File name:

Gaomon Windows Driver_v14.7.105.346.zip

Full analysis: https://app.any.run/tasks/0073b8ab-c8c1-4b83-94d8-3ca62c2114c9
Verdict: Malicious activity
Analysis date: July 19, 2019, 02:02:27
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: application/zip
File info: Zip archive data, at least v1.0 to extract
MD5:

A6FA126B608B41E1BD35F515CA3317E1

SHA1:

A620EEB9B60555913EB39DB6EC5B7A373A99B0FF

SHA256:

04B5E206BF14E46227D12A8105CD04EC7BBAFEF84C4A046F3DC9315EB95A5FBA

SSDEEP:

196608:tiguCcAUj8ifqOOZJYQasTN86uu7+y51qMT+QusL3JcJtguYG:tYOw8ukZV5N86uGqMT+JE3JcJ1YG

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Application was dropped or rewritten from another process

      • Listdlls.exe (PID: 3920)
      • Listdlls.exe (PID: 3800)
      • devcon.exe (PID: 864)
      • dpinst.exe (PID: 3376)
      • Gaomon Tablet.exe (PID: 1684)
      • Gaomon Tablet.exe (PID: 3016)
      • Gaomon Tablet.exe (PID: 3024)

    • Changes the autorun value in the registry

      • Gaomon Windows Driver_v14.7.105.346.tmp (PID: 1188)

    • Loads dropped or rewritten executable

      • Gaomon Tablet.exe (PID: 1684)
      • Gaomon Tablet.exe (PID: 3024)
      • Gaomon Tablet.exe (PID: 3016)

    • Changes settings of System certificates

      • Gaomon Tablet.exe (PID: 1684)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • Gaomon Windows Driver_v14.7.105.346.exe (PID: 3776)
      • Gaomon Windows Driver_v14.7.105.346.tmp (PID: 1188)
      • DrvInst.exe (PID: 3156)
      • dpinst.exe (PID: 3376)
      • devcon.exe (PID: 864)
      • DrvInst.exe (PID: 3632)

    • Reads Windows owner or organization settings

      • Gaomon Windows Driver_v14.7.105.346.tmp (PID: 1188)

    • Reads the Windows organization settings

      • Gaomon Windows Driver_v14.7.105.346.tmp (PID: 1188)

    • Starts CMD.EXE for commands execution

      • Gaomon Windows Driver_v14.7.105.346.tmp (PID: 1188)
      • cmd.exe (PID: 3976)
      • cmd.exe (PID: 3900)

    • Uses TASKKILL.EXE to kill process

      • cmd.exe (PID: 4012)
      • cmd.exe (PID: 2996)

    • Creates files in the Windows directory

      • Gaomon Windows Driver_v14.7.105.346.tmp (PID: 1188)
      • dpinst.exe (PID: 3376)
      • DrvInst.exe (PID: 3156)
      • DrvInst.exe (PID: 2556)
      • DrvInst.exe (PID: 3632)

    • Application launched itself

      • cmd.exe (PID: 3976)
      • cmd.exe (PID: 3900)
      • Gaomon Tablet.exe (PID: 3016)

    • Removes files from Windows directory

      • DrvInst.exe (PID: 3156)
      • DrvInst.exe (PID: 2556)
      • DrvInst.exe (PID: 3632)

    • Executed via COM

      • DrvInst.exe (PID: 3156)
      • DrvInst.exe (PID: 2556)
      • DrvInst.exe (PID: 856)
      • DrvInst.exe (PID: 2064)
      • DrvInst.exe (PID: 3040)
      • DrvInst.exe (PID: 2948)
      • rundll32.exe (PID: 2796)
      • rundll32.exe (PID: 640)
      • DrvInst.exe (PID: 3632)

    • Creates files in the program directory

      • dpinst.exe (PID: 3376)

    • Creates files in the driver directory

      • DrvInst.exe (PID: 3156)
      • DrvInst.exe (PID: 2556)
      • DrvInst.exe (PID: 3632)

    • Creates a software uninstall entry

      • dpinst.exe (PID: 3376)

    • Adds / modifies Windows certificates

      • Gaomon Tablet.exe (PID: 1684)

    • Starts Internet Explorer

      • Gaomon Tablet.exe (PID: 1684)

  • INFO

    • Manual execution by user

      • Gaomon Windows Driver_v14.7.105.346.exe (PID: 3060)
      • Gaomon Windows Driver_v14.7.105.346.exe (PID: 3776)
      • Gaomon Tablet.exe (PID: 3016)

    • Loads dropped or rewritten executable

      • Gaomon Windows Driver_v14.7.105.346.tmp (PID: 1188)

    • Application was dropped or rewritten from another process

      • Gaomon Windows Driver_v14.7.105.346.tmp (PID: 1188)

    • Creates files in the program directory

      • Gaomon Windows Driver_v14.7.105.346.tmp (PID: 1188)

    • Creates a software uninstall entry

      • Gaomon Windows Driver_v14.7.105.346.tmp (PID: 1188)

    • Changes internet zones settings

      • iexplore.exe (PID: 3820)

    • Creates files in the user directory

      • iexplore.exe (PID: 3024)

    • Reads internet explorer settings

      • iexplore.exe (PID: 3024)

    • Reads Internet Cache Settings

      • iexplore.exe (PID: 3024)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.zip | ZIP compressed archive (100)

EXIF

ZIP

ZipRequiredVersion: 10
ZipBitFlag: -
ZipCompression: None
ZipModifyDate: 2019:04:15 12:04:00
ZipCRC: 0x00000000
ZipCompressedSize: -
ZipUncompressedSize: -
ZipFileName: Gaomon Windows Driver_v14.7.105.346/
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
93
Monitored processes
43
Malicious processes
12
Suspicious processes
0

Behavior graph

Click at the process to see the details
start drop and start drop and start drop and start drop and start winrar.exe no specs gaomon windows driver_v14.7.105.346.exe no specs gaomon windows driver_v14.7.105.346.exe gaomon windows driver_v14.7.105.346.tmp cmd.exe no specs taskkill.exe no specs cmd.exe no specs taskkill.exe no specs cmd.exe no specs cmd.exe no specs listdlls.exe no specs cmd.exe no specs find.exe no specs cmd.exe no specs find.exe no specs cmd.exe no specs find.exe no specs cmd.exe no specs cacls.exe no specs cmd.exe no specs listdlls.exe no specs cmd.exe no specs find.exe no specs cmd.exe no specs find.exe no specs cmd.exe no specs find.exe no specs dpinst.exe drvinst.exe devcon.exe drvinst.exe no specs drvinst.exe drvinst.exe no specs drvinst.exe no specs drvinst.exe no specs drvinst.exe no specs rundll32.exe no specs rundll32.exe no specs gaomon tablet.exe gaomon tablet.exe no specs gaomon tablet.exe iexplore.exe iexplore.exe

Process information

PID
CMD
Path
Indicators
Parent process
280C:\Windows\system32\cmd.exe /S /D /c" echo Sysinternals - www.sysinternals.com "C:\Windows\system32\cmd.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\cmd.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\winbrand.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
300"C:\Windows\system32\cacls.exe" "C:\Windows\system32\config\system" C:\Windows\system32\cacls.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Control ACLs Program
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\cacls.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
476C:\Windows\system32\cmd.exe /S /D /c" echo ListDLLs v3.1 - List loaded DLLs "C:\Windows\system32\cmd.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\cmd.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\winbrand.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
640C:\Windows\System32\rundll32.exe shell32.dll,SHCreateLocalServerRunDll {995C996E-D918-4a8c-A302-45719A6F4EA7} -EmbeddingC:\Windows\System32\rundll32.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows host process (Rundll32)
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\rundll32.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\imagehlp.dll
856DrvInst.exe "1" "200" "HID\tablethid&Col02\1&2d595ca7&0&0001" "" "" "6d952b023" "00000000" "000005E0" "000005EC"C:\Windows\system32\DrvInst.exe—svchost.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Driver Installation Module
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\drvinst.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\setupapi.dll
c:\windows\system32\cfgmgr32.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
864"C:\Gaomon Tablet\driver\GaomonHID\i386\devcon.exe" /r INSTALL vmulti.inf "gaomon\tablethid"C:\Gaomon Tablet\driver\GaomonHID\i386\devcon.exe
Gaomon Windows Driver_v14.7.105.346.tmp
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Setup API
Exit code:
0
Version:
6.1.7600.16385 (win7_wdk.100208-1538)
Modules
Images
c:\gaomon tablet\driver\gaomonhid\i386\devcon.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\ole32.dll
c:\windows\system32\gdi32.dll
1188"C:\Users\admin\AppData\Local\Temp\is-0DMKF.tmp\Gaomon Windows Driver_v14.7.105.346.tmp" /SL5="$6014E,8553060,181760,C:\Users\admin\Desktop\Gaomon Windows Driver_v14.7.105.346\Gaomon Windows Driver_v14.7.105.346.exe" C:\Users\admin\AppData\Local\Temp\is-0DMKF.tmp\Gaomon Windows Driver_v14.7.105.346.tmp
Gaomon Windows Driver_v14.7.105.346.exe
User:
admin
Integrity Level:
HIGH
Description:
Setup/Uninstall
Exit code:
0
Version:
51.1052.0.0
Modules
Images
c:\users\admin\appdata\local\temp\is-0dmkf.tmp\gaomon windows driver_v14.7.105.346.tmp
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\ole32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
1532find "pid:" C:\Windows\system32\find.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Find String (grep) Utility
Exit code:
1
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\find.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\ulib.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
1684"C:\Gaomon Tablet\Gaomon Tablet.exe"C:\Gaomon Tablet\Gaomon Tablet.exe
Gaomon Windows Driver_v14.7.105.346.tmp
User:
admin
Integrity Level:
HIGH
Description:
TabletOEM
Exit code:
0
Version:
1.0.0.0
Modules
Images
c:\gaomon tablet\gaomon tablet.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\microsoft.net\framework\v4.0.30319\mscoreei.dll
2064DrvInst.exe "1" "200" "HID\tablethid&Col04\1&2d595ca7&0&0003" "" "" "65df2711f" "00000000" "00000628" "00000604"C:\Windows\system32\DrvInst.exe—svchost.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Driver Installation Module
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\drvinst.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\setupapi.dll
c:\windows\system32\cfgmgr32.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\sechost.dll
Total events
1 467
Read events
1 203
Write events
257
Delete events
7

Modification events

(PID) Process:(3576) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtBMP
Value:
(PID) Process:(3576) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtIcon
Value:
(PID) Process:(3576) WinRAR.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\70\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(3576) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\AppData\Local\Temp\Gaomon Windows Driver_v14.7.105.346.zip
(PID) Process:(3576) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(3576) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(3576) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
(PID) Process:(3576) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:mtime
Value:
100
(PID) Process:(1188) Gaomon Windows Driver_v14.7.105.346.tmpKey:HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0000
Operation:writeName:Owner
Value:
A4040000289CDA1BD63DD501
(PID) Process:(1188) Gaomon Windows Driver_v14.7.105.346.tmpKey:HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0000
Operation:writeName:SessionHash
Value:
97A44FB82DE53E3B4A79E818BAD6A913042F31C698D04202C566067974D953EF
Executable files
74
Suspicious files
31
Text files
398
Unknown types
39

Dropped files

PID
Process
Filename
Type
3576WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa3576.28106\Gaomon Windows Driver_v14.7.105.346\Gaomon Windows Driver_v14.7.105.346.exe —
MD5:—
SHA256:—
1188Gaomon Windows Driver_v14.7.105.346.tmpC:\Gaomon Tablet\is-IAEUI.tmp —
MD5:—
SHA256:—
1188Gaomon Windows Driver_v14.7.105.346.tmpC:\Gaomon Tablet\is-ENN7V.tmp —
MD5:—
SHA256:—
1188Gaomon Windows Driver_v14.7.105.346.tmpC:\Gaomon Tablet\is-PUUS7.tmp —
MD5:—
SHA256:—
1188Gaomon Windows Driver_v14.7.105.346.tmpC:\Gaomon Tablet\is-R93RQ.tmp —
MD5:—
SHA256:—
1188Gaomon Windows Driver_v14.7.105.346.tmpC:\Gaomon Tablet\is-CRUT0.tmp —
MD5:—
SHA256:—
1188Gaomon Windows Driver_v14.7.105.346.tmpC:\Gaomon Tablet\is-L5OJ8.tmp —
MD5:—
SHA256:—
1188Gaomon Windows Driver_v14.7.105.346.tmpC:\Gaomon Tablet\is-N8TJK.tmp —
MD5:—
SHA256:—
1188Gaomon Windows Driver_v14.7.105.346.tmpC:\Gaomon Tablet\is-6CLBQ.tmp —
MD5:—
SHA256:—
1188Gaomon Windows Driver_v14.7.105.346.tmpC:\Gaomon Tablet\is-21DK1.tmp —
MD5:—
SHA256:—
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
4
TCP/UDP connections
47
DNS requests
6
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
3024
iexplore.exe
GET
301
47.88.32.48:80
http://www.gaomon.net/
US
html
295 b
unknown
3820
iexplore.exe
GET
200
204.79.197.200:80
http://www.bing.com/favicon.ico
US
image
237 b
whitelisted
1684
Gaomon Tablet.exe
GET
200
2.16.106.186:80
http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/8CF427FD790C3AD166068DE81E57EFBB932272D4.crt
unknown
der
1.06 Kb
whitelisted
1684
Gaomon Tablet.exe
GET
200
2.16.106.186:80
http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
unknown
compressed
56.3 Kb
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
1684
Gaomon Tablet.exe
2.16.106.186:80
www.download.windowsupdate.com
Akamai International B.V.
—
whitelisted
3820
iexplore.exe
204.79.197.200:80
www.bing.com
Microsoft Corporation
US
whitelisted
3024
iexplore.exe
47.88.32.48:80
www.gaomon.net
Alibaba (China) Technology Co., Ltd.
US
unknown
3024
iexplore.exe
47.88.32.48:443
www.gaomon.net
Alibaba (China) Technology Co., Ltd.
US
unknown
3024
iexplore.exe
104.20.243.79:443
embed.tawk.to
Cloudflare Inc
US
shared
3024
iexplore.exe
172.217.22.110:443
www.google-analytics.com
Google Inc.
US
whitelisted
3024
iexplore.exe
172.217.23.168:443
www.googletagmanager.com
Google Inc.
US
whitelisted

DNS requests

Domain
IP
Reputation
www.download.windowsupdate.com
  • 2.16.106.186
  • 2.16.106.233
whitelisted
www.gaomon.net
  • 47.88.32.48
unknown
www.bing.com
  • 204.79.197.200
  • 13.107.21.200
whitelisted
embed.tawk.to
  • 104.20.243.79
  • 104.20.242.79
whitelisted
www.googletagmanager.com
  • 172.217.23.168
whitelisted
www.google-analytics.com
  • 172.217.22.110
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
Gaomon Windows Driver_v14.7.105.346.zip