File name:

Fiery Driver Updater.exe

Full analysis: https://app.any.run/tasks/2e1c785d-a24f-497a-ac75-b1365b539aeb
Verdict: Malicious activity
Analysis date: May 08, 2024, 11:35:55
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386, for MS Windows, RAR self-extracting archive
MD5:

A7F35D7E469FB2ABC56FBE38749F5694

SHA1:

5E8B53A69049C531B7CE1A7864292C670348482B

SHA256:

06FE430DC95746C387541AAE303A1692EBC9538DEC3EE8A97758D0E528A2134F

SSDEEP:

98304:KAaTqvpbtRBIcAOK+OO5WQyaZrvppvOqK/MarBlSdgGSOrBSEfgSfMajegSqn0DI:dxWwL1pAUX2dE7HEoD

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Drops the executable file immediately after the start

      • Fiery Driver Updater.exe (PID: 4012)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • Fiery Driver Updater.exe (PID: 4012)

    • Process drops legitimate windows executable

      • Fiery Driver Updater.exe (PID: 4012)

    • Reads the Internet Settings

      • Fiery Driver Updater.exe (PID: 4012)
      • Fiery Driver Updater.exe (PID: 1064)

    • Reads security settings of Internet Explorer

      • Fiery Driver Updater.exe (PID: 4012)

    • The process drops C-runtime libraries

      • Fiery Driver Updater.exe (PID: 4012)

    • Uses NETSH.EXE to delete a firewall rule or allowed programs

      • Fiery Driver Updater.exe (PID: 1064)

    • Uses NETSH.EXE to add a firewall rule or allowed programs

      • Fiery Driver Updater.exe (PID: 1064)

  • INFO

    • Reads the computer name

      • Fiery Driver Updater.exe (PID: 4012)
      • Fiery Driver Updater.exe (PID: 1064)
      • wmpnscfg.exe (PID: 1616)
      • curl.exe (PID: 2252)
      • curl.exe (PID: 284)

    • Checks supported languages

      • Fiery Driver Updater.exe (PID: 4012)
      • Fiery Driver Updater.exe (PID: 1064)
      • curl.exe (PID: 284)
      • curl.exe (PID: 2252)
      • wmpnscfg.exe (PID: 1616)

    • Create files in a temporary directory

      • Fiery Driver Updater.exe (PID: 4012)

    • Creates files in the program directory

      • Fiery Driver Updater.exe (PID: 1064)

    • Checks proxy server information

      • Fiery Driver Updater.exe (PID: 1064)

    • Creates files or folders in the user directory

      • Fiery Driver Updater.exe (PID: 1064)
      • curl.exe (PID: 284)

    • Reads the machine GUID from the registry

      • Fiery Driver Updater.exe (PID: 1064)
      • curl.exe (PID: 284)
      • curl.exe (PID: 2252)

    • Manual execution by a user

      • wmpnscfg.exe (PID: 1616)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win32 Executable MS Visual C++ (generic) (67.4)
.dll | Win32 Dynamic Link Library (generic) (14.2)
.exe | Win32 Executable (generic) (9.7)
.exe | Generic Win/DOS Executable (4.3)
.exe | DOS Executable Generic (4.3)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2014:08:27 16:40:54+00:00
ImageFileCharacteristics: No relocs, Executable, 32-bit
PEType: PE32
LinkerVersion: 9
CodeSize: 165888
InitializedDataSize: 468480
UninitializedDataSize: -
EntryPoint: 0x1d62b
OSVersion: 5
ImageVersion: -
SubsystemVersion: 5
Subsystem: Windows GUI
FileVersionNumber: 1.1.0.3
ProductVersionNumber: 1.1.0.3
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Windows NT 32-bit
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: English (U.S.)
CharacterSet: Unicode
CompanyName: Electronics For Imaging, Inc.
FileDescription: Fiery Printer Driver Updater Module
FileVersion: 1.1.0.4
InternalName: FPDU.exe
LegalCopyright: Copyright © 1999-2015, Electronics For Imaging, Inc. All rights reserved.
OriginalFileName: FPDU.exe
ProductName: Fiery Printer Driver Updater
ProductVersion: 1.1.0.4
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
49
Monitored processes
9
Malicious processes
1
Suspicious processes
1

Behavior graph

Click at the process to see the details
start fiery driver updater.exe fiery driver updater.exe no specs fiery driver updater.exe netsh.exe no specs netsh.exe no specs schtasks.exe no specs wmpnscfg.exe no specs curl.exe curl.exe

Process information

PID
CMD
Path
Indicators
Parent process
284updater_lib\Win\curl.exe -s --insecure --output "C:\Users\admin\AppData\Roaming\Fiery Driver Updater\ProductMaster.xml" "https://d1umxs9ckzarso.cloudfront.net/Products/FieryDriver/FD51/ProductMaster/ProductMaster.xml"C:\Users\admin\AppData\Local\Temp\RarSFX0\FDU\updater_lib\Win\curl.exe
Fiery Driver Updater.exe
User:
admin
Company:
cURL, http://curl.haxx.se/
Integrity Level:
HIGH
Description:
The cURL executable
Exit code:
0
Version:
7.19.3
Modules
Images
c:\users\admin\appdata\local\temp\rarsfx0\fdu\updater_lib\win\curl.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\users\admin\appdata\local\temp\rarsfx0\fdu\updater_lib\win\curllib.dll
c:\windows\system32\ws2_32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\nsi.dll
c:\users\admin\appdata\local\temp\rarsfx0\fdu\updater_lib\win\ssleay32.dll
1064"C:\Users\admin\AppData\Local\Temp\RarSFX0\FDU\Fiery Driver Updater.exe" C:\Users\admin\AppData\Local\Temp\RarSFX0\FDU\Fiery Driver Updater.exe
Fiery Driver Updater.exe
User:
admin
Company:
Electronics For Imaging, Inc.
Integrity Level:
HIGH
Description:
Fiery Printer Driver Updater Module
Version:
1.1.0.3
Modules
Images
c:\users\admin\appdata\local\temp\rarsfx0\fdu\fiery driver updater.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\comdlg32.dll
1432netsh advfirewall firewall add rule name="FierySoftwareManager" dir=in action=allow program="C:\Users\admin\AppData\Local\Temp\RarSFX0\FDU\Fiery Driver Updater.exe" enable=yesC:\Windows\System32\netsh.exe—Fiery Driver Updater.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Network Command Shell
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\netsh.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\credui.dll
c:\windows\system32\user32.dll
1616"C:\Program Files\Windows Media Player\wmpnscfg.exe"C:\Program Files\Windows Media Player\wmpnscfg.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Media Player Network Sharing Service Configuration Application
Exit code:
0
Version:
12.0.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\program files\windows media player\wmpnscfg.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
1764SchTasks /Create /F /RL HIGHEST /RU Administrators /SC DAILY /TN FPDUDaily /TR "'C:\Program Files\FPDU\Fiery Driver Updater.exe' -s -sp"'-showonupdate"'" /ST 12:36:10C:\Windows\System32\schtasks.exe—Fiery Driver Updater.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Manages scheduled tasks
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\schtasks.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\ole32.dll
2116netsh advfirewall firewall delete rule name="FierySoftwareManager"C:\Windows\System32\netsh.exe—Fiery Driver Updater.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Network Command Shell
Exit code:
1
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\netsh.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\credui.dll
c:\windows\system32\user32.dll
2252updater_lib\Win\curl.exe -s --insecure --output "C:\Users\admin\AppData\Roaming\Fiery Driver Updater\ProductMaster.xml" "https://d1umxs9ckzarso.cloudfront.net/Products/FieryDriver/FD51/ProductMaster/ProductMaster.xml"C:\Users\admin\AppData\Local\Temp\RarSFX0\FDU\updater_lib\Win\curl.exe
Fiery Driver Updater.exe
User:
admin
Company:
cURL, http://curl.haxx.se/
Integrity Level:
HIGH
Description:
The cURL executable
Version:
7.19.3
Modules
Images
c:\users\admin\appdata\local\temp\rarsfx0\fdu\updater_lib\win\curl.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\users\admin\appdata\local\temp\rarsfx0\fdu\updater_lib\win\curllib.dll
c:\windows\system32\ws2_32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\nsi.dll
c:\users\admin\appdata\local\temp\rarsfx0\fdu\updater_lib\win\ssleay32.dll
4012"C:\Users\admin\Desktop\Fiery Driver Updater.exe" C:\Users\admin\Desktop\Fiery Driver Updater.exe
explorer.exe
User:
admin
Company:
Electronics For Imaging, Inc.
Integrity Level:
MEDIUM
Description:
Fiery Printer Driver Updater Module
Version:
1.1.0.4
Modules
Images
c:\users\admin\desktop\fiery driver updater.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.24483_none_2b200f664577e14b\comctl32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
4040"C:\Users\admin\AppData\Local\Temp\RarSFX0\FDU\Fiery Driver Updater.exe" C:\Users\admin\AppData\Local\Temp\RarSFX0\FDU\Fiery Driver Updater.exe—Fiery Driver Updater.exe
User:
admin
Company:
Electronics For Imaging, Inc.
Integrity Level:
MEDIUM
Description:
Fiery Printer Driver Updater Module
Exit code:
3221226540
Version:
1.1.0.3
Modules
Images
c:\users\admin\appdata\local\temp\rarsfx0\fdu\fiery driver updater.exe
c:\windows\system32\ntdll.dll
Total events
4 998
Read events
4 882
Write events
116
Delete events
0

Modification events

(PID) Process:(4012) Fiery Driver Updater.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
(PID) Process:(4012) Fiery Driver Updater.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:IntranetName
Value:
1
(PID) Process:(4012) Fiery Driver Updater.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
1
(PID) Process:(4012) Fiery Driver Updater.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
0
(PID) Process:(2116) netsh.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\182\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(2116) netsh.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\182\52C64B7E
Operation:writeName:@%SystemRoot%\system32\dhcpqec.dll,-100
Value:
DHCP Quarantine Enforcement Client
(PID) Process:(2116) netsh.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\182\52C64B7E
Operation:writeName:@%SystemRoot%\system32\dhcpqec.dll,-101
Value:
Provides DHCP based enforcement for NAP
(PID) Process:(2116) netsh.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\182\52C64B7E
Operation:writeName:@%SystemRoot%\system32\dhcpqec.dll,-103
Value:
1.0
(PID) Process:(2116) netsh.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\182\52C64B7E
Operation:writeName:@%SystemRoot%\system32\dhcpqec.dll,-102
Value:
Microsoft Corporation
(PID) Process:(2116) netsh.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\182\52C64B7E
Operation:writeName:@%SystemRoot%\system32\napipsec.dll,-1
Value:
IPsec Relying Party
Executable files
29
Suspicious files
17
Text files
70
Unknown types
3

Dropped files

PID
Process
Filename
Type
4012Fiery Driver Updater.exeC:\Users\admin\AppData\Local\Temp\RarSFX0\FDU\msvcr120.dllexecutable
MD5:034CCADC1C073E4216E9466B720F9849
SHA256:86E39B5995AF0E042FCDAA85FE2AEFD7C9DDC7AD65E6327BD5E7058BC3AB615F
4012Fiery Driver Updater.exeC:\Users\admin\AppData\Local\Temp\RarSFX0\FDU\Microsoft.VC90.CRT\msvcm90.dllexecutable
MD5:4A8BC195ABDC93F0DB5DAB7F5093C52F
SHA256:B371AF3CE6CB5D0B411919A188D5274DF74D5EE49F6DD7B1CCB5A31466121A18
4012Fiery Driver Updater.exeC:\Users\admin\AppData\Local\Temp\RarSFX0\FDU\mfc120u.dllexecutable
MD5:F4F2A4C459DD3AA22DD3984D13B15746
SHA256:C2D0E285E2333A9C620BE04A5747881AF0D5615DA32226886E659FF31A9761CC
4012Fiery Driver Updater.exeC:\Users\admin\AppData\Local\Temp\RarSFX0\FDU\Microsoft.VC90.CRT\msvcr90.dllexecutable
MD5:E7D91D008FE76423962B91C43C88E4EB
SHA256:ED0170D3DE86DA33E02BFA1605EEC8FF6010583481B1C530843867C1939D2185
4012Fiery Driver Updater.exeC:\Users\admin\AppData\Local\Temp\RarSFX0\FDU\Microsoft.VC90.CRT\msvcp90.dllexecutable
MD5:6DE5C66E434A9C1729575763D891C6C2
SHA256:4F7ED27B532888CE72B96E52952073EAB2354160D1156924489054B7FA9B0B1A
4012Fiery Driver Updater.exeC:\Users\admin\AppData\Local\Temp\RarSFX0\FDU\msvcp120.dllexecutable
MD5:FD5CABBE52272BD76007B68186EBAF00
SHA256:87C42CA155473E4E71857D03497C8CBC28FA8FF7F2C8D72E8A1F39B71078F608
4012Fiery Driver Updater.exeC:\Users\admin\AppData\Local\Temp\RarSFX0\FDU\cfscore.dllexecutable
MD5:3590367B578D1ED91DA5729B33C21909
SHA256:DFAECCCE32B8BE9C626911D4A4DE6D67909A0BA22FA6CBF47E133CE971F4D70F
4012Fiery Driver Updater.exeC:\Users\admin\AppData\Local\Temp\RarSFX0\FDU\updater_lib\Common\Images\FEA_small.pngimage
MD5:21FA7576BFD2341555E75C7F79380215
SHA256:253F6C67F8A92E49EA3CEE123DA6A14D12CE667A8ECADC5C5CEA2B91DE05591D
4012Fiery Driver Updater.exeC:\Users\admin\AppData\Local\Temp\RarSFX0\FDU\Microsoft.VC90.CRT\Microsoft.VC90.CRT.manifestxml
MD5:6BB5D2AAD0AE1B4A82E7DDF7CF58802A
SHA256:9E0220511D4EBDB014CC17ECB8319D57E3B0FEA09681A80D8084AA8647196582
4012Fiery Driver Updater.exeC:\Users\admin\AppData\Local\Temp\RarSFX0\FDU\vccorlib120.dllexecutable
MD5:69837E50C50561A083A72A5F8EA1F6A2
SHA256:9C9D4E421C55F7EF4E455E75B58A6639428CCD75C76E5717F448AFE4C21C52BC
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
3
TCP/UDP connections
12
DNS requests
3
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
1064
Fiery Driver Updater.exe
POST
200
192.68.228.46:80
http://liveupdate.efi.com/des/hypatia.asmx
unknown
—
—
unknown
1064
Fiery Driver Updater.exe
POST
200
192.68.228.46:80
http://liveupdate.efi.com/des/hypatia.asmx
unknown
—
—
unknown
1064
Fiery Driver Updater.exe
POST
200
192.68.228.46:80
http://liveupdate.efi.com/des/hypatia.asmx
unknown
—
—
unknown
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:138
—
—
—
unknown
—
—
224.0.0.252:5355
—
—
—
unknown
4
System
192.168.100.255:137
—
—
—
whitelisted
1064
Fiery Driver Updater.exe
192.68.228.46:80
liveupdate.efi.com
ELECFORIMAG
US
unknown
284
curl.exe
18.66.137.3:443
d1umxs9ckzarso.cloudfront.net
AMAZON-02
US
unknown
2252
curl.exe
18.66.137.191:443
d1umxs9ckzarso.cloudfront.net
AMAZON-02
US
unknown

DNS requests

Domain
IP
Reputation
liveupdate.efi.com
  • 192.68.228.46
unknown
d1umxs9ckzarso.cloudfront.net
  • 18.66.137.3
  • 18.66.137.191
  • 18.66.137.73
  • 18.66.137.20
whitelisted

Threats

No threats detected
Process
Message
Fiery Driver Updater.exe
UpdaterApp::OnInit(): -> Preference first time initialized to Notify updates
Fiery Driver Updater.exe
LAUNCHED: Fiery Driver Updater::1.1.0.003
Fiery Driver Updater.exe
UUID:: 5752a83a4afa4c7cb98482abaa8ab314
Fiery Driver Updater.exe
Retrieving preferences from file.
Fiery Driver Updater.exe
Checking for updates...
Fiery Driver Updater.exe
GRAD:liveupdate.efi.com
Fiery Driver Updater.exe
Checking GRAD for ProductMaster module...
Fiery Driver Updater.exe
fdu_version=1.1.0.003|uid=5752a83a4afa4c7cb98482abaa8ab314|passport_id=|passport_pref=|os_version=6.1|os_type=win32|os_lang=en_US|codebase=|workstation=1|fdu_pref=StartAtLogin,AutoDownload,NotifyAll,Analytics
Fiery Driver Updater.exe
Will call GradInterface.dll
Fiery Driver Updater.exe
ProductMaster request from GRAD:: Status=0, NumModules=2
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
Fiery Driver Updater.exe