| File name: | VolDrvConfig.exe |
| Full analysis: | https://app.any.run/tasks/827d9e41-4dd7-46d6-8e8e-d838679c9a16 |
| Verdict: | Malicious activity |
| Threats: | A loader is malicious software that infiltrates devices to deliver malicious payloads. This malware is capable of infecting victims’ computers, analyzing their system information, and installing other types of threats, such as trojans or stealers. Criminals usually deliver loaders through phishing emails and links by relying on social engineering to trick users into downloading and running their executables. Loaders employ advanced evasion and persistence tactics to avoid detection. |
| Analysis date: | January 14, 2025, 07:54:11 |
| OS: | Windows 10 Professional (build: 19045, 64 bit) |
| Tags: | |
| Indicators: | |
| MIME: | application/vnd.microsoft.portable-executable |
| File info: | PE32 executable (GUI) Intel 80386, for MS Windows, 3 sections |
| MD5: | A7F8236EB39605D51964BF50FD015332 |
| SHA1: | C627B0F52FA94BFEFA7A7D17056F82F00737876C |
| SHA256: | 1B5B8D4000174658B280D11CE9143D60AC3DB44B9885F35545C3B6C9AEB5AC13 |
| SSDEEP: | 3072:yr/hMNfDU6NP/mAyp/8+62bSKI2agi1+iv5kHJoSEvD4jsBb9d4otpNtATg46K8Q:7tnToIKYZ |
MALICIOUS
Changes the autorun value in the registry
- VolDrvConfig.exe (PID: 5652)
Adds path to the Windows Defender exclusion list
- sysarddrvs.exe (PID: 5540)
- cmd.exe (PID: 6224)
Changes appearance of the Explorer extensions
- sysarddrvs.exe (PID: 5540)
Changes Security Center notification settings
- sysarddrvs.exe (PID: 5540)
PHORPIEX has been detected (SURICATA)
- sysarddrvs.exe (PID: 5540)
PHORPIEX has been found (auto)
- 126832248.exe (PID: 6856)
PHORPIEX has been detected (YARA)
- sysarddrvs.exe (PID: 5540)
Connects to the CnC server
- sysarddrvs.exe (PID: 5540)
Actions looks like stealing of personal data
- 77378756.exe (PID: 4876)
- 3127917339.exe (PID: 6984)
Changes the Windows auto-update feature
- sysarddrvs.exe (PID: 5540)
SUSPICIOUS
Executable content was dropped or overwritten
- VolDrvConfig.exe (PID: 5652)
- 126832248.exe (PID: 6856)
- 77378756.exe (PID: 4876)
Starts itself from another location
- VolDrvConfig.exe (PID: 5652)
Reads security settings of Internet Explorer
- sysarddrvs.exe (PID: 5540)
- 126832248.exe (PID: 6856)
Starts CMD.EXE for commands execution
- sysarddrvs.exe (PID: 5540)
Manipulates environment variables
- powershell.exe (PID: 6344)
Stops a currently running service
- sc.exe (PID: 6376)
- sc.exe (PID: 6336)
Script adds exclusion path to Windows Defender
- cmd.exe (PID: 6224)
Starts POWERSHELL.EXE for commands execution
- cmd.exe (PID: 6224)
Potential Corporate Privacy Violation
- 126832248.exe (PID: 6856)
Connects to the server without a host name
- 126832248.exe (PID: 6856)
- sysarddrvs.exe (PID: 5540)
Process requests binary or script from the Internet
- 126832248.exe (PID: 6856)
INFO
Failed to create an executable file in Windows directory
- VolDrvConfig.exe (PID: 5652)
Checks supported languages
- VolDrvConfig.exe (PID: 5652)
- sysarddrvs.exe (PID: 5540)
- 126832248.exe (PID: 6856)
- 3127917339.exe (PID: 6984)
The process uses the downloaded file
- VolDrvConfig.exe (PID: 5652)
- sysarddrvs.exe (PID: 5540)
- 126832248.exe (PID: 6856)
- powershell.exe (PID: 6344)
Reads the computer name
- sysarddrvs.exe (PID: 5540)
- 126832248.exe (PID: 6856)
Process checks computer location settings
- sysarddrvs.exe (PID: 5540)
Creates files or folders in the user directory
- sysarddrvs.exe (PID: 5540)
- 126832248.exe (PID: 6856)
Checks proxy server information
- sysarddrvs.exe (PID: 5540)
Create files in a temporary directory
- sysarddrvs.exe (PID: 5540)
- 3127917339.exe (PID: 6984)
- 126832248.exe (PID: 6856)
Checks if a key exists in the options dictionary (POWERSHELL)
- powershell.exe (PID: 6344)
Script raised an exception (POWERSHELL)
- powershell.exe (PID: 6344)
Drops encrypted VBS script (Microsoft Script Encoder)
- 77378756.exe (PID: 4876)
The sample compiled with english language support
- 77378756.exe (PID: 4876)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
TRiD
| .exe | | | Win64 Executable (generic) (64.6) |
|---|---|---|
| .dll | | | Win32 Dynamic Link Library (generic) (15.4) |
| .exe | | | Win32 Executable (generic) (10.5) |
| .exe | | | Generic Win/DOS Executable (4.6) |
| .exe | | | DOS Executable Generic (4.6) |
EXIF
EXE
| MachineType: | Intel 386 or later, and compatibles |
|---|---|
| TimeStamp: | 2024:07:17 14:05:21+00:00 |
| ImageFileCharacteristics: | No relocs, Executable, 32-bit |
| PEType: | PE32 |
| LinkerVersion: | 9 |
| CodeSize: | 59904 |
| InitializedDataSize: | 24576 |
| UninitializedDataSize: | - |
| EntryPoint: | 0x7510 |
| OSVersion: | 5 |
| ImageVersion: | - |
| SubsystemVersion: | 5 |
| Subsystem: | Windows GUI |
Total processes
140
Monitored processes
12
Malicious processes
5
Suspicious processes
1
Behavior graph
Click at the process to see the details
Process information
PID | CMD | Path | Indicators | Parent process | |||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 4876 | C:\Users\admin\AppData\Local\Temp\77378756.exe | C:\Users\admin\AppData\Local\Temp\77378756.exe | 126832248.exe | ||||||||||||
User: admin Integrity Level: MEDIUM Modules
| |||||||||||||||
| 5540 | C:\Users\admin\sysarddrvs.exe | C:\Users\admin\sysarddrvs.exe | VolDrvConfig.exe | ||||||||||||
User: admin Integrity Level: MEDIUM Modules
| |||||||||||||||
| 5652 | "C:\Users\admin\AppData\Local\Temp\VolDrvConfig.exe" | C:\Users\admin\AppData\Local\Temp\VolDrvConfig.exe | explorer.exe | ||||||||||||
User: admin Integrity Level: MEDIUM Exit code: 0 Modules
| |||||||||||||||
| 6224 | "C:\Windows\System32\cmd.exe" /c powershell -Command "Add-MpPreference -ExclusionPath $env:windir; Add-MpPreference -ExclusionPath $env:TEMP; Add-MpPreference -ExclusionPath $env:USERPROFILE" | C:\Windows\SysWOW64\cmd.exe | — | sysarddrvs.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows Command Processor Exit code: 1 Version: 10.0.19041.3636 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 6232 | \??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1 | C:\Windows\System32\conhost.exe | — | cmd.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Console Window Host Exit code: 0 Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 6240 | "C:\Windows\System32\cmd.exe" /c sc stop UsoSvc & sc stop WaaSMedicSvc & sc stop wuauserv & sc stop DoSvc & sc stop BITS | C:\Windows\SysWOW64\cmd.exe | — | sysarddrvs.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows Command Processor Version: 10.0.19041.3636 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 6264 | \??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1 | C:\Windows\System32\conhost.exe | — | cmd.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Console Window Host Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 6336 | sc stop UsoSvc | C:\Windows\SysWOW64\sc.exe | — | cmd.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Service Control Manager Configuration Tool Exit code: 5 Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 6344 | powershell -Command "Add-MpPreference -ExclusionPath $env:windir; Add-MpPreference -ExclusionPath $env:TEMP; Add-MpPreference -ExclusionPath $env:USERPROFILE" | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | — | cmd.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows PowerShell Exit code: 1 Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 6376 | sc stop WaaSMedicSvc | C:\Windows\SysWOW64\sc.exe | — | cmd.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Service Control Manager Configuration Tool Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
Total events
6 409
Read events
6 392
Write events
17
Delete events
0
Modification events
| (PID) Process: | (5652) VolDrvConfig.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run |
| Operation: | write | Name: | Windows Settings |
Value: C:\Users\admin\sysarddrvs.exe | |||
| (PID) Process: | (5540) sysarddrvs.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder\Hidden\SHOWALL |
| Operation: | write | Name: | CheckedValue |
Value: 0 | |||
| (PID) Process: | (5540) sysarddrvs.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate |
| Operation: | write | Name: | DisableWindowsUpdateAccess |
Value: 1 | |||
| (PID) Process: | (5540) sysarddrvs.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU |
| Operation: | write | Name: | NoAutoUpdate |
Value: 1 | |||
| (PID) Process: | (5540) sysarddrvs.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center |
| Operation: | write | Name: | FirewallOverride |
Value: 1 | |||
| (PID) Process: | (5540) sysarddrvs.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center |
| Operation: | write | Name: | FirewallDisableNotify |
Value: 1 | |||
| (PID) Process: | (5540) sysarddrvs.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center |
| Operation: | write | Name: | AntiSpywareOverride |
Value: 1 | |||
| (PID) Process: | (5540) sysarddrvs.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center |
| Operation: | write | Name: | AntiVirusOverride |
Value: 1 | |||
| (PID) Process: | (5540) sysarddrvs.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center |
| Operation: | write | Name: | AntiVirusDisableNotify |
Value: 1 | |||
| (PID) Process: | (5540) sysarddrvs.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center |
| Operation: | write | Name: | UpdatesOverride |
Value: 1 | |||
Executable files
6
Suspicious files
3
Text files
4
Unknown types
0
Dropped files
PID | Process | Filename | Type | |
|---|---|---|---|---|
| 5540 | sysarddrvs.exe | C:\Users\admin\AppData\Local\Microsoft\Windows\INetCache\IE\KCV3KQBA\1[1] | binary | |
MD5:1A107841A127395CD4DA7415C7534CCE | SHA256:ED81C9633C0A1A53029DBE322B0FBCEA646393CA8DD9223CA2505B6CBDD801C8 | |||
| 6344 | powershell.exe | C:\Users\admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive | binary | |
MD5:6C6B6070D16F508A57F157CD773B643F | SHA256:A490BBF560521A2F6C1E3807C13271EF46C68EDDC3961BE19EFE4D927D633A0D | |||
| 6344 | powershell.exe | C:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_ah0ykple.ziv.ps1 | text | |
MD5:D17FE0A3F47BE24A6453E9EF58C94641 | SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7 | |||
| 5652 | VolDrvConfig.exe | C:\Users\admin\sysarddrvs.exe | executable | |
MD5:A7F8236EB39605D51964BF50FD015332 | SHA256:1B5B8D4000174658B280D11CE9143D60AC3DB44B9885F35545C3B6C9AEB5AC13 | |||
| 6344 | powershell.exe | C:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_01iyxb3n.vr2.ps1 | text | |
MD5:D17FE0A3F47BE24A6453E9EF58C94641 | SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7 | |||
| 6344 | powershell.exe | C:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_15prznzy.djh.psm1 | text | |
MD5:D17FE0A3F47BE24A6453E9EF58C94641 | SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7 | |||
| 6856 | 126832248.exe | C:\Users\admin\AppData\Local\Temp\77378756.exe | executable | |
MD5:BF9BDB940CC6E4352DD79B46B50B3571 | SHA256:0C00211734FF1E06B09192DEC6B83048047E487EAC730E959C4521D82F0F7B7E | |||
| 6856 | 126832248.exe | C:\Users\admin\AppData\Local\Microsoft\Windows\INetCache\IE\RR3E01RZ\peinf[1].exe | executable | |
MD5:BF9BDB940CC6E4352DD79B46B50B3571 | SHA256:0C00211734FF1E06B09192DEC6B83048047E487EAC730E959C4521D82F0F7B7E | |||
| 6856 | 126832248.exe | C:\Users\admin\AppData\Local\Temp\3127917339.exe | executable | |
MD5:873B85E4A12F1F2321AF32DC27C16241 | SHA256:773A4FA1692919C604421BB1824DF5DB11FA114BB93DFDC4E02986DAB7303F25 | |||
| 4876 | 77378756.exe | C:\ProgramData\Adobe\ARM\S\388\AdobeARMHelper.exe | executable | |
MD5:DFB789E2A35C98DC0019FDC071634EF1 | SHA256:2229173D0628BC4E7B7F990A0F316EB7406B347915EE05AFB91735AF3D987606 | |||
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
22
TCP/UDP connections
63
DNS requests
14
Threats
22
HTTP requests
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
|---|---|---|---|---|---|---|---|---|---|
6856 | 126832248.exe | GET | 200 | 185.215.113.66:80 | http://185.215.113.66/tcoin.exe | unknown | — | — | malicious |
5064 | SearchApp.exe | GET | 200 | 184.30.131.245:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAI5PUjXAkJafLQcAAsO18o%3D | unknown | — | — | whitelisted |
4712 | MoUsoCoreWorker.exe | GET | 200 | 23.48.23.166:80 | http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl | unknown | — | — | whitelisted |
2796 | SIHClient.exe | GET | 200 | 23.218.209.163:80 | http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl | unknown | — | — | whitelisted |
2796 | SIHClient.exe | GET | 200 | 23.218.209.163:80 | http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl | unknown | — | — | whitelisted |
5540 | sysarddrvs.exe | GET | 404 | 91.202.233.141:80 | http://91.202.233.141/1 | unknown | — | — | malicious |
5540 | sysarddrvs.exe | GET | 404 | 91.202.233.141:80 | http://91.202.233.141/2 | unknown | — | — | malicious |
5540 | sysarddrvs.exe | GET | 404 | 91.202.233.141:80 | http://91.202.233.141/3 | unknown | — | — | malicious |
5540 | sysarddrvs.exe | GET | 404 | 185.215.113.66:80 | http://185.215.113.66/5 | unknown | — | — | malicious |
6856 | 126832248.exe | GET | 200 | 185.215.113.66:80 | http://185.215.113.66/peinf.exe | unknown | — | — | malicious |
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
Connections
PID | Process | IP | Domain | ASN | CN | Reputation |
|---|---|---|---|---|---|---|
4 | System | 192.168.100.255:138 | — | — | — | whitelisted |
— | — | 20.73.194.208:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | NL | whitelisted |
— | — | 23.48.23.166:80 | crl.microsoft.com | Akamai International B.V. | DE | whitelisted |
4712 | MoUsoCoreWorker.exe | 23.48.23.166:80 | crl.microsoft.com | Akamai International B.V. | DE | whitelisted |
4712 | MoUsoCoreWorker.exe | 23.218.209.163:80 | www.microsoft.com | AKAMAI-AS | DE | whitelisted |
— | — | 23.218.209.163:80 | www.microsoft.com | AKAMAI-AS | DE | whitelisted |
— | — | 2.16.110.193:443 | — | Akamai International B.V. | DE | unknown |
5064 | SearchApp.exe | 2.16.110.195:443 | — | Akamai International B.V. | DE | unknown |
5540 | sysarddrvs.exe | 185.215.113.66:80 | — | 1337team Limited | SC | malicious |
1176 | svchost.exe | 20.190.159.0:443 | login.live.com | MICROSOFT-CORP-MSN-AS-BLOCK | IE | whitelisted |
DNS requests
Domain | IP | Reputation |
|---|---|---|
settings-win.data.microsoft.com |
| whitelisted |
crl.microsoft.com |
| whitelisted |
www.microsoft.com |
| whitelisted |
google.com |
| whitelisted |
login.live.com |
| whitelisted |
ocsp.digicert.com |
| whitelisted |
go.microsoft.com |
| whitelisted |
slscr.update.microsoft.com |
| whitelisted |
fe3cr.delivery.mp.microsoft.com |
| whitelisted |
arc.msn.com |
| whitelisted |
Threats
PID | Process | Class | Message |
|---|---|---|---|
5540 | sysarddrvs.exe | Misc Attack | ET DROP Spamhaus DROP Listed Traffic Inbound group 33 |
6856 | 126832248.exe | Potentially Bad Traffic | ET INFO Executable Download from dotted-quad Host |
6856 | 126832248.exe | Misc activity | ET INFO Packed Executable Download |
6856 | 126832248.exe | Potential Corporate Privacy Violation | ET POLICY PE EXE or DLL Windows file download HTTP |
6856 | 126832248.exe | Potentially Bad Traffic | ET HUNTING SUSPICIOUS Dotted Quad Host MZ Response |
6856 | 126832248.exe | Misc activity | ET INFO EXE IsDebuggerPresent (Used in Malware Anti-Debugging) |
6856 | 126832248.exe | Misc activity | ET INFO Packed Executable Download |
6856 | 126832248.exe | Potentially Bad Traffic | ET INFO Executable Download from dotted-quad Host |
5540 | sysarddrvs.exe | Misc Attack | ET DROP Spamhaus DROP Listed Traffic Inbound group 13 |
6856 | 126832248.exe | Potentially Bad Traffic | ET HUNTING SUSPICIOUS Dotted Quad Host MZ Response |
11 ETPRO signatures available at the full report