File name:

KeyboardSplitter.exe

Full analysis: https://app.any.run/tasks/14323b62-d4f0-491f-85a4-6605a84c7c5e
Verdict: Malicious activity
Analysis date: November 30, 2023, 21:22:05
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (console) Intel 80386 Mono/.Net assembly, for MS Windows
MD5:

81E89981CEBF899BD3EE985A88A63D53

SHA1:

67C2733322E10475A91C9AD4805FE478662A7B0B

SHA256:

36656BC7DF1C724AFECEA974A85533D83D1BCA3675DC541E42CD2592AF00EE77

SSDEEP:

98304:o1tpy43QTufo7h3XFvfXMWMmyHoeRzCueFrq3bOBqygpCtyawall0XtkPp1DQvQL:o8bhLytkgZqeUJi

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Drops the executable file immediately after the start

      • keyboard_driver.exe (PID: 1072)
      • KeyboardSplitter.exe (PID: 2476)
      • devcon.exe (PID: 292)
      • drvinst.exe (PID: 3160)
      • drvinst.exe (PID: 3480)

    • Creates a writable file in the system directory

      • keyboard_driver.exe (PID: 1072)
      • drvinst.exe (PID: 3160)
      • drvinst.exe (PID: 3480)

  • SUSPICIOUS

    • Reads the Internet Settings

      • KeyboardSplitter.exe (PID: 2476)
      • sipnotify.exe (PID: 1496)

    • Drops a system driver (possible attempt to evade defenses)

      • KeyboardSplitter.exe (PID: 2476)
      • keyboard_driver.exe (PID: 1072)
      • devcon.exe (PID: 292)
      • drvinst.exe (PID: 3160)
      • drvinst.exe (PID: 3480)

    • Creates files in the driver directory

      • keyboard_driver.exe (PID: 1072)
      • drvinst.exe (PID: 3160)
      • drvinst.exe (PID: 3480)

    • Process drops legitimate windows executable

      • KeyboardSplitter.exe (PID: 2476)
      • drvinst.exe (PID: 3160)
      • devcon.exe (PID: 292)

    • Reads security settings of Internet Explorer

      • devcon.exe (PID: 292)

    • Reads settings of System Certificates

      • devcon.exe (PID: 292)
      • sipnotify.exe (PID: 1496)

    • Checks Windows Trust Settings

      • devcon.exe (PID: 292)
      • drvinst.exe (PID: 3160)
      • drvinst.exe (PID: 3480)

    • Executes as Windows Service

      • VSSVC.exe (PID: 1028)

    • The system shut down or reboot

      • KeyboardSplitter.exe (PID: 2476)

    • The process executes via Task Scheduler

      • ctfmon.exe (PID: 1692)
      • sipnotify.exe (PID: 1496)

  • INFO

    • Checks supported languages

      • keyboard_driver.exe (PID: 1072)
      • KeyboardSplitter.exe (PID: 2476)
      • devcon.exe (PID: 292)
      • drvinst.exe (PID: 3160)
      • drvinst.exe (PID: 3480)
      • IMEKLMG.EXE (PID: 1708)
      • IMEKLMG.EXE (PID: 1076)
      • wmpnscfg.exe (PID: 2344)
      • wmpnscfg.exe (PID: 2460)
      • wmpnscfg.exe (PID: 2252)

    • Reads the computer name

      • KeyboardSplitter.exe (PID: 2476)
      • devcon.exe (PID: 292)
      • drvinst.exe (PID: 3160)
      • drvinst.exe (PID: 3480)
      • IMEKLMG.EXE (PID: 1076)
      • IMEKLMG.EXE (PID: 1708)
      • wmpnscfg.exe (PID: 2460)
      • wmpnscfg.exe (PID: 2344)
      • wmpnscfg.exe (PID: 2252)

    • Reads the machine GUID from the registry

      • KeyboardSplitter.exe (PID: 2476)
      • devcon.exe (PID: 292)
      • drvinst.exe (PID: 3160)
      • drvinst.exe (PID: 3480)
      • wmpnscfg.exe (PID: 2252)
      • wmpnscfg.exe (PID: 2344)
      • wmpnscfg.exe (PID: 2460)

    • Create files in a temporary directory

      • KeyboardSplitter.exe (PID: 2476)
      • devcon.exe (PID: 292)

    • Manual execution by a user

      • IMEKLMG.EXE (PID: 1076)
      • IMEKLMG.EXE (PID: 1708)
      • wmpnscfg.exe (PID: 2252)
      • wmpnscfg.exe (PID: 2344)
      • wmpnscfg.exe (PID: 2460)

    • Process checks are UAC notifies on

      • IMEKLMG.EXE (PID: 1076)
      • IMEKLMG.EXE (PID: 1708)

    • Reads security settings of Internet Explorer

      • sipnotify.exe (PID: 1496)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Generic CIL Executable (.NET, Mono, etc.) (45.4)
.exe | InstallShield setup (26.7)
.exe | Win64 Executable (generic) (17.1)
.dll | Win32 Dynamic Link Library (generic) (4)
.exe | Win32 Executable (generic) (2.7)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2023:10:28 14:31:47+02:00
ImageFileCharacteristics: Executable, 32-bit
PEType: PE32
LinkerVersion: 11
CodeSize: 6309888
InitializedDataSize: 374784
UninitializedDataSize: -
EntryPoint: 0x6067de
OSVersion: 4
ImageVersion: -
SubsystemVersion: 4
Subsystem: Windows command line
FileVersionNumber: 2.3.0.0
ProductVersionNumber: 2.3.0.0
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: Neutral
CharacterSet: Unicode
Comments: Keyboard Splitter (Creates up to 4 virtual xbox 360 contollers and feeds them using keyboards and/or mice)
CompanyName: djlastnight
FileDescription: Keyboard Splitter
FileVersion: 2.3.0.0
InternalName: KeyboardSplitter.exe
LegalCopyright: Copyright © 2023
OriginalFileName: KeyboardSplitter.exe
ProductName: djlastnight's Gaming Keyboard Splitter
ProductVersion: 2.3.0.0
AssemblyVersion: 2.3.0.0
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
105
Monitored processes
16
Malicious processes
6
Suspicious processes
0

Behavior graph

Click at the process to see the details
start keyboardsplitter.exe keyboard_driver.exe no specs devcon.exe no specs drvinst.exe no specs rundll32.exe no specs vssvc.exe no specs drvinst.exe shutdown.exe no specs sipnotify.exe ctfmon.exe no specs imeklmg.exe no specs imeklmg.exe no specs wmpnscfg.exe no specs wmpnscfg.exe no specs wmpnscfg.exe no specs keyboardsplitter.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
292"C:\Users\admin\AppData\Local\Temp\VirtualXbox 2.2.0.0 resources\devcon.exe" install ScpVBus.inf Root\ScpVBusC:\Users\admin\AppData\Local\Temp\VirtualXbox 2.2.0.0 resources\devcon.exe—KeyboardSplitter.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Setup API
Exit code:
0
Version:
10.0.10586.0 (th2_release.151029-1700)
Modules
Images
c:\users\admin\appdata\local\temp\virtualxbox 2.2.0.0 resources\devcon.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\ole32.dll
c:\windows\system32\gdi32.dll
1028C:\Windows\system32\vssvc.exeC:\Windows\System32\VSSVC.exe—services.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Microsoft® Volume Shadow Copy Service
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\vssvc.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
1072"C:\Users\admin\AppData\Local\Temp\KeyboardSplitter 2.3.0.0 resources\keyboard_driver.exe" /installC:\Users\admin\AppData\Local\Temp\KeyboardSplitter 2.3.0.0 resources\keyboard_driver.exe—KeyboardSplitter.exe
User:
admin
Company:
Francisco Lopes
Integrity Level:
HIGH
Description:
Interception command line installation tool
Exit code:
0
Version:
1.00 built by: WinDDK
Modules
Images
c:\users\admin\appdata\local\temp\keyboardsplitter 2.3.0.0 resources\keyboard_driver.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\apphelp.dll
c:\windows\apppatch\acgenral.dll
1076"C:\Program Files\Common Files\microsoft shared\IME14\SHARED\IMEKLMG.EXE" /SetPreload /JPN /LogC:\Program Files\Common Files\microsoft shared\IME14\SHARED\IMEKLMG.EXE—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Office IME 2010
Exit code:
1
Version:
14.0.4734.1000
Modules
Images
c:\program files\common files\microsoft shared\ime14\shared\imeklmg.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\userenv.dll
1496C:\Windows\system32\sipnotify.exe -LogonOrUnlockC:\Windows\System32\sipnotify.exe
taskeng.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
sipnotify
Exit code:
0
Version:
6.1.7602.20480 (win7sp1_ldr_escrow.191010-1716)
Modules
Images
c:\windows\system32\sipnotify.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
1692C:\Windows\System32\ctfmon.exe C:\Windows\System32\ctfmon.exe—taskeng.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
CTF Loader
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\ctfmon.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\msctfmonitor.dll
c:\windows\system32\msctf.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
1708"C:\Program Files\Common Files\microsoft shared\IME14\SHARED\IMEKLMG.EXE" /SetPreload /KOR /LogC:\Program Files\Common Files\microsoft shared\IME14\SHARED\IMEKLMG.EXE—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Office IME 2010
Exit code:
1
Version:
14.0.4734.1000
Modules
Images
c:\program files\common files\microsoft shared\ime14\shared\imeklmg.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\userenv.dll
2252"C:\Program Files\Windows Media Player\wmpnscfg.exe"C:\Program Files\Windows Media Player\wmpnscfg.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Media Player Network Sharing Service Configuration Application
Exit code:
0
Version:
12.0.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\program files\windows media player\wmpnscfg.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\sspicli.dll
c:\windows\system32\ole32.dll
2344"C:\Program Files\Windows Media Player\wmpnscfg.exe"C:\Program Files\Windows Media Player\wmpnscfg.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Media Player Network Sharing Service Configuration Application
Exit code:
0
Version:
12.0.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\program files\windows media player\wmpnscfg.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\sspicli.dll
c:\windows\system32\ole32.dll
2460"C:\Program Files\Windows Media Player\wmpnscfg.exe"C:\Program Files\Windows Media Player\wmpnscfg.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Media Player Network Sharing Service Configuration Application
Exit code:
0
Version:
12.0.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\program files\windows media player\wmpnscfg.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\sspicli.dll
c:\windows\system32\ole32.dll
Total events
13 250
Read events
13 160
Write events
77
Delete events
13

Modification events

(PID) Process:(2476) KeyboardSplitter.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Direct3D\MostRecentApplication
Operation:writeName:Name
Value:
Explorer.EXE
(PID) Process:(1072) keyboard_driver.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96B-E325-11CE-BFC1-08002BE10318}
Operation:writeName:UpperFilters
Value:
kbdclass
(PID) Process:(1072) keyboard_driver.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96F-E325-11CE-BFC1-08002BE10318}
Operation:writeName:UpperFilters
Value:
mouclass
(PID) Process:(292) devcon.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\17F\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(3160) drvinst.exeKey:HKEY_USERS\.DEFAULT\Software\Classes\Local Settings\MuiCache\17F\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(3160) drvinst.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\SystemRestore
Operation:writeName:SrCreateRp (Enter)
Value:
4000000000000000F2B487BA16B0D901C80700002C0A0000D5070000000000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(3160) drvinst.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\SPP
Operation:writeName:SppCreate (Enter)
Value:
4000000000000000F2B487BA16B0D901C80700002C0A0000D0070000000000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(3160) drvinst.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SPP
Operation:writeName:LastIndex
Value:
72
(PID) Process:(3160) drvinst.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\SPP
Operation:writeName:SppGatherWriterMetadata (Enter)
Value:
40000000000000008C62D6BA16B0D901C80700002C0A0000D3070000000000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(3160) drvinst.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\SPP
Operation:writeName:SppGatherWriterMetadata (Leave)
Value:
400000000000000064514ABC16B0D901C80700002C0A0000D3070000010000000000000000000000000000000000000000000000000000000000000000000000
Executable files
20
Suspicious files
26
Text files
8
Unknown types
0

Dropped files

PID
Process
Filename
Type
1072keyboard_driver.exeC:\Windows\system32\drivers\keyboard.sysexecutable
MD5:08D1211820889F97D8A8796584D38EB9
SHA256:979F790B75860FC713C159740F00ED4A11E7BC785E417B3442F765FFEC4DDC36
2476KeyboardSplitter.exeC:\Users\admin\AppData\Local\Temp\splitter_log.txttext
MD5:F3B25701FE362EC84616A93A45CE9998
SHA256:B3D510EF04275CA8E698E5B3CBB0ECE3949EF9252F0CDC839E9EE347409A2209
2476KeyboardSplitter.exeC:\Users\admin\AppData\Local\Temp\djlastnight's Gaming Keyboard Splitter v2.3.0.0\VirtualXboxNative.dllexecutable
MD5:AC4FF97B7CD229177E710EAA02663063
SHA256:9E670480ABC2676670840B708CF1E3CC8E101167AE419913AE8DA8A8A7754C17
2476KeyboardSplitter.exeC:\Users\admin\AppData\Local\Temp\djlastnight's Gaming Keyboard Splitter v2.3.0.0\interception.dllexecutable
MD5:C53B817577411AE5776A1EF0F22D1818
SHA256:53650570A3841949C85F7CF1BEEA968ED50893E5C8EAE00263247ED78FE9F06F
2476KeyboardSplitter.exeC:\Users\admin\AppData\Local\Temp\VirtualXbox 2.2.0.0 resources\devcon.exeexecutable
MD5:B14F9FFBEAAAB08167E6223CAC933B22
SHA256:21DCF559210ECD2ED8DD8DF704A9248D52E9EABE33059F448E0E044B0153CE73
292devcon.exeC:\Windows\INF\setupapi.app.logtext
MD5:2F7F2A9DA878A78313439B160D8226F0
SHA256:4953C60C19D90870F9BA856F7934F3C4ECA3F83BC88A433DE2731F601AEBB589
292devcon.exeC:\Users\admin\AppData\Local\Temp\{25a5d65c-dc86-1093-3727-d96f32076c1b}\WdfCoInstaller01009.dllexecutable
MD5:A9970042BE512C7981B36E689C5F3F9F
SHA256:7A6BF1F950684381205C717A51AF2D9C81B203CB1F3DB0006A4602E2DF675C77
292devcon.exeC:\Users\admin\AppData\Local\Temp\{25a5d65c-dc86-1093-3727-d96f32076c1b}\ScpVBus.catbinary
MD5:2FB151D296227211DDF158A3FF85B5DC
SHA256:23207F82F7DFD330472E3E5E60227B8E147F8ECEB393762937AE74A34BE276E9
292devcon.exeC:\Users\admin\AppData\Local\Temp\{25a5d65c-dc86-1093-3727-d96f32076c1b}\SETF3B5.tmpbinary
MD5:D0A8B29B7BFD6AD6B024BEA51AE96BFA
SHA256:0470B305E9C9E98A016F80A72181BAA9F350CCAC0455A7B7870CAA2EDF595205
292devcon.exeC:\Users\admin\AppData\Local\Temp\{25a5d65c-dc86-1093-3727-d96f32076c1b}\SETF3A4.tmpcat
MD5:2FB151D296227211DDF158A3FF85B5DC
SHA256:23207F82F7DFD330472E3E5E60227B8E147F8ECEB393762937AE74A34BE276E9
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
1
TCP/UDP connections
10
DNS requests
1
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
1496
sipnotify.exe
HEAD
200
23.197.138.118:80
http://query.prod.cms.rt.microsoft.com/cms/api/am/binary/RE2JgkA?v=133458529732960000
unknown
—
—
unknown
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
1080
svchost.exe
224.0.0.252:5355
—
—
—
unknown
4
System
192.168.100.255:138
—
—
—
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
2588
svchost.exe
239.255.255.250:1900
—
—
—
whitelisted
1108
svchost.exe
224.0.0.252:5355
—
—
—
unknown
1496
sipnotify.exe
23.197.138.118:80
query.prod.cms.rt.microsoft.com
Akamai International B.V.
US
unknown
2528
svchost.exe
239.255.255.250:1900
—
—
—
whitelisted

DNS requests

Domain
IP
Reputation
query.prod.cms.rt.microsoft.com
  • 23.197.138.118
whitelisted

Threats

No threats detected
Process
Message
drvinst.exe
WdfCoInstaller: [11/30/2023 21:22.30.893] DIF_INSTALLDEVICE: Pre-Processing
drvinst.exe
WdfCoInstaller: [11/30/2023 21:22.30.908] ReadComponents: WdfSection for Driver Service ScpVBus using KMDF lib version Major 0x1, minor 0x9
drvinst.exe
WdfCoInstaller: [11/30/2023 21:22.33.987] DIF_INSTALLDEVICE: Post-Processing
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
KeyboardSplitter.exe