| File name: | usbdriver.exe |
| Full analysis: | https://app.any.run/tasks/c8131da2-69f0-4201-8296-ee8ac26a89ce |
| Verdict: | Malicious activity |
| Analysis date: | November 28, 2024, 09:58:32 |
| OS: | Windows 10 Professional (build: 19045, 64 bit) |
| Indicators: | |
| MIME: | application/vnd.microsoft.portable-executable |
| File info: | PE32 executable (GUI) Intel 80386, for MS Windows, 4 sections |
| MD5: | 3181D00D36FB2AF61BB3FA44C2601E98 |
| SHA1: | FDA6CF8143A36A03F5DC42463FE189C664202B8E |
| SHA256: | 414E66BDFA77B8B656EEBD12613AA2FF5A52D6B6D71221F17D9DDD40A4B86962 |
| SSDEEP: | 49152:x0eGG4O9oJKmhQPUH6QtHKuZ74qzOI0jXZGadc:xnGGlo0muUaS/7wI2wIc |
MALICIOUS
No malicious indicators.SUSPICIOUS
Executable content was dropped or overwritten
- usbdriver.exe (PID: 1580)
- drvinst.exe (PID: 5652)
Executes as Windows Service
- VSSVC.exe (PID: 6988)
Process drops legitimate windows executable
- msiexec.exe (PID: 6400)
Drops a system driver (possible attempt to evade defenses)
- msiexec.exe (PID: 6400)
- drvinst.exe (PID: 5652)
INFO
Checks supported languages
- usbdriver.exe (PID: 1580)
- TestoSetup.exe (PID: 6232)
- msiexec.exe (PID: 6400)
- msiexec.exe (PID: 6592)
Reads security settings of Internet Explorer
- msiexec.exe (PID: 6252)
Reads the computer name
- msiexec.exe (PID: 6400)
- msiexec.exe (PID: 6592)
Reads the software policy settings
- msiexec.exe (PID: 6252)
Create files in a temporary directory
- usbdriver.exe (PID: 1580)
Executable content was dropped or overwritten
- msiexec.exe (PID: 6252)
- msiexec.exe (PID: 6400)
Manages system restore points
- SrTasks.exe (PID: 6304)
Application launched itself
- msiexec.exe (PID: 6400)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
TRiD
| .exe | | | Generic Win/DOS Executable (50) |
|---|---|---|
| .exe | | | DOS Executable Generic (49.9) |
EXIF
EXE
| MachineType: | Intel 386 or later, and compatibles |
|---|---|
| TimeStamp: | 2012:05:10 08:33:52+00:00 |
| ImageFileCharacteristics: | No relocs, Executable, 32-bit |
| PEType: | PE32 |
| LinkerVersion: | 8 |
| CodeSize: | 75776 |
| InitializedDataSize: | 95232 |
| UninitializedDataSize: | - |
| EntryPoint: | 0x12ddf |
| OSVersion: | 4 |
| ImageVersion: | - |
| SubsystemVersion: | 4 |
| Subsystem: | Windows GUI |
| FileVersionNumber: | 1.5.0.2478 |
| ProductVersionNumber: | 1.5.0.2478 |
| FileFlagsMask: | 0x003f |
| FileFlags: | Private build |
| FileOS: | Windows NT 32-bit |
| ObjectFileType: | Executable application |
| FileSubtype: | - |
| LanguageCode: | Neutral |
| CharacterSet: | Unicode |
| CompanyName: | Oleg N. Scherbakov |
| FileDescription: | 7z Setup SFX (x86) |
| FileVersion: | 1.5.0.2478 |
| InternalName: | 7ZSfxMod |
| LegalCopyright: | Copyright © 2005-2012 Oleg N. Scherbakov |
| OriginalFileName: | 7ZSfxMod_x86.exe |
| PrivateBuild: | May 10, 2012 |
| ProductName: | 7-Zip SFX |
| ProductVersion: | 1.5.0.2478 |
Total processes
142
Monitored processes
12
Malicious processes
1
Suspicious processes
0
Behavior graph
Click at the process to see the details
Process information
PID | CMD | Path | Indicators | Parent process | |||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 1580 | "C:\Users\admin\AppData\Local\Temp\usbdriver.exe" | C:\Users\admin\AppData\Local\Temp\usbdriver.exe | explorer.exe | ||||||||||||
User: admin Company: Oleg N. Scherbakov Integrity Level: MEDIUM Description: 7z Setup SFX (x86) Exit code: 0 Version: 1.5.0.2478 Modules
| |||||||||||||||
| 3696 | rundll32.exe C:\WINDOWS\system32\pnpui.dll,InstallSecurityPromptRunDllW 20 Global\{500d0c42-dad4-3e44-8804-f20cd0ee6e6e} Global\{0162c203-5787-4040-aa13-fb53aaa2f93b} C:\WINDOWS\System32\DriverStore\Temp\{10379e06-be14-4b42-8af8-15efc17374ec}\ftdibus.inf C:\WINDOWS\System32\DriverStore\Temp\{10379e06-be14-4b42-8af8-15efc17374ec}\ftdibus.cat | C:\Windows\System32\rundll32.exe | — | drvinst.exe | |||||||||||
User: SYSTEM Company: Microsoft Corporation Integrity Level: SYSTEM Description: Windows host process (Rundll32) Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 3928 | C:\Windows\System32\MsiExec.exe -Embedding 010AA1469879DFAFA90EC3D9BBD7CB8A E Global\MSI0000 | C:\Windows\System32\msiexec.exe | — | msiexec.exe | |||||||||||
User: SYSTEM Company: Microsoft Corporation Integrity Level: SYSTEM Description: Windows® installer Version: 5.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 5652 | DrvInst.exe "4" "1" "C:\Program Files\Testo\USBDrivers\USBDriver\FTDIBus\ftdibus.inf" "9" "4e4a36bbf" "00000000000001D0" "WinSta0\Default" "00000000000000EC" "208" "C:\Program Files\Testo\USBDrivers\USBDriver\FTDIBus" | C:\Windows\System32\drvinst.exe | svchost.exe | ||||||||||||
User: SYSTEM Company: Microsoft Corporation Integrity Level: SYSTEM Description: Driver Installation Module Version: 10.0.19041.3996 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 6232 | "C:\Users\admin\AppData\Local\Temp\TestoSetup.exe" | C:\Users\admin\AppData\Local\Temp\TestoSetup.exe | — | usbdriver.exe | |||||||||||
User: admin Company: Testo AG Integrity Level: MEDIUM Description: Check running device driver Exit code: 1 Version: 1, 0, 0, 1 Modules
| |||||||||||||||
| 6252 | C:\WINDOWS\system32\MSIEXEC.exe /i USBDRIVER64.MSI | C:\Windows\SysWOW64\msiexec.exe | TestoSetup.exe | ||||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows® installer Version: 5.0.19041.3636 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 6304 | C:\WINDOWS\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:11 | C:\Windows\System32\SrTasks.exe | — | msiexec.exe | |||||||||||
User: SYSTEM Company: Microsoft Corporation Integrity Level: SYSTEM Description: Microsoft® Windows System Protection background tasks. Exit code: 0 Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 6312 | \??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1 | C:\Windows\System32\conhost.exe | — | SrTasks.exe | |||||||||||
User: SYSTEM Company: Microsoft Corporation Integrity Level: SYSTEM Description: Console Window Host Exit code: 0 Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 6400 | C:\WINDOWS\system32\msiexec.exe /V | C:\Windows\System32\msiexec.exe | services.exe | ||||||||||||
User: SYSTEM Company: Microsoft Corporation Integrity Level: SYSTEM Description: Windows® installer Version: 5.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 6592 | C:\Windows\syswow64\MsiExec.exe -Embedding FEAF4572DECB7DEBD86F13AFA2A2DEB3 C | C:\Windows\SysWOW64\msiexec.exe | — | msiexec.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows® installer Version: 5.0.19041.3636 (WinBuild.160101.0800) Modules
| |||||||||||||||
Total events
17 311
Read events
17 108
Write events
191
Delete events
12
Modification events
| (PID) Process: | (6400) msiexec.exe | Key: | HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\SystemRestore |
| Operation: | write | Name: | SrCreateRp (Enter) |
Value: 4800000000000000C0BB9B1E7C41DB01001900003C1B0000D50700000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 | |||
| (PID) Process: | (6400) msiexec.exe | Key: | HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\SPP |
| Operation: | write | Name: | SppGetSnapshots (Enter) |
Value: 4800000000000000C0BB9B1E7C41DB01001900003C1B0000D20700000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 | |||
| (PID) Process: | (6400) msiexec.exe | Key: | HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\SPP |
| Operation: | write | Name: | SppGetSnapshots (Leave) |
Value: 4800000000000000584ED71E7C41DB01001900003C1B0000D20700000100000000000000000000000000000000000000000000000000000000000000000000000000000000000000 | |||
| (PID) Process: | (6400) msiexec.exe | Key: | HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\SPP |
| Operation: | write | Name: | SppEnumGroups (Enter) |
Value: 480000000000000026B3D91E7C41DB01001900003C1B0000D10700000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 | |||
| (PID) Process: | (6400) msiexec.exe | Key: | HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\SPP |
| Operation: | write | Name: | SppEnumGroups (Leave) |
Value: 4800000000000000C717DC1E7C41DB01001900003C1B0000D10700000100000000000000010000000000000000000000000000000000000000000000000000000000000000000000 | |||
| (PID) Process: | (6400) msiexec.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SPP |
| Operation: | write | Name: | LastIndex |
Value: 11 | |||
| (PID) Process: | (6400) msiexec.exe | Key: | HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\VssapiPublisher |
| Operation: | write | Name: | IDENTIFY (Enter) |
Value: 48000000000000006EE9501F7C41DB0100190000AC1B0000E803000001000000000000000000000009979EB0EEC0CD4EBDDA8389373F117100000000000000000000000000000000 | |||
| (PID) Process: | (6988) VSSVC.exe | Key: | HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\ASR Writer |
| Operation: | write | Name: | IDENTIFY (Leave) |
Value: 48000000000000004C9F611F7C41DB014C1B0000CC1B0000E80300000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000 | |||
| (PID) Process: | (6400) msiexec.exe | Key: | HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\SPP |
| Operation: | write | Name: | SppCreate (Enter) |
Value: 4800000000000000E0DFE01E7C41DB01001900003C1B0000D00700000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 | |||
| (PID) Process: | (6400) msiexec.exe | Key: | HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\SPP |
| Operation: | write | Name: | SppGatherWriterMetadata (Enter) |
Value: 4800000000000000BB834E1F7C41DB01001900003C1B0000D30700000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 | |||
Executable files
45
Suspicious files
16
Text files
4
Unknown types
3
Dropped files
PID | Process | Filename | Type | |
|---|---|---|---|---|
| 1580 | usbdriver.exe | C:\Users\admin\AppData\Local\Temp\usbdriver64.msi | — | |
MD5:— | SHA256:— | |||
| 6400 | msiexec.exe | C:\System Volume Information\SPP\metadata-2 | — | |
MD5:— | SHA256:— | |||
| 6400 | msiexec.exe | C:\Windows\Installer\13bad7.msi | — | |
MD5:— | SHA256:— | |||
| 6400 | msiexec.exe | C:\Windows\Installer\MSIBE42.tmp | — | |
MD5:— | SHA256:— | |||
| 6252 | msiexec.exe | C:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\ECF3006D44DA211141391220EE5049F4 | binary | |
MD5:D80FE91ACEDF131DC36DD0B1D9AB2AB1 | SHA256:702D085882ADCD9131F021F85B844688761CE7E8E456BBF4F7BCED294791281A | |||
| 1580 | usbdriver.exe | C:\Users\admin\AppData\Local\Temp\usbdriver32.msi | executable | |
MD5:AD1EE98160B420C7B6C066F543838AD1 | SHA256:DD6996E227308E1FC16430852CB3D5C53D4FB170BFC3CD271878E2FF1AC5ABB3 | |||
| 6400 | msiexec.exe | C:\Program Files\Testo\USBDrivers\USBDriver\FTDIBus\AMD64\ftbusui.dll | executable | |
MD5:284C4C51734AC901DF4E00BAB3D7C628 | SHA256:368C42008ECDC511B1C95C67236BA11C69D69E708E00490E014BE958952043E1 | |||
| 6252 | msiexec.exe | C:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\40C68D5626484A90937F0752C8B950AB | binary | |
MD5:6A3AE7391E110D2C1676F3AF23802FE5 | SHA256:90FDD5F67D04E9FFB3C0EDE15C7808A27CE5F0BFDE48BD6F415332149E79E505 | |||
| 1580 | usbdriver.exe | C:\Users\admin\AppData\Local\Temp\TestoSetup.exe | executable | |
MD5:48BDC31F4812D98AB66C9C3A13263BFE | SHA256:5A60B296AF35E8DCAD9310CAEFCE5F1366EB6ADFE067EBF2B1A3BABC93ED3554 | |||
| 6252 | msiexec.exe | C:\Users\admin\AppData\Local\Temp\MSI60E0.tmp | executable | |
MD5:B1298B75B1C09FDBB3906AEEC500F066 | SHA256:826289B33E9046FD86C559AC3C888129451534BFB2F31FA264D0C62760E0E35E | |||
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
13
TCP/UDP connections
37
DNS requests
20
Threats
0
HTTP requests
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
|---|---|---|---|---|---|---|---|---|---|
— | — | GET | 200 | 23.48.23.156:80 | http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl | unknown | — | — | whitelisted |
— | — | GET | 200 | 2.23.9.218:80 | http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl | unknown | — | — | whitelisted |
— | — | GET | 200 | 192.229.221.95:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAI5PUjXAkJafLQcAAsO18o%3D | unknown | — | — | whitelisted |
6252 | msiexec.exe | GET | 200 | 152.199.19.74:80 | http://s2.symcb.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBS56bKHAoUD%2BOyl%2B0LhPg9JxyQm4gQUf9Nlp8Ld7LvwMAnzQzn6Aq8zMTMCED141%2Fl2SWCyYX308B7Khio%3D | unknown | — | — | whitelisted |
6252 | msiexec.exe | GET | 200 | 152.199.19.74:80 | http://s2.symcb.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBS56bKHAoUD%2BOyl%2B0LhPg9JxyQm4gQUf9Nlp8Ld7LvwMAnzQzn6Aq8zMTMCED141%2Fl2SWCyYX308B7Khio%3D | unknown | — | — | whitelisted |
6252 | msiexec.exe | GET | 200 | 192.229.221.95:80 | http://s1.symcb.com/pca3-g5.crl | unknown | — | — | whitelisted |
6252 | msiexec.exe | GET | 200 | 152.199.19.74:80 | http://sv.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQe6LNDJdqx%2BJOp7hVgTeaGFJ%2FCQgQUljtT8Hkzl699g%2B8uK8zKt4YecmYCEFBWxl3zUa3mz%2BJMT12I4OE%3D | unknown | — | — | unknown |
6252 | msiexec.exe | GET | 200 | 152.199.19.74:80 | http://sv.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQe6LNDJdqx%2BJOp7hVgTeaGFJ%2FCQgQUljtT8Hkzl699g%2B8uK8zKt4YecmYCEFBWxl3zUa3mz%2BJMT12I4OE%3D | unknown | — | — | unknown |
6252 | msiexec.exe | GET | 200 | 192.229.221.95:80 | http://sv.symcb.com/sv.crl | unknown | — | — | whitelisted |
1176 | svchost.exe | GET | 200 | 192.229.221.95:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D | unknown | — | — | whitelisted |
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
Connections
PID | Process | IP | Domain | ASN | CN | Reputation |
|---|---|---|---|---|---|---|
4712 | MoUsoCoreWorker.exe | 51.104.136.2:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | IE | whitelisted |
4 | System | 192.168.100.255:137 | — | — | — | whitelisted |
3508 | svchost.exe | 51.104.136.2:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | IE | whitelisted |
— | — | 51.104.136.2:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | IE | whitelisted |
— | — | 23.48.23.156:80 | crl.microsoft.com | Akamai International B.V. | DE | whitelisted |
— | — | 2.23.9.218:80 | www.microsoft.com | AKAMAI-AS | CZ | whitelisted |
4 | System | 192.168.100.255:138 | — | — | — | whitelisted |
5064 | SearchApp.exe | 23.212.110.171:443 | www.bing.com | Akamai International B.V. | CZ | whitelisted |
— | — | 192.229.221.95:80 | ocsp.digicert.com | EDGECAST | US | whitelisted |
6252 | msiexec.exe | 152.199.19.74:80 | s2.symcb.com | EDGECAST | US | shared |
DNS requests
Domain | IP | Reputation |
|---|---|---|
settings-win.data.microsoft.com |
| whitelisted |
crl.microsoft.com |
| whitelisted |
google.com |
| whitelisted |
www.microsoft.com |
| whitelisted |
www.bing.com |
| whitelisted |
ocsp.digicert.com |
| whitelisted |
s2.symcb.com |
| whitelisted |
s1.symcb.com |
| whitelisted |
sv.symcd.com |
| shared |
sv.symcb.com |
| whitelisted |