File name:

free-virtual-serial-port-tools.exe

Full analysis: https://app.any.run/tasks/1a040e8e-59ad-445a-8266-dd946bd8e045
Verdict: Malicious activity
Analysis date: March 18, 2024, 07:59:12
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386, for MS Windows
MD5:

A76F304322C2C70FE8DF56907DA10255

SHA1:

27CCA5C809285773EBC2B8892447FF5AEFD7E9CE

SHA256:

50E756552E99CE53F9A3FF01785A115AEA9C3775EDEC4249E58FF866A868BDC6

SSDEEP:

98304:JoXFabQWxZuaqgYZ9S/cKZb/X6Gw8Lrw0yTkA+gWDynVgrZHkc4pGZ05ieLY//bh:NubCz/5/smDRXpeklskRc9IGLQ

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Drops the executable file immediately after the start

      • free-virtual-serial-port-tools.exe (PID: 3936)
      • setup.exe (PID: 2792)
      • drvinst.exe (PID: 2096)
      • drvinst.exe (PID: 668)

    • Creates a writable file in the system directory

      • drvinst.exe (PID: 2096)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • free-virtual-serial-port-tools.exe (PID: 3936)
      • setup.exe (PID: 2792)
      • drvinst.exe (PID: 2096)
      • drvinst.exe (PID: 668)

    • Application launched itself

      • setup.exe (PID: 1696)

    • Reads the Internet Settings

      • setup.exe (PID: 1696)
      • vspcfg.exe (PID: 3192)

    • Reads security settings of Internet Explorer

      • setup.exe (PID: 1696)
      • vspcfg.exe (PID: 3192)

    • Reads Internet Explorer settings

      • setup.exe (PID: 1696)
      • vspcfg.exe (PID: 3192)

    • Executes as Windows Service

      • VSSVC.exe (PID: 2364)
      • ps_server.exe (PID: 2588)
      • psip_server.exe (PID: 2808)

    • Searches for installed software

      • setup.exe (PID: 2792)
      • dllhost.exe (PID: 240)

    • Process drops legitimate windows executable

      • setup.exe (PID: 2792)
      • drvinst.exe (PID: 2096)
      • drvinst.exe (PID: 668)

    • Creates files in the driver directory

      • drvinst.exe (PID: 2096)

    • Checks Windows Trust Settings

      • drvinst.exe (PID: 2096)
      • vspcfg.exe (PID: 3192)

    • Reads settings of System Certificates

      • rundll32.exe (PID: 968)
      • vspcfg.exe (PID: 3192)

    • Creates/Modifies COM task schedule object

      • setup.exe (PID: 2792)

    • Reads Microsoft Outlook installation path

      • vspcfg.exe (PID: 3192)

    • Creates a software uninstall entry

      • setup.exe (PID: 2792)

  • INFO

    • Create files in a temporary directory

      • free-virtual-serial-port-tools.exe (PID: 3936)
      • setup.exe (PID: 2792)

    • Checks supported languages

      • free-virtual-serial-port-tools.exe (PID: 3936)
      • setup.exe (PID: 2792)
      • setup.exe (PID: 1696)
      • drvinst.exe (PID: 2096)
      • ps_server.exe (PID: 2588)
      • vspcfg.exe (PID: 3192)
      • psip_server.exe (PID: 2808)

    • Reads the computer name

      • setup.exe (PID: 1696)
      • setup.exe (PID: 2792)
      • drvinst.exe (PID: 2096)
      • ps_server.exe (PID: 2588)
      • psip_server.exe (PID: 2808)
      • vspcfg.exe (PID: 3192)

    • Reads the machine GUID from the registry

      • setup.exe (PID: 2792)
      • drvinst.exe (PID: 2096)
      • vspcfg.exe (PID: 3192)

    • Creates files in the program directory

      • setup.exe (PID: 2792)

    • Reads the software policy settings

      • drvinst.exe (PID: 2096)
      • rundll32.exe (PID: 968)
      • vspcfg.exe (PID: 3192)

    • Reads security settings of Internet Explorer

      • rundll32.exe (PID: 968)

    • Checks proxy server information

      • vspcfg.exe (PID: 3192)

    • Adds/modifies Windows certificates

      • drvinst.exe (PID: 2096)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win64 Executable (generic) (64.6)
.dll | Win32 Dynamic Link Library (generic) (15.4)
.exe | Win32 Executable (generic) (10.5)
.exe | Generic Win/DOS Executable (4.6)
.exe | DOS Executable Generic (4.6)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2023:07:03 11:36:59+00:00
ImageFileCharacteristics: Executable, 32-bit
PEType: PE32
LinkerVersion: 14.16
CodeSize: 70144
InitializedDataSize: 68096
UninitializedDataSize: -
EntryPoint: 0x7de0
OSVersion: 5.1
ImageVersion: -
SubsystemVersion: 5.1
Subsystem: Windows GUI
FileVersionNumber: 5.27.0.1156
ProductVersionNumber: 5.27.0.1156
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: English (U.S.)
CharacterSet: Windows, Latin1
CompanyName: HHD Software Ltd.
FileDescription: Virtual Serial Port Tools Installation Package
FileVersion: 5.27.00.1156
LegalCopyright: © 2018 - 2023 by HHD Software Ltd. All rights reserved.
InternalName: setup.exe
OriginalFileName: setup.exe
ProductName: Virtual Serial Port Tools
ProductVersion: 5.27.00.1156
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
58
Monitored processes
15
Malicious processes
8
Suspicious processes
0

Behavior graph

Click at the process to see the details
start free-virtual-serial-port-tools.exe setup.exe no specs setup.exe vssvc.exe no specs SPPSurrogate no specs drvinst.exe rundll32.exe no specs ps_server.exe no specs psip_server.exe no specs vspcfg.exe no specs vspcfg.exe drvinst.exe wusa.exe no specs drvinst.exe no specs rundll32.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
240C:\Windows\system32\DllHost.exe /Processid:{F32D97DF-E3E5-4CB9-9E3E-0EB5B4E49801}C:\Windows\System32\dllhost.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
COM Surrogate
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\dllhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\ole32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
668DrvInst.exe "2" "211" "ROOT\PORTS\0000" "C:\Windows\INF\oem2.inf" "psharedrv.inf:HHD.NTx86:PShare_Install:5.26.0.1154:hhdvirt\universalserial2" "68749c2f3" "000004B0" "000005E0" "000005E8"C:\Windows\System32\drvinst.exe
svchost.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Driver Installation Module
Exit code:
1058
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
968rundll32.exe C:\Windows\system32\pnpui.dll,InstallSecurityPromptRunDllW 20 Global\{6b9f6f96-c62f-5de1-9ee4-8975dd4baf6c} Global\{52c9ec26-af37-3bf1-0c65-cd2d990cce17} C:\Windows\System32\DriverStore\Temp\{43ce1582-3d2f-50d3-c795-b75c1f488541}\psharedrv.inf C:\Windows\System32\DriverStore\Temp\{43ce1582-3d2f-50d3-c795-b75c1f488541}\psharedrv_x86.catC:\Windows\System32\rundll32.exe—drvinst.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows host process (Rundll32)
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\rundll32.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\imagehlp.dll
1592"C:\Program Files\HHD Software\Virtual Serial Port Tools\vspcfg.exe" C:\Program Files\HHD Software\Virtual Serial Port Tools\vspcfg.exe—setup.exe
User:
admin
Company:
HHD Software Ltd.
Integrity Level:
MEDIUM
Description:
Virtual Serial Port Tools Configuration Utility
Exit code:
3221226540
Version:
5.27.00.1156
Modules
Images
c:\program files\hhd software\virtual serial port tools\vspcfg.exe
c:\windows\system32\ntdll.dll
1696"C:\Users\admin\AppData\Local\Temp\7z81A48F60\setup.exe" C:\Users\admin\AppData\Local\Temp\7z81A48F60\setup.exe—free-virtual-serial-port-tools.exe
User:
admin
Company:
HHD Software Ltd.
Integrity Level:
MEDIUM
Description:
Virtual Serial Port Tools Installation Package
Exit code:
0
Version:
5.27.00.1156
Modules
Images
c:\users\admin\appdata\local\temp\7z81a48f60\setup.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
2096DrvInst.exe "4" "20" "C:\Users\admin\AppData\Local\Temp\{2efd8e52-55ee-0f66-65b7-4f0738dc5f43}\psharedrv.inf" "0" "6343464b7" "000005D4" "WinSta0\Default" "000003F8" "208" "C:\Users\admin\AppData\Local\Temp\{F9C3716E-A2B9-4719-BD8A-A0BDA00F645D}\Components\drvreg_win8"C:\Windows\System32\drvinst.exe
svchost.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Driver Installation Module
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\drvinst.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\setupapi.dll
c:\windows\system32\cfgmgr32.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
2364C:\Windows\system32\vssvc.exeC:\Windows\System32\VSSVC.exe—services.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Microsoft® Volume Shadow Copy Service
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\vssvc.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
2588"C:\Program Files\HHD Software\Virtual Serial Port Tools\ps_server.exe"C:\Program Files\HHD Software\Virtual Serial Port Tools\ps_server.exe—services.exe
User:
LOCAL SERVICE
Company:
HHD Software Ltd.
Integrity Level:
SYSTEM
Description:
Remote Serial Ports Server Application
Exit code:
0
Version:
5.27.00.1156
Modules
Images
c:\program files\hhd software\virtual serial port tools\ps_server.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\ole32.dll
c:\windows\system32\gdi32.dll
2792"C:\Users\admin\AppData\Local\Temp\7z81A48F60\setup.exe" -machine -silent --allow-error --type 1 --server {8974CC4C-FD34-4761-BA16-E41C7352C55F} --source "C:\Users\admin\AppData\Local\Temp\7z81A48F60"C:\Users\admin\AppData\Local\Temp\7z81A48F60\setup.exe
setup.exe
User:
admin
Company:
HHD Software Ltd.
Integrity Level:
HIGH
Description:
Virtual Serial Port Tools Installation Package
Exit code:
0
Version:
5.27.00.1156
Modules
Images
c:\users\admin\appdata\local\temp\7z81a48f60\setup.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
2808"C:\Program Files\HHD Software\Virtual Serial Port Tools\psip_server.exe"C:\Program Files\HHD Software\Virtual Serial Port Tools\psip_server.exe—services.exe
User:
LOCAL SERVICE
Company:
HHD Software Ltd.
Integrity Level:
SYSTEM
Description:
TCP/IP Serial Ports Server Application
Exit code:
0
Version:
5.27.00.1156
Modules
Images
c:\program files\hhd software\virtual serial port tools\psip_server.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\ole32.dll
c:\windows\system32\gdi32.dll
Total events
20 513
Read events
19 944
Write events
556
Delete events
13

Modification events

(PID) Process:(1696) setup.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
(PID) Process:(1696) setup.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:IntranetName
Value:
1
(PID) Process:(1696) setup.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
1
(PID) Process:(1696) setup.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
0
(PID) Process:(2792) setup.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\SystemRestore
Operation:writeName:SrCreateRp (Enter)
Value:
4000000000000000E21E56350A79DA01E80A000010080000D5070000000000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(2792) setup.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\SPP
Operation:writeName:SppCreate (Enter)
Value:
4000000000000000E21E56350A79DA01E80A000010080000D0070000000000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(2792) setup.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SPP
Operation:writeName:LastIndex
Value:
75
(PID) Process:(2792) setup.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\SPP
Operation:writeName:SppGatherWriterMetadata (Enter)
Value:
40000000000000000C946B350A79DA01E80A000010080000D3070000000000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(2792) setup.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\VssapiPublisher
Operation:writeName:IDENTIFY (Enter)
Value:
4000000000000000741D75350A79DA01E80A0000640E0000E803000001000000000000000000000001F20CB9DBD7734992010B99C82BDFC30000000000000000
(PID) Process:(2364) VSSVC.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\Shadow Copy Optimization Writer
Operation:writeName:IDENTIFY (Enter)
Value:
400000000000000082447C350A79DA013C09000088090000E8030000010000000100000000000000000000000000000000000000000000000000000000000000
Executable files
90
Suspicious files
33
Text files
29
Unknown types
16

Dropped files

PID
Process
Filename
Type
3936free-virtual-serial-port-tools.exeC:\Users\admin\AppData\Local\Temp\7z81A48F60\{150A905B-EF26-4780-9315-63DE2CA08DD6}.7z —
MD5:—
SHA256:—
3936free-virtual-serial-port-tools.exeC:\Users\admin\AppData\Local\Temp\7z81A48F60\icon.pngimage
MD5:0FD76852C28360D5183B114A5664D757
SHA256:B4DEF9573C7EFBEC6B62DB1B26D91CC0823D7124C1830A493FBF2906C830ECC0
2792setup.exeC:\Users\admin\AppData\Local\Temp\{F9C3716E-A2B9-4719-BD8A-A0BDA00F645D}\Components\drvreg_win10\psharedrv_x64.catcat
MD5:4A804255D0A0DDA7BC4268AB7A4FA672
SHA256:5FEE64EF955DD6003084D74C987AD301A242B9E23C1CAEB743C2B75D3A364FE7
2792setup.exeC:\Users\admin\AppData\Local\Temp\{F9C3716E-A2B9-4719-BD8A-A0BDA00F645D}\Components\drvreg_win8\psharedrv_x64.catcat
MD5:36DBE65585B7EEA64335AEC36D2CEE74
SHA256:73D9072956DF1D728AEEBBAE81D9D3478E3FD82ACFDE35BD9D342A98313132B1
2792setup.exeC:\Users\admin\AppData\Local\Temp\{F9C3716E-A2B9-4719-BD8A-A0BDA00F645D}\Components\drvreg_win8\psharedrv.infbinary
MD5:5B6EE56A94553830908191B3183B4453
SHA256:6C5EDB5AE8678FC97951266E0044111CC0CCF6DEF05A94D488F304C4993947B7
2792setup.exeC:\Users\admin\AppData\Local\Temp\{F9C3716E-A2B9-4719-BD8A-A0BDA00F645D}\Components\drvreg_win8\psharedrv_x86.catcat
MD5:3E3260C55460ECFF3D2F2E19ACDE5DBC
SHA256:68AA0F8E7B8893779AA14D99D0B1855B5DB5E9C4A15E30100B8BDE196B981DD4
2792setup.exeC:\Users\admin\AppData\Local\Temp\{F9C3716E-A2B9-4719-BD8A-A0BDA00F645D}\Components\drvreg_win8\psharedrv_arm64.catcat
MD5:5CDC39B0CA9CE30E9A56FB24C2959249
SHA256:1A99AF2114EDF5DE38E269C4C7E120CEFCF9EA571607454377E607A281FCD2FF
2792setup.exeC:\Users\admin\AppData\Local\Temp\{F9C3716E-A2B9-4719-BD8A-A0BDA00F645D}\Components\hhdvspkit32.dll\hhdvspkit.dll.rgstext
MD5:D5370222E94BEF6F94502E8BDAE42492
SHA256:1EDD38B9B8039B425EDF3E469BD4446E103C8128565DDC869935FFCCEA009D0E
2792setup.exeC:\Users\admin\AppData\Local\Temp\{F9C3716E-A2B9-4719-BD8A-A0BDA00F645D}\Components\idlfile\clientctl.idltext
MD5:1D5E62D4BF25974627F89FADD81BE27E
SHA256:C088CBD5DBA73671EB3CF1484892A178D8B1583A9442386CFA7280BE4D536EA6
2792setup.exeC:\Users\admin\AppData\Local\Temp\{F9C3716E-A2B9-4719-BD8A-A0BDA00F645D}\Components\vspcfg.exe\install vspcfg.rgstext
MD5:6BBCFA5B946A655B7C4F0D1A56FEBAEF
SHA256:C21AEE3C545123F8574682FA01FF5807D123BA652A697A7A1F35C08FA55EB79C
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
5
DNS requests
2
Threats
0

HTTP requests

No HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:138
—
—
—
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
—
—
224.0.0.252:5355
—
—
—
unknown
1080
svchost.exe
224.0.0.252:5355
—
—
—
unknown
3192
vspcfg.exe
46.4.88.174:443
www.hhdsoftware.com
Hetzner Online GmbH
DE
unknown

DNS requests

Domain
IP
Reputation
www.hhdsoftware.com
  • 46.4.88.174
unknown
dns.msftncsi.com
  • 131.107.255.255
shared

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
free-virtual-serial-port-tools.exe