| File name: | DriverEasy_Setup.exe |
| Full analysis: | https://app.any.run/tasks/c813bf0e-850d-4116-a96c-3f268550aeef |
| Verdict: | Malicious activity |
| Analysis date: | December 02, 2023, 20:34:31 |
| OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
| Indicators: | |
| MIME: | application/x-dosexec |
| File info: | PE32 executable (GUI) Intel 80386, for MS Windows |
| MD5: | ACF113BDC4583A106696935F4EB019EE |
| SHA1: | 0AEFA5323925BD97BCE4AD1E5B604D5BA9E298F8 |
| SHA256: | 538CCBE8745DC8FC45223275CF4E69F9A7085421DB413B795B085400CDE146F4 |
| SSDEEP: | 98304:T+cD4dnGok8BazCB+tx/+IBBQHQOZF7CV6W+ytwlUXbZa5ZABAroyWZ98ZCCFvSI:EIvAZapB7q5 |
| .exe | | | Inno Setup installer (67.7) |
|---|---|---|
| .exe | | | Win32 EXE PECompact compressed (generic) (25.6) |
| .exe | | | Win32 Executable (generic) (2.7) |
| .exe | | | Win16/32 Executable Delphi generic (1.2) |
| .exe | | | Generic Win/DOS Executable (1.2) |
| MachineType: | Intel 386 or later, and compatibles |
|---|---|
| TimeStamp: | 2022:04:14 18:10:23+02:00 |
| ImageFileCharacteristics: | No relocs, Executable, No line numbers, No symbols, Bytes reversed lo, 32-bit, Bytes reversed hi |
| PEType: | PE32 |
| LinkerVersion: | 2.25 |
| CodeSize: | 741888 |
| InitializedDataSize: | 314880 |
| UninitializedDataSize: | - |
| EntryPoint: | 0xb5eec |
| OSVersion: | 6.1 |
| ImageVersion: | 6 |
| SubsystemVersion: | 6.1 |
| Subsystem: | Windows GUI |
| FileVersionNumber: | 5.8.1.41398 |
| ProductVersionNumber: | 5.8.1.41398 |
| FileFlagsMask: | 0x003f |
| FileFlags: | (none) |
| FileOS: | Win32 |
| ObjectFileType: | Executable application |
| FileSubtype: | - |
| LanguageCode: | Neutral |
| CharacterSet: | Unicode |
| Comments: | This installation was built with Inno Setup. |
| CompanyName: | Easeware |
| FileDescription: | Driver Easy Setup |
| FileVersion: | 5.8.1.41398 |
| LegalCopyright: | Copyright © 2023 Easeware. |
| OriginalFileName: | DriverEasy_Setup.exe |
| ProductName: | Driver Easy |
| ProductVersion: | 5.8.1 |
PID | CMD | Path | Indicators | Parent process | |||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 280 | "C:\Users\admin\AppData\Local\Temp\DriverEasy_Setup.exe" /SPAWNWND=$10015A /NOTIFYWND=$25013A | C:\Users\admin\AppData\Local\Temp\DriverEasy_Setup.exe | DriverEasy_Setup.tmp | ||||||||||||
User: admin Company: Easeware Integrity Level: HIGH Description: Driver Easy Setup Exit code: 0 Version: 5.8.1.41398 Modules
| |||||||||||||||
| 684 | "C:\Program Files\Easeware\DriverEasy\Easeware.ConfigLanguageFromSetup.exe" DriverEasy en True | C:\Program Files\Easeware\DriverEasy\Easeware.ConfigLanguageFromSetup.exe | — | DriverEasy_Setup.tmp | |||||||||||
User: admin Company: Easeware Integrity Level: HIGH Description: Easeware.ConfigLanguageFromSetup Exit code: 0 Version: 1.0.4.0 Modules
| |||||||||||||||
| 1128 | "C:\Program Files\Windows Media Player\wmpnscfg.exe" | C:\Program Files\Windows Media Player\wmpnscfg.exe | — | explorer.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows Media Player Network Sharing Service Configuration Application Exit code: 0 Version: 12.0.7600.16385 (win7_rtm.090713-1255) Modules
| |||||||||||||||
| 1236 | "C:\Users\admin\AppData\Local\Temp\is-A0KVA.tmp\DriverEasy_Setup.tmp" /SL5="$25013A,4429772,1057792,C:\Users\admin\AppData\Local\Temp\DriverEasy_Setup.exe" | C:\Users\admin\AppData\Local\Temp\is-A0KVA.tmp\DriverEasy_Setup.tmp | — | DriverEasy_Setup.exe | |||||||||||
User: admin Company: Easeware Integrity Level: MEDIUM Description: Setup/Uninstall Exit code: 0 Version: 51.1052.0.0 Modules
| |||||||||||||||
| 1840 | "C:\Program Files\Easeware\DriverEasy\Easeware.CheckScheduledScan.exe" -create "Driver Easy Scheduled Scan" "C:\Program Files\Easeware\DriverEasy\DriverEasy.exe" | C:\Program Files\Easeware\DriverEasy\Easeware.CheckScheduledScan.exe | — | DriverEasy_Setup.tmp | |||||||||||
User: admin Company: Easeware Integrity Level: HIGH Description: Easeware.CheckScheduledScan Exit code: 0 Version: 1.0.1.0 Modules
| |||||||||||||||
| 2088 | "C:\Program Files\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=2496 --field-trial-handle=1300,i,6601223198873653091,12024743079889472216,131072 /prefetch:8 | C:\Program Files\Microsoft\Edge\Application\msedge.exe | — | msedge.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: LOW Description: Microsoft Edge Exit code: 0 Version: 109.0.1518.115 Modules
| |||||||||||||||
| 2464 | "C:\Users\admin\AppData\Local\Temp\is-6D5S6.tmp\DriverEasy_Setup.tmp" /SL5="$1B0190,4429772,1057792,C:\Users\admin\AppData\Local\Temp\DriverEasy_Setup.exe" /SPAWNWND=$10015A /NOTIFYWND=$25013A | C:\Users\admin\AppData\Local\Temp\is-6D5S6.tmp\DriverEasy_Setup.tmp | — | DriverEasy_Setup.exe | |||||||||||
User: admin Company: Easeware Integrity Level: HIGH Description: Setup/Uninstall Exit code: 0 Version: 51.1052.0.0 Modules
| |||||||||||||||
| 2644 | "C:\Users\admin\AppData\Local\Temp\DriverEasy_Setup.exe" | C:\Users\admin\AppData\Local\Temp\DriverEasy_Setup.exe | — | explorer.exe | |||||||||||
User: admin Company: Easeware Integrity Level: MEDIUM Description: Driver Easy Setup Exit code: 0 Version: 5.8.1.41398 Modules
| |||||||||||||||
| 2716 | "C:\Program Files\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.drivereasy.com/redirect/manager.php?info=postinstall&lang=en&ver=5.8.1.41398 Free&installer_id= | C:\Program Files\Microsoft\Edge\Application\msedge.exe | — | DriverEasy_Setup.tmp | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: HIGH Description: Microsoft Edge Exit code: 0 Version: 109.0.1518.115 Modules
| |||||||||||||||
| 2760 | "C:\Program Files\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1556 --field-trial-handle=1300,i,6601223198873653091,12024743079889472216,131072 /prefetch:3 | C:\Program Files\Microsoft\Edge\Application\msedge.exe | msedge.exe | ||||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Microsoft Edge Exit code: 0 Version: 109.0.1518.115 Modules
| |||||||||||||||
| (PID) Process: | (3940) DriverEasy.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Direct3D\MostRecentApplication |
| Operation: | write | Name: | Name |
Value: Explorer.EXE | |||
| (PID) Process: | (2716) msedge.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Edge\BLBeacon |
| Operation: | write | Name: | failed_count |
Value: 0 | |||
| (PID) Process: | (2716) msedge.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Edge\BLBeacon |
| Operation: | write | Name: | state |
Value: 1 | |||
| (PID) Process: | (2716) msedge.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Edge\ThirdParty |
| Operation: | write | Name: | StatusCodes |
Value: 01000000 | |||
| (PID) Process: | (2464) DriverEasy_Setup.tmp | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
| Operation: | write | Name: | ProxyBypass |
Value: 1 | |||
| (PID) Process: | (2464) DriverEasy_Setup.tmp | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
| Operation: | write | Name: | IntranetName |
Value: 1 | |||
| (PID) Process: | (2464) DriverEasy_Setup.tmp | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
| Operation: | write | Name: | UNCAsIntranet |
Value: 1 | |||
| (PID) Process: | (2464) DriverEasy_Setup.tmp | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
| Operation: | write | Name: | AutoDetect |
Value: 0 | |||
| (PID) Process: | (2716) msedge.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Edge\BLBeacon |
| Operation: | write | Name: | state |
Value: 2 | |||
| (PID) Process: | (3388) netsh.exe | Key: | HKEY_CLASSES_ROOT\Local Settings\MuiCache\17F\52C64B7E |
| Operation: | write | Name: | LanguageList |
Value: en-US | |||
PID | Process | Filename | Type | |
|---|---|---|---|---|
| 2644 | DriverEasy_Setup.exe | C:\Users\admin\AppData\Local\Temp\is-A0KVA.tmp\DriverEasy_Setup.tmp | executable | |
MD5:945FCB7A7FD86C96A36BEC419F528D1F | SHA256:C9D52631073331262504A87C2D8F10BE1F56D45F8CE837C886970D0F706A287C | |||
| 2464 | DriverEasy_Setup.tmp | C:\Users\admin\AppData\Local\Temp\is-8UEI1.tmp\background_welcome.png | image | |
MD5:F048154D9062A3C2F147B6380CE6F3AC | SHA256:1D537619EA6508A383387D88E523522436E86DC72B929680E1552B10E44CF0F6 | |||
| 2464 | DriverEasy_Setup.tmp | C:\Users\admin\AppData\Local\Temp\is-8UEI1.tmp\progressbar_foreground.png | image | |
MD5:1432DB7BB8B975C28F110A373D9EFE94 | SHA256:ADD59E97C665F0B2E91ED46A9E229320CA3B99F64FC09A54FD5456A8D906F82A | |||
| 2464 | DriverEasy_Setup.tmp | C:\Users\admin\AppData\Local\Temp\is-8UEI1.tmp\progressbar_background.png | image | |
MD5:8590E035E72584CA56EBA6A9DFB23A33 | SHA256:C5267FFEA02E06C538C8BE10B1B83513830D6390A069761D10A4B67D9E684F0B | |||
| 2464 | DriverEasy_Setup.tmp | C:\Users\admin\AppData\Local\Temp\is-8UEI1.tmp\button_browse.png | image | |
MD5:C7C746FCC5542D734A3860B425AC6A1E | SHA256:7CDAC82567CDD9719A83BCB62C098C6D2B19D115F10E3DB2B164B5F3B0ED1F89 | |||
| 2464 | DriverEasy_Setup.tmp | C:\Users\admin\AppData\Local\Temp\is-8UEI1.tmp\icon_uncustom.png | image | |
MD5:5A7F3314FBD8A3DB765394798BC8A9CE | SHA256:2F67D842567176B42176784BB001EC63E3D84685FA35AEBE5C23DB20A969D427 | |||
| 2464 | DriverEasy_Setup.tmp | C:\Users\admin\AppData\Local\Temp\is-8UEI1.tmp\botva2.dll | executable | |
MD5:67965A5957A61867D661F05AE1F4773E | SHA256:450B9B0BA25BF068AFBC2B23D252585A19E282939BF38326384EA9112DFD0105 | |||
| 2464 | DriverEasy_Setup.tmp | C:\Users\admin\AppData\Local\Temp\is-8UEI1.tmp\background_finish.png | image | |
MD5:D616086585F3450D847F32F3E6AD8317 | SHA256:B0E957BF89342424DA907D866FF5D1C614A4FD3A0603F4DE9C57F606A360DEBB | |||
| 2464 | DriverEasy_Setup.tmp | C:\Users\admin\AppData\Local\Temp\is-8UEI1.tmp\button_setup_or_next.png | image | |
MD5:B9E4B8247138AFE12AE2157B20628DE9 | SHA256:7877A7839C12C635271F4F03B980F80CB2CDD19B9C660E706EDAC85F2CA50022 | |||
| 2464 | DriverEasy_Setup.tmp | C:\Users\admin\AppData\Local\Temp\is-8UEI1.tmp\isxdl.dll | executable | |
MD5:48AD1A1C893CE7BF456277A0A085ED01 | SHA256:B0CC4697B2FD1B4163FDDCA2050FC62A9E7D221864F1BD11E739144C90B685B3 | |||
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
|---|---|---|---|---|---|---|---|---|---|
3940 | DriverEasy.exe | GET | 200 | 184.24.77.199:80 | http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab?bd95f31c171c0a54 | unknown | compressed | 65.2 Kb | unknown |
PID | Process | IP | Domain | ASN | CN | Reputation |
|---|---|---|---|---|---|---|
4 | System | 192.168.100.255:137 | — | — | — | whitelisted |
2588 | svchost.exe | 239.255.255.250:1900 | — | — | — | whitelisted |
1080 | svchost.exe | 224.0.0.252:5355 | — | — | — | unknown |
4 | System | 192.168.100.255:138 | — | — | — | whitelisted |
2760 | msedge.exe | 51.38.74.198:443 | www.drivereasy.com | OVH SAS | FR | unknown |
3972 | msedge.exe | 239.255.255.250:1900 | — | — | — | whitelisted |
2760 | msedge.exe | 13.107.42.16:443 | config.edge.skype.com | MICROSOFT-CORP-MSN-AS-BLOCK | US | whitelisted |
2760 | msedge.exe | 204.79.197.239:443 | edge.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | US | unknown |
2760 | msedge.exe | 20.31.251.109:443 | nav-edge.smartscreen.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | NL | unknown |
2760 | msedge.exe | 51.104.176.40:443 | data-edge.smartscreen.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | IE | unknown |
Domain | IP | Reputation |
|---|---|---|
www.drivereasy.com |
| unknown |
config.edge.skype.com |
| whitelisted |
nav-edge.smartscreen.microsoft.com |
| whitelisted |
edge.microsoft.com |
| whitelisted |
data-edge.smartscreen.microsoft.com |
| whitelisted |
www.googletagmanager.com |
| whitelisted |
yt3.ggpht.com |
| whitelisted |
i.ytimg.com |
| whitelisted |
s.ytimg.com |
| whitelisted |
cdn.affiliatable.io |
| unknown |