| File name: | DriverEasy_Setup.exe |
| Full analysis: | https://app.any.run/tasks/c813bf0e-850d-4116-a96c-3f268550aeef |
| Verdict: | Malicious activity |
| Analysis date: | December 02, 2023, 20:34:31 |
| OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
| Indicators: | |
| MIME: | application/x-dosexec |
| File info: | PE32 executable (GUI) Intel 80386, for MS Windows |
| MD5: | ACF113BDC4583A106696935F4EB019EE |
| SHA1: | 0AEFA5323925BD97BCE4AD1E5B604D5BA9E298F8 |
| SHA256: | 538CCBE8745DC8FC45223275CF4E69F9A7085421DB413B795B085400CDE146F4 |
| SSDEEP: | 98304:T+cD4dnGok8BazCB+tx/+IBBQHQOZF7CV6W+ytwlUXbZa5ZABAroyWZ98ZCCFvSI:EIvAZapB7q5 |
| .exe | | | Inno Setup installer (67.7) |
|---|---|---|
| .exe | | | Win32 EXE PECompact compressed (generic) (25.6) |
| .exe | | | Win32 Executable (generic) (2.7) |
| .exe | | | Win16/32 Executable Delphi generic (1.2) |
| .exe | | | Generic Win/DOS Executable (1.2) |
| MachineType: | Intel 386 or later, and compatibles |
|---|---|
| TimeStamp: | 2022:04:14 18:10:23+02:00 |
| ImageFileCharacteristics: | No relocs, Executable, No line numbers, No symbols, Bytes reversed lo, 32-bit, Bytes reversed hi |
| PEType: | PE32 |
| LinkerVersion: | 2.25 |
| CodeSize: | 741888 |
| InitializedDataSize: | 314880 |
| UninitializedDataSize: | - |
| EntryPoint: | 0xb5eec |
| OSVersion: | 6.1 |
| ImageVersion: | 6 |
| SubsystemVersion: | 6.1 |
| Subsystem: | Windows GUI |
| FileVersionNumber: | 5.8.1.41398 |
| ProductVersionNumber: | 5.8.1.41398 |
| FileFlagsMask: | 0x003f |
| FileFlags: | (none) |
| FileOS: | Win32 |
| ObjectFileType: | Executable application |
| FileSubtype: | - |
| LanguageCode: | Neutral |
| CharacterSet: | Unicode |
| Comments: | This installation was built with Inno Setup. |
| CompanyName: | Easeware |
| FileDescription: | Driver Easy Setup |
| FileVersion: | 5.8.1.41398 |
| LegalCopyright: | Copyright © 2023 Easeware. |
| OriginalFileName: | DriverEasy_Setup.exe |
| ProductName: | Driver Easy |
| ProductVersion: | 5.8.1 |
PID | CMD | Path | Indicators | Parent process | |||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 280 | "C:\Users\admin\AppData\Local\Temp\DriverEasy_Setup.exe" /SPAWNWND=$10015A /NOTIFYWND=$25013A | C:\Users\admin\AppData\Local\Temp\DriverEasy_Setup.exe | DriverEasy_Setup.tmp | ||||||||||||
User: admin Company: Easeware Integrity Level: HIGH Description: Driver Easy Setup Exit code: 0 Version: 5.8.1.41398 Modules
| |||||||||||||||
| 684 | "C:\Program Files\Easeware\DriverEasy\Easeware.ConfigLanguageFromSetup.exe" DriverEasy en True | C:\Program Files\Easeware\DriverEasy\Easeware.ConfigLanguageFromSetup.exe | — | DriverEasy_Setup.tmp | |||||||||||
User: admin Company: Easeware Integrity Level: HIGH Description: Easeware.ConfigLanguageFromSetup Exit code: 0 Version: 1.0.4.0 Modules
| |||||||||||||||
| 1128 | "C:\Program Files\Windows Media Player\wmpnscfg.exe" | C:\Program Files\Windows Media Player\wmpnscfg.exe | — | explorer.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows Media Player Network Sharing Service Configuration Application Exit code: 0 Version: 12.0.7600.16385 (win7_rtm.090713-1255) Modules
| |||||||||||||||
| 1236 | "C:\Users\admin\AppData\Local\Temp\is-A0KVA.tmp\DriverEasy_Setup.tmp" /SL5="$25013A,4429772,1057792,C:\Users\admin\AppData\Local\Temp\DriverEasy_Setup.exe" | C:\Users\admin\AppData\Local\Temp\is-A0KVA.tmp\DriverEasy_Setup.tmp | — | DriverEasy_Setup.exe | |||||||||||
User: admin Company: Easeware Integrity Level: MEDIUM Description: Setup/Uninstall Exit code: 0 Version: 51.1052.0.0 Modules
| |||||||||||||||
| 1840 | "C:\Program Files\Easeware\DriverEasy\Easeware.CheckScheduledScan.exe" -create "Driver Easy Scheduled Scan" "C:\Program Files\Easeware\DriverEasy\DriverEasy.exe" | C:\Program Files\Easeware\DriverEasy\Easeware.CheckScheduledScan.exe | — | DriverEasy_Setup.tmp | |||||||||||
User: admin Company: Easeware Integrity Level: HIGH Description: Easeware.CheckScheduledScan Exit code: 0 Version: 1.0.1.0 Modules
| |||||||||||||||
| 2088 | "C:\Program Files\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=2496 --field-trial-handle=1300,i,6601223198873653091,12024743079889472216,131072 /prefetch:8 | C:\Program Files\Microsoft\Edge\Application\msedge.exe | — | msedge.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: LOW Description: Microsoft Edge Exit code: 0 Version: 109.0.1518.115 Modules
| |||||||||||||||
| 2464 | "C:\Users\admin\AppData\Local\Temp\is-6D5S6.tmp\DriverEasy_Setup.tmp" /SL5="$1B0190,4429772,1057792,C:\Users\admin\AppData\Local\Temp\DriverEasy_Setup.exe" /SPAWNWND=$10015A /NOTIFYWND=$25013A | C:\Users\admin\AppData\Local\Temp\is-6D5S6.tmp\DriverEasy_Setup.tmp | — | DriverEasy_Setup.exe | |||||||||||
User: admin Company: Easeware Integrity Level: HIGH Description: Setup/Uninstall Exit code: 0 Version: 51.1052.0.0 Modules
| |||||||||||||||
| 2644 | "C:\Users\admin\AppData\Local\Temp\DriverEasy_Setup.exe" | C:\Users\admin\AppData\Local\Temp\DriverEasy_Setup.exe | — | explorer.exe | |||||||||||
User: admin Company: Easeware Integrity Level: MEDIUM Description: Driver Easy Setup Exit code: 0 Version: 5.8.1.41398 Modules
| |||||||||||||||
| 2716 | "C:\Program Files\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.drivereasy.com/redirect/manager.php?info=postinstall&lang=en&ver=5.8.1.41398 Free&installer_id= | C:\Program Files\Microsoft\Edge\Application\msedge.exe | — | DriverEasy_Setup.tmp | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: HIGH Description: Microsoft Edge Exit code: 0 Version: 109.0.1518.115 Modules
| |||||||||||||||
| 2760 | "C:\Program Files\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1556 --field-trial-handle=1300,i,6601223198873653091,12024743079889472216,131072 /prefetch:3 | C:\Program Files\Microsoft\Edge\Application\msedge.exe | msedge.exe | ||||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Microsoft Edge Exit code: 0 Version: 109.0.1518.115 Modules
| |||||||||||||||
| (PID) Process: | (3940) DriverEasy.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Direct3D\MostRecentApplication |
| Operation: | write | Name: | Name |
Value: Explorer.EXE | |||
| (PID) Process: | (2716) msedge.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Edge\BLBeacon |
| Operation: | write | Name: | failed_count |
Value: 0 | |||
| (PID) Process: | (2716) msedge.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Edge\BLBeacon |
| Operation: | write | Name: | state |
Value: 1 | |||
| (PID) Process: | (2716) msedge.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Edge\ThirdParty |
| Operation: | write | Name: | StatusCodes |
Value: 01000000 | |||
| (PID) Process: | (2464) DriverEasy_Setup.tmp | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
| Operation: | write | Name: | ProxyBypass |
Value: 1 | |||
| (PID) Process: | (2464) DriverEasy_Setup.tmp | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
| Operation: | write | Name: | IntranetName |
Value: 1 | |||
| (PID) Process: | (2464) DriverEasy_Setup.tmp | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
| Operation: | write | Name: | UNCAsIntranet |
Value: 1 | |||
| (PID) Process: | (2464) DriverEasy_Setup.tmp | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
| Operation: | write | Name: | AutoDetect |
Value: 0 | |||
| (PID) Process: | (2716) msedge.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Edge\BLBeacon |
| Operation: | write | Name: | state |
Value: 2 | |||
| (PID) Process: | (3388) netsh.exe | Key: | HKEY_CLASSES_ROOT\Local Settings\MuiCache\17F\52C64B7E |
| Operation: | write | Name: | LanguageList |
Value: en-US | |||
PID | Process | Filename | Type | |
|---|---|---|---|---|
| 2464 | DriverEasy_Setup.tmp | C:\Users\admin\AppData\Local\Temp\is-8UEI1.tmp\botva2.dll | executable | |
MD5:67965A5957A61867D661F05AE1F4773E | SHA256:450B9B0BA25BF068AFBC2B23D252585A19E282939BF38326384EA9112DFD0105 | |||
| 2464 | DriverEasy_Setup.tmp | C:\Users\admin\AppData\Local\Temp\is-8UEI1.tmp\innocallback.dll | executable | |
MD5:1C55AE5EF9980E3B1028447DA6105C75 | SHA256:6AFA2D104BE6EFE3D9A2AB96DBB75DB31565DAD64DD0B791E402ECC25529809F | |||
| 2464 | DriverEasy_Setup.tmp | C:\Users\admin\AppData\Local\Temp\is-8UEI1.tmp\button_close.png | image | |
MD5:5F6A7AF5ECA52AA134A4A06832A5D005 | SHA256:7D9EF408AD2520D62D4389C957E105D3FABF14697D2846B77E4FC488FBB84535 | |||
| 2464 | DriverEasy_Setup.tmp | C:\Users\admin\AppData\Local\Temp\is-8UEI1.tmp\background_messagebox.png | image | |
MD5:1549EA2CF00358FB791DB13BCB773501 | SHA256:D9CD2CEE2F362D1388513D5DA6031259FF9CE97E0F13A992C50077E8EAF33E54 | |||
| 280 | DriverEasy_Setup.exe | C:\Users\admin\AppData\Local\Temp\is-6D5S6.tmp\DriverEasy_Setup.tmp | executable | |
MD5:945FCB7A7FD86C96A36BEC419F528D1F | SHA256:C9D52631073331262504A87C2D8F10BE1F56D45F8CE837C886970D0F706A287C | |||
| 2644 | DriverEasy_Setup.exe | C:\Users\admin\AppData\Local\Temp\is-A0KVA.tmp\DriverEasy_Setup.tmp | executable | |
MD5:945FCB7A7FD86C96A36BEC419F528D1F | SHA256:C9D52631073331262504A87C2D8F10BE1F56D45F8CE837C886970D0F706A287C | |||
| 2464 | DriverEasy_Setup.tmp | C:\Users\admin\AppData\Local\Temp\is-8UEI1.tmp\background_welcome_more.png | image | |
MD5:A6D3E5688C82C04D29A0A9EE356E9A8B | SHA256:E940C5F6F7CAD5CE4EB7A66E15F5604D4F4DA5902B53A5259EB045775C93EE4C | |||
| 2464 | DriverEasy_Setup.tmp | C:\Users\admin\AppData\Local\Temp\is-8UEI1.tmp\icon-info_60x60.png | image | |
MD5:1DF20E390976AD57765F1449E07CFD72 | SHA256:7A07B728EBEDE2CF1B4E81A50B7F5F9BEAE0975D4909C889E0D650472016663B | |||
| 2464 | DriverEasy_Setup.tmp | C:\Users\admin\AppData\Local\Temp\is-8UEI1.tmp\background_installing.png | image | |
MD5:01ACDCCEAC1F70FDD485FE5F634D38FD | SHA256:29CC4235D79581DC85BCE06183738F4562C4F9E5E35CE3F1C55366FCFC25D38B | |||
| 2464 | DriverEasy_Setup.tmp | C:\Users\admin\AppData\Local\Temp\is-8UEI1.tmp\background_finish.png | image | |
MD5:D616086585F3450D847F32F3E6AD8317 | SHA256:B0E957BF89342424DA907D866FF5D1C614A4FD3A0603F4DE9C57F606A360DEBB | |||
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
|---|---|---|---|---|---|---|---|---|---|
3940 | DriverEasy.exe | GET | 200 | 184.24.77.199:80 | http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab?bd95f31c171c0a54 | unknown | compressed | 65.2 Kb | unknown |
PID | Process | IP | Domain | ASN | CN | Reputation |
|---|---|---|---|---|---|---|
4 | System | 192.168.100.255:137 | — | — | — | whitelisted |
2588 | svchost.exe | 239.255.255.250:1900 | — | — | — | whitelisted |
1080 | svchost.exe | 224.0.0.252:5355 | — | — | — | unknown |
4 | System | 192.168.100.255:138 | — | — | — | whitelisted |
2760 | msedge.exe | 51.38.74.198:443 | www.drivereasy.com | OVH SAS | FR | unknown |
3972 | msedge.exe | 239.255.255.250:1900 | — | — | — | whitelisted |
2760 | msedge.exe | 13.107.42.16:443 | config.edge.skype.com | MICROSOFT-CORP-MSN-AS-BLOCK | US | whitelisted |
2760 | msedge.exe | 204.79.197.239:443 | edge.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | US | unknown |
2760 | msedge.exe | 20.31.251.109:443 | nav-edge.smartscreen.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | NL | unknown |
2760 | msedge.exe | 51.104.176.40:443 | data-edge.smartscreen.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | IE | unknown |
Domain | IP | Reputation |
|---|---|---|
www.drivereasy.com |
| unknown |
config.edge.skype.com |
| whitelisted |
nav-edge.smartscreen.microsoft.com |
| whitelisted |
edge.microsoft.com |
| whitelisted |
data-edge.smartscreen.microsoft.com |
| whitelisted |
www.googletagmanager.com |
| whitelisted |
yt3.ggpht.com |
| whitelisted |
i.ytimg.com |
| whitelisted |
s.ytimg.com |
| whitelisted |
cdn.affiliatable.io |
| unknown |