URL:

http://dwrapper-dev.herokuapp.com/beetle-cab.cab

Full analysis: https://app.any.run/tasks/81899d40-2fa9-4e59-acac-94c47e47bc5c
Verdict: Malicious activity
Threats:

A loader is malicious software that infiltrates devices to deliver malicious payloads. This malware is capable of infecting victims’ computers, analyzing their system information, and installing other types of threats, such as trojans or stealers. Criminals usually deliver loaders through phishing emails and links by relying on social engineering to trick users into downloading and running their executables. Loaders employ advanced evasion and persistence tactics to avoid detection.

Malware Trends Tracker     >>>
Analysis date: June 26, 2023, 04:33:49
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
loader
Indicators:
MD5:

BD8E5AE36D88769DC2EB67FDBDC43258

SHA1:

F432312E763C10287D6E437D5878ED41FB18FF02

SHA256:

54832E3C4FF757E22E693191CAC6575500510FF26180D2B83651081D1C580CDA

SSDEEP:

3:N1KaSMpBsSxYIOu:CaHn3Ou

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Bypass execution policy to execute commands

      • powershell.exe (PID: 908)

    • Starts Visual C# compiler

      • powershell.exe (PID: 908)

    • Registers / Runs the DLL via REGSVR32.EXE

      • cmd.exe (PID: 2600)

  • SUSPICIOUS

    • Executing commands from ".cmd" file

      • explorer.exe (PID: 1068)
      • mshta.exe (PID: 2864)
      • RuntimePack.exe (PID: 3276)
      • DirectX.exe (PID: 5308)

    • Possibly malicious use of IEX has been detected

      • cmd.exe (PID: 1472)

    • Starts POWERSHELL.EXE for commands execution

      • cmd.exe (PID: 1472)

    • Starts CMD.EXE for commands execution

      • explorer.exe (PID: 1068)
      • mshta.exe (PID: 2864)
      • RuntimePack.exe (PID: 3276)
      • cmd.exe (PID: 2600)
      • DirectX.exe (PID: 5308)

    • Executable content was dropped or overwritten

      • 7za.exe (PID: 1160)
      • csc.exe (PID: 528)
      • mshta.exe (PID: 2864)
      • aria2c.exe (PID: 528)
      • SearcherBar.exe (PID: 1156)
      • aria2c.exe (PID: 2336)
      • aria2c.exe (PID: 1832)
      • RuntimePack.exe (PID: 3276)
      • cmd.exe (PID: 2600)
      • xcopy.exe (PID: 4192)
      • xcopy.exe (PID: 4428)
      • DirectX.exe (PID: 5308)
      • xcopy.exe (PID: 4812)
      • Chrone.exe (PID: 2180)

    • The process hide an interactive prompt from the user

      • cmd.exe (PID: 1472)

    • Get information on the list of running processes

      • cmd.exe (PID: 1472)

    • The process hides Powershell's copyright startup banner

      • cmd.exe (PID: 1472)

    • The process bypasses the loading of PowerShell profile settings

      • cmd.exe (PID: 1472)

    • Uses RUNDLL32.EXE to load library

      • mshta.exe (PID: 2864)

    • Uses NETSH.EXE to delete a firewall rule or allowed programs

      • cmd.exe (PID: 2968)

    • Uses .NET C# to load dll

      • powershell.exe (PID: 908)

    • Uses NETSH.EXE to add a firewall rule or allowed programs

      • cmd.exe (PID: 2640)

    • Starts application with an unusual extension

      • cmd.exe (PID: 3064)

    • Uses NETSH.EXE to obtain data on the network

      • cmd.exe (PID: 3064)

    • Uses WMIC.EXE to obtain system information

      • cmd.exe (PID: 768)

    • Starts SC.EXE for service management

      • cmd.exe (PID: 3868)

    • Application launched itself

      • cmd.exe (PID: 2600)

    • Uses REG/REGEDIT.EXE to modify registry

      • cmd.exe (PID: 2600)
      • cmd.exe (PID: 6016)

  • INFO

    • The process uses the downloaded file

      • WinRAR.exe (PID: 4012)
      • iexplore.exe (PID: 2096)

    • Application launched itself

      • iexplore.exe (PID: 2096)

    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 4012)

    • The executable file from the user directory is run by the CMD process

      • SearcherBar.exe (PID: 2616)
      • SearcherBar.exe (PID: 3880)
      • SearcherBar.exe (PID: 1156)
      • RuntimePack.exe (PID: 2368)
      • RuntimePack.exe (PID: 3828)
      • RuntimePack.exe (PID: 3276)
      • WOW.exe (PID: 3868)
      • WOW.exe (PID: 2592)
      • WOT.exe (PID: 2264)
      • WOW.exe (PID: 1356)
      • WOT.exe (PID: 2056)
      • WOT.exe (PID: 2540)
      • DirectX.exe (PID: 5532)
      • DirectX.exe (PID: 5308)
      • DirectX.exe (PID: 5972)
      • Chrone.exe (PID: 2044)
      • Chrone.exe (PID: 2180)
      • Chrone.exe (PID: 4500)
      • DriverPack-Alice.exe (PID: 5632)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
665
Monitored processes
444
Malicious processes
14
Suspicious processes
3

Behavior graph

Click at the process to see the details
start iexplore.exe iexplore.exe winrar.exe searchprotocolhost.exe no specs explorer.exe no specs notepad.exe no specs 7za.exe no specs cmd.exe no specs 7za.exe mshta.exe cmd.exe no specs powershell.exe no specs cmd.exe no specs rundll32.exe no specs netsh.exe no specs csc.exe cvtres.exe no specs cmd.exe no specs netsh.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs driverpack-wget.exe no specs driverpack-wget.exe no specs driverpack-wget.exe no specs driverpack-wget.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs driverpack-wget.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs driverpack-wget.exe no specs driverpack-wget.exe no specs driverpack-wget.exe no specs driverpack-wget.exe no specs driverpack-wget.exe no specs driverpack-wget.exe no specs driverpack-wget.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs driverpack-wget.exe no specs driverpack-wget.exe no specs driverpack-wget.exe no specs driverpack-wget.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs driverpack-wget.exe no specs driverpack-wget.exe no specs driverpack-wget.exe no specs cmd.exe no specs cmd.exe no specs driverpack-wget.exe no specs driverpack-wget.exe no specs driverpack-7za.exe no specs cmd.exe no specs chcp.com no specs netsh.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs driverpack-wget.exe no specs driverpack-wget.exe no specs driverpack-wget.exe no specs cmd.exe no specs sc.exe no specs cmd.exe no specs wmic.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs driverpack-wget.exe no specs driverpack-wget.exe no specs driverpack-wget.exe no specs driverpack-wget.exe no specs driverpack-wget.exe no specs rundll32.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs aria2c.exe aria2c.exe no specs aria2c.exe no specs aria2c.exe no specs aria2c.exe no specs driverpack-wget.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs driverpack-wget.exe no specs driverpack-wget.exe no specs driverpack-wget.exe no specs cmd.exe no specs driverpack-wget.exe no specs cmd.exe no specs cmd.exe no specs aria2c.exe searcherbar.exe no specs searcherbar.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs driverpack-wget.exe no specs driverpack-wget.exe no specs driverpack-wget.exe no specs searcherbar.exe cmd.exe no specs cmd.exe no specs cmd.exe no specs driverpack-wget.exe no specs driverpack-wget.exe no specs driverpack-wget.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs driverpack-wget.exe no specs driverpack-wget.exe no specs driverpack-wget.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs driverpack-wget.exe no specs driverpack-wget.exe no specs driverpack-wget.exe no specs cmd.exe no specs cmd.exe no specs driverpack-wget.exe no specs driverpack-wget.exe no specs cmd.exe no specs aria2c.exe cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs driverpack-wget.exe no specs driverpack-wget.exe no specs driverpack-wget.exe no specs driverpack-wget.exe no specs cmd.exe no specs cmd.exe no specs aria2c.exe no specs runtimepack.exe no specs runtimepack.exe no specs runtimepack.exe cmd.exe no specs cmd.exe no specs driverpack-wget.exe no specs driverpack-wget.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe driverpack-wget.exe no specs driverpack-wget.exe no specs cmd.exe no specs regsvr32.exe no specs regsvr32.exe no specs regsvr32.exe no specs cmd.exe no specs wow.exe no specs wow.exe no specs wow.exe regsvr32.exe no specs regsvr32.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs driverpack-wget.exe no specs driverpack-wget.exe no specs driverpack-wget.exe no specs regsvr32.exe no specs driverpack-wget.exe no specs regsvr32.exe no specs cmd.exe no specs regsvr32.exe no specs wot.exe no specs wot.exe no specs regsvr32.exe no specs wot.exe regsvr32.exe no specs regsvr32.exe no specs regsvr32.exe no specs regsvr32.exe no specs regsvr32.exe no specs regsvr32.exe no specs cmd.exe no specs cmd.exe no specs driverpack-wget.exe no specs driverpack-wget.exe no specs regsvr32.exe no specs regsvr32.exe no specs regsvr32.exe no specs regsvr32.exe no specs regsvr32.exe no specs regsvr32.exe no specs regsvr32.exe no specs regsvr32.exe no specs regedit.exe no specs compact.exe no specs compact.exe no specs compact.exe no specs compact.exe no specs compact.exe no specs compact.exe no specs compact.exe no specs compact.exe no specs compact.exe no specs compact.exe no specs compact.exe no specs compact.exe no specs compact.exe no specs compact.exe no specs compact.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs compact.exe no specs driverpack-wget.exe no specs driverpack-wget.exe no specs driverpack-wget.exe no specs compact.exe no specs compact.exe no specs compact.exe no specs compact.exe no specs compact.exe no specs compact.exe no specs compact.exe no specs compact.exe no specs compact.exe no specs compact.exe no specs compact.exe no specs compact.exe no specs compact.exe no specs compact.exe no specs compact.exe no specs compact.exe no specs compact.exe no specs compact.exe no specs compact.exe no specs compact.exe no specs compact.exe no specs compact.exe no specs compact.exe no specs wmpnscfg.exe no specs compact.exe no specs compact.exe no specs compact.exe no specs compact.exe no specs compact.exe no specs compact.exe no specs compact.exe no specs compact.exe no specs compact.exe no specs compact.exe no specs compact.exe no specs compact.exe no specs compact.exe no specs compact.exe no specs compact.exe no specs compact.exe no specs compact.exe no specs compact.exe no specs compact.exe no specs compact.exe no specs compact.exe no specs compact.exe no specs compact.exe no specs compact.exe no specs compact.exe no specs compact.exe no specs compact.exe no specs cmd.exe no specs cmd.exe no specs compact.exe no specs driverpack-wget.exe no specs driverpack-wget.exe no specs compact.exe no specs cmd.exe no specs cmd.exe no specs driverpack-wget.exe no specs driverpack-wget.exe no specs cmd.exe no specs driverpack-wget.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs driverpack-wget.exe no specs driverpack-wget.exe no specs driverpack-wget.exe no specs driverpack-wget.exe no specs driverpack-wget.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs driverpack-wget.exe no specs driverpack-wget.exe no specs driverpack-wget.exe no specs driverpack-wget.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs driverpack-wget.exe no specs driverpack-wget.exe no specs driverpack-wget.exe no specs driverpack-wget.exe no specs driverpack-wget.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs driverpack-wget.exe no specs driverpack-wget.exe no specs driverpack-wget.exe no specs driverpack-wget.exe no specs driverpack-wget.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs driverpack-wget.exe no specs driverpack-wget.exe no specs driverpack-wget.exe no specs driverpack-wget.exe no specs driverpack-wget.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs driverpack-wget.exe no specs driverpack-wget.exe no specs driverpack-wget.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs driverpack-wget.exe no specs driverpack-wget.exe no specs driverpack-wget.exe no specs driverpack-wget.exe no specs driverpack-wget.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs driverpack-wget.exe no specs driverpack-wget.exe no specs driverpack-wget.exe no specs driverpack-wget.exe no specs driverpack-wget.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs driverpack-wget.exe no specs driverpack-wget.exe no specs driverpack-wget.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs driverpack-wget.exe no specs driverpack-wget.exe no specs driverpack-wget.exe no specs driverpack-wget.exe no specs driverpack-wget.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs driverpack-wget.exe no specs driverpack-wget.exe no specs driverpack-wget.exe no specs driverpack-wget.exe no specs driverpack-wget.exe no specs cmd.exe no specs cmd.exe no specs driverpack-wget.exe no specs driverpack-wget.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs driverpack-wget.exe no specs driverpack-wget.exe no specs driverpack-wget.exe no specs driverpack-wget.exe no specs driverpack-wget.exe no specs cmd.exe no specs driverpack-wget.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs driverpack-wget.exe no specs driverpack-wget.exe no specs driverpack-wget.exe no specs driverpack-wget.exe no specs driverpack-wget.exe no specs cmd.exe no specs driverpack-wget.exe no specs cmd.exe no specs driverpack-wget.exe no specs cmd.exe no specs cmd.exe no specs driverpack-wget.exe no specs driverpack-wget.exe no specs cmd.exe no specs directx.exe no specs directx.exe no specs directx.exe cmd.exe no specs xcopy.exe xcopy.exe xcopy.exe regedit.exe no specs cmd.exe no specs chrone.exe no specs chrone.exe no specs chrone.exe cmd.exe no specs driverpack-alice.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
120"C:\Windows\System32\cmd.exe" /c ""tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Users\admin\Desktop\beetle-cab\ext\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/ANTIVIRUS-1.mp3" -o "C:\Users\admin\AppData\Roaming\DRPSu\temp\wget_log_85378.log" & echo DONE > "C:\Users\admin\AppData\Roaming\DRPSu\temp\wget_finished_85378.txt""C:\Windows\System32\cmd.exe—mshta.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
120"C:\Windows\System32\cmd.exe" /c ""tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Users\admin\Desktop\beetle-cab\ext\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/ISTART_4.mp3" -o "C:\Users\admin\AppData\Roaming\DRPSu\temp\wget_log_23224.log" & echo DONE > "C:\Users\admin\AppData\Roaming\DRPSu\temp\wget_finished_23224.txt""C:\Windows\System32\cmd.exe—mshta.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
128"C:\Windows\System32\cmd.exe" /c ""tools\aria2c.exe" "http://dl.driverpack.io/soft/SearcherBar.exe.torrent" --dir="C:\Users\admin\AppData\Roaming\DRPSu\PROGRAMS" --quiet --continue --min-split-size=1M --follow-torrent=true --check-integrity --seed-time=0 --bt-stop-timeout=120 || echo Done & call echo Done %^errorLevel% > "C:\Users\admin\AppData\Roaming\DRPSu\temp\run_command_32064.txt""C:\Windows\System32\cmd.exe—mshta.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
148"C:\Windows\System32\cmd.exe" /c ""tools\aria2c.exe" "http://dl.driverpack.io/tools/DriverPack-Alice.exe.torrent" --dir="C:\Users\admin\AppData\Roaming\DRPSu\PROGRAMS" --quiet --continue --min-split-size=1M --follow-torrent=true --check-integrity --seed-time=0 --bt-stop-timeout=120 || echo Done & call echo Done %^errorLevel% > "C:\Users\admin\AppData\Roaming\DRPSu\temp\run_command_31806.txt""C:\Windows\System32\cmd.exe—mshta.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
268"C:\Windows\System32\cmd.exe" /c ""tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Users\admin\Desktop\beetle-cab\ext\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/TEAM-PROOF-1.mp3" -o "C:\Users\admin\AppData\Roaming\DRPSu\temp\wget_log_15862.log" & echo DONE > "C:\Users\admin\AppData\Roaming\DRPSu\temp\wget_finished_15862.txt""C:\Windows\System32\cmd.exe—mshta.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
268"tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Users\admin\Desktop\beetle-cab\ext\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/COMPILATION-3.mp3" -o "C:\Users\admin\AppData\Roaming\DRPSu\temp\wget_log_28220.log" C:\Users\admin\Desktop\beetle-cab\ext\Tools\driverpack-wget.exe—cmd.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
312compact.exe /i /c /a /f "C:\Windows\System32\msflxgrd.ocx"C:\Windows\System32\compact.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
File Compress Utility
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
328"tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Users\admin\Desktop\beetle-cab\ext\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/intro.mp3" -o "C:\Users\admin\AppData\Roaming\DRPSu\temp\wget_log_31194.log" C:\Users\admin\Desktop\beetle-cab\ext\Tools\driverpack-wget.exe—cmd.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
328"tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Users\admin\Desktop\beetle-cab\ext\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/UTILS-1.mp3" -o "C:\Users\admin\AppData\Roaming\DRPSu\temp\wget_log_49509.log" C:\Users\admin\Desktop\beetle-cab\ext\Tools\driverpack-wget.exe—cmd.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
528"C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\admin\AppData\Local\Temp\0ws0bko1.cmdline"C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
powershell.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Visual C# Command Line Compiler
Exit code:
0
Version:
4.0.30319.34209 built by: FX452RTMGDR
Total events
14 174
Read events
14 080
Write events
94
Delete events
0

Modification events

(PID) Process:(1068) explorer.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Action Center\Checks\{C8E6F269-B90A-4053-A3BE-499AFCEC98C4}.check.0
Operation:writeName:CheckSetting
Value:
01000000D08C9DDF0115D1118C7A00C04FC297EB010000003D77C3133A5D7248BA6D7744BB9A3E16000000000200000000001066000000010000200000004A9CAAC251DD88A0E7E33FFB23F636A225CB7CC4485369C7C9B03862A811D096000000000E8000000002000020000000659B7585C71088AEEB1875008044DFB4B07623A0B20C3E867A78A9695191E29230000000F9C4E47AAD7D214C673E4CDC8385C59DDC5AE0E28396FCF21F9D028C590E79749BDDC16862F8E26B3D4F8E8966EEF17C4000000006EE6EDF8BC2D3544F7C9D682CF07277A50A34FA9DF6D8FB7B39CA5834F62523E20C12EF252EC87A75BE0FA4A5D7BD80B713248892E659363C3419474A1FEA18
(PID) Process:(2096) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\TabbedBrowsing
Operation:writeName:NTPDaysSinceLastAutoMigration
Value:
0
(PID) Process:(2096) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\TabbedBrowsing
Operation:writeName:NTPLastLaunchHighDateTime
Value:
30847387
(PID) Process:(2096) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\UrlBlockManager
Operation:writeName:NextCheckForUpdateHighDateTime
Value:
30847437
(PID) Process:(2096) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(2096) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
(PID) Process:(2096) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main
Operation:writeName:CompatibilityFlags
Value:
0
(PID) Process:(2096) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
(PID) Process:(2096) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:IntranetName
Value:
1
(PID) Process:(2096) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
1
Executable files
632
Suspicious files
474
Text files
1 510
Unknown types
0

Dropped files

PID
Process
Filename
Type
3580iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\PO2HN1X2\beetle-cab.cab.ibwpifw.partial —
MD5:—
SHA256:—
2096iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\PO2HN1X2\beetle-cab.cab —
MD5:—
SHA256:—
4012WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa4012.3834\beetle-cab\arc.7z —
MD5:—
SHA256:—
4012WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa4012.5845\beetle-cab\arc.7z —
MD5:—
SHA256:—
1068explorer.exe —
MD5:—
SHA256:—
2096iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776binary
MD5:69F5547BC524ACF6B75CAFC58352B3ED
SHA256:2367B2CD7F199E772E876B02E1CACD6FAEE3E1C1295B1731372DEFC355D12AC2
2096iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\PO2HN1X2\beetle-cab.cab.ibwpifw.partial:Zone.Identifiertext
MD5:FBCCF14D504B7B2DBCB5A5BDA75BD93B
SHA256:EACD09517CE90D34BA562171D15AC40D302F0E691B439F91BE1B6406E25F5913
4012WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa4012.3834\beetle-cab\7za.exeexecutable
MD5:90AAC6489F6B226BF7DC1ADABFDB1259
SHA256:BA7F3627715614D113C1E1CD7DD9D47E3402A1E8A7404043E08BC14939364549
2096iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157binary
MD5:8ED1BB05965DBA4EAB12E54CC2FB38B5
SHA256:32C6FA4DA5614C7AD931839203CE92B3DB964769581F7E2F9486135F99C3BE73
3580iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\DY534W2X\beetle-cab[1].cabcompressed
MD5:48EB8E33733B720AE639EE63A18C8643
SHA256:A06F08AEF2C8E6CFA3F8C3283D9AE19091D726B5FE56420A391A39DDE0232243
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
1 093
TCP/UDP connections
400
DNS requests
53
Threats
6 312

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
—
—
GET
301
188.114.96.3:80
http://allfont.ru/allfont.css?fonts=lucida-console
US
—
—
whitelisted
—
—
GET
301
188.114.96.3:80
http://allfont.ru/cache/css/lucida-console.css
US
—
—
whitelisted
—
—
GET
200
142.250.185.67:80
http://ocsp.pki.goog/gtsr1/ME4wTDBKMEgwRjAJBgUrDgMCGgUABBQwkcLWD4LqGJ7bE7B1XZsEbmfwUAQU5K8rJnEaK0gnhS9SZizv8IkTcT4CDQIDvFCjJ1PwkYAi7fE%3D
US
binary
724 b
whitelisted
—
—
GET
200
104.18.21.226:80
http://ocsp2.globalsign.com/rootr5/ME4wTDBKMEgwRjAJBgUrDgMCGgUABBQiD0S5cIHyfrLTJ1fvAkJWflH%2B2QQUPeYpSJvqB8ohREom3m7e0oPQn1kCDQHuXyKVQkkF%2BQGRqNw%3D
US
binary
1.25 Kb
whitelisted
—
—
HEAD
200
87.117.239.151:80
http://dl.driverpack.io/updates/beetle/driverpack-wget.exe
GB
—
—
malicious
—
—
GET
200
142.250.185.67:80
http://ocsp.pki.goog/gsr1/MFEwTzBNMEswSTAJBgUrDgMCGgUABBS3V7W2nAf4FiMTjpDJKg6%2BMgGqMQQUYHtmGkUNl8qJUC99BM00qP%2F8%2FUsCEHe9DWzbNvka6iEPxPBY0w0%3D
US
binary
1.41 Kb
whitelisted
—
—
GET
200
104.18.21.226:80
http://ocsp.globalsign.com/gseccovsslca2018/ME0wSzBJMEcwRTAJBgUrDgMCGgUABBSTMjK03nNiYoQYvu4Izyfn9OJNdAQUWHuOdSr%2BYYCqkEABrtboB0ZuP0gCDGARYrzw0HpRmEcQ9Q%3D%3D
US
binary
940 b
whitelisted
—
—
GET
200
104.18.21.226:80
http://ocsp.globalsign.com/rootr1/MFEwTzBNMEswSTAJBgUrDgMCGgUABBS3V7W2nAf4FiMTjpDJKg6%2BMgGqMQQUYHtmGkUNl8qJUC99BM00qP%2F8%2FUsCEHUeP1PjGFkz6V8I7O6tApc%3D
US
binary
1.41 Kb
whitelisted
—
—
POST
401
87.117.235.115:80
http://auth.drp.su/api/session
GB
text
12 b
suspicious
—
—
GET
200
172.217.16.206:80
http://www.google-analytics.com/collect?v=1&ds=hta&tid=UA-68879973-23&cid=618684412.1614698884&t=event&ec=driverpack%20online&ea=yandex%20patcher%20browser%20not%20detected&el=17.11.108%20online&ul=&z=033212829945585054&sc=start&cd1=618684412.1614698884&cd2=17.11.108%20Online&cd3=7%20x86&cd4=SP%201&cd5=Windows%207%20Professional%20&cd6=(not%20set)
US
image
35 b
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
—
—
37.9.8.75:80
update.drp.su
OOO Network of data-centers Selectel
RU
malicious
—
—
172.217.16.206:80
www.google-analytics.com
GOOGLE
US
whitelisted
—
—
104.18.21.226:80
ocsp.globalsign.com
CLOUDFLARENET
—
shared
—
—
87.117.239.151:80
dl.driverpack.io
Iomart Cloud Services Limited
GB
malicious
4
System
192.168.100.255:138
—
—
—
whitelisted
3580
iexplore.exe
46.137.15.86:80
dwrapper-dev.herokuapp.com
AMAZON-02
IE
suspicious
1076
svchost.exe
224.0.0.252:5355
—
—
—
unknown
4
System
192.168.100.255:137
—
—
—
whitelisted
2000
svchost.exe
239.255.255.250:1900
—
—
—
whitelisted
2096
iexplore.exe
152.199.19.161:443
r20swj13mr.microsoft.com
EDGECAST
US
whitelisted

DNS requests

Domain
IP
Reputation
dwrapper-dev.herokuapp.com
  • 46.137.15.86
  • 54.73.53.134
  • 54.220.192.176
suspicious
r20swj13mr.microsoft.com
  • 152.199.19.161
whitelisted
iecvlist.microsoft.com
  • 152.199.19.161
whitelisted
ctldl.windowsupdate.com
  • 93.184.221.240
whitelisted
ocsp.digicert.com
  • 192.229.221.95
whitelisted
allfont.ru
  • 188.114.96.3
  • 188.114.97.3
whitelisted
ocsp.pki.goog
  • 142.250.185.67
whitelisted
auth.drp.su
  • 87.117.235.115
suspicious
mc.yandex.ru
  • 87.250.251.119
  • 87.250.250.119
  • 93.158.134.119
  • 77.88.21.119
whitelisted
update.drp.su
  • 37.9.8.75
malicious

Threats

PID
Process
Class
Message
—
—
Potentially Bad Traffic
ET DNS Query for .su TLD (Soviet Union) Often Malware Related
—
—
Possibly Unwanted Program Detected
ET ADWARE_PUP DriverPack Domain in DNS Query
—
—
Possibly Unwanted Program Detected
ET ADWARE_PUP Observed DNS Query to DriverPack Domain ( .drp .su)
—
—
Potentially Bad Traffic
ET DNS Query for .su TLD (Soviet Union) Often Malware Related
—
—
Possibly Unwanted Program Detected
ET ADWARE_PUP DriverPack Domain in DNS Query
—
—
Possibly Unwanted Program Detected
ET ADWARE_PUP Observed DNS Query to DriverPack Domain ( .drp .su)
—
—
Potentially Bad Traffic
ET POLICY HTTP Request to .su TLD (Soviet Union) Often Malware Related
—
—
Potentially Bad Traffic
ET POLICY HTTP Request to .su TLD (Soviet Union) Often Malware Related
—
—
Potentially Bad Traffic
ET POLICY HTTP Request to .su TLD (Soviet Union) Often Malware Related
—
—
Potentially Bad Traffic
ET POLICY HTTP Request to .su TLD (Soviet Union) Often Malware Related
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
http://dwrapper-dev.herokuapp.com/beetle-cab.cab