File name:

CH341SER.EXE

Full analysis: https://app.any.run/tasks/62188c39-6f8b-45b6-a62b-ac9514bea3a5
Verdict: Malicious activity
Analysis date: May 26, 2025, 16:50:01
OS: Windows 10 Professional (build: 19044, 64 bit)
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386, for MS Windows, RAR self-extracting archive, 4 sections
MD5:

1461E4F00D1F457B1EACF214FD5A2EF2

SHA1:

C38D5005921D1F932EB29A57168426F06850C254

SHA256:

5C79A8C123D3FA03274FDCCC8FAD722AAF3B703DF35C39B4B42F0B5BFBB26DFD

SSDEEP:

6144:h8U2qy6rRZb7jxGYXqZ9vcF/6jHLrZpEr9TI:5zy6rRxE7RrrjCJI

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Executing a file with an untrusted certificate

      • SETUP.EXE (PID: 7244)
      • SETUP.EXE (PID: 3192)
      • DRVSETUP64.exe (PID: 7272)

  • SUSPICIOUS

    • Drops a system driver (possible attempt to evade defenses)

      • CH341SER.EXE.exe (PID: 5352)
      • drvinst.exe (PID: 7592)
      • DRVSETUP64.exe (PID: 7272)

    • Executable content was dropped or overwritten

      • CH341SER.EXE.exe (PID: 5352)
      • drvinst.exe (PID: 7592)
      • DRVSETUP64.exe (PID: 7272)

    • Reads security settings of Internet Explorer

      • CH341SER.EXE.exe (PID: 5352)

    • Creates file in the systems drive root

      • CH341SER.EXE.exe (PID: 5352)

    • Creates files in the driver directory

      • drvinst.exe (PID: 7592)
      • DRVSETUP64.exe (PID: 7272)

  • INFO

    • Reads the computer name

      • CH341SER.EXE.exe (PID: 5352)
      • DRVSETUP64.exe (PID: 7272)
      • drvinst.exe (PID: 7592)

    • The sample compiled with english language support

      • CH341SER.EXE.exe (PID: 5352)
      • drvinst.exe (PID: 7592)
      • DRVSETUP64.exe (PID: 7272)

    • The sample compiled with chinese language support

      • CH341SER.EXE.exe (PID: 5352)

    • Process checks computer location settings

      • CH341SER.EXE.exe (PID: 5352)

    • Checks supported languages

      • CH341SER.EXE.exe (PID: 5352)
      • DRVSETUP64.exe (PID: 7272)
      • SETUP.EXE (PID: 7244)
      • drvinst.exe (PID: 7592)

    • Create files in a temporary directory

      • DRVSETUP64.exe (PID: 7272)

    • Reads the machine GUID from the registry

      • drvinst.exe (PID: 7592)

    • Reads the software policy settings

      • drvinst.exe (PID: 7592)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | WinRAR Self Extracting archive (94.3)
.scr | Windows screen saver (2.3)
.dll | Win32 Dynamic Link Library (generic) (1.1)
.exe | Win32 Executable (generic) (0.8)
.exe | Win32 Executable Watcom C++ (generic) (0.4)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2007:05:22 04:59:14+00:00
ImageFileCharacteristics: No relocs, Executable, No line numbers, No symbols, 32-bit
PEType: PE32
LinkerVersion: 5
CodeSize: 81920
InitializedDataSize: 22016
UninitializedDataSize: -
EntryPoint: 0x1000
OSVersion: 4
ImageVersion: -
SubsystemVersion: 4
Subsystem: Windows GUI
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
137
Monitored processes
8
Malicious processes
4
Suspicious processes
1

Behavior graph

Click at the process to see the details
start ch341ser.exe.exe setup.exe no specs setup.exe drvsetup64.exe sppextcomobj.exe no specs slui.exe no specs drvinst.exe slui.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
2096C:\WINDOWS\System32\slui.exe -EmbeddingC:\Windows\System32\slui.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Activation Client
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
3192"C:\WCH.CN\CH341SER\SETUP.EXE" C:\WCH.CN\CH341SER\SETUP.EXE—CH341SER.EXE.exe
User:
admin
Integrity Level:
MEDIUM
Description:
EXE For Driver Installation
Exit code:
3221226540
Version:
1, 6, 0, 0
Modules
Images
c:\wch.cn\ch341ser\setup.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
5352"C:\Users\admin\AppData\Local\Temp\CH341SER.EXE.exe" C:\Users\admin\AppData\Local\Temp\CH341SER.EXE.exe
explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\ch341ser.exe.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\advapi32.dll
7244"C:\WCH.CN\CH341SER\SETUP.EXE" C:\WCH.CN\CH341SER\SETUP.EXE
CH341SER.EXE.exe
User:
admin
Integrity Level:
HIGH
Description:
EXE For Driver Installation
Exit code:
0
Version:
1, 6, 0, 0
Modules
Images
c:\wch.cn\ch341ser\setup.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\acgenral.dll
7272C:\WCH.CN\CH341SER\DRVSETUP64\DRVSETUP64.EXEC:\WCH.CN\CH341SER\DRVSETUP64\DRVSETUP64.exe
SETUP.EXE
User:
admin
Integrity Level:
HIGH
Description:
EXE For Driver Installation
Exit code:
1
Version:
1, 6, 0, 0
Modules
Images
c:\wch.cn\ch341ser\drvsetup64\drvsetup64.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
7312C:\WINDOWS\system32\SppExtComObj.exe -EmbeddingC:\Windows\System32\SppExtComObj.Exe—svchost.exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
KMS Connection Broker
Version:
10.0.19041.3996 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\sppextcomobj.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\oleaut32.dll
7344"C:\WINDOWS\System32\SLUI.exe" RuleId=3482d82e-ca2c-4e1f-8864-da0267b484b2;Action=AutoActivate;AppId=55c92734-d682-4d71-983e-d6ec3f16059f;SkuId=4de7cb65-cdf1-4de9-8ae8-e3cce27b9f2c;NotificationInterval=1440;Trigger=TimerEventC:\Windows\System32\slui.exe—SppExtComObj.Exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Windows Activation Client
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
7592DrvInst.exe "4" "0" "C:\Users\admin\AppData\Local\Temp\{de70fa13-43fd-9d42-9f78-6f27e63b4923}\CH341SER.INF" "9" "4dbd0d02f" "00000000000001D0" "WinSta0\Default" "00000000000001D8" "208" "C:\WCH.CN\CH341SER"C:\Windows\System32\drvinst.exe
svchost.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Driver Installation Module
Exit code:
0
Version:
10.0.19041.3996 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\drvinst.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\cfgmgr32.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\ntmarta.dll
c:\windows\system32\devrtl.dll
c:\windows\system32\drvstore.dll
Total events
3 557
Read events
3 555
Write events
2
Delete events
0

Modification events

(PID) Process:(5352) CH341SER.EXE.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR SFX
Operation:writeName:C%%WCH.CN%CH341SER
Value:
C:\WCH.CN\CH341SER
(PID) Process:(7272) DRVSETUP64.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\Setup\SetupapiLogStatus
Operation:writeName:setupapi.dev.log
Value:
4096
Executable files
41
Suspicious files
11
Text files
1
Unknown types
0

Dropped files

PID
Process
Filename
Type
5352CH341SER.EXE.exeC:\WCH.CN\CH341SER\ch341SER.CATbinary
MD5:1F7FE778164D85076E97B10363661CFB
SHA256:18FAB08BA0A79CC57B7A0CE8724CD17E0724B3E0A51BDBA364AE9C236D02DDDC
7272DRVSETUP64.exeC:\Users\admin\AppData\Local\Temp\{de70fa13-43fd-9d42-9f78-6f27e63b4923}\SETDE8D.tmpexecutable
MD5:C58EC27035731337ADD1326880086B16
SHA256:1A48A57D7FF5332AD380AF7884F516548DB535CFE23F3AE7D5AF291307CBC435
5352CH341SER.EXE.exeC:\WCH.CN\CH341SER\CH341S64.SYSexecutable
MD5:C58EC27035731337ADD1326880086B16
SHA256:1A48A57D7FF5332AD380AF7884F516548DB535CFE23F3AE7D5AF291307CBC435
5352CH341SER.EXE.exeC:\WCH.CN\CH341SER\CH341S98.SYSexecutable
MD5:B6F4A83911336E84BEAD8F8905285FAB
SHA256:0ECD1222627271EA31D3B64796992B6DAF5133D64CC26D43B3873CBE32FD59CB
7592drvinst.exeC:\Windows\System32\DriverStore\Temp\{0651396f-85c8-ce42-a316-dd61265ea0a4}\SETDF17.tmpbinary
MD5:1F7FE778164D85076E97B10363661CFB
SHA256:18FAB08BA0A79CC57B7A0CE8724CD17E0724B3E0A51BDBA364AE9C236D02DDDC
7272DRVSETUP64.exeC:\Users\admin\AppData\Local\Temp\{de70fa13-43fd-9d42-9f78-6f27e63b4923}\SETDE7D.tmpexecutable
MD5:69B6FEC924C30042D329AE56CA8925CC
SHA256:45494CE819C1B5C21ABB72DC47A0CA36807E0ED74CE55B631DA174C77A9B24DB
7592drvinst.exeC:\Windows\System32\DriverStore\Temp\{0651396f-85c8-ce42-a316-dd61265ea0a4}\CH341SER.CATbinary
MD5:1F7FE778164D85076E97B10363661CFB
SHA256:18FAB08BA0A79CC57B7A0CE8724CD17E0724B3E0A51BDBA364AE9C236D02DDDC
7272DRVSETUP64.exeC:\Users\admin\AppData\Local\Temp\{de70fa13-43fd-9d42-9f78-6f27e63b4923}\CH341PT.DLLexecutable
MD5:69B6FEC924C30042D329AE56CA8925CC
SHA256:45494CE819C1B5C21ABB72DC47A0CA36807E0ED74CE55B631DA174C77A9B24DB
7272DRVSETUP64.exeC:\Users\admin\AppData\Local\Temp\{de70fa13-43fd-9d42-9f78-6f27e63b4923}\CH341S64.SYSexecutable
MD5:C58EC27035731337ADD1326880086B16
SHA256:1A48A57D7FF5332AD380AF7884F516548DB535CFE23F3AE7D5AF291307CBC435
7272DRVSETUP64.exeC:\Users\admin\AppData\Local\Temp\{de70fa13-43fd-9d42-9f78-6f27e63b4923}\CH341SER.CATbinary
MD5:1F7FE778164D85076E97B10363661CFB
SHA256:18FAB08BA0A79CC57B7A0CE8724CD17E0724B3E0A51BDBA364AE9C236D02DDDC
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
5
TCP/UDP connections
20
DNS requests
15
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
—
—
GET
200
23.219.150.101:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
—
—
GET
200
2.16.168.114:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
8064
SIHClient.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
6544
svchost.exe
GET
200
2.23.77.188:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
8064
SIHClient.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:138
—
—
—
whitelisted
2104
svchost.exe
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
—
—
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
—
—
2.16.168.114:80
crl.microsoft.com
Akamai International B.V.
RU
whitelisted
—
—
23.219.150.101:80
www.microsoft.com
AKAMAI-AS
CL
whitelisted
3216
svchost.exe
172.211.123.248:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
FR
whitelisted
6544
svchost.exe
20.190.159.131:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
6544
svchost.exe
2.23.77.188:80
ocsp.digicert.com
AKAMAI-AS
DE
whitelisted
2112
svchost.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
2104
svchost.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 4.231.128.59
  • 51.104.136.2
whitelisted
google.com
  • 142.250.186.46
whitelisted
crl.microsoft.com
  • 2.16.168.114
  • 2.16.168.124
whitelisted
www.microsoft.com
  • 23.219.150.101
  • 184.30.21.171
whitelisted
client.wns.windows.com
  • 172.211.123.248
whitelisted
login.live.com
  • 20.190.159.131
  • 40.126.31.0
  • 20.190.159.0
  • 40.126.31.129
  • 20.190.159.75
  • 40.126.31.73
  • 20.190.159.71
  • 40.126.31.130
whitelisted
ocsp.digicert.com
  • 2.23.77.188
whitelisted
slscr.update.microsoft.com
  • 4.245.163.56
whitelisted
fe3cr.delivery.mp.microsoft.com
  • 20.3.187.198
whitelisted
activation-v2.sls.microsoft.com
  • —
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
CH341SER.EXE