File name:

ch341a-programa-v1.18-em-portugues-inclui-driver-usb-e-driver-serial5.zip

Full analysis: https://app.any.run/tasks/00b327ac-32ef-44c6-8bb1-8647cf2f4e0f
Verdict: Malicious activity
Analysis date: October 13, 2019, 21:20:07
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: application/zip
File info: Zip archive data, at least v1.0 to extract
MD5:

304328E81E646580A88EE403D016E9EF

SHA1:

54CE6B517A984C850D4F44B70FAD3CCC9E4EBD65

SHA256:

799AA07C20890DA54692384FBFF14D22E39A686A3CB19B093576058060EB0500

SSDEEP:

49152:w9tJtKIkE0fyANNCHOvX5HvIe8vWAn0cwbfujalfD:wJtuE0fyVyXxIPW0gajMD

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Loads dropped or rewritten executable

      • CH341A.exe (PID: 2136)
      • SearchProtocolHost.exe (PID: 3464)

    • Application was dropped or rewritten from another process

      • CH341A.exe (PID: 2136)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 944)

  • INFO

    • Manual execution by user

      • CH341A.exe (PID: 2136)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.zip | ZIP compressed archive (100)

EXIF

ZIP

ZipRequiredVersion: 10
ZipBitFlag: -
ZipCompression: None
ZipModifyDate: 2016:03:01 00:52:28
ZipCRC: 0x00000000
ZipCompressedSize: -
ZipUncompressedSize: -
ZipFileName: CH341A V1.18/
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
37
Monitored processes
3
Malicious processes
2
Suspicious processes
0

Behavior graph

Click at the process to see the details
start winrar.exe searchprotocolhost.exe no specs ch341a.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
944"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\AppData\Local\Temp\ch341a-programa-v1.18-em-portugues-inclui-driver-usb-e-driver-serial5.zip"C:\Program Files\WinRAR\WinRAR.exe
explorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Exit code:
0
Version:
5.60.0
Modules
Images
c:\program files\winrar\winrar.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\comdlg32.dll
2136"C:\Users\admin\Desktop\CH341A V1.18\CH341A V1.18\CH341A.exe" C:\Users\admin\Desktop\CH341A V1.18\CH341A V1.18\CH341A.exe—explorer.exe
User:
admin
Integrity Level:
MEDIUM
Description:
CH341A编程器
Exit code:
0
Version:
1.18
Modules
Images
c:\users\admin\desktop\ch341a v1.18\ch341a v1.18\ch341a.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\shell32.dll
3464"C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe2_ Global\UsGthrCtrlFltPipeMssGthrPipe2 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" C:\Windows\System32\SearchProtocolHost.exe—SearchIndexer.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Microsoft Windows Search Protocol Host
Exit code:
0
Version:
7.00.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\searchprotocolhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
Total events
789
Read events
769
Write events
20
Delete events
0

Modification events

(PID) Process:(944) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtBMP
Value:
(PID) Process:(944) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtIcon
Value:
(PID) Process:(944) WinRAR.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\12B\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(944) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\AppData\Local\Temp\ch341a-programa-v1.18-em-portugues-inclui-driver-usb-e-driver-serial5.zip
(PID) Process:(944) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(944) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(944) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
(PID) Process:(944) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:mtime
Value:
100
(PID) Process:(944) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\DialogEditHistory\ExtrPath
Operation:writeName:0
Value:
C:\Users\admin\Desktop
(PID) Process:(3464) SearchProtocolHost.exeKey:HKEY_USERS\.DEFAULT\Software\Classes\Local Settings\MuiCache\12B\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
Executable files
22
Suspicious files
6
Text files
5
Unknown types
4

Dropped files

PID
Process
Filename
Type
944WinRAR.exeC:\Users\admin\Desktop\CH341A V1.18\CH341A V1.18\Config.initext
MD5:—
SHA256:—
944WinRAR.exeC:\Users\admin\Desktop\CH341A V1.18\CH341A V1.18\Languages\Portugues.initext
MD5:—
SHA256:—
944WinRAR.exeC:\Users\admin\Desktop\CH341A V1.18\CH341A V1.18\USBIOX.DLLexecutable
MD5:DD5716CCFEB8E01D68CDC7EE55BD159A
SHA256:0650452FED018CF1F1B08F70C61EEE2161ABB8249DF37F30706C2DFA30100B41
944WinRAR.exeC:\Users\admin\Desktop\CH341A V1.18\CH341A V1.18\Zlib1.dllexecutable
MD5:B99629D4DBEB3E7A080E9AC4AD1418C5
SHA256:AE79D55C29038CCFAD270F627B120D539D433B385BF299AD8CD5D10743BBF795
944WinRAR.exeC:\Users\admin\Desktop\CH341A V1.18\CH341_SPI Driver_For_WIN7-XP-32e64bits\CH341WDM.CATcat
MD5:71BDCA7F420EA6C2AAC393040624349D
SHA256:1D25C1A1B550E94789CD9A7E3FA01C11B3C7B75737D1C0BE1AC08626C76111FB
944WinRAR.exeC:\Users\admin\Desktop\CH341A V1.18\CH341_SPI Driver_For_WIN7-XP-32e64bits\CH341W64.SYSexecutable
MD5:2E8E48AD2CA64024C20C67C747F217F6
SHA256:AED7640E2195F5A52E788844D38B08F906264D2E740BD362DB76C241CBB27F7E
944WinRAR.exeC:\Users\admin\Desktop\CH341A V1.18\CH341_SPI Driver_For_WIN7-XP-32e64bits\DRVSETUP64\CH341PAR.EXEexecutable
MD5:E2F8D948713CB68786F3221B59634E09
SHA256:CB7A064C92503C245E38D86FEB87B6B241ADAE940CA352BB186CD252F1F1E469
944WinRAR.exeC:\Users\admin\Desktop\CH341A V1.18\CH341_SPI Driver_For_WIN7-XP-32e64bits\CH341WDM.SYSexecutable
MD5:E6E76D443E2925F7AE9D9FBF4255B50C
SHA256:A3045A4F29A8C86E6FE5AF9E5C9225294D266C6218D65BBFCAA5A7D1C683ABD7
944WinRAR.exeC:\Users\admin\Desktop\CH341A V1.18\CH341A V1.18\CH341A.exeexecutable
MD5:3F217D4DBFECCAB5F7BF158981F46CA9
SHA256:8B3C13C1BB8D954028AFDDA8CAE749808A64EC3D931063192AC0ACD102AC1416
944WinRAR.exeC:\Users\admin\Desktop\CH341A V1.18\CH341_SPI Driver_For_WIN7-XP-32e64bits\CH341WDM.INFbinary
MD5:92AA65B747DC242E8CC3B50264147D21
SHA256:466D05703A3CD24C9A4C7E7329A46205543D342474D80384894FE7748D53556D
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
0
DNS requests
0
Threats
0

HTTP requests

No HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

No data

DNS requests

No data

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
ch341a-programa-v1.18-em-portugues-inclui-driver-usb-e-driver-serial5.zip