File name:

CDM212364_Setup.exe

Full analysis: https://app.any.run/tasks/03504615-88a3-43c8-acc3-12cb842e4968
Verdict: Malicious activity
Analysis date: May 28, 2024, 15:50:45
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386, for MS Windows
MD5:

0C97E7B5DE1B46FB723BED38F0DE28A2

SHA1:

3AB353ADB602908EDDB884C8B2B587FCC0691BFA

SHA256:

835DD64B199190D20DC37C0CADEB064B7EAAAEF271703781B2B259B7085437A4

SSDEEP:

49152:e0YNuL7q5Mj5dWZdLUVK5IECejW+N5X6kQ9rY/vuvs0SS/y:e0YEL758dLU0vC1+skQxY/vgsE/y

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Drops the executable file immediately after the start

      • CDM212364_Setup.exe (PID: 4088)
      • dpinst-x86.exe (PID: 864)
      • drvinst.exe (PID: 124)
      • drvinst.exe (PID: 2024)

    • Creates a writable file in the system directory

      • drvinst.exe (PID: 124)
      • drvinst.exe (PID: 2024)

  • SUSPICIOUS

    • Drops a system driver (possible attempt to evade defenses)

      • CDM212364_Setup.exe (PID: 4088)
      • dpinst-x86.exe (PID: 864)
      • drvinst.exe (PID: 124)
      • drvinst.exe (PID: 2024)

    • Executable content was dropped or overwritten

      • CDM212364_Setup.exe (PID: 4088)
      • dpinst-x86.exe (PID: 864)
      • drvinst.exe (PID: 124)
      • drvinst.exe (PID: 2024)

    • Process drops legitimate windows executable

      • CDM212364_Setup.exe (PID: 4088)

    • Starts a Microsoft application from unusual location

      • dpinst-x86.exe (PID: 864)

    • Creates files in the driver directory

      • drvinst.exe (PID: 124)
      • drvinst.exe (PID: 2024)

    • Checks Windows Trust Settings

      • drvinst.exe (PID: 124)
      • drvinst.exe (PID: 2024)

  • INFO

    • Checks supported languages

      • CDM212364_Setup.exe (PID: 4088)
      • dp-chooser.exe (PID: 2108)
      • dpinst-x86.exe (PID: 864)
      • drvinst.exe (PID: 124)
      • drvinst.exe (PID: 2024)

    • Create files in a temporary directory

      • CDM212364_Setup.exe (PID: 4088)
      • dpinst-x86.exe (PID: 864)

    • Reads the computer name

      • dpinst-x86.exe (PID: 864)
      • drvinst.exe (PID: 124)
      • drvinst.exe (PID: 2024)

    • Reads the machine GUID from the registry

      • dpinst-x86.exe (PID: 864)
      • drvinst.exe (PID: 124)
      • drvinst.exe (PID: 2024)

    • Reads the software policy settings

      • drvinst.exe (PID: 124)
      • drvinst.exe (PID: 2024)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win32 Executable MS Visual C++ (generic) (42.2)
.exe | Win64 Executable (generic) (37.3)
.dll | Win32 Dynamic Link Library (generic) (8.8)
.exe | Win32 Executable (generic) (6)
.exe | Generic Win/DOS Executable (2.7)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2021:03:17 12:31:33+00:00
ImageFileCharacteristics: Executable, 32-bit
PEType: PE32
LinkerVersion: 12
CodeSize: 24064
InitializedDataSize: 66560
UninitializedDataSize: -
EntryPoint: 0x6700
OSVersion: 5.1
ImageVersion: -
SubsystemVersion: 5.1
Subsystem: Windows GUI
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
40
Monitored processes
6
Malicious processes
5
Suspicious processes
0

Behavior graph

Click at the process to see the details
start cdm212364_setup.exe dp-chooser.exe no specs dpinst-x86.exe drvinst.exe drvinst.exe cdm212364_setup.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
124DrvInst.exe "4" "0" "C:\Users\admin\AppData\Local\Temp\{348a5591-5616-1a7f-0f0e-e01de2d9ef10}\ftdibus.inf" "0" "657f6b0d3" "000002BC" "WinSta0\Default" "00000330" "208" "c:\users\admin\appdata\local\temp\ftdi-driver"C:\Windows\System32\drvinst.exe
svchost.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Driver Installation Module
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\drvinst.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\setupapi.dll
c:\windows\system32\cfgmgr32.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
864C:\Users\admin\AppData\Local\Temp\FTDI-Driver\dpinst-x86.exe /saC:\Users\admin\AppData\Local\Temp\FTDI-Driver\dpinst-x86.exe
dp-chooser.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Driver Package Installer
Exit code:
512
Version:
2.1
Modules
Images
c:\users\admin\appdata\local\temp\ftdi-driver\dpinst-x86.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
2024DrvInst.exe "4" "0" "C:\Users\admin\AppData\Local\Temp\{19959795-ff48-36b5-eec8-cb3c40dca47c}\ftdiport.inf" "0" "6960183e3" "00000330" "WinSta0\Default" "00000064" "208" "c:\users\admin\appdata\local\temp\ftdi-driver"C:\Windows\System32\drvinst.exe
svchost.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Driver Installation Module
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\drvinst.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\setupapi.dll
c:\windows\system32\cfgmgr32.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
2108C:\Users\admin\AppData\Local\Temp\FTDI-Driver\dp-chooser.exeC:\Users\admin\AppData\Local\Temp\FTDI-Driver\dp-chooser.exe—CDM212364_Setup.exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\ftdi-driver\dp-chooser.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\shell32.dll
3976"C:\Users\admin\AppData\Local\Temp\CDM212364_Setup.exe" C:\Users\admin\AppData\Local\Temp\CDM212364_Setup.exe—explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
3221226540
Modules
Images
c:\users\admin\appdata\local\temp\cdm212364_setup.exe
c:\windows\system32\ntdll.dll
4088"C:\Users\admin\AppData\Local\Temp\CDM212364_Setup.exe" C:\Users\admin\AppData\Local\Temp\CDM212364_Setup.exe
explorer.exe
User:
admin
Integrity Level:
HIGH
Exit code:
1
Modules
Images
c:\users\admin\appdata\local\temp\cdm212364_setup.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\shell32.dll
Total events
6 501
Read events
6 452
Write events
46
Delete events
3

Modification events

(PID) Process:(864) dpinst-x86.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\182\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(864) dpinst-x86.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\Setup\SetupapiLogStatus
Operation:writeName:setupapi.dev.log
Value:
4096
(PID) Process:(124) drvinst.exeKey:HKEY_USERS\.DEFAULT\Software\Classes\Local Settings\MuiCache\182\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(124) drvinst.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\EnterpriseCertificates\Root\Certificates
Operation:delete valueName:9F6134C5FA75E4FDDE631B232BE961D6D4B97DB6
Value:
(PID) Process:(124) drvinst.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\EnterpriseCertificates\Root\Certificates\9F6134C5FA75E4FDDE631B232BE961D6D4B97DB6
Operation:writeName:Blob
Value:
0F00000001000000200000009065F32AFC2CFEA7F452D2D6BE94D20C877EFC1C05433D9935696193FDCC05D80300000001000000140000009F6134C5FA75E4FDDE631B232BE961D6D4B97DB6200000000100000047030000308203433082022BA00302010202147327B7C17D5AE708EF73F1F45A79D78B4E99A29F300D06092A864886F70D01010B05003031310B3009060355040613025553310F300D06035504080C06426F73746F6E3111300F060355040A0C084469676943657274301E170D3233303932393130353030335A170D3339303530383130353030335A3031310B3009060355040613025553310F300D06035504080C06426F73746F6E3111300F060355040A0C08446967694365727430820122300D06092A864886F70D01010105000382010F003082010A0282010100D91B7A55548F44F3E97C493153B75B055695736B184640D7335A2E6218083B5A1BEE2695209350E57A3EB76FBC604CB3B250DF3D9D0C560D1FBDFE30108D233A3C555100BE1A3F8E543C0B253E06E91B6D5F9CB3A093009BC8B4D3A0EB19DB59E56DA7E3D637847970D6C2AEB4A1FCF3896A7C080FE68759BAA62E6AAA8B7C7CBDA176DDC72F8D259A16D3469E31F19D2959904611D730D7D26FCFED789A0C49698FDFABF3F6727D08C61A073BB11E85C96486D49B0E0D38364C008A5EB964F8813C5DF004F9E76D2F8DB90702D800032674959BF0DF823785419101CEA928A10ACBAE7E48FE19202F3CB7BCF416476D17CB64C5570FCED443BD75D9F2C632FF0203010001A3533051301D0603551D0E041604145D6CA352CEFC713CBBC5E21F663C3639FD19D4D7301F0603551D230418301680145D6CA352CEFC713CBBC5E21F663C3639FD19D4D7300F0603551D130101FF040530030101FF300D06092A864886F70D01010B05000382010100AF2218E4CA18144728FCC76EA14958061522FD4A018BED1A4BFCC5CCE70BC6AE9DF7D3795C9A010D53628E2B6E7C10D6B07E53546235A5EE480E5A434E312154BF1E39AAC27D2C18D4F41CBBECFE4538CEF93EF62C17D187A7F720F4A9478410D09620C9F8B293B5786A5440BC0743B7B7753CF66FBA498B7E083BC267597238DC031B9BB131F997D9B8164AAED0D6E328420E53E1969DA6CD035078179677A7177BB2BF9C87CF592910CD380E8501B92040A39469C782BA383BEAE498C060FCC7C429BC10B7B6B7A0659C9BE03DC13DB46C638CF5E3B22A303726906DC8DD91C64501EBFC282A3A497EC430CACC066EE4BF9C5C8F2F2A05D0C1921A9E3E85E3
(PID) Process:(124) drvinst.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\EnterpriseCertificates\Root\Certificates\9F6134C5FA75E4FDDE631B232BE961D6D4B97DB6
Operation:writeName:Blob
Value:
1400000001000000140000005D6CA352CEFC713CBBC5E21F663C3639FD19D4D70300000001000000140000009F6134C5FA75E4FDDE631B232BE961D6D4B97DB60F00000001000000200000009065F32AFC2CFEA7F452D2D6BE94D20C877EFC1C05433D9935696193FDCC05D8200000000100000047030000308203433082022BA00302010202147327B7C17D5AE708EF73F1F45A79D78B4E99A29F300D06092A864886F70D01010B05003031310B3009060355040613025553310F300D06035504080C06426F73746F6E3111300F060355040A0C084469676943657274301E170D3233303932393130353030335A170D3339303530383130353030335A3031310B3009060355040613025553310F300D06035504080C06426F73746F6E3111300F060355040A0C08446967694365727430820122300D06092A864886F70D01010105000382010F003082010A0282010100D91B7A55548F44F3E97C493153B75B055695736B184640D7335A2E6218083B5A1BEE2695209350E57A3EB76FBC604CB3B250DF3D9D0C560D1FBDFE30108D233A3C555100BE1A3F8E543C0B253E06E91B6D5F9CB3A093009BC8B4D3A0EB19DB59E56DA7E3D637847970D6C2AEB4A1FCF3896A7C080FE68759BAA62E6AAA8B7C7CBDA176DDC72F8D259A16D3469E31F19D2959904611D730D7D26FCFED789A0C49698FDFABF3F6727D08C61A073BB11E85C96486D49B0E0D38364C008A5EB964F8813C5DF004F9E76D2F8DB90702D800032674959BF0DF823785419101CEA928A10ACBAE7E48FE19202F3CB7BCF416476D17CB64C5570FCED443BD75D9F2C632FF0203010001A3533051301D0603551D0E041604145D6CA352CEFC713CBBC5E21F663C3639FD19D4D7301F0603551D230418301680145D6CA352CEFC713CBBC5E21F663C3639FD19D4D7300F0603551D130101FF040530030101FF300D06092A864886F70D01010B05000382010100AF2218E4CA18144728FCC76EA14958061522FD4A018BED1A4BFCC5CCE70BC6AE9DF7D3795C9A010D53628E2B6E7C10D6B07E53546235A5EE480E5A434E312154BF1E39AAC27D2C18D4F41CBBECFE4538CEF93EF62C17D187A7F720F4A9478410D09620C9F8B293B5786A5440BC0743B7B7753CF66FBA498B7E083BC267597238DC031B9BB131F997D9B8164AAED0D6E328420E53E1969DA6CD035078179677A7177BB2BF9C87CF592910CD380E8501B92040A39469C782BA383BEAE498C060FCC7C429BC10B7B6B7A0659C9BE03DC13DB46C638CF5E3B22A303726906DC8DD91C64501EBFC282A3A497EC430CACC066EE4BF9C5C8F2F2A05D0C1921A9E3E85E3
(PID) Process:(124) drvinst.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\EnterpriseCertificates\Root\Certificates\9F6134C5FA75E4FDDE631B232BE961D6D4B97DB6
Operation:writeName:Blob
Value:
190000000100000010000000BCC80DAA2F98A4692805BFF4CBB372EB0F00000001000000200000009065F32AFC2CFEA7F452D2D6BE94D20C877EFC1C05433D9935696193FDCC05D80300000001000000140000009F6134C5FA75E4FDDE631B232BE961D6D4B97DB61400000001000000140000005D6CA352CEFC713CBBC5E21F663C3639FD19D4D7200000000100000047030000308203433082022BA00302010202147327B7C17D5AE708EF73F1F45A79D78B4E99A29F300D06092A864886F70D01010B05003031310B3009060355040613025553310F300D06035504080C06426F73746F6E3111300F060355040A0C084469676943657274301E170D3233303932393130353030335A170D3339303530383130353030335A3031310B3009060355040613025553310F300D06035504080C06426F73746F6E3111300F060355040A0C08446967694365727430820122300D06092A864886F70D01010105000382010F003082010A0282010100D91B7A55548F44F3E97C493153B75B055695736B184640D7335A2E6218083B5A1BEE2695209350E57A3EB76FBC604CB3B250DF3D9D0C560D1FBDFE30108D233A3C555100BE1A3F8E543C0B253E06E91B6D5F9CB3A093009BC8B4D3A0EB19DB59E56DA7E3D637847970D6C2AEB4A1FCF3896A7C080FE68759BAA62E6AAA8B7C7CBDA176DDC72F8D259A16D3469E31F19D2959904611D730D7D26FCFED789A0C49698FDFABF3F6727D08C61A073BB11E85C96486D49B0E0D38364C008A5EB964F8813C5DF004F9E76D2F8DB90702D800032674959BF0DF823785419101CEA928A10ACBAE7E48FE19202F3CB7BCF416476D17CB64C5570FCED443BD75D9F2C632FF0203010001A3533051301D0603551D0E041604145D6CA352CEFC713CBBC5E21F663C3639FD19D4D7301F0603551D230418301680145D6CA352CEFC713CBBC5E21F663C3639FD19D4D7300F0603551D130101FF040530030101FF300D06092A864886F70D01010B05000382010100AF2218E4CA18144728FCC76EA14958061522FD4A018BED1A4BFCC5CCE70BC6AE9DF7D3795C9A010D53628E2B6E7C10D6B07E53546235A5EE480E5A434E312154BF1E39AAC27D2C18D4F41CBBECFE4538CEF93EF62C17D187A7F720F4A9478410D09620C9F8B293B5786A5440BC0743B7B7753CF66FBA498B7E083BC267597238DC031B9BB131F997D9B8164AAED0D6E328420E53E1969DA6CD035078179677A7177BB2BF9C87CF592910CD380E8501B92040A39469C782BA383BEAE498C060FCC7C429BC10B7B6B7A0659C9BE03DC13DB46C638CF5E3B22A303726906DC8DD91C64501EBFC282A3A497EC430CACC066EE4BF9C5C8F2F2A05D0C1921A9E3E85E3
(PID) Process:(2024) drvinst.exeKey:HKEY_USERS\.DEFAULT\Software\Classes\Local Settings\MuiCache\182\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
Executable files
46
Suspicious files
27
Text files
18
Unknown types
0

Dropped files

PID
Process
Filename
Type
4088CDM212364_Setup.exeC:\Users\admin\AppData\Local\Temp\FE3A2C.tmptext
MD5:50F2BBF24A14BE4E408F94BC3849C38D
SHA256:D99B9414E6B4C20127BD62BB105010BF980A5F1C2922B1D900629F498473095A
4088CDM212364_Setup.exeC:\Users\admin\AppData\Local\Temp\FTDI-Driver\amd64\ftcserco.dllexecutable
MD5:AA69BF96E10F463082A0664B7A2E9FAE
SHA256:C0224B9EF14365F6DDA96134CC77D978E69FBD61EFDADE6FD1EB676418C41023
4088CDM212364_Setup.exeC:\Users\admin\AppData\Local\Temp\FTDI-Driver\amd64\ftbusui.dllexecutable
MD5:D79A5E34F684B547FA2F963DFCC15A21
SHA256:4BBC0B301A7C5A6B1B73878CE3AEEB191F5FCEAC05835372142206D79AC81559
4088CDM212364_Setup.exeC:\Users\admin\AppData\Local\Temp\FTDI-Driver\amd64\ftser2k.sysexecutable
MD5:B66678FF4E347E22146609B3D5B7B2C4
SHA256:7A303AA880CC746D13F71E565874FB7C174747372CCF358B928A72219D2A50DD
4088CDM212364_Setup.exeC:\Users\admin\AppData\Local\Temp\FTDI-Driver\amd64\ftlang.dllexecutable
MD5:662679682F491FBAF3D15953D13EC72E
SHA256:C2729911C4B82D8F9E22E057A1570D0265D7A9ECA44D6FE8DC0658F47263CE12
4088CDM212364_Setup.exeC:\Users\admin\AppData\Local\Temp\FTDI-Driver\amd64\ftserui2.dllexecutable
MD5:3E5BCD980AF8B20313005D9A492CEC8A
SHA256:55A23A2AC263E10B77D7E95601439F771062F2C248A8D93039A968D66100C39C
4088CDM212364_Setup.exeC:\Users\admin\AppData\Local\Temp\FTDI-Driver\dpinst.xmlxml
MD5:BBB46E3360F3FCABC5D03CA33DC10458
SHA256:65E9BC1F59DE53462ED2E6B002C0BE26CD3F37B1E360938A0A32AA452ED58030
4088CDM212364_Setup.exeC:\Users\admin\AppData\Local\Temp\FTDI-Driver\ftdibus.catcat
MD5:B392C785B9C2AA31187D1BD0A4F5EBA5
SHA256:B286055896DEA79D4521368293DEEE801930F3FB503CC3076AC97716B338B0F7
4088CDM212364_Setup.exeC:\Users\admin\AppData\Local\Temp\FTDI-Driver\dpinst-amd64.exeexecutable
MD5:0E7E8820A977D3B4B81C5188FA841C52
SHA256:65054D27C91C21AF7C7F1838427A0AC64089DC51DD27EB220B589C26B94903A1
4088CDM212364_Setup.exeC:\Users\admin\AppData\Local\Temp\FTDI-Driver\ftdibus.inftext
MD5:B404B591DCAE1E28603479A7963CB6F6
SHA256:FF361CDD7C814DB0BEA98578A731EF5C03BF457E06BCA9950FDBAB57A4D3C7F6
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
4
DNS requests
0
Threats
0

HTTP requests

No HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
—
—
224.0.0.252:5355
—
—
—
unknown
4
System
192.168.100.255:138
—
—
—
whitelisted
1088
svchost.exe
224.0.0.252:5355
—
—
—
unknown

DNS requests

No data

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
CDM212364_Setup.exe