| File name: | driver-hub-install__28.exe |
| Full analysis: | https://app.any.run/tasks/e128cccf-abd7-47e9-9878-1ab56839bdd9 |
| Verdict: | Malicious activity |
| Analysis date: | March 27, 2024, 16:21:09 |
| OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
| Indicators: | |
| MIME: | application/x-dosexec |
| File info: | PE32 executable (GUI) Intel 80386, for MS Windows |
| MD5: | 49F38034852A31F5BC6959F8E1EE7C82 |
| SHA1: | 4DBA9E745D0AE24F1B5DB6D08B329003686F6AFA |
| SHA256: | B247BE78BBD13776AE8C05106CCF2136911186ECF8BAD1A4BE2DE93E365429F2 |
| SSDEEP: | 98304:K4ttWaRF/xPRem/weyUxWuABC6lisdlxVanqhk8vO39bwWcyDDH/yMccKocWv8lF:DhWKU |
| .exe | | | Win32 Executable (generic) (3.6) |
|---|---|---|
| .exe | | | Generic Win/DOS Executable (1.6) |
| .exe | | | DOS Executable Generic (1.5) |
| MachineType: | Intel 386 or later, and compatibles |
|---|---|
| TimeStamp: | 2024:02:06 15:44:56+00:00 |
| ImageFileCharacteristics: | Executable, 32-bit |
| PEType: | PE32 |
| LinkerVersion: | 14.29 |
| CodeSize: | 4751872 |
| InitializedDataSize: | 7326208 |
| UninitializedDataSize: | - |
| EntryPoint: | 0x4008b2 |
| OSVersion: | 6 |
| ImageVersion: | - |
| SubsystemVersion: | 6 |
| Subsystem: | Windows GUI |
| FileVersionNumber: | 3.4.2.0 |
| ProductVersionNumber: | 3.4.2.0 |
| FileFlagsMask: | 0x003f |
| FileFlags: | (none) |
| FileOS: | Windows NT 32-bit |
| ObjectFileType: | Executable application |
| FileSubtype: | - |
| LanguageCode: | English (U.S.) |
| CharacterSet: | Unicode |
| CompanyName: | ROSTPAY LTD. |
| FileDescription: | Install DriverHub |
| InternalName: | DriverHubInstaller |
| LegalCopyright: | © ROSTPAY LTD. All rights reserved. |
| OriginalFileName: | DriverHubInstaller.exe |
| ProductName: | DriverHub |
| FileVersion: | 3.4.2 |
| ProductVersion: | 3.4.2 |
PID | CMD | Path | Indicators | Parent process |
|---|---|---|---|---|
| 392 | C:\ProgramData\BrightData\0958021a4a573e283a9a7d03525578a2225ac6fd\idle_report.exe --id 25113 --screen | C:\ProgramData\BrightData\0958021a4a573e283a9a7d03525578a2225ac6fd\idle_report.exe | — | net_updater32.exe |
User: admin Company: BrightData Ltd. Integrity Level: MEDIUM Description: idle_report Exit code: 0 Version: 1.429.308 | ||||
| 604 | DrvInst.exe "4" "0" "C:\Users\admin\AppData\Local\Temp\{352479fc-8ad0-12de-85f4-af6c1934d646}\e1g6032.inf" "0" "6efe00be3" "000005C0" "WinSta0\Default" "00000558" "208" "c:\users\admin\appdata\roaming\driverhub\unpack-temp" | C:\Windows\System32\drvinst.exe | — | svchost.exe |
User: SYSTEM Company: Microsoft Corporation Integrity Level: SYSTEM Description: Driver Installation Module Exit code: 0 Version: 6.1.7600.16385 (win7_rtm.090713-1255) | ||||
| 748 | "C:\Program Files\Windows Media Player\wmpnscfg.exe" | C:\Program Files\Windows Media Player\wmpnscfg.exe | — | explorer.exe |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows Media Player Network Sharing Service Configuration Application Exit code: 0 Version: 12.0.7600.16385 (win7_rtm.090713-1255) | ||||
| 1044 | C:\ProgramData\BrightData\0958021a4a573e283a9a7d03525578a2225ac6fd\idle_report.exe --id 97801 | C:\ProgramData\BrightData\0958021a4a573e283a9a7d03525578a2225ac6fd\idle_report.exe | — | net_updater32.exe |
User: admin Company: BrightData Ltd. Integrity Level: MEDIUM Description: idle_report Exit code: 0 Version: 1.429.308 | ||||
| 1232 | "C:\Users\admin\AppData\Local\Temp\DriverHub\OperaGXDownloader.exe" --silent --allusers=0 | C:\Users\admin\AppData\Local\Temp\DriverHub\OperaGXDownloader.exe | — | driver-hub-install__28.exe |
User: admin Company: Opera Software Integrity Level: HIGH Description: Opera GX Installer Exit code: 2 Version: 107.0.5045.79 | ||||
| 1652 | "C:\Program Files\DriverHub\net_updater32.exe" --install win_drvhub.net --no-cleanup | C:\Program Files\DriverHub\net_updater32.exe | DriverHub.exe | |
User: admin Company: BrightData Ltd. (certified) Integrity Level: HIGH Description: BrightData service allows free use of certain features in an app you installed Exit code: 0 Version: 1.429.308 | ||||
| 1732 | C:\ProgramData\BrightData\0958021a4a573e283a9a7d03525578a2225ac6fd\test_wpf.exe | C:\ProgramData\BrightData\0958021a4a573e283a9a7d03525578a2225ac6fd\test_wpf.exe | — | net_updater32.exe |
User: SYSTEM Company: BrightData Ltd. (certified) Integrity Level: SYSTEM Description: test_wpf Exit code: 0 Version: 1.429.308 | ||||
| 1740 | "C:/Program Files/DriverHub/Win32/Installer.exe" | C:\Program Files\DriverHub\Win32\Installer.exe | — | DriverHub.exe |
User: admin Company: ROSTPAY LTD Integrity Level: HIGH Description: Driver install Exit code: 0 Version: 1.0.0.0 | ||||
| 1808 | DrvInst.exe "4" "0" "C:\Users\admin\AppData\Local\Temp\{5fc61b4b-1f06-499a-edfc-c66a42eaec40}\zumbus.inf" "0" "618607533" "000003F8" "WinSta0\Default" "000005F0" "208" "c:\users\admin\appdata\roaming\driverhub\unpack-temp" | C:\Windows\System32\drvinst.exe | — | svchost.exe |
User: SYSTEM Company: Microsoft Corporation Integrity Level: SYSTEM Description: Driver Installation Module Exit code: 0 Version: 6.1.7600.16385 (win7_rtm.090713-1255) | ||||
| 1844 | DrvInst.exe "2" "211" "ROOT\UMBUS\0000" "C:\Windows\INF\oem4.inf" "zumbus.inf:Microsoft.NTx86:UmBusRoot_Device:4.8.2148.0:root\umbus" "618607533" "000003F8" "000005E8" "000005E0" | C:\Windows\System32\drvinst.exe | svchost.exe | |
User: SYSTEM Company: Microsoft Corporation Integrity Level: SYSTEM Description: Driver Installation Module Exit code: 0 Version: 6.1.7600.16385 (win7_rtm.090713-1255) | ||||
PID | Process | Filename | Type | |
|---|---|---|---|---|
| 2960 | driver-hub-install__28.exe | C:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506 | compressed | |
MD5:— | SHA256:— | |||
| 2960 | driver-hub-install__28.exe | C:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506 | binary | |
MD5:— | SHA256:— | |||
| 2960 | driver-hub-install__28.exe | C:\Users\admin\AppData\Local\Temp\Cab52BE.tmp | compressed | |
MD5:— | SHA256:— | |||
| 2960 | driver-hub-install__28.exe | C:\Users\admin\AppData\Local\Temp\Tar52BF.tmp | binary | |
MD5:— | SHA256:— | |||
| 2960 | driver-hub-install__28.exe | C:\Program Files\DriverHub\Credits.txt | text | |
MD5:— | SHA256:— | |||
| 2960 | driver-hub-install__28.exe | C:\Program Files\DriverHub\d3dcompiler_47.dll | executable | |
MD5:— | SHA256:— | |||
| 2960 | driver-hub-install__28.exe | C:\Program Files\DriverHub\DriverHub.exe | binary | |
MD5:— | SHA256:— | |||
| 2960 | driver-hub-install__28.exe | C:\Program Files\DriverHub\DriverHubUninstaller.exe | executable | |
MD5:— | SHA256:— | |||
| 2960 | driver-hub-install__28.exe | C:\Program Files\DriverHub\imageformats\qgif.dll | executable | |
MD5:— | SHA256:— | |||
| 2960 | driver-hub-install__28.exe | C:\Program Files\DriverHub\imageformats\qjpeg.dll | executable | |
MD5:— | SHA256:— | |||
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
|---|---|---|---|---|---|---|---|---|---|
2968 | DriverHub.exe | POST | 200 | 142.250.184.238:80 | http://www.google-analytics.com/collect | unknown | — | — | unknown |
2960 | driver-hub-install__28.exe | GET | 200 | 173.222.108.226:80 | http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab?3c50fbe1bd586eb7 | unknown | — | — | unknown |
2960 | driver-hub-install__28.exe | GET | 304 | 173.222.108.226:80 | http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?59ec885f674d5a7e | unknown | — | — | unknown |
2960 | driver-hub-install__28.exe | GET | 200 | 2.19.105.18:80 | http://x1.c.lencr.org/ | unknown | — | — | unknown |
— | — | GET | 200 | 2.16.241.15:80 | http://r3.o.lencr.org/MFMwUTBPME0wSzAJBgUrDgMCGgUABBRI2smg%2ByvTLU%2Fw3mjS9We3NfmzxAQUFC6zF7dYVsuuUAlA5h%2BvnYsUwsYCEgSBMIUl3dUhDJLPdisKEY1cpA%3D%3D | unknown | — | — | unknown |
488 | lsass.exe | GET | 200 | 2.16.202.115:80 | http://r3.o.lencr.org/MFMwUTBPME0wSzAJBgUrDgMCGgUABBRI2smg%2ByvTLU%2Fw3mjS9We3NfmzxAQUFC6zF7dYVsuuUAlA5h%2BvnYsUwsYCEgR%2FvyiDg0G65bijhTOMwZPa6Q%3D%3D | unknown | — | — | unknown |
2968 | DriverHub.exe | POST | 200 | 142.250.186.142:80 | http://www.google-analytics.com/collect | unknown | — | — | unknown |
2968 | DriverHub.exe | POST | 200 | 142.250.186.142:80 | http://www.google-analytics.com/collect | unknown | — | — | unknown |
2968 | DriverHub.exe | POST | 200 | 142.250.186.142:80 | http://www.google-analytics.com/collect | unknown | — | — | unknown |
2968 | DriverHub.exe | POST | 200 | 142.250.186.142:80 | http://www.google-analytics.com/collect | unknown | — | — | unknown |
PID | Process | IP | Domain | ASN | CN | Reputation |
|---|---|---|---|---|---|---|
4 | System | 192.168.100.255:137 | — | — | — | whitelisted |
4 | System | 192.168.100.255:138 | — | — | — | whitelisted |
— | — | 224.0.0.252:5355 | — | — | — | unknown |
1080 | svchost.exe | 224.0.0.252:5355 | — | — | — | unknown |
2960 | driver-hub-install__28.exe | 188.130.153.32:443 | api.az-partners.net | Rostpay Ltd | RU | unknown |
2960 | driver-hub-install__28.exe | 173.222.108.226:80 | ctldl.windowsupdate.com | Akamai International B.V. | CH | unknown |
2960 | driver-hub-install__28.exe | 188.130.153.33:443 | api.az-partners.net | Rostpay Ltd | RU | unknown |
2960 | driver-hub-install__28.exe | 2.19.105.18:80 | x1.c.lencr.org | AKAMAI-AS | DE | unknown |
2960 | driver-hub-install__28.exe | 2.16.241.15:80 | r3.o.lencr.org | Akamai International B.V. | DE | unknown |
2960 | driver-hub-install__28.exe | 104.21.12.132:443 | www.biphic.com | CLOUDFLARENET | — | unknown |
Domain | IP | Reputation |
|---|---|---|
api.az-partners.net |
| unknown |
ctldl.windowsupdate.com |
| whitelisted |
www.drvhub.net |
| unknown |
www.az-partners.net |
| malicious |
x1.c.lencr.org |
| whitelisted |
r3.o.lencr.org |
| shared |
www.biphic.com |
| unknown |
net.geo.opera.com |
| whitelisted |
perr.lum-sdk.io |
| unknown |
api.drvhub.net |
| unknown |
PID | Process | Class | Message |
|---|---|---|---|
1080 | svchost.exe | Potentially Bad Traffic | ET INFO Observed DNS Query to .biz TLD |
3108 | net_updater32.exe | Potential Corporate Privacy Violation | ET POLICY Dropbox.com Offsite File Backup in Use |
1080 | svchost.exe | Potentially Bad Traffic | ET INFO Observed DNS Query to .biz TLD |
Process | Message |
|---|---|
DriverHub.exe | qrc:/main.qml:655:13: QML Connections: Implicitly defined onFoo properties in Connections are deprecated. Use this syntax instead: function onFoo(<arguments>) { ... }
|
DriverHub.exe | qrc:/UpdateProgressDialog.qml:11:5: QML Connections: Implicitly defined onFoo properties in Connections are deprecated. Use this syntax instead: function onFoo(<arguments>) { ... }
|
DriverHub.exe | qrc:/main.qml:453:31: QML ItemDelegate: Binding loop detected for property "height"
|
DriverHub.exe | file:///C:/Program Files/DriverHub/QtQuick/Dialogs/DefaultFileDialog.qml:102:33: QML Settings: The following application identifiers have not been set: QVector("organizationName", "organizationDomain")
|
DriverHub.exe | file:///C:/Program Files/DriverHub/QtQuick/Dialogs/DefaultFileDialog.qml:102:33: QML Settings: Failed to initialize QSettings instance. Status code is: 1
|
DriverHub.exe | qrc:/SettingsPage.qml:29:9: QML MyCheckBox: Binding loop detected for property "width"
|
DriverHub.exe | qrc:/SettingsPage.qml:47:9: QML MyCheckBox: Binding loop detected for property "width"
|
DriverHub.exe | qrc:/SettingsPage.qml:47:9: QML MyCheckBox: Binding loop detected for property "width"
|
DriverHub.exe | qrc:/SettingsPage.qml:29:9: QML MyCheckBox: Binding loop detected for property "width"
|
DriverHub.exe | qrc:/SettingsPage.qml:29:9: QML MyCheckBox: Binding loop detected for property "width"
|