download:

beetle-cab.cab

Full analysis: https://app.any.run/tasks/ac786a24-e69d-4eb5-8d75-50b0ea8c2512
Verdict: Malicious activity
Threats:

A loader is malicious software that infiltrates devices to deliver malicious payloads. This malware is capable of infecting victims’ computers, analyzing their system information, and installing other types of threats, such as trojans or stealers. Criminals usually deliver loaders through phishing emails and links by relying on social engineering to trick users into downloading and running their executables. Loaders employ advanced evasion and persistence tactics to avoid detection.

Malware Trends Tracker     >>>
Analysis date: June 21, 2023, 17:26:39
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
loader
Indicators:
MIME: application/vnd.ms-cab-compressed
File info: Microsoft Cabinet archive data, many, 13140694 bytes, 5 files, at 0x2c +A "beetle-cab\7za.dll" +A "beetle-cab\7za.exe", number 1, 419 datablocks, 0x1 compression
MD5:

6179E6DCDD9D0C1223A7DC76FC350E37

SHA1:

856799DB415BA9EF398D489E29E093F132FDC0DF

SHA256:

B5A91D9C0614412D975E2E2CE82D5AAA3453ED467BF011FDD1C8AE765D6C8C1C

SSDEEP:

196608:dBR6ZkXHrtQbiY7YO0jJsmraB6vexQnwJSvu+lOdLpFlh6ENP5gxIlO:3R6iXH2ipjJsmr/eSWKyjlJNPiilO

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Application was dropped or rewritten from another process

      • 7za.exe (PID: 1808)
      • 7za.exe (PID: 2740)
      • driverpack-wget.exe (PID: 3948)
      • driverpack-wget.exe (PID: 2052)
      • driverpack-wget.exe (PID: 3820)
      • driverpack-wget.exe (PID: 1808)
      • driverpack-wget.exe (PID: 3144)
      • driverpack-wget.exe (PID: 2360)
      • driverpack-wget.exe (PID: 548)
      • driverpack-wget.exe (PID: 2840)
      • driverpack-wget.exe (PID: 3096)
      • driverpack-wget.exe (PID: 976)
      • driverpack-wget.exe (PID: 1172)
      • driverpack-wget.exe (PID: 3616)
      • driverpack-wget.exe (PID: 3636)
      • driverpack-wget.exe (PID: 1252)
      • driverpack-wget.exe (PID: 1808)
      • driverpack-wget.exe (PID: 2592)
      • driverpack-wget.exe (PID: 3452)
      • driverpack-wget.exe (PID: 3412)
      • driverpack-wget.exe (PID: 3780)
      • driverpack-7za.exe (PID: 1640)
      • driverpack-wget.exe (PID: 3484)
      • driverpack-wget.exe (PID: 1832)
      • driverpack-wget.exe (PID: 2036)
      • driverpack-wget.exe (PID: 4000)
      • driverpack-wget.exe (PID: 2224)
      • driverpack-wget.exe (PID: 1024)
      • driverpack-wget.exe (PID: 4076)
      • driverpack-wget.exe (PID: 3992)
      • driverpack-wget.exe (PID: 2712)
      • driverpack-wget.exe (PID: 3764)
      • driverpack-wget.exe (PID: 932)
      • driverpack-wget.exe (PID: 3924)
      • driverpack-wget.exe (PID: 2980)
      • driverpack-wget.exe (PID: 3464)
      • driverpack-wget.exe (PID: 3272)
      • driverpack-wget.exe (PID: 2844)
      • driverpack-wget.exe (PID: 4088)
      • driverpack-wget.exe (PID: 4072)
      • driverpack-wget.exe (PID: 908)
      • driverpack-wget.exe (PID: 3176)
      • driverpack-wget.exe (PID: 3840)
      • driverpack-wget.exe (PID: 1836)
      • driverpack-wget.exe (PID: 3444)
      • driverpack-wget.exe (PID: 3832)
      • aria2c.exe (PID: 3756)
      • aria2c.exe (PID: 2096)
      • driverpack-wget.exe (PID: 4088)
      • driverpack-wget.exe (PID: 796)
      • aria2c.exe (PID: 1060)
      • aria2c.exe (PID: 2864)
      • aria2c.exe (PID: 3412)
      • driverpack-wget.exe (PID: 1540)
      • driverpack-wget.exe (PID: 3828)
      • driverpack-wget.exe (PID: 3792)
      • driverpack-wget.exe (PID: 872)
      • driverpack-wget.exe (PID: 1544)
      • driverpack-wget.exe (PID: 2380)
      • driverpack-wget.exe (PID: 3100)
      • driverpack-wget.exe (PID: 1836)
      • driverpack-wget.exe (PID: 3896)
      • driverpack-wget.exe (PID: 780)
      • driverpack-wget.exe (PID: 1024)
      • driverpack-wget.exe (PID: 2580)
      • driverpack-wget.exe (PID: 3040)
      • driverpack-wget.exe (PID: 3772)
      • driverpack-wget.exe (PID: 3944)
      • driverpack-wget.exe (PID: 2640)
      • driverpack-wget.exe (PID: 820)
      • driverpack-wget.exe (PID: 3900)
      • driverpack-wget.exe (PID: 3596)
      • driverpack-wget.exe (PID: 1776)
      • driverpack-wget.exe (PID: 3508)
      • driverpack-wget.exe (PID: 2932)
      • driverpack-wget.exe (PID: 124)
      • driverpack-wget.exe (PID: 3832)
      • aria2c.exe (PID: 3596)
      • driverpack-wget.exe (PID: 2544)
      • driverpack-wget.exe (PID: 1620)
      • driverpack-wget.exe (PID: 3292)
      • driverpack-wget.exe (PID: 452)
      • driverpack-wget.exe (PID: 1328)
      • driverpack-wget.exe (PID: 3048)
      • driverpack-wget.exe (PID: 2716)
      • driverpack-wget.exe (PID: 1232)
      • driverpack-wget.exe (PID: 2980)
      • driverpack-wget.exe (PID: 1060)
      • driverpack-wget.exe (PID: 1476)
      • driverpack-wget.exe (PID: 1924)
      • driverpack-wget.exe (PID: 452)
      • driverpack-wget.exe (PID: 1144)
      • driverpack-wget.exe (PID: 3440)
      • driverpack-wget.exe (PID: 2848)
      • driverpack-wget.exe (PID: 3048)
      • driverpack-wget.exe (PID: 2892)
      • driverpack-wget.exe (PID: 796)
      • driverpack-wget.exe (PID: 3532)
      • driverpack-wget.exe (PID: 1776)
      • driverpack-wget.exe (PID: 3956)
      • driverpack-wget.exe (PID: 4224)
      • driverpack-wget.exe (PID: 4200)
      • driverpack-wget.exe (PID: 3236)
      • driverpack-wget.exe (PID: 5352)
      • driverpack-wget.exe (PID: 5448)
      • driverpack-wget.exe (PID: 5592)
      • driverpack-wget.exe (PID: 4196)
      • driverpack-wget.exe (PID: 4892)
      • driverpack-wget.exe (PID: 3956)
      • driverpack-wget.exe (PID: 4908)
      • driverpack-wget.exe (PID: 4152)
      • driverpack-wget.exe (PID: 4536)
      • driverpack-wget.exe (PID: 4308)
      • driverpack-wget.exe (PID: 4464)
      • driverpack-wget.exe (PID: 4604)
      • driverpack-wget.exe (PID: 4820)
      • driverpack-wget.exe (PID: 5788)
      • driverpack-wget.exe (PID: 4260)
      • driverpack-wget.exe (PID: 5388)
      • driverpack-wget.exe (PID: 4624)
      • driverpack-wget.exe (PID: 372)
      • driverpack-wget.exe (PID: 5980)
      • driverpack-wget.exe (PID: 5724)
      • driverpack-wget.exe (PID: 3960)
      • driverpack-wget.exe (PID: 5036)
      • driverpack-wget.exe (PID: 5308)
      • driverpack-wget.exe (PID: 5336)
      • driverpack-wget.exe (PID: 5452)
      • driverpack-wget.exe (PID: 4384)
      • driverpack-wget.exe (PID: 4364)
      • driverpack-wget.exe (PID: 596)
      • driverpack-wget.exe (PID: 4604)
      • driverpack-wget.exe (PID: 5852)
      • driverpack-wget.exe (PID: 6024)
      • driverpack-wget.exe (PID: 4540)
      • driverpack-wget.exe (PID: 1188)
      • driverpack-wget.exe (PID: 4652)
      • driverpack-wget.exe (PID: 4752)
      • driverpack-wget.exe (PID: 3408)
      • driverpack-wget.exe (PID: 4524)
      • driverpack-wget.exe (PID: 4624)
      • driverpack-wget.exe (PID: 4920)
      • driverpack-wget.exe (PID: 3864)
      • driverpack-wget.exe (PID: 4604)
      • driverpack-wget.exe (PID: 4632)
      • driverpack-wget.exe (PID: 5700)
      • SearcherBar.exe (PID: 4232)
      • SearcherBar.exe (PID: 5592)
      • SearcherBar.exe (PID: 5224)

    • Bypass execution policy to execute commands

      • powershell.exe (PID: 2724)

    • Starts Visual C# compiler

      • powershell.exe (PID: 2724)

    • Actions looks like stealing of personal data

      • mshta.exe (PID: 528)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • 7za.exe (PID: 2740)
      • csc.exe (PID: 3008)
      • mshta.exe (PID: 528)
      • aria2c.exe (PID: 2096)
      • SearcherBar.exe (PID: 5592)

    • Reads the Internet Settings

      • mshta.exe (PID: 528)
      • cmd.exe (PID: 2384)
      • WMIC.exe (PID: 2456)

    • The process hide an interactive prompt from the user

      • cmd.exe (PID: 1896)

    • Executing commands from ".cmd" file

      • mshta.exe (PID: 528)

    • Get information on the list of running processes

      • cmd.exe (PID: 1896)

    • The process hides Powershell's copyright startup banner

      • cmd.exe (PID: 1896)

    • Possibly malicious use of IEX has been detected

      • cmd.exe (PID: 1896)

    • Starts POWERSHELL.EXE for commands execution

      • cmd.exe (PID: 1896)

    • Uses RUNDLL32.EXE to load library

      • mshta.exe (PID: 528)

    • The process bypasses the loading of PowerShell profile settings

      • cmd.exe (PID: 1896)

    • Uses .NET C# to load dll

      • powershell.exe (PID: 2724)

    • Starts CMD.EXE for commands execution

      • mshta.exe (PID: 528)

    • Uses NETSH.EXE to delete a firewall rule or allowed programs

      • cmd.exe (PID: 3376)

    • Uses NETSH.EXE to add a firewall rule or allowed programs

      • cmd.exe (PID: 1796)

    • Changes internet zones settings

      • mshta.exe (PID: 528)

    • Adds/modifies Windows certificates

      • cmd.exe (PID: 2384)

    • Starts application with an unusual extension

      • cmd.exe (PID: 3600)

    • Uses NETSH.EXE to obtain data on the network

      • cmd.exe (PID: 3600)

    • Process requests binary or script from the Internet

      • mshta.exe (PID: 528)
      • aria2c.exe (PID: 3756)
      • aria2c.exe (PID: 2096)
      • aria2c.exe (PID: 2864)
      • aria2c.exe (PID: 3412)
      • aria2c.exe (PID: 3596)

    • Uses WMIC.EXE to obtain system information

      • cmd.exe (PID: 1012)

    • Starts SC.EXE for service management

      • cmd.exe (PID: 3376)

  • INFO

    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 2812)

    • The process checks LSA protection

      • SearchProtocolHost.exe (PID: 3208)
      • csc.exe (PID: 3008)
      • cvtres.exe (PID: 3888)
      • netsh.exe (PID: 3692)
      • netsh.exe (PID: 3540)
      • netsh.exe (PID: 3580)
      • WMIC.exe (PID: 2456)
      • aria2c.exe (PID: 2096)
      • aria2c.exe (PID: 3756)
      • aria2c.exe (PID: 1060)
      • aria2c.exe (PID: 3412)
      • aria2c.exe (PID: 2864)
      • wmpnscfg.exe (PID: 3792)
      • aria2c.exe (PID: 3596)
      • SearcherBar.exe (PID: 5592)

    • Checks supported languages

      • 7za.exe (PID: 1808)
      • 7za.exe (PID: 2740)
      • csc.exe (PID: 3008)
      • cvtres.exe (PID: 3888)
      • driverpack-wget.exe (PID: 3820)
      • driverpack-wget.exe (PID: 2052)
      • driverpack-wget.exe (PID: 3948)
      • driverpack-wget.exe (PID: 1808)
      • driverpack-wget.exe (PID: 2360)
      • driverpack-wget.exe (PID: 3144)
      • driverpack-wget.exe (PID: 548)
      • driverpack-wget.exe (PID: 2840)
      • driverpack-wget.exe (PID: 3096)
      • driverpack-wget.exe (PID: 976)
      • driverpack-wget.exe (PID: 1172)
      • driverpack-wget.exe (PID: 3616)
      • driverpack-wget.exe (PID: 3636)
      • driverpack-wget.exe (PID: 2592)
      • driverpack-wget.exe (PID: 1808)
      • driverpack-wget.exe (PID: 1252)
      • driverpack-wget.exe (PID: 3412)
      • driverpack-wget.exe (PID: 3452)
      • driverpack-7za.exe (PID: 1640)
      • driverpack-wget.exe (PID: 3780)
      • chcp.com (PID: 4016)
      • driverpack-wget.exe (PID: 3484)
      • driverpack-wget.exe (PID: 2036)
      • driverpack-wget.exe (PID: 1832)
      • driverpack-wget.exe (PID: 2224)
      • driverpack-wget.exe (PID: 4000)
      • driverpack-wget.exe (PID: 4076)
      • driverpack-wget.exe (PID: 3992)
      • driverpack-wget.exe (PID: 1024)
      • driverpack-wget.exe (PID: 2712)
      • driverpack-wget.exe (PID: 3764)
      • driverpack-wget.exe (PID: 3924)
      • driverpack-wget.exe (PID: 932)
      • driverpack-wget.exe (PID: 3464)
      • driverpack-wget.exe (PID: 2980)
      • driverpack-wget.exe (PID: 2844)
      • driverpack-wget.exe (PID: 3272)
      • driverpack-wget.exe (PID: 4072)
      • driverpack-wget.exe (PID: 4088)
      • driverpack-wget.exe (PID: 908)
      • driverpack-wget.exe (PID: 3840)
      • driverpack-wget.exe (PID: 3176)
      • driverpack-wget.exe (PID: 1836)
      • driverpack-wget.exe (PID: 3444)
      • driverpack-wget.exe (PID: 3832)
      • aria2c.exe (PID: 3756)
      • aria2c.exe (PID: 2096)
      • driverpack-wget.exe (PID: 4088)
      • aria2c.exe (PID: 1060)
      • driverpack-wget.exe (PID: 796)
      • aria2c.exe (PID: 2864)
      • driverpack-wget.exe (PID: 1540)
      • aria2c.exe (PID: 3412)
      • driverpack-wget.exe (PID: 3828)
      • driverpack-wget.exe (PID: 3792)
      • driverpack-wget.exe (PID: 1544)
      • driverpack-wget.exe (PID: 872)
      • driverpack-wget.exe (PID: 2380)
      • driverpack-wget.exe (PID: 3896)
      • driverpack-wget.exe (PID: 3100)
      • driverpack-wget.exe (PID: 2848)
      • driverpack-wget.exe (PID: 780)
      • driverpack-wget.exe (PID: 3040)
      • driverpack-wget.exe (PID: 3772)
      • driverpack-wget.exe (PID: 2580)
      • driverpack-wget.exe (PID: 1024)
      • wmpnscfg.exe (PID: 3792)
      • driverpack-wget.exe (PID: 3596)
      • driverpack-wget.exe (PID: 3944)
      • driverpack-wget.exe (PID: 2640)
      • driverpack-wget.exe (PID: 820)
      • driverpack-wget.exe (PID: 3900)
      • driverpack-wget.exe (PID: 3508)
      • driverpack-wget.exe (PID: 1776)
      • driverpack-wget.exe (PID: 124)
      • driverpack-wget.exe (PID: 3832)
      • driverpack-wget.exe (PID: 2932)
      • aria2c.exe (PID: 3596)
      • driverpack-wget.exe (PID: 3292)
      • driverpack-wget.exe (PID: 2544)
      • driverpack-wget.exe (PID: 1620)
      • driverpack-wget.exe (PID: 452)
      • driverpack-wget.exe (PID: 1328)
      • driverpack-wget.exe (PID: 1232)
      • driverpack-wget.exe (PID: 2716)
      • driverpack-wget.exe (PID: 1924)
      • driverpack-wget.exe (PID: 3048)
      • driverpack-wget.exe (PID: 1060)
      • driverpack-wget.exe (PID: 2980)
      • driverpack-wget.exe (PID: 1476)
      • driverpack-wget.exe (PID: 1144)
      • driverpack-wget.exe (PID: 452)
      • driverpack-wget.exe (PID: 1836)
      • driverpack-wget.exe (PID: 3440)
      • driverpack-wget.exe (PID: 3532)
      • driverpack-wget.exe (PID: 3048)
      • driverpack-wget.exe (PID: 796)
      • driverpack-wget.exe (PID: 2892)
      • driverpack-wget.exe (PID: 3236)
      • driverpack-wget.exe (PID: 1776)
      • driverpack-wget.exe (PID: 3956)
      • driverpack-wget.exe (PID: 4224)
      • driverpack-wget.exe (PID: 4200)
      • driverpack-wget.exe (PID: 5352)
      • driverpack-wget.exe (PID: 5448)
      • driverpack-wget.exe (PID: 5592)
      • driverpack-wget.exe (PID: 3956)
      • driverpack-wget.exe (PID: 4892)
      • driverpack-wget.exe (PID: 4908)
      • driverpack-wget.exe (PID: 4536)
      • driverpack-wget.exe (PID: 4196)
      • driverpack-wget.exe (PID: 4152)
      • driverpack-wget.exe (PID: 4464)
      • driverpack-wget.exe (PID: 4604)
      • driverpack-wget.exe (PID: 4820)
      • driverpack-wget.exe (PID: 4308)
      • driverpack-wget.exe (PID: 5980)
      • driverpack-wget.exe (PID: 5724)
      • driverpack-wget.exe (PID: 5788)
      • driverpack-wget.exe (PID: 4260)
      • driverpack-wget.exe (PID: 372)
      • driverpack-wget.exe (PID: 3960)
      • driverpack-wget.exe (PID: 5388)
      • driverpack-wget.exe (PID: 5036)
      • driverpack-wget.exe (PID: 4624)
      • driverpack-wget.exe (PID: 5308)
      • driverpack-wget.exe (PID: 596)
      • driverpack-wget.exe (PID: 5452)
      • driverpack-wget.exe (PID: 5336)
      • driverpack-wget.exe (PID: 4384)
      • driverpack-wget.exe (PID: 4364)
      • driverpack-wget.exe (PID: 4604)
      • driverpack-wget.exe (PID: 6024)
      • driverpack-wget.exe (PID: 4540)
      • driverpack-wget.exe (PID: 1188)
      • driverpack-wget.exe (PID: 5852)
      • driverpack-wget.exe (PID: 4652)
      • driverpack-wget.exe (PID: 4752)
      • driverpack-wget.exe (PID: 4624)
      • driverpack-wget.exe (PID: 4524)
      • driverpack-wget.exe (PID: 3864)
      • driverpack-wget.exe (PID: 4920)
      • driverpack-wget.exe (PID: 4604)
      • driverpack-wget.exe (PID: 4632)
      • driverpack-wget.exe (PID: 3408)
      • driverpack-wget.exe (PID: 5700)
      • SearcherBar.exe (PID: 5592)

    • Reads the computer name

      • 7za.exe (PID: 2740)
      • driverpack-wget.exe (PID: 2052)
      • driverpack-wget.exe (PID: 3820)
      • driverpack-wget.exe (PID: 3948)
      • driverpack-wget.exe (PID: 1808)
      • driverpack-wget.exe (PID: 3144)
      • driverpack-wget.exe (PID: 2360)
      • driverpack-wget.exe (PID: 548)
      • driverpack-wget.exe (PID: 976)
      • driverpack-wget.exe (PID: 2840)
      • driverpack-wget.exe (PID: 3096)
      • driverpack-wget.exe (PID: 1172)
      • driverpack-wget.exe (PID: 3616)
      • driverpack-wget.exe (PID: 3636)
      • driverpack-wget.exe (PID: 1252)
      • driverpack-wget.exe (PID: 1808)
      • driverpack-wget.exe (PID: 2592)
      • driverpack-wget.exe (PID: 3412)
      • driverpack-wget.exe (PID: 3452)
      • driverpack-wget.exe (PID: 3780)
      • driverpack-7za.exe (PID: 1640)
      • driverpack-wget.exe (PID: 3484)
      • driverpack-wget.exe (PID: 1832)
      • driverpack-wget.exe (PID: 2036)
      • driverpack-wget.exe (PID: 2224)
      • driverpack-wget.exe (PID: 4000)
      • driverpack-wget.exe (PID: 4076)
      • driverpack-wget.exe (PID: 1024)
      • driverpack-wget.exe (PID: 2712)
      • driverpack-wget.exe (PID: 3924)
      • driverpack-wget.exe (PID: 3992)
      • driverpack-wget.exe (PID: 3764)
      • driverpack-wget.exe (PID: 932)
      • driverpack-wget.exe (PID: 3464)
      • driverpack-wget.exe (PID: 2844)
      • driverpack-wget.exe (PID: 2980)
      • driverpack-wget.exe (PID: 3272)
      • driverpack-wget.exe (PID: 4088)
      • driverpack-wget.exe (PID: 4072)
      • driverpack-wget.exe (PID: 908)
      • driverpack-wget.exe (PID: 3176)
      • driverpack-wget.exe (PID: 3840)
      • driverpack-wget.exe (PID: 1836)
      • driverpack-wget.exe (PID: 3444)
      • driverpack-wget.exe (PID: 3832)
      • aria2c.exe (PID: 3756)
      • aria2c.exe (PID: 2096)
      • driverpack-wget.exe (PID: 4088)
      • aria2c.exe (PID: 1060)
      • driverpack-wget.exe (PID: 796)
      • aria2c.exe (PID: 2864)
      • aria2c.exe (PID: 3412)
      • driverpack-wget.exe (PID: 1540)
      • driverpack-wget.exe (PID: 3828)
      • driverpack-wget.exe (PID: 3792)
      • driverpack-wget.exe (PID: 1544)
      • driverpack-wget.exe (PID: 3100)
      • driverpack-wget.exe (PID: 872)
      • driverpack-wget.exe (PID: 2380)
      • driverpack-wget.exe (PID: 780)
      • wmpnscfg.exe (PID: 3792)
      • driverpack-wget.exe (PID: 1836)
      • driverpack-wget.exe (PID: 3896)
      • driverpack-wget.exe (PID: 2848)
      • driverpack-wget.exe (PID: 3040)
      • driverpack-wget.exe (PID: 3772)
      • driverpack-wget.exe (PID: 2580)
      • driverpack-wget.exe (PID: 1024)
      • driverpack-wget.exe (PID: 3944)
      • driverpack-wget.exe (PID: 3596)
      • driverpack-wget.exe (PID: 2640)
      • driverpack-wget.exe (PID: 820)
      • driverpack-wget.exe (PID: 3900)
      • driverpack-wget.exe (PID: 1776)
      • driverpack-wget.exe (PID: 3508)
      • driverpack-wget.exe (PID: 2932)
      • driverpack-wget.exe (PID: 124)
      • aria2c.exe (PID: 3596)
      • driverpack-wget.exe (PID: 3292)
      • driverpack-wget.exe (PID: 2544)
      • driverpack-wget.exe (PID: 1620)
      • driverpack-wget.exe (PID: 3832)
      • driverpack-wget.exe (PID: 1232)
      • driverpack-wget.exe (PID: 2716)
      • driverpack-wget.exe (PID: 452)
      • driverpack-wget.exe (PID: 3048)
      • driverpack-wget.exe (PID: 1924)
      • driverpack-wget.exe (PID: 1328)
      • driverpack-wget.exe (PID: 1476)
      • driverpack-wget.exe (PID: 1060)
      • driverpack-wget.exe (PID: 2980)
      • driverpack-wget.exe (PID: 1144)
      • driverpack-wget.exe (PID: 452)
      • driverpack-wget.exe (PID: 3440)
      • driverpack-wget.exe (PID: 3532)
      • driverpack-wget.exe (PID: 3048)
      • driverpack-wget.exe (PID: 796)
      • driverpack-wget.exe (PID: 3236)
      • driverpack-wget.exe (PID: 1776)
      • driverpack-wget.exe (PID: 3956)
      • driverpack-wget.exe (PID: 2892)
      • driverpack-wget.exe (PID: 4200)
      • driverpack-wget.exe (PID: 5352)
      • driverpack-wget.exe (PID: 4224)
      • driverpack-wget.exe (PID: 5592)
      • driverpack-wget.exe (PID: 5448)
      • driverpack-wget.exe (PID: 4536)
      • driverpack-wget.exe (PID: 4196)
      • driverpack-wget.exe (PID: 4892)
      • driverpack-wget.exe (PID: 3956)
      • driverpack-wget.exe (PID: 4908)
      • driverpack-wget.exe (PID: 4464)
      • driverpack-wget.exe (PID: 4308)
      • driverpack-wget.exe (PID: 4152)
      • driverpack-wget.exe (PID: 4604)
      • driverpack-wget.exe (PID: 5980)
      • driverpack-wget.exe (PID: 5788)
      • driverpack-wget.exe (PID: 5724)
      • driverpack-wget.exe (PID: 4260)
      • driverpack-wget.exe (PID: 4820)
      • driverpack-wget.exe (PID: 372)
      • driverpack-wget.exe (PID: 4624)
      • driverpack-wget.exe (PID: 5388)
      • driverpack-wget.exe (PID: 3960)
      • driverpack-wget.exe (PID: 596)
      • driverpack-wget.exe (PID: 5452)
      • driverpack-wget.exe (PID: 5308)
      • driverpack-wget.exe (PID: 5336)
      • driverpack-wget.exe (PID: 5036)
      • driverpack-wget.exe (PID: 4364)
      • driverpack-wget.exe (PID: 4384)
      • driverpack-wget.exe (PID: 6024)
      • driverpack-wget.exe (PID: 4604)
      • driverpack-wget.exe (PID: 4540)
      • driverpack-wget.exe (PID: 1188)
      • driverpack-wget.exe (PID: 5852)
      • driverpack-wget.exe (PID: 4652)
      • driverpack-wget.exe (PID: 4752)
      • driverpack-wget.exe (PID: 4524)
      • driverpack-wget.exe (PID: 4624)
      • driverpack-wget.exe (PID: 3408)
      • driverpack-wget.exe (PID: 5700)
      • driverpack-wget.exe (PID: 4920)
      • driverpack-wget.exe (PID: 3864)
      • driverpack-wget.exe (PID: 4632)
      • driverpack-wget.exe (PID: 4604)
      • SearcherBar.exe (PID: 5592)

    • Manual execution by a user

      • 7za.exe (PID: 1808)
      • cmd.exe (PID: 2384)
      • WinRAR.exe (PID: 2436)
      • wmpnscfg.exe (PID: 3792)

    • Reads Internet Explorer settings

      • mshta.exe (PID: 528)

    • Checks proxy server information

      • mshta.exe (PID: 528)

    • Create files in a temporary directory

      • csc.exe (PID: 3008)
      • cvtres.exe (PID: 3888)
      • SearcherBar.exe (PID: 5592)

    • Reads the machine GUID from the registry

      • csc.exe (PID: 3008)
      • cvtres.exe (PID: 3888)
      • aria2c.exe (PID: 3756)
      • aria2c.exe (PID: 2096)
      • aria2c.exe (PID: 1060)
      • aria2c.exe (PID: 2864)
      • aria2c.exe (PID: 3412)
      • wmpnscfg.exe (PID: 3792)
      • aria2c.exe (PID: 3596)

    • Creates files or folders in the user directory

      • driverpack-wget.exe (PID: 2052)
      • driverpack-wget.exe (PID: 3820)
      • driverpack-wget.exe (PID: 3948)
      • driverpack-wget.exe (PID: 1808)
      • driverpack-wget.exe (PID: 3144)
      • driverpack-wget.exe (PID: 2360)
      • driverpack-wget.exe (PID: 548)
      • driverpack-wget.exe (PID: 2840)
      • driverpack-wget.exe (PID: 976)
      • driverpack-wget.exe (PID: 3096)
      • driverpack-wget.exe (PID: 1172)
      • driverpack-wget.exe (PID: 3616)
      • driverpack-wget.exe (PID: 3636)
      • driverpack-wget.exe (PID: 2592)
      • driverpack-wget.exe (PID: 1252)
      • driverpack-wget.exe (PID: 3452)
      • driverpack-wget.exe (PID: 1808)
      • driverpack-wget.exe (PID: 3780)
      • driverpack-wget.exe (PID: 3412)
      • driverpack-7za.exe (PID: 1640)
      • driverpack-wget.exe (PID: 1832)
      • driverpack-wget.exe (PID: 3484)
      • driverpack-wget.exe (PID: 2036)
      • driverpack-wget.exe (PID: 2224)
      • driverpack-wget.exe (PID: 4000)
      • driverpack-wget.exe (PID: 4076)
      • driverpack-wget.exe (PID: 1024)
      • driverpack-wget.exe (PID: 3992)
      • driverpack-wget.exe (PID: 2712)
      • driverpack-wget.exe (PID: 3764)
      • driverpack-wget.exe (PID: 3924)
      • driverpack-wget.exe (PID: 932)
      • driverpack-wget.exe (PID: 2844)
      • driverpack-wget.exe (PID: 2980)
      • driverpack-wget.exe (PID: 3464)
      • driverpack-wget.exe (PID: 3272)
      • driverpack-wget.exe (PID: 4088)
      • driverpack-wget.exe (PID: 4072)
      • driverpack-wget.exe (PID: 908)
      • driverpack-wget.exe (PID: 3840)
      • driverpack-wget.exe (PID: 3176)
      • driverpack-wget.exe (PID: 1836)
      • driverpack-wget.exe (PID: 3444)
      • driverpack-wget.exe (PID: 3832)
      • driverpack-wget.exe (PID: 4088)
      • driverpack-wget.exe (PID: 796)
      • aria2c.exe (PID: 3756)
      • aria2c.exe (PID: 2096)
      • aria2c.exe (PID: 1060)
      • aria2c.exe (PID: 2864)
      • driverpack-wget.exe (PID: 1540)
      • aria2c.exe (PID: 3412)
      • driverpack-wget.exe (PID: 3792)
      • driverpack-wget.exe (PID: 3828)
      • driverpack-wget.exe (PID: 1544)
      • driverpack-wget.exe (PID: 872)
      • driverpack-wget.exe (PID: 2380)
      • driverpack-wget.exe (PID: 3100)
      • driverpack-wget.exe (PID: 3896)
      • driverpack-wget.exe (PID: 2848)
      • driverpack-wget.exe (PID: 780)
      • driverpack-wget.exe (PID: 3040)
      • driverpack-wget.exe (PID: 3772)
      • driverpack-wget.exe (PID: 2580)
      • driverpack-wget.exe (PID: 3596)
      • driverpack-wget.exe (PID: 3944)
      • driverpack-wget.exe (PID: 820)
      • driverpack-wget.exe (PID: 1024)
      • driverpack-wget.exe (PID: 3900)
      • driverpack-wget.exe (PID: 1776)
      • driverpack-wget.exe (PID: 3508)
      • driverpack-wget.exe (PID: 2640)
      • driverpack-wget.exe (PID: 124)
      • driverpack-wget.exe (PID: 2932)
      • aria2c.exe (PID: 3596)
      • driverpack-wget.exe (PID: 3832)
      • driverpack-wget.exe (PID: 2544)
      • driverpack-wget.exe (PID: 1620)
      • driverpack-wget.exe (PID: 3292)
      • driverpack-wget.exe (PID: 2716)
      • driverpack-wget.exe (PID: 1232)
      • driverpack-wget.exe (PID: 452)
      • driverpack-wget.exe (PID: 1328)
      • driverpack-wget.exe (PID: 3048)
      • driverpack-wget.exe (PID: 1924)
      • driverpack-wget.exe (PID: 1060)
      • driverpack-wget.exe (PID: 2980)
      • driverpack-wget.exe (PID: 1476)
      • driverpack-wget.exe (PID: 1144)
      • driverpack-wget.exe (PID: 452)
      • driverpack-wget.exe (PID: 1836)
      • driverpack-wget.exe (PID: 3440)
      • driverpack-wget.exe (PID: 3532)
      • driverpack-wget.exe (PID: 796)
      • driverpack-wget.exe (PID: 3048)
      • driverpack-wget.exe (PID: 1776)
      • driverpack-wget.exe (PID: 3956)
      • driverpack-wget.exe (PID: 4200)
      • driverpack-wget.exe (PID: 2892)
      • driverpack-wget.exe (PID: 3236)
      • driverpack-wget.exe (PID: 5352)
      • driverpack-wget.exe (PID: 5592)
      • driverpack-wget.exe (PID: 5448)
      • driverpack-wget.exe (PID: 4224)
      • driverpack-wget.exe (PID: 4536)
      • driverpack-wget.exe (PID: 4892)
      • driverpack-wget.exe (PID: 3956)
      • driverpack-wget.exe (PID: 4908)
      • driverpack-wget.exe (PID: 4196)
      • driverpack-wget.exe (PID: 4308)
      • driverpack-wget.exe (PID: 4152)
      • driverpack-wget.exe (PID: 4464)
      • driverpack-wget.exe (PID: 4604)
      • driverpack-wget.exe (PID: 4820)
      • driverpack-wget.exe (PID: 5788)
      • driverpack-wget.exe (PID: 5724)
      • driverpack-wget.exe (PID: 5980)
      • driverpack-wget.exe (PID: 4260)
      • driverpack-wget.exe (PID: 3960)
      • driverpack-wget.exe (PID: 372)
      • driverpack-wget.exe (PID: 5388)
      • driverpack-wget.exe (PID: 5036)
      • driverpack-wget.exe (PID: 4624)
      • driverpack-wget.exe (PID: 5308)
      • driverpack-wget.exe (PID: 5452)
      • driverpack-wget.exe (PID: 5336)
      • driverpack-wget.exe (PID: 4384)
      • driverpack-wget.exe (PID: 596)
      • driverpack-wget.exe (PID: 4364)
      • driverpack-wget.exe (PID: 4604)
      • driverpack-wget.exe (PID: 1188)
      • driverpack-wget.exe (PID: 6024)
      • driverpack-wget.exe (PID: 4540)
      • driverpack-wget.exe (PID: 4652)
      • driverpack-wget.exe (PID: 4752)
      • driverpack-wget.exe (PID: 4524)
      • driverpack-wget.exe (PID: 4624)
      • driverpack-wget.exe (PID: 5852)
      • driverpack-wget.exe (PID: 3408)
      • driverpack-wget.exe (PID: 5700)
      • driverpack-wget.exe (PID: 4920)
      • driverpack-wget.exe (PID: 3864)
      • driverpack-wget.exe (PID: 4604)
      • driverpack-wget.exe (PID: 4632)

    • The executable file from the user directory is run by the CMD process

      • SearcherBar.exe (PID: 5224)
      • SearcherBar.exe (PID: 4232)
      • SearcherBar.exe (PID: 5592)

    • Creates files in the program directory

      • SearcherBar.exe (PID: 5592)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.cab | Microsoft Cabinet Archive (100)
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
518
Monitored processes
316
Malicious processes
90
Suspicious processes
79

Behavior graph

Click at the process to see the details
start winrar.exe searchprotocolhost.exe no specs 7za.exe no specs cmd.exe no specs 7za.exe mshta.exe cmd.exe no specs powershell.exe no specs rundll32.exe no specs csc.exe cvtres.exe no specs cmd.exe no specs netsh.exe no specs cmd.exe no specs netsh.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs driverpack-wget.exe driverpack-wget.exe driverpack-wget.exe driverpack-wget.exe cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs driverpack-wget.exe cmd.exe no specs cmd.exe no specs cmd.exe no specs driverpack-wget.exe driverpack-wget.exe driverpack-wget.exe driverpack-wget.exe driverpack-wget.exe driverpack-wget.exe driverpack-wget.exe winrar.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs driverpack-wget.exe driverpack-wget.exe driverpack-wget.exe driverpack-wget.exe cmd.exe no specs cmd.exe no specs cmd.exe no specs driverpack-wget.exe driverpack-wget.exe driverpack-wget.exe driverpack-7za.exe no specs cmd.exe no specs chcp.com no specs netsh.exe no specs cmd.exe no specs cmd.exe no specs driverpack-wget.exe driverpack-wget.exe cmd.exe no specs cmd.exe no specs cmd.exe no specs driverpack-wget.exe driverpack-wget.exe driverpack-wget.exe cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs driverpack-wget.exe driverpack-wget.exe driverpack-wget.exe driverpack-wget.exe driverpack-wget.exe cmd.exe no specs driverpack-wget.exe cmd.exe no specs cmd.exe no specs cmd.exe no specs driverpack-wget.exe driverpack-wget.exe driverpack-wget.exe cmd.exe no specs driverpack-wget.exe cmd.exe no specs cmd.exe no specs cmd.exe no specs driverpack-wget.exe driverpack-wget.exe driverpack-wget.exe cmd.exe no specs driverpack-wget.exe cmd.exe no specs cmd.exe no specs driverpack-wget.exe driverpack-wget.exe cmd.exe no specs sc.exe no specs cmd.exe no specs wmic.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs driverpack-wget.exe driverpack-wget.exe driverpack-wget.exe rundll32.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs aria2c.exe cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs aria2c.exe driverpack-wget.exe driverpack-wget.exe aria2c.exe aria2c.exe aria2c.exe driverpack-wget.exe cmd.exe no specs cmd.exe no specs driverpack-wget.exe driverpack-wget.exe cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs driverpack-wget.exe driverpack-wget.exe driverpack-wget.exe driverpack-wget.exe cmd.exe no specs cmd.exe no specs driverpack-wget.exe driverpack-wget.exe cmd.exe no specs cmd.exe no specs driverpack-wget.exe driverpack-wget.exe wmpnscfg.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs driverpack-wget.exe driverpack-wget.exe driverpack-wget.exe driverpack-wget.exe cmd.exe no specs cmd.exe no specs driverpack-wget.exe driverpack-wget.exe cmd.exe no specs cmd.exe no specs cmd.exe no specs driverpack-wget.exe driverpack-wget.exe driverpack-wget.exe cmd.exe no specs cmd.exe no specs driverpack-wget.exe driverpack-wget.exe cmd.exe no specs cmd.exe no specs driverpack-wget.exe driverpack-wget.exe cmd.exe no specs aria2c.exe cmd.exe no specs driverpack-wget.exe cmd.exe no specs cmd.exe no specs cmd.exe no specs driverpack-wget.exe cmd.exe no specs cmd.exe no specs driverpack-wget.exe driverpack-wget.exe driverpack-wget.exe driverpack-wget.exe cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs driverpack-wget.exe driverpack-wget.exe driverpack-wget.exe driverpack-wget.exe cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs driverpack-wget.exe driverpack-wget.exe driverpack-wget.exe driverpack-wget.exe driverpack-wget.exe cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs driverpack-wget.exe driverpack-wget.exe driverpack-wget.exe driverpack-wget.exe driverpack-wget.exe cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs driverpack-wget.exe driverpack-wget.exe driverpack-wget.exe driverpack-wget.exe driverpack-wget.exe cmd.exe no specs cmd.exe no specs cmd.exe no specs driverpack-wget.exe driverpack-wget.exe driverpack-wget.exe cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs driverpack-wget.exe driverpack-wget.exe driverpack-wget.exe driverpack-wget.exe driverpack-wget.exe cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs driverpack-wget.exe driverpack-wget.exe driverpack-wget.exe driverpack-wget.exe driverpack-wget.exe cmd.exe no specs cmd.exe no specs cmd.exe no specs driverpack-wget.exe driverpack-wget.exe driverpack-wget.exe cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs driverpack-wget.exe driverpack-wget.exe driverpack-wget.exe driverpack-wget.exe driverpack-wget.exe cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs driverpack-wget.exe driverpack-wget.exe driverpack-wget.exe driverpack-wget.exe driverpack-wget.exe cmd.exe no specs cmd.exe no specs driverpack-wget.exe driverpack-wget.exe cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs driverpack-wget.exe driverpack-wget.exe driverpack-wget.exe driverpack-wget.exe driverpack-wget.exe cmd.exe no specs driverpack-wget.exe cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs driverpack-wget.exe driverpack-wget.exe driverpack-wget.exe driverpack-wget.exe driverpack-wget.exe cmd.exe no specs driverpack-wget.exe cmd.exe no specs driverpack-wget.exe cmd.exe no specs cmd.exe no specs driverpack-wget.exe driverpack-wget.exe cmd.exe no specs searcherbar.exe no specs searcherbar.exe no specs searcherbar.exe

Process information

PID
CMD
Path
Indicators
Parent process
124"tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Users\admin\Desktop\beetle-cab\ext\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/REVIEWS-2.mp3" -o "C:\Users\admin\AppData\Roaming\DRPSu\temp\wget_log_2914.log" C:\Users\admin\Desktop\beetle-cab\ext\Tools\driverpack-wget.exe
cmd.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\desktop\beetle-cab\ext\tools\driverpack-wget.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
148"C:\Windows\System32\cmd.exe" /c ""tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Users\admin\Desktop\beetle-cab\ext\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/EXPERT-DIAGNOSTICS-4.mp3" -o "C:\Users\admin\AppData\Roaming\DRPSu\temp\wget_log_65758.log" & echo DONE > "C:\Users\admin\AppData\Roaming\DRPSu\temp\wget_finished_65758.txt""C:\Windows\System32\cmd.exe—mshta.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\kernelbase.dll
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\winbrand.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
148"C:\Windows\System32\cmd.exe" /c ""tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Users\admin\Desktop\beetle-cab\ext\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/REVIEWS-2.mp3" -o "C:\Users\admin\AppData\Roaming\DRPSu\temp\wget_log_2914.log" & echo DONE > "C:\Users\admin\AppData\Roaming\DRPSu\temp\wget_finished_2914.txt""C:\Windows\System32\cmd.exe—mshta.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\winbrand.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
312"C:\Windows\System32\cmd.exe" /c ""tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Users\admin\Desktop\beetle-cab\ext\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/CONTINUOUS-2.mp3" -o "C:\Users\admin\AppData\Roaming\DRPSu\temp\wget_log_31032.log" & echo DONE > "C:\Users\admin\AppData\Roaming\DRPSu\temp\wget_finished_31032.txt""C:\Windows\System32\cmd.exe—mshta.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\winbrand.dll
c:\windows\system32\user32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\usp10.dll
c:\windows\system32\imm32.dll
312"C:\Windows\System32\cmd.exe" /c ""tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Users\admin\Desktop\beetle-cab\ext\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/STORIES-adout-1.mp3" -o "C:\Users\admin\AppData\Roaming\DRPSu\temp\wget_log_39026.log" & echo DONE > "C:\Users\admin\AppData\Roaming\DRPSu\temp\wget_finished_39026.txt""C:\Windows\System32\cmd.exe—mshta.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\winbrand.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\usp10.dll
312"C:\Windows\System32\cmd.exe" /c ""tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Users\admin\Desktop\beetle-cab\ext\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/STORIES-adout-9.mp3" -o "C:\Users\admin\AppData\Roaming\DRPSu\temp\wget_log_21004.log" & echo DONE > "C:\Users\admin\AppData\Roaming\DRPSu\temp\wget_finished_21004.txt""C:\Windows\System32\cmd.exe—mshta.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\ntdll.dll
c:\windows\system32\cmd.exe
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\users\admin\desktop\beetle-cab\ext\tools\driverpack-wget.exe
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\winbrand.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
328"C:\Windows\System32\cmd.exe" /c ""tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Users\admin\Desktop\beetle-cab\ext\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/STORIES-adout-4.mp3" -o "C:\Users\admin\AppData\Roaming\DRPSu\temp\wget_log_15252.log" & echo DONE > "C:\Users\admin\AppData\Roaming\DRPSu\temp\wget_finished_15252.txt""C:\Windows\System32\cmd.exe—mshta.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\kernelbase.dll
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\winbrand.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
372"tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Users\admin\Desktop\beetle-cab\ext\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/STORIES-false-positive-3.mp3" -o "C:\Users\admin\AppData\Roaming\DRPSu\temp\wget_log_12027.log" C:\Users\admin\Desktop\beetle-cab\ext\Tools\driverpack-wget.exe
cmd.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\desktop\beetle-cab\ext\tools\driverpack-wget.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
452"tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Users\admin\Desktop\beetle-cab\ext\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/STORIES-adout-10.mp3" -o "C:\Users\admin\AppData\Roaming\DRPSu\temp\wget_log_74579.log" C:\Users\admin\Desktop\beetle-cab\ext\Tools\driverpack-wget.exe
cmd.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\desktop\beetle-cab\ext\tools\driverpack-wget.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
452"tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Users\admin\Desktop\beetle-cab\ext\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/STORIES-technologies-4.mp3" -o "C:\Users\admin\AppData\Roaming\DRPSu\temp\wget_log_23985.log" C:\Users\admin\Desktop\beetle-cab\ext\Tools\driverpack-wget.exe
cmd.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\desktop\beetle-cab\ext\tools\driverpack-wget.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
Total events
44 227
Read events
42 887
Write events
1 333
Delete events
7

Modification events

(PID) Process:(2812) WinRAR.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\16D\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(2812) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:2
Value:
C:\Users\admin\Desktop\virtio_ivshmem_master_build.zip
(PID) Process:(2812) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:1
Value:
C:\Users\admin\Desktop\Win7-KB3191566-x86.zip
(PID) Process:(2812) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\Desktop\phacker.zip
(PID) Process:(2812) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(2812) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(2812) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
(PID) Process:(2812) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:mtime
Value:
100
(PID) Process:(3208) SearchProtocolHost.exeKey:HKEY_USERS\.DEFAULT\Software\Classes\Local Settings\MuiCache\16D\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(2384) cmd.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
Executable files
14
Suspicious files
443
Text files
806
Unknown types
0

Dropped files

PID
Process
Filename
Type
2812WinRAR.exeC:\Users\admin\Desktop\beetle-cab\arc.7z —
MD5:—
SHA256:—
2812WinRAR.exeC:\Users\admin\Desktop\beetle-cab\7za.exeexecutable
MD5:90AAC6489F6B226BF7DC1ADABFDB1259
SHA256:BA7F3627715614D113C1E1CD7DD9D47E3402A1E8A7404043E08BC14939364549
27407za.exeC:\Users\admin\Desktop\beetle-cab\ext\audio\ru\DRIVERS-1.mp3binary
MD5:E22F53E19924A501841E5FC3114D8C54
SHA256:742B0B848BB66409B43B918FAB6FD827C8F37D78F3F5225B3264AE755D97BAB1
27407za.exeC:\Users\admin\Desktop\beetle-cab\ext\audio\ru\COMPILATION-2.mp3binary
MD5:E4360CB22B1B602A1BECF017C4D6B220
SHA256:9C1C807DC3D200B1639E4DCECDE44B3C181F4A18ABA6797924FF34D209F62FDF
2812WinRAR.exeC:\Users\admin\Desktop\beetle-cab\7za.dllexecutable
MD5:B54E2DCD1A3D593CA0AE4CB71910710E
SHA256:D7F1224CC4AFB90AF3792DADFDF2F14BAD4A19329EE0F3C87C111611AA36B7B1
2812WinRAR.exeC:\Users\admin\Desktop\beetle-cab\7zxa.dllexecutable
MD5:72DCC77BA25EBC4984D959A78C8646D5
SHA256:6B4888207C46C23D2D4E4EACE8A2DB01711692BC7D4BB93F3750BC41E91BB73C
27407za.exeC:\Users\admin\Desktop\beetle-cab\ext\audio\ru\COMPILATION-1.mp3binary
MD5:723F7ABC3A9EB779332D97D047680E35
SHA256:05BB6CE8A7C911A9C7FBA5D4A386E3387BFDAF5525CCE9ABA05D29C8C4102BC9
27407za.exeC:\Users\admin\Desktop\beetle-cab\ext\audio\ru\DRIVERS-2.mp3binary
MD5:FFA3D6ADBC43563B3F60E568E147D9CA
SHA256:F2225D9D2F59D21DE16E88D339AA5FDB713D0301533023DFE5B1B7F4028B5A91
27407za.exeC:\Users\admin\Desktop\beetle-cab\ext\audio\ru\CONTINUOUS-3.mp3binary
MD5:21C823FDD5FFD43CBEBEF2F9C06CCB49
SHA256:3E70363B7C324113FDE6AF824089503755B3C0A21F47D53EB51A031C71618EE8
27407za.exeC:\Users\admin\Desktop\beetle-cab\ext\audio\ru\CONTINUOUS-2.mp3binary
MD5:7EEDB085677BB86E9886235D4ADD1A5A
SHA256:D27497768C7A006C3630326B79EC8E943A1FA762627239C9511B05B2A2289108
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
679
TCP/UDP connections
400
DNS requests
44
Threats
1 645

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
528
mshta.exe
HEAD
200
81.94.192.167:80
http://dl.driverpack.io/updates/beetle/driverpack-wget.exe
GB
—
—
malicious
528
mshta.exe
GET
200
37.9.8.75:80
http://update.drp.su/
RU
html
141 b
malicious
528
mshta.exe
GET
200
142.250.185.142:80
http://www.google-analytics.com/collect?v=1&ds=hta&tid=UA-69093127-16&cid=183525443.0323909505&t=event&ec=driverpack%20online&ea=yandex%20patcher%20browser%20not%20detected&el=17.11.108%20online&ul=&z=33446414086623666&sc=start&cd1=183525443.0323909505&cd2=17.11.108%20Online&cd3=7%20x86&cd4=SP%201&cd5=Windows%207%20Professional%20&cd6=(not%20set)
US
image
35 b
whitelisted
528
mshta.exe
POST
401
87.117.235.115:80
http://auth.drp.su/api/session
GB
text
12 b
suspicious
528
mshta.exe
POST
202
37.9.8.75:80
http://update.drp.su/api/events
RU
compressed
141 b
malicious
528
mshta.exe
GET
200
142.250.185.142:80
http://www.google-analytics.com/collect?v=1&ds=hta&tid=UA-69093127-16&cid=183525443.0323909505&t=event&ec=driverpack%20online&ea=new%20ui%20experiment%20detected%20enabled&el=17.11.108%20online&ul=&z=45736483159324625&cd1=183525443.0323909505&cd2=17.11.108%20Online&cd3=7%20x86&cd4=SP%201&cd5=Windows%207%20Professional%20&cd6=(not%20set)
US
image
35 b
whitelisted
528
mshta.exe
GET
200
142.250.185.142:80
http://www.google-analytics.com/collect?v=1&ds=hta&tid=UA-69093127-16&cid=183525443.0323909505&t=event&ec=driverpack%20online&ea=application%20opened&el=17.11.108%20online&ul=&z=29168062677459783&cd1=183525443.0323909505&cd2=17.11.108%20Online&cd3=7%20x86&cd4=SP%201&cd5=Windows%207%20Professional%20&cd6=(not%20set)
US
image
35 b
whitelisted
528
mshta.exe
GET
200
142.250.185.142:80
http://www.google-analytics.com/collect?v=1&ds=hta&tid=UA-68879973-26&cid=183525443.0323909505&t=event&ec=driverpack%20online&ea=application%20opened&el=17.11.108%20online&ul=&z=554366286403194&cd1=183525443.0323909505&cd2=17.11.108%20Online&cd3=7%20x86&cd4=SP%201&cd5=Windows%207%20Professional%20&cd6=(not%20set)
US
image
35 b
whitelisted
528
mshta.exe
GET
200
142.250.185.142:80
http://www.google-analytics.com/collect?v=1&ds=hta&tid=UA-69093127-16&cid=183525443.0323909505&t=event&ec=driverpack%20online&ea=application%20opened&el=17.11.108%20online&ul=&z=5970870358708454&sc=start&cd1=183525443.0323909505&cd2=17.11.108%20Online&cd3=7%20x86&cd4=SP%201&cd5=Windows%207%20Professional%20&cd6=(not%20set)
US
image
35 b
whitelisted
528
mshta.exe
POST
202
37.9.8.75:80
http://update.drp.su/api/logs
RU
compressed
141 b
malicious
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:138
—
—
—
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
528
mshta.exe
188.114.96.3:80
allfont.ru
CLOUDFLARENET
NL
malicious
528
mshta.exe
188.114.97.3:80
allfont.ru
CLOUDFLARENET
NL
malicious
528
mshta.exe
87.117.235.115:80
auth.drp.su
Iomart Cloud Services Limited
GB
suspicious
528
mshta.exe
87.250.250.119:443
mc.yandex.ru
YANDEX LLC
RU
whitelisted
528
mshta.exe
142.250.185.142:80
www.google-analytics.com
GOOGLE
US
whitelisted
528
mshta.exe
37.9.8.75:80
update.drp.su
OOO Network of data-centers Selectel
RU
malicious
528
mshta.exe
81.94.192.167:80
dl.driverpack.io
Iomart Cloud Services Limited
GB
malicious
3948
driverpack-wget.exe
81.94.192.167:80
dl.driverpack.io
Iomart Cloud Services Limited
GB
malicious

DNS requests

Domain
IP
Reputation
allfont.ru
  • 188.114.96.3
  • 188.114.97.3
whitelisted
auth.drp.su
  • 87.117.235.115
suspicious
mc.yandex.ru
  • 87.250.250.119
  • 77.88.21.119
  • 93.158.134.119
  • 87.250.251.119
whitelisted
update.drp.su
  • 37.9.8.75
malicious
www.google-analytics.com
  • 142.250.185.142
whitelisted
dl.driverpack.io
  • 81.94.192.167
  • 87.117.239.151
  • 87.117.231.157
  • 87.117.239.150
malicious
ctldl.windowsupdate.com
  • 95.140.236.0
  • 178.79.242.128
whitelisted
ocsp.globalsign.com
  • 104.18.21.226
  • 104.18.20.226
whitelisted
crl.globalsign.com
  • 104.18.20.226
  • 104.18.21.226
whitelisted
ocsp2.globalsign.com
  • 104.18.21.226
  • 104.18.20.226
whitelisted

Threats

PID
Process
Class
Message
1076
svchost.exe
Potentially Bad Traffic
ET DNS Query for .su TLD (Soviet Union) Often Malware Related
1076
svchost.exe
Possibly Unwanted Program Detected
ET ADWARE_PUP DriverPack Domain in DNS Query
1076
svchost.exe
Possibly Unwanted Program Detected
ET ADWARE_PUP Observed DNS Query to DriverPack Domain ( .drp .su)
1076
svchost.exe
Potentially Bad Traffic
ET DNS Query for .su TLD (Soviet Union) Often Malware Related
1076
svchost.exe
Possibly Unwanted Program Detected
ET ADWARE_PUP DriverPack Domain in DNS Query
1076
svchost.exe
Possibly Unwanted Program Detected
ET ADWARE_PUP Observed DNS Query to DriverPack Domain ( .drp .su)
528
mshta.exe
Potentially Bad Traffic
ET POLICY HTTP Request to .su TLD (Soviet Union) Often Malware Related
528
mshta.exe
Potentially Bad Traffic
ET POLICY HTTP Request to .su TLD (Soviet Union) Often Malware Related
528
mshta.exe
Potentially Bad Traffic
ET POLICY HTTP Request to .su TLD (Soviet Union) Often Malware Related
528
mshta.exe
Potentially Bad Traffic
ET POLICY HTTP Request to .su TLD (Soviet Union) Often Malware Related
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
beetle-cab.cab