File name:

tinfoil_driver.exe

Full analysis: https://app.any.run/tasks/71d1814f-05fc-45be-b0a7-c4c38267d61f
Verdict: Malicious activity
Analysis date: November 26, 2023, 23:47:26
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386, for MS Windows
MD5:

C6A3790A4064F7FD6663EC0F3F25158B

SHA1:

C7EFCB061C09BC41E20E2DC7CC8369DC39E63376

SHA256:

E2A0B793E8890417CB1BBFF52A65F9A5B9399F1BD072168F1E0482002D80B821

SSDEEP:

98304:sSdxWsjVCn06dWuGCelS+tCPndMm8I2G6liOQphl0IC9iaQORVlcnzD2HoOtC1MS:FuIGf

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Drops the executable file immediately after the start

      • tinfoil_driver.exe (PID: 3352)
      • dpinst32.exe (PID: 2508)
      • drvinst.exe (PID: 2948)

    • Creates a writable file in the system directory

      • drvinst.exe (PID: 2948)

  • SUSPICIOUS

    • Process drops legitimate windows executable

      • tinfoil_driver.exe (PID: 3352)
      • dpinst32.exe (PID: 2508)
      • drvinst.exe (PID: 2948)

    • Drops a system driver (possible attempt to evade defenses)

      • tinfoil_driver.exe (PID: 3352)
      • dpinst32.exe (PID: 2508)
      • drvinst.exe (PID: 2948)

    • Reads the Internet Settings

      • tinfoil_driver.exe (PID: 3352)

    • Reads settings of System Certificates

      • dpscat.exe (PID: 2504)

    • Adds/modifies Windows certificates

      • tinfoil_driver.exe (PID: 3352)

    • Creates files in the driver directory

      • drvinst.exe (PID: 2948)

    • Checks Windows Trust Settings

      • drvinst.exe (PID: 2948)

    • Executes as Windows Service

      • VSSVC.exe (PID: 3120)

  • INFO

    • Checks supported languages

      • tinfoil_driver.exe (PID: 3352)
      • dpscat.exe (PID: 2504)
      • dpinst32.exe (PID: 2508)
      • drvinst.exe (PID: 2948)

    • Reads the computer name

      • tinfoil_driver.exe (PID: 3352)
      • dpscat.exe (PID: 2504)
      • dpinst32.exe (PID: 2508)
      • drvinst.exe (PID: 2948)

    • Create files in a temporary directory

      • tinfoil_driver.exe (PID: 3352)
      • dpscat.exe (PID: 2504)
      • dpinst32.exe (PID: 2508)

    • Reads the machine GUID from the registry

      • dpscat.exe (PID: 2504)
      • dpinst32.exe (PID: 2508)
      • drvinst.exe (PID: 2948)

    • Creates files in the program directory

      • dpscat.exe (PID: 2504)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Generic Win/DOS Executable (50)
.exe | DOS Executable Generic (49.9)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2012:02:10 00:36:29+01:00
ImageFileCharacteristics: No relocs, Executable, 32-bit
PEType: PE32
LinkerVersion: 8
CodeSize: 66560
InitializedDataSize: 31744
UninitializedDataSize: -
EntryPoint: 0x10def
OSVersion: 4
ImageVersion: -
SubsystemVersion: 4
Subsystem: Windows GUI
FileVersionNumber: 1.4.1.2100
ProductVersionNumber: 1.4.1.2100
FileFlagsMask: 0x003f
FileFlags: Private build
FileOS: Windows NT 32-bit
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: Neutral
CharacterSet: Unicode
CompanyName: Oleg N. Scherbakov
FileDescription: 7z Setup SFX (x86)
FileVersion: 1.4.1.2100
InternalName: 7ZSfxMod
LegalCopyright: Copyright © 2005-2010 Oleg N. Scherbakov
OriginalFileName: 7ZSfxMod_x86.exe
PrivateBuild: April 28, 2011
ProductName: 7-Zip SFX
ProductVersion: 1.4.1.2100
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
45
Monitored processes
6
Malicious processes
4
Suspicious processes
0

Behavior graph

Click at the process to see the details
start tinfoil_driver.exe dpscat.exe dpinst32.exe no specs drvinst.exe no specs vssvc.exe no specs tinfoil_driver.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
2504"C:\Users\admin\AppData\Local\Temp\7ZipSfx_000\dpscat.exe" C:\Users\admin\AppData\Local\Temp\7ZipSfx_000\dpscat.exe
tinfoil_driver.exe
User:
admin
Company:
http://libusb-win32.sourceforge.net
Integrity Level:
HIGH
Description:
Inf catalog and signing tool
Exit code:
0
Version:
3.0.7.0
Modules
Images
c:\users\admin\appdata\local\temp\7zipsfx_000\dpscat.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
2508"C:\Users\admin\AppData\Local\Temp\7ZipSfx_000\dpinst32.exe" C:\Users\admin\AppData\Local\Temp\7ZipSfx_000\dpinst32.exe—tinfoil_driver.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Driver Package Installer
Exit code:
256
Version:
2.1
Modules
Images
c:\users\admin\appdata\local\temp\7zipsfx_000\dpinst32.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
2708"C:\Users\admin\AppData\Local\Temp\tinfoil_driver.exe" C:\Users\admin\AppData\Local\Temp\tinfoil_driver.exe—explorer.exe
User:
admin
Company:
Oleg N. Scherbakov
Integrity Level:
MEDIUM
Description:
7z Setup SFX (x86)
Exit code:
3221226540
Version:
1.4.1.2100
Modules
Images
c:\users\admin\appdata\local\temp\tinfoil_driver.exe
c:\windows\system32\ntdll.dll
2948DrvInst.exe "4" "0" "C:\Users\admin\AppData\Local\Temp\{03ca1643-5b8f-6a92-536c-9f1e46de091d}\tinfoil.inf" "0" "61128a813" "00000360" "WinSta0\Default" "00000388" "208" "c:\users\admin\appdata\local\temp\7zipsfx_000"C:\Windows\System32\drvinst.exe—svchost.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Driver Installation Module
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\drvinst.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\setupapi.dll
c:\windows\system32\cfgmgr32.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
3120C:\Windows\system32\vssvc.exeC:\Windows\System32\VSSVC.exe—services.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Microsoft® Volume Shadow Copy Service
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\vssvc.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
3352"C:\Users\admin\AppData\Local\Temp\tinfoil_driver.exe" C:\Users\admin\AppData\Local\Temp\tinfoil_driver.exe
explorer.exe
User:
admin
Company:
Oleg N. Scherbakov
Integrity Level:
HIGH
Description:
7z Setup SFX (x86)
Exit code:
256
Version:
1.4.1.2100
Modules
Images
c:\users\admin\appdata\local\temp\tinfoil_driver.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.24483_none_2b200f664577e14b\comctl32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
Total events
11 392
Read events
11 326
Write events
64
Delete events
2

Modification events

(PID) Process:(3352) tinfoil_driver.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
(PID) Process:(3352) tinfoil_driver.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:IntranetName
Value:
1
(PID) Process:(3352) tinfoil_driver.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
1
(PID) Process:(3352) tinfoil_driver.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
0
(PID) Process:(2504) dpscat.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\17F\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(2504) dpscat.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\BF9F38DE807C9FCD7AD43A69FD3862FF5F66ACF7
Operation:writeName:Blob
Value:
030000000100000014000000BF9F38DE807C9FCD7AD43A69FD3862FF5F66ACF702000000010000004C0000001C0000000000000001000000200000000000000000000000020000006C006900620077006400690020006B0065007900200063006F006E007400610069006E006500720000000000000000000B000000010000000E0000006C0069006200770064006900000020000000010000008C02000030820288308201F1A003020102021045110CF1A683268B4F57415FB6896DA0300D06092A864886F70D010105050030433141303F06035504031E38006C00690062007500730062004B0020002800740069006E0066006F0069006C002E0069006E006600290020005B00530065006C0066005D301E170D3233313132363233343733375A170D3239303130313030303030305A30433141303F06035504031E38006C00690062007500730062004B0020002800740069006E0066006F0069006C002E0069006E006600290020005B00530065006C0066005D30819F300D06092A864886F70D010101050003818D0030818902818100AF959277AEC6CAC25E5818A8C944B25B467E890214B9683DAFDBD7F02F89C949FEB0A2398916FFBC6E63EAED3EF13484400AB07044BBA569A1B658A8994C8D006F3251819DC69EFB1E442A6BFB2AA06D820458CA9B81B0D0951CE957C1023CDEAAFD6E4F8CAB8DA958FC0A6522751E0CDBBBCFC9FBB3E286861DD3C515F4257B0203010001A37D307B30160603551D250101FF040C300A06082B0601050507030330200603551D07041930178615687474703A2F2F6C69627764692E616B656F2E6965303F0603551D2004383036303406082B060105050702013028302606082B06010505070201161A687474703A2F2F6C69627764692D6370732E616B656F2E696500300D06092A864886F70D010105050003818100A5697EB89857E1647103A40004B3670BB18429A208C472E33594F930759C20F9CF35853963D1ED4ECB06D73DF2C887ABE3FB085CE63FA5A229F3815A991D23056920CEC2D59ACBDD6CF202292E496B9B3648F633A61B6EB80CF1F7629AF4EC7E77F5622572E6DED10395684BC99170A1FAFEB8FBEFCA38BA8F00EA401933E369
(PID) Process:(2504) dpscat.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\BF9F38DE807C9FCD7AD43A69FD3862FF5F66ACF7
Operation:delete keyName:(default)
Value:
(PID) Process:(2504) dpscat.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\BF9F38DE807C9FCD7AD43A69FD3862FF5F66ACF7
Operation:writeName:Blob
Value:
030000000100000014000000BF9F38DE807C9FCD7AD43A69FD3862FF5F66ACF720000000010000008C02000030820288308201F1A003020102021045110CF1A683268B4F57415FB6896DA0300D06092A864886F70D010105050030433141303F06035504031E38006C00690062007500730062004B0020002800740069006E0066006F0069006C002E0069006E006600290020005B00530065006C0066005D301E170D3233313132363233343733375A170D3239303130313030303030305A30433141303F06035504031E38006C00690062007500730062004B0020002800740069006E0066006F0069006C002E0069006E006600290020005B00530065006C0066005D30819F300D06092A864886F70D010101050003818D0030818902818100AF959277AEC6CAC25E5818A8C944B25B467E890214B9683DAFDBD7F02F89C949FEB0A2398916FFBC6E63EAED3EF13484400AB07044BBA569A1B658A8994C8D006F3251819DC69EFB1E442A6BFB2AA06D820458CA9B81B0D0951CE957C1023CDEAAFD6E4F8CAB8DA958FC0A6522751E0CDBBBCFC9FBB3E286861DD3C515F4257B0203010001A37D307B30160603551D250101FF040C300A06082B0601050507030330200603551D07041930178615687474703A2F2F6C69627764692E616B656F2E6965303F0603551D2004383036303406082B060105050702013028302606082B06010505070201161A687474703A2F2F6C69627764692D6370732E616B656F2E696500300D06092A864886F70D010105050003818100A5697EB89857E1647103A40004B3670BB18429A208C472E33594F930759C20F9CF35853963D1ED4ECB06D73DF2C887ABE3FB085CE63FA5A229F3815A991D23056920CEC2D59ACBDD6CF202292E496B9B3648F633A61B6EB80CF1F7629AF4EC7E77F5622572E6DED10395684BC99170A1FAFEB8FBEFCA38BA8F00EA401933E369
(PID) Process:(2504) dpscat.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\TrustedPublisher\Certificates\BF9F38DE807C9FCD7AD43A69FD3862FF5F66ACF7
Operation:delete keyName:(default)
Value:
(PID) Process:(2504) dpscat.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\TrustedPublisher\Certificates\BF9F38DE807C9FCD7AD43A69FD3862FF5F66ACF7
Operation:writeName:Blob
Value:
030000000100000014000000BF9F38DE807C9FCD7AD43A69FD3862FF5F66ACF720000000010000008C02000030820288308201F1A003020102021045110CF1A683268B4F57415FB6896DA0300D06092A864886F70D010105050030433141303F06035504031E38006C00690062007500730062004B0020002800740069006E0066006F0069006C002E0069006E006600290020005B00530065006C0066005D301E170D3233313132363233343733375A170D3239303130313030303030305A30433141303F06035504031E38006C00690062007500730062004B0020002800740069006E0066006F0069006C002E0069006E006600290020005B00530065006C0066005D30819F300D06092A864886F70D010101050003818D0030818902818100AF959277AEC6CAC25E5818A8C944B25B467E890214B9683DAFDBD7F02F89C949FEB0A2398916FFBC6E63EAED3EF13484400AB07044BBA569A1B658A8994C8D006F3251819DC69EFB1E442A6BFB2AA06D820458CA9B81B0D0951CE957C1023CDEAAFD6E4F8CAB8DA958FC0A6522751E0CDBBBCFC9FBB3E286861DD3C515F4257B0203010001A37D307B30160603551D250101FF040C300A06082B0601050507030330200603551D07041930178615687474703A2F2F6C69627764692E616B656F2E6965303F0603551D2004383036303406082B060105050702013028302606082B06010505070201161A687474703A2F2F6C69627764692D6370732E616B656F2E696500300D06092A864886F70D010105050003818100A5697EB89857E1647103A40004B3670BB18429A208C472E33594F930759C20F9CF35853963D1ED4ECB06D73DF2C887ABE3FB085CE63FA5A229F3815A991D23056920CEC2D59ACBDD6CF202292E496B9B3648F633A61B6EB80CF1F7629AF4EC7E77F5622572E6DED10395684BC99170A1FAFEB8FBEFCA38BA8F00EA401933E369
Executable files
29
Suspicious files
16
Text files
9
Unknown types
0

Dropped files

PID
Process
Filename
Type
3352tinfoil_driver.exeC:\Users\admin\AppData\Local\Temp\7ZipSfx_000\tinfoil.inftext
MD5:28F001699DA6C0920D4B2D73B7DBFC23
SHA256:49CC5AF0BE44527245CA0CF9857CE238B91D7585A6CC2335D506E0A8AEB6ACEA
3352tinfoil_driver.exeC:\Users\admin\AppData\Local\Temp\7ZipSfx_000\dpinst64.exeexecutable
MD5:BE3C79033FA8302002D9D3A6752F2263
SHA256:181BF85D3B5900FF8ABED34BC415AFC37FC322D9D7702E14D144F96A908F5CAB
3352tinfoil_driver.exeC:\Users\admin\AppData\Local\Temp\7ZipSfx_000\dpinst32.exeexecutable
MD5:30A0AFEE4AEA59772DB6434F1C0511AB
SHA256:D84149976BC94A21B21AA0BC99FCBDEE9D1AD4F3387D8B62B90F805AC300BA05
3352tinfoil_driver.exeC:\Users\admin\AppData\Local\Temp\7ZipSfx_000\x86\libusb0_x86.dllexecutable
MD5:535779909A40B42F4F3E48598F5778A5
SHA256:00CACA07869B19D10B370552AC7CC2F6F2EE246FC15DB11650F6CD3F4EF9B666
3352tinfoil_driver.exeC:\Users\admin\AppData\Local\Temp\7ZipSfx_000\amd64\libusb0.dllexecutable
MD5:1D8215F7F8CD02A553499B534CCFB4D5
SHA256:4F18B5D2C28AA66B648C8683C6D09B52B92CBBEE85984BBEFAD5F38A64BC2A14
3352tinfoil_driver.exeC:\Users\admin\AppData\Local\Temp\7ZipSfx_000\amd64\libusbK.sysexecutable
MD5:A814FF2972F55909AAFFD943EBB0E866
SHA256:1DF66FF22E2EAEC27180756D90926CA5B07E8BCF6B0E4E3C56471E63A3A05FA6
3352tinfoil_driver.exeC:\Users\admin\AppData\Local\Temp\7ZipSfx_000\x86\WdfCoInstaller01009.dllexecutable
MD5:A9970042BE512C7981B36E689C5F3F9F
SHA256:7A6BF1F950684381205C717A51AF2D9C81B203CB1F3DB0006A4602E2DF675C77
3352tinfoil_driver.exeC:\Users\admin\AppData\Local\Temp\7ZipSfx_000\amd64\WdfCoInstaller01009.dllexecutable
MD5:4DA5DA193E0E4F86F6F8FD43EF25329A
SHA256:18487B4FF94EDCCC98ED59D9FCA662D4A1331C5F1E14DF8DB3093256DD9F1C3E
2508dpinst32.exeC:\Users\admin\AppData\Local\Temp\{03ca1643-5b8f-6a92-536c-9f1e46de091d}\x86\SETF45F.tmpexecutable
MD5:1F17DFE26285CF9971E55DDFF915877B
SHA256:6265AE9AE5C49F515613F0B749AD8390A1B34CA326203318BFFEB6C2C281D2D0
2504dpscat.exeC:\Users\admin\AppData\Local\Temp\7ZipSfx_000\tinfoil.catbinary
MD5:5FB2D1051689792F9E40C8F5FEB9DBE5
SHA256:8370FF5FAFBD0F303B0DE2A44245FA9A0837F5AC6ED6B84C521FA74CECE5879B
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
5
DNS requests
1
Threats
0

HTTP requests

No HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:138
—
—
—
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
2588
svchost.exe
239.255.255.250:1900
—
—
—
whitelisted
868
svchost.exe
95.101.148.135:80
—
Akamai International B.V.
NL
unknown
868
svchost.exe
184.30.20.134:80
armmf.adobe.com
AKAMAI-AS
DE
unknown

DNS requests

Domain
IP
Reputation
armmf.adobe.com
  • 184.30.20.134
whitelisted

Threats

No threats detected
Process
Message
dpscat.exe
dpscat.exe
Portions Copyright(c) Pete Batard. (LGPL)
dpscat.exe
Copyright(c) 2012 Travis Lee Robinson. (DUAL BSD/GPL)
dpscat.exe
Found Hwid: USB\VID_16C0&PID_27E2&MI_00
dpscat.exe
Actual section to install: LUsbK_DeviceGroup.NTx86
dpscat.exe
Hash calculated for: .\x86\libusbk.sys
dpscat.exe
Hash calculated for: .\x86\libusb0_x86.dll
dpscat.exe
Hash added..
dpscat.exe
Using PE guid..
dpscat.exe
Using PE guid..
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
tinfoil_driver.exe