File name:

hidusbf.zip

Full analysis: https://app.any.run/tasks/2bd80642-bbdf-4583-9648-4c385205a94e
Verdict: Malicious activity
Analysis date: December 14, 2024, 10:26:27
OS: Windows 10 Professional (build: 19045, 64 bit)
Tags:
arch-exec
arch-doc
Indicators:
MIME: application/zip
File info: Zip archive data, at least v2.0 to extract, compression method=store
MD5:

91F9D7834431CCDB8640E6514413BB2E

SHA1:

99E180FABED3F805D4A09E3121DBB53D56883051

SHA256:

EA74EAE4F4F074DEF0328ADE4F2414C3090F34E35226D1FDEC07DCE90F2DA7E3

SSDEEP:

24576:kuG6O+oo1+oorQ2Yh/QwTj7xKceaaj/HWS4OXQ4euMSZMBi0BHu/jy:kD6O+oo1+oorQ2Yh/QwTj7xKceaaj/H6

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Executing a file with an untrusted certificate

      • Setup.exe (PID: 5788)
      • sx64.exe (PID: 4864)

  • SUSPICIOUS

    • Reads security settings of Internet Explorer

      • Setup.exe (PID: 5788)

    • Drops a system driver (possible attempt to evade defenses)

      • WinRAR.exe (PID: 6312)

  • INFO

    • Reads security settings of Internet Explorer

      • notepad.exe (PID: 7016)

    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 6312)

    • The sample compiled with english language support

      • WinRAR.exe (PID: 6312)

    • The process uses the downloaded file

      • WinRAR.exe (PID: 6312)
      • Setup.exe (PID: 5788)

    • Manual execution by a user

      • notepad.exe (PID: 7016)
      • Setup.exe (PID: 5788)

    • Checks supported languages

      • Setup.exe (PID: 5788)
      • sx64.exe (PID: 4864)

    • Reads the computer name

      • Setup.exe (PID: 5788)

    • Process checks computer location settings

      • Setup.exe (PID: 5788)

    • Sends debugging messages

      • sx64.exe (PID: 4864)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.zip | ZIP compressed archive (100)

EXIF

ZIP

ZipFileName: DRIVER/
ZipUncompressedSize: -
ZipCompressedSize: -
ZipCRC: 0x00000000
ZipModifyDate: 2008:04:15 15:30:18
ZipCompression: None
ZipBitFlag: -
ZipRequiredVersion: 20
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
134
Monitored processes
5
Malicious processes
2
Suspicious processes
1

Behavior graph

Click at the process to see the details
start winrar.exe notepad.exe no specs rundll32.exe no specs setup.exe sx64.exe

Process information

PID
CMD
Path
Indicators
Parent process
6312"C:\Program Files\WinRAR\WinRAR.exe" C:\Users\admin\AppData\Local\Temp\hidusbf.zipC:\Program Files\WinRAR\WinRAR.exe
explorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Exit code:
0
Version:
5.91.0
Modules
Images
c:\program files\winrar\winrar.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
7016"C:\WINDOWS\system32\NOTEPAD.EXE" C:\Users\admin\Desktop\README.ENG.TXTC:\Windows\System32\notepad.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Notepad
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\notepad.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\user32.dll
5696C:\WINDOWS\System32\rundll32.exe C:\WINDOWS\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -EmbeddingC:\Windows\System32\rundll32.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows host process (Rundll32)
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\rundll32.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\shcore.dll
c:\windows\system32\imagehlp.dll
5788"C:\Users\admin\Desktop\DRIVER\Setup.exe" C:\Users\admin\Desktop\DRIVER\Setup.exe
explorer.exe
User:
admin
Integrity Level:
HIGH
Modules
Images
c:\users\admin\desktop\driver\setup.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\acgenral.dll
4864"C:\Users\admin\Desktop\DRIVER\sx64.exe" U USB\VID_0627&PID_0001\28754-0000:00:04.7-1C:\Users\admin\Desktop\DRIVER\sx64.exe
Setup.exe
User:
admin
Company:
SweetLow
Integrity Level:
HIGH
Description:
SETUP x64 Helper
Exit code:
0
Version:
1.3.0.0
Modules
Images
c:\users\admin\desktop\driver\sx64.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\setupapi.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\cfgmgr32.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
Total events
2 290
Read events
2 272
Write events
18
Delete events
0

Modification events

(PID) Process:(6312) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:3
Value:
C:\Users\admin\Desktop\preferences.zip
(PID) Process:(6312) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:2
Value:
C:\Users\admin\Desktop\chromium_ext.zip
(PID) Process:(6312) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:1
Value:
C:\Users\admin\Desktop\omni_23_10_2024_.zip
(PID) Process:(6312) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\AppData\Local\Temp\hidusbf.zip
(PID) Process:(6312) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(6312) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(6312) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
(PID) Process:(6312) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:mtime
Value:
100
(PID) Process:(6312) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\Interface\MainWin
Operation:writeName:Placement
Value:
2C0000000000000001000000FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFE400000045000000A40400002E020000
(PID) Process:(6312) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\ArcColumnWidths
Operation:writeName:name
Value:
256
Executable files
23
Suspicious files
3
Text files
7
Unknown types
1

Dropped files

PID
Process
Filename
Type
6312WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa6312.31131\DRIVER\NTX86\2khz-4khz\hidusbf.sysexecutable
MD5:2EAA8605C6F9F511BB28B16F3626C609
SHA256:3273A052E5A54F0270168CEE156B7B27B22B59E122B94922A801DD7CDB8BF6B5
6312WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa6312.31131\DRIVER\NTX86\4khz-8khz\hidusbf.sysexecutable
MD5:E20703C1C2A2AA94E6D5EEB48BAB62FD
SHA256:377D2BBC879759260A66D937D3C80E2C2B4BAD08D6ED36A0CF93873B7B38A9CE
6312WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa6312.31131\DRIVER\AMD64\2khz-4khz\hidusbf.sysexecutable
MD5:52A628ECC5B5D74F3F9F03FE6FD49C30
SHA256:841D8EC5B070D068B0BF97C8EA255CD3AE9360FCA4BE2FB61149411419DBE755
6312WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa6312.31131\DRIVER\AMD64\1khz\hidusbf.sysexecutable
MD5:C0C8BDFA88BFAF4552B1C50BEDB2E20D
SHA256:EC97D9C203B6FC47605027DE2E65891C63C8088230F5F8B59E705F40E0BD860A
6312WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa6312.31131\DRIVER\NTX86\nopatch\hidusbf.sysexecutable
MD5:2122564C266A79E73FA73A44523783DC
SHA256:A3CBA51DC28B10F7BE1A232BE0D6CEC6D734B6753AB7054169A04CE22335F7D8
6312WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa6312.31131\DRIVER\AMD64\nopatch\hidusbf.sysexecutable
MD5:846D9A8DE2927AB31C1A9DE2892EA8B9
SHA256:6A85DF7738F2A04BA9576A7690D1AD67D385D0F6957ADF16027B804F485EEF04
6312WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa6312.31131\DRIVER\HIDUSBF.INFbinary
MD5:8EAD6929CA01C948532FC16CEF6B8591
SHA256:9F98870BA3CBF2B992C848BC7447685B70C0A06D2DD31975CBD8CE3E8235E5A5
6312WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa6312.31131\DRIVER\AMD64\4khz-8khz\hidusbf.sysexecutable
MD5:DFE3AEEA9E6C889698FE12F5308C810F
SHA256:889241E792A3E58673EB98D4D1815C8073A6BCFA0ABC6C3AF060C5C6E7B94302
6312WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa6312.31131\DRIVER\98ME\hidusbf.sysexecutable
MD5:DAC9A10C24B1770031C1F29934853422
SHA256:B14D9D4946A70259038E9B284FD9E9423E95D2CC048D46665E090B4BFB5C73F5
6312WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa6312.31131\README.ENG.TXTtext
MD5:D898178CA79E34C5913E32CC64FC6E65
SHA256:7B959AF6B817FA0AF827126ADECBEC6F3060C67DCCFE9533AD51736B106314DB
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
8
TCP/UDP connections
33
DNS requests
20
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
6564
backgroundTaskHost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0%3D
unknown
—
—
whitelisted
7152
SIHClient.exe
GET
200
23.215.121.133:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
—
—
GET
200
2.16.164.97:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
7152
SIHClient.exe
GET
200
23.215.121.133:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
6564
backgroundTaskHost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAUZZSZEml49Gjh0j13P68w%3D
unknown
—
—
whitelisted
—
—
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAI5PUjXAkJafLQcAAsO18o%3D
unknown
—
—
whitelisted
—
—
GET
200
88.221.169.152:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
1176
svchost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
4712
MoUsoCoreWorker.exe
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4300
svchost.exe
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
—
—
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
—
—
2.16.164.97:80
crl.microsoft.com
Akamai International B.V.
NL
whitelisted
5064
SearchApp.exe
2.23.209.144:443
www.bing.com
Akamai International B.V.
GB
whitelisted
—
—
88.221.169.152:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
—
—
192.229.221.95:80
ocsp.digicert.com
EDGECAST
US
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
1176
svchost.exe
20.190.159.75:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 40.127.240.158
  • 51.104.136.2
  • 4.231.128.59
whitelisted
google.com
  • 142.250.186.110
whitelisted
crl.microsoft.com
  • 2.16.164.97
  • 2.16.164.49
whitelisted
www.bing.com
  • 2.23.209.144
  • 2.23.209.160
  • 2.23.209.161
  • 2.23.209.133
  • 2.23.209.150
  • 2.23.209.158
  • 2.23.209.141
  • 2.23.209.149
  • 2.23.209.156
whitelisted
www.microsoft.com
  • 88.221.169.152
  • 23.215.121.133
whitelisted
ocsp.digicert.com
  • 192.229.221.95
whitelisted
login.live.com
  • 20.190.159.75
  • 20.190.159.0
  • 20.190.159.4
  • 40.126.31.69
  • 20.190.159.73
  • 40.126.31.73
  • 20.190.159.2
  • 40.126.31.71
whitelisted
go.microsoft.com
  • 184.28.89.167
whitelisted
arc.msn.com
  • 20.199.58.43
whitelisted
fd.api.iris.microsoft.com
  • 20.223.35.26
whitelisted

Threats

No threats detected
Process
Message
sx64.exe
ReloadDevice - ENTER
sx64.exe
SetupDiCreateDeviceInfoList - OK (DeviceInstanceID = USB\VID_0627&PID_0001\28754-0000:00:04.7-1)
sx64.exe
USB Input Device
sx64.exe
ReloadDevice - OK
Interactive malware hunting service ANY.RUN
© 2017-2024 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
hidusbf.zip