analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
File name:

DriverPack-17-Online_1760402736.1664902656__p0ral00y94b3gbu.exe

Full analysis: https://app.any.run/tasks/addb1107-1f7b-4c8c-8ab2-57942b9a88a8
Verdict: Malicious activity
Analysis date: October 04, 2022, 21:50:46
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive
MD5:

A590A3B8EB80EFD0B8CE98BFE1F6F465

SHA1:

A1DB5703428E8BC6ECF3F0E425DB647375561F22

SHA256:

ED3E434362045111E48B9D30C9CB1DD21F58DC625B4CD862CF483ECC5A61DF33

SSDEEP:

196608:TRAwoqFBMTns8HJAiQqGkr3DRnDSuTJ6ZMW9j:TRAfA0ZJr53ZSuk

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Drops executable file immediately after starts

      • DriverPack-17-Online_1760402736.1664902656__p0ral00y94b3gbu.exe (PID: 1156)
      • csc.exe (PID: 984)

    • Loads dropped or rewritten executable

      • DriverPack-17-Online_1760402736.1664902656__p0ral00y94b3gbu.exe (PID: 1156)

    • Changes internet zones settings

      • mshta.exe (PID: 3364)

    • Changes settings of System certificates

      • mshta.exe (PID: 3364)

    • Executes PowerShell scripts

      • cmd.exe (PID: 1260)

    • Starts Visual C# compiler

      • powershell.exe (PID: 3720)

  • SUSPICIOUS

    • Checks supported languages

      • DriverPack-17-Online_1760402736.1664902656__p0ral00y94b3gbu.exe (PID: 1156)
      • cmd.exe (PID: 2956)
      • mshta.exe (PID: 3364)
      • cmd.exe (PID: 1260)
      • powershell.exe (PID: 3720)
      • cmd.exe (PID: 1784)
      • cvtres.exe (PID: 284)
      • csc.exe (PID: 984)
      • cmd.exe (PID: 2016)

    • Reads the computer name

      • DriverPack-17-Online_1760402736.1664902656__p0ral00y94b3gbu.exe (PID: 1156)
      • cmd.exe (PID: 2956)
      • mshta.exe (PID: 3364)
      • powershell.exe (PID: 3720)

    • Executable content was dropped or overwritten

      • DriverPack-17-Online_1760402736.1664902656__p0ral00y94b3gbu.exe (PID: 1156)
      • csc.exe (PID: 984)

    • Drops a file with a compile date too recent

      • DriverPack-17-Online_1760402736.1664902656__p0ral00y94b3gbu.exe (PID: 1156)
      • csc.exe (PID: 984)

    • Creates a software uninstall entry

      • DriverPack-17-Online_1760402736.1664902656__p0ral00y94b3gbu.exe (PID: 1156)

    • Starts CMD.EXE for commands execution

      • DriverPack-17-Online_1760402736.1664902656__p0ral00y94b3gbu.exe (PID: 1156)
      • mshta.exe (PID: 3364)

    • Creates a directory in Program Files

      • DriverPack-17-Online_1760402736.1664902656__p0ral00y94b3gbu.exe (PID: 1156)

    • Starts MSHTA.EXE for opening HTA or HTMLS files

      • cmd.exe (PID: 2956)

    • Reads Microsoft Outlook installation path

      • mshta.exe (PID: 3364)

    • Creates files in the user directory

      • mshta.exe (PID: 3364)
      • cmd.exe (PID: 1260)
      • cmd.exe (PID: 1784)
      • cmd.exe (PID: 2016)

    • Adds / modifies Windows certificates

      • mshta.exe (PID: 3364)

    • Uses RUNDLL32.EXE to load library

      • mshta.exe (PID: 3364)

    • Uses NETSH.EXE for network configuration

      • cmd.exe (PID: 1784)
      • cmd.exe (PID: 2016)

    • Creates files in the program directory

      • DriverPack-17-Online_1760402736.1664902656__p0ral00y94b3gbu.exe (PID: 1156)

    • Reads Environment values

      • netsh.exe (PID: 3340)
      • netsh.exe (PID: 4076)

  • INFO

    • Reads internet explorer settings

      • mshta.exe (PID: 3364)

    • Checks Windows Trust Settings

      • mshta.exe (PID: 3364)
      • powershell.exe (PID: 3720)

    • Reads settings of System Certificates

      • mshta.exe (PID: 3364)

    • Checks supported languages

      • rundll32.exe (PID: 272)
      • netsh.exe (PID: 3340)
      • netsh.exe (PID: 4076)

    • Reads the computer name

      • netsh.exe (PID: 3340)
      • netsh.exe (PID: 4076)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win32 Executable MS Visual C++ (generic) (67.4)
.dll | Win32 Dynamic Link Library (generic) (14.2)
.exe | Win32 Executable (generic) (9.7)
.exe | Generic Win/DOS Executable (4.3)
.exe | DOS Executable Generic (4.3)

Summary

Architecture: IMAGE_FILE_MACHINE_I386
Subsystem: IMAGE_SUBSYSTEM_WINDOWS_GUI
Compilation Date: 2021-Sep-25 21:56:47
Detected languages:
  • English - United States

DOS Header

e_magic: MZ
e_cblp: 144
e_cp: 3
e_crlc: -
e_cparhdr: 4
e_minalloc: -
e_maxalloc: 65535
e_ss: -
e_sp: 184
e_csum: -
e_ip: -
e_cs: -
e_ovno: -
e_oemid: -
e_oeminfo: -
e_lfanew: 216

PE Headers

Signature: PE
Machine: IMAGE_FILE_MACHINE_I386
NumberofSections: 5
TimeDateStamp: 2021-Sep-25 21:56:47
PointerToSymbolTable: -
NumberOfSymbols: -
SizeOfOptionalHeader: 224
Characteristics:
  • IMAGE_FILE_32BIT_MACHINE
  • IMAGE_FILE_EXECUTABLE_IMAGE
  • IMAGE_FILE_LINE_NUMS_STRIPPED
  • IMAGE_FILE_LOCAL_SYMS_STRIPPED
  • IMAGE_FILE_RELOCS_STRIPPED

Sections

Name
Virtual Address
Virtual Size
Raw Size
Charateristics
Entropy
.text
4096
26230
26624
IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
6.41746
.rdata
32768
5018
5120
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
5.14107
.data
40960
131960
1536
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
4.11058
.ndata
176128
73728
0
IMAGE_SCN_CNT_UNINITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc
249856
156720
157184
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
3.97681

Resources

Title
Entropy
Size
Codepage
Language
Type
1
3.26647
67624
UNKNOWN
English - United States
RT_ICON
2
2.62561
38056
UNKNOWN
English - United States
RT_ICON
3
3.61635
16936
UNKNOWN
English - United States
RT_ICON
4
3.35698
9640
UNKNOWN
English - United States
RT_ICON
5
3.21738
4264
UNKNOWN
English - United States
RT_ICON
6
3.8607
2440
UNKNOWN
English - United States
RT_ICON
7
4.69763
1128
UNKNOWN
English - United States
RT_ICON
103
2.56193
288
UNKNOWN
English - United States
RT_DIALOG
105
2.67385
512
UNKNOWN
English - United States
RT_DIALOG
106
2.91148
248
UNKNOWN
English - United States
RT_DIALOG

Imports

ADVAPI32.dll
COMCTL32.dll
GDI32.dll
KERNEL32.dll
SHELL32.dll
USER32.dll
ole32.dll
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
56
Monitored processes
13
Malicious processes
5
Suspicious processes
0

Behavior graph

Click at the process to see the details
start driverpack-17-online_1760402736.1664902656__p0ral00y94b3gbu.exe no specs driverpack-17-online_1760402736.1664902656__p0ral00y94b3gbu.exe cmd.exe no specs mshta.exe cmd.exe no specs powershell.exe no specs cmd.exe no specs rundll32.exe no specs netsh.exe no specs csc.exe cvtres.exe no specs cmd.exe no specs netsh.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
3428"C:\Users\admin\AppData\Local\Temp\DriverPack-17-Online_1760402736.1664902656__p0ral00y94b3gbu.exe" C:\Users\admin\AppData\Local\Temp\DriverPack-17-Online_1760402736.1664902656__p0ral00y94b3gbu.exe—Explorer.EXE
User:
admin
Integrity Level:
MEDIUM
Exit code:
3221226540
Modules
Images
c:\windows\system32\ntdll.dll
c:\users\admin\appdata\local\temp\driverpack-17-online_1760402736.1664902656__p0ral00y94b3gbu.exe
1156"C:\Users\admin\AppData\Local\Temp\DriverPack-17-Online_1760402736.1664902656__p0ral00y94b3gbu.exe" C:\Users\admin\AppData\Local\Temp\DriverPack-17-Online_1760402736.1664902656__p0ral00y94b3gbu.exe
Explorer.EXE
User:
admin
Integrity Level:
HIGH
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\driverpack-17-online_1760402736.1664902656__p0ral00y94b3gbu.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\shell32.dll
c:\windows\system32\shlwapi.dll
2956C:\Windows\system32\cmd.exe /c ""C:\Program Files\DriverPack\start.bat" "DriverPack-17-Online_1760402736.1664902656__p0ral00y94b3gbu.exe""C:\Windows\system32\cmd.exe—DriverPack-17-Online_1760402736.1664902656__p0ral00y94b3gbu.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\winbrand.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\usp10.dll
c:\windows\system32\lpk.dll
3364"C:\Windows\System32\mshta.exe" "C:\Program Files\DriverPack\run.hta" --sfx "DriverPack-17-Online_1760402736.1664902656__p0ral00y94b3gbu.exe"C:\Windows\System32\mshta.exe
cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Microsoft (R) HTML Application host
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
Modules
Images
c:\windows\system32\mshta.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\api-ms-win-downlevel-version-l1-1-0.dll
c:\windows\system32\iertutil.dll
1260"C:\Windows\System32\cmd.exe" /C powershell -NonInteractive -NoLogo -NoProfile -ExecutionPolicy Bypass "Get-Content 'C:\Users\admin\AppData\Roaming\DRPSu\temp\ps.l8uqjtrt.smwkl.cmd.txt' -Wait | Invoke-Expression" > "C:\Users\admin\AppData\Roaming\DRPSu\temp\ps.l8uqjtrt.smwkl.stdout.log" 2> "C:\Users\admin\AppData\Roaming\DRPSu\temp\ps.l8uqjtrt.smwkl.stderr.log"C:\Windows\System32\cmd.exe—mshta.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Command Processor
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\winbrand.dll
c:\windows\system32\usp10.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
3720powershell -NonInteractive -NoLogo -NoProfile -ExecutionPolicy Bypass "Get-Content 'C:\Users\admin\AppData\Roaming\DRPSu\temp\ps.l8uqjtrt.smwkl.cmd.txt' -Wait | Invoke-Expression" C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows PowerShell
Version:
10.0.14409.1005 (rs1_srvoob.161208-1155)
Modules
Images
c:\windows\system32\windowspowershell\v1.0\powershell.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\atl.dll
c:\windows\system32\user32.dll
1784"C:\Windows\System32\cmd.exe" /c "netsh advfirewall firewall delete rule name="DriverPack aria2c.exe" || echo Done & call echo Done %^errorLevel% > "C:\Users\admin\AppData\Roaming\DRPSu\temp\run_command_94681.txt""C:\Windows\System32\cmd.exe—mshta.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\ntdll.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\winbrand.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
272rundll32 kernel32,SleepC:\Windows\System32\rundll32.exe—mshta.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows host process (Rundll32)
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\rundll32.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\imagehlp.dll
c:\windows\system32\sechost.dll
3340netsh advfirewall firewall delete rule name="DriverPack aria2c.exe" C:\Windows\system32\netsh.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Network Command Shell
Exit code:
1
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\netsh.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\credui.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\gdi32.dll
984"C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\admin\AppData\Local\Temp\mxcdmzss.cmdline"C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
powershell.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Visual C# Command Line Compiler
Exit code:
0
Version:
4.0.30319.34209 built by: FX452RTMGDR
Modules
Images
c:\windows\microsoft.net\framework\v4.0.30319\csc.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\ole32.dll
c:\windows\system32\msvcr120_clr0400.dll
Total events
11 744
Read events
11 549
Write events
195
Delete events
0

Modification events

(PID) Process:(1156) DriverPack-17-Online_1760402736.1664902656__p0ral00y94b3gbu.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\drp.su\update
Operation:writeName:http
Value:
1
(PID) Process:(1156) DriverPack-17-Online_1760402736.1664902656__p0ral00y94b3gbu.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\drp.su\update
Operation:writeName:https
Value:
1
(PID) Process:(1156) DriverPack-17-Online_1760402736.1664902656__p0ral00y94b3gbu.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings
Operation:writeName:GlobalUserOffline
Value:
0
(PID) Process:(1156) DriverPack-17-Online_1760402736.1664902656__p0ral00y94b3gbu.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\DriverPack
Operation:writeName:DisplayName
Value:
DriverPack
(PID) Process:(1156) DriverPack-17-Online_1760402736.1664902656__p0ral00y94b3gbu.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\DriverPack
Operation:writeName:DisplayVersion
Value:
17.11
(PID) Process:(1156) DriverPack-17-Online_1760402736.1664902656__p0ral00y94b3gbu.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\DriverPack
Operation:writeName:DisplayIcon
Value:
"C:\Program Files\DriverPack\Tools\Icon.ico"
(PID) Process:(1156) DriverPack-17-Online_1760402736.1664902656__p0ral00y94b3gbu.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\DriverPack
Operation:writeName:UninstallString
Value:
"C:\Program Files\DriverPack\Uninstall.exe"
(PID) Process:(1156) DriverPack-17-Online_1760402736.1664902656__p0ral00y94b3gbu.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\DriverPack
Operation:writeName:Publisher
Value:
DriverPack
(PID) Process:(1156) DriverPack-17-Online_1760402736.1664902656__p0ral00y94b3gbu.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\DriverPack
Operation:writeName:NoModify
Value:
1
(PID) Process:(1156) DriverPack-17-Online_1760402736.1664902656__p0ral00y94b3gbu.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\DriverPack
Operation:writeName:NoRepair
Value:
1
Executable files
10
Suspicious files
15
Text files
504
Unknown types
44

Dropped files

PID
Process
Filename
Type
1156DriverPack-17-Online_1760402736.1664902656__p0ral00y94b3gbu.exeC:\Program Files\DriverPack\drp.csstext
MD5:5FDAF0FD106200153F8243EBB8BC6B18
SHA256:439BFD8BF9F9176C1757BA277850525F0ABEC59BB3EF7CD8A974A5AD1D2B3004
1156DriverPack-17-Online_1760402736.1664902656__p0ral00y94b3gbu.exeC:\Users\admin\AppData\Local\Temp\nszBA79.tmp\modern-wizard.bmpimage
MD5:2ADD351A8600764028D38F3A1B0D34F8
SHA256:65844F7B35D63C3F805324FCA880831BA7086B6BBEA00CE1E29C38D46B67F7E5
1156DriverPack-17-Online_1760402736.1664902656__p0ral00y94b3gbu.exeC:\Program Files\DriverPack\start.battext
MD5:F66F13D4770EB90E6D81222FE3525A3F
SHA256:88EBE6FC9F45E734243DD674A3CDD9222BE692BDE089D0BC06726DD32156B892
1156DriverPack-17-Online_1760402736.1664902656__p0ral00y94b3gbu.exeC:\Program Files\DriverPack\css\icons-checkbox.csstext
MD5:3BE98220035017D9B818F3CC94F87587
SHA256:CB134DCB95A407795C671A512C389894D3525FBA3F6A2168FC5B9B7E875E78DC
1156DriverPack-17-Online_1760402736.1664902656__p0ral00y94b3gbu.exeC:\Program Files\DriverPack\Tools\load8.gifimage
MD5:8A061EF740FA2801AB4BF78CB123D9BE
SHA256:EE0CC89EF293B559B64FCB35B469DCB144180FF048B0B6EB14F326847A544903
1156DriverPack-17-Online_1760402736.1664902656__p0ral00y94b3gbu.exeC:\Users\admin\AppData\Local\Temp\nszBA79.tmp\InstallOptions.dllexecutable
MD5:ECE25721125D55AA26CDFE019C871476
SHA256:C7FEF6457989D97FECC0616A69947927DA9D8C493F7905DC8475C748F044F3CF
1156DriverPack-17-Online_1760402736.1664902656__p0ral00y94b3gbu.exeC:\Program Files\DriverPack\config.jstext
MD5:31009D2EFB710925BF7F308AF59C629B
SHA256:18F86EF3FAD86C97D56274E5577B178A77F40587A80451A971013248E37190A6
1156DriverPack-17-Online_1760402736.1664902656__p0ral00y94b3gbu.exeC:\Program Files\DriverPack\DriverPackSolution.htmlhtml
MD5:203AC1542D8E93EDBBC80F7B59DB5C44
SHA256:8892E63141854BCF4BB1452ABEF68DD2C348C59322D697EF11A7AB7C5E3C4AEA
1156DriverPack-17-Online_1760402736.1664902656__p0ral00y94b3gbu.exeC:\Program Files\DriverPack\Tools\Icon.icoimage
MD5:CBD76182149BBA7EB76EC535DA43DB7F
SHA256:8707AE608F38AFD9ADE700BBDCA79344A4F50EAFC9EA3592B1E9FD6B616A6314
1156DriverPack-17-Online_1760402736.1664902656__p0ral00y94b3gbu.exeC:\Program Files\DriverPack\run.htahtml
MD5:6BCAB16CD99663B1093D10F827CA0323
SHA256:02BD627D6825599ED039F053FECBE7F15000B5D5071E9B6BAAB488BEFA4F02DD
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
23
TCP/UDP connections
21
DNS requests
13
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
3364
mshta.exe
GET
301
188.114.97.3:80
http://allfont.ru/allfont.css?fonts=lucida-console
US
—
—
whitelisted
3364
mshta.exe
GET
301
188.114.97.3:80
http://allfont.ru/cache/css/lucida-console.css
US
—
—
whitelisted
3364
mshta.exe
GET
200
2.16.107.114:80
http://e1.o.lencr.org/MFMwUTBPME0wSzAJBgUrDgMCGgUABBTvkAFw3ViPKmUeIVEf3NC7b1ErqwQUWvPtK%2Fw2wjd5uVIw6lRvz1XLLqwCEgTfAZP0%2B0D1blFnYCV3UIVwNA%3D%3D
unknown
der
346 b
whitelisted
3364
mshta.exe
GET
200
82.145.55.146:80
http://update.drp.su/
GB
html
141 b
malicious
3364
mshta.exe
GET
200
8.253.95.249:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab?413e39a5b4a3c95f
US
compressed
60.9 Kb
whitelisted
3364
mshta.exe
GET
200
8.253.95.249:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?4771109c9b66a9fa
US
compressed
4.70 Kb
whitelisted
3364
mshta.exe
GET
200
104.18.21.226:80
http://ocsp2.globalsign.com/rootr5/ME4wTDBKMEgwRjAJBgUrDgMCGgUABBQiD0S5cIHyfrLTJ1fvAkJWflH%2B2QQUPeYpSJvqB8ohREom3m7e0oPQn1kCDQHuXyKVQkkF%2BQGRqNw%3D
US
der
1.26 Kb
whitelisted
3364
mshta.exe
GET
200
104.18.21.226:80
http://ocsp.globalsign.com/rootr1/MFEwTzBNMEswSTAJBgUrDgMCGgUABBS3V7W2nAf4FiMTjpDJKg6%2BMgGqMQQUYHtmGkUNl8qJUC99BM00qP%2F8%2FUsCEHUeP1PjGFkz6V8I7O6tApc%3D
US
der
1.41 Kb
whitelisted
3364
mshta.exe
GET
200
142.250.187.110:80
http://www.google-analytics.com/collect?v=1&ds=hta&tid=UA-68879973-23&cid=1760402736.1664902656&t=event&ec=driverpack%20online&ea=yandex%20patcher%20browser%20not%20detected&el=17.11.108%20online&ul=&z=2530251373215409&sc=start&cd1=1760402736.1664902656&cd2=17.11.108%20Online&cd3=7%20x86&cd4=SP%201&cd5=Windows%207%20Professional%20&cd6=(not%20set)
US
image
35 b
whitelisted
3364
mshta.exe
GET
200
23.45.105.185:80
http://x1.c.lencr.org/
NL
der
717 b
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
3364
mshta.exe
188.114.97.3:80
allfont.ru
CLOUDFLARENET
NL
malicious
3364
mshta.exe
8.253.95.249:80
ctldl.windowsupdate.com
LEVEL3
US
suspicious
3364
mshta.exe
2.16.107.114:80
e1.o.lencr.org
Akamai International B.V.
DE
suspicious
3364
mshta.exe
23.45.105.185:80
x1.c.lencr.org
AKAMAI-AS
DE
unknown
3364
mshta.exe
178.162.204.5:80
auth.drp.su
Leaseweb Deutschland GmbH
DE
suspicious
3364
mshta.exe
188.114.97.3:443
allfont.ru
CLOUDFLARENET
NL
malicious
3364
mshta.exe
82.145.55.146:80
update.drp.su
Iomart Cloud Services Limited
GB
malicious
3364
mshta.exe
104.18.21.226:80
ocsp.globalsign.com
CLOUDFLARENET
—
shared
3364
mshta.exe
77.88.21.119:443
mc.yandex.ru
YANDEX LLC
RU
whitelisted
3364
mshta.exe
142.250.187.110:80
www.google-analytics.com
GOOGLE
US
whitelisted

DNS requests

Domain
IP
Reputation
allfont.ru
  • 188.114.97.3
  • 188.114.96.3
whitelisted
ctldl.windowsupdate.com
  • 8.253.95.249
  • 8.241.121.254
  • 8.253.204.120
  • 67.27.233.254
  • 8.241.9.254
whitelisted
x1.c.lencr.org
  • 23.45.105.185
whitelisted
x2.c.lencr.org
  • 23.45.105.185
whitelisted
e1.o.lencr.org
  • 2.16.107.114
  • 2.16.107.43
  • 2.16.107.99
whitelisted
auth.drp.su
  • 178.162.204.5
suspicious
mc.yandex.ru
  • 77.88.21.119
  • 87.250.250.119
  • 93.158.134.119
  • 87.250.251.119
whitelisted
update.drp.su
  • 82.145.55.146
  • 37.9.8.75
  • 178.162.207.42
  • 46.161.36.165
malicious
www.google-analytics.com
  • 142.250.187.110
whitelisted
ocsp.globalsign.com
  • 104.18.21.226
  • 104.18.20.226
whitelisted

Threats

PID
Process
Class
Message
—
—
A Network Trojan was detected
ET MALWARE Observed DNS Query to DriverPack Domain ( .drp .su)
—
—
Potentially Bad Traffic
ET DNS Query for .su TLD (Soviet Union) Often Malware Related
—
—
Potentially Bad Traffic
ET MALWARE DriverPack Domain in DNS Query
—
—
A Network Trojan was detected
ET MALWARE Observed DNS Query to DriverPack Domain ( .drp .su)
—
—
Potentially Bad Traffic
ET DNS Query for .su TLD (Soviet Union) Often Malware Related
—
—
Potentially Bad Traffic
ET MALWARE DriverPack Domain in DNS Query
3364
mshta.exe
Potentially Bad Traffic
ET POLICY HTTP Request to .su TLD (Soviet Union) Often Malware Related
3364
mshta.exe
Potentially Bad Traffic
ET POLICY HTTP Request to .su TLD (Soviet Union) Often Malware Related
3364
mshta.exe
Potentially Bad Traffic
ET POLICY HTTP Request to .su TLD (Soviet Union) Often Malware Related
—
—
A Network Trojan was detected
ET MALWARE Observed DNS Query to DriverPack Domain ( .drp .su)
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2024 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
DriverPack-17-Online_1760402736.1664902656__p0ral00y94b3gbu.exe