File name:

DriverPack-17-Online_1760402736.1664902656__p0ral00y94b3gbu.exe

Full analysis: https://app.any.run/tasks/addb1107-1f7b-4c8c-8ab2-57942b9a88a8
Verdict: Malicious activity
Analysis date: October 04, 2022, 21:50:46
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive
MD5:

A590A3B8EB80EFD0B8CE98BFE1F6F465

SHA1:

A1DB5703428E8BC6ECF3F0E425DB647375561F22

SHA256:

ED3E434362045111E48B9D30C9CB1DD21F58DC625B4CD862CF483ECC5A61DF33

SSDEEP:

196608:TRAwoqFBMTns8HJAiQqGkr3DRnDSuTJ6ZMW9j:TRAfA0ZJr53ZSuk

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Drops executable file immediately after starts

      • DriverPack-17-Online_1760402736.1664902656__p0ral00y94b3gbu.exe (PID: 1156)
      • csc.exe (PID: 984)

    • Loads dropped or rewritten executable

      • DriverPack-17-Online_1760402736.1664902656__p0ral00y94b3gbu.exe (PID: 1156)

    • Changes settings of System certificates

      • mshta.exe (PID: 3364)

    • Changes internet zones settings

      • mshta.exe (PID: 3364)

    • Executes PowerShell scripts

      • cmd.exe (PID: 1260)

    • Starts Visual C# compiler

      • powershell.exe (PID: 3720)

  • SUSPICIOUS

    • Reads the computer name

      • DriverPack-17-Online_1760402736.1664902656__p0ral00y94b3gbu.exe (PID: 1156)
      • cmd.exe (PID: 2956)
      • mshta.exe (PID: 3364)
      • powershell.exe (PID: 3720)

    • Executable content was dropped or overwritten

      • DriverPack-17-Online_1760402736.1664902656__p0ral00y94b3gbu.exe (PID: 1156)
      • csc.exe (PID: 984)

    • Drops a file with a compile date too recent

      • DriverPack-17-Online_1760402736.1664902656__p0ral00y94b3gbu.exe (PID: 1156)
      • csc.exe (PID: 984)

    • Creates a directory in Program Files

      • DriverPack-17-Online_1760402736.1664902656__p0ral00y94b3gbu.exe (PID: 1156)

    • Starts CMD.EXE for commands execution

      • DriverPack-17-Online_1760402736.1664902656__p0ral00y94b3gbu.exe (PID: 1156)
      • mshta.exe (PID: 3364)

    • Creates a software uninstall entry

      • DriverPack-17-Online_1760402736.1664902656__p0ral00y94b3gbu.exe (PID: 1156)

    • Reads Microsoft Outlook installation path

      • mshta.exe (PID: 3364)

    • Checks supported languages

      • DriverPack-17-Online_1760402736.1664902656__p0ral00y94b3gbu.exe (PID: 1156)
      • cmd.exe (PID: 2956)
      • mshta.exe (PID: 3364)
      • powershell.exe (PID: 3720)
      • cmd.exe (PID: 1784)
      • csc.exe (PID: 984)
      • cvtres.exe (PID: 284)
      • cmd.exe (PID: 2016)
      • cmd.exe (PID: 1260)

    • Starts MSHTA.EXE for opening HTA or HTMLS files

      • cmd.exe (PID: 2956)

    • Creates files in the user directory

      • cmd.exe (PID: 1260)
      • mshta.exe (PID: 3364)
      • cmd.exe (PID: 1784)
      • cmd.exe (PID: 2016)

    • Uses RUNDLL32.EXE to load library

      • mshta.exe (PID: 3364)

    • Reads Environment values

      • netsh.exe (PID: 3340)
      • netsh.exe (PID: 4076)

    • Adds / modifies Windows certificates

      • mshta.exe (PID: 3364)

    • Uses NETSH.EXE for network configuration

      • cmd.exe (PID: 1784)
      • cmd.exe (PID: 2016)

    • Creates files in the program directory

      • DriverPack-17-Online_1760402736.1664902656__p0ral00y94b3gbu.exe (PID: 1156)

  • INFO

    • Reads internet explorer settings

      • mshta.exe (PID: 3364)

    • Reads settings of System Certificates

      • mshta.exe (PID: 3364)

    • Reads the computer name

      • netsh.exe (PID: 3340)
      • netsh.exe (PID: 4076)

    • Checks Windows Trust Settings

      • mshta.exe (PID: 3364)
      • powershell.exe (PID: 3720)

    • Checks supported languages

      • rundll32.exe (PID: 272)
      • netsh.exe (PID: 3340)
      • netsh.exe (PID: 4076)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win32 Executable MS Visual C++ (generic) (67.4)
.dll | Win32 Dynamic Link Library (generic) (14.2)
.exe | Win32 Executable (generic) (9.7)
.exe | Generic Win/DOS Executable (4.3)
.exe | DOS Executable Generic (4.3)

Summary

Architecture: IMAGE_FILE_MACHINE_I386
Subsystem: IMAGE_SUBSYSTEM_WINDOWS_GUI
Compilation Date: 2021-Sep-25 21:56:47
Detected languages:
  • English - United States

DOS Header

e_magic: MZ
e_cblp: 144
e_cp: 3
e_crlc: -
e_cparhdr: 4
e_minalloc: -
e_maxalloc: 65535
e_ss: -
e_sp: 184
e_csum: -
e_ip: -
e_cs: -
e_ovno: -
e_oemid: -
e_oeminfo: -
e_lfanew: 216

PE Headers

Signature: PE
Machine: IMAGE_FILE_MACHINE_I386
NumberofSections: 5
TimeDateStamp: 2021-Sep-25 21:56:47
PointerToSymbolTable: -
NumberOfSymbols: -
SizeOfOptionalHeader: 224
Characteristics:
  • IMAGE_FILE_32BIT_MACHINE
  • IMAGE_FILE_EXECUTABLE_IMAGE
  • IMAGE_FILE_LINE_NUMS_STRIPPED
  • IMAGE_FILE_LOCAL_SYMS_STRIPPED
  • IMAGE_FILE_RELOCS_STRIPPED

Sections

Name
Virtual Address
Virtual Size
Raw Size
Charateristics
Entropy
.text
4096
26230
26624
IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
6.41746
.rdata
32768
5018
5120
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
5.14107
.data
40960
131960
1536
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
4.11058
.ndata
176128
73728
0
IMAGE_SCN_CNT_UNINITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc
249856
156720
157184
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
3.97681

Resources

Title
Entropy
Size
Codepage
Language
Type
1
3.26647
67624
UNKNOWN
English - United States
RT_ICON
2
2.62561
38056
UNKNOWN
English - United States
RT_ICON
3
3.61635
16936
UNKNOWN
English - United States
RT_ICON
4
3.35698
9640
UNKNOWN
English - United States
RT_ICON
5
3.21738
4264
UNKNOWN
English - United States
RT_ICON
6
3.8607
2440
UNKNOWN
English - United States
RT_ICON
7
4.69763
1128
UNKNOWN
English - United States
RT_ICON
103
2.56193
288
UNKNOWN
English - United States
RT_DIALOG
105
2.67385
512
UNKNOWN
English - United States
RT_DIALOG
106
2.91148
248
UNKNOWN
English - United States
RT_DIALOG

Imports

ADVAPI32.dll
COMCTL32.dll
GDI32.dll
KERNEL32.dll
SHELL32.dll
USER32.dll
ole32.dll
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
56
Monitored processes
13
Malicious processes
5
Suspicious processes
0

Behavior graph

Click at the process to see the details
start driverpack-17-online_1760402736.1664902656__p0ral00y94b3gbu.exe cmd.exe no specs mshta.exe cmd.exe no specs powershell.exe no specs cmd.exe no specs rundll32.exe no specs netsh.exe no specs csc.exe cvtres.exe no specs cmd.exe no specs netsh.exe no specs driverpack-17-online_1760402736.1664902656__p0ral00y94b3gbu.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
272rundll32 kernel32,SleepC:\Windows\System32\rundll32.exe—mshta.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows host process (Rundll32)
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\rundll32.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\imagehlp.dll
c:\windows\system32\sechost.dll
284C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\admin\AppData\Local\Temp\RES1940.tmp" "c:\Users\admin\AppData\Local\Temp\CSC46447871E8CD4B3DAEA6F8377766E93.TMP"C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe—csc.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Microsoft® Resource File To COFF Object Conversion Utility
Exit code:
0
Version:
12.00.51209.34209 built by: FX452RTMGDR
Modules
Images
c:\windows\microsoft.net\framework\v4.0.30319\cvtres.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\msvcr120_clr0400.dll
c:\windows\system32\cryptsp.dll
984"C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\admin\AppData\Local\Temp\mxcdmzss.cmdline"C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
powershell.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Visual C# Command Line Compiler
Exit code:
0
Version:
4.0.30319.34209 built by: FX452RTMGDR
Modules
Images
c:\windows\microsoft.net\framework\v4.0.30319\csc.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\ole32.dll
c:\windows\system32\msvcr120_clr0400.dll
1156"C:\Users\admin\AppData\Local\Temp\DriverPack-17-Online_1760402736.1664902656__p0ral00y94b3gbu.exe" C:\Users\admin\AppData\Local\Temp\DriverPack-17-Online_1760402736.1664902656__p0ral00y94b3gbu.exe
Explorer.EXE
User:
admin
Integrity Level:
HIGH
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\driverpack-17-online_1760402736.1664902656__p0ral00y94b3gbu.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\shell32.dll
c:\windows\system32\shlwapi.dll
1260"C:\Windows\System32\cmd.exe" /C powershell -NonInteractive -NoLogo -NoProfile -ExecutionPolicy Bypass "Get-Content 'C:\Users\admin\AppData\Roaming\DRPSu\temp\ps.l8uqjtrt.smwkl.cmd.txt' -Wait | Invoke-Expression" > "C:\Users\admin\AppData\Roaming\DRPSu\temp\ps.l8uqjtrt.smwkl.stdout.log" 2> "C:\Users\admin\AppData\Roaming\DRPSu\temp\ps.l8uqjtrt.smwkl.stderr.log"C:\Windows\System32\cmd.exe—mshta.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\winbrand.dll
c:\windows\system32\usp10.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
1784"C:\Windows\System32\cmd.exe" /c "netsh advfirewall firewall delete rule name="DriverPack aria2c.exe" || echo Done & call echo Done %^errorLevel% > "C:\Users\admin\AppData\Roaming\DRPSu\temp\run_command_94681.txt""C:\Windows\System32\cmd.exe—mshta.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\ntdll.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\winbrand.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
2016"C:\Windows\System32\cmd.exe" /c "netsh advfirewall firewall add rule name="DriverPack aria2c.exe" dir=in action=allow program="C:\Program Files\DriverPack\tools\aria2c.exe" || echo Done & call echo Done %^errorLevel% > "C:\Users\admin\AppData\Roaming\DRPSu\temp\run_command_2515.txt""C:\Windows\System32\cmd.exe—mshta.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\winbrand.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
2956C:\Windows\system32\cmd.exe /c ""C:\Program Files\DriverPack\start.bat" "DriverPack-17-Online_1760402736.1664902656__p0ral00y94b3gbu.exe""C:\Windows\system32\cmd.exe—DriverPack-17-Online_1760402736.1664902656__p0ral00y94b3gbu.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\winbrand.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\usp10.dll
c:\windows\system32\lpk.dll
3340netsh advfirewall firewall delete rule name="DriverPack aria2c.exe" C:\Windows\system32\netsh.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Network Command Shell
Exit code:
1
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\netsh.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\credui.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\gdi32.dll
3364"C:\Windows\System32\mshta.exe" "C:\Program Files\DriverPack\run.hta" --sfx "DriverPack-17-Online_1760402736.1664902656__p0ral00y94b3gbu.exe"C:\Windows\System32\mshta.exe
cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Microsoft (R) HTML Application host
Exit code:
0
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
Modules
Images
c:\windows\system32\mshta.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\api-ms-win-downlevel-version-l1-1-0.dll
c:\windows\system32\iertutil.dll
Total events
11 744
Read events
11 549
Write events
195
Delete events
0

Modification events

(PID) Process:(1156) DriverPack-17-Online_1760402736.1664902656__p0ral00y94b3gbu.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\drp.su\update
Operation:writeName:http
Value:
1
(PID) Process:(1156) DriverPack-17-Online_1760402736.1664902656__p0ral00y94b3gbu.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\drp.su\update
Operation:writeName:https
Value:
1
(PID) Process:(1156) DriverPack-17-Online_1760402736.1664902656__p0ral00y94b3gbu.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings
Operation:writeName:GlobalUserOffline
Value:
0
(PID) Process:(1156) DriverPack-17-Online_1760402736.1664902656__p0ral00y94b3gbu.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\DriverPack
Operation:writeName:DisplayName
Value:
DriverPack
(PID) Process:(1156) DriverPack-17-Online_1760402736.1664902656__p0ral00y94b3gbu.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\DriverPack
Operation:writeName:DisplayVersion
Value:
17.11
(PID) Process:(1156) DriverPack-17-Online_1760402736.1664902656__p0ral00y94b3gbu.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\DriverPack
Operation:writeName:DisplayIcon
Value:
"C:\Program Files\DriverPack\Tools\Icon.ico"
(PID) Process:(1156) DriverPack-17-Online_1760402736.1664902656__p0ral00y94b3gbu.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\DriverPack
Operation:writeName:UninstallString
Value:
"C:\Program Files\DriverPack\Uninstall.exe"
(PID) Process:(1156) DriverPack-17-Online_1760402736.1664902656__p0ral00y94b3gbu.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\DriverPack
Operation:writeName:Publisher
Value:
DriverPack
(PID) Process:(1156) DriverPack-17-Online_1760402736.1664902656__p0ral00y94b3gbu.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\DriverPack
Operation:writeName:NoModify
Value:
1
(PID) Process:(1156) DriverPack-17-Online_1760402736.1664902656__p0ral00y94b3gbu.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\DriverPack
Operation:writeName:NoRepair
Value:
1
Executable files
10
Suspicious files
15
Text files
504
Unknown types
44

Dropped files

PID
Process
Filename
Type
1156DriverPack-17-Online_1760402736.1664902656__p0ral00y94b3gbu.exeC:\Program Files\DriverPack\start.battext
MD5:F66F13D4770EB90E6D81222FE3525A3F
SHA256:88EBE6FC9F45E734243DD674A3CDD9222BE692BDE089D0BC06726DD32156B892
1156DriverPack-17-Online_1760402736.1664902656__p0ral00y94b3gbu.exeC:\Users\admin\AppData\Local\Temp\nszBA79.tmp\ioSpecial.iniini
MD5:E2D5070BC28DB1AC745613689FF86067
SHA256:D95AED234F932A1C48A2B1B0D98C60CA31F962310C03158E2884AB4DDD3EA1E0
1156DriverPack-17-Online_1760402736.1664902656__p0ral00y94b3gbu.exeC:\Program Files\DriverPack\config.jstext
MD5:31009D2EFB710925BF7F308AF59C629B
SHA256:18F86EF3FAD86C97D56274E5577B178A77F40587A80451A971013248E37190A6
1156DriverPack-17-Online_1760402736.1664902656__p0ral00y94b3gbu.exeC:\Program Files\DriverPack\css\blank.gifimage
MD5:56398E76BE6355AD5999B262208A17C9
SHA256:2F561B02A49376E3679ACD5975E3790ABDFF09ECBADFA1E1858C7BA26E3FFCEF
1156DriverPack-17-Online_1760402736.1664902656__p0ral00y94b3gbu.exeC:\Program Files\DriverPack\drp.jsbinary
MD5:0F62A60E249A6F77428CBA73EE22780B
SHA256:06643527422E7F6E3FC094F2314488CB8758BFF19F677499D27A4289EB15627E
1156DriverPack-17-Online_1760402736.1664902656__p0ral00y94b3gbu.exeC:\Program Files\DriverPack\DriverPackSolution.htmlhtml
MD5:203AC1542D8E93EDBBC80F7B59DB5C44
SHA256:8892E63141854BCF4BB1452ABEF68DD2C348C59322D697EF11A7AB7C5E3C4AEA
1156DriverPack-17-Online_1760402736.1664902656__p0ral00y94b3gbu.exeC:\Users\admin\AppData\Local\Temp\nszBA79.tmp\InstallOptions.dllexecutable
MD5:ECE25721125D55AA26CDFE019C871476
SHA256:C7FEF6457989D97FECC0616A69947927DA9D8C493F7905DC8475C748F044F3CF
1156DriverPack-17-Online_1760402736.1664902656__p0ral00y94b3gbu.exeC:\Program Files\DriverPack\Tools\driverpack-wget.exeexecutable
MD5:BD126A7B59D5D1F97BA89A3E71425731
SHA256:A48AD33695A44DE887BBA8F2F3174FD8FB01A46A19E3EC9078B0118647CCF599
1156DriverPack-17-Online_1760402736.1664902656__p0ral00y94b3gbu.exeC:\Program Files\DriverPack\run.htahtml
MD5:6BCAB16CD99663B1093D10F827CA0323
SHA256:02BD627D6825599ED039F053FECBE7F15000B5D5071E9B6BAAB488BEFA4F02DD
1156DriverPack-17-Online_1760402736.1664902656__p0ral00y94b3gbu.exeC:\Program Files\DriverPack\Tools\load8.gifimage
MD5:8A061EF740FA2801AB4BF78CB123D9BE
SHA256:EE0CC89EF293B559B64FCB35B469DCB144180FF048B0B6EB14F326847A544903
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
23
TCP/UDP connections
21
DNS requests
13
Threats
15

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
3364
mshta.exe
GET
301
188.114.97.3:80
http://allfont.ru/cache/css/lucida-console.css
US
—
—
whitelisted
3364
mshta.exe
GET
301
188.114.97.3:80
http://allfont.ru/allfont.css?fonts=lucida-console
US
—
—
whitelisted
3364
mshta.exe
GET
200
2.16.107.114:80
http://e1.o.lencr.org/MFMwUTBPME0wSzAJBgUrDgMCGgUABBTvkAFw3ViPKmUeIVEf3NC7b1ErqwQUWvPtK%2Fw2wjd5uVIw6lRvz1XLLqwCEgTfAZP0%2B0D1blFnYCV3UIVwNA%3D%3D
unknown
der
346 b
whitelisted
3364
mshta.exe
GET
200
104.18.21.226:80
http://ocsp2.globalsign.com/rootr5/ME4wTDBKMEgwRjAJBgUrDgMCGgUABBQiD0S5cIHyfrLTJ1fvAkJWflH%2B2QQUPeYpSJvqB8ohREom3m7e0oPQn1kCDQHuXyKVQkkF%2BQGRqNw%3D
US
der
1.26 Kb
whitelisted
3364
mshta.exe
GET
200
104.18.21.226:80
http://ocsp.globalsign.com/gseccovsslca2018/ME0wSzBJMEcwRTAJBgUrDgMCGgUABBSTMjK03nNiYoQYvu4Izyfn9OJNdAQUWHuOdSr%2BYYCqkEABrtboB0ZuP0gCDDr6WyPB2UqgqvyNjw%3D%3D
US
der
939 b
whitelisted
3364
mshta.exe
GET
200
104.18.21.226:80
http://ocsp.globalsign.com/rootr1/MFEwTzBNMEswSTAJBgUrDgMCGgUABBS3V7W2nAf4FiMTjpDJKg6%2BMgGqMQQUYHtmGkUNl8qJUC99BM00qP%2F8%2FUsCEHUeP1PjGFkz6V8I7O6tApc%3D
US
der
1.41 Kb
whitelisted
3364
mshta.exe
POST
401
178.162.204.5:80
http://auth.drp.su/api/session
DE
text
12 b
suspicious
3364
mshta.exe
GET
200
82.145.55.146:80
http://update.drp.su/
GB
html
141 b
malicious
3364
mshta.exe
GET
200
23.45.105.185:80
http://x2.c.lencr.org/
NL
der
300 b
whitelisted
3364
mshta.exe
GET
200
8.253.95.249:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?4771109c9b66a9fa
US
compressed
4.70 Kb
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
3364
mshta.exe
188.114.97.3:80
allfont.ru
CLOUDFLARENET
NL
malicious
3364
mshta.exe
188.114.97.3:443
allfont.ru
CLOUDFLARENET
NL
malicious
3364
mshta.exe
178.162.204.5:80
auth.drp.su
Leaseweb Deutschland GmbH
DE
suspicious
3364
mshta.exe
77.88.21.119:443
mc.yandex.ru
YANDEX LLC
RU
whitelisted
3364
mshta.exe
23.45.105.185:80
x1.c.lencr.org
AKAMAI-AS
DE
unknown
3364
mshta.exe
78.129.240.46:80
sentry.drp.su
Iomart Cloud Services Limited
GB
suspicious
3364
mshta.exe
82.145.55.146:80
update.drp.su
Iomart Cloud Services Limited
GB
malicious
3364
mshta.exe
104.18.21.226:80
ocsp.globalsign.com
CLOUDFLARENET
—
shared
3364
mshta.exe
8.253.95.249:80
ctldl.windowsupdate.com
LEVEL3
US
suspicious
3364
mshta.exe
2.16.107.114:80
e1.o.lencr.org
Akamai International B.V.
DE
suspicious

DNS requests

Domain
IP
Reputation
allfont.ru
  • 188.114.97.3
  • 188.114.96.3
whitelisted
ctldl.windowsupdate.com
  • 8.253.95.249
  • 8.241.121.254
  • 8.253.204.120
  • 67.27.233.254
  • 8.241.9.254
whitelisted
x1.c.lencr.org
  • 23.45.105.185
whitelisted
x2.c.lencr.org
  • 23.45.105.185
whitelisted
e1.o.lencr.org
  • 2.16.107.114
  • 2.16.107.43
  • 2.16.107.99
whitelisted
auth.drp.su
  • 178.162.204.5
suspicious
mc.yandex.ru
  • 77.88.21.119
  • 87.250.250.119
  • 93.158.134.119
  • 87.250.251.119
whitelisted
update.drp.su
  • 82.145.55.146
  • 37.9.8.75
  • 178.162.207.42
  • 46.161.36.165
malicious
www.google-analytics.com
  • 142.250.187.110
whitelisted
ocsp.globalsign.com
  • 104.18.21.226
  • 104.18.20.226
whitelisted

Threats

PID
Process
Class
Message
—
—
A Network Trojan was detected
ET MALWARE Observed DNS Query to DriverPack Domain ( .drp .su)
—
—
Potentially Bad Traffic
ET DNS Query for .su TLD (Soviet Union) Often Malware Related
—
—
Potentially Bad Traffic
ET MALWARE DriverPack Domain in DNS Query
—
—
A Network Trojan was detected
ET MALWARE Observed DNS Query to DriverPack Domain ( .drp .su)
—
—
Potentially Bad Traffic
ET DNS Query for .su TLD (Soviet Union) Often Malware Related
—
—
Potentially Bad Traffic
ET MALWARE DriverPack Domain in DNS Query
3364
mshta.exe
Potentially Bad Traffic
ET POLICY HTTP Request to .su TLD (Soviet Union) Often Malware Related
3364
mshta.exe
Potentially Bad Traffic
ET POLICY HTTP Request to .su TLD (Soviet Union) Often Malware Related
3364
mshta.exe
Potentially Bad Traffic
ET POLICY HTTP Request to .su TLD (Soviet Union) Often Malware Related
—
—
A Network Trojan was detected
ET MALWARE Observed DNS Query to DriverPack Domain ( .drp .su)
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
DriverPack-17-Online_1760402736.1664902656__p0ral00y94b3gbu.exe