analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
download:

DriverPack-17-Online.exe

Full analysis: https://app.any.run/tasks/b051e25f-cfab-46db-9512-b7379585e47f
Verdict: Malicious activity
Analysis date: October 04, 2022, 22:20:33
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive
MD5:

A590A3B8EB80EFD0B8CE98BFE1F6F465

SHA1:

A1DB5703428E8BC6ECF3F0E425DB647375561F22

SHA256:

ED3E434362045111E48B9D30C9CB1DD21F58DC625B4CD862CF483ECC5A61DF33

SSDEEP:

196608:TRAwoqFBMTns8HJAiQqGkr3DRnDSuTJ6ZMW9j:TRAfA0ZJr53ZSuk

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Drops executable file immediately after starts

      • DriverPack-17-Online.exe (PID: 2028)
      • csc.exe (PID: 2888)

    • Loads dropped or rewritten executable

      • DriverPack-17-Online.exe (PID: 2028)

    • Changes settings of System certificates

      • mshta.exe (PID: 2560)

    • Changes internet zones settings

      • mshta.exe (PID: 2560)

    • Executes PowerShell scripts

      • cmd.exe (PID: 1308)

    • Starts Visual C# compiler

      • powershell.exe (PID: 308)

  • SUSPICIOUS

    • Reads the computer name

      • DriverPack-17-Online.exe (PID: 2028)
      • mshta.exe (PID: 2560)
      • cmd.exe (PID: 2392)
      • powershell.exe (PID: 308)

    • Checks supported languages

      • DriverPack-17-Online.exe (PID: 2028)
      • cmd.exe (PID: 2392)
      • mshta.exe (PID: 2560)
      • powershell.exe (PID: 308)
      • cmd.exe (PID: 1308)
      • csc.exe (PID: 2888)
      • cvtres.exe (PID: 3152)
      • cmd.exe (PID: 700)

    • Executable content was dropped or overwritten

      • DriverPack-17-Online.exe (PID: 2028)
      • csc.exe (PID: 2888)

    • Drops a file with a compile date too recent

      • DriverPack-17-Online.exe (PID: 2028)
      • csc.exe (PID: 2888)

    • Starts CMD.EXE for commands execution

      • DriverPack-17-Online.exe (PID: 2028)
      • mshta.exe (PID: 2560)

    • Creates a software uninstall entry

      • DriverPack-17-Online.exe (PID: 2028)

    • Creates a directory in Program Files

      • DriverPack-17-Online.exe (PID: 2028)

    • Starts MSHTA.EXE for opening HTA or HTMLS files

      • cmd.exe (PID: 2392)

    • Reads Microsoft Outlook installation path

      • mshta.exe (PID: 2560)

    • Creates files in the user directory

      • cmd.exe (PID: 1308)
      • mshta.exe (PID: 2560)
      • cmd.exe (PID: 700)

    • Adds / modifies Windows certificates

      • mshta.exe (PID: 2560)

    • Uses RUNDLL32.EXE to load library

      • mshta.exe (PID: 2560)

    • Creates files in the program directory

      • DriverPack-17-Online.exe (PID: 2028)

    • Uses NETSH.EXE for network configuration

      • cmd.exe (PID: 700)

    • Reads Environment values

      • netsh.exe (PID: 3400)

  • INFO

    • Reads internet explorer settings

      • mshta.exe (PID: 2560)

    • Checks Windows Trust Settings

      • mshta.exe (PID: 2560)
      • powershell.exe (PID: 308)

    • Reads settings of System Certificates

      • mshta.exe (PID: 2560)

    • Checks supported languages

      • rundll32.exe (PID: 468)
      • netsh.exe (PID: 3400)

    • Reads the computer name

      • netsh.exe (PID: 3400)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win32 Executable MS Visual C++ (generic) (67.4)
.dll | Win32 Dynamic Link Library (generic) (14.2)
.exe | Win32 Executable (generic) (9.7)
.exe | Generic Win/DOS Executable (4.3)
.exe | DOS Executable Generic (4.3)

Summary

Architecture: IMAGE_FILE_MACHINE_I386
Subsystem: IMAGE_SUBSYSTEM_WINDOWS_GUI
Compilation Date: 2021-Sep-25 21:56:47
Detected languages:
  • English - United States

DOS Header

e_magic: MZ
e_cblp: 144
e_cp: 3
e_crlc: -
e_cparhdr: 4
e_minalloc: -
e_maxalloc: 65535
e_ss: -
e_sp: 184
e_csum: -
e_ip: -
e_cs: -
e_ovno: -
e_oemid: -
e_oeminfo: -
e_lfanew: 216

PE Headers

Signature: PE
Machine: IMAGE_FILE_MACHINE_I386
NumberofSections: 5
TimeDateStamp: 2021-Sep-25 21:56:47
PointerToSymbolTable: -
NumberOfSymbols: -
SizeOfOptionalHeader: 224
Characteristics:
  • IMAGE_FILE_32BIT_MACHINE
  • IMAGE_FILE_EXECUTABLE_IMAGE
  • IMAGE_FILE_LINE_NUMS_STRIPPED
  • IMAGE_FILE_LOCAL_SYMS_STRIPPED
  • IMAGE_FILE_RELOCS_STRIPPED

Sections

Name
Virtual Address
Virtual Size
Raw Size
Charateristics
Entropy
.text
4096
26230
26624
IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
6.41746
.rdata
32768
5018
5120
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
5.14107
.data
40960
131960
1536
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
4.11058
.ndata
176128
73728
0
IMAGE_SCN_CNT_UNINITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc
249856
156720
157184
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
3.97681

Resources

Title
Entropy
Size
Codepage
Language
Type
1
3.26647
67624
UNKNOWN
English - United States
RT_ICON
2
2.62561
38056
UNKNOWN
English - United States
RT_ICON
3
3.61635
16936
UNKNOWN
English - United States
RT_ICON
4
3.35698
9640
UNKNOWN
English - United States
RT_ICON
5
3.21738
4264
UNKNOWN
English - United States
RT_ICON
6
3.8607
2440
UNKNOWN
English - United States
RT_ICON
7
4.69763
1128
UNKNOWN
English - United States
RT_ICON
103
2.56193
288
UNKNOWN
English - United States
RT_DIALOG
105
2.67385
512
UNKNOWN
English - United States
RT_DIALOG
106
2.91148
248
UNKNOWN
English - United States
RT_DIALOG

Imports

ADVAPI32.dll
COMCTL32.dll
GDI32.dll
KERNEL32.dll
SHELL32.dll
USER32.dll
ole32.dll
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
52
Monitored processes
11
Malicious processes
5
Suspicious processes
0

Behavior graph

Click at the process to see the details
start driverpack-17-online.exe no specs driverpack-17-online.exe cmd.exe no specs mshta.exe cmd.exe no specs powershell.exe no specs rundll32.exe no specs csc.exe cvtres.exe no specs cmd.exe no specs netsh.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
3336"C:\Users\admin\AppData\Local\Temp\DriverPack-17-Online.exe" C:\Users\admin\AppData\Local\Temp\DriverPack-17-Online.exe—Explorer.EXE
User:
admin
Integrity Level:
MEDIUM
Exit code:
3221226540
Modules
Images
c:\users\admin\appdata\local\temp\driverpack-17-online.exe
c:\windows\system32\ntdll.dll
2028"C:\Users\admin\AppData\Local\Temp\DriverPack-17-Online.exe" C:\Users\admin\AppData\Local\Temp\DriverPack-17-Online.exe
Explorer.EXE
User:
admin
Integrity Level:
HIGH
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\driverpack-17-online.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\shell32.dll
c:\windows\system32\gdi32.dll
2392C:\Windows\system32\cmd.exe /c ""C:\Program Files\DriverPack\start.bat" "DriverPack-17-Online.exe""C:\Windows\system32\cmd.exe—DriverPack-17-Online.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\winbrand.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\user32.dll
2560"C:\Windows\System32\mshta.exe" "C:\Program Files\DriverPack\run.hta" --sfx "DriverPack-17-Online.exe"C:\Windows\System32\mshta.exe
cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Microsoft (R) HTML Application host
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
Modules
Images
c:\windows\system32\mshta.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\api-ms-win-downlevel-version-l1-1-0.dll
c:\windows\system32\iertutil.dll
1308"C:\Windows\System32\cmd.exe" /C powershell -NonInteractive -NoLogo -NoProfile -ExecutionPolicy Bypass "Get-Content 'C:\Users\admin\AppData\Roaming\DRPSu\temp\ps.l8urmaeg.u40fy.cmd.txt' -Wait | Invoke-Expression" > "C:\Users\admin\AppData\Roaming\DRPSu\temp\ps.l8urmaeg.u40fy.stdout.log" 2> "C:\Users\admin\AppData\Roaming\DRPSu\temp\ps.l8urmaeg.u40fy.stderr.log"C:\Windows\System32\cmd.exe—mshta.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Command Processor
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\winbrand.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
308powershell -NonInteractive -NoLogo -NoProfile -ExecutionPolicy Bypass "Get-Content 'C:\Users\admin\AppData\Roaming\DRPSu\temp\ps.l8urmaeg.u40fy.cmd.txt' -Wait | Invoke-Expression" C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows PowerShell
Version:
10.0.14409.1005 (rs1_srvoob.161208-1155)
Modules
Images
c:\windows\system32\ntdll.dll
c:\windows\system32\windowspowershell\v1.0\powershell.exe
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\atl.dll
c:\windows\system32\user32.dll
468rundll32 kernel32,SleepC:\Windows\System32\rundll32.exe—mshta.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows host process (Rundll32)
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\rundll32.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\usp10.dll
c:\windows\system32\lpk.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\imagehlp.dll
2888"C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\admin\AppData\Local\Temp\eyaihmn4.cmdline"C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
powershell.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Visual C# Command Line Compiler
Exit code:
0
Version:
4.0.30319.34209 built by: FX452RTMGDR
Modules
Images
c:\windows\microsoft.net\framework\v4.0.30319\csc.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\msvcr120_clr0400.dll
c:\windows\system32\ole32.dll
3152C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\admin\AppData\Local\Temp\RES5DEF.tmp" "c:\Users\admin\AppData\Local\Temp\CSC5BC65D8FC95343B6B0ADEE92A75B917.TMP"C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe—csc.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Microsoft® Resource File To COFF Object Conversion Utility
Exit code:
0
Version:
12.00.51209.34209 built by: FX452RTMGDR
Modules
Images
c:\windows\microsoft.net\framework\v4.0.30319\cvtres.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\msvcr120_clr0400.dll
c:\windows\system32\cryptsp.dll
700"C:\Windows\System32\cmd.exe" /c "netsh advfirewall firewall delete rule name="DriverPack aria2c.exe" || echo Done & call echo Done %^errorLevel% > "C:\Users\admin\AppData\Roaming\DRPSu\temp\run_command_61357.txt""C:\Windows\System32\cmd.exe—mshta.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\winbrand.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
Total events
11 134
Read events
11 001
Write events
133
Delete events
0

Modification events

(PID) Process:(2028) DriverPack-17-Online.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\drp.su\update
Operation:writeName:http
Value:
1
(PID) Process:(2028) DriverPack-17-Online.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\drp.su\update
Operation:writeName:https
Value:
1
(PID) Process:(2028) DriverPack-17-Online.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings
Operation:writeName:GlobalUserOffline
Value:
0
(PID) Process:(2028) DriverPack-17-Online.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\DriverPack
Operation:writeName:DisplayName
Value:
DriverPack
(PID) Process:(2028) DriverPack-17-Online.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\DriverPack
Operation:writeName:DisplayVersion
Value:
17.11
(PID) Process:(2028) DriverPack-17-Online.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\DriverPack
Operation:writeName:DisplayIcon
Value:
"C:\Program Files\DriverPack\Tools\Icon.ico"
(PID) Process:(2028) DriverPack-17-Online.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\DriverPack
Operation:writeName:UninstallString
Value:
"C:\Program Files\DriverPack\Uninstall.exe"
(PID) Process:(2028) DriverPack-17-Online.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\DriverPack
Operation:writeName:Publisher
Value:
DriverPack
(PID) Process:(2028) DriverPack-17-Online.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\DriverPack
Operation:writeName:NoModify
Value:
1
(PID) Process:(2028) DriverPack-17-Online.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\DriverPack
Operation:writeName:NoRepair
Value:
1
Executable files
10
Suspicious files
14
Text files
499
Unknown types
43

Dropped files

PID
Process
Filename
Type
2028DriverPack-17-Online.exeC:\Program Files\DriverPack\DriverPackSolution.htmlhtml
MD5:203AC1542D8E93EDBBC80F7B59DB5C44
SHA256:8892E63141854BCF4BB1452ABEF68DD2C348C59322D697EF11A7AB7C5E3C4AEA
2028DriverPack-17-Online.exeC:\Program Files\DriverPack\Tools\modules\bugreport.htahtml
MD5:69013B5F2C85EF14D5AF5B0598796A16
SHA256:A9B7A43232D0B48DC2F75269DCA5898F4149B81634C461C279A81AC725879E2E
2028DriverPack-17-Online.exeC:\Program Files\DriverPack\Tools\load8.gifimage
MD5:8A061EF740FA2801AB4BF78CB123D9BE
SHA256:EE0CC89EF293B559B64FCB35B469DCB144180FF048B0B6EB14F326847A544903
2028DriverPack-17-Online.exeC:\Program Files\DriverPack\Tools\driverpack-wget.exeexecutable
MD5:BD126A7B59D5D1F97BA89A3E71425731
SHA256:A48AD33695A44DE887BBA8F2F3174FD8FB01A46A19E3EC9078B0118647CCF599
2028DriverPack-17-Online.exeC:\Program Files\DriverPack\css\custom-control.csstext
MD5:F7F8703ADA2176DC144343A2C2ACB1CD
SHA256:7D7853E95258A7A3F8EAF41795F7124E7D2DACDEB5F1EFE212B3FF7ED0DA9E50
2028DriverPack-17-Online.exeC:\Program Files\DriverPack\css\ie7.csstext
MD5:2DBDB8116515F8458F9750F63C074FA7
SHA256:2FFFEDDB2D1C6CEE5CC956965B7047B0C2888F48CBA13A4FCB070417F1D4899D
2028DriverPack-17-Online.exeC:\Program Files\DriverPack\Tools\Icon.icoimage
MD5:CBD76182149BBA7EB76EC535DA43DB7F
SHA256:8707AE608F38AFD9ADE700BBDCA79344A4F50EAFC9EA3592B1E9FD6B616A6314
2028DriverPack-17-Online.exeC:\Program Files\DriverPack\Tools\run.htahtml
MD5:66E315709C21E476C5511BD8325DF9F7
SHA256:5B5582C940D24BD040CABD1D0D1C21249899546E0D3278692200ED65C3201EBF
2028DriverPack-17-Online.exeC:\Users\admin\AppData\Local\Temp\nsiEC3C.tmp\modern-wizard.bmpimage
MD5:2ADD351A8600764028D38F3A1B0D34F8
SHA256:65844F7B35D63C3F805324FCA880831BA7086B6BBEA00CE1E29C38D46B67F7E5
2028DriverPack-17-Online.exeC:\Program Files\DriverPack\css\icons-checkbox.csstext
MD5:3BE98220035017D9B818F3CC94F87587
SHA256:CB134DCB95A407795C671A512C389894D3525FBA3F6A2168FC5B9B7E875E78DC
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
15
TCP/UDP connections
17
DNS requests
11
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
2560
mshta.exe
GET
301
188.114.97.3:80
http://allfont.ru/cache/css/lucida-console.css
US
—
—
whitelisted
2560
mshta.exe
GET
301
188.114.97.3:80
http://allfont.ru/allfont.css?fonts=lucida-console
US
—
—
whitelisted
2560
mshta.exe
GET
200
2.22.117.227:80
http://e1.o.lencr.org/MFMwUTBPME0wSzAJBgUrDgMCGgUABBTvkAFw3ViPKmUeIVEf3NC7b1ErqwQUWvPtK%2Fw2wjd5uVIw6lRvz1XLLqwCEgTfAZP0%2B0D1blFnYCV3UIVwNA%3D%3D
GB
der
346 b
whitelisted
2560
mshta.exe
GET
200
23.216.77.69:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab?9a576261f19502c4
US
compressed
60.9 Kb
whitelisted
2560
mshta.exe
GET
200
23.216.77.69:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?3ce451c255eea243
US
compressed
4.70 Kb
whitelisted
2560
mshta.exe
GET
200
37.9.8.75:80
http://update.drp.su/
RU
html
141 b
malicious
2560
mshta.exe
GET
200
104.125.75.233:80
http://x2.c.lencr.org/
NL
der
300 b
whitelisted
2560
mshta.exe
GET
200
104.18.21.226:80
http://ocsp.globalsign.com/gseccovsslca2018/ME0wSzBJMEcwRTAJBgUrDgMCGgUABBSTMjK03nNiYoQYvu4Izyfn9OJNdAQUWHuOdSr%2BYYCqkEABrtboB0ZuP0gCDDr6WyPB2UqgqvyNjw%3D%3D
US
der
938 b
whitelisted
2560
mshta.exe
GET
200
104.18.20.226:80
http://ocsp2.globalsign.com/rootr5/ME4wTDBKMEgwRjAJBgUrDgMCGgUABBQiD0S5cIHyfrLTJ1fvAkJWflH%2B2QQUPeYpSJvqB8ohREom3m7e0oPQn1kCDQHuXyKVQkkF%2BQGRqNw%3D
US
der
1.26 Kb
whitelisted
2560
mshta.exe
GET
200
172.217.18.14:80
http://www.google-analytics.com/collect?v=1&ds=hta&tid=UA-68879973-26&cid=671090449.7270461486&t=event&ec=driverpack%20online&ea=yandex%20patcher%20browser%20not%20detected&el=17.11.108%20online&ul=&z=3423150966845401&sc=start&cd1=671090449.7270461486&cd2=17.11.108%20Online&cd3=7%20x86&cd4=SP%201&cd5=Windows%207%20Professional%20&cd6=(not%20set)
US
image
35 b
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
2560
mshta.exe
188.114.97.3:80
allfont.ru
CLOUDFLARENET
NL
malicious
2560
mshta.exe
188.114.97.3:443
allfont.ru
CLOUDFLARENET
NL
malicious
2560
mshta.exe
23.216.77.69:80
ctldl.windowsupdate.com
Akamai International B.V.
DE
suspicious
2560
mshta.exe
104.18.21.226:80
ocsp.globalsign.com
CLOUDFLARENET
—
shared
2560
mshta.exe
87.250.250.119:443
mc.yandex.ru
YANDEX LLC
RU
whitelisted
2560
mshta.exe
2.22.117.227:80
e1.o.lencr.org
Akamai International B.V.
DE
suspicious
2560
mshta.exe
178.162.204.5:80
auth.drp.su
Leaseweb Deutschland GmbH
DE
suspicious
2560
mshta.exe
96.16.145.230:80
x1.c.lencr.org
AKAMAI-AS
DE
suspicious
—
—
104.125.75.233:80
x2.c.lencr.org
AKAMAI-AS
DE
suspicious
2560
mshta.exe
37.9.8.75:80
update.drp.su
OOO Network of data-centers Selectel
RU
malicious

DNS requests

Domain
IP
Reputation
allfont.ru
  • 188.114.97.3
  • 188.114.96.3
whitelisted
ctldl.windowsupdate.com
  • 23.216.77.69
  • 23.216.77.80
whitelisted
x1.c.lencr.org
  • 96.16.145.230
whitelisted
x2.c.lencr.org
  • 104.125.75.233
whitelisted
e1.o.lencr.org
  • 2.22.117.227
  • 2.22.118.162
whitelisted
auth.drp.su
  • 178.162.204.5
suspicious
mc.yandex.ru
  • 87.250.250.119
  • 93.158.134.119
  • 77.88.21.119
  • 87.250.251.119
whitelisted
update.drp.su
  • 37.9.8.75
  • 82.145.55.146
  • 46.161.36.165
  • 178.162.207.42
malicious
ocsp.globalsign.com
  • 104.18.21.226
  • 104.18.20.226
whitelisted
www.google-analytics.com
  • 172.217.18.14
whitelisted

Threats

PID
Process
Class
Message
—
—
A Network Trojan was detected
ET MALWARE Observed DNS Query to DriverPack Domain ( .drp .su)
—
—
Potentially Bad Traffic
ET DNS Query for .su TLD (Soviet Union) Often Malware Related
—
—
Potentially Bad Traffic
ET MALWARE DriverPack Domain in DNS Query
—
—
A Network Trojan was detected
ET MALWARE Observed DNS Query to DriverPack Domain ( .drp .su)
—
—
Potentially Bad Traffic
ET DNS Query for .su TLD (Soviet Union) Often Malware Related
—
—
Potentially Bad Traffic
ET MALWARE DriverPack Domain in DNS Query
2560
mshta.exe
Potentially Bad Traffic
ET POLICY HTTP Request to .su TLD (Soviet Union) Often Malware Related
2560
mshta.exe
Potentially Bad Traffic
ET POLICY HTTP Request to .su TLD (Soviet Union) Often Malware Related
2560
mshta.exe
Potentially Bad Traffic
ET POLICY HTTP Request to .su TLD (Soviet Union) Often Malware Related
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2024 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
DriverPack-17-Online.exe