download:

DriverPack-17-Online.exe

Full analysis: https://app.any.run/tasks/b051e25f-cfab-46db-9512-b7379585e47f
Verdict: Malicious activity
Analysis date: October 04, 2022, 22:20:33
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive
MD5:

A590A3B8EB80EFD0B8CE98BFE1F6F465

SHA1:

A1DB5703428E8BC6ECF3F0E425DB647375561F22

SHA256:

ED3E434362045111E48B9D30C9CB1DD21F58DC625B4CD862CF483ECC5A61DF33

SSDEEP:

196608:TRAwoqFBMTns8HJAiQqGkr3DRnDSuTJ6ZMW9j:TRAfA0ZJr53ZSuk

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Drops executable file immediately after starts

      • DriverPack-17-Online.exe (PID: 2028)
      • csc.exe (PID: 2888)

    • Loads dropped or rewritten executable

      • DriverPack-17-Online.exe (PID: 2028)

    • Changes settings of System certificates

      • mshta.exe (PID: 2560)

    • Executes PowerShell scripts

      • cmd.exe (PID: 1308)

    • Changes internet zones settings

      • mshta.exe (PID: 2560)

    • Starts Visual C# compiler

      • powershell.exe (PID: 308)

  • SUSPICIOUS

    • Checks supported languages

      • DriverPack-17-Online.exe (PID: 2028)
      • cmd.exe (PID: 2392)
      • mshta.exe (PID: 2560)
      • cmd.exe (PID: 1308)
      • powershell.exe (PID: 308)
      • cvtres.exe (PID: 3152)
      • csc.exe (PID: 2888)
      • cmd.exe (PID: 700)

    • Executable content was dropped or overwritten

      • DriverPack-17-Online.exe (PID: 2028)
      • csc.exe (PID: 2888)

    • Reads the computer name

      • DriverPack-17-Online.exe (PID: 2028)
      • mshta.exe (PID: 2560)
      • cmd.exe (PID: 2392)
      • powershell.exe (PID: 308)

    • Starts CMD.EXE for commands execution

      • DriverPack-17-Online.exe (PID: 2028)
      • mshta.exe (PID: 2560)

    • Reads Microsoft Outlook installation path

      • mshta.exe (PID: 2560)

    • Creates a software uninstall entry

      • DriverPack-17-Online.exe (PID: 2028)

    • Starts MSHTA.EXE for opening HTA or HTMLS files

      • cmd.exe (PID: 2392)

    • Adds / modifies Windows certificates

      • mshta.exe (PID: 2560)

    • Drops a file with a compile date too recent

      • DriverPack-17-Online.exe (PID: 2028)
      • csc.exe (PID: 2888)

    • Creates a directory in Program Files

      • DriverPack-17-Online.exe (PID: 2028)

    • Creates files in the user directory

      • mshta.exe (PID: 2560)
      • cmd.exe (PID: 1308)
      • cmd.exe (PID: 700)

    • Uses RUNDLL32.EXE to load library

      • mshta.exe (PID: 2560)

    • Uses NETSH.EXE for network configuration

      • cmd.exe (PID: 700)

    • Creates files in the program directory

      • DriverPack-17-Online.exe (PID: 2028)

    • Reads Environment values

      • netsh.exe (PID: 3400)

  • INFO

    • Reads internet explorer settings

      • mshta.exe (PID: 2560)

    • Checks Windows Trust Settings

      • mshta.exe (PID: 2560)
      • powershell.exe (PID: 308)

    • Reads settings of System Certificates

      • mshta.exe (PID: 2560)

    • Checks supported languages

      • rundll32.exe (PID: 468)
      • netsh.exe (PID: 3400)

    • Reads the computer name

      • netsh.exe (PID: 3400)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win32 Executable MS Visual C++ (generic) (67.4)
.dll | Win32 Dynamic Link Library (generic) (14.2)
.exe | Win32 Executable (generic) (9.7)
.exe | Generic Win/DOS Executable (4.3)
.exe | DOS Executable Generic (4.3)

Summary

Architecture: IMAGE_FILE_MACHINE_I386
Subsystem: IMAGE_SUBSYSTEM_WINDOWS_GUI
Compilation Date: 2021-Sep-25 21:56:47
Detected languages:
  • English - United States

DOS Header

e_magic: MZ
e_cblp: 144
e_cp: 3
e_crlc: -
e_cparhdr: 4
e_minalloc: -
e_maxalloc: 65535
e_ss: -
e_sp: 184
e_csum: -
e_ip: -
e_cs: -
e_ovno: -
e_oemid: -
e_oeminfo: -
e_lfanew: 216

PE Headers

Signature: PE
Machine: IMAGE_FILE_MACHINE_I386
NumberofSections: 5
TimeDateStamp: 2021-Sep-25 21:56:47
PointerToSymbolTable: -
NumberOfSymbols: -
SizeOfOptionalHeader: 224
Characteristics:
  • IMAGE_FILE_32BIT_MACHINE
  • IMAGE_FILE_EXECUTABLE_IMAGE
  • IMAGE_FILE_LINE_NUMS_STRIPPED
  • IMAGE_FILE_LOCAL_SYMS_STRIPPED
  • IMAGE_FILE_RELOCS_STRIPPED

Sections

Name
Virtual Address
Virtual Size
Raw Size
Charateristics
Entropy
.text
4096
26230
26624
IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
6.41746
.rdata
32768
5018
5120
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
5.14107
.data
40960
131960
1536
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
4.11058
.ndata
176128
73728
0
IMAGE_SCN_CNT_UNINITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc
249856
156720
157184
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
3.97681

Resources

Title
Entropy
Size
Codepage
Language
Type
1
3.26647
67624
UNKNOWN
English - United States
RT_ICON
2
2.62561
38056
UNKNOWN
English - United States
RT_ICON
3
3.61635
16936
UNKNOWN
English - United States
RT_ICON
4
3.35698
9640
UNKNOWN
English - United States
RT_ICON
5
3.21738
4264
UNKNOWN
English - United States
RT_ICON
6
3.8607
2440
UNKNOWN
English - United States
RT_ICON
7
4.69763
1128
UNKNOWN
English - United States
RT_ICON
103
2.56193
288
UNKNOWN
English - United States
RT_DIALOG
105
2.67385
512
UNKNOWN
English - United States
RT_DIALOG
106
2.91148
248
UNKNOWN
English - United States
RT_DIALOG

Imports

ADVAPI32.dll
COMCTL32.dll
GDI32.dll
KERNEL32.dll
SHELL32.dll
USER32.dll
ole32.dll
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
52
Monitored processes
11
Malicious processes
5
Suspicious processes
0

Behavior graph

Click at the process to see the details
start driverpack-17-online.exe cmd.exe no specs mshta.exe cmd.exe no specs powershell.exe no specs rundll32.exe no specs csc.exe cvtres.exe no specs cmd.exe no specs netsh.exe no specs driverpack-17-online.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
308powershell -NonInteractive -NoLogo -NoProfile -ExecutionPolicy Bypass "Get-Content 'C:\Users\admin\AppData\Roaming\DRPSu\temp\ps.l8urmaeg.u40fy.cmd.txt' -Wait | Invoke-Expression" C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows PowerShell
Exit code:
0
Version:
10.0.14409.1005 (rs1_srvoob.161208-1155)
Modules
Images
c:\windows\system32\ntdll.dll
c:\windows\system32\windowspowershell\v1.0\powershell.exe
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\atl.dll
c:\windows\system32\user32.dll
468rundll32 kernel32,SleepC:\Windows\System32\rundll32.exe—mshta.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows host process (Rundll32)
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\rundll32.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\usp10.dll
c:\windows\system32\lpk.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\imagehlp.dll
700"C:\Windows\System32\cmd.exe" /c "netsh advfirewall firewall delete rule name="DriverPack aria2c.exe" || echo Done & call echo Done %^errorLevel% > "C:\Users\admin\AppData\Roaming\DRPSu\temp\run_command_61357.txt""C:\Windows\System32\cmd.exe—mshta.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\winbrand.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
1308"C:\Windows\System32\cmd.exe" /C powershell -NonInteractive -NoLogo -NoProfile -ExecutionPolicy Bypass "Get-Content 'C:\Users\admin\AppData\Roaming\DRPSu\temp\ps.l8urmaeg.u40fy.cmd.txt' -Wait | Invoke-Expression" > "C:\Users\admin\AppData\Roaming\DRPSu\temp\ps.l8urmaeg.u40fy.stdout.log" 2> "C:\Users\admin\AppData\Roaming\DRPSu\temp\ps.l8urmaeg.u40fy.stderr.log"C:\Windows\System32\cmd.exe—mshta.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\winbrand.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
2028"C:\Users\admin\AppData\Local\Temp\DriverPack-17-Online.exe" C:\Users\admin\AppData\Local\Temp\DriverPack-17-Online.exe
Explorer.EXE
User:
admin
Integrity Level:
HIGH
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\driverpack-17-online.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\shell32.dll
c:\windows\system32\gdi32.dll
2392C:\Windows\system32\cmd.exe /c ""C:\Program Files\DriverPack\start.bat" "DriverPack-17-Online.exe""C:\Windows\system32\cmd.exe—DriverPack-17-Online.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\winbrand.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\user32.dll
2560"C:\Windows\System32\mshta.exe" "C:\Program Files\DriverPack\run.hta" --sfx "DriverPack-17-Online.exe"C:\Windows\System32\mshta.exe
cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Microsoft (R) HTML Application host
Exit code:
0
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
Modules
Images
c:\windows\system32\mshta.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\api-ms-win-downlevel-version-l1-1-0.dll
c:\windows\system32\iertutil.dll
2888"C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\admin\AppData\Local\Temp\eyaihmn4.cmdline"C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
powershell.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Visual C# Command Line Compiler
Exit code:
0
Version:
4.0.30319.34209 built by: FX452RTMGDR
Modules
Images
c:\windows\microsoft.net\framework\v4.0.30319\csc.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\msvcr120_clr0400.dll
c:\windows\system32\ole32.dll
3152C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\admin\AppData\Local\Temp\RES5DEF.tmp" "c:\Users\admin\AppData\Local\Temp\CSC5BC65D8FC95343B6B0ADEE92A75B917.TMP"C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe—csc.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Microsoft® Resource File To COFF Object Conversion Utility
Exit code:
0
Version:
12.00.51209.34209 built by: FX452RTMGDR
Modules
Images
c:\windows\microsoft.net\framework\v4.0.30319\cvtres.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\msvcr120_clr0400.dll
c:\windows\system32\cryptsp.dll
3336"C:\Users\admin\AppData\Local\Temp\DriverPack-17-Online.exe" C:\Users\admin\AppData\Local\Temp\DriverPack-17-Online.exe—Explorer.EXE
User:
admin
Integrity Level:
MEDIUM
Exit code:
3221226540
Modules
Images
c:\users\admin\appdata\local\temp\driverpack-17-online.exe
c:\windows\system32\ntdll.dll
Total events
11 134
Read events
11 001
Write events
133
Delete events
0

Modification events

(PID) Process:(2028) DriverPack-17-Online.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\drp.su\update
Operation:writeName:http
Value:
1
(PID) Process:(2028) DriverPack-17-Online.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\drp.su\update
Operation:writeName:https
Value:
1
(PID) Process:(2028) DriverPack-17-Online.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings
Operation:writeName:GlobalUserOffline
Value:
0
(PID) Process:(2028) DriverPack-17-Online.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\DriverPack
Operation:writeName:DisplayName
Value:
DriverPack
(PID) Process:(2028) DriverPack-17-Online.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\DriverPack
Operation:writeName:DisplayVersion
Value:
17.11
(PID) Process:(2028) DriverPack-17-Online.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\DriverPack
Operation:writeName:DisplayIcon
Value:
"C:\Program Files\DriverPack\Tools\Icon.ico"
(PID) Process:(2028) DriverPack-17-Online.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\DriverPack
Operation:writeName:UninstallString
Value:
"C:\Program Files\DriverPack\Uninstall.exe"
(PID) Process:(2028) DriverPack-17-Online.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\DriverPack
Operation:writeName:Publisher
Value:
DriverPack
(PID) Process:(2028) DriverPack-17-Online.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\DriverPack
Operation:writeName:NoModify
Value:
1
(PID) Process:(2028) DriverPack-17-Online.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\DriverPack
Operation:writeName:NoRepair
Value:
1
Executable files
10
Suspicious files
14
Text files
499
Unknown types
43

Dropped files

PID
Process
Filename
Type
2028DriverPack-17-Online.exeC:\Program Files\DriverPack\css\custom-control.csstext
MD5:F7F8703ADA2176DC144343A2C2ACB1CD
SHA256:7D7853E95258A7A3F8EAF41795F7124E7D2DACDEB5F1EFE212B3FF7ED0DA9E50
2028DriverPack-17-Online.exeC:\Users\admin\AppData\Local\Temp\nsiEC3C.tmp\ioSpecial.iniini
MD5:E2D5070BC28DB1AC745613689FF86067
SHA256:D95AED234F932A1C48A2B1B0D98C60CA31F962310C03158E2884AB4DDD3EA1E0
2028DriverPack-17-Online.exeC:\Program Files\DriverPack\css\icons-checkbox.csstext
MD5:3BE98220035017D9B818F3CC94F87587
SHA256:CB134DCB95A407795C671A512C389894D3525FBA3F6A2168FC5B9B7E875E78DC
2028DriverPack-17-Online.exeC:\Program Files\DriverPack\Tools\load8.gifimage
MD5:8A061EF740FA2801AB4BF78CB123D9BE
SHA256:EE0CC89EF293B559B64FCB35B469DCB144180FF048B0B6EB14F326847A544903
2028DriverPack-17-Online.exeC:\Program Files\DriverPack\Tools\run.htahtml
MD5:66E315709C21E476C5511BD8325DF9F7
SHA256:5B5582C940D24BD040CABD1D0D1C21249899546E0D3278692200ED65C3201EBF
2028DriverPack-17-Online.exeC:\Program Files\DriverPack\css\icons.csstext
MD5:EBAE852F3327FDAF3E2FC2BF1CDECB8F
SHA256:B5F111103F7F090C246A223B1FF497B94C4DD3AC64BF5B3FB2D91555FCFD6F2C
2028DriverPack-17-Online.exeC:\Program Files\DriverPack\Tools\modules\bugreport.htahtml
MD5:69013B5F2C85EF14D5AF5B0598796A16
SHA256:A9B7A43232D0B48DC2F75269DCA5898F4149B81634C461C279A81AC725879E2E
2028DriverPack-17-Online.exeC:\Program Files\DriverPack\Tools\Icon.icoimage
MD5:CBD76182149BBA7EB76EC535DA43DB7F
SHA256:8707AE608F38AFD9ADE700BBDCA79344A4F50EAFC9EA3592B1E9FD6B616A6314
2028DriverPack-17-Online.exeC:\Program Files\DriverPack\css\blank.gifimage
MD5:56398E76BE6355AD5999B262208A17C9
SHA256:2F561B02A49376E3679ACD5975E3790ABDFF09ECBADFA1E1858C7BA26E3FFCEF
2028DriverPack-17-Online.exeC:\Program Files\DriverPack\start.battext
MD5:F66F13D4770EB90E6D81222FE3525A3F
SHA256:88EBE6FC9F45E734243DD674A3CDD9222BE692BDE089D0BC06726DD32156B892
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
15
TCP/UDP connections
17
DNS requests
11
Threats
9

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
2560
mshta.exe
GET
301
188.114.97.3:80
http://allfont.ru/allfont.css?fonts=lucida-console
US
—
—
whitelisted
2560
mshta.exe
GET
301
188.114.97.3:80
http://allfont.ru/cache/css/lucida-console.css
US
—
—
whitelisted
2560
mshta.exe
GET
200
2.22.117.227:80
http://e1.o.lencr.org/MFMwUTBPME0wSzAJBgUrDgMCGgUABBTvkAFw3ViPKmUeIVEf3NC7b1ErqwQUWvPtK%2Fw2wjd5uVIw6lRvz1XLLqwCEgTfAZP0%2B0D1blFnYCV3UIVwNA%3D%3D
GB
der
346 b
whitelisted
2560
mshta.exe
GET
200
104.18.21.226:80
http://ocsp.globalsign.com/gseccovsslca2018/ME0wSzBJMEcwRTAJBgUrDgMCGgUABBSTMjK03nNiYoQYvu4Izyfn9OJNdAQUWHuOdSr%2BYYCqkEABrtboB0ZuP0gCDDr6WyPB2UqgqvyNjw%3D%3D
US
der
938 b
whitelisted
2560
mshta.exe
GET
200
104.18.21.226:80
http://ocsp.globalsign.com/rootr1/MFEwTzBNMEswSTAJBgUrDgMCGgUABBS3V7W2nAf4FiMTjpDJKg6%2BMgGqMQQUYHtmGkUNl8qJUC99BM00qP%2F8%2FUsCEHUeP1PjGFkz6V8I7O6tApc%3D
US
der
1.41 Kb
whitelisted
2560
mshta.exe
GET
200
104.18.20.226:80
http://ocsp2.globalsign.com/rootr5/ME4wTDBKMEgwRjAJBgUrDgMCGgUABBQiD0S5cIHyfrLTJ1fvAkJWflH%2B2QQUPeYpSJvqB8ohREom3m7e0oPQn1kCDQHuXyKVQkkF%2BQGRqNw%3D
US
der
1.26 Kb
whitelisted
2560
mshta.exe
POST
202
37.9.8.75:80
http://update.drp.su/api/events
RU
binary
24 b
malicious
2560
mshta.exe
GET
200
37.9.8.75:80
http://update.drp.su/
RU
html
141 b
malicious
2560
mshta.exe
GET
200
104.125.75.233:80
http://x2.c.lencr.org/
NL
der
300 b
whitelisted
2560
mshta.exe
GET
200
172.217.18.14:80
http://www.google-analytics.com/collect?v=1&ds=hta&tid=UA-69093127-16&cid=671090449.7270461486&t=event&ec=driverpack%20online&ea=yandex%20patcher%20browser%20not%20detected&el=17.11.108%20online&ul=&z=13106924344278792&sc=start&cd1=671090449.7270461486&cd2=17.11.108%20Online&cd3=7%20x86&cd4=SP%201&cd5=Windows%207%20Professional%20&cd6=(not%20set)
US
image
35 b
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
2560
mshta.exe
188.114.97.3:80
allfont.ru
CLOUDFLARENET
NL
malicious
2560
mshta.exe
188.114.97.3:443
allfont.ru
CLOUDFLARENET
NL
malicious
2560
mshta.exe
23.216.77.69:80
ctldl.windowsupdate.com
Akamai International B.V.
DE
suspicious
2560
mshta.exe
96.16.145.230:80
x1.c.lencr.org
AKAMAI-AS
DE
suspicious
—
—
104.125.75.233:80
x2.c.lencr.org
AKAMAI-AS
DE
suspicious
2560
mshta.exe
2.22.117.227:80
e1.o.lencr.org
Akamai International B.V.
DE
suspicious
2560
mshta.exe
178.162.204.5:80
auth.drp.su
Leaseweb Deutschland GmbH
DE
suspicious
2560
mshta.exe
172.217.18.14:80
www.google-analytics.com
GOOGLE
US
whitelisted
2560
mshta.exe
37.9.8.75:80
update.drp.su
OOO Network of data-centers Selectel
RU
malicious
2560
mshta.exe
104.18.20.226:80
ocsp.globalsign.com
CLOUDFLARENET
—
shared

DNS requests

Domain
IP
Reputation
allfont.ru
  • 188.114.97.3
  • 188.114.96.3
whitelisted
ctldl.windowsupdate.com
  • 23.216.77.69
  • 23.216.77.80
whitelisted
x1.c.lencr.org
  • 96.16.145.230
whitelisted
x2.c.lencr.org
  • 104.125.75.233
whitelisted
e1.o.lencr.org
  • 2.22.117.227
  • 2.22.118.162
whitelisted
auth.drp.su
  • 178.162.204.5
suspicious
mc.yandex.ru
  • 87.250.250.119
  • 93.158.134.119
  • 77.88.21.119
  • 87.250.251.119
whitelisted
update.drp.su
  • 37.9.8.75
  • 82.145.55.146
  • 46.161.36.165
  • 178.162.207.42
malicious
ocsp.globalsign.com
  • 104.18.21.226
  • 104.18.20.226
whitelisted
www.google-analytics.com
  • 172.217.18.14
whitelisted

Threats

PID
Process
Class
Message
—
—
A Network Trojan was detected
ET MALWARE Observed DNS Query to DriverPack Domain ( .drp .su)
—
—
Potentially Bad Traffic
ET DNS Query for .su TLD (Soviet Union) Often Malware Related
—
—
Potentially Bad Traffic
ET MALWARE DriverPack Domain in DNS Query
—
—
A Network Trojan was detected
ET MALWARE Observed DNS Query to DriverPack Domain ( .drp .su)
—
—
Potentially Bad Traffic
ET DNS Query for .su TLD (Soviet Union) Often Malware Related
—
—
Potentially Bad Traffic
ET MALWARE DriverPack Domain in DNS Query
2560
mshta.exe
Potentially Bad Traffic
ET POLICY HTTP Request to .su TLD (Soviet Union) Often Malware Related
2560
mshta.exe
Potentially Bad Traffic
ET POLICY HTTP Request to .su TLD (Soviet Union) Often Malware Related
2560
mshta.exe
Potentially Bad Traffic
ET POLICY HTTP Request to .su TLD (Soviet Union) Often Malware Related
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
DriverPack-17-Online.exe