File name:

vJoySetup.exe

Full analysis: https://app.any.run/tasks/0a132b9f-df25-48b7-973d-b0f6f8fc0533
Verdict: Malicious activity
Analysis date: November 07, 2023, 20:58:46
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386, for MS Windows
MD5:

2AB668A12EBDEA3BD8FA1D5A2CA7CB45

SHA1:

535822F96003B9B68F155A1FBDC226DE93D1D1AF

SHA256:

F103CED4E7FF7CCB49C8415A542C56768ED4DA4FEA252B8F4FFDAC343074654A

SSDEEP:

98304:lbUMv+3ec9TMYWBg0UJIJV+bbRgT4jZNvbaXG3NF6Sn3KWlnuZbgQ2PinzJCxyen:1b5nJJuIyzfmGj

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Drops the executable file immediately after the start

      • vJoySetup.exe (PID: 3448)
      • vJoySetup.exe (PID: 3480)
      • vJoyInstall.exe (PID: 3632)
      • drvinst.exe (PID: 3860)
      • vJoySetup.tmp (PID: 3512)
      • drvinst.exe (PID: 3700)

    • Creates a writable file the system directory

      • drvinst.exe (PID: 3860)
      • drvinst.exe (PID: 3700)

  • SUSPICIOUS

    • Reads the Windows owner or organization settings

      • vJoySetup.tmp (PID: 3512)

    • Drops a system driver (possible attempt to evade defenses)

      • vJoySetup.tmp (PID: 3512)
      • vJoyInstall.exe (PID: 3632)
      • drvinst.exe (PID: 3860)
      • drvinst.exe (PID: 3700)

    • Process drops legitimate windows executable

      • vJoySetup.tmp (PID: 3512)
      • vJoyInstall.exe (PID: 3632)
      • drvinst.exe (PID: 3860)

    • The process drops C-runtime libraries

      • vJoySetup.tmp (PID: 3512)

    • Reads security settings of Internet Explorer

      • vJoyInstall.exe (PID: 3632)

    • Reads settings of System Certificates

      • vJoyInstall.exe (PID: 3632)

    • Creates files in the driver directory

      • drvinst.exe (PID: 3860)
      • drvinst.exe (PID: 3700)

    • Checks Windows Trust Settings

      • vJoyInstall.exe (PID: 3632)
      • drvinst.exe (PID: 3700)
      • drvinst.exe (PID: 3860)

    • Executes as Windows Service

      • VSSVC.exe (PID: 3908)

  • INFO

    • Create files in a temporary directory

      • vJoySetup.exe (PID: 3448)
      • vJoySetup.exe (PID: 3480)
      • vJoySetup.tmp (PID: 3512)
      • vJoyInstall.exe (PID: 3632)
      • rundll32.exe (PID: 1856)

    • Checks supported languages

      • vJoySetup.tmp (PID: 3156)
      • vJoySetup.exe (PID: 3448)
      • vJoySetup.exe (PID: 3480)
      • vJoySetup.tmp (PID: 3512)
      • wmpnscfg.exe (PID: 3400)
      • vJoyInstall.exe (PID: 3632)
      • drvinst.exe (PID: 3860)
      • drvinst.exe (PID: 3700)
      • drvinst.exe (PID: 916)
      • drvinst.exe (PID: 2056)
      • vJoyList.exe (PID: 1420)
      • vJoyConf.exe (PID: 2756)
      • drvinst.exe (PID: 668)

    • Reads the computer name

      • vJoySetup.tmp (PID: 3156)
      • vJoySetup.tmp (PID: 3512)
      • wmpnscfg.exe (PID: 3400)
      • drvinst.exe (PID: 3860)
      • vJoyInstall.exe (PID: 3632)
      • drvinst.exe (PID: 3700)
      • drvinst.exe (PID: 916)
      • drvinst.exe (PID: 2056)
      • vJoyList.exe (PID: 1420)
      • vJoyConf.exe (PID: 2756)
      • drvinst.exe (PID: 668)

    • Creates files in the program directory

      • vJoySetup.tmp (PID: 3512)
      • vJoyInstall.exe (PID: 3632)

    • Manual execution by a user

      • wmpnscfg.exe (PID: 3400)
      • vJoyList.exe (PID: 1420)
      • vJoyConf.exe (PID: 2756)
      • vJoyConf.exe (PID: 3868)

    • Reads the machine GUID from the registry

      • wmpnscfg.exe (PID: 3400)
      • vJoyInstall.exe (PID: 3632)
      • drvinst.exe (PID: 3860)
      • drvinst.exe (PID: 3700)
      • drvinst.exe (PID: 668)

    • Creates files or folders in the user directory

      • rundll32.exe (PID: 1856)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Inno Setup installer (67.7)
.exe | Win32 EXE PECompact compressed (generic) (25.6)
.exe | Win32 Executable (generic) (2.7)
.exe | Win16/32 Executable Delphi generic (1.2)
.exe | Generic Win/DOS Executable (1.2)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2019:04:27 10:22:11+02:00
ImageFileCharacteristics: No relocs, Executable, No line numbers, No symbols, Bytes reversed lo, 32-bit, Bytes reversed hi
PEType: PE32
LinkerVersion: 2.25
CodeSize: 682496
InitializedDataSize: 300032
UninitializedDataSize: -
EntryPoint: 0xa7ed0
OSVersion: 6
ImageVersion: 6
SubsystemVersion: 6
Subsystem: Windows GUI
FileVersionNumber: 2.1.9.1
ProductVersionNumber: 2.1.9.1
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: Neutral
CharacterSet: Unicode
Comments: This installation was built with Inno Setup.
CompanyName: Shaul Eizikovich
FileDescription: vJoy Device Driver Setup
FileVersion: 2.1.9.1
LegalCopyright: Copyright (c) 2005-2016 by Shaul Eizikovich
OriginalFileName:
ProductName: vJoy Device Driver
ProductVersion: 2.1.9.1
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
60
Monitored processes
18
Malicious processes
7
Suspicious processes
0

Behavior graph

Click at the process to see the details
start vjoysetup.exe no specs vjoysetup.tmp no specs vjoysetup.exe vjoysetup.tmp no specs wmpnscfg.exe no specs vjoyinstall.exe no specs drvinst.exe no specs rundll32.exe no specs vssvc.exe no specs drvinst.exe no specs drvinst.exe no specs drvinst.exe no specs rundll32.exe no specs rundll32.exe no specs drvinst.exe no specs vjoylist.exe no specs vjoyconf.exe no specs vjoyconf.exe

Process information

PID
CMD
Path
Indicators
Parent process
668DrvInst.exe "2" "201" "HID\HIDCLASS\1&2D595CA7&0&0000" "C:\Windows\INF\input.inf" "input.inf:Standard.NTx86:HID_Raw_Inst:6.1.7601.24386::hid_device_system_game" "6070ed7cf" "00000620" "000005D4" "00000630"C:\Windows\System32\drvinst.exe—svchost.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Driver Installation Module
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\drvinst.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\setupapi.dll
c:\windows\system32\cfgmgr32.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
916DrvInst.exe "1" "200" "HID\HIDCLASS\1&2d595ca7&0&0000" "" "" "6eeb73e57" "00000000" "000005E4" "000005D8"C:\Windows\System32\drvinst.exe—svchost.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Driver Installation Module
Exit code:
3758096899
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\drvinst.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\setupapi.dll
c:\windows\system32\cfgmgr32.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
1420"C:\Program Files\vJoy\x86\vJoyList.exe" C:\Program Files\vJoy\x86\vJoyList.exe—explorer.exe
User:
admin
Company:
Shaul Eizikovich
Integrity Level:
MEDIUM
Description:
vJoyList - List vJoy devices
Exit code:
0
Version:
0.0.0
Modules
Images
c:\program files\vjoy\x86\vjoylist.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\vjoy\x86\mfc120u.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\program files\vjoy\x86\msvcr120.dll
1856rundll32.exe C:\Windows\system32\newdev.dll,pDiDeviceInstallNotification \\.\pipe\PNP_Device_Install_Pipe_1.{f33acce7-e58a-4eda-95c7-14cd65e0b81e} "(null)"C:\Windows\System32\rundll32.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows host process (Rundll32)
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\rundll32.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\imagehlp.dll
2000C:\Windows\System32\rundll32.exe shell32.dll,SHCreateLocalServerRunDll {995C996E-D918-4a8c-A302-45719A6F4EA7} -EmbeddingC:\Windows\System32\rundll32.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows host process (Rundll32)
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\rundll32.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\imagehlp.dll
2056DrvInst.exe "1" "200" "{D6E55CA0-1A2E-4234-AAF3-3852170B492F}\vJoyRawPdo\1&2d595ca7&0&vJoyInstance00" "" "" "60a97addf" "00000000" "000005D4" "00000618"C:\Windows\System32\drvinst.exe—svchost.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Driver Installation Module
Exit code:
3758096899
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\drvinst.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\setupapi.dll
c:\windows\system32\cfgmgr32.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
2756"C:\Program Files\vJoy\x86\vJoyConf.exe" C:\Program Files\vJoy\x86\vJoyConf.exe
explorer.exe
User:
admin
Company:
Shaul Eizikovich
Integrity Level:
HIGH
Description:
vJoyConf - Configure vJoy devices
Exit code:
0
Version:
0.0.0
Modules
Images
c:\program files\vjoy\x86\vjoyconf.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.18837_none_ec86b8d6858ec0bc\comctl32.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\gdi32.dll
3156"C:\Users\admin\AppData\Local\Temp\is-GGFSA.tmp\vJoySetup.tmp" /SL5="$50194,10728610,983552,C:\Users\admin\AppData\Local\Temp\vJoySetup.exe" C:\Users\admin\AppData\Local\Temp\is-GGFSA.tmp\vJoySetup.tmp—vJoySetup.exe
User:
admin
Integrity Level:
MEDIUM
Description:
Setup/Uninstall
Exit code:
0
Version:
51.1052.0.0
Modules
Images
c:\users\admin\appdata\local\temp\is-ggfsa.tmp\vjoysetup.tmp
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\mpr.dll
c:\windows\system32\comdlg32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
3400"C:\Program Files\Windows Media Player\wmpnscfg.exe"C:\Program Files\Windows Media Player\wmpnscfg.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Media Player Network Sharing Service Configuration Application
Exit code:
0
Version:
12.0.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\program files\windows media player\wmpnscfg.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\sspicli.dll
c:\windows\system32\ole32.dll
3448"C:\Users\admin\AppData\Local\Temp\vJoySetup.exe" C:\Users\admin\AppData\Local\Temp\vJoySetup.exe—explorer.exe
User:
admin
Company:
Shaul Eizikovich
Integrity Level:
MEDIUM
Description:
vJoy Device Driver Setup
Exit code:
0
Version:
2.1.9.1
Modules
Images
c:\users\admin\appdata\local\temp\vjoysetup.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.24483_none_2b200f664577e14b\comctl32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
Total events
11 066
Read events
10 988
Write events
69
Delete events
9

Modification events

(PID) Process:(3400) wmpnscfg.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Media Player NSS\3.0\Events\{E6AA288E-56B3-4B08-A90B-FE9F12873CA2}\{FFE9D7E0-E0E7-4A19-84C2-B700DF3E92F2}
Operation:delete keyName:(default)
Value:
(PID) Process:(3400) wmpnscfg.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Media Player NSS\3.0\Events\{E6AA288E-56B3-4B08-A90B-FE9F12873CA2}
Operation:delete keyName:(default)
Value:
(PID) Process:(3400) wmpnscfg.exeKey:HKEY_CURRENT_USER\Software\Microsoft\MediaPlayer\Health\{800D47F3-F9B4-481B-9988-41D5C5544BB2}
Operation:delete keyName:(default)
Value:
(PID) Process:(3632) vJoyInstall.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\17A\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(3860) drvinst.exeKey:HKEY_USERS\.DEFAULT\Software\Classes\Local Settings\MuiCache\17A\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(3860) drvinst.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\SystemRestore
Operation:writeName:SrCreateRp (Enter)
Value:
4000000000000000F2B487BA16B0D901C80700002C0A0000D5070000000000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(3860) drvinst.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\SPP
Operation:writeName:SppCreate (Enter)
Value:
4000000000000000F2B487BA16B0D901C80700002C0A0000D0070000000000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(3860) drvinst.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SPP
Operation:writeName:LastIndex
Value:
72
(PID) Process:(3860) drvinst.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\SPP
Operation:writeName:SppGatherWriterMetadata (Enter)
Value:
40000000000000008C62D6BA16B0D901C80700002C0A0000D3070000000000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(3860) drvinst.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\SPP
Operation:writeName:SppGatherWriterMetadata (Leave)
Value:
400000000000000064514ABC16B0D901C80700002C0A0000D3070000010000000000000000000000000000000000000000000000000000000000000000000000
Executable files
62
Suspicious files
34
Text files
9
Unknown types
0

Dropped files

PID
Process
Filename
Type
3512vJoySetup.tmpC:\Program Files\vJoy\hidkmdf.sysexecutable
MD5:8D3DB0D325B03D532AECD2F043255C53
SHA256:E6D604466BA9A852BD48C269084A0643F1C81A29233ADEAE505BE1D081DCA6DB
3480vJoySetup.exeC:\Users\admin\AppData\Local\Temp\is-J44CT.tmp\vJoySetup.tmpexecutable
MD5:F8034AC234BF9638B31432E22FC2F53F
SHA256:C7548189B1EEFDC5BD0CAEB5E43B9496E5A7CFB9578FBECA0F31DD099D6AA47A
3448vJoySetup.exeC:\Users\admin\AppData\Local\Temp\is-GGFSA.tmp\vJoySetup.tmpexecutable
MD5:F8034AC234BF9638B31432E22FC2F53F
SHA256:C7548189B1EEFDC5BD0CAEB5E43B9496E5A7CFB9578FBECA0F31DD099D6AA47A
3512vJoySetup.tmpC:\Program Files\vJoy\x86\is-TVFM7.tmpexecutable
MD5:74FD55B0A678AF4D4DF0F8E291630F7A
SHA256:7BC7422DAFA1272F9C528A6FB2195A6E0F0816178BBE841CBAC2E916B71F58E8
3512vJoySetup.tmpC:\Program Files\vJoy\x86\is-Q7U6K.tmpexecutable
MD5:17642D8C9EC09984C441884C9BFF090C
SHA256:D723727B75687B9F3DBE3D31D3A1FDF6BF387387C3627FCF0005B58C4238D858
3512vJoySetup.tmpC:\Program Files\vJoy\WdfCoinstaller01009.dllexecutable
MD5:16A8D851CE07D6FDABF28707E50CC698
SHA256:FC45FC877B470236C2FB4A335D16594CD2ADA6FA1CBCDFE9184885326D6EB5FA
3512vJoySetup.tmpC:\Program Files\vJoy\is-9NOMO.tmpexecutable
MD5:16A8D851CE07D6FDABF28707E50CC698
SHA256:FC45FC877B470236C2FB4A335D16594CD2ADA6FA1CBCDFE9184885326D6EB5FA
3512vJoySetup.tmpC:\Program Files\vJoy\x86\LBIndustrialCtrls.dllexecutable
MD5:74FD55B0A678AF4D4DF0F8E291630F7A
SHA256:7BC7422DAFA1272F9C528A6FB2195A6E0F0816178BBE841CBAC2E916B71F58E8
3512vJoySetup.tmpC:\Program Files\vJoy\x86\vJoyInterface.dllexecutable
MD5:17642D8C9EC09984C441884C9BFF090C
SHA256:D723727B75687B9F3DBE3D31D3A1FDF6BF387387C3627FCF0005B58C4238D858
3512vJoySetup.tmpC:\Program Files\vJoy\x86\is-PT7DO.tmpexecutable
MD5:AD81515BA0301B239E1E6C02DF0847F2
SHA256:A1862EC323C672DCB3662B376ED614B08AC688C6223EF6ECE0BA3089C4A6AA05
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
3
DNS requests
1
Threats
0

HTTP requests

No HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:138
—
—
—
whitelisted
868
svchost.exe
88.221.124.138:80
armmf.adobe.com
AKAMAI-AS
DE
unknown
4
System
192.168.100.255:137
—
—
—
whitelisted

DNS requests

Domain
IP
Reputation
armmf.adobe.com
  • 88.221.124.138
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
vJoySetup.exe