Analysis
-
max time kernel
153s -
max time network
33s -
platform
windows7_x64 -
resource
win7-20230220-en -
resource tags
arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system -
submitted
07-04-2023 08:44
Static task
static1
Behavioral task
behavioral1
Sample
DriverEasy_Setup.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
DriverEasy_Setup.exe
Resource
win10v2004-20230220-en
General
-
Target
DriverEasy_Setup.exe
-
Size
5.2MB
-
MD5
bfb4c3cfd7d868058b300ffec858e7a2
-
SHA1
08b38f2082aba63160cfe1e376cb216a14269943
-
SHA256
c41067c647d5685aa0116554f0e1eb95a4a114af7046daa1ccc4561edc36483e
-
SHA512
7e1dfed4cd3957b5e5e22562ee454c117d69ef48a73996f354a1c84aad68eeb5acd2c89d7d05d1c6238fbde956c4ca96b4e92ab0ee0c8a017ddc4e9d5e8f2232
-
SSDEEP
98304:TkLQhsosOuPdJ2gyJgGaMMygX9jhU6ZbqAZO5z8ziZHxC3IpdpyttB:YesoYdcgyJBa4gX9jhLtqAY8ZIdpyttB
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
Processes:
DriverEasy_Setup.tmppid process 1136 DriverEasy_Setup.tmp -
Loads dropped DLL 4 IoCs
Processes:
DriverEasy_Setup.exeDriverEasy_Setup.tmppid process 1772 DriverEasy_Setup.exe 1136 DriverEasy_Setup.tmp 1136 DriverEasy_Setup.tmp 1136 DriverEasy_Setup.tmp -
Suspicious use of WriteProcessMemory 7 IoCs
Processes:
DriverEasy_Setup.exedescription pid process target process PID 1772 wrote to memory of 1136 1772 DriverEasy_Setup.exe DriverEasy_Setup.tmp PID 1772 wrote to memory of 1136 1772 DriverEasy_Setup.exe DriverEasy_Setup.tmp PID 1772 wrote to memory of 1136 1772 DriverEasy_Setup.exe DriverEasy_Setup.tmp PID 1772 wrote to memory of 1136 1772 DriverEasy_Setup.exe DriverEasy_Setup.tmp PID 1772 wrote to memory of 1136 1772 DriverEasy_Setup.exe DriverEasy_Setup.tmp PID 1772 wrote to memory of 1136 1772 DriverEasy_Setup.exe DriverEasy_Setup.tmp PID 1772 wrote to memory of 1136 1772 DriverEasy_Setup.exe DriverEasy_Setup.tmp
Processes
-
C:\Users\Admin\AppData\Local\Temp\DriverEasy_Setup.exe"C:\Users\Admin\AppData\Local\Temp\DriverEasy_Setup.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-5M3C7.tmp\DriverEasy_Setup.tmp"C:\Users\Admin\AppData\Local\Temp\is-5M3C7.tmp\DriverEasy_Setup.tmp" /SL5="$7012C,4430333,1057792,C:\Users\Admin\AppData\Local\Temp\DriverEasy_Setup.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\is-1MIEJ.tmp\background_messagebox.pngFilesize
1KB
MD51549ea2cf00358fb791db13bcb773501
SHA1ed199cb343304bfc7116ce4755d6f7ff7b6304d1
SHA256d9cd2cee2f362d1388513d5da6031259ff9ce97e0f13a992c50077e8eaf33e54
SHA512a2892c12f5eaccc4216e8aa5a5a88f3a0ebdcebb142f145e218c5d94697e127eba613d2bafdc82700064714035df9a8420cabceddb65ea4ad6cde339c5af0a79
-
C:\Users\Admin\AppData\Local\Temp\is-1MIEJ.tmp\background_welcome.pngFilesize
10KB
MD5f048154d9062a3c2f147b6380ce6f3ac
SHA15abfa577139f41e7f28769f98304b878ad3df696
SHA2561d537619ea6508a383387d88e523522436e86dc72b929680e1552b10e44cf0f6
SHA5124875070a599a2afc5d8f6f4b0803397e1fc425807af90d377270b857da5631a78c9a61442572229c63891b7a5ecd96dcd8fc06329988dc6a97eec7db926e3e66
-
C:\Users\Admin\AppData\Local\Temp\is-1MIEJ.tmp\btn_browse.bmpFilesize
14KB
MD5a14d38bcad591c0f1a3cf9f5f77e3000
SHA1268665e61ff92a50f8060cb09fc1e1baa9dd16ad
SHA2561642d5ba407ad652fae4a4d10a00fc1c0728d94a6ef75a8d0901a2b315f1677e
SHA512e7527dab0a030bf9913528f7e7261e2be03bbcb6342b61e69d16b3ae1fcbec8e53f376ae9e4866aff6efae840f1578549e4034df852a260d7530583449a5598e
-
C:\Users\Admin\AppData\Local\Temp\is-1MIEJ.tmp\btn_install.bmpFilesize
70KB
MD5447126e21ba415d65a71e514987d08ed
SHA13c88bcd409acc7a239159cd658df50c79bdfddf1
SHA2561d0bc1f1d4ac68ecd6420a3031803620d5bfcb71dec93ad4f74e4cd1ee1be6c3
SHA51282cf2b1299cb85b88970111464f6cd2572e5cb4518aaa894bb5189e45616cd8cdce3fd260deaaa6b71f2a570883d09fb7cc4268d3116dde96b10f100a74244f0
-
C:\Users\Admin\AppData\Local\Temp\is-1MIEJ.tmp\button_browse.pngFilesize
2KB
MD5c7c746fcc5542d734a3860b425ac6a1e
SHA1fbec196d3b5b64ef14e10f6583c51206436f46cb
SHA2567cdac82567cdd9719a83bcb62c098c6d2b19d115f10e3db2b164b5f3b0ed1f89
SHA512e541b97fa6a6044ee95dde3b6f2d6232c4f1bf96c490eacce9be76eebdd760eacdb1b36fd4b720ca206a5e9ddea0870e0eae7b514f0edfdf0fdd80c594b677b6
-
C:\Users\Admin\AppData\Local\Temp\is-1MIEJ.tmp\button_close.pngFilesize
1KB
MD55f6a7af5eca52aa134a4a06832a5d005
SHA125ad7d62392ac4007e1ed1139e319edd14597f62
SHA2567d9ef408ad2520d62d4389c957e105d3fabf14697d2846b77e4fc488fbb84535
SHA5124001faa3b99fb852991106846889bf6e16b50c2977e6cf7749a89f1925f0e70f9265688dcb10376ed77d07a816f80e6484273877ad726ed046ca1c49a4e71ce1
-
C:\Users\Admin\AppData\Local\Temp\is-1MIEJ.tmp\button_minimize.pngFilesize
1KB
MD50327da652758a468b4a782e3392eb72b
SHA158fda11c77fd75c42142cbaf5a33c22d984da76d
SHA256a1c151e746184ba06e9ff178b4134fc8763f64a53d017486cbfb5b2a9af36ca0
SHA51207a3f282e64e4aa163052242747e10a0b3c0aeb8c70077840c6a00c3149025a95d0a4a21b43dfb546e274aa8354d71d3451e199fa7a8b35b7be3e9da714e4fd8
-
C:\Users\Admin\AppData\Local\Temp\is-1MIEJ.tmp\button_setup_or_next.pngFilesize
5KB
MD5b9e4b8247138afe12ae2157b20628de9
SHA17814f463723eea931c4c139bf6bb01bd0349d0c8
SHA2567877a7839c12c635271f4f03b980f80cb2cdd19b9c660e706edac85f2ca50022
SHA5127a612b1dc28fccdc8c47d0f68afa530dfccaa5c657a109cf1927ec983b6090bc3ddab8fed0826dbf4f5319d84fa4b2ba70714c9bd3027272d7dc334f3e3e4e5f
-
C:\Users\Admin\AppData\Local\Temp\is-1MIEJ.tmp\checkbox_license.pngFilesize
2KB
MD5b66aff516f0d0b51ac1330ad38f0da68
SHA13c7454547eb33669609f91716ae4cee0e4fbbb9b
SHA256e76216c1183152853638f804170efebe8d061d11c30ea9bf9e6ed1a9fcc6afed
SHA512b1ec90c4a69bc45fa59eeb27adc8ce168209fdf1653fbafee5775e76719c5a170e9eea1cefbd70837cc518d0ce86078a43a12dfa415514c0d96ff462dd670435
-
C:\Users\Admin\AppData\Local\Temp\is-1MIEJ.tmp\icon-info_60x60.pngFilesize
3KB
MD51df20e390976ad57765f1449e07cfd72
SHA1065e56256389918977f6fafb08dcc700572b9667
SHA2567a07b728ebede2cf1b4e81a50b7f5f9beae0975d4909c889e0d650472016663b
SHA51224465bd65a39c3631a2c4b8709fbb09b279bc21d2056cc21bec4253787ff5a60662b5869b0e912ed529f280745b0436f9b76ae0370625dc41aff03995d9a5b1c
-
C:\Users\Admin\AppData\Local\Temp\is-1MIEJ.tmp\icon_custom.pngFilesize
1KB
MD539ab68a67302e28f0ae08ec418890d2e
SHA1f3499299e54d05fff2ff8b888a1aacefa8f4e5fc
SHA256a22aa447e1f620098e969d56688e79cc4b3b729afe83a13468e86cd2927545df
SHA512efe3bbb6769bc9a694b994303bc56f566b2b532f31cc067d137df972d332c18541513327440f914671ec1253b3d0827ac6a3be1eb5c81f921ffe128587ecff39
-
C:\Users\Admin\AppData\Local\Temp\is-1MIEJ.tmp\icon_uncustom.pngFilesize
1KB
MD55a7f3314fbd8a3db765394798bc8a9ce
SHA12b48d22c07be26ac653e5ed30b8e816f96914345
SHA2562f67d842567176b42176784bb001ec63e3d84685fa35aebe5c23db20a969d427
SHA512d371ba564494c05d5fda955b1c6665473637b6d7bc0fe8c26ca57ec2133cc9664dab2bb4a5cdb02b2886ac94d64629f7af2edcbb7362ef4aedd53956ed31f824
-
C:\Users\Admin\AppData\Local\Temp\is-5M3C7.tmp\DriverEasy_Setup.tmpFilesize
3.2MB
MD55db3f851819182022dc6ab874814a992
SHA1663132eba6bdcd27a34ca6b6f9f9fc9bddde58b6
SHA256a6de4dae9e9f2df8f993fa629787887e63029e5b9eafb639451876d2739e0567
SHA5129606971c9e483d6d809de70fc48e3d2bf101a5407351d0dee8afb9577e18d04cf0a94b62f85caf249313609995d5e8840feba325c162149b1aaa7bc00f26b119
-
\Users\Admin\AppData\Local\Temp\is-1MIEJ.tmp\botva2.dllFilesize
37KB
MD567965a5957a61867d661f05ae1f4773e
SHA1f14c0a4f154dc685bb7c65b2d804a02a0fb2360d
SHA256450b9b0ba25bf068afbc2b23d252585a19e282939bf38326384ea9112dfd0105
SHA512c6942818b9026dc5db2d62999d32cf99fe7289f79a28b8345af17acf9d13b2229a5e917a48ff1f6d59715bdbcb00c1625e0302abcfe10ca7e0475762e0a3f41b
-
\Users\Admin\AppData\Local\Temp\is-1MIEJ.tmp\innocallback.dllFilesize
63KB
MD51c55ae5ef9980e3b1028447da6105c75
SHA1f85218e10e6aa23b2f5a3ed512895b437e41b45c
SHA2566afa2d104be6efe3d9a2ab96dbb75db31565dad64dd0b791e402ecc25529809f
SHA5121ec4d52f49747b29cfd83e1a75fc6ae4101add68ada0b9add5770c10be6dffb004bb47d0854d50871ed8d77acf67d4e0445e97f0548a95c182e83b94ddf2eb6b
-
\Users\Admin\AppData\Local\Temp\is-1MIEJ.tmp\isxdl.dllFilesize
121KB
MD548ad1a1c893ce7bf456277a0a085ed01
SHA1803997ef17eedf50969115c529a2bf8de585dc91
SHA256b0cc4697b2fd1b4163fddca2050fc62a9e7d221864f1bd11e739144c90b685b3
SHA5127c9e7fe9f00c62cccb5921cb55ba0dd96a0077ad52962473c1e79cda1fd9aa101129637043955703121443e1f8b6b2860cd4dfdb71052b20a322e05deed101a4
-
\Users\Admin\AppData\Local\Temp\is-5M3C7.tmp\DriverEasy_Setup.tmpFilesize
3.2MB
MD55db3f851819182022dc6ab874814a992
SHA1663132eba6bdcd27a34ca6b6f9f9fc9bddde58b6
SHA256a6de4dae9e9f2df8f993fa629787887e63029e5b9eafb639451876d2739e0567
SHA5129606971c9e483d6d809de70fc48e3d2bf101a5407351d0dee8afb9577e18d04cf0a94b62f85caf249313609995d5e8840feba325c162149b1aaa7bc00f26b119
-
memory/1136-223-0x0000000003330000-0x000000000333F000-memory.dmpFilesize
60KB
-
memory/1136-128-0x0000000003330000-0x000000000333F000-memory.dmpFilesize
60KB
-
memory/1136-135-0x00000000033C0000-0x00000000033D5000-memory.dmpFilesize
84KB
-
memory/1136-214-0x0000000003330000-0x000000000333F000-memory.dmpFilesize
60KB
-
memory/1136-213-0x0000000000400000-0x000000000074A000-memory.dmpFilesize
3.3MB
-
memory/1136-215-0x00000000033C0000-0x00000000033D5000-memory.dmpFilesize
84KB
-
memory/1136-216-0x0000000000240000-0x0000000000241000-memory.dmpFilesize
4KB
-
memory/1136-61-0x0000000000240000-0x0000000000241000-memory.dmpFilesize
4KB
-
memory/1136-224-0x00000000033C0000-0x00000000033D5000-memory.dmpFilesize
84KB
-
memory/1136-230-0x0000000000400000-0x000000000074A000-memory.dmpFilesize
3.3MB
-
memory/1136-262-0x0000000000400000-0x000000000074A000-memory.dmpFilesize
3.3MB
-
memory/1772-54-0x0000000000400000-0x000000000050F000-memory.dmpFilesize
1.1MB
-
memory/1772-212-0x0000000000400000-0x000000000050F000-memory.dmpFilesize
1.1MB