Analysis
-
max time kernel
56s -
max time network
55s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-es -
resource tags
-
submitted
19-10-2024 19:15
General
-
Target
Driver_Updater_setup.exe
-
Size
6.5MB
-
MD5
60eadf6552fb282c9dd437890c0b5e24
-
SHA1
11d401803530793093a7e01e54ad627d72b3065c
-
SHA256
0e056015ea77714ef6307709779bc9b7ade3a0e3e730d6cee39e298056d9811b
-
SHA512
b4cc19f0ac5f333c73b1cb592276243f64ba44ba8b81e61bbf3d475c822b2faa18dad48a9795e6589c97ae12d4ff6c2de3a4d207ac3aae7ad4684d66d72916ed
-
SSDEEP
196608:Lw0d6YbAcnuLtG8ltisbd2WTXwLw/fDXGhQ/vPn:KOAlhlIslUMDXGhQ3Pn
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 3 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 6 IoCs
-
Loads dropped DLL 8 IoCs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Checks system information in the registry 2 TTPs 2 IoCs
System information is often read in order to detect sandboxing environments.
-
Drops file in System32 directory 2 IoCs
-
Drops file in Program Files directory 64 IoCs
-
Drops file in Windows directory 34 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 9 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Checks SCSI registry key(s) 3 TTPs 64 IoCs
SCSI information is often read in order to detect sandboxing environments.
-
Enumerates system info in registry 2 TTPs 5 IoCs
-
Modifies registry class 26 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of AdjustPrivilegeToken 40 IoCs
-
Suspicious use of FindShellTrayWindow 4 IoCs
-
Suspicious use of SendNotifyMessage 3 IoCs
-
Suspicious use of WriteProcessMemory 24 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Driver_Updater_setup.exe"C:\Users\Admin\AppData\Local\Temp\Driver_Updater_setup.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-RNK49.tmp\Driver_Updater_setup.tmp"C:\Users\Admin\AppData\Local\Temp\is-RNK49.tmp\Driver_Updater_setup.tmp" /SL5="$8006A,5854474,811008,C:\Users\Admin\AppData\Local\Temp\Driver_Updater_setup.exe"2⤵
- Executes dropped EXE
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\PC HelpSoft Driver Updater\PCHelpSoftDriverUpdater.exe"C:\Program Files (x86)\PC HelpSoft Driver Updater\PCHelpSoftDriverUpdater.exe" /INSTALL3⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Delete /TN "PC HelpSoft Driver Updater Schedule" /F4⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Delete /TN "PC HelpSoft Driver Updater Monitoring" /F4⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Program Files (x86)\PC HelpSoft Driver Updater\PCHelpSoftDriverUpdater.exe"C:\Program Files (x86)\PC HelpSoft Driver Updater\PCHelpSoftDriverUpdater.exe" /START /INSTALLED3⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- Checks system information in the registry
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\PC HelpSoft Driver Updater\PCHelpSoftDriverUpdater.exe"C:\Program Files (x86)\PC HelpSoft Driver Updater\PCHelpSoftDriverUpdater.exe" /TRAY4⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
-
C:\Users\Admin\AppData\Local\Temp\tmp52AF.tmp_collect\PCHelpSoftDriverUpdater.exe"C:\Users\Admin\AppData\Local\Temp\tmp52AF.tmp_collect\PCHelpSoftDriverUpdater.exe" /COLLECT4⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Program Files (x86)\PC HelpSoft Driver Updater\Extra\DriverPro.exe"C:\Program Files (x86)\PC HelpSoft Driver Updater\Extra\DriverPro.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
999KB
MD56de20d75ed981894ff5b8b89ccbc7499
SHA1066bfefdb6a22fcc69d8cd7b22b9b9657c4f8e73
SHA25623cc17c0e8c24f8084cd8a396e9aa33cb3e766d8b93cae54fc3857af825e7f36
SHA5121e9766a3102da84673779e6fe597a2e301d0c770754bfa943897fa5449b21403f7e0e05c110ba0b8f84b73d791ce37e5f01c3c58f8304b86bfc0fc492e604aff
-
Filesize
17KB
MD559fdee32d3f9b78f5584b0f41b0fd6f7
SHA1cd29d4fd4868027203e05aaac7540e3b56b76ae3
SHA256030e0280563f4e6cc76dc47fa8143fe2cae26684bf657e836fa250d6a44f8710
SHA512f94e38fe71227f055830124baa9b2aa5707ff4680f527bd10a71a73f43e5888056ec83ce77bc3097ed945d89861efdf44d2450fb905388bc09c4fb00c341e2ea
-
Filesize
16KB
MD5e105e39bd46b29fc3d9c8a45cc93b1a8
SHA1e8d29b02e57e223feea62b0bae930df9af064dd1
SHA256338afdb73932bfbd15c2627df805c5838efc1a0e624e84e7311389bdfb1fd54e
SHA512873f1cb99e02885a9f85b8ced3c0dd404f652b974f421bef77e223fe590488cf1202a55f48f784793cb34f68565a31e06d52496ba3aad8b52ff1287816c1ee09
-
Filesize
5.2MB
MD598ff049770433852a64f027caa567e71
SHA11c2589dfb5bea24fb439c333f1fe7bfb9719bd20
SHA256012da8993f671af5ff41ea38577a25822268763b766b17fa88398ec23e34aee5
SHA512c569301533bf64b5072d49bcd7a82f2c57dc877158345c2c8056842b98288935aa088a96edaf5f2d955a984d8087013760307e4a18b52a5c7892269c6b3e09d2
-
Filesize
17KB
MD5094069998ccb29d5a56a4e605394a639
SHA1440b4ecbff42c32d1ea1f299001f38675ac0190e
SHA256c2b9ef60261365303b536258831c93fc1804e09e1bb01a02b010fa7878cbd22e
SHA5126e6f443e6b744e2b62989cb92e8bb7561e5ef8aaef46dea35529107bdbce028894d0e8a150fd66f7ff1b287dce086fcf3b9f8defe3b985e73ae74bfb2431d21f
-
Filesize
15KB
MD51b2ffa92f211d9d0b7cdb536e99ce4b3
SHA1ec5b4885556194540bdb4a0166adbd081b591fae
SHA25610d7845b4f5ce17da1115eb60b054adaa32f424e349b21d8a46682eecc1b835e
SHA51286ac865a88a438bb4035b0b5473354b8aecd9963a79c67f5725813a585a0b94eb1ed049903fc5e8d8495d274fd23b88bdc7ac7c263e4c18e1c2492066873fa79
-
Filesize
17KB
MD507ace8db776a5db0a639fa6be292a277
SHA111b8003a8a5382b8e3dcd3b002b9de254f4c83d4
SHA256e6524a50756ca57f607acba31184b493d04030b31455ecd7d9ecdd9f875a6805
SHA512345071223110b19bb0b06e261929be7fd9c9249e7960296ad471bd86c28c605c5f9b9c3d3bd0123e4fb6d59badf80f077882b06cd78f0d6a4a47ecc035d2a348
-
Filesize
18KB
MD5d0d011e52fb74218b602003c376d94b3
SHA13024e6bd626d6dc3a684295e733eac740d2c53fe
SHA2560895c6e68dd04cdc888e93a82b60d59d807eb24b8002c2bdc8998bacc6246bee
SHA5128ebd6f8e6dc9b987c161d44b505e29b1840442cc2b46e67239a3aa33e1fa2257b9726c36a9527e0e9f17001ca02272f7ddf5676b36ec27472936a5c8f30c8eb1
-
Filesize
18KB
MD59f25fbf2d9d6db03a387895b9ad147b4
SHA142ffa865b058e4dbe41059c5c03b09ebe41cb7a6
SHA25667d2a2452dd77fa8deda9e1d5cf5710eeadc5ef29a85b7aac690420db2cbb62d
SHA5123b935261a4180e58464886355123193edf446512ecb61b941e3cffc2062ea51399802a4873760e35696e35afedfb9e647a904927f2cf4171e64b040bc29230a5
-
Filesize
17KB
MD5123b66fc5bdda63a8bba1b580511f6ac
SHA1abba14dfa8c91c0c98a2659a9e6751cb98383921
SHA256f809d4ea37d7c1d42c5d8ffe55b1bdeaa9065b2313b53810400297f70efecd44
SHA5122a942d9cbf31b3e6a30f66c6445ffe1c18582826c0a9f1d35268e99193b590762adc9f6aa14498b39285da873ea3b6ec87a3c48a79eafe7c4c2bfdc8634910f3
-
Filesize
21KB
MD5daba71201d5e8859ff518008a23bf1fe
SHA1f583f65604c1793d90c5b4ba72145f45af0894d7
SHA256cb73b7514d23b9958735a8bfdecbd5d77571be9cc23da9bb9724b01b9116e602
SHA512d187f38e7ab632656bb5fc3baae5bbbcf521a9f612e09dd03c536bd0c03482eb7a42116380aec1bfbf2b462f88c86cd7c29cc02e4f0030f2153edabf1e031dd4
-
Filesize
18KB
MD5a1aaaf95ea726ad6d5bb5e3ec030be59
SHA1f1b2341983c7d2a0a81b7f5786865219aeb22ca4
SHA25652bac3272f720b51fad93ac34cb9f244522752e82c833c7eb6edebb960d32369
SHA512c3db2fb4378733d7cca8d7dee651cb096fc6cf01dca8203643aa8cd9a6db0f411b222321ea51aac8361e2bd732c546a6cf7eb5f7cfca5f1e34692fd1e5dfd48e
-
Filesize
16KB
MD51f35efcde6db4dec93c94bba45be4542
SHA1359a683c1c959c0ad5cf7f7ead2a463fe4747842
SHA2561902747d9c60329c5752b869c1adf85c701b533471cf3c6c980f736d7551c4c4
SHA512d243d4ecaee6ad2ef06a73291db82ca9763b1d8f7a93c0f07b2b0f7b71a85b5773cfd99962aed6b2c600d86a228a5dfdbf17aee12106e5dd6dc9fedf6505a4c3
-
Filesize
17KB
MD585a03f193e27125d605b19804b43e0bb
SHA170d28931c8f5f19b59b1e719f1183a79f69efa62
SHA2564805389183887f3636646cb5897371bccf7d683b4e7cbd50e35d2675e1d7fac2
SHA512591c555a75ef380048583a4cda16888b2005dd103edfa2b4aea0b8aed459102f3a6781d34e4a2f533b25faaabefa980aafb546bdf743a55febf03c72c6000fb0
-
Filesize
17KB
MD5b95d52afe2aa053c0096a2567bd3e381
SHA19fd928fb9af44e30fc8bddcba4f42a319b567666
SHA2560e1c55e1acffc117656b552e9dc9fcab1bb5d4c8d15fdfaadedafe21222c0aea
SHA5125d6fefdab72dc5edae981a52a809eb840bdfb6f834f7881a7ac95d99fb4692e8ee1b66709696020564cd3f3c4bf13b1b2d01228f924272c8097dee7e02a3add1
-
Filesize
25KB
MD5f1e275534fe7d59ad3bebfda230d7370
SHA1cc11725efe67239f62e0d3ae063a27576ef67db3
SHA256c9e0b64103422fdc3f6a31ec2300b58e9540cc21346a0620c9f0901d16bdc405
SHA512b6045f90ee2e16d15a321c149beab0d91f6e4603a9582d1efabcccdaff53bb0aca8a7ca34219b19511f9a649b11fe35cc41ecb41989c29702470d1decf5496c1
-
Filesize
121B
MD5c12e324f7ba24c91f31927d7a720294a
SHA16fd195d957da6f1514cf790d0006b0690f91f4fd
SHA256bad8f599f3b38b7f67e77e26aec057fa8849c0cb80b72ac9e7265f9dcb3af199
SHA512c26954af817905c390707607ade5380400778b2d41d2309c1ec6fce76699252ece34aff9079d1c6b8a96c075a8b6711dd56060037dfc4bb11ee6ad9ca17233b4
-
Filesize
17KB
MD5839235142fedcf6eaacda727ab05dcb5
SHA199d860c34452d31d3c69f37bdb826bb9b45ab478
SHA256802b866f10646fef8facf3b5b45b714f800aa03a582c76c06d4b9cfe7e164c82
SHA512c145a8386e41aa9427d7a896aba5c6024daa3d9c2f2041325dc72b5c991aa43c24db0cb29138f0c91833c00528912ec787a5295fb832a8764c1e5f11b71a2dae
-
Filesize
16KB
MD51aab81548ef8bfb11b1e81bebee4f19f
SHA1073a5e57c51153da9454f3097f35f4213fc15d18
SHA2560b5578d884c760c2d1e4c2d4fb16459f15bc3871a55320e58e1d9d3bfe5a4bbd
SHA512f84cca8cc024a2c4427f9479aa719a1d0534053aa2dca7d4abd9fe759b32dea3cb91cbdad44d7e0b45f6c04515e3025d4a198704d826071d174e0fec92b71865
-
Filesize
8.2MB
MD521a4dadd5686773fe0ef880c22f07d38
SHA16236e9ec7eee10d95b3055a5e473fd2656898469
SHA25676ec2ea23b6d6cfd69699822a95e9032b9ef8100df19be91357c4e71a1f33b37
SHA512e8dc6bec5347f6d83cdab1df7683abc0d563603ea08dcd5acccbdb6ac3a6efdbaa88dbdff5c257251eaa1c5311947a581d4a2bd506cbf3fbddba1e46471683c9
-
Filesize
960KB
MD511a813c0972b740937d3a7e2daf9ffcb
SHA14245b5a3c97f725c56a29d745767edebb5e3f15d
SHA2563f933bced2d9f65d48f7c48715bf286fd431341a74e1ce15d39b7c4c96603cf9
SHA5129a590dcab0cf7051d04743736ea7a6b74fa0f87539580cc41a58ad33a76574201e7b6d54d5100cbcd262266bc55b053243edd4860a2d43deeb1c164395e4a941
-
Filesize
62KB
MD57c3a3ab83437e7f6e22e211d4d238292
SHA1da215cc0e6baa19bc93e398449700ffe0a70a0fb
SHA256d67e284f9c2732ba1d8244fbe52311a158c48ebb17aeb3a90a23609cebce4794
SHA5126196c49da014e1719303b9682f8ad0efa97f97cbe8f2aaba1ab2ac00dd1dec82ae072ae3017e6eb0dc2ba35853a67e8ca8e4bd4ae25a35d0370ef166d8eca2f0
-
Filesize
640KB
MD5842e8edbfbeffb9ef234a2da6d5980fe
SHA1f76e944e5ac3c489d987a11a313b41dee3e813f3
SHA256ec30f1214fa645b8e436142acab6cc9a07f5c4e3414b5e539a832df9237a7bb3
SHA5121ca9449dffa72b274b842b3a1f2008d3f13c6f423e7ac466e2efb97fe2103e1aea052a5e8a9839083061154fb61ec870fbe8e35164b386a3aa0aaaf8064a0ed4
-
Filesize
398KB
MD53892af3a2540cf8567d89f5e52837d6c
SHA19f52ec519d454d32a8b446b54b547cbff81cf4bf
SHA256db6383d6291c8842131ab741217ee4a22685ed87934aa470a22d0c755aa52e37
SHA512d97ddf70c1f7609def62ba66a0721f0a815ad014c071bf514ab048ea4d7495ad23b8f5e149f0aae17144be3fa8612e1e253acc0a11889673fbc19d6c60e4473d
-
Filesize
3.0MB
MD5dfd93de42e9578134afa014f60acbe36
SHA19a0e08fd5122a5f7688b05868aa51e4e2c69a647
SHA2569d2d3263a5b32dbb2dd9532aa571c1e07da9a2df228e5389872df126126bdabc
SHA5124b6858c06a93e107e9854d4e5892da171d28c069fe7cea465c66e9e5dbb98285d165bf50281d8d00390263b99323222bc7c87017bb24c90c6529a3406faa0100
-
Filesize
99KB
MD5a54a3986d08c2384ef2b1e16b38cbae5
SHA166cd18d4831a51b6a631059d448cd9ffa361525f
SHA2563c68b044322f9c56afc4e8c00bff630a2aed221871b1bd4fa1183892fdfe17fd
SHA5126581b22c5e57abea02fb2d2180ab75c41ccadb80356c51de14accb1c01cda516374ce4d337b5ab0cfdcf08b89f1b77e91447ba1a2491c45ee76b9c69b69fb9de
-
Filesize
735B
MD505e74dcd8c2770d15454ac5a7b4684f2
SHA1767089de93c19a9b253ee453048d024668a02758
SHA25652e931772eb6b8e4418ded2e5bdeed47e36da26dab2317fe724491c639bd7bd6
SHA512e3d9ea44d85c490ad0dc48bdd44e196ed46abb6607b6474df10563cc290e1835f087263b3b6196435d7ba0a9f6570ee026ebf0a07b58e46fb2bf4339c1837265
-
Filesize
229B
MD5efd52b06c521742c269631ac2f2e4441
SHA19325e153ba4542301bf7bdbe1cc7f31c6f62491d
SHA256c2061d5c954a47fb059946f41eeae106aa957522d8d5e2a31a59d25de7031bce
SHA51226864c1f35f70df199a17ee14dc35e74e19255c946cd35c237b4c15c117b7accf101c0304d69ca03d4afa42fa9a1f7de350af0b9b8168bb0ea4a0b390965812c
-
Filesize
5KB
MD5e8872c0cb4648746485d2cb1b411632b
SHA191beab9a9601e24ca13a3c190a03b7ab106c78f8
SHA25671fc32bdb1b0a2a8b4fa8c2084c6f062c58e41811c8dbcd9c4731e79e6c0a9e1
SHA51201cc9a0affb7e963154ab109594705a534d83686c7b1ac4dca0c2ecf4f27a16d69d83dc2d96f16e7d1c96dfc0331b815f73c1851082f98c8ee7a71aef77b6c61
-
Filesize
6KB
MD5eefefb97b50ffb44b19751fafe8ebe0d
SHA1e0ffad9bb35a0e1b289097f8e62eeb362af1549a
SHA2565772d503ea168cdd5149cb58066ce37fb9ae224e83481ff555afbcb88320fc4b
SHA51203c7a6e083b01e267d8be4c17bd89685cfa257ab247f0406578c86fa85867de31a284f852fc0d211bc9da8633c301ab550fc604b2603099b133e9a7e950f7902
-
Filesize
94KB
MD59c2f58f9c4a0e80b3c445c633d2579e1
SHA142624028eb5c16f0e126cf0241ee5a90c7a2af3d
SHA2568277b91fbbf185687cf396d8b71e9973c132e83dd9524df3e0fdd51bd7d17ef0
SHA51203d86d2c3b0bc19851cef6fe5988201cc459bea0190a159d285baf699bc30994a809515eb982a9f3ab3e2a080d6ac62ff51a53667467b6ea4e2e5c5c1ea319d5
-
Filesize
7KB
MD51fef128ac1f2d5e31aafd853e0192a69
SHA17b6ba933e54244445c5450f36d8bae3674f0d7f7
SHA256170e852032ab5b89990b3457f4ae8a67026ee2d7c2523d9fb32d3020616000ef
SHA512c4aff1bdf5669fdd32dea6fa307c0afbd179084d10af9ec235dff6ed4a4a40722495f8a742328e238c29898dd3737e7ddb0df5adc72cff25aecd961a59f67fdb
-
Filesize
153KB
MD518a9e38d5a10a1b1e19d1dd39c0b7650
SHA18df2f7bd213c3bd26d7f7584dd9382e2e68e471d
SHA2565ecaf04b960f43621695632daf9a19d81a0b4598f65ab46ece746f773d86f751
SHA512dbc2d86f1072e520640a8cc7bd9a383edda5ea7664d69bec65a2c18f2c596ac9ca7111469a01d6f6e1b35eb5f0a56ad1106b8728eab658765e1c047cfc92e06f
-
Filesize
5KB
MD5f84d8e25a9fd1868a9bf87c4f6111ad3
SHA128f0d6a33ec1bffd8217f37a803d51c251343256
SHA2565d2d23dfb3573c5a3014682c1002d2e1123f156bcbdbb226e363c44880040228
SHA5127afef82a24feade4d19ed2b6de9e2e14df5e69f264a2cb6eaa2f59fe1eb750888c562bdea0f0c0b2d554c70e5b5b91aee91c7290b1c07f557fa5fbe749c86921
-
Filesize
3.1MB
-
Filesize
3.1MB
-
Filesize
3.1MB
-
Filesize
3.1MB
-
Filesize
8.2MB
-
Filesize
8.2MB
-
Filesize
588KB
-
Filesize
8.2MB
-
Filesize
8.2MB
-
Filesize
4KB
-
Filesize
8.2MB
-
Filesize
588KB
-
Filesize
728KB
-
Filesize
844KB
-
Filesize
844KB
-
Filesize
844KB
-
Filesize
8.2MB
-
Filesize
1.0MB
-
Filesize
588KB
-
Filesize
8.2MB
-
Filesize
8.2MB
-
Filesize
588KB
-
Filesize
8.2MB
-
Filesize
5.2MB
-
Filesize
588KB
-
Filesize
588KB
-
Filesize
8.2MB