Analysis
- max time kernel
148s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260629-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
05/07/2026, 06:16
Behavioral task
behavioral1
Sample
CH341-USB-Serial-Drivers.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
15 signatures
150 seconds
General
- Target CH341-USB-Serial-Drivers.exe
- Size 2.2MB
- Sample260705-g1hsnset4q
- SHA256 2d4f8c3c6e4ec3c2bc278fab74bfc6a739b1c22f1ab735ed94a5a1a62648a6b0
- MD5 07e6892a8d0056d1f3dda44b7eb9f7b1
- SHA1 80a92facb6aaec7b861324ff9866a13dc931618b
- SHA512 2fcdd03489b50a6b71697419340181559a0201362d7a6f10de1b5351e4631af4628ef7dc0ea33e6e9a6d89d63fd88ce2f726ca4025e295841454f5ced8eba1b5
- SSDEEP 49152:IuI2hGK2ylKHGlpR1zW+W1BtXJI38IwmxkRC:I5OCV6R1zWhftSNwpRC
- TLSH T176B5D03FB28B753EE06E5A397A76E210583B766165124C1697F4C88CCF250B12E3E787
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell and hide display window.
pid Process 6008 powershell.exe - Drops file in Drivers directory 13 IoCs
description ioc Process File opened for modification C:\Windows\System32\Drivers\SETB41A.tmp DRVSETUP64.EXE File created C:\Windows\System32\Drivers\SETB41A.tmp DRVSETUP64.EXE File opened for modification C:\Windows\System32\Drivers\SETB587.tmp DRVSETUP64.EXE File created C:\Windows\System32\Drivers\SETB587.tmp DRVSETUP64.EXE File opened for modification C:\Windows\System32\Drivers\SETB655.tmp DRVSETUP64.EXE File created C:\Windows\System32\Drivers\SETB655.tmp DRVSETUP64.EXE File created C:\Windows\System32\Drivers\SETB1B2.tmp DRVSETUP64.EXE File opened for modification C:\Windows\System32\Drivers\CH341SER.SYS DRVSETUP64.EXE File opened for modification C:\Windows\System32\Drivers\SETB2AF.tmp DRVSETUP64.EXE File opened for modification C:\Windows\System32\Drivers\SETB4D8.tmp DRVSETUP64.EXE File created C:\Windows\System32\Drivers\SETB4D8.tmp DRVSETUP64.EXE File opened for modification C:\Windows\System32\Drivers\SETB1B2.tmp DRVSETUP64.EXE File created C:\Windows\System32\Drivers\SETB2AF.tmp DRVSETUP64.EXE - Executes dropped EXE 3 IoCs
pid Process 4280 CH341-USB-Serial-Drivers.tmp 3952 SETUP.EXE 3092 DRVSETUP64.EXE - Drops file in System32 directory 54 IoCs
description ioc Process File opened for modification C:\Windows\System32\DriverStore\Temp\{668ef1f3-75ee-b341-bdc4-40fa7d90d1e7}\CH341SER.CAT DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{668ef1f3-75ee-b341-bdc4-40fa7d90d1e7}\SETAF54.tmp DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{668ef1f3-75ee-b341-bdc4-40fa7d90d1e7}\CH341PT.DLL DrvInst.exe File opened for modification C:\Windows\System32\CatRoot2\dberr.txt DrvInst.exe File opened for modification C:\Windows\system32\SETB1C3.tmp DRVSETUP64.EXE File created C:\Windows\system32\SETB42A.tmp DRVSETUP64.EXE File created C:\Windows\system32\SETB5A8.tmp DRVSETUP64.EXE File opened for modification C:\Windows\system32\SETB676.tmp DRVSETUP64.EXE File opened for modification C:\Windows\System32\DriverStore\Temp\{668ef1f3-75ee-b341-bdc4-40fa7d90d1e7}\SETAF53.tmp DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{668ef1f3-75ee-b341-bdc4-40fa7d90d1e7}\CH341PORTSA64.DLL DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\ch341ser.inf_amd64_34a3206305b40d57\CH341PTA64.DLL DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\ch341ser.inf_amd64_34a3206305b40d57\CH341PT.DLL DrvInst.exe File opened for modification C:\Windows\system32\SETB2C0.tmp DRVSETUP64.EXE File opened for modification C:\Windows\system32\SETB42A.tmp DRVSETUP64.EXE File opened for modification C:\Windows\system32\SETB4E9.tmp DRVSETUP64.EXE File opened for modification C:\Windows\system32\SETB598.tmp DRVSETUP64.EXE File created C:\Windows\System32\DriverStore\Temp\{668ef1f3-75ee-b341-bdc4-40fa7d90d1e7}\SETAF65.tmp DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{668ef1f3-75ee-b341-bdc4-40fa7d90d1e7}\SETAF41.tmp DrvInst.exe File created C:\Windows\System32\DriverStore\Temp\{668ef1f3-75ee-b341-bdc4-40fa7d90d1e7}\SETAF52.tmp DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{668ef1f3-75ee-b341-bdc4-40fa7d90d1e7}\CH341SER.INF DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\ch341ser.inf_amd64_34a3206305b40d57.ini DrvInst.exe File created C:\Windows\System32\DriverStore\drvstore.tmp DrvInst.exe File created C:\Windows\System32\DriverStore\Temp\{668ef1f3-75ee-b341-bdc4-40fa7d90d1e7}\SETAF53.tmp DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{668ef1f3-75ee-b341-bdc4-40fa7d90d1e7}\CH341PTA64.DLL DrvInst.exe File created C:\Windows\System32\DriverStore\Temp\{668ef1f3-75ee-b341-bdc4-40fa7d90d1e7}\SETAF54.tmp DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{668ef1f3-75ee-b341-bdc4-40fa7d90d1e7}\CH341S64.SYS DrvInst.exe File created C:\Windows\system32\SETB4F9.tmp DRVSETUP64.EXE File opened for modification C:\Windows\system32\SETB5A8.tmp DRVSETUP64.EXE File opened for modification C:\Windows\system32\SETB666.tmp DRVSETUP64.EXE File opened for modification C:\Windows\System32\DriverStore\Temp\{668ef1f3-75ee-b341-bdc4-40fa7d90d1e7}\SETAF52.tmp DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{668ef1f3-75ee-b341-bdc4-40fa7d90d1e7}\SETAF65.tmp DrvInst.exe File created C:\Windows\system32\SETB1C4.tmp DRVSETUP64.EXE File opened for modification C:\Windows\system32\SETB2D1.tmp DRVSETUP64.EXE File opened for modification C:\Windows\system32\SETB4F9.tmp DRVSETUP64.EXE File created C:\Windows\System32\DriverStore\Temp\{668ef1f3-75ee-b341-bdc4-40fa7d90d1e7}\SETAF41.tmp DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{668ef1f3-75ee-b341-bdc4-40fa7d90d1e7}\SETAF66.tmp DrvInst.exe File opened for modification C:\Windows\system32\CH341PORTS.DLL DRVSETUP64.EXE File created C:\Windows\system32\SETB666.tmp DRVSETUP64.EXE File created C:\Windows\system32\SETB676.tmp DRVSETUP64.EXE File opened for modification C:\Windows\System32\DriverStore\FileRepository\ch341ser.inf_amd64_34a3206305b40d57\CH341PORTSA64.DLL DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\ch341ser.inf_amd64_34a3206305b40d57\CH341SER.INF DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{668ef1f3-75ee-b341-bdc4-40fa7d90d1e7} DrvInst.exe File opened for modification C:\Windows\system32\SETB1C4.tmp DRVSETUP64.EXE File created C:\Windows\system32\SETB2C0.tmp DRVSETUP64.EXE File created C:\Windows\system32\SETB2D1.tmp DRVSETUP64.EXE File opened for modification C:\Windows\system32\SETB42B.tmp DRVSETUP64.EXE File created C:\Windows\system32\SETB598.tmp DRVSETUP64.EXE File created C:\Windows\System32\DriverStore\Temp\{668ef1f3-75ee-b341-bdc4-40fa7d90d1e7}\SETAF66.tmp DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\ch341ser.inf_amd64_34a3206305b40d57\CH341S64.SYS DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\ch341ser.inf_amd64_34a3206305b40d57\CH341SER.CAT DrvInst.exe File created C:\Windows\system32\SETB1C3.tmp DRVSETUP64.EXE File opened for modification C:\Windows\system32\CH341PT.DLL DRVSETUP64.EXE File created C:\Windows\system32\SETB42B.tmp DRVSETUP64.EXE File created C:\Windows\system32\SETB4E9.tmp DRVSETUP64.EXE - Drops file in Windows directory 4 IoCs
description ioc Process File opened for modification C:\Windows\INF\setupapi.dev.log DRVSETUP64.EXE File opened for modification C:\Windows\INF\setupapi.dev.log DrvInst.exe File opened for modification C:\Windows\inf\oem1.inf DrvInst.exe File created C:\Windows\inf\oem1.inf DrvInst.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CH341-USB-Serial-Drivers.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CH341-USB-Serial-Drivers.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language powershell.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SETUP.EXE - Inno Setup is an open-source installation builder for Windows applications. 3 IoCs
Inno Setup installer
resource yara_rule behavioral2/memory/5016-0-0x0000000000820000-0x00000000008FC000-memory.dmp innosetup behavioral2/memory/5016-70-0x0000000000820000-0x00000000008FC000-memory.dmp innosetup behavioral2/memory/5016-141-0x0000000000820000-0x00000000008FC000-memory.dmp innosetup - Checks SCSI registry key(s) 3 TTPs 32 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000 DRVSETUP64.EXE Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Phantom DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\CompatibleIDs DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000 DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Phantom DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags DRVSETUP64.EXE Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\HardwareID DRVSETUP64.EXE Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\HardwareID DRVSETUP64.EXE Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\HardwareID DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000002 DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Phantom DRVSETUP64.EXE Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID DRVSETUP64.EXE Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\CompatibleIDs DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Phantom DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\CompatibleIDs DRVSETUP64.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000002 DRVSETUP64.EXE Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags DRVSETUP64.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000 DRVSETUP64.EXE Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\CompatibleIDs DRVSETUP64.EXE Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\CompatibleIDs DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\CompatibleIDs DRVSETUP64.EXE Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\CompatibleIDs DRVSETUP64.EXE Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\HardwareID DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000 DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Phantom DRVSETUP64.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000001 DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Phantom DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000001 DRVSETUP64.EXE Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\HardwareID DRVSETUP64.EXE Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\CompatibleIDs DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\HardwareID DrvInst.exe - Modifies data under HKEY_USERS 41 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs DrvInst.exe - Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 6008 powershell.exe 6008 powershell.exe - Suspicious use of AdjustPrivilegeToken 23 IoCs
description pid Process Token: SeDebugPrivilege 6008 powershell.exe Token: SeIncreaseQuotaPrivilege 6008 powershell.exe Token: SeSecurityPrivilege 6008 powershell.exe Token: SeTakeOwnershipPrivilege 6008 powershell.exe Token: SeLoadDriverPrivilege 6008 powershell.exe Token: SeSystemProfilePrivilege 6008 powershell.exe Token: SeSystemtimePrivilege 6008 powershell.exe Token: SeProfSingleProcessPrivilege 6008 powershell.exe Token: SeIncBasePriorityPrivilege 6008 powershell.exe Token: SeCreatePagefilePrivilege 6008 powershell.exe Token: SeBackupPrivilege 6008 powershell.exe Token: SeRestorePrivilege 6008 powershell.exe Token: SeShutdownPrivilege 6008 powershell.exe Token: SeDebugPrivilege 6008 powershell.exe Token: SeSystemEnvironmentPrivilege 6008 powershell.exe Token: SeRemoteShutdownPrivilege 6008 powershell.exe Token: SeUndockPrivilege 6008 powershell.exe Token: SeManageVolumePrivilege 6008 powershell.exe Token: 33 6008 powershell.exe Token: 34 6008 powershell.exe Token: 35 6008 powershell.exe Token: 36 6008 powershell.exe Token: SeLoadDriverPrivilege 3092 DRVSETUP64.EXE - Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 4280 CH341-USB-Serial-Drivers.tmp - Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 5016 wrote to memory of 4280 5016 CH341-USB-Serial-Drivers.exe 88 PID 4280 wrote to memory of 6008 4280 CH341-USB-Serial-Drivers.tmp 89 PID 6008 wrote to memory of 3952 6008 powershell.exe 92 PID 3952 wrote to memory of 3092 3952 SETUP.EXE 93
Processes
-
C:\Users\Admin\AppData\Local\Temp\CH341-USB-Serial-Drivers.exe"C:\Users\Admin\AppData\Local\Temp\CH341-USB-Serial-Drivers.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5016 -
C:\Users\Admin\AppData\Local\Temp\is-PE7XY5G547.tmp\CH341-USB-Serial-Drivers.tmp"C:\Users\Admin\AppData\Local\Temp\is-PE7XY5G547.tmp\CH341-USB-Serial-Drivers.tmp" /SL5="$B0044,1088934,842752,C:\Users\Admin\AppData\Local\Temp\CH341-USB-Serial-Drivers.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:4280 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -File "C:\Users\Admin\AppData\Local\Temp\is-K3JN0QKL01.tmp\CH341SER\Install-CH341SER-Auto.ps1" -NoPause3⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:6008 -
C:\Users\Admin\AppData\Local\Temp\is-K3JN0QKL01.tmp\CH341SER\SETUP.EXE"C:\Users\Admin\AppData\Local\Temp\is-K3JN0QKL01.tmp\CH341SER\SETUP.EXE" /S4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3952 -
C:\Users\Admin\AppData\Local\Temp\is-K3JN0QKL01.tmp\CH341SER\DRVSETUP64\DRVSETUP64.EXEC:\Users\Admin\AppData\Local\Temp\is-K3JN0QKL01.tmp\CH341SER\DRVSETUP64\DRVSETUP64.EXE \s5⤵
- Drops file in Drivers directory
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:3092
-
-
-
-
-
C:\Windows\system32\DrvInst.exeDrvInst.exe "4" "0" "C:\Users\Admin\AppData\Local\Temp\{1eeb3fa2-d195-5c42-9ae2-ae5b9df24bd8}\CH341SER.INF" "9" "4e5eabf5b" "00000000000000E0" "WinSta0\Default" "0000000000000168" "208" "C:\Users\Admin\AppData\Local\Temp\is-K3JN0QKL01.tmp\CH341SER\WIN 1X"1⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Modifies data under HKEY_USERS
PID:3500
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\IS-K3J~1.TMP\CH341SER\WIN1X~1\CH341PT.DLL
- Size 58KB
- SHA256 4fae54a4cc5cbfd5bd0a59b6aff3f888bebeb3c78521dadcdd1247b40012c580
- MD5 fff40ea944490b6bb79288dfaf0fc288
- SHA1 9eee498028485dc9f83781ad20980cb053b18419
- SHA512 2b5913f57148c951e446f529bb3246a74e22bd6cff7253815c651438906375973ae26dff21a14b1d9629e6442845767ba0fd9462e24bb4092b9a7ca2721dd74f
- SSDEEP 768:HDM3FrWK86sl/RCt8kcVQ59uFc4Kh1u3fTHEQzsyHQZ19zNEb1nzxOW9zWKKDPjo:41u67h1GTkQzsMizNO1nzUizW+OdkzR
- TLSH T11E435A93CC289002DCD664705388F6A36C7D56B62B9054F3F785F6D418A27E6EB2836F
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\IS-K3J~1.TMP\CH341SER\WIN1X~1\CH341P~1.DLL
- Size 69KB
- SHA256 7e2169a614c608475921c45ca9d73ad63cb3bc82b2198197e6aecb969b9ed0e4
- MD5 4beecf48670e0ca0d8685df35fc6e4bb
- SHA1 50136de7b84d9bea29f8db918e7aba2ee832f757
- SHA512 91efa5e0d19a311fe20150ac0c39505b1e0ddefca8e2dfe42e19d4f0ef52c552f6578596513961bffe955423fd784952aefe9549561e3e3fc627f1f1503dabdf
- SSDEEP 1536:t8s8+BJ2QNhe2isPCV7cYeuhzd6zUizITzR:t8hyJvh1iCq7cYDhSUik9
- TLSH T1B8632B6157A45143E8B3297056B8E6533D3DBFF62B30C54FA650A68C2871BC6EE3432B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\IS-K3J~1.TMP\CH341SER\WIN1X~1\CH341P~2.DLL
- Size 81KB
- SHA256 16ad9a058df6b58ce8259e086275b81f663f43202a2b7f0da7a634c356203e1d
- MD5 9a08e20878252a329128012ed5fd01a4
- SHA1 725c805db6b2a5466bf6205f127a894f73a97664
- SHA512 3b9717d9731fc4efde0b1be91c3bddecb83d2c03f58af90b24d0e7e68a0381c278ccff463af2f8b5e35637d058406a7d1040ae5feb15d88ee35e9b362ee70b1a
- SSDEEP 1536:m1WxG7H3ynh5GdMbcj0hzZfujzUizbCzrH:mc4HCnh5GybcAhd6UiS
- TLSH T1BE834C5283E84085E8B7EA3097FCCA53BD7579955B308ACF0250D95D0E33BC5DA3972A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\IS-K3J~1.TMP\CH341SER\WIN1X~1\CH341P~3.DLL
- Size 76KB
- SHA256 9f8b6dbe2b81a720184f0a0a269e17a90ed6da9ecbb3fa3d9fa32d2b95ab1adc
- MD5 2e85168392fa0dfdf61627a44b71d984
- SHA1 91f599dfe43cb13b512c71c8fceb3fbb5bb18f44
- SHA512 46756d6499b7634873c40d7ca0cab1c26584626633596637c82f1279b980396af846112acec6e24d43fe6b305a24aec6287f8a2bb995c91f630e3fe35625c125
- SSDEEP 1536:KmL1cYoQB2Z9fMIaETrV4KGJNzYgsz5q31Tzu:79ow2ZiIaE/V4KGTUde1Ty
- TLSH T15B737DC3E7189081DC7BE07042A9E267ECB536A5CB1029FF2B91EA500A537D5FB3D619
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\IS-K3J~1.TMP\CH341SER\WIN1X~1\CH341S64.SYS
- Size 82KB
- SHA256 a8cb7cf5050f9d14106b27d45d50dfb85f6cb119c0e871e673743ad62ecaeed0
- MD5 cceb043a4fa87236115ed4205e9f751a
- SHA1 a102530a0d0f3948e9c3f7e2c1daf8a313b7984c
- SHA512 87e2eecafc9e261567f43389a50a65c414b29c0b3ae889d8aa6ea910beabe6a4592deb2c663912d8bcb383a5cf26c4c7af940c2fff6f513c8bf41ecf962ad629
- SSDEEP 1536:9eI/Z0ULgTXI8yOdmaIvvY/NBiVlnn/H3zfrzUizb:9bWULWXIAdmAOVlnnf3zUiX
- TLSH T113837BD29AA940E6C9E7D5308279CEA3BF797098130497DF50C189180E97FD5AE3C3B9
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\IS-K3J~1.TMP\CH341SER\WIN1X~1\CH341SER.SYS
- Size 62KB
- SHA256 2e8a6011677450461adc019a3bcc1829424924cf0ee91906ce0e05ccecff370f
- MD5 3f4203eba812de55dea067d023f299e6
- SHA1 60eae124208864ff2e28cab23db08eb7d35b7d71
- SHA512 808da3d8cf190f9f5940565e17d18b28463d593c6127cac7e70aa5b97bd4004006730def132d57982ba75778103885f48be1da5e6ecf1525b97e4d2af2cd94f2
- SSDEEP 1536:DlzEOK3AFK6qN8MklwUrquS00EI8wXsC4dezJPdzUiza:VEO0AF8N8l6UsEI8wQI/Ui+
- TLSH T1BC534B61AD1404F3DCCA69F0E2ACB767743F56EB070066D711A0DAD45D9E3C2BE3826A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\is-K3JN0QKL01.tmp\CH341SER\CH341SER.CAT
- Size 14KB
- SHA256 b44f551843d0e36319ab4e911d4579a866b175201980daa9e8973919ad3fb1fe
- MD5 114f929bc857e5fae94efdbf419ac7e6
- SHA1 09cae5914d9ea880b5c511e889befec6f4db002a
- SHA512 e5eb153d857abd15d86edbf95d2be0d969412fbaaaf0a3c6bf23b953b9a4d82b2ced90decddb607086d1140228feb61d23e79c967a8dead8a9163cb5745f054c
- SSDEEP 192:+5MzDEQpDlqdmZUpjNrpyJw9EcyFIFIOckhLxyKR/2FWQFXiGnvM30LRLLX01k9Q:+oXZimUjHeFRJDkELRPR9zgd
- TLSH T1DE52E9B95A9D01C3E4AB987147D8D19FBC35A7D7AC00A97D21DBF7500983385FB0892E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\is-K3JN0QKL01.tmp\CH341SER\DRVSETUP64\DRVSETUP64.EXE
- Size 52KB
- SHA256 b5d55fa31753fcd86145c460d644bac78f171f51d708a050326234b4a2876c4c
- MD5 7ffb66cad5197396885b8835d79f0e29
- SHA1 87b539785f4d91a398f730bd4a77b31dec4d9fe2
- SHA512 ad7877d74416063ccd36e965ea15b95dfb6b6c9a3460ff3a1bf20390981e25ab479c82c2a2d82cc05a709c431386a080fd2bab4e87987f9d8c0e6d459ccad9ed
- SSDEEP 768:AV/9p0Ykw0qaWKUGjrqUiwykN8CNUQCEryu/HDnYiN82Eh:AV/9O3d9tNUQ2u/Dn7N8X
- TLSH T1A4335A429740A099E42AC23598FB573BCBB574144B3553EF7318C9112F223D3D97FAA6
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\is-K3JN0QKL01.tmp\CH341SER\Install-CH341SER-Auto.ps1
- Size 5KB
- SHA256 1d7988c1d9efcf4a05e2cfa60c139612aaae7e0dab640e085532675c134c60ed
- MD5 1d3661b5c7c87ea8f57ee0229faccaaa
- SHA1 5b9e9fa5f6bdf85ee87c7eeee451fa6dd7cfa77c
- SHA512 cb9d8d95286230e0de664a940dd3a755764f5ca243d460b1eaeced9b4132c4546c941ee209b7296864810b7132a95168c72829ca9fe4b20332cb15549b8e0071
- SSDEEP 96:Vylv/WBHm/rzJZ0VG5SpIjbHKTNqJglfNvnqrh9m3aDI2hCU0oxU2G27fjssSJL7:8v/WBHO3TB5SOjbqxqJS1khserCkxZAl
- TLSH T1B5C1870C97D4466256DB06EE2CA6A0027BDD406F501D2E80B8EC9184FFD906DC6F4BEB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\is-K3JN0QKL01.tmp\CH341SER\SETUP.EXE
- Size 90KB
- SHA256 b89fd6c6a1eb20df0fb347e9af5e935be2e6f2e2915b984543c0532e6d0ffaa2
- MD5 ee3c4e765ec0e7fcc1f69e4571dbc44a
- SHA1 e620c48f82d9e6bad321e343624b4ad627689d5b
- SHA512 71e83b588ea6eedff518850370209e7654c94d2494b28c55c399ebff96c58e9937caaaf1573011020d5f5010cf1643edcc65135abc4ceae81f043e1f5703b52d
- SSDEEP 1536:az5z0khtMnlTVLV63kWpCKLOFO0soj/s/359/7NW2Z:algAteQ0wDLOQfojs/J9/gI
- TLSH T19E937C1369D24873F061063121E217B69FBDAA132667E4DFFF1FC9414E7929282276F2
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\is-K3JN0QKL01.tmp\CH341SER\WIN 1X\CH341SER.INF
- Size 9KB
- SHA256 fb573086ee1b6f65d68a330cc4b48350439e3327c85292fc455b3588dff053a3
- MD5 867d71937ac1f93dbeb22e7de5cf677c
- SHA1 121188adcc605358564742aabc988e0dfe531fc3
- SHA512 ad43e8d38fabeecafa2919e6eeff6af254db90bde3dbcef0c8cc9d9aaa556abd4afc69372d83f9d102ad0b3ae641fbd393b736b9d70486f57cff3fe4c5cc211f
- SSDEEP 192:4F6pCs/xOFevOsZafiEOPQj94j4FJ4TvyhGQFuD4JSpQYQLhQfQYh6AT5qq:FCs/xOFevOsbEQQekF2TvyhVFuDISpQ4
- TLSH T12312AA3C9ECF34797A36633CAA47A8C2DFCA1B59B00066952BD466048EC8505D777CDB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\is-K3JN0QKL01.tmp\CH341SER\logs\ch341ser-auto-20260705-072149.log
- Size 329B
- SHA256 56816ccc26d917850bd4806b0137c64e4e41f1ecdab9b6ca0acc3e5fc6e59d5c
- MD5 adff503bc67db5c30c5aaf3ea7f08ed9
- SHA1 b8362e126a04e4915da602c21ef19dd59e296585
- SHA512 a182bba9c5ac52d7d4d4699c5eed5712211c63fe873e5f858f7642c02cdaa78254ddd77bd308689555e29c5ca23bed2d7a883676adbfd3d7aab8efe7e6a4722d
- TLSH T18CE0262812DFA284D37707CB8DE2D01946B6B8349D542659004482489D811128F32B33
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\is-PE7XY5G547.tmp\CH341-USB-Serial-Drivers.tmp
- Size 4.1MB
- SHA256 aceb078799a88255882e3344a0213f625f8836def840fb673bb60af8c94de9a0
- MD5 1d5936a0292a18f4ecd6f1b5e53a1938
- SHA1 446ca2318927fd29ac65d3f3a2e0b8f27c8fe983
- SHA512 1385547ef23e7b7631e0e225db26abb47809813936789b312fe04a8febed76f46cc1b0c8b5e8608e7710f1b02abcce3a61836478722fc8cd7bb908b7c3be1984
- SSDEEP 98304:PYU5hnuOajWwMPdCpepI3GrwrA+Js333q:ZxuHjWfZIzH
- TLSH T1F8168F03B388753EE4671A3A583FA284983F7A213A26CD4F6BF40D5C8F395416D2A757
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\DriverStore\FileRepository\ch341ser.inf_amd64_34a3206305b40d57.ini
- Size 768B
- SHA256 907e6a1dc6f6a8491288dfe3442305e446b26548c9706962d334cae7de9a7dc2
- MD5 b1ca123c73d2c6d9553588aea1e6b14f
- SHA1 39028a445acb6ea52c3cdb44ce55123e0c9fd15c
- SHA512 a6190d7d6ce8af0f4ef114d88a446f494ddaf8ee6e7f1ecdf068dbf5954a5809852d848974429710c4c1a77aca7f3180fe9c05650f23a10f5dfec616c7be01e2
- TLSH T108018532620EF2BCB006544CE32D9A31C089F7DA002517D03A14E9802B06832FBA39A7
- MD5 SHA1 SHA512 TLSH