Overview

overview

8

Static

static

3

CH34x_Inst..._4.exe

windows10-2004-x64

8

CH34x_Inst..._4.exe

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    149s
  • max time network
    140s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260911-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    13/11/2026, 04:49

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    CH34x_Install_Windows_v3_4.exe
  • Size 237KB
  • Sample261113-ff6tbsfx21
  • SHA256 9cf96fddf474eda80f2b4c09f8ef19443cf6768429819e4cba7b869291b7b8b5
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
discovery

Malware Config

Signatures

  • Drops file in Drivers directory 64 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 2 IoCs
  • Drops file in System32 directory 64 IoCs
  • Drops file in Windows directory 5 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 42 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Modifies data under HKEY_USERS 41 IoCs
  • Suspicious use of AdjustPrivilegeToken 12 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\CH34x_Install_Windows_v3_4.exe
    "C:\Users\Admin\AppData\Local\Temp\CH34x_Install_Windows_v3_4.exe"
    1⤵
    • Checks computer location settings
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:1040
    • C:\WCH.CN\CH341SER\SETUP.EXE
      "C:\WCH.CN\CH341SER\SETUP.EXE"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:2296
      • C:\WCH.CN\CH341SER\DRVSETUP64\DRVSETUP64.EXE
        C:\WCH.CN\CH341SER\DRVSETUP64\DRVSETUP64.EXE
        3⤵
        • Drops file in Drivers directory
        • Executes dropped EXE
        • Drops file in System32 directory
        • Drops file in Windows directory
        • Checks SCSI registry key(s)
        • Suspicious use of AdjustPrivilegeToken
        PID:1988
  • C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k DcomLaunch -p -s DeviceInstall
    1⤵
    • Drops file in Windows directory
    • Checks SCSI registry key(s)
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:3080
    • C:\Windows\system32\DrvInst.exe
      DrvInst.exe "4" "0" "C:\Users\Admin\AppData\Local\Temp\{44206d62-1384-5a48-af61-e3da7fb91f9d}\CH341SER.INF" "9" "4dbd0d02f" "000000000000013C" "WinSta0\Default" "000000000000015C" "208" "C:\WCH.CN\CH341SER"
      2⤵
      • Drops file in System32 directory
      • Drops file in Windows directory
      • Checks SCSI registry key(s)
      • Modifies data under HKEY_USERS
      PID:2228

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        SETEB94.tmp
        • Path C:\Users\Admin\AppData\Local\Temp\{44206d62-1384-5a48-af61-e3da7fb91f9d}\SETEB94.tmp
        • Size 10KB
        • SHA256 585fca8ab9c8a13222760d6bbab62ce4069d24f73bd304d89c54b5298b9420bd
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        SETEB96.tmp
        • Path C:\Users\Admin\AppData\Local\Temp\{44206d62-1384-5a48-af61-e3da7fb91f9d}\SETEB96.tmp
        • Size 58KB
        • SHA256 de6ca1ae927081ac622f99ab9c77b2127cbb2df597b4123a4aa2f3da52cd64d5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        CH341PT.DLL
        • Path C:\WCH.CN\CH341SER\CH341PT.DLL
        • Size 6KB
        • SHA256 45494ce819c1b5c21abb72dc47a0ca36807e0ed74ce55b631da174c77a9b24db
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        CH341SER.INF
        • Path C:\WCH.CN\CH341SER\CH341SER.INF
        • Size 6KB
        • SHA256 0cbd34f89b0d11b386e07a825fab531706f86e9da44dcc536ac7c98a6d22c383
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        DRVSETUP64.EXE
        • Path C:\WCH.CN\CH341SER\DRVSETUP64\DRVSETUP64.EXE
        • Size 45KB
        • SHA256 a5a07ee7b5195497be4796845cb05b38618daaf2af98884b29eead6d073353b8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        SETUP.EXE
        • Path C:\WCH.CN\CH341SER\SETUP.EXE
        • Size 97KB
        • SHA256 a8f306d5ba1a23f587283fd410313f50ac1ac5ce1268938b065130a0dc84c658
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        SETF129.tmp
        • Path C:\Windows\System32\SETF129.tmp
        • Size 19KB
        • SHA256 2a946f316edd7e1185deeafdc2de52b2d2843198be098a724233c12f9ccd0dae
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        SETEE82.tmp
        • Path C:\Windows\System32\drivers\SETEE82.tmp
        • Size 40KB
        • SHA256 50877bc8ea82bbac833d25c9ac248e6fc9a240ab3c6d7e2c115667532c23676f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        SETF12A.tmp
        • Path C:\Windows\System32\drivers\SETF12A.tmp
        • Size 19KB
        • SHA256 0ecd1222627271ea31d3b64796992b6daf5133d64cc26d43b3873cbe32fd59cb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        memory/1040-28-0x0000000000400000-0x0000000000421000-memory.dmp
        Download