Overview

overview

8

Static

static

3

CH34x_Inst..._4.exe

windows10-2004-x64

8

CH34x_Inst..._4.exe

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    147s
  • max time network
    143s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260911-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    13/11/2026, 04:49

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    CH34x_Install_Windows_v3_4.exe
  • Size 237KB
  • Sample261113-ff6tbsfx21
  • SHA256 9cf96fddf474eda80f2b4c09f8ef19443cf6768429819e4cba7b869291b7b8b5
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
discovery

Malware Config

Signatures

  • Drops file in Drivers directory 64 IoCs
  • Executes dropped EXE 2 IoCs
  • Drops file in System32 directory 64 IoCs
  • Drops file in Windows directory 4 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 32 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Modifies data under HKEY_USERS 41 IoCs
  • Suspicious use of AdjustPrivilegeToken 22 IoCs
  • Suspicious use of WriteProcessMemory 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\CH34x_Install_Windows_v3_4.exe
    "C:\Users\Admin\AppData\Local\Temp\CH34x_Install_Windows_v3_4.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:4584
    • C:\WCH.CN\CH341SER\SETUP.EXE
      "C:\WCH.CN\CH341SER\SETUP.EXE"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:540
      • C:\WCH.CN\CH341SER\DRVSETUP64\DRVSETUP64.EXE
        C:\WCH.CN\CH341SER\DRVSETUP64\DRVSETUP64.EXE
        3⤵
        • Drops file in Drivers directory
        • Executes dropped EXE
        • Drops file in System32 directory
        • Drops file in Windows directory
        • Checks SCSI registry key(s)
        • Suspicious use of AdjustPrivilegeToken
        PID:860
  • C:\Windows\system32\DrvInst.exe
    DrvInst.exe "4" "0" "C:\Users\Admin\AppData\Local\Temp\{5ff6de0e-0aa7-8749-bbf7-eff450e89926}\CH341SER.INF" "9" "4dbd0d02f" "0000000000000184" "WinSta0\Default" "0000000000000178" "208" "C:\WCH.CN\CH341SER"
    1⤵
    • Drops file in System32 directory
    • Drops file in Windows directory
    • Checks SCSI registry key(s)
    • Modifies data under HKEY_USERS
    PID:2976

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        CH341S64.SYS
        • Path C:\WCH.CN\CH341SER\CH341S64.SYS
        • Size 58KB
        • SHA256 de6ca1ae927081ac622f99ab9c77b2127cbb2df597b4123a4aa2f3da52cd64d5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        CH341S98.SYS
        • Path C:\WCH.CN\CH341SER\CH341S98.SYS
        • Size 19KB
        • SHA256 0ecd1222627271ea31d3b64796992b6daf5133d64cc26d43b3873cbe32fd59cb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        CH341SER.CAT
        • Path C:\WCH.CN\CH341SER\CH341SER.CAT
        • Size 10KB
        • SHA256 585fca8ab9c8a13222760d6bbab62ce4069d24f73bd304d89c54b5298b9420bd
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        CH341SER.INF
        • Path C:\WCH.CN\CH341SER\CH341SER.INF
        • Size 6KB
        • SHA256 0cbd34f89b0d11b386e07a825fab531706f86e9da44dcc536ac7c98a6d22c383
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        CH341SER.SYS
        • Path C:\WCH.CN\CH341SER\CH341SER.SYS
        • Size 40KB
        • SHA256 50877bc8ea82bbac833d25c9ac248e6fc9a240ab3c6d7e2c115667532c23676f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        CH341SER.VXD
        • Path C:\WCH.CN\CH341SER\CH341SER.VXD
        • Size 19KB
        • SHA256 2a946f316edd7e1185deeafdc2de52b2d2843198be098a724233c12f9ccd0dae
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        DRVSETUP64.EXE
        • Path C:\WCH.CN\CH341SER\DRVSETUP64\DRVSETUP64.EXE
        • Size 45KB
        • SHA256 a5a07ee7b5195497be4796845cb05b38618daaf2af98884b29eead6d073353b8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        SETUP.EXE
        • Path C:\WCH.CN\CH341SER\SETUP.EXE
        • Size 97KB
        • SHA256 a8f306d5ba1a23f587283fd410313f50ac1ac5ce1268938b065130a0dc84c658
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ch341ser.inf_amd64_084c012580251feb.ini
        • Path C:\Windows\System32\DriverStore\FileRepository\ch341ser.inf_amd64_084c012580251feb.ini
        • Size 420B
        • SHA256 bd41f9afe5049068882925230ccdece7ca59f0ae0a54d9f75fa9e79e7422b31a
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        SETECAE.tmp
        • Path C:\Windows\System32\SETECAE.tmp
        • Size 6KB
        • SHA256 45494ce819c1b5c21abb72dc47a0ca36807e0ed74ce55b631da174c77a9b24db
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        memory/4584-26-0x0000000000400000-0x0000000000421000-memory.dmp
        Download