26:I[7638,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/3l_wb6il5gi_h.js","/_next/static/chunks/136wug8odqdqr.js"],"SampleDetailWrapper"] 3c:I[27201,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js"],"IconMark"] 25:T507,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious DriverPack.A potentially unwanted application Sample 574d0ca9cda5… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample 574d0ca9cda5…. Malware family: DriverPack.A potentially unwanted application. Threat score 100/100. 10/25 AV engines flagged this file. 13 malicious and 25 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/574d0ca9cda56cd8dd6398baf3e1cdcf56e9ca4f71d85d9155fac4325444ea25","keywords":["Malicious","DriverPack.A potentially unwanted application","malware analysis","sandbox report","threat intelligence","574d0ca9cda56cd8dd6398baf3e1cdcf56e9ca4f71d85d9155fac4325444ea25"],"about":{"@type":"SoftwareApplication","name":"DrvUpdater.exe","applicationCategory":["peexe","executable"],"identifier":"574d0ca9cda56cd8dd6398baf3e1cdcf56e9ca4f71d85d9155fac4325444ea25","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"DriverPack.A potentially unwanted application","antivirusDetections":{"malicious":10,"total":25},"behavioralIndicators":{"malicious":13,"suspicious":25},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}27:T980,Observed string: "VirtualAlloc" (Indicator: "VirtualAlloc") in Source: 574d0ca9cda56cd8dd6398baf3e1cdcf56e9ca4f71d85d9155fac4325444ea25.bin Observed string: "VirtualFree" (Indicator: "VirtualFree") in Source: 574d0ca9cda56cd8dd6398baf3e1cdcf56e9ca4f71d85d9155fac4325444ea25.bin Observed string: "VirtualAlloc" (Indicator: "VirtualAlloc") in Source: 00000000-00003572.00000000.77969.010B1000.00000040.mdmp 00000000-00003572.00000000.77969.01117000.00000004.mdmp Observed string: "VirtualFree" (Indicator: "VirtualFree") in Source: 00000000-00003572.00000000.77969.010B1000.00000040.mdmp 00000000-00003572.00000000.77969.01117000.00000004.mdmp Observed string: "SetupDiDestroyDeviceInfoList" (Indicator: "SetupDiDestroyDeviceInfoList") in Source: 00000000-00003572.00000000.77969.010B1000.00000040.mdmp Observed string: "VirtualAlloc" (Indicator: "VirtualAlloc") in Source: 00000000-00004260.00000000.78414.00261000.00000040.mdmp 00000000-00004260.00000000.78414.002C7000.00000004.mdmp 00000000-00004260.00000001.80336.00261000.00000040.mdmp 00000000-00004260.00000001.80336.002C7000.00000004.mdmp 00000000-00004260.00000002.82253.00261000.00000040.mdmp 00000000-00004260.00000002.82253.002C7000.00000004.mdmp Observed string: "VirtualFree" (Indicator: "VirtualFree") in Source: 00000000-00004260.00000000.78414.00261000.00000040.mdmp 00000000-00004260.00000000.78414.002C7000.00000004.mdmp 00000000-00004260.00000001.80336.00261000.00000040.mdmp 00000000-00004260.00000001.80336.002C7000.00000004.mdmp 00000000-00004260.00000002.82253.00261000.00000040.mdmp 00000000-00004260.00000002.82253.002C7000.00000004.mdmp Observed string: "SetupDiDestroyDeviceInfoList" (Indicator: "SetupDiDestroyDeviceInfoList") in Source: 00000000-00004260.00000000.78414.00261000.00000040.mdmp 00000000-00004260.00000001.80336.00261000.00000040.mdmp 00000000-00004260.00000002.82253.00261000.00000040.mdmp Observed string: "VirtualAlloc" (Indicator: "VirtualAlloc") in Source: 00000000-00006724.00000000.89696.00261000.00000040.mdmp 00000000-00006724.00000000.89696.002C7000.00000004.mdmp Observed string: "VirtualFree" (Indicator: "VirtualFree") in Source: 00000000-00006724.00000000.89696.00261000.00000040.mdmp 00000000-00006724.00000000.89696.002C7000.00000004.mdmp Observed string: "SetupDiDestroyDeviceInfoList" (Indicator: "SetupDiDestroyDeviceInfoList") in Source: 00000000-00006724.00000000.89696.00261000.00000040.mdmp28:T1df8,"DrvUpdater.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00003572) "DrvUpdater.exe" called "RtlGetVersion" (UID: 00000000-00003572) "DrvUpdater.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f0000020000000000ffff0000000050d8900038cf47772c24b100bcd8900001000000e023b1002c24b100e023b100040000000400000000e0be7600100000bcd8900001000000e023b100cd9747779c974777f381ae96b50fb576e023b10000004777000000003c0a2e760000000080eebb760100000000000000f8e2be76000000000400000080a9dc734840bd76f8e2be76c0d8900080e85274200eb20080e85274bcd890000000000080e852746c76dcfffeffffff00000000000000000000000005000000d862b40002000000020000000a000000c862b400d862b40000000000d01e85bd40db9000ddf3b27634d9900000000000c862b4000a000000f8f3b276c862b400 (UID: 00000000-00003572) "DrvUpdater.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f000002000000000000000000000000000000000000001030b6000000b1000000b1001030b6003888b1003888b1007f070000c000b100b8f5b500ccd79000d2fb457701000000ff070000fa3300001030b6000000b10000000000000000000000b1000000000000000000fc1d000000000000b812fb00ff070000fa330000fa3300000000b10000000000000000000782ae96086afb000000fb00020000001030b60000000000000000000000000004000004b812fb0080dc90005cdc900081f16076b812fb0098e1900028de9000c5f160760000b10098344777e82cb60088dc90001c605d760400000080dc90005c834774b012fb00a0906476000000003cd99000fcffffff (UID: 00000000-00003572) "DrvUpdater.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff000000000000000000000000a64ab600bc4ab600 (UID: 00000000-00003572) "DrvUpdater.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000007e3bb600963bb600 (UID: 00000000-00003572) "DrvUpdater.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff000000000000000000000000ee33b6000234b600 (UID: 00000000-00003572) "DrvUpdater.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff000000000000000000000000a64ab600be4ab600 (UID: 00000000-00003572) "DrvUpdater.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000003ec5b60054c5b600 (UID: 00000000-00003572) "DrvUpdater.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff00000000000000000000000066cab6007ecab600 (UID: 00000000-00003572) "DrvUpdater.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000008ec9b600a6c9b600 (UID: 00000000-00003572) "DrvUpdater.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00003572) "DrvUpdater.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000000eecb60026ecb600 (UID: 00000000-00003572)29:Ta19,Observed API string: "SetupDiGetClassDevsA" which can detect virtual environments. (Indicator: "SetupDiGetClassDevs") in Source: 574d0ca9cda56cd8dd6398baf3e1cdcf56e9ca4f71d85d9155fac4325444ea25.bin Observed API string: "SetupDiGetDeviceRegistryPropertyA" which can detect virtual environments. (Indicator: "SetupDiGetDeviceRegistryProperty") in Source: 00000000-00003572.00000000.77969.010B1000.00000040.mdmp Observed API string: "SetupDiEnumDeviceInfo" which can detect virtual environments. (Indicator: "SetupDiEnumDeviceInfo") in Source: 00000000-00003572.00000000.77969.010B1000.00000040.mdmp Observed API string: "SetupDiGetClassDevsA" which can detect virtual environments. (Indicator: "SetupDiGetClassDevs") in Source: 00000000-00003572.00000000.77969.010B1000.00000040.mdmp 00000000-00003572.00000000.77969.01117000.00000004.mdmp Observed API string: "SetupDiGetDeviceRegistryPropertyA" which can detect virtual environments. (Indicator: "SetupDiGetDeviceRegistryProperty") in Source: 00000000-00004260.00000000.78414.00261000.00000040.mdmp 00000000-00004260.00000001.80336.00261000.00000040.mdmp 00000000-00004260.00000002.82253.00261000.00000040.mdmp Observed API string: "SetupDiEnumDeviceInfo" which can detect virtual environments. (Indicator: "SetupDiEnumDeviceInfo") in Source: 00000000-00004260.00000000.78414.00261000.00000040.mdmp 00000000-00004260.00000001.80336.00261000.00000040.mdmp 00000000-00004260.00000002.82253.00261000.00000040.mdmp Observed API string: "SetupDiGetClassDevsA" which can detect virtual environments. (Indicator: "SetupDiGetClassDevs") in Source: 00000000-00004260.00000000.78414.00261000.00000040.mdmp 00000000-00004260.00000000.78414.002C7000.00000004.mdmp 00000000-00004260.00000001.80336.00261000.00000040.mdmp 00000000-00004260.00000001.80336.002C7000.00000004.mdmp 00000000-00004260.00000002.82253.00261000.00000040.mdmp 00000000-00004260.00000002.82253.002C7000.00000004.mdmp Observed API string: "SetupDiGetDeviceRegistryPropertyA" which can detect virtual environments. (Indicator: "SetupDiGetDeviceRegistryProperty") in Source: 00000000-00006724.00000000.89696.00261000.00000040.mdmp Observed API string: "SetupDiEnumDeviceInfo" which can detect virtual environments. (Indicator: "SetupDiEnumDeviceInfo") in Source: 00000000-00006724.00000000.89696.00261000.00000040.mdmp Observed API string: "SetupDiGetClassDevsA" which can detect virtual environments. (Indicator: "SetupDiGetClassDevs") in Source: 00000000-00006724.00000000.89696.00261000.00000040.mdmp 00000000-00006724.00000000.89696.002C7000.00000004.mdmp2a:T6ec,Observed string: "GetLocaleInfoEx" [Source: 00000000-00003572-00000C1E-74709421] Observed string: "GetUserDefaultLCID" [Source: 00000000-00003572.00000000.77969.010B1000.00000040.mdmp] Observed string: "GetLocaleInfoW" [Source: 00000000-00003572.00000000.77969.010B1000.00000040.mdmp] Observed string: "EnumSystemLocalesA" [Source: 00000000-00003572.00000000.77969.010B1000.00000040.mdmp] Observed string: "GetLocaleInfoA" [Source: 00000000-00003572.00000000.77969.010B1000.00000040.mdmp] Observed string: "GetUserDefaultLCID" [Source: 00000000-00004260.00000000.78414.00261000.00000040.mdmp 00000000-00004260.00000001.80336.00261000.00000040.mdmp 00000000-00004260.00000002.82253.00261000.00000040.mdmp] Observed string: "GetLocaleInfoW" [Source: 00000000-00004260.00000000.78414.00261000.00000040.mdmp 00000000-00004260.00000001.80336.00261000.00000040.mdmp 00000000-00004260.00000002.82253.00261000.00000040.mdmp] Observed string: "EnumSystemLocalesA" [Source: 00000000-00004260.00000000.78414.00261000.00000040.mdmp 00000000-00004260.00000001.80336.00261000.00000040.mdmp 00000000-00004260.00000002.82253.00261000.00000040.mdmp] Observed string: "GetLocaleInfoA" [Source: 00000000-00004260.00000000.78414.00261000.00000040.mdmp 00000000-00004260.00000001.80336.00261000.00000040.mdmp 00000000-00004260.00000002.82253.00261000.00000040.mdmp] Observed string: "GetUserDefaultLCID" [Source: 00000000-00006724.00000000.89696.00261000.00000040.mdmp] Observed string: "GetLocaleInfoW" [Source: 00000000-00006724.00000000.89696.00261000.00000040.mdmp] Observed string: "EnumSystemLocalesA" [Source: 00000000-00006724.00000000.89696.00261000.00000040.mdmp] Observed string: "GetLocaleInfoA" [Source: 00000000-00006724.00000000.89696.00261000.00000040.mdmp]2b:T688,Observed string: "FileTimeToSystemTime" (Indicator: "FileTimeToSystemTime") in Source: 00000000-00003572.00000000.77969.010B1000.00000040.mdmp Observed string: "FileTimeToLocalFileTime" (Indicator: "FileTimeToLocalFileTime") in Source: 00000000-00003572.00000000.77969.010B1000.00000040.mdmp Observed string: "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime") in Source: 00000000-00003572.00000000.77969.010B1000.00000040.mdmp Observed string: "FileTimeToSystemTime" (Indicator: "FileTimeToSystemTime") in Source: 00000000-00004260.00000000.78414.00261000.00000040.mdmp 00000000-00004260.00000001.80336.00261000.00000040.mdmp 00000000-00004260.00000002.82253.00261000.00000040.mdmp Observed string: "FileTimeToLocalFileTime" (Indicator: "FileTimeToLocalFileTime") in Source: 00000000-00004260.00000000.78414.00261000.00000040.mdmp 00000000-00004260.00000001.80336.00261000.00000040.mdmp 00000000-00004260.00000002.82253.00261000.00000040.mdmp Observed string: "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime") in Source: 00000000-00004260.00000000.78414.00261000.00000040.mdmp 00000000-00004260.00000001.80336.00261000.00000040.mdmp 00000000-00004260.00000002.82253.00261000.00000040.mdmp Observed string: "FileTimeToSystemTime" (Indicator: "FileTimeToSystemTime") in Source: 00000000-00006724.00000000.89696.00261000.00000040.mdmp Observed string: "FileTimeToLocalFileTime" (Indicator: "FileTimeToLocalFileTime") in Source: 00000000-00006724.00000000.89696.00261000.00000040.mdmp Observed string: "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime") in Source: 00000000-00006724.00000000.89696.00261000.00000040.mdmp2c:T4b1,"DrvUpdater.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00003572) "DrvUpdater.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00003572) "DrvUpdater.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00003572) "DrvUpdater.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00003572) "DrvUpdater.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00003572) "DrvUpdater.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00003572) "DrvUpdater.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00003572) "DrvUpdater.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00003572) "DrvUpdater.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00003572) "DrvUpdater.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00003572) "DrvUpdater.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00003572) "DrvUpdater.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00003572)2d:T7a7,Observed string: "ShellExecuteA" (Indicator: "ShellExecute") in Source: 574d0ca9cda56cd8dd6398baf3e1cdcf56e9ca4f71d85d9155fac4325444ea25.bin Observed string: "EnableShellExecuteHooks" (Indicator: "ShellExecute") in Source: 00000000-00003572-00000BC0-74765202 Observed string: "yncShellExecute" (Indicator: "ShellExecute") in Source: 00000000-00003572.00000000.77969.00B10000.00000004.mdmp Observed string: "yncShellExecuteB" (Indicator: "ShellExecute") in Source: 00000000-00003572.00000000.77969.00B10000.00000004.mdmp Observed string: "ShellExecuteA" (Indicator: "ShellExecute") in Source: 00000000-00003572.00000000.77969.010B1000.00000040.mdmp 00000000-00003572.00000000.77969.01117000.00000004.mdmp Observed string: "ShellExecuteExA" (Indicator: "ShellExecute") in Source: 00000000-00003572.00000000.77969.010B1000.00000040.mdmp Observed string: "NoRemove 'ShellExecuteHooks'" (Indicator: "ShellExecute") in Source: 00000000-00003572.00000000.77969.71D70000.00000002.mdmp Observed string: "ShellExecuteA" (Indicator: "ShellExecute") in Source: 00000000-00004260.00000000.78414.00261000.00000040.mdmp 00000000-00004260.00000000.78414.002C7000.00000004.mdmp 00000000-00004260.00000001.80336.00261000.00000040.mdmp 00000000-00004260.00000001.80336.002C7000.00000004.mdmp 00000000-00004260.00000002.82253.00261000.00000040.mdmp 00000000-00004260.00000002.82253.002C7000.00000004.mdmp Observed string: "ShellExecuteExA" (Indicator: "ShellExecute") in Source: 00000000-00004260.00000000.78414.00261000.00000040.mdmp 00000000-00004260.00000001.80336.00261000.00000040.mdmp 00000000-00004260.00000002.82253.00261000.00000040.mdmp Observed string: "ShellExecuteA" (Indicator: "ShellExecute") in Source: 00000000-00006724.00000000.89696.00261000.00000040.mdmp 00000000-00006724.00000000.89696.002C7000.00000004.mdmp Observed string: "ShellExecuteExA" (Indicator: "ShellExecute") in Source: 00000000-00006724.00000000.89696.00261000.00000040.mdmp2e:T52e,"DrvUpdater.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 76a40000 "DrvUpdater.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 76a40000 "DrvUpdater.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 76a40000 "DrvUpdater.exe" loaded module "KERNEL32" at base 74300000 "DrvUpdater.exe" loaded module "%WINDIR%\TEMP\VXOLE.DLL" at base 725d0000 "DrvUpdater.exe" loaded module "KERNEL32.DLL" at base 74300000 "DrvUpdater.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 736c0000 "DrvUpdater.exe" loaded module "NTDLL.DLL" at base 77430000 "DrvUpdater.exe" loaded module "SHELL32.DLL" at base 750b0000 "DrvUpdater.exe" loaded module "%WINDIR%\SYSWOW64\DLNASHEXT.DLL" at base 72380000 "DrvUpdater.exe" loaded module "%WINDIR%\SYSTEM32\PLAYTODEVICE.DLL" at base 72330000 "DrvUpdater.exe" loaded module "RPCRT4.DLL" at base 76c20000 "DrvUpdater.exe" loaded module "%WINDIR%\SYSTEM32\DEVDISPITEMPROVIDER.DLL" at base 72310000 "DrvUpdater.exe" loaded module "%WINDIR%\SYSTEM32\MMDEVAPI.DLL" at base 722b0000 "DrvUpdater.exe" loaded module "%WINDIR%\SYSTEM32\WPDSHEXT.DLL" at base 720d0000 "DrvUpdater.exe" loaded module "%WINDIR%\SYSTEM32\WINDOWS.STORAGE.DLL" at base 74410000 "DrvUpdater.exe" loaded module "%WINDIR%\SYSWOW64\ONECOREUAPCOMMONPROXYSTUB.DLL" at base 71df00002f:Tab4,"DrvUpdater.exe" touched "Computer" (Path: "HKCU\WOW6432NODE\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\SHELLFOLDER") "DrvUpdater.exe" touched "DLNA Media Servers Data Source" (Path: "HKCU\WOW6432NODE\CLSID\{289AF617-1CC3-42A6-926C-E6A863F0E3BA}\SHELLFOLDER") "DrvUpdater.exe" touched "Portable Devices" (Path: "HKCU\WOW6432NODE\CLSID\{35786D3C-B075-49B9-88DD-029876E11C01}\SHELLFOLDER") "DrvUpdater.exe" touched "Portable Media Devices" (Path: "HKCU\WOW6432NODE\CLSID\{640167B4-59B0-47A6-B335-A6B3C0695AEA}\SHELLFOLDER") "DrvUpdater.exe" touched "delegate folder that appears in Computer" (Path: "HKCU\WOW6432NODE\CLSID\{B155BDF8-02F0-451E-9A26-AE317CFD7779}\SHELLFOLDER") "DrvUpdater.exe" touched "Shell File System Folder" (Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{0E5AAE11-A475-4C5B-AB00-C66DE400274E}\INPROCSERVER32") "DrvUpdater.exe" touched "Network" (Path: "HKCU\WOW6432NODE\CLSID\{208D2C60-3AEA-1069-A2D7-08002B30309D}\SHELLFOLDER") "DrvUpdater.exe" touched "Recycle Bin" (Path: "HKCU\WOW6432NODE\CLSID\{645FF040-5081-101B-9F08-00AA002F954E}\SHELLFOLDER") "DrvUpdater.exe" touched "Control Panel" (Path: "HKCU\WOW6432NODE\CLSID\{26EE0668-A00A-44D7-9371-BEB064C98683}\SHELLFOLDER") "DrvUpdater.exe" touched "UsersFiles" (Path: "HKCU\WOW6432NODE\CLSID\{59031A47-3F72-44A7-89C5-5595FE6B30EE}\SHELLFOLDER") "DrvUpdater.exe" touched "UsersLibraries" (Path: "HKCU\WOW6432NODE\CLSID\{031E4825-7B94-4DC3-B131-E946B44C8DD5}\SHELLFOLDER") "DrvUpdater.exe" touched "CLSID_SearchFolder" (Path: "HKCU\WOW6432NODE\CLSID\{04731B67-D933-450A-90E6-4ACD2E9408FE}\SHELLFOLDER") "DrvUpdater.exe" touched "IE History and Feeds Shell Data Source for Windows Search" (Path: "HKCU\WOW6432NODE\CLSID\{11016101-E366-4D22-BC06-4ADA335C892B}\SHELLFOLDER") "DrvUpdater.exe" touched "Public Folder" (Path: "HKCU\WOW6432NODE\CLSID\{4336A54D-038B-4685-AB02-99BB52D3FB8B}\SHELLFOLDER") "DrvUpdater.exe" touched "Control Panel command object for Start menu and desktop" (Path: "HKCU\WOW6432NODE\CLSID\{5399E694-6CE5-4D6C-8FCE-1D8870FDCBA0}\SHELLFOLDER") "DrvUpdater.exe" touched "This Device" (Path: "HKCU\WOW6432NODE\CLSID\{5B934B42-522B-4C34-BBFE-37A3EF7B9C90}\SHELLFOLDER") "DrvUpdater.exe" touched "CLSID_AppInstanceFolder" (Path: "HKCU\WOW6432NODE\CLSID\{64693913-1C21-4F30-A98F-4E52906D3B56}\SHELLFOLDER") "DrvUpdater.exe" touched "@%systemroot%\system32\mssvp.dll,-110" (Path: "HKCU\WOW6432NODE\CLSID\{89D83576-6BD1-4C86-9454-BEB04E94C819}\SHELLFOLDER") "DrvUpdater.exe" touched "CLSID_SearchHome" (Path: "HKCU\WOW6432NODE\CLSID\{9343812E-1C37-4A49-A12E-4B2D810D956B}\SHELLFOLDER") "DrvUpdater.exe" touched "CLSID_StartMenuLauncherProviderFolder" (Path: "HKCU\WOW6432NODE\CLSID\{98F275B4-4FFF-11E0-89E2-7B86DFD72085}\SHELLFOLDER")30:T472,"574d0ca9cda56cd8dd6398baf3e1cdcf56e9ca4f71d85d9155fac4325444ea25.bin" file has an entrypoint instructions - "pushal ,mov esi, 0x43f000,lea edi, [esi - 0x3e000],push edi,mov ebp, esp,lea ebx, [esp - 0x3e80],xor eax, eax,push eax,cmp esp, ebx,jne 0x465bb8,inc esi,inc esi,push ebx,push 0x63375,push edi,add ebx, 4,push ebx,push 0x26b9b,push esi,add ebx, 4,push ebx,push eax,mov dword ptr [ebx], 3,nop ,nop ,nop ,nop ,nop ,push ebp,push edi,push esi,push ebx,sub esp, 0x7c,mov edx, dword ptr [esp + 0x90],mov dword ptr [esp + 0x74], 0,mov byte ptr [esp + 0x73], 0,mov ebp, dword ptr [esp + 0x9c]," "DrvUpdater.exe" file has an entrypoint instructions - "pushal ,mov esi, 0x43f000,lea edi, [esi - 0x3e000],push edi,mov ebp, esp,lea ebx, [esp - 0x3e80],xor eax, eax,push eax,cmp esp, ebx,jne 0x465bb8,inc esi,inc esi,push ebx,push 0x63375,push edi,add ebx, 4,push ebx,push 0x26b9b,push esi,add ebx, 4,push ebx,push eax,mov dword ptr [ebx], 3,nop ,nop ,nop ,nop ,nop ,push ebp,push edi,push esi,push ebx,sub esp, 0x7c,mov edx, dword ptr [esp + 0x90],mov dword ptr [esp + 0x74], 0,mov byte ptr [esp + 0x73], 0,mov ebp, dword ptr [esp + 0x9c],"31:T405,The input sample is signed with a certificate issued by "CN=AddTrust External CA Root, OU=AddTrust External TTP Network, O=AddTrust AB, C=SE" (SHA1: 8A:D5:C9:98:7E:6F:19:0B:D6:F5:41:6E:2D:E4:4C:CD:64:1D:8C:DA; see report for more information) The input sample is signed with a certificate issued by "CN=UTN-USERFirst-Object, OU=http://www.usertrust.com, O=The USERTRUST Network, L=Salt Lake City, ST=UT, C=US" (SHA1: 3D:BB:6D:B5:08:5C:6D:D5:A1:CA:7F:9C:F8:4E:CB:1A:39:10:CA:C8; see report for more information) The input sample is signed with a certificate issued by "CN=UTN-USERFirst-Object, OU=http://www.usertrust.com, O=The USERTRUST Network, L=Salt Lake City, ST=UT, C=US" (SHA1: B6:47:71:39:25:38:D1:EB:7A:92:81:99:87:91:C1:4A:FD:0C:50:35; see report for more information) The input sample is signed with a certificate issued by "CN=COMODO Code Signing CA 2, O=COMODO CA Limited, L=Salford, ST=Greater Manchester, C=GB" (SHA1: F1:9E:84:77:FB:A1:F3:DA:C2:75:2E:51:1B:3E:C1:D5:06:D7:4C:1F; see report for more information)32:T537,"DrvUpdater.exe" trying to access non-existent file "C:\Windows\System32\WOW64LOG.DLL" "DrvUpdater.exe" trying to access non-existent file "C:\MSIMG32.DLL" "DrvUpdater.exe" trying to access non-existent file "C:\FLTLIB.DLL" "DrvUpdater.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Roaming\DRPSu\DRVUPDATER.EXE" "DrvUpdater.exe" trying to access non-existent file "C:\Windows\SysWOW64\RPCSS.DLL" "DrvUpdater.exe" trying to access non-existent file "C:\WINDOWS\system32\rpcss.dll" "DrvUpdater.exe" trying to access non-existent file "C:\CLDAPI.DLL" "DrvUpdater.exe" trying to access non-existent file "C:\CLDAPI.dll" "DrvUpdater.exe" trying to access non-existent file "C:\AEPIC.DLL" "DrvUpdater.exe" trying to access non-existent file "C:\AEPIC.dll" "DrvUpdater.exe" trying to access non-existent file "C:\BCRYPT.DLL" "DrvUpdater.exe" trying to access non-existent file "C:\bcrypt.dll" "DrvUpdater.exe" trying to access non-existent file "C:\PROPSYS.DLL" "DrvUpdater.exe" trying to access non-existent file "C:\PROPSYS.dll" "DrvUpdater.exe" trying to access non-existent file "C:\EDPUTIL.DLL" "DrvUpdater.exe" trying to access non-existent file "C:\edputil.dll" "DrvUpdater.exe" trying to access non-existent file "C:\URLMON.DLL" "DrvUpdater.exe" trying to access non-existent file "C:\urlmon.dll"33:Te96,Observed string: "" [Source: 00000000-00003572.00000000.77969.00B10000.00000004.mdmp] Observed string: "" [Source: 00000000-00003572.00000000.77969.00B10000.00000004.mdmp] Observed string: "" [Source: 00000000-00003572.00000000.77969.00B10000.00000004.mdmp] Observed string: "" [Source: 00000000-00003572.00000000.77969.00B10000.00000004.mdmp] Observed string: "" [Source: 00000000-00003572.00000000.77969.00B10000.00000004.mdmp] Observed string: "" [Source: 00000000-00003572.00000000.77969.00B10000.00000004.mdmp] Observed string: "" [Source: 00000000-00003572.00000000.77969.00B10000.00000004.mdmp] Observed string: "" [Source: 00000000-00003572.00000000.77969.00B10000.00000004.mdmp] Observed string: "CreateCompatibleDC" [Source: 00000000-00003572.00000000.77969.010B1000.00000040.mdmp] Observed string: "GetDesktopWindow" [Source: 00000000-00003572.00000000.77969.010B1000.00000040.mdmp] Observed string: "CreateCompatibleDC" [Source: 00000000-00004260.00000000.78414.00261000.00000040.mdmp 00000000-00004260.00000001.80336.00261000.00000040.mdmp 00000000-00004260.00000002.82253.00261000.00000040.mdmp] Observed string: "GetDesktopWindow" [Source: 00000000-00004260.00000000.78414.00261000.00000040.mdmp 00000000-00004260.00000001.80336.00261000.00000040.mdmp 00000000-00004260.00000002.82253.00261000.00000040.mdmp] Observed string: "" [Source: 00000000-00004260.00000000.78414.03120000.00000004.mdmp 00000000-00004260.00000001.80336.03120000.00000004.mdmp 00000000-00004260.00000002.82253.03120000.00000004.mdmp] Observed string: "" [Source: 00000000-00004260.00000000.78414.03120000.00000004.mdmp 00000000-00004260.00000001.80336.03120000.00000004.mdmp 00000000-00004260.00000002.82253.03120000.00000004.mdmp] Observed string: "" [Source: 00000000-00004260.00000000.78414.03120000.00000004.mdmp 00000000-00004260.00000001.80336.03120000.00000004.mdmp 00000000-00004260.00000002.82253.03120000.00000004.mdmp] Observed string: "" [Source: 00000000-00004260.00000000.78414.03120000.00000004.mdmp 00000000-00004260.00000001.80336.03120000.00000004.mdmp 00000000-00004260.00000002.82253.03120000.00000004.mdmp] Observed string: "" [Source: 00000000-00004260.00000000.78414.03120000.00000004.mdmp 00000000-00004260.00000001.80336.03120000.00000004.mdmp 00000000-00004260.00000002.82253.03120000.00000004.mdmp] Observed string: "" [Source: 00000000-00004260.00000000.78414.03120000.00000004.mdmp 00000000-00004260.00000001.80336.03120000.00000004.mdmp 00000000-00004260.00000002.82253.03120000.00000004.mdmp] Observed string: "" [Source: 00000000-00004260.00000000.78414.03120000.00000004.mdmp 00000000-00004260.00000001.80336.03120000.00000004.mdmp 00000000-00004260.00000002.82253.03120000.00000004.mdmp] Observed string: "" [Source: 00000000-00004260.00000000.78414.03120000.00000004.mdmp 00000000-00004260.00000001.80336.03120000.00000004.mdmp 00000000-00004260.00000002.82253.03120000.00000004.mdmp]34:T58f,Observed string: "RegOpenKeyA" (Indicator: "RegOpenKey") in Source: 574d0ca9cda56cd8dd6398baf3e1cdcf56e9ca4f71d85d9155fac4325444ea25.bin Observed string: "RegOpenKeyA" (Indicator: "RegOpenKey") in Source: 00000000-00003572.00000000.77969.010B1000.00000040.mdmp 00000000-00003572.00000000.77969.01117000.00000004.mdmp Observed string: "RegQueryValueExA" (Indicator: "RegQueryValue") in Source: 00000000-00003572.00000000.77969.010B1000.00000040.mdmp Observed string: "RegOpenKeyA" (Indicator: "RegOpenKey") in Source: 00000000-00004260.00000000.78414.00261000.00000040.mdmp 00000000-00004260.00000000.78414.002C7000.00000004.mdmp 00000000-00004260.00000001.80336.00261000.00000040.mdmp 00000000-00004260.00000001.80336.002C7000.00000004.mdmp 00000000-00004260.00000002.82253.00261000.00000040.mdmp 00000000-00004260.00000002.82253.002C7000.00000004.mdmp Observed string: "RegQueryValueExA" (Indicator: "RegQueryValue") in Source: 00000000-00004260.00000000.78414.00261000.00000040.mdmp 00000000-00004260.00000001.80336.00261000.00000040.mdmp 00000000-00004260.00000002.82253.00261000.00000040.mdmp Observed string: "RegOpenKeyA" (Indicator: "RegOpenKey") in Source: 00000000-00006724.00000000.89696.00261000.00000040.mdmp 00000000-00006724.00000000.89696.002C7000.00000004.mdmp Observed string: "RegQueryValueExA" (Indicator: "RegQueryValue") in Source: 00000000-00006724.00000000.89696.00261000.00000040.mdmp35:T40c,Observed string: "GetTempPathA" (Indicator: "GetTempPath") in Source: 00000000-00003572.00000000.77969.010B1000.00000040.mdmp Observed string: "GetCurrentDirectoryA" (Indicator: "GetCurrentDirectory") in Source: 00000000-00003572.00000000.77969.010B1000.00000040.mdmp Observed string: "GetTempPathA" (Indicator: "GetTempPath") in Source: 00000000-00004260.00000000.78414.00261000.00000040.mdmp 00000000-00004260.00000001.80336.00261000.00000040.mdmp 00000000-00004260.00000002.82253.00261000.00000040.mdmp Observed string: "GetCurrentDirectoryA" (Indicator: "GetCurrentDirectory") in Source: 00000000-00004260.00000000.78414.00261000.00000040.mdmp 00000000-00004260.00000001.80336.00261000.00000040.mdmp 00000000-00004260.00000002.82253.00261000.00000040.mdmp Observed string: "GetTempPathA" (Indicator: "GetTempPath") in Source: 00000000-00006724.00000000.89696.00261000.00000040.mdmp Observed string: "GetCurrentDirectoryA" (Indicator: "GetCurrentDirectory") in Source: 00000000-00006724.00000000.89696.00261000.00000040.mdmp36:T68e,"Software\Microsoft\Windows\CurrentVersion\Uninstall\DRPSu Updater" (Indicator: "microsoft\windows\currentversion\uninstall") in Source: 00000000-00003572.00000000.77969.010B1000.00000040.mdmp "Software\Microsoft\Windows\CurrentVersion\Uninstall\DRPSu Updater" (Indicator: "microsoft\windows\currentversion\uninstall") in Source: 00000000-00004260.00000000.78414.00261000.00000040.mdmp 00000000-00004260.00000001.80336.00261000.00000040.mdmp 00000000-00004260.00000002.82253.00261000.00000040.mdmp "Microsoft\Windows\CurrentVersion\Uninstall\DRPSu Updater" (Indicator: "microsoft\windows\currentversion\uninstall") in Source: 00000000-00004260.00000000.78414.00990000.00000004.mdmp 00000000-00004260.00000001.80336.00990000.00000004.mdmp 00000000-00004260.00000002.82253.00990000.00000004.mdmp "oftware\Microsoft\Windows\CurrentVersion\Uninstall\DRPSu Updater" (Indicator: "microsoft\windows\currentversion\uninstall") in Source: 00000000-00004260.00000000.78414.03120000.00000004.mdmp 00000000-00004260.00000001.80336.03120000.00000004.mdmp 00000000-00004260.00000002.82253.03120000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Uninstall\DRPSu Updater" (Indicator: "microsoft\windows\currentversion\uninstall") in Source: 00000000-00006724.00000000.89696.00261000.00000040.mdmp "oftware\Microsoft\Windows\CurrentVersion\Uninstall\DRPSu Updater" (Indicator: "microsoft\windows\currentversion\uninstall") in Source: 00000000-00006724.00000000.89696.003C0000.00000004.mdmp "Microsoft\Windows\CurrentVersion\Uninstall\DRPSu Updater" (Indicator: "microsoft\windows\currentversion\uninstall") in Source: 00000000-00006724.00000000.89696.02C50000.00000004.mdmp37:T791,Observed string: "ExitProcess" (Indicator: "ExitProcess") in Source: 574d0ca9cda56cd8dd6398baf3e1cdcf56e9ca4f71d85d9155fac4325444ea25.bin Observed string: "CorExitProcess" (Indicator: "ExitProcess") in Source: 00000000-00003572.00000000.77969.010B1000.00000040.mdmp Observed string: "ExitProcess" (Indicator: "ExitProcess") in Source: 00000000-00003572.00000000.77969.010B1000.00000040.mdmp 00000000-00003572.00000000.77969.01117000.00000004.mdmp Observed string: "TerminateProcess" (Indicator: "TerminateProcess") in Source: 00000000-00003572.00000000.77969.010B1000.00000040.mdmp Observed string: "CorExitProcess" (Indicator: "ExitProcess") in Source: 00000000-00004260.00000000.78414.00261000.00000040.mdmp 00000000-00004260.00000001.80336.00261000.00000040.mdmp 00000000-00004260.00000002.82253.00261000.00000040.mdmp Observed string: "ExitProcess" (Indicator: "ExitProcess") in Source: 00000000-00004260.00000000.78414.00261000.00000040.mdmp 00000000-00004260.00000000.78414.002C7000.00000004.mdmp 00000000-00004260.00000001.80336.00261000.00000040.mdmp 00000000-00004260.00000001.80336.002C7000.00000004.mdmp 00000000-00004260.00000002.82253.00261000.00000040.mdmp 00000000-00004260.00000002.82253.002C7000.00000004.mdmp Observed string: "TerminateProcess" (Indicator: "TerminateProcess") in Source: 00000000-00004260.00000000.78414.00261000.00000040.mdmp 00000000-00004260.00000001.80336.00261000.00000040.mdmp 00000000-00004260.00000002.82253.00261000.00000040.mdmp Observed string: "CorExitProcess" (Indicator: "ExitProcess") in Source: 00000000-00006724.00000000.89696.00261000.00000040.mdmp Observed string: "ExitProcess" (Indicator: "ExitProcess") in Source: 00000000-00006724.00000000.89696.00261000.00000040.mdmp 00000000-00006724.00000000.89696.002C7000.00000004.mdmp Observed string: "TerminateProcess" (Indicator: "TerminateProcess") in Source: 00000000-00006724.00000000.89696.00261000.00000040.mdmp38:T456,Found string "ystem.OfflineFiles.Encrypted" (Indicator: ".encrypt"; Source: "00000000-00003572.00000000.77969.04940000.00000002.mdmp") Found string "ystem.Security.EncryptionOwners" (Indicator: ".encrypt"; Source: "00000000-00003572.00000000.77969.04940000.00000002.mdmp") Found string "ystem.Security.EncryptionOwnersDisplay" (Indicator: ".encrypt"; Source: "00000000-00003572.00000000.77969.04940000.00000002.mdmp") Found string "ystem.ZipFolder.Encrypted" (Indicator: ".encrypt"; Source: "00000000-00003572.00000000.77969.04940000.00000002.mdmp") Found string "System.Security.EncryptionOwnersDisplay" (Indicator: ".encrypt"; Source: "00000000-00003572.00000000.77969.057C0000.00000002.mdmp") Found string "System.Security.EncryptionOwners" (Indicator: ".encrypt"; Source: "00000000-00003572.00000000.77969.057C0000.00000002.mdmp") Found string "System.OfflineFiles.Encrypted" (Indicator: ".encrypt"; Source: "00000000-00003572.00000000.77969.057C0000.00000002.mdmp") Found string "System.ZipFolder.Encrypted" (Indicator: ".encrypt"; Source: "00000000-00003572.00000000.77969.057C0000.00000002.mdmp")39:Tc47,"DrvUpdater.exe" wrote bytes "702b6776403868764079677660096876e026677660166776a01a6776801d6776e01a6776d077677620226776b07b6776e02a6776406b6876c03d677660456776206c67761040677670446776203d677680636776303c687650266776" to virtual address "0x755A4158" (part of module "SHELL32.DLL") "DrvUpdater.exe" wrote bytes "104cfd767045fd76" to virtual address "0x7664D160" (part of module "SHCORE.DLL") "DrvUpdater.exe" wrote bytes "80f66076" to virtual address "0x766A02AC" (part of module "SHLWAPI.DLL") "DrvUpdater.exe" wrote bytes "70ebff7300ecff7340ecff73" to virtual address "0x773401FC" (part of module "COMBASE.DLL") "DrvUpdater.exe" wrote bytes "a0336076b0bf6076" to virtual address "0x74971704" (part of module "WINDOWS.STORAGE.DLL") "DrvUpdater.exe" wrote bytes "102d1a77c0ff197740dd2177f0c2197780a6197730302077f0701a77c0ed217740bf207720be2077704222771040227760a51977" to virtual address "0x72375124" (part of module "PLAYTODEVICE.DLL") "DrvUpdater.exe" wrote bytes "1036ef732036ef73" to virtual address "0x773401A0" (part of module "COMBASE.DLL") "DrvUpdater.exe" wrote bytes "e0aeff73" to virtual address "0x77340220" (part of module "COMBASE.DLL") "DrvUpdater.exe" wrote bytes "b0bf607620346076a0336076" to virtual address "0x755A408C" (part of module "SHELL32.DLL") "DrvUpdater.exe" wrote bytes "b08a1874a061187460901874c01b1974d044187400591d7470a81874e0a7187410a318746036187410581874408b187420a91874303718749076187420361874c0371874b0471874f08c1874" to virtual address "0x74971140" (part of module "WINDOWS.STORAGE.DLL") "DrvUpdater.exe" wrote bytes "30aecf76" to virtual address "0x76CD1094" (part of module "RPCRT4.DLL") "DrvUpdater.exe" wrote bytes "e058227760ef217710402277f0c21977d04f2f7740bf2077102d1a777042227780a6197740dd2177c0ff1977" to virtual address "0x723B9060" (part of module "DLNASHEXT.DLL") "DrvUpdater.exe" wrote bytes "b0ff1c7700911a7790971a7770f02177603c207760f82177606e1c7780041c77b0072077e0b61c7750b81f77b0f01b77106e1c7700ba227750071f7750da227750b61c77" to virtual address "0x723750AC" (part of module "PLAYTODEVICE.DLL") "DrvUpdater.exe" wrote bytes "10f2ff7300b9fe73f0914b77109dff739092ff73c0b4ff735088ff73d067ff7340b2ff73209cff73108cff73a0a4ff73507cff7350a9ff73c0b3ff73805dff73c0e6ff739075ff73c0eeff73a0c4ff7300c0ff7310d2fe7360aaff73" to virtual address "0x77340228" (part of module "COMBASE.DLL") "DrvUpdater.exe" wrote bytes "90dddc73" to virtual address "0x74971848" (part of module "WINDOWS.STORAGE.DLL") "DrvUpdater.exe" wrote bytes "c0696076a02f607630696076" to virtual address "0x749716F4" (part of module "WINDOWS.STORAGE.DLL") "DrvUpdater.exe" wrote bytes "5047b476" to virtual address "0x72375194" (part of module "PLAYTODEVICE.DLL") "DrvUpdater.exe" wrote bytes "3066fd76100cfd767023fd76" to virtual address "0x749715F0" (part of module "WINDOWS.STORAGE.DLL") "DrvUpdater.exe" wrote bytes "00412277003d2277608a1a77b0ff1c7700911a77b0072077e0b61c7750b61c77b0f01b770092227750bc1c77b0ff1f779041227770b71c7710c7227780041c77" to virtual address "0x76729058" (part of module "CLBCATQ.DLL") "DrvUpdater.exe" wrote bytes "a02f6076" to virtual address "0x723B9090" (part of module "DLNASHEXT.DLL")3a:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAADszMzszMzMzMzAiAAAAAAMzM7MzMzMzMzOyIiAAAAMzMzMzMzMzMzMzMiIiAAADMzMzMzMzMzMzOyJiIgAAMzMzMzMzMzMzMzsyJiIiAzMzMzMzMzMzM7u7MiJiIiMzMzMzMzMzM7u7u3IiIiIjMzMzMzMzO7u7u7syIiIiIzMzMzMzu7u7u7u7ciIyIiszMzMzu7u7u7u7uzIiMiJjMzM7u7u7u7u7u4tyIjMjK7u7u7u7u7u7u7iIgiIzMyszM7u7u7u7u4iIiIAnczN2Zme7u7u7u4iIiIiHJ4MzNmZmu7u7u4iIiIiIdiiIMzZmZniIiIiIiIiIiAJoiHM2ZmZne4iIiIiIiI8CeIiDNmZmZmZ7iIiIiIiHYoiIgzZmZmZmZniIiIiI8CaIiIM2ZmdmZmZkePiIiHIniIiHdmZmd4dmZkRIj4hnaIiIh3ZmZmeIh2ZGZkRwiIiIiIc2ZmZniIiIdmREh4j4iIiIhmZmZ4iIiIiHZuEBd3cRERZmZmd4iIiIj/gREREREREWZmZneIiIiIiHEXd3cxGRFmZmZ3eIiIiIcROIiImZmRBmZnd3eIiI9xEYiIeZmZkQBmd3d3eIiHERiIeZmZmZAABmd3d3d3cRF3mZmZmZkAAAB3d3h3EREZmZmZmZmQAAAAB3d4gRERmZmZmZmQAAD/+B///8AH//8AAv/8AAI/+AABH/AAAY/gAAGP4AABh8AAAYPAAAGDwAABgeAAAYHwAAGAnAADgD8AA4A/wAMAH/AHAAf8BwAB/4cAgH/uAIAf/gGAB/8BwAD/48AAf//gAHnz8ADwB/gB4A/8A8Af/geAP/8PAP//+AP///gf/w==3b:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAADszMzszMzMzMzAiAAAAAAMzM7MzMzMzMzOyIiAAAAMzMzMzMzMzMzMzMiIiAAADMzMzMzMzMzMzOyJiIgAAMzMzMzMzMzMzMzsyJiIiAzMzMzMzMzMzM7u7MiJiIiMzMzMzMzMzM7u7u3IiIiIjMzMzMzMzO7u7u7syIiIiIzMzMzMzu7u7u7u7ciIyIiszMzMzu7u7u7u7uzIiMiJjMzM7u7u7u7u7u4tyIjMjK7u7u7u7u7u7u7iIgiIzMyszM7u7u7u7u4iIiIAnczN2Zme7u7u7u4iIiIiHJ4MzNmZmu7u7u4iIiIiIdiiIMzZmZniIiIiIiIiIiAJoiHM2ZmZne4iIiIiIiI8CeIiDNmZmZmZ7iIiIiIiHYoiIgzZmZmZmZniIiIiI8CaIiIM2ZmdmZmZkePiIiHIniIiHdmZmd4dmZkRIj4hnaIiIh3ZmZmeIh2ZGZkRwiIiIiIc2ZmZniIiIdmREh4j4iIiIhmZmZ4iIiIiHZuEBd3cRERZmZmd4iIiIj/gREREREREWZmZneIiIiIiHEXd3cxGRFmZmZ3eIiIiIcROIiImZmRBmZnd3eIiI9xEYiIeZmZkQBmd3d3eIiHERiIeZmZmZAABmd3d3d3cRF3mZmZmZkAAAB3d3h3EREZmZmZmZmQAAAAB3d4gRERmZmZmZmQAAD/+B///8AH//8AAv/8AAI/+AABH/AAAY/gAAGP4AABh8AAAYPAAAGDwAABgeAAAYHwAAGAnAADgD8AA4A/wAMAH/AHAAf8BwAB/4cAgH/uAIAf/gGAB/8BwAD/48AAf//gAHnz8ADwB/gB4A/8A8Af/geAP/8PAP//+AP///gf/w==1d:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$25"}}],["$","$L26",null,{"initialData":{"schema_version":"1.0.15","sha256":"574d0ca9cda56cd8dd6398baf3e1cdcf56e9ca4f71d85d9155fac4325444ea25","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"NOT_AVAILABLE","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":100,"unified_at_epoch_ms":1790868725353,"unified_at":"2026-10-01T15:32:05.353Z","metadata":{"hashes":{"sha256":"574d0ca9cda56cd8dd6398baf3e1cdcf56e9ca4f71d85d9155fac4325444ea25","sha1":"d5bc16779827e1cd0bb6d7dc652cdee40c0b9bac","md5":"1db3300fe6ef0d52ecabbb903fca6a41","sha512":"3720839229cc899acbaf90e746cb435b9e21399e0164bc959556a8ce2bd2750fc0e681d5af44ffb557c16b5848ff0e65e668f326eb05b6c642fd93da906f907d","ssdeep":"3072:Qj52RXf17lQSfIR08uBlCfsUaJAgtpl+xu+QXGOw07mEiEo+C9eIT6RfbtDw9ouk:QdGvgKIR08uBlCfVOAIpl+4vcHz9ek6R","ssdeep_chunks":["3072:Qj52RXf","3072:j52RXf1","3072:52RXf17","3072:2RXf17l","3072:RXf17lQ","3072:Xf17lQS","3072:f17lQSf","3072:17lQSfI","3072:7lQSfIR","3072:lQSfIR0","3072:QSfIR08","3072:SfIR08u","3072:fIR08uB","3072:IR08uBl","3072:R08uBlC","3072:08uBlCf","3072:8uBlCfs","3072:uBlCfsU","3072:BlCfsUa","3072:lCfsUaJ","3072:CfsUaJA","3072:fsUaJAg","3072:sUaJAgt","3072:UaJAgtp","3072:aJAgtpl","3072:JAgtpl+","3072:Agtpl+x","3072:gtpl+xu","3072:tpl+xu+","3072:pl+xu+Q","3072:l+xu+QX","3072:+xu+QXG","3072:xu+QXGO","3072:u+QXGOw","3072:+QXGOw0","3072:QXGOw07","3072:XGOw07m","3072:GOw07mE","3072:Ow07mEi","3072:w07mEiE","3072:07mEiEo","3072:7mEiEo+","3072:mEiEo+C","3072:EiEo+C9","3072:iEo+C9e","3072:Eo+C9eI","3072:o+C9eIT","3072:+C9eIT6","3072:C9eIT6R","3072:9eIT6Rf","3072:eIT6Rfb","3072:IT6Rfbt","3072:T6RfbtD","3072:6RfbtDw","3072:RfbtDw9","3072:fbtDw9o","3072:btDw9ou","3072:tDw9ouk","6144:Qj52RXf","6144:j52RXf1","6144:52RXf17","6144:2RXf17l","6144:RXf17lQ","6144:Xf17lQS","6144:f17lQSf","6144:17lQSfI","6144:7lQSfIR","6144:lQSfIR0","6144:QSfIR08","6144:SfIR08u","6144:fIR08uB","6144:IR08uBl","6144:R08uBlC","6144:08uBlCf","6144:8uBlCfs","6144:uBlCfsU","6144:BlCfsUa","6144:lCfsUaJ","6144:CfsUaJA","6144:fsUaJAg","6144:sUaJAgt","6144:UaJAgtp","6144:aJAgtpl","6144:JAgtpl+","6144:Agtpl+x","6144:gtpl+xu","6144:tpl+xu+","6144:pl+xu+Q","6144:l+xu+QX","6144:+xu+QXG","6144:xu+QXGO","6144:u+QXGOw","6144:+QXGOw0","6144:QXGOw07","6144:XGOw07m","6144:GOw07mE","6144:Ow07mEi","6144:w07mEiE","6144:07mEiEo","6144:7mEiEo+","6144:mEiEo+C","6144:EiEo+C9","6144:iEo+C9e","6144:Eo+C9eI","6144:o+C9eIT","6144:+C9eIT6","6144:C9eIT6R","6144:9eIT6Rf","6144:eIT6Rfb","6144:IT6Rfbt","6144:T6RfbtD","6144:6RfbtDw","6144:RfbtDw9","6144:fbtDw9o","6144:btDw9ou","6144:tDw9ouk","3072:QdGvgKI","3072:dGvgKIR","3072:GvgKIR0","3072:vgKIR08","3072:gKIR08u","3072:KIR08uB","3072:8uBlCfV","3072:uBlCfVO","3072:BlCfVOA","3072:lCfVOAI","3072:CfVOAIp","3072:fVOAIpl","3072:VOAIpl+","3072:OAIpl+4","3072:AIpl+4v","3072:Ipl+4vc","3072:pl+4vcH","3072:l+4vcHz","3072:+4vcHz9","3072:4vcHz9e","3072:vcHz9ek","3072:cHz9ek6","3072:Hz9ek6R"],"imphash":"acad5a6d356430081724fe32a0331daa"},"file_info":{"file_name":"DrvUpdater.exe","file_type":["peexe","executable"],"file_type_id":"exe","file_size":195256,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1499289992000,"last_seen":1723800948000,"last_multi_scan":1723800948000}},"detections":{"summary":{"verdict":"malicious","score":100,"tags":["driverpack","windows-server-utility"]},"stats":{"av":{"malicious_count":10,"suspicious_count":0,"total_engines":25},"attributions":{"malware_families_count":1,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":52},"sandbox_signatures":{"informative_count":102,"suspicious_count":25,"malicious_count":13,"total":140},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"ahnlab":{"name":"AhnLab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"malicious","threat_name":"GrayWare/Win32.DriverPack","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"malicious","threat_name":"Application.Agent.JDL","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"clamav":{"name":"ClamAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"cmc":{"name":"CMC","success":true,"verdict":"malicious","threat_name":"PUABundler_Win32_DriverPack","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"comodo":{"name":"Comodo","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"crowdstrike":{"name":"CrowdStrike","success":true,"verdict":"malicious","threat_name":"win/grayware_confidence_100% (W)","status":"malicious","progress":100,"data_source":"CrowdStrike","permalink":"https://www.crowdstrike.com/en-us/platform/endpoint-security/"},"cylance":{"name":"Cylance","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"malicious","threat_name":"a variant of Win32/DriverPack.A potentially unwanted application","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"lionic":{"name":"Lionic","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"mcafee":{"name":"McAfee","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"netgate":{"name":"NETGATE","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.Malware","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"malicious","threat_name":"App/DriverUpd-M","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"varist":{"name":"Varist","success":true,"verdict":"malicious","threat_name":"W32/S-4d88a4ad!Eldorado","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"malicious","threat_name":"Adware.Win32.Amonetize.C","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"webrootsmd":{"name":"Webroot SMD","success":true,"verdict":"malicious","threat_name":"Malware","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"DriverPack.A potentially unwanted application","sources":[{"report_type":"quickscan","report_id":""}]}]},"mitre_attacks":[{"tactic":"Execution","technique":"Native API","attack_id":"T1106","attack_id_wiki":"https://attack.mitre.org/techniques/T1106","identifiers":[{"type":"suspicious","value":"Imports suspicious APIs"},{"type":"informative","value":"Calls an API typically used to retrieve function addresses"},{"type":"informative","value":"Calls an API typically used to find a resource in a module"},{"type":"informative","value":"Calls an API typically used to create a process"},{"type":"informative","value":"Contains Windows APIs"},{"type":"informative","value":"Contains ability to load modules (API string)"},{"type":"informative","value":"Contains ability to retrieve the fully qualified path of module (API string)"},{"type":"informative","value":"Contains ability to create files (API string)"},{"type":"informative","value":"Calls an API typically used to load a resource in memory"},{"type":"informative","value":"Contains ability to execute an application (API string)"},{"type":"informative","value":"Contains ability to set/get the last-error code for a calling thread (API string)"},{"type":"informative","value":"Contains ability to modify process thread functionality (API string)"}],"sources":[{"report_type":"sandbox","report_id":"64369837353cf50d1f02053d"}]},{"tactic":"Execution","technique":"Shared Modules","attack_id":"T1129","attack_id_wiki":"https://attack.mitre.org/techniques/T1129","identifiers":[{"type":"informative","value":"Calls an API typically used to load libraries"},{"type":"informative","value":"Loads the RPC (Remote Procedure Call) module DLL"},{"type":"informative","value":"Loads modules at runtime"}],"sources":[{"report_type":"sandbox","report_id":"64369837353cf50d1f02053d"}]},{"tactic":"Execution","technique":"Command and Scripting Interpreter","attack_id":"T1059","attack_id_wiki":"https://attack.mitre.org/techniques/T1059","identifiers":[{"type":"informative","value":"Executes batch file"}],"sources":[{"report_type":"sandbox","report_id":"64369837353cf50d1f02053d"}]},{"tactic":"Execution","technique":"Windows Command Shell","attack_id":"T1059.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1059/003","identifiers":[{"type":"informative","value":"Runs shell commands"},{"type":"informative","value":"Possibly executes files or commands through Windows command line"},{"type":"informative","value":"Contains ability to retrieve the command-line string for the current process (API string)"}],"sources":[{"report_type":"sandbox","report_id":"64369837353cf50d1f02053d"}]},{"tactic":"Execution","technique":"Malicious File","attack_id":"T1204.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1204/002","identifiers":[{"type":"malicious","value":"The analysis extracted a file that was identified as malicious"},{"type":"malicious","value":"The analysis spawned a process that was identified as malicious"}],"sources":[{"report_type":"sandbox","report_id":"64369837353cf50d1f02053d"}]},{"tactic":"Execution","technique":"Windows Management Instrumentation","attack_id":"T1047","attack_id_wiki":"https://attack.mitre.org/techniques/T1047","identifiers":[{"type":"suspicious","value":"Contains references to WMI/WMIC"}],"sources":[{"report_type":"sandbox","report_id":"64369837353cf50d1f02053d"}]},{"tactic":"Persistence","technique":"Component Object Model Hijacking","attack_id":"T1546.015","attack_id_wiki":"https://attack.mitre.org/techniques/T1546/015","identifiers":[{"type":"informative","value":"Overview of unique CLSIDs touched in registry"}],"sources":[{"report_type":"sandbox","report_id":"64369837353cf50d1f02053d"}]},{"tactic":"Persistence","technique":"Windows Service","attack_id":"T1543.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1543/003","identifiers":[{"type":"informative","value":"Creates or modifies windows services"},{"type":"informative","value":"Contains ability to retrieve/open a process (API string)"}],"sources":[{"report_type":"sandbox","report_id":"64369837353cf50d1f02053d"}]},{"tactic":"Persistence","technique":"Registry Run Keys / Startup Folder","attack_id":"T1547.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1547/001","identifiers":[{"type":"suspicious","value":"Modifies auto-execute functionality by setting/creating a value in the registry"}],"sources":[{"report_type":"sandbox","report_id":"64369837353cf50d1f02053d"}]},{"tactic":"Persistence","technique":"Boot or Logon Autostart Execution","attack_id":"T1547","attack_id_wiki":"https://attack.mitre.org/techniques/T1547","sources":[{"report_type":"sandbox","report_id":"64369837353cf50d1f02053d"}]},{"tactic":"Privilege Escalation","technique":"Extra Window Memory Injection","attack_id":"T1055.011","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/011","sources":[{"report_type":"sandbox","report_id":"64369837353cf50d1f02053d"}]},{"tactic":"Privilege Escalation","technique":"Process Injection","attack_id":"T1055","attack_id_wiki":"https://attack.mitre.org/techniques/T1055","identifiers":[{"type":"malicious","value":"Writes data to a remote process"}],"sources":[{"report_type":"sandbox","report_id":"64369837353cf50d1f02053d"}]},{"tactic":"Privilege Escalation","technique":"Dynamic-link Library Injection","attack_id":"T1055.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/001","identifiers":[{"type":"informative","value":"Contains ability to free a loaded DLL module (API string)"},{"type":"informative","value":"Contains ability to retrieve address of exported function from a DLL (API string)"}],"sources":[{"report_type":"sandbox","report_id":"64369837353cf50d1f02053d"}]},{"tactic":"Privilege Escalation","technique":"Thread Execution Hijacking","attack_id":"T1055.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/003","identifiers":[{"type":"informative","value":"Contains ability to modify process memory (API string)"}],"sources":[{"report_type":"sandbox","report_id":"64369837353cf50d1f02053d"}]},{"tactic":"Defense Evasion","technique":"File Deletion","attack_id":"T1070.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/004","identifiers":[{"type":"malicious","value":"Tries to hide tracks of having downloaded a file from the internet"},{"type":"malicious","value":"Drops a batch file that contains a force-delete command (typical for malware init code)"},{"type":"suspicious","value":"Opens file with deletion access rights"},{"type":"suspicious","value":"Marks file for deletion"},{"type":"suspicious","value":"Process deletes itself"},{"type":"informative","value":"Contains ability to delete files"},{"type":"informative","value":"Contains ability to delete files (API string)"}],"sources":[{"report_type":"sandbox","report_id":"64369837353cf50d1f02053d"}]},{"tactic":"Defense Evasion","technique":"Debugger Evasion","attack_id":"T1622","attack_id_wiki":"https://attack.mitre.org/techniques/T1622","identifiers":[{"type":"suspicious","value":"Queries kernel debugger information"}],"sources":[{"report_type":"sandbox","report_id":"64369837353cf50d1f02053d"}]},{"tactic":"Defense Evasion","technique":"Obfuscated Files or Information","attack_id":"T1027","attack_id_wiki":"https://attack.mitre.org/techniques/T1027","identifiers":[{"type":"informative","value":"PE file contains zero-size sections"},{"type":"informative","value":"YARA signature match - RC4 Encryption"},{"type":"suspicious","value":"Contains CRYPTO related strings"},{"type":"informative","value":"Loads the cryptographic module DLL"}],"sources":[{"report_type":"sandbox","report_id":"64369837353cf50d1f02053d"}]},{"tactic":"Defense Evasion","technique":"Modify Registry","attack_id":"T1112","attack_id_wiki":"https://attack.mitre.org/techniques/T1112","identifiers":[{"type":"suspicious","value":"Modifies proxy settings"},{"type":"informative","value":"Contains ability to delete registry value (API string)"},{"type":"informative","value":"Contains ability to close the handle to a registry key (API string)"},{"type":"informative","value":"Contains ability to create/open registry keys (API string)"}],"sources":[{"report_type":"sandbox","report_id":"64369837353cf50d1f02053d"}]},{"tactic":"Defense Evasion","technique":"Time Based Evasion","attack_id":"T1497.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/003","identifiers":[{"type":"informative","value":"Contains ability to retrieve the time elapsed since the system was started (API string)"},{"type":"informative","value":"Contains ability to delay execution by waiting for signal/timeout (API string)"},{"type":"suspicious","value":"Possibly tries to evade analysis by sleeping many times"}],"sources":[{"report_type":"sandbox","report_id":"64369837353cf50d1f02053d"}]},{"tactic":"Defense Evasion","technique":"Virtualization/Sandbox Evasion","attack_id":"T1497","attack_id_wiki":"https://attack.mitre.org/techniques/T1497","identifiers":[{"type":"informative","value":"Contains ability to detect presence of virtual environment (API string)"}],"sources":[{"report_type":"sandbox","report_id":"64369837353cf50d1f02053d"}]},{"tactic":"Defense Evasion","technique":"Code Signing","attack_id":"T1553.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1553/002","identifiers":[{"type":"informative","value":"The input sample is signed with a valid certificate"},{"type":"informative","value":"The input sample is signed with a certificate"}],"sources":[{"report_type":"sandbox","report_id":"64369837353cf50d1f02053d"}]},{"tactic":"Defense Evasion","technique":"Masquerading","attack_id":"T1036","attack_id_wiki":"https://attack.mitre.org/techniques/T1036","identifiers":[{"type":"informative","value":"Drops files inside appdata directory"}],"sources":[{"report_type":"sandbox","report_id":"64369837353cf50d1f02053d"}]},{"tactic":"Defense Evasion","technique":"Software Packing","attack_id":"T1027.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/002","identifiers":[{"type":"suspicious","value":"PE file has unusual entropy sections"},{"type":"informative","value":"Matched Compiler/Packer signature"}],"sources":[{"report_type":"sandbox","report_id":"64369837353cf50d1f02053d"}]},{"tactic":"Defense Evasion","technique":"Dynamic API Resolution","attack_id":"T1027.007","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/007","identifiers":[{"type":"informative","value":"Contains ability to dynamically determine API calls"}],"sources":[{"report_type":"sandbox","report_id":"64369837353cf50d1f02053d"}]},{"tactic":"Defense Evasion","technique":"Hidden Window","attack_id":"T1564.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1564/003","identifiers":[{"type":"informative","value":"Contains ability to pass information to a window procedure (API string)"},{"type":"informative","value":"Contains ability to show a graphical window (API string)"}],"sources":[{"report_type":"sandbox","report_id":"64369837353cf50d1f02053d"}]},{"tactic":"Defense Evasion","technique":"Timestomp","attack_id":"T1070.006","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/006","identifiers":[{"type":"informative","value":"Contains ability to retrieve file time (API string)"}],"sources":[{"report_type":"sandbox","report_id":"64369837353cf50d1f02053d"}]},{"tactic":"Credential Access","technique":"Credential API Hooking","attack_id":"T1056.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1056/004","identifiers":[{"type":"suspicious","value":"Installs hooks/patches the running process"}],"sources":[{"report_type":"sandbox","report_id":"64369837353cf50d1f02053d"}]},{"tactic":"Discovery","technique":"File and Directory Discovery","attack_id":"T1083","attack_id_wiki":"https://attack.mitre.org/techniques/T1083","identifiers":[{"type":"informative","value":"Tries to access non-existent files (executable)"},{"type":"informative","value":"Tries to access non-existent files (non-executable)"},{"type":"informative","value":"Touches files in the Windows directory"},{"type":"informative","value":"Contains ability to retrieve file and directory information (API string)"},{"type":"informative","value":"Contains ability to enumerate files on disk (API string)"},{"type":"suspicious","value":"Reads configuration files (.ini files)"}],"sources":[{"report_type":"sandbox","report_id":"64369837353cf50d1f02053d"}]},{"tactic":"Discovery","technique":"Query Registry","attack_id":"T1012","attack_id_wiki":"https://attack.mitre.org/techniques/T1012","identifiers":[{"type":"informative","value":"Found registry key string for installed applications"},{"type":"informative","value":"Reads information about supported languages"},{"type":"informative","value":"Reads the active computer name"},{"type":"informative","value":"Contains ability to read registry keys (API string)"}],"sources":[{"report_type":"sandbox","report_id":"64369837353cf50d1f02053d"}]},{"tactic":"Discovery","technique":"Process Discovery","attack_id":"T1057","attack_id_wiki":"https://attack.mitre.org/techniques/T1057","identifiers":[{"type":"suspicious","value":"Queries process information"},{"type":"informative","value":"Calls an API typically used for taking snapshot of the specified processes"},{"type":"informative","value":"Process launched with changed environment"},{"type":"informative","value":"Spawns new processes that are not known child processes"},{"type":"informative","value":"Spawns new processes"}],"sources":[{"report_type":"sandbox","report_id":"64369837353cf50d1f02053d"}]},{"tactic":"Discovery","technique":"Application Window Discovery","attack_id":"T1010","attack_id_wiki":"https://attack.mitre.org/techniques/T1010","identifiers":[{"type":"informative","value":"Scanning for window names"},{"type":"informative","value":"Calls an API possibly used to retrieve a handle to the foreground window"},{"type":"informative","value":"Contains ability to retrieve open application windows (API string)"}],"sources":[{"report_type":"sandbox","report_id":"64369837353cf50d1f02053d"}]},{"tactic":"Discovery","technique":"System Information Discovery","attack_id":"T1082","attack_id_wiki":"https://attack.mitre.org/techniques/T1082","identifiers":[{"type":"informative","value":"Calls an API typically used to get product type"},{"type":"informative","value":"Calls an API typically used to determine whether a process running under Wow64"},{"type":"informative","value":"Queries volume information"},{"type":"informative","value":"Queries volume information of an entire harddrive"},{"type":"informative","value":"Contains ability to retrieve volume information (API string)"},{"type":"informative","value":"Contains ability to determine disk drive type (API string)"},{"type":"suspicious","value":"Found system commands related strings"},{"type":"informative","value":"Contains ability to read software policies"},{"type":"informative","value":"Reads the cryptographic machine GUID"},{"type":"informative","value":"Contains ability to retrieve the host's architecture (API string)"},{"type":"informative","value":"Contains ability to retrieve data about the local computer (API string)"},{"type":"informative","value":"Contains ability to retrieve information about the current system (API string)"},{"type":"informative","value":"Calls an API typically used to get system version information"}],"sources":[{"report_type":"sandbox","report_id":"64369837353cf50d1f02053d"}]},{"tactic":"Discovery","technique":"System Language Discovery","attack_id":"T1614.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1614/001","identifiers":[{"type":"informative","value":"Reads the windows installation language"}],"sources":[{"report_type":"sandbox","report_id":"64369837353cf50d1f02053d"}]},{"tactic":"Discovery","technique":"Software Discovery","attack_id":"T1518","attack_id_wiki":"https://attack.mitre.org/techniques/T1518","identifiers":[{"type":"informative","value":"Reads the registry for installed applications"}],"sources":[{"report_type":"sandbox","report_id":"64369837353cf50d1f02053d"}]},{"tactic":"Discovery","technique":"System Location Discovery","attack_id":"T1614","attack_id_wiki":"https://attack.mitre.org/techniques/T1614","identifiers":[{"type":"informative","value":"Contains ability to query system locale (API string)"}],"sources":[{"report_type":"sandbox","report_id":"64369837353cf50d1f02053d"}]},{"tactic":"Discovery","technique":"System Time Discovery","attack_id":"T1124","attack_id_wiki":"https://attack.mitre.org/techniques/T1124","identifiers":[{"type":"informative","value":"Contains ability to retrieve machine time (API string)"},{"type":"informative","value":"Contains ability to retrieve machine timezone (API string)"}],"sources":[{"report_type":"sandbox","report_id":"64369837353cf50d1f02053d"}]},{"tactic":"Discovery","technique":"Remote System Discovery","attack_id":"T1018","attack_id_wiki":"https://attack.mitre.org/techniques/T1018","sources":[{"report_type":"sandbox","report_id":"64369837353cf50d1f02053d"}]},{"tactic":"Discovery","technique":"System Network Configuration Discovery","attack_id":"T1016","attack_id_wiki":"https://attack.mitre.org/techniques/T1016","identifiers":[{"type":"informative","value":"Contains ability to retrieve the local name for a socket (API string)"}],"sources":[{"report_type":"sandbox","report_id":"64369837353cf50d1f02053d"}]},{"tactic":"Discovery","technique":"Security Software Discovery","attack_id":"T1518.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1518/001","sources":[{"report_type":"sandbox","report_id":"64369837353cf50d1f02053d"}]},{"tactic":"Collection","technique":"Local Data Staging","attack_id":"T1074.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1074/001","identifiers":[{"type":"informative","value":"Calls an API typically used to create a directory"}],"sources":[{"report_type":"sandbox","report_id":"64369837353cf50d1f02053d"}]},{"tactic":"Collection","technique":"Email Collection","attack_id":"T1114","attack_id_wiki":"https://attack.mitre.org/techniques/T1114","sources":[{"report_type":"sandbox","report_id":"64369837353cf50d1f02053d"}]},{"tactic":"Collection","technique":"Screen Capture","attack_id":"T1113","attack_id_wiki":"https://attack.mitre.org/techniques/T1113","identifiers":[{"type":"informative","value":"Contains ability to capture screen (API string)"}],"sources":[{"report_type":"sandbox","report_id":"64369837353cf50d1f02053d"}]},{"tactic":"Command and Control","technique":"Application Layer Protocol","attack_id":"T1071","attack_id_wiki":"https://attack.mitre.org/techniques/T1071","identifiers":[{"type":"informative","value":"Contacts server"},{"type":"informative","value":"Contacts domains"},{"type":"informative","value":"Found potential URL in binary/memory"},{"type":"suspicious","value":"Found potential IP address in binary/memory"}],"sources":[{"report_type":"sandbox","report_id":"64369837353cf50d1f02053d"}]},{"tactic":"Command and Control","technique":"Web Protocols","attack_id":"T1071.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/001","identifiers":[{"type":"informative","value":"Found user-agent related strings"},{"type":"suspicious","value":"Sends traffic on typical HTTP outbound port, but without HTTP header"},{"type":"informative","value":"GETs files from a webserver"},{"type":"informative","value":"Communicates with HTTP webserver (GET/POST requests)"}],"sources":[{"report_type":"sandbox","report_id":"64369837353cf50d1f02053d"}]},{"tactic":"Command and Control","technique":"DNS","attack_id":"T1071.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/004","identifiers":[{"type":"informative","value":"Queries DNS server"}],"sources":[{"report_type":"sandbox","report_id":"64369837353cf50d1f02053d"}]},{"tactic":"Command and Control","technique":"Encrypted Channel","attack_id":"T1573","attack_id_wiki":"https://attack.mitre.org/techniques/T1573","identifiers":[{"type":"informative","value":"Making HTTPS connections using secure TLS/SSL version"},{"type":"informative","value":"Possibly tries to communicate over SSL connection (HTTPS)"}],"sources":[{"report_type":"sandbox","report_id":"64369837353cf50d1f02053d"}]},{"tactic":"Command and Control","technique":"Ingress Tool Transfer","attack_id":"T1105","attack_id_wiki":"https://attack.mitre.org/techniques/T1105","identifiers":[{"type":"informative","value":"Contains ability to copy files"},{"type":"suspicious","value":"Drops executable files"},{"type":"informative","value":"Dropped files"},{"type":"informative","value":"Drops XML files"}],"sources":[{"report_type":"sandbox","report_id":"64369837353cf50d1f02053d"}]},{"tactic":"Command and Control","technique":"Proxy","attack_id":"T1090","attack_id_wiki":"https://attack.mitre.org/techniques/T1090","identifiers":[{"type":"informative","value":"Contains references to RPC protocol sequence strings"}],"sources":[{"report_type":"sandbox","report_id":"64369837353cf50d1f02053d"}]},{"tactic":"Command and Control","technique":"Mail Protocols","attack_id":"T1071.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/003","identifiers":[{"type":"informative","value":"Found mail related domain names"}],"sources":[{"report_type":"sandbox","report_id":"64369837353cf50d1f02053d"}]},{"tactic":"Exfiltration","technique":"Scheduled Transfer","attack_id":"T1029","attack_id_wiki":"https://attack.mitre.org/techniques/T1029","identifiers":[{"type":"informative","value":"Contains ability to perform scheduled transfer (API string)"}],"sources":[{"report_type":"sandbox","report_id":"64369837353cf50d1f02053d"}]},{"tactic":"Exfiltration","technique":"Exfiltration Over C2 Channel","attack_id":"T1041","attack_id_wiki":"https://attack.mitre.org/techniques/T1041","identifiers":[{"type":"informative","value":"Contains ability to upload file/data"}],"sources":[{"report_type":"sandbox","report_id":"64369837353cf50d1f02053d"}]},{"tactic":"Impact","technique":"Service Stop","attack_id":"T1489","attack_id_wiki":"https://attack.mitre.org/techniques/T1489","identifiers":[{"type":"informative","value":"Contains ability to terminate a process (API string)"}],"sources":[{"report_type":"sandbox","report_id":"64369837353cf50d1f02053d"}]}],"sandbox_signatures":[{"level":"informative","category":"Environment Awareness","name":"Contains ability to query machine time","description":"GetSystemTimeAsFileTime@KERNEL32.DLL at 00550437-00003352-34215-1058-00E22E64\n GetSystemTimeAsFileTime@KERNEL32.DLL at 00550437-00003352-34215-1675-00E32FCC\n GetSystemTimeAsFileTime@KERNEL32.DLL at 00554250-00001084-47537-1066-00922E64\n GetSystemTimeAsFileTime@KERNEL32.DLL at 00554250-00001084-47537-1683-00932FCC","origin":"Hybrid Analysis Technology","relevance":1,"id":"stream-2","sources":[{"report_type":"sandbox","report_id":"55c0bc7e0e316df02e616b24"}]},{"level":"informative","category":"General","name":"Contacts domains","description":"\"update.drp.su\"","origin":"Network Traffic","relevance":1,"id":"network-0","sources":[{"report_type":"sandbox","report_id":"55c0bc7e0e316df02e616b24"},{"report_type":"sandbox","report_id":"64369837353cf50d1f02053d"}]},{"level":"informative","category":"General","name":"Contacts server","description":"\"5.79.68.159:80\"","origin":"Network Traffic","relevance":1,"id":"network-1","sources":[{"report_type":"sandbox","report_id":"55c0bc7e0e316df02e616b24"},{"report_type":"sandbox","report_id":"64369837353cf50d1f02053d"}]},{"level":"informative","category":"General","name":"Contains PDB pathways","description":"\"d:\\DRPSuUpdater\\bin\\Release\\DrvUpdater.pdb\"","origin":"File/Memory","relevance":1,"id":"string-7","sources":[{"report_type":"sandbox","report_id":"55c0bc7e0e316df02e616b24"}]},{"level":"informative","category":"General","name":"Creates mutants","description":"\"DriverFinderMutex\"\n \"Local\\ZonesCounterMutex\"\n \"Local\\ZoneAttributeCacheCounterMutex\"\n \"Local\\ZonesCacheCounterMutex\"\n \"Local\\ZonesLockedCacheCounterMutex\"","origin":"Created Mutant","relevance":3,"id":"mutant-0","sources":[{"report_type":"sandbox","report_id":"55c0bc7e0e316df02e616b24"},{"report_type":"sandbox","report_id":"64369837353cf50d1f02053d"}]},{"level":"informative","category":"General","name":"GETs files from a webserver","description":"\"GET /drpupdater/DrvUpdater.xml HTTP/1.1\nHost: update.drp.su\nAccept: */*\"","origin":"Network Traffic","relevance":5,"id":"network-2","sources":[{"report_type":"sandbox","report_id":"55c0bc7e0e316df02e616b24"},{"report_type":"sandbox","report_id":"64369837353cf50d1f02053d"}]},{"level":"informative","category":"General","name":"Runs shell commands","description":"\"cmd /c C:\\Users\\PSPUBWS\\AppData\\Local\\Temp\\DrvUpdater.Run.bat\" \"\" on 2015-08-04.07:29:36","origin":"Monitored Target","relevance":5,"id":"target-3","sources":[{"report_type":"sandbox","report_id":"55c0bc7e0e316df02e616b24"},{"report_type":"sandbox","report_id":"64369837353cf50d1f02053d"}]},{"level":"informative","category":"Installation/Persistance","name":"Dropped files","description":"\"DrvUpdater.exe\" has type \"PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed\"\n \"DrvUpdater.Run.bat\" has type \"ASCII text, with CRLF line terminators\"","origin":"Binary File","relevance":3,"id":"binary-0","sources":[{"report_type":"sandbox","report_id":"55c0bc7e0e316df02e616b24"},{"report_type":"sandbox","report_id":"64369837353cf50d1f02053d"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"Contains ability to register a top-level exception handler (often used as anti-debugging trick)","description":"SetUnhandledExceptionFilter@KERNEL32.DLL at 00550437-00003352-34215-572-00E228AD\n SetUnhandledExceptionFilter@KERNEL32.DLL at 00550437-00003352-34215-573-00E2A77B\n SetUnhandledExceptionFilter@KERNEL32.DLL at 00550437-00003352-34215-634-00E2E7A7\n SetUnhandledExceptionFilter@KERNEL32.DLL at 00550437-00003352-34215-2558-00E32946\n SetUnhandledExceptionFilter@KERNEL32.DLL at 00554250-00001084-47537-580-009228AD\n SetUnhandledExceptionFilter@KERNEL32.DLL at 00554250-00001084-47537-581-0092A77B\n SetUnhandledExceptionFilter@KERNEL32.DLL at 00554250-00001084-47537-642-0092E7A7\n SetUnhandledExceptionFilter@KERNEL32.DLL at 00554250-00001084-47537-2535-00932946","origin":"Hybrid Analysis Technology","relevance":1,"id":"stream-4","sources":[{"report_type":"sandbox","report_id":"55c0bc7e0e316df02e616b24"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"PE file has unusual entropy sections","description":"UPX1 with unusual entropies 7.99639532037","origin":"Static Parser","relevance":10,"id":"static-6","sources":[{"report_type":"sandbox","report_id":"55c0bc7e0e316df02e616b24"},{"report_type":"sandbox","report_id":"64369837353cf50d1f02053d"}]},{"level":"suspicious","category":"Environment Awareness","name":"Possibly tries to detect the presence of a debugger","description":"GetProcessHeap@KERNEL32.DLL at 00550437-00003352-34215-873-00E3A828\n GetProcessHeap@KERNEL32.DLL at 00554250-00001084-47537-881-0093A828","origin":"Hybrid Analysis Technology","relevance":1,"id":"stream-31","sources":[{"report_type":"sandbox","report_id":"55c0bc7e0e316df02e616b24"}]},{"level":"suspicious","category":"Environment Awareness","name":"Possibly tries to evade analysis by sleeping many times","description":"\"DrvUpdater.exe\" (Thread ID: 3428) slept \"210\" times (threshold: 200)","origin":"API Call","relevance":10,"id":"api-47","sources":[{"report_type":"sandbox","report_id":"55c0bc7e0e316df02e616b24"},{"report_type":"sandbox","report_id":"64369837353cf50d1f02053d"}]},{"level":"suspicious","category":"General","name":"Reads configuration files","description":"\"\" read file \"C:\\Users\\desktop.ini\"\n \"\" read file \"C:\\Users\\PSPUBWS\\Desktop\\desktop.ini\"\n \"\" read file \"C:\\Users\\PSPUBWS\\Searches\\desktop.ini\"\n \"\" read file \"C:\\Users\\PSPUBWS\\Videos\\desktop.ini\"","origin":"API Call","relevance":4,"id":"api-6","sources":[{"report_type":"sandbox","report_id":"55c0bc7e0e316df02e616b24"}]},{"level":"suspicious","category":"Installation/Persistance","name":"Drops executable files","description":"\"DrvUpdater.exe\" has type \"PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed\"","origin":"Binary File","relevance":10,"id":"binary-1","sources":[{"report_type":"sandbox","report_id":"55c0bc7e0e316df02e616b24"},{"report_type":"sandbox","report_id":"64369837353cf50d1f02053d"}]},{"level":"suspicious","category":"Installation/Persistance","name":"Modifies auto-execute functionality by setting a value in the registry","description":"\"DrvUpdater.exe\" (Access type: \"CREATE\", Path: \"\\REGISTRY\\MACHINE\\SYSTEM\\CURRENTCONTROLSET\\SERVICES\\TCPIP\\PARAMETERS\")\n \"DrvUpdater.exe\" (Access type: \"CREATE\", Path: \"\\REGISTRY\\USER\\S-1-5-21-4162757579-3804539371-4239455898-1000\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\RUN\")\n \"DrvUpdater.exe\" (Access type: \"SETVAL\", Path: \"\\REGISTRY\\USER\\S-1-5-21-4162757579-3804539371-4239455898-1000\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\RUN\", Key: \"DRVUPDATER\", Value: \"C:\\Users\\PSPUBWS\\AppData\\Roaming\\DRPSu\\DrvUpdater.exe\")","origin":"Registry Access","relevance":8,"id":"registry-0","sources":[{"report_type":"sandbox","report_id":"55c0bc7e0e316df02e616b24"}]},{"level":"suspicious","category":"Network Related","name":"Found potential URL in binary/memory","description":"\"http://dev2.drp.su/download/DrvUpdater.exe\"","origin":"File/Memory","relevance":2,"id":"string-3","sources":[{"report_type":"sandbox","report_id":"55c0bc7e0e316df02e616b24"},{"report_type":"sandbox","report_id":"64369837353cf50d1f02053d"}]},{"level":"suspicious","category":"System Security","name":"Modifies proxy settings","description":"\"\" (Access type: \"DELETEVAL\", Path: \"\\REGISTRY\\USER\\S-1-5-21-4162757579-3804539371-4239455898-1000\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\", Key: \"PROXYBYPASS\")\n \"\" (Access type: \"DELETEVAL\", Path: \"\\REGISTRY\\MACHINE\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\", Key: \"PROXYBYPASS\")\n \"cmd.exe\" (Access type: \"DELETEVAL\", Path: \"\\REGISTRY\\USER\\S-1-5-21-4162757579-3804539371-4239455898-1000\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\", Key: \"PROXYBYPASS\")\n \"cmd.exe\" (Access type: \"DELETEVAL\", Path: \"\\REGISTRY\\MACHINE\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\", Key: \"PROXYBYPASS\")","origin":"Registry Access","relevance":10,"id":"registry-27","sources":[{"report_type":"sandbox","report_id":"55c0bc7e0e316df02e616b24"},{"report_type":"sandbox","report_id":"64369837353cf50d1f02053d"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Imports suspicious APIs","description":"LoadLibraryA\n GetProcAddress\n VirtualProtect\n VirtualAlloc\n RegOpenKeyA\n ShellExecuteA","origin":"Static Parser","relevance":1,"id":"static-1","sources":[{"report_type":"sandbox","report_id":"55c0bc7e0e316df02e616b24"},{"report_type":"sandbox","report_id":"64369837353cf50d1f02053d"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Reads information about supported languages","description":"\"cmd.exe\" (Path: \"\\REGISTRY\\MACHINE\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LOCALE\", Key: \"00000409\")\n \"DrvUpdater.exe\" (Path: \"\\REGISTRY\\MACHINE\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LOCALE\", Key: \"00000409\")","origin":"Registry Access","relevance":3,"id":"registry-25","sources":[{"report_type":"sandbox","report_id":"55c0bc7e0e316df02e616b24"},{"report_type":"sandbox","report_id":"64369837353cf50d1f02053d"}]},{"level":"malicious","category":"General","name":"Sample was identified as malicious by at least one Antivirus engine","description":"3/56 Antivirus vendors marked sample as malicious (5% detection rate)","origin":"External System","relevance":10,"id":"avtest-0","sources":[{"report_type":"sandbox","report_id":"55c0bc7e0e316df02e616b24"},{"report_type":"sandbox","report_id":"64369837353cf50d1f02053d"}]},{"level":"malicious","category":"Installation/Persistance","name":"Writes a PE file header to disc","description":"\"\" wrote 65536 bytes starting with PE header signature to file \"C:\\Users\\PSPUBWS\\AppData\\Roaming\\DRPSu\\DrvUpdater.exe\": 4d5a90000300000004000000ffff0000b8000000000000004000000000000000000000000000000000000000000000000000 ...","origin":"API Call","relevance":1,"id":"api-43","sources":[{"report_type":"sandbox","report_id":"55c0bc7e0e316df02e616b24"}]},{"level":"malicious","category":"Installation/Persistance","name":"Writes data to a remote process","description":"\"\" wrote 1500 bytes to a foreign process \"cmd.exe\" (PID: 00003376)\n \"\" wrote 4 bytes to a foreign process \"cmd.exe\" (PID: 00003376)\n \"\" wrote 32 bytes to a foreign process \"cmd.exe\" (PID: 00003376)\n \"\" wrote 52 bytes to a foreign process \"cmd.exe\" (PID: 00003376)","origin":"API Call","relevance":6,"id":"api-0","sources":[{"report_type":"sandbox","report_id":"55c0bc7e0e316df02e616b24"},{"report_type":"sandbox","report_id":"64369837353cf50d1f02053d"}]},{"level":"malicious","category":"Network Related","name":"Sends traffic on typical HTTP outbound port, but without HTTP header","description":"TCP traffic to 5.79.68.159 on port 80 is sent without HTTP header","origin":"Network Traffic","relevance":7,"id":"network-23","sources":[{"report_type":"sandbox","report_id":"55c0bc7e0e316df02e616b24"},{"report_type":"sandbox","report_id":"64369837353cf50d1f02053d"}]},{"level":"malicious","category":"Unusual Characteristics","name":"Contains native function calls","description":"ZwQueryInformationFile@NTDLL.DLL at 00550437-00003352-34215-1338-00E01020","origin":"Hybrid Analysis Technology","relevance":5,"id":"stream-22","sources":[{"report_type":"sandbox","report_id":"55c0bc7e0e316df02e616b24"}]},{"level":"malicious","category":"Unusual Characteristics","name":"Entrypoint points to uncommon section","description":"UPX1","origin":"Static Parser","relevance":5,"id":"static-4","sources":[{"report_type":"sandbox","report_id":"55c0bc7e0e316df02e616b24"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Calls an API typically used to find a resource in a module","description":"\"DrvUpdater.exe\" called \"FindResourceW\" (UID: 00000000-00003572)\n \"DrvUpdater.exe\" called \"FindResourceW\" with parameter \"789\" - (UID: 00000000-00003572)","origin":"API Call","mitre_attack_id":"T1106","relevance":3,"id":"api-140","sources":[{"report_type":"sandbox","report_id":"64369837353cf50d1f02053d"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Calls an API typically used to load a resource in memory","description":"\"DrvUpdater.exe\" called \"LoadResource\" (UID: 00000000-00003572)","origin":"API Call","mitre_attack_id":"T1106","relevance":3,"id":"api-139","sources":[{"report_type":"sandbox","report_id":"64369837353cf50d1f02053d"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to delay execution by waiting for signal/timeout (API string)","description":"Observed string: \"SleepEx\" (Indicator: \"SleepEx\") in Source: 00000000-00003572.00000000.77969.010B1000.00000040.mdmp\n Observed string: \"SleepEx\" (Indicator: \"SleepEx\") in Source: 00000000-00004260.00000000.78414.00261000.00000040.mdmp\n 00000000-00004260.00000001.80336.00261000.00000040.mdmp\n 00000000-00004260.00000002.82253.00261000.00000040.mdmp\n Observed string: \"SleepEx\" (Indicator: \"SleepEx\") in Source: 00000000-00006724.00000000.89696.00261000.00000040.mdmp","origin":"File/Memory","mitre_attack_id":"T1497.003","relevance":1,"id":"string-226","sources":[{"report_type":"sandbox","report_id":"64369837353cf50d1f02053d"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to free a loaded DLL module (API string)","description":"Observed string: \"FreeLibraryWhenCallbackReturns\" (Indicator: \"FreeLibrary\") in Source: 00000000-00006548-00000C1E-80523988","origin":"File/Memory","mitre_attack_id":"T1055.001","relevance":1,"id":"string-318","sources":[{"report_type":"sandbox","report_id":"64369837353cf50d1f02053d"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to modify process memory (API string)","description":"$27","origin":"File/Memory","mitre_attack_id":"T1055.003","relevance":1,"id":"string-309","sources":[{"report_type":"sandbox","report_id":"64369837353cf50d1f02053d"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to pass information to a window procedure (API string)","description":"Observed string: \"\" (Indicator: \"CallWindowProc\") in Source: 00000000-00003572.00000000.77969.00B10000.00000004.mdmp\n Observed string: \"\" (Indicator: \"CallWindowProc\") in Source: 00000000-00004260.00000000.78414.03120000.00000004.mdmp\n 00000000-00004260.00000001.80336.03120000.00000004.mdmp\n 00000000-00004260.00000002.82253.03120000.00000004.mdmp","origin":"File/Memory","mitre_attack_id":"T1564.003","relevance":1,"id":"string-320","sources":[{"report_type":"sandbox","report_id":"64369837353cf50d1f02053d"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"PE file contains zero-size sections","description":"Raw size of \"UPX0\" is zero","origin":"Static Parser","mitre_attack_id":"T1027","relevance":10,"id":"static-5","sources":[{"report_type":"sandbox","report_id":"64369837353cf50d1f02053d"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API possibly used to retrieve a handle to the foreground window","description":"\"DrvUpdater.exe\" called \"GetForegroundWindow\" (UID: 00000000-00003572)","origin":"API Call","mitre_attack_id":"T1010","relevance":3,"id":"api-142","sources":[{"report_type":"sandbox","report_id":"64369837353cf50d1f02053d"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to determine whether a process running under Wow64","description":"\"DrvUpdater.exe\" called \"IsWow64Process\" with parameter \"3572\" - (UID: 00000000-00003572)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-146","sources":[{"report_type":"sandbox","report_id":"64369837353cf50d1f02053d"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get product type","description":"\"DrvUpdater.exe\" called \"RtlGetNtProductType\" with parameter 01000000 (UID: 00000000-00003572)\n \"DrvUpdater.exe\" called \"RtlGetNtProductType\" (UID: 00000000-00003572)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-124","sources":[{"report_type":"sandbox","report_id":"64369837353cf50d1f02053d"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get system version information","description":"$28","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-125","sources":[{"report_type":"sandbox","report_id":"64369837353cf50d1f02053d"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to detect presence of virtual environment (API string)","description":"$29","origin":"File/Memory","mitre_attack_id":"T1497","relevance":1,"id":"string-253","sources":[{"report_type":"sandbox","report_id":"64369837353cf50d1f02053d"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to perform scheduled transfer (API string)","description":"Observed string: \"GetSystemTimePreciseAsFileTime\" (Indicator: \"GetSystemTime\") in Source: 00000000-00006548-00000C1E-80524655\n Observed string: \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTime\") in Source: 00000000-00003572.00000000.77969.010B1000.00000040.mdmp\n Observed string: \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTime\") in Source: 00000000-00004260.00000000.78414.00261000.00000040.mdmp\n 00000000-00004260.00000001.80336.00261000.00000040.mdmp\n 00000000-00004260.00000002.82253.00261000.00000040.mdmp\n Observed string: \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTime\") in Source: 00000000-00006724.00000000.89696.00261000.00000040.mdmp","origin":"File/Memory","mitre_attack_id":"T1029","relevance":1,"id":"string-365","sources":[{"report_type":"sandbox","report_id":"64369837353cf50d1f02053d"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query system locale (API string)","description":"$2a","origin":"File/Memory","mitre_attack_id":"T1614","relevance":1,"id":"string-201","sources":[{"report_type":"sandbox","report_id":"64369837353cf50d1f02053d"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to read software policies","description":"\"DrvUpdater.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\")\n \"cmd.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\")\n \"cmd.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"LEVELS\")\n \"cmd.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"DEFAULTLEVEL\")\n \"cmd.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"SAFERFLAGS\")\n \"cmd.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"POLICYSCOPE\")\n \"cmd.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"LOGFILENAME\")\n \"cmd.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"AUTHENTICODEENABLED\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":1,"id":"registry-78","sources":[{"report_type":"sandbox","report_id":"64369837353cf50d1f02053d"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve file time (API string)","description":"$2b","origin":"File/Memory","mitre_attack_id":"T1070.006","relevance":1,"id":"string-249","sources":[{"report_type":"sandbox","report_id":"64369837353cf50d1f02053d"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve machine time (API string)","description":"Observed string: \"GetSystemTimePreciseAsFileTime\" (Indicator: \"GetSystemTime\") in Source: 00000000-00006548-00000C1E-80524655\n Observed string: \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTime\") in Source: 00000000-00003572.00000000.77969.010B1000.00000040.mdmp\n Observed string: \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTime\") in Source: 00000000-00004260.00000000.78414.00261000.00000040.mdmp\n 00000000-00004260.00000001.80336.00261000.00000040.mdmp\n 00000000-00004260.00000002.82253.00261000.00000040.mdmp\n Observed string: \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTime\") in Source: 00000000-00006724.00000000.89696.00261000.00000040.mdmp","origin":"File/Memory","mitre_attack_id":"T1124","relevance":1,"id":"string-247","sources":[{"report_type":"sandbox","report_id":"64369837353cf50d1f02053d"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve machine timezone (API string)","description":"Observed string: \"GetTimeZoneInformation\" (Indicator: \"GetTimeZoneInformation\") in Source: 00000000-00003572.00000000.77969.010B1000.00000040.mdmp\n Observed string: \"GetTimeZoneInformation\" (Indicator: \"GetTimeZoneInformation\") in Source: 00000000-00004260.00000000.78414.00261000.00000040.mdmp\n 00000000-00004260.00000001.80336.00261000.00000040.mdmp\n 00000000-00004260.00000002.82253.00261000.00000040.mdmp\n Observed string: \"GetTimeZoneInformation\" (Indicator: \"GetTimeZoneInformation\") in Source: 00000000-00006724.00000000.89696.00261000.00000040.mdmp","origin":"File/Memory","mitre_attack_id":"T1124","relevance":1,"id":"string-248","sources":[{"report_type":"sandbox","report_id":"64369837353cf50d1f02053d"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve open application windows (API string)","description":"Observed api:\"FindWindow\"[Source: 00000000-00003572.00000000.77969.010B1000.00000040.mdmp]\n Observed api:\"FindWindow\"[Source: 00000000-00004260.00000000.78414.00261000.00000040.mdmp\n 00000000-00004260.00000001.80336.00261000.00000040.mdmp\n 00000000-00004260.00000002.82253.00261000.00000040.mdmp]\n Observed api:\"FindWindow\"[Source: 00000000-00006724.00000000.89696.00261000.00000040.mdmp]","origin":"File/Memory","mitre_attack_id":"T1010","relevance":1,"id":"string-141","sources":[{"report_type":"sandbox","report_id":"64369837353cf50d1f02053d"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve volume information (API string)","description":"Observed string: \"GetVolumeInformation\" [Source: 00000000-00003572.00000000.77969.010B1000.00000040.mdmp]\n Observed string: \"GetVolumeInformation\" [Source: 00000000-00004260.00000000.78414.00261000.00000040.mdmp\n 00000000-00004260.00000001.80336.00261000.00000040.mdmp\n 00000000-00004260.00000002.82253.00261000.00000040.mdmp]\n Observed string: \"GetVolumeInformation\" [Source: 00000000-00006724.00000000.89696.00261000.00000040.mdmp]","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-162","sources":[{"report_type":"sandbox","report_id":"64369837353cf50d1f02053d"}]},{"level":"informative","category":"Environment Awareness","name":"Queries volume information","description":"\"cmd.exe\" queries volume information of \"C:\\\" at 00000000-00006548-00000C15-80571864","origin":"API Call","mitre_attack_id":"T1082","relevance":2,"id":"api-11","sources":[{"report_type":"sandbox","report_id":"64369837353cf50d1f02053d"}]},{"level":"informative","category":"Environment Awareness","name":"Queries volume information of an entire harddrive","description":"\"cmd.exe\" queries volume information of \"C:\\\" at 00000000-00006548-00000C15-80571864","origin":"API Call","mitre_attack_id":"T1082","relevance":8,"id":"api-39","sources":[{"report_type":"sandbox","report_id":"64369837353cf50d1f02053d"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the active computer name","description":"\"DrvUpdater.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":5,"id":"registry-35","sources":[{"report_type":"sandbox","report_id":"64369837353cf50d1f02053d"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the cryptographic machine GUID","description":"\"DrvUpdater.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":5,"id":"registry-1","sources":[{"report_type":"sandbox","report_id":"64369837353cf50d1f02053d"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the registry for installed applications","description":"\"DrvUpdater.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\DRVUPDATER.RUN.BAT\")\n \"DrvUpdater.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\UNINSTALL\\DRPSU UPDATER\")","origin":"Registry Access","mitre_attack_id":"T1518","relevance":10,"id":"registry-55","sources":[{"report_type":"sandbox","report_id":"64369837353cf50d1f02053d"}]},{"level":"informative","category":"General","name":"Calls an API typically used to create a directory","description":"\"DrvUpdater.exe\" called \"CreateDirectoryA\" with parameter %APPDATA%\\DRPSu (UID: 00000000-00004260)\n \"DrvUpdater.exe\" called \"CreateDirectoryA\" with parameter %APPDATA%\\DRPSu (UID: 00000000-00006724)","origin":"API Call","mitre_attack_id":"T1074.001","relevance":3,"id":"api-122","sources":[{"report_type":"sandbox","report_id":"64369837353cf50d1f02053d"}]},{"level":"informative","category":"General","name":"Calls an API typically used to create a process","description":"\"cmd.exe\" called \"CreateProcessW\" with parameter \"DrvUpdater.exe\" - (UID: 00000000-00006548)","origin":"API Call","mitre_attack_id":"T1106","relevance":5,"id":"api-128","sources":[{"report_type":"sandbox","report_id":"64369837353cf50d1f02053d"}]},{"level":"informative","category":"General","name":"Calls an API typically used to load libraries","description":"\"DrvUpdater.exe\" called \"LoadLibrary\" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00003572)\n \"DrvUpdater.exe\" called \"LoadLibrary\" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00003572)\n \"DrvUpdater.exe\" called \"LoadLibrary\" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00003572)\n \"DrvUpdater.exe\" called \"LoadLibrary\" with a parameter kernel32 (UID: 00000000-00003572)\n \"DrvUpdater.exe\" called \"LoadLibrary\" with a parameter %PROGRAMFILES(X86)%\\COMMON~1\\MICROS~1\\OFFICE14\\Cultures\\office.odf (UID: 00000000-00003572)\n \"cmd.exe\" called \"LoadLibrary\" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00006548)\n \"cmd.exe\" called \"LoadLibrary\" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00006548)\n \"cmd.exe\" called \"LoadLibrary\" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00006548)\n \"cmd.exe\" called \"LoadLibrary\" with a parameter kernel32 (UID: 00000000-00006548)","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-175","sources":[{"report_type":"sandbox","report_id":"64369837353cf50d1f02053d"}]},{"level":"informative","category":"General","name":"Calls an API typically used to retrieve function addresses","description":"$2c","origin":"API Call","mitre_attack_id":"T1106","relevance":1,"id":"api-176","sources":[{"report_type":"sandbox","report_id":"64369837353cf50d1f02053d"}]},{"level":"informative","category":"General","name":"Contains Windows APIs","description":"details too long to display","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-101","sources":[{"report_type":"sandbox","report_id":"64369837353cf50d1f02053d"}]},{"level":"informative","category":"General","name":"Contains ability to close the handle to a registry key (API string)","description":"Observed string: \"RegCloseKey\" (Indicator: \"RegCloseKey\") in Source: 00000000-00003572.00000000.77969.010B1000.00000040.mdmp\n Observed string: \"RegCloseKey\" (Indicator: \"RegCloseKey\") in Source: 00000000-00004260.00000000.78414.00261000.00000040.mdmp\n 00000000-00004260.00000001.80336.00261000.00000040.mdmp\n 00000000-00004260.00000002.82253.00261000.00000040.mdmp\n Observed string: \"RegCloseKey\" (Indicator: \"RegCloseKey\") in Source: 00000000-00006724.00000000.89696.00261000.00000040.mdmp","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-345","sources":[{"report_type":"sandbox","report_id":"64369837353cf50d1f02053d"}]},{"level":"informative","category":"General","name":"Contains ability to create files (API string)","description":"Observed string: \"CreateFileA\" (Indicator: \"CreateFile\") in Source: 00000000-00003572.00000000.77969.010B1000.00000040.mdmp\n Observed string: \"CreateFileW\" (Indicator: \"CreateFile\") in Source: 00000000-00003572.00000000.77969.010B1000.00000040.mdmp\n Observed string: \"CreateFileA\" (Indicator: \"CreateFile\") in Source: 00000000-00004260.00000000.78414.00261000.00000040.mdmp\n 00000000-00004260.00000001.80336.00261000.00000040.mdmp\n 00000000-00004260.00000002.82253.00261000.00000040.mdmp\n Observed string: \"CreateFileW\" (Indicator: \"CreateFile\") in Source: 00000000-00004260.00000000.78414.00261000.00000040.mdmp\n 00000000-00004260.00000001.80336.00261000.00000040.mdmp\n 00000000-00004260.00000002.82253.00261000.00000040.mdmp\n Observed string: \"CreateFileA\" (Indicator: \"CreateFile\") in Source: 00000000-00006724.00000000.89696.00261000.00000040.mdmp\n Observed string: \"CreateFileW\" (Indicator: \"CreateFile\") in Source: 00000000-00006724.00000000.89696.00261000.00000040.mdmp","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-315","sources":[{"report_type":"sandbox","report_id":"64369837353cf50d1f02053d"}]},{"level":"informative","category":"General","name":"Contains ability to create/open registry keys (API string)","description":"Observed string: \"RegCreateKeyExA\" (Indicator: \"RegCreateKey\") in Source: 00000000-00003572.00000000.77969.010B1000.00000040.mdmp\n Observed string: \"RegCreateKeyExA\" (Indicator: \"RegCreateKey\") in Source: 00000000-00004260.00000000.78414.00261000.00000040.mdmp\n 00000000-00004260.00000001.80336.00261000.00000040.mdmp\n 00000000-00004260.00000002.82253.00261000.00000040.mdmp\n Observed string: \"RegCreateKeyExA\" (Indicator: \"RegCreateKey\") in Source: 00000000-00006724.00000000.89696.00261000.00000040.mdmp","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-307","sources":[{"report_type":"sandbox","report_id":"64369837353cf50d1f02053d"}]},{"level":"informative","category":"General","name":"Contains ability to dynamically determine API calls","description":"Found GetProcAddress() and LoadLibraryA() in an import section (Source: 574d0ca9cda56cd8dd6398baf3e1cdcf56e9ca4f71d85d9155fac4325444ea25.bin)\n Found GetProcAddress() and LoadLibraryA() in an import section (Source: DrvUpdater.exe)","origin":"Static Parser","mitre_attack_id":"T1027.007","relevance":1,"id":"static-79","sources":[{"report_type":"sandbox","report_id":"64369837353cf50d1f02053d"}]},{"level":"informative","category":"General","name":"Contains ability to execute an application (API string)","description":"$2d","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-240","sources":[{"report_type":"sandbox","report_id":"64369837353cf50d1f02053d"}]},{"level":"informative","category":"General","name":"Contains ability to modify process thread functionality (API string)","description":"Found string \"CreateThread\" (Indicator: \"CreateThread\"; Source: \"00000000-00003572.00000000.77969.010B1000.00000040.mdmp\")\n Found string \"CreateThread\" (Indicator: \"CreateThread\"; Source: \"00000000-00004260.00000000.78414.00261000.00000040.mdmp, 00000000-00004260.00000001.80336.00261000.00000040.mdmp, 00000000-00004260.00000002.82253.00261000.00000040.mdmp\")\n Found string \"CreateThread\" (Indicator: \"CreateThread\"; Source: \"00000000-00006724.00000000.89696.00261000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-161","sources":[{"report_type":"sandbox","report_id":"64369837353cf50d1f02053d"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve the command-line string for the current process (API string)","description":"Observed string: \"GetCommandLineA\" (Indicator: \"GetCommandLine\") in Source: 00000000-00003572.00000000.77969.010B1000.00000040.mdmp\n Observed string: \"GetCommandLineA\" (Indicator: \"GetCommandLine\") in Source: 00000000-00004260.00000000.78414.00261000.00000040.mdmp\n 00000000-00004260.00000001.80336.00261000.00000040.mdmp\n 00000000-00004260.00000002.82253.00261000.00000040.mdmp\n Observed string: \"GetCommandLineA\" (Indicator: \"GetCommandLine\") in Source: 00000000-00006724.00000000.89696.00261000.00000040.mdmp","origin":"File/Memory","mitre_attack_id":"T1059.003","relevance":1,"id":"string-206","sources":[{"report_type":"sandbox","report_id":"64369837353cf50d1f02053d"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve/open a process (API string)","description":"Observed string: \"GetProcessHeap\" (Indicator: \"GetProcessHeap\") in Source: 00000000-00003572.00000000.77969.010B1000.00000040.mdmp\n Observed string: \"GetProcessHeap\" (Indicator: \"GetProcessHeap\") in Source: 00000000-00004260.00000000.78414.00261000.00000040.mdmp\n 00000000-00004260.00000001.80336.00261000.00000040.mdmp\n 00000000-00004260.00000002.82253.00261000.00000040.mdmp\n Observed string: \"GetProcessHeap\" (Indicator: \"GetProcessHeap\") in Source: 00000000-00006724.00000000.89696.00261000.00000040.mdmp","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-272","sources":[{"report_type":"sandbox","report_id":"64369837353cf50d1f02053d"}]},{"level":"informative","category":"General","name":"Contains ability to set/get the last-error code for a calling thread (API string)","description":"Observed string: \"GetLastError\" (Indicator: \"GetLastError\") in Source: 00000000-00003572.00000000.77969.010B1000.00000040.mdmp\n Observed string: \"SetLastError\" (Indicator: \"SetLastError\") in Source: 00000000-00003572.00000000.77969.010B1000.00000040.mdmp\n Observed string: \"GetLastError\" (Indicator: \"GetLastError\") in Source: 00000000-00004260.00000000.78414.00261000.00000040.mdmp\n 00000000-00004260.00000001.80336.00261000.00000040.mdmp\n 00000000-00004260.00000002.82253.00261000.00000040.mdmp\n Observed string: \"SetLastError\" (Indicator: \"SetLastError\") in Source: 00000000-00004260.00000000.78414.00261000.00000040.mdmp\n 00000000-00004260.00000001.80336.00261000.00000040.mdmp\n 00000000-00004260.00000002.82253.00261000.00000040.mdmp\n Observed string: \"GetLastError\" (Indicator: \"GetLastError\") in Source: 00000000-00006724.00000000.89696.00261000.00000040.mdmp\n Observed string: \"SetLastError\" (Indicator: \"SetLastError\") in Source: 00000000-00006724.00000000.89696.00261000.00000040.mdmp","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-319","sources":[{"report_type":"sandbox","report_id":"64369837353cf50d1f02053d"}]},{"level":"informative","category":"General","name":"Contains ability to show a graphical window (API string)","description":"Observed string: \"ShowWindow\" (Indicator: \"ShowWindow\") in Source: 00000000-00003572.00000000.77969.010B1000.00000040.mdmp\n Observed string: \"ShowWindow\" (Indicator: \"ShowWindow\") in Source: 00000000-00004260.00000000.78414.00261000.00000040.mdmp\n 00000000-00004260.00000001.80336.00261000.00000040.mdmp\n 00000000-00004260.00000002.82253.00261000.00000040.mdmp\n Observed string: \"ShowWindow\" (Indicator: \"ShowWindow\") in Source: 00000000-00006724.00000000.89696.00261000.00000040.mdmp","origin":"File/Memory","mitre_attack_id":"T1564.003","relevance":1,"id":"string-208","sources":[{"report_type":"sandbox","report_id":"64369837353cf50d1f02053d"}]},{"level":"informative","category":"General","name":"Executes batch file","description":"Process \"cmd.exe\" with commandline \"%WINDIR%\\\\system32\\\\cmd.exe /c \"\"%TEMP%\\\\DrvUpdater.Run.bat\" \"\" (UID: 00000000-00006548)","origin":"Monitored Target","mitre_attack_id":"T1059","relevance":3,"id":"target-220","sources":[{"report_type":"sandbox","report_id":"64369837353cf50d1f02053d"}]},{"level":"informative","category":"General","name":"Found user-agent related strings","description":"\"User-Agent: %s\" (Indicator: \"user-agent: \")\" in Source: 00000000-00003572.00000000.77969.010B1000.00000040.mdmp","origin":"File/Memory","mitre_attack_id":"T1071.001","relevance":1,"id":"string-127","sources":[{"report_type":"sandbox","report_id":"64369837353cf50d1f02053d"}]},{"level":"informative","category":"General","name":"Loads modules at runtime","description":"$2e","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-7","sources":[{"report_type":"sandbox","report_id":"64369837353cf50d1f02053d"}]},{"level":"informative","category":"General","name":"Loads the RPC (Remote Procedure Call) module DLL","description":"\"DrvUpdater.exe\" loaded module \"%WINDIR%\\SysWOW64\\rpcrt4.dll\" at 76C20000\n \"cmd.exe\" loaded module \"%WINDIR%\\SysWOW64\\rpcrt4.dll\" at 76C20000","origin":"Loaded Module","mitre_attack_id":"T1129","id":"module-10","sources":[{"report_type":"sandbox","report_id":"64369837353cf50d1f02053d"}]},{"level":"informative","category":"General","name":"Loads the cryptographic module DLL","description":"\"DrvUpdater.exe\" loaded module \"%WINDIR%\\SysWOW64\\bcryptprimitives.dll\" at 76CE0000\n \"cmd.exe\" loaded module \"%WINDIR%\\SysWOW64\\bcryptprimitives.dll\" at 76CE0000","origin":"Loaded Module","mitre_attack_id":"T1027","id":"module-9","sources":[{"report_type":"sandbox","report_id":"64369837353cf50d1f02053d"}]},{"level":"informative","category":"General","name":"Overview of unique CLSIDs touched in registry","description":"$2f","origin":"Registry Access","mitre_attack_id":"T1546.015","relevance":3,"id":"registry-72","sources":[{"report_type":"sandbox","report_id":"64369837353cf50d1f02053d"}]},{"level":"informative","category":"General","name":"PE file contains executable sections","description":"\"574d0ca9cda56cd8dd6398baf3e1cdcf56e9ca4f71d85d9155fac4325444ea25.bin\" has an executable section named \"UPX0\"\n \"574d0ca9cda56cd8dd6398baf3e1cdcf56e9ca4f71d85d9155fac4325444ea25.bin\" has an executable section named \"UPX1\"\n \"DrvUpdater.exe\" has an executable section named \"UPX0\"\n \"DrvUpdater.exe\" has an executable section named \"UPX1\"","origin":"Static Parser","relevance":1,"id":"static-80","sources":[{"report_type":"sandbox","report_id":"64369837353cf50d1f02053d"}]},{"level":"informative","category":"General","name":"PE file contains writable sections","description":"\"574d0ca9cda56cd8dd6398baf3e1cdcf56e9ca4f71d85d9155fac4325444ea25.bin\" has an writable section named \"UPX0\"\n \"574d0ca9cda56cd8dd6398baf3e1cdcf56e9ca4f71d85d9155fac4325444ea25.bin\" has an writable section named \"UPX1\"\n \"574d0ca9cda56cd8dd6398baf3e1cdcf56e9ca4f71d85d9155fac4325444ea25.bin\" has an writable section named \".rsrc\"\n \"DrvUpdater.exe\" has an writable section named \"UPX0\"\n \"DrvUpdater.exe\" has an writable section named \"UPX1\"\n \"DrvUpdater.exe\" has an writable section named \".rsrc\"","origin":"Static Parser","id":"static-95","sources":[{"report_type":"sandbox","report_id":"64369837353cf50d1f02053d"}]},{"level":"informative","category":"General","name":"PE file entrypoint instructions","description":"$30","origin":"Static Parser","id":"static-96","sources":[{"report_type":"sandbox","report_id":"64369837353cf50d1f02053d"}]},{"level":"informative","category":"General","name":"Possibly executes files or commands through Windows command line","description":"Found string \"%WINDIR%\\system32\\cmd.exe /c \"\"%TEMP%\\DrvUpdater.Run.bat\" \"\" (Indicator: \"\\system32\\cmd.exe /c \"; File: \"cmd.exe\")","origin":"File/Memory","mitre_attack_id":"T1059.003","relevance":1,"id":"string-174","sources":[{"report_type":"sandbox","report_id":"64369837353cf50d1f02053d"}]},{"level":"informative","category":"General","name":"Process launched with changed environment","description":"Process \"cmd.exe\" (UID: 00000000-00006548) was launched with new environment variables: \"PROCESSOR_ARCHITEW6432=\"AMD64\"\"\n Process \"cmd.exe\" (UID: 00000000-00006548) was launched with modified environment variables: \"PROCESSOR_ARCHITECTURE, CommonProgramFiles, ProgramFiles\"\n Process \"DrvUpdater.exe\" (UID: 00000000-00004260) was launched with new environment variables: \"PROMPT=\"$P$G\"\"\n Process \"DrvUpdater.exe\" (UID: 00000000-00006724) was launched with modified environment variables: \"Path\"","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":10,"id":"target-67","sources":[{"report_type":"sandbox","report_id":"64369837353cf50d1f02053d"}]},{"level":"informative","category":"General","name":"Queries DNS server","description":"\"update.drp.su\"","origin":"Network Traffic","mitre_attack_id":"T1071.004","relevance":1,"id":"network-51","sources":[{"report_type":"sandbox","report_id":"64369837353cf50d1f02053d"}]},{"level":"informative","category":"General","name":"Scanning for window names","description":"\"DrvUpdater.exe\" searching for class \"Shell_TrayWnd\"","origin":"API Call","mitre_attack_id":"T1010","relevance":10,"id":"api-70","sources":[{"report_type":"sandbox","report_id":"64369837353cf50d1f02053d"}]},{"level":"informative","category":"General","name":"Spawns new processes","description":"Spawned process \"cmd.exe\" with commandline \"%WINDIR%\\\\system32\\\\cmd.exe /c \"\"%TEMP%\\\\DrvUpdater.Run.bat\" \"\" (UID: 00000000-00006548)\n Spawned process \"DrvUpdater.exe\" (UID: 00000000-00004260)","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":3,"id":"target-25","sources":[{"report_type":"sandbox","report_id":"64369837353cf50d1f02053d"}]},{"level":"informative","category":"General","name":"Spawns new processes that are not known child processes","description":"Spawned process \"cmd.exe\" with commandline \"%WINDIR%\\\\system32\\\\cmd.exe /c \"\"%TEMP%\\\\DrvUpdater.Run.bat\" \"\" (UID: 00000000-00006548)\n Spawned process \"DrvUpdater.exe\" (UID: 00000000-00004260)","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":3,"id":"target-103","sources":[{"report_type":"sandbox","report_id":"64369837353cf50d1f02053d"}]},{"level":"informative","category":"General","name":"The input sample is signed with a certificate","description":"$31","origin":"Certificate Data","mitre_attack_id":"T1553.002","relevance":10,"id":"certificate-0","sources":[{"report_type":"sandbox","report_id":"64369837353cf50d1f02053d"}]},{"level":"informative","category":"General","name":"The input sample is signed with a valid certificate","description":"The entire certificate chain of the input sample was validated successfully.","origin":"Certificate Data","mitre_attack_id":"T1553.002","relevance":10,"id":"certificate-2","sources":[{"report_type":"sandbox","report_id":"64369837353cf50d1f02053d"}]},{"level":"informative","category":"Installation/Persistence","name":"Contains ability to load modules (API string)","description":"Observed string: \"LoadLibraryA\" (Indicator: \"LoadLibrary\") in Source: 574d0ca9cda56cd8dd6398baf3e1cdcf56e9ca4f71d85d9155fac4325444ea25.bin\n Observed string: \"LoadLibraryA\" (Indicator: \"LoadLibrary\") in Source: 00000000-00003572.00000000.77969.010B1000.00000040.mdmp\n 00000000-00003572.00000000.77969.01117000.00000004.mdmp\n Observed string: \"LoadLibraryA\" (Indicator: \"LoadLibrary\") in Source: 00000000-00004260.00000000.78414.00261000.00000040.mdmp\n 00000000-00004260.00000000.78414.002C7000.00000004.mdmp\n 00000000-00004260.00000001.80336.00261000.00000040.mdmp\n 00000000-00004260.00000001.80336.002C7000.00000004.mdmp\n 00000000-00004260.00000002.82253.00261000.00000040.mdmp\n 00000000-00004260.00000002.82253.002C7000.00000004.mdmp\n Observed string: \"LoadLibraryA\" (Indicator: \"LoadLibrary\") in Source: 00000000-00006724.00000000.89696.00261000.00000040.mdmp\n 00000000-00006724.00000000.89696.002C7000.00000004.mdmp","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-310","sources":[{"report_type":"sandbox","report_id":"64369837353cf50d1f02053d"}]},{"level":"informative","category":"Installation/Persistence","name":"Drops XML files","description":"\"DrvUpdater.xml\" has type \"ASCII text\" - Location: [%TEMP%\\DrvUpdater.xml]","origin":"Binary File","mitre_attack_id":"T1105","relevance":1,"id":"binary-39","sources":[{"report_type":"sandbox","report_id":"64369837353cf50d1f02053d"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files in the Windows directory","description":"\"DrvUpdater.exe\" touched file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Microsoft\\Windows\\Caches\"\n \"DrvUpdater.exe\" touched file \"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches\"","origin":"API Call","mitre_attack_id":"T1083","relevance":7,"id":"api-55","sources":[{"report_type":"sandbox","report_id":"64369837353cf50d1f02053d"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (executable)","description":"$32","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-126","sources":[{"report_type":"sandbox","report_id":"64369837353cf50d1f02053d"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (non-executable)","description":"\"DrvUpdater.exe\" trying to access non-existent file \"C:\\DRVUPDATER.EXE.LOCAL\"\n \"DrvUpdater.exe\" trying to access non-existent file \"C:\\DrvUpdater.exe.Local\\\"\n \"DrvUpdater.exe\" trying to access non-existent file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\DrvUpdater.Run.bat:ZONE.IDENTIFIER\"\n \"DrvUpdater.exe\" trying to access non-existent file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\DrvUpdater.Run.bat:Zone.Identifier\"\n \"DrvUpdater.exe\" trying to access non-existent file \"C:\\Windows\\WinSxS\\FileMaps\\USERS_%OSUSER%_APPDATA_LOCAL_TEMP_3C2DE5193402AF3A.CDF-MS\"\n \"cmd.exe\" trying to access non-existent file \"C:\\Windows\\SysWOW64\\AppLocker\\MDM\"\n \"cmd.exe\" trying to access non-existent file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\DRVUPDATER.RUN.BAT\"","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-161","sources":[{"report_type":"sandbox","report_id":"64369837353cf50d1f02053d"}]},{"level":"informative","category":"Network Related","name":"Communicates with HTTP webserver (GET/POST requests)","description":"Found http requests in header \"GET /drpupdater/DrvUpdater.xml\"","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":1,"id":"network-62","sources":[{"report_type":"sandbox","report_id":"64369837353cf50d1f02053d"}]},{"level":"informative","category":"Network Related","name":"Contains ability to copy files","description":"Observed string: \"copy /Y /B \"%TEMP%\\DrvUpdater.Update\" \"%APPDATA%\\DRPSu\\DrvUpdater.exe\"\" (Indicator: \"copy \") in Source: 00000000-00003572.00000000.77969.010B1000.00000040.mdmp\n Observed string: \"Copy\" (Indicator: \"copy\") in Source: 00000000-00003572.00000000.77969.03340000.00000002.mdmp\n Observed string: \"copy /Y /B \"%TEMP%\\DrvUpdater.Update\" \"%APPDATA%\\DRPSu\\DrvUpdater.exe\"\" (Indicator: \"copy \") in Source: 00000000-00004260.00000000.78414.00261000.00000040.mdmp\n 00000000-00004260.00000001.80336.00261000.00000040.mdmp\n 00000000-00004260.00000002.82253.00261000.00000040.mdmp\n Observed string: \"copy /Y /B \"%TEMP%\\DrvUpdater.Update\" \"%APPDATA%\\DRPSu\\DrvUpdater.exe\"\" (Indicator: \"copy \") in Source: 00000000-00006724.00000000.89696.00261000.00000040.mdmp","origin":"File/Memory","mitre_attack_id":"T1105","relevance":1,"id":"string-329","sources":[{"report_type":"sandbox","report_id":"64369837353cf50d1f02053d"}]},{"level":"informative","category":"Network Related","name":"Contains ability to upload file/data","description":"Found string \"Content-Disposition: form-data; name=\"\"; Source: \"00000000-00003572.00000000.77969.010B1000.00000040.mdmp\"), Found string \"Content-Disposition: form-data; name=\"\"; Source: \"00000000-00004260.00000000.78414.00261000.00000040.mdmp, 00000000-00004260.00000001.80336.00261000.00000040.mdmp, 00000000-00004260.00000002.82253.00261000.00000040.mdmp\")\n Found string \"Content-Disposition: form-data; name=\"\"; Source: \"00000000-00006724.00000000.89696.00261000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1041","relevance":1,"id":"string-511","sources":[{"report_type":"sandbox","report_id":"64369837353cf50d1f02053d"}]},{"level":"informative","category":"Network Related","name":"Found mail related domain names","description":"Observed email domain:\"imap.\" [Source: 00000000-00003572.00000000.77969.010B1000.00000040.mdmp]\n Observed email domain:\"imap.\" [Source: 00000000-00004260.00000000.78414.00261000.00000040.mdmp\n 00000000-00004260.00000001.80336.00261000.00000040.mdmp\n 00000000-00004260.00000002.82253.00261000.00000040.mdmp]\n Observed email domain:\"imap.\" [Source: 00000000-00006724.00000000.89696.00261000.00000040.mdmp]","origin":"File/Memory","mitre_attack_id":"T1071.003","relevance":1,"id":"string-169","sources":[{"report_type":"sandbox","report_id":"64369837353cf50d1f02053d"}]},{"level":"informative","category":"Network Related","name":"Making HTTPS connections using secure TLS/SSL version","description":"Connection was made using TLSv1.2 [tls.handshake.version: 0x00000303]","origin":"Network Traffic","mitre_attack_id":"T1573","relevance":1,"id":"network-54","sources":[{"report_type":"sandbox","report_id":"64369837353cf50d1f02053d"}]},{"level":"informative","category":"Network Related","name":"Possibly tries to communicate over SSL connection (HTTPS)","description":"Found HTTPS url \"https://secure.comodo.net\"","origin":"File/Memory","mitre_attack_id":"T1573","relevance":1,"id":"string-98","sources":[{"report_type":"sandbox","report_id":"64369837353cf50d1f02053d"}]},{"level":"informative","category":"Pattern Matching","name":"YARA signature match - RC4 Encryption","description":"YARA signature for RC4 encryption matched on process \"00000000-00006724\"\n YARA signature for RC4 encryption matched on process \"00000000-00004260\"\n YARA signature for RC4 encryption matched on process \"00000000-00003572\"","origin":"YARA Signature","mitre_attack_id":"T1027","relevance":5,"id":"yara-104","sources":[{"report_type":"sandbox","report_id":"64369837353cf50d1f02053d"}]},{"level":"informative","category":"Remote Access Related","name":"Contains references to RPC protocol sequence strings","description":"Found string \"9ncalrpc:[epmapper,Security=Impersonation Dynamic False]\" (Indicator: \"ncalrpc\"; Source: \"00000000-00003572.00000000.77969.00B10000.00000004.mdmp\")\n Found string \"+ncalrpc:[OLEDE32E7BFFD2E8C18CBAA8912005B]\" (Indicator: \"ncalrpc\"; Source: \"00000000-00003572.00000000.77969.00B10000.00000004.mdmp\")\n Found string \"+ncalrpc:[OLE5D8D3587AA26034A2F8998137B6A]\" (Indicator: \"ncalrpc\"; Source: \"00000000-00003572.00000000.77969.00B10000.00000004.mdmp\")\n Found string \"B+ncalrpc:[OLEDE32E7BFFD2E8C18CBAA8912005B]\" (Indicator: \"ncalrpc\"; Source: \"00000000-00003572.00000000.77969.00B10000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1090","relevance":1,"id":"string-531","sources":[{"report_type":"sandbox","report_id":"64369837353cf50d1f02053d"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used for taking snapshot of the specified processes","description":"\"DrvUpdater.exe\" called \"CreateToolhelp32Snapshot\" (UID: 00000000-00003572)\n \"cmd.exe\" called \"CreateToolhelp32Snapshot\" (UID: 00000000-00006548)","origin":"API Call","mitre_attack_id":"T1057","relevance":3,"id":"api-103","sources":[{"report_type":"sandbox","report_id":"64369837353cf50d1f02053d"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to capture screen (API string)","description":"$33","origin":"File/Memory","mitre_attack_id":"T1113","relevance":1,"id":"string-78","sources":[{"report_type":"sandbox","report_id":"64369837353cf50d1f02053d"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to determine disk drive type (API string)","description":"Observed string: \"GetDriveTypeA\" [Source: 00000000-00003572.00000000.77969.010B1000.00000040.mdmp]\n Observed string: \"GetDriveTypeA\" [Source: 00000000-00004260.00000000.78414.00261000.00000040.mdmp\n 00000000-00004260.00000001.80336.00261000.00000040.mdmp\n 00000000-00004260.00000002.82253.00261000.00000040.mdmp]\n Observed string: \"GetDriveTypeA\" [Source: 00000000-00006724.00000000.89696.00261000.00000040.mdmp]","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-80","sources":[{"report_type":"sandbox","report_id":"64369837353cf50d1f02053d"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate files on disk (API string)","description":"Observed string: \"FindFirstFileA\" [Source: 00000000-00003572.00000000.77969.010B1000.00000040.mdmp]\n Observed string: \"FindFirstFileA\" [Source: 00000000-00004260.00000000.78414.00261000.00000040.mdmp\n 00000000-00004260.00000001.80336.00261000.00000040.mdmp\n 00000000-00004260.00000002.82253.00261000.00000040.mdmp]\n Observed string: \"FindFirstFileA\" [Source: 00000000-00006724.00000000.89696.00261000.00000040.mdmp]","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-83","sources":[{"report_type":"sandbox","report_id":"64369837353cf50d1f02053d"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to read registry keys (API string)","description":"$34","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-229","sources":[{"report_type":"sandbox","report_id":"64369837353cf50d1f02053d"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve address of exported function from a DLL (API string)","description":"Observed string: \"GetProcAddress\" (Indicator: \"GetProcAddress\") in Source: 574d0ca9cda56cd8dd6398baf3e1cdcf56e9ca4f71d85d9155fac4325444ea25.bin\n Observed string: \"GetProcAddress\" (Indicator: \"GetProcAddress\") in Source: 00000000-00003572.00000000.77969.010B1000.00000040.mdmp\n 00000000-00003572.00000000.77969.01117000.00000004.mdmp\n Observed string: \"GetProcAddress\" (Indicator: \"GetProcAddress\") in Source: 00000000-00004260.00000000.78414.00261000.00000040.mdmp\n 00000000-00004260.00000000.78414.002C7000.00000004.mdmp\n 00000000-00004260.00000001.80336.00261000.00000040.mdmp\n 00000000-00004260.00000001.80336.002C7000.00000004.mdmp\n 00000000-00004260.00000002.82253.00261000.00000040.mdmp\n 00000000-00004260.00000002.82253.002C7000.00000004.mdmp\n Observed string: \"GetProcAddress\" (Indicator: \"GetProcAddress\") in Source: 00000000-00006724.00000000.89696.00261000.00000040.mdmp\n 00000000-00006724.00000000.89696.002C7000.00000004.mdmp","origin":"File/Memory","mitre_attack_id":"T1055.001","relevance":1,"id":"string-317","sources":[{"report_type":"sandbox","report_id":"64369837353cf50d1f02053d"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve data about the local computer (API string)","description":"Observed interface string:\"InterlockedExchange\" [Source: 00000000-00003572.00000000.77969.010B1000.00000040.mdmp]\n Observed interface string:\"InterlockedExchange\" [Source: 00000000-00004260.00000000.78414.00261000.00000040.mdmp\n 00000000-00004260.00000001.80336.00261000.00000040.mdmp\n 00000000-00004260.00000002.82253.00261000.00000040.mdmp]\n Observed interface string:\"InterlockedExchange\" [Source: 00000000-00006724.00000000.89696.00261000.00000040.mdmp]","origin":"File/Memory","mitre_attack_id":"T1082","relevance":3,"id":"string-115","sources":[{"report_type":"sandbox","report_id":"64369837353cf50d1f02053d"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve file and directory information (API string)","description":"$35","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-207","sources":[{"report_type":"sandbox","report_id":"64369837353cf50d1f02053d"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve information about the current system (API string)","description":"Observed string: \"ExpandEnvironmentStringsA\" [Source: 00000000-00003572.00000000.77969.010B1000.00000040.mdmp]\n Observed string: \"ExpandEnvironmentStringsA\" [Source: 00000000-00004260.00000000.78414.00261000.00000040.mdmp\n 00000000-00004260.00000001.80336.00261000.00000040.mdmp\n 00000000-00004260.00000002.82253.00261000.00000040.mdmp]\n Observed string: \"ExpandEnvironmentStringsA\" [Source: 00000000-00006724.00000000.89696.00261000.00000040.mdmp]","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-89","sources":[{"report_type":"sandbox","report_id":"64369837353cf50d1f02053d"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the fully qualified path of module (API string)","description":"Observed string: \"GetModuleFileName\" [Source: 00000000-00003572.00000000.77969.010B1000.00000040.mdmp]\n Observed string: \"GetModuleFileName\" [Source: 00000000-00004260.00000000.78414.00261000.00000040.mdmp\n 00000000-00004260.00000001.80336.00261000.00000040.mdmp\n 00000000-00004260.00000002.82253.00261000.00000040.mdmp]\n Observed string: \"GetModuleFileName\" [Source: 00000000-00006724.00000000.89696.00261000.00000040.mdmp]","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-164","sources":[{"report_type":"sandbox","report_id":"64369837353cf50d1f02053d"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the host's architecture (API string)","description":"Observed string: \"GetEnvironmentVariableW\" [Source: 00000000-00003572.00000000.77969.010B1000.00000040.mdmp]\n Observed string: \"GetEnvironmentVariableW\" [Source: 00000000-00004260.00000000.78414.00261000.00000040.mdmp\n 00000000-00004260.00000001.80336.00261000.00000040.mdmp\n 00000000-00004260.00000002.82253.00261000.00000040.mdmp]\n Observed string: \"GetEnvironmentVariableW\" [Source: 00000000-00006724.00000000.89696.00261000.00000040.mdmp]","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-107","sources":[{"report_type":"sandbox","report_id":"64369837353cf50d1f02053d"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the local name for a socket (API string)","description":"Observed string: \"getsockname() failed with errno %d: %s\" (Indicator: \"getsockname\") in Source: 00000000-00003572.00000000.77969.010B1000.00000040.mdmp\n Observed string: \"getsockname() failed with errno %d: %s\" (Indicator: \"getsockname\") in Source: 00000000-00004260.00000000.78414.00261000.00000040.mdmp\n 00000000-00004260.00000001.80336.00261000.00000040.mdmp\n 00000000-00004260.00000002.82253.00261000.00000040.mdmp\n Observed string: \"getsockname() failed with errno %d: %s\" (Indicator: \"getsockname\") in Source: 00000000-00006724.00000000.89696.00261000.00000040.mdmp","origin":"File/Memory","mitre_attack_id":"T1016","relevance":1,"id":"string-224","sources":[{"report_type":"sandbox","report_id":"64369837353cf50d1f02053d"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the time elapsed since the system was started (API string)","description":"Observed string: \"GetTickCount64\" (Indicator: \"GetTickCount\") in Source: 00000000-00006548-00000C1E-80524372\n Observed string: \"GetTickCount\" (Indicator: \"GetTickCount\") in Source: 00000000-00003572.00000000.77969.010B1000.00000040.mdmp\n Observed string: \"GetTickCount\" (Indicator: \"GetTickCount\") in Source: 00000000-00004260.00000000.78414.00261000.00000040.mdmp\n 00000000-00004260.00000001.80336.00261000.00000040.mdmp\n 00000000-00004260.00000002.82253.00261000.00000040.mdmp\n Observed string: \"GetTickCount\" (Indicator: \"GetTickCount\") in Source: 00000000-00006724.00000000.89696.00261000.00000040.mdmp","origin":"File/Memory","mitre_attack_id":"T1497.003","relevance":1,"id":"string-205","sources":[{"report_type":"sandbox","report_id":"64369837353cf50d1f02053d"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Found registry key string for installed applications","description":"$36","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-96","sources":[{"report_type":"sandbox","report_id":"64369837353cf50d1f02053d"}]},{"level":"informative","category":"System Security","name":"Contains ability to delete files","description":"Observed string: \"del /F \"C:\\Users\\HAPUBWS\\AppData\\Local\\Temp\\/DrvUpdater.Run.bat\"\" (Indicator: \"del \") in Source: DrvUpdater.Run.bat","origin":"File/Memory","mitre_attack_id":"T1070.004","relevance":1,"id":"string-408","sources":[{"report_type":"sandbox","report_id":"64369837353cf50d1f02053d"}]},{"level":"informative","category":"System Security","name":"Contains ability to delete files (API string)","description":"Observed string: \"DeleteFileA\" (Indicator: \"DeleteFileA\") in Source: 00000000-00003572.00000000.77969.010B1000.00000040.mdmp\n Observed string: \"DeleteFileW\" (Indicator: \"DeleteFileW\") in Source: 00000000-00003572.00000000.77969.010B1000.00000040.mdmp\n Observed string: \"DeleteFileA\" (Indicator: \"DeleteFileA\") in Source: 00000000-00004260.00000000.78414.00261000.00000040.mdmp\n 00000000-00004260.00000001.80336.00261000.00000040.mdmp\n 00000000-00004260.00000002.82253.00261000.00000040.mdmp\n Observed string: \"DeleteFileW\" (Indicator: \"DeleteFileW\") in Source: 00000000-00004260.00000000.78414.00261000.00000040.mdmp\n 00000000-00004260.00000001.80336.00261000.00000040.mdmp\n 00000000-00004260.00000002.82253.00261000.00000040.mdmp\n Observed string: \"DeleteFileA\" (Indicator: \"DeleteFileA\") in Source: 00000000-00006724.00000000.89696.00261000.00000040.mdmp\n Observed string: \"DeleteFileW\" (Indicator: \"DeleteFileW\") in Source: 00000000-00006724.00000000.89696.00261000.00000040.mdmp","origin":"File/Memory","mitre_attack_id":"T1070.004","relevance":1,"id":"string-308","sources":[{"report_type":"sandbox","report_id":"64369837353cf50d1f02053d"}]},{"level":"informative","category":"System Security","name":"Contains ability to delete registry value (API string)","description":"Observed string: \"RegDeleteValueA\" (Indicator: \"RegDeleteValue\") in Source: 00000000-00003572.00000000.77969.010B1000.00000040.mdmp\n Observed string: \"RegDeleteValueA\" (Indicator: \"RegDeleteValue\") in Source: 00000000-00004260.00000000.78414.00261000.00000040.mdmp\n 00000000-00004260.00000001.80336.00261000.00000040.mdmp\n 00000000-00004260.00000002.82253.00261000.00000040.mdmp\n Observed string: \"RegDeleteValueA\" (Indicator: \"RegDeleteValue\") in Source: 00000000-00006724.00000000.89696.00261000.00000040.mdmp","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-230","sources":[{"report_type":"sandbox","report_id":"64369837353cf50d1f02053d"}]},{"level":"informative","category":"System Security","name":"Contains ability to terminate a process (API string)","description":"$37","origin":"File/Memory","mitre_attack_id":"T1489","relevance":1,"id":"string-316","sources":[{"report_type":"sandbox","report_id":"64369837353cf50d1f02053d"}]},{"level":"informative","category":"System Security","name":"Creates or modifies windows services","description":"\"DrvUpdater.exe\" (Access type: \"CREATE\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\TCPIP\\PARAMETERS\")","origin":"Registry Access","mitre_attack_id":"T1543.003","relevance":10,"id":"registry-67","sources":[{"report_type":"sandbox","report_id":"64369837353cf50d1f02053d"}]},{"level":"informative","category":"Unusual Characteristics","name":"Contains reference to mutex-related activity (API string)","description":"Observed string: \"CreateMutexA\" (Indicator: \"CreateMutex\") in Source: 00000000-00003572.00000000.77969.010B1000.00000040.mdmp\n Observed string: \"CreateMutexA\" (Indicator: \"CreateMutex\") in Source: 00000000-00004260.00000000.78414.00261000.00000040.mdmp\n 00000000-00004260.00000001.80336.00261000.00000040.mdmp\n 00000000-00004260.00000002.82253.00261000.00000040.mdmp\n Observed string: \"CreateMutexA\" (Indicator: \"CreateMutex\") in Source: 00000000-00006724.00000000.89696.00261000.00000040.mdmp","origin":"File/Memory","relevance":1,"id":"string-354","sources":[{"report_type":"sandbox","report_id":"64369837353cf50d1f02053d"}]},{"level":"informative","category":"Unusual Characteristics","name":"Drops files inside appdata directory","description":"Dropped file: \"DrvUpdater.exe\" - Location: [%APPDATA%\\DRPSu\\DrvUpdater.exe]- [targetUID: 00000000-00004260]","origin":"Binary File","mitre_attack_id":"T1036","relevance":3,"id":"binary-37","sources":[{"report_type":"sandbox","report_id":"64369837353cf50d1f02053d"}]},{"level":"informative","category":"Unusual Characteristics","name":"Matched Compiler/Packer signature","description":"\"574d0ca9cda56cd8dd6398baf3e1cdcf56e9ca4f71d85d9155fac4325444ea25.bin\" was detected as \"UPX v1.25 (Delphi) Stub\"\n \"DrvUpdater.exe\" was detected as \"UPX v1.25 (Delphi) Stub\"","origin":"Static Parser","mitre_attack_id":"T1027.002","relevance":10,"id":"static-18","sources":[{"report_type":"sandbox","report_id":"64369837353cf50d1f02053d"}]},{"level":"informative","category":"Unusual Characteristics","name":"Possibly uses a Windows Server utility","description":"\"RuntimeBroker.exe\" (Indicator: \"runtimebroker.exe\")","origin":"File/Memory","relevance":10,"id":"string-65","sources":[{"report_type":"sandbox","report_id":"64369837353cf50d1f02053d"}]},{"level":"informative","category":"Unusual Characteristics","name":"Reads the windows installation language","description":"\"DrvUpdater.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE\"; Key: \"INSTALLLANGUAGEFALLBACK\")\n \"cmd.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE\"; Key: \"INSTALLLANGUAGEFALLBACK\")\n \"cmd.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE GROUPS\"; Key: \"1\")\n \"DrvUpdater.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE GROUPS\"; Key: \"1\")","origin":"Registry Access","mitre_attack_id":"T1614.001","relevance":2,"id":"registry-26","sources":[{"report_type":"sandbox","report_id":"64369837353cf50d1f02053d"}]},{"level":"suspicious","category":"Anti-Detection/Stealthyness","name":"Process deletes itself","description":"\"C:\\DrvUpdater.exe\" deletes itself","origin":"API Call","mitre_attack_id":"T1070.004","relevance":10,"id":"api-27","sources":[{"report_type":"sandbox","report_id":"64369837353cf50d1f02053d"}]},{"level":"suspicious","category":"Anti-Detection/Stealthyness","name":"Queries kernel debugger information","description":"\"DrvUpdater.exe\" at 00000000-00003572-00000C13-79171573","origin":"API Call","mitre_attack_id":"T1622","relevance":6,"id":"api-10","sources":[{"report_type":"sandbox","report_id":"64369837353cf50d1f02053d"}]},{"level":"suspicious","category":"Anti-Detection/Stealthyness","name":"Queries process information","description":"\"DrvUpdater.exe\" queried SystemProcessInformation at 00000000-00003572-00000C13-78035383 [PID: 3572]\n \"DrvUpdater.exe\" queried SystemProcessInformation at 00000000-00003572-00000C13-78036598 [PID: 3572]\n \"cmd.exe\" queried SystemProcessInformation at 00000000-00006548-00000C13-80202354 [PID: 6548]\n \"cmd.exe\" queried SystemProcessInformation at 00000000-00006548-00000C13-80203538 [PID: 6548]","origin":"API Call","mitre_attack_id":"T1057","relevance":4,"id":"api-9","sources":[{"report_type":"sandbox","report_id":"64369837353cf50d1f02053d"}]},{"level":"suspicious","category":"Cryptographic Related","name":"Contains CRYPTO related strings","description":"$38","origin":"File/Memory","mitre_attack_id":"T1027","relevance":3,"id":"string-57","sources":[{"report_type":"sandbox","report_id":"64369837353cf50d1f02053d"}]},{"level":"suspicious","category":"External Systems","name":"Found an IP/URL artifact that was identified as malicious by at least three reputation engines","description":"4/89 reputation engines marked \"http://update.drp.su\" as malicious (4% detection rate)","origin":"External System","relevance":10,"id":"avtest-6","sources":[{"report_type":"sandbox","report_id":"64369837353cf50d1f02053d"}]},{"level":"suspicious","category":"General","name":"Reads configuration files (.ini files)","description":"\"DrvUpdater.exe\" reads file \"C:\\Users\\desktop.ini\"\n \"DrvUpdater.exe\" reads file \"C:\\Users\\%OSUSER%\\Desktop\\desktop.ini\"\n \"DrvUpdater.exe\" reads file \"C:\\Users\\%OSUSER%\\Documents\\desktop.ini\"\n \"DrvUpdater.exe\" reads file \"C:\\Users\\%OSUSER%\\Music\\desktop.ini\"\n \"DrvUpdater.exe\" reads file \"C:\\Users\\%OSUSER%\\Pictures\\desktop.ini\"\n \"DrvUpdater.exe\" reads file \"C:\\Users\\%OSUSER%\\Videos\\desktop.ini\"\n \"DrvUpdater.exe\" reads file \"C:\\Users\\%OSUSER%\\Downloads\\desktop.ini\"\n \"DrvUpdater.exe\" reads file \"C:\\Users\\%OSUSER%\\OneDrive\\desktop.ini\"\n \"DrvUpdater.exe\" reads file \"C:\\Users\\%OSUSER%\\Searches\\desktop.ini\"\n \"DrvUpdater.exe\" reads file \"C:\\Users\\%OSUSER%\\Contacts\\desktop.ini\"\n \"DrvUpdater.exe\" reads file \"C:\\Users\\%OSUSER%\\Favorites\\desktop.ini\"\n \"DrvUpdater.exe\" reads file \"C:\\Users\\%OSUSER%\\Links\\desktop.ini\"\n \"DrvUpdater.exe\" reads file \"C:\\Users\\%OSUSER%\\Saved Games\\desktop.ini\"","origin":"API Call","mitre_attack_id":"T1083","relevance":4,"id":"api-6","sources":[{"report_type":"sandbox","report_id":"64369837353cf50d1f02053d"}]},{"level":"suspicious","category":"Installation/Persistence","name":"Modifies auto-execute functionality by setting/creating a value in the registry","description":"\"DrvUpdater.exe\" (Access type: \"CREATE\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\RUN\")\n \"DrvUpdater.exe\" (Access type: \"SETVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\RUN\"; Key: \"DRVUPDATER\"; Value: \"%APPDATA%\\DRPSu\\DrvUpdater.exe\")","origin":"Registry Access","mitre_attack_id":"T1547.001","relevance":8,"id":"registry-0","sources":[{"report_type":"sandbox","report_id":"64369837353cf50d1f02053d"}]},{"level":"suspicious","category":"Network Related","name":"Found potential IP address in binary/memory","description":"Potential IP \"5.1.0.0\" found in string \"wpdshext.dll,processorArchitecture=\"x86\",type=\"win32\",version=\"5.1.0.0\"C:\\WINDOWS\\SysWOW64\\wpdshext.dll\"\n \"192.168.243.80\"\n Potential IP \"6.0.0.0\" found in string \"\"\n Potential IP \"127.0.0.1\" found in string \"ping -n 1 127.0.0.1\"\n Potential IP \"6.0.0.0\" found in string \"\"\n \"37.9.8.75\"\n \"82.145.55.146\"","origin":"File/Memory","mitre_attack_id":"T1071","relevance":3,"id":"string-14","sources":[{"report_type":"sandbox","report_id":"64369837353cf50d1f02053d"}]},{"level":"suspicious","category":"Remote Access Related","name":"Contains references to WMI/WMIC","description":"Found string \"WmiPrvSE.exe\" (Indicator: \"wmiprvse.exe\"; in Source: \"00000000-00003572.00000000.77969.061C0000.00000004.mdmp\")\n Found string \"WMIADAP.exe\" (Indicator: \"wmiadap.exe\"; in Source: \"00000000-00003572.00000000.77969.061C0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1047","relevance":10,"id":"string-30","sources":[{"report_type":"sandbox","report_id":"64369837353cf50d1f02053d"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Found system commands related strings","description":"Found string \"ping -n 1 127.0.0.1\" (Indicator: \"ping\"; Source: \"00000000-00003572.00000000.77969.010B1000.00000040.mdmp\")\n Found string \"ping -n 1 127.0.0.1\" (Indicator: \"ping\"; Source: \"00000000-00004260.00000000.78414.00261000.00000040.mdmp, 00000000-00004260.00000001.80336.00261000.00000040.mdmp, 00000000-00004260.00000002.82253.00261000.00000040.mdmp\")\n Found string \"ping -n 1 127.0.0.1\" (Indicator: \"ping\"; Source: \"00000000-00006724.00000000.89696.00261000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":3,"id":"string-126","sources":[{"report_type":"sandbox","report_id":"64369837353cf50d1f02053d"}]},{"level":"suspicious","category":"System Destruction","name":"Marks file for deletion","description":"\"DrvUpdater.exe\" marked \"C:\\Users\\%OSUSER%\\AppData\\Roaming\\DRPSu\\DrvUpdater.exe:Zone.Identifier\" for deletion","origin":"API Call","mitre_attack_id":"T1070.004","relevance":10,"id":"api-26","sources":[{"report_type":"sandbox","report_id":"64369837353cf50d1f02053d"}]},{"level":"suspicious","category":"System Destruction","name":"Opens file with deletion access rights","description":"\"DrvUpdater.exe\" opened \"C:\\Users\\%OSUSER%\\AppData\\Roaming\\DRPSu\\DrvUpdater.exe:Zone.Identifier\" with delete access\n \"cmd.exe\" opened \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\DrvUpdater.Run.bat\" with delete access","origin":"API Call","mitre_attack_id":"T1070.004","relevance":7,"id":"api-25","sources":[{"report_type":"sandbox","report_id":"64369837353cf50d1f02053d"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Entrypoint in PE header is within an uncommon section","description":"\"574d0ca9cda56cd8dd6398baf3e1cdcf56e9ca4f71d85d9155fac4325444ea25.bin\" has an entrypoint in section \"UPX1\"\n \"DrvUpdater.exe\" has an entrypoint in section \"UPX1\"","origin":"Static Parser","relevance":10,"id":"static-4","sources":[{"report_type":"sandbox","report_id":"64369837353cf50d1f02053d"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Installs hooks/patches the running process","description":"$39","origin":"Hook Detection","mitre_attack_id":"T1056.004","relevance":10,"id":"hooks-8","sources":[{"report_type":"sandbox","report_id":"64369837353cf50d1f02053d"}]},{"level":"malicious","category":"Anti-Detection/Stealthyness","name":"Tries to hide tracks of having downloaded a file from the internet","description":"\"DrvUpdater.exe\" opened \"C:\\Users\\%OSUSER%\\AppData\\Roaming\\DRPSu\\DrvUpdater.exe:Zone.Identifier\" with delete access","origin":"API Call","mitre_attack_id":"T1070.004","relevance":7,"id":"api-42","sources":[{"report_type":"sandbox","report_id":"64369837353cf50d1f02053d"}]},{"level":"malicious","category":"External Systems","name":"Sample detected by CrowdStrike Static Analysis and ML with relatively high confidence","description":"CrowdStrike Static Analysis and ML (QuickScan) yielded detection: win/grayware_confidence_100% (W)","origin":"External System","relevance":10,"id":"avtest-8","sources":[{"report_type":"sandbox","report_id":"64369837353cf50d1f02053d"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by a large number of Antivirus engines","description":"38/70 Antivirus vendors marked sample as malicious (54% detection rate)","origin":"External System","relevance":10,"id":"avtest-3","sources":[{"report_type":"sandbox","report_id":"64369837353cf50d1f02053d"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by a trusted Antivirus engine","description":"No specific details available","origin":"External System","relevance":10,"id":"avtest-5","sources":[{"report_type":"sandbox","report_id":"64369837353cf50d1f02053d"}]},{"level":"malicious","category":"General","name":"The analysis extracted a file that was identified as malicious","description":"38/70 Antivirus vendors marked dropped file \"DrvUpdater.exe\" as malicious (classified as \"Downloader.DriverPack\" with 54% detection rate)\n 38/70 Antivirus vendors marked dropped file \"DrvUpdater.exe.bin\" as malicious (classified as \"Downloader.DriverPack\" with 54% detection rate)","origin":"Binary File","mitre_attack_id":"T1204.002","relevance":10,"id":"binary-11","sources":[{"report_type":"sandbox","report_id":"64369837353cf50d1f02053d"}]},{"level":"malicious","category":"General","name":"The analysis spawned a process that was identified as malicious","description":"38/70 Antivirus vendors marked spawned process \"DrvUpdater.exe\" (PID: 4260) as malicious (classified as \"Downloader.DriverPack\" with 54% detection rate)","origin":"Monitored Target","mitre_attack_id":"T1204.002","relevance":10,"id":"target-58","sources":[{"report_type":"sandbox","report_id":"64369837353cf50d1f02053d"}]},{"level":"malicious","category":"Installation/Persistence","name":"Drops a batch file that contains a force-delete command (typical for malware init code)","description":"\"cd \"%APPDATA%\\DRPSu\"start /D \"%APPDATA%\\DRPSu\" DrvUpdater.exedel /F \"C:\\Users\\HAPUBWS\\AppData\\Local\\Temp\\/DrvUpdater.Run.bat\"\"\n \"del /F \"C:\\Users\\HAPUBWS\\AppData\\Local\\Temp\\/DrvUpdater.Run.bat\"\"","origin":"File/Memory","mitre_attack_id":"T1070.004","relevance":7,"id":"string-9","sources":[{"report_type":"sandbox","report_id":"64369837353cf50d1f02053d"}]}],"incidents":[{"name":"Persistence","details_count":1,"details":[{"detail":"Modifies auto-execute functionality by setting a value in the registry"}],"sources":[{"report_type":"sandbox","report_id":"55c0bc7e0e316df02e616b24"},{"report_type":"sandbox","report_id":"64369837353cf50d1f02053d"}]},{"name":"Network Behavior","details_count":1,"details":[{"detail":"Contacts 1 domain and 1 host"}],"sources":[{"report_type":"sandbox","report_id":"55c0bc7e0e316df02e616b24"},{"report_type":"sandbox","report_id":"64369837353cf50d1f02053d"}]},{"name":"Spyware","details_count":1,"details":[{"detail":"Found a string that may be used as part of an injection method"}],"sources":[{"report_type":"sandbox","report_id":"64369837353cf50d1f02053d"}]},{"name":"Fingerprint","details_count":3,"details":[{"detail":"Queries kernel debugger information"},{"detail":"Queries process information"},{"detail":"Queries sensitive IE security settings"}],"sources":[{"report_type":"sandbox","report_id":"64369837353cf50d1f02053d"}]},{"name":"Evasive","details_count":5,"details":[{"detail":"Marks file for deletion"},{"detail":"Tries to hide tracks of having downloaded a file from the internet"},{"detail":"Possibly tries to evade analysis by sleeping many times"},{"detail":"Possibly checks for the presence of a forensics/monitoring tool"},{"detail":"PE file has a section name known to be used by a packer/protector"}],"sources":[{"report_type":"sandbox","report_id":"64369837353cf50d1f02053d"}]}]},"activity":{"stats":{"process_count":4,"spawned_processes_count":4,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":9,"imported_dlls_count":114,"dropped_files_count":0,"extracted_files_count":4,"files_written_count":25,"files_deleted_count":0,"registry_keys_created_count":11,"registry_keys_modified_count":0,"registry_keys_deleted_count":4,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":15,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":3,"dns_resolutions_count":1,"contacted_urls_count":1,"http_requests_count":1},"behavior_tags":["driverpack","windows-server-utility"],"sample_flags":["Network Traffic","Extracted Files","Multi-Process"],"sandbox_reports":[{"id":"64369837353cf50d1f02053d","environment_id":160,"environment_description":"Windows 10 64 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"malware_family":"Downloader.DriverPack","contacted_countries":["GBR","RUS"],"submit_name":"DrvUpdater.exe","analysis_start_time":"2023-04-12T11:38:31+00:00","indicators_count":{"informative":102,"suspicious":38,"malicious":8},"tags":["Multi-Process","Network Traffic","Extracted Files"],"is_in_unified_schema":true},{"id":"58371fb7aac2ed5c3ceab66e","environment_id":100,"environment_description":"Windows 7 32 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"malware_family":"W32.HfsAdware","contacted_countries":["GBR","USA"],"submit_name":"DrvUpdater.exe","analysis_start_time":"2016-11-24T18:14:20+00:00","indicators_count":{"informative":18,"suspicious":22,"malicious":10},"tags":["Multi-Process","Network Traffic","Extracted Files"],"is_in_unified_schema":true},{"id":"55c0bc7e0e316df02e616b24","environment_id":1,"environment_description":"Windows 7 32 bit (EN)","state":"SUCCESS","verdict":"malicious","threat_score":79,"malware_family":"Worm.Chir","contacted_countries":["NLD"],"submit_name":"DrvUpdater.exe","analysis_start_time":"2015-08-04T09:27:38+00:00","indicators_count":{"informative":8,"suspicious":14,"malicious":7},"tags":["Network Traffic","Extracted Files"],"is_in_unified_schema":true},{"id":"556ed7988690b8ab7c27770d","environment_id":2,"environment_description":"Windows 7 32 bit (EN)","state":"SUCCESS","verdict":"malicious","threat_score":73,"malware_family":"DriverPack","contacted_countries":["NLD"],"submit_name":"drvupdater.exe","analysis_start_time":"2015-06-03T12:32:01+00:00","indicators_count":{"informative":11,"suspicious":15,"malicious":8},"tags":["Network Traffic","Extracted Files"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":[{"address":"5.79.68.159","port":80,"protocol":"TCP","country":"Netherlands","sources":[{"report_type":"sandbox","report_id":"55c0bc7e0e316df02e616b24"}]},{"address":"37.9.8.75","port":80,"protocol":"TCP","country":"Russian Federation","sources":[{"report_type":"sandbox","report_id":"64369837353cf50d1f02053d"}]},{"address":"82.145.55.146","port":80,"protocol":"TCP","country":"United Kingdom","sources":[{"report_type":"sandbox","report_id":"64369837353cf50d1f02053d"}]}],"dns_resolutions":[{"domain":"update.drp.su","address":"5.79.68.159","country":"Netherlands","sources":[{"report_type":"sandbox","report_id":"55c0bc7e0e316df02e616b24"},{"report_type":"sandbox","report_id":"64369837353cf50d1f02053d"}]}],"http_requests":[{"host":"update.drp.su","host_ip":"5.79.68.159:80","url":"/drpupdater/DrvUpdater.xml","method":"GET","sources":[{"report_type":"sandbox","report_id":"55c0bc7e0e316df02e616b24"},{"report_type":"sandbox","report_id":"64369837353cf50d1f02053d"}]}]},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"64369837353cf50d1f02053d"}],"processes":[{"pid":3572,"ppid":0,"name":"DrvUpdater.exe","command_line":"","sha256":"574d0ca9cda56cd8dd6398baf3e1cdcf56e9ca4f71d85d9155fac4325444ea25","normalized_path":"C:\\DrvUpdater.exe","uid":"00000000-00003572","icon":"$3a"},{"pid":6548,"ppid":3572,"name":"cmd.exe","command_line":"%WINDIR%\\system32\\cmd.exe /c \"\"%TEMP%\\DrvUpdater.Run.bat\" \"","sha256":"4c3ea4c44aab74350355c419826b8c9e6172c3bd8f0bb5817ecf7be50b629051","normalized_path":"%WINDIR%\\SysWOW64\\cmd.exe","parent_uid":"00000000-00003572","uid":"00000000-00006548"},{"pid":4260,"ppid":6548,"name":"DrvUpdater.exe","command_line":"","sha256":"574d0ca9cda56cd8dd6398baf3e1cdcf56e9ca4f71d85d9155fac4325444ea25","normalized_path":"%APPDATA%\\DRPSu\\DrvUpdater.exe","parent_uid":"00000000-00006548","uid":"00000000-00004260"},{"pid":6724,"ppid":0,"name":"DrvUpdater.exe","command_line":"","sha256":"574d0ca9cda56cd8dd6398baf3e1cdcf56e9ca4f71d85d9155fac4325444ea25","normalized_path":"%APPDATA%\\DRPSu\\DrvUpdater.exe","uid":"00000000-00006724","icon":"$3b"}],"all_imported_dlls":["CRYPTBASE.dll","uxtheme.dll","ntmarta.dll","sfc.dll","WINBRAND.dll","IMM32.DLL","USP10.dll","CFGMGR32.dll","WS2_32.dll","wship6.dll","NSI.dll","KERNELBASE.dll","PSAPI.DLL","comctl32.dll","ADVAPI32.dll","shdocvw.dll","profapi.dll","SHELL32.dll","VERSION.dll","MSIMG32.dll","GDI32.dll","ole32.dll","ieframe.dll","RPCRT4.dll","IPHLPAPI.DLL","fwpuclnt.dll","SHLWAPI.dll","ntdll.dll","LPK.dll","wpdshext.dll","OLEAUT32.dll","urlmon.dll","apphelp.dll","SETUPAPI.dll","msvcrt.dll","USER32.dll","CLBCatQ.DLL","DEVRTL.dll","sechost.dll","wshtcpip.dll","WINTRUST.dll","MSCTF.dll","DEVOBJ.dll","PROPSYS.dll","MPR.dll","dwmapi.dll","DNSAPI.dll","mswsock.dll","rasadhlp.dll","SspiCli.dll","kernel32.dll","ucrtbase.dll","cfgmgr32.dll","aepic.dll","powrprof.dll","dlnashext.dll","dnsapi.dll","FWPUCLNT.DLL","user32.dll","msimg32.dll","kernel.appcore.dll","oleaut32.dll","OneCoreUAPCommonProxyStub.dll","msvcp90.dll","imagehlp.dll","advapi32.dll","gdi32full.dll","SHCore.dll","cryptsp.dll","edputil.dll","iertutil.dll","cmdext.dll","devobj.dll","imm32.dll","fltLib.dll","PlayToDevice.dll","shell32.dll","mpr.dll","KernelBase.dll","cldapi.dll","DevDispItemProvider.dll","msIso.dll","wintrust.dll","windows.storage.dll","wow64win.dll","sspicli.dll","GdiPlus.dll","GROOVEEX.DLL","pcacli.dll","msctf.dll","sfc_os.dll","nsi.dll","crypt32.dll","rpcrt4.dll","ATL90.dll","MMDevAPI.dll","msasn1.dll","wow64cpu.dll","cryptbase.dll","gdi32.dll","ws2_32.dll","bcrypt.dll","wow64.dll","setupapi.dll","propsys.dll","clbcatq.dll","bcryptprimitives.dll","shlwapi.dll","Windows.StateRepositoryPS.dll","win32u.dll","msvcr90.dll","rsaenh.dll","combase.dll","msvcp_win.dll"]},"file_activity":{"dropped_files":null,"extracted_files":[{"name":"DrvUpdater.Run.bat","sha256":"61a41a4fa9968f0cbbcfa2e892cfc62f400e344e23aa83db1115831295500e7c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"55c0bc7e0e316df02e616b24"},{"report_type":"sandbox","report_id":"64369837353cf50d1f02053d"}]},{"name":"DrvUpdater.exe","sha256":"574d0ca9cda56cd8dd6398baf3e1cdcf56e9ca4f71d85d9155fac4325444ea25","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"55c0bc7e0e316df02e616b24"},{"report_type":"sandbox","report_id":"64369837353cf50d1f02053d"}]},{"name":"DrvUpdater.exe.bin","sha256":"574d0ca9cda56cd8dd6398baf3e1cdcf56e9ca4f71d85d9155fac4325444ea25","verdict":"malicious","sources":[{"report_type":"sandbox","report_id":"64369837353cf50d1f02053d"}]},{"name":"DrvUpdater.xml","sha256":"9342c428e43a4c763e6de5db97958d1cef9faf056d8bd7ea9eeb2d1cd890d6c3","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"64369837353cf50d1f02053d"}]}],"files_written":[{"path":"%APPDATA%\\DRPSu","sources":[{"report_type":"sandbox","report_id":"55c0bc7e0e316df02e616b24"},{"report_type":"sandbox","report_id":"64369837353cf50d1f02053d"}]},{"path":"%APPDATA%\\DRPSu\\DrvUpdater.exe","sources":[{"report_type":"sandbox","report_id":"55c0bc7e0e316df02e616b24"}]},{"path":"%WINDIR%\\Globalization\\Sorting\\sortdefault.nls","sources":[{"report_type":"sandbox","report_id":"55c0bc7e0e316df02e616b24"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches","sources":[{"report_type":"sandbox","report_id":"55c0bc7e0e316df02e616b24"},{"report_type":"sandbox","report_id":"64369837353cf50d1f02053d"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches\\cversions.1.db","sources":[{"report_type":"sandbox","report_id":"55c0bc7e0e316df02e616b24"}]},{"path":"%USERPROFILE%\\AppData","sources":[{"report_type":"sandbox","report_id":"55c0bc7e0e316df02e616b24"}]},{"path":"%USERPROFILE%\\AppData\\Local","sources":[{"report_type":"sandbox","report_id":"55c0bc7e0e316df02e616b24"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches\\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x0000000000000006.db","sources":[{"report_type":"sandbox","report_id":"55c0bc7e0e316df02e616b24"}]},{"path":"%LOCALAPPDATA%\\Temp","sources":[{"report_type":"sandbox","report_id":"55c0bc7e0e316df02e616b24"}]},{"path":"%USERPROFILE%\\Desktop\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"55c0bc7e0e316df02e616b24"}]},{"path":"C:\\Users\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"55c0bc7e0e316df02e616b24"}]},{"path":"MountPointManager","sources":[{"report_type":"sandbox","report_id":"55c0bc7e0e316df02e616b24"}]},{"path":"C:\\Users\\PSPUBWS","sources":[{"report_type":"sandbox","report_id":"55c0bc7e0e316df02e616b24"}]},{"path":"%USERPROFILE%\\Documents\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"55c0bc7e0e316df02e616b24"}]},{"path":"%USERPROFILE%\\Links\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"55c0bc7e0e316df02e616b24"}]},{"path":"C:\\Users","sources":[{"report_type":"sandbox","report_id":"55c0bc7e0e316df02e616b24"}]},{"path":"\\SystemRoot\\AppPatch\\sysmain.sdb","sources":[{"report_type":"sandbox","report_id":"55c0bc7e0e316df02e616b24"}]},{"path":"%WINDIR%\\AppPatch\\pcamain.sdb","sources":[{"report_type":"sandbox","report_id":"55c0bc7e0e316df02e616b24"}]},{"path":"%TEMP%\\DrvUpdater.Run.bat","sources":[{"report_type":"sandbox","report_id":"55c0bc7e0e316df02e616b24"}]},{"path":"%WINDIR%\\Fonts\\staticcache.dat","sources":[{"report_type":"sandbox","report_id":"55c0bc7e0e316df02e616b24"}]},{"path":"Nsi","sources":[{"report_type":"sandbox","report_id":"55c0bc7e0e316df02e616b24"}]},{"path":"\\Device\\RasAcd","sources":[{"report_type":"sandbox","report_id":"55c0bc7e0e316df02e616b24"}]},{"path":"\\Device\\Afd\\AsyncConnectHlp","sources":[{"report_type":"sandbox","report_id":"55c0bc7e0e316df02e616b24"}]},{"path":"\\Device\\Afd\\Endpoint","sources":[{"report_type":"sandbox","report_id":"55c0bc7e0e316df02e616b24"}]},{"path":"%TEMP%\\DrvUpdater.xml","sources":[{"report_type":"sandbox","report_id":"55c0bc7e0e316df02e616b24"}]}],"files_deleted":null},"registry_activity":{"keys_created":[{"key":"HKCU\\SOFTWARE\\DRPSU UPDATER\\","sources":[{"report_type":"sandbox","report_id":"55c0bc7e0e316df02e616b24"}]},{"key":"HKLM\\SYSTEM\\CURRENTCONTROLSET\\SERVICES\\TCPIP\\PARAMETERS\\","sources":[{"report_type":"sandbox","report_id":"55c0bc7e0e316df02e616b24"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\RUN\\","sources":[{"report_type":"sandbox","report_id":"55c0bc7e0e316df02e616b24"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\UNINSTALL\\DRPSU UPDATER\\","sources":[{"report_type":"sandbox","report_id":"55c0bc7e0e316df02e616b24"}]},{"key":"HKCU\\SOFTWARE\\","sources":[{"report_type":"sandbox","report_id":"55c0bc7e0e316df02e616b24"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\","sources":[{"report_type":"sandbox","report_id":"55c0bc7e0e316df02e616b24"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\","sources":[{"report_type":"sandbox","report_id":"55c0bc7e0e316df02e616b24"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\","sources":[{"report_type":"sandbox","report_id":"55c0bc7e0e316df02e616b24"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\UNINSTALL\\","sources":[{"report_type":"sandbox","report_id":"55c0bc7e0e316df02e616b24"}]},{"key":"HKCUHKCU\\SOFTWARE\\DRPSU UPDATER\\","sources":[{"report_type":"sandbox","report_id":"64369837353cf50d1f02053d"}]},{"key":"HKLMHKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\TCPIP\\PARAMETERS\\","sources":[{"report_type":"sandbox","report_id":"64369837353cf50d1f02053d"}]}],"keys_modified":null,"keys_deleted":[{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\\PROXYBYPASS\\PROXYBYPASS","sources":[{"report_type":"sandbox","report_id":"55c0bc7e0e316df02e616b24"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\\PROXYBYPASS\\PROXYBYPASS","sources":[{"report_type":"sandbox","report_id":"55c0bc7e0e316df02e616b24"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\\INTRANETNAME\\INTRANETNAME","sources":[{"report_type":"sandbox","report_id":"55c0bc7e0e316df02e616b24"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\\INTRANETNAME\\INTRANETNAME","sources":[{"report_type":"sandbox","report_id":"55c0bc7e0e316df02e616b24"}]}]},"mutex_activity":{"mutex_created":[{"name":"DriverFinderMutex","sources":[{"report_type":"sandbox","report_id":"55c0bc7e0e316df02e616b24"}]},{"name":"Local\\ZonesCounterMutex","sources":[{"report_type":"sandbox","report_id":"55c0bc7e0e316df02e616b24"}]},{"name":"Local\\ZoneAttributeCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"55c0bc7e0e316df02e616b24"}]},{"name":"Local\\ZonesCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"55c0bc7e0e316df02e616b24"},{"report_type":"sandbox","report_id":"64369837353cf50d1f02053d"}]},{"name":"Local\\ZonesLockedCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"55c0bc7e0e316df02e616b24"},{"report_type":"sandbox","report_id":"64369837353cf50d1f02053d"}]},{"name":"Local\\SM0:3572:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"64369837353cf50d1f02053d"}]},{"name":"Local\\SM0:3572:64:WilError_01","sources":[{"report_type":"sandbox","report_id":"64369837353cf50d1f02053d"}]},{"name":"SM0:3572:64:WilError_01","sources":[{"report_type":"sandbox","report_id":"64369837353cf50d1f02053d"}]},{"name":"SM0:4260:64:WilError_01","sources":[{"report_type":"sandbox","report_id":"64369837353cf50d1f02053d"}]}]}},"report_ids":{"sandbox_job_ids":["58371fb7aac2ed5c3ceab66e","64369837353cf50d1f02053d","55c0bc7e0e316df02e616b24","556ed7988690b8ab7c27770d"]}}}]]}] 20:null 24:[["$","title","0",{"children":"Malicious DriverPack.A potentially unwanted application Sample 574d0ca9cda5… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample 574d0ca9cda5…. Malware family: DriverPack.A potentially unwanted application. Threat score 100/100. 10/25 AV engines flagged this file. 13 malicious and 25 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/574d0ca9cda56cd8dd6398baf3e1cdcf56e9ca4f71d85d9155fac4325444ea25"}],["$","meta","4",{"property":"og:title","content":"Malicious DriverPack.A potentially unwanted application Sample 574d0ca9cda5… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample 574d0ca9cda5…. Malware family: DriverPack.A potentially unwanted application. Threat score 100/100. 10/25 AV engines flagged this file. 13 malicious and 25 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/574d0ca9cda56cd8dd6398baf3e1cdcf56e9ca4f71d85d9155fac4325444ea25"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious DriverPack.A potentially unwanted application Sample 574d0ca9cda5… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample 574d0ca9cda5…. Malware family: DriverPack.A potentially unwanted application. Threat score 100/100. 10/25 AV engines flagged this file. 13 malicious and 25 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L3c","11",{}]]