6ec6c457...2a18 | Network
Logo
Try VMRay Analyzer
VTI SCORE: 98/100
Dynamic Analysis Report
Classification: Dropper, Pua, Spyware, Downloader

6ec6c457f112de97ece2f7b9c654ffe165ee1fa6bee52f0575dad1426c552a18 (SHA256)

DriverPack-17-Online.exe

Windows Exe (x86-32)

Created at 2018-11-07 11:27:00

...

Notifications (2/2)

The maximum number of reputation file hash requests (20 per analysis) was exceeded. As a result, the reputation status could not be queried for all file hashes. In order to get the reputation status for all file hashes, please increase the 'Max File Hash Requests' setting in the system configurations.

The overall sleep time of all monitored processes was truncated from "10 minutes" to "10 seconds" to reveal dormant functionality.

Network Overview

Hosts (2)
»
Hostname IP Address Location Protocols Reputation Status WHOIS Data
download.drp.su 81.94.192.167 United Kingdom HTTP, TCP
Not Queried
Not Queried
update.drp.su 82.145.55.124 United Kingdom HTTP, TCP
Not Queried
Not Queried
URLs (5)
»
URL Categories Names Source HTTP Status Code Reputation Status
http://download.drp.su/updates/beetle/driverpack-wget.exe - - Function Log -
Unknown
http://download.drp.su/updates/beetle/driverpack-7za.exe - - Function Log -
Unknown
http://download.drp.su/updates/beetle/devcon64.exe - - Function Log OK (200)
Unknown
http://download.drp.su/updates/beetle/aria2c.exe - - Function Log -
Unknown
http://update.drp.su/v2/ - - Function Log OK (200)
Unknown

Connections

URL (3)
»
Operation Additional Information Success Count Logfile
Query Info url = file:///C:/Users/CIIHMN~1/AppData/Local/Temp/7ZipSfx.000/bin/Tools/run.hta, query_options = QUERY_RECOMBINE False 1
Fn
Query Info url = http://update.drp.su/beetle/17.7.119/DriverPackSolution.html, query_options = QUERY_CAN_NAVIGATE False 1
Fn
Query Info url = http://update.drp.su/beetle/17.7.119/css/style.css, query_options = QUERY_RECOMBINE False 1
Fn
Inet (1)
»
Operation Additional Information Success Count Logfile
Check for internet connection - True 1
Fn
HTTP Sessions (5)
»
Information Value
Total Data Sent 1.68 KB
Total Data Received 1.12 MB
Contacted Host Count 2
Contacted Hosts download.drp.su, update.drp.su
HTTP Session #1
»
Information Value
Source Function Log
User Agent Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.3; Win64; x64; Trident/7.0; .NET4.0E; .NET4.0C; .NET CLR 3.5.30729; .NET CLR 2.0.50727; .NET CLR 3.0.30729)
Server Name download.drp.su
Server Port 80
Data Sent 0.35 KB
Data Received 409.39 KB
Operation Additional Information Success Count Logfile
Open Session user_agent = Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.3; Win64; x64; Trident/7.0; .NET4.0E; .NET4.0C; .NET CLR 3.5.30729; .NET CLR 2.0.50727; .NET CLR 3.0.30729), access_type = WINHTTP_ACCESS_TYPE_NO_PROXY, proxy_name = WINHTTP_NO_PROXY_NAME, proxy_bypass = WINHTTP_NO_PROXY_BYPASS True 1
Fn
Open Connection protocol = http, server_name = download.drp.su, server_port = 80 True 1
Fn
Open HTTP Request http_verb = GET, http_version = HTTP 1.1, target_resource = /updates/beetle/driverpack-wget.exe True 1
Fn
Send HTTP Request url = http://download.drp.su/updates/beetle/driverpack-wget.exe True 1
Fn
Read Response size_out = 419216 True 1
Fn
Data
HTTP Session #2
»
Information Value
Source Function Log
User Agent Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.3; Win64; x64; Trident/7.0; .NET4.0E; .NET4.0C; .NET CLR 3.5.30729; .NET CLR 2.0.50727; .NET CLR 3.0.30729)
Server Name download.drp.su
Server Port 80
Data Sent 0.35 KB
Data Received 645.89 KB
Operation Additional Information Success Count Logfile
Open Session user_agent = Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.3; Win64; x64; Trident/7.0; .NET4.0E; .NET4.0C; .NET CLR 3.5.30729; .NET CLR 2.0.50727; .NET CLR 3.0.30729), access_type = WINHTTP_ACCESS_TYPE_NO_PROXY, proxy_name = WINHTTP_NO_PROXY_NAME, proxy_bypass = WINHTTP_NO_PROXY_BYPASS True 1
Fn
Open Connection protocol = http, server_name = download.drp.su, server_port = 80 True 1
Fn
Open HTTP Request http_verb = GET, http_version = HTTP 1.1, target_resource = /updates/beetle/driverpack-7za.exe True 1
Fn
Send HTTP Request url = http://download.drp.su/updates/beetle/driverpack-7za.exe True 1
Fn
Read Response size_out = 661392 True 1
Fn
Data
HTTP Session #3
»
Information Value
Source Function Log
User Agent Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.3; Win64; x64; Trident/7.0; .NET4.0E; .NET4.0C; .NET CLR 3.5.30729; .NET CLR 2.0.50727; .NET CLR 3.0.30729)
Server Name download.drp.su
Server Port 80
Data Sent 0.34 KB
Data Received 85.89 KB
Operation Additional Information Success Count Logfile
Open Session user_agent = Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.3; Win64; x64; Trident/7.0; .NET4.0E; .NET4.0C; .NET CLR 3.5.30729; .NET CLR 2.0.50727; .NET CLR 3.0.30729), access_type = WINHTTP_ACCESS_TYPE_NO_PROXY, proxy_name = WINHTTP_NO_PROXY_NAME, proxy_bypass = WINHTTP_NO_PROXY_BYPASS True 1
Fn
Open Connection protocol = http, server_name = download.drp.su, server_port = 80 True 1
Fn
Open HTTP Request http_verb = GET, http_version = HTTP 1.1, target_resource = /updates/beetle/devcon64.exe True 1
Fn
Send HTTP Request url = http://download.drp.su/updates/beetle/devcon64.exe True 1
Fn
Read Response size_out = 87952 True 1
Fn
Data
HTTP Session #4
»
Information Value
Source Function Log
User Agent Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.3; Win64; x64; Trident/7.0; .NET4.0E; .NET4.0C; .NET CLR 3.5.30729; .NET CLR 2.0.50727; .NET CLR 3.0.30729)
Server Name download.drp.su
Server Port 80
Data Sent 0.34 KB
Data Received 0.00 KB
Operation Additional Information Success Count Logfile
Open Session user_agent = Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.3; Win64; x64; Trident/7.0; .NET4.0E; .NET4.0C; .NET CLR 3.5.30729; .NET CLR 2.0.50727; .NET CLR 3.0.30729), access_type = WINHTTP_ACCESS_TYPE_NO_PROXY, proxy_name = WINHTTP_NO_PROXY_NAME, proxy_bypass = WINHTTP_NO_PROXY_BYPASS True 1
Fn
Open Connection protocol = http, server_name = download.drp.su, server_port = 80 True 1
Fn
Open HTTP Request http_verb = GET, http_version = HTTP 1.1, target_resource = /updates/beetle/aria2c.exe True 1
Fn
Send HTTP Request url = http://download.drp.su/updates/beetle/aria2c.exe True 1
Fn
Read Response 0 True 1
Fn
HTTP Session #5
»
Information Value
Source Function Log
User Agent Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.3; Win64; x64; Trident/7.0; .NET4.0E; .NET4.0C; .NET CLR 3.5.30729; .NET CLR 2.0.50727; .NET CLR 3.0.30729)
Server Name update.drp.su
Server Port 80
Data Sent 0.31 KB
Data Received 5.00 KB
Operation Additional Information Success Count Logfile
Open Session user_agent = Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.3; Win64; x64; Trident/7.0; .NET4.0E; .NET4.0C; .NET CLR 3.5.30729; .NET CLR 2.0.50727; .NET CLR 3.0.30729), access_type = WINHTTP_ACCESS_TYPE_NO_PROXY, proxy_name = WINHTTP_NO_PROXY_NAME, proxy_bypass = WINHTTP_NO_PROXY_BYPASS True 1
Fn
Open Connection protocol = http, server_name = update.drp.su, server_port = 80 True 1
Fn
Open HTTP Request http_verb = GET, http_version = HTTP 1.1, target_resource = /v2/ True 1
Fn
Send HTTP Request url = http://update.drp.su/v2/ True 1
Fn
Receive HTTP Status status = 200 True 1
Fn
Read Response size_out = 5119, data = var UPDATE_CONFIG = { "HOST": "http://update.drp.su", "ONLINE_17_URL": "/beetle/17.7.119/", "MIGRATIONS_URL": "/v2/", "EXPERIMENTS": [], "MIGRATIONS_CONTENT": { "17.7.36": { "filename": "patch.reg", "content": [ "Windows Registry Editor Version 5.00\r", "\r", "; --------------------------------------------------\r", "; - ZoneMap patching -\r", "; --------------------------------------------------\r", "\r", "; production\r", "\r", "[HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\ZoneMap\\Domains\\drp.su\\update]\r", "\"http\"=dword:00000001\r", "\"https\"=dword:00000001\r", "\r", "\r", ";Disables offline mode\r", "[HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings]\r", "\"GlobalUserOffline\"=dword:00000000\r", "\r", "; --------------------------------------------------\r", "; - Fix for long running scripts -\r", "; --------------------------------------------------\r", "\r", "[HKEY_CURRENT_USER\\Software\\Microsoft\\Internet Explorer\\Styles]\r", "\"MaxScriptStatements\"=dword:ffffffff\r", "\r", "[HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Internet Explorer\\Styles]\r", "\"MaxScriptStatements\"=dword:ffffffff\r", "\r", "; --------------------------------------------------\r", "; - Internet Explorer settings -\r", "; --------------------------------------------------\r", "\r", "; GPU rendering enabled\r", "[HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Internet Explorer\\Main\\FeatureControl\\FEATURE_GPU_RENDERING]\r", "\"mshta.exe\"=dword:00000001\r", "\r", "; Touch Screen enabled\r", "[HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Internet Explorer\\Main\\FeatureControl\\FEATURE_NINPUT_LEGACYMODE]\r", "\"mshta.exe\"=dword:00000000\r", "\r", "; Suppress dialog boxes for SSL errors\r", "[HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Internet Explorer\\Main\\FeatureControl\\FEATURE_SSLUX]\r", "\"mshta.exe\"=dword:00000001\r", "\r", "; IE Add-ons disabled\r", "[HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Internet Explorer\\Main\\FeatureControl\\FEATURE_ADDON_MANAGEMENT]\r", "\"mshta.exe\"=dword:00000000\r", "\r", "; Windows Registry Editor Version 5.00\r", "[HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Internet Explorer\\MAIN\\FeatureControl\\FEATURE_BROWSER_EMULATION]\r", "\"mshta.exe\"=dword:0000270f\r", "\r", "; Enable the native XMLHttpRequest object\r", "[HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Internet Explorer\\Main\\FeatureControl\\FEATURE_XMLHTTP]\r", "\"mshta.exe\"=dword:00000001\r", "\r", "; Allows script to create and use WebSocket objects\r", "[HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Internet Explorer\\Main\\FeatureControl\\FEATURE_WEBSOCKET]\r", "\"mshta.exe\"=dword:00000001\r", "\r", "; FEATURE_AJAX_CONNECTIONEVENTS\r", "[HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Internet Explorer\\Main\\FeatureControl\\FEATURE_AJAX_CONNECTIONEVENTS]\r", "\"mshta.exe\"=dword:00000001\r", "\r", "; Enables the XDomainRequest object, which represents a cross-domain Asynchronous JavaScript and XML (AJAX) request\r", "[HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Internet Explorer\\Main\\FeatureControl\\FEATURE_XDOMAINREQUEST]\r", "\"mshta.exe\"=dword:00000001\r", "\r", "; Disabling Local Machine Zone Lockdown an other blocking\r", "[HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Internet Explorer\\Main\\FeatureControl\\FEATURE_LOCALMACHINE_LOCKDOWN]\r", "\"mshta.exe\"=dword:00000000\r", "[HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Internet Explorer\\Main\\FeatureControl\\FEATURE_BLOCK_LMZ_OBJECT]\r", "\"mshta.exe\"=dword:00000000\r", "[HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Internet Explorer\\Main\\FeatureControl\\FEATURE_BLOCK_LMZ_SCRIPT]\r", "\"mshta.exe\"=dword:00000000\r", "\r", "; Disallow security band (still retains security)\r", "[HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Internet Explorer\\Main\\FeatureControl\\FEATURE_SECURITYBAND]\r", "\"mshta.exe\"=dword:00000000\r", "\r", "\r", "; FEATURE_BLOCK_CROSS_PROTOCOL_FILE_NAVIGATION\r", "[HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Internet Explorer\\Main\\FeatureControl\\FEATURE_BLOCK_CROSS_PROTOCOL_FILE_NAVIGATION]\r", "\"mshta.exe\"=dword:00000000\r", "\r", "; ActiveX Update Restriction\r", "[HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Internet Explorer\\Main\\FeatureControl\\FEATURE_RESTRICT_ACTIVEXINSTALL]\r", "\"mshta.exe\"=dword:00000000\r", "\r", "\r" True 1
Fn
Exit-Icon
WHOIS Domain Information
Domain Name
WHOIS Response 

       		
      

     

    

   

  

  

  

  

   

    
    

     Function Logfile
    

    

     

      Download-Icon
     

    

    

     Exit-Icon
    

   

   

    

     

      
       This feature requires an online-connection to the VMRay backend.
      
      

      

      An offline version with limited functionality is also provided.
      

      The offline version is supported only in Mozilla Firefoxwith deactivated setting "security.fileuri.strict_origin_policy".
     

     

    

   

   

    Before
   

   

    

     

      
       This feature requires an online-connection to the VMRay backend.
      
      

      

      An offline version with limited functionality is also provided.
      

      The offline version is supported only in Mozilla Firefoxwith deactivated setting "security.fileuri.strict_origin_policy".
     

     

    

   

   

    After
   

   

    

     

      
       This feature requires an online-connection to the VMRay backend.
      
      

      

      An offline version with limited functionality is also provided.
      

      The offline version is supported only in Mozilla Firefoxwith deactivated setting "security.fileuri.strict_origin_policy".
     

     

    

   

   

    

     
      

       
       
       
       
      

     
     
     
    

   

  

  

   

    
    

     Screenshot
    

    

     Expand-Icon
    

    

     Exit-Icon
    

   

   

    

     icon_left
    

    

     icon_left
    

   

   

   

   

    image