IObit Driver Booster 5.1.0.488 PRO serial key or number

IObit Driver Booster Pro 5.1.0.488 Preactiver (20 Nov.exe

This report is generated from a file or URL submitted to this webservice on December 1st 2017 15:53:09 (UTC)
Guest System: Windows 7 32 bit, Home Premium, 6.1 (build 7601), Service Pack 1
Report generated by Falcon Sandbox v7.20 © Hybrid Analysis

Remote Access

Reads terminal service related keys (often RDP related)

Spyware

POSTs files to a webserver

Persistence

Spawns a lot of processes
Writes data to a remote process

Fingerprint

Reads the active computer name
Reads the cryptographic machine GUID

Evasive

Reads Antivirus engine related registry keys
References security related windows services

Spreading

Opens the MountPointManager (often used to detect additional infection locations)

Network Behavior

Contacts 10 domains and 7 hosts. View all details

Not all malicious and suspicious indicators are displayed. Get your own cloud service or the full version to view all details.

• Malicious Indicators 13

• Anti-Detection/Stealthyness
  • Reads Antivirus engine related registry keys

    details

    "RttHlp.exe" (Path: "HKLM\SOFTWARE\IOBIT\DRIVER BOOSTER"; Key: "STATUS"; Value: "00000000040000000400000000000000")
    "AUpdate.exe" (Path: "HKLM\SOFTWARE\IOBIT\DRIVER BOOSTER"; Key: "STATUS"; Value: "00000000040000000400000000000000")

    source

    Registry Access

    relevance

    8/10

• External Systems
  • Detected Emerging Threats Alert

    details

    Detected alert "ET INFO Suspicious Mozilla User-Agent - Likely Fake (Mozilla/4.0)" (SID: 2003492, Rev: 29, Severity: 1) categorized as "A Network Trojan was detected"
    Detected alert "ET POLICY PE EXE or DLL Windows file download HTTP" (SID: 2018959, Rev: 3, Severity: 1) categorized as "Potential Corporate Privacy Violation"

    source

    Suricata Alerts

    relevance

    10/10

  • Sample was identified as malicious by at least one Antivirus engine

    details

    1/66 Antivirus vendors marked sample as malicious (1% detection rate)

    source

    External System

    relevance

    8/10

• General
  • The analysis extracted a file that was identified as malicious

    details

    1/68 Antivirus vendors marked dropped file "AUpdate.exe" as malicious (classified as "Program.Unwanted" with 1% detection rate)
    1/68 Antivirus vendors marked dropped file "is-45IES.tmp" as malicious (classified as "Program.Unwanted" with 1% detection rate)
    1/64 Antivirus vendors marked dropped file "is-8KCTO.tmp" as malicious (classified as "Program.Unwanted" with 1% detection rate)
    1/65 Antivirus vendors marked dropped file "is-DQCER.tmp" as malicious (classified as "Program.Unwanted" with 1% detection rate)

    source

    Extracted File

    relevance

    10/10

  • The analysis spawned a process that was identified as malicious

    details

    1/66 Antivirus vendors marked spawned process "DriverBooster.exe" (PID: 2940) as malicious (classified as "Program.Unwanted" with 1% detection rate)
    2/68 Antivirus vendors marked spawned process "SetupHlp.exe" (PID: 3096) as malicious (classified as "Program.Unwanted" with 2% detection rate)
    1/67 Antivirus vendors marked spawned process "HWiNFO.exe" (PID: 2952) as malicious (classified as "Program.Unwanted" with 1% detection rate)
    1/66 Antivirus vendors marked spawned process "AutoUpdate.exe" (PID: 3044) as malicious (classified as "Program.Unwanted" with 1% detection rate)
    1/68 Antivirus vendors marked spawned process "ChangeIcon.exe" (PID: 3128) as malicious (classified as "Program.Unwanted" with 1% detection rate)
    1/68 Antivirus vendors marked spawned process "NoteIcon.exe" (PID: 3156) as malicious (classified as "Program.Unwanted" with 1% detection rate)
    1/68 Antivirus vendors marked spawned process "FaultFixes.exe" (PID: 3140) as malicious (classified as "Program.Unwanted" with 1% detection rate)
    1/68 Antivirus vendors marked spawned process "FaultFixes.exe" (PID: 3240) as malicious (classified as "Program.Unwanted" with 1% detection rate)
    1/68 Antivirus vendors marked spawned process "RttHlp.exe" (PID: 3832) as malicious (classified as "Program.Unwanted" with 1% detection rate)
    1/66 Antivirus vendors marked spawned process "DBDownloader.exe" (PID: 1284) as malicious (classified as "Program.Unwanted" with 1% detection rate)
    1/68 Antivirus vendors marked spawned process "ChangeIcon.exe" (PID: 3388) as malicious (classified as "Program.Unwanted" with 1% detection rate)
    1/66 Antivirus vendors marked spawned process "DBDownloader.exe" (PID: 3464) as malicious (classified as "Program.Unwanted" with 1% detection rate)
    1/68 Antivirus vendors marked spawned process "AUpdate.exe" (PID: 3364) as malicious (classified as "Program.Unwanted" with 1% detection rate)

    source

    Monitored Target

    relevance

    10/10

• Installation/Persistance
  • Loads the task scheduler COM API

    details

    "DriverBooster.exe" loaded module "%WINDIR%\System32\taskschd.dll" at 717E0000
    "SetupHlp.exe" loaded module "%WINDIR%\System32\taskschd.dll" at 717E0000
    "NoteIcon.exe" loaded module "%WINDIR%\System32\taskschd.dll" at 717E0000

    source

    Loaded Module

    relevance

    5/10

  • Scans for the windows taskbar (often used for explorer injection)

    details

    "6b2b4f16e9fee43bd37e37aefd9aa23aabb2e5b1c6fb2ea3a915088e51c7a9ec.tmp" searching for class "Shell_TrayWnd"
    "DriverBooster.exe" searching for class "Shell_TrayWnd"

    source

    API Call

    relevance

    5/10

  • Writes data to a remote process

    details

    "<Input Sample>" wrote 1500 bytes to a remote process "%TEMP%\is-CPEK8.tmp\6b2b4f16e9fee43bd37e37aefd9aa23aabb2e5b1c6fb2ea3a915088e51c7a9ec.tmp" (Handle: 220)
    "<Input Sample>" wrote 4 bytes to a remote process "C:\Users\%USERNAME%\AppData\Local\Temp\is-CPEK8.tmp\6b2b4f16e9fee43bd37e37aefd9aa23aabb2e5b1c6fb2ea3a915088e51c7a9ec.tmp" (Handle: 220)
    "<Input Sample>" wrote 32 bytes to a remote process "C:\Users\%USERNAME%\AppData\Local\Temp\is-CPEK8.tmp\6b2b4f16e9fee43bd37e37aefd9aa23aabb2e5b1c6fb2ea3a915088e51c7a9ec.tmp" (Handle: 220)
    "<Input Sample>" wrote 52 bytes to a remote process "C:\Users\%USERNAME%\AppData\Local\Temp\is-CPEK8.tmp\6b2b4f16e9fee43bd37e37aefd9aa23aabb2e5b1c6fb2ea3a915088e51c7a9ec.tmp" (Handle: 220)
    "6b2b4f16e9fee43bd37e37aefd9aa23aabb2e5b1c6fb2ea3a915088e51c7a9ec.tmp" wrote 32 bytes to a remote process "C:\Program Files\IObit\Driver Booster\DriverBooster.exe" (Handle: 640)
    "6b2b4f16e9fee43bd37e37aefd9aa23aabb2e5b1c6fb2ea3a915088e51c7a9ec.tmp" wrote 52 bytes to a remote process "C:\Program Files\IObit\Driver Booster\DriverBooster.exe" (Handle: 640)
    "6b2b4f16e9fee43bd37e37aefd9aa23aabb2e5b1c6fb2ea3a915088e51c7a9ec.tmp" wrote 4 bytes to a remote process "C:\Program Files\IObit\Driver Booster\DriverBooster.exe" (Handle: 640)
    "DriverBooster.exe" wrote 1500 bytes to a remote process "C:\Program Files\IObit\Driver Booster\SetupHlp.exe" (Handle: 776)
    "DriverBooster.exe" wrote 4 bytes to a remote process "C:\Program Files\IObit\Driver Booster\SetupHlp.exe" (Handle: 776)
    "DriverBooster.exe" wrote 32 bytes to a remote process "C:\Program Files\IObit\Driver Booster\SetupHlp.exe" (Handle: 776)
    "DriverBooster.exe" wrote 52 bytes to a remote process "C:\Program Files\IObit\Driver Booster\SetupHlp.exe" (Handle: 776)
    "DriverBooster.exe" wrote 32 bytes to a remote process "C:\Program Files\IObit\Driver Booster\HWiNFO\HWiNFO.exe" (Handle: 776)
    "DriverBooster.exe" wrote 52 bytes to a remote process "C:\Program Files\IObit\Driver Booster\HWiNFO\HWiNFO.exe" (Handle: 776)
    "DriverBooster.exe" wrote 4 bytes to a remote process "C:\Program Files\IObit\Driver Booster\HWiNFO\HWiNFO.exe" (Handle: 776)
    "DriverBooster.exe" wrote 1500 bytes to a remote process "C:\Program Files\IObit\Driver Booster\AutoUpdate.exe" (Handle: 964)
    "DriverBooster.exe" wrote 4 bytes to a remote process "C:\Program Files\IObit\Driver Booster\AutoUpdate.exe" (Handle: 964)
    "DriverBooster.exe" wrote 32 bytes to a remote process "C:\Program Files\IObit\Driver Booster\AutoUpdate.exe" (Handle: 964)
    "DriverBooster.exe" wrote 52 bytes to a remote process "C:\Program Files\IObit\Driver Booster\AutoUpdate.exe" (Handle: 964)
    "DriverBooster.exe" wrote 32 bytes to a remote process "C:\Program Files\IObit\Driver Booster\ChangeIcon.exe" (Handle: 988)
    "DriverBooster.exe" wrote 52 bytes to a remote process "C:\Program Files\IObit\Driver Booster\ChangeIcon.exe" (Handle: 988)
    "DriverBooster.exe" wrote 4 bytes to a remote process "C:\Program Files\IObit\Driver Booster\ChangeIcon.exe" (Handle: 988)
    "DriverBooster.exe" wrote 32 bytes to a remote process "C:\Program Files\IObit\Driver Booster\NoteIcon.exe" (Handle: 1308)
    "DriverBooster.exe" wrote 52 bytes to a remote process "C:\Program Files\IObit\Driver Booster\NoteIcon.exe" (Handle: 1308)
    "DriverBooster.exe" wrote 4 bytes to a remote process "C:\Program Files\IObit\Driver Booster\NoteIcon.exe" (Handle: 1308)
    "DriverBooster.exe" wrote 32 bytes to a remote process "C:\Program Files\IObit\Driver Booster\FaultFixes.exe" (Handle: 1576)
    "DriverBooster.exe" wrote 52 bytes to a remote process "C:\Program Files\IObit\Driver Booster\FaultFixes.exe" (Handle: 1576)
    "DriverBooster.exe" wrote 4 bytes to a remote process "C:\Program Files\IObit\Driver Booster\FaultFixes.exe" (Handle: 1576)
    "DriverBooster.exe" wrote 32 bytes to a remote process "C:\Program Files\IObit\Driver Booster\RttHlp.exe" (Handle: 1576)
    "DriverBooster.exe" wrote 52 bytes to a remote process "C:\Program Files\IObit\Driver Booster\RttHlp.exe" (Handle: 1576)
    "DriverBooster.exe" wrote 4 bytes to a remote process "C:\Program Files\IObit\Driver Booster\RttHlp.exe" (Handle: 1576)
    "DriverBooster.exe" wrote 32 bytes to a remote process "C:\Program Files\IObit\Driver Booster\DBDownloader.exe" (Handle: 1680)
    "DriverBooster.exe" wrote 52 bytes to a remote process "C:\Program Files\IObit\Driver Booster\DBDownloader.exe" (Handle: 1680)
    "DriverBooster.exe" wrote 4 bytes to a remote process "C:\Program Files\IObit\Driver Booster\DBDownloader.exe" (Handle: 1680)
    "DriverBooster.exe" wrote 32 bytes to a remote process "C:\Program Files\IObit\Driver Booster\ChangeIcon.exe" (Handle: 1720)
    "DriverBooster.exe" wrote 52 bytes to a remote process "C:\Program Files\IObit\Driver Booster\ChangeIcon.exe" (Handle: 1720)
    "DriverBooster.exe" wrote 4 bytes to a remote process "C:\Program Files\IObit\Driver Booster\ChangeIcon.exe" (Handle: 1720)
    "DriverBooster.exe" wrote 32 bytes to a remote process "C:\Program Files\IObit\Driver Booster\DBDownloader.exe" (Handle: 1596)
    "DriverBooster.exe" wrote 52 bytes to a remote process "C:\Program Files\IObit\Driver Booster\DBDownloader.exe" (Handle: 1596)
    "DriverBooster.exe" wrote 4 bytes to a remote process "C:\Program Files\IObit\Driver Booster\DBDownloader.exe" (Handle: 1596)
    "DriverBooster.exe" wrote 1500 bytes to a remote process "C:\Program Files\IObit\Driver Booster\AUpdate.exe" (Handle: 1560)
    "DriverBooster.exe" wrote 4 bytes to a remote process "C:\Program Files\IObit\Driver Booster\AUpdate.exe" (Handle: 1560)
    "DriverBooster.exe" wrote 32 bytes to a remote process "C:\Program Files\IObit\Driver Booster\AUpdate.exe" (Handle: 1560)
    "DriverBooster.exe" wrote 52 bytes to a remote process "C:\Program Files\IObit\Driver Booster\AUpdate.exe" (Handle: 1560)

    source

    API Call

    relevance

    6/10

• Network Related
  • Found more than one unique User-Agent

    details

    Found the following User-Agents: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.0.10) Gecko/2009042316 Firefox/3.0.10
    Mozilla/5.0 (Windows NT 6.1; rv:28.0) Firefox/28.0
    Mozilla/3.0 (compatible; Indy Library)
    Mozilla/5.0 (compatible; MSIE 10.0; Trident/6.0; Windows NT 6.1;)
    Mozilla/4.0 (compatible; ICS)
    Mozilla/4.0
    Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.2; Trident/6.0)

    source

    Network Traffic

    relevance

    5/10

  • Malicious artifacts seen in the context of a contacted host

    details

    Found malicious artifacts related to "54.235.137.177" (ASN: , Owner: ): ...
    
    File SHA256: 69d63068fc188618808bd8c9beef8cdc505de953d48970cedee18b6bc373d3f4 (AV positives: 13/68 scanned on 10/26/2017 20:14:41)
    File SHA256: 87fb8ca3931c3d2902192ee4f68c648695eafda15dcdd145292c6eedb06dcb26 (AV positives: 12/64 scanned on 09/29/2017 13:01:12)
    File SHA256: 9a31d6d8e8e878c72bde10d0b1639752ee07165d55451f78634725d77d7ebb9c (AV positives: 9/65 scanned on 09/28/2017 09:03:01)
    Found malicious artifacts related to "93.184.221.133" (ASN: , Owner: ): ...
    
    URL: http://images.webads.nl/stir/an/INDIANFEELINGS.NL.js (AV positives: 1/65 scanned on 11/17/2017 07:16:15)
    URL: http://images.webads.nl/stir/an/VOETBALPRIMEUR.NL.js (AV positives: 1/65 scanned on 11/16/2017 22:05:12)
    URL: http://images.webads.nl/stir/eredivisie.js (AV positives: 1/65 scanned on 11/16/2017 16:16:00)
    URL: http://images.webads.nl/stir/an/OKOKO.NL.js (AV positives: 1/65 scanned on 11/16/2017 12:59:15)
    URL: http://images.webads.nl/stir/an/FOK.NL.js (AV positives: 1/65 scanned on 11/16/2017 12:24:53)
    File SHA256: 5ce19274f94d5ec6ae562f7e5bf74e942caf4f14c3064ac039a934aa276e9927 (AV positives: 4/66 scanned on 12/01/2017 05:52:57)
    File SHA256: aa50977185e89c925a8076043b73033eccb9857c684766ba2a4f16e09737bfe3 (AV positives: 14/66 scanned on 11/28/2017 06:59:02)
    File SHA256: d4906f54739946d76be4fee7bcb07c4b9903f23924f14d6692c6f61d696e31da (AV positives: 2/68 scanned on 11/27/2017 15:45:44)
    File SHA256: 05207932cc312a43158137421d479554ba5fc166309ee314e134ec86d886ad25 (AV positives: 37/68 scanned on 11/27/2017 13:32:53)
    File SHA256: e5ed57e2a4f6513b761be787d5653b434dc3f5eeb698612e085f991f6e27fe11 (AV positives: 4/68 scanned on 11/26/2017 11:39:29)
    File SHA256: f74ae2140f24775ba135f97b95eeede0ef04a9d389efdc20a4080ebbf5088ef4 (Scanned on 11/25/2017 14:59:00)
    File SHA256: bec90b65dcd74eecb031805b20f1f37eb93412471184019d4d6ccfbb8eaa7499 (Scanned on 11/24/2017 12:09:24)
    File SHA256: 7f8fec61c7272e583e024a6f7e7c8df552422f2d1b0b456a945cb400c7e8cce8 (Scanned on 11/24/2017 11:46:52)
    File SHA256: 2f56d73112a96dca86cb878c31d12898d5bcca64835b56962f11823b3ac8296d (Scanned on 11/24/2017 07:55:42)
    File SHA256: f16d9b861b36cca2edc3cafe3d9e38e983c8b2e1aa61adea3a6b953a02a9852a (Scanned on 11/24/2017 07:55:17)
    Found malicious artifacts related to "52.57.6.142" (ASN: , Owner: ): ...
    
    File SHA256: aa50977185e89c925a8076043b73033eccb9857c684766ba2a4f16e09737bfe3 (AV positives: 14/66 scanned on 11/28/2017 06:59:02)
    Found malicious artifacts related to "54.243.109.161" (ASN: , Owner: ): ...
    
    File SHA256: aa50977185e89c925a8076043b73033eccb9857c684766ba2a4f16e09737bfe3 (AV positives: 14/66 scanned on 11/28/2017 06:59:02)
    File SHA256: 7cf2655b2ba201163d38d699eeaf567ccbd81a362002e4d8f3af1fc55f6d4069 (AV positives: 23/65 scanned on 10/22/2017 13:38:54)
    File SHA256: 9de2daeb469a15a3564ec28506f6b200f599cf7ab65e812758efa2ab5ca7464d (AV positives: 7/65 scanned on 10/13/2017 02:16:47)
    Found malicious artifacts related to "74.81.175.20" (ASN: , Owner: ): ...
    
    URL: http://icculus.org/virtualjaguar/tarballs/virtualjaguar-2.1.0-win32.rar (AV positives: 1/65 scanned on 11/12/2017 23:38:51)
    URL: http://offload2.icculus.org:9090/virtualjaguar/tarballs/virtualjaguar-2.1.0-win32.rar (AV positives: 1/65 scanned on 11/12/2017 23:38:52)
    URL: http://icculus.org/physfs/downloads/physfs-2.0.1.tar.gz (AV positives: 1/65 scanned on 08/11/2017 14:26:01)
    URL: http://offload2.icculus.org/alienarena/Files (AV positives: 1/65 scanned on 07/26/2017 07:14:45)
    URL: http://icculus.org/alienarena/Files (AV positives: 1/65 scanned on 07/26/2017 07:13:36)
    File SHA256: 69d63068fc188618808bd8c9beef8cdc505de953d48970cedee18b6bc373d3f4 (AV positives: 13/68 scanned on 10/26/2017 20:14:41)
    File SHA256: 7cf2655b2ba201163d38d699eeaf567ccbd81a362002e4d8f3af1fc55f6d4069 (AV positives: 23/65 scanned on 10/22/2017 13:38:54)
    File SHA256: 9a31d6d8e8e878c72bde10d0b1639752ee07165d55451f78634725d77d7ebb9c (AV positives: 9/65 scanned on 09/28/2017 09:03:01)
    File SHA256: 26d2092cf93269f76deeddcdf411adf1c80c810d2aff0c379e89750c7eac5f5d (AV positives: 1/58 scanned on 07/19/2017 22:31:06)
    File SHA256: 29bed71ed0fdbe98f3978a39597a288b075017471d503f3cdc6042985a5b6dba (AV positives: 10/58 scanned on 07/05/2017 19:48:02)
    Found malicious artifacts related to "54.235.130.156" (ASN: , Owner: ): ...
    
    File SHA256: aa50977185e89c925a8076043b73033eccb9857c684766ba2a4f16e09737bfe3 (AV positives: 14/66 scanned on 11/28/2017 06:59:02)

    source

    Network Traffic

    relevance

    10/10

  • Multiple malicious artifacts seen in the context of different hosts

    details

    Found malicious artifacts related to "54.235.137.177" (ASN: , Owner: ): ...
    
    File SHA256: 69d63068fc188618808bd8c9beef8cdc505de953d48970cedee18b6bc373d3f4 (AV positives: 13/68 scanned on 10/26/2017 20:14:41)
    File SHA256: 87fb8ca3931c3d2902192ee4f68c648695eafda15dcdd145292c6eedb06dcb26 (AV positives: 12/64 scanned on 09/29/2017 13:01:12)
    File SHA256: 9a31d6d8e8e878c72bde10d0b1639752ee07165d55451f78634725d77d7ebb9c (AV positives: 9/65 scanned on 09/28/2017 09:03:01)
    Found malicious artifacts related to "93.184.221.133" (ASN: , Owner: ): ...
    
    URL: http://images.webads.nl/stir/an/INDIANFEELINGS.NL.js (AV positives: 1/65 scanned on 11/17/2017 07:16:15)
    URL: http://images.webads.nl/stir/an/VOETBALPRIMEUR.NL.js (AV positives: 1/65 scanned on 11/16/2017 22:05:12)
    URL: http://images.webads.nl/stir/eredivisie.js (AV positives: 1/65 scanned on 11/16/2017 16:16:00)
    URL: http://images.webads.nl/stir/an/OKOKO.NL.js (AV positives: 1/65 scanned on 11/16/2017 12:59:15)
    URL: http://images.webads.nl/stir/an/FOK.NL.js (AV positives: 1/65 scanned on 11/16/2017 12:24:53)
    File SHA256: 5ce19274f94d5ec6ae562f7e5bf74e942caf4f14c3064ac039a934aa276e9927 (AV positives: 4/66 scanned on 12/01/2017 05:52:57)
    File SHA256: aa50977185e89c925a8076043b73033eccb9857c684766ba2a4f16e09737bfe3 (AV positives: 14/66 scanned on 11/28/2017 06:59:02)
    File SHA256: d4906f54739946d76be4fee7bcb07c4b9903f23924f14d6692c6f61d696e31da (AV positives: 2/68 scanned on 11/27/2017 15:45:44)
    File SHA256: 05207932cc312a43158137421d479554ba5fc166309ee314e134ec86d886ad25 (AV positives: 37/68 scanned on 11/27/2017 13:32:53)
    File SHA256: e5ed57e2a4f6513b761be787d5653b434dc3f5eeb698612e085f991f6e27fe11 (AV positives: 4/68 scanned on 11/26/2017 11:39:29)
    File SHA256: f74ae2140f24775ba135f97b95eeede0ef04a9d389efdc20a4080ebbf5088ef4 (Scanned on 11/25/2017 14:59:00)
    File SHA256: bec90b65dcd74eecb031805b20f1f37eb93412471184019d4d6ccfbb8eaa7499 (Scanned on 11/24/2017 12:09:24)
    File SHA256: 7f8fec61c7272e583e024a6f7e7c8df552422f2d1b0b456a945cb400c7e8cce8 (Scanned on 11/24/2017 11:46:52)
    File SHA256: 2f56d73112a96dca86cb878c31d12898d5bcca64835b56962f11823b3ac8296d (Scanned on 11/24/2017 07:55:42)
    File SHA256: f16d9b861b36cca2edc3cafe3d9e38e983c8b2e1aa61adea3a6b953a02a9852a (Scanned on 11/24/2017 07:55:17)
    Found malicious artifacts related to "52.57.6.142" (ASN: , Owner: ): ...
    
    File SHA256: aa50977185e89c925a8076043b73033eccb9857c684766ba2a4f16e09737bfe3 (AV positives: 14/66 scanned on 11/28/2017 06:59:02)
    Found malicious artifacts related to "54.243.109.161" (ASN: , Owner: ): ...
    
    File SHA256: aa50977185e89c925a8076043b73033eccb9857c684766ba2a4f16e09737bfe3 (AV positives: 14/66 scanned on 11/28/2017 06:59:02)
    File SHA256: 7cf2655b2ba201163d38d699eeaf567ccbd81a362002e4d8f3af1fc55f6d4069 (AV positives: 23/65 scanned on 10/22/2017 13:38:54)
    File SHA256: 9de2daeb469a15a3564ec28506f6b200f599cf7ab65e812758efa2ab5ca7464d (AV positives: 7/65 scanned on 10/13/2017 02:16:47)
    Found malicious artifacts related to "74.81.175.20" (ASN: , Owner: ): ...
    
    URL: http://icculus.org/virtualjaguar/tarballs/virtualjaguar-2.1.0-win32.rar (AV positives: 1/65 scanned on 11/12/2017 23:38:51)
    URL: http://offload2.icculus.org:9090/virtualjaguar/tarballs/virtualjaguar-2.1.0-win32.rar (AV positives: 1/65 scanned on 11/12/2017 23:38:52)
    URL: http://icculus.org/physfs/downloads/physfs-2.0.1.tar.gz (AV positives: 1/65 scanned on 08/11/2017 14:26:01)
    URL: http://offload2.icculus.org/alienarena/Files (AV positives: 1/65 scanned on 07/26/2017 07:14:45)
    URL: http://icculus.org/alienarena/Files (AV positives: 1/65 scanned on 07/26/2017 07:13:36)
    File SHA256: 69d63068fc188618808bd8c9beef8cdc505de953d48970cedee18b6bc373d3f4 (AV positives: 13/68 scanned on 10/26/2017 20:14:41)
    File SHA256: 7cf2655b2ba201163d38d699eeaf567ccbd81a362002e4d8f3af1fc55f6d4069 (AV positives: 23/65 scanned on 10/22/2017 13:38:54)
    File SHA256: 9a31d6d8e8e878c72bde10d0b1639752ee07165d55451f78634725d77d7ebb9c (AV positives: 9/65 scanned on 09/28/2017 09:03:01)
    File SHA256: 26d2092cf93269f76deeddcdf411adf1c80c810d2aff0c379e89750c7eac5f5d (AV positives: 1/58 scanned on 07/19/2017 22:31:06)
    File SHA256: 29bed71ed0fdbe98f3978a39597a288b075017471d503f3cdc6042985a5b6dba (AV positives: 10/58 scanned on 07/05/2017 19:48:02)
    Found malicious artifacts related to "54.235.130.156" (ASN: , Owner: ): ...
    
    File SHA256: aa50977185e89c925a8076043b73033eccb9857c684766ba2a4f16e09737bfe3 (AV positives: 14/66 scanned on 11/28/2017 06:59:02)

    source

    Network Traffic

    relevance

    10/10

• System Security
• Unusual Characteristics
  • Spawns a lot of processes

    details

    Spawned process "<Input Sample>" (Show Process)
    Spawned process "6b2b4f16e9fee43bd37e37aefd9aa23aabb2e5b1c6fb2ea3a915088e51c7a9ec.tmp" with commandline "/SL5="$101A0
    22021256
    57856
    C:\6b2b4f16e9fee43bd37e37aefd9aa23aabb2e5b1c6fb2ea3a915088e51c7a9ec.exe"" (Show Process)
    Spawned process "DriverBooster.exe" (Show Process)
    Spawned process "SetupHlp.exe" with commandline "/checkover" (Show Process)
    Spawned process "HWiNFO.exe" with commandline "/brandname" (Show Process)
    Spawned process "AutoUpdate.exe" with commandline "/auto /App=db5 /MainHwnd=0" (Show Process)
    Spawned process "ChangeIcon.exe" with commandline "/0 "%PROGRAMFILES%\IObit\Driver Booster\Icons\Main\"" (Show Process)
    Spawned process "NoteIcon.exe" with commandline ""%PROGRAMFILES%\IObit\Driver Booster\DriverBooster.exe"" (Show Process)
    Spawned process "FaultFixes.exe" with commandline "/fix-errorcode-1" (Show Process)
    Spawned process "FaultFixes.exe" with commandline "/fix-clean-1" (Show Process)
    Spawned process "RttHlp.exe" with commandline "/regcheckfalse" (Show Process)
    Spawned process "DBDownloader.exe" with commandline "{"proxytype":0,"task":[{"exp":"C:\\Program Files\\IObit\\Driver Booster\\Database\\Scan\\WhiteList.db","u":"http://192-168-1-14.driverboosterscan.com/2017/live/wlst/47bad3c34bde5c6ad96b2ac2a7e6c7ee.wlst","t":3,"p":"C:\\Program Files\\IObit\\Driver Booster\\Database\\Scan\\WhiteListtmp","m":"47bad3c34bde5c6ad96b2ac2a7e6c7ee","d":false}],"downtype":1}" (Show Process)
    Spawned process "ChangeIcon.exe" with commandline "/10 "%PROGRAMFILES%\IObit\Driver Booster\Icons\Main\"" (Show Process)
    Spawned process "DBDownloader.exe" with commandline "{"proxytype":0,"hosthandle":197072,"timeout":10,"id":22268,"task":[{"u":"http://fpdownload.adobe.com/get/flashplayer/pdc/27.0.0.187/install_flash_player.exe","t":0,"p":""},{"u":"http://download.microsoft.com/download/c/9/3/c93555e3-472e-4493-a796-73fd6721c648/vc_redist.x86.exe","t":0,"p":""},{"u":"http://download.microsoft.com/download/0/f/f/0ff8780d-f50a-41ef-a31a-09db7c0589a2/xnafx30_redist.msi","t":0,"p":""},{"u":"http://www.openal.org/downloads/oalinst.zip","t":0,"p":""},{"u":"http://download.microsoft.com/download/5/9/1/5912526C-B950-4662-99B6-119A83E60E5C/xnafx31_redist.msi","t":0,"p":""},{"u":"http://download.microsoft.com/download/0/5/6/056dcda9-d667-4e27-8001-8a0c6971d6b1/vcredist_x86.exe","t":0,"p":""},{"u":"http://fpdownload.adobe.com/get/flashplayer/pdc/27.0.0.187/install_flash_player_ax.exe","t":0,"p":""},{"u":"http://download.microsoft.com/download/F/D/0/FD0B0093-DE8A-4C4E-BDC4-F0C56D72018C/50907.00/Silverlight.exe","t":0,"p":""},{"u":"http://download.microsoft.com/download/D/0/F/D0F9F1BD-9BE6-49E4-8729-4AAAFCAC20F9/gfwlivesetup.exe","t":0,"p":""},{"u":"http://download.microsoft.com/download/1/4/9/14936FE9-4D16-4019-A093-5E00182609EB/Windows6.1-KB2670838-x86.msu","t":0,"p":""}],"downtype":4}" (Show Process)
    Spawned process "AUpdate.exe" with commandline "/u http://ascstats.iobit.com/active.php /p iobit /a db5 /v 5.1.0.488 /t 2 /d 7" (Show Process)

    source

    Monitored Target

    relevance

    8/10

• Suspicious Indicators 27

• Anti-Detection/Stealthyness
  • Contains ability to open/control a service

    details

    OpenServiceW@ADVAPI32.dll at 33610-1174-0041EE8C
    ControlService@ADVAPI32.dll at 33610-1177-0041EE11

    source

    Hybrid Analysis Technology

    relevance

    8/10

  • Queries the internet cache settings (often used to hide footprints in index.dat or internet cache)

    details

    "DriverBooster.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS"; Key: "DISABLECACHINGOFSSLPAGES"; Value: "00000000040000000400000000000000")
    "AUpdate.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS"; Key: "DISABLECACHINGOFSSLPAGES"; Value: "00000000040000000400000000000000")

    source

    Registry Access

    relevance

    3/10

• Anti-Reverse Engineering
• Environment Awareness
  • Reads the active computer name

    details

    "6b2b4f16e9fee43bd37e37aefd9aa23aabb2e5b1c6fb2ea3a915088e51c7a9ec.tmp" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\COMPUTERNAME\ACTIVECOMPUTERNAME"; Key: "COMPUTERNAME")
    "DriverBooster.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\COMPUTERNAME\ACTIVECOMPUTERNAME"; Key: "COMPUTERNAME")
    "SetupHlp.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\COMPUTERNAME\ACTIVECOMPUTERNAME"; Key: "COMPUTERNAME")
    "HWiNFO.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\COMPUTERNAME\ACTIVECOMPUTERNAME"; Key: "COMPUTERNAME")
    "AutoUpdate.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\COMPUTERNAME\ACTIVECOMPUTERNAME"; Key: "COMPUTERNAME")
    "ChangeIcon.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\COMPUTERNAME\ACTIVECOMPUTERNAME"; Key: "COMPUTERNAME")
    "NoteIcon.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\COMPUTERNAME\ACTIVECOMPUTERNAME"; Key: "COMPUTERNAME")
    "FaultFixes.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\COMPUTERNAME\ACTIVECOMPUTERNAME"; Key: "COMPUTERNAME")
    "DBDownloader.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\COMPUTERNAME\ACTIVECOMPUTERNAME"; Key: "COMPUTERNAME")
    "AUpdate.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\COMPUTERNAME\ACTIVECOMPUTERNAME"; Key: "COMPUTERNAME")

    source

    Registry Access

    relevance

    5/10

  • Reads the cryptographic machine GUID

    details

    "DriverBooster.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\CRYPTOGRAPHY"; Key: "MACHINEGUID")
    "AUpdate.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\CRYPTOGRAPHY"; Key: "MACHINEGUID")

    source

    Registry Access

    relevance

    10/10

• External Systems
• General
  • Opened the service control manager

    details

    "DriverBooster.exe" called "OpenSCManager" requesting access rights "SC_MANAGER_CONNECT" (0x1)
    "HWiNFO.exe" called "OpenSCManager" requesting access rights "SC_MANAGER_ALL_ACCESS" (0xf003f)
    "AUpdate.exe" called "OpenSCManager" requesting access rights "SC_MANAGER_CONNECT" (0x1)

    source

    API Call

    relevance

    10/10

  • POSTs files to a webserver

    details

    "POST /check.php HTTP/1.0
    Connection: Keep-Alive
    Content-Type: application/x-www-form-urlencoded
    Content-Length: 48
    Host: idb.iobit.com
    Accept: text/html, application/xhtml+xml, */*
    Accept-Encoding: identity
    User-Agent: Mozilla/5.0 (Windows NT 6.1; rv:28.0) Firefox/28.0" with no payload
    "POST /news/version-check.ini HTTP/1.0
    Connection: keep-alive
    Content-Type: application/x-www-form-urlencoded
    Content-Length: 0
    Host: download.iobit.com
    Accept: text/html, */*
    Accept-Encoding: identity
    User-Agent: Mozilla/3.0 (compatible; Indy Library)" with no payload
    "POST /news/idb/v5/idb5_ln.dat HTTP/1.0
    Connection: keep-alive
    Content-Type: application/x-www-form-urlencoded
    Content-Length: 0
    Host: download.iobit.com
    Accept: text/html, */*
    Accept-Encoding: identity
    User-Agent: Mozilla/3.0 (compatible; Indy Library)" with no payload

    source

    Network Traffic

    relevance

    5/10

  • Requested access to a system service

    details

    "6b2b4f16e9fee43bd37e37aefd9aa23aabb2e5b1c6fb2ea3a915088e51c7a9ec.tmp" called "OpenService" to access the "ServicesActive" service
    "DriverBooster.exe" called "OpenService" to access the "Sens" service requesting "SERVICE_QUERY_STATUS" (0X4) access rights
    "DriverBooster.exe" called "OpenService" to access the "rasman" service
    "DriverBooster.exe" called "OpenService" to access the "RASMAN" service
    "AUpdate.exe" called "OpenService" to access the "rasman" service
    "AUpdate.exe" called "OpenService" to access the "Sens" service requesting "SERVICE_QUERY_STATUS" (0X4) access rights
    "AUpdate.exe" called "OpenService" to access the "RASMAN" service

    source

    API Call

    relevance

    10/10

• Installation/Persistance

Download Setup+Crack File:

Download Crack Only File: