| File name: | emd_vo_agent_client_111317.msi |
| Full analysis: | https://app.any.run/tasks/44b9cb11-9ab2-4bc8-b378-e431b138ce30 |
| Verdict: | Malicious activity |
| Analysis date: | March 15, 2018, 15:18:03 |
| OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
| Indicators: | |
| MIME: | application/x-msi |
| File info: | Composite Document File V2 Document, Little Endian, Os: Windows, Version 6.2, MSI Installer, Code page: 1252, Title: Installation Database, Subject: Virtual Observer Agent Client, Author: Coordinated Systems, Inc., Keywords: Installer,MSI,Database, Comments: Contact: Your local administrator, Template: Intel;1033, Last Saved By: jziencina, Revision Number: {199C76BB-4B5E-4864-8BAE-C1C9EF18CCEE}, Last Printed: Thu Nov 2 15:23:07 2017, Create Time/Date: Thu Nov 2 15:23:07 2017, Last Saved Time/Date: Mon Nov 13 09:34:34 2017, Number of Pages: 200, Number of Words: 0, Number of Characters: 0, Name of Creating Application: InstEd, Security: 1 |
| MD5: | 60A4F126A1A06AEFB796C6F79CAAD1F2 |
| SHA1: | 2088E7A8FDA6EDFA86262349CB6B0F658C648C64 |
| SHA256: | 06DB66FF76F978AE7F847CE0DF8DF27530915BB57ECEE92A15059207DEA19477 |
| SSDEEP: | 196608:/59Nra3MwQ/UZTptOii49Ry6OKA6g1HkthUji:B9N28lOTXOiiyOnk |
MALICIOUS
Application was dropped or rewritten from another process
- TSCC.exe (PID: 3348)
- InstallServices.exe (PID: 3456)
- voacld.exe (PID: 2760)
- VOACLI.EXE (PID: 3712)
- VOACMT.EXE (PID: 3060)
- GLBF8A0.tmp (PID: 1732)
- RegisterFiles.exe (PID: 3908)
- InstallLightsOutButton.exe (PID: 3580)
Application loaded dropped or rewritten executable
- RegisterFiles.exe (PID: 3908)
- voacld.exe (PID: 2760)
- VOACLI.EXE (PID: 3712)
- VOACMT.EXE (PID: 3060)
- regsvr32.exe (PID: 4076)
- regsvr32.exe (PID: 2468)
- regsvr32.exe (PID: 3524)
- regsvr32.exe (PID: 3420)
Changes the autorun value in the registry
- InstallServices.exe (PID: 3456)
SUSPICIOUS
Modifies files in the system directory
- vssvc.exe (PID: 2704)
- msiexec.exe (PID: 2488)
- GLBF8A0.tmp (PID: 1732)
Creates or modifies windows services
- msiexec.exe (PID: 2488)
- vssvc.exe (PID: 2704)
- VOACLI.EXE (PID: 3712)
- VOACMT.EXE (PID: 3060)
Low-level read access rights to disk partition
- vssvc.exe (PID: 2704)
Starts application with an unusual extension
- TSCC.exe (PID: 3348)
Creates files in the Windows directory
- GLBF8A0.tmp (PID: 1732)
- msiexec.exe (PID: 2488)
- VOACLI.EXE (PID: 3712)
- VOACMT.EXE (PID: 3060)
Creates files in the program directory
- msiexec.exe (PID: 2488)
- RegisterFiles.exe (PID: 3908)
- InstallServices.exe (PID: 3456)
- cmd.exe (PID: 2792)
- VOACLI.EXE (PID: 3712)
- VOACMT.EXE (PID: 3060)
Removes files from Windows directory
- msiexec.exe (PID: 2488)
- GLBF8A0.tmp (PID: 1732)
Creates COM task schedule object
- RegisterFiles.exe (PID: 3908)
Starts CMD.EXE for commands execution
- InstallServices.exe (PID: 3456)
Starts SC.EXE for service management
- cmd.exe (PID: 2792)
Creates a software uninstall entry
- msiexec.exe (PID: 2488)
INFO
Loads rich edit control libraries
- GLBF8A0.tmp (PID: 1732)
Dropped object may contain URL's
- msiexec.exe (PID: 2488)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
TRiD
| .msi | | | Microsoft Windows Installer (88.6) |
|---|---|---|
| .mst | | | Windows SDK Setup Transform Script (10) |
| . | | | Generic OLE2 / Multistream Compound File (1.2) |
EXIF
FlashPix
| CodePage: | Windows Latin 1 (Western European) |
|---|---|
| Title: | Installation Database |
| Subject: | Virtual Observer Agent Client |
| Author: | Coordinated Systems, Inc. |
| Keywords: | Installer,MSI,Database |
| Comments: | Contact: Your local administrator |
| Template: | Intel;1033 |
| LastModifiedBy: | jziencina |
| RevisionNumber: | {199C76BB-4B5E-4864-8BAE-C1C9EF18CCEE} |
| LastPrinted: | 2017:11:02 15:23:07 |
| CreateDate: | 2017:11:02 15:23:07 |
| ModifyDate: | 2017:11:13 09:34:34 |
| Pages: | 200 |
| Words: | - |
| Characters: | - |
| Software: | InstEd |
| Security: | Password protected |
Total processes
59
Monitored processes
23
Malicious processes
10
Suspicious processes
1
Behavior graph
Click at the process to see the details
Process information
PID | CMD | Path | Indicators | Parent process | |||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 1732 | C:\Users\admin\AppData\Local\Temp\GLBF8A0.tmp /s4736 C:\PROGRA~1\CSI\VIRTUA~1\TSCC.exe | C:\Users\admin\AppData\Local\Temp\GLBF8A0.tmp | TSCC.exe | ||||||||||||
User: SYSTEM Integrity Level: SYSTEM Exit code: 0 Modules
| |||||||||||||||
| 2468 | regsvr32 "C:\Program Files\CSI\Virtual Observer\IGToolBars50.OCX" /s | C:\Windows\system32\regsvr32.exe | — | cmd.exe | |||||||||||
User: SYSTEM Company: Microsoft Corporation Integrity Level: SYSTEM Description: Microsoft(C) Register Server Exit code: 0 Version: 6.1.7600.16385 (win7_rtm.090713-1255) Modules
| |||||||||||||||
| 2488 | C:\Windows\system32\msiexec.exe /V | C:\Windows\system32\msiexec.exe | services.exe | ||||||||||||
User: SYSTEM Company: Microsoft Corporation Integrity Level: SYSTEM Description: Windows® installer Exit code: 0 Version: 5.0.7600.16385 (win7_rtm.090713-1255) Modules
| |||||||||||||||
| 2704 | C:\Windows\system32\vssvc.exe | C:\Windows\system32\vssvc.exe | — | services.exe | |||||||||||
User: SYSTEM Company: Microsoft Corporation Integrity Level: SYSTEM Description: Microsoft® Volume Shadow Copy Service Exit code: 0 Version: 6.1.7600.16385 (win7_rtm.090713-1255) Modules
| |||||||||||||||
| 2744 | sc create VOACMT binpath= "C:\Program Files\CSI\Virtual Observer\VOACMT.EXE" displayname= "VO - Agent Client Media Transfer Service" start= "auto" type= "own" depend= "lanmanworkstation" | C:\Windows\system32\sc.exe | — | cmd.exe | |||||||||||
User: SYSTEM Company: Microsoft Corporation Integrity Level: SYSTEM Description: A tool to aid in developing services for WindowsNT Exit code: 0 Version: 6.1.7600.16385 (win7_rtm.090713-1255) Modules
| |||||||||||||||
| 2756 | regsvr32 "C:\Program Files\CSI\Virtual Observer\ChilKatFTP2.DLL" /s | C:\Windows\system32\regsvr32.exe | — | cmd.exe | |||||||||||
User: SYSTEM Company: Microsoft Corporation Integrity Level: SYSTEM Description: Microsoft(C) Register Server Exit code: 3 Version: 6.1.7600.16385 (win7_rtm.090713-1255) Modules
| |||||||||||||||
| 2760 | "C:\Program Files\CSI\Virtual Observer\voacld.exe" /wait=10 | C:\Program Files\CSI\Virtual Observer\voacld.exe | InstallServices.exe | ||||||||||||
User: SYSTEM Company: CSI.Net, Inc. Integrity Level: SYSTEM Description: Virtual Observer Agent Client Login Detector Exit code: 0 Version: 3.00.0206 Modules
| |||||||||||||||
| 2768 | sc start VOACLI | C:\Windows\system32\sc.exe | — | cmd.exe | |||||||||||
User: SYSTEM Company: Microsoft Corporation Integrity Level: SYSTEM Description: A tool to aid in developing services for WindowsNT Exit code: 0 Version: 6.1.7600.16385 (win7_rtm.090713-1255) Modules
| |||||||||||||||
| 2792 | cmd /c ""C:\Program Files\CSI\Virtual Observer\InstallServices.BAT" > "C:\Program Files\CSI\Virtual Observer\InstallServices.OUT"" | C:\Windows\system32\cmd.exe | InstallServices.exe | ||||||||||||
User: SYSTEM Company: Microsoft Corporation Integrity Level: SYSTEM Description: Windows Command Processor Exit code: 3 Version: 6.1.7601.17514 (win7sp1_rtm.101119-1850) Modules
| |||||||||||||||
| 2856 | sc create VOACLI binpath= "C:\Program Files\CSI\Virtual Observer\VOACLI.EXE" displayname= "VO - Agent Client Login Service" start= "auto" type= "own" depend= "lanmanworkstation" | C:\Windows\system32\sc.exe | — | cmd.exe | |||||||||||
User: SYSTEM Company: Microsoft Corporation Integrity Level: SYSTEM Description: A tool to aid in developing services for WindowsNT Exit code: 0 Version: 6.1.7600.16385 (win7_rtm.090713-1255) Modules
| |||||||||||||||
Total events
3 176
Read events
396
Write events
2 749
Delete events
31
Modification events
| (PID) Process: | (2488) msiexec.exe | Key: | HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\SystemRestore |
| Operation: | write | Name: | SrCreateRp (Enter) |
Value: 4000000000000000485D1FE870BCD301B8090000C0090000D5070000000000000000000000000000000000000000000000000000000000000000000000000000 | |||
| (PID) Process: | (2488) msiexec.exe | Key: | HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\SPP |
| Operation: | write | Name: | SppCreate (Enter) |
Value: 4000000000000000485D1FE870BCD301B8090000C0090000D0070000000000000000000000000000000000000000000000000000000000000000000000000000 | |||
| (PID) Process: | (2488) msiexec.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SPP |
| Operation: | write | Name: | LastIndex |
Value: 47 | |||
| (PID) Process: | (2488) msiexec.exe | Key: | HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\SPP |
| Operation: | write | Name: | SppGatherWriterMetadata (Enter) |
Value: 4000000000000000E20A6EE870BCD301B8090000C0090000D3070000000000000000000000000000000000000000000000000000000000000000000000000000 | |||
| (PID) Process: | (2488) msiexec.exe | Key: | HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\VssapiPublisher |
| Operation: | write | Name: | IDENTIFY (Enter) |
Value: 40000000000000003C6D70E870BCD301B809000030080000E803000001000000000000000000000094CF5CF2D54FD44294445651110E164B0000000000000000 | |||
| (PID) Process: | (2704) vssvc.exe | Key: | HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\COM+ REGDB Writer |
| Operation: | write | Name: | IDENTIFY (Enter) |
Value: 400000000000000058BB7EE870BCD301900A000058080000E8030000010000000100000000000000000000000000000000000000000000000000000000000000 | |||
| (PID) Process: | (2704) vssvc.exe | Key: | HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\ASR Writer |
| Operation: | write | Name: | IDENTIFY (Enter) |
Value: 400000000000000058BB7EE870BCD301900A00009C0C0000E8030000010000000100000000000000000000000000000000000000000000000000000000000000 | |||
| (PID) Process: | (2704) vssvc.exe | Key: | HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\Shadow Copy Optimization Writer |
| Operation: | write | Name: | IDENTIFY (Enter) |
Value: 400000000000000058BB7EE870BCD301900A0000A00C0000E8030000010000000100000000000000000000000000000000000000000000000000000000000000 | |||
| (PID) Process: | (2704) vssvc.exe | Key: | HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\Registry Writer |
| Operation: | write | Name: | IDENTIFY (Enter) |
Value: 400000000000000058BB7EE870BCD301900A000060080000E8030000010000000100000000000000000000000000000000000000000000000000000000000000 | |||
| (PID) Process: | (2704) vssvc.exe | Key: | HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\COM+ REGDB Writer |
| Operation: | write | Name: | IDENTIFY (Leave) |
Value: 4000000000000000C04488E870BCD301900A000058080000E8030000000000000100000000000000000000000000000000000000000000000000000000000000 | |||
Executable files
45
Suspicious files
4
Text files
21
Unknown types
0
Dropped files
PID | Process | Filename | Type | |
|---|---|---|---|---|
| 2488 | msiexec.exe | C:\System Volume Information\SPP\metadata-2 | — | |
MD5:— | SHA256:— | |||
| 2488 | msiexec.exe | C:\Windows\Installer\12ecaa.msi | — | |
MD5:— | SHA256:— | |||
| 2488 | msiexec.exe | C:\Users\admin\AppData\Local\Temp\~DF85A55649B911C9F1.TMP | — | |
MD5:— | SHA256:— | |||
| 2704 | vssvc.exe | C: | — | |
MD5:— | SHA256:— | |||
| 2488 | msiexec.exe | C:\Program Files\CSI\Virtual Observer\TSCRec3.ocx | executable | |
MD5:— | SHA256:— | |||
| 2488 | msiexec.exe | C:\Windows\Installer\MSIEFC7.tmp | binary | |
MD5:— | SHA256:— | |||
| 2488 | msiexec.exe | C:\System Volume Information\SPP\snapshot-2 | binary | |
MD5:— | SHA256:— | |||
| 2488 | msiexec.exe | C:\System Volume Information\SPP\OnlineMetadataCache\{f25ccf94-4fd5-42d4-9444-5651110e164b}_OnDiskSnapshotProp | binary | |
MD5:— | SHA256:— | |||
| 2488 | msiexec.exe | C:\Program Files\CSI\Virtual Observer\voacld.exe | executable | |
MD5:— | SHA256:— | |||
| 2488 | msiexec.exe | C:\Program Files\CSI\Virtual Observer\TSCC.exe | executable | |
MD5:— | SHA256:— | |||
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
0
DNS requests
0
Threats
0
HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report