File name:

0fc59838280a5d1ee9fa531ed578473b4039d7a8aef9fa047c08a32bc18c7b04.msi

Full analysis: https://app.any.run/tasks/25b6868c-893b-4db4-9e85-914e4fbdec7b
Verdict: Malicious activity
Analysis date: May 14, 2024, 14:27:29
OS: Windows 10 Professional (build: 19045, 64 bit)
Tags:
generated-doc
Indicators:
MIME: application/x-msi
File info: Composite Document File V2 Document, Little Endian, Os: Windows, Version 10.0, MSI Installer, Security: 0, Code page: 1252, Revision Number: {29544570-ABF0-4028-B5DF-FD879341E8AC}, Number of Words: 10, Subject: AppQue, Author: Vuis Queue, Name of Creating Application: AppQue, Template: ;1033, Comments: This installer database contains the logic and data required to install AppQue., Title: Installation Database, Keywords: Installer, MSI, Database, Create Time/Date: Mon May 13 11:40:57 2024, Last Saved Time/Date: Mon May 13 11:40:57 2024, Last Printed: Mon May 13 11:40:57 2024, Number of Pages: 450
MD5:

2BC508FD91BF49C2F29575BB0D017289

SHA1:

801C42782CF13DFDAC63A4E6ED09F3F4C190B3DB

SHA256:

0FC59838280A5D1EE9FA531ED578473B4039D7A8AEF9FA047C08A32BC18C7B04

SSDEEP:

393216:gzmJYfj8l6aslEI1TKJu2y4sHpeFeB1mo:FIj8l6qoEPsMS1

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Drops the executable file immediately after the start

      • msiexec.exe (PID: 6736)
      • msiexec.exe (PID: 7044)

    • Changes powershell execution policy (Bypass)

      • msiexec.exe (PID: 7156)

    • Bypass execution policy to execute commands

      • powershell.exe (PID: 4924)

  • SUSPICIOUS

    • Reads the Windows owner or organization settings

      • msiexec.exe (PID: 7044)

    • Checks Windows Trust Settings

      • msiexec.exe (PID: 7044)

    • Starts POWERSHELL.EXE for commands execution

      • msiexec.exe (PID: 7156)

    • The process bypasses the loading of PowerShell profile settings

      • msiexec.exe (PID: 7156)

    • The process hide an interactive prompt from the user

      • msiexec.exe (PID: 7156)

    • Unusual connection from system programs

      • powershell.exe (PID: 4924)

    • The process executes Powershell scripts

      • msiexec.exe (PID: 7156)

  • INFO

    • Reads security settings of Internet Explorer

      • msiexec.exe (PID: 6736)
      • powershell.exe (PID: 4924)

    • Creates files or folders in the user directory

      • msiexec.exe (PID: 6736)
      • msiexec.exe (PID: 7044)

    • Reads the computer name

      • msiexec.exe (PID: 7044)
      • msiexec.exe (PID: 7156)

    • Reads the machine GUID from the registry

      • msiexec.exe (PID: 7044)

    • Checks proxy server information

      • msiexec.exe (PID: 6736)
      • powershell.exe (PID: 4924)

    • Checks supported languages

      • msiexec.exe (PID: 7156)
      • msiexec.exe (PID: 7044)

    • Reads the software policy settings

      • msiexec.exe (PID: 7044)
      • powershell.exe (PID: 4924)
      • slui.exe (PID: 6536)
      • msiexec.exe (PID: 6736)

    • Executable content was dropped or overwritten

      • msiexec.exe (PID: 7044)

    • Reads Environment values

      • msiexec.exe (PID: 7156)

    • Create files in a temporary directory

      • msiexec.exe (PID: 7156)
      • powershell.exe (PID: 4924)

    • Uses string replace method (POWERSHELL)

      • powershell.exe (PID: 4924)

    • Creates a software uninstall entry

      • msiexec.exe (PID: 7044)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.msi | Microsoft Windows Installer (81.9)
.mst | Windows SDK Setup Transform Script (9.2)
.msp | Windows Installer Patch (7.6)
.msi | Microsoft Installer (100)

EXIF

FlashPix

Security: None
CodePage: Windows Latin 1 (Western European)
RevisionNumber: {29544570-ABF0-4028-B5DF-FD879341E8AC}
Words: 10
Subject: AppQue
Author: Vuis Queue
LastModifiedBy: -
Software: AppQue
Template: ;1033
Comments: This installer database contains the logic and data required to install AppQue.
Title: Installation Database
Keywords: Installer, MSI, Database
CreateDate: 2024:05:13 11:40:57
ModifyDate: 2024:05:13 11:40:57
LastPrinted: 2024:05:13 11:40:57
Pages: 450
No data.
screenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
131
Monitored processes
9
Malicious processes
2
Suspicious processes
2

Behavior graph

Click at the process to see the details
start msiexec.exe msiexec.exe msiexec.exe no specs powershell.exe conhost.exe no specs sppextcomobj.exe no specs slui.exe slui.exe no specs filecoauth.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
1704\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—powershell.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
3652C:\WINDOWS\system32\SppExtComObj.exe -EmbeddingC:\Windows\System32\SppExtComObj.Exe—svchost.exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
KMS Connection Broker
Version:
10.0.19041.3996 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\sppextcomobj.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\oleaut32.dll
4924 -NoProfile -Noninteractive -ExecutionPolicy Bypass -File "C:\Users\admin\AppData\Local\Temp\pss58DE.ps1" -propFile "C:\Users\admin\AppData\Local\Temp\msi58CB.txt" -scriptFile "C:\Users\admin\AppData\Local\Temp\scr58CC.ps1" -scriptArgsFile "C:\Users\admin\AppData\Local\Temp\scr58CD.txt" -propSep " :<->: " -lineSep " <<:>> " -testPrefix "_testValue."C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
msiexec.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows PowerShell
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\windowspowershell\v1.0\powershell.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\msvcrt.dll
c:\windows\syswow64\oleaut32.dll
6036C:\Users\admin\AppData\Local\Microsoft\OneDrive\19.043.0304.0013\FileCoAuth.exe -EmbeddingC:\Users\admin\AppData\Local\Microsoft\OneDrive\19.043.0304.0013\FileCoAuth.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft OneDriveFile Co-Authoring Executable
Exit code:
0
Version:
19.043.0304.0013
Modules
Images
c:\users\admin\appdata\local\microsoft\onedrive\19.043.0304.0013\filecoauth.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\user32.dll
c:\windows\syswow64\win32u.dll
6252C:\WINDOWS\System32\slui.exe -EmbeddingC:\Windows\System32\slui.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Activation Client
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
6536"C:\WINDOWS\System32\SLUI.exe" RuleId=3482d82e-ca2c-4e1f-8864-da0267b484b2;Action=AutoActivate;AppId=55c92734-d682-4d71-983e-d6ec3f16059f;SkuId=4de7cb65-cdf1-4de9-8ae8-e3cce27b9f2c;NotificationInterval=1440;Trigger=TimerEventC:\Windows\System32\slui.exe
SppExtComObj.Exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Windows Activation Client
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
6736"C:\Windows\System32\msiexec.exe" /i C:\Users\admin\AppData\Local\Temp\0fc59838280a5d1ee9fa531ed578473b4039d7a8aef9fa047c08a32bc18c7b04.msiC:\Windows\System32\msiexec.exe
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows® installer
Exit code:
0
Version:
5.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\msiexec.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\aclayers.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
7044C:\WINDOWS\system32\msiexec.exe /VC:\Windows\System32\msiexec.exe
services.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Windows® installer
Version:
5.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\msiexec.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\aclayers.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
7156C:\Windows\syswow64\MsiExec.exe -Embedding A28006C157500941A281CF4FC16780BCC:\Windows\SysWOW64\msiexec.exe—msiexec.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows® installer
Exit code:
0
Version:
5.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\msiexec.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\aclayers.dll
Total events
16 853
Read events
16 689
Write events
155
Delete events
9

Modification events

(PID) Process:(7044) msiexec.exeKey:HKEY_USERS\S-1-5-21-1693682860-607145093-2874071422-1001\SOFTWARE\Microsoft\RestartManager\Session0000
Operation:writeName:Owner
Value:
841B00009C79ECE70AA6DA01
(PID) Process:(7044) msiexec.exeKey:HKEY_USERS\S-1-5-21-1693682860-607145093-2874071422-1001\SOFTWARE\Microsoft\RestartManager\Session0000
Operation:writeName:SessionHash
Value:
C7539A95CCB988DC86DC8D35578CDE58E14516C3914D57DDC2347BD2831F00A1
(PID) Process:(7044) msiexec.exeKey:HKEY_USERS\S-1-5-21-1693682860-607145093-2874071422-1001\SOFTWARE\Microsoft\RestartManager\Session0000
Operation:writeName:Sequence
Value:
1
(PID) Process:(4924) powershell.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing
Operation:writeName:EnableConsoleTracing
Value:
0
(PID) Process:(4924) powershell.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\powershell_RASAPI32
Operation:writeName:EnableFileTracing
Value:
0
(PID) Process:(4924) powershell.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\powershell_RASAPI32
Operation:writeName:EnableAutoFileTracing
Value:
0
(PID) Process:(4924) powershell.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\powershell_RASAPI32
Operation:writeName:EnableConsoleTracing
Value:
0
(PID) Process:(4924) powershell.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\powershell_RASAPI32
Operation:writeName:FileTracingMask
Value:
(PID) Process:(4924) powershell.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\powershell_RASAPI32
Operation:writeName:ConsoleTracingMask
Value:
(PID) Process:(4924) powershell.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\powershell_RASAPI32
Operation:writeName:MaxFileSize
Value:
1048576
Executable files
48
Suspicious files
21
Text files
24
Unknown types
1

Dropped files

PID
Process
Filename
Type
7044msiexec.exeC:\WINDOWS\Installer\11492b.msi —
MD5:—
SHA256:—
7156msiexec.exeC:\Users\admin\AppData\Local\Temp\msi58CB.txt —
MD5:—
SHA256:—
7156msiexec.exeC:\Users\admin\AppData\Local\Temp\scr58CC.ps1 —
MD5:—
SHA256:—
7156msiexec.exeC:\Users\admin\AppData\Local\Temp\scr58CD.txt —
MD5:—
SHA256:—
7156msiexec.exeC:\Users\admin\AppData\Local\Temp\pss58DE.ps1 —
MD5:—
SHA256:—
7044msiexec.exeC:\WINDOWS\Installer\inprogressinstallinfo.ipi —
MD5:—
SHA256:—
6736msiexec.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\9CB4373A4252DE8D2212929836304EC5_1AB74AA2E3A56E1B8AD8D3FEC287554Ebinary
MD5:91F5309150A22FD10A2BD8218A2E4F49
SHA256:8C87309D43F58934D7FCD1D3885EAAB06DD8247006C9B2FC8355F4B73D9740A6
7044msiexec.exeC:\WINDOWS\Installer\MSI566D.tmpexecutable
MD5:B158D8D605571EA47A238DF5AB43DFAA
SHA256:CA763693CC25D316F14A9EBAD80EBF00590329550C45ADB7E5205486533C2504
6736msiexec.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\357F04AD41BCF5FE18FCB69F60C6680F_E049417E5C2A0ECD64032982D0A31504binary
MD5:835B88E16D29B8419547BDBE6D7532CD
SHA256:D9D9C5075D60DC7679A5FB8178248AE1E7EB8B3494EFEFEC9B628AB89F5229D5
6736msiexec.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\357F04AD41BCF5FE18FCB69F60C6680F_E049417E5C2A0ECD64032982D0A31504binary
MD5:ABD48D133382CA01E1C076B4E1A2C0F2
SHA256:0932A9D12F73EE1E63118C8226BCF55BA6CA93E3FBAF8A340E70C8311416298F
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
10
TCP/UDP connections
48
DNS requests
20
Threats
1

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
5632
svchost.exe
GET
200
2.19.217.218:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
unknown
6736
msiexec.exe
GET
200
104.18.20.226:80
http://ocsp.globalsign.com/codesigningrootr45/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQVFZP5vqhCrtRN5SWf40Rn6NM1IAQUHwC%2FRoAK%2FHg5t6W0Q9lWULvOljsCEHe9DgW3WQu2HUdhUx4%2Fde0%3D
unknown
—
—
unknown
6736
msiexec.exe
GET
200
104.18.20.226:80
http://ocsp.globalsign.com/gsgccr45evcodesignca2020/ME0wSzBJMEcwRTAJBgUrDgMCGgUABBQaCbVYh07WONuW4e63Ydlu4AlbDAQUJZ3Q%2FFkJhmPF7POxEztXHAOSNhECDF8azPlNEeplzc9RQQ%3D%3D
unknown
—
—
unknown
5940
svchost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
unknown
6872
backgroundTaskHost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEApDqVCbATUviZV57HIIulA%3D
unknown
—
—
unknown
4924
powershell.exe
GET
301
188.114.97.3:80
http://stand-dog.com/getLicenseInfo.php?need=lic&timestamp=581
unknown
—
—
unknown
6452
SIHClient.exe
GET
200
2.19.217.218:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
unknown
6452
SIHClient.exe
GET
200
2.19.217.218:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
unknown
2908
OfficeClickToRun.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAUZZSZEml49Gjh0j13P68w%3D
unknown
—
—
unknown
5632
svchost.exe
GET
200
23.48.23.156:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
unknown
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
unknown
—
—
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
unknown
1120
RUXIMICS.exe
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
unknown
5140
MoUsoCoreWorker.exe
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
unknown
4
System
192.168.100.255:138
—
—
—
unknown
—
—
239.255.255.250:1900
—
—
—
unknown
5632
svchost.exe
23.48.23.156:80
crl.microsoft.com
Akamai International B.V.
DE
unknown
5632
svchost.exe
2.19.217.218:80
www.microsoft.com
Akamai International B.V.
NL
unknown
6736
msiexec.exe
104.18.20.226:80
ocsp.globalsign.com
CLOUDFLARENET
—
shared
5940
svchost.exe
40.126.32.138:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 51.124.78.146
whitelisted
crl.microsoft.com
  • 23.48.23.156
  • 23.48.23.143
whitelisted
www.microsoft.com
  • 2.19.217.218
whitelisted
ocsp.globalsign.com
  • 104.18.20.226
  • 104.18.21.226
whitelisted
login.live.com
  • 40.126.32.138
  • 20.190.160.20
  • 40.126.32.76
  • 20.190.160.14
  • 40.126.32.68
  • 40.126.32.140
  • 20.190.160.17
  • 40.126.32.133
whitelisted
go.microsoft.com
  • 23.35.238.131
whitelisted
client.wns.windows.com
  • 40.115.3.253
whitelisted
www.bing.com
  • 95.100.146.19
  • 95.100.146.10
  • 95.100.146.8
  • 95.100.146.16
  • 95.100.146.33
  • 95.100.146.27
  • 95.100.146.25
  • 95.100.146.34
  • 95.100.146.40
whitelisted
arc.msn.com
  • 20.103.156.88
whitelisted
stand-dog.com
  • 188.114.97.3
  • 188.114.96.3
unknown

Threats

PID
Process
Class
Message
4924
powershell.exe
Not Suspicious Traffic
ET INFO Windows Powershell User-Agent Usage
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
0fc59838280a5d1ee9fa531ed578473b4039d7a8aef9fa047c08a32bc18c7b04.msi