File name:

altinstaller.zip

Full analysis: https://app.any.run/tasks/cd7257a6-4966-4047-a553-895e18338849
Verdict: Malicious activity
Analysis date: December 07, 2023, 23:53:32
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: application/zip
File info: Zip archive data, at least v2.0 to extract
MD5:

CAF6DC57668B89BAFE51A0E65AA6AA05

SHA1:

A81475C1FF6DBCDD5D6690877DA54978D3A6D5E6

SHA256:

12C2F14F920E8378F5E4479DF718DDDD6DA35041F4C65D5CA4472D4814A148B7

SSDEEP:

196608:9VSOK9c4+Oy86Enc/JhVrEFlSbuEjNqoJjFJwQ1wDZXsjrd:DSOK9J6qkLgFobrNpRwD9XyJ

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Drops the executable file immediately after the start

      • msiexec.exe (PID: 3784)

  • SUSPICIOUS

    • Executes as Windows Service

      • VSSVC.exe (PID: 2928)

    • Process drops legitimate windows executable

      • msiexec.exe (PID: 3784)

    • The process drops C-runtime libraries

      • msiexec.exe (PID: 3784)

    • Reads the Internet Settings

      • setup.exe (PID: 2608)

  • INFO

    • Reads the computer name

      • msiexec.exe (PID: 3784)
      • wmpnscfg.exe (PID: 3680)
      • setup.exe (PID: 2608)

    • Manual execution by a user

      • wmpnscfg.exe (PID: 3680)
      • WINWORD.EXE (PID: 3736)

    • Reads the machine GUID from the registry

      • msiexec.exe (PID: 3784)
      • setup.exe (PID: 2608)

    • Checks supported languages

      • msiexec.exe (PID: 3784)
      • wmpnscfg.exe (PID: 3680)
      • setup.exe (PID: 2608)

    • Drops the executable file immediately after the start

      • WinRAR.exe (PID: 1864)

    • Create files in a temporary directory

      • msiexec.exe (PID: 3784)
      • setup.exe (PID: 2608)

    • Creates files or folders in the user directory

      • msiexec.exe (PID: 3784)

    • Creates a software uninstall entry

      • msiexec.exe (PID: 3784)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.zip | ZIP compressed archive (100)

EXIF

ZIP

ZipRequiredVersion: 20
ZipBitFlag: -
ZipCompression: Deflated
ZipModifyDate: 2023:02:20 09:31:46
ZipCRC: 0xc4adeb6a
ZipCompressedSize: 6483263
ZipUncompressedSize: 6689280
ZipFileName: AltInstaller.msi
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
49
Monitored processes
9
Malicious processes
1
Suspicious processes
0

Behavior graph

Click at the process to see the details
start winrar.exe no specs msiexec.exe no specs msiexec.exe no specs vssvc.exe no specs wmpnscfg.exe no specs setup.exe no specs msiexec.exe no specs PhotoViewer.dll no specs winword.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
1864"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\AppData\Local\Temp\altinstaller.zip"C:\Program Files\WinRAR\WinRAR.exe—explorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Exit code:
0
Version:
5.91.0
Modules
Images
c:\program files\winrar\winrar.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\comdlg32.dll
1868C:\Windows\system32\DllHost.exe /Processid:{76D0CB12-7604-4048-B83C-1005C7DDC503}C:\Windows\System32\dllhost.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
COM Surrogate
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\dllhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\ole32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
2608"C:\Users\admin\AppData\Local\Temp\Rar$EXa1864.23592\setup.exe" C:\Users\admin\AppData\Local\Temp\Rar$EXa1864.23592\setup.exe—WinRAR.exe
User:
admin
Integrity Level:
MEDIUM
Description:
Setup
Exit code:
0
Version:
16.0.31206.173 built by: D16.10
Modules
Images
c:\users\admin\appdata\local\temp\rar$exa1864.23592\setup.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\ole32.dll
2632"C:\Windows\System32\msiexec.exe" /i "C:\Users\admin\AppData\Local\Temp\Rar$EXa1864.21056\AltInstaller.msi" C:\Windows\System32\msiexec.exe—WinRAR.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows® installer
Exit code:
0
Version:
5.0.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\msiexec.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
2928C:\Windows\system32\vssvc.exeC:\Windows\System32\VSSVC.exe—services.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Microsoft® Volume Shadow Copy Service
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\vssvc.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
3680"C:\Program Files\Windows Media Player\wmpnscfg.exe"C:\Program Files\Windows Media Player\wmpnscfg.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Media Player Network Sharing Service Configuration Application
Exit code:
0
Version:
12.0.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\program files\windows media player\wmpnscfg.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
3736"C:\Program Files\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\admin\Desktop\autoeducation.rtf"C:\Program Files\Microsoft Office\Office14\WINWORD.EXE—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Word
Exit code:
0
Version:
14.0.6024.1000
Modules
Images
c:\program files\microsoft office\office14\winword.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\winsxs\x86_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.6161_none_50934f2ebcb7eb57\msvcr90.dll
c:\windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.18837_none_ec86b8d6858ec0bc\comctl32.dll
3784C:\Windows\system32\msiexec.exe /VC:\Windows\System32\msiexec.exe—services.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Windows® installer
Exit code:
0
Version:
5.0.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\msiexec.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
3916"C:\Windows\system32\msiexec.exe" -I "C:\Users\admin\AppData\Local\Temp\Rar$EXa1864.23592\AltInstaller.msi" C:\Windows\System32\msiexec.exe—setup.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows® installer
Exit code:
0
Version:
5.0.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\msiexec.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
Total events
6 974
Read events
6 700
Write events
111
Delete events
163

Modification events

(PID) Process:(1864) WinRAR.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\17F\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(1864) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:2
Value:
C:\Users\admin\Desktop\virtio_ivshmem_master_build.zip
(PID) Process:(1864) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:1
Value:
C:\Users\admin\Desktop\Win7-KB3191566-x86.zip
(PID) Process:(1864) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\Desktop\phacker.zip
(PID) Process:(1864) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(1864) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(1864) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
(PID) Process:(1864) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:mtime
Value:
100
(PID) Process:(1864) WinRAR.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
(PID) Process:(1864) WinRAR.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:IntranetName
Value:
1
Executable files
32
Suspicious files
26
Text files
6
Unknown types
0

Dropped files

PID
Process
Filename
Type
1864WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa1864.21056\AltInstaller.msi —
MD5:—
SHA256:—
3784msiexec.exeC:\System Volume Information\SPP\metadata-2 —
MD5:—
SHA256:—
3784msiexec.exeC:\Windows\Installer\216a71.msi —
MD5:—
SHA256:—
3784msiexec.exeC:\Program Files\AltServer\zlib1.dllexecutable
MD5:B3F72B6CCE47EFEFA9F5224AA668401C
SHA256:08E31FACDF08916482372DA2D4A7DDCEC40EDF8E1FAB985773ED99D4C109248A
1864WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa1864.21056\setup.exeexecutable
MD5:E3D0C2A49F23DC150348DCCC644E61B2
SHA256:D48AD2CCF063CE4606B04FFEB0468AF44EEC3FE0A42A969A51673547B22D8E58
3784msiexec.exeC:\System Volume Information\SPP\snapshot-2binary
MD5:4F480ECDD9EF5E1E2ADAEBACCCF5A31B
SHA256:CF96EAAA62F3B92E6B9A87140E8FB7008936F74930982AC847BA680DAE210071
3784msiexec.exeC:\Program Files\AltServer\vcruntime140.dllexecutable
MD5:1A84957B6E681FCA057160CD04E26B27
SHA256:9FAEAA45E8CC986AF56F28350B38238B03C01C355E9564B849604B8D690919C5
3784msiexec.exeC:\Program Files\AltServer\regex2.dllexecutable
MD5:547C43567AB8C08EB30F6C6BACB479A3
SHA256:3A71BF90E8BDDFB813B44F9CBCECF431311A7979C1DEBC976767B3E5E59031AF
3784msiexec.exeC:\Program Files\AltServer\libcrypto-1_1.dllexecutable
MD5:D5A5E2B8E937E31C881DAFD4179F5536
SHA256:2E7C6AA4DAEA6E14D3D74E01A021A33E063CF60D34632E51B4730A2C3F0D46B3
3784msiexec.exeC:\Program Files\AltServer\brotlidec.dllexecutable
MD5:25A9A1077D3C46FC2C6CB399EFC04783
SHA256:CBA318B29EB0C7854F9A6DD7EB3F86D22FA4D833395A1E631B9115EBD796CFF5
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
3
DNS requests
2
Threats
0

HTTP requests

No HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
868
svchost.exe
49.13.77.253:80
armmf.adobe.com
Hetzner Online GmbH
DE
unknown

DNS requests

Domain
IP
Reputation
armmf.adobe.com
  • 49.13.77.253
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
altinstaller.zip