File name:

скf4cqstgm5qsfr7jp2k.msi

Full analysis: https://app.any.run/tasks/7a9b30db-9b7f-490f-a989-8fe9c4f09642
Verdict: Malicious activity
Analysis date: June 27, 2022, 12:58:00
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
generated-doc
Indicators:
MIME: application/x-msi
File info: Composite Document File V2 Document, Little Endian, Os: Windows, Version 6.3, MSI Installer, Title: Installation Database, Keywords: Installer, MSI, Database, Last Printed: Fri Dec 11 11:47:44 2009, Create Time/Date: Fri Dec 11 11:47:44 2009, Last Saved Time/Date: Fri Dec 11 11:47:44 2009, Number of Pages: 200, Security: 0, Code page: 1252, Revision Number: {535E6490-309C-4BDE-8C83-07C1972D6C81}, Number of Words: 10, Subject: Adobe Reader PDF, Author: Adobe Reader PDF, Name of Creating Application: Advanced Installer 12.2.1 build 64247, Template: ;1033, Comments: This installer database contains the logic and data required to install Adobe Reader PDF.
MD5:

8304394E8BDEC3C0C0D14437FCBE2785

SHA1:

E2DA9897A55990B372CA98E30B531368C23F6E96

SHA256:

150BAC3B488270DB479D96FDED7FA91F3B044F17AC197A0C06F8E3C08C3E7587

SSDEEP:

98304:EYMAO5NyrV8fCeyPP6LzLTFpXckbaRr1GJX/0HVAQUofmQ+Hb6:eT7fCDSFpsqaRr1GJPPQUa2H

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Drops executable file immediately after starts

      • msiexec.exe (PID: 3560)

    • Loads dropped or rewritten executable

      • SearchProtocolHost.exe (PID: 3488)
      • SpotifyConverter.exe (PID: 2352)

    • Application was dropped or rewritten from another process

      • SpotifyConverter.exe (PID: 2352)

    • Loads the Task Scheduler COM API

      • SpotifyConverter.exe (PID: 2352)

  • SUSPICIOUS

    • Checks supported languages

      • msiexec.exe (PID: 3560)
      • MsiExec.exe (PID: 2036)
      • SpotifyConverter.exe (PID: 2352)

    • Reads the computer name

      • msiexec.exe (PID: 3560)
      • MsiExec.exe (PID: 2036)
      • SpotifyConverter.exe (PID: 2352)

    • Reads Windows owner or organization settings

      • msiexec.exe (PID: 3212)
      • msiexec.exe (PID: 3560)

    • Reads the Windows organization settings

      • msiexec.exe (PID: 3212)
      • msiexec.exe (PID: 3560)

    • Executable content was dropped or overwritten

      • msiexec.exe (PID: 3560)

    • Drops a file with a compile date too recent

      • msiexec.exe (PID: 3560)

  • INFO

    • Checks supported languages

      • msiexec.exe (PID: 3212)

    • Reads the computer name

      • msiexec.exe (PID: 3212)

    • Application launched itself

      • msiexec.exe (PID: 3560)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.msi | Microsoft Windows Installer (88.6)
.mst | Windows SDK Setup Transform Script (10)
.msi | Microsoft Installer (100)

EXIF

FlashPix

Comments: This installer database contains the logic and data required to install Adobe Reader PDF.
Template: ;1033
Software: Advanced Installer 12.2.1 build 64247
LastModifiedBy: -
Author: Adobe Reader PDF
Subject: Adobe Reader PDF
Words: 10
RevisionNumber: {535E6490-309C-4BDE-8C83-07C1972D6C81}
CodePage: Windows Latin 1 (Western European)
Security: None
Pages: 200
ModifyDate: 2009:12:11 11:47:44
CreateDate: 2009:12:11 11:47:44
LastPrinted: 2009:12:11 11:47:44
Keywords: Installer, MSI, Database
Title: Installation Database
No data.
screenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
37
Monitored processes
5
Malicious processes
2
Suspicious processes
1

Behavior graph

Click at the process to see the details
start drop and start msiexec.exe no specs msiexec.exe msiexec.exe no specs spotifyconverter.exe searchprotocolhost.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
2036C:\Windows\system32\MsiExec.exe -Embedding 810E515E278552D9208676B18D15068FC:\Windows\system32\MsiExec.exe—msiexec.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows® installer
Exit code:
0
Version:
5.0.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\msiexec.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
2352"C:\Users\admin\Documents\Spotify.pdf\SpotifyConverter.exe"C:\Users\admin\Documents\Spotify.pdf\SpotifyConverter.exe
msiexec.exe
User:
admin
Company:
TunesKit
Integrity Level:
MEDIUM
Description:
TunesKit Application
Exit code:
0
Version:
2, 1, 0, 700
Modules
Images
c:\windows\system32\ntdll.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\kernel32.dll
c:\users\admin\documents\spotify.pdf\spotifyconverter.exe
c:\windows\system32\ws2_32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\nsi.dll
c:\windows\system32\wldap32.dll
c:\windows\system32\crypt32.dll
3212"C:\Windows\System32\msiexec.exe" /i "C:\Users\admin\AppData\Local\Temp\скf4cqstgm5qsfr7jp2k.msi"C:\Windows\System32\msiexec.exe—Explorer.EXE
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows® installer
Exit code:
0
Version:
5.0.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\msiexec.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
3488"C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe2_ Global\UsGthrCtrlFltPipeMssGthrPipe2 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" C:\Windows\system32\SearchProtocolHost.exe—SearchIndexer.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Microsoft Windows Search Protocol Host
Exit code:
0
Version:
7.00.7601.24542 (win7sp1_ldr_escrow.191209-2211)
Modules
Images
c:\windows\system32\searchprotocolhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
3560C:\Windows\system32\msiexec.exe /VC:\Windows\system32\msiexec.exe
services.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Windows® installer
Exit code:
0
Version:
5.0.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\msiexec.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
Total events
3 211
Read events
3 146
Write events
63
Delete events
2

Modification events

(PID) Process:(3560) msiexec.exeKey:HKEY_USERS\S-1-5-21-1302019708-1500728564-335382590-1000\Software\Microsoft\RestartManager\Session0000
Operation:writeName:Owner
Value:
E80D000022397B8B258AD801
(PID) Process:(3560) msiexec.exeKey:HKEY_USERS\S-1-5-21-1302019708-1500728564-335382590-1000\Software\Microsoft\RestartManager\Session0000
Operation:writeName:SessionHash
Value:
87186884FDCDEE578B4E9A775521061FDDBE3054627F7B4FBBAC464F2F452102
(PID) Process:(3560) msiexec.exeKey:HKEY_USERS\S-1-5-21-1302019708-1500728564-335382590-1000\Software\Microsoft\RestartManager\Session0000
Operation:writeName:Sequence
Value:
1
(PID) Process:(3560) msiexec.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\InProgress
Operation:writeName:(default)
Value:
C:\Windows\Installer\104c30.ipi
(PID) Process:(3560) msiexec.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Folders
Operation:writeName:C:\Config.Msi\
Value:
(PID) Process:(3560) msiexec.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Rollback\Scripts
Operation:writeName:C:\Config.Msi\104c31.rbs
Value:
30968365
(PID) Process:(3560) msiexec.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Rollback\Scripts
Operation:writeName:C:\Config.Msi\104c31.rbsLow
Value:
(PID) Process:(3560) msiexec.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-21-1302019708-1500728564-335382590-1000\Components\4887ACFEDFBACFF46B07A2E9816759A1
Operation:writeName:A93F6BF2BDE113E46823D7368B5EABB9
Value:
C:\Users\admin\Documents\Spotify.pdf\ConvertLibrary.dll
(PID) Process:(3560) msiexec.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-21-1302019708-1500728564-335382590-1000\Components\948AAF0721E76CC4E89986D6C35E2F03
Operation:writeName:A93F6BF2BDE113E46823D7368B5EABB9
Value:
C:\Users\admin\Documents\Spotify.pdf\skin\en\about.xml
(PID) Process:(3560) msiexec.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-21-1302019708-1500728564-335382590-1000\Components\8664763B42A1CCC41AB5AE594F51D04E
Operation:writeName:A93F6BF2BDE113E46823D7368B5EABB9
Value:
C:\Users\admin\Documents\Spotify.pdf\skin\de\about.xml
Executable files
10
Suspicious files
4
Text files
67
Unknown types
2

Dropped files

PID
Process
Filename
Type
3560msiexec.exeC:\Windows\Installer\104c2e.msiexecutable
MD5:—
SHA256:—
3560msiexec.exeC:\Users\admin\AppData\Local\Temp\~DF9003740230D2753C.TMPgmc
MD5:—
SHA256:—
3560msiexec.exeC:\Users\admin\Documents\Spotify.pdf\ConvertLibrary.dllexecutable
MD5:—
SHA256:—
3560msiexec.exeC:\Windows\Installer\MSI4D96.tmpbinary
MD5:—
SHA256:—
3560msiexec.exeC:\Users\admin\Documents\Spotify.pdf\FileLinkstext
MD5:—
SHA256:—
3560msiexec.exeC:\Users\admin\Documents\Spotify.pdf\unins000.datdat
MD5:—
SHA256:—
3560msiexec.exeC:\Users\admin\Documents\Spotify.pdf\WebStream.dllexecutable
MD5:—
SHA256:—
3560msiexec.exeC:\Users\admin\Documents\Spotify.pdf\unins000.exeexecutable
MD5:—
SHA256:—
3560msiexec.exeC:\Users\admin\Documents\Spotify.pdf\WinSparkle.dllexecutable
MD5:—
SHA256:—
3560msiexec.exeC:\Users\admin\Documents\Spotify.pdf\skin\de\about.xmlxml
MD5:—
SHA256:—
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
1
DNS requests
1
Threats
0

HTTP requests

No HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
2352
SpotifyConverter.exe
5.252.177.234:443
cvcimagensoilinexxxp21.com
—
—
unknown

DNS requests

Domain
IP
Reputation
cvcimagensoilinexxxp21.com
  • 5.252.177.234
unknown

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
скf4cqstgm5qsfr7jp2k.msi