download:

cpextender.msi

Full analysis: https://app.any.run/tasks/74cf2f41-a469-4f19-a6ca-a586f6e121f2
Verdict: Malicious activity
Analysis date: January 08, 2020, 21:05:19
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
generated-doc
Indicators:
MIME: application/x-msi
File info: Composite Document File V2 Document, Little Endian, Os: Windows, Version 6.1, MSI Installer, Number of Characters: 0, Last Saved By: InstallShield, Number of Words: 0, Title: Installation Database, Comments: Contact: Your local administrator, Keywords: Installer,MSI,Database, Subject: Check Point SSL Network Extender, Author: CheckPoint, Security: 1, Number of Pages: 200, Name of Creating Application: InstallShield 2011 - Professional Edition 17, Last Saved Time/Date: Mon Dec 31 19:48:10 2018, Create Time/Date: Mon Dec 31 19:48:10 2018, Last Printed: Mon Dec 31 19:48:10 2018, Revision Number: {276B0AA6-BFC8-4A1D-AF49-740312764CAB}, Code page: 1252, Template: Intel;1033
MD5:

DD7DF32D8BDCBD724638B293B39B8839

SHA1:

9B1F8F83D7637A83F778676230ACDCEB34A4F09E

SHA256:

174C94875D0CFF6E4D3A1FC5BB33E3FD46A8F45D471FF7E0A2D74B2A8D27FB0C

SSDEEP:

12288:YBVRpYyNql2UUbkRnfw+1nEOvQyVco6sSd+a6wYL52DV3Lg3eH:YBV/YyNTIfH1ZvzRHSd+FzkB3cOH

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Application was dropped or rewritten from another process

      • vna_utils.exe (PID: 3948)
      • slimsvc.exe (PID: 2092)
      • vna_utils.exe (PID: 1944)
      • slimsvc.exe (PID: 1756)

    • Loads dropped or rewritten executable

      • DrvInst.exe (PID: 2660)
      • vna_utils.exe (PID: 3948)
      • vna_utils.exe (PID: 1944)

    • Registers / Runs the DLL via REGSVR32.EXE

      • MsiExec.exe (PID: 1516)

    • Starts NET.EXE for service management

      • MsiExec.exe (PID: 1516)

    • Adds new firewall rule via NETSH.EXE

      • MsiExec.exe (PID: 1516)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • msiexec.exe (PID: 1296)
      • vna_utils.exe (PID: 3948)
      • DrvInst.exe (PID: 2660)

    • Executed via COM

      • DrvInst.exe (PID: 2076)
      • DrvInst.exe (PID: 2660)

    • Executed as Windows Service

      • vssvc.exe (PID: 2916)
      • slimsvc.exe (PID: 1756)

    • Creates files in the Windows directory

      • DrvInst.exe (PID: 2076)
      • DrvInst.exe (PID: 2660)

    • Creates files in the driver directory

      • DrvInst.exe (PID: 2660)
      • DrvInst.exe (PID: 2076)

    • Removes files from Windows directory

      • DrvInst.exe (PID: 2660)
      • DrvInst.exe (PID: 2076)

    • Creates COM task schedule object

      • regsvr32.exe (PID: 1784)

    • Creates files in the program directory

      • slimsvc.exe (PID: 1756)

    • Uses NETSH.EXE for network configuration

      • MsiExec.exe (PID: 1516)

  • INFO

    • Searches for installed software

      • msiexec.exe (PID: 1296)

    • Low-level read access rights to disk partition

      • vssvc.exe (PID: 2916)

    • Creates files in the program directory

      • msiexec.exe (PID: 1296)

    • Application launched itself

      • msiexec.exe (PID: 1296)

    • Creates a software uninstall entry

      • msiexec.exe (PID: 1296)

    • Loads dropped or rewritten executable

      • MsiExec.exe (PID: 1516)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.msi | Microsoft Windows Installer (81.8)
.mst | Windows SDK Setup Transform Script (9.2)
.doc | Microsoft Word document (old ver.) (2.7)
.msi | Microsoft Installer (100)

EXIF

FlashPix

Characters: -
LastModifiedBy: InstallShield
Words: -
Title: Installation Database
Comments: Contact: Your local administrator
Keywords: Installer,MSI,Database
Subject: Check Point SSL Network Extender
Author: CheckPoint
Security: Password protected
Pages: 200
Software: InstallShield? 2011 - Professional Edition 17
ModifyDate: 2019:01:31 19:48:10
CreateDate: 2019:01:31 19:48:10
LastPrinted: 2019:01:31 19:48:10
RevisionNumber: {276B0AA6-BFC8-4A1D-AF49-740312764CAB}
CodePage: Windows Latin 1 (Western European)
Template: Intel;1033
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
58
Monitored processes
16
Malicious processes
5
Suspicious processes
2

Behavior graph

Click at the process to see the details
start msiexec.exe msiexec.exe msiexec.exe no specs vssvc.exe no specs msiexec.exe vna_utils.exe drvinst.exe no specs drvinst.exe regsvr32.exe no specs slimsvc.exe no specs net.exe no specs net1.exe no specs slimsvc.exe vna_utils.exe no specs netsh.exe no specs msiexec.exe

Process information

PID
CMD
Path
Indicators
Parent process
908net start cpextenderC:\Windows\system32\net.exe—MsiExec.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Net Command
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\net.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\netutils.dll
c:\windows\system32\browcli.dll
1048C:\Windows\system32\MsiExec.exe -Embedding D9AA89A8BB5251202FBD0EF524E9B617 CC:\Windows\system32\MsiExec.exe—msiexec.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows® installer
Exit code:
0
Version:
5.0.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\msiexec.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
1296C:\Windows\system32\msiexec.exe /VC:\Windows\system32\msiexec.exe
services.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Windows® installer
Exit code:
0
Version:
5.0.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\msiexec.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
1516C:\Windows\system32\MsiExec.exe -Embedding D0C02ED4A543B2A017DCC2478F182715 M Global\MSI0000C:\Windows\system32\MsiExec.exe
msiexec.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Windows® installer
Exit code:
0
Version:
5.0.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\msiexec.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
1756"C:\Program Files\CheckPoint\SSL Network Extender\slimsvc.exe"C:\Program Files\CheckPoint\SSL Network Extender\slimsvc.exe
services.exe
User:
SYSTEM
Company:
Check Point Software Technologies
Integrity Level:
SYSTEM
Exit code:
0
Version:
80,0,0080,74
Modules
Images
c:\program files\checkpoint\ssl network extender\slimsvc.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\ole32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
1784"C:\Windows\system32\regsvr32.exe" /s "C:\Program Files\CheckPoint\SSL Network Extender\extender.dll"C:\Windows\system32\regsvr32.exe—MsiExec.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Microsoft(C) Register Server
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\regsvr32.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
1944"C:\Program Files\CheckPoint\SSL Network Extender\vna_utils.exe" -an vna drv loadC:\Program Files\CheckPoint\SSL Network Extender\vna_utils.exe—MsiExec.exe
User:
SYSTEM
Company:
Check Point Software Technologies
Integrity Level:
SYSTEM
Exit code:
0
Version:
80,0,0070,14
Modules
Images
c:\program files\checkpoint\ssl network extender\vna_utils.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\setupapi.dll
c:\windows\system32\cfgmgr32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
2076DrvInst.exe "4" "0" "C:\Users\admin\AppData\Local\Temp\{3c8f5f76-6544-48d9-eb3a-d312b3ef736e}\netvna.inf" "0" "6c6a8e163" "00000538" "WinSta0\Default" "0000055C" "208" "c:\program files\checkpoint\ssl network extender"C:\Windows\system32\DrvInst.exe—svchost.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Driver Installation Module
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\drvinst.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\setupapi.dll
c:\windows\system32\cfgmgr32.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
2092"C:\Program Files\CheckPoint\SSL Network Extender\slimsvc.exe" installC:\Program Files\CheckPoint\SSL Network Extender\slimsvc.exe—MsiExec.exe
User:
SYSTEM
Company:
Check Point Software Technologies
Integrity Level:
SYSTEM
Exit code:
0
Version:
80,0,0080,74
Modules
Images
c:\program files\checkpoint\ssl network extender\slimsvc.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\ole32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
2380C:\Windows\system32\MsiExec.exe -Embedding 5E295927E124868CAD8586DEDCA7C012C:\Windows\system32\MsiExec.exe
msiexec.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows® installer
Exit code:
0
Version:
5.0.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\msiexec.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
Total events
1 442
Read events
716
Write events
667
Delete events
59

Modification events

(PID) Process:(2528) msiexec.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\12B\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(2528) msiexec.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\12B\52C64B7E
Operation:writeName:@%SystemRoot%\system32\p2pcollab.dll,-8042
Value:
Peer to Peer Trust
(PID) Process:(2528) msiexec.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\12B\52C64B7E
Operation:writeName:@%SystemRoot%\system32\qagentrt.dll,-10
Value:
System Health Authentication
(PID) Process:(2528) msiexec.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\12B\52C64B7E
Operation:writeName:@%SystemRoot%\system32\dnsapi.dll,-103
Value:
Domain Name System (DNS) Server Trust
(PID) Process:(2528) msiexec.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\12B\52C64B7E
Operation:writeName:@%SystemRoot%\System32\fveui.dll,-843
Value:
BitLocker Drive Encryption
(PID) Process:(2528) msiexec.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\12B\52C64B7E
Operation:writeName:@%SystemRoot%\System32\fveui.dll,-844
Value:
BitLocker Data Recovery Agent
(PID) Process:(1296) msiexec.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\SystemRestore
Operation:writeName:SrCreateRp (Enter)
Value:
400000000000000088B4C36867C6D5011005000090090000D5070000000000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(1296) msiexec.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\SPP
Operation:writeName:SppCreate (Enter)
Value:
400000000000000088B4C36867C6D5011005000090090000D0070000000000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(1296) msiexec.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SPP
Operation:writeName:LastIndex
Value:
33
(PID) Process:(1296) msiexec.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\SPP
Operation:writeName:SppGatherWriterMetadata (Enter)
Value:
4000000000000000C8FF0F6967C6D5011005000090090000D3070000000000000000000000000000000000000000000000000000000000000000000000000000
Executable files
15
Suspicious files
26
Text files
174
Unknown types
5

Dropped files

PID
Process
Filename
Type
2528msiexec.exeC:\Users\admin\AppData\Local\Temp\CabA95A.tmp —
MD5:—
SHA256:—
2528msiexec.exeC:\Users\admin\AppData\Local\Temp\TarA95B.tmp —
MD5:—
SHA256:—
2528msiexec.exeC:\Users\admin\AppData\Local\Temp\CabA96B.tmp —
MD5:—
SHA256:—
2528msiexec.exeC:\Users\admin\AppData\Local\Temp\TarA96C.tmp —
MD5:—
SHA256:—
2528msiexec.exeC:\Users\admin\AppData\Local\Temp\CabAA0A.tmp —
MD5:—
SHA256:—
2528msiexec.exeC:\Users\admin\AppData\Local\Temp\TarAA0B.tmp —
MD5:—
SHA256:—
2528msiexec.exeC:\Users\admin\AppData\Local\Temp\MSIAB92.tmp —
MD5:—
SHA256:—
1296msiexec.exeC:\System Volume Information\SPP\metadata-2 —
MD5:—
SHA256:—
1296msiexec.exeC:\Users\admin\AppData\Local\Temp\CabDA2.tmp —
MD5:—
SHA256:—
1296msiexec.exeC:\Users\admin\AppData\Local\Temp\TarDB2.tmp —
MD5:—
SHA256:—
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
1
TCP/UDP connections
1
DNS requests
1
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
2528
msiexec.exe
GET
200
205.185.216.42:80
http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
US
compressed
57.4 Kb
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
2528
msiexec.exe
205.185.216.42:80
www.download.windowsupdate.com
Highwinds Network Group, Inc.
US
whitelisted

DNS requests

Domain
IP
Reputation
www.download.windowsupdate.com
  • 205.185.216.42
  • 205.185.216.10
whitelisted

Threats

No threats detected
Process
Message
MsiExec.exe
<8 Jan 21:06:06.779> <VnaInstall> ****************************** VnaInstall started **********************************
MsiExec.exe
<8 Jan 21:06:06.779> <SystemWithoutConsoleWait> Running: "C:\Program Files\CheckPoint\SSL Network Extender\vna_utils.exe" -an vna dev install "C:\Program Files\CheckPoint\SSL Network Extender\netvna.inf" cp_vna
MsiExec.exe
<8 Jan 21:06:14.341> <VnaInstall> vna dev install (first time) status 0
MsiExec.exe
<8 Jan 21:06:14.341> <SystemWithoutConsoleWait> Running: "C:\Windows\system32\regsvr32.exe" /s "C:\Program Files\CheckPoint\SSL Network Extender\extender.dll"
MsiExec.exe
<8 Jan 21:06:14.810> <SystemWithoutConsoleWait> Running: "C:\Program Files\CheckPoint\SSL Network Extender\slimsvc.exe" install
MsiExec.exe
<8 Jan 21:06:15.247> <SystemWithoutConsoleWait> Running: net start cpextender
MsiExec.exe
<8 Jan 21:06:18.122> <SystemWithoutConsoleWait> Running: "C:\Program Files\CheckPoint\SSL Network Extender\vna_utils.exe" -an vna drv load
MsiExec.exe
<8 Jan 21:06:18.310> <SystemWithoutConsoleWait> Running: netsh advfirewall firewall add rule name = "SSL Network Extender Service" program = "C:\Program Files\CheckPoint\SSL Network Extender\slimsvc.exe" action = allow dir = in
MsiExec.exe
<8 Jan 21:06:18.810> <VnaInstall> ****************************** VnaInstall ended **********************************
MsiExec.exe
<8 Jan 21:06:18.997> <CheckReboot> CheckReboot no need for reboot
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
cpextender.msi