File name:

1e5ce241801ccbef1583b30d15bc5340897f02797c496f524b56412515936fca

Full analysis: https://app.any.run/tasks/1339d66f-68ee-45e9-80ae-f44e23314866
Verdict: Malicious activity
Analysis date: December 09, 2024, 15:53:49
OS: Windows 10 Professional (build: 19045, 64 bit)
Tags:
generated-doc
Indicators:
MIME: application/x-msi
File info: Composite Document File V2 Document, Little Endian, Os: Windows, Version 10.0, MSI Installer, Security: 0, Code page: 1252, Revision Number: {564632B4-D632-4965-A808-AC4D3E1DC9DD}, Number of Words: 10, Subject: Ifid Apps, Author: Grovi Tend, Name of Creating Application: Ifid Apps, Template: x64;1033, Comments: This installer database contains the logic and data required to install Ifid Apps., Title: Installation Database, Keywords: Installer, MSI, Database, Create Time/Date: Sat Dec 7 14:17:41 2024, Last Saved Time/Date: Sat Dec 7 14:17:41 2024, Last Printed: Sat Dec 7 14:17:41 2024, Number of Pages: 450
MD5:

5D5BF0697A16502AD90C1A0945859215

SHA1:

756580443533D77296238335BEF2D6553DFB8FDC

SHA256:

1E5CE241801CCBEF1583B30D15BC5340897F02797C496F524B56412515936FCA

SSDEEP:

393216:IUCV/lfl4WYP56O+X0lFe/pIrr/VjW47CYSBhJWSEj:xutfh05Y08p85jW4shWj

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Bypass execution policy to execute commands

      • powershell.exe (PID: 1512)

    • Changes powershell execution policy (Bypass)

      • msiexec.exe (PID: 6464)

  • SUSPICIOUS

    • Reads security settings of Internet Explorer

      • msiexec.exe (PID: 6464)

    • The process hide an interactive prompt from the user

      • msiexec.exe (PID: 6464)

    • Starts POWERSHELL.EXE for commands execution

      • msiexec.exe (PID: 6464)

    • The process bypasses the loading of PowerShell profile settings

      • msiexec.exe (PID: 6464)

    • The process executes Powershell scripts

      • msiexec.exe (PID: 6464)

    • Reverses array data (POWERSHELL)

      • powershell.exe (PID: 1512)

    • Process drops legitimate windows executable

      • msiexec.exe (PID: 6416)

    • The process drops C-runtime libraries

      • msiexec.exe (PID: 6416)

  • INFO

    • Reads the computer name

      • msiexec.exe (PID: 6464)
      • msiexec.exe (PID: 6416)

    • An automatically generated document

      • msiexec.exe (PID: 2972)

    • Checks supported languages

      • msiexec.exe (PID: 6416)
      • msiexec.exe (PID: 6464)
      • openvpn.exe (PID: 4596)

    • Executable content was dropped or overwritten

      • msiexec.exe (PID: 6416)

    • Reads Environment values

      • msiexec.exe (PID: 6464)

    • Create files in a temporary directory

      • msiexec.exe (PID: 6464)
      • powershell.exe (PID: 1512)

    • Checks proxy server information

      • msiexec.exe (PID: 6464)

    • Reads security settings of Internet Explorer

      • powershell.exe (PID: 1512)

    • Uses string replace method (POWERSHELL)

      • powershell.exe (PID: 1512)

    • Reads the software policy settings

      • powershell.exe (PID: 1512)

    • Reads the machine GUID from the registry

      • msiexec.exe (PID: 6464)
      • openvpn.exe (PID: 4596)

    • Creates files or folders in the user directory

      • msiexec.exe (PID: 6416)

    • Sends debugging messages

      • openvpn.exe (PID: 4596)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.msi | Microsoft Windows Installer (81.9)
.mst | Windows SDK Setup Transform Script (9.2)
.msp | Windows Installer Patch (7.6)
.msi | Microsoft Installer (100)

EXIF

FlashPix

Security: None
CodePage: Windows Latin 1 (Western European)
RevisionNumber: {564632B4-D632-4965-A808-AC4D3E1DC9DD}
Words: 10
Subject: Ifid Apps
Author: Grovi Tend
LastModifiedBy: -
Software: Ifid Apps
Template: x64;1033
Comments: This installer database contains the logic and data required to install Ifid Apps.
Title: Installation Database
Keywords: Installer, MSI, Database
CreateDate: 2024:12:07 14:17:41
ModifyDate: 2024:12:07 14:17:41
LastPrinted: 2024:12:07 14:17:41
Pages: 450
No data.
screenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
123
Monitored processes
7
Malicious processes
1
Suspicious processes
1

Behavior graph

Click at the process to see the details
start msiexec.exe no specs msiexec.exe msiexec.exe no specs powershell.exe no specs conhost.exe no specs openvpn.exe conhost.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
1512 -NoProfile -Noninteractive -ExecutionPolicy Bypass -File "C:\Users\admin\AppData\Local\Temp\pssB6A4.ps1" -propFile "C:\Users\admin\AppData\Local\Temp\msiB6A1.txt" -scriptFile "C:\Users\admin\AppData\Local\Temp\scrB6A2.ps1" -scriptArgsFile "C:\Users\admin\AppData\Local\Temp\scrB6A3.txt" -propSep " :<->: " -lineSep " <<:>> " -testPrefix "_testValue."C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe—msiexec.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows PowerShell
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\windowspowershell\v1.0\powershell.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\msvcrt.dll
c:\windows\syswow64\oleaut32.dll
2972"C:\Windows\System32\msiexec.exe" /i C:\Users\admin\AppData\Local\Temp\1e5ce241801ccbef1583b30d15bc5340897f02797c496f524b56412515936fca.msiC:\Windows\System32\msiexec.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows® installer
Exit code:
0
Version:
5.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\msiexec.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\aclayers.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
3692\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—powershell.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
4596"C:\Users\admin\AppData\Roaming\Grovi Tend\Ifid Apps\openvpn.exe"C:\Users\admin\AppData\Roaming\Grovi Tend\Ifid Apps\openvpn.exe
msiexec.exe
User:
admin
Company:
The OpenVPN Project
Integrity Level:
MEDIUM
Description:
OpenVPN Daemon
Exit code:
0
Version:
2.6.12.0
Modules
Images
c:\users\admin\appdata\roaming\grovi tend\ifid apps\openvpn.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\ws2_32.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\crypt32.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\setupapi.dll
c:\windows\system32\msvcrt.dll
5096\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—openvpn.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
6416C:\WINDOWS\system32\msiexec.exe /VC:\Windows\System32\msiexec.exe
services.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Windows® installer
Version:
5.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\msiexec.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\aclayers.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
6464C:\Windows\syswow64\MsiExec.exe -Embedding 151C410FDD54696F7047F7C521F288ECC:\Windows\SysWOW64\msiexec.exe—msiexec.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows® installer
Exit code:
0
Version:
5.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\msiexec.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\aclayers.dll
Total events
9 246
Read events
9 110
Write events
127
Delete events
9

Modification events

(PID) Process:(6416) msiexec.exeKey:HKEY_USERS\S-1-5-21-1693682860-607145093-2874071422-1001\SOFTWARE\Microsoft\RestartManager\Session0000
Operation:writeName:Owner
Value:
1019000010BC58A0524ADB01
(PID) Process:(6416) msiexec.exeKey:HKEY_USERS\S-1-5-21-1693682860-607145093-2874071422-1001\SOFTWARE\Microsoft\RestartManager\Session0000
Operation:writeName:SessionHash
Value:
8BE106B0860A8F445F57AE21FCB8161EB44912160ED28F53D47FECF338BBEEB8
(PID) Process:(6416) msiexec.exeKey:HKEY_USERS\S-1-5-21-1693682860-607145093-2874071422-1001\SOFTWARE\Microsoft\RestartManager\Session0000
Operation:writeName:Sequence
Value:
1
(PID) Process:(6416) msiexec.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Folders
Operation:writeName:C:\Users\admin\AppData\Roaming\Microsoft\Installer\
Value:
(PID) Process:(6416) msiexec.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-21-1693682860-607145093-2874071422-1001\Components\E000BAE45BED82E4488460C826B4BCAA
Operation:writeName:BF21C56FE12FCA644BE0AD5872E84C70
Value:
C:\Users\admin\AppData\Roaming\Grovi Tend\Ifid Apps\
(PID) Process:(6416) msiexec.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-21-1693682860-607145093-2874071422-1001\Components\E42C39A34CE969B479D3D8468735891E
Operation:writeName:BF21C56FE12FCA644BE0AD5872E84C70
Value:
21:\Software\Grovi Tend\Ifid Apps\Version
(PID) Process:(6416) msiexec.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-21-1693682860-607145093-2874071422-1001\Components\09DEA3894AA5B2C49A3F5236FFAD9E46
Operation:writeName:BF21C56FE12FCA644BE0AD5872E84C70
Value:
C:\Users\admin\AppData\Roaming\Grovi Tend\Ifid Apps\libssl-3-x64.dll
(PID) Process:(6416) msiexec.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-21-1693682860-607145093-2874071422-1001\Components\D22AA40CB6EB3EE4C8639F83ABC44D58
Operation:writeName:BF21C56FE12FCA644BE0AD5872E84C70
Value:
C:\Users\admin\AppData\Roaming\Grovi Tend\Ifid Apps\openvpn.exe
(PID) Process:(6416) msiexec.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-21-1693682860-607145093-2874071422-1001\Components\2F1ABDAE04A95194999734FCDCC153EC
Operation:writeName:BF21C56FE12FCA644BE0AD5872E84C70
Value:
C:\Users\admin\AppData\Roaming\Grovi Tend\Ifid Apps\VCRUNTIME140.dll
(PID) Process:(6416) msiexec.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-21-1693682860-607145093-2874071422-1001\Components\FD09DCBC63BD76D4EADD14171F0EC2A1
Operation:writeName:BF21C56FE12FCA644BE0AD5872E84C70
Value:
C:\Users\admin\AppData\Roaming\Grovi Tend\Ifid Apps\libcrypto-3-x64.dll
Executable files
43
Suspicious files
75
Text files
22
Unknown types
7

Dropped files

PID
Process
Filename
Type
6416msiexec.exeC:\Windows\Installer\1391f2.msi —
MD5:—
SHA256:—
6464msiexec.exeC:\Users\admin\AppData\Local\Temp\msiB6A1.txt —
MD5:—
SHA256:—
6464msiexec.exeC:\Users\admin\AppData\Local\Temp\scrB6A2.ps1 —
MD5:—
SHA256:—
6464msiexec.exeC:\Users\admin\AppData\Local\Temp\scrB6A3.txt —
MD5:—
SHA256:—
6464msiexec.exeC:\Users\admin\AppData\Local\Temp\pssB6A4.ps1 —
MD5:—
SHA256:—
6416msiexec.exeC:\Windows\Installer\MSI94A4.tmpexecutable
MD5:EE09D6A1BB908B42C05FD0BEEB67DFD2
SHA256:7BBF611F5E2A16439DC8CD11936F6364F6D5CC0044545C92775DA5646AFC7752
6416msiexec.exeC:\Windows\Installer\MSI960D.tmpexecutable
MD5:EE09D6A1BB908B42C05FD0BEEB67DFD2
SHA256:7BBF611F5E2A16439DC8CD11936F6364F6D5CC0044545C92775DA5646AFC7752
6416msiexec.exeC:\Windows\Installer\MSI9503.tmpexecutable
MD5:EE09D6A1BB908B42C05FD0BEEB67DFD2
SHA256:7BBF611F5E2A16439DC8CD11936F6364F6D5CC0044545C92775DA5646AFC7752
6416msiexec.exeC:\Windows\Installer\MSIB570.tmpexecutable
MD5:FFDAACB43C074A8CB9A608C612D7540B
SHA256:7484797EA4480BC71509FA28B16E607F82323E05C44F59FFA65DB3826ED1B388
6416msiexec.exeC:\Windows\Installer\MSIA1B7.tmpexecutable
MD5:EE09D6A1BB908B42C05FD0BEEB67DFD2
SHA256:7BBF611F5E2A16439DC8CD11936F6364F6D5CC0044545C92775DA5646AFC7752
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
7
TCP/UDP connections
32
DNS requests
21
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
4712
MoUsoCoreWorker.exe
GET
200
184.24.77.12:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
4712
MoUsoCoreWorker.exe
GET
200
23.35.229.160:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
—
—
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAI5PUjXAkJafLQcAAsO18o%3D
unknown
—
—
whitelisted
5872
SIHClient.exe
GET
200
23.35.229.160:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
5872
SIHClient.exe
GET
200
23.35.229.160:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
6568
backgroundTaskHost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0%3D
unknown
—
—
whitelisted
1176
svchost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
—
—
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4712
MoUsoCoreWorker.exe
184.24.77.12:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
4712
MoUsoCoreWorker.exe
23.35.229.160:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
—
—
92.123.104.64:443
www.bing.com
Akamai International B.V.
DE
whitelisted
—
—
192.229.221.95:80
ocsp.digicert.com
EDGECAST
US
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
1176
svchost.exe
20.190.159.75:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
1176
svchost.exe
192.229.221.95:80
ocsp.digicert.com
EDGECAST
US
whitelisted
—
—
23.35.238.131:443
go.microsoft.com
AKAMAI-AS
DE
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 51.104.136.2
  • 40.127.240.158
  • 20.73.194.208
whitelisted
crl.microsoft.com
  • 184.24.77.12
  • 184.24.77.35
whitelisted
www.microsoft.com
  • 23.35.229.160
whitelisted
www.bing.com
  • 92.123.104.64
  • 92.123.104.60
  • 92.123.104.36
  • 92.123.104.37
  • 92.123.104.40
  • 92.123.104.43
  • 92.123.104.59
  • 92.123.104.63
  • 92.123.104.46
whitelisted
ocsp.digicert.com
  • 192.229.221.95
whitelisted
google.com
  • 142.250.185.206
whitelisted
login.live.com
  • 20.190.159.75
  • 20.190.159.4
  • 40.126.31.71
  • 20.190.159.0
  • 20.190.159.64
  • 20.190.159.2
  • 20.190.159.73
  • 20.190.159.23
whitelisted
go.microsoft.com
  • 23.35.238.131
whitelisted
arc.msn.com
  • 20.223.35.26
whitelisted
fd.api.iris.microsoft.com
  • 20.105.99.58
whitelisted

Threats

No threats detected
Process
Message
openvpn.exe
Current Directory: C:\WINDOWS\system32 Attributes: - Directory
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
1e5ce241801ccbef1583b30d15bc5340897f02797c496f524b56412515936fca