File name:

Microsoft_Excel.msi

Full analysis: https://app.any.run/tasks/8ecc866c-4be0-478d-9d89-064ab029ee8d
Verdict: Malicious activity
Analysis date: October 03, 2025, 17:18:43
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
generated-doc
screenconnect
rmm-tool
remote
Indicators:
MIME: application/x-msi
File info: Composite Document File V2 Document, Little Endian, Os: Windows, Version 6.2, MSI Installer, Code page: 1252, Title: Installation Database, Subject: Default, Author: ScreenConnect Software, Keywords: Default, Comments: Default, Template: Intel;1033, Revision Number: {63F222AA-0C09-8B28-5ABB-E7221BC1F823}, Create Time/Date: Wed Dec 18 21:40:44 2024, Last Saved Time/Date: Wed Dec 18 21:40:44 2024, Number of Pages: 200, Number of Words: 2, Name of Creating Application: Windows Installer XML Toolset (3.11.0.1701), Security: 2
MD5:

11DD50D77AE2C24C8331D15F6ABE97D6

SHA1:

D5B2B79DF6158F66DAEDF570E5762A2359296FD1

SHA256:

1FD040C91B03F71D5A120F3C6B696DA441D8424BA6F874991F5E7F1B014BEB65

SSDEEP:

196608:mlpHh8xBXNw0lpHhKlpHh9lpHh1lpHh3lpHhKklpHhKYylpHhKY:WB8xcIBaBVBtBLBlB6B

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • SCREENCONNECT has been detected (SURICATA)

      • ScreenConnect.ClientService.exe (PID: 8476)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • rundll32.exe (PID: 7568)

    • Reads the Windows owner or organization settings

      • msiexec.exe (PID: 3196)

    • The process creates files with name similar to system file names

      • msiexec.exe (PID: 3196)

    • Creates/Modifies COM task schedule object

      • msiexec.exe (PID: 3196)

    • Screenconnect has been detected

      • msiexec.exe (PID: 3196)
      • ScreenConnect.ClientService.exe (PID: 8476)
      • ScreenConnect.ClientService.exe (PID: 8476)

    • Executes as Windows Service

      • ScreenConnect.ClientService.exe (PID: 8476)

    • SCREENCONNECT mutex has been found

      • ScreenConnect.ClientService.exe (PID: 8476)

    • Reads security settings of Internet Explorer

      • ScreenConnect.WindowsClient.exe (PID: 8536)
      • ScreenConnect.WindowsClient.exe (PID: 8696)
      • ScreenConnect.ClientService.exe (PID: 8476)

    • Potential Corporate Privacy Violation

      • ScreenConnect.ClientService.exe (PID: 8476)

    • Connects to unusual port

      • ScreenConnect.ClientService.exe (PID: 8476)

    • Creates or modifies Windows services

      • ScreenConnect.ClientService.exe (PID: 8476)

  • INFO

    • Checks proxy server information

      • msiexec.exe (PID: 1924)
      • BackgroundTransferHost.exe (PID: 8304)
      • slui.exe (PID: 8388)

    • Reads the software policy settings

      • msiexec.exe (PID: 1924)
      • msiexec.exe (PID: 3196)
      • BackgroundTransferHost.exe (PID: 8304)

    • An automatically generated document

      • msiexec.exe (PID: 1924)

    • Reads security settings of Internet Explorer

      • msiexec.exe (PID: 1924)
      • BackgroundTransferHost.exe (PID: 9100)
      • BackgroundTransferHost.exe (PID: 8304)
      • BackgroundTransferHost.exe (PID: 4288)
      • BackgroundTransferHost.exe (PID: 9192)
      • BackgroundTransferHost.exe (PID: 8912)

    • Creates files or folders in the user directory

      • msiexec.exe (PID: 1924)
      • BackgroundTransferHost.exe (PID: 8304)

    • Reads the computer name

      • msiexec.exe (PID: 3196)
      • msiexec.exe (PID: 5256)
      • msiexec.exe (PID: 8444)
      • ScreenConnect.ClientService.exe (PID: 8476)
      • msiexec.exe (PID: 8388)
      • ScreenConnect.WindowsClient.exe (PID: 8536)
      • ScreenConnect.WindowsClient.exe (PID: 8696)

    • Executable content was dropped or overwritten

      • msiexec.exe (PID: 1924)
      • msiexec.exe (PID: 3196)

    • Checks supported languages

      • msiexec.exe (PID: 5256)
      • msiexec.exe (PID: 3196)
      • msiexec.exe (PID: 8388)
      • ScreenConnect.ClientService.exe (PID: 8476)
      • msiexec.exe (PID: 8444)
      • ScreenConnect.WindowsClient.exe (PID: 8536)
      • ScreenConnect.WindowsClient.exe (PID: 8696)

    • Create files in a temporary directory

      • rundll32.exe (PID: 7568)

    • CONNECTWISE has been detected

      • msiexec.exe (PID: 1924)
      • msiexec.exe (PID: 3196)
      • ScreenConnect.ClientService.exe (PID: 8476)
      • ScreenConnect.WindowsClient.exe (PID: 8536)
      • ScreenConnect.WindowsClient.exe (PID: 8696)

    • Reads the machine GUID from the registry

      • msiexec.exe (PID: 3196)
      • ScreenConnect.ClientService.exe (PID: 8476)
      • ScreenConnect.WindowsClient.exe (PID: 8536)
      • ScreenConnect.WindowsClient.exe (PID: 8696)

    • Manages system restore points

      • SrTasks.exe (PID: 8224)

    • SCREENCONNECT has been detected

      • msiexec.exe (PID: 3196)
      • ScreenConnect.ClientService.exe (PID: 8476)

    • Creates a software uninstall entry

      • msiexec.exe (PID: 3196)

    • Reads CPU info

      • ScreenConnect.WindowsClient.exe (PID: 8696)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.msi | Microsoft Windows Installer (98.5)
.msi | Microsoft Installer (100)

EXIF

FlashPix

CodePage: Windows Latin 1 (Western European)
Title: Installation Database
Subject: Default
Author: ScreenConnect Software
Keywords: Default
Comments: Default
Template: Intel;1033
RevisionNumber: {63F222AA-0C09-8B28-5ABB-E7221BC1F823}
CreateDate: 2024:12:18 21:40:44
ModifyDate: 2024:12:18 21:40:44
Pages: 200
Words: 2
Software: Windows Installer XML Toolset (3.11.0.1701)
Security: Read-only recommended
No data.
screenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
190
Monitored processes
18
Malicious processes
1
Suspicious processes
1

Behavior graph

Click at the process to see the details
start msiexec.exe msiexec.exe msiexec.exe no specs rundll32.exe srtasks.exe no specs conhost.exe no specs msiexec.exe no specs msiexec.exe no specs #SCREENCONNECT screenconnect.clientservice.exe screenconnect.windowsclient.exe no specs svchost.exe screenconnect.windowsclient.exe no specs backgroundtransferhost.exe no specs backgroundtransferhost.exe backgroundtransferhost.exe no specs backgroundtransferhost.exe no specs backgroundtransferhost.exe no specs slui.exe

Process information

PID
CMD
Path
Indicators
Parent process
1924"C:\Windows\System32\msiexec.exe" /i C:\Users\admin\AppData\Local\Temp\Microsoft_Excel.msiC:\Windows\System32\msiexec.exe
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows® installer
Exit code:
0
Version:
5.0.19041.1 (WinBuild.160101.0800)
2428C:\WINDOWS\system32\svchost.exe -k NetworkService -p -s DnscacheC:\Windows\System32\svchost.exe
services.exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Host Process for Windows Services
Version:
10.0.19041.1 (WinBuild.160101.0800)
3196C:\WINDOWS\system32\msiexec.exe /VC:\Windows\System32\msiexec.exe
services.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Windows® installer
Version:
5.0.19041.1 (WinBuild.160101.0800)
4288"BackgroundTransferHost.exe" -ServerName:BackgroundTransferHost.1C:\Windows\System32\BackgroundTransferHost.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Download/Upload Host
Exit code:
1
Version:
10.0.19041.3636 (WinBuild.160101.0800)
5256C:\Windows\syswow64\MsiExec.exe -Embedding 316A66C65C4DB6ABE02F15AD906BC4D8 CC:\Windows\SysWOW64\msiexec.exe—msiexec.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows® installer
Exit code:
0
Version:
5.0.19041.3636 (WinBuild.160101.0800)
7568rundll32.exe "C:\Users\admin\AppData\Local\Temp\MSI186A.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_1513718 1 ScreenConnect.InstallerActions!ScreenConnect.ClientInstallerActions.FixupServiceArgumentsC:\Windows\SysWOW64\rundll32.exe
msiexec.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows host process (Rundll32)
Exit code:
0
Version:
10.0.19041.3636 (WinBuild.160101.0800)
8224C:\WINDOWS\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:14C:\Windows\System32\SrTasks.exe—msiexec.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Microsoft® Windows System Protection background tasks.
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
8236\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—SrTasks.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
8304"BackgroundTransferHost.exe" -ServerName:BackgroundTransferHost.1C:\Windows\System32\BackgroundTransferHost.exe
svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Download/Upload Host
Exit code:
1
Version:
10.0.19041.3636 (WinBuild.160101.0800)
8388C:\Windows\syswow64\MsiExec.exe -Embedding E58EAA946776856ABAE3B1C2715AECC5C:\Windows\SysWOW64\msiexec.exe—msiexec.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows® installer
Exit code:
0
Version:
5.0.19041.3636 (WinBuild.160101.0800)
Total events
0
Read events
0
Write events
0
Delete events
0

Modification events

No data
Executable files
19
Suspicious files
30
Text files
10
Unknown types
0

Dropped files

PID
Process
Filename
Type
3196msiexec.exeC:\System Volume Information\SPP\metadata-2 —
MD5:—
SHA256:—
3196msiexec.exeC:\Windows\Installer\1743bf.msi —
MD5:—
SHA256:—
1924msiexec.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\FE17BEC2A573BC9AE36869D0274FFA19_6DA81F04C5F9EAD2CD0268808FCE61E1binary
MD5:61D90F82A2F0EDC98BF60883A590A982
SHA256:C1FA44B85833E428B10CA18485E42C34C1DBC516CB999865CF8BEC1271B97D54
1924msiexec.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\FE17BEC2A573BC9AE36869D0274FFA19_6DA81F04C5F9EAD2CD0268808FCE61E1binary
MD5:AE55914DCC4D6E261E241FEE21982A86
SHA256:6401890CBB268D4CB64F227FCC44B76A30BCB49085C04E8DBA3BB5733607AAE1
1924msiexec.exeC:\Users\admin\AppData\Local\Temp\MSI186A.tmpexecutable
MD5:4ABAD4FD1A22BC922B457C28D1E40F1A
SHA256:DB51E4B70F27D0BF28789EA3345BF693035916461D22661C26F149C5BC8891ED
7568rundll32.exeC:\Users\admin\AppData\Local\Temp\MSI186A.tmp-\Microsoft.Deployment.WindowsInstaller.dllexecutable
MD5:5EF88919012E4A3D8A1E2955DC8C8D81
SHA256:3E54286E348EBD3D70EAED8174CCA500455C3E098CDD1FCCB167BC43D93DB29D
7568rundll32.exeC:\Users\admin\AppData\Local\Temp\MSI186A.tmp-\ScreenConnect.InstallerActions.dll —
MD5:7572B9AE2ECF5946645863A828678B5A
SHA256:BE89FE3C59FD927B3B45FEBD183FDDC1D990994D4B64D689EB04A40D8964F493
7568rundll32.exeC:\Users\admin\AppData\Local\Temp\MSI186A.tmp-\Microsoft.Deployment.WindowsInstaller.Package.dllexecutable
MD5:A921A2B83B98F02D003D9139FA6BA3D8
SHA256:548C551F6EBC5D829158A1E9AD1948D301D7C921906C3D8D6B6D69925FC624A1
1924msiexec.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\248DDD9FCF61002E219645695E3FFC98_EB6660ADA54D907AB1364F711C276089binary
MD5:AB92718C82FAA98F03AF3AB3C121132F
SHA256:F0771DFAD7B37403C947588E9CE47AECFC86913F977DBD1BF3FD978334324207
1924msiexec.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\248DDD9FCF61002E219645695E3FFC98_EB6660ADA54D907AB1364F711C276089binary
MD5:4C48B49E381F68B63BE1F6AE2444DA94
SHA256:9796D3A383E66AD609FFE36395E4FAEDEA4D0FE74BA2F78BE619D43054FE8838
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
8
TCP/UDP connections
38
DNS requests
22
Threats
4

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
1924
msiexec.exe
GET
200
18.173.205.57:80
http://ocsps.ssl.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQg3SSkKA74hABkhmlBtJTz8w3hlAQU%2BWC71OPVNPa49QaAJadz20ZpqJ4CEEJLalPOx2YUHCpjsaUcQQQ%3D
unknown
—
—
whitelisted
1924
msiexec.exe
GET
200
18.173.205.57:80
http://ocsps.ssl.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSoEwb5tith0jIBy9frSyNGB1lsAAQUNr1J%2FzEs669qQP6ZwBbtuvxI3V8CEHMBvXddPk3GU5sheiw8sTc%3D
unknown
—
—
whitelisted
4620
svchost.exe
GET
200
2.17.190.73:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
4620
svchost.exe
GET
200
2.17.190.73:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
8180
backgroundTaskHost.exe
GET
200
2.17.190.73:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAI5PUjXAkJafLQcAAsO18o%3D
unknown
—
—
whitelisted
7804
backgroundTaskHost.exe
GET
200
2.17.190.73:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0%3D
unknown
—
—
whitelisted
8304
BackgroundTransferHost.exe
GET
200
2.17.190.73:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAI5PUjXAkJafLQcAAsO18o%3D
unknown
—
—
whitelisted
8044
backgroundTaskHost.exe
GET
200
2.17.190.73:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0%3D
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
3432
RUXIMICS.exe
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
6016
MoUsoCoreWorker.exe
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
5224
SearchApp.exe
92.123.104.58:443
www.bing.com
Akamai International B.V.
DE
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
1924
msiexec.exe
18.173.205.57:80
ocsps.ssl.com
—
US
whitelisted
4620
svchost.exe
20.190.159.2:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4620
svchost.exe
2.17.190.73:80
ocsp.digicert.com
AKAMAI-AS
DE
whitelisted
3464
svchost.exe
172.211.123.248:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
FR
whitelisted
8180
backgroundTaskHost.exe
92.123.104.58:443
www.bing.com
Akamai International B.V.
DE
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 4.231.128.59
  • 51.124.78.146
whitelisted
www.bing.com
  • 92.123.104.58
  • 92.123.104.52
  • 92.123.104.66
  • 92.123.104.63
  • 92.123.104.65
  • 92.123.104.53
  • 92.123.104.50
  • 92.123.104.64
  • 92.123.104.62
  • 2.16.241.201
  • 2.16.241.218
  • 2.16.241.205
whitelisted
google.com
  • 142.250.185.206
whitelisted
ocsps.ssl.com
  • 18.173.205.57
  • 18.173.205.113
  • 18.173.205.43
  • 18.173.205.76
whitelisted
login.live.com
  • 20.190.159.2
  • 20.190.159.130
  • 40.126.31.73
  • 20.190.159.64
  • 40.126.31.2
  • 40.126.31.71
  • 20.190.159.131
  • 40.126.31.3
whitelisted
ocsp.digicert.com
  • 2.17.190.73
whitelisted
client.wns.windows.com
  • 172.211.123.248
whitelisted
arc.msn.com
  • 20.199.58.43
whitelisted
fd.api.iris.microsoft.com
  • 20.223.35.26
  • 20.199.58.43
whitelisted
listen.onyxaquarius.top
  • 194.102.105.26
unknown

Threats

PID
Process
Class
Message
2428
svchost.exe
Potentially Bad Traffic
ET DNS Query to a *.top domain - Likely Hostile
2428
svchost.exe
A Network Trojan was detected
MALWARE [ANY.RUN] Suspected Domain Associated with Malware Distribution (onyxaquarius .top)
8476
ScreenConnect.ClientService.exe
Potential Corporate Privacy Violation
REMOTE [ANY.RUN] ScreenConnect Server Response
—
—
Unknown Traffic
ET USER_AGENTS Microsoft Dr Watson User-Agent (MSDW)
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
Microsoft_Excel.msi