File name: | testest.msi |
Full analysis: | https://app.any.run/tasks/b1bacd88-e0c3-44e0-b290-3306d386f676 |
Verdict: | Malicious activity |
Analysis date: | December 06, 2018, 07:52:16 |
OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
Indicators: | |
MIME: | application/x-msi |
File info: | Composite Document File V2 Document, Little Endian, Os: Windows, Version 6.1, MSI Installer, Create Time/Date: Mon Jun 21 08:00:00 1999, Name of Creating Application: Windows Installer, Security: 1, Code page: 1252, Template: Intel;1033, Number of Pages: 200, Revision Number: {C6713ABA-9A7A-43C5-9DE9-DBD4E477A9EE}, Title: BBLV Toolkit, Author: IVENT, Number of Words: 2, Last Saved Time/Date: Mon Mar 13 09:46:04 2017, Last Printed: Mon Mar 13 09:46:04 2017 |
MD5: | 2BBB072457EFDD15B9033695B7AC997A |
SHA1: | 7899CE132A1872EC6FF75D72C814DBDF8343001E |
SHA256: | 266B9672C07C9D1D15D919C8BEAA73645FFB33601C5EFD636F312085459B2C9F |
SSDEEP: | 12288:qO24xEXlQUAZKaEmTO9sD1BM6Qj1cRYztmNpGpqhLDW/b:qONUAfBNQepNpAqQ |
.msi | | | Microsoft Windows Installer (90.2) |
---|---|---|
.msp | | | Windows Installer Patch (8.4) |
.msi | | | Microsoft Installer (100) |
LastPrinted: | 2017:03:13 09:46:04 |
---|---|
ModifyDate: | 2017:03:13 09:46:04 |
Words: | 2 |
Comments: | - |
Keywords: | - |
Author: | IVENT |
Subject: | - |
Title: | BBLV Toolkit |
RevisionNumber: | {C6713ABA-9A7A-43C5-9DE9-DBD4E477A9EE} |
Pages: | 200 |
Template: | Intel;1033 |
CodePage: | Windows Latin 1 (Western European) |
Security: | Password protected |
Software: | Windows Installer |
CreateDate: | 1999:06:21 07:00:00 |
PID | CMD | Path | Indicators | Parent process |
---|---|---|---|---|
2984 | "C:\Windows\System32\msiexec.exe" /i "C:\Users\admin\AppData\Local\Temp\testest.msi" | C:\Windows\System32\msiexec.exe | — | explorer.exe |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows® installer Exit code: 0 Version: 5.0.7600.16385 (win7_rtm.090713-1255) | ||||
2576 | C:\Windows\system32\msiexec.exe /V | C:\Windows\system32\msiexec.exe | services.exe | |
User: SYSTEM Company: Microsoft Corporation Integrity Level: SYSTEM Description: Windows® installer Version: 5.0.7600.16385 (win7_rtm.090713-1255) | ||||
2272 | C:\Windows\system32\MsiExec.exe -Embedding A774AA03716ED663993185563805B63C C | C:\Windows\system32\MsiExec.exe | — | msiexec.exe |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows® installer Exit code: 0 Version: 5.0.7600.16385 (win7_rtm.090713-1255) | ||||
2724 | C:\Windows\system32\vssvc.exe | C:\Windows\system32\vssvc.exe | — | services.exe |
User: SYSTEM Company: Microsoft Corporation Integrity Level: SYSTEM Description: Microsoft® Volume Shadow Copy Service Version: 6.1.7600.16385 (win7_rtm.090713-1255) | ||||
2344 | DrvInst.exe "1" "200" "STORAGE\VolumeSnapshot\HarddiskVolumeSnapshot18" "" "" "6792c44eb" "00000000" "00000550" "00000330" | C:\Windows\system32\DrvInst.exe | — | svchost.exe |
User: SYSTEM Company: Microsoft Corporation Integrity Level: SYSTEM Description: Driver Installation Module Exit code: 0 Version: 6.1.7600.16385 (win7_rtm.090713-1255) | ||||
3916 | C:\Windows\system32\MsiExec.exe -Embedding 9B4E290051A0CE91F185158CC0031BD9 | C:\Windows\system32\MsiExec.exe | — | msiexec.exe |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows® installer Exit code: 0 Version: 5.0.7600.16385 (win7_rtm.090713-1255) | ||||
3820 | "C:\Program Files\IVENT\BBLV Toolkit\Toolkit.exe" | C:\Program Files\IVENT\BBLV Toolkit\Toolkit.exe | — | explorer.exe |
User: admin Company: IVENT Integrity Level: MEDIUM Description: applicatie Beveiligingsprogramma Exit code: 0 Version: 1.0.0.0 |
PID | Process | Filename | Type | |
---|---|---|---|---|
2984 | msiexec.exe | C:\Users\admin\AppData\Local\Temp\MSI6EC8.tmp | — | |
MD5:— | SHA256:— | |||
2984 | msiexec.exe | C:\Users\admin\AppData\Local\Temp\MSI6F36.tmp | — | |
MD5:— | SHA256:— | |||
2576 | msiexec.exe | C:\System Volume Information\SPP\metadata-2 | — | |
MD5:— | SHA256:— | |||
2576 | msiexec.exe | C:\System Volume Information\SPP\snapshot-2 | binary | |
MD5:722FA2BDDAE622565819BACFFBCE22F5 | SHA256:2C1408DCF1E68D00388D3C6DD793DE3795BA4C287A550510DF4BCE4108537099 | |||
2344 | DrvInst.exe | C:\Windows\INF\setupapi.dev.log | ini | |
MD5:184D92CF44334D0937F0C191ABB52FEA | SHA256:49D6360639B70FB68BC5D263F2F354AB98DB6882CE8A1D44385FA284E7CEF753 | |||
2344 | DrvInst.exe | C:\Windows\INF\setupapi.ev3 | binary | |
MD5:76DCC60F78B3DFF1AE3627619074F465 | SHA256:18541AC1875315C4F9EFF75050C574FAFF83717C029DAE6B366F9C6C3F0C19E0 | |||
2576 | msiexec.exe | C:\System Volume Information\SPP\OnlineMetadataCache\{ed8840f1-f072-47de-8f1b-a78511a3db25}_OnDiskSnapshotProp | binary | |
MD5:722FA2BDDAE622565819BACFFBCE22F5 | SHA256:2C1408DCF1E68D00388D3C6DD793DE3795BA4C287A550510DF4BCE4108537099 | |||
2344 | DrvInst.exe | C:\Windows\INF\setupapi.ev1 | binary | |
MD5:F2F967E541C754DAAB0E6520E6A19084 | SHA256:6E1139F3E49147A38F8436F8C5E096E4B559B924D535D8D7773148B4CC163B0B | |||
2576 | msiexec.exe | C:\Windows\Installer\MSIBB53.tmp | — | |
MD5:— | SHA256:— | |||
2576 | msiexec.exe | C:\Users\admin\AppData\Local\Temp\~DF14A42A757B45257B.TMP | — | |
MD5:— | SHA256:— |