File name:

instmsia.exe

Full analysis: https://app.any.run/tasks/a82a2805-bc19-456a-ad01-1b644d36ddc2
Verdict: Malicious activity
Analysis date: December 20, 2024, 06:57:55
OS: Windows 10 Professional (build: 19045, 64 bit)
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386, for MS Windows, MS CAB-Installer self-extracting archive, 3 sections
MD5:

43F7305C2E5DD4A8F3C5ABEB2FFE4833

SHA1:

03BDA624AB7F0D7CB9ADA41A960C35C0152F98FD

SHA256:

267304EFCC831E35927C1F25D610D36FB64121D108A6F4FF0168C53DF01E2B16

SSDEEP:

49152:Ru0LSVHASxN9aD7sOP93ZPaZRNsa95ZN5T:o0mVgSxa872av9

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Changes the autorun value in the registry

      • instmsia.exe (PID: 5040)

  • SUSPICIOUS

    • Process drops legitimate windows executable

      • instmsia.exe (PID: 5040)

    • Starts a Microsoft application from unusual location

      • instmsia.exe (PID: 1520)
      • msiinst.exe (PID: 1876)
      • instmsia.exe (PID: 5040)

    • The process creates files with name similar to system file names

      • instmsia.exe (PID: 5040)

    • Executable content was dropped or overwritten

      • instmsia.exe (PID: 5040)

  • INFO

    • The sample compiled with english language support

      • instmsia.exe (PID: 5040)

    • Create files in a temporary directory

      • instmsia.exe (PID: 5040)

    • Checks supported languages

      • instmsia.exe (PID: 5040)
      • msiinst.exe (PID: 1876)

    • Sends debugging messages

      • msiinst.exe (PID: 1876)

    • Reads the computer name

      • msiinst.exe (PID: 1876)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Microsoft Update - Self Extracting Cabinet (82.1)
.exe | Win32 Executable MS Visual C++ (generic) (7.5)
.exe | Win64 Executable (generic) (6.6)
.dll | Win32 Dynamic Link Library (generic) (1.5)
.exe | Win32 Executable (generic) (1)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2001:03:01 21:56:32+00:00
ImageFileCharacteristics: No relocs, Executable, No line numbers, No symbols, 32-bit
PEType: PE32
LinkerVersion: 7
CodeSize: 34304
InitializedDataSize: 1667072
UninitializedDataSize: -
EntryPoint: 0x5a8b
OSVersion: 5.1
ImageVersion: 5.1
SubsystemVersion: 4
Subsystem: Windows GUI
FileVersionNumber: 12.0.2600.2
ProductVersionNumber: 12.0.2600.2
FileFlagsMask: 0x003f
FileFlags: Private build
FileOS: Windows NT 32-bit
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: English (U.S.)
CharacterSet: Unicode
CompanyName: Microsoft Corporation
FileDescription: Installer for the Windows Installer
FileVersion: 2.0.2600.2
InternalName: InstMsi.exe
LegalCopyright: Copyright (c) Microsoft Corp. 2000
OriginalFileName: Msi.dll,MsiHnd.dll,MsiExec.exe
ProductName: Windows Installer
ProductVersion: 2.0.2600.2
No data.
screenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
129
Monitored processes
3
Malicious processes
1
Suspicious processes
0

Behavior graph

Click at the process to see the details
start instmsia.exe msiinst.exe instmsia.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
1520"C:\Users\admin\AppData\Local\Temp\instmsia.exe" C:\Users\admin\AppData\Local\Temp\instmsia.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Installer for the Windows Installer
Exit code:
3221226540
Version:
2.0.2600.2
Modules
Images
c:\users\admin\appdata\local\temp\instmsia.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
1876C:\Users\admin\AppData\Local\Temp\IXP000.TMP\msiinst.exe /i instmsi.msi MSIEXECREG=1 /m /qb+!C:\Users\admin\AppData\Local\Temp\IXP000.TMP\msiinst.exe
instmsia.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
MSI Self-update
Version:
5.1.2600.27 (xpclnt_qfe(rahulth).020125-2033)
Modules
Images
c:\users\admin\appdata\local\temp\ixp000.tmp\msiinst.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\acgenral.dll
5040"C:\Users\admin\AppData\Local\Temp\instmsia.exe" C:\Users\admin\AppData\Local\Temp\instmsia.exe
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Installer for the Windows Installer
Version:
2.0.2600.2
Modules
Images
c:\users\admin\appdata\local\temp\instmsia.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\acgenral.dll
Total events
38
Read events
37
Write events
1
Delete events
0

Modification events

(PID) Process:(5040) instmsia.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce
Operation:writeName:wextract_cleanup0
Value:
rundll32.exe C:\WINDOWS\system32\advpack.dll,DelNodeRunDLL32 "C:\Users\admin\AppData\Local\Temp\IXP000.TMP\"
Executable files
15
Suspicious files
1
Text files
0
Unknown types
0

Dropped files

PID
Process
Filename
Type
5040instmsia.exeC:\Users\admin\AppData\Local\Temp\IXP000.TMP\msihnd.dllexecutable
MD5:4B36D51EA5FDD261E80EE9A93E9F8645
SHA256:A0974E45507A683A3E663627BB4AE29F4B2B19239D804A62E0E346CEC82B8F33
5040instmsia.exeC:\Users\admin\AppData\Local\Temp\IXP000.TMP\msiexec.exeexecutable
MD5:7A4D01DCC76B268EB08C44D9FABA73CF
SHA256:BD73D956CB75EA184DC1DC65FA39B59B49C2F94BC26191C642995D4C41DBC986
5040instmsia.exeC:\Users\admin\AppData\Local\Temp\IXP000.TMP\msimsg.dllexecutable
MD5:687CCEB254CD60DE01CA543A8E1E20C0
SHA256:33402554C614AAC1ABBF481EFFA7F784946994FD5F660866A0AD30EC4D15C1E5
5040instmsia.exeC:\Users\admin\AppData\Local\Temp\IXP000.TMP\msisip.dllexecutable
MD5:8915718188DF7E4857B85614E2815CA5
SHA256:C245B84324BE46D85E656D1312FE89E8C0B076247171AA00C2A9C7E236EBF999
5040instmsia.exeC:\Users\admin\AppData\Local\Temp\IXP000.TMP\msimain.sdbbinary
MD5:9A7CA59803DD20AC5C6B900E8665169B
SHA256:AEEC814144D4253D3167360EC6399F542D9123E4D5878808BAC279D6436B3C8D
5040instmsia.exeC:\Users\admin\AppData\Local\Temp\IXP000.TMP\riched20.dllexecutable
MD5:AE5ABEC31518E015A9FB4EB196854291
SHA256:1C2508FB55DDC459D0327F2017471545C87420443391567094E768FB34032DA1
5040instmsia.exeC:\Users\admin\AppData\Local\Temp\IXP000.TMP\msi.dllexecutable
MD5:84CC0E992099F7886057BEE4E466F8CF
SHA256:25F0FEB0759F942E2DC7CBCB9F931E3B32DE1AA551CB54D627AE36DBA031E973
5040instmsia.exeC:\Users\admin\AppData\Local\Temp\IXP000.TMP\msiinst.exeexecutable
MD5:5E9189E28544286137EB313100835892
SHA256:A68D8931DC6DDF89CD36374F1FA5A01AACA3FB4694610CD9EF1FF62D53332515
5040instmsia.exeC:\Users\admin\AppData\Local\Temp\IXP000.TMP\imagehlp.dllexecutable
MD5:0B783914A5BF8CE566C6F7BE36E50759
SHA256:A01EA2839B8B9676631CC7D5A9E8D6D64C2CAE5CFBA8D7E74D6E9F4B0E122331
5040instmsia.exeC:\Users\admin\AppData\Local\Temp\IXP000.TMP\mspatcha.dllexecutable
MD5:61E99AA0A399D3D82DCFB162C712F658
SHA256:202366E216CF3139AE49125A1614DC07DD2068F7A13D9570E5336F7532DD5E71
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
9
TCP/UDP connections
31
DNS requests
15
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
—
—
GET
200
23.35.229.160:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
5064
SearchApp.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAI5PUjXAkJafLQcAAsO18o%3D
unknown
—
—
whitelisted
1176
svchost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
4712
MoUsoCoreWorker.exe
GET
200
23.216.77.28:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
4712
MoUsoCoreWorker.exe
GET
200
23.35.229.160:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
6776
SIHClient.exe
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
6776
SIHClient.exe
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
6432
backgroundTaskHost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAUZZSZEml49Gjh0j13P68w%3D
unknown
—
—
whitelisted
6432
backgroundTaskHost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0%3D
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
—
—
51.124.78.146:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
4712
MoUsoCoreWorker.exe
23.216.77.28:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
4712
MoUsoCoreWorker.exe
23.35.229.160:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
—
—
23.35.229.160:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
3508
svchost.exe
51.124.78.146:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
3976
svchost.exe
51.124.78.146:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
3508
svchost.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
5064
SearchApp.exe
92.123.104.46:443
www.bing.com
Akamai International B.V.
DE
whitelisted
5064
SearchApp.exe
192.229.221.95:80
ocsp.digicert.com
EDGECAST
US
whitelisted

DNS requests

Domain
IP
Reputation
crl.microsoft.com
  • 23.216.77.28
  • 23.216.77.6
whitelisted
www.microsoft.com
  • 23.35.229.160
  • 95.101.149.131
whitelisted
google.com
  • 142.250.186.46
whitelisted
settings-win.data.microsoft.com
  • 51.104.136.2
whitelisted
www.bing.com
  • 92.123.104.46
  • 92.123.104.59
  • 92.123.104.58
  • 92.123.104.61
  • 92.123.104.67
  • 92.123.104.62
  • 92.123.104.54
  • 92.123.104.66
  • 92.123.104.65
whitelisted
ocsp.digicert.com
  • 192.229.221.95
whitelisted
login.live.com
  • 20.190.159.0
  • 20.190.159.2
  • 40.126.31.69
  • 20.190.159.23
  • 40.126.31.71
  • 20.190.159.68
  • 40.126.31.73
  • 20.190.159.71
whitelisted
go.microsoft.com
  • 23.35.238.131
whitelisted
slscr.update.microsoft.com
  • 4.175.87.197
whitelisted
fe3cr.delivery.mp.microsoft.com
  • 13.85.23.206
whitelisted

Threats

No threats detected
Process
Message
msiinst.exe
MsiInst:
msiinst.exe
MsiInst:
msiinst.exe
MsiInst:
msiinst.exe
msiinst.exe
ANSI BUILD
msiinst.exe
msiinst.exe
msiinst.exe
Not running on Win9X.
msiinst.exe
ANSI version of the Windows installer is not supported on Microsoft Windows NT.
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
instmsia.exe