File name:

19.tro

Full analysis: https://app.any.run/tasks/8082b8b4-30d9-4362-b8ca-edaa91da5664
Verdict: Malicious activity
Analysis date: February 15, 2025, 08:51:27
OS: Windows 10 Professional (build: 19045, 64 bit)
Tags:
generated-doc
Indicators:
MIME: application/x-msi
File info: Composite Document File V2 Document, Little Endian, Os: Windows, Version 6.2, MSI Installer, Code page: 1252, Title: Installation Database, Subject: Guruship, Author: Trill Aconite, Keywords: Installer, Comments: This installer database contains the logic and data required to install Guruship., Template: Intel;1033, Revision Number: {ADADF189-2EE1-467B-A7D6-6A7A77E1750E}, Create Time/Date: Fri Feb 14 17:23:00 2025, Last Saved Time/Date: Fri Feb 14 17:23:00 2025, Number of Pages: 500, Number of Words: 10, Name of Creating Application: WiX Toolset (4.0.0.0), Security: 2
MD5:

5FE7C33730BE7DDEE3A76999DBD5A4F8

SHA1:

1B1B612F205EF93AAD247DC753173C972050782C

SHA256:

2C7BD3712DC007F03388D149AE82818816E75FDF82BD1A09C3AE38636C73418F

SSDEEP:

98304:8W7sC6xP2bZx1joDiYognaMfSwXOpFZtlxfurw0f9E+VKlG+Fnm/s1Vyu6uuTt3l:KayEsB+Em5lU

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Executing a file with an untrusted certificate

      • TiVoServer.exe (PID: 6028)
      • TiVoServer.exe (PID: 4320)

  • SUSPICIOUS

    • Executes as Windows Service

      • VSSVC.exe (PID: 6644)

    • Reads the Windows owner or organization settings

      • msiexec.exe (PID: 6580)

    • Executable content was dropped or overwritten

      • TiVoServer.exe (PID: 6028)
      • cmd.exe (PID: 4804)

    • Starts itself from another location

      • TiVoServer.exe (PID: 6028)

    • Reads the date of Windows installation

      • Chromewizard_test_v2.exe (PID: 5320)

    • The executable file from the user directory is run by the CMD process

      • Chromewizard_test_v2.exe (PID: 5320)

    • Starts CMD.EXE for commands execution

      • TiVoServer.exe (PID: 4320)

  • INFO

    • The sample compiled with english language support

      • msiexec.exe (PID: 6496)
      • msiexec.exe (PID: 6580)
      • TiVoServer.exe (PID: 6028)

    • Reads the computer name

      • msiexec.exe (PID: 6580)
      • TiVoServer.exe (PID: 6028)
      • TiVoServer.exe (PID: 4320)
      • Chromewizard_test_v2.exe (PID: 5320)

    • Checks supported languages

      • msiexec.exe (PID: 6580)
      • TiVoServer.exe (PID: 6028)
      • TiVoServer.exe (PID: 4320)
      • Chromewizard_test_v2.exe (PID: 5320)

    • Manages system restore points

      • SrTasks.exe (PID: 5096)

    • Create files in a temporary directory

      • msiexec.exe (PID: 6580)
      • TiVoServer.exe (PID: 4320)

    • Executable content was dropped or overwritten

      • msiexec.exe (PID: 6580)

    • Creates a software uninstall entry

      • msiexec.exe (PID: 6580)

    • Creates files or folders in the user directory

      • TiVoServer.exe (PID: 6028)

    • Reads the machine GUID from the registry

      • Chromewizard_test_v2.exe (PID: 5320)

    • Checks proxy server information

      • Chromewizard_test_v2.exe (PID: 5320)

    • Reads the software policy settings

      • Chromewizard_test_v2.exe (PID: 5320)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.msi | Microsoft Installer (100)

EXIF

FlashPix

CodePage: Windows Latin 1 (Western European)
Title: Installation Database
Subject: Guruship
Author: Trill Aconite
Keywords: Installer
Comments: This installer database contains the logic and data required to install Guruship.
Template: Intel;1033
RevisionNumber: {ADADF189-2EE1-467B-A7D6-6A7A77E1750E}
CreateDate: 2025:02:14 17:23:00
ModifyDate: 2025:02:14 17:23:00
Pages: 500
Words: 10
Software: WiX Toolset (4.0.0.0)
Security: Read-only recommended
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
139
Monitored processes
11
Malicious processes
3
Suspicious processes
0

Behavior graph

Click at the process to see the details
start msiexec.exe no specs msiexec.exe vssvc.exe no specs srtasks.exe no specs conhost.exe no specs tivoserver.exe tivoserver.exe no specs cmd.exe conhost.exe no specs chromewizard_test_v2.exe rundll32.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
848\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
4320C:\Users\admin\AppData\Roaming\oracletask\TiVoServer.exeC:\Users\admin\AppData\Roaming\oracletask\TiVoServer.exe—TiVoServer.exe
User:
admin
Company:
TiVo Inc.
Integrity Level:
MEDIUM
Description:
TiVo Server Service Process
Exit code:
1
Version:
2.8.3
Modules
Images
c:\users\admin\appdata\roaming\oracletask\tivoserver.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\shell32.dll
4804C:\WINDOWS\SysWOW64\cmd.exeC:\Windows\SysWOW64\cmd.exe
TiVoServer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\msvcrt.dll
c:\windows\syswow64\combase.dll
5096C:\WINDOWS\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:11C:\Windows\System32\SrTasks.exe—msiexec.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Microsoft® Windows System Protection background tasks.
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\srtasks.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
5320C:\Users\admin\AppData\Local\Temp\Chromewizard_test_v2.exeC:\Users\admin\AppData\Local\Temp\Chromewizard_test_v2.exe
cmd.exe
User:
admin
Company:
Nenad Hrg (SoftwareOK.com)
Integrity Level:
MEDIUM
Description:
Q-Dir
Exit code:
0
Version:
11,4,4,0
Modules
Images
c:\users\admin\appdata\local\temp\rfyaocm
c:\users\admin\appdata\local\temp\chromewizard_test_v2.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
5536\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—SrTasks.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
6028"C:\Users\admin\AppData\Local\Temp\Joe\TiVoServer.exe"C:\Users\admin\AppData\Local\Temp\Joe\TiVoServer.exe
msiexec.exe
User:
admin
Company:
TiVo Inc.
Integrity Level:
MEDIUM
Description:
TiVo Server Service Process
Exit code:
0
Version:
2.8.3
Modules
Images
c:\users\admin\appdata\local\temp\joe\tivoserver.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\shell32.dll
6352C:\WINDOWS\System32\rundll32.exe C:\WINDOWS\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -EmbeddingC:\Windows\System32\rundll32.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows host process (Rundll32)
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\rundll32.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\shcore.dll
c:\windows\system32\imagehlp.dll
6496"C:\Windows\System32\msiexec.exe" /i C:\Users\admin\AppData\Local\Temp\19.tro.msiC:\Windows\System32\msiexec.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows® installer
Exit code:
0
Version:
5.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\msiexec.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\aclayers.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
6580C:\WINDOWS\system32\msiexec.exe /VC:\Windows\System32\msiexec.exe
services.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Windows® installer
Version:
5.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\msiexec.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\aclayers.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
Total events
3 481
Read events
3 210
Write events
253
Delete events
18

Modification events

(PID) Process:(6580) msiexec.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\SystemRestore
Operation:writeName:SrCreateRp (Enter)
Value:
4800000000000000F51D8DD3867FDB01B4190000DC190000D50700000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(6580) msiexec.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\SPP
Operation:writeName:SppGetSnapshots (Enter)
Value:
480000000000000043838FD3867FDB01B4190000DC190000D20700000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(6580) msiexec.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\SPP
Operation:writeName:SppGetSnapshots (Leave)
Value:
48000000000000006BE40DD4867FDB01B4190000DC190000D20700000100000000000000000000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(6580) msiexec.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\SPP
Operation:writeName:SppEnumGroups (Enter)
Value:
48000000000000006BE40DD4867FDB01B4190000DC190000D10700000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(6580) msiexec.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\SPP
Operation:writeName:SppEnumGroups (Leave)
Value:
480000000000000068C519D4867FDB01B4190000DC190000D10700000100000000000000010000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(6580) msiexec.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\SPP
Operation:writeName:SppCreate (Enter)
Value:
4800000000000000548F1ED4867FDB01B4190000DC190000D00700000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(6580) msiexec.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SPP
Operation:writeName:LastIndex
Value:
11
(PID) Process:(6580) msiexec.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\SPP
Operation:writeName:SppGatherWriterMetadata (Enter)
Value:
480000000000000021B7C0D4867FDB01B4190000DC190000D30700000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(6580) msiexec.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\VssapiPublisher
Operation:writeName:IDENTIFY (Enter)
Value:
48000000000000004D7EC5D4867FDB01B4190000601A0000E8030000010000000000000000000000BBC8F9B0B6C97A449C7DBED418BBE9F500000000000000000000000000000000
(PID) Process:(6644) VSSVC.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\ASR Writer
Operation:writeName:IDENTIFY (Enter)
Value:
4800000000000000E0C4D3D4867FDB01F4190000801A0000E80300000100000001000000000000000000000000000000000000000000000000000000000000000000000000000000
Executable files
19
Suspicious files
23
Text files
0
Unknown types
0

Dropped files

PID
Process
Filename
Type
6580msiexec.exeC:\System Volume Information\SPP\metadata-2 —
MD5:—
SHA256:—
6580msiexec.exeC:\Windows\Installer\13e708.msi —
MD5:—
SHA256:—
6580msiexec.exeC:\Users\admin\AppData\Local\Temp\Joe\leprosarium.mpg —
MD5:—
SHA256:—
6580msiexec.exeC:\Windows\Installer\13e70a.msi —
MD5:—
SHA256:—
6580msiexec.exeC:\System Volume Information\SPP\snapshot-2binary
MD5:D69E33260B1856A90775690FC0B2D236
SHA256:3A9E3DDA998DA8393855C8B950F15419A3534DFFBCF8CDB89B7AC707DFECC9BD
6580msiexec.exeC:\Windows\Installer\inprogressinstallinfo.ipibinary
MD5:A9D04FAC9ADC0B7BF07627CAABBE49E4
SHA256:BA2C40B6318C66AEC41A6D929058C660E1C015D9A6A6B3FD2904E438900DB0D1
6580msiexec.exeC:\Windows\Temp\~DF0D5BD898A71ABF79.TMPbinary
MD5:BF619EAC0CDF3F68D496EA9344137E8B
SHA256:076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
6580msiexec.exeC:\Windows\Temp\~DFC448B424490F7C1E.TMPbinary
MD5:A9D04FAC9ADC0B7BF07627CAABBE49E4
SHA256:BA2C40B6318C66AEC41A6D929058C660E1C015D9A6A6B3FD2904E438900DB0D1
6580msiexec.exeC:\Users\admin\AppData\Local\Temp\Joe\CC3260MT.dllexecutable
MD5:1D9AD5040C5A901108CA0328AFF82FC3
SHA256:BBD201530224B8AE7D1EB74DE8DBC5C58CF43139468C5513E34B03C9AC00D284
6580msiexec.exeC:\Users\admin\AppData\Local\Temp\Joe\MindClient.dllexecutable
MD5:C058B36FB6B007C2920604229B1FA0A3
SHA256:37CC3EBFF3B7B7E55E8A8CC8785449152C6B119D25BACC6671B089DCA7998CA2
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
5
TCP/UDP connections
32
DNS requests
16
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
5064
SearchApp.exe
GET
200
184.30.131.245:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAI5PUjXAkJafLQcAAsO18o%3D
unknown
—
—
whitelisted
—
—
GET
200
184.30.131.245:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
—
—
GET
200
2.16.253.202:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
6388
SIHClient.exe
GET
200
2.16.253.202:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
6876
backgroundTaskHost.exe
GET
200
184.30.131.245:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAUZZSZEml49Gjh0j13P68w%3D
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
—
—
4.231.128.59:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
5064
SearchApp.exe
2.16.204.157:443
www.bing.com
Akamai International B.V.
DE
whitelisted
1176
svchost.exe
20.190.160.2:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
1176
svchost.exe
184.30.131.245:80
ocsp.digicert.com
AKAMAI-AS
US
whitelisted
1076
svchost.exe
23.218.210.69:443
go.microsoft.com
AKAMAI-AS
DE
whitelisted
5064
SearchApp.exe
184.30.131.245:80
ocsp.digicert.com
AKAMAI-AS
US
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
6388
SIHClient.exe
4.245.163.56:443
slscr.update.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
6388
SIHClient.exe
2.16.253.202:80
www.microsoft.com
Akamai International B.V.
NL
whitelisted

DNS requests

Domain
IP
Reputation
www.bing.com
  • 2.16.204.157
  • 2.16.204.151
  • 2.16.204.139
  • 2.16.204.155
  • 2.16.204.161
  • 2.16.204.138
  • 2.16.204.135
  • 2.16.204.146
whitelisted
login.live.com
  • 20.190.160.2
  • 40.126.32.72
  • 40.126.32.138
  • 20.190.160.22
  • 20.190.160.66
  • 40.126.32.136
  • 20.190.160.14
  • 20.190.160.64
whitelisted
ocsp.digicert.com
  • 184.30.131.245
whitelisted
go.microsoft.com
  • 23.218.210.69
whitelisted
slscr.update.microsoft.com
  • 4.245.163.56
whitelisted
www.microsoft.com
  • 2.16.253.202
whitelisted
fe3cr.delivery.mp.microsoft.com
  • 52.165.164.15
whitelisted
settings-win.data.microsoft.com
  • 20.73.194.208
whitelisted
arc.msn.com
  • 20.105.99.58
whitelisted
fd.api.iris.microsoft.com
  • 20.103.156.88
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
19.tro