File name:

BR9332TI.msi

Full analysis: https://app.any.run/tasks/845a0e4d-5e1f-4cc8-89c5-74c95d4d70b0
Verdict: Malicious activity
Threats:

Trojans are a group of malicious programs distinguished by their ability to masquerade as benign software. Depending on their type, trojans possess a variety of capabilities, ranging from maintaining full remote control over the victim’s machine to stealing data and files, as well as dropping other malware. At the same time, the main functionality of each trojan family can differ significantly depending on its type. The most common trojan infection chain starts with a phishing email.

Malware Trends Tracker     >>>
Analysis date: June 12, 2019, 10:17:42
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
trojan
Indicators:
MIME: application/x-msi
File info: Composite Document File V2 Document, Little Endian, Os: Windows, Version 10.0, MSI Installer, Last Printed: Wed Nov 21 14:59:58 2007, Create Time/Date: Wed Nov 21 14:59:58 2007, Last Saved Time/Date: Wed Nov 21 15:17:57 2007, Code page: 1252, Revision Number: {656E114D-D7AA-4BF0-B816-94DBA6E35121}, Number of Words: 10, Subject: Adobe Acrobat Reader, Author: Adobe Acrobat Reader, Name of Creating Application: Advanced Installer 12.2.1 build 64247, Template: ;1033, Comments: This installer database contains the logic and data required to install Adobe Acrobat Reader., Title: Installation Database, Keywords: Installer, MSI, Database, Security: 0, Number of Pages: 200
MD5:

66AC1072E51C2D98081F1EC9494E06E4

SHA1:

3EA0FAC0F3963388CA8AAC397300E547F79F915C

SHA256:

2E817F0A077C6BEB98C789A7D5B46E04D04AFC31142F8732CCCCFCBFA6E9BD53

SSDEEP:

49152:e3ZA0roSOphumnoXrbv3n+Tw2gs39SaekYkA:QAKzXX29dYkA

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Application was dropped or rewritten from another process

      • lc4578.tmp (PID: 3556)
      • J2u4C7c3S3N5G4.cmd (PID: 2128)

    • Connects to CnC server

      • MSI47A1.tmp (PID: 3420)

    • Changes the autorun value in the registry

      • J2u4C7c3S3N5G4.cmd (PID: 2128)

    • Loads dropped or rewritten executable

      • J2u4C7c3S3N5G4.cmd (PID: 2128)

    • Writes to a start menu file

      • J2u4C7c3S3N5G4.cmd (PID: 2128)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • MsiExec.exe (PID: 2604)
      • MSI47A1.tmp (PID: 3420)
      • msiexec.exe (PID: 916)
      • J2u4C7c3S3N5G4.cmd (PID: 2128)

    • Creates files in the program directory

      • MSI47A1.tmp (PID: 3420)
      • J2u4C7c3S3N5G4.cmd (PID: 2128)

    • Starts application with an unusual extension

      • MSI47A1.tmp (PID: 3420)

    • Reads Environment values

      • J2u4C7c3S3N5G4.cmd (PID: 2128)

    • Suspicious files were dropped or overwritten

      • MSI47A1.tmp (PID: 3420)
      • J2u4C7c3S3N5G4.cmd (PID: 2128)

    • Creates files in the user directory

      • J2u4C7c3S3N5G4.cmd (PID: 2128)

  • INFO

    • Application launched itself

      • msiexec.exe (PID: 916)

    • Starts application with an unusual extension

      • MsiExec.exe (PID: 2604)
      • msiexec.exe (PID: 916)

    • Application was dropped or rewritten from another process

      • MSI47A1.tmp (PID: 3420)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.msi | Microsoft Windows Installer (84.2)
.mst | Windows SDK Setup Transform Script (9.5)
.msi | Microsoft Installer (100)

EXIF

FlashPix

LastPrinted: 2007:11:21 14:59:58
CreateDate: 2007:11:21 14:59:58
ModifyDate: 2007:11:21 15:17:57
CodePage: Windows Latin 1 (Western European)
RevisionNumber: {656E114D-D7AA-4BF0-B816-94DBA6E35121}
Words: 10
Subject: Adobe Acrobat Reader
Author: Adobe Acrobat Reader
LastModifiedBy: -
Software: Advanced Installer 12.2.1 build 64247
Template: ;1033
Comments: This installer database contains the logic and data required to install Adobe Acrobat Reader.
Title: Installation Database
Keywords: Installer, MSI, Database
Security: None
Pages: 200
No data.
screenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
38
Monitored processes
6
Malicious processes
2
Suspicious processes
1

Behavior graph

Click at the process to see the details
start drop and start drop and start drop and start msiexec.exe no specs msiexec.exe msiexec.exe lc4578.tmp no specs msi47a1.tmp j2u4c7c3s3n5g4.cmd

Process information

PID
CMD
Path
Indicators
Parent process
916C:\Windows\system32\msiexec.exe /VC:\Windows\system32\msiexec.exe
services.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Windows® installer
Exit code:
0
Version:
5.0.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\msiexec.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
2128"C:\ProgramData\7E02BC731F154EE5A36B999C9293C4FE\J2u4C7c3S3N5G4.cmd" C:\ProgramData\7E02BC731F154EE5A36B999C9293C4FE\J2u4C7c3S3N5G4.cmd
MSI47A1.tmp
User:
admin
Company:
Avira Operations GmbH & Co. KG
Integrity Level:
MEDIUM
Description:
Avira
Exit code:
0
Version:
1.2.119.17994
Modules
Images
c:\programdata\7e02bc731f154ee5a36b999c9293c4fe\j2u4c7c3s3n5g4.cmd
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\shell32.dll
2604C:\Windows\system32\MsiExec.exe -Embedding D051960F8EF332646317A83CB6438171C:\Windows\system32\MsiExec.exe
msiexec.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows® installer
Exit code:
0
Version:
5.0.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\msiexec.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
3420"C:\Windows\Installer\MSI47A1.tmp"C:\Windows\Installer\MSI47A1.tmp
msiexec.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\windows\installer\msi47a1.tmp
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\ole32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
3556"C:\Users\admin\AppData\Local\Temp\lc4578.tmp"C:\Users\admin\AppData\Local\Temp\lc4578.tmp—MsiExec.exe
User:
admin
Company:
Caphyon LTD
Integrity Level:
MEDIUM
Description:
Executable that detects if running in a virtual machine
Exit code:
0
Version:
12.2.1.0
Modules
Images
c:\users\admin\appdata\local\temp\lc4578.tmp
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\ole32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
3564"C:\Windows\System32\msiexec.exe" /i "C:\Users\admin\AppData\Local\Temp\BR9332TI.msi"C:\Windows\System32\msiexec.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows® installer
Exit code:
0
Version:
5.0.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\msiexec.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
Total events
467
Read events
428
Write events
27
Delete events
12

Modification events

(PID) Process:(916) msiexec.exeKey:HKEY_USERS\S-1-5-21-1302019708-1500728564-335382590-1000\Software\Microsoft\RestartManager\Session0000
Operation:writeName:Owner
Value:
94030000F477781B0821D501
(PID) Process:(916) msiexec.exeKey:HKEY_USERS\S-1-5-21-1302019708-1500728564-335382590-1000\Software\Microsoft\RestartManager\Session0000
Operation:writeName:SessionHash
Value:
DD3127D928EE991407C3822A899A3CAAC126ECAB1C571A6295DCB17EE1AAD965
(PID) Process:(916) msiexec.exeKey:HKEY_USERS\S-1-5-21-1302019708-1500728564-335382590-1000\Software\Microsoft\RestartManager\Session0000
Operation:writeName:Sequence
Value:
1
(PID) Process:(2604) MsiExec.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\MsiExec_RASAPI32
Operation:writeName:EnableFileTracing
Value:
0
(PID) Process:(2604) MsiExec.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\MsiExec_RASAPI32
Operation:writeName:EnableConsoleTracing
Value:
0
(PID) Process:(2604) MsiExec.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\MsiExec_RASAPI32
Operation:writeName:FileTracingMask
Value:
4294901760
(PID) Process:(2604) MsiExec.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\MsiExec_RASAPI32
Operation:writeName:ConsoleTracingMask
Value:
4294901760
(PID) Process:(2604) MsiExec.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\MsiExec_RASAPI32
Operation:writeName:MaxFileSize
Value:
1048576
(PID) Process:(2604) MsiExec.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\MsiExec_RASAPI32
Operation:writeName:FileDirectory
Value:
%windir%\tracing
(PID) Process:(2604) MsiExec.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\MsiExec_RASMANCS
Operation:writeName:EnableFileTracing
Value:
0
Executable files
10
Suspicious files
0
Text files
1
Unknown types
0

Dropped files

PID
Process
Filename
Type
916msiexec.exeC:\Windows\Installer\MSI450C.tmp —
MD5:—
SHA256:—
916msiexec.exeC:\Windows\Installer\MSI46C3.tmp —
MD5:—
SHA256:—
916msiexec.exeC:\Users\admin\AppData\Local\Temp\~DF73D4F111DC073B8C.TMP —
MD5:—
SHA256:—
916msiexec.exeC:\Windows\Installer\1343d4.ipi —
MD5:—
SHA256:—
916msiexec.exeC:\Windows\Installer\MSI4751.tmp —
MD5:—
SHA256:—
916msiexec.exeC:\Config.Msi\1343d5.rbs —
MD5:—
SHA256:—
916msiexec.exeC:\Users\admin\AppData\Local\Temp\~DFBE202237FAF5AC08.TMP —
MD5:—
SHA256:—
3420MSI47A1.tmpC:\ProgramData\J2u4C7c3S3N5G4.zip —
MD5:—
SHA256:—
3420MSI47A1.tmpC:\ProgramData\7E02BC731F154EE5A36B999C9293C4FE\Avira.OE.NativeCore.dll —
MD5:—
SHA256:—
2128J2u4C7c3S3N5G4.cmdC:\ProgramData\7E02BC731F154EE5A36B999C9293C4FE\WIN —
MD5:—
SHA256:—
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
1
TCP/UDP connections
3
DNS requests
2
Threats
3

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
2128
J2u4C7c3S3N5G4.cmd
POST
200
137.116.113.155:80
http://zenansalameabreu.serveirc.com/pateta/
US
—
—
suspicious
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
—
—
172.217.16.132:80
www.google.com
Google Inc.
US
whitelisted
3420
MSI47A1.tmp
18.196.205.25:1241
—
Amazon.com, Inc.
DE
malicious
2128
J2u4C7c3S3N5G4.cmd
137.116.113.155:80
zenansalameabreu.serveirc.com
Microsoft Corporation
US
suspicious

DNS requests

Domain
IP
Reputation
www.google.com
  • 172.217.16.132
malicious
zenansalameabreu.serveirc.com
  • 137.116.113.155
unknown

Threats

PID
Process
Class
Message
3420
MSI47A1.tmp
A Network Trojan was detected
ET TROJAN [eSentire] Win32/Spy.Banker CnC Command (DOWNLOAD)
3420
MSI47A1.tmp
A Network Trojan was detected
MALWARE [PTsecurity] Trojan-Spy.Win32.Delf(Banload) response
3420
MSI47A1.tmp
A Network Trojan was detected
MALWARE [PTsecurity] Trojan-Spy.Win32.Delf(Banload) request
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
BR9332TI.msi