analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
File name:

BR9332TI.msi

Full analysis: https://app.any.run/tasks/845a0e4d-5e1f-4cc8-89c5-74c95d4d70b0
Verdict: Malicious activity
Threats:

Trojans are a group of malicious programs distinguished by their ability to masquerade as benign software. Depending on their type, trojans possess a variety of capabilities, ranging from maintaining full remote control over the victim’s machine to stealing data and files, as well as dropping other malware. At the same time, the main functionality of each trojan family can differ significantly depending on its type. The most common trojan infection chain starts with a phishing email.

Malware Trends Tracker     >>>
Analysis date: June 12, 2019, 10:17:42
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
trojan
Indicators:
MIME: application/x-msi
File info: Composite Document File V2 Document, Little Endian, Os: Windows, Version 10.0, MSI Installer, Last Printed: Wed Nov 21 14:59:58 2007, Create Time/Date: Wed Nov 21 14:59:58 2007, Last Saved Time/Date: Wed Nov 21 15:17:57 2007, Code page: 1252, Revision Number: {656E114D-D7AA-4BF0-B816-94DBA6E35121}, Number of Words: 10, Subject: Adobe Acrobat Reader, Author: Adobe Acrobat Reader, Name of Creating Application: Advanced Installer 12.2.1 build 64247, Template: ;1033, Comments: This installer database contains the logic and data required to install Adobe Acrobat Reader., Title: Installation Database, Keywords: Installer, MSI, Database, Security: 0, Number of Pages: 200
MD5:

66AC1072E51C2D98081F1EC9494E06E4

SHA1:

3EA0FAC0F3963388CA8AAC397300E547F79F915C

SHA256:

2E817F0A077C6BEB98C789A7D5B46E04D04AFC31142F8732CCCCFCBFA6E9BD53

SSDEEP:

49152:e3ZA0roSOphumnoXrbv3n+Tw2gs39SaekYkA:QAKzXX29dYkA

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Application was dropped or rewritten from another process

      • lc4578.tmp (PID: 3556)
      • J2u4C7c3S3N5G4.cmd (PID: 2128)

    • Connects to CnC server

      • MSI47A1.tmp (PID: 3420)

    • Loads dropped or rewritten executable

      • J2u4C7c3S3N5G4.cmd (PID: 2128)

    • Changes the autorun value in the registry

      • J2u4C7c3S3N5G4.cmd (PID: 2128)

    • Writes to a start menu file

      • J2u4C7c3S3N5G4.cmd (PID: 2128)

  • SUSPICIOUS

    • Creates files in the program directory

      • MSI47A1.tmp (PID: 3420)
      • J2u4C7c3S3N5G4.cmd (PID: 2128)

    • Executable content was dropped or overwritten

      • msiexec.exe (PID: 916)
      • MsiExec.exe (PID: 2604)
      • MSI47A1.tmp (PID: 3420)
      • J2u4C7c3S3N5G4.cmd (PID: 2128)

    • Suspicious files were dropped or overwritten

      • MSI47A1.tmp (PID: 3420)
      • J2u4C7c3S3N5G4.cmd (PID: 2128)

    • Reads Environment values

      • J2u4C7c3S3N5G4.cmd (PID: 2128)

    • Starts application with an unusual extension

      • MSI47A1.tmp (PID: 3420)

    • Creates files in the user directory

      • J2u4C7c3S3N5G4.cmd (PID: 2128)

  • INFO

    • Application was dropped or rewritten from another process

      • MSI47A1.tmp (PID: 3420)

    • Starts application with an unusual extension

      • msiexec.exe (PID: 916)
      • MsiExec.exe (PID: 2604)

    • Application launched itself

      • msiexec.exe (PID: 916)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.msi | Microsoft Windows Installer (84.2)
.mst | Windows SDK Setup Transform Script (9.5)
.msi | Microsoft Installer (100)

EXIF

FlashPix

Pages: 200
Security: None
Keywords: Installer, MSI, Database
Title: Installation Database
Comments: This installer database contains the logic and data required to install Adobe Acrobat Reader.
Template: ;1033
Software: Advanced Installer 12.2.1 build 64247
LastModifiedBy: -
Author: Adobe Acrobat Reader
Subject: Adobe Acrobat Reader
Words: 10
RevisionNumber: {656E114D-D7AA-4BF0-B816-94DBA6E35121}
CodePage: Windows Latin 1 (Western European)
ModifyDate: 2007:11:21 15:17:57
CreateDate: 2007:11:21 14:59:58
LastPrinted: 2007:11:21 14:59:58
No data.
screenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
38
Monitored processes
6
Malicious processes
2
Suspicious processes
1

Behavior graph

Click at the process to see the details
start drop and start drop and start drop and start msiexec.exe no specs msiexec.exe msiexec.exe lc4578.tmp no specs msi47a1.tmp j2u4c7c3s3n5g4.cmd

Process information

PID
CMD
Path
Indicators
Parent process
3564"C:\Windows\System32\msiexec.exe" /i "C:\Users\admin\AppData\Local\Temp\BR9332TI.msi"C:\Windows\System32\msiexec.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows® installer
Exit code:
0
Version:
5.0.7600.16385 (win7_rtm.090713-1255)
916C:\Windows\system32\msiexec.exe /VC:\Windows\system32\msiexec.exe
services.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Windows® installer
Version:
5.0.7600.16385 (win7_rtm.090713-1255)
2604C:\Windows\system32\MsiExec.exe -Embedding D051960F8EF332646317A83CB6438171C:\Windows\system32\MsiExec.exe
msiexec.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows® installer
Exit code:
0
Version:
5.0.7600.16385 (win7_rtm.090713-1255)
3556"C:\Users\admin\AppData\Local\Temp\lc4578.tmp"C:\Users\admin\AppData\Local\Temp\lc4578.tmp—MsiExec.exe
User:
admin
Company:
Caphyon LTD
Integrity Level:
MEDIUM
Description:
Executable that detects if running in a virtual machine
Exit code:
0
Version:
12.2.1.0
3420"C:\Windows\Installer\MSI47A1.tmp"C:\Windows\Installer\MSI47A1.tmp
msiexec.exe
User:
admin
Integrity Level:
MEDIUM
2128"C:\ProgramData\7E02BC731F154EE5A36B999C9293C4FE\J2u4C7c3S3N5G4.cmd" C:\ProgramData\7E02BC731F154EE5A36B999C9293C4FE\J2u4C7c3S3N5G4.cmd
MSI47A1.tmp
User:
admin
Company:
Avira Operations GmbH & Co. KG
Integrity Level:
MEDIUM
Description:
Avira
Version:
1.2.119.17994
Total events
467
Read events
428
Write events
0
Delete events
0

Modification events

No data
Executable files
10
Suspicious files
0
Text files
1
Unknown types
0

Dropped files

PID
Process
Filename
Type
916msiexec.exeC:\Windows\Installer\MSI450C.tmp —
MD5:—
SHA256:—
916msiexec.exeC:\Windows\Installer\MSI46C3.tmp —
MD5:—
SHA256:—
916msiexec.exeC:\Users\admin\AppData\Local\Temp\~DF73D4F111DC073B8C.TMP —
MD5:—
SHA256:—
916msiexec.exeC:\Windows\Installer\1343d4.ipi —
MD5:—
SHA256:—
916msiexec.exeC:\Windows\Installer\MSI4751.tmp —
MD5:—
SHA256:—
916msiexec.exeC:\Config.Msi\1343d5.rbs —
MD5:—
SHA256:—
916msiexec.exeC:\Users\admin\AppData\Local\Temp\~DFBE202237FAF5AC08.TMP —
MD5:—
SHA256:—
3420MSI47A1.tmpC:\ProgramData\J2u4C7c3S3N5G4.zip —
MD5:—
SHA256:—
3420MSI47A1.tmpC:\ProgramData\7E02BC731F154EE5A36B999C9293C4FE\Avira.OE.NativeCore.dll —
MD5:—
SHA256:—
2128J2u4C7c3S3N5G4.cmdC:\ProgramData\7E02BC731F154EE5A36B999C9293C4FE\WIN —
MD5:—
SHA256:—
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
1
TCP/UDP connections
3
DNS requests
2
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
2128
J2u4C7c3S3N5G4.cmd
POST
200
137.116.113.155:80
http://zenansalameabreu.serveirc.com/pateta/
US
—
—
suspicious
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
2128
J2u4C7c3S3N5G4.cmd
137.116.113.155:80
zenansalameabreu.serveirc.com
Microsoft Corporation
US
suspicious
3420
MSI47A1.tmp
18.196.205.25:1241
—
Amazon.com, Inc.
DE
malicious
—
—
172.217.16.132:80
www.google.com
Google Inc.
US
whitelisted

DNS requests

Domain
IP
Reputation
www.google.com
  • 172.217.16.132
whitelisted
zenansalameabreu.serveirc.com
  • 137.116.113.155
unknown

Threats

PID
Process
Class
Message
3420
MSI47A1.tmp
A Network Trojan was detected
ET TROJAN [eSentire] Win32/Spy.Banker CnC Command (DOWNLOAD)
3420
MSI47A1.tmp
A Network Trojan was detected
MALWARE [PTsecurity] Trojan-Spy.Win32.Delf(Banload) response
3420
MSI47A1.tmp
A Network Trojan was detected
MALWARE [PTsecurity] Trojan-Spy.Win32.Delf(Banload) request
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2024 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
BR9332TI.msi