File name: | ale_setup_free.msi |
Full analysis: | https://app.any.run/tasks/4825e476-1e0e-40a6-82be-b94bb43da9ac |
Verdict: | Malicious activity |
Analysis date: | April 23, 2019, 08:59:50 |
OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
Tags: | |
Indicators: | |
MIME: | application/x-msi |
File info: | Composite Document File V2 Document, Little Endian, Os: Windows, Version 6.1, MSI Installer, Code page: 1252, Title: Installation Database, Subject: Quickly identifies the reason for an account lockout without doing the routine work., Author: Netwrix Corporation, Keywords: Installer, Comments: Netwrix is a registered trademark of Netwrix Corporation, Template: Intel;1033, Revision Number: {B39F8756-9904-4C26-9B2D-E874DC266829}, Create Time/Date: Mon Jun 16 11:09:00 2014, Last Saved Time/Date: Mon Jun 16 11:09:00 2014, Number of Pages: 200, Number of Words: 2, Name of Creating Application: Windows Installer XML (3.5.2415.0), Security: 2 |
MD5: | 3E5EC11F4533D6076EF57652FF1C2EA1 |
SHA1: | 68679EB8CD552C1792A5776FCE39B88E13AC113F |
SHA256: | 3076C2B913CCEAF654EB655C7FE8921BB1EA1A8840DADFC744CDAB4A3F17B9D5 |
SSDEEP: | 98304:8vuZPFv77CmvfaZSIA1TbNlXPEgDDeVRokN6LiU6+HEnXxMaZPdqlJLD7tet8t:muHrvf6MvlOohiUInXxMaZqLDl |
.msi | | | Microsoft Windows Installer (98.5) |
---|---|---|
.msi | | | Microsoft Installer (100) |
Security: | Read-only recommended |
---|---|
Software: | Windows Installer XML (3.5.2415.0) |
Words: | 2 |
Pages: | 200 |
ModifyDate: | 2014:06:16 10:09:00 |
CreateDate: | 2014:06:16 10:09:00 |
RevisionNumber: | {B39F8756-9904-4C26-9B2D-E874DC266829} |
Template: | Intel;1033 |
Comments: | Netwrix is a registered trademark of Netwrix Corporation |
Keywords: | Installer |
Author: | Netwrix Corporation |
Subject: | Quickly identifies the reason for an account lockout without doing the routine work. |
Title: | Installation Database |
CodePage: | Windows Latin 1 (Western European) |
PID | CMD | Path | Indicators | Parent process | |||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
1484 | "C:\Windows\System32\msiexec.exe" /i "C:\Users\admin\AppData\Local\Temp\ale_setup_free.msi" | C:\Windows\System32\msiexec.exe | explorer.exe | ||||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows® installer Exit code: 4294967295 Version: 5.0.7600.16385 (win7_rtm.090713-1255) Modules
| |||||||||||||||
4080 | C:\Windows\system32\msiexec.exe /V | C:\Windows\system32\msiexec.exe | — | services.exe | |||||||||||
User: SYSTEM Company: Microsoft Corporation Integrity Level: SYSTEM Description: Windows® installer Version: 5.0.7600.16385 (win7_rtm.090713-1255) Modules
| |||||||||||||||
3744 | "C:\Users\admin\AppData\Local\Temp\MSI7B08.tmp" "C:\Users\admin\AppData\Local\Temp\ale_setup_free.msi" "Netwrix Account Lockout Examiner" | C:\Users\admin\AppData\Local\Temp\MSI7B08.tmp | msiexec.exe | ||||||||||||
User: admin Company: Netwrix Corporation Integrity Level: MEDIUM Description: NonElevatedInvoker Exit code: 0 Version: 1.0.85.0 Modules
| |||||||||||||||
392 | "C:\Users\admin\AppData\Local\Temp\NetWrix\Netwrix Account Lockout Examiner\Installation\NetWrixInstaller.exe" "C:\Users\admin\AppData\Local\Temp\NetWrix\Netwrix Account Lockout Examiner\Installation\ale_setup_free.msi" "Netwrix Account Lockout Examiner" "C:\Users\admin\AppData\Local\Temp\ale_setup_free.msi" | C:\Users\admin\AppData\Local\Temp\NetWrix\Netwrix Account Lockout Examiner\Installation\NetWrixInstaller.exe | — | MSI7B08.tmp | |||||||||||
User: admin Company: Netwrix Corporation Integrity Level: MEDIUM Description: ElevatedInvoker Exit code: 3221226540 Version: 1.0.85.0 Modules
| |||||||||||||||
2588 | "C:\Users\admin\AppData\Local\Temp\NetWrix\Netwrix Account Lockout Examiner\Installation\NetWrixInstaller.exe" "C:\Users\admin\AppData\Local\Temp\NetWrix\Netwrix Account Lockout Examiner\Installation\ale_setup_free.msi" "Netwrix Account Lockout Examiner" "C:\Users\admin\AppData\Local\Temp\ale_setup_free.msi" | C:\Users\admin\AppData\Local\Temp\NetWrix\Netwrix Account Lockout Examiner\Installation\NetWrixInstaller.exe | MSI7B08.tmp | ||||||||||||
User: admin Company: Netwrix Corporation Integrity Level: HIGH Description: ElevatedInvoker Exit code: 0 Version: 1.0.85.0 Modules
| |||||||||||||||
1916 | C:\Windows\system32\wbem\WmiApSrv.exe | C:\Windows\system32\wbem\WmiApSrv.exe | — | services.exe | |||||||||||
User: SYSTEM Company: Microsoft Corporation Integrity Level: SYSTEM Description: WMI Performance Reverse Adapter Exit code: 0 Version: 6.1.7600.16385 (win7_rtm.090713-1255) Modules
| |||||||||||||||
728 | "C:\Windows\System32\msiexec.exe" /i "C:\Users\admin\AppData\Local\Temp\NetWrix\Netwrix Account Lockout Examiner\Installation\ale_setup_free.msi" NON_UAC=1 /l*v "C:\Users\admin\AppData\Local\Temp\NetWrix\Netwrix Account Lockout Examiner\Installation\InstallLog.log" | C:\Windows\System32\msiexec.exe | — | NetWrixInstaller.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: HIGH Description: Windows® installer Version: 5.0.7600.16385 (win7_rtm.090713-1255) Modules
|
(PID) Process: | (1484) msiexec.exe | Key: | HKEY_CLASSES_ROOT\Local Settings\MuiCache\62\52C64B7E |
Operation: | write | Name: | LanguageList |
Value: en-US | |||
(PID) Process: | (3744) MSI7B08.tmp | Key: | HKEY_CLASSES_ROOT\Local Settings\MuiCache\62\52C64B7E |
Operation: | write | Name: | LanguageList |
Value: en-US | |||
(PID) Process: | (3744) MSI7B08.tmp | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
Operation: | write | Name: | UNCAsIntranet |
Value: 0 | |||
(PID) Process: | (3744) MSI7B08.tmp | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
Operation: | write | Name: | AutoDetect |
Value: 1 | |||
(PID) Process: | (2588) NetWrixInstaller.exe | Key: | HKEY_CLASSES_ROOT\Local Settings\MuiCache\62\52C64B7E |
Operation: | write | Name: | LanguageList |
Value: en-US | |||
(PID) Process: | (2588) NetWrixInstaller.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\91C6D6EE3E8AC86384E548C299295C756C817B81 |
Operation: | write | Name: | Blob |
Value: 0F000000010000001400000085FEF11B4F47FE3952F98301C9F98976FEFEE0CE09000000010000002A000000302806082B0601050507030106082B0601050507030206082B0601050507030406082B0601050507030353000000010000002500000030233021060B6086480186F8450107300130123010060A2B0601040182373C0101030200C01400000001000000140000007B5B45CFAFCECB7AFD31921A6AB6F346EB5748501D00000001000000100000005B3B67000EEB80022E42605B6B3B72400B000000010000000E000000740068006100770074006500000003000000010000001400000091C6D6EE3E8AC86384E548C299295C756C817B812000000001000000240400003082042030820308A0030201020210344ED55720D5EDEC49F42FCE37DB2B6D300D06092A864886F70D01010505003081A9310B300906035504061302555331153013060355040A130C7468617774652C20496E632E31283026060355040B131F43657274696669636174696F6E205365727669636573204469766973696F6E31383036060355040B132F2863292032303036207468617774652C20496E632E202D20466F7220617574686F72697A656420757365206F6E6C79311F301D06035504031316746861777465205072696D61727920526F6F74204341301E170D3036313131373030303030305A170D3336303731363233353935395A3081A9310B300906035504061302555331153013060355040A130C7468617774652C20496E632E31283026060355040B131F43657274696669636174696F6E205365727669636573204469766973696F6E31383036060355040B132F2863292032303036207468617774652C20496E632E202D20466F7220617574686F72697A656420757365206F6E6C79311F301D06035504031316746861777465205072696D61727920526F6F7420434130820122300D06092A864886F70D01010105000382010F003082010A0282010100ACA0F0FB8059D49CC7A4CF9DA159730910450C0D2C6E68F16C5B4868495937FC0B3319C2777FCC102D95341CE6EB4D09A71CD2B8C9973602B789D4245F06C0CC4494948D02626FEB5ADD118D289A5C8490107A0DBD74662F6A38A0E2D55444EB1D079F07BA6FEEE9FD4E0B29F53E84A001F19CABF81C7E89A4E8A1D871650DA3517BEEBCD222600DB95B9DDFBAFC515B0BAF98B2E92EE904E86287DE2BC8D74EC14C641EDDCF8758BA4A4FCA68071D1C9D4AC6D52F91CC7C71721CC5C067EB32FDC9925C94DA85C09BBF537D2B09F48C9D911F976A52CBDE0936A477D87B875044D53E6E2969FB3949261E09A5807B402DEBE82785C9FE61FD7EE67C971DD59D0203010001A3423040300F0603551D130101FF040530030101FF300E0603551D0F0101FF040403020106301D0603551D0E041604147B5B45CFAFCECB7AFD31921A6AB6F346EB574850300D06092A864886F70D010105050003820101007911C04BB391B6FCF0E967D40D6E45BE55E893D2CE033FEDDA25B01D57CB1E3A76A04CEC5076E864720CA4A9F1B88BD6D68784BB32E54111C077D9B3609DEB1BD5D16E4444A9A601EC55621D77B85C8E48497C9C3B5711ACAD73378E2F785C906847D96060E6FC073D222017C4F716E9C4D872F9C8737CDF162F15A93EFD6A27B6A1EB5ABA981FD5E34D640A9D13C861BAF5391C87BAB8BD7B227FF6FEAC4079E5AC106F3D8F1B79768BC437B3211884E53600EB632099B9E9FE3304BB41C8C102F94463209E81CE42D3D63F2C76D3639C59DD8FA6E10EA02E41F72E9547CFBCFD33F3F60B617E7E912B8147C22730EEA7105D378F5C392BE404F07B8D568C68 | |||
(PID) Process: | (2588) NetWrixInstaller.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\91C6D6EE3E8AC86384E548C299295C756C817B81 |
Operation: | write | Name: | Blob |
Value: 190000000100000010000000DC73F9B71E16D51D26527D32B11A6A3D03000000010000001400000091C6D6EE3E8AC86384E548C299295C756C817B810B000000010000000E00000074006800610077007400650000001D00000001000000100000005B3B67000EEB80022E42605B6B3B72401400000001000000140000007B5B45CFAFCECB7AFD31921A6AB6F346EB57485053000000010000002500000030233021060B6086480186F8450107300130123010060A2B0601040182373C0101030200C009000000010000002A000000302806082B0601050507030106082B0601050507030206082B0601050507030406082B060105050703030F000000010000001400000085FEF11B4F47FE3952F98301C9F98976FEFEE0CE2000000001000000240400003082042030820308A0030201020210344ED55720D5EDEC49F42FCE37DB2B6D300D06092A864886F70D01010505003081A9310B300906035504061302555331153013060355040A130C7468617774652C20496E632E31283026060355040B131F43657274696669636174696F6E205365727669636573204469766973696F6E31383036060355040B132F2863292032303036207468617774652C20496E632E202D20466F7220617574686F72697A656420757365206F6E6C79311F301D06035504031316746861777465205072696D61727920526F6F74204341301E170D3036313131373030303030305A170D3336303731363233353935395A3081A9310B300906035504061302555331153013060355040A130C7468617774652C20496E632E31283026060355040B131F43657274696669636174696F6E205365727669636573204469766973696F6E31383036060355040B132F2863292032303036207468617774652C20496E632E202D20466F7220617574686F72697A656420757365206F6E6C79311F301D06035504031316746861777465205072696D61727920526F6F7420434130820122300D06092A864886F70D01010105000382010F003082010A0282010100ACA0F0FB8059D49CC7A4CF9DA159730910450C0D2C6E68F16C5B4868495937FC0B3319C2777FCC102D95341CE6EB4D09A71CD2B8C9973602B789D4245F06C0CC4494948D02626FEB5ADD118D289A5C8490107A0DBD74662F6A38A0E2D55444EB1D079F07BA6FEEE9FD4E0B29F53E84A001F19CABF81C7E89A4E8A1D871650DA3517BEEBCD222600DB95B9DDFBAFC515B0BAF98B2E92EE904E86287DE2BC8D74EC14C641EDDCF8758BA4A4FCA68071D1C9D4AC6D52F91CC7C71721CC5C067EB32FDC9925C94DA85C09BBF537D2B09F48C9D911F976A52CBDE0936A477D87B875044D53E6E2969FB3949261E09A5807B402DEBE82785C9FE61FD7EE67C971DD59D0203010001A3423040300F0603551D130101FF040530030101FF300E0603551D0F0101FF040403020106301D0603551D0E041604147B5B45CFAFCECB7AFD31921A6AB6F346EB574850300D06092A864886F70D010105050003820101007911C04BB391B6FCF0E967D40D6E45BE55E893D2CE033FEDDA25B01D57CB1E3A76A04CEC5076E864720CA4A9F1B88BD6D68784BB32E54111C077D9B3609DEB1BD5D16E4444A9A601EC55621D77B85C8E48497C9C3B5711ACAD73378E2F785C906847D96060E6FC073D222017C4F716E9C4D872F9C8737CDF162F15A93EFD6A27B6A1EB5ABA981FD5E34D640A9D13C861BAF5391C87BAB8BD7B227FF6FEAC4079E5AC106F3D8F1B79768BC437B3211884E53600EB632099B9E9FE3304BB41C8C102F94463209E81CE42D3D63F2C76D3639C59DD8FA6E10EA02E41F72E9547CFBCFD33F3F60B617E7E912B8147C22730EEA7105D378F5C392BE404F07B8D568C68 | |||
(PID) Process: | (2588) NetWrixInstaller.exe | Key: | HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\.NET Memory Cache 4.0\Linkage |
Operation: | write | Name: | Export |
Value: .NET Memory Cache 4.0 | |||
(PID) Process: | (2588) NetWrixInstaller.exe | Key: | HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\MSDTC Bridge 3.0.0.0\Linkage |
Operation: | write | Name: | Export |
Value: MSDTC Bridge 3.0.0.0 | |||
(PID) Process: | (2588) NetWrixInstaller.exe | Key: | HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\MSDTC Bridge 4.0.0.0\Linkage |
Operation: | write | Name: | Export |
Value: MSDTC Bridge 4.0.0.0 |
PID | Process | Filename | Type | |
---|---|---|---|---|
3744 | MSI7B08.tmp | C:\Users\admin\AppData\Local\Temp\NetWrix\Netwrix Account Lockout Examiner\Installation\ale_setup_free.msi | — | |
MD5:— | SHA256:— | |||
2588 | NetWrixInstaller.exe | C:\Users\admin\AppData\Local\Temp\NetWrix\Netwrix Account Lockout Examiner\Installation\ElevatedInvoker.log | text | |
MD5:0C3DFBD59CECF5CE993EC7AA8E56063D | SHA256:218B0617395F8E87A8C0A227FC3E9C4BA16474D88C3B0C6ADF2CB5F60A898A94 | |||
3744 | MSI7B08.tmp | C:\Users\admin\AppData\Local\Temp\NetWrix\Netwrix Account Lockout Examiner\Installation\NonElevatedInvoker.log | text | |
MD5:51980E5158889F2AF78006DA88BB3742 | SHA256:445CBCCDFB271C969B4D3481D2221A8077FD40419E280F4AA7970464251B8CB5 | |||
3744 | MSI7B08.tmp | C:\Users\admin\AppData\Local\Temp\NetWrix\Netwrix Account Lockout Examiner\Installation\NetWrixInstaller.exe | executable | |
MD5:A4FB68384A50AABBCE71EA440211C49E | SHA256:C00A6C2927FC7ABCA85FFA7AE9F300EA331F962C080E7EEEEF06444982C5AF28 | |||
1484 | msiexec.exe | C:\Users\admin\AppData\Local\Temp\MSI7B08.tmp | executable | |
MD5:0206540782340CE84E15E9CD36F07177 | SHA256:AE6289681E80D974A2913A1BC7F579476F2917B52F07E4D5F47EC948D25FA7B2 |