File name:

SQL2022-SSEI-Expr.exe

Full analysis: https://app.any.run/tasks/a77fb903-972a-4ffc-95f8-0433f7694b82
Verdict: Malicious activity
Analysis date: January 21, 2025, 22:27:28
OS: Windows 10 Professional (build: 19045, 64 bit)
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows, 3 sections
MD5:

9D3E508BDEC464EB30C0126D4C552BE6

SHA1:

9A256EB2B36991E220DF21ED362858FEDF884025

SHA256:

36E0EC2AC3DD60F496C99CE44722C629209EA7302A2CE9CBFD1E42A73510D7B6

SSDEEP:

49152:6JlbZDTWvDNNBpc1qonwwpuQNie803bk9vK7OJtpfGVZjYDKu2bRPEDTTDh/Z+rP:m6T9R2ie803bk9vK7Nn

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    No malicious indicators.

  • SUSPICIOUS

    • Starts a Microsoft application from unusual location

      • SQL2022-SSEI-Expr.exe (PID: 6284)
      • SQL2022-SSEI-Expr.exe (PID: 6168)

    • Process drops legitimate windows executable

      • SQL2022-SSEI-Expr.exe (PID: 6284)
      • SQLRules_x64_ENU.exe (PID: 6968)

    • Reads security settings of Internet Explorer

      • SQL2022-SSEI-Expr.exe (PID: 6284)
      • SETUP.EXE (PID: 7048)
      • SCENARIOENGINE.EXE (PID: 7104)

    • Executable content was dropped or overwritten

      • SQL2022-SSEI-Expr.exe (PID: 6284)
      • SQLRules_x64_ENU.exe (PID: 6968)

    • The process creates files with name similar to system file names

      • SQLRules_x64_ENU.exe (PID: 6968)

    • The process drops C-runtime libraries

      • SQLRules_x64_ENU.exe (PID: 6968)

  • INFO

    • Checks supported languages

      • SQL2022-SSEI-Expr.exe (PID: 6284)
      • SQLRules_x64_ENU.exe (PID: 6968)
      • SETUP.EXE (PID: 7048)
      • SCENARIOENGINE.EXE (PID: 7104)

    • Reads the machine GUID from the registry

      • SQL2022-SSEI-Expr.exe (PID: 6284)
      • SETUP.EXE (PID: 7048)
      • SCENARIOENGINE.EXE (PID: 7104)

    • Reads the computer name

      • SQL2022-SSEI-Expr.exe (PID: 6284)
      • SQLRules_x64_ENU.exe (PID: 6968)
      • SETUP.EXE (PID: 7048)
      • SCENARIOENGINE.EXE (PID: 7104)

    • Creates files in the program directory

      • SQL2022-SSEI-Expr.exe (PID: 6284)
      • SCENARIOENGINE.EXE (PID: 7104)

    • Reads Environment values

      • SQL2022-SSEI-Expr.exe (PID: 6284)

    • Disables trace logs

      • SQL2022-SSEI-Expr.exe (PID: 6284)

    • Reads the software policy settings

      • SQL2022-SSEI-Expr.exe (PID: 6284)

    • Checks proxy server information

      • SQL2022-SSEI-Expr.exe (PID: 6284)

    • The process uses the downloaded file

      • SQL2022-SSEI-Expr.exe (PID: 6284)
      • SETUP.EXE (PID: 7048)
      • SCENARIOENGINE.EXE (PID: 7104)

    • The sample compiled with english language support

      • SQLRules_x64_ENU.exe (PID: 6968)

    • Create files in a temporary directory

      • SQLRules_x64_ENU.exe (PID: 6968)
      • SETUP.EXE (PID: 7048)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win64 Executable (generic) (49.4)
.scr | Windows screen saver (23.4)
.dll | Win32 Dynamic Link Library (generic) (11.7)
.exe | Win32 Executable (generic) (8)
.exe | Generic Win/DOS Executable (3.5)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2049:04:13 15:40:44+00:00
ImageFileCharacteristics: Executable, Large address aware
PEType: PE32
LinkerVersion: 48
CodeSize: 4265984
InitializedDataSize: 14336
UninitializedDataSize: -
EntryPoint: 0x413796
OSVersion: 4
ImageVersion: -
SubsystemVersion: 6
Subsystem: Windows GUI
FileVersionNumber: 16.2211.5693.3
ProductVersionNumber: 16.2211.5693.3
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: Neutral
CharacterSet: Unicode
CompanyName: Microsoft Corporation
FileDescription: SQL Server Installer for Express Editions
FileVersion: 16.2211.5693.3
InternalName: SQL2022-SSEI-Expr.exe
LegalCopyright: Copyright (c) Microsoft Corporation. All rights reserved.
LegalTrademarks: Microsoft and Windows are either registered trademarks or trademarks of Microsoft Corporation in the U.S. and/or other countries.
OriginalFileName: SQL2022-SSEI-Expr.exe
ProductName: Microsoft Sql Server Installer
ProductVersion: 16.2211.5693.3
AssemblyVersion: 16.2211.0.0
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
133
Monitored processes
6
Malicious processes
2
Suspicious processes
0

Behavior graph

Click at the process to see the details
start sql2022-ssei-expr.exe sqlrules_x64_enu.exe setup.exe no specs conhost.exe no specs scenarioengine.exe no specs sql2022-ssei-expr.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
6168"C:\Users\admin\AppData\Local\Temp\SQL2022-SSEI-Expr.exe" C:\Users\admin\AppData\Local\Temp\SQL2022-SSEI-Expr.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
SQL Server Installer for Express Editions
Exit code:
3221226540
Version:
16.2211.5693.3
Modules
Images
c:\users\admin\appdata\local\temp\sql2022-ssei-expr.exe
c:\windows\system32\ntdll.dll
6284"C:\Users\admin\AppData\Local\Temp\SQL2022-SSEI-Expr.exe" C:\Users\admin\AppData\Local\Temp\SQL2022-SSEI-Expr.exe
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
SQL Server Installer for Express Editions
Version:
16.2211.5693.3
Modules
Images
c:\users\admin\appdata\local\temp\sql2022-ssei-expr.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
6968"C:\SQL2022\SQLRules_x64_ENU.exe" /q /x:"C:\SQL2022\RulesEng"C:\SQL2022\SQLRules_x64_ENU.exe
SQL2022-SSEI-Expr.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Microsoft SQL Server 2022
Exit code:
0
Version:
16.0.1000.6
Modules
Images
c:\sql2022\sqlrules_x64_enu.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\rpcrt4.dll
7048"C:\SQL2022\RulesEng\SETUP.EXE" /q /ENU /TIMESTAMP=20250121_222748C:\SQL2022\RulesEng\SETUP.EXE—SQL2022-SSEI-Expr.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Sql Server Setup Bootstrapper
Exit code:
0
Version:
2022.0160.1000.06 ((SQL22_RTM).221008-0913)
Modules
Images
c:\sql2022\ruleseng\setup.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\ole32.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\combase.dll
c:\windows\system32\gdi32.dll
7056\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—SETUP.EXE
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
7104"C:\SQL2022\RulesEng\x64\ScenarioEngine.exe" /TIMESTAMP=20250121_222748 /LOGMARKER=_Rules /MEDIASOURCE="C:\SQL2022\RulesEng\\" /INSTALLMEDIAPATH="C:\SQL2022\RulesEng\x64\setup\\" /ENU /MEDIALAYOUT="None" /q /ENU /TIMESTAMP=20250121_222748 /ACTION=RUNRULES /RULES=PreInstallRulesC:\SQL2022\RulesEng\x64\SCENARIOENGINE.EXE—SETUP.EXE
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Exit code:
0
Version:
16.0.1000.6
Modules
Images
c:\sql2022\ruleseng\x64\scenarioengine.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
Total events
4 688
Read events
4 670
Write events
18
Delete events
0

Modification events

(PID) Process:(6284) SQL2022-SSEI-Expr.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\SQL2022-SSEI-Expr_RASAPI32
Operation:writeName:EnableFileTracing
Value:
0
(PID) Process:(6284) SQL2022-SSEI-Expr.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\SQL2022-SSEI-Expr_RASAPI32
Operation:writeName:EnableAutoFileTracing
Value:
0
(PID) Process:(6284) SQL2022-SSEI-Expr.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\SQL2022-SSEI-Expr_RASAPI32
Operation:writeName:EnableConsoleTracing
Value:
0
(PID) Process:(6284) SQL2022-SSEI-Expr.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\SQL2022-SSEI-Expr_RASAPI32
Operation:writeName:FileTracingMask
Value:
(PID) Process:(6284) SQL2022-SSEI-Expr.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\SQL2022-SSEI-Expr_RASAPI32
Operation:writeName:ConsoleTracingMask
Value:
(PID) Process:(6284) SQL2022-SSEI-Expr.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\SQL2022-SSEI-Expr_RASAPI32
Operation:writeName:MaxFileSize
Value:
1048576
(PID) Process:(6284) SQL2022-SSEI-Expr.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\SQL2022-SSEI-Expr_RASAPI32
Operation:writeName:FileDirectory
Value:
%windir%\tracing
(PID) Process:(6284) SQL2022-SSEI-Expr.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\SQL2022-SSEI-Expr_RASMANCS
Operation:writeName:EnableFileTracing
Value:
0
(PID) Process:(6284) SQL2022-SSEI-Expr.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\SQL2022-SSEI-Expr_RASMANCS
Operation:writeName:EnableAutoFileTracing
Value:
0
(PID) Process:(6284) SQL2022-SSEI-Expr.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\SQL2022-SSEI-Expr_RASMANCS
Operation:writeName:EnableConsoleTracing
Value:
0
Executable files
125
Suspicious files
1
Text files
113
Unknown types
0

Dropped files

PID
Process
Filename
Type
6968SQLRules_x64_ENU.exeC:\SQL2022\RulesEng\SETUP.EXE.CONFIGxml
MD5:31E956ACE5473F21A11E81166912C9A5
SHA256:D713884D3C5307892633E0DDF9348A4C37D855447A79936F64307CF804D3E3A3
6968SQLRules_x64_ENU.exeC:\SQL2022\RulesEng\x64\COMPLETEIMAGEWIZARD.XMLxml
MD5:8764B7B3EB78219704441544FDDAD84A
SHA256:EB45E57F21E2AC322E9C1BBF0A4D5CB417923CE2F9F4F4A41CC989DB5C4CA8A4
6968SQLRules_x64_ENU.exeC:\SQL2022\RulesEng\SQLSETUPBOOTSTRAPPER.DLLexecutable
MD5:FCBDE14AF779CAB7A8A0461026C2523A
SHA256:4C8AAB261E0E9499D8CAAD167F75F21AEFDD4A3FEF5EA701B046C07E994215BD
6968SQLRules_x64_ENU.exeC:\SQL2022\RulesEng\x64\EDITIONUPGRADEWIZARD.XMLxml
MD5:DC7C9F32CEDA3865AAFCA07FFE5ADC89
SHA256:090AB8E6603D077E73D480DC568A192900E55CE369D0B38AA34AC5365386B381
6968SQLRules_x64_ENU.exeC:\SQL2022\RulesEng\x64\ADDNODE.XMLxml
MD5:C76A09067E578D90303D43FCA059DCC7
SHA256:A7E1F3CFDA360B2FCBDB9905DB6B743C1A69A50A54914A5F4D00FE2E4FB29A08
6968SQLRules_x64_ENU.exeC:\SQL2022\RulesEng\1033_ENU_LP\MEDIAINFO.XMLxml
MD5:88E5419002A2B82198F7C3515620DE63
SHA256:74E8E84493D88CE62D0A32B916F1FEB8E59FDB32BA06D092855A653AD284EF93
6968SQLRules_x64_ENU.exeC:\SQL2022\RulesEng\x64\FIXSQLREGISTRYKEY_X86.EXEexecutable
MD5:E6779E3C112169D23891E6E09476B203
SHA256:DFCBCD9EF31B75BB1BAA1340986349F02A63F34A2D7837A32498DB303E25B338
6968SQLRules_x64_ENU.exeC:\SQL2022\RulesEng\x64\FIXSQLREGISTRYKEY_X64.EXEexecutable
MD5:3884A80C46A305C4CDBA351BD0F7BD2A
SHA256:E441BC728D819FD9DB9F771C87DCE04EDA7E3DB08D62B5EB3B39828AA72917B6
6968SQLRules_x64_ENU.exeC:\SQL2022\RulesEng\MEDIAINFO.XMLxml
MD5:5DAE34995D33178062ADE79940448010
SHA256:1ADAD1391382C06F391E723B95A7840F8368B1F3E23C21D003344CCF16758A25
6968SQLRules_x64_ENU.exeC:\SQL2022\RulesEng\x64\FIXSQLREGISTRYKEY_X86.EXE.CONFIGxml
MD5:31E956ACE5473F21A11E81166912C9A5
SHA256:D713884D3C5307892633E0DDF9348A4C37D855447A79936F64307CF804D3E3A3
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
7
TCP/UDP connections
38
DNS requests
19
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
—
—
GET
200
2.23.246.101:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
—
—
GET
200
2.16.241.12:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
—
—
GET
200
2.23.77.188:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAI5PUjXAkJafLQcAAsO18o%3D
unknown
—
—
whitelisted
1176
svchost.exe
GET
200
2.23.77.188:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
5780
SIHClient.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
3688
backgroundTaskHost.exe
GET
200
2.17.190.73:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAUZZSZEml49Gjh0j13P68w%3D
unknown
—
—
whitelisted
—
—
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
—
—
51.104.136.2:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
—
—
2.16.241.12:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
—
—
2.23.246.101:80
www.microsoft.com
Ooredoo Q.S.C.
QA
whitelisted
5064
SearchApp.exe
2.23.227.208:443
www.bing.com
Ooredoo Q.S.C.
QA
whitelisted
—
—
2.23.77.188:80
ocsp.digicert.com
AKAMAI-AS
DE
whitelisted
4712
MoUsoCoreWorker.exe
51.104.136.2:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
5340
svchost.exe
51.104.136.2:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
1076
svchost.exe
184.28.89.167:443
go.microsoft.com
AKAMAI-AS
US
whitelisted

DNS requests

Domain
IP
Reputation
google.com
  • 142.250.186.46
whitelisted
crl.microsoft.com
  • 2.16.241.12
  • 2.16.241.19
whitelisted
www.microsoft.com
  • 2.23.246.101
  • 184.30.21.171
whitelisted
www.bing.com
  • 2.23.227.208
  • 2.23.227.215
whitelisted
ocsp.digicert.com
  • 2.23.77.188
  • 2.17.190.73
whitelisted
go.microsoft.com
  • 184.28.89.167
whitelisted
login.live.com
  • 40.126.32.134
  • 20.190.160.17
  • 40.126.32.68
  • 40.126.32.133
  • 40.126.32.76
  • 20.190.160.20
  • 40.126.32.138
  • 40.126.32.72
whitelisted
download.microsoft.com
  • 23.212.89.111
whitelisted
settings-win.data.microsoft.com
  • 20.73.194.208
  • 4.231.128.59
whitelisted
arc.msn.com
  • 20.223.35.26
whitelisted

Threats

No threats detected
Process
Message
SQL2022-SSEI-Expr.exe
(01) 2025-01-21 22:27:37 SSEI v16.2211.5693.3
SQL2022-SSEI-Expr.exe
(01) 2025-01-21 22:27:37 CorrelationId: 8a201317-f9a0-4a20-8a51-79e1075e0f04
SQL2022-SSEI-Expr.exe
(01) 2025-01-21 22:27:37 CurrentCulture.Name='en-US'.LCID='1033'.Parent.Name='en'
SQL2022-SSEI-Expr.exe
(01) 2025-01-21 22:27:37 CurrentUICulture.Name='en-US'.LCID='1033'.Parent.Name='en'
SQL2022-SSEI-Expr.exe
(01) 2025-01-21 22:27:37 supported culture detected ='en-US'.
SQL2022-SSEI-Expr.exe
(01) 2025-01-21 22:27:37 resolvedCulture: en-US
SQL2022-SSEI-Expr.exe
(01) 2025-01-21 22:27:37 osSupported: True, osVersion: 10.0.19045.0, osPlatform: amd64
SQL2022-SSEI-Expr.exe
(04) 2025-01-21 22:27:38 .NET Framework Version: 4.5
SQL2022-SSEI-Expr.exe
(04) 2025-01-21 22:27:38 StartupBootstrapActivity:SSEIActivityStart:Message: Starting Activity StartupBootstrapActivity
SQL2022-SSEI-Expr.exe
(04) 2025-01-21 22:27:38 StartupBootstrapActivity:SSEIProgressReport:ProgressPercent: 1
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
SQL2022-SSEI-Expr.exe