File name:

anyconnect-win-4.3.02039-pre-deploy-k9.msi

Full analysis: https://app.any.run/tasks/dfddee50-6a6b-45f0-b1e3-e8dbe59efabe
Verdict: Malicious activity
Analysis date: May 07, 2019, 13:26:32
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
generated-doc
Indicators:
MIME: application/x-msi
File info: Composite Document File V2 Document, Little Endian, Os: Windows, Version 6.1, MSI Installer, Title: Installation Database, Keywords: Installer, MSI, Database, Last Printed: Fri Dec 11 11:47:44 2009, Create Time/Date: Fri Dec 11 11:47:44 2009, Last Saved Time/Date: Fri Dec 11 11:47:44 2009, Number of Pages: 200, Security: 0, Code page: 1252, Revision Number: {F4A117DC-03F4-4B6B-8A2D-6C738B27B706}, Number of Words: 2, Subject: Cisco AnyConnect Secure Mobility Client, Author: Cisco Systems, Inc., Name of Creating Application: Advanced Installer 7.5.2, Template: ;1033, Comments: A SmartNET contract is required for support - Cisco AnyConnect Secure Mobility Client.
MD5:

0C81DF154241333AC97AE38CC4411639

SHA1:

389E8077A02F9CA483212D5C7C41B596CAB35E9B

SHA256:

3B2EC357789F91693AC2AEC16DD258E8825170D33B117386DAC41AB054D69838

SSDEEP:

196608:MgaXiAfCx16g1aJwmJwZFdRFpf8PeQa+1zeD7oJFE:MgaXffwX1ajmZFdXpf8L9yoJ

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Loads dropped or rewritten executable

      • InstallHelper.exe (PID: 1700)
      • InstallHelper.exe (PID: 1888)
      • InstallHelper.exe (PID: 1364)
      • InstallHelper.exe (PID: 2408)
      • InstallHelper.exe (PID: 4084)
      • InstallHelper.exe (PID: 2372)
      • VACon.exe (PID: 1352)
      • InstallHelper.exe (PID: 2620)
      • InstallHelper.exe (PID: 4068)
      • InstallHelper.exe (PID: 1340)
      • InstallHelper.exe (PID: 1128)
      • VACon.exe (PID: 328)
      • vpnagent.exe (PID: 2732)
      • InstallHelper.exe (PID: 2216)
      • InstallHelper.exe (PID: 2328)
      • ManifestTool.exe (PID: 888)
      • vpnui.exe (PID: 2580)
      • InstallHelper.exe (PID: 4068)

    • Application was dropped or rewritten from another process

      • InstallHelper.exe (PID: 1700)
      • InstallHelper.exe (PID: 1364)
      • InstallHelper.exe (PID: 1340)
      • InstallHelper.exe (PID: 1888)
      • InstallHelper.exe (PID: 2408)
      • InstallHelper.exe (PID: 2372)
      • InstallHelper.exe (PID: 4084)
      • VACon.exe (PID: 1352)
      • InstallHelper.exe (PID: 2620)
      • vpnagent.exe (PID: 2732)
      • InstallHelper.exe (PID: 4068)
      • VACon.exe (PID: 328)
      • InstallHelper.exe (PID: 1128)
      • InstallHelper.exe (PID: 2328)
      • InstallHelper.exe (PID: 2216)
      • InstallHelper.exe (PID: 4068)
      • ManifestTool.exe (PID: 888)
      • vpnui.exe (PID: 2580)

    • Changes the autorun value in the registry

      • VACon.exe (PID: 1352)
      • vpnagent.exe (PID: 2732)

  • SUSPICIOUS

    • Creates files in the Windows directory

      • msiexec.exe (PID: 2388)
      • VACon.exe (PID: 1352)
      • vpnagent.exe (PID: 2732)
      • DrvInst.exe (PID: 2360)
      • DrvInst.exe (PID: 1804)

    • Executable content was dropped or overwritten

      • msiexec.exe (PID: 2388)
      • VACon.exe (PID: 1352)
      • VACon.exe (PID: 328)
      • DrvInst.exe (PID: 2360)

    • Creates COM task schedule object

      • InstallHelper.exe (PID: 2372)

    • Changes the autorun value in the registry

      • msiexec.exe (PID: 2388)

    • Creates files in the driver directory

      • VACon.exe (PID: 1352)
      • vpnagent.exe (PID: 2732)
      • DrvInst.exe (PID: 1804)
      • DrvInst.exe (PID: 2360)

    • Removes files from Windows directory

      • VACon.exe (PID: 1352)
      • vpnagent.exe (PID: 2732)
      • DrvInst.exe (PID: 2360)
      • DrvInst.exe (PID: 1804)

    • Creates files in the program directory

      • InstallHelper.exe (PID: 2620)
      • ManifestTool.exe (PID: 888)

    • Reads internet explorer settings

      • vpnui.exe (PID: 2580)

  • INFO

    • Application launched itself

      • msiexec.exe (PID: 2388)

    • Low-level read access rights to disk partition

      • vssvc.exe (PID: 3012)

    • Searches for installed software

      • msiexec.exe (PID: 2388)

    • Changes settings of System certificates

      • DrvInst.exe (PID: 1688)

    • Creates a software uninstall entry

      • msiexec.exe (PID: 2388)

    • Creates files in the program directory

      • msiexec.exe (PID: 2388)

    • Creates or modifies windows services

      • msiexec.exe (PID: 2388)

    • Adds / modifies Windows certificates

      • DrvInst.exe (PID: 1688)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.msi | Microsoft Windows Installer (88.6)
.mst | Windows SDK Setup Transform Script (10)
.msi | Microsoft Installer (100)

EXIF

FlashPix

Title: Installation Database
Keywords: Installer, MSI, Database
LastPrinted: 2009:12:11 11:47:44
CreateDate: 2009:12:11 11:47:44
ModifyDate: 2009:12:11 11:47:44
Pages: 200
Security: None
CodePage: Windows Latin 1 (Western European)
RevisionNumber: {F4A117DC-03F4-4B6B-8A2D-6C738B27B706}
Words: 2
Subject: Cisco AnyConnect Secure Mobility Client
Author: Cisco Systems, Inc.
LastModifiedBy: -
Software: Advanced Installer 7.5.2
Template: ;1033
Comments: A SmartNET contract is required for support - Cisco AnyConnect Secure Mobility Client.
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
65
Monitored processes
30
Malicious processes
18
Suspicious processes
2

Behavior graph

Click at the process to see the details
start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start msiexec.exe no specs msiexec.exe msiexec.exe no specs vssvc.exe no specs drvinst.exe no specs msiexec.exe no specs installhelper.exe no specs installhelper.exe no specs installhelper.exe no specs installhelper.exe no specs installhelper.exe no specs installhelper.exe no specs installhelper.exe no specs installhelper.exe no specs installhelper.exe no specs vacon.exe runonce.exe grpconv.exe no specs installhelper.exe no specs vpnagent.exe vacon.exe drvinst.exe no specs drvinst.exe installhelper.exe no specs rundll32.exe no specs installhelper.exe no specs installhelper.exe no specs manifesttool.exe no specs msiexec.exe no specs vpnui.exe

Process information

PID
CMD
Path
Indicators
Parent process
328"C:\Program Files\Cisco\Cisco AnyConnect Secure Mobility Client\VACon.exe" -install "C:\Program Files\Cisco\Cisco AnyConnect Secure Mobility Client\vpnva-6.inf" VPNVAC:\Program Files\Cisco\Cisco AnyConnect Secure Mobility Client\VACon.exe
msiexec.exe
User:
admin
Company:
Cisco Systems, Inc.
Integrity Level:
MEDIUM
Description:
AnyConnect Secure Mobility Client Virtual Adapter Installer
Exit code:
0
Version:
4, 3, 02039
Modules
Images
c:\program files\cisco\cisco anyconnect secure mobility client\vacon.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\newdev.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
888"C:\Program Files\Cisco\Cisco AnyConnect Secure Mobility Client\ManifestTool.exe" -i "C:\ProgramData\Cisco\Cisco AnyConnect Secure Mobility Client\\" "C:\ProgramData\Cisco\Cisco AnyConnect Secure Mobility Client\VPNManifestClient.xml"C:\Program Files\Cisco\Cisco AnyConnect Secure Mobility Client\ManifestTool.exe—msiexec.exe
User:
admin
Company:
Cisco Systems, Inc.
Integrity Level:
MEDIUM
Description:
Cisco AnyConnect Secure Mobility Client ManifestTool
Exit code:
0
Version:
4, 3, 02039
Modules
Images
c:\program files\cisco\cisco anyconnect secure mobility client\manifesttool.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\ole32.dll
c:\windows\system32\gdi32.dll
1128"C:\Program Files\Cisco\Cisco AnyConnect Secure Mobility Client\InstallHelper.exe" -moveIfExist "C:\Users\admin\AppData\Local\\Cisco\Cisco AnyConnect VPN Client\preferences.xml" "C:\Users\admin\AppData\Local\Cisco\Cisco AnyConnect Secure Mobility Client\\preferences.xml"C:\Program Files\Cisco\Cisco AnyConnect Secure Mobility Client\InstallHelper.exe—msiexec.exe
User:
admin
Company:
Cisco Systems, Inc.
Integrity Level:
MEDIUM
Description:
AnyConnect Secure Mobility Client Install Helper
Exit code:
0
Version:
4, 3, 02039
Modules
Images
c:\program files\cisco\cisco anyconnect secure mobility client\installhelper.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\ole32.dll
c:\windows\system32\gdi32.dll
1340"C:\Program Files\Cisco\Cisco AnyConnect Secure Mobility Client\InstallHelper.exe" -moveFiles "C:\ProgramData\\Cisco\Cisco AnyConnect VPN Client\Profile\\" "C:\ProgramData\Cisco\Cisco AnyConnect Secure Mobility Client\\Profile\\" "*.xml"C:\Program Files\Cisco\Cisco AnyConnect Secure Mobility Client\InstallHelper.exe—msiexec.exe
User:
admin
Company:
Cisco Systems, Inc.
Integrity Level:
MEDIUM
Description:
AnyConnect Secure Mobility Client Install Helper
Exit code:
1
Version:
4, 3, 02039
Modules
Images
c:\program files\cisco\cisco anyconnect secure mobility client\installhelper.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\ole32.dll
c:\windows\system32\gdi32.dll
1352"C:\Program Files\Cisco\Cisco AnyConnect Secure Mobility Client\VACon.exe" kdf -install "C:\Program Files\Cisco\Cisco AnyConnect Secure Mobility Client\\" acsockC:\Program Files\Cisco\Cisco AnyConnect Secure Mobility Client\VACon.exe
msiexec.exe
User:
admin
Company:
Cisco Systems, Inc.
Integrity Level:
MEDIUM
Description:
AnyConnect Secure Mobility Client Virtual Adapter Installer
Exit code:
0
Version:
4, 3, 02039
Modules
Images
c:\program files\cisco\cisco anyconnect secure mobility client\vacon.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\newdev.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
1364"C:\Program Files\Cisco\Cisco AnyConnect Secure Mobility Client\InstallHelper.exe" -copyFiles "C:\Users\admin\AppData\Local\Temp\Profiles\\" "C:\ProgramData\Cisco\Cisco AnyConnect Secure Mobility Client\\" "AnyConnectLocalPolicy.xml"C:\Program Files\Cisco\Cisco AnyConnect Secure Mobility Client\InstallHelper.exe—msiexec.exe
User:
admin
Company:
Cisco Systems, Inc.
Integrity Level:
MEDIUM
Description:
AnyConnect Secure Mobility Client Install Helper
Exit code:
1
Version:
4, 3, 02039
Modules
Images
c:\program files\cisco\cisco anyconnect secure mobility client\installhelper.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\ole32.dll
c:\windows\system32\gdi32.dll
1364"C:\Windows\System32\grpconv.exe" -oC:\Windows\System32\grpconv.exe—runonce.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Windows Progman Group Converter
Exit code:
1
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\msctf.dll
c:\program files\cisco\cisco anyconnect secure mobility client\api-ms-win-crt-multibyte-l1-1-0.dll
c:\program files\cisco\cisco anyconnect secure mobility client\msvcp140.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\wininet.dll
c:\windows\system32\shlwapi.dll
c:\program files\cisco\cisco anyconnect secure mobility client\api-ms-win-crt-conio-l1-1-0.dll
c:\program files\cisco\cisco anyconnect secure mobility client\api-ms-win-crt-math-l1-1-0.dll
c:\program files\cisco\cisco anyconnect secure mobility client\api-ms-win-crt-time-l1-1-0.dll
c:\program files\cisco\cisco anyconnect secure mobility client\api-ms-win-crt-convert-l1-1-0.dll
1424C:\Windows\system32\MsiExec.exe -Embedding D957D46E8EA78181A4F124DF86D7BEC7 CC:\Windows\system32\MsiExec.exe—msiexec.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows® installer
Exit code:
0
Version:
5.0.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\msiexec.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
1688DrvInst.exe "1" "200" "STORAGE\VolumeSnapshot\HarddiskVolumeSnapshot18" "" "" "6792c44eb" "00000000" "00000580" "00000388"C:\Windows\system32\DrvInst.exe—svchost.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Driver Installation Module
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\drvinst.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\setupapi.dll
c:\windows\system32\cfgmgr32.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
1700"C:\Program Files\Cisco\Cisco AnyConnect Secure Mobility Client\InstallHelper.exe" -moveIfExist "C:\ProgramData\\Cisco\Cisco AnyConnect VPN Client\preferences_global.xml" "C:\ProgramData\Cisco\Cisco AnyConnect Secure Mobility Client\\preferences_global.xml"C:\Program Files\Cisco\Cisco AnyConnect Secure Mobility Client\InstallHelper.exe—msiexec.exe
User:
admin
Company:
Cisco Systems, Inc.
Integrity Level:
MEDIUM
Description:
AnyConnect Secure Mobility Client Install Helper
Exit code:
0
Version:
4, 3, 02039
Modules
Images
c:\program files\cisco\cisco anyconnect secure mobility client\installhelper.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\ole32.dll
c:\windows\system32\gdi32.dll
Total events
1 845
Read events
868
Write events
920
Delete events
57

Modification events

(PID) Process:(2660) msiexec.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\62\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(2388) msiexec.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\SystemRestore
Operation:writeName:SrCreateRp (Enter)
Value:
40000000000000006C719F92D804D50154090000DC090000D5070000000000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(2388) msiexec.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\SPP
Operation:writeName:SppCreate (Enter)
Value:
40000000000000006C719F92D804D50154090000DC090000D0070000000000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(2388) msiexec.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SPP
Operation:writeName:LastIndex
Value:
20
(PID) Process:(2388) msiexec.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\SPP
Operation:writeName:SppGatherWriterMetadata (Enter)
Value:
4000000000000000ACBCEB92D804D50154090000DC090000D3070000000000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(2388) msiexec.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\VssapiPublisher
Operation:writeName:IDENTIFY (Enter)
Value:
4000000000000000061FEE92D804D50154090000340E0000E8030000010000000000000000000000786440AAC47A5245BE4AD8B91103D3950000000000000000
(PID) Process:(3012) vssvc.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\ASR Writer
Operation:writeName:IDENTIFY (Enter)
Value:
4000000000000000D6310193D804D501C40B0000B4080000E8030000010000000100000000000000000000000000000000000000000000000000000000000000
(PID) Process:(3012) vssvc.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\COM+ REGDB Writer
Operation:writeName:IDENTIFY (Enter)
Value:
4000000000000000D6310193D804D501C40B0000B0080000E8030000010000000100000000000000000000000000000000000000000000000000000000000000
(PID) Process:(3012) vssvc.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\Registry Writer
Operation:writeName:IDENTIFY (Enter)
Value:
4000000000000000D6310193D804D501C40B00008C0B0000E8030000010000000100000000000000000000000000000000000000000000000000000000000000
(PID) Process:(3012) vssvc.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\Shadow Copy Optimization Writer
Operation:writeName:IDENTIFY (Enter)
Value:
4000000000000000D6310193D804D501C40B0000300D0000E8030000010000000100000000000000000000000000000000000000000000000000000000000000
Executable files
80
Suspicious files
24
Text files
420
Unknown types
8

Dropped files

PID
Process
Filename
Type
2660msiexec.exeC:\Users\admin\AppData\Local\Temp\MSI4543.tmp —
MD5:—
SHA256:—
2660msiexec.exeC:\Users\admin\AppData\Local\Temp\MSI45F0.tmp —
MD5:—
SHA256:—
2388msiexec.exeC:\System Volume Information\SPP\metadata-2 —
MD5:—
SHA256:—
2388msiexec.exeC:\System Volume Information\SPP\snapshot-2binary
MD5:—
SHA256:—
2388msiexec.exeC:\Windows\Installer\11acc7.msi —
MD5:—
SHA256:—
2388msiexec.exeC:\Windows\Installer\MSIB284.tmp —
MD5:—
SHA256:—
3012vssvc.exeC: —
MD5:—
SHA256:—
2388msiexec.exeC:\Users\admin\AppData\Local\Temp\~DF20380864F5D90F4C.TMP —
MD5:—
SHA256:—
2388msiexec.exeC:\Windows\Installer\MSIB4C8.tmp —
MD5:—
SHA256:—
2388msiexec.exeC:\Windows\Installer\MSIB4D9.tmp —
MD5:—
SHA256:—
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
4
TCP/UDP connections
4
DNS requests
4
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
2732
vpnagent.exe
GET
—
72.163.1.80:80
http://72.163.1.80/
US
—
—
whitelisted
2732
vpnagent.exe
GET
—
72.163.1.80:80
http://72.163.1.80/
US
—
—
whitelisted
2732
vpnagent.exe
GET
—
72.163.1.80:80
http://72.163.1.80/
US
—
—
whitelisted
2732
vpnagent.exe
GET
—
72.163.1.80:80
http://72.163.1.80/
US
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
2732
vpnagent.exe
72.163.1.80:80
mus.cisco.com
Cisco Systems, Inc.
US
unknown

DNS requests

Domain
IP
Reputation
mus.cisco.com
  • 72.163.1.80
whitelisted

Threats

No threats detected
Process
Message
VACon.exe
VACON: -install
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
anyconnect-win-4.3.02039-pre-deploy-k9.msi