File name:

Profwiz.msi

Full analysis: https://app.any.run/tasks/ac7ecb61-16d0-4ec3-92a2-4ba853b681dc
Verdict: Malicious activity
Analysis date: August 24, 2020, 12:09:08
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
generated-doc
Indicators:
MIME: application/x-msi
File info: Composite Document File V2 Document, Little Endian, Os: Windows, Version 10.0, MSI Installer, Last Printed: Fri Dec 11 11:47:44 2009, Create Time/Date: Fri Dec 11 11:47:44 2009, Last Saved Time/Date: Fri Dec 11 11:47:44 2009, Security: 0, Code page: 1252, Revision Number: {E251EAF9-629C-43BC-A73B-FC2D73465A6A}, Number of Words: 10, Subject: User Profile Wizard Personal Edition, Author: ForensiT, Name of Creating Application: Advanced Installer 17.1.2 build 64c1c160, Template: ;1033, Comments: This installer database contains the logic and data required to install User Profile Wizard Personal Edition., Title: Installation Database, Keywords: Installer, MSI, Database, Number of Pages: 200
MD5:

DB84A6E6AE2A28C32EB7CDE384013CD9

SHA1:

5AA53FD6237C0ED18B98520CCE27AE5C14B2866B

SHA256:

3BAB4A4DA9153A64B829D134029A7E3800B0C90E2489484ABA5B3547BA561E65

SSDEEP:

24576:Lq/YW86JyV3OhVoirgTiAQJhUtpCNGGl8FKDzxVqaLSMTZ9iug4kIHg:Lq/YCMV3eVougTiAQJhUtpLwHxQamMVE

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Application was dropped or rewritten from another process

      • Profwiz.exe (PID: 1328)
      • Profwiz.exe (PID: 2508)
      • UserProfileMigrationService.exe (PID: 1408)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • msiexec.exe (PID: 3676)
      • Profwiz.exe (PID: 1328)

    • Executed as Windows Service

      • UserProfileMigrationService.exe (PID: 1408)

    • Creates files in the program directory

      • Profwiz.exe (PID: 1328)

  • INFO

    • Loads dropped or rewritten executable

      • MsiExec.exe (PID: 2440)
      • MsiExec.exe (PID: 2944)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.msi | Microsoft Windows Installer (81.9)
.mst | Windows SDK Setup Transform Script (9.2)
.msp | Windows Installer Patch (7.6)
.msi | Microsoft Installer (100)

EXIF

FlashPix

LastPrinted: 2009:12:11 11:47:44
CreateDate: 2009:12:11 11:47:44
ModifyDate: 2009:12:11 11:47:44
Security: None
CodePage: Windows Latin 1 (Western European)
RevisionNumber: {E251EAF9-629C-43BC-A73B-FC2D73465A6A}
Words: 10
Subject: User Profile Wizard Personal Edition
Author: ForensiT
LastModifiedBy: -
Software: Advanced Installer 17.1.2 build 64c1c160
Template: ;1033
Comments: This installer database contains the logic and data required to install User Profile Wizard Personal Edition.
Title: Installation Database
Keywords: Installer, MSI, Database
Pages: 200
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
48
Monitored processes
6
Malicious processes
2
Suspicious processes
1

Behavior graph

Click at the process to see the details
start msiexec.exe msiexec.exe no specs msiexec.exe no specs profwiz.exe no specs profwiz.exe userprofilemigrationservice.exe

Process information

PID
CMD
Path
Indicators
Parent process
1328"C:\Users\admin\AppData\Local\Temp\Profwiz.exe" C:\Users\admin\AppData\Local\Temp\Profwiz.exe
MsiExec.exe
User:
admin
Company:
ForensiT Limited
Integrity Level:
HIGH
Description:
ForensiT User Profile Wizard
Exit code:
0
Version:
3.19.1252.0
Modules
Images
c:\users\admin\appdata\local\temp\profwiz.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\netapi32.dll
c:\windows\system32\netutils.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\srvcli.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\wkscli.dll
1408C:\ProgramData\UserProfileMigrationService.exeC:\ProgramData\UserProfileMigrationService.exe
services.exe
User:
SYSTEM
Company:
ForensiT Limited
Integrity Level:
SYSTEM
Description:
ForensiT User Profile Migration Service
Exit code:
0
Version:
3.19.1252.0
Modules
Images
c:\programdata\userprofilemigrationservice.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\netapi32.dll
c:\windows\system32\netutils.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\srvcli.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\wkscli.dll
2440C:\Windows\system32\MsiExec.exe -Embedding 0E243417F1A449150EB6DC76DC038532 CC:\Windows\system32\MsiExec.exe—msiexec.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows® installer
Exit code:
0
Version:
5.0.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\msiexec.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
2508"C:\Users\admin\AppData\Local\Temp\Profwiz.exe" C:\Users\admin\AppData\Local\Temp\Profwiz.exe—MsiExec.exe
User:
admin
Company:
ForensiT Limited
Integrity Level:
MEDIUM
Description:
ForensiT User Profile Wizard
Exit code:
3221226540
Version:
3.19.1252.0
Modules
Images
c:\users\admin\appdata\local\temp\profwiz.exe
c:\systemroot\system32\ntdll.dll
2944C:\Windows\system32\MsiExec.exe -Embedding D0DD5EADF8035E53002E815CADBB5F63C:\Windows\system32\MsiExec.exe—msiexec.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows® installer
Exit code:
0
Version:
5.0.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\msiexec.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
3676"C:\Windows\System32\msiexec.exe" /i "C:\Users\admin\AppData\Local\Temp\Profwiz.msi"C:\Windows\System32\msiexec.exe
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows® installer
Exit code:
0
Version:
5.0.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\msiexec.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
Total events
563
Read events
524
Write events
39
Delete events
0

Modification events

(PID) Process:(3676) msiexec.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\136\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(3676) msiexec.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\136\52C64B7E
Operation:writeName:@%SystemRoot%\system32\p2pcollab.dll,-8042
Value:
Peer to Peer Trust
(PID) Process:(3676) msiexec.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\136\52C64B7E
Operation:writeName:@%SystemRoot%\system32\qagentrt.dll,-10
Value:
System Health Authentication
(PID) Process:(3676) msiexec.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\136\52C64B7E
Operation:writeName:@%SystemRoot%\system32\dnsapi.dll,-103
Value:
Domain Name System (DNS) Server Trust
(PID) Process:(3676) msiexec.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\136\52C64B7E
Operation:writeName:@%SystemRoot%\System32\fveui.dll,-843
Value:
BitLocker Drive Encryption
(PID) Process:(3676) msiexec.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\136\52C64B7E
Operation:writeName:@%SystemRoot%\System32\fveui.dll,-844
Value:
BitLocker Data Recovery Agent
(PID) Process:(2440) MsiExec.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
0
(PID) Process:(2440) MsiExec.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
1
(PID) Process:(1328) Profwiz.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Windows Error Reporting\LocalDumps\Profwiz.exe
Operation:writeName:DumpCount
Value:
16
(PID) Process:(1328) Profwiz.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Windows Error Reporting\LocalDumps\Profwiz.exe
Operation:writeName:DumpFolder
Value:
%ALLUSERSPROFILE%\ForensiT\Error Reporting
Executable files
2
Suspicious files
1
Text files
0
Unknown types
0

Dropped files

PID
Process
Filename
Type
3676msiexec.exeC:\Users\admin\AppData\Local\Temp\MSIC43B.tmp —
MD5:—
SHA256:—
3676msiexec.exeC:\Users\admin\AppData\Local\Temp\MSIC4C8.tmp —
MD5:—
SHA256:—
3676msiexec.exeC:\Users\admin\AppData\Local\Temp\MSIC4D9.tmp —
MD5:—
SHA256:—
3676msiexec.exeC:\Users\admin\AppData\Local\Temp\MSIC518.tmp —
MD5:—
SHA256:—
3676msiexec.exeC:\Users\admin\AppData\Local\Temp\MSIC548.tmp —
MD5:—
SHA256:—
1328Profwiz.exeC:\ProgramData\UserProfileMigrationService.exeexecutable
MD5:—
SHA256:—
1408UserProfileMigrationService.exeC:\ProgramData\Microsoft\Crypto\RSA\S-1-5-18\6d14e4b1d8ca773bab785d1be032546e_90059c37-1320-41a4-b58d-2b75a9850d2fbinary
MD5:—
SHA256:—
3676msiexec.exeC:\Users\admin\AppData\Local\Temp\MSI279D.tmpexecutable
MD5:AF61221C6F4E9AB3AC2440B25D751868
SHA256:1E587D8593152B2538DA7BDCB13880C45D256E84BAA7E94C00EC4DE08AB018D8
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
0
DNS requests
0
Threats
0

HTTP requests

No HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

No data

DNS requests

No data

Threats

No threats detected
Process
Message
Profwiz.exe
Starting service with SERVICE_ALL_ACCESS
UserProfileMigrationService.exe
User Profile Wizard Service Started (Direct.)
Profwiz.exe
Service has started
UserProfileMigrationService.exe
OS build 6.1.7601.
UserProfileMigrationService.exe
/DOMAIN USER-PC /GUI /DS1 /NOJOIN /ACCOUNT admin /LOCALACCOUNT USER-PC\admin
UserProfileMigrationService.exe
admin
UserProfileMigrationService.exe
pwsSourceAccountStringSid: S-1-5-21-1302019708-1500728564-335382590-1000
UserProfileMigrationService.exe
dwFlags: 34
UserProfileMigrationService.exe
pDomainSid: S-1-5-21-1302019708-1500728564-335382590-1000
UserProfileMigrationService.exe
USERS\\Software\Dropbox\ks
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
Profwiz.msi