File name:

TribulusTerrestres01.msi

Full analysis: https://app.any.run/tasks/b9877e11-13d4-48d9-b528-63712d487d8b
Verdict: Malicious activity
Analysis date: June 27, 2022, 10:58:01
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
generated-doc
Indicators:
MIME: application/x-msi
File info: Composite Document File V2 Document, Little Endian, Os: Windows, Version 10.0, MSI Installer, Last Printed: Fri Dec 11 11:47:44 2009, Create Time/Date: Fri Dec 11 11:47:44 2009, Last Saved Time/Date: Fri Dec 11 11:47:44 2009, Security: 0, Code page: 1252, Revision Number: {DD6D8E82-46D3-456D-AEE3-6CBE34B72183}, Number of Words: 10, Subject: Installer, Author: Installer, Name of Creating Application: Installer 64247, Template: ;1033, Title: Installation Database, Keywords: Installer, MSI, Database, Number of Pages: 200
MD5:

D6D1E2E887EC9496A1195C722BB9281A

SHA1:

DF4904313082C7A4294A4292B72E58F5183017A2

SHA256:

3CABD5F4059D1B665F5461663C4289A7CEDF1E1A56481A2A43CF958A30E77E06

SSDEEP:

98304:IezS5Chbr9cvcTfrwlZof5mtsIWmOYpA:IzU7ycTDw7of53pm

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Drops executable file immediately after starts

      • msiexec.exe (PID: 880)

  • SUSPICIOUS

    • Reads the Windows organization settings

      • msiexec.exe (PID: 880)
      • msiexec.exe (PID: 1056)

    • Reads the computer name

      • msiexec.exe (PID: 880)
      • MsiExec.exe (PID: 2724)

    • Reads Windows owner or organization settings

      • msiexec.exe (PID: 1056)
      • msiexec.exe (PID: 880)

    • Checks supported languages

      • msiexec.exe (PID: 880)
      • MsiExec.exe (PID: 2724)

    • Executable content was dropped or overwritten

      • msiexec.exe (PID: 880)

    • Drops a file with a compile date too recent

      • msiexec.exe (PID: 880)

  • INFO

    • Reads the computer name

      • msiexec.exe (PID: 1056)

    • Checks supported languages

      • msiexec.exe (PID: 1056)

    • Application launched itself

      • msiexec.exe (PID: 880)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.msi | Microsoft Windows Installer (84.6)
.mst | Windows SDK Setup Transform Script (9.5)
.xls | Microsoft Excel sheet (4.5)
.msi | Microsoft Installer (100)

EXIF

FlashPix

Pages: 200
Keywords: Installer, MSI, Database
Title: Installation Database
Comments: -
Template: ;1033
Software: Installer 64247
LastModifiedBy: -
Author: Installer
Subject: Installer
Words: 10
RevisionNumber: {DD6D8E82-46D3-456D-AEE3-6CBE34B72183}
CodePage: Windows Latin 1 (Western European)
Security: None
ModifyDate: 2009:12:11 11:47:44
CreateDate: 2009:12:11 11:47:44
LastPrinted: 2009:12:11 11:47:44
No data.
screenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
35
Monitored processes
3
Malicious processes
1
Suspicious processes
0

Behavior graph

Click at the process to see the details
start msiexec.exe no specs msiexec.exe msiexec.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
880C:\Windows\system32\msiexec.exe /VC:\Windows\system32\msiexec.exe
services.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Windows® installer
Exit code:
0
Version:
5.0.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\msiexec.exe
c:\windows\system32\kernel32.dll
c:\windows\system32\ntdll.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
1056"C:\Windows\System32\msiexec.exe" /i "C:\Users\admin\AppData\Local\Temp\TribulusTerrestres01.msi"C:\Windows\System32\msiexec.exe—Explorer.EXE
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows® installer
Exit code:
0
Version:
5.0.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\msiexec.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
2724C:\Windows\system32\MsiExec.exe -Embedding D0BB8556C4A50332270520F1DB637181C:\Windows\system32\MsiExec.exe—msiexec.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows® installer
Exit code:
0
Version:
5.0.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\msiexec.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
Total events
2 001
Read events
1 979
Write events
10
Delete events
12

Modification events

(PID) Process:(880) msiexec.exeKey:HKEY_USERS\S-1-5-21-1302019708-1500728564-335382590-1000\Software\Microsoft\RestartManager\Session0000
Operation:writeName:Owner
Value:
70030000B0E757C9148AD801
(PID) Process:(880) msiexec.exeKey:HKEY_USERS\S-1-5-21-1302019708-1500728564-335382590-1000\Software\Microsoft\RestartManager\Session0000
Operation:writeName:SessionHash
Value:
88B55249E9EC6C04436B4A355FED00561AE5DDC73ACA5F3ECB5AC091861885E3
(PID) Process:(880) msiexec.exeKey:HKEY_USERS\S-1-5-21-1302019708-1500728564-335382590-1000\Software\Microsoft\RestartManager\Session0000
Operation:writeName:Sequence
Value:
1
(PID) Process:(880) msiexec.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\InProgress
Operation:writeName:(default)
Value:
C:\Windows\Installer\f9fb3.ipi
(PID) Process:(880) msiexec.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Folders
Operation:writeName:C:\Config.Msi\
Value:
(PID) Process:(880) msiexec.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Rollback\Scripts
Operation:writeName:C:\Config.Msi\f9fb4.rbs
Value:
30968349
(PID) Process:(880) msiexec.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Rollback\Scripts
Operation:writeName:C:\Config.Msi\f9fb4.rbsLow
Value:
729525696
(PID) Process:(880) msiexec.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-21-1302019708-1500728564-335382590-1000\Components\5A17B9C9A2D3B63458E41EF38F50D086
Operation:writeName:AFB5490E8ED44EA4784B8455AB156AA1
Value:
01:\Software\CODE ERROR 02x71241\CODE ERROR 02x71241\Version
(PID) Process:(880) msiexec.exeKey:HKEY_USERS\S-1-5-21-1302019708-1500728564-335382590-1000\Software\CODE ERROR 02x71241\CODE ERROR 02x71241
Operation:writeName:Version
Value:
11.0.0.25
(PID) Process:(880) msiexec.exeKey:HKEY_USERS\S-1-5-21-1302019708-1500728564-335382590-1000\Software\CODE ERROR 02x71241\CODE ERROR 02x71241
Operation:writeName:Path
Value:
C:\Users\admin\AppData\Roaming\CODE ERROR 02x71241\CODE ERROR 02x71241\
Executable files
3
Suspicious files
4
Text files
0
Unknown types
3

Dropped files

PID
Process
Filename
Type
880msiexec.exeC:\Windows\Installer\f9fb1.msi —
MD5:—
SHA256:—
880msiexec.exeC:\Windows\Installer\f9fb3.ipibinary
MD5:—
SHA256:—
880msiexec.exeC:\Windows\Installer\MSIA159.tmpbinary
MD5:—
SHA256:—
880msiexec.exeC:\Windows\Installer\MSIA1A9.tmpexecutable
MD5:—
SHA256:—
880msiexec.exeC:\Windows\Installer\SourceHash{E0945BFA-4DE8-4AE4-87B4-4855BA51A61A}binary
MD5:—
SHA256:—
880msiexec.exeC:\Users\admin\AppData\Local\Temp\~DFC2770D9AC4D595AA.TMPgmc
MD5:BF619EAC0CDF3F68D496EA9344137E8B
SHA256:076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
880msiexec.exeC:\Windows\Installer\MSIA08D.tmpexecutable
MD5:9F1E5D66C2889018DAEF4AEF604EEBC4
SHA256:02A81AEA451CDFA2CD6668E3B814C4E50C6025E36B70AB972A8CC68ABA5B3222
880msiexec.exeC:\Config.Msi\f9fb4.rbsbinary
MD5:—
SHA256:—
880msiexec.exeC:\Users\admin\AppData\Local\Temp\~DF92615CEB22C6C16C.TMPgmc
MD5:—
SHA256:—
880msiexec.exeC:\Users\admin\AppData\Local\Temp\~DF61000A9BCAB9D9FF.TMPgmc
MD5:—
SHA256:—
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
0
DNS requests
0
Threats
0

HTTP requests

No HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

No data

DNS requests

No data

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
TribulusTerrestres01.msi