| File name: | build.msi |
| Full analysis: | https://app.any.run/tasks/985c0ab2-60ee-4652-9707-dba9f30cd804 |
| Verdict: | Malicious activity |
| Threats: | Stealers are a group of malicious software that are intended for gaining unauthorized access to users’ information and transferring it to the attacker. The stealer malware category includes various types of programs that focus on their particular kind of data, including files, passwords, and cryptocurrency. Stealers are capable of spying on their targets by recording their keystrokes and taking screenshots. This type of malware is primarily distributed as part of phishing campaigns. |
| Analysis date: | April 03, 2025, 11:27:01 |
| OS: | Windows 10 Professional (build: 19044, 64 bit) |
| Tags: | |
| Indicators: | |
| MIME: | application/x-msi |
| File info: | Composite Document File V2 Document, Little Endian, Os: Windows, Version 10.0, MSI Installer, Security: 0, Code page: 1252, Revision Number: {286E6677-4C49-4A64-800D-E8808D5A5A7F}, Number of Words: 10, Subject: Tao Raiqsuv Utils, Author: RepairCang, Name of Creating Application: Tao Raiqsuv Utils, Template: ;1033, Comments: This installer database contains the logic and data required to install Tao Raiqsuv Utils., Title: Installation Database, Keywords: Installer, MSI, Database, Create Time/Date: Wed Apr 2 07:11:23 2025, Last Saved Time/Date: Wed Apr 2 07:11:23 2025, Last Printed: Wed Apr 2 07:11:23 2025, Number of Pages: 450 |
| MD5: | 4A13B683B32AD3AC7D99EECD1EAB95D8 |
| SHA1: | DC043AAD9DF7D33899C64531DE704569A3CCCCF2 |
| SHA256: | 40F92CDBBFDC7164FE1799922305CEE481F7115DC4BAE781D3D8E54A725BB4FF |
| SSDEEP: | 393216:HKnASMEBpP3gYVej7/mmvcEVN4XQ/tHQxO6:x5EcYG7TvcEVag/tIO |
MALICIOUS
GENERIC has been found (auto)
- msiexec.exe (PID: 7516)
Actions looks like stealing of personal data
- launcher.exe (PID: 7892)
SUSPICIOUS
Reads the Windows owner or organization settings
- msiexec.exe (PID: 7516)
Reads security settings of Internet Explorer
- msiexec.exe (PID: 7604)
- launcher.exe (PID: 7892)
Drops 7-zip archiver for unpacking
- msiexec.exe (PID: 7516)
Process drops legitimate windows executable
- msiexec.exe (PID: 7516)
There is functionality for taking screenshot (YARA)
- launcher.exe (PID: 7892)
INFO
Reads the computer name
- msiexec.exe (PID: 7516)
- msiexec.exe (PID: 7604)
- launcher.exe (PID: 7892)
An automatically generated document
- msiexec.exe (PID: 7440)
Reads Environment values
- msiexec.exe (PID: 7604)
Checks supported languages
- msiexec.exe (PID: 7604)
- msiexec.exe (PID: 7516)
- launcher.exe (PID: 7892)
The sample compiled with english language support
- msiexec.exe (PID: 7516)
Checks proxy server information
- msiexec.exe (PID: 7604)
- slui.exe (PID: 6392)
Reads the machine GUID from the registry
- msiexec.exe (PID: 7604)
Creates files or folders in the user directory
- msiexec.exe (PID: 7604)
- msiexec.exe (PID: 7516)
- launcher.exe (PID: 7892)
Reads the software policy settings
- msiexec.exe (PID: 7604)
Executable content was dropped or overwritten
- msiexec.exe (PID: 7516)
The sample compiled with japanese language support
- msiexec.exe (PID: 7516)
The sample compiled with german language support
- msiexec.exe (PID: 7516)
Creates a software uninstall entry
- msiexec.exe (PID: 7516)
Reads CPU info
- launcher.exe (PID: 7892)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
TRiD
| .msi | | | Microsoft Windows Installer (88.6) |
|---|---|---|
| .mst | | | Windows SDK Setup Transform Script (10) |
| .msi | | | Microsoft Installer (100) |
EXIF
FlashPix
| Security: | None |
|---|---|
| CodePage: | Windows Latin 1 (Western European) |
| RevisionNumber: | {286E6677-4C49-4A64-800D-E8808D5A5A7F} |
| Words: | 10 |
| Subject: | Tao Raiqsuv Utils |
| Author: | RepairCang |
| LastModifiedBy: | - |
| Software: | Tao Raiqsuv Utils |
| Template: | ;1033 |
| Comments: | This installer database contains the logic and data required to install Tao Raiqsuv Utils. |
| Title: | Installation Database |
| Keywords: | Installer, MSI, Database |
| CreateDate: | 2025:04:02 07:11:23 |
| ModifyDate: | 2025:04:02 07:11:23 |
| LastPrinted: | 2025:04:02 07:11:23 |
| Pages: | 450 |
Total processes
131
Monitored processes
5
Malicious processes
2
Suspicious processes
0
Behavior graph
Click at the process to see the details
Process information
PID | CMD | Path | Indicators | Parent process | |||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 6392 | C:\WINDOWS\System32\slui.exe -Embedding | C:\Windows\System32\slui.exe | svchost.exe | ||||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows Activation Client Exit code: 0 Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 7440 | "C:\Windows\System32\msiexec.exe" /i C:\Users\admin\AppData\Local\Temp\build.msi | C:\Windows\System32\msiexec.exe | — | explorer.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows® installer Exit code: 0 Version: 5.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 7516 | C:\WINDOWS\system32\msiexec.exe /V | C:\Windows\System32\msiexec.exe | services.exe | ||||||||||||
User: SYSTEM Company: Microsoft Corporation Integrity Level: SYSTEM Description: Windows® installer Version: 5.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 7604 | C:\Windows\syswow64\MsiExec.exe -Embedding AD0C4335F82FBFC03C1E4663517EDAEE | C:\Windows\SysWOW64\msiexec.exe | msiexec.exe | ||||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows® installer Exit code: 0 Version: 5.0.19041.3636 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 7892 | "C:\Users\admin\AppData\Roaming\RepairCang\Tao Raiqsuv Utils\launcher.exe" | C:\Users\admin\AppData\Roaming\RepairCang\Tao Raiqsuv Utils\launcher.exe | msiexec.exe | ||||||||||||
User: admin Company: Krzysztof Kowalczyk Integrity Level: MEDIUM Description: SumatraPDF Version: 3.5.2 Modules
| |||||||||||||||
Total events
13 232
Read events
12 993
Write events
226
Delete events
13
Modification events
| (PID) Process: | (7516) msiexec.exe | Key: | HKEY_USERS\S-1-5-21-1693682860-607145093-2874071422-1001\SOFTWARE\Microsoft\RestartManager\Session0000 |
| Operation: | write | Name: | Owner |
Value: 5C1D000010CD1A728BA4DB01 | |||
| (PID) Process: | (7516) msiexec.exe | Key: | HKEY_USERS\S-1-5-21-1693682860-607145093-2874071422-1001\SOFTWARE\Microsoft\RestartManager\Session0000 |
| Operation: | write | Name: | SessionHash |
Value: 40D1AA696EED62273C87AD6D7D83568B17FD0F513891DBAA0097675757E73071 | |||
| (PID) Process: | (7516) msiexec.exe | Key: | HKEY_USERS\S-1-5-21-1693682860-607145093-2874071422-1001\SOFTWARE\Microsoft\RestartManager\Session0000 |
| Operation: | write | Name: | Sequence |
Value: 1 | |||
| (PID) Process: | (7604) msiexec.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content |
| Operation: | write | Name: | CachePrefix |
Value: | |||
| (PID) Process: | (7604) msiexec.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies |
| Operation: | write | Name: | CachePrefix |
Value: Cookie: | |||
| (PID) Process: | (7604) msiexec.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History |
| Operation: | write | Name: | CachePrefix |
Value: Visited: | |||
| (PID) Process: | (7516) msiexec.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Folders |
| Operation: | write | Name: | C:\Users\admin\AppData\Roaming\RepairCang\Tao Raiqsuv Utils\locales\ |
Value: | |||
| (PID) Process: | (7516) msiexec.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Folders |
| Operation: | write | Name: | C:\Users\admin\AppData\Roaming\RepairCang\Tao Raiqsuv Utils\resources\extras\automator-workflows\Open Tabby here.workflow\Contents\QuickLook\ |
Value: | |||
| (PID) Process: | (7516) msiexec.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Folders |
| Operation: | write | Name: | C:\Users\admin\AppData\Roaming\RepairCang\Tao Raiqsuv Utils\resources\extras\automator-workflows\Open Tabby here.workflow\Contents\_CodeSignature\ |
Value: | |||
| (PID) Process: | (7516) msiexec.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Folders |
| Operation: | write | Name: | C:\Users\admin\AppData\Roaming\RepairCang\Tao Raiqsuv Utils\resources\extras\automator-workflows\Paste path into Tabby.workflow\Contents\ |
Value: | |||
Executable files
38
Suspicious files
59
Text files
21
Unknown types
0
Dropped files
PID | Process | Filename | Type | |
|---|---|---|---|---|
| 7516 | msiexec.exe | C:\Windows\Installer\10dcb6.msi | — | |
MD5:— | SHA256:— | |||
| 7604 | msiexec.exe | C:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B2FAF7692FD9FFBD64EDE317E42334BA_0E7D957F8CAC4DE448BF5D34E62E9B04 | — | |
MD5:— | SHA256:— | |||
| 7516 | msiexec.exe | C:\Windows\Installer\MSIDFE3.tmp | executable | |
MD5:EE09D6A1BB908B42C05FD0BEEB67DFD2 | SHA256:7BBF611F5E2A16439DC8CD11936F6364F6D5CC0044545C92775DA5646AFC7752 | |||
| 7516 | msiexec.exe | C:\Windows\Installer\MSIE39F.tmp | executable | |
MD5:FFDAACB43C074A8CB9A608C612D7540B | SHA256:7484797EA4480BC71509FA28B16E607F82323E05C44F59FFA65DB3826ED1B388 | |||
| 7604 | msiexec.exe | C:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\02460F0C5E46824211DA37830EBE26EF | binary | |
MD5:D26D6BD11A36EF4F1F576A480B7F3F4D | SHA256:F4FD657E8003E87683234CF2D9DCEC92E57CE71616087868F4C820781152EDFA | |||
| 7516 | msiexec.exe | C:\Windows\Installer\MSIE256.tmp | executable | |
MD5:EE09D6A1BB908B42C05FD0BEEB67DFD2 | SHA256:7BBF611F5E2A16439DC8CD11936F6364F6D5CC0044545C92775DA5646AFC7752 | |||
| 7604 | msiexec.exe | C:\Users\admin\AppData\Local\Microsoft\Windows\INetCache\IE\RR3E01RZ\diagnostics[1].htm | binary | |
MD5:CFCD208495D565EF66E7DFF9F98764DA | SHA256:5FECEB66FFC86F38D952786C6D696C79C2DBC239DD4E91B46729D73A27FB57E9 | |||
| 7516 | msiexec.exe | C:\Windows\Installer\MSIDDDF.tmp | executable | |
MD5:EE09D6A1BB908B42C05FD0BEEB67DFD2 | SHA256:7BBF611F5E2A16439DC8CD11936F6364F6D5CC0044545C92775DA5646AFC7752 | |||
| 7516 | msiexec.exe | C:\Users\admin\AppData\Roaming\RepairCang\Tao Raiqsuv Utils\7z.exe | executable | |
MD5:B6D5860F368B28CAA9DD14A51666A5CD | SHA256:E2CA3EC168AE9C0B4115CD4FE220145EA9B2DC4B6FC79D765E91F415B34D00DE | |||
| 7516 | msiexec.exe | C:\Users\admin\AppData\Roaming\RepairCang\Tao Raiqsuv Utils\mksSandbox.exe | executable | |
MD5:32D4F18844BB58AD0EDED3931CB4022F | SHA256:24B08EDA5DA534A3389718241DB384B7BDFA3FDCD6AD126D03B436069E2AE845 | |||
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
6
TCP/UDP connections
24
DNS requests
17
Threats
0
HTTP requests
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
|---|---|---|---|---|---|---|---|---|---|
5496 | MoUsoCoreWorker.exe | GET | 200 | 23.216.77.4:80 | http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl | unknown | — | — | whitelisted |
7604 | msiexec.exe | GET | 200 | 172.64.149.23:80 | http://ocsp.comodoca.com/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBRTtU9uFqgVGHhJwXZyWCNXmVR5ngQUoBEKIz6W8Qfs4q8p74Klf9AwpLQCEQCtjS32RoGg02RH6qlPonPB | unknown | — | — | whitelisted |
7604 | msiexec.exe | GET | 200 | 18.244.18.54:80 | http://crls.ssl.com/SSL.com-TLS-T-ECC-R2.crl | unknown | — | — | whitelisted |
6544 | svchost.exe | GET | 200 | 2.17.190.73:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D | unknown | — | — | whitelisted |
8100 | SIHClient.exe | GET | 200 | 95.101.149.131:80 | http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl | unknown | — | — | whitelisted |
8100 | SIHClient.exe | GET | 200 | 95.101.149.131:80 | http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl | unknown | — | — | whitelisted |
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
Connections
PID | Process | IP | Domain | ASN | CN | Reputation |
|---|---|---|---|---|---|---|
4 | System | 192.168.100.255:137 | — | — | — | whitelisted |
— | — | 40.127.240.158:443 | — | MICROSOFT-CORP-MSN-AS-BLOCK | IE | unknown |
5496 | MoUsoCoreWorker.exe | 23.216.77.4:80 | crl.microsoft.com | Akamai International B.V. | DE | whitelisted |
4 | System | 192.168.100.255:138 | — | — | — | whitelisted |
— | — | 172.172.255.217:443 | client.wns.windows.com | MICROSOFT-CORP-MSN-AS-BLOCK | US | whitelisted |
7604 | msiexec.exe | 104.21.96.1:443 | korinpc.com | CLOUDFLARENET | — | unknown |
7604 | msiexec.exe | 172.64.149.23:80 | ocsp.comodoca.com | CLOUDFLARENET | US | whitelisted |
7604 | msiexec.exe | 18.244.18.54:80 | crls.ssl.com | — | US | whitelisted |
6544 | svchost.exe | 20.190.160.128:443 | login.live.com | MICROSOFT-CORP-MSN-AS-BLOCK | NL | whitelisted |
6544 | svchost.exe | 2.17.190.73:80 | ocsp.digicert.com | AKAMAI-AS | DE | whitelisted |
DNS requests
Domain | IP | Reputation |
|---|---|---|
crl.microsoft.com |
| whitelisted |
google.com |
| whitelisted |
client.wns.windows.com |
| whitelisted |
korinpc.com |
| unknown |
ocsp.comodoca.com |
| whitelisted |
crls.ssl.com |
| whitelisted |
login.live.com |
| whitelisted |
ocsp.digicert.com |
| whitelisted |
settings-win.data.microsoft.com |
| whitelisted |
slscr.update.microsoft.com |
| whitelisted |