analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
File name:

48b8d9ebc4b8d00d258b223732c8fafc1e2b935f7064df9d6520b68c04418c38

Full analysis: https://app.any.run/tasks/89f7f34b-da7c-4b89-912d-84078ed3c040
Verdict: Malicious activity
Threats:

Agent Tesla is spyware that collects information about the actions of its victims by recording keystrokes and user interactions. It is falsely marketed as a legitimate software on the dedicated website where this malware is sold.

Malware Trends Tracker     >>>
Analysis date: April 25, 2019, 16:37:31
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
generated-doc
evasion
trojan
rat
agenttesla
Indicators:
MIME: application/x-msi
File info: Composite Document File V2 Document, Little Endian, Os: Windows, Version 10.0, MSI Installer, Code page: 1252, Title: Microsoft .NET Framework 4 Client Profile 4.0.30319.0, Subject: Microsoft .NET Framework 4 Client Profile, Author: Microsoft Corporation, Keywords: Installer, Template: Intel;1033, Revision Number: {EECF31ED-6347-4845-83CA-CB7F67FDE2C8}, Create Time/Date: Mon Aug 13 19:00:06 2018, Last Saved Time/Date: Mon Aug 13 19:00:06 2018, Number of Pages: 200, Number of Words: 12, Name of Creating Application: MSI Wrapper (8.0.26.0), Security: 2
MD5:

AA16EBC633DFDE159A23B83F7F77E4F3

SHA1:

5A48311FB7F5EBEC1F84639EF57E17935D7ACC2C

SHA256:

48B8D9EBC4B8D00D258B223732C8FAFC1E2B935F7064DF9D6520B68C04418C38

SSDEEP:

98304:G43dxBvxBvxBvxBvxB1FYwBvxBvxBfrOxB02vjdJnHbBLK33Fs2FH72lqm:VF56bdJSK2FqlB

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Writes to a start menu file

      • cmd.exe (PID: 4084)

    • Application was dropped or rewritten from another process

      • Edge.exe (PID: 764)
      • MicrosoftEdge.exe (PID: 2244)

    • AGENTTESLA was detected

      • MicrosoftEdge.exe (PID: 2244)

  • SUSPICIOUS

    • Creates files in the user directory

      • cmd.exe (PID: 4084)

    • Executable content was dropped or overwritten

      • msiexec.exe (PID: 4060)
      • Edge.exe (PID: 764)
      • expand.exe (PID: 3292)
      • cmd.exe (PID: 4084)

    • Starts CMD.EXE for commands execution

      • Edge.exe (PID: 764)
      • MicrosoftEdge.exe (PID: 2244)

    • Reads Environment values

      • MicrosoftEdge.exe (PID: 2244)

    • Checks for external IP

      • MicrosoftEdge.exe (PID: 2244)

    • Uses WMIC.EXE to obtain a list of AntiViruses

      • cmd.exe (PID: 1736)

  • INFO

    • Low-level read access rights to disk partition

      • vssvc.exe (PID: 4068)

    • Adds / modifies Windows certificates

      • DrvInst.exe (PID: 3276)

    • Application launched itself

      • msiexec.exe (PID: 4060)

    • Searches for installed software

      • msiexec.exe (PID: 4060)

    • Changes settings of System certificates

      • DrvInst.exe (PID: 3276)

    • Reads settings of System Certificates

      • MicrosoftEdge.exe (PID: 2244)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.msi | Microsoft Windows Installer (98.5)
.msi | Microsoft Installer (100)

EXIF

FlashPix

Category: -
Company: Microsoft Corporation
LocaleIndicator: 1025
CodePage: Unicode UTF-16, little endian
Security: Read-only recommended
Software: MSI Wrapper (8.0.26.0)
Words: 12
Pages: 200
ModifyDate: 2018:08:13 18:00:06
CreateDate: 2018:08:13 18:00:06
RevisionNumber: {EECF31ED-6347-4845-83CA-CB7F67FDE2C8}
Template: Intel;1033
Comments: -
Keywords: Installer
Author: Microsoft Corporation
Subject: Microsoft .NET Framework 4 Client Profile
Title: Microsoft .NET Framework 4 Client Profile 4.0.30319.0
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
49
Monitored processes
12
Malicious processes
2
Suspicious processes
2

Behavior graph

Click at the process to see the details
start drop and start msiexec.exe no specs msiexec.exe vssvc.exe no specs drvinst.exe no specs msiexec.exe no specs expand.exe edge.exe cmd.exe #AGENTTESLA microsoftedge.exe explorer.exe no specs cmd.exe no specs wmic.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
1712"C:\Windows\System32\msiexec.exe" /i "C:\Users\admin\AppData\Local\Temp\48b8d9ebc4b8d00d258b223732c8fafc1e2b935f7064df9d6520b68c04418c38.msi"C:\Windows\System32\msiexec.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows® installer
Exit code:
1603
Version:
5.0.7600.16385 (win7_rtm.090713-1255)
4060C:\Windows\system32\msiexec.exe /VC:\Windows\system32\msiexec.exe
services.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Windows® installer
Version:
5.0.7600.16385 (win7_rtm.090713-1255)
4068C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe—services.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Microsoft® Volume Shadow Copy Service
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
3276DrvInst.exe "1" "200" "STORAGE\VolumeSnapshot\HarddiskVolumeSnapshot18" "" "" "6792c44eb" "00000000" "000004C0" "000004AC"C:\Windows\system32\DrvInst.exe—svchost.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Driver Installation Module
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
3588C:\Windows\system32\MsiExec.exe -Embedding 74F3D08EC0C0A3A4C949DC99E9226327C:\Windows\system32\MsiExec.exe—msiexec.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows® installer
Exit code:
0
Version:
5.0.7600.16385 (win7_rtm.090713-1255)
3292"C:\Windows\System32\expand.exe" -R files.cab -F:* filesC:\Windows\System32\expand.exe
MsiExec.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
LZ Expansion Utility
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
764"C:\Users\admin\AppData\Local\Temp\MW-71af44d9-bda8-44ae-ba5f-862048c8b3e7\files\Edge.exe" C:\Users\admin\AppData\Local\Temp\MW-71af44d9-bda8-44ae-ba5f-862048c8b3e7\files\Edge.exe
MsiExec.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
4084C:\Windows\system32\cmd.exe /c type %temp%\MicrosoftEdge.exe > "%appdata%\Microsoft\Windows\Start Menu\Programs\Startup\MicrosoftEdge.exe"C:\Windows\system32\cmd.exe
Edge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
2244C:\Users\admin\AppData\Local\Temp/MicrosoftEdge.exeC:\Users\admin\AppData\Local\Temp\MicrosoftEdge.exe
Edge.exe
User:
admin
Integrity Level:
MEDIUM
Description:
Client
Version:
1.0.0.0
1924"C:\Windows\explorer.exe" C:\Windows\explorer.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Explorer
Exit code:
1
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Total events
971
Read events
764
Write events
0
Delete events
0

Modification events

No data
Executable files
5
Suspicious files
7
Text files
139
Unknown types
0

Dropped files

PID
Process
Filename
Type
4060msiexec.exeC:\System Volume Information\SPP\metadata-2 —
MD5:—
SHA256:—
3276DrvInst.exeC:\Windows\INF\setupapi.dev.logini
MD5:9464FB4CE1C45D27D55F4891EBAF2A35
SHA256:B3E7FCBBCB83B3C0AE44120A5F5521C5C874AC6D787D2746CF76D3D39DD7C17D
4060msiexec.exeC:\System Volume Information\SPP\snapshot-2binary
MD5:6EFB7F19FE204D978D7BA5A5689FA29B
SHA256:F30564527E87D54D87B1065A023C1D18B23F566FA48D592F463E0DE08DA37A3F
4060msiexec.exeC:\System Volume Information\SPP\OnlineMetadataCache\{6b566f60-2c49-450c-92a2-6856d6aa51b3}_OnDiskSnapshotPropbinary
MD5:6EFB7F19FE204D978D7BA5A5689FA29B
SHA256:F30564527E87D54D87B1065A023C1D18B23F566FA48D592F463E0DE08DA37A3F
3276DrvInst.exeC:\Windows\INF\setupapi.ev3binary
MD5:76DCC60F78B3DFF1AE3627619074F465
SHA256:18541AC1875315C4F9EFF75050C574FAFF83717C029DAE6B366F9C6C3F0C19E0
3276DrvInst.exeC:\Windows\INF\setupapi.ev1binary
MD5:A67BAD5D7C3202ABB72802455E1228A4
SHA256:511E614DE046CF611482BC8B0281BA04F990EA1F7A96E2A0C78BD461DBEE79AF
4060msiexec.exeC:\Users\admin\AppData\Local\Temp\~DF5F3EBB025DA44A3C.TMP —
MD5:—
SHA256:—
3292expand.exeC:\Users\admin\AppData\Local\Temp\MW-71af44d9-bda8-44ae-ba5f-862048c8b3e7\files\$dpx$.tmp\6924815e859b994bbfc387733c3ee6d6.tmp —
MD5:—
SHA256:—
4068vssvc.exeC: —
MD5:—
SHA256:—
764Edge.exeC:\Users\admin\AppData\Local\Temp\autC63A.tmp —
MD5:—
SHA256:—
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
1
TCP/UDP connections
3
DNS requests
2
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
2244
MicrosoftEdge.exe
GET
200
52.206.161.133:80
http://checkip.amazonaws.com/
US
text
14 b
shared
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
2244
MicrosoftEdge.exe
172.217.21.234:443
www.googleapis.com
Google Inc.
US
whitelisted
2244
MicrosoftEdge.exe
52.206.161.133:80
checkip.amazonaws.com
Amazon.com, Inc.
US
shared

DNS requests

Domain
IP
Reputation
www.googleapis.com
  • 172.217.21.234
  • 172.217.22.10
  • 172.217.18.10
  • 172.217.18.170
  • 216.58.206.10
  • 216.58.207.42
  • 172.217.16.170
  • 216.58.208.42
  • 172.217.16.138
  • 172.217.22.74
  • 216.58.210.10
  • 172.217.16.202
  • 172.217.18.106
  • 172.217.23.170
  • 216.58.205.234
whitelisted
checkip.amazonaws.com
  • 52.206.161.133
  • 52.200.125.74
  • 18.211.215.84
  • 52.6.79.229
  • 34.233.102.38
  • 52.202.139.131
shared

Threats

PID
Process
Class
Message
2244
MicrosoftEdge.exe
A Network Trojan was detected
MALWARE [PTsecurity] AgentTesla IP Check
2 ETPRO signatures available at the full report
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2024 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
48b8d9ebc4b8d00d258b223732c8fafc1e2b935f7064df9d6520b68c04418c38