File name:

SecureExamBrowserInstaller_en_1.5.5.msi

Full analysis: https://app.any.run/tasks/fa0708da-c247-4fa7-a271-ac460acd5692
Verdict: Malicious activity
Analysis date: September 01, 2024, 03:52:26
OS: Windows 10 Professional (build: 19045, 64 bit)
Indicators:
MIME: application/x-msi
File info: Composite Document File V2 Document, Little Endian, Os: Windows, Version 10.0, MSI Installer, Create Time/Date: Mon Jun 21 07:00:00 1999, Name of Creating Application: Windows Installer, Security: 1, Code page: 1252, Template: x64;1033, Number of Pages: 200, Revision Number: {826F7769-1D9D-4166-8AD2-D74B0968935B}, Title: SecureExamBrowserInstaller, Author: Hirepro, Comments: Secure Exam Browser, Number of Words: 2, Last Saved Time/Date: Fri Mar 8 02:48:38 2024, Last Printed: Fri Mar 8 02:48:38 2024
MD5:

C9C01A9459906E0B8A860FFEE4366703

SHA1:

7ECF851C1B9625BD22DD2A8576E4FF0C65F5E989

SHA256:

48BAF16D61CFDB060F9B2FD9DE898BECDD9AB742715636743A83AC0AEE00D3C4

SSDEEP:

98304:xxOK0el1ey6lF0hXLROiMGzAeinz8yFLau7gfd5GXbD2GyM9irvqLo9G0RNW7eQ6:Tyedrh0jyK

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    No malicious indicators.

  • SUSPICIOUS

    • Executes as Windows Service

      • VSSVC.exe (PID: 6912)
      • SebWindowsServiceWCF.exe (PID: 6356)

    • Process drops legitimate windows executable

      • msiexec.exe (PID: 6440)
      • msiexec.exe (PID: 6676)

    • Reads the Windows owner or organization settings

      • msiexec.exe (PID: 6440)

    • Checks Windows Trust Settings

      • msiexec.exe (PID: 6440)

    • Drops the executable file immediately after the start

      • msiexec.exe (PID: 6440)

    • The process creates files with name similar to system file names

      • msiexec.exe (PID: 6440)

    • Changes default file association

      • msiexec.exe (PID: 6440)

    • Reads security settings of Internet Explorer

      • msiexec.exe (PID: 6580)

  • INFO

    • Reads the computer name

      • msiexec.exe (PID: 7052)
      • msiexec.exe (PID: 6440)
      • msiexec.exe (PID: 6816)
      • msiexec.exe (PID: 6580)
      • SebWindowsServiceWCF.exe (PID: 6356)

    • Executable content was dropped or overwritten

      • msiexec.exe (PID: 6676)
      • msiexec.exe (PID: 6440)

    • Reads the software policy settings

      • msiexec.exe (PID: 6676)
      • msiexec.exe (PID: 6440)

    • Checks supported languages

      • msiexec.exe (PID: 6440)
      • msiexec.exe (PID: 6816)
      • msiexec.exe (PID: 6580)
      • SebWindowsServiceWCF.exe (PID: 6356)
      • msiexec.exe (PID: 7052)

    • Reads security settings of Internet Explorer

      • msiexec.exe (PID: 6676)

    • Checks proxy server information

      • msiexec.exe (PID: 6676)

    • Reads the machine GUID from the registry

      • msiexec.exe (PID: 6440)
      • msiexec.exe (PID: 6580)
      • SebWindowsServiceWCF.exe (PID: 6356)

    • Create files in a temporary directory

      • msiexec.exe (PID: 6816)
      • msiexec.exe (PID: 7052)

    • Creates files in the program directory

      • SebWindowsServiceWCF.exe (PID: 6356)

    • The process uses the downloaded file

      • msiexec.exe (PID: 6580)

    • Creates a software uninstall entry

      • msiexec.exe (PID: 6440)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.msi | Microsoft Windows Installer (90.2)
.msp | Windows Installer Patch (8.4)
.msi | Microsoft Installer (100)

EXIF

FlashPix

CreateDate: 1999:06:21 07:00:00
Software: Windows Installer
Security: Password protected
CodePage: Windows Latin 1 (Western European)
Template: x64;1033
Pages: 200
RevisionNumber: {826F7769-1D9D-4166-8AD2-D74B0968935B}
Title: SecureExamBrowserInstaller
Subject: -
Author: Hirepro
Keywords: -
Comments: Secure Exam Browser
Words: 2
ModifyDate: 2024:03:08 02:48:38
LastPrinted: 2024:03:08 02:48:38
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
136
Monitored processes
9
Malicious processes
1
Suspicious processes
0

Behavior graph

Click at the process to see the details
start msiexec.exe msiexec.exe msiexec.exe no specs vssvc.exe no specs srtasks.exe no specs conhost.exe no specs msiexec.exe no specs msiexec.exe no specs sebwindowsservicewcf.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
788\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—SrTasks.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
6356"C:\Program Files (x86)\SecureExamBrowser\SebWindowsServiceWCF.exe"C:\Program Files (x86)\SecureExamBrowser\SebWindowsServiceWCF.exe—services.exe
User:
SYSTEM
Company:
ETH Zurich
Integrity Level:
SYSTEM
Description:
SEB Windows Service with WCF
Version:
2.2.8833.14950
Modules
Images
c:\program files (x86)\secureexambrowser\sebwindowsservicewcf.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\mscoree.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
6440C:\WINDOWS\system32\msiexec.exe /VC:\Windows\System32\msiexec.exe
services.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Windows® installer
Version:
5.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\msiexec.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\aclayers.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
6580C:\Windows\syswow64\MsiExec.exe -Embedding 680522A8988F3525D2F28962E40D1AED E Global\MSI0000C:\Windows\SysWOW64\msiexec.exe—msiexec.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Windows® installer
Exit code:
0
Version:
5.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\msiexec.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\aclayers.dll
6640C:\WINDOWS\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:11C:\Windows\System32\SrTasks.exe—msiexec.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Microsoft® Windows System Protection background tasks.
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\srtasks.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
6676"C:\Windows\System32\msiexec.exe" /i C:\Users\admin\AppData\Local\Temp\SecureExamBrowserInstaller_en_1.5.5.msiC:\Windows\System32\msiexec.exe
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows® installer
Exit code:
0
Version:
5.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\msiexec.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\aclayers.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
6816C:\Windows\syswow64\MsiExec.exe -Embedding 077C8619AB3FA3A5C379B0105291848DC:\Windows\SysWOW64\msiexec.exe—msiexec.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows® installer
Exit code:
0
Version:
5.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\msiexec.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\aclayers.dll
6912C:\WINDOWS\system32\vssvc.exeC:\Windows\System32\VSSVC.exe—services.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Microsoft® Volume Shadow Copy Service
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\vssvc.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
7052C:\Windows\syswow64\MsiExec.exe -Embedding 321C2F7472AAB8A3AF8BFAB66F23F113 CC:\Windows\SysWOW64\msiexec.exe—msiexec.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows® installer
Exit code:
0
Version:
5.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\msiexec.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\aclayers.dll
Total events
15 801
Read events
15 346
Write events
436
Delete events
19

Modification events

(PID) Process:(6440) msiexec.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\SystemRestore
Operation:writeName:SrCreateRp (Enter)
Value:
4800000000000000DAD8FE6422FCDA0128190000EC000000D50700000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(6440) msiexec.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\SPP
Operation:writeName:SppGetSnapshots (Enter)
Value:
4800000000000000DAD8FE6422FCDA0128190000EC000000D20700000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(6440) msiexec.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\SPP
Operation:writeName:SppGetSnapshots (Leave)
Value:
480000000000000002373F6522FCDA0128190000EC000000D20700000100000000000000000000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(6440) msiexec.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\SPP
Operation:writeName:SppEnumGroups (Enter)
Value:
480000000000000002373F6522FCDA0128190000EC000000D10700000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(6440) msiexec.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\SPP
Operation:writeName:SppEnumGroups (Leave)
Value:
4800000000000000BF99416522FCDA0128190000EC000000D10700000100000000000000010000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(6440) msiexec.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\SPP
Operation:writeName:SppCreate (Enter)
Value:
480000000000000008FD436522FCDA0128190000EC000000D00700000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(6440) msiexec.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SPP
Operation:writeName:LastIndex
Value:
11
(PID) Process:(6440) msiexec.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\SPP
Operation:writeName:SppGatherWriterMetadata (Enter)
Value:
48000000000000001262B66522FCDA0128190000EC000000D30700000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(6440) msiexec.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\VssapiPublisher
Operation:writeName:IDENTIFY (Enter)
Value:
48000000000000009CC6B86522FCDA0128190000580C0000E80300000100000000000000000000009379A11A48466843964ECA033A84F5B400000000000000000000000000000000
(PID) Process:(6912) VSSVC.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\Shadow Copy Optimization Writer
Operation:writeName:IDENTIFY (Enter)
Value:
48000000000000006357C26522FCDA01001B00003C1A0000E80300000100000001000000000000000000000000000000000000000000000000000000000000000000000000000000
Executable files
42
Suspicious files
28
Text files
55
Unknown types
2

Dropped files

PID
Process
Filename
Type
6440msiexec.exeC:\System Volume Information\SPP\metadata-2 —
MD5:—
SHA256:—
6440msiexec.exeC:\Windows\Installer\12fb40.msi —
MD5:—
SHA256:—
6676msiexec.exeC:\Users\admin\AppData\Local\Temp\MSIA793.tmpexecutable
MD5:684F2D21637CB5835172EDAD55B6A8D9
SHA256:DA1FE86141C446921021BB26B6FE2BD2D1BB51E3E614F46F8103FFAD8042F2C0
6440msiexec.exeC:\System Volume Information\SPP\snapshot-2binary
MD5:98DA9CBBA7098DB5CB18B1D671EF57D1
SHA256:9D641A86CE14D561528E212239AE36C4A0F6D1F2D6F7AC6BCE6E1EF15D0E557F
7052msiexec.exeC:\Users\admin\AppData\Local\Temp\CFGA783.tmpxml
MD5:84F2F872035A2B2007494208AC3B98C4
SHA256:F5BA88B4A9928B710C9DBF757F0C4DEE5BC6B6A56985D5BFEBA8620C8AE65B6C
6440msiexec.exeC:\Windows\Installer\MSI16C.tmpbinary
MD5:1BC601F4966FB317B3DF9FE9B3CEEA1B
SHA256:9133025041549A0032D13A35359CD360B1107AB9F8F7C0F9213B33CCA6A63693
6440msiexec.exeC:\Windows\Installer\inprogressinstallinfo.ipibinary
MD5:E695CB79B48A78CC9C20219BC7CAEBF0
SHA256:76EE6C2ABCAEA34A630CC204DA8C5E4BDA8185237EB0FD834F011649C6EB5B02
6440msiexec.exeC:\Windows\Installer\MSIFFD4.tmpexecutable
MD5:684F2D21637CB5835172EDAD55B6A8D9
SHA256:DA1FE86141C446921021BB26B6FE2BD2D1BB51E3E614F46F8103FFAD8042F2C0
6440msiexec.exeC:\Windows\Temp\~DFBCF8D54C410B1799.TMPbinary
MD5:E695CB79B48A78CC9C20219BC7CAEBF0
SHA256:76EE6C2ABCAEA34A630CC204DA8C5E4BDA8185237EB0FD834F011649C6EB5B02
6440msiexec.exeC:\Windows\Temp\~DFD028EA86B47DEA83.TMPbinary
MD5:BF619EAC0CDF3F68D496EA9344137E8B
SHA256:076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
18
TCP/UDP connections
67
DNS requests
19
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
6676
msiexec.exe
GET
404
172.64.149.23:80
http://crl.comodoca.com/AAACertificateServices.crl
unknown
—
—
whitelisted
6676
msiexec.exe
GET
404
172.64.149.23:80
http://ocsp.sectigo.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSdE3gf41WAic8Uh9lF92%2BIJqh5qwQUMuuSmv81lkgvKEBCcCA2kVwXheYCEDPXCKiRQFMZ4qW70zm5rW4%3D
unknown
—
—
whitelisted
6676
msiexec.exe
GET
404
104.18.38.233:80
http://ocsp.comodoca.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBRTtU9uFqgVGHhJwXZyWCNXmVR5ngQUoBEKIz6W8Qfs4q8p74Klf9AwpLQCEEj8k7RgVZSNNqfJionWlBY%3D
unknown
—
—
whitelisted
6676
msiexec.exe
POST
404
104.18.38.233:80
http://ocsp.comodoca.com/
unknown
—
—
unknown
6676
msiexec.exe
POST
404
172.64.149.23:80
http://ocsp.sectigo.com/
unknown
—
—
unknown
6676
msiexec.exe
GET
404
172.64.149.23:80
http://crl.sectigo.com/SectigoPublicCodeSigningRootR46.crl
unknown
—
—
whitelisted
6440
msiexec.exe
GET
404
104.18.38.233:80
http://ocsp.comodoca.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBRTtU9uFqgVGHhJwXZyWCNXmVR5ngQUoBEKIz6W8Qfs4q8p74Klf9AwpLQCEEj8k7RgVZSNNqfJionWlBY%3D
unknown
—
—
whitelisted
6676
msiexec.exe
GET
404
172.64.149.23:80
http://ocsp.sectigo.com/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBRd0JozUYXMqqW4y4zJTrLcMCRSkAQUgTKSQSsozUbIxKLGKjkS7EipPxQCEQDJylMg%2F%2Bp373vSetjhEV0d
unknown
—
—
whitelisted
6440
msiexec.exe
POST
404
104.18.38.233:80
http://ocsp.comodoca.com/
unknown
—
—
unknown
6676
msiexec.exe
POST
404
172.64.149.23:80
http://ocsp.sectigo.com/
unknown
—
—
unknown
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:138
—
—
—
whitelisted
—
—
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
3888
svchost.exe
239.255.255.250:1900
—
—
—
whitelisted
6676
msiexec.exe
104.18.38.233:80
ocsp.comodoca.com
CLOUDFLARENET
—
whitelisted
6676
msiexec.exe
172.64.149.23:80
ocsp.comodoca.com
CLOUDFLARENET
US
whitelisted
3260
svchost.exe
40.113.110.67:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
3652
svchost.exe
40.126.31.71:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
608
svchost.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4324
svchost.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
5336
SearchApp.exe
104.126.37.139:443
www.bing.com
Akamai International B.V.
DE
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 40.127.240.158
  • 51.104.136.2
whitelisted
google.com
  • 142.250.181.238
whitelisted
ocsp.comodoca.com
  • 104.18.38.233
  • 172.64.149.23
whitelisted
crl.comodoca.com
  • 172.64.149.23
  • 104.18.38.233
whitelisted
ocsp.sectigo.com
  • 172.64.149.23
  • 104.18.38.233
whitelisted
crl.sectigo.com
  • 172.64.149.23
  • 104.18.38.233
whitelisted
client.wns.windows.com
  • 40.113.110.67
whitelisted
login.live.com
  • 40.126.31.71
  • 20.190.159.0
  • 20.190.159.68
  • 20.190.159.73
  • 20.190.159.64
  • 40.126.31.67
  • 20.190.159.71
  • 40.126.31.73
whitelisted
www.bing.com
  • 104.126.37.139
  • 104.126.37.153
  • 104.126.37.146
  • 104.126.37.123
  • 104.126.37.160
  • 104.126.37.130
  • 104.126.37.155
  • 104.126.37.131
  • 104.126.37.163
whitelisted
browser.pipe.aria.microsoft.com
  • 51.104.15.253
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
SecureExamBrowserInstaller_en_1.5.5.msi