File name:

SecureExamBrowserInstaller_en_1.5.5.msi

Full analysis: https://app.any.run/tasks/fa0708da-c247-4fa7-a271-ac460acd5692
Verdict: Malicious activity
Analysis date: September 01, 2024, 03:52:26
OS: Windows 10 Professional (build: 19045, 64 bit)
Indicators:
MIME: application/x-msi
File info: Composite Document File V2 Document, Little Endian, Os: Windows, Version 10.0, MSI Installer, Create Time/Date: Mon Jun 21 07:00:00 1999, Name of Creating Application: Windows Installer, Security: 1, Code page: 1252, Template: x64;1033, Number of Pages: 200, Revision Number: {826F7769-1D9D-4166-8AD2-D74B0968935B}, Title: SecureExamBrowserInstaller, Author: Hirepro, Comments: Secure Exam Browser, Number of Words: 2, Last Saved Time/Date: Fri Mar 8 02:48:38 2024, Last Printed: Fri Mar 8 02:48:38 2024
MD5:

C9C01A9459906E0B8A860FFEE4366703

SHA1:

7ECF851C1B9625BD22DD2A8576E4FF0C65F5E989

SHA256:

48BAF16D61CFDB060F9B2FD9DE898BECDD9AB742715636743A83AC0AEE00D3C4

SSDEEP:

98304:xxOK0el1ey6lF0hXLROiMGzAeinz8yFLau7gfd5GXbD2GyM9irvqLo9G0RNW7eQ6:Tyedrh0jyK

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    No malicious indicators.

  • SUSPICIOUS

    • Process drops legitimate windows executable

      • msiexec.exe (PID: 6676)
      • msiexec.exe (PID: 6440)

    • Drops the executable file immediately after the start

      • msiexec.exe (PID: 6440)

    • Reads the Windows owner or organization settings

      • msiexec.exe (PID: 6440)

    • The process creates files with name similar to system file names

      • msiexec.exe (PID: 6440)

    • Changes default file association

      • msiexec.exe (PID: 6440)

    • Checks Windows Trust Settings

      • msiexec.exe (PID: 6440)

    • Reads security settings of Internet Explorer

      • msiexec.exe (PID: 6580)

    • Executes as Windows Service

      • SebWindowsServiceWCF.exe (PID: 6356)
      • VSSVC.exe (PID: 6912)

  • INFO

    • Executable content was dropped or overwritten

      • msiexec.exe (PID: 6676)
      • msiexec.exe (PID: 6440)

    • Reads the software policy settings

      • msiexec.exe (PID: 6676)
      • msiexec.exe (PID: 6440)

    • Reads security settings of Internet Explorer

      • msiexec.exe (PID: 6676)

    • Checks proxy server information

      • msiexec.exe (PID: 6676)

    • Checks supported languages

      • msiexec.exe (PID: 6440)
      • msiexec.exe (PID: 6816)
      • msiexec.exe (PID: 6580)
      • SebWindowsServiceWCF.exe (PID: 6356)
      • msiexec.exe (PID: 7052)

    • Create files in a temporary directory

      • msiexec.exe (PID: 7052)
      • msiexec.exe (PID: 6816)

    • Reads the computer name

      • msiexec.exe (PID: 6816)
      • msiexec.exe (PID: 6580)
      • SebWindowsServiceWCF.exe (PID: 6356)
      • msiexec.exe (PID: 6440)
      • msiexec.exe (PID: 7052)

    • Reads the machine GUID from the registry

      • msiexec.exe (PID: 6580)
      • SebWindowsServiceWCF.exe (PID: 6356)
      • msiexec.exe (PID: 6440)

    • The process uses the downloaded file

      • msiexec.exe (PID: 6580)

    • Creates files in the program directory

      • SebWindowsServiceWCF.exe (PID: 6356)

    • Creates a software uninstall entry

      • msiexec.exe (PID: 6440)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.msi | Microsoft Windows Installer (90.2)
.msp | Windows Installer Patch (8.4)
.msi | Microsoft Installer (100)

EXIF

FlashPix

CreateDate: 1999:06:21 07:00:00
Software: Windows Installer
Security: Password protected
CodePage: Windows Latin 1 (Western European)
Template: x64;1033
Pages: 200
RevisionNumber: {826F7769-1D9D-4166-8AD2-D74B0968935B}
Title: SecureExamBrowserInstaller
Subject: -
Author: Hirepro
Keywords: -
Comments: Secure Exam Browser
Words: 2
ModifyDate: 2024:03:08 02:48:38
LastPrinted: 2024:03:08 02:48:38
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
136
Monitored processes
9
Malicious processes
1
Suspicious processes
0

Behavior graph

Click at the process to see the details
start msiexec.exe msiexec.exe msiexec.exe no specs vssvc.exe no specs srtasks.exe no specs conhost.exe no specs msiexec.exe no specs msiexec.exe no specs sebwindowsservicewcf.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
788\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—SrTasks.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
6356"C:\Program Files (x86)\SecureExamBrowser\SebWindowsServiceWCF.exe"C:\Program Files (x86)\SecureExamBrowser\SebWindowsServiceWCF.exe—services.exe
User:
SYSTEM
Company:
ETH Zurich
Integrity Level:
SYSTEM
Description:
SEB Windows Service with WCF
Version:
2.2.8833.14950
Modules
Images
c:\program files (x86)\secureexambrowser\sebwindowsservicewcf.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\mscoree.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
6440C:\WINDOWS\system32\msiexec.exe /VC:\Windows\System32\msiexec.exe
services.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Windows® installer
Version:
5.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\msiexec.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\aclayers.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
6580C:\Windows\syswow64\MsiExec.exe -Embedding 680522A8988F3525D2F28962E40D1AED E Global\MSI0000C:\Windows\SysWOW64\msiexec.exe—msiexec.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Windows® installer
Exit code:
0
Version:
5.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\msiexec.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\aclayers.dll
6640C:\WINDOWS\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:11C:\Windows\System32\SrTasks.exe—msiexec.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Microsoft® Windows System Protection background tasks.
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\srtasks.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
6676"C:\Windows\System32\msiexec.exe" /i C:\Users\admin\AppData\Local\Temp\SecureExamBrowserInstaller_en_1.5.5.msiC:\Windows\System32\msiexec.exe
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows® installer
Exit code:
0
Version:
5.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\msiexec.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\aclayers.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
6816C:\Windows\syswow64\MsiExec.exe -Embedding 077C8619AB3FA3A5C379B0105291848DC:\Windows\SysWOW64\msiexec.exe—msiexec.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows® installer
Exit code:
0
Version:
5.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\msiexec.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\aclayers.dll
6912C:\WINDOWS\system32\vssvc.exeC:\Windows\System32\VSSVC.exe—services.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Microsoft® Volume Shadow Copy Service
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\vssvc.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
7052C:\Windows\syswow64\MsiExec.exe -Embedding 321C2F7472AAB8A3AF8BFAB66F23F113 CC:\Windows\SysWOW64\msiexec.exe—msiexec.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows® installer
Exit code:
0
Version:
5.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\msiexec.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\aclayers.dll
Total events
15 801
Read events
15 346
Write events
436
Delete events
19

Modification events

(PID) Process:(6440) msiexec.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\SystemRestore
Operation:writeName:SrCreateRp (Enter)
Value:
4800000000000000DAD8FE6422FCDA0128190000EC000000D50700000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(6440) msiexec.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\SPP
Operation:writeName:SppGetSnapshots (Enter)
Value:
4800000000000000DAD8FE6422FCDA0128190000EC000000D20700000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(6440) msiexec.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\SPP
Operation:writeName:SppGetSnapshots (Leave)
Value:
480000000000000002373F6522FCDA0128190000EC000000D20700000100000000000000000000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(6440) msiexec.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\SPP
Operation:writeName:SppEnumGroups (Enter)
Value:
480000000000000002373F6522FCDA0128190000EC000000D10700000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(6440) msiexec.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\SPP
Operation:writeName:SppEnumGroups (Leave)
Value:
4800000000000000BF99416522FCDA0128190000EC000000D10700000100000000000000010000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(6440) msiexec.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\SPP
Operation:writeName:SppCreate (Enter)
Value:
480000000000000008FD436522FCDA0128190000EC000000D00700000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(6440) msiexec.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SPP
Operation:writeName:LastIndex
Value:
11
(PID) Process:(6440) msiexec.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\SPP
Operation:writeName:SppGatherWriterMetadata (Enter)
Value:
48000000000000001262B66522FCDA0128190000EC000000D30700000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(6440) msiexec.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\VssapiPublisher
Operation:writeName:IDENTIFY (Enter)
Value:
48000000000000009CC6B86522FCDA0128190000580C0000E80300000100000000000000000000009379A11A48466843964ECA033A84F5B400000000000000000000000000000000
(PID) Process:(6912) VSSVC.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\Shadow Copy Optimization Writer
Operation:writeName:IDENTIFY (Enter)
Value:
48000000000000006357C26522FCDA01001B00003C1A0000E80300000100000001000000000000000000000000000000000000000000000000000000000000000000000000000000
Executable files
42
Suspicious files
28
Text files
55
Unknown types
2

Dropped files

PID
Process
Filename
Type
6440msiexec.exeC:\System Volume Information\SPP\metadata-2 —
MD5:—
SHA256:—
6440msiexec.exeC:\Windows\Installer\12fb40.msi —
MD5:—
SHA256:—
7052msiexec.exeC:\Users\admin\AppData\Local\Temp\CFGA783.tmpxml
MD5:84F2F872035A2B2007494208AC3B98C4
SHA256:F5BA88B4A9928B710C9DBF757F0C4DEE5BC6B6A56985D5BFEBA8620C8AE65B6C
6676msiexec.exeC:\Users\admin\AppData\Local\Temp\MSIA793.tmpexecutable
MD5:684F2D21637CB5835172EDAD55B6A8D9
SHA256:DA1FE86141C446921021BB26B6FE2BD2D1BB51E3E614F46F8103FFAD8042F2C0
6440msiexec.exeC:\Windows\Installer\MSIFFD4.tmpexecutable
MD5:684F2D21637CB5835172EDAD55B6A8D9
SHA256:DA1FE86141C446921021BB26B6FE2BD2D1BB51E3E614F46F8103FFAD8042F2C0
6440msiexec.exeC:\System Volume Information\SPP\snapshot-2binary
MD5:98DA9CBBA7098DB5CB18B1D671EF57D1
SHA256:9D641A86CE14D561528E212239AE36C4A0F6D1F2D6F7AC6BCE6E1EF15D0E557F
6816msiexec.exeC:\Users\admin\AppData\Local\Temp\CFG51.tmpxml
MD5:84F2F872035A2B2007494208AC3B98C4
SHA256:F5BA88B4A9928B710C9DBF757F0C4DEE5BC6B6A56985D5BFEBA8620C8AE65B6C
6676msiexec.exeC:\Users\admin\AppData\Local\Temp\MSIA6B8.tmpexecutable
MD5:684F2D21637CB5835172EDAD55B6A8D9
SHA256:DA1FE86141C446921021BB26B6FE2BD2D1BB51E3E614F46F8103FFAD8042F2C0
6440msiexec.exeC:\Windows\Installer\MSI71.tmpexecutable
MD5:684F2D21637CB5835172EDAD55B6A8D9
SHA256:DA1FE86141C446921021BB26B6FE2BD2D1BB51E3E614F46F8103FFAD8042F2C0
6440msiexec.exeC:\System Volume Information\SPP\OnlineMetadataCache\{1aa17993-4648-4368-964e-ca033a84f5b4}_OnDiskSnapshotPropbinary
MD5:98DA9CBBA7098DB5CB18B1D671EF57D1
SHA256:9D641A86CE14D561528E212239AE36C4A0F6D1F2D6F7AC6BCE6E1EF15D0E557F
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
18
TCP/UDP connections
67
DNS requests
19
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
6676
msiexec.exe
POST
404
104.18.38.233:80
http://ocsp.comodoca.com/
unknown
—
—
unknown
6440
msiexec.exe
GET
404
172.64.149.23:80
http://crl.comodoca.com/AAACertificateServices.crl
unknown
—
—
whitelisted
6676
msiexec.exe
GET
404
104.18.38.233:80
http://ocsp.comodoca.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBRTtU9uFqgVGHhJwXZyWCNXmVR5ngQUoBEKIz6W8Qfs4q8p74Klf9AwpLQCEEj8k7RgVZSNNqfJionWlBY%3D
unknown
—
—
whitelisted
6676
msiexec.exe
GET
404
172.64.149.23:80
http://crl.comodoca.com/AAACertificateServices.crl
unknown
—
—
whitelisted
6676
msiexec.exe
GET
404
172.64.149.23:80
http://ocsp.sectigo.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSdE3gf41WAic8Uh9lF92%2BIJqh5qwQUMuuSmv81lkgvKEBCcCA2kVwXheYCEDPXCKiRQFMZ4qW70zm5rW4%3D
unknown
—
—
whitelisted
6676
msiexec.exe
POST
404
172.64.149.23:80
http://ocsp.sectigo.com/
unknown
—
—
unknown
6676
msiexec.exe
GET
404
172.64.149.23:80
http://crl.sectigo.com/SectigoPublicCodeSigningRootR46.crl
unknown
—
—
whitelisted
6440
msiexec.exe
POST
404
172.64.149.23:80
http://ocsp.sectigo.com/
unknown
—
—
unknown
6440
msiexec.exe
POST
404
172.64.149.23:80
http://ocsp.sectigo.com/
unknown
—
—
unknown
6440
msiexec.exe
GET
404
104.18.38.233:80
http://ocsp.comodoca.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBRTtU9uFqgVGHhJwXZyWCNXmVR5ngQUoBEKIz6W8Qfs4q8p74Klf9AwpLQCEEj8k7RgVZSNNqfJionWlBY%3D
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:138
—
—
—
whitelisted
—
—
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
3888
svchost.exe
239.255.255.250:1900
—
—
—
whitelisted
6676
msiexec.exe
104.18.38.233:80
ocsp.comodoca.com
CLOUDFLARENET
—
whitelisted
6676
msiexec.exe
172.64.149.23:80
ocsp.comodoca.com
CLOUDFLARENET
US
whitelisted
3260
svchost.exe
40.113.110.67:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
3652
svchost.exe
40.126.31.71:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
608
svchost.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4324
svchost.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
5336
SearchApp.exe
104.126.37.139:443
www.bing.com
Akamai International B.V.
DE
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 40.127.240.158
  • 51.104.136.2
whitelisted
google.com
  • 142.250.181.238
whitelisted
ocsp.comodoca.com
  • 104.18.38.233
  • 172.64.149.23
whitelisted
crl.comodoca.com
  • 172.64.149.23
  • 104.18.38.233
whitelisted
ocsp.sectigo.com
  • 172.64.149.23
  • 104.18.38.233
whitelisted
crl.sectigo.com
  • 172.64.149.23
  • 104.18.38.233
whitelisted
client.wns.windows.com
  • 40.113.110.67
whitelisted
login.live.com
  • 40.126.31.71
  • 20.190.159.0
  • 20.190.159.68
  • 20.190.159.73
  • 20.190.159.64
  • 40.126.31.67
  • 20.190.159.71
  • 40.126.31.73
whitelisted
www.bing.com
  • 104.126.37.139
  • 104.126.37.153
  • 104.126.37.146
  • 104.126.37.123
  • 104.126.37.160
  • 104.126.37.130
  • 104.126.37.155
  • 104.126.37.131
  • 104.126.37.163
whitelisted
browser.pipe.aria.microsoft.com
  • 51.104.15.253
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
SecureExamBrowserInstaller_en_1.5.5.msi