File name:

e563.msi

Full analysis: https://app.any.run/tasks/97a6ffc2-798c-4ca6-8739-d6b89bd4627c
Verdict: Malicious activity
Analysis date: February 19, 2025, 20:09:42
OS: Windows 10 Professional (build: 19045, 64 bit)
Tags:
auto
generic
generated-doc
Indicators:
MIME: application/x-msi
File info: Composite Document File V2 Document, Little Endian, Os: Windows, Version 6.2, MSI Installer, Code page: 1252, Title: Installation Database, Subject: Peach, Author: Monkeypod Privy, Keywords: Installer, Comments: This installer database contains the logic and data required to install Peach., Template: Intel;1033, Revision Number: {D4D490EE-626F-4B8C-BB54-08E64991835D}, Create Time/Date: Mon Jan 27 08:02:30 2025, Last Saved Time/Date: Mon Jan 27 08:02:30 2025, Number of Pages: 500, Number of Words: 10, Name of Creating Application: WiX Toolset (4.0.0.0), Security: 2
MD5:

702EFF7EFBAE474770FA8B974796F525

SHA1:

EDF846B3466BF5AF032AE53CD53E07AFA5D0C438

SHA256:

4AFB456BB3983C01AEE5136F35B7C2EE462730CA277E533AE3A323F6BD91A4E3

SSDEEP:

98304:FFC0Z/SHN7xSsKXT79A/5r3mOJbaGQWQNm957WGK3C/xiX945ZoCmulXvrmomu2C:lUjJhAZj

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • GENERIC has been found (auto)

      • msiexec.exe (PID: 5556)
      • ISDbg.exe (PID: 644)

    • Executing a file with an untrusted certificate

      • ISDbg.exe (PID: 644)
      • ISDbg.exe (PID: 4500)
      • ISDbg.exe (PID: 6784)

    • Known privilege escalation attack

      • dllhost.exe (PID: 6704)

  • SUSPICIOUS

    • Executes as Windows Service

      • VSSVC.exe (PID: 3220)

    • Reads the Windows owner or organization settings

      • msiexec.exe (PID: 5556)

    • Process drops legitimate windows executable

      • msiexec.exe (PID: 5556)
      • ISDbg.exe (PID: 644)

    • The process drops C-runtime libraries

      • msiexec.exe (PID: 5556)
      • ISDbg.exe (PID: 644)

    • Executable content was dropped or overwritten

      • ISDbg.exe (PID: 644)

    • Starts itself from another location

      • ISDbg.exe (PID: 644)

    • Starts CMD.EXE for commands execution

      • ISDbg.exe (PID: 4500)
      • ISDbg.exe (PID: 6784)

  • INFO

    • The sample compiled with english language support

      • msiexec.exe (PID: 2040)
      • msiexec.exe (PID: 5556)
      • ISDbg.exe (PID: 644)

    • Checks supported languages

      • msiexec.exe (PID: 5556)
      • ISDbg.exe (PID: 644)
      • ISDbg.exe (PID: 4500)
      • ISDbg.exe (PID: 6784)

    • Reads the computer name

      • msiexec.exe (PID: 5556)
      • ISDbg.exe (PID: 644)
      • ISDbg.exe (PID: 4500)
      • ISDbg.exe (PID: 6784)

    • Manages system restore points

      • SrTasks.exe (PID: 1752)

    • Executable content was dropped or overwritten

      • msiexec.exe (PID: 5556)

    • Creates a software uninstall entry

      • msiexec.exe (PID: 5556)

    • Reads security settings of Internet Explorer

      • dllhost.exe (PID: 6704)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.msi | Microsoft Installer (100)

EXIF

FlashPix

CodePage: Windows Latin 1 (Western European)
Title: Installation Database
Subject: Peach
Author: Monkeypod Privy
Keywords: Installer
Comments: This installer database contains the logic and data required to install Peach.
Template: Intel;1033
RevisionNumber: {D4D490EE-626F-4B8C-BB54-08E64991835D}
CreateDate: 2025:01:27 08:02:30
ModifyDate: 2025:01:27 08:02:30
Pages: 500
Words: 10
Software: WiX Toolset (4.0.0.0)
Security: Read-only recommended
No data.
screenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
144
Monitored processes
15
Malicious processes
3
Suspicious processes
2

Behavior graph

Click at the process to see the details
start msiexec.exe no specs #GENERIC msiexec.exe vssvc.exe no specs srtasks.exe no specs conhost.exe no specs #GENERIC isdbg.exe isdbg.exe no specs cmd.exe no specs conhost.exe no specs CMSTPLUA isdbg.exe no specs cmd.exe no specs conhost.exe no specs explorer.exe svchost.exe

Process information

PID
CMD
Path
Indicators
Parent process
644"C:\Users\admin\AppData\Local\Cabman\ISDbg.exe"C:\Users\admin\AppData\Local\Cabman\ISDbg.exe
msiexec.exe
User:
admin
Company:
Flexera
Integrity Level:
MEDIUM
Description:
InstallShield (R) Script Debugger
Exit code:
0
Version:
27.0.58
Modules
Images
c:\users\admin\appdata\local\cabman\isdbg.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
1752C:\WINDOWS\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:11C:\Windows\System32\SrTasks.exe—msiexec.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Microsoft® Windows System Protection background tasks.
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\srtasks.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
2040"C:\Windows\System32\msiexec.exe" /i C:\Users\admin\AppData\Local\Temp\e563.msiC:\Windows\System32\msiexec.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows® installer
Exit code:
0
Version:
5.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\msiexec.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\aclayers.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
2192C:\WINDOWS\system32\svchost.exe -k NetworkService -p -s DnscacheC:\Windows\System32\svchost.exe
services.exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Host Process for Windows Services
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\svchost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\kernel.appcore.dll
3220C:\WINDOWS\system32\vssvc.exeC:\Windows\System32\VSSVC.exe—services.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Microsoft® Volume Shadow Copy Service
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\vssvc.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
3688\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—SrTasks.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
4500C:\Users\admin\AppData\Roaming\AgentcomTD\ISDbg.exeC:\Users\admin\AppData\Roaming\AgentcomTD\ISDbg.exe—ISDbg.exe
User:
admin
Company:
Flexera
Integrity Level:
MEDIUM
Description:
InstallShield (R) Script Debugger
Exit code:
1
Version:
27.0.58
Modules
Images
c:\users\admin\appdata\roaming\agentcomtd\isdbg.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
5556C:\WINDOWS\system32\msiexec.exe /VC:\Windows\System32\msiexec.exe
services.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Windows® installer
Version:
5.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\msiexec.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\aclayers.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
6252C:\WINDOWS\SysWOW64\cmd.exeC:\Windows\SysWOW64\cmd.exe—ISDbg.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\msvcrt.dll
c:\windows\syswow64\combase.dll
6260\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
Total events
3 825
Read events
3 557
Write events
250
Delete events
18

Modification events

(PID) Process:(5556) msiexec.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\SystemRestore
Operation:writeName:SrCreateRp (Enter)
Value:
480000000000000018AF043B0A83DB01B415000040100000D50700000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(5556) msiexec.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\SPP
Operation:writeName:SppGetSnapshots (Enter)
Value:
480000000000000018AF043B0A83DB01B415000040100000D20700000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(5556) msiexec.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\SPP
Operation:writeName:SppGetSnapshots (Leave)
Value:
48000000000000006B6E533B0A83DB01B415000040100000D20700000100000000000000000000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(5556) msiexec.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\SPP
Operation:writeName:SppEnumGroups (Enter)
Value:
48000000000000006B6E533B0A83DB01B415000040100000D10700000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(5556) msiexec.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\SPP
Operation:writeName:SppEnumGroups (Leave)
Value:
48000000000000008BBE553B0A83DB01B415000040100000D10700000100000000000000010000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(5556) msiexec.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\SPP
Operation:writeName:SppCreate (Enter)
Value:
48000000000000000B865A3B0A83DB01B415000040100000D00700000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(5556) msiexec.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SPP
Operation:writeName:LastIndex
Value:
11
(PID) Process:(5556) msiexec.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\SPP
Operation:writeName:SppGatherWriterMetadata (Enter)
Value:
4800000000000000914CFA3B0A83DB01B415000040100000D30700000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(3220) VSSVC.exeKey:HKEY_LOCAL_MACHINE\BCD00000000\Objects\{9dea862c-5cdd-4e70-acc1-f32b344d4795}\Elements\11000001
Operation:delete keyName:(default)
Value:
(PID) Process:(3220) VSSVC.exeKey:HKEY_LOCAL_MACHINE\BCD00000000\Objects\{9dea862c-5cdd-4e70-acc1-f32b344d4795}\Elements\11000001
Operation:writeName:Element
Value:
0000000000000000000000000000000006000000000000004800000000000000715E5C2FA985EB1190A89A9B763584210000000000000000745E5C2FA985EB1190A89A9B7635842100000000000000000000000000000000
Executable files
12
Suspicious files
24
Text files
0
Unknown types
0

Dropped files

PID
Process
Filename
Type
5556msiexec.exeC:\System Volume Information\SPP\metadata-2 —
MD5:—
SHA256:—
5556msiexec.exeC:\Windows\Installer\138dbc.msi —
MD5:—
SHA256:—
5556msiexec.exeC:\Windows\Installer\138dbe.msi —
MD5:—
SHA256:—
5556msiexec.exeC:\System Volume Information\SPP\snapshot-2binary
MD5:AF81B4BBFEEA63F5B823B0FD4112FB19
SHA256:520ADFF5BFFA23C09E35CD50A16F9406623C248B053E2B729F4BB5F9E79207D7
5556msiexec.exeC:\Windows\Installer\inprogressinstallinfo.ipibinary
MD5:083CCAD40A92E9DAC670DBEF053B13C7
SHA256:C8B7F5703E55DC22571D746F37EC5336A39DE375819F99CF9D27871708F87BA8
5556msiexec.exeC:\Users\admin\AppData\Local\Cabman\FNP_Act_Installer.dllexecutable
MD5:818ABBBD3717505C01E4E8277406AF8F
SHA256:BC0ACDFB672AD01AD3B658EE51E2EE6523D56EA4BC4C066B390CF9B494E2AA69
5556msiexec.exeC:\Windows\Temp\~DF132C6B46908B234F.TMPbinary
MD5:083CCAD40A92E9DAC670DBEF053B13C7
SHA256:C8B7F5703E55DC22571D746F37EC5336A39DE375819F99CF9D27871708F87BA8
5556msiexec.exeC:\Users\admin\AppData\Local\Cabman\ISDbg.exeexecutable
MD5:7CA79F128ADAF85BA662D15AF223ACAC
SHA256:AF2F747F6DAA4B949EE7E418E36AEE0E40DE8ABD3CBD4DCCC26105DBFA8211D6
5556msiexec.exeC:\Windows\Installer\MSI8F24.tmpbinary
MD5:5FFAF2453FEBC528268C2D06BB462046
SHA256:C57E278682BD74F043A62CE2F623D6433747F5BE0249142405F7968217D986D9
5556msiexec.exeC:\Users\admin\AppData\Local\Cabman\ISUIServices.dllexecutable
MD5:76B4DE944E20EC55394DBEBC7AC2081C
SHA256:141406239B4E894F3BA0B812D0DCF246C8510CC6AE3ECDB1F6A9BC5BF5E60C7D
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
7
TCP/UDP connections
34
DNS requests
20
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
716
svchost.exe
GET
200
23.48.23.45:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
716
svchost.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
1176
svchost.exe
GET
200
2.17.190.73:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
6536
SIHClient.exe
GET
200
23.219.150.101:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
6536
SIHClient.exe
GET
200
23.219.150.101:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
5240
backgroundTaskHost.exe
GET
200
2.17.190.73:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAUZZSZEml49Gjh0j13P68w%3D
unknown
—
—
whitelisted
5064
SearchApp.exe
GET
200
2.17.190.73:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAI5PUjXAkJafLQcAAsO18o%3D
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4712
MoUsoCoreWorker.exe
40.127.240.158:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
IE
unknown
4
System
192.168.100.255:137
—
—
—
whitelisted
716
svchost.exe
40.127.240.158:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
IE
unknown
244
RUXIMICS.exe
40.127.240.158:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
IE
unknown
4
System
192.168.100.255:138
—
—
—
whitelisted
716
svchost.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
716
svchost.exe
23.48.23.45:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
716
svchost.exe
184.30.21.171:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
5064
SearchApp.exe
184.86.251.22:443
www.bing.com
Akamai International B.V.
DE
whitelisted
1176
svchost.exe
20.190.159.129:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted

DNS requests

Domain
IP
Reputation
google.com
  • 142.250.74.206
whitelisted
settings-win.data.microsoft.com
  • 51.104.136.2
  • 20.73.194.208
whitelisted
crl.microsoft.com
  • 23.48.23.45
  • 23.48.23.49
  • 23.48.23.31
  • 23.48.23.29
  • 23.48.23.33
  • 23.48.23.58
  • 23.48.23.32
  • 23.48.23.37
  • 23.48.23.57
whitelisted
www.microsoft.com
  • 184.30.21.171
  • 23.219.150.101
whitelisted
www.bing.com
  • 184.86.251.22
  • 184.86.251.27
  • 184.86.251.9
  • 184.86.251.17
  • 184.86.251.21
  • 184.86.251.25
  • 184.86.251.28
  • 184.86.251.19
  • 184.86.251.7
whitelisted
login.live.com
  • 20.190.159.129
  • 20.190.159.68
  • 40.126.31.3
  • 40.126.31.0
  • 40.126.31.1
  • 40.126.31.128
  • 40.126.31.71
  • 40.126.31.2
whitelisted
ocsp.digicert.com
  • 2.17.190.73
whitelisted
go.microsoft.com
  • 23.35.238.131
whitelisted
slscr.update.microsoft.com
  • 20.12.23.50
whitelisted
fe3cr.delivery.mp.microsoft.com
  • 52.165.164.15
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
e563.msi