File name:

Setup.msi

Full analysis: https://app.any.run/tasks/b275ac37-bc6f-458d-b842-eb492b938a04
Verdict: Malicious activity
Analysis date: December 08, 2024, 00:58:44
OS: Windows 10 Professional (build: 19045, 64 bit)
Tags:
generated-doc
Indicators:
MIME: application/x-msi
File info: Composite Document File V2 Document, Little Endian, Os: Windows, Version 10.0, MSI Installer, Security: 0, Code page: 1252, Revision Number: {0FF6F948-C2C0-4E1F-9A7A-BDE384E257CC}, Number of Words: 10, Subject: Ifid Apps, Author: Grovi Tend, Name of Creating Application: Ifid Apps, Template: x64;1033, Comments: This installer database contains the logic and data required to install Ifid Apps., Title: Installation Database, Keywords: Installer, MSI, Database, Create Time/Date: Sat Dec 7 13:59:08 2024, Last Saved Time/Date: Sat Dec 7 13:59:08 2024, Last Printed: Sat Dec 7 13:59:08 2024, Number of Pages: 450
MD5:

63332FC84DA9BFE2D0EC2E8C79BD21B7

SHA1:

2337DF197FE02B58E2CE3DD6DA053855CD96ED12

SHA256:

4BC409C39BBAD88D3141FD6EB71F03AF9AE6F0F404FAF71BD17A3E26676F6D89

SSDEEP:

393216:3dCV/lfl4WYP56O+X0lFe/pIrr/VjW47CYSBhJWSET:Nutfh05Y08p85jW4shW

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Changes powershell execution policy (Bypass)

      • msiexec.exe (PID: 4052)

    • Bypass execution policy to execute commands

      • powershell.exe (PID: 1468)

  • SUSPICIOUS

    • Reads the Windows owner or organization settings

      • msiexec.exe (PID: 3984)

    • Reads security settings of Internet Explorer

      • msiexec.exe (PID: 4052)

    • Checks Windows Trust Settings

      • msiexec.exe (PID: 4052)

    • The process hide an interactive prompt from the user

      • msiexec.exe (PID: 4052)

    • Starts POWERSHELL.EXE for commands execution

      • msiexec.exe (PID: 4052)

    • The process executes Powershell scripts

      • msiexec.exe (PID: 4052)

    • The process bypasses the loading of PowerShell profile settings

      • msiexec.exe (PID: 4052)

    • Reverses array data (POWERSHELL)

      • powershell.exe (PID: 1468)

    • The process drops C-runtime libraries

      • msiexec.exe (PID: 3984)

    • Process drops legitimate windows executable

      • msiexec.exe (PID: 3984)

  • INFO

    • An automatically generated document

      • msiexec.exe (PID: 3260)

    • Checks supported languages

      • msiexec.exe (PID: 4052)
      • msiexec.exe (PID: 3984)
      • openvpn.exe (PID: 4420)

    • Reads the computer name

      • msiexec.exe (PID: 4052)
      • msiexec.exe (PID: 3984)

    • Executable content was dropped or overwritten

      • msiexec.exe (PID: 3984)

    • Creates files or folders in the user directory

      • msiexec.exe (PID: 4052)
      • msiexec.exe (PID: 3984)

    • Checks proxy server information

      • msiexec.exe (PID: 4052)

    • Reads the machine GUID from the registry

      • msiexec.exe (PID: 4052)
      • openvpn.exe (PID: 4420)

    • Reads Environment values

      • msiexec.exe (PID: 4052)

    • Create files in a temporary directory

      • msiexec.exe (PID: 4052)
      • powershell.exe (PID: 1468)

    • Reads the software policy settings

      • msiexec.exe (PID: 4052)
      • powershell.exe (PID: 1468)

    • Uses string replace method (POWERSHELL)

      • powershell.exe (PID: 1468)

    • Reads security settings of Internet Explorer

      • powershell.exe (PID: 1468)

    • Sends debugging messages

      • openvpn.exe (PID: 4420)

    • Creates a software uninstall entry

      • msiexec.exe (PID: 3984)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.msi | Microsoft Windows Installer (81.9)
.mst | Windows SDK Setup Transform Script (9.2)
.msp | Windows Installer Patch (7.6)
.msi | Microsoft Installer (100)

EXIF

FlashPix

Security: None
CodePage: Windows Latin 1 (Western European)
RevisionNumber: {0FF6F948-C2C0-4E1F-9A7A-BDE384E257CC}
Words: 10
Subject: Ifid Apps
Author: Grovi Tend
LastModifiedBy: -
Software: Ifid Apps
Template: x64;1033
Comments: This installer database contains the logic and data required to install Ifid Apps.
Title: Installation Database
Keywords: Installer, MSI, Database
CreateDate: 2024:12:07 13:59:08
ModifyDate: 2024:12:07 13:59:08
LastPrinted: 2024:12:07 13:59:08
Pages: 450
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
134
Monitored processes
7
Malicious processes
1
Suspicious processes
1

Behavior graph

Click at the process to see the details
start msiexec.exe no specs msiexec.exe msiexec.exe powershell.exe no specs conhost.exe no specs openvpn.exe conhost.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
876\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—powershell.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1468 -NoProfile -Noninteractive -ExecutionPolicy Bypass -File "C:\Users\admin\AppData\Local\Temp\pssBDE7.ps1" -propFile "C:\Users\admin\AppData\Local\Temp\msiBDD5.txt" -scriptFile "C:\Users\admin\AppData\Local\Temp\scrBDD6.ps1" -scriptArgsFile "C:\Users\admin\AppData\Local\Temp\scrBDD7.txt" -propSep " :<->: " -lineSep " <<:>> " -testPrefix "_testValue."C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe—msiexec.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows PowerShell
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\windowspowershell\v1.0\powershell.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\msvcrt.dll
c:\windows\syswow64\oleaut32.dll
3260"C:\Windows\System32\msiexec.exe" /i C:\Users\admin\AppData\Local\Temp\Setup.msiC:\Windows\System32\msiexec.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows® installer
Exit code:
0
Version:
5.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\msiexec.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\aclayers.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
3984C:\WINDOWS\system32\msiexec.exe /VC:\Windows\System32\msiexec.exe
services.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Windows® installer
Version:
5.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\msiexec.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\aclayers.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
4052C:\Windows\syswow64\MsiExec.exe -Embedding CB524815A5ECAB3F5B215E70B8797FDAC:\Windows\SysWOW64\msiexec.exe
msiexec.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows® installer
Exit code:
0
Version:
5.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\msiexec.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\aclayers.dll
4420"C:\Users\admin\AppData\Roaming\Grovi Tend\Ifid Apps\openvpn.exe"C:\Users\admin\AppData\Roaming\Grovi Tend\Ifid Apps\openvpn.exe
msiexec.exe
User:
admin
Company:
The OpenVPN Project
Integrity Level:
MEDIUM
Description:
OpenVPN Daemon
Exit code:
0
Version:
2.6.12.0
Modules
Images
c:\users\admin\appdata\roaming\grovi tend\ifid apps\openvpn.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\ws2_32.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\crypt32.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\setupapi.dll
c:\windows\system32\msvcrt.dll
5400\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—openvpn.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
Total events
9 365
Read events
9 226
Write events
130
Delete events
9

Modification events

(PID) Process:(3984) msiexec.exeKey:HKEY_USERS\S-1-5-21-1693682860-607145093-2874071422-1001\SOFTWARE\Microsoft\RestartManager\Session0000
Operation:writeName:Owner
Value:
900F0000B7D8FC5F0C49DB01
(PID) Process:(3984) msiexec.exeKey:HKEY_USERS\S-1-5-21-1693682860-607145093-2874071422-1001\SOFTWARE\Microsoft\RestartManager\Session0000
Operation:writeName:SessionHash
Value:
6EC65ED48D2261521E625A7F053BFF392FB7E5A0C419E32271EC6F7877B417B1
(PID) Process:(3984) msiexec.exeKey:HKEY_USERS\S-1-5-21-1693682860-607145093-2874071422-1001\SOFTWARE\Microsoft\RestartManager\Session0000
Operation:writeName:Sequence
Value:
1
(PID) Process:(4052) msiexec.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content
Operation:writeName:CachePrefix
Value:
(PID) Process:(4052) msiexec.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(4052) msiexec.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
(PID) Process:(3984) msiexec.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Folders
Operation:writeName:C:\Config.Msi\
Value:
(PID) Process:(3984) msiexec.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Rollback\Scripts
Operation:writeName:C:\Config.Msi\136bcf.rbs
Value:
31148300
(PID) Process:(3984) msiexec.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Rollback\Scripts
Operation:writeName:C:\Config.Msi\136bcf.rbsLow
Value:
(PID) Process:(3984) msiexec.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Folders
Operation:writeName:C:\Users\admin\AppData\Roaming\Microsoft\Installer\
Value:
Executable files
43
Suspicious files
83
Text files
23
Unknown types
3

Dropped files

PID
Process
Filename
Type
3984msiexec.exeC:\Windows\Installer\136bcd.msi —
MD5:—
SHA256:—
4052msiexec.exeC:\Users\admin\AppData\Local\Temp\msiBDD5.txt —
MD5:—
SHA256:—
4052msiexec.exeC:\Users\admin\AppData\Local\Temp\scrBDD6.ps1 —
MD5:—
SHA256:—
4052msiexec.exeC:\Users\admin\AppData\Local\Temp\scrBDD7.txt —
MD5:—
SHA256:—
4052msiexec.exeC:\Users\admin\AppData\Local\Temp\pssBDE7.ps1 —
MD5:—
SHA256:—
3984msiexec.exeC:\Windows\Installer\MSI6CC7.tmpexecutable
MD5:EE09D6A1BB908B42C05FD0BEEB67DFD2
SHA256:7BBF611F5E2A16439DC8CD11936F6364F6D5CC0044545C92775DA5646AFC7752
3984msiexec.exeC:\Windows\Installer\MSI6D74.tmpexecutable
MD5:EE09D6A1BB908B42C05FD0BEEB67DFD2
SHA256:7BBF611F5E2A16439DC8CD11936F6364F6D5CC0044545C92775DA5646AFC7752
3984msiexec.exeC:\Windows\Installer\MSIB791.tmpexecutable
MD5:EE09D6A1BB908B42C05FD0BEEB67DFD2
SHA256:7BBF611F5E2A16439DC8CD11936F6364F6D5CC0044545C92775DA5646AFC7752
3984msiexec.exeC:\Windows\Installer\MSI6EDE.tmpexecutable
MD5:EE09D6A1BB908B42C05FD0BEEB67DFD2
SHA256:7BBF611F5E2A16439DC8CD11936F6364F6D5CC0044545C92775DA5646AFC7752
3984msiexec.exeC:\Windows\Installer\MSI6DD2.tmpexecutable
MD5:EE09D6A1BB908B42C05FD0BEEB67DFD2
SHA256:7BBF611F5E2A16439DC8CD11936F6364F6D5CC0044545C92775DA5646AFC7752
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
9
TCP/UDP connections
34
DNS requests
20
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
1380
svchost.exe
GET
200
23.53.40.178:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
1380
svchost.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
1176
svchost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
5064
SearchApp.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAI5PUjXAkJafLQcAAsO18o%3D
unknown
—
—
whitelisted
4052
msiexec.exe
GET
200
142.250.185.227:80
http://c.pki.goog/r/gsr1.crl
unknown
—
—
whitelisted
4052
msiexec.exe
GET
200
142.250.185.227:80
http://c.pki.goog/r/r4.crl
unknown
—
—
whitelisted
4132
SIHClient.exe
GET
200
88.221.125.143:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
4132
SIHClient.exe
GET
200
88.221.125.143:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
4764
backgroundTaskHost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0%3D
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
1576
RUXIMICS.exe
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
4712
MoUsoCoreWorker.exe
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
—
—
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
1380
svchost.exe
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
1380
svchost.exe
23.53.40.178:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
1380
svchost.exe
184.30.21.171:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
5064
SearchApp.exe
2.23.209.133:443
www.bing.com
Akamai International B.V.
GB
whitelisted
1176
svchost.exe
40.126.32.76:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted

DNS requests

Domain
IP
Reputation
google.com
  • 142.250.186.78
whitelisted
settings-win.data.microsoft.com
  • 20.73.194.208
  • 51.124.78.146
  • 4.231.128.59
whitelisted
crl.microsoft.com
  • 23.53.40.178
  • 23.53.40.176
whitelisted
www.microsoft.com
  • 184.30.21.171
  • 88.221.125.143
whitelisted
www.bing.com
  • 2.23.209.133
  • 2.23.209.130
  • 2.23.209.187
whitelisted
login.live.com
  • 40.126.32.76
  • 40.126.32.133
  • 20.190.160.14
  • 20.190.160.17
  • 40.126.32.134
  • 40.126.32.138
  • 40.126.32.74
  • 40.126.32.72
whitelisted
ocsp.digicert.com
  • 192.229.221.95
whitelisted
go.microsoft.com
  • 23.32.186.57
whitelisted
taco-keys.com
  • 104.21.38.176
  • 172.67.137.27
unknown
c.pki.goog
  • 142.250.185.227
whitelisted

Threats

No threats detected
Process
Message
openvpn.exe
Current Directory: C:\WINDOWS\system32 Attributes: - Directory
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
Setup.msi