analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
File name:

Win10.0_System_Upgrade_Software.msi

Full analysis: https://app.any.run/tasks/bdc532ff-bc36-422d-bece-dbc057e40652
Verdict: Malicious activity
Analysis date: May 21, 2022, 08:00:13
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
generated-doc
Indicators:
MIME: application/x-msi
File info: Composite Document File V2 Document, Little Endian, Os: Windows, Version 6.2, MSI Installer, Code page: 1252, Title: Installation Database, Subject: Installer, Author: Corporation, Keywords: Installer, Comments: Installer Package, Template: Intel;1033, Revision Number: {DEBB4A85-EC27-4415-B5D6-DF4F44095086}, Create Time/Date: Wed Apr 27 17:56:46 2022, Last Saved Time/Date: Wed Apr 27 17:56:46 2022, Number of Pages: 200, Number of Words: 10, Name of Creating Application: Windows Installer XML Toolset (3.11.2.4163), Security: 2
MD5:

5D4E40D1D41C4588FBF7065FA85454E7

SHA1:

CA876C335EF0A4D90B456F13CC975C04016A5CC1

SHA256:

4C7314083933A283C87DC28ABBED3082040F12E92EDAC47FF72F8539AF6E3EA1

SSDEEP:

768:qhDfhKuI7+HwtCvdttj42XZ5uNenzMtKf17xXbdTXbkVB3YoyWMDCTyWMDC/YifW:8u7+ACu2XZ/zMkIVCo0D80DO7fxP

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Drops executable file immediately after starts

      • msiexec.exe (PID: 3452)

  • SUSPICIOUS

    • Reads the computer name

      • msiexec.exe (PID: 3452)
      • MsiExec.exe (PID: 3984)

    • Checks supported languages

      • msiexec.exe (PID: 3452)
      • MsiExec.exe (PID: 3984)

    • Executed as Windows Service

      • vssvc.exe (PID: 1960)

    • Reads the Windows organization settings

      • msiexec.exe (PID: 2960)
      • msiexec.exe (PID: 3452)

    • Reads Windows owner or organization settings

      • msiexec.exe (PID: 2960)
      • msiexec.exe (PID: 3452)

    • Reads Environment values

      • vssvc.exe (PID: 1960)

    • Drops a file with a compile date too recent

      • msiexec.exe (PID: 3452)

    • Executable content was dropped or overwritten

      • msiexec.exe (PID: 3452)

  • INFO

    • Checks supported languages

      • msiexec.exe (PID: 2960)
      • vssvc.exe (PID: 1960)

    • Reads settings of System Certificates

      • msiexec.exe (PID: 2960)
      • msiexec.exe (PID: 3452)

    • Reads the computer name

      • msiexec.exe (PID: 2960)
      • vssvc.exe (PID: 1960)

    • Checks Windows Trust Settings

      • msiexec.exe (PID: 2960)
      • msiexec.exe (PID: 3452)

    • Application launched itself

      • msiexec.exe (PID: 3452)

    • Creates a software uninstall entry

      • msiexec.exe (PID: 3452)

    • Searches for installed software

      • msiexec.exe (PID: 3452)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.msi | Microsoft Installer (100)

EXIF

FlashPix

Security: Read-only recommended
Software: Windows Installer XML Toolset (3.11.2.4163)
Words: 10
Pages: 200
ModifyDate: 2022:04:27 16:56:46
CreateDate: 2022:04:27 16:56:46
RevisionNumber: {DEBB4A85-EC27-4415-B5D6-DF4F44095086}
Template: Intel;1033
Comments: Installer Package
Keywords: Installer
Author: Corporation
Subject: Installer
Title: Installation Database
CodePage: Windows Latin 1 (Western European)
No data.
screenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
37
Monitored processes
4
Malicious processes
1
Suspicious processes
0

Behavior graph

Click at the process to see the details
start msiexec.exe no specs msiexec.exe vssvc.exe no specs msiexec.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
2960"C:\Windows\System32\msiexec.exe" /i "C:\Users\admin\AppData\Local\Temp\Win10.0_System_Upgrade_Software.msi"C:\Windows\System32\msiexec.exe—Explorer.EXE
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows® installer
Exit code:
0
Version:
5.0.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\msiexec.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
3452C:\Windows\system32\msiexec.exe /VC:\Windows\system32\msiexec.exe
services.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Windows® installer
Version:
5.0.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\ntdll.dll
c:\windows\system32\msiexec.exe
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
1960C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe—services.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Microsoft® Volume Shadow Copy Service
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\vssvc.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
3984C:\Windows\system32\MsiExec.exe -Embedding A75499F5DC81DD03B257BAFC91430EC0C:\Windows\system32\MsiExec.exe—msiexec.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows® installer
Exit code:
0
Version:
5.0.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\ntdll.dll
c:\windows\system32\msiexec.exe
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
Total events
7 992
Read events
7 736
Write events
0
Delete events
0

Modification events

No data
Executable files
3
Suspicious files
6
Text files
0
Unknown types
3

Dropped files

PID
Process
Filename
Type
3452msiexec.exeC:\System Volume Information\SPP\metadata-2 —
MD5:—
SHA256:—
3452msiexec.exeC:\Users\admin\AppData\Local\uhau8i5a9k —
MD5:—
SHA256:—
3452msiexec.exeC:\Windows\Installer\MSIEA28.tmpexecutable
MD5:EADAAA6EDAB657ED52D0B76325494469
SHA256:EC0AC9068FA7C0E422F0F090EFB31E335EF87439BB5034E98A6D9F1A6E292ACB
3452msiexec.exeC:\Windows\Installer\MSIEA87.tmpbinary
MD5:66C4B29D38FB0016D8A64B4A337E3DFF
SHA256:FFCE3D7D555C98957C98F312E9D77BBDC35F4B4965485901064CE63BD7F022D8
3452msiexec.exeC:\Users\admin\AppData\Local\Temp\~DF113365585415C952.TMPgmc
MD5:8E25BECF6C9AB9CAAE8C7440D20F7343
SHA256:9760FB872F38E7803F307F6CC9AE47E230C749D0495621C412730E3F435361D1
3452msiexec.exeC:\Config.Msi\fe865.rbsbinary
MD5:A23DA811C9A66FA5AEE2D5D51D798EEE
SHA256:45DBB430BA8340103837C18AF052049A0801B07339A78B69AE9A77D64CB03A2F
3452msiexec.exeC:\System Volume Information\SPP\OnlineMetadataCache\{de0b4ef1-168b-431a-8ad0-749b97e3d8d2}_OnDiskSnapshotPropbinary
MD5:EA6F806B7601ABDEEF394FE59334E3CE
SHA256:31DB1690CEDDB6B1A4710065CB70FEC27C62C4BA48FDAFDA23FE7E468113500A
3452msiexec.exeC:\Windows\Installer\fe864.ipibinary
MD5:FDC264F8FFA118220FE57C304F1D6C72
SHA256:EC827B07E0B90FF4EF84EC67C79B81141AF3280511191BC3246CF47EF7C29FAB
3452msiexec.exeC:\Windows\Installer\fe863.msiexecutable
MD5:5D4E40D1D41C4588FBF7065FA85454E7
SHA256:4C7314083933A283C87DC28ABBED3082040F12E92EDAC47FF72F8539AF6E3EA1
3452msiexec.exeC:\Windows\Installer\fe866.msiexecutable
MD5:5D4E40D1D41C4588FBF7065FA85454E7
SHA256:4C7314083933A283C87DC28ABBED3082040F12E92EDAC47FF72F8539AF6E3EA1
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
0
DNS requests
0
Threats
0

HTTP requests

No HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

No data

DNS requests

No data

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2024 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
Win10.0_System_Upgrade_Software.msi