File name:

ZeroTier One.msi

Full analysis: https://app.any.run/tasks/5749840f-bd46-4aba-91ab-2e736cc1a185
Verdict: Malicious activity
Analysis date: July 04, 2024, 14:22:21
OS: Windows 10 Professional (build: 19045, 64 bit)
Indicators:
MIME: application/x-msi
File info: Composite Document File V2 Document, Little Endian, Os: Windows, Version 10.0, MSI Installer, Last Printed: Fri Dec 11 11:47:44 2009, Last Saved Time/Date: Fri Sep 18 14:06:51 2020, Security: 0, Code page: 1252, Revision Number: {10779326-4D29-4D6C-A2AE-45C16F135E92}, Number of Words: 2, Subject: ZeroTier One, Author: ZeroTier, Inc., Name of Creating Application: ZeroTier One, Template: ;1033, Comments: This installer database contains the logic and data required to install ZeroTier One., Title: Installation Database, Keywords: Installer, MSI, Database, Create Time/Date: Thu Apr 18 00:45:42 2024, Number of Pages: 200
MD5:

316FC65318BD86FD3B71593501825DE6

SHA1:

6AE35FD08375D0FDA71816125A7D18B4678821C6

SHA256:

4F844EB5632CB7484499BA1B237D91FB2FD4E97176864EDE6E74AD33C599C135

SSDEEP:

98304:Q9IUoavvvM0KoIPEUfzRg01BDdEu4nndV2Sks/CtGjPoAXSiTSX5tGnDpUdqDQSR:2fUw/Qa4vsWWES

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Drops the executable file immediately after the start

      • msiexec.exe (PID: 2208)
      • drvinst.exe (PID: 5564)
      • drvinst.exe (PID: 3972)

    • Creates a writable file in the system directory

      • drvinst.exe (PID: 3972)
      • zerotier-one_x64.exe (PID: 2412)
      • drvinst.exe (PID: 5564)
      • powershell.exe (PID: 2488)

  • SUSPICIOUS

    • Executes as Windows Service

      • VSSVC.exe (PID: 5908)
      • zerotier-one_x64.exe (PID: 2412)

    • Checks Windows Trust Settings

      • msiexec.exe (PID: 2208)
      • zerotier-one_x64.exe (PID: 2412)
      • drvinst.exe (PID: 3972)

    • Reads the Windows owner or organization settings

      • msiexec.exe (PID: 2208)

    • Drops a system driver (possible attempt to evade defenses)

      • msiexec.exe (PID: 2208)
      • drvinst.exe (PID: 3972)
      • drvinst.exe (PID: 5564)

    • Uses NETSH.EXE to delete a firewall rule or allowed programs

      • zerotier-one_x64.exe (PID: 2412)

    • Uses NETSH.EXE to add a firewall rule or allowed programs

      • zerotier-one_x64.exe (PID: 2412)

    • Uses ICACLS.EXE to modify access control lists

      • zerotier-one_x64.exe (PID: 2412)

    • Reads security settings of Internet Explorer

      • MSI4DA6.tmp (PID: 6196)
      • zerotier_desktop_ui.exe (PID: 6244)

    • Reads the date of Windows installation

      • MSI4DA6.tmp (PID: 6196)
      • zerotier_desktop_ui.exe (PID: 6244)

    • Application launched itself

      • zerotier_desktop_ui.exe (PID: 6244)

    • Creates files in the driver directory

      • drvinst.exe (PID: 3972)
      • zerotier-one_x64.exe (PID: 2412)
      • drvinst.exe (PID: 5564)

    • Executable content was dropped or overwritten

      • drvinst.exe (PID: 3972)
      • drvinst.exe (PID: 5564)

    • Creates or modifies Windows services

      • drvinst.exe (PID: 5564)

    • Starts POWERSHELL.EXE for commands execution

      • zerotier-one_x64.exe (PID: 2412)

    • Found IP address in command line

      • powershell.exe (PID: 2488)

    • Detected use of alternative data streams (AltDS)

      • powershell.exe (PID: 2488)

    • Process uses IPCONFIG to get network configuration information

      • cmd.exe (PID: 6872)

  • INFO

    • Reads security settings of Internet Explorer

      • msiexec.exe (PID: 2032)
      • powershell.exe (PID: 2488)

    • Reads the software policy settings

      • msiexec.exe (PID: 2032)
      • msiexec.exe (PID: 2208)
      • zerotier-one_x64.exe (PID: 2412)
      • powershell.exe (PID: 2488)
      • drvinst.exe (PID: 3972)

    • Checks proxy server information

      • msiexec.exe (PID: 2032)

    • Creates files or folders in the user directory

      • msiexec.exe (PID: 2032)
      • zerotier_desktop_ui.exe (PID: 6328)

    • Checks supported languages

      • msiexec.exe (PID: 2208)
      • msiexec.exe (PID: 2968)
      • msiexec.exe (PID: 452)
      • msiexec.exe (PID: 4944)
      • zerotier-one_x64.exe (PID: 2412)
      • MSI4DA6.tmp (PID: 6196)
      • zerotier_desktop_ui.exe (PID: 6244)
      • zerotier_desktop_ui.exe (PID: 6328)
      • zerotier_desktop_ui.exe (PID: 6588)
      • drvinst.exe (PID: 3972)
      • drvinst.exe (PID: 5564)

    • Reads the computer name

      • msiexec.exe (PID: 2208)
      • msiexec.exe (PID: 2968)
      • msiexec.exe (PID: 452)
      • msiexec.exe (PID: 4944)
      • zerotier-one_x64.exe (PID: 2412)
      • MSI4DA6.tmp (PID: 6196)
      • zerotier_desktop_ui.exe (PID: 6244)
      • zerotier_desktop_ui.exe (PID: 6588)
      • drvinst.exe (PID: 5564)
      • drvinst.exe (PID: 3972)

    • Reads Environment values

      • msiexec.exe (PID: 2968)
      • msiexec.exe (PID: 452)

    • Drops the executable file immediately after the start

      • msiexec.exe (PID: 2032)

    • Executable content was dropped or overwritten

      • msiexec.exe (PID: 2032)
      • msiexec.exe (PID: 2208)

    • Reads the machine GUID from the registry

      • msiexec.exe (PID: 2208)
      • msiexec.exe (PID: 4944)
      • zerotier-one_x64.exe (PID: 2412)
      • drvinst.exe (PID: 3972)

    • Creates a software uninstall entry

      • msiexec.exe (PID: 2208)

    • Starts application with an unusual extension

      • msiexec.exe (PID: 2208)

    • Creates files in the program directory

      • zerotier-one_x64.exe (PID: 2412)

    • Create files in a temporary directory

      • zerotier_desktop_ui.exe (PID: 6244)

    • Process checks computer location settings

      • zerotier_desktop_ui.exe (PID: 6244)
      • MSI4DA6.tmp (PID: 6196)

    • Application launched itself

      • firefox.exe (PID: 2440)
      • firefox.exe (PID: 6704)

    • Manual execution by a user

      • cmd.exe (PID: 6872)
      • firefox.exe (PID: 2440)

    • Reads Microsoft Office registry keys

      • firefox.exe (PID: 6704)

    • Connects to unusual port

      • firefox.exe (PID: 6704)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.msi | Microsoft Windows Installer (81.9)
.mst | Windows SDK Setup Transform Script (9.2)
.msp | Windows Installer Patch (7.6)
.msi | Microsoft Installer (100)

EXIF

FlashPix

LastPrinted: 2009:12:11 11:47:44
ModifyDate: 2020:09:18 14:06:51
Security: None
CodePage: Windows Latin 1 (Western European)
RevisionNumber: {10779326-4D29-4D6C-A2AE-45C16F135E92}
Words: 2
Subject: ZeroTier One
Author: ZeroTier, Inc.
LastModifiedBy: -
Software: ZeroTier One
Template: ;1033
Comments: This installer database contains the logic and data required to install ZeroTier One.
Title: Installation Database
Keywords: Installer, MSI, Database
CreateDate: 2024:04:18 00:45:42
Pages: 200
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
215
Monitored processes
65
Malicious processes
4
Suspicious processes
2

Behavior graph

Click at the process to see the details
start msiexec.exe msiexec.exe msiexec.exe no specs vssvc.exe no specs srtasks.exe no specs conhost.exe no specs msiexec.exe no specs msiexec.exe no specs HNetCfg.FwPolicy2 no specs zerotier-one_x64.exe netsh.exe no specs conhost.exe no specs netsh.exe no specs conhost.exe no specs netsh.exe no specs conhost.exe no specs icacls.exe no specs conhost.exe no specs icacls.exe no specs conhost.exe no specs icacls.exe no specs conhost.exe no specs icacls.exe no specs conhost.exe no specs icacls.exe no specs conhost.exe no specs icacls.exe no specs conhost.exe no specs icacls.exe no specs conhost.exe no specs icacls.exe no specs conhost.exe no specs icacls.exe no specs conhost.exe no specs icacls.exe no specs conhost.exe no specs icacls.exe no specs conhost.exe no specs icacls.exe no specs conhost.exe no specs msi4da6.tmp no specs zerotier_desktop_ui.exe no specs zerotier_desktop_ui.exe zerotier_desktop_ui.exe no specs drvinst.exe drvinst.exe powershell.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs ipconfig.exe no specs firefox.exe no specs firefox.exe firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
376\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—SrTasks.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
452C:\Windows\syswow64\MsiExec.exe -Embedding D0A5C5C59CCE01A87A09190567BFB510C:\Windows\SysWOW64\msiexec.exe—msiexec.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows® installer
Exit code:
0
Version:
5.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\msiexec.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\aclayers.dll
1112\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—netsh.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1112C:\Windows\System32\icacls.exe "C:\ProgramData\ZeroTier\One\metricstoken.secret" /remove:g Everyone /t /c /QC:\Windows\System32\icacls.exe—zerotier-one_x64.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\icacls.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\ntmarta.dll
1112C:\Windows\System32\icacls.exe "C:\ProgramData\ZeroTier\One\controller.d" /remove *S-1-5-32-545 /QC:\Windows\System32\icacls.exe—zerotier-one_x64.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\icacls.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\ntmarta.dll
1328\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—icacls.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1588ipconfigC:\Windows\System32\ipconfig.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
IP Configuration Utility
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\ipconfig.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\ws2_32.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\dhcpcsvc.dll
c:\windows\system32\iphlpapi.dll
c:\windows\system32\dhcpcsvc6.dll
1672\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—powershell.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1928\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—icacls.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1928\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—icacls.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
Total events
55 468
Read events
54 985
Write events
452
Delete events
31

Modification events

(PID) Process:(2208) msiexec.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\SystemRestore
Operation:writeName:SrCreateRp (Enter)
Value:
4800000000000000CEA1EB9C1DCEDA01A008000034080000D50700000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(2208) msiexec.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\SPP
Operation:writeName:SppGetSnapshots (Enter)
Value:
4800000000000000CEA1EB9C1DCEDA01A008000034080000D20700000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(2208) msiexec.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\SPP
Operation:writeName:SppGetSnapshots (Leave)
Value:
4800000000000000E364AA9D1DCEDA01A008000034080000D20700000100000000000000000000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(2208) msiexec.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\SPP
Operation:writeName:SppEnumGroups (Enter)
Value:
4800000000000000E364AA9D1DCEDA01A008000034080000D10700000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(2208) msiexec.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\SPP
Operation:writeName:SppEnumGroups (Leave)
Value:
48000000000000008541B69D1DCEDA01A008000034080000D10700000100000000000000010000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(2208) msiexec.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\SPP
Operation:writeName:SppCreate (Enter)
Value:
480000000000000086A4B89D1DCEDA01A008000034080000D00700000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(2208) msiexec.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SPP
Operation:writeName:LastIndex
Value:
11
(PID) Process:(2208) msiexec.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\SPP
Operation:writeName:SppGatherWriterMetadata (Enter)
Value:
480000000000000089A6729E1DCEDA01A008000034080000D30700000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(2208) msiexec.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\VssapiPublisher
Operation:writeName:IDENTIFY (Enter)
Value:
4800000000000000FC6E779E1DCEDA01A0080000E4100000E8030000010000000000000000000000AA10FEEBEAADC7438B1843DDAA8CEA9A00000000000000000000000000000000
(PID) Process:(5908) VSSVC.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\ASR Writer
Operation:writeName:IDENTIFY (Enter)
Value:
480000000000000079EF799E1DCEDA0114170000CC0A0000E80300000100000001000000000000000000000000000000000000000000000000000000000000000000000000000000
Executable files
33
Suspicious files
196
Text files
39
Unknown types
9

Dropped files

PID
Process
Filename
Type
2208msiexec.exeC:\System Volume Information\SPP\metadata-2 —
MD5:—
SHA256:—
2208msiexec.exeC:\WINDOWS\Installer\1d4038.msi —
MD5:—
SHA256:—
2032msiexec.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\9CB4373A4252DE8D2212929836304EC5_1AB74AA2E3A56E1B8AD8D3FEC287554Eder
MD5:2ED0F362EE01D1E39EAFF41853EABBCC
SHA256:51D94C6DCEB1078DB6AFF585B943AFFAD3CBA0B35C856E0361BD9F75D3F8C510
2032msiexec.exeC:\Users\admin\AppData\Local\Temp\MSIECBB.tmpexecutable
MD5:B7A6A99CBE6E762C0A61A8621AD41706
SHA256:39FD8D36F8E5D915AD571EA429DB3C3DE6E9C160DBEA7C3E137C9BA4B7FD301D
2208msiexec.exeC:\System Volume Information\SPP\snapshot-2binary
MD5:AB8C2C00FCEA6BF269844CEC7180EE05
SHA256:584095EACFC001EC16F591A891909FFDC23B795FBAED285C5107161E569C09A0
2208msiexec.exeC:\WINDOWS\Installer\MSI425C.tmpexecutable
MD5:B7A6A99CBE6E762C0A61A8621AD41706
SHA256:39FD8D36F8E5D915AD571EA429DB3C3DE6E9C160DBEA7C3E137C9BA4B7FD301D
2032msiexec.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\357F04AD41BCF5FE18FCB69F60C6680F_7BB3308594A3EB9AAE4C61EE21221196der
MD5:D6DB17CAB31CF823E60C94C9B7F36977
SHA256:C96D5BE75EF0424D8C9AC20833DEF0CCE73ADA58CBDFCC8C6D4D539B69A68AA8
2032msiexec.exeC:\Users\admin\AppData\Local\Temp\MSIEEA4.tmpexecutable
MD5:B7A6A99CBE6E762C0A61A8621AD41706
SHA256:39FD8D36F8E5D915AD571EA429DB3C3DE6E9C160DBEA7C3E137C9BA4B7FD301D
2208msiexec.exeC:\WINDOWS\Installer\MSI43E8.tmp —
MD5:—
SHA256:—
2032msiexec.exeC:\Users\admin\AppData\Local\Temp\MSIED29.tmpexecutable
MD5:B7A6A99CBE6E762C0A61A8621AD41706
SHA256:39FD8D36F8E5D915AD571EA429DB3C3DE6E9C160DBEA7C3E137C9BA4B7FD301D
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
35
TCP/UDP connections
214
DNS requests
129
Threats
3

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
2032
msiexec.exe
GET
200
104.18.20.226:80
http://ocsp.globalsign.com/codesigningrootr45/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQVFZP5vqhCrtRN5SWf40Rn6NM1IAQUHwC%2FRoAK%2FHg5t6W0Q9lWULvOljsCEHe9DgW3WQu2HUdhUx4%2Fde0%3D
unknown
—
—
unknown
2032
msiexec.exe
GET
200
104.18.20.226:80
http://ocsp.globalsign.com/gsgccr45evcodesignca2020/ME0wSzBJMEcwRTAJBgUrDgMCGgUABBQaCbVYh07WONuW4e63Ydlu4AlbDAQUJZ3Q%2FFkJhmPF7POxEztXHAOSNhECDGWP9qViJDHKVZCA5w%3D%3D
unknown
—
—
unknown
6116
svchost.exe
GET
200
23.53.40.176:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
unknown
6116
svchost.exe
GET
200
23.52.120.96:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
unknown
2408
svchost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
unknown
5224
SIHClient.exe
GET
200
23.52.120.96:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
unknown
5224
SIHClient.exe
GET
200
23.52.120.96:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
unknown
6836
backgroundTaskHost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0%3D
unknown
—
—
unknown
3040
OfficeClickToRun.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAUZZSZEml49Gjh0j13P68w%3D
unknown
—
—
unknown
4656
SearchApp.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEApDqVCbATUviZV57HIIulA%3D
unknown
—
—
unknown
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
6116
svchost.exe
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
4032
svchost.exe
239.255.255.250:1900
—
—
—
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
2124
RUXIMICS.exe
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
2824
MoUsoCoreWorker.exe
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
2032
msiexec.exe
104.18.20.226:80
ocsp.globalsign.com
CLOUDFLARENET
—
shared
6004
svchost.exe
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
2412
zerotier-one_x64.exe
103.195.103.66:9993
—
—
—
unknown
2412
zerotier-one_x64.exe
192.168.100.2:5351
—
—
—
whitelisted

DNS requests

Domain
IP
Reputation
ocsp.globalsign.com
  • 104.18.20.226
  • 104.18.21.226
whitelisted
settings-win.data.microsoft.com
  • 20.73.194.208
  • 51.124.78.146
  • 40.127.240.158
whitelisted
www.bing.com
  • 2.16.110.121
  • 2.16.110.171
  • 2.16.110.170
  • 2.16.110.123
  • 2.16.110.176
  • 192.229.221.95
whitelisted
crl.microsoft.com
  • 23.53.40.176
  • 23.53.40.178
whitelisted
www.microsoft.com
  • 23.52.120.96
whitelisted
login.live.com
  • 40.126.32.72
  • 20.190.160.17
  • 40.126.32.140
  • 40.126.32.136
  • 40.126.32.134
  • 40.126.32.74
  • 40.126.32.68
  • 20.190.160.22
  • 40.126.31.67
  • 20.190.159.23
  • 20.190.159.68
  • 40.126.31.69
  • 40.126.31.73
  • 20.190.159.4
  • 20.190.159.0
  • 20.190.159.64
whitelisted
go.microsoft.com
  • 23.213.166.81
whitelisted
slscr.update.microsoft.com
  • 13.85.23.86
whitelisted
fe3cr.delivery.mp.microsoft.com
  • 20.166.126.56
whitelisted
arc.msn.com
  • 20.105.99.58
whitelisted

Threats

PID
Process
Class
Message
2412
zerotier-one_x64.exe
Potentially Bad Traffic
ET INFO ZeroTier Related Activity (udp)
2412
zerotier-one_x64.exe
Potentially Bad Traffic
INFO [ANY.RUN] Malformed TLS App-Layer Outbound Packet
2412
zerotier-one_x64.exe
Potentially Bad Traffic
ET INFO ZeroTier Related Activity (udp)
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
ZeroTier One.msi