File name:

52341adb87a5e79d06901a64002c494e3f431c378193982c30225eab3b136688.msi

Full analysis: https://app.any.run/tasks/2adaee21-599e-4eeb-86d0-3f1e6976609d
Verdict: Malicious activity
Analysis date: January 15, 2025, 18:12:22
OS: Windows 10 Professional (build: 19045, 64 bit)
Tags:
generated-doc
Indicators:
MIME: application/x-msi
File info: Composite Document File V2 Document, Little Endian, Os: Windows, Version 10.0, MSI Installer, Security: 0, Code page: 1252, Revision Number: {B33EC93A-7963-48BA-BFFE-FA8E09A16C9E}, Number of Words: 10, Subject: Joas App, Author: Barsoc Quite Sols, Name of Creating Application: Joas App, Template: x64;2057, Comments: This installer database contains the logic and data required to install Joas App., Title: Installation Database, Keywords: Installer, MSI, Database, Create Time/Date: Wed Jan 15 12:32:58 2025, Last Saved Time/Date: Wed Jan 15 12:32:58 2025, Last Printed: Wed Jan 15 12:32:58 2025, Number of Pages: 450
MD5:

FC2FCA2711E9FF2C2D5919F4C27CD1A1

SHA1:

1D0A411878F9EBC1C5C7DA1B2FE812C295A37CBD

SHA256:

52341ADB87A5E79D06901A64002C494E3F431C378193982C30225EAB3B136688

SSDEEP:

196608:mrFVNBAlwKwiV+PR9U+nv8LcngwlDXB7b421If9:6PIOhianXEdwlDtb4P

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Changes powershell execution policy (Bypass)

      • msiexec.exe (PID: 6632)

    • Bypass execution policy to execute commands

      • powershell.exe (PID: 6772)

  • SUSPICIOUS

    • Reads security settings of Internet Explorer

      • msiexec.exe (PID: 6632)

    • Checks Windows Trust Settings

      • msiexec.exe (PID: 6632)

    • The process hide an interactive prompt from the user

      • msiexec.exe (PID: 6632)

    • The process bypasses the loading of PowerShell profile settings

      • msiexec.exe (PID: 6632)

    • Process drops legitimate windows executable

      • msiexec.exe (PID: 6580)

    • Reverses array data (POWERSHELL)

      • powershell.exe (PID: 6772)

    • The process drops C-runtime libraries

      • msiexec.exe (PID: 6580)

    • Starts POWERSHELL.EXE for commands execution

      • msiexec.exe (PID: 6632)

    • The process executes Powershell scripts

      • msiexec.exe (PID: 6632)

  • INFO

    • Reads the computer name

      • msiexec.exe (PID: 6580)
      • msiexec.exe (PID: 6632)

    • The sample compiled with english language support

      • msiexec.exe (PID: 6580)

    • An automatically generated document

      • msiexec.exe (PID: 6468)

    • Reads Environment values

      • msiexec.exe (PID: 6632)

    • Executable content was dropped or overwritten

      • msiexec.exe (PID: 6580)

    • Checks supported languages

      • msiexec.exe (PID: 6632)
      • msiexec.exe (PID: 6580)
      • createdump.exe (PID: 6932)

    • Reads the machine GUID from the registry

      • msiexec.exe (PID: 6632)

    • Create files in a temporary directory

      • msiexec.exe (PID: 6632)
      • powershell.exe (PID: 6772)

    • Reads the software policy settings

      • msiexec.exe (PID: 6632)
      • powershell.exe (PID: 6772)

    • Checks proxy server information

      • msiexec.exe (PID: 6632)

    • Uses string replace method (POWERSHELL)

      • powershell.exe (PID: 6772)

    • Creates files or folders in the user directory

      • msiexec.exe (PID: 6580)

    • Reads security settings of Internet Explorer

      • powershell.exe (PID: 6772)

    • Creates a software uninstall entry

      • msiexec.exe (PID: 6580)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.msi | Microsoft Windows Installer (88.6)
.mst | Windows SDK Setup Transform Script (10)
.msi | Microsoft Installer (100)

EXIF

FlashPix

Security: None
CodePage: Windows Latin 1 (Western European)
RevisionNumber: {B33EC93A-7963-48BA-BFFE-FA8E09A16C9E}
Words: 10
Subject: Joas App
Author: Barsoc Quite Sols
LastModifiedBy: -
Software: Joas App
Template: x64;2057
Comments: This installer database contains the logic and data required to install Joas App.
Title: Installation Database
Keywords: Installer, MSI, Database
CreateDate: 2025:01:15 12:32:58
ModifyDate: 2025:01:15 12:32:58
LastPrinted: 2025:01:15 12:32:58
Pages: 450
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
119
Monitored processes
9
Malicious processes
1
Suspicious processes
1

Behavior graph

Click at the process to see the details
start msiexec.exe no specs msiexec.exe msiexec.exe powershell.exe no specs conhost.exe no specs obs-ffmpeg-mux.exe no specs createdump.exe no specs conhost.exe no specs conhost.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
6468"C:\Windows\System32\msiexec.exe" /i C:\Users\admin\Desktop\52341adb87a5e79d06901a64002c494e3f431c378193982c30225eab3b136688.msiC:\Windows\System32\msiexec.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows® installer
Exit code:
0
Version:
5.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\msiexec.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\aclayers.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
6580C:\WINDOWS\system32\msiexec.exe /VC:\Windows\System32\msiexec.exe
services.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Windows® installer
Version:
5.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\msiexec.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\aclayers.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
6632C:\Windows\syswow64\MsiExec.exe -Embedding 92579458F0AB37376F94C38DFA7874D0C:\Windows\SysWOW64\msiexec.exe
msiexec.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows® installer
Exit code:
0
Version:
5.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\msiexec.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\aclayers.dll
6772 -NoProfile -Noninteractive -ExecutionPolicy Bypass -File "C:\Users\admin\AppData\Local\Temp\pssC181.ps1" -propFile "C:\Users\admin\AppData\Local\Temp\msiC17E.txt" -scriptFile "C:\Users\admin\AppData\Local\Temp\scrC17F.ps1" -scriptArgsFile "C:\Users\admin\AppData\Local\Temp\scrC180.txt" -propSep " :<->: " -lineSep " <<:>> " -testPrefix "_testValue."C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe—msiexec.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows PowerShell
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\windowspowershell\v1.0\powershell.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\msvcrt.dll
c:\windows\syswow64\oleaut32.dll
6780\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—powershell.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
6924"C:\Users\admin\AppData\Roaming\Barsoc Quite Sols\Joas App\obs-ffmpeg-mux.exe"C:\Users\admin\AppData\Roaming\Barsoc Quite Sols\Joas App\obs-ffmpeg-mux.exe—msiexec.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
3221225781
Modules
Images
c:\users\admin\appdata\roaming\barsoc quite sols\joas app\obs-ffmpeg-mux.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\ucrtbase.dll
c:\users\admin\appdata\roaming\barsoc quite sols\joas app\avcodec-60.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\ole32.dll
c:\windows\system32\rpcrt4.dll
6932"C:\Users\admin\AppData\Roaming\Barsoc Quite Sols\Joas App\createdump.exe"C:\Users\admin\AppData\Roaming\Barsoc Quite Sols\Joas App\createdump.exe—msiexec.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft .NET Runtime Crash Dump Generator
Exit code:
4294967295
Version:
6,0,2223,42425 @Commit: 4bb6dc195c0a3bc4c7e24ff54a8925b98db
Modules
Images
c:\users\admin\appdata\roaming\barsoc quite sols\joas app\createdump.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\ws2_32.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\dbghelp.dll
c:\windows\system32\dbgcore.dll
6940\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—obs-ffmpeg-mux.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
6948\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—createdump.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
Total events
9 470
Read events
9 325
Write events
136
Delete events
9

Modification events

(PID) Process:(6580) msiexec.exeKey:HKEY_USERS\S-1-5-21-1693682860-607145093-2874071422-1001\SOFTWARE\Microsoft\RestartManager\Session0000
Operation:writeName:Owner
Value:
B4190000FF9D8A1C7967DB01
(PID) Process:(6580) msiexec.exeKey:HKEY_USERS\S-1-5-21-1693682860-607145093-2874071422-1001\SOFTWARE\Microsoft\RestartManager\Session0000
Operation:writeName:SessionHash
Value:
CD2B15C58EBADE4A8582117A295A888219DDF11F9ABBAC8DD1CBCB50FEA530CD
(PID) Process:(6580) msiexec.exeKey:HKEY_USERS\S-1-5-21-1693682860-607145093-2874071422-1001\SOFTWARE\Microsoft\RestartManager\Session0000
Operation:writeName:Sequence
Value:
1
(PID) Process:(6580) msiexec.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Folders
Operation:writeName:C:\Users\admin\AppData\Roaming\Microsoft\Installer\
Value:
(PID) Process:(6580) msiexec.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-21-1693682860-607145093-2874071422-1001\Components\E443C93FE38A0674D88A2F672090B5F4
Operation:writeName:F77D37381FFFF4549ACB50E784EDD908
Value:
C:\Users\admin\AppData\Roaming\Barsoc Quite Sols\Joas App\
(PID) Process:(6580) msiexec.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-21-1693682860-607145093-2874071422-1001\Components\187E38CB2ED78A74793CE2C69CCBDA28
Operation:writeName:F77D37381FFFF4549ACB50E784EDD908
Value:
21:\Software\Barsoc Quite Sols\Joas App\Version
(PID) Process:(6580) msiexec.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-21-1693682860-607145093-2874071422-1001\Components\3E23C972A00A3154A9B83D89A4146ABF
Operation:writeName:F77D37381FFFF4549ACB50E784EDD908
Value:
C:\Users\admin\AppData\Roaming\Barsoc Quite Sols\Joas App\utest.dll
(PID) Process:(6580) msiexec.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-21-1693682860-607145093-2874071422-1001\Components\4E53B16B1EB817146BB92E24C39E71F9
Operation:writeName:F77D37381FFFF4549ACB50E784EDD908
Value:
C:\Users\admin\AppData\Roaming\Barsoc Quite Sols\Joas App\vcruntime140.dll
(PID) Process:(6580) msiexec.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-21-1693682860-607145093-2874071422-1001\Components\EE69BDDFD74852B4581B566E26FC368A
Operation:writeName:F77D37381FFFF4549ACB50E784EDD908
Value:
C:\Users\admin\AppData\Roaming\Barsoc Quite Sols\Joas App\vcruntime140_1.dll
(PID) Process:(6580) msiexec.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-21-1693682860-607145093-2874071422-1001\Components\DE8D80696CE804542B23A42863608F26
Operation:writeName:F77D37381FFFF4549ACB50E784EDD908
Value:
C:\Users\admin\AppData\Roaming\Barsoc Quite Sols\Joas App\msvcp140.dll
Executable files
53
Suspicious files
16
Text files
7
Unknown types
6

Dropped files

PID
Process
Filename
Type
6580msiexec.exeC:\Windows\Installer\13aa9b.msi —
MD5:—
SHA256:—
6632msiexec.exeC:\Users\admin\AppData\Local\Temp\msiC17E.txt —
MD5:—
SHA256:—
6632msiexec.exeC:\Users\admin\AppData\Local\Temp\scrC17F.ps1 —
MD5:—
SHA256:—
6632msiexec.exeC:\Users\admin\AppData\Local\Temp\scrC180.txt —
MD5:—
SHA256:—
6632msiexec.exeC:\Users\admin\AppData\Local\Temp\pssC181.ps1 —
MD5:—
SHA256:—
6580msiexec.exeC:\Windows\Installer\MSIAD3C.tmpexecutable
MD5:EE09D6A1BB908B42C05FD0BEEB67DFD2
SHA256:7BBF611F5E2A16439DC8CD11936F6364F6D5CC0044545C92775DA5646AFC7752
6580msiexec.exeC:\Windows\Installer\MSIAC02.tmpexecutable
MD5:EE09D6A1BB908B42C05FD0BEEB67DFD2
SHA256:7BBF611F5E2A16439DC8CD11936F6364F6D5CC0044545C92775DA5646AFC7752
6580msiexec.exeC:\Windows\Installer\MSIAF33.tmpexecutable
MD5:E83D774F643972B8ECCDB3A34DA135C5
SHA256:D0A6F6373CFB902FCD95BC12360A9E949F5597B72C01E0BD328F9B1E2080B5B7
6580msiexec.exeC:\Windows\Temp\~DFDB7F13D417BF22B9.TMPbinary
MD5:0630BDBFEA6DB1A54FBF6C1D6815784D
SHA256:2910760F99D0165DAA83E025A718833A6978AF61D9F5968932CC11CDC46D6B39
6580msiexec.exeC:\Users\admin\AppData\Roaming\Barsoc Quite Sols\Joas App\utest.dllexecutable
MD5:01DACEA3CBE5F2557D0816FC64FAE363
SHA256:B4C96B1E5EEE34871D9AB43BCEE8096089742032C0669DF3C9234941AAC3D502
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
3
TCP/UDP connections
19
DNS requests
6
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
4712
MoUsoCoreWorker.exe
GET
200
2.16.168.114:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
4712
MoUsoCoreWorker.exe
GET
200
2.23.246.101:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
—
—
POST
403
188.114.97.3:443
https://staticmaxepress.com/updater2.php
unknown
html
4.42 Kb
—
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:138
—
—
—
whitelisted
—
—
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
4712
MoUsoCoreWorker.exe
2.16.168.114:80
crl.microsoft.com
Akamai International B.V.
RU
whitelisted
4712
MoUsoCoreWorker.exe
2.23.246.101:80
www.microsoft.com
Ooredoo Q.S.C.
QA
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
6632
msiexec.exe
188.114.96.3:443
staticmaxepress.com
CLOUDFLARENET
NL
unknown

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 51.124.78.146
whitelisted
google.com
  • 142.250.185.206
whitelisted
crl.microsoft.com
  • 2.16.168.114
  • 2.16.168.124
whitelisted
www.microsoft.com
  • 2.23.246.101
whitelisted
staticmaxepress.com
  • 188.114.96.3
  • 188.114.97.3
unknown
self.events.data.microsoft.com
  • 20.189.173.10
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
52341adb87a5e79d06901a64002c494e3f431c378193982c30225eab3b136688.msi