File name: | OpenVPN-2.6.12-I001-amd64.msi |
Full analysis: | https://app.any.run/tasks/2625d322-dd65-4325-a923-729104a003c2 |
Verdict: | Malicious activity |
Analysis date: | August 11, 2024, 16:43:13 |
OS: | Windows 10 Professional (build: 19045, 64 bit) |
Tags: | |
Indicators: | |
MIME: | application/x-msi |
File info: | Composite Document File V2 Document, Little Endian, Os: Windows, Version 6.2, MSI Installer, Code page: 1252, Title: Installation Database, Subject: OpenVPN 2.6.12-I001 amd64, Author: OpenVPN, Inc., Keywords: Installer, Comments: This installer database contains the logic and data required to install OpenVPN 2.6.12-I001 amd64., Template: x64;1033, Revision Number: {BF5745AD-8DEC-4CA6-B592-CA6F82192E1C}, Create Time/Date: Thu Jul 18 10:22:00 2024, Last Saved Time/Date: Thu Jul 18 10:22:00 2024, Number of Pages: 500, Number of Words: 2, Name of Creating Application: Windows Installer XML Toolset (3.14.1.8722), Security: 4 |
MD5: | 635B9D9D72F6E455F35365801FB4B040 |
SHA1: | A9DF3D98EECFCA7372C03FEE38D530F5B7AEBCF8 |
SHA256: | 525759FE9E52A77A7D2CAD99F5AF1923D7D3027CAB775CCFB7469CE0FD2B1758 |
SSDEEP: | 98304:0HtpwDAQ/+jcyOIWEw15FS76szPBKyNMxCxM4/8pz9AKinu/CvhHRplv9i8Q6Nx2:cKvxT/FsQ1+ |
.msi | | | Microsoft Windows Installer (98.5) |
---|---|---|
.msi | | | Microsoft Installer (100) |
Security: | Read-only enforced |
---|---|
Software: | Windows Installer XML Toolset (3.14.1.8722) |
Words: | 2 |
Pages: | 500 |
ModifyDate: | 2024:07:18 10:22:00 |
CreateDate: | 2024:07:18 10:22:00 |
RevisionNumber: | {BF5745AD-8DEC-4CA6-B592-CA6F82192E1C} |
Template: | x64;1033 |
Comments: | This installer database contains the logic and data required to install OpenVPN 2.6.12-I001 amd64. |
Keywords: | Installer |
Author: | OpenVPN, Inc. |
Subject: | OpenVPN 2.6.12-I001 amd64 |
Title: | Installation Database |
CodePage: | Windows Latin 1 (Western European) |
PID | CMD | Path | Indicators | Parent process | |||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
6436 | "C:\Windows\System32\msiexec.exe" /i C:\Users\admin\AppData\Local\Temp\OpenVPN-2.6.12-I001-amd64.msi | C:\Windows\System32\msiexec.exe | explorer.exe | ||||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows® installer Exit code: 0 Version: 5.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
6568 | C:\WINDOWS\system32\msiexec.exe /V | C:\Windows\System32\msiexec.exe | services.exe | ||||||||||||
User: SYSTEM Company: Microsoft Corporation Integrity Level: SYSTEM Description: Windows® installer Version: 5.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
6656 | C:\Windows\System32\MsiExec.exe -Embedding 7B4F1D89144913E2F4B752714AEECEF1 C | C:\Windows\System32\msiexec.exe | — | msiexec.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows® installer Exit code: 0 Version: 5.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
6392 | C:\WINDOWS\system32\vssvc.exe | C:\Windows\System32\VSSVC.exe | — | services.exe | |||||||||||
User: SYSTEM Company: Microsoft Corporation Integrity Level: SYSTEM Description: Microsoft® Volume Shadow Copy Service Exit code: 0 Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
4576 | C:\WINDOWS\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:11 | C:\Windows\System32\SrTasks.exe | — | msiexec.exe | |||||||||||
User: SYSTEM Company: Microsoft Corporation Integrity Level: SYSTEM Description: Microsoft® Windows System Protection background tasks. Exit code: 0 Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
2928 | \??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1 | C:\Windows\System32\conhost.exe | — | SrTasks.exe | |||||||||||
User: SYSTEM Company: Microsoft Corporation Integrity Level: SYSTEM Description: Console Window Host Exit code: 0 Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
3188 | C:\Windows\System32\MsiExec.exe -Embedding 9145023D3BA1A1CC65E2F5C5B903A936 | C:\Windows\System32\msiexec.exe | — | msiexec.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows® installer Exit code: 0 Version: 5.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
1184 | C:\Windows\System32\MsiExec.exe -Embedding 48637097AA468DF203DCD6F21F3B16DE E Global\MSI0000 | C:\Windows\System32\msiexec.exe | msiexec.exe | ||||||||||||
User: SYSTEM Company: Microsoft Corporation Integrity Level: SYSTEM Description: Windows® installer Exit code: 0 Version: 5.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
3904 | DrvInst.exe "4" "1" "C:\WINDOWS\Temp\8e287cbdeede8242dd7ecd7755d3c528d4a09a0e148acc470b029249b30a730a\wintun.inf" "9" "4e7126313" "0000000000000174" "WinSta0\Default" "00000000000001E8" "208" "C:\WINDOWS\Temp\8e287cbdeede8242dd7ecd7755d3c528d4a09a0e148acc470b029249b30a730a" | C:\Windows\System32\drvinst.exe | svchost.exe | ||||||||||||
User: SYSTEM Company: Microsoft Corporation Integrity Level: SYSTEM Description: Driver Installation Module Exit code: 0 Version: 10.0.19041.3996 (WinBuild.160101.0800) Modules
| |||||||||||||||
7060 | DrvInst.exe "4" "1" "C:\WINDOWS\Temp\acdadd0394d40eeca7d35e7ff91353d0145eced8634d1bf60af749c282c4151f\OemVista.inf" "9" "4fc31481f" "00000000000001F4" "WinSta0\Default" "00000000000001F0" "208" "C:\WINDOWS\Temp\acdadd0394d40eeca7d35e7ff91353d0145eced8634d1bf60af749c282c4151f" | C:\Windows\System32\drvinst.exe | svchost.exe | ||||||||||||
User: SYSTEM Company: Microsoft Corporation Integrity Level: SYSTEM Description: Driver Installation Module Exit code: 0 Version: 10.0.19041.3996 (WinBuild.160101.0800) Modules
|
(PID) Process: | (6568) msiexec.exe | Key: | HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\SystemRestore |
Operation: | write | Name: | SrCreateRp (Enter) |
Value: 48000000000000000185CBA10DECDA01A819000004190000D50700000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 | |||
(PID) Process: | (6568) msiexec.exe | Key: | HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\SPP |
Operation: | write | Name: | SppGetSnapshots (Enter) |
Value: 48000000000000000185CBA10DECDA01A819000004190000D20700000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 | |||
(PID) Process: | (6568) msiexec.exe | Key: | HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\SPP |
Operation: | write | Name: | SppGetSnapshots (Leave) |
Value: 480000000000000090CE2FA20DECDA01A819000004190000D20700000100000000000000000000000000000000000000000000000000000000000000000000000000000000000000 | |||
(PID) Process: | (6568) msiexec.exe | Key: | HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\SPP |
Operation: | write | Name: | SppEnumGroups (Enter) |
Value: 480000000000000090CE2FA20DECDA01A819000004190000D10700000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 | |||
(PID) Process: | (6568) msiexec.exe | Key: | HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\SPP |
Operation: | write | Name: | SppEnumGroups (Leave) |
Value: 4800000000000000D07234A20DECDA01A819000004190000D10700000100000000000000010000000000000000000000000000000000000000000000000000000000000000000000 | |||
(PID) Process: | (6568) msiexec.exe | Key: | HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\SPP |
Operation: | write | Name: | SppCreate (Enter) |
Value: 4800000000000000D78D3BA20DECDA01A819000004190000D00700000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 | |||
(PID) Process: | (6568) msiexec.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SPP |
Operation: | write | Name: | LastIndex |
Value: 11 | |||
(PID) Process: | (6568) msiexec.exe | Key: | HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\SPP |
Operation: | write | Name: | SppGatherWriterMetadata (Enter) |
Value: 48000000000000000F40E0A20DECDA01A819000004190000D30700000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 | |||
(PID) Process: | (6568) msiexec.exe | Key: | HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\VssapiPublisher |
Operation: | write | Name: | IDENTIFY (Enter) |
Value: 4800000000000000D1E0E4A20DECDA01A8190000A8170000E803000001000000000000000000000024991858AFB6C247AD689F07AE27632900000000000000000000000000000000 | |||
(PID) Process: | (6392) VSSVC.exe | Key: | HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\Shadow Copy Optimization Writer |
Operation: | write | Name: | IDENTIFY (Enter) |
Value: 4800000000000000D2F4F7A20DECDA01F81800007C180000E80300000100000001000000000000000000000000000000000000000000000000000000000000000000000000000000 |
PID | Process | Filename | Type | |
---|---|---|---|---|
6568 | msiexec.exe | C:\System Volume Information\SPP\metadata-2 | — | |
MD5:— | SHA256:— | |||
6568 | msiexec.exe | C:\Windows\Installer\f1776.msi | — | |
MD5:— | SHA256:— | |||
6436 | msiexec.exe | C:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB | der | |
MD5:8358092757B62F879CF39DC9274894CA | SHA256:D72B634CD47262CF36FEBD296BA48F3F984F972DA03116C3C0C16E94B7F5738E | |||
6568 | msiexec.exe | C:\System Volume Information\SPP\OnlineMetadataCache\{58189924-b6af-47c2-ad68-9f07ae276329}_OnDiskSnapshotProp | binary | |
MD5:2492BFBBBF377817710C5DB7D332602E | SHA256:E4482DFE4BA8C89377155D153735E8AB28269D515AF6CCC5658CE9EA5223F12E | |||
6568 | msiexec.exe | C:\Windows\Temp\~DFCEFDFD1E3CF5BB33.TMP | binary | |
MD5:15F834B9EEE1CA3A565C9FD73E968F75 | SHA256:5E3BAEBBD2C4187BBE98346D0241E41B8FD6BDB2C518C1DAFA61E211D5F8BF70 | |||
6568 | msiexec.exe | C:\Windows\Installer\MSI1C39.tmp | binary | |
MD5:D1A0C653F65266B91C8DFEE8C4683693 | SHA256:49A4DB6096C84D554371D35EDD1EAD3877122F2808A629702C3E21F8A21BB83D | |||
6568 | msiexec.exe | C:\Windows\Installer\MSI1F57.tmp | executable | |
MD5:F97794A736B3C59CED7C005806FE9000 | SHA256:3F591A709E24A1D95FE81CBB7EFE336E91A92299A95FDBDA91ADDF9AA0763030 | |||
6568 | msiexec.exe | C:\Windows\Installer\MSI20C0.tmp | executable | |
MD5:718222E232D11298DFBABBC2B70D8B14 | SHA256:45E855461F5D1BE28A2F88416603070BD1778055ABDD06834AE58E97B7DDF53C | |||
6568 | msiexec.exe | C:\System Volume Information\SPP\snapshot-2 | binary | |
MD5:2492BFBBBF377817710C5DB7D332602E | SHA256:E4482DFE4BA8C89377155D153735E8AB28269D515AF6CCC5658CE9EA5223F12E | |||
6436 | msiexec.exe | C:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB | binary | |
MD5:D04DF20E8EA0D2F38B5B621FFD974AD5 | SHA256:A9DA43A1E4E359A3908C1E4C7646CEE955FE1A93F4518283193DA376DF9B10CC |
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
---|---|---|---|---|---|---|---|---|---|
6436 | msiexec.exe | GET | 200 | 192.229.221.95:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBT3xL4LQLXDRDM9P665TW442vrsUQQUReuir%2FSSy4IxLVGLp6chnfNtyA8CEA6bGI750C3n79tQ4ghAGFo%3D | unknown | — | — | unknown |
6436 | msiexec.exe | GET | 200 | 192.229.221.95:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfIs%2BLjDtGwQ09XEB1Yeq%2BtX%2BBgQQU7NfjgtJxXWRM3y5nP%2Be6mK4cD08CEAitQLJg0pxMn17Nqb2Trtk%3D | unknown | — | — | unknown |
6436 | msiexec.exe | GET | 200 | 192.229.221.95:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSRXerF0eFeSWRripTgTkcJWMm7iQQUaDfg67Y7%2BF8Rhvv%2BYXsIiGX0TkICEAzUxnaTjMm9vxp0%2F7fWexo%3D | unknown | — | — | unknown |
5300 | svchost.exe | GET | 200 | 192.229.221.95:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D | unknown | — | — | unknown |
6908 | backgroundTaskHost.exe | GET | 200 | 192.229.221.95:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0%3D | unknown | — | — | unknown |
5300 | svchost.exe | GET | 200 | 192.229.221.95:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D | unknown | — | — | unknown |
5336 | SearchApp.exe | GET | 200 | 192.229.221.95:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAI5PUjXAkJafLQcAAsO18o%3D | unknown | — | — | unknown |
5336 | SearchApp.exe | GET | 200 | 192.229.221.95:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAUZZSZEml49Gjh0j13P68w%3D | unknown | — | — | unknown |
6944 | backgroundTaskHost.exe | GET | 200 | 192.229.221.95:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0%3D | unknown | — | — | unknown |
2656 | OfficeClickToRun.exe | GET | 200 | 192.229.221.95:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEApDqVCbATUviZV57HIIulA%3D | unknown | — | — | unknown |
PID | Process | IP | Domain | ASN | CN | Reputation |
---|---|---|---|---|---|---|
3888 | svchost.exe | 239.255.255.250:1900 | — | — | — | whitelisted |
3360 | svchost.exe | 51.104.136.2:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | IE | whitelisted |
5116 | RUXIMICS.exe | 51.104.136.2:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | IE | whitelisted |
2120 | MoUsoCoreWorker.exe | 51.104.136.2:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | IE | whitelisted |
4 | System | 192.168.100.255:138 | — | — | — | whitelisted |
4 | System | 192.168.100.255:137 | — | — | — | whitelisted |
6436 | msiexec.exe | 192.229.221.95:80 | ocsp.digicert.com | EDGECAST | US | whitelisted |
3360 | svchost.exe | 40.127.240.158:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | IE | unknown |
5336 | SearchApp.exe | 23.36.162.84:443 | www.bing.com | Akamai International B.V. | DE | unknown |
5336 | SearchApp.exe | 192.229.221.95:80 | ocsp.digicert.com | EDGECAST | US | whitelisted |
Domain | IP | Reputation |
---|---|---|
settings-win.data.microsoft.com |
| whitelisted |
google.com |
| whitelisted |
ocsp.digicert.com |
| whitelisted |
www.bing.com |
| whitelisted |
client.wns.windows.com |
| whitelisted |
login.live.com |
| whitelisted |
th.bing.com |
| whitelisted |
fd.api.iris.microsoft.com |
| whitelisted |
arc.msn.com |
| whitelisted |
slscr.update.microsoft.com |
| whitelisted |