analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
File name:

Imprimir-Fatura-19-02-2019.msi

Full analysis: https://app.any.run/tasks/2ebbdcf4-8a76-4fcd-b348-a95449eb9d8c
Verdict: Malicious activity
Analysis date: February 19, 2019, 12:58:11
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: application/x-msi
File info: Composite Document File V2 Document, Little Endian, Os: Windows, Version 6.3, MSI Installer, Last Printed: Wed Nov 21 14:59:58 2007, Create Time/Date: Wed Nov 21 14:59:58 2007, Last Saved Time/Date: Wed Nov 21 15:17:57 2007, Code page: 1252, Revision Number: {DBE20CDB-2E4C-4274-8B8D-8078B0735B02}, Number of Words: 10, Subject: Adobe Acrobat Reader, Author: Adobe Acrobat Reader, Name of Creating Application: Advanced Installer 12.2.1 build 64247, Template: ;1033, Comments: This installer database contains the logic and data required to install Adobe Acrobat Reader., Title: Installation Database, Keywords: Installer, MSI, Database, Security: 0, Number of Pages: 200
MD5:

4B1D9230B374EFFDDA67AFE2F57E2585

SHA1:

F7D78F46D1C913414C385461F95E74FA962EECFD

SHA256:

5D111482EA0B0B5065E00600D1618ACE2E9DDD5F1D75CF0BCDE4EF98E7D0F913

SSDEEP:

3072:zry4hdOmkr/wgz88ereWn/7w05g059xt7I3D7YQA6McB3RUN46ILJ9+ZB5yOanI:zrZdObO8er1nzTHC3D7YQAprp

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Application was dropped or rewritten from another process

      • lc103B.tmp (PID: 2900)

    • Changes the autorun value in the registry

      • reg.exe (PID: 2944)

    • Loads dropped or rewritten executable

      • SearchProtocolHost.exe (PID: 300)

  • SUSPICIOUS

    • Starts Internet Explorer

      • cmd.exe (PID: 3464)

    • Creates files in the user directory

      • cmd.exe (PID: 3464)

    • Executable content was dropped or overwritten

      • msiexec.exe (PID: 2592)
      • MsiExec.exe (PID: 2344)

    • Starts CMD.EXE for commands execution

      • MsiExec.exe (PID: 2344)

    • Reads Internet Cache Settings

      • MsiExec.exe (PID: 2344)

    • Uses REG.EXE to modify Windows registry

      • cmd.exe (PID: 3048)

  • INFO

    • Application launched itself

      • msiexec.exe (PID: 2592)

    • Creates files in the user directory

      • iexplore.exe (PID: 3400)

    • Reads internet explorer settings

      • iexplore.exe (PID: 3400)

    • Reads Internet Cache Settings

      • iexplore.exe (PID: 3400)
      • iexplore.exe (PID: 2856)

    • Changes internet zones settings

      • iexplore.exe (PID: 2856)

    • Reads settings of System Certificates

      • iexplore.exe (PID: 2856)

    • Starts application with an unusual extension

      • MsiExec.exe (PID: 2344)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.msi | Microsoft Windows Installer (88.6)
.mst | Windows SDK Setup Transform Script (10)
.msi | Microsoft Installer (100)

EXIF

FlashPix

LastPrinted: 2007:11:21 14:59:58
CreateDate: 2007:11:21 14:59:58
ModifyDate: 2007:11:21 15:17:57
CodePage: Windows Latin 1 (Western European)
RevisionNumber: {DBE20CDB-2E4C-4274-8B8D-8078B0735B02}
Words: 10
Subject: Adobe Acrobat Reader
Author: Adobe Acrobat Reader
LastModifiedBy: -
Software: Advanced Installer 12.2.1 build 64247
Template: ;1033
Comments: This installer database contains the logic and data required to install Adobe Acrobat Reader.
Title: Installation Database
Keywords: Installer, MSI, Database
Security: None
Pages: 200
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
51
Monitored processes
14
Malicious processes
2
Suspicious processes
1

Behavior graph

Click at the process to see the details
start drop and start msiexec.exe no specs msiexec.exe msiexec.exe cmd.exe no specs iexplore.exe iexplore.exe searchprotocolhost.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs reg.exe shutdown.exe no specs shutdown.exe no specs lc103b.tmp no specs

Process information

PID
CMD
Path
Indicators
Parent process
3104"C:\Windows\System32\msiexec.exe" /i "C:\Users\admin\Desktop\Imprimir-Fatura-19-02-2019.msi"C:\Windows\System32\msiexec.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows® installer
Version:
5.0.7600.16385 (win7_rtm.090713-1255)
2592C:\Windows\system32\msiexec.exe /VC:\Windows\system32\msiexec.exe
services.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Windows® installer
Version:
5.0.7600.16385 (win7_rtm.090713-1255)
2344C:\Windows\system32\MsiExec.exe -Embedding 15F131178115DCA1864E4291A7A4516EC:\Windows\system32\MsiExec.exe
msiexec.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows® installer
Exit code:
1073807364
Version:
5.0.7600.16385 (win7_rtm.090713-1255)
3464"C:\Windows\System32\cmd.exe" /C start /MAX https://adobe.ly/2RY5GJRC:\Windows\System32\cmd.exe—MsiExec.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
2856"C:\Program Files\Internet Explorer\iexplore.exe" -nohomeC:\Program Files\Internet Explorer\iexplore.exe
cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Internet Explorer
Exit code:
1073807364
Version:
8.00.7600.16385 (win7_rtm.090713-1255)
3400"C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:2856 CREDAT:71937C:\Program Files\Internet Explorer\iexplore.exe
iexplore.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Internet Explorer
Exit code:
0
Version:
8.00.7600.16385 (win7_rtm.090713-1255)
300"C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe6_ Global\UsGthrCtrlFltPipeMssGthrPipe6 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" C:\Windows\System32\SearchProtocolHost.exe—SearchIndexer.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Microsoft Windows Search Protocol Host
Version:
7.00.7600.16385 (win7_rtm.090713-1255)
3048"C:\Windows\System32\cmd.exe" /C start /MIN reg add HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v CzSZSr /t reg_sz /d "C:\Users\admin\Links\CzSZSr\CzSZSr.exe"C:\Windows\System32\cmd.exe—MsiExec.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
3204"C:\Windows\System32\cmd.exe" /C shutdown -r -f -t 0C:\Windows\System32\cmd.exe—MsiExec.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
3432"C:\Windows\system32\cmd.exe" /c shutdown /r /t 1 /fC:\Windows\system32\cmd.exe—MsiExec.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
1115
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Total events
1 468
Read events
1 371
Write events
0
Delete events
0

Modification events

No data
Executable files
10
Suspicious files
5
Text files
17
Unknown types
15

Dropped files

PID
Process
Filename
Type
3400iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\PP6KS563\main.min[1].jstext
MD5:1B861AABE768644459AF6B145B94E54E
SHA256:47B308A9A9E86456514B02D425A8F2EAC4D3958215FF6908432CF6DE7F8004F1
3400iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\U2ZG9DE0\liveperson.min.fp-0232b34deadc0421a8b6a57415f16562[1].csstext
MD5:1E426576474B356877191024EF5DF065
SHA256:7DEAAE6889260AB6ABE16C1DCFC485E2DDDD44726F65BA3884D3571966CE88B3
2344MsiExec.exeC:\Users\admin\Links\CzSZSr\CzSZSr.zipcompressed
MD5:3E031A594C6D7E532973284F75AB2EA5
SHA256:971AE44CC704A059B77E54C68F27B6ABB3DCEB59263DF843F49FA6DAE9CDEA7B
3400iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\OCDM6JB6\terms[1].htmlhtml
MD5:841E0D7ED7B3F0733B6C326CF0856E7D
SHA256:6065C3395E86D359DBD977232B8026D635425CDB5A8E78A99EEEB318EA971277
3400iexplore.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Cookies\Low\admin@adobe[1].txttext
MD5:945FE5318771B41CB933A6270DBC83E2
SHA256:66449D9F01EF4C49BC5A08C0D8430AC455023B77736488BED2AB4052B1C3E632
3400iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\OCDM6JB6\customized.min.fp-98a146bdf24a2f72b562417b9c873c42[1].csstext
MD5:6D54B8F730ECBC4A4A354BED32B48F95
SHA256:DED54670B07A4032B066F134E62BB1BD20B88F7BD7BB2757E010D4576C89119C
3400iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\OCDM6JB6\adobe.min.fp-9f089e57989ec2e6fb36add7a91cbd7b[1].csstext
MD5:E128187D03C3440C7C4F881BDDFD5075
SHA256:0AF569746751282665C23B2BD8CFF33477EDAA223DBA31C38891A256973334A7
2592msiexec.exeC:\Windows\Installer\20ebdb.msiexecutable
MD5:4B1D9230B374EFFDDA67AFE2F57E2585
SHA256:5D111482EA0B0B5065E00600D1618ACE2E9DDD5F1D75CF0BCDE4EF98E7D0F913
3400iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\OCDM6JB6\adobe-head.min.fp-49c976728c560175ef3915d2bbcaa219[1].jstext
MD5:E89D4A4F71AC0A90E8BE1F2446E01DC3
SHA256:66BFD06574039BECB7B87D41600B5FD34A6C476B3AB54271C6A9A74C7440B656
3400iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\BWPPCY0O\thirdparty-new.min.fp-82c94a7b28ebafb87f108e6611d49a7c[1].csstext
MD5:3F9C9B1F235EC170EF2D1F03B1EF8086
SHA256:85EC7522C5A3682307CDC7BB150D06BAC22A995C030BB1DE0FA1BDD3F9647D18
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
1
TCP/UDP connections
18
DNS requests
7
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
2856
iexplore.exe
GET
200
204.79.197.200:80
http://www.bing.com/favicon.ico
US
image
237 b
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
2856
iexplore.exe
204.79.197.200:80
www.bing.com
Microsoft Corporation
US
whitelisted
3400
iexplore.exe
92.123.235.227:443
www.adobe.com
Akamai International B.V.
—
whitelisted
2344
MsiExec.exe
52.218.24.163:443
s3-eu-west-1.amazonaws.com
Amazon.com, Inc.
IE
unknown
3400
iexplore.exe
67.199.248.13:443
adobe.ly
Bitly Inc
US
shared
2856
iexplore.exe
92.123.235.227:443
www.adobe.com
Akamai International B.V.
—
whitelisted
3400
iexplore.exe
23.38.53.224:443
use.typekit.com
Akamai International B.V.
NL
whitelisted
2344
MsiExec.exe
172.217.21.228:80
www.google.com
Google Inc.
US
whitelisted

DNS requests

Domain
IP
Reputation
s3-eu-west-1.amazonaws.com
  • 52.218.24.163
shared
www.bing.com
  • 204.79.197.200
  • 13.107.21.200
whitelisted
adobe.ly
  • 67.199.248.13
  • 67.199.248.12
suspicious
www.adobe.com
  • 92.123.235.227
whitelisted
use.typekit.com
  • 23.38.53.224
whitelisted
p.typekit.net
  • 23.38.53.224
shared
www.google.com
  • 172.217.21.228
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2024 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
Imprimir-Fatura-19-02-2019.msi