File name: | dcmnt090023.msi |
Full analysis: | https://app.any.run/tasks/b5a549a7-45ec-4e16-a714-0f7c39249f57 |
Verdict: | Malicious activity |
Analysis date: | December 06, 2019, 18:14:10 |
OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
Tags: | |
Indicators: | |
MIME: | application/x-msi |
File info: | Composite Document File V2 Document, Little Endian, Os: Windows, Version 10.0, MSI Installer, Last Printed: Fri Dec 11 11:47:44 2009, Create Time/Date: Fri Dec 11 11:47:44 2009, Last Saved Time/Date: Fri Dec 11 11:47:44 2009, Security: 0, Code page: 1252, Revision Number: {B88BBFEB-8677-4474-AC00-65BFBE385688}, Number of Words: 10, Subject: Microsoft Gamepad, Author: MiniWorld, Name of Creating Application: Advanced Installer 15.9 build daae28bc, Template: ;1033, Comments: This installer database contains the logic and data required to install Microsoft Gamepad., Title: Installation Database, Keywords: Installer, MSI, Database, Number of Pages: 200 |
MD5: | 43F2F3026B7E7656CE5F8DD1567302A6 |
SHA1: | EE3146C97D52C7A713B6BFC68283057775B66D79 |
SHA256: | 6364E2C32155D42FF55BF5FD75F9C453F16E6E449E9F0E37A7AFBB178695F4D6 |
SSDEEP: | 24576:N0XLTLZk09TZneKRi1jUZJY9fgVUoxhrQDvw07Ra6A+l:N0XH1hTZeKRmjUZJYu+vw07Ra6A |
.msi | | | Microsoft Windows Installer (88.6) |
---|---|---|
.mst | | | Windows SDK Setup Transform Script (10) |
.msi | | | Microsoft Installer (100) |
LastPrinted: | 2009:12:11 11:47:44 |
---|---|
CreateDate: | 2009:12:11 11:47:44 |
ModifyDate: | 2009:12:11 11:47:44 |
Security: | None |
CodePage: | Windows Latin 1 (Western European) |
RevisionNumber: | {B88BBFEB-8677-4474-AC00-65BFBE385688} |
Words: | 10 |
Subject: | Microsoft Gamepad |
Author: | MiniWorld |
LastModifiedBy: | - |
Software: | Advanced Installer 15.9 build daae28bc |
Template: | ;1033 |
Comments: | This installer database contains the logic and data required to install Microsoft Gamepad. |
Title: | Installation Database |
Keywords: | Installer, MSI, Database |
Pages: | 200 |
PID | CMD | Path | Indicators | Parent process |
---|---|---|---|---|
2812 | "C:\Windows\System32\msiexec.exe" /i "C:\Users\admin\Desktop\dcmnt090023.msi" | C:\Windows\System32\msiexec.exe | — | explorer.exe |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows® installer Exit code: 0 Version: 5.0.7600.16385 (win7_rtm.090713-1255) | ||||
2080 | C:\Windows\system32\msiexec.exe /V | C:\Windows\system32\msiexec.exe | services.exe | |
User: SYSTEM Company: Microsoft Corporation Integrity Level: SYSTEM Description: Windows® installer Version: 5.0.7600.16385 (win7_rtm.090713-1255) | ||||
1708 | C:\Windows\system32\MsiExec.exe -Embedding A1AADB2E7D1CBAE963A4A0ADA5C256DB | C:\Windows\system32\MsiExec.exe | msiexec.exe | |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows® installer Exit code: 0 Version: 5.0.7600.16385 (win7_rtm.090713-1255) | ||||
3276 | "C:\Users\admin\AppData\Roaming\MiniWorld\Microsoft Gamepad\OneDrive.exe" | C:\Users\admin\AppData\Roaming\MiniWorld\Microsoft Gamepad\OneDrive.exe | msiexec.exe | |
User: admin Company: 迷你玩科技有限公司 Integrity Level: MEDIUM Description: 迷你世界 Version: 1.0.0.1 | ||||
976 | "C:\Program Files\Internet Explorer\iexplore.exe" http://bit.ly/385lrYI | C:\Program Files\Internet Explorer\iexplore.exe | OneDrive.exe | |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Internet Explorer Exit code: 1 Version: 8.00.7600.16385 (win7_rtm.090713-1255) | ||||
2892 | "C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:976 CREDAT:71937 | C:\Program Files\Internet Explorer\iexplore.exe | iexplore.exe | |
User: admin Company: Microsoft Corporation Integrity Level: LOW Description: Internet Explorer Exit code: 0 Version: 8.00.7600.16385 (win7_rtm.090713-1255) | ||||
3788 | C:\Windows\system32\Macromed\Flash\FlashUtil32_26_0_0_131_ActiveX.exe -Embedding | C:\Windows\system32\Macromed\Flash\FlashUtil32_26_0_0_131_ActiveX.exe | — | svchost.exe |
User: admin Company: Adobe Systems Incorporated Integrity Level: MEDIUM Description: Adobe® Flash® Player Installer/Uninstaller 26.0 r0 Exit code: 0 Version: 26,0,0,131 |
PID | Process | Filename | Type | |
---|---|---|---|---|
2080 | msiexec.exe | C:\Windows\Installer\MSIAE3C.tmp | — | |
MD5:— | SHA256:— | |||
2080 | msiexec.exe | C:\Windows\Installer\MSIAED9.tmp | — | |
MD5:— | SHA256:— | |||
2080 | msiexec.exe | C:\Windows\Installer\MSIAF19.tmp | — | |
MD5:— | SHA256:— | |||
2080 | msiexec.exe | C:\Users\admin\AppData\Local\Temp\~DF8C9604685EFB578D.TMP | — | |
MD5:— | SHA256:— | |||
2080 | msiexec.exe | C:\Windows\Installer\MSIB015.tmp | — | |
MD5:— | SHA256:— | |||
2080 | msiexec.exe | C:\Windows\Installer\MSIB035.tmp | — | |
MD5:— | SHA256:— | |||
1708 | MsiExec.exe | C:\Users\admin\AppData\Roaming\MiniWorld\Microsoft Gamepad\OneDrive.zip.part | — | |
MD5:— | SHA256:— | |||
1708 | MsiExec.exe | C:\Users\admin\AppData\Roaming\MiniWorld\Microsoft Gamepad\OneDrive.zip | — | |
MD5:— | SHA256:— | |||
2080 | msiexec.exe | C:\Windows\Installer\MSICAF4.tmp | — | |
MD5:— | SHA256:— | |||
2080 | msiexec.exe | C:\Config.Msi\39ad35.rbs | — | |
MD5:— | SHA256:— |
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
---|---|---|---|---|---|---|---|---|---|
2892 | iexplore.exe | GET | 301 | 67.199.248.10:80 | http://bit.ly/385lrYI | US | html | 159 b | shared |
PID | Process | IP | Domain | ASN | CN | Reputation |
---|---|---|---|---|---|---|
2892 | iexplore.exe | 138.197.4.239:443 | blog.akop.com.br | Digital Ocean, Inc. | US | unknown |
2892 | iexplore.exe | 172.217.16.130:443 | pagead2.googlesyndication.com | Google Inc. | US | whitelisted |
2892 | iexplore.exe | 67.199.248.10:80 | bit.ly | Bitly Inc | US | shared |
2892 | iexplore.exe | 172.217.23.174:443 | www.google-analytics.com | Google Inc. | US | whitelisted |
2892 | iexplore.exe | 74.125.206.155:443 | stats.g.doubleclick.net | Google Inc. | US | whitelisted |
2892 | iexplore.exe | 216.58.210.14:443 | www.youtube.com | Google Inc. | US | whitelisted |
2892 | iexplore.exe | 172.217.21.206:443 | www.youtube.com | Google Inc. | US | whitelisted |
976 | iexplore.exe | 13.107.21.200:80 | www.bing.com | Microsoft Corporation | US | whitelisted |
1708 | MsiExec.exe | 52.219.80.32:443 | geracao2.s3.us-east-2.amazonaws.com | Amazon.com, Inc. | US | unknown |
2892 | iexplore.exe | 172.217.22.104:443 | www.googletagmanager.com | Google Inc. | US | whitelisted |
Domain | IP | Reputation |
---|---|---|
geracao2.s3.us-east-2.amazonaws.com |
| suspicious |
bit.ly |
| shared |
blog.akop.com.br |
| unknown |
www.bing.com |
| whitelisted |
www.googletagmanager.com |
| whitelisted |
www.google-analytics.com |
| whitelisted |
pagead2.googlesyndication.com |
| whitelisted |
stats.g.doubleclick.net |
| whitelisted |
www.youtube.com |
| whitelisted |
s.ytimg.com |
| whitelisted |