Analysis date (UTC): 14 November 2023, 06:32Analysis environment: Windows 7 Pro, build 7601, x64

81b73.msi

MD5:1528B593F65BCBCA9A88663AC528510F

SHA1:2528591984935CC3290AAC4931CDBA8DCA580BFB

SHA256:69925C370A71B0BC37EB5D6381E8FC3309A7E71A7BDADE54233214C73C728170

Analysis result

Threat level:Malicious activity

Tags:

generated-doc

Full analysis:Analysis 81b73.msi (MD5: 1528B593F65BCBCA9A88663AC528510F) Malicious activity - Interactive analysis ANY.RUN

Behavior activities

MALICIOUS

Bypass execution policy to execute commands

powershell.exe (PID: 1584)
powershell.exe (PID: 2412)
powershell.exe (PID: 2992)

Changes powershell execution policy (Bypass)

msiexec.exe (PID: 2784)

Drops the executable file immediately after the start

msiexec.exe (PID: 1088)
7za.exe (PID: 2840)

SUSPICIOUS

Reads the Internet Settings

msiexec.exe (PID: 2700)
powershell.exe (PID: 1584)

Checks Windows Trust Settings

msiexec.exe (PID: 1088)

Executes as Windows Service

VSSVC.exe (PID: 2952)

The process executes Powershell scripts

msiexec.exe (PID: 2784)

Starts POWERSHELL.EXE for commands execution

msiexec.exe (PID: 2784)

Drops 7-zip archiver for unpacking

msiexec.exe (PID: 1088)

The process hide an interactive prompt from the user

msiexec.exe (PID: 2784)

The process bypasses the loading of PowerShell profile settings

msiexec.exe (PID: 2784)

Process drops legitimate windows executable

msiexec.exe (PID: 1088)

The process drops C-runtime libraries

msiexec.exe (PID: 1088)

Unusual connection from system programs

powershell.exe (PID: 1584)

Uses TASKKILL.EXE to kill process

powershell.exe (PID: 2412)

INFO

Reads the computer name

msiexec.exe (PID: 1088)
msiexec.exe (PID: 2784)
7za.exe (PID: 2840)

Checks supported languages

msiexec.exe (PID: 1088)
msiexec.exe (PID: 2784)
7za.exe (PID: 2840)

Reads security settings of Internet Explorer

msiexec.exe (PID: 2700)
powershell.exe (PID: 2412)
powershell.exe (PID: 1584)
powershell.exe (PID: 2992)

Create files in a temporary directory

msiexec.exe (PID: 2700)
msiexec.exe (PID: 2784)
powershell.exe (PID: 1584)
powershell.exe (PID: 2412)
powershell.exe (PID: 2992)
msiexec.exe (PID: 1088)

Creates files or folders in the user directory

msiexec.exe (PID: 2700)
msiexec.exe (PID: 1088)
7za.exe (PID: 2840)

Reads the machine GUID from the registry

msiexec.exe (PID: 1088)
msiexec.exe (PID: 2784)

Reads Environment values

msiexec.exe (PID: 2784)

Threats

No threats detected