File name:

81b73.msi

Full analysis: https://app.any.run/tasks/1aa7f6e6-3b96-4db0-8185-f74df89d599d
Verdict: Malicious activity
Analysis date: November 14, 2023, 06:32:01
OS: Windows 7 Professional Service Pack 1 (build: 7601, 64 bit)
Tags:
generated-doc
Indicators:
MIME: application/x-msi
File info: Composite Document File V2 Document, Little Endian, Os: Windows, Version 10.0, MSI Installer, Last Printed: Fri Dec 11 11:47:44 2009, Create Time/Date: Fri Dec 11 11:47:44 2009, Last Saved Time/Date: Fri Dec 11 11:47:44 2009, Security: 0, Code page: 1252, Revision Number: {3EC57D06-013F-4180-9922-FE5C74B65FE6}, Number of Words: 10, Subject: Browser Assistant, Author: Realistic Media Inc., Name of Creating Application: Advanced Installer 15.8 build b14c769f44, Template: ;1033, Comments: This installer database contains the logic and data required to install Browser Assistant., Title: Installation Database, Keywords: Installer, MSI, Database, Number of Pages: 200
MD5:

1528B593F65BCBCA9A88663AC528510F

SHA1:

2528591984935CC3290AAC4931CDBA8DCA580BFB

SHA256:

69925C370A71B0BC37EB5D6381E8FC3309A7E71A7BDADE54233214C73C728170

SSDEEP:

196608://Jwrsfnmos+6n03JMfFCoyIfiyKmZ2AbyILoGeHwXVECuX:nJwrsfmZ05MMoamZ22yILoGfXJuX

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Bypass execution policy to execute commands

      • powershell.exe (PID: 1584)
      • powershell.exe (PID: 2412)
      • powershell.exe (PID: 2992)

    • Changes powershell execution policy (Bypass)

      • msiexec.exe (PID: 2784)

    • Drops the executable file immediately after the start

      • msiexec.exe (PID: 1088)
      • 7za.exe (PID: 2840)

  • SUSPICIOUS

    • Reads the Internet Settings

      • msiexec.exe (PID: 2700)
      • powershell.exe (PID: 1584)

    • Checks Windows Trust Settings

      • msiexec.exe (PID: 1088)

    • Executes as Windows Service

      • VSSVC.exe (PID: 2952)

    • The process executes Powershell scripts

      • msiexec.exe (PID: 2784)

    • The process hide an interactive prompt from the user

      • msiexec.exe (PID: 2784)

    • The process bypasses the loading of PowerShell profile settings

      • msiexec.exe (PID: 2784)

    • Starts POWERSHELL.EXE for commands execution

      • msiexec.exe (PID: 2784)

    • Uses TASKKILL.EXE to kill process

      • powershell.exe (PID: 2412)

    • Process drops legitimate windows executable

      • msiexec.exe (PID: 1088)

    • Drops 7-zip archiver for unpacking

      • msiexec.exe (PID: 1088)

    • Unusual connection from system programs

      • powershell.exe (PID: 1584)

    • The process drops C-runtime libraries

      • msiexec.exe (PID: 1088)

  • INFO

    • Reads the computer name

      • msiexec.exe (PID: 1088)
      • msiexec.exe (PID: 2784)
      • 7za.exe (PID: 2840)

    • Checks supported languages

      • msiexec.exe (PID: 1088)
      • msiexec.exe (PID: 2784)
      • 7za.exe (PID: 2840)

    • Create files in a temporary directory

      • msiexec.exe (PID: 2700)
      • msiexec.exe (PID: 2784)
      • powershell.exe (PID: 1584)
      • powershell.exe (PID: 2412)
      • msiexec.exe (PID: 1088)
      • powershell.exe (PID: 2992)

    • Reads the machine GUID from the registry

      • msiexec.exe (PID: 1088)
      • msiexec.exe (PID: 2784)

    • Creates files or folders in the user directory

      • msiexec.exe (PID: 2700)
      • msiexec.exe (PID: 1088)
      • 7za.exe (PID: 2840)

    • Reads security settings of Internet Explorer

      • msiexec.exe (PID: 2700)
      • powershell.exe (PID: 1584)
      • powershell.exe (PID: 2412)
      • powershell.exe (PID: 2992)

    • Reads Environment values

      • msiexec.exe (PID: 2784)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.msi | Microsoft Windows Installer (81.9)
.mst | Windows SDK Setup Transform Script (9.2)
.msp | Windows Installer Patch (7.6)
.msi | Microsoft Installer (100)

EXIF

FlashPix

LastPrinted: 2009:12:11 11:47:44
CreateDate: 2009:12:11 11:47:44
ModifyDate: 2009:12:11 11:47:44
Security: None
CodePage: Windows Latin 1 (Western European)
RevisionNumber: {3EC57D06-013F-4180-9922-FE5C74B65FE6}
Words: 10
Subject: Browser Assistant
Author: Realistic Media Inc.
LastModifiedBy: -
Software: Advanced Installer 15.8 build b14c769f44
Template: ;1033
Comments: This installer database contains the logic and data required to install Browser Assistant.
Title: Installation Database
Keywords: Installer, MSI, Database
Pages: 200
No data.
screenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
45
Monitored processes
9
Malicious processes
3
Suspicious processes
1

Behavior graph

Click at the process to see the details
start msiexec.exe msiexec.exe no specs vssvc.exe no specs msiexec.exe no specs powershell.exe powershell.exe no specs taskkill.exe no specs powershell.exe no specs 7za.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
1088C:\Windows\system32\msiexec.exe /VC:\Windows\System32\msiexec.exe—services.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Windows® installer
Exit code:
0
Version:
5.0.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\msiexec.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
1584 -NoProfile -Noninteractive -ExecutionPolicy Bypass -File "C:\Users\admin\AppData\Local\Temp\pssD7F9.tmp.ps1" C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
msiexec.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows PowerShell
Exit code:
0
Version:
10.0.14409.1005 (rs1_srvoob.161208-1155)
Modules
Images
c:\windows\syswow64\windowspowershell\v1.0\powershell.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\system32\kernel32.dll
c:\windows\syswow64\kernel32.dll
c:\windows\system32\user32.dll
c:\windows\syswow64\kernelbase.dll
2412 -NoProfile -Noninteractive -ExecutionPolicy Bypass -File "C:\Users\admin\AppData\Local\Temp\pssE1E0.tmp.ps1" C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe—msiexec.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows PowerShell
Exit code:
1
Version:
10.0.14409.1005 (rs1_srvoob.161208-1155)
Modules
Images
c:\windows\syswow64\windowspowershell\v1.0\powershell.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\system32\kernel32.dll
c:\windows\syswow64\kernel32.dll
c:\windows\system32\user32.dll
c:\windows\syswow64\kernelbase.dll
2448"C:\Windows\system32\taskkill.exe" /F /pid C:\Windows\SysWOW64\taskkill.exe—powershell.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Terminates Processes
Exit code:
1
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\syswow64\taskkill.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\system32\kernel32.dll
c:\windows\syswow64\kernel32.dll
c:\windows\system32\user32.dll
c:\windows\syswow64\kernelbase.dll
2700"C:\Windows\System32\msiexec.exe" /i "C:\Users\admin\AppData\Local\Temp\81b73.msi"C:\Windows\System32\msiexec.exe
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows® installer
Exit code:
0
Version:
5.0.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\msiexec.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
2784C:\Windows\syswow64\MsiExec.exe -Embedding A1BB27B6F358590E246C17DF05DBC1FCC:\Windows\SysWOW64\msiexec.exe—msiexec.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows® installer
Exit code:
0
Version:
5.0.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\syswow64\msiexec.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\system32\kernel32.dll
c:\windows\syswow64\kernel32.dll
c:\windows\system32\user32.dll
c:\windows\syswow64\kernelbase.dll
2840"C:\Users\admin\AppData\Roaming/Browser Assistant/7za.exe" x Data2.7z -y -p1.41.1302.28794C:\Users\admin\AppData\Roaming\Browser Assistant\7za.exe—powershell.exe
User:
admin
Company:
Igor Pavlov
Integrity Level:
MEDIUM
Description:
7-Zip Standalone Console
Exit code:
0
Version:
19.00
Modules
Images
c:\users\admin\appdata\roaming\browser assistant\7za.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\system32\kernel32.dll
c:\windows\syswow64\kernel32.dll
c:\windows\system32\user32.dll
c:\windows\syswow64\kernelbase.dll
2952C:\Windows\system32\vssvc.exeC:\Windows\System32\VSSVC.exe—services.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Microsoft® Volume Shadow Copy Service
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\vssvc.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
2992 -NoProfile -Noninteractive -ExecutionPolicy Bypass -File "C:\Users\admin\AppData\Local\Temp\pssEE58.tmp.ps1" C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe—msiexec.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows PowerShell
Exit code:
0
Version:
10.0.14409.1005 (rs1_srvoob.161208-1155)
Modules
Images
c:\windows\syswow64\windowspowershell\v1.0\powershell.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\system32\kernel32.dll
c:\windows\syswow64\kernel32.dll
c:\windows\system32\user32.dll
c:\windows\syswow64\kernelbase.dll
Total events
7 277
Read events
7 229
Write events
43
Delete events
5

Modification events

(PID) Process:(2700) msiexec.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\156\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(1088) msiexec.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\SystemRestore
Operation:writeName:SrCreateRp (Enter)
Value:
4800000000000000C42CD6BE4EB0D9014C0F0000380F0000D50700000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(1088) msiexec.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\SPP
Operation:writeName:SppCreate (Enter)
Value:
4800000000000000C42CD6BE4EB0D9014C0F0000380F0000D00700000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(1088) msiexec.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SPP
Operation:writeName:LastIndex
Value:
66
(PID) Process:(1088) msiexec.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\SPP
Operation:writeName:SppGatherWriterMetadata (Enter)
Value:
480000000000000080A00ABF4EB0D9014C0F0000380F0000D30700000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(1088) msiexec.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\SPP
Operation:writeName:SppGatherWriterMetadata (Leave)
Value:
4800000000000000A4CA79C04EB0D9014C0F0000380F0000D30700000100000000000000000000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(1088) msiexec.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\SPP
Operation:writeName:SppAddInterestingComponents (Enter)
Value:
4800000000000000A4CA79C04EB0D9014C0F0000380F0000D40700000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(1088) msiexec.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\SPP
Operation:writeName:SppAddInterestingComponents (Leave)
Value:
4800000000000000CE3F8FC04EB0D9014C0F0000380F0000D40700000100000000000000000000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(1088) msiexec.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\SPP
Operation:writeName:SppCreate (Leave)
Value:
48000000000000000CAEE5C24EB0D9014C0F0000380F0000D00700000100000000000000000000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(1088) msiexec.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\SystemRestore
Operation:writeName:SrCreateRp (Leave)
Value:
48000000000000006610E8C24EB0D9014C0F0000380F0000D50700000100000000000000000000000000000000000000000000000000000000000000000000000000000000000000
Executable files
61
Suspicious files
67
Text files
2 085
Unknown types
0

Dropped files

PID
Process
Filename
Type
1088msiexec.exeC:\System Volume Information\SPP\metadata-2 —
MD5:—
SHA256:—
1088msiexec.exeC:\Windows\Installer\19d3b1.msi —
MD5:—
SHA256:—
2784msiexec.exeC:\Users\admin\AppData\Local\Temp\msiD7E7.tmp.txt —
MD5:—
SHA256:—
2784msiexec.exeC:\Users\admin\AppData\Local\Temp\pssD7E8.tmp.ps1 —
MD5:—
SHA256:—
2784msiexec.exeC:\Users\admin\AppData\Local\Temp\pssD7F9.tmp.ps1 —
MD5:—
SHA256:—
2784msiexec.exeC:\Users\admin\AppData\Local\Temp\msiE1CF.tmp.txt —
MD5:—
SHA256:—
2784msiexec.exeC:\Users\admin\AppData\Local\Temp\pssE1DF.tmp.ps1 —
MD5:—
SHA256:—
2784msiexec.exeC:\Users\admin\AppData\Local\Temp\pssE1E0.tmp.ps1 —
MD5:—
SHA256:—
1088msiexec.exeC:\Windows\Installer\MSIE76C.tmpexecutable
MD5:3144225F1A2DCCFDA435970964158357
SHA256:A99D2C6FD1667942A085F01784BD599762182FCE8A8F866FA12AC93F52AE2ED1
1584powershell.exeC:\Users\admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractivebinary
MD5:446DD1CF97EABA21CF14D03AEBC79F27
SHA256:A7DE5177C68A64BD48B36D49E2853799F4EBCFA8E4761F7CC472F333DC5F65CF
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
3
TCP/UDP connections
9
DNS requests
3
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
2700
msiexec.exe
GET
200
23.32.238.178:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab?16a5120acdc97ea5
DE
compressed
61.6 Kb
unknown
1584
powershell.exe
POST
200
13.32.118.218:80
http://d1ph3c47yby10w.cloudfront.net/
US
binary
19 b
unknown
2700
msiexec.exe
GET
200
34.229.33.15:80
http://www.ssl.com/repository/SSLcom-RootCA-EV-RSA-4096-R2.crt
US
binary
1.48 Kb
unknown
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:138
—
—
—
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
324
svchost.exe
224.0.0.252:5355
—
—
—
unknown
1956
svchost.exe
239.255.255.250:1900
—
—
—
whitelisted
2700
msiexec.exe
34.229.33.15:80
www.ssl.com
AMAZON-AES
US
unknown
2700
msiexec.exe
23.32.238.178:80
ctldl.windowsupdate.com
Akamai International B.V.
DE
unknown
1584
powershell.exe
13.32.118.218:80
d1ph3c47yby10w.cloudfront.net
AMAZON-02
US
unknown

DNS requests

Domain
IP
Reputation
www.ssl.com
  • 34.229.33.15
  • 18.205.123.191
unknown
ctldl.windowsupdate.com
  • 23.32.238.178
  • 23.32.238.232
  • 23.32.238.224
  • 23.32.238.171
  • 23.32.238.240
  • 23.32.238.226
  • 23.32.238.219
  • 23.32.238.169
  • 23.32.238.241
whitelisted
d1ph3c47yby10w.cloudfront.net
  • 13.32.118.218
  • 13.32.118.131
  • 13.32.118.75
  • 13.32.118.166
unknown

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
81b73.msi