File name:

76ac9ce0eb.msi

Full analysis: https://app.any.run/tasks/f8cb8b0c-14e1-4a6b-8611-7b041a545cea
Verdict: Malicious activity
Analysis date: May 13, 2024, 09:27:51
OS: Windows 10 Professional (build: 19045, 64 bit)
Tags:
generated-doc
Indicators:
MIME: application/x-msi
File info: Composite Document File V2 Document, Little Endian, Os: Windows, Version 6.2, MSI Installer, Code page: 1252, Title: Installation Database, Subject: AdBlock Shield 1.0.0.0, Author: ivanovsasha224, Keywords: Installer, Comments: This installer database contains the logic and data required to install AdBlock Shield 1.0.0.0., Template: Intel;1033, Revision Number: {35E4BF44-7772-4B59-A02E-F0AF606BB0B1}, Create Time/Date: Thu Jul 27 09:04:12 2023, Last Saved Time/Date: Thu Jul 27 09:04:12 2023, Number of Pages: 400, Number of Words: 10, Name of Creating Application: Windows Installer XML Toolset (3.11.2.4516), Security: 2
MD5:

1E9E87231555E41E6AB493217AC77756

SHA1:

541838D2B2D3BFC0BA07936CAF27ED68A436B956

SHA256:

6DA60F007A8E92B2E8F2E976D414E63C6A1759AC1F5EC4CC89A79040CFFF6A51

SSDEEP:

12288:v133ThJUcTqshcpknraa5ybagLcwc7w7zVyxdik:933XPqsh9nraa5ybHNc9ik

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Drops the executable file immediately after the start

      • msiexec.exe (PID: 6160)
      • msiexec.exe (PID: 6328)

  • SUSPICIOUS

    • Executes as Windows Service

      • VSSVC.exe (PID: 1492)

    • Reads the Windows owner or organization settings

      • msiexec.exe (PID: 6328)

  • INFO

    • Reads the computer name

      • msiexec.exe (PID: 6328)
      • msiexec.exe (PID: 5180)

    • Checks supported languages

      • msiexec.exe (PID: 6328)
      • msiexec.exe (PID: 5180)

    • Executable content was dropped or overwritten

      • msiexec.exe (PID: 6328)

    • Creates files or folders in the user directory

      • msiexec.exe (PID: 6328)

    • Reads Environment values

      • msiexec.exe (PID: 5180)

    • Creates a software uninstall entry

      • msiexec.exe (PID: 6328)

    • Reads the software policy settings

      • slui.exe (PID: 7000)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.msi | Microsoft Windows Installer (98.5)
.msi | Microsoft Installer (100)

EXIF

FlashPix

CodePage: Windows Latin 1 (Western European)
Title: Installation Database
Subject: AdBlock Shield 1.0.0.0
Author: ivanovsasha224
Keywords: Installer
Comments: This installer database contains the logic and data required to install AdBlock Shield 1.0.0.0.
Template: Intel;1033
RevisionNumber: {35E4BF44-7772-4B59-A02E-F0AF606BB0B1}
CreateDate: 2023:07:27 09:04:12
ModifyDate: 2023:07:27 09:04:12
Pages: 400
Words: 10
Software: Windows Installer XML Toolset (3.11.2.4516)
Security: Read-only recommended
No data.
screenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
139
Monitored processes
10
Malicious processes
1
Suspicious processes
0

Behavior graph

Click at the process to see the details
start msiexec.exe no specs msiexec.exe vssvc.exe no specs sppextcomobj.exe no specs slui.exe srtasks.exe no specs conhost.exe no specs msiexec.exe no specs schtasks.exe no specs conhost.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
432"schtasks.exe" /F /CREATE /TN "AdLock Update Task-S-1-5-21-1693682860-607145093-2874071422-1001" /XML "C:\Users\admin\AppData\Local\Temp\76ac9ce0eb.xml"C:\Windows\SysWOW64\schtasks.exe—msiexec.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Task Scheduler Configuration Tool
Exit code:
1
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\schtasks.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\msvcrt.dll
c:\windows\syswow64\oleaut32.dll
1492C:\WINDOWS\system32\vssvc.exeC:\Windows\System32\VSSVC.exe—services.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Microsoft® Volume Shadow Copy Service
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\vssvc.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
2480C:\WINDOWS\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:11C:\Windows\System32\SrTasks.exe—msiexec.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Microsoft® Windows System Protection background tasks.
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\srtasks.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
2680\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—schtasks.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
5180C:\Windows\syswow64\MsiExec.exe -Embedding 8E9AA2E3FB3B39EC230F4C63D8EE5D10C:\Windows\SysWOW64\msiexec.exe—msiexec.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows® installer
Exit code:
0
Version:
5.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\msiexec.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\aclayers.dll
5228\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—SrTasks.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Console Window Host
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
6160"C:\Windows\System32\msiexec.exe" /i C:\Users\admin\AppData\Local\Temp\76ac9ce0eb.msiC:\Windows\System32\msiexec.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows® installer
Exit code:
0
Version:
5.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\msiexec.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\aclayers.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
6328C:\WINDOWS\system32\msiexec.exe /VC:\Windows\System32\msiexec.exe
services.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Windows® installer
Version:
5.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\msiexec.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\aclayers.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
6936C:\WINDOWS\system32\SppExtComObj.exe -EmbeddingC:\Windows\System32\SppExtComObj.Exe—svchost.exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
KMS Connection Broker
Version:
10.0.19041.3996 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\sppextcomobj.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\oleaut32.dll
7000"C:\WINDOWS\System32\SLUI.exe" RuleId=3482d82e-ca2c-4e1f-8864-da0267b484b2;Action=AutoActivate;AppId=55c92734-d682-4d71-983e-d6ec3f16059f;SkuId=4de7cb65-cdf1-4de9-8ae8-e3cce27b9f2c;NotificationInterval=1440;Trigger=TimerEventC:\Windows\System32\slui.exe
SppExtComObj.Exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Windows Activation Client
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
Total events
5 976
Read events
5 697
Write events
260
Delete events
19

Modification events

(PID) Process:(6328) msiexec.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\SystemRestore
Operation:writeName:SrCreateRp (Enter)
Value:
4800000000000000645A5BDF17A5DA01B8180000EC130000D50700000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(6328) msiexec.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\SPP
Operation:writeName:SppGetSnapshots (Enter)
Value:
4800000000000000645A5BDF17A5DA01B8180000EC130000D20700000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(6328) msiexec.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\SPP
Operation:writeName:SppGetSnapshots (Leave)
Value:
48000000000000006927B1DF17A5DA01B8180000EC130000D20700000100000000000000000000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(6328) msiexec.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\SPP
Operation:writeName:SppEnumGroups (Enter)
Value:
48000000000000006927B1DF17A5DA01B8180000EC130000D10700000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(6328) msiexec.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\SPP
Operation:writeName:SppEnumGroups (Leave)
Value:
480000000000000030EEB5DF17A5DA01B8180000EC130000D10700000100000000000000010000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(6328) msiexec.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\SPP
Operation:writeName:SppCreate (Enter)
Value:
4800000000000000B451B8DF17A5DA01B8180000EC130000D00700000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(6328) msiexec.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SPP
Operation:writeName:LastIndex
Value:
11
(PID) Process:(6328) msiexec.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\SPP
Operation:writeName:SppGatherWriterMetadata (Enter)
Value:
4800000000000000016F5AE017A5DA01B8180000EC130000D30700000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(6328) msiexec.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\VssapiPublisher
Operation:writeName:IDENTIFY (Enter)
Value:
48000000000000008CD35CE017A5DA01B818000034150000E8030000010000000000000000000000821715DB4BAFD3468DF1F7070543492B00000000000000000000000000000000
(PID) Process:(1492) VSSVC.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\COM+ REGDB Writer
Operation:writeName:IDENTIFY (Enter)
Value:
4800000000000000169A61E017A5DA01D40500004C0F0000E80300000100000001000000000000000000000000000000000000000000000000000000000000000000000000000000
Executable files
3
Suspicious files
15
Text files
1
Unknown types
1

Dropped files

PID
Process
Filename
Type
6328msiexec.exeC:\System Volume Information\SPP\OnlineMetadataCache\{db151782-af4b-46d3-8df1-f7070543492b}_OnDiskSnapshotProp —
MD5:—
SHA256:—
6328msiexec.exeC:\System Volume Information\SPP\metadata-2 —
MD5:—
SHA256:—
6328msiexec.exeC:\WINDOWS\TEMP\~DFCFFD43746CEAE4C4.TMP —
MD5:—
SHA256:—
6328msiexec.exeC:\System Volume Information\SPP\snapshot-2binary
MD5:1E2B5470A33C47540633F51146F3AE46
SHA256:879BB6E30AB26DFCAF4A8163DBE40676CB0F6D090AB876174B03C0E4FF606FDA
6328msiexec.exeC:\WINDOWS\Installer\inprogressinstallinfo.ipibinary
MD5:2B588DDFBA3256A99B9F1FFB575E7B7B
SHA256:F575EFE79C9EED6417B5B608B8D393D761FD86BFA04FCF96766467D13A29C9ED
6328msiexec.exeC:\WINDOWS\Installer\MSI9567.tmpbinary
MD5:F368C3DD20551DABCECF96E27E28848E
SHA256:D83090D47E1C661F7EC8232E5F47179CD46D9BC93F4724555DE49A924ED0F7ED
6328msiexec.exeC:\WINDOWS\TEMP\~DF3F9A029C85E1F706.TMPbinary
MD5:2B588DDFBA3256A99B9F1FFB575E7B7B
SHA256:F575EFE79C9EED6417B5B608B8D393D761FD86BFA04FCF96766467D13A29C9ED
6328msiexec.exeC:\WINDOWS\Installer\1192f6.msiexecutable
MD5:1E9E87231555E41E6AB493217AC77756
SHA256:6DA60F007A8E92B2E8F2E976D414E63C6A1759AC1F5EC4CC89A79040CFFF6A51
6328msiexec.exeC:\WINDOWS\TEMP\~DF0D4FBD9A48E59165.TMPbinary
MD5:BF619EAC0CDF3F68D496EA9344137E8B
SHA256:076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
6328msiexec.exeC:\WINDOWS\TEMP\~DFA938330503344377.TMPgmc
MD5:BF619EAC0CDF3F68D496EA9344137E8B
SHA256:076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
6
TCP/UDP connections
39
DNS requests
16
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
5612
svchost.exe
GET
200
2.16.164.49:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
—
4000
svchost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
—
5612
svchost.exe
GET
200
104.79.89.142:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
—
6612
backgroundTaskHost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEApDqVCbATUviZV57HIIulA%3D
unknown
—
—
—
6900
SIHClient.exe
GET
200
104.79.89.142:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
—
6900
SIHClient.exe
GET
200
104.79.89.142:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
—
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
5612
svchost.exe
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
unknown
—
—
239.255.255.250:1900
—
—
—
unknown
5612
svchost.exe
2.16.164.49:80
crl.microsoft.com
Akamai International B.V.
NL
unknown
4000
svchost.exe
40.126.32.140:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
unknown
4000
svchost.exe
192.229.221.95:80
—
EDGECAST
US
unknown
4680
SearchApp.exe
184.86.251.29:443
—
Akamai International B.V.
DE
unknown
5612
svchost.exe
104.79.89.142:80
www.microsoft.com
AKAMAI-AS
DE
unknown
5140
MoUsoCoreWorker.exe
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
unknown
5256
RUXIMICS.exe
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
unknown
1032
svchost.exe
184.28.89.167:443
go.microsoft.com
AKAMAI-AS
US
unknown

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 40.127.240.158
unknown
crl.microsoft.com
  • 2.16.164.49
  • 2.16.164.120
unknown
login.live.com
  • 40.126.32.140
  • 20.190.160.22
  • 20.190.160.17
  • 40.126.32.68
  • 20.190.160.20
  • 40.126.32.74
  • 40.126.32.76
  • 40.126.32.133
unknown
www.microsoft.com
  • 104.79.89.142
unknown
go.microsoft.com
  • 184.28.89.167
unknown
slscr.update.microsoft.com
  • 52.165.165.26
unknown
fe3cr.delivery.mp.microsoft.com
  • 20.3.187.198
unknown
client.wns.windows.com
  • 40.113.103.199
unknown
arc.msn.com
  • 20.31.169.57
unknown
fd.api.iris.microsoft.com
  • 20.103.156.88
unknown

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
76ac9ce0eb.msi