| File name: | EA Sports UFC 3 PC Downloader_526235.msi |
| Full analysis: | https://app.any.run/tasks/20d18aee-0e40-4160-9f62-32f6ed221856 |
| Verdict: | Malicious activity |
| Analysis date: | November 12, 2020, 19:06:36 |
| OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
| Tags: | |
| Indicators: | |
| MIME: | application/x-msi |
| File info: | Composite Document File V2 Document, Little Endian, Os: Windows, Version 6.2, MSI Installer, Code page: 1252, Title: Installation Database, Subject: This setup package will Install Native Didymochlaena version 1.6.7.4, Author: Didymochlaena Native Soft, Keywords: Installer, Comments: This installer database contains the logic and data required to install Native Didymochlaena., Template: Intel;1033, Revision Number: {1B5B4F85-F0EA-4727-B873-0BDDC1467700}, Create Time/Date: Wed Nov 11 19:19:56 2020, Last Saved Time/Date: Wed Nov 11 19:19:56 2020, Number of Pages: 200, Number of Words: 10, Name of Creating Application: Windows Installer XML Toolset (3.11.0.1528), Security: 2 |
| MD5: | 81F9BE1FE184DA046F17FF14DFBB0607 |
| SHA1: | 7BF2E8E74979BF6635A8CB81A6EDD691ABC77E5D |
| SHA256: | 7195F238EF395AFF69C3C7C3CDEA93A584CB634136CAB5CAA0CB79D8DB3C9F02 |
| SSDEEP: | 24576:DUPUbDh9GZFRpXHEgaak7FGNNvRG4i6XWTtF2:D8kDhOHhzk5GNnG4CTtw |
MALICIOUS
Application was dropped or rewritten from another process
- NativeDidymochlaena.exe (PID: 2936)
- NativeDidymochlaena.exe (PID: 2176)
- DidymochlaenakNative.exe (PID: 2736)
Loads dropped or rewritten executable
- DidymochlaenakNative.exe (PID: 2736)
SUSPICIOUS
Executable content was dropped or overwritten
- msiexec.exe (PID: 1892)
- NativeDidymochlaena.exe (PID: 2176)
- DidymochlaenakNative.exe (PID: 2736)
Creates files in the program directory
- NativeDidymochlaena.exe (PID: 2936)
- NativeDidymochlaena.exe (PID: 2176)
Creates files in the user directory
- NativeDidymochlaena.exe (PID: 2936)
- msiexec.exe (PID: 1892)
- NativeDidymochlaena.exe (PID: 2176)
Application launched itself
- NativeDidymochlaena.exe (PID: 2936)
- cmd.exe (PID: 2892)
Starts CMD.EXE for self-deleting
- cmd.exe (PID: 2892)
- NativeDidymochlaena.exe (PID: 2176)
Starts CMD.EXE for commands execution
- NativeDidymochlaena.exe (PID: 2176)
- cmd.exe (PID: 2892)
INFO
No info indicators.
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
TRiD
| .msi | | | Microsoft Installer (100) |
|---|
EXIF
FlashPix
| CodePage: | Windows Latin 1 (Western European) |
|---|---|
| Title: | Installation Database |
| Subject: | This setup package will Install Native Didymochlaena version 1.6.7.4 |
| Author: | Didymochlaena Native Soft |
| Keywords: | Installer |
| Comments: | This installer database contains the logic and data required to install Native Didymochlaena. |
| Template: | Intel;1033 |
| RevisionNumber: | {1B5B4F85-F0EA-4727-B873-0BDDC1467700} |
| CreateDate: | 2020:11:11 19:19:56 |
| ModifyDate: | 2020:11:11 19:19:56 |
| Pages: | 200 |
| Words: | 10 |
| Software: | Windows Installer XML Toolset (3.11.0.1528) |
| Security: | Read-only recommended |
Total processes
46
Monitored processes
9
Malicious processes
4
Suspicious processes
0
Behavior graph
Click at the process to see the details
Process information
PID | CMD | Path | Indicators | Parent process | |||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 1892 | C:\Windows\system32\msiexec.exe /V | C:\Windows\system32\msiexec.exe | services.exe | ||||||||||||
User: SYSTEM Company: Microsoft Corporation Integrity Level: SYSTEM Description: Windows® installer Exit code: 0 Version: 5.0.7600.16385 (win7_rtm.090713-1255) Modules
| |||||||||||||||
| 1932 | timeout 5 | C:\Windows\system32\timeout.exe | — | cmd.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: HIGH Description: timeout - pauses command processing Exit code: 0 Version: 6.1.7600.16385 (win7_rtm.090713-1255) Modules
| |||||||||||||||
| 2080 | "C:\Windows\System32\msiexec.exe" /i "C:\Users\admin\AppData\Local\Temp\EA Sports UFC 3 PC Downloader_526235.msi" | C:\Windows\System32\msiexec.exe | — | explorer.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows® installer Exit code: 0 Version: 5.0.7600.16385 (win7_rtm.090713-1255) Modules
| |||||||||||||||
| 2176 | "C:\Users\admin\AppData\Roaming\NativeDidymochlaena\NativeDidymochlaena.exe" -uac D6JHyvXuAxJJ17oePvQ+dOfO/RIZE6rd2eyuf2aPCJSlyy9/1ZRdtC8IyUQcTLWfjR1wzX2EAefupHs8kZjziA== C:\Users\admin\AppData\Local\Temp\EA Sports UFC 3 PC Downloader_526235.msi | C:\Users\admin\AppData\Roaming\NativeDidymochlaena\NativeDidymochlaena.exe | NativeDidymochlaena.exe | ||||||||||||
User: admin Integrity Level: HIGH Description: Didymochlaena Native Install Exit code: 0 Version: 1.2.2.2 Modules
| |||||||||||||||
| 2736 | "C:\Program Files\DidymochlaenaNativecooInstall\DidymochlaenakNative.exe" 72349764502217 J/Mxw1/z1gus77SSh/Tn1l4vV+RGT8n9awfA9SwWoMsx68WxhwCbrlffp0cN1IG6xOL6v15tk5RnMlGqnJKCNR3kRTsamWQwYgrmSiihi254bDwCshGdoFzf1wAiyLfSdSr82MmbPv6Va05SQjnKV2lkoFGopu1okAXQThg/qD+fxu5cLpZbXdmTT1tlnq2s8AcIcBs42oBoCebZI4kYQMkuD2pbsBoixGRVBJYAbMDWgrsN2J9JXwdHlxCzNjlA D6JHyvXuAxJJ17oePvQ+dOfO/RIZE6rd2eyuf2aPCJSlyy9/1ZRdtC8IyUQcTLWfjR1wzX2EAefupHs8kZjziA== | C:\Program Files\DidymochlaenaNativecooInstall\DidymochlaenakNative.exe | NativeDidymochlaena.exe | ||||||||||||
User: admin Company: Don HO don.h@free.fr Integrity Level: HIGH Description: Notepad++ : a free (GNU) source code editor Exit code: 0 Version: 7.8.8.0 Modules
| |||||||||||||||
| 2892 | C:\Windows\system32\cmd.exe /d /c timeout 5 & cmd /d /c del /f /q "C:\Users\admin\AppData\Roaming\NativeDidymochlaena\NativeDidymochlaena.exe" & cmd /d /c del /f /q "C:\Users\admin\AppData\Local\Temp\EA Sports UFC 3 PC Downloader_526235.msi" | C:\Windows\system32\cmd.exe | — | NativeDidymochlaena.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: HIGH Description: Windows Command Processor Exit code: 0 Version: 6.1.7601.17514 (win7sp1_rtm.101119-1850) Modules
| |||||||||||||||
| 2936 | "C:\Users\admin\AppData\Roaming\NativeDidymochlaena\NativeDidymochlaena.exe" "C:\Users\admin\AppData\Local\Temp\EA Sports UFC 3 PC Downloader_526235.msi" | C:\Users\admin\AppData\Roaming\NativeDidymochlaena\NativeDidymochlaena.exe | — | msiexec.exe | |||||||||||
User: admin Integrity Level: MEDIUM Description: Didymochlaena Native Install Exit code: 0 Version: 1.2.2.2 Modules
| |||||||||||||||
| 3356 | cmd /d /c del /f /q "C:\Users\admin\AppData\Roaming\NativeDidymochlaena\NativeDidymochlaena.exe" | C:\Windows\system32\cmd.exe | — | cmd.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: HIGH Description: Windows Command Processor Exit code: 0 Version: 6.1.7601.17514 (win7sp1_rtm.101119-1850) Modules
| |||||||||||||||
| 3820 | cmd /d /c del /f /q "C:\Users\admin\AppData\Local\Temp\EA Sports UFC 3 PC Downloader_526235.msi" | C:\Windows\system32\cmd.exe | — | cmd.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: HIGH Description: Windows Command Processor Exit code: 0 Version: 6.1.7601.17514 (win7sp1_rtm.101119-1850) Modules
| |||||||||||||||
Total events
876
Read events
823
Write events
41
Delete events
12
Modification events
| (PID) Process: | (2080) msiexec.exe | Key: | HKEY_CLASSES_ROOT\Local Settings\MuiCache\13B\52C64B7E |
| Operation: | write | Name: | LanguageList |
Value: en-US | |||
| (PID) Process: | (1892) msiexec.exe | Key: | HKEY_USERS\S-1-5-21-1302019708-1500728564-335382590-1000_CLASSES\Local Settings\MuiCache\13B\52C64B7E |
| Operation: | write | Name: | LanguageList |
Value: en-US | |||
| (PID) Process: | (1892) msiexec.exe | Key: | HKEY_USERS\S-1-5-21-1302019708-1500728564-335382590-1000\Software\Microsoft\RestartManager\Session0000 |
| Operation: | write | Name: | Owner |
Value: 640700001418CCFE26B9D601 | |||
| (PID) Process: | (1892) msiexec.exe | Key: | HKEY_USERS\S-1-5-21-1302019708-1500728564-335382590-1000\Software\Microsoft\RestartManager\Session0000 |
| Operation: | write | Name: | SessionHash |
Value: CF4F81D73D23DA8C69E71B8D1AE7C9D43A900FAC18132C6745AAAFFD606FEB31 | |||
| (PID) Process: | (1892) msiexec.exe | Key: | HKEY_USERS\S-1-5-21-1302019708-1500728564-335382590-1000\Software\Microsoft\RestartManager\Session0000 |
| Operation: | write | Name: | Sequence |
Value: 1 | |||
| (PID) Process: | (1892) msiexec.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\InProgress |
| Operation: | write | Name: | (default) |
Value: C:\Windows\Installer\12ab7b.ipi | |||
| (PID) Process: | (1892) msiexec.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Folders |
| Operation: | write | Name: | C:\Config.Msi\ |
Value: | |||
| (PID) Process: | (1892) msiexec.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Rollback\Scripts |
| Operation: | write | Name: | C:\Config.Msi\12ab7c.rbs |
Value: 30849318 | |||
| (PID) Process: | (1892) msiexec.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Rollback\Scripts |
| Operation: | write | Name: | C:\Config.Msi\12ab7c.rbsLow |
Value: 4285565872 | |||
| (PID) Process: | (1892) msiexec.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-21-1302019708-1500728564-335382590-1000\Components\660DB7BB83D2A7547ADC03F46E076F01 |
| Operation: | write | Name: | 660DB7BB83D2A7547ADC03F4EC9EA3E2 |
Value: 01:\Software\WixSharp\Used\ | |||
Executable files
6
Suspicious files
4
Text files
16
Unknown types
0
Dropped files
PID | Process | Filename | Type | |
|---|---|---|---|---|
| 1892 | msiexec.exe | C:\Users\admin\AppData\Local\Temp\~DF5D38B6659FBBD6A3.TMP | — | |
MD5:— | SHA256:— | |||
| 1892 | msiexec.exe | C:\Windows\Installer\12ab7b.ipi | — | |
MD5:— | SHA256:— | |||
| 1892 | msiexec.exe | C:\Windows\Installer\MSIAD5F.tmp | — | |
MD5:— | SHA256:— | |||
| 1892 | msiexec.exe | C:\Config.Msi\12ab7c.rbs | — | |
MD5:— | SHA256:— | |||
| 1892 | msiexec.exe | C:\Users\admin\AppData\Local\Temp\~DF972189B3C8B0DA9F.TMP | — | |
MD5:— | SHA256:— | |||
| 1892 | msiexec.exe | C:\Windows\Installer\12ab7a.msi | executable | |
MD5:— | SHA256:— | |||
| 2936 | NativeDidymochlaena.exe | C:\ProgramData\okle\gratspho | binary | |
MD5:00A5033694B6E94D8078EF2535036E09 | SHA256:4DD388E61295C6B3F52937C142468B736B18D46EB878C28D15E202E84FD81C6F | |||
| 2176 | NativeDidymochlaena.exe | C:\Program Files\DidymochlaenaNativecooInstall\DidymochlaenakNative.exe | executable | |
MD5:— | SHA256:— | |||
| 2736 | DidymochlaenakNative.exe | C:\Users\admin\AppData\Local\Temp\nso2F52.tmp\ioSpecial.ini | text | |
MD5:— | SHA256:— | |||
| 1892 | msiexec.exe | C:\Users\admin\AppData\Roaming\NativeDidymochlaena\NativeDidymochlaena.exe | executable | |
MD5:— | SHA256:— | |||
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
5
DNS requests
1
Threats
0
HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
Connections
PID | Process | IP | Domain | ASN | CN | Reputation |
|---|---|---|---|---|---|---|
2176 | NativeDidymochlaena.exe | 172.67.71.12:443 | theplainapp.com | — | US | unknown |
2176 | NativeDidymochlaena.exe | 104.26.0.161:443 | theplainapp.com | Cloudflare Inc | US | unknown |
— | — | 172.67.71.12:443 | theplainapp.com | — | US | unknown |
DNS requests
Domain | IP | Reputation |
|---|---|---|
theplainapp.com |
| suspicious |