File name:

abc.msi

Full analysis: https://app.any.run/tasks/5863bfb4-0e90-4f03-a43b-e6a9927c9ea0
Verdict: Malicious activity
Analysis date: March 19, 2025, 15:31:43
OS: Windows 10 Professional (build: 19045, 64 bit)
Tags:
generated-doc
Indicators:
MIME: application/x-msi
File info: Composite Document File V2 Document, Little Endian, Os: Windows, Version 6.2, MSI Installer, Number of Characters: 0, Last Saved By: InstallShield, Number of Words: 0, Title: Installation Database, Comments: Contact: Your local administrator, Keywords: Installer,MSI,Database, Subject: Blank Project Template, Author: InstallShield, Security: 1, Number of Pages: 200, Name of Creating Application: InstallShield 2021 - Premier Edition with Virtualization Pack 27, Last Saved Time/Date: Tue Mar 18 17:13:31 2025, Create Time/Date: Tue Mar 18 17:13:31 2025, Last Printed: Tue Mar 18 17:13:31 2025, Revision Number: {178F8BDA-8769-4BCF-9A0B-9ECDF828C1CD}, Code page: 1252, Template: Intel;1033
MD5:

E4D59F25997603B092E55B0041762565

SHA1:

1906CB0DA1F47FE137B284CC4C1F86ECA8912CB7

SHA256:

7DA1254753F2520D733F7DC27A5BBD7FCA239953154E1EB8ABF1C9981CEACC31

SSDEEP:

98304:5SngC5BEc/zQN2+nsZGgx+5QGN4zKRUVT/h0o0MzqOlg3kS765We0yWP7fuvqtwo:YJGj3obHJ/GMSgUs2FuyIZVIAg1pL

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Executing a file with an untrusted certificate

      • ISBEW64.exe (PID: 6300)
      • ISBEW64.exe (PID: 2340)
      • ISBEW64.exe (PID: 2692)
      • ISBEW64.exe (PID: 3676)
      • ISBEW64.exe (PID: 3268)
      • ISBEW64.exe (PID: 7084)
      • ISBEW64.exe (PID: 6644)
      • ISBEW64.exe (PID: 5960)
      • ISBEW64.exe (PID: 4428)
      • ISBEW64.exe (PID: 3156)

  • SUSPICIOUS

    • The process drops C-runtime libraries

      • msiexec.exe (PID: 4408)
      • QQPlayer.exe (PID: 5544)

    • Process drops legitimate windows executable

      • msiexec.exe (PID: 4408)
      • QQPlayer.exe (PID: 5544)

    • Executable content was dropped or overwritten

      • QQPlayer.exe (PID: 5544)
      • ftp.exe (PID: 6032)

    • Starts itself from another location

      • QQPlayer.exe (PID: 5544)

    • Reads the date of Windows installation

      • Launchdemo_1.exe (PID: 2268)

  • INFO

    • Checks supported languages

      • msiexec.exe (PID: 1188)
      • msiexec.exe (PID: 4408)
      • ISBEW64.exe (PID: 6300)
      • ISBEW64.exe (PID: 2340)
      • ISBEW64.exe (PID: 3676)
      • ISBEW64.exe (PID: 7084)
      • ISBEW64.exe (PID: 2692)
      • ISBEW64.exe (PID: 6644)
      • ISBEW64.exe (PID: 3268)
      • ISBEW64.exe (PID: 4428)
      • ISBEW64.exe (PID: 5960)
      • QQPlayer.exe (PID: 5544)
      • ISBEW64.exe (PID: 3156)
      • QQPlayer.exe (PID: 6244)
      • Launchdemo_1.exe (PID: 2268)

    • An automatically generated document

      • msiexec.exe (PID: 4560)

    • Reads the computer name

      • msiexec.exe (PID: 1188)
      • msiexec.exe (PID: 4408)
      • ISBEW64.exe (PID: 6300)
      • ISBEW64.exe (PID: 7084)
      • ISBEW64.exe (PID: 3676)
      • ISBEW64.exe (PID: 6644)
      • ISBEW64.exe (PID: 3268)
      • ISBEW64.exe (PID: 4428)
      • ISBEW64.exe (PID: 5960)
      • QQPlayer.exe (PID: 5544)
      • ISBEW64.exe (PID: 3156)
      • QQPlayer.exe (PID: 6244)
      • Launchdemo_1.exe (PID: 2268)
      • ISBEW64.exe (PID: 2692)
      • ISBEW64.exe (PID: 2340)

    • Create files in a temporary directory

      • msiexec.exe (PID: 4408)
      • QQPlayer.exe (PID: 6244)
      • ftp.exe (PID: 6032)

    • The sample compiled with chinese language support

      • msiexec.exe (PID: 4408)
      • QQPlayer.exe (PID: 5544)

    • Executable content was dropped or overwritten

      • msiexec.exe (PID: 4560)
      • msiexec.exe (PID: 4408)

    • The sample compiled with english language support

      • msiexec.exe (PID: 4560)
      • msiexec.exe (PID: 4408)
      • QQPlayer.exe (PID: 5544)

    • Creates files or folders in the user directory

      • QQPlayer.exe (PID: 5544)

    • Manual execution by a user

      • OpenWith.exe (PID: 7020)

    • Reads Microsoft Office registry keys

      • OpenWith.exe (PID: 7020)

    • Reads the machine GUID from the registry

      • Launchdemo_1.exe (PID: 2268)

    • Reads the software policy settings

      • slui.exe (PID: 5436)
      • Launchdemo_1.exe (PID: 2268)

    • Checks proxy server information

      • Launchdemo_1.exe (PID: 2268)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.msi | Microsoft Windows Installer (84.2)
.mst | Windows SDK Setup Transform Script (9.5)
.msi | Microsoft Installer (100)

EXIF

FlashPix

Characters: -
LastModifiedBy: InstallShield
Words: -
Title: Installation Database
Comments: Contact: Your local administrator
Keywords: Installer,MSI,Database
Subject: Blank Project Template
Author: InstallShield
Security: Password protected
Pages: 200
Software: InstallShield? 2021 - Premier Edition with Virtualization Pack 27
ModifyDate: 2025:03:18 17:13:31
CreateDate: 2025:03:18 17:13:31
LastPrinted: 2025:03:18 17:13:31
RevisionNumber: {178F8BDA-8769-4BCF-9A0B-9ECDF828C1CD}
CodePage: Windows Latin 1 (Western European)
Template: Intel;1033
No data.
screenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
144
Monitored processes
21
Malicious processes
2
Suspicious processes
11

Behavior graph

Click at the process to see the details
start msiexec.exe msiexec.exe no specs msiexec.exe isbew64.exe no specs isbew64.exe no specs isbew64.exe no specs isbew64.exe no specs isbew64.exe no specs isbew64.exe no specs isbew64.exe no specs isbew64.exe no specs isbew64.exe no specs isbew64.exe no specs qqplayer.exe qqplayer.exe no specs ftp.exe conhost.exe no specs openwith.exe no specs launchdemo_1.exe slui.exe svchost.exe

Process information

PID
CMD
Path
Indicators
Parent process
728\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—ftp.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1188C:\WINDOWS\system32\msiexec.exe /VC:\Windows\System32\msiexec.exe—services.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Windows® installer
Version:
5.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\msiexec.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\aclayers.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
2196C:\WINDOWS\system32\svchost.exe -k NetworkService -p -s DnscacheC:\Windows\System32\svchost.exe
services.exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Host Process for Windows Services
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\svchost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\kernel.appcore.dll
2268C:\Users\admin\AppData\Local\Temp\Launchdemo_1.exeC:\Users\admin\AppData\Local\Temp\Launchdemo_1.exe
ftp.exe
User:
admin
Company:
Nenad Hrg (SoftwareOK.com)
Integrity Level:
MEDIUM
Description:
Q-Dir
Version:
11,4,4,0
Modules
Images
c:\users\admin\appdata\local\temp\llemkysxsktr
c:\users\admin\appdata\local\temp\launchdemo_1.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
2340C:\Users\admin\AppData\Local\Temp\{E710BD60-5C23-4C9C-BA69-E5292EB0B150}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{1B5E93B2-2794-49D8-8F35-AD94A5B56B15}C:\Users\admin\AppData\Local\Temp\{E710BD60-5C23-4C9C-BA69-E5292EB0B150}\ISBEW64.exe—msiexec.exe
User:
admin
Company:
Flexera
Integrity Level:
MEDIUM
Description:
InstallShield (R) 64-bit Setup Engine
Exit code:
0
Version:
27.0.58
Modules
Images
c:\users\admin\appdata\local\temp\{e710bd60-5c23-4c9c-ba69-e5292eb0b150}\isbew64.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
2692C:\Users\admin\AppData\Local\Temp\{E710BD60-5C23-4C9C-BA69-E5292EB0B150}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{5FB2A5E7-E868-41D0-8DD2-E2CD7C1D7F2B}C:\Users\admin\AppData\Local\Temp\{E710BD60-5C23-4C9C-BA69-E5292EB0B150}\ISBEW64.exe—msiexec.exe
User:
admin
Company:
Flexera
Integrity Level:
MEDIUM
Description:
InstallShield (R) 64-bit Setup Engine
Exit code:
0
Version:
27.0.58
Modules
Images
c:\users\admin\appdata\local\temp\{e710bd60-5c23-4c9c-ba69-e5292eb0b150}\isbew64.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
3156C:\Users\admin\AppData\Local\Temp\{E710BD60-5C23-4C9C-BA69-E5292EB0B150}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{BED261B4-251A-42A5-982A-D464D2941005}C:\Users\admin\AppData\Local\Temp\{E710BD60-5C23-4C9C-BA69-E5292EB0B150}\ISBEW64.exe—msiexec.exe
User:
admin
Company:
Flexera
Integrity Level:
MEDIUM
Description:
InstallShield (R) 64-bit Setup Engine
Exit code:
0
Version:
27.0.58
Modules
Images
c:\users\admin\appdata\local\temp\{e710bd60-5c23-4c9c-ba69-e5292eb0b150}\isbew64.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
3268C:\Users\admin\AppData\Local\Temp\{E710BD60-5C23-4C9C-BA69-E5292EB0B150}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{00DC2077-4C8A-42F3-9B2A-4AED163DBC12}C:\Users\admin\AppData\Local\Temp\{E710BD60-5C23-4C9C-BA69-E5292EB0B150}\ISBEW64.exe—msiexec.exe
User:
admin
Company:
Flexera
Integrity Level:
MEDIUM
Description:
InstallShield (R) 64-bit Setup Engine
Exit code:
0
Version:
27.0.58
Modules
Images
c:\users\admin\appdata\local\temp\{e710bd60-5c23-4c9c-ba69-e5292eb0b150}\isbew64.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
3676C:\Users\admin\AppData\Local\Temp\{E710BD60-5C23-4C9C-BA69-E5292EB0B150}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{9FA7BA4A-7BC6-44BB-8551-46A79EB29FD2}C:\Users\admin\AppData\Local\Temp\{E710BD60-5C23-4C9C-BA69-E5292EB0B150}\ISBEW64.exe—msiexec.exe
User:
admin
Company:
Flexera
Integrity Level:
MEDIUM
Description:
InstallShield (R) 64-bit Setup Engine
Exit code:
0
Version:
27.0.58
Modules
Images
c:\users\admin\appdata\local\temp\{e710bd60-5c23-4c9c-ba69-e5292eb0b150}\isbew64.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
4408C:\Windows\syswow64\MsiExec.exe -Embedding A05A06C418EF905295041F65DE23BDDC CC:\Windows\SysWOW64\msiexec.exe
msiexec.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows® installer
Exit code:
0
Version:
5.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\msiexec.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\aclayers.dll
Total events
8 336
Read events
8 336
Write events
0
Delete events
0

Modification events

No data
Executable files
47
Suspicious files
5
Text files
1
Unknown types
0

Dropped files

PID
Process
Filename
Type
4408msiexec.exeC:\Users\admin\AppData\Local\Temp\{D834CE9F-665F-4B59-A2FD-050F1355C2C3}\cerebrotonia.xls —
MD5:—
SHA256:—
4408msiexec.exeC:\Users\admin\AppData\Local\Temp\{D834CE9F-665F-4B59-A2FD-050F1355C2C3}\Common.dllexecutable
MD5:DB7F889A32083695AD19C0328F31503F
SHA256:E3786CEEF2B7207512140843702A2782F0C8351C486FDA4C89081430C2980F55
4408msiexec.exeC:\Users\admin\AppData\Local\Temp\{D834CE9F-665F-4B59-A2FD-050F1355C2C3}\libexpat.dllexecutable
MD5:E92990C951FDF5ADF27348C42EE4FD87
SHA256:D5C80D353FA48FE010F0652CD92C571DACDED2F8321C83210A37A633F3EA8172
4408msiexec.exeC:\Users\admin\AppData\Local\Temp\{D834CE9F-665F-4B59-A2FD-050F1355C2C3}\libeay32.dllexecutable
MD5:E709374BFC5D26439A4B626520D2DBBB
SHA256:7CEE2F68FA47F8F1657E9F5238B203B4966BD20CB3B506CB69C5DA645A1CFFDE
4408msiexec.exeC:\Users\admin\AppData\Local\Temp\{D834CE9F-665F-4B59-A2FD-050F1355C2C3}\tinyxml.dllexecutable
MD5:19F1ED1A772EA201AF1E986DF1E109C1
SHA256:7DFF6B0E5686076247D1D62854B0475D909056078CBFD44326B94F835BAC8870
4408msiexec.exeC:\Users\admin\AppData\Local\Temp\{D834CE9F-665F-4B59-A2FD-050F1355C2C3}\libskottie.dllexecutable
MD5:5BC516FAE65A26280939F630C6EE5109
SHA256:69B0D592715B69D9930A2D98EBF5DC06D61827E3C3226BE89B452EB03DAC73B5
4408msiexec.exeC:\Users\admin\AppData\Local\Temp\{D834CE9F-665F-4B59-A2FD-050F1355C2C3}\campo.wavbinary
MD5:9B88E10A397EDC32D62C8356C71DF06C
SHA256:B6135D3D9A66E39BA10CC381D833B0FF5BFB66B29D9A195FCC0FAE0E9F145F9D
4408msiexec.exeC:\Users\admin\AppData\Local\Temp\{D834CE9F-665F-4B59-A2FD-050F1355C2C3}\msvcr100.dllexecutable
MD5:26B2D9C49E69A59BEA22558525F3D643
SHA256:092B59A6C1C778ECF56CE7219B103B0A547A14FE3BD94ABDD7FDC0C894B31E8F
4408msiexec.exeC:\Users\admin\AppData\Local\Temp\{D834CE9F-665F-4B59-A2FD-050F1355C2C3}\LIBCURL.dllexecutable
MD5:9C7232E92A2936844D753239233246CD
SHA256:7DE31F5ACE824EA7DD845B71A6EEDB921A04DED24BD4172D21D849879DE17129
4408msiexec.exeC:\Users\admin\AppData\Local\Temp\{D834CE9F-665F-4B59-A2FD-050F1355C2C3}\msvcp140.dllexecutable
MD5:1D8C79F293CA86E8857149FB4EFE4452
SHA256:C09B126E7D4C1E6EFB3FFCDA2358252CE37383572C78E56CA97497A7F7C793E4
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
4
TCP/UDP connections
23
DNS requests
9
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
2104
svchost.exe
GET
200
23.48.23.190:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
—
—
POST
204
104.21.73.174:443
https://tastedata.shop/ag-ap.php?z9nroyvgbw=gQ6ChFCc2mogCbPX74cABgkhnZF3P%2BsYo%2F7lDl4tw6plkbJ9O6tyQGzfwdXoS%2BI6
unknown
—
—
malicious
—
—
POST
500
40.91.76.224:443
https://activation-v2.sls.microsoft.com/SLActivateProduct/SLActivateProduct.asmx?configextension=Retail
unknown
xml
512 b
whitelisted
—
—
POST
500
20.83.72.98:443
https://activation-v2.sls.microsoft.com/SLActivateProduct/SLActivateProduct.asmx?configextension=Retail
unknown
xml
512 b
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
—
—
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
—
—
192.168.100.255:137
—
—
—
whitelisted
2104
svchost.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
—
—
192.168.100.255:138
—
—
—
whitelisted
—
—
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
2104
svchost.exe
23.48.23.190:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
2104
svchost.exe
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
3812
svchost.exe
239.255.255.250:1900
—
—
—
whitelisted
1760
slui.exe
40.91.76.224:443
activation-v2.sls.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
2268
Launchdemo_1.exe
104.21.73.174:443
tastedata.shop
CLOUDFLARENET
—
malicious

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 40.127.240.158
  • 51.104.136.2
whitelisted
google.com
  • 142.250.186.78
whitelisted
crl.microsoft.com
  • 23.48.23.190
  • 23.48.23.180
  • 23.48.23.171
  • 23.48.23.176
  • 23.48.23.183
  • 23.48.23.179
  • 23.48.23.191
  • 23.48.23.169
  • 23.48.23.178
whitelisted
activation-v2.sls.microsoft.com
  • 40.91.76.224
whitelisted
tastedata.shop
  • 104.21.73.174
  • 172.67.146.161
malicious

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
abc.msi