| File name: | build.msi |
| Full analysis: | https://app.any.run/tasks/2ac46dcf-593b-43db-806c-8bc25f38d470 |
| Verdict: | Malicious activity |
| Threats: | Stealers are a group of malicious software that are intended for gaining unauthorized access to users’ information and transferring it to the attacker. The stealer malware category includes various types of programs that focus on their particular kind of data, including files, passwords, and cryptocurrency. Stealers are capable of spying on their targets by recording their keystrokes and taking screenshots. This type of malware is primarily distributed as part of phishing campaigns. |
| Analysis date: | March 27, 2025, 15:24:46 |
| OS: | Windows 10 Professional (build: 19044, 64 bit) |
| Tags: | |
| Indicators: | |
| MIME: | application/x-msi |
| File info: | Composite Document File V2 Document, Little Endian, Os: Windows, Version 10.0, MSI Installer, Security: 0, Code page: 1252, Revision Number: {91EA9310-7780-492F-A56F-BF42DC80BBF2}, Number of Words: 10, Subject: Klio Verfair Tools, Author: TasovCoop, Name of Creating Application: Klio Verfair Tools, Template: ;1033, Comments: This installer database contains the logic and data required to install Klio Verfair Tools., Title: Installation Database, Keywords: Installer, MSI, Database, Create Time/Date: Wed Mar 26 09:40:44 2025, Last Saved Time/Date: Wed Mar 26 09:40:44 2025, Last Printed: Wed Mar 26 09:40:44 2025, Number of Pages: 450 |
| MD5: | 46F04AAE8CDFC6AD83904DA94C701B2D |
| SHA1: | 76DFD02B13D5D47A969A024D7AD5B25845F0B1AE |
| SHA256: | 80D82BABDD2AC07E080F470378D7191A58C339597A549CC4ECC9C572C4679DA5 |
| SSDEEP: | 393216:bv5CIlbyCuqed7nYR5D7hyS6dA0vO56LqZSPZh:wv1qed7nY3DYLdAdILqZSPf |
MALICIOUS
GENERIC has been found (auto)
- msiexec.exe (PID: 5344)
Actions looks like stealing of personal data
- launcher.exe (PID: 3300)
SUSPICIOUS
Reads security settings of Internet Explorer
- msiexec.exe (PID: 2340)
- launcher.exe (PID: 3300)
Reads the Windows owner or organization settings
- msiexec.exe (PID: 5344)
Drops 7-zip archiver for unpacking
- msiexec.exe (PID: 5344)
Process drops legitimate windows executable
- msiexec.exe (PID: 5344)
There is functionality for taking screenshot (YARA)
- launcher.exe (PID: 3300)
INFO
An automatically generated document
- msiexec.exe (PID: 4920)
Reads the computer name
- msiexec.exe (PID: 5344)
- msiexec.exe (PID: 2340)
- launcher.exe (PID: 3300)
The sample compiled with english language support
- msiexec.exe (PID: 5344)
Checks supported languages
- msiexec.exe (PID: 5344)
- msiexec.exe (PID: 2340)
- launcher.exe (PID: 3300)
Reads Environment values
- msiexec.exe (PID: 2340)
Executable content was dropped or overwritten
- msiexec.exe (PID: 5344)
Checks proxy server information
- msiexec.exe (PID: 2340)
- slui.exe (PID: 3676)
Reads the machine GUID from the registry
- msiexec.exe (PID: 2340)
Creates files or folders in the user directory
- msiexec.exe (PID: 2340)
- msiexec.exe (PID: 5344)
- launcher.exe (PID: 3300)
Reads the software policy settings
- msiexec.exe (PID: 2340)
- slui.exe (PID: 3676)
The sample compiled with german language support
- msiexec.exe (PID: 5344)
The sample compiled with japanese language support
- msiexec.exe (PID: 5344)
Reads CPU info
- launcher.exe (PID: 3300)
Creates a software uninstall entry
- msiexec.exe (PID: 5344)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
TRiD
| .msi | | | Microsoft Windows Installer (88.6) |
|---|---|---|
| .mst | | | Windows SDK Setup Transform Script (10) |
| .msi | | | Microsoft Installer (100) |
EXIF
FlashPix
| Security: | None |
|---|---|
| CodePage: | Windows Latin 1 (Western European) |
| RevisionNumber: | {91EA9310-7780-492F-A56F-BF42DC80BBF2} |
| Words: | 10 |
| Subject: | Klio Verfair Tools |
| Author: | TasovCoop |
| LastModifiedBy: | - |
| Software: | Klio Verfair Tools |
| Template: | ;1033 |
| Comments: | This installer database contains the logic and data required to install Klio Verfair Tools. |
| Title: | Installation Database |
| Keywords: | Installer, MSI, Database |
| CreateDate: | 2025:03:26 09:40:44 |
| ModifyDate: | 2025:03:26 09:40:44 |
| LastPrinted: | 2025:03:26 09:40:44 |
| Pages: | 450 |
Total processes
129
Monitored processes
5
Malicious processes
2
Suspicious processes
0
Behavior graph
Click at the process to see the details
Process information
PID | CMD | Path | Indicators | Parent process | |||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 2340 | C:\Windows\syswow64\MsiExec.exe -Embedding A315ADA326FD8C6A3BEA3A41AE33DA5C | C:\Windows\SysWOW64\msiexec.exe | msiexec.exe | ||||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows® installer Exit code: 0 Version: 5.0.19041.3636 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 3300 | "C:\Users\admin\AppData\Roaming\TasovCoop\Klio Verfair Tools\launcher.exe" | C:\Users\admin\AppData\Roaming\TasovCoop\Klio Verfair Tools\launcher.exe | msiexec.exe | ||||||||||||
User: admin Company: Krzysztof Kowalczyk Integrity Level: MEDIUM Description: SumatraPDF Version: 3.5.2 Modules
| |||||||||||||||
| 3676 | C:\WINDOWS\System32\slui.exe -Embedding | C:\Windows\System32\slui.exe | svchost.exe | ||||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows Activation Client Exit code: 0 Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 4920 | "C:\Windows\System32\msiexec.exe" /i C:\Users\admin\AppData\Local\Temp\build.msi | C:\Windows\System32\msiexec.exe | — | explorer.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows® installer Exit code: 0 Version: 5.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 5344 | C:\WINDOWS\system32\msiexec.exe /V | C:\Windows\System32\msiexec.exe | services.exe | ||||||||||||
User: SYSTEM Company: Microsoft Corporation Integrity Level: SYSTEM Description: Windows® installer Version: 5.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
Total events
13 466
Read events
13 227
Write events
226
Delete events
13
Modification events
| (PID) Process: | (5344) msiexec.exe | Key: | HKEY_USERS\S-1-5-21-1693682860-607145093-2874071422-1001\SOFTWARE\Microsoft\RestartManager\Session0000 |
| Operation: | write | Name: | Owner |
Value: E01400000F6CBA762C9FDB01 | |||
| (PID) Process: | (5344) msiexec.exe | Key: | HKEY_USERS\S-1-5-21-1693682860-607145093-2874071422-1001\SOFTWARE\Microsoft\RestartManager\Session0000 |
| Operation: | write | Name: | SessionHash |
Value: 1237521DB6574A4D9525D0B0CE0B6DE62DC27DFE390A9048679D342FB62525D0 | |||
| (PID) Process: | (5344) msiexec.exe | Key: | HKEY_USERS\S-1-5-21-1693682860-607145093-2874071422-1001\SOFTWARE\Microsoft\RestartManager\Session0000 |
| Operation: | write | Name: | Sequence |
Value: 1 | |||
| (PID) Process: | (2340) msiexec.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content |
| Operation: | write | Name: | CachePrefix |
Value: | |||
| (PID) Process: | (2340) msiexec.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies |
| Operation: | write | Name: | CachePrefix |
Value: Cookie: | |||
| (PID) Process: | (2340) msiexec.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History |
| Operation: | write | Name: | CachePrefix |
Value: Visited: | |||
| (PID) Process: | (5344) msiexec.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Folders |
| Operation: | write | Name: | C:\Users\admin\AppData\Roaming\Microsoft\Installer\ |
Value: | |||
| (PID) Process: | (5344) msiexec.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-21-1693682860-607145093-2874071422-1001\Components\7D7790D7F9136E14CA22C426A8BF3566 |
| Operation: | write | Name: | A7534D09770FAE642B67FB8A2896A107 |
Value: C:\Users\admin\AppData\Roaming\TasovCoop\Klio Verfair Tools\ | |||
| (PID) Process: | (5344) msiexec.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-21-1693682860-607145093-2874071422-1001\Components\29E14500A03BAF34A91D267AFBD8B658 |
| Operation: | write | Name: | A7534D09770FAE642B67FB8A2896A107 |
Value: 01:\Software\TasovCoop\Klio Verfair Tools\Version | |||
| (PID) Process: | (5344) msiexec.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-21-1693682860-607145093-2874071422-1001\Components\E74917A0994572B468592F64C630D075 |
| Operation: | write | Name: | A7534D09770FAE642B67FB8A2896A107 |
Value: C:\Users\admin\AppData\Roaming\TasovCoop\Klio Verfair Tools\7z.dll | |||
Executable files
38
Suspicious files
60
Text files
21
Unknown types
0
Dropped files
PID | Process | Filename | Type | |
|---|---|---|---|---|
| 5344 | msiexec.exe | C:\Windows\Installer\10fb1b.msi | — | |
MD5:— | SHA256:— | |||
| 5344 | msiexec.exe | C:\Windows\Installer\MSIFC34.tmp | executable | |
MD5:EE09D6A1BB908B42C05FD0BEEB67DFD2 | SHA256:7BBF611F5E2A16439DC8CD11936F6364F6D5CC0044545C92775DA5646AFC7752 | |||
| 2340 | msiexec.exe | C:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B46811C17859FFB409CF0E904A4AA8F8 | binary | |
MD5:218960F7A9ED8BAA321BE10F06A72558 | SHA256:17789A4ED3F43EEC34981B2A1A93D7D92145936F515DC141F33F6AD5BB7E60A0 | |||
| 5344 | msiexec.exe | C:\Windows\Installer\MSIFD6F.tmp | executable | |
MD5:EE09D6A1BB908B42C05FD0BEEB67DFD2 | SHA256:7BBF611F5E2A16439DC8CD11936F6364F6D5CC0044545C92775DA5646AFC7752 | |||
| 5344 | msiexec.exe | C:\Windows\Installer\MSIFE6B.tmp | executable | |
MD5:FFDAACB43C074A8CB9A608C612D7540B | SHA256:7484797EA4480BC71509FA28B16E607F82323E05C44F59FFA65DB3826ED1B388 | |||
| 5344 | msiexec.exe | C:\Windows\Installer\MSIFDAE.tmp | executable | |
MD5:EE09D6A1BB908B42C05FD0BEEB67DFD2 | SHA256:7BBF611F5E2A16439DC8CD11936F6364F6D5CC0044545C92775DA5646AFC7752 | |||
| 5344 | msiexec.exe | C:\Windows\Installer\MSIFD10.tmp | executable | |
MD5:EE09D6A1BB908B42C05FD0BEEB67DFD2 | SHA256:7BBF611F5E2A16439DC8CD11936F6364F6D5CC0044545C92775DA5646AFC7752 | |||
| 2340 | msiexec.exe | C:\Users\admin\AppData\Local\Microsoft\Windows\INetCache\IE\RR3E01RZ\diagnostics[1].htm | binary | |
MD5:CFCD208495D565EF66E7DFF9F98764DA | SHA256:5FECEB66FFC86F38D952786C6D696C79C2DBC239DD4E91B46729D73A27FB57E9 | |||
| 2340 | msiexec.exe | C:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B46811C17859FFB409CF0E904A4AA8F8 | binary | |
MD5:971C514F84BBA0785F80AA1C23EDFD79 | SHA256:F157ED17FCAF8837FA82F8B69973848C9B10A02636848F995698212A08F31895 | |||
| 5344 | msiexec.exe | C:\Windows\Installer\MSI580.tmp | executable | |
MD5:EE09D6A1BB908B42C05FD0BEEB67DFD2 | SHA256:7BBF611F5E2A16439DC8CD11936F6364F6D5CC0044545C92775DA5646AFC7752 | |||
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
8
TCP/UDP connections
28
DNS requests
19
Threats
0
HTTP requests
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
|---|---|---|---|---|---|---|---|---|---|
5496 | MoUsoCoreWorker.exe | GET | 200 | 2.19.11.105:80 | http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl | unknown | — | — | whitelisted |
— | — | GET | 200 | 2.23.77.188:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D | unknown | — | — | whitelisted |
— | — | GET | 200 | 2.23.77.188:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAUZZSZEml49Gjh0j13P68w%3D | unknown | — | — | whitelisted |
— | — | GET | 200 | 2.23.77.188:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAI5PUjXAkJafLQcAAsO18o%3D | unknown | — | — | whitelisted |
2340 | msiexec.exe | GET | 200 | 142.250.184.227:80 | http://c.pki.goog/r/r4.crl | unknown | — | — | whitelisted |
2340 | msiexec.exe | GET | 200 | 142.250.184.227:80 | http://c.pki.goog/r/gsr1.crl | unknown | — | — | whitelisted |
2420 | SIHClient.exe | GET | 200 | 23.219.150.101:80 | http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl | unknown | — | — | whitelisted |
2420 | SIHClient.exe | GET | 200 | 23.219.150.101:80 | http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl | unknown | — | — | whitelisted |
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
Connections
PID | Process | IP | Domain | ASN | CN | Reputation |
|---|---|---|---|---|---|---|
4 | System | 192.168.100.255:137 | — | — | — | whitelisted |
— | — | 20.73.194.208:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | NL | whitelisted |
5496 | MoUsoCoreWorker.exe | 2.19.11.105:80 | crl.microsoft.com | Elisa Oyj | NL | whitelisted |
4 | System | 192.168.100.255:138 | — | — | — | whitelisted |
— | — | 40.127.240.158:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | IE | whitelisted |
— | — | 40.126.32.74:443 | login.live.com | MICROSOFT-CORP-MSN-AS-BLOCK | NL | whitelisted |
— | — | 20.197.71.89:443 | client.wns.windows.com | MICROSOFT-CORP-MSN-AS-BLOCK | SG | whitelisted |
— | — | 2.23.77.188:80 | ocsp.digicert.com | AKAMAI-AS | DE | whitelisted |
— | — | 20.223.36.55:443 | arc.msn.com | MICROSOFT-CORP-MSN-AS-BLOCK | IE | whitelisted |
6544 | svchost.exe | 40.126.32.74:443 | login.live.com | MICROSOFT-CORP-MSN-AS-BLOCK | NL | whitelisted |
DNS requests
Domain | IP | Reputation |
|---|---|---|
google.com |
| whitelisted |
settings-win.data.microsoft.com |
| whitelisted |
crl.microsoft.com |
| whitelisted |
login.live.com |
| whitelisted |
client.wns.windows.com |
| whitelisted |
ocsp.digicert.com |
| whitelisted |
arc.msn.com |
| whitelisted |
www.bing.com |
| whitelisted |
shaundoose.com |
| unknown |
c.pki.goog |
| whitelisted |