File name:

8355bd295c468007f6700cd1f969dc90c794f733158ef8f858a1180a2ee2cbaa.msi

Full analysis: https://app.any.run/tasks/d16b38a8-52a7-4b25-b085-8e02aa778976
Verdict: Malicious activity
Analysis date: December 27, 2024, 23:50:09
OS: Windows 10 Professional (build: 19045, 64 bit)
Tags:
generated-doc
Indicators:
MIME: application/x-msi
File info: Composite Document File V2 Document, Little Endian, Os: Windows, Version 10.0, MSI Installer, Security: 0, Code page: 1252, Revision Number: {1CD1875B-5E87-42CE-9389-9C216C5C1759}, Number of Words: 10, Subject: Cave App, Author: Weqos Apps Industries, Name of Creating Application: Cave App, Template: x64;2057, Comments: This installer database contains the logic and data required to install Cave App., Title: Installation Database, Keywords: Installer, MSI, Database, Create Time/Date: Fri Dec 27 06:19:13 2024, Last Saved Time/Date: Fri Dec 27 06:19:13 2024, Last Printed: Fri Dec 27 06:19:13 2024, Number of Pages: 450
MD5:

492132729EB10B285B0D97E5E73ECEFB

SHA1:

6A6EB7FF3C801766A868DDD1F32D3EB6A9C7844C

SHA256:

8355BD295C468007F6700CD1F969DC90C794F733158EF8F858A1180A2EE2CBAA

SSDEEP:

196608:Vv/ccT79lV46BmuSBEK8B7DhVG4QH6KovmePQszNBeC8RL:R0d6BmC7DhsB6DuePQwU

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Changes powershell execution policy (Bypass)

      • msiexec.exe (PID: 2928)

    • Bypass execution policy to execute commands

      • powershell.exe (PID: 6096)

  • SUSPICIOUS

    • Reads the Windows owner or organization settings

      • msiexec.exe (PID: 396)

    • Reads security settings of Internet Explorer

      • msiexec.exe (PID: 2928)

    • Checks Windows Trust Settings

      • msiexec.exe (PID: 2928)

    • The process executes Powershell scripts

      • msiexec.exe (PID: 2928)

    • The process creates files with name similar to system file names

      • msiexec.exe (PID: 396)

    • Process drops legitimate windows executable

      • msiexec.exe (PID: 396)

    • Starts CMD.EXE for commands execution

      • msiexec.exe (PID: 396)

    • The process hide an interactive prompt from the user

      • msiexec.exe (PID: 2928)

    • The process bypasses the loading of PowerShell profile settings

      • msiexec.exe (PID: 2928)

    • Starts POWERSHELL.EXE for commands execution

      • msiexec.exe (PID: 2928)

    • Reverses array data (POWERSHELL)

      • powershell.exe (PID: 6096)

    • The process drops C-runtime libraries

      • msiexec.exe (PID: 396)

    • Executing commands from a ".bat" file

      • msiexec.exe (PID: 396)

    • The executable file from the user directory is run by the CMD process

      • ImporterREDServer.exe (PID: 5604)

  • INFO

    • Reads the computer name

      • msiexec.exe (PID: 2928)
      • msiexec.exe (PID: 396)

    • An automatically generated document

      • msiexec.exe (PID: 2972)

    • Checks supported languages

      • msiexec.exe (PID: 396)
      • msiexec.exe (PID: 2928)
      • createdump.exe (PID: 3816)

    • Executable content was dropped or overwritten

      • msiexec.exe (PID: 396)

    • The sample compiled with english language support

      • msiexec.exe (PID: 396)

    • Reads Environment values

      • msiexec.exe (PID: 2928)

    • Checks proxy server information

      • msiexec.exe (PID: 2928)

    • Reads the machine GUID from the registry

      • msiexec.exe (PID: 2928)

    • Reads the software policy settings

      • msiexec.exe (PID: 2928)
      • powershell.exe (PID: 6096)

    • Create files in a temporary directory

      • powershell.exe (PID: 6096)
      • msiexec.exe (PID: 2928)

    • Reads security settings of Internet Explorer

      • powershell.exe (PID: 6096)

    • Creates a software uninstall entry

      • msiexec.exe (PID: 396)

    • Creates files or folders in the user directory

      • msiexec.exe (PID: 396)

    • Uses string replace method (POWERSHELL)

      • powershell.exe (PID: 6096)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.msi | Microsoft Windows Installer (88.6)
.mst | Windows SDK Setup Transform Script (10)
.msi | Microsoft Installer (100)

EXIF

FlashPix

Security: None
CodePage: Windows Latin 1 (Western European)
RevisionNumber: {1CD1875B-5E87-42CE-9389-9C216C5C1759}
Words: 10
Subject: Cave App
Author: Weqos Apps Industries
LastModifiedBy: -
Software: Cave App
Template: x64;2057
Comments: This installer database contains the logic and data required to install Cave App.
Title: Installation Database
Keywords: Installer, MSI, Database
CreateDate: 2024:12:27 06:19:13
ModifyDate: 2024:12:27 06:19:13
LastPrinted: 2024:12:27 06:19:13
Pages: 450
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
122
Monitored processes
11
Malicious processes
1
Suspicious processes
1

Behavior graph

Click at the process to see the details
start msiexec.exe no specs msiexec.exe msiexec.exe powershell.exe no specs conhost.exe no specs createdump.exe no specs cmd.exe no specs conhost.exe no specs conhost.exe no specs importerredserver.exe no specs conhost.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
396C:\WINDOWS\system32\msiexec.exe /VC:\Windows\System32\msiexec.exe
services.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Windows® installer
Version:
5.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\msiexec.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\aclayers.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
1576\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—powershell.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1868\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—ImporterREDServer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
2928C:\Windows\syswow64\MsiExec.exe -Embedding F5FB5F2F20CB88A0802B3C86BEB8C08FC:\Windows\SysWOW64\msiexec.exe
msiexec.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows® installer
Exit code:
0
Version:
5.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\msiexec.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\aclayers.dll
2972"C:\Windows\System32\msiexec.exe" /i C:\Users\admin\Desktop\8355bd295c468007f6700cd1f969dc90c794f733158ef8f858a1180a2ee2cbaa.msiC:\Windows\System32\msiexec.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows® installer
Exit code:
0
Version:
5.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\msiexec.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\aclayers.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
3288C:\WINDOWS\system32\cmd.exe /c ""C:\Users\admin\AppData\Roaming\Weqos Apps Industries\Cave App\suriqk.bat" "C:\Users\admin\AppData\Roaming\Weqos Apps Industries\Cave App\ImporterREDServer.exe""C:\Windows\System32\cmd.exe—msiexec.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\cmdext.dll
c:\windows\system32\advapi32.dll
3816"C:\Users\admin\AppData\Roaming\Weqos Apps Industries\Cave App\createdump.exe"C:\Users\admin\AppData\Roaming\Weqos Apps Industries\Cave App\createdump.exe—msiexec.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft .NET Runtime Crash Dump Generator
Exit code:
4294967295
Version:
6,0,2223,42425 @Commit: 4bb6dc195c0a3bc4c7e24ff54a8925b98db
Modules
Images
c:\users\admin\appdata\roaming\weqos apps industries\cave app\createdump.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\ws2_32.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\dbghelp.dll
c:\windows\system32\dbgcore.dll
5592\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—createdump.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
5604"C:\Users\admin\AppData\Roaming\Weqos Apps Industries\Cave App\ImporterREDServer.exe" C:\Users\admin\AppData\Roaming\Weqos Apps Industries\Cave App\ImporterREDServer.exe—cmd.exe
User:
admin
Company:
Adobe
Integrity Level:
MEDIUM
Description:
Adobe ImporterRED Server 14
Exit code:
3221225781
Version:
14.0.0.0
Modules
Images
c:\users\admin\appdata\roaming\weqos apps industries\cave app\importerredserver.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\ucrtbase.dll
c:\users\admin\appdata\roaming\weqos apps industries\cave app\vcruntime140.dll
c:\users\admin\appdata\roaming\weqos apps industries\cave app\msvcp140.dll
c:\users\admin\appdata\roaming\weqos apps industries\cave app\vcruntime140_1.dll
c:\users\admin\appdata\roaming\weqos apps industries\cave app\dvacore.dll
6016\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
Total events
9 507
Read events
9 359
Write events
139
Delete events
9

Modification events

(PID) Process:(396) msiexec.exeKey:HKEY_USERS\S-1-5-21-1693682860-607145093-2874071422-1001\SOFTWARE\Microsoft\RestartManager\Session0000
Operation:writeName:Owner
Value:
8C01000057F46C1BBA58DB01
(PID) Process:(396) msiexec.exeKey:HKEY_USERS\S-1-5-21-1693682860-607145093-2874071422-1001\SOFTWARE\Microsoft\RestartManager\Session0000
Operation:writeName:SessionHash
Value:
6ECBAA8B484200A13440DC06C23820187951AA7793A5E7404C29C37D7860764A
(PID) Process:(396) msiexec.exeKey:HKEY_USERS\S-1-5-21-1693682860-607145093-2874071422-1001\SOFTWARE\Microsoft\RestartManager\Session0000
Operation:writeName:Sequence
Value:
1
(PID) Process:(396) msiexec.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Folders
Operation:writeName:C:\Users\admin\AppData\Roaming\Microsoft\Installer\
Value:
(PID) Process:(396) msiexec.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-21-1693682860-607145093-2874071422-1001\Components\E443C93FE38A0674D88A2F672090B5F4
Operation:writeName:1D4F3572304C4D44CA2A03CD40F72228
Value:
C:\Users\admin\AppData\Roaming\Weqos Apps Industries\Cave App\
(PID) Process:(396) msiexec.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-21-1693682860-607145093-2874071422-1001\Components\187E38CB2ED78A74793CE2C69CCBDA28
Operation:writeName:1D4F3572304C4D44CA2A03CD40F72228
Value:
21:\Software\Weqos Apps Industries\Cave App\Version
(PID) Process:(396) msiexec.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-21-1693682860-607145093-2874071422-1001\Components\E7EE285D6BCFBB0488FD8D57166FADAC
Operation:writeName:1D4F3572304C4D44CA2A03CD40F72228
Value:
C:\Users\admin\AppData\Roaming\Weqos Apps Industries\Cave App\dvacore.dll
(PID) Process:(396) msiexec.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-21-1693682860-607145093-2874071422-1001\Components\51125544FAB230246BBFE149506FE373
Operation:writeName:1D4F3572304C4D44CA2A03CD40F72228
Value:
C:\Users\admin\AppData\Roaming\Weqos Apps Industries\Cave App\dvaunittesting.dll
(PID) Process:(396) msiexec.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-21-1693682860-607145093-2874071422-1001\Components\065A82ED1E5E5304C83A443964682A94
Operation:writeName:1D4F3572304C4D44CA2A03CD40F72228
Value:
C:\Users\admin\AppData\Roaming\Weqos Apps Industries\Cave App\ImporterREDServer.exe
(PID) Process:(396) msiexec.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-21-1693682860-607145093-2874071422-1001\Components\89B93D30BB7E2604DB2903D746A2C51F
Operation:writeName:1D4F3572304C4D44CA2A03CD40F72228
Value:
C:\Users\admin\AppData\Roaming\Weqos Apps Industries\Cave App\ghiuoqfj.rar
Executable files
55
Suspicious files
20
Text files
7
Unknown types
2

Dropped files

PID
Process
Filename
Type
396msiexec.exeC:\Windows\Installer\137d80.msi —
MD5:—
SHA256:—
2928msiexec.exeC:\Users\admin\AppData\Local\Temp\msi96C5.txt —
MD5:—
SHA256:—
2928msiexec.exeC:\Users\admin\AppData\Local\Temp\scr96C6.ps1 —
MD5:—
SHA256:—
2928msiexec.exeC:\Users\admin\AppData\Local\Temp\scr96C7.txt —
MD5:—
SHA256:—
2928msiexec.exeC:\Users\admin\AppData\Local\Temp\pss96C8.ps1 —
MD5:—
SHA256:—
396msiexec.exeC:\Windows\Installer\MSI8297.tmpexecutable
MD5:EE09D6A1BB908B42C05FD0BEEB67DFD2
SHA256:7BBF611F5E2A16439DC8CD11936F6364F6D5CC0044545C92775DA5646AFC7752
396msiexec.exeC:\Windows\Installer\MSI7FF2.tmpexecutable
MD5:EE09D6A1BB908B42C05FD0BEEB67DFD2
SHA256:7BBF611F5E2A16439DC8CD11936F6364F6D5CC0044545C92775DA5646AFC7752
396msiexec.exeC:\Windows\Installer\MSI95F2.tmpbinary
MD5:3792C63C9BBE7259F81237DE25D9F720
SHA256:468A1A5D4C2E7FE748ACFE4917E280317F007F0D6DA97B10C7CA4657E4743954
396msiexec.exeC:\Windows\Installer\MSI80DE.tmpexecutable
MD5:EE09D6A1BB908B42C05FD0BEEB67DFD2
SHA256:7BBF611F5E2A16439DC8CD11936F6364F6D5CC0044545C92775DA5646AFC7752
396msiexec.exeC:\Windows\Installer\MSI8238.tmpexecutable
MD5:EE09D6A1BB908B42C05FD0BEEB67DFD2
SHA256:7BBF611F5E2A16439DC8CD11936F6364F6D5CC0044545C92775DA5646AFC7752
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
5
TCP/UDP connections
17
DNS requests
7
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
4712
MoUsoCoreWorker.exe
GET
200
2.16.241.19:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
5208
svchost.exe
GET
200
2.16.241.19:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
5208
svchost.exe
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
4712
MoUsoCoreWorker.exe
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
—
—
POST
403
188.114.97.3:443
https://ksarcftp.com/updater.php
unknown
html
4.41 Kb
—
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
—
—
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
—
—
192.168.100.255:137
—
—
—
whitelisted
—
—
192.168.100.255:138
—
—
—
whitelisted
4712
MoUsoCoreWorker.exe
2.16.241.19:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
5208
svchost.exe
2.16.241.19:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
5208
svchost.exe
95.101.149.131:80
www.microsoft.com
Akamai International B.V.
NL
whitelisted
4712
MoUsoCoreWorker.exe
95.101.149.131:80
www.microsoft.com
Akamai International B.V.
NL
whitelisted
2928
msiexec.exe
188.114.97.3:443
ksarcftp.com
CLOUDFLARENET
NL
unknown

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 4.231.128.59
whitelisted
google.com
  • 142.250.186.78
whitelisted
crl.microsoft.com
  • 2.16.241.19
  • 2.16.241.12
whitelisted
www.microsoft.com
  • 95.101.149.131
whitelisted
ksarcftp.com
  • 188.114.97.3
  • 188.114.96.3
unknown
self.events.data.microsoft.com
  • 20.42.73.27
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
8355bd295c468007f6700cd1f969dc90c794f733158ef8f858a1180a2ee2cbaa.msi