File name:

GUI Turbo Assembler v5.0.msi

Full analysis: https://app.any.run/tasks/b1ff1e3e-9d3a-449f-b1fa-c329dafb7a11
Verdict: Malicious activity
Analysis date: October 26, 2023, 07:55:02
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: application/x-msi
File info: Composite Document File V2 Document, Little Endian, Os: Windows, Version 10.0, MSI Installer, Create Time/Date: Mon Jun 21 08:00:00 1999, Name of Creating Application: Windows Installer, Security: 1, Code page: 1252, Template: ;1033, Number of Pages: 200, Revision Number: {2B855D75-8C6B-447F-843E-D65315C767D3}, Title: GUI Turbo Assembler, Author: Lakhya Jyoti Nath, Keywords: tasm,tlink,td,guitasm,gui, Comments: An essential 32-64bit localized IDE for Assembly Language with TASM, TLINK and TD, Number of Words: 2, Last Saved Time/Date: Wed Oct 18 23:13:10 2023, Last Printed: Wed Oct 18 23:13:10 2023
MD5:

709E77A4DBBC7192D73EF47C722348AB

SHA1:

D8C96690F3D9CDBB131B162575E4967EBB5555F9

SHA256:

8FCC26490CE579D25C8A30ABDF01655E7963F4CF191A8528CABDA597557FA727

SSDEEP:

98304:kB0el1eIIeaSlSfRK8MZMT9ameTZY7A3vYBLUAYrbyjSTwKA9u2xFT8K2+E8kDxl:a2HJajTeBM2

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Application was dropped or rewritten from another process

      • GUI Turbo Assembler.exe (PID: 4072)
      • GUI Turbo Assembler.exe (PID: 3580)
      • AL.exe (PID: 3508)

    • Drops the executable file immediately after the start

      • msiexec.exe (PID: 568)

    • Loads dropped or rewritten executable

      • GUI Turbo Assembler.exe (PID: 3580)

  • SUSPICIOUS

    • Process drops legitimate windows executable

      • msiexec.exe (PID: 1824)
      • msiexec.exe (PID: 568)

    • Executes as Windows Service

      • VSSVC.exe (PID: 3016)

    • Changes default file association

      • msiexec.exe (PID: 568)

    • The process drops C-runtime libraries

      • msiexec.exe (PID: 568)

    • Reads settings of System Certificates

      • GUI Turbo Assembler.exe (PID: 3580)

    • Reads the Internet Settings

      • GUI Turbo Assembler.exe (PID: 3580)

    • Starts CMD.EXE for commands execution

      • GUI Turbo Assembler.exe (PID: 3580)
      • AL.exe (PID: 3508)

  • INFO

    • Reads the computer name

      • msiexec.exe (PID: 568)
      • msiexec.exe (PID: 3792)
      • msiexec.exe (PID: 2512)
      • GUI Turbo Assembler.exe (PID: 3580)

    • Reads the machine GUID from the registry

      • msiexec.exe (PID: 568)
      • msiexec.exe (PID: 3792)
      • msiexec.exe (PID: 2512)
      • GUI Turbo Assembler.exe (PID: 3580)

    • Checks supported languages

      • msiexec.exe (PID: 568)
      • msiexec.exe (PID: 3792)
      • msiexec.exe (PID: 2512)
      • GUI Turbo Assembler.exe (PID: 3580)
      • AL.exe (PID: 3508)

    • Drops the executable file immediately after the start

      • msiexec.exe (PID: 1824)
      • ntvdm.exe (PID: 1044)

    • Application launched itself

      • msiexec.exe (PID: 568)

    • Create files in a temporary directory

      • msiexec.exe (PID: 3792)
      • msiexec.exe (PID: 2512)
      • msiexec.exe (PID: 568)
      • GUI Turbo Assembler.exe (PID: 3580)

    • Manual execution by a user

      • GUI Turbo Assembler.exe (PID: 4072)
      • GUI Turbo Assembler.exe (PID: 3580)

    • Reads Environment values

      • GUI Turbo Assembler.exe (PID: 3580)

    • Creates files or folders in the user directory

      • GUI Turbo Assembler.exe (PID: 3580)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.msi | Microsoft Windows Installer (90.2)
.msp | Windows Installer Patch (8.4)
.msi | Microsoft Installer (100)

EXIF

FlashPix

CreateDate: 1999:06:21 07:00:00
Software: Windows Installer
Security: Password protected
CodePage: Windows Latin 1 (Western European)
Template: ;1033
Pages: 200
RevisionNumber: {2B855D75-8C6B-447F-843E-D65315C767D3}
Title: GUI Turbo Assembler
Subject: -
Author: Lakhya Jyoti Nath
Keywords: tasm,tlink,td,guitasm,gui
Comments: An essential 32-64bit localized IDE for Assembly Language with TASM, TLINK and TD
Words: 2
ModifyDate: 2023:10:18 22:13:10
LastPrinted: 2023:10:18 22:13:10
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
63
Monitored processes
17
Malicious processes
3
Suspicious processes
2

Behavior graph

Click at the process to see the details
start msiexec.exe no specs msiexec.exe no specs msiexec.exe no specs vssvc.exe no specs msiexec.exe no specs gui turbo assembler.exe no specs gui turbo assembler.exe cmd.exe no specs ntvdm.exe no specs cmd.exe no specs ntvdm.exe no specs cmd.exe no specs al.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs ntvdm.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
568C:\Windows\system32\msiexec.exe /VC:\Windows\System32\msiexec.exe—services.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Windows® installer
Exit code:
0
Version:
5.0.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\msiexec.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\user32.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\lpk.dll
892"C:\Windows\system32\ntvdm.exe" C:\Windows\System32\ntvdm.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
NTVDM.EXE
Exit code:
255
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\ntdll.dll
c:\windows\system32\ntvdm.exe
c:\windows\system32\kernel32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\usp10.dll
c:\windows\system32\user32.dll
1044"C:\Windows\system32\ntvdm.exe" C:\Windows\System32\ntvdm.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
NTVDM.EXE
Exit code:
255
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\ntvdm.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
1336"cmd.exe" /c AL "C:\Program Files\GUI Turbo Assembler\EXAMPLES\HELOWRLD.exe"C:\Windows\System32\cmd.exe—GUI Turbo Assembler.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Command Processor
Exit code:
3221225547
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\winbrand.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\usp10.dll
1736C:\Windows\system32\cmd.exe /c clsC:\Windows\System32\cmd.exe—AL.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\kernelbase.dll
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\winbrand.dll
c:\windows\system32\user32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\lpk.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\usp10.dll
1824"C:\Windows\System32\msiexec.exe" /i "C:\Users\admin\AppData\Local\Temp\GUI Turbo Assembler v5.0.msi"C:\Windows\System32\msiexec.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows® installer
Exit code:
0
Version:
5.0.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\msiexec.exe
c:\windows\system32\kernelbase.dll
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\gdi32.dll
1864"cmd.exe" /c TASM /z /zi HELOWRLD.ASMC:\Windows\System32\cmd.exe—GUI Turbo Assembler.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\ntdll.dll
c:\windows\system32\cmd.exe
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\winbrand.dll
c:\windows\system32\user32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
1872C:\Windows\system32\cmd.exe /c "C:\Program Files\GUI Turbo Assembler\EXAMPLES\HELOWRLD.exe"C:\Windows\System32\cmd.exe—AL.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\ntdll.dll
c:\windows\system32\cmd.exe
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\winbrand.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
2052"cmd.exe" /c TLINK /3 /x /v /k HELOWRLDC:\Windows\System32\cmd.exe—GUI Turbo Assembler.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\winbrand.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
2372"C:\Windows\system32\ntvdm.exe" C:\Windows\System32\ntvdm.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
NTVDM.EXE
Exit code:
255
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\ntvdm.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
Total events
8 588
Read events
8 537
Write events
40
Delete events
11

Modification events

(PID) Process:(568) msiexec.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\SystemRestore
Operation:writeName:SrCreateRp (Enter)
Value:
4000000000000000F2B487BA16B0D901C80700002C0A0000D5070000000000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(568) msiexec.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\SPP
Operation:writeName:SppCreate (Enter)
Value:
4000000000000000F2B487BA16B0D901C80700002C0A0000D0070000000000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(568) msiexec.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SPP
Operation:writeName:LastIndex
Value:
72
(PID) Process:(568) msiexec.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\SPP
Operation:writeName:SppGatherWriterMetadata (Enter)
Value:
40000000000000008C62D6BA16B0D901C80700002C0A0000D3070000000000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(568) msiexec.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\SPP
Operation:writeName:SppGatherWriterMetadata (Leave)
Value:
400000000000000064514ABC16B0D901C80700002C0A0000D3070000010000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(568) msiexec.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\SPP
Operation:writeName:SppAddInterestingComponents (Enter)
Value:
400000000000000064514ABC16B0D901C80700002C0A0000D4070000000000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(568) msiexec.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\SPP
Operation:writeName:SppAddInterestingComponents (Leave)
Value:
400000000000000034645DBC16B0D901C80700002C0A0000D4070000010000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(568) msiexec.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\SPP
Operation:writeName:SppCreate (Leave)
Value:
4000000000000000781D5ABD16B0D901C80700002C0A0000D0070000010000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(568) msiexec.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\SystemRestore
Operation:writeName:SrCreateRp (Leave)
Value:
4000000000000000781D5ABD16B0D901C80700002C0A0000D5070000010000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(568) msiexec.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore
Operation:writeName:FirstRun
Value:
0
Executable files
72
Suspicious files
63
Text files
202
Unknown types
0

Dropped files

PID
Process
Filename
Type
568msiexec.exeC:\System Volume Information\SPP\metadata-2 —
MD5:—
SHA256:—
568msiexec.exeC:\Windows\Installer\1f2052.msi —
MD5:—
SHA256:—
1824msiexec.exeC:\Users\admin\AppData\Local\Temp\MSIAEEC.tmpexecutable
MD5:684F2D21637CB5835172EDAD55B6A8D9
SHA256:DA1FE86141C446921021BB26B6FE2BD2D1BB51E3E614F46F8103FFAD8042F2C0
568msiexec.exeC:\System Volume Information\SPP\OnlineMetadataCache\{18480e8e-9692-4bfa-8812-fe75e7ba5e8f}_OnDiskSnapshotPropbinary
MD5:8AB42B62E6E61303AB2DB28F3F0F9392
SHA256:A2F2D408B3993E90CF252C98A23712A1D39D3EA583956D43F0B942D4DEB4738A
568msiexec.exeC:\Windows\Installer\MSI22F3.tmpexecutable
MD5:684F2D21637CB5835172EDAD55B6A8D9
SHA256:DA1FE86141C446921021BB26B6FE2BD2D1BB51E3E614F46F8103FFAD8042F2C0
568msiexec.exeC:\Windows\Installer\MSI2294.tmpexecutable
MD5:684F2D21637CB5835172EDAD55B6A8D9
SHA256:DA1FE86141C446921021BB26B6FE2BD2D1BB51E3E614F46F8103FFAD8042F2C0
2512msiexec.exeC:\Users\admin\AppData\Local\Temp\CFG22F2.tmpxml
MD5:FDBBDB01EBC78A136A78F17E1E2E40D8
SHA256:A0314FF4CB7D286BCF94CF5B862E96122DDF6FEA6AF1014B71253E04CF67C94B
568msiexec.exeC:\Users\admin\AppData\Local\Temp\~DF94474BBE873361BD.TMPbinary
MD5:C48D4AED1FD6C8A18B24FB4F9B3A7019
SHA256:9C75E1478DA2B35FE215BD0F8A42179289BFFD856864168FE0B2239F4E7497CE
568msiexec.exeC:\Windows\Installer\1f2053.ipibinary
MD5:1A8FF9CC3B0B4A9E467966B55AAB8294
SHA256:D6B5F6AC2C35EA972E8ACC5DE9C217DD887530A86093F2D0BF9FFF01B8C203AB
568msiexec.exeC:\Windows\Installer\MSI26EC.tmpbinary
MD5:D097F4E34524A2C1953E31C5820442C7
SHA256:59AB30B07FCC61B188ECF843E3327A972009E1D7282285084139EFEE9DFA03C0
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
1
TCP/UDP connections
8
DNS requests
2
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
3580
GUI Turbo Assembler.exe
GET
200
93.184.221.240:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab?164ab23c5a0fce87
unknown
compressed
61.6 Kb
unknown
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:138
—
—
—
whitelisted
2656
svchost.exe
239.255.255.250:1900
—
—
—
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
1088
svchost.exe
224.0.0.252:5355
—
—
—
unknown
3580
GUI Turbo Assembler.exe
104.21.0.103:443
app.ljnath.com
CLOUDFLARENET
—
unknown
3580
GUI Turbo Assembler.exe
93.184.221.240:80
ctldl.windowsupdate.com
EDGECAST
GB
whitelisted

DNS requests

Domain
IP
Reputation
app.ljnath.com
  • 104.21.0.103
  • 172.67.150.223
unknown
ctldl.windowsupdate.com
  • 93.184.221.240
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
GUI Turbo Assembler v5.0.msi