File name:

RDPWInst-v1.6.2.msi

Full analysis: https://app.any.run/tasks/b8a766c4-f359-4559-890f-cfc59593f756
Verdict: Malicious activity
Analysis date: June 29, 2024, 01:44:28
OS: Windows 10 Professional (build: 19045, 64 bit)
Tags:
generated-doc
Indicators:
MIME: application/x-msi
File info: Composite Document File V2 Document, Little Endian, Os: Windows, Version 6.1, MSI Installer, Code page: 1252, Title: Installation Database, Subject: RDP Wrapper Library, Author: Stas'M Corp. and contributors, Keywords: Installer, Comments: This installer database contains the logic and data required to install RDP Wrapper Library., Template: Intel;1033, Revision Number: {DB3018A4-F249-43B2-98B5-79F64E34E88C}, Create Time/Date: Wed Dec 27 20:02:46 2017, Last Saved Time/Date: Wed Dec 27 20:02:46 2017, Number of Pages: 200, Number of Words: 2, Name of Creating Application: Windows Installer XML Toolset (3.11.0.1701), Security: 2
MD5:

92CBBE2D06D03C156C83AE1A02AB30E3

SHA1:

7D14F457F193D75DD7F52BECDEE5CF25B948573B

SHA256:

9899FFECF141AB4535EC702FACBF2B4233903B428B862F3A87E635D09C6244DE

SSDEEP:

12288:GnAYhZFoqIVAV0yjNZzucNNZLVk/dJJibRoQu9kzWEYCdrflYemcS1/U6:UASZFKAVbBZzu0Ni49oQu9DuZYebSS6

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Drops the executable file immediately after the start

      • msiexec.exe (PID: 5124)
      • msiexec.exe (PID: 4852)

  • SUSPICIOUS

    • Reads the Windows owner or organization settings

      • msiexec.exe (PID: 5124)

  • INFO

    • Checks supported languages

      • msiexec.exe (PID: 5124)

    • Reads the computer name

      • msiexec.exe (PID: 5124)

    • Executable content was dropped or overwritten

      • msiexec.exe (PID: 5124)

    • Create files in a temporary directory

      • msiexec.exe (PID: 4852)

    • Creates a software uninstall entry

      • msiexec.exe (PID: 5124)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.msi | Microsoft Installer (100)

EXIF

FlashPix

CodePage: Windows Latin 1 (Western European)
Title: Installation Database
Subject: RDP Wrapper Library
Author: Stas'M Corp. and contributors
Keywords: Installer
Comments: This installer database contains the logic and data required to install RDP Wrapper Library.
Template: Intel;1033
RevisionNumber: {DB3018A4-F249-43B2-98B5-79F64E34E88C}
CreateDate: 2017:12:27 20:02:46
ModifyDate: 2017:12:27 20:02:46
Pages: 200
Words: 2
Software: Windows Installer XML Toolset (3.11.0.1701)
Security: Read-only recommended
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
144
Monitored processes
3
Malicious processes
0
Suspicious processes
1

Behavior graph

Click at the process to see the details
start msiexec.exe no specs msiexec.exe rdpwinst.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
4764"C:\ProgramData\Package Cache\{37ea5771-3352-4a52-9fac-9297331daebd}\RDPWInst.exe" -i -oC:\ProgramData\Package Cache\{37ea5771-3352-4a52-9fac-9297331daebd}\RDPWInst.exe—msiexec.exe
User:
admin
Company:
Stas'M Corp.
Integrity Level:
MEDIUM
Description:
RDP Wrapper Library Installer
Exit code:
3221226540
Version:
2.5.0.0
Modules
Images
c:\programdata\package cache\{37ea5771-3352-4a52-9fac-9297331daebd}\rdpwinst.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
4852"C:\Windows\System32\msiexec.exe" /i C:\Users\admin\AppData\Local\Temp\RDPWInst-v1.6.2.msiC:\Windows\System32\msiexec.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows® installer
Exit code:
1603
Version:
5.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\msiexec.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\aclayers.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
5124C:\WINDOWS\system32\msiexec.exe /VC:\Windows\System32\msiexec.exe
services.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Windows® installer
Version:
5.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\msiexec.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\aclayers.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
Total events
2 883
Read events
2 799
Write events
75
Delete events
9

Modification events

(PID) Process:(5124) msiexec.exeKey:HKEY_USERS\S-1-5-21-1693682860-607145093-2874071422-1001\SOFTWARE\Microsoft\RestartManager\Session0000
Operation:writeName:Owner
Value:
041400002A31ECE4C5C9DA01
(PID) Process:(5124) msiexec.exeKey:HKEY_USERS\S-1-5-21-1693682860-607145093-2874071422-1001\SOFTWARE\Microsoft\RestartManager\Session0000
Operation:writeName:SessionHash
Value:
9EE314D7738A13E0483A31593D3B27995E1BB30CE76242A19255B4F8DB111169
(PID) Process:(5124) msiexec.exeKey:HKEY_USERS\S-1-5-21-1693682860-607145093-2874071422-1001\SOFTWARE\Microsoft\RestartManager\Session0000
Operation:writeName:Sequence
Value:
1
(PID) Process:(5124) msiexec.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Folders
Operation:writeName:C:\Config.Msi\
Value:
(PID) Process:(5124) msiexec.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Rollback\Scripts
Operation:writeName:C:\Config.Msi\1ad1f8.rbs
Value:
31115717
(PID) Process:(5124) msiexec.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Rollback\Scripts
Operation:writeName:C:\Config.Msi\1ad1f8.rbsLow
Value:
(PID) Process:(5124) msiexec.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Folders
Operation:writeName:C:\Users\admin\AppData\Roaming\Microsoft\Installer\
Value:
(PID) Process:(5124) msiexec.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-21-1693682860-607145093-2874071422-1001\Components\1D77DFFAC53B3F649AF76168CD758B8B
Operation:writeName:1775AE73253325A4F9CA297933D1EADB
Value:
C:\ProgramData\Package Cache\{37ea5771-3352-4a52-9fac-9297331daebd}\RDPWInst.exe
(PID) Process:(5124) msiexec.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Folders
Operation:writeName:C:\ProgramData\Package Cache\{37ea5771-3352-4a52-9fac-9297331daebd}\
Value:
(PID) Process:(5124) msiexec.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-21-1693682860-607145093-2874071422-1001\Products\1775AE73253325A4F9CA297933D1EADB\InstallProperties
Operation:writeName:LocalPackage
Value:
C:\WINDOWS\Installer\1ad1f9.msi
Executable files
3
Suspicious files
11
Text files
1
Unknown types
3

Dropped files

PID
Process
Filename
Type
5124msiexec.exeC:\WINDOWS\TEMP\~DFAEF3161251CF7405.TMPgmc
MD5:BF619EAC0CDF3F68D496EA9344137E8B
SHA256:076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
5124msiexec.exeC:\WINDOWS\Installer\inprogressinstallinfo.ipibinary
MD5:A11AF7E468B5DB8C975D3D01952C0546
SHA256:E465EECA58A25F0D62369794E528B8A000498E750869CD316CC76AD4AAA4CC86
5124msiexec.exeC:\WINDOWS\TEMP\~DF9EE2BE8796D45CFF.TMPbinary
MD5:A11AF7E468B5DB8C975D3D01952C0546
SHA256:E465EECA58A25F0D62369794E528B8A000498E750869CD316CC76AD4AAA4CC86
5124msiexec.exeC:\WINDOWS\TEMP\~DF10848702A0A8829A.TMPgmc
MD5:BF619EAC0CDF3F68D496EA9344137E8B
SHA256:076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
5124msiexec.exeC:\WINDOWS\Installer\1ad1f9.msiexecutable
MD5:92CBBE2D06D03C156C83AE1A02AB30E3
SHA256:9899FFECF141AB4535EC702FACBF2B4233903B428B862F3A87E635D09C6244DE
5124msiexec.exeC:\WINDOWS\TEMP\~DF16AA02E9FCED3555.TMPbinary
MD5:A11AF7E468B5DB8C975D3D01952C0546
SHA256:E465EECA58A25F0D62369794E528B8A000498E750869CD316CC76AD4AAA4CC86
5124msiexec.exeC:\WINDOWS\TEMP\~DF187EC3B2B56AFC1B.TMPgmc
MD5:BF619EAC0CDF3F68D496EA9344137E8B
SHA256:076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
5124msiexec.exeC:\WINDOWS\Installer\SourceHash{37EA5771-3352-4A52-9FAC-9297331DAEBD}binary
MD5:D899D417C5A2776913ABA2BD271BC5EB
SHA256:480A1CC6E56CBAD3429BBF4BB61F1BDFD67F46A1FA888F9780D9AACEA933BF30
5124msiexec.exeC:\WINDOWS\TEMP\~DF0E32849B2FB7E016.TMPgmc
MD5:5F067BA9AC16AD46982B17A1F7A6C29D
SHA256:3F84AF851848DBDF9E2E3D905439AF7BA47F562D34C76CF3E2CE5DBED3A6BC56
5124msiexec.exeC:\WINDOWS\TEMP\~DF61808E8261EFC54F.TMPbinary
MD5:FEF29CE4DE21CAF669D82E08C9FA91C5
SHA256:E6C3E872B5B62F7F575B9AD22FE8D8FAE9761455D4835062F91E58B7D87CEE56
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
8
TCP/UDP connections
71
DNS requests
15
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
1660
SIHClient.exe
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
unknown
1660
SIHClient.exe
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
unknown
1436
MoUsoCoreWorker.exe
GET
200
2.16.164.120:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
unknown
1436
MoUsoCoreWorker.exe
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
unknown
3040
OfficeClickToRun.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEA77flR%2B3w%2FxBpruV2lte6A%3D
unknown
—
—
unknown
2476
backgroundTaskHost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0%3D
unknown
—
—
unknown
1544
svchost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
unknown
1292
backgroundTaskHost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0%3D
unknown
—
—
unknown
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
2916
svchost.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4032
svchost.exe
239.255.255.250:1900
—
—
—
unknown
4
System
192.168.100.255:138
—
—
—
unknown
3688
RUXIMICS.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
unknown
1436
MoUsoCoreWorker.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
unknown
4656
SearchApp.exe
2.20.142.187:443
r.bing.com
Akamai International B.V.
DE
unknown
1544
svchost.exe
40.126.32.133:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
unknown
1544
svchost.exe
192.229.221.95:80
—
EDGECAST
US
whitelisted
1060
svchost.exe
2.19.105.250:443
go.microsoft.com
AKAMAI-AS
DE
unknown
3040
OfficeClickToRun.exe
51.105.71.136:443
self.events.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
GB
unknown

DNS requests

Domain
IP
Reputation
r.bing.com
  • 2.20.142.187
  • 2.20.142.154
whitelisted
login.live.com
  • 40.126.32.133
  • 40.126.32.138
  • 40.126.32.68
  • 40.126.32.140
  • 20.190.160.14
  • 20.190.160.17
  • 20.190.160.22
  • 40.126.32.72
whitelisted
go.microsoft.com
  • 2.19.105.250
whitelisted
self.events.data.microsoft.com
  • 51.105.71.136
whitelisted
settings-win.data.microsoft.com
  • 51.104.136.2
whitelisted
crl.microsoft.com
  • 2.16.164.120
  • 2.16.164.72
whitelisted
www.microsoft.com
  • 95.101.149.131
whitelisted
arc.msn.com
  • 20.199.58.43
whitelisted
slscr.update.microsoft.com
  • 40.68.123.157
whitelisted
fe3cr.delivery.mp.microsoft.com
  • 20.3.187.198
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
RDPWInst-v1.6.2.msi