File name:

Setup.msi

Full analysis: https://app.any.run/tasks/6d2397ec-95c7-4be6-9fb7-77d5f4aac0eb
Verdict: Malicious activity
Analysis date: November 20, 2020, 23:15:17
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
generated-doc
Indicators:
MIME: application/x-msi
File info: Composite Document File V2 Document, Little Endian, Os: Windows, Version 6.2, MSI Installer, Code page: 1252, Title: Installation Database, Subject: This setup package will Install Holcus Topical Soft version 1.4.6.2, Author: Holcus Topical Soft Inc., Keywords: Installer, Comments: This installer database contains the logic and data required to install Holcus Topical Soft., Template: Intel;1033, Revision Number: {6AA28988-9E2C-41FF-805B-CCCD7B6AF935}, Create Time/Date: Thu Nov 12 13:18:36 2020, Last Saved Time/Date: Thu Nov 12 13:18:36 2020, Number of Pages: 200, Number of Words: 10, Name of Creating Application: Windows Installer XML Toolset (3.11.0.1528), Security: 2
MD5:

57950764249146EE962DED00FBEDA479

SHA1:

2C732019D5249FBDE597F9A1F3DE64B2A7A23DE0

SHA256:

9AC0B4084B6A3E277510CB1B0FBFD8FC9A8FC70C1F8D97669206B41A04F6C888

SSDEEP:

24576:X6mLIehUUi+3q3hx6hVYTfdZ7brfVNa0w0fEsfBUyq+:XbhUUt3qRxEVWrrVa7

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Changes settings of System certificates

      • HolcusTopicalSoft.exe (PID: 2364)

    • Application was dropped or rewritten from another process

      • HolcusTopicalSoft.exe (PID: 2916)
      • HolcusTopicalSoft.exe (PID: 2364)
      • HolcusTopicalSoftgua.exe (PID: 2188)

    • Drops executable file immediately after starts

      • HolcusTopicalSoftgua.exe (PID: 2188)

    • Loads dropped or rewritten executable

      • HolcusTopicalSoftgua.exe (PID: 2188)

  • SUSPICIOUS

    • Creates files in the user directory

      • HolcusTopicalSoft.exe (PID: 2916)
      • msiexec.exe (PID: 2340)
      • HolcusTopicalSoft.exe (PID: 2364)

    • Creates files in the program directory

      • HolcusTopicalSoft.exe (PID: 2364)
      • HolcusTopicalSoft.exe (PID: 2916)

    • Drops a file with a compile date too recent

      • msiexec.exe (PID: 2340)

    • Executable content was dropped or overwritten

      • msiexec.exe (PID: 2340)
      • HolcusTopicalSoft.exe (PID: 2364)
      • HolcusTopicalSoftgua.exe (PID: 2188)

    • Application launched itself

      • HolcusTopicalSoft.exe (PID: 2916)
      • cmd.exe (PID: 684)

    • Adds / modifies Windows certificates

      • HolcusTopicalSoft.exe (PID: 2364)

    • Creates a directory in Program Files

      • HolcusTopicalSoft.exe (PID: 2364)

    • Starts CMD.EXE for commands execution

      • HolcusTopicalSoft.exe (PID: 2364)
      • cmd.exe (PID: 684)

    • Starts CMD.EXE for self-deleting

      • HolcusTopicalSoft.exe (PID: 2364)
      • cmd.exe (PID: 684)

  • INFO

    • Reads settings of System Certificates

      • HolcusTopicalSoft.exe (PID: 2364)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.msi | Microsoft Installer (100)

EXIF

FlashPix

CodePage: Windows Latin 1 (Western European)
Title: Installation Database
Subject: This setup package will Install Holcus Topical Soft version 1.4.6.2
Author: Holcus Topical Soft Inc.
Keywords: Installer
Comments: This installer database contains the logic and data required to install Holcus Topical Soft.
Template: Intel;1033
RevisionNumber: {6AA28988-9E2C-41FF-805B-CCCD7B6AF935}
CreateDate: 2020:11:12 13:18:36
ModifyDate: 2020:11:12 13:18:36
Pages: 200
Words: 10
Software: Windows Installer XML Toolset (3.11.0.1528)
Security: Read-only recommended
No data.
screenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
47
Monitored processes
9
Malicious processes
4
Suspicious processes
1

Behavior graph

Click at the process to see the details
start drop and start drop and start msiexec.exe no specs msiexec.exe holcustopicalsoft.exe no specs holcustopicalsoft.exe holcustopicalsoftgua.exe cmd.exe no specs timeout.exe no specs cmd.exe no specs cmd.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
684C:\Windows\system32\cmd.exe /d /c timeout 5 & cmd /d /c del /f /q "C:\Users\admin\AppData\Roaming\HolcusTopicalSoft\HolcusTopicalSoft.exe" & cmd /d /c del /f /q "C:\Users\admin\AppData\Local\Temp\Setup.msi"C:\Windows\system32\cmd.exe—HolcusTopicalSoft.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\cmd.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\winbrand.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
1772timeout 5 C:\Windows\system32\timeout.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
timeout - pauses command processing
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\timeout.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\ws2_32.dll
2188C:\Program Files\HolcusTopicaljhoSoft\HolcusTopicalSoftgua.exeC:\Program Files\HolcusTopicaljhoSoft\HolcusTopicalSoftgua.exe
HolcusTopicalSoft.exe
User:
admin
Company:
Don HO don.h@free.fr
Integrity Level:
HIGH
Description:
Notepad++ : a free (GNU) source code editor
Exit code:
0
Version:
7.8.4.0
Modules
Images
c:\program files\holcustopicaljhosoft\holcustopicalsoftgua.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\usp10.dll
c:\windows\system32\shell32.dll
2340C:\Windows\system32\msiexec.exe /VC:\Windows\system32\msiexec.exe
services.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Windows® installer
Exit code:
0
Version:
5.0.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\msiexec.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
2364"C:\Users\admin\AppData\Roaming\HolcusTopicalSoft\HolcusTopicalSoft.exe" -uac C:\Users\admin\AppData\Local\Temp\Setup.msiC:\Users\admin\AppData\Roaming\HolcusTopicalSoft\HolcusTopicalSoft.exe
HolcusTopicalSoft.exe
User:
admin
Integrity Level:
HIGH
Description:
Holcus Topical Soft
Exit code:
100
Version:
2.6.9.68
Modules
Images
c:\users\admin\appdata\roaming\holcustopicalsoft\holcustopicalsoft.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\msimg32.dll
2588"C:\Windows\System32\msiexec.exe" /i "C:\Users\admin\AppData\Local\Temp\Setup.msi"C:\Windows\System32\msiexec.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows® installer
Exit code:
0
Version:
5.0.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\msiexec.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
2916"C:\Users\admin\AppData\Roaming\HolcusTopicalSoft\HolcusTopicalSoft.exe" "C:\Users\admin\AppData\Local\Temp\Setup.msi"C:\Users\admin\AppData\Roaming\HolcusTopicalSoft\HolcusTopicalSoft.exe—msiexec.exe
User:
admin
Integrity Level:
MEDIUM
Description:
Holcus Topical Soft
Exit code:
100
Version:
2.6.9.68
Modules
Images
c:\users\admin\appdata\roaming\holcustopicalsoft\holcustopicalsoft.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msimg32.dll
3644cmd /d /c del /f /q "C:\Users\admin\AppData\Roaming\HolcusTopicalSoft\HolcusTopicalSoft.exe" C:\Windows\system32\cmd.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\cmd.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\winbrand.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
4080cmd /d /c del /f /q "C:\Users\admin\AppData\Local\Temp\Setup.msi"C:\Windows\system32\cmd.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\cmd.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\winbrand.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
Total events
892
Read events
823
Write events
57
Delete events
12

Modification events

(PID) Process:(2588) msiexec.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\13B\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(2340) msiexec.exeKey:HKEY_USERS\S-1-5-21-1302019708-1500728564-335382590-1000_CLASSES\Local Settings\MuiCache\13B\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(2340) msiexec.exeKey:HKEY_USERS\S-1-5-21-1302019708-1500728564-335382590-1000\Software\Microsoft\RestartManager\Session0000
Operation:writeName:Owner
Value:
240900007A2F600C93BFD601
(PID) Process:(2340) msiexec.exeKey:HKEY_USERS\S-1-5-21-1302019708-1500728564-335382590-1000\Software\Microsoft\RestartManager\Session0000
Operation:writeName:SessionHash
Value:
BC33FACFED0FB40B9BBABEB48A1EFDF46524DCA2ABE7AEEB8903445A7ECD32DB
(PID) Process:(2340) msiexec.exeKey:HKEY_USERS\S-1-5-21-1302019708-1500728564-335382590-1000\Software\Microsoft\RestartManager\Session0000
Operation:writeName:Sequence
Value:
1
(PID) Process:(2340) msiexec.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\InProgress
Operation:writeName:(default)
Value:
C:\Windows\Installer\fcde7.ipi
(PID) Process:(2340) msiexec.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Folders
Operation:writeName:C:\Config.Msi\
Value:
(PID) Process:(2340) msiexec.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Rollback\Scripts
Operation:writeName:C:\Config.Msi\fcde8.rbs
Value:
30850963
(PID) Process:(2340) msiexec.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Rollback\Scripts
Operation:writeName:C:\Config.Msi\fcde8.rbsLow
Value:
216223952
(PID) Process:(2340) msiexec.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-21-1302019708-1500728564-335382590-1000\Components\17F8941455B53AB4A93333D81E0CEC66
Operation:writeName:17F8941455B53AB4A93333D81268BD27
Value:
01:\Software\WixSharp\Used\
Executable files
4
Suspicious files
4
Text files
2
Unknown types
2

Dropped files

PID
Process
Filename
Type
2340msiexec.exeC:\Users\admin\AppData\Local\Temp\~DF68946F08834616A6.TMP —
MD5:—
SHA256:—
2340msiexec.exeC:\Windows\Installer\fcde7.ipi —
MD5:—
SHA256:—
2340msiexec.exeC:\Windows\Installer\MSICF8B.tmp —
MD5:—
SHA256:—
2340msiexec.exeC:\Config.Msi\fcde8.rbs —
MD5:—
SHA256:—
2340msiexec.exeC:\Users\admin\AppData\Local\Temp\~DF210F8D78FE93126C.TMP —
MD5:—
SHA256:—
2916HolcusTopicalSoft.exeC:\Users\admin\AppData\Roaming\folder\Changelogejn —
MD5:—
SHA256:—
2916HolcusTopicalSoft.exeC:\ProgramData\folder\Changelogejn —
MD5:—
SHA256:—
2364HolcusTopicalSoft.exeC:\Users\admin\AppData\Local\Temp\CabDE51.tmp —
MD5:—
SHA256:—
2364HolcusTopicalSoft.exeC:\Users\admin\AppData\Local\Temp\TarDE52.tmp —
MD5:—
SHA256:—
2340msiexec.exeC:\Windows\Installer\fcde6.msiexecutable
MD5:—
SHA256:—
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
2
TCP/UDP connections
4
DNS requests
2
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
2364
HolcusTopicalSoft.exe
GET
200
93.184.220.29:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQS14tALDViBvqCf47YkiQRtKz1BAQUpc436uuwdQ6UZ4i0RfrZJBCHlh8CEAe4Vs70AIoEomBwtCJ530I%3D
US
der
279 b
whitelisted
2364
HolcusTopicalSoft.exe
GET
200
93.184.220.29:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEAo3h2ReX7SMIk79G%2B0UDDw%3D
US
der
1.47 Kb
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
2364
HolcusTopicalSoft.exe
172.67.69.229:443
myappcube.com
—
US
unknown
2364
HolcusTopicalSoft.exe
93.184.220.29:80
ocsp.digicert.com
MCI Communications Services, Inc. d/b/a Verizon Business
US
whitelisted

DNS requests

Domain
IP
Reputation
myappcube.com
  • 172.67.69.229
  • 104.26.1.137
  • 104.26.0.137
malicious
ocsp.digicert.com
  • 93.184.220.29
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
Setup.msi