File name:

setup.msi

Full analysis: https://app.any.run/tasks/f8c63056-af94-4e03-b0a3-1c941af8ed10
Verdict: Malicious activity
Analysis date: May 10, 2025, 06:01:04
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
generated-doc
Indicators:
MIME: application/x-msi
File info: Composite Document File V2 Document, Little Endian, Os: Windows, Version 10.0, MSI Installer, Security: 0, Code page: 1252, Revision Number: {C4AECC88-FF41-4120-9146-AA02B0EF7CD1}, Number of Words: 10, Subject: Koqlpo Cynav Tool, Author: Niviqol Raisox, Name of Creating Application: Koqlpo Cynav Tool, Template: x64;1033, Comments: This installer database contains the logic and data required to install Koqlpo Cynav Tool., Title: Installation Database, Keywords: Installer, MSI, Database, Create Time/Date: Thu May 8 20:06:16 2025, Last Saved Time/Date: Thu May 8 20:06:16 2025, Last Printed: Thu May 8 20:06:16 2025, Number of Pages: 450
MD5:

674652BA6A8E5BFF5F9566BB4A68B649

SHA1:

950ACCB24DE4BBC9B3F29FB462311DCB54E6E6B2

SHA256:

9B59AA79432EE430A8D11A809F5E1DE7234BBCCFD0AAD23F53C86ADD18184B41

SSDEEP:

393216:yJ6AhndyL/8/aDzj9U82/PVoATjN2h0objZMdmYxIg2hzd:udij9RcVoATjN2h0objZB2IfR

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    No malicious indicators.

  • SUSPICIOUS

    • Reads the Windows owner or organization settings

      • msiexec.exe (PID: 7836)

    • Reads security settings of Internet Explorer

      • msiexec.exe (PID: 7888)

    • Process drops python dynamic module

      • msiexec.exe (PID: 7836)

    • Process drops legitimate windows executable

      • msiexec.exe (PID: 7836)

    • The process drops C-runtime libraries

      • msiexec.exe (PID: 7836)

    • Drops 7-zip archiver for unpacking

      • msiexec.exe (PID: 7836)

    • There is functionality for taking screenshot (YARA)

      • taskcoach.exe (PID: 2384)

  • INFO

    • Checks supported languages

      • msiexec.exe (PID: 7836)
      • msiexec.exe (PID: 7888)
      • taskcoach.exe (PID: 2384)

    • An automatically generated document

      • msiexec.exe (PID: 7744)

    • Reads the computer name

      • msiexec.exe (PID: 7836)
      • msiexec.exe (PID: 7888)
      • taskcoach.exe (PID: 2384)

    • The sample compiled with english language support

      • msiexec.exe (PID: 7836)

    • Executable content was dropped or overwritten

      • msiexec.exe (PID: 7836)

    • Reads Environment values

      • msiexec.exe (PID: 7888)

    • Checks proxy server information

      • msiexec.exe (PID: 7888)
      • slui.exe (PID: 5204)
      • taskcoach.exe (PID: 2384)

    • Creates files or folders in the user directory

      • msiexec.exe (PID: 7888)
      • msiexec.exe (PID: 7836)
      • taskcoach.exe (PID: 2384)

    • Reads the software policy settings

      • msiexec.exe (PID: 7888)
      • slui.exe (PID: 5204)

    • Reads the machine GUID from the registry

      • msiexec.exe (PID: 7888)
      • taskcoach.exe (PID: 2384)

    • Creates a software uninstall entry

      • msiexec.exe (PID: 7836)

    • Create files in a temporary directory

      • taskcoach.exe (PID: 2384)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.msi | Microsoft Windows Installer (88.6)
.mst | Windows SDK Setup Transform Script (10)
.msi | Microsoft Installer (100)

EXIF

FlashPix

Security: None
CodePage: Windows Latin 1 (Western European)
RevisionNumber: {C4AECC88-FF41-4120-9146-AA02B0EF7CD1}
Words: 10
Subject: Koqlpo Cynav Tool
Author: Niviqol Raisox
LastModifiedBy: -
Software: Koqlpo Cynav Tool
Template: x64;1033
Comments: This installer database contains the logic and data required to install Koqlpo Cynav Tool.
Title: Installation Database
Keywords: Installer, MSI, Database
CreateDate: 2025:05:08 20:06:16
ModifyDate: 2025:05:08 20:06:16
LastPrinted: 2025:05:08 20:06:16
Pages: 450
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
134
Monitored processes
7
Malicious processes
1
Suspicious processes
0

Behavior graph

Click at the process to see the details
start msiexec.exe no specs msiexec.exe msiexec.exe tpm2emu.exe no specs taskcoach.exe conhost.exe no specs slui.exe

Process information

PID
CMD
Path
Indicators
Parent process
2320"C:\Users\admin\AppData\Roaming\Koqlpo Cynav Tool\tpm2emu.exe" 0C:\Users\admin\AppData\Roaming\Koqlpo Cynav Tool\tpm2emu.exe—msiexec.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
3221225781
Modules
Images
c:\users\admin\appdata\roaming\koqlpo cynav tool\tpm2emu.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
2384"C:\Users\admin\AppData\Roaming\Koqlpo Cynav Tool\taskcoach.exe"C:\Users\admin\AppData\Roaming\Koqlpo Cynav Tool\taskcoach.exe
msiexec.exe
User:
admin
Integrity Level:
MEDIUM
Description:
Your friendly task manager
Version:
1.4.6
Modules
Images
c:\users\admin\appdata\roaming\koqlpo cynav tool\taskcoach.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
4880\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—tpm2emu.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
5204C:\WINDOWS\System32\slui.exe -EmbeddingC:\Windows\System32\slui.exe
svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Activation Client
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
7744"C:\Windows\System32\msiexec.exe" /i C:\Users\admin\AppData\Local\Temp\setup.msiC:\Windows\System32\msiexec.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows® installer
Exit code:
0
Version:
5.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\msiexec.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\aclayers.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
7836C:\WINDOWS\system32\msiexec.exe /VC:\Windows\System32\msiexec.exe
services.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Windows® installer
Version:
5.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\msiexec.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\aclayers.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
7888C:\Windows\syswow64\MsiExec.exe -Embedding 6DB08EB4DC28A069EF48464237128095C:\Windows\SysWOW64\msiexec.exe
msiexec.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows® installer
Exit code:
0
Version:
5.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\msiexec.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\aclayers.dll
Total events
3 741
Read events
3 415
Write events
317
Delete events
9

Modification events

(PID) Process:(7836) msiexec.exeKey:HKEY_USERS\S-1-5-21-1693682860-607145093-2874071422-1001\SOFTWARE\Microsoft\RestartManager\Session0000
Operation:writeName:Owner
Value:
9C1E0000EFFF5EF870C1DB01
(PID) Process:(7836) msiexec.exeKey:HKEY_USERS\S-1-5-21-1693682860-607145093-2874071422-1001\SOFTWARE\Microsoft\RestartManager\Session0000
Operation:writeName:SessionHash
Value:
4AFB17A4CFBF6B1BD17CF677E340DF1FBE4D0392536D990A1CB51B7855EFD8F9
(PID) Process:(7836) msiexec.exeKey:HKEY_USERS\S-1-5-21-1693682860-607145093-2874071422-1001\SOFTWARE\Microsoft\RestartManager\Session0000
Operation:writeName:Sequence
Value:
1
(PID) Process:(7888) msiexec.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content
Operation:writeName:CachePrefix
Value:
(PID) Process:(7888) msiexec.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(7888) msiexec.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
(PID) Process:(7836) msiexec.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Folders
Operation:writeName:C:\Config.Msi\
Value:
(PID) Process:(7836) msiexec.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Rollback\Scripts
Operation:writeName:C:\Config.Msi\10cdd3.rbs
Value:
31179120
(PID) Process:(7836) msiexec.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Rollback\Scripts
Operation:writeName:C:\Config.Msi\10cdd3.rbsLow
Value:
(PID) Process:(7836) msiexec.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-21-1693682860-607145093-2874071422-1001\Components\42F0865697CD28440AD3B5A00E8D7F5B
Operation:writeName:B0C3D3F08660A474AAF46D317F1A5A5F
Value:
C:\Users\admin\AppData\Roaming\Koqlpo Cynav Tool\w9xpopen.exe
Executable files
117
Suspicious files
297
Text files
71
Unknown types
2

Dropped files

PID
Process
Filename
Type
7836msiexec.exeC:\Windows\Installer\10cdd1.msi —
MD5:—
SHA256:—
7836msiexec.exeC:\Windows\Installer\MSID024.tmpexecutable
MD5:379F76E2FA6EEF4C2116C2A3AE6896BE
SHA256:C54F8A0CC280A9A0C934B8B23BBD530BA739E79AD686121CC8B659882CEB60FD
7836msiexec.exeC:\Windows\Installer\MSICF19.tmpexecutable
MD5:379F76E2FA6EEF4C2116C2A3AE6896BE
SHA256:C54F8A0CC280A9A0C934B8B23BBD530BA739E79AD686121CC8B659882CEB60FD
7836msiexec.exeC:\Windows\Installer\MSID1DC.tmpexecutable
MD5:379F76E2FA6EEF4C2116C2A3AE6896BE
SHA256:C54F8A0CC280A9A0C934B8B23BBD530BA739E79AD686121CC8B659882CEB60FD
7836msiexec.exeC:\Windows\Installer\MSID092.tmpexecutable
MD5:379F76E2FA6EEF4C2116C2A3AE6896BE
SHA256:C54F8A0CC280A9A0C934B8B23BBD530BA739E79AD686121CC8B659882CEB60FD
7836msiexec.exeC:\Windows\Installer\MSIDB44.tmpexecutable
MD5:481FBA768D3692CB566F14697E436689
SHA256:802730190E1CD8B0EF380992C3C6664C142CAEFFADE56A7E2157F9EDE596A77B
7836msiexec.exeC:\Windows\Installer\MSID0E1.tmpexecutable
MD5:379F76E2FA6EEF4C2116C2A3AE6896BE
SHA256:C54F8A0CC280A9A0C934B8B23BBD530BA739E79AD686121CC8B659882CEB60FD
7836msiexec.exeC:\Windows\Installer\MSIE586.tmpexecutable
MD5:379F76E2FA6EEF4C2116C2A3AE6896BE
SHA256:C54F8A0CC280A9A0C934B8B23BBD530BA739E79AD686121CC8B659882CEB60FD
7888msiexec.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\103621DE9CD5414CC2538780B4B75751binary
MD5:E192462F281446B5D1500D474FBACC4B
SHA256:F1BA9F1B63C447682EBF9DE956D0DA2A027B1B779ABEF9522D347D3479139A60
7888msiexec.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\103621DE9CD5414CC2538780B4B75751binary
MD5:BBBD2D5A765C72BE92B195A8F64057F2
SHA256:5106D349408F42AE35029C4078A0AB4EFF6D660CBAEBDD6B807C35E09718DF57
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
9
TCP/UDP connections
27
DNS requests
21
Threats
2

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
—
—
GET
200
2.23.246.101:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
—
—
GET
200
23.48.23.156:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
7888
msiexec.exe
GET
200
23.209.209.135:80
http://x1.c.lencr.org/
unknown
—
—
whitelisted
7888
msiexec.exe
GET
200
65.9.66.41:80
http://r11.c.lencr.org/26.crl
unknown
—
—
whitelisted
6544
svchost.exe
GET
200
2.17.190.73:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
2384
taskcoach.exe
GET
301
51.158.149.82:80
http://taskcoach.org/version.txt
unknown
—
—
—
2384
taskcoach.exe
GET
301
51.158.149.82:80
http://taskcoach.org/messages.txt
unknown
—
—
—
7356
SIHClient.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
7356
SIHClient.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
—
—
51.124.78.146:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
—
—
23.48.23.156:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
—
—
2.23.246.101:80
www.microsoft.com
Ooredoo Q.S.C.
QA
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
3216
svchost.exe
172.211.123.250:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
FR
whitelisted
7888
msiexec.exe
169.150.247.37:443
cbsnaturalway.com
—
GB
unknown
7888
msiexec.exe
23.209.209.135:80
x1.c.lencr.org
PT. Telekomunikasi Selular
ID
whitelisted
7888
msiexec.exe
65.9.66.41:80
r11.c.lencr.org
AMAZON-02
US
whitelisted
6544
svchost.exe
20.190.160.132:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted

DNS requests

Domain
IP
Reputation
crl.microsoft.com
  • 23.48.23.156
  • 23.48.23.143
whitelisted
www.microsoft.com
  • 2.23.246.101
  • 184.30.21.171
whitelisted
google.com
  • 142.250.184.238
whitelisted
client.wns.windows.com
  • 172.211.123.250
whitelisted
cbsnaturalway.com
  • 169.150.247.37
unknown
x1.c.lencr.org
  • 23.209.209.135
whitelisted
r11.c.lencr.org
  • 65.9.66.41
  • 65.9.66.40
  • 65.9.66.2
  • 65.9.66.96
whitelisted
login.live.com
  • 20.190.160.132
  • 20.190.160.5
  • 20.190.160.4
  • 40.126.32.136
  • 40.126.32.133
  • 40.126.32.134
  • 20.190.160.64
  • 40.126.32.68
whitelisted
ocsp.digicert.com
  • 2.17.190.73
whitelisted
settings-win.data.microsoft.com
  • 40.127.240.158
whitelisted

Threats

PID
Process
Class
Message
—
—
Attempted Information Leak
ET INFO Python-urllib/ Suspicious User Agent
—
—
Attempted Information Leak
ET INFO Python-urllib/ Suspicious User Agent
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
setup.msi