File name: | a065.msi |
Full analysis: | https://app.any.run/tasks/517015a0-235d-46ef-9374-3a68ba816218 |
Verdict: | Malicious activity |
Analysis date: | March 22, 2019, 08:17:21 |
OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
Tags: | |
Indicators: | |
MIME: | application/x-msi |
File info: | Composite Document File V2 Document, Little Endian, Os: Windows, Version 6.2, MSI Installer, Number of Characters: 0, Last Saved By: InstallShield, Number of Words: 0, Title: LiteManager - Server 4.7 installation package, Comments: This installer contains the logic and data to install LiteManager Pro - Server 4.7, Keywords: Installer,MSI,Database, Subject: LiteManager Pro - Server, Author: LiteManagerTeam, Security: 1, Number of Pages: 200, Name of Creating Application: InstallShield 2015 - Premier Edition with Virtualization Pack 22, Last Saved Time/Date: Fri May 20 11:28:10 2016, Create Time/Date: Fri May 20 11:28:10 2016, Last Printed: Fri May 20 11:28:10 2016, Revision Number: {35028391-353C-4E4D-BFA5-D1848C001F10}, Code page: 0, Template: Intel;0,1033,1049 |
MD5: | E97CECBD1B11EC4F49C54669B609393B |
SHA1: | 6A0C7CAEE2AD39BC5EDD4B80F2524D9716229EF0 |
SHA256: | A1A54C198AC8A470ECC940BC6608C73DB5E71139F82EC3C36A190673E1D86CCD |
SSDEEP: | 196608:0J50VEu1BJ1V6Mp5m4XvmrQOJjckh0UodJ8k1lTB56KCWn7T:KKJtjirQkjckh0LKSltiw7 |
.msi | | | Microsoft Windows Installer (84.2) |
---|---|---|
.mst | | | Windows SDK Setup Transform Script (9.5) |
.flo | | | iGrafx FlowCharter document (5) |
.msi | | | Microsoft Installer (100) |
Characters: | - |
---|---|
LastModifiedBy: | InstallShield |
Words: | - |
Title: | LiteManager - Server 4.7 installation package |
Comments: | This installer contains the logic and data to install LiteManager Pro - Server 4.7 |
Keywords: | Installer,MSI,Database |
Subject: | LiteManager Pro - Server |
Author: | LiteManagerTeam |
Security: | Password protected |
Pages: | 200 |
Software: | InstallShield? 2015 - Premier Edition with Virtualization Pack 22 |
ModifyDate: | 2016:05:20 10:28:10 |
CreateDate: | 2016:05:20 10:28:10 |
LastPrinted: | 2016:05:20 10:28:10 |
RevisionNumber: | {35028391-353C-4E4D-BFA5-D1848C001F10} |
CodePage: | Unknown (0) |
Template: | Intel;0,1033,1049 |
PID | CMD | Path | Indicators | Parent process |
---|---|---|---|---|
3268 | "C:\Windows\System32\msiexec.exe" /i "C:\Users\admin\AppData\Local\Temp\a065.msi" | C:\Windows\System32\msiexec.exe | — | explorer.exe |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows® installer Exit code: 0 Version: 5.0.7600.16385 (win7_rtm.090713-1255) | ||||
2680 | C:\Windows\system32\msiexec.exe /V | C:\Windows\system32\msiexec.exe | services.exe | |
User: SYSTEM Company: Microsoft Corporation Integrity Level: SYSTEM Description: Windows® installer Version: 5.0.7600.16385 (win7_rtm.090713-1255) | ||||
3960 | C:\Windows\system32\vssvc.exe | C:\Windows\system32\vssvc.exe | — | services.exe |
User: SYSTEM Company: Microsoft Corporation Integrity Level: SYSTEM Description: Microsoft® Volume Shadow Copy Service Version: 6.1.7600.16385 (win7_rtm.090713-1255) | ||||
2916 | DrvInst.exe "1" "200" "STORAGE\VolumeSnapshot\HarddiskVolumeSnapshot18" "" "" "6792c44eb" "00000000" "00000398" "00000574" | C:\Windows\system32\DrvInst.exe | — | svchost.exe |
User: SYSTEM Company: Microsoft Corporation Integrity Level: SYSTEM Description: Driver Installation Module Exit code: 0 Version: 6.1.7600.16385 (win7_rtm.090713-1255) | ||||
3748 | "C:\Program Files\LiteManager Pro - Server\ROMFUSClient.exe" /server /msiinstall /silentinstall /SETSECURITY | C:\Program Files\LiteManager Pro - Server\ROMFUSClient.exe | — | msiexec.exe |
User: admin Integrity Level: MEDIUM Exit code: 0 Version: 4.7.2.0 | ||||
3832 | "C:\Program Files\LiteManager Pro - Server\ROMServer.exe" /msiinstall /silentinstall /SETSECURITY | C:\Program Files\LiteManager Pro - Server\ROMServer.exe | — | ROMFUSClient.exe |
User: admin Integrity Level: MEDIUM Exit code: 3221226540 Version: 4.7.2.0 | ||||
3276 | "C:\Program Files\LiteManager Pro - Server\ROMServer.exe" /msiinstall /silentinstall /SETSECURITY | C:\Program Files\LiteManager Pro - Server\ROMServer.exe | ROMFUSClient.exe | |
User: admin Integrity Level: HIGH Exit code: 0 Version: 4.7.2.0 | ||||
2588 | "C:\Program Files\LiteManager Pro - Server\ROMFUSClient.exe" /server /start | C:\Program Files\LiteManager Pro - Server\ROMFUSClient.exe | — | msiexec.exe |
User: admin Integrity Level: MEDIUM Exit code: 0 Version: 4.7.2.0 | ||||
3292 | "C:\Program Files\LiteManager Pro - Server\ROMServer.exe" /start | C:\Program Files\LiteManager Pro - Server\ROMServer.exe | — | ROMFUSClient.exe |
User: admin Integrity Level: MEDIUM Exit code: 3221226540 Version: 4.7.2.0 | ||||
3016 | "C:\Program Files\LiteManager Pro - Server\ROMServer.exe" /start | C:\Program Files\LiteManager Pro - Server\ROMServer.exe | ROMFUSClient.exe | |
User: admin Integrity Level: HIGH Exit code: 0 Version: 4.7.2.0 |
PID | Process | Filename | Type | |
---|---|---|---|---|
2680 | msiexec.exe | C:\System Volume Information\SPP\metadata-2 | — | |
MD5:— | SHA256:— | |||
2916 | DrvInst.exe | C:\Windows\INF\setupapi.ev3 | binary | |
MD5:76DCC60F78B3DFF1AE3627619074F465 | SHA256:18541AC1875315C4F9EFF75050C574FAFF83717C029DAE6B366F9C6C3F0C19E0 | |||
2916 | DrvInst.exe | C:\Windows\INF\setupapi.dev.log | ini | |
MD5:CD8DA3A7CFF08302A16579727B774CCB | SHA256:98F10F5C74ADD50072835A6EA98148F86E4B454850A3C4F10B527A54751F2428 | |||
2916 | DrvInst.exe | C:\Windows\INF\setupapi.ev1 | binary | |
MD5:E00F4765D53F50AE7A1377CB2C616C2B | SHA256:5C3775FDC76F3FBEF9FC89BF82FDC9F8E27D1825C95012D40CE7C5A9A617C40E | |||
2680 | msiexec.exe | C:\System Volume Information\SPP\OnlineMetadataCache\{038f43a5-4f9d-423d-a6a8-89c82307f652}_OnDiskSnapshotProp | binary | |
MD5:0A1D347FB3FB1C5F41D1FDD926C0F315 | SHA256:6B0F39984F3A6F738C0B3D8C0C67B53F4484BADA26EB0D4E01E2C3A85BC74747 | |||
2680 | msiexec.exe | C:\System Volume Information\SPP\snapshot-2 | binary | |
MD5:0A1D347FB3FB1C5F41D1FDD926C0F315 | SHA256:6B0F39984F3A6F738C0B3D8C0C67B53F4484BADA26EB0D4E01E2C3A85BC74747 | |||
2680 | msiexec.exe | C:\Windows\Installer\108be6.msi | — | |
MD5:— | SHA256:— | |||
2680 | msiexec.exe | C:\Users\admin\AppData\Local\Temp\~DF442841736B6F52F2.TMP | — | |
MD5:— | SHA256:— | |||
2680 | msiexec.exe | C:\Program Files\LiteManager Pro - Server\ROMServer.map | — | |
MD5:— | SHA256:— | |||
3960 | vssvc.exe | C: | — | |
MD5:— | SHA256:— |