File name:

AESCrypt.msi

Full analysis: https://app.any.run/tasks/d34f845c-ba6b-425a-8b6c-6b48fdf59ca0
Verdict: Malicious activity
Analysis date: August 01, 2024, 23:08:49
OS: Windows 10 Professional (build: 19045, 64 bit)
Indicators:
MIME: application/x-msi
File info: Composite Document File V2 Document, Little Endian, Os: Windows, Version 6.1, MSI Installer, Create Time/Date: Mon Jun 21 07:00:00 1999, Name of Creating Application: Windows Installer, Security: 1, Code page: 1252, Template: x64;1033, Number of Pages: 200, Revision Number: {F56C64FE-F9BD-4368-952E-F5601C31FC95}, Title: AES Crypt, Author: Packetizer, Inc., Comments: AES Crypt - Advanced File Encryption for Windows, Number of Words: 2, Last Saved Time/Date: Fri Apr 17 21:30:39 2015, Last Printed: Fri Apr 17 21:30:39 2015
MD5:

E738DA4DDDE4EC6A45F0E5E64ACC99AA

SHA1:

BD7D7AAB63690429EDA5D715D7199FA1EA658FEA

SHA256:

AA96E7FACF48235B091B01453AE6290860B1FF28889026E72936172875EFE70C

SSDEEP:

24576:wzmzCXj/uGPBc6ba10EW5SfNP7FVHWw6YJXnqCGoHCX2Fag:wzmzCDuUBo0EWgFjFVH7fFag

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Drops the executable file immediately after the start

      • msiexec.exe (PID: 6532)
      • msiexec.exe (PID: 6808)

  • SUSPICIOUS

    • Process drops legitimate windows executable

      • msiexec.exe (PID: 6532)
      • msiexec.exe (PID: 6808)

    • Executes as Windows Service

      • VSSVC.exe (PID: 7084)

    • The process drops C-runtime libraries

      • msiexec.exe (PID: 6808)

  • INFO

    • Checks supported languages

      • msiexec.exe (PID: 6916)
      • msiexec.exe (PID: 6808)

    • Reads the computer name

      • msiexec.exe (PID: 6808)
      • msiexec.exe (PID: 6916)

    • Executable content was dropped or overwritten

      • msiexec.exe (PID: 6532)
      • msiexec.exe (PID: 6808)

    • Create files in a temporary directory

      • msiexec.exe (PID: 6916)

    • Application launched itself

      • msiexec.exe (PID: 6808)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.msi | Microsoft Windows Installer (98.5)
.msi | Microsoft Installer (100)

EXIF

FlashPix

CreateDate: 1999:06:21 07:00:00
Software: Windows Installer
Security: Password protected
CodePage: Windows Latin 1 (Western European)
Template: x64;1033
Pages: 200
RevisionNumber: {F56C64FE-F9BD-4368-952E-F5601C31FC95}
Title: AES Crypt
Subject: -
Author: Packetizer, Inc.
Keywords: -
Comments: AES Crypt - Advanced File Encryption for Windows
Words: 2
ModifyDate: 2015:04:17 21:30:39
LastPrinted: 2015:04:17 21:30:39
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
139
Monitored processes
8
Malicious processes
1
Suspicious processes
1

Behavior graph

Click at the process to see the details
start msiexec.exe msiexec.exe msiexec.exe no specs vssvc.exe no specs srtasks.exe no specs conhost.exe no specs msiexec.exe no specs msiexec.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
2128"C:\Windows\System32\MsiExec.exe" /Y "C:\Program Files\AESCrypt\AESCrypt.dll"C:\Windows\System32\msiexec.exe—msiexec.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows® installer
Exit code:
0
Version:
5.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\msiexec.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\aclayers.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
4060C:\WINDOWS\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:11C:\Windows\System32\SrTasks.exe—msiexec.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Microsoft® Windows System Protection background tasks.
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\srtasks.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
5064C:\Windows\syswow64\MsiExec.exe -Embedding DD3F1B1B6E5C9BF7F9A1948DAC4E0591C:\Windows\SysWOW64\msiexec.exe—msiexec.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows® installer
Exit code:
0
Version:
5.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\msiexec.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\aclayers.dll
5924\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—SrTasks.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Console Window Host
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
6532"C:\Windows\System32\msiexec.exe" /i C:\Users\admin\AppData\Local\Temp\AESCrypt.msiC:\Windows\System32\msiexec.exe
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows® installer
Exit code:
0
Version:
5.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\msiexec.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\aclayers.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
6808C:\WINDOWS\system32\msiexec.exe /VC:\Windows\System32\msiexec.exe
services.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Windows® installer
Version:
5.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\msiexec.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\aclayers.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
6916C:\Windows\syswow64\MsiExec.exe -Embedding 4AA53E848121011215923A39C5DBEE42 CC:\Windows\SysWOW64\msiexec.exe—msiexec.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows® installer
Exit code:
0
Version:
5.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\msiexec.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\aclayers.dll
7084C:\WINDOWS\system32\vssvc.exeC:\Windows\System32\VSSVC.exe—services.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Microsoft® Volume Shadow Copy Service
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\vssvc.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
Total events
5 037
Read events
4 734
Write events
284
Delete events
19

Modification events

(PID) Process:(6808) msiexec.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\SystemRestore
Operation:writeName:SrCreateRp (Enter)
Value:
4800000000000000C1E5F5CF67E4DA01981A00009C080000D50700000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(6808) msiexec.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\SPP
Operation:writeName:SppGetSnapshots (Enter)
Value:
4800000000000000C1E5F5CF67E4DA01981A00009C080000D20700000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(6808) msiexec.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\SPP
Operation:writeName:SppGetSnapshots (Leave)
Value:
480000000000000059F93AD067E4DA01981A00009C080000D20700000100000000000000000000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(6808) msiexec.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\SPP
Operation:writeName:SppEnumGroups (Enter)
Value:
480000000000000059F93AD067E4DA01981A00009C080000D10700000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(6808) msiexec.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\SPP
Operation:writeName:SppEnumGroups (Leave)
Value:
4800000000000000AD5C3DD067E4DA01981A00009C080000D10700000100000000000000010000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(6808) msiexec.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\SPP
Operation:writeName:SppCreate (Enter)
Value:
4800000000000000FE2442D067E4DA01981A00009C080000D00700000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(6808) msiexec.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SPP
Operation:writeName:LastIndex
Value:
11
(PID) Process:(6808) msiexec.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\SPP
Operation:writeName:SppGatherWriterMetadata (Enter)
Value:
480000000000000035B5BBD067E4DA01981A00009C080000D30700000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(6808) msiexec.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\VssapiPublisher
Operation:writeName:IDENTIFY (Enter)
Value:
48000000000000001D18BED067E4DA01981A0000DC100000E8030000010000000000000000000000257B58C28E99B74291121945F8CBA45400000000000000000000000000000000
(PID) Process:(7084) VSSVC.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\Registry Writer
Operation:writeName:IDENTIFY (Enter)
Value:
4800000000000000B66CCCD067E4DA01AC1B0000E0130000E80300000100000001000000000000000000000000000000000000000000000000000000000000000000000000000000
Executable files
12
Suspicious files
20
Text files
2
Unknown types
0

Dropped files

PID
Process
Filename
Type
6808msiexec.exeC:\System Volume Information\SPP\metadata-2 —
MD5:—
SHA256:—
6808msiexec.exeC:\Windows\Temp\~DFA1876EE0130DBA57.TMPbinary
MD5:D1B5FCBFB9E99B690D3341B31BCA21C3
SHA256:C16AB4DA45D4C1D3AC08C3B593C2964D035F4F76F67EB0DD53CA33072D426580
6808msiexec.exeC:\System Volume Information\SPP\OnlineMetadataCache\{c2587b25-998e-42b7-9112-1945f8cba454}_OnDiskSnapshotPropbinary
MD5:35636EB886C921E6ABF71A0A8CFE3608
SHA256:C39EA247F831B3C419D0D95795BBAFAF584AB8A23283F4A630D2066E7625E631
6808msiexec.exeC:\Windows\Installer\ebea8.msiexecutable
MD5:E738DA4DDDE4EC6A45F0E5E64ACC99AA
SHA256:AA96E7FACF48235B091B01453AE6290860B1FF28889026E72936172875EFE70C
6808msiexec.exeC:\Windows\Installer\MSIC149.tmpexecutable
MD5:5494165B1384FAEEFDD3D5133DF92F5A
SHA256:BA0AD3A4D2112B269E379A2231128E7EBE23E95D5D04878D6EE8815E657BB055
6916msiexec.exeC:\Users\admin\AppData\Local\Temp\CFG55AD.tmpxml
MD5:C517737DD6B59D0BD576A0A484C12E8B
SHA256:0774A3FD610BE54DAF2801AC6763F7FDE87073D95435900874C9A61B14F88F50
6532msiexec.exeC:\Users\admin\AppData\Local\Temp\MSI54E2.tmpexecutable
MD5:5494165B1384FAEEFDD3D5133DF92F5A
SHA256:BA0AD3A4D2112B269E379A2231128E7EBE23E95D5D04878D6EE8815E657BB055
6808msiexec.exeC:\Windows\Installer\MSIC0EA.tmpexecutable
MD5:5494165B1384FAEEFDD3D5133DF92F5A
SHA256:BA0AD3A4D2112B269E379A2231128E7EBE23E95D5D04878D6EE8815E657BB055
5064msiexec.exeC:\Users\admin\AppData\Local\Temp\CFGC138.tmpxml
MD5:C517737DD6B59D0BD576A0A484C12E8B
SHA256:0774A3FD610BE54DAF2801AC6763F7FDE87073D95435900874C9A61B14F88F50
6808msiexec.exeC:\Program Files\AESCrypt\AESCrypt.dllexecutable
MD5:FF91C1C5852C1B87A75D92070793DBF9
SHA256:71020AA19597AC2D7ADA376B244D71BDA8E747C640735390804D1E163297AB07
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
4
TCP/UDP connections
33
DNS requests
15
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
—
—
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
—
—
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAI5PUjXAkJafLQcAAsO18o%3D
unknown
—
—
whitelisted
—
—
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0%3D
unknown
—
—
whitelisted
—
—
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0%3D
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4084
svchost.exe
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
5240
RUXIMICS.exe
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
—
—
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
—
—
239.255.255.250:1900
—
—
—
whitelisted
3260
svchost.exe
40.113.110.67:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
4436
svchost.exe
40.126.32.136:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
unknown
5336
SearchApp.exe
104.126.37.153:443
www.bing.com
Akamai International B.V.
DE
unknown
4436
svchost.exe
192.229.221.95:80
ocsp.digicert.com
EDGECAST
US
whitelisted
5336
SearchApp.exe
192.229.221.95:80
ocsp.digicert.com
EDGECAST
US
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 4.231.128.59
whitelisted
google.com
  • 216.58.212.142
whitelisted
client.wns.windows.com
  • 40.113.110.67
whitelisted
login.live.com
  • 40.126.32.136
  • 40.126.32.140
  • 40.126.32.74
  • 40.126.32.138
  • 40.126.32.76
  • 40.126.32.68
  • 20.190.160.20
  • 20.190.160.22
whitelisted
www.bing.com
  • 104.126.37.153
  • 104.126.37.155
  • 104.126.37.170
  • 104.126.37.146
  • 104.126.37.147
  • 104.126.37.161
  • 104.126.37.177
  • 104.126.37.171
  • 104.126.37.160
whitelisted
ocsp.digicert.com
  • 192.229.221.95
whitelisted
th.bing.com
  • 2.23.209.149
  • 2.23.209.133
  • 2.23.209.182
  • 2.23.209.187
  • 2.23.209.130
whitelisted
fd.api.iris.microsoft.com
  • 20.74.47.205
whitelisted
arc.msn.com
  • 20.31.169.57
whitelisted
go.microsoft.com
  • 184.28.89.167
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
AESCrypt.msi