Malware analysis 3CXPhone6.msi Malicious activity | ANY.RUN

Add for printing

File name:	3CXPhone6.msi
Full analysis:	https://app.any.run/tasks/4fd8126b-559d-4c51-be5c-49be1af396b4
Verdict:	Malicious activity
Analysis date:	April 10, 2019, 13:43:31
OS:	Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:	generated-doc
Indicators:
MIME:	application/x-msi
File info:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 6.0, MSI Installer, Title: Installation Database, Keywords: Installer, MSI, Database, Last Printed: Fri Dec 11 11:47:44 2009, Create Time/Date: Fri Dec 11 11:47:44 2009, Last Saved Time/Date: Fri Dec 11 11:47:44 2009, Number of Pages: 200, Security: 0, Code page: 1252, Revision Number: {D205D479-89C2-4B2C-BA1E-426411082CBF}, Number of Words: 2, Subject: 3CXPhone, Author: 3CX, Name of Creating Application: Advanced Installer 9.2 build 44805, Template: ;1033, Comments: This installer database contains the logic and data required to install 3CXPhone.
MD5:	CEEC4DBD300086C8F052BDC51D287CA5
SHA1:	5F36BC56D6D4484D4557092F4BEFE8F280EE0C1B
SHA256:	ABC2869C39480F0040D872679B961BCD565DB1D8FD1F79DE99FEFC78A88D10CF
SSDEEP:	393216:cC2sv/LoSsfbZv+6wuZebE8osHeht3QCBe2iLftp:cC2kolv+6w4gMs0SCwLff

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

Launch configuration

Task duration:: 60 seconds
Heavy Evasion option:: off
Network geolocation:: off
Additional time used:: none
MITM proxy:: off
Privacy:: Public submission
Fakenet option:: off
Route via Tor:: off
Autoconfirmation of UAC:: on
Network:: on

Software preset

Internet Explorer 8.0.7601.17514 undefined
Adobe Acrobat Reader DC MUI (15.023.20070)
Adobe Flash Player 26 ActiveX (26.0.0.131)
Adobe Flash Player 26 NPAPI (26.0.0.131)
Adobe Flash Player 26 PPAPI (26.0.0.131)
Adobe Refresh Manager (1.8.0)
CCleaner (5.35)
FileZilla Client 3.36.0 (3.36.0)
Google Chrome (73.0.3683.75)
Google Update Helper (1.3.33.23)
Java 8 Update 92 (8.0.920.14)
Java Auto Updater (2.8.92.14)
Microsoft .NET Framework 4.6.1 (4.6.01055)
Microsoft Office Access MUI (English) 2010 (14.0.6029.1000)
Microsoft Office Access Setup Metadata MUI (English) 2010 (14.0.6029.1000)
Microsoft Office Excel MUI (English) 2010 (14.0.6029.1000)
Microsoft Office OneNote MUI (English) 2010 (14.0.6029.1000)
Microsoft Office Outlook MUI (English) 2010 (14.0.6029.1000)
Microsoft Office PowerPoint MUI (English) 2010 (14.0.6029.1000)
Microsoft Office Professional 2010 (14.0.6029.1000)
Microsoft Office Proof (English) 2010 (14.0.6029.1000)
Microsoft Office Proof (French) 2010 (14.0.6029.1000)
Microsoft Office Proof (Spanish) 2010 (14.0.6029.1000)
Microsoft Office Proofing (English) 2010 (14.0.6029.1000)
Microsoft Office Publisher MUI (English) 2010 (14.0.6029.1000)
Microsoft Office Shared MUI (English) 2010 (14.0.6029.1000)
Microsoft Office Shared Setup Metadata MUI (English) 2010 (14.0.6029.1000)
Microsoft Office Single Image 2010 (14.0.6029.1000)
Microsoft Office Word MUI (English) 2010 (14.0.6029.1000)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (9.0.30729.6161)
Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 (10.0.40219)
Microsoft Visual C++ 2013 Redistributable (x86) - 12.0.30501 (12.0.30501.0)
Microsoft Visual C++ 2013 x86 Additional Runtime - 12.0.21005 (12.0.21005)
Microsoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005 (12.0.21005)
Microsoft Visual C++ 2017 Redistributable (x86) - 14.15.26706 (14.15.26706.0)
Microsoft Visual C++ 2017 x86 Additional Runtime - 14.15.26706 (14.15.26706)
Microsoft Visual C++ 2017 x86 Minimum Runtime - 14.15.26706 (14.15.26706)
Mozilla Firefox 65.0.2 (x86 en-US) (65.0.2)
Notepad++ (32-bit x86) (7.5.1)
Opera 12.15 (12.15.1748)
Skype version 8.29 (8.29)
VLC media player (2.2.6)
WinRAR 5.60 (32-bit) (5.60.0)

Hotfixes

Client LanguagePack Package
Client Refresh LanguagePack Package
CodecPack Basic Package
Foundation Package
IE Troubleshooters Package
InternetExplorer Optional Package
KB2534111
KB2999226
KB976902
LocalPack AU Package
LocalPack CA Package
LocalPack GB Package
LocalPack US Package
LocalPack ZA Package
ProfessionalEdition
UltimateEdition

Add for printing

MALICIOUS
- Application was dropped or rewritten from another process
  - 3CXPhone.exe (PID: 2156)
  - 3CXPhoneLookup.exe (PID: 3948)
  - 3CXPhoneLookup.exe (PID: 344)
- Loads dropped or rewritten executable
  - 3CXPhone.exe (PID: 2156)
SUSPICIOUS
- Creates COM task schedule object
  - msiexec.exe (PID: 2168)
- Executable content was dropped or overwritten
  - msiexec.exe (PID: 2168)
  - 3CXPhoneLookup.exe (PID: 3948)
- Starts itself from another location
  - 3CXPhoneLookup.exe (PID: 3948)
INFO
- Adds / modifies Windows certificates
  - DrvInst.exe (PID: 1012)
- Application launched itself
  - msiexec.exe (PID: 2168)
- Searches for installed software
  - msiexec.exe (PID: 2168)
- Low-level read access rights to disk partition
  - vssvc.exe (PID: 3544)
- Changes settings of System certificates
  - DrvInst.exe (PID: 1012)
- Creates files in the program directory
  - msiexec.exe (PID: 2168)
- Creates a software uninstall entry
  - msiexec.exe (PID: 2168)

Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report

Add for printing

No Malware configuration.

Add for printing

TRiD

.msi	\|	Microsoft Windows Installer (88.6)
.mst	\|	Windows SDK Setup Transform Script (10)
.msi	\|	Microsoft Installer (100)

EXIF

FlashPix

Title:	Installation Database
Keywords:	Installer, MSI, Database
LastPrinted:	2009:12:11 11:47:44
CreateDate:	2009:12:11 11:47:44
ModifyDate:	2009:12:11 11:47:44
Pages:	200
Security:	None
CodePage:	Windows Latin 1 (Western European)
RevisionNumber:	{D205D479-89C2-4B2C-BA1E-426411082CBF}
Words:	2
Subject:	3CXPhone
Author:	3CX
LastModifiedBy:	-
Software:	Advanced Installer 9.2 build 44805
Template:	;1033
Comments:	This installer database contains the logic and data required to install 3CXPhone.

No data.

Add for printing

All screenshots are available in the full report

Add for printing

Total processes

Monitored processes

Malicious processes

Suspicious processes

Behavior graph

Click at the process to see the details

Process information

PID

CMD

Path

Indicators

Parent process

344

"C:\Users\admin\AppData\Local\3CX VoIP Phone\Updater\3CXPhoneLookup.exe" C:\Program Files\3CXPhone

C:\Users\admin\AppData\Local\3CX VoIP Phone\Updater\3CXPhoneLookup.exe

—

3CXPhoneLookup.exe

User:

admin

Company:

3CX Ltd

Integrity Level:

MEDIUM

Description:

3CXPhone lookup

Exit code:

Version:

1.0.0.0

Modules

Images
c:\users\admin\appdata\local\3cx voip phone\updater\3cxphonelookup.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\comdlg32.dll

580

C:\Windows\system32\MsiExec.exe -Embedding 5E56E138F50E8115F3AD180E5027BB91 C

C:\Windows\system32\MsiExec.exe

—

msiexec.exe

User:

admin

Company:

Microsoft Corporation

Integrity Level:

MEDIUM

Description:

Windows® installer

Exit code:

Version:

5.0.7600.16385 (win7_rtm.090713-1255)

Modules

Images
c:\windows\system32\msiexec.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll

1012

DrvInst.exe "1" "200" "STORAGE\VolumeSnapshot\HarddiskVolumeSnapshot18" "" "" "6792c44eb" "00000000" "00000580" "00000388"

C:\Windows\system32\DrvInst.exe

—

svchost.exe

User:

SYSTEM

Company:

Microsoft Corporation

Integrity Level:

SYSTEM

Description:

Driver Installation Module

Exit code:

Version:

6.1.7600.16385 (win7_rtm.090713-1255)

Modules

Images
c:\windows\system32\drvinst.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\cfgmgr32.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\setupapi.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll

1356

C:\Windows\system32\MsiExec.exe -Embedding A70E42B104F80F5E4DDC221E59E954BB

C:\Windows\system32\MsiExec.exe

—

msiexec.exe

User:

admin

Company:

Microsoft Corporation

Integrity Level:

MEDIUM

Description:

Windows® installer

Exit code:

Version:

5.0.7600.16385 (win7_rtm.090713-1255)

Modules

Images
c:\windows\system32\msiexec.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll

2156

"C:\Program Files\3CXPhone\3CXPhone.exe"

C:\Program Files\3CXPhone\3CXPhone.exe

—

MsiExec.exe

User:

admin

Company:

3CX Ltd

Integrity Level:

MEDIUM

Description:

3CX VoIP Phone

Exit code:

Version:

6.0.26523.0

Modules

Images
c:\program files\3cxphone\3cxphone.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\3cxphone\3cxvoipphone.dll
c:\windows\system32\ws2_32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\nsi.dll
c:\windows\system32\iphlpapi.dll

2168

C:\Windows\system32\msiexec.exe /V

C:\Windows\system32\msiexec.exe

services.exe

User:

SYSTEM

Company:

Microsoft Corporation

Integrity Level:

SYSTEM

Description:

Windows® installer

Exit code:

Version:

5.0.7600.16385 (win7_rtm.090713-1255)

Modules

Images
c:\windows\system32\msiexec.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll

2688

"C:\Windows\System32\msiexec.exe" /i "C:\Users\admin\AppData\Local\Temp\3CXPhone6.msi"

C:\Windows\System32\msiexec.exe

—

explorer.exe

User:

admin

Company:

Microsoft Corporation

Integrity Level:

MEDIUM

Description:

Windows® installer

Exit code:

Version:

5.0.7600.16385 (win7_rtm.090713-1255)

Modules

Images
c:\windows\system32\msiexec.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll

3524

C:\Windows\system32\DllHost.exe /Processid:{E2B3C97F-6AE1-41AC-817A-F6F92166D7DD}

C:\Windows\system32\DllHost.exe

—

svchost.exe

User:

SYSTEM

Company:

Microsoft Corporation

Integrity Level:

SYSTEM

Description:

COM Surrogate

Exit code:

Version:

6.1.7600.16385 (win7_rtm.090713-1255)

Modules

Images
c:\windows\system32\dllhost.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\ole32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll

3544

C:\Windows\system32\vssvc.exe

—

services.exe

User:

SYSTEM

Company:

Microsoft Corporation

Integrity Level:

SYSTEM

Description:

Microsoft® Volume Shadow Copy Service

Exit code:

Version:

6.1.7600.16385 (win7_rtm.090713-1255)

Modules

Images
c:\windows\system32\vssvc.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll

3948

"C:\Program Files\3CXPhone\3CXPhoneLookup.exe" 3CXPhone

C:\Program Files\3CXPhone\3CXPhoneLookup.exe

3CXPhone.exe

User:

admin

Company:

3CX Ltd

Integrity Level:

MEDIUM

Description:

3CXPhone lookup

Exit code:

Version:

1.0.0.0

Modules

Images
c:\program files\3cxphone\3cxphonelookup.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\comdlg32.dll

Add for printing

Total events

2 012

Read events

1 069

Write events

931

Delete events

Modification events


(PID) Process:	(2688) msiexec.exe	Key:	HKEY_CLASSES_ROOT\Local Settings\MuiCache\62\52C64B7E
Operation:	write	Name:	LanguageList
Value: en-US
(PID) Process:	(2168) msiexec.exe	Key:	HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\SystemRestore
Operation:	write	Name:	SrCreateRp (Enter)
Value: 400000000000000016D22376A3EFD4017808000018070000D5070000000000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:	(2168) msiexec.exe	Key:	HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\SPP
Operation:	write	Name:	SppCreate (Enter)
Value: 400000000000000016D22376A3EFD4017808000018070000D0070000000000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:	(2168) msiexec.exe	Key:	HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SPP
Operation:	write	Name:	LastIndex
Value: 20
(PID) Process:	(2168) msiexec.exe	Key:	HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\SPP
Operation:	write	Name:	SppGatherWriterMetadata (Enter)
Value: 4000000000000000BEA67976A3EFD4017808000018070000D3070000000000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:	(2168) msiexec.exe	Key:	HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\VssapiPublisher
Operation:	write	Name:	IDENTIFY (Enter)
Value: 400000000000000018097C76A3EFD4017808000000090000E8030000010000000000000000000000EC18EDCEA98FBD40A0E4975BCBD00B630000000000000000
(PID) Process:	(3544) vssvc.exe	Key:	HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\ASR Writer
Operation:	write	Name:	IDENTIFY (Enter)
Value: 40000000000000009CE09376A3EFD401D80D0000980F0000E8030000010000000100000000000000000000000000000000000000000000000000000000000000
(PID) Process:	(3544) vssvc.exe	Key:	HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\COM+ REGDB Writer
Operation:	write	Name:	IDENTIFY (Enter)
Value: 40000000000000009CE09376A3EFD401D80D0000E8080000E8030000010000000100000000000000000000000000000000000000000000000000000000000000
(PID) Process:	(3544) vssvc.exe	Key:	HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\Shadow Copy Optimization Writer
Operation:	write	Name:	IDENTIFY (Enter)
Value: 40000000000000009CE09376A3EFD401D80D0000B80A0000E8030000010000000100000000000000000000000000000000000000000000000000000000000000
(PID) Process:	(3544) vssvc.exe	Key:	HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\Registry Writer
Operation:	write	Name:	IDENTIFY (Enter)
Value: 40000000000000009CE09376A3EFD401D80D0000000F0000E8030000010000000100000000000000000000000000000000000000000000000000000000000000

Add for printing

Executable files

Suspicious files

Text files

Unknown types

Dropped files

PID	Process	Filename		Type
2688	msiexec.exe	C:\Users\admin\AppData\Local\Temp\MSI49D7.tmp		—
		MD5:—	SHA256:—
2688	msiexec.exe	C:\Users\admin\AppData\Local\Temp\MSI4A55.tmp		—
		MD5:—	SHA256:—
2688	msiexec.exe	C:\Users\admin\AppData\Local\Temp\MSI4A66.tmp		—
		MD5:—	SHA256:—
2688	msiexec.exe	C:\Users\admin\AppData\Local\Temp\MSI4A86.tmp		—
		MD5:—	SHA256:—
2688	msiexec.exe	C:\Users\admin\AppData\Local\Temp\MSI6718.tmp		—
		MD5:—	SHA256:—
2168	msiexec.exe	C:\System Volume Information\SPP\metadata-2		—
		MD5:—	SHA256:—
2168	msiexec.exe	C:\Windows\Installer\11abbe.msi		—
		MD5:—	SHA256:—
2168	msiexec.exe	C:\Windows\Installer\MSIB1D8.tmp		—
		MD5:—	SHA256:—
2168	msiexec.exe	C:\Windows\Installer\MSIB2D3.tmp		—
		MD5:—	SHA256:—
2168	msiexec.exe	C:\Windows\Installer\MSIB2F3.tmp		—
		MD5:—	SHA256:—

Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Add for printing

HTTP(S) requests

TCP/UDP connections

DNS requests

Threats

HTTP requests

No HTTP requests

Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

No data

DNS requests

No data

Threats

No threats detected

Add for printing

No debug info

General Info

3CXPhone6.msi

CEEC4DBD300086C8F052BDC51D287CA5

5F36BC56D6D4484D4557092F4BEFE8F280EE0C1B

ABC2869C39480F0040D872679B961BCD565DB1D8FD1F79DE99FEFC78A88D10CF

393216:cC2sv/LoSsfbZv+6wuZebE8osHeht3QCBe2iLftp:cC2kolv+6w4gMs0SCwLff

Software environment set and analysis options

Launch configuration

Software preset

Hotfixes

Behavior activities

MALICIOUS

Application was dropped or rewritten from another process

Loads dropped or rewritten executable

SUSPICIOUS

Creates COM task schedule object

Executable content was dropped or overwritten

Starts itself from another location

INFO

Adds / modifies Windows certificates

Application launched itself

Searches for installed software

Low-level read access rights to disk partition

Changes settings of System certificates

Creates files in the program directory

Creates a software uninstall entry

Malware configuration

Static information

TRiD

EXIF

FlashPix

Video and screenshots

Processes

Behavior graph

Specs description

Process information

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Registry activity

Modification events

Files activity

Dropped files

Network activity

HTTP requests

Connections

DNS requests

Threats

Debug output strings