File name:

msodbcsql REST DB 2025.msi

Full analysis: https://app.any.run/tasks/4cbf9f8b-5a7e-4f91-aada-0f780f6fa05b
Verdict: Malicious activity
Analysis date: March 18, 2025, 22:15:36
OS: Windows 10 Professional (build: 19045, 64 bit)
Tags:
generated-doc
Indicators:
MIME: application/x-msi
File info: Composite Document File V2 Document, Little Endian, Os: Windows, Version 6.3, MSI Installer, Code page: 1252, Title: Installation Database, Subject: Microsoft ODBC Driver 18 for SQL Server, Author: Microsoft Corporation, Keywords: Installer, Comments: Microsoft ODBC Driver 18 for SQL Server MSI, Template: x64;1033, Revision Number: {FAC0641F-3772-4AAD-ABD5-B5E1AF4DF504}, Create Time/Date: Thu Jul 11 20:30:06 2024, Last Saved Time/Date: Thu Jul 11 20:30:06 2024, Number of Pages: 405, Number of Words: 2, Name of Creating Application: Windows Installer XML Toolset (3.14.0.6526), Security: 2
MD5:

DEC822E28159137CD0766F448B1655DE

SHA1:

0F54A903B26D9682C4D59A150660BEAA5F4AA122

SHA256:

B0FE5FEB86975837C3297BF09E843C30241512AAC4D10A4D40377C54039016BB

SSDEEP:

98304:H6wEgqvMwpZpXFulz0fHX+xlePzuReE0Yhp8MddawOCMH1twZo1ZEInDIDeICRkB:9/PRY8GQNp2jF

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    No malicious indicators.

  • SUSPICIOUS

    • Process drops legitimate windows executable

      • msiexec.exe (PID: 5364)
      • msiexec.exe (PID: 4180)

    • Executes as Windows Service

      • VSSVC.exe (PID: 1128)

    • Reads the Windows owner or organization settings

      • msiexec.exe (PID: 4180)

    • The process drops C-runtime libraries

      • msiexec.exe (PID: 4180)

  • INFO

    • Reads the software policy settings

      • msiexec.exe (PID: 5364)
      • msiexec.exe (PID: 4180)

    • Reads security settings of Internet Explorer

      • msiexec.exe (PID: 5364)

    • Creates files or folders in the user directory

      • msiexec.exe (PID: 5364)

    • The sample compiled with english language support

      • msiexec.exe (PID: 5364)
      • msiexec.exe (PID: 4180)

    • Checks proxy server information

      • msiexec.exe (PID: 5364)

    • Reads the computer name

      • msiexec.exe (PID: 4180)
      • msiexec.exe (PID: 5772)
      • msiexec.exe (PID: 840)

    • Checks supported languages

      • msiexec.exe (PID: 4180)
      • msiexec.exe (PID: 5772)
      • msiexec.exe (PID: 840)

    • Executable content was dropped or overwritten

      • msiexec.exe (PID: 5364)
      • msiexec.exe (PID: 4180)

    • Application launched itself

      • msiexec.exe (PID: 4180)

    • Manages system restore points

      • SrTasks.exe (PID: 5588)

    • Reads the machine GUID from the registry

      • msiexec.exe (PID: 4180)

    • Creates a software uninstall entry

      • msiexec.exe (PID: 4180)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.msi | Microsoft Windows Installer (98.5)
.msi | Microsoft Installer (100)

EXIF

FlashPix

CodePage: Windows Latin 1 (Western European)
Title: Installation Database
Subject: Microsoft ODBC Driver 18 for SQL Server
Author: Microsoft Corporation
Keywords: Installer
Comments: Microsoft ODBC Driver 18 for SQL Server MSI
Template: x64;1033
RevisionNumber: {FAC0641F-3772-4AAD-ABD5-B5E1AF4DF504}
CreateDate: 2024:07:11 20:30:06
ModifyDate: 2024:07:11 20:30:06
Pages: 405
Words: 2
Software: Windows Installer XML Toolset (3.14.0.6526)
Security: Read-only recommended
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
143
Monitored processes
9
Malicious processes
1
Suspicious processes
0

Behavior graph

Click at the process to see the details
start msiexec.exe msiexec.exe msiexec.exe no specs sppextcomobj.exe no specs slui.exe no specs vssvc.exe no specs srtasks.exe no specs conhost.exe no specs msiexec.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
840C:\Windows\System32\MsiExec.exe -Embedding 6A1FDD3AB363EC207E5108BEFD3D080FC:\Windows\System32\msiexec.exe—msiexec.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows® installer
Exit code:
0
Version:
5.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\msiexec.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\aclayers.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
1128C:\WINDOWS\system32\vssvc.exeC:\Windows\System32\VSSVC.exe—services.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Microsoft® Volume Shadow Copy Service
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\vssvc.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1184C:\WINDOWS\system32\SppExtComObj.exe -EmbeddingC:\Windows\System32\SppExtComObj.Exe—svchost.exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
KMS Connection Broker
Version:
10.0.19041.3996 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\sppextcomobj.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\oleaut32.dll
3300\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—SrTasks.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
4180C:\WINDOWS\system32\msiexec.exe /VC:\Windows\System32\msiexec.exe
services.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Windows® installer
Version:
5.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\msiexec.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\aclayers.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
5364"C:\Windows\System32\msiexec.exe" /i "C:\Users\admin\AppData\Local\Temp\msodbcsql REST DB 2025.msi"C:\Windows\System32\msiexec.exe
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows® installer
Exit code:
0
Version:
5.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\msiexec.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\aclayers.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
5588C:\WINDOWS\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:11C:\Windows\System32\SrTasks.exe—msiexec.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Microsoft® Windows System Protection background tasks.
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\srtasks.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
5772C:\Windows\System32\MsiExec.exe -Embedding D711684C91A32523319E0EA792CF8217 CC:\Windows\System32\msiexec.exe—msiexec.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows® installer
Exit code:
0
Version:
5.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\msiexec.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\aclayers.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
6768"C:\WINDOWS\System32\SLUI.exe" RuleId=3482d82e-ca2c-4e1f-8864-da0267b484b2;Action=AutoActivate;AppId=55c92734-d682-4d71-983e-d6ec3f16059f;SkuId=4de7cb65-cdf1-4de9-8ae8-e3cce27b9f2c;NotificationInterval=1440;Trigger=TimerEventC:\Windows\System32\slui.exe—SppExtComObj.Exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Windows Activation Client
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
Total events
9 940
Read events
9 378
Write events
545
Delete events
17

Modification events

(PID) Process:(4180) msiexec.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\SystemRestore
Operation:writeName:SrCreateRp (Enter)
Value:
4800000000000000E82767565398DB0154100000C8150000D50700000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(4180) msiexec.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\SPP
Operation:writeName:SppGetSnapshots (Enter)
Value:
4800000000000000E82767565398DB0154100000C8150000D20700000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(4180) msiexec.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\SPP
Operation:writeName:SppGetSnapshots (Leave)
Value:
48000000000000004D8FA7565398DB0154100000C8150000D20700000100000000000000000000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(4180) msiexec.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\SPP
Operation:writeName:SppEnumGroups (Enter)
Value:
48000000000000004D8FA7565398DB0154100000C8150000D10700000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(4180) msiexec.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\SPP
Operation:writeName:SppEnumGroups (Leave)
Value:
48000000000000005BF4A9565398DB0154100000C8150000D10700000100000000000000010000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(4180) msiexec.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\SPP
Operation:writeName:SppCreate (Enter)
Value:
480000000000000067A9AE565398DB0154100000C8150000D00700000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(4180) msiexec.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\SPP
Operation:writeName:SppGatherWriterMetadata (Enter)
Value:
4800000000000000C2E725575398DB0154100000C8150000D30700000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(1128) VSSVC.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\ASR Writer
Operation:writeName:IDENTIFY (Enter)
Value:
480000000000000016303A575398DB0168040000E40F0000E80300000100000001000000000000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(1128) VSSVC.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\Registry Writer
Operation:writeName:IDENTIFY (Enter)
Value:
480000000000000016303A575398DB016804000074090000E80300000100000001000000000000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(1128) VSSVC.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\Shadow Copy Optimization Writer
Operation:writeName:IDENTIFY (Enter)
Value:
480000000000000016303A575398DB0168040000F8070000E80300000100000001000000000000000000000000000000000000000000000000000000000000000000000000000000
Executable files
19
Suspicious files
22
Text files
3
Unknown types
0

Dropped files

PID
Process
Filename
Type
4180msiexec.exeC:\System Volume Information\SPP\metadata-2 —
MD5:—
SHA256:—
4180msiexec.exeC:\Windows\Installer\1140af.msi —
MD5:—
SHA256:—
5364msiexec.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\37C951188967C8EB88D99893D9D191FEbinary
MD5:681A382978E7C001D3ADCDF3B6949E8E
SHA256:DFE1824575CE8F12804FDFE57402AAA9A8C3A34792CC2EA613B42735125F13FF
4180msiexec.exeC:\Windows\Installer\MSI42B3.tmpexecutable
MD5:9E729231FC8934D7A7284CD37D465CD4
SHA256:A3240F13698E9179A12B5E7A294D325B4CC553A453F723183467252CC67ADE84
4180msiexec.exeC:\System Volume Information\SPP\snapshot-2binary
MD5:04D2CA2B6D70B769BD0D0AC8F642ED81
SHA256:B3AC9D7F517AC9DA1E16A075195C42034EFF544A677299DA3AD06C489617B81E
4180msiexec.exeC:\Windows\Installer\MSI43BE.tmpbinary
MD5:2D24EA3A83FC7F3DB7CB54DFA193B80F
SHA256:2C615E4ED503DBEA3B9FD7D8FEEFDE625A23920110FA44D2CEE43A7DF693C805
4180msiexec.exeC:\Windows\Installer\inprogressinstallinfo.ipibinary
MD5:1481440590FCBF0D19BF5DBC6A9DF3FB
SHA256:0307AC4121FE63368F2E248A8EAD98599407203CB3490239063153530AED72EF
4180msiexec.exeC:\Windows\Temp\~DF4B51214B3D7B92F8.TMPbinary
MD5:BF619EAC0CDF3F68D496EA9344137E8B
SHA256:076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
5364msiexec.exeC:\Users\admin\AppData\Local\Temp\MSIBB14.tmpexecutable
MD5:9E729231FC8934D7A7284CD37D465CD4
SHA256:A3240F13698E9179A12B5E7A294D325B4CC553A453F723183467252CC67ADE84
5364msiexec.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\C0018BB1B5834735BFA60CD063B31956binary
MD5:5345FFDF819E3EC67AE3BB0452E4B43A
SHA256:784600836A9A4F4D36E0ED66E3DAA34513C3BDCA246CAC4F41688C1BFFED0987
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
8
TCP/UDP connections
32
DNS requests
16
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
5496
MoUsoCoreWorker.exe
GET
200
23.53.40.176:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
—
—
GET
200
23.53.40.176:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
5364
msiexec.exe
GET
200
23.53.40.176:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
6544
svchost.exe
GET
200
23.54.109.203:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
5364
msiexec.exe
GET
200
23.35.229.160:80
http://www.microsoft.com/pkiops/crl/MicCodSigPCA2011_2011-07-08.crl
unknown
—
—
whitelisted
900
backgroundTaskHost.exe
GET
200
23.54.109.203:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAUZZSZEml49Gjh0j13P68w%3D
unknown
—
—
whitelisted
1312
SIHClient.exe
GET
200
23.35.229.160:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
1312
SIHClient.exe
GET
200
23.35.229.160:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
—
—
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
—
—
192.168.100.255:137
—
—
—
whitelisted
—
—
23.53.40.176:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
5496
MoUsoCoreWorker.exe
23.53.40.176:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
2104
svchost.exe
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
5364
msiexec.exe
23.53.40.176:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
5364
msiexec.exe
23.35.229.160:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
6544
svchost.exe
20.190.159.64:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
6544
svchost.exe
23.54.109.203:80
ocsp.digicert.com
AKAMAI-AS
DE
whitelisted

DNS requests

Domain
IP
Reputation
crl.microsoft.com
  • 23.53.40.176
  • 23.53.40.178
whitelisted
google.com
  • 172.217.16.142
whitelisted
www.microsoft.com
  • 23.35.229.160
whitelisted
login.live.com
  • 20.190.159.64
  • 40.126.31.131
  • 20.190.159.4
  • 20.190.159.2
  • 40.126.31.129
  • 40.126.31.0
  • 20.190.159.71
  • 40.126.31.71
whitelisted
ocsp.digicert.com
  • 23.54.109.203
whitelisted
client.wns.windows.com
  • 20.198.162.78
whitelisted
settings-win.data.microsoft.com
  • 51.104.136.2
  • 4.231.128.59
whitelisted
arc.msn.com
  • 20.74.47.205
whitelisted
slscr.update.microsoft.com
  • 52.149.20.212
whitelisted
fe3cr.delivery.mp.microsoft.com
  • 40.69.42.241
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
msodbcsql REST DB 2025.msi