File name: | ba506d2acdff76109d44688dc4213d9192852f00dacf2933543c256e450f85de.msi |
Full analysis: | https://app.any.run/tasks/aa1a8e84-551d-4084-83a1-9cfd436e5b37 |
Verdict: | Malicious activity |
Analysis date: | January 14, 2022, 21:25:43 |
OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
Tags: | |
Indicators: | |
MIME: | application/x-msi |
File info: | Composite Document File V2 Document, Little Endian, Os: Windows, Version 6.1, MSI Installer, Last Printed: Fri Dec 11 11:47:44 2009, Create Time/Date: Fri Dec 11 11:47:44 2009, Last Saved Time/Date: Fri Sep 18 15:06:51 2020, Code page: 1252, Revision Number: {9B9BDA25-DA69-4F4E-A6B1-53C3F8980848}, Number of Words: 10, Subject: Windows, Author: MYMSqZGvFr, Name of Creating Application: 432432432432 (Evaluation Installer), Template: ;1033, Comments: (Evaluation Installer), Title: Installation Database, Keywords: Installer, MSI, Database, Security: 0, Number of Pages: 200 |
MD5: | F56286E1B544DB75D711D9AC267C4CE5 |
SHA1: | FFB5A9650475D40076287F6D24831CE78B047B36 |
SHA256: | BA506D2ACDFF76109D44688DC4213D9192852F00DACF2933543C256E450F85DE |
SSDEEP: | 24576:TaSxGU0fqgQazW/G/tPABM+seD6T+QXle8AVLdPliY5Aj5:TaSw/QmW/GqMpe++QXllAVLdPliY5Al |
.msi | | | Microsoft Windows Installer (88.6) |
---|---|---|
.mst | | | Windows SDK Setup Transform Script (10) |
.msi | | | Microsoft Installer (100) |
LastPrinted: | 2009:12:11 11:47:44 |
---|---|
CreateDate: | 2009:12:11 11:47:44 |
ModifyDate: | 2020:09:18 14:06:51 |
CodePage: | Windows Latin 1 (Western European) |
RevisionNumber: | {9B9BDA25-DA69-4F4E-A6B1-53C3F8980848} |
Words: | 10 |
Subject: | Windows |
Author: | MYMSqZGvFr |
LastModifiedBy: | - |
Software: | 432432432432 (Evaluation Installer) |
Template: | ;1033 |
Comments: | (Evaluation Installer) |
Title: | Installation Database |
Keywords: | Installer, MSI, Database |
Security: | None |
Pages: | 200 |
PID | CMD | Path | Indicators | Parent process | |||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
2828 | "C:\Windows\System32\msiexec.exe" /i "C:\Users\admin\AppData\Local\Temp\ba506d2acdff76109d44688dc4213d9192852f00dacf2933543c256e450f85de.msi" | C:\Windows\System32\msiexec.exe | — | Explorer.EXE | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows� installer Exit code: 1603 Version: 5.0.7600.16385 (win7_rtm.090713-1255) Modules
| |||||||||||||||
1168 | C:\Windows\system32\msiexec.exe /V | C:\Windows\system32\msiexec.exe | services.exe | ||||||||||||
User: SYSTEM Company: Microsoft Corporation Integrity Level: SYSTEM Description: Windows� installer Version: 5.0.7600.16385 (win7_rtm.090713-1255) Modules
| |||||||||||||||
3004 | C:\Windows\system32\MsiExec.exe -Embedding 5E33B7A12053DFD988765259AACD006C | C:\Windows\system32\MsiExec.exe | msiexec.exe | ||||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows� installer Exit code: 0 Version: 5.0.7600.16385 (win7_rtm.090713-1255) Modules
|
(PID) Process: | (1168) msiexec.exe | Key: | HKEY_USERS\S-1-5-21-1302019708-1500728564-335382590-1000\Software\Microsoft\RestartManager\Session0000 |
Operation: | write | Name: | Owner |
Value: 90040000263336558D09D801 | |||
(PID) Process: | (1168) msiexec.exe | Key: | HKEY_USERS\S-1-5-21-1302019708-1500728564-335382590-1000\Software\Microsoft\RestartManager\Session0000 |
Operation: | write | Name: | SessionHash |
Value: 179C0949C27CCBF78332693F07ED13E1E3DC676925E5451DDC8E4ADE5C740C11 | |||
(PID) Process: | (1168) msiexec.exe | Key: | HKEY_USERS\S-1-5-21-1302019708-1500728564-335382590-1000\Software\Microsoft\RestartManager\Session0000 |
Operation: | write | Name: | Sequence |
Value: 1 | |||
(PID) Process: | (1168) msiexec.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\InProgress |
Operation: | write | Name: | (default) |
Value: C:\Windows\Installer\13f0fd.ipi | |||
(PID) Process: | (3004) MsiExec.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings |
Operation: | write | Name: | ProxyEnable |
Value: 0 | |||
(PID) Process: | (3004) MsiExec.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections |
Operation: | write | Name: | SavedLegacySettings |
Value: 460000003B010000090000000000000000000000000000000400000000000000C0E333BBEAB1D3010000000000000000000000000100000002000000C0A80164000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 | |||
(PID) Process: | (3004) MsiExec.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
Operation: | write | Name: | ProxyBypass |
Value: 1 | |||
(PID) Process: | (3004) MsiExec.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
Operation: | write | Name: | IntranetName |
Value: 1 | |||
(PID) Process: | (3004) MsiExec.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
Operation: | write | Name: | UNCAsIntranet |
Value: 1 | |||
(PID) Process: | (3004) MsiExec.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
Operation: | write | Name: | AutoDetect |
Value: 0 |
PID | Process | Filename | Type | |
---|---|---|---|---|
3004 | MsiExec.exe | C:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\CAF4703619713E3F18D8A9D5D88D6288_45E3C223BCF135987E4038FB6B0DBA13 | der | |
MD5:34615E035F22E0F62ABB877EF4E65B52 | SHA256:77DA562E421B1004406EBDA1A1E2576B3B04D6D6E62BBDFF40B8C67E0A3C6486 | |||
3004 | MsiExec.exe | C:\Users\admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Google Chrome.lnk | lnk | |
MD5:669AF8B8720C806BDA446629F3439B4C | SHA256:EA1DB6B67D3F4B2530DE171AA36C86EE7E3C2A741DD5381598E4FE7BD99679BF | |||
3004 | MsiExec.exe | C:\Users\admin\AppData\Roaming\ext\a1jMB.png | image | |
MD5:376020512FBFC6841B12D6FCADD4834E | SHA256:741B44D1DD7A2EAB43CE7718D6D7F85A091F5DA9C958F35DFA9ADBC52C075BEE | |||
3004 | MsiExec.exe | C:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA | der | |
MD5:2663BED1F902BED00647B84FABBF8DEA | SHA256:7A3C6A8BE401F6DE91999C00919EA0F3BDCF80D06EB0E8A15D801F8F9A465DE9 | |||
3004 | MsiExec.exe | C:\Users\admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Google Chrome.lnk | lnk | |
MD5:669AF8B8720C806BDA446629F3439B4C | SHA256:EA1DB6B67D3F4B2530DE171AA36C86EE7E3C2A741DD5381598E4FE7BD99679BF | |||
1168 | msiexec.exe | C:\Windows\Installer\13f0fb.msi | executable | |
MD5:F56286E1B544DB75D711D9AC267C4CE5 | SHA256:BA506D2ACDFF76109D44688DC4213D9192852F00DACF2933543C256E450F85DE | |||
3004 | MsiExec.exe | C:\Users\admin\AppData\Roaming\ext\73Rl9.js | text | |
MD5:338A7BF1B7A237BF4990A80B91CCD926 | SHA256:8077757D206AF0066BFC87B624B32C0A298A34C56968E5F7E99FADF76F911450 | |||
3004 | MsiExec.exe | C:\Users\admin\Desktop\Google Chrome.lnk | lnk | |
MD5:91A836DCF88D0946650FE2EF144491A9 | SHA256:57E51730AF1443784F942FDA4D50E7782A517D2764162FFE6FE67356820BEBDA | |||
3004 | MsiExec.exe | C:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA | binary | |
MD5:CD82D76180856E93F6882DBAE8A3F712 | SHA256:3CB59F3862E0B835B7C08E3CB00879DFD2E1E0E2767AF6AF06558058A09195F7 | |||
3004 | MsiExec.exe | C:\Users\admin\AppData\Roaming\ext\111ms.js | text | |
MD5:417EE6CEB96F332526D7562A500B3C86 | SHA256:01E73F3047B1EDDE72EBD3ECB76F00BCC356A893902FA6E5338A0FFB8B2E0BF3 |
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
---|---|---|---|---|---|---|---|---|---|
3004 | MsiExec.exe | GET | 302 | 34.117.59.81:80 | http://myexternalip.com/raw | US | text | 50 b | shared |
3004 | MsiExec.exe | GET | 200 | 142.250.185.67:80 | http://ocsp.pki.goog/gtsr1/ME4wTDBKMEgwRjAJBgUrDgMCGgUABBQwkcLWD4LqGJ7bE7B1XZsEbmfwUAQU5K8rJnEaK0gnhS9SZizv8IkTcT4CDQIAjrICMzZli2TN25s%3D | US | der | 724 b | whitelisted |
3004 | MsiExec.exe | GET | 200 | 142.250.185.67:80 | http://ocsp.pki.goog/gsr1/MFEwTzBNMEswSTAJBgUrDgMCGgUABBS3V7W2nAf4FiMTjpDJKg6%2BMgGqMQQUYHtmGkUNl8qJUC99BM00qP%2F8%2FUsCEHe9DWzbNvka6iEPxPBY0w0%3D | US | der | 1.41 Kb | whitelisted |
3004 | MsiExec.exe | GET | 200 | 142.250.185.67:80 | http://ocsp.pki.goog/gts1d4/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBSMBFDqU0NJQdZdEGU3bkhj0FoRrQQUJeIYDrJXkZQq5dRdhpCD3lOzuJICEQDiOJGRlIYAiAoAAAABKkNX | US | der | 472 b | whitelisted |
3004 | MsiExec.exe | GET | 200 | 2.16.186.81:80 | http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?91ac130b07bb0ab3 | unknown | compressed | 4.70 Kb | whitelisted |
PID | Process | IP | Domain | ASN | CN | Reputation |
---|---|---|---|---|---|---|
3004 | MsiExec.exe | 2.16.186.81:80 | ctldl.windowsupdate.com | Akamai International B.V. | — | whitelisted |
3004 | MsiExec.exe | 34.117.59.81:443 | myexternalip.com | — | US | whitelisted |
3004 | MsiExec.exe | 34.117.59.81:80 | myexternalip.com | — | US | whitelisted |
3004 | MsiExec.exe | 142.250.185.67:80 | ocsp.pki.goog | Google Inc. | US | whitelisted |
3004 | MsiExec.exe | 208.118.63.215:1433 | sql5098.site4now.net | Sharktech | US | suspicious |
Domain | IP | Reputation |
---|---|---|
sql5098.site4now.net |
| suspicious |
myexternalip.com |
| shared |
ctldl.windowsupdate.com |
| whitelisted |
ocsp.pki.goog |
| whitelisted |
PID | Process | Class | Message |
---|---|---|---|
3004 | MsiExec.exe | Potentially Bad Traffic | ET POLICY Outbound MSSQL Connection to Standard port (1433) |
3004 | MsiExec.exe | Potentially Bad Traffic | ET POLICY Outbound MSSQL Connection to Standard port (1433) |
3004 | MsiExec.exe | Potential Corporate Privacy Violation | ET POLICY External IP Check myexternalip.com |
3004 | MsiExec.exe | Potential Corporate Privacy Violation | ET POLICY IP Check Domain (myexternalip .com in TLS SNI) |
3004 | MsiExec.exe | Potentially Bad Traffic | ET POLICY Outbound MSSQL Connection to Standard port (1433) |
3004 | MsiExec.exe | Potentially Bad Traffic | ET POLICY Outbound MSSQL Connection to Standard port (1433) |