File name: | ba506d2acdff76109d44688dc4213d9192852f00dacf2933543c256e450f85de.msi |
Full analysis: | https://app.any.run/tasks/be620b80-158f-4313-8e16-a08d72c92c59 |
Verdict: | Malicious activity |
Analysis date: | January 15, 2022, 00:47:08 |
OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
Tags: | |
Indicators: | |
MIME: | application/x-msi |
File info: | Composite Document File V2 Document, Little Endian, Os: Windows, Version 6.1, MSI Installer, Last Printed: Fri Dec 11 11:47:44 2009, Create Time/Date: Fri Dec 11 11:47:44 2009, Last Saved Time/Date: Fri Sep 18 15:06:51 2020, Code page: 1252, Revision Number: {9B9BDA25-DA69-4F4E-A6B1-53C3F8980848}, Number of Words: 10, Subject: Windows, Author: MYMSqZGvFr, Name of Creating Application: 432432432432 (Evaluation Installer), Template: ;1033, Comments: (Evaluation Installer), Title: Installation Database, Keywords: Installer, MSI, Database, Security: 0, Number of Pages: 200 |
MD5: | F56286E1B544DB75D711D9AC267C4CE5 |
SHA1: | FFB5A9650475D40076287F6D24831CE78B047B36 |
SHA256: | BA506D2ACDFF76109D44688DC4213D9192852F00DACF2933543C256E450F85DE |
SSDEEP: | 24576:TaSxGU0fqgQazW/G/tPABM+seD6T+QXle8AVLdPliY5Aj5:TaSw/QmW/GqMpe++QXllAVLdPliY5Al |
.msi | | | Microsoft Windows Installer (88.6) |
---|---|---|
.mst | | | Windows SDK Setup Transform Script (10) |
.msi | | | Microsoft Installer (100) |
LastPrinted: | 2009:12:11 11:47:44 |
---|---|
CreateDate: | 2009:12:11 11:47:44 |
ModifyDate: | 2020:09:18 14:06:51 |
CodePage: | Windows Latin 1 (Western European) |
RevisionNumber: | {9B9BDA25-DA69-4F4E-A6B1-53C3F8980848} |
Words: | 10 |
Subject: | Windows |
Author: | MYMSqZGvFr |
LastModifiedBy: | - |
Software: | 432432432432 (Evaluation Installer) |
Template: | ;1033 |
Comments: | (Evaluation Installer) |
Title: | Installation Database |
Keywords: | Installer, MSI, Database |
Security: | None |
Pages: | 200 |
PID | CMD | Path | Indicators | Parent process | |||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
2752 | "C:\Windows\System32\msiexec.exe" /i "C:\Users\admin\Desktop\ba506d2acdff76109d44688dc4213d9192852f00dacf2933543c256e450f85de.msi" | C:\Windows\System32\msiexec.exe | — | Explorer.EXE | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows� installer Exit code: 1603 Version: 5.0.7600.16385 (win7_rtm.090713-1255) Modules
| |||||||||||||||
3112 | C:\Windows\system32\msiexec.exe /V | C:\Windows\system32\msiexec.exe | services.exe | ||||||||||||
User: SYSTEM Company: Microsoft Corporation Integrity Level: SYSTEM Description: Windows� installer Version: 5.0.7600.16385 (win7_rtm.090713-1255) Modules
| |||||||||||||||
576 | C:\Windows\system32\MsiExec.exe -Embedding 81575E174DD903998EF55F27DBF1D059 | C:\Windows\system32\MsiExec.exe | msiexec.exe | ||||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows� installer Exit code: 0 Version: 5.0.7600.16385 (win7_rtm.090713-1255) Modules
|
(PID) Process: | (3112) msiexec.exe | Key: | HKEY_USERS\S-1-5-21-1302019708-1500728564-335382590-1000\Software\Microsoft\RestartManager\Session0000 |
Operation: | write | Name: | Owner |
Value: 280C0000CA6BEE6EA909D801 | |||
(PID) Process: | (3112) msiexec.exe | Key: | HKEY_USERS\S-1-5-21-1302019708-1500728564-335382590-1000\Software\Microsoft\RestartManager\Session0000 |
Operation: | write | Name: | SessionHash |
Value: 420429EE0372C5ADE3FCB1BA36F851AFC197AA7F50686BDD967B898D208979CC | |||
(PID) Process: | (3112) msiexec.exe | Key: | HKEY_USERS\S-1-5-21-1302019708-1500728564-335382590-1000\Software\Microsoft\RestartManager\Session0000 |
Operation: | write | Name: | Sequence |
Value: 1 | |||
(PID) Process: | (3112) msiexec.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\InProgress |
Operation: | write | Name: | (default) |
Value: C:\Windows\Installer\112ecf.ipi | |||
(PID) Process: | (576) MsiExec.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings |
Operation: | write | Name: | ProxyEnable |
Value: 0 | |||
(PID) Process: | (576) MsiExec.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections |
Operation: | write | Name: | SavedLegacySettings |
Value: 460000003B010000090000000000000000000000000000000400000000000000C0E333BBEAB1D3010000000000000000000000000100000002000000C0A80164000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 | |||
(PID) Process: | (576) MsiExec.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
Operation: | write | Name: | ProxyBypass |
Value: 1 | |||
(PID) Process: | (576) MsiExec.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
Operation: | write | Name: | IntranetName |
Value: 1 | |||
(PID) Process: | (576) MsiExec.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
Operation: | write | Name: | UNCAsIntranet |
Value: 1 | |||
(PID) Process: | (576) MsiExec.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
Operation: | write | Name: | AutoDetect |
Value: 0 |
PID | Process | Filename | Type | |
---|---|---|---|---|
3112 | msiexec.exe | C:\Windows\Installer\MSI3058.tmp | executable | |
MD5:09986F8E88420C200AE6E108A8EAB6D7 | SHA256:DC2EF9C125D3BB8354F367D36E85E44F603FCAFD6CAF875D8593A806C06C8513 | |||
3112 | msiexec.exe | C:\Windows\Installer\112ecd.msi | executable | |
MD5:F56286E1B544DB75D711D9AC267C4CE5 | SHA256:BA506D2ACDFF76109D44688DC4213D9192852F00DACF2933543C256E450F85DE | |||
3112 | msiexec.exe | C:\Users\admin\AppData\Local\Temp\~DF7E55AEB72915E2D1.TMP | gmc | |
MD5:35DB8B73C83B4997EF8F10562B8AF470 | SHA256:8D1D53476FF6475D1D4F086661A423706DE44C2080CBF640937C90F930B16C56 | |||
3112 | msiexec.exe | C:\Windows\Installer\112ecf.ipi | binary | |
MD5:AF87422DD42AD35019369AB7F0A5DD61 | SHA256:939291682C7B0CE87334B0449013F41F8947E424AD5F2E547A2B168E1BCC0D6A | |||
3112 | msiexec.exe | C:\Users\admin\AppData\Local\Temp\~DF6DF040FD4C986479.TMP | gmc | |
MD5:A3A72F4BEFCEE85B88B24AD137B0721E | SHA256:B059E18F20DC76232EAD692BBAFBB0DB96FA6424088B262DD2132ED9F1D641E4 | |||
576 | MsiExec.exe | C:\Users\admin\AppData\Roaming\ext\manifest.json | binary | |
MD5:AE69CD95D746E3FCE1C9B8CAFD705745 | SHA256:DFD18C5EF4D52BDA30D2F861DAF9087B542EE26AF9A3739CF9A0556D0B5F5B68 | |||
576 | MsiExec.exe | C:\Users\admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Google Chrome.lnk | lnk | |
MD5:669AF8B8720C806BDA446629F3439B4C | SHA256:EA1DB6B67D3F4B2530DE171AA36C86EE7E3C2A741DD5381598E4FE7BD99679BF | |||
576 | MsiExec.exe | C:\Users\admin\AppData\Roaming\ext\a1jMB.png | image | |
MD5:376020512FBFC6841B12D6FCADD4834E | SHA256:741B44D1DD7A2EAB43CE7718D6D7F85A091F5DA9C958F35DFA9ADBC52C075BEE | |||
576 | MsiExec.exe | C:\Users\admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Google Chrome.lnk | lnk | |
MD5:669AF8B8720C806BDA446629F3439B4C | SHA256:EA1DB6B67D3F4B2530DE171AA36C86EE7E3C2A741DD5381598E4FE7BD99679BF | |||
576 | MsiExec.exe | C:\Users\admin\AppData\Roaming\ext\73Rl9.js | text | |
MD5:338A7BF1B7A237BF4990A80B91CCD926 | SHA256:8077757D206AF0066BFC87B624B32C0A298A34C56968E5F7E99FADF76F911450 |
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
---|---|---|---|---|---|---|---|---|---|
576 | MsiExec.exe | GET | 403 | 34.117.59.81:80 | http://myexternalip.com/raw | US | html | 1.54 Kb | shared |
PID | Process | IP | Domain | ASN | CN | Reputation |
---|---|---|---|---|---|---|
576 | MsiExec.exe | 208.118.63.215:1433 | sql5098.site4now.net | Sharktech | US | suspicious |
576 | MsiExec.exe | 34.117.59.81:80 | myexternalip.com | — | US | whitelisted |
Domain | IP | Reputation |
---|---|---|
sql5098.site4now.net |
| suspicious |
myexternalip.com |
| shared |
PID | Process | Class | Message |
---|---|---|---|
576 | MsiExec.exe | Potentially Bad Traffic | ET POLICY Outbound MSSQL Connection to Standard port (1433) |
576 | MsiExec.exe | Potentially Bad Traffic | ET POLICY Outbound MSSQL Connection to Standard port (1433) |
576 | MsiExec.exe | Potential Corporate Privacy Violation | ET POLICY External IP Check myexternalip.com |
576 | MsiExec.exe | Potentially Bad Traffic | ET POLICY Outbound MSSQL Connection to Standard port (1433) |
576 | MsiExec.exe | Potentially Bad Traffic | ET POLICY Outbound MSSQL Connection to Standard port (1433) |