File name: | ba506d2acdff76109d44688dc4213d9192852f00dacf2933543c256e450f85de.msi |
Full analysis: | https://app.any.run/tasks/e7a261a7-7a57-47bb-bff8-e68fbf4979be |
Verdict: | Malicious activity |
Analysis date: | January 15, 2022, 00:18:48 |
OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
Tags: | |
Indicators: | |
MIME: | application/x-msi |
File info: | Composite Document File V2 Document, Little Endian, Os: Windows, Version 6.1, MSI Installer, Last Printed: Fri Dec 11 11:47:44 2009, Create Time/Date: Fri Dec 11 11:47:44 2009, Last Saved Time/Date: Fri Sep 18 15:06:51 2020, Code page: 1252, Revision Number: {9B9BDA25-DA69-4F4E-A6B1-53C3F8980848}, Number of Words: 10, Subject: Windows, Author: MYMSqZGvFr, Name of Creating Application: 432432432432 (Evaluation Installer), Template: ;1033, Comments: (Evaluation Installer), Title: Installation Database, Keywords: Installer, MSI, Database, Security: 0, Number of Pages: 200 |
MD5: | F56286E1B544DB75D711D9AC267C4CE5 |
SHA1: | FFB5A9650475D40076287F6D24831CE78B047B36 |
SHA256: | BA506D2ACDFF76109D44688DC4213D9192852F00DACF2933543C256E450F85DE |
SSDEEP: | 24576:TaSxGU0fqgQazW/G/tPABM+seD6T+QXle8AVLdPliY5Aj5:TaSw/QmW/GqMpe++QXllAVLdPliY5Al |
.msi | | | Microsoft Windows Installer (88.6) |
---|---|---|
.mst | | | Windows SDK Setup Transform Script (10) |
.msi | | | Microsoft Installer (100) |
LastPrinted: | 2009:12:11 11:47:44 |
---|---|
CreateDate: | 2009:12:11 11:47:44 |
ModifyDate: | 2020:09:18 14:06:51 |
CodePage: | Windows Latin 1 (Western European) |
RevisionNumber: | {9B9BDA25-DA69-4F4E-A6B1-53C3F8980848} |
Words: | 10 |
Subject: | Windows |
Author: | MYMSqZGvFr |
LastModifiedBy: | - |
Software: | 432432432432 (Evaluation Installer) |
Template: | ;1033 |
Comments: | (Evaluation Installer) |
Title: | Installation Database |
Keywords: | Installer, MSI, Database |
Security: | None |
Pages: | 200 |
PID | CMD | Path | Indicators | Parent process |
---|---|---|---|---|
1044 | "C:\Windows\System32\msiexec.exe" /i "C:\Users\admin\Desktop\ba506d2acdff76109d44688dc4213d9192852f00dacf2933543c256e450f85de.msi" | C:\Windows\System32\msiexec.exe | — | Explorer.EXE |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows� installer Exit code: 1603 Version: 5.0.7600.16385 (win7_rtm.090713-1255) | ||||
3412 | C:\Windows\system32\msiexec.exe /V | C:\Windows\system32\msiexec.exe | services.exe | |
User: SYSTEM Company: Microsoft Corporation Integrity Level: SYSTEM Description: Windows� installer Version: 5.0.7600.16385 (win7_rtm.090713-1255) | ||||
424 | C:\Windows\system32\MsiExec.exe -Embedding A0E95FA729A542BB630051967699915E | C:\Windows\system32\MsiExec.exe | msiexec.exe | |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows� installer Exit code: 0 Version: 5.0.7600.16385 (win7_rtm.090713-1255) |
(PID) Process: | (3412) msiexec.exe | Key: | HKEY_USERS\S-1-5-21-1302019708-1500728564-335382590-1000\Software\Microsoft\RestartManager\Session0000 |
Operation: | write | Name: | Owner |
Value: 540D0000356FB279A509D801 | |||
(PID) Process: | (3412) msiexec.exe | Key: | HKEY_USERS\S-1-5-21-1302019708-1500728564-335382590-1000\Software\Microsoft\RestartManager\Session0000 |
Operation: | write | Name: | SessionHash |
Value: EDCDDB7FC648515082878FEC7B4DFC1239251AF288D0146D52B688FE574B8B68 | |||
(PID) Process: | (3412) msiexec.exe | Key: | HKEY_USERS\S-1-5-21-1302019708-1500728564-335382590-1000\Software\Microsoft\RestartManager\Session0000 |
Operation: | write | Name: | Sequence |
Value: 1 | |||
(PID) Process: | (3412) msiexec.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\InProgress |
Operation: | write | Name: | (default) |
Value: C:\Windows\Installer\112ceb.ipi | |||
(PID) Process: | (424) MsiExec.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings |
Operation: | write | Name: | ProxyEnable |
Value: 0 | |||
(PID) Process: | (424) MsiExec.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections |
Operation: | write | Name: | SavedLegacySettings |
Value: 460000003B010000090000000000000000000000000000000400000000000000C0E333BBEAB1D3010000000000000000000000000100000002000000C0A80164000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 | |||
(PID) Process: | (424) MsiExec.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
Operation: | write | Name: | ProxyBypass |
Value: 1 | |||
(PID) Process: | (424) MsiExec.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
Operation: | write | Name: | IntranetName |
Value: 1 | |||
(PID) Process: | (424) MsiExec.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
Operation: | write | Name: | UNCAsIntranet |
Value: 1 | |||
(PID) Process: | (424) MsiExec.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
Operation: | write | Name: | AutoDetect |
Value: 0 |
PID | Process | Filename | Type | |
---|---|---|---|---|
424 | MsiExec.exe | C:\Users\admin\AppData\Roaming\ext\manifest.json | binary | |
MD5:AE69CD95D746E3FCE1C9B8CAFD705745 | SHA256:DFD18C5EF4D52BDA30D2F861DAF9087B542EE26AF9A3739CF9A0556D0B5F5B68 | |||
424 | MsiExec.exe | C:\Users\admin\AppData\Roaming\ext\111ms.js | text | |
MD5:417EE6CEB96F332526D7562A500B3C86 | SHA256:01E73F3047B1EDDE72EBD3ECB76F00BCC356A893902FA6E5338A0FFB8B2E0BF3 | |||
3412 | msiexec.exe | C:\Windows\Installer\MSI2EC2.tmp | executable | |
MD5:09986F8E88420C200AE6E108A8EAB6D7 | SHA256:DC2EF9C125D3BB8354F367D36E85E44F603FCAFD6CAF875D8593A806C06C8513 | |||
3412 | msiexec.exe | C:\Windows\Installer\112ceb.ipi | binary | |
MD5:3AE49933474C7A20BD98BA5E00E48441 | SHA256:3005E9192AEC825BA600134241B2610794F614B4324EC3C80132440AB1337101 | |||
424 | MsiExec.exe | C:\Users\admin\AppData\Roaming\ext\73Rl9.js | text | |
MD5:338A7BF1B7A237BF4990A80B91CCD926 | SHA256:8077757D206AF0066BFC87B624B32C0A298A34C56968E5F7E99FADF76F911450 | |||
3412 | msiexec.exe | C:\Users\admin\AppData\Local\Temp\~DF86F9E0CA8A8329FD.TMP | gmc | |
MD5:B3054AA640CE81EEE1304E042A0FAFD3 | SHA256:E009C0A82B0DA4BF771175C489300B9503A6C7E532A126468C7435BE27FA5E30 | |||
3412 | msiexec.exe | C:\Windows\Installer\SourceHash{B8AFB836-6225-44B1-80F0-CF99FFB08245} | binary | |
MD5:1EA102ED0FDF939D493C78C22A1379C9 | SHA256:2C0DFE6B769788E7EE90DCB29F8DB0824A92FB555737794597B89F5F1FC511E1 | |||
3412 | msiexec.exe | C:\Users\admin\AppData\Local\Temp\~DF5B166D458C97EC65.TMP | gmc | |
MD5:A3A72F4BEFCEE85B88B24AD137B0721E | SHA256:B059E18F20DC76232EAD692BBAFBB0DB96FA6424088B262DD2132ED9F1D641E4 | |||
3412 | msiexec.exe | C:\Windows\Installer\MSI2EA1.tmp | binary | |
MD5:2AF684C10EF92C70F2DBEC8C2422E617 | SHA256:2D6CCF316AF6E42A987BAD72A4C7B3776F39B920DAD671FC17BE9E4DE227F0CF | |||
424 | MsiExec.exe | C:\Users\admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Google Chrome.lnk | lnk | |
MD5:669AF8B8720C806BDA446629F3439B4C | SHA256:EA1DB6B67D3F4B2530DE171AA36C86EE7E3C2A741DD5381598E4FE7BD99679BF |
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
---|---|---|---|---|---|---|---|---|---|
424 | MsiExec.exe | GET | 403 | 34.117.59.81:80 | http://myexternalip.com/raw | US | html | 1.54 Kb | shared |
PID | Process | IP | Domain | ASN | CN | Reputation |
---|---|---|---|---|---|---|
424 | MsiExec.exe | 34.117.59.81:80 | myexternalip.com | — | US | whitelisted |
424 | MsiExec.exe | 208.118.63.215:1433 | sql5098.site4now.net | Sharktech | US | suspicious |
Domain | IP | Reputation |
---|---|---|
sql5098.site4now.net |
| suspicious |
myexternalip.com |
| shared |
PID | Process | Class | Message |
---|---|---|---|
424 | MsiExec.exe | Potentially Bad Traffic | ET POLICY Outbound MSSQL Connection to Standard port (1433) |
424 | MsiExec.exe | Potentially Bad Traffic | ET POLICY Outbound MSSQL Connection to Standard port (1433) |
424 | MsiExec.exe | Potential Corporate Privacy Violation | ET POLICY External IP Check myexternalip.com |
424 | MsiExec.exe | Potentially Bad Traffic | ET POLICY Outbound MSSQL Connection to Standard port (1433) |
424 | MsiExec.exe | Potentially Bad Traffic | ET POLICY Outbound MSSQL Connection to Standard port (1433) |