File name:

transmission-2.94+-ra440981571-x86.msi

Full analysis: https://app.any.run/tasks/c64f0ea7-f62b-4f30-ae9d-ef389531a1fd
Verdict: Malicious activity
Analysis date: March 21, 2019, 19:54:04
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
generated-doc
Indicators:
MIME: application/x-msi
File info: Composite Document File V2 Document, Little Endian, Os: Windows, Version 6.2, MSI Installer, Code page: 1252, Title: Installation Database, Subject: Transmission 2.94+ Installer, Author: Transmission Project, Keywords: Installer, Comments: A Fast, Easy, and Free BitTorrent Client, Template: Intel;1033, Revision Number: {DE5E09AB-330C-4FB2-8CC2-E71EEE1251FF}, Create Time/Date: Sun Mar 3 14:33:12 2019, Last Saved Time/Date: Sun Mar 3 14:33:12 2019, Number of Pages: 500, Number of Words: 2, Name of Creating Application: Windows Installer XML Toolset (3.11.1.2318), Security: 2
MD5:

3A95E8C177F6FE6D61B21A2CA3D0CEF9

SHA1:

F3CA07571C26E7E4B52D68BE6802EF59CD0812E2

SHA256:

BE7402FA41075D1F99C0BA10C962AB6D4DA88B2BB14871EADC6BD36AC1C66B8B

SSDEEP:

196608:bzdyybWUb4vNZL44MHeFhOLcx22e55mK0vbiWgsJpZ1ezjiH4M/Clqg+Q6zdrUtE:dyyAZRMH48c0N+K0WWgUZ1Hb/8qg++

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Loads dropped or rewritten executable

      • transmission-qt.exe (PID: 2440)

    • Application was dropped or rewritten from another process

      • transmission-qt.exe (PID: 2440)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • msiexec.exe (PID: 2580)

    • Creates files in the program directory

      • transmission-qt.exe (PID: 2440)

    • Modifies the open verb of a shell class

      • msiexec.exe (PID: 2580)

  • INFO

    • Adds / modifies Windows certificates

      • DrvInst.exe (PID: 2384)

    • Changes settings of System certificates

      • DrvInst.exe (PID: 2384)

    • Low-level read access rights to disk partition

      • vssvc.exe (PID: 2516)

    • Searches for installed software

      • msiexec.exe (PID: 2580)

    • Application launched itself

      • msiexec.exe (PID: 2580)

    • Dropped object may contain Bitcoin addresses

      • msiexec.exe (PID: 2580)

    • Creates files in the program directory

      • msiexec.exe (PID: 2580)

    • Creates a software uninstall entry

      • msiexec.exe (PID: 2580)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.msi | Microsoft Windows Installer (98.5)
.msi | Microsoft Installer (100)

EXIF

FlashPix

CodePage: Windows Latin 1 (Western European)
Title: Installation Database
Subject: Transmission 2.94+ Installer
Author: Transmission Project
Keywords: Installer
Comments: A Fast, Easy, and Free BitTorrent Client
Template: Intel;1033
RevisionNumber: {DE5E09AB-330C-4FB2-8CC2-E71EEE1251FF}
CreateDate: 2019:03:03 14:33:12
ModifyDate: 2019:03:03 14:33:12
Pages: 500
Words: 2
Software: Windows Installer XML Toolset (3.11.1.2318)
Security: Read-only recommended
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
41
Monitored processes
6
Malicious processes
1
Suspicious processes
1

Behavior graph

Click at the process to see the details
start msiexec.exe no specs msiexec.exe vssvc.exe no specs drvinst.exe no specs msiexec.exe no specs transmission-qt.exe

Process information

PID
CMD
Path
Indicators
Parent process
2384DrvInst.exe "1" "200" "STORAGE\VolumeSnapshot\HarddiskVolumeSnapshot18" "" "" "6792c44eb" "00000000" "000005B8" "00000398"C:\Windows\system32\DrvInst.exe—svchost.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Driver Installation Module
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\drvinst.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\setupapi.dll
c:\windows\system32\cfgmgr32.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
2440"C:\Program Files\Transmission\transmission-qt.exe" C:\Program Files\Transmission\transmission-qt.exe
explorer.exe
User:
admin
Company:
Transmission Project
Integrity Level:
MEDIUM
Description:
Transmission Qt Client
Exit code:
3221225547
Version:
2.94+ (a440981571)
Modules
Images
c:\program files\transmission\transmission-qt.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\transmission\qt5network.dll
c:\windows\system32\ws2_32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\nsi.dll
c:\program files\transmission\zlib.dll
2516C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe—services.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Microsoft® Volume Shadow Copy Service
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\vssvc.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
2580C:\Windows\system32\msiexec.exe /VC:\Windows\system32\msiexec.exe
services.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Windows® installer
Exit code:
0
Version:
5.0.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\msiexec.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
3232"C:\Windows\System32\msiexec.exe" /i "C:\Users\admin\AppData\Local\Temp\transmission-2.94+-ra440981571-x86.msi"C:\Windows\System32\msiexec.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows® installer
Exit code:
0
Version:
5.0.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\msiexec.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
3896C:\Windows\system32\MsiExec.exe -Embedding A043277CDC21817685A72EA8C2FEDB27C:\Windows\system32\MsiExec.exe—msiexec.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows® installer
Exit code:
0
Version:
5.0.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\msiexec.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
Total events
1 533
Read events
1 004
Write events
516
Delete events
13

Modification events

(PID) Process:(2580) msiexec.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\SystemRestore
Operation:writeName:SrCreateRp (Enter)
Value:
4000000000000000F43A02E91FE0D401140A000004090000D5070000000000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(2580) msiexec.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\SPP
Operation:writeName:SppCreate (Enter)
Value:
4000000000000000F43A02E91FE0D401140A000004090000D0070000000000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(2580) msiexec.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SPP
Operation:writeName:LastIndex
Value:
20
(PID) Process:(2580) msiexec.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\SPP
Operation:writeName:SppGatherWriterMetadata (Enter)
Value:
40000000000000008EE850E91FE0D401140A000004090000D3070000000000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(2580) msiexec.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\VssapiPublisher
Operation:writeName:IDENTIFY (Enter)
Value:
4000000000000000E84A53E91FE0D401140A00008C0F0000E8030000010000000000000000000000A5438F039D4F3D42A6A889C82307F6520000000000000000
(PID) Process:(2516) vssvc.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\ASR Writer
Operation:writeName:IDENTIFY (Enter)
Value:
4000000000000000B85D66E91FE0D401D4090000F80B0000E8030000010000000100000000000000000000000000000000000000000000000000000000000000
(PID) Process:(2516) vssvc.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\Shadow Copy Optimization Writer
Operation:writeName:IDENTIFY (Enter)
Value:
4000000000000000B85D66E91FE0D401D4090000F00B0000E8030000010000000100000000000000000000000000000000000000000000000000000000000000
(PID) Process:(2516) vssvc.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\COM+ REGDB Writer
Operation:writeName:IDENTIFY (Enter)
Value:
4000000000000000B85D66E91FE0D401D409000008080000E8030000010000000100000000000000000000000000000000000000000000000000000000000000
(PID) Process:(2516) vssvc.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\Registry Writer
Operation:writeName:IDENTIFY (Enter)
Value:
4000000000000000B85D66E91FE0D401D4090000B4050000E8030000010000000100000000000000000000000000000000000000000000000000000000000000
(PID) Process:(2516) vssvc.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\COM+ REGDB Writer
Operation:writeName:IDENTIFY (Leave)
Value:
4000000000000000C6846DE91FE0D401D409000008080000E8030000000000000100000000000000000000000000000000000000000000000000000000000000
Executable files
18
Suspicious files
7
Text files
94
Unknown types
64

Dropped files

PID
Process
Filename
Type
2580msiexec.exeC:\System Volume Information\SPP\metadata-2 —
MD5:—
SHA256:—
2580msiexec.exeC:\Windows\Installer\106786.msi —
MD5:—
SHA256:—
2580msiexec.exeC:\Users\admin\AppData\Local\Temp\~DFDE3FA7EAF1F05012.TMP —
MD5:—
SHA256:—
2516vssvc.exeC: —
MD5:—
SHA256:—
2580msiexec.exeC:\Windows\Installer\MSI6F37.tmp —
MD5:—
SHA256:—
2580msiexec.exeC:\System Volume Information\SPP\snapshot-2binary
MD5:—
SHA256:—
2580msiexec.exeC:\Windows\Installer\106787.ipibinary
MD5:—
SHA256:—
2580msiexec.exeC:\System Volume Information\SPP\OnlineMetadataCache\{038f43a5-4f9d-423d-a6a8-89c82307f652}_OnDiskSnapshotPropbinary
MD5:—
SHA256:—
2384DrvInst.exeC:\Windows\INF\setupapi.ev3binary
MD5:—
SHA256:—
2384DrvInst.exeC:\Windows\INF\setupapi.ev1binary
MD5:—
SHA256:—
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
0
DNS requests
0
Threats
0

HTTP requests

No HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

No data

DNS requests

No data

Threats

No threats detected
Process
Message
transmission-qt.exe
QAxBase::setControl: requested control Transmission.QtClient could not be instantiated
transmission-qt.exe
Transmission 2.94+ (a440981571) started
transmission-qt.exe
Adding address to whitelist: ::1
transmission-qt.exe
Adding address to whitelist: ::1
transmission-qt.exe
Generating new id
transmission-qt.exe
initnatpmp succeeded (0)
transmission-qt.exe
sendpublicaddressrequest succeeded (2)
transmission-qt.exe
Port Forwarding
transmission-qt.exe
Port Forwarding
transmission-qt.exe
Not saving nodes, DHT not ready
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
transmission-2.94+-ra440981571-x86.msi