File name: | transmission-2.94+-ra440981571-x86.msi |
Full analysis: | https://app.any.run/tasks/c64f0ea7-f62b-4f30-ae9d-ef389531a1fd |
Verdict: | Malicious activity |
Analysis date: | March 21, 2019, 19:54:04 |
OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
Tags: | |
Indicators: | |
MIME: | application/x-msi |
File info: | Composite Document File V2 Document, Little Endian, Os: Windows, Version 6.2, MSI Installer, Code page: 1252, Title: Installation Database, Subject: Transmission 2.94+ Installer, Author: Transmission Project, Keywords: Installer, Comments: A Fast, Easy, and Free BitTorrent Client, Template: Intel;1033, Revision Number: {DE5E09AB-330C-4FB2-8CC2-E71EEE1251FF}, Create Time/Date: Sun Mar 3 14:33:12 2019, Last Saved Time/Date: Sun Mar 3 14:33:12 2019, Number of Pages: 500, Number of Words: 2, Name of Creating Application: Windows Installer XML Toolset (3.11.1.2318), Security: 2 |
MD5: | 3A95E8C177F6FE6D61B21A2CA3D0CEF9 |
SHA1: | F3CA07571C26E7E4B52D68BE6802EF59CD0812E2 |
SHA256: | BE7402FA41075D1F99C0BA10C962AB6D4DA88B2BB14871EADC6BD36AC1C66B8B |
SSDEEP: | 196608:bzdyybWUb4vNZL44MHeFhOLcx22e55mK0vbiWgsJpZ1ezjiH4M/Clqg+Q6zdrUtE:dyyAZRMH48c0N+K0WWgUZ1Hb/8qg++ |
.msi | | | Microsoft Windows Installer (98.5) |
---|---|---|
.msi | | | Microsoft Installer (100) |
Security: | Read-only recommended |
---|---|
Software: | Windows Installer XML Toolset (3.11.1.2318) |
Words: | 2 |
Pages: | 500 |
ModifyDate: | 2019:03:03 14:33:12 |
CreateDate: | 2019:03:03 14:33:12 |
RevisionNumber: | {DE5E09AB-330C-4FB2-8CC2-E71EEE1251FF} |
Template: | Intel;1033 |
Comments: | A Fast, Easy, and Free BitTorrent Client |
Keywords: | Installer |
Author: | Transmission Project |
Subject: | Transmission 2.94+ Installer |
Title: | Installation Database |
CodePage: | Windows Latin 1 (Western European) |
PID | CMD | Path | Indicators | Parent process |
---|---|---|---|---|
3232 | "C:\Windows\System32\msiexec.exe" /i "C:\Users\admin\AppData\Local\Temp\transmission-2.94+-ra440981571-x86.msi" | C:\Windows\System32\msiexec.exe | — | explorer.exe |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows® installer Exit code: 0 Version: 5.0.7600.16385 (win7_rtm.090713-1255) | ||||
2580 | C:\Windows\system32\msiexec.exe /V | C:\Windows\system32\msiexec.exe | services.exe | |
User: SYSTEM Company: Microsoft Corporation Integrity Level: SYSTEM Description: Windows® installer Version: 5.0.7600.16385 (win7_rtm.090713-1255) | ||||
2516 | C:\Windows\system32\vssvc.exe | C:\Windows\system32\vssvc.exe | — | services.exe |
User: SYSTEM Company: Microsoft Corporation Integrity Level: SYSTEM Description: Microsoft® Volume Shadow Copy Service Version: 6.1.7600.16385 (win7_rtm.090713-1255) | ||||
2384 | DrvInst.exe "1" "200" "STORAGE\VolumeSnapshot\HarddiskVolumeSnapshot18" "" "" "6792c44eb" "00000000" "000005B8" "00000398" | C:\Windows\system32\DrvInst.exe | — | svchost.exe |
User: SYSTEM Company: Microsoft Corporation Integrity Level: SYSTEM Description: Driver Installation Module Exit code: 0 Version: 6.1.7600.16385 (win7_rtm.090713-1255) | ||||
3896 | C:\Windows\system32\MsiExec.exe -Embedding A043277CDC21817685A72EA8C2FEDB27 | C:\Windows\system32\MsiExec.exe | — | msiexec.exe |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows® installer Exit code: 0 Version: 5.0.7600.16385 (win7_rtm.090713-1255) | ||||
2440 | "C:\Program Files\Transmission\transmission-qt.exe" | C:\Program Files\Transmission\transmission-qt.exe | explorer.exe | |
User: admin Company: Transmission Project Integrity Level: MEDIUM Description: Transmission Qt Client Exit code: 3221225547 Version: 2.94+ (a440981571) |
PID | Process | Filename | Type | |
---|---|---|---|---|
2580 | msiexec.exe | C:\System Volume Information\SPP\metadata-2 | — | |
MD5:— | SHA256:— | |||
2384 | DrvInst.exe | C:\Windows\INF\setupapi.ev3 | binary | |
MD5:76DCC60F78B3DFF1AE3627619074F465 | SHA256:18541AC1875315C4F9EFF75050C574FAFF83717C029DAE6B366F9C6C3F0C19E0 | |||
2580 | msiexec.exe | C:\System Volume Information\SPP\OnlineMetadataCache\{038f43a5-4f9d-423d-a6a8-89c82307f652}_OnDiskSnapshotProp | binary | |
MD5:624151A4FBD8F6AF156E3DCAB66FC020 | SHA256:27B158374672AC3A14F03A5580827272F68C494ADD712DAA746DE81D9A7193D9 | |||
2580 | msiexec.exe | C:\System Volume Information\SPP\snapshot-2 | binary | |
MD5:624151A4FBD8F6AF156E3DCAB66FC020 | SHA256:27B158374672AC3A14F03A5580827272F68C494ADD712DAA746DE81D9A7193D9 | |||
2384 | DrvInst.exe | C:\Windows\INF\setupapi.dev.log | ini | |
MD5:E030845AB0437F9C278346E7AA3ED916 | SHA256:8ED58F35D50B557EEE9960CA3F3798649DA316FBBC6DF3769BD773C7BE223A6D | |||
2384 | DrvInst.exe | C:\Windows\INF\setupapi.ev1 | binary | |
MD5:019033CE6526AB95FA5B2E31527920EC | SHA256:C9F5F1E41FB8CE9406EF5646BB020B3C78862DE3D8D37363BC0138FD647AB98C | |||
2580 | msiexec.exe | C:\Windows\Installer\106786.msi | — | |
MD5:— | SHA256:— | |||
2580 | msiexec.exe | C:\Users\admin\AppData\Local\Temp\~DFDE3FA7EAF1F05012.TMP | — | |
MD5:— | SHA256:— | |||
2516 | vssvc.exe | C: | — | |
MD5:— | SHA256:— | |||
2580 | msiexec.exe | C:\Windows\Installer\MSI6F37.tmp | — | |
MD5:— | SHA256:— |
Process | Message |
---|---|
transmission-qt.exe | QAxBase::setControl: requested control Transmission.QtClient could not be instantiated
|
transmission-qt.exe | Transmission 2.94+ (a440981571) started
|
transmission-qt.exe | Adding address to whitelist: ::1
|
transmission-qt.exe | Adding address to whitelist: ::1
|
transmission-qt.exe | Generating new id
|
transmission-qt.exe | initnatpmp succeeded (0)
|
transmission-qt.exe | sendpublicaddressrequest succeeded (2)
|
transmission-qt.exe | Port Forwarding
|
transmission-qt.exe | Port Forwarding
|
transmission-qt.exe | Not saving nodes, DHT not ready
|