File name:

bf5c7562e8b9cba0bf038b36fb03e451cdb7e942ea34ac79d31c9c115111cc30.msi

Full analysis: https://app.any.run/tasks/6da22883-e8d0-40d9-91db-d7f2afe69e10
Verdict: Malicious activity
Analysis date: August 08, 2024, 23:27:40
OS: Windows 10 Professional (build: 19045, 64 bit)
Tags:
generated-doc
Indicators:
MIME: application/x-msi
File info: Composite Document File V2 Document, Little Endian, Os: Windows, Version 6.2, MSI Installer, Code page: 1252, Title: Installation Database, Subject: This setup package will Install BvSsh version 1.0, Author: BvSsh, Keywords: Installer, Comments: This installer database contains the logic and data required to install BvSsh., Template: Intel;1033, Revision Number: {1082E6B6-B875-4E7C-BDC6-8A293810FEF8}, Create Time/Date: Sun Jun 30 07:15:00 2024, Last Saved Time/Date: Sun Jun 30 07:15:00 2024, Number of Pages: 200, Number of Words: 10, Name of Creating Application: Windows Installer XML Toolset (3.11.0.1528), Security: 2
MD5:

19616C7FEB7B674FB8B6FB192F2A75FF

SHA1:

B1BF2C3E92B0D0A2835870599346C7B64480D827

SHA256:

BF5C7562E8B9CBA0BF038B36FB03E451CDB7E942EA34AC79D31C9C115111CC30

SSDEEP:

24576:TEVWYTMnuPJYWiWPSlEddKpUXIkoPO/X2r6ut:4VWYTMnuPJYHWPSlEddKpUXIkoPO/X2h

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Create files in the Startup directory

      • msiexec.exe (PID: 6664)

  • SUSPICIOUS

    • Executes as Windows Service

      • VSSVC.exe (PID: 6712)

    • Drops the executable file immediately after the start

      • msiexec.exe (PID: 6572)
      • msiexec.exe (PID: 6664)

    • Reads security settings of Internet Explorer

      • BvSsh.exe (PID: 5540)

    • Reads the Windows owner or organization settings

      • msiexec.exe (PID: 6664)

    • Connects to the server without a host name

      • BvSsh.exe (PID: 5540)

  • INFO

    • Reads the computer name

      • msiexec.exe (PID: 6664)
      • BvSsh.exe (PID: 5540)

    • Checks supported languages

      • msiexec.exe (PID: 6664)
      • BvSsh.exe (PID: 5540)

    • Creates files or folders in the user directory

      • msiexec.exe (PID: 6664)

    • Executable content was dropped or overwritten

      • msiexec.exe (PID: 6664)

    • Creates files in the program directory

      • BvSsh.exe (PID: 5540)

    • Checks proxy server information

      • BvSsh.exe (PID: 5540)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.msi | Microsoft Installer (100)

EXIF

FlashPix

CodePage: Windows Latin 1 (Western European)
Title: Installation Database
Subject: This setup package will Install BvSsh version 1.0
Author: BvSsh
Keywords: Installer
Comments: This installer database contains the logic and data required to install BvSsh.
Template: Intel;1033
RevisionNumber: {1082E6B6-B875-4E7C-BDC6-8A293810FEF8}
CreateDate: 2024:07:31 07:15:00
ModifyDate: 2024:07:31 07:15:00
Pages: 200
Words: 10
Software: Windows Installer XML Toolset (3.11.0.1528)
Security: Read-only recommended
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
132
Monitored processes
6
Malicious processes
2
Suspicious processes
0

Behavior graph

Click at the process to see the details
start msiexec.exe no specs msiexec.exe vssvc.exe no specs srtasks.exe no specs conhost.exe no specs bvssh.exe

Process information

PID
CMD
Path
Indicators
Parent process
1128C:\WINDOWS\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:11C:\Windows\System32\SrTasks.exe—msiexec.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Microsoft® Windows System Protection background tasks.
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\srtasks.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
5540"C:\ProgramData\BvSsh\BvSsh.exe"C:\ProgramData\BvSsh\BvSsh.exe
msiexec.exe
User:
admin
Integrity Level:
MEDIUM
Description:
AutoHotkey Unicode 32-bit
Version:
1.1.22.09
Modules
Images
c:\programdata\bvssh\bvssh.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\psapi.dll
c:\windows\syswow64\user32.dll
6152\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—SrTasks.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
6572"C:\Windows\System32\msiexec.exe" /i C:\Users\admin\AppData\Local\Temp\bf5c7562e8b9cba0bf038b36fb03e451cdb7e942ea34ac79d31c9c115111cc30.msiC:\Windows\System32\msiexec.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows® installer
Exit code:
0
Version:
5.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\msiexec.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\aclayers.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
6664C:\WINDOWS\system32\msiexec.exe /VC:\Windows\System32\msiexec.exe
services.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Windows® installer
Version:
5.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\msiexec.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\aclayers.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
6712C:\WINDOWS\system32\vssvc.exeC:\Windows\System32\VSSVC.exe—services.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Microsoft® Volume Shadow Copy Service
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\vssvc.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
Total events
7 343
Read events
7 118
Write events
206
Delete events
19

Modification events

(PID) Process:(6664) msiexec.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\SystemRestore
Operation:writeName:SrCreateRp (Enter)
Value:
4800000000000000ED36DC93EAE9DA01081A0000281A0000D50700000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(6664) msiexec.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\SPP
Operation:writeName:SppGetSnapshots (Enter)
Value:
4800000000000000079BDE93EAE9DA01081A0000281A0000D20700000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(6664) msiexec.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\SPP
Operation:writeName:SppGetSnapshots (Leave)
Value:
4800000000000000C3BE2394EAE9DA01081A0000281A0000D20700000100000000000000000000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(6664) msiexec.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\SPP
Operation:writeName:SppEnumGroups (Enter)
Value:
4800000000000000C3BE2394EAE9DA01081A0000281A0000D10700000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(6664) msiexec.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\SPP
Operation:writeName:SppEnumGroups (Leave)
Value:
480000000000000037852894EAE9DA01081A0000281A0000D10700000100000000000000010000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(6664) msiexec.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\SPP
Operation:writeName:SppCreate (Enter)
Value:
4800000000000000B2E82A94EAE9DA01081A0000281A0000D00700000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(6664) msiexec.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SPP
Operation:writeName:LastIndex
Value:
11
(PID) Process:(6664) msiexec.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\SPP
Operation:writeName:SppGatherWriterMetadata (Enter)
Value:
48000000000000001504BB94EAE9DA01081A0000281A0000D30700000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(6664) msiexec.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\VssapiPublisher
Operation:writeName:IDENTIFY (Enter)
Value:
48000000000000000B68BD94EAE9DA01081A0000C01A0000E80300000100000000000000000000002B1A12B2D261D4489CB1B4B3399135C400000000000000000000000000000000
(PID) Process:(6712) VSSVC.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\Shadow Copy Optimization Writer
Operation:writeName:IDENTIFY (Enter)
Value:
48000000000000000DE3C694EAE9DA01381A0000DC1A0000E80300000100000001000000000000000000000000000000000000000000000000000000000000000000000000000000
Executable files
2
Suspicious files
17
Text files
1
Unknown types
2

Dropped files

PID
Process
Filename
Type
6664msiexec.exeC:\System Volume Information\SPP\metadata-2 —
MD5:—
SHA256:—
6664msiexec.exeC:\System Volume Information\SPP\snapshot-2binary
MD5:D00F4AD607FB7737CDE4CC27D085F185
SHA256:8FFD9DCA8E9228AA9907505578416FC43D9FB1C34D90D94DCEE42F1DF3B60D0D
6664msiexec.exeC:\Windows\Temp\~DF392F8F31CD1563D4.TMPbinary
MD5:8C2564F541A02F45FDFF19FA9C2D0E98
SHA256:A8C60D01BB82F7D64FDA81983F2BE99EFCD935168FC652586AAF84FAEBBF0E18
6664msiexec.exeC:\Windows\Installer\inprogressinstallinfo.ipibinary
MD5:8C2564F541A02F45FDFF19FA9C2D0E98
SHA256:A8C60D01BB82F7D64FDA81983F2BE99EFCD935168FC652586AAF84FAEBBF0E18
6664msiexec.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\BvSsh.lnkbinary
MD5:0B9E539252D6E5948D27AA1CBF03AACB
SHA256:7A9125D39A5D403B9284E96C2A58C02DBF285F15C4ECCA41746ACF220826D0A7
6664msiexec.exeC:\Windows\Temp\~DF869C047E65B4C2F1.TMPbinary
MD5:8C2564F541A02F45FDFF19FA9C2D0E98
SHA256:A8C60D01BB82F7D64FDA81983F2BE99EFCD935168FC652586AAF84FAEBBF0E18
6664msiexec.exeC:\Windows\Temp\~DF04C30504C70A7AED.TMPbinary
MD5:100E6AC842EE513C46BE9677C3F9E189
SHA256:AA51826D69B472CD36DF17256CB2BEFDDBC9197799B93E423DBE78D6B956BDE5
6664msiexec.exeC:\Windows\Temp\~DF03803A6C14FD9AC8.TMPbinary
MD5:8C2564F541A02F45FDFF19FA9C2D0E98
SHA256:A8C60D01BB82F7D64FDA81983F2BE99EFCD935168FC652586AAF84FAEBBF0E18
6664msiexec.exeC:\Windows\Temp\~DF82806589DCBA1510.TMPbinary
MD5:51EC741BBA3203CD4A2B83AEF2EF86AB
SHA256:093EFA170896D23018B5A8F6E18CFCEEAF85B4961F6C2995592C0C55C225F29B
6664msiexec.exeC:\Windows\Temp\~DF9A9885827F585BFF.TMPgmc
MD5:BF619EAC0CDF3F68D496EA9344137E8B
SHA256:076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
66
TCP/UDP connections
41
DNS requests
16
Threats
3

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
5540
BvSsh.exe
GET
404
192.64.86.56:80
http://192.64.86.56/649566714
unknown
—
—
—
5540
BvSsh.exe
GET
404
192.64.86.56:80
http://192.64.86.56/649566714
unknown
—
—
—
5540
BvSsh.exe
GET
404
192.64.86.56:80
http://192.64.86.56/649566714
unknown
—
—
—
5540
BvSsh.exe
GET
404
192.64.86.56:80
http://192.64.86.56/649566714
unknown
—
—
—
5540
BvSsh.exe
GET
404
192.64.86.56:80
http://192.64.86.56/649566714
unknown
—
—
—
5540
BvSsh.exe
GET
404
192.64.86.56:80
http://192.64.86.56/649566714
unknown
—
—
—
5540
BvSsh.exe
GET
404
192.64.86.56:80
http://192.64.86.56/649566714
unknown
—
—
—
5336
SearchApp.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAI5PUjXAkJafLQcAAsO18o%3D
unknown
—
—
whitelisted
5540
BvSsh.exe
GET
404
192.64.86.56:80
http://192.64.86.56/649566714
unknown
—
—
—
5336
SearchApp.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEA77flR%2B3w%2FxBpruV2lte6A%3D
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
3888
svchost.exe
239.255.255.250:1900
—
—
—
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
4016
svchost.exe
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
—
—
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
4324
svchost.exe
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
4016
svchost.exe
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
unknown
5540
BvSsh.exe
192.64.86.56:80
—
IS-AS-1
US
unknown
5336
SearchApp.exe
2.23.209.182:443
www.bing.com
Akamai International B.V.
GB
unknown
5336
SearchApp.exe
2.23.209.130:443
th.bing.com
Akamai International B.V.
GB
unknown

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 51.124.78.146
  • 40.127.240.158
whitelisted
google.com
  • 142.250.185.142
whitelisted
www.bing.com
  • 2.23.209.182
whitelisted
th.bing.com
  • 2.23.209.130
whitelisted
browser.pipe.aria.microsoft.com
  • 51.11.192.49
whitelisted
ocsp.digicert.com
  • 192.229.221.95
whitelisted
r.bing.com
  • 2.23.209.182
whitelisted
fp.msedge.net
  • 204.79.197.222
whitelisted
wac-ring.msedge.net
  • 52.108.8.254
unknown
c-ring.msedge.net
  • 13.107.4.254
unknown

Threats

PID
Process
Class
Message
—
—
A Network Trojan was detected
ET USER_AGENTS Suspicious User-Agent (AutoHotkey)
—
—
A Network Trojan was detected
ET USER_AGENTS Suspicious User-Agent (AutoHotkey)
—
—
A Network Trojan was detected
ET USER_AGENTS Suspicious User-Agent (AutoHotkey)
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
bf5c7562e8b9cba0bf038b36fb03e451cdb7e942ea34ac79d31c9c115111cc30.msi