File name:

caustics-generator-pro-32_619456.msi

Full analysis: https://app.any.run/tasks/35b986aa-c885-4da5-9262-2058335f10da
Verdict: Malicious activity
Analysis date: November 04, 2020, 08:01:32
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
generated-doc
Indicators:
MIME: application/x-msi
File info: Composite Document File V2 Document, Little Endian, Os: Windows, Version 6.2, MSI Installer, Code page: 1252, Title: Installation Database, Subject: This setup package will Install Native Gagea version 1.6.7.3, Author: Gagea Native Soft, Keywords: Installer, Comments: This installer database contains the logic and data required to install Native Gagea., Template: Intel;1033, Revision Number: {40FD75EC-E12F-47CD-A29D-B8EDC3A01371}, Create Time/Date: Fri Oct 30 14:23:10 2020, Last Saved Time/Date: Fri Oct 30 14:23:10 2020, Number of Pages: 200, Number of Words: 10, Name of Creating Application: Windows Installer XML Toolset (3.11.0.1528), Security: 2
MD5:

5162EE9FE89B5750FCA06D1F81C58835

SHA1:

BF6FF0B0B88D86D60F1140D4FB29E6D2EAE818EF

SHA256:

C34C4678FDA1C32E2C2F0516FD38028C96775AA35FA364D2DA25E98CBEA684BF

SSDEEP:

24576:WCxKZr+O/bwc/+gaJR5ZwBml12jHpLBjhhHo9UdBi:WCARVbwcXatgbjJLVT0K

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Application was dropped or rewritten from another process

      • GageaNative.exe (PID: 1780)
      • GageaNative.exe (PID: 2844)
      • GagealNative.exe (PID: 380)

    • Loads dropped or rewritten executable

      • GagealNative.exe (PID: 380)

  • SUSPICIOUS

    • Creates files in the user directory

      • msiexec.exe (PID: 1548)
      • GageaNative.exe (PID: 2844)
      • GageaNative.exe (PID: 1780)

    • Creates files in the program directory

      • GageaNative.exe (PID: 1780)
      • GageaNative.exe (PID: 2844)

    • Executable content was dropped or overwritten

      • msiexec.exe (PID: 1548)
      • GagealNative.exe (PID: 380)
      • GageaNative.exe (PID: 2844)

    • Application launched itself

      • GageaNative.exe (PID: 1780)
      • cmd.exe (PID: 3768)

    • Starts CMD.EXE for commands execution

      • GageaNative.exe (PID: 2844)
      • cmd.exe (PID: 3768)

    • Starts CMD.EXE for self-deleting

      • GageaNative.exe (PID: 2844)
      • cmd.exe (PID: 3768)

  • INFO

    • Manual execution by user

      • explorer.exe (PID: 2364)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.msi | Microsoft Installer (100)

EXIF

FlashPix

CodePage: Windows Latin 1 (Western European)
Title: Installation Database
Subject: This setup package will Install Native Gagea version 1.6.7.3
Author: Gagea Native Soft
Keywords: Installer
Comments: This installer database contains the logic and data required to install Native Gagea.
Template: Intel;1033
RevisionNumber: {40FD75EC-E12F-47CD-A29D-B8EDC3A01371}
CreateDate: 2020:10:30 14:23:10
ModifyDate: 2020:10:30 14:23:10
Pages: 200
Words: 10
Software: Windows Installer XML Toolset (3.11.0.1528)
Security: Read-only recommended
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
49
Monitored processes
10
Malicious processes
4
Suspicious processes
0

Behavior graph

Click at the process to see the details
start drop and start drop and start msiexec.exe no specs msiexec.exe gageanative.exe no specs gageanative.exe gagealnative.exe cmd.exe no specs timeout.exe no specs cmd.exe no specs cmd.exe no specs explorer.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
380"C:\Program Files\GageaNativezzsInstall\GagealNative.exe" 56241527714512 NK9N1+hzCmkUcZotoFWeuyBCy+voBSRvszKjUFW9wrtU7rGadopcy0dA1vv5ker7YS9RqtfpOMNYseuiPjTrkCfEn+R9Sjf3785a4jpYmctmP+HQ0RuRs4/pYcCUPacI4QKAAsjgH7p+fQNBvNU6lp7V5hGRiTWVb7Yoe2Wczc83MTCVi7T7z0ilrFM1eH+unrwTyAQtdLxluYI85ufdIQljDKD9NW8fk0YyZ82PS6o= sCan1cuVp+OiTy/IDcm73z3jisepLqKq8SDt+tlWwaY6PurfHEDd9fEfMgWk1A98p78lUXRF0xilCmXK6/6kAg==C:\Program Files\GageaNativezzsInstall\GagealNative.exe
GageaNative.exe
User:
admin
Company:
Don HO don.h@free.fr
Integrity Level:
HIGH
Description:
Notepad++ : a free (GNU) source code editor
Exit code:
0
Version:
7.8.8.0
Modules
Images
c:\program files\gageanativezzsinstall\gagealnative.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\shell32.dll
756cmd /d /c del /f /q "C:\Users\admin\AppData\Local\Temp\caustics-generator-pro-32_619456.msi"C:\Windows\system32\cmd.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\cmd.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\winbrand.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
1548C:\Windows\system32\msiexec.exe /VC:\Windows\system32\msiexec.exe
services.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Windows® installer
Exit code:
0
Version:
5.0.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\msiexec.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
1780"C:\Users\admin\AppData\Roaming\GageaNative\GageaNative.exe" "C:\Users\admin\AppData\Local\Temp\caustics-generator-pro-32_619456.msi"C:\Users\admin\AppData\Roaming\GageaNative\GageaNative.exe—msiexec.exe
User:
admin
Integrity Level:
MEDIUM
Description:
Gagea Native Install
Exit code:
0
Version:
1.4.5.1
Modules
Images
c:\users\admin\appdata\roaming\gageanative\gageanative.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\pcwum.dll
c:\windows\system32\ws2_32.dll
2364"C:\Windows\explorer.exe" C:\Windows\explorer.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Explorer
Exit code:
1
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\explorer.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
2472"C:\Windows\System32\msiexec.exe" /i "C:\Users\admin\AppData\Local\Temp\caustics-generator-pro-32_619456.msi"C:\Windows\System32\msiexec.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows® installer
Exit code:
0
Version:
5.0.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\msiexec.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
2844"C:\Users\admin\AppData\Roaming\GageaNative\GageaNative.exe" -uac sCan1cuVp+OiTy/IDcm73z3jisepLqKq8SDt+tlWwaY6PurfHEDd9fEfMgWk1A98p78lUXRF0xilCmXK6/6kAg== C:\Users\admin\AppData\Local\Temp\caustics-generator-pro-32_619456.msiC:\Users\admin\AppData\Roaming\GageaNative\GageaNative.exe
GageaNative.exe
User:
admin
Integrity Level:
HIGH
Description:
Gagea Native Install
Exit code:
0
Version:
1.4.5.1
Modules
Images
c:\users\admin\appdata\roaming\gageanative\gageanative.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\pcwum.dll
c:\windows\system32\ws2_32.dll
2848timeout 5 C:\Windows\system32\timeout.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
timeout - pauses command processing
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\timeout.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\ws2_32.dll
c:\windows\system32\msvcrt.dll
3556cmd /d /c del /f /q "C:\Users\admin\AppData\Roaming\GageaNative\GageaNative.exe" C:\Windows\system32\cmd.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\cmd.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\winbrand.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
3768C:\Windows\system32\cmd.exe /d /c timeout 5 & cmd /d /c del /f /q "C:\Users\admin\AppData\Roaming\GageaNative\GageaNative.exe" & cmd /d /c del /f /q "C:\Users\admin\AppData\Local\Temp\caustics-generator-pro-32_619456.msi"C:\Windows\system32\cmd.exe—GageaNative.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\cmd.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\winbrand.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
Total events
910
Read events
857
Write events
41
Delete events
12

Modification events

(PID) Process:(2472) msiexec.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\13B\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(1548) msiexec.exeKey:HKEY_USERS\S-1-5-21-1302019708-1500728564-335382590-1000_CLASSES\Local Settings\MuiCache\13B\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(1548) msiexec.exeKey:HKEY_USERS\S-1-5-21-1302019708-1500728564-335382590-1000\Software\Microsoft\RestartManager\Session0000
Operation:writeName:Owner
Value:
0C06000052F6D5C180B2D601
(PID) Process:(1548) msiexec.exeKey:HKEY_USERS\S-1-5-21-1302019708-1500728564-335382590-1000\Software\Microsoft\RestartManager\Session0000
Operation:writeName:SessionHash
Value:
34B456589A61C4557CDAE9AC786441AB73C3EC4E7D5F366DD1DD26A0C710B067
(PID) Process:(1548) msiexec.exeKey:HKEY_USERS\S-1-5-21-1302019708-1500728564-335382590-1000\Software\Microsoft\RestartManager\Session0000
Operation:writeName:Sequence
Value:
1
(PID) Process:(1548) msiexec.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\InProgress
Operation:writeName:(default)
Value:
C:\Windows\Installer\157efe.ipi
(PID) Process:(1548) msiexec.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Folders
Operation:writeName:C:\Config.Msi\
Value:
(PID) Process:(1548) msiexec.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Rollback\Scripts
Operation:writeName:C:\Config.Msi\157eff.rbs
Value:
30847616
(PID) Process:(1548) msiexec.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Rollback\Scripts
Operation:writeName:C:\Config.Msi\157eff.rbsLow
Value:
3262493664
(PID) Process:(1548) msiexec.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-21-1302019708-1500728564-335382590-1000\Components\1D22B906E59E0444BA41A7C12779FE99
Operation:writeName:1D22B906E59E0444BA41A7C1050378CD
Value:
01:\Software\WixSharp\Used\
Executable files
4
Suspicious files
5
Text files
0
Unknown types
0

Dropped files

PID
Process
Filename
Type
1548msiexec.exeC:\Users\admin\AppData\Local\Temp\~DF60B79B837623FDA6.TMP —
MD5:—
SHA256:—
1548msiexec.exeC:\Windows\Installer\MSI80A3.tmp —
MD5:—
SHA256:—
1548msiexec.exeC:\Config.Msi\157eff.rbs —
MD5:—
SHA256:—
1548msiexec.exeC:\Users\admin\AppData\Local\Temp\~DFEEBA0B2C8CABD7D5.TMP —
MD5:—
SHA256:—
1548msiexec.exeC:\Windows\Installer\157efe.ipibinary
MD5:—
SHA256:—
1548msiexec.exeC:\Users\admin\AppData\Roaming\GageaNative\GageaNative.exeexecutable
MD5:—
SHA256:—
2844GageaNative.exeC:\Program Files\GageaNativezzsInstall\GagealNative.exeexecutable
MD5:—
SHA256:—
1548msiexec.exeC:\Windows\Installer\157efd.msiexecutable
MD5:—
SHA256:—
1780GageaNative.exeC:\ProgramData\okle\gratsphobinary
MD5:00A5033694B6E94D8078EF2535036E09
SHA256:4DD388E61295C6B3F52937C142468B736B18D46EB878C28D15E202E84FD81C6F
2844GageaNative.exeC:\ProgramData\okle\gratsphobinary
MD5:00A5033694B6E94D8078EF2535036E09
SHA256:4DD388E61295C6B3F52937C142468B736B18D46EB878C28D15E202E84FD81C6F
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
6
DNS requests
6
Threats
0

HTTP requests

No HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
2844
GageaNative.exe
172.67.75.195:443
onehonorapp.com
—
US
unknown
2844
GageaNative.exe
104.26.9.181:443
onehonorapp.com
Cloudflare Inc
US
unknown

DNS requests

Domain
IP
Reputation
onehonorapp.com
  • 104.26.9.181
  • 172.67.75.195
  • 104.26.8.181
unknown
dns.msftncsi.com
  • 131.107.255.255
shared

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
caustics-generator-pro-32_619456.msi