| File name: | 824263.msi |
| Full analysis: | https://app.any.run/tasks/261905e1-f3d3-4bac-a766-43f4045aa943 |
| Verdict: | Malicious activity |
| Analysis date: | June 26, 2025, 18:29:01 |
| OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
| Tags: | |
| Indicators: | |
| MIME: | application/x-msi |
| File info: | Composite Document File V2 Document, Little Endian, Os: Windows, Version 6.1, MSI Installer, Number of Characters: 0, Title: Installation Database for CryptoPro CADESCOM, Comments: 2.0.14660, Keywords: Installer,MSI,Database, Subject: PKIpro2: CryptoPro CADESCOM, Author: Crypto-Pro, Security: 2, Number of Pages: 200, Name of Creating Application: InstallShield 12 - Professional Edition 12.0, Last Saved Time/Date: Mon Nov 21 16:46:19 2022, Create Time/Date: Mon Nov 21 16:46:19 2022, Revision Number: {08B9EA45-B427-4C22-A257-0163EA1430A8}, Code page: 1251, Template: Intel;1049, Last Saved By: cpbuilder, Last Printed: Mon Nov 21 14:16:04 2022, Number of Words: 4 |
| MD5: | 0D5C624F066D243C2E049535E939A467 |
| SHA1: | A5D05FEDC347B77D2E5BF6451BDAD174F8B81E6E |
| SHA256: | C3B181FF49BFD9BE46F67BC609086796C4A4C854F140FCBB0F53E3F60560B1BF |
| SSDEEP: | 12288:ZgnImGaNiidRHiEOB9hgqDzbUjSKcnLVsF0fZOmQSOVU9zh2/:ZgndGh9hgqD/QSKcnLVsF0Ump8/ |
MALICIOUS
No malicious indicators.SUSPICIOUS
Starts another process probably with elevated privileges via RUNAS.EXE
- runas.exe (PID: 1268)
Application launched itself
- msiexec.exe (PID: 3656)
Executes as Windows Service
- VSSVC.exe (PID: 2948)
Reads the Windows owner or organization settings
- msiexec.exe (PID: 3656)
Creates/Modifies COM task schedule object
- msiexec.exe (PID: 3656)
- msiexec.exe (PID: 1372)
INFO
Checks supported languages
- msiexec.exe (PID: 3656)
- msiexec.exe (PID: 2804)
- msiexec.exe (PID: 3196)
- msiexec.exe (PID: 1372)
An automatically generated document
- runas.exe (PID: 1268)
Reads security settings of Internet Explorer
- msiexec.exe (PID: 2488)
Manual execution by a user
- msiexec.exe (PID: 2488)
Reads the computer name
- msiexec.exe (PID: 3656)
- msiexec.exe (PID: 2804)
- msiexec.exe (PID: 3196)
- msiexec.exe (PID: 1372)
Reads the machine GUID from the registry
- msiexec.exe (PID: 3656)
- msiexec.exe (PID: 2804)
- msiexec.exe (PID: 3196)
- msiexec.exe (PID: 1372)
Reads the software policy settings
- msiexec.exe (PID: 2488)
- msiexec.exe (PID: 3656)
The sample compiled with russian language support
- msiexec.exe (PID: 2488)
- msiexec.exe (PID: 3656)
Executable content was dropped or overwritten
- msiexec.exe (PID: 2488)
- msiexec.exe (PID: 3656)
Create files in a temporary directory
- msiexec.exe (PID: 3656)
- msiexec.exe (PID: 2488)
Creates a software uninstall entry
- msiexec.exe (PID: 1372)
- msiexec.exe (PID: 3656)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
TRiD
| .msi | | | Microsoft Windows Installer (98.5) |
|---|---|---|
| .msi | | | Microsoft Installer (100) |
EXIF
FlashPix
| Characters: | - |
|---|---|
| Title: | Installation Database for CryptoPro CADESCOM |
| Comments: | 2.0.14660 |
| Keywords: | Installer,MSI,Database |
| Subject: | PKIpro2: CryptoPro CADESCOM |
| Author: | Crypto-Pro |
| Security: | Read-only recommended |
| Pages: | 200 |
| Software: | InstallShield? 12 - Professional Edition 12.0 |
| ModifyDate: | 2022:11:21 16:46:19 |
| CreateDate: | 2022:11:21 16:46:19 |
| RevisionNumber: | {08B9EA45-B427-4C22-A257-0163EA1430A8} |
| CodePage: | Windows Cyrillic |
| Template: | Intel;1049 |
| LastModifiedBy: | cpbuilder |
| LastPrinted: | 2022:11:21 14:16:04 |
| Words: | 4 |
Total processes
43
Monitored processes
7
Malicious processes
1
Suspicious processes
1
Behavior graph
Click at the process to see the details
Process information
PID | CMD | Path | Indicators | Parent process | |||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 1268 | "C:\Windows\System32\runas.exe" /user:administrator C:\Users\admin\Desktop\824263.msi | C:\Windows\System32\runas.exe | — | explorer.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Run As Utility Exit code: 3221225786 Version: 6.1.7600.16385 (win7_rtm.090713-1255) Modules
| |||||||||||||||
| 1372 | C:\Windows\system32\MsiExec.exe -Embedding 0E121AC2D9AD437D7BBAC18EC9276D63 E Global\MSI0000 | C:\Windows\System32\msiexec.exe | — | msiexec.exe | |||||||||||
User: SYSTEM Company: Microsoft Corporation Integrity Level: SYSTEM Description: Windows® installer Exit code: 0 Version: 5.0.7600.16385 (win7_rtm.090713-1255) Modules
| |||||||||||||||
| 2488 | "C:\Windows\System32\msiexec.exe" /i "C:\Users\admin\Desktop\824263.msi" | C:\Windows\System32\msiexec.exe | explorer.exe | ||||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows® installer Exit code: 0 Version: 5.0.7600.16385 (win7_rtm.090713-1255) Modules
| |||||||||||||||
| 2804 | C:\Windows\system32\MsiExec.exe -Embedding 9F47DF8C4DD0C51B3291293851812254 C | C:\Windows\System32\msiexec.exe | — | msiexec.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows® installer Exit code: 0 Version: 5.0.7600.16385 (win7_rtm.090713-1255) Modules
| |||||||||||||||
| 2948 | C:\Windows\system32\vssvc.exe | C:\Windows\System32\VSSVC.exe | — | services.exe | |||||||||||
User: SYSTEM Company: Microsoft Corporation Integrity Level: SYSTEM Description: Microsoft® Volume Shadow Copy Service Version: 6.1.7600.16385 (win7_rtm.090713-1255) Modules
| |||||||||||||||
| 3196 | C:\Windows\system32\MsiExec.exe -Embedding B685517AA485D60F52A1F5C427C7DC81 | C:\Windows\System32\msiexec.exe | — | msiexec.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows® installer Exit code: 0 Version: 5.0.7600.16385 (win7_rtm.090713-1255) Modules
| |||||||||||||||
| 3656 | C:\Windows\system32\msiexec.exe /V | C:\Windows\System32\msiexec.exe | services.exe | ||||||||||||
User: SYSTEM Company: Microsoft Corporation Integrity Level: SYSTEM Description: Windows® installer Version: 5.0.7600.16385 (win7_rtm.090713-1255) Modules
| |||||||||||||||
Total events
9 739
Read events
9 107
Write events
620
Delete events
12
Modification events
| (PID) Process: | (2488) msiexec.exe | Key: | HKEY_CLASSES_ROOT\Local Settings\MuiCache\182\52C64B7E |
| Operation: | write | Name: | LanguageList |
Value: en-US | |||
| (PID) Process: | (3656) msiexec.exe | Key: | HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\SystemRestore |
| Operation: | write | Name: | SrCreateRp (Enter) |
Value: 4000000000000000D2A6BD3CC8E6DB01480E000038070000D5070000000000000000000000000000000000000000000000000000000000000000000000000000 | |||
| (PID) Process: | (3656) msiexec.exe | Key: | HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\SPP |
| Operation: | write | Name: | SppCreate (Enter) |
Value: 40000000000000002C09C03CC8E6DB01480E000038070000D0070000000000000000000000000000000000000000000000000000000000000000000000000000 | |||
| (PID) Process: | (3656) msiexec.exe | Key: | HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\VssapiPublisher |
| Operation: | write | Name: | IDENTIFY (Enter) |
Value: 4000000000000000FE522B3DC8E6DB01480E000058060000E803000001000000000000000000000057F638D723278E4FB5AE8BDD7A64FC500000000000000000 | |||
| (PID) Process: | (2948) VSSVC.exe | Key: | HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\COM+ REGDB Writer |
| Operation: | write | Name: | IDENTIFY (Leave) |
Value: 4000000000000000DC8C453DC8E6DB01840B0000CC0D0000E8030000000000000100000000000000000000000000000000000000000000000000000000000000 | |||
| (PID) Process: | (2948) VSSVC.exe | Key: | HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\Registry Writer |
| Operation: | write | Name: | IDENTIFY (Leave) |
Value: 400000000000000036EF473DC8E6DB01840B0000EC0A0000E8030000000000000100000000000000000000000000000000000000000000000000000000000000 | |||
| (PID) Process: | (2948) VSSVC.exe | Key: | HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\Shadow Copy Optimization Writer |
| Operation: | write | Name: | IDENTIFY (Leave) |
Value: 400000000000000036EF473DC8E6DB01840B0000200B0000E8030000000000000100000000000000000000000000000000000000000000000000000000000000 | |||
| (PID) Process: | (2948) VSSVC.exe | Key: | HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\ASR Writer |
| Operation: | write | Name: | IDENTIFY (Leave) |
Value: 400000000000000090514A3DC8E6DB01840B00006C0D0000E8030000000000000100000000000000000000000000000000000000000000000000000000000000 | |||
| (PID) Process: | (3656) msiexec.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SPP |
| Operation: | write | Name: | LastIndex |
Value: 75 | |||
| (PID) Process: | (3656) msiexec.exe | Key: | HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\SPP |
| Operation: | write | Name: | SppGatherWriterMetadata (Enter) |
Value: 4000000000000000A4F0283DC8E6DB01480E000038070000D3070000000000000000000000000000000000000000000000000000000000000000000000000000 | |||
Executable files
28
Suspicious files
6
Text files
2
Unknown types
6
Dropped files
PID | Process | Filename | Type | |
|---|---|---|---|---|
| 3656 | msiexec.exe | C:\System Volume Information\SPP\metadata-2 | — | |
MD5:— | SHA256:— | |||
| 3656 | msiexec.exe | C:\Windows\Installer\MSI7049.tmp | executable | |
MD5:4EE0B2D21027F1B034D78C658311FEEC | SHA256:025317228771264643413954FDB302EC72AD1F28DAA4BD68302FAAF7E6E21BAD | |||
| 3656 | msiexec.exe | C:\System Volume Information\SPP\snapshot-2 | binary | |
MD5:8E011BB37ECFEC378698DE39B556AFED | SHA256:6FD81DDD62ADBE0FD0579C33BF818175F5FB54BBFB3D63EE2E5260167A75B53C | |||
| 2488 | msiexec.exe | C:\Users\admin\AppData\Local\Temp\MSI364E.tmp | executable | |
MD5:4EE0B2D21027F1B034D78C658311FEEC | SHA256:025317228771264643413954FDB302EC72AD1F28DAA4BD68302FAAF7E6E21BAD | |||
| 3656 | msiexec.exe | C:\System Volume Information\SPP\OnlineMetadataCache\{d738f657-2723-4f8e-b5ae-8bdd7a64fc50}_OnDiskSnapshotProp | binary | |
MD5:8E011BB37ECFEC378698DE39B556AFED | SHA256:6FD81DDD62ADBE0FD0579C33BF818175F5FB54BBFB3D63EE2E5260167A75B53C | |||
| 3656 | msiexec.exe | C:\Windows\Installer\186e26.msi | executable | |
MD5:0D5C624F066D243C2E049535E939A467 | SHA256:C3B181FF49BFD9BE46F67BC609086796C4A4C854F140FCBB0F53E3F60560B1BF | |||
| 3656 | msiexec.exe | C:\Windows\Installer\MSI7088.tmp | executable | |
MD5:4EE0B2D21027F1B034D78C658311FEEC | SHA256:025317228771264643413954FDB302EC72AD1F28DAA4BD68302FAAF7E6E21BAD | |||
| 2488 | msiexec.exe | C:\Users\admin\AppData\Local\Temp\MSI360F.tmp | executable | |
MD5:4EE0B2D21027F1B034D78C658311FEEC | SHA256:025317228771264643413954FDB302EC72AD1F28DAA4BD68302FAAF7E6E21BAD | |||
| 3656 | msiexec.exe | C:\Windows\Installer\MSI7777.tmp | executable | |
MD5:71509152855760A32D6B233ADEC27D99 | SHA256:9D9CCCCEBD3151CA819291B995E8946FF72657B4208CED90B97B2D9BAF930DE4 | |||
| 3656 | msiexec.exe | C:\Windows\Installer\MSI7457.tmp | executable | |
MD5:71509152855760A32D6B233ADEC27D99 | SHA256:9D9CCCCEBD3151CA819291B995E8946FF72657B4208CED90B97B2D9BAF930DE4 | |||
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
6
DNS requests
1
Threats
0
HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
Connections
PID | Process | IP | Domain | ASN | CN | Reputation |
|---|---|---|---|---|---|---|
4 | System | 192.168.100.255:137 | — | — | — | whitelisted |
— | — | 224.0.0.252:5355 | — | — | — | whitelisted |
1080 | svchost.exe | 224.0.0.252:5355 | — | — | — | whitelisted |
4 | System | 192.168.100.255:138 | — | — | — | whitelisted |
DNS requests
Domain | IP | Reputation |
|---|---|---|
google.com |
| whitelisted |