analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
File name:

brm02907122MS.msi

Full analysis: https://app.any.run/tasks/e03f254d-4924-4227-9c04-65e3ce60ea8d
Verdict: Malicious activity
Analysis date: July 17, 2019, 13:26:20
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
generated-doc
Indicators:
MIME: application/x-msi
File info: Composite Document File V2 Document, Little Endian, Os: Windows, Version 10.0, MSI Installer, Last Printed: Fri Dec 11 11:47:44 2009, Create Time/Date: Fri Dec 11 11:47:44 2009, Last Saved Time/Date: Fri Dec 11 11:47:44 2009, Security: 0, Code page: 1252, Revision Number: {3930CA29-4053-4533-834C-EEF607ECC125}, Number of Words: 10, Subject: Games Softwares, Author: Intertainment, Name of Creating Application: Advanced Installer 15.9 build daae28bc, Template: ;1033, Comments: This installer database contains the logic and data required to install Games Softwares., Title: Installation Database, Keywords: Installer, MSI, Database, Number of Pages: 200
MD5:

1BCDA9DE99E06AC261EBD6853AE2946E

SHA1:

C7163E9CBCF1ACFD71020059BA24575A942D39A9

SHA256:

C7E162C84B6FC268D7DAE9002410E0CC02537BC214170E846154BA2B05DB0C48

SSDEEP:

24576:6NCLTLZk09TZneKRi1jUZJYSfgVUoxhrQDvw07Ra6A:6NCH1hTZeKRmjUZJYz+vw07Ra6A

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Writes to a start menu file

      • Nvidia.scr (PID: 2892)
      • EJBUWEKP.scr (PID: 2212)

    • Application was dropped or rewritten from another process

      • Nvidia.scr (PID: 2892)
      • Sony.scr (PID: 3420)
      • EJBUWEKP.scr (PID: 2212)

    • Loads dropped or rewritten executable

      • Nvidia.scr (PID: 2892)
      • EJBUWEKP.scr (PID: 2212)
      • Sony.scr (PID: 3420)
      • SearchProtocolHost.exe (PID: 2564)

  • SUSPICIOUS

    • Starts Internet Explorer

      • Nvidia.scr (PID: 2892)

    • Executable content was dropped or overwritten

      • msiexec.exe (PID: 3096)
      • MsiExec.exe (PID: 3880)
      • Sony.scr (PID: 3420)

    • Creates files in the user directory

      • Nvidia.scr (PID: 2892)
      • EJBUWEKP.scr (PID: 2212)

    • Starts application with an unusual extension

      • Sony.scr (PID: 3420)

    • Starts itself from another location

      • Sony.scr (PID: 3420)

  • INFO

    • Loads dropped or rewritten executable

      • MsiExec.exe (PID: 3880)

    • Dropped object may contain Bitcoin addresses

      • MsiExec.exe (PID: 3880)

    • Application launched itself

      • msiexec.exe (PID: 3096)
      • iexplore.exe (PID: 3172)

    • Starts application with an unusual extension

      • msiexec.exe (PID: 3096)

    • Creates a software uninstall entry

      • msiexec.exe (PID: 3096)

    • Creates files in the user directory

      • iexplore.exe (PID: 3172)
      • iexplore.exe (PID: 700)

    • Changes internet zones settings

      • iexplore.exe (PID: 3172)

    • Reads Internet Cache Settings

      • iexplore.exe (PID: 700)

    • Reads internet explorer settings

      • iexplore.exe (PID: 700)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.msi | Microsoft Windows Installer (88.6)
.mst | Windows SDK Setup Transform Script (10)
.msi | Microsoft Installer (100)

EXIF

FlashPix

Pages: 200
Keywords: Installer, MSI, Database
Title: Installation Database
Comments: This installer database contains the logic and data required to install Games Softwares.
Template: ;1033
Software: Advanced Installer 15.9 build daae28bc
LastModifiedBy: -
Author: Intertainment
Subject: Games Softwares
Words: 10
RevisionNumber: {3930CA29-4053-4533-834C-EEF607ECC125}
CodePage: Windows Latin 1 (Western European)
Security: None
ModifyDate: 2009:12:11 11:47:44
CreateDate: 2009:12:11 11:47:44
LastPrinted: 2009:12:11 11:47:44
No data.
screenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
42
Monitored processes
9
Malicious processes
3
Suspicious processes
2

Behavior graph

Click at the process to see the details
start drop and start msiexec.exe no specs msiexec.exe msiexec.exe nvidia.scr sony.scr iexplore.exe iexplore.exe ejbuwekp.scr searchprotocolhost.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
3528"C:\Windows\System32\msiexec.exe" /i "C:\Users\admin\AppData\Local\Temp\brm02907122MS.msi"C:\Windows\System32\msiexec.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows® installer
Exit code:
0
Version:
5.0.7600.16385 (win7_rtm.090713-1255)
3096C:\Windows\system32\msiexec.exe /VC:\Windows\system32\msiexec.exe
services.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Windows® installer
Version:
5.0.7600.16385 (win7_rtm.090713-1255)
3880C:\Windows\system32\MsiExec.exe -Embedding 43D9E9A7CED7DFF4D9D0A08574AFDB85C:\Windows\system32\MsiExec.exe
msiexec.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows® installer
Exit code:
0
Version:
5.0.7600.16385 (win7_rtm.090713-1255)
2892"C:\Users\admin\Documents\Intertainment\Games Softwares\Nvidia.scr"C:\Users\admin\Documents\Intertainment\Games Softwares\Nvidia.scr
msiexec.exe
User:
admin
Integrity Level:
MEDIUM
Description:
NVIDIA Smart Maximise Helper Host
Version:
6.14.10.100.03
3420"C:\Users\admin\Documents\Intertainment\Games Softwares\Sony.scr"C:\Users\admin\Documents\Intertainment\Games Softwares\Sony.scr
msiexec.exe
User:
admin
Company:
Valve Corporation
Integrity Level:
MEDIUM
Description:
steamerrorreporter.exe
Exit code:
0
Version:
05.17.44.02
3172"C:\Program Files\Internet Explorer\iexplore.exe" https://bit.ly/2YSz48NC:\Program Files\Internet Explorer\iexplore.exe
Nvidia.scr
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Internet Explorer
Version:
8.00.7600.16385 (win7_rtm.090713-1255)
700"C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:3172 CREDAT:71937C:\Program Files\Internet Explorer\iexplore.exe
iexplore.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Internet Explorer
Version:
8.00.7600.16385 (win7_rtm.090713-1255)
2212"C:\Users\admin\Documents\Intertainment\Games Softwares\EJBUWEKP.scr"C:\Users\admin\Documents\Intertainment\Games Softwares\EJBUWEKP.scr
Sony.scr
User:
admin
Company:
Valve Corporation
Integrity Level:
MEDIUM
Description:
steamerrorreporter.exe
Version:
05.17.44.02
2564"C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe8_ Global\UsGthrCtrlFltPipeMssGthrPipe8 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" C:\Windows\System32\SearchProtocolHost.exe—SearchIndexer.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Microsoft Windows Search Protocol Host
Exit code:
0
Version:
7.00.7600.16385 (win7_rtm.090713-1255)
Total events
1 460
Read events
1 284
Write events
0
Delete events
0

Modification events

No data
Executable files
11
Suspicious files
4
Text files
20
Unknown types
5

Dropped files

PID
Process
Filename
Type
3096msiexec.exeC:\Windows\Installer\MSID32F.tmp —
MD5:—
SHA256:—
3096msiexec.exeC:\Windows\Installer\MSID35F.tmp —
MD5:—
SHA256:—
3096msiexec.exeC:\Users\admin\AppData\Local\Temp\~DF4E08E1112DCB98E2.TMP —
MD5:—
SHA256:—
3096msiexec.exeC:\Windows\Installer\MSID3FD.tmp —
MD5:—
SHA256:—
3096msiexec.exeC:\Windows\Installer\MSID43D.tmp —
MD5:—
SHA256:—
3880MsiExec.exeC:\Users\admin\Documents\Intertainment\Games Softwares\Nvidia.zip.part —
MD5:—
SHA256:—
3880MsiExec.exeC:\Users\admin\Documents\Intertainment\Games Softwares\Sony.zip.part —
MD5:—
SHA256:—
3880MsiExec.exeC:\Users\admin\Documents\Intertainment\Games Softwares\vstdlib_s.dll —
MD5:—
SHA256:—
3096msiexec.exeC:\Config.Msi\17d208.rbs —
MD5:—
SHA256:—
3096msiexec.exeC:\Users\admin\AppData\Local\Temp\~DFDCC1B4710BC7E090.TMP —
MD5:—
SHA256:—
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
1
TCP/UDP connections
8
DNS requests
4
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
3172
iexplore.exe
GET
200
204.79.197.200:80
http://www.bing.com/favicon.ico
US
image
237 b
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
3172
iexplore.exe
204.79.197.200:80
www.bing.com
Microsoft Corporation
US
whitelisted
700
iexplore.exe
67.199.248.11:443
bit.ly
Bitly Inc
US
shared
700
iexplore.exe
95.101.177.32:443
www.sony.com.br
Akamai Technologies, Inc.
—
whitelisted
3880
MsiExec.exe
52.219.96.216:443
luztunner.s3.us-east-2.amazonaws.com
—
US
shared

DNS requests

Domain
IP
Reputation
luztunner.s3.us-east-2.amazonaws.com
  • 52.219.96.216
shared
bit.ly
  • 67.199.248.11
  • 67.199.248.10
shared
www.bing.com
  • 204.79.197.200
  • 13.107.21.200
whitelisted
www.sony.com.br
  • 95.101.177.32
unknown

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2024 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
brm02907122MS.msi