File name:

msn-7.0.0820-tr.exe

Full analysis: https://app.any.run/tasks/79ae6a41-f9ef-49c0-aeed-7517c77fd2e6
Verdict: Malicious activity
Analysis date: April 14, 2020, 13:37:26
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386, for MS Windows, MS CAB-Installer self-extracting archive
MD5:

FC24BADE7FDA71096B790455158E565C

SHA1:

473F996D1AA24CD2859D75DB711AAB63FCAE62BE

SHA256:

CBE80471AAD9277968F9B1E1252371402A0D0EDF6657BFFFE13194AD6B2723F8

SSDEEP:

196608:sPikz4UmHxeTGtovDfz3InlMD/QTMvKzFpWRdEFgVa7hS1ueBC7Iy8:sPD4qdLc4/V4WYgOvLh8

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Loads dropped or rewritten executable

      • bootstrap.exe (PID: 348)
      • msnmsgr.exe (PID: 1784)
      • mtbs.exe (PID: 3508)
      • iexplore.exe (PID: 3120)

    • Application was dropped or rewritten from another process

      • msnsearch.exe (PID: 3720)
      • bootstrap.exe (PID: 348)
      • msnmsgr.exe (PID: 1784)
      • mtbs.exe (PID: 3508)
      • mtbs.exe (PID: 3096)

    • Changes the autorun value in the registry

      • msnsearch.exe (PID: 3720)
      • msn-7.0.0820-tr.exe (PID: 2480)
      • WinSat.exe (PID: 3340)
      • WinSat.exe (PID: 2748)
      • WinSat.exe (PID: 3072)

    • Starts Visual C# compiler

      • sdiagnhost.exe (PID: 2468)
      • sdiagnhost.exe (PID: 2996)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • msn-7.0.0820-tr.exe (PID: 2480)
      • bootstrap.exe (PID: 348)
      • msiexec.exe (PID: 3360)
      • msnsearch.exe (PID: 3720)
      • mtbs.exe (PID: 3508)
      • msdt.exe (PID: 3036)

    • Executed as Windows Service

      • vssvc.exe (PID: 3848)

    • Creates COM task schedule object

      • msiexec.exe (PID: 3360)
      • mtbs.exe (PID: 3508)

    • Changes the started page of IE

      • msiexec.exe (PID: 3360)

    • Creates files in the user directory

      • msiexec.exe (PID: 3360)

    • Changes the autorun value in the registry

      • msiexec.exe (PID: 3360)

    • Reads internet explorer settings

      • msnmsgr.exe (PID: 1784)
      • mtbs.exe (PID: 3508)

    • Executed via COM

      • iexplore.exe (PID: 3120)
      • sdiagnhost.exe (PID: 2468)
      • sdiagnhost.exe (PID: 2996)

    • Creates a software uninstall entry

      • mtbs.exe (PID: 3508)

    • Creates files in the program directory

      • mtbs.exe (PID: 3508)
      • msdt.exe (PID: 3036)

    • Application launched itself

      • msdt.exe (PID: 3860)

    • Creates files in the Windows directory

      • msdt.exe (PID: 3036)
      • WinSat.exe (PID: 3340)
      • WinSat.exe (PID: 3072)

    • Reads Internet Cache Settings

      • msnmsgr.exe (PID: 1784)

    • Low-level read access rights to disk partition

      • WinSat.exe (PID: 3340)
      • WinSat.exe (PID: 2748)
      • WinSat.exe (PID: 3072)

    • Removes files from Windows directory

      • msdt.exe (PID: 3036)

  • INFO

    • Low-level read access rights to disk partition

      • vssvc.exe (PID: 3848)

    • Loads dropped or rewritten executable

      • MsiExec.exe (PID: 3820)
      • MsiExec.exe (PID: 332)

    • Creates files in the program directory

      • msiexec.exe (PID: 3360)

    • Searches for installed software

      • msiexec.exe (PID: 3360)

    • Creates a software uninstall entry

      • msiexec.exe (PID: 3360)

    • Application launched itself

      • iexplore.exe (PID: 3120)
      • msiexec.exe (PID: 3360)

    • Reads Internet Cache Settings

      • iexplore.exe (PID: 2120)
      • iexplore.exe (PID: 3120)

    • Changes internet zones settings

      • iexplore.exe (PID: 3120)

    • Creates files in the user directory

      • iexplore.exe (PID: 2120)
      • WINWORD.EXE (PID: 3556)
      • iexplore.exe (PID: 3120)

    • Reads Microsoft Office registry keys

      • WINWORD.EXE (PID: 3556)

    • Reads internet explorer settings

      • iexplore.exe (PID: 2120)

    • Manual execution by user

      • msdt.exe (PID: 3860)
      • WINWORD.EXE (PID: 3556)

    • Reads settings of System Certificates

      • iexplore.exe (PID: 3120)
      • iexplore.exe (PID: 2120)

    • Changes settings of System certificates

      • iexplore.exe (PID: 2120)

    • Adds / modifies Windows certificates

      • iexplore.exe (PID: 2120)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win32 Executable MS Visual C++ (generic) (42.2)
.exe | Win64 Executable (generic) (37.3)
.dll | Win32 Dynamic Link Library (generic) (8.8)
.exe | Win32 Executable (generic) (6)
.exe | Generic Win/DOS Executable (2.7)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2002:08:29 13:23:17+02:00
PEType: PE32
LinkerVersion: 7
CodeSize: 34816
InitializedDataSize: 10801152
UninitializedDataSize: -
EntryPoint: 0x5ae4
OSVersion: 5.1
ImageVersion: 5.1
SubsystemVersion: 4
Subsystem: Windows GUI
FileVersionNumber: 6.0.2800.1106
ProductVersionNumber: 6.0.2800.1106
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Windows NT 32-bit
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: Turkish
CharacterSet: Unicode
CompanyName: Microsoft Corporation
FileDescription: Win32 Kabin Ayıklayıcısı
FileVersion: 6.00.2800.1106
InternalName: Wextract
LegalCopyright: © Microsoft Corporation. Tüm hakları saklıdır.
OriginalFileName: WEXTRACT.EXE
ProductName: Microsoft® Windows® İşletim Sistemi
ProductVersion: 6.00.2800.1106

Summary

Architecture: IMAGE_FILE_MACHINE_I386
Subsystem: IMAGE_SUBSYSTEM_WINDOWS_GUI
Compilation Date: 29-Aug-2002 11:23:17
Detected languages:
  • English - United States
  • Turkish - Turkey
Debug artifacts:
  • .pdb
CompanyName: Microsoft Corporation
FileDescription: Win32 Kabin Ayıklayıcısı
FileVersion: 6.00.2800.1106
InternalName: Wextract
LegalCopyright: © Microsoft Corporation. Tüm hakları saklıdır.
OriginalFilename: WEXTRACT.EXE
ProductName: Microsoft® Windows® İşletim Sistemi
ProductVersion: 6.00.2800.1106

DOS Header

Magic number: MZ
Bytes on last page of file: 0x0090
Pages in file: 0x0003
Relocations: 0x0000
Size of header: 0x0004
Min extra paragraphs: 0x0000
Max extra paragraphs: 0xFFFF
Initial SS value: 0x0000
Initial SP value: 0x00B8
Checksum: 0x0000
Initial IP value: 0x0000
Initial CS value: 0x0000
Overlay number: 0x0000
OEM identifier: 0x0000
OEM information: 0x0000
Address of NE header: 0x000000C8

PE Headers

Signature: PE
Machine: IMAGE_FILE_MACHINE_I386
Number of sections: 3
Time date stamp: 29-Aug-2002 11:23:17
Pointer to Symbol Table: 0x00000000
Number of symbols: 0
Size of Optional Header: 0x00E0
Characteristics:
  • IMAGE_FILE_32BIT_MACHINE
  • IMAGE_FILE_EXECUTABLE_IMAGE
  • IMAGE_FILE_LINE_NUMS_STRIPPED
  • IMAGE_FILE_LOCAL_SYMS_STRIPPED
  • IMAGE_FILE_RELOCS_STRIPPED

Sections

Name
Virtual Address
Virtual Size
Raw Size
Charateristics
Entropy
.text
0x00001000
0x000086E6
0x00008800
IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
6.5734
.data
0x0000A000
0x00001BE4
0x00000400
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
4.18428
.rsrc
0x0000C000
0x00A4D000
0x00A4CC00
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
7.99962

Resources

Title
Entropy
Size
Codepage
Language
Type
1
3.45336
1016
Latin 1 / Western European
Turkish - Turkey
RT_VERSION
2
3.53793
296
Latin 1 / Western European
Turkish - Turkey
RT_ICON
63
2.8173
144
Latin 1 / Western European
Turkish - Turkey
RT_STRING
76
3.56513
1288
Latin 1 / Western European
Turkish - Turkey
RT_STRING
77
3.53457
1478
Latin 1 / Western European
Turkish - Turkey
RT_STRING
80
3.53045
1206
Latin 1 / Western European
Turkish - Turkey
RT_STRING
83
3.54802
1216
Latin 1 / Western European
Turkish - Turkey
RT_STRING
85
3.45904
818
Latin 1 / Western European
Turkish - Turkey
RT_STRING
2001
3.50539
796
Latin 1 / Western European
Turkish - Turkey
RT_DIALOG
2002
3.23759
398
Latin 1 / Western European
Turkish - Turkey
RT_DIALOG

Imports

ADVAPI32.dll
COMCTL32.dll
GDI32.dll
KERNEL32.dll
USER32.dll
VERSION.dll
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
86
Monitored processes
32
Malicious processes
10
Suspicious processes
4

Behavior graph

Click at the process to see the details
drop and start start drop and start drop and start msn-7.0.0820-tr.exe bootstrap.exe msiexec.exe msiexec.exe no specs vssvc.exe no specs msiexec.exe no specs msnsearch.exe mtbs.exe no specs msnmsgr.exe no specs mtbs.exe iexplore.exe iexplore.exe winword.exe no specs msdt.exe no specs msdt.exe sdiagnhost.exe no specs csc.exe cvtres.exe no specs csc.exe cvtres.exe no specs csc.exe cvtres.exe no specs winsat.exe winsat.exe sdiagnhost.exe no specs csc.exe cvtres.exe no specs csc.exe cvtres.exe no specs csc.exe cvtres.exe no specs winsat.exe

Process information

PID
CMD
Path
Indicators
Parent process
332C:\Windows\system32\MsiExec.exe -Embedding 76E14903C25E0FF1B65985322452C1C7C:\Windows\system32\MsiExec.exe—msiexec.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows® installer
Exit code:
0
Version:
5.0.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\msiexec.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
348C:\Users\admin\AppData\Local\Temp\IXP000.TMP\bootstrap.exeC:\Users\admin\AppData\Local\Temp\IXP000.TMP\bootstrap.exe
msn-7.0.0820-tr.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
MSN Messenger Setup Bootstrap
Exit code:
0
Version:
7.0.0820
Modules
Images
c:\users\admin\appdata\local\temp\ixp000.tmp\bootstrap.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\shell32.dll
552"C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\admin\AppData\Local\Temp\ftbnbopo.cmdline"C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe
sdiagnhost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Visual C# Command Line Compiler
Exit code:
0
Version:
8.0.50727.4927 (NetFXspW7.050727-4900)
Modules
Images
c:\windows\microsoft.net\framework\v2.0.50727\csc.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\winsxs\x86_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.4940_none_d08cc06a442b34fc\msvcr80.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\ole32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
944"C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\admin\AppData\Local\Temp\ruxl_21w.cmdline"C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe
sdiagnhost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Visual C# Command Line Compiler
Exit code:
0
Version:
8.0.50727.4927 (NetFXspW7.050727-4900)
Modules
Images
c:\windows\microsoft.net\framework\v2.0.50727\csc.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\winsxs\x86_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.4940_none_d08cc06a442b34fc\msvcr80.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\ole32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
1168C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\admin\AppData\Local\Temp\RES40AD.tmp" "c:\Users\admin\AppData\Local\Temp\CSC40AC.tmp"C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe—csc.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Microsoft® Resource File To COFF Object Conversion Utility
Exit code:
0
Version:
8.00.50727.4940 (Win7SP1.050727-5400)
Modules
Images
c:\windows\microsoft.net\framework\v2.0.50727\cvtres.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\winsxs\x86_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.4940_none_d08cc06a442b34fc\msvcr80.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\cryptsp.dll
1492"C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\admin\AppData\Local\Temp\upr1x0f3.cmdline"C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe
sdiagnhost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Visual C# Command Line Compiler
Exit code:
0
Version:
8.0.50727.4927 (NetFXspW7.050727-4900)
Modules
Images
c:\windows\microsoft.net\framework\v2.0.50727\csc.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\winsxs\x86_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.4940_none_d08cc06a442b34fc\msvcr80.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\ole32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
1784"C:\Program Files\MSN Messenger\msnmsgr.exe" C:\Program Files\MSN Messenger\msnmsgr.exe—bootstrap.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
MSN Messenger
Exit code:
0
Version:
7.0.0820
Modules
Images
c:\program files\msn messenger\msnmsgr.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
2120"C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:3120 CREDAT:275457 /prefetch:2C:\Program Files\Internet Explorer\iexplore.exe
iexplore.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Internet Explorer
Exit code:
0
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-downlevel-advapi32-l1-1-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\iertutil.dll
2468C:\Windows\System32\sdiagnhost.exe -EmbeddingC:\Windows\System32\sdiagnhost.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Scripted Diagnostics Native Host
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\wininet.dll
c:\windows\system32\normaliz.dll
c:\windows\system32\api-ms-win-downlevel-version-l1-1-0.dll
c:\windows\system32\api-ms-win-downlevel-advapi32-l1-1-0.dll
c:\windows\system32\api-ms-win-downlevel-ole32-l1-1-0.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msdt.exe
c:\windows\system32\version.dll
c:\windows\system32\cryptnet.dll
c:\windows\system32\ncrypt.dll
2480"C:\Users\admin\AppData\Local\Temp\msn-7.0.0820-tr.exe" C:\Users\admin\AppData\Local\Temp\msn-7.0.0820-tr.exe
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Win32 Kabin Ayıklayıcısı
Exit code:
0
Version:
6.00.2800.1106
Modules
Images
c:\users\admin\appdata\local\temp\msn-7.0.0820-tr.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
Total events
7 716
Read events
4 012
Write events
3 516
Delete events
188

Modification events

(PID) Process:(2480) msn-7.0.0820-tr.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce
Operation:writeName:wextract_cleanup0
Value:
rundll32.exe C:\Windows\system32\advpack.dll,DelNodeRunDLL32 "C:\Users\admin\AppData\Local\Temp\IXP000.TMP\"
(PID) Process:(3360) msiexec.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\SystemRestore
Operation:writeName:SrCreateRp (Enter)
Value:
400000000000000028D03AEF6112D601200D0000780C0000D5070000000000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(3360) msiexec.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\SPP
Operation:writeName:SppCreate (Enter)
Value:
400000000000000028D03AEF6112D601200D0000780C0000D0070000000000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(3360) msiexec.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SPP
Operation:writeName:LastIndex
Value:
34
(PID) Process:(3360) msiexec.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\SPP
Operation:writeName:SppGatherWriterMetadata (Enter)
Value:
4000000000000000681B87EF6112D601200D0000780C0000D3070000000000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(3360) msiexec.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\VssapiPublisher
Operation:writeName:IDENTIFY (Enter)
Value:
4000000000000000681B87EF6112D601200D0000280E0000E8030000010000000000000000000000B825F70A24BF0B43B95F8A5CA762BA8C0000000000000000
(PID) Process:(3848) vssvc.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\ASR Writer
Operation:writeName:IDENTIFY (Enter)
Value:
400000000000000092909CEF6112D601080F0000740D0000E8030000010000000100000000000000000000000000000000000000000000000000000000000000
(PID) Process:(3848) vssvc.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\COM+ REGDB Writer
Operation:writeName:IDENTIFY (Enter)
Value:
400000000000000092909CEF6112D601080F0000380B0000E8030000010000000100000000000000000000000000000000000000000000000000000000000000
(PID) Process:(3848) vssvc.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\Registry Writer
Operation:writeName:IDENTIFY (Enter)
Value:
400000000000000092909CEF6112D601080F0000700F0000E8030000010000000100000000000000000000000000000000000000000000000000000000000000
(PID) Process:(3848) vssvc.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\Shadow Copy Optimization Writer
Operation:writeName:IDENTIFY (Enter)
Value:
400000000000000092909CEF6112D601080F0000940C0000E8030000010000000100000000000000000000000000000000000000000000000000000000000000
Executable files
35
Suspicious files
233
Text files
366
Unknown types
130

Dropped files

PID
Process
Filename
Type
2480msn-7.0.0820-tr.exeC:\Users\admin\AppData\Local\Temp\IXP000.TMP\MsnMsgs.msi —
MD5:—
SHA256:—
3360msiexec.exeC:\System Volume Information\SPP\metadata-2 —
MD5:—
SHA256:—
3360msiexec.exeC:\Windows\Installer\a765f1.msi —
MD5:—
SHA256:—
3848vssvc.exeC: —
MD5:—
SHA256:—
3360msiexec.exeC:\Windows\Installer\MSI7891.tmp —
MD5:—
SHA256:—
3360msiexec.exeC:\Users\admin\AppData\Local\Temp\~DFF8EBB54DFD6CCF50.TMP —
MD5:—
SHA256:—
3360msiexec.exeC:\System Volume Information\SPP\snapshot-2binary
MD5:—
SHA256:—
2480msn-7.0.0820-tr.exeC:\Users\admin\AppData\Local\Temp\IXP000.TMP\bootstrap.exeexecutable
MD5:—
SHA256:—
3360msiexec.exeC:\Program Files\MSN Messenger\license.rtftext
MD5:—
SHA256:—
348bootstrap.exeC:\Users\admin\AppData\Local\Temp\MSIF9E9.tmpexecutable
MD5:—
SHA256:—
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
234
TCP/UDP connections
235
DNS requests
98
Threats
1

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
2120
iexplore.exe
GET
302
40.81.30.101:80
http://g.msn.com/8SE/1?http://toolbar.world.msn.com/installsuccess.aspx&&FORM=TOOLBR&DI=2999&CM=MsgrInstall
US
—
—
whitelisted
2120
iexplore.exe
GET
—
13.107.5.80:80
http://api.bing.com/qsml.aspx?query=www.w'ndows.c&maxwidth=32765&rowheight=20&sectionHeight=160&FORM=IE11SS&market=tr
US
—
—
whitelisted
2120
iexplore.exe
GET
200
13.107.5.80:80
http://api.bing.com/qsml.aspx?query=www.w'&maxwidth=32765&rowheight=20&sectionHeight=160&FORM=IE11SS&market=tr
US
xml
263 b
whitelisted
2120
iexplore.exe
GET
404
13.77.161.179:80
http://toolbar.msn.com/upgrade.aspx?http://toolbar.world.msn.com/installsuccess.aspx
US
html
2.83 Kb
whitelisted
2120
iexplore.exe
GET
200
13.107.5.80:80
http://api.bing.com/qsml.aspx?query=www.w&maxwidth=32765&rowheight=20&sectionHeight=160&FORM=IE11SS&market=tr
US
xml
271 b
whitelisted
2120
iexplore.exe
GET
200
13.107.5.80:80
http://api.bing.com/qsml.aspx?query=www.w'ndoww&maxwidth=32765&rowheight=20&sectionHeight=160&FORM=IE11SS&market=tr
US
xml
169 b
whitelisted
2120
iexplore.exe
GET
200
13.107.5.80:80
http://api.bing.com/qsml.aspx?query=www.w'ndows.&maxwidth=32765&rowheight=20&sectionHeight=160&FORM=IE11SS&market=tr
US
xml
260 b
whitelisted
2120
iexplore.exe
GET
200
13.107.5.80:80
http://api.bing.com/qsml.aspx?query=www.&maxwidth=32765&rowheight=20&sectionHeight=160&FORM=IE11SS&market=tr
US
xml
241 b
whitelisted
2120
iexplore.exe
GET
200
13.107.5.80:80
http://api.bing.com/qsml.aspx?query=www.w'nd&maxwidth=32765&rowheight=20&sectionHeight=160&FORM=IE11SS&market=tr
US
xml
246 b
whitelisted
2120
iexplore.exe
GET
200
13.107.5.80:80
http://api.bing.com/qsml.aspx?query=w&maxwidth=32765&rowheight=20&sectionHeight=160&FORM=IE11SS&market=tr
US
xml
241 b
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
2120
iexplore.exe
40.81.30.101:80
g.msn.com
Microsoft Corporation
US
whitelisted
3120
iexplore.exe
204.79.197.200:80
www.bing.com
Microsoft Corporation
US
whitelisted
2120
iexplore.exe
13.77.161.179:80
toolbar.msn.com
Microsoft Corporation
US
whitelisted
2120
iexplore.exe
204.79.197.200:80
www.bing.com
Microsoft Corporation
US
whitelisted
2120
iexplore.exe
20.190.129.160:443
login.microsoftonline.com
Microsoft Corporation
US
malicious
2120
iexplore.exe
40.90.137.124:443
login.live.com
Microsoft Corporation
US
unknown
2120
iexplore.exe
65.52.7.224:80
15b399b47e6ec6bd50a308d3e6a53181.clo.footprintdns.com
Microsoft Corporation
US
whitelisted
2120
iexplore.exe
52.231.32.10:80
07d39cfd12510ec9d5ad12331a8e2ead.clo.footprintdns.com
Microsoft Corporation
KR
whitelisted
2120
iexplore.exe
204.79.197.222:80
fp.msedge.net
Microsoft Corporation
US
whitelisted
2120
iexplore.exe
2.16.106.96:80
a4.bing.com
Akamai International B.V.
—
whitelisted

DNS requests

Domain
IP
Reputation
runonce.msn.com
  • 23.99.81.176
whitelisted
g.msn.com
  • 40.81.30.101
whitelisted
toolbar.msn.com
  • 13.77.161.179
  • 40.113.200.201
  • 104.215.95.187
  • 52.164.206.56
  • 40.76.4.15
  • 40.112.72.205
  • 104.215.148.63
whitelisted
api.bing.com
  • 13.107.5.80
whitelisted
www.bing.com
  • 204.79.197.200
  • 13.107.21.200
whitelisted
login.microsoftonline.com
  • 20.190.129.160
  • 40.126.1.166
  • 20.190.129.128
  • 20.190.129.17
  • 40.126.1.130
  • 40.126.1.142
  • 20.190.129.130
  • 20.190.129.19
whitelisted
login.live.com
  • 40.90.137.124
  • 40.90.137.126
  • 40.90.23.206
whitelisted
15b399b47e6ec6bd50a308d3e6a53181.clo.footprintdns.com
  • 65.52.7.224
unknown
www2.bing.com
  • 204.79.197.200
  • 13.107.21.200
whitelisted
07d39cfd12510ec9d5ad12331a8e2ead.clo.footprintdns.com
  • 52.231.32.10
unknown

Threats

PID
Process
Class
Message
2120
iexplore.exe
Generic Protocol Command Decode
SURICATA HTTP unable to match response to request
Process
Message
mtbs.exe
*** Assertion: Unknown IE Build Format (A) ***
mtbs.exe
*** Assertion: Unknown IE Major Version ***
mtbs.exe
10990 OS: 0x6, 0x1
mtbs.exe
*** Assertion: Unknown IE Major Version ***
mtbs.exe
*** Assertion: Unknown IE Major Version ***
mtbs.exe
10999 OS: 0x6, 0x1
mtbs.exe
10999 http://g.msn.com/8SE/1?http://toolbar.world.msn.com/installsuccess.aspx&&FORM=TOOLBR&DI=2999&CM=MsgrInstall
mtbs.exe
10999 Navigating to:
csc.exe
*** HR propagated: -2147024774 *** Source File: d:\iso_whid\x86fre\base\isolation\com\enumidentityattribute.cpp, line 144
csc.exe
*** HR originated: -2147024774 *** Source File: d:\iso_whid\x86fre\base\isolation\com\copyout.cpp, line 1302
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
msn-7.0.0820-tr.exe