File name:

Agent-Core-Windows-10.0.0-3240.i386.msi

Full analysis: https://app.any.run/tasks/6afbdcaa-705a-43e4-bb56-04fc4b782d1d
Verdict: Malicious activity
Analysis date: February 06, 2019, 15:27:33
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
generated-doc
Indicators:
MIME: application/x-msi
File info: Composite Document File V2 Document, Little Endian, Os: Windows, Version 6.1, MSI Installer, Code page: 950, Title: Installation Database, Subject: Trend Micro Deep Security Agent, Author: q, Keywords: Installer Firewall DPI IDS IPS Integrity-Monitoring Log-Inspection, Comments: w{w]t Deep Security Agent wM, Create Time/Date: Tue Jan 29 02:44:46 2019, Name of Creating Application: Windows Installer XML Toolset (3.10.3.3007), Security: 2, Template: Intel;1033, Last Saved By: Intel;1028, Revision Number: {40B647BE-5F0F-42F3-A862-78870786F8F0}127.127.32767;{9E9C33D7-CCD2-4BDC-A540-1417E3880CEB}127.127.32767;{7D80D986-A5B6-4A74-BF95-9DD7C2B43980}, Number of Pages: 300, Number of Characters: 0
MD5:

48762C47EEDB201A56847D31C91BA071

SHA1:

69E2B946A7DEFF5F3E5C6D237801759BCE7CF3B6

SHA256:

CD48312182843B0FB94A41E36EE0E4F5A94A264888F9A12C68001684B351603C

SSDEEP:

98304:gjlHGBzETDJcUtkF2zNCAaaWGvCaLv+PDz29MIsZXSfT2TQue03USgVdLi:g5HOzETttkFx7c2HDfS0Q3Vw

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Application was dropped or rewritten from another process

      • Notifier.exe (PID: 2572)
      • Notifier.exe (PID: 3024)
      • ds_monitor.exe (PID: 3944)
      • dsa.exe (PID: 2056)
      • dsa.exe (PID: 2380)

    • Loads dropped or rewritten executable

      • ds_monitor.exe (PID: 3944)
      • dsa.exe (PID: 2380)
      • dsa.exe (PID: 2056)

  • SUSPICIOUS

    • Changes the autorun value in the registry

      • msiexec.exe (PID: 2396)

    • Executable content was dropped or overwritten

      • msiexec.exe (PID: 2396)

    • Creates files in the program directory

      • Notifier.exe (PID: 2572)
      • dsa.exe (PID: 2380)
      • dsa.exe (PID: 2056)

  • INFO

    • Application launched itself

      • msiexec.exe (PID: 2396)

    • Creates a software uninstall entry

      • msiexec.exe (PID: 2396)

    • Creates files in the program directory

      • msiexec.exe (PID: 2396)

    • Dropped object may contain Bitcoin addresses

      • msiexec.exe (PID: 2396)

    • Loads dropped or rewritten executable

      • MsiExec.exe (PID: 2840)
      • MsiExec.exe (PID: 3412)
      • MsiExec.exe (PID: 364)
      • MsiExec.exe (PID: 3120)
      • MsiExec.exe (PID: 1464)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.msi | Microsoft Windows Installer (98.5)
.msi | Microsoft Installer (100)

EXIF

FlashPix

CodePage: Windows Latin 1 (Western European)
Title: Installation Database
Subject: Trend Micro Deep Security Agent
Author: Trend Micro Inc.
Keywords: Installer Firewall DPI IDS IPS Integrity-Monitoring Log-Inspection
Comments: This installer database contains the logic and data required to install Deep Security Agent
RevisionNumber: {E893E793-8705-4AA7-9ADC-D06C2A1661AC}
CreateDate: 2019:01:29 02:43:00
ModifyDate: 2019:01:29 02:43:00
Pages: 300
Words: 2
Software: Windows Installer XML Toolset (3.10.3.3007)
Security: Read-only recommended
Template: Intel;1033,1031,3082,1036,1040,1041,1042,1049,2052,1028
LastModifiedBy: Intel;1031
Characters: -
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
52
Monitored processes
16
Malicious processes
4
Suspicious processes
1

Behavior graph

Click at the process to see the details
start msiexec.exe msiexec.exe msiexec.exe no specs msiexec.exe no specs msiexec.exe no specs notifier.exe no specs notifier.exe no specs ds_monitor.exe dsa.exe no specs cmd.exe no specs hostname.exe no specs control.exe no specs msiexec.exe no specs msiexec.exe no specs dsa.exe netcfg.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
364C:\Windows\system32\MsiExec.exe -Embedding 00FCD9FC4E27AD7D57C0F5DBC152DC20 CC:\Windows\system32\MsiExec.exe—msiexec.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows® installer
Exit code:
0
Version:
5.0.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\msiexec.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
1464C:\Windows\system32\MsiExec.exe -Embedding CF42D7C70E7803F712178DDF5146A0BD M Global\MSI0000C:\Windows\system32\MsiExec.exe—msiexec.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Windows® installer
Exit code:
0
Version:
5.0.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\msiexec.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
2056"C:\Program Files\Trend Micro\Deep Security Agent\dsa.exe" -a uninstall -w "HKLM\Software\TrendMicro\Deep Security Agent\DataFolder" -e "C:\Program Files\Trend Micro\Deep Security Agent\ext\."C:\Program Files\Trend Micro\Deep Security Agent\dsa.exe
MsiExec.exe
User:
SYSTEM
Company:
Trend Micro Inc.
Integrity Level:
SYSTEM
Description:
Deep Security Agent
Exit code:
0
Version:
10.0.0.3240
Modules
Images
c:\program files\trend micro\deep security agent\dsa.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\ws2_32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\nsi.dll
c:\program files\trend micro\deep security agent\libeay32.dll
c:\windows\system32\gdi32.dll
2380"C:\Program Files\Trend Micro\Deep Security Agent\dsa.exe" -a "ds_agent" -b -i -w "HKLM\Software\TrendMicro\Deep Security Agent\DataFolder" -e "C:\Program Files\Trend Micro\Deep Security Agent\ext\."C:\Program Files\Trend Micro\Deep Security Agent\dsa.exe—services.exe
User:
SYSTEM
Company:
Trend Micro Inc.
Integrity Level:
SYSTEM
Description:
Deep Security Agent
Exit code:
0
Version:
10.0.0.3240
Modules
Images
c:\program files\trend micro\deep security agent\dsa.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\ws2_32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\nsi.dll
c:\program files\trend micro\deep security agent\libeay32.dll
c:\windows\system32\gdi32.dll
2396C:\Windows\system32\msiexec.exe /VC:\Windows\system32\msiexec.exe
services.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Windows® installer
Exit code:
0
Version:
5.0.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\msiexec.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
2572"C:\Program Files\Trend Micro\Deep Security Agent\Notifier.exe" -serviceC:\Program Files\Trend Micro\Deep Security Agent\Notifier.exe—services.exe
User:
SYSTEM
Company:
Trend Micro Inc.
Integrity Level:
SYSTEM
Description:
Deep Security Notifier
Exit code:
0
Version:
10.0.0.3240
Modules
Images
c:\program files\trend micro\deep security agent\notifier.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
2768"netcfg.exe" -u tbimdsaC:\Windows\system32\netcfg.exe—MsiExec.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
WinPE network installer
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\netcfg.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\ole32.dll
c:\windows\system32\gdi32.dll
2840C:\Windows\system32\MsiExec.exe -Embedding D94D342432BBAF51472124F1338EE15EC:\Windows\system32\MsiExec.exe—msiexec.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows® installer
Exit code:
0
Version:
5.0.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\msiexec.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
3024"C:\Program Files\Trend Micro\Deep Security Agent\Notifier.exe"C:\Program Files\Trend Micro\Deep Security Agent\Notifier.exe—Notifier.exe
User:
admin
Company:
Trend Micro Inc.
Integrity Level:
MEDIUM
Description:
Deep Security Notifier
Exit code:
0
Version:
10.0.0.3240
Modules
Images
c:\program files\trend micro\deep security agent\notifier.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
3088control.exeC:\Windows\system32\control.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Control Panel
Exit code:
1
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\control.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
Total events
1 328
Read events
662
Write events
417
Delete events
249

Modification events

(PID) Process:(3232) msiexec.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\5F\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(2396) msiexec.exeKey:HKEY_USERS\S-1-5-21-1302019708-1500728564-335382590-1000_CLASSES\Local Settings\MuiCache\5F\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(2396) msiexec.exeKey:HKEY_USERS\S-1-5-21-1302019708-1500728564-335382590-1000\Software\Microsoft\RestartManager\Session0000
Operation:writeName:Owner
Value:
5C0900007673069130BED401
(PID) Process:(2396) msiexec.exeKey:HKEY_USERS\S-1-5-21-1302019708-1500728564-335382590-1000\Software\Microsoft\RestartManager\Session0000
Operation:writeName:SessionHash
Value:
ECE010BBF8CEBDA76D9BBEDA5881F3D63689AE9BBF8C7355E477E54F63399604
(PID) Process:(2396) msiexec.exeKey:HKEY_USERS\S-1-5-21-1302019708-1500728564-335382590-1000\Software\Microsoft\RestartManager\Session0000
Operation:writeName:Sequence
Value:
1
(PID) Process:(2396) msiexec.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\InProgress
Operation:writeName:
Value:
C:\Windows\Installer\24d023.ipi
(PID) Process:(2396) msiexec.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Rollback\Scripts
Operation:writeName:C:\Config.Msi\24d024.rbs
Value:
30719536
(PID) Process:(2396) msiexec.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Rollback\Scripts
Operation:writeName:C:\Config.Msi\24d024.rbsLow
Value:
2521705344
(PID) Process:(2396) msiexec.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\DB94759B5030A3248B34CAA6A46B58B4
Operation:writeName:EB746B04F0F53F248A26877870688F0F
Value:
C:\Program Files\Trend Micro\Deep Security Agent\eula.html
(PID) Process:(2396) msiexec.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\515CD92148DB7CC43B967911C7709441
Operation:writeName:EB746B04F0F53F248A26877870688F0F
Value:
02:\SOFTWARE\Microsoft\Windows\CurrentVersion\QualityCompat\cadca5fe-87d3-4b96-b7fb-a231484277cc
Executable files
76
Suspicious files
31
Text files
131
Unknown types
4

Dropped files

PID
Process
Filename
Type
3232msiexec.exeC:\Users\admin\AppData\Local\Temp\Cab7AFD.tmp —
MD5:—
SHA256:—
3232msiexec.exeC:\Users\admin\AppData\Local\Temp\Tar7AFE.tmp —
MD5:—
SHA256:—
3232msiexec.exeC:\Users\admin\AppData\Local\Temp\Cab7B0E.tmp —
MD5:—
SHA256:—
3232msiexec.exeC:\Users\admin\AppData\Local\Temp\Tar7B0F.tmp —
MD5:—
SHA256:—
3232msiexec.exeC:\Users\admin\AppData\Local\Temp\MSIB6E1.tmp —
MD5:—
SHA256:—
3232msiexec.exeC:\Users\admin\AppData\Local\Temp\MSICBC2.tmp —
MD5:—
SHA256:—
2396msiexec.exeC:\Windows\Installer\24d022.msi —
MD5:—
SHA256:—
2396msiexec.exeC:\Users\admin\AppData\Local\Temp\CabD0BE.tmp —
MD5:—
SHA256:—
2396msiexec.exeC:\Users\admin\AppData\Local\Temp\TarD0BF.tmp —
MD5:—
SHA256:—
2396msiexec.exeC:\Users\admin\AppData\Local\Temp\CabD0D0.tmp —
MD5:—
SHA256:—
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
1
TCP/UDP connections
2
DNS requests
1
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
2396
msiexec.exe
GET
200
93.184.221.240:80
http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
US
compressed
55.2 Kb
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
2396
msiexec.exe
93.184.221.240:80
www.download.windowsupdate.com
MCI Communications Services, Inc. d/b/a Verizon Business
US
whitelisted
3232
msiexec.exe
93.184.221.240:80
www.download.windowsupdate.com
MCI Communications Services, Inc. d/b/a Verizon Business
US
whitelisted

DNS requests

Domain
IP
Reputation
www.download.windowsupdate.com
  • 93.184.221.240
whitelisted

Threats

No threats detected
Process
Message
ds_monitor.exe
ds_monitor
ds_monitor.exe
ServiceMain_
ds_monitor.exe
Setting ds_monitor state to 2
ds_monitor.exe
Setting ds_monitor state to 4
ds_monitor.exe
ds_agent's status: 4
ds_monitor.exe
ds_notifier's status: 4
ds_monitor.exe
ServiceCtrl: 1
ds_monitor.exe
Setting ds_monitor state to 3
ds_monitor.exe
Setting ds_monitor state to 1
dsa.exe
..\..\src\msw\window.cpp(502): 'DestroyWindow' failed with error 0x00000578 (invalid window handle.).
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
Agent-Core-Windows-10.0.0-3240.i386.msi