| File name: | build.msi |
| Full analysis: | https://app.any.run/tasks/87739bc5-c28c-4963-a722-c9d81b873b37 |
| Verdict: | Malicious activity |
| Threats: | Stealers are a group of malicious software that are intended for gaining unauthorized access to users’ information and transferring it to the attacker. The stealer malware category includes various types of programs that focus on their particular kind of data, including files, passwords, and cryptocurrency. Stealers are capable of spying on their targets by recording their keystrokes and taking screenshots. This type of malware is primarily distributed as part of phishing campaigns. |
| Analysis date: | March 28, 2025, 14:18:05 |
| OS: | Windows 10 Professional (build: 19044, 64 bit) |
| Tags: | |
| Indicators: | |
| MIME: | application/x-msi |
| File info: | Composite Document File V2 Document, Little Endian, Os: Windows, Version 10.0, MSI Installer, Security: 0, Code page: 1252, Revision Number: {434405B6-DBCA-4C5D-94EF-CB705A6150C9}, Number of Words: 10, Subject: Klio Verfair Tools, Author: TasovCoop, Name of Creating Application: Klio Verfair Tools, Template: ;1033, Comments: This installer database contains the logic and data required to install Klio Verfair Tools., Title: Installation Database, Keywords: Installer, MSI, Database, Create Time/Date: Thu Mar 27 17:12:11 2025, Last Saved Time/Date: Thu Mar 27 17:12:11 2025, Last Printed: Thu Mar 27 17:12:11 2025, Number of Pages: 450 |
| MD5: | C6F5594658703C221D306371F6A096EC |
| SHA1: | 616251A941A5941306D950F9EE5C9E6EABB2485B |
| SHA256: | D1B74D6B4F808540B505E63F53936B2825F6935CFAFAB5E6B8DEF355F8C69C30 |
| SSDEEP: | 196608:lH4jPFyZmByveGhldN179ojCl9k2ACEOcQfAsXl3kKgEwAPjQM+oL8P:V0MZmoGcvpXl9CCEmfA8oZKj2 |
MALICIOUS
GENERIC has been found (auto)
- msiexec.exe (PID: 1348)
Actions looks like stealing of personal data
- launcher.exe (PID: 6592)
SUSPICIOUS
Reads the Windows owner or organization settings
- msiexec.exe (PID: 1348)
Reads security settings of Internet Explorer
- msiexec.exe (PID: 3676)
- launcher.exe (PID: 6592)
Drops 7-zip archiver for unpacking
- msiexec.exe (PID: 1348)
Process drops legitimate windows executable
- msiexec.exe (PID: 1348)
There is functionality for taking screenshot (YARA)
- launcher.exe (PID: 6592)
INFO
An automatically generated document
- msiexec.exe (PID: 5332)
Reads the computer name
- msiexec.exe (PID: 1348)
- msiexec.exe (PID: 3676)
- launcher.exe (PID: 6592)
Executable content was dropped or overwritten
- msiexec.exe (PID: 1348)
Checks supported languages
- msiexec.exe (PID: 3676)
- launcher.exe (PID: 6592)
- msiexec.exe (PID: 1348)
The sample compiled with english language support
- msiexec.exe (PID: 1348)
Reads Environment values
- msiexec.exe (PID: 3676)
Checks proxy server information
- msiexec.exe (PID: 3676)
Reads security settings of Internet Explorer
- BackgroundTransferHost.exe (PID: 6240)
- BackgroundTransferHost.exe (PID: 7432)
- BackgroundTransferHost.exe (PID: 7784)
Creates files or folders in the user directory
- msiexec.exe (PID: 3676)
- msiexec.exe (PID: 1348)
- launcher.exe (PID: 6592)
Reads the machine GUID from the registry
- msiexec.exe (PID: 3676)
Reads the software policy settings
- msiexec.exe (PID: 3676)
- slui.exe (PID: 5072)
The sample compiled with japanese language support
- msiexec.exe (PID: 1348)
The sample compiled with german language support
- msiexec.exe (PID: 1348)
Creates a software uninstall entry
- msiexec.exe (PID: 1348)
Reads CPU info
- launcher.exe (PID: 6592)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
TRiD
| .msi | | | Microsoft Windows Installer (88.6) |
|---|---|---|
| .mst | | | Windows SDK Setup Transform Script (10) |
| .msi | | | Microsoft Installer (100) |
EXIF
FlashPix
| Security: | None |
|---|---|
| CodePage: | Windows Latin 1 (Western European) |
| RevisionNumber: | {434405B6-DBCA-4C5D-94EF-CB705A6150C9} |
| Words: | 10 |
| Subject: | Klio Verfair Tools |
| Author: | TasovCoop |
| LastModifiedBy: | - |
| Software: | Klio Verfair Tools |
| Template: | ;1033 |
| Comments: | This installer database contains the logic and data required to install Klio Verfair Tools. |
| Title: | Installation Database |
| Keywords: | Installer, MSI, Database |
| CreateDate: | 2025:03:27 17:12:11 |
| ModifyDate: | 2025:03:27 17:12:11 |
| LastPrinted: | 2025:03:27 17:12:11 |
| Pages: | 450 |
Total processes
135
Monitored processes
8
Malicious processes
2
Suspicious processes
0
Behavior graph
Click at the process to see the details
Process information
PID | CMD | Path | Indicators | Parent process | |||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 1348 | C:\WINDOWS\system32\msiexec.exe /V | C:\Windows\System32\msiexec.exe | services.exe | ||||||||||||
User: SYSTEM Company: Microsoft Corporation Integrity Level: SYSTEM Description: Windows® installer Version: 5.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 3676 | C:\Windows\syswow64\MsiExec.exe -Embedding B4E124D05D92D93006232F234C0AE1F2 | C:\Windows\SysWOW64\msiexec.exe | msiexec.exe | ||||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows® installer Exit code: 0 Version: 5.0.19041.3636 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 5072 | C:\WINDOWS\System32\slui.exe -Embedding | C:\Windows\System32\slui.exe | svchost.exe | ||||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows Activation Client Exit code: 0 Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 5332 | "C:\Windows\System32\msiexec.exe" /i C:\Users\admin\AppData\Local\Temp\build.msi | C:\Windows\System32\msiexec.exe | — | explorer.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows® installer Exit code: 0 Version: 5.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 6240 | "BackgroundTransferHost.exe" -ServerName:BackgroundTransferHost.1 | C:\Windows\System32\BackgroundTransferHost.exe | — | svchost.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Download/Upload Host Exit code: 1 Version: 10.0.19041.3636 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 6592 | "C:\Users\admin\AppData\Roaming\TasovCoop\Klio Verfair Tools\launcher.exe" | C:\Users\admin\AppData\Roaming\TasovCoop\Klio Verfair Tools\launcher.exe | msiexec.exe | ||||||||||||
User: admin Company: Krzysztof Kowalczyk Integrity Level: MEDIUM Description: SumatraPDF Version: 3.5.2 Modules
| |||||||||||||||
| 7432 | "BackgroundTransferHost.exe" -ServerName:BackgroundTransferHost.1 | C:\Windows\System32\BackgroundTransferHost.exe | — | svchost.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Download/Upload Host Exit code: 1 Version: 10.0.19041.3636 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 7784 | "BackgroundTransferHost.exe" -ServerName:BackgroundTransferHost.1 | C:\Windows\System32\BackgroundTransferHost.exe | — | svchost.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Download/Upload Host Exit code: 1 Version: 10.0.19041.3636 (WinBuild.160101.0800) Modules
| |||||||||||||||
Total events
14 040
Read events
13 792
Write events
235
Delete events
13
Modification events
| (PID) Process: | (1348) msiexec.exe | Key: | HKEY_USERS\S-1-5-21-1693682860-607145093-2874071422-1001\SOFTWARE\Microsoft\RestartManager\Session0000 |
| Operation: | write | Name: | Owner |
Value: 440500007BE0CD54EC9FDB01 | |||
| (PID) Process: | (1348) msiexec.exe | Key: | HKEY_USERS\S-1-5-21-1693682860-607145093-2874071422-1001\SOFTWARE\Microsoft\RestartManager\Session0000 |
| Operation: | write | Name: | SessionHash |
Value: 89D06E24A52EDAAE59AB5540B8FFEA677EBF60C00C4986AF61BD9CA25C643848 | |||
| (PID) Process: | (1348) msiexec.exe | Key: | HKEY_USERS\S-1-5-21-1693682860-607145093-2874071422-1001\SOFTWARE\Microsoft\RestartManager\Session0000 |
| Operation: | write | Name: | Sequence |
Value: 1 | |||
| (PID) Process: | (3676) msiexec.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History |
| Operation: | write | Name: | CachePrefix |
Value: Visited: | |||
| (PID) Process: | (6240) BackgroundTransferHost.exe | Key: | HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\Content |
| Operation: | write | Name: | CachePrefix |
Value: | |||
| (PID) Process: | (6240) BackgroundTransferHost.exe | Key: | HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\Cookies |
| Operation: | write | Name: | CachePrefix |
Value: Cookie: | |||
| (PID) Process: | (6240) BackgroundTransferHost.exe | Key: | HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\History |
| Operation: | write | Name: | CachePrefix |
Value: Visited: | |||
| (PID) Process: | (3676) msiexec.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content |
| Operation: | write | Name: | CachePrefix |
Value: | |||
| (PID) Process: | (3676) msiexec.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies |
| Operation: | write | Name: | CachePrefix |
Value: Cookie: | |||
| (PID) Process: | (1348) msiexec.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-21-1693682860-607145093-2874071422-1001\Components\F0717E22B99957D438D3C6A3CA658333 |
| Operation: | write | Name: | 1B6A3F70873C32146BABAD8BDB43CFB4 |
Value: C:\Users\admin\AppData\Roaming\TasovCoop\Klio Verfair Tools\resources\extras\clink\clink_x64.exe | |||
Executable files
38
Suspicious files
59
Text files
21
Unknown types
1
Dropped files
PID | Process | Filename | Type | |
|---|---|---|---|---|
| 1348 | msiexec.exe | C:\Windows\Installer\10fd7c.msi | — | |
MD5:— | SHA256:— | |||
| 3676 | msiexec.exe | C:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8B2B9A00839EED1DFDCCC3BFC2F5DF12 | binary | |
MD5:C9BE626E9715952E9B70F92F912B9787 | SHA256:C13E8D22800C200915F87F71C31185053E4E60CA25DE2E41E160E09CD2D815D4 | |||
| 1348 | msiexec.exe | C:\Windows\Installer\MSIAB.tmp | executable | |
MD5:EE09D6A1BB908B42C05FD0BEEB67DFD2 | SHA256:7BBF611F5E2A16439DC8CD11936F6364F6D5CC0044545C92775DA5646AFC7752 | |||
| 3676 | msiexec.exe | C:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B46811C17859FFB409CF0E904A4AA8F8 | binary | |
MD5:971C514F84BBA0785F80AA1C23EDFD79 | SHA256:F157ED17FCAF8837FA82F8B69973848C9B10A02636848F995698212A08F31895 | |||
| 1348 | msiexec.exe | C:\Windows\Installer\MSI205.tmp | executable | |
MD5:FFDAACB43C074A8CB9A608C612D7540B | SHA256:7484797EA4480BC71509FA28B16E607F82323E05C44F59FFA65DB3826ED1B388 | |||
| 1348 | msiexec.exe | C:\Windows\Installer\inprogressinstallinfo.ipi | binary | |
MD5:14C51C7E0FAA2F758321ABC9A2CB3E43 | SHA256:32755D1A1CBC3FF044612F823D1D49A96BA70DBE8FF75DE6590142C9714D6243 | |||
| 1348 | msiexec.exe | C:\Users\admin\AppData\Roaming\TasovCoop\Klio Verfair Tools\7z.dll | executable | |
MD5:C4AABD70DC28C9516809B775A30FDD3F | SHA256:882063948D675EE41B5AE68DB3E84879350EC81CF88D15B9BABF2FA08E332863 | |||
| 3676 | msiexec.exe | C:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8B2B9A00839EED1DFDCCC3BFC2F5DF12 | binary | |
MD5:0562733A36B8E3E4D148B40646D1058F | SHA256:EC155C6DB585457B0214C625746ECF1CD7F53CFC92E201DBA73A5EC1ADED55EA | |||
| 1348 | msiexec.exe | C:\Windows\Installer\MSIFF03.tmp | executable | |
MD5:EE09D6A1BB908B42C05FD0BEEB67DFD2 | SHA256:7BBF611F5E2A16439DC8CD11936F6364F6D5CC0044545C92775DA5646AFC7752 | |||
| 1348 | msiexec.exe | C:\Windows\Temp\~DFAEF905CA6D2E8A16.TMP | binary | |
MD5:14C51C7E0FAA2F758321ABC9A2CB3E43 | SHA256:32755D1A1CBC3FF044612F823D1D49A96BA70DBE8FF75DE6590142C9714D6243 | |||
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
8
TCP/UDP connections
27
DNS requests
18
Threats
0
HTTP requests
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
|---|---|---|---|---|---|---|---|---|---|
5496 | MoUsoCoreWorker.exe | GET | 200 | 23.53.40.178:80 | http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl | unknown | — | — | whitelisted |
3676 | msiexec.exe | GET | 200 | 172.217.16.195:80 | http://c.pki.goog/r/r4.crl | unknown | — | — | whitelisted |
7456 | backgroundTaskHost.exe | GET | 200 | 2.17.190.73:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAUZZSZEml49Gjh0j13P68w%3D | unknown | — | — | whitelisted |
— | — | GET | 200 | 2.17.190.73:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D | unknown | — | — | whitelisted |
1240 | SIHClient.exe | GET | 200 | 184.30.21.171:80 | http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl | unknown | — | — | whitelisted |
3676 | msiexec.exe | GET | 200 | 172.217.16.195:80 | http://c.pki.goog/r/gsr1.crl | unknown | — | — | whitelisted |
8180 | BackgroundTransferHost.exe | GET | 200 | 2.17.190.73:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAI5PUjXAkJafLQcAAsO18o%3D | unknown | — | — | whitelisted |
1240 | SIHClient.exe | GET | 200 | 184.30.21.171:80 | http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl | unknown | — | — | whitelisted |
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
Connections
PID | Process | IP | Domain | ASN | CN | Reputation |
|---|---|---|---|---|---|---|
4 | System | 192.168.100.255:137 | — | — | — | whitelisted |
— | — | 4.231.128.59:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | IE | whitelisted |
4 | System | 192.168.100.255:138 | — | — | — | whitelisted |
5496 | MoUsoCoreWorker.exe | 23.53.40.178:80 | crl.microsoft.com | Akamai International B.V. | DE | whitelisted |
— | — | 172.172.255.217:443 | client.wns.windows.com | MICROSOFT-CORP-MSN-AS-BLOCK | US | whitelisted |
— | — | 40.126.31.69:443 | login.live.com | MICROSOFT-CORP-MSN-AS-BLOCK | IE | whitelisted |
— | — | 2.17.190.73:80 | ocsp.digicert.com | AKAMAI-AS | DE | whitelisted |
6544 | svchost.exe | 40.126.31.69:443 | login.live.com | MICROSOFT-CORP-MSN-AS-BLOCK | IE | whitelisted |
— | — | 20.73.194.208:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | NL | whitelisted |
7456 | backgroundTaskHost.exe | 20.199.58.43:443 | arc.msn.com | MICROSOFT-CORP-MSN-AS-BLOCK | FR | whitelisted |
DNS requests
Domain | IP | Reputation |
|---|---|---|
settings-win.data.microsoft.com |
| whitelisted |
crl.microsoft.com |
| whitelisted |
google.com |
| whitelisted |
client.wns.windows.com |
| whitelisted |
login.live.com |
| whitelisted |
ocsp.digicert.com |
| whitelisted |
arc.msn.com |
| whitelisted |
www.bing.com |
| whitelisted |
ticketvistas.com |
| unknown |
c.pki.goog |
| whitelisted |