File name:

deef940da19f6baca00002f28ee02998269ac036b0d277132402cd4bb086f093.msi

Full analysis: https://app.any.run/tasks/66b55380-4f42-42d9-83e9-67dd3e38248e
Verdict: Malicious activity
Analysis date: June 04, 2024, 09:19:55
OS: Windows 10 Professional (build: 19045, 64 bit)
Indicators:
MIME: application/x-msi
File info: Composite Document File V2 Document, Little Endian, Os: Windows, Version 6.1, MSI Installer, Create Time/Date: Mon Jun 21 07:00:00 1999, Name of Creating Application: Windows Installer, Code page: 1252, Last Printed: Mon Jun 3 18:16:22 2024, Title: Setup2, Author: Microsoft, Template: Intel;1033, Last Saved By: Asterix, Revision Number: {346216D6-FC2D-4B10-AF3A-E3FFCBE2B3C3}, Last Saved Time/Date: Mon Jun 3 18:17:41 2024, Number of Pages: 200, Number of Words: 10, Security: 0
MD5:

47F1B324EAB7E1DA2CA116F62B7C2D05

SHA1:

1D35C95616D2D9187B735B039DB7D4D71FF7DAF2

SHA256:

DEEF940DA19F6BACA00002F28EE02998269AC036B0D277132402CD4BB086F093

SSDEEP:

98304:qBvwwznn8+aM3rmFEqPqzeRFf0CZbuk8GO9AoJqDgOo0n7IgtuVw9UdHGdhe95Z6:A+EwtS3V2ty+E

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Drops the executable file immediately after the start

      • msiexec.exe (PID: 6372)
      • nwsvc.exe (PID: 6264)

    • Accesses name of a computer manufacturer via WMI (SCRIPT)

      • cscript.exe (PID: 6172)

  • SUSPICIOUS

    • Executes as Windows Service

      • VSSVC.exe (PID: 6640)

    • Process drops legitimate windows executable

      • msiexec.exe (PID: 6372)
      • nwsvc.exe (PID: 6264)

    • Starts a Microsoft application from unusual location

      • nwsvc.exe (PID: 6264)

    • Likely accesses (executes) a file from the Public directory

      • nwsvc.exe (PID: 6264)

    • The process creates files with name similar to system file names

      • msiexec.exe (PID: 6372)

    • Reads the Windows owner or organization settings

      • msiexec.exe (PID: 6372)

    • Executable content was dropped or overwritten

      • nwsvc.exe (PID: 6264)

    • The process executes VB scripts

      • nwsvc.exe (PID: 6264)

    • Accesses WMI object, sets custom ImpersonationLevel (SCRIPT)

      • cscript.exe (PID: 6172)

  • INFO

    • Checks supported languages

      • msiexec.exe (PID: 6372)
      • nwsvc.exe (PID: 6264)

    • Reads the computer name

      • msiexec.exe (PID: 6372)
      • nwsvc.exe (PID: 6264)

    • Executable content was dropped or overwritten

      • msiexec.exe (PID: 6372)

    • Reads the machine GUID from the registry

      • nwsvc.exe (PID: 6264)

    • Reads Environment values

      • nwsvc.exe (PID: 6264)

    • Reads Windows Product ID

      • nwsvc.exe (PID: 6264)

    • Create files in a temporary directory

      • nwsvc.exe (PID: 6264)

    • Reads security settings of Internet Explorer

      • cscript.exe (PID: 6172)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.msi | Microsoft Windows Installer (98.5)
.msi | Microsoft Installer (100)

EXIF

FlashPix

CreateDate: 1999:06:21 07:00:00
Software: Windows Installer
CodePage: Windows Latin 1 (Western European)
LastPrinted: 2024:06:03 18:16:22
Title: Setup2
Subject: -
Author: Microsoft
Keywords: -
Comments: -
Template: Intel;1033
LastModifiedBy: Asterix
RevisionNumber: {346216D6-FC2D-4B10-AF3A-E3FFCBE2B3C3}
ModifyDate: 2024:06:03 18:17:41
Pages: 200
Words: 10
Security: None
No data.
screenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
136
Monitored processes
8
Malicious processes
3
Suspicious processes
0

Behavior graph

Click at the process to see the details
start msiexec.exe no specs msiexec.exe vssvc.exe no specs srtasks.exe no specs conhost.exe no specs nwsvc.exe cscript.exe no specs conhost.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
3692\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—SrTasks.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
4480C:\WINDOWS\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:11C:\Windows\System32\SrTasks.exe—msiexec.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Microsoft® Windows System Protection background tasks.
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\srtasks.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
6164\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—cscript.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
6172C:\WINDOWS\system32\cscript.exe "C:\Users\admin\AppData\Local\Temp\VPN_03A6\detectvm.vbs"C:\Windows\System32\cscript.exe—nwsvc.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft ® Console Based Script Host
Exit code:
0
Version:
5.812.10240.16384
Modules
Images
c:\windows\system32\cscript.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
6264"C:\Users\Public\Music\nwsvc.exe" /usermodeC:\Users\Public\Music\nwsvc.exe
msiexec.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Network Access Service
Version:
6.1.7600.16385
Modules
Images
c:\users\public\music\nwsvc.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\ws2_32.dll
c:\windows\syswow64\rpcrt4.dll
6268"C:\Windows\System32\msiexec.exe" /i C:\Users\admin\AppData\Local\Temp\deef940da19f6baca00002f28ee02998269ac036b0d277132402cd4bb086f093.msiC:\Windows\System32\msiexec.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows® installer
Version:
5.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\msiexec.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\aclayers.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
6372C:\WINDOWS\system32\msiexec.exe /VC:\Windows\System32\msiexec.exe
services.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Windows® installer
Version:
5.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\msiexec.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\aclayers.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
6640C:\WINDOWS\system32\vssvc.exeC:\Windows\System32\VSSVC.exe—services.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Microsoft® Volume Shadow Copy Service
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\vssvc.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
Total events
6 354
Read events
6 155
Write events
189
Delete events
10

Modification events

(PID) Process:(6372) msiexec.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\SystemRestore
Operation:writeName:SrCreateRp (Enter)
Value:
4800000000000000B4E23B6860B6DA01E4180000E0190000D50700000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(6372) msiexec.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\SPP
Operation:writeName:SppGetSnapshots (Enter)
Value:
4800000000000000B4E23B6860B6DA01E4180000E0190000D20700000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(6372) msiexec.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\SPP
Operation:writeName:SppGetSnapshots (Leave)
Value:
4800000000000000105F8F6860B6DA01E4180000E0190000D20700000100000000000000000000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(6372) msiexec.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\SPP
Operation:writeName:SppEnumGroups (Enter)
Value:
480000000000000008B1916860B6DA01E4180000E0190000D10700000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(6372) msiexec.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\SPP
Operation:writeName:SppEnumGroups (Leave)
Value:
48000000000000009C16946860B6DA01E4180000E0190000D10700000100000000000000010000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(6372) msiexec.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\SPP
Operation:writeName:SppCreate (Enter)
Value:
48000000000000004C479B6860B6DA01E4180000E0190000D00700000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(6372) msiexec.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SPP
Operation:writeName:LastIndex
Value:
11
(PID) Process:(6372) msiexec.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\SPP
Operation:writeName:SppGatherWriterMetadata (Enter)
Value:
4800000000000000FD85446960B6DA01E4180000E0190000D30700000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(6372) msiexec.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\VssapiPublisher
Operation:writeName:IDENTIFY (Enter)
Value:
48000000000000006CED466960B6DA01E4180000581A0000E803000001000000000000000000000041654ED53F5A15418285A992A8857A4500000000000000000000000000000000
(PID) Process:(6640) VSSVC.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\Shadow Copy Optimization Writer
Operation:writeName:IDENTIFY (Enter)
Value:
4800000000000000F40E4E6960B6DA01F0190000701A0000E80300000100000001000000000000000000000000000000000000000000000000000000000000000000000000000000
Executable files
4
Suspicious files
7
Text files
7
Unknown types
0

Dropped files

PID
Process
Filename
Type
6372msiexec.exeC:\System Volume Information\SPP\metadata-2 —
MD5:—
SHA256:—
6372msiexec.exeC:\WINDOWS\Installer\119fd7.msi —
MD5:—
SHA256:—
6372msiexec.exeC:\WINDOWS\Installer\inprogressinstallinfo.ipibinary
MD5:60F81BD6FC9D919E89165295BFAF631B
SHA256:5DDE8BA430CC0BC30852DF1EDF91176F95C56F437D5F3350E08865E34A90B328
6372msiexec.exeC:\WINDOWS\TEMP\~DF7DBD43F3C4300DC4.TMPbinary
MD5:60F81BD6FC9D919E89165295BFAF631B
SHA256:5DDE8BA430CC0BC30852DF1EDF91176F95C56F437D5F3350E08865E34A90B328
6372msiexec.exeC:\System Volume Information\SPP\OnlineMetadataCache\{d54e6541-5a3f-4115-8285-a992a8857a45}_OnDiskSnapshotPropbinary
MD5:6308CA0FE7743E00FDDA1BC751DBC7CF
SHA256:E668768817F62BC27B1196A384D2801A226736DC6FFA05969B88B51B4A97F125
6372msiexec.exeC:\WINDOWS\Installer\MSIA1EA.tmpbinary
MD5:280B1D7905BB8862D1FB933912D85F09
SHA256:601EF3D4FBB5EFB250DD1683ADBD77068BB7D9988E812565E831EAEE1D4A10F0
6372msiexec.exeC:\System Volume Information\SPP\snapshot-2binary
MD5:6308CA0FE7743E00FDDA1BC751DBC7CF
SHA256:E668768817F62BC27B1196A384D2801A226736DC6FFA05969B88B51B4A97F125
6264nwsvc.exeC:\Users\Public\Music\vpn_server.config.logtext
MD5:A5E27803E925F9ED124F04B2EAC490D2
SHA256:EC2A3CD6DD36722E4D8BCA84AB3494560F875E4F1D2FDD99BC50CDB0F0B0A79A
6372msiexec.exeC:\Users\Public\Music\nwsvc.exeexecutable
MD5:71630300BD04A8C07844844FE9A33568
SHA256:A203D0849E09D676428A998CE69B3B9C5662FA566856619A62707C12B9E15663
6264nwsvc.exeC:\Users\admin\AppData\Local\Temp\VPN_03A6\detectvm.vbstext
MD5:29F107D28462045BC4E2CA807F935515
SHA256:0BBAE16631951F3E631FC04D916FF6897284DDD0C593269BDCF7AA14B2DD93A8
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
11
TCP/UDP connections
65
DNS requests
39
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
5380
svchost.exe
GET
200
5.178.42.186:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
unknown
5380
svchost.exe
GET
200
2.17.0.227:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
unknown
4680
SearchApp.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAzlnDD9eoNTLi0BRrMy%2BWU%3D
unknown
—
—
unknown
1608
svchost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
unknown
3824
SIHClient.exe
GET
200
2.17.0.227:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
unknown
3824
SIHClient.exe
GET
200
2.17.0.227:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
unknown
6264
nwsvc.exe
GET
200
103.95.185.148:80
http://get-my-ip.ddns.softether-network.net/ddns/getmyip.ashx?v=5805051540976293219
unknown
—
—
unknown
6264
nwsvc.exe
POST
200
103.41.63.66:80
http://x6.xf.open.servers.ddns.softether-network.net/ddns/ddns.aspx?v=3232284318336091529
unknown
—
—
unknown
6264
nwsvc.exe
POST
200
103.41.63.66:80
http://x6.xf.open.servers.ddns.softether-network.net/ddns/ddns.aspx?v=18325939636911354550
unknown
—
—
unknown
6984
backgroundTaskHost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEApDqVCbATUviZV57HIIulA%3D
unknown
—
—
unknown
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
—
—
239.255.255.250:1900
—
—
—
unknown
—
—
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
unknown
2492
RUXIMICS.exe
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
5140
MoUsoCoreWorker.exe
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
5380
svchost.exe
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
5380
svchost.exe
5.178.42.186:80
crl.microsoft.com
TELECOM ITALIA SPARKLE S.p.A.
IT
unknown
5380
svchost.exe
2.17.0.227:80
www.microsoft.com
AKAMAI-AS
DK
unknown
4
System
192.168.100.255:138
—
—
—
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
4680
SearchApp.exe
92.123.106.129:443
www.bing.com
TELECOM ITALIA SPARKLE S.p.A.
IT
unknown

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 4.231.128.59
  • 51.104.136.2
whitelisted
crl.microsoft.com
  • 5.178.42.186
  • 5.178.42.162
whitelisted
www.microsoft.com
  • 2.17.0.227
whitelisted
www.bing.com
  • 92.123.106.129
  • 92.123.106.152
  • 92.123.106.139
  • 92.123.106.163
  • 92.123.106.169
  • 92.123.106.170
  • 92.123.106.146
  • 92.123.106.154
  • 92.123.106.144
whitelisted
r.bing.com
  • 92.123.106.169
  • 92.123.106.146
  • 92.123.106.144
  • 92.123.106.129
  • 92.123.106.154
  • 92.123.106.139
  • 92.123.106.152
  • 92.123.106.163
  • 92.123.106.170
whitelisted
login.live.com
  • 20.190.159.4
  • 40.126.31.73
  • 20.190.159.0
  • 20.190.159.2
  • 40.126.31.69
  • 20.190.159.73
  • 20.190.159.71
  • 20.190.159.23
whitelisted
ocsp.digicert.com
  • 192.229.221.95
whitelisted
go.microsoft.com
  • 104.94.26.91
whitelisted
slscr.update.microsoft.com
  • 40.68.123.157
whitelisted
fe3cr.delivery.mp.microsoft.com
  • 20.166.126.56
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
deef940da19f6baca00002f28ee02998269ac036b0d277132402cd4bb086f093.msi