File name:

deef940da19f6baca00002f28ee02998269ac036b0d277132402cd4bb086f093.msi

Full analysis: https://app.any.run/tasks/66b55380-4f42-42d9-83e9-67dd3e38248e
Verdict: Malicious activity
Analysis date: June 04, 2024, 09:19:55
OS: Windows 10 Professional (build: 19045, 64 bit)
Indicators:
MIME: application/x-msi
File info: Composite Document File V2 Document, Little Endian, Os: Windows, Version 6.1, MSI Installer, Create Time/Date: Mon Jun 21 07:00:00 1999, Name of Creating Application: Windows Installer, Code page: 1252, Last Printed: Mon Jun 3 18:16:22 2024, Title: Setup2, Author: Microsoft, Template: Intel;1033, Last Saved By: Asterix, Revision Number: {346216D6-FC2D-4B10-AF3A-E3FFCBE2B3C3}, Last Saved Time/Date: Mon Jun 3 18:17:41 2024, Number of Pages: 200, Number of Words: 10, Security: 0
MD5:

47F1B324EAB7E1DA2CA116F62B7C2D05

SHA1:

1D35C95616D2D9187B735B039DB7D4D71FF7DAF2

SHA256:

DEEF940DA19F6BACA00002F28EE02998269AC036B0D277132402CD4BB086F093

SSDEEP:

98304:qBvwwznn8+aM3rmFEqPqzeRFf0CZbuk8GO9AoJqDgOo0n7IgtuVw9UdHGdhe95Z6:A+EwtS3V2ty+E

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Drops the executable file immediately after the start

      • msiexec.exe (PID: 6372)
      • nwsvc.exe (PID: 6264)

    • Accesses name of a computer manufacturer via WMI (SCRIPT)

      • cscript.exe (PID: 6172)

  • SUSPICIOUS

    • The process creates files with name similar to system file names

      • msiexec.exe (PID: 6372)

    • Likely accesses (executes) a file from the Public directory

      • nwsvc.exe (PID: 6264)

    • Starts a Microsoft application from unusual location

      • nwsvc.exe (PID: 6264)

    • Process drops legitimate windows executable

      • msiexec.exe (PID: 6372)
      • nwsvc.exe (PID: 6264)

    • Reads the Windows owner or organization settings

      • msiexec.exe (PID: 6372)

    • Executes as Windows Service

      • VSSVC.exe (PID: 6640)

    • Accesses WMI object, sets custom ImpersonationLevel (SCRIPT)

      • cscript.exe (PID: 6172)

    • Executable content was dropped or overwritten

      • nwsvc.exe (PID: 6264)

    • The process executes VB scripts

      • nwsvc.exe (PID: 6264)

  • INFO

    • Executable content was dropped or overwritten

      • msiexec.exe (PID: 6372)

    • Reads the computer name

      • msiexec.exe (PID: 6372)
      • nwsvc.exe (PID: 6264)

    • Checks supported languages

      • msiexec.exe (PID: 6372)
      • nwsvc.exe (PID: 6264)

    • Reads the machine GUID from the registry

      • nwsvc.exe (PID: 6264)

    • Reads Environment values

      • nwsvc.exe (PID: 6264)

    • Create files in a temporary directory

      • nwsvc.exe (PID: 6264)

    • Reads security settings of Internet Explorer

      • cscript.exe (PID: 6172)

    • Reads Windows Product ID

      • nwsvc.exe (PID: 6264)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.msi | Microsoft Windows Installer (98.5)
.msi | Microsoft Installer (100)

EXIF

FlashPix

CreateDate: 1999:06:21 07:00:00
Software: Windows Installer
CodePage: Windows Latin 1 (Western European)
LastPrinted: 2024:06:03 18:16:22
Title: Setup2
Subject: -
Author: Microsoft
Keywords: -
Comments: -
Template: Intel;1033
LastModifiedBy: Asterix
RevisionNumber: {346216D6-FC2D-4B10-AF3A-E3FFCBE2B3C3}
ModifyDate: 2024:06:03 18:17:41
Pages: 200
Words: 10
Security: None
No data.
screenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
136
Monitored processes
8
Malicious processes
3
Suspicious processes
0

Behavior graph

Click at the process to see the details
start msiexec.exe no specs msiexec.exe vssvc.exe no specs srtasks.exe no specs conhost.exe no specs nwsvc.exe cscript.exe no specs conhost.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
3692\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—SrTasks.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
4480C:\WINDOWS\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:11C:\Windows\System32\SrTasks.exe—msiexec.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Microsoft® Windows System Protection background tasks.
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\srtasks.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
6164\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—cscript.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
6172C:\WINDOWS\system32\cscript.exe "C:\Users\admin\AppData\Local\Temp\VPN_03A6\detectvm.vbs"C:\Windows\System32\cscript.exe—nwsvc.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft ® Console Based Script Host
Exit code:
0
Version:
5.812.10240.16384
Modules
Images
c:\windows\system32\cscript.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
6264"C:\Users\Public\Music\nwsvc.exe" /usermodeC:\Users\Public\Music\nwsvc.exe
msiexec.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Network Access Service
Version:
6.1.7600.16385
Modules
Images
c:\users\public\music\nwsvc.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\ws2_32.dll
c:\windows\syswow64\rpcrt4.dll
6268"C:\Windows\System32\msiexec.exe" /i C:\Users\admin\AppData\Local\Temp\deef940da19f6baca00002f28ee02998269ac036b0d277132402cd4bb086f093.msiC:\Windows\System32\msiexec.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows® installer
Version:
5.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\msiexec.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\aclayers.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
6372C:\WINDOWS\system32\msiexec.exe /VC:\Windows\System32\msiexec.exe
services.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Windows® installer
Version:
5.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\msiexec.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\aclayers.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
6640C:\WINDOWS\system32\vssvc.exeC:\Windows\System32\VSSVC.exe—services.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Microsoft® Volume Shadow Copy Service
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\vssvc.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
Total events
6 354
Read events
6 155
Write events
189
Delete events
10

Modification events

(PID) Process:(6372) msiexec.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\SystemRestore
Operation:writeName:SrCreateRp (Enter)
Value:
4800000000000000B4E23B6860B6DA01E4180000E0190000D50700000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(6372) msiexec.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\SPP
Operation:writeName:SppGetSnapshots (Enter)
Value:
4800000000000000B4E23B6860B6DA01E4180000E0190000D20700000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(6372) msiexec.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\SPP
Operation:writeName:SppGetSnapshots (Leave)
Value:
4800000000000000105F8F6860B6DA01E4180000E0190000D20700000100000000000000000000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(6372) msiexec.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\SPP
Operation:writeName:SppEnumGroups (Enter)
Value:
480000000000000008B1916860B6DA01E4180000E0190000D10700000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(6372) msiexec.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\SPP
Operation:writeName:SppEnumGroups (Leave)
Value:
48000000000000009C16946860B6DA01E4180000E0190000D10700000100000000000000010000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(6372) msiexec.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\SPP
Operation:writeName:SppCreate (Enter)
Value:
48000000000000004C479B6860B6DA01E4180000E0190000D00700000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(6372) msiexec.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SPP
Operation:writeName:LastIndex
Value:
11
(PID) Process:(6372) msiexec.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\SPP
Operation:writeName:SppGatherWriterMetadata (Enter)
Value:
4800000000000000FD85446960B6DA01E4180000E0190000D30700000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(6372) msiexec.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\VssapiPublisher
Operation:writeName:IDENTIFY (Enter)
Value:
48000000000000006CED466960B6DA01E4180000581A0000E803000001000000000000000000000041654ED53F5A15418285A992A8857A4500000000000000000000000000000000
(PID) Process:(6640) VSSVC.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\Shadow Copy Optimization Writer
Operation:writeName:IDENTIFY (Enter)
Value:
4800000000000000F40E4E6960B6DA01F0190000701A0000E80300000100000001000000000000000000000000000000000000000000000000000000000000000000000000000000
Executable files
4
Suspicious files
7
Text files
7
Unknown types
0

Dropped files

PID
Process
Filename
Type
6372msiexec.exeC:\System Volume Information\SPP\metadata-2 —
MD5:—
SHA256:—
6372msiexec.exeC:\WINDOWS\Installer\119fd7.msi —
MD5:—
SHA256:—
6372msiexec.exeC:\WINDOWS\TEMP\~DF852D04AB4F12D840.TMPbinary
MD5:BF619EAC0CDF3F68D496EA9344137E8B
SHA256:076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
6372msiexec.exeC:\System Volume Information\SPP\OnlineMetadataCache\{d54e6541-5a3f-4115-8285-a992a8857a45}_OnDiskSnapshotPropbinary
MD5:6308CA0FE7743E00FDDA1BC751DBC7CF
SHA256:E668768817F62BC27B1196A384D2801A226736DC6FFA05969B88B51B4A97F125
6372msiexec.exeC:\System Volume Information\SPP\snapshot-2binary
MD5:6308CA0FE7743E00FDDA1BC751DBC7CF
SHA256:E668768817F62BC27B1196A384D2801A226736DC6FFA05969B88B51B4A97F125
6372msiexec.exeC:\Users\Public\Music\nwsvb.exeexecutable
MD5:A3FD2D29D6DC9BE3625AE87BF1EA5B78
SHA256:C7D731AFC4303DC898D65F9E2FDDF282C659D2517FE7A448778CBBE7759B17C2
6372msiexec.exeC:\WINDOWS\TEMP\~DF7DBD43F3C4300DC4.TMPbinary
MD5:60F81BD6FC9D919E89165295BFAF631B
SHA256:5DDE8BA430CC0BC30852DF1EDF91176F95C56F437D5F3350E08865E34A90B328
6372msiexec.exeC:\Users\Public\Music\hamcore\languages.txttext
MD5:331C37929CC46B4C9853D4018BE2F676
SHA256:C35287198BBF4C4643AB31C29B55F3471885A649B6B1F99D8885FA07C2021396
6372msiexec.exeC:\Users\Public\Music\hamcore\strtable_en.stbtext
MD5:B7653BEF754C80D73A4BA41FB5ABBE07
SHA256:105FC9C8E893754E38D57D8B2956B03859259014E24596B7CF6322977A7EAD0E
6372msiexec.exeC:\Users\Public\Music\nwsvc.exeexecutable
MD5:71630300BD04A8C07844844FE9A33568
SHA256:A203D0849E09D676428A998CE69B3B9C5662FA566856619A62707C12B9E15663
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
11
TCP/UDP connections
65
DNS requests
39
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
5380
svchost.exe
GET
200
2.17.0.227:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
unknown
5380
svchost.exe
GET
200
5.178.42.186:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
unknown
4680
SearchApp.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAzlnDD9eoNTLi0BRrMy%2BWU%3D
unknown
—
—
unknown
1608
svchost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
unknown
3824
SIHClient.exe
GET
200
2.17.0.227:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
unknown
3824
SIHClient.exe
GET
200
2.17.0.227:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
unknown
6264
nwsvc.exe
POST
200
103.41.63.66:80
http://x6.xf.open.servers.ddns.softether-network.net/ddns/ddns.aspx?v=3232284318336091529
unknown
—
—
unknown
6264
nwsvc.exe
GET
200
103.95.185.148:80
http://get-my-ip.ddns.softether-network.net/ddns/getmyip.ashx?v=5805051540976293219
unknown
—
—
unknown
6264
nwsvc.exe
POST
200
103.41.63.66:80
http://x6.xf.open.servers.ddns.softether-network.net/ddns/ddns.aspx?v=18325939636911354550
unknown
—
—
unknown
6984
backgroundTaskHost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEApDqVCbATUviZV57HIIulA%3D
unknown
—
—
unknown
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
—
—
239.255.255.250:1900
—
—
—
unknown
—
—
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
unknown
2492
RUXIMICS.exe
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
5140
MoUsoCoreWorker.exe
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
5380
svchost.exe
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
5380
svchost.exe
5.178.42.186:80
crl.microsoft.com
TELECOM ITALIA SPARKLE S.p.A.
IT
unknown
5380
svchost.exe
2.17.0.227:80
www.microsoft.com
AKAMAI-AS
DK
unknown
4
System
192.168.100.255:138
—
—
—
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
4680
SearchApp.exe
92.123.106.129:443
www.bing.com
TELECOM ITALIA SPARKLE S.p.A.
IT
unknown

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 4.231.128.59
  • 51.104.136.2
whitelisted
crl.microsoft.com
  • 5.178.42.186
  • 5.178.42.162
whitelisted
www.microsoft.com
  • 2.17.0.227
whitelisted
www.bing.com
  • 92.123.106.129
  • 92.123.106.152
  • 92.123.106.139
  • 92.123.106.163
  • 92.123.106.169
  • 92.123.106.170
  • 92.123.106.146
  • 92.123.106.154
  • 92.123.106.144
whitelisted
r.bing.com
  • 92.123.106.169
  • 92.123.106.146
  • 92.123.106.144
  • 92.123.106.129
  • 92.123.106.154
  • 92.123.106.139
  • 92.123.106.152
  • 92.123.106.163
  • 92.123.106.170
whitelisted
login.live.com
  • 20.190.159.4
  • 40.126.31.73
  • 20.190.159.0
  • 20.190.159.2
  • 40.126.31.69
  • 20.190.159.73
  • 20.190.159.71
  • 20.190.159.23
whitelisted
ocsp.digicert.com
  • 192.229.221.95
whitelisted
go.microsoft.com
  • 104.94.26.91
whitelisted
slscr.update.microsoft.com
  • 40.68.123.157
whitelisted
fe3cr.delivery.mp.microsoft.com
  • 20.166.126.56
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
deef940da19f6baca00002f28ee02998269ac036b0d277132402cd4bb086f093.msi