File name:

01756676_2

Full analysis: https://app.any.run/tasks/217a7a9b-777a-4f45-8c50-72928f973517
Verdict: Malicious activity
Analysis date: January 08, 2020, 03:00:19
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: application/x-msi
File info: Composite Document File V2 Document, Little Endian, Os: Windows, Version 6.1, MSI Installer, Create Time/Date: Mon Jun 21 08:00:00 1999, Name of Creating Application: Windows Installer, Security: 1, Code page: 1252, Template: Intel;1033, Number of Pages: 200, Revision Number: {9A16F79C-5C92-4464-AA57-0FB8B8F23F8C}, Title: Dtex Endpoint Collector Installer, Author: Dtex Systems, Inc., Comments: Endpoint Collector Version 4.5.1015, Number of Words: 2, Last Saved Time/Date: Sat Oct 26 03:53:55 2019, Last Printed: Sat Oct 26 03:53:55 2019
MD5:

AD5A4D29D662D18B276F22E99902D337

SHA1:

7A0DF37D323CEEA2995EEB1432EBF2E46688423C

SHA256:

E2B40A39B979B884B2CC5DB84B62EAB6091A541AACB9730938BA869C877BFD69

SSDEEP:

393216:Yjm58NCJby0+fwyvvWi+4fBvljqwonj1veaAIGgV9V+B/VU:R5jysyvvWN4f1ljAj1vea79qV

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Loads dropped or rewritten executable

      • EventReporting.AgentService.exe (PID: 3116)
      • msiexec.exe (PID: 2968)

    • Application was dropped or rewritten from another process

      • EventReporting.AgentService.exe (PID: 3116)

  • SUSPICIOUS

    • Executed as Windows Service

      • vssvc.exe (PID: 3400)
      • EventReporting.AgentService.exe (PID: 3116)

    • Creates files in the Windows directory

      • MsiExec.exe (PID: 2304)

    • Executable content was dropped or overwritten

      • msiexec.exe (PID: 3976)
      • MsiExec.exe (PID: 2304)

    • Executes PowerShell scripts

      • MsiExec.exe (PID: 2304)

    • Creates files in the user directory

      • powershell.exe (PID: 3180)

    • Creates files in the driver directory

      • MsiExec.exe (PID: 2304)

    • Reads Windows Product ID

      • EventReporting.AgentService.exe (PID: 3116)

    • Removes files from Windows directory

      • MsiExec.exe (PID: 2304)

    • Creates files in the program directory

      • logman.exe (PID: 2068)
      • logman.exe (PID: 3720)
      • EventReporting.AgentService.exe (PID: 3116)

  • INFO

    • Searches for installed software

      • msiexec.exe (PID: 3976)

    • Low-level read access rights to disk partition

      • vssvc.exe (PID: 3400)

    • Application launched itself

      • msiexec.exe (PID: 3976)

    • Creates files in the program directory

      • msiexec.exe (PID: 3976)
      • MsiExec.exe (PID: 2304)

    • Creates a software uninstall entry

      • msiexec.exe (PID: 3976)
      • MsiExec.exe (PID: 2304)

    • Creates or modifies windows services

      • MsiExec.exe (PID: 2304)

    • Loads dropped or rewritten executable

      • MsiExec.exe (PID: 2304)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.msi | Microsoft Windows Installer (90.2)
.msp | Windows Installer Patch (8.4)
.msi | Microsoft Installer (100)

EXIF

FlashPix

CreateDate: 1999:06:21 07:00:00
Software: Windows Installer
Security: Password protected
CodePage: Windows Latin 1 (Western European)
Template: Intel;1033
Pages: 200
RevisionNumber: {9A16F79C-5C92-4464-AA57-0FB8B8F23F8C}
Title: Dtex Endpoint Collector Installer
Subject: -
Author: Dtex Systems, Inc.
Keywords: -
Comments: Endpoint Collector Version 4.5.1015
Words: 2
ModifyDate: 2019:10:26 02:53:55
LastPrinted: 2019:10:26 02:53:55
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
49
Monitored processes
8
Malicious processes
4
Suspicious processes
0

Behavior graph

Click at the process to see the details
start msiexec.exe msiexec.exe vssvc.exe no specs msiexec.exe powershell.exe no specs eventreporting.agentservice.exe no specs logman.exe no specs logman.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
2068logman.exe -start EventReportingUserModeTrace -p {ADE1228A-8FA3-447D-B465-CEA6CC8448A7} 0xff 0xf -o "C:\Program Files\Windows Event Reporting\Core\Logs\EventReporting.AgentService.4.5.1.15.20200108030204.etl" -ets -mode circular -max 25 -ft 2C:\Windows\system32\logman.exe—EventReporting.AgentService.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Performance Log Utility
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\logman.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
2304C:\Windows\system32\MsiExec.exe -Embedding 00DD49245276C415FCBA563853DC17F5 M Global\MSI0000C:\Windows\system32\MsiExec.exe
msiexec.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Windows® installer
Exit code:
0
Version:
5.0.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\msiexec.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
2968"C:\Windows\System32\msiexec.exe" /i "C:\Users\admin\AppData\Local\Temp\01756676_2.msi"C:\Windows\System32\msiexec.exe
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows® installer
Exit code:
0
Version:
5.0.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\msiexec.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
3116"C:\Program Files\Windows Event Reporting\Core\EventReporting.AgentService.exe"C:\Program Files\Windows Event Reporting\Core\EventReporting.AgentService.exe—services.exe
User:
SYSTEM
Company:
Dtex Systems, Inc
Integrity Level:
SYSTEM
Description:
Windows Event Reporting Service
Exit code:
0
Version:
4.5.1.248
Modules
Images
c:\program files\windows event reporting\core\eventreporting.agentservice.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\ws2_32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\nsi.dll
c:\windows\system32\version.dll
c:\windows\system32\gdi32.dll
3180powershell "Add-MpPreference -ExclusionPath \"C:\Program Files\Windows Event Reporting\""C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe—MsiExec.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Windows PowerShell
Exit code:
1
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\windowspowershell\v1.0\powershell.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\atl.dll
c:\windows\system32\user32.dll
3400C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe—services.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Microsoft® Volume Shadow Copy Service
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\vssvc.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
3720logman.exe -start sseFileFilter -p {ADC2FE0F-9FF4-4613-B28D-583238F86026} 0xff 0x6 -o "C:\Program Files\Windows Event Reporting\Core\Logs\EventReporting.FileFilter.Driver.4.5.1.15.20200108030204.etl" -ets -mode circular -max 25 -ft 2C:\Windows\system32\logman.exe—EventReporting.AgentService.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Performance Log Utility
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\logman.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
3976C:\Windows\system32\msiexec.exe /VC:\Windows\system32\msiexec.exe
services.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Windows® installer
Exit code:
0
Version:
5.0.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\msiexec.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
Total events
917
Read events
601
Write events
304
Delete events
12

Modification events

(PID) Process:(2968) msiexec.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\12B\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(2968) msiexec.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\12B\52C64B7E
Operation:writeName:@%SystemRoot%\system32\p2pcollab.dll,-8042
Value:
Peer to Peer Trust
(PID) Process:(2968) msiexec.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\12B\52C64B7E
Operation:writeName:@%SystemRoot%\system32\qagentrt.dll,-10
Value:
System Health Authentication
(PID) Process:(2968) msiexec.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\12B\52C64B7E
Operation:writeName:@%SystemRoot%\system32\dnsapi.dll,-103
Value:
Domain Name System (DNS) Server Trust
(PID) Process:(2968) msiexec.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\12B\52C64B7E
Operation:writeName:@%SystemRoot%\System32\fveui.dll,-843
Value:
BitLocker Drive Encryption
(PID) Process:(2968) msiexec.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\12B\52C64B7E
Operation:writeName:@%SystemRoot%\System32\fveui.dll,-844
Value:
BitLocker Data Recovery Agent
(PID) Process:(3976) msiexec.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\SystemRestore
Operation:writeName:SrCreateRp (Enter)
Value:
40000000000000007A247EF8CFC5D501880F0000D80A0000D5070000000000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(3976) msiexec.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\SPP
Operation:writeName:SppCreate (Enter)
Value:
40000000000000007A247EF8CFC5D501880F0000D80A0000D0070000000000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(3976) msiexec.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SPP
Operation:writeName:LastIndex
Value:
33
(PID) Process:(3976) msiexec.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\SPP
Operation:writeName:SppGatherWriterMetadata (Enter)
Value:
4000000000000000F883BEF8CFC5D501880F0000D80A0000D3070000000000000000000000000000000000000000000000000000000000000000000000000000
Executable files
55
Suspicious files
17
Text files
13
Unknown types
6

Dropped files

PID
Process
Filename
Type
2968msiexec.exeC:\Users\admin\AppData\Local\Temp\CabB030.tmp —
MD5:—
SHA256:—
2968msiexec.exeC:\Users\admin\AppData\Local\Temp\TarB031.tmp —
MD5:—
SHA256:—
2968msiexec.exeC:\Users\admin\AppData\Local\Temp\CabB041.tmp —
MD5:—
SHA256:—
2968msiexec.exeC:\Users\admin\AppData\Local\Temp\TarB042.tmp —
MD5:—
SHA256:—
2968msiexec.exeC:\Users\admin\AppData\Local\Temp\CabB0D0.tmp —
MD5:—
SHA256:—
2968msiexec.exeC:\Users\admin\AppData\Local\Temp\TarB0D1.tmp —
MD5:—
SHA256:—
3976msiexec.exeC:\System Volume Information\SPP\metadata-2 —
MD5:—
SHA256:—
3976msiexec.exeC:\Windows\Installer\3aec2a.msi —
MD5:—
SHA256:—
3976msiexec.exeC:\Users\admin\AppData\Local\Temp\CabECF6.tmp —
MD5:—
SHA256:—
3976msiexec.exeC:\Users\admin\AppData\Local\Temp\TarECF7.tmp —
MD5:—
SHA256:—
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
1
TCP/UDP connections
1
DNS requests
1
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
2968
msiexec.exe
GET
200
93.184.221.240:80
http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
US
compressed
57.4 Kb
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
2968
msiexec.exe
93.184.221.240:80
www.download.windowsupdate.com
MCI Communications Services, Inc. d/b/a Verizon Business
US
whitelisted

DNS requests

Domain
IP
Reputation
www.download.windowsupdate.com
  • 93.184.221.240
whitelisted

Threats

No threats detected
Process
Message
MsiExec.exe
[DEC:Error] Failed to read the Endpoint Configuration (Specified storage data does not exist)
MsiExec.exe
[DEC:Error] Failed to read the Endpoint Configuration (Specified storage data does not exist)
MsiExec.exe
[DEC:Error] Failed to read the Endpoint Configuration (Specified storage data does not exist)
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
01756676_2