File name:

ADVERTENCIA_17092.msi

Full analysis: https://app.any.run/tasks/cdec208c-2a48-4381-aa37-1296ddf3b0b5
Verdict: Malicious activity
Analysis date: December 05, 2023, 21:55:32
OS: Windows 7 Professional Service Pack 1 (build: 7601, 64 bit)
Indicators:
MIME: application/x-msi
File info: Composite Document File V2 Document, Little Endian, Os: Windows, Version 6.1, MSI Installer, Last Printed: Fri Dec 11 11:47:44 2009, Create Time/Date: Fri Dec 11 11:47:44 2009, Last Saved Time/Date: Fri Sep 18 15:06:51 2020, Security: 0, Code page: 1252, Revision Number: {FC87A4D0-764F-4B78-8EF6-C0C159C56D6B}, Number of Words: 10, Subject: Facture.pdf, Author: Facture.pdf, Name of Creating Application: Advanced Installer 18.7 build 0a7fdead, Template: ;1033, Comments: This installer database contains the logic and data required to install Facture.pdf., Title: Installation Database, Keywords: Installer, MSI, Database, Number of Pages: 200
MD5:

47551653A59690565E93CAD6C132015E

SHA1:

90AC63B5ED4ED536A623B63D312B0BE8C10B12C9

SHA256:

E4DA4DB027FD66D0BDF38996463E34B3832FB46C13012A4EE5909F4E2C9583F2

SSDEEP:

12288:02Oo9IdHt+DorqxetLtzVaKmK+EPimr0C2txtnJ2adZjTtYKV139Aecy:02n9IdHWosK+EqC2t92aZjT6KV

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Checks whether a specified folder exists (SCRIPT)

      • msiexec.exe (PID: 332)

    • Accesses environment variables (SCRIPT)

      • msiexec.exe (PID: 332)

    • Gets %appdata% folder path (SCRIPT)

      • msiexec.exe (PID: 332)

    • Creates internet connection object (SCRIPT)

      • msiexec.exe (PID: 332)

    • Opens an HTTP connection (SCRIPT)

      • msiexec.exe (PID: 332)

    • Sends HTTP request (SCRIPT)

      • msiexec.exe (PID: 332)

    • Drops the executable file immediately after the start

      • msiexec.exe (PID: 332)
      • msiexec.exe (PID: 2072)

    • Deletes a file (SCRIPT)

      • msiexec.exe (PID: 332)

    • Create files in the Startup directory

      • msiexec.exe (PID: 332)

  • SUSPICIOUS

    • Creates FileSystem object to access computer's file system (SCRIPT)

      • msiexec.exe (PID: 332)

    • Writes binary data to a Stream object (SCRIPT)

      • msiexec.exe (PID: 332)

    • Checks whether a specific file exists (SCRIPT)

      • msiexec.exe (PID: 332)

    • Reads the Internet Settings

      • msiexec.exe (PID: 332)

    • Creates a Stream, which may work with files, input/output devices, pipes, or TCP/IP sockets (SCRIPT)

      • msiexec.exe (PID: 332)

    • Saves data to a binary file (SCRIPT)

      • msiexec.exe (PID: 332)

    • Creates a Folder object (SCRIPT)

      • msiexec.exe (PID: 332)

    • Runs shell command (SCRIPT)

      • msiexec.exe (PID: 332)

  • INFO

    • Reads the computer name

      • msiexec.exe (PID: 332)
      • msiexec.exe (PID: 2072)

    • Reads the machine GUID from the registry

      • msiexec.exe (PID: 2072)
      • msiexec.exe (PID: 332)

    • Checks supported languages

      • msiexec.exe (PID: 2072)
      • msiexec.exe (PID: 332)

    • Reads Environment values

      • msiexec.exe (PID: 332)

    • Creates files or folders in the user directory

      • msiexec.exe (PID: 332)
      • msiexec.exe (PID: 2072)

    • Create files in a temporary directory

      • msiexec.exe (PID: 2072)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.msi | Microsoft Windows Installer (88.6)
.mst | Windows SDK Setup Transform Script (10)
.msi | Microsoft Installer (100)

EXIF

FlashPix

LastPrinted: 2009:12:11 11:47:44
CreateDate: 2009:12:11 11:47:44
ModifyDate: 2020:09:18 14:06:51
Security: None
CodePage: Windows Latin 1 (Western European)
RevisionNumber: {FC87A4D0-764F-4B78-8EF6-C0C159C56D6B}
Words: 10
Subject: Facture.pdf
Author: Facture.pdf
LastModifiedBy: -
Software: Advanced Installer 18.7 build 0a7fdead
Template: ;1033
Comments: This installer database contains the logic and data required to install Facture.pdf.
Title: Installation Database
Keywords: Installer, MSI, Database
Pages: 200
No data.
screenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
35
Monitored processes
4
Malicious processes
2
Suspicious processes
0

Behavior graph

Click at the process to see the details
start msiexec.exe no specs msiexec.exe no specs msiexec.exe pwa_helper.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
332C:\Windows\syswow64\MsiExec.exe -Embedding 81C16EE91C0E5276D9C703FCFC5EA851C:\Windows\SysWOW64\msiexec.exe
msiexec.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows® installer
Exit code:
0
Version:
5.0.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\syswow64\msiexec.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\system32\kernel32.dll
c:\windows\syswow64\kernel32.dll
c:\windows\system32\user32.dll
c:\windows\syswow64\kernelbase.dll
1800"C:\Users\admin\AppData\Roaming\Microsoft\pwa_helper.exe" C:\Users\admin\AppData\Roaming\Microsoft\pwa_helper.exe—msiexec.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
3221225781
Modules
Images
c:\users\admin\appdata\roaming\microsoft\pwa_helper.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\system32\kernel32.dll
c:\windows\syswow64\kernel32.dll
c:\windows\system32\user32.dll
c:\windows\syswow64\kernelbase.dll
2072C:\Windows\system32\msiexec.exe /VC:\Windows\System32\msiexec.exe—services.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Windows® installer
Exit code:
0
Version:
5.0.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\msiexec.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
2308"C:\Windows\System32\msiexec.exe" /i "C:\Users\admin\AppData\Local\Temp\ADVERTENCIA_17092.msi"C:\Windows\System32\msiexec.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows® installer
Exit code:
0
Version:
5.0.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\msiexec.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
Total events
3 746
Read events
3 722
Write events
14
Delete events
10

Modification events

(PID) Process:(332) msiexec.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\15A\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(332) msiexec.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
(PID) Process:(332) msiexec.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:IntranetName
Value:
1
(PID) Process:(332) msiexec.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
1
(PID) Process:(332) msiexec.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
0
(PID) Process:(332) msiexec.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Discardable\PostSetup\Component Categories\{56FFCC30-D398-11D0-B2AE-00A0C908FA49}\Enum
Operation:writeName:Implementing
Value:
1C00000001000000E7070C0002000500150038000F00BA03010000001E768127E028094199FEB9D127C57AFE
(PID) Process:(2072) msiexec.exeKey:HKEY_USERS\S-1-5-21-3896776584-4254864009-862391680-1000_CLASSES\Local Settings\MuiCache\15A\52C64B7E
Operation:delete keyName:(default)
Value:
(PID) Process:(2072) msiexec.exeKey:HKEY_USERS\S-1-5-21-3896776584-4254864009-862391680-1000_CLASSES\Local Settings\MuiCache\15A
Operation:delete keyName:(default)
Value:
(PID) Process:(2072) msiexec.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Rollback\Scripts
Operation:delete valueName:C:\Config.Msi\22bb20.rbs
Value:
31074245
(PID) Process:(2072) msiexec.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Rollback\Scripts
Operation:delete keyName:(default)
Value:
Executable files
8
Suspicious files
11
Text files
2
Unknown types
0

Dropped files

PID
Process
Filename
Type
2072msiexec.exeC:\Windows\Installer\22bb1d.msiexecutable
MD5:47551653A59690565E93CAD6C132015E
SHA256:E4DA4DB027FD66D0BDF38996463E34B3832FB46C13012A4EE5909F4E2C9583F2
332msiexec.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B5E07AF15F3B6E48EDF7575279F2E80Bbinary
MD5:7FFB7EB7935FA68BD3C0D6936A99AB26
SHA256:7C4E90207B2B7CAEC080426CC469908CB27B925EE3B1C999C22B8568812FDA8C
332msiexec.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\nglb.ps1text
MD5:A067F5EC97BA51B576825B69BC855E58
SHA256:CF3E339D25C3C023C9417FFC5D8E73F1DA828B18FEECAF14FDB9C24D04E49BA0
332msiexec.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B5E07AF15F3B6E48EDF7575279F2E80Bbinary
MD5:785D7C4EE1D76425FF3DD0C337C3A9DC
SHA256:2B7C11DF76143FD05D7557ED65D28A9EF687FAD720E4A7E88824EBFFB88BF0B2
2072msiexec.exeC:\Users\admin\AppData\Local\Temp\~DF666B0E84043569B0.TMPbinary
MD5:C7C37E29E50B3619EBA713875EEF0EB2
SHA256:0A62CF8DC6B375173E0DABDAAFB41F00803172D43271A9FFCB7426AB84F48D01
2072msiexec.exeC:\Users\admin\AppData\Roaming\Microsoft\Installer\{AD98D31D-3589-40C3-8F3A-CE6489D07AD2}\putty.exeimage
MD5:B115B4A1541BF759B027C6BAF81A9DFC
SHA256:1E88D81AEAA776D5D402F118571F60EBCDBA6B76F62E994AEB215C2F64E11D2F
2072msiexec.exeC:\Windows\Installer\MSI12F3.tmpexecutable
MD5:3D24A2AF1FB93F9960A17D6394484802
SHA256:8D23754E6B8BB933D79861540B50DECA42E33AC4C3A6669C99FB368913B66D88
332msiexec.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\pwa_helper.lnkbinary
MD5:EABDE50EE43FDE73746593DA2DF1CD2A
SHA256:210D74F32A1DC2D8AF0CD2A980F4F56BA9FC74197F62D4705AD136D2FED9F96C
2072msiexec.exeC:\Windows\Installer\MSI1371.tmpbinary
MD5:64B2175A64EB57DA4131680518ADC8E1
SHA256:B543CDBC625EC3124FDEA716D8C266CC83598F56FF6D900292D3CDAA288614DD
2072msiexec.exeC:\Windows\Installer\22bb1f.ipibinary
MD5:C908741B297F3B203A0A3F848229FD83
SHA256:A980C4EEBF6BE3FF660E689C53D2C83B95EBFF1E3992C581AD8C78615E76FB3F
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
1
TCP/UDP connections
7
DNS requests
2
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
332
msiexec.exe
GET
200
104.18.21.226:80
http://secure.globalsign.com/cacert/alphasslcasha256g4.crt
unknown
binary
1.14 Kb
unknown
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:138
—
—
—
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
—
—
224.0.0.252:5355
—
—
—
unknown
1956
svchost.exe
239.255.255.250:1900
—
—
—
whitelisted
324
svchost.exe
224.0.0.252:5355
—
—
—
unknown
332
msiexec.exe
186.202.153.99:443
shopinkfast.com
Locaweb Servicos de Internet SA
BR
unknown
332
msiexec.exe
104.18.21.226:80
secure.globalsign.com
CLOUDFLARENET
—
shared

DNS requests

Domain
IP
Reputation
shopinkfast.com
  • 186.202.153.99
unknown
secure.globalsign.com
  • 104.18.21.226
  • 104.18.20.226
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
ADVERTENCIA_17092.msi