| File name: | Doc171836.js |
| Full analysis: | https://app.any.run/tasks/156ed3af-8e28-41c0-8e45-d9d07af1a4e5 |
| Verdict: | Malicious activity |
| Analysis date: | February 19, 2025, 17:25:22 |
| OS: | Windows 10 Professional (build: 19045, 64 bit) |
| Indicators: | |
| MIME: | text/plain |
| File info: | ASCII text, with very long lines (25409), with CRLF line terminators |
| MD5: | DA7ED43B68DF0E3A40B48E1FBB8B539B |
| SHA1: | C53936F0811FE54DD3F57E525C1DD31F04BF249D |
| SHA256: | EB164525C66C559AEC32C119A9E2FA54444CAEFCD32B944A12C459E80FD568C4 |
| SSDEEP: | 3072:D5RU5Rv5RjiL2wiL2niL2WGyTGyR3d54+e0ekewer:VRkRRRj2T2m23GyTGydXJ5S |
MALICIOUS
No malicious indicators.SUSPICIOUS
Reads security settings of Internet Explorer
- msiexec.exe (PID: 5192)
Reads the Windows owner or organization settings
- msiexec.exe (PID: 5192)
Process drops legitimate windows executable
- msiexec.exe (PID: 5192)
The process drops C-runtime libraries
- msiexec.exe (PID: 5192)
The process creates files with name similar to system file names
- msiexec.exe (PID: 5192)
INFO
Reads the software policy settings
- msiexec.exe (PID: 5192)
Reads the computer name
- msiexec.exe (PID: 5192)
- msiexec.exe (PID: 4160)
- OneDrive.exe (PID: 4392)
- FileCoAuth.exe (PID: 6060)
Executable content was dropped or overwritten
- msiexec.exe (PID: 5192)
Checks supported languages
- msiexec.exe (PID: 4160)
- msiexec.exe (PID: 5192)
- OneDrive.exe (PID: 4392)
- FileCoAuth.exe (PID: 6060)
Reads Environment values
- msiexec.exe (PID: 4160)
Creates files or folders in the user directory
- msiexec.exe (PID: 5192)
- FileCoAuth.exe (PID: 6060)
The sample compiled with english language support
- msiexec.exe (PID: 5192)
Reads the machine GUID from the registry
- FileCoAuth.exe (PID: 6060)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
Total processes
135
Monitored processes
5
Malicious processes
1
Suspicious processes
0
Behavior graph
Click at the process to see the details
Process information
PID | CMD | Path | Indicators | Parent process | |||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 2136 | "C:\Windows\System32\WScript.exe" C:\Users\admin\AppData\Local\Temp\Doc171836.js | C:\Windows\System32\wscript.exe | — | explorer.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Microsoft ® Windows Based Script Host Version: 5.812.10240.16384 Modules
| |||||||||||||||
| 4160 | C:\Windows\syswow64\MsiExec.exe -Embedding 52E901E1044802FC4085063D766FA287 | C:\Windows\SysWOW64\msiexec.exe | — | msiexec.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows® installer Version: 5.0.19041.3636 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 4392 | "C:\Users\admin\AppData\Roaming\onedrive\OneDrive.exe" | C:\Users\admin\AppData\Roaming\onedrive\OneDrive.exe | — | msiexec.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Microsoft OneDrive Exit code: 0 Version: 24.226.1110.0004 Modules
| |||||||||||||||
| 5192 | C:\WINDOWS\system32\msiexec.exe /V | C:\Windows\System32\msiexec.exe | services.exe | ||||||||||||
User: SYSTEM Company: Microsoft Corporation Integrity Level: SYSTEM Description: Windows® installer Version: 5.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 6060 | "C:\Users\admin\AppData\Roaming\onedrive\FileCoAuth.exe" | C:\Users\admin\AppData\Roaming\onedrive\FileCoAuth.exe | — | msiexec.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Microsoft OneDriveFile Co-Authoring Executable Version: 24.226.1110.0004 Modules
| |||||||||||||||
Total events
2 468
Read events
2 290
Write events
178
Delete events
0
Modification events
| (PID) Process: | (5192) msiexec.exe | Key: | HKEY_USERS\S-1-5-21-1693682860-607145093-2874071422-1001\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
| Operation: | write | Name: | ProxyBypass |
Value: 1 | |||
| (PID) Process: | (5192) msiexec.exe | Key: | HKEY_USERS\S-1-5-21-1693682860-607145093-2874071422-1001\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
| Operation: | write | Name: | IntranetName |
Value: 1 | |||
| (PID) Process: | (5192) msiexec.exe | Key: | HKEY_USERS\S-1-5-21-1693682860-607145093-2874071422-1001\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
| Operation: | write | Name: | UNCAsIntranet |
Value: 1 | |||
| (PID) Process: | (5192) msiexec.exe | Key: | HKEY_USERS\S-1-5-21-1693682860-607145093-2874071422-1001\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
| Operation: | write | Name: | AutoDetect |
Value: 0 | |||
| (PID) Process: | (5192) msiexec.exe | Key: | HKEY_USERS\S-1-5-21-1693682860-607145093-2874071422-1001\SOFTWARE\Microsoft\RestartManager\Session0000 |
| Operation: | write | Name: | Owner |
Value: 4814000072FFF245F382DB01 | |||
| (PID) Process: | (5192) msiexec.exe | Key: | HKEY_USERS\S-1-5-21-1693682860-607145093-2874071422-1001\SOFTWARE\Microsoft\RestartManager\Session0000 |
| Operation: | write | Name: | SessionHash |
Value: CD858D4B40E35F8AB4C065E7084EC776E6368DBCAC5BB794C4EB460BE4492658 | |||
| (PID) Process: | (5192) msiexec.exe | Key: | HKEY_USERS\S-1-5-21-1693682860-607145093-2874071422-1001\SOFTWARE\Microsoft\RestartManager\Session0000 |
| Operation: | write | Name: | Sequence |
Value: 1 | |||
| (PID) Process: | (5192) msiexec.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Folders |
| Operation: | write | Name: | C:\Config.Msi\ |
Value: | |||
| (PID) Process: | (5192) msiexec.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Rollback\Scripts |
| Operation: | write | Name: | C:\Config.Msi\13aa2f.rbs |
Value: 31163123 | |||
| (PID) Process: | (5192) msiexec.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Rollback\Scripts |
| Operation: | write | Name: | C:\Config.Msi\13aa2f.rbsLow |
Value: | |||
Executable files
158
Suspicious files
8
Text files
49
Unknown types
0
Dropped files
PID | Process | Filename | Type | |
|---|---|---|---|---|
| 5192 | msiexec.exe | C:\Windows\Installer\MSI60A1.tmp | — | |
MD5:— | SHA256:— | |||
| 5192 | msiexec.exe | C:\Windows\Installer\MSIA974.tmp | executable | |
MD5:475D20C0EA477A35660E3F67ECF0A1DF | SHA256:426E6CF199A8268E8A7763EC3A4DD7ADD982B28C51D89EBEA90CA792CBAE14DD | |||
| 5192 | msiexec.exe | C:\Windows\Temp\~DFCE113CC0B3262CA5.TMP | binary | |
MD5:75FE44448300E808F3C9B4E55665ECC9 | SHA256:CB0ECC8947CA9496E212A985C294A350F4B8D61B903CEB7EE89BBBEB1BDE405D | |||
| 5192 | msiexec.exe | C:\Windows\Installer\inprogressinstallinfo.ipi | binary | |
MD5:75FE44448300E808F3C9B4E55665ECC9 | SHA256:CB0ECC8947CA9496E212A985C294A350F4B8D61B903CEB7EE89BBBEB1BDE405D | |||
| 5192 | msiexec.exe | C:\Windows\Installer\MSIAAFE.tmp | binary | |
MD5:36CD5AEF5EA99E54B208A723C88BDA7F | SHA256:FF02FD8CDCEF4D095F6AC614C9D74E03C993AF14BFEA4DA226CA210B074AC340 | |||
| 5192 | msiexec.exe | C:\Users\admin\AppData\Roaming\onedrive\QuotaOverLimit_default.png | image | |
MD5:E3FC02A16E3E550ED34CF0ACED64E87F | SHA256:8F4A9341CC0715F081F6275B436A34BB9E62DB4A5E937AA273DDBEC0660686A8 | |||
| 5192 | msiexec.exe | C:\Users\admin\AppData\Roaming\onedrive\quotawarning_light.png | image | |
MD5:DDEDCD8B3C0214B4F33E7136E83192F6 | SHA256:B2B999186325F76A42A20BE9A453BF1A50368BB203BB8BE5945FC86702BDA15B | |||
| 5192 | msiexec.exe | C:\Users\admin\AppData\Roaming\onedrive\quotawarning_dark.png | image | |
MD5:960AFF869C6269D96EE8327B35DF0927 | SHA256:1809EC80A5838548D2B79FCE0EA5ED6B6370B3EFCB3F532B83B35365E7FD5AED | |||
| 5192 | msiexec.exe | C:\Windows\Installer\MSIA9B4.tmp | executable | |
MD5:475D20C0EA477A35660E3F67ECF0A1DF | SHA256:426E6CF199A8268E8A7763EC3A4DD7ADD982B28C51D89EBEA90CA792CBAE14DD | |||
| 5192 | msiexec.exe | C:\Windows\Temp\~DF0F077A9CFCE62B26.TMP | binary | |
MD5:BF619EAC0CDF3F68D496EA9344137E8B | SHA256:076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560 | |||
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
7
TCP/UDP connections
33
DNS requests
20
Threats
0
HTTP requests
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
|---|---|---|---|---|---|---|---|---|---|
1536 | svchost.exe | GET | 200 | 95.101.54.137:80 | http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl | unknown | — | — | whitelisted |
3568 | SIHClient.exe | GET | 200 | 104.119.109.218:80 | http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl | unknown | — | — | whitelisted |
3568 | SIHClient.exe | GET | 200 | 104.119.109.218:80 | http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl | unknown | — | — | whitelisted |
3080 | backgroundTaskHost.exe | GET | 200 | 2.23.77.188:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAUZZSZEml49Gjh0j13P68w%3D | unknown | — | — | whitelisted |
— | — | GET | 200 | 2.23.77.188:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAI5PUjXAkJafLQcAAsO18o%3D | unknown | — | — | whitelisted |
1536 | svchost.exe | GET | 200 | 2.23.246.101:80 | http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl | unknown | — | — | whitelisted |
— | — | GET | 200 | 2.23.77.188:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D | unknown | — | — | whitelisted |
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
Connections
PID | Process | IP | Domain | ASN | CN | Reputation |
|---|---|---|---|---|---|---|
4712 | MoUsoCoreWorker.exe | 20.73.194.208:443 | — | MICROSOFT-CORP-MSN-AS-BLOCK | NL | whitelisted |
4 | System | 192.168.100.255:137 | — | — | — | whitelisted |
1536 | svchost.exe | 20.73.194.208:443 | — | MICROSOFT-CORP-MSN-AS-BLOCK | NL | whitelisted |
236 | RUXIMICS.exe | 20.73.194.208:443 | — | MICROSOFT-CORP-MSN-AS-BLOCK | NL | whitelisted |
4 | System | 192.168.100.255:138 | — | — | — | whitelisted |
5192 | msiexec.exe | 104.21.23.216:443 | streameqst.live | CLOUDFLARENET | — | unknown |
1536 | svchost.exe | 51.124.78.146:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | NL | whitelisted |
1536 | svchost.exe | 95.101.54.137:80 | crl.microsoft.com | Akamai International B.V. | DE | whitelisted |
1536 | svchost.exe | 2.23.246.101:80 | www.microsoft.com | Ooredoo Q.S.C. | QA | whitelisted |
5064 | SearchApp.exe | 2.23.227.215:443 | www.bing.com | Ooredoo Q.S.C. | QA | whitelisted |
DNS requests
Domain | IP | Reputation |
|---|---|---|
google.com |
| whitelisted |
streameqst.live |
| unknown |
settings-win.data.microsoft.com |
| whitelisted |
crl.microsoft.com |
| whitelisted |
www.microsoft.com |
| whitelisted |
www.bing.com |
| whitelisted |
login.live.com |
| whitelisted |
ocsp.digicert.com |
| whitelisted |
go.microsoft.com |
| whitelisted |
slscr.update.microsoft.com |
| whitelisted |