analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
File name:

ADTD.Net Setup.msi

Full analysis: https://app.any.run/tasks/3277daa4-076a-4d18-ad62-df5c793851a6
Verdict: Malicious activity
Analysis date: March 21, 2019, 09:01:07
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: application/x-msi
File info: Composite Document File V2 Document, Little Endian, Os: Windows, Version 5.2, MSI Installer, Create Time/Date: Mon Jun 21 08:00:00 1999, Name of Creating Application: Windows Installer, Security: 1, Code page: 1252, Template: Intel;1033, Number of Pages: 200, Revision Number: {E635A1BC-3A3D-4CDB-828B-FA8E922A0833}, Title: Active Directory Topology Diagrammer, Author: Microsoft Corporation, Keywords: ADTD, Comments: Make your Microsoft Active Directory configuration visible in Microsoft Visio, Number of Words: 2, Last Saved Time/Date: Tue May 10 10:41:19 2011, Last Printed: Tue May 10 10:41:19 2011
MD5:

EF9A1ACA99082FA0970095A150B9B55A

SHA1:

C5D51F2B400FD41EC13905ABAA08A41E9B842CD7

SHA256:

ED3F6222704691F8E826F63334EA161E1316FE78E38EB594286BF2DFD16895FF

SSDEEP:

24576:lpFG1n9AGyKfeefIN8bYtSF1A8BV0gmaIPFlL:lpFG19zfe8IMY8Fy8B5MF1

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Application was dropped or rewritten from another process

      • ADTD.exe (PID: 3412)
      • ADTD.exe (PID: 3272)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • msiexec.exe (PID: 2096)

  • INFO

    • Searches for installed software

      • msiexec.exe (PID: 2096)

    • Changes settings of System certificates

      • DrvInst.exe (PID: 332)

    • Low-level read access rights to disk partition

      • vssvc.exe (PID: 396)

    • Creates files in the program directory

      • msiexec.exe (PID: 2096)

    • Application launched itself

      • msiexec.exe (PID: 2096)

    • Adds / modifies Windows certificates

      • DrvInst.exe (PID: 332)

    • Creates a software uninstall entry

      • msiexec.exe (PID: 2096)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.msi | Microsoft Windows Installer (98.5)
.msi | Microsoft Installer (100)

EXIF

FlashPix

LastPrinted: 2011:05:10 09:41:19
ModifyDate: 2011:05:10 09:41:19
Words: 2
Comments: Make your Microsoft Active Directory configuration visible in Microsoft Visio
Keywords: ADTD
Author: Microsoft Corporation
Subject: -
Title: Active Directory Topology Diagrammer
RevisionNumber: {E635A1BC-3A3D-4CDB-828B-FA8E922A0833}
Pages: 200
Template: Intel;1033
CodePage: Windows Latin 1 (Western European)
Security: Password protected
Software: Windows Installer
CreateDate: 1999:06:21 07:00:00
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
41
Monitored processes
8
Malicious processes
1
Suspicious processes
0

Behavior graph

Click at the process to see the details
start msiexec.exe no specs msiexec.exe msiexec.exe no specs vssvc.exe no specs drvinst.exe no specs msiexec.exe no specs adtd.exe no specs adtd.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
360"C:\Windows\System32\msiexec.exe" /i "C:\Users\admin\AppData\Local\Temp\ADTD.Net Setup.msi"C:\Windows\System32\msiexec.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows® installer
Exit code:
0
Version:
5.0.7600.16385 (win7_rtm.090713-1255)
2096C:\Windows\system32\msiexec.exe /VC:\Windows\system32\msiexec.exe
services.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Windows® installer
Version:
5.0.7600.16385 (win7_rtm.090713-1255)
3316C:\Windows\system32\MsiExec.exe -Embedding A754C127F4D7A58C495920AA57DC81D9 CC:\Windows\system32\MsiExec.exe—msiexec.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows® installer
Exit code:
0
Version:
5.0.7600.16385 (win7_rtm.090713-1255)
396C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe—services.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Microsoft® Volume Shadow Copy Service
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
332DrvInst.exe "1" "200" "STORAGE\VolumeSnapshot\HarddiskVolumeSnapshot18" "" "" "6792c44eb" "00000000" "00000398" "000005C4"C:\Windows\system32\DrvInst.exe—svchost.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Driver Installation Module
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
3760C:\Windows\system32\MsiExec.exe -Embedding 5FAD641CDFE9F8A8C2037D995FF3D991C:\Windows\system32\MsiExec.exe—msiexec.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows® installer
Exit code:
0
Version:
5.0.7600.16385 (win7_rtm.090713-1255)
3412"C:\Program Files\Microsoft Active Directory Topology Diagrammer\ADTD.exe" C:\Program Files\Microsoft Active Directory Topology Diagrammer\ADTD.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Active Directory Topology Diagrammer
Exit code:
0
Version:
2.2.4146.20801
3272"C:\Program Files\Microsoft Active Directory Topology Diagrammer\ADTD.exe" C:\Program Files\Microsoft Active Directory Topology Diagrammer\ADTD.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Active Directory Topology Diagrammer
Exit code:
0
Version:
2.2.4146.20801
Total events
731
Read events
435
Write events
0
Delete events
0

Modification events

No data
Executable files
4
Suspicious files
7
Text files
96
Unknown types
4

Dropped files

PID
Process
Filename
Type
360msiexec.exeC:\Users\admin\AppData\Local\Temp\MSIA128.tmp —
MD5:—
SHA256:—
360msiexec.exeC:\Users\admin\AppData\Local\Temp\MSIA1D5.tmp —
MD5:—
SHA256:—
2096msiexec.exeC:\System Volume Information\SPP\metadata-2 —
MD5:—
SHA256:—
2096msiexec.exeC:\System Volume Information\SPP\OnlineMetadataCache\{24c29632-a1bc-417d-8a82-675fb92e1b90}_OnDiskSnapshotPropbinary
MD5:D890A964A6677CAA728DC60B19B64D79
SHA256:041F014E84794D10818F5A9185526057AC7FCA356CFC8EF9AE13E643245F5B47
332DrvInst.exeC:\Windows\INF\setupapi.ev1binary
MD5:AFDD2D3663332D156563D17DE12E8313
SHA256:16EE238B56E605FDA13735B615D29A956DBB11674C8FB84139C6E0D2E38A6139
332DrvInst.exeC:\Windows\INF\setupapi.ev3binary
MD5:76DCC60F78B3DFF1AE3627619074F465
SHA256:18541AC1875315C4F9EFF75050C574FAFF83717C029DAE6B366F9C6C3F0C19E0
332DrvInst.exeC:\Windows\INF\setupapi.dev.logini
MD5:035E38EF72ECDD3217DC81D8E7A5610A
SHA256:A6F077739C03B3829D80EA04A23B938CEC124778A5618A8DE34C44C56C377D18
2096msiexec.exeC:\System Volume Information\SPP\snapshot-2binary
MD5:D890A964A6677CAA728DC60B19B64D79
SHA256:041F014E84794D10818F5A9185526057AC7FCA356CFC8EF9AE13E643245F5B47
3316MsiExec.exeC:\Users\admin\AppData\Local\Temp\CFGA1C5.tmpxml
MD5:17AF548F88A3199AA8A63A72201F470F
SHA256:A558DBE555749CD3BDD62060FDBBA72720C4F4A186D5870B977ED2ACF9721D9E
2096msiexec.exeC:\Windows\Installer\MSI2146.tmp —
MD5:—
SHA256:—
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
0
DNS requests
0
Threats
0

HTTP requests

No HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

No data

DNS requests

No data

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2024 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
ADTD.Net Setup.msi