File name:

ZeroTier One.msi

Full analysis: https://app.any.run/tasks/2ceb7b50-2b68-49e9-a2a2-40d2cb93c29b
Verdict: Malicious activity
Analysis date: March 01, 2020, 18:07:35
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
generated-doc
Indicators:
MIME: application/x-msi
File info: Composite Document File V2 Document, Little Endian, Os: Windows, Version 10.0, MSI Installer, Last Printed: Fri Dec 11 11:47:44 2009, Create Time/Date: Fri Dec 11 11:47:44 2009, Last Saved Time/Date: Fri Dec 11 11:47:44 2009, Security: 0, Code page: 1252, Revision Number: {CCC926E3-9294-49EC-A968-EB46C7C6E8DD}, Number of Words: 2, Subject: ZeroTier One, Author: ZeroTier, Inc., Name of Creating Application: Advanced Installer 14.5.2 build 83143, Template: ;1033, Comments: This installer database contains the logic and data required to install ZeroTier One., Title: Installation Database, Keywords: Installer, MSI, Database, Number of Pages: 200
MD5:

EE6F67E2EFDA78A897971A3B12455D39

SHA1:

DF0803639F663E4B1791E2894D0EF47697064727

SHA256:

F18D2D4E4F053D75DA625ACFC8E2A8820BCD107722D6FB1721B407806DB6CEFC

SSDEEP:

196608:L7IR8HLFXrwAU8bdEPC2UY8EWWWWWWWWwtYRt1U7B37heaf7a:C8Z1oCfFvYRLUt7heaja

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Application was dropped or rewritten from another process

      • zerotier-one_x86.exe (PID: 3560)
      • certutil.exe (PID: 3052)

    • Changes settings of System certificates

      • certutil.exe (PID: 3052)

  • SUSPICIOUS

    • Executed as Windows Service

      • vssvc.exe (PID: 3188)
      • zerotier-one_x86.exe (PID: 3560)

    • Reads Environment values

      • MsiExec.exe (PID: 2536)

    • Executable content was dropped or overwritten

      • msiexec.exe (PID: 3380)
      • MsiExec.exe (PID: 3528)
      • MsiExec.exe (PID: 2536)
      • DrvInst.exe (PID: 1064)

    • Uses ICACLS.EXE to modify access control list

      • zerotier-one_x86.exe (PID: 3560)

    • Executed via COM

      • DllHost.exe (PID: 3020)
      • DrvInst.exe (PID: 1064)

    • Creates files in the program directory

      • zerotier-one_x86.exe (PID: 3560)

    • Uses NETSH.EXE for network configuration

      • zerotier-one_x86.exe (PID: 3560)

    • Starts CMD.EXE for commands execution

      • cmd.exe (PID: 2052)
      • MsiExec.exe (PID: 2536)
      • cmd.exe (PID: 1828)
      • cmd.exe (PID: 3148)
      • cmd.exe (PID: 1852)

    • Creates files in the Windows directory

      • certutil.exe (PID: 3052)
      • DrvInst.exe (PID: 1064)

    • Removes files from Windows directory

      • certutil.exe (PID: 3052)
      • DrvInst.exe (PID: 1064)

    • Creates files in the driver directory

      • DrvInst.exe (PID: 1064)

  • INFO

    • Low-level read access rights to disk partition

      • vssvc.exe (PID: 3188)

    • Searches for installed software

      • msiexec.exe (PID: 3380)

    • Application launched itself

      • msiexec.exe (PID: 3380)

    • Creates files in the program directory

      • msiexec.exe (PID: 3380)
      • MsiExec.exe (PID: 2536)

    • Reads settings of System Certificates

      • msiexec.exe (PID: 3380)
      • DrvInst.exe (PID: 1064)

    • Creates a software uninstall entry

      • msiexec.exe (PID: 3380)

    • Loads dropped or rewritten executable

      • MsiExec.exe (PID: 2372)
      • MsiExec.exe (PID: 2536)
      • MsiExec.exe (PID: 3528)

    • Dropped object may contain Bitcoin addresses

      • msiexec.exe (PID: 3380)

    • Starts application with an unusual extension

      • msiexec.exe (PID: 3380)

    • Application was dropped or rewritten from another process

      • MSIFF5F.tmp (PID: 2932)

    • Changes settings of System certificates

      • DrvInst.exe (PID: 1064)

    • Adds / modifies Windows certificates

      • DrvInst.exe (PID: 1064)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.msi | Microsoft Windows Installer (81.9)
.mst | Windows SDK Setup Transform Script (9.2)
.msp | Windows Installer Patch (7.6)
.msi | Microsoft Installer (100)

EXIF

FlashPix

LastPrinted: 2009:12:11 11:47:44
CreateDate: 2009:12:11 11:47:44
ModifyDate: 2009:12:11 11:47:44
Security: None
CodePage: Windows Latin 1 (Western European)
RevisionNumber: {CCC926E3-9294-49EC-A968-EB46C7C6E8DD}
Words: 2
Subject: ZeroTier One
Author: ZeroTier, Inc.
LastModifiedBy: -
Software: Advanced Installer 14.5.2 build 83143
Template: ;1033
Comments: This installer database contains the logic and data required to install ZeroTier One.
Title: Installation Database
Keywords: Installer, MSI, Database
Pages: 200
No data.
screenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
81
Monitored processes
32
Malicious processes
4
Suspicious processes
1

Behavior graph

Click at the process to see the details
start drop and start drop and start msiexec.exe no specs msiexec.exe msiexec.exe no specs vssvc.exe no specs msiexec.exe msiexec.exe HNetCfg.FwPolicy2 no specs zerotier-one_x86.exe netsh.exe no specs netsh.exe no specs netsh.exe no specs icacls.exe no specs icacls.exe no specs icacls.exe no specs icacls.exe no specs icacls.exe no specs icacls.exe no specs cmd.exe no specs cmd.exe no specs xcopy.exe no specs cmd.exe no specs cmd.exe no specs xcopy.exe no specs cmd.exe no specs cmd.exe no specs xcopy.exe no specs cmd.exe no specs cmd.exe no specs xcopy.exe no specs msiff5f.tmp no specs certutil.exe no specs drvinst.exe

Process information

PID
CMD
Path
Indicators
Parent process
880xcopy /E /Y /K /H /I "1\*" "C:\Windows\Fonts\"C:\Windows\system32\xcopy.exe—cmd.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Extended Copy Utility
Exit code:
4
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\xcopy.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\ulib.dll
c:\windows\system32\user32.dll
1064DrvInst.exe "4" "0" "C:\Users\admin\AppData\Local\Temp\{0e248401-b7b0-016e-67ca-2d5c41d8b93c}\zttap300.inf" "0" "6d2774c0b" "00000554" "WinSta0\Default" "000003C0" "208" "C:\Program Files\ZeroTier\ZeroTier One Virtual Network Port\zttap300"C:\Windows\system32\DrvInst.exe
svchost.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Driver Installation Module
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\drvinst.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\setupapi.dll
c:\windows\system32\cfgmgr32.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
1632xcopy /E /Y /K /H /I "2\*" "C:\Windows\Fonts\"C:\Windows\system32\xcopy.exe—cmd.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Extended Copy Utility
Exit code:
4
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\xcopy.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\ulib.dll
c:\windows\system32\user32.dll
1740xcopy /E /Y /K /H /I "0\*" "C:\Windows\Fonts\"C:\Windows\system32\xcopy.exe—cmd.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Extended Copy Utility
Exit code:
4
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\xcopy.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\ulib.dll
c:\windows\system32\user32.dll
1828/C "C:\Users\admin\AppData\Local\Temp\{B16A57C0-300A-4B0C-9EE3-CF34F06B404F}.bat"C:\Windows\system32\cmd.exe—MsiExec.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Windows Command Processor
Exit code:
1
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\cmd.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\winbrand.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
1832C:\Windows\System32\icacls.exe "C:\ProgramData\ZeroTier\One\authtoken.secret" /inheritance:d /QC:\Windows\System32\icacls.exe—zerotier-one_x86.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\icacls.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\ntmarta.dll
c:\windows\system32\wldap32.dll
1852/C "C:\Users\admin\AppData\Local\Temp\{FE29E45D-0F17-40BE-9EA2-F73ACC293F31}.bat"C:\Windows\system32\cmd.exe—MsiExec.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Windows Command Processor
Exit code:
1
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\cmd.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\winbrand.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
1944C:\Windows\system32\cmd.exe /c dir /b /a "1" C:\Windows\system32\cmd.exe—cmd.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\cmd.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\winbrand.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
2052/C "C:\Users\admin\AppData\Local\Temp\{5A5095F0-B6F5-48FA-A295-6D334C852758}.bat"C:\Windows\system32\cmd.exe—MsiExec.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Windows Command Processor
Exit code:
1
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\cmd.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\winbrand.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
2372C:\Windows\system32\MsiExec.exe -Embedding 2927C0B2FCC1F86E86E9A33CD78CDD54 CC:\Windows\system32\MsiExec.exe—msiexec.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows® installer
Exit code:
0
Version:
5.0.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\msiexec.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
Total events
2 471
Read events
965
Write events
1 498
Delete events
8

Modification events

(PID) Process:(2908) msiexec.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\12B\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(3380) msiexec.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\SystemRestore
Operation:writeName:SrCreateRp (Enter)
Value:
4000000000000000161D0061F4EFD501340D0000A00A0000D5070000000000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(3380) msiexec.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\SPP
Operation:writeName:SppCreate (Enter)
Value:
4000000000000000161D0061F4EFD501340D0000A00A0000D0070000000000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(3380) msiexec.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SPP
Operation:writeName:LastIndex
Value:
34
(PID) Process:(3380) msiexec.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\SPP
Operation:writeName:SppGatherWriterMetadata (Enter)
Value:
4000000000000000A2A34761F4EFD501340D0000A00A0000D3070000000000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(3380) msiexec.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\VssapiPublisher
Operation:writeName:IDENTIFY (Enter)
Value:
4000000000000000FC054A61F4EFD501340D000050080000E80300000100000000000000000000000A16C92642769342B3940B8233E5C4A10000000000000000
(PID) Process:(3188) vssvc.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\ASR Writer
Operation:writeName:IDENTIFY (Enter)
Value:
4000000000000000CC185D61F4EFD501740C00000C0D0000E8030000010000000100000000000000000000000000000000000000000000000000000000000000
(PID) Process:(3188) vssvc.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\Shadow Copy Optimization Writer
Operation:writeName:IDENTIFY (Enter)
Value:
4000000000000000CC185D61F4EFD501740C0000640A0000E8030000010000000100000000000000000000000000000000000000000000000000000000000000
(PID) Process:(3188) vssvc.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\Registry Writer
Operation:writeName:IDENTIFY (Enter)
Value:
4000000000000000CC185D61F4EFD501740C0000C40A0000E8030000010000000100000000000000000000000000000000000000000000000000000000000000
(PID) Process:(3188) vssvc.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\COM+ REGDB Writer
Operation:writeName:IDENTIFY (Enter)
Value:
4000000000000000CC185D61F4EFD501740C000074090000E8030000010000000100000000000000000000000000000000000000000000000000000000000000
Executable files
18
Suspicious files
17
Text files
33
Unknown types
18

Dropped files

PID
Process
Filename
Type
2908msiexec.exeC:\Users\admin\AppData\Local\Temp\MSI810F.tmp —
MD5:—
SHA256:—
2908msiexec.exeC:\Users\admin\AppData\Local\Temp\MSI818D.tmp —
MD5:—
SHA256:—
2908msiexec.exeC:\Users\admin\AppData\Local\Temp\MSI819E.tmp —
MD5:—
SHA256:—
2908msiexec.exeC:\Users\admin\AppData\Local\Temp\MSI81CE.tmp —
MD5:—
SHA256:—
2908msiexec.exeC:\Users\admin\AppData\Local\Temp\MSI81DE.tmp —
MD5:—
SHA256:—
2908msiexec.exeC:\Users\admin\AppData\Local\Temp\MSI81EF.tmp —
MD5:—
SHA256:—
2908msiexec.exeC:\Users\admin\AppData\Local\Temp\MSI820F.tmp —
MD5:—
SHA256:—
3380msiexec.exeC:\System Volume Information\SPP\metadata-2 —
MD5:—
SHA256:—
3380msiexec.exeC:\Windows\Installer\a6f6bc.msi —
MD5:—
SHA256:—
3380msiexec.exeC:\Windows\Installer\MSIFE3F.tmp —
MD5:—
SHA256:—
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
27
DNS requests
0
Threats
0

HTTP requests

No HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
3560
zerotier-one_x86.exe
185.180.13.82:9993
—
Datacamp Limited
US
unknown
—
—
207.246.73.245:443
—
—
US
unknown
—
—
147.75.92.2:9993
—
Packet Host, Inc.
US
unknown
—
—
195.181.173.159:9993
—
Datacamp Limited
GB
unknown
—
—
103.195.103.66:443
—
Choopa, LLC
US
suspicious
—
—
185.180.13.82:443
—
Datacamp Limited
US
unknown
—
—
147.75.92.2:443
—
Packet Host, Inc.
US
unknown
—
—
103.195.103.66:9993
—
Choopa, LLC
US
suspicious
—
—
195.181.173.159:443
—
Datacamp Limited
GB
unknown

DNS requests

No data

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
ZeroTier One.msi