Malware analysis 4e7ac0bdb516e983b3cab7f79850d8102d2bf4117bb343b68d0da73780cceb1a.msi Malicious activity

analyze malware

Huge database of samples and IOCs
Custom VM setup
Unlimited submissions
Interactive approach

Add for printing

File name:	4e7ac0bdb516e983b3cab7f79850d8102d2bf4117bb343b68d0da73780cceb1a.msi
Full analysis:	https://app.any.run/tasks/845b6837-b5d8-4a84-8382-1fa5d7381111
Verdict:	Malicious activity
Analysis date:	April 26, 2024, 21:13:47
OS:	Windows 10 Professional (build: 19045, 64 bit)
Tags:	latrodectus
Indicators:
MIME:	application/x-msi
File info:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 10.0, MSI Installer, Last Printed: Fri Dec 11 11:47:44 2009, Create Time/Date: Fri Dec 11 11:47:44 2009, Last Saved Time/Date: Fri Sep 18 14:06:51 2020, Security: 0, Code page: 1252, Revision Number: {6C81CEE0-3161-4D91-A688-254B67D7D838}, Number of Words: 10, Subject: 360 Total, Author: HuMaster LLC, Name of Creating Application: 360 Total, Template: ;1033, Comments: This installer database contains the logic and data required to install 360 Total., Title: Installation Database, Keywords: Installer, MSI, Database, Number of Pages: 200
MD5:	37605A3EB80F3366E56938031A9AC917
SHA1:	0582A0DD69D6027FB94765254ED91AD736ADE305
SHA256:	4E7AC0BDB516E983B3CAB7F79850D8102D2BF4117BB343B68D0DA73780CCEB1A
SSDEEP:	49152:CZq9IfHgoHxmbqD+/GKIikt698ta5Q1rTeor8trZeXxU6qaaAttJ9VKIf+iRQEWH:J9IIoHWkt698t5TeorjUFaztz9AI2i2Q

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

Launch configuration

Task duration:: 120 seconds
Heavy Evasion option:: off
Network geolocation:: off
Additional time used:: none
MITM proxy:: off
Privacy:: Public submission
Fakenet option:: off
Route via Tor:: off
Autoconfirmation of UAC:: on
Network:: on

Software preset

Internet Explorer 11.3636.19041.0
Adobe Acrobat (64-bit) (23.001.20093)
Adobe Flash Player 32 NPAPI (32.0.0.465)
Adobe Flash Player 32 PPAPI (32.0.0.465)
CCleaner (6.20)
FileZilla 3.65.0 (3.65.0)
Google Chrome (122.0.6261.70)
Google Update Helper (1.3.36.51)
Java 8 Update 271 (64-bit) (8.0.2710.9)
Java Auto Updater (2.8.271.9)
Microsoft Edge (122.0.2365.59)
Microsoft Edge Update (1.3.185.17)
Microsoft Office Professional 2019 - de-de (16.0.16026.20146)
Microsoft Office Professional 2019 - en-us (16.0.16026.20146)
Microsoft Office Professional 2019 - es-es (16.0.16026.20146)
Microsoft Office Professional 2019 - it-it (16.0.16026.20146)
Microsoft Office Professional 2019 - ja-jp (16.0.16026.20146)
Microsoft Office Professional 2019 - ko-kr (16.0.16026.20146)
Microsoft Office Professional 2019 - pt-br (16.0.16026.20146)
Microsoft Office Professional 2019 - tr-tr (16.0.16026.20146)
Microsoft Office Professionnel 2019 - fr-fr (16.0.16026.20146)
Microsoft Office профессиональный 2019 - ru-ru (16.0.16026.20146)
Microsoft OneNote - en-us (16.0.16026.20146)
Microsoft Update Health Tools (3.74.0.0)
Microsoft Visual C++ 2013 Redistributable (x64) - 12.0.30501 (12.0.30501.0)
Microsoft Visual C++ 2013 x64 Additional Runtime - 12.0.21005 (12.0.21005)
Microsoft Visual C++ 2013 x64 Minimum Runtime - 12.0.21005 (12.0.21005)
Microsoft Visual C++ 2015-2022 Redistributable (x64) - 14.36.32532 (14.36.32532.0)
Microsoft Visual C++ 2015-2022 Redistributable (x86) - 14.36.32532 (14.36.32532.0)
Microsoft Visual C++ 2022 X64 Additional Runtime - 14.36.32532 (14.36.32532)
Microsoft Visual C++ 2022 X64 Minimum Runtime - 14.36.32532 (14.36.32532)
Microsoft Visual C++ 2022 X86 Additional Runtime - 14.36.32532 (14.36.32532)
Microsoft Visual C++ 2022 X86 Minimum Runtime - 14.36.32532 (14.36.32532)
Mozilla Firefox (x64 en-US) (123.0)
Mozilla Maintenance Service (123.0)
Notepad++ (64-bit x64) (7.9.1)
Office 16 Click-to-Run Extensibility Component (16.0.15726.20202)
Office 16 Click-to-Run Licensing Component (16.0.16026.20146)
Office 16 Click-to-Run Localization Component (16.0.15726.20202)
Office 16 Click-to-Run Localization Component (16.0.15726.20202)
Office 16 Click-to-Run Localization Component (16.0.15726.20202)
Office 16 Click-to-Run Localization Component (16.0.15726.20202)
Office 16 Click-to-Run Localization Component (16.0.15726.20202)
Office 16 Click-to-Run Localization Component (16.0.15726.20202)
Office 16 Click-to-Run Localization Component (16.0.15726.20202)
Office 16 Click-to-Run Localization Component (16.0.15928.20198)
PowerShell 7-x64 (7.3.5.0)
Skype version 8.104 (8.104)
Update for Windows 10 for x64-based Systems (KB4023057) (2.59.0.0)
Update for Windows 10 for x64-based Systems (KB4023057) (2.63.0.0)
Update for Windows 10 for x64-based Systems (KB4480730) (2.55.0.0)
Update for Windows 10 for x64-based Systems (KB5001716) (8.93.0.0)
VLC media player (3.0.11)
WinRAR 5.91 (64-bit) (5.91.0)
Windows PC Health Check (3.6.2204.08001)

Add for printing

MALICIOUS
- Drops the executable file immediately after the start
  - msiexec.exe (PID: 3808)
  - msiexec.exe (PID: 1100)
- LATRODECTUS mutex has been found
  - rundll32.exe (PID: 6164)
  - rundll32.exe (PID: 6212)
- LATRODECTUS has been detected
  - rundll32.exe (PID: 6164)
  - rundll32.exe (PID: 6212)
SUSPICIOUS
- Executes as Windows Service
  - VSSVC.exe (PID: 4360)
- Reads the Windows owner or organization settings
  - msiexec.exe (PID: 1100)
- Reads the date of Windows installation
  - MSI7C64.tmp (PID: 1728)
- Reads security settings of Internet Explorer
  - MSI7C64.tmp (PID: 1728)
- Uses RUNDLL32.EXE to load library
  - rundll32.exe (PID: 6148)
  - rundll32.exe (PID: 6164)
- Executable content was dropped or overwritten
  - rundll32.exe (PID: 6164)
- Application launched itself
  - rundll32.exe (PID: 6164)
- Non-standard symbols in registry
  - msiexec.exe (PID: 1100)
INFO
- Checks supported languages
  - msiexec.exe (PID: 4928)
  - msiexec.exe (PID: 1100)
  - msiexec.exe (PID: 3172)
  - MSI7C64.tmp (PID: 1728)
- Executable content was dropped or overwritten
  - msiexec.exe (PID: 3808)
  - msiexec.exe (PID: 1100)
- Reads the computer name
  - msiexec.exe (PID: 4928)
  - msiexec.exe (PID: 1100)
  - msiexec.exe (PID: 3172)
  - MSI7C64.tmp (PID: 1728)
- Reads Environment values
  - msiexec.exe (PID: 4928)
  - msiexec.exe (PID: 3172)
- Starts application with an unusual extension
  - msiexec.exe (PID: 1100)
- Creates files or folders in the user directory
  - msiexec.exe (PID: 1100)
  - rundll32.exe (PID: 6164)
- Drops the executable file immediately after the start
  - rundll32.exe (PID: 6164)
- Process checks computer location settings
  - MSI7C64.tmp (PID: 1728)

Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report

Add for printing

No Malware configuration.

Add for printing

TRiD

.msi	\|	Microsoft Windows Installer (81.9)
.mst	\|	Windows SDK Setup Transform Script (9.2)
.msp	\|	Windows Installer Patch (7.6)
.msi	\|	Microsoft Installer (100)

EXIF

FlashPix

Pages:	200
Keywords:	Installer, MSI, Database
Title:	Installation Database
Comments:	This installer database contains the logic and data required to install 360 Total.
Template:	;1033
Software:	360 Total
LastModifiedBy:	-
Author:	HuMaster LLC
Subject:	360 Total
Words:	10
RevisionNumber:	{6C81CEE0-3161-4D91-A688-254B67D7D838}
CodePage:	Windows Latin 1 (Western European)
Security:	None
ModifyDate:	2020:09:18 14:06:51
CreateDate:	2009:12:11 11:47:44
LastPrinted:	2009:12:11 11:47:44

No data.

Add for printing

All screenshots are available in the full report

Add for printing

Total processes

137

Monitored processes

Malicious processes

Suspicious processes

Behavior graph

Click at the process to see the details

Process information

PID

CMD

Path

Indicators

Parent process

3808

"C:\Windows\System32\msiexec.exe" /i C:\Users\admin\AppData\Local\Temp\4e7ac0bdb516e983b3cab7f79850d8102d2bf4117bb343b68d0da73780cceb1a.msi

C:\Windows\System32\msiexec.exe

explorer.exe

User:

admin

Company:

Microsoft Corporation

Integrity Level:

MEDIUM

Description:

Windows® installer

Exit code:

Version:

5.0.19041.1 (WinBuild.160101.0800)

Modules

Images
c:\windows\system32\msiexec.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\aclayers.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll

1100

C:\WINDOWS\system32\msiexec.exe /V

C:\Windows\System32\msiexec.exe

services.exe

User:

SYSTEM

Company:

Microsoft Corporation

Integrity Level:

SYSTEM

Description:

Windows® installer

Version:

5.0.19041.1 (WinBuild.160101.0800)

Modules

Images
c:\windows\system32\msiexec.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\aclayers.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll

4928

C:\Windows\syswow64\MsiExec.exe -Embedding 3EE977F149FC22A24CD53DF05D854C8A C

C:\Windows\SysWOW64\msiexec.exe

—

msiexec.exe

User:

admin

Company:

Microsoft Corporation

Integrity Level:

MEDIUM

Description:

Windows® installer

Exit code:

Version:

5.0.19041.3636 (WinBuild.160101.0800)

Modules

Images
c:\windows\syswow64\msiexec.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\aclayers.dll

4360

C:\WINDOWS\system32\vssvc.exe

C:\Windows\System32\VSSVC.exe

—

services.exe

User:

SYSTEM

Company:

Microsoft Corporation

Integrity Level:

SYSTEM

Description:

Microsoft® Volume Shadow Copy Service

Version:

10.0.19041.1 (WinBuild.160101.0800)

Modules

Images
c:\windows\system32\vssvc.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll

1572

C:\WINDOWS\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:11

C:\Windows\System32\SrTasks.exe

—

msiexec.exe

User:

SYSTEM

Company:

Microsoft Corporation

Integrity Level:

SYSTEM

Description:

Microsoft® Windows System Protection background tasks.

Exit code:

Version:

10.0.19041.1 (WinBuild.160101.0800)

Modules

Images
c:\windows\system32\srtasks.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll

5396

\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1

C:\Windows\System32\conhost.exe

—

SrTasks.exe

User:

SYSTEM

Company:

Microsoft Corporation

Integrity Level:

SYSTEM

Description:

Console Window Host

Exit code:

Version:

10.0.19041.1 (WinBuild.160101.0800)

Modules

Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll

3172

C:\Windows\syswow64\MsiExec.exe -Embedding 0961D90D9934635FAE8C7D9BF8CAB328

C:\Windows\SysWOW64\msiexec.exe

—

msiexec.exe

User:

admin

Company:

Microsoft Corporation

Integrity Level:

MEDIUM

Description:

Windows® installer

Exit code:

Version:

5.0.19041.3636 (WinBuild.160101.0800)

Modules

Images
c:\windows\syswow64\msiexec.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\aclayers.dll

1728

"C:\WINDOWS\Installer\MSI7C64.tmp" C:/Windows/System32/rundll32.exe C:\Users\admin\AppData\Local\sharepoint\360total.dll, homq

C:\Windows\Installer\MSI7C64.tmp

—

msiexec.exe

User:

admin

Company:

Caphyon LTD

Integrity Level:

MEDIUM

Description:

File that launches another file

Exit code:

Version:

19.1.0.0

Modules

Images
c:\windows\installer\msi7c64.tmp
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\user32.dll
c:\windows\syswow64\win32u.dll

6148

"C:\Windows\System32\rundll32.exe" C:\Users\admin\AppData\Local\sharepoint\360total.dll, homq

C:\Windows\SysWOW64\rundll32.exe

—

MSI7C64.tmp

User:

admin

Company:

Microsoft Corporation

Integrity Level:

MEDIUM

Description:

Windows host process (Rundll32)

Exit code:

Version:

10.0.19041.3636 (WinBuild.160101.0800)

Modules

Images
c:\windows\syswow64\rundll32.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\aclayers.dll

6164

"C:\Windows\System32\rundll32.exe" C:\Users\admin\AppData\Local\sharepoint\360total.dll, homq

C:\Windows\System32\rundll32.exe

rundll32.exe

User:

admin

Company:

Microsoft Corporation

Integrity Level:

MEDIUM

Description:

Windows host process (Rundll32)

Exit code:

Version:

10.0.19041.1 (WinBuild.160101.0800)

Modules

Images
c:\windows\system32\rundll32.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\shcore.dll
c:\windows\system32\imagehlp.dll

Add for printing

Total events

6 486

Read events

6 265

Write events

202

Delete events

Modification events


(PID) Process:	(1100) msiexec.exe	Key:	HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\SystemRestore
Operation:	write	Name:	SrCreateRp (Enter)
Value: 4800000000000000697169A71E98DA014C0400007C030000D50700000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:	(1100) msiexec.exe	Key:	HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\SPP
Operation:	write	Name:	SppGetSnapshots (Enter)
Value: 4800000000000000697169A71E98DA014C0400007C030000D20700000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:	(1100) msiexec.exe	Key:	HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\SPP
Operation:	write	Name:	SppGetSnapshots (Leave)
Value: 48000000000000006C1A85A81E98DA014C0400007C030000D20700000100000000000000000000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:	(1100) msiexec.exe	Key:	HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\SPP
Operation:	write	Name:	SppEnumGroups (Enter)
Value: 48000000000000006C1A85A81E98DA014C0400007C030000D10700000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:	(1100) msiexec.exe	Key:	HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\SPP
Operation:	write	Name:	SppEnumGroups (Leave)
Value: 480000000000000098E489A81E98DA014C0400007C030000D10700000100000000000000010000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:	(1100) msiexec.exe	Key:	HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\SPP
Operation:	write	Name:	SppCreate (Enter)
Value: 4800000000000000711491A81E98DA014C0400007C030000D00700000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:	(1100) msiexec.exe	Key:	HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SPP
Operation:	write	Name:	LastIndex
Value: 11
(PID) Process:	(1100) msiexec.exe	Key:	HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\SPP
Operation:	write	Name:	SppGatherWriterMetadata (Enter)
Value: 4800000000000000D9FC18A91E98DA014C0400007C030000D30700000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:	(1100) msiexec.exe	Key:	HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\VssapiPublisher
Operation:	write	Name:	IDENTIFY (Enter)
Value: 4800000000000000D24D1BA91E98DA014C04000020100000E803000001000000000000000000000075DDB34EBFC7714EAC0DF1CBFBF3904400000000000000000000000000000000
(PID) Process:	(4360) VSSVC.exe	Key:	HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\COM+ REGDB Writer
Operation:	write	Name:	IDENTIFY (Enter)
Value: 4800000000000000111720A91E98DA010811000064080000E80300000100000001000000000000000000000000000000000000000000000000000000000000000000000000000000

Add for printing

Executable files

Suspicious files

Text files

Unknown types

Dropped files

PID	Process	Filename		Type
1100	msiexec.exe	C:\System Volume Information\SPP\OnlineMetadataCache\{4eb3dd75-c7bf-4e71-ac0d-f1cbfbf39044}_OnDiskSnapshotProp		—
		MD5:—	SHA256:—
1100	msiexec.exe	C:\System Volume Information\SPP\metadata-2		—
		MD5:—	SHA256:—
6164	rundll32.exe	C:\Users\admin\AppData\Local\sharepoint\360total.dll:wtfbbq		executable
		MD5:BD3A3714EE9A071EBEB59AC91D9EBB5A	SHA256:4CF2B612939359977DF51A32D2F63E2CB0C6C601E114B8E4812BD548D1DB85FE
3808	msiexec.exe	C:\Users\admin\AppData\Local\Temp\MSI392E.tmp		executable
		MD5:475D20C0EA477A35660E3F67ECF0A1DF	SHA256:426E6CF199A8268E8A7763EC3A4DD7ADD982B28C51D89EBEA90CA792CBAE14DD
1100	msiexec.exe	C:\WINDOWS\Installer\1178f6.msi		executable
		MD5:37605A3EB80F3366E56938031A9AC917	SHA256:4E7AC0BDB516E983B3CAB7F79850D8102D2BF4117BB343B68D0DA73780CCEB1A
1100	msiexec.exe	C:\WINDOWS\Installer\inprogressinstallinfo.ipi		binary
		MD5:585B7977CB1D2119DA05EE4B3897C153	SHA256:39A65795C5CBCAD7F70F50C9677FD8B1A74030E67BBAF0B286E2160C056E5CAD
1100	msiexec.exe	C:\WINDOWS\Installer\MSI7C64.tmp		executable
		MD5:B9545ED17695A32FACE8C3408A6A3553	SHA256:1E0E63B446EECF6C9781C7D1CAE1F46A3BB31654A70612F71F31538FB4F4729A
1100	msiexec.exe	C:\WINDOWS\TEMP\~DF0407A8B38DB56DD3.TMP		gmc
		MD5:50597AC9B0890E345D1C13533C973703	SHA256:6A94B299187A3A4ECCB36F289F6D17C814503AD27FAB5B2709C6FFD8094351BE
3808	msiexec.exe	C:\Users\admin\AppData\Local\Temp\MSI3AA7.tmp		executable
		MD5:475D20C0EA477A35660E3F67ECF0A1DF	SHA256:426E6CF199A8268E8A7763EC3A4DD7ADD982B28C51D89EBEA90CA792CBAE14DD
3808	msiexec.exe	C:\Users\admin\AppData\Local\Temp\MSI3AD6.tmp		executable
		MD5:475D20C0EA477A35660E3F67ECF0A1DF	SHA256:426E6CF199A8268E8A7763EC3A4DD7ADD982B28C51D89EBEA90CA792CBAE14DD

Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Add for printing

HTTP(S) requests

TCP/UDP connections

DNS requests

Threats

HTTP requests

PID	Process	Method	HTTP Code	IP	URL	CN	Type	Size	Reputation
920	svchost.exe	GET	200	192.229.221.95:80	http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D	unknown	—	—	unknown
636	svchost.exe	GET	200	23.211.9.92:80	http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl	unknown	—	—	unknown
6664	SIHClient.exe	GET	200	184.30.21.171:80	http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl	unknown	—	—	unknown
6300	backgroundTaskHost.exe	GET	200	192.229.221.95:80	http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEApDqVCbATUviZV57HIIulA%3D	unknown	—	—	unknown
4680	SearchApp.exe	GET	200	192.229.221.95:80	http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAzlnDD9eoNTLi0BRrMy%2BWU%3D	unknown	—	—	unknown
6664	SIHClient.exe	GET	200	184.30.21.171:80	http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl	unknown	—	—	unknown

Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID	Process	IP	Domain	ASN	CN	Reputation
4	System	192.168.100.255:138	—	—	—	unknown
—	—	239.255.255.250:1900	—	—	—	unknown
636	svchost.exe	4.231.128.59:443	—	MICROSOFT-CORP-MSN-AS-BLOCK	IE	whitelisted
4856	RUXIMICS.exe	40.127.240.158:443	settings-win.data.microsoft.com	MICROSOFT-CORP-MSN-AS-BLOCK	IE	unknown
5140	MoUsoCoreWorker.exe	40.127.240.158:443	settings-win.data.microsoft.com	MICROSOFT-CORP-MSN-AS-BLOCK	IE	unknown
636	svchost.exe	40.127.240.158:443	settings-win.data.microsoft.com	MICROSOFT-CORP-MSN-AS-BLOCK	IE	unknown
636	svchost.exe	23.211.9.92:80	www.microsoft.com	AKAMAI-AS	DE	whitelisted
4	System	192.168.100.255:137	—	—	—	unknown
4680	SearchApp.exe	2.19.120.29:443	www.bing.com	Akamai International B.V.	DE	unknown
4680	SearchApp.exe	192.229.221.95:80	ocsp.digicert.com	EDGECAST	US	unknown

DNS requests

Domain	IP	Reputation
settings-win.data.microsoft.com	40.127.240.158	whitelisted
www.microsoft.com	23.211.9.92 184.30.21.171	whitelisted
www.bing.com	2.19.120.29 2.19.120.21	whitelisted
r.bing.com	2.19.120.29 2.19.120.21	whitelisted
ocsp.digicert.com	192.229.221.95	whitelisted
login.live.com	20.190.160.20 40.126.32.76 40.126.32.68 40.126.32.136 40.126.32.74 20.190.160.17 20.190.160.22 40.126.32.72	whitelisted
go.microsoft.com	184.28.89.167	whitelisted
slscr.update.microsoft.com	52.165.165.26	whitelisted
fe3cr.delivery.mp.microsoft.com	20.242.39.171	whitelisted
client.wns.windows.com	40.113.103.199	whitelisted

Threats

No threats detected

Add for printing

No debug info

General Info

4e7ac0bdb516e983b3cab7f79850d8102d2bf4117bb343b68d0da73780cceb1a.msi

37605A3EB80F3366E56938031A9AC917

0582A0DD69D6027FB94765254ED91AD736ADE305

4E7AC0BDB516E983B3CAB7F79850D8102D2BF4117BB343B68D0DA73780CCEB1A

49152:CZq9IfHgoHxmbqD+/GKIikt698ta5Q1rTeor8trZeXxU6qaaAttJ9VKIf+iRQEWH:J9IIoHWkt698t5TeorjUFaztz9AI2i2Q

Software environment set and analysis options

Launch configuration

Software preset

Behavior activities

MALICIOUS

Drops the executable file immediately after the start

LATRODECTUS mutex has been found

LATRODECTUS has been detected

SUSPICIOUS

Executes as Windows Service

Reads the Windows owner or organization settings

Reads the date of Windows installation

Reads security settings of Internet Explorer

Uses RUNDLL32.EXE to load library

Executable content was dropped or overwritten

Application launched itself

Non-standard symbols in registry

INFO

Checks supported languages

Executable content was dropped or overwritten

Reads the computer name

Reads Environment values

Starts application with an unusual extension

Creates files or folders in the user directory

Drops the executable file immediately after the start

Process checks computer location settings

Malware configuration

Static information

TRiD

EXIF

FlashPix

Video and screenshots

Processes

Behavior graph

Specs description

Process information

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Registry activity

Modification events

Files activity

Dropped files

Network activity

HTTP requests

Connections

DNS requests

Threats

Debug output strings