Automated Malware Analysis IOC Report for

Details

Filetype:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 6.2, MSI Installer, Code page: 1252, Title: Installation Database, Subject: Arixcel Explorer Installer, Author: Arixcel Ltd, Keywords: Arixcel Installer, Comments: Arixcel Explorer is a spreadsheet analysis add-in for Microsoft Excel., Template: x64;1033, Revision Number: {536F3CBA-F2A0-411E-AC41-4EE4C94EE2D8}, Create Time/Date: Sun Jan 28 20:44:34 2024, Last Saved Time/Date: Sun Jan 28 20:44:34 2024, Number of Pages: 200, Number of Words: 2, Name of Creating Application: Windows Installer XML Toolset (3.14.0.5722), Security: 2
Entropy:	7.638717425789046
Filename:	Arixcel_Explorer_v8.7.8793.msi
Filesize:	2240512
MD5:	a9fabc2227e5a5ce5aa17c3783e56110
SHA1:	602a2f1521d423a6111e62ff4d38d8353e5e9eae
SHA256:	da7c2031d596747b9afdde61ccfc469977495e3f3406acfbe733b6f598f02a73
SHA512:	1bd2344cce7955fcd505141fbf3caf83486a450f3490a45281a6bb2718e18bed3b89b8897ff93c9a1ebdaceb79cb5e47a848357d1c1be2a14271e44e8dc48bf7
SSDEEP:	49152:TAn5ftVvJ6FDzPbNjrhbwwtIWGfPn13vcOSu3R+f:E5V6FnR9UuGfPnFVSuB+f
Preview:	........................>......................................................................................................................................................................................................................................

Signature Hits	Behavior Group	Mitre Attack
Sample is a Windows installer	System Summary
PE / OLE file has a valid certificate	Compliance, System Summary
Submission file is bigger than most known malware samples	System Summary	Extra Window Memory Injection

Details

File:	C:\Config.Msi\5cb73b.rbs
Category:	modified
Dump:	5cb73b.rbs.1.dr
ID:	dr_9
Target ID:	1
Process:	C:\Windows\System32\msiexec.exe
Type:	data
Entropy:	5.785527605783875
Encrypted:	false
Size:	13212
Whitelisted:	false

Details

File:	C:\Users\user\AppData\Local\Arixcel Explorer\Aga.Controls.dll
Category:	dropped
Dump:	Aga.Controls.dll.1.dr
ID:	dr_19
Target ID:	1
Process:	C:\Windows\System32\msiexec.exe
Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy:	6.096376548726116
Encrypted:	false
Size:	154112
Whitelisted:	false

Signature Hits	Behavior Group	Mitre Attack
Drops PE files	Persistence and Installation Behavior
Found dropped PE file which has not been started or loaded	Malware Analysis System Evasion

Details

File:	C:\Users\user\AppData\Local\Arixcel Explorer\Arixcel.Common.dll
Category:	dropped
Dump:	Arixcel.Common.dll.1.dr
ID:	dr_20
Target ID:	1
Process:	C:\Windows\System32\msiexec.exe
Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy:	5.983845132885013
Encrypted:	false
Size:	480768
Whitelisted:	false

Signature Hits	Behavior Group	Mitre Attack
Drops PE files	Persistence and Installation Behavior
Found dropped PE file which has not been started or loaded	Malware Analysis System Evasion

Details

File:	C:\Users\user\AppData\Local\Arixcel Explorer\Arixcel.Controls.dll
Category:	dropped
Dump:	Arixcel.Controls.dll.1.dr
ID:	dr_21
Target ID:	1
Process:	C:\Windows\System32\msiexec.exe
Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy:	7.064201575562964
Encrypted:	false
Size:	60416
Whitelisted:	false

Signature Hits	Behavior Group	Mitre Attack
Drops PE files	Persistence and Installation Behavior
Found dropped PE file which has not been started or loaded	Malware Analysis System Evasion

Details

File:	C:\Users\user\AppData\Local\Arixcel Explorer\ArixcelExplorer.dll
Category:	dropped
Dump:	ArixcelExplorer.dll.1.dr
ID:	dr_22
Target ID:	1
Process:	C:\Windows\System32\msiexec.exe
Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy:	6.68949795451891
Encrypted:	false
Size:	1149440
Whitelisted:	false

Signature Hits	Behavior Group	Mitre Attack
Drops PE files	Persistence and Installation Behavior
Found dropped PE file which has not been started or loaded	Malware Analysis System Evasion

Details

File:	C:\Users\user\AppData\Local\Arixcel Explorer\ArixcelExplorer.dll.config
Category:	dropped
Dump:	ArixcelExplorer.dll.config.1.dr
ID:	dr_23
Target ID:	1
Process:	C:\Windows\System32\msiexec.exe
Type:	XML 1.0 document, ASCII text
Entropy:	5.0893178747806695
Encrypted:	false
Size:	650
Whitelisted:	false

Details

File:	C:\Users\user\AppData\Local\Arixcel Explorer\ArixcelExplorer.dll.manifest
Category:	dropped
Dump:	ArixcelExplorer.dll.manifest.1.dr
ID:	dr_24
Target ID:	1
Process:	C:\Windows\System32\msiexec.exe
Type:	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with very long lines (9465), with CRLF, LF line terminators
Entropy:	5.620036402328506
Encrypted:	false
Size:	70423
Whitelisted:	false

Details

File:	C:\Users\user\AppData\Local\Arixcel Explorer\ArixcelExplorer.log4net
Category:	dropped
Dump:	ArixcelExplorer.log4net.1.dr
ID:	dr_25
Target ID:	1
Process:	C:\Windows\System32\msiexec.exe
Type:	ASCII text
Entropy:	4.622492348319434
Encrypted:	false
Size:	622
Whitelisted:	false

Details

File:	C:\Users\user\AppData\Local\Arixcel Explorer\ArixcelExplorer.vsto
Category:	dropped
Dump:	ArixcelExplorer.vsto.1.dr
ID:	dr_26
Target ID:	1
Process:	C:\Windows\System32\msiexec.exe
Type:	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with very long lines (9494), with CRLF line terminators
Entropy:	6.1170297565125615
Encrypted:	false
Size:	19770
Whitelisted:	false

Details

File:	C:\Users\user\AppData\Local\Arixcel Explorer\ArixcelExplorer.xlam
Category:	dropped
Dump:	ArixcelExplorer.xlam.1.dr
ID:	dr_27
Target ID:	1
Process:	C:\Windows\System32\msiexec.exe
Type:	Microsoft Excel 2007+
Entropy:	7.827570152744385
Encrypted:	false
Size:	47521
Whitelisted:	false

Details

File:	C:\Users\user\AppData\Local\Arixcel Explorer\Microsoft.Office.Tools.Common.v4.0.Utilities.dll
Category:	dropped
Dump:	Microsoft.Office.Tools.Common.v4.0.Utilities.dll.1.dr
ID:	dr_29
Target ID:	1
Process:	C:\Windows\System32\msiexec.exe
Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy:	6.067183560016906
Encrypted:	false
Size:	32664
Whitelisted:	false

Signature Hits	Behavior Group	Mitre Attack
Drops PE files	Persistence and Installation Behavior
Found dropped PE file which has not been started or loaded	Malware Analysis System Evasion

Details

File:	C:\Users\user\AppData\Local\Arixcel Explorer\Newtonsoft.Json.dll
Category:	dropped
Dump:	Newtonsoft.Json.dll.1.dr
ID:	dr_30
Target ID:	1
Process:	C:\Windows\System32\msiexec.exe
Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy:	5.96669864901384
Encrypted:	false
Size:	711952
Whitelisted:	false

Signature Hits	Behavior Group	Mitre Attack
Drops PE files	Persistence and Installation Behavior
Found dropped PE file which has not been started or loaded	Malware Analysis System Evasion

Details

File:	C:\Users\user\AppData\Local\Arixcel Explorer\System.Buffers.dll
Category:	dropped
Dump:	System.Buffers.dll.1.dr
ID:	dr_31
Target ID:	1
Process:	C:\Windows\System32\msiexec.exe
Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy:	6.425485073687783
Encrypted:	false
Size:	20856
Whitelisted:	false

Signature Hits	Behavior Group	Mitre Attack
Drops PE files	Persistence and Installation Behavior
Found dropped PE file which has not been started or loaded	Malware Analysis System Evasion

Details

File:	C:\Users\user\AppData\Local\Arixcel Explorer\System.Memory.dll
Category:	dropped
Dump:	System.Memory.dll.1.dr
ID:	dr_32
Target ID:	1
Process:	C:\Windows\System32\msiexec.exe
Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy:	6.142019016866883
Encrypted:	false
Size:	142240
Whitelisted:	false

Signature Hits	Behavior Group	Mitre Attack
Drops PE files	Persistence and Installation Behavior
Found dropped PE file which has not been started or loaded	Malware Analysis System Evasion

Details

File:	C:\Users\user\AppData\Local\Arixcel Explorer\System.Numerics.Vectors.dll
Category:	dropped
Dump:	System.Numerics.Vectors.dll.1.dr
ID:	dr_33
Target ID:	1
Process:	C:\Windows\System32\msiexec.exe
Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy:	5.631610124521223
Encrypted:	false
Size:	115856
Whitelisted:	false

Signature Hits	Behavior Group	Mitre Attack
Drops PE files	Persistence and Installation Behavior
Found dropped PE file which has not been started or loaded	Malware Analysis System Evasion

Details

File:	C:\Users\user\AppData\Local\Arixcel Explorer\System.Runtime.CompilerServices.Unsafe.dll
Category:	dropped
Dump:	System.Runtime.CompilerServices.Unsafe.dll.1.dr
ID:	dr_5
Target ID:	1
Process:	C:\Windows\System32\msiexec.exe
Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy:	6.361391591273708
Encrypted:	false
Size:	16768
Whitelisted:	false

Signature Hits	Behavior Group	Mitre Attack
Drops PE files	Persistence and Installation Behavior
Found dropped PE file which has not been started or loaded	Malware Analysis System Evasion

Details

File:	C:\Users\user\AppData\Local\Arixcel Explorer\System.Threading.Channels.dll
Category:	dropped
Dump:	System.Threading.Channels.dll.1.dr
ID:	dr_6
Target ID:	1
Process:	C:\Windows\System32\msiexec.exe
Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy:	6.328404491602846
Encrypted:	false
Size:	53904
Whitelisted:	false

Signature Hits	Behavior Group	Mitre Attack
Drops PE files	Persistence and Installation Behavior
Found dropped PE file which has not been started or loaded	Malware Analysis System Evasion

Details

File:	C:\Users\user\AppData\Local\Arixcel Explorer\System.Threading.Tasks.Extensions.dll
Category:	dropped
Dump:	System.Threading.Tasks.Extensions.dll.1.dr
ID:	dr_7
Target ID:	1
Process:	C:\Windows\System32\msiexec.exe
Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy:	6.291520154015514
Encrypted:	false
Size:	25984
Whitelisted:	false

Signature Hits	Behavior Group	Mitre Attack
Drops PE files	Persistence and Installation Behavior
Found dropped PE file which has not been started or loaded	Malware Analysis System Evasion

Details

File:	C:\Users\user\AppData\Local\Arixcel Explorer\log4net.dll
Category:	dropped
Dump:	log4net.dll.1.dr
ID:	dr_28
Target ID:	1
Process:	C:\Windows\System32\msiexec.exe
Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy:	5.596191661109029
Encrypted:	false
Size:	270336
Whitelisted:	false

Signature Hits	Behavior Group	Mitre Attack
Drops PE files	Persistence and Installation Behavior
Found dropped PE file which has not been started or loaded	Malware Analysis System Evasion

Details

File:	C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.MSO\1D601E47.tmp (copy)
Category:	dropped
Dump:	ArixcelExplorer.xlam.1.dr
Target ID:	18
Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE
Type:	Microsoft Excel 2007+
Entropy:	0.0
Encrypted:	false
Size:	0
Whitelisted:	false

Details

File:	C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\AN5UOLP8\6O27WT20.log
Category:	dropped
Dump:	6O27WT20.log.18.dr
ID:	dr_37
Target ID:	18
Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE
Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Entropy:	3.757684233944689
Encrypted:	false
Size:	2672
Whitelisted:	false

Details

File:	C:\Users\user\AppData\Local\Temp\ArixcelExplorer.log
Category:	dropped
Dump:	ArixcelExplorer.log.18.dr
ID:	dr_45
Target ID:	18
Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE
Type:	Unicode text, UTF-8 (with BOM) text, with CRLF, LF line terminators
Entropy:	5.184742958201135
Encrypted:	false
Size:	1599
Whitelisted:	false

Details

File:	C:\Users\user\AppData\Local\Temp\MSI8C71.tmp
Category:	dropped
Dump:	MSI8C71.tmp.0.dr
ID:	dr_0
Target ID:	0
Process:	C:\Windows\System32\msiexec.exe
Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Entropy:	6.031305225900342
Encrypted:	false
Size:	156888
Whitelisted:	false

Signature Hits	Behavior Group	Mitre Attack
Drops PE files	Persistence and Installation Behavior
Found dropped PE file which has not been started or loaded	Malware Analysis System Evasion
Creates temporary files	System Summary

Details

File:	C:\Users\user\AppData\Local\Temp\MSI8CFF.tmp-\CustomAction.config
Category:	dropped
Dump:	CustomAction.config.4.dr
ID:	dr_3
Target ID:	4
Process:	C:\Windows\SysWOW64\rundll32.exe
Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Entropy:	4.7443746690988435
Encrypted:	false
Size:	1500
Whitelisted:	false

Details

File:	C:\Users\user\AppData\Local\Temp\MSI8CFF.tmp-\Microsoft.Deployment.WindowsInstaller.dll
Category:	dropped
Dump:	Microsoft.Deployment.WindowsInstaller.dll.4.dr
ID:	dr_2
Target ID:	4
Process:	C:\Windows\SysWOW64\rundll32.exe
Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy:	5.879610839431918
Encrypted:	false
Size:	183904
Whitelisted:	false

Signature Hits	Behavior Group	Mitre Attack
Drops PE files	Persistence and Installation Behavior
Found dropped PE file which has not been started or loaded	Malware Analysis System Evasion
Queries the volume information (name, serial number etc) of a device	Language, Device and Operating System Detection	System Information Discovery

Details

File:	C:\Users\user\AppData\Local\Temp\MSI8E86.tmp-\ArixcelSetup.dll
Category:	dropped
Dump:	ArixcelSetup.dll.5.dr
ID:	dr_4
Target ID:	5
Process:	C:\Windows\SysWOW64\rundll32.exe
Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy:	5.174522385270341
Encrypted:	false
Size:	15360
Whitelisted:	false

Signature Hits	Behavior Group	Mitre Attack
Drops PE files	Persistence and Installation Behavior
Found dropped PE file which has not been started or loaded	Malware Analysis System Evasion
Queries the volume information (name, serial number etc) of a device	Language, Device and Operating System Detection	System Information Discovery

Details

File:	C:\Users\user\AppData\Local\Temp\MSI905C.tmp
Category:	dropped
Dump:	MSI905C.tmp.0.dr
ID:	dr_1
Target ID:	0
Process:	C:\Windows\System32\msiexec.exe
Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows, InstallShield self-extracting archive
Entropy:	6.256870163299765
Encrypted:	false
Size:	258045
Whitelisted:	false

Signature Hits	Behavior Group	Mitre Attack
Drops PE files	Persistence and Installation Behavior
Found dropped PE file which has not been started or loaded	Malware Analysis System Evasion
Queries the volume information (name, serial number etc) of a device	Language, Device and Operating System Detection	System Information Discovery
Spawns processes	System Summary	Process Injection

Details

File:	C:\Users\user\AppData\Local\Temp\~DF1BF63C73D47F646D.TMP
Category:	dropped
Dump:	~DF1BF63C73D47F646D.TMP.18.dr
ID:	dr_46
Target ID:	18
Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE
Type:	Composite Document File V2 Document, Cannot read section info
Entropy:	3.051180922408337
Encrypted:	false
Size:	32768
Whitelisted:	false

Details

File:	C:\Users\user\AppData\Local\Temp\~DFD2AA41CFBB79474C.TMP
Category:	dropped
Dump:	~DFD2AA41CFBB79474C.TMP.18.dr
ID:	dr_34
Target ID:	18
Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE
Type:	Composite Document File V2 Document, Cannot read section info
Entropy:	3.9940426594581613
Encrypted:	false
Size:	24064
Whitelisted:	false

Details

File:	C:\Users\user\AppData\Local\assembly\tmp\2YQK1WIO\__AssemblyInfo__.ini
Category:	dropped
Dump:	__AssemblyInfo__.ini4.18.dr
ID:	dr_41
Target ID:	18
Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE
Type:	data
Entropy:	3.382619857626537
Encrypted:	false
Size:	240
Whitelisted:	false

Details

File:	C:\Users\user\AppData\Local\assembly\tmp\9WIRSJYC\__AssemblyInfo__.ini
Category:	dropped
Dump:	__AssemblyInfo__.ini2.18.dr
ID:	dr_39
Target ID:	18
Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE
Type:	data
Entropy:	3.352718136566885
Encrypted:	false
Size:	348
Whitelisted:	false

Details

File:	C:\Users\user\AppData\Local\assembly\tmp\FNYW4YDD\__AssemblyInfo__.ini
Category:	dropped
Dump:	__AssemblyInfo__.ini6.18.dr
ID:	dr_43
Target ID:	18
Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE
Type:	data
Entropy:	3.4239518422616997
Encrypted:	false
Size:	270
Whitelisted:	false

Details

File:	C:\Users\user\AppData\Local\assembly\tmp\HWC6L5O8\__AssemblyInfo__.ini
Category:	dropped
Dump:	__AssemblyInfo__.ini.18.dr
ID:	dr_35
Target ID:	18
Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE
Type:	data
Entropy:	3.411196688630613
Encrypted:	false
Size:	322
Whitelisted:	false

Details

File:	C:\Users\user\AppData\Local\assembly\tmp\OCUJWGU0\__AssemblyInfo__.ini
Category:	dropped
Dump:	__AssemblyInfo__.ini5.18.dr
ID:	dr_42
Target ID:	18
Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE
Type:	data
Entropy:	3.3628289142077143
Encrypted:	false
Size:	232
Whitelisted:	false

Details

File:	C:\Users\user\AppData\Local\assembly\tmp\PFAA2LU0\__AssemblyInfo__.ini
Category:	dropped
Dump:	__AssemblyInfo__.ini7.18.dr
ID:	dr_44
Target ID:	18
Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE
Type:	data
Entropy:	3.4377194171895726
Encrypted:	false
Size:	302
Whitelisted:	false

Details

File:	C:\Users\user\AppData\Local\assembly\tmp\QMQ4QZ9O\__AssemblyInfo__.ini
Category:	dropped
Dump:	__AssemblyInfo__.ini0.18.dr
ID:	dr_36
Target ID:	18
Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE
Type:	data
Entropy:	3.3510035537056524
Encrypted:	false
Size:	218
Whitelisted:	false

Details

File:	C:\Users\user\AppData\Local\assembly\tmp\V1H78IGM\__AssemblyInfo__.ini
Category:	dropped
Dump:	__AssemblyInfo__.ini3.18.dr
ID:	dr_40
Target ID:	18
Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE
Type:	data
Entropy:	3.360853748423405
Encrypted:	false
Size:	200
Whitelisted:	false

Details

File:	C:\Users\user\AppData\Local\assembly\tmp\ZDZO238B\__AssemblyInfo__.ini
Category:	dropped
Dump:	__AssemblyInfo__.ini1.18.dr
ID:	dr_38
Target ID:	18
Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE
Type:	data
Entropy:	3.3102228726013143
Encrypted:	false
Size:	244
Whitelisted:	false

Signature Hits	Behavior Group	Mitre Attack
Writes ini files	System Summary	File and Directory Discovery

Details

File:	C:\Users\user\AppData\Roaming\Microsoft\Installer\{C22576F4-B0E1-4CB8-A237-B8F2C5DF3505}\arixcel.ico
Category:	dropped
Dump:	arixcel.ico.1.dr
ID:	dr_8
Target ID:	1
Process:	C:\Windows\System32\msiexec.exe
Type:	MS Windows icon resource - 4 icons, 32x32, 32 bits/pixel, 24x24, 32 bits/pixel
Entropy:	2.126126989614935
Encrypted:	false
Size:	9622
Whitelisted:	false

Details

File:	C:\Windows\Installer\5cb73a.msi
Category:	dropped
Dump:	5cb73a.msi.1.dr
ID:	dr_16
Target ID:	1
Process:	C:\Windows\System32\msiexec.exe
Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 6.2, MSI Installer, Code page: 1252, Title: Installation Database, Subject: Arixcel Explorer Installer, Author: Arixcel Ltd, Keywords: Arixcel Installer, Comments: Arixcel Explorer is a spreadsheet analysis add-in for Microsoft Excel., Template: x64;1033, Revision Number: {536F3CBA-F2A0-411E-AC41-4EE4C94EE2D8}, Create Time/Date: Sun Jan 28 20:44:34 2024, Last Saved Time/Date: Sun Jan 28 20:44:34 2024, Number of Pages: 200, Number of Words: 2, Name of Creating Application: Windows Installer XML Toolset (3.14.0.5722), Security: 2
Entropy:	7.638717425789046
Encrypted:	false
Size:	2240512
Whitelisted:	false

Signature Hits	Behavior Group	Mitre Attack
Creates files inside the system directory	System Summary	Masquerading

Details

File:	C:\Windows\Installer\MSIB8FF.tmp
Category:	dropped
Dump:	MSIB8FF.tmp.1.dr
ID:	dr_18
Target ID:	1
Process:	C:\Windows\System32\msiexec.exe
Type:	data
Entropy:	4.349810416374007
Encrypted:	false
Size:	18314
Whitelisted:	false

Signature Hits	Behavior Group	Mitre Attack
Creates files inside the system directory	System Summary	Masquerading

Details

File:	C:\Windows\Installer\SourceHash{C22576F4-B0E1-4CB8-A237-B8F2C5DF3505}
Category:	dropped
Dump:	SourceHash{C22576F4-B0E1-4CB8-A237-B8F2C5DF3505}.1.dr
ID:	dr_13
Target ID:	1
Process:	C:\Windows\System32\msiexec.exe
Type:	Composite Document File V2 Document, Cannot read section info
Entropy:	1.1729169874222374
Encrypted:	false
Size:	20480
Whitelisted:	false

Signature Hits	Behavior Group	Mitre Attack
Creates files inside the system directory	System Summary	Masquerading

Details

File:	C:\Windows\Installer\inprogressinstallinfo.ipi
Category:	dropped
Dump:	inprogressinstallinfo.ipi.1.dr
ID:	dr_15
Target ID:	1
Process:	C:\Windows\System32\msiexec.exe
Type:	Composite Document File V2 Document, Cannot read section info
Entropy:	1.5359309894672553
Encrypted:	false
Size:	20480
Whitelisted:	false

Signature Hits	Behavior Group	Mitre Attack
Creates files inside the system directory	System Summary	Masquerading

Details

File:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log
Category:	dropped
Dump:	ngen.log.1.dr
ID:	dr_17
Target ID:	1
Process:	C:\Windows\System32\msiexec.exe
Type:	Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Entropy:	5.356171700478858
Encrypted:	false
Size:	454234
Whitelisted:	false

Details

File:	C:\Windows\Temp\~DF4DC108F2BF5F5926.TMP
Category:	dropped
Dump:	~DF4DC108F2BF5F5926.TMP.1.dr
ID:	dr_11
Target ID:	1
Process:	C:\Windows\System32\msiexec.exe
Type:	Composite Document File V2 Document, Cannot read section info
Entropy:	1.231342184291806
Encrypted:	false
Size:	32768
Whitelisted:	false

Details

File:	C:\Windows\Temp\~DF5055E0BD43DB7F38.TMP
Category:	dropped
Dump:	~DF5055E0BD43DB7F38.TMP.1.dr
ID:	dr_14
Target ID:	1
Process:	C:\Windows\System32\msiexec.exe
Type:	data
Entropy:	0.13119249583520878
Encrypted:	false
Size:	69632
Whitelisted:	false

Details

File:	C:\Windows\Temp\~DF56D4A918F02576FC.TMP
Category:	dropped
Dump:	~DF56D4A918F02576FC.TMP.1.dr
ID:	dr_10
Target ID:	1
Process:	C:\Windows\System32\msiexec.exe
Type:	data
Entropy:	0.0
Encrypted:	false
Size:	512
Whitelisted:	false

Details

File:	C:\Windows\Temp\~DF8E149199FA49F656.TMP
Category:	dropped
Dump:	~DF8E149199FA49F656.TMP.1.dr
ID:	dr_12
Target ID:	1
Process:	C:\Windows\System32\msiexec.exe
Type:	data
Entropy:	0.07854837411207781
Encrypted:	false
Size:	32768
Whitelisted:	false

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

IOC Report
Arixcel_Explorer_v8.7.8793.msi

Files

IPs

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

IOC ReportArixcel_Explorer_v8.7.8793.msi

Files

IPs

IOC Report
Arixcel_Explorer_v8.7.8793.msi