Windows Analysis Report
gxR3zHIEht.msi

Overview

General Information

Sample name: gxR3zHIEht.msi
renamed because original name is a hash value
Original sample name: 9c19bd024d357ea6b4261a1416dcad7e3b62347914ddd8728ed9a8babc28a0b7.msi
Analysis ID: 1527958
MD5: a339e7ef0c0bfa60927b25d8768fc421
SHA1: a3f6ca6ab910b710b346621934d07eb89eeb38cb
SHA256: 9c19bd024d357ea6b4261a1416dcad7e3b62347914ddd8728ed9a8babc28a0b7
Tags: msiuser-JAMESWT_MHT
Infos:

Detection

Score: 1
Range: 0 - 100
Whitelisted: false
Confidence: 60%

Signatures

Checks for available system drives (often done to infect USB drives)
May sleep (evasive loops) to hinder dynamic analysis
Queries the volume information (name, serial number etc) of a device
Sample file is different than original file name gathered from version info

Classification

Source: Binary string: C:\agent\_work\8\s\build\ship\x86\burn.pdb source: gxR3zHIEht.msi
Source: Binary string: .PdbhXjbft source: gxR3zHIEht.msi
Checks for available system drives (often done to infect USB drives)
Source: C:\Windows\System32\msiexec.exe File opened: z: Jump to behavior
Source: C:\Windows\System32\msiexec.exe File opened: x: Jump to behavior
Source: C:\Windows\System32\msiexec.exe File opened: v: Jump to behavior
Source: C:\Windows\System32\msiexec.exe File opened: t: Jump to behavior
Source: C:\Windows\System32\msiexec.exe File opened: r: Jump to behavior
Source: C:\Windows\System32\msiexec.exe File opened: p: Jump to behavior
Source: C:\Windows\System32\msiexec.exe File opened: n: Jump to behavior
Source: C:\Windows\System32\msiexec.exe File opened: l: Jump to behavior
Source: C:\Windows\System32\msiexec.exe File opened: j: Jump to behavior
Source: C:\Windows\System32\msiexec.exe File opened: h: Jump to behavior
Source: C:\Windows\System32\msiexec.exe File opened: f: Jump to behavior
Source: C:\Windows\System32\msiexec.exe File opened: b: Jump to behavior
Source: C:\Windows\System32\msiexec.exe File opened: y: Jump to behavior
Source: C:\Windows\System32\msiexec.exe File opened: w: Jump to behavior
Source: C:\Windows\System32\msiexec.exe File opened: u: Jump to behavior
Source: C:\Windows\System32\msiexec.exe File opened: s: Jump to behavior
Source: C:\Windows\System32\msiexec.exe File opened: q: Jump to behavior
Source: C:\Windows\System32\msiexec.exe File opened: o: Jump to behavior
Source: C:\Windows\System32\msiexec.exe File opened: m: Jump to behavior
Source: C:\Windows\System32\msiexec.exe File opened: k: Jump to behavior
Source: C:\Windows\System32\msiexec.exe File opened: i: Jump to behavior
Source: C:\Windows\System32\msiexec.exe File opened: g: Jump to behavior
Source: C:\Windows\System32\msiexec.exe File opened: e: Jump to behavior
Source: C:\Windows\System32\msiexec.exe File opened: c: Jump to behavior
Source: C:\Windows\System32\msiexec.exe File opened: a: Jump to behavior
Source: global traffic DNS traffic detected: DNS query: ocsps.ssl.com
Source: gxR3zHIEht.msi String found in binary or memory: http://appsyndication.org/2006/appsynapplicationapuputil.cppupgradeexclusivetrueenclosuredigestalgor
Source: gxR3zHIEht.msi String found in binary or memory: http://cert.ssl.com/SSL.com-timeStamping-I-RSA-R1.cer0Q
Source: gxR3zHIEht.msi String found in binary or memory: http://cert.ssl.com/SSLcom-SubCA-CodeSigning-RSA-4096-R1.cer0
Source: gxR3zHIEht.msi String found in binary or memory: http://crls.ssl.com/SSL.com-timeStamping-I-RSA-R1.crl0
Source: gxR3zHIEht.msi String found in binary or memory: http://crls.ssl.com/SSLcom-SubCA-CodeSigning-RSA-4096-R1.crl0
Source: gxR3zHIEht.msi String found in binary or memory: http://crls.ssl.com/ssl.com-rsa-RootCA.crl0
Source: gxR3zHIEht.msi String found in binary or memory: http://ocsps.ssl.com0
Source: gxR3zHIEht.msi String found in binary or memory: http://ocsps.ssl.com0?
Source: gxR3zHIEht.msi String found in binary or memory: http://ocsps.ssl.com0Q
Source: gxR3zHIEht.msi String found in binary or memory: http://www.ssl.com/repository/SSLcomRootCertificationAuthorityRSA.crt0
Source: gxR3zHIEht.msi String found in binary or memory: https://www.ssl.com/repository0
Sample file is different than original file name gathered from version info
Source: gxR3zHIEht.msi Binary or memory string: tLegalCopyrightCopyright (c) Microsoft Corporation. All rights reserved.L$OriginalFilenameVC_redist.x86.exe vs gxR3zHIEht.msi
Source: classification engine Classification label: clean1.winMSI@2/0@4/0
Source: C:\Windows\System32\msiexec.exe Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\SystemCertificates\CA Jump to behavior
Source: unknown Process created: C:\Windows\System32\msiexec.exe "C:\Windows\System32\msiexec.exe" /i "C:\Users\user\Desktop\gxR3zHIEht.msi"
Source: unknown Process created: C:\Windows\System32\msiexec.exe C:\Windows\system32\msiexec.exe /V
Source: C:\Windows\System32\msiexec.exe Section loaded: msi.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: mpr.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: sfc.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: sfc_os.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: dwmapi.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: cryptsp.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: cryptbase.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: propsys.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: wkscli.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: msisip.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: ncrypt.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: bcrypt.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: gpapi.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: rpcrtremote.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: msihnd.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: msi.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: mpr.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: sfc.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: sfc_os.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: dwmapi.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: cryptbase.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: cryptsp.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: rpcrtremote.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Automated click: OK
Source: C:\Windows\System32\msiexec.exe Automated click: OK
Source: C:\Windows\System32\msiexec.exe Automated click: OK
Source: C:\Windows\System32\msiexec.exe Automated click: OK
Source: C:\Windows\System32\msiexec.exe Automated click: OK
Source: C:\Windows\System32\msiexec.exe Automated click: OK
Source: C:\Windows\System32\msiexec.exe Automated click: OK
Source: C:\Windows\System32\msiexec.exe Automated click: OK
Source: C:\Windows\System32\msiexec.exe Automated click: OK
Source: C:\Windows\System32\msiexec.exe Automated click: OK
Source: C:\Windows\System32\msiexec.exe Automated click: OK
Source: C:\Windows\System32\msiexec.exe Automated click: OK
Source: C:\Windows\System32\msiexec.exe Automated click: OK
Source: C:\Windows\System32\msiexec.exe Automated click: OK
Source: C:\Windows\System32\msiexec.exe Automated click: OK
Source: C:\Windows\System32\msiexec.exe Automated click: OK
Source: C:\Windows\System32\msiexec.exe Automated click: OK
Source: C:\Windows\System32\msiexec.exe Automated click: OK
Source: C:\Windows\System32\msiexec.exe Automated click: OK
Source: C:\Windows\System32\msiexec.exe Automated click: OK
Source: C:\Windows\System32\msiexec.exe Automated click: OK
Source: C:\Windows\System32\msiexec.exe Automated click: OK
Source: C:\Windows\System32\msiexec.exe Automated click: OK
Source: C:\Windows\System32\msiexec.exe Automated click: OK
Source: Window Recorder Window detected: More than 3 window changes detected
Source: gxR3zHIEht.msi Static file information: File size 24010752 > 1048576
Source: Binary string: C:\agent\_work\8\s\build\ship\x86\burn.pdb source: gxR3zHIEht.msi
Source: Binary string: .PdbhXjbft source: gxR3zHIEht.msi
Source: C:\Windows\System32\msiexec.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\msiexec.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
May sleep (evasive loops) to hinder dynamic analysis
Source: C:\Windows\System32\msiexec.exe TID: 3652 Thread sleep time: -120000s >= -30000s Jump to behavior
Source: C:\Windows\System32\msiexec.exe TID: 3684 Thread sleep time: -60000s >= -30000s Jump to behavior
Source: C:\Windows\System32\msiexec.exe File Volume queried: C:\ FullSizeInformation Jump to behavior
Source: C:\Windows\System32\msiexec.exe File Volume queried: C:\ FullSizeInformation Jump to behavior
Source: C:\Windows\System32\msiexec.exe File Volume queried: C:\ FullSizeInformation Jump to behavior
Source: C:\Windows\System32\msiexec.exe File Volume queried: C:\ FullSizeInformation Jump to behavior
Queries the volume information (name, serial number etc) of a device
Source: C:\Windows\System32\msiexec.exe Queries volume information: C:\ VolumeInformation Jump to behavior
windows-stand
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1527958 Sample: gxR3zHIEht.msi Startdate: 07/10/2024 Architecture: WINDOWS Score: 1 9 ocsps.ssl.com 2->9 11 bg.microsoft.map.fastly.net 2->11 5 msiexec.exe 3 2->5         started        7 msiexec.exe 2->7         started        process3
⊘No contacted IP infos

Contacted Domains

Name IP Active
bg.microsoft.map.fastly.net 199.232.210.172 true
ocsps.ssl.com 34.237.184.165 true