Windows Analysis Report
QoN2S1Dd5s.msi

Overview

General Information

Sample name: QoN2S1Dd5s.msi
renamed because original name is a hash value
Original sample name: cef3ffac6b5d0aad3911b07c35c8c2c7a4e0a78319a6bdb059ec2b3afbfa722e.msi
Analysis ID: 1527968
MD5: 3965a5a62a57bf13246fd771da7ace3c
SHA1: a0dcb38b0bb8ab12db06905920be63798c02e7af
SHA256: cef3ffac6b5d0aad3911b07c35c8c2c7a4e0a78319a6bdb059ec2b3afbfa722e
Tags: msiuser-JAMESWT_MHT
Infos:

Detection

Score: 0
Range: 0 - 100
Whitelisted: false
Confidence: 60%

Signatures

Checks for available system drives (often done to infect USB drives)
Queries the volume information (name, serial number etc) of a device

Classification

Checks for available system drives (often done to infect USB drives)
Source: C:\Windows\System32\msiexec.exe File opened: z: Jump to behavior
Source: C:\Windows\System32\msiexec.exe File opened: x: Jump to behavior
Source: C:\Windows\System32\msiexec.exe File opened: v: Jump to behavior
Source: C:\Windows\System32\msiexec.exe File opened: t: Jump to behavior
Source: C:\Windows\System32\msiexec.exe File opened: r: Jump to behavior
Source: C:\Windows\System32\msiexec.exe File opened: p: Jump to behavior
Source: C:\Windows\System32\msiexec.exe File opened: n: Jump to behavior
Source: C:\Windows\System32\msiexec.exe File opened: l: Jump to behavior
Source: C:\Windows\System32\msiexec.exe File opened: j: Jump to behavior
Source: C:\Windows\System32\msiexec.exe File opened: h: Jump to behavior
Source: C:\Windows\System32\msiexec.exe File opened: f: Jump to behavior
Source: C:\Windows\System32\msiexec.exe File opened: b: Jump to behavior
Source: C:\Windows\System32\msiexec.exe File opened: y: Jump to behavior
Source: C:\Windows\System32\msiexec.exe File opened: w: Jump to behavior
Source: C:\Windows\System32\msiexec.exe File opened: u: Jump to behavior
Source: C:\Windows\System32\msiexec.exe File opened: s: Jump to behavior
Source: C:\Windows\System32\msiexec.exe File opened: q: Jump to behavior
Source: C:\Windows\System32\msiexec.exe File opened: o: Jump to behavior
Source: C:\Windows\System32\msiexec.exe File opened: m: Jump to behavior
Source: C:\Windows\System32\msiexec.exe File opened: k: Jump to behavior
Source: C:\Windows\System32\msiexec.exe File opened: i: Jump to behavior
Source: C:\Windows\System32\msiexec.exe File opened: g: Jump to behavior
Source: C:\Windows\System32\msiexec.exe File opened: e: Jump to behavior
Source: C:\Windows\System32\msiexec.exe File opened: c: Jump to behavior
Source: C:\Windows\System32\msiexec.exe File opened: a: Jump to behavior
Source: QoN2S1Dd5s.msi String found in binary or memory: http://cert.ssl.com/SSL.com-timeStamping-I-RSA-R1.cer0Q
Source: QoN2S1Dd5s.msi String found in binary or memory: http://cert.ssl.com/SSLcom-SubCA-CodeSigning-RSA-4096-R1.cer0
Source: QoN2S1Dd5s.msi String found in binary or memory: http://crls.ssl.com/SSL.com-timeStamping-I-RSA-R1.crl0
Source: QoN2S1Dd5s.msi String found in binary or memory: http://crls.ssl.com/SSLcom-SubCA-CodeSigning-RSA-4096-R1.crl0
Source: QoN2S1Dd5s.msi String found in binary or memory: http://crls.ssl.com/ssl.com-rsa-RootCA.crl0
Source: QoN2S1Dd5s.msi String found in binary or memory: http://ocsps.ssl.com0
Source: QoN2S1Dd5s.msi String found in binary or memory: http://ocsps.ssl.com0?
Source: QoN2S1Dd5s.msi String found in binary or memory: http://ocsps.ssl.com0Q
Source: QoN2S1Dd5s.msi String found in binary or memory: http://www.ssl.com/repository/SSLcomRootCertificationAuthorityRSA.crt0
Source: QoN2S1Dd5s.msi String found in binary or memory: https://www.ssl.com/repository0
Source: classification engine Classification label: clean0.winMSI@2/0@0/0
Source: C:\Windows\System32\msiexec.exe Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\SystemCertificates\CA Jump to behavior
Source: QoN2S1Dd5s.msi Static file information: TRID: Microsoft Windows Installer (60509/1) 88.31%
Source: unknown Process created: C:\Windows\System32\msiexec.exe "C:\Windows\System32\msiexec.exe" /i "C:\Users\user\Desktop\QoN2S1Dd5s.msi"
Source: unknown Process created: C:\Windows\System32\msiexec.exe C:\Windows\system32\msiexec.exe /V
Source: C:\Windows\System32\msiexec.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: aclayers.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: sfc.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: sfc_os.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: msi.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: srpapi.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: tsappcmp.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: textinputframework.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: coreuicomponents.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: coremessaging.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: ntmarta.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: coremessaging.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: wintypes.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: wintypes.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: wintypes.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: propsys.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: textshaping.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: netapi32.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: wkscli.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: msasn1.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: cryptsp.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: rsaenh.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: cryptbase.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: msisip.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: gpapi.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: version.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: mscoree.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: msihnd.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: dwmapi.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: pcacli.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: mpr.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: aclayers.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: sfc.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: sfc_os.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: msi.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Automated click: OK
Source: C:\Windows\System32\msiexec.exe Automated click: OK
Source: C:\Windows\System32\msiexec.exe Automated click: OK
Source: C:\Windows\System32\msiexec.exe Automated click: OK
Source: C:\Windows\System32\msiexec.exe Automated click: OK
Source: C:\Windows\System32\msiexec.exe Automated click: OK
Source: C:\Windows\System32\msiexec.exe Automated click: OK
Source: C:\Windows\System32\msiexec.exe Automated click: OK
Source: C:\Windows\System32\msiexec.exe Automated click: OK
Source: C:\Windows\System32\msiexec.exe Automated click: OK
Source: C:\Windows\System32\msiexec.exe Automated click: OK
Source: C:\Windows\System32\msiexec.exe Automated click: OK
Source: C:\Windows\System32\msiexec.exe Automated click: OK
Source: C:\Windows\System32\msiexec.exe Automated click: OK
Source: C:\Windows\System32\msiexec.exe Automated click: OK
Source: C:\Windows\System32\msiexec.exe Automated click: OK
Source: C:\Windows\System32\msiexec.exe Automated click: OK
Source: C:\Windows\System32\msiexec.exe Automated click: OK
Source: C:\Windows\System32\msiexec.exe Automated click: OK
Source: C:\Windows\System32\msiexec.exe Automated click: OK
Source: C:\Windows\System32\msiexec.exe Automated click: OK
Source: C:\Windows\System32\msiexec.exe Automated click: OK
Source: C:\Windows\System32\msiexec.exe Automated click: OK
Source: C:\Windows\System32\msiexec.exe Automated click: OK
Source: C:\Windows\System32\msiexec.exe Automated click: OK
Source: C:\Windows\System32\msiexec.exe Automated click: OK
Source: C:\Windows\System32\msiexec.exe Automated click: OK
Source: C:\Windows\System32\msiexec.exe Automated click: OK
Source: C:\Windows\System32\msiexec.exe Automated click: OK
Source: C:\Windows\System32\msiexec.exe Automated click: OK
Source: C:\Windows\System32\msiexec.exe Automated click: OK
Source: C:\Windows\System32\msiexec.exe Automated click: OK
Source: C:\Windows\System32\msiexec.exe Automated click: OK
Source: C:\Windows\System32\msiexec.exe Automated click: OK
Source: C:\Windows\System32\msiexec.exe Automated click: OK
Source: C:\Windows\System32\msiexec.exe Automated click: OK
Source: C:\Windows\System32\msiexec.exe Automated click: OK
Source: C:\Windows\System32\msiexec.exe Automated click: OK
Source: C:\Windows\System32\msiexec.exe Automated click: OK
Source: C:\Windows\System32\msiexec.exe Automated click: OK
Source: C:\Windows\System32\msiexec.exe Automated click: OK
Source: C:\Windows\System32\msiexec.exe Automated click: OK
Source: C:\Windows\System32\msiexec.exe Automated click: OK
Source: C:\Windows\System32\msiexec.exe Automated click: OK
Source: C:\Windows\System32\msiexec.exe Automated click: OK
Source: C:\Windows\System32\msiexec.exe Automated click: OK
Source: Window Recorder Window detected: More than 3 window changes detected
Source: QoN2S1Dd5s.msi Static file information: File size 10543104 > 1048576
Source: C:\Windows\System32\msiexec.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\msiexec.exe File Volume queried: C:\ FullSizeInformation Jump to behavior
Source: C:\Windows\System32\msiexec.exe File Volume queried: C:\ FullSizeInformation Jump to behavior
Source: C:\Windows\System32\msiexec.exe File Volume queried: C:\ FullSizeInformation Jump to behavior
Source: C:\Windows\System32\msiexec.exe File Volume queried: C:\ FullSizeInformation Jump to behavior
Queries the volume information (name, serial number etc) of a device
Source: C:\Windows\System32\msiexec.exe Queries volume information: C:\ VolumeInformation Jump to behavior
windows-stand
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 process2 2 Behavior Graph ID: 1527968 Sample: QoN2S1Dd5s.msi Startdate: 07/10/2024 Architecture: WINDOWS Score: 0 4 msiexec.exe 3 2->4         started        6 msiexec.exe 2->6         started       
⊘No contacted IP infos