Windows Analysis Report
EBJYdmfyWF.msi

Overview

General Information

Sample name: EBJYdmfyWF.msi
renamed because original name is a hash value
Original sample name: 590dce80d55f6819ccb64040a93bcacf31636b59976a576013d04ad740aa89c4.msi
Analysis ID: 1527969
MD5: 4eb1b41576f9096924e9d2a506849e28
SHA1: 318319830333b6d3910135e1086788c6ec24950c
SHA256: 590dce80d55f6819ccb64040a93bcacf31636b59976a576013d04ad740aa89c4
Tags: msiuser-JAMESWT_MHT
Infos:

Detection

Score: 42
Range: 0 - 100
Whitelisted: false
Confidence: 100%

Signatures

Antivirus / Scanner detection for submitted sample
Multi AV Scanner detection for submitted file
Checks for available system drives (often done to infect USB drives)
Queries the volume information (name, serial number etc) of a device

Classification

AV Detection
barindex
Antivirus / Scanner detection for submitted sample
Source: EBJYdmfyWF.msi Avira: detected
Multi AV Scanner detection for submitted file
Source: EBJYdmfyWF.msi ReversingLabs: Detection: 15%
Checks for available system drives (often done to infect USB drives)
Source: C:\Windows\System32\msiexec.exe File opened: z: Jump to behavior
Source: C:\Windows\System32\msiexec.exe File opened: x: Jump to behavior
Source: C:\Windows\System32\msiexec.exe File opened: v: Jump to behavior
Source: C:\Windows\System32\msiexec.exe File opened: t: Jump to behavior
Source: C:\Windows\System32\msiexec.exe File opened: r: Jump to behavior
Source: C:\Windows\System32\msiexec.exe File opened: p: Jump to behavior
Source: C:\Windows\System32\msiexec.exe File opened: n: Jump to behavior
Source: C:\Windows\System32\msiexec.exe File opened: l: Jump to behavior
Source: C:\Windows\System32\msiexec.exe File opened: j: Jump to behavior
Source: C:\Windows\System32\msiexec.exe File opened: h: Jump to behavior
Source: C:\Windows\System32\msiexec.exe File opened: f: Jump to behavior
Source: C:\Windows\System32\msiexec.exe File opened: b: Jump to behavior
Source: C:\Windows\System32\msiexec.exe File opened: y: Jump to behavior
Source: C:\Windows\System32\msiexec.exe File opened: w: Jump to behavior
Source: C:\Windows\System32\msiexec.exe File opened: u: Jump to behavior
Source: C:\Windows\System32\msiexec.exe File opened: s: Jump to behavior
Source: C:\Windows\System32\msiexec.exe File opened: q: Jump to behavior
Source: C:\Windows\System32\msiexec.exe File opened: o: Jump to behavior
Source: C:\Windows\System32\msiexec.exe File opened: m: Jump to behavior
Source: C:\Windows\System32\msiexec.exe File opened: k: Jump to behavior
Source: C:\Windows\System32\msiexec.exe File opened: i: Jump to behavior
Source: C:\Windows\System32\msiexec.exe File opened: g: Jump to behavior
Source: C:\Windows\System32\msiexec.exe File opened: e: Jump to behavior
Source: C:\Windows\System32\msiexec.exe File opened: c: Jump to behavior
Source: C:\Windows\System32\msiexec.exe File opened: a: Jump to behavior
Source: EBJYdmfyWF.msi String found in binary or memory: http://cert.ssl.com/SSL.com-timeStamping-I-RSA-R1.cer0Q
Source: EBJYdmfyWF.msi String found in binary or memory: http://cert.ssl.com/SSLcom-SubCA-CodeSigning-RSA-4096-R1.cer0
Source: EBJYdmfyWF.msi String found in binary or memory: http://crls.ssl.com/SSL.com-timeStamping-I-RSA-R1.crl0
Source: EBJYdmfyWF.msi String found in binary or memory: http://crls.ssl.com/SSLcom-SubCA-CodeSigning-RSA-4096-R1.crl0
Source: EBJYdmfyWF.msi String found in binary or memory: http://crls.ssl.com/ssl.com-rsa-RootCA.crl0
Source: EBJYdmfyWF.msi String found in binary or memory: http://ocsps.ssl.com0
Source: EBJYdmfyWF.msi String found in binary or memory: http://ocsps.ssl.com0?
Source: EBJYdmfyWF.msi String found in binary or memory: http://ocsps.ssl.com0Q
Source: EBJYdmfyWF.msi String found in binary or memory: http://www.ssl.com/repository/SSLcomRootCertificationAuthorityRSA.crt0
Source: EBJYdmfyWF.msi String found in binary or memory: https://www.ssl.com/repository0
Source: classification engine Classification label: mal42.winMSI@2/0@0/0
Source: C:\Windows\System32\msiexec.exe Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\SystemCertificates\CA Jump to behavior
Source: EBJYdmfyWF.msi Static file information: TRID: Microsoft Windows Installer (60509/1) 88.31%
Source: EBJYdmfyWF.msi ReversingLabs: Detection: 15%
Source: unknown Process created: C:\Windows\System32\msiexec.exe "C:\Windows\System32\msiexec.exe" /i "C:\Users\user\Desktop\EBJYdmfyWF.msi"
Source: unknown Process created: C:\Windows\System32\msiexec.exe C:\Windows\system32\msiexec.exe /V
Source: C:\Windows\System32\msiexec.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: aclayers.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: sfc.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: sfc_os.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: msi.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: srpapi.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: tsappcmp.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: textinputframework.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: coreuicomponents.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: coremessaging.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: ntmarta.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: wintypes.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: wintypes.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: wintypes.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: propsys.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: textshaping.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: netapi32.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: wkscli.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: msasn1.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: cryptsp.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: rsaenh.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: cryptbase.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: msisip.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: gpapi.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: version.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: mscoree.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: msihnd.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: dwmapi.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: pcacli.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: mpr.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: aclayers.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: sfc.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: sfc_os.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: msi.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Automated click: OK
Source: C:\Windows\System32\msiexec.exe Automated click: OK
Source: C:\Windows\System32\msiexec.exe Automated click: OK
Source: C:\Windows\System32\msiexec.exe Automated click: OK
Source: C:\Windows\System32\msiexec.exe Automated click: OK
Source: C:\Windows\System32\msiexec.exe Automated click: OK
Source: C:\Windows\System32\msiexec.exe Automated click: OK
Source: C:\Windows\System32\msiexec.exe Automated click: OK
Source: C:\Windows\System32\msiexec.exe Automated click: OK
Source: C:\Windows\System32\msiexec.exe Automated click: OK
Source: C:\Windows\System32\msiexec.exe Automated click: OK
Source: C:\Windows\System32\msiexec.exe Automated click: OK
Source: C:\Windows\System32\msiexec.exe Automated click: OK
Source: C:\Windows\System32\msiexec.exe Automated click: OK
Source: C:\Windows\System32\msiexec.exe Automated click: OK
Source: C:\Windows\System32\msiexec.exe Automated click: OK
Source: C:\Windows\System32\msiexec.exe Automated click: OK
Source: C:\Windows\System32\msiexec.exe Automated click: OK
Source: C:\Windows\System32\msiexec.exe Automated click: OK
Source: C:\Windows\System32\msiexec.exe Automated click: OK
Source: C:\Windows\System32\msiexec.exe Automated click: OK
Source: C:\Windows\System32\msiexec.exe Automated click: OK
Source: C:\Windows\System32\msiexec.exe Automated click: OK
Source: C:\Windows\System32\msiexec.exe Automated click: OK
Source: C:\Windows\System32\msiexec.exe Automated click: OK
Source: C:\Windows\System32\msiexec.exe Automated click: OK
Source: C:\Windows\System32\msiexec.exe Automated click: OK
Source: C:\Windows\System32\msiexec.exe Automated click: OK
Source: C:\Windows\System32\msiexec.exe Automated click: OK
Source: C:\Windows\System32\msiexec.exe Automated click: OK
Source: C:\Windows\System32\msiexec.exe Automated click: OK
Source: C:\Windows\System32\msiexec.exe Automated click: OK
Source: C:\Windows\System32\msiexec.exe Automated click: OK
Source: C:\Windows\System32\msiexec.exe Automated click: OK
Source: C:\Windows\System32\msiexec.exe Automated click: OK
Source: C:\Windows\System32\msiexec.exe Automated click: OK
Source: C:\Windows\System32\msiexec.exe Automated click: OK
Source: C:\Windows\System32\msiexec.exe Automated click: OK
Source: C:\Windows\System32\msiexec.exe Automated click: OK
Source: C:\Windows\System32\msiexec.exe Automated click: OK
Source: C:\Windows\System32\msiexec.exe Automated click: OK
Source: C:\Windows\System32\msiexec.exe Automated click: OK
Source: C:\Windows\System32\msiexec.exe Automated click: OK
Source: C:\Windows\System32\msiexec.exe Automated click: OK
Source: C:\Windows\System32\msiexec.exe Automated click: OK
Source: C:\Windows\System32\msiexec.exe Automated click: OK
Source: Window Recorder Window detected: More than 3 window changes detected
Source: EBJYdmfyWF.msi Static file information: File size 7598080 > 1048576
Source: C:\Windows\System32\msiexec.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\msiexec.exe File Volume queried: C:\ FullSizeInformation Jump to behavior
Source: C:\Windows\System32\msiexec.exe File Volume queried: C:\ FullSizeInformation Jump to behavior
Source: C:\Windows\System32\msiexec.exe File Volume queried: C:\ FullSizeInformation Jump to behavior
Source: C:\Windows\System32\msiexec.exe File Volume queried: C:\ FullSizeInformation Jump to behavior
Source: EBJYdmfyWF.msi Binary or memory string: tQemu
Queries the volume information (name, serial number etc) of a device
Source: C:\Windows\System32\msiexec.exe Queries volume information: C:\ VolumeInformation Jump to behavior
windows-stand
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 signatures2 2 Behavior Graph ID: 1527969 Sample: EBJYdmfyWF.msi Startdate: 07/10/2024 Architecture: WINDOWS Score: 42 9 Antivirus / Scanner detection for submitted sample 2->9 11 Multi AV Scanner detection for submitted file 2->11 5 msiexec.exe 3 2->5         started        7 msiexec.exe 2->7         started        process3
⊘No contacted IP infos