Edit tour
Windows
Analysis Report
._WinSitu-5.7.8.0.msi
Overview
General Information
| Sample name: | ._WinSitu-5.7.8.0.msi |
| Analysis ID: | 1545013 |
| MD5: | 4b727a821f9e95373d63665d682c199a |
| SHA1: | 3b4420390f54e03befe3aa523b508d68af359337 |
| SHA256: | dc67d7a6ae0d2dd5fe97f8eae6c1793ce084fadad1c64e194c06d7e8a8122d3e |
 | |
Detection
| Score: | 0 |
| Range: | 0 - 100 |
| Whitelisted: | false |
| Confidence: | 80% |
Signatures
Program does not show much activity (idle)
Classification
- System is w10x64
msiexec.exe (PID: 7356 cmdline: "C:\Window s\System32 \msiexec.e xe" /i "C: \Users\use r\Desktop\ ._WinSitu- 5.7.8.0.ms i" MD5: E5DA170027542E25EDE42FC54C929077)
- cleanup
⊘No configs have been found
⊘No yara matches
⊘No Sigma rule has matched
⊘No Suricata rule has matched
Click to jump to signature section
Show All Signature Results
There are no malicious signatures, click here to show all signatures.
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | Classification label: | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Thread injection, dropped files, key value created, disk infection and DNS query: | ||
| Source: | Thread injection, dropped files, key value created, disk infection and DNS query: | ||
| Reconnaissance | Resource Development | Initial Access | Execution | Persistence | Privilege Escalation | Defense Evasion | Credential Access | Discovery | Lateral Movement | Collection | Command and Control | Exfiltration | Impact |
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| Gather Victim Identity Information | Acquire Infrastructure | Valid Accounts | Windows Management Instrumentation | 1 DLL Side-Loading | 1 DLL Side-Loading | 1 DLL Side-Loading | OS Credential Dumping | System Service Discovery | Remote Services | Data from Local System | Data Obfuscation | Exfiltration Over Other Network Medium | Abuse Accessibility Features |
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
InternetThis section contains all screenshots as thumbnails, including those not shown in the slideshow.
| Source | Detection | Scanner | Label | Link |
|---|---|---|---|---|
| 0% | ReversingLabs | |||
| 0% | Virustotal | Browse |
⊘No Antivirus matches
⊘No Antivirus matches
⊘No Antivirus matches
⊘No contacted domains info
| Name | Source | Malicious | Antivirus Detection | Reputation |
|---|---|---|---|---|
| false |
| unknown | ||
| false |
| unknown |
⊘No contacted IP infos
| Joe Sandbox version: | 41.0.0 Charoite |
| Analysis ID: | 1545013 |
| Start date and time: | 2024-10-30 00:59:36 +01:00 |
| Joe Sandbox product: | CloudBasic |
| Overall analysis duration: | 0h 1m 48s |
| Hypervisor based Inspection enabled: | false |
| Report type: | full |
| Cookbook file name: | default.jbs |
| Analysis system description: | Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01 |
| Number of analysed new started processes analysed: | 1 |
| Number of new started drivers analysed: | 0 |
| Number of existing processes analysed: | 0 |
| Number of existing drivers analysed: | 0 |
| Number of injected processes analysed: | 0 |
| Technologies: |
|
| Analysis Mode: | default |
| Analysis stop reason: | Timeout |
| Sample name: | ._WinSitu-5.7.8.0.msi |
| Detection: | CLEAN |
| Classification: | clean0.winMSI@1/0@0/0 |
| Cookbook Comments: |
|
⊘No simulations
⊘No created / dropped files found
| File type: | |
| Entropy (8bit): | 5.574176621052749 |
| TrID: |
|
| File name: | ._WinSitu-5.7.8.0.msi |
| File size: | 1'014 bytes |
| MD5: | 4b727a821f9e95373d63665d682c199a |
| SHA1: | 3b4420390f54e03befe3aa523b508d68af359337 |
| SHA256: | dc67d7a6ae0d2dd5fe97f8eae6c1793ce084fadad1c64e194c06d7e8a8122d3e |
| SHA512: | 3ecd2665c546e2f4acefc023cb6cddfedc374f026ce139298102818106e4fb74f9f87285f44c5c0a107ca717585af113fe1a7f39cbbaece2bad5e5e8d87b5d2f |
| SSDEEP: | 24:PgImxklrleBrjhklsrsghWqvNLJ3oQdP+uGw:IImxMrlMrtMsrNjYQEuGw |
| TLSH: | AC119B6971D6420ADD746EB639E3F509222396BCFA4A8988D4D5C4406B019CFA4319AF |
| File Content Preview: | ........Mac OS X .........2..................................................ATTR..........................................%com.apple.metadata:kMDItemWhereFroms........<...com.apple.quarantine.bplist00..._..https://insituinc.sharepoint.com/sites/ma |
 | |
| Icon Hash: | 2d2e3797b32b2b99 |
Key Decision
Richest Path
Thread / callback creation
Lower opacity -> Library Node⊘No network behavior found
| Target ID: | 0 |
| Start time: | 20:00:33 |
| Start date: | 29/10/2024 |
| Path: | C:\Windows\System32\msiexec.exe |
| Wow64 process (32bit): | false |
| Commandline: | |
| Imagebase: | 0x7ff75d6e0000 |
| File size: | 69'632 bytes |
| MD5 hash: | E5DA170027542E25EDE42FC54C929077 |
| Has elevated privileges: | true |
| Has administrator privileges: | true |
| Programmed in: | C, C++ or other language |
| Reputation: | high |
| Has exited: | true |
⊘No disassembly