Automated Malware Analysis IOC Report for

Files

File Path

Type

Category

Malicious

Healthmark Scope Viewer - Local Mode 05252021 (1).msi

Composite Document File V2 Document, Little Endian, Os: Windows, Version 10.0, MSI Installer, Last Printed: Fri Dec 11 11:47:44 2009, Create Time/Date: Fri Dec 11 11:47:44 2009, Last Saved Time/Date: Fri Sep 18 15:06:51 2020, Security: 0, Code page: 1252, Revision Number: {85B3BCB7-C030-41D6-8614-BD53246D8417}, Number of Words: 2, Subject: Healthmark Scope Viewer, Author: Healthmark, Name of Creating Application: Advanced Installer 17.7 build 8a137570, Template: ;1033, Comments: This installer database contains the logic and data required to install Healthmark Scope Viewer., Title: Installation Database, Keywords: Installer, MSI, Database, Number of Pages: 200

initial sample

Details

Filetype:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 10.0, MSI Installer, Last Printed: Fri Dec 11 11:47:44 2009, Create Time/Date: Fri Dec 11 11:47:44 2009, Last Saved Time/Date: Fri Sep 18 15:06:51 2020, Security: 0, Code page: 1252, Revision Number: {85B3BCB7-C030-41D6-8614-BD53246D8417}, Number of Words: 2, Subject: Healthmark Scope Viewer, Author: Healthmark, Name of Creating Application: Advanced Installer 17.7 build 8a137570, Template: ;1033, Comments: This installer database contains the logic and data required to install Healthmark Scope Viewer., Title: Installation Database, Keywords: Installer, MSI, Database, Number of Pages: 200
Entropy:	7.992522495912771
Filename:	Healthmark Scope Viewer - Local Mode 05252021 (1).msi
Filesize:	33198080
MD5:	5fd9400c920567663328d5a133156d44
SHA1:	e59c361e6a21f593bc48e286bc866e6d2d26fe06
SHA256:	07ef5c2b2d7fc4d556e8a0a5be13537908a7ce49dee1f48f4fff695ac72c27e5
SHA512:	fe603929ebc31ea8fb271a3559117151a9d2b3c40938eee195ebf883f703011e4000271dbb5c8876ad4d2795013cc6aa453f2beaf1a861c2faf03136b4967fbd
SSDEEP:	786432:x6tGDc1IwWkq4XqYVCgArxK+BsRdlG+OKOMt73+rzSK0zUx:4tQ6kYogA9K+BsoyOD0
Preview:	........................>.......................................................P...Q...R...S...T...U...[.......t...u...v...w...x...y...z...{...\|...}...~......................................................................................................

Signature Hits	Behavior Group	Mitre Attack
Sample file is different than original file name gathered from version info	System Summary
URLs found in memory or binary data	Networking
Submission file is bigger than most known malware samples	System Summary

C:\Users\user\AppData\Local\Temp\MSI6C1C.tmp

PE32 executable (DLL) (GUI) Intel 80386, for MS Windows

dropped

Details

File:	C:\Users\user\AppData\Local\Temp\MSI6C1C.tmp
Category:	dropped
Dump:	MSI6C1C.tmp.0.dr
ID:	dr_0
Target ID:	0
Process:	C:\Windows\System32\msiexec.exe
Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Entropy:	6.42232102371954
Encrypted:	false
Ssdeep:	6144:JyVt6fHYx+8GOL2bS9Li0k9TY1fuMuwLspJaDsAkvAO5cSrQVKlbCS4T73:6tkeYbS9L/RuMuwLocopMlVSCS4T7
Size:	390304
Whitelisted:	false
Reputation:	moderate

Signature Hits	Behavior Group	Mitre Attack
Drops PE files	Persistence and Installation Behavior
Found dropped PE file which has not been started or loaded	Malware Analysis System Evasion

C:\Users\user\AppData\Local\Temp\MSI6CAA.tmp

PE32 executable (DLL) (GUI) Intel 80386, for MS Windows

dropped

Details

File:	C:\Users\user\AppData\Local\Temp\MSI6CAA.tmp
Category:	dropped
Dump:	MSI6CAA.tmp.0.dr
ID:	dr_1
Target ID:	0
Process:	C:\Windows\System32\msiexec.exe
Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Entropy:	6.42232102371954
Encrypted:	false
Ssdeep:	6144:JyVt6fHYx+8GOL2bS9Li0k9TY1fuMuwLspJaDsAkvAO5cSrQVKlbCS4T73:6tkeYbS9L/RuMuwLocopMlVSCS4T7
Size:	390304
Whitelisted:	false
Reputation:	moderate

Signature Hits	Behavior Group	Mitre Attack
Drops PE files	Persistence and Installation Behavior
Found dropped PE file which has not been started or loaded	Malware Analysis System Evasion

C:\Users\user\AppData\Local\Temp\MSI6CBA.tmp

PE32 executable (DLL) (GUI) Intel 80386, for MS Windows

dropped

Details

File:	C:\Users\user\AppData\Local\Temp\MSI6CBA.tmp
Category:	dropped
Dump:	MSI6CBA.tmp.0.dr
ID:	dr_2
Target ID:	0
Process:	C:\Windows\System32\msiexec.exe
Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Entropy:	6.42232102371954
Encrypted:	false
Ssdeep:	6144:JyVt6fHYx+8GOL2bS9Li0k9TY1fuMuwLspJaDsAkvAO5cSrQVKlbCS4T73:6tkeYbS9L/RuMuwLocopMlVSCS4T7
Size:	390304
Whitelisted:	false
Reputation:	moderate

Signature Hits	Behavior Group	Mitre Attack
Drops PE files	Persistence and Installation Behavior
Found dropped PE file which has not been started or loaded	Malware Analysis System Evasion

C:\Users\user\AppData\Local\Temp\MSI6CDB.tmp

PE32 executable (DLL) (GUI) Intel 80386, for MS Windows

modified

Details

File:	C:\Users\user\AppData\Local\Temp\MSI6CDB.tmp
Category:	modified
Dump:	MSI6CDB.tmp.0.dr
ID:	dr_3
Target ID:	0
Process:	C:\Windows\System32\msiexec.exe
Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Entropy:	6.42232102371954
Encrypted:	false
Ssdeep:	6144:JyVt6fHYx+8GOL2bS9Li0k9TY1fuMuwLspJaDsAkvAO5cSrQVKlbCS4T73:6tkeYbS9L/RuMuwLocopMlVSCS4T7
Size:	390304
Whitelisted:	false
Reputation:	moderate

Signature Hits	Behavior Group	Mitre Attack
Drops PE files	Persistence and Installation Behavior
Found dropped PE file which has not been started or loaded	Malware Analysis System Evasion

C:\Users\user\AppData\Local\Temp\MSI6D68.tmp

PE32 executable (DLL) (GUI) Intel 80386, for MS Windows

dropped

Details

File:	C:\Users\user\AppData\Local\Temp\MSI6D68.tmp
Category:	dropped
Dump:	MSI6D68.tmp.0.dr
ID:	dr_4
Target ID:	0
Process:	C:\Windows\System32\msiexec.exe
Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Entropy:	6.42232102371954
Encrypted:	false
Ssdeep:	6144:JyVt6fHYx+8GOL2bS9Li0k9TY1fuMuwLspJaDsAkvAO5cSrQVKlbCS4T73:6tkeYbS9L/RuMuwLocopMlVSCS4T7
Size:	390304
Whitelisted:	false
Reputation:	timeout

Signature Hits	Behavior Group	Mitre Attack
Drops PE files	Persistence and Installation Behavior
Found dropped PE file which has not been started or loaded	Malware Analysis System Evasion

Processes

Path

Cmdline

Malicious

C:\Windows\System32\msiexec.exe

"C:\Windows\System32\msiexec.exe" /i "C:\Users\user\Desktop\Healthmark Scope Viewer - Local Mode 05252021 (1).msi"

Details

Is windows:	true
Is dropped:	false
PID:	6636
Target ID:	0
Parent PID:	4056
Name:	msiexec.exe
Class:	system-tools
Path:	C:\Windows\System32\msiexec.exe
Commandline:	"C:\Windows\System32\msiexec.exe" /i "C:\Users\user\Desktop\Healthmark Scope Viewer - Local Mode 05252021 (1).msi"
Size:	69632
MD5:	E5DA170027542E25EDE42FC54C929077
Time:	16:55:46
Date:	30/10/2024
Reason:	newprocess
Reputation:	high
Is admin:	true
Is elevated:	true
Modulebase:	0x7ff6e0460000
Modulesize:	94208
Wow64:	false

Signature Hits	Behavior Group	Mitre Attack
Spawns processes	System Summary	Process Injection

C:\Windows\System32\msiexec.exe

C:\Windows\system32\msiexec.exe /V

Details

Is windows:	true
Is dropped:	false
PID:	1412
Target ID:	2
Parent PID:	624
Name:	msiexec.exe
Class:	system-tools
Path:	C:\Windows\System32\msiexec.exe
Commandline:	C:\Windows\system32\msiexec.exe /V
Size:	69632
MD5:	E5DA170027542E25EDE42FC54C929077
Time:	16:55:46
Date:	30/10/2024
Reason:	newprocess
Reputation:	high
Is admin:	true
Is elevated:	true
Modulebase:	0x7ff6e0460000
Modulesize:	94208
Wow64:	false

Signature Hits	Behavior Group	Mitre Attack
Spawns processes	System Summary	Process Injection

C:\Windows\SysWOW64\msiexec.exe

C:\Windows\syswow64\MsiExec.exe -Embedding AEEDF54BDF0194DBE73191312315C287 C

Details

Is windows:	true
Is dropped:	false
PID:	1528
Target ID:	3
Parent PID:	1412
Name:	msiexec.exe
Class:	system-tools
Path:	C:\Windows\SysWOW64\msiexec.exe
Commandline:	C:\Windows\syswow64\MsiExec.exe -Embedding AEEDF54BDF0194DBE73191312315C287 C
Size:	59904
MD5:	9D09DC1EDA745A5F87553048E57620CF
Time:	16:55:46
Date:	30/10/2024
Reason:	newprocess
Reputation:	high
Is admin:	true
Is elevated:	true
Modulebase:	0x310000
Modulesize:	73728
Wow64:	true

Signature Hits	Behavior Group	Mitre Attack
Spawns processes	System Summary	Process Injection

URLs

Name

Malicious

https://www.advancedinstaller.com

unknown

https://www.thawte.com/cps0/

unknown

https://www.thawte.com/repository0W

unknown

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

IOC Report
Healthmark Scope Viewer - Local Mode 05252021 (1).msi

Files

Processes

URLs

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

IOC ReportHealthmark Scope Viewer - Local Mode 05252021 (1).msi

Files

Processes

URLs

IOC Report
Healthmark Scope Viewer - Local Mode 05252021 (1).msi