Joe Sandbox Cloud Basic

Want to search on specific fields?


Try our:

Advanced Search

Want to search in depth on all Cloud Basic reports?

Try: Joe Sandbox View

Register Login
sloganpng
top title background image
flash

2UoXCbfNSl.msi

Status: finished
Submission Time: 2023-05-26 11:40:11 +02:00
Malicious
Evader

Comments

Tags

  • gozi
  • msi

Details

  • Analysis ID:
    876164
  • API (Web) ID:
    1243153
  • Original Filename:
    cd8393350f7cfc0762e09ee3b0a98002a1b9abf362caf5f210e717e1d4ebe53a.msi
  • Analysis Started:
    2023-05-26 11:40:14 +02:00
  • Analysis Finished:
    2023-05-26 11:51:12 +02:00
  • MD5:
    82ff84cb9924f0855a894e75b5d3edb2
  • SHA1:
    df89381239f8a8ececeb697a6a35a573203bac09
  • SHA256:
    cd8393350f7cfc0762e09ee3b0a98002a1b9abf362caf5f210e717e1d4ebe53a
  • Technologies:

Joe Sandbox

Engine Download Report Detection Info
Full Report Management Report IOC Report
malicious
Score: 52
System: Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01

URLs

Name Detection
https://sectigo.com
https://sectigo.comButtonText_Yes&YesARPCOMMENTSThis

Dropped files

Name File Type Hashes Detection
C:\Windows\Installer\MSI2E51.tmp
 PE32 executable (GUI) Intel 80386, for MS Windows
 #
C:\Windows\Installer\MSI2A38.tmp
 PE32 executable (GUI) Intel 80386, for MS Windows
 #
C:\Windows\Temp\~DF95C513D54DE54DBD.TMP
 data
 #
Click to see the 28 hidden entries
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log
 Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
 #
C:\Windows\Temp\~DF10D2DAB67DA41C8A.TMP
 Composite Document File V2 Document, Cannot read section info
 #
C:\Windows\Temp\~DF1227C6BDFAEB717C.TMP
 Composite Document File V2 Document, Cannot read section info
 #
C:\Windows\Temp\~DF68D74EC899244EDA.TMP
 data
 #
C:\Windows\Temp\~DF7FE13E1A7726FEE7.TMP
 Composite Document File V2 Document, Cannot read section info
 #
C:\Windows\Temp\~DF8512FFC219F00200.TMP
 data
 #
C:\Windows\Installer\SourceHash{61FBEA40-2644-43BA-811E-2B6E5B7CAA2A}
 Composite Document File V2 Document, Cannot read section info
 #
C:\Windows\Temp\~DF96E1B63E07A25412.TMP
 data
 #
C:\Windows\Temp\~DFB2AA96E7FD83FBD9.TMP
 Composite Document File V2 Document, Cannot read section info
 #
C:\Windows\Temp\~DFB34D19DFF552AF61.TMP
 data
 #
C:\Windows\Temp\~DFBED5ECD771A438C3.TMP
 data
 #
C:\Windows\Temp\~DFDDFB5948BDA3D3DB.TMP
 data
 #
C:\Windows\Temp\~DFE5C2C184C7DA67D2.TMP
 Composite Document File V2 Document, Cannot read section info
 #
\Device\ConDrv
 ASCII text, with CRLF line terminators
 #
C:\Windows\Installer\inprogressinstallinfo.ipi
 Composite Document File V2 Document, Cannot read section info
 #
C:\Config.Msi\51235e.rbs
 data
 #
C:\Windows\Installer\MSI29DA.tmp
 data
 #
C:\Windows\Installer\MSI28B0.tmp
 PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
 #
C:\Windows\Installer\MSI2841.tmp
 PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
 #
C:\Windows\Installer\MSI27E3.tmp
 PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
 #
C:\Windows\Installer\MSI27A3.tmp
 PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
 #
C:\Windows\Installer\MSI26B8.tmp
 PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
 #
C:\Windows\Installer\51235f.msi
 Composite Document File V2 Document, Little Endian, Os: Windows, Version 10.0, MSI Installer, Last Printed: Fri Dec 11 11:47:44 2009, Last Saved Time/Date: Fri Sep 18 15:06:51 2020, Security: 0, Code page: 1252, Revision Number: {B4B73A8E-7CF9-43FC-9A (…)
 #
C:\Windows\Installer\51235c.msi
 Composite Document File V2 Document, Little Endian, Os: Windows, Version 10.0, MSI Installer, Last Printed: Fri Dec 11 11:47:44 2009, Last Saved Time/Date: Fri Sep 18 15:06:51 2020, Security: 0, Code page: 1252, Revision Number: {B4B73A8E-7CF9-43FC-9A (…)
 #
C:\Users\user\AppData\Roaming\MSTX340\ini.dll
 PE32+ executable (DLL) (console) x86-64, for MS Windows
 #
C:\Users\user\AppData\Roaming\MSTX340\Information_psw.pdf
 PDF document, version 1.5 (zip deflate encoded)
 #
C:\Users\user\AppData\Local\Temp\4505.tmp
 ASCII text, with CRLF line terminators
 #
C:\Users\user\AppData\Local\Temp\158A.tmp
 ASCII text, with CRLF line terminators
 #