Automated Malware Analysis IOC Report for

Files

File Path

Type

Category

Malicious

eligiendo-y-aprendiendo.msi

Composite Document File V2 Document, Little Endian, Os: Windows, Version 10.0, MSI Installer, Last Printed: Fri Dec 11 11:47:44 2009, Create Time/Date: Fri Dec 11 11:47:44 2009, Last Saved Time/Date: Fri Dec 11 11:47:44 2009, Security: 0, Code page: 1252, Revision Number: {42302C37-CC28-47E3-9F55-2F7C94D9942F}, Number of Words: 2, Subject: Eligiendo y Aprendiendo, Author: Inclusive Technology Ltd, Name of Creating Application: Advanced Installer 14.2.1 build 80371, Template: ;3082, Comments: Esta base de datos del instalador contiene la lgica y los datos necesarios para instalar Eligiendo y Aprendiendo., Title: Installation Database, Keywords: Installer, MSI, Database, Number of Pages: 200

initial sample

Details

Filetype:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 10.0, MSI Installer, Last Printed: Fri Dec 11 11:47:44 2009, Create Time/Date: Fri Dec 11 11:47:44 2009, Last Saved Time/Date: Fri Dec 11 11:47:44 2009, Security: 0, Code page: 1252, Revision Number: {42302C37-CC28-47E3-9F55-2F7C94D9942F}, Number of Words: 2, Subject: Eligiendo y Aprendiendo, Author: Inclusive Technology Ltd, Name of Creating Application: Advanced Installer 14.2.1 build 80371, Template: ;3082, Comments: Esta base de datos del instalador contiene la lgica y los datos necesarios para instalar Eligiendo y Aprendiendo., Title: Installation Database, Keywords: Installer, MSI, Database, Number of Pages: 200
Entropy:	7.98018390949407
Filename:	eligiendo-y-aprendiendo.msi
Filesize:	50646016
MD5:	6e871e9447ac8f07e16ef6daa0a69f57
SHA1:	645a4bb9d18878067dff0d8cd3fb8c3fc4f2e053
SHA256:	c70bc8df9fdfbab4b797193afb59cd9d5c9ce439a77efd49f5288412b08777ef
SHA512:	d1deaec55f908c238a0ae0b0ae59abaa4c036e5d5a8e9b243e408435fbfc9a5d8e653a0e2b15c92d9524c146e566cde09fb079a187137aeb6464957574e74313
SSDEEP:	786432:n4jGsFw1rXI/vR/oSKi+Cfo28O5edHoRpdf/PzaU0q5QkFWAUBkfoJZ5v3V0:n45w1rXMgCA1NoRpB8qjAAUt5vV
Preview:	........................>.......................................................(...)...*...+...,...-...X..............................._...`...a...............w..............................................................................................

Signature Hits	Behavior Group	Mitre Attack
Multi AV Scanner detection for submitted file	AV Detection
Sample file is different than original file name gathered from version info	System Summary
Sample is known by Antivirus	System Summary
URLs found in memory or binary data	Networking
Submission file is bigger than most known malware samples	System Summary

C:\Users\user\AppData\Local\Temp\MSI355.tmp

PE32 executable (DLL) (GUI) Intel 80386, for MS Windows

dropped

Details

File:	C:\Users\user\AppData\Local\Temp\MSI355.tmp
Category:	dropped
Dump:	MSI355.tmp.0.dr
ID:	dr_0
Target ID:	0
Process:	C:\Windows\System32\msiexec.exe
Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Entropy:	6.496201077142068
Encrypted:	false
Ssdeep:	3072:cfAJE2dIr2FsYa7gdwW0ZeYlCllS0KtzFAzxXtksgsQt1RIp7SW+Gt:c69sYoewW0dU40IFAwIpOBG
Size:	211616
Whitelisted:	false
Reputation:	low

Signature Hits	Behavior Group	Mitre Attack
Drops PE files	Persistence and Installation Behavior
Found dropped PE file which has not been started or loaded	Malware Analysis System Evasion
Creates temporary files	System Summary

C:\Users\user\AppData\Local\Temp\MSI421.tmp

PE32 executable (DLL) (GUI) Intel 80386, for MS Windows

dropped

Details

File:	C:\Users\user\AppData\Local\Temp\MSI421.tmp
Category:	dropped
Dump:	MSI421.tmp.0.dr
ID:	dr_1
Target ID:	0
Process:	C:\Windows\System32\msiexec.exe
Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Entropy:	6.496201077142068
Encrypted:	false
Ssdeep:	3072:cfAJE2dIr2FsYa7gdwW0ZeYlCllS0KtzFAzxXtksgsQt1RIp7SW+Gt:c69sYoewW0dU40IFAwIpOBG
Size:	211616
Whitelisted:	false
Reputation:	low

Signature Hits	Behavior Group	Mitre Attack
Drops PE files	Persistence and Installation Behavior
Found dropped PE file which has not been started or loaded	Malware Analysis System Evasion

C:\Users\user\AppData\Local\Temp\MSI442.tmp

PE32 executable (DLL) (GUI) Intel 80386, for MS Windows

dropped

Details

File:	C:\Users\user\AppData\Local\Temp\MSI442.tmp
Category:	dropped
Dump:	MSI442.tmp.0.dr
ID:	dr_2
Target ID:	0
Process:	C:\Windows\System32\msiexec.exe
Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Entropy:	6.496201077142068
Encrypted:	false
Ssdeep:	3072:cfAJE2dIr2FsYa7gdwW0ZeYlCllS0KtzFAzxXtksgsQt1RIp7SW+Gt:c69sYoewW0dU40IFAwIpOBG
Size:	211616
Whitelisted:	false
Reputation:	low

Signature Hits	Behavior Group	Mitre Attack
Drops PE files	Persistence and Installation Behavior
Found dropped PE file which has not been started or loaded	Malware Analysis System Evasion

C:\Users\user\AppData\Local\Temp\MSI452.tmp

PE32 executable (DLL) (GUI) Intel 80386, for MS Windows

dropped

Details

File:	C:\Users\user\AppData\Local\Temp\MSI452.tmp
Category:	dropped
Dump:	MSI452.tmp.0.dr
ID:	dr_3
Target ID:	0
Process:	C:\Windows\System32\msiexec.exe
Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Entropy:	6.496201077142068
Encrypted:	false
Ssdeep:	3072:cfAJE2dIr2FsYa7gdwW0ZeYlCllS0KtzFAzxXtksgsQt1RIp7SW+Gt:c69sYoewW0dU40IFAwIpOBG
Size:	211616
Whitelisted:	false
Reputation:	low

Signature Hits	Behavior Group	Mitre Attack
Drops PE files	Persistence and Installation Behavior
Found dropped PE file which has not been started or loaded	Malware Analysis System Evasion

C:\Users\user\AppData\Local\Temp\MSI4E0.tmp

PE32 executable (DLL) (GUI) Intel 80386, for MS Windows

dropped

Details

File:	C:\Users\user\AppData\Local\Temp\MSI4E0.tmp
Category:	dropped
Dump:	MSI4E0.tmp.0.dr
ID:	dr_4
Target ID:	0
Process:	C:\Windows\System32\msiexec.exe
Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Entropy:	6.496201077142068
Encrypted:	false
Ssdeep:	3072:cfAJE2dIr2FsYa7gdwW0ZeYlCllS0KtzFAzxXtksgsQt1RIp7SW+Gt:c69sYoewW0dU40IFAwIpOBG
Size:	211616
Whitelisted:	false
Reputation:	timeout

Signature Hits	Behavior Group	Mitre Attack
Drops PE files	Persistence and Installation Behavior
Found dropped PE file which has not been started or loaded	Malware Analysis System Evasion

Processes

Path

Cmdline

Malicious

C:\Windows\System32\msiexec.exe

"C:\Windows\System32\msiexec.exe" /i "C:\Users\user\Desktop\eligiendo-y-aprendiendo.msi"

Details

Is windows:	true
Is dropped:	false
PID:	7504
Target ID:	0
Parent PID:	2580
Name:	msiexec.exe
Class:	system-tools
Path:	C:\Windows\System32\msiexec.exe
Commandline:	"C:\Windows\System32\msiexec.exe" /i "C:\Users\user\Desktop\eligiendo-y-aprendiendo.msi"
Size:	69632
MD5:	E5DA170027542E25EDE42FC54C929077
Time:	14:05:03
Date:	25/04/2024
Reason:	newprocess
Reputation:	high
Is admin:	true
Is elevated:	true
Modulebase:	0x7ff784c20000
Modulesize:	94208
Wow64:	false

Signature Hits	Behavior Group	Mitre Attack
Spawns processes	System Summary	Process Injection
URLs found in memory or binary data	Networking

C:\Windows\System32\msiexec.exe

C:\Windows\system32\msiexec.exe /V

Details

Is windows:	true
Is dropped:	false
PID:	7536
Target ID:	1
Parent PID:	620
Name:	msiexec.exe
Class:	system-tools
Path:	C:\Windows\System32\msiexec.exe
Commandline:	C:\Windows\system32\msiexec.exe /V
Size:	69632
MD5:	E5DA170027542E25EDE42FC54C929077
Time:	14:05:04
Date:	25/04/2024
Reason:	newprocess
Reputation:	high
Is admin:	true
Is elevated:	true
Modulebase:	0x7ff784c20000
Modulesize:	94208
Wow64:	false

Signature Hits	Behavior Group	Mitre Attack
Spawns processes	System Summary	Process Injection
URLs found in memory or binary data	Networking

C:\Windows\SysWOW64\msiexec.exe

C:\Windows\syswow64\MsiExec.exe -Embedding 03A2419DA634EBCB7D1BE519434F4415 C

Details

Is windows:	true
Is dropped:	false
PID:	7584
Target ID:	2
Parent PID:	7536
Name:	msiexec.exe
Class:	system-tools
Path:	C:\Windows\SysWOW64\msiexec.exe
Commandline:	C:\Windows\syswow64\MsiExec.exe -Embedding 03A2419DA634EBCB7D1BE519434F4415 C
Size:	59904
MD5:	9D09DC1EDA745A5F87553048E57620CF
Time:	14:05:04
Date:	25/04/2024
Reason:	newprocess
Reputation:	high
Is admin:	true
Is elevated:	true
Modulebase:	0x80000
Modulesize:	73728
Wow64:	true

Signature Hits	Behavior Group	Mitre Attack
Spawns processes	System Summary	Process Injection
URLs found in memory or binary data	Networking

URLs

Name

Malicious

http://www.inclusive.comAI_UNINSTALLERmsiexec.exeDialogBitmapdialogALLUSERS1ButtonText_Yes&S

unknown

https://www.thawte.com/cps0/

unknown

https://www.thawte.com/repository0W

unknown

http://www.advancedinstaller.com0

unknown

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

IOC Report
eligiendo-y-aprendiendo.msi

Files

Processes

URLs

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

IOC Reporteligiendo-y-aprendiendo.msi

Files

Processes

URLs

IOC Report
eligiendo-y-aprendiendo.msi