Automated Malware Analysis IOC Report for

Files

File Path

Type

Category

Malicious

explorando-y-jugando.msi

Composite Document File V2 Document, Little Endian, Os: Windows, Version 10.0, MSI Installer, Last Printed: Fri Dec 11 11:47:44 2009, Create Time/Date: Fri Dec 11 11:47:44 2009, Last Saved Time/Date: Fri Dec 11 11:47:44 2009, Security: 0, Code page: 1252, Revision Number: {7AFBC8C6-179F-4DC5-B89F-9B7ED108178A}, Number of Words: 2, Subject: Explorando y Jugando, Author: Inclusive Technology Ltd, Name of Creating Application: Advanced Installer 14.2.1 build 80371, Template: ;3082, Comments: Esta base de datos del instalador contiene la lgica y los datos necesarios para instalar Explorando y Jugando., Title: Installation Database, Keywords: Installer, MSI, Database, Number of Pages: 200

initial sample

Details

Filetype:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 10.0, MSI Installer, Last Printed: Fri Dec 11 11:47:44 2009, Create Time/Date: Fri Dec 11 11:47:44 2009, Last Saved Time/Date: Fri Dec 11 11:47:44 2009, Security: 0, Code page: 1252, Revision Number: {7AFBC8C6-179F-4DC5-B89F-9B7ED108178A}, Number of Words: 2, Subject: Explorando y Jugando, Author: Inclusive Technology Ltd, Name of Creating Application: Advanced Installer 14.2.1 build 80371, Template: ;3082, Comments: Esta base de datos del instalador contiene la lgica y los datos necesarios para instalar Explorando y Jugando., Title: Installation Database, Keywords: Installer, MSI, Database, Number of Pages: 200
Entropy:	7.9656416986760545
Filename:	explorando-y-jugando.msi
Filesize:	34364416
MD5:	86d01bc26931534885cf4cee900793b6
SHA1:	6d8761c82848f2bb12ca4b40aafb085c41973a6c
SHA256:	6ffcdcf6ae0006a2b218301d0eb2c275b475c897a638bbec8ef578ec7bfd8cca
SHA512:	782acc5dce94619c8b07c81b4866cb31f836c48c08edcf5e773fc69fe9e18cdcea7bc2780bfd281d68fc025f6a8c73ead3416c29f80f92e739e4e62608371d76
SSDEEP:	786432:ofjqsFw1rXI/vR/oSKi+CfSqymap3SB7wMthVO/nWP:0Fw1rXMgC6qv4aTVO/nu
Preview:	........................>.......................................................'...(...)...*...+...,...W...............................^..._...`...............v..............................................................................................

Signature Hits	Behavior Group	Mitre Attack
Multi AV Scanner detection for submitted file	AV Detection
Sample file is different than original file name gathered from version info	System Summary
Sample is known by Antivirus	System Summary
URLs found in memory or binary data	Networking
Submission file is bigger than most known malware samples	System Summary

C:\Users\user\AppData\Local\Temp\MSID66D.tmp

PE32 executable (DLL) (GUI) Intel 80386, for MS Windows

dropped

Details

File:	C:\Users\user\AppData\Local\Temp\MSID66D.tmp
Category:	dropped
Dump:	MSID66D.tmp.0.dr
ID:	dr_0
Target ID:	0
Process:	C:\Windows\System32\msiexec.exe
Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Entropy:	6.496201077142068
Encrypted:	false
Ssdeep:	3072:cfAJE2dIr2FsYa7gdwW0ZeYlCllS0KtzFAzxXtksgsQt1RIp7SW+Gt:c69sYoewW0dU40IFAwIpOBG
Size:	211616
Whitelisted:	false
Reputation:	low

Signature Hits	Behavior Group	Mitre Attack
Drops PE files	Persistence and Installation Behavior
Found dropped PE file which has not been started or loaded	Malware Analysis System Evasion
Creates temporary files	System Summary

C:\Users\user\AppData\Local\Temp\MSID7E5.tmp

PE32 executable (DLL) (GUI) Intel 80386, for MS Windows

dropped

Details

File:	C:\Users\user\AppData\Local\Temp\MSID7E5.tmp
Category:	dropped
Dump:	MSID7E5.tmp.0.dr
ID:	dr_1
Target ID:	0
Process:	C:\Windows\System32\msiexec.exe
Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Entropy:	6.496201077142068
Encrypted:	false
Ssdeep:	3072:cfAJE2dIr2FsYa7gdwW0ZeYlCllS0KtzFAzxXtksgsQt1RIp7SW+Gt:c69sYoewW0dU40IFAwIpOBG
Size:	211616
Whitelisted:	false
Reputation:	low

Signature Hits	Behavior Group	Mitre Attack
Drops PE files	Persistence and Installation Behavior
Found dropped PE file which has not been started or loaded	Malware Analysis System Evasion

C:\Users\user\AppData\Local\Temp\MSID805.tmp

PE32 executable (DLL) (GUI) Intel 80386, for MS Windows

dropped

Details

File:	C:\Users\user\AppData\Local\Temp\MSID805.tmp
Category:	dropped
Dump:	MSID805.tmp.0.dr
ID:	dr_2
Target ID:	0
Process:	C:\Windows\System32\msiexec.exe
Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Entropy:	6.496201077142068
Encrypted:	false
Ssdeep:	3072:cfAJE2dIr2FsYa7gdwW0ZeYlCllS0KtzFAzxXtksgsQt1RIp7SW+Gt:c69sYoewW0dU40IFAwIpOBG
Size:	211616
Whitelisted:	false
Reputation:	low

Signature Hits	Behavior Group	Mitre Attack
Drops PE files	Persistence and Installation Behavior
Found dropped PE file which has not been started or loaded	Malware Analysis System Evasion

C:\Users\user\AppData\Local\Temp\MSID815.tmp

PE32 executable (DLL) (GUI) Intel 80386, for MS Windows

dropped

Details

File:	C:\Users\user\AppData\Local\Temp\MSID815.tmp
Category:	dropped
Dump:	MSID815.tmp.0.dr
ID:	dr_3
Target ID:	0
Process:	C:\Windows\System32\msiexec.exe
Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Entropy:	6.496201077142068
Encrypted:	false
Ssdeep:	3072:cfAJE2dIr2FsYa7gdwW0ZeYlCllS0KtzFAzxXtksgsQt1RIp7SW+Gt:c69sYoewW0dU40IFAwIpOBG
Size:	211616
Whitelisted:	false
Reputation:	low

Signature Hits	Behavior Group	Mitre Attack
Drops PE files	Persistence and Installation Behavior
Found dropped PE file which has not been started or loaded	Malware Analysis System Evasion

C:\Users\user\AppData\Local\Temp\MSID93F.tmp

PE32 executable (DLL) (GUI) Intel 80386, for MS Windows

dropped

Details

File:	C:\Users\user\AppData\Local\Temp\MSID93F.tmp
Category:	dropped
Dump:	MSID93F.tmp.0.dr
ID:	dr_4
Target ID:	0
Process:	C:\Windows\System32\msiexec.exe
Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Entropy:	6.496201077142068
Encrypted:	false
Ssdeep:	3072:cfAJE2dIr2FsYa7gdwW0ZeYlCllS0KtzFAzxXtksgsQt1RIp7SW+Gt:c69sYoewW0dU40IFAwIpOBG
Size:	211616
Whitelisted:	false
Reputation:	low

Signature Hits	Behavior Group	Mitre Attack
Drops PE files	Persistence and Installation Behavior
Found dropped PE file which has not been started or loaded	Malware Analysis System Evasion

Processes

Path

Cmdline

Malicious

C:\Windows\System32\msiexec.exe

"C:\Windows\System32\msiexec.exe" /i "C:\Users\user\Desktop\explorando-y-jugando.msi"

Details

Is windows:	true
Is dropped:	false
PID:	5784
Target ID:	0
Parent PID:	1028
Name:	msiexec.exe
Class:	system-tools
Path:	C:\Windows\System32\msiexec.exe
Commandline:	"C:\Windows\System32\msiexec.exe" /i "C:\Users\user\Desktop\explorando-y-jugando.msi"
Size:	69632
MD5:	E5DA170027542E25EDE42FC54C929077
Time:	14:05:10
Date:	25/04/2024
Reason:	newprocess
Reputation:	high
Is admin:	true
Is elevated:	true
Modulebase:	0x7ff7f9f80000
Modulesize:	94208
Wow64:	false

Signature Hits	Behavior Group	Mitre Attack
Spawns processes	System Summary	Process Injection
URLs found in memory or binary data	Networking

C:\Windows\System32\msiexec.exe

C:\Windows\system32\msiexec.exe /V

Details

Is windows:	true
Is dropped:	false
PID:	652
Target ID:	2
Parent PID:	632
Name:	msiexec.exe
Class:	system-tools
Path:	C:\Windows\System32\msiexec.exe
Commandline:	C:\Windows\system32\msiexec.exe /V
Size:	69632
MD5:	E5DA170027542E25EDE42FC54C929077
Time:	14:05:11
Date:	25/04/2024
Reason:	newprocess
Reputation:	high
Is admin:	true
Is elevated:	true
Modulebase:	0x7ff7f9f80000
Modulesize:	94208
Wow64:	false

Signature Hits	Behavior Group	Mitre Attack
Spawns processes	System Summary	Process Injection
URLs found in memory or binary data	Networking

C:\Windows\SysWOW64\msiexec.exe

C:\Windows\syswow64\MsiExec.exe -Embedding A1D006493CD647BD2EC1A35C9661BDDE C

Details

Is windows:	true
Is dropped:	false
PID:	6204
Target ID:	3
Parent PID:	652
Name:	msiexec.exe
Class:	system-tools
Path:	C:\Windows\SysWOW64\msiexec.exe
Commandline:	C:\Windows\syswow64\MsiExec.exe -Embedding A1D006493CD647BD2EC1A35C9661BDDE C
Size:	59904
MD5:	9D09DC1EDA745A5F87553048E57620CF
Time:	14:05:12
Date:	25/04/2024
Reason:	newprocess
Reputation:	high
Is admin:	true
Is elevated:	true
Modulebase:	0x4c0000
Modulesize:	73728
Wow64:	true

Signature Hits	Behavior Group	Mitre Attack
Spawns processes	System Summary	Process Injection
URLs found in memory or binary data	Networking

URLs

Name

Malicious

http://www.inclusive.comAI_UNINSTALLERmsiexec.exeDialogBitmapdialogALLUSERS1ButtonText_Yes&S

unknown

https://www.thawte.com/cps0/

unknown

https://www.thawte.com/repository0W

unknown

http://www.advancedinstaller.com0

unknown

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

IOC Report
explorando-y-jugando.msi

Files

Processes

URLs

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

IOC Reportexplorando-y-jugando.msi

Files

Processes

URLs

IOC Report
explorando-y-jugando.msi