Automated Malware Analysis IOC Report for

Files

File Path

Type

Category

Malicious

atencion_y_estimulacion_visual.msi

Composite Document File V2 Document, Little Endian, Os: Windows, Version 10.0, MSI Installer, Last Printed: Fri Dec 11 11:47:44 2009, Create Time/Date: Fri Dec 11 11:47:44 2009, Last Saved Time/Date: Fri Dec 11 11:47:44 2009, Security: 0, Code page: 1252, Revision Number: {36A468D7-B112-481E-AC92-7F8529874C22}, Number of Words: 2, Subject: Atencin y estimulacin visual, Author: Inclusive Technology Ltd, Name of Creating Application: Advanced Installer 14.2.1 build 80371, Template: ;3082, Comments: Esta base de datos del instalador contiene la lgica y los datos necesarios para instalar Atencin y estimulacin visual., Title: Installation Database, Keywords: Installer, MSI, Database, Number of Pages: 200

initial sample

Details

Filetype:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 10.0, MSI Installer, Last Printed: Fri Dec 11 11:47:44 2009, Create Time/Date: Fri Dec 11 11:47:44 2009, Last Saved Time/Date: Fri Dec 11 11:47:44 2009, Security: 0, Code page: 1252, Revision Number: {36A468D7-B112-481E-AC92-7F8529874C22}, Number of Words: 2, Subject: Atencin y estimulacin visual, Author: Inclusive Technology Ltd, Name of Creating Application: Advanced Installer 14.2.1 build 80371, Template: ;3082, Comments: Esta base de datos del instalador contiene la lgica y los datos necesarios para instalar Atencin y estimulacin visual., Title: Installation Database, Keywords: Installer, MSI, Database, Number of Pages: 200
Entropy:	7.9540401448663856
Filename:	atencion_y_estimulacion_visual.msi
Filesize:	27866624
MD5:	fcda6ce6211be974da8526ccd07ff424
SHA1:	efb5f0aa45de0e352bf6a84ce43ca9243bf4d3f6
SHA256:	413b159502d249ada382b32466a4a81ea5a43abf88ce285ea2aed0d7207c73c6
SHA512:	4fe9c466d120a48b09c2697e46e0a71faa5bf4031ad3a0056f2ce541da527ce3eedb79ee4dbded819f110d24457b33aec745a5b290d47769a2f3997e4a3a44a0
SSDEEP:	393216:m7PpjrKkChseeabf6LcqAiTrBrrHSWbhu/VDipQcdmLvg30wqf+EsqYdhKWPCP1i:yBjSsFFHuKQcdmsIf+EnYdQW6P1S
Preview:	........................>.......................................................'...(...)...*...+...,...W...............................^..._...`...............v..............................................................................................

Signature Hits	Behavior Group	Mitre Attack
Multi AV Scanner detection for submitted file	AV Detection
Sample file is different than original file name gathered from version info	System Summary
Sample is known by Antivirus	System Summary
URLs found in memory or binary data	Networking
Submission file is bigger than most known malware samples	System Summary

C:\Users\user\AppData\Local\Temp\MSIDB26.tmp

PE32 executable (DLL) (GUI) Intel 80386, for MS Windows

dropped

Details

File:	C:\Users\user\AppData\Local\Temp\MSIDB26.tmp
Category:	dropped
Dump:	MSIDB26.tmp.0.dr
ID:	dr_0
Target ID:	0
Process:	C:\Windows\System32\msiexec.exe
Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Entropy:	6.496201077142068
Encrypted:	false
Ssdeep:	3072:cfAJE2dIr2FsYa7gdwW0ZeYlCllS0KtzFAzxXtksgsQt1RIp7SW+Gt:c69sYoewW0dU40IFAwIpOBG
Size:	211616
Whitelisted:	false
Reputation:	low

Signature Hits	Behavior Group	Mitre Attack
Drops PE files	Persistence and Installation Behavior
Found dropped PE file which has not been started or loaded	Malware Analysis System Evasion
Creates temporary files	System Summary

C:\Users\user\AppData\Local\Temp\MSIDBF2.tmp

PE32 executable (DLL) (GUI) Intel 80386, for MS Windows

dropped

Details

File:	C:\Users\user\AppData\Local\Temp\MSIDBF2.tmp
Category:	dropped
Dump:	MSIDBF2.tmp.0.dr
ID:	dr_1
Target ID:	0
Process:	C:\Windows\System32\msiexec.exe
Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Entropy:	6.496201077142068
Encrypted:	false
Ssdeep:	3072:cfAJE2dIr2FsYa7gdwW0ZeYlCllS0KtzFAzxXtksgsQt1RIp7SW+Gt:c69sYoewW0dU40IFAwIpOBG
Size:	211616
Whitelisted:	false
Reputation:	low

Signature Hits	Behavior Group	Mitre Attack
Drops PE files	Persistence and Installation Behavior
Found dropped PE file which has not been started or loaded	Malware Analysis System Evasion

C:\Users\user\AppData\Local\Temp\MSIDC03.tmp

PE32 executable (DLL) (GUI) Intel 80386, for MS Windows

dropped

Details

File:	C:\Users\user\AppData\Local\Temp\MSIDC03.tmp
Category:	dropped
Dump:	MSIDC03.tmp.0.dr
ID:	dr_2
Target ID:	0
Process:	C:\Windows\System32\msiexec.exe
Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Entropy:	6.496201077142068
Encrypted:	false
Ssdeep:	3072:cfAJE2dIr2FsYa7gdwW0ZeYlCllS0KtzFAzxXtksgsQt1RIp7SW+Gt:c69sYoewW0dU40IFAwIpOBG
Size:	211616
Whitelisted:	false
Reputation:	low

Signature Hits	Behavior Group	Mitre Attack
Drops PE files	Persistence and Installation Behavior
Found dropped PE file which has not been started or loaded	Malware Analysis System Evasion

C:\Users\user\AppData\Local\Temp\MSIDC23.tmp

PE32 executable (DLL) (GUI) Intel 80386, for MS Windows

dropped

Details

File:	C:\Users\user\AppData\Local\Temp\MSIDC23.tmp
Category:	dropped
Dump:	MSIDC23.tmp.0.dr
ID:	dr_3
Target ID:	0
Process:	C:\Windows\System32\msiexec.exe
Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Entropy:	6.496201077142068
Encrypted:	false
Ssdeep:	3072:cfAJE2dIr2FsYa7gdwW0ZeYlCllS0KtzFAzxXtksgsQt1RIp7SW+Gt:c69sYoewW0dU40IFAwIpOBG
Size:	211616
Whitelisted:	false
Reputation:	low

Signature Hits	Behavior Group	Mitre Attack
Drops PE files	Persistence and Installation Behavior
Found dropped PE file which has not been started or loaded	Malware Analysis System Evasion

C:\Users\user\AppData\Local\Temp\MSIDE37.tmp

PE32 executable (DLL) (GUI) Intel 80386, for MS Windows

dropped

Details

File:	C:\Users\user\AppData\Local\Temp\MSIDE37.tmp
Category:	dropped
Dump:	MSIDE37.tmp.0.dr
ID:	dr_4
Target ID:	0
Process:	C:\Windows\System32\msiexec.exe
Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Entropy:	6.496201077142068
Encrypted:	false
Ssdeep:	3072:cfAJE2dIr2FsYa7gdwW0ZeYlCllS0KtzFAzxXtksgsQt1RIp7SW+Gt:c69sYoewW0dU40IFAwIpOBG
Size:	211616
Whitelisted:	false
Reputation:	timeout

Signature Hits	Behavior Group	Mitre Attack
Drops PE files	Persistence and Installation Behavior
Found dropped PE file which has not been started or loaded	Malware Analysis System Evasion

Processes

Path

Cmdline

Malicious

C:\Windows\System32\msiexec.exe

"C:\Windows\System32\msiexec.exe" /i "C:\Users\user\Desktop\atencion_y_estimulacion_visual.msi"

Details

Is windows:	true
Is dropped:	false
PID:	6456
Target ID:	0
Parent PID:	4004
Name:	msiexec.exe
Class:	system-tools
Path:	C:\Windows\System32\msiexec.exe
Commandline:	"C:\Windows\System32\msiexec.exe" /i "C:\Users\user\Desktop\atencion_y_estimulacion_visual.msi"
Size:	69632
MD5:	E5DA170027542E25EDE42FC54C929077
Time:	14:05:08
Date:	25/04/2024
Reason:	newprocess
Reputation:	high
Is admin:	true
Is elevated:	true
Modulebase:	0x7ff601e20000
Modulesize:	94208
Wow64:	false

Signature Hits	Behavior Group	Mitre Attack
Spawns processes	System Summary	Process Injection
URLs found in memory or binary data	Networking

C:\Windows\System32\msiexec.exe

C:\Windows\system32\msiexec.exe /V

Details

Is windows:	true
Is dropped:	false
PID:	6920
Target ID:	2
Parent PID:	632
Name:	msiexec.exe
Class:	system-tools
Path:	C:\Windows\System32\msiexec.exe
Commandline:	C:\Windows\system32\msiexec.exe /V
Size:	69632
MD5:	E5DA170027542E25EDE42FC54C929077
Time:	14:05:08
Date:	25/04/2024
Reason:	newprocess
Reputation:	high
Is admin:	true
Is elevated:	true
Modulebase:	0x7ff601e20000
Modulesize:	94208
Wow64:	false

Signature Hits	Behavior Group	Mitre Attack
Spawns processes	System Summary	Process Injection
URLs found in memory or binary data	Networking

C:\Windows\SysWOW64\msiexec.exe

C:\Windows\syswow64\MsiExec.exe -Embedding E85D5D35B24865A3B7876DC8C57EC5ED C

Details

Is windows:	true
Is dropped:	false
PID:	5788
Target ID:	3
Parent PID:	6920
Name:	msiexec.exe
Class:	system-tools
Path:	C:\Windows\SysWOW64\msiexec.exe
Commandline:	C:\Windows\syswow64\MsiExec.exe -Embedding E85D5D35B24865A3B7876DC8C57EC5ED C
Size:	59904
MD5:	9D09DC1EDA745A5F87553048E57620CF
Time:	14:05:08
Date:	25/04/2024
Reason:	newprocess
Reputation:	high
Is admin:	true
Is elevated:	true
Modulebase:	0x8a0000
Modulesize:	73728
Wow64:	true

Signature Hits	Behavior Group	Mitre Attack
Spawns processes	System Summary	Process Injection
URLs found in memory or binary data	Networking

URLs

Name

Malicious

http://www.inclusive.comAI_UNINSTALLERmsiexec.exeDialogBitmapdialogALLUSERS1ButtonText_Yes&S

unknown

https://www.thawte.com/cps0/

unknown

https://www.thawte.com/repository0W

unknown

http://www.advancedinstaller.com0

unknown

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

IOC Report
atencion_y_estimulacion_visual.msi

Files

Processes

URLs

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

IOC Reportatencion_y_estimulacion_visual.msi

Files

Processes

URLs

IOC Report
atencion_y_estimulacion_visual.msi