Play interactive tour

Edit tour

Analysis Report notifica2104.msi

Overview

General Information

Sample Name:	notifica2104.msi
Analysis ID:	395218
MD5:	37261a4c059499f3d379f539834b8990
SHA1:	1c06fb8a5bf94db2782bf49e080eacc25e740d7c
SHA256:	f3316d7cef4978eb334264f709301d6616089abd6272c675228614a6407ed629
Infos:
Most interesting Screenshot:

Detection

Score:	2
Range:	0 - 100
Whitelisted:	false
Confidence:	60%

Signatures

Checks for available system drives (often done to infect USB drives)

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Tries to load missing DLLs

Classification

Analysis Advice

Sample is looking for USB drives. Launch the sample with the USB Fake Disk cookbook

Sample tries to load a library which is not present or installed on the analysis machine, adding the library might reveal more behavior

Startup

System is w10x64

msiexec.exe (PID: 6560 cmdline: 'C:\Windows\System32\msiexec.exe' /i 'C:\Users\user\Desktop\notifica2104.msi' MD5: 4767B71A318E201188A0D0A420C8B608)

msiexec.exe (PID: 6616 cmdline: C:\Windows\syswow64\MsiExec.exe -Embedding 62996ADAF98AEA6C3E76201DA1491D0F MD5: 12C17B5A5C2A7B97342C362CA467E9A2)

cleanup

Malware Configuration

No configs have been found

Yara Overview

No yara matches

Sigma Overview

No Sigma rule has matched

Signature Overview

Click to jump to signature section

Show All Signature Results

There are no malicious signatures, click here to show all signatures.

Source:	Binary string: C:\JobRelease\win\Release\custact\x86\FileOperations.pdb` source: notifica2104.msi
Source:	Binary string: C:\JobRelease\win\Release\custact\x86\AICustAct.pdb^ source: notifica2104.msi
Source:	Binary string: C:\JobRelease\win\Release\custact\x86\FileOperations.pdb source: notifica2104.msi
Source:	Binary string: C:\JobRelease\win\Release\custact\x86\AICustAct.pdb source: notifica2104.msi

Source: C:\Windows\System32\msiexec.exe	File opened: z:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: x:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: v:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: t:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: r:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: p:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: n:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: l:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: j:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: h:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: f:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: b:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: y:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: w:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: u:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: s:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: q:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: o:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: m:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: k:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: i:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: g:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: e:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: c:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: a:	Jump to behavior

Source: msiexec.exe, 00000000.00000003.227511962.000001BC85B50000.00000004.00000001.sdmp	String found in binary or memory: http://conlazionzzytz.eastus.cloudapp.azure.com/64bits.php
Source: notifica2104.msi	String found in binary or memory: http://conlazionzzytz.eastus.cloudapp.azure.com/64bits.php(VersionNT64)SecureCustomPropertiesOLDPROD
Source: msiexec.exe, 00000000.00000003.227479172.000001BC85B5F000.00000004.00000001.sdmp	String found in binary or memory: http://conlazionzzytz.eastus.cloudapp.azure.com/64bits.php-
Source: notifica2104.msi	String found in binary or memory: http://s.symcb.com/universal-root.crl0
Source: notifica2104.msi	String found in binary or memory: http://s.symcd.com06
Source: notifica2104.msi	String found in binary or memory: http://t1.symcb.com/ThawtePCA.crl0
Source: notifica2104.msi	String found in binary or memory: http://t2.symcb.com0
Source: notifica2104.msi	String found in binary or memory: http://tl.symcb.com/tl.crl0
Source: notifica2104.msi	String found in binary or memory: http://tl.symcb.com/tl.crt0
Source: notifica2104.msi	String found in binary or memory: http://tl.symcd.com0&
Source: notifica2104.msi	String found in binary or memory: http://ts-aia.ws.symantec.com/sha256-tss-ca.cer0(
Source: notifica2104.msi	String found in binary or memory: http://ts-crl.ws.symantec.com/sha256-tss-ca.crl0
Source: notifica2104.msi	String found in binary or memory: http://ts-ocsp.ws.symantec.com0;
Source: notifica2104.msi	String found in binary or memory: http://www.winimage.com/zLibDll
Source: notifica2104.msi	String found in binary or memory: http://www.winimage.com/zLibDll1.2.7rbr
Source: notifica2104.msi	String found in binary or memory: https://d.symcb.com/cps0%
Source: notifica2104.msi	String found in binary or memory: https://d.symcb.com/rpa0
Source: notifica2104.msi	String found in binary or memory: https://d.symcb.com/rpa0.
Source: notifica2104.msi	String found in binary or memory: https://www.advancedinstaller.com
Source: notifica2104.msi	String found in binary or memory: https://www.thawte.com/cps0/
Source: notifica2104.msi	String found in binary or memory: https://www.thawte.com/repository0W

Source: notifica2104.msi	Binary or memory string: OriginalFilenameAICustAct.dllF vs notifica2104.msi
Source: notifica2104.msi	Binary or memory string: OriginalFilenameFileOperations.dllF vs notifica2104.msi

Source: C:\Windows\System32\msiexec.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: tsappcmp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: sfc.dll	Jump to behavior

Source: classification engine

Classification label: clean2.winMSI@2/1@0/0

Source: C:\Windows\System32\msiexec.exe

File created: C:\Users\user\AppData\Local\Temp\MSIe9f32.LOG

Jump to behavior

Source: C:\Windows\System32\msiexec.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: C:\Windows\SysWOW64\msiexec.exe	File read: C:\Windows\System32\drivers\etc\hosts			Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	File read: C:\Windows\System32\drivers\etc\hosts			Jump to behavior

Source: notifica2104.msi

Static file information: TRID: Microsoft Windows Installer (77509/1) 52.18%

Source: unknown	Process created: C:\Windows\System32\msiexec.exe 'C:\Windows\System32\msiexec.exe' /i 'C:\Users\user\Desktop\notifica2104.msi'
Source: unknown	Process created: C:\Windows\SysWOW64\msiexec.exe C:\Windows\syswow64\MsiExec.exe -Embedding 62996ADAF98AEA6C3E76201DA1491D0F

Source: C:\Windows\System32\msiexec.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{000C103E-0000-0000-C000-000000000046}\InProcServer32

Jump to behavior

Source:	Binary string: C:\JobRelease\win\Release\custact\x86\FileOperations.pdb` source: notifica2104.msi
Source:	Binary string: C:\JobRelease\win\Release\custact\x86\AICustAct.pdb^ source: notifica2104.msi
Source:	Binary string: C:\JobRelease\win\Release\custact\x86\FileOperations.pdb source: notifica2104.msi
Source:	Binary string: C:\JobRelease\win\Release\custact\x86\AICustAct.pdb source: notifica2104.msi

Source: C:\Windows\System32\msiexec.exe

Registry key monitored for changes: HKEY_CURRENT_USER_Classes

Jump to behavior

Source: C:\Windows\System32\msiexec.exe

Process information set: NOOPENFILEERRORBOX

Jump to behavior

Source: C:\Windows\System32\msiexec.exe

File Volume queried: C:\ FullSizeInformation

Jump to behavior

Source: msiexec.exe, 00000001.00000002.250323950.0000000004860000.00000002.00000001.sdmp	Binary or memory string: A Virtual Machine could not be started because Hyper-V is not installed.
Source: msiexec.exe, 00000001.00000002.250323950.0000000004860000.00000002.00000001.sdmp	Binary or memory string: A communication protocol error has occurred between the Hyper-V Host and Guest Compute Service.
Source: msiexec.exe, 00000001.00000002.250323950.0000000004860000.00000002.00000001.sdmp	Binary or memory string: The communication protocol version between the Hyper-V Host and Guest Compute Services is not supported.
Source: msiexec.exe, 00000001.00000002.250323950.0000000004860000.00000002.00000001.sdmp	Binary or memory string: An unknown internal message was received by the Hyper-V Compute Service.

Source: C:\Windows\System32\msiexec.exe

Queries volume information: C:\ VolumeInformation

Jump to behavior

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Replication Through Removable Media1	Windows Management Instrumentation	DLL Side-Loading1	Process Injection1	Process Injection1	OS Credential Dumping	Query Registry1	Replication Through Removable Media1	Data from Local System	Exfiltration Over Other Network Medium	Data Obfuscation	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	Modify System Partition
Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	DLL Side-Loading1	DLL Side-Loading1	LSASS Memory	Security Software Discovery1	Remote Desktop Protocol	Data from Removable Media	Exfiltration Over Bluetooth	Junk Data	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	At (Linux)	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information	Security Account Manager	Peripheral Device Discovery11	SMB/Windows Admin Shares	Data from Network Shared Drive	Automated Exfiltration	Steganography	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	At (Windows)	Logon Script (Mac)	Logon Script (Mac)	Binary Padding	NTDS	System Information Discovery12	Distributed Component Object Model	Input Capture	Scheduled Transfer	Protocol Impersonation	SIM Card Swap		Carrier Billing Fraud
Cloud Accounts	Cron	Network Logon Script	Network Logon Script	Software Packing	LSA Secrets	Remote System Discovery1	SSH	Keylogging	Data Transfer Size Limits	Fallback Channels	Manipulate Device Communication		Manipulate App Store Rankings or Ratings

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading ...

Warning!

Analysis Report notifica2104.msi

Overview

General Information

Detection

Signatures

Classification

Analysis Advice

Startup

Malware Configuration

Yara Overview

Sigma Overview

Signature Overview

Compliance:

Spreading:

Networking:

System Summary:

Hooking and other Techniques for Hiding and Protection:

Malware Analysis System Evasion:

Language, Device and Operating System Detection:

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails