24:I[7638,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/3l_wb6il5gi_h.js","/_next/static/chunks/136wug8odqdqr.js"],"SampleDetailWrapper"] 31:I[27201,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js"],"IconMark"] 23:T419,{"@context":"https://schema.org","@type":"TechArticle","headline":"Suspicious Sample a478c27db33c… — Score 67/100 — Hybrid Analysis","description":"Suspicious verdict for sample a478c27db33c…. Threat score 67/100. 0/27 AV engines flagged this file. 1 malicious and 8 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/a478c27db33ca5a9fee798a20f662922910fe74955016d692fa81dee9dad78cf","keywords":["Suspicious","malware analysis","sandbox report","threat intelligence","a478c27db33ca5a9fee798a20f662922910fe74955016d692fa81dee9dad78cf"],"about":{"@type":"SoftwareApplication","name":"Boom3D.msi","applicationCategory":["msi","data"],"identifier":"a478c27db33ca5a9fee798a20f662922910fe74955016d692fa81dee9dad78cf","additionalType":"Suspicious sample"},"threatScore":67,"antivirusDetections":{"malicious":0,"total":27},"behavioralIndicators":{"malicious":1,"suspicious":8},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}25:T7ad,"msiexec.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLS"; Key: "") "msiexec.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLS"; Key: "") "msiexec.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES"; Key: "") "msiexec.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED"; Key: "") "msiexec.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS"; Key: "") "msiexec.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS"; Key: "") "msiexec.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES"; Key: "") "msiexec.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA"; Key: "") "msiexec.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS"; Key: "") "msiexec.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS"; Key: "") "msiexec.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES"; Key: "") "msiexec.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA"; Key: "") "msiexec.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES"; Key: "") "msiexec.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED"; Key: "") "msiexec.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLS"; Key: "") "msiexec.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLS"; Key: "") "msiexec.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CTLS"; Key: "") "msiexec.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CRLS"; Key: "") "msiexec.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CERTIFICATES"; Key: "") "msiexec.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT"; Key: "")26:T4a1,"msiexec.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\5AEAEE3F7F2A9449CEBAFEEC68FDD184F20124A7"; Key: "BLOB") "msiexec.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\902EF2DEEB3C5B13EA4C3D5193629309E231AE55"; Key: "BLOB") "msiexec.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\C86EDBC71AB05078F61ACDF3D8DC5DB61EB75FB6"; Key: "BLOB") "msiexec.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES\1916A2AF346D399F50313C393200F14140456616"; Key: "BLOB") "msiexec.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES\2A83E9020591A55FC6DDAD3FB102794C52B24E70"; Key: "BLOB") "msiexec.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES\2B84BFBB34EE2EF949FE1CBE30AA026416EB2216"; Key: "BLOB") "msiexec.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES"; Key: "") "msiexec.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES\305F8BD17AA2CBC483A4C41B19A39A0C75DA39D6"; Key: "BLOB") "msiexec.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED"; Key: "")27:T4553,"NameTableTypeColumn_ValidationIdentifierNString categoryText;Formatted;Template;Condition;Guid;Path;Version;Language;Identifier;Binary;UpperCase;LowerCase;Filename;Paths;AnyPath;WildCardFilename;RegPath;KeyFormatted;CustomSource;Property;Cabinet;Shortcut;URLYDescriptionSetCategoryKeyColumnKeyTableMaxValueMinValueNullableName of columnTextDescription of columnColumn to which foreign key connectsFor foreign key, Name of table to which data must linkMaximum value allowedMinimum value allowedY;N;@Whether the column is nullableSet of values that are permittedName of tableActionTextActionName of action to be described.Localized description displayed in progress dialog and log when action is executing.TemplateOptional localized format template used to format action data records for display during action execution.AdminExecuteSequenceName of action to invoke, either in the engine or the handler DLL.ConditionOptional expression which skips the action if evaluates to expFalse.If the expression syntax is invalid, the en" (Indicator: "connect") in Source: a478c27db33ca5a9fee798a20f662922910fe74955016d692fa81dee9dad78cf.msi.bin "eature table.LevelNew selection Level to set in Feature table if Condition evaluates to TRUE.ControlName of the control. This name must be unique within a dialog, but can repeat on different dialogs. Control_NextThe name of an other control on the same dialog. This link defines the tab order of the controls. The links have to form one or more cycles!Dialog_DialogExternal key to the Dialog table, name of the dialog.HelpThe help strings used with the button. The text is optional. The name of a defined property to be linked to this control. ControlConditionDefault;Disable;Enable;Hide;ShowThe desired action to be taken on the specified control.A standard conditional statement that specifies under which conditions the action should be triggered.Control_A foreign key to the Control table, name of the control.A foreign key to the Dialog table, name of the dialog.ControlEventA value to be used as a modifier when triggering a particular event.A standard conditional statement that specifies under which conditions an ev" (Indicator: "select") in Source: a478c27db33ca5a9fee798a20f662922910fe74955016d692fa81dee9dad78cf.msi.bin "c display ordering.Primary key used to identify a particular feature record.Feature_ParentOptional key of a parent record in the same table. If the parent is not selected, then the record will not be installed. Null indicates a root item.The install level at which record will be initially selected. An install level of 0 will disable an item and prevent its display.Short text identifying a visible feature item.FeatureComponentsForeign key into Component table.Foreign key into Feature table.Integer containing bit flags representing file attributes (with the decimal value of each bit position in parentheses)Foreign key referencing Component that controls the file.Primary key, non-localized token, must match identifier in cabinet. For uncompressed files, this field is ignored.FileNameFile name used for installation, may be localized. This may contain a "short name|long name" pair.FileSizeSize of file in bytes (long integer).LanguageList of decimal language Ids, comma-separated if more than one.Sequence with res" (Indicator: "select") in Source: a478c27db33ca5a9fee798a20f662922910fe74955016d692fa81dee9dad78cf.msi.bin "gnatureDefault language ID for module (may be changed by transform).ModuleIDModule containing the component.ModuleDependencyModule requiring the dependency.ModuleLanguageLanguage of module requiring the dependency.RequiredIDString.GUID of required module.RequiredLanguageLanguageID of the required module.RequiredVersionVersion of the required version.ModuleExclusionExcludedIDString.GUID of excluded module.ExcludedLanguageLanguage of excluded module.ExcludedMaxVersionMaximum version of excluded module.ExcludedMinVersionMinimum version of excluded module.String.GUID of module with exclusion requirement.LanguageID of module with exclusion requirement.Default decimal language of module.Module identifier (String.GUID).Version of the module.MoveFileIf this component is not "selected" for installation or removal, no action will be taken on the associated MoveFile entryName of a property whose value is assumed to resolve to the full path to the destination directoryName to be given to the original file after it is mov" (Indicator: "select") in Source: a478c27db33ca5a9fee798a20f662922910fe74955016d692fa81dee9dad78cf.msi.bin "peType of the serviceStartNameUser or object name to run service asStartTypeCatalogSFP CatalogDependencyParent catalog - only used by SFPFile name for the catalog.ShortcutThe command-line arguments for the shortcut.Foreign key into the Component table denoting the component whose selection gates the the shortcut creation/deletion.The description for the shortcut.Foreign key into the Directory table denoting the directory where the shortcut file is created.HotkeyThe hotkey for the shortcut. It has the virtual-key code for the key in the low-order byte, and the modifier flags in the high-order byte. Foreign key into the File table denoting the external icon file for the shortcut.The icon index for the shortcut.The name of the shortcut to be created.ShowCmd1;3;7The show command for the application window.The following values may be used.The shortcut target. This is usually a property that is expanded to a file or a folder that the shortcut points to.WkDirName of property defining location of working directory.Si" (Indicator: "select") in Source: a478c27db33ca5a9fee798a20f662922910fe74955016d692fa81dee9dad78cf.msi.bin " " (Indicator: "bind") in Source: a478c27db33ca5a9fee798a20f662922910fe74955016d692fa81dee9dad78cf.msi.bin " " (Indicator: "bind") in Source: a478c27db33ca5a9fee798a20f662922910fe74955016d692fa81dee9dad78cf.msi.bin "IsWow64Process" (Indicator: "IsWow64Process") in Source: a478c27db33ca5a9fee798a20f662922910fe74955016d692fa81dee9dad78cf.msi.bin "FlsGetValue" (Indicator: "FlsGetValue") in Source: a478c27db33ca5a9fee798a20f662922910fe74955016d692fa81dee9dad78cf.msi.bin28:T47e,The input sample is signed with a certificate issued by "SERIALNUMBER=045222, OID.1.3.6.1.4.1.311.60.2.1.3=IN, OID.2.5.4.15=Private Organization, C=IN, S=Karnataka, O=Global Delight Technologies Private Limited, CN=Global Delight Technologies Private Limited" (SHA1: 9E:7F:50:4E:0F:E8:E2:E3:37:40:36:2A:BC:81:78:E1:76:5A:D1:4F: (1.2.840.113549.1.1.11); see report for more information) The input sample is signed with a certificate issued by "C=GB, O=Sectigo Limited, CN=Sectigo Public Code Signing CA EV R36" (SHA1: 01:85:FF:99:61:FF:0A:A2:E4:31:81:79:48:C2:8E:83:D3:F3:EC:70: (1.2.840.113549.1.1.12); see report for more information) The input sample is signed with a certificate issued by "C=GB, O=Sectigo Limited, CN=Sectigo Public Code Signing Root R46" (SHA1: 32:9B:78:A5:C9:EB:C2:04:32:42:DE:90:CE:1B:7C:6B:1B:A6:C6:92: (1.2.840.113549.1.1.12); see report for more information) The input sample is signed with a certificate issued by "C=GB, S=Greater Manchester, L=Salford, O=Comodo CA Limited, CN=AAA Certificate Services" (SHA1: D1:EB:23:A4:6D:17:D6:8F:D9:25:64:C2:F1:F1:60:17:64:D8:E3:49: (sha1RSA(RSA)); see report for more information)29:T669,"Cab4BD0.tmp" has type "Microsoft Cabinet archive data 61480 bytes 1 file"- Location: [%TEMP%\Cab4BD0.tmp] "77EC63BDA74BD0D0E0426DC8F8008506" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506] "18E6B4A57A6BC7EC9B861CDF2D6D0D02_EF52C1EC85F21F31CC0157A5C8803013" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\MetaData\18E6B4A57A6BC7EC9B861CDF2D6D0D02_EF52C1EC85F21F31CC0157A5C8803013] "3AA0DCD5A74331FBD6F344550EC48B87_5732EC2A70C607BA73FCF995F888DAF1" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\MetaData\3AA0DCD5A74331FBD6F344550EC48B87_5732EC2A70C607BA73FCF995F888DAF1] "Tar4BD1.tmp" has type "data"- Location: [%TEMP%\Tar4BD1.tmp] "57C8EDB95DF3F0AD4EE2DC2B8CFD4157" has type "Microsoft Cabinet archive data 4817 bytes 1 file"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157] "MSI64A9.tmp" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\MSI64A9.tmp] "B2FAF7692FD9FFBD64EDE317E42334BA_93702E680A5530C052C8D2BA33A2225F" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\B2FAF7692FD9FFBD64EDE317E42334BA_93702E680A5530C052C8D2BA33A2225F] "77EC63BDA74BD0D0E0426DC8F8008506" has type "Microsoft Cabinet archive data 61480 bytes 1 file"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506] "57C8EDB95DF3F0AD4EE2DC2B8CFD4157" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157]2a:T4c3,"msiexec.exe" monitors "\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NetworkProvider\HwOrder" (Filter: 4; Subtree: 131072) "msiexec.exe" monitors "\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\WinSock2\Parameters\Protocol_Catalog9" (Filter: 1; Subtree: 0) "msiexec.exe" monitors "\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\WinSock2\Parameters\NameSpace_Catalog5" (Filter: 1; Subtree: 0) "msiexec.exe" monitors "\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\WinSock2\Parameters\Protocol_Catalog9" (Filter: 1; Subtree: 2565438720) "msiexec.exe" monitors "\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot" (Filter: 5; Subtree: 1994588929) "msiexec.exe" monitors "\REGISTRY\USER\S-1-5-21-686412048-2446563785-1323799475-1001\Software\Microsoft\SystemCertificates\TrustedPublisher" (Filter: 5; Subtree: 1) "msiexec.exe" monitors "\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\TrustedPublisher" (Filter: 5; Subtree: 1) "msiexec.exe" monitors "\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\crypt32" (Filter: 4; Subtree: 65536) "msiexec.exe" monitors "\REGISTRY\USER\S-1-5-21-686412048-2446563785-1323799475-1001\Software\Microsoft\SystemCertificates\Root" (Filter: 5; Subtree: 1)2b:T545,"msiexec.exe" touched file "C:\Windows\AppPatch\msimain.sdb" "msiexec.exe" touched file "C:\Windows\system32\ar-SA\sxs.DLL.mui" "msiexec.exe" touched file "C:\Windows\system32\bg-BG\sxs.DLL.mui" "msiexec.exe" touched file "C:\Windows\system32\cs-CZ\sxs.DLL.mui" "msiexec.exe" touched file "C:\Windows\system32\da-DK\sxs.DLL.mui" "msiexec.exe" touched file "C:\Windows\system32\de-DE\sxs.DLL.mui" "msiexec.exe" touched file "C:\Windows\system32\el-GR\sxs.DLL.mui" "msiexec.exe" touched file "C:\Windows\system32\en\sxs.DLL.mui" "msiexec.exe" touched file "C:\Windows\system32\es-ES\sxs.DLL.mui" "msiexec.exe" touched file "C:\Windows\system32\et-EE\sxs.DLL.mui" "msiexec.exe" touched file "C:\Windows\system32\fi-FI\sxs.DLL.mui" "msiexec.exe" touched file "C:\Windows\system32\fr-FR\sxs.DLL.mui" "msiexec.exe" touched file "C:\Windows\system32\he-IL\sxs.DLL.mui" "msiexec.exe" touched file "C:\Windows\system32\hr-HR\sxs.DLL.mui" "msiexec.exe" touched file "C:\Windows\system32\hu-HU\sxs.DLL.mui" "msiexec.exe" touched file "C:\Windows\system32\it-IT\sxs.DLL.mui" "msiexec.exe" touched file "C:\Windows\system32\ja-JP\sxs.DLL.mui" "msiexec.exe" touched file "C:\Windows\system32\ko-KR\sxs.DLL.mui" "msiexec.exe" touched file "C:\Windows\system32\lt-LT\sxs.DLL.mui" "msiexec.exe" touched file "C:\Windows\system32\lv-LV\sxs.DLL.mui"2c:T870,Heuristic match: "peType of the serviceStartNameUser or object name to run service asStartTypeCatalogSFP CatalogDependencyParent catalog - only used by SFPFile name for the catalog.ShortcutThe command-line arguments for the shortcut.Foreign key into the Component table deno" Pattern match: "https://www.globaldelight.com/}}{\fldrslt" Heuristic match: "i}2[9=^.gW" Heuristic match: "J3jV8E.cI" Pattern match: "crl.comodoca.com/AAACertificateServices.crl04" Pattern match: "http://ocsp.comodoca.com0" Pattern match: "http://crl.sectigo.com/SectigoPublicCodeSigningRootR46.crl0" Pattern match: "http://crt.sectigo.com/SectigoPublicCodeSigningRootR46.p7c0#" Pattern match: "http://ocsp.sectigo.com0" Pattern match: "http://crl.usertrust.com/USERTrustRSACertificationAuthority.crl0v" Pattern match: "crt.usertrust.com/USERTrustRSAAddTrustCA.crt0%" Pattern match: "http://ocsp.usertrust.com0" Pattern match: "https://sectigo.com/CPS0D" Pattern match: "crl.sectigo.com/SectigoRSATimeStampingCA.crl0t" Pattern match: "crt.sectigo.com/SectigoRSATimeStampingCA.crt0#" Pattern match: "https://sectigo.com/CPS0" Pattern match: "http://crl.sectigo.com/SectigoPublicCodeSigningCAEVR36.crl0" Pattern match: "http://crt.sectigo.com/SectigoPublicCodeSigningCAEVR36.crt0#" Pattern match: "http://ocsp.sectigo.com0@" Heuristic match: "ocsp.sectigo.com" Heuristic match: "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSdE3gf41WAic8Uh9lF92%2BIJqh5qwQUMuuSmv81lkgvKEBCcCA2kVwXheYCEDPXCKiRQFMZ4qW70zm5rW4%3D HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: ocsp.sectigo.com" Heuristic match: "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBRd0JozUYXMqqW4y4zJTrLcMCRSkAQUgTKSQSsozUbIxKLGKjkS7EipPxQCEAPe3DWx05c0Xw3KxjTWbR0%3D HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: ocsp.sectigo.com" Pattern match: "C.JgU/0$" Pattern match: "crl.microsoft.com/pki/crl/products/MicCerLisCA2011_2011-03-29.crl0]+Q0O0M+0Ahttp://www.microsoft.com/pki/certs/MicCerLisCA2011_2011-03-29.crt0U00" Pattern match: "crl.microsoft.com/pki/crl/products/MicRooCerAut_2010-06-23.crl0Z+N0L0J+0" Pattern match: "www.microsoft.com0"2d:T46a,"and conditions, please write to the Company at info@globaldelight.com <{\field{\*\fldinst{HYPERLINK "mailto:info@globaldelight.com"}}{\fldrslt mailto:info@globaldelight.com}}> or visit our Website <{\field{\*\fldinst{HYPERLINK "https://www.globaldelight.com/"}}{\fldrslt https://www.globaldelight.com/}}> for contact information. \ \ \pard\pardeftab720\qc\partightenfactor0 \cf0 Copyright \'a9 2008-2021, Global Delight Technologies Pvt. Ltd. All rights reserved.\ }ScrollableTextLicenseText{\VSI_MS_Sans_Serif16.0_1_0}License Agreement{\VSI_MS_Sans_Serif13.0_0_0}Please take a moment to read the license agreement now. If you accept the terms below, click "I Agree", then "Next". Otherwise click "Cancel".EulaForm_Property<>"Yes"DisableEulaForm_Property="Yes"EnableEulaForm_PrevArgs=""EulaForm_PrevArgs<>""EulaForm_NextArgs<>""[EulaForm_NextArgs]NewDialogEulaForm_NextArgs=""[EulaForm_PrevArgs]EnabledEulaEvent{\VSI_MS_Sans_Serif13.0_0_0}I &Do Not Agree{\VSI_MS_Sans_Serif13.0_0_0}I &AgreeYesCustomCheckC_SetProperty_CH" (Indicator: "https://") in Source: a478c27db33ca5a9fee798a20f662922910fe74955016d692fa81dee9dad78cf.msi.bin2e:T8c5,"msiexec.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLS") "msiexec.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLS") "msiexec.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES") "msiexec.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED") "msiexec.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS") "msiexec.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS") "msiexec.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES") "msiexec.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA") "msiexec.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS") "msiexec.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS") "msiexec.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES") "msiexec.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA") "msiexec.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES") "msiexec.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED") "msiexec.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLS") "msiexec.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLS") "msiexec.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CTLS") "msiexec.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CRLS") "msiexec.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CERTIFICATES") "msiexec.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT")2f:T70e,"msiexec.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "msiexec.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "msiexec.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LOCALE"; Key: "00000409") "msiexec.exe" (Path: "HKCU\CONTROL PANEL\INTERNATIONAL"; Key: "LOCALENAME") "msiexec.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "SPOOL") "msiexec.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "WINRM") "msiexec.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "WINEVT") "msiexec.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "WINDOWSPOWERSHELL") "msiexec.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "WINBIOPLUGINS") "msiexec.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "WINBIODATABASE") "msiexec.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "WFP") "msiexec.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "WDI") "msiexec.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "WCN") "msiexec.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "WBEM") "msiexec.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "WAT") "msiexec.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "TASKS") "msiexec.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "SYSPREP") "msiexec.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "SPPUI") "msiexec.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "SPP") "msiexec.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "SPEECH")30:T7ec,Found malicious artifacts related to "104.18.32.68": ... URL: http://ocsp.comodoca.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBRXzFDqgcxizGsL1BkUc1gIwekZcAQU34/zIAzpyqYE2FtYNyo9q0bcg0kCEG6jE0M89ZkFTTX8Zr2sMEE= (AV positives: 1/92 scanned on 05/13/2022 15:02:24) URL: http://crl.sectigo.com/SectigoRSATimeStampingCA.crl (AV positives: 1/92 scanned on 05/13/2022 13:46:29) URL: http://104.18.32.68/ (AV positives: 1/92 scanned on 05/13/2022 11:22:31) URL: http://ocsp.comodoca.com/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBRXzFDqgcxizGsL1BkUc1gIwekZcAQU34/zIAzpyqYE2FtYNyo9q0bcg0kCEQDUHYP0eSM4hhiYODvO/w4S (AV positives: 1/92 scanned on 05/12/2022 07:14:55) URL: http://ocsp.comodoca.com/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBSSdxXdG447ymkRNPVViULv3rkBzQQUKZFg/4pN+uv5pmq4z/nmS71JzhICEQCvuzt/ymIzw5DtLx/uH2nO (AV positives: 1/92 scanned on 05/11/2022 11:23:35) File SHA256: 0a35b0e0112fc3ffb7fb29e2f7afa092ae3b5932ff8e79c7a9b5365ad5e08013 (Date: 05/12/2022 17:15:18) File SHA256: a45ebb3340191fd44261c7179641aea436b673ce74af805b67b6519579db9b0e (Date: 05/09/2022 18:48:16) File SHA256: b545cfdfe40c338449038dbcaeb37f3aeddb909774dd8646518f76701f0fc535 (Date: 05/09/2022 17:43:06) File SHA256: 067be5af68551f7e3976abe4b5df596d1f8fde173d0a367ba32a76755e40db17 (Date: 05/09/2022 17:23:02) File SHA256: 537ef49be3daca7fe20429eaae069259f856745125c68a854327cd525ab7e852 (Date: 05/09/2022 17:08:20) File SHA256: ee5d444d2829e2f9cfc90756f94149f85514b3766615fd081b722c6587c331d8 (AV positives: 24/76 scanned on 08/13/2020 17:37:39) File SHA256: 09beb0353a1dd50585062539afaa03adb9e6606e389cb425fab2c19c8d1c0d40 (AV positives: 8/74 scanned on 04/16/2020 20:18:28) File SHA256: 512fa645ab48d14e1e2ad8995e7473a1d0aae4301df305599752dcea74a5db96 (AV positives: 28/75 scanned on 04/12/2020 00:41:00) File SHA256: 4b9fd57d275ed12face119f421f0397e1465937b736581ab576fd08a09acf140 (AV positives: 24/70 scanned on 02/25/2020 12:06:19) File SHA256: e99d3b66766c8a5134ed4512d8019a9e73635919538a11a73b7f6bd09bcce4fb (AV positives: 22/75 scanned on 02/11/2020 20:16:14)1b:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$23"}}],["$","$L24",null,{"initialData":{"schema_version":"1.0.15","sha256":"a478c27db33ca5a9fee798a20f662922910fe74955016d692fa81dee9dad78cf","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"NOT_AVAILABLE","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"suspicious","threat_score":67,"unified_at_epoch_ms":1790637186788,"unified_at":"2026-09-28T23:13:06.788Z","metadata":{"hashes":{"sha256":"a478c27db33ca5a9fee798a20f662922910fe74955016d692fa81dee9dad78cf","sha1":"cc46c4e4113ba72c085be3f8e12b2c4cafd3b357","md5":"a238efa2ffa19b2549569846f3e28ec1","sha512":"b8ce2ce546cacb20258427d19f7834e80a6d8d5d0368805d9c79d56f36647380e5deb00f7344bde2b4c8809d0feaed8f84d515e4e67c6f7778f3737b0b12bf21","ssdeep":"786432:wM+ugjXitTRqKvDUovm3MZLC1y9j99yE5JkeJ:ajjXitRqKLUov5LwyV9jz","ssdeep_chunks":["786432:wM+ugjX","786432:M+ugjXi","786432:+ugjXit","786432:ugjXitT","786432:gjXitTR","786432:jXitTRq","786432:XitTRqK","786432:itTRqKv","786432:tTRqKvD","786432:TRqKvDU","786432:RqKvDUo","786432:qKvDUov","786432:KvDUovm","786432:vDUovm3","786432:DUovm3M","786432:Uovm3MZ","786432:ovm3MZL","786432:vm3MZLC","786432:m3MZLC1","786432:3MZLC1y","786432:MZLC1y9","786432:ZLC1y9j","786432:LC1y9j9","786432:C1y9j99","786432:1y9j99y","786432:y9j99yE","786432:9j99yE5","786432:j99yE5J","786432:99yE5Jk","786432:9yE5Jke","786432:yE5JkeJ","1572864:wM+ugjX","1572864:M+ugjXi","1572864:+ugjXit","1572864:ugjXitT","1572864:gjXitTR","1572864:jXitTRq","1572864:XitTRqK","1572864:itTRqKv","1572864:tTRqKvD","1572864:TRqKvDU","1572864:RqKvDUo","1572864:qKvDUov","1572864:KvDUovm","1572864:vDUovm3","1572864:DUovm3M","1572864:Uovm3MZ","1572864:ovm3MZL","1572864:vm3MZLC","1572864:m3MZLC1","1572864:3MZLC1y","1572864:MZLC1y9","1572864:ZLC1y9j","1572864:LC1y9j9","1572864:C1y9j99","1572864:1y9j99y","1572864:y9j99yE","1572864:9j99yE5","1572864:j99yE5J","1572864:99yE5Jk","1572864:9yE5Jke","1572864:yE5JkeJ","786432:ajjXitR","786432:jjXitRq","786432:jXitRqK","786432:XitRqKL","786432:itRqKLU","786432:tRqKLUo","786432:RqKLUov","786432:qKLUov5","786432:KLUov5L","786432:LUov5Lw","786432:Uov5Lwy","786432:ov5LwyV","786432:v5LwyV9","786432:5LwyV9j","786432:LwyV9jz"],"imphash":"Unknown"},"file_info":{"file_name":"Boom3D.msi","file_type":["msi","data"],"file_type_id":"msi","file_size":32253440,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1652467046000,"last_seen":1676820469000,"last_multi_scan":1676820469000}},"detections":{"summary":{"verdict":"suspicious","score":67,"tags":null},"stats":{"av":{"malicious_count":0,"suspicious_count":0,"total_engines":27},"attributions":{"malware_families_count":0,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":12},"sandbox_signatures":{"informative_count":38,"suspicious_count":8,"malicious_count":1,"total":47},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"aegislab":{"name":"AegisLab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"ahnlab":{"name":"AhnLab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"clamav":{"name":"ClamAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"comodo":{"name":"Comodo","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"cyren":{"name":"Cyren","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"filseclab":{"name":"Filseclab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"kaspersky":{"name":"Kaspersky","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"mcafee":{"name":"McAfee","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"microsoftdefender":{"name":"Microsoft Defender","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"netgate":{"name":"NETGATE","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicro":{"name":"Trend Micro","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicrohousecall":{"name":"Trend Micro HouseCall","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"webrootsmd":{"name":"Webroot SMD","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{},"mitre_attacks":[{"tactic":"Privilege Escalation","technique":"Extra Window Memory Injection","attack_id":"T1055.011","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/011","identifiers":[{"type":"informative","value":"Scans for the windows taskbar (may be used for explorer injection)"},{"type":"informative","value":"Found a string that may be used as part of an injection method"}],"sources":[{"report_type":"sandbox","report_id":"627ea5605e47bd6d70235bda"}]},{"tactic":"Defense Evasion","technique":"Code Signing","attack_id":"T1553.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1553/002","identifiers":[{"type":"informative","value":"The input sample is signed with a valid certificate"},{"type":"informative","value":"The input sample is signed with a certificate"}],"sources":[{"report_type":"sandbox","report_id":"627ea5605e47bd6d70235bda"}]},{"tactic":"Defense Evasion","technique":"File Deletion","attack_id":"T1070.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/004","identifiers":[{"type":"informative","value":"Opens file with deletion access rights"},{"type":"informative","value":"Marks file for deletion"}],"sources":[{"report_type":"sandbox","report_id":"627ea5605e47bd6d70235bda"}]},{"tactic":"Defense Evasion","technique":"Modify Registry","attack_id":"T1112","attack_id_wiki":"https://attack.mitre.org/techniques/T1112","identifiers":[{"type":"informative","value":"Modifies Software Policy Settings"},{"type":"informative","value":"Accesses System Certificates Settings"},{"type":"informative","value":"Creates or modifies windows services"}],"sources":[{"report_type":"sandbox","report_id":"627ea5605e47bd6d70235bda"}]},{"tactic":"Credential Access","technique":"Credential API Hooking","attack_id":"T1056.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1056/004","identifiers":[{"type":"suspicious","value":"Installs hooks/patches the running process"}],"sources":[{"report_type":"sandbox","report_id":"627ea5605e47bd6d70235bda"}]},{"tactic":"Discovery","technique":"Peripheral Device Discovery","attack_id":"T1120","attack_id_wiki":"https://attack.mitre.org/techniques/T1120","identifiers":[{"type":"informative","value":"Queries volume information"},{"type":"informative","value":"Queries volume information of an entire harddrive"}],"sources":[{"report_type":"sandbox","report_id":"627ea5605e47bd6d70235bda"}]},{"tactic":"Discovery","technique":"Application Window Discovery","attack_id":"T1010","attack_id_wiki":"https://attack.mitre.org/techniques/T1010","identifiers":[{"type":"informative","value":"Scanning for window names"}],"sources":[{"report_type":"sandbox","report_id":"627ea5605e47bd6d70235bda"}]},{"tactic":"Discovery","technique":"Query Registry","attack_id":"T1012","attack_id_wiki":"https://attack.mitre.org/techniques/T1012","identifiers":[{"type":"informative","value":"Monitors specific registry key for changes"},{"type":"suspicious","value":"Reads the active computer name"},{"type":"suspicious","value":"Reads the windows installation language"},{"type":"informative","value":"Reads Windows Trust Settings"},{"type":"informative","value":"Accesses Software Policy Settings"},{"type":"informative","value":"Reads information about supported languages"}],"sources":[{"report_type":"sandbox","report_id":"627ea5605e47bd6d70235bda"}]},{"tactic":"Discovery","technique":"System Information Discovery","attack_id":"T1082","attack_id_wiki":"https://attack.mitre.org/techniques/T1082","identifiers":[{"type":"suspicious","value":"Reads the cryptographic machine GUID"},{"type":"informative","value":"Contains ability to read software policies"}],"sources":[{"report_type":"sandbox","report_id":"627ea5605e47bd6d70235bda"}]},{"tactic":"Discovery","technique":"File and Directory Discovery","attack_id":"T1083","attack_id_wiki":"https://attack.mitre.org/techniques/T1083","identifiers":[{"type":"suspicious","value":"Tries to access unusual system drive letters"}],"sources":[{"report_type":"sandbox","report_id":"627ea5605e47bd6d70235bda"}]},{"tactic":"Collection","technique":"Email Collection","attack_id":"T1114","attack_id_wiki":"https://attack.mitre.org/techniques/T1114","identifiers":[{"type":"suspicious","value":"Found a potential E-Mail address in binary/memory"}],"sources":[{"report_type":"sandbox","report_id":"627ea5605e47bd6d70235bda"}]},{"tactic":"Command and Control","technique":"Encrypted Channel","attack_id":"T1573","attack_id_wiki":"https://attack.mitre.org/techniques/T1573","identifiers":[{"type":"informative","value":"Possibly tries to communicate over SSL connection (HTTPS)"}],"sources":[{"report_type":"sandbox","report_id":"627ea5605e47bd6d70235bda"}]}],"sandbox_signatures":[{"level":"informative","category":"Environment Awareness","name":"Contains ability to read software policies","description":"\"msiexec.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\")\n \"msiexec.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"LEVELS\")\n \"msiexec.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"POLICYSCOPE\")\n \"msiexec.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"SAFERFLAGS\")\n \"msiexec.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"DEFAULTLEVEL\")\n \"msiexec.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"LOGFILENAME\")\n \"msiexec.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"AUTHENTICODEENABLED\")\n \"MsiExec.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":1,"id":"registry-78","sources":[{"report_type":"sandbox","report_id":"627ea5605e47bd6d70235bda"}]},{"level":"informative","category":"Environment Awareness","name":"Queries the installation properties of user installed products","description":"\"msiexec.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INSTALLER\\USERDATA\\S-1-5-18\\PRODUCTS\\8911938C22D4EAA4C8F26D723ADF10A8\\INSTALLPROPERTIES\")","origin":"Registry Access","relevance":10,"id":"registry-71","sources":[{"report_type":"sandbox","report_id":"627ea5605e47bd6d70235bda"}]},{"level":"informative","category":"Environment Awareness","name":"Queries volume information","description":"\"msiexec.exe\" queries volume information of \"C:\\\" at 00000000-00003972-00000046-2030550\n \"msiexec.exe\" queries volume information of \"C:\\\" at 00000000-00003220-00000046-17250079","origin":"API Call","mitre_attack_id":"T1120","relevance":2,"id":"api-11","sources":[{"report_type":"sandbox","report_id":"627ea5605e47bd6d70235bda"}]},{"level":"informative","category":"Environment Awareness","name":"Queries volume information of an entire harddrive","description":"\"msiexec.exe\" queries volume information of \"C:\\\" at 00000000-00003972-00000046-2030550\n \"msiexec.exe\" queries volume information of \"C:\\\" at 00000000-00003220-00000046-17250079","origin":"API Call","mitre_attack_id":"T1120","relevance":8,"id":"api-39","sources":[{"report_type":"sandbox","report_id":"627ea5605e47bd6d70235bda"}]},{"level":"informative","category":"External Systems","name":"Sample was identified as clean by Antivirus engines","description":"0/59 Antivirus vendors marked sample as malicious (0% detection rate)","origin":"External System","relevance":10,"id":"avtest-1","sources":[{"report_type":"sandbox","report_id":"627ea5605e47bd6d70235bda"}]},{"level":"informative","category":"General","name":"Accesses Software Policy Settings","description":"$25","origin":"Registry Access","mitre_attack_id":"T1012","relevance":10,"id":"registry-18","sources":[{"report_type":"sandbox","report_id":"627ea5605e47bd6d70235bda"}]},{"level":"informative","category":"General","name":"Accesses System Certificates Settings","description":"$26","origin":"Registry Access","mitre_attack_id":"T1112","relevance":10,"id":"registry-17","sources":[{"report_type":"sandbox","report_id":"627ea5605e47bd6d70235bda"}]},{"level":"informative","category":"General","name":"Contacts domains","description":"\"ocsp.sectigo.com\"","origin":"Network Traffic","relevance":1,"id":"network-0","sources":[{"report_type":"sandbox","report_id":"627ea5605e47bd6d70235bda"}]},{"level":"informative","category":"General","name":"Contacts server","description":"\"104.18.32.68:80\"","origin":"Network Traffic","relevance":1,"id":"network-1","sources":[{"report_type":"sandbox","report_id":"627ea5605e47bd6d70235bda"}]},{"level":"informative","category":"General","name":"Contains PDB pathways","description":"\"F:\\gx\\VS\\out\\binaries\\x86ret\\bin\\i386\\DPCA.pdb\"","origin":"File/Memory","relevance":1,"id":"string-7","sources":[{"report_type":"sandbox","report_id":"627ea5605e47bd6d70235bda"}]},{"level":"informative","category":"General","name":"Creates mutants","description":"\"\\Sessions\\1\\BaseNamedObjects\\Global\\MSILOG_76aba2841d866e9GOL.b467ISM_pmeT_lacoL_ataDppA_PMP5Hbh_sresU_:C\"\n \"Global\\MSILOG_76aba2841d866e9GOL.b467ISM_pmeT_lacoL_ataDppA_PMP5Hbh_sresU_:C\"","origin":"Created Mutant","relevance":3,"id":"mutant-0","sources":[{"report_type":"sandbox","report_id":"627ea5605e47bd6d70235bda"}]},{"level":"informative","category":"General","name":"Drops files marked as clean","description":"Antivirus vendors marked dropped file \"Tar4BD1.tmp\" as clean (type is \"data\")\n Antivirus vendors marked dropped file \"MSI64A9.tmp\" as clean (type is \"PE32 executable (DLL) (GUI) Intel 80386 for MS Windows\")","origin":"Binary File","relevance":10,"id":"binary-16","sources":[{"report_type":"sandbox","report_id":"627ea5605e47bd6d70235bda"}]},{"level":"informative","category":"General","name":"Found API related strings","description":"$27","origin":"File/Memory","relevance":1,"id":"string-101","sources":[{"report_type":"sandbox","report_id":"627ea5605e47bd6d70235bda"}]},{"level":"informative","category":"General","name":"Overview of unique CLSIDs touched in registry","description":"\"msiexec.exe\" touched \"Msi install server\" (Path: \"HKLM\\SOFTWARE\\CLASSES\\CLSID\\{000C101C-0000-0000-C000-000000000046}\\LOCALSERVER32\")\n \"msiexec.exe\" touched \"Microsoft Windows Installer Message RPC\" (Path: \"HKCU\\CLSID\\{000C101D-0000-0000-C000-000000000046}\\DLLVERSION\")\n \"msiexec.exe\" touched \"PSFactoryBuffer\" (Path: \"HKLM\\SOFTWARE\\CLASSES\\CLSID\\{000C103E-0000-0000-C000-000000000046}\\TREATAS\")","origin":"Registry Access","relevance":3,"id":"registry-72","sources":[{"report_type":"sandbox","report_id":"627ea5605e47bd6d70235bda"}]},{"level":"informative","category":"General","name":"Process launched with changed environment","description":"Process \"msiexec.exe\" (UID: 00000000-00003220) was launched with modified environment variables: \"CommonProgramFiles, Path, LOCALAPPDATA, USERDOMAIN, PROCESSOR_ARCHITECTURE, TEMP, APPDATA, USERPROFILE, TMP, ProgramFiles\"\n Process \"msiexec.exe\" (UID: 00000000-00003220) was launched with missing environment variables: \"PROCESSOR_ARCHITEW6432, LOGONSERVER, PROMPT, HOMEPATH, HOMEDRIVE\"\n Process \"MsiExec.exe\" (UID: 00000000-00001140) was launched with new environment variables: \"LOGONSERVER=\"\\\\HAPUBWS-PC\", PROMPT=\"$P$G\", HOMEPATH=\"\\Users\\hbH5PMP\", HOMEDRIVE=\"C:\"\"\n Process \"MsiExec.exe\" (UID: 00000000-00001140) was launched with modified environment variables: \"Path, LOCALAPPDATA, USERDOMAIN, TEMP, APPDATA, USERPROFILE, TMP\"","origin":"Monitored Target","relevance":10,"id":"target-67","sources":[{"report_type":"sandbox","report_id":"627ea5605e47bd6d70235bda"}]},{"level":"informative","category":"General","name":"Reads Windows Trust Settings","description":"\"msiexec.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\WINTRUST\\TRUST PROVIDERS\\SOFTWARE PUBLISHING\"; Key: \"STATE\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":5,"id":"registry-20","sources":[{"report_type":"sandbox","report_id":"627ea5605e47bd6d70235bda"}]},{"level":"informative","category":"General","name":"Sample shows a variety of benign indicators","description":"The input file/all extracted files were not detected as malicious and the input file is signed with a validated certificate","origin":"Indicator Combinations","relevance":10,"id":"summary-6","sources":[{"report_type":"sandbox","report_id":"627ea5605e47bd6d70235bda"}]},{"level":"informative","category":"General","name":"Scanning for window names","description":"\"msiexec.exe\" searching for class \"Shell_TrayWnd\"","origin":"API Call","mitre_attack_id":"T1010","relevance":10,"id":"api-70","sources":[{"report_type":"sandbox","report_id":"627ea5605e47bd6d70235bda"}]},{"level":"informative","category":"General","name":"Spawns new processes","description":"Spawned process \"msiexec.exe\" with commandline \"/V\" (UID: 00000000-00003220)\n Spawned process \"MsiExec.exe\" with commandline \"-Embedding F574F1FC76F0713152867D2257BB4E00 C\" (UID: 00000000-00001140)","origin":"Monitored Target","relevance":3,"id":"target-25","sources":[{"report_type":"sandbox","report_id":"627ea5605e47bd6d70235bda"}]},{"level":"informative","category":"General","name":"Spawns new processes that are not known child processes","description":"Spawned process \"msiexec.exe\" with commandline \"/V\" (UID: 00000000-00003220)\n Spawned process \"MsiExec.exe\" with commandline \"-Embedding F574F1FC76F0713152867D2257BB4E00 C\" (UID: 00000000-00001140)","origin":"Monitored Target","relevance":3,"id":"target-103","sources":[{"report_type":"sandbox","report_id":"627ea5605e47bd6d70235bda"}]},{"level":"informative","category":"General","name":"The input sample is signed with a certificate","description":"$28","origin":"Certificate Data","mitre_attack_id":"T1553.002","relevance":10,"id":"certificate-0","sources":[{"report_type":"sandbox","report_id":"627ea5605e47bd6d70235bda"}]},{"level":"informative","category":"General","name":"The input sample is signed with a valid certificate","description":"The entire certificate chain of the input sample was validated successfully.","origin":"Certificate Data","mitre_attack_id":"T1553.002","relevance":10,"id":"certificate-2","sources":[{"report_type":"sandbox","report_id":"627ea5605e47bd6d70235bda"}]},{"level":"informative","category":"Installation/Persistence","name":"Connects to LPC ports","description":"\"msiexec.exe\" connecting to \"\\ThemeApiPort\"","origin":"API Call","relevance":1,"id":"api-16","sources":[{"report_type":"sandbox","report_id":"627ea5605e47bd6d70235bda"}]},{"level":"informative","category":"Installation/Persistence","name":"Dropped files","description":"$29","origin":"Binary File","relevance":3,"id":"binary-0","sources":[{"report_type":"sandbox","report_id":"627ea5605e47bd6d70235bda"}]},{"level":"informative","category":"Installation/Persistence","name":"Drops executable files","description":"\"MSI64A9.tmp\" has type \"PE32 executable (DLL) (GUI) Intel 80386 for MS Windows\"- Location: [%TEMP%\\MSI64A9.tmp]","origin":"Binary File","relevance":10,"id":"binary-1","sources":[{"report_type":"sandbox","report_id":"627ea5605e47bd6d70235bda"}]},{"level":"informative","category":"Installation/Persistence","name":"Found a string that may be used as part of an injection method","description":"\"Shell_TrayWnd\" (Taskbar window class may be used to inject into explorer with the SetWindowLong method)","origin":"File/Memory","mitre_attack_id":"T1055.011","relevance":4,"id":"string-4","sources":[{"report_type":"sandbox","report_id":"627ea5605e47bd6d70235bda"}]},{"level":"informative","category":"Installation/Persistence","name":"Monitors specific registry key for changes","description":"$2a","origin":"API Call","mitre_attack_id":"T1012","relevance":4,"id":"api-12","sources":[{"report_type":"sandbox","report_id":"627ea5605e47bd6d70235bda"}]},{"level":"informative","category":"Installation/Persistence","name":"Scans for the windows taskbar (may be used for explorer injection)","description":"\"msiexec.exe\" searching for class \"Shell_TrayWnd\"","origin":"API Call","mitre_attack_id":"T1055.011","relevance":10,"id":"api-17","sources":[{"report_type":"sandbox","report_id":"627ea5605e47bd6d70235bda"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files in the Windows directory","description":"$2b","origin":"API Call","relevance":7,"id":"api-55","sources":[{"report_type":"sandbox","report_id":"627ea5605e47bd6d70235bda"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"$2c","origin":"File/Memory","relevance":10,"id":"string-3","sources":[{"report_type":"sandbox","report_id":"627ea5605e47bd6d70235bda"}]},{"level":"informative","category":"Network Related","name":"Possibly tries to communicate over SSL connection (HTTPS)","description":"$2d","origin":"File/Memory","mitre_attack_id":"T1573","relevance":1,"id":"string-98","sources":[{"report_type":"sandbox","report_id":"627ea5605e47bd6d70235bda"}]},{"level":"informative","category":"System Destruction","name":"Marks file for deletion","description":"\"%WINDIR%\\System32\\msiexec.exe\" marked \"%TEMP%\\Cab4BD0.tmp\" for deletion\n \"%WINDIR%\\System32\\msiexec.exe\" marked \"%TEMP%\\MSI64A9.tmp\" for deletion","origin":"API Call","mitre_attack_id":"T1070.004","relevance":10,"id":"api-26","sources":[{"report_type":"sandbox","report_id":"627ea5605e47bd6d70235bda"}]},{"level":"informative","category":"System Destruction","name":"Opens file with deletion access rights","description":"\"msiexec.exe\" opened \"%TEMP%\\Cab4BD0.tmp\" with delete access\n \"msiexec.exe\" opened \"%TEMP%\\MSI64A9.tmp\" with delete access","origin":"API Call","mitre_attack_id":"T1070.004","relevance":7,"id":"api-25","sources":[{"report_type":"sandbox","report_id":"627ea5605e47bd6d70235bda"}]},{"level":"informative","category":"System Security","name":"Creates or modifies windows services","description":"\"msiexec.exe\" (Access type: \"CREATE\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\TCPIP\\PARAMETERS\")","origin":"Registry Access","mitre_attack_id":"T1112","relevance":10,"id":"registry-67","sources":[{"report_type":"sandbox","report_id":"627ea5605e47bd6d70235bda"}]},{"level":"informative","category":"System Security","name":"Modifies Software Policy Settings","description":"$2e","origin":"Registry Access","mitre_attack_id":"T1112","relevance":10,"id":"registry-19","sources":[{"report_type":"sandbox","report_id":"627ea5605e47bd6d70235bda"}]},{"level":"informative","category":"System Security","name":"Opens the Kernel Security Device Driver (KsecDD) of Windows","description":"\"msiexec.exe\" opened \"\\Device\\KsecDD\"\n \"MsiExec.exe\" opened \"\\Device\\KsecDD\"","origin":"API Call","relevance":10,"id":"api-37","sources":[{"report_type":"sandbox","report_id":"627ea5605e47bd6d70235bda"}]},{"level":"informative","category":"Unusual Characteristics","name":"Drops cabinet archive files","description":"\"Cab4BD0.tmp\" has type \"Microsoft Cabinet archive data 61480 bytes 1 file\"\n \"57C8EDB95DF3F0AD4EE2DC2B8CFD4157\" has type \"Microsoft Cabinet archive data 4817 bytes 1 file\"\n \"77EC63BDA74BD0D0E0426DC8F8008506\" has type \"Microsoft Cabinet archive data 61480 bytes 1 file\"","origin":"Binary File","relevance":10,"id":"binary-5","sources":[{"report_type":"sandbox","report_id":"627ea5605e47bd6d70235bda"}]},{"level":"informative","category":"Unusual Characteristics","name":"Reads information about supported languages","description":"$2f","origin":"Registry Access","mitre_attack_id":"T1012","relevance":3,"id":"registry-25","sources":[{"report_type":"sandbox","report_id":"627ea5605e47bd6d70235bda"}]},{"level":"suspicious","category":"Anti-Detection/Stealthyness","name":"Queries kernel debugger information","description":"\"msiexec.exe\" at 00000000-00003972-00000033-1323037\n \"msiexec.exe\" at 00000000-00003220-00000033-15760629\n \"MsiExec.exe\" at 00000000-00001140-00000033-10662857836418731","origin":"API Call","relevance":6,"id":"api-10","sources":[{"report_type":"sandbox","report_id":"627ea5605e47bd6d70235bda"}]},{"level":"suspicious","category":"Environment Awareness","name":"Reads the active computer name","description":"\"msiexec.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")\n \"MsiExec.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":5,"id":"registry-35","sources":[{"report_type":"sandbox","report_id":"627ea5605e47bd6d70235bda"}]},{"level":"suspicious","category":"Environment Awareness","name":"Reads the cryptographic machine GUID","description":"\"msiexec.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")\n \"MsiExec.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":10,"id":"registry-1","sources":[{"report_type":"sandbox","report_id":"627ea5605e47bd6d70235bda"}]},{"level":"suspicious","category":"General","name":"Found a potential E-Mail address in binary/memory","description":"Pattern match: \"f@e8.a2yn\"\n Pattern match: \"e@2.z\"\n Pattern match: \"licenses@globaldelight.com0\"","origin":"File/Memory","mitre_attack_id":"T1114","relevance":3,"id":"string-63","sources":[{"report_type":"sandbox","report_id":"627ea5605e47bd6d70235bda"}]},{"level":"suspicious","category":"Network Related","name":"Sends traffic on typical HTTP outbound port, but without HTTP header","description":"TCP traffic to 104.18.32.68 on port 80 is sent without HTTP header","origin":"Network Traffic","relevance":5,"id":"network-23","sources":[{"report_type":"sandbox","report_id":"627ea5605e47bd6d70235bda"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Installs hooks/patches the running process","description":"\"MsiExec.exe\" wrote bytes \"c0dff2761cf9f176ccf8f1760d64f37600000000c011c47400000000fc3ec47400000000e013c474000000009457657625e0f276c6e0f27600000000bc6a647600000000cf31c4740000000093196576000000002c32c47400000000\" to virtual address \"0x75061000\" (part of module \"NSI.DLL\")\n \"MsiExec.exe\" wrote bytes \"71114b027a3b4a02ab8b02007f950200fc8c0200729602006cc805001ecd47027d264702\" to virtual address \"0x74AD07E4\" (part of module \"USER32.DLL\")","origin":"Hook Detection","mitre_attack_id":"T1056.004","relevance":10,"id":"hooks-8","sources":[{"report_type":"sandbox","report_id":"627ea5605e47bd6d70235bda"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Reads the windows installation language","description":"\"MsiExec.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE\"; Key: \"INSTALLLANGUAGEFALLBACK\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":5,"id":"registry-26","sources":[{"report_type":"sandbox","report_id":"627ea5605e47bd6d70235bda"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Tries to access unusual system drive letters","description":"\"msiexec.exe\" touched \"V:\"\n \"msiexec.exe\" touched \"W:\"\n \"msiexec.exe\" touched \"X:\"\n \"msiexec.exe\" touched \"Y:\"\n \"msiexec.exe\" touched \"K:\"\n \"msiexec.exe\" touched \"L:\"\n \"msiexec.exe\" touched \"M:\"\n \"msiexec.exe\" touched \"N:\"\n \"msiexec.exe\" touched \"O:\"\n \"msiexec.exe\" touched \"P:\"\n \"msiexec.exe\" touched \"Q:\"\n \"msiexec.exe\" touched \"R:\"\n \"msiexec.exe\" touched \"S:\"","origin":"API Call","mitre_attack_id":"T1083","relevance":9,"id":"api-31","sources":[{"report_type":"sandbox","report_id":"627ea5605e47bd6d70235bda"}]},{"level":"malicious","category":"Network Related","name":"Malicious artifacts seen in the context of a contacted host","description":"$30","origin":"Network Traffic","relevance":10,"id":"network-21","sources":[{"report_type":"sandbox","report_id":"627ea5605e47bd6d70235bda"}]}],"incidents":[{"name":"Fingerprint","details_count":1,"details":[{"detail":"Reads the windows installation language"}],"sources":[{"report_type":"sandbox","report_id":"627ea5605e47bd6d70235bda"}]},{"name":"Network Behavior","details_count":1,"details":[{"detail":"Contacts 1 domain and 1 host"}],"sources":[{"report_type":"sandbox","report_id":"627ea5605e47bd6d70235bda"}]}]},"activity":{"stats":{"process_count":3,"spawned_processes_count":3,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":2,"imported_dlls_count":100,"dropped_files_count":0,"extracted_files_count":8,"files_written_count":16,"files_deleted_count":0,"registry_keys_created_count":5,"registry_keys_modified_count":0,"registry_keys_deleted_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":5,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":1,"dns_resolutions_count":1,"contacted_urls_count":2,"http_requests_count":2},"behavior_tags":null,"sample_flags":["Multi-Process","Network Traffic","Extracted Files"],"sandbox_reports":[{"id":"627ea5605e47bd6d70235bda","environment_id":120,"environment_description":"Windows 7 64 bit","state":"SUCCESS","verdict":"suspicious","threat_score":67,"contacted_countries":["USA"],"submit_name":"Boom3D.msi","analysis_start_time":"2022-05-13T18:44:21+00:00","indicators_count":{"informative":38,"suspicious":8,"malicious":1},"tags":["Multi-Process","Network Traffic","Extracted Files"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":[{"address":"104.18.32.68","port":80,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"627ea5605e47bd6d70235bda"}]}],"dns_resolutions":[{"domain":"ocsp.sectigo.com","address":"104.18.32.68","ttl":3559,"country":"United States","registrar_name":"CSC CORPORATE DOMAINS, INC.","registrar_organization":"Sectigo Limited","registrar_name_servers":"NS1.AS48447.NET","registrar_creation_date":"2018-08-16T17:53:22+00:00","sources":[{"report_type":"sandbox","report_id":"627ea5605e47bd6d70235bda"}]}],"http_requests":[{"host":"ocsp.sectigo.com","host_ip":"104.18.32.68:80","url":"/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSdE3gf41WAic8Uh9lF92%2BIJqh5qwQUMuuSmv81lkgvKEBCcCA2kVwXheYCEDPXCKiRQFMZ4qW70zm5rW4%3D","method":"GET","header":"GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSdE3gf41WAic8Uh9lF92%2BIJqh5qwQUMuuSmv81lkgvKEBCcCA2kVwXheYCEDPXCKiRQFMZ4qW70zm5rW4%3D HTTP/1.1\nConnection: Keep-Alive\nAccept: */*\nUser-Agent: Microsoft-CryptoAPI/6.1\nHost: ocsp.sectigo.com","sources":[{"report_type":"sandbox","report_id":"627ea5605e47bd6d70235bda"}]},{"host":"ocsp.sectigo.com","host_ip":"104.18.32.68:80","url":"/MFEwTzBNMEswSTAJBgUrDgMCGgUABBRd0JozUYXMqqW4y4zJTrLcMCRSkAQUgTKSQSsozUbIxKLGKjkS7EipPxQCEAPe3DWx05c0Xw3KxjTWbR0%3D","method":"GET","header":"GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBRd0JozUYXMqqW4y4zJTrLcMCRSkAQUgTKSQSsozUbIxKLGKjkS7EipPxQCEAPe3DWx05c0Xw3KxjTWbR0%3D HTTP/1.1\nConnection: Keep-Alive\nAccept: */*\nUser-Agent: Microsoft-CryptoAPI/6.1\nHost: ocsp.sectigo.com","sources":[{"report_type":"sandbox","report_id":"627ea5605e47bd6d70235bda"}]}]},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"627ea5605e47bd6d70235bda"}],"processes":[{"pid":3972,"ppid":0,"name":"msiexec.exe","command_line":"/i \"C:\\Boom3D.msi\"","sha256":"1a899bef4f64d5cdd23911a6ea09f69483e4dba8e76cda38a37dab6fa24406e8","normalized_path":"%WINDIR%\\System32\\msiexec.exe","uid":"00000000-00003972","icon":"iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAABvElEQVR42rWWwZHDIAxFubkfCsrNLeS8p5SQGW45bAWuIAXo7gJSCPH37mcVViRgY8388YyN/R8SAju3Mc7nc9wjtycul0vcGvf7PeL9LgDOfTXpEIBRYpJf7i2XdHXx79nhALm51+ZBjgX4aH4kQJX5kQBV5nsAMDgX7lsZKJn7ceMitPq9lIF35psAMOh0Or3I3AcqzJsBSubft1vsvhFZNaZy8xyg21Zc+mBurgHwoa0yS5Cn3DInQI+YpikOwxA/tpsF8K5sNYJ5VRlKAHx+vV5fxLO+JnYB0GiUsIwKUWRMwuy896us2RfXQS0A1oZfenwMoQgAYSwg8trDvLkEeJbMRVYAQgBAQ9AcghkgrE5o2nYJkQBEzCzo2cMEYWWhad/X5o/HA1b/IUJ4mT3N53leVQVBABFJV50BAhBCg+jexliaMyPVANrcykBYZpor/w5nrVd+twzgHsXZvft/6J4BbUzpFc0SQXpMtwxY5iJhlUNJlnWhIaguGeAOqM0JgDb8+QkJaYE2mX/KgD4xtbkGWLshg1g7pQXAyoB1bGtzAshvW2qIavPW4P9CCYCHkTs69M8LTVuNn8o4YS+PakCyAAAAAElFTkSuQmCC"},{"pid":3220,"ppid":0,"name":"msiexec.exe","command_line":"/V","sha256":"1a899bef4f64d5cdd23911a6ea09f69483e4dba8e76cda38a37dab6fa24406e8","normalized_path":"%WINDIR%\\system32\\msiexec.exe","uid":"00000000-00003220","icon":"iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAABvElEQVR42rWWwZHDIAxFubkfCsrNLeS8p5SQGW45bAWuIAXo7gJSCPH37mcVViRgY8388YyN/R8SAju3Mc7nc9wjtycul0vcGvf7PeL9LgDOfTXpEIBRYpJf7i2XdHXx79nhALm51+ZBjgX4aH4kQJX5kQBV5nsAMDgX7lsZKJn7ceMitPq9lIF35psAMOh0Or3I3AcqzJsBSubft1vsvhFZNaZy8xyg21Zc+mBurgHwoa0yS5Cn3DInQI+YpikOwxA/tpsF8K5sNYJ5VRlKAHx+vV5fxLO+JnYB0GiUsIwKUWRMwuy896us2RfXQS0A1oZfenwMoQgAYSwg8trDvLkEeJbMRVYAQgBAQ9AcghkgrE5o2nYJkQBEzCzo2cMEYWWhad/X5o/HA1b/IUJ4mT3N53leVQVBABFJV50BAhBCg+jexliaMyPVANrcykBYZpor/w5nrVd+twzgHsXZvft/6J4BbUzpFc0SQXpMtwxY5iJhlUNJlnWhIaguGeAOqM0JgDb8+QkJaYE2mX/KgD4xtbkGWLshg1g7pQXAyoB1bGtzAshvW2qIavPW4P9CCYCHkTs69M8LTVuNn8o4YS+PakCyAAAAAElFTkSuQmCC"},{"pid":1140,"ppid":3220,"name":"MsiExec.exe","command_line":"-Embedding F574F1FC76F0713152867D2257BB4E00 C","sha256":"83d965138a2fc05f5a403d43c9425afc1360eb793b3d94c64037f0f848467e22","normalized_path":"%WINDIR%\\syswow64\\MsiExec.exe","parent_uid":"00000000-00003220","uid":"00000000-00001140"}],"all_imported_dlls":["ole32.dll","mswsock.dll","RpcRtRemote.dll","msctf.dll","propsys.dll","lpk.dll","usp10.dll","cryptnet.dll","rpcss.dll","winmm.dll","winhttp.dll","webio.dll","winnsi.dll","rpcrt4.dll","cfgmgr32.dll","dnsapi.dll","gdi32.dll","wow64win.dll","api-ms-win-downlevel-ole32-l1-1-0.dll","api-ms-win-downlevel-version-l1-1-0.dll","wininet.dll","cryptsp.dll","uxtheme.dll","shlwapi.dll","wintrust.dll","Wldap32.dll","wow64cpu.dll","kernel32.dll","msvcrt.dll","mscoreei.dll","comctl32.dll","msimsg.dll","comdlg32.dll","mpr.dll","rasadhlp.dll","devrtl.dll","msacm32.dll","mscoree.dll","sfc_os.dll","clbcatq.dll","KernelBase.dll","msisip.dll","WSHTCPIP.DLL","wship6.dll","srvcli.dll","advapi32.dll","cryptbase.dll","bcryptprimitives.dll","clr.dll","dhcpcsvc.dll","msihnd.dll","sechost.dll","AcGenral.dll","fltLib.dll","rsaenh.dll","dhcpcsvc6.dll","crypt32.dll","msasn1.dll","FWPUCLNT.DLL","wow64.dll","profapi.dll","dwmapi.dll","fusion.dll","SensApi.dll","api-ms-win-downlevel-normaliz-l1-1-0.dll","iertutil.dll","apphelp.dll","sfc.dll","nsi.dll","netutils.dll","sxs.dll","api-ms-win-core-synch-l1-2-0.dll","ncrypt.dll","bcrypt.dll","ntdll.dll","version.dll","msi.dll","wkscli.dll","IPHLPAPI.DLL","setupapi.dll","cabinet.dll","normaliz.dll","AcLayers.dll","user32.dll","credssp.dll","samcli.dll","urlmon.dll","api-ms-win-downlevel-shlwapi-l1-1-0.dll","shell32.dll","sspicli.dll","ws2_32.dll","oleaut32.dll","gpapi.dll","api-ms-win-downlevel-advapi32-l1-1-0.dll","api-ms-win-downlevel-user32-l1-1-0.dll","userenv.dll","imm32.dll","VxSSL64.dll","netapi32.dll","devobj.dll"]},"file_activity":{"dropped_files":null,"extracted_files":[{"name":"MSI64A9.tmp","sha256":"da1fe86141c446921021bb26b6fe2bd2d1bb51e3e614f46f8103ffad8042f2c0","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"627ea5605e47bd6d70235bda"}]},{"name":"Tar4BD1.tmp","sha256":"3163b82d1289693122ef99ed6c3c1911f68aa2a7296907cebf84c897141ced4e","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"627ea5605e47bd6d70235bda"}]},{"name":"77EC63BDA74BD0D0E0426DC8F8008506","sha256":"998e0209690a48ed33b79af30fc13851e3e3416bed97e3679b6030c10cab361e","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"627ea5605e47bd6d70235bda"}]},{"name":"B2FAF7692FD9FFBD64EDE317E42334BA_93702E680A5530C052C8D2BA33A2225F","sha256":"ede1544829ace2f866487684a248f20ebe767e8d52b200fa49d43269ed0bbf72","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"627ea5605e47bd6d70235bda"}]},{"name":"18E6B4A57A6BC7EC9B861CDF2D6D0D02_EF52C1EC85F21F31CC0157A5C8803013","sha256":"46ed469dd4189c5a2e215ce5ef3a694ed3e02799431b64b0e620625577993b91","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"627ea5605e47bd6d70235bda"}]},{"name":"3AA0DCD5A74331FBD6F344550EC48B87_5732EC2A70C607BA73FCF995F888DAF1","sha256":"91cb1458e582f32a46c09e1447f1a0a13c937a9f19a452321f0a1012b6d85350","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"627ea5605e47bd6d70235bda"}]},{"name":"57C8EDB95DF3F0AD4EE2DC2B8CFD4157","sha256":"9f6ecb122ef1bb7661633f208deab28c9fc78db19109f9e3fd3d1d5792ef09e4","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"627ea5605e47bd6d70235bda"}]},{"name":"Cab4BD0.tmp","sha256":"998e0209690a48ed33b79af30fc13851e3e3416bed97e3679b6030c10cab361e","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"627ea5605e47bd6d70235bda"}]}],"files_written":[{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\B2FAF7692FD9FFBD64EDE317E42334BA_93702E680A5530C052C8D2BA33A2225F","sources":[{"report_type":"sandbox","report_id":"627ea5605e47bd6d70235bda"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\Content\\B2FAF7692FD9FFBD64EDE317E42334BA_93702E680A5530C052C8D2BA33A2225F","sources":[{"report_type":"sandbox","report_id":"627ea5605e47bd6d70235bda"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\3AA0DCD5A74331FBD6F344550EC48B87_5732EC2A70C607BA73FCF995F888DAF1","sources":[{"report_type":"sandbox","report_id":"627ea5605e47bd6d70235bda"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\Content\\3AA0DCD5A74331FBD6F344550EC48B87_5732EC2A70C607BA73FCF995F888DAF1","sources":[{"report_type":"sandbox","report_id":"627ea5605e47bd6d70235bda"}]},{"path":"%TEMP%\\Tar4BD1.tmp","sources":[{"report_type":"sandbox","report_id":"627ea5605e47bd6d70235bda"}]},{"path":"C:\\Windows","sources":[{"report_type":"sandbox","report_id":"627ea5605e47bd6d70235bda"}]},{"path":"%WINDIR%\\Fonts","sources":[{"report_type":"sandbox","report_id":"627ea5605e47bd6d70235bda"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\57C8EDB95DF3F0AD4EE2DC2B8CFD4157","sources":[{"report_type":"sandbox","report_id":"627ea5605e47bd6d70235bda"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\Content\\57C8EDB95DF3F0AD4EE2DC2B8CFD4157","sources":[{"report_type":"sandbox","report_id":"627ea5605e47bd6d70235bda"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\18E6B4A57A6BC7EC9B861CDF2D6D0D02_EF52C1EC85F21F31CC0157A5C8803013","sources":[{"report_type":"sandbox","report_id":"627ea5605e47bd6d70235bda"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\Content\\18E6B4A57A6BC7EC9B861CDF2D6D0D02_EF52C1EC85F21F31CC0157A5C8803013","sources":[{"report_type":"sandbox","report_id":"627ea5605e47bd6d70235bda"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\77EC63BDA74BD0D0E0426DC8F8008506","sources":[{"report_type":"sandbox","report_id":"627ea5605e47bd6d70235bda"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\Content\\77EC63BDA74BD0D0E0426DC8F8008506","sources":[{"report_type":"sandbox","report_id":"627ea5605e47bd6d70235bda"}]},{"path":"%TEMP%\\MSI764b.LOG","sources":[{"report_type":"sandbox","report_id":"627ea5605e47bd6d70235bda"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{846EE342-7039-11DE-9D20-806E6F6E6963}","sources":[{"report_type":"sandbox","report_id":"627ea5605e47bd6d70235bda"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{C3450F58-7060-4AEA-B0A0-C245927D78D0}","sources":[{"report_type":"sandbox","report_id":"627ea5605e47bd6d70235bda"}]}],"files_deleted":null},"registry_activity":{"keys_created":[{"key":"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\TCPIP\\PARAMETERS\\","sources":[{"report_type":"sandbox","report_id":"627ea5605e47bd6d70235bda"}]},{"key":"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\TIMEZONEINFORMATION\\","sources":[{"report_type":"sandbox","report_id":"627ea5605e47bd6d70235bda"}]},{"key":"HKLM\\SOFTWARE\\CLASSES\\","sources":[{"report_type":"sandbox","report_id":"627ea5605e47bd6d70235bda"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INSTALLER\\SECURE\\","sources":[{"report_type":"sandbox","report_id":"627ea5605e47bd6d70235bda"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INSTALLER\\","sources":[{"report_type":"sandbox","report_id":"627ea5605e47bd6d70235bda"}]}],"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":[{"name":"\\Sessions\\1\\BaseNamedObjects\\Global\\MSILOG_76aba2841d866e9GOL.b467ISM_pmeT_lacoL_ataDppA_PMP5Hbh_sresU_:C","sources":[{"report_type":"sandbox","report_id":"627ea5605e47bd6d70235bda"}]},{"name":"Global\\MSILOG_76aba2841d866e9GOL.b467ISM_pmeT_lacoL_ataDppA_PMP5Hbh_sresU_:C","sources":[{"report_type":"sandbox","report_id":"627ea5605e47bd6d70235bda"}]}]}},"report_ids":{"sandbox_job_ids":["627ea5605e47bd6d70235bda"]}}}]]}] 1e:null 22:[["$","title","0",{"children":"Suspicious Sample a478c27db33c… — Score 67/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Suspicious verdict for sample a478c27db33c…. Threat score 67/100. 0/27 AV engines flagged this file. 1 malicious and 8 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/a478c27db33ca5a9fee798a20f662922910fe74955016d692fa81dee9dad78cf"}],["$","meta","4",{"property":"og:title","content":"Suspicious Sample a478c27db33c… — Score 67/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Suspicious verdict for sample a478c27db33c…. Threat score 67/100. 0/27 AV engines flagged this file. 1 malicious and 8 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/a478c27db33ca5a9fee798a20f662922910fe74955016d692fa81dee9dad78cf"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Suspicious Sample a478c27db33c… — Score 67/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Suspicious verdict for sample a478c27db33c…. Threat score 67/100. 0/27 AV engines flagged this file. 1 malicious and 8 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L31","11",{}]]