3CXDesktopApp-18.12.416.msi

Classification: Malicious

3CXDesktopApp-18.12.416.msi is a malicious file sample (Office document, 97.8 MB). Linked to Lazarus Group activity. 5 sightings, last seen 2026-07-23.

Detection summary

  • 0 antivirus detections
  • 0 IDS alerts
  • 14 processes observed
  • 0 contacted hosts
  • 1 DNS requests

MITRE ATT&CK associations

Intrusion sets: LAZARUS GROUP (G0032)

Blacklist sightings

Description Source First seen Last seen Labels MITRE ATT&CK
Generic Malware Triage 2026-06-27 10:20:08 2026-07-23 23:56:23 malicious-activity
Generic.Malware MalwareBazaar Abuse.ch 2024-06-17 05:16:27 2024-06-17 05:16:27 malicious-activity
Lazarus Group Maltiverse 2023-03-31 04:15:44 2023-04-01 00:17:21 malicious-activity G0032 Lazarus Group
Generic Malware Hybrid-Analysis 2023-03-28 09:00:04 2023-03-28 09:00:04

Tags

apt discovery persistence privilege_escalation ransomware revoked_codesign

Sample information

Filenames
3CXDesktopApp-18.12.416.msi
File type
Composite Document File V2 Document, Little Endian ...
Size
102555648 bytes
MD5
0eeb1c0133eb4d571178b2d9d14ce3e9
SHA-1
bfecb8ce89a312d2ef4afc64a63847ae11c6f69e
SHA-256
59e1edf4d82fae4978e97512b0331b7eb21dd4b838b850ba46794d9c7a2c0983
First indexed
2023-03-28 08:27:24
Last updated
2026-07-24 00:59:18

DNS requests

ocsp.sectigo.com

Process list

NameCommand line
msiexec.exe/i "C:\3CXDesktopApp-18.12.416.msi"
msiexec.exe/V
MsiExec.exe-Embedding 8552B5B59336733E0273D101E1ED3F4D
3CXDesktopApp.exe
3CXDesktopApp.exe
reg.exeQUERY HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v 3CXDeskTopApp
3CXDesktopApp.exe"%APPDATA%\3CXDesktopApp" --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1544 --field-trial-handle=1632,i,6184131615707346431,7096442305017630903,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:2
3CXDesktopApp.exe"%APPDATA%\3CXDesktopApp" --standard-schemes=voipc --enable-sandbox --secure-schemes=voipc --bypasscsp-schemes --cors-schemes=voipc --fetch-schemes=voipc --service-worker-schemes=voipc --streaming-schemes --mojo-platform-channel-handle=1732 --field-trial-handle=1632,i,6184131615707346431,7096442305017630903,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:8
3CXDesktopApp.exe"%APPDATA%\3CXDesktopApp" --standard-schemes=voipc --enable-sandbox --secure-schemes=voipc --bypasscsp-schemes --cors-schemes=voipc --fetch-schemes=voipc --service-worker-schemes=voipc --streaming-schemes --app-user-model-id=9071E5B59CCA4D120EC8D975AF3F02AB --app-path="%LOCALAPPDATA%\Programs\3CXDesktopApp\app\resources\app.asar" --enable-sandbox --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=4 --launch-time-ticks=1330395162 --mojo-platform-channel-handle=2392 --field-trial-handle=1632,i,6184131615707346431,7096442305017630903,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:1
3CXDesktopApp.exe"%APPDATA%\3CXDesktopApp" --standard-schemes=voipc --enable-sandbox --secure-schemes=voipc --bypasscsp-schemes --cors-schemes=voipc --fetch-schemes=voipc --service-worker-schemes=voipc --streaming-schemes --app-user-model-id=9071E5B59CCA4D120EC8D975AF3F02AB --app-path="%LOCALAPPDATA%\Programs\3CXDesktopApp\app\resources\app.asar" --enable-sandbox --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --launch-time-ticks=1351898931 --mojo-platform-channel-handle=3684 --field-trial-handle=1632,i,6184131615707346431,7096442305017630903,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:1
3CXDesktopApp.exe"%APPDATA%\3CXDesktopApp" --standard-schemes=voipc --enable-sandbox --secure-schemes=voipc --bypasscsp-schemes --cors-schemes=voipc --fetch-schemes=voipc --service-worker-schemes=voipc --streaming-schemes --mojo-platform-channel-handle=3952 --field-trial-handle=1632,i,6184131615707346431,7096442305017630903,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:8
3CXDesktopApp.exe"%APPDATA%\3CXDesktopApp" --standard-schemes=voipc --enable-sandbox --secure-schemes=voipc --bypasscsp-schemes --cors-schemes=voipc --fetch-schemes=voipc --service-worker-schemes=voipc --streaming-schemes --mojo-platform-channel-handle=3900 --field-trial-handle=1632,i,6184131615707346431,7096442305017630903,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:8
3CXDesktopApp.exe"%APPDATA%\3CXDesktopApp" --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3400 --field-trial-handle=1632,i,6184131615707346431,7096442305017630903,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:2
MsiExec.exe-Embedding 598EF0A4305DC2038DDD9392DE3CBD5C