Analysis
- max time kernel
148s - max time network
142s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
30/07/2026, 18:24
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
iRacingManagerSetup.msi
Resource
win10v2004-20260513-en
windows10-2004-x64
12 signatures
150 seconds
Behavioral task
behavioral2
Sample
iRacingManagerSetup.msi
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
13 signatures
150 seconds
General
- Target iRacingManagerSetup.msi
- Size 1.8MB
- Sample260730-w2a7jsxycs
- SHA256 ea51cef01f1fc54096a45ef2fbe19b5aeb40fc37499f3bace3b647ba414e2aa6
- MD5 491143b35a5ca1dfe18ea6794d0c9786
- SHA1 5faedc906afa7cd9ad549a047a58ee390dbbff5d
- SHA512 fccb4c9be8ad613aef20591a603083675100ee9e929e30f70d66b337ef6e07cd4c0a72b5260b0d59eab6507e87402f5ee7f5bd2e095695a47407d18a288c28a4
- SSDEEP 49152:9BhEt/Qbo+BF9o+Bn+dY6V32bKl0JsmJ0:hWxu0unuhqKl0xJ
- TLSH T13595E012BA475F31D12A0DFE217A6661DA7FFC300EB4995BA29072287DF13C07356A63
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Loads dropped DLL 4 IoCs
pid Process 2772 MsiExec.exe 2772 MsiExec.exe 1104 MsiExec.exe 1104 MsiExec.exe - Enumerates connected drives 3 TTPs 46 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\D: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\D: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\T: msiexec.exe - Drops file in Program Files directory 16 IoCs
description ioc Process File created C:\Program Files\iRacingManager\iRacingManager.exe.config msiexec.exe File created C:\Program Files\iRacingManager\iRacingSdkWrapper.dll msiexec.exe File created C:\Program Files\iRacingManager\System.IO.Compression.dll msiexec.exe File opened for modification C:\Program Files\iRacingManager\System.IO.Compression.dll msiexec.exe File created C:\Program Files\iRacingManager\logo.jpg msiexec.exe File opened for modification C:\Program Files\iRacingManager\icon.ico msiexec.exe File created C:\Program Files\iRacingManager\NLog.config msiexec.exe File created C:\Program Files\iRacingManager\iRSDKSharp.dll msiexec.exe File created C:\Program Files\iRacingManager\System.Net.Http.dll msiexec.exe File created C:\Program Files\iRacingManager\NLog.dll msiexec.exe File created C:\Program Files\iRacingManager\logo.png msiexec.exe File created C:\Program Files\iRacingManager\setupbanner.jpg msiexec.exe File created C:\Program Files\iRacingManager\iRacingManager.exe msiexec.exe File created C:\Program Files\iRacingManager\MaterialSkin.dll msiexec.exe File created C:\Program Files\iRacingManager\icon.ico msiexec.exe File created C:\Program Files\iRacingManager\YamlDotNet.dll msiexec.exe - Drops file in Windows directory 14 IoCs
description ioc Process File opened for modification C:\Windows\Installer\e59e69d.msi msiexec.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log msiexec.exe File opened for modification C:\Windows\Installer\MSIE94D.tmp msiexec.exe File created C:\Windows\Installer\inprogressinstallinfo.ipi msiexec.exe File created C:\Windows\SystemTemp\~DFC86981A07831F313.TMP msiexec.exe File opened for modification C:\Windows\Installer\MSIECF8.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSIEA48.tmp msiexec.exe File opened for modification C:\Windows\Installer\ msiexec.exe File created C:\Windows\Installer\SourceHash{5FE18A8A-1703-4217-B016-ED2337FB5AC5} msiexec.exe File created C:\Windows\SystemTemp\~DF40016E094E1A6260.TMP msiexec.exe File created C:\Windows\Installer\e59e6a1.msi msiexec.exe File created C:\Windows\SystemTemp\~DFA6E8DFFF9FD662CB.TMP msiexec.exe File created C:\Windows\SystemTemp\~DF20DEA716D9A0028D.TMP msiexec.exe File created C:\Windows\Installer\e59e69d.msi msiexec.exe - Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs
pid Process 2096 msiexec.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsiExec.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsiExec.exe - Checks SCSI registry key(s) 3 TTPs 5 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters vssvc.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters vssvc.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 0000000004000000ffbf1fc65d8bbf350000000000000000000000000000000000000000000000000000000000000000000000000000000000001071020000000000c0120000000000000000000000002701010000883801ffbf1fc60000000000001071020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d0830200000000006025c501000000000000000000000700010000e84101ffbf1fc6000000000000d08302000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030a9c701000000000000050000000000000000000000070001000098d4e3ffbf1fc600000000000030a9c7010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030a9cc0100000000000005000000000000000000000007000100009854e6ffbf1fc600000000000030a9cc01000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe - Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 2164 msiexec.exe 2164 msiexec.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 2096 msiexec.exe Token: SeIncreaseQuotaPrivilege 2096 msiexec.exe Token: SeSecurityPrivilege 2164 msiexec.exe Token: SeCreateTokenPrivilege 2096 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 2096 msiexec.exe Token: SeLockMemoryPrivilege 2096 msiexec.exe Token: SeIncreaseQuotaPrivilege 2096 msiexec.exe Token: SeMachineAccountPrivilege 2096 msiexec.exe Token: SeTcbPrivilege 2096 msiexec.exe Token: SeSecurityPrivilege 2096 msiexec.exe Token: SeTakeOwnershipPrivilege 2096 msiexec.exe Token: SeLoadDriverPrivilege 2096 msiexec.exe Token: SeSystemProfilePrivilege 2096 msiexec.exe Token: SeSystemtimePrivilege 2096 msiexec.exe Token: SeProfSingleProcessPrivilege 2096 msiexec.exe Token: SeIncBasePriorityPrivilege 2096 msiexec.exe Token: SeCreatePagefilePrivilege 2096 msiexec.exe Token: SeCreatePermanentPrivilege 2096 msiexec.exe Token: SeBackupPrivilege 2096 msiexec.exe Token: SeRestorePrivilege 2096 msiexec.exe Token: SeShutdownPrivilege 2096 msiexec.exe Token: SeDebugPrivilege 2096 msiexec.exe Token: SeAuditPrivilege 2096 msiexec.exe Token: SeSystemEnvironmentPrivilege 2096 msiexec.exe Token: SeChangeNotifyPrivilege 2096 msiexec.exe Token: SeRemoteShutdownPrivilege 2096 msiexec.exe Token: SeUndockPrivilege 2096 msiexec.exe Token: SeSyncAgentPrivilege 2096 msiexec.exe Token: SeEnableDelegationPrivilege 2096 msiexec.exe Token: SeManageVolumePrivilege 2096 msiexec.exe Token: SeImpersonatePrivilege 2096 msiexec.exe Token: SeCreateGlobalPrivilege 2096 msiexec.exe Token: SeCreateTokenPrivilege 2096 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 2096 msiexec.exe Token: SeLockMemoryPrivilege 2096 msiexec.exe Token: SeIncreaseQuotaPrivilege 2096 msiexec.exe Token: SeMachineAccountPrivilege 2096 msiexec.exe Token: SeTcbPrivilege 2096 msiexec.exe Token: SeSecurityPrivilege 2096 msiexec.exe Token: SeTakeOwnershipPrivilege 2096 msiexec.exe Token: SeLoadDriverPrivilege 2096 msiexec.exe Token: SeSystemProfilePrivilege 2096 msiexec.exe Token: SeSystemtimePrivilege 2096 msiexec.exe Token: SeProfSingleProcessPrivilege 2096 msiexec.exe Token: SeIncBasePriorityPrivilege 2096 msiexec.exe Token: SeCreatePagefilePrivilege 2096 msiexec.exe Token: SeCreatePermanentPrivilege 2096 msiexec.exe Token: SeBackupPrivilege 2096 msiexec.exe Token: SeRestorePrivilege 2096 msiexec.exe Token: SeShutdownPrivilege 2096 msiexec.exe Token: SeDebugPrivilege 2096 msiexec.exe Token: SeAuditPrivilege 2096 msiexec.exe Token: SeSystemEnvironmentPrivilege 2096 msiexec.exe Token: SeChangeNotifyPrivilege 2096 msiexec.exe Token: SeRemoteShutdownPrivilege 2096 msiexec.exe Token: SeUndockPrivilege 2096 msiexec.exe Token: SeSyncAgentPrivilege 2096 msiexec.exe Token: SeEnableDelegationPrivilege 2096 msiexec.exe Token: SeManageVolumePrivilege 2096 msiexec.exe Token: SeImpersonatePrivilege 2096 msiexec.exe Token: SeCreateGlobalPrivilege 2096 msiexec.exe Token: SeCreateTokenPrivilege 2096 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 2096 msiexec.exe Token: SeLockMemoryPrivilege 2096 msiexec.exe - Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 2096 msiexec.exe 2096 msiexec.exe - Suspicious use of SetWindowsHookEx 4 IoCs
pid Process 2096 msiexec.exe 2164 msiexec.exe 2772 MsiExec.exe 1104 MsiExec.exe - Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 2164 wrote to memory of 2772 2164 msiexec.exe 90 PID 2164 wrote to memory of 3652 2164 msiexec.exe 96 PID 2164 wrote to memory of 1104 2164 msiexec.exe 98 - Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Windows\system32\msiexec.exemsiexec.exe /I C:\Users\Admin\AppData\Local\Temp\iRacingManagerSetup.msi1⤵
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:2096
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2164 -
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 5FDE47827B8E9C5272B9C2761C8C6B7F C2⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:2772
-
-
C:\Windows\system32\srtasks.exeC:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:22⤵PID:3652
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 950BBDA35709BF4E9E2C9D86AA1B62052⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:1104
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Checks SCSI registry key(s)
PID:908
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Config.Msi\e59e69e.rbs
- Size 15KB
- SHA256 0e6dbb1ad40873d6f593cbb40c4192f6c8735db0940b386e4f783c4783b4afab
- MD5 c6e0edbe9d0a7d5eced6bb95f7a1c64a
- SHA1 649238f43849b002de47bd224c751b1a5f760633
- SHA512 d8353cea76ae0ec6b6905dc1f130aff75a5bf54660cff8f1036474e99e9160d6a7db1c7c25aa4ce2cb9c097028e03cf791d0e79e4ae0a7ba901aa655096aec7c
- SSDEEP 384:6bolYwK/mXRQgqiJ5/A46kGHUaU4nVm+YYpJdt4c2EEC7Ffe6Lhld8wUX9cJPG3C:6bolYwK/mXRQgqiJ5/A4FGHXJnV55rnP
- TLSH T16A62A6613616CAF3E2D82236CF216B193366EA88C780635F16CCC5BECE127595F181E7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\iRacingManager\System.IO.Compression.dll
- Size 29KB
- SHA256 c251b0f18d96251db2326f67cba338903d04dbae2838dd72f537576e84007d8c
- MD5 f1c5d4d080e59421efdb81ade8c967a6
- SHA1 a2095e4b815b282a138d9f45f427b8abe086e8c4
- SHA512 8a21ea42ffeb2b55690c6b3b8e91fae95c6b0f546851bd6dc93df7fd5e6782612ab18f1215d16abe6e7f673fd994690697d50868013e4cb0f7907a7f30e508a0
- SSDEEP 384:MuHg8PpkgRsPZBxvQCYITYlc+wHmWS1WqE5dlF0GftpBjENCc4HRN7dgXlL:9g8PPM5qfGwH8l+iRBd
- TLSH T134D23A96DBF84602ECD35E306B76D5433A39B3D66C11C25E011EE1A92CA37D0EBA0725
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\iRacingManager\icon.ico
- Size 136KB
- SHA256 a43f3da2bf79f20c330f9c4edf1742fb297acc3dceddb194a30a763190464a70
- MD5 14ed443d3c6c2634a34836c7650141fd
- SHA1 72262d9fc1f4ce216b77c217e0b2f3983b47586a
- SHA512 da038c697c6d4d3a83728db65d6b69e908317208d486d105d7e41dd579aac8b605d86564bac671a6bcdc17cfa2c3228d9e38213f5a26fc067289769442ac57fa
- SSDEEP 768:IbWdwmFiVlC4Hyg0OYEUpVylCWXG4lX5cU41Ybd9gUbic86T:IbWdjMW4HIOYEuA4wtbwU
- TLSH T1B1D33F56D9269F25D01D5DFE512A3822D7BFFE300D6879E6E0A2B229F5F67C13302812
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\MSI51B0.tmp
- Size 285KB
- SHA256 f74c97b1a53541b059d3bfafe41a79005ce5065f8210d7de9f1b600dc4e28aa0
- MD5 b77a2a2768b9cc78a71bbffb9812b978
- SHA1 b70e27eb446fe1c3bc8ea03dabbee2739a782e04
- SHA512 a8b16bc60f8559c78c64ca9e85cd7fd704bba1f55b362465b7accef1bb853d1c9616995a35f972256c57fbe877ce880398ba1fbceaa658604883aa12dcbc4f57
- SSDEEP 6144:cAOfnUdzb4m26KFHF/jliAYktxjw0gCvo5VGWg6AZzGbasKHr45I:cRUFb4H6KJF/pDYkw0gCvoKWg6AZznX4
- TLSH T18B547C117AD5D432E1BE0530397DABA52ABEF8316DF0C68F9384566D2D712C0A728F27
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Installer\e59e69d.msi
- Size 1.8MB
- SHA256 ea51cef01f1fc54096a45ef2fbe19b5aeb40fc37499f3bace3b647ba414e2aa6
- MD5 491143b35a5ca1dfe18ea6794d0c9786
- SHA1 5faedc906afa7cd9ad549a047a58ee390dbbff5d
- SHA512 fccb4c9be8ad613aef20591a603083675100ee9e929e30f70d66b337ef6e07cd4c0a72b5260b0d59eab6507e87402f5ee7f5bd2e095695a47407d18a288c28a4
- SSDEEP 49152:9BhEt/Qbo+BF9o+Bn+dY6V32bKl0JsmJ0:hWxu0unuhqKl0xJ
- TLSH T13595E012BA475F31D12A0DFE217A6661DA7FFC300EB4995BA29072287DF13C07356A63
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
- Size 26.1MB
- SHA256 291f201ec22d249c80b85414fd2861bdcc9a86831c75d208fa93ce6b6943b911
- MD5 4c27369c0cae607d7be407136a25c3d7
- SHA1 f9486b8abb3836383e05e9f0b9651fd24ceade21
- SHA512 a2c86dafe4218a98db49bac13a075d17e461d0854c249e712da266f232aefff7cd567b8cf18efe31d7452867e11e10cc967bd9052d91797ca4f6887f6ca8c5ab
- SSDEEP 24576:EFo3DMP5doO/vvTL/yAsMilQPrOWX7rf0R6e9BCE65iqpLNMMoR2s12NoeC:AH0
- TLSH T1F057B51436F92100E7F79E3CA8F06A234D397D5BAC19DE8D45511B8E0922F71E872F6A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path \??\Volume{c61fbfff-0000-0000-0000-d08302000000}\System Volume Information\SPP\OnlineMetadataCache\{48b5c9ab-8c61-4c53-aca0-4f88e1507451}_OnDiskSnapshotProp
- Size 6KB
- SHA256 92840d66d3c1ce988e9f69eecae45b5c7f94fe4b6871a4a859bf08ed0e72e5c8
- MD5 37074f5cd155eb91e2590a95c482fc40
- SHA1 1bd423ed0aec8d1128242861cf0544cadb8ac0c0
- SHA512 c801488d15161f7fd595627bda869bff8e39262023d39cca5aa85e212cf4774d690fc09e1a21028c27d88ece957a92c1c0e124098fc6994ef6aea0b2ac892b74
- SSDEEP 96:FVz7W5m7lDvc6DD84LTHzbOHXOHBlBRQn8Sc9XE56tOSVQpu:TWml/b++uVm
- TLSH T1F6D188085AE54711E2F3AB3229F18557A837B911FF33CB8E0198238E6631910F935F6B
- MD5 SHA1 SHA512 SSDEEP TLSH