Analysis
- max time kernel
148s - max time network
145s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
02/08/2026, 03:11
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
MacroGamer_v275_Setup.msi
Resource
win10v2004-20260513-en
windows10-2004-x64
24 signatures
150 seconds
Behavioral task
behavioral2
Sample
MacroGamer_v275_Setup.msi
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
10 signatures
150 seconds
General
- Target MacroGamer_v275_Setup.msi
- Size 667KB
- Sample260802-dpvrbacl6z
- SHA256 d82a1cffc6e982b07c0aef61b96b4c36ebd921949c9d4c45a31781539ae443e8
- MD5 f7a9d1bf05f8f0e2a1cc6cafd0985070
- SHA1 a9f931e9f7c8a7964d19af9b5f938c2dbfcb44e4
- SHA512 c30df08a315c7f161646269254645a2825de1108af85d48cfad8a1e88a6f70c7259235a8eaf235f548d0647760e535dfeb3b43d719398e2f9acb75274b865e6c
- SSDEEP 12288:mjDGPXXktIro8FAPUxv9gvIp2z92NFttMDWEzpS6P:mjDGPnkqc8FAM32z92TtwFS6P
- TLSH T1D3E4012675C74B73C60312329A1B53A0AF769D6443B21D3231AB778D2DF27A053EBAD1
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
6/10
Malware Config
Signatures
- Enumerates connected drives 3 TTPs 46 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\D: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\D: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\X: msiexec.exe - Drops file in Windows directory 12 IoCs
description ioc Process File created C:\Windows\Installer\inprogressinstallinfo.ipi msiexec.exe File created C:\Windows\Installer\SourceHash{2AAF54AF-F0E3-425C-996B-52A1EF5BE13D} msiexec.exe File opened for modification C:\Windows\Installer\MSI8CB1.tmp msiexec.exe File created C:\Windows\Installer\e5a86f6.msi msiexec.exe File created C:\Windows\SystemTemp\~DF3F91D75E1CBB2E7B.TMP msiexec.exe File created C:\Windows\Installer\e5a86f4.msi msiexec.exe File opened for modification C:\Windows\Installer\e5a86f4.msi msiexec.exe File created C:\Windows\SystemTemp\~DF5AA3C1381003EF07.TMP msiexec.exe File created C:\Windows\SystemTemp\~DF5A673D31507BE875.TMP msiexec.exe File created C:\Windows\SystemTemp\~DFAA4B70277517685A.TMP msiexec.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log msiexec.exe File opened for modification C:\Windows\Installer\ msiexec.exe - Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs
pid Process 6076 msiexec.exe - Checks SCSI registry key(s) 3 TTPs 5 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters vssvc.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters vssvc.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 0000000004000000ad3b1fc6af0fc0350000000000000000000000000000000000000000000000000000000000000000000000000000000000001071020000000000c0120000000000000000000000002701010000883801ad3b1fc60000000000001071020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d0830200000000006025c501000000000000000000000700010000e84101ad3b1fc6000000000000d08302000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030a9c701000000000000050000000000000000000000070001000098d4e3ad3b1fc600000000000030a9c7010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030a9cc0100000000000005000000000000000000000007000100009854e6ad3b1fc600000000000030a9cc01000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe - Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 5216 msiexec.exe 5216 msiexec.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 6076 msiexec.exe Token: SeIncreaseQuotaPrivilege 6076 msiexec.exe Token: SeSecurityPrivilege 5216 msiexec.exe Token: SeCreateTokenPrivilege 6076 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 6076 msiexec.exe Token: SeLockMemoryPrivilege 6076 msiexec.exe Token: SeIncreaseQuotaPrivilege 6076 msiexec.exe Token: SeMachineAccountPrivilege 6076 msiexec.exe Token: SeTcbPrivilege 6076 msiexec.exe Token: SeSecurityPrivilege 6076 msiexec.exe Token: SeTakeOwnershipPrivilege 6076 msiexec.exe Token: SeLoadDriverPrivilege 6076 msiexec.exe Token: SeSystemProfilePrivilege 6076 msiexec.exe Token: SeSystemtimePrivilege 6076 msiexec.exe Token: SeProfSingleProcessPrivilege 6076 msiexec.exe Token: SeIncBasePriorityPrivilege 6076 msiexec.exe Token: SeCreatePagefilePrivilege 6076 msiexec.exe Token: SeCreatePermanentPrivilege 6076 msiexec.exe Token: SeBackupPrivilege 6076 msiexec.exe Token: SeRestorePrivilege 6076 msiexec.exe Token: SeShutdownPrivilege 6076 msiexec.exe Token: SeDebugPrivilege 6076 msiexec.exe Token: SeAuditPrivilege 6076 msiexec.exe Token: SeSystemEnvironmentPrivilege 6076 msiexec.exe Token: SeChangeNotifyPrivilege 6076 msiexec.exe Token: SeRemoteShutdownPrivilege 6076 msiexec.exe Token: SeUndockPrivilege 6076 msiexec.exe Token: SeSyncAgentPrivilege 6076 msiexec.exe Token: SeEnableDelegationPrivilege 6076 msiexec.exe Token: SeManageVolumePrivilege 6076 msiexec.exe Token: SeImpersonatePrivilege 6076 msiexec.exe Token: SeCreateGlobalPrivilege 6076 msiexec.exe Token: SeBackupPrivilege 2236 vssvc.exe Token: SeRestorePrivilege 2236 vssvc.exe Token: SeAuditPrivilege 2236 vssvc.exe Token: SeBackupPrivilege 5216 msiexec.exe Token: SeRestorePrivilege 5216 msiexec.exe Token: SeRestorePrivilege 5216 msiexec.exe Token: SeTakeOwnershipPrivilege 5216 msiexec.exe Token: SeRestorePrivilege 5216 msiexec.exe Token: SeTakeOwnershipPrivilege 5216 msiexec.exe Token: SeRestorePrivilege 5216 msiexec.exe Token: SeTakeOwnershipPrivilege 5216 msiexec.exe Token: SeRestorePrivilege 5216 msiexec.exe Token: SeTakeOwnershipPrivilege 5216 msiexec.exe Token: SeRestorePrivilege 5216 msiexec.exe Token: SeTakeOwnershipPrivilege 5216 msiexec.exe Token: SeRestorePrivilege 5216 msiexec.exe Token: SeTakeOwnershipPrivilege 5216 msiexec.exe Token: SeRestorePrivilege 5216 msiexec.exe Token: SeTakeOwnershipPrivilege 5216 msiexec.exe Token: SeRestorePrivilege 5216 msiexec.exe Token: SeTakeOwnershipPrivilege 5216 msiexec.exe Token: SeRestorePrivilege 5216 msiexec.exe Token: SeTakeOwnershipPrivilege 5216 msiexec.exe Token: SeRestorePrivilege 5216 msiexec.exe Token: SeTakeOwnershipPrivilege 5216 msiexec.exe Token: SeRestorePrivilege 5216 msiexec.exe Token: SeTakeOwnershipPrivilege 5216 msiexec.exe Token: SeRestorePrivilege 5216 msiexec.exe Token: SeTakeOwnershipPrivilege 5216 msiexec.exe Token: SeRestorePrivilege 5216 msiexec.exe Token: SeTakeOwnershipPrivilege 5216 msiexec.exe Token: SeRestorePrivilege 5216 msiexec.exe - Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 6076 msiexec.exe 6076 msiexec.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 6076 msiexec.exe 5216 msiexec.exe - Suspicious use of WriteProcessMemory 1 IoCs
description pid Process procid_target PID 5216 wrote to memory of 2696 5216 msiexec.exe 94 - Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Windows\system32\msiexec.exemsiexec.exe /I C:\Users\Admin\AppData\Local\Temp\MacroGamer_v275_Setup.msi1⤵
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:6076
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5216 -
C:\Windows\system32\srtasks.exeC:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:22⤵PID:2696
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:2236
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Config.Msi\e5a86f5.rbs
- Size 10KB
- SHA256 df80a6442c0bd288c438ea4ee8101d870fd66e17ae4e24d0fbdb7aaefad7706b
- MD5 b4993052425791368832bdbcc5f7c35a
- SHA1 4dd919493e55397e706c3598e4dd5ea274b2e226
- SHA512 6e31bf72ffeca2d14fe0bae773c8d1f70df9c316ddf3b2ce04ad2a220cd69782f932ee4b0a6f45f863e7cf1e928c48751ab7e0ce788e92173dc3445e0889d0f8
- SSDEEP 192:IrzKXMik7VsboGBLoeLczYRMSWC0+21T/6O6lOIAmT/6O6lOdIGAYPAOlmrTnA4D:IrmXMH7VsboGBLoeLcYRMSST/6O6lOmA
- TLSH T146324F01611584E6F4A51A3293230784BB72D3E79792771B4C8B983C8FA3B99CE964DB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Microsoft\Installer\{2AAF54AF-F0E3-425C-996B-52A1EF5BE13D}\_36B21AED3F98F043ACBA3A.exe
- Size 2KB
- SHA256 dafa4e0ffbcd14a47ffef97037660be4c9bd51d573f31c97d0247e0fbd29cd01
- MD5 ea20f13a4b9cf60cf79804edfa0b514f
- SHA1 9cbafb307dadd8b6d7d1c90c4be125fbbae460aa
- SHA512 b10747f390aae73d6bfa36f9412e2985b2c9c3671baa5268d0e8232a024659195f2a0170a825e4f63aaa503d83ca1d36eb6858d3655ee782f651a6741829cd01
- TLSH T1A751BFB3355E8CEAD14726345C51CBD87621BDAB89283C3AB4E737AE54346D08D8E6E0
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\Installer\e5a86f4.msi
- Size 667KB
- SHA256 d82a1cffc6e982b07c0aef61b96b4c36ebd921949c9d4c45a31781539ae443e8
- MD5 f7a9d1bf05f8f0e2a1cc6cafd0985070
- SHA1 a9f931e9f7c8a7964d19af9b5f938c2dbfcb44e4
- SHA512 c30df08a315c7f161646269254645a2825de1108af85d48cfad8a1e88a6f70c7259235a8eaf235f548d0647760e535dfeb3b43d719398e2f9acb75274b865e6c
- SSDEEP 12288:mjDGPXXktIro8FAPUxv9gvIp2z92NFttMDWEzpS6P:mjDGPnkqc8FAM32z92TtwFS6P
- TLSH T1D3E4012675C74B73C60312329A1B53A0AF769D6443B21D3231AB778D2DF27A053EBAD1
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
- Size 26.1MB
- SHA256 4e44618a52c0eaa439608f524a6ad957c3f827606575c8776466dfe6719a93ee
- MD5 00698fc2e5da8a5620242c9e6908a7f4
- SHA1 b672fcd209f5abb8b2858176641bf68573ea1c0d
- SHA512 471721a57d336dff73d21eaef05fce0ef04d67b23510c030ba5dfd8363f033d764d8bf005f4c9c072c902144ea1b1923d752978138b57fc95793742b5f37b4b9
- SSDEEP 24576:oFo3DMP7doO/vvTL/Sg88iFQvrumHb7P0BKudxSUKpyKpb9cMoRWclmd4+2:GHY
- TLSH T14757B42436F92200E7F79E3DA8F06A234D397D5BAC15DE8D45511B4E0822F71E872F6A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path \??\Volume{c61f3bad-0000-0000-0000-d08302000000}\System Volume Information\SPP\OnlineMetadataCache\{df768211-66bb-41d8-9c3d-712254c8b388}_OnDiskSnapshotProp
- Size 6KB
- SHA256 8eebfdfd42dd09ee4491c82b60d57fa55528bd4a874ed0cc839f8f1d53bf22fa
- MD5 bbcf94d6681678ee792269f5b4894f37
- SHA1 65ea448caf604221036389facd541eb16f9039f5
- SHA512 02bed7b0bba722372bb4c78f25abfad62a5e2bc50c9663413cbc02d69e326c3a63031201e32ef759a88ce195811988cb7704bfe0ea77985c58fda78dd24e9947
- SSDEEP 96:F7N6O7vCvc6DD84LTHzbOHXOHBlBRQn8Sc9XE56tOSVQpu:/6Geb++uVm
- TLSH T102D188085AF54311E2B3AB3229F14557A877B911FF33CB8E0198238E2671A10F935F6B
- MD5 SHA1 SHA512 SSDEEP TLSH