Analysis
- geolocation tags
eueuropefrfrance - max time kernel
900s - max time network
480s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
03/08/2026, 13:12
Behavioral task
behavioral1
Sample
GT600_GTX3_GTX4_GTX9_GTX1_Version20220812.exe
Resource
win11-20260513-en
windows11-21h2-x64
17 signatures
900 seconds
Behavioral task
behavioral2
Sample
GT600_GTX3_GTX4_GTX9_GTX1_Version20220812.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
6 signatures
900 seconds
General
- Target GT600_GTX3_GTX4_GTX9_GTX1_Version20220812.exe
- Size 6.4MB
- Sample260803-qfs8caaa67
- SHA256 83532c917061b7c215240c80f23d27f8ba43d1d396c175e3853fdadcf764e070
- MD5 ed09263905a615e20af027828efeae55
- SHA1 1a2c3c1b8a4612d5e9c051d0a32d5f897c2dc2d5
- SHA512 a6bc8d78162601d7fb819ad4a35720e7d37562f3f9713cf07e428de7454536dd2da493845f68b01df457f1a8c211b20329bf31d9a0aca670ca1422d7c1917baa
- SSDEEP 196608:Ulq+1NHsR86QSgFaz9Skl6ab0hRXg3PX1cormY4Ei+:gHsR86UFug7ab03g3PlCYe+
- TLSH T1096602137A41943FD2B202328C6FAE6042A97E7759314657B7A8FF2D2EF0481B917F16
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
6/10
Malware Config
Signatures
- Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\B: MSIEXEC.EXE File opened (read-only) \??\P: MSIEXEC.EXE File opened (read-only) \??\U: MSIEXEC.EXE File opened (read-only) \??\V: MSIEXEC.EXE File opened (read-only) \??\D: MSIEXEC.EXE File opened (read-only) \??\T: MSIEXEC.EXE File opened (read-only) \??\Y: MSIEXEC.EXE File opened (read-only) \??\Z: MSIEXEC.EXE File opened (read-only) \??\G: MSIEXEC.EXE File opened (read-only) \??\H: MSIEXEC.EXE File opened (read-only) \??\J: MSIEXEC.EXE File opened (read-only) \??\L: MSIEXEC.EXE File opened (read-only) \??\M: MSIEXEC.EXE File opened (read-only) \??\N: MSIEXEC.EXE File opened (read-only) \??\O: MSIEXEC.EXE File opened (read-only) \??\R: MSIEXEC.EXE File opened (read-only) \??\I: MSIEXEC.EXE File opened (read-only) \??\K: MSIEXEC.EXE File opened (read-only) \??\Q: MSIEXEC.EXE File opened (read-only) \??\S: MSIEXEC.EXE File opened (read-only) \??\W: MSIEXEC.EXE File opened (read-only) \??\X: MSIEXEC.EXE File opened (read-only) \??\A: MSIEXEC.EXE - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language GT600_GTX3_GTX4_GTX9_GTX1_Version20220812.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MSIEXEC.EXE - Suspicious use of AdjustPrivilegeToken 32 IoCs
description pid Process Token: SeShutdownPrivilege 1356 MSIEXEC.EXE Token: SeIncreaseQuotaPrivilege 1356 MSIEXEC.EXE Token: SeSecurityPrivilege 4608 msiexec.exe Token: SeCreateTokenPrivilege 1356 MSIEXEC.EXE Token: SeAssignPrimaryTokenPrivilege 1356 MSIEXEC.EXE Token: SeLockMemoryPrivilege 1356 MSIEXEC.EXE Token: SeIncreaseQuotaPrivilege 1356 MSIEXEC.EXE Token: SeMachineAccountPrivilege 1356 MSIEXEC.EXE Token: SeTcbPrivilege 1356 MSIEXEC.EXE Token: SeSecurityPrivilege 1356 MSIEXEC.EXE Token: SeTakeOwnershipPrivilege 1356 MSIEXEC.EXE Token: SeLoadDriverPrivilege 1356 MSIEXEC.EXE Token: SeSystemProfilePrivilege 1356 MSIEXEC.EXE Token: SeSystemtimePrivilege 1356 MSIEXEC.EXE Token: SeProfSingleProcessPrivilege 1356 MSIEXEC.EXE Token: SeIncBasePriorityPrivilege 1356 MSIEXEC.EXE Token: SeCreatePagefilePrivilege 1356 MSIEXEC.EXE Token: SeCreatePermanentPrivilege 1356 MSIEXEC.EXE Token: SeBackupPrivilege 1356 MSIEXEC.EXE Token: SeRestorePrivilege 1356 MSIEXEC.EXE Token: SeShutdownPrivilege 1356 MSIEXEC.EXE Token: SeDebugPrivilege 1356 MSIEXEC.EXE Token: SeAuditPrivilege 1356 MSIEXEC.EXE Token: SeSystemEnvironmentPrivilege 1356 MSIEXEC.EXE Token: SeChangeNotifyPrivilege 1356 MSIEXEC.EXE Token: SeRemoteShutdownPrivilege 1356 MSIEXEC.EXE Token: SeUndockPrivilege 1356 MSIEXEC.EXE Token: SeSyncAgentPrivilege 1356 MSIEXEC.EXE Token: SeEnableDelegationPrivilege 1356 MSIEXEC.EXE Token: SeManageVolumePrivilege 1356 MSIEXEC.EXE Token: SeImpersonatePrivilege 1356 MSIEXEC.EXE Token: SeCreateGlobalPrivilege 1356 MSIEXEC.EXE - Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1356 MSIEXEC.EXE - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 1356 MSIEXEC.EXE 4608 msiexec.exe - Suspicious use of WriteProcessMemory 1 IoCs
description pid Process procid_target PID 2876 wrote to memory of 1356 2876 GT600_GTX3_GTX4_GTX9_GTX1_Version20220812.exe 89
Processes
-
C:\Users\Admin\AppData\Local\Temp\GT600_GTX3_GTX4_GTX9_GTX1_Version20220812.exe"C:\Users\Admin\AppData\Local\Temp\GT600_GTX3_GTX4_GTX9_GTX1_Version20220812.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2876 -
C:\Windows\SysWOW64\MSIEXEC.EXEMSIEXEC.EXE /i "C:\Users\Admin\AppData\Local\Temp\{144BB9C8-4283-4EBF-B408-DC1059A8124F}\英斯特A704x_5in1游戏鼠标.msi" SETUPEXEDIR="C:\Users\Admin\AppData\Local\Temp" SETUPEXENAME="GT600_GTX3_GTX4_GTX9_GTX1_Version20220812.exe"2⤵
- Enumerates connected drives
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:1356
-
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:4608
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k GPSvcGroup1⤵PID:5460
-
C:\Windows\System32\SecurityHealthHost.exe\\?\C:\Windows\System32\SecurityHealthHost.exe {08728914-3F57-4D52-9E31-49DAECA5A80A} -Embedding1⤵PID:5108
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\{144BB9C8-4283-4EBF-B408-DC1059A8124F}\0x0804.ini
- Size 10KB
- SHA256 792e2ed82640e22f9d86f19ec34fd4bb89450b8b874edeb4fdcbe07935a63110
- MD5 6f4c6d5b044895684a1e11bfe98b2abd
- SHA1 45efec6e70e66a248b25ed1437bc336b846f6f19
- SHA512 04727eb781330fd11c2b3adecdece5fa6ed9501061497e41efe9ed528c2e95a724ad8e6d02180f31c6e810c28f94751e6944fcdb6d7415c338bbf5cf82726973
- SSDEEP 192:Nw8vvP/KID2jmYt1bRNJQYRyljRpRIHDJCL0PvrmeAdovo/BVEU3EDa+7VUX7AoU:7XD6bP9PvabCU6l7
- TLSH T15D22215C0A8A0F2ED3F24E05E8E84B13634378496D5C9A4586D98FD826E1E15F077BEF
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\{144BB9C8-4283-4EBF-B408-DC1059A8124F}\英斯特A704x_5in1游戏鼠标.msi
- Size 5.8MB
- SHA256 6f41e604c25e3759d73756158fe2dbcd045c4787b90786f893ab3c2033c7ea4e
- MD5 bf90b3dbdc53aedfef4d99596e16ac9c
- SHA1 bf23a8794a64be3de7e910f416e90ebb10ddf6e3
- SHA512 00103f1f4188c81fbea2172a810f47353404393bb1afa4ca59c82b218dac81ee736f54f208682f623aaa9d55a506c91611dcd507e1df1bff61c3b331c7fe75d2
- SSDEEP 98304:FYyFJ8ikFT/8zAmGiifj8coMbCr8MT87GiCt+ICpyl74Gtu:BJ8/d/8zvir8Xr8MYCtYpU7L
- TLSH T1B756011337918477D7BD023D89ABD621072938715B2181C373BA6B7E2FB2AD1E972742
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\~AF46.tmp
- Size 5KB
- SHA256 6430febac8b73a904ace74d9ebd990df6a7163320fb610a52997caa30178867c
- MD5 9094873a4c56687aae1d581023a085c6
- SHA1 dc7bb7aeac001e02c061043a03dfc695b0df225d
- SHA512 4fd5e17d8e30a70da1068e4a0b09e5cde5319ba2e50414d10db2a2d50e51271aa5bd838e958906960c3a0a2afc7f09e8a15c55c978ea4956be39d1f72cd5e068
- SSDEEP 96:rEhkMaEhP2cqejON/XsEbFWaEPRhS+gWPQPgWRGTwQbPrvnp6kY05w7tCYOvlnAb:Yhci2ZcuQaEZhdxoIWRGcQbPr/p0050B
- TLSH T1FDB1AD172BE6005FFAF3AB45DEF4443797263C15282CCA1C55D1835A28F2D824A27BEB
- MD5 SHA1 SHA512 SSDEEP TLSH