Overview

overview

7

Static

static

1

playit-win...ed.msi

windows11-ltsc_2024-x64

7

Analysis

  • user interaction
    yes
  • max time kernel
    53s
  • max time network
    58s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260710-de
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260710-delocale:de-deos:windows11-ltsc_2024-x64systemwindows
  • submitted
    04/08/2026, 16:46

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    playit-windows-x86_64-signed.msi
  • Size 5.8MB
  • Sample260804-t9ylpssyet
  • SHA256 18c022281fcfe578fb0d614ac6dc1d36cd6885b4a5439b97655768cd2a82bdc1
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
discoverypersistenceprivilege_escalationransomware

Malware Config

Signatures

  • Creates a file in the Startup directory 1 TTPs 1 IoCs

    A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

    persistenceprivilege_escalation
  • Executes dropped EXE 7 IoCs
  • Loads dropped DLL 4 IoCs
  • Modifies file permissions 1 TTPs 1 IoCs
    discovery
  • Badlisted process makes network request 1 IoCs

    Network request originating from process or tool commonly abused by malware.

  • Enumerates connected drives 3 TTPs 46 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in Program Files directory 5 IoCs
  • Drops file in Windows directory 18 IoCs
  • Launches sc.exe 2 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs
    persistenceprivilege_escalation
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 5 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Modifies data under HKEY_USERS 3 IoCs
  • Modifies registry class 25 IoCs
  • Suspicious behavior: EnumeratesProcesses 8 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 3 IoCs
  • Suspicious use of SendNotifyMessage 1 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs
  • Suspicious use of WriteProcessMemory 11 IoCs
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Windows\system32\msiexec.exe
    msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\playit-windows-x86_64-signed.msi
    1⤵
    • Badlisted process makes network request
    • Enumerates connected drives
    • Event Triggered Execution: Installer Packages
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SetWindowsHookEx
    PID:3872
  • C:\Windows\system32\msiexec.exe
    C:\Windows\system32\msiexec.exe /V
    1⤵
    • Enumerates connected drives
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Modifies data under HKEY_USERS
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:5920
    • C:\Windows\system32\srtasks.exe
      C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
      2⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:4764
    • C:\Windows\syswow64\MsiExec.exe
      C:\Windows\syswow64\MsiExec.exe -Embedding 2E9668CEC4A7EF2F006610244D245E87
      2⤵
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:2524
      • C:\Program Files\playit_gg\bin\playitd-tray.exe
        "C:\Program Files\playit_gg\bin\playitd-tray.exe"
        3⤵
        • Executes dropped EXE
        PID:4160
    • C:\Windows\syswow64\MsiExec.exe
      C:\Windows\syswow64\MsiExec.exe -Embedding A89C7B6A496F6859F615B39566970317 E Global\MSI0000
      2⤵
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of SetWindowsHookEx
      PID:1948
    • C:\Program Files\playit_gg\bin\playitd-windows-setup.exe
      "C:\Program Files\playit_gg\bin\playitd-windows-setup.exe" apply-installer-permissions S-1-5-21-2301830172-776172150-2531349243-1000
      2⤵
      • Executes dropped EXE
      • Suspicious use of WriteProcessMemory
      PID:3656
      • C:\Windows\system32\icacls.exe
        "icacls.exe" C:\ProgramData\playit_gg\logs /grant *S-1-5-11:(OI)(CI)M
        3⤵
        • Modifies file permissions
        PID:2696
      • C:\Windows\system32\sc.exe
        "sc.exe" sdshow playitd
        3⤵
        • Launches sc.exe
        • Suspicious use of AdjustPrivilegeToken
        PID:1904
      • C:\Windows\system32\sc.exe
        "sc.exe" sdset playitd D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)(A;;LCRPWPLO;;;AU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)
        3⤵
        • Launches sc.exe
        • Suspicious use of AdjustPrivilegeToken
        PID:1892
    • C:\Program Files\playit_gg\bin\playitd-windows-setup.exe
      "C:\Program Files\playit_gg\bin\playitd-windows-setup.exe" migrate-v17-secret S-1-5-21-2301830172-776172150-2531349243-1000
      2⤵
      • Executes dropped EXE
      PID:1728
    • C:\Program Files\playit_gg\bin\playitd-windows-setup.exe
      "C:\Program Files\playit_gg\bin\playitd-windows-setup.exe" write-installed-user-sid
      2⤵
      • Executes dropped EXE
      PID:1140
    • C:\Program Files\playit_gg\bin\playitd-windows-setup.exe
      "C:\Program Files\playit_gg\bin\playitd-windows-setup.exe" ensure-startup-shortcut
      2⤵
      • Creates a file in the Startup directory
      • Executes dropped EXE
      PID:2388
  • C:\Windows\system32\vssvc.exe
    C:\Windows\system32\vssvc.exe
    1⤵
    • Checks SCSI registry key(s)
    • Suspicious use of AdjustPrivilegeToken
    PID:2080
  • C:\Program Files\playit_gg\bin\playitd-service.exe
    "C:\Program Files\playit_gg\bin\playitd-service.exe"
    1⤵
    • Executes dropped EXE
    PID:3184
  • C:\PROGRA~1\PLAYIT~1\bin\playitd-tray.exe
    C:\PROGRA~1\PLAYIT~1\bin\PLAYIT~1.EXE
    1⤵
    • Executes dropped EXE
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    PID:3028

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        e5985b2.rbs
        • Path C:\Config.Msi\e5985b2.rbs
        • Size 10KB
        • SHA256 2f7a204bcfdf619a8708fea2f5b4108e534cde80d7d363dc863ef4be5e0a1deb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        playit.exe
        • Path C:\Program Files\playit_gg\bin\playit.exe
        • Size 4.3MB
        • SHA256 4fe0c01b1becbf5f096878d74de45c3a474435330abc1193b891e788421cb395
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        playitd-service.exe
        • Path C:\Program Files\playit_gg\bin\playitd-service.exe
        • Size 892KB
        • SHA256 c6d8dd683caa5591ca4fe07f23fc038b291f222b70b030ed4877d0d9d7ece060
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        playitd-tray.exe
        • Path C:\Program Files\playit_gg\bin\playitd-tray.exe
        • Size 1.3MB
        • SHA256 e6bde8724d8c15d73b27b6f8c7d57d1cbe17f5216ee5424731d4687899c3d814
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        playitd-windows-setup.exe
        • Path C:\Program Files\playit_gg\bin\playitd-windows-setup.exe
        • Size 365KB
        • SHA256 126f5e37d3ca32d1f79ba6d0be706120c8aeba890b6794a96462abdc0eda859f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        installed_user.sid
        • Path C:\ProgramData\playit_gg\installed_user.sid
        • Size 46B
        • SHA256 df067974effbad544fb1ba5cad2d8d992525260fdcadd2ae642f4f4acec62f8f
        • MD5 SHA1 SHA512
        Submit Download

        playit-installer.log
        • Path C:\ProgramData\playit_gg\logs\playit-installer.log
        • Size 189B
        • SHA256 a9616b35d1a34379d27384ca76bc6a340587ff68e5c51362bb4b41c569efbc54
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        playit-installer.log
        • Path C:\ProgramData\playit_gg\logs\playit-installer.log
        • Size 285B
        • SHA256 6043e089322469bcbc748519791584a427e72d09a0936dd0d946f6a318d3bdb5
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        playit-installer.log
        • Path C:\ProgramData\playit_gg\logs\playit-installer.log
        • Size 380B
        • SHA256 672717252259c1c57416ccae2530da4a2baa866c7cb3384409991afad3d346a9
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        MSI91e5c.LOG
        • Path C:\Users\Admin\AppData\Local\Temp\MSI91e5c.LOG
        • Size 48KB
        • SHA256 2f22bb3652e87e6c54652881f0695edcd0547f197cf8db3b06f0659dfe7cca8a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Playit Tray.lnk
        • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Playit Tray.lnk
        • Size 1KB
        • SHA256 7e09d914b296e8d7844de9e92c3c54ffc64ce655640e484bfc4e23f70d9e5e0f
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        MSI8CC6.tmp
        • Path C:\Windows\Installer\MSI8CC6.tmp
        • Size 234KB
        • SHA256 78860e15e474cc2af7ad6e499a8971b6b8197afb8e49a1b9eaaa392e4378f3a5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        e5985b1.msi
        • Path C:\Windows\Installer\e5985b1.msi
        • Size 5.8MB
        • SHA256 18c022281fcfe578fb0d614ac6dc1d36cd6885b4a5439b97655768cd2a82bdc1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        metadata-2
        • Path \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
        • Size 26.1MB
        • SHA256 5defcd11d5124d245dcbcfc377a31f15b90665f58d563e3d5cac9c0192142269
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        {f1305e66-b758-4a5c-a6c6-e80e61af7b27}_OnDiskSnapshotProp
        • Path \??\Volume{5d76dc85-0000-0000-0000-d08302000000}\System Volume Information\SPP\OnlineMetadataCache\{f1305e66-b758-4a5c-a6c6-e80e61af7b27}_OnDiskSnapshotProp
        • Size 6KB
        • SHA256 39e18a7b850daf5fb95c25f4c368afb74d2954b46fd9fbe78fd6f683c46a2a41
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download