Analysis
- max time kernel
599s - max time network
478s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
09/08/2026, 23:50
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
MacroGamer_v275_Setup.msi
Resource
win10v2004-20260513-en
windows10-2004-x64
16 signatures
600 seconds
Behavioral task
behavioral2
Sample
MacroGamer_v275_Setup.msi
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
10 signatures
600 seconds
General
- Target MacroGamer_v275_Setup.msi
- Size 667KB
- Sample260809-3v3rjsxeqc
- SHA256 d82a1cffc6e982b07c0aef61b96b4c36ebd921949c9d4c45a31781539ae443e8
- MD5 f7a9d1bf05f8f0e2a1cc6cafd0985070
- SHA1 a9f931e9f7c8a7964d19af9b5f938c2dbfcb44e4
- SHA512 c30df08a315c7f161646269254645a2825de1108af85d48cfad8a1e88a6f70c7259235a8eaf235f548d0647760e535dfeb3b43d719398e2f9acb75274b865e6c
- SSDEEP 12288:mjDGPXXktIro8FAPUxv9gvIp2z92NFttMDWEzpS6P:mjDGPnkqc8FAM32z92TtwFS6P
- TLSH T1D3E4012675C74B73C60312329A1B53A0AF769D6443B21D3231AB778D2DF27A053EBAD1
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
6/10
Malware Config
Signatures
- Enumerates connected drives 3 TTPs 46 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\D: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\D: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\Q: msiexec.exe - Drops file in Windows directory 12 IoCs
description ioc Process File created C:\Windows\Installer\e5a5015.msi msiexec.exe File opened for modification C:\Windows\Installer\e5a5015.msi msiexec.exe File opened for modification C:\Windows\Installer\ msiexec.exe File created C:\Windows\SystemTemp\~DF49EC874FEEE04528.TMP msiexec.exe File created C:\Windows\SystemTemp\~DF400CC4A1D35E6B1B.TMP msiexec.exe File opened for modification C:\Windows\Installer\MSI548A.tmp msiexec.exe File created C:\Windows\SystemTemp\~DFD30EA03A35687B5F.TMP msiexec.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log msiexec.exe File created C:\Windows\Installer\inprogressinstallinfo.ipi msiexec.exe File created C:\Windows\Installer\SourceHash{2AAF54AF-F0E3-425C-996B-52A1EF5BE13D} msiexec.exe File created C:\Windows\Installer\e5a5017.msi msiexec.exe File created C:\Windows\SystemTemp\~DF7F4AFEBD94153ACA.TMP msiexec.exe - Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs
pid Process 4536 msiexec.exe - Checks SCSI registry key(s) 3 TTPs 5 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters vssvc.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters vssvc.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 000000000400000067831fc6f5c7bf350000000000000000000000000000000000000000000000000000000000000000000000000000000000001071020000000000c012000000000000000000000000270101000088380167831fc60000000000001071020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d0830200000000006025c501000000000000000000000700010000e8410167831fc6000000000000d08302000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030a9c701000000000000050000000000000000000000070001000098d4e367831fc600000000000030a9c7010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030a9cc0100000000000005000000000000000000000007000100009854e667831fc600000000000030a9cc01000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe - Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 5552 msiexec.exe 5552 msiexec.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 4536 msiexec.exe Token: SeIncreaseQuotaPrivilege 4536 msiexec.exe Token: SeSecurityPrivilege 5552 msiexec.exe Token: SeCreateTokenPrivilege 4536 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 4536 msiexec.exe Token: SeLockMemoryPrivilege 4536 msiexec.exe Token: SeIncreaseQuotaPrivilege 4536 msiexec.exe Token: SeMachineAccountPrivilege 4536 msiexec.exe Token: SeTcbPrivilege 4536 msiexec.exe Token: SeSecurityPrivilege 4536 msiexec.exe Token: SeTakeOwnershipPrivilege 4536 msiexec.exe Token: SeLoadDriverPrivilege 4536 msiexec.exe Token: SeSystemProfilePrivilege 4536 msiexec.exe Token: SeSystemtimePrivilege 4536 msiexec.exe Token: SeProfSingleProcessPrivilege 4536 msiexec.exe Token: SeIncBasePriorityPrivilege 4536 msiexec.exe Token: SeCreatePagefilePrivilege 4536 msiexec.exe Token: SeCreatePermanentPrivilege 4536 msiexec.exe Token: SeBackupPrivilege 4536 msiexec.exe Token: SeRestorePrivilege 4536 msiexec.exe Token: SeShutdownPrivilege 4536 msiexec.exe Token: SeDebugPrivilege 4536 msiexec.exe Token: SeAuditPrivilege 4536 msiexec.exe Token: SeSystemEnvironmentPrivilege 4536 msiexec.exe Token: SeChangeNotifyPrivilege 4536 msiexec.exe Token: SeRemoteShutdownPrivilege 4536 msiexec.exe Token: SeUndockPrivilege 4536 msiexec.exe Token: SeSyncAgentPrivilege 4536 msiexec.exe Token: SeEnableDelegationPrivilege 4536 msiexec.exe Token: SeManageVolumePrivilege 4536 msiexec.exe Token: SeImpersonatePrivilege 4536 msiexec.exe Token: SeCreateGlobalPrivilege 4536 msiexec.exe Token: SeBackupPrivilege 4324 vssvc.exe Token: SeRestorePrivilege 4324 vssvc.exe Token: SeAuditPrivilege 4324 vssvc.exe Token: SeBackupPrivilege 5552 msiexec.exe Token: SeRestorePrivilege 5552 msiexec.exe Token: SeRestorePrivilege 5552 msiexec.exe Token: SeTakeOwnershipPrivilege 5552 msiexec.exe Token: SeRestorePrivilege 5552 msiexec.exe Token: SeTakeOwnershipPrivilege 5552 msiexec.exe Token: SeRestorePrivilege 5552 msiexec.exe Token: SeTakeOwnershipPrivilege 5552 msiexec.exe Token: SeRestorePrivilege 5552 msiexec.exe Token: SeTakeOwnershipPrivilege 5552 msiexec.exe Token: SeRestorePrivilege 5552 msiexec.exe Token: SeTakeOwnershipPrivilege 5552 msiexec.exe Token: SeRestorePrivilege 5552 msiexec.exe Token: SeTakeOwnershipPrivilege 5552 msiexec.exe Token: SeRestorePrivilege 5552 msiexec.exe Token: SeTakeOwnershipPrivilege 5552 msiexec.exe Token: SeRestorePrivilege 5552 msiexec.exe Token: SeTakeOwnershipPrivilege 5552 msiexec.exe Token: SeRestorePrivilege 5552 msiexec.exe Token: SeTakeOwnershipPrivilege 5552 msiexec.exe Token: SeRestorePrivilege 5552 msiexec.exe Token: SeTakeOwnershipPrivilege 5552 msiexec.exe Token: SeRestorePrivilege 5552 msiexec.exe Token: SeTakeOwnershipPrivilege 5552 msiexec.exe Token: SeRestorePrivilege 5552 msiexec.exe Token: SeTakeOwnershipPrivilege 5552 msiexec.exe Token: SeRestorePrivilege 5552 msiexec.exe Token: SeTakeOwnershipPrivilege 5552 msiexec.exe Token: SeRestorePrivilege 5552 msiexec.exe - Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 4536 msiexec.exe 4536 msiexec.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 4536 msiexec.exe 5552 msiexec.exe - Suspicious use of WriteProcessMemory 1 IoCs
description pid Process procid_target PID 5552 wrote to memory of 4700 5552 msiexec.exe 94 - Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Windows\system32\msiexec.exemsiexec.exe /I C:\Users\Admin\AppData\Local\Temp\MacroGamer_v275_Setup.msi1⤵
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:4536
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5552 -
C:\Windows\system32\srtasks.exeC:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:22⤵PID:4700
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:4324
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k GPSvcGroup1⤵PID:3444
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Config.Msi\e5a5016.rbs
- Size 10KB
- SHA256 7df7b0a83901fe59a3f562dce2e90a584272d45c16ceedb4eac07ab331a627f5
- MD5 f5cd6a769750653b63ece5d5e973480f
- SHA1 3da261fa5d6b5d9c83de4bfab0fe26177f86bd41
- SHA512 fa7214305899e1c00e936b71050e8fd8415bf612145571206c25705daacf2bc382a604288cae405f2f34e998a8a0cb95931af7178b737600dde4aba8087fc0f2
- SSDEEP 192:wrzKXMik7VsboGBLoeLczYRMSWCT1TO6O6lOIAmTO6O6lO5AvOH4/pN:wrmXMH7VsboGBLoeLcYRMSXTO6O6lOm1
- TLSH T116325302A48484E2E8E71A32935747847B22D3E65791674B0C4FC83C8F9379DDFAA4DB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Microsoft\Installer\{2AAF54AF-F0E3-425C-996B-52A1EF5BE13D}\_36B21AED3F98F043ACBA3A.exe
- Size 2KB
- SHA256 dafa4e0ffbcd14a47ffef97037660be4c9bd51d573f31c97d0247e0fbd29cd01
- MD5 ea20f13a4b9cf60cf79804edfa0b514f
- SHA1 9cbafb307dadd8b6d7d1c90c4be125fbbae460aa
- SHA512 b10747f390aae73d6bfa36f9412e2985b2c9c3671baa5268d0e8232a024659195f2a0170a825e4f63aaa503d83ca1d36eb6858d3655ee782f651a6741829cd01
- TLSH T1A751BFB3355E8CEAD14726345C51CBD87621BDAB89283C3AB4E737AE54346D08D8E6E0
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\Installer\e5a5015.msi
- Size 667KB
- SHA256 d82a1cffc6e982b07c0aef61b96b4c36ebd921949c9d4c45a31781539ae443e8
- MD5 f7a9d1bf05f8f0e2a1cc6cafd0985070
- SHA1 a9f931e9f7c8a7964d19af9b5f938c2dbfcb44e4
- SHA512 c30df08a315c7f161646269254645a2825de1108af85d48cfad8a1e88a6f70c7259235a8eaf235f548d0647760e535dfeb3b43d719398e2f9acb75274b865e6c
- SSDEEP 12288:mjDGPXXktIro8FAPUxv9gvIp2z92NFttMDWEzpS6P:mjDGPnkqc8FAM32z92TtwFS6P
- TLSH T1D3E4012675C74B73C60312329A1B53A0AF769D6443B21D3231AB778D2DF27A053EBAD1
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
- Size 26.1MB
- SHA256 164393a9644d76ad8bbdda2071a3b0aa4e6be205ae660a23d51d589fb6983df7
- MD5 db3ea5c6b7ccfc73e804173f0133b185
- SHA1 7c78ac7519f9fd289cddb29a5e21253f21ab2c19
- SHA512 3bca9e15dc82171869b00661e376d0eebc3b06a483870de7acad42f6168ebf0a8a9aaa8ea3837c2b5d410a683283b225185b4d28710ed3920d99346effec4916
- SSDEEP 24576:NFo3DMPNdoO/vvTL/SwyiCFAvre45LFB0vkwN/8qUn8aZ1jS8Ih2ibYDGuo:FHE
- TLSH T18457B42436F92100EBF7AE3CA8F06A274D397D57AC16DE8D45511B4D0822F71E872F6A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path \??\Volume{c61f8367-0000-0000-0000-d08302000000}\System Volume Information\SPP\OnlineMetadataCache\{868f2bc5-2728-4f68-b09a-3cb62cf819d8}_OnDiskSnapshotProp
- Size 6KB
- SHA256 073b364877280f53bc11bbbdf59a629a11289f09c48c8219c3e1e0d7c48dcc5a
- MD5 2b2ee45f84d24b34a32f3588b710f6b8
- SHA1 4e2694b6fcadb7311f5ebaee3f4383bc04dc07e6
- SHA512 42f98a49f97bd86a365835acefb6c5eddfc1ab9ffedb33551d8a8cd11fedfe883dbd8af84c01e5d5977851c3b8ab9760cf2712c9ec0e74b325a32fe80c7d08fa
- SSDEEP 96:FY6Olkvc6DD84LTHzbOHXOHBlBRQn8Sc9XE56tOSVQpu:u67b++uVm
- TLSH T17ED187185AF54711E2B3AB3128F18557A837B912FF33CB8E0198238E2671910F975F6B
- MD5 SHA1 SHA512 SSDEEP TLSH