Analysis
- user interaction
yes - max time kernel
127s - max time network
124s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
18/08/2026, 04:12
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
Game.msi
Resource
win10v2004-20260513-en
windows10-2004-x64
12 signatures
150 seconds
Behavioral task
behavioral2
Sample
Game.msi
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
12 signatures
150 seconds
General
- Target Game.msi
- Size 30.7MB
- Sample260818-eshrlafc75
- SHA256 851e2b164b736b057c512b33e1cd1884f2a0289c0f0792bcf8624f518c67139d
- MD5 15531927cbfcad110a06c4c24e7fd4ed
- SHA1 4bb64a6e44c90ce7293ea17ea44d80256883e2da
- SHA512 57e311f9540e5e52bdafeda167ef5db98063d9eb382ff5a4c778639d39ca59390ff04cdb14c32c7fb939c14356fdb433a281c52530c121c7cffee4ca2ac3a7bb
- SSDEEP 786432:o/luyK1XTenkLebQamksx3aPzCjmIlP5o1kEA2+Ywomo8ahiOIVL1v:cxKBTgkqnspaYjlBo1lX0whiOIVL1v
- TLSH T13E67330BF40B7FD6CD1C1DF0811A26462636AC836689F913F25ABB2277F721751709BA
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
pid Process 2620 p3w4wk1mktk5vtif2y6c.exe - Badlisted process makes network request 1 IoCs
Network request originating from process or tool commonly abused by malware.
flow pid Process 5 1684 msiexec.exe - Enumerates connected drives 3 TTPs 46 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\P: msiexec.exe - Drops file in Windows directory 7 IoCs
description ioc Process File created C:\Windows\Installer\e587ff9.msi msiexec.exe File opened for modification C:\Windows\Installer\e587ff9.msi msiexec.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log msiexec.exe File opened for modification C:\Windows\Installer\ msiexec.exe File created C:\Windows\Installer\inprogressinstallinfo.ipi msiexec.exe File created C:\Windows\Installer\SourceHash{F3F0A9C5-CCB3-41F0-B514-AD9571CD7843} msiexec.exe File opened for modification C:\Windows\Installer\MSI822B.tmp msiexec.exe - Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs
pid Process 1684 msiexec.exe - Checks SCSI registry key(s) 3 TTPs 8 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters vssvc.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters vssvc.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 0000000004000000499bfc0d34bfe76b0000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff000000002701010000080000499bfc0d0000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed35000000ffffffff000000000700010000680900499bfc0d000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff350000000000000005000000ffffffff000000000700010000f8ff1a499bfc0d000000000000f0ff350000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff3a0000000000000005000000ffffffff000000000700010000f87f1d499bfc0d000000000000f0ff3a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 taskmgr.exe - Suspicious behavior: EnumeratesProcesses 27 IoCs
pid Process 2564 msiexec.exe 2564 msiexec.exe 2796 taskmgr.exe 2796 taskmgr.exe 2796 taskmgr.exe 2796 taskmgr.exe 2796 taskmgr.exe 2796 taskmgr.exe 2796 taskmgr.exe 2796 taskmgr.exe 2796 taskmgr.exe 2796 taskmgr.exe 2796 taskmgr.exe 2796 taskmgr.exe 2796 taskmgr.exe 2796 taskmgr.exe 2796 taskmgr.exe 2796 taskmgr.exe 2796 taskmgr.exe 2796 taskmgr.exe 2796 taskmgr.exe 2796 taskmgr.exe 2796 taskmgr.exe 2796 taskmgr.exe 2796 taskmgr.exe 2796 taskmgr.exe 2796 taskmgr.exe - Suspicious use of AdjustPrivilegeToken 60 IoCs
description pid Process Token: SeShutdownPrivilege 1684 msiexec.exe Token: SeIncreaseQuotaPrivilege 1684 msiexec.exe Token: SeSecurityPrivilege 2564 msiexec.exe Token: SeCreateTokenPrivilege 1684 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 1684 msiexec.exe Token: SeLockMemoryPrivilege 1684 msiexec.exe Token: SeIncreaseQuotaPrivilege 1684 msiexec.exe Token: SeMachineAccountPrivilege 1684 msiexec.exe Token: SeTcbPrivilege 1684 msiexec.exe Token: SeSecurityPrivilege 1684 msiexec.exe Token: SeTakeOwnershipPrivilege 1684 msiexec.exe Token: SeLoadDriverPrivilege 1684 msiexec.exe Token: SeSystemProfilePrivilege 1684 msiexec.exe Token: SeSystemtimePrivilege 1684 msiexec.exe Token: SeProfSingleProcessPrivilege 1684 msiexec.exe Token: SeIncBasePriorityPrivilege 1684 msiexec.exe Token: SeCreatePagefilePrivilege 1684 msiexec.exe Token: SeCreatePermanentPrivilege 1684 msiexec.exe Token: SeBackupPrivilege 1684 msiexec.exe Token: SeRestorePrivilege 1684 msiexec.exe Token: SeShutdownPrivilege 1684 msiexec.exe Token: SeDebugPrivilege 1684 msiexec.exe Token: SeAuditPrivilege 1684 msiexec.exe Token: SeSystemEnvironmentPrivilege 1684 msiexec.exe Token: SeChangeNotifyPrivilege 1684 msiexec.exe Token: SeRemoteShutdownPrivilege 1684 msiexec.exe Token: SeUndockPrivilege 1684 msiexec.exe Token: SeSyncAgentPrivilege 1684 msiexec.exe Token: SeEnableDelegationPrivilege 1684 msiexec.exe Token: SeManageVolumePrivilege 1684 msiexec.exe Token: SeImpersonatePrivilege 1684 msiexec.exe Token: SeCreateGlobalPrivilege 1684 msiexec.exe Token: SeBackupPrivilege 3096 vssvc.exe Token: SeRestorePrivilege 3096 vssvc.exe Token: SeAuditPrivilege 3096 vssvc.exe Token: SeBackupPrivilege 2564 msiexec.exe Token: SeRestorePrivilege 2564 msiexec.exe Token: SeRestorePrivilege 2564 msiexec.exe Token: SeTakeOwnershipPrivilege 2564 msiexec.exe Token: SeRestorePrivilege 2564 msiexec.exe Token: SeTakeOwnershipPrivilege 2564 msiexec.exe Token: SeBackupPrivilege 4548 srtasks.exe Token: SeRestorePrivilege 4548 srtasks.exe Token: SeSecurityPrivilege 4548 srtasks.exe Token: SeTakeOwnershipPrivilege 4548 srtasks.exe Token: SeBackupPrivilege 4548 srtasks.exe Token: SeRestorePrivilege 4548 srtasks.exe Token: SeSecurityPrivilege 4548 srtasks.exe Token: SeTakeOwnershipPrivilege 4548 srtasks.exe Token: SeDebugPrivilege 2796 taskmgr.exe Token: SeSystemProfilePrivilege 2796 taskmgr.exe Token: SeCreateGlobalPrivilege 2796 taskmgr.exe Token: SeRestorePrivilege 2564 msiexec.exe Token: SeTakeOwnershipPrivilege 2564 msiexec.exe Token: SeRestorePrivilege 2564 msiexec.exe Token: SeTakeOwnershipPrivilege 2564 msiexec.exe Token: SeRestorePrivilege 2564 msiexec.exe Token: SeTakeOwnershipPrivilege 2564 msiexec.exe Token: 33 2796 taskmgr.exe Token: SeIncBasePriorityPrivilege 2796 taskmgr.exe - Suspicious use of FindShellTrayWindow 53 IoCs
pid Process 1684 msiexec.exe 2796 taskmgr.exe 2796 taskmgr.exe 2796 taskmgr.exe 2796 taskmgr.exe 2796 taskmgr.exe 2796 taskmgr.exe 2796 taskmgr.exe 2796 taskmgr.exe 2796 taskmgr.exe 2796 taskmgr.exe 2796 taskmgr.exe 2796 taskmgr.exe 2796 taskmgr.exe 2796 taskmgr.exe 2796 taskmgr.exe 2796 taskmgr.exe 2796 taskmgr.exe 2796 taskmgr.exe 2796 taskmgr.exe 2796 taskmgr.exe 2796 taskmgr.exe 2796 taskmgr.exe 2796 taskmgr.exe 2796 taskmgr.exe 1684 msiexec.exe 2796 taskmgr.exe 2796 taskmgr.exe 2796 taskmgr.exe 2796 taskmgr.exe 2796 taskmgr.exe 2796 taskmgr.exe 2796 taskmgr.exe 2796 taskmgr.exe 2796 taskmgr.exe 2796 taskmgr.exe 2796 taskmgr.exe 2796 taskmgr.exe 2796 taskmgr.exe 2796 taskmgr.exe 2796 taskmgr.exe 2796 taskmgr.exe 2796 taskmgr.exe 2796 taskmgr.exe 2796 taskmgr.exe 2796 taskmgr.exe 2796 taskmgr.exe 2796 taskmgr.exe 2796 taskmgr.exe 2796 taskmgr.exe 2796 taskmgr.exe 2796 taskmgr.exe 2796 taskmgr.exe - Suspicious use of SendNotifyMessage 51 IoCs
pid Process 2796 taskmgr.exe 2796 taskmgr.exe 2796 taskmgr.exe 2796 taskmgr.exe 2796 taskmgr.exe 2796 taskmgr.exe 2796 taskmgr.exe 2796 taskmgr.exe 2796 taskmgr.exe 2796 taskmgr.exe 2796 taskmgr.exe 2796 taskmgr.exe 2796 taskmgr.exe 2796 taskmgr.exe 2796 taskmgr.exe 2796 taskmgr.exe 2796 taskmgr.exe 2796 taskmgr.exe 2796 taskmgr.exe 2796 taskmgr.exe 2796 taskmgr.exe 2796 taskmgr.exe 2796 taskmgr.exe 2796 taskmgr.exe 2796 taskmgr.exe 2796 taskmgr.exe 2796 taskmgr.exe 2796 taskmgr.exe 2796 taskmgr.exe 2796 taskmgr.exe 2796 taskmgr.exe 2796 taskmgr.exe 2796 taskmgr.exe 2796 taskmgr.exe 2796 taskmgr.exe 2796 taskmgr.exe 2796 taskmgr.exe 2796 taskmgr.exe 2796 taskmgr.exe 2796 taskmgr.exe 2796 taskmgr.exe 2796 taskmgr.exe 2796 taskmgr.exe 2796 taskmgr.exe 2796 taskmgr.exe 2796 taskmgr.exe 2796 taskmgr.exe 2796 taskmgr.exe 2796 taskmgr.exe 2796 taskmgr.exe 2796 taskmgr.exe - Suspicious use of WriteProcessMemory 2 IoCs
description pid Process procid_target PID 2564 wrote to memory of 4548 2564 msiexec.exe 101 PID 2564 wrote to memory of 2620 2564 msiexec.exe 103 - Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Windows\system32\msiexec.exemsiexec.exe /I C:\Users\Admin\AppData\Local\Temp\Game.msi1⤵
- Badlisted process makes network request
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:1684
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2564 -
C:\Windows\system32\srtasks.exeC:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:22⤵
- Suspicious use of AdjustPrivilegeToken
PID:4548
-
-
C:\Users\Admin\AppData\Local\u9bpx6zvui52acpe9a2apmddnjnz\p3w4wk1mktk5vtif2y6c.exe"C:\Users\Admin\AppData\Local\u9bpx6zvui52acpe9a2apmddnjnz\p3w4wk1mktk5vtif2y6c.exe"2⤵
- Executes dropped EXE
PID:2620
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:3096
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2796
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵PID:2432
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\u9bpx6zvui52acpe9a2apmddnjnz\p3w4wk1mktk5vtif2y6c.exe
- Size 193KB
- SHA256 3266da89fa9b893402a95c3744f05038ff36eaedd5237d1bf995269be0153c60
- MD5 cc0237e1525de348603468f4f6c5a59d
- SHA1 d57fa219c77dff31512a7c1f1f59daf0814c3ace
- SHA512 420dae96c8d8191b989cef284f4748447c5b0f4a8d56ef1c12280e24c412b963420281880a03af2eaf511ccd1becf32a8b9bfb0d9ea10cc422720326c86ffe32
- SSDEEP 3072:UTwtZapglFk3kb/mhfMZHu8lw/q56hQhF+fvcZumGPr5fkEX9yUzjnl:pfkAk3kDt/lw/qoQhFIPr5f5yA
- TLSH T14514CF5B67E531F9E5368238C5668A15E7B2F8721620DF5F1768062A1F232C08D3FF62
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\u9bpx6zvui52acpe9a2apmddnjnz\yupesrca.exe
- Size 28.9MB
- SHA256 1e85662d0107383422ad8b4c60d9501827b1eb9363e7e49bd4b2600343212500
- MD5 26149fb4015552ea4eb130a820a8a0f1
- SHA1 c62f78a912815791a05166d49afe5a836c681069
- SHA512 d6050cf5ba6df9966ad3f36fc4c650d7dc3c00f42dac8fa890c9adacfcefa8c07e2a5d37594e27b91a33234dc9068a8e1b5ea51e1c97599bc62e7df22e66c1fc
- SSDEEP 786432:heDy1C1qKO7UFkmwsMurvrnCVAZCjXN9kolBUlj4qPVwbssluQBbk:kyo1rO6zMKzocCLN9V0hWbssluQBbk
- TLSH T12A67330AF9073CC39D282DC4162A5B537B37A493B6CCFA2377976712B7F92254050A7A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
- Size 24.1MB
- SHA256 85b19a39773cf6c7b506667570a4c89aff12c2ba850735d544808f7d2b670468
- MD5 6a7d80d353b6a054bf97b26a3c84cc28
- SHA1 7082d1c317a08df027e6394e98a094667b1a8b69
- SHA512 f27c6e24e409b58a0d9689997f1d7e632479e6c9123335b5c4c0f8c83a0482334bcc86755654675f01dd4302aa9b44d51cd4a9b038778bf6508b98d963db9474
- SSDEEP 24576:xu8m+1zSdoO/vvTL7W6u/maObDkzylKSGM2NIFb1ykqredzHIvlzicRRv:g
- TLSH T1A247B22477F92210E7F79E3CA8F06A234D3A7D5B9C259E8D45411B4E0921FB0E872F5A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path \??\Volume{0dfc9b49-0000-0000-0000-d01200000000}\System Volume Information\SPP\OnlineMetadataCache\{e7a6ba61-40d6-41ef-b6c5-f0a348ee5418}_OnDiskSnapshotProp
- Size 6KB
- SHA256 a269f9f3639619567e1cc5d01cd83ac2bfb3402ae18136b8bea27d74f64fc402
- MD5 4d5b7ef5d5b82ce9e0f59ea23926b727
- SHA1 f50dd9f043338a4711125f4a4d1662af8e8b74ce
- SHA512 cd8600874272d5ecd01be8106fb7f594fe75c5209cc41b6ef011a1e487223242de21cda4e128502a0ad5ab74d83c8830648b72b24d1fb34a4fef958c76ff86b0
- SSDEEP 96:FUIIJGGPGtvc8DD84LTHzbOHXOHBlBRQ88Sc9XE56tOSVQpuN:+aGPGnb++ZVmN
- TLSH T147D199085AF54711E2B3AB3129F14557A877B911EF33CB8E0198638E2630A10F936F6F
- MD5 SHA1 SHA512 SSDEEP TLSH