Analysis
- max time kernel
149s - max time network
129s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
18/08/2026, 04:12
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
Game.msi
Resource
win10v2004-20260513-en
windows10-2004-x64
12 signatures
150 seconds
Behavioral task
behavioral2
Sample
Game.msi
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
12 signatures
150 seconds
General
- Target Game.msi
- Size 30.7MB
- Sample260818-eshrlafc75
- SHA256 851e2b164b736b057c512b33e1cd1884f2a0289c0f0792bcf8624f518c67139d
- MD5 15531927cbfcad110a06c4c24e7fd4ed
- SHA1 4bb64a6e44c90ce7293ea17ea44d80256883e2da
- SHA512 57e311f9540e5e52bdafeda167ef5db98063d9eb382ff5a4c778639d39ca59390ff04cdb14c32c7fb939c14356fdb433a281c52530c121c7cffee4ca2ac3a7bb
- SSDEEP 786432:o/luyK1XTenkLebQamksx3aPzCjmIlP5o1kEA2+Ywomo8ahiOIVL1v:cxKBTgkqnspaYjlBo1lX0whiOIVL1v
- TLSH T13E67330BF40B7FD6CD1C1DF0811A26462636AC836689F913F25ABB2277F721751709BA
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
pid Process 3104 p3w4wk1mktk5vtif2y6c.exe - Badlisted process makes network request 1 IoCs
Network request originating from process or tool commonly abused by malware.
flow pid Process 2 4580 msiexec.exe - Enumerates connected drives 3 TTPs 46 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\D: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\D: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\Z: msiexec.exe - Drops file in Windows directory 9 IoCs
description ioc Process File opened for modification C:\Windows\Installer\e59bc03.msi msiexec.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log msiexec.exe File opened for modification C:\Windows\Installer\ msiexec.exe File created C:\Windows\Installer\SourceHash{F3F0A9C5-CCB3-41F0-B514-AD9571CD7843} msiexec.exe File created C:\Windows\SystemTemp\~DF50C9E0747061966F.TMP msiexec.exe File created C:\Windows\Installer\inprogressinstallinfo.ipi msiexec.exe File created C:\Windows\SystemTemp\~DF0136C235980A433D.TMP msiexec.exe File opened for modification C:\Windows\Installer\MSIC411.tmp msiexec.exe File created C:\Windows\Installer\e59bc03.msi msiexec.exe - Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs
pid Process 4580 msiexec.exe - Checks SCSI registry key(s) 3 TTPs 5 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters vssvc.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters vssvc.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 0000000004000000940e18cbc83cc7300000000000000000000000000000000000000000000000000000000000000000000000000000000000001071020000000000c0120000000000000000000000002701010000883801940e18cb0000000000001071020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d0830200000000006025c501000000000000000000000700010000e84101940e18cb000000000000d08302000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030a9c701000000000000050000000000000000000000070001000098d4e3940e18cb00000000000030a9c7010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030a9cc0100000000000005000000000000000000000007000100009854e6940e18cb00000000000030a9cc01000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe - Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 2712 msiexec.exe 2712 msiexec.exe - Suspicious use of AdjustPrivilegeToken 49 IoCs
description pid Process Token: SeShutdownPrivilege 4580 msiexec.exe Token: SeIncreaseQuotaPrivilege 4580 msiexec.exe Token: SeSecurityPrivilege 2712 msiexec.exe Token: SeCreateTokenPrivilege 4580 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 4580 msiexec.exe Token: SeLockMemoryPrivilege 4580 msiexec.exe Token: SeIncreaseQuotaPrivilege 4580 msiexec.exe Token: SeMachineAccountPrivilege 4580 msiexec.exe Token: SeTcbPrivilege 4580 msiexec.exe Token: SeSecurityPrivilege 4580 msiexec.exe Token: SeTakeOwnershipPrivilege 4580 msiexec.exe Token: SeLoadDriverPrivilege 4580 msiexec.exe Token: SeSystemProfilePrivilege 4580 msiexec.exe Token: SeSystemtimePrivilege 4580 msiexec.exe Token: SeProfSingleProcessPrivilege 4580 msiexec.exe Token: SeIncBasePriorityPrivilege 4580 msiexec.exe Token: SeCreatePagefilePrivilege 4580 msiexec.exe Token: SeCreatePermanentPrivilege 4580 msiexec.exe Token: SeBackupPrivilege 4580 msiexec.exe Token: SeRestorePrivilege 4580 msiexec.exe Token: SeShutdownPrivilege 4580 msiexec.exe Token: SeDebugPrivilege 4580 msiexec.exe Token: SeAuditPrivilege 4580 msiexec.exe Token: SeSystemEnvironmentPrivilege 4580 msiexec.exe Token: SeChangeNotifyPrivilege 4580 msiexec.exe Token: SeRemoteShutdownPrivilege 4580 msiexec.exe Token: SeUndockPrivilege 4580 msiexec.exe Token: SeSyncAgentPrivilege 4580 msiexec.exe Token: SeEnableDelegationPrivilege 4580 msiexec.exe Token: SeManageVolumePrivilege 4580 msiexec.exe Token: SeImpersonatePrivilege 4580 msiexec.exe Token: SeCreateGlobalPrivilege 4580 msiexec.exe Token: SeBackupPrivilege 360 vssvc.exe Token: SeRestorePrivilege 360 vssvc.exe Token: SeAuditPrivilege 360 vssvc.exe Token: SeBackupPrivilege 2712 msiexec.exe Token: SeRestorePrivilege 2712 msiexec.exe Token: SeRestorePrivilege 2712 msiexec.exe Token: SeTakeOwnershipPrivilege 2712 msiexec.exe Token: SeBackupPrivilege 5748 srtasks.exe Token: SeRestorePrivilege 5748 srtasks.exe Token: SeSecurityPrivilege 5748 srtasks.exe Token: SeTakeOwnershipPrivilege 5748 srtasks.exe Token: SeRestorePrivilege 2712 msiexec.exe Token: SeTakeOwnershipPrivilege 2712 msiexec.exe Token: SeBackupPrivilege 5748 srtasks.exe Token: SeRestorePrivilege 5748 srtasks.exe Token: SeSecurityPrivilege 5748 srtasks.exe Token: SeTakeOwnershipPrivilege 5748 srtasks.exe - Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 4580 msiexec.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 4580 msiexec.exe 2712 msiexec.exe - Suspicious use of WriteProcessMemory 2 IoCs
description pid Process procid_target PID 2712 wrote to memory of 5748 2712 msiexec.exe 94 PID 2712 wrote to memory of 3104 2712 msiexec.exe 96 - Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Windows\system32\msiexec.exemsiexec.exe /I C:\Users\Admin\AppData\Local\Temp\Game.msi1⤵
- Badlisted process makes network request
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:4580
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2712 -
C:\Windows\system32\srtasks.exeC:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:22⤵
- Suspicious use of AdjustPrivilegeToken
PID:5748
-
-
C:\Users\Admin\AppData\Local\u9bpx6zvui52acpe9a2apmddnjnz\p3w4wk1mktk5vtif2y6c.exe"C:\Users\Admin\AppData\Local\u9bpx6zvui52acpe9a2apmddnjnz\p3w4wk1mktk5vtif2y6c.exe"2⤵
- Executes dropped EXE
PID:3104
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:360
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\u9bpx6zvui52acpe9a2apmddnjnz\p3w4wk1mktk5vtif2y6c.exe
- Size 193KB
- SHA256 3266da89fa9b893402a95c3744f05038ff36eaedd5237d1bf995269be0153c60
- MD5 cc0237e1525de348603468f4f6c5a59d
- SHA1 d57fa219c77dff31512a7c1f1f59daf0814c3ace
- SHA512 420dae96c8d8191b989cef284f4748447c5b0f4a8d56ef1c12280e24c412b963420281880a03af2eaf511ccd1becf32a8b9bfb0d9ea10cc422720326c86ffe32
- SSDEEP 3072:UTwtZapglFk3kb/mhfMZHu8lw/q56hQhF+fvcZumGPr5fkEX9yUzjnl:pfkAk3kDt/lw/qoQhFIPr5f5yA
- TLSH T14514CF5B67E531F9E5368238C5668A15E7B2F8721620DF5F1768062A1F232C08D3FF62
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\u9bpx6zvui52acpe9a2apmddnjnz\yupesrca.exe
- Size 28.9MB
- SHA256 1e85662d0107383422ad8b4c60d9501827b1eb9363e7e49bd4b2600343212500
- MD5 26149fb4015552ea4eb130a820a8a0f1
- SHA1 c62f78a912815791a05166d49afe5a836c681069
- SHA512 d6050cf5ba6df9966ad3f36fc4c650d7dc3c00f42dac8fa890c9adacfcefa8c07e2a5d37594e27b91a33234dc9068a8e1b5ea51e1c97599bc62e7df22e66c1fc
- SSDEEP 786432:heDy1C1qKO7UFkmwsMurvrnCVAZCjXN9kolBUlj4qPVwbssluQBbk:kyo1rO6zMKzocCLN9V0hWbssluQBbk
- TLSH T12A67330AF9073CC39D282DC4162A5B537B37A493B6CCFA2377976712B7F92254050A7A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
- Size 26.1MB
- SHA256 6cbd2d1208e7917c60879d97f74f09c796068f44760f0e97663f7ae7e41af01b
- MD5 9347fa9b6ab411f6286c5e8dbaaa1bf0
- SHA1 15330cf6554e44a4431df5ab132bb70b3a7806af
- SHA512 a2f7a2fe098dc50229edc691e2c6df83c9666bef80e86d8b104b48108d10b74326fc1af76e3e43c8bea33e73da69bc7d7d8d9540f20cbb733eb506c03b6e1daa
- SSDEEP 24576:WFo3DMPHdoO/vvTL/iQSCy1w/7uoZ7lhkvUAtvsqUnc65lTicoxGSr4j2+c:8HY
- TLSH T10557F41436F92210E7F39E3CA8F46A234D397D5B9C1ADE8C45411B4E0922F71E972F6A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path \??\Volume{cb180e94-0000-0000-0000-d08302000000}\System Volume Information\SPP\OnlineMetadataCache\{f1765f4c-ab75-4611-897f-e905cf8f1695}_OnDiskSnapshotProp
- Size 6KB
- SHA256 876123b1301aed68ddc4b0ded5693edb8aec452bf5891b77b84aea381bc1992e
- MD5 074c8811c260eeddc5a031d0f8f548f9
- SHA1 bec6d5fa5ec2505fa74e8c86cd1c99b3bbd5a470
- SHA512 69de64e73d780866e3c3a3343164af0b865fe2dd9eb71f36324bd71f9686bfde10bb8c302d46f51a30ce4abc4ff9e681af85ec633b417837169d8e88f05f1b21
- SSDEEP 96:FBhI7P8vc6DD84LTHzbOHXOHBlBRQn8Sc9XE56tOSVQpuN:Dpb++uVmN
- TLSH T10ED198085AF54311E2B3AB3129F18557A877B912EF33CB8E0198238E6631910F935F6F
- MD5 SHA1 SHA512 SSDEEP TLSH