Analysis
- user interaction
yes - max time kernel
598s - max time network
424s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
18/08/2026, 04:23
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
Game.msi
Resource
win10v2004-20260513-en
windows10-2004-x64
22 signatures
600 seconds
Behavioral task
behavioral2
Sample
Game.msi
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
12 signatures
600 seconds
General
- Target Game.msi
- Size 30.7MB
- Sample260818-ezz98awcke
- SHA256 851e2b164b736b057c512b33e1cd1884f2a0289c0f0792bcf8624f518c67139d
- MD5 15531927cbfcad110a06c4c24e7fd4ed
- SHA1 4bb64a6e44c90ce7293ea17ea44d80256883e2da
- SHA512 57e311f9540e5e52bdafeda167ef5db98063d9eb382ff5a4c778639d39ca59390ff04cdb14c32c7fb939c14356fdb433a281c52530c121c7cffee4ca2ac3a7bb
- SSDEEP 786432:o/luyK1XTenkLebQamksx3aPzCjmIlP5o1kEA2+Ywomo8ahiOIVL1v:cxKBTgkqnspaYjlBo1lX0whiOIVL1v
- TLSH T13E67330BF40B7FD6CD1C1DF0811A26462636AC836689F913F25ABB2277F721751709BA
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
pid Process 5404 p3w4wk1mktk5vtif2y6c.exe - Badlisted process makes network request 1 IoCs
Network request originating from process or tool commonly abused by malware.
flow pid Process 2 5576 msiexec.exe - Enumerates connected drives 3 TTPs 46 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\D: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\D: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\A: msiexec.exe - Drops file in Windows directory 11 IoCs
description ioc Process File opened for modification C:\Windows\Installer\e59dc0e.msi msiexec.exe File opened for modification C:\Windows\Installer\ msiexec.exe File created C:\Windows\Installer\inprogressinstallinfo.ipi msiexec.exe File created C:\Windows\SystemTemp\~DFE3F6792898400864.TMP msiexec.exe File opened for modification C:\Windows\Installer\MSIE891.tmp msiexec.exe File created C:\Windows\Installer\e59dc0e.msi msiexec.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log msiexec.exe File created C:\Windows\SystemTemp\~DF629B3E7C277A7B76.TMP msiexec.exe File created C:\Windows\Installer\SourceHash{F3F0A9C5-CCB3-41F0-B514-AD9571CD7843} msiexec.exe File created C:\Windows\SystemTemp\~DF5DF427D28E445767.TMP msiexec.exe File created C:\Windows\SystemTemp\~DFCDA005D02E1B0052.TMP msiexec.exe - Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs
pid Process 5576 msiexec.exe - Checks SCSI registry key(s) 3 TTPs 5 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters vssvc.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters vssvc.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 0000000004000000ad3b1fc6af0fc0350000000000000000000000000000000000000000000000000000000000000000000000000000000000001071020000000000c0120000000000000000000000002701010000883801ad3b1fc60000000000001071020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d0830200000000006025c501000000000000000000000700010000e84101ad3b1fc6000000000000d08302000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030a9c701000000000000050000000000000000000000070001000098d4e3ad3b1fc600000000000030a9c7010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030a9cc0100000000000005000000000000000000000007000100009854e6ad3b1fc600000000000030a9cc01000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe - Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 620 msiexec.exe 620 msiexec.exe - Suspicious use of AdjustPrivilegeToken 55 IoCs
description pid Process Token: SeShutdownPrivilege 5576 msiexec.exe Token: SeIncreaseQuotaPrivilege 5576 msiexec.exe Token: SeSecurityPrivilege 620 msiexec.exe Token: SeCreateTokenPrivilege 5576 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 5576 msiexec.exe Token: SeLockMemoryPrivilege 5576 msiexec.exe Token: SeIncreaseQuotaPrivilege 5576 msiexec.exe Token: SeMachineAccountPrivilege 5576 msiexec.exe Token: SeTcbPrivilege 5576 msiexec.exe Token: SeSecurityPrivilege 5576 msiexec.exe Token: SeTakeOwnershipPrivilege 5576 msiexec.exe Token: SeLoadDriverPrivilege 5576 msiexec.exe Token: SeSystemProfilePrivilege 5576 msiexec.exe Token: SeSystemtimePrivilege 5576 msiexec.exe Token: SeProfSingleProcessPrivilege 5576 msiexec.exe Token: SeIncBasePriorityPrivilege 5576 msiexec.exe Token: SeCreatePagefilePrivilege 5576 msiexec.exe Token: SeCreatePermanentPrivilege 5576 msiexec.exe Token: SeBackupPrivilege 5576 msiexec.exe Token: SeRestorePrivilege 5576 msiexec.exe Token: SeShutdownPrivilege 5576 msiexec.exe Token: SeDebugPrivilege 5576 msiexec.exe Token: SeAuditPrivilege 5576 msiexec.exe Token: SeSystemEnvironmentPrivilege 5576 msiexec.exe Token: SeChangeNotifyPrivilege 5576 msiexec.exe Token: SeRemoteShutdownPrivilege 5576 msiexec.exe Token: SeUndockPrivilege 5576 msiexec.exe Token: SeSyncAgentPrivilege 5576 msiexec.exe Token: SeEnableDelegationPrivilege 5576 msiexec.exe Token: SeManageVolumePrivilege 5576 msiexec.exe Token: SeImpersonatePrivilege 5576 msiexec.exe Token: SeCreateGlobalPrivilege 5576 msiexec.exe Token: SeBackupPrivilege 3188 vssvc.exe Token: SeRestorePrivilege 3188 vssvc.exe Token: SeAuditPrivilege 3188 vssvc.exe Token: SeBackupPrivilege 620 msiexec.exe Token: SeRestorePrivilege 620 msiexec.exe Token: SeRestorePrivilege 620 msiexec.exe Token: SeTakeOwnershipPrivilege 620 msiexec.exe Token: SeRestorePrivilege 620 msiexec.exe Token: SeTakeOwnershipPrivilege 620 msiexec.exe Token: SeBackupPrivilege 1080 srtasks.exe Token: SeRestorePrivilege 1080 srtasks.exe Token: SeSecurityPrivilege 1080 srtasks.exe Token: SeTakeOwnershipPrivilege 1080 srtasks.exe Token: SeBackupPrivilege 1080 srtasks.exe Token: SeRestorePrivilege 1080 srtasks.exe Token: SeSecurityPrivilege 1080 srtasks.exe Token: SeTakeOwnershipPrivilege 1080 srtasks.exe Token: SeRestorePrivilege 620 msiexec.exe Token: SeTakeOwnershipPrivilege 620 msiexec.exe Token: SeRestorePrivilege 620 msiexec.exe Token: SeTakeOwnershipPrivilege 620 msiexec.exe Token: SeRestorePrivilege 620 msiexec.exe Token: SeTakeOwnershipPrivilege 620 msiexec.exe - Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 5576 msiexec.exe 5576 msiexec.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 5576 msiexec.exe 620 msiexec.exe - Suspicious use of WriteProcessMemory 2 IoCs
description pid Process procid_target PID 620 wrote to memory of 1080 620 msiexec.exe 95 PID 620 wrote to memory of 5404 620 msiexec.exe 97 - Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Windows\system32\msiexec.exemsiexec.exe /I C:\Users\Admin\AppData\Local\Temp\Game.msi1⤵
- Badlisted process makes network request
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:5576
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:620 -
C:\Windows\system32\srtasks.exeC:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:22⤵
- Suspicious use of AdjustPrivilegeToken
PID:1080
-
-
C:\Users\Admin\AppData\Local\u9bpx6zvui52acpe9a2apmddnjnz\p3w4wk1mktk5vtif2y6c.exe"C:\Users\Admin\AppData\Local\u9bpx6zvui52acpe9a2apmddnjnz\p3w4wk1mktk5vtif2y6c.exe"2⤵
- Executes dropped EXE
PID:5404
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:3188
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k GPSvcGroup1⤵PID:2644
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\u9bpx6zvui52acpe9a2apmddnjnz\p3w4wk1mktk5vtif2y6c.exe
- Size 193KB
- SHA256 3266da89fa9b893402a95c3744f05038ff36eaedd5237d1bf995269be0153c60
- MD5 cc0237e1525de348603468f4f6c5a59d
- SHA1 d57fa219c77dff31512a7c1f1f59daf0814c3ace
- SHA512 420dae96c8d8191b989cef284f4748447c5b0f4a8d56ef1c12280e24c412b963420281880a03af2eaf511ccd1becf32a8b9bfb0d9ea10cc422720326c86ffe32
- SSDEEP 3072:UTwtZapglFk3kb/mhfMZHu8lw/q56hQhF+fvcZumGPr5fkEX9yUzjnl:pfkAk3kDt/lw/qoQhFIPr5f5yA
- TLSH T14514CF5B67E531F9E5368238C5668A15E7B2F8721620DF5F1768062A1F232C08D3FF62
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\u9bpx6zvui52acpe9a2apmddnjnz\yupesrca.exe
- Size 28.9MB
- SHA256 1e85662d0107383422ad8b4c60d9501827b1eb9363e7e49bd4b2600343212500
- MD5 26149fb4015552ea4eb130a820a8a0f1
- SHA1 c62f78a912815791a05166d49afe5a836c681069
- SHA512 d6050cf5ba6df9966ad3f36fc4c650d7dc3c00f42dac8fa890c9adacfcefa8c07e2a5d37594e27b91a33234dc9068a8e1b5ea51e1c97599bc62e7df22e66c1fc
- SSDEEP 786432:heDy1C1qKO7UFkmwsMurvrnCVAZCjXN9kolBUlj4qPVwbssluQBbk:kyo1rO6zMKzocCLN9V0hWbssluQBbk
- TLSH T12A67330AF9073CC39D282DC4162A5B537B37A493B6CCFA2377976712B7F92254050A7A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
- Size 26.1MB
- SHA256 c60b2ae56aff737370ef81d88288883ffc7d38d10d9ce4727d686d4289cd7342
- MD5 07941b50403fce5b108e1fbe10218363
- SHA1 f79c4fe07bb7efb33f03a14c7626500b0fdeb5be
- SHA512 946461b61f4bc90d819c32a2e815181c308f0f99b610950096b61998a5a16d684594f6470f26d75d63619c399b4750276b638e4d1f04a161d819f5bbd0f21fc6
- SSDEEP 24576:uFo3DMPodoO/vvTL/Sg88iFQvrumHb7P0BKudxSUKpyKpb9cMoRWclmd4+2:rHY
- TLSH T15F57B42436F92200E7F79E3DA8F06A234D397D5BAC15DE8D45511B4E0822F71E872F6A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path \??\Volume{c61f3bad-0000-0000-0000-d08302000000}\System Volume Information\SPP\OnlineMetadataCache\{dba34e0e-4725-4ed6-8522-58b55f3628e2}_OnDiskSnapshotProp
- Size 6KB
- SHA256 6f71aef0c1dbec8879ca4c9fd0d196cba7574e5998fc95dd67e676361f1bdcdc
- MD5 d69237fe3d95d8cc6532830c2c39b9e0
- SHA1 25162d0d70a379ddb7a27f1413e792f5f2998c9e
- SHA512 df593f51a466a50ef5c9d34093a3994bb62b0680b84e34bf8ed8d8c67817dd34ef7462ae8d878d3d1b128ad0b75cb970a5ca42329b0db6960008959d11e672c0
- SSDEEP 96:FThI7fCvc6DD84LTHzbOHXOHBlBRQn8Sc9XE56tOSVQpuN:Fueb++uVmN
- TLSH T144D188085AF54711E2B3AB7129F14557A877B911EF33CB8E0198238E2631A10F976F6F
- MD5 SHA1 SHA512 SSDEEP TLSH