Analysis
- max time kernel
148s - max time network
127s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
10/11/2026, 16:55
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
rivals-smurf-tracker-0.3.0-win64.msi
Resource
win10v2004-20260911-en
windows10-2004-x64
9 signatures
150 seconds
Behavioral task
behavioral2
Sample
rivals-smurf-tracker-0.3.0-win64.msi
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
10 signatures
150 seconds
General
- Target rivals-smurf-tracker-0.3.0-win64.msi
- Size 19.9MB
- Sample261110-ve5bfabt2p
- SHA256 60dd094a3fbe064226fde3c714773aaf9f394b76259c583a462a9242c35cd677
- MD5 73aba63efd6a7d524e614a15b927ca8e
- SHA1 80adf003bc44dbb84af64bfc7fed4ca0d2ddee61
- SHA512 ed8a3f78ccf53a26d07cd80d91a1048aa77a5f32c2df1e936a54af55005cc733f1bc17358832306f6636ecee20882307d1dd696e94a0ce9c049c6efe3b3ee120
- SSDEEP 393216:0jZhhW/21hUD6XQJaArU7kJRDSd4ZH19IlfxWpYMJmouUTijz:yC/21hUWXQJaKOSDSd4lIBxKYSbuyif
- TLSH T131273392F8968713E5689D3A50721F71E1B02D64F558BC1A6BA53A3D3C32F44A13E1CF
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
6/10
Malware Config
Signatures
- Enumerates connected drives 3 TTPs 47 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\F: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\D: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\D: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\Y: msiexec.exe - Drops file in Windows directory 12 IoCs
description ioc Process File created C:\Windows\SystemTemp\~DFECC426EC0499C43E.TMP msiexec.exe File created C:\Windows\Installer\SourceHash{4ABC57C9-3F2E-42B7-868D-D33FD40E9232} msiexec.exe File created C:\Windows\SystemTemp\~DF82D8BD33E48AFE7E.TMP msiexec.exe File opened for modification C:\Windows\Installer\MSI4AD5.tmp msiexec.exe File created C:\Windows\Installer\e5a420b.msi msiexec.exe File created C:\Windows\Installer\e5a420d.msi msiexec.exe File created C:\Windows\SystemTemp\~DF007980AA4EF6284C.TMP msiexec.exe File created C:\Windows\SystemTemp\~DFED685024570AB623.TMP msiexec.exe File opened for modification C:\Windows\Installer\e5a420b.msi msiexec.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log msiexec.exe File opened for modification C:\Windows\Installer\ msiexec.exe File created C:\Windows\Installer\inprogressinstallinfo.ipi msiexec.exe - Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs
pid Process 260 msiexec.exe - Checks SCSI registry key(s) 3 TTPs 5 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 000000000400000032ed1b0a2a5ec3f10000000000000000000000000000000000000000000000000000000000000000000000000000000000001071020000000000c012000000000000000000000000270101000088380132ed1b0a0000000000001071020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d0830200000000006025c501000000000000000000000700010000e8410132ed1b0a000000000000d08302000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030a9c701000000000000050000000000000000000000070001000098d4e332ed1b0a00000000000030a9c7010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030a9cc0100000000000005000000000000000000000007000100009854e632ed1b0a00000000000030a9cc01000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters vssvc.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters vssvc.exe - Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 1348 msiexec.exe 1348 msiexec.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 260 msiexec.exe Token: SeIncreaseQuotaPrivilege 260 msiexec.exe Token: SeSecurityPrivilege 1348 msiexec.exe Token: SeCreateTokenPrivilege 260 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 260 msiexec.exe Token: SeLockMemoryPrivilege 260 msiexec.exe Token: SeIncreaseQuotaPrivilege 260 msiexec.exe Token: SeMachineAccountPrivilege 260 msiexec.exe Token: SeTcbPrivilege 260 msiexec.exe Token: SeSecurityPrivilege 260 msiexec.exe Token: SeTakeOwnershipPrivilege 260 msiexec.exe Token: SeLoadDriverPrivilege 260 msiexec.exe Token: SeSystemProfilePrivilege 260 msiexec.exe Token: SeSystemtimePrivilege 260 msiexec.exe Token: SeProfSingleProcessPrivilege 260 msiexec.exe Token: SeIncBasePriorityPrivilege 260 msiexec.exe Token: SeCreatePagefilePrivilege 260 msiexec.exe Token: SeCreatePermanentPrivilege 260 msiexec.exe Token: SeBackupPrivilege 260 msiexec.exe Token: SeRestorePrivilege 260 msiexec.exe Token: SeShutdownPrivilege 260 msiexec.exe Token: SeDebugPrivilege 260 msiexec.exe Token: SeAuditPrivilege 260 msiexec.exe Token: SeSystemEnvironmentPrivilege 260 msiexec.exe Token: SeChangeNotifyPrivilege 260 msiexec.exe Token: SeRemoteShutdownPrivilege 260 msiexec.exe Token: SeUndockPrivilege 260 msiexec.exe Token: SeSyncAgentPrivilege 260 msiexec.exe Token: SeEnableDelegationPrivilege 260 msiexec.exe Token: SeManageVolumePrivilege 260 msiexec.exe Token: SeImpersonatePrivilege 260 msiexec.exe Token: SeCreateGlobalPrivilege 260 msiexec.exe Token: SeBackupPrivilege 3692 vssvc.exe Token: SeRestorePrivilege 3692 vssvc.exe Token: SeAuditPrivilege 3692 vssvc.exe Token: SeBackupPrivilege 1348 msiexec.exe Token: SeRestorePrivilege 1348 msiexec.exe Token: SeRestorePrivilege 1348 msiexec.exe Token: SeTakeOwnershipPrivilege 1348 msiexec.exe Token: SeRestorePrivilege 1348 msiexec.exe Token: SeTakeOwnershipPrivilege 1348 msiexec.exe Token: SeRestorePrivilege 1348 msiexec.exe Token: SeTakeOwnershipPrivilege 1348 msiexec.exe Token: SeRestorePrivilege 1348 msiexec.exe Token: SeTakeOwnershipPrivilege 1348 msiexec.exe Token: SeRestorePrivilege 1348 msiexec.exe Token: SeTakeOwnershipPrivilege 1348 msiexec.exe Token: SeRestorePrivilege 1348 msiexec.exe Token: SeTakeOwnershipPrivilege 1348 msiexec.exe Token: SeRestorePrivilege 1348 msiexec.exe Token: SeTakeOwnershipPrivilege 1348 msiexec.exe Token: SeRestorePrivilege 1348 msiexec.exe Token: SeTakeOwnershipPrivilege 1348 msiexec.exe Token: SeRestorePrivilege 1348 msiexec.exe Token: SeTakeOwnershipPrivilege 1348 msiexec.exe Token: SeRestorePrivilege 1348 msiexec.exe Token: SeTakeOwnershipPrivilege 1348 msiexec.exe Token: SeRestorePrivilege 1348 msiexec.exe Token: SeTakeOwnershipPrivilege 1348 msiexec.exe Token: SeRestorePrivilege 1348 msiexec.exe Token: SeTakeOwnershipPrivilege 1348 msiexec.exe Token: SeRestorePrivilege 1348 msiexec.exe Token: SeTakeOwnershipPrivilege 1348 msiexec.exe Token: SeRestorePrivilege 1348 msiexec.exe - Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 260 msiexec.exe 260 msiexec.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 260 msiexec.exe 1348 msiexec.exe - Suspicious use of WriteProcessMemory 1 IoCs
description pid Process procid_target PID 1348 wrote to memory of 360 1348 msiexec.exe 93 - Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Windows\system32\msiexec.exemsiexec.exe /I C:\Users\Admin\AppData\Local\Temp\rivals-smurf-tracker-0.3.0-win64.msi1⤵
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:260
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1348 -
C:\Windows\system32\srtasks.exeC:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:22⤵PID:360
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:3692
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Config.Msi\e5a420c.rbs
- Size 160KB
- SHA256 1c3c9ac7e2e7f286a3905b3499a7d6814f731ee6c291ed6a30e7314c06d4813b
- MD5 b45f9f838b2bf4ac46fb7e22281bdf75
- SHA1 59a5244e7e323436449bba50abf3e43b6ba32046
- SHA512 aeb8548f1f3392ddf72e17fc27c3ee4f20aa1a23de9aa3d659d32e79e887f1efd32d3bd9cf5b6eb2c2358cd1ac8a768226e7a61b53e344e4994feb03de871839
- SSDEEP 1536:/LTpUGjVqz6nbkWypoqjLiw/Q6M5x0JZJxU0GJKxINL9NQ6KdNRzYoHE+G9Rxibw:PfUckU
- TLSH T1D0F38D228BDDC18D1297201F07F9A60CECE8BC017FCD6A1FD78AD25D564DE19A2DE912
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Installer\e5a420d.msi
- Size 19.9MB
- SHA256 60dd094a3fbe064226fde3c714773aaf9f394b76259c583a462a9242c35cd677
- MD5 73aba63efd6a7d524e614a15b927ca8e
- SHA1 80adf003bc44dbb84af64bfc7fed4ca0d2ddee61
- SHA512 ed8a3f78ccf53a26d07cd80d91a1048aa77a5f32c2df1e936a54af55005cc733f1bc17358832306f6636ecee20882307d1dd696e94a0ce9c049c6efe3b3ee120
- SSDEEP 393216:0jZhhW/21hUD6XQJaArU7kJRDSd4ZH19IlfxWpYMJmouUTijz:yC/21hUWXQJaKOSDSd4lIBxKYSbuyif
- TLSH T131273392F8968713E5689D3A50721F71E1B02D64F558BC1A6BA53A3D3C32F44A13E1CF
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
- Size 26.1MB
- SHA256 cbf32bd539aa11ea6885d413476906c662ad828777614a6d2d3bf80980e33021
- MD5 d5dcc9b6a7f87fc6845ee0c51d5019b2
- SHA1 b74083aea106974ef7267008024be7e6e9e11a84
- SHA512 c2cd24f07b40546ed407498ff466d6dacb912966b463f7c75c6314b4f45474e0a6d7a2c9dc1c5fcfc14bd62b7026136e5beccd43ec8a79f28e1a78d7a66b81a4
- SSDEEP 24576:pFo3DMPmdoO/vvTL/CgQQyFAv7Oqbr3DUt2id9O4mFea5HRQc4BmwJKR0uu:CHM
- TLSH T18957B51836F92100E7F79F3CA8F46A63493A7D579C1ADE8D45411B4E0821FB1E872F6A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path \??\Volume{0a1bed32-0000-0000-0000-d08302000000}\System Volume Information\SPP\OnlineMetadataCache\{4fa4b956-447e-410c-9ce7-6d8f17aa91db}_OnDiskSnapshotProp
- Size 6KB
- SHA256 4417427ee67d76db4c7c65dba625df1bf90c5bfe14a96c1bb9ad54e8b4283e35
- MD5 3ed776eced3cd63ec81153ad1576c3d5
- SHA1 504db48b306cdec16661e7f577091211d12fe469
- SHA512 7c50509278e776c3fa8885032e570adfed1972717b427b237a791ff2f3ea7e1c3fe0575269a83bd6912d507aaacdaa153fab06d7503e304026b5034326546783
- SSDEEP 96:FDhL1RqyNRsvc6DD84LTHzbOHXOHBlBRQn8Sc9XE56tOSVQpuN:NhLxNRgb++uVmN
- TLSH T1FDD1880C5AE54711E2B3AB312CF18557A877B851EF33CB8E0198238E6670A10F835F6B
- MD5 SHA1 SHA512 SSDEEP TLSH