File name:

playit-windows-x86_64-signed.msi

Full analysis: https://app.any.run/tasks/e905aa92-bcd5-4ca2-af9d-ff8e97bea92c
Verdict: Malicious activity
Analysis date: June 30, 2024, 14:39:26
OS: Windows 10 Professional (build: 19045, 64 bit)
Tags:
generated-doc
Indicators:
MIME: application/x-msi
File info: Composite Document File V2 Document, Little Endian, Os: Windows, Version 6.2, MSI Installer, Code page: 1252, Title: Installation Database, Subject: playit, Author: Developed Methods LLC, Keywords: Installer, Comments: This installer database contains the logic and data required to install playit., Template: x64;1033, Revision Number: {A5D5EDCC-E398-4022-B07C-E3CA36B74592}, Create Time/Date: Wed Jan 31 22:27:26 2024, Last Saved Time/Date: Wed Jan 31 22:27:26 2024, Number of Pages: 450, Number of Words: 2, Name of Creating Application: Windows Installer XML Toolset (3.11.2.4516), Security: 2
MD5:

93B91C8721CA2951ECCEB0FC0E739CC8

SHA1:

F5AC76BAE778ACDE000F72D5630D1A8983948705

SHA256:

727679568706156F635BE9B786C61B8FECAF55894B902A014AA6A2A691FC3108

SSDEEP:

98304:COJV2JX07dZ8W1Nakt4hGcJ75MqMw3NGM4HaHaCkNJxGfkTjG08XcFcPl3JRplvf:3o

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Drops the executable file immediately after the start

      • msiexec.exe (PID: 1324)
      • msiexec.exe (PID: 4052)

  • SUSPICIOUS

    • Executes as Windows Service

      • VSSVC.exe (PID: 3128)

    • Checks Windows Trust Settings

      • msiexec.exe (PID: 4052)

  • INFO

    • Checks supported languages

      • msiexec.exe (PID: 4052)

    • Reads security settings of Internet Explorer

      • msiexec.exe (PID: 1324)

    • Reads the computer name

      • msiexec.exe (PID: 4052)

    • Reads the software policy settings

      • msiexec.exe (PID: 1324)
      • msiexec.exe (PID: 4052)

    • Reads the machine GUID from the registry

      • msiexec.exe (PID: 4052)

    • Executable content was dropped or overwritten

      • msiexec.exe (PID: 4052)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.msi | Microsoft Windows Installer (98.5)
.msi | Microsoft Installer (100)

EXIF

FlashPix

CodePage: Windows Latin 1 (Western European)
Title: Installation Database
Subject: playit
Author: Developed Methods LLC
Keywords: Installer
Comments: This installer database contains the logic and data required to install playit.
Template: x64;1033
RevisionNumber: {A5D5EDCC-E398-4022-B07C-E3CA36B74592}
CreateDate: 2024:02:29 22:27:26
ModifyDate: 2024:02:29 22:27:26
Pages: 450
Words: 2
Software: Windows Installer XML Toolset (3.11.2.4516)
Security: Read-only recommended
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
143
Monitored processes
5
Malicious processes
0
Suspicious processes
1

Behavior graph

Click at the process to see the details
start msiexec.exe no specs msiexec.exe vssvc.exe no specs srtasks.exe no specs conhost.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
1324"C:\Windows\System32\msiexec.exe" /i C:\Users\admin\AppData\Local\Temp\playit-windows-x86_64-signed.msiC:\Windows\System32\msiexec.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows® installer
Exit code:
0
Version:
5.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\msiexec.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\aclayers.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
3128C:\WINDOWS\system32\vssvc.exeC:\Windows\System32\VSSVC.exe—services.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Microsoft® Volume Shadow Copy Service
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\vssvc.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
4052C:\WINDOWS\system32\msiexec.exe /VC:\Windows\System32\msiexec.exe
services.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Windows® installer
Version:
5.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\msiexec.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\aclayers.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
5324C:\WINDOWS\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:11C:\Windows\System32\SrTasks.exe—msiexec.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Microsoft® Windows System Protection background tasks.
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\srtasks.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
5820\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—SrTasks.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Console Window Host
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
Total events
9 144
Read events
8 989
Write events
145
Delete events
10

Modification events

(PID) Process:(4052) msiexec.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\SystemRestore
Operation:writeName:SrCreateRp (Enter)
Value:
4800000000000000EDB0BF5EFBCADA01D40F000068110000D50700000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(4052) msiexec.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\SPP
Operation:writeName:SppGetSnapshots (Enter)
Value:
4800000000000000EDB0BF5EFBCADA01D40F000068110000D20700000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(4052) msiexec.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\SPP
Operation:writeName:SppGetSnapshots (Leave)
Value:
480000000000000065C9045FFBCADA01D40F000068110000D20700000100000000000000000000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(4052) msiexec.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\SPP
Operation:writeName:SppEnumGroups (Enter)
Value:
480000000000000065C9045FFBCADA01D40F000068110000D10700000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(4052) msiexec.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\SPP
Operation:writeName:SppEnumGroups (Leave)
Value:
48000000000000000F2C075FFBCADA01D40F000068110000D10700000100000000000000010000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(4052) msiexec.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\SPP
Operation:writeName:SppCreate (Enter)
Value:
48000000000000006F8F095FFBCADA01D40F000068110000D00700000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(4052) msiexec.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SPP
Operation:writeName:LastIndex
Value:
11
(PID) Process:(4052) msiexec.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\SPP
Operation:writeName:SppGatherWriterMetadata (Enter)
Value:
4800000000000000C85D8A5FFBCADA01D40F000068110000D30700000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(4052) msiexec.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\VssapiPublisher
Operation:writeName:IDENTIFY (Enter)
Value:
48000000000000009B148F5FFBCADA01D40F000078100000E8030000010000000000000000000000F2165DF55B763C4C8A1B14FCFE5EA61400000000000000000000000000000000
(PID) Process:(3128) VSSVC.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\Registry Writer
Operation:writeName:IDENTIFY (Enter)
Value:
480000000000000093DF935FFBCADA01380C0000F0150000E80300000100000001000000000000000000000000000000000000000000000000000000000000000000000000000000
Executable files
3
Suspicious files
19
Text files
1
Unknown types
0

Dropped files

PID
Process
Filename
Type
4052msiexec.exeC:\System Volume Information\SPP\metadata-2 —
MD5:—
SHA256:—
4052msiexec.exeC:\WINDOWS\Installer\MSI650F.tmpbinary
MD5:A0821531680D8A1D76C3DC9D10D40EBF
SHA256:B14BDDA66EF87A8F2872C88434962BF2E5B4E9F339653081C68994B6766BE95F
4052msiexec.exeC:\System Volume Information\SPP\snapshot-2binary
MD5:3C27E6A5E3BFFE84DAF7BF1D6EC8FFBD
SHA256:1F054CED8CF922AE32A39D75C3A2A80B36D65BF63856B3114279C412F3F587F9
4052msiexec.exeC:\WINDOWS\Installer\1b6212.msiexecutable
MD5:93B91C8721CA2951ECCEB0FC0E739CC8
SHA256:727679568706156F635BE9B786C61B8FECAF55894B902A014AA6A2A691FC3108
4052msiexec.exeC:\WINDOWS\Installer\inprogressinstallinfo.ipibinary
MD5:906C40FC1EC0BD56267B291692AD4E0A
SHA256:1067CCFA39033A9EE05FF4C3C50D12DCC7BA4FB7E0809E01F75BEC02464DCF09
4052msiexec.exeC:\WINDOWS\TEMP\~DFF4D09DAFBF8A81A8.TMPbinary
MD5:BF619EAC0CDF3F68D496EA9344137E8B
SHA256:076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
4052msiexec.exeC:\WINDOWS\TEMP\~DF4359E87F4586D2CB.TMPbinary
MD5:906C40FC1EC0BD56267B291692AD4E0A
SHA256:1067CCFA39033A9EE05FF4C3C50D12DCC7BA4FB7E0809E01F75BEC02464DCF09
4052msiexec.exeC:\Program Files\playit_gg\bin\playit.exeexecutable
MD5:B52B1B1B92B4C4E96A9352BECDC372B5
SHA256:7DCC38A9820CCB0DE9C5652FDA9976D9F649F4239AC5E746A419F3076B324DD7
4052msiexec.exeC:\ProgramData\Microsoft\Windows\Start Menu\Programs\Playit.gg\Playit.gg.lnklnk
MD5:9DC01C0B83CF21D1902236C94925489F
SHA256:2E22E6F172332835BCED7592F9DE45276E3B824D114185607DE24153D6916F5B
4052msiexec.exeC:\WINDOWS\TEMP\~DFBB83EB9D47594FE3.TMPbinary
MD5:906C40FC1EC0BD56267B291692AD4E0A
SHA256:1067CCFA39033A9EE05FF4C3C50D12DCC7BA4FB7E0809E01F75BEC02464DCF09
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
9
TCP/UDP connections
70
DNS requests
20
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
2456
svchost.exe
GET
200
2.16.241.19:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
unknown
2456
svchost.exe
GET
200
88.221.169.152:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
unknown
3040
OfficeClickToRun.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEA77flR%2B3w%2FxBpruV2lte6A%3D
unknown
—
—
unknown
4656
SearchApp.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAI5PUjXAkJafLQcAAsO18o%3D
unknown
—
—
unknown
1544
svchost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
unknown
2196
SIHClient.exe
GET
200
104.119.109.218:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
unknown
2196
SIHClient.exe
GET
200
104.119.109.218:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
unknown
476
backgroundTaskHost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0%3D
unknown
—
—
unknown
—
—
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0%3D
unknown
—
—
unknown
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:138
—
—
—
whitelisted
2456
svchost.exe
51.104.136.2:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4032
svchost.exe
239.255.255.250:1900
—
—
—
whitelisted
2916
RUXIMICS.exe
51.104.136.2:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4656
SearchApp.exe
2.23.209.141:443
—
Akamai International B.V.
GB
unknown
2520
MoUsoCoreWorker.exe
51.104.136.2:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
2456
svchost.exe
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
2456
svchost.exe
2.16.241.19:80
crl.microsoft.com
Akamai International B.V.
DE
unknown
2456
svchost.exe
88.221.169.152:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
3040
OfficeClickToRun.exe
13.69.116.104:443
self.events.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
unknown

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 51.124.78.146
whitelisted
crl.microsoft.com
  • 2.16.241.19
  • 2.16.241.12
whitelisted
www.microsoft.com
  • 88.221.169.152
  • 104.119.109.218
whitelisted
self.events.data.microsoft.com
  • 13.69.116.104
whitelisted
ocsp.digicert.com
  • 192.229.221.95
whitelisted
login.live.com
  • 40.126.32.76
  • 40.126.32.134
  • 40.126.32.140
  • 40.126.32.138
  • 40.126.32.74
  • 40.126.32.133
  • 40.126.32.68
  • 20.190.160.20
whitelisted
r.bing.com
  • 23.213.161.196
  • 23.213.161.217
  • 23.213.161.225
  • 23.213.161.224
  • 23.213.161.211
  • 23.213.161.226
  • 23.213.161.212
  • 23.213.161.223
  • 23.213.161.202
  • 23.213.161.215
  • 23.213.161.221
  • 23.213.161.218
  • 23.213.161.216
  • 23.213.161.219
whitelisted
go.microsoft.com
  • 184.28.89.167
whitelisted
slscr.update.microsoft.com
  • 40.127.169.103
whitelisted
fe3cr.delivery.mp.microsoft.com
  • 52.165.164.15
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
playit-windows-x86_64-signed.msi