File name:

Installer_GGPokerUK_en.msi

Full analysis: https://app.any.run/tasks/0595cfa6-f869-4da0-8a24-514fc265c8c8
Verdict: Malicious activity
Analysis date: March 24, 2020, 14:18:28
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
generated-doc
Indicators:
MIME: application/x-msi
File info: Composite Document File V2 Document, Little Endian, Os: Windows, Version 6.2, MSI Installer, Code page: 1252, Title: Installation Database, Subject: GGPoker UK, Author: NSUS Ltd., Keywords: Installer, Comments: Windows Installer Package, Template: Intel;1033, Revision Number: {F2F6ECD1-3BA8-4480-A8D9-7C3603344628}, Create Time/Date: Tue Mar 17 03:22:48 2020, Last Saved Time/Date: Tue Mar 17 03:22:48 2020, Number of Pages: 200, Number of Words: 2, Name of Creating Application: Windows Installer XML Toolset (3.10.3.3007), Security: 2
MD5:

8FA7A69972AFAB5FFE369F4DD8A485BE

SHA1:

79414ACE19335C806059BDDDEC0351D575BBADA4

SHA256:

A002296391F97F1BF77BEDADDFE1C0C8D61D07CED9B88071B13292525AEBF10B

SSDEEP:

24576:ihF9Fwq6quL5wj9q4n1qZbPxeGThtqDrNS2R64qrSiUR8AAhNQsJCrpltk:cgLeZBnYyGThv2eAhsJCrp/

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Application was dropped or rewritten from another process

      • launcher.exe (PID: 3956)
      • launcher.exe (PID: 2848)
      • GGnet.exe (PID: 1388)

    • Loads dropped or rewritten executable

      • launcher.exe (PID: 3956)
      • launcher.exe (PID: 2848)
      • GGnet.exe (PID: 1388)

    • Changes settings of System certificates

      • GGnet.exe (PID: 1388)
      • launcher.exe (PID: 2848)

  • SUSPICIOUS

    • Executed as Windows Service

      • vssvc.exe (PID: 2872)

    • Reads Internet Cache Settings

      • launcher.exe (PID: 3956)
      • launcher.exe (PID: 2848)
      • GGnet.exe (PID: 1388)

    • Application launched itself

      • launcher.exe (PID: 3956)

    • Executable content was dropped or overwritten

      • msiexec.exe (PID: 3088)
      • launcher.exe (PID: 2848)
      • GGnet.exe (PID: 1388)

    • Creates files in the program directory

      • launcher.exe (PID: 2848)

    • Creates files in the user directory

      • GGnet.exe (PID: 1388)

    • Adds / modifies Windows certificates

      • GGnet.exe (PID: 1388)
      • launcher.exe (PID: 2848)

  • INFO

    • Low-level read access rights to disk partition

      • vssvc.exe (PID: 2872)

    • Reads settings of System Certificates

      • msiexec.exe (PID: 3088)
      • launcher.exe (PID: 3956)
      • launcher.exe (PID: 2848)
      • GGnet.exe (PID: 1388)

    • Creates files in the program directory

      • msiexec.exe (PID: 3088)

    • Creates a software uninstall entry

      • msiexec.exe (PID: 3088)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.msi | Microsoft Installer (100)

EXIF

FlashPix

CodePage: Windows Latin 1 (Western European)
Title: Installation Database
Subject: GGPoker UK
Author: NSUS Ltd.
Keywords: Installer
Comments: Windows Installer Package
Template: Intel;1033
RevisionNumber: {F2F6ECD1-3BA8-4480-A8D9-7C3603344628}
CreateDate: 2020:03:17 03:22:48
ModifyDate: 2020:03:17 03:22:48
Pages: 200
Words: 2
Software: Windows Installer XML Toolset (3.10.3.3007)
Security: Read-only recommended
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
47
Monitored processes
6
Malicious processes
4
Suspicious processes
0

Behavior graph

Click at the process to see the details
start drop and start drop and start msiexec.exe no specs msiexec.exe vssvc.exe no specs launcher.exe launcher.exe ggnet.exe

Process information

PID
CMD
Path
Indicators
Parent process
1388"C:\Program Files\GGPoker UK\bin\GGnet.exe" env=live brand=GGPOKER mode=nor lang=pt tags=""C:\Program Files\GGPoker UK\bin\GGnet.exe
launcher.exe
User:
admin
Integrity Level:
HIGH
Description:
GGNetwork
Exit code:
0
Version:
1.0.0
Modules
Images
c:\program files\ggpoker uk\bin\ggnet.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\shell32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
2848"C:\Program Files\GGPoker UK\launcher.exe" lauhcher_rerunC:\Program Files\GGPoker UK\launcher.exe
launcher.exe
User:
admin
Integrity Level:
HIGH
Description:
Game Launcher
Exit code:
0
Version:
1.0.0.1
Modules
Images
c:\program files\ggpoker uk\launcher.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\shell32.dll
2872C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe—services.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Microsoft® Volume Shadow Copy Service
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\vssvc.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
3088C:\Windows\system32\msiexec.exe /VC:\Windows\system32\msiexec.exe
services.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Windows® installer
Exit code:
0
Version:
5.0.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\msiexec.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
3956"C:\Program Files\GGPoker UK\\launcher.exe"C:\Program Files\GGPoker UK\launcher.exe
msiexec.exe
User:
admin
Integrity Level:
MEDIUM
Description:
Game Launcher
Exit code:
1
Version:
1.0.0.1
Modules
Images
c:\program files\ggpoker uk\launcher.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\shell32.dll
3984"C:\Windows\System32\msiexec.exe" /i "C:\Users\admin\Desktop\Installer_GGPokerUK_en.msi"C:\Windows\System32\msiexec.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows® installer
Exit code:
0
Version:
5.0.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\msiexec.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
Total events
2 242
Read events
739
Write events
1 491
Delete events
12

Modification events

(PID) Process:(3984) msiexec.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\12B\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(3088) msiexec.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\SystemRestore
Operation:writeName:SrCreateRp (Enter)
Value:
40000000000000007C64E523E701D601100C0000000B0000D5070000000000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(3088) msiexec.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\SPP
Operation:writeName:SppCreate (Enter)
Value:
40000000000000007C64E523E701D601100C0000000B0000D0070000000000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(3088) msiexec.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SPP
Operation:writeName:LastIndex
Value:
34
(PID) Process:(3088) msiexec.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\SPP
Operation:writeName:SppGatherWriterMetadata (Enter)
Value:
400000000000000008EB2C24E701D601100C0000000B0000D3070000000000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(3088) msiexec.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\VssapiPublisher
Operation:writeName:IDENTIFY (Enter)
Value:
400000000000000008EB2C24E701D601100C000098070000E80300000100000000000000000000004FC52986605F334983E91E66F057E7B80000000000000000
(PID) Process:(2872) vssvc.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\ASR Writer
Operation:writeName:IDENTIFY (Enter)
Value:
400000000000000024393B24E701D601380B0000DC0F0000E8030000010000000100000000000000000000000000000000000000000000000000000000000000
(PID) Process:(2872) vssvc.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\Shadow Copy Optimization Writer
Operation:writeName:IDENTIFY (Enter)
Value:
400000000000000024393B24E701D601380B0000E40B0000E8030000010000000100000000000000000000000000000000000000000000000000000000000000
(PID) Process:(2872) vssvc.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\Registry Writer
Operation:writeName:IDENTIFY (Enter)
Value:
400000000000000024393B24E701D601380B0000C8030000E8030000010000000100000000000000000000000000000000000000000000000000000000000000
(PID) Process:(2872) vssvc.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\COM+ REGDB Writer
Operation:writeName:IDENTIFY (Enter)
Value:
400000000000000024393B24E701D601380B0000640C0000E8030000010000000100000000000000000000000000000000000000000000000000000000000000
Executable files
13
Suspicious files
15
Text files
44
Unknown types
9

Dropped files

PID
Process
Filename
Type
3088msiexec.exeC:\System Volume Information\SPP\metadata-2 —
MD5:—
SHA256:—
3088msiexec.exeC:\Users\admin\AppData\Local\Temp\~DFCBBC84D8BA2FB736.TMP —
MD5:—
SHA256:—
2872vssvc.exeC: —
MD5:—
SHA256:—
3088msiexec.exeC:\Users\admin\AppData\Local\Temp\~DF8F73D5F8A9F16425.TMP —
MD5:—
SHA256:—
3088msiexec.exeC:\Windows\Installer\a6a958.msiexecutable
MD5:—
SHA256:—
3088msiexec.exeC:\System Volume Information\SPP\snapshot-2binary
MD5:—
SHA256:—
3088msiexec.exeC:\Windows\Installer\MSIAF24.tmpbinary
MD5:—
SHA256:—
3088msiexec.exeC:\System Volume Information\SPP\OnlineMetadataCache\{8629c54f-5f60-4933-83e9-1e66f057e7b8}_OnDiskSnapshotPropbinary
MD5:—
SHA256:—
3956launcher.exeC:\Users\admin\AppData\Local\Temp\CabCD7A.tmp —
MD5:—
SHA256:—
3956launcher.exeC:\Users\admin\AppData\Local\Temp\TarCD7B.tmp —
MD5:—
SHA256:—
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
22
TCP/UDP connections
12
DNS requests
6
Threats
1

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
3956
launcher.exe
GET
301
18.162.198.91:80
http://portal-front.good-game-network.com/launcher/update/GGPOKER?filename=fchecksum.ini
US
—
—
suspicious
3956
launcher.exe
GET
301
18.162.198.91:80
http://portal-front.good-game-network.com/launcher/update/GGPOKER?filename=fchecksum.ini
US
—
—
suspicious
2848
launcher.exe
GET
301
18.162.198.91:80
http://portal-front.good-game-network.com/launcher/update/GGPOKER?filename=fchecksum.ini
US
—
—
suspicious
3956
launcher.exe
GET
301
18.162.198.91:80
http://portal-front.good-game-network.com/launcher/update/GGPOKER?filename=version.ini
US
—
—
suspicious
1388
GGnet.exe
GET
301
18.162.198.91:80
http://dlportal.good-game-network.com/iron/update/GGPOKER?fileName=43/windows/launcher.update.windows.json
US
—
—
suspicious
2848
launcher.exe
GET
301
18.162.198.91:80
http://portal-front.good-game-network.com/launcher/update/GGPOKER?filename=version.ini
US
—
—
suspicious
2848
launcher.exe
GET
301
18.162.198.91:80
http://portal-front.good-game-network.com/launcher/update/GGPOKER?filename=fchecksum.ini
US
—
—
suspicious
1388
GGnet.exe
GET
301
18.162.198.91:80
http://dlportal.good-game-network.com/iron/update/GGPOKER?fileName=external/tools/sqlite3.zip
US
—
—
suspicious
1388
GGnet.exe
GET
301
18.162.198.91:80
http://dlportal.good-game-network.com/iron/update/GGPOKER?fileName=iron.update.43.json
US
—
—
suspicious
1388
GGnet.exe
GET
301
18.162.198.91:80
http://dlportal.good-game-network.com/iron/update/GGPOKER?fileName=brands/GGPOKER/windows/Launcher_bg.bmp
US
—
—
suspicious
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
1388
GGnet.exe
18.162.198.91:80
portal-front.good-game-network.com
—
US
unknown
1388
GGnet.exe
163.171.132.119:443
download.ggnet.com
—
US
malicious
1388
GGnet.exe
23.210.248.158:443
www.adobe.com
Akamai International B.V.
NL
malicious
1388
GGnet.exe
93.184.220.29:80
ocsp.digicert.com
MCI Communications Services, Inc. d/b/a Verizon Business
US
whitelisted
3956
launcher.exe
18.162.198.91:80
portal-front.good-game-network.com
—
US
unknown
1388
GGnet.exe
23.210.248.158:80
www.adobe.com
Akamai International B.V.
NL
malicious
2848
launcher.exe
163.171.132.119:443
download.ggnet.com
—
US
malicious
3956
launcher.exe
93.184.220.29:80
ocsp.digicert.com
MCI Communications Services, Inc. d/b/a Verizon Business
US
whitelisted
3956
launcher.exe
163.171.132.119:443
download.ggnet.com
—
US
malicious
2848
launcher.exe
18.162.198.91:80
portal-front.good-game-network.com
—
US
unknown

DNS requests

Domain
IP
Reputation
portal-front.good-game-network.com
  • 18.162.198.91
  • 18.162.174.147
suspicious
download.ggnet.com
  • 163.171.132.119
malicious
ocsp.digicert.com
  • 93.184.220.29
whitelisted
dlportal.good-game-network.com
  • 18.162.198.91
  • 18.162.174.147
unknown
www.adobe.com
  • 23.210.248.158
whitelisted

Threats

PID
Process
Class
Message
1388
GGnet.exe
Potential Corporate Privacy Violation
ET POLICY Outdated Flash Version M1
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
Installer_GGPokerUK_en.msi