5876404d7991d718cde6936119ee536f833a849066f3ea41310b689d36660141

Analysis

user interaction
yes
max time kernel
148s
max time network
166s
platform
windows10-ltsc_2021_x64
resource
win10ltsc2021-20260130-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20260130-enlocale:en-usos:windows10-ltsc_2021-x64systemwindows
submitted
27/04/2026, 00:58

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Granny Chapter Two v1.2.1/Granny Chapter Two.exe
Size 639KB
Sample260427-bbvs2saz7z
SHA256 5876404d7991d718cde6936119ee536f833a849066f3ea41310b689d36660141
MD5 f9f4ae3a08dbbecae1a0cf1063dd3ef4
SHA1 55dd8718d17b531d5875170437965ce700341435
SHA512 a86e0ec5c7e448f44e77d43f7104adef69bd9f994a04abfc4bb1ca14f0457b7673da785e277b69680c8b59691a1ef13a7c3ca404e56466cb72afef90c180bbf1
SSDEEP 6144:PEbaWnBUCGabkR2DOS4lyT6QWrRfsTAykwS0s+LIR06di/vEl+RKoyXe5UyESy8+:PoCCROS45mvs+LYcZ+Gfc3X1mTlVy
TLSH
T1E9D45C2E0B69C507E3506EFCA4A1F1E1B6BD40F18D2E890FA9B2D9D75968DF72D4D080
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Malware Config

Signatures

Checks processor information in registry 2 TTPs 4 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-2783838373-340812344-1280766377-1000\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Granny Chapter Two.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Granny Chapter Two.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	Granny Chapter Two.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	Granny Chapter Two.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
5016	Granny Chapter Two.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 5016 wrote to memory of 3592	5016	Granny Chapter Two.exe	84

C:\Users\Admin\AppData\Local\Temp\Granny Chapter Two v1.2.1\Granny Chapter Two.exe
"C:\Users\Admin\AppData\Local\Temp\Granny Chapter Two v1.2.1\Granny Chapter Two.exe"
1⤵
- Checks processor information in registry
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5016
- C:\Users\Admin\AppData\Local\Temp\Granny Chapter Two v1.2.1\UnityCrashHandler64.exe
  "C:\Users\Admin\AppData\Local\Temp\Granny Chapter Two v1.2.1\UnityCrashHandler64.exe" --attach 5016 3236850307072
  2⤵
  PID:3592

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x34c 0x4f0
1⤵
PID:3896

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Path C:\Users\Admin\AppData\LocalLow\DVloper\Granny_ Chapter Two\Unity\d1bbc083-5519-408c-817e-6cf17b68d8e2\Analytics\ArchivedEvents\177725187400002.e2be930f\c
Size 1B
SHA256 d4735e3a265e16eee03f59718b9b5d03019c07d8b6c51f90da3a666eec13ab35
MD5 c81e728d9d4c2f636f067f89cc14862c
SHA1 da4b9237bacccdf19c0760cab7aec4a8359010b0
SHA512 40b244112641dd78dd4f93b6c9190dd46e0099194d5a44257b7efad6ef9ff4683da1eda0244448cb343aa688f5d3efd7314dafe580ac0bcbf115aeca9e8dc114
MD5 SHA1 SHA512

Submit Download

Path C:\Users\Admin\AppData\LocalLow\DVloper\Granny_ Chapter Two\Unity\d1bbc083-5519-408c-817e-6cf17b68d8e2\Analytics\ArchivedEvents\177725187400002.e2be930f\s
Size 440B
SHA256 f13c2da4cae0f8fe75116ad6f8f84460bfbd2d34d090b34cdc099fbc42782042
MD5 8d6bc8c21d31b41fdc9ba8142e0cc60b
SHA1 8eee67a5097bd0e3f493a9e4f8cbeece43c3fb7b
SHA512 ac36aa951d84b991906f356f457cfef7944b56c7c3879873ed558d16d229c8b444d5d005fd97c379e71b36b7371b5bade012db1b470e387c47d0eb795859b3f7
TLSH
T137F023B28B32A5319667041405F49CBF4C1C265070B0F73E0FF46164431861813D33B6
MD5 SHA1 SHA512 TLSH