da22ebb688aa8a7b9f04e730a7fbe2d19b1e6b3f6f477f5a0fcac6541a712fd9

Analysis

max time kernel
149s
max time network
134s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
08/05/2026, 07:51

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Heroes-University-H-0.8.1-pc/renpy/translation/scanstrings.pyo
Size 5KB
Sample260508-jqaenaev4x
SHA256 da22ebb688aa8a7b9f04e730a7fbe2d19b1e6b3f6f477f5a0fcac6541a712fd9
MD5 1026b792c5b247cd73b48ff5a7cbbfeb
SHA1 b7c443e6fa1bcc5944010a58a29dc3ae0401ecfb
SHA512 195e9f210fdc582a41fd5c25c0d35be05dc817cd29be8b3892fe84670b0fdf38844f63c59484a59f15b4d28a1055167afdd90b643fceac1cb01e3717dde0e967
SSDEEP 96:U32P/r9pkm8e++4p7Xdqe0Jh2VUvl2kYnGkUcy3hQutDA5qo:aUjYne+Vp7hJavlAGkU/R3tgqo
TLSH
T137C130B027FD45D7D8A15F3290F080A7CD33FA7754A0277252E8F4F12A9A65AC76A384
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-650218026-1419908266-2856590055-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-650218026-1419908266-2856590055-1000_Classes\Local Settings	OpenWith.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
5516	OpenWith.exe

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\Heroes-University-H-0.8.1-pc\renpy\translation\scanstrings.pyo
1⤵
- Modifies registry class
PID:4988

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:5516

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4988-0-0x0000024794280000-0x00000247942B1000-memory.dmp

Download

memory/5516-1-0x0000023E58A70000-0x0000023E58AA1000-memory.dmp