8b830be10232543de798937b233abc8b28a20443d724b6bc323ffb309ed8633e

Analysis

user interaction
yes
max time kernel
175s
max time network
187s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
11/05/2026, 12:11

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
epsteins island.zip
Size 307.0MB
Sample260511-pcslzahs2s
SHA256 8b830be10232543de798937b233abc8b28a20443d724b6bc323ffb309ed8633e
MD5 da42eb7a75009c6b28607445eda7779b
SHA1 0a6812eeb63e0609dfba1d43bab61580902f2140
SHA512 335d13084b7cecafc5ee0f6212acfd4477e9e473274fad107bbfbdbe65f0666875541e8541902be8f763024c839692d34c07dcd453077946322652b00e9c578c
SSDEEP 6291456:4XWJMrlSMKJIZqe+qkvoFFvZBdanwOetqqRM8E10:KWJmsMKeZqtQlzMwI6MO
TLSH
T1BFE833B4C0EC00B0D717E2B4A591AA4B5DF9329557F994257A08FFE48BEE7806E3B701
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Malware Config

Signatures

Checks SCSI registry key(s) 3 TTPs 4 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	Myfamilyfallsintodepravity.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	Myfamilyfallsintodepravity.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	Myfamilyfallsintodepravity.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	Myfamilyfallsintodepravity.exe

NTFS ADS 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\Myfamilyfallsintodepravity-0.2.zip:Zone.Identifier	chrome.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5276	chrome.exe
5276	chrome.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
6048	Myfamilyfallsintodepravity.exe
6048	Myfamilyfallsintodepravity.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 6048 wrote to memory of 5996	6048	Myfamilyfallsintodepravity.exe	109
PID 6048 wrote to memory of 1496	6048	Myfamilyfallsintodepravity.exe	111
PID 6048 wrote to memory of 352	6048	Myfamilyfallsintodepravity.exe	113

C:\Windows\Explorer.exe
C:\Windows\Explorer.exe /idlist,,"C:\Users\Admin\AppData\Local\Temp\epsteins island.zip"
1⤵
PID:4468

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5376,i,3239187322084590620,14343604278879111869,524288 --field-trial-handle=1912,i,768066907043520188,256999664013925405,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=5380 /prefetch:14
1⤵
PID:6136

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:2080

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=10 --metrics-shmem-handle=5756,i,1839622465635173376,5154304621769728143,2097152 --field-trial-handle=1912,i,768066907043520188,256999664013925405,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=5528 /prefetch:1
1⤵
PID:4852

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=11 --metrics-shmem-handle=3464,i,5209242781548461558,16570929090511580118,2097152 --field-trial-handle=1912,i,768066907043520188,256999664013925405,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=3620 /prefetch:1
1⤵
PID:2648

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=3368,i,4844172752444632978,5123546468603219520,524288 --field-trial-handle=1912,i,768066907043520188,256999664013925405,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=4540 /prefetch:14
1⤵
PID:6040

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=4464,i,2070092248178375755,9126783292637313113,524288 --field-trial-handle=1912,i,768066907043520188,256999664013925405,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=3528 /prefetch:14
1⤵
PID:6084

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=4456,i,11805513482783686708,2451976572944935726,524288 --field-trial-handle=1912,i,768066907043520188,256999664013925405,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=5876 /prefetch:14
1⤵
PID:2928

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --metrics-shmem-handle=4456,i,16471282744783792005,7375983823853776680,524288 --field-trial-handle=1912,i,768066907043520188,256999664013925405,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=5888 /prefetch:12
1⤵
PID:5344

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=16 --metrics-shmem-handle=4080,i,12466827480712406424,4764957505839021232,2097152 --field-trial-handle=1912,i,768066907043520188,256999664013925405,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=4032 /prefetch:1
1⤵
PID:4452

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=17 --metrics-shmem-handle=3968,i,7781942427019596665,8190017037250190358,2097152 --field-trial-handle=1912,i,768066907043520188,256999664013925405,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=4012 /prefetch:1
1⤵
PID:1868

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=18 --metrics-shmem-handle=6096,i,5138482292921053327,13762329362326129619,2097152 --field-trial-handle=1912,i,768066907043520188,256999664013925405,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=6052 /prefetch:1
1⤵
PID:3280

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=3648,i,2463370507423111369,12977492442506473306,524288 --field-trial-handle=1912,i,768066907043520188,256999664013925405,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=6016 /prefetch:14
1⤵
- NTFS ADS
PID:1508

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:5032

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=6232,i,3237603709199150219,10224124633777671069,262144 --field-trial-handle=1912,i,768066907043520188,256999664013925405,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=3636 /prefetch:10
1⤵
- Suspicious behavior: EnumeratesProcesses
PID:5276

C:\Users\Admin\Downloads\New folder\Myfamilyfallsintodepravity-0.2\Myfamilyfallsintodepravity.exe
"C:\Users\Admin\Downloads\New folder\Myfamilyfallsintodepravity-0.2\Myfamilyfallsintodepravity.exe"
1⤵
- Checks SCSI registry key(s)
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:6048
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c "ver"
  2⤵
  PID:5996
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c "ver"
  2⤵
  PID:1496
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c "ver"
  2⤵
  PID:352

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

_auto-LT1.save

Path C:\Users\Admin\AppData\Roaming\RenPy\Myfamilyfallsintodepravity-1764438766\_auto-LT1.save
Size 219KB
SHA256 2b60a03ddec5eb096b0a2e8a53317834467553c37dbed7ebf16668bbdfca9345
MD5 e5f5b52271fc307533a804c9a326956d
SHA1 c52a6023bf8f9793ac42c4ecca390a216201e491
SHA512 55050d3258b43bed7b0fea44106ce4f75b77656f8a78a21e725f054e62d715d8b6b2d2c3997f95874354f3ae0d7802eeddf31b30ec28a4dd1b964cfc273d3ae1
SSDEEP 6144:sRm9fNXA9SQYtlX69JHCXwSKDLZvAA51m8p9:j9faSN+JHCXSLp3b7
TLSH
T1392423A9D1A3AAA6FF3FA93673073BCB6B21BA34CB078ED604B164555644361C700C37
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_auto-LT1.save

Path C:\Users\Admin\AppData\Roaming\RenPy\Myfamilyfallsintodepravity-1764438766\_auto-LT1.save
Size 219KB
SHA256 17d48db83fbb2e025a5237bc47d68742255438009552035649023ed80393839d
MD5 f6b5eb2b6d280dbebe20187da4d537f9
SHA1 dd08a96311fd2efdd736b50b1672a2373d84967b
SHA512 23803f9632a2c47504772102b44c2c62939c6eea5350cf5f1b965009187b09cdf9976c74c850b1030b161ed5a84b6ca4c4fe3fa0591deb964700d4992e3d4fe4
SSDEEP 6144:jRm9fNXA9SQYtlX69JHCowSKDLZvAA51m8pX:k9faSN+JHCoSLp3b9
TLSH
T1532423A5D1A76AA6FF3FA93673073BCB6B21BA34CB079ED600B124955648391C700C27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_auto-LT1.save

Path C:\Users\Admin\AppData\Roaming\RenPy\Myfamilyfallsintodepravity-1764438766\_auto-LT1.save
Size 85KB
SHA256 41dc0c4501a0292b3d5c15285ed2f9a83d3313fdcc5f3f3d5e05773459e3b41c
MD5 290b09f676f7800bf60f73aa9811697b
SHA1 2757c6942688126a8f8ee8f6aa5d11dd8226023c
SHA512 e62292798b5fa71531791c0d833daa4c471c807aa3d351e426b8fa0c1b82878739027c3c2be387d2cab9e9c3f9f52ff8bb77a92901511a2e855f7bb5f9d4467b
SSDEEP 1536:HD3yKEpta4td8kHqDxD59WeDeGvjS0klvoJxA6yDyLu1tknXGLvOeWW6O6t:HD3yKFA2gqtbpG0gmKtyyYXGLvOMzM
TLSH
T1EF83027C73FEDAC2D62C7AEC6C9F00CA166E6570037E60124671B48D8B32D51E581BAE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

text.txt

Path C:\Users\Admin\AppData\Roaming\RenPy\Myfamilyfallsintodepravity-1764438766\sync\text.txt
Size 5B
SHA256 314ad142957febe390cc7223b4deb1d1b21c187f84f6e7257a23fe46c27fcae3
MD5 f4020e91252aafd4b18d8acd17f883db
SHA1 748d77dbb8bdb0dd330c099e7fde82da053fb1ff
SHA512 301ddd0e34cbd842dae99a2cc4ccbfeb6ee8b3def39c214a719fa9edc26d7142749bbe6e992d26353dc167febbab0dbc05476b68a86ad93cab5f299f0aaf916d
MD5 SHA1 SHA512

Submit Download

persistent.1778501960.tmp

Path C:\Users\Admin\Downloads\New folder\Myfamilyfallsintodepravity-0.2\game\saves\persistent.1778501960.tmp
Size 3KB
SHA256 13d7b90fb9c980855a7a0c59bc9b0c3c35127e6e9622ee17d618481f6e3ebf77
MD5 33b681ceb799607a7f590342cfa9cdc6
SHA1 5196ba73f76e817ab158ac4b4bb1c2d164e32b4b
SHA512 a29b4f5d0a64a6a22d8ec6b188cb71ebaedb6389cd129632b8135a3b8d33f6f23f714089dd865558ce4fd8449c32c536e7552872540c5c941ac5b70bf260aeb7
TLSH
T19F715D7C226D4F6C25949E0FC7E17375859EDF54E0A1BA65D12B1C606C684B6277403C
MD5 SHA1 SHA512 TLSH

Submit Download

memory/4468-0-0x0000000000B60000-0x000000000130E000-memory.dmp

Download

memory/6048-340-0x0000000006C70000-0x0000000006C82000-memory.dmp

Download

memory/6048-336-0x0000000002020000-0x00000000027CE000-memory.dmp

Download

memory/6048-497-0x0000000002020000-0x00000000027CE000-memory.dmp

Download