372c02833c17bbece9e95d0f9cf7f0af009f299e20749fa28af49e1303ea16ff

Resubmissions

17/05/2026, 17:39

260517-v8l2ysbw2y10

17/05/2026, 17:37

260517-v645rabv8x10

Analysis

max time kernel
150s
max time network
148s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
17/05/2026, 17:37

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
game.exe
Size 2.5MB
Sample260517-v645rabv8x
SHA256 372c02833c17bbece9e95d0f9cf7f0af009f299e20749fa28af49e1303ea16ff
MD5 1a8eea09419281eef0a85e277ef17bc3
SHA1 340013c032b3043b95b15ee18bd32e054d0a0bad
SHA512 83b4cc31cd99ca519f620f974e98d89693082aa237a9b33e63a0ffca584be31faae92425f902307e83e9551a72707b62e46006a8bf895b926447d6f1c10f3900
SSDEEP 49152:bzf6V1jqp9ekTDDSxfHLqY+xKkmyLW5RhM0glV:bzyV0pMfOtIFIlV
TLSH
T1D3C5E122F3918837D55326345D4B93D86926BF201E2858877BE93E4CAF367C27839367
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery persistence trojan

Malware Config

Signatures

UAC bypass 3 TTPs 1 IoCs

defense_evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	game.exe

Event Triggered Execution: Image File Execution Options Injection 1 TTPs 4 IoCs

persistence

Image File Execution Options Injection

T1546.012

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\explorer.exe	game.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\explorer.exe\Debugger = "C:\\Users\\Admin\\AppData\\Local\\Temp\\game.exe"	game.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe	game.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe\Debugger = "C:\\Users\\Admin\\AppData\\Local\\Temp\\game.exe"	game.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Java = "C:\\Users\\Admin\\AppData\\Local\\Temp\\game.exe"	game.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	game.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	game.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	game.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4784	game.exe
4784	game.exe
4784	game.exe
4784	game.exe
4784	game.exe
4784	game.exe
4784	game.exe
4784	game.exe
4784	game.exe
4784	game.exe
4784	game.exe
4784	game.exe
4784	game.exe
4784	game.exe
4784	game.exe
4784	game.exe
4784	game.exe
4784	game.exe
4784	game.exe
4784	game.exe
4784	game.exe
4784	game.exe
4784	game.exe
4784	game.exe
4784	game.exe
4784	game.exe
4784	game.exe
4784	game.exe
4784	game.exe
4784	game.exe
4784	game.exe
4784	game.exe
4784	game.exe
4784	game.exe
4784	game.exe
4784	game.exe
4784	game.exe
4784	game.exe
4784	game.exe
4784	game.exe
4784	game.exe
4784	game.exe
4784	game.exe
4784	game.exe
4784	game.exe
4784	game.exe
4784	game.exe
4784	game.exe
4784	game.exe
4784	game.exe
4784	game.exe
4784	game.exe
4784	game.exe
4784	game.exe
4784	game.exe
4784	game.exe
4784	game.exe
4784	game.exe
4784	game.exe
4784	game.exe
4784	game.exe
4784	game.exe
4784	game.exe
4784	game.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
4784	game.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeBackupPrivilege	4784	game.exe
Token: SeRestorePrivilege	4784	game.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
4784	game.exe
5720	game.exe

System policy modification 1 TTPs 3 IoCs

defense_evasion

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\HideFastUserSwitching = "1"	game.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	game.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	game.exe

C:\Users\Admin\AppData\Local\Temp\game.exe
"C:\Users\Admin\AppData\Local\Temp\game.exe"
1⤵
- UAC bypass
- Event Triggered Execution: Image File Execution Options Injection
- Adds Run key to start application
- Checks whether UAC is enabled
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:4784

C:\Users\Admin\AppData\Local\Temp\game.exe
C:\Users\Admin\AppData\Local\Temp\game.exe explorer.exe
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:5720