Overview

overview

3

Static

static

3

Forza Hori....3.exe

windows10-ltsc_2021-x64

1

Forza Hori....3.exe

windows11-21h2-x64

3

Resubmissions

23/05/2026, 04:19

260523-exk3hscy3j3

23/05/2026, 03:55

260523-eg386acv2l7

23/05/2026, 03:47

260523-eckk9aez3w3

Analysis

  • user interaction
    yes
  • max time kernel
    88s
  • max time network
    153s
  • platform
    windows11-21h2_x64
  • resource
    win11-20260513-en
  • resource tags

    arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
  • submitted
    23/05/2026, 03:47

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    Forza Horizon 6 Luna Version 1.3.3.exe
  • Size 686KB
  • Sample260523-eckk9aez3w
  • SHA256 a667ee14eda319d1d6e90d8bde6b74f9370d00de1fda4a0a7d183744ac36668a
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
adwarespyware

Malware Config

Signatures

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies Internet Explorer settings 1 TTPs 52 IoCs
    adwarespyware
  • Modifies registry class 64 IoCs
  • Suspicious behavior: AddClipboardFormatListener 13 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of SetWindowsHookEx 26 IoCs
  • Suspicious use of WriteProcessMemory 13 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Forza Horizon 6 Luna Version 1.3.3.exe
    "C:\Users\Admin\AppData\Local\Temp\Forza Horizon 6 Luna Version 1.3.3.exe"
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:3040
    • C:\Windows\explorer.exe
      "C:\Windows\explorer.exe" C:\Users\Admin\AppData\Local\Temp
      2⤵
        PID:2176
      • C:\Windows\explorer.exe
        "C:\Windows\explorer.exe" C:\Users\Admin\AppData\Local\Temp
        2⤵
          PID:4324
        • C:\Windows\explorer.exe
          "C:\Windows\explorer.exe" C:\Users\Admin\AppData\Local\Temp
          2⤵
            PID:2000
          • C:\Windows\explorer.exe
            "C:\Windows\explorer.exe" C:\Users\Admin\AppData\Local\Temp
            2⤵
              PID:3376
            • C:\Windows\explorer.exe
              "C:\Windows\explorer.exe" C:\Users\Admin\AppData\Local\Temp
              2⤵
                PID:3380
              • C:\Windows\explorer.exe
                "C:\Windows\explorer.exe" C:\Users\Admin\AppData\Local\Temp
                2⤵
                  PID:5036
                • C:\Windows\explorer.exe
                  "C:\Windows\explorer.exe" C:\Users\Admin\AppData\Local\Temp
                  2⤵
                    PID:2380
                  • C:\Windows\explorer.exe
                    "C:\Windows\explorer.exe" C:\Users\Admin\AppData\Local\Temp
                    2⤵
                      PID:4000
                    • C:\Windows\explorer.exe
                      "C:\Windows\explorer.exe" C:\Users\Admin\AppData\Local\Temp
                      2⤵
                        PID:1816
                      • C:\Windows\explorer.exe
                        "C:\Windows\explorer.exe" C:\Users\Admin\AppData\Local\Temp
                        2⤵
                          PID:1644
                        • C:\Windows\explorer.exe
                          "C:\Windows\explorer.exe" C:\Users\Admin\AppData\Local\Temp
                          2⤵
                            PID:1160
                          • C:\Windows\explorer.exe
                            "C:\Windows\explorer.exe" C:\Users\Admin\AppData\Local\Temp
                            2⤵
                              PID:2112
                            • C:\Windows\explorer.exe
                              "C:\Windows\explorer.exe" C:\Users\Admin\AppData\Local\Temp
                              2⤵
                                PID:3240
                              • C:\Windows\explorer.exe
                                "C:\Windows\explorer.exe" C:\Users\Admin\AppData\Local\Temp
                                2⤵
                                  PID:3468
                              • C:\Windows\explorer.exe
                                C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
                                1⤵
                                • Modifies Internet Explorer settings
                                • Modifies registry class
                                • Suspicious behavior: AddClipboardFormatListener
                                • Suspicious behavior: GetForegroundWindowSpam
                                • Suspicious use of SetWindowsHookEx
                                PID:4008
                              • C:\Windows\System32\rundll32.exe
                                C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
                                1⤵
                                  PID:3176
                                • C:\Windows\explorer.exe
                                  C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
                                  1⤵
                                  • Modifies Internet Explorer settings
                                  • Modifies registry class
                                  • Suspicious behavior: AddClipboardFormatListener
                                  • Suspicious use of SetWindowsHookEx
                                  PID:1052
                                • C:\Windows\explorer.exe
                                  C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
                                  1⤵
                                  • Modifies Internet Explorer settings
                                  • Modifies registry class
                                  • Suspicious behavior: AddClipboardFormatListener
                                  • Suspicious use of SetWindowsHookEx
                                  PID:4832
                                • C:\Windows\explorer.exe
                                  C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
                                  1⤵
                                  • Modifies Internet Explorer settings
                                  • Modifies registry class
                                  • Suspicious behavior: AddClipboardFormatListener
                                  • Suspicious use of SetWindowsHookEx
                                  PID:3404
                                • C:\Windows\explorer.exe
                                  C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
                                  1⤵
                                  • Modifies Internet Explorer settings
                                  • Modifies registry class
                                  • Suspicious behavior: AddClipboardFormatListener
                                  • Suspicious use of SetWindowsHookEx
                                  PID:1840
                                • C:\Windows\explorer.exe
                                  C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
                                  1⤵
                                  • Modifies Internet Explorer settings
                                  • Modifies registry class
                                  • Suspicious behavior: AddClipboardFormatListener
                                  • Suspicious use of SetWindowsHookEx
                                  PID:4688
                                • C:\Windows\explorer.exe
                                  C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
                                  1⤵
                                  • Modifies Internet Explorer settings
                                  • Modifies registry class
                                  • Suspicious behavior: AddClipboardFormatListener
                                  • Suspicious use of SetWindowsHookEx
                                  PID:1216
                                • C:\Windows\explorer.exe
                                  C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
                                  1⤵
                                  • Modifies Internet Explorer settings
                                  • Modifies registry class
                                  • Suspicious behavior: AddClipboardFormatListener
                                  • Suspicious use of SetWindowsHookEx
                                  PID:4232
                                • C:\Windows\explorer.exe
                                  C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
                                  1⤵
                                  • Modifies Internet Explorer settings
                                  • Modifies registry class
                                  • Suspicious behavior: AddClipboardFormatListener
                                  • Suspicious use of SetWindowsHookEx
                                  PID:3984
                                • C:\Windows\explorer.exe
                                  C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
                                  1⤵
                                  • Modifies Internet Explorer settings
                                  • Modifies registry class
                                  • Suspicious behavior: AddClipboardFormatListener
                                  • Suspicious use of SetWindowsHookEx
                                  PID:4076
                                • C:\Windows\explorer.exe
                                  C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
                                  1⤵
                                  • Modifies Internet Explorer settings
                                  • Modifies registry class
                                  • Suspicious behavior: AddClipboardFormatListener
                                  • Suspicious use of SetWindowsHookEx
                                  PID:2120
                                • C:\Windows\explorer.exe
                                  C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
                                  1⤵
                                  • Modifies Internet Explorer settings
                                  • Modifies registry class
                                  • Suspicious behavior: AddClipboardFormatListener
                                  • Suspicious use of SetWindowsHookEx
                                  PID:1684
                                • C:\Windows\explorer.exe
                                  C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
                                  1⤵
                                  • Modifies Internet Explorer settings
                                  • Modifies registry class
                                  • Suspicious behavior: AddClipboardFormatListener
                                  • Suspicious use of SetWindowsHookEx
                                  PID:4696
                                • C:\Windows\explorer.exe
                                  C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
                                  1⤵
                                    PID:324

                                  Network

                                        MITRE ATT&CK Enterprise v16

                                        Replay Monitor

                                        Loading Replay Monitor...

                                        Downloads

                                        memory/3040-0-0x0000000000BB0000-0x0000000000C60000-memory.dmp
                                        Download

                                        memory/3040-1-0x00000000036C0000-0x00000000036D0000-memory.dmp
                                        Download

                                        memory/3040-2-0x00000000036C0000-0x00000000036D0000-memory.dmp
                                        Download

                                        memory/3040-9-0x00000000036C0000-0x00000000036D0000-memory.dmp
                                        Download

                                        memory/3040-10-0x00000000036C0000-0x00000000036D0000-memory.dmp
                                        Download

                                        memory/3040-11-0x00000000036C0000-0x00000000036D0000-memory.dmp
                                        Download

                                        memory/3040-12-0x00000000036C0000-0x00000000036D0000-memory.dmp
                                        Download