Overview
overview
7Static
static
3geometryda....4.zip
windows10-2004-x64
7arm64/package.json
windows10-2004-x64
3arm64/www/data.json
windows10-2004-x64
3arm64/www/...28.png
windows10-2004-x64
1arm64/www/...16.png
windows10-2004-x64
1arm64/www/...56.png
windows10-2004-x64
1arm64/www/...32.png
windows10-2004-x64
1arm64/www/...12.png
windows10-2004-x64
1arm64/www/...64.png
windows10-2004-x64
1arm64/www/...go.png
windows10-2004-x64
1arm64/www/...t0.png
windows10-2004-x64
1arm64/www/...t0.png
windows10-2004-x64
1arm64/www/...t1.png
windows10-2004-x64
1arm64/www/index.html
windows10-2004-x64
7arm64/www/...ain.js
windows10-2004-x64
3arm64/www/...ime.js
windows10-2004-x64
3arm64/www/...ker.js
windows10-2004-x64
3arm64/www/...ker.js
windows10-2004-x64
3arm64/www/...ain.js
windows10-2004-x64
3arm64/www/...eck.js
windows10-2004-x64
3arm64/www/...ble.js
windows10-2004-x64
3arm64/www/...eck.js
windows10-2004-x64
3x64/www/index.html
windows10-2004-x64
7x64/www/sc...ain.js
windows10-2004-x64
3x64/www/sc...ime.js
windows10-2004-x64
3x64/www/sc...ker.js
windows10-2004-x64
3x64/www/sc...ker.js
windows10-2004-x64
3x64/www/sc...ain.js
windows10-2004-x64
3x64/www/sc...eck.js
windows10-2004-x64
3x64/www/sc...ble.js
windows10-2004-x64
3x64/www/sc...eck.js
windows10-2004-x64
3x64/www/workermain.js
windows10-2004-x64
3Analysis
- max time kernel
898s - max time network
490s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
31/05/2026, 17:07
Static task
static1
Behavioral task
behavioral1
Sample
geometrydash_full_archive_version_3.4.zip
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral2
Sample
arm64/package.json
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral3
Sample
arm64/www/data.json
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral4
Sample
arm64/www/icons/icon-128.png
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral5
Sample
arm64/www/icons/icon-16.png
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral6
Sample
arm64/www/icons/icon-256.png
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral7
Sample
arm64/www/icons/icon-32.png
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral8
Sample
arm64/www/icons/icon-512.png
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral9
Sample
arm64/www/icons/icon-64.png
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral10
Sample
arm64/www/icons/loading-logo.png
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral11
Sample
arm64/www/images/geo-sheet0.png
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral12
Sample
arm64/www/images/shared-0-sheet0.png
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral13
Sample
arm64/www/images/shared-0-sheet1.png
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral14
Sample
arm64/www/index.html
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral15
Sample
arm64/www/scripts/c3main.js
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral16
Sample
arm64/www/scripts/c3runtime.js
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral17
Sample
arm64/www/scripts/dispatchworker.js
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral18
Sample
arm64/www/scripts/jobworker.js
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral19
Sample
arm64/www/scripts/main.js
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral20
Sample
arm64/www/scripts/modernjscheck.js
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral21
Sample
arm64/www/scripts/objRefTable.js
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral22
Sample
arm64/www/scripts/supportcheck.js
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral23
Sample
x64/www/index.html
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral24
Sample
x64/www/scripts/c3main.js
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral25
Sample
x64/www/scripts/c3runtime.js
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral26
Sample
x64/www/scripts/dispatchworker.js
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral27
Sample
x64/www/scripts/jobworker.js
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral28
Sample
x64/www/scripts/main.js
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral29
Sample
x64/www/scripts/modernjscheck.js
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral30
Sample
x64/www/scripts/objRefTable.js
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral31
Sample
x64/www/scripts/supportcheck.js
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral32
Sample
x64/www/workermain.js
Resource
win10v2004-20260513-en
windows10-2004-x64
General
- Target arm64/www/icons/icon-16.png
- Size 767B
- Sample260531-vm41msft9l
- SHA256 1eaf0a704b39426ad07de694facd86c2a4d088f85b9f31b158e957a6ceff2834
- MD5 cb5a6a119dd4ce4849d5705c76c10e40
- SHA1 5e15697299e6d76ebeb4a793d9f27f283eed2e11
- SHA512 e86294dc154238b03f78ba850c6d50aa3c1454eaa80de4e772b8350fd982aa20cdc9f964ea63fe8919946efadfb2ab5b18516c2104c273c3800d5f52665ce723
- TLSH T12801BAFC4910F464B4E11A38A2F540E67C3DC5471FB04A0570872C32145974BB4DB567
- MD5 SHA1 SHA512 TLSH
Malware Config
Signatures
- Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 3256 mspaint.exe 3256 mspaint.exe - Suspicious use of SetWindowsHookEx 4 IoCs
pid Process 3256 mspaint.exe 3256 mspaint.exe 3256 mspaint.exe 3256 mspaint.exe
Processes
-
C:\Windows\system32\mspaint.exe"C:\Windows\system32\mspaint.exe" "C:\Users\Admin\AppData\Local\Temp\arm64\www\icons\icon-16.png"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:3256
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s DeviceAssociationService1⤵PID:1104