Analysis
- max time kernel
149s - max time network
153s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
27/06/2026, 15:01
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
Super Meat Boy Jack O'Lantern/Prerequisites/DXSETUP.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
Super Meat Boy Jack O'Lantern/Prerequisites/vcredist_x64.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
6 signatures
150 seconds
Behavioral task
behavioral3
Sample
Super Meat Boy Jack O'Lantern/Prerequisites/vcredist_x86.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
6 signatures
150 seconds
Behavioral task
behavioral4
Sample
Super Meat Boy Jack O'Lantern/SuperMeatBoy.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
1 signatures
150 seconds
General
- Target Super Meat Boy Jack O'Lantern/Prerequisites/vcredist_x86.exe
- Size 1.7MB
- Sample260627-sd3ecabt8v
- SHA256 c6a7e484f4d84883bc1205bccea3114c0521025712922298ede9b2a1cd632357
- MD5 b936f0f378b9a35489353e878154e899
- SHA1 56719288ab6514c07ac2088119d8a87056eeb94a
- SHA512 acdf7b464a258b3ae3015c808d0e08a697ba3209662faa9b18c1aee882bf236dc725f6c3425cb6f9e10d8ab5cbb82ac118ff947a4b9ec6f91c2e150b0beef70f
- SSDEEP 49152:wQixbpVndRcpfqwYO3u2XoKNLlMDEe/pmVS/F0jD:wtdnfnwp3oOLuB/3/uD
- TLSH T1CE8533428124885AF1C52A30ABB73E5E8EF9D651743F87BB314B8543E65B770A923F34
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
pid Process 2720 install.exe - Loads dropped DLL 1 IoCs
pid Process 2720 install.exe - Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\H: install.exe File opened (read-only) \??\L: install.exe File opened (read-only) \??\X: install.exe File opened (read-only) \??\Y: install.exe File opened (read-only) \??\Z: install.exe File opened (read-only) \??\G: install.exe File opened (read-only) \??\I: install.exe File opened (read-only) \??\J: install.exe File opened (read-only) \??\M: install.exe File opened (read-only) \??\N: install.exe File opened (read-only) \??\Q: install.exe File opened (read-only) \??\A: install.exe File opened (read-only) \??\E: install.exe File opened (read-only) \??\K: install.exe File opened (read-only) \??\O: install.exe File opened (read-only) \??\P: install.exe File opened (read-only) \??\R: install.exe File opened (read-only) \??\T: install.exe File opened (read-only) \??\U: install.exe File opened (read-only) \??\B: install.exe File opened (read-only) \??\S: install.exe File opened (read-only) \??\V: install.exe File opened (read-only) \??\W: install.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vcredist_x86.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language install.exe - Suspicious use of AdjustPrivilegeToken 30 IoCs
description pid Process Token: SeSecurityPrivilege 2336 msiexec.exe Token: SeCreateTokenPrivilege 2720 install.exe Token: SeAssignPrimaryTokenPrivilege 2720 install.exe Token: SeLockMemoryPrivilege 2720 install.exe Token: SeIncreaseQuotaPrivilege 2720 install.exe Token: SeMachineAccountPrivilege 2720 install.exe Token: SeTcbPrivilege 2720 install.exe Token: SeSecurityPrivilege 2720 install.exe Token: SeTakeOwnershipPrivilege 2720 install.exe Token: SeLoadDriverPrivilege 2720 install.exe Token: SeSystemProfilePrivilege 2720 install.exe Token: SeSystemtimePrivilege 2720 install.exe Token: SeProfSingleProcessPrivilege 2720 install.exe Token: SeIncBasePriorityPrivilege 2720 install.exe Token: SeCreatePagefilePrivilege 2720 install.exe Token: SeCreatePermanentPrivilege 2720 install.exe Token: SeBackupPrivilege 2720 install.exe Token: SeRestorePrivilege 2720 install.exe Token: SeShutdownPrivilege 2720 install.exe Token: SeDebugPrivilege 2720 install.exe Token: SeAuditPrivilege 2720 install.exe Token: SeSystemEnvironmentPrivilege 2720 install.exe Token: SeChangeNotifyPrivilege 2720 install.exe Token: SeRemoteShutdownPrivilege 2720 install.exe Token: SeUndockPrivilege 2720 install.exe Token: SeSyncAgentPrivilege 2720 install.exe Token: SeEnableDelegationPrivilege 2720 install.exe Token: SeManageVolumePrivilege 2720 install.exe Token: SeImpersonatePrivilege 2720 install.exe Token: SeCreateGlobalPrivilege 2720 install.exe - Suspicious use of WriteProcessMemory 1 IoCs
description pid Process procid_target PID 3672 wrote to memory of 2720 3672 vcredist_x86.exe 89
Processes
-
C:\Users\Admin\AppData\Local\Temp\Super Meat Boy Jack O'Lantern\Prerequisites\vcredist_x86.exe"C:\Users\Admin\AppData\Local\Temp\Super Meat Boy Jack O'Lantern\Prerequisites\vcredist_x86.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3672 -
\??\c:\20007df41a3b297a8c\install.exec:\20007df41a3b297a8c\.\install.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
- Enumerates connected drives
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:2720
-
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2336
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\20007df41a3b297a8c\eula.1031.txt
- Size 17KB
- SHA256 a75019ac38e0d3570633fa282f3d95d20763657f4a2fe851fae52a3185d1eded
- MD5 9147a93f43d8e58218ebcb15fda888c9
- SHA1 8277c722ba478be8606d8429de3772b5de4e5f09
- SHA512 cc9176027621a590a1d4f6e17942012023e3fabc3316bc62c4b17cd61ce76bf5cf270bd32da95dba7ddf3163e84114be1103a6f810ca1a05d914712895f09705
- SSDEEP 384:Ce91JzQa6Kc6ZyaMeqFjLD+f2bTdmKMvO:Ce94aUaijLD+fiTdmKMvO
- TLSH T1E0827622A3FD4618F6FB3F506EB966685E7ABC96AC3DC64D1150104E09B6E80CD70B73
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\20007df41a3b297a8c\install.exe
- Size 549KB
- SHA256 08966ce743aa1cbed0874933e104ef7b913188ecd8f0c679f7d8378516c51da2
- MD5 520a6d1cbcc9cf642c625fe814c93c58
- SHA1 fb517abb38e9ccc67de411d4f18a9446c11c0923
- SHA512 b92a32b27d6e6187c30d8018d7e0a35bde98dc524eabcd7709420b499778159e2872db04a3f2dfacf016d0e6d97b8175920e83fa28804609786828e52f058ff0
- SSDEEP 12288:bpNWz8beHITmTmbA4yrRGsR5A5lcwFhpto/cT9aRzS:bpC/mbANrr5MiwFhDoET9t
- TLSH T12EC46D307EF48035D4F351B446AD626151B9FCB01B3984CBB38443EEAAB0BD1AA35B67
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path \??\c:\20007df41a3b297a8c\eula.1033.txt
- Size 9KB
- SHA256 93a3c629fecfd10c1cf614714efd69b10e89cfcaf94c2609d688b27754e4ab41
- MD5 99c22d4a31f4ead4351b71d6f4e5f6a1
- SHA1 73207ebe59f6e1073c0d76c8835a312c367b6104
- SHA512 47b7ec5fed06d6c789935e9e95ea245c7c498b859e2c0165a437a7bf0006e447c4df4beeb97484c56446f1dae547a01387bea4e884970380f37432825eb16e94
- SSDEEP 192:uJXbvpB7sTAiLftIotTl7msk4apSftn7ib/:uJrYTAwKotTYszasfsb/
- TLSH T129229D15B7F91208F6FB7F906EB5A1785A3A7CA6AD3EC69D1150004E09B6E40CE70B73
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path \??\c:\20007df41a3b297a8c\globdata.ini
- Size 1KB
- SHA256 7912e3fcf2698cf4f8625e563cd8215c6668739cae18bd6f27af2d25bec5c951
- MD5 0a6b586fabd072bd7382b5e24194eac7
- SHA1 60e3c7215c1a40fbfb3016d52c2de44592f8ca95
- SHA512 b96b0448e9f0e94a7867b6bb103979e9ef2c0e074bcb85988d450d63de6edcf21dc83bb154aafb7de524af3c3734f0bb1ba649db0408612479322e1aa85be9f4
- TLSH T1AF11D64846A04125E2F2485298E21CEA9DAB74235E39E95A00D52BCF9AB4E41FD3634B
- MD5 SHA1 SHA512 TLSH
- Path \??\c:\20007df41a3b297a8c\install.ini
- Size 843B
- SHA256 672621b056188f8d3fa5ab8cd3df4f95530c962af9bb11cf7c9bd1127b3c3605
- MD5 0da9ab4977f3e7ba8c65734df42fdab6
- SHA1 b4ed6eea276f1a7988112f3bde0bd89906237c3f
- SHA512 1ef58271cdedbdc53615631cc823483f874c89c2d62e0678de9d469a82bd676eb8abd34656caa5128b7edb0eb24dbf0992e5e571a97f7782c933b2be88af3144
- TLSH T18001EF63C629518928E6E8B740A00A8BBC55AEC973412C54C0512CCC2FE788BD32EB7E
- MD5 SHA1 SHA512 TLSH
- Path \??\c:\20007df41a3b297a8c\install.res.1033.dll
- Size 89KB
- SHA256 9bf7026a47daab7bb2948fd23e8cf42c06dd2e19ef8cdea0af7367453674a8f9
- MD5 9edeb8b1c5c0a4cd3a3016b85108127d
- SHA1 9ec25485a7ff52d1211a28cca095950901669b34
- SHA512 aa2f6dde0aa6d804bcadc169b6d48aad6b485b8e669f1b0c3624848b27bcd37bd3dd9073bddc6bde5c0dd3bc565fd851e161edb0efe9fcaa4636cdcaaec966db
- SSDEEP 768:JvH1jrH2TnaQGLdYnWl6ZgSsPMRq6Ao8JO/CaqpuK6tmW3U8HafdjIafdjcj8HbU:rjJunWlORCTJO/CajFk8HafdUafd4X
- TLSH T1E093504267F88125F5F73B74ACB957601E3ABC919E39C68E2280619E4DB2BC0DD70763
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path \??\c:\20007df41a3b297a8c\vc_red.msi
- Size 227KB
- SHA256 507ac60e145057764f13cf1ad5366a7e15ddc0da5cc22216f69e3482697d5e88
- MD5 e0951d3cb1038eb2d2b2b2f336e1ab32
- SHA1 500f832b1fcd869e390457ff3dc005ba5b8cca96
- SHA512 34b9c5ed9dd8f384ecf7589e824c3acc824f5f70a36517d35f6d79b0296fbccb699c3ec1e86e749d34643934bf2e20a9c384a5586d368af9887b7c2cede9bfb8
- SSDEEP 3072:WZhJpq8Cy/U5i9vQ4Vv1jO5E/8HafOafaK8yCNmRK0+4mN2E/28z8Cy/:JgR93VdjD/RzSKz626g
- TLSH T107344B12B914C133DC402372025FEB513A7CAFE78F95899721D9729D9E727C4A33A2AD
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path \??\c:\20007df41a3b297a8c\vcredist.bmp
- Size 5KB
- SHA256 594884a8006e24ad5b1578cd7c75aca21171bb079ebdc4f6518905bcf2237ba1
- MD5 06fba95313f26e300917c6cea4480890
- SHA1 31beee44776f114078fc403e405eaa5936c4bc3b
- SHA512 7dca0f1ab5d3fd1ac8755142a7ca4d085bb0c2f12a7272e56159dadfa22da79ec8261815be71b9f5e7c32f6e8121ecb2443060f7db76feaf01eb193200e67dfd
- SSDEEP 24:pS75l775l7aqV7j7Q55okTg2vrlgprDDcaWJQvS2PRSmob6SHSl4CiZ:pKV7j7AXgbjlLI
- TLSH T15EC1E74B200A6854D296603147AECDFB472BADC182E063F631F93E8A36FDC98351E719
- MD5 SHA1 SHA512 SSDEEP TLSH
