Resubmissions

19/07/2026, 04:09

260719-eqvndabt8r

19/07/2026, 03:17

260719-dtdzcsdv9x3

19/07/2026, 02:57

260719-dfxvbac17t7

Analysis

  • user interaction
    yes
  • max time kernel
    177s
  • max time network
    214s
  • platform
    windows11-21h2_x64
  • resource
    win11-20260513-en
  • resource tags

    arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
  • submitted
    19/07/2026, 02:57

General

  • Target
    Deltarune.rar
  • Size 572.6MB
  • Sample260719-dfxvbac17t
  • SHA256 c742c71b84cda3affd4c128da5bd3c6d6fdb657437cdf08c3bc91a488cf27c79
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10

Malware Config

Signatures

  • Executes dropped EXE 4 IoCs
  • Drops desktop.ini file(s) 1 IoCs
  • Network Service Discovery 1 TTPs 1 IoCs

    Attempt to gather information on host's network.

  • Checks processor information in registry 2 TTPs 8 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Modifies data under HKEY_USERS 3 IoCs
  • Modifies registry class 3 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SetWindowsHookEx 9 IoCs
  • Suspicious use of WriteProcessMemory 1 IoCs

Processes

  • C:\Program Files\7-Zip\7zFM.exe
    "C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\Deltarune.rar"
    1⤵
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    PID:4404
  • C:\Windows\System32\rundll32.exe
    C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
    1⤵
      PID:4452
    • C:\Users\Admin\Downloads\home\nottherealsocksfor1w\Pirated_games\Deltarune\DELTARUNE\DELTARUNE.exe
      "C:\Users\Admin\Downloads\home\nottherealsocksfor1w\Pirated_games\Deltarune\DELTARUNE\DELTARUNE.exe"
      1⤵
      • Executes dropped EXE
      • Suspicious use of SetWindowsHookEx
      PID:3444
    • C:\Windows\System32\GameBarPresenceWriter.exe
      "C:\Windows\System32\GameBarPresenceWriter.exe" -ServerName:Windows.Gaming.GameBar.Internal.PresenceWriterServer
      1⤵
      • Network Service Discovery
      PID:4224
    • C:\Windows\system32\OpenWith.exe
      C:\Windows\system32\OpenWith.exe -Embedding
      1⤵
      • Suspicious use of SetWindowsHookEx
      PID:4496
    • C:\Windows\system32\svchost.exe
      C:\Windows\system32\svchost.exe -k BcastDVRUserService -s BcastDVRUserService
      1⤵
      • Drops desktop.ini file(s)
      • Checks processor information in registry
      • Modifies registry class
      PID:2540
    • C:\Windows\system32\svchost.exe
      C:\Windows\system32\svchost.exe -k BcastDVRUserService -s BcastDVRUserService
      1⤵
      • Checks processor information in registry
      • Modifies registry class
      PID:3384
    • C:\Users\Admin\Downloads\home\nottherealsocksfor1w\Pirated_games\Deltarune\DELTARUNE\DELTARUNE.exe
      "C:\Users\Admin\Downloads\home\nottherealsocksfor1w\Pirated_games\Deltarune\DELTARUNE\DELTARUNE.exe"
      1⤵
      • Executes dropped EXE
      • Suspicious use of SetWindowsHookEx
      PID:4528
    • C:\Windows\system32\OpenWith.exe
      C:\Windows\system32\OpenWith.exe -Embedding
      1⤵
      • Suspicious use of SetWindowsHookEx
      PID:1556
    • C:\Windows\System32\svchost.exe
      C:\Windows\System32\svchost.exe -k GraphicsPerfSvcGroup -s GraphicsPerfSvc
      1⤵
      • Checks processor information in registry
      • Modifies data under HKEY_USERS
      PID:4372
    • C:\Windows\system32\svchost.exe
      C:\Windows\system32\svchost.exe -k BcastDVRUserService -s BcastDVRUserService
      1⤵
      • Checks processor information in registry
      • Modifies registry class
      PID:2996
    • C:\Users\Admin\Downloads\home\nottherealsocksfor1w\Pirated_games\Deltarune\DELTARUNE\DELTARUNE.exe
      "C:\Users\Admin\Downloads\home\nottherealsocksfor1w\Pirated_games\Deltarune\DELTARUNE\DELTARUNE.exe"
      1⤵
      • Executes dropped EXE
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:544
      • C:\Users\Admin\Downloads\home\nottherealsocksfor1w\Pirated_games\Deltarune\DELTARUNE\DELTARUNE.exe
        C:\Users\Admin\Downloads\home\nottherealsocksfor1w\Pirated_games\Deltarune\DELTARUNE\DELTARUNE.exe -game data.win launcher switch_-1 returning_0
        2⤵
        • Executes dropped EXE
        PID:428
    • C:\Windows\system32\OpenWith.exe
      C:\Windows\system32\OpenWith.exe -Embedding
      1⤵
      • Suspicious use of SetWindowsHookEx
      PID:4056
    • C:\Windows\system32\OpenWith.exe
      C:\Windows\system32\OpenWith.exe -Embedding
      1⤵
        PID:236
      • C:\Windows\system32\svchost.exe
        C:\Windows\system32\svchost.exe -k BcastDVRUserService -s BcastDVRUserService
        1⤵
          PID:4972

        Network

              MITRE ATT&CK Enterprise v16

              Replay Monitor

              Loading Replay Monitor...

              Downloads

              dr.ini

              • Path C:\Users\Admin\AppData\Local\DELTARUNE\dr.ini
              • Size 247B
              • SHA256 43c16a227ccc808714e80690e64a6a7a6bf7d308cc2be9fa377e1e3c7db992a9
              • MD5 SHA1 SHA512 TLSH

              dr.ini

              • Path C:\Users\Admin\AppData\Local\DELTARUNE\dr.ini
              • Size 247B
              • SHA256 d023fec6e5037d096a3e58716cacd93a9630412e3b04f854be2c50b08f39effc
              • MD5 SHA1 SHA512 TLSH

              AUDIO_INTRONOISE.ogg

              • Path C:\Users\Admin\AppData\Local\Temp\7zE43179FA9\home\nottherealsocksfor1w\Pirated_games\Deltarune\DELTARUNE\chapter3_windows\AUDIO_INTRONOISE.ogg
              • Size 253KB
              • SHA256 39e9dd180519d1929d280799ea8bff77ba899653de79e0954221fec14b1eca7b
              • MD5 SHA1 SHA512 SSDEEP TLSH

              snd_closet_fall.ogg

              • Path C:\Users\Admin\AppData\Local\Temp\7zE43179FA9\home\nottherealsocksfor1w\Pirated_games\Deltarune\DELTARUNE\chapter3_windows\snd_closet_fall.ogg
              • Size 116KB
              • SHA256 49ade98cb1534fad9ff07b18b448d1b67563365f606275a8a230b279d1b5a3d2
              • MD5 SHA1 SHA512 SSDEEP TLSH

              snd_closet_impact.ogg

              • Path C:\Users\Admin\AppData\Local\Temp\7zE43179FA9\home\nottherealsocksfor1w\Pirated_games\Deltarune\DELTARUNE\chapter3_windows\snd_closet_impact.ogg
              • Size 78KB
              • SHA256 a041d05cf35d235e2bf9fde25a71e06d6e11efce33d4246b30c5d562556d848f
              • MD5 SHA1 SHA512 SSDEEP TLSH

              snd_paper_rumble.ogg

              • Path C:\Users\Admin\AppData\Local\Temp\7zE43179FA9\home\nottherealsocksfor1w\Pirated_games\Deltarune\DELTARUNE\chapter3_windows\snd_paper_rumble.ogg
              • Size 30KB
              • SHA256 2a063a900e21794fadf11f7d8f3d17c7bcbf8cc90dec11975163078ce084e6ff
              • MD5 SHA1 SHA512 SSDEEP TLSH

              snd_paper_surf.ogg

              • Path C:\Users\Admin\AppData\Local\Temp\7zE43179FA9\home\nottherealsocksfor1w\Pirated_games\Deltarune\DELTARUNE\chapter3_windows\snd_paper_surf.ogg
              • Size 30KB
              • SHA256 8bc383e9cd6d40891304bee271da152af16a2293af1289f66d222a48c592a1b3
              • MD5 SHA1 SHA512 SSDEEP TLSH

              snd_rurus_appear.ogg

              • Path C:\Users\Admin\AppData\Local\Temp\7zE43179FA9\home\nottherealsocksfor1w\Pirated_games\Deltarune\DELTARUNE\chapter3_windows\snd_rurus_appear.ogg
              • Size 60KB
              • SHA256 a55f77023e0bcb6181094cbc844cc04a7130aaebcaa07766a0a7afa7892223fc
              • MD5 SHA1 SHA512 SSDEEP TLSH

              options.ini

              • Path C:\Users\Admin\AppData\Local\Temp\7zE43179FA9\home\nottherealsocksfor1w\Pirated_games\Deltarune\DELTARUNE\chapter4_windows\options.ini
              • Size 63B
              • SHA256 9661cdf7dd64de452729351b70833d24ca37ab80b3254c0a52b08c28bdca2e49
              • MD5 SHA1 SHA512 TLSH

              snd_bigcar_yelp.ogg

              • Path C:\Users\Admin\AppData\Local\Temp\7zE43179FA9\home\nottherealsocksfor1w\Pirated_games\Deltarune\DELTARUNE\chapter4_windows\snd_bigcar_yelp.ogg
              • Size 7KB
              • SHA256 7227d899a1d8712dc069f3b3bc7229899865e425e21256636bc8c5605ea77ba8
              • MD5 SHA1 SHA512 SSDEEP TLSH

              snd_dtrans_drone.ogg

              • Path C:\Users\Admin\AppData\Local\Temp\7zE43179FA9\home\nottherealsocksfor1w\Pirated_games\Deltarune\DELTARUNE\chapter4_windows\snd_dtrans_drone.ogg
              • Size 188KB
              • SHA256 f800be1425e584bfb3a602401d7213a83a137d2dd3872ae6cd062aece8eaef2b
              • MD5 SHA1 SHA512 SSDEEP TLSH

              snd_dtrans_flip.ogg

              • Path C:\Users\Admin\AppData\Local\Temp\7zE43179FA9\home\nottherealsocksfor1w\Pirated_games\Deltarune\DELTARUNE\chapter4_windows\snd_dtrans_flip.ogg
              • Size 37KB
              • SHA256 53c83f9a19ad956a22312941dcf6492e48bd43bf7de22fc2683dded6ac0e35b8
              • MD5 SHA1 SHA512 SSDEEP TLSH

              snd_dtrans_heavypassing.ogg

              • Path C:\Users\Admin\AppData\Local\Temp\7zE43179FA9\home\nottherealsocksfor1w\Pirated_games\Deltarune\DELTARUNE\chapter4_windows\snd_dtrans_heavypassing.ogg
              • Size 27KB
              • SHA256 7af68ffbf6fff282f839e40dbb6fd0cc44f72a0c48d372aaf4d6ca39b908b8e3
              • MD5 SHA1 SHA512 SSDEEP TLSH

              snd_dtrans_lw.ogg

              • Path C:\Users\Admin\AppData\Local\Temp\7zE43179FA9\home\nottherealsocksfor1w\Pirated_games\Deltarune\DELTARUNE\chapter4_windows\snd_dtrans_lw.ogg
              • Size 80KB
              • SHA256 693a127d51c1ffdf2c196496cf0b95aefe0c8365bae39ead34a20645882ce5c5
              • MD5 SHA1 SHA512 SSDEEP TLSH

              snd_dtrans_square.ogg

              • Path C:\Users\Admin\AppData\Local\Temp\7zE43179FA9\home\nottherealsocksfor1w\Pirated_games\Deltarune\DELTARUNE\chapter4_windows\snd_dtrans_square.ogg
              • Size 26KB
              • SHA256 bed1ee68a913c8900ef63fe6032728833362706f0e98b72e7a5b53965bc9b1cd
              • MD5 SHA1 SHA512 SSDEEP TLSH

              snd_dtrans_twinkle.ogg

              • Path C:\Users\Admin\AppData\Local\Temp\7zE43179FA9\home\nottherealsocksfor1w\Pirated_games\Deltarune\DELTARUNE\chapter4_windows\snd_dtrans_twinkle.ogg
              • Size 52KB
              • SHA256 af31b48ba91d8932728027d5f5fac8e4a47e4f0ca88e68827ccb1be1376209e5
              • MD5 SHA1 SHA512 SSDEEP TLSH

              snd_fountain_make.ogg

              • Path C:\Users\Admin\AppData\Local\Temp\7zE43179FA9\home\nottherealsocksfor1w\Pirated_games\Deltarune\DELTARUNE\chapter4_windows\snd_fountain_make.ogg
              • Size 84KB
              • SHA256 523da55498ad60313855e2befefb6659ef7eb79c78a5e0b9e194bb4027e66379
              • MD5 SHA1 SHA512 SSDEEP TLSH

              snd_fountain_target.ogg

              • Path C:\Users\Admin\AppData\Local\Temp\7zE43179FA9\home\nottherealsocksfor1w\Pirated_games\Deltarune\DELTARUNE\chapter4_windows\snd_fountain_target.ogg
              • Size 4KB
              • SHA256 aed05ae33c93d24da26f34b13b477c194ae963a2a1b511a232a61c5496d90eb0
              • MD5 SHA1 SHA512 SSDEEP TLSH

              snd_ghostappear.ogg

              • Path C:\Users\Admin\AppData\Local\Temp\7zE43179FA9\home\nottherealsocksfor1w\Pirated_games\Deltarune\DELTARUNE\chapter4_windows\snd_ghostappear.ogg
              • Size 17KB
              • SHA256 aa1855e7494c691056ebf8db149fc8cb292fbaa925f547e1373f761964432ca3
              • MD5 SHA1 SHA512 SSDEEP TLSH

              snd_great_shine.ogg

              • Path C:\Users\Admin\AppData\Local\Temp\7zE43179FA9\home\nottherealsocksfor1w\Pirated_games\Deltarune\DELTARUNE\chapter4_windows\snd_great_shine.ogg
              • Size 20KB
              • SHA256 8f5a5053cd175683cdfa3830b73f7fe1b7203b679c4809dfdc08b4c761624de3
              • MD5 SHA1 SHA512 SSDEEP TLSH

              snd_him_quick.ogg

              • Path C:\Users\Admin\AppData\Local\Temp\7zE43179FA9\home\nottherealsocksfor1w\Pirated_games\Deltarune\DELTARUNE\chapter4_windows\snd_him_quick.ogg
              • Size 34KB
              • SHA256 0ef382d5298b2d8daba246a46db398cb4dfc626a57c9c6f9595f1d9358442d36
              • MD5 SHA1 SHA512 SSDEEP TLSH

              snd_hitcar.ogg

              • Path C:\Users\Admin\AppData\Local\Temp\7zE43179FA9\home\nottherealsocksfor1w\Pirated_games\Deltarune\DELTARUNE\chapter4_windows\snd_hitcar.ogg
              • Size 10KB
              • SHA256 b86b266cc572933a8882d26a0729225d6e308f5daefbc5fdf3a28c2e645992e3
              • MD5 SHA1 SHA512 SSDEEP TLSH

              snd_hitcar_little.ogg

              • Path C:\Users\Admin\AppData\Local\Temp\7zE43179FA9\home\nottherealsocksfor1w\Pirated_games\Deltarune\DELTARUNE\chapter4_windows\snd_hitcar_little.ogg
              • Size 8KB
              • SHA256 559bed038778c622a85aa718fdc7ed713a8316b62ee84acccd56dfeaea2aee6b
              • MD5 SHA1 SHA512 SSDEEP TLSH

              snd_icespell.ogg

              • Path C:\Users\Admin\AppData\Local\Temp\7zE43179FA9\home\nottherealsocksfor1w\Pirated_games\Deltarune\DELTARUNE\chapter4_windows\snd_icespell.ogg
              • Size 34KB
              • SHA256 b1768b33d89ef31c72ea113d46cb6d4cf7038dc81490aca3efa7c500c633ce43
              • MD5 SHA1 SHA512 SSDEEP TLSH

              snd_revival.ogg

              • Path C:\Users\Admin\AppData\Local\Temp\7zE43179FA9\home\nottherealsocksfor1w\Pirated_games\Deltarune\DELTARUNE\chapter4_windows\snd_revival.ogg
              • Size 44KB
              • SHA256 e9dc59893281d2fd3cd06b38376f1d3de2f060ae1e144cb0f584916aee73b0b3
              • MD5 SHA1 SHA512 SSDEEP TLSH

              snd_smallcar_yelp.ogg

              • Path C:\Users\Admin\AppData\Local\Temp\7zE43179FA9\home\nottherealsocksfor1w\Pirated_games\Deltarune\DELTARUNE\chapter4_windows\snd_smallcar_yelp.ogg
              • Size 5KB
              • SHA256 7bbb80dc81429345569d7eb6567f1068015cfa12012b85ee954d24b73458cc28
              • MD5 SHA1 SHA512 SSDEEP TLSH

              snd_snowgrave.ogg

              • Path C:\Users\Admin\AppData\Local\Temp\7zE43179FA9\home\nottherealsocksfor1w\Pirated_games\Deltarune\DELTARUNE\chapter4_windows\snd_snowgrave.ogg
              • Size 43KB
              • SHA256 e34f9737fb330ca8e32e10842b1fff51fcf19d94ddb3e63294864d2ccfcefa34
              • MD5 SHA1 SHA512 SSDEEP TLSH

              snd_spell_pacify.ogg

              • Path C:\Users\Admin\AppData\Local\Temp\7zE43179FA9\home\nottherealsocksfor1w\Pirated_games\Deltarune\DELTARUNE\chapter4_windows\snd_spell_pacify.ogg
              • Size 17KB
              • SHA256 7cdd4890c8c6e134f5f37f4635447fe3ba0d108545ba030f968c212b0c119752
              • MD5 SHA1 SHA512 SSDEEP TLSH

              snd_usefountain.ogg

              • Path C:\Users\Admin\AppData\Local\Temp\7zE43179FA9\home\nottherealsocksfor1w\Pirated_games\Deltarune\DELTARUNE\chapter4_windows\snd_usefountain.ogg
              • Size 109KB
              • SHA256 f1aa3197d0ee44afe3c58fb72dc9daf18c2a92abeb9e5cb0b11bca49445fbc3e
              • MD5 SHA1 SHA512 SSDEEP TLSH

              DELTARUNE.exe

              • Path C:\Users\Admin\Downloads\home\nottherealsocksfor1w\Pirated_games\Deltarune\DELTARUNE\DELTARUNE.exe
              • Size 6.8MB
              • SHA256 b882cc1879ad8f24c63fa6e4f47a8fef9a01065ee61ad6220beed9932b04e7ed
              • MD5 SHA1 SHA512 SSDEEP TLSH

              audiogroup1.dat

              • Path C:\Users\Admin\Downloads\home\nottherealsocksfor1w\Pirated_games\Deltarune\DELTARUNE\chapter1_windows\audiogroup1.dat
              • Size 8.2MB
              • SHA256 f007d82c5e133b56b9c068fac8e83211c9b6b6b4a4264a956c83edf929132182
              • MD5 SHA1 SHA512 SSDEEP TLSH

              data.win

              • Path C:\Users\Admin\Downloads\home\nottherealsocksfor1w\Pirated_games\Deltarune\DELTARUNE\chapter1_windows\data.win
              • Size 11.6MB
              • SHA256 4b19ab7d5790655c703cdba63d0ab7067d77aad1cbc08d9d7f9dc1e8f75b4b77
              • MD5 SHA1 SHA512 SSDEEP TLSH

              lang_en.json

              • Path C:\Users\Admin\Downloads\home\nottherealsocksfor1w\Pirated_games\Deltarune\DELTARUNE\chapter1_windows\lang\lang_en.json
              • Size 530KB
              • SHA256 6a1d6cfd166bc7220a8440e19a4dfbde923056e2af333bc00b1084a11953c08f
              • MD5 SHA1 SHA512 SSDEEP TLSH

              data.win

              • Path C:\Users\Admin\Downloads\home\nottherealsocksfor1w\Pirated_games\Deltarune\DELTARUNE\data.win
              • Size 2.8MB
              • SHA256 609c603a54cf0b89797bf39422a32ca7b4dcc00df3a72fa11afedf36929739a1
              • MD5 SHA1 SHA512 SSDEEP TLSH

              AUDIO_DRONE.ogg

              • Path C:\Users\Admin\Downloads\home\nottherealsocksfor1w\Pirated_games\Deltarune\DELTARUNE\mus\AUDIO_DRONE.ogg
              • Size 182KB
              • SHA256 2775a00f8fe492efe5ecc7a513e32b0ce407d1848db16ef9686caf9a2c8f54f2
              • MD5 SHA1 SHA512 SSDEEP TLSH

              options.ini

              • Path C:\Users\Admin\Downloads\home\nottherealsocksfor1w\Pirated_games\Deltarune\DELTARUNE\options.ini
              • Size 40B
              • SHA256 26e34ad8f1f4d5aabe3b32a44847cdbe86adbf94a5c05eefb1f3e578c53a64c6
              • MD5 SHA1 SHA512

              desktop.ini

              • Path C:\Users\Admin\Videos\Captures\desktop.ini
              • Size 190B
              • SHA256 86d9f822aeb989755fac82929e8db369b3f5f04117ef96fd76e3d5f920a501d2
              • MD5 SHA1 SHA512 TLSH