582031d5fdceff9c99e14399cceeabc5f4807a850bc0d971477ce6d05ba425d9

Analysis

user interaction
yes
max time kernel
149s
max time network
151s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
31/07/2026, 17:43

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
hedgemodmanager_33586.exe
Size 23.1MB
Sample260731-waxapseb65
SHA256 582031d5fdceff9c99e14399cceeabc5f4807a850bc0d971477ce6d05ba425d9
MD5 9ab6f4dc8258d8639c4621ba7cf5af37
SHA1 cfc4bd65f490f5497e691fcc10b884d602063cf7
SHA512 309a86d2098eecc10eb8e3e1cdd6012fa0b5b8be1c80460d45e2ddcdb29a892599a4122438061b1616711850beb0b0770c9dcfdbbd7d7d01d9d6bde53ce8bcd7
SSDEEP 393216:tomse60+pyx2ej68XRWOQbXowyCAUq818Q5UP7S2hy0VjDEALTfYdW82t4Zngpf:toi60+E3fBu0wy5Uq818aUzS2hRLTf82
TLSH
T189373310167688BBD8AE8B3BA030C408B7367D47A615C71C799EB7785FE2287C657273
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion

Malware Config

Signatures

Identifies Wine through registry keys 2 TTPs 1 IoCs

Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

defense_evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Wine	hedgemodmanager_33586.exe

Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
1	raw.githubusercontent.com
6	raw.githubusercontent.com

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\hedgemmtenpex\shell\open	hedgemodmanager_33586.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\hedgemmmusashi\shell\open\command	hedgemodmanager_33586.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\hedgemmhite\shell\open\command	hedgemodmanager_33586.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\hedgemmhite\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\hedgemodmanager_33586.exe\" -gb \"%1\""	hedgemodmanager_33586.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\hedgemmmillershadow\ = "URL:HedgeModManager for Shadow Generations"	hedgemodmanager_33586.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\hedgemmswa\shell	hedgemodmanager_33586.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\hedgemm	hedgemodmanager_33586.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\hedgemmgens\shell\open	hedgemodmanager_33586.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\hedgemmlw\shell\open	hedgemodmanager_33586.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\hedgemmrainbow\URL Protocol	hedgemodmanager_33586.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\hedgemmrainbow\shell\open\command	hedgemodmanager_33586.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\hedgemmhite\URL Protocol	hedgemodmanager_33586.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\hedgemmmillershadow	hedgemodmanager_33586.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\hedgemmgens\URL Protocol	hedgemodmanager_33586.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\hedgemmlw	hedgemodmanager_33586.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\hedgemmlw\ = "URL:HedgeModManager for Sonic Lost World"	hedgemodmanager_33586.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\hedgemmforces\ = "URL:HedgeModManager for Sonic Forces"	hedgemodmanager_33586.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\hedgemmmusashi	hedgemodmanager_33586.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\hedgemmmusashi\shell	hedgemodmanager_33586.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\hedgemmrainbow\shell	hedgemodmanager_33586.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\hedgemmswa\shell\open	hedgemodmanager_33586.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\hedgemmtenpex	hedgemodmanager_33586.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\hedgemmrainbow\ = "URL:HedgeModManager for Sonic Colours: Ultimate"	hedgemodmanager_33586.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\hedgemmswa\URL Protocol	hedgemodmanager_33586.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\hedgemmgens	hedgemodmanager_33586.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\hedgemmmusashi\ = "URL:HedgeModManager for Olympic Games Tokyo 2020"	hedgemodmanager_33586.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\hedgemm\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\hedgemodmanager_33586.exe\" \"%1\""	hedgemodmanager_33586.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\hedgemmforces\shell\open\command	hedgemodmanager_33586.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\hedgemmforces\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\hedgemodmanager_33586.exe\" -gb \"%1\""	hedgemodmanager_33586.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\hedgemmtenpex\URL Protocol	hedgemodmanager_33586.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\hedgemmforces	hedgemodmanager_33586.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\hedgemmforces\URL Protocol	hedgemodmanager_33586.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\hedgemmtenpex\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\hedgemodmanager_33586.exe\" -gb \"%1\""	hedgemodmanager_33586.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\hedgemmmusashi\URL Protocol	hedgemodmanager_33586.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\hedgemmmusashi\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\hedgemodmanager_33586.exe\" -gb \"%1\""	hedgemodmanager_33586.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\hedgemmrangers\shell\open	hedgemodmanager_33586.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\hedgemm\ = "URL:HedgeModManager"	hedgemodmanager_33586.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\hedgemmgens\shell	hedgemodmanager_33586.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\hedgemmlw\shell\open\command	hedgemodmanager_33586.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\hedgemmforces\shell\open	hedgemodmanager_33586.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\hedgemmmusashi\shell\open	hedgemodmanager_33586.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\hedgemmhite\ = "URL:HedgeModManager for Sonic Origins"	hedgemodmanager_33586.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\hedgemm\shell\open\command	hedgemodmanager_33586.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\hedgemm\shell	hedgemodmanager_33586.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\hedgemmgens\ = "URL:HedgeModManager for Sonic Generations (2011)"	hedgemodmanager_33586.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\hedgemmgens\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\hedgemodmanager_33586.exe\" -gb \"%1\""	hedgemodmanager_33586.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\hedgemmforces\shell	hedgemodmanager_33586.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\hedgemmrangers\shell	hedgemodmanager_33586.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\hedgemmlw\URL Protocol	hedgemodmanager_33586.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\hedgemmhite	hedgemodmanager_33586.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\hedgemmmillershadow\shell\open\command	hedgemodmanager_33586.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\hedgemmmillershadow\shell	hedgemodmanager_33586.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\hedgemmswa\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\hedgemodmanager_33586.exe\" -gb \"%1\""	hedgemodmanager_33586.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\hedgemmrangers\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\hedgemodmanager_33586.exe\" -gb \"%1\""	hedgemodmanager_33586.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\hedgemmlw\shell	hedgemodmanager_33586.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\hedgemmrainbow	hedgemodmanager_33586.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\hedgemmrainbow\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\hedgemodmanager_33586.exe\" -gb \"%1\""	hedgemodmanager_33586.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\hedgemmhite\shell	hedgemodmanager_33586.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\hedgemmmillershadow\shell\open	hedgemodmanager_33586.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\hedgemmlw\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\hedgemodmanager_33586.exe\" -gb \"%1\""	hedgemodmanager_33586.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\hedgemmtenpex\shell\open\command	hedgemodmanager_33586.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\hedgemmrangers\shell\open\command	hedgemodmanager_33586.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\hedgemmswa\ = "URL:HedgeModManager for Unleashed Recompiled"	hedgemodmanager_33586.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\hedgemm\URL Protocol	hedgemodmanager_33586.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	3788	hedgemodmanager_33586.exe

C:\Users\Admin\AppData\Local\Temp\hedgemodmanager_33586.exe
"C:\Users\Admin\AppData\Local\Temp\hedgemodmanager_33586.exe"
1⤵
- Identifies Wine through registry keys
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:3788

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3788-0-0x00007FFB7385F000-0x00007FFB73860000-memory.dmp

Download

memory/3788-1-0x00007FFB736D0000-0x00007FFB74074000-memory.dmp

Download

memory/3788-3-0x0000019B66190000-0x0000019B678B0000-memory.dmp

Download

memory/3788-2-0x00007FFB736D0000-0x00007FFB74074000-memory.dmp

Download

memory/3788-4-0x0000019B67D60000-0x0000019B67D72000-memory.dmp

Download

memory/3788-5-0x00007FFB736D0000-0x00007FFB74074000-memory.dmp

Download

memory/3788-6-0x00007FFB736D0000-0x00007FFB74074000-memory.dmp

Download

memory/3788-7-0x00007FFB736D0000-0x00007FFB74074000-memory.dmp

Download

memory/3788-11-0x0000019B67D90000-0x0000019B67D9A000-memory.dmp

Download

memory/3788-10-0x0000019B67D00000-0x0000019B67D0A000-memory.dmp

Download

memory/3788-9-0x0000019B695D0000-0x0000019B695EA000-memory.dmp

Download

memory/3788-8-0x0000019B6A010000-0x0000019B6A8FC000-memory.dmp

Download

memory/3788-12-0x0000019B69E10000-0x0000019B69E6C000-memory.dmp

Download

memory/3788-13-0x0000019B695B0000-0x0000019B695CA000-memory.dmp

Download

memory/3788-14-0x00007FFB736D0000-0x00007FFB74074000-memory.dmp

Download

memory/3788-16-0x0000019B69ED0000-0x0000019B69EEC000-memory.dmp

Download

memory/3788-15-0x0000019B6B3C0000-0x0000019B6B47A000-memory.dmp

Download

memory/3788-19-0x0000019B69EC0000-0x0000019B69ECE000-memory.dmp

Download

memory/3788-20-0x0000019B6B680000-0x0000019B6B732000-memory.dmp

Download

memory/3788-18-0x0000019B6B340000-0x0000019B6B37E000-memory.dmp

Download

memory/3788-21-0x0000019B6B320000-0x0000019B6B328000-memory.dmp

Download

memory/3788-17-0x0000019B69EB0000-0x0000019B69EB8000-memory.dmp

Download

memory/3788-22-0x0000019B6BB80000-0x0000019B6C204000-memory.dmp

Download

memory/3788-24-0x0000019B6B380000-0x0000019B6B3B4000-memory.dmp

Download

memory/3788-23-0x0000019B6C4C0000-0x0000019B6C90A000-memory.dmp

Download

memory/3788-27-0x0000019B6BAC0000-0x0000019B6BAC8000-memory.dmp

Download

memory/3788-28-0x0000019B6BA60000-0x0000019B6BA7E000-memory.dmp

Download

memory/3788-26-0x0000019B6BA90000-0x0000019B6BAB6000-memory.dmp

Download

memory/3788-25-0x0000019B6BA80000-0x0000019B6BA88000-memory.dmp

Download

memory/3788-29-0x0000019B6BB50000-0x0000019B6BB72000-memory.dmp

Download

memory/3788-30-0x00007FFB736D0000-0x00007FFB74074000-memory.dmp

Download

memory/3788-31-0x0000019B6BB10000-0x0000019B6BB18000-memory.dmp

Download

memory/3788-35-0x0000019B6BB40000-0x0000019B6BB48000-memory.dmp

Download

memory/3788-34-0x0000019B6F910000-0x0000019B6F986000-memory.dmp

Download

memory/3788-37-0x0000019B6FDA0000-0x0000019B6FDA8000-memory.dmp

Download

memory/3788-36-0x0000019B6F9A0000-0x0000019B6F9A8000-memory.dmp

Download

memory/3788-39-0x00007FFB736D0000-0x00007FFB74074000-memory.dmp

Download

memory/3788-40-0x00007FFB736D0000-0x00007FFB74074000-memory.dmp

Download

memory/3788-41-0x0000019B714A0000-0x0000019B714A8000-memory.dmp

Download

memory/3788-42-0x00007FFB736D0000-0x00007FFB74074000-memory.dmp

Download

memory/3788-43-0x00007FFB736D0000-0x00007FFB74074000-memory.dmp

Download

memory/3788-44-0x00007FFB736D0000-0x00007FFB74074000-memory.dmp

Download

memory/3788-45-0x00007FFB736D0000-0x00007FFB74074000-memory.dmp

Download

memory/3788-46-0x00007FFB736D0000-0x00007FFB74074000-memory.dmp

Download

memory/3788-47-0x00007FFB736D0000-0x00007FFB74074000-memory.dmp

Download

memory/3788-48-0x00007FFB736D0000-0x00007FFB74074000-memory.dmp

Download

memory/3788-49-0x00007FFB736D0000-0x00007FFB74074000-memory.dmp

Download

memory/3788-50-0x0000019B71030000-0x0000019B7108E000-memory.dmp

Download

memory/3788-51-0x00007FFB736D0000-0x00007FFB74074000-memory.dmp

Download

memory/3788-52-0x00007FFB736D0000-0x00007FFB74074000-memory.dmp

Download

memory/3788-53-0x00007FFB736D0000-0x00007FFB74074000-memory.dmp

Download

memory/3788-54-0x0000019B71090000-0x0000019B710A2000-memory.dmp

Download

memory/3788-55-0x0000019B710A0000-0x0000019B71112000-memory.dmp

Download

memory/3788-56-0x0000019B725C0000-0x0000019B725FC000-memory.dmp

Download

memory/3788-57-0x0000019B725A0000-0x0000019B725A8000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads