Analysis
- user interaction
yes - max time kernel
56s - max time network
73s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
01/08/2026, 04:16
General
- Target Mini Motorways/Mini Motorways.exe
- Size 635KB
- Sample260801-evxcrsdr4w
- SHA256 bfaf4bcd703ed4d044245b7510323190afea10c0e9f62008747c1843d5e2f0e0
Malware Config
Signatures
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Checks processor information in registry 2 TTPs 4 IoCs
Processor information is often read in order to detect sandboxing environments.
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of SetWindowsHookEx 2 IoCs
- Suspicious use of WriteProcessMemory 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Mini Motorways\Mini Motorways.exe"C:\Users\Admin\AppData\Local\Temp\Mini Motorways\Mini Motorways.exe"1⤵
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Mini Motorways\UnityCrashHandler32.exe"C:\Users\Admin\AppData\Local\Temp\Mini Motorways\UnityCrashHandler32.exe" --attach 2648 194027522⤵
-
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x00000000000004D8 0x00000000000004F41⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
memory/2648-1-0x0000000003050000-0x0000000003060000-memory.dmp
memory/2648-0-0x0000000003060000-0x0000000003070000-memory.dmp
memory/2648-2-0x000000000F250000-0x000000000F260000-memory.dmp
memory/2648-3-0x000000000FAD0000-0x000000000FAF0000-memory.dmp
memory/2648-4-0x00000000109B0000-0x00000000109C0000-memory.dmp
memory/2648-5-0x00000000154B0000-0x00000000154C0000-memory.dmp
memory/2648-6-0x0000000016DA0000-0x0000000016DB0000-memory.dmp
memory/2648-7-0x0000000016FF0000-0x0000000017000000-memory.dmp
memory/2648-8-0x0000000017010000-0x0000000017020000-memory.dmp
memory/2648-9-0x0000000017020000-0x0000000017030000-memory.dmp
memory/2648-14-0x0000000017030000-0x0000000017040000-memory.dmp
memory/2648-13-0x0000000003050000-0x0000000003060000-memory.dmp
memory/2648-12-0x0000000003060000-0x0000000003070000-memory.dmp
memory/2648-15-0x0000000017410000-0x0000000017420000-memory.dmp
memory/2648-17-0x0000000017420000-0x0000000017430000-memory.dmp
memory/2648-16-0x000000000F250000-0x000000000F260000-memory.dmp
memory/2648-19-0x0000000017430000-0x0000000017440000-memory.dmp
memory/2648-18-0x000000000FAD0000-0x000000000FAF0000-memory.dmp
memory/2648-33-0x00000000109B0000-0x00000000109C0000-memory.dmp
memory/2648-37-0x00000000154B0000-0x00000000154C0000-memory.dmp
memory/2648-38-0x0000000016DA0000-0x0000000016DB0000-memory.dmp
memory/2648-39-0x0000000016FF0000-0x0000000017000000-memory.dmp
memory/2648-44-0x000000006BA10000-0x000000006BA20000-memory.dmp
memory/2648-46-0x000000006BA10000-0x000000006BA20000-memory.dmp
memory/2648-45-0x000000006BA10000-0x000000006BA20000-memory.dmp
memory/2648-47-0x0000000017010000-0x0000000017020000-memory.dmp
memory/2648-49-0x000000006EFA0000-0x000000006EFB0000-memory.dmp
memory/2648-48-0x000000006EFA0000-0x000000006EFB0000-memory.dmp
memory/2648-50-0x0000000017020000-0x0000000017030000-memory.dmp
memory/2648-55-0x0000000017030000-0x0000000017040000-memory.dmp
memory/2648-56-0x0000000017410000-0x0000000017420000-memory.dmp
memory/2648-57-0x0000000017420000-0x0000000017430000-memory.dmp
memory/2648-58-0x0000000017430000-0x0000000017440000-memory.dmp