3384d5642617767c4233f737b04ed92e67030b0ea6f41a3a54f425f03fbf48a9

Analysis

max time kernel
10s
max time network
15s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
04/08/2026, 17:31

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Prison Architect 2 Setup.exe
Size 6.8MB
Sample260804-v37rgawdmb
SHA256 3384d5642617767c4233f737b04ed92e67030b0ea6f41a3a54f425f03fbf48a9
MD5 b219de253af70210ff0aff439d709c1f
SHA1 df34b39c5e713e7c59bbbf31563738e9ba060d16
SHA512 9bb1c7c5b8902111ec5c0d78c0d780133d7b5be1b8f7943288678d7c288b754da6882a82b0309038c5443840c62be32ab70209072bc98a92573133579b0743d9
SSDEEP 98304:+QZ+u+0V/bOGO99C+XAdplaJP40rvUgHhj2ctJJr6JaoLYNXrNzz61sfZiznh1g5:+8dvCJXAdplah9UgBRteL4bizhQAYnZZ
TLSH
T1CB663346C0EA4796D01F4EFC4B059CCB48381B1F26A2BC4DAC759F9B59EF722E4E6520
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Loads dropped DLL 3 IoCs

pid	Process
4120	Prison Architect 2 Setup.exe
4120	Prison Architect 2 Setup.exe
4120	Prison Architect 2 Setup.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Prison Architect 2 Setup.exe

Modifies registry class 4 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{3ADD1653-EB32-4cb0-BBD7-DFA0ABB5ACCA}\Instance\	Prison Architect 2 Setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1CF1260C-4DD0-4ebb-811F-33C572699FDE}\Instance\	Prison Architect 2 Setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A0953C92-50DC-43bf-BE83-3742FED03C9C}\Instance\	Prison Architect 2 Setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	Prison Architect 2 Setup.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
4120	Prison Architect 2 Setup.exe
4120	Prison Architect 2 Setup.exe
4120	Prison Architect 2 Setup.exe
4120	Prison Architect 2 Setup.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4120	Prison Architect 2 Setup.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
4120	Prison Architect 2 Setup.exe

C:\Users\Admin\AppData\Local\Temp\Prison Architect 2 Setup.exe
"C:\Users\Admin\AppData\Local\Temp\Prison Architect 2 Setup.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:4120

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

guig.dll

Path C:\Users\Admin\AppData\Local\Temp\genteeAB\guig.dll
Size 20KB
SHA256 005c251c21d6a5ba1c3281e7b9f3b4f684d007e0c3486b34a545bb370d8420aa
MD5 d3f8c0334c19198a109e44d074dac5fd
SHA1 167716989a62b25e9fcf8e20d78e390a52e12077
SHA512 9c890e0af5b20ce9db4284e726ec0b05b2a9f18b909fb8e595edf3348a8f0d07d5238d85446a09e72e4faa2e2875beb52742d312e5163f48df4072b982801b51
SSDEEP 192:mxonubPh9zJCEvCZj6beDKnYFRJvS/QwC3:tubPh9N6N6k3z
TLSH
T16892F6B672D244F7D28B02F50E932F9E7B7999515B7438720E234BCE54A6541F83AA03
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

genteert.dll

Path C:\Users\Admin\AppData\Local\Temp\genteert.dll
Size 60KB
SHA256 54c0da1735bb1cb02b60c321de938488345f8d1d26bf389c8cb2acad5d01b831
MD5 6ce814fd1ad7ae07a9e462c26b3a0f69
SHA1 15f440c2a8498a4efe2d9ba0c6268fab4fb8e0a7
SHA512 e5cff6bcb063635e5193209b94a9b2f5465f1c82394f23f50bd30bf0a2b117b209f5fca5aa10a7912a94ad88711dcd490aa528a7202f09490acd96cd640a3556
SSDEEP 768:BVPbKk9022j0efXs6X8zqk3pT3oMapzxc7Ep+DnSIiacDwGpr1a:BVTK+022j0V6mqMozpzxcXOpwEr1
TLSH
T16A536D03678600F5D6526A7A342F7277FB34DFE742E6C6836F69DC902D221A1A52A1C3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4120-18-0x0000000003430000-0x0000000003431000-memory.dmp

Download

memory/4120-17-0x00000000033E0000-0x00000000033E1000-memory.dmp

Download

memory/4120-19-0x00000000033D0000-0x00000000033D1000-memory.dmp

Download

memory/4120-24-0x00000000033F0000-0x00000000033F1000-memory.dmp

Download