b882cc1879ad8f24c63fa6e4f47a8fef9a01065ee61ad6220beed9932b04e7ed

Analysis

max time kernel
152s
max time network
177s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
05/08/2026, 02:56

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
DELTARUNE/DELTARUNE.exe
Size 6.8MB
Sample260805-dfd27saj91
SHA256 b882cc1879ad8f24c63fa6e4f47a8fef9a01065ee61ad6220beed9932b04e7ed
MD5 7bf3cccc2e54481ced3a149e1a083684
SHA1 ddd9992ca1ae2e7eb8f63b4b20c63b430dba4026
SHA512 9e29c01120c1f145363c1d0e2cdbd764a50dbe875191b98839ea37a7cafaed160a654d88cfbd84b73c5e3e5cc4bea863373d2a3062205f768191fe6ccec843b9
SSDEEP 196608:nbP4YyBOMDt0q3LM76lz38SmJPcZoOxCeW00q+Ux/agp:HE8S2P5Dhgd
TLSH
T108766B8632A4C1DDD167803CC55696FAE2713C41CF5197CB2AA0BF6E3F37AD409BA621
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

discovery

Malware Config

Signatures

Drops desktop.ini file(s) 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Videos\Captures\desktop.ini	svchost.exe

Network Service Discovery 1 TTPs 1 IoCs

Attempt to gather information on host's network.

discovery

Network Service Discovery

T1046

pid	Process
3932	GameBarPresenceWriter.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	svchost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	svchost.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3797332335-34111092-3597280141-1000\{2FDE26E9-BC93-4AB8-A898-C9E1BA326BEB}	svchost.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
4492	DELTARUNE.exe
4492	DELTARUNE.exe
2332	OpenWith.exe

C:\Users\Admin\AppData\Local\Temp\DELTARUNE\DELTARUNE.exe
"C:\Users\Admin\AppData\Local\Temp\DELTARUNE\DELTARUNE.exe"
1⤵
- Suspicious use of SetWindowsHookEx
PID:4492

C:\Windows\System32\GameBarPresenceWriter.exe
"C:\Windows\System32\GameBarPresenceWriter.exe" -ServerName:Windows.Gaming.GameBar.Internal.PresenceWriterServer
1⤵
- Network Service Discovery
PID:3932

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:2332

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k BcastDVRUserService -s BcastDVRUserService
1⤵
- Drops desktop.ini file(s)
- Checks processor information in registry
- Modifies registry class
PID:2720

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Network Service Discovery

T1046

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

dr.ini

Path C:\Users\Admin\AppData\Local\DELTARUNE\dr.ini
Size 247B
SHA256 43c16a227ccc808714e80690e64a6a7a6bf7d308cc2be9fa377e1e3c7db992a9
MD5 c28d1fcf093516d230871020427fae8d
SHA1 4a57a3d0733293f636ace6796697490c207cb1cb
SHA512 4385d9239fc4324880435493a785929a622fc4a37d7d5af14a3a0faba07ce6e773377373ed92e767f11fb114b807d0cc11e812c422cc5270f72112c3fe5d5a28
TLSH
T1B5D004C40905CC94DDE68C670812B1002A3DF7DF4CC0C4D102E83B2E8A5DC318B0E062
MD5 SHA1 SHA512 TLSH

Submit Download

desktop.ini

Path C:\Users\Admin\Videos\Captures\desktop.ini
Size 190B
SHA256 86d9f822aeb989755fac82929e8db369b3f5f04117ef96fd76e3d5f920a501d2
MD5 b0d27eaec71f1cd73b015f5ceeb15f9d
SHA1 62264f8b5c2f5034a1e4143df6e8c787165fbc2f
SHA512 7b5c9783a0a14b600b156825639d24cbbc000f5066c48ce9fecc195255603fc55129aaaca336d7ce6ad4e941d5492b756562f2c7a1d151fcfc2dabac76f3946c
TLSH
T11EC0121892F93224A1728D12BD7460119AB1F4217C16CA9D1380508F08A1601E631B53
MD5 SHA1 SHA512 TLSH