1a4d5fc5f07cb48446bfb05cb4924ef9217f1695f39dc1bb0dfb156354a53add

Analysis

max time kernel
149s
max time network
161s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
05/08/2026, 03:18

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
osu!.exe
Size 4.3MB
Sample260805-dtmlhaxclg
SHA256 1a4d5fc5f07cb48446bfb05cb4924ef9217f1695f39dc1bb0dfb156354a53add
MD5 88394100b61ddd13136085498ea180b2
SHA1 ad7ed6dd66adb634e6f951332cf829d125fcd9f4
SHA512 c251b7a3cb6610d9e993704a16db61e32b2991d8fa7af4d8ee8802b03c5b48222223d7f721060064c47704e52c5c91f3c5bb882ac15a4984b9f99354fda532df
SSDEEP 98304:4K9BadB+8IGHvBQg4UwnsOF6y2xRxpDOh0:/9I+FAUnl9Ki0
TLSH
T16B267B08AAA44F3EC66F4BB3A0651A1963F5CD5833C7FBCF5540B7B425B2362590326B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

defense_evasion discovery spyware trojan

Malware Config

Signatures

Drops desktop.ini file(s) 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Videos\Captures\desktop.ini	svchost.exe

Network Service Discovery 1 TTPs 1 IoCs

Attempt to gather information on host's network.

discovery

Network Service Discovery

T1046

pid	Process
5644	GameBarPresenceWriter.exe

Loads dropped DLL 4 IoCs

pid	Process
3008	osu!.exe
3008	osu!.exe
3008	osu!.exe
3008	osu!.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	osu!.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	osu!.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	svchost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	svchost.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3797332335-34111092-3597280141-1000\{F9A2DBE3-9728-4B4B-90DF-E3E09C48F898}	svchost.exe

Modifies system certificate store 2 TTPs 5 IoCs

defense_evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\2B8F1B57330DBBA2D07A6C51F70EE90DDAB9AD8E	osu!.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\2B8F1B57330DBBA2D07A6C51F70EE90DDAB9AD8E\Blob = 0f000000010000003000000066b764a96581128168cf208e374dda479d54e311f32457f4aee0dbd2a6c8d171d531289e1cd22bfdbbd4cfd979625483090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b0601050507030853000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0620000000100000020000000e793c9b02fd8aa13e21c31228accb08119643b749c898964b1746d46c3d4cbd21400000001000000140000005379bf5aaa2b4acf5480e1d89bc09df2b20366cb1d0000000100000010000000885010358d29a38f059b028559c95f900b00000001000000100000005300650063007400690067006f0000000300000001000000140000002b8f1b57330dbba2d07a6c51f70ee90ddab9ad8e2000000001000000e2050000308205de308203c6a003020102021001fd6d30fca3ca51a81bbc640e35032d300d06092a864886f70d01010c0500308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374205253412043657274696669636174696f6e20417574686f72697479301e170d3130303230313030303030305a170d3338303131383233353935395a308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374205253412043657274696669636174696f6e20417574686f7269747930820222300d06092a864886f70d01010105000382020f003082020a028202010080126517360ec3db08b3d0ac570d76edcd27d34cad508361e2aa204d092d6409dcce899fcc3da9ecf6cfc1dcf1d3b1d67b3728112b47da39c6bc3a19b45fa6bd7d9da36342b676f2a93b2b91f8e26fd0ec162090093ee2e874c918b491d46264db7fa306f188186a90223cbcfe13f087147bf6e41f8ed4e451c61167460851cb8614543fbc33fe7e6c9cff169d18bd518e35a6a766c87267db2166b1d49b7803c0503ae8ccf0dcbc9e4cfeaf0596351f575ab7ffcef93db72cb6f654ddc8e7123a4dae4c8ab75c9ab4b7203dca7f2234ae7e3b68660144e7014e46539b3360f794be5337907343f332c353efdbaafe744e69c76b8c6093dec4c70cdfe132aecc933b517895678bee3d56fe0cd0690f1b0ff325266b336df76e47fa7343e57e0ea566b1297c3284635589c40dc19354301913acd37d37a7eb5d3a6c355cdb41d712daa9490bdfd8808a0993628eb566cf2588cd84b8b13fa4390fd9029eeb124c957cf36b05a95e1683ccb867e2e8139dcc5b82d34cb3ed5bffdee573ac233b2d00bf3555740949d849581a7f9236e651920ef3267d1c4d17bcc9ec4326d0bf415f40a94444f499e757879e501f5754a83efd74632fb1506509e658422e431a4cb4f0254759fa041e93d426464a5081b2debe78b7fc6715e1c957841e0f63d6e962bad65f552eea5cc62808042539b80e2ba9f24c971c073f0d52f5edef2f820f0203010001a3423040301d0603551d0e041604145379bf5aaa2b4acf5480e1d89bc09df2b20366cb300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff300d06092a864886f70d01010c050003820201005cd47c0dcff7017d4199650c73c5529fcbf8cf99067f1bda43159f9e0255579614f1523c27879428ed1f3a0137a276fc5350c0849bc66b4eba8c214fa28e556291f36915d8bc88e3c4aa0bfdefa8e94b552a06206d55782919ee5f305c4b241155ff249a6e5e2a2bee0b4d9f7ff70138941495430709fb60a9ee1cab128ca09a5ea7986a596d8b3f08fbc8d145af18156490120f73282ec5e2244efc58ecf0f445fe22b3eb2f8ed2d9456105c1976fa876728f8b8c36afbf0d05ce718de6a66f1f6ca67162c5d8d083720cf16711890c9c134c7234dfbcd571dfaa71dde1b96c8c3c125d65dabd5712b6436bffe5de4d661151cf99aeec17b6e871918cde49fedd3571a21527941ccf61e326bb6fa36725215de6dd1d0b2e681b3b82afec836785d4985174b1b9998089ff7f78195c794a602e9240ae4c372a2cc9c762c80e5df7365bcae0252501b4dd1a079c77003fd0dcd5ec3dd4fabb3fcc85d66f7fa92ddfb902f7f5979ab535dac367b0874aa9289e238eff5c276be1b04ff307ee002ed45987cb524195eaf447d7ee6441557c8d590295dd629dc2b9ee5a287484a59bb790c70c07dff589367432d628c1b0b00be09c4cc31cd6fce369b54746812fa282abd3634470c48dff2d33baad8f7bb57088ae3e19cf4028d8fcc890bb5d9922f552e658c51f883143ee881dd7c68e3c436a1da718de7d3d16f162f9ca90a8fd	osu!.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\2B8F1B57330DBBA2D07A6C51F70EE90DDAB9AD8E\Blob = 190000000100000010000000ea6089055218053dd01e37e1d806eedf0300000001000000140000002b8f1b57330dbba2d07a6c51f70ee90ddab9ad8e0b00000001000000100000005300650063007400690067006f0000001d0000000100000010000000885010358d29a38f059b028559c95f901400000001000000140000005379bf5aaa2b4acf5480e1d89bc09df2b20366cb620000000100000020000000e793c9b02fd8aa13e21c31228accb08119643b749c898964b1746d46c3d4cbd253000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b060105050703080f000000010000003000000066b764a96581128168cf208e374dda479d54e311f32457f4aee0dbd2a6c8d171d531289e1cd22bfdbbd4cfd9796254832000000001000000e2050000308205de308203c6a003020102021001fd6d30fca3ca51a81bbc640e35032d300d06092a864886f70d01010c0500308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374205253412043657274696669636174696f6e20417574686f72697479301e170d3130303230313030303030305a170d3338303131383233353935395a308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374205253412043657274696669636174696f6e20417574686f7269747930820222300d06092a864886f70d01010105000382020f003082020a028202010080126517360ec3db08b3d0ac570d76edcd27d34cad508361e2aa204d092d6409dcce899fcc3da9ecf6cfc1dcf1d3b1d67b3728112b47da39c6bc3a19b45fa6bd7d9da36342b676f2a93b2b91f8e26fd0ec162090093ee2e874c918b491d46264db7fa306f188186a90223cbcfe13f087147bf6e41f8ed4e451c61167460851cb8614543fbc33fe7e6c9cff169d18bd518e35a6a766c87267db2166b1d49b7803c0503ae8ccf0dcbc9e4cfeaf0596351f575ab7ffcef93db72cb6f654ddc8e7123a4dae4c8ab75c9ab4b7203dca7f2234ae7e3b68660144e7014e46539b3360f794be5337907343f332c353efdbaafe744e69c76b8c6093dec4c70cdfe132aecc933b517895678bee3d56fe0cd0690f1b0ff325266b336df76e47fa7343e57e0ea566b1297c3284635589c40dc19354301913acd37d37a7eb5d3a6c355cdb41d712daa9490bdfd8808a0993628eb566cf2588cd84b8b13fa4390fd9029eeb124c957cf36b05a95e1683ccb867e2e8139dcc5b82d34cb3ed5bffdee573ac233b2d00bf3555740949d849581a7f9236e651920ef3267d1c4d17bcc9ec4326d0bf415f40a94444f499e757879e501f5754a83efd74632fb1506509e658422e431a4cb4f0254759fa041e93d426464a5081b2debe78b7fc6715e1c957841e0f63d6e962bad65f552eea5cc62808042539b80e2ba9f24c971c073f0d52f5edef2f820f0203010001a3423040301d0603551d0e041604145379bf5aaa2b4acf5480e1d89bc09df2b20366cb300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff300d06092a864886f70d01010c050003820201005cd47c0dcff7017d4199650c73c5529fcbf8cf99067f1bda43159f9e0255579614f1523c27879428ed1f3a0137a276fc5350c0849bc66b4eba8c214fa28e556291f36915d8bc88e3c4aa0bfdefa8e94b552a06206d55782919ee5f305c4b241155ff249a6e5e2a2bee0b4d9f7ff70138941495430709fb60a9ee1cab128ca09a5ea7986a596d8b3f08fbc8d145af18156490120f73282ec5e2244efc58ecf0f445fe22b3eb2f8ed2d9456105c1976fa876728f8b8c36afbf0d05ce718de6a66f1f6ca67162c5d8d083720cf16711890c9c134c7234dfbcd571dfaa71dde1b96c8c3c125d65dabd5712b6436bffe5de4d661151cf99aeec17b6e871918cde49fedd3571a21527941ccf61e326bb6fa36725215de6dd1d0b2e681b3b82afec836785d4985174b1b9998089ff7f78195c794a602e9240ae4c372a2cc9c762c80e5df7365bcae0252501b4dd1a079c77003fd0dcd5ec3dd4fabb3fcc85d66f7fa92ddfb902f7f5979ab535dac367b0874aa9289e238eff5c276be1b04ff307ee002ed45987cb524195eaf447d7ee6441557c8d590295dd629dc2b9ee5a287484a59bb790c70c07dff589367432d628c1b0b00be09c4cc31cd6fce369b54746812fa282abd3634470c48dff2d33baad8f7bb57088ae3e19cf4028d8fcc890bb5d9922f552e658c51f883143ee881dd7c68e3c436a1da718de7d3d16f162f9ca90a8fd	osu!.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\2B8F1B57330DBBA2D07A6C51F70EE90DDAB9AD8E\Blob = 6b0000000100000020000000e793c9b02fd8aa13e21c31228accb08119643b749c898964b1746d46c3d4cbd20f000000010000003000000066b764a96581128168cf208e374dda479d54e311f32457f4aee0dbd2a6c8d171d531289e1cd22bfdbbd4cfd979625483090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b0601050507030853000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0620000000100000020000000e793c9b02fd8aa13e21c31228accb08119643b749c898964b1746d46c3d4cbd21400000001000000140000005379bf5aaa2b4acf5480e1d89bc09df2b20366cb1d0000000100000010000000885010358d29a38f059b028559c95f900b00000001000000100000005300650063007400690067006f0000000300000001000000140000002b8f1b57330dbba2d07a6c51f70ee90ddab9ad8e190000000100000010000000ea6089055218053dd01e37e1d806eedf2000000001000000e2050000308205de308203c6a003020102021001fd6d30fca3ca51a81bbc640e35032d300d06092a864886f70d01010c0500308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374205253412043657274696669636174696f6e20417574686f72697479301e170d3130303230313030303030305a170d3338303131383233353935395a308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374205253412043657274696669636174696f6e20417574686f7269747930820222300d06092a864886f70d01010105000382020f003082020a028202010080126517360ec3db08b3d0ac570d76edcd27d34cad508361e2aa204d092d6409dcce899fcc3da9ecf6cfc1dcf1d3b1d67b3728112b47da39c6bc3a19b45fa6bd7d9da36342b676f2a93b2b91f8e26fd0ec162090093ee2e874c918b491d46264db7fa306f188186a90223cbcfe13f087147bf6e41f8ed4e451c61167460851cb8614543fbc33fe7e6c9cff169d18bd518e35a6a766c87267db2166b1d49b7803c0503ae8ccf0dcbc9e4cfeaf0596351f575ab7ffcef93db72cb6f654ddc8e7123a4dae4c8ab75c9ab4b7203dca7f2234ae7e3b68660144e7014e46539b3360f794be5337907343f332c353efdbaafe744e69c76b8c6093dec4c70cdfe132aecc933b517895678bee3d56fe0cd0690f1b0ff325266b336df76e47fa7343e57e0ea566b1297c3284635589c40dc19354301913acd37d37a7eb5d3a6c355cdb41d712daa9490bdfd8808a0993628eb566cf2588cd84b8b13fa4390fd9029eeb124c957cf36b05a95e1683ccb867e2e8139dcc5b82d34cb3ed5bffdee573ac233b2d00bf3555740949d849581a7f9236e651920ef3267d1c4d17bcc9ec4326d0bf415f40a94444f499e757879e501f5754a83efd74632fb1506509e658422e431a4cb4f0254759fa041e93d426464a5081b2debe78b7fc6715e1c957841e0f63d6e962bad65f552eea5cc62808042539b80e2ba9f24c971c073f0d52f5edef2f820f0203010001a3423040301d0603551d0e041604145379bf5aaa2b4acf5480e1d89bc09df2b20366cb300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff300d06092a864886f70d01010c050003820201005cd47c0dcff7017d4199650c73c5529fcbf8cf99067f1bda43159f9e0255579614f1523c27879428ed1f3a0137a276fc5350c0849bc66b4eba8c214fa28e556291f36915d8bc88e3c4aa0bfdefa8e94b552a06206d55782919ee5f305c4b241155ff249a6e5e2a2bee0b4d9f7ff70138941495430709fb60a9ee1cab128ca09a5ea7986a596d8b3f08fbc8d145af18156490120f73282ec5e2244efc58ecf0f445fe22b3eb2f8ed2d9456105c1976fa876728f8b8c36afbf0d05ce718de6a66f1f6ca67162c5d8d083720cf16711890c9c134c7234dfbcd571dfaa71dde1b96c8c3c125d65dabd5712b6436bffe5de4d661151cf99aeec17b6e871918cde49fedd3571a21527941ccf61e326bb6fa36725215de6dd1d0b2e681b3b82afec836785d4985174b1b9998089ff7f78195c794a602e9240ae4c372a2cc9c762c80e5df7365bcae0252501b4dd1a079c77003fd0dcd5ec3dd4fabb3fcc85d66f7fa92ddfb902f7f5979ab535dac367b0874aa9289e238eff5c276be1b04ff307ee002ed45987cb524195eaf447d7ee6441557c8d590295dd629dc2b9ee5a287484a59bb790c70c07dff589367432d628c1b0b00be09c4cc31cd6fce369b54746812fa282abd3634470c48dff2d33baad8f7bb57088ae3e19cf4028d8fcc890bb5d9922f552e658c51f883143ee881dd7c68e3c436a1da718de7d3d16f162f9ca90a8fd	osu!.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\2B8F1B57330DBBA2D07A6C51F70EE90DDAB9AD8E\Blob = 5c000000010000000400000000100000190000000100000010000000ea6089055218053dd01e37e1d806eedf0300000001000000140000002b8f1b57330dbba2d07a6c51f70ee90ddab9ad8e0b00000001000000100000005300650063007400690067006f0000001d0000000100000010000000885010358d29a38f059b028559c95f901400000001000000140000005379bf5aaa2b4acf5480e1d89bc09df2b20366cb620000000100000020000000e793c9b02fd8aa13e21c31228accb08119643b749c898964b1746d46c3d4cbd253000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b060105050703080f000000010000003000000066b764a96581128168cf208e374dda479d54e311f32457f4aee0dbd2a6c8d171d531289e1cd22bfdbbd4cfd9796254836b0000000100000020000000e793c9b02fd8aa13e21c31228accb08119643b749c898964b1746d46c3d4cbd22000000001000000e2050000308205de308203c6a003020102021001fd6d30fca3ca51a81bbc640e35032d300d06092a864886f70d01010c0500308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374205253412043657274696669636174696f6e20417574686f72697479301e170d3130303230313030303030305a170d3338303131383233353935395a308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374205253412043657274696669636174696f6e20417574686f7269747930820222300d06092a864886f70d01010105000382020f003082020a028202010080126517360ec3db08b3d0ac570d76edcd27d34cad508361e2aa204d092d6409dcce899fcc3da9ecf6cfc1dcf1d3b1d67b3728112b47da39c6bc3a19b45fa6bd7d9da36342b676f2a93b2b91f8e26fd0ec162090093ee2e874c918b491d46264db7fa306f188186a90223cbcfe13f087147bf6e41f8ed4e451c61167460851cb8614543fbc33fe7e6c9cff169d18bd518e35a6a766c87267db2166b1d49b7803c0503ae8ccf0dcbc9e4cfeaf0596351f575ab7ffcef93db72cb6f654ddc8e7123a4dae4c8ab75c9ab4b7203dca7f2234ae7e3b68660144e7014e46539b3360f794be5337907343f332c353efdbaafe744e69c76b8c6093dec4c70cdfe132aecc933b517895678bee3d56fe0cd0690f1b0ff325266b336df76e47fa7343e57e0ea566b1297c3284635589c40dc19354301913acd37d37a7eb5d3a6c355cdb41d712daa9490bdfd8808a0993628eb566cf2588cd84b8b13fa4390fd9029eeb124c957cf36b05a95e1683ccb867e2e8139dcc5b82d34cb3ed5bffdee573ac233b2d00bf3555740949d849581a7f9236e651920ef3267d1c4d17bcc9ec4326d0bf415f40a94444f499e757879e501f5754a83efd74632fb1506509e658422e431a4cb4f0254759fa041e93d426464a5081b2debe78b7fc6715e1c957841e0f63d6e962bad65f552eea5cc62808042539b80e2ba9f24c971c073f0d52f5edef2f820f0203010001a3423040301d0603551d0e041604145379bf5aaa2b4acf5480e1d89bc09df2b20366cb300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff300d06092a864886f70d01010c050003820201005cd47c0dcff7017d4199650c73c5529fcbf8cf99067f1bda43159f9e0255579614f1523c27879428ed1f3a0137a276fc5350c0849bc66b4eba8c214fa28e556291f36915d8bc88e3c4aa0bfdefa8e94b552a06206d55782919ee5f305c4b241155ff249a6e5e2a2bee0b4d9f7ff70138941495430709fb60a9ee1cab128ca09a5ea7986a596d8b3f08fbc8d145af18156490120f73282ec5e2244efc58ecf0f445fe22b3eb2f8ed2d9456105c1976fa876728f8b8c36afbf0d05ce718de6a66f1f6ca67162c5d8d083720cf16711890c9c134c7234dfbcd571dfaa71dde1b96c8c3c125d65dabd5712b6436bffe5de4d661151cf99aeec17b6e871918cde49fedd3571a21527941ccf61e326bb6fa36725215de6dd1d0b2e681b3b82afec836785d4985174b1b9998089ff7f78195c794a602e9240ae4c372a2cc9c762c80e5df7365bcae0252501b4dd1a079c77003fd0dcd5ec3dd4fabb3fcc85d66f7fa92ddfb902f7f5979ab535dac367b0874aa9289e238eff5c276be1b04ff307ee002ed45987cb524195eaf447d7ee6441557c8d590295dd629dc2b9ee5a287484a59bb790c70c07dff589367432d628c1b0b00be09c4cc31cd6fce369b54746812fa282abd3634470c48dff2d33baad8f7bb57088ae3e19cf4028d8fcc890bb5d9922f552e658c51f883143ee881dd7c68e3c436a1da718de7d3d16f162f9ca90a8fd	osu!.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	3008	osu!.exe
Token: SeDebugPrivilege	5992	osu!.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4756	OpenWith.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 3008 wrote to memory of 5992	3008	osu!.exe	92

C:\Users\Admin\AppData\Local\Temp\osu!.exe
"C:\Users\Admin\AppData\Local\Temp\osu!.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Modifies system certificate store
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3008
- C:\Users\Admin\AppData\Local\Temp\osu!.exe
  "C:\Users\Admin\AppData\Local\Temp\osu!.exe" -repair
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  PID:5992

C:\Windows\System32\GameBarPresenceWriter.exe
"C:\Windows\System32\GameBarPresenceWriter.exe" -ServerName:Windows.Gaming.GameBar.Internal.PresenceWriterServer
1⤵
- Network Service Discovery
PID:5644

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:4756

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k BcastDVRUserService -s BcastDVRUserService
1⤵
- Drops desktop.ini file(s)
- Checks processor information in registry
- Modifies registry class
PID:5032

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Discovery

Network Service Discovery

T1046

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

18E6B4A57A6BC7EC9B861CDF2D6D0D02_C3B142D2C5374581DC2FDFFDEDBDEDDB

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\18E6B4A57A6BC7EC9B861CDF2D6D0D02_C3B142D2C5374581DC2FDFFDEDBDEDDB
Size 765B
SHA256 e34859bb5d9e1be9d43295be5b519a98b8082a88e513d013d745187c9b6c049d
MD5 cad995243ee381647c664c3e4dda482f
SHA1 8a052a9942591515e48dea1b823c04d090eba07b
SHA512 4332e5ea09e3e615cf70cd11d1105db43a0efc209797b25f4729d23acaafd4688814b99547cb9b9e76cd2cb914eaad7a8900511b85f2ff1ce2b5e538e9d05859
TLSH
T1440125224F4189423F1699C4D665D4792605B2A53C9606F33027938852E7FCD5782DC8
MD5 SHA1 SHA512 TLSH

Submit Download

AEACCDA8653DD8D7B2EA32F21D15D44F_C99E84AF904BD8598CB3FED576528926

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\AEACCDA8653DD8D7B2EA32F21D15D44F_C99E84AF904BD8598CB3FED576528926
Size 637B
SHA256 c13a9bb8560107d5920ee6632c6c50a6838dedf50ecff985c51088409cc5319e
MD5 1650dfc43be6795dd33174e30bb799a3
SHA1 e571419cde5edcfcf51afdffa825d726c91e0abd
SHA512 b7d1968dcb09bc5e95bd749281c75b8c79fa1761b3c137a58e2e5b7ff4cce64407760488c9453d6ec350606db5a1c26a6dd5bff5240627c5a6b3418de1cadc8d
TLSH
T1E9F008567871EC22C65170DD0555F19652D13D1D35C03F4B7BB5379845C8B561154F08
MD5 SHA1 SHA512 TLSH

Submit Download

B2FAF7692FD9FFBD64EDE317E42334BA_93702E680A5530C052C8D2BA33A2225F

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B2FAF7692FD9FFBD64EDE317E42334BA_93702E680A5530C052C8D2BA33A2225F
Size 1KB
SHA256 a0d6ce27684a757d37eab3719f249b191a0479b5e63a1ec2be4bd6779ff85ad4
MD5 c0b4f7a55f44500152fdf5d834e9b66e
SHA1 1d8608e3403296cc60a7685e22ad243d004a0138
SHA512 6e040d6531cf12ec13f9f902c161e3807b781ae8ae96e193e5391c22a7c4c597bc7303548ba8b2465f559829dcc3add5869347466926401a6f23a1196096d289
TLSH
T19C31C6D36EA87831ED088DC4585DCFF27CB025AAF45808743498C56AA9A3FE46C4A81D
MD5 SHA1 SHA512 TLSH

Submit Download

18E6B4A57A6BC7EC9B861CDF2D6D0D02_C3B142D2C5374581DC2FDFFDEDBDEDDB

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\18E6B4A57A6BC7EC9B861CDF2D6D0D02_C3B142D2C5374581DC2FDFFDEDBDEDDB
Size 484B
SHA256 ba8ba64cd2599bf097eca4c09f10ef4ed11e7dd0187600b31a0d9cc3fb83b8d0
MD5 53858a25d2e2e384cd57ace174dbe45a
SHA1 b6dcb4b4c383f7389f53962202b2675cb8b758dd
SHA512 488beaf2a88af62198f70434dba576cd9f845bf560ab3143dba14ba410280c7e5127febabadcc293092b7669b424f6bb9f5eb3e59fd26ec471f6d59c057ead3e
TLSH
T1E1F0A32C1DE6013EF1779D75D7D0B1A7C84AF113280048A51AF503041B87F8E2C51069
MD5 SHA1 SHA512 TLSH

Submit Download

AEACCDA8653DD8D7B2EA32F21D15D44F_C99E84AF904BD8598CB3FED576528926

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\AEACCDA8653DD8D7B2EA32F21D15D44F_C99E84AF904BD8598CB3FED576528926
Size 488B
SHA256 b7487490505f16fa377301db1e25786b62c880cb28581cf40d2776c22610f678
MD5 8447d17606e09e073c300b6457dce3eb
SHA1 c622eb8511c8d9f843624e1cd92b037bd4b8dacc
SHA512 2e22904b3c850a62a670792d6ea0253d5e1134ddad9c7c36ebdd0e7648381b142095e0bac2fc6cda53a4bfa287e739aef942063b656a35c46b9358ab99ddf2b0
TLSH
T1C5F0AB28B8FF112DF4775D7AC3EA88629D29F166280523BD2B654B0B9D06F85CD1293C
MD5 SHA1 SHA512 TLSH

Submit Download

B2FAF7692FD9FFBD64EDE317E42334BA_93702E680A5530C052C8D2BA33A2225F

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B2FAF7692FD9FFBD64EDE317E42334BA_93702E680A5530C052C8D2BA33A2225F
Size 482B
SHA256 005febcb2dc835282cb97caf6ac64be420dd353db67596741e15a664a999c6e1
MD5 775dd08cba4bf866f258977bd7f45342
SHA1 50f613de3953fa895a8d550a6baf3020083ae446
SHA512 4317db6b5cf04a4be1214db1dbc13bce8a2a68a925221430bceb2614398caf0f95ecaa0c0810554456a84d34039ed22eefdb0005c67d8d8f34d90ee515f08a27
TLSH
T135F0AB2827BA902DE17BDE79CAD5E3275DBDF311A80001620B5143066F0B6C21E95173
MD5 SHA1 SHA512 TLSH

Submit Download

update.log

Path C:\Users\Admin\AppData\Local\Temp\Logs\update.log
Size 2KB
SHA256 10f0d73313b068a998e2725f425f1bc749cade2528e1fa11d9f14906bc39d203
MD5 e10fe8a6b58888b409eb87b27adb119a
SHA1 9be773a3977b4d3aba55b1a58256598f8b673c80
SHA512 7fa6fa3db609ffa72cffde8a658d24ef47972c9c486582dc22d37fc4d2c77098201e61f3f489255aec754b64b9c69ad1cbc558f05f57a5b5f090e6c961d21019
TLSH
T1D5414AA391F4A09A7EA3425AE198EB1D8C83BC37331CB7D4F67966448306135F926DB4
MD5 SHA1 SHA512 TLSH

Submit Download

update.log

Path C:\Users\Admin\AppData\Local\Temp\Logs\update.log
Size 2KB
SHA256 cb856e75206841f542f122e5f2dfc971328ae75c20d266e68db12e80512ac90b
MD5 726cc2d66e04c14ecf93fc897e497739
SHA1 43d2a54376394b7ca2223a04920bda18a01d6db0
SHA512 ca1dba7847ba1999559e8b76e3b1bbd4091a6f191ec5df60c0d9e2095ab15d49e2690b88ebbe0ab207f0b070362875080456e1359db92a592b2bd371a5fd16e5
TLSH
T162516AA391F5A09A7EA3425AD198EB1D8C83BC37331CB3D4F67567444306135F926DB4
MD5 SHA1 SHA512 TLSH

Submit Download

update.log

Path C:\Users\Admin\AppData\Local\Temp\Logs\update.log
Size 3KB
SHA256 7a4bb8c46dbc8fc1dea116dd6a0ec07ed8e9a73b1131488961fda5bdcc90022e
MD5 a0028563806b21246e1ce29edcf193ff
SHA1 0e2c25b0cad4e66deafc7daa8864a215c76a9991
SHA512 c8030b017e61f978ca1cbe04a20637dfe7f45325fdd22b73cee322d810cc9b31c6bd17b8381c382d4e05e5b6e0953f5bf81b7312ec5b7cffd2ba3e7ccb3b5a7d
TLSH
T1D67166A395F4A09A7EA3425AD098EB2D8C83BC37331CB3D4F67967494305135EA2AD74
MD5 SHA1 SHA512 TLSH

Submit Download

update.log

Path C:\Users\Admin\AppData\Local\Temp\Logs\update.log
Size 4KB
SHA256 133d6881e1474f1a9fb2f7811a121bd7dc7aac7f12c7c63c8555c05bf3711797
MD5 eab7710c35cd944c1570bd4ecc13fc84
SHA1 8793cce3b1d35ca9e17c54658a70c4ff3f46fa1c
SHA512 fc423d67b0cf6e222ffaa7aac6e59da6b27aeb6f6c0b65633edd1c67f0bdfee8e97f058a3aff7916a72ba59c61b4f49e647164062ab2605d3d3bab29e94d56e6
SSDEEP 96:K/ltDhuLgHJ7QmexHJp8RCZHJTcZjKRHJR0o:mnJ7GJpDJTcEJRf
TLSH
T1379167A395F4A0993EA34169D0A8EF1D8C83BC3B332CB3D4F66967494305135EA3AD74
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

update.log

Path C:\Users\Admin\AppData\Local\Temp\Logs\update.log
Size 325B
SHA256 f7dcdb893291eb08557166589e39f9d59f22f361f0052c82c20cdb4d3953c726
MD5 5167ab625cd3ff5f595acd5c258bae00
SHA1 70f84ecf50f17d2409158ffc97be49c828551963
SHA512 4bdf1d6862a8db68f2a346f52497fe2cb2bb9509fc6b97689f315338dfeeaad2460bda9a8262f496784567ab526d24cd05d23c5768a9d400f7e33ff8d2e1282c
TLSH
T120E0BDA381F060857EA34159C0C8FB2ECD92BC33630876D4F669A2840201938AB2AD34
MD5 SHA1 SHA512 TLSH

Submit Download

update.log

Path C:\Users\Admin\AppData\Local\Temp\Logs\update.log
Size 415B
SHA256 2019087add90a49ee7d7755807389fb74c37611c28059631535e345c89d7e319
MD5 35fd36fceea59ee84038a596a227ef4b
SHA1 14d764bf481e7ba19fca38cc9a67eca6d76c1645
SHA512 12ffc0fae8eb0c5c0b136cc1fad31dec358e112e70b0dd0179f001f88701143d5c1f83af88a4f4bc906f8a95f7fd8210004658b92d4ee586a0517ac5096a209a
TLSH
T1A2E0C2A395F0A0897EA34599C4C8FB2ECD52FC73670C76D8F27552841200939BE29D34
MD5 SHA1 SHA512 TLSH

Submit Download

update.log

Path C:\Users\Admin\AppData\Local\Temp\Logs\update.log
Size 740B
SHA256 2c5bb57005f8372e4db0519d2aa30d58e11947c5cab2585b1b02d06e3f373bcc
MD5 6f103efa7e8e16f3d535cf02a988e88d
SHA1 d7bb996113c0cef18f4b72111ec9dfc34dfc9294
SHA512 fe44954ed87da95a018c145e244084abb747b1ec7d47554c6e81f05d65afaad390bd31340a3eb0f0c9f3d452f909abd832722bd995038871e518fab44955a4e7
TLSH
T1880116A381F060897EA3419AC688FF2E8D53FC7B670C76D4F27552888200538BE26D34
MD5 SHA1 SHA512 TLSH

Submit Download

update.log

Path C:\Users\Admin\AppData\Local\Temp\Logs\update.log
Size 1KB
SHA256 70d1469c4ad76c0b7ebee6f7e702e38897f6df910c30b9dbf89e94f771b16754
MD5 132b7fb2f30d354cfdccad4e25091598
SHA1 c31207cede071fa1b39bd9fe1389525cbf4ac36f
SHA512 8ad88ecb789e36f62f6a567513eb40a741962e3b540cc5ab25d9198080283f70e00546e52131ae3035011576e8727689871b48b7580af47e08bd634a788247b0
TLSH
T15F2134A391F4609D7EA3418AC298FB2D8C92BC3A370C77C4F67962488201138FA29D34
MD5 SHA1 SHA512 TLSH

Submit Download

update.log

Path C:\Users\Admin\AppData\Local\Temp\Logs\update.log
Size 1KB
SHA256 32381046b366d7c6b01f146a2e2ef88a461e5c7b4f68a47b8867c72c63fcf5c9
MD5 d734e2e89138d457b954cee69decb8bf
SHA1 ea7e9341dba8dc5bb2df9f5aed110fe20f6cc5b0
SHA512 58294d118de6ee89c21d15b2ba78e57ef20bb09836ad6f33aa15532f658f474e03830c2a06573f8d5a4df4016b1dd8648462a214d1d77a01008a733e4c2c0c59
TLSH
T10F3125A391F4A09D7EA3415AD298FB2D8D83BC3B331CB7D4F67962488305139A926D74
MD5 SHA1 SHA512 TLSH

Submit Download

OpenTK.dll

Path C:\Users\Admin\AppData\Local\Temp\OpenTK.dll
Size 4.2MB
SHA256 b415f3e061d9758316074dcbf31d6dba48cb0b89405254db94ead0e43ed88511
MD5 b4d949571134fc3ec6c28f1af7a75e49
SHA1 07eb5685ff4f19ff8ed466c68c2426e2ead69241
SHA512 7abb1128d4f9312ec714f7d3f4e1d1ce12a6f93235d6382cf25c39dae0d7d88b5ad5141f512659c33cf57a762e14711b6b690b33da7d16c7d7be35c8b292131b
SSDEEP 24576:gGg1QKR0dSMIK0v6FMF2Y9JhGtZuD1/TMvXgZ2j41WEfyj+jNhlxZ:UQ1d0K0jT4L4htPlb
TLSH
T18B160759EAD6087BCA972E7E906304433136966B5B57EB3BA047D37C3CC6F642C1A1C2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libEGL.dll

Path C:\Users\Admin\AppData\Local\Temp\libEGL.dll
Size 146KB
SHA256 041a631d114e45a11c43efe3b7712a10ce8052cf4b313c7f4577a5b9adb78072
MD5 9f7f22cef980ec272a9b73bf317500e4
SHA1 ae11d7cdfa84a242e31efd6f03b0ef764d5f900c
SHA512 19e432313c1e28fc076fb9e9c3884c3c97cc2d05b6d1aecf429180a6f5cc407734fe758bcc63936d5fe7ef8ac01abdf5ec4b17bb08b26c5cc87c560f4b89c5bc
SSDEEP 3072:AQpSfKDSjkC6G3a3xX4k6es65psG6gX6gr:AQpSfKWkCDeizA
TLSH
T1C4E35A0175E84030E4FB427A8565AA120BBE7D66DF268EDE3BDC4D4D06785C1BB39B23
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libGLESv2.dll

Path C:\Users\Admin\AppData\Local\Temp\libGLESv2.dll
Size 3.2MB
SHA256 cbfc536b80405da7b5c37c97fceaf2310daf58d78c806140367b8f513352342f
MD5 a4dfddff62d1e917ebb0688cf8d96be7
SHA1 9376bfa069a72da76733cc72cf90386920815142
SHA512 97de24a94f7aaaf3035853c0eb93f44c5c2cdfad99b563fef225d9f2b6f4fa3fe8f89850895d286322191cf8b372aa87da6620796cd32fe368f75b6722b556c3
SSDEEP 49152:lnXliT77777777E377777SaTm7NCO7777ovwwz7777777y0pIyRTNEClTRyAlllD:Eg9TOW05n16Entwr
TLSH
T1EAF55C11BC408275FFDA01FBDAFC3E645A5C8664032E61D7D69C0C996BA07E32B71A87
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

osu!.Admin.cfg

Path C:\Users\Admin\AppData\Local\Temp\osu!.Admin.cfg
Size 4KB
SHA256 7c3b50e6cb86863d8d21c8cd1d34f6d1906d5f6856d19ff35b7d03307fab5806
MD5 1c5e498f22048a5fb820aa97e8a41fbb
SHA1 799509ab95a85bad35ab720578ad1647904a75e5
SHA512 864014dcbe2d8ce28a0aff4437d0e5db374c9e8fdac9c8aa68938b07a29333e893bbaafa0ea958439a2a6f695c30607ef99668b0f9b71f79e5ff613baa8b44e7
SSDEEP 96:MGcFmx4K76XbA6gXOo7wpwYWErnY2b8IxfG08hOKcYbkSoX4hW2Ta1Au3EJLROOq:MG6+N0wZqY2oWfGQbtXkw09JlK
TLSH
T13FA194F86313395F4D1E77E3B840B2042EF164955901607BB7AAC4CC2B66D88D7A792B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

osu!.cfg.639215004340740740

Path C:\Users\Admin\AppData\Local\Temp\osu!.cfg.639215004340740740
Size 49B
SHA256 f11b2f84271b332b901d6394fd406553d1687af9e265b9a2757138f8ee31938e
MD5 fd8945f7c9d67594283e2cb2b48829d2
SHA1 d000454a6f0b279f89cc94138f1381d06a5abd18
SHA512 64c70d231fd425fa5a34445b54ff6ceea9ce255ef2d7a12cd4e44f191b555f2512b4d2e5e1be23a9f4656eb85f4e0c902b6b65628956b689c5f84d89cd4e9e23
MD5 SHA1 SHA512

Submit Download

desktop.ini

Path C:\Users\Admin\Videos\Captures\desktop.ini
Size 190B
SHA256 86d9f822aeb989755fac82929e8db369b3f5f04117ef96fd76e3d5f920a501d2
MD5 b0d27eaec71f1cd73b015f5ceeb15f9d
SHA1 62264f8b5c2f5034a1e4143df6e8c787165fbc2f
SHA512 7b5c9783a0a14b600b156825639d24cbbc000f5066c48ce9fecc195255603fc55129aaaca336d7ce6ad4e941d5492b756562f2c7a1d151fcfc2dabac76f3946c
TLSH
T11EC0121892F93224A1728D12BD7460119AB1F4217C16CA9D1380508F08A1601E631B53
MD5 SHA1 SHA512 TLSH

Submit Download

memory/3008-25-0x0000000008E80000-0x0000000008E8A000-memory.dmp

Download

memory/3008-50-0x00000000744A0000-0x0000000074C5C000-memory.dmp

Download

memory/3008-48-0x00000000744A0000-0x0000000074C5C000-memory.dmp

Download

memory/3008-47-0x00000000744A0000-0x0000000074C5C000-memory.dmp

Download

memory/3008-46-0x00000000744B2000-0x00000000744B3000-memory.dmp

Download

memory/3008-29-0x000000000BB60000-0x000000000BF8C000-memory.dmp

Download

memory/3008-26-0x00000000744A0000-0x0000000074C5C000-memory.dmp

Download

memory/3008-0-0x00000000744B2000-0x00000000744B3000-memory.dmp

Download

memory/3008-16-0x0000000007750000-0x000000000778C000-memory.dmp

Download

memory/3008-15-0x0000000007AC0000-0x0000000007FEC000-memory.dmp

Download

memory/3008-14-0x00000000744A0000-0x0000000074C5C000-memory.dmp

Download

memory/3008-13-0x0000000007250000-0x00000000072A6000-memory.dmp

Download

memory/3008-3-0x0000000005500000-0x0000000005592000-memory.dmp

Download

memory/3008-2-0x0000000005AC0000-0x000000000607A000-memory.dmp

Download

memory/3008-1-0x00000000004C0000-0x0000000000906000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads