d37d9c48915b35b10b9aa8e297fdf229cf0bca108cf9fe14388aaba77e3660e7

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
07/08/2026, 18:12

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Client_Game_TTDL/TruyenThuyetDoLong/ProjectorClient/StartGame.bat
Size 878B
Sample260807-wtly3stxev
SHA256 d37d9c48915b35b10b9aa8e297fdf229cf0bca108cf9fe14388aaba77e3660e7
MD5 467941e971d5cabf4f4a64099ff548fe
SHA1 15a0e044e2c1efa27a1a488c29bdc5ac23f6d2f2
SHA512 177d1ec9a12c063d3bc616a6c18e97535f45eff1bb5caf6801a79f1b8480bbb1059604389c16bfc312b6a5014c87da2f35ed8158e26a65db4cd47e79fb07cf14
TLSH
T1691100A9A20E220CAB733E4160D1849BE38A67A2434191ADE002D7590D4C4B7F7E9B63
MD5 SHA1 SHA512 TLSH

Score

3^/10

discovery execution

Malware Config

Signatures

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2756	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	FlashPlayer.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	FlashPlayer.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	FlashPlayer.exe

Modifies registry class 43 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\FlashPlayer.AudioForFlashPlayer\shell	FlashPlayer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\FlashPlayer.AudioForFlashPlayer\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Client_Game_TTDL\\TruyenThuyetDoLong\\ProjectorClient\\FlashPlayer.exe,-205"	FlashPlayer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\FlashPlayer.ProtectedMediaForFlashPlayer\shell\open	FlashPlayer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\ShockwaveFlash.ShockwaveFlash\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\Client_Game_TTDL\\TruyenThuyetDoLong\\ProjectorClient\\FlashPlayer.exe\" %1"	FlashPlayer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ShockwaveFlash.ShockwaveFlash\DefaultIcon	FlashPlayer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.spl\ = "ShockwaveFlash.ShockwaveFlash"	FlashPlayer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\FlashPlayer.FlashVideo\shell	FlashPlayer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\FlashPlayer.VideoForFlashPlayer\shell\open\command	FlashPlayer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\FlashPlayer.VideoForFlashPlayer\DefaultIcon	FlashPlayer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.f4a\ = "FlashPlayer.AudioForFlashPlayer"	FlashPlayer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\FlashPlayer.ProtectedMediaForFlashPlayer\shell	FlashPlayer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.swf	FlashPlayer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\FlashPlayer.FlashVideo	FlashPlayer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\FlashPlayer.FlashVideo\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\Client_Game_TTDL\\TruyenThuyetDoLong\\ProjectorClient\\FlashPlayer.exe\" %1"	FlashPlayer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\FlashPlayer.AudioForFlashPlayer\shell\open\command	FlashPlayer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\FlashPlayer.AudioForFlashPlayer\shell\open	FlashPlayer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.f4a	FlashPlayer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\FlashPlayer.ProtectedMediaForFlashPlayer\DefaultIcon	FlashPlayer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\FlashPlayer.ProtectedMediaForFlashPlayer\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Client_Game_TTDL\\TruyenThuyetDoLong\\ProjectorClient\\FlashPlayer.exe,-204"	FlashPlayer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ShockwaveFlash.ShockwaveFlash	FlashPlayer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\FlashPlayer.FlashVideo\DefaultIcon	FlashPlayer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\FlashPlayer.VideoForFlashPlayer	FlashPlayer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\FlashPlayer.VideoForFlashPlayer\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\Client_Game_TTDL\\TruyenThuyetDoLong\\ProjectorClient\\FlashPlayer.exe\" %1"	FlashPlayer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\FlashPlayer.ProtectedMediaForFlashPlayer\shell\open\command	FlashPlayer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.f4p	FlashPlayer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.f4p\ = "FlashPlayer.ProtectedMediaForFlashPlayer"	FlashPlayer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.swf\ = "ShockwaveFlash.ShockwaveFlash"	FlashPlayer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.spl	FlashPlayer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\FlashPlayer.ProtectedMediaForFlashPlayer\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\Client_Game_TTDL\\TruyenThuyetDoLong\\ProjectorClient\\FlashPlayer.exe\" %1"	FlashPlayer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\FlashPlayer.AudioForFlashPlayer	FlashPlayer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ShockwaveFlash.ShockwaveFlash\shell\open\command	FlashPlayer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ShockwaveFlash.ShockwaveFlash\shell\open	FlashPlayer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\ShockwaveFlash.ShockwaveFlash\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Client_Game_TTDL\\TruyenThuyetDoLong\\ProjectorClient\\FlashPlayer.exe,-608"	FlashPlayer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\FlashPlayer.FlashVideo\shell\open\command	FlashPlayer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\FlashPlayer.FlashVideo\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Client_Game_TTDL\\TruyenThuyetDoLong\\ProjectorClient\\FlashPlayer.exe,-202"	FlashPlayer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\FlashPlayer.VideoForFlashPlayer\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Client_Game_TTDL\\TruyenThuyetDoLong\\ProjectorClient\\FlashPlayer.exe,-203"	FlashPlayer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\FlashPlayer.VideoForFlashPlayer\shell	FlashPlayer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\FlashPlayer.AudioForFlashPlayer\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\Client_Game_TTDL\\TruyenThuyetDoLong\\ProjectorClient\\FlashPlayer.exe\" %1"	FlashPlayer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\FlashPlayer.AudioForFlashPlayer\DefaultIcon	FlashPlayer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\FlashPlayer.ProtectedMediaForFlashPlayer	FlashPlayer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ShockwaveFlash.ShockwaveFlash\shell	FlashPlayer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\FlashPlayer.FlashVideo\shell\open	FlashPlayer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\FlashPlayer.VideoForFlashPlayer\shell\open	FlashPlayer.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1600	FlashPlayer.exe
1600	FlashPlayer.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 2756 wrote to memory of 1600	2756	cmd.exe	85

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\Client_Game_TTDL\TruyenThuyetDoLong\ProjectorClient\StartGame.bat"
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2756
- C:\Users\Admin\AppData\Local\Temp\Client_Game_TTDL\TruyenThuyetDoLong\ProjectorClient\FlashPlayer.exe
  "C:\Users\Admin\AppData\Local\Temp\Client_Game_TTDL\TruyenThuyetDoLong\ProjectorClient\FlashPlayer.exe" "http://180.93.244.31:81/GameFrame.swf?cache=49013975&srvaddr=180.93.244.31&srvport=13000&cbppack=0&ver=20260714directitem1&nocache=1&srvportmax=13000&srvid=1&ip1=123456&spid=937&ressite=http://180.93.244.31:81/data/&map=2&lang=zh-cn&frameRate=60&fpVersionURL=http://180.93.244.31:81/asdasdasdasdas.php&rechargeURL=http://180.93.244.31:81/main.php&rankurl=http://180.93.244.31:81/rankingserver.php&protectURL=http://180.93.244.31:81/&saveGameURL=http://180.93.244.31:81/"
  2⤵
  - System Location Discovery: System Language Discovery
  - Checks processor information in registry
  - Modifies registry class
  - Suspicious use of SetWindowsHookEx
  PID:1600

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.sxx

Path C:\Users\Admin\AppData\Roaming\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\settings.sxx
Size 397B
SHA256 f5a513d977e777f36d61dbd5e2be3c737ade51f304a712f7955244264303adb4
MD5 18f13d5d50365841e15f38ff3b576470
SHA1 925af99273268c571faa7d8aec4ae16b3710fd28
SHA512 61f12376bcb1b41bd791f4b757a28241472e0857d6e25b2456d98b5d8511af1ee69a94a1d288799eb459aa6172ac63988af26694a1df4813e01b4ffa8ac1a326
TLSH
T165E068C27020C5A2D9674E3D2180727D2631EF1F32863C0250C961614F8F8F28D0A7D5
MD5 SHA1 SHA512 TLSH

Submit Download