2fd0581dbd66bc77293d69a350da7837d2aae9c3585f78375ad1bb3880a0c6c2

Analysis

max time kernel
150s
max time network
115s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
14/08/2026, 01:11

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Game Maker 8.2 Setup.exe
Size 27.9MB
Sample260814-bjxbvasbrb
SHA256 2fd0581dbd66bc77293d69a350da7837d2aae9c3585f78375ad1bb3880a0c6c2
MD5 d3e6489c1d3ca6fdfa34b374ad1353b4
SHA1 7cf23fa3c7f89a61c6897710ac93617437ab65d4
SHA512 cbe9a2ffd528486e9780aa2b8abc427c41cf39e6434766ae1248594a3f1209221df1573726be936907f485469be4f2bf7642eb2a04b9b9c0d7232b4599974451
SSDEEP 786432:yojPug/Ud4PkO3MN/K6K/mLgmX9FoV3q9GELI8ch4D:lP79PF3MG/mLgNV69drz
TLSH
T1655733412BC6E897E95124B1464A3F52F3ECF834E2E40A09EA3F51739D313D687265EB
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery execution

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
5824	7za.exe
5944	7za.exe

Loads dropped DLL 3 IoCs

pid	Process
3800	Game Maker 8.2 Setup.exe
3800	Game Maker 8.2 Setup.exe
3800	Game Maker 8.2 Setup.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4996	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	7za.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	7za.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Game Maker 8.2 Setup.exe

Kills process with taskkill 1 IoCs

defense_evasion

pid	Process
5184	taskkill.exe

Modifies registry class 29 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\gmkfile\Shell\Open	cmd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\gm82file\Shell\Open\Command\ = "\"C:\\Users\\Admin\\AppData\\Roaming\\GameMaker8.2\\GameMaker.exe\" \"%1\""	cmd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.rv2	cmd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.gm81	cmd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\gmkfile\Shell	cmd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\gm81file\Shell\Open	cmd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\gm81file\Shell\Open\Command	cmd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.gm82\ = "gm82file"	cmd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\rv2file\Shell\Open	cmd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\gm82file\Shell\Open\Command	cmd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.gm81\ = "gm81file"	cmd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\gmkfile	cmd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\gmkfile\Shell\Open\Command	cmd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\gm82file	cmd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\gm82file\Shell	cmd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\rv2file\Shell\Open\Command	cmd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\gm82file\Shell\Open	cmd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.rv2\ = "rv2file"	cmd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.gmk	cmd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\rv2file\Shell	cmd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.gm82	cmd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\gmkfile\Shell\Open\Command\ = "\"C:\\Users\\Admin\\AppData\\Roaming\\GameMaker8.2\\GameMaker.exe\" \"%1\""	cmd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\gm81file	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Local Settings	Game Maker 8.2 Setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.gmk\ = "gmkfile"	cmd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\rv2file	cmd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\rv2file\Shell\Open\Command\ = "\"C:\\Users\\Admin\\AppData\\Roaming\\GameMaker8.2\\gm82vp.exe\" \"%1\""	cmd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\gm81file\Shell	cmd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\gm81file\Shell\Open\Command\ = "\"C:\\Users\\Admin\\AppData\\Roaming\\GameMaker8.2\\GameMaker.exe\" \"%1\""	cmd.exe

Suspicious use of AdjustPrivilegeToken 9 IoCs

description	pid	Process
Token: SeDebugPrivilege	5184	taskkill.exe
Token: SeRestorePrivilege	5824	7za.exe
Token: 35	5824	7za.exe
Token: SeSecurityPrivilege	5824	7za.exe
Token: SeSecurityPrivilege	5824	7za.exe
Token: SeRestorePrivilege	5944	7za.exe
Token: 35	5944	7za.exe
Token: SeSecurityPrivilege	5944	7za.exe
Token: SeSecurityPrivilege	5944	7za.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 3800 wrote to memory of 5184	3800	Game Maker 8.2 Setup.exe	89
PID 3800 wrote to memory of 5824	3800	Game Maker 8.2 Setup.exe	92
PID 3800 wrote to memory of 4996	3800	Game Maker 8.2 Setup.exe	94
PID 3800 wrote to memory of 5944	3800	Game Maker 8.2 Setup.exe	96

C:\Users\Admin\AppData\Local\Temp\Game Maker 8.2 Setup.exe
"C:\Users\Admin\AppData\Local\Temp\Game Maker 8.2 Setup.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3800
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /f /im GameMaker.exe
  2⤵
  - System Location Discovery: System Language Discovery
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:5184
- C:\Users\Admin\AppData\Roaming\GameMaker8.2\7za.exe
  "C:\Users\Admin\AppData\Roaming\GameMaker8.2\7za.exe" -y x Game_Maker_8.2_portable.7z
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  PID:5824
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\GameMaker8.2\associate.bat""
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  PID:4996
- C:\Users\Admin\AppData\Roaming\GameMaker8.2\7za.exe
  "C:\Users\Admin\AppData\Roaming\GameMaker8.2\7za.exe" -y x doc.7z
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  PID:5944

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4276

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

nsExec.dll

Path C:\Users\Admin\AppData\Local\Temp\nsu8CB7.tmp\nsExec.dll
Size 10KB
SHA256 0d7f702c518286a2d87db689af169c3857142324de4c9d76d51ebf639dced3df
MD5 e78bcd3208bff839e612041895bb8d42
SHA1 4b21b475b21d8f8bb2655d8e8e7d47548825831f
SHA512 eb38959a877d1af4ae53f25407ede3172f990f8c824624f5a2f385cddbd71a437b9033d45042a0e40f7fb611ff48836be166d97d42f3c169babb063ef48e8e35
SSDEEP 192:MItx8GSBYnUMu3Oad973Ykv/RGwC7ocJ4D4:bx8GOYnBu3Oad973YkvMwC7ocJ
TLSH
T12A22B8C9BA1579F5E0239838B18AF12F4D5D7C31DA2B840EE89A1E35B81F5E4571DB03
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7za.exe

Path C:\Users\Admin\AppData\Roaming\GameMaker8.2\7za.exe
Size 838KB
SHA256 26817725650583d99ca3e617a618dd75c0f71bd316b5761780b7361f5f824cad
MD5 e96e28b3824abf6496fd0971b3ba7459
SHA1 1195b7ff7090587b1c6d38a959ff7e86ebf22cc6
SHA512 b90609b54666f54e154d4e7c21a505247db811c1da99a02c92a9d7db6c85f1248326ba791f28b8efe4d103ac880981200ac546f2c6730fb95e2bf93c9b89f740
SSDEEP 24576:DzwrgD+SHLYg9WITZMnYy4lbDiPw9ADbDmgZmz6yE:DU8RrYcWVvIDrdgUz6y
TLSH
T12805AD127AE9D0BBD2421132CB1C6BF591FAD7680B3048C763848F5D7B359D1DA3AA1E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

doc.7z

Path C:\Users\Admin\AppData\Roaming\GameMaker8.2\Game Maker 8.2 Documentation\doc.7z
Size 1.4MB
SHA256 b3e292d1b949e1cc1e8230c68ad33214068e9db5a29f4c9ffebaf16cbf833e9e
MD5 27e4935f84612d8d2043f72fa1ba4292
SHA1 be065e2b23c054ec9d8156957917b06a032fe1f5
SHA512 e48788f4e9a7859d47e481723ab0094111a409a41906b69ca6b1dd96477e7a491df3aaad9ffb00209c4246127f2c09b3a3033fa9a7c2ad6f196678f000affa28
SSDEEP 24576:I3SjOk7d/kmoQGPgB8HFUndhsDOVI/UHDhAcpwH67fcqvwNqb6DktjT3YONSPZ:iSjODmKoB8HmnXAbH6bcywNDktjMOYPZ
TLSH
T1C96533102286640FA39AD1133ED25666C44CBC3DE5102399B37E64ADCC79A89DFEFD2D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

GameMaker.exe

Path C:\Users\Admin\AppData\Roaming\GameMaker8.2\GameMaker.exe
Size 5.0MB
SHA256 04b5eb0a46ea073d76dd623837675e5bb8450912de3ca472e78921f34a07714c
MD5 82bfd40830239dc422113f903767fe46
SHA1 1c85c1ec7191bb697519b213ed6b5290ddd1d399
SHA512 c85cd3fa16d956b93c57ee0a436ade6c14c1fce1641e6e6fd6569cac291d696b95a8efc872b58302337388e503099a199cbd2018f51df65e9a6fdd49bffbbdff
SSDEEP 49152:ojgzyfcNKWh6SzRAg10OgUYgVdQtzdBNe0W9uAY2THCr+KqPndEHvxi:+gz8ogUL8bw0WMlHO5
TLSH
T18F366D01B7859436D0B60B3ACC2BD6FC583ABE60AD26C9DB6BE07E4C3D75740A925707
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Game_Maker_8.2_portable.7z

Path C:\Users\Admin\AppData\Roaming\GameMaker8.2\Game_Maker_8.2_portable.7z
Size 25.3MB
SHA256 19027973c1c6c90239b12e2fbece1dc13cae949ea50151d92037242e54035b64
MD5 c22516999baef5e7ba3d3d8f2697d38a
SHA1 6e2ae7c57d763de59da3cb81abca6a42d43fa9b4
SHA512 2890b87d3f032757f7e6c7fdffea65673d801c41000c0cba80609ee3553c45713c5ef15978d36b1575e0799b704b99e7058b51ae1928dbe3fdc37e152b8c800c
SSDEEP 786432:+ojPug/Ud4PkO3MN/K6K/mLgmX9FoV3q9Gq:pP79PF3MG/mLgNV69B
TLSH
T13247339119CAF596E98039F1450D3F41F7E8E034F7E44A49A93F817366223DB8722DAB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

anvil.exe

Path C:\Users\Admin\AppData\Roaming\GameMaker8.2\anvil.exe
Size 5.5MB
SHA256 8b67e5db0deafeb3c9fe5cfaa77c61b266ddfef585e6daf157aa3bce26ad4bdb
MD5 a1fc7f5698b4e051b3736a86052ead4b
SHA1 73a6f5c4c3a2b874aa63c8f54c5a255418cb877d
SHA512 8efb184885e6d363189121b2fabfdb355798c1fddafb5f105cdbc66604dc2a6bfd39a5bb64a584ef085f628e78924cde2c1b8df4c4522f1a0ba3747866a8a270
SSDEEP 98304:hyMNL76YkzFf06Vgnp7MxgGXR5tiuHt7evUe43KGjZXeSiYt4ZLD:EMlG+pzGXR5XV5n3KGjS64ZLD
TLSH
T1F246C012A3C69C3ED4B71B324CBBC3945936BE512A2AC94F2AB47E0C2E397506C35757
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

associate.bat

Path C:\Users\Admin\AppData\Roaming\GameMaker8.2\associate.bat
Size 251B
SHA256 527c9f08d816202cfd2eb9a5efded27ae601b97c1fbb54ce6039053e79300e99
MD5 c2ed4abc2e06b7e0a7ffe97ae1b57002
SHA1 b05a13b470c5c4622936b0cd54822a19f675c069
SHA512 220ffe36e3e55c63497caab24613e8597417feefe6d66ef279a4c6bd4d8e36fb106473f5f5d92e1fe414b09271970b4c1c31b68bb8275f84ce3034fdf58979e8
TLSH
T165D0A7480E0B1C000CDF3195478840F1704D5A430B5B32AAF1A2EC1F630B11758FC3CC
MD5 SHA1 SHA512 TLSH

Submit Download

gm82hub.exe

Path C:\Users\Admin\AppData\Roaming\GameMaker8.2\gm82hub.exe
Size 4.8MB
SHA256 2b13b6a53edaa011d80485eb6939516bc69e311a0006b82831322928e7eb0c75
MD5 99388bacb10e896583dca8ead5582e1e
SHA1 11e720c48414ba5c2c67d7e8212f971fb1d57649
SHA512 6c2ee1a415c6a4a7798592c897327179ccbbeeea832c8e4fd84a15fdb30405479c9907eb236e32d2f708e37ae0beef47963a463101a06d5c386cb62c4bacd7a7
SSDEEP 98304:hyMNL76YkzFf06VgnLI1z2BbzmertJ3e9UVHzd5b1:EMlG+LI1z2Bn/3yUVTLb1
TLSH
T16736BF12A3C69C3ED4B71B324CBBC3945936BE512A2ACD4F2AA47E0C2E397506C35757
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gm82mv.exe

Path C:\Users\Admin\AppData\Roaming\GameMaker8.2\gm82mv.exe
Size 4.8MB
SHA256 1f8dc91bafb221eb8692891aeac4285c347f7bfa98f5af3958b2e24c8c1c499b
MD5 37587577995c7e375e2caa8659bed980
SHA1 9e31da838b73f74cd4d46c2d83649db0ceb00c73
SHA512 5f2e4a40208b4e780abf3e9b7cef2101e2cdb81a67e9c8e95666e8572932210d234add86094055f65374e9072bcf134e6bfb28f36aab22fc7d76ddaba35979eb
SSDEEP 98304:OyMNL76YkzFf06VgnOkh/ugKkEhbk9L5TnRDDevM0a:xMlG+90gKkSbk9L5nRDDua
TLSH
T13B36BF12A3D69C3ED0B60B324C7BC3946936BE512A2BCC4F2AA47D4C2E397816D35757
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gm82room.exe

Path C:\Users\Admin\AppData\Roaming\GameMaker8.2\gm82room.exe
Size 4.9MB
SHA256 f1de5bdafd4924b8e3ffc950e96cfa244c15bc9a6676afa65d4a79ee765db5e2
MD5 9922e0995f2128dc8db9e17dfae8f00a
SHA1 380116fb20deb67e8d526ef63ce85b5005438055
SHA512 97480e71524ffe308eccf2e30af7b9d1b37e4fc3c462c73e99471af40d78ab6122cd2e75fe2500cc6e38a774c960146846a3ba7168fea0c0676d01666c2e36df
SSDEEP 98304:hyMNL76YkzFf06Vgn3rqFQKKGPcUB+r02bSj8:EMlG+3uKsf+hk8
TLSH
T19236BF12A3C69C3EE4B71B324CBBC3945936BE512A2BC90F2AA47D0C6E397506C35757
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gm82venc.exe

Path C:\Users\Admin\AppData\Roaming\GameMaker8.2\gm82venc.exe
Size 5.4MB
SHA256 f7a31f97f48a017a6260ec4ae6e90ec48b91b2b251e23855b024421d10665efa
MD5 0fb2c473e573d31a1d56d836b774c4c5
SHA1 2c42ea0cec16b543b1296f82c0bf31d2a6508a3f
SHA512 652fe9a3514766368f863bb216ae56e95f5b83d1c344e6c6152d3c464b340143318762b699bc84ec58f4b926c22a85ebc4a4c217effbd419520468e12a38a74a
SSDEEP 98304:nyMNL76YkzFf06Vgn1LDyUBjXRVoLsPnmCLzBi34buKC:yMlG+JDyqjh8sPnLzM34buKC
TLSH
T19D46B012A3C69C3EE4B61B324CBBC3945936BD512A2BCD4F2BA4790C2E397906C35757
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gm82vp.exe

Path C:\Users\Admin\AppData\Roaming\GameMaker8.2\gm82vp.exe
Size 4.8MB
SHA256 4ad6271aa92fb444331d4e8c744008a24220ddb6d69db4d1aa409d37dd358de7
MD5 beaf358e00ba4995f454b7bd145bc660
SHA1 827dbbbb141ab431be6ea5665552ce00d2e5affd
SHA512 dcdc03107d516321e7820739ef06905f31db99d74affa03f5f16002e32ee62b69bf71b81d9efcb43c60df091380ecd7ff9695099e796c61030773ae799fcc13c
SSDEEP 98304:nyMNL76YkzFf06VgnRLG8lvWv7c8ywM7Gjsn3JGldUb:yMlG+I8lvFzwYos3SdUb
TLSH
T15336AF12A3C69C3ED4B71B324CBBC3945936BE512A2ACC4F2BA4790C6E397906C35757
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3800-461-0x0000000000400000-0x0000000000459000-memory.dmp

Download

memory/3800-0-0x0000000000400000-0x0000000000459000-memory.dmp

Download

memory/3800-620-0x0000000000400000-0x0000000000459000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads