Overview

overview

7

Static

static

3

flappybird...ke.exe

windows10-2004-x64

1

flappybird...ke.exe

windows11-ltsc_2024-x64

1

flappybird...ke.exe

windows10-2004-x64

7

flappybird...ke.exe

windows11-ltsc_2024-x64

6

flappybird...io.dll

windows10-2004-x64

1

flappybird...io.dll

windows11-ltsc_2024-x64

1

flappybird...re.dll

windows10-2004-x64

1

flappybird...re.dll

windows11-ltsc_2024-x64

1

flappybird...di.dll

windows10-2004-x64

1

flappybird...di.dll

windows11-ltsc_2024-x64

1

flappybird...pi.dll

windows10-2004-x64

1

flappybird...pi.dll

windows11-ltsc_2024-x64

1

flappybird...ms.dll

windows10-2004-x64

1

flappybird...ms.dll

windows11-ltsc_2024-x64

1

flappybird...MM.dll

windows10-2004-x64

1

flappybird...MM.dll

windows11-ltsc_2024-x64

1

flappybird/NAudio.dll

windows10-2004-x64

1

flappybird/NAudio.dll

windows11-ltsc_2024-x64

1

Analysis

  • max time kernel
    150s
  • max time network
    152s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260513-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    15/08/2026, 04:34

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    flappybird/FlappyBirdsTacotrucksTake.exe
  • Size 571KB
  • Sample260815-e662caztfv
  • SHA256 9d9b60e6391f3e2f7728283c531d761a06e9ee88c3d69e7c84b5728f7686bcfd
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
adwareransomwarespyware

Malware Config

Signatures

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Sets desktop wallpaper using registry 2 TTPs 1 IoCs
    ransomware
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies Internet Explorer settings 1 TTPs 12 IoCs
    adwarespyware
  • Modifies registry class 43 IoCs
  • Suspicious behavior: AddClipboardFormatListener 3 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of SetWindowsHookEx 6 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\flappybird\FlappyBirdsTacotrucksTake.exe
    "C:\Users\Admin\AppData\Local\Temp\flappybird\FlappyBirdsTacotrucksTake.exe"
    1⤵
    • Checks computer location settings
    • Sets desktop wallpaper using registry
    • Modifies registry class
    • Suspicious use of WriteProcessMemory
    PID:3112
    • C:\Windows\explorer.exe
      "C:\Windows\explorer.exe" search-ms:query=how%20to%20delete%20system32
      2⤵
        PID:4564
      • C:\Windows\explorer.exe
        "C:\Windows\explorer.exe" search-ms:query=test
        2⤵
          PID:2172
        • C:\Windows\explorer.exe
          "C:\Windows\explorer.exe" search-ms:query=test
          2⤵
            PID:3252
        • C:\Windows\system32\AUDIODG.EXE
          C:\Windows\system32\AUDIODG.EXE 0x4d8 0x4c4
          1⤵
            PID:2972
          • C:\Windows\explorer.exe
            C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
            1⤵
            • Modifies Internet Explorer settings
            • Modifies registry class
            • Suspicious behavior: AddClipboardFormatListener
            • Suspicious use of SetWindowsHookEx
            PID:5008
          • C:\Windows\explorer.exe
            C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
            1⤵
            • Modifies Internet Explorer settings
            • Modifies registry class
            • Suspicious behavior: AddClipboardFormatListener
            • Suspicious use of SetWindowsHookEx
            PID:4612
          • C:\Windows\explorer.exe
            C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
            1⤵
            • Modifies Internet Explorer settings
            • Modifies registry class
            • Suspicious behavior: AddClipboardFormatListener
            • Suspicious behavior: GetForegroundWindowSpam
            • Suspicious use of SetWindowsHookEx
            PID:2288

          Network

                MITRE ATT&CK Enterprise v16

                Replay Monitor

                Loading Replay Monitor...

                Downloads

                poop.gif
                • Path C:\Users\Admin\AppData\Local\Temp\pv_7f5fbf5c\poop.gif
                • Size 4.1MB
                • SHA256 12ae44396534f9b435574a4969ce156cb4c48f83798ef6c4eef84df6b002fefb
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                poop1.gif
                • Path C:\Users\Admin\AppData\Local\Temp\pv_7f5fbf5c\poop1.gif
                • Size 1.8MB
                • SHA256 c851cff3a97a4326c4737f64dc47c63338ef4053bdfe65591515f31db1d1b699
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                poop2.gif
                • Path C:\Users\Admin\AppData\Local\Temp\pv_7f5fbf5c\poop2.gif
                • Size 213KB
                • SHA256 79d80ed6db05953b534230d11572e5a79b93162399cc4a51294f759c5df3c08b
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                poop3.gif
                • Path C:\Users\Admin\AppData\Local\Temp\pv_7f5fbf5c\poop3.gif
                • Size 7.7MB
                • SHA256 7cb91c701c522d5b4ca4e3aa1a64a0111be423c9991207a57646a7fb436488c7
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                poop4.gif
                • Path C:\Users\Admin\AppData\Local\Temp\pv_7f5fbf5c\poop4.gif
                • Size 124KB
                • SHA256 7465c875f1dac1ec01ea98a5e55b499c1dd6eb9f4763de168434d39a65e7d1cc
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                poop7.gif
                • Path C:\Users\Admin\AppData\Local\Temp\pv_7f5fbf5c\poop7.gif
                • Size 3.9MB
                • SHA256 a3d9ddec64e3effa54bc4b9882099479fc094e894680c58d6a5d3b24175de36e
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download