Overview

overview

7

Static

static

3

flappybird...ke.exe

windows10-2004-x64

1

flappybird...ke.exe

windows11-ltsc_2024-x64

1

flappybird...ke.exe

windows10-2004-x64

7

flappybird...ke.exe

windows11-ltsc_2024-x64

6

flappybird...io.dll

windows10-2004-x64

1

flappybird...io.dll

windows11-ltsc_2024-x64

1

flappybird...re.dll

windows10-2004-x64

1

flappybird...re.dll

windows11-ltsc_2024-x64

1

flappybird...di.dll

windows10-2004-x64

1

flappybird...di.dll

windows11-ltsc_2024-x64

1

flappybird...pi.dll

windows10-2004-x64

1

flappybird...pi.dll

windows11-ltsc_2024-x64

1

flappybird...ms.dll

windows10-2004-x64

1

flappybird...ms.dll

windows11-ltsc_2024-x64

1

flappybird...MM.dll

windows10-2004-x64

1

flappybird...MM.dll

windows11-ltsc_2024-x64

1

flappybird/NAudio.dll

windows10-2004-x64

1

flappybird/NAudio.dll

windows11-ltsc_2024-x64

1

Analysis

  • max time kernel
    22s
  • max time network
    115s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    15/08/2026, 04:34

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    flappybird/FlappyBirdsTacotrucksTake.exe
  • Size 571KB
  • Sample260815-e662caztfv
  • SHA256 9d9b60e6391f3e2f7728283c531d761a06e9ee88c3d69e7c84b5728f7686bcfd
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
6/10
adwareransomwarespyware

Malware Config

Signatures

  • Drops desktop.ini file(s) 6 IoCs
  • Sets desktop wallpaper using registry 2 TTPs 1 IoCs
    ransomware
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies Internet Explorer settings 1 TTPs 6 IoCs
    adwarespyware
  • Modifies registry class 51 IoCs
  • Suspicious behavior: AddClipboardFormatListener 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SetWindowsHookEx 3 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\flappybird\FlappyBirdsTacotrucksTake.exe
    "C:\Users\Admin\AppData\Local\Temp\flappybird\FlappyBirdsTacotrucksTake.exe"
    1⤵
    • Sets desktop wallpaper using registry
    • Modifies registry class
    • Suspicious use of WriteProcessMemory
    PID:5748
    • C:\Windows\explorer.exe
      "C:\Windows\explorer.exe" search-ms:query=test
      2⤵
      • Modifies registry class
      PID:4916
    • C:\Windows\explorer.exe
      "C:\Windows\explorer.exe" search-ms:query=free%20robux
      2⤵
      • Modifies registry class
      PID:2352
    • C:\Windows\explorer.exe
      "C:\Windows\explorer.exe" search-ms:query=how%20to%20delete%20system32
      2⤵
      • Modifies registry class
      PID:1780
  • C:\Windows\system32\AUDIODG.EXE
    C:\Windows\system32\AUDIODG.EXE 0x00000000000004FC 0x00000000000004F0
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:376
  • C:\Windows\explorer.exe
    C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
    1⤵
    • Drops desktop.ini file(s)
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SetWindowsHookEx
    PID:2044
  • C:\Windows\System32\rundll32.exe
    C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
    1⤵
      PID:6100
    • C:\Windows\explorer.exe
      C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
      1⤵
      • Drops desktop.ini file(s)
      • Modifies Internet Explorer settings
      • Modifies registry class
      • Suspicious behavior: AddClipboardFormatListener
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SetWindowsHookEx
      PID:4576
    • C:\Windows\explorer.exe
      C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
      1⤵
      • Modifies Internet Explorer settings
      • Modifies registry class
      • Suspicious use of SetWindowsHookEx
      PID:2560

    Network

          MITRE ATT&CK Enterprise v16

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          poop.gif
          • Path C:\Users\Admin\AppData\Local\Temp\pv_fa02178f\poop.gif
          • Size 4.1MB
          • SHA256 12ae44396534f9b435574a4969ce156cb4c48f83798ef6c4eef84df6b002fefb
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          poop1.gif
          • Path C:\Users\Admin\AppData\Local\Temp\pv_fa02178f\poop1.gif
          • Size 1.8MB
          • SHA256 c851cff3a97a4326c4737f64dc47c63338ef4053bdfe65591515f31db1d1b699
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          poop2.gif
          • Path C:\Users\Admin\AppData\Local\Temp\pv_fa02178f\poop2.gif
          • Size 213KB
          • SHA256 79d80ed6db05953b534230d11572e5a79b93162399cc4a51294f759c5df3c08b
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          poop3.gif
          • Path C:\Users\Admin\AppData\Local\Temp\pv_fa02178f\poop3.gif
          • Size 7.7MB
          • SHA256 7cb91c701c522d5b4ca4e3aa1a64a0111be423c9991207a57646a7fb436488c7
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          poop6.jpeg
          • Path C:\Users\Admin\AppData\Local\Temp\pv_fa02178f\poop6.jpeg
          • Size 104KB
          • SHA256 d650d1419a0ecc789cf641709aa89f0ac1ee30fe54b33974ff87e5813e28dc29
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          poop7.gif
          • Path C:\Users\Admin\AppData\Local\Temp\pv_fa02178f\poop7.gif
          • Size 3.9MB
          • SHA256 a3d9ddec64e3effa54bc4b9882099479fc094e894680c58d6a5d3b24175de36e
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download