Overview
overview
6Static
static
3GameAssembly.dll
windows10-2004-x64
3GameAssembly.dll
windows11-ltsc_2024-x64
6Granny 1.0 PC.exe
windows10-2004-x64
5Granny 1.0 PC.exe
windows11-ltsc_2024-x64
1UnityCrash...64.exe
windows10-2004-x64
1UnityCrash...64.exe
windows11-ltsc_2024-x64
1UnityPlayer.dll
windows10-2004-x64
1UnityPlayer.dll
windows11-ltsc_2024-x64
1baselib.dll
windows10-2004-x64
1baselib.dll
windows11-ltsc_2024-x64
1Analysis
- max time kernel
149s - max time network
153s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
20/08/2026, 18:40
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
GameAssembly.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
12 signatures
150 seconds
Behavioral task
behavioral2
Sample
GameAssembly.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
20 signatures
150 seconds
Behavioral task
behavioral3
Sample
Granny 1.0 PC.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
5 signatures
150 seconds
Behavioral task
behavioral4
Sample
Granny 1.0 PC.exe
Resource
win11ltsc2024-20260710-en
windows11-ltsc_2024-x64
4 signatures
150 seconds
Behavioral task
behavioral5
Sample
UnityCrashHandler64.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral6
Sample
UnityCrashHandler64.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
Behavioral task
behavioral7
Sample
UnityPlayer.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral8
Sample
UnityPlayer.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
Behavioral task
behavioral9
Sample
baselib.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral10
Sample
baselib.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
General
- Target Granny 1.0 PC.exe
- Size 651KB
- Sample260820-xa85yahk71
- SHA256 fd4d5da53b6a539bba181426118335490731b913068aa5270dc43a0250ca1be6
- MD5 92ad985af86d2e61d267da5d8542d6ef
- SHA1 46c68abd76e126f3fdb92c97cd2ea635e081cdec
- SHA512 76191373ec472ed84af85658d430880b687d3a67b134e9c6d7bb8864e805838292c3fb7129a52f682fbdc381db5344e3ddff5f053431cb4471755556072447e3
- SSDEEP 6144:v/7FG9mpcJ/OD8T26RU3bYcdtpFW8XTrrK9S1FUCoLNf9vYzSTF56Mw51KjjkIXQ:v/744aOD8VvK5W8X/uKS5A8fBLNNfu
- TLSH T1F8E48CB5E92752CED2B3233C16A0E1E0DBB49AA0DD17039E66E1DC7BBC3A5C50D0659C
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
5/10
Malware Config
Signatures
- Drops file in System32 directory 64 IoCs
description ioc Process File opened for modification C:\Windows\system32\dll\winmm.pdb Granny 1.0 PC.exe File opened for modification C:\Windows\system32\dll\dwmapi.pdb Granny 1.0 PC.exe File opened for modification C:\Windows\system32\gdi32full.pdb Granny 1.0 PC.exe File opened for modification C:\Windows\system32\dll\ntdll.pdb Granny 1.0 PC.exe File opened for modification C:\Windows\system32\symbols\dll\ntdll.pdb Granny 1.0 PC.exe File opened for modification C:\Windows\system32\DLL\kernel32.pdb Granny 1.0 PC.exe File opened for modification C:\Windows\system32\shlwapi.pdb Granny 1.0 PC.exe File opened for modification C:\Windows\system32\symbols\dll\shlwapi.pdb Granny 1.0 PC.exe File opened for modification C:\Windows\system32\oleaut32.pdb Granny 1.0 PC.exe File opened for modification C:\Windows\system32\symbols\dll\crypt32.pdb Granny 1.0 PC.exe File opened for modification C:\Windows\system32\symbols\dll\cfgmgr32.pdb Granny 1.0 PC.exe File opened for modification C:\Windows\system32\dll\combase.pdb Granny 1.0 PC.exe File opened for modification C:\Windows\system32\symbols\dll\shell32.pdb Granny 1.0 PC.exe File opened for modification C:\Windows\system32\UxTheme.pdb Granny 1.0 PC.exe File opened for modification C:\Windows\system32\ws2_32.pdb Granny 1.0 PC.exe File opened for modification C:\Windows\system32\dll\version.pdb Granny 1.0 PC.exe File opened for modification C:\Windows\system32\symbols\dll\Kernel.Appcore.pdb Granny 1.0 PC.exe File opened for modification C:\Windows\system32\iphlpapi.pdb Granny 1.0 PC.exe File opened for modification C:\Windows\system32\shell32.pdb Granny 1.0 PC.exe File opened for modification C:\Windows\system32\symbols\dll\ws2_32.pdb Granny 1.0 PC.exe File opened for modification C:\Windows\system32\symbols\dll\bcryptprimitives.pdb Granny 1.0 PC.exe File opened for modification C:\Windows\system32\dbghelp.pdb Granny 1.0 PC.exe File opened for modification C:\Windows\system32\dll\CLBCatQ.pdb Granny 1.0 PC.exe File opened for modification C:\Windows\system32\dxgi.pdb Granny 1.0 PC.exe File opened for modification C:\Windows\system32\dll\fastprox.pdb Granny 1.0 PC.exe File opened for modification C:\Windows\system32\symbols\dll\MMDevAPI.pdb Granny 1.0 PC.exe File opened for modification C:\Windows\system32\symbols\dll\UMPDC.pdb Granny 1.0 PC.exe File opened for modification C:\Windows\system32\symbols\dll\apphelp.pdb Granny 1.0 PC.exe File opened for modification C:\Windows\system32\symbols\dll\win32u.pdb Granny 1.0 PC.exe File opened for modification C:\Windows\system32\symbols\dll\combase.pdb Granny 1.0 PC.exe File opened for modification C:\Windows\system32\dll\shlwapi.pdb Granny 1.0 PC.exe File opened for modification C:\Windows\system32\symbols\dll\sechost.pdb Granny 1.0 PC.exe File opened for modification C:\Windows\system32\apphelp.pdb Granny 1.0 PC.exe File opened for modification C:\Windows\system32\CoreMessaging.pdb Granny 1.0 PC.exe File opened for modification C:\Windows\system32\symbols\dll\d3d10warp.pdb Granny 1.0 PC.exe File opened for modification C:\Windows\system32\UnityPlayer_Win64_player_il2cpp_x64.pdb Granny 1.0 PC.exe File opened for modification C:\Windows\system32\gdi32.pdb Granny 1.0 PC.exe File opened for modification C:\Windows\system32\msvcrt.pdb Granny 1.0 PC.exe File opened for modification C:\Windows\system32\dll\d3d10warp.pdb Granny 1.0 PC.exe File opened for modification C:\Windows\system32\symbols\dll\fastprox.pdb Granny 1.0 PC.exe File opened for modification C:\Windows\system32\Amsi.pdb Granny 1.0 PC.exe File opened for modification C:\Windows\system32\symbols\dll\Amsi.pdb Granny 1.0 PC.exe File opened for modification C:\Windows\system32\symbols\dll\devobj.pdb Granny 1.0 PC.exe File opened for modification C:\Windows\system32\symbols\dll\gdi32full.pdb Granny 1.0 PC.exe File opened for modification C:\Windows\system32\version.pdb Granny 1.0 PC.exe File opened for modification C:\Windows\system32\opengl32.pdb Granny 1.0 PC.exe File opened for modification C:\Windows\system32\symbols\dll\d3d11.pdb Granny 1.0 PC.exe File opened for modification C:\Windows\system32\DXCore.pdb Granny 1.0 PC.exe File opened for modification C:\Windows\system32\symbols\dll\bcrypt.pdb Granny 1.0 PC.exe File opened for modification C:\Windows\system32\dll\oleaut32.pdb Granny 1.0 PC.exe File opened for modification C:\Windows\system32\symbols\dll\imm32.pdb Granny 1.0 PC.exe File opened for modification C:\Windows\system32\symbols\DLL\audioses.pdb Granny 1.0 PC.exe File opened for modification C:\Windows\system32\symbols\dll\ResourcePolicyClient.pdb Granny 1.0 PC.exe File opened for modification C:\Windows\system32\dll\winhttp.pdb Granny 1.0 PC.exe File opened for modification C:\Windows\system32\msctf.pdb Granny 1.0 PC.exe File opened for modification C:\Windows\system32\dll\Amsi.pdb Granny 1.0 PC.exe File opened for modification C:\Windows\system32\ucrtbase.pdb Granny 1.0 PC.exe File opened for modification C:\Windows\system32\symbols\dll\version.pdb Granny 1.0 PC.exe File opened for modification C:\Windows\system32\hid.pdb Granny 1.0 PC.exe File opened for modification C:\Windows\system32\UMPDC.pdb Granny 1.0 PC.exe File opened for modification C:\Windows\system32\dll\UMPDC.pdb Granny 1.0 PC.exe File opened for modification C:\Windows\system32\symbols\dll\msvcp_win.pdb Granny 1.0 PC.exe File opened for modification C:\Windows\system32\dll\msvcrt.pdb Granny 1.0 PC.exe File opened for modification C:\Windows\system32\sechost.pdb Granny 1.0 PC.exe - Drops file in Windows directory 64 IoCs
description ioc Process File opened for modification C:\Windows\symbols\dll\shlwapi.pdb Granny 1.0 PC.exe File opened for modification C:\Windows\advapi32.pdb Granny 1.0 PC.exe File opened for modification C:\Windows\symbols\dll\bcryptprimitives.pdb Granny 1.0 PC.exe File opened for modification C:\Windows\dll\dbghelp.pdb Granny 1.0 PC.exe File opened for modification C:\Windows\symbols\dll\ntdll.pdb Granny 1.0 PC.exe File opened for modification C:\Windows\dll\user32.pdb Granny 1.0 PC.exe File opened for modification C:\Windows\gdi32.pdb Granny 1.0 PC.exe File opened for modification C:\Windows\dll\bcryptprimitives.pdb Granny 1.0 PC.exe File opened for modification C:\Windows\CLBCatQ.pdb Granny 1.0 PC.exe File opened for modification C:\Windows\wbemcomn.pdb Granny 1.0 PC.exe File opened for modification C:\Windows\dll\wbemsvc.pdb Granny 1.0 PC.exe File opened for modification C:\Windows\symbols\dll\wbemsvc.pdb Granny 1.0 PC.exe File opened for modification C:\Windows\symbols\dll\win32u.pdb Granny 1.0 PC.exe File opened for modification C:\Windows\symbols\dll\gdi32.pdb Granny 1.0 PC.exe File opened for modification C:\Windows\dll\msctf.pdb Granny 1.0 PC.exe File opened for modification C:\Windows\dll\ResourcePolicyClient.pdb Granny 1.0 PC.exe File opened for modification C:\Windows\dll\gdi32.pdb Granny 1.0 PC.exe File opened for modification C:\Windows\symbols\dll\CLBCatQ.pdb Granny 1.0 PC.exe File opened for modification C:\Windows\CoreMessaging.pdb Granny 1.0 PC.exe File opened for modification C:\Windows\symbols\dll\d3d11.pdb Granny 1.0 PC.exe File opened for modification C:\Windows\dll\wbemprox.pdb Granny 1.0 PC.exe File opened for modification C:\Windows\devobj.pdb Granny 1.0 PC.exe File opened for modification C:\Windows\dll\ntdll.pdb Granny 1.0 PC.exe File opened for modification C:\Windows\bcryptprimitives.pdb Granny 1.0 PC.exe File opened for modification C:\Windows\symbols\dll\UxTheme.pdb Granny 1.0 PC.exe File opened for modification C:\Windows\GameAssembly.pdb Granny 1.0 PC.exe File opened for modification C:\Windows\symbols\dll\kernelbase.pdb Granny 1.0 PC.exe File opened for modification C:\Windows\dll\ole32.pdb Granny 1.0 PC.exe File opened for modification C:\Windows\dll\apphelp.pdb Granny 1.0 PC.exe File opened for modification C:\Windows\symbols\dll\apphelp.pdb Granny 1.0 PC.exe File opened for modification C:\Windows\symbols\dll\wbemprox.pdb Granny 1.0 PC.exe File opened for modification C:\Windows\symbols\dll\MMDevAPI.pdb Granny 1.0 PC.exe File opened for modification C:\Windows\dll\powrprof.pdb Granny 1.0 PC.exe File opened for modification C:\Windows\dll\msvcp_win.pdb Granny 1.0 PC.exe File opened for modification C:\Windows\dll\crypt32.pdb Granny 1.0 PC.exe File opened for modification C:\Windows\DLL\hid.pdb Granny 1.0 PC.exe File opened for modification C:\Windows\dll\UxTheme.pdb Granny 1.0 PC.exe File opened for modification C:\Windows\dll\Amsi.pdb Granny 1.0 PC.exe File opened for modification C:\Windows\symbols\dll\UMPDC.pdb Granny 1.0 PC.exe File opened for modification C:\Windows\symbols\dll\UnityPlayer_Win64_player_il2cpp_x64.pdb Granny 1.0 PC.exe File opened for modification C:\Windows\rpcrt4.pdb Granny 1.0 PC.exe File opened for modification C:\Windows\DLL\iphlpapi.pdb Granny 1.0 PC.exe File opened for modification C:\Windows\symbols\dll\CoreMessaging.pdb Granny 1.0 PC.exe File opened for modification C:\Windows\Amsi.pdb Granny 1.0 PC.exe File opened for modification C:\Windows\symbols\dll\combase.pdb Granny 1.0 PC.exe File opened for modification C:\Windows\d3d10warp.pdb Granny 1.0 PC.exe File opened for modification C:\Windows\dll\DXCore.pdb Granny 1.0 PC.exe File opened for modification C:\Windows\symbols\DLL\audioses.pdb Granny 1.0 PC.exe File opened for modification C:\Windows\ole32.pdb Granny 1.0 PC.exe File opened for modification C:\Windows\dll\combase.pdb Granny 1.0 PC.exe File opened for modification C:\Windows\dll\setupapi.pdb Granny 1.0 PC.exe File opened for modification C:\Windows\audioses.pdb Granny 1.0 PC.exe File opened for modification C:\Windows\ResourcePolicyClient.pdb Granny 1.0 PC.exe File opened for modification C:\Windows\UnityPlayer_Win64_player_il2cpp_x64.pdb Granny 1.0 PC.exe File opened for modification C:\Windows\symbols\dll\ole32.pdb Granny 1.0 PC.exe File opened for modification C:\Windows\symbols\dll\shell32.pdb Granny 1.0 PC.exe File opened for modification C:\Windows\dll\imm32.pdb Granny 1.0 PC.exe File opened for modification C:\Windows\ws2_32.pdb Granny 1.0 PC.exe File opened for modification C:\Windows\dll\version.pdb Granny 1.0 PC.exe File opened for modification C:\Windows\dwmapi.pdb Granny 1.0 PC.exe File opened for modification C:\Windows\dll\d3d11.pdb Granny 1.0 PC.exe File opened for modification C:\Windows\dll\ucrtbase.pdb Granny 1.0 PC.exe File opened for modification C:\Windows\symbols\dll\setupapi.pdb Granny 1.0 PC.exe File opened for modification C:\Windows\symbols\dll\oleaut32.pdb Granny 1.0 PC.exe - Checks processor information in registry 2 TTPs 4 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz Granny 1.0 PC.exe Key opened \REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000\HARDWARE\DESCRIPTION\System\CentralProcessor\0 Granny 1.0 PC.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 Granny 1.0 PC.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString Granny 1.0 PC.exe - Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 3940 Granny 1.0 PC.exe - Suspicious use of WriteProcessMemory 1 IoCs
description pid Process procid_target PID 3940 wrote to memory of 4632 3940 Granny 1.0 PC.exe 85
Processes
-
C:\Users\Admin\AppData\Local\Temp\Granny 1.0 PC.exe"C:\Users\Admin\AppData\Local\Temp\Granny 1.0 PC.exe"1⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Checks processor information in registry
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3940 -
C:\Users\Admin\AppData\Local\Temp\UnityCrashHandler64.exe"C:\Users\Admin\AppData\Local\Temp\UnityCrashHandler64.exe" --attach 3940 13758150123522⤵PID:4632
-
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x518 0x4981⤵PID:2044
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\LocalLow\Hunter Of Jake\Granny 1_0 PC\Unity\7d446314-4fb3-4b42-88e3-eea31d5979e8\Analytics\ArchivedEvents\178725127900002.54683d3e\c
- Size 1B
- SHA256 d4735e3a265e16eee03f59718b9b5d03019c07d8b6c51f90da3a666eec13ab35
- MD5 c81e728d9d4c2f636f067f89cc14862c
- SHA1 da4b9237bacccdf19c0760cab7aec4a8359010b0
- SHA512 40b244112641dd78dd4f93b6c9190dd46e0099194d5a44257b7efad6ef9ff4683da1eda0244448cb343aa688f5d3efd7314dafe580ac0bcbf115aeca9e8dc114
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Hunter Of Jake\Granny 1_0 PC\Unity\7d446314-4fb3-4b42-88e3-eea31d5979e8\Analytics\ArchivedEvents\178725127900002.54683d3e\s
- Size 462B
- SHA256 145d0f0f4efc7e87feefce7cc8e10071617c395ff7700c33187998711ed1be05
- MD5 40fa9c7bd7e80ead9577a09c14e76732
- SHA1 52aea9bc65383c60ec02a280ad5709265c6fb50f
- SHA512 6095b3148db6479fb204c6182ecb807b9de0adbf86c9768b0481c13ff1e371113072e834989f653c6abdf22e0411044812efac19dc4eceb98462e9ea44c26fc0
- TLSH T13EF0D46707D4EF3581F56A917CE70051043A6460A571977F52F480494BC9054A34383D
- MD5 SHA1 SHA512 TLSH