fd4d5da53b6a539bba181426118335490731b913068aa5270dc43a0250ca1be6

Analysis

max time kernel
149s
max time network
148s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
20/08/2026, 18:40

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Granny 1.0 PC.exe
Size 651KB
Sample260820-xa85yahk71
SHA256 fd4d5da53b6a539bba181426118335490731b913068aa5270dc43a0250ca1be6
MD5 92ad985af86d2e61d267da5d8542d6ef
SHA1 46c68abd76e126f3fdb92c97cd2ea635e081cdec
SHA512 76191373ec472ed84af85658d430880b687d3a67b134e9c6d7bb8864e805838292c3fb7129a52f682fbdc381db5344e3ddff5f053431cb4471755556072447e3
SSDEEP 6144:v/7FG9mpcJ/OD8T26RU3bYcdtpFW8XTrrK9S1FUCoLNf9vYzSTF56Mw51KjjkIXQ:v/744aOD8VvK5W8X/uKS5A8fBLNNfu
TLSH
T1F8E48CB5E92752CED2B3233C16A0E1E0DBB49AA0DD17039E66E1DC7BBC3A5C50D0659C
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Malware Config

Signatures

Checks processor information in registry 2 TTPs 4 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	Granny 1.0 PC.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	Granny 1.0 PC.exe
Key opened	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Granny 1.0 PC.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Granny 1.0 PC.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: 33	4676	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	4676	AUDIODG.EXE

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
4264	Granny 1.0 PC.exe
4264	Granny 1.0 PC.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4264 wrote to memory of 1600	4264	Granny 1.0 PC.exe	89

C:\Users\Admin\AppData\Local\Temp\Granny 1.0 PC.exe
"C:\Users\Admin\AppData\Local\Temp\Granny 1.0 PC.exe"
1⤵
- Checks processor information in registry
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4264
- C:\Users\Admin\AppData\Local\Temp\UnityCrashHandler64.exe
  "C:\Users\Admin\AppData\Local\Temp\UnityCrashHandler64.exe" --attach 4264 1703855525888
  2⤵
  PID:1600

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x0000000000000498 0x00000000000004E4
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4676

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Path C:\Users\Admin\AppData\LocalLow\Hunter Of Jake\Granny 1_0 PC\Unity\7d446314-4fb3-4b42-88e3-eea31d5979e8\Analytics\ArchivedEvents\178725129500002.e53f27c0\c
Size 1B
SHA256 d4735e3a265e16eee03f59718b9b5d03019c07d8b6c51f90da3a666eec13ab35
MD5 c81e728d9d4c2f636f067f89cc14862c
SHA1 da4b9237bacccdf19c0760cab7aec4a8359010b0
SHA512 40b244112641dd78dd4f93b6c9190dd46e0099194d5a44257b7efad6ef9ff4683da1eda0244448cb343aa688f5d3efd7314dafe580ac0bcbf115aeca9e8dc114
MD5 SHA1 SHA512

Submit Download

Path C:\Users\Admin\AppData\LocalLow\Hunter Of Jake\Granny 1_0 PC\Unity\7d446314-4fb3-4b42-88e3-eea31d5979e8\Analytics\ArchivedEvents\178725129500002.e53f27c0\s
Size 462B
SHA256 899933f86c60a4c6c124520e175cca471cc742e17802d0aebe7cb5fa395b1db1
MD5 f3663826ec496937d72dcb9bfb9f69e8
SHA1 31f47f11f730664632dbe4f426f86ce0afabdd59
SHA512 1a3ea19d9647ea8f28ebeea6031ab038a5d44ccec14da89af739bf09990011ebe24549034219887b70e22c504aebb973aea25dcd654573d69b15a774828ca9d4
TLSH
T1DDF0DC3A0F56EF3506E801A269A2859228292191BD2BD2BE30B141EF471D2608B83865
MD5 SHA1 SHA512 TLSH