Analysis
- user interaction
yes - max time kernel
60s - max time network
42s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-es - resource tags
- submitted
20/08/2026, 20:40
General
- Target Sonic Mania Plus/SonicMania.exe
- Size 3.0MB
- Sample260820-zfxefaam2v
- SHA256 69da0c7b1b9d54ace4a84b500a1610e761e55f155969442d6d036c86e9dda8a7
Malware Config
Signatures
- Drops desktop.ini file(s) 1 IoCs
- Program crash 2 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Checks processor information in registry 2 TTPs 6 IoCs
Processor information is often read in order to detect sandboxing environments.
- Enumerates system info in registry 2 TTPs 5 IoCs
- Modifies data under HKEY_USERS 2 IoCs
- Modifies registry class 1 IoCs
- Suspicious use of SetWindowsHookEx 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Sonic Mania Plus\SonicMania.exe"C:\Users\Admin\AppData\Local\Temp\Sonic Mania Plus\SonicMania.exe"1⤵
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Enumerates system info in registry
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3824 -s 15042⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3824 -s 14922⤵
- Program crash
-
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
- Suspicious use of SetWindowsHookEx
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k BcastDVRUserService -s BcastDVRUserService1⤵
- Drops desktop.ini file(s)
- Checks processor information in registry
- Modifies registry class
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k GraphicsPerfSvcGroup -s GraphicsPerfSvc1⤵
- Checks processor information in registry
- Modifies data under HKEY_USERS
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 484 -p 3824 -ip 38241⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 564 -p 3824 -ip 38241⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
desktop.ini
memory/3824-29-0x0000000001400000-0x0000000001401000-memory.dmp
memory/3824-25-0x0000000001400000-0x0000000001401000-memory.dmp
memory/3824-51-0x0000000001400000-0x0000000001401000-memory.dmp
memory/3824-49-0x0000000001400000-0x0000000001401000-memory.dmp
memory/3824-47-0x0000000001400000-0x0000000001401000-memory.dmp
memory/3824-45-0x0000000001400000-0x0000000001401000-memory.dmp
memory/3824-43-0x0000000001400000-0x0000000001401000-memory.dmp
memory/3824-41-0x0000000001400000-0x0000000001401000-memory.dmp
memory/3824-39-0x0000000001400000-0x0000000001401000-memory.dmp
memory/3824-37-0x0000000001400000-0x0000000001401000-memory.dmp
memory/3824-35-0x0000000001400000-0x0000000001401000-memory.dmp
memory/3824-33-0x0000000001400000-0x0000000001401000-memory.dmp
memory/3824-31-0x0000000001400000-0x0000000001401000-memory.dmp
memory/3824-0-0x0000000001400000-0x0000000001401000-memory.dmp
memory/3824-53-0x0000000001400000-0x0000000001401000-memory.dmp
memory/3824-11-0x0000000001400000-0x0000000001401000-memory.dmp
memory/3824-23-0x0000000001400000-0x0000000001401000-memory.dmp
memory/3824-1-0x0000000001400000-0x0000000001401000-memory.dmp
memory/3824-27-0x0000000001400000-0x0000000001401000-memory.dmp
memory/3824-17-0x0000000001400000-0x0000000001401000-memory.dmp
memory/3824-21-0x0000000001400000-0x0000000001401000-memory.dmp
memory/3824-19-0x0000000001400000-0x0000000001401000-memory.dmp
memory/3824-15-0x0000000001400000-0x0000000001401000-memory.dmp
memory/3824-13-0x0000000001400000-0x0000000001401000-memory.dmp
memory/3824-9-0x0000000001400000-0x0000000001401000-memory.dmp
memory/3824-7-0x0000000001400000-0x0000000001401000-memory.dmp
memory/3824-5-0x0000000001400000-0x0000000001401000-memory.dmp
memory/3824-3-0x0000000001400000-0x0000000001401000-memory.dmp
memory/3824-55-0x0000000001400000-0x0000000001401000-memory.dmp