Analysis
- user interaction
yes - max time kernel
900s - max time network
616s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
24/08/2026, 01:28
General
- Target Sonic the Hedgehog 4 - Episode I/SonicLauncher.exe
- Size 1.3MB
- Sample260824-bvx3hsxtft
- SHA256 4983db08aa64463f3a89ff209c42fa023e0e2233ebc6b8d5765e3376a46b149b
Malware Config
Signatures
- Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
- Drops desktop.ini file(s) 1 IoCs
- Enumerates connected drives 3 TTPs 2 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
- System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Checks SCSI registry key(s) 3 TTPs 62 IoCs
SCSI information is often read in order to detect sandboxing environments.
- Checks processor information in registry 2 TTPs 12 IoCs
Processor information is often read in order to detect sandboxing environments.
- Modifies Internet Explorer settings 1 TTPs 1 IoCs
- Modifies data under HKEY_USERS 26 IoCs
- Modifies registry class 39 IoCs
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious use of AdjustPrivilegeToken 46 IoCs
- Suspicious use of FindShellTrayWindow 54 IoCs
- Suspicious use of SendNotifyMessage 43 IoCs
- Suspicious use of SetWindowsHookEx 11 IoCs
- Suspicious use of WriteProcessMemory 3 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
- Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
- Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\Sonic the Hedgehog 4 - Episode I\SonicLauncher.exe"C:\Users\Admin\AppData\Local\Temp\Sonic the Hedgehog 4 - Episode I\SonicLauncher.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Java\jre-1.8\bin\javaw.exe"C:\Program Files\Java\jre-1.8\bin\javaw.exe" -jar "C:\Users\Admin\AppData\Local\Temp\Sonic the Hedgehog 4 - Episode I\SonicLauncher.exe"2⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Sonic the Hedgehog 4 - Episode I\Sonic.exeSonic.exe3⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
-
-
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
- Suspicious use of SetWindowsHookEx
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k BcastDVRUserService -s BcastDVRUserService1⤵
- Drops desktop.ini file(s)
- Checks processor information in registry
- Modifies registry class
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k GraphicsPerfSvcGroup -s GraphicsPerfSvc1⤵
- Checks processor information in registry
- Modifies data under HKEY_USERS
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k GraphicsPerfSvcGroup -s GraphicsPerfSvc1⤵
- Checks processor information in registry
- Modifies data under HKEY_USERS
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k GPSvcGroup1⤵
-
C:\Windows\system32\sihost.exesihost.exe1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Windows\explorer.exeexplorer.exe /LOADSAVEDWINDOWS2⤵
- Boot or Logon Autostart Execution: Active Setup
- Enumerates connected drives
- Checks SCSI registry key(s)
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
-
-
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k GraphicsPerfSvcGroup -s GraphicsPerfSvc1⤵
- Checks processor information in registry
- Modifies data under HKEY_USERS
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k GraphicsPerfSvcGroup -s GraphicsPerfSvc1⤵
- Checks processor information in registry
- Modifies data under HKEY_USERS
-
C:\Windows\System32\SecurityHealthHost.exe\\?\C:\Windows\System32\SecurityHealthHost.exe {08728914-3F57-4D52-9E31-49DAECA5A80A} -Embedding1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k GraphicsPerfSvcGroup -s GraphicsPerfSvc1⤵
- Checks processor information in registry
- Modifies data under HKEY_USERS
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
main.conf
desktop.ini
memory/1236-747-0x0000019BDDBE0000-0x0000019BDDE9C000-memory.dmp
memory/1236-764-0x0000019BDDBE0000-0x0000019BDDE9C000-memory.dmp
memory/2812-108-0x000001FA89B00000-0x000001FA89B10000-memory.dmp
memory/2812-63-0x000001FA87DE0000-0x000001FA87DE1000-memory.dmp
memory/2812-21-0x000001FA899D0000-0x000001FA899E0000-memory.dmp
memory/2812-24-0x000001FA899E0000-0x000001FA899F0000-memory.dmp
memory/2812-25-0x000001FA87DE0000-0x000001FA87DE1000-memory.dmp
memory/2812-28-0x000001FA899F0000-0x000001FA89A00000-memory.dmp
memory/2812-30-0x000001FA89A00000-0x000001FA89A10000-memory.dmp
memory/2812-32-0x000001FA89A10000-0x000001FA89A20000-memory.dmp
memory/2812-36-0x000001FA89A30000-0x000001FA89A40000-memory.dmp
memory/2812-35-0x000001FA89A20000-0x000001FA89A30000-memory.dmp
memory/2812-39-0x000001FA89A40000-0x000001FA89A50000-memory.dmp
memory/2812-43-0x000001FA89A50000-0x000001FA89A60000-memory.dmp
memory/2812-42-0x000001FA89760000-0x000001FA899D0000-memory.dmp
memory/2812-44-0x000001FA89A60000-0x000001FA89A70000-memory.dmp
memory/2812-47-0x000001FA89A70000-0x000001FA89A80000-memory.dmp
memory/2812-46-0x000001FA899D0000-0x000001FA899E0000-memory.dmp
memory/2812-49-0x000001FA87DE0000-0x000001FA87DE1000-memory.dmp
memory/2812-51-0x000001FA89A80000-0x000001FA89A90000-memory.dmp
memory/2812-50-0x000001FA899E0000-0x000001FA899F0000-memory.dmp
memory/2812-54-0x000001FA899F0000-0x000001FA89A00000-memory.dmp
memory/2812-55-0x000001FA89A90000-0x000001FA89AA0000-memory.dmp
memory/2812-57-0x000001FA89A00000-0x000001FA89A10000-memory.dmp
memory/2812-58-0x000001FA89AA0000-0x000001FA89AB0000-memory.dmp
memory/2812-61-0x000001FA89A10000-0x000001FA89A20000-memory.dmp
memory/2812-62-0x000001FA89AB0000-0x000001FA89AC0000-memory.dmp
memory/2812-109-0x000001FA89BA0000-0x000001FA89BB0000-memory.dmp
memory/2812-65-0x000001FA89A20000-0x000001FA89A30000-memory.dmp
memory/2812-67-0x000001FA89AC0000-0x000001FA89AD0000-memory.dmp
memory/2812-66-0x000001FA89A30000-0x000001FA89A40000-memory.dmp
memory/2812-69-0x000001FA89AD0000-0x000001FA89AE0000-memory.dmp
memory/2812-71-0x000001FA89A40000-0x000001FA89A50000-memory.dmp
memory/2812-72-0x000001FA89AE0000-0x000001FA89AF0000-memory.dmp
memory/2812-75-0x000001FA89AF0000-0x000001FA89B00000-memory.dmp
memory/2812-74-0x000001FA89A50000-0x000001FA89A60000-memory.dmp
memory/2812-77-0x000001FA89A60000-0x000001FA89A70000-memory.dmp
memory/2812-78-0x000001FA89B00000-0x000001FA89B10000-memory.dmp
memory/2812-80-0x000001FA89A70000-0x000001FA89A80000-memory.dmp
memory/2812-81-0x000001FA89B10000-0x000001FA89B20000-memory.dmp
memory/2812-83-0x000001FA89A80000-0x000001FA89A90000-memory.dmp
memory/2812-84-0x000001FA89B20000-0x000001FA89B30000-memory.dmp
memory/2812-87-0x000001FA89B30000-0x000001FA89B40000-memory.dmp
memory/2812-86-0x000001FA89A90000-0x000001FA89AA0000-memory.dmp
memory/2812-90-0x000001FA89B40000-0x000001FA89B50000-memory.dmp
memory/2812-89-0x000001FA89AA0000-0x000001FA89AB0000-memory.dmp
memory/2812-93-0x000001FA89B50000-0x000001FA89B60000-memory.dmp
memory/2812-92-0x000001FA89AB0000-0x000001FA89AC0000-memory.dmp
memory/2812-96-0x000001FA89B60000-0x000001FA89B70000-memory.dmp
memory/2812-95-0x000001FA89AC0000-0x000001FA89AD0000-memory.dmp
memory/2812-3-0x000001FA89760000-0x000001FA899D0000-memory.dmp
memory/2812-99-0x000001FA89B70000-0x000001FA89B80000-memory.dmp
memory/2812-101-0x000001FA89AE0000-0x000001FA89AF0000-memory.dmp
memory/2812-102-0x000001FA89B80000-0x000001FA89B90000-memory.dmp
memory/2812-105-0x000001FA89B90000-0x000001FA89BA0000-memory.dmp
memory/2812-104-0x000001FA89AF0000-0x000001FA89B00000-memory.dmp
memory/2812-98-0x000001FA89AD0000-0x000001FA89AE0000-memory.dmp
memory/2812-17-0x000001FA87DE0000-0x000001FA87DE1000-memory.dmp
memory/2812-111-0x000001FA89B10000-0x000001FA89B20000-memory.dmp
memory/2812-112-0x000001FA89BB0000-0x000001FA89BC0000-memory.dmp
memory/2812-114-0x000001FA89B20000-0x000001FA89B30000-memory.dmp
memory/2812-115-0x000001FA89BC0000-0x000001FA89BD0000-memory.dmp
memory/2812-118-0x000001FA89BD0000-0x000001FA89BE0000-memory.dmp
memory/2812-117-0x000001FA89B30000-0x000001FA89B40000-memory.dmp
memory/2812-121-0x000001FA89B40000-0x000001FA89B50000-memory.dmp
memory/2812-122-0x000001FA89BE0000-0x000001FA89BF0000-memory.dmp
memory/2812-124-0x000001FA89B50000-0x000001FA89B60000-memory.dmp
memory/2812-125-0x000001FA89BF0000-0x000001FA89C00000-memory.dmp
memory/2812-127-0x000001FA89B60000-0x000001FA89B70000-memory.dmp
memory/2812-128-0x000001FA89C00000-0x000001FA89C10000-memory.dmp
memory/2812-131-0x000001FA89C10000-0x000001FA89C20000-memory.dmp
memory/2812-130-0x000001FA89B70000-0x000001FA89B80000-memory.dmp
memory/2812-134-0x000001FA89B80000-0x000001FA89B90000-memory.dmp
memory/2812-135-0x000001FA89C20000-0x000001FA89C30000-memory.dmp
memory/2812-138-0x000001FA89B90000-0x000001FA89BA0000-memory.dmp
memory/2812-139-0x000001FA89C30000-0x000001FA89C40000-memory.dmp
memory/2812-141-0x000001FA89BA0000-0x000001FA89BB0000-memory.dmp
memory/2812-142-0x000001FA89C40000-0x000001FA89C50000-memory.dmp
memory/2812-144-0x000001FA89BB0000-0x000001FA89BC0000-memory.dmp
memory/2812-145-0x000001FA89C50000-0x000001FA89C60000-memory.dmp
memory/2812-147-0x000001FA89BC0000-0x000001FA89BD0000-memory.dmp
memory/2812-148-0x000001FA89C60000-0x000001FA89C70000-memory.dmp
memory/2812-149-0x000001FA87DE0000-0x000001FA87DE1000-memory.dmp
memory/2812-151-0x000001FA89BD0000-0x000001FA89BE0000-memory.dmp
memory/2812-152-0x000001FA89C70000-0x000001FA89C80000-memory.dmp
memory/2812-156-0x000001FA89C80000-0x000001FA89C90000-memory.dmp
memory/2812-155-0x000001FA89BE0000-0x000001FA89BF0000-memory.dmp
memory/2812-159-0x000001FA89C90000-0x000001FA89CA0000-memory.dmp
memory/2812-158-0x000001FA89BF0000-0x000001FA89C00000-memory.dmp
memory/2812-161-0x000001FA89C00000-0x000001FA89C10000-memory.dmp
memory/2812-162-0x000001FA89CA0000-0x000001FA89CB0000-memory.dmp
memory/2812-164-0x000001FA89C10000-0x000001FA89C20000-memory.dmp
memory/2812-165-0x000001FA89CB0000-0x000001FA89CC0000-memory.dmp
memory/2812-169-0x000001FA89CC0000-0x000001FA89CD0000-memory.dmp
memory/2812-168-0x000001FA89C20000-0x000001FA89C30000-memory.dmp
memory/2812-173-0x000001FA89CD0000-0x000001FA89CE0000-memory.dmp
memory/2812-172-0x000001FA89C30000-0x000001FA89C40000-memory.dmp
memory/2812-176-0x000001FA89CE0000-0x000001FA89CF0000-memory.dmp
memory/2812-175-0x000001FA89C40000-0x000001FA89C50000-memory.dmp
memory/2812-179-0x000001FA89CF0000-0x000001FA89D00000-memory.dmp
memory/2812-178-0x000001FA89C50000-0x000001FA89C60000-memory.dmp
memory/2812-183-0x000001FA89D00000-0x000001FA89D10000-memory.dmp
memory/2812-182-0x000001FA89C60000-0x000001FA89C70000-memory.dmp
memory/2812-230-0x000001FA87DE0000-0x000001FA87DE1000-memory.dmp
memory/2812-390-0x000001FA87DE0000-0x000001FA87DE1000-memory.dmp
memory/2812-404-0x000001FA87DE0000-0x000001FA87DE1000-memory.dmp
memory/3204-412-0x0000000002510000-0x0000000002526000-memory.dmp
memory/3204-521-0x0000000056410000-0x0000000056433000-memory.dmp
memory/3928-608-0x0000028414380000-0x00000284143A0000-memory.dmp
memory/3928-594-0x0000028403E00000-0x0000028403E20000-memory.dmp
memory/3928-584-0x0000028414090000-0x0000028414190000-memory.dmp
memory/3928-562-0x00000284001E0000-0x00000284002E0000-memory.dmp
memory/3928-583-0x0000028403A90000-0x0000028403AB0000-memory.dmp
memory/4944-0-0x0000000000400000-0x0000000000438000-memory.dmp