Overview
overview
8Static
static
7Sonic the ...X9.dll
windows11-ltsc_2024-x64
3Sonic the ...41.dll
windows11-ltsc_2024-x64
3Sonic the ...er.exe
windows11-ltsc_2024-x64
8Sonic the ...1k.exe
windows11-ltsc_2024-x64
7Sonic the ...00.dll
windows11-ltsc_2024-x64
3Sonic the ...00.dll
windows11-ltsc_2024-x64
8Sonic the ...ic.exe
windows11-ltsc_2024-x64
6Sonic the ...pi.dll
windows11-ltsc_2024-x64
8Sonic the ..._3.dll
windows11-ltsc_2024-x64
8Analysis
- max time kernel
900s - max time network
462s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
24/08/2026, 01:28
Static task
static1
3 signatures
Behavioral task
behavioral1
Sample
Sonic the Hedgehog 4 - Episode I/D3DX9.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
3 signatures
900 seconds
Behavioral task
behavioral2
Sample
Sonic the Hedgehog 4 - Episode I/D3DX9_41.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
3 signatures
900 seconds
Behavioral task
behavioral3
Sample
Sonic the Hedgehog 4 - Episode I/SonicLauncher.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
19 signatures
900 seconds
Behavioral task
behavioral4
Sample
Sonic the Hedgehog 4 - Episode I/TDU1k.exe
Resource
win11ltsc2024-20260710-en
windows11-ltsc_2024-x64
4 signatures
900 seconds
Behavioral task
behavioral5
Sample
Sonic the Hedgehog 4 - Episode I/msvcp100.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
3 signatures
900 seconds
Behavioral task
behavioral6
Sample
Sonic the Hedgehog 4 - Episode I/msvcr100.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
16 signatures
900 seconds
Behavioral task
behavioral7
Sample
Sonic the Hedgehog 4 - Episode I/sonic.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
7 signatures
900 seconds
Behavioral task
behavioral8
Sample
Sonic the Hedgehog 4 - Episode I/storm_api.dll
Resource
win11ltsc2024-20260710-en
windows11-ltsc_2024-x64
15 signatures
900 seconds
Behavioral task
behavioral9
Sample
Sonic the Hedgehog 4 - Episode I/xinput1_3.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
15 signatures
900 seconds
General
- Target Sonic the Hedgehog 4 - Episode I/sonic.exe
- Size 1.9MB
- Sample260824-bvx3hsxtft
- SHA256 0fe56d2a5a44b52554268ed24083128ca180057a37fbfb37ea3df97abeb0e826
- MD5 6b69968e21ec53f751c418a55f1e56e2
- SHA1 f6d51248ef50bfef031f259fde1c7ab889a33c39
- SHA512 2630e1823779975f6dd81ddcf2e0bf89bc64b6dbde77b60deda055061a258b7b0aa13bef1fc0f31a969a1f087b6c06225cc315b370a670c658dc76683aea8468
- SSDEEP 24576:ijtHIuFHtokqyJtgKvRMyoV7luUQWfLilI1k15gIM/M5yRIEdU8TSN40:m7Dt/tNeZuUQWziIk7MM5w88TQ4
- TLSH T19B957D10B5408576E88D9179CAEDDFBD483D9E119B2D60C37BF83B9A6F30AE29435603
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
6/10
Malware Config
Signatures
- Drops desktop.ini file(s) 1 IoCs
description ioc Process File opened for modification C:\Users\Admin\Videos\Captures\desktop.ini svchost.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language sonic.exe - Checks processor information in registry 2 TTPs 14 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0 svchost.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz svchost.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz svchost.exe Key opened \Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0 svchost.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz svchost.exe Key opened \Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0 svchost.exe Key opened \Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0 svchost.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz svchost.exe Key opened \Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0 svchost.exe Key opened \Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0 svchost.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz svchost.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz svchost.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 svchost.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString svchost.exe - Modifies data under HKEY_USERS 51 IoCs
description ioc Process Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Direct3D\LastTelemetryChangeStamp = "11" svchost.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Direct3D\LastTelemetryChangeStamp = "16" svchost.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Direct3D\LastTelemetryChangeStamp = "19" svchost.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Direct3D\LastTelemetryChangeStamp = "27" svchost.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Direct3D\LastTelemetryChangeStamp = "28" svchost.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Direct3D\LastTelemetryChangeStamp = "32" svchost.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Direct3D\LastTelemetryChangeStamp = "5" svchost.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Direct3D\LastTelemetryChangeStamp = "7" svchost.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Direct3D svchost.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Direct3D\LastTelemetryChangeStamp = "33" svchost.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Direct3D\LastTelemetryChangeStamp = "41" svchost.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Direct3D\LastTelemetryChangeStamp = "44" svchost.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Direct3D\LastTelemetryChangeStamp = "18" svchost.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Direct3D svchost.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Direct3D\LastTelemetryChangeStamp = "36" svchost.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Direct3D\LastTelemetryChangeStamp = "39" svchost.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Direct3D svchost.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Direct3D\LastTelemetryChangeStamp = "42" svchost.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Direct3D\LastTelemetryChangeStamp = "45" svchost.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Direct3D svchost.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Direct3D\LastTelemetryChangeStamp = "14" svchost.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Direct3D\LastTelemetryChangeStamp = "26" svchost.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Direct3D\LastTelemetryChangeStamp = "34" svchost.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Direct3D\LastTelemetryChangeStamp = "23" svchost.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Direct3D svchost.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Direct3D\LastTelemetryChangeStamp = "1" svchost.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Direct3D\LastTelemetryChangeStamp = "2" svchost.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Direct3D svchost.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Direct3D\LastTelemetryChangeStamp = "35" svchost.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Direct3D\LastTelemetryChangeStamp = "37" svchost.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Direct3D\LastTelemetryChangeStamp = "3" svchost.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Direct3D\LastTelemetryChangeStamp = "15" svchost.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Direct3D\LastTelemetryChangeStamp = "22" svchost.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Direct3D\LastTelemetryChangeStamp = "25" svchost.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Direct3D\LastTelemetryChangeStamp = "31" svchost.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Direct3D\LastTelemetryChangeStamp = "38" svchost.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Direct3D\LastTelemetryChangeStamp = "43" svchost.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Direct3D\LastTelemetryChangeStamp = "17" svchost.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Direct3D\LastTelemetryChangeStamp = "29" svchost.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Direct3D\LastTelemetryChangeStamp = "30" svchost.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Direct3D\LastTelemetryChangeStamp = "40" svchost.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Direct3D\LastTelemetryChangeStamp = "24" svchost.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Direct3D\LastTelemetryChangeStamp = "6" svchost.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Direct3D\LastTelemetryChangeStamp = "8" svchost.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Direct3D\LastTelemetryChangeStamp = "9" svchost.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Direct3D\LastTelemetryChangeStamp = "10" svchost.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Direct3D\LastTelemetryChangeStamp = "12" svchost.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Direct3D\LastTelemetryChangeStamp = "13" svchost.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Direct3D\LastTelemetryChangeStamp = "20" svchost.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Direct3D\LastTelemetryChangeStamp = "21" svchost.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Direct3D\LastTelemetryChangeStamp = "4" svchost.exe - Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-189034102-168398478-1159367937-1000\{58070C56-B834-48A8-A53D-C6146A261F4A} svchost.exe - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2680 sonic.exe - Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 2680 sonic.exe 2680 sonic.exe 1120 OpenWith.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Sonic the Hedgehog 4 - Episode I\sonic.exe"C:\Users\Admin\AppData\Local\Temp\Sonic the Hedgehog 4 - Episode I\sonic.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2680
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
- Suspicious use of SetWindowsHookEx
PID:1120
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k BcastDVRUserService -s BcastDVRUserService1⤵
- Drops desktop.ini file(s)
- Checks processor information in registry
- Modifies registry class
PID:1424
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k GraphicsPerfSvcGroup -s GraphicsPerfSvc1⤵
- Checks processor information in registry
- Modifies data under HKEY_USERS
PID:4612
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k GraphicsPerfSvcGroup -s GraphicsPerfSvc1⤵
- Checks processor information in registry
- Modifies data under HKEY_USERS
PID:3720
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k GPSvcGroup1⤵PID:980
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k GraphicsPerfSvcGroup -s GraphicsPerfSvc1⤵
- Checks processor information in registry
- Modifies data under HKEY_USERS
PID:4772
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k GraphicsPerfSvcGroup -s GraphicsPerfSvc1⤵
- Checks processor information in registry
- Modifies data under HKEY_USERS
PID:2560
-
C:\Windows\System32\SecurityHealthHost.exe\\?\C:\Windows\System32\SecurityHealthHost.exe {08728914-3F57-4D52-9E31-49DAECA5A80A} -Embedding1⤵PID:5980
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k GraphicsPerfSvcGroup -s GraphicsPerfSvc1⤵
- Checks processor information in registry
- Modifies data under HKEY_USERS
PID:3212
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k GraphicsPerfSvcGroup -s GraphicsPerfSvc1⤵
- Checks processor information in registry
- Modifies data under HKEY_USERS
PID:1928
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\Videos\Captures\desktop.ini
- Size 190B
- SHA256 86d9f822aeb989755fac82929e8db369b3f5f04117ef96fd76e3d5f920a501d2
- MD5 b0d27eaec71f1cd73b015f5ceeb15f9d
- SHA1 62264f8b5c2f5034a1e4143df6e8c787165fbc2f
- SHA512 7b5c9783a0a14b600b156825639d24cbbc000f5066c48ce9fecc195255603fc55129aaaca336d7ce6ad4e941d5492b756562f2c7a1d151fcfc2dabac76f3946c
- TLSH T11EC0121892F93224A1728D12BD7460119AB1F4217C16CA9D1380508F08A1601E631B53
- MD5 SHA1 SHA512 TLSH