Overview
overview
8Static
static
3YourHappyP...lp.dll
windows10-2004-x64
1YourHappyP...64.dll
windows10-2004-x64
1YourHappyP...64.dll
windows11-ltsc_2024-x64
1YourHappyP...64.dll
windows10-2004-x64
1YourHappyP...64.dll
windows11-ltsc_2024-x64
1YourHappyP...64.dll
windows10-2004-x64
1YourHappyP...64.dll
windows11-ltsc_2024-x64
1YourHappyP...64.dll
windows10-2004-x64
1YourHappyP...64.dll
windows11-ltsc_2024-x64
1YourHappyP...me.dll
windows10-2004-x64
1YourHappyP...st.dll
windows10-2004-x64
1YourHappyP...st.dll
windows11-ltsc_2024-x64
8YourHappyP...64.exe
windows10-2004-x64
7YourHappyP...64.exe
windows11-ltsc_2024-x64
8YourHappyP...re.dll
windows10-2004-x64
1YourHappyP...re.dll
windows11-ltsc_2024-x64
1YourHappyP...rs.dll
windows10-2004-x64
1YourHappyP...rs.dll
windows11-ltsc_2024-x64
8YourHappyP...se.dll
windows10-2004-x64
1YourHappyP...se.dll
windows11-ltsc_2024-x64
8YourHappyP...al.exe
windows10-2004-x64
1YourHappyP...al.exe
windows11-ltsc_2024-x64
8YourHappyP...70.dll
windows10-2004-x64
1YourHappyP...70.dll
windows11-ltsc_2024-x64
1YourHappyP...70.dll
windows10-2004-x64
1YourHappyP...70.dll
windows11-ltsc_2024-x64
1YourHappyP...70.dll
windows10-2004-x64
1YourHappyP...70.dll
windows11-ltsc_2024-x64
6YourHappyP...70.dll
windows10-2004-x64
1YourHappyP...70.dll
windows11-ltsc_2024-x64
1YourHappyP...70.dll
windows10-2004-x64
1YourHappyP...70.dll
windows11-ltsc_2024-x64
1Analysis
- max time kernel
898s - max time network
486s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
25/08/2026, 02:34
Static task
static1
Behavioral task
behavioral1
Sample
YourHappyPlace/Windows/Engine/Binaries/ThirdParty/DbgHelp/dbghelp.dll
Resource
win10v2004-20260513-en
Behavioral task
behavioral2
Sample
YourHappyPlace/Windows/Engine/Binaries/ThirdParty/NVIDIA/NVaftermath/Win64/GFSDK_Aftermath_Lib.x64.dll
Resource
win10v2004-20260513-en
Behavioral task
behavioral3
Sample
YourHappyPlace/Windows/Engine/Binaries/ThirdParty/NVIDIA/NVaftermath/Win64/GFSDK_Aftermath_Lib.x64.dll
Resource
win11ltsc2024-20260709-en
Behavioral task
behavioral4
Sample
YourHappyPlace/Windows/Engine/Binaries/ThirdParty/Ogg/Win64/VS2015/libogg_64.dll
Resource
win10v2004-20260513-en
Behavioral task
behavioral5
Sample
YourHappyPlace/Windows/Engine/Binaries/ThirdParty/Ogg/Win64/VS2015/libogg_64.dll
Resource
win11ltsc2024-20260710-en
Behavioral task
behavioral6
Sample
YourHappyPlace/Windows/Engine/Binaries/ThirdParty/Vorbis/Win64/VS2015/libvorbis_64.dll
Resource
win10v2004-20260513-en
Behavioral task
behavioral7
Sample
YourHappyPlace/Windows/Engine/Binaries/ThirdParty/Vorbis/Win64/VS2015/libvorbis_64.dll
Resource
win11ltsc2024-20260709-en
Behavioral task
behavioral8
Sample
YourHappyPlace/Windows/Engine/Binaries/ThirdParty/Vorbis/Win64/VS2015/libvorbisfile_64.dll
Resource
win10v2004-20260513-en
Behavioral task
behavioral9
Sample
YourHappyPlace/Windows/Engine/Binaries/ThirdParty/Vorbis/Win64/VS2015/libvorbisfile_64.dll
Resource
win11ltsc2024-20260710-en
Behavioral task
behavioral10
Sample
YourHappyPlace/Windows/Engine/Binaries/ThirdParty/Windows/WinPixEventRuntime/x64/WinPixEventRuntime.dll
Resource
win10v2004-20260513-en
Behavioral task
behavioral11
Sample
YourHappyPlace/Windows/Engine/Binaries/ThirdParty/Windows/XAudio2_9/x64/xaudio2_9redist.dll
Resource
win10v2004-20260513-en
Behavioral task
behavioral12
Sample
YourHappyPlace/Windows/Engine/Binaries/ThirdParty/Windows/XAudio2_9/x64/xaudio2_9redist.dll
Resource
win11ltsc2024-20260709-en
Behavioral task
behavioral13
Sample
YourHappyPlace/Windows/Engine/Extras/Redist/en-us/UEPrereqSetup_x64.exe
Resource
win10v2004-20260513-en
Behavioral task
behavioral14
Sample
YourHappyPlace/Windows/Engine/Extras/Redist/en-us/UEPrereqSetup_x64.exe
Resource
win11ltsc2024-20260709-en
Behavioral task
behavioral15
Sample
YourHappyPlace/Windows/VHSLiminal/Binaries/Win64/D3D12/D3D12Core.dll
Resource
win10v2004-20260513-en
Behavioral task
behavioral16
Sample
YourHappyPlace/Windows/VHSLiminal/Binaries/Win64/D3D12/D3D12Core.dll
Resource
win11ltsc2024-20260709-en
Behavioral task
behavioral17
Sample
YourHappyPlace/Windows/VHSLiminal/Binaries/Win64/D3D12/d3d12SDKLayers.dll
Resource
win10v2004-20260513-en
Behavioral task
behavioral18
Sample
YourHappyPlace/Windows/VHSLiminal/Binaries/Win64/D3D12/d3d12SDKLayers.dll
Resource
win11ltsc2024-20260709-en
Behavioral task
behavioral19
Sample
YourHappyPlace/Windows/VHSLiminal/Binaries/Win64/OpenImageDenoise.dll
Resource
win10v2004-20260513-en
Behavioral task
behavioral20
Sample
YourHappyPlace/Windows/VHSLiminal/Binaries/Win64/OpenImageDenoise.dll
Resource
win11ltsc2024-20260709-en
Behavioral task
behavioral21
Sample
YourHappyPlace/Windows/VHSLiminal/Binaries/Win64/VHSLiminal.exe
Resource
win10v2004-20260513-en
Behavioral task
behavioral22
Sample
YourHappyPlace/Windows/VHSLiminal/Binaries/Win64/VHSLiminal.exe
Resource
win11ltsc2024-20260710-en
Behavioral task
behavioral23
Sample
YourHappyPlace/Windows/VHSLiminal/Binaries/Win64/boost_atomic-vc142-mt-x64-1_70.dll
Resource
win10v2004-20260513-en
Behavioral task
behavioral24
Sample
YourHappyPlace/Windows/VHSLiminal/Binaries/Win64/boost_atomic-vc142-mt-x64-1_70.dll
Resource
win11ltsc2024-20260709-en
Behavioral task
behavioral25
Sample
YourHappyPlace/Windows/VHSLiminal/Binaries/Win64/boost_chrono-vc142-mt-x64-1_70.dll
Resource
win10v2004-20260513-en
Behavioral task
behavioral26
Sample
YourHappyPlace/Windows/VHSLiminal/Binaries/Win64/boost_chrono-vc142-mt-x64-1_70.dll
Resource
win11ltsc2024-20260709-en
Behavioral task
behavioral27
Sample
YourHappyPlace/Windows/VHSLiminal/Binaries/Win64/boost_iostreams-vc142-mt-x64-1_70.dll
Resource
win10v2004-20260513-en
Behavioral task
behavioral28
Sample
YourHappyPlace/Windows/VHSLiminal/Binaries/Win64/boost_iostreams-vc142-mt-x64-1_70.dll
Resource
win11ltsc2024-20260709-en
Behavioral task
behavioral29
Sample
YourHappyPlace/Windows/VHSLiminal/Binaries/Win64/boost_program_options-vc142-mt-x64-1_70.dll
Resource
win10v2004-20260513-en
Behavioral task
behavioral30
Sample
YourHappyPlace/Windows/VHSLiminal/Binaries/Win64/boost_program_options-vc142-mt-x64-1_70.dll
Resource
win11ltsc2024-20260709-en
Behavioral task
behavioral31
Sample
YourHappyPlace/Windows/VHSLiminal/Binaries/Win64/boost_python39-vc142-mt-x64-1_70.dll
Resource
win10v2004-20260513-en
Behavioral task
behavioral32
Sample
YourHappyPlace/Windows/VHSLiminal/Binaries/Win64/boost_python39-vc142-mt-x64-1_70.dll
Resource
win11ltsc2024-20260709-en
General
- Target YourHappyPlace/Windows/Engine/Extras/Redist/en-us/UEPrereqSetup_x64.exe
- Size 48.0MB
- Sample260825-c2wnpsej2s
- SHA256 1a74ec10fb15d36472ad2267e297c84431ab376bda01b8326df77ba540b9cabc
- MD5 9a9c467ef1912bd48db78961c6c7d870
- SHA1 5a37b48f8639ef246ea3d81188935ecf253bfb91
- SHA512 d1cf31d35c3fbb5dc0a15938026cec459c44bfed192ab66dbfc4c45c9d8bd16f26c2a835aea70b030e2a5ea80b5c11b40dd5c35de71a7c49c740b0d8f0595641
- SSDEEP 786432:k/bdC1Q6cdW2xTDUANjtdoTtwe/UUjwirV6po5O5wnbKJO56XN4yfQSyABGOw:I5xTLNjtdoTtd/djwiB6po5UwnbSOMeh
- TLSH T152B73373B88CC62ECF931837E546B9081E2E3525625094B7E25CCDEB2E3716322F6756
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Loads dropped DLL 1 IoCs
pid Process 728 UEPrereqSetup_x64.exe - Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language UEPrereqSetup_x64.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language UEPrereqSetup_x64.exe - Suspicious use of WriteProcessMemory 1 IoCs
description pid Process procid_target PID 6012 wrote to memory of 728 6012 UEPrereqSetup_x64.exe 89
Processes
-
C:\Users\Admin\AppData\Local\Temp\YourHappyPlace\Windows\Engine\Extras\Redist\en-us\UEPrereqSetup_x64.exe"C:\Users\Admin\AppData\Local\Temp\YourHappyPlace\Windows\Engine\Extras\Redist\en-us\UEPrereqSetup_x64.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:6012 -
C:\Users\Admin\AppData\Local\Temp\YourHappyPlace\Windows\Engine\Extras\Redist\en-us\UEPrereqSetup_x64.exe"C:\Users\Admin\AppData\Local\Temp\YourHappyPlace\Windows\Engine\Extras\Redist\en-us\UEPrereqSetup_x64.exe" -burn.unelevated BurnPipe.{109B9497-9049-434B-AB9F-3DAB2CCD87AB} {B451656C-EFFD-4419-81FC-C24DC10DC9DF} 60122⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:728
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\{aad8a4b2-74da-409d-abb6-79a299008692}\.ba1\Banner.bmp
- Size 123KB
- SHA256 b76bbf9f7b8da4ca886f3b97d7db00ab1d38a9bb3b9567f4e1c3e30203098add
- MD5 87300b4c1b1d79f75e3c406043d73acb
- SHA1 de7ed5119f1caf8d11d30810c28031b37d1485aa
- SHA512 1d482404dcbcb3326e0efa4cdf46253be374f83d5c0f1051c15d4b1625b4e1e61adf017d037f8f4cc643e205be657cf5cc4edeb566f7eb44a89729ee050280da
- SSDEEP 192:VSNHyTXie12ZyYyblHBphfuMrHn5gu8JOeehv6q+nqmHGajWZoDeJX/2+Pw:0ZEXie7YMDnfuiHqu8ionqapWZoDeHo
- TLSH T173C35D24C9B6ABD0C52909A37CD77754105B9F9C5ADC6CE98D98BCE833BC100589B8BF
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\{aad8a4b2-74da-409d-abb6-79a299008692}\.ba1\LogoSide.png
- Size 6KB
- SHA256 988c657d1cc77aceb4804c5217bf756eaa2b4defcb4d03f47aea83ccda3d3672
- MD5 702684ff196740ebaedb34beca30346f
- SHA1 1f3af4bdac42b973b05dc121fc00c804aa3c28ec
- SHA512 ff4eec96f733ed32280123f5a6bff4a488eab4586a9740416125ceef1b4e1ce85dddb4524589111d1c6c57fb9d561a3586b637f8b17e8ff8dd2bf736b484b676
- SSDEEP 96:tShDBamM07aN2V97B5VAqGerxjV4IVfS8AeJn0TfIb8R21QPzKT0i2OKqslna1E4:tS9S25VuehV458d8R2KPzj9qOa2xsuK
- TLSH T13BD11A4064A88E3901800617F981E43B4D76D96BBFE7377EC7CA2B62FF278390906C55
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\{aad8a4b2-74da-409d-abb6-79a299008692}\.ba1\wixstdba.dll
- Size 135KB
- SHA256 97f1901e7c928b9231e503cd3a1315f0d8449356b9f25e7eb4c2cebeee72012a
- MD5 36b53c5299a3b39e5c9cdbbd28a09506
- SHA1 9f4c767ef7ea887a88a698bcd66e4ba691e1c17a
- SHA512 af4c7cea8bebe0f125b59eed11fa0053178dd546784f68ad7a642eb128ed0d05dd6ccfe685b912381b61becf9c336dcbbc8c4ce56884a511f3f0a69826d8de83
- SSDEEP 3072:TSr1RqAidK8hzwgkmo9VB/bgR7+iX8r2cf43:K1RqAiE+0mo60Ko2cu
- TLSH T1F7D35C1176E05072F7FB063869785365AB3FFE29E9B0DA8A6784194E28711C0DF71B23
- MD5 SHA1 SHA512 SSDEEP TLSH