Resubmissions

25/08/2026, 18:20

260825-wyytfatycy7

25/08/2026, 18:01

260825-wlx2daxbqa8

Analysis

  • max time kernel
    603s
  • max time network
    525s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    25/08/2026, 18:01

General

  • Target
    Counter-Strike 1.6 2018 Clássico (v4.2)/Counter-Strike 1.6 2018 Clássico (v4.2).exe
  • Size 258.7MB
  • Sample260825-wlx2daxbqa
  • SHA256 28e0d1cf3644eac91f39d8c7bc244d50149e1c4053b78f02aeae8cab58471751
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10

Malware Config

Signatures

  • Loads dropped DLL 8 IoCs
  • Enumerates connected drives 3 TTPs 46 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Counter-Strike 1.6 2018 Clássico (v4.2)\Counter-Strike 1.6 2018 Clássico (v4.2).exe
    "C:\Users\Admin\AppData\Local\Temp\Counter-Strike 1.6 2018 Clássico (v4.2)\Counter-Strike 1.6 2018 Clássico (v4.2).exe"
    1⤵
    • Loads dropped DLL
    • Enumerates connected drives
    • System Location Discovery: System Language Discovery
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    PID:1592
  • C:\Windows\system32\msiexec.exe
    C:\Windows\system32\msiexec.exe /V
    1⤵
    • Enumerates connected drives
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:5824
    • C:\Windows\syswow64\MsiExec.exe
      C:\Windows\syswow64\MsiExec.exe -Embedding B9192DC0D7A88EDEC86477242F561873 C
      2⤵
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      PID:2596
  • C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k GPSvcGroup
    1⤵
      PID:4628

    Network

          MITRE ATT&CK Enterprise v16

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          banner.png

          • Path C:\Users\Admin\AppData\Local\Temp\AI_EXTUI_BIN_1592\banner.png
          • Size 20KB
          • SHA256 b06cbc75761b845a59f64ee0893e3c9f8e72da2ae20d7efd2c04991f5c23596a
          • MD5 SHA1 SHA512 SSDEEP TLSH

          MSI76BE.tmp

          • Path C:\Users\Admin\AppData\Local\Temp\MSI76BE.tmp
          • Size 209KB
          • SHA256 84fe1f4a7dc3c2a73ed202a9fcf4da9b463c5b692639cb93f919bda9f18a14e9
          • MD5 SHA1 SHA512 SSDEEP TLSH

          Counter-Strike 1.6 Classic 2018.msi

          • Path C:\Users\Admin\AppData\Roaming\Counter-Strike 1.6 Classic 2018\2.0\install\C72C85F\Counter-Strike 1.6 Classic 2018.msi
          • Size 2.3MB
          • SHA256 b0f10f4ed8d352ad58ccd387b814b326faff21940743fe419ba95c5ce8b21265
          • MD5 SHA1 SHA512 SSDEEP TLSH

          decoder.dll

          • Path C:\Users\Admin\AppData\Roaming\Counter-Strike 1.6 Classic 2018\2.0\install\decoder.dll
          • Size 145KB
          • SHA256 abdee86230f7d790976ac031522788e0a23cc5657d19e95d97096a398140ea93
          • MD5 SHA1 SHA512 SSDEEP TLSH