Analysis
- user interaction
yes - max time kernel
415s - max time network
456s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
27/08/2026, 00:15
General
- Target game-katana.zero-(30035).rar
- Size 175.9MB
- Sample260827-akb7mayamf
- SHA256 5c7e0c7772c063b7924a2b6e87e8b50fef530cc001622fdef4170b3f8c1e3611
Malware Config
Signatures
- Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
- Executes dropped EXE 7 IoCs
- Loads dropped DLL 9 IoCs
- Modifies file permissions 1 TTPs 1 IoCs
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 8 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Inno Setup is an open-source installation builder for Windows applications. 6 IoCs
Inno Setup installer
- Modifies registry class 8 IoCs
- Suspicious behavior: EnumeratesProcesses 6 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious use of AdjustPrivilegeToken 11 IoCs
- Suspicious use of FindShellTrayWindow 6 IoCs
- Suspicious use of SetWindowsHookEx 2 IoCs
- Suspicious use of WriteProcessMemory 9 IoCs
Processes
-
C:\Program Files\7-Zip\7zFM.exe"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\game-katana.zero-(30035).rar"1⤵
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\7zO82DC8FAA\setup_katana_zero_1.0.5_(30035).exe"C:\Users\Admin\AppData\Local\Temp\7zO82DC8FAA\setup_katana_zero_1.0.5_(30035).exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-AN9QQ.tmp\setup_katana_zero_1.0.5_(30035).tmp"C:\Users\Admin\AppData\Local\Temp\is-AN9QQ.tmp\setup_katana_zero_1.0.5_(30035).tmp" /SL5="$A025E,183845417,192512,C:\Users\Admin\AppData\Local\Temp\7zO82DC8FAA\setup_katana_zero_1.0.5_(30035).exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\GOG Games\Katana ZERO\__redist\MSVC2015\vcredist_x86.exe"C:\GOG Games\Katana ZERO\__redist\MSVC2015\vcredist_x86.exe" /install /quiet /norestart4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\GOG Games\Katana ZERO\__redist\MSVC2015\vcredist_x86.exe"C:\GOG Games\Katana ZERO\__redist\MSVC2015\vcredist_x86.exe" /install /quiet /norestart -burn.unelevated BurnPipe.{7703A860-C0BF-4216-A233-A42F5517F372} {D476F04A-AB6D-4FA4-8980-838CCD0342BB} 41245⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
-
-
-
C:\GOG Games\Katana ZERO\__redist\ISI\scriptInterpreter.exe"C:\GOG Games\Katana ZERO\__redist\ISI\scriptInterpreter.exe" /verysilent /supportDir="C:\GOG Games\Katana ZERO\__support" /SUPPRESSMSGBOXES /NORESTART /DIR="C:\GOG Games\Katana ZERO" /productId="1557080015" /buildId="52336036425347663" /versionName="1.0.5" /Language="English" /LANG="english"4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-0OTTF.tmp\scriptInterpreter.tmp"C:\Users\Admin\AppData\Local\Temp\is-0OTTF.tmp\scriptInterpreter.tmp" /SL5="$402EE,572759,192000,C:\GOG Games\Katana ZERO\__redist\ISI\scriptInterpreter.exe" /verysilent /supportDir="C:\GOG Games\Katana ZERO\__support" /SUPPRESSMSGBOXES /NORESTART /DIR="C:\GOG Games\Katana ZERO" /productId="1557080015" /buildId="52336036425347663" /versionName="1.0.5" /Language="English" /LANG="english"5⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\icacls.exe"C:\Windows\System32\icacls.exe" "C:\Users\Admin\AppData\Local\Katana_ZERO" /grant Everyone:(OI)(CI)F6⤵
- Modifies file permissions
- System Location Discovery: System Language Discovery
-
-
-
-
C:\GOG Games\Katana ZERO\Katana ZERO.exe"C:\GOG Games\Katana ZERO\Katana ZERO.exe"4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k GPSvcGroup1⤵
-
C:\Windows\system32\sihost.exesihost.exe1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Windows\explorer.exeexplorer.exe /LOADSAVEDWINDOWS2⤵
- Boot or Logon Autostart Execution: Active Setup
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
-
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
-
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca1⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
Katana ZERO.exe
scriptinterpreter.exe
vcredist_x86.exe
audiogroup1.dat
audiogroup2.dat
audiogroup3.dat
audiogroup4.dat
goggame-1557080015.info
goggame-1557080015.script
song_rainonbrick.ogg
splash.png
unins000.dat
unins000.msg
prep_Activatable Class_Hermes_perf.cache
prep_Activatable Class_Hermes_perf.cache
prep_Activatable Class_Hermes_perf.cache
prep_Activatable Class_Hermes_perf.cache
scriptInterpreter.tmp
setup_katana_zero_1.0.5_(30035).tmp
1207658714_english.jpg
1439474400_english.jpg
BigOK.png
EULAAccepted.png
EULAShow.png
GOG_new.png
background.jpg
botva2.dll
btn_md5.png
crcdll.dll
error.png
error_icon.png
innocallback.dll
ok.png
progress_center.png
progress_left.png
progress_right.png
slideshow.ini
track_center.png
track_left.png
track_right.png
uninstall.dll
uninstall.dll
logo.png
wixstdba.dll
Katana ZERO.lnk
memory/1036-536-0x00000000034E0000-0x000000000359B000-memory.dmp
memory/1036-573-0x00000000007C0000-0x0000000000912000-memory.dmp
memory/1332-678-0x000001CE14880000-0x000001CE148A0000-memory.dmp
memory/1332-633-0x000001CE001E0000-0x000001CE002E0000-memory.dmp
memory/1332-638-0x000001CE04130000-0x000001CE04230000-memory.dmp
memory/1332-637-0x000001CE01E00000-0x000001CE01E20000-memory.dmp
memory/1332-647-0x000001CE01DB0000-0x000001CE01DD0000-memory.dmp
memory/1852-581-0x0000000000420000-0x0000000000572000-memory.dmp
memory/1852-376-0x0000000000420000-0x0000000000572000-memory.dmp
memory/1852-582-0x0000000000400000-0x0000000000415000-memory.dmp
memory/1852-583-0x0000000006820000-0x00000000068D7000-memory.dmp
memory/1852-377-0x0000000000400000-0x0000000000415000-memory.dmp
memory/1852-69-0x0000000006BE0000-0x0000000006BEE000-memory.dmp
memory/1852-378-0x0000000006820000-0x00000000068D7000-memory.dmp
memory/1852-379-0x0000000006BE0000-0x0000000006BEE000-memory.dmp
memory/1852-15-0x0000000003060000-0x0000000003061000-memory.dmp
memory/1852-380-0x0000000003060000-0x0000000003061000-memory.dmp
memory/1852-24-0x0000000006820000-0x00000000068D7000-memory.dmp
memory/1852-604-0x0000000000420000-0x0000000000572000-memory.dmp
memory/1852-584-0x0000000006BE0000-0x0000000006BEE000-memory.dmp
memory/3676-605-0x00000000008A0000-0x00000000008D9000-memory.dmp
memory/3676-8-0x00000000008A0000-0x00000000008D9000-memory.dmp
memory/3676-375-0x00000000008A0000-0x00000000008D9000-memory.dmp
memory/3728-524-0x0000000000F00000-0x0000000000F39000-memory.dmp
memory/3728-574-0x0000000000F00000-0x0000000000F39000-memory.dmp
memory/5840-728-0x000000000E5F0000-0x000000000EE6B000-memory.dmp
memory/5840-621-0x000000000E5F0000-0x000000000EE6B000-memory.dmp