c5605d9911aa7c3308efe16370be500922f04189efe6389e13702181a6c44689

Analysis

user interaction
yes
max time kernel
12s
max time network
15s
platform
windows10-ltsc_2021_x64
resource
win10ltsc2021-20260513-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20260513-enlocale:en-usos:windows10-ltsc_2021-x64systemwindows
submitted
31/08/2026, 02:14

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
MSI_5.9.300.6315_dluzgames.com.br (1).exe
Size 1.1MB
Sample260831-cn2msstdjh
SHA256 c5605d9911aa7c3308efe16370be500922f04189efe6389e13702181a6c44689
MD5 5570243405835e8f74dded31569a7662
SHA1 e8f45e855f9e6c3137f57e8fe1a0cc661eccb89a
SHA512 d79b447a4d0d6b17a93924cf90fe6a37cdd86e9cd0dc0b754904b79e364635712cb521364f2f798a5c71b1e06bbe3e3d6c0b5272447ecabd38344214254012c4
SSDEEP 24576:+ivtCX8jElikZ3NzhXV0Oy5zCsP2/KzmwpSeqZUjAiH8KT0fEy:rtCX8ol9XxV07zCumRKny
TLSH
T1A545F1440F46C4F4C09A21B15FD34270AB7D5AB2CFBFC0529AF12F1CC6366ED6A65A68
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

discovery

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2684263265-1628758615-802431902-1000\Control Panel\International\Geo\Nation	MSI_5.9.300.6315_dluzgames.com.br (1).exe

Executes dropped EXE 3 IoCs

pid	Process
4092	BlueStacksInstaller.exe
824	HD-CheckCpu.exe
2384	HD-CheckCpu.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MSI_5.9.300.6315_dluzgames.com.br (1).exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	HD-CheckCpu.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	HD-CheckCpu.exe

Suspicious behavior: EnumeratesProcesses 7 IoCs

pid	Process
4092	BlueStacksInstaller.exe
4092	BlueStacksInstaller.exe
4092	BlueStacksInstaller.exe
4092	BlueStacksInstaller.exe
4092	BlueStacksInstaller.exe
4092	BlueStacksInstaller.exe
4092	BlueStacksInstaller.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4092	BlueStacksInstaller.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 760 wrote to memory of 4092	760	MSI_5.9.300.6315_dluzgames.com.br (1).exe	85
PID 4092 wrote to memory of 824	4092	BlueStacksInstaller.exe	88
PID 4092 wrote to memory of 2384	4092	BlueStacksInstaller.exe	90

C:\Users\Admin\AppData\Local\Temp\MSI_5.9.300.6315_dluzgames.com.br (1).exe
"C:\Users\Admin\AppData\Local\Temp\MSI_5.9.300.6315_dluzgames.com.br (1).exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:760
- C:\Users\Admin\AppData\Local\Temp\7zS8F23C9C8\BlueStacksInstaller.exe
  "C:\Users\Admin\AppData\Local\Temp\7zS8F23C9C8\BlueStacksInstaller.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4092
- - C:\Users\Admin\AppData\Local\Temp\7zS8F23C9C8\HD-CheckCpu.exe
    "C:\Users\Admin\AppData\Local\Temp\7zS8F23C9C8\HD-CheckCpu.exe" --cmd checkHypervEnabled
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:824
- - C:\Users\Admin\AppData\Local\Temp\7zS8F23C9C8\HD-CheckCpu.exe
    "C:\Users\Admin\AppData\Local\Temp\7zS8F23C9C8\HD-CheckCpu.exe" --cmd checkSSE4
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:2384

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

backicon.png

Path C:\Users\Admin\AppData\Local\Temp\7zS8F23C9C8\Assets\backicon.png
Size 778B
SHA256 77533707194f691af85e6c990d852b949c09018378c8f9d87763b54b1c118f67
MD5 bb32b6c0cb2fd3b9329f0813e1b4239d
SHA1 241b75e5e21aa3e7a6aae5066de65d65db49651f
SHA512 e3aa89c3ba19f4d0a26fc6f3fd725c5201f3609b7e3f91bd8fa1fe95aa8cfdac5d684893ccac3e81b290ad241c048264d12bb1c6aa4b9646e604879b54bb9d33
TLSH
T118014163ED891988428A58B2FA4E056AE177C8925BFB503FEA49053CD016596839AA82
MD5 SHA1 SHA512 TLSH

Submit Download

checked_gray.png

Path C:\Users\Admin\AppData\Local\Temp\7zS8F23C9C8\Assets\checked_gray.png
Size 659B
SHA256 fc88b72393b58799ad747a988b76c1b9d8ce3dbaedfd0463e74d6a33be0878b6
MD5 f5273eda49f641257ccb5fc5235cee80
SHA1 ac2f52d7a0b34facc5cebf4745fb72e15c0e5c8d
SHA512 95457d926dbb7dbcd7c5b30fe6ec45634ab7c0f3dbd5820c8956d21d33a0f5feddc36e0d52d40abbb8b0ba07c005e4594dd56dab1cb278ee3104ec14d8ca921f
TLSH
T14A0183E2FBA43D0E30DD7435D18F0125ECB38008834D0613FF42C2203666A15AE33B46
MD5 SHA1 SHA512 TLSH

Submit Download

close_red.png

Path C:\Users\Admin\AppData\Local\Temp\7zS8F23C9C8\Assets\close_red.png
Size 1KB
SHA256 8cd75e91be69cf7cc6e6979c14b394a11fe683be7b62d5163da1073bb568b7d9
MD5 3759fdf92c29556e5740a6282507e1f9
SHA1 23960cb0edd610083edd8f817c03add5e883453d
SHA512 d0773ead77552514a2cd7fd7e55abe730579b4fab24981eb976ac43a821fc5a06ae02626e48dff83a58acb37db23d5527444faf5d4b7cb2fc78df33b065b80d3
TLSH
T15821E7DBCECCF1658D180C7B82E211C256AB8C2A0B034400E58D9C940FB8B2B97E4834
MD5 SHA1 SHA512 TLSH

Submit Download

custom.png

Path C:\Users\Admin\AppData\Local\Temp\7zS8F23C9C8\Assets\custom.png
Size 580B
SHA256 8eaab641d186f93f50d2d2bbae6ac5b3c937ca30665bf916321a35c83253eca3
MD5 07c7f00c7498d32e8045c1a0eda0727d
SHA1 bebf52df35cf5a95dd6ff5da778b83c5eafeb052
SHA512 142752b1ab40a23f654293a15e075321020322fc0f19efdab93e69716cc0ff5dc2148a83f7db149b7dcd8c30b7f542c0f89ac52bd50470e756b07b00ec78f5b9
TLSH
T101F04712EF1645B58D79965D80E370B1B4714001A2D02843131309C1757C2E72ACD3F6
MD5 SHA1 SHA512 TLSH

Submit Download

installer_bg.jpg

Path C:\Users\Admin\AppData\Local\Temp\7zS8F23C9C8\Assets\installer_bg.jpg
Size 353KB
SHA256 15bde105d61a562560d354614e0254dc4259000d8f610b32be8a965bf26829ca
MD5 49875ca1499a58b4ca9abda4d34adea5
SHA1 091155113dd5cf955211fd7a932ecba32f8bf136
SHA512 08cf0ce98b4c31f5879789f9458f14526fa3483096efd5feeca0f9b477456d80eb542a1e2f5823593e6d7d4d9d106bae0a7a7f096bacb638ee6fcfc67e13623a
SSDEEP 6144:OJPWdCG7sIfZ0esuoF2rWnLAfWfOBzXExDXO8W9l7Zj8AvcY9bYzJXnuIx2aWHN3:OKHAIulF2KnxfOEDI7ZBR18XuIKtvDZJ
TLSH
T18174234ECD0D81015A19B1E5E213C0F69D07DA8DC78C72F95153EA86CFA8599DCFA88E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

installer_logo.png

Path C:\Users\Admin\AppData\Local\Temp\7zS8F23C9C8\Assets\installer_logo.png
Size 19KB
SHA256 fe59d96de7342bcbfea62564e92d8e27530fc52c16399399be5f1d6c45340246
MD5 7ad11e07d8f30571debb2a69f77833c2
SHA1 6351d8968889c6a636abafa2a989b788fd477822
SHA512 7bc37d326a0d0fcf80231b2e69f3491f7ea8a714fa70b91d5606f9a03054b2c9113b4caf5bb5c980f53c5c73a769a11d1634660cd7c1e1e213124d6b55b2fbc6
SSDEEP 384:hcciBMKlK8KMi0hA7kj8ChkqMNN5WvpGjrsLQsopcY:yOKAYAsqqMNN5sGsVgcY
TLSH
T1A892D157A10331896D6BBFD5509FC2E487F09DBD86C46639A2EEA74363122702ADC336
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

installer_minimize.png

Path C:\Users\Admin\AppData\Local\Temp\7zS8F23C9C8\Assets\installer_minimize.png
Size 157B
SHA256 8e6e37b79756bfebb943d51d3571926fe4992748c4a673bbb6d78b22e87bc7f6
MD5 857bcef475b0d4c1d669bf47a143e85e
SHA1 072746be2f79c9571ec9b7e3b702a8cdef5a2b66
SHA512 b7e236edefe3f4aceefd912f2b6cfcecee034125ff082d3bac5fdf6db57c89dc2dfb4a96897529aed8834a423529680cc0ba1c94d497eb8d9c4f450ff70cf79c
TLSH
T143C02BD307666C38CE8D616380D20798FEF713CB251D214CA172A07D31467CCE0E5356
MD5 SHA1 SHA512 TLSH

Submit Download

loader.png

Path C:\Users\Admin\AppData\Local\Temp\7zS8F23C9C8\Assets\loader.png
Size 279B
SHA256 076263cc65f9824f4f82eb6beaa594d1df90218a2ee21664cf209181557e04b1
MD5 03903fd42ed2ee3cb014f0f3b410bcb4
SHA1 762a95240607fe8a304867a46bc2d677f494f5c2
SHA512 8b0e717268590e5287c07598a06d89220c5e9a33cd1c29c55f8720321f4b3efc869d20c61fcc892e13188d77f0fdc4c73a2ee6dece174bf876fcc3a6c5683857
TLSH
T17FD0EB93F339AC52F8018213C788083CD2FA26852E476E4C022A8CB60280D3E8AE018B
MD5 SHA1 SHA512 TLSH

Submit Download

setpath.png

Path C:\Users\Admin\AppData\Local\Temp\7zS8F23C9C8\Assets\setpath.png
Size 355B
SHA256 9ea14db4e8d39be52c9b55a39119d5f95dc331a0559d38de44fd8e72e8677718
MD5 f4c65de79fb292fd6104eb1a160ca09b
SHA1 52173df03e93433d88b50ebcd7d3bdbc32bd4165
SHA512 db4bca2ed5582efe9ca27ec67bff59ed2a66c471dc4e4247818e3b79838b57a00cd69d92b709c3a7e0628d7c9e9508335aff877279d30741de18226f0626dced
TLSH
T1F3E0C0CF8778ED6DA4CAA4B610A36820DD7EDCDB13A4518DFA05C134597695190D57C0
MD5 SHA1 SHA512 TLSH

Submit Download

unchecked_gray.png

Path C:\Users\Admin\AppData\Local\Temp\7zS8F23C9C8\Assets\unchecked_gray.png
Size 321B
SHA256 8355a9b447991ed53c3e1c768f397b622f9535faadb26913e4f2298cc3621c5c
MD5 8b3031b63549708b7ef422da8dfc42a5
SHA1 46407a76af6ac9887a15bd682533922c4b2d09da
SHA512 97b2fe161483b90abafc0bff3e4839f357aa3c0765b1d5d54e5210fcd9d543480eb4ff3671f2706def344ccc83548fe8d064b9ba1bb15abae9e718b87b91298d
TLSH
T186E0C6802A0CD0AACC8620B2F3B209A0F93B11A8843C940BE4A581BE17E302801AA794
MD5 SHA1 SHA512 TLSH

Submit Download

BlueStacksInstaller.exe

Path C:\Users\Admin\AppData\Local\Temp\7zS8F23C9C8\BlueStacksInstaller.exe
Size 576KB
SHA256 446345af3cc6537997659c227e52a990cf085d9805433ac80fb386057c17382d
MD5 25672929ecf0e64bcdbd89d6d5df7785
SHA1 b5310cecad2d88ec92df716ebe34251e720f6adc
SHA512 fb48c6769a9244b246dde0264039e5d68c4ab9b45fe40a7cfe337dbf6c4bdda02e4e75214b680da4f0bcbec6179ebc5b307ca289ce855c144f03c34a63633102
SSDEEP 6144:m1GiG9J7NEi/2DFBABYBmWgy2mJs3JH+ebPQSYS5pWfRJ:m1G0i/YFBA2gaJgJehXRJ
TLSH
T195C42A4407F8C458F1BF1BB46AF20531873AF8779EA7C22E01E2694D4AB27C49D6177A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BlueStacksInstaller.exe.config

Path C:\Users\Admin\AppData\Local\Temp\7zS8F23C9C8\BlueStacksInstaller.exe.config
Size 324B
SHA256 d6d316584b63bb0d670a42f88b8f84e0de0db4275f1a342084dc383ebeb278eb
MD5 1b456d88546e29f4f007cd0bf1025703
SHA1 e5c444fcfe5baf2ef71c1813afc3f2c1100cab86
SHA512 c545e416c841b8786e4589fc9ca2b732b16cdd759813ec03f558332f2436f165ec1ad2fbc65012b5709fa19ff1e8396639c17bfad150cabeb51328a39ea556e6
TLSH
T1C9E0C21941D8FD2B5D734B13A3128852EFB0A2A391A4544CF0EE7F830F3308A6697332
MD5 SHA1 SHA512 TLSH

Submit Download

HD-CheckCpu.exe

Path C:\Users\Admin\AppData\Local\Temp\7zS8F23C9C8\HD-CheckCpu.exe
Size 211KB
SHA256 e81e0444ba2deb4056872d1c4f9b01971bb4fb376c6434c942718da7c39190bf
MD5 764ac83167adcd8d2273f6bff7d769b2
SHA1 bf6a46b8c03d7efb16fdd6e4ce0a5e4362f41957
SHA512 a3a484aaf5cfdff1c198c37f3055409dc066646db3d61e74bfef2b4ce212d95fd43d3e3b239e080ba9fab62eae23cd4b54b6b466fad3192845b43d4212ccd667
SSDEEP 3072:qjDeWjpu716WoCYv8NBa3eSx8LHGYwj6V4NL1q7HOAg0FujFfnk60MfSLExfSeh:IpcoCYv8Xa3eSqL8j/3AOpvDNh
TLSH
T19F247D10B4818473D9B319314DFCDAB99A3DB8510B1459EB73D80B7E4F316E3BA31A6A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

JSON.dll

Path C:\Users\Admin\AppData\Local\Temp\7zS8F23C9C8\JSON.dll
Size 411KB
SHA256 d2c8d26f95f55431e632c8581154db7c19547b656380e051194a9d2583dd2156
MD5 f5fd966e29f5c359f78cb61a571d1be4
SHA1 a55e7ed593b4bc7a77586da0f1223cfd9d51a233
SHA512 d99e6fe250bb106257f86135938635f6e7ad689b2c11a96bb274f4c4c5e9a85cfacba40122dbc953f77b5d33d886c6af30bff821f10945e15b21a24b66f6c8be
SSDEEP 6144:GmyZXnmtWrnngnnnKnanlywwwBwwA5wwwwswww+wwwGwwwbwwwLwwwwwwwwwnwwd:GmIWtWrnngnnnKnanxNYhX
TLSH
T11F947250D8535838CA244778BA7396B02DF9EC718A07E6716B207EE7F13BA20ED75532
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i18n.en-US.txt

Path C:\Users\Admin\AppData\Local\Temp\7zS8F23C9C8\Locales\i18n.en-US.txt
Size 14KB
SHA256 00fdd7e83dd77a977506aef679eb73b7d127e05207e08af51b6a88b9b10d631a
MD5 d6ea93131e5a355199e1971251644960
SHA1 ba2fe9a990d79aed9218528449ee7edff2b76b06
SHA512 0b978b510f01c108de079b92354b0fc7e7e05d1fbdfd73f60dc0ab2228daee34df4486c344bd7f80a213bce489dfd466362ec7113d3d713f2fa3d6a94227d4ef
SSDEEP 384:aBvGq6rKPsL/ds89JplYTWfUvcABwGjV+qXOJtUmEIpNGU6+FKvtCFV30Y4TWEa3:aBvGqaKPsL/ds893l+WfacWwGjV+qXOX
TLSH
T145621DDBC777136DAAD1015A94E93542A507B35B32683A11BCADC0371B2790E133FADE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ThemeFile

Path C:\Users\Admin\AppData\Local\Temp\7zS8F23C9C8\ThemeFile
Size 78KB
SHA256 a30b83e8c303d0a7f6fd9301a95795325f4d6b519adcd73301ff1f3e03caec35
MD5 710068e25bcd44649dedcadce58654c8
SHA1 d6b0655b96c2e05614f6b7f70af9c60134989699
SHA512 f8a749d87cafbe043ed84f4227634da8411fe6bc024e0ee6b875a40bc679fa3a66c1e6bf97ab574c40014b2fdad2c76616e8307d485d10c7555c9d870d17f161
SSDEEP 1536:Vy0cVtQ4Bt5A+pDdOlCaVqlt1ck8nTLsP8fPmaE32fO5GBQ/MPVn8Oep3xu+Pchw:FcsZC
TLSH
T1E2737B9DEADD3C39323F52AEB6361063C847301B7942896ABA1F12115FBC89F3457B25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4092-133-0x000000001CF30000-0x000000001CF3E000-memory.dmp

Download

memory/4092-132-0x0000000020AE0000-0x0000000020B18000-memory.dmp

Download

memory/4092-131-0x000000001B980000-0x000000001B990000-memory.dmp

Download

memory/4092-126-0x000000001D1B0000-0x000000001D6D8000-memory.dmp

Download

memory/4092-125-0x000000001B980000-0x000000001B990000-memory.dmp

Download

memory/4092-121-0x000000001B980000-0x000000001B990000-memory.dmp

Download

memory/4092-120-0x000000001B910000-0x000000001B978000-memory.dmp

Download

memory/4092-146-0x0000000020F20000-0x0000000020F28000-memory.dmp

Download

memory/4092-118-0x00000000005A0000-0x0000000000634000-memory.dmp

Download

memory/4092-148-0x000000001B980000-0x000000001B990000-memory.dmp

Download