Analysis
- user interaction
yes - max time kernel
5s - max time network
5s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
10/09/2026, 21:36
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
BeamNG.drive.exe
Resource
win10v2004-20260513-en
7 signatures
150 seconds
Behavioral task
behavioral2
Sample
BeamNG.drive.exe
Resource
win11ltsc2024-20260709-en
8 signatures
150 seconds
General
- Target BeamNG.drive.exe
- Size 890KB
- Sample260910-1f2jtsywev
- SHA256 e37be10e3bbf03fc97c7a0e510e169a30cf76fe99691122ebdd461aeaf3ef532
- MD5 f0c123a9e40d0f5f22e96d97092a1c38
- SHA1 fc64f61cf7275d8022fbdb7743e125f7bfa4d10a
- SHA512 1014d47a9af7e35db078409c7d9502d9b13d8320493b482b708459c37023e37f7ee410add6b603373b812efac8e9f7655b8bef22fbd73c9c1c381199e0bd64ec
- SSDEEP 24576:CPzH+0sTQ198IvnNTo/VcomJiXCkkKkk7nP:4+vIfdotcotP
- TLSH T13F153850B672B87EC1EDC131BDAA26256D2CDE0603C549C3D2D1EDF865132DAEF39298
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
6/10
Malware Config
Signatures
- Drops desktop.ini file(s) 1 IoCs
description ioc Process File opened for modification C:\Users\Admin\Videos\Captures\desktop.ini svchost.exe -
pid Process 3032 GameBarPresenceWriter.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BeamNG.drive.exe - Modifies registry class 9 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\beamng\shell\open\command BeamNG.drive.exe Key created \REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\beamng\shell BeamNG.drive.exe Key created \REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\beamng BeamNG.drive.exe Set value (str) \REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\beamng\ = "URL:beamng Protocol" BeamNG.drive.exe Set value (str) \REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\beamng\URL Protocol BeamNG.drive.exe Set value (str) \REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\beamng\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\BeamNG.drive.exe,0" BeamNG.drive.exe Key created \REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\beamng\shell\open BeamNG.drive.exe Set value (str) \REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\beamng\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\BeamNG.drive.exe\" \"%1\"" BeamNG.drive.exe Key created \REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\beamng\DefaultIcon BeamNG.drive.exe - Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 4564 BeamNG.drive.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2276 OpenWith.exe 4364 OpenWith.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\BeamNG.drive.exe"C:\Users\Admin\AppData\Local\Temp\BeamNG.drive.exe"1⤵
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of FindShellTrayWindow
PID:4564
-
C:\Windows\System32\GameBarPresenceWriter.exe"C:\Windows\System32\GameBarPresenceWriter.exe" -ServerName:Windows.Gaming.GameBar.Internal.PresenceWriterServer1⤵
- Network Service Discovery
PID:3032
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
- Suspicious use of SetWindowsHookEx
PID:2276
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k BcastDVRUserService -s BcastDVRUserService1⤵
- Drops desktop.ini file(s)
PID:1872
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
- Suspicious use of SetWindowsHookEx
PID:4364
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\Videos\Captures\desktop.ini
- Size 190B
- SHA256 86d9f822aeb989755fac82929e8db369b3f5f04117ef96fd76e3d5f920a501d2
- MD5 b0d27eaec71f1cd73b015f5ceeb15f9d
- SHA1 62264f8b5c2f5034a1e4143df6e8c787165fbc2f
- SHA512 7b5c9783a0a14b600b156825639d24cbbc000f5066c48ce9fecc195255603fc55129aaaca336d7ce6ad4e941d5492b756562f2c7a1d151fcfc2dabac76f3946c
- TLSH T11EC0121892F93224A1728D12BD7460119AB1F4217C16CA9D1380508F08A1601E631B53
- MD5 SHA1 SHA512 TLSH