Overview
overview
6Static
static
3CheesyPizza.dll
windows10-2004-x64
1CheesyPizza.dll
windows11-ltsc_2024-x64
1PizzaTower.exe
windows10-2004-x64
1PizzaTower.exe
windows11-ltsc_2024-x64
6fmodL.dll
windows10-2004-x64
1fmodL.dll
windows11-ltsc_2024-x64
1fmodstudioL.dll
windows10-2004-x64
1fmodstudioL.dll
windows11-ltsc_2024-x64
1gameframe_x64.dll
windows10-2004-x64
1gameframe_x64.dll
windows11-ltsc_2024-x64
1mods/Examp...tep.js
windows10-2004-x64
3mods/Examp...tep.js
windows11-ltsc_2024-x64
3mods/Pizza...roy.js
windows10-2004-x64
3mods/Pizza...roy.js
windows11-ltsc_2024-x64
3Analysis
- user interaction
yes - max time kernel
111s - max time network
137s - platform
windows10-2004_x64 - resource
win10v2004-20260911-en - resource tags
arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
22/09/2026, 10:27
Static task
static1
Behavioral task
behavioral1
Sample
CheesyPizza.dll
Resource
win10v2004-20260911-en
Behavioral task
behavioral2
Sample
CheesyPizza.dll
Resource
win11ltsc2024-20260911-en
Behavioral task
behavioral3
Sample
PizzaTower.exe
Resource
win10v2004-20260911-en
Behavioral task
behavioral4
Sample
PizzaTower.exe
Resource
win11ltsc2024-20260911-en
Behavioral task
behavioral5
Sample
fmodL.dll
Resource
win10v2004-20260911-en
Behavioral task
behavioral6
Sample
fmodL.dll
Resource
win11ltsc2024-20260911-en
Behavioral task
behavioral7
Sample
fmodstudioL.dll
Resource
win10v2004-20260911-en
Behavioral task
behavioral8
Sample
fmodstudioL.dll
Resource
win11ltsc2024-20260911-en
Behavioral task
behavioral9
Sample
gameframe_x64.dll
Resource
win10v2004-20260911-en
Behavioral task
behavioral10
Sample
gameframe_x64.dll
Resource
win11ltsc2024-20260911-en
Behavioral task
behavioral11
Sample
mods/Example Mod/objects/obj_example_controller/step.js
Resource
win10v2004-20260911-en
Behavioral task
behavioral12
Sample
mods/Example Mod/objects/obj_example_controller/step.js
Resource
win11ltsc2024-20260911-en
Behavioral task
behavioral13
Sample
mods/Pizza Multi/hooks/instance/destroy.js
Resource
win10v2004-20260911-en
Behavioral task
behavioral14
Sample
mods/Pizza Multi/hooks/instance/destroy.js
Resource
win11ltsc2024-20260911-en
General
- Target PizzaTower.exe
- Size 7.4MB
- Sample260922-mhdnwstdpg
- SHA256 736a54519c4b7f5b08d5ca4faabfb16cf037b96660fcd71ebf91ead2078bf834
- MD5 aa1c027d92eeb209f9dd933e71348aa9
- SHA1 226a5ad4af6518531eee456565aa932b8e0af68d
- SHA512 723094efc22fc80dd548e110feb3d18788c8058c773bc6ef9b5f043e752e85cfcceb47895670a6ebfea1becdab7f0ab8b5f1de119b2c71c1c829553cd062647b
- SSDEEP 49152:1qm8yRo+qU1gBhLMML4d2zqzAVAQhNm26XN1Y8FbBXH6324vRt5lmCYk3MSOmUBJ:DML68Ad6324FlmlIMSybSQ9sNPMHfVAW
- TLSH T1F9765B45B660C1DDD067C039C15AA6FAE2B13C44DF9092DB66A03E6C3F73EE44DBA612
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Suspicious behavior: EnumeratesProcesses 16 IoCs
pid Process 4464 PizzaTower.exe 4464 PizzaTower.exe 4464 PizzaTower.exe 4464 PizzaTower.exe 4464 PizzaTower.exe 4464 PizzaTower.exe 4464 PizzaTower.exe 4464 PizzaTower.exe 4464 PizzaTower.exe 4464 PizzaTower.exe 4464 PizzaTower.exe 4464 PizzaTower.exe 4464 PizzaTower.exe 4464 PizzaTower.exe 4464 PizzaTower.exe 4464 PizzaTower.exe - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 4464 PizzaTower.exe - Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 4464 PizzaTower.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 4464 PizzaTower.exe 4464 PizzaTower.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\PizzaTower.exe"C:\Users\Admin\AppData\Local\Temp\PizzaTower.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:4464
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x3f4 0x4681⤵PID:4704
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Roaming\PizzaTower_CHEESEDUP\saveData.ini
- Size 33B
- SHA256 c3f2df800d96a25defb88047914fd111c8723387ab9881924a9bb9abd101a400
- MD5 e041c3311420219f7ad07be4cb11cf92
- SHA1 950d4351bedc44cd33a0d817088975caeb0a77b4
- SHA512 b4f6b17f36fd0b58ab9d60daa557e35e15d43422a616697f76476e12854dd708b672122ede3cb97fd252a83fd14e6554e67b576593dc3d39435ea0db614e7b70
- MD5 SHA1 SHA512