d1d70c18ac09d8010c136403e2ca9d5ad489dd7d84f5671e863437045f63f0c1

Analysis

user interaction
yes
max time kernel
149s
max time network
164s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
29/09/2026, 16:26

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Scritchy.Scratchy.Build.23142522/ScritchyScratchy.exe
Size 656KB
Sample260929-txnwqsbb33
SHA256 d1d70c18ac09d8010c136403e2ca9d5ad489dd7d84f5671e863437045f63f0c1
MD5 fcde314997625da453aa2c851aa7ee80
SHA1 7c00d576dcaed56a9227af4a92e6ed50068ef508
SHA512 64b936dd22c78e1f4ecb26856a5102cd654f0b7027c10e9b9475c8525977e3b2b534fe6a9f94287263a3053c03f4255446ac941d3a01f179a6d7c938594a75b9
SSDEEP 12288:o2NCDdJr3d48xBMOfkubjGOWIkOJxIVcVNfbtsKbaLkfxHuXrSU:cj2OfV6OWInbfb/baLkNer
TLSH
T179E47B56E6C9339BD6665B35C59ED33A83E76C20F26979411291BC8F2E2A1830CF4C73
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	ScritchyScratchy.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	ScritchyScratchy.exe

Checks SCSI registry key(s) 3 TTPs 4 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	ScritchyScratchy.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	ScritchyScratchy.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	ScritchyScratchy.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	ScritchyScratchy.exe

Checks processor information in registry 2 TTPs 4 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ScritchyScratchy.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ScritchyScratchy.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ScritchyScratchy.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	ScritchyScratchy.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4220	ScritchyScratchy.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4220 wrote to memory of 5552	4220	ScritchyScratchy.exe	86

C:\Users\Admin\AppData\Local\Temp\Scritchy.Scratchy.Build.23142522\ScritchyScratchy.exe
"C:\Users\Admin\AppData\Local\Temp\Scritchy.Scratchy.Build.23142522\ScritchyScratchy.exe"
1⤵
- Reads the TCP/IP host and domain name from the registry
- Checks SCSI registry key(s)
- Checks processor information in registry
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4220
- C:\Users\Admin\AppData\Local\Temp\Scritchy.Scratchy.Build.23142522\UnityCrashHandler64.exe
  "C:\Users\Admin\AppData\Local\Temp\Scritchy.Scratchy.Build.23142522\UnityCrashHandler64.exe" --attach 4220 2634658942976
  2⤵
  PID:5552

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x478 0x430
1⤵
PID:5980

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Path C:\Users\Admin\AppData\LocalLow\Lunch Money Games\Scritchy Scratchy\Unity\e83fece5-4314-4a6b-9877-4f91c92cdfc9\Analytics\ArchivedEvents\179070102500002.a3fe7ed3\c
Size 1B
SHA256 d4735e3a265e16eee03f59718b9b5d03019c07d8b6c51f90da3a666eec13ab35
MD5 c81e728d9d4c2f636f067f89cc14862c
SHA1 da4b9237bacccdf19c0760cab7aec4a8359010b0
SHA512 40b244112641dd78dd4f93b6c9190dd46e0099194d5a44257b7efad6ef9ff4683da1eda0244448cb343aa688f5d3efd7314dafe580ac0bcbf115aeca9e8dc114
MD5 SHA1 SHA512

Submit Download

Path C:\Users\Admin\AppData\LocalLow\Lunch Money Games\Scritchy Scratchy\Unity\e83fece5-4314-4a6b-9877-4f91c92cdfc9\Analytics\ArchivedEvents\179070102500002.a3fe7ed3\s
Size 429B
SHA256 ff37de5fea6d09a768d34d810dcc2236459b0b3dc685d6d5a8818ffbcb2426c5
MD5 0fb497808f332e7f27f2ddf22f1617a0
SHA1 d0bfb43cb37b854b5c90d72724cf7da0a42bb4e9
SHA512 b5483291c25b2b259c9b9e9b17c11f34deab19021e48a0aae13af997db9b6fdcc3c4d8f4e412229f1cce6651c02abca3fb0a4179b14f733a3530b6d9d84e142b
TLSH
T147E0ABB1E36A4E34DFA912D7296406252F763271F315ACBD41F454CB0E6A4B27781432
MD5 SHA1 SHA512 TLSH

Submit Download

save.json

Path C:\Users\Admin\AppData\LocalLow\Lunch Money Games\Scritchy Scratchy\save.json
Size 9KB
SHA256 bbc1d3973ecae4111882dc02f56f75c641b03c72c5d1dbe8049954e4f92234d3
MD5 e1db7c4eb0ca01274b5cf0300e887e50
SHA1 435bcbb2d601b8d43c8cfa41694c2632d3bc8d8c
SHA512 f11598493634f6e137931a7961e616dcfdd4b45d67ea80cab416a0c479aa0bd7633f20e53d6fc3ee49cc4d73c61c88d31d718d5a0becea07dc8af8999875fb80
SSDEEP 96:VFfe6OeK80I2t7wJlpwnid13VYeWcU1EQg9KW1Hn6+qI0B25xq6535gjyGU24BVb:VFff1AUuAM+B2ub1WrRLj9EVxpr5sRo
TLSH
T18D228E3AE5600C7F647E62A1B9BD1323F2A143AF15126D1B7D7D228C4F731221990B9F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

save.json~RFe5b1b26.TMP

Path C:\Users\Admin\AppData\LocalLow\Lunch Money Games\Scritchy Scratchy\save.json~RFe5b1b26.TMP
Size 9KB
SHA256 1dd0f42c3a7370495f1142fd869f48f28e749091c636a0c8a560ba70569f6cd6
MD5 1715b788e801b6a6cd3bdf2bb7852a5f
SHA1 7a56663bddcbf350b66ea8a454c48d28e0ad3162
SHA512 39b401e12520ed67d9192bb3007d6a0fee1e5b54722d0360056d97e4e7e83580cc58fc4df70dcd6861e34b9b174c151ed1c305962493b4e40261708e8ec046a2
SSDEEP 96:Vffg6OeK80I2t7wJlpwnid13VYeWcU1EQg9KW1Hn6+qI0B25xq6535gjyGU24BVR:VffF1AUuAM+B2ub1WrRLj9EVxpr50po
TLSH
T151127E3AE5600C7F647E62A1B9BD1323F2A143AF15126D1B7D7D228C4F731221990F9E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

configs.user.ini

Path C:\Users\Admin\AppData\Roaming\GSE Saves\settings\configs.user.ini
Size 422B
SHA256 377c9177b5ff3253dd94e44e42fa7469bea56fef97a78834df1b56aa9937474c
MD5 e9730ba31fda2dfd227f9e6036fc789a
SHA1 245b6fa8d29ef799b46ba56e23bc5f45ac7b7263
SHA512 a236efdb3b1b97a9161772326733d15d60b12ec438cff3a3e75f1772cfb792e7d8b13a2604f1b12b8a44f02eb35290fc1252549e516574bb394364f5369ce2a1
TLSH
T1A1E0F11658071DB62F7217A174D57EEE4F0E92DC0D407D9D77C123165192CC29822B44
MD5 SHA1 SHA512 TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads