Analysis
- max time kernel
598s - max time network
490s - platform
windows10-2004_x64 - resource
win10v2004-20260911-en - resource tags
- submitted
30/09/2026, 07:50
General
- Target Forza Horizon 5 Opti 7z.exe
- Size 2.0MB
- Sample260930-jpl23azbqa
- SHA256 728e51da2097727fb9b04efae65b7c6349fb21ca3fd5c64d34306eb6400a1ffb
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Inno Setup is an open-source installation builder for Windows applications. 2 IoCs
Inno Setup installer
- Suspicious use of WriteProcessMemory 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Forza Horizon 5 Opti 7z.exe"C:\Users\Admin\AppData\Local\Temp\Forza Horizon 5 Opti 7z.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-VRZLYSERZQ.tmp\Forza Horizon 5 Opti 7z.tmp"C:\Users\Admin\AppData\Local\Temp\is-VRZLYSERZQ.tmp\Forza Horizon 5 Opti 7z.tmp" /SL5="$50112,890880,890880,C:\Users\Admin\AppData\Local\Temp\Forza Horizon 5 Opti 7z.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
Forza Horizon 5 Opti 7z.tmp
memory/1604-0-0x0000000000D30000-0x0000000000E19000-memory.dmp
memory/1604-6-0x0000000000D30000-0x0000000000E19000-memory.dmp
memory/1912-5-0x00000000012E0000-0x00000000012E1000-memory.dmp
memory/1912-8-0x00000000012E0000-0x00000000012E1000-memory.dmp
memory/1912-7-0x00000000009B0000-0x0000000000E02000-memory.dmp
memory/1912-10-0x00000000009B0000-0x0000000000E02000-memory.dmp
memory/1912-12-0x00000000009B0000-0x0000000000E02000-memory.dmp
memory/1912-14-0x00000000009B0000-0x0000000000E02000-memory.dmp
memory/1912-16-0x00000000009B0000-0x0000000000E02000-memory.dmp
memory/1912-18-0x00000000009B0000-0x0000000000E02000-memory.dmp
memory/1912-20-0x00000000009B0000-0x0000000000E02000-memory.dmp
memory/1912-22-0x00000000009B0000-0x0000000000E02000-memory.dmp
memory/1912-24-0x00000000009B0000-0x0000000000E02000-memory.dmp
memory/1912-26-0x00000000009B0000-0x0000000000E02000-memory.dmp
memory/1912-28-0x00000000009B0000-0x0000000000E02000-memory.dmp
memory/1912-30-0x00000000009B0000-0x0000000000E02000-memory.dmp
memory/1912-32-0x00000000009B0000-0x0000000000E02000-memory.dmp
memory/1912-34-0x00000000009B0000-0x0000000000E02000-memory.dmp
memory/1912-36-0x00000000009B0000-0x0000000000E02000-memory.dmp
memory/1912-38-0x00000000009B0000-0x0000000000E02000-memory.dmp
memory/1912-40-0x00000000009B0000-0x0000000000E02000-memory.dmp
memory/1912-42-0x00000000009B0000-0x0000000000E02000-memory.dmp
memory/1912-44-0x00000000009B0000-0x0000000000E02000-memory.dmp
memory/1912-46-0x00000000009B0000-0x0000000000E02000-memory.dmp
memory/1912-48-0x00000000009B0000-0x0000000000E02000-memory.dmp
memory/1912-50-0x00000000009B0000-0x0000000000E02000-memory.dmp
memory/1912-52-0x00000000009B0000-0x0000000000E02000-memory.dmp
memory/1912-54-0x00000000009B0000-0x0000000000E02000-memory.dmp
memory/1912-56-0x00000000009B0000-0x0000000000E02000-memory.dmp
memory/1912-58-0x00000000009B0000-0x0000000000E02000-memory.dmp
memory/1912-60-0x00000000009B0000-0x0000000000E02000-memory.dmp
memory/1912-62-0x00000000009B0000-0x0000000000E02000-memory.dmp
memory/1912-64-0x00000000009B0000-0x0000000000E02000-memory.dmp
memory/1912-66-0x00000000009B0000-0x0000000000E02000-memory.dmp
memory/1912-68-0x00000000009B0000-0x0000000000E02000-memory.dmp
memory/1912-70-0x00000000009B0000-0x0000000000E02000-memory.dmp
memory/1912-72-0x00000000009B0000-0x0000000000E02000-memory.dmp
memory/1912-74-0x00000000009B0000-0x0000000000E02000-memory.dmp
memory/1912-76-0x00000000009B0000-0x0000000000E02000-memory.dmp
memory/1912-78-0x00000000009B0000-0x0000000000E02000-memory.dmp
memory/1912-80-0x00000000009B0000-0x0000000000E02000-memory.dmp
memory/1912-82-0x00000000009B0000-0x0000000000E02000-memory.dmp
memory/1912-84-0x00000000009B0000-0x0000000000E02000-memory.dmp
memory/1912-86-0x00000000009B0000-0x0000000000E02000-memory.dmp
memory/1912-88-0x00000000009B0000-0x0000000000E02000-memory.dmp
memory/1912-90-0x00000000009B0000-0x0000000000E02000-memory.dmp
memory/1912-92-0x00000000009B0000-0x0000000000E02000-memory.dmp
memory/1912-94-0x00000000009B0000-0x0000000000E02000-memory.dmp
memory/1912-96-0x00000000009B0000-0x0000000000E02000-memory.dmp
memory/1912-98-0x00000000009B0000-0x0000000000E02000-memory.dmp
memory/1912-100-0x00000000009B0000-0x0000000000E02000-memory.dmp
memory/1912-102-0x00000000009B0000-0x0000000000E02000-memory.dmp
memory/1912-104-0x00000000009B0000-0x0000000000E02000-memory.dmp
memory/1912-106-0x00000000009B0000-0x0000000000E02000-memory.dmp
memory/1912-108-0x00000000009B0000-0x0000000000E02000-memory.dmp
memory/1912-110-0x00000000009B0000-0x0000000000E02000-memory.dmp
memory/1912-112-0x00000000009B0000-0x0000000000E02000-memory.dmp
memory/1912-114-0x00000000009B0000-0x0000000000E02000-memory.dmp
memory/1912-116-0x00000000009B0000-0x0000000000E02000-memory.dmp
memory/1912-118-0x00000000009B0000-0x0000000000E02000-memory.dmp
memory/1912-120-0x00000000009B0000-0x0000000000E02000-memory.dmp
memory/1912-122-0x00000000009B0000-0x0000000000E02000-memory.dmp
memory/1912-124-0x00000000009B0000-0x0000000000E02000-memory.dmp