5a555f48c357eeced711ef4728585d2c33e25c265167eca8d56398bc76bd01a5

Analysis

max time kernel
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
03/10/2026, 14:05

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Modrinth App_0.21.6_x64-setup.exe
Size 24.8MB
Sample261003-rdxcnadf25
SHA256 5a555f48c357eeced711ef4728585d2c33e25c265167eca8d56398bc76bd01a5
MD5 df07f1efa391003a06c639a37898a247
SHA1 2d228250715e9621317b8e9d3946390ee0f59530
SHA512 668810ca5b6f3e9999e4a8dbc4f87df72da03ec689be2df58dc5a1173813b61f0a47d2f0a1b77169e552ae324d7c8c754e90d56fd769df0cdaf4622226568043
SSDEEP 786432:KlZP+cr5D64OcBago1krorREWMeva4J0NyNP:Kl4cl240OrozvdqINP
TLSH
T1D547335B7A045127ED5E8231B0DFCF5B2F86BE144511E7AD7A87E6438E12B310ACC8E9
MD5 SHA1 SHA512 SSDEEP TLSH

Score

4^/10

discovery

Malware Config

Signatures

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Loads dropped DLL 3 IoCs

pid	Process
5428	Modrinth App_0.21.6_x64-setup.exe
5428	Modrinth App_0.21.6_x64-setup.exe
5428	Modrinth App_0.21.6_x64-setup.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Modrinth App_0.21.6_x64-setup.exe

Modifies registry class 22 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000_Classes\.mrpack	Modrinth App_0.21.6_x64-setup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000_Classes\.mrpack\mrpack_backup	Modrinth App_0.21.6_x64-setup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000_Classes\mrpack\ = "MRPACK File"	Modrinth App_0.21.6_x64-setup.exe
Key created	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000_Classes\mrpack\DefaultIcon	Modrinth App_0.21.6_x64-setup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000_Classes\mrpack\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\Modrinth App\\Modrinth App.exe,0"	Modrinth App_0.21.6_x64-setup.exe
Key created	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000_Classes\modrinth\shell\open\command	Modrinth App_0.21.6_x64-setup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000_Classes\.mrpack\ = "mrpack"	Modrinth App_0.21.6_x64-setup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000_Classes\mrpack\shell\ = "open"	Modrinth App_0.21.6_x64-setup.exe
Key created	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000_Classes\modrinth	Modrinth App_0.21.6_x64-setup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000_Classes\modrinth\DefaultIcon\ = "\"C:\\Users\\Admin\\AppData\\Local\\Modrinth App\\Modrinth App.exe\",0"	Modrinth App_0.21.6_x64-setup.exe
Key created	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000_Classes\modrinth\shell\open	Modrinth App_0.21.6_x64-setup.exe
Key created	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000_Classes\mrpack\shell	Modrinth App_0.21.6_x64-setup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000_Classes\mrpack\shell\open\ = "Open with Modrinth App"	Modrinth App_0.21.6_x64-setup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000_Classes\mrpack\shell\open\command\ = "C:\\Users\\Admin\\AppData\\Local\\Modrinth App\\Modrinth App.exe \"%1\""	Modrinth App_0.21.6_x64-setup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000_Classes\modrinth\URL Protocol	Modrinth App_0.21.6_x64-setup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000_Classes\modrinth\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Modrinth App\\Modrinth App.exe\" \"%1\""	Modrinth App_0.21.6_x64-setup.exe
Key created	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000_Classes\mrpack	Modrinth App_0.21.6_x64-setup.exe
Key created	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000_Classes\mrpack\shell\open	Modrinth App_0.21.6_x64-setup.exe
Key created	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000_Classes\mrpack\shell\open\command	Modrinth App_0.21.6_x64-setup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000_Classes\modrinth\ = "URL:ModrinthApp protocol"	Modrinth App_0.21.6_x64-setup.exe
Key created	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000_Classes\modrinth\DefaultIcon	Modrinth App_0.21.6_x64-setup.exe
Key created	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000_Classes\modrinth\shell	Modrinth App_0.21.6_x64-setup.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5428	Modrinth App_0.21.6_x64-setup.exe
5428	Modrinth App_0.21.6_x64-setup.exe

C:\Users\Admin\AppData\Local\Temp\Modrinth App_0.21.6_x64-setup.exe
"C:\Users\Admin\AppData\Local\Temp\Modrinth App_0.21.6_x64-setup.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:5428

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Modrinth App.exe

Path C:\Users\Admin\AppData\Local\Modrinth App\Modrinth App.exe
Size 44.4MB
SHA256 98ded0d979736a54d761782644c37b06a2ecb551398389fe4ed0004fd8bb40f8
MD5 67169d6308ca35da1bdcbddb1c97a042
SHA1 98ed41c37d950f1ff1f927ec5350cd46d53acfd6
SHA512 0af65f3417c8765209ea2f7fd3b32972bfe3244aacd11bf22e48e6ee555c11d29c61eb5073e843cd7fed0f4769c6f09a1349634614e3dc71a2f75f55f71babcd
SSDEEP 393216:LushFteZeAzHGBWgVEZNvQMgilmw35Qdv2xnVaREKLmJ/3Ow98C7SisOr20792Uz:LlF6DyUc9EFfOwIU/UU5xH
TLSH
T1A6A79E43F6A180E8D0AEC4B9835AE637EB767C89053472AF5BE40B212F19F506B0D75D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.dll

Path C:\Users\Admin\AppData\Local\Temp\nsxA1A7.tmp\System.dll
Size 12KB
SHA256 8dc562cda7217a3a52db898243de3e2ed68b80e62ddcb8619545ed0b4e7f65a8
MD5 cff85c549d536f651d4fb8387f1976f2
SHA1 d41ce3a5ff609df9cf5c7e207d3b59bf8a48530e
SHA512 531d6328daf3b86d85556016d299798fa06fefc81604185108a342d000e203094c8c12226a12bd6e1f89b0db501fb66f827b610d460b933bd4ab936ac2fd8a88
SSDEEP 192:Zjvco0qWTlt70m5Aj/lQ0sEWD/wtYbBHFNaDybC7y+XBz0QPi:FHQlt70mij/lQRv/9VMjzr
TLSH
T126426B129BB089F2F591583814667F2A6FBE9C5D27F50563CFE304D63D212CB983A283
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

modern-wizard.bmp

Path C:\Users\Admin\AppData\Local\Temp\nsxA1A7.tmp\modern-wizard.bmp
Size 25KB
SHA256 3ad2dc318056d0a2024af1804ea741146cfc18cc404649a44610cbf8b2056cf2
MD5 cbe40fd2b1ec96daedc65da172d90022
SHA1 366c216220aa4329dff6c485fd0e9b0f4f0a7944
SHA512 62990cb16e37b6b4eff6ab03571c3a82dcaa21a1d393c3cb01d81f62287777fb0b4b27f8852b5fa71bc975feab5baa486d33f2c58660210e115de7e2bd34ea63
SSDEEP 24:Qwika6aSaaDaVYoG6abuJsnZs5GhI11BayNXPcDrSsUWcSphsWwlEWqCl6aHAX2x:Qoi47a5G8SddzKFIcsOz3Xz
TLSH
T139C29757DE6B6EA4BE0804EF1A0694931C71FE211AB0CD0561D2B767B4FC93B19A0B3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nsDialogs.dll

Path C:\Users\Admin\AppData\Local\Temp\nsxA1A7.tmp\nsDialogs.dll
Size 9KB
SHA256 56b96add1978b1abba286f7f8982b0efbe007d4a48b3ded6a4d408e01d753fe2
MD5 6c3f8c94d0727894d706940a8a980543
SHA1 0d1bcad901be377f38d579aafc0c41c0ef8dcefd
SHA512 2094f0e4bb7c806a5ff27f83a1d572a5512d979eefda3345baff27d2c89e828f68466d08c3ca250da11b01fc0407a21743037c25e94fbe688566dd7deaebd355
SSDEEP 96:o0svUu3Uy+sytcS8176b+XR8pCHFcMcxSgB5PKtAtgt+Nt+rnt3DVEB3YcNqkzfS:o0svWyNO81b8pCHFcM0PuAgkOyuIFc
TLSH
T17012F992E6A450B3C5D6533B35AA2F2DCBBD5325B0926C00C7738E4D39395B66E38353
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nsis_tauri_utils.dll

Path C:\Users\Admin\AppData\Local\Temp\nsxA1A7.tmp\nsis_tauri_utils.dll
Size 30KB
SHA256 7317e5508923f425bced2698bb89f79b00fcddcd1028f44b598732b2e3711464
MD5 fc4691e51cdfac476b2fc63bbe951e82
SHA1 6532da4545864c6ec95f62f27f2199bfd668560b
SHA512 5b544832f1b1b8f2e1c6f8d61a839bea22c2c3d7e2a03671a12bab936e46a6f3fa3dd8aa53ec91157c1de08f0b349d6d2c1aec29385ad38cc0b2ab4c033c58ed
SSDEEP 768:IMSeZbzz284uMJSmuGrAFKpnp0jdhK7R+qV0Z:IjKfAuXiMtXIV
TLSH
T16FD23918FCC56FB6E2DF1575240C596E429FC8180B14CE9BD7A25E22E9E63722EE500F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download