487bd28f3d0b43ed9827ba519d6d113c4f31059bd62b4492da586c7bc82a9474

Analysis

max time kernel
150s
max time network
218s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
27/10/2026, 04:06

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
HH QUEST `҂Ɛ̑`ver1.10/Game.exe
Size 1.5MB
Sample261027-ephmesx19m
SHA256 487bd28f3d0b43ed9827ba519d6d113c4f31059bd62b4492da586c7bc82a9474
MD5 9ebc7dd20fa66f5deabfd8873a4ed8c6
SHA1 cf1b1da0e5215738a8e972077be5804cb326b8ed
SHA512 5d0a052edec070ee573bc43ed9eb7eb92c0460efe60a5abc31d1200e092937b91eafce5492cd945d46645f9029f0f80a37907fe6292639d37f15f58dae377271
SSDEEP 24576:5XVhPcthsRP/d3qI4N+Nl49LPSncvK51CvO8ofTWIZAmOLB:R5RP/d6IxNIKnL5mO8ofTrZAmm
TLSH
T12D759D01A4629075CB522271EC2CF73D6B206E1D4BF249F7FB946DE9AFB01E0353259A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	Game.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	Game.exe

System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Game.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Game.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Game.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Game.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Game.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Game.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-560646293-820748483-2532804640-1000\{A6745873-A294-4C84-80C8-174A37686A59}	Game.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
6028	Game.exe
6028	Game.exe
5636	Game.exe
5636	Game.exe
3956	Game.exe
3956	Game.exe
5636	Game.exe
5636	Game.exe
3428	Game.exe
3428	Game.exe
4144	Game.exe
4144	Game.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
5636	Game.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 5636 wrote to memory of 4492	5636	Game.exe	88
PID 5636 wrote to memory of 6028	5636	Game.exe	89
PID 5636 wrote to memory of 3956	5636	Game.exe	90
PID 5636 wrote to memory of 3428	5636	Game.exe	93
PID 5636 wrote to memory of 4144	5636	Game.exe	94

C:\Users\Admin\AppData\Local\Temp\HH QUEST `҂Ɛ̑`ver1.10\Game.exe
"C:\Users\Admin\AppData\Local\Temp\HH QUEST `҂Ɛ̑`ver1.10\Game.exe"
1⤵
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:5636
- C:\Users\Admin\AppData\Local\Temp\HH QUEST `҂Ɛ̑`ver1.10\Game.exe
  "C:\Users\Admin\AppData\Local\Temp\HH QUEST `҂Ɛ̑`ver1.10\Game.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\nwjs\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\nwjs\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\nwjs\User Data" --annotation=plat=Win32 --annotation=prod= --annotation=ver= --initial-client-data=0x300,0x304,0x308,0x2fc,0x30c,0x74add0e0,0x74add0f0,0x74add0fc
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4492
- C:\Users\Admin\AppData\Local\Temp\HH QUEST `҂Ɛ̑`ver1.10\Game.exe
  "C:\Users\Admin\AppData\Local\Temp\HH QUEST `҂Ɛ̑`ver1.10\Game.exe" --type=gpu-process --field-trial-handle=1692,10033283075938894262,5412486703865335297,131072 --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\HH QUEST `҂Ɛ̑`ver1.10" --gpu-preferences=KAAAAAAAAAAABwCAAQAAAAAAAAAAAGAAAQAAAAAAAAAIAAAAAAAAACgAAAAEAAAAIAAAAAAAAAAoAAAAAAAAADAAAAAAAAAAOAAAAAAAAAAQAAAAAAAAAAAAAAAKAAAAEAAAAAAAAAAAAAAACwAAABAAAAAAAAAAAQAAAAoAAAAQAAAAAAAAAAEAAAALAAAA --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor=Microsoft --gpu-driver-version=10.0.26100.1 --gpu-driver-date=6-21-2006 --user-data-dir="C:\Users\Admin\AppData\Local\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\HH QUEST `҂Ɛ̑`ver1.10" --service-request-channel-token=B619DFE8254F2583A52223AF1B6673B6 --mojo-platform-channel-handle=1708 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  PID:6028
- C:\Users\Admin\AppData\Local\Temp\HH QUEST `҂Ɛ̑`ver1.10\Game.exe
  "C:\Users\Admin\AppData\Local\Temp\HH QUEST `҂Ɛ̑`ver1.10\Game.exe" --type=renderer --js-flags=--expose-gc --no-sandbox --no-zygote --field-trial-handle=1692,10033283075938894262,5412486703865335297,131072 --service-pipe-token=F74B41E485107E3E228C8D7876C027A8 --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\HH QUEST `҂Ɛ̑`ver1.10" --nwjs --extension-process --disable-client-side-phishing-detection --enable-offline-auto-reload --enable-offline-auto-reload-visible-only --blink-settings=disallowFetchForDocWrittenScriptsInMainFrame=false,disallowFetchForDocWrittenScriptsInMainFrameOnSlowConnections=true,cssExternalScannerNoPreload=false,cssExternalScannerPreload=true --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-checker-imaging --enable-compositor-image-animations --service-request-channel-token=F74B41E485107E3E228C8D7876C027A8 --renderer-client-id=3 --mojo-platform-channel-handle=2588 /prefetch:1
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:3956
- C:\Users\Admin\AppData\Local\Temp\HH QUEST `҂Ɛ̑`ver1.10\Game.exe
  "C:\Users\Admin\AppData\Local\Temp\HH QUEST `҂Ɛ̑`ver1.10\Game.exe" --type=utility --field-trial-handle=1692,10033283075938894262,5412486703865335297,131072 --lang=en-US --no-sandbox --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\HH QUEST `҂Ɛ̑`ver1.10" --service-request-channel-token=19C6F1CDB523E0A9D486A8885ABD1180 --mojo-platform-channel-handle=3240 /prefetch:8
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:3428
- C:\Users\Admin\AppData\Local\Temp\HH QUEST `҂Ɛ̑`ver1.10\Game.exe
  "C:\Users\Admin\AppData\Local\Temp\HH QUEST `҂Ɛ̑`ver1.10\Game.exe" --type=utility --field-trial-handle=1692,10033283075938894262,5412486703865335297,131072 --lang=en-US --service-sandbox-type=utility --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\HH QUEST `҂Ɛ̑`ver1.10" --service-request-channel-token=D67026E2E8841D2752C9CCA4917AD7D7 --mojo-platform-channel-handle=4084 /prefetch:8
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:4144

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

0706cd6c-bba5-4044-95fb-9599a331c155.tmp

Path C:\Users\Admin\AppData\Local\User Data\0706cd6c-bba5-4044-95fb-9599a331c155.tmp
Size 1KB
SHA256 886359218b450071194f6d3eaaf8efdba5c3bfdac027150b1ab46528c78d7c3a
MD5 be4dcc00a909d958ce55bc9d52e65e27
SHA1 96cd126017d1b39af83fd269863b50e280333a39
SHA512 7d221b52469d8ae71a9b89a2775306b1ccd2c8ef6cf7099d711468742ba0dfb11f4dc26b786085ab69c452df5c51f0d50f6200e37e5fefc484f145fd8d845fa5
TLSH
T13631FF99699DC83BBDDBD505F8473B23876A10562B552F40C3F84F3D16A979C231B107
MD5 SHA1 SHA512 TLSH

Submit Download

676c4b0f-b714-4fa0-bdba-0acbde95df3c.tmp

Path C:\Users\Admin\AppData\Local\User Data\676c4b0f-b714-4fa0-bdba-0acbde95df3c.tmp
Size 1KB
SHA256 dcd9fe25b23123db1ed4114e2c31a63504f5030e05fc5f8c935e516b94036939
MD5 2201606e2b35ff5121b5ebca092554ff
SHA1 5e3440d28b22bf83b5171aca877209365c341553
SHA512 130c6a05d2a5d921547d9cd79a4a4f54482397522e538b847e251d31bbc8242b8c9492036ff0685d1cbc8acf6128adf5aef33d74891c31e1d2aa6d343935869e
TLSH
T13D31F05D695DC83BBED7D505F8472B238B7A105627155F40C2F84F3C06A979C2317107
MD5 SHA1 SHA512 TLSH

Submit Download

348d2432-5511-472c-bb90-e41319298788.tmp

Path C:\Users\Admin\AppData\Local\User Data\Default\348d2432-5511-472c-bb90-e41319298788.tmp
Size 1KB
SHA256 cac02e3aec0995ed1aa1cc29aa99a53e9f426cedd6c68777340b905e92ed8180
MD5 3ee4676bcac89adc4537b8c794916c48
SHA1 e42144831b79cc05b0094fb276351f4bfd73941a
SHA512 982ac481776715acfeb464e49d3a54dba084263f83f2cd973d533f09f5a341aa451927aab06508a6b3cfe096770e3c896300029e71a19e8ba0cf927783ca7f22
TLSH
T1EB3153168C24ED778CCDD71C7E2D7E93D1F514A25680594C96F84B6C0C6E6EE210B907
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\User Data\Default\Preferences
Size 1KB
SHA256 2b201bd676617728530d15ed0b7dd8154b9138f7ac799f0a327eecce06afd6cf
MD5 50b88632164be137eadc4dfa6c29a0ea
SHA1 b95a36dfb988944bcd447df8c930c78e8caf8197
SHA512 d019af6c7125649d2b770b17e502004dda0838c9306f42428fc274147bd5fd09c60f2ad02faea0879150ae7e7a437a2b18a2a12bfb8a049e20ac16714eac8f89
TLSH
T1863165168C24FD778CCED71C7D6D7E93D1F504929680494C96F84B6C0C6E6EE220B907
MD5 SHA1 SHA512 TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\User Data\Default\Sync Data\LevelDB\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\User Data\Default\Thumbnails\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

000002.dbtmp

Path C:\Users\Admin\AppData\Local\User Data\Default\data_reduction_proxy_leveldb\000002.dbtmp
Size 16B
SHA256 1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167
MD5 206702161f94c5cd39fadd03f4014d98
SHA1 bd8bfc144fb5326d21bd1531523d9fb50e1b600a
SHA512 0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\User Data\Local State
Size 1KB
SHA256 dcfaadaec9f3a19586c84a87339b10805007e821e081d54d017726e3b07bc0aa
MD5 b67f1a652a210eb83258dd6b3cfcd303
SHA1 929f201e2510a2d352eaab1cec7c168f50cdfdb1
SHA512 a4fc9d8b36872ecd91a8ff5d641735421a5bc8ecdc5c0835155f3129016c39733aac01b327cb2f60eae3019724590944e570a2f62faf377b5f2a6d3041835e11
TLSH
T14F31F05D699DC83BBEDBD505F8872B238B7A105627191F40C2F84F3C06A979C2317207
MD5 SHA1 SHA512 TLSH

Submit Download

e790c57b-7ba3-4529-977d-2d69a0a71c77.tmp

Path C:\Users\Admin\AppData\Local\User Data\e790c57b-7ba3-4529-977d-2d69a0a71c77.tmp
Size 3KB
SHA256 ae57f438b6097ffe142eee147f69eb5577d613d3b086b5c929b63cfea9e5e770
MD5 f653cb0f39b12e6cd4e01d332c80e853
SHA1 b4587e30f65cab805d99ddd671753583348b2099
SHA512 b51d3c30f57e2f96a2343120349dd8de58c6c1d9ebd323e8a8548d259bc8470cffeff0b9ca09c1ca69e9b1bafe4c6602dd93c5ed1feea42fca8d1b06b21961c8
TLSH
T15661745AA949D53F5EEBC205FA4F2B53BFFA00531289AF40D2EA0B3D066DB5C1316207
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\nwjs\User Data\Crashpad\settings.dat
Size 40B
SHA256 64a306cd15c59b52b3313c37492457d153d1bcbf33a4fc337d0904b7f691eb66
MD5 5ddce1bd5d936121a0f395c2e3a08a91
SHA1 84b92127c00c8522185278d2a3f99cd1e54c7776
SHA512 a52d4b5b828989e485112c081ac1ca1f0d898f2de036ba32fd552582c94c0081af2463073d32ee1b3287fc9ec30c1a5212e4a7e2e93d6a7f5147e4739fbd9387
MD5 SHA1 SHA512

Submit Download