5a3f96ebfcbb5a4e6dbf1611cc2ebc35fb2d3ee1ad0b60a8f9e6e63820043bd1

Analysis

max time kernel
30s
max time network
27s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-uk
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-uklocale:uk-uaos:windows11-ltsc_2024-x64systemwindows
submitted
07/11/2026, 12:31

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Roll & Glow/Roll & Grow_Data/Managed/UnityEngine.UnityWebRequestTextureModule.dll
Size 21KB
Sample261107-pp3mpsds2r
SHA256 5a3f96ebfcbb5a4e6dbf1611cc2ebc35fb2d3ee1ad0b60a8f9e6e63820043bd1
MD5 e4f740f0bb2d2e530b0d69f8d7dfb209
SHA1 c25c47da525df6190e296552886ecbb6b88d13f4
SHA512 fffb2a11b6e43727e2fb469a2e8ad360c0b4b5074db91c9cc145971d5e80e0d1deffcb997cdd6b78994a6633e18c8611969b642c68081ef6ba75a1ae59e1e80c
SSDEEP 384:hlhO5SQ71WhPMtOJhqQDGz2hjkecjOkoHCNyb8E9VF6IYiTPx3nk4g4x5C63:hlhO5d1WhktOJhqIvhjkehbiEpYiTPxD
TLSH
T1D3A2C6F27684281BDC064F73A0A893413EA0D157CEB1D3A6424E9264B67D3DE7F613E9
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Malware Config

Signatures

Modifies data under HKEY_USERS 9 IoCs

description	ioc	Process
Set value (data)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\IdentityCRL\Immersive\production\Property\0018801AA33BAA70 = 0100000001000000d08c9ddf0115d1118c7a00c04fc297eb01000000263bf26d51023645bc9d5eb8fa7fca1c0000000002000000000010660000000100002000000052cb7a3fd0c17af61a30278b699a0dd6072e2b97857df273b4ce4393f1728826000000000e80000000020000200000008f98874457d780cb0ddb4fcf735387cf37ec003fe64cf8cdcd662926ab44358e80000000774d0604c89b5cc99fc2aabde900485cd81bd549a9d2a5dda53ca821236a7cb27c93b4daa4c1318ac864aaea69bd64835659b1d7322906899aa687fb137ef4b231596994e67e5018df0b50efcb7359080709b041ba2cb2b2c79ad1222de779075ea5e5204c6b1bca95324bf5ed6e730f3226f6f5b44ba4d930038c6a8002277c40000000ced2a4500ab6f0c18900e3172e409d4c420247b966208ad86268f93252f1aef68c91e0a80abf1d1c77018ac371cbdd8b59d5a1c2e063b7c966db389678e5161e	svchost.exe
Set value (str)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\IdentityCRL\Immersive\production\Token\{F0C62012-2CEF-4831-B1F7-930682874C86}\DeviceId = "0018801AA33BAA70"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\IdentityCRL\Immersive\production\Token\{F0C62012-2CEF-4831-B1F7-930682874C86}\ApplicationFlags = "1"	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Classes\Local Settings\MuiCache	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\IdentityCRL\Immersive\production\Property	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\IdentityCRL\Immersive\production\Token\{F0C62012-2CEF-4831-B1F7-930682874C86}	svchost.exe
Set value (data)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\IdentityCRL\Immersive\production\Token\{F0C62012-2CEF-4831-B1F7-930682874C86}\DeviceTicket = 0100000001000000d08c9ddf0115d1118c7a00c04fc297eb01000000263bf26d51023645bc9d5eb8fa7fca1c000000000200000000001066000000010000200000000a49f5b88ee36651841fc0ddd6049bac6bfa3b838aba8d89a34878ad1cedc730000000000e800000000200002000000034765c260f405e144ddf4452943e34e6f0ae91e10a64cbca674b6196ba4c73c9700f0000a7d0703214845e8b6c0eb72e83ef1f4e92b5a0914498713d23923de070a2d785aea3888a7c68d3ce7ee501c8ee3c6f5ead38f719d5480abc4f13ecb19ab9bf9571ad45f7ec2fac7790f28a8fc1644e4d76316f13f7dee0040e937a8cd6a87f7d5254ff4f5d5febecc1f230bfaf2fdcd75f59665d75ea8f93cdf277c56d07f2d2fbfea5020c54835ebaa92ce9c7b9190da850fb08a53d74d5aba409e00d59bf58dfbd0305bd11da0387a14505a6f5dce686668c3ca2aff222a3cb442b33333516165f000af076e571a72648241e545e243ccdab48ab37bb7dd4cbfbfb08b45175b8c1d3137f011043b825e798ce8c16bb96b2432957e5f9679c0aa184230b0dd1a4f8885389a55ba5fb160a0e89e7f6332057b57fff4a671d400b0167c08d0206f0da9e6f7e92d90ef0e0c58e5626af959c52da394b94e7aa2ffd7f67a6703fcc1a5718ca4372be651dbc7b64a68ddc23177f5742c7364f0019d57f7a473e86ce3c6ae236735226c0278d45e83cc014d3762065397fa26a950ee88aa402fbcd3351326a4c2bff27cf97e8c284e600254e4f7b4bc33b781b2499d2d0f7a768ae60dac2a1ddbbd5f548ecc4934616e2cbc1061633b5a5f644971d5665bb3b2ae6bda530067d66cd87bf14545de75c80e8dcdadcfd9330e7189da0c44540b308d3db88b3cf579418c935f953403a692835729b60e0425006868928a3be42a0da18f85d87228b39b15120ae03de1761cdde118fbf87075db3f154e4f732b2929d41b785983f5ba31531df33722a845da315444c02fc93c8cce52b805014e13b662c24d1261be371664f7ccd614bc1c754faac9ce4a759615581cf76e21b0e7ab995ee581c5bfa22bbba7e897fd7101860c0b099df53f5a9f6fc1115fe39603c8c90e0aae7afef3025570e4e5f89b9676aac1cc8374e33500e3bdb9b681275bdc8d469d3f60bbb8e8edb301cc85928279e278c1f741bac50c43a9ec8b247f558da4c21e8403b6e3c13086128f95449f0e92ffc6aef55182332969a170f23cb1103542fc94a0bffb56ac46b75334d0612bb2891c04c7bca2b0d2cde72147a00e3473a05b1c7de2bfe296824fbefdf33eef6240a1dad649c8d63f91cd3d46b082e552c17da6918a789b89e5a41e443650859fd577681ccd8f55a07a39328a60e922732c715345ebb403e4bb258eab4fb721aa46d18c965ab18a8940ace612662f02a8733ecf3bd1158ebf980c98b7600e1a60d5e941b718a4d7df6cc184806b406cec113c6576a136163da75a0a8dd550e1293e6c3fe6936db637cd6b17848e99699d4eba57ff319ef5034ec5fa95a5cea63bd334fd08e9861c52a70a48e6c6e131b96c8a15acb8d8c6dc11cb14b52e9bb73420ad9765f3611366468164309cdd3f14729d56ee9aa6900ca7ce79cec937389d44de918ef39301488b4f77e0d8d7ab03108a27dd3934f1af1a8ecedb44d96e94651a0388fb041d7d9f8ffe9b7408eeb0f234d2502004cc9de9436a7a770890f4381b240c58d24d3518b86d0c83be00af0029ffa8873deaef0a0db045a9474cf43ee959e89e0edf7fc30df2d9ac423982ea46cb0bf148ed0a3ae43fccdab2e8a3246963a202513a825338a632982d55768d128463d79792a7b3596a43c48662baed47c45215c71dbb2d6978ea19d70f1e657ed3bcc00fa3a37c695021eabbd206b08800e640e9f13afc579c1b299e50b501d35475e91004bbf223e8740c367f0bce2771a8abacbe75e169e089829730c6e5c18ca3e276c0b73c6b37c0d460061f21f5371c3c105766b54826c2c355141fc9e5b440e32cc191b86e7130cb5ffc42d42ddd5e75ec9a2fe52672bd89efd089df09a05962d1a91e8c166bd58c78d4c0e83b810ae99789081ab3eeee44454f5594b98b88868aea34ec4f53e6086e2d1b846d968321b75a6cc6f1c67f3f94056d1932fbe5570b7c813d1b1a140b531d32063b8885fe063d130bce6b10168beca3cedfc7d1ecf298123ce51fec3fb9fb8a9d338473d7d6f41038778e9abba1a1b9c9868c31886fbe911c7909d8b18cb3c9c5bfb1d07b4cb6996ffdef87462078e9f2128cf4c6fcb991d4773022ae1529efd3dfb76ba78e70b059432ed2ca278e3d21d247802029e83e4cd768ad5557c13b64bd25bf0ec7724185c65347b556f28c36850679a53b722d8c6aae97d1a2c95f096f359e2c2139d60e4a5f80dc630529834801ea19f6067ff76c491a4eadd3864950b5b6d0fc72fcd2fb7ad484809ffdfa02ba5ff0c88bdb51d70d476cfbbb246430a2811ed1fac58caf290b018e06286e8e7b2fb2fb8ee8aaa0714dadd71c8e0d0727eb8b65ebd654a389940b69f413d058f7e591a8b7837a1c8e50b1315430a4af735301dbb9b9c28925c90752530e5756cc3e32f07481e27da9e08296240a4e32d4ef18e5140b0deebd96d8e7e6a2780a6387923049b9db7418c982a1415426b5c86ae584a6b5c92d15654bd7b1b91443bdb10d3e00959b1f19f347e882321801924487dd5ef25770ae311ef257c9f27004891fc5aae0b9513148b92e0535748e874e44ad79495b0a5fe8b82ba6f4a5c4c61fac0bee550accb422b4987571dcb59eabe6ef11a0e778b6830718c57c58d7d5f4ba938d42095316df3de2ee6552f7c280e50430d79d953b977d6563fcec1007f2d06ac53d48cc18f13b5ab245ffb78a65fc007f9dc88d4e9fd3a8b9bf00c830993163b02a2529600ea5316d49a75e9aaae9b2bb9c06d2aade426e9c94f44d6a1a76f6e6f7461d54713066234a652cf9bc84558ca13b4c2849159fd688b126ff131afcd0e01c96008c121f84eabc4d0968c99f867aff12994c7bf3d640de831f6c7917e58444a8984f481e496810275b5b9064ee3247faebf1469ecba758f3d73ba67338a65f5aa8ce6f08d8268d757c4704d9a976dfef4594026a9bb2ffeb2361242ac86530e2164df12a95bcab850a4b06afbc4584b73bad8438cb83cc4b862680051e976321a14e25f21671530bf38192fcde686ad3eb5cedd91a4656dd622f316430ab735c3e0d2c63babf57156e58fbf0df8f4e35b440b2d8ad4d300b19a72489d9374c7bd0b3f4e2bc77e32f604c0a96224a6cbee0ef3379deb96f22761d8efbbb9ee7d0360ce171c7cb947faac906271bcf109ce7a52186f31a842f46f3b714e2cc44c38e780b8a425d8ff32e241aa5b2d331d65dbb55fabacdf3c7a4b22f7d7851fd4ac53373e59c0b06daee70392b581206c93eb89fc6c4ea223845a4d8cf4488b0c2b18c770f57a655c95ad830abe80da95ac642e4aa56fa5e5535a485f97b7d766920cf10f7ccdcba67ff48329118cbf38697c13552d4b45b898587c3f19968695963c46479e71484878f188328961c0f3f5f8a837d4a822e5bb6c81ab7e232f06e13ec0c9ee25094004a3f25f3b705cf4ca7fd78fd181e45046604dc9dda9b2fbb93a4ef0679ec312242257bad8e6e6ca3e63b1c54a57f7cd88709038c0e2325e0e4ec6c63f77d10d7d01501a3509f0e9a4d2c4d8c2e8e3f4c30bb1dc8c24b6e7dad17c21ea39d9017df3f1dd689ad19b19521c14189a5bc0f75deeac149155e42922dcc1590985794cec9f501b9a6b8d48041f8e650250d08e7287c83b7ffc72ca37a4817bdf17142460b806e93405cde5904d118ce213d2b3ee787d3798c49ed8eaf2fa514c2ba7ef2b071cc9b688e292970fa1bd172abc613b4e5827840b231a62cb597aab54054cca7d3d081d4c2a4ad9fe54f055f715a05662c33608f558b7fc9af310e443d2bc391aa039d203d7257c6152049529a04640380e3dc4b040901606385a243c019627eb3bc44ca1d05e46b8fe5b1fdb35c3d4108ab69ab9128fb0e5f56364359e115789896fe1a10f570201662aa3bcecf6e43efd2e2cd43edcda274f897cded0afd4cbb3248c9aa9ab7cb1cedbda2def9b5cd0a885965919b5b2e9f27e5ce3b4eb3a736a82228ca3852b496ca06a3587388ed37609913e1b3b172482a0502287d362a6fb73981090d5b0199df9bdce023434cc7ccdd34983dc61114f8a49053532a5f68c7c3d240210bb142361d9f5ae151d7609065b8d87e87ead971247132e6e812a5ea0a0c0e1b70b193eb879e3910e3decb6bd8d8d9994a498e96e770143b2f46704e21745534577f501d524b4ff945373757d9e3e4cda42c3ac1084bf58ebf07ae6a94810c0604dcc23cf0a9faed1a66b8d0f5d1c7fe97217b0e71dd2ec57bc718738a438b9b945d61f97e2d26d9cf37e215d296a14e7bd77a39c9560ffe03c0c24f87723850fda798e17b3ee079ca3e248a64dcf8fa795d0a650dc5ea7c6c11935b6d88438a01d26cde1a25ac980cd0fe50d8974b53eac65104739736f61d655bd755bdf0293f82e7c7159779d2522354cdcf754fe8a81c8f0e0c09292340bbcc0f6b6f98438be725bf95acc4809763061b650f4b474b8cd2e6b7226e5408822618c7511551222e5df7cc2170ba875afb326e7d9fb1ef98887e3b0915c06347b9a0d7435e056bbf557faca7b24b9dffb7eb710a21fd72426d1bdcd21ff451e804779bccaa30aee8e5edb62f81f8b448cf19e806df5990b03b494e7becb6f4b7e1a95527d980ecff8b21a30687cd2451f37c0ad316fb453efe35202a3014eff3a73b37ee2e26cb7f3676e35a17ae754cedc677ba64cbccdea257f81bc9a7b67e930a13c95701e1c88fad9970b9a8e378db6ead5e409b322c05f82556de084a579d00f079f0a3749a00c73010cf1764dcec03fcb51376a4f4bd796aec46bbe90736c7d135168c12170613ceb9dbe29f366391885ec24c060ec4b2c5e7caa856adf8382f20660ccc6233b27c1e68b87f38d8729e4a0f383ff526e6d8ba97523e28291794e626657509dab8e7cc8730183c5a4fa558ba5c97f79d75383fe5b41c31cfab361e31f48d65a604ad3d2b014734470ccf084b333b9d4deeba9563825cac0307862e9866a1e000ed996a2311bee4a48e2106cabe615e4588aa189d812247464c11da345556f62a9f1bc2dc5c9a460da83374d3f3f343a51030a13625b81acaafe2d3614203699eb0b6232b322d792251661e742d6ff20dc0fc50bce6c851c1b316b32e25f8777d282d1dcd4d9816102f488f159b479faa50afb914345df9f12615ba0ff238eb971b151d3d3f5f64616afa8dbdd0c374d4ae0c87cdd1029b5f8223f18db03cd64905bc875a9eb6655068b2dd24f919587007a9184955bcc4aa6c74bee6da8858467f1aff80ffac2ad9bf9b6c672ae9145ccb15dbda7a5d421a0d449acf074ea10054162d07a9df8ffa09b67927b53566c668eb8e76c359075d7adcae0026ec8c6635d5b3dee63c584ed6acc683ceaf60fcb3629870febd4ac4e31851633c9fd7bc001db10ec8c8bd85f64ae1d374e7c5ba9891bdc48998b77305e11b28280fe6e71e38249f21525321905074fe8cb5969d43aab3de695b22c89aeda4c5259b2979b76136a4be956a00dcb2b5be0330c6d09c83a6f858499265a1dfb9121a8d13d50057990fa7c02249dcbff81354c431e4746633b408bc998271985b87465247d79ee834cd9e311b9c1ec86e936e73a633e265f809340000000efa2578fe6a7cff6b5ec722c530513c535d0bfe014da285326efc8c405ddc7ef24d2a4c19b0daaa3e651bd111aab9fe89c547f1976f4889c905876f67bc35d70	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Classes\Local Settings\MuiCache\27\52C64B7E	svchost.exe

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\Roll & Glow\Roll & Grow_Data\Managed\UnityEngine.UnityWebRequestTextureModule.dll",#1
1⤵
PID:5836

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager
1⤵
- Modifies data under HKEY_USERS
PID:5880

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads