Overview

overview

8

Static

static

1

Pizza.Towe...er.exe

windows10-1703-x64

1

Pizza.Towe...64.dll

windows10-1703-x64

3

Pizza.Towe...er.dll

windows10-1703-x64

3

Pizza.Towe...od.dll

windows10-1703-x64

1

Pizza.Towe...io.dll

windows10-1703-x64

3

Pizza.Towe...64.dll

windows10-1703-x64

1

Pizza.Towe...64.dll

windows10-1703-x64

1

Pizza.Towe...64.dll

windows10-1703-x64

1

Pizza.Towe...PC.url

windows10-1703-x64

1

Pizza.Towe...up.exe

windows10-1703-x64

7

Pizza.Towe...up.exe

windows10-1703-x64

7

Pizza.Towe...st.exe

windows10-1703-x64

6

Pizza.Towe...64.exe

windows10-1703-x64

7

Pizza.Towe...86.exe

windows10-1703-x64

7

Pizza.Towe...64.exe

windows10-1703-x64

7

Pizza.Towe...86.exe

windows10-1703-x64

7

Pizza.Towe...st.msi

windows10-1703-x64

8

Sharing

Copy URL
Twitter E-mail

General

  • Target

    Pizza.Tower.v1.0.zip

  • Size

    293.8MB

  • Sample

    230331-1allesde97

  • MD5

    8e9dc82a03f2d136f94ca42774270cb9

  • SHA1

    2867930f12ef98f9a1b29428575f3ffe0eb0fe23

  • SHA256

    71c4ec9675523146c3a2e03c81711fee316dd45b255c8e84b673c0430636641a

  • SHA512

    764a89554644cf5461fad4b2ece9201394fc53e811a2258ea9da95f6361015ecd29e0fd7c62b9e65d509afee8231969e3dd4cb8fd36c22196479523b9fda6113

  • SSDEEP

    6291456:KetvDe0CEdHDe0qrMj6i2W1u4ZHnXjRQVZD+v9PtND:HtvDe0hdHDe0D6zOHXjqPDA9PX

Score
8/10
discoverypersistence

Malware Config

Targets

    • Target

      Pizza.Tower.v1.0.311/Pizza.Tower.v1.0.311/PizzaTower.exe

    • Size

      6.7MB

    • MD5

      2f7b788caca5b7377fbd78ec311f4dfc

    • SHA1

      858d6eedfb5e0a94646c5fff7cc8e89d3df69d35

    • SHA256

      51fcebe74e2d27e5ae84492621eabcff3ba746b5a22807e0e61fdf892decdb5f

    • SHA512

      29c19f0a4a5f098112d7d7d1a8818a59915de8656665af88993f710fb1427893f3aafa33706b594c4c4f622b541a4b5e8c5b643557e953e1fe7ad905805ed50d

    • SSDEEP

      196608:E11sYP7pFubcekPZlyoFutmDGjNARKM1AmgDp37I0:GXDGd3H1N

    Score
    1/10
    behavioral1

    • Target

      Pizza.Tower.v1.0.311/Pizza.Tower.v1.0.311/Steamworks_x64.dll

    • Size

      484KB

    • MD5

      dddff8b3c67e40ba51ab322122f50f0a

    • SHA1

      85eed85a3b6c00dab448267b42b13060128584c1

    • SHA256

      03c6b308f2433a6f144e1731075481f50713b58dc3af1d5f90eb3c9ed037b404

    • SHA512

      4e6a51ffd2469dcefda5016719b622941982c71b9d92fd350ba99c2c711ef02b2792c2b97dbccba870df8440467b7eeca32630b43fba930ab1098fd36cd6678d

    • SSDEEP

      6144:PSb5wLBs8fsLD0Q3Wuoc7E9aXZOXUoWJ9XOkdm+VPZW/qohE0uyeQAZ0D7L:KyVsL3Pop9AZCUv9mJiom0u9q3

    Score
    3/10
    behavioral2

    • Target

      Pizza.Tower.v1.0.311/Pizza.Tower.v1.0.311/fmod-gamemaker.dll

    • Size

      35KB

    • MD5

      7d03df224eef39d3c507e33fe2165158

    • SHA1

      c8a1f626079a3a7e750d5205d1ed92f3f9d6c499

    • SHA256

      0cbb76f9bd8987c194b891c3c0b14c3ffb15ae0f676623a811090ca7619bd3b3

    • SHA512

      2dd05d7495456cda7bbea293032569ea6956b22f9e96e2a68de291bb3cc54e5240471d3994a04ff3481f4d76ded694803e55a870490a8aa8ba806a82d596ab54

    • SSDEEP

      384:HshbIB/FimHZgyn1bMVB39LkS7XuTE8L8RMO3VH6cbJ/NlGz8WDf9qGuokHmbPIz:4+S1/NlGz8W7bIOPOP4I7

    Score
    3/10
    behavioral3

    • Target

      Pizza.Tower.v1.0.311/Pizza.Tower.v1.0.311/fmod.dll

    • Size

      1.8MB

    • MD5

      bf5815e7bbcbe5d2d5cb84900527536f

    • SHA1

      b6f4c2e0d57a17c0096d287679f855e2a3f68f6a

    • SHA256

      e78d09eafe87c4699e23e7b1fa88d99e4d031538c452d8647e3961bc104dbe09

    • SHA512

      7933df1990b9cddd2f50737e8980c7fdbf572586cd74a76a9f9e2f2e35b26a3bae9e0f66d45d5d9fdd400de29274cf042ff98e84a3c6441b919281f6d7cfaed4

    • SSDEEP

      24576:JVcCsfgfaDCHWnfFbHZmIHqizddHiVAZZVbNhUTPiRIVPaoF4iVzwI6n:JVcCsYfd2dbAaBdr3WYQP1F46c

    Score
    1/10
    behavioral4

    • Target

      Pizza.Tower.v1.0.311/Pizza.Tower.v1.0.311/fmodstudio.dll

    • Size

      1.4MB

    • MD5

      3aa316d24bac9601e3136d73cee0193d

    • SHA1

      9448c6c683239b9b67a73831112a8a2d3e077541

    • SHA256

      489e8d08b760579a1974de3865a16c9c5e6dd989a09c831cf1c8c7db7c1ea50f

    • SHA512

      e2f2093665b40b2aa705e6e92cd93a823361928e8d527d40cb42f4d548b6dfba72d0aa05b4046225ec2a00fe84b25f0c5cf41af091a2355c41a119dc08c30d8c

    • SSDEEP

      24576:WDdspg+MtYUteTzXmYs8NGo4mmHq30JbV/ybI:2sp5MtYgeTzXm4/7+T/yM

    Score
    3/10
    behavioral5

    • Target

      Pizza.Tower.v1.0.311/Pizza.Tower.v1.0.311/gameframe_x64.dll

    • Size

      6KB

    • MD5

      d2503d70b9ada6302b9424caf6987522

    • SHA1

      ba327c52f3ab987b1218f8cda363c4003e6b4db6

    • SHA256

      bf6699ee52f7e52dc2444de4afece133a37127d194272e323509120497b7d974

    • SHA512

      fa40bc000aab587b0642863016eab43bd67331e9653fd4f5e4a8863ed284e362c01866b7deecf6ad7f05acdc6b741bab8ac9f83a0f4ddc6ad8ddcc5c19e18a04

    • SSDEEP

      96:GosrIC4lrlf+4JWuPUMLcIS9JF+Y+MIUnKnM:GL74FAeBjcbYo

    Score
    1/10
    behavioral6

    • Target

      Pizza.Tower.v1.0.311/Pizza.Tower.v1.0.311/steam_api64.dll

    • Size

      1.9MB

    • MD5

      37a7e0deae6e7bd1154f8fd059f9a241

    • SHA1

      5787b8db0d0d656d13474cd7d2caf66c443e181c

    • SHA256

      eb9b78ef3c339591c1993c9c364098de386edd391e1169ea0a6daa39ae9735a9

    • SHA512

      6d375c3abceb83a48b277ebafa7da24128fa97cdde7b3f3e89970671582ff3af8a413fead8d074127a97fc34cc423fd218f878ee3a218f6f28be3aededbf83f7

    • SSDEEP

      24576:0Nip4KmiEeJARIEOzje4nKGyAJ1VyKm9m0DKXC5CMcWXoyefCJXS0abv:EM/mIYI37p7VyKmTcMcWXAfCHab

    Score
    1/10
    behavioral7

    • Target

      Pizza.Tower.v1.0.311/Pizza.Tower.v1.0.311/steam_api64.dll.bak

    • Size

      288KB

    • MD5

      500475b20083ccdc64f12d238cab687a

    • SHA1

      b13f17561a9a0671befbebf0aae7b51bcc0072df

    • SHA256

      4df999c0c8cb12589f0864d52be5d4c775577aeb27fee28b49b188f9ba083eea

    • SHA512

      de926d38118c808cde4d3a8f6fde7b56b755ef7938b9adadf0efaac45c853f3d19f4cdd5906b02a7dcca7d2c38b8c01cbd401ce3a7f5e3f9221776f0ed49355b

    • SSDEEP

      3072:ujTqkh2mB9mkVi635gRaeaZqk4YJDf32uB+rJFC9R+5z65lhTbCz+hnv91vFAyNp:Gb9mZOB3Zx4YUuoaRRFAymC2CPzbN

    Score
    1/10
    behavioral8

    • Target

      Pizza.Tower.v1.0.311/STEAMUNLOCKED ยป Free Steam Games Pre-installed for PC.url

    • Size

      52B

    • MD5

      92672216743fd0ad8799d25ec99e5096

    • SHA1

      68103be0fa83db8a4a2efac6bb6169ce959a0290

    • SHA256

      677d2e85447eea64fa541b8e8a9e92b41e20456360bef8642f898e7eb1b2f0db

    • SHA512

      1ca286141902e64c4cac05fabc1ce0ef4d910582e720c8b38f3cf2799cadaab7cbc9d8fc925eff17e0d3280d5d074ebd856dc75d6cadbd95872cae14eddb7719

    Score
    1/10
    behavioral9

    • Target

      Pizza.Tower.v1.0.311/_Redist/dotNetFx40_Full_setup.exe

    • Size

      868KB

    • MD5

      53406e9988306cbd4537677c5336aba4

    • SHA1

      06becadb92a5fcca2529c0b93687c2a0c6d0d610

    • SHA256

      fa1afff978325f8818ce3a559d67a58297d9154674de7fd8eb03656d93104425

    • SHA512

      4f89da81b5a3800aa16ff33cc4a42dbb17d4c698a5e2983b88c32738decb57e3088a1da444ad0ec0d745c3c6b6b8b9b86d3f19909142f9e51f513748c0274a99

    • SSDEEP

      24576:+tW4x8xAxCdUcyezFSjaBHFaNlsqK5/oh6iZf1LUXw/vxNI:d4x8xqCGexm8FCspg0iZf1LUXD

    Score
    7/10

    • Executes dropped EXE

    • Loads dropped DLL

    behavioral10

    • Target

      Pizza.Tower.v1.0.311/_Redist/dxwebsetup.exe

    • Size

      281KB

    • MD5

      fd6057b33e15a553ddc5d9873723ce8f

    • SHA1

      f90efb623b5abea70af63c470daa8674444fb1df

    • SHA256

      111aeddc6a6dbf64b28cb565aa12af9ee3cc0a56ce31e4da0068cf6b474c3288

    • SHA512

      d894630c9a4bdb767e9f16d1b701acbdf011e721768ba0dc7a24e6d82a4d062a7ca253b1b334edba38c06187104351203a92c017838bdd9f13905cde30f7d94d

    • SSDEEP

      6144:pWK8EGMUjp5cGQ3Mek1B3B9h8Ins3i8AEYBSawz1YSc:JGvjp5cj35kDB9hrs3zARBSaJSc

    Score
    7/10
    persistence

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Drops file in System32 directory

    behavioral11

    • Target

      Pizza.Tower.v1.0.311/_Redist/oalinst.exe

    • Size

      790KB

    • MD5

      694f54bd227916b89fc3eb1db53f0685

    • SHA1

      21fdc367291bbef14dac27925cae698d3928eead

    • SHA256

      b8f39714d41e009f75efb183c37100f2cbabb71784bbd243be881ac5b42d86fd

    • SHA512

      55bc0de75a7f27f11eb8f4ee8c9934dfe1acd044d8b7b2151c506bdcbead3ab179df7023f699c9139c77541bbc4b1c0657e93c34a6bc4309b665c6cb7636a7e5

    • SSDEEP

      12288:0s1yfEcpPzdv+t4cRIy3ze3SUN0PXGTjiqRy2p3kwzjGHTkV:NwfLrvi4cRIyDe3SUNaXy+WypoGHgV

    Score
    6/10
    discovery

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery

    • Drops file in System32 directory

    behavioral12

    • Target

      Pizza.Tower.v1.0.311/_Redist/vcredist_2015-2019_x64.exe

    • Size

      14.3MB

    • MD5

      f0248d477e74687c5619ae16498b13d4

    • SHA1

      9ed4b091148c9b53f66b3f2c69be7e60e74c486a

    • SHA256

      b6c82087a2c443db859fdbeaae7f46244d06c3f2a7f71c35e50358066253de52

    • SHA512

      0c373b06ffe84f3e803831e90f22d7d73304e47a47839db614f63399ff1b7fcf33153bf3d23998877c96d2a75e316291a219fdd12358ca48928526284b802591

    • SSDEEP

      393216:q5lptVYmfr7yBG/4WoI+j6LTinXKSf0fzTDv8:q7pttD7yBG/uljIinXj0fQ

    Score
    7/10
    discovery

    • Executes dropped EXE

    • Loads dropped DLL

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery
    behavioral13

    • Target

      Pizza.Tower.v1.0.311/_Redist/vcredist_2015-2019_x86.exe

    • Size

      13.7MB

    • MD5

      de34b1c517e0463602624bbc8294c08d

    • SHA1

      5ce7923ffea712468c05e7ac376dd9c29ea9f6be

    • SHA256

      ac96016f1511ae3eb5ec9de04551146fe351b7f97858dcd67163912e2302f5d6

    • SHA512

      114bca1ecd17e419ad617a1a4341e607250bcb02626cdc0670eb60be734bbad1f3c84e38f077af9a32a6b1607b8ce6e4b3641c0faefaa779c0fec0d3ac022dac

    • SSDEEP

      393216:/d/FlptVYmfr7yBG/4JU4TRjtjUMy4i6kgsY7i:/1PpttD7yBG/QHTJtYMyke9

    Score
    7/10
    discovery

    • Executes dropped EXE

    • Loads dropped DLL

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery
    behavioral14

    • Target

      Pizza.Tower.v1.0.311/_Redist/vcredist_x64.exe

    • Size

      5.5MB

    • MD5

      630d75210b325a280c3352f879297ed5

    • SHA1

      b330b760a8f16d5a31c2dc815627f5eb40861008

    • SHA256

      b06546ddc8ca1e3d532f3f2593e88a6f49e81b66a9c2051d58508cc97b6a2023

    • SHA512

      b6e107fa34764d336c9b59802c858845df9f8661a1beb41436fd638a044580557921e69883ed32737f853e203f0083358f642f3efe0a80fae7932c5e6137331f

    • SSDEEP

      98304:EuLgywiNHBeSLxYK/bxE3q/BlZkWMGPQflVJ/EK1sLyzs2T2Q1mOjq4/:V7wqheSVYK/bua/BlWWnuVhsus8nm+qi

    Score
    7/10

    • Executes dropped EXE

    • Loads dropped DLL

    behavioral15

    • Target

      Pizza.Tower.v1.0.311/_Redist/vcredist_x86.exe

    • Size

      4.8MB

    • MD5

      b88228d5fef4b6dc019d69d4471f23ec

    • SHA1

      372d9c1670343d3fb252209ba210d4dc4d67d358

    • SHA256

      8162b2d665ca52884507ede19549e99939ce4ea4a638c537fa653539819138c8

    • SHA512

      cdd218d211a687dde519719553748f3fb36d4ac618670986a6dadb4c45b34a9c6262ba7bab243a242f91d867b041721f22330170a74d4d0b2c354aec999dbff8

    • SSDEEP

      98304:RuLgywiN1ah6HcG0UJrN7SDgndrHZDMeaNNjt0CKKBgY2r71pZ/APaOR72HgQo0z:I7wq1W6HqULS8djZDTaNNeCKVP5ORsg0

    Score
    7/10

    • Executes dropped EXE

    • Loads dropped DLL

    behavioral16

    • Target

      Pizza.Tower.v1.0.311/_Redist/xnafx40_redist.msi

    • Size

      6.7MB

    • MD5

      97c2eebb30c5a88c68c8f24f37183f1d

    • SHA1

      49efdc29f65fc8263c196338552c7009fc96c5de

    • SHA256

      e6c41d692ebcba854dad4b1c52bb7ddd05926bad3105595d6596b8bab01c25e7

    • SHA512

      c9d1017b274ceb1b4ee624cf7e628787c32a727c64f715fbce1f1ae929d9114f8fe1291e34583cec615619b0128c01206b07efc878e7a5c57b792453f73fd0da

    • SSDEEP

      98304:wynfL329J1XswfXO6wiBB+4RZg6aENaCZAU5PMO0MntfERyJGH2YPq/:wYD3C1XXfzH+4cLHU5PM/Mnt+YGlq

    Score
    8/10

    • Blocklisted process makes network request

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    behavioral17

MITRE ATT&CK Enterprise v6

Tasks