Overview
overview
7Static
static
7Texture Pa...ts.apk
android-9-x86
1Texture Pa...ts.apk
android-11-x64
1DungeonSheet-hd.xml
windows7-x64
1DungeonSheet-hd.xml
windows10-2004-x64
1DungeonSheet.xml
windows7-x64
1DungeonSheet.xml
windows10-2004-x64
1FireSheet_01-hd.xml
windows7-x64
1FireSheet_01-hd.xml
windows10-2004-x64
1FireSheet_01.xml
windows7-x64
1FireSheet_01.xml
windows10-2004-x64
1GJShopKeep...sc.xml
windows7-x64
1GJShopKeep...sc.xml
windows10-2004-x64
1GJ_GameSheet-hd.xml
windows7-x64
1GJ_GameSheet-hd.xml
windows10-2004-x64
1GJ_GameSheet.xml
windows7-x64
1GJ_GameSheet.xml
windows10-2004-x64
1GJ_GameSheet02-hd.xml
windows7-x64
1GJ_GameSheet02-hd.xml
windows10-2004-x64
1GJ_GameSheet02.xml
windows7-x64
1GJ_GameSheet02.xml
windows10-2004-x64
1GJ_GameSheet03-hd.xml
windows7-x64
1GJ_GameSheet03-hd.xml
windows10-2004-x64
1GJ_GameSheet03.xml
windows7-x64
1GJ_GameSheet03.xml
windows10-2004-x64
1GJ_GameSheet04-hd.xml
windows7-x64
1GJ_GameSheet04-hd.xml
windows10-2004-x64
1GJ_GameSheet04.xml
windows7-x64
1GJ_GameSheet04.xml
windows10-2004-x64
1GJ_GameShe...hd.xml
windows7-x64
1GJ_GameShe...hd.xml
windows10-2004-x64
1GauntletSheet.xml
windows7-x64
1GauntletSheet.xml
windows10-2004-x64
1Analysis
-
max time kernel
134s -
max time network
161s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
10-06-2023 23:11
Static task
static1
Behavioral task
behavioral1
Sample
Texture Pack Lights.apk
Resource
android-x86-arm-20220823-en
Behavioral task
behavioral2
Sample
Texture Pack Lights.apk
Resource
android-x64-arm64-20220823-en
Behavioral task
behavioral3
Sample
DungeonSheet-hd.xml
Resource
win7-20230220-en
Behavioral task
behavioral4
Sample
DungeonSheet-hd.xml
Resource
win10v2004-20230220-en
Behavioral task
behavioral5
Sample
DungeonSheet.xml
Resource
win7-20230220-en
Behavioral task
behavioral6
Sample
DungeonSheet.xml
Resource
win10v2004-20230221-en
Behavioral task
behavioral7
Sample
FireSheet_01-hd.xml
Resource
win7-20230220-en
Behavioral task
behavioral8
Sample
FireSheet_01-hd.xml
Resource
win10v2004-20230220-en
Behavioral task
behavioral9
Sample
FireSheet_01.xml
Resource
win7-20230220-en
Behavioral task
behavioral10
Sample
FireSheet_01.xml
Resource
win10v2004-20230220-en
Behavioral task
behavioral11
Sample
GJShopKeeper3_AnimDesc.xml
Resource
win7-20230220-en
Behavioral task
behavioral12
Sample
GJShopKeeper3_AnimDesc.xml
Resource
win10v2004-20230220-en
Behavioral task
behavioral13
Sample
GJ_GameSheet-hd.xml
Resource
win7-20230220-en
Behavioral task
behavioral14
Sample
GJ_GameSheet-hd.xml
Resource
win10v2004-20230220-en
Behavioral task
behavioral15
Sample
GJ_GameSheet.xml
Resource
win7-20230220-en
Behavioral task
behavioral16
Sample
GJ_GameSheet.xml
Resource
win10v2004-20230220-en
Behavioral task
behavioral17
Sample
GJ_GameSheet02-hd.xml
Resource
win7-20230220-en
Behavioral task
behavioral18
Sample
GJ_GameSheet02-hd.xml
Resource
win10v2004-20230220-en
Behavioral task
behavioral19
Sample
GJ_GameSheet02.xml
Resource
win7-20230220-en
Behavioral task
behavioral20
Sample
GJ_GameSheet02.xml
Resource
win10v2004-20230221-en
Behavioral task
behavioral21
Sample
GJ_GameSheet03-hd.xml
Resource
win7-20230220-en
Behavioral task
behavioral22
Sample
GJ_GameSheet03-hd.xml
Resource
win10v2004-20230220-en
Behavioral task
behavioral23
Sample
GJ_GameSheet03.xml
Resource
win7-20230220-en
Behavioral task
behavioral24
Sample
GJ_GameSheet03.xml
Resource
win10v2004-20230220-en
Behavioral task
behavioral25
Sample
GJ_GameSheet04-hd.xml
Resource
win7-20230220-en
Behavioral task
behavioral26
Sample
GJ_GameSheet04-hd.xml
Resource
win10v2004-20230220-en
Behavioral task
behavioral27
Sample
GJ_GameSheet04.xml
Resource
win7-20230220-en
Behavioral task
behavioral28
Sample
GJ_GameSheet04.xml
Resource
win10v2004-20230221-en
Behavioral task
behavioral29
Sample
GJ_GameSheetGlow-hd.xml
Resource
win7-20230220-en
Behavioral task
behavioral30
Sample
GJ_GameSheetGlow-hd.xml
Resource
win10v2004-20230220-en
Behavioral task
behavioral31
Sample
GauntletSheet.xml
Resource
win7-20230220-en
Behavioral task
behavioral32
Sample
GauntletSheet.xml
Resource
win10v2004-20230220-en
General
-
Target
GJ_GameSheet03.xml
-
Size
251KB
-
MD5
85bad65c57441522787e304a0749a974
-
SHA1
34be2692d75bbe2271811a1be0d2bda907ac5fcf
-
SHA256
495685b2660b6cf5d6519e7101e3e6c8370a99d73ba8c572fba5050f6b419c8b
-
SHA512
0a32a0f35569d91d5251a8b60ee7adb231a510df5d15e0ae91de4921437f1d76de36bc2e59964aec2f9c20aee4b209694b46a911d7979ee1070e6997b742ae2e
-
SSDEEP
192:antPmaaTN/REK62A5qRJFWuJpQcKjCNzwQh1V9kA5FB/ESwMCeiCtVckxQRGuqPp:EP/tHqR1JpQtjC5bTkA5F1ekxFD56V6
Malware Config
Signatures
-
Processes:
IEXPLORE.EXEiexplore.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "927054295" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "943148726" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 609d6f39f19bd901 iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000a764b4d44fde454ea24e8108e2c9b65d00000000020000000000106600000001000020000000005308cc1bed3f3545ea70850b5d575696c5382ccb34558f54ae6d9eecb53839000000000e80000000020000200000006e0127686d834e56cc57234945964e890e9ee38b2326907ad6df29c5c18f82af200000001158f854d6ec948cb81f959747087c2c509c5e93a509546bed4b29b375cd438540000000fde25319303c49883515cf39b3a969ab7530ce783248337b4eb93bc981ad9216bd467d3543bfc8dd552453442fa576802719e485bd2cfeec9395b501e9055817 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\Software\Microsoft\Internet Explorer\IESettingSync IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000a764b4d44fde454ea24e8108e2c9b65d000000000200000000001066000000010000200000009dfdb289b30737af54ce789e8863db98c915314aadd84cac6461ba72c76bc0c4000000000e8000000002000020000000bde783038f077e9a229eead1f258dff373c1f065bf351f3675c4b71796e62bed2000000025467b477ba2397d4de46578cafb60ece2c6dcc6b4eb3a81e58a3d482ee28c0e40000000498293f2b45d4e83c265d04f8e095591bca5163a08cbf3a5eb8b82a30bb87e5dfa06c8b2a46524e1ea4ac3e10bf555e5683b5eabfc9edba1d71b98130944b7f0 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLLowDateTime = "1251635200" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLHighDateTime = "50" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\Software\Microsoft\Internet Explorer\VersionManager iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "31038449" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31038449" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "927054295" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31038449" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 30ce7d39f19bd901 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "393203774" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{6208C2AA-07E4-11EE-9F77-72EDBB006969} = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\SOFTWARE\Microsoft\Internet Explorer\IESettingSync\SlowSettingTypesChanged = "2" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\Software\Microsoft\Internet Explorer\VersionManager IEXPLORE.EXE -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
iexplore.exepid process 3164 iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
iexplore.exepid process 3164 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
Processes:
iexplore.exeIEXPLORE.EXEpid process 3164 iexplore.exe 3164 iexplore.exe 4760 IEXPLORE.EXE 4760 IEXPLORE.EXE 4760 IEXPLORE.EXE 4760 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 5 IoCs
Processes:
MSOXMLED.EXEiexplore.exedescription pid process target process PID 1896 wrote to memory of 3164 1896 MSOXMLED.EXE iexplore.exe PID 1896 wrote to memory of 3164 1896 MSOXMLED.EXE iexplore.exe PID 3164 wrote to memory of 4760 3164 iexplore.exe IEXPLORE.EXE PID 3164 wrote to memory of 4760 3164 iexplore.exe IEXPLORE.EXE PID 3164 wrote to memory of 4760 3164 iexplore.exe IEXPLORE.EXE
Processes
-
C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX64\Microsoft Shared\Office16\MSOXMLED.EXE"C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX64\Microsoft Shared\Office16\MSOXMLED.EXE" /verb open "C:\Users\Admin\AppData\Local\Temp\GJ_GameSheet03.xml"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\GJ_GameSheet03.xml2⤵
- Modifies Internet Explorer settings
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3164 CREDAT:17410 /prefetch:23⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776Filesize
471B
MD5f555af3f1b663a55df56040069b6097b
SHA1ac566b3ec3882b349616e37dcce15f1470496361
SHA256e9a0504f3aaee42e85baf24a611a6c237ba0de8c974cf2cb0b9f26913e445d5a
SHA5128fca6bdd6356875a5e21d988cc809e6d062c1ee3271293f837968138fc4f302c5457707c4152a62b1ab8469c01c90d4dcde80bdbc210541ef12d151ff6edf1c2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776Filesize
404B
MD5323014d0cd971b8e65a44c76483735b2
SHA1880c2fac3df53d7f116a244d61c0e4418e892fa0
SHA256c8dba47e5a22dd0b3554df5419efe3aa1c13a402730f573e84b3176ba093bc36
SHA512db658f7c90fea0373984c6d36eda287a6589184ca469b592570f032cebcb2479abf9d7b2c364b7c166d72f6dd1402f16f357d1bfdff4478e0d05c63b6ec0d219
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\1IYUAPIF\suggestions[1].en-USFilesize
17KB
MD55a34cb996293fde2cb7a4ac89587393a
SHA13c96c993500690d1a77873cd62bc639b3a10653f
SHA256c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad
SHA512e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee
-
memory/1896-133-0x00007FFA5BC50000-0x00007FFA5BC60000-memory.dmpFilesize
64KB
-
memory/1896-134-0x00007FFA5BC50000-0x00007FFA5BC60000-memory.dmpFilesize
64KB
-
memory/1896-135-0x00007FFA5BC50000-0x00007FFA5BC60000-memory.dmpFilesize
64KB
-
memory/1896-136-0x00007FFA5BC50000-0x00007FFA5BC60000-memory.dmpFilesize
64KB
-
memory/1896-137-0x00007FFA5BC50000-0x00007FFA5BC60000-memory.dmpFilesize
64KB
-
memory/1896-138-0x00007FFA5BC50000-0x00007FFA5BC60000-memory.dmpFilesize
64KB
-
memory/1896-140-0x00007FFA5BC50000-0x00007FFA5BC60000-memory.dmpFilesize
64KB
-
memory/1896-139-0x00007FFA5BC50000-0x00007FFA5BC60000-memory.dmpFilesize
64KB
-
memory/1896-141-0x00007FFA5BC50000-0x00007FFA5BC60000-memory.dmpFilesize
64KB