Overview
overview
7Static
static
7Texture Pa...ts.apk
android-9-x86
1Texture Pa...ts.apk
android-11-x64
1DungeonSheet-hd.xml
windows7-x64
1DungeonSheet-hd.xml
windows10-2004-x64
1DungeonSheet.xml
windows7-x64
1DungeonSheet.xml
windows10-2004-x64
1FireSheet_01-hd.xml
windows7-x64
1FireSheet_01-hd.xml
windows10-2004-x64
1FireSheet_01.xml
windows7-x64
1FireSheet_01.xml
windows10-2004-x64
1GJShopKeep...sc.xml
windows7-x64
1GJShopKeep...sc.xml
windows10-2004-x64
1GJ_GameSheet-hd.xml
windows7-x64
1GJ_GameSheet-hd.xml
windows10-2004-x64
1GJ_GameSheet.xml
windows7-x64
1GJ_GameSheet.xml
windows10-2004-x64
1GJ_GameSheet02-hd.xml
windows7-x64
1GJ_GameSheet02-hd.xml
windows10-2004-x64
1GJ_GameSheet02.xml
windows7-x64
1GJ_GameSheet02.xml
windows10-2004-x64
1GJ_GameSheet03-hd.xml
windows7-x64
1GJ_GameSheet03-hd.xml
windows10-2004-x64
1GJ_GameSheet03.xml
windows7-x64
1GJ_GameSheet03.xml
windows10-2004-x64
1GJ_GameSheet04-hd.xml
windows7-x64
1GJ_GameSheet04-hd.xml
windows10-2004-x64
1GJ_GameSheet04.xml
windows7-x64
1GJ_GameSheet04.xml
windows10-2004-x64
1GJ_GameShe...hd.xml
windows7-x64
1GJ_GameShe...hd.xml
windows10-2004-x64
1GauntletSheet.xml
windows7-x64
1GauntletSheet.xml
windows10-2004-x64
1Analysis
-
max time kernel
154s -
max time network
177s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
10-06-2023 23:11
Static task
static1
Behavioral task
behavioral1
Sample
Texture Pack Lights.apk
Resource
android-x86-arm-20220823-en
Behavioral task
behavioral2
Sample
Texture Pack Lights.apk
Resource
android-x64-arm64-20220823-en
Behavioral task
behavioral3
Sample
DungeonSheet-hd.xml
Resource
win7-20230220-en
Behavioral task
behavioral4
Sample
DungeonSheet-hd.xml
Resource
win10v2004-20230220-en
Behavioral task
behavioral5
Sample
DungeonSheet.xml
Resource
win7-20230220-en
Behavioral task
behavioral6
Sample
DungeonSheet.xml
Resource
win10v2004-20230221-en
Behavioral task
behavioral7
Sample
FireSheet_01-hd.xml
Resource
win7-20230220-en
Behavioral task
behavioral8
Sample
FireSheet_01-hd.xml
Resource
win10v2004-20230220-en
Behavioral task
behavioral9
Sample
FireSheet_01.xml
Resource
win7-20230220-en
Behavioral task
behavioral10
Sample
FireSheet_01.xml
Resource
win10v2004-20230220-en
Behavioral task
behavioral11
Sample
GJShopKeeper3_AnimDesc.xml
Resource
win7-20230220-en
Behavioral task
behavioral12
Sample
GJShopKeeper3_AnimDesc.xml
Resource
win10v2004-20230220-en
Behavioral task
behavioral13
Sample
GJ_GameSheet-hd.xml
Resource
win7-20230220-en
Behavioral task
behavioral14
Sample
GJ_GameSheet-hd.xml
Resource
win10v2004-20230220-en
Behavioral task
behavioral15
Sample
GJ_GameSheet.xml
Resource
win7-20230220-en
Behavioral task
behavioral16
Sample
GJ_GameSheet.xml
Resource
win10v2004-20230220-en
Behavioral task
behavioral17
Sample
GJ_GameSheet02-hd.xml
Resource
win7-20230220-en
Behavioral task
behavioral18
Sample
GJ_GameSheet02-hd.xml
Resource
win10v2004-20230220-en
Behavioral task
behavioral19
Sample
GJ_GameSheet02.xml
Resource
win7-20230220-en
Behavioral task
behavioral20
Sample
GJ_GameSheet02.xml
Resource
win10v2004-20230221-en
Behavioral task
behavioral21
Sample
GJ_GameSheet03-hd.xml
Resource
win7-20230220-en
Behavioral task
behavioral22
Sample
GJ_GameSheet03-hd.xml
Resource
win10v2004-20230220-en
Behavioral task
behavioral23
Sample
GJ_GameSheet03.xml
Resource
win7-20230220-en
Behavioral task
behavioral24
Sample
GJ_GameSheet03.xml
Resource
win10v2004-20230220-en
Behavioral task
behavioral25
Sample
GJ_GameSheet04-hd.xml
Resource
win7-20230220-en
Behavioral task
behavioral26
Sample
GJ_GameSheet04-hd.xml
Resource
win10v2004-20230220-en
Behavioral task
behavioral27
Sample
GJ_GameSheet04.xml
Resource
win7-20230220-en
Behavioral task
behavioral28
Sample
GJ_GameSheet04.xml
Resource
win10v2004-20230221-en
Behavioral task
behavioral29
Sample
GJ_GameSheetGlow-hd.xml
Resource
win7-20230220-en
Behavioral task
behavioral30
Sample
GJ_GameSheetGlow-hd.xml
Resource
win10v2004-20230220-en
Behavioral task
behavioral31
Sample
GauntletSheet.xml
Resource
win7-20230220-en
Behavioral task
behavioral32
Sample
GauntletSheet.xml
Resource
win10v2004-20230220-en
General
-
Target
GJ_GameSheet04-hd.xml
-
Size
27KB
-
MD5
050392d9359549dc0164ee9425fdeee7
-
SHA1
fe561d6db7575b003958c7e3b2343fc201eb346c
-
SHA256
69ee7d63b1fc1a648a62c3c01448db3e271ec5ed3998e9dfcb0c877e7e6e89b8
-
SHA512
ebd68b94d162c4358cd9f8a6cca0e9ba99cac0ca1e9352d352df05a3a22a74673c29b0f6f4f9bdaba3c9e58634cb5d4e6c9f09bc98e2f696e305746b5f27a6b9
-
SSDEEP
96:/y+vAYkCWwNAYkCWwbnYkCWw9XYkCWwdf2YkCWwtVYkCWwW4YkCWwCUYkCWwm1Ym:a6QkpZeRV4
Malware Config
Signatures
-
Processes:
iexplore.exeIEXPLORE.EXEdescription ioc process Set value (data) \REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 60689845f19bd901 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLLowDateTime = "1251635200" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLHighDateTime = "50" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000\Software\Microsoft\Internet Explorer\IESettingSync IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "1139491730" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{6D5633B0-07E4-11EE-BDA1-62EB0CDC8974} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "31038449" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "1115116856" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000\Software\Microsoft\Internet Explorer\VersionManager IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000\SOFTWARE\Microsoft\Internet Explorer\IESettingSync\SlowSettingTypesChanged = "2" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 809f8745f19bd901 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "393203793" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000\Software\Microsoft\Internet Explorer\VersionManager iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000024b8d06808c83948bca6bff8cdd70eb90000000002000000000010660000000100002000000092e7f6669bae589b8b53ebb4dfd91b53ed25960117c07b18620ecbd70985509d000000000e800000000200002000000052541b04d0adbc1bd213463865c1326c70e1ea3fadb5d246d76ff98a361d21782000000075af33506a8b2d2942d501e6d91be4b7308e35af9f24dc2f54e3d6bf9b335fdd40000000ef05b529911ed44e9b4da6519f951cdabd1f48098705200211ce46206338b361780209dbe43f581c5a6f89139286f651d3155416401aadbcbca21b3d9b7ba6e0 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31038449" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "1115116856" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31038449" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000024b8d06808c83948bca6bff8cdd70eb9000000000200000000001066000000010000200000001315e085301b7859e707b345bd986478033e6b17e6b8da377dee7a401c4afcdb000000000e800000000200002000000000a1e20209631a4e0ae6ad9db8bd0dc0020aed4ec37eeb4cd54cb8061c9ccf6b2000000052e8d99df9d15ed9c54abcfd1d66a8d83d48149779dd3ed83d17b5136fdad063400000002da3b1604be659cef2ead6d5c4f66ed69706ec6cb9a518c2e4f1514ed183f46c8609597b41428d714ac0dc4526ee8f61cafb156a39cf7c1ba66a8dc31fa2d503 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
iexplore.exepid process 1572 iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
iexplore.exepid process 1572 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
Processes:
iexplore.exeIEXPLORE.EXEpid process 1572 iexplore.exe 1572 iexplore.exe 3480 IEXPLORE.EXE 3480 IEXPLORE.EXE 3480 IEXPLORE.EXE 3480 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 5 IoCs
Processes:
MSOXMLED.EXEiexplore.exedescription pid process target process PID 2472 wrote to memory of 1572 2472 MSOXMLED.EXE iexplore.exe PID 2472 wrote to memory of 1572 2472 MSOXMLED.EXE iexplore.exe PID 1572 wrote to memory of 3480 1572 iexplore.exe IEXPLORE.EXE PID 1572 wrote to memory of 3480 1572 iexplore.exe IEXPLORE.EXE PID 1572 wrote to memory of 3480 1572 iexplore.exe IEXPLORE.EXE
Processes
-
C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX64\Microsoft Shared\Office16\MSOXMLED.EXE"C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX64\Microsoft Shared\Office16\MSOXMLED.EXE" /verb open "C:\Users\Admin\AppData\Local\Temp\GJ_GameSheet04-hd.xml"1⤵
- Suspicious use of WriteProcessMemory
PID:2472 -
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\GJ_GameSheet04-hd.xml2⤵
- Modifies Internet Explorer settings
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1572 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1572 CREDAT:17410 /prefetch:23⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:3480
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776Filesize
471B
MD5f555af3f1b663a55df56040069b6097b
SHA1ac566b3ec3882b349616e37dcce15f1470496361
SHA256e9a0504f3aaee42e85baf24a611a6c237ba0de8c974cf2cb0b9f26913e445d5a
SHA5128fca6bdd6356875a5e21d988cc809e6d062c1ee3271293f837968138fc4f302c5457707c4152a62b1ab8469c01c90d4dcde80bdbc210541ef12d151ff6edf1c2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776Filesize
404B
MD5f611d438c66416a6240298d8bf40872b
SHA109c80106de053f72fc0dbfb3a83ceb52264442bb
SHA256547fa3b6371218ae9b99c2774102602e32830da7bed39142c7d18aa812a1846a
SHA5124b890439dc3390e7874fd182aa43bcfddba1354b246c2dc52169ef49acf073ca7eae433cc6834d865dc1b3a0f3a3569d719d9d90e0ca12b0e9b3ab6ed0377d46
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\0BMP3ERH\suggestions[1].en-USFilesize
17KB
MD55a34cb996293fde2cb7a4ac89587393a
SHA13c96c993500690d1a77873cd62bc639b3a10653f
SHA256c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad
SHA512e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee
-
memory/2472-133-0x00007FFB7D650000-0x00007FFB7D660000-memory.dmpFilesize
64KB
-
memory/2472-134-0x00007FFB7D650000-0x00007FFB7D660000-memory.dmpFilesize
64KB
-
memory/2472-135-0x00007FFB7D650000-0x00007FFB7D660000-memory.dmpFilesize
64KB
-
memory/2472-136-0x00007FFB7D650000-0x00007FFB7D660000-memory.dmpFilesize
64KB
-
memory/2472-137-0x00007FFB7D650000-0x00007FFB7D660000-memory.dmpFilesize
64KB
-
memory/2472-138-0x00007FFB7D650000-0x00007FFB7D660000-memory.dmpFilesize
64KB
-
memory/2472-139-0x00007FFB7D650000-0x00007FFB7D660000-memory.dmpFilesize
64KB
-
memory/2472-140-0x00007FFB7D650000-0x00007FFB7D660000-memory.dmpFilesize
64KB
-
memory/2472-141-0x00007FFB7D650000-0x00007FFB7D660000-memory.dmpFilesize
64KB