42c5a74fdc77b2fb5adfc011437e01aec7b178873e725f90fbd50fb8db9929e9

Resubmissions

03/07/2023, 15:28

230703-swbpcaac8w 8

03/07/2023, 15:24

230703-ss6ejsac7z 8

Analysis

max time kernel
26s
max time network
29s
platform
windows7_x64
resource
win7-20230621-en
resource tags

arch:x64arch:x86image:win7-20230621-enlocale:en-usos:windows7-x64system
submitted
03/07/2023, 15:28

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

Everygame_EN_install.exe
Size

579KB
MD5

5fb92c3a7e96f2e5bf430d23df09922f
SHA1

1db9a40c3d8965dec4fd2362f6fefc7f0e1883f4
SHA256

42c5a74fdc77b2fb5adfc011437e01aec7b178873e725f90fbd50fb8db9929e9
SHA512

de97634b695120d98ac85db8388476478d08753dcf8cd996a3369fb89a498c672b8a6cb063cb61df65b6f21cf97a00f99c2970762bbd808f2dc6d9c37f8a61e9
SSDEEP

12288:PybTT3i/KTMu8yGbiZsLHVq+cXWaC0KAp6KJFWXndM7YqiskVGECE3S3:PybTFn8yalj3cXWa3KAp/anWEqlGS3

Score

8^/10

Malware Config

Signatures

Blocklisted process makes network request 2 IoCs

flow	pid	Process
4	808	MSIEXEC.EXE
6	808	MSIEXEC.EXE

Executes dropped EXE 1 IoCs

pid	Process
1640	Ins8C78.tmpinstall.exe

Loads dropped DLL 4 IoCs

pid	Process
1572	Everygame_EN_install.exe
1572	Everygame_EN_install.exe
1572	Everygame_EN_install.exe
1572	Everygame_EN_install.exe

Use of msiexec (install) with remote resource 1 IoCs

pid	Process
808	MSIEXEC.EXE

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeShutdownPrivilege	808	MSIEXEC.EXE
Token: SeIncreaseQuotaPrivilege	808	MSIEXEC.EXE

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
808	MSIEXEC.EXE
808	MSIEXEC.EXE

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 1572 wrote to memory of 1640	1572	Everygame_EN_install.exe	27
PID 1572 wrote to memory of 1640	1572	Everygame_EN_install.exe	27
PID 1572 wrote to memory of 1640	1572	Everygame_EN_install.exe	27
PID 1572 wrote to memory of 1640	1572	Everygame_EN_install.exe	27
PID 1572 wrote to memory of 1640	1572	Everygame_EN_install.exe	27
PID 1572 wrote to memory of 1640	1572	Everygame_EN_install.exe	27
PID 1572 wrote to memory of 1640	1572	Everygame_EN_install.exe	27
PID 1640 wrote to memory of 808	1640	Ins8C78.tmpinstall.exe	28
PID 1640 wrote to memory of 808	1640	Ins8C78.tmpinstall.exe	28
PID 1640 wrote to memory of 808	1640	Ins8C78.tmpinstall.exe	28
PID 1640 wrote to memory of 808	1640	Ins8C78.tmpinstall.exe	28
PID 1640 wrote to memory of 808	1640	Ins8C78.tmpinstall.exe	28
PID 1640 wrote to memory of 808	1640	Ins8C78.tmpinstall.exe	28
PID 1640 wrote to memory of 808	1640	Ins8C78.tmpinstall.exe	28

C:\Users\Admin\AppData\Local\Temp\Everygame_EN_install.exe
"C:\Users\Admin\AppData\Local\Temp\Everygame_EN_install.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1572
- C:\Users\Admin\AppData\Local\Temp\Ins8C78.tmpinstall.exe
  "C:\Users\Admin\AppData\Local\Temp\Ins8C78.tmpinstall.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:1640
- - C:\Windows\SysWOW64\MSIEXEC.EXE
    MSIEXEC.EXE /i "https://flshmonte.cfcntntdnfiles.eu/client/pkgs/everygame/Everygame20230608010102.msi" DDC_DID=8819095 DDC_RTGURL=https://www.cdnfile.eu/dl/TrackSetup/TrackSetup.aspx?DID=8819095%26downloadid=8819095%26filename=Everygame%5FEN%5Finstall%2Eexe%26CASINONAME=everygame CUSTOMNAME02=downloadid CUSTOMVALUE02=8819095 SETUPEXEDIR="C:\Users\Admin\AppData\Local\Temp" SETUPEXENAME="Ins8C78.tmpinstall.exe"
    3⤵
    - Blocklisted process makes network request
    - Use of msiexec (install) with remote resource
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of FindShellTrayWindow
    PID:808

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\CabC371.tmp

Filesize
62KB

MD5
3ac860860707baaf32469fa7cc7c0192

SHA1
c33c2acdaba0e6fa41fd2f00f186804722477639

SHA256
d015145d551ecd14916270efad773bbc9fd57fad2228d2c24559f696c961d904

SHA512
d62ad2408c969a95550fb87efda50f988770ba5e39972041bf85924275baf156b8bec309ecc6409e5acdd37ec175dea40eff921ab58933b5b5b5d35a6147567c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Ins8C78.tmpinstall.exe

Filesize
1.2MB

MD5
8d7ba9665e79e7f4866d29e1f972fd22

SHA1
033ef72201c745204c960a88f1126843176d30d4

SHA256
cba257fe5c17dbf35314f8d0ae9b7a23490e349cb61928bf9df1256c19fd5a5d

SHA512
247fd6c357162120a92e78746342e34e922c594f39fac195d8a3eedd6b02d0a3eed72789930082766819476f2bc47b0136f87d380743267e9735531028a36617

Download Submit
C:\Users\Admin\AppData\Local\Temp\Ins8C78.tmpinstall.exe

Filesize
1.2MB

MD5
8d7ba9665e79e7f4866d29e1f972fd22

SHA1
033ef72201c745204c960a88f1126843176d30d4

SHA256
cba257fe5c17dbf35314f8d0ae9b7a23490e349cb61928bf9df1256c19fd5a5d

SHA512
247fd6c357162120a92e78746342e34e922c594f39fac195d8a3eedd6b02d0a3eed72789930082766819476f2bc47b0136f87d380743267e9735531028a36617

Download Submit
C:\Users\Admin\AppData\Local\Temp\Ins8C78.tmpinstall.exe

Filesize
1.2MB

MD5
8d7ba9665e79e7f4866d29e1f972fd22

SHA1
033ef72201c745204c960a88f1126843176d30d4

SHA256
cba257fe5c17dbf35314f8d0ae9b7a23490e349cb61928bf9df1256c19fd5a5d

SHA512
247fd6c357162120a92e78746342e34e922c594f39fac195d8a3eedd6b02d0a3eed72789930082766819476f2bc47b0136f87d380743267e9735531028a36617

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarC410.tmp

Filesize
164KB

MD5
4ff65ad929cd9a367680e0e5b1c08166

SHA1
c0af0d4396bd1f15c45f39d3b849ba444233b3a2

SHA256
c8733c93cc5aaf5ca206d06af22ee8dbdec764fb5085019a6a9181feb9dfdee6

SHA512
f530dc0d024a5a3b8903ffaaa41b608a5ccdd6da4ba1949f2c2e55a9fca475fec5c8d2119b5763cabe7ef1c3788fb9dcac621869db51d65b1d83cfe404fb4c27

Download Submit
C:\Users\Admin\AppData\Local\Temp\_is93AE.tmp

Filesize
1KB

MD5
d96913d26a737bfedf2b172e1c2f5b13

SHA1
60cd34f0246544f7834e20f2a3d50ebe6fea050d

SHA256
6ca3574df24a155e81e8841d0066e1b732a381455bda0264e5d6c14ecd9215cf

SHA512
3657fa31c285c582b365455418bb5b3863a5de0027dae5760cf0545c3d71d8f4347be8e04b45caa5faa168afd390265cec93cd54758955cb1b7f5e84d28ead78

Download Submit
C:\Users\Admin\AppData\Local\Temp\{17302BFD-C541-4E6C-B420-4481D053528B}\0x0409.ini

Filesize
21KB

MD5
be345d0260ae12c5f2f337b17e07c217

SHA1
0976ba0982fe34f1c35a0974f6178e15c238ed7b

SHA256
e994689a13b9448c074f9b471edeec9b524890a0d82925e98ab90b658016d8f3

SHA512
77040dbee29be6b136a83b9e444d8b4f71ff739f7157e451778fb4fccb939a67ff881a70483de16bcb6ae1fea64a89e00711a33ec26f4d3eea8e16c9e9553eff

Download Submit
C:\Users\Admin\AppData\Local\Temp\{17302BFD-C541-4E6C-B420-4481D053528B}\_ISMSIDEL.INI

Filesize
20B

MD5
db9af7503f195df96593ac42d5519075

SHA1
1b487531bad10f77750b8a50aca48593379e5f56

SHA256
0a33c5dffabcf31a1f6802026e9e2eef4b285e57fd79d52fdcd98d6502d14b13

SHA512
6839264e14576fe190260a4b82afc11c88e50593a20113483851bf4abfdb7cca9986bef83f4c6b8f98ef4d426f07024cf869e8ab393df6d2b743b9b8e2544e1b

Download Submit
C:\Users\Admin\AppData\Local\Temp\~93AB.tmp

Filesize
5KB

MD5
1bd92840e5a539b0a3685081c416256d

SHA1
6f9388f3e371d8f67f1a05c79fcdcab5c7712bef

SHA256
31d5dcdaa9931dc21dd164629cbd6783242c2bebfbc5ad52c7e0697e2d4a5b6a

SHA512
8e6123f601d2f4b03d00c1292cf93f71443f4082294d475f2e34ce2f37cec7faa2d7b14a40071f94e09c767fe196b79fbaef0a1b39b36dffa0a3118e598743d6

Download Submit
\Users\Admin\AppData\Local\Temp\Ins8C78.tmpinstall.exe

Filesize
1.2MB

MD5
8d7ba9665e79e7f4866d29e1f972fd22

SHA1
033ef72201c745204c960a88f1126843176d30d4

SHA256
cba257fe5c17dbf35314f8d0ae9b7a23490e349cb61928bf9df1256c19fd5a5d

SHA512
247fd6c357162120a92e78746342e34e922c594f39fac195d8a3eedd6b02d0a3eed72789930082766819476f2bc47b0136f87d380743267e9735531028a36617

Download Submit
\Users\Admin\AppData\Local\Temp\Ins8C78.tmpinstall.exe

Filesize
1.2MB

MD5
8d7ba9665e79e7f4866d29e1f972fd22

SHA1
033ef72201c745204c960a88f1126843176d30d4

SHA256
cba257fe5c17dbf35314f8d0ae9b7a23490e349cb61928bf9df1256c19fd5a5d

SHA512
247fd6c357162120a92e78746342e34e922c594f39fac195d8a3eedd6b02d0a3eed72789930082766819476f2bc47b0136f87d380743267e9735531028a36617

Download Submit
\Users\Admin\AppData\Local\Temp\Ins8C78.tmpinstall.exe

Filesize
1.2MB

MD5
8d7ba9665e79e7f4866d29e1f972fd22

SHA1
033ef72201c745204c960a88f1126843176d30d4

SHA256
cba257fe5c17dbf35314f8d0ae9b7a23490e349cb61928bf9df1256c19fd5a5d

SHA512
247fd6c357162120a92e78746342e34e922c594f39fac195d8a3eedd6b02d0a3eed72789930082766819476f2bc47b0136f87d380743267e9735531028a36617

Download Submit
\Users\Admin\AppData\Local\Temp\Ins8C78.tmpinstall.exe

Filesize
1.2MB

MD5
8d7ba9665e79e7f4866d29e1f972fd22

SHA1
033ef72201c745204c960a88f1126843176d30d4

SHA256
cba257fe5c17dbf35314f8d0ae9b7a23490e349cb61928bf9df1256c19fd5a5d

SHA512
247fd6c357162120a92e78746342e34e922c594f39fac195d8a3eedd6b02d0a3eed72789930082766819476f2bc47b0136f87d380743267e9735531028a36617

Download Submit
memory/808-140-0x00000000008F0000-0x00000000008F1000-memory.dmp

Filesize
4KB

Download