8fa040ad61b72d8be290640baf39fccc945d6991ac8356020fbee760c88656ce

Analysis

max time kernel
139s
max time network
158s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
11/04/2024, 01:13

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

$TEMP/AlawarGameBoxSetup.exe
Size

1.9MB
MD5

4e3cf1d4c252eea6d92f05e5d707f16d
SHA1

126f51322add7d3ea6d1a29631dcfa8ae2994f6c
SHA256

90b0d487d5be85aa4e943279b822844d6dfdab14fde5e47216bda2bb38833ee5
SHA512

4070b61945d4395ed47319d2848020c301cb13e18d797216e5c708d5d7c2663b7392495d0a66c4a393f5772a569a60ec362e5a07d575da44d74b69592fd59fc9
SSDEEP

49152:SXfpUyvZfTsx6wExvVG/Bvu2HymhMdhLHuzFHy:SXfpndTsxQdVGluxEs

Score

7^/10

Malware Config

Signatures

Loads dropped DLL 1 IoCs

pid	Process
2076	AlawarGameBoxSetup.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

C:\Users\Admin\AppData\Local\Temp\$TEMP\AlawarGameBoxSetup.exe
"C:\Users\Admin\AppData\Local\Temp\$TEMP\AlawarGameBoxSetup.exe"
1⤵
- Loads dropped DLL
PID:2076

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4072 --field-trial-handle=2744,i,16362475727591565961,3676688664819797550,262144 --variations-seed-version /prefetch:8
1⤵
PID:3864

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\nsl223B.tmp\InstallOptions.dll

Filesize
14KB

MD5
79be350c8381293abb045bbd2a7b5f0a

SHA1
0b4e6d482cae461e36c2b47661ef586545162e23

SHA256
3091623495d6e81bc0aa9182a55b0f93d3b2238102a44fd66943e46ed7eeaf51

SHA512
1d39bc13f2825bb4aee5832bc5c60603b62b3475e0075028a146981764e6796e68fdd752627f37f8bb198dcfce5a62efb6a6283366fc4874a8915008aa0a4c28

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsl223B.tmp\ioSpecial.ini

Filesize
698B

MD5
6a330ca05c9451f975a689dfd2f4bda1

SHA1
fe3d131a75a643396bb4fd378781ade3038c9627

SHA256
0b349b2f26cacdbc5033b421cc9ee93341b96a2a17c06bff3cce9db32e675ab5

SHA512
05586161e990083dabdb7c963ca1e289064274234411221919d4f07f21eb2631900e6b625287374a1e836b86ccda0d1a170af62cc6ad6d9d9a152a802a0aafab

Download Submit