c1325391f2a2ba9a56a97e44ed8f308abbb00d96007a79f52796d34cfa60d0cc

Analysis

max time kernel
117s
max time network
123s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
14/05/2024, 06:41

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

$TEMP/AlawarGameBoxSetup.exe
Size

1.9MB
MD5

4e3cf1d4c252eea6d92f05e5d707f16d
SHA1

126f51322add7d3ea6d1a29631dcfa8ae2994f6c
SHA256

90b0d487d5be85aa4e943279b822844d6dfdab14fde5e47216bda2bb38833ee5
SHA512

4070b61945d4395ed47319d2848020c301cb13e18d797216e5c708d5d7c2663b7392495d0a66c4a393f5772a569a60ec362e5a07d575da44d74b69592fd59fc9
SSDEEP

49152:SXfpUyvZfTsx6wExvVG/Bvu2HymhMdhLHuzFHy:SXfpndTsxQdVGluxEs

Score

7^/10

Malware Config

Signatures

Loads dropped DLL 1 IoCs

pid	Process
2056	AlawarGameBoxSetup.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2056	AlawarGameBoxSetup.exe

C:\Users\Admin\AppData\Local\Temp\$TEMP\AlawarGameBoxSetup.exe
"C:\Users\Admin\AppData\Local\Temp\$TEMP\AlawarGameBoxSetup.exe"
1⤵
- Loads dropped DLL
- Suspicious behavior: GetForegroundWindowSpam
PID:2056

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\nsy2ACA.tmp\ioSpecial.ini

Filesize
698B

MD5
c6ba595066018bfa29abe0a2b0843022

SHA1
aff0cc69ceea25af98d85f7fd76630006ea9baa5

SHA256
83c1e08befde4c44335f12695cf3f30602b2bd1cb10b1e49a3fe660eee9ed279

SHA512
8ea7bcdf7aff3335a8d68b40b27ddc7901fdb7f73ab8831fd080648c245fbb59d94ae27e5502ed90c0d0f863e6826716a0066dbaa2f959b9d856543859da1627

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsy2ACA.tmp\ioSpecial.ini

Filesize
737B

MD5
dcca567dde27d4c6697addf3e4f23631

SHA1
f41fa98720dd4b92c795ed63ea65e307b6b59f7d

SHA256
3704fa42412ab1296e58a8f91c29bcc9d82c7f3f24c177c24771e636c38b7667

SHA512
dbe949e5205bf8f8362328f331b6bf11c31b6c3ad4ebc8179d0d6fa9fab3ae9c526f2eb9bd68b197be66bb6419f259eca04f4faba9894cd4208d4a0e46b8514d

Download Submit
\Users\Admin\AppData\Local\Temp\nsy2ACA.tmp\InstallOptions.dll

Filesize
14KB

MD5
79be350c8381293abb045bbd2a7b5f0a

SHA1
0b4e6d482cae461e36c2b47661ef586545162e23

SHA256
3091623495d6e81bc0aa9182a55b0f93d3b2238102a44fd66943e46ed7eeaf51

SHA512
1d39bc13f2825bb4aee5832bc5c60603b62b3475e0075028a146981764e6796e68fdd752627f37f8bb198dcfce5a62efb6a6283366fc4874a8915008aa0a4c28

Download Submit