c1325391f2a2ba9a56a97e44ed8f308abbb00d96007a79f52796d34cfa60d0cc

Analysis

max time kernel
122s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
14/05/2024, 06:41

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

$TEMP/AlawarGameBoxSetup.exe
Size

1.9MB
MD5

4e3cf1d4c252eea6d92f05e5d707f16d
SHA1

126f51322add7d3ea6d1a29631dcfa8ae2994f6c
SHA256

90b0d487d5be85aa4e943279b822844d6dfdab14fde5e47216bda2bb38833ee5
SHA512

4070b61945d4395ed47319d2848020c301cb13e18d797216e5c708d5d7c2663b7392495d0a66c4a393f5772a569a60ec362e5a07d575da44d74b69592fd59fc9
SSDEEP

49152:SXfpUyvZfTsx6wExvVG/Bvu2HymhMdhLHuzFHy:SXfpndTsxQdVGluxEs

Score

7^/10

Malware Config

Signatures

Loads dropped DLL 1 IoCs

pid	Process
3524	AlawarGameBoxSetup.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

C:\Users\Admin\AppData\Local\Temp\$TEMP\AlawarGameBoxSetup.exe
"C:\Users\Admin\AppData\Local\Temp\$TEMP\AlawarGameBoxSetup.exe"
1⤵
- Loads dropped DLL
PID:3524

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=3452,i,16710585221322798697,8586257254049248207,262144 --variations-seed-version --mojo-platform-channel-handle=4432 /prefetch:8
1⤵
PID:2692

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\nsaECA4.tmp\InstallOptions.dll

Filesize
14KB

MD5
79be350c8381293abb045bbd2a7b5f0a

SHA1
0b4e6d482cae461e36c2b47661ef586545162e23

SHA256
3091623495d6e81bc0aa9182a55b0f93d3b2238102a44fd66943e46ed7eeaf51

SHA512
1d39bc13f2825bb4aee5832bc5c60603b62b3475e0075028a146981764e6796e68fdd752627f37f8bb198dcfce5a62efb6a6283366fc4874a8915008aa0a4c28

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsaECA4.tmp\ioSpecial.ini

Filesize
698B

MD5
4827a7d456dcfb647dad2d936d057b83

SHA1
2502eb04ab01f70746d94ff5be89e2f4ededc519

SHA256
25cc63038fbb4cc42c65a6909b19e4a281734e1c247af87cb34f781d9a8ccead

SHA512
d4350425be8b50e1a2b232e8c6ebc33562f70b8a4d1b812f8d0b2388e701b6b71f45664131c5140a9db4c196e622edc6cd21428344bd838c415e6e4e4aaec1f9

Download Submit