Overview

overview

9

Static

static

7

Gamesense.exe

windows7-x64

9

Gamesense.exe

windows10-2004-x64

9

Sharing

Copy URL
Twitter E-mail

General

  • Target

    Gamesense.exe

  • Size

    18.4MB

  • Sample

    240526-w525fagc82

  • MD5

    bcd2906b00f86fd920a147dae43d7dad

  • SHA1

    6b582dbe0dfe349054d2b21beb8a8ab54d4873b0

  • SHA256

    0651bd702bdd0a856e6690a8b46322d7008b27390c9a6658dde5d0974b2e6b53

  • SHA512

    0a56785242804f56cce06c25a31c08497df58a3f9e70b1ad1b444471ef59cd80692a8d1de6b17ee4fe08a88d254629245409d64afae7de0b42721b91c2eb1783

  • SSDEEP

    393216:bSwXCg6VhB65LGLGT2p4S7xh/yCZUWFMVJPTpr8uCM2+ovxIe:b8pVf69FT2p77xh/yJWFaP9r8hM2+ovF

Score
9/10
bootkitevasionpersistencethemidatrojan

Malware Config

Targets

    • Target

      Gamesense.exe

    • Size

      18.4MB

    • MD5

      bcd2906b00f86fd920a147dae43d7dad

    • SHA1

      6b582dbe0dfe349054d2b21beb8a8ab54d4873b0

    • SHA256

      0651bd702bdd0a856e6690a8b46322d7008b27390c9a6658dde5d0974b2e6b53

    • SHA512

      0a56785242804f56cce06c25a31c08497df58a3f9e70b1ad1b444471ef59cd80692a8d1de6b17ee4fe08a88d254629245409d64afae7de0b42721b91c2eb1783

    • SSDEEP

      393216:bSwXCg6VhB65LGLGT2p4S7xh/yCZUWFMVJPTpr8uCM2+ovxIe:b8pVf69FT2p77xh/yJWFaP9r8hM2+ovF

    Score
    9/10
    bootkitevasionpersistencethemidatrojan

    • Identifies VirtualBox via ACPI registry values (likely anti-VM)

      evasion

    • Checks BIOS information in registry

      BIOS information is often read in order to detect sandboxing environments.

    • Themida packer

      Detects Themida, an advanced Windows software protection system.

      themida

    • Checks whether UAC is enabled

      evasiontrojan

    • Writes to the Master Boot Record (MBR)

      Bootkits write to the MBR to gain persistence at a level below the operating system.

      bootkitpersistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks