Overview
overview
7Static
static
36d27a4abf0...e9.exe
windows7-x64
76d27a4abf0...e9.exe
windows10-2004-x64
7$PLUGINSDI...LL.dll
windows7-x64
3$PLUGINSDI...LL.dll
windows10-2004-x64
3$PLUGINSDI...LL.dll
windows7-x64
3$PLUGINSDI...LL.dll
windows10-2004-x64
3$PLUGINSDI...tn.dll
windows7-x64
3$PLUGINSDI...tn.dll
windows10-2004-x64
3$PLUGINSDI...ss.dll
windows7-x64
3$PLUGINSDI...ss.dll
windows10-2004-x64
3$PLUGINSDI...em.dll
windows7-x64
3$PLUGINSDI...em.dll
windows10-2004-x64
3$PLUGINSDI...oc.dll
windows7-x64
3$PLUGINSDI...oc.dll
windows10-2004-x64
3$PLUGINSDI...gs.dll
windows7-x64
3$PLUGINSDI...gs.dll
windows10-2004-x64
3MouseHook.dll
windows7-x64
1MouseHook.dll
windows10-2004-x64
1PrintScreen.exe
windows7-x64
1PrintScreen.exe
windows10-2004-x64
1gamebox.exe
windows7-x64
1gamebox.exe
windows10-2004-x64
1tabGame.exe
windows7-x64
1tabGame.exe
windows10-2004-x64
1uninst.exe
windows7-x64
7uninst.exe
windows10-2004-x64
7$PLUGINSDI...er.dll
windows7-x64
3$PLUGINSDI...er.dll
windows10-2004-x64
3$PLUGINSDI...LL.dll
windows7-x64
3$PLUGINSDI...LL.dll
windows10-2004-x64
3$PLUGINSDI...LL.dll
windows7-x64
3$PLUGINSDI...LL.dll
windows10-2004-x64
3Analysis
- max time kernel
118s - max time network
131s - platform
windows7_x64 - resource
win7-20240611-en - resource tags
arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system - submitted
16/06/2024, 12:12
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
6d27a4abf0b2438f8d5cf4f6ada7798be1b8208d36674705252c631dd6f844e9.exe
Resource
win7-20240611-en
windows7-x64
13 signatures
150 seconds
Behavioral task
behavioral2
Sample
6d27a4abf0b2438f8d5cf4f6ada7798be1b8208d36674705252c631dd6f844e9.exe
Resource
win10v2004-20240611-en
windows10-2004-x64
12 signatures
150 seconds
Behavioral task
behavioral3
Sample
$PLUGINSDIR/FindProcDLL.dll
Resource
win7-20240221-en
windows7-x64
2 signatures
150 seconds
Behavioral task
behavioral4
Sample
$PLUGINSDIR/FindProcDLL.dll
Resource
win10v2004-20240508-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral5
Sample
$PLUGINSDIR/KillProcDLL.dll
Resource
win7-20240508-en
windows7-x64
2 signatures
150 seconds
Behavioral task
behavioral6
Sample
$PLUGINSDIR/KillProcDLL.dll
Resource
win10v2004-20240611-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral7
Sample
$PLUGINSDIR/SkinBtn.dll
Resource
win7-20231129-en
windows7-x64
2 signatures
150 seconds
Behavioral task
behavioral8
Sample
$PLUGINSDIR/SkinBtn.dll
Resource
win10v2004-20240508-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral9
Sample
$PLUGINSDIR/SkinProgress.dll
Resource
win7-20240508-en
windows7-x64
2 signatures
150 seconds
Behavioral task
behavioral10
Sample
$PLUGINSDIR/SkinProgress.dll
Resource
win10v2004-20240508-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral11
Sample
$PLUGINSDIR/System.dll
Resource
win7-20240221-en
windows7-x64
2 signatures
150 seconds
Behavioral task
behavioral12
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20240611-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral13
Sample
$PLUGINSDIR/WndProc.dll
Resource
win7-20240611-en
windows7-x64
2 signatures
150 seconds
Behavioral task
behavioral14
Sample
$PLUGINSDIR/WndProc.dll
Resource
win10v2004-20240508-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral15
Sample
$PLUGINSDIR/nsDialogs.dll
Resource
win7-20240508-en
windows7-x64
2 signatures
150 seconds
Behavioral task
behavioral16
Sample
$PLUGINSDIR/nsDialogs.dll
Resource
win10v2004-20240508-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral17
Sample
MouseHook.dll
Resource
win7-20231129-en
windows7-x64
1 signatures
150 seconds
Behavioral task
behavioral18
Sample
MouseHook.dll
Resource
win10v2004-20240611-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral19
Sample
PrintScreen.exe
Resource
win7-20240221-en
windows7-x64
1 signatures
150 seconds
Behavioral task
behavioral20
Sample
PrintScreen.exe
Resource
win10v2004-20240508-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral21
Sample
gamebox.exe
Resource
win7-20240611-en
windows7-x64
4 signatures
150 seconds
Behavioral task
behavioral22
Sample
gamebox.exe
Resource
win10v2004-20240611-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral23
Sample
tabGame.exe
Resource
win7-20231129-en
windows7-x64
2 signatures
150 seconds
Behavioral task
behavioral24
Sample
tabGame.exe
Resource
win10v2004-20240611-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral25
Sample
uninst.exe
Resource
win7-20240508-en
windows7-x64
7 signatures
150 seconds
Behavioral task
behavioral26
Sample
uninst.exe
Resource
win10v2004-20240611-en
windows10-2004-x64
7 signatures
150 seconds
Behavioral task
behavioral27
Sample
$PLUGINSDIR/BgWorker.dll
Resource
win7-20240508-en
windows7-x64
2 signatures
150 seconds
Behavioral task
behavioral28
Sample
$PLUGINSDIR/BgWorker.dll
Resource
win10v2004-20240611-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral29
Sample
$PLUGINSDIR/FindProcDLL.dll
Resource
win7-20240611-en
windows7-x64
2 signatures
150 seconds
Behavioral task
behavioral30
Sample
$PLUGINSDIR/FindProcDLL.dll
Resource
win10v2004-20240508-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral31
Sample
$PLUGINSDIR/KillProcDLL.dll
Resource
win7-20240508-en
windows7-x64
2 signatures
150 seconds
Behavioral task
behavioral32
Sample
$PLUGINSDIR/KillProcDLL.dll
Resource
win10v2004-20240508-en
windows10-2004-x64
2 signatures
150 seconds
General
- Target 6d27a4abf0b2438f8d5cf4f6ada7798be1b8208d36674705252c631dd6f844e9.exe
- Size 1.5MB
- Sample240616-pdbpvasfph
- SHA256 6d27a4abf0b2438f8d5cf4f6ada7798be1b8208d36674705252c631dd6f844e9
- MD5 64972fe0da09081ef0d7e670413bbb03
- SHA1 0b42848a45e3c890613e46bb647efb39c19d6cb1
- SHA512 c72be206fe7d3832b93af5b250f7ebe2f55c5690462604ee4c693915254c739da193609c34d1124cbd10e64b88447eb8c5099e1324a023a2565b5e4e0aa76ba7
- SSDEEP 24576:JTcPTNrdAcGwqV4aUxuxWQMnGVrZ58wrU02Q/CH+lHRm3nYJlX:INrKcGwqLUxuxWQMS3IbiS+p6nYTX
- MD5 SHA1 SHA512 SSDEEP
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 2 IoCs
pid Process 2308 gamebox.exe 740 gamebox.exe - Loads dropped DLL 9 IoCs
pid Process 2928 6d27a4abf0b2438f8d5cf4f6ada7798be1b8208d36674705252c631dd6f844e9.exe 2928 6d27a4abf0b2438f8d5cf4f6ada7798be1b8208d36674705252c631dd6f844e9.exe 2928 6d27a4abf0b2438f8d5cf4f6ada7798be1b8208d36674705252c631dd6f844e9.exe 2928 6d27a4abf0b2438f8d5cf4f6ada7798be1b8208d36674705252c631dd6f844e9.exe 2928 6d27a4abf0b2438f8d5cf4f6ada7798be1b8208d36674705252c631dd6f844e9.exe 2928 6d27a4abf0b2438f8d5cf4f6ada7798be1b8208d36674705252c631dd6f844e9.exe 2928 6d27a4abf0b2438f8d5cf4f6ada7798be1b8208d36674705252c631dd6f844e9.exe 2928 6d27a4abf0b2438f8d5cf4f6ada7798be1b8208d36674705252c631dd6f844e9.exe 2928 6d27a4abf0b2438f8d5cf4f6ada7798be1b8208d36674705252c631dd6f844e9.exe - Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
description ioc Process File opened for modification \??\PhysicalDrive0 gamebox.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files (x86)\G©f¹CÀ¸²°¤l\Skin\Default\multaccount_down.png 6d27a4abf0b2438f8d5cf4f6ada7798be1b8208d36674705252c631dd6f844e9.exe File created C:\Program Files (x86)\G©f¹CÀ¸²°¤l\Skin\Default\home_down.png 6d27a4abf0b2438f8d5cf4f6ada7798be1b8208d36674705252c631dd6f844e9.exe File created C:\Program Files (x86)\G©f¹CÀ¸²°¤l\Skin\Default\Screenshot_Down.png 6d27a4abf0b2438f8d5cf4f6ada7798be1b8208d36674705252c631dd6f844e9.exe File created C:\Program Files (x86)\G©f¹CÀ¸²°¤l\Skin\Default\game_max_normal.png 6d27a4abf0b2438f8d5cf4f6ada7798be1b8208d36674705252c631dd6f844e9.exe File created C:\Program Files (x86)\G©f¹CÀ¸²°¤l\Skin\Default\FormTLMenu_ShutdownOver.png 6d27a4abf0b2438f8d5cf4f6ada7798be1b8208d36674705252c631dd6f844e9.exe File created C:\Program Files (x86)\G©f¹CÀ¸²°¤l\Skin\Default\Form_Close_Normal.png 6d27a4abf0b2438f8d5cf4f6ada7798be1b8208d36674705252c631dd6f844e9.exe File created C:\Program Files (x86)\G©f¹CÀ¸²°¤l\Skin\Default\bulletin_normal.png 6d27a4abf0b2438f8d5cf4f6ada7798be1b8208d36674705252c631dd6f844e9.exe File created C:\Program Files (x86)\G©f¹CÀ¸²°¤l\Skin\Default\taccelerate_over.png 6d27a4abf0b2438f8d5cf4f6ada7798be1b8208d36674705252c631dd6f844e9.exe File created C:\Program Files (x86)\G©f¹CÀ¸²°¤l\Skin\Default\FormTLMenu_SelClearOver.png 6d27a4abf0b2438f8d5cf4f6ada7798be1b8208d36674705252c631dd6f844e9.exe File created C:\Program Files (x86)\G©f¹CÀ¸²°¤l\Skin\Default\FormSetMenu_VersionSelOver.png 6d27a4abf0b2438f8d5cf4f6ada7798be1b8208d36674705252c631dd6f844e9.exe File created C:\Program Files (x86)\G©f¹CÀ¸²°¤l\Service.ico 6d27a4abf0b2438f8d5cf4f6ada7798be1b8208d36674705252c631dd6f844e9.exe File created C:\Program Files (x86)\G©f¹CÀ¸²°¤l\Skin\Default\SkinDefine.xml 6d27a4abf0b2438f8d5cf4f6ada7798be1b8208d36674705252c631dd6f844e9.exe File created C:\Program Files (x86)\G©f¹CÀ¸²°¤l\Skin\Default\game_set_sel_normal.png 6d27a4abf0b2438f8d5cf4f6ada7798be1b8208d36674705252c631dd6f844e9.exe File created C:\Program Files (x86)\G©f¹CÀ¸²°¤l\Skin\Default\Form_Left.png 6d27a4abf0b2438f8d5cf4f6ada7798be1b8208d36674705252c631dd6f844e9.exe File created C:\Program Files (x86)\G©f¹CÀ¸²°¤l\Skin\Default\Form_AddClock_Down.png 6d27a4abf0b2438f8d5cf4f6ada7798be1b8208d36674705252c631dd6f844e9.exe File created C:\Program Files (x86)\G©f¹CÀ¸²°¤l\Skin\Default\game_nor_normal.png 6d27a4abf0b2438f8d5cf4f6ada7798be1b8208d36674705252c631dd6f844e9.exe File created C:\Program Files (x86)\G©f¹CÀ¸²°¤l\Skin\Default\Form_FullScreen_bg.png 6d27a4abf0b2438f8d5cf4f6ada7798be1b8208d36674705252c631dd6f844e9.exe File created C:\Program Files (x86)\G©f¹CÀ¸²°¤l\Skin\Default\tkeyelves_normal.png 6d27a4abf0b2438f8d5cf4f6ada7798be1b8208d36674705252c631dd6f844e9.exe File created C:\Program Files (x86)\G©f¹CÀ¸²°¤l\Skin\Default\Radio_Unchecked.png 6d27a4abf0b2438f8d5cf4f6ada7798be1b8208d36674705252c631dd6f844e9.exe File created C:\Program Files (x86)\G©f¹CÀ¸²°¤l\Skin\Default\FormTLMenu_Shutdown.png 6d27a4abf0b2438f8d5cf4f6ada7798be1b8208d36674705252c631dd6f844e9.exe File created C:\Program Files (x86)\G©f¹CÀ¸²°¤l\Skin\Default\FormTLMenu_ClockOver.png 6d27a4abf0b2438f8d5cf4f6ada7798be1b8208d36674705252c631dd6f844e9.exe File created C:\Program Files (x86)\G©f¹CÀ¸²°¤l\Skin\Default\FormTLMenu_Clear.png 6d27a4abf0b2438f8d5cf4f6ada7798be1b8208d36674705252c631dd6f844e9.exe File created C:\Program Files (x86)\G©f¹CÀ¸²°¤l\Skin\Default\FormExitMenu_OpenOver.png 6d27a4abf0b2438f8d5cf4f6ada7798be1b8208d36674705252c631dd6f844e9.exe File created C:\Program Files (x86)\G©f¹CÀ¸²°¤l\Skin\Default\stop_record_normal.png 6d27a4abf0b2438f8d5cf4f6ada7798be1b8208d36674705252c631dd6f844e9.exe File created C:\Program Files (x86)\G©f¹CÀ¸²°¤l\Skin\Default\shutdown_down.png 6d27a4abf0b2438f8d5cf4f6ada7798be1b8208d36674705252c631dd6f844e9.exe File created C:\Program Files (x86)\G©f¹CÀ¸²°¤l\Skin\Default\shortcut_normal.png 6d27a4abf0b2438f8d5cf4f6ada7798be1b8208d36674705252c631dd6f844e9.exe File created C:\Program Files (x86)\G©f¹CÀ¸²°¤l\Skin\Default\game_set_sel_down.png 6d27a4abf0b2438f8d5cf4f6ada7798be1b8208d36674705252c631dd6f844e9.exe File created C:\Program Files (x86)\G©f¹CÀ¸²°¤l\Skin\Default\game_set_normal.png 6d27a4abf0b2438f8d5cf4f6ada7798be1b8208d36674705252c631dd6f844e9.exe File created C:\Program Files (x86)\G©f¹CÀ¸²°¤l\Skin\Default\game_close_normal.png 6d27a4abf0b2438f8d5cf4f6ada7798be1b8208d36674705252c631dd6f844e9.exe File created C:\Program Files (x86)\G©f¹CÀ¸²°¤l\Skin\Default\FormMain_Skin_Normal.png 6d27a4abf0b2438f8d5cf4f6ada7798be1b8208d36674705252c631dd6f844e9.exe File created C:\Program Files (x86)\G©f¹CÀ¸²°¤l\Skin\Default\tclock_down.png 6d27a4abf0b2438f8d5cf4f6ada7798be1b8208d36674705252c631dd6f844e9.exe File created C:\Program Files (x86)\G©f¹CÀ¸²°¤l\Skin\Default\Radiobtn_Unchecked.png 6d27a4abf0b2438f8d5cf4f6ada7798be1b8208d36674705252c631dd6f844e9.exe File created C:\Program Files (x86)\G©f¹CÀ¸²°¤l\Skin\Default\gift_normal.png 6d27a4abf0b2438f8d5cf4f6ada7798be1b8208d36674705252c631dd6f844e9.exe File created C:\Program Files (x86)\G©f¹CÀ¸²°¤l\Skin\Default\catechisml_normal.png 6d27a4abf0b2438f8d5cf4f6ada7798be1b8208d36674705252c631dd6f844e9.exe File created C:\Program Files (x86)\G©f¹CÀ¸²°¤l\Skin\Default\game_min_normal.png 6d27a4abf0b2438f8d5cf4f6ada7798be1b8208d36674705252c631dd6f844e9.exe File created C:\Program Files (x86)\G©f¹CÀ¸²°¤l\Skin\Default\game_left.png 6d27a4abf0b2438f8d5cf4f6ada7798be1b8208d36674705252c631dd6f844e9.exe File created C:\Program Files (x86)\G©f¹CÀ¸²°¤l\Skin\Default\FormMulAccount_EnterGame_Over.png 6d27a4abf0b2438f8d5cf4f6ada7798be1b8208d36674705252c631dd6f844e9.exe File created C:\Program Files (x86)\G©f¹CÀ¸²°¤l\Skin\Default\autoclear_over.png 6d27a4abf0b2438f8d5cf4f6ada7798be1b8208d36674705252c631dd6f844e9.exe File created C:\Program Files (x86)\G©f¹CÀ¸²°¤l\Skin\Default\autoclear_normal.png 6d27a4abf0b2438f8d5cf4f6ada7798be1b8208d36674705252c631dd6f844e9.exe File created C:\Program Files (x86)\G©f¹CÀ¸²°¤l\Skin\Default\Form_Title2.png 6d27a4abf0b2438f8d5cf4f6ada7798be1b8208d36674705252c631dd6f844e9.exe File created C:\Program Files (x86)\G©f¹CÀ¸²°¤l\Skin\Default\tcatechisml_down.png 6d27a4abf0b2438f8d5cf4f6ada7798be1b8208d36674705252c631dd6f844e9.exe File created C:\Program Files (x86)\G©f¹CÀ¸²°¤l\Skin\Default\shop_down.png 6d27a4abf0b2438f8d5cf4f6ada7798be1b8208d36674705252c631dd6f844e9.exe File created C:\Program Files (x86)\G©f¹CÀ¸²°¤l\Skin\Default\search_over.png 6d27a4abf0b2438f8d5cf4f6ada7798be1b8208d36674705252c631dd6f844e9.exe File created C:\Program Files (x86)\G©f¹CÀ¸²°¤l\Skin\Default\game_message_over.png 6d27a4abf0b2438f8d5cf4f6ada7798be1b8208d36674705252c631dd6f844e9.exe File created C:\Program Files (x86)\G©f¹CÀ¸²°¤l\Skin\Default\gift_down.png 6d27a4abf0b2438f8d5cf4f6ada7798be1b8208d36674705252c631dd6f844e9.exe File created C:\Program Files (x86)\G©f¹CÀ¸²°¤l\Skin\Default\fullscreen_sel_normal.png 6d27a4abf0b2438f8d5cf4f6ada7798be1b8208d36674705252c631dd6f844e9.exe File created C:\Program Files (x86)\G©f¹CÀ¸²°¤l\Skin\Default\formgame_domain_back.jpg 6d27a4abf0b2438f8d5cf4f6ada7798be1b8208d36674705252c631dd6f844e9.exe File created C:\Program Files (x86)\G©f¹CÀ¸²°¤l\Skin\Default\Form_Title1.png 6d27a4abf0b2438f8d5cf4f6ada7798be1b8208d36674705252c631dd6f844e9.exe File created C:\Program Files (x86)\G©f¹CÀ¸²°¤l\Skin\Default\accelerate_b_down.png 6d27a4abf0b2438f8d5cf4f6ada7798be1b8208d36674705252c631dd6f844e9.exe File created C:\Program Files (x86)\G©f¹CÀ¸²°¤l\Skin\Default\FormMulAccount_Icon.png 6d27a4abf0b2438f8d5cf4f6ada7798be1b8208d36674705252c631dd6f844e9.exe File created C:\Program Files (x86)\G©f¹CÀ¸²°¤l\PrintScreen.exe 6d27a4abf0b2438f8d5cf4f6ada7798be1b8208d36674705252c631dd6f844e9.exe File created C:\Program Files (x86)\G©f¹CÀ¸²°¤l\Skin\Default\tools_sel_normal.png 6d27a4abf0b2438f8d5cf4f6ada7798be1b8208d36674705252c631dd6f844e9.exe File created C:\Program Files (x86)\G©f¹CÀ¸²°¤l\Skin\Default\Progress_Point.png 6d27a4abf0b2438f8d5cf4f6ada7798be1b8208d36674705252c631dd6f844e9.exe File created C:\Program Files (x86)\G©f¹CÀ¸²°¤l\Skin\Default\game_set_down.png 6d27a4abf0b2438f8d5cf4f6ada7798be1b8208d36674705252c631dd6f844e9.exe File created C:\Program Files (x86)\G©f¹CÀ¸²°¤l\Skin\Default\game_left.bmp 6d27a4abf0b2438f8d5cf4f6ada7798be1b8208d36674705252c631dd6f844e9.exe File created C:\Program Files (x86)\G©f¹CÀ¸²°¤l\Skin\Default\FormUserMenu_Safe_Over.png 6d27a4abf0b2438f8d5cf4f6ada7798be1b8208d36674705252c631dd6f844e9.exe File created C:\Program Files (x86)\G©f¹CÀ¸²°¤l\Skin\Default\FormTLMenu_MuteOver.png 6d27a4abf0b2438f8d5cf4f6ada7798be1b8208d36674705252c631dd6f844e9.exe File created C:\Program Files (x86)\G©f¹CÀ¸²°¤l\Skin\Default\Form_Title.png 6d27a4abf0b2438f8d5cf4f6ada7798be1b8208d36674705252c631dd6f844e9.exe File created C:\Program Files (x86)\G©f¹CÀ¸²°¤l\Skin\Default\Form_Close_Over.png 6d27a4abf0b2438f8d5cf4f6ada7798be1b8208d36674705252c631dd6f844e9.exe File created C:\Program Files (x86)\G©f¹CÀ¸²°¤l\Skin\Default\Entergame_Normal.png 6d27a4abf0b2438f8d5cf4f6ada7798be1b8208d36674705252c631dd6f844e9.exe File created C:\Program Files (x86)\G©f¹CÀ¸²°¤l\Skin\Default\Entergame_Down.png 6d27a4abf0b2438f8d5cf4f6ada7798be1b8208d36674705252c631dd6f844e9.exe File created C:\Program Files (x86)\G©f¹CÀ¸²°¤l\Skin\Default\accelerate_b_normal.png 6d27a4abf0b2438f8d5cf4f6ada7798be1b8208d36674705252c631dd6f844e9.exe File created C:\Program Files (x86)\G©f¹CÀ¸²°¤l\Skin\Default\Form_AddClock_Over.png 6d27a4abf0b2438f8d5cf4f6ada7798be1b8208d36674705252c631dd6f844e9.exe File created C:\Program Files (x86)\G©f¹CÀ¸²°¤l\tabGame.exe 6d27a4abf0b2438f8d5cf4f6ada7798be1b8208d36674705252c631dd6f844e9.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\MAIN\FeatureControl\FEATURE_BROWSER_EMULATION 6d27a4abf0b2438f8d5cf4f6ada7798be1b8208d36674705252c631dd6f844e9.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\MAIN\FeatureControl\FEATURE_BROWSER_EMULATION\tabGame.exe = "9999" 6d27a4abf0b2438f8d5cf4f6ada7798be1b8208d36674705252c631dd6f844e9.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\MAIN\FeatureControl\FEATURE_BROWSER_EMULATION\gamebox.exe = "9999" 6d27a4abf0b2438f8d5cf4f6ada7798be1b8208d36674705252c631dd6f844e9.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main gamebox.exe - Modifies registry class 9 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\gmgamebox\shell 6d27a4abf0b2438f8d5cf4f6ada7798be1b8208d36674705252c631dd6f844e9.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\gmgamebox 6d27a4abf0b2438f8d5cf4f6ada7798be1b8208d36674705252c631dd6f844e9.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\gmgamebox\ = "gmgameboxProtocol" 6d27a4abf0b2438f8d5cf4f6ada7798be1b8208d36674705252c631dd6f844e9.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\gmgamebox\DefaultIcon\ = "C:\\Program Files (x86)\\G©f¹CÀ¸²°¤l\\gamebox.exe,1" 6d27a4abf0b2438f8d5cf4f6ada7798be1b8208d36674705252c631dd6f844e9.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\gmgamebox\shell\open\command 6d27a4abf0b2438f8d5cf4f6ada7798be1b8208d36674705252c631dd6f844e9.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\gmgamebox\URL Protocol = "C:\\Program Files (x86)\\G©f¹CÀ¸²°¤l\\gamebox.exe" 6d27a4abf0b2438f8d5cf4f6ada7798be1b8208d36674705252c631dd6f844e9.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\gmgamebox\DefaultIcon 6d27a4abf0b2438f8d5cf4f6ada7798be1b8208d36674705252c631dd6f844e9.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\gmgamebox\shell\open 6d27a4abf0b2438f8d5cf4f6ada7798be1b8208d36674705252c631dd6f844e9.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\gmgamebox\shell\open\command\ = "\"C:\\Program Files (x86)\\G©f¹CÀ¸²°¤l\\gamebox.exe\" \"%1\"" 6d27a4abf0b2438f8d5cf4f6ada7798be1b8208d36674705252c631dd6f844e9.exe - Suspicious behavior: EnumeratesProcesses 13 IoCs
pid Process 2928 6d27a4abf0b2438f8d5cf4f6ada7798be1b8208d36674705252c631dd6f844e9.exe 2928 6d27a4abf0b2438f8d5cf4f6ada7798be1b8208d36674705252c631dd6f844e9.exe 2308 gamebox.exe 2308 gamebox.exe 2308 gamebox.exe 2308 gamebox.exe 2308 gamebox.exe 2308 gamebox.exe 2308 gamebox.exe 2308 gamebox.exe 2308 gamebox.exe 2308 gamebox.exe 2308 gamebox.exe - Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 740 gamebox.exe - Suspicious use of SendNotifyMessage 1 IoCs
pid Process 740 gamebox.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 740 gamebox.exe 740 gamebox.exe - Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 2928 wrote to memory of 2308 2928 6d27a4abf0b2438f8d5cf4f6ada7798be1b8208d36674705252c631dd6f844e9.exe 29 PID 2928 wrote to memory of 2308 2928 6d27a4abf0b2438f8d5cf4f6ada7798be1b8208d36674705252c631dd6f844e9.exe 29 PID 2928 wrote to memory of 2308 2928 6d27a4abf0b2438f8d5cf4f6ada7798be1b8208d36674705252c631dd6f844e9.exe 29 PID 2928 wrote to memory of 2308 2928 6d27a4abf0b2438f8d5cf4f6ada7798be1b8208d36674705252c631dd6f844e9.exe 29 PID 2928 wrote to memory of 740 2928 6d27a4abf0b2438f8d5cf4f6ada7798be1b8208d36674705252c631dd6f844e9.exe 30 PID 2928 wrote to memory of 740 2928 6d27a4abf0b2438f8d5cf4f6ada7798be1b8208d36674705252c631dd6f844e9.exe 30 PID 2928 wrote to memory of 740 2928 6d27a4abf0b2438f8d5cf4f6ada7798be1b8208d36674705252c631dd6f844e9.exe 30 PID 2928 wrote to memory of 740 2928 6d27a4abf0b2438f8d5cf4f6ada7798be1b8208d36674705252c631dd6f844e9.exe 30
Processes
-
C:\Users\Admin\AppData\Local\Temp\6d27a4abf0b2438f8d5cf4f6ada7798be1b8208d36674705252c631dd6f844e9.exe"C:\Users\Admin\AppData\Local\Temp\6d27a4abf0b2438f8d5cf4f6ada7798be1b8208d36674705252c631dd6f844e9.exe"1⤵
- Loads dropped DLL
- Drops file in Program Files directory
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2928 -
C:\Program Files (x86)\G©f¹CÀ¸²°¤l\gamebox.exe"C:\Program Files (x86)\G©f¹CÀ¸²°¤l\gamebox.exe" /setupsucc2⤵
- Executes dropped EXE
- Writes to the Master Boot Record (MBR)
- Suspicious behavior: EnumeratesProcesses
PID:2308
-
-
C:\Program Files (x86)\G©f¹CÀ¸²°¤l\gamebox.exe"C:\Program Files (x86)\G©f¹CÀ¸²°¤l\gamebox.exe" /autorun /setuprun2⤵
- Executes dropped EXE
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:740
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files (x86)\G©f¹CÀ¸²°¤l\Skin\Default\FormMain_Background.jpg
- Size 7KB
- SHA256 25b1530ea1cf06d98a352511273c53419d4c6e1709dc27b3a88f64f05348db24
- MD5 dd15568596806007e87c9675f3786cd1
- SHA1 a3aa4b74d0a7022af9df5b67795c43aab85503b6
- SHA512 789faf3b65a4d352872d7068614e01f694ac0c0750b099ab289b4aabe254f048f06f98759f8debc9217b33f8a0554babf2629d0577d59b8d315ba293c9020baf
- SSDEEP 96:XQ0runVXPZEi+YyHwm1uDoxm9eBqtwTShyCa3YcLWGCDShyV7In:XiVXPJyQkqQqtwuhyCaIcLMVg
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files (x86)\G©f¹CÀ¸²°¤l\Skin\Default\FormMain_BottomBackground.jpg
- Size 1KB
- SHA256 ec10723f8df472ab394c9bbf5f16167b5194402275f26bdb004cd6ea600ff983
- MD5 685ac329c5e719b0251e25ace69b8099
- SHA1 a827bf8985c1b277198ed77f1bf9e730ad7ae76a
- SHA512 f937d73eb24eb307400c8f65dd64ada944d6c1def892b192efa9ce06d2111d9a1b8bc695594540616bd8c84e9f7a1db1dee1c332d856e65e6c173f2772f93e41
- MD5 SHA1 SHA512
- Path C:\Program Files (x86)\G©f¹CÀ¸²°¤l\Skin\Default\FormMain_Close_Down.png
- Size 1KB
- SHA256 a6cf2dba7a2a4fca44e9ef8772831dfbea7f8be5f2e4082a3ae6c45f6d7e5376
- MD5 29fbf50751219abe0d89c0493ed577c0
- SHA1 76cc6ed2c2975166b0fcffdac6f11f76a406dc94
- SHA512 7bb072f6ccd0f11e089c6a965a5601a0895b4b12e364260d4760404f5a7782ff0763e055edc542b20b331cb15433c5a84710bf54434243ffe83344604ad6e4c8
- MD5 SHA1 SHA512
- Path C:\Program Files (x86)\G©f¹CÀ¸²°¤l\Skin\Default\FormMain_Close_Normal.png
- Size 1KB
- SHA256 1915627d189b9b645c2bd93f4f4acc76d0531ccf72ef9e0448cc85cad369ab43
- MD5 a84ac3484179ff165ec884a8bb65953e
- SHA1 8c2eff7189a20e49e6ca1cb24a4ed1fa6a498d91
- SHA512 a3a1537d731d2a3720ebac6b93abd4e69a78551a0670bc9dae9a7599bfc719b62f0dc7db6e2b70974e0c891c8c7cc8dec898cac2b73e48ab242602b0461efb93
- MD5 SHA1 SHA512
- Path C:\Program Files (x86)\G©f¹CÀ¸²°¤l\Skin\Default\FormMain_Close_Over.png
- Size 1KB
- SHA256 a9f748197809ff8e7d19c5e5490d028b17a56ef8938e40a1ad186d3f28ce034a
- MD5 c55c1084e5054cf301317da23e58cb23
- SHA1 9ec89c5a205981b4209dd001264a708b5c90fa95
- SHA512 702fae540a9a9b6bd4566512d3940ef006364c8ea26c5d47efb979355948cac09e83564c073f05c7d507ebccec4556d61770db2beba2d458aea1b474a52d947c
- MD5 SHA1 SHA512
- Path C:\Program Files (x86)\G©f¹CÀ¸²°¤l\Skin\Default\FormMain_Min_Down.png
- Size 1KB
- SHA256 971bc02a755bcca862dbae3b1c31deaa0cbf776fe36acbd985cc034642c6dc91
- MD5 77fb0f85754952b80adec4c9ca8c28a7
- SHA1 0fd426498a9c20174e69bee013ee35470432f335
- SHA512 4e1828a6395793c3ce00bc2885a26547bfb384a8c1206503a1b8506d406d416e184ef700b38e659f7357fedb9129b6c0b5d3f25f356fcd6991e4158b51c96691
- MD5 SHA1 SHA512
- Path C:\Program Files (x86)\G©f¹CÀ¸²°¤l\Skin\Default\FormMain_Min_Normal.png
- Size 1KB
- SHA256 fb3892f351ab4494c9bdcd2efcae6fd44424c01bff883ddcdf62f0957c3230ab
- MD5 53dc89f0a405d1c1939d4584ac7a0d80
- SHA1 afabbf176dae4fee5dcfcf2626408ff80ce1b10d
- SHA512 1ffce9cbb7b05697f332064aa38d017ac77e6e632b775641e23f5efb99fbfcd6e7b1222671587044e6d2cfd690e864f6db93b1338a6196482ef7624638f6697b
- MD5 SHA1 SHA512
- Path C:\Program Files (x86)\G©f¹CÀ¸²°¤l\Skin\Default\FormMain_Min_Over.png
- Size 1KB
- SHA256 08f6ada2c3b87b1e20903ea5667fdbd724752b19332d6c3c446a0aa3e77ae09f
- MD5 525351a09bbd4e70e62ef643629ce76f
- SHA1 e889cb34eebf63ff27bca9e601f0a6081ad2e0cd
- SHA512 53c0e43c1a585ae058734cebe14bb48ec51fdb49e8345d6cceab552d67e0da8de5a755cb85de6a415b9101cc7f81921c896d17d5c2c83c3553f7abbf6b3bbff6
- MD5 SHA1 SHA512
- Path C:\Program Files (x86)\G©f¹CÀ¸²°¤l\Skin\Default\SkinDefine.xml
- Size 44KB
- SHA256 97091ef3ef6be9d9ba958ef4ef55b0f82c46da58dacdd6ddc1710cc3757b882e
- MD5 6a803783a9eeba737c2a132e3f85393b
- SHA1 c272dbb4915321ebe74fbcaba941864783694e58
- SHA512 c8b4f0297a792d68cd3127da990a9a35f4b9ed9f09e0029a8f0e4a619d725f45de9071cb78ca8e560662deb45f7625b860410045747f5d2996d22c66b79a34cf
- SSDEEP 768:Pe5QrVFOUEVFOQ0efJO/g3D/8I8cMemZmKgdthvZyRGH8jTbVtrugLsRygPxrAER:rlb7sfY9e97Ypv97Yp597Yp697Yp797m
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\Cab7274.tmp
- Size 70KB
- SHA256 b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
- MD5 49aebf8cbd62d92ac215b2923fb1b9f5
- SHA1 1723be06719828dda65ad804298d0431f6aff976
- SHA512 bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
- SSDEEP 1536:gc257bHnClJ3v5mnAQEBP+bfnW8Ctl8G1G4eu76NWDdB34w18R5cBWcJAm68+Q:gp2ld5jPqW8LgeulxB3fgcEfDQ
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\Tar72E4.tmp
- Size 181KB
- SHA256 8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
- MD5 4ea6026cf93ec6338144661bf1202cd1
- SHA1 a1dec9044f750ad887935a01430bf49322fbdcb7
- SHA512 6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b
- SSDEEP 1536:aAZw/J+lCUsTRvsqgCyqWlUDNWdm1wpSru2A0XwjY/z02DTr3rmt6mZ:as2J+qTR0XCy/dmASru2AijbdG
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\G©f¹CÀ¸²°¤l.lnk
- Size 1KB
- SHA256 6beaede154bd221766155a01bbdfe5b05afec623d4702074d05d2355a96537a1
- MD5 1c881f33af5814ecad34cb01d1745d4a
- SHA1 cc34b6bba17dd47be1e6c0e21ef78136c4cd63ea
- SHA512 d57a8e2a2db6cca3db85324737daa0d94cd4d1b280de6fb739747b1a64d6a8af69990cd6bacf30ce69e19fc119da678579bbe94579b32b8cdd1ada700f28ce25
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Roaming\gmgames\gamebox\Upgrade\app.ini
- Size 35B
- SHA256 2c607a4fdea2b68be5ac769cfb4bf32e5f377cc3187747c444990ffa83a2331a
- MD5 52f3db1c9cfaebd1a6881022fb17a62c
- SHA1 a49f68b91210680d18768d0a60244f1b1552a69e
- SHA512 bc6473ad43fceb1ae4792f4028326d7c2f8f4c079a4604e6f094db9439715c1c55873afbc4462d5a1e0fd9294169d8fed40f3ad6ca3d5657a21c6d8460c326ce
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Roaming\gmgames\gamebox\config.ini
- Size 306B
- SHA256 ef5d4c3b9e3f155f0520db22c3aac420076aa2b4f6bb8fb6b38619d81b39bb6c
- MD5 3a63c449acbcab52a61fe77bf87d3cfa
- SHA1 0ea6e85a53938239438bcb12cfefb84d4a571b0b
- SHA512 db4ea937b675ae536edf22a9b418638740a24cbcb43c59404b89c797c30f7b5ce0e1f971c97b5db7559cef8036ff8174cb16a728f05cd716710a629d697233e6
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Roaming\gmgames\gamebox\lander.ini
- Size 432B
- SHA256 60a9ca060983adc4442772f9acea69eb4769cc652bc3e0ad692995468c69a4fb
- MD5 1c06e834d0bdb61973301e1dba87ed31
- SHA1 cdfbd1666560e28357f9e0381a7c99c58229e55d
- SHA512 d0c86da06502f6630b1f6c43a243ae1c3e11a797df8489d099b04481df04c10588c09ef29797a4929a9a1e92fab9a0be8c26eaaf6f870d5dc0f6e59de594f296
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Roaming\gmgames\gamebox\lander.ini
- Size 525B
- SHA256 100ec6540bf96490a1f4c4cf52079a02999a0ec6c4a57d1fd9d5b505b3145f1c
- MD5 90ba35d76269cfe985f3cff6f585370c
- SHA1 d8f3cfe455732c6822853057a650e2451cb6c94a
- SHA512 27a6dc7e79b57d3c21da1b78eb22b86de7f121ed447f36853b57c24015b49a693771a748ed2d651fe7695bcc082a08987c46b49f80787bd6723637f91b00de42
- MD5 SHA1 SHA512
- Path \Program Files (x86)\G©f¹CÀ¸²°¤l\gamebox.exe
- Size 1.3MB
- SHA256 9627dacd4cba7a4a7ff107d96e037b20367ad21cbd9f8fddec6d006a1172df38
- MD5 e3b9eb80454af79599c7921741cca862
- SHA1 e127c45748667c325cc7db327728e19a6439c576
- SHA512 0f3d5105f94e414ff872534bef72705b9941081c0df9a79163fcfb66196216b7b2923ed3db46899e06972c4ae4756c5bdeaa9066c71dfa59358e71d7148fd928
- SSDEEP 24576:oThecuUBs2D+MoGcPlLgKaslRTM0yInTBlzIhhB2YEZ8GvkTvN29BTcuQjvi:oThD+RDLlz+hB2YEGGcTlinQjvi
- MD5 SHA1 SHA512 SSDEEP
- Path \Users\Admin\AppData\Local\Temp\nsd5237.tmp\FindProcDLL.dll
- Size 3KB
- SHA256 0fa04f06a6de18d316832086891e9c23ae606d7784d5d5676385839b21ca2758
- MD5 8614c450637267afacad1645e23ba24a
- SHA1 e7b7b09b5bbc13e910aa36316d9cc5fc5d4dcdc2
- SHA512 af46cd679097584ff9a1d894a729b6397f4b3af17dff3e6f07bef257bc7e48ffa341d82daf298616cd5df1450fc5ab7435cacb70f27302b6db193f01a9f8391b
- MD5 SHA1 SHA512
- Path \Users\Admin\AppData\Local\Temp\nsd5237.tmp\SkinProgress.dll
- Size 4KB
- SHA256 888b32ecbc37ce67d4edc28d894cba0a4f4e2488cfc2212d1af011bd0bfe97ff
- MD5 cc037c4703d3ec257efeef2ce0a1a20e
- SHA1 b3d6cc8f687a31fb2c1a5921a38de9429af20502
- SHA512 120bfa0a68775bef04c1863023b0e73a41982284fb36da7f497fbb7d5ed8631ad02fa09951424d339f6fefaa90a17c12f949dd68bb33bad64b1b7cace489d2a7
- MD5 SHA1 SHA512
- Path \Users\Admin\AppData\Local\Temp\nsd5237.tmp\System.dll
- Size 11KB
- SHA256 dc58d8ad81cacb0c1ed72e33bff8f23ea40b5252b5bb55d393a0903e6819ae2f
- MD5 c17103ae9072a06da581dec998343fc1
- SHA1 b72148c6bdfaada8b8c3f950e610ee7cf1da1f8d
- SHA512 d32a71aaef18e993f28096d536e41c4d016850721b31171513ce28bbd805a54fd290b7c3e9d935f72e676a1acfb4f0dcc89d95040a0dd29f2b6975855c18986f
- SSDEEP 192:7DKnJZCv6VmbJQC+tFiUdK7ckD4gRXKQx+LQ2CSF:7ViJrtFRdbmXK8+PCw
- MD5 SHA1 SHA512 SSDEEP
- Path \Users\Admin\AppData\Local\Temp\nsd5237.tmp\WndProc.dll
- Size 3KB
- SHA256 e7b3115fa2ce4a8fa09beeefa4fb634a474197f38a2854ce9be60d0a26016458
- MD5 f0cb331dd4bd92a6ebce45e7cd1cf5ef
- SHA1 b66ea0c10b08750295f2dc7c170b370402393214
- SHA512 7c33418f39b91ae0d4cc8b560f516bac293593eef539832815028878c2058bf1691c2d767a039cf312989839071f2f6f0b6d9d59835acdfff6b448bf1ffea271
- MD5 SHA1 SHA512
- Path \Users\Admin\AppData\Local\Temp\nsd5237.tmp\nsDialogs.dll
- Size 9KB
- SHA256 e31ad6c6e82e603378cb6b80e67d0e0dcd9cf384e1199ac5a65cb4935680021a
- MD5 c10e04dd4ad4277d5adc951bb331c777
- SHA1 b1e30808198a3ae6d6d1cca62df8893dc2a7ad43
- SHA512 853a5564bf751d40484ea482444c6958457cb4a17fb973cf870f03f201b8b2643be41bccde00f6b2026dc0c3d113e6481b0dc4c7b0f3ae7966d38c92c6b5862e
- SSDEEP 96:hBABCcnl5TKhkfLxSslykcxM2DjDf3GE+Xv8Xav+Yx4VndY7ndS27gA:h6n+0SAfRE+/8ZYxMdqn420
- MD5 SHA1 SHA512 SSDEEP