Overview
overview
7Static
static
36d27a4abf0...e9.exe
windows7-x64
76d27a4abf0...e9.exe
windows10-2004-x64
7$PLUGINSDI...LL.dll
windows7-x64
3$PLUGINSDI...LL.dll
windows10-2004-x64
3$PLUGINSDI...LL.dll
windows7-x64
3$PLUGINSDI...LL.dll
windows10-2004-x64
3$PLUGINSDI...tn.dll
windows7-x64
3$PLUGINSDI...tn.dll
windows10-2004-x64
3$PLUGINSDI...ss.dll
windows7-x64
3$PLUGINSDI...ss.dll
windows10-2004-x64
3$PLUGINSDI...em.dll
windows7-x64
3$PLUGINSDI...em.dll
windows10-2004-x64
3$PLUGINSDI...oc.dll
windows7-x64
3$PLUGINSDI...oc.dll
windows10-2004-x64
3$PLUGINSDI...gs.dll
windows7-x64
3$PLUGINSDI...gs.dll
windows10-2004-x64
3MouseHook.dll
windows7-x64
1MouseHook.dll
windows10-2004-x64
1PrintScreen.exe
windows7-x64
1PrintScreen.exe
windows10-2004-x64
1gamebox.exe
windows7-x64
1gamebox.exe
windows10-2004-x64
1tabGame.exe
windows7-x64
1tabGame.exe
windows10-2004-x64
1uninst.exe
windows7-x64
7uninst.exe
windows10-2004-x64
7$PLUGINSDI...er.dll
windows7-x64
3$PLUGINSDI...er.dll
windows10-2004-x64
3$PLUGINSDI...LL.dll
windows7-x64
3$PLUGINSDI...LL.dll
windows10-2004-x64
3$PLUGINSDI...LL.dll
windows7-x64
3$PLUGINSDI...LL.dll
windows10-2004-x64
3Analysis
- max time kernel
124s - max time network
128s - platform
windows10-2004_x64 - resource
win10v2004-20240611-en - resource tags
arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system - submitted
16/06/2024, 12:12
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
6d27a4abf0b2438f8d5cf4f6ada7798be1b8208d36674705252c631dd6f844e9.exe
Resource
win7-20240611-en
windows7-x64
13 signatures
150 seconds
Behavioral task
behavioral2
Sample
6d27a4abf0b2438f8d5cf4f6ada7798be1b8208d36674705252c631dd6f844e9.exe
Resource
win10v2004-20240611-en
windows10-2004-x64
12 signatures
150 seconds
Behavioral task
behavioral3
Sample
$PLUGINSDIR/FindProcDLL.dll
Resource
win7-20240221-en
windows7-x64
2 signatures
150 seconds
Behavioral task
behavioral4
Sample
$PLUGINSDIR/FindProcDLL.dll
Resource
win10v2004-20240508-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral5
Sample
$PLUGINSDIR/KillProcDLL.dll
Resource
win7-20240508-en
windows7-x64
2 signatures
150 seconds
Behavioral task
behavioral6
Sample
$PLUGINSDIR/KillProcDLL.dll
Resource
win10v2004-20240611-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral7
Sample
$PLUGINSDIR/SkinBtn.dll
Resource
win7-20231129-en
windows7-x64
2 signatures
150 seconds
Behavioral task
behavioral8
Sample
$PLUGINSDIR/SkinBtn.dll
Resource
win10v2004-20240508-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral9
Sample
$PLUGINSDIR/SkinProgress.dll
Resource
win7-20240508-en
windows7-x64
2 signatures
150 seconds
Behavioral task
behavioral10
Sample
$PLUGINSDIR/SkinProgress.dll
Resource
win10v2004-20240508-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral11
Sample
$PLUGINSDIR/System.dll
Resource
win7-20240221-en
windows7-x64
2 signatures
150 seconds
Behavioral task
behavioral12
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20240611-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral13
Sample
$PLUGINSDIR/WndProc.dll
Resource
win7-20240611-en
windows7-x64
2 signatures
150 seconds
Behavioral task
behavioral14
Sample
$PLUGINSDIR/WndProc.dll
Resource
win10v2004-20240508-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral15
Sample
$PLUGINSDIR/nsDialogs.dll
Resource
win7-20240508-en
windows7-x64
2 signatures
150 seconds
Behavioral task
behavioral16
Sample
$PLUGINSDIR/nsDialogs.dll
Resource
win10v2004-20240508-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral17
Sample
MouseHook.dll
Resource
win7-20231129-en
windows7-x64
1 signatures
150 seconds
Behavioral task
behavioral18
Sample
MouseHook.dll
Resource
win10v2004-20240611-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral19
Sample
PrintScreen.exe
Resource
win7-20240221-en
windows7-x64
1 signatures
150 seconds
Behavioral task
behavioral20
Sample
PrintScreen.exe
Resource
win10v2004-20240508-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral21
Sample
gamebox.exe
Resource
win7-20240611-en
windows7-x64
4 signatures
150 seconds
Behavioral task
behavioral22
Sample
gamebox.exe
Resource
win10v2004-20240611-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral23
Sample
tabGame.exe
Resource
win7-20231129-en
windows7-x64
2 signatures
150 seconds
Behavioral task
behavioral24
Sample
tabGame.exe
Resource
win10v2004-20240611-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral25
Sample
uninst.exe
Resource
win7-20240508-en
windows7-x64
7 signatures
150 seconds
Behavioral task
behavioral26
Sample
uninst.exe
Resource
win10v2004-20240611-en
windows10-2004-x64
7 signatures
150 seconds
Behavioral task
behavioral27
Sample
$PLUGINSDIR/BgWorker.dll
Resource
win7-20240508-en
windows7-x64
2 signatures
150 seconds
Behavioral task
behavioral28
Sample
$PLUGINSDIR/BgWorker.dll
Resource
win10v2004-20240611-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral29
Sample
$PLUGINSDIR/FindProcDLL.dll
Resource
win7-20240611-en
windows7-x64
2 signatures
150 seconds
Behavioral task
behavioral30
Sample
$PLUGINSDIR/FindProcDLL.dll
Resource
win10v2004-20240508-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral31
Sample
$PLUGINSDIR/KillProcDLL.dll
Resource
win7-20240508-en
windows7-x64
2 signatures
150 seconds
Behavioral task
behavioral32
Sample
$PLUGINSDIR/KillProcDLL.dll
Resource
win10v2004-20240508-en
windows10-2004-x64
2 signatures
150 seconds
General
- Target 6d27a4abf0b2438f8d5cf4f6ada7798be1b8208d36674705252c631dd6f844e9.exe
- Size 1.5MB
- Sample240616-pdbpvasfph
- SHA256 6d27a4abf0b2438f8d5cf4f6ada7798be1b8208d36674705252c631dd6f844e9
- MD5 64972fe0da09081ef0d7e670413bbb03
- SHA1 0b42848a45e3c890613e46bb647efb39c19d6cb1
- SHA512 c72be206fe7d3832b93af5b250f7ebe2f55c5690462604ee4c693915254c739da193609c34d1124cbd10e64b88447eb8c5099e1324a023a2565b5e4e0aa76ba7
- SSDEEP 24576:JTcPTNrdAcGwqV4aUxuxWQMnGVrZ58wrU02Q/CH+lHRm3nYJlX:INrKcGwqLUxuxWQMS3IbiS+p6nYTX
- MD5 SHA1 SHA512 SSDEEP
Score
7/10
Malware Config
Signatures
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-3665033694-1447845302-680750983-1000\Control Panel\International\Geo\Nation 6d27a4abf0b2438f8d5cf4f6ada7798be1b8208d36674705252c631dd6f844e9.exe - Executes dropped EXE 3 IoCs
pid Process 1052 gamebox.exe 4632 gamebox.exe 4640 gamebox.exe - Loads dropped DLL 11 IoCs
pid Process 5044 6d27a4abf0b2438f8d5cf4f6ada7798be1b8208d36674705252c631dd6f844e9.exe 5044 6d27a4abf0b2438f8d5cf4f6ada7798be1b8208d36674705252c631dd6f844e9.exe 5044 6d27a4abf0b2438f8d5cf4f6ada7798be1b8208d36674705252c631dd6f844e9.exe 5044 6d27a4abf0b2438f8d5cf4f6ada7798be1b8208d36674705252c631dd6f844e9.exe 5044 6d27a4abf0b2438f8d5cf4f6ada7798be1b8208d36674705252c631dd6f844e9.exe 5044 6d27a4abf0b2438f8d5cf4f6ada7798be1b8208d36674705252c631dd6f844e9.exe 5044 6d27a4abf0b2438f8d5cf4f6ada7798be1b8208d36674705252c631dd6f844e9.exe 5044 6d27a4abf0b2438f8d5cf4f6ada7798be1b8208d36674705252c631dd6f844e9.exe 5044 6d27a4abf0b2438f8d5cf4f6ada7798be1b8208d36674705252c631dd6f844e9.exe 5044 6d27a4abf0b2438f8d5cf4f6ada7798be1b8208d36674705252c631dd6f844e9.exe 5044 6d27a4abf0b2438f8d5cf4f6ada7798be1b8208d36674705252c631dd6f844e9.exe - Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
description ioc Process File opened for modification \??\PhysicalDrive0 gamebox.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files (x86)\G©f¹CÀ¸²°¤l\Skin\Default\keyelves_over.png 6d27a4abf0b2438f8d5cf4f6ada7798be1b8208d36674705252c631dd6f844e9.exe File created C:\Program Files (x86)\G©f¹CÀ¸²°¤l\Skin\Default\home_normal.png 6d27a4abf0b2438f8d5cf4f6ada7798be1b8208d36674705252c631dd6f844e9.exe File created C:\Program Files (x86)\G©f¹CÀ¸²°¤l\Skin\Default\game_changesize.png 6d27a4abf0b2438f8d5cf4f6ada7798be1b8208d36674705252c631dd6f844e9.exe File created C:\Program Files (x86)\G©f¹CÀ¸²°¤l\Skin\Default\tshutdown_over.png 6d27a4abf0b2438f8d5cf4f6ada7798be1b8208d36674705252c631dd6f844e9.exe File created C:\Program Files (x86)\G©f¹CÀ¸²°¤l\Skin\Default\top_right.bmp 6d27a4abf0b2438f8d5cf4f6ada7798be1b8208d36674705252c631dd6f844e9.exe File created C:\Program Files (x86)\G©f¹CÀ¸²°¤l\Skin\Default\tkeyelves_down.png 6d27a4abf0b2438f8d5cf4f6ada7798be1b8208d36674705252c631dd6f844e9.exe File created C:\Program Files (x86)\G©f¹CÀ¸²°¤l\Skin\Default\stop_down.png 6d27a4abf0b2438f8d5cf4f6ada7798be1b8208d36674705252c631dd6f844e9.exe File created C:\Program Files (x86)\G©f¹CÀ¸²°¤l\Skin\Default\shutdown_normal.png 6d27a4abf0b2438f8d5cf4f6ada7798be1b8208d36674705252c631dd6f844e9.exe File created C:\Program Files (x86)\G©f¹CÀ¸²°¤l\Skin\Default\FormMulAccount_Add_Normal.png 6d27a4abf0b2438f8d5cf4f6ada7798be1b8208d36674705252c631dd6f844e9.exe File created C:\Program Files (x86)\G©f¹CÀ¸²°¤l\Skin\Default\FormFullScreenMenu_FullScreen_Over.png 6d27a4abf0b2438f8d5cf4f6ada7798be1b8208d36674705252c631dd6f844e9.exe File created C:\Program Files (x86)\G©f¹CÀ¸²°¤l\Skin\Default\bulletin_over.png 6d27a4abf0b2438f8d5cf4f6ada7798be1b8208d36674705252c631dd6f844e9.exe File created C:\Program Files (x86)\G©f¹CÀ¸²°¤l\Skin\Default\Form_Edit_Round.png 6d27a4abf0b2438f8d5cf4f6ada7798be1b8208d36674705252c631dd6f844e9.exe File created C:\Program Files (x86)\G©f¹CÀ¸²°¤l\Skin\Default\Form_Delete_Squarely.png 6d27a4abf0b2438f8d5cf4f6ada7798be1b8208d36674705252c631dd6f844e9.exe File created C:\Program Files (x86)\G©f¹CÀ¸²°¤l\Skin\Default\Form_MulAccount_Background.png 6d27a4abf0b2438f8d5cf4f6ada7798be1b8208d36674705252c631dd6f844e9.exe File created C:\Program Files (x86)\G©f¹CÀ¸²°¤l\Skin\Default\more_down.png 6d27a4abf0b2438f8d5cf4f6ada7798be1b8208d36674705252c631dd6f844e9.exe File created C:\Program Files (x86)\G©f¹CÀ¸²°¤l\Skin\Default\game_close_normal.png 6d27a4abf0b2438f8d5cf4f6ada7798be1b8208d36674705252c631dd6f844e9.exe File created C:\Program Files (x86)\G©f¹CÀ¸²°¤l\Skin\Default\fullscreen_menu_over.png 6d27a4abf0b2438f8d5cf4f6ada7798be1b8208d36674705252c631dd6f844e9.exe File created C:\Program Files (x86)\G©f¹CÀ¸²°¤l\Skin\Default\FormMain_Skin_Down.png 6d27a4abf0b2438f8d5cf4f6ada7798be1b8208d36674705252c631dd6f844e9.exe File created C:\Program Files (x86)\G©f¹CÀ¸²°¤l\Skin\Default\Form_Help_Over.png 6d27a4abf0b2438f8d5cf4f6ada7798be1b8208d36674705252c631dd6f844e9.exe File created C:\Program Files (x86)\G©f¹CÀ¸²°¤l\Skin\Default\record_down.png 6d27a4abf0b2438f8d5cf4f6ada7798be1b8208d36674705252c631dd6f844e9.exe File created C:\Program Files (x86)\G©f¹CÀ¸²°¤l\Skin\Default\FormTLMenu_ClearOver.png 6d27a4abf0b2438f8d5cf4f6ada7798be1b8208d36674705252c631dd6f844e9.exe File created C:\Program Files (x86)\G©f¹CÀ¸²°¤l\Skin\Default\Form_Help_Normal.png 6d27a4abf0b2438f8d5cf4f6ada7798be1b8208d36674705252c631dd6f844e9.exe File created C:\Program Files (x86)\G©f¹CÀ¸²°¤l\Skin\Default\Form_DropDown_Normal.png 6d27a4abf0b2438f8d5cf4f6ada7798be1b8208d36674705252c631dd6f844e9.exe File created C:\Program Files (x86)\G©f¹CÀ¸²°¤l\Skin\Default\stop_over.png 6d27a4abf0b2438f8d5cf4f6ada7798be1b8208d36674705252c631dd6f844e9.exe File created C:\Program Files (x86)\G©f¹CÀ¸²°¤l\Skin\Default\Progress_Roll.png 6d27a4abf0b2438f8d5cf4f6ada7798be1b8208d36674705252c631dd6f844e9.exe File created C:\Program Files (x86)\G©f¹CÀ¸²°¤l\Skin\Default\FormSetMenu_FeedBack.png 6d27a4abf0b2438f8d5cf4f6ada7798be1b8208d36674705252c631dd6f844e9.exe File created C:\Program Files (x86)\G©f¹CÀ¸²°¤l\Skin\Default\FormMulAccount_EnterGame_Normal.png 6d27a4abf0b2438f8d5cf4f6ada7798be1b8208d36674705252c631dd6f844e9.exe File created C:\Program Files (x86)\G©f¹CÀ¸²°¤l\Skin\Default\voice_down.png 6d27a4abf0b2438f8d5cf4f6ada7798be1b8208d36674705252c631dd6f844e9.exe File created C:\Program Files (x86)\G©f¹CÀ¸²°¤l\Skin\Default\signin_over.png 6d27a4abf0b2438f8d5cf4f6ada7798be1b8208d36674705252c631dd6f844e9.exe File created C:\Program Files (x86)\G©f¹CÀ¸²°¤l\Skin\Default\search_down.png 6d27a4abf0b2438f8d5cf4f6ada7798be1b8208d36674705252c631dd6f844e9.exe File created C:\Program Files (x86)\G©f¹CÀ¸²°¤l\Skin\Default\game_nor_over.png 6d27a4abf0b2438f8d5cf4f6ada7798be1b8208d36674705252c631dd6f844e9.exe File created C:\Program Files (x86)\G©f¹CÀ¸²°¤l\Skin\Default\FormSetMenu_Version.png 6d27a4abf0b2438f8d5cf4f6ada7798be1b8208d36674705252c631dd6f844e9.exe File created C:\Program Files (x86)\G©f¹CÀ¸²°¤l\Skin\Default\tab_background.bmp 6d27a4abf0b2438f8d5cf4f6ada7798be1b8208d36674705252c631dd6f844e9.exe File created C:\Program Files (x86)\G©f¹CÀ¸²°¤l\Skin\Default\FormExitMenu_SetOver.png 6d27a4abf0b2438f8d5cf4f6ada7798be1b8208d36674705252c631dd6f844e9.exe File created C:\Program Files (x86)\G©f¹CÀ¸²°¤l\Skin\Default\Form_FullScreen_Lock.png 6d27a4abf0b2438f8d5cf4f6ada7798be1b8208d36674705252c631dd6f844e9.exe File created C:\Program Files (x86)\G©f¹CÀ¸²°¤l\Skin\Default\clock_down.png 6d27a4abf0b2438f8d5cf4f6ada7798be1b8208d36674705252c631dd6f844e9.exe File created C:\Program Files (x86)\G©f¹CÀ¸²°¤l\Skin\Default\tab_head_over.png 6d27a4abf0b2438f8d5cf4f6ada7798be1b8208d36674705252c631dd6f844e9.exe File created C:\Program Files (x86)\G©f¹CÀ¸²°¤l\Skin\Default\stop_replay_over.png 6d27a4abf0b2438f8d5cf4f6ada7798be1b8208d36674705252c631dd6f844e9.exe File created C:\Program Files (x86)\G©f¹CÀ¸²°¤l\Skin\Default\FormTLMenu_AccelerateOver.png 6d27a4abf0b2438f8d5cf4f6ada7798be1b8208d36674705252c631dd6f844e9.exe File created C:\Program Files (x86)\G©f¹CÀ¸²°¤l\Skin\Default\FormMulAccount_Line.jpg 6d27a4abf0b2438f8d5cf4f6ada7798be1b8208d36674705252c631dd6f844e9.exe File created C:\Program Files (x86)\G©f¹CÀ¸²°¤l\Skin\Default\Form_RemindBg.png 6d27a4abf0b2438f8d5cf4f6ada7798be1b8208d36674705252c631dd6f844e9.exe File created C:\Program Files (x86)\G©f¹CÀ¸²°¤l\Skin\Default\FormTLMenu_Catechisml.png 6d27a4abf0b2438f8d5cf4f6ada7798be1b8208d36674705252c631dd6f844e9.exe File created C:\Program Files (x86)\G©f¹CÀ¸²°¤l\Skin\Default\FormSetMenu_About.png 6d27a4abf0b2438f8d5cf4f6ada7798be1b8208d36674705252c631dd6f844e9.exe File created C:\Program Files (x86)\G©f¹CÀ¸²°¤l\Skin\Default\Form_FullScreen_Exit_Over.png 6d27a4abf0b2438f8d5cf4f6ada7798be1b8208d36674705252c631dd6f844e9.exe File created C:\Program Files (x86)\G©f¹CÀ¸²°¤l\MouseHook.dll 6d27a4abf0b2438f8d5cf4f6ada7798be1b8208d36674705252c631dd6f844e9.exe File created C:\Program Files (x86)\G©f¹CÀ¸²°¤l\Skin\Default\shutdown_down.png 6d27a4abf0b2438f8d5cf4f6ada7798be1b8208d36674705252c631dd6f844e9.exe File created C:\Program Files (x86)\G©f¹CÀ¸²°¤l\Skin\Default\ScrollPercent_Over.png 6d27a4abf0b2438f8d5cf4f6ada7798be1b8208d36674705252c631dd6f844e9.exe File created C:\Program Files (x86)\G©f¹CÀ¸²°¤l\Skin\Default\fullscreen_menu_down.png 6d27a4abf0b2438f8d5cf4f6ada7798be1b8208d36674705252c631dd6f844e9.exe File created C:\Program Files (x86)\G©f¹CÀ¸²°¤l\Skin\Default\FormTLMuen_AccountOver.png 6d27a4abf0b2438f8d5cf4f6ada7798be1b8208d36674705252c631dd6f844e9.exe File created C:\Program Files (x86)\G©f¹CÀ¸²°¤l\Skin\Default\Form_Background.png 6d27a4abf0b2438f8d5cf4f6ada7798be1b8208d36674705252c631dd6f844e9.exe File created C:\Program Files (x86)\G©f¹CÀ¸²°¤l\Skin\Default\fb_normal.png 6d27a4abf0b2438f8d5cf4f6ada7798be1b8208d36674705252c631dd6f844e9.exe File created C:\Program Files (x86)\G©f¹CÀ¸²°¤l\Skin\Default\tmultaccount_over.png 6d27a4abf0b2438f8d5cf4f6ada7798be1b8208d36674705252c631dd6f844e9.exe File created C:\Program Files (x86)\G©f¹CÀ¸²°¤l\Skin\Default\game_rolladvert.png 6d27a4abf0b2438f8d5cf4f6ada7798be1b8208d36674705252c631dd6f844e9.exe File created C:\Program Files (x86)\G©f¹CÀ¸²°¤l\Skin\Default\FormTLMenu_SelClearOver.png 6d27a4abf0b2438f8d5cf4f6ada7798be1b8208d36674705252c631dd6f844e9.exe File created C:\Program Files (x86)\G©f¹CÀ¸²°¤l\Skin\Default\FormSetMenu_SetOver.png 6d27a4abf0b2438f8d5cf4f6ada7798be1b8208d36674705252c631dd6f844e9.exe File created C:\Program Files (x86)\G©f¹CÀ¸²°¤l\Skin\Default\catechisml_over.png 6d27a4abf0b2438f8d5cf4f6ada7798be1b8208d36674705252c631dd6f844e9.exe File created C:\Program Files (x86)\G©f¹CÀ¸²°¤l\Skin\Default\Progress_Point.png 6d27a4abf0b2438f8d5cf4f6ada7798be1b8208d36674705252c631dd6f844e9.exe File created C:\Program Files (x86)\G©f¹CÀ¸²°¤l\Skin\Default\more_sel_normal.png 6d27a4abf0b2438f8d5cf4f6ada7798be1b8208d36674705252c631dd6f844e9.exe File created C:\Program Files (x86)\G©f¹CÀ¸²°¤l\Skin\Default\game_min_over.png 6d27a4abf0b2438f8d5cf4f6ada7798be1b8208d36674705252c631dd6f844e9.exe File created C:\Program Files (x86)\G©f¹CÀ¸²°¤l\Skin\Default\Form_Min1_Normal.png 6d27a4abf0b2438f8d5cf4f6ada7798be1b8208d36674705252c631dd6f844e9.exe File created C:\Program Files (x86)\G©f¹CÀ¸²°¤l\Skin\Default\upgrade_over.png 6d27a4abf0b2438f8d5cf4f6ada7798be1b8208d36674705252c631dd6f844e9.exe File created C:\Program Files (x86)\G©f¹CÀ¸²°¤l\Skin\Default\game_set_sel_over.png 6d27a4abf0b2438f8d5cf4f6ada7798be1b8208d36674705252c631dd6f844e9.exe File created C:\Program Files (x86)\G©f¹CÀ¸²°¤l\Skin\Default\game_nor_down.png 6d27a4abf0b2438f8d5cf4f6ada7798be1b8208d36674705252c631dd6f844e9.exe File created C:\Program Files (x86)\G©f¹CÀ¸²°¤l\Skin\Default\FormSetMenu_Officical.png 6d27a4abf0b2438f8d5cf4f6ada7798be1b8208d36674705252c631dd6f844e9.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\MAIN\FeatureControl\FEATURE_BROWSER_EMULATION 6d27a4abf0b2438f8d5cf4f6ada7798be1b8208d36674705252c631dd6f844e9.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION\tabGame.exe = "9999" 6d27a4abf0b2438f8d5cf4f6ada7798be1b8208d36674705252c631dd6f844e9.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION\gamebox.exe = "9999" 6d27a4abf0b2438f8d5cf4f6ada7798be1b8208d36674705252c631dd6f844e9.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\MAIN\FeatureControl\FEATURE_BROWSER_EMULATION 6d27a4abf0b2438f8d5cf4f6ada7798be1b8208d36674705252c631dd6f844e9.exe - Modifies registry class 9 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\gmgamebox 6d27a4abf0b2438f8d5cf4f6ada7798be1b8208d36674705252c631dd6f844e9.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\gmgamebox\DefaultIcon 6d27a4abf0b2438f8d5cf4f6ada7798be1b8208d36674705252c631dd6f844e9.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\gmgamebox\DefaultIcon\ = "C:\\Program Files (x86)\\G©f¹CÀ¸²°¤l\\gamebox.exe,1" 6d27a4abf0b2438f8d5cf4f6ada7798be1b8208d36674705252c631dd6f844e9.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\gmgamebox\shell 6d27a4abf0b2438f8d5cf4f6ada7798be1b8208d36674705252c631dd6f844e9.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\gmgamebox\shell\open\command\ = "\"C:\\Program Files (x86)\\G©f¹CÀ¸²°¤l\\gamebox.exe\" \"%1\"" 6d27a4abf0b2438f8d5cf4f6ada7798be1b8208d36674705252c631dd6f844e9.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\gmgamebox\ = "gmgameboxProtocol" 6d27a4abf0b2438f8d5cf4f6ada7798be1b8208d36674705252c631dd6f844e9.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\gmgamebox\URL Protocol = "C:\\Program Files (x86)\\G©f¹CÀ¸²°¤l\\gamebox.exe" 6d27a4abf0b2438f8d5cf4f6ada7798be1b8208d36674705252c631dd6f844e9.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\gmgamebox\shell\open\command 6d27a4abf0b2438f8d5cf4f6ada7798be1b8208d36674705252c631dd6f844e9.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\gmgamebox\shell\open 6d27a4abf0b2438f8d5cf4f6ada7798be1b8208d36674705252c631dd6f844e9.exe - Suspicious behavior: EnumeratesProcesses 26 IoCs
pid Process 5044 6d27a4abf0b2438f8d5cf4f6ada7798be1b8208d36674705252c631dd6f844e9.exe 5044 6d27a4abf0b2438f8d5cf4f6ada7798be1b8208d36674705252c631dd6f844e9.exe 5044 6d27a4abf0b2438f8d5cf4f6ada7798be1b8208d36674705252c631dd6f844e9.exe 5044 6d27a4abf0b2438f8d5cf4f6ada7798be1b8208d36674705252c631dd6f844e9.exe 4632 gamebox.exe 4632 gamebox.exe 4632 gamebox.exe 4632 gamebox.exe 4632 gamebox.exe 4632 gamebox.exe 4632 gamebox.exe 4632 gamebox.exe 4632 gamebox.exe 4632 gamebox.exe 4632 gamebox.exe 4632 gamebox.exe 4632 gamebox.exe 4632 gamebox.exe 4632 gamebox.exe 4632 gamebox.exe 4632 gamebox.exe 4632 gamebox.exe 4632 gamebox.exe 4632 gamebox.exe 4632 gamebox.exe 4632 gamebox.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 1052 gamebox.exe 1052 gamebox.exe - Suspicious use of WriteProcessMemory 9 IoCs
description pid Process procid_target PID 5044 wrote to memory of 1052 5044 6d27a4abf0b2438f8d5cf4f6ada7798be1b8208d36674705252c631dd6f844e9.exe 92 PID 5044 wrote to memory of 1052 5044 6d27a4abf0b2438f8d5cf4f6ada7798be1b8208d36674705252c631dd6f844e9.exe 92 PID 5044 wrote to memory of 1052 5044 6d27a4abf0b2438f8d5cf4f6ada7798be1b8208d36674705252c631dd6f844e9.exe 92 PID 5044 wrote to memory of 4632 5044 6d27a4abf0b2438f8d5cf4f6ada7798be1b8208d36674705252c631dd6f844e9.exe 94 PID 5044 wrote to memory of 4632 5044 6d27a4abf0b2438f8d5cf4f6ada7798be1b8208d36674705252c631dd6f844e9.exe 94 PID 5044 wrote to memory of 4632 5044 6d27a4abf0b2438f8d5cf4f6ada7798be1b8208d36674705252c631dd6f844e9.exe 94 PID 5044 wrote to memory of 4640 5044 6d27a4abf0b2438f8d5cf4f6ada7798be1b8208d36674705252c631dd6f844e9.exe 95 PID 5044 wrote to memory of 4640 5044 6d27a4abf0b2438f8d5cf4f6ada7798be1b8208d36674705252c631dd6f844e9.exe 95 PID 5044 wrote to memory of 4640 5044 6d27a4abf0b2438f8d5cf4f6ada7798be1b8208d36674705252c631dd6f844e9.exe 95
Processes
-
C:\Users\Admin\AppData\Local\Temp\6d27a4abf0b2438f8d5cf4f6ada7798be1b8208d36674705252c631dd6f844e9.exe"C:\Users\Admin\AppData\Local\Temp\6d27a4abf0b2438f8d5cf4f6ada7798be1b8208d36674705252c631dd6f844e9.exe"1⤵
- Checks computer location settings
- Loads dropped DLL
- Drops file in Program Files directory
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:5044 -
C:\Program Files (x86)\G©f¹CÀ¸²°¤l\gamebox.exe"C:\Program Files (x86)\G©f¹CÀ¸²°¤l\gamebox.exe" SW_SHOWNORMAL2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1052
-
-
C:\Program Files (x86)\G©f¹CÀ¸²°¤l\gamebox.exe"C:\Program Files (x86)\G©f¹CÀ¸²°¤l\gamebox.exe" /setupsucc2⤵
- Executes dropped EXE
- Writes to the Master Boot Record (MBR)
- Suspicious behavior: EnumeratesProcesses
PID:4632
-
-
C:\Program Files (x86)\G©f¹CÀ¸²°¤l\gamebox.exe"C:\Program Files (x86)\G©f¹CÀ¸²°¤l\gamebox.exe" /autorun /setuprun2⤵
- Executes dropped EXE
PID:4640
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=4224,i,3833046924978547022,12404847742964713612,262144 --variations-seed-version --mojo-platform-channel-handle=3780 /prefetch:81⤵PID:2772
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files (x86)\G©f¹CÀ¸²°¤l\Skin\Default\FormMain_Background.jpg
- Size 7KB
- SHA256 25b1530ea1cf06d98a352511273c53419d4c6e1709dc27b3a88f64f05348db24
- MD5 dd15568596806007e87c9675f3786cd1
- SHA1 a3aa4b74d0a7022af9df5b67795c43aab85503b6
- SHA512 789faf3b65a4d352872d7068614e01f694ac0c0750b099ab289b4aabe254f048f06f98759f8debc9217b33f8a0554babf2629d0577d59b8d315ba293c9020baf
- SSDEEP 96:XQ0runVXPZEi+YyHwm1uDoxm9eBqtwTShyCa3YcLWGCDShyV7In:XiVXPJyQkqQqtwuhyCaIcLMVg
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files (x86)\G©f¹CÀ¸²°¤l\Skin\Default\FormMain_BottomBackground.jpg
- Size 1KB
- SHA256 ec10723f8df472ab394c9bbf5f16167b5194402275f26bdb004cd6ea600ff983
- MD5 685ac329c5e719b0251e25ace69b8099
- SHA1 a827bf8985c1b277198ed77f1bf9e730ad7ae76a
- SHA512 f937d73eb24eb307400c8f65dd64ada944d6c1def892b192efa9ce06d2111d9a1b8bc695594540616bd8c84e9f7a1db1dee1c332d856e65e6c173f2772f93e41
- MD5 SHA1 SHA512
- Path C:\Program Files (x86)\G©f¹CÀ¸²°¤l\Skin\Default\FormMain_Close_Down.png
- Size 1KB
- SHA256 a6cf2dba7a2a4fca44e9ef8772831dfbea7f8be5f2e4082a3ae6c45f6d7e5376
- MD5 29fbf50751219abe0d89c0493ed577c0
- SHA1 76cc6ed2c2975166b0fcffdac6f11f76a406dc94
- SHA512 7bb072f6ccd0f11e089c6a965a5601a0895b4b12e364260d4760404f5a7782ff0763e055edc542b20b331cb15433c5a84710bf54434243ffe83344604ad6e4c8
- MD5 SHA1 SHA512
- Path C:\Program Files (x86)\G©f¹CÀ¸²°¤l\Skin\Default\FormMain_Close_Normal.png
- Size 1KB
- SHA256 1915627d189b9b645c2bd93f4f4acc76d0531ccf72ef9e0448cc85cad369ab43
- MD5 a84ac3484179ff165ec884a8bb65953e
- SHA1 8c2eff7189a20e49e6ca1cb24a4ed1fa6a498d91
- SHA512 a3a1537d731d2a3720ebac6b93abd4e69a78551a0670bc9dae9a7599bfc719b62f0dc7db6e2b70974e0c891c8c7cc8dec898cac2b73e48ab242602b0461efb93
- MD5 SHA1 SHA512
- Path C:\Program Files (x86)\G©f¹CÀ¸²°¤l\Skin\Default\FormMain_Close_Over.png
- Size 1KB
- SHA256 a9f748197809ff8e7d19c5e5490d028b17a56ef8938e40a1ad186d3f28ce034a
- MD5 c55c1084e5054cf301317da23e58cb23
- SHA1 9ec89c5a205981b4209dd001264a708b5c90fa95
- SHA512 702fae540a9a9b6bd4566512d3940ef006364c8ea26c5d47efb979355948cac09e83564c073f05c7d507ebccec4556d61770db2beba2d458aea1b474a52d947c
- MD5 SHA1 SHA512
- Path C:\Program Files (x86)\G©f¹CÀ¸²°¤l\Skin\Default\FormMain_Min_Down.png
- Size 1KB
- SHA256 971bc02a755bcca862dbae3b1c31deaa0cbf776fe36acbd985cc034642c6dc91
- MD5 77fb0f85754952b80adec4c9ca8c28a7
- SHA1 0fd426498a9c20174e69bee013ee35470432f335
- SHA512 4e1828a6395793c3ce00bc2885a26547bfb384a8c1206503a1b8506d406d416e184ef700b38e659f7357fedb9129b6c0b5d3f25f356fcd6991e4158b51c96691
- MD5 SHA1 SHA512
- Path C:\Program Files (x86)\G©f¹CÀ¸²°¤l\Skin\Default\FormMain_Min_Normal.png
- Size 1KB
- SHA256 fb3892f351ab4494c9bdcd2efcae6fd44424c01bff883ddcdf62f0957c3230ab
- MD5 53dc89f0a405d1c1939d4584ac7a0d80
- SHA1 afabbf176dae4fee5dcfcf2626408ff80ce1b10d
- SHA512 1ffce9cbb7b05697f332064aa38d017ac77e6e632b775641e23f5efb99fbfcd6e7b1222671587044e6d2cfd690e864f6db93b1338a6196482ef7624638f6697b
- MD5 SHA1 SHA512
- Path C:\Program Files (x86)\G©f¹CÀ¸²°¤l\Skin\Default\FormMain_Min_Over.png
- Size 1KB
- SHA256 08f6ada2c3b87b1e20903ea5667fdbd724752b19332d6c3c446a0aa3e77ae09f
- MD5 525351a09bbd4e70e62ef643629ce76f
- SHA1 e889cb34eebf63ff27bca9e601f0a6081ad2e0cd
- SHA512 53c0e43c1a585ae058734cebe14bb48ec51fdb49e8345d6cceab552d67e0da8de5a755cb85de6a415b9101cc7f81921c896d17d5c2c83c3553f7abbf6b3bbff6
- MD5 SHA1 SHA512
- Path C:\Program Files (x86)\G©f¹CÀ¸²°¤l\Skin\Default\SkinDefine.xml
- Size 44KB
- SHA256 97091ef3ef6be9d9ba958ef4ef55b0f82c46da58dacdd6ddc1710cc3757b882e
- MD5 6a803783a9eeba737c2a132e3f85393b
- SHA1 c272dbb4915321ebe74fbcaba941864783694e58
- SHA512 c8b4f0297a792d68cd3127da990a9a35f4b9ed9f09e0029a8f0e4a619d725f45de9071cb78ca8e560662deb45f7625b860410045747f5d2996d22c66b79a34cf
- SSDEEP 768:Pe5QrVFOUEVFOQ0efJO/g3D/8I8cMemZmKgdthvZyRGH8jTbVtrugLsRygPxrAER:rlb7sfY9e97Ypv97Yp597Yp697Yp797m
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files (x86)\G©f¹CÀ¸²°¤l\gamebox.exe
- Size 1.3MB
- SHA256 9627dacd4cba7a4a7ff107d96e037b20367ad21cbd9f8fddec6d006a1172df38
- MD5 e3b9eb80454af79599c7921741cca862
- SHA1 e127c45748667c325cc7db327728e19a6439c576
- SHA512 0f3d5105f94e414ff872534bef72705b9941081c0df9a79163fcfb66196216b7b2923ed3db46899e06972c4ae4756c5bdeaa9066c71dfa59358e71d7148fd928
- SSDEEP 24576:oThecuUBs2D+MoGcPlLgKaslRTM0yInTBlzIhhB2YEZ8GvkTvN29BTcuQjvi:oThD+RDLlz+hB2YEGGcTlinQjvi
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\nsjF5EB.tmp\FindProcDLL.dll
- Size 3KB
- SHA256 0fa04f06a6de18d316832086891e9c23ae606d7784d5d5676385839b21ca2758
- MD5 8614c450637267afacad1645e23ba24a
- SHA1 e7b7b09b5bbc13e910aa36316d9cc5fc5d4dcdc2
- SHA512 af46cd679097584ff9a1d894a729b6397f4b3af17dff3e6f07bef257bc7e48ffa341d82daf298616cd5df1450fc5ab7435cacb70f27302b6db193f01a9f8391b
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Temp\nsjF5EB.tmp\SkinProgress.dll
- Size 4KB
- SHA256 888b32ecbc37ce67d4edc28d894cba0a4f4e2488cfc2212d1af011bd0bfe97ff
- MD5 cc037c4703d3ec257efeef2ce0a1a20e
- SHA1 b3d6cc8f687a31fb2c1a5921a38de9429af20502
- SHA512 120bfa0a68775bef04c1863023b0e73a41982284fb36da7f497fbb7d5ed8631ad02fa09951424d339f6fefaa90a17c12f949dd68bb33bad64b1b7cace489d2a7
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Temp\nsjF5EB.tmp\System.dll
- Size 11KB
- SHA256 dc58d8ad81cacb0c1ed72e33bff8f23ea40b5252b5bb55d393a0903e6819ae2f
- MD5 c17103ae9072a06da581dec998343fc1
- SHA1 b72148c6bdfaada8b8c3f950e610ee7cf1da1f8d
- SHA512 d32a71aaef18e993f28096d536e41c4d016850721b31171513ce28bbd805a54fd290b7c3e9d935f72e676a1acfb4f0dcc89d95040a0dd29f2b6975855c18986f
- SSDEEP 192:7DKnJZCv6VmbJQC+tFiUdK7ckD4gRXKQx+LQ2CSF:7ViJrtFRdbmXK8+PCw
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\nsjF5EB.tmp\WndProc.dll
- Size 3KB
- SHA256 e7b3115fa2ce4a8fa09beeefa4fb634a474197f38a2854ce9be60d0a26016458
- MD5 f0cb331dd4bd92a6ebce45e7cd1cf5ef
- SHA1 b66ea0c10b08750295f2dc7c170b370402393214
- SHA512 7c33418f39b91ae0d4cc8b560f516bac293593eef539832815028878c2058bf1691c2d767a039cf312989839071f2f6f0b6d9d59835acdfff6b448bf1ffea271
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Temp\nsjF5EB.tmp\nsDialogs.dll
- Size 9KB
- SHA256 e31ad6c6e82e603378cb6b80e67d0e0dcd9cf384e1199ac5a65cb4935680021a
- MD5 c10e04dd4ad4277d5adc951bb331c777
- SHA1 b1e30808198a3ae6d6d1cca62df8893dc2a7ad43
- SHA512 853a5564bf751d40484ea482444c6958457cb4a17fb973cf870f03f201b8b2643be41bccde00f6b2026dc0c3d113e6481b0dc4c7b0f3ae7966d38c92c6b5862e
- SSDEEP 96:hBABCcnl5TKhkfLxSslykcxM2DjDf3GE+Xv8Xav+Yx4VndY7ndS27gA:h6n+0SAfRE+/8ZYxMdqn420
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\gmgames\gamebox\Lander.ini
- Size 453B
- SHA256 0fb93edd85eed994e9a9e0f3a726c95d91369b355670280fa66cd8ba1f8c7654
- MD5 d15521eb65734c023da1e04bd151c846
- SHA1 675bc6dbf726d8b5e5a651288fdabd7d9b5a50a7
- SHA512 39a88c19f6194ba118f5e26d9c94b376b322208c60e49d5fdaa5d68c26d4027008548898db12bae8077aa791747e5a045d9c1ea933f7d82e9500fa717c9e70d5
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Roaming\gmgames\gamebox\config.ini
- Size 306B
- SHA256 ef5d4c3b9e3f155f0520db22c3aac420076aa2b4f6bb8fb6b38619d81b39bb6c
- MD5 3a63c449acbcab52a61fe77bf87d3cfa
- SHA1 0ea6e85a53938239438bcb12cfefb84d4a571b0b
- SHA512 db4ea937b675ae536edf22a9b418638740a24cbcb43c59404b89c797c30f7b5ce0e1f971c97b5db7559cef8036ff8174cb16a728f05cd716710a629d697233e6
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Roaming\gmgames\gamebox\lander.ini
- Size 432B
- SHA256 60a9ca060983adc4442772f9acea69eb4769cc652bc3e0ad692995468c69a4fb
- MD5 1c06e834d0bdb61973301e1dba87ed31
- SHA1 cdfbd1666560e28357f9e0381a7c99c58229e55d
- SHA512 d0c86da06502f6630b1f6c43a243ae1c3e11a797df8489d099b04481df04c10588c09ef29797a4929a9a1e92fab9a0be8c26eaaf6f870d5dc0f6e59de594f296
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Roaming\gmgames\gamebox\lander.ini
- Size 498B
- SHA256 f9d35a2a027d9ff11cb15d7d126860f1aa064ea9828eccb5ce24c68a93d3d97f
- MD5 09dad02797c0d199ecbc9e149b4dbe66
- SHA1 49a38719184ce78340dff176c47686d5b3f15a49
- SHA512 038e910203cc932119e82dbf2f57018f10bcce63a2a0504441e25a82f2bc15e7a76e4d0d77e509c1dd6ec980e3bf1e9f9191984d72b2c7aa3205a25aeb90d60c
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Roaming\gmgames\gamebox\lander.ini
- Size 537B
- SHA256 acab8a3a636942d0d6ffc3c7da9a6f8c5775d66891d3ebecae30fb8085cda0ea
- MD5 f7bc753485050449969fe5f8929f109a
- SHA1 a8bd025906d459f426c322e82904df549ce008bf
- SHA512 726d7186ca1a918dff13186b600f4854cac0d936b36891b4af6cde671c05569a3985250f7618f1c2389b94bce616e3d68bd8ce6abcf20245352d26852eab7017
- MD5 SHA1 SHA512