Overview
overview
7Static
static
3b521286a52...18.exe
windows7-x64
7b521286a52...18.exe
windows10-2004-x64
7$PLUGINSDI...LL.dll
windows7-x64
3$PLUGINSDI...LL.dll
windows10-2004-x64
3$PLUGINSDI...LL.dll
windows7-x64
3$PLUGINSDI...LL.dll
windows10-2004-x64
3$PLUGINSDI...se.rtf
windows7-x64
4$PLUGINSDI...se.rtf
windows10-2004-x64
1$PLUGINSDI...tn.dll
windows7-x64
3$PLUGINSDI...tn.dll
windows10-2004-x64
3$PLUGINSDI...ss.dll
windows7-x64
3$PLUGINSDI...ss.dll
windows10-2004-x64
3$PLUGINSDI...em.dll
windows7-x64
3$PLUGINSDI...em.dll
windows10-2004-x64
3$PLUGINSDI...oc.dll
windows7-x64
3$PLUGINSDI...oc.dll
windows10-2004-x64
3$PLUGINSDI...gs.dll
windows7-x64
3$PLUGINSDI...gs.dll
windows10-2004-x64
3$_47_/Web/error.html
windows7-x64
1$_47_/Web/error.html
windows10-2004-x64
1Accelerator.dll
windows7-x64
1Accelerator.dll
windows10-2004-x64
1Basicsurvey.exe
windows7-x64
1Basicsurvey.exe
windows10-2004-x64
1BoxDoctor.exe
windows7-x64
1BoxDoctor.exe
windows10-2004-x64
1MouseHook.dll
windows7-x64
1MouseHook.dll
windows10-2004-x64
1Socks.dll
windows7-x64
1Socks.dll
windows10-2004-x64
1gamebox.exe
windows7-x64
6gamebox.exe
windows10-2004-x64
6Analysis
-
max time kernel
129s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240611-en -
resource tags
arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system -
submitted
16-06-2024 20:48
Static task
static1
Behavioral task
behavioral1
Sample
b521286a522fa3051998f4d7a14bae33_JaffaCakes118.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
b521286a522fa3051998f4d7a14bae33_JaffaCakes118.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral3
Sample
$PLUGINSDIR/FindProcDLL.dll
Resource
win7-20240508-en
Behavioral task
behavioral4
Sample
$PLUGINSDIR/FindProcDLL.dll
Resource
win10v2004-20240611-en
Behavioral task
behavioral5
Sample
$PLUGINSDIR/KillProcDLL.dll
Resource
win7-20240611-en
Behavioral task
behavioral6
Sample
$PLUGINSDIR/KillProcDLL.dll
Resource
win10v2004-20240508-en
Behavioral task
behavioral7
Sample
$PLUGINSDIR/License.rtf
Resource
win7-20240220-en
Behavioral task
behavioral8
Sample
$PLUGINSDIR/License.rtf
Resource
win10v2004-20240611-en
Behavioral task
behavioral9
Sample
$PLUGINSDIR/SkinBtn.dll
Resource
win7-20240508-en
Behavioral task
behavioral10
Sample
$PLUGINSDIR/SkinBtn.dll
Resource
win10v2004-20240611-en
Behavioral task
behavioral11
Sample
$PLUGINSDIR/SkinProgress.dll
Resource
win7-20240611-en
Behavioral task
behavioral12
Sample
$PLUGINSDIR/SkinProgress.dll
Resource
win10v2004-20240226-en
Behavioral task
behavioral13
Sample
$PLUGINSDIR/System.dll
Resource
win7-20240220-en
Behavioral task
behavioral14
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20240611-en
Behavioral task
behavioral15
Sample
$PLUGINSDIR/WndProc.dll
Resource
win7-20240508-en
Behavioral task
behavioral16
Sample
$PLUGINSDIR/WndProc.dll
Resource
win10v2004-20240611-en
Behavioral task
behavioral17
Sample
$PLUGINSDIR/nsDialogs.dll
Resource
win7-20240611-en
Behavioral task
behavioral18
Sample
$PLUGINSDIR/nsDialogs.dll
Resource
win10v2004-20240611-en
Behavioral task
behavioral19
Sample
$_47_/Web/error.html
Resource
win7-20240508-en
Behavioral task
behavioral20
Sample
$_47_/Web/error.html
Resource
win10v2004-20240508-en
Behavioral task
behavioral21
Sample
Accelerator.dll
Resource
win7-20240221-en
Behavioral task
behavioral22
Sample
Accelerator.dll
Resource
win10v2004-20240508-en
Behavioral task
behavioral23
Sample
Basicsurvey.exe
Resource
win7-20240508-en
Behavioral task
behavioral24
Sample
Basicsurvey.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral25
Sample
BoxDoctor.exe
Resource
win7-20240611-en
Behavioral task
behavioral26
Sample
BoxDoctor.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral27
Sample
MouseHook.dll
Resource
win7-20240508-en
Behavioral task
behavioral28
Sample
MouseHook.dll
Resource
win10v2004-20240611-en
Behavioral task
behavioral29
Sample
Socks.dll
Resource
win7-20240220-en
Behavioral task
behavioral30
Sample
Socks.dll
Resource
win10v2004-20240611-en
Behavioral task
behavioral31
Sample
gamebox.exe
Resource
win7-20240611-en
Behavioral task
behavioral32
Sample
gamebox.exe
Resource
win10v2004-20240611-en
General
-
Target
gamebox.exe
-
Size
2.8MB
-
MD5
096b6470db9da516a4cae074c172ac98
-
SHA1
1af437bae48d5e87d68c89711b2cbf3e581fbe7a
-
SHA256
8435b0b2306f5d48cc119c7fba8501c3edad71e5f47ec27a4a2e3408e30913b3
-
SHA512
276b15aecf76109c0a6f760d3b4b070d3e0d7c8691d537bca61d7667a5c277466785c586809140e0bbb62ba2f96d7aa8ecae4588867fbb9094bb7f0c60ac9d7e
-
SSDEEP
49152:kDtu+HSgpOSpSQpbOJWWDD3t1vrhM+scRsITkWYqeXH+HZ91+FgjZCu7wK:kDE2Sgp1SmyJLt1jdsceXH+j
Malware Config
Signatures
-
Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
Processes:
gamebox.exedescription ioc process File opened for modification \??\PhysicalDrive0 gamebox.exe -
Processes:
gamebox.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main gamebox.exe -
Suspicious behavior: EnumeratesProcesses 31 IoCs
Processes:
gamebox.exepid process 2872 gamebox.exe 2872 gamebox.exe 2872 gamebox.exe 2872 gamebox.exe 2872 gamebox.exe 2872 gamebox.exe 2872 gamebox.exe 2872 gamebox.exe 2872 gamebox.exe 2872 gamebox.exe 2872 gamebox.exe 2872 gamebox.exe 2872 gamebox.exe 2872 gamebox.exe 2872 gamebox.exe 2872 gamebox.exe 2872 gamebox.exe 2872 gamebox.exe 2872 gamebox.exe 2872 gamebox.exe 2872 gamebox.exe 2872 gamebox.exe 2872 gamebox.exe 2872 gamebox.exe 2872 gamebox.exe 2872 gamebox.exe 2872 gamebox.exe 2872 gamebox.exe 2872 gamebox.exe 2872 gamebox.exe 2872 gamebox.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
gamebox.exepid process 2872 gamebox.exe -
Suspicious use of SendNotifyMessage 1 IoCs
Processes:
gamebox.exepid process 2872 gamebox.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
gamebox.exepid process 2872 gamebox.exe 2872 gamebox.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\gamebox.exe"C:\Users\Admin\AppData\Local\Temp\gamebox.exe"1⤵
- Writes to the Master Boot Record (MBR)
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:2872
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
87B
MD572d84a25258c3d810ae898909a45c3da
SHA13d3193d360f2699a5aeaeb14a55aaff30cbf8b78
SHA25617ab79d372c5463b1209f94c5930f25d9a777d3f4131c4ea5aa5bd35ee6b5db3
SHA512cdad46990db87038fc88aa3c2da7747c1cb2ad5b219f6eca37ec397a3e5ef9c0388aef547da4ac0938112aa88d4ae7676394ef342bfad5d7f3c583b872566b4c
-
Filesize
211B
MD57e24410c1cc00eef38e7ed4b881f31b1
SHA1bbb6241907bcd611a881211d120020d3efbdb592
SHA256b6b3083ff0b1d428f92e176510b3a7a1e5274d9a4ffef0174f1f4e30f4ed2d31
SHA51293c9c45971a42324b3fe0c445d86bae756a248f7e9e9c9ecc60bf1765432978282b2fc814c6071cd5b65946eb5c9b95cc2d45d021eaa6ce5a998d2f55f78154f
-
Filesize
847B
MD5a3aed3f395c042f131a76390f74b3c9d
SHA1d490a5319cbac06f8a06293f085e1c961a42dea6
SHA256dcd6680bfd400614819793b8cae17f47e6dd91b228bbf89230f09a543be5d258
SHA512c7f3a4c50982aa298fa634d30c874f510d124ba448a1251531d6ad50a0e0a3b783d63a5a90730d219ffbf5ef5c2a881bbc54217a5fed99a43985ea39ada05033