Analysis

  • max time kernel
    129s
  • max time network
    123s
  • platform
    windows7_x64
  • resource
    win7-20240611-en
  • resource tags

    arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
  • submitted
    16-06-2024 20:48

General

  • Target

    gamebox.exe

  • Size

    2.8MB

  • MD5

    096b6470db9da516a4cae074c172ac98

  • SHA1

    1af437bae48d5e87d68c89711b2cbf3e581fbe7a

  • SHA256

    8435b0b2306f5d48cc119c7fba8501c3edad71e5f47ec27a4a2e3408e30913b3

  • SHA512

    276b15aecf76109c0a6f760d3b4b070d3e0d7c8691d537bca61d7667a5c277466785c586809140e0bbb62ba2f96d7aa8ecae4588867fbb9094bb7f0c60ac9d7e

  • SSDEEP

    49152:kDtu+HSgpOSpSQpbOJWWDD3t1vrhM+scRsITkWYqeXH+HZ91+FgjZCu7wK:kDE2Sgp1SmyJLt1jdsceXH+j

Score
6/10

Malware Config

Signatures

  • Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

    Bootkits write to the MBR to gain persistence at a level below the operating system.

  • Modifies Internet Explorer settings 1 TTPs 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 31 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SendNotifyMessage 1 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\gamebox.exe
    "C:\Users\Admin\AppData\Local\Temp\gamebox.exe"
    1⤵
    • Writes to the Master Boot Record (MBR)
    • Modifies Internet Explorer settings
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of SetWindowsHookEx
    PID:2872

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Roaming\37games\gamebox\Lander.ini

    Filesize

    87B

    MD5

    72d84a25258c3d810ae898909a45c3da

    SHA1

    3d3193d360f2699a5aeaeb14a55aaff30cbf8b78

    SHA256

    17ab79d372c5463b1209f94c5930f25d9a777d3f4131c4ea5aa5bd35ee6b5db3

    SHA512

    cdad46990db87038fc88aa3c2da7747c1cb2ad5b219f6eca37ec397a3e5ef9c0388aef547da4ac0938112aa88d4ae7676394ef342bfad5d7f3c583b872566b4c

  • C:\Users\Admin\AppData\Roaming\37games\gamebox\Upgrade\app.ini

    Filesize

    211B

    MD5

    7e24410c1cc00eef38e7ed4b881f31b1

    SHA1

    bbb6241907bcd611a881211d120020d3efbdb592

    SHA256

    b6b3083ff0b1d428f92e176510b3a7a1e5274d9a4ffef0174f1f4e30f4ed2d31

    SHA512

    93c9c45971a42324b3fe0c445d86bae756a248f7e9e9c9ecc60bf1765432978282b2fc814c6071cd5b65946eb5c9b95cc2d45d021eaa6ce5a998d2f55f78154f

  • C:\Users\Admin\AppData\Roaming\37games\gamebox\option.ini

    Filesize

    847B

    MD5

    a3aed3f395c042f131a76390f74b3c9d

    SHA1

    d490a5319cbac06f8a06293f085e1c961a42dea6

    SHA256

    dcd6680bfd400614819793b8cae17f47e6dd91b228bbf89230f09a543be5d258

    SHA512

    c7f3a4c50982aa298fa634d30c874f510d124ba448a1251531d6ad50a0e0a3b783d63a5a90730d219ffbf5ef5c2a881bbc54217a5fed99a43985ea39ada05033

  • memory/2872-10-0x0000000000220000-0x0000000000221000-memory.dmp

    Filesize

    4KB

  • memory/2872-12-0x00000000002C0000-0x00000000002C1000-memory.dmp

    Filesize

    4KB

  • memory/2872-4-0x0000000000180000-0x0000000000181000-memory.dmp

    Filesize

    4KB

  • memory/2872-3-0x00000000000C0000-0x00000000000C1000-memory.dmp

    Filesize

    4KB

  • memory/2872-7-0x00000000001F0000-0x00000000001F1000-memory.dmp

    Filesize

    4KB

  • memory/2872-8-0x0000000000200000-0x0000000000201000-memory.dmp

    Filesize

    4KB

  • memory/2872-9-0x0000000000210000-0x0000000000211000-memory.dmp

    Filesize

    4KB

  • memory/2872-0-0x0000000000090000-0x0000000000091000-memory.dmp

    Filesize

    4KB

  • memory/2872-11-0x00000000002B0000-0x00000000002B1000-memory.dmp

    Filesize

    4KB

  • memory/2872-5-0x0000000000190000-0x0000000000191000-memory.dmp

    Filesize

    4KB

  • memory/2872-13-0x00000000002D0000-0x00000000002D1000-memory.dmp

    Filesize

    4KB

  • memory/2872-14-0x00000000002E0000-0x00000000002E1000-memory.dmp

    Filesize

    4KB

  • memory/2872-15-0x00000000003F0000-0x00000000003F1000-memory.dmp

    Filesize

    4KB

  • memory/2872-16-0x0000000000400000-0x0000000000401000-memory.dmp

    Filesize

    4KB

  • memory/2872-17-0x0000000000410000-0x0000000000411000-memory.dmp

    Filesize

    4KB

  • memory/2872-18-0x0000000000420000-0x0000000000421000-memory.dmp

    Filesize

    4KB

  • memory/2872-19-0x0000000000430000-0x0000000000431000-memory.dmp

    Filesize

    4KB

  • memory/2872-6-0x00000000001A0000-0x00000000001A1000-memory.dmp

    Filesize

    4KB

  • memory/2872-1-0x00000000000A0000-0x00000000000A1000-memory.dmp

    Filesize

    4KB

  • memory/2872-2-0x00000000000B0000-0x00000000000B1000-memory.dmp

    Filesize

    4KB