Analysis

  • max time kernel
    148s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240611-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
  • submitted
    16-06-2024 20:48

General

  • Target

    gamebox.exe

  • Size

    2.8MB

  • MD5

    096b6470db9da516a4cae074c172ac98

  • SHA1

    1af437bae48d5e87d68c89711b2cbf3e581fbe7a

  • SHA256

    8435b0b2306f5d48cc119c7fba8501c3edad71e5f47ec27a4a2e3408e30913b3

  • SHA512

    276b15aecf76109c0a6f760d3b4b070d3e0d7c8691d537bca61d7667a5c277466785c586809140e0bbb62ba2f96d7aa8ecae4588867fbb9094bb7f0c60ac9d7e

  • SSDEEP

    49152:kDtu+HSgpOSpSQpbOJWWDD3t1vrhM+scRsITkWYqeXH+HZ91+FgjZCu7wK:kDE2Sgp1SmyJLt1jdsceXH+j

Score
6/10

Malware Config

Signatures

  • Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

    Bootkits write to the MBR to gain persistence at a level below the operating system.

  • Suspicious behavior: EnumeratesProcesses 62 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\gamebox.exe
    "C:\Users\Admin\AppData\Local\Temp\gamebox.exe"
    1⤵
    • Writes to the Master Boot Record (MBR)
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:3896

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Roaming\37games\gamebox\Lander.ini

    Filesize

    87B

    MD5

    3ad4a3abfe81df3b0108713295d8dd4f

    SHA1

    87231f7137cd6ec1719d940b837a6de3e3be80e0

    SHA256

    979ab9c301c2cfd0e42ead9e153425f487f9a9a1cfce6cd12f7660a6e61676fd

    SHA512

    3c6d3e7648d659e87fea272c6748a82d74808e2aacffe2fd26ed988abdd470f7e4e3cc10fe0b2837166364945cd09b2c0d14f097d16e018480db9b0f8bb674d5

  • memory/3896-10-0x00000000000B0000-0x00000000000B1000-memory.dmp

    Filesize

    4KB

  • memory/3896-18-0x0000000000400000-0x0000000000401000-memory.dmp

    Filesize

    4KB

  • memory/3896-3-0x0000000000040000-0x0000000000041000-memory.dmp

    Filesize

    4KB

  • memory/3896-4-0x0000000000050000-0x0000000000051000-memory.dmp

    Filesize

    4KB

  • memory/3896-5-0x0000000000060000-0x0000000000061000-memory.dmp

    Filesize

    4KB

  • memory/3896-6-0x0000000000070000-0x0000000000071000-memory.dmp

    Filesize

    4KB

  • memory/3896-7-0x0000000000080000-0x0000000000081000-memory.dmp

    Filesize

    4KB

  • memory/3896-11-0x00000000000C0000-0x00000000000C1000-memory.dmp

    Filesize

    4KB

  • memory/3896-1-0x0000000000020000-0x0000000000021000-memory.dmp

    Filesize

    4KB

  • memory/3896-2-0x0000000000030000-0x0000000000031000-memory.dmp

    Filesize

    4KB

  • memory/3896-8-0x0000000000090000-0x0000000000091000-memory.dmp

    Filesize

    4KB

  • memory/3896-12-0x00000000000D0000-0x00000000000D1000-memory.dmp

    Filesize

    4KB

  • memory/3896-13-0x00000000000E0000-0x00000000000E1000-memory.dmp

    Filesize

    4KB

  • memory/3896-14-0x00000000000F0000-0x00000000000F1000-memory.dmp

    Filesize

    4KB

  • memory/3896-15-0x0000000000100000-0x0000000000101000-memory.dmp

    Filesize

    4KB

  • memory/3896-16-0x0000000000110000-0x0000000000111000-memory.dmp

    Filesize

    4KB

  • memory/3896-17-0x00000000003F0000-0x00000000003F1000-memory.dmp

    Filesize

    4KB

  • memory/3896-0-0x0000000000010000-0x0000000000011000-memory.dmp

    Filesize

    4KB

  • memory/3896-19-0x0000000000410000-0x0000000000411000-memory.dmp

    Filesize

    4KB

  • memory/3896-9-0x00000000000A0000-0x00000000000A1000-memory.dmp

    Filesize

    4KB