5ffbf12675bb0a3af407a83e83d85adee93e4fb76154f43340963d4f621a9a43

Analysis

max time kernel
119s
max time network
121s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
14/07/2024, 11:04

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

gamebox.exe
Size

2.5MB
MD5

9d7b476a2364dd2bc9e3074e1762bb2b
SHA1

ca5d851df7e076ce1c8e2389f643d1967fb5fc09
SHA256

a14aca4e4807ed1f274ea36325e8e87c2072d4bcab1233c25256f5807be9b5b2
SHA512

ab0cfe4ce97f1f71f1f3235e0fac586d68b6cce9a10b624083148fef638de8e6bcdb3ae5a2807e374eb0f61c790c0e13f8cd29641fb57b7a641a0818f36bc0a5
SSDEEP

49152:ets5HtSXs211dAsedueI70zhPtO31AWFXsII4BItQ5YkE9iJAIeGvAuX3:z5Nis22sedueIgVVO3GIXetsY9iJTvAE

Score

7^/10

Malware Config

Signatures

Loads dropped DLL 1 IoCs

pid	Process
1972	gamebox.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1972	gamebox.exe

C:\Users\Admin\AppData\Local\Temp\gamebox.exe
"C:\Users\Admin\AppData\Local\Temp\gamebox.exe"
1⤵
- Loads dropped DLL
- Suspicious behavior: GetForegroundWindowSpam
PID:1972

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\nsjA7A7.tmp\ioSpecial.ini

Filesize
619B

MD5
4a09da4cfd1487ac1542d2d544db45c2

SHA1
0ea96c2aa70b04cc463087af9ef4629b2c8dd1d6

SHA256
ce3942c3169750be8735f13f75a73b044b0784d9408a60edf4867ccfd2d067ee

SHA512
531f9615c61b6b2bf449a103d711159927b6317d9d2aa0b3744379ba73aef9ac0cb820e2ebf8e1d734b4366bf1bfde7fe2cb256184f2ad5229b274a47b49c251

Download Submit
\Users\Admin\AppData\Local\Temp\nsjA7A7.tmp\InstallOptions.dll

Filesize
14KB

MD5
325b008aec81e5aaa57096f05d4212b5

SHA1
27a2d89747a20305b6518438eff5b9f57f7df5c3

SHA256
c9cd5c9609e70005926ae5171726a4142ffbcccc771d307efcd195dafc1e6b4b

SHA512
18362b3aee529a27e85cc087627ecf6e2d21196d725f499c4a185cb3a380999f43ff1833a8ebec3f5ba1d3a113ef83185770e663854121f2d8b885790115afdf

Download Submit