Overview

overview

7

Static

static

3

b1a93a43d8...18.exe

windows7-x64

7

b1a93a43d8...18.exe

windows10-2004-x64

7

$PLUGINSDI...er.dll

windows7-x64

3

$PLUGINSDI...er.dll

windows10-2004-x64

3

$PLUGINSDI...er.exe

windows7-x64

3

$PLUGINSDI...er.exe

windows10-2004-x64

3

$PLUGINSDI...ar.exe

windows7-x64

3

$PLUGINSDI...ar.exe

windows10-2004-x64

3

$PLUGINSDI...em.dll

windows7-x64

3

$PLUGINSDI...em.dll

windows10-2004-x64

3

$PLUGINSDI...ec.dll

windows7-x64

3

$PLUGINSDI...ec.dll

windows10-2004-x64

3

$PLUGINSDI...ne.exe

windows7-x64

7

$PLUGINSDI...ne.exe

windows10-2004-x64

7

AdminWorker.exe

windows7-x64

3

AdminWorker.exe

windows10-2004-x64

3

Uninstall.exe

windows7-x64

7

Uninstall.exe

windows10-2004-x64

7

$PLUGINSDI...er.dll

windows7-x64

3

$PLUGINSDI...er.dll

windows10-2004-x64

3

$PLUGINSDI...em.dll

windows7-x64

3

$PLUGINSDI...em.dll

windows10-2004-x64

3

WebInstaller.exe

windows7-x64

6

WebInstaller.exe

windows10-2004-x64

6

WebUpdater.exe

windows7-x64

3

WebUpdater.exe

windows10-2004-x64

3

content/iwa-ovr.js

windows7-x64

3

content/iwa-ovr.js

windows10-2004-x64

3

content/iwinarcade.js

windows7-x64

3

content/iwinarcade.js

windows10-2004-x64

3

content/un...l.html

windows7-x64

3

content/un...l.html

windows10-2004-x64

3

Analysis

  • max time kernel
    117s
  • max time network
    120s
  • platform
    windows7_x64
  • resource
    win7-20240708-en
  • resource tags

    arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
  • submitted
    21/08/2024, 01:39 UTC

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    $PLUGINSDIR/InstGameInfoHelper.exe

  • Size

    99KB

  • MD5

    3d3d2bf9c42dbdf97247775c00f22190

  • SHA1

    7a046170aaeb5e1a29d8c8cd7c32225f49237aa1

  • SHA256

    59f09ba2c79a209008e76d0478bb691a9fdb2180d84318d9fc73b10401aa853a

  • SHA512

    6e66c4ff467e286cd5dc1d4ccd412fec32cfd01514db6c339fd275eaab5f3b549e223e9330bc61ff19048df70b81b66dfcc78ac351aa2c5ff45cf8d197140466

  • SSDEEP

    1536:3HzOAUoqkqff6SgsbBa8zl2P2Mv1LkZ0v/lAZMnLHI595a6QNt8kcTT:3CAUoqkPSjlsboGnLHo95a65FTT

Score
3/10
discovery

Malware Config

Signatures

  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies system certificate store 2 TTPs 7 IoCs
    evasionspywaretrojan

Processes

  • C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\InstGameInfoHelper.exe
    "C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\InstGameInfoHelper.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Modifies system certificate store
    PID:2624

Network

  • flag-us
    DNS
    www.iwin.com
    InstGameInfoHelper.exe
    Remote address:
    8.8.8.8:53
    Request
    www.iwin.com
    IN A
    Response
    www.iwin.com
    IN CNAME
    iwin-routing-alb-2041963653.us-east-1.elb.amazonaws.com
    iwin-routing-alb-2041963653.us-east-1.elb.amazonaws.com
    IN A
    34.232.40.94
    iwin-routing-alb-2041963653.us-east-1.elb.amazonaws.com
    IN A
    3.214.132.149
    iwin-routing-alb-2041963653.us-east-1.elb.amazonaws.com
    IN A
    34.206.98.238
  • flag-us
    GET
    http://www.iwin.com/arcade/rawinfo/2463082850695827969/2463082858382377731
    InstGameInfoHelper.exe
    Remote address:
    34.232.40.94:80
    Request
    GET /arcade/rawinfo/2463082850695827969/2463082858382377731 HTTP/1.1
    User-Agent: iWin GameInfo Installer Helper
    Host: www.iwin.com
    Response
    HTTP/1.1 301 https://www.iwin.com/arcade/rawinfo/2463082850695827969/2463082858382377731
    Date: Wed, 21 Aug 2024 01:39:50 GMT
    Transfer-Encoding: chunked
    Connection: keep-alive
    Location: https://www.iwin.com/arcade/rawinfo/2463082850695827969/2463082858382377731
    Accept-Ranges: bytes
    Age: 0
    Via: 1.1 varnish
    Set-Cookie: iwindevice=pc-other; Path=/; Domain=.iwin.com; Expires=Mon, 09-Nov-2099 00:00:00 GMT; Secure
    Set-Cookie: ugm3device=pc-other; Path=/; Domain=.iwin.com; Expires=Thu, 01 Jan 1970 00:00:00 GMT; Secure
    Set-Cookie: forced=ugm3; Path=/; Domain=.iwin.com; Expires=Thu, 01 Jan 1970 00:00:00 GMT; Secure
  • flag-us
    GET
    https://www.iwin.com/arcade/rawinfo/2463082850695827969/2463082858382377731
    InstGameInfoHelper.exe
    Remote address:
    34.232.40.94:443
    Request
    GET /arcade/rawinfo/2463082850695827969/2463082858382377731 HTTP/1.1
    User-Agent: iWin GameInfo Installer Helper
    Host: www.iwin.com
    Connection: Keep-Alive
    Cookie: iwindevice=pc-other
    Response
    HTTP/1.1 200 OK
    Date: Wed, 21 Aug 2024 01:39:52 GMT
    Content-Type: text/plain;charset=utf-8
    Content-Length: 867
    Connection: keep-alive
    Cache-Control: no-cache, private, max-age=0, s-max-age=0, must-revalidate
    Vary: iWin-App
    P3P: CP="NOI CURo ADMo DEVo TAIo OUR NOR IND COM NAV"
    X-DETECTED-DEVICE: pc-other
    Accept-Ranges: bytes
    Age: 0
    Via: 1.1 varnish
    Strict-Transport-Security: max-age=31536000
    Set-Cookie: iwindevice=pc-other; Path=/; Domain=.iwin.com; Expires=Mon, 09-Nov-2099 00:00:00 GMT; Secure
    Set-Cookie: ugm3device=pc-other; Path=/; Domain=.iwin.com; Expires=Thu, 01 Jan 1970 00:00:00 GMT; Secure
    Set-Cookie: forced=ugm3; Path=/; Domain=.iwin.com; Expires=Thu, 01 Jan 1970 00:00:00 GMT; Secure
  • flag-us
    DNS
    ocsp.r2m03.amazontrust.com
    InstGameInfoHelper.exe
    Remote address:
    8.8.8.8:53
    Request
    ocsp.r2m03.amazontrust.com
    IN A
    Response
    ocsp.r2m03.amazontrust.com
    IN A
    143.204.67.183
  • flag-gb
    GET
    http://ocsp.r2m03.amazontrust.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQqHI%2BsdmapawQncL1rpCEZZ8gTSAQUVdkYX9IczAHhWLS%2Bq9lVQgHXLgICEA8wkGcUKsb9V5NGX7y58Tw%3D
    InstGameInfoHelper.exe
    Remote address:
    143.204.67.183:80
    Request
    GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQqHI%2BsdmapawQncL1rpCEZZ8gTSAQUVdkYX9IczAHhWLS%2Bq9lVQgHXLgICEA8wkGcUKsb9V5NGX7y58Tw%3D HTTP/1.1
    Connection: Keep-Alive
    Accept: */*
    User-Agent: Microsoft-CryptoAPI/6.1
    Host: ocsp.r2m03.amazontrust.com
    Response
    HTTP/1.1 200 OK
    Content-Type: application/ocsp-response
    Content-Length: 471
    Connection: keep-alive
    Accept-Ranges: bytes
    Cache-Control: max-age=7200
    Date: Wed, 21 Aug 2024 00:20:48 GMT
    Last-Modified: Wed, 21 Aug 2024 00:20:47 GMT
    Server: ECAcc (lhd/3599)
    X-Cache: Hit from cloudfront
    Via: 1.1 622dda1d37c6c071fbb7b1381dd6abb4.cloudfront.net (CloudFront)
    X-Amz-Cf-Pop: LHR61-P1
    X-Amz-Cf-Id: z8DKuPm7LT5ohaGl-dj_WaPHHuKiYFtJ6g5j2LXx6AEClm4VMU5gNA==
    Age: 4744
  • flag-us
    DNS
    img.iwin.com
    InstGameInfoHelper.exe
    Remote address:
    8.8.8.8:53
    Request
    img.iwin.com
    IN A
    Response
    img.iwin.com
    IN CNAME
    img-lb.aws.iwin.com
    img-lb.aws.iwin.com
    IN CNAME
    cdn.aws.iwin.com
    cdn.aws.iwin.com
    IN CNAME
    d2onl1l5v18u1k.cloudfront.net
    d2onl1l5v18u1k.cloudfront.net
    IN A
    143.204.68.65
    d2onl1l5v18u1k.cloudfront.net
    IN A
    143.204.68.16
    d2onl1l5v18u1k.cloudfront.net
    IN A
    143.204.68.129
    d2onl1l5v18u1k.cloudfront.net
    IN A
    143.204.68.118
  • flag-gb
    GET
    http://img.iwin.com/images/product/2463082850695827969/tn_feat.jpg
    InstGameInfoHelper.exe
    Remote address:
    143.204.68.65:80
    Request
    GET /images/product/2463082850695827969/tn_feat.jpg HTTP/1.1
    User-Agent: iWin GameInfo Installer Helper
    Host: img.iwin.com
    Response
    HTTP/1.1 200 OK
    Content-Type: image/jpeg
    Content-Length: 1597
    Connection: keep-alive
    Date: Wed, 21 Aug 2024 01:39:53 GMT
    Last-Modified: Thu, 01 May 2014 17:09:53 GMT
    ETag: "33342452e289486b79ea1660c10dda8b"
    Accept-Ranges: bytes
    Server: AmazonS3
    Access-Control-Allow-Origin: *
    Access-Control-Allow-Methods: GET, OPTIONS
    Access-Control-Allow-Headers: X-Requested-With, Accept
    Access-Control-Max-Age: 86400
    Cache-Control: max-age=86400, s-maxage=2592000
    X-Cache: Hit from cloudfront
    Via: 1.1 d988e8f8d1d61c3f00c34e2ca94238fa.cloudfront.net (CloudFront)
    X-Amz-Cf-Pop: LHR61-P1
    X-Amz-Cf-Id: uJTWPzo0H5FP1u-xAplyhsxok7rdQyWNSTALONGBh2DHVQgfQky2ew==
  • flag-us
    DNS
    crl.microsoft.com
    Remote address:
    8.8.8.8:53
    Request
    crl.microsoft.com
    IN A
    Response
    crl.microsoft.com
    IN CNAME
    crl.www.ms.akadns.net
    crl.www.ms.akadns.net
    IN CNAME
    a1363.dscg.akamai.net
    a1363.dscg.akamai.net
    IN A
    2.18.190.71
    a1363.dscg.akamai.net
    IN A
    2.18.190.80
  • flag-gb
    GET
    http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
    Remote address:
    2.18.190.71:80
    Request
    GET /pki/crl/products/MicRooCerAut2011_2011_03_22.crl HTTP/1.1
    Connection: Keep-Alive
    Accept: */*
    If-Modified-Since: Wed, 01 May 2024 09:28:59 GMT
    User-Agent: Microsoft-CryptoAPI/6.1
    Host: crl.microsoft.com
    Response
    HTTP/1.1 200 OK
    Content-Length: 1036
    Content-Type: application/octet-stream
    Content-MD5: 5xIscz+eN7ugykyYXOEdbQ==
    Last-Modified: Thu, 11 Jul 2024 01:45:51 GMT
    ETag: 0x8DCA14B323B2CC0
    Server: Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0
    x-ms-request-id: a4477661-c01e-0047-59b2-e33cb1000000
    x-ms-version: 2009-09-19
    x-ms-lease-status: unlocked
    x-ms-blob-type: BlockBlob
    Date: Wed, 21 Aug 2024 01:40:22 GMT
    Connection: keep-alive
  • 34.232.40.94:80
    http://www.iwin.com/arcade/rawinfo/2463082850695827969/2463082858382377731
    http
    InstGameInfoHelper.exe
    366 B
     803 B
     5
    4

    HTTP Request

    GET http://www.iwin.com/arcade/rawinfo/2463082850695827969/2463082858382377731

    HTTP Response

    301
  • 34.232.40.94:443
    https://www.iwin.com/arcade/rawinfo/2463082850695827969/2463082858382377731
    tls, http
    InstGameInfoHelper.exe
    1.1kB
     7.7kB
     11
    11

    HTTP Request

    GET https://www.iwin.com/arcade/rawinfo/2463082850695827969/2463082858382377731

    HTTP Response

    200
  • 143.204.67.183:80
    http://ocsp.r2m03.amazontrust.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQqHI%2BsdmapawQncL1rpCEZZ8gTSAQUVdkYX9IczAHhWLS%2Bq9lVQgHXLgICEA8wkGcUKsb9V5NGX7y58Tw%3D
    http
    InstGameInfoHelper.exe
    474 B
     1.1kB
     5
    4

    HTTP Request

    GET http://ocsp.r2m03.amazontrust.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQqHI%2BsdmapawQncL1rpCEZZ8gTSAQUVdkYX9IczAHhWLS%2Bq9lVQgHXLgICEA8wkGcUKsb9V5NGX7y58Tw%3D

    HTTP Response

    200
  • 143.204.68.65:80
    http://img.iwin.com/images/product/2463082850695827969/tn_feat.jpg
    http
    InstGameInfoHelper.exe
    358 B
     2.5kB
     5
    5

    HTTP Request

    GET http://img.iwin.com/images/product/2463082850695827969/tn_feat.jpg

    HTTP Response

    200
  • 2.18.190.71:80
    http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
    http
    399 B
     1.7kB
     4
    4

    HTTP Request

    GET http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl

    HTTP Response

    200
  • 8.8.8.8:53
    www.iwin.com
    dns
    InstGameInfoHelper.exe
    58 B
     172 B
     1
    1

    DNS Request

    www.iwin.com

    DNS Response

    34.232.40.94
    3.214.132.149
    34.206.98.238

  • 8.8.8.8:53
    ocsp.r2m03.amazontrust.com
    dns
    InstGameInfoHelper.exe
    72 B
     88 B
     1
    1

    DNS Request

    ocsp.r2m03.amazontrust.com

    DNS Response

    143.204.67.183

  • 8.8.8.8:53
    img.iwin.com
    dns
    InstGameInfoHelper.exe
    58 B
     208 B
     1
    1

    DNS Request

    img.iwin.com

    DNS Response

    143.204.68.65
    143.204.68.16
    143.204.68.129
    143.204.68.118

  • 8.8.8.8:53
    crl.microsoft.com
    dns
    63 B
     162 B
     1
    1

    DNS Request

    crl.microsoft.com

    DNS Response

    2.18.190.71
    2.18.190.80

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
    Filesize

    342B

    MD5

    1ac696ad412d76f29d46821831cf5db4

    SHA1

    4d77c59fb51c68030b117746637b0b7a9d97f2c3

    SHA256

    b54945715cfe95a129e2c14da7a61d7bc79b6f70add77ad561f44b7c1888de8e

    SHA512

    33fa3a5c92314cf28541584f0a49c0e88e28ab5347eb8c6a5ce3763771b6e39d0077fa9884c12fbb29813380cf39a3ff4d6ce8743ecd61117f0fec827c938b1c

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\CabF568.tmp
    Filesize

    70KB

    MD5

    49aebf8cbd62d92ac215b2923fb1b9f5

    SHA1

    1723be06719828dda65ad804298d0431f6aff976

    SHA256

    b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

    SHA512

    bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\TarF58B.tmp
    Filesize

    181KB

    MD5

    4ea6026cf93ec6338144661bf1202cd1

    SHA1

    a1dec9044f750ad887935a01430bf49322fbdcb7

    SHA256

    8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

    SHA512

    6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

    Download Submit

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.