Analysis
-
max time kernel
8s -
max time network
10s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
-
submitted
25-08-2024 05:43
General
-
Target
Gamesense.exe
-
Size
18.5MB
-
MD5
044e3f45a72c31c3b220a60cfb026694
-
SHA1
57cc38d9b6155a184fe679e96e6abb6b1e5afcec
-
SHA256
e7e414c253f9ddc4543de1d5ffe6d307f362f49a23e7cadff325856b2b623f8e
-
SHA512
8ca84cad8b70d07e1efed057930168f3638004b22db56b69db7840a74da27f3dd97cc9a2a28914f68a52527b52d8a31a3277ab30b2e7a5a3b0700dfcfee0c173
-
SSDEEP
393216:USLpLFG0zW0zkV8GP870Qj3+thpvLpTWwim72/kpW8wxUm:USLBz1ABUj3+vpvLpTLim7KiQl
Score
9/10
Malware Config
Signatures
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
-
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
-
Themida packer 8 IoCs
Detects Themida, an advanced Windows software protection system.
-
Checks whether UAC is enabled 1 TTPs 1 IoCs
-
Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
-
Checks SCSI registry key(s) 3 TTPs 16 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes
-
C:\Users\Admin\AppData\Local\Temp\Gamesense.exe"C:\Users\Admin\AppData\Local\Temp\Gamesense.exe"1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Writes to the Master Boot Record (MBR)
- Checks SCSI registry key(s)
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
49.6MB
-
Filesize
49.6MB
-
Filesize
49.6MB
-
Filesize
49.6MB
-
Filesize
49.6MB
-
Filesize
49.6MB
-
Filesize
49.6MB
-
Filesize
49.6MB