ee4659bffa0c48f7f3ff98fa534c372c818c11f55016fecc2e0273e295afbc79

Analysis

max time kernel
120s
max time network
123s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
08/10/2024, 23:11

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

$TEMP/AlawarGameBoxSetup.exe
Size

1.9MB
MD5

4e3cf1d4c252eea6d92f05e5d707f16d
SHA1

126f51322add7d3ea6d1a29631dcfa8ae2994f6c
SHA256

90b0d487d5be85aa4e943279b822844d6dfdab14fde5e47216bda2bb38833ee5
SHA512

4070b61945d4395ed47319d2848020c301cb13e18d797216e5c708d5d7c2663b7392495d0a66c4a393f5772a569a60ec362e5a07d575da44d74b69592fd59fc9
SSDEEP

49152:SXfpUyvZfTsx6wExvVG/Bvu2HymhMdhLHuzFHy:SXfpndTsxQdVGluxEs

Score

7^/10

discovery

Malware Config

Signatures

Loads dropped DLL 2 IoCs

pid	Process
2184	AlawarGameBoxSetup.exe
2184	AlawarGameBoxSetup.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AlawarGameBoxSetup.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2184	AlawarGameBoxSetup.exe

C:\Users\Admin\AppData\Local\Temp\$TEMP\AlawarGameBoxSetup.exe
"C:\Users\Admin\AppData\Local\Temp\$TEMP\AlawarGameBoxSetup.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
PID:2184

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\nso9AAC.tmp\insttype_page.ini

Filesize
277B

MD5
12f1988bd05d34a55a5058d209519002

SHA1
beeefe9b061a43afada71de29a310b38511d2c58

SHA256
bdf60663d1123b93befe414b296f5b5be92b904694280a7421dee291f02bd890

SHA512
4e44f0242955051780b341cc6a9b4022d21970771396416e83af6a8167e92879cabcc32034b6e371103689d40d703845c503a85b7d87ed9bb891149269b56a10

Download Submit
C:\Users\Admin\AppData\Local\Temp\nso9AAC.tmp\ioSpecial.ini

Filesize
737B

MD5
882cd9c0aa7e76254c129a0b8ba2c268

SHA1
3477cd1d239cf0e8b095b593bc17aa9b51b5e687

SHA256
b9c2ec170d1aaba125a1dd72c8dbeea86b525bb61e2b7df550aa63f2728003d0

SHA512
9c36c41928622992cdb06e6cd7cf5ba585a3ac5f001268a68976955668bc0345840d6ed403786b20a2f840f2a1bc9337a982913ad80fc74fbd7e144d88c9fecb

Download Submit
\Users\Admin\AppData\Local\Temp\nso9AAC.tmp\InstallOptions.dll

Filesize
14KB

MD5
79be350c8381293abb045bbd2a7b5f0a

SHA1
0b4e6d482cae461e36c2b47661ef586545162e23

SHA256
3091623495d6e81bc0aa9182a55b0f93d3b2238102a44fd66943e46ed7eeaf51

SHA512
1d39bc13f2825bb4aee5832bc5c60603b62b3475e0075028a146981764e6796e68fdd752627f37f8bb198dcfce5a62efb6a6283366fc4874a8915008aa0a4c28

Download Submit