dbdb54d5a90130e3370590c7e07b2e3146f8578305554ba3ed11aab579a3dd3f

Analysis

max time kernel
89s
max time network
29s
platform
windows7_x64
resource
win7-20240729-en
resource tags

arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
submitted
10-11-2024 12:00

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

8Jw_RggGj5lBX2auQAnIQe71.exe
Size

381KB
MD5

58f5dca577a49a38ea439b3dc7b5f8d6
SHA1

175dc7a597935b1afeb8705bd3d7a556649b06cf
SHA256

857dd46102aea53f0cb7934b96410ebbc3e7988d38dcafdc8c0988f436533b98
SHA512

3c75c0cbbbc14bd25b4feb141fd1595ce02469da50432fb48400eb089d6150fe87831ccc775d921eeec697af7aad33a35fadcfd2ec775aeee1ce34355af7338a
SSDEEP

6144:x/QiQXCfoL8+Ee0CYDTAsdRa1OGBfj/WUplm6zIOYQNd28pTXdAmpCLVRZoglM7f:pQi3foL8+iDNdRa1lL//plmW9bTXeVh8

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2852	8Jw_RggGj5lBX2auQAnIQe71.tmp

Loads dropped DLL 5 IoCs

pid	Process
2440	8Jw_RggGj5lBX2auQAnIQe71.exe
2852	8Jw_RggGj5lBX2auQAnIQe71.tmp
2852	8Jw_RggGj5lBX2auQAnIQe71.tmp
2852	8Jw_RggGj5lBX2auQAnIQe71.tmp
2852	8Jw_RggGj5lBX2auQAnIQe71.tmp

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Looks up external IP address via web service 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
2	ipinfo.io
4	ipinfo.io

Drops file in Program Files directory 3 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\GameBox\unins000.dat	8Jw_RggGj5lBX2auQAnIQe71.tmp
File created	C:\Program Files (x86)\GameBox\is-K84G1.tmp	8Jw_RggGj5lBX2auQAnIQe71.tmp
File opened for modification	C:\Program Files (x86)\GameBox\unins000.dat	8Jw_RggGj5lBX2auQAnIQe71.tmp

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	8Jw_RggGj5lBX2auQAnIQe71.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	8Jw_RggGj5lBX2auQAnIQe71.tmp

Script User-Agent 2 IoCs

Uses user-agent string associated with script host/environment.

description	flow	ioc
HTTP User-Agent header	3	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP User-Agent header	7	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2852	8Jw_RggGj5lBX2auQAnIQe71.tmp
2852	8Jw_RggGj5lBX2auQAnIQe71.tmp

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2852	8Jw_RggGj5lBX2auQAnIQe71.tmp

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2440 wrote to memory of 2852	2440	8Jw_RggGj5lBX2auQAnIQe71.exe	30
PID 2440 wrote to memory of 2852	2440	8Jw_RggGj5lBX2auQAnIQe71.exe	30
PID 2440 wrote to memory of 2852	2440	8Jw_RggGj5lBX2auQAnIQe71.exe	30
PID 2440 wrote to memory of 2852	2440	8Jw_RggGj5lBX2auQAnIQe71.exe	30
PID 2440 wrote to memory of 2852	2440	8Jw_RggGj5lBX2auQAnIQe71.exe	30
PID 2440 wrote to memory of 2852	2440	8Jw_RggGj5lBX2auQAnIQe71.exe	30
PID 2440 wrote to memory of 2852	2440	8Jw_RggGj5lBX2auQAnIQe71.exe	30

C:\Users\Admin\AppData\Local\Temp\8Jw_RggGj5lBX2auQAnIQe71.exe
"C:\Users\Admin\AppData\Local\Temp\8Jw_RggGj5lBX2auQAnIQe71.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2440
- C:\Users\Admin\AppData\Local\Temp\is-673D1.tmp\8Jw_RggGj5lBX2auQAnIQe71.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-673D1.tmp\8Jw_RggGj5lBX2auQAnIQe71.tmp" /SL5="$301C6,138429,56832,C:\Users\Admin\AppData\Local\Temp\8Jw_RggGj5lBX2auQAnIQe71.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of FindShellTrayWindow
  PID:2852

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Program Files (x86)\GameBox\unins000.exe

Filesize
705KB

MD5
f0477b622428f93864bfee68dd054e6d

SHA1
28bef7759909021f7126b41299d0c310746603de

SHA256
fbe9abe3885a928bb762ff4be6e00e55395056ab6d66a8ea0d2fc6a43bdbd75e

SHA512
7bc1a0b94893cce3cf08b02b224440ce08b716165184816804d979d0c71bd0f8bbd3e5dc645dc7d20356e0f995bff39a2b1e13a4c3b140f9bfafb48965f55afe

Download Submit
\Users\Admin\AppData\Local\Temp\is-673D1.tmp\8Jw_RggGj5lBX2auQAnIQe71.tmp

Filesize
694KB

MD5
ffcf263a020aa7794015af0edee5df0b

SHA1
bce1eb5f0efb2c83f416b1782ea07c776666fdab

SHA256
1d07cfb7104b85fc0dffd761f6848ad176117e146bbb4079fe993efa06b94c64

SHA512
49f2b062adfb99c0c7f1012c56f0b52a8850d9f030cc32073b90025b372e4eb373f06a351e9b33264967427b8174c060c8a6110979f0eaf0872f7da6d5e4308a

Download Submit
\Users\Admin\AppData\Local\Temp\is-ILF85.tmp\_isetup\_shfoldr.dll

Filesize
22KB

MD5
92dc6ef532fbb4a5c3201469a5b5eb63

SHA1
3e89ff837147c16b4e41c30d6c796374e0b8e62c

SHA256
9884e9d1b4f8a873ccbd81f8ad0ae257776d2348d027d811a56475e028360d87

SHA512
9908e573921d5dbc3454a1c0a6c969ab8a81cc2e8b5385391d46b1a738fb06a76aa3282e0e58d0d2ffa6f27c85668cd5178e1500b8a39b1bbae04366ae6a86d3

Download Submit
\Users\Admin\AppData\Local\Temp\is-ILF85.tmp\itdownload.dll

Filesize
200KB

MD5
d82a429efd885ca0f324dd92afb6b7b8

SHA1
86bbdaa15e6fc5c7779ac69c84e53c43c9eb20ea

SHA256
b258c4d7d2113dee2168ed7e35568c8e03341e24e3eafc7a22a0d62e32122ef3

SHA512
5bf0c3b8fa5db63205a263c4fa5337188173248bef609ba4d03508c50db1fd1e336f3041ce96d78cc97659357a83e6e422f5b079d893a20a683270e05f5438df

Download Submit
memory/2440-27-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/2440-0-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/2440-45-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/2440-2-0x0000000000401000-0x000000000040B000-memory.dmp

Filesize
40KB

Download
memory/2852-17-0x00000000004C0000-0x00000000004FC000-memory.dmp

Filesize
240KB

Download
memory/2852-21-0x0000000000400000-0x00000000004BD000-memory.dmp

Filesize
756KB

Download
memory/2852-24-0x0000000000400000-0x00000000004BD000-memory.dmp

Filesize
756KB

Download
memory/2852-23-0x0000000000400000-0x00000000004BD000-memory.dmp

Filesize
756KB

Download
memory/2852-22-0x0000000000400000-0x00000000004BD000-memory.dmp

Filesize
756KB

Download
memory/2852-25-0x0000000000400000-0x00000000004BD000-memory.dmp

Filesize
756KB

Download
memory/2852-26-0x0000000000400000-0x00000000004BD000-memory.dmp

Filesize
756KB

Download
memory/2852-19-0x0000000000400000-0x00000000004BD000-memory.dmp

Filesize
756KB

Download
memory/2852-29-0x00000000004C0000-0x00000000004FC000-memory.dmp

Filesize
240KB

Download
memory/2852-20-0x0000000000400000-0x00000000004BD000-memory.dmp

Filesize
756KB

Download
memory/2852-39-0x0000000000400000-0x00000000004BD000-memory.dmp

Filesize
756KB

Download
memory/2852-44-0x0000000000400000-0x00000000004BD000-memory.dmp

Filesize
756KB

Download
memory/2852-8-0x0000000000400000-0x00000000004BD000-memory.dmp

Filesize
756KB

Download