Overview

overview

7

Static

static

3

GYYO_TheGa....2.zip

windows10-2004-x64

1

GYYO_TheGa....2.zip

windows11-ltsc_2024-x64

1

GYYO_TheGa...lp.dll

windows10-2004-x64

1

GYYO_TheGa...64.dll

windows10-2004-x64

1

GYYO_TheGa...64.dll

windows11-ltsc_2024-x64

1

GYYO_TheGa...64.dll

windows10-2004-x64

1

GYYO_TheGa...64.dll

windows11-ltsc_2024-x64

1

GYYO_TheGa...64.dll

windows10-2004-x64

1

GYYO_TheGa...64.dll

windows11-ltsc_2024-x64

1

GYYO_TheGa...64.dll

windows10-2004-x64

1

GYYO_TheGa...64.dll

windows11-ltsc_2024-x64

1

GYYO_TheGa...st.dll

windows10-2004-x64

1

GYYO_TheGa...st.dll

windows11-ltsc_2024-x64

1

GYYO_TheGa...64.exe

windows10-2004-x64

7

GYYO_TheGa...64.exe

windows11-ltsc_2024-x64

7

GYYO_TheGa...me.exe

windows10-2004-x64

7

GYYO_TheGa...me.exe

windows11-ltsc_2024-x64

7

GYYO_TheGa...re.dll

windows10-2004-x64

1

GYYO_TheGa...re.dll

windows11-ltsc_2024-x64

1

GYYO_TheGa...ng.exe

windows10-2004-x64

3

GYYO_TheGa...ng.exe

windows11-ltsc_2024-x64

3

GYYO_TheGa...se.dll

windows10-2004-x64

1

GYYO_TheGa...se.dll

windows11-ltsc_2024-x64

1

GYYO_TheGa...64.dll

windows10-2004-x64

1

GYYO_TheGa...64.dll

windows11-ltsc_2024-x64

1

GYYO_TheGa...64.dll

windows10-2004-x64

1

GYYO_TheGa...64.dll

windows11-ltsc_2024-x64

1

GYYO_TheGa...64.dll

windows10-2004-x64

1

GYYO_TheGa...64.dll

windows11-ltsc_2024-x64

1

GYYO_TheGa...64.dll

windows10-2004-x64

1

GYYO_TheGa...64.dll

windows11-ltsc_2024-x64

1

GYYO_TheGa...64.dll

windows10-2004-x64

1

Sharing

Copy URL Twitter E-mail

General

  • Target
    GYYO_TheGame_0.2.7.2.zip
  • Size 889.8MB
  • Sample260806-scdplatemd
  • SHA256 e02f59223fcaf32b4f48e08f6ae6c7fded5f41d36d8548f1d6e7bf97f2f54af7
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
discoverypersistenceprivilege_escalationransomware

Malware Config

Targets

    • Target
      GYYO_TheGame_0.2.7.2.zip
    • Size 889.8MB
    • SHA256 e02f59223fcaf32b4f48e08f6ae6c7fded5f41d36d8548f1d6e7bf97f2f54af7
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    1/10
    behavioral1behavioral2
    • Target
      GYYO_TheGame_0.2.7.2/Engine/Binaries/ThirdParty/DbgHelp/dbghelp.dll
    • Size 1.8MB
    • SHA256 e728908137ccf8326a1e955656fc8b5b2ee57d130aa7d9fb47d9fea77366ffb4
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    1/10
    behavioral3
    • Target
      GYYO_TheGame_0.2.7.2/Engine/Binaries/ThirdParty/NVIDIA/NVaftermath/Win64/GFSDK_Aftermath_Lib.x64.dll
    • Size 1.8MB
    • SHA256 6c0918fb5d68831c33136805a772e6250c1111a9769240994ce991ed38808870
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    1/10
    behavioral4behavioral5
    • Target
      GYYO_TheGame_0.2.7.2/Engine/Binaries/ThirdParty/Ogg/Win64/VS2015/libogg_64.dll
    • Size 63KB
    • SHA256 c1cb9c6b7c1b46f47200b2943f7fbcc30088e9bec36e1ba047d639bc487432f2
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    1/10
    behavioral6behavioral7
    • Target
      GYYO_TheGame_0.2.7.2/Engine/Binaries/ThirdParty/Vorbis/Win64/VS2015/libvorbis_64.dll
    • Size 1.7MB
    • SHA256 fd31d4dd32474d5d0ef7d571d70a7907f5a477b2c8dbfbbfc371c5481dfa5419
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    1/10
    behavioral8behavioral9
    • Target
      GYYO_TheGame_0.2.7.2/Engine/Binaries/ThirdParty/Vorbis/Win64/VS2015/libvorbisfile_64.dll
    • Size 52KB
    • SHA256 34d2ef246fe32838dedfddcece02172a13efa29ebda0c02b75ecc72b26d30007
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    1/10
    behavioral10behavioral11
    • Target
      GYYO_TheGame_0.2.7.2/Engine/Binaries/ThirdParty/Windows/XAudio2_9/x64/xaudio2_9redist.dll
    • Size 843KB
    • SHA256 e34d1250d42d5c8eb368c78d5b179db86a91eaee4443b17c265f53c619aed465
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    1/10
    behavioral12behavioral13
    • Target
      GYYO_TheGame_0.2.7.2/Engine/Extras/Redist/en-us/UEPrereqSetup_x64.exe
    • Size 48.3MB
    • SHA256 ef1ac9b2347702667e6a2a280bf2bcd55462882444a7c6981be74ac34df971f0
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    7/10
    discoverypersistenceprivilege_escalationransomware

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Event Triggered Execution: Component Object Model Hijacking

      Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

      persistenceprivilege_escalation

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Drops file in System32 directory

    behavioral14behavioral15
    • Target
      GYYO_TheGame_0.2.7.2/GYYO_The_Game.exe
    • Size 150KB
    • SHA256 8976d127cf47985a029660165c2f635a7e8d57c08396e5920172ecf1af55df16
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    7/10
    discovery

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    behavioral16behavioral17
    • Target
      GYYO_TheGame_0.2.7.2/GYYO_The_Game/Binaries/Win64/D3D12/D3D12Core.dll
    • Size 5.3MB
    • SHA256 c6b78379aa99185b0e48e65fd63ed2ec25b5a227f1a74afba4b5d93ae76a4475
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    1/10
    behavioral18behavioral19
    • Target
      GYYO_TheGame_0.2.7.2/GYYO_The_Game/Binaries/Win64/GYYO_The_Game-Win64-Shipping.exe
    • Size 107.5MB
    • SHA256 2815a98bf00a4d3d238e796cd6837e12ec1895475131e28af00986251f5d9591
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    3/10
    discovery
    behavioral20behavioral21
    • Target
      GYYO_TheGame_0.2.7.2/GYYO_The_Game/Binaries/Win64/OpenImageDenoise.dll
    • Size 47.5MB
    • SHA256 fb216867cd83c061ae446694d540ec0f27ecb35223c9acd0bb4de93d172f69f7
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    1/10
    behavioral22behavioral23
    • Target
      GYYO_TheGame_0.2.7.2/GYYO_The_Game/Binaries/Win64/boost_atomic-mt-x64.dll
    • Size 32KB
    • SHA256 606fceb0fbbb1e9ca953dbe9b9c320af8c6572d9c2d147aa72cdd6e596e8ba25
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    1/10
    behavioral24behavioral25
    • Target
      GYYO_TheGame_0.2.7.2/GYYO_The_Game/Binaries/Win64/boost_chrono-mt-x64.dll
    • Size 51KB
    • SHA256 dbeecc29646dafcd2b6d930b33290b5edfd7fc6b1cc87e3ea71d54083a4782c7
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    1/10
    behavioral26behavioral27
    • Target
      GYYO_TheGame_0.2.7.2/GYYO_The_Game/Binaries/Win64/boost_filesystem-mt-x64.dll
    • Size 153KB
    • SHA256 ec5b976cafea739a8a0c747ccf33225def32e83255b41adeb4d14b8e5e718c0f
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    1/10
    behavioral28behavioral29
    • Target
      GYYO_TheGame_0.2.7.2/GYYO_The_Game/Binaries/Win64/boost_iostreams-mt-x64.dll
    • Size 62KB
    • SHA256 970084ed7c784542e7793574aee0febca214472568fabae3f086bd9c034a2c9f
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    1/10
    behavioral30behavioral31
    • Target
      GYYO_TheGame_0.2.7.2/GYYO_The_Game/Binaries/Win64/boost_program_options-mt-x64.dll
    • Size 348KB
    • SHA256 61d48946d97285436840a3ceaac1949e15306b14bfc9d04e15434de23554284d
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    1/10
    behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Event Triggered Execution

1
T1546

Component Object Model Hijacking

1
T1546.015

Privilege Escalation

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Event Triggered Execution

1
T1546

Component Object Model Hijacking

1
T1546.015

Defense Evasion

Modify Registry

1
T1112

Credential Access

Discovery

Peripheral Device Discovery

2
T1120

Query Registry

4
T1012

System Information Discovery

4
T1082

System Location Discovery

1
T1614

System Language Discovery

1
T1614.001

System Network Configuration Discovery

1
T1016

Internet Connection Discovery

1
T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

Score
3/10

behavioral1

Score
1/10

behavioral2

Score
1/10

behavioral3

Score
1/10

behavioral4

Score
1/10

behavioral5

Score
1/10

behavioral6

Score
1/10

behavioral7

Score
1/10

behavioral8

Score
1/10

behavioral9

Score
1/10

behavioral10

Score
1/10

behavioral11

Score
1/10

behavioral12

Score
1/10

behavioral13

Score
1/10

behavioral14

discoverypersistenceprivilege_escalationransomware
Score
7/10

behavioral15

discovery
Score
7/10

behavioral16

discovery
Score
7/10

behavioral17

discovery
Score
7/10

behavioral18

Score
1/10

behavioral19

Score
1/10

behavioral20

discovery
Score
3/10

behavioral21

discovery
Score
3/10

behavioral22

Score
1/10

behavioral23

Score
1/10

behavioral24

Score
1/10

behavioral25

Score
1/10

behavioral26

Score
1/10

behavioral27

Score
1/10

behavioral28

Score
1/10

behavioral29

Score
1/10

behavioral30

Score
1/10

behavioral31

Score
1/10

behavioral32

Score
1/10