{
  "family": "gamebox",
  "sample_count": 5,
  "category": "advanced_threat",
  "description": "Adware:Win32/Gamebox is an adware application typically disguised as a legitimate gaming portal, cheat utility, or free game downloading software. While it may provide some rudimentary gaming functionality to maintain the deception, its actual purpose is to aggressively monetize the user's system by injecting unwanted advertisements into web browsers, hijacking search queries, and tracking browsing behavior.<br><br><b>Understanding Gamebox (Gaming Adware)</b><br>To an end-user (often younger users or gamers looking for free content), Gamebox seems like a useful application. However, it quickly degrades the system's performance and fills the browser with intrusive pop-ups, often leading to potentially unsafe websites. For a network administrator, it represents a risk of drive-by downloads and a violation of acceptable use policies.<br><br><b>Execution and Injection Mechanics</b><br>Gamebox is typically distributed via deceptive software bundles, fake 'game cracks,' or aggressive advertising on gaming forums (`T1189`). When installed (`T1204.002`), it establishes deep persistence, often adding itself to the Windows Registry Run keys or creating Scheduled Tasks (`T1547.001`). Its primary malicious activity involves installing persistent browser extensions or modifying browser shortcut properties to ensure it loads whenever the browser is launched (`T1176`). It then intercepts web traffic locally to inject its own sponsored links and banner ads directly into the DOM of legitimate websites the user is visiting (`T1562.001`).<br><br><b>Indicators of Compromise & Impact</b><br>The impact is a severely degraded user experience and potential exposure to malvertising. Host-based IoCs include EDR alerts for unexpected additions to browser extension directories, modifications to `LNK` shortcut files (e.g., appending a URL to the target path of the Chrome shortcut), and anomalous processes communicating with known adware tracking domains. Users will report excessive ads, especially those labeled 'Ads by Gamebox' or similar.",
  "cta": "Published by the SystemHelpdesk team.",
  "aliases": [],
  "enrichment_level": "expert-seo",
  "faq": [],
  "faq_count": 0,
  "mitre_attack": [
    "T1547.001",
    "T1562.001",
    "T1176",
    "T1189"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-06-09",
  "mitre_attack_detail": [
    {
      "id": "T1176",
      "name": "Browser Extensions (Installing malicious adware extensions)",
      "tactic": "Persistence"
    },
    {
      "id": "T1547.001",
      "name": "Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder",
      "tactic": "Persistence"
    },
    {
      "id": "T1562.001",
      "name": "Impair Defenses: Disable or Modify Tools (Browser hijacking)",
      "tactic": "Defense Evasion"
    },
    {
      "id": "T1189",
      "name": "Drive-by Compromise",
      "tactic": "Initial Access"
    }
  ],
  "containment_steps": [
    "Use the Windows Control Panel to thoroughly uninstall the 'Gamebox' application and any associated gaming toolbars.",
    "Remove any unknown or recently installed browser extensions from Chrome, Edge, Internet Explorer, and Firefox.",
    "Check all browser desktop shortcuts (`.lnk` files); adware often modifies the 'Target' path to automatically open a specific URL upon launch.",
    "Run a thorough scan with an enterprise-grade Adware/PUA removal tool to clean up deep registry persistence mechanisms."
  ],
  "what_to_avoid": [
    "Do not allow users to download 'cracked' software or cheat engines, as these are primary vectors for Gamebox and more severe malware.",
    "Avoid simply changing the homepage back manually; if the Gamebox extension is still present, the changes will revert on the next launch."
  ],
  "target_industries": [
    "Global / Opportunistic"
  ],
  "motivation": "Opportunistic",
  "threat_actors": [
    "Unknown / Cybercriminal"
  ],
  "target_geographies": [
    "Global"
  ]
}