8847b946ce71df5c133dbe477d216e703a201f4ee8c1dfa516cfb7bab124b39d

Analysis

max time kernel
96s
max time network
48s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
12-03-2023 15:56

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Grand Theft Auto V.exe
Size

41.6MB
MD5

1d0b244a201695a38fd8271a1ca783b1
SHA1

ba9af18c1e3e0ba89c652ffa89c7e5a22bac6a57
SHA256

8847b946ce71df5c133dbe477d216e703a201f4ee8c1dfa516cfb7bab124b39d
SHA512

c4b21e1bb15d7f7bf528a2cc81846b6d71498908fe70bcd8b77c512f5643dfb779c600ec08ac6feeeb5c50aabcb3b3378667d1656f83f2aaab084165279ee934
SSDEEP

786432:hnH60LGTVMaIHuu7V6CdalG2elGSw+2FT2sgtUAv2uprx0XArtoR1PmzA5uJSXU:F6wGTmtHaCdEnSg2taBu+XbDPawXU

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
848	FRESH ADVICE LTD App Executable.exe

Loads dropped DLL 6 IoCs

pid	Process
1740	Grand Theft Auto V.exe
1740	Grand Theft Auto V.exe
1740	Grand Theft Auto V.exe
1740	Grand Theft Auto V.exe
848	FRESH ADVICE LTD App Executable.exe
848	FRESH ADVICE LTD App Executable.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeSecurityPrivilege	1740	Grand Theft Auto V.exe

Suspicious use of WriteProcessMemory 24 IoCs

description	pid	Process	procid_target
PID 1740 wrote to memory of 848	1740	Grand Theft Auto V.exe	28
PID 1740 wrote to memory of 848	1740	Grand Theft Auto V.exe	28
PID 1740 wrote to memory of 848	1740	Grand Theft Auto V.exe	28
PID 1740 wrote to memory of 848	1740	Grand Theft Auto V.exe	28
PID 848 wrote to memory of 1372	848	FRESH ADVICE LTD App Executable.exe	29
PID 848 wrote to memory of 1372	848	FRESH ADVICE LTD App Executable.exe	29
PID 848 wrote to memory of 1372	848	FRESH ADVICE LTD App Executable.exe	29
PID 848 wrote to memory of 1372	848	FRESH ADVICE LTD App Executable.exe	29
PID 848 wrote to memory of 1372	848	FRESH ADVICE LTD App Executable.exe	29
PID 848 wrote to memory of 1372	848	FRESH ADVICE LTD App Executable.exe	29
PID 848 wrote to memory of 1372	848	FRESH ADVICE LTD App Executable.exe	29
PID 848 wrote to memory of 1372	848	FRESH ADVICE LTD App Executable.exe	29
PID 848 wrote to memory of 1372	848	FRESH ADVICE LTD App Executable.exe	29
PID 848 wrote to memory of 1372	848	FRESH ADVICE LTD App Executable.exe	29
PID 848 wrote to memory of 1372	848	FRESH ADVICE LTD App Executable.exe	29
PID 848 wrote to memory of 1372	848	FRESH ADVICE LTD App Executable.exe	29
PID 848 wrote to memory of 1372	848	FRESH ADVICE LTD App Executable.exe	29
PID 848 wrote to memory of 1372	848	FRESH ADVICE LTD App Executable.exe	29
PID 848 wrote to memory of 1372	848	FRESH ADVICE LTD App Executable.exe	29
PID 848 wrote to memory of 1372	848	FRESH ADVICE LTD App Executable.exe	29
PID 848 wrote to memory of 1372	848	FRESH ADVICE LTD App Executable.exe	29
PID 848 wrote to memory of 1372	848	FRESH ADVICE LTD App Executable.exe	29
PID 848 wrote to memory of 1372	848	FRESH ADVICE LTD App Executable.exe	29
PID 848 wrote to memory of 1372	848	FRESH ADVICE LTD App Executable.exe	29

C:\Users\Admin\AppData\Local\Temp\Grand Theft Auto V.exe
"C:\Users\Admin\AppData\Local\Temp\Grand Theft Auto V.exe"
1⤵
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1740
- C:\Users\Admin\AppData\Local\Temp\2KNr66neuE1DhW3Qoqum390CJxO\FRESH ADVICE LTD App Executable.exe
  "C:\Users\Admin\AppData\Local\Temp\2KNr66neuE1DhW3Qoqum390CJxO\FRESH ADVICE LTD App Executable.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:848
- - C:\Users\Admin\AppData\Local\Temp\2KNr66neuE1DhW3Qoqum390CJxO\FRESH ADVICE LTD App Executable.exe
    "C:\Users\Admin\AppData\Local\Temp\2KNr66neuE1DhW3Qoqum390CJxO\FRESH ADVICE LTD App Executable.exe" --type=gpu-process --field-trial-handle=1116,17406778987056577223,1432301780143029278,131072 --disable-features=LayoutNG,SpareRendererForSitePerProcess --gpu-preferences=IAAAAAAAAADgAAAgAAAAAAAAYAAAAAAACAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAABQAAABAAAAAAAAAAAAAAAAYAAAAQAAAAAAAAAAEAAAAFAAAAEAAAAAAAAAABAAAABgAAAA== --service-request-channel-token=18004610603066162788 --mojo-platform-channel-handle=1124 --ignored=" --type=renderer " /prefetch:2
    3⤵
    PID:1372

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\2KNr66neuE1DhW3Qoqum390CJxO\FRESH ADVICE LTD App Executable.exe

Filesize
95.6MB

MD5
d8ac4b0d128e5d800920e4c67887bf45

SHA1
a1c94c1fe4e4ae38112ccb0a3cf1a8ed41457b73

SHA256
368138d46a90e337be9d6ef61dc3b8cac5d317f5dc036d846a7a6503f50d225e

SHA512
51b0151faefecadbf86eef0310ac073d83d2d2a73c5e988eb881659ca3822992ae22f672647b300882bcba27cf57555679b2c1a35c813b8f2c02ea529863506c

Download Submit
C:\Users\Admin\AppData\Local\Temp\2KNr66neuE1DhW3Qoqum390CJxO\FRESH ADVICE LTD App Executable.exe

Filesize
95.6MB

MD5
d8ac4b0d128e5d800920e4c67887bf45

SHA1
a1c94c1fe4e4ae38112ccb0a3cf1a8ed41457b73

SHA256
368138d46a90e337be9d6ef61dc3b8cac5d317f5dc036d846a7a6503f50d225e

SHA512
51b0151faefecadbf86eef0310ac073d83d2d2a73c5e988eb881659ca3822992ae22f672647b300882bcba27cf57555679b2c1a35c813b8f2c02ea529863506c

Download Submit
C:\Users\Admin\AppData\Local\Temp\2KNr66neuE1DhW3Qoqum390CJxO\chrome_100_percent.pak

Filesize
142KB

MD5
8d56d44c318d122f7931d03ba435f00b

SHA1
387f530e06f79a2a9f7fbf4446c71c31db08e7e0

SHA256
fcb4faaa82d13d90c42dfa0669f67391b3124d30310d0f4c510f31412974cab2

SHA512
03bd2f56f73ad06fe22ebd94fb0de4e37d1771f8a9d82a47ea93002ba4696d906b59d0e25db63e98af10a169a8c3dc9d047cfcbca01030924bf93abe7bce1590

Download Submit
C:\Users\Admin\AppData\Local\Temp\2KNr66neuE1DhW3Qoqum390CJxO\chrome_200_percent.pak

Filesize
204KB

MD5
879f88cafa5714994744bde20e7bd2c2

SHA1
d63b55f9f7c0e40f9585cac8a5cb28c0ea9f32ee

SHA256
76126341d0dc2b4b6ddccf30559709e6a856cd47148107808bd18ceb16ed1df3

SHA512
4d70ae16c2656cf3a8aaad00e2ce0ddcc030bf1ad29bbb1d0e90c03f866c413f893b273b8b03aa12c9ea5ae01537ad1d2d1b2c52b35bf7773278121a09a3af9c

Download Submit
C:\Users\Admin\AppData\Local\Temp\2KNr66neuE1DhW3Qoqum390CJxO\ffmpeg.dll

Filesize
2.0MB

MD5
ee633f99d30a105bf1d07cf4b3341833

SHA1
2581cb0e9c4a62cc7da15134c56e7e2b1deed959

SHA256
30f4b1789bb0e44a29bfc9ae5c2e6025e54f033040cb53560897f38bf54baead

SHA512
9a41bb3792befeecbf091ece4ee4601d000c1a8cd0133430c54e03ff01e918ec640711bef868b55788e6b9fb1066d5918f29a050a1a4e91f27ac9520f0f61ae1

Download Submit
C:\Users\Admin\AppData\Local\Temp\2KNr66neuE1DhW3Qoqum390CJxO\icudtl.dat

Filesize
9.9MB

MD5
4c8a9e9c260dc5a6fee2a3c37520f5bf

SHA1
5a9883dbeb5314a98e7ab5326f9868e78ba387dc

SHA256
8c2df1f6e2ea8df2e5fc5e4b016b0cddd64a7ce6985189ca45be3c0ec99472c2

SHA512
c0da0b08a0b0eaa898f96c6e6c6fb65bc7f773f5814fc0d612a40e2fcaea4049c67cd2812716a564dbc16d609677ee62eaa9f9747d2a7bc5c9bce43cd2208aa7

Download Submit
C:\Users\Admin\AppData\Local\Temp\2KNr66neuE1DhW3Qoqum390CJxO\locales\en-US.pak

Filesize
69KB

MD5
15e8556f737d17bd4d645513ee190990

SHA1
a24844d68fe3e9f4c57d14e6091a06f5e6b5f327

SHA256
12e4fd083a49e038578ea2993e6c88239083c8d098231527eee861299a4e1c99

SHA512
4e5c423b2b14def0e6ebb9c7844bdc050198064c9db69d3a880c1444314211995b1f0dec6fcbb12c6d5e59f690c3ffc893c2265bf7168d1ecbc8d83dfa5e1465

Download Submit
C:\Users\Admin\AppData\Local\Temp\2KNr66neuE1DhW3Qoqum390CJxO\natives_blob.bin

Filesize
81KB

MD5
f8ac49858ca8739658ff44c296f8aba6

SHA1
427b4da3bd619d85381c36d61daf2ce392e07909

SHA256
354ff502a0e1ed73df4e5c7b52970356b04777461f6e169f72a8567ab5f4c317

SHA512
52e875aedbdc5dad21e01a42e333ff5aefed9ae6468a00e80f2bb373b871196f9a82bc3f43a6c72c9dd6be0e4fbc591d3ede41ca47b23a806b788db5aa9bf313

Download Submit
C:\Users\Admin\AppData\Local\Temp\2KNr66neuE1DhW3Qoqum390CJxO\resources.pak

Filesize
8.1MB

MD5
978e8122033961585e14c65949d15e11

SHA1
3097d04bbcdfc6ff9e0bb52c2d38f6395e4bb631

SHA256
a435fa0e07a9124b0d457811de5e2245aeb225ad55ab99186cb665c6ec6e30ef

SHA512
5f6706116b7eaec70213f7343cac44eea2dc735de6262524b5508a659b150d8a5ad7f449fec984b45a2e5c170e1cb4feb927a19530c94841f3e6429a2fcaa1c0

Download Submit
C:\Users\Admin\AppData\Local\Temp\2KNr66neuE1DhW3Qoqum390CJxO\resources\app.asar

Filesize
13.9MB

MD5
b3c532c3e051f064d5d77fb5348ed8fd

SHA1
512bfb5ed89d7993f5f8bb1804aa67ff5f5b90dc

SHA256
563d387522c215aa9dda84d99ceca926d69d474cb206d2bffe0d2b3871c29576

SHA512
b33c1c760e05afa5c04ab4c6369b37c504ab56f2cb8d55d518eaf1e893e2198d7a87bd7355078e3b896bb58e7011f7b026b39fc24e6b6a84d795ddf97d9d168b

Download Submit
C:\Users\Admin\AppData\Local\Temp\2KNr66neuE1DhW3Qoqum390CJxO\resources\electron.asar

Filesize
347KB

MD5
1362f92031875676f4b082ff249abe1f

SHA1
bc9a9b6b08e28d8a33c5d388662b0fb3535af8ef

SHA256
5acf0deb20455487cb0f39cc4c752e7740137ab6adf8c049e62f092174310ca9

SHA512
2fc75d23c61b18b0537c0b5d889766fc51ad37b3a283f64c5edfc0c6abeff21123c055410c15f5d9c5945cba204937983409c865816669442ad8b165ab185d90

Download Submit
C:\Users\Admin\AppData\Local\Temp\2KNr66neuE1DhW3Qoqum390CJxO\v8_context_snapshot.bin

Filesize
685KB

MD5
25bee133a55efa9756b25ba25ba3cfa7

SHA1
6980de30de3d8e6ae81b4b3a14954ca67f58f9de

SHA256
156f90f0a8c6748716428786dca9cb53d1275f4510ebae2be5502f3fd94b7dc1

SHA512
c80232eda1bc9a7dc52fac538b99cc9a9805c00b455661bd493c12e620286e1983afe37814b0941d90c9e4be970b63108e1f9428c1a7d6fc5ab083acc0ee2aa6

Download Submit
C:\Users\Admin\AppData\Local\Temp\nso51.tmp\StdUtils.dll

Filesize
100KB

MD5
c6a6e03f77c313b267498515488c5740

SHA1
3d49fc2784b9450962ed6b82b46e9c3c957d7c15

SHA256
b72e9013a6204e9f01076dc38dabbf30870d44dfc66962adbf73619d4331601e

SHA512
9870c5879f7b72836805088079ad5bbafcb59fc3d9127f2160d4ec3d6e88d3cc8ebe5a9f5d20a4720fe6407c1336ef10f33b2b9621bc587e930d4cbacf337803

Download Submit
\Users\Admin\AppData\Local\Temp\2KNr66neuE1DhW3Qoqum390CJxO\FRESH ADVICE LTD App Executable.exe

Filesize
95.6MB

MD5
d8ac4b0d128e5d800920e4c67887bf45

SHA1
a1c94c1fe4e4ae38112ccb0a3cf1a8ed41457b73

SHA256
368138d46a90e337be9d6ef61dc3b8cac5d317f5dc036d846a7a6503f50d225e

SHA512
51b0151faefecadbf86eef0310ac073d83d2d2a73c5e988eb881659ca3822992ae22f672647b300882bcba27cf57555679b2c1a35c813b8f2c02ea529863506c

Download Submit
\Users\Admin\AppData\Local\Temp\2KNr66neuE1DhW3Qoqum390CJxO\FRESH ADVICE LTD App Executable.exe

Filesize
95.6MB

MD5
d8ac4b0d128e5d800920e4c67887bf45

SHA1
a1c94c1fe4e4ae38112ccb0a3cf1a8ed41457b73

SHA256
368138d46a90e337be9d6ef61dc3b8cac5d317f5dc036d846a7a6503f50d225e

SHA512
51b0151faefecadbf86eef0310ac073d83d2d2a73c5e988eb881659ca3822992ae22f672647b300882bcba27cf57555679b2c1a35c813b8f2c02ea529863506c

Download Submit
\Users\Admin\AppData\Local\Temp\2KNr66neuE1DhW3Qoqum390CJxO\ffmpeg.dll

Filesize
2.0MB

MD5
ee633f99d30a105bf1d07cf4b3341833

SHA1
2581cb0e9c4a62cc7da15134c56e7e2b1deed959

SHA256
30f4b1789bb0e44a29bfc9ae5c2e6025e54f033040cb53560897f38bf54baead

SHA512
9a41bb3792befeecbf091ece4ee4601d000c1a8cd0133430c54e03ff01e918ec640711bef868b55788e6b9fb1066d5918f29a050a1a4e91f27ac9520f0f61ae1

Download Submit
\Users\Admin\AppData\Local\Temp\nso51.tmp\StdUtils.dll

Filesize
100KB

MD5
c6a6e03f77c313b267498515488c5740

SHA1
3d49fc2784b9450962ed6b82b46e9c3c957d7c15

SHA256
b72e9013a6204e9f01076dc38dabbf30870d44dfc66962adbf73619d4331601e

SHA512
9870c5879f7b72836805088079ad5bbafcb59fc3d9127f2160d4ec3d6e88d3cc8ebe5a9f5d20a4720fe6407c1336ef10f33b2b9621bc587e930d4cbacf337803

Download Submit
\Users\Admin\AppData\Local\Temp\nso51.tmp\System.dll

Filesize
12KB

MD5
0d7ad4f45dc6f5aa87f606d0331c6901

SHA1
48df0911f0484cbe2a8cdd5362140b63c41ee457

SHA256
3eb38ae99653a7dbc724132ee240f6e5c4af4bfe7c01d31d23faf373f9f2eaca

SHA512
c07de7308cb54205e8bd703001a7fe4fd7796c9ac1b4bb330c77c872bf712b093645f40b80ce7127531fe6746a5b66e18ea073ab6a644934abed9bb64126fea9

Download Submit
\Users\Admin\AppData\Local\Temp\nso51.tmp\nsis7z.dll

Filesize
424KB

MD5
80e44ce4895304c6a3a831310fbf8cd0

SHA1
36bd49ae21c460be5753a904b4501f1abca53508

SHA256
b393f05e8ff919ef071181050e1873c9a776e1a0ae8329aefff7007d0cadf592

SHA512
c8ba7b1f9113ead23e993e74a48c4427ae3562c1f6d9910b2bbe6806c9107cf7d94bc7d204613e4743d0cd869e00dafd4fb54aad1e8adb69c553f3b9e5bc64df

Download Submit
memory/848-266-0x0000000001F60000-0x0000000001F61000-memory.dmp

Filesize
4KB

Download
memory/1372-235-0x0000000000060000-0x0000000000061000-memory.dmp

Filesize
4KB

Download