Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
615s -
max time network
618s -
platform
windows10-1703_x64 -
resource
win10-20240404-en -
resource tags
arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system -
submitted
04/07/2024, 11:25
Behavioral task
behavioral1
Sample
GTA 6 Builder-Install.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
GTA 6 Builder-Install.exe
Resource
win10-20240404-en
Behavioral task
behavioral3
Sample
GTA 6 Builder-Install.exe
Resource
win10v2004-20240508-en
General
-
Target
GTA 6 Builder-Install.exe
-
Size
13.2MB
-
MD5
76c24a289ef8e97b890585d7727ac384
-
SHA1
4f5e5bbd4d24f3d475bd77b30c9f6f62d96f3d64
-
SHA256
ecf92b4d201eb858e63d6dd03937de3255ac7bc6f57264753f53306a3a9d7aa2
-
SHA512
0d54872ea7cc28f3de62a40eb50b06ace92a4e77144608f2d9e51d4ca60fec5d485bd6bceba8d1f4acea8b20670233a412df4cf5bf29eac17dc723b23ee1128d
-
SSDEEP
196608:FexmCr8ywE5Ec0BY36vhmYzr9bD3xRlLlPIIHtOC21rGY+GVz3mAp:UPr8ycYqv9bDflLlggOd+M1p
Malware Config
Signatures
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ GTA 6 Builder-Install.exe -
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion GTA 6 Builder-Install.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion GTA 6 Builder-Install.exe -
Drops startup file 2 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svhost.exe Runtime64.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svhost.exe Runtime64.exe -
Executes dropped EXE 2 IoCs
pid Process 3616 ComHostSvc.exe 4900 Runtime64.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
resource yara_rule behavioral2/memory/3328-0-0x0000000000400000-0x00000000021E4000-memory.dmp themida behavioral2/memory/3328-18-0x0000000000400000-0x00000000021E4000-memory.dmp themida -
description ioc Process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA GTA 6 Builder-Install.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
pid Process 3328 GTA 6 Builder-Install.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000_Classes\Local Settings ComHostSvc.exe -
Runs ping.exe 1 TTPs 1 IoCs
pid Process 1352 PING.EXE -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3616 ComHostSvc.exe 3616 ComHostSvc.exe 3616 ComHostSvc.exe 3616 ComHostSvc.exe 3616 ComHostSvc.exe 3616 ComHostSvc.exe 3616 ComHostSvc.exe 3616 ComHostSvc.exe 3616 ComHostSvc.exe 3616 ComHostSvc.exe 3616 ComHostSvc.exe 3616 ComHostSvc.exe 3616 ComHostSvc.exe 3616 ComHostSvc.exe 3616 ComHostSvc.exe 3616 ComHostSvc.exe 3616 ComHostSvc.exe 3616 ComHostSvc.exe 3616 ComHostSvc.exe 3616 ComHostSvc.exe 3616 ComHostSvc.exe 3616 ComHostSvc.exe 3616 ComHostSvc.exe 3616 ComHostSvc.exe 3616 ComHostSvc.exe 3616 ComHostSvc.exe 3616 ComHostSvc.exe 3616 ComHostSvc.exe 3616 ComHostSvc.exe 3616 ComHostSvc.exe 3616 ComHostSvc.exe 3616 ComHostSvc.exe 3616 ComHostSvc.exe 3616 ComHostSvc.exe 3616 ComHostSvc.exe 3616 ComHostSvc.exe 3616 ComHostSvc.exe 3616 ComHostSvc.exe 3616 ComHostSvc.exe 3616 ComHostSvc.exe 3616 ComHostSvc.exe 3616 ComHostSvc.exe 3616 ComHostSvc.exe 3616 ComHostSvc.exe 3616 ComHostSvc.exe 3616 ComHostSvc.exe 3616 ComHostSvc.exe 3616 ComHostSvc.exe 3616 ComHostSvc.exe 3616 ComHostSvc.exe 3616 ComHostSvc.exe 3616 ComHostSvc.exe 3616 ComHostSvc.exe 3616 ComHostSvc.exe 3616 ComHostSvc.exe 3616 ComHostSvc.exe 3616 ComHostSvc.exe 3616 ComHostSvc.exe 3616 ComHostSvc.exe 3616 ComHostSvc.exe 3616 ComHostSvc.exe 3616 ComHostSvc.exe 3616 ComHostSvc.exe 3616 ComHostSvc.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 3616 ComHostSvc.exe -
Suspicious use of WriteProcessMemory 10 IoCs
description pid Process procid_target PID 3328 wrote to memory of 3616 3328 GTA 6 Builder-Install.exe 74 PID 3328 wrote to memory of 3616 3328 GTA 6 Builder-Install.exe 74 PID 3328 wrote to memory of 4900 3328 GTA 6 Builder-Install.exe 75 PID 3328 wrote to memory of 4900 3328 GTA 6 Builder-Install.exe 75 PID 3616 wrote to memory of 60 3616 ComHostSvc.exe 77 PID 3616 wrote to memory of 60 3616 ComHostSvc.exe 77 PID 60 wrote to memory of 2588 60 cmd.exe 79 PID 60 wrote to memory of 2588 60 cmd.exe 79 PID 60 wrote to memory of 1352 60 cmd.exe 80 PID 60 wrote to memory of 1352 60 cmd.exe 80
Processes
-
C:\Users\Admin\AppData\Local\Temp\GTA 6 Builder-Install.exe"C:\Users\Admin\AppData\Local\Temp\GTA 6 Builder-Install.exe"1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of WriteProcessMemory
PID:3328 -
C:\Users\Admin\AppData\Local\Temp\ComHostSvc.exe"C:\Users\Admin\AppData\Local\Temp\ComHostSvc.exe"2⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3616 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\9dbjknkRRi.bat"3⤵
- Suspicious use of WriteProcessMemory
PID:60 -
C:\Windows\system32\chcp.comchcp 650014⤵PID:2588
-
-
C:\Windows\system32\PING.EXEping -n 10 localhost4⤵
- Runs ping.exe
PID:1352
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Runtime64.exe"C:\Users\Admin\AppData\Local\Temp\Runtime64.exe"2⤵
- Drops startup file
- Executes dropped EXE
PID:4900
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
180B
MD55a64ff7e8f4ce7f290791cfcaa2a45c3
SHA154f23701ae1ee611ea00a7cd90e8b899c789fcfc
SHA2568baa0dd33b64fa6af4f3ac64a91e35e44e39dffbe6bd1e4d2828b0abd3e26584
SHA5129b92f9a0f1a763e14e9a3dc051445b5e3b927b44b47ec9899c6d1be6734e71b78b9afe5f4415ab7e673138ae7781740b473f78e56c0061bcb558c3235a79ac15
-
Filesize
2.0MB
MD531e5e3ac5a03d60d67188b6b0c3d152b
SHA141e831bc8b0c314a46d17492ded7b6b587d66db2
SHA256dc73ce51066fdcd5f0c7c88fd6fdfb9a4a3722ebe3d2def1dc593fbc1af9e467
SHA51264837c66af3f63c214ff8f466266f3dea1cf135d54ccaaf5c06fa13763045d79220f88d09ca49a36668d7e1f506bc74c9a2b8de0ec77aac272b0e1466aa168c2
-
Filesize
11KB
MD5da23f44a96e6aa3a8b80f1cc40169dae
SHA19c5ff4215e46407da34524ce4f26841aa2c842c6
SHA2562d86ab0d97a265aa7b465439ac97c0c6b428a3bdc18000625f3fd66c07ff6f70
SHA512ccf6056c176a98e2f235f22667ea1497191a3cb373fc63632467de6255493c98fcb315d55a634cd0bb10e6087d832f46d0712fb3661dd3786bd9fe360981a035