Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
448s -
max time network
450s -
platform
windows11-21h2_x64 -
resource
win11-20240419-en -
resource tags
arch:x64arch:x86image:win11-20240419-enlocale:en-usos:windows11-21h2-x64system -
submitted
04/07/2024, 11:25
Behavioral task
behavioral1
Sample
GTA 6 Builder-Install.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
GTA 6 Builder-Install.exe
Resource
win10-20240404-en
Behavioral task
behavioral3
Sample
GTA 6 Builder-Install.exe
Resource
win10v2004-20240508-en
General
-
Target
GTA 6 Builder-Install.exe
-
Size
13.2MB
-
MD5
76c24a289ef8e97b890585d7727ac384
-
SHA1
4f5e5bbd4d24f3d475bd77b30c9f6f62d96f3d64
-
SHA256
ecf92b4d201eb858e63d6dd03937de3255ac7bc6f57264753f53306a3a9d7aa2
-
SHA512
0d54872ea7cc28f3de62a40eb50b06ace92a4e77144608f2d9e51d4ca60fec5d485bd6bceba8d1f4acea8b20670233a412df4cf5bf29eac17dc723b23ee1128d
-
SSDEEP
196608:FexmCr8ywE5Ec0BY36vhmYzr9bD3xRlLlPIIHtOC21rGY+GVz3mAp:UPr8ycYqv9bDflLlggOd+M1p
Malware Config
Signatures
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ GTA 6 Builder-Install.exe -
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion GTA 6 Builder-Install.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion GTA 6 Builder-Install.exe -
Drops startup file 2 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svhost.exe Runtime64.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svhost.exe Runtime64.exe -
Executes dropped EXE 2 IoCs
pid Process 1396 ComHostSvc.exe 3148 Runtime64.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
resource yara_rule behavioral4/memory/4460-0-0x0000000000400000-0x00000000021E4000-memory.dmp themida behavioral4/memory/4460-32-0x0000000000400000-0x00000000021E4000-memory.dmp themida -
description ioc Process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA GTA 6 Builder-Install.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
pid Process 4460 GTA 6 Builder-Install.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1474490143-3221292397-4168103503-1000_Classes\Local Settings ComHostSvc.exe -
Runs ping.exe 1 TTPs 1 IoCs
pid Process 2020 PING.EXE -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1396 ComHostSvc.exe 1396 ComHostSvc.exe 1396 ComHostSvc.exe 1396 ComHostSvc.exe 1396 ComHostSvc.exe 1396 ComHostSvc.exe 1396 ComHostSvc.exe 1396 ComHostSvc.exe 1396 ComHostSvc.exe 1396 ComHostSvc.exe 1396 ComHostSvc.exe 1396 ComHostSvc.exe 1396 ComHostSvc.exe 1396 ComHostSvc.exe 1396 ComHostSvc.exe 1396 ComHostSvc.exe 1396 ComHostSvc.exe 1396 ComHostSvc.exe 1396 ComHostSvc.exe 1396 ComHostSvc.exe 1396 ComHostSvc.exe 1396 ComHostSvc.exe 1396 ComHostSvc.exe 1396 ComHostSvc.exe 1396 ComHostSvc.exe 1396 ComHostSvc.exe 1396 ComHostSvc.exe 1396 ComHostSvc.exe 1396 ComHostSvc.exe 1396 ComHostSvc.exe 1396 ComHostSvc.exe 1396 ComHostSvc.exe 1396 ComHostSvc.exe 1396 ComHostSvc.exe 1396 ComHostSvc.exe 1396 ComHostSvc.exe 1396 ComHostSvc.exe 1396 ComHostSvc.exe 1396 ComHostSvc.exe 1396 ComHostSvc.exe 1396 ComHostSvc.exe 1396 ComHostSvc.exe 1396 ComHostSvc.exe 1396 ComHostSvc.exe 1396 ComHostSvc.exe 1396 ComHostSvc.exe 1396 ComHostSvc.exe 1396 ComHostSvc.exe 1396 ComHostSvc.exe 1396 ComHostSvc.exe 1396 ComHostSvc.exe 1396 ComHostSvc.exe 1396 ComHostSvc.exe 1396 ComHostSvc.exe 1396 ComHostSvc.exe 1396 ComHostSvc.exe 1396 ComHostSvc.exe 1396 ComHostSvc.exe 1396 ComHostSvc.exe 1396 ComHostSvc.exe 1396 ComHostSvc.exe 1396 ComHostSvc.exe 1396 ComHostSvc.exe 1396 ComHostSvc.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 1396 ComHostSvc.exe -
Suspicious use of WriteProcessMemory 10 IoCs
description pid Process procid_target PID 4460 wrote to memory of 1396 4460 GTA 6 Builder-Install.exe 76 PID 4460 wrote to memory of 1396 4460 GTA 6 Builder-Install.exe 76 PID 4460 wrote to memory of 3148 4460 GTA 6 Builder-Install.exe 77 PID 4460 wrote to memory of 3148 4460 GTA 6 Builder-Install.exe 77 PID 1396 wrote to memory of 2720 1396 ComHostSvc.exe 79 PID 1396 wrote to memory of 2720 1396 ComHostSvc.exe 79 PID 2720 wrote to memory of 1984 2720 cmd.exe 81 PID 2720 wrote to memory of 1984 2720 cmd.exe 81 PID 2720 wrote to memory of 2020 2720 cmd.exe 82 PID 2720 wrote to memory of 2020 2720 cmd.exe 82
Processes
-
C:\Users\Admin\AppData\Local\Temp\GTA 6 Builder-Install.exe"C:\Users\Admin\AppData\Local\Temp\GTA 6 Builder-Install.exe"1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of WriteProcessMemory
PID:4460 -
C:\Users\Admin\AppData\Local\Temp\ComHostSvc.exe"C:\Users\Admin\AppData\Local\Temp\ComHostSvc.exe"2⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1396 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\LW19r029AS.bat"3⤵
- Suspicious use of WriteProcessMemory
PID:2720 -
C:\Windows\system32\chcp.comchcp 650014⤵PID:1984
-
-
C:\Windows\system32\PING.EXEping -n 10 localhost4⤵
- Runs ping.exe
PID:2020
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Runtime64.exe"C:\Users\Admin\AppData\Local\Temp\Runtime64.exe"2⤵
- Drops startup file
- Executes dropped EXE
PID:3148
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.0MB
MD531e5e3ac5a03d60d67188b6b0c3d152b
SHA141e831bc8b0c314a46d17492ded7b6b587d66db2
SHA256dc73ce51066fdcd5f0c7c88fd6fdfb9a4a3722ebe3d2def1dc593fbc1af9e467
SHA51264837c66af3f63c214ff8f466266f3dea1cf135d54ccaaf5c06fa13763045d79220f88d09ca49a36668d7e1f506bc74c9a2b8de0ec77aac272b0e1466aa168c2
-
Filesize
180B
MD5e987dfb8862f5fb43bccda3e1c91c0d7
SHA18d62a6f4a09979b07b1b55c9a040f2f69a72e0c1
SHA2566e48bc2c057f41f98c74b941d14486a9255a96a9e00663b621812a2815902fcd
SHA512ea2bf1b6080ab1872fe12995ff97288302e1fe76d963f558ec39d4c7216138af9de8750be1461a50a9076fbb74470a58ad8fe94c06a7a1d969067b3baf9bfa76
-
Filesize
11KB
MD5da23f44a96e6aa3a8b80f1cc40169dae
SHA19c5ff4215e46407da34524ce4f26841aa2c842c6
SHA2562d86ab0d97a265aa7b465439ac97c0c6b428a3bdc18000625f3fd66c07ff6f70
SHA512ccf6056c176a98e2f235f22667ea1497191a3cb373fc63632467de6255493c98fcb315d55a634cd0bb10e6087d832f46d0712fb3661dd3786bd9fe360981a035