Analysis

  • max time kernel
    438s
  • max time network
    459s
  • platform
    windows11-21h2_x64
  • resource
    win11-20240802-en
  • resource tags

    arch:x64arch:x86image:win11-20240802-enlocale:en-usos:windows11-21h2-x64system
  • submitted
    25/08/2024, 10:09

General

  • Target

    [Open Beta] Grand_Theft_Auto_VI.exe

  • Size

    376KB

  • MD5

    a8bc7fb55a324f1ba1c7807b7c1c4f29

  • SHA1

    9286664648e7629ff1cc35ca030e22a45a913c9d

  • SHA256

    f17b6dc2f1dc25b982d1d3da8601121a1f21e16be3fe406d3cff62100cf7562b

  • SHA512

    726d8dca09ed5173f17a7c271cfb8faf6e83547390a55c7afcca6213c25da0e5f55599616b65b297ddaf606d0c2194ef98e9df9a45490950f23a0a3c9bb1d534

  • SSDEEP

    6144:CNwt6ykfy77nrjTPhSVQBFD7sxBUXEe9OmGC0GoOwwmVQBFv6jOjK:CNwz3nrj4QB97sx0d9OmGcwwyQB1OyK

Score
8/10

Malware Config

Signatures

  • Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

    Run Powershell and hide display window.

  • Enumerates connected drives 3 TTPs 23 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 24 IoCs
  • Suspicious use of FindShellTrayWindow 3 IoCs
  • Suspicious use of SendNotifyMessage 3 IoCs
  • Suspicious use of WriteProcessMemory 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\[Open Beta] Grand_Theft_Auto_VI.exe
    "C:\Users\Admin\AppData\Local\Temp\[Open Beta] Grand_Theft_Auto_VI.exe"
    1⤵
    • Enumerates connected drives
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:2440
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell.exe" -WindowStyle Hidden -ExecutionPolicy Bypass -Command "(Get-CimInstance -ClassName Win32_VideoController).Caption;"
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:1952

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\Local\Microsoft\Windows Media\12.0\WMSDKNS.XML

          Filesize

          9KB

          MD5

          7050d5ae8acfbe560fa11073fef8185d

          SHA1

          5bc38e77ff06785fe0aec5a345c4ccd15752560e

          SHA256

          cb87767c4a384c24e4a0f88455f59101b1ae7b4fb8de8a5adb4136c5f7ee545b

          SHA512

          a7a295ac8921bb3dde58d4bcde9372ed59def61d4b7699057274960fa8c1d1a1daff834a93f7a0698e9e5c16db43af05e9fd2d6d7c9232f7d26ffcff5fc5900b

        • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_xur0fdg4.tgu.ps1

          Filesize

          60B

          MD5

          d17fe0a3f47be24a6453e9ef58c94641

          SHA1

          6ab83620379fc69f80c0242105ddffd7d98d5d9d

          SHA256

          96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

          SHA512

          5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

        • memory/1952-31-0x00007FFE03150000-0x00007FFE03C12000-memory.dmp

          Filesize

          10.8MB

        • memory/1952-28-0x00007FFE03150000-0x00007FFE03C12000-memory.dmp

          Filesize

          10.8MB

        • memory/1952-35-0x00007FFE03150000-0x00007FFE03C12000-memory.dmp

          Filesize

          10.8MB

        • memory/1952-32-0x00007FFE03150000-0x00007FFE03C12000-memory.dmp

          Filesize

          10.8MB

        • memory/1952-30-0x00000254A6850000-0x00000254A6874000-memory.dmp

          Filesize

          144KB

        • memory/1952-29-0x00000254A6850000-0x00000254A687A000-memory.dmp

          Filesize

          168KB

        • memory/1952-27-0x000002548E4A0000-0x000002548E4C2000-memory.dmp

          Filesize

          136KB

        • memory/2440-8-0x000000001BF10000-0x000000001BF20000-memory.dmp

          Filesize

          64KB

        • memory/2440-5-0x000000001AF90000-0x000000001AFA2000-memory.dmp

          Filesize

          72KB

        • memory/2440-2-0x000000001B200000-0x000000001B31C000-memory.dmp

          Filesize

          1.1MB

        • memory/2440-3-0x00007FFE03150000-0x00007FFE03C12000-memory.dmp

          Filesize

          10.8MB

        • memory/2440-7-0x000000001BF50000-0x000000001BF82000-memory.dmp

          Filesize

          200KB

        • memory/2440-6-0x00007FFE03150000-0x00007FFE03C12000-memory.dmp

          Filesize

          10.8MB

        • memory/2440-0-0x00007FFE03153000-0x00007FFE03155000-memory.dmp

          Filesize

          8KB

        • memory/2440-1-0x0000000000240000-0x000000000029E000-memory.dmp

          Filesize

          376KB

        • memory/2440-4-0x0000000000BF0000-0x0000000000BFA000-memory.dmp

          Filesize

          40KB

        • memory/2440-36-0x0000000020890000-0x00000000208C8000-memory.dmp

          Filesize

          224KB

        • memory/2440-37-0x000000001DF60000-0x000000001DF6E000-memory.dmp

          Filesize

          56KB

        • memory/2440-39-0x0000000020C60000-0x0000000020C68000-memory.dmp

          Filesize

          32KB

        • memory/2440-38-0x000000001DFA0000-0x000000001DFA8000-memory.dmp

          Filesize

          32KB

        • memory/2440-40-0x00007FFE03150000-0x00007FFE03C12000-memory.dmp

          Filesize

          10.8MB