Analysis
- max time kernel
150s - max time network
148s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
06/10/2026, 16:38
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
jaffacakes118_Trojan-GameThief.Win32.Magania.fdee.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
6 signatures
150 seconds
Behavioral task
behavioral2
Sample
jaffacakes118_Trojan-GameThief.Win32.Magania.fdee.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
6 signatures
150 seconds
General
- Target jaffacakes118_Trojan-GameThief.Win32.Magania.fdee.exe
- Size 148KB
- Sample261006-t5mnmsdw2j
- SHA256 9a6ac9c52e2f9dd2fe02462e9219e374c68a673ec480d350dab3c53e72fd214a
- MD5 f2dec928950b4a2fe647cf65fbd407a5
- SHA1 179ef64705894bc27ff1b671f27baa7340650b06
- SHA512 26c8d47a51f0fe26fd0fd8ac411ddba299d00df1fc7914cef093b0dd78aaa274428729e8d31d54d2a014411ad3cd9f1eb958495187012c6fcdd62a3d2f620855
- SSDEEP 3072:cUqYW8TOt7UvapdtDcex9/2lVvy/whjLwBDrk:clYWIGUCpdtDPIlFGwhvwBX
- TLSH T18CE37C117AD050BAE0F6013C68E97F379B7BACB44A558C47B73489892CB5A49DB32F43
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Loads dropped DLL 2 IoCs
pid Process 4200 jaffacakes118_Trojan-GameThief.Win32.Magania.fdee.exe 1256 svchost.exe - Drops file in Windows directory 4 IoCs
description ioc Process File created C:\windows\temp2420500.dll jaffacakes118_Trojan-GameThief.Win32.Magania.fdee.exe File opened for modification C:\windows\temp2420500.dll jaffacakes118_Trojan-GameThief.Win32.Magania.fdee.exe File opened for modification C:\Windows\FileName.jpg jaffacakes118_Trojan-GameThief.Win32.Magania.fdee.exe File created C:\Windows\FileName.jpg jaffacakes118_Trojan-GameThief.Win32.Magania.fdee.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jaffacakes118_Trojan-GameThief.Win32.Magania.fdee.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1256 svchost.exe 1256 svchost.exe 1256 svchost.exe 1256 svchost.exe 1256 svchost.exe 1256 svchost.exe 1256 svchost.exe 1256 svchost.exe 1256 svchost.exe 1256 svchost.exe 1256 svchost.exe 1256 svchost.exe 1256 svchost.exe 1256 svchost.exe 1256 svchost.exe 1256 svchost.exe 1256 svchost.exe 1256 svchost.exe 1256 svchost.exe 1256 svchost.exe 1256 svchost.exe 1256 svchost.exe 1256 svchost.exe 1256 svchost.exe 1256 svchost.exe 1256 svchost.exe 1256 svchost.exe 1256 svchost.exe 1256 svchost.exe 1256 svchost.exe 1256 svchost.exe 1256 svchost.exe 1256 svchost.exe 1256 svchost.exe 1256 svchost.exe 1256 svchost.exe 1256 svchost.exe 1256 svchost.exe 1256 svchost.exe 1256 svchost.exe 1256 svchost.exe 1256 svchost.exe 1256 svchost.exe 1256 svchost.exe 1256 svchost.exe 1256 svchost.exe 1256 svchost.exe 1256 svchost.exe 1256 svchost.exe 1256 svchost.exe 1256 svchost.exe 1256 svchost.exe 1256 svchost.exe 1256 svchost.exe 1256 svchost.exe 1256 svchost.exe 1256 svchost.exe 1256 svchost.exe 1256 svchost.exe 1256 svchost.exe 1256 svchost.exe 1256 svchost.exe 1256 svchost.exe 1256 svchost.exe - Suspicious behavior: LoadsDriver 6 IoCs
pid Process 4 Process not Found 4 Process not Found 4 Process not Found 4 Process not Found 4 Process not Found 812 Process not Found - Suspicious use of AdjustPrivilegeToken 8 IoCs
description pid Process Token: SeBackupPrivilege 4200 jaffacakes118_Trojan-GameThief.Win32.Magania.fdee.exe Token: SeRestorePrivilege 4200 jaffacakes118_Trojan-GameThief.Win32.Magania.fdee.exe Token: SeBackupPrivilege 4200 jaffacakes118_Trojan-GameThief.Win32.Magania.fdee.exe Token: SeRestorePrivilege 4200 jaffacakes118_Trojan-GameThief.Win32.Magania.fdee.exe Token: SeBackupPrivilege 4200 jaffacakes118_Trojan-GameThief.Win32.Magania.fdee.exe Token: SeRestorePrivilege 4200 jaffacakes118_Trojan-GameThief.Win32.Magania.fdee.exe Token: SeBackupPrivilege 4200 jaffacakes118_Trojan-GameThief.Win32.Magania.fdee.exe Token: SeRestorePrivilege 4200 jaffacakes118_Trojan-GameThief.Win32.Magania.fdee.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-GameThief.Win32.Magania.fdee.exe"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-GameThief.Win32.Magania.fdee.exe"1⤵
- Loads dropped DLL
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:4200
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe -k imgsvc1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:1256
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k imgsvc1⤵PID:5772
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Windows\temp2420500.dll
- Size 101KB
- SHA256 5d04ffb8078648d0073683ea82b067a9eb88ce30c91a202d2080b97d076a45ba
- MD5 f1f9ea7251f84410ff35551487a9d36c
- SHA1 bf26c10a429241897d62f2f0501246d8391cf34a
- SHA512 79bdd1a79a0e5c5bf8adb54eed9c0409cb0ac3e959c80d4c36a761369fa8c443d286cba214901346d484af92b31b86a71151f521aeb5a53d4101ea0c3c3e2bc5
- SSDEEP 1536:zwHvUYGRegHdtR/nf1lGAcC9Rx9cI22+fVvyV9whjLwBDdXV:zUvapdtDcex9/2lVvy/whjLwBDr
- TLSH T161A35A117A9050BAE0F5143CA9A93F37DB7BACE44948CD47BB3485882CB5A09DB36F47
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path \??\c:\windows\filename.jpg
- Size 8.8MB
- SHA256 85a2ed84eaa34e827d79e1b3c2ffd25665a605cefc1f5e000925bf7a4af108c2
- MD5 5b52b7f2ef1eaa951cd8ecb637c92192
- SHA1 57595c070bd0eabdfd4a6c7c8e6bbaa731fc0e7b
- SHA512 6bef1692c19e379c159e5bc4b966937b52ee670d688bc48b3bf6f6a2f157331a8b5c111443a88db75c243cde858b64bd0955885b07c21ba65c4e49ec248ef448
- SSDEEP 196608:4JQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQk:4JQQQQQQQQQQQQQQQQQQQQQQQQQQQQQk
- TLSH T1B996BFD8C631339CED9B3C375821711AA76CE47639335AED6CE5B854A82CAB9323D134
- MD5 SHA1 SHA512 SSDEEP TLSH
