5ace6e0663fd22e24db7ca215ce1b8d9bce148b88e40ab0c93e94e7fbe5a6163

Analysis

max time kernel
150s
max time network
149s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
06/10/2026, 16:43

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
jaffacakes118_Trojan-GameThief.Win32.Magania.hsdo.exe
Size 180KB
Sample261006-t8jfdsff34
SHA256 5ace6e0663fd22e24db7ca215ce1b8d9bce148b88e40ab0c93e94e7fbe5a6163
MD5 ddbd2db90543c3190887296dc3a4d6aa
SHA1 005b4d28ff2b3f4af1aefa6f60e0846a9250fe06
SHA512 f740cfc07219a65ecbd723b3966d9f9068a8d7cf3199e8f52999f771251a6c35507c9b1acdbf7a148ab2156ba2865a6d20789d52a7a029eb68008a369da4307a
SSDEEP 3072:xaS4TSqOQznJw4TifIDQhzd0USwVAQnwwfFScsftgjUcMLHn1:xaS4GqzJw8gz+ZwVAQwwfFGfNcM5
TLSH
T14C049E427A4080F7E6F5003C94B53B33DBBBB874595E8947F70496992870AE6EB21F4B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
5116	XunLei.exe
1984	Pass.exe

Loads dropped DLL 1 IoCs

pid	Process
1412	rundll32.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\GrpConv = "grpconv -o"	rundll32.exe

Drops file in System32 directory 5 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\XunLei.exe	jaffacakes118_Trojan-GameThief.Win32.Magania.hsdo.exe
File created	C:\Windows\SysWOW64\newarea.dll	jaffacakes118_Trojan-GameThief.Win32.Magania.hsdo.exe
File created	C:\Windows\SysWOW64\KB1815552.inf	jaffacakes118_Trojan-GameThief.Win32.Magania.hsdo.exe
File opened for modification	C:\Windows\SysWOW64\KB1815552.inf	jaffacakes118_Trojan-GameThief.Win32.Magania.hsdo.exe
File created	C:\Windows\SysWOW64\KB1815552.bat	jaffacakes118_Trojan-GameThief.Win32.Magania.hsdo.exe

Drops file in Program Files directory 1 IoCs

description	ioc	Process
File created	C:\Program Files\Pass.exe	jaffacakes118_Trojan-GameThief.Win32.Magania.hsdo.exe

Executes a command shell one-liner 1 TTPs 2 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
5676	cmd.exe
4444	cmd.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
5980	1984	WerFault.exe	100

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	rundll32.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	rundll32.exe

System Location Discovery: System Language Discovery 1 TTPs 10 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	XunLei.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pass.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	grpconv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jaffacakes118_Trojan-GameThief.Win32.Magania.hsdo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jaffacakes118_Trojan-GameThief.Win32.Magania.hsdo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	runonce.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	runonce.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	runonce.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
5724	jaffacakes118_Trojan-GameThief.Win32.Magania.hsdo.exe
5724	jaffacakes118_Trojan-GameThief.Win32.Magania.hsdo.exe
4832	jaffacakes118_Trojan-GameThief.Win32.Magania.hsdo.exe
4832	jaffacakes118_Trojan-GameThief.Win32.Magania.hsdo.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	5116	XunLei.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 5724 wrote to memory of 4832	5724	jaffacakes118_Trojan-GameThief.Win32.Magania.hsdo.exe	89
PID 4832 wrote to memory of 5676	4832	jaffacakes118_Trojan-GameThief.Win32.Magania.hsdo.exe	90
PID 5676 wrote to memory of 3364	5676	cmd.exe	92
PID 3364 wrote to memory of 2820	3364	rundll32.exe	93
PID 2820 wrote to memory of 3608	2820	runonce.exe	96
PID 5116 wrote to memory of 1412	5116	XunLei.exe	99
PID 4832 wrote to memory of 1984	4832	jaffacakes118_Trojan-GameThief.Win32.Magania.hsdo.exe	100
PID 4832 wrote to memory of 4444	4832	jaffacakes118_Trojan-GameThief.Win32.Magania.hsdo.exe	104

C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-GameThief.Win32.Magania.hsdo.exe
"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-GameThief.Win32.Magania.hsdo.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:5724
- C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-GameThief.Win32.Magania.hsdo.exe
  C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-GameThief.Win32.Magania.hsdo.exe
  2⤵
  - Drops file in System32 directory
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:4832
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c C:\Windows\system32\KB1815552.bat
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5676
  - - C:\Windows\SysWOW64\rundll32.exe
      rundll32.exe setupapi,InstallHinfSection DefaultInstall 128 C:\Windows\system32\KB1815552.inf
      4⤵
      Adds Run key to start application
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:3364
    - - C:\Windows\SysWOW64\runonce.exe
        
        "C:\Windows\system32\runonce.exe" -r
        5⤵
        System Location Discovery: System Language Discovery
        Checks processor information in registry
        Suspicious use of WriteProcessMemory
        
        PID:2820
      - C:\Windows\SysWOW64\grpconv.exe
        
        "C:\Windows\System32\grpconv.exe" -o
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3608
- - C:\Program Files\Pass.exe
    "C:\\Program Files\Pass.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:1984
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1984 -s 268
      4⤵
      Program crash
      PID:5980
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /C DEL C:\Users\Admin\AppData\Local\Temp\JAFFAC~1.EXE > NUL
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    PID:4444

C:\Windows\system32\grpconv.exe
grpconv -o
1⤵
PID:4648

C:\Windows\SysWOW64\XunLei.exe
C:\Windows\SysWOW64\XunLei.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5116
- C:\Windows\SysWOW64\rundll32.exe
  rundll32 newarea.dll,main
  2⤵
  - Loads dropped DLL
  - Reads the TCP/IP host and domain name from the registry
  - System Location Discovery: System Language Discovery
  PID:1412

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 1984 -ip 1984
1⤵
PID:3044

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Pass.exe

Path C:\Program Files\Pass.exe
Size 31KB
SHA256 9a1b9f4193942b4810811d4d391098212775df80b818960c06770a34943e7c1c
MD5 4fd6ea7e4167c275b5928559078bd3b1
SHA1 f418ee411fece9819687b17913ece2e6a2592973
SHA512 ab734828cd099c72f79c258514f2054fa3d3da06f98f2c713daecad032de59216761b3d5432842cdc0f9f8a257f1454ac0f020ffec26972beaee43e8b2e24b07
SSDEEP 768:vDX7+LQuo/ykGyORyJQmd2eOeQjhrxIwhvZe:vjuojURyQmPOLHhvZe
TLSH
T1D7E2BE074A1D85D3E2731E7544BA669351DBB4B08B2F966F7B1CD00A2432FE0CAB4B5B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

KB1815552.bat

Path C:\Windows\SysWOW64\KB1815552.bat
Size 94B
SHA256 dab72c1fc2aad368554e04a32dffa1ba05286a9bb3f0b87acb39ff162a5259db
MD5 e4129780788c0b6e5819608abf99f204
SHA1 8e495017f7a55859043ff110d32ecbd615e3e9cf
SHA512 9557c057217f5dd2c18477b9d5e1ff9fdad738772a9477a682640522158b41b9d9d21ce39cd87948823d5e99e7ad00222a2a4f9d938946372c275e5b3dae7f41
TLSH
T182B012073E263532D0C41E6811072E260633E87E510A80D022D198C0E53141A0A00FBE
MD5 SHA1 SHA512 TLSH

Submit Download

KB1815552.inf

Path C:\Windows\SysWOW64\KB1815552.inf
Size 261B
SHA256 5c7a4173bd96a988f82cae889280b20e3258a2522c47db7a85ee12fa0e3cc4ee
MD5 4962099b2666131855f2d1ccc2e6a90b
SHA1 7bbbe99e55ff8ac40e81f33ccdc93849881f6570
SHA512 bfd10653278b28580ad137452f20d80b873f0d678f6c92472bf4e6dee332ad2d81f94ed79d0f77c8e7274db843192657ff8ddc8babc197f1a2abf40ce4110df3
TLSH
T1CED097089FA085F0C01830BC0F9B998C30286213B0483223BBC0AE5C9BC2C0CC7BE6B0
MD5 SHA1 SHA512 TLSH

Submit Download

XunLei.exe

Path C:\Windows\SysWOW64\XunLei.exe
Size 12.0MB
SHA256 91ec9e64ce153ba51914e540d93ecd0443a38bf579fab602ff0e92e3474a4736
MD5 fa77a2e9b9405f54acedda75bdc27dd3
SHA1 3c0379cd1e87e777c646688493f69ad94624cdab
SHA512 5b476f486742dfa969ccff82a66cb6a751a56f0a72143fcb482444d6b736864559b8b833cb41a6733d96a9ef6ff821782260d0a5658c35620f5d78de22b985ef
SSDEEP 192:hDaFGaJDalkKeSq0vkQThLXtQ0d7HP1oynb60PyXpD:FUfgkKeF4Z9Q0dL1d6eyXZ
TLSH
T1B6C6F9176E443877E4A353B49862273AEE127C3247294D0F5AA3EAD209719137CB8F1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

newarea.dll

Path C:\Windows\SysWOW64\newarea.dll
Size 120KB
SHA256 16ac8a61ec21b6ed15e21d00d966e5d79abfc2ee2f3c638075e044650beb6254
MD5 f05b02ec1c3adce8cde1a2c31abcee4f
SHA1 64481f35fc2b54c27e1aba32396b8b3391a1e80d
SHA512 14f3e371fd5b7b47dad0112d236864eb905ef8bd69cd46a63c3070eeef377817e8ac8270674c26a54574f2e6a20b1cfb99c2e2f695667058cbe2ea3ad46d34ba
SSDEEP 3072:zTSqOQznJw4TifIDQhzd0USwVAQnwwfFScY:zGqzJw8gz+ZwVAQwwfFm
TLSH
T1BEC37D41769081EAE5E5003CA8A53B33DFBB78348C5DC943F714A6992C74AA7E712F4B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1984-26-0x0000000000400000-0x0000000000407C00-memory.dmp

Download

memory/1984-28-0x0000000000400000-0x0000000000407C00-memory.dmp

Download

memory/5116-17-0x0000000000400000-0x0000000000404000-memory.dmp

Download

memory/5116-19-0x0000000000400000-0x0000000000404000-memory.dmp

Download