Analysis
- max time kernel
150s - max time network
139s - platform
windows10-2004_x64 - resource
win10v2004-20260911-en - resource tags
arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
14/10/2026, 09:28
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
jaffacakes118_Trojan-GameThief.Win32.Magania.tzio.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
jaffacakes118_Trojan-GameThief.Win32.Magania.tzio.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
8 signatures
150 seconds
General
- Target jaffacakes118_Trojan-GameThief.Win32.Magania.tzio.exe
- Size 141KB
- Sample261014-lftfwsfd93
- SHA256 5ea088511d4a3e42606f5e382fe096794888f18ecc1fd5c301c3205a5af67223
- MD5 9e6edb444896beb858427a133919ab6e
- SHA1 ef97e192879fd695dcf929cbe266de0a0e48f3a3
- SHA512 915186cea790bd8de4d2eb5c5ce7aae664a2bb073e111d5f756d3b42a761fa4fcdfed29c5a7d2c7e7923dd6dd1694c9674c1006653a45ce5905a14acd93f3045
- SSDEEP 3072:+HcxWthDtm+mZO1gJX+K+wuDdrylpgqVR6SbwQY0uG62clCttC7BS:+H3I+mZ0gJ7ADlYpgq+SbwQx
- TLSH T1EFE38D1279D040BAE1FA043C55BE3B36DB7FA4744A29C943F72496492CB1969DB22F83
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Deletes itself 1 TTPs 1 IoCs
pid Process 1752 svchost.exe - Loads dropped DLL 2 IoCs
pid Process 2120 jaffacakes118_Trojan-GameThief.Win32.Magania.tzio.exe 1752 svchost.exe - Drops file in Program Files directory 2 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Bfqo\Yjoinebsn.bmp jaffacakes118_Trojan-GameThief.Win32.Magania.tzio.exe File created C:\Program Files (x86)\Bfqo\Yjoinebsn.bmp jaffacakes118_Trojan-GameThief.Win32.Magania.tzio.exe - Drops file in Windows directory 2 IoCs
description ioc Process File created C:\Windows\temp1824500.dll jaffacakes118_Trojan-GameThief.Win32.Magania.tzio.exe File opened for modification C:\Windows\temp1824500.dll jaffacakes118_Trojan-GameThief.Win32.Magania.tzio.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jaffacakes118_Trojan-GameThief.Win32.Magania.tzio.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2120 jaffacakes118_Trojan-GameThief.Win32.Magania.tzio.exe 2120 jaffacakes118_Trojan-GameThief.Win32.Magania.tzio.exe 1752 svchost.exe 1752 svchost.exe 1752 svchost.exe 1752 svchost.exe 1752 svchost.exe 1752 svchost.exe 1752 svchost.exe 1752 svchost.exe 1752 svchost.exe 1752 svchost.exe 1752 svchost.exe 1752 svchost.exe 1752 svchost.exe 1752 svchost.exe 1752 svchost.exe 1752 svchost.exe 1752 svchost.exe 1752 svchost.exe 1752 svchost.exe 1752 svchost.exe 1752 svchost.exe 1752 svchost.exe 1752 svchost.exe 1752 svchost.exe 1752 svchost.exe 1752 svchost.exe 1752 svchost.exe 1752 svchost.exe 1752 svchost.exe 1752 svchost.exe 1752 svchost.exe 1752 svchost.exe 1752 svchost.exe 1752 svchost.exe 1752 svchost.exe 1752 svchost.exe 1752 svchost.exe 1752 svchost.exe 1752 svchost.exe 1752 svchost.exe 1752 svchost.exe 1752 svchost.exe 1752 svchost.exe 1752 svchost.exe 1752 svchost.exe 1752 svchost.exe 1752 svchost.exe 1752 svchost.exe 1752 svchost.exe 1752 svchost.exe 1752 svchost.exe 1752 svchost.exe 1752 svchost.exe 1752 svchost.exe 1752 svchost.exe 1752 svchost.exe 1752 svchost.exe 1752 svchost.exe 1752 svchost.exe 1752 svchost.exe 1752 svchost.exe 1752 svchost.exe - Suspicious behavior: LoadsDriver 6 IoCs
pid Process 4 Process not Found 4 Process not Found 4 Process not Found 4 Process not Found 4 Process not Found 656 Process not Found - Suspicious use of AdjustPrivilegeToken 8 IoCs
description pid Process Token: SeBackupPrivilege 2120 jaffacakes118_Trojan-GameThief.Win32.Magania.tzio.exe Token: SeRestorePrivilege 2120 jaffacakes118_Trojan-GameThief.Win32.Magania.tzio.exe Token: SeBackupPrivilege 2120 jaffacakes118_Trojan-GameThief.Win32.Magania.tzio.exe Token: SeRestorePrivilege 2120 jaffacakes118_Trojan-GameThief.Win32.Magania.tzio.exe Token: SeBackupPrivilege 2120 jaffacakes118_Trojan-GameThief.Win32.Magania.tzio.exe Token: SeRestorePrivilege 2120 jaffacakes118_Trojan-GameThief.Win32.Magania.tzio.exe Token: SeBackupPrivilege 2120 jaffacakes118_Trojan-GameThief.Win32.Magania.tzio.exe Token: SeRestorePrivilege 2120 jaffacakes118_Trojan-GameThief.Win32.Magania.tzio.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-GameThief.Win32.Magania.tzio.exe"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-GameThief.Win32.Magania.tzio.exe"1⤵
- Loads dropped DLL
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2120
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe -k imgsvc1⤵
- Deletes itself
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:1752
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k imgsvc1⤵PID:1936
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Windows\temp1824500.dll
- Size 98KB
- SHA256 832d46b2528698444d989ea3a855b5dbe24e4bfa184989ddd40093a8aaa9c2bd
- MD5 8c51a7aedaab0229827220d4968a66d8
- SHA1 0f7181b0dcff3e925669ab2b9dd5c0310f0a0d53
- SHA512 a252ba08888eb16d8b8fb678d3fd3ac081143a51ba23abe383aa9a06a9cee1159632d792d4119ed9d34b61fa4e4388a5ff718348b686b0e065836d18dd7860b0
- SSDEEP 1536:q8dmZq81mOTRkP1n7ERKVf0lGMX+w9+crujfdryeIpG7qGuR6SbwQYWX:q+mZO1gJX+K+wuDdrylpgqVR6SbwQY
- TLSH T100A38D56B5C050FAE1FA043C55BE3B36EB7BA4784819CD43F72482496CB2929DB21F87
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path \??\c:\NT_Path.old
- Size 114B
- SHA256 a7d34e67a7ce1b05fb3d5de1e560a1cec58e98f2174c0cfe7ecdd9958c8f0bc5
- MD5 2137d4d86ba06e3072060dd8dce29d34
- SHA1 cb2aa9a40e9cdca360c492d33d1cef19771c5f53
- SHA512 d0b80d7baa27532d854f11455f97235a38d797971ecaae1ea8cc93fe6d57d01ba9bacd5f162c131fa92280c96468cd85d0ad4fa0b90f044d4aac3021ef7240d5
- TLSH T1ABB012844291495A4905DC3B42FDDFDF8470A90D3EA53B308735C1899A302DBBE8132C
- MD5 SHA1 SHA512 TLSH
- Path \??\c:\program files (x86)\bfqo\yjoinebsn.bmp
- Size 11.2MB
- SHA256 d0ef3542a6f2bd503b68259b5a5e768b7d2901aa07360ff8ff35446ab2897cc7
- MD5 d41d6e2c31f442cefc8d956bdaa68ab8
- SHA1 ed0861de849814ed37b2601532d2634b7d8d7671
- SHA512 a7933bf296d933af145dda9dff7af341927efdf589c4b91fb85e7439dc89896e9cadc1caa6180ea2d822ea3666fea088af19abcc90dd749a42d472c341972310
- SSDEEP 49152:q+Ygrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrq:q+q
- TLSH T19DC6D10815E307AAF8C58BD08A68387D69C4C51AF53EE3BF166FD6C66B986C904D4FC4
- MD5 SHA1 SHA512 SSDEEP TLSH
