Analysis
- max time kernel
150s - max time network
134s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
14/10/2026, 09:28
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
jaffacakes118_Trojan-GameThief.Win32.Magania.tzio.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
jaffacakes118_Trojan-GameThief.Win32.Magania.tzio.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
8 signatures
150 seconds
General
- Target jaffacakes118_Trojan-GameThief.Win32.Magania.tzio.exe
- Size 141KB
- Sample261014-lftfwsfd93
- SHA256 5ea088511d4a3e42606f5e382fe096794888f18ecc1fd5c301c3205a5af67223
- MD5 9e6edb444896beb858427a133919ab6e
- SHA1 ef97e192879fd695dcf929cbe266de0a0e48f3a3
- SHA512 915186cea790bd8de4d2eb5c5ce7aae664a2bb073e111d5f756d3b42a761fa4fcdfed29c5a7d2c7e7923dd6dd1694c9674c1006653a45ce5905a14acd93f3045
- SSDEEP 3072:+HcxWthDtm+mZO1gJX+K+wuDdrylpgqVR6SbwQY0uG62clCttC7BS:+H3I+mZ0gJ7ADlYpgq+SbwQx
- TLSH T1EFE38D1279D040BAE1FA043C55BE3B36DB7FA4744A29C943F72496492CB1969DB22F83
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Deletes itself 1 TTPs 1 IoCs
pid Process 2828 svchost.exe - Loads dropped DLL 2 IoCs
pid Process 5028 jaffacakes118_Trojan-GameThief.Win32.Magania.tzio.exe 2828 svchost.exe - Drops file in Program Files directory 2 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Bfqo\Yjoinebsn.bmp jaffacakes118_Trojan-GameThief.Win32.Magania.tzio.exe File created C:\Program Files (x86)\Bfqo\Yjoinebsn.bmp jaffacakes118_Trojan-GameThief.Win32.Magania.tzio.exe - Drops file in Windows directory 2 IoCs
description ioc Process File created C:\Windows\temp1093900.dll jaffacakes118_Trojan-GameThief.Win32.Magania.tzio.exe File opened for modification C:\Windows\temp1093900.dll jaffacakes118_Trojan-GameThief.Win32.Magania.tzio.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jaffacakes118_Trojan-GameThief.Win32.Magania.tzio.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 5028 jaffacakes118_Trojan-GameThief.Win32.Magania.tzio.exe 5028 jaffacakes118_Trojan-GameThief.Win32.Magania.tzio.exe 2828 svchost.exe 2828 svchost.exe 2828 svchost.exe 2828 svchost.exe 2828 svchost.exe 2828 svchost.exe 2828 svchost.exe 2828 svchost.exe 2828 svchost.exe 2828 svchost.exe 2828 svchost.exe 2828 svchost.exe 2828 svchost.exe 2828 svchost.exe 2828 svchost.exe 2828 svchost.exe 2828 svchost.exe 2828 svchost.exe 2828 svchost.exe 2828 svchost.exe 2828 svchost.exe 2828 svchost.exe 2828 svchost.exe 2828 svchost.exe 2828 svchost.exe 2828 svchost.exe 2828 svchost.exe 2828 svchost.exe 2828 svchost.exe 2828 svchost.exe 2828 svchost.exe 2828 svchost.exe 2828 svchost.exe 2828 svchost.exe 2828 svchost.exe 2828 svchost.exe 2828 svchost.exe 2828 svchost.exe 2828 svchost.exe 2828 svchost.exe 2828 svchost.exe 2828 svchost.exe 2828 svchost.exe 2828 svchost.exe 2828 svchost.exe 2828 svchost.exe 2828 svchost.exe 2828 svchost.exe 2828 svchost.exe 2828 svchost.exe 2828 svchost.exe 2828 svchost.exe 2828 svchost.exe 2828 svchost.exe 2828 svchost.exe 2828 svchost.exe 2828 svchost.exe 2828 svchost.exe 2828 svchost.exe 2828 svchost.exe 2828 svchost.exe 2828 svchost.exe - Suspicious behavior: LoadsDriver 6 IoCs
pid Process 4 Process not Found 4 Process not Found 4 Process not Found 4 Process not Found 4 Process not Found 816 Process not Found - Suspicious use of AdjustPrivilegeToken 8 IoCs
description pid Process Token: SeBackupPrivilege 5028 jaffacakes118_Trojan-GameThief.Win32.Magania.tzio.exe Token: SeRestorePrivilege 5028 jaffacakes118_Trojan-GameThief.Win32.Magania.tzio.exe Token: SeBackupPrivilege 5028 jaffacakes118_Trojan-GameThief.Win32.Magania.tzio.exe Token: SeRestorePrivilege 5028 jaffacakes118_Trojan-GameThief.Win32.Magania.tzio.exe Token: SeBackupPrivilege 5028 jaffacakes118_Trojan-GameThief.Win32.Magania.tzio.exe Token: SeRestorePrivilege 5028 jaffacakes118_Trojan-GameThief.Win32.Magania.tzio.exe Token: SeBackupPrivilege 5028 jaffacakes118_Trojan-GameThief.Win32.Magania.tzio.exe Token: SeRestorePrivilege 5028 jaffacakes118_Trojan-GameThief.Win32.Magania.tzio.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-GameThief.Win32.Magania.tzio.exe"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-GameThief.Win32.Magania.tzio.exe"1⤵
- Loads dropped DLL
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5028
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe -k imgsvc1⤵
- Deletes itself
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:2828
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k imgsvc1⤵PID:5268
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Windows\temp1093900.dll
- Size 98KB
- SHA256 832d46b2528698444d989ea3a855b5dbe24e4bfa184989ddd40093a8aaa9c2bd
- MD5 8c51a7aedaab0229827220d4968a66d8
- SHA1 0f7181b0dcff3e925669ab2b9dd5c0310f0a0d53
- SHA512 a252ba08888eb16d8b8fb678d3fd3ac081143a51ba23abe383aa9a06a9cee1159632d792d4119ed9d34b61fa4e4388a5ff718348b686b0e065836d18dd7860b0
- SSDEEP 1536:q8dmZq81mOTRkP1n7ERKVf0lGMX+w9+crujfdryeIpG7qGuR6SbwQYWX:q+mZO1gJX+K+wuDdrylpgqVR6SbwQY
- TLSH T100A38D56B5C050FAE1FA043C55BE3B36EB7BA4784819CD43F72482496CB2929DB21F87
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path \??\c:\NT_Path.old
- Size 114B
- SHA256 14e4d126b12601d8d309e3d5edfadea7d91e26b8ac20534d9d53ff093eed0649
- MD5 c048b77efa5c7e33d15fb5132e48c766
- SHA1 23fafda878380b65a73fb547f05229df1ebb31d8
- SHA512 d67e62b024133d80e77afe720f625b27833e27d6d8f3ad446cafedbdb8684bd294baf56a47321269bd312400b3e1fb5620bcd2b05ddf55788b90b449387e1af3
- TLSH T1B9B012814291491A8908DC3B41BDEFDF8270790C7EA53B348731C08A59207DBBE8131C
- MD5 SHA1 SHA512 TLSH
- Path \??\c:\program files (x86)\bfqo\yjoinebsn.bmp
- Size 8.2MB
- SHA256 aa581a4eac91b285325b15c9fce3d2e627999a325b1f6d337941ab2572547c25
- MD5 80efd82573ac05575ecac2dd52394ce4
- SHA1 9e0989f44ac68f8ab9d0365fed4f1f52302a09bf
- SHA512 d3e3da5824e496e3029ec775c8c0d5c7423c4f1de221e81bb7b3aedbff41b8ddd16cb8907d3bf75de7c7480dfc1c348ff317790f02dfea7dfaa48d6b7fc21146
- SSDEEP 3072:q+mZO1gJX+K+wuDdrylpgqVR6SbwQYfaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaV:q+mZ0gJ7ADlYpgq+SbwQu
- TLSH T1F1969FE2D2E9AC0EF0B71EEF762D96D6E13BDC0272BC1EB412C6545EC6E1605399041E
- MD5 SHA1 SHA512 SSDEEP TLSH
