Edit tour

Windows Analysis Report
gta_sa.exe

Overview

General Information

Sample name:	gta_sa.exe
Analysis ID:	1559582
MD5:	e7697a085336f974a4a6102a51223960
SHA1:	0df50d56ef9e304c8d59366afa9aa5c71159261d
SHA256:	8c609f108ad737deffbd0d17c702f5974d290c4379de742277b809f80350da1c
Tags:	exegtasanandreassinvirususer-tuinsi

Detection

Score:	23
Range:	0 - 100
Whitelisted:	false
Confidence:	60%

Signatures

PE file has a writeable .text section

Creates a DirectInput object (often for capturing keystrokes)

Entry point lies outside standard sections

PE file contains more sections than normal

PE file contains sections with non-standard names

Program does not show much activity (idle)

Sample file is different than original file name gathered from version info

Uses 32bit PE files

Classification

Process Tree

System is w10x64

gta_sa.exe (PID: 2504 cmdline: "C:\Users\user\Desktop\gta_sa.exe" MD5: E7697A085336F974A4A6102A51223960)

cleanup

Malware Configuration

⊘No configs have been found

Yara Signatures

⊘No yara matches

Sigma Signatures

⊘No Sigma rule has matched

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

Source: gta_sa.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE

Source:	Binary string: x:\SA_PC_SRC (pcv110 - final)\gta_source\MSVC PC files\D3D9 Final\gta_sa.pdbWINMM.dll source: gta_sa.exe
Source:	Binary string: x:\SA_PC_SRC (pcv110 - final)\gta_source\MSVC PC files\D3D9 Final\gta_sa.pdb source: gta_sa.exe

Source: gta_sa.exe	String found in binary or memory: http://www.rockstargames.com
Source: gta_sa.exe	String found in binary or memory: http://www.rockstargames.com/sanandreas
Source: gta_sa.exe	String found in binary or memory: http://www.rockstarnorth.com

Source: gta_sa.exe, 00000000.00000000.1705095651.0000000000858000.00000002.00000001.01000000.00000003.sdmp

Binary or memory string: Please check you have installed Direct X 9 correctly : Couldn't DirectDrawCreateEx

memstr_68087084-d

System Summary

PE file has a writeable .text section

Source: gta_sa.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Source: gta_sa.exe

Static PE information: Number of sections : 11 > 10

Source: gta_sa.exe, 00000000.00000000.1705376592.0000000001480000.00000080.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenamesony_ssm.sysD vs gta_sa.exe
Source: gta_sa.exe, 00000000.00000000.1705376592.0000000001480000.00000080.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilename vs gta_sa.exe
Source: gta_sa.exe, 00000000.00000000.1705376592.0000000001480000.00000080.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenamesony_ssm.vxd?+LegalCopyrightCopyright (C) 2004/05 Sony DADC Austria AG vs gta_sa.exe
Source: gta_sa.exe, 00000000.00000000.1705376592.0000000001480000.00000080.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameCmdLineExt.dll, vs gta_sa.exe
Source: gta_sa.exe, 00000000.00000000.1705376592.0000000001480000.00000080.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameUAService7.exeD vs gta_sa.exe
Source: gta_sa.exe, 00000000.00000002.2962479592.0000000001456000.00000080.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameSecuExp.exeD vs gta_sa.exe
Source: gta_sa.exe	Binary or memory string: OriginalFilenameSecuExp.exeD vs gta_sa.exe
Source: gta_sa.exe	Binary or memory string: OriginalFilenamesony_ssm.sysD vs gta_sa.exe
Source: gta_sa.exe	Binary or memory string: OriginalFilename vs gta_sa.exe
Source: gta_sa.exe	Binary or memory string: OriginalFilenamesony_ssm.vxd?+LegalCopyrightCopyright (C) 2004/05 Sony DADC Austria AG vs gta_sa.exe
Source: gta_sa.exe	Binary or memory string: OriginalFilenameCmdLineExt.dll, vs gta_sa.exe
Source: gta_sa.exe	Binary or memory string: OriginalFilenameUAService7.exeD vs gta_sa.exe

Source: gta_sa.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE

Source: gta_sa.exe

Binary string: @B\Device\sony_ssm.sys\DosDevices\sony_ssm.sys`

Source: classification engine

Classification label: sus23.winEXE@1/0@0/0

Source: C:\Users\user\Desktop\gta_sa.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: gta_sa.exe	String found in binary or memory: %s -install to install the service
Source: gta_sa.exe	String found in binary or memory: UserAccess7%s -install to install the service

Source: C:\Users\user\Desktop\gta_sa.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\gta_sa.exe	Section loaded: aclayers.dll	Jump to behavior
Source: C:\Users\user\Desktop\gta_sa.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\Desktop\gta_sa.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Users\user\Desktop\gta_sa.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Users\user\Desktop\gta_sa.exe	Section loaded: acspecfc.dll	Jump to behavior
Source: C:\Users\user\Desktop\gta_sa.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\gta_sa.exe	Section loaded: mscms.dll	Jump to behavior
Source: C:\Users\user\Desktop\gta_sa.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\gta_sa.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\gta_sa.exe	Section loaded: ddraw.dll	Jump to behavior
Source: C:\Users\user\Desktop\gta_sa.exe	Section loaded: dwmapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\gta_sa.exe	Section loaded: msi.dll	Jump to behavior
Source: C:\Users\user\Desktop\gta_sa.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\gta_sa.exe	Section loaded: coloradapterclient.dll	Jump to behavior
Source: C:\Users\user\Desktop\gta_sa.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\gta_sa.exe	Section loaded: dxgi.dll	Jump to behavior
Source: C:\Users\user\Desktop\gta_sa.exe	Section loaded: dciman32.dll	Jump to behavior
Source: C:\Users\user\Desktop\gta_sa.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\gta_sa.exe	Section loaded: vorbisfile.dll	Jump to behavior
Source: C:\Users\user\Desktop\gta_sa.exe	Section loaded: eax.dll	Jump to behavior
Source: C:\Users\user\Desktop\gta_sa.exe	Section loaded: version.dll	Jump to behavior

Source: gta_sa.exe	Static PE information: Virtual size of .text is bigger than: 0x100000
Source: gta_sa.exe	Static PE information: Virtual size of .text is bigger than: 0x100000

Source: gta_sa.exe

Static file information: File size 14405632 > 1048576

Source: gta_sa.exe	Static PE information: Raw size of .text is bigger than: 0x100000 < 0x456000
Source: gta_sa.exe	Static PE information: Raw size of .text is bigger than: 0x100000 < 0x64a000
Source: gta_sa.exe	Static PE information: Raw size of .data is bigger than: 0x100000 < 0x255000

Source: gta_sa.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: x:\SA_PC_SRC (pcv110 - final)\gta_source\MSVC PC files\D3D9 Final\gta_sa.pdbWINMM.dll source: gta_sa.exe
Source:	Binary string: x:\SA_PC_SRC (pcv110 - final)\gta_source\MSVC PC files\D3D9 Final\gta_sa.pdb source: gta_sa.exe

Source: initial sample

Static PE information: section where entry point is pointing to: .init

Source: gta_sa.exe	Static PE information: section name: _rwcseg
Source: gta_sa.exe	Static PE information: section name: _TEXT_HA
Source: gta_sa.exe	Static PE information: section name: _rwdseg
Source: gta_sa.exe	Static PE information: section name: .init
Source: gta_sa.exe	Static PE information: section name: .securom

Source: all processes

Thread injection, dropped files, key value created, disk infection and DNS query: no activity detected

Source: gta_sa.exe

Binary or memory string: 7HGfSV/(jH`qq

Source: all processes

Thread injection, dropped files, key value created, disk infection and DNS query: no activity detected

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	2 Command and Scripting Interpreter	1 DLL Side-Loading	1 DLL Side-Loading	1 DLL Side-Loading	1 Input Capture	1 Security Software Discovery	Remote Services	1 Input Capture	Data Obfuscation	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	Rootkit	LSASS Memory	1 System Information Discovery	Remote Desktop Protocol	Data from Removable Media	Junk Data	Exfiltration Over Bluetooth	Network Denial of Service

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
gta_sa.exe	0%	ReversingLabs

Source	Detection	Scanner	Label	Link
http://www.rockstarnorth.com	0%	Avira URL Cloud	safe

Name	Source	Malicious	Antivirus Detection	Reputation
http://www.rockstargames.com	gta_sa.exe	false		high
http://www.rockstarnorth.com	gta_sa.exe	false	Avira URL Cloud: safe	unknown
http://www.rockstargames.com/sanandreas	gta_sa.exe	false		high

World Map of Contacted IPs

⊘No contacted IP infos

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1559582
Start date and time:	2024-11-20 17:30:10 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 32s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	5
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	gta_sa.exe
Detection:	SUS
Classification:	sus23.winEXE@1/0@0/0
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, SIHClient.exe, conhost.exe
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, otelrules.azureedge.net, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
VT rate limit hit for: gta_sa.exe

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.428002861421193
TrID:	Win32 Executable (generic) a (10002005/4) 98.68% Windows ActiveX control (116523/4) 1.15% DOS Executable Borland C++ (13009/5) 0.13% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02%
File name:	gta_sa.exe
File size:	14'405'632 bytes
MD5:	e7697a085336f974a4a6102a51223960
SHA1:	0df50d56ef9e304c8d59366afa9aa5c71159261d
SHA256:	8c609f108ad737deffbd0d17c702f5974d290c4379de742277b809f80350da1c
SHA512:	2abc0796fa3f4e194c7714ea15e6fea0ce34adee467adfb6ad96d56470718f7ae7c11dbe38f91699bd933a29edf7b0cf62bcdcc742df58a2aeb2b518e5c90d41
SSDEEP:	393216:CDNnPxT4+Xkn6x9ayhgvdQ65jvA2mqQ+:Uni+io9uvdQgA9q
TLSH:	A9E612577600C097EA4330724806FC967791CE745F7796A37B8CBE2E29B2694D8372E2
File Content Preview:	MZ......................@...................................@...).x.e.@..D<.......h.}.................(.b.'......'H.&)...t..F..I.-a?"\....`..pD%M..VV-...gY1(.>k.3...{@8d=>..tY z......GX.x.......(.....j.h.................f..G0. .....:.........X.4.*.@...%..

File Icon


Icon Hash:	8e87878e9c8caeb7

Static PE Info

General

Entrypoint:	0x12ffe40
Entrypoint Section:	.init
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE
DLL Characteristics:
Time Stamp:	0x4270F18A [Thu Apr 28 14:22:02 2005 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	c07fc76a0773659fb8c5e6b5013914ea

Entrypoint Preview

Instruction
push eax
push ss
pop ss
pushfd
mov eax, dword ptr [esp]
test ah, 00000001h
je 00007FB384F0FCE7h
mov ecx, 000007BEh
xor eax, eax
je 00007FB384F0FCE3h
call 00007FB39B415582h
pop ss
pushfd
mov eax, dword ptr [esp]
test ah, 00000001h
je 00007FB384F0FCE7h
mov ecx, 000007BEh
xor eax, eax
je 00007FB384F0FCE3h
call 00007FB3088D5582h
in al, dx
and al, C7h
inc esp
and al, 20h
ficomp word ptr [eax+44C7132Ch]
and al, 1Ch
pushfd
add al, byte ptr [eax]
add byte ptr [ecx-46E7DBB4h], cl
adc dh, bh
das
add ecx, eax
dec esp
and al, 20h
add byte ptr [ecx-74EBDBBCh], cl
add dword ptr [eax+20244401h], edx
nop
add ecx, 04h
lea esi, dword ptr [esi]
dec word ptr [esp+1Ch]
nop
jne 00007FB384F0FCCDh
or byte ptr [esp+20h], 00000001h
mov ecx, dword ptr [esp+24h]
mov eax, dword ptr [esp+20h]
mov dword ptr [esp+20h], ecx
xchg edi, edi
mov ecx, dword ptr [esp+18h]
mov dword ptr [esp+24h], eax
mov eax, dword ptr [esp+14h]
add esp, 20h
nop
popfd
jnbe 00007FB384F0FCF3h
add dword ptr [esp], 012ADEEAh
add dword ptr [esp], 000510C3h
jmp 00007FB384F0FCDCh
push eax
push ss
pop ss
pushfd
mov eax, dword ptr [esp]
test ah, 00000001h
je 00007FB384F0FCE7h
mov ecx, 000007BEh
xor eax, eax
je 00007FB384F0FCE3h
call 00007FB39B415582h
pop ss
pushfd
mov eax, dword ptr [esp]
test ah, 00000001h
je 00007FB384F0FCE7h
mov ecx, 000000BEh

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x1157e12	0xdc	.securom
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x8b0000	0x520	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0x1156368	0x1c	.securom
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x115757a	0x44c	.securom
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x4a1ee0	0xa0	.rdata
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x455cda	0x456000	759a86ec888aca835be83bebb36c1cc1	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
_rwcseg	0x457000	0x451	0x1000	0c2f94cf9c1c85e37a8d1a6d9c1cd35b	False	0.28955078125	data	2.941959439091133	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x458000	0x4b29c	0x4c000	db7d4d54315fd5a8a7976f276eddfc9f	False	0.3458444695723684	OpenPGP Public Key	5.541613871037211	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x4a4000	0x3f9434	0x40000	8995715a053ef41f4333bdf7d75bea65	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
_TEXT_HA	0x89e000	0x10a82	0x11000	febc8925ffd3776de6530510bfa64292	False	0.5987333409926471	data	6.540908103945562	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
_rwdseg	0x8af000	0x8	0x1000	620f0b67a91f7f74151bc5be745b7110	False	0.00634765625	data	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x8b0000	0x520	0x1000	646afd3f5531f001cd9b81d0f834f78f	False	0.166259765625	data	1.5415565362664405	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.text	0x8b1000	0x649b20	0x64a000	f062b900278a4650741b3bb5d8d42279	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.init	0xefb000	0x58b0	0x6000	cb55fba15addd8f19db1a0801a1a6435	False	0.3461100260416667	data	6.101240107284273	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.data	0xf01000	0x2543c4	0x255000	878547f1485a698402473d89664a5c14	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.securom	0x1156000	0x21000	0x21000	7f9a63689422c0be83e02b065491d857	False	0.5552201704545454	data	6.467953452624957	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_ICON	0x8b0220	0x2e8	Device independent bitmap graphic, 32 x 64 x 4, image size 512, 16 important colors	English	Great Britain	0.5443548387096774
RT_DIALOG	0x8b00f0	0x12e	data	English	Great Britain	0.6158940397350994
RT_GROUP_ICON	0x8b0508	0x14	data	English	Great Britain	1.2

Imports

DLL	Import
WINMM.dll	timeEndPeriod, timeGetTime, timeBeginPeriod, timeGetDevCaps
vorbisfile.dll	ov_open_callbacks, ov_clear, ov_time_total, ov_time_tell, ov_read, ov_info, ov_time_seek
WS2_32.dll	recv, send, closesocket, htons, inet_addr, connect, WSAGetLastError, WSAStartup, WSACleanup, socket
EAX.DLL
KERNEL32.dll	VirtualProtect, GetOEMCP, GetACP, IsBadCodePtr, IsBadReadPtr, GetStringTypeW, GetStringTypeA, IsValidCodePage, IsValidLocale, EnumSystemLocalesA, GetLocaleInfoA, GetCPInfo, GetDateFormatA, VirtualQuery, GetTickCount, GetModuleHandleA, GetProcAddress, LoadLibraryA, GetFileSize, CloseHandle, LocalFree, WaitForSingleObjectEx, GetOverlappedResult, WaitForSingleObject, ReleaseSemaphore, SetFilePointer, GetLastError, ReadFile, SetLastError, CreateFileA, ResumeThread, SetThreadPriority, GetThreadPriority, GetCurrentThread, CreateThread, LocalAlloc, CreateSemaphoreA, GetDiskFreeSpaceA, Sleep, QueryPerformanceCounter, InterlockedIncrement, InterlockedDecrement, lstrcpyA, lstrcatA, lstrlenA, DeleteCriticalSection, SuspendThread, LeaveCriticalSection, EnterCriticalSection, InitializeCriticalSection, MultiByteToWideChar, DeleteFileA, TerminateThread, FindClose, FindNextFileA, GetFileAttributesA, FindFirstFileA, FreeLibrary, QueryPerformanceFrequency, OutputDebugStringA, GetLocalTime, CreateDirectoryA, GetUserDefaultLCID, SetStdHandle, CreateEventA, GetVolumeInformationA, GetDriveTypeA, GetLogicalDriveStringsA, SetErrorMode, GlobalMemoryStatus, GetVersionExA, GetCommandLineA, GetFullPathNameA, WideCharToMultiByte, lstrcmpiA, GetSystemInfo, IsProcessorFeaturePresent, LockResource, LoadResource, SizeofResource, FindResourceA, FindResourceW, MapViewOfFile, CreateFileMappingA, CreateFileW, UnmapViewOfFile, ReleaseMutex, CreateMutexA, GetCurrentProcessId, GetSystemDirectoryA, GetModuleFileNameA, FreeEnvironmentStringsA, UnhandledExceptionFilter, IsBadWritePtr, VirtualAlloc, VirtualFree, HeapCreate, HeapDestroy, GetFileType, GetStdHandle, SetHandleCount, FlushFileBuffers, LCMapStringW, LCMapStringA, WriteFile, FatalAppExitA, SetUnhandledExceptionFilter, HeapSize, TlsAlloc, TlsGetValue, TlsSetValue, GetCurrentThreadId, TlsFree, GetStartupInfoA, HeapReAlloc, HeapAlloc, HeapFree, GetSystemTimeAsFileTime, GetCurrentProcess, TerminateProcess, ExitProcess, RtlUnwind, RaiseException, InterlockedExchange, FreeEnvironmentStringsW, GetEnvironmentStringsW, SetConsoleCtrlHandler, GetTimeFormatA, CompareStringA, CompareStringW, SetEnvironmentVariableA, GetTimeZoneInformation, SetEndOfFile, GetLocaleInfoW, GetCurrentDirectoryA, GetSystemDefaultLCID, SetCurrentDirectoryA, GetEnvironmentStrings, CompareFileTime, SetFileAttributesA, CopyFileA, WaitNamedPipeA, SetNamedPipeHandleState, GetShortPathNameA, FileTimeToSystemTime, GetWindowsDirectoryA, GetUserDefaultLangID, CreateProcessA, GetTempPathA, DeviceIoControl, FormatMessageA, GetLogicalDrives, SetPriorityClass, GetPriorityClass, QueryDosDeviceA, lstrcmpA
USER32.dll	wsprintfA, IsIconic, GetWindowLongA, GetMenu, AdjustWindowRectEx, SystemParametersInfoA, DestroyWindow, SetWindowLongA, ShowWindow, LoadIconA, LoadCursorA, RegisterClassA, ReleaseCapture, GetWindowPlacement, SetTimer, ClipCursor, PostQuitMessage, SetCursor, SetCapture, DefWindowProcA, MapVirtualKeyA, UpdateWindow, GetKeyState, FindWindowA, SetForegroundWindow, PeekMessageA, DispatchMessageA, TranslateMessage, GetKeyboardLayout, DialogBoxParamA, EndDialog, GetDlgItem, SetFocus, SendMessageA, SetWindowPos, AdjustWindowRect, CreateWindowExA, ShowCursor, GetWindowRect, MessageBoxA, SetWindowTextA, ClientToScreen, SetCursorPos, GetClientRect, SendDlgItemMessageA, GetWindowTextA, GetParent, GetClassNameA, FindWindowExA, EnumWindows, LoadCursorFromFileA, SetSystemCursor, LoadImageA, CopyImage, GetForegroundWindow, DialogBoxIndirectParamA
GDI32.dll	DeleteObject
ADVAPI32.dll	RegCloseKey, RegCreateKeyExA, RegOpenKeyExA, RegQueryValueExA, RegOpenKeyA, RegSetValueExA, OpenThreadToken, OpenProcessToken, GetTokenInformation, AllocateAndInitializeSid, EqualSid, RegEnumKeyExA, ControlService, QueryServiceStatus, OpenSCManagerA, CreateServiceA, OpenServiceA, StartServiceA, DeleteService, CloseServiceHandle, RegQueryValueA, RegFlushKey, RegDeleteValueA, RevertToSelf
ole32.dll	CoCreateInstance, CoInitialize, CoUninitialize
VERSION.dll	GetFileVersionInfoA, GetFileVersionInfoSizeA, VerQueryValueA

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	Great Britain

Target ID:	0
Start time:	11:31:05
Start date:	20/11/2024
Path:	C:\Users\user\Desktop\gta_sa.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\gta_sa.exe"
Imagebase:	0x400000
File size:	14'405'632 bytes
MD5 hash:	E7697A085336F974A4A6102A51223960
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Chronological Activities

Disassembly

⊘No disassembly

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	Driver: Driver Load, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report gta_sa.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

Compliance

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Malware Analysis System Evasion

Anti Debugging

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Possible Origin

Network Behavior

Statistics

CPU Usage

Memory Usage

System Behavior

Analysis Process: gta_sa.exePID: 2504, Parent PID: 2580

General

Chronological Activities

Disassembly

Windows Analysis Report
gta_sa.exe