Analysis Overview
SHA256
93d8134fa11201cecedac89d6c6af96afa83783aebf347ea3f6aefc925df8ceb
Threat Level: Likely malicious
The file CheatoSpoofer (1).exe was found to be: Likely malicious.
Malicious Activity Summary
Enumerates VirtualBox registry keys
Identifies VirtualBox via ACPI registry values (likely anti-VM)
Looks for VirtualBox Guest Additions in registry
Looks for VMWare Tools registry key
Obfuscated with Agile.Net obfuscator
Checks BIOS information in registry
Loads dropped DLL
Identifies Wine through registry keys
Maps connected drives based on registry
Suspicious use of NtSetInformationThreadHideFromDebugger
Drops file in System32 directory
Unsigned PE
Suspicious behavior: LoadsDriver
Checks processor information in registry
Uses Task Scheduler COM API
Suspicious use of AdjustPrivilegeToken
Enumerates system info in registry
Suspicious behavior: EnumeratesProcesses
MITRE ATT&CK
Enterprise Matrix V6
Analysis: static1
Detonation Overview
Reported
2023-07-07 04:24
Signatures
Unsigned PE
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
Analysis: behavioral1
Detonation Overview
Submitted
2023-07-07 04:24
Reported
2023-07-07 04:27
Platform
win10v2004-20230703-en
Max time kernel
141s
Max time network
146s
Command Line
Signatures
Enumerates VirtualBox registry keys
| Description | Indicator | Process | Target |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxVideo | C:\Users\Admin\AppData\Local\Temp\CheatoSpoofer (1).exe | N/A |
| Key opened | \REGISTRY\USER\S-1-5-21-1722984668-1829624581-3022101259-1000\SYSTEM\ControlSet001\Services\VBoxVideo | C:\Users\Admin\AppData\Local\Temp\CheatoSpoofer (1).exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxGuest | C:\Users\Admin\AppData\Local\Temp\CheatoSpoofer (1).exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxMouse | C:\Users\Admin\AppData\Local\Temp\CheatoSpoofer (1).exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxService | C:\Users\Admin\AppData\Local\Temp\CheatoSpoofer (1).exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxSF | C:\Users\Admin\AppData\Local\Temp\CheatoSpoofer (1).exe | N/A |
| Key opened | \REGISTRY\USER\S-1-5-21-1722984668-1829624581-3022101259-1000\SYSTEM\ControlSet001\Services\VBoxSF | C:\Users\Admin\AppData\Local\Temp\CheatoSpoofer (1).exe | N/A |
| Key opened | \REGISTRY\USER\S-1-5-21-1722984668-1829624581-3022101259-1000\SYSTEM\ControlSet001\Services\VBoxGuest | C:\Users\Admin\AppData\Local\Temp\CheatoSpoofer (1).exe | N/A |
| Key opened | \REGISTRY\USER\S-1-5-21-1722984668-1829624581-3022101259-1000\SYSTEM\ControlSet001\Services\VBoxMouse | C:\Users\Admin\AppData\Local\Temp\CheatoSpoofer (1).exe | N/A |
| Key opened | \REGISTRY\USER\S-1-5-21-1722984668-1829624581-3022101259-1000\SYSTEM\ControlSet001\Services\VBoxService | C:\Users\Admin\AppData\Local\Temp\CheatoSpoofer (1).exe | N/A |
Identifies VirtualBox via ACPI registry values (likely anti-VM)
| Description | Indicator | Process | Target |
| Key opened | \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ | C:\Users\Admin\AppData\Local\Temp\CheatoSpoofer (1).exe | N/A |
| Key opened | \REGISTRY\USER\S-1-5-21-1722984668-1829624581-3022101259-1000\HARDWARE\ACPI\DSDT\VBOX__ | C:\Users\Admin\AppData\Local\Temp\CheatoSpoofer (1).exe | N/A |
| Key opened | \REGISTRY\MACHINE\HARDWARE\ACPI\FADT\VBOX__ | C:\Users\Admin\AppData\Local\Temp\CheatoSpoofer (1).exe | N/A |
| Key opened | \REGISTRY\USER\S-1-5-21-1722984668-1829624581-3022101259-1000\HARDWARE\ACPI\FADT\VBOX__ | C:\Users\Admin\AppData\Local\Temp\CheatoSpoofer (1).exe | N/A |
| Key opened | \REGISTRY\MACHINE\HARDWARE\ACPI\RSDT\VBOX__ | C:\Users\Admin\AppData\Local\Temp\CheatoSpoofer (1).exe | N/A |
| Key opened | \REGISTRY\USER\S-1-5-21-1722984668-1829624581-3022101259-1000\HARDWARE\ACPI\RSDT\VBOX__ | C:\Users\Admin\AppData\Local\Temp\CheatoSpoofer (1).exe | N/A |
Looks for VirtualBox Guest Additions in registry
| Description | Indicator | Process | Target |
| Key opened | \REGISTRY\MACHINE\SOFTWARE\Oracle\VirtualBox Guest Additions | C:\Users\Admin\AppData\Local\Temp\CheatoSpoofer (1).exe | N/A |
| Key opened | \REGISTRY\USER\S-1-5-21-1722984668-1829624581-3022101259-1000\SOFTWARE\Oracle\VirtualBox Guest Additions | C:\Users\Admin\AppData\Local\Temp\CheatoSpoofer (1).exe | N/A |
Looks for VMWare Tools registry key
| Description | Indicator | Process | Target |
| Key opened | \REGISTRY\MACHINE\SOFTWARE\VMware, Inc.\VMware Tools | C:\Users\Admin\AppData\Local\Temp\CheatoSpoofer (1).exe | N/A |
| Key opened | \REGISTRY\USER\S-1-5-21-1722984668-1829624581-3022101259-1000\SOFTWARE\VMware, Inc.\VMware Tools | C:\Users\Admin\AppData\Local\Temp\CheatoSpoofer (1).exe | N/A |
Checks BIOS information in registry
| Description | Indicator | Process | Target |
| Key value queried | \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion | C:\Users\Admin\AppData\Local\Temp\CheatoSpoofer (1).exe | N/A |
| Key value queried | \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion | C:\Users\Admin\AppData\Local\Temp\CheatoSpoofer (1).exe | N/A |
Identifies Wine through registry keys
| Description | Indicator | Process | Target |
| Key opened | \REGISTRY\MACHINE\SOFTWARE\Wine | C:\Users\Admin\AppData\Local\Temp\CheatoSpoofer (1).exe | N/A |
| Key opened | \REGISTRY\USER\S-1-5-21-1722984668-1829624581-3022101259-1000\SOFTWARE\Wine | C:\Users\Admin\AppData\Local\Temp\CheatoSpoofer (1).exe | N/A |
Loads dropped DLL
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\CheatoSpoofer (1).exe | N/A |
Obfuscated with Agile.Net obfuscator
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
Maps connected drives based on registry
| Description | Indicator | Process | Target |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum | C:\Users\Admin\AppData\Local\Temp\CheatoSpoofer (1).exe | N/A |
| Key value queried | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 | C:\Users\Admin\AppData\Local\Temp\CheatoSpoofer (1).exe | N/A |
Drops file in System32 directory
| Description | Indicator | Process | Target |
| File created | C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\InstallService\{7CCADC42-76D6-46DA-BF2A-1A7632A74CA0}.catalogItem | C:\Windows\System32\svchost.exe | N/A |
Suspicious use of NtSetInformationThreadHideFromDebugger
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\CheatoSpoofer (1).exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\CheatoSpoofer (1).exe | N/A |
Checks processor information in registry
| Description | Indicator | Process | Target |
| Key opened | \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 | C:\Windows\System32\svchost.exe | N/A |
| Key value queried | \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz | C:\Windows\System32\svchost.exe | N/A |
| Key value queried | \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString | C:\Windows\System32\svchost.exe | N/A |
Enumerates system info in registry
| Description | Indicator | Process | Target |
| Key opened | \REGISTRY\MACHINE\Hardware\Description\System\BIOS | C:\Windows\System32\svchost.exe | N/A |
| Key value queried | \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU | C:\Windows\System32\svchost.exe | N/A |
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: LoadsDriver
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
Suspicious use of AdjustPrivilegeToken
Uses Task Scheduler COM API
Processes
C:\Users\Admin\AppData\Local\Temp\CheatoSpoofer (1).exe
"C:\Users\Admin\AppData\Local\Temp\CheatoSpoofer (1).exe"
C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p
Network
| Country | Destination | Domain | Proto |
| US | 8.8.8.8:53 | 8.8.8.8.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 8.3.197.209.in-addr.arpa | udp |
| US | 8.8.8.8:53 | assets.msn.com | udp |
| GB | 95.101.143.242:443 | assets.msn.com | tcp |
| US | 8.8.8.8:53 | 45.147.19.2.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 242.143.101.95.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 0.159.190.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 241.154.82.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 177.17.30.184.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 95.221.229.192.in-addr.arpa | udp |
| US | 8.8.8.8:53 | sentry.chea.to | udp |
| US | 104.26.9.75:443 | sentry.chea.to | tcp |
| US | 8.8.8.8:53 | 75.9.26.104.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 106.39.251.142.in-addr.arpa | udp |
| US | 8.8.8.8:53 | dev.virtualearth.net | udp |
| IE | 52.156.193.145:443 | dev.virtualearth.net | tcp |
| US | 8.8.8.8:53 | maps.googleapis.com | udp |
| NL | 142.250.179.170:443 | maps.googleapis.com | tcp |
| US | 8.8.8.8:53 | 145.193.156.52.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 170.179.250.142.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 157.123.68.40.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 171.39.242.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 240.81.21.72.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 45.8.109.52.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 4.173.189.20.in-addr.arpa | udp |
Files
memory/4512-133-0x00007FF475C70000-0x00007FF476041000-memory.dmp
memory/4512-134-0x0000000000D40000-0x00000000057D8000-memory.dmp
memory/4512-135-0x0000000000D40000-0x00000000057D8000-memory.dmp
memory/4512-136-0x00007FFC1D760000-0x00007FFC1D770000-memory.dmp
memory/4512-137-0x0000000000D40000-0x00000000057D8000-memory.dmp
memory/4512-139-0x0000000000D40000-0x00000000057D8000-memory.dmp
memory/4512-138-0x0000000000D40000-0x00000000057D8000-memory.dmp
memory/4512-140-0x0000000000D40000-0x00000000057D8000-memory.dmp
memory/4512-141-0x0000000000D40000-0x00000000057D8000-memory.dmp
memory/4512-143-0x00007FF475C70000-0x00007FF476041000-memory.dmp
memory/4512-142-0x0000000000D40000-0x00000000057D8000-memory.dmp
memory/4512-144-0x0000000000D40000-0x00000000057D8000-memory.dmp
memory/4512-145-0x0000000000D40000-0x00000000057D8000-memory.dmp
memory/4512-146-0x000001310DF50000-0x000001310DF6A000-memory.dmp
memory/4512-147-0x000001310DF50000-0x000001310DF6A000-memory.dmp
memory/4512-148-0x000001310DF50000-0x000001310DF6A000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\Costura\5B2255609A942D3203015BC01089042A\64\user64.dll
| MD5 | c204468635ab30602dea443c445e1821 |
| SHA1 | c1fa917a4604f956ef15bb53655d368c6b19d042 |
| SHA256 | 7bdc755921404ec6bca532790460523873c3169091020f117ad3ee79d395b6f7 |
| SHA512 | d1558e916f31f19ab5a86f3b07aab951cb0fa2df14d5ec4f8f704b146a6e2b117c108bc68afce17859a2c81048cabb1b0510b0c43b45839dc4d82d3aea61dc5b |
memory/4512-154-0x000001310F5A0000-0x000001310F5A8000-memory.dmp
memory/4512-160-0x0000000000D40000-0x00000000057D8000-memory.dmp
memory/4512-163-0x000001310F5B0000-0x000001310F5C0000-memory.dmp
memory/4512-164-0x000001310F5B0000-0x000001310F5C0000-memory.dmp
memory/4512-165-0x0000013128DF0000-0x0000013128DF8000-memory.dmp
memory/4512-166-0x0000013128F40000-0x0000013128F5A000-memory.dmp
memory/4512-167-0x0000013128F90000-0x0000013128FB2000-memory.dmp
memory/4512-168-0x0000000000D40000-0x00000000057D8000-memory.dmp
memory/4512-169-0x000001310F5B0000-0x000001310F5C0000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_rydqgtxy.yla.ps1
| MD5 | d17fe0a3f47be24a6453e9ef58c94641 |
| SHA1 | 6ab83620379fc69f80c0242105ddffd7d98d5d9d |
| SHA256 | 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7 |
| SHA512 | 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82 |
memory/4512-179-0x0000000000D40000-0x00000000057D8000-memory.dmp
memory/4512-180-0x000001310F5B0000-0x000001310F5C0000-memory.dmp
memory/4512-181-0x000001310DF50000-0x000001310DF6A000-memory.dmp
memory/4512-182-0x000001310DF50000-0x000001310DF6A000-memory.dmp
memory/4512-183-0x000001310DF50000-0x000001310DF6A000-memory.dmp
memory/4512-184-0x000001310F5B0000-0x000001310F5C0000-memory.dmp
memory/4512-185-0x000001310F5B0000-0x000001310F5C0000-memory.dmp
memory/4512-186-0x0000000000D40000-0x00000000057D8000-memory.dmp
memory/4512-187-0x000001310F5B0000-0x000001310F5C0000-memory.dmp
memory/4512-188-0x000001310F5B0000-0x000001310F5C0000-memory.dmp
memory/4512-189-0x000001312CBB0000-0x000001312CCB0000-memory.dmp
memory/4512-190-0x000001310F5B0000-0x000001310F5C0000-memory.dmp
memory/4512-191-0x000001310F5B0000-0x000001310F5C0000-memory.dmp
memory/4512-192-0x000001312D1F0000-0x000001312D1F1000-memory.dmp
memory/4512-193-0x000001312CBB0000-0x000001312CCB0000-memory.dmp
memory/4512-194-0x0000000000D40000-0x00000000057D8000-memory.dmp