Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
185s -
max time network
181s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
28/12/2023, 23:19
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
ff729a55815119aee404b13890dd32b1.exe
Resource
win7-20231215-en
windows7-x64
11 signatures
150 seconds
Behavioral task
behavioral2
Sample
ff729a55815119aee404b13890dd32b1.exe
Resource
win10v2004-20231215-en
windows10-2004-x64
11 signatures
150 seconds
General
-
Target
ff729a55815119aee404b13890dd32b1.exe
-
Size
4.7MB
-
MD5
ff729a55815119aee404b13890dd32b1
-
SHA1
e54929cc3b819e4827b235c83a4391c4486b9741
-
SHA256
7f058cfc5bcd03da3014a0b1283c30b330b33b90cd3d18ea2034d89d75c87973
-
SHA512
53e7ce61529a2df327bb083f6c6e33ec8e4136e0d027e0d14c0b07e7d8c658799ffeed0350007d53f57ee0709ac29793a4119a27530dafdf124c650bfb9a78ca
-
SSDEEP
49152:dW2V9THnvlq+kmRHPxqw1BWyhHSvJe7vr+0mgtJkGZ1wG9WIxKr2iQnro09xdGeQ:jlv8g9OhOvq0mgtJk7VO04Qq3UI8L00
Score
8/10
Malware Config
Signatures
-
Drops file in Drivers directory 6 IoCs
description ioc Process File created C:\WINDOWS\SysWOW64\drivers\pk.bin rinst.exe File created C:\WINDOWS\SysWOW64\drivers\Cheat Engine.exe rinst.exe File created C:\WINDOWS\SysWOW64\drivers\Cheat Enginehk.dll rinst.exe File created C:\WINDOWS\SysWOW64\drivers\inst.dat rinst.exe File created C:\WINDOWS\SysWOW64\drivers\rinst.exe rinst.exe File opened for modification C:\WINDOWS\SysWOW64\drivers\pk.bin Cheat Engine.exe -
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-1815711207-1844170477-3539718864-1000\Control Panel\International\Geo\Nation ff729a55815119aee404b13890dd32b1.exe Key value queried \REGISTRY\USER\S-1-5-21-1815711207-1844170477-3539718864-1000\Control Panel\International\Geo\Nation rinst.exe -
Executes dropped EXE 4 IoCs
pid Process 3396 rinst.exe 4196 CheatEngine561.exe 5100 Cheat Engine.exe 1304 CheatEngine561.tmp -
Loads dropped DLL 5 IoCs
pid Process 5100 Cheat Engine.exe 4196 CheatEngine561.exe 1304 CheatEngine561.tmp 1304 CheatEngine561.tmp 2128 ff729a55815119aee404b13890dd32b1.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Cheat Engine = "C:\\WINDOWS\\SysWOW64\\drivers\\Cheat Engine.exe" Cheat Engine.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 3396 rinst.exe 3396 rinst.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 5100 Cheat Engine.exe 5100 Cheat Engine.exe -
Suspicious use of SendNotifyMessage 64 IoCs
pid Process 5100 Cheat Engine.exe 5100 Cheat Engine.exe 5100 Cheat Engine.exe 5100 Cheat Engine.exe 5100 Cheat Engine.exe 5100 Cheat Engine.exe 5100 Cheat Engine.exe 5100 Cheat Engine.exe 5100 Cheat Engine.exe 5100 Cheat Engine.exe 5100 Cheat Engine.exe 5100 Cheat Engine.exe 5100 Cheat Engine.exe 5100 Cheat Engine.exe 5100 Cheat Engine.exe 5100 Cheat Engine.exe 5100 Cheat Engine.exe 5100 Cheat Engine.exe 5100 Cheat Engine.exe 5100 Cheat Engine.exe 5100 Cheat Engine.exe 5100 Cheat Engine.exe 5100 Cheat Engine.exe 5100 Cheat Engine.exe 5100 Cheat Engine.exe 5100 Cheat Engine.exe 5100 Cheat Engine.exe 5100 Cheat Engine.exe 5100 Cheat Engine.exe 5100 Cheat Engine.exe 5100 Cheat Engine.exe 5100 Cheat Engine.exe 5100 Cheat Engine.exe 5100 Cheat Engine.exe 5100 Cheat Engine.exe 5100 Cheat Engine.exe 5100 Cheat Engine.exe 5100 Cheat Engine.exe 5100 Cheat Engine.exe 5100 Cheat Engine.exe 5100 Cheat Engine.exe 5100 Cheat Engine.exe 5100 Cheat Engine.exe 5100 Cheat Engine.exe 5100 Cheat Engine.exe 5100 Cheat Engine.exe 5100 Cheat Engine.exe 5100 Cheat Engine.exe 5100 Cheat Engine.exe 5100 Cheat Engine.exe 5100 Cheat Engine.exe 5100 Cheat Engine.exe 5100 Cheat Engine.exe 5100 Cheat Engine.exe 5100 Cheat Engine.exe 5100 Cheat Engine.exe 5100 Cheat Engine.exe 5100 Cheat Engine.exe 5100 Cheat Engine.exe 5100 Cheat Engine.exe 5100 Cheat Engine.exe 5100 Cheat Engine.exe 5100 Cheat Engine.exe 5100 Cheat Engine.exe -
Suspicious use of SetWindowsHookEx 8 IoCs
pid Process 5100 Cheat Engine.exe 5100 Cheat Engine.exe 5100 Cheat Engine.exe 5100 Cheat Engine.exe 5100 Cheat Engine.exe 5100 Cheat Engine.exe 5100 Cheat Engine.exe 5100 Cheat Engine.exe -
Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 2128 wrote to memory of 3396 2128 ff729a55815119aee404b13890dd32b1.exe 53 PID 2128 wrote to memory of 3396 2128 ff729a55815119aee404b13890dd32b1.exe 53 PID 2128 wrote to memory of 3396 2128 ff729a55815119aee404b13890dd32b1.exe 53 PID 3396 wrote to memory of 4196 3396 rinst.exe 54 PID 3396 wrote to memory of 4196 3396 rinst.exe 54 PID 3396 wrote to memory of 4196 3396 rinst.exe 54 PID 3396 wrote to memory of 5100 3396 rinst.exe 57 PID 3396 wrote to memory of 5100 3396 rinst.exe 57 PID 3396 wrote to memory of 5100 3396 rinst.exe 57 PID 4196 wrote to memory of 1304 4196 CheatEngine561.exe 55 PID 4196 wrote to memory of 1304 4196 CheatEngine561.exe 55 PID 4196 wrote to memory of 1304 4196 CheatEngine561.exe 55
Processes
-
C:\Users\Admin\AppData\Local\Temp\ff729a55815119aee404b13890dd32b1.exe"C:\Users\Admin\AppData\Local\Temp\ff729a55815119aee404b13890dd32b1.exe"1⤵
- Checks computer location settings
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2128 -
C:\Users\Admin\AppData\Local\Temp\RarSFX0\rinst.exe"C:\Users\Admin\AppData\Local\Temp\RarSFX0\rinst.exe"2⤵
- Drops file in Drivers directory
- Checks computer location settings
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3396 -
C:\Users\Admin\AppData\Local\Temp\RarSFX0\CheatEngine561.exe"C:\Users\Admin\AppData\Local\Temp\RarSFX0\CheatEngine561.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:4196 -
C:\Users\Admin\AppData\Local\Temp\is-QOUA5.tmp\CheatEngine561.tmp"C:\Users\Admin\AppData\Local\Temp\is-QOUA5.tmp\CheatEngine561.tmp" /SL5="$D01CE,4409825,54272,C:\Users\Admin\AppData\Local\Temp\RarSFX0\CheatEngine561.exe"4⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1304
-
-
-
C:\WINDOWS\SysWOW64\drivers\Cheat Engine.exe"C:\WINDOWS\system32\drivers\Cheat Engine.exe"3⤵
- Drops file in Drivers directory
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:5100
-
-