0e24b8e9026309ce107cc22c3e37d189b3491a500c0282e029da324733772051

Analysis

max time kernel
147s
max time network
119s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
06-01-2024 08:24

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

CheatMaker.exe
Size

977KB
MD5

2ecb96153091d32afcb7d8db660d9997
SHA1

3717e06780aa1592ede71d4d8d898b75b22662ea
SHA256

00dd0b3169a1b61dcef889a41a37fceb0aa3e18db5a1ae538424f4a60a5b258f
SHA512

1bff0830390759ad6d6bdc1d50188b13ed7c75a9f28f9e2e0cb4a808856013b805081155b5487282b1974afbab680f6075d32585a9b0aedc18806d3b6f49a01b
SSDEEP

24576:Ss2ZDpE4pEEuuyLIr82LXIP5e1c6ufg5pzvMS0nlqMCFQ:t0Dj5kU10PU1c6ufipX00FQ

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process
2444	2436	WerFault.exe

Modifies registry class 25 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CheatMaker.cmf\shell\open\ddeexec\ = "[open(\"%1\")]"	CheatMaker.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CheatMaker.cmf\shell\printto\ddeexec\ = "[printto(\"%1\",\"%2\",\"%3\",\"%4\")]"	CheatMaker.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CheatMaker.cmf\shell\open\command	CheatMaker.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CheatMaker.cmf\shell\print\ddeexec\ = "[print(\"%1\")]"	CheatMaker.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CheatMaker.cmf\shell\printto\ddeexec	CheatMaker.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CheatMaker.cmf\shell\printto	CheatMaker.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CheatMaker.cmf\shell\open	CheatMaker.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CheatMaker.cmf\shell\print	CheatMaker.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CheatMaker.cmf\ = "CheatMaker Modifier File"	CheatMaker.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CheatMaker.cmf\DefaultIcon	CheatMaker.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CheatMaker.cmf\shell	CheatMaker.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CheatMaker.cmf\shell\print\ddeexec	CheatMaker.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CheatMaker.cmf\shell\print\command\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\CHEATM~1.EXE /dde"	CheatMaker.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.cmf\ShellNew	CheatMaker.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.cmf\ShellNew\NullFile	CheatMaker.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CheatMaker.cmf\shell\print\command	CheatMaker.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CheatMaker.cmf\shell\printto\command	CheatMaker.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CheatMaker.cmf\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\CHEATM~1.EXE,1"	CheatMaker.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CheatMaker.cmf\shell\open\ddeexec	CheatMaker.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.cmf\ShellNew	CheatMaker.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.cmf	CheatMaker.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.cmf\ = "CheatMaker.cmf"	CheatMaker.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CheatMaker.cmf	CheatMaker.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CheatMaker.cmf\shell\open\command\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\CHEATM~1.EXE /dde"	CheatMaker.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CheatMaker.cmf\shell\printto\command\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\CHEATM~1.EXE /dde"	CheatMaker.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1848	CheatMaker.exe
1848	CheatMaker.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1848	CheatMaker.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1848	CheatMaker.exe
1848	CheatMaker.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 1848 wrote to memory of 2436	1848	CheatMaker.exe	31
PID 1848 wrote to memory of 2436	1848	CheatMaker.exe	31
PID 1848 wrote to memory of 2436	1848	CheatMaker.exe	31
PID 1848 wrote to memory of 2436	1848	CheatMaker.exe	31
PID 1848 wrote to memory of 2436	1848	CheatMaker.exe	31
PID 1848 wrote to memory of 2436	1848	CheatMaker.exe	31
PID 1848 wrote to memory of 2436	1848	CheatMaker.exe	31
PID 2436 wrote to memory of 2444	2436	Update.exe	30
PID 2436 wrote to memory of 2444	2436	Update.exe	30
PID 2436 wrote to memory of 2444	2436	Update.exe	30
PID 2436 wrote to memory of 2444	2436	Update.exe	30

C:\Users\Admin\AppData\Local\Temp\CheatMaker.exe
"C:\Users\Admin\AppData\Local\Temp\CheatMaker.exe"
1⤵
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1848
- C:\Users\Admin\AppData\Local\Temp\Update.exe
  C:\Users\Admin\AppData\Local\Temp\Update.exe
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2436

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2436 -s 124
1⤵
- Program crash
PID:2444

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1848-0-0x0000000000400000-0x00000000006EC000-memory.dmp

Filesize
2.9MB

Download
memory/1848-5-0x0000000000350000-0x0000000000351000-memory.dmp

Filesize
4KB

Download
memory/1848-58-0x0000000003680000-0x0000000003681000-memory.dmp

Filesize
4KB

Download
memory/1848-63-0x00000000036B0000-0x00000000036B1000-memory.dmp

Filesize
4KB

Download
memory/1848-62-0x00000000036C0000-0x00000000036C1000-memory.dmp

Filesize
4KB

Download
memory/1848-61-0x0000000003690000-0x0000000003691000-memory.dmp

Filesize
4KB

Download
memory/1848-60-0x00000000036A0000-0x00000000036A1000-memory.dmp

Filesize
4KB

Download
memory/1848-59-0x0000000003670000-0x0000000003671000-memory.dmp

Filesize
4KB

Download
memory/1848-57-0x0000000003650000-0x0000000003651000-memory.dmp

Filesize
4KB

Download
memory/1848-56-0x0000000003520000-0x0000000003521000-memory.dmp

Filesize
4KB

Download
memory/1848-55-0x0000000003530000-0x0000000003531000-memory.dmp

Filesize
4KB

Download
memory/1848-54-0x0000000003500000-0x0000000003501000-memory.dmp

Filesize
4KB

Download
memory/1848-53-0x0000000003510000-0x0000000003511000-memory.dmp

Filesize
4KB

Download
memory/1848-52-0x0000000003460000-0x0000000003461000-memory.dmp

Filesize
4KB

Download
memory/1848-51-0x0000000003470000-0x0000000003471000-memory.dmp

Filesize
4KB

Download
memory/1848-50-0x0000000003440000-0x0000000003441000-memory.dmp

Filesize
4KB

Download
memory/1848-49-0x0000000003450000-0x0000000003451000-memory.dmp

Filesize
4KB

Download
memory/1848-48-0x0000000003420000-0x0000000003421000-memory.dmp

Filesize
4KB

Download
memory/1848-47-0x0000000003430000-0x0000000003431000-memory.dmp

Filesize
4KB

Download
memory/1848-46-0x0000000003400000-0x0000000003401000-memory.dmp

Filesize
4KB

Download
memory/1848-45-0x0000000003410000-0x0000000003411000-memory.dmp

Filesize
4KB

Download
memory/1848-44-0x00000000033E0000-0x00000000033E1000-memory.dmp

Filesize
4KB

Download
memory/1848-43-0x00000000033F0000-0x00000000033F1000-memory.dmp

Filesize
4KB

Download
memory/1848-42-0x00000000033C0000-0x00000000033C1000-memory.dmp

Filesize
4KB

Download
memory/1848-41-0x00000000033D0000-0x00000000033D1000-memory.dmp

Filesize
4KB

Download
memory/1848-40-0x00000000033A0000-0x00000000033A1000-memory.dmp

Filesize
4KB

Download
memory/1848-39-0x00000000033B0000-0x00000000033B1000-memory.dmp

Filesize
4KB

Download
memory/1848-38-0x0000000003370000-0x0000000003371000-memory.dmp

Filesize
4KB

Download
memory/1848-37-0x0000000003380000-0x0000000003381000-memory.dmp

Filesize
4KB

Download
memory/1848-36-0x0000000003350000-0x0000000003351000-memory.dmp

Filesize
4KB

Download
memory/1848-35-0x0000000003360000-0x0000000003361000-memory.dmp

Filesize
4KB

Download
memory/1848-34-0x0000000003330000-0x0000000003331000-memory.dmp

Filesize
4KB

Download
memory/1848-33-0x0000000003340000-0x0000000003341000-memory.dmp

Filesize
4KB

Download
memory/1848-32-0x0000000002700000-0x0000000002701000-memory.dmp

Filesize
4KB

Download
memory/1848-31-0x00000000021A0000-0x00000000021A1000-memory.dmp

Filesize
4KB

Download
memory/1848-30-0x0000000002340000-0x0000000002341000-memory.dmp

Filesize
4KB

Download
memory/1848-29-0x0000000000AF0000-0x0000000000AF1000-memory.dmp

Filesize
4KB

Download
memory/1848-28-0x00000000032F0000-0x00000000032F1000-memory.dmp

Filesize
4KB

Download
memory/1848-27-0x0000000000250000-0x0000000000251000-memory.dmp

Filesize
4KB

Download
memory/1848-26-0x0000000000230000-0x0000000000231000-memory.dmp

Filesize
4KB

Download
memory/1848-25-0x0000000000370000-0x0000000000371000-memory.dmp

Filesize
4KB

Download
memory/1848-24-0x0000000003320000-0x0000000003321000-memory.dmp

Filesize
4KB

Download
memory/1848-23-0x00000000008A0000-0x00000000008A1000-memory.dmp

Filesize
4KB

Download
memory/1848-22-0x0000000002150000-0x0000000002151000-memory.dmp

Filesize
4KB

Download
memory/1848-21-0x0000000002170000-0x0000000002171000-memory.dmp

Filesize
4KB

Download
memory/1848-20-0x0000000002140000-0x0000000002141000-memory.dmp

Filesize
4KB

Download
memory/1848-19-0x0000000000B00000-0x0000000000B01000-memory.dmp

Filesize
4KB

Download
memory/1848-18-0x0000000000B10000-0x0000000000B11000-memory.dmp

Filesize
4KB

Download
memory/1848-17-0x0000000000B20000-0x0000000000B21000-memory.dmp

Filesize
4KB

Download
memory/1848-16-0x0000000000AE0000-0x0000000000AE1000-memory.dmp

Filesize
4KB

Download
memory/1848-15-0x0000000000880000-0x0000000000881000-memory.dmp

Filesize
4KB

Download
memory/1848-14-0x00000000008B0000-0x00000000008B1000-memory.dmp

Filesize
4KB

Download
memory/1848-13-0x0000000000380000-0x0000000000381000-memory.dmp

Filesize
4KB

Download
memory/1848-12-0x0000000000390000-0x0000000000391000-memory.dmp

Filesize
4KB

Download
memory/1848-11-0x00000000003E0000-0x00000000003E1000-memory.dmp

Filesize
4KB

Download
memory/1848-10-0x00000000032D0000-0x00000000032D5000-memory.dmp

Filesize
20KB

Download
memory/1848-9-0x00000000002B0000-0x00000000002B1000-memory.dmp

Filesize
4KB

Download
memory/1848-8-0x00000000032E0000-0x00000000032E1000-memory.dmp

Filesize
4KB

Download
memory/1848-7-0x0000000000360000-0x0000000000361000-memory.dmp

Filesize
4KB

Download
memory/1848-6-0x0000000000340000-0x0000000000341000-memory.dmp

Filesize
4KB

Download
memory/1848-4-0x00000000002A0000-0x00000000002A1000-memory.dmp

Filesize
4KB

Download
memory/1848-3-0x0000000000260000-0x0000000000261000-memory.dmp

Filesize
4KB

Download
memory/1848-2-0x0000000000270000-0x0000000000271000-memory.dmp

Filesize
4KB

Download
memory/1848-1-0x0000000000280000-0x0000000000281000-memory.dmp

Filesize
4KB

Download
memory/1848-115-0x0000000000400000-0x00000000006EC000-memory.dmp

Filesize
2.9MB

Download
memory/1848-125-0x0000000000400000-0x00000000006EC000-memory.dmp

Filesize
2.9MB

Download
memory/1848-135-0x0000000000400000-0x00000000006EC000-memory.dmp

Filesize
2.9MB

Download
memory/1848-147-0x0000000000400000-0x00000000006EC000-memory.dmp

Filesize
2.9MB

Download