Analysis
-
max time kernel
43s -
max time network
43s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
01-03-2024 19:36
Behavioral task
behavioral1
Sample
Grape Cheat Crack.exe
Resource
win7-20240221-en
windows7-x64
13 signatures
150 seconds
General
-
Target
Grape Cheat Crack.exe
-
Size
494KB
-
MD5
7bafac8b38d3dd8452af266a2f4a4cce
-
SHA1
a71b7d1ae925605a05c4e9fd50a49e601626c84c
-
SHA256
e70684c0929b0713733778032e5b310bae9967f544febfe62009c820f71e950d
-
SHA512
08f2f1f334757858333b72488fffeb283809d202bf09b40fb5a6a32f4abb57b42484793e8c79a4e53c50cac576cbbea2fadc8f06edeeca84774c6cb90527904a
-
SSDEEP
12288:9oZOL+EP8sqcTR/k4XLG/BcoNPpUL8jNDxChcOtC+R:+I83cTR/k4XLG/BcoNPeLYND+
Malware Config
Signatures
-
Detect Umbral payload 1 IoCs
resource yara_rule behavioral2/memory/2924-0-0x000001F06DB70000-0x000001F06DBF2000-memory.dmp family_umbral -
Drops file in Drivers directory 1 IoCs
description ioc Process File opened for modification C:\Windows\System32\drivers\etc\hosts Grape Cheat Crack.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
flow ioc 39 discord.com 40 discord.com -
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 32 ip-api.com -
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000 taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName taskmgr.exe -
Detects videocard installed 1 TTPs 1 IoCs
Uses WMIC.exe to determine videocard installed.
pid Process 2044 wmic.exe -
Runs ping.exe 1 TTPs 1 IoCs
pid Process 4436 PING.EXE -
Suspicious behavior: EnumeratesProcesses 53 IoCs
pid Process 1864 powershell.exe 1864 powershell.exe 4508 powershell.exe 4508 powershell.exe 2092 powershell.exe 2092 powershell.exe 468 powershell.exe 468 powershell.exe 4040 taskmgr.exe 4040 taskmgr.exe 4040 taskmgr.exe 4040 taskmgr.exe 4040 taskmgr.exe 3512 powershell.exe 3512 powershell.exe 3512 powershell.exe 4040 taskmgr.exe 4040 taskmgr.exe 4040 taskmgr.exe 4040 taskmgr.exe 4040 taskmgr.exe 4040 taskmgr.exe 4040 taskmgr.exe 4040 taskmgr.exe 4040 taskmgr.exe 4040 taskmgr.exe 4040 taskmgr.exe 4040 taskmgr.exe 4040 taskmgr.exe 4040 taskmgr.exe 4040 taskmgr.exe 4040 taskmgr.exe 4040 taskmgr.exe 4040 taskmgr.exe 4040 taskmgr.exe 4040 taskmgr.exe 4040 taskmgr.exe 4040 taskmgr.exe 4040 taskmgr.exe 4040 taskmgr.exe 4040 taskmgr.exe 4040 taskmgr.exe 4040 taskmgr.exe 4040 taskmgr.exe 4040 taskmgr.exe 4040 taskmgr.exe 4040 taskmgr.exe 4040 taskmgr.exe 4040 taskmgr.exe 4040 taskmgr.exe 4040 taskmgr.exe 4040 taskmgr.exe 4040 taskmgr.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 2924 Grape Cheat Crack.exe Token: SeDebugPrivilege 1864 powershell.exe Token: SeDebugPrivilege 4508 powershell.exe Token: SeDebugPrivilege 2092 powershell.exe Token: SeDebugPrivilege 468 powershell.exe Token: SeDebugPrivilege 4040 taskmgr.exe Token: SeSystemProfilePrivilege 4040 taskmgr.exe Token: SeCreateGlobalPrivilege 4040 taskmgr.exe Token: SeIncreaseQuotaPrivilege 1660 wmic.exe Token: SeSecurityPrivilege 1660 wmic.exe Token: SeTakeOwnershipPrivilege 1660 wmic.exe Token: SeLoadDriverPrivilege 1660 wmic.exe Token: SeSystemProfilePrivilege 1660 wmic.exe Token: SeSystemtimePrivilege 1660 wmic.exe Token: SeProfSingleProcessPrivilege 1660 wmic.exe Token: SeIncBasePriorityPrivilege 1660 wmic.exe Token: SeCreatePagefilePrivilege 1660 wmic.exe Token: SeBackupPrivilege 1660 wmic.exe Token: SeRestorePrivilege 1660 wmic.exe Token: SeShutdownPrivilege 1660 wmic.exe Token: SeDebugPrivilege 1660 wmic.exe Token: SeSystemEnvironmentPrivilege 1660 wmic.exe Token: SeRemoteShutdownPrivilege 1660 wmic.exe Token: SeUndockPrivilege 1660 wmic.exe Token: SeManageVolumePrivilege 1660 wmic.exe Token: 33 1660 wmic.exe Token: 34 1660 wmic.exe Token: 35 1660 wmic.exe Token: 36 1660 wmic.exe Token: SeIncreaseQuotaPrivilege 1660 wmic.exe Token: SeSecurityPrivilege 1660 wmic.exe Token: SeTakeOwnershipPrivilege 1660 wmic.exe Token: SeLoadDriverPrivilege 1660 wmic.exe Token: SeSystemProfilePrivilege 1660 wmic.exe Token: SeSystemtimePrivilege 1660 wmic.exe Token: SeProfSingleProcessPrivilege 1660 wmic.exe Token: SeIncBasePriorityPrivilege 1660 wmic.exe Token: SeCreatePagefilePrivilege 1660 wmic.exe Token: SeBackupPrivilege 1660 wmic.exe Token: SeRestorePrivilege 1660 wmic.exe Token: SeShutdownPrivilege 1660 wmic.exe Token: SeDebugPrivilege 1660 wmic.exe Token: SeSystemEnvironmentPrivilege 1660 wmic.exe Token: SeRemoteShutdownPrivilege 1660 wmic.exe Token: SeUndockPrivilege 1660 wmic.exe Token: SeManageVolumePrivilege 1660 wmic.exe Token: 33 1660 wmic.exe Token: 34 1660 wmic.exe Token: 35 1660 wmic.exe Token: 36 1660 wmic.exe Token: SeIncreaseQuotaPrivilege 4416 wmic.exe Token: SeSecurityPrivilege 4416 wmic.exe Token: SeTakeOwnershipPrivilege 4416 wmic.exe Token: SeLoadDriverPrivilege 4416 wmic.exe Token: SeSystemProfilePrivilege 4416 wmic.exe Token: SeSystemtimePrivilege 4416 wmic.exe Token: SeProfSingleProcessPrivilege 4416 wmic.exe Token: SeIncBasePriorityPrivilege 4416 wmic.exe Token: SeCreatePagefilePrivilege 4416 wmic.exe Token: SeBackupPrivilege 4416 wmic.exe Token: SeRestorePrivilege 4416 wmic.exe Token: SeShutdownPrivilege 4416 wmic.exe Token: SeDebugPrivilege 4416 wmic.exe Token: SeSystemEnvironmentPrivilege 4416 wmic.exe -
Suspicious use of FindShellTrayWindow 53 IoCs
pid Process 4040 taskmgr.exe 4040 taskmgr.exe 4040 taskmgr.exe 4040 taskmgr.exe 4040 taskmgr.exe 4040 taskmgr.exe 4040 taskmgr.exe 4040 taskmgr.exe 4040 taskmgr.exe 4040 taskmgr.exe 4040 taskmgr.exe 4040 taskmgr.exe 4040 taskmgr.exe 4040 taskmgr.exe 4040 taskmgr.exe 4040 taskmgr.exe 4040 taskmgr.exe 4040 taskmgr.exe 4040 taskmgr.exe 4040 taskmgr.exe 4040 taskmgr.exe 4040 taskmgr.exe 4040 taskmgr.exe 4040 taskmgr.exe 4040 taskmgr.exe 4040 taskmgr.exe 4040 taskmgr.exe 4040 taskmgr.exe 4040 taskmgr.exe 4040 taskmgr.exe 4040 taskmgr.exe 4040 taskmgr.exe 4040 taskmgr.exe 4040 taskmgr.exe 4040 taskmgr.exe 4040 taskmgr.exe 4040 taskmgr.exe 4040 taskmgr.exe 4040 taskmgr.exe 4040 taskmgr.exe 4040 taskmgr.exe 4040 taskmgr.exe 4040 taskmgr.exe 4040 taskmgr.exe 4040 taskmgr.exe 4040 taskmgr.exe 4040 taskmgr.exe 4040 taskmgr.exe 4040 taskmgr.exe 4040 taskmgr.exe 4040 taskmgr.exe 4040 taskmgr.exe 4040 taskmgr.exe -
Suspicious use of SendNotifyMessage 53 IoCs
pid Process 4040 taskmgr.exe 4040 taskmgr.exe 4040 taskmgr.exe 4040 taskmgr.exe 4040 taskmgr.exe 4040 taskmgr.exe 4040 taskmgr.exe 4040 taskmgr.exe 4040 taskmgr.exe 4040 taskmgr.exe 4040 taskmgr.exe 4040 taskmgr.exe 4040 taskmgr.exe 4040 taskmgr.exe 4040 taskmgr.exe 4040 taskmgr.exe 4040 taskmgr.exe 4040 taskmgr.exe 4040 taskmgr.exe 4040 taskmgr.exe 4040 taskmgr.exe 4040 taskmgr.exe 4040 taskmgr.exe 4040 taskmgr.exe 4040 taskmgr.exe 4040 taskmgr.exe 4040 taskmgr.exe 4040 taskmgr.exe 4040 taskmgr.exe 4040 taskmgr.exe 4040 taskmgr.exe 4040 taskmgr.exe 4040 taskmgr.exe 4040 taskmgr.exe 4040 taskmgr.exe 4040 taskmgr.exe 4040 taskmgr.exe 4040 taskmgr.exe 4040 taskmgr.exe 4040 taskmgr.exe 4040 taskmgr.exe 4040 taskmgr.exe 4040 taskmgr.exe 4040 taskmgr.exe 4040 taskmgr.exe 4040 taskmgr.exe 4040 taskmgr.exe 4040 taskmgr.exe 4040 taskmgr.exe 4040 taskmgr.exe 4040 taskmgr.exe 4040 taskmgr.exe 4040 taskmgr.exe -
Suspicious use of WriteProcessMemory 24 IoCs
description pid Process procid_target PID 2924 wrote to memory of 224 2924 Grape Cheat Crack.exe 91 PID 2924 wrote to memory of 224 2924 Grape Cheat Crack.exe 91 PID 2924 wrote to memory of 1864 2924 Grape Cheat Crack.exe 94 PID 2924 wrote to memory of 1864 2924 Grape Cheat Crack.exe 94 PID 2924 wrote to memory of 4508 2924 Grape Cheat Crack.exe 98 PID 2924 wrote to memory of 4508 2924 Grape Cheat Crack.exe 98 PID 2924 wrote to memory of 2092 2924 Grape Cheat Crack.exe 100 PID 2924 wrote to memory of 2092 2924 Grape Cheat Crack.exe 100 PID 2924 wrote to memory of 468 2924 Grape Cheat Crack.exe 102 PID 2924 wrote to memory of 468 2924 Grape Cheat Crack.exe 102 PID 2924 wrote to memory of 1660 2924 Grape Cheat Crack.exe 106 PID 2924 wrote to memory of 1660 2924 Grape Cheat Crack.exe 106 PID 2924 wrote to memory of 4416 2924 Grape Cheat Crack.exe 110 PID 2924 wrote to memory of 4416 2924 Grape Cheat Crack.exe 110 PID 2924 wrote to memory of 3944 2924 Grape Cheat Crack.exe 112 PID 2924 wrote to memory of 3944 2924 Grape Cheat Crack.exe 112 PID 2924 wrote to memory of 3512 2924 Grape Cheat Crack.exe 114 PID 2924 wrote to memory of 3512 2924 Grape Cheat Crack.exe 114 PID 2924 wrote to memory of 2044 2924 Grape Cheat Crack.exe 116 PID 2924 wrote to memory of 2044 2924 Grape Cheat Crack.exe 116 PID 2924 wrote to memory of 3368 2924 Grape Cheat Crack.exe 118 PID 2924 wrote to memory of 3368 2924 Grape Cheat Crack.exe 118 PID 3368 wrote to memory of 4436 3368 cmd.exe 120 PID 3368 wrote to memory of 4436 3368 cmd.exe 120 -
Views/modifies file attributes 1 TTPs 1 IoCs
pid Process 224 attrib.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Grape Cheat Crack.exe"C:\Users\Admin\AppData\Local\Temp\Grape Cheat Crack.exe"1⤵
- Drops file in Drivers directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2924 -
C:\Windows\SYSTEM32\attrib.exe"attrib.exe" +h +s "C:\Users\Admin\AppData\Local\Temp\Grape Cheat Crack.exe"2⤵
- Views/modifies file attributes
PID:224
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Grape Cheat Crack.exe'2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1864
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 22⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4508
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2092
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Get-ItemPropertyValue -Path HKLN:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:468
-
-
C:\Windows\System32\Wbem\wmic.exe"wmic.exe" os get Caption2⤵
- Suspicious use of AdjustPrivilegeToken
PID:1660
-
-
C:\Windows\System32\Wbem\wmic.exe"wmic.exe" computersystem get totalphysicalmemory2⤵
- Suspicious use of AdjustPrivilegeToken
PID:4416
-
-
C:\Windows\System32\Wbem\wmic.exe"wmic.exe" csproduct get uuid2⤵PID:3944
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER2⤵
- Suspicious behavior: EnumeratesProcesses
PID:3512
-
-
C:\Windows\System32\Wbem\wmic.exe"wmic" path win32_VideoController get name2⤵
- Detects videocard installed
PID:2044
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c ping localhost && del /F /A h "C:\Users\Admin\AppData\Local\Temp\Grape Cheat Crack.exe" && pause2⤵
- Suspicious use of WriteProcessMemory
PID:3368 -
C:\Windows\system32\PING.EXEping localhost3⤵
- Runs ping.exe
PID:4436
-
-
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:4040
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2KB
MD5440cb38dbee06645cc8b74d51f6e5f71
SHA1d7e61da91dc4502e9ae83281b88c1e48584edb7c
SHA2568ef7a682dfd99ff5b7e9de0e1be43f0016d68695a43c33c028af2635cc15ecfe
SHA5123aab19578535e6ba0f6beb5690c87d970292100704209d2dcebddcdd46c6bead27588ef5d98729bfd50606a54cc1edf608b3d15bef42c13b9982aaaf15de7fd6
-
Filesize
1KB
MD592382908106bf04aac6575ae0e55073f
SHA1b164dd606b60ada42fe843963f95e14e92d5d86a
SHA2561332dc373efa610424b48ae9955247275f4f94cfeecec93a5121784ed8d6b3db
SHA512d6ee3e3776f683b2a4eaf4fd92e2cd2b9412d85fb57556130d8cabf52e180fb17b5dcdfec9ccd0b3b80bed2816c0bd2d25de35580b859e7799b7cb61071edb3f
-
Filesize
944B
MD54d8567f2d1c8a09bbfe613145bf78577
SHA1f2af10d629e6d7d2ecec76c34bd755ecf61be931
SHA2567437b098af4618fbcefe7522942c862aeaf39a0b82ce05b0797185c552f22a3c
SHA51289130e5c514e33f5108e308f300614dc63989f3e6a4e762a12982af341ab1c5748dd93fd185698dcf6d3a1ea7234228d04ad962e4ee0a15a683e988f115a84ea
-
Filesize
948B
MD528ef595a6cc9f47b8eccb22d4ed50d6c
SHA14335de707324b15eba79017938c3da2752d3eea5
SHA2563abd14d4fe7b5697b2fa84993e7183f4fd2580be5b4e5150da15ddda5a9560b9
SHA512687b7849faa62a4dabc240b573afa163f0cda9a80be61cebe28ef1461777744d73b465ac92d065093228068540846e79c899445057f5b906f9b9fa9868132208
-
Filesize
1KB
MD5276798eeb29a49dc6e199768bc9c2e71
SHA15fdc8ccb897ac2df7476fbb07517aca5b7a6205b
SHA256cd0a1056e8f1b6cb5cb328532239d802f4e2aa8f8fcdc0fcb487684bd68e0dcc
SHA5120d34fce64bbefc57d64fa6e03ca886952263d5f24df9c1c4cce6a1e8f5a47a9a21e9820f8d38caa7f7b43a52336ce00b738ea18419aaa7c788b72e04ce19e4f2
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82