Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
162s -
max time network
157s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
-
submitted
12/05/2024, 14:00
General
-
Target
CheatEngine75.exe
-
Size
28.5MB
-
MD5
0fa34a970c3defa54dbc6b725e03b83d
-
SHA1
44fa4a2d4d3fc9259fb03324eb390def62ff786a
-
SHA256
93bc218fa7956dc4eb8d19f7fe8c8ebb2e0b60f06ff221bbab6e62b56fc94f6a
-
SHA512
2ec36599bae79365cfb02edc475ca416b4cd85c9cf349b0cc548e145a10fb22b2fae5ce504e76725e6832028cda3fd6b2bec4adfb7dbf49738e952651a5b7e90
-
SSDEEP
786432:yTCxuEnwFho+zM77UDZiZCd08jFZJAI5E70TZFH:y2EXFhV0KAcNjxAItj
Malware Config
Signatures
-
Checks for any installed AV software in registry 1 TTPs 9 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 1 IoCs
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Script User-Agent 1 IoCs
Uses user-agent string associated with script host/environment.
-
Suspicious behavior: EnumeratesProcesses 28 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\CheatEngine75.exe"C:\Users\Admin\AppData\Local\Temp\CheatEngine75.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-25I84.tmp\CheatEngine75.tmp"C:\Users\Admin\AppData\Local\Temp\is-25I84.tmp\CheatEngine75.tmp" /SL5="$80182,29019897,780800,C:\Users\Admin\AppData\Local\Temp\CheatEngine75.exe"2⤵
- Checks for any installed AV software in registry
- Executes dropped EXE
- Loads dropped DLL
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
246KB
MD51df360d73bf8108041d31d9875888436
SHA1c866e8855d62f56a411641ece0552e54cbd0f2fb
SHA256c1b1d7b4806955fe39a8bc6ce5574ab6ac5b93ad640cecfebe0961360c496d43
SHA5123991b89927d89effca30cc584d5907998c217cf00ca441f2525ef8627ffff2032d104536f8b6ab79b83f4e32a7aab993f45d3930d5943cbfb5e449c5832abe14
-
Filesize
2.0MB
MD5b83f5833e96c2eb13f14dcca805d51a1
SHA19976b0a6ef3dabeab064b188d77d870dcdaf086d
SHA25600e667b838a4125c8cf847936168bb77bb54580bc05669330cb32c0377c4a401
SHA5128641b351e28b3c61ed6762adbca165f4a5f2ee26a023fd74dd2102a6258c0f22e91b78f4a3e9fba6094b68096001de21f10d6495f497580847103c428d30f7bb
-
Filesize
2.9MB
MD514e34c5e0e3c320b904b9500e8fa96cf
SHA147cf88e6ddc1683135194b9d8b1cc32c78277f5e
SHA2567398bd01e78df0d69169402f7fecf781c23f61127ba68290d146582ebadbf2ef
SHA5126d99202dafd3209622e6fa217407bccd0b4157550d873bff36f06a279c499c9e98cb01d235c337d76d86c9e3c369d89712450fe1353eb18b2b7c108abd67ad59
-
Filesize
816KB
-
Filesize
728KB
-
Filesize
816KB
-
Filesize
2.9MB
-
Filesize
1.2MB
-
Filesize
2.9MB
-
Filesize
2.9MB
