Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
120s -
max time network
126s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
20/05/2024, 00:11
Behavioral task
behavioral1
Sample
release/main/cheat.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
release/main/cheat.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral3
Sample
release/main/loader.exe
Resource
win7-20240419-en
General
-
Target
release/main/cheat.exe
-
Size
4.1MB
-
MD5
d1895f02df8810e698741d4805317916
-
SHA1
b45eb5ebe4184b6249f514122838b582c8030a0b
-
SHA256
b2304109f2212ccf8b49c9fe8999b178ce7563c1c7540a05ea3d2836b22d361d
-
SHA512
bf9449415ee28b84319df57dca23ce43b345e5dfa042e2613fd84f183a02154bca859785a8b51434ed5466ea7def19a2d562822d9d9f1c7a9de72055843d60b1
-
SSDEEP
98304:bSXAizswlu7vCx/0nrEw1PP3rSDdV+8Tz7kI:bS/Qa50RP3rSP3II
Malware Config
Signatures
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ cheat.exe -
Sets service image path in registry 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\frAQBc8Wsa1xVPfv\ImagePath = "\\??\\C:\\Users\\Admin\\AppData\\Local\\Temp\\frAQBc8Wsa1xVPfv" cheat.exe -
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion cheat.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion cheat.exe -
resource yara_rule behavioral1/memory/2172-0-0x000000013F650000-0x00000001400FF000-memory.dmp themida behavioral1/memory/2172-2-0x000000013F650000-0x00000001400FF000-memory.dmp themida behavioral1/memory/2172-3-0x000000013F650000-0x00000001400FF000-memory.dmp themida behavioral1/memory/2172-4-0x000000013F650000-0x00000001400FF000-memory.dmp themida behavioral1/memory/2172-6-0x000000013F650000-0x00000001400FF000-memory.dmp themida behavioral1/memory/2172-5-0x000000013F650000-0x00000001400FF000-memory.dmp themida behavioral1/memory/2172-7-0x000000013F650000-0x00000001400FF000-memory.dmp themida behavioral1/memory/2172-8-0x000000013F650000-0x00000001400FF000-memory.dmp themida behavioral1/memory/2172-24-0x000000013F650000-0x00000001400FF000-memory.dmp themida behavioral1/memory/2172-26-0x000000013F650000-0x00000001400FF000-memory.dmp themida behavioral1/memory/2172-27-0x000000013F650000-0x00000001400FF000-memory.dmp themida -
description ioc Process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA cheat.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
pid Process 2172 cheat.exe -
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\A8985D3A65E5E5C4B2D7D66D40C6DD2FB19C5436 cheat.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\A8985D3A65E5E5C4B2D7D66D40C6DD2FB19C5436\Blob = 04000000010000001000000079e4a9840d7d3a96d7c04fe2434c892e0f0000000100000014000000b34ddd372ed92e8f2abfbb9e20a9d31f204f194b090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030814000000010000001400000003de503556d14cbb66f0a3e21b1bc397b23dd1550b00000001000000120000004400690067006900430065007200740000001d000000010000001000000059779e39e21a2e3dfced6857ed5c5fd9030000000100000014000000a8985d3a65e5e5c4b2d7d66d40c6dd2fb19c54361900000001000000100000000f3a0527d242de2dc98e5cfcb1e991ee2000000001000000b3030000308203af30820297a0030201020210083be056904246b1a1756ac95991c74a300d06092a864886f70d01010505003061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100e23be11172dea8a4d3a357aa50a28f0b7790c9a2a5ee12ce965b010920cc0193a74e30b753f743c46900579de28d22dd870640008109cece1b83bfdfcd3b7146e2d666c705b37627168f7b9e1e957deeb748a308dad6af7a0c3906657f4a5d1fbc17f8abbeee28d7747f7a78995985686e5c23324bbf4ec0e85a6de370bf7710bffc01f685d9a844105832a97518d5d1a2be47e2276af49a33f84908608bd45fb43a84bfa1aa4a4c7d3ecf4f5f6c765ea04b37919edc22e66dce141a8e6acbfecdb3146417c75b299e32bff2eefad30b42d4abb74132da0cd4eff881d5bb8d583fb51be84928a270da3104ddf7b216f24c0a4e07a8ed4a3d5eb57fa390c3af270203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041403de503556d14cbb66f0a3e21b1bc397b23dd155301f0603551d2304183016801403de503556d14cbb66f0a3e21b1bc397b23dd155300d06092a864886f70d01010505000382010100cb9c37aa4813120afadd449c4f52b0f4dfae04f5797908a32418fc4b2b84c02db9d5c7fef4c11f58cbb86d9c7a74e79829ab11b5e370a0a1cd4c8899938c9170e2ab0f1cbe93a9ff63d5e40760d3a3bf9d5b09f1d58ee353f48e63fa3fa7dbb466df6266d6d16e418df22db5ea774a9f9d58e22b59c04023ed2d2882453e7954922698e08048a837eff0d6796016deace80ecd6eac4417382f49dae1453e2ab93653cf3a5006f72ee8c457496c612118d504ad783c2c3a806ba7ebaf1514e9d889c1b9386ce2916c8aff64b977255730c01b24a3e1dce9df477cb5b424080530ec2dbd0bbf45bf50b9a9f3eb980112adc888c698345f8d0a3cc6e9d595956dde cheat.exe -
Suspicious behavior: LoadsDriver 1 IoCs
pid Process 2172 cheat.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeLoadDriverPrivilege 2172 cheat.exe -
Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 2172 wrote to memory of 2544 2172 cheat.exe 28 PID 2172 wrote to memory of 2544 2172 cheat.exe 28 PID 2172 wrote to memory of 2544 2172 cheat.exe 28 PID 2544 wrote to memory of 2596 2544 cmd.exe 30 PID 2544 wrote to memory of 2596 2544 cmd.exe 30 PID 2544 wrote to memory of 2596 2544 cmd.exe 30 PID 2544 wrote to memory of 2760 2544 cmd.exe 31 PID 2544 wrote to memory of 2760 2544 cmd.exe 31 PID 2544 wrote to memory of 2760 2544 cmd.exe 31 PID 2544 wrote to memory of 2644 2544 cmd.exe 32 PID 2544 wrote to memory of 2644 2544 cmd.exe 32 PID 2544 wrote to memory of 2644 2544 cmd.exe 32
Processes
-
C:\Users\Admin\AppData\Local\Temp\release\main\cheat.exe"C:\Users\Admin\AppData\Local\Temp\release\main\cheat.exe"1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Sets service image path in registry
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Modifies system certificate store
- Suspicious behavior: LoadsDriver
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2172 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c certutil -hashfile "C:\Users\Admin\AppData\Local\Temp\release\main\cheat.exe" MD5 | find /i /v "md5" | find /i /v "certutil"2⤵
- Suspicious use of WriteProcessMemory
PID:2544 -
C:\Windows\system32\certutil.execertutil -hashfile "C:\Users\Admin\AppData\Local\Temp\release\main\cheat.exe" MD53⤵PID:2596
-
-
C:\Windows\system32\find.exefind /i /v "md5"3⤵PID:2760
-
-
C:\Windows\system32\find.exefind /i /v "certutil"3⤵PID:2644
-
-
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Defense Evasion
Modify Registry
2Subvert Trust Controls
1Install Root Certificate
1Virtualization/Sandbox Evasion
1