Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    134s
  • max time network
    126s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    23/05/2024, 12:03

General

  • Target

    Cheat Lab 2.7.2.msi

  • Size

    2.4MB

  • MD5

    f97903fac84172871545926d6e553eb9

  • SHA1

    e6e027b77df4823f4ff37656867e8f40d4ebd732

  • SHA256

    35cee7837f460d9e1141e375af8438e868a9e6b8d923ed2673a980fcadfd4774

  • SHA512

    5d82d62399079a10d36f5c32b091592cff640c40f593140138a1c741fbc92c579925186a2dd40820cef9bb04a5a7680486508896e6032caa4909d49a95e3fd75

  • SSDEEP

    49152:zjfedtZKumZrEq4Fb6HXr1iWnYs4ntHurpllQ6aduxtZB6DXDNvu8S:+VKwFnWnwux567DNG8S

Score
8/10

Malware Config

Signatures

  • Blocklisted process makes network request 5 IoCs
  • Enumerates connected drives 3 TTPs 46 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Drops file in Program Files directory 3 IoCs
  • Drops file in Windows directory 14 IoCs
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 22 IoCs
  • Modifies data under HKEY_USERS 3 IoCs
  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of WriteProcessMemory 13 IoCs

Processes

  • C:\Windows\system32\msiexec.exe
    msiexec.exe /I "C:\Users\Admin\AppData\Local\Temp\Cheat Lab 2.7.2.msi"
    1⤵
    • Enumerates connected drives
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    PID:4864
  • C:\Windows\system32\msiexec.exe
    C:\Windows\system32\msiexec.exe /V
    1⤵
    • Enumerates connected drives
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Modifies data under HKEY_USERS
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:4420
    • C:\Windows\syswow64\MsiExec.exe
      C:\Windows\syswow64\MsiExec.exe -Embedding D5F87B4BE9EDADA7E111C682A70E885D C
      2⤵
      • Loads dropped DLL
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:764
      • C:\Program Files\Cheat Lab Inc\Cheat Lab\compiler.exe
        "C:\Program Files\Cheat Lab Inc\Cheat Lab\compiler.exe" "C:\Program Files\Cheat Lab Inc\Cheat Lab\readme.txt"
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Suspicious use of WriteProcessMemory
        PID:3232
        • C:\Windows\SYSTEM32\rundll32.exe
          rundll32 "C:\Users\Admin\AppData\Roaming\Lua\bin\lua.dll", init
          4⤵
          • Blocklisted process makes network request
          • Loads dropped DLL
          PID:4468
    • C:\Windows\syswow64\MsiExec.exe
      C:\Windows\syswow64\MsiExec.exe -Embedding D3A27E1EF0A0D32B27328EBB7D8B6976
      2⤵
      • Loads dropped DLL
      • Suspicious behavior: EnumeratesProcesses
      PID:3160
    • C:\Windows\syswow64\MsiExec.exe
      C:\Windows\syswow64\MsiExec.exe -Embedding 11ABD7F86AAD0B81742CD9E61C20AAE5 E Global\MSI0000
      2⤵
      • Loads dropped DLL
      PID:3560

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Config.Msi\e57ee68.rbs

    Filesize

    188KB

    MD5

    3a33160e5568ed2218842a82f6f5d281

    SHA1

    bfd4a3d6fd68f721848ad49c3b1b81152d7bec7d

    SHA256

    6beb41b966cb3f9e355ebf6f7e3a06692e0d2a6bd6a0bb6ae3c3d0540e8b49cd

    SHA512

    75a565a62e7526573db771f1770ba332c842d07eeed0766a2bee043160727fc212f805d8164c0d2ba6041eb57bdd2e54e7e6f986f27585c22e8e119b3151a850

  • C:\Program Files\Cheat Lab Inc\Cheat Lab\compiler.exe

    Filesize

    261KB

    MD5

    f33e239a228ad29b22f40a503db1dd60

    SHA1

    8b56571cd8c39978c657818f2ff6b05753c9fd94

    SHA256

    dfbf23697cfd9d35f263af7a455351480920a95bfc642f3254ee8452ce20655a

    SHA512

    e161d6b8b5df6da2d3f7fbd4f68ac05ba9ebd479404c502b45a126758e21cc7b918ab038688d3abfbb50e25216bb39dae30efa2d306dbc76e6216461520e2c2d

  • C:\Program Files\Cheat Lab Inc\Cheat Lab\lua51.dll

    Filesize

    484KB

    MD5

    75d539df595217555d98c59af85edab1

    SHA1

    a67b14c2ddfda8f770cfeef0d3b676b433df500c

    SHA256

    873aa2e88dbc2efa089e6efd1c8a5370e04c9f5749d7631f2912bcb640439997

    SHA512

    e2b47f2733d2f439af53b12fddd9efa044b832871be2e064d236d6581a3d81e57d7ff4ae123b6f82fd00c752e33d51ae8fd403cee49b628a6d0c2d46de04ce6e

  • C:\Program Files\Cheat Lab Inc\Cheat Lab\readme.txt

    Filesize

    188KB

    MD5

    da93380e27ef93a7b46af81a3b8c0f13

    SHA1

    620c61603dfd44074133b20ae15f2b1a7478be9a

    SHA256

    751f97824cd211ae710655e60a26885cd79974f0f0a5e4e582e3b635492b4cad

    SHA512

    e9dc7ab3447cf523b9f895ea3ae2b3a8d52fae8b3cbaab14dc256d9a9cf3b79ce770bb665591ad5e9bf1bd216948b131c1003a16b6b3a19f4e1aa6a0e944b550

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\A66A8DB907BADC9D16AD67B2FBFFDD5C

    Filesize

    281B

    MD5

    2db5345850c203829dc2d4c66b441ac6

    SHA1

    25e5cbaffdfe0456301188b304106baea4750535

    SHA256

    2716710828b2390a73099b978e2ca941a8bce3fdc275fa58d511be7177e150ca

    SHA512

    c36e197ca81a2d9786d822d1058e1817600e82763c2027213ea67abbc0eb1257d48893163550cb6d46205e282c101efdfee9388d1457e30e78dee34e5b1e0ac5

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B2FAF7692FD9FFBD64EDE317E42334BA_89854CA6A0F0936A4D2ECA78845CEA25

    Filesize

    1KB

    MD5

    72d4880bc5c5e75d2c69ea85932f6015

    SHA1

    ac33593f45a034fef778aa22b0b93dd29a6c7366

    SHA256

    7e576ce866607f8e6802355e09db9431853bd6568fc239ff4e3308b4edc06b6d

    SHA512

    ba0976e2b8652d3dc71558e669ab450b793c49a61aa01a1b0b4dfe9a6c8bf0ab065548a314bad955104be5d5ef6948d959569433c40c69b01dd8b3ac09fa36e9

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\D0E1C4B6144E7ECAB3F020E4A19EFC29_B5F77004C894173A10E3A199871D2D90

    Filesize

    979B

    MD5

    bc90511177a4597118c0cd5572567295

    SHA1

    ab38408b2f638d16ee748aae07dea098071f7aed

    SHA256

    eacd1a0ba09bb02dc47fa6e150be8a7d27ac8d082f33a3549e12be8161765784

    SHA512

    126d34d1095e69c89fff418e21cb72ed71d63977cc30a1202d7c5ebd80b6c4d960db4964ef7d1972a370f561205def244e33628632c44226ad1cb30f6c0dd1f3

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_CBDCCBFE4F7A916411C1E69BDD97BB04

    Filesize

    471B

    MD5

    6fe86f61844682b66eb0e8e5ffedb9db

    SHA1

    ee01554a31c29ea6cf581c2728d1d0ecc5a5c720

    SHA256

    19e5c432c12c7f17a681f54cc75b5a88b2f374360e1ecb086bf21447a0fd830a

    SHA512

    93dc92d22b193ba9a6db17cfdd191985ad989a1fc71a6049f361a5e9132ec8381480064b03923a93785bf1dc194b3ccc5a1320e97f55cac93783ddaa16df6abe

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\A66A8DB907BADC9D16AD67B2FBFFDD5C

    Filesize

    480B

    MD5

    e27fc4ee85e73ecb194891596fc73c59

    SHA1

    dea32adb2daae722d9f923bb6eccf15dc618cf12

    SHA256

    168a9548d7ebe1beab6c8658e1bed4f38a5123dc5557abf5aa381f108ac96e95

    SHA512

    2952624f4b3610d75759ecad779791b09d3f1927c0c9207eea78442902343b5faa5c323181d60bfeab23d71c10a374546613a7783688a06daf26f832627b1f50

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B2FAF7692FD9FFBD64EDE317E42334BA_89854CA6A0F0936A4D2ECA78845CEA25

    Filesize

    482B

    MD5

    8bfb1f03848f07a8fb5dd8967423506e

    SHA1

    089ad1fe516fed56f948a43a024e6283efafc4bd

    SHA256

    47bdaa989ffec3599abad9fa98f4daac460e58a5f6edb55c68e1e39f841b3935

    SHA512

    c85099d0ba449ca382d3bafe138d913462e1c69dc343e4d50275ed6efade13fc596588ae57b75f51ca8f0a935443231e3fc7350616da06727a7eb3220db10cd8

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\D0E1C4B6144E7ECAB3F020E4A19EFC29_B5F77004C894173A10E3A199871D2D90

    Filesize

    480B

    MD5

    c09d58453aef6780fe5e3e293fd7bb75

    SHA1

    433cd6ec1ac85c12d8cfec7a549c35af62454468

    SHA256

    ffea233fae4209ccc2ce4f2a79aadf8c4ae2f0cfce2c903d82dfe8ec6e62cf69

    SHA512

    4aaf719cbd4b7e41c2a211966524cb20d406b0acc3f77ee9e21fa4ac4ab3b92814ef635ec3e414dc6ef9a1043d561d79b9f0c79f0e197cea2dc02b718211510e

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_CBDCCBFE4F7A916411C1E69BDD97BB04

    Filesize

    412B

    MD5

    8c8b4be201c5956948ee8ba390151410

    SHA1

    5914ea0d1b5d6f4fba7263cf00c7a879686d9ab8

    SHA256

    8697b8040a537864eb184ce960f1ca2a9f66bd4e0b18e396b88d72e24a1c1413

    SHA512

    6030704c377ccfea6b53e0a207217aec3c6157ae5a1f78788877f45a3d68d71737bd75246b6c647ca68b3d635779c6497c935a6d8cc5dc8f962edeb6038eccdb

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\J2J1W33T\packet[1].log

    Filesize

    4.1MB

    MD5

    0ffd3bd05a9281981db2330e5a7291c1

    SHA1

    fabbfea6c072f68692b81571d38e8eab72de1362

    SHA256

    286dca4423a65cbd5d23e9bf002e584ec16a88c0a5edf4cfdc6b639d982593ad

    SHA512

    54ff1df237207e4fe70808583b96a07d0366887ed7e3389527eaadb6c3e045c19c4ba1621a47e24fa661f52b504274b46af91acd1b562bc15b1e51518846c333

  • C:\Users\Admin\AppData\Local\Temp\MSI47B7.tmp

    Filesize

    436KB

    MD5

    475d20c0ea477a35660e3f67ecf0a1df

    SHA1

    67340739f51e1134ae8f0ffc5ae9dd710e8e3a08

    SHA256

    426e6cf199a8268e8a7763ec3a4dd7add982b28c51d89ebea90ca792cbae14dd

    SHA512

    99525aaab2ab608134b5d66b5313e7fc3c2e2877395c5c171897d7a6c66efb26b606de1a4cb01118c2738ea4b6542e4eb4983e631231b3f340bf85e509a9589e

  • C:\Users\Admin\AppData\Local\Temp\MSI4A5D.tmp

    Filesize

    897KB

    MD5

    6189cdcb92ab9ddbffd95facd0b631fa

    SHA1

    b74c72cefcb5808e2c9ae4ba976fa916ba57190d

    SHA256

    519f7ac72beba9d5d7dcf71fcac15546f5cfd3bcfc37a5129e63b4e0be91a783

    SHA512

    ee9ce27628e7a07849cd9717609688ca4229d47579b69e3d3b5b2e7c2433369de9557ef6a13fa59964f57fb213cd8ca205b35f5791ea126bde5a4e00f6a11caf

  • C:\Users\Admin\Pictures\310807AB751F4D81AE09B202EAF21E19

    Filesize

    1KB

    MD5

    0685f628f7b26462640a2d8647a9db08

    SHA1

    dfd04f884ca8ef1074a28153d0d9754462693a2d

    SHA256

    4d2490dfccac8fff703222d3d3b82d3c390b4b9458c3e3e305dc4a29389b5e39

    SHA512

    7fe7549f120349ccaf39719595d1bd338882b8191f85f5f4d3f6a2e7688b1e442db2eda6db2fc8ac5b09a2e7574fbfd2bdaf72946e587fce2de610bcaaf723ec

  • C:\Windows\Installer\MSIF0FC.tmp

    Filesize

    187KB

    MD5

    f11e8ec00dfd2d1344d8a222e65fea09

    SHA1

    235ed90cc729c50eb6b8a36ebcd2cf044a2d8b20

    SHA256

    775037d6d7de214796f2f5850440257ae7f04952b73538da2b55db45f3b26e93

    SHA512

    6163dd8fd18b4520d7fda0986a80f2e424fe55f5d65d67f5a3519a366e53049f902a08164ea5669476100b71bb2f0c085327b7c362174cb7a051d268f10872d3

  • memory/3232-129-0x00007FFE6B080000-0x00007FFE6B090000-memory.dmp

    Filesize

    64KB

  • memory/3232-121-0x00007FFE6B080000-0x00007FFE6B090000-memory.dmp

    Filesize

    64KB

  • memory/3232-150-0x00007FFE6B080000-0x00007FFE6B090000-memory.dmp

    Filesize

    64KB

  • memory/3232-149-0x00007FFE6B080000-0x00007FFE6B090000-memory.dmp

    Filesize

    64KB

  • memory/3232-148-0x00007FFE6B080000-0x00007FFE6B090000-memory.dmp

    Filesize

    64KB

  • memory/3232-147-0x00007FFE6B080000-0x00007FFE6B090000-memory.dmp

    Filesize

    64KB

  • memory/3232-146-0x00007FFE6B080000-0x00007FFE6B090000-memory.dmp

    Filesize

    64KB

  • memory/3232-145-0x00007FFE6B080000-0x00007FFE6B090000-memory.dmp

    Filesize

    64KB

  • memory/3232-144-0x00007FFE6B080000-0x00007FFE6B090000-memory.dmp

    Filesize

    64KB

  • memory/3232-143-0x00007FFE6B080000-0x00007FFE6B090000-memory.dmp

    Filesize

    64KB

  • memory/3232-142-0x00007FFE6B080000-0x00007FFE6B090000-memory.dmp

    Filesize

    64KB

  • memory/3232-141-0x00007FFE6B080000-0x00007FFE6B090000-memory.dmp

    Filesize

    64KB

  • memory/3232-140-0x00007FFE6B080000-0x00007FFE6B090000-memory.dmp

    Filesize

    64KB

  • memory/3232-139-0x00007FFE6B080000-0x00007FFE6B090000-memory.dmp

    Filesize

    64KB

  • memory/3232-138-0x00007FFE6B080000-0x00007FFE6B090000-memory.dmp

    Filesize

    64KB

  • memory/3232-137-0x00007FFE6B080000-0x00007FFE6B090000-memory.dmp

    Filesize

    64KB

  • memory/3232-136-0x00007FFE6B080000-0x00007FFE6B090000-memory.dmp

    Filesize

    64KB

  • memory/3232-135-0x00007FFE6B080000-0x00007FFE6B090000-memory.dmp

    Filesize

    64KB

  • memory/3232-134-0x00007FFE6B080000-0x00007FFE6B090000-memory.dmp

    Filesize

    64KB

  • memory/3232-133-0x00007FFE6B080000-0x00007FFE6B090000-memory.dmp

    Filesize

    64KB

  • memory/3232-132-0x00007FFE6B080000-0x00007FFE6B090000-memory.dmp

    Filesize

    64KB

  • memory/3232-131-0x00007FFE6B080000-0x00007FFE6B090000-memory.dmp

    Filesize

    64KB

  • memory/3232-130-0x00007FFE6B080000-0x00007FFE6B090000-memory.dmp

    Filesize

    64KB

  • memory/3232-152-0x00007FFE6B080000-0x00007FFE6B090000-memory.dmp

    Filesize

    64KB

  • memory/3232-128-0x00007FFE6B080000-0x00007FFE6B090000-memory.dmp

    Filesize

    64KB

  • memory/3232-127-0x00007FFE6B080000-0x00007FFE6B090000-memory.dmp

    Filesize

    64KB

  • memory/3232-126-0x00007FFE6B080000-0x00007FFE6B090000-memory.dmp

    Filesize

    64KB

  • memory/3232-125-0x00007FFE6B080000-0x00007FFE6B090000-memory.dmp

    Filesize

    64KB

  • memory/3232-124-0x00007FFE6B080000-0x00007FFE6B090000-memory.dmp

    Filesize

    64KB

  • memory/3232-123-0x00007FFE6B080000-0x00007FFE6B090000-memory.dmp

    Filesize

    64KB

  • memory/3232-122-0x00007FFE6B080000-0x00007FFE6B090000-memory.dmp

    Filesize

    64KB

  • memory/3232-151-0x00007FFE6B080000-0x00007FFE6B090000-memory.dmp

    Filesize

    64KB

  • memory/3232-120-0x00007FFE6B080000-0x00007FFE6B090000-memory.dmp

    Filesize

    64KB

  • memory/3232-119-0x00007FFE6B080000-0x00007FFE6B090000-memory.dmp

    Filesize

    64KB

  • memory/3232-118-0x00007FFE6B080000-0x00007FFE6B090000-memory.dmp

    Filesize

    64KB

  • memory/3232-117-0x00007FFE6B080000-0x00007FFE6B090000-memory.dmp

    Filesize

    64KB

  • memory/3232-116-0x00007FFE6B080000-0x00007FFE6B090000-memory.dmp

    Filesize

    64KB

  • memory/3232-115-0x00007FFE6B080000-0x00007FFE6B090000-memory.dmp

    Filesize

    64KB

  • memory/3232-114-0x00007FFE6B080000-0x00007FFE6B090000-memory.dmp

    Filesize

    64KB

  • memory/3232-113-0x00007FFE6B080000-0x00007FFE6B090000-memory.dmp

    Filesize

    64KB

  • memory/3232-112-0x00007FFE6B080000-0x00007FFE6B090000-memory.dmp

    Filesize

    64KB

  • memory/3232-109-0x00007FFE6B080000-0x00007FFE6B090000-memory.dmp

    Filesize

    64KB

  • memory/3232-108-0x00007FFE6B080000-0x00007FFE6B090000-memory.dmp

    Filesize

    64KB

  • memory/3232-107-0x00007FFE6B080000-0x00007FFE6B090000-memory.dmp

    Filesize

    64KB

  • memory/3232-105-0x00007FFE6B080000-0x00007FFE6B090000-memory.dmp

    Filesize

    64KB

  • memory/3232-104-0x00007FFE6B080000-0x00007FFE6B090000-memory.dmp

    Filesize

    64KB

  • memory/3232-103-0x00007FFE6B080000-0x00007FFE6B090000-memory.dmp

    Filesize

    64KB

  • memory/3232-102-0x00007FFE6B080000-0x00007FFE6B090000-memory.dmp

    Filesize

    64KB

  • memory/3232-101-0x00007FFE6B080000-0x00007FFE6B090000-memory.dmp

    Filesize

    64KB

  • memory/3232-100-0x00007FFE6B080000-0x00007FFE6B090000-memory.dmp

    Filesize

    64KB

  • memory/3232-99-0x00007FFE6B080000-0x00007FFE6B090000-memory.dmp

    Filesize

    64KB

  • memory/3232-98-0x00007FFE6B080000-0x00007FFE6B090000-memory.dmp

    Filesize

    64KB

  • memory/3232-156-0x00007FFE6B080000-0x00007FFE6B090000-memory.dmp

    Filesize

    64KB

  • memory/3232-111-0x00007FFE6B080000-0x00007FFE6B090000-memory.dmp

    Filesize

    64KB

  • memory/3232-153-0x00007FFE6B080000-0x00007FFE6B090000-memory.dmp

    Filesize

    64KB

  • memory/3232-154-0x00007FFE6B080000-0x00007FFE6B090000-memory.dmp

    Filesize

    64KB

  • memory/3232-155-0x00007FFE6B080000-0x00007FFE6B090000-memory.dmp

    Filesize

    64KB

  • memory/3232-157-0x00007FFE6B080000-0x00007FFE6B090000-memory.dmp

    Filesize

    64KB

  • memory/3232-159-0x00007FFE6B080000-0x00007FFE6B090000-memory.dmp

    Filesize

    64KB

  • memory/3232-160-0x00007FFE6B080000-0x00007FFE6B090000-memory.dmp

    Filesize

    64KB

  • memory/3232-158-0x00007FFE6B080000-0x00007FFE6B090000-memory.dmp

    Filesize

    64KB

  • memory/3232-162-0x00007FFE6B080000-0x00007FFE6B090000-memory.dmp

    Filesize

    64KB

  • memory/3232-106-0x00007FFE6B080000-0x00007FFE6B090000-memory.dmp

    Filesize

    64KB

  • memory/3232-110-0x00007FFE6B080000-0x00007FFE6B090000-memory.dmp

    Filesize

    64KB