59f0c094091505062f443e72c7f20faea6333de746cd2bcdf7b2616970b02f26

Analysis

max time kernel
149s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
29-05-2024 23:33

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Steam cheat engine/Files cheat/Steam CE.exe
Size

16.1MB
MD5

4646ce6163658aa1c8500d517775859e
SHA1

2d3498cbf0a8ce5992909f87c86320f9278546f5
SHA256

94435a79f66c55efaf942263a0318d11fd4c689b7a4f52386712f2a328677b76
SHA512

740110a93e1c7e303f82a437ce44dd69ba4610facd208e8ec1387fdee88310265faf56815dcd8deabebcecaf8a8b951b9f9ef1ca02c8a6a972858c3039a9cfe1
SSDEEP

393216:C3Z8A06vEQ3ITvzx46SxiILGREuV3WjI8O:C3ZIzx46YNL6WEZ

Score

5^/10

Malware Config

Signatures

Drops file in System32 directory 43 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\combase.dll	Steam CE.exe
File opened for modification	C:\Windows\SYSTEM32\msimg32.dll	Steam CE.exe
File opened for modification	C:\Windows\SYSTEM32\windows.storage.dll	Steam CE.exe
File opened for modification	C:\Windows\SYSTEM32\Wldp.dll	Steam CE.exe
File opened for modification	C:\Windows\SYSTEM32\PROPSYS.dll	Steam CE.exe
File opened for modification	C:\Windows\System32\KERNEL32.DLL	Steam CE.exe
File opened for modification	C:\Windows\System32\KERNELBASE.dll	Steam CE.exe
File opened for modification	C:\Windows\System32\win32u.dll	Steam CE.exe
File opened for modification	C:\Windows\SYSTEM32\kernel.appcore.dll	Steam CE.exe
File opened for modification	C:\Windows\system32\IconCodecService.dll	Steam CE.exe
File opened for modification	C:\Windows\System32\msvcp_win.dll	Steam CE.exe
File opened for modification	C:\Windows\System32\RPCRT4.dll	Steam CE.exe
File opened for modification	C:\Windows\SYSTEM32\wsock32.dll	Steam CE.exe
File opened for modification	C:\Windows\system32\explorerframe.dll	Steam CE.exe
File opened for modification	C:\Windows\System32\ucrtbase.dll	Steam CE.exe
File opened for modification	C:\Windows\System32\user32.dll	Steam CE.exe
File opened for modification	C:\Windows\System32\imm32.dll	Steam CE.exe
File opened for modification	C:\Windows\System32\ws2_32.dll	Steam CE.exe
File opened for modification	C:\Windows\System32\psapi.dll	Steam CE.exe
File opened for modification	C:\Windows\SYSTEM32\version.dll	Steam CE.exe
File opened for modification	C:\Windows\SYSTEM32\wininet.dll	Steam CE.exe
File opened for modification	C:\Windows\SYSTEM32\GLU32.dll	Steam CE.exe
File opened for modification	C:\Windows\SYSTEM32\WindowsCodecs.dll	Steam CE.exe
File opened for modification	C:\Windows\SYSTEM32\ntdll.dll	Steam CE.exe
File opened for modification	C:\Windows\System32\GDI32.dll	Steam CE.exe
File opened for modification	C:\Windows\System32\shcore.dll	Steam CE.exe
File opened for modification	C:\Windows\System32\SHLWAPI.dll	Steam CE.exe
File opened for modification	C:\Windows\SYSTEM32\opengl32.dll	Steam CE.exe
File opened for modification	C:\Windows\System32\clbcatq.dll	Steam CE.exe
File opened for modification	C:\Windows\System32\bcrypt.dll	Steam CE.exe
File opened for modification	C:\Windows\System32\gdi32full.dll	Steam CE.exe
File opened for modification	C:\Windows\System32\comdlg32.dll	Steam CE.exe
File opened for modification	C:\Windows\System32\sechost.dll	Steam CE.exe
File opened for modification	C:\Windows\System32\shell32.dll	Steam CE.exe
File opened for modification	C:\Windows\SYSTEM32\hhctrl.ocx	Steam CE.exe
File opened for modification	C:\Windows\System32\bcryptPrimitives.dll	Steam CE.exe
File opened for modification	C:\Windows\System32\MSCTF.dll	Steam CE.exe
File opened for modification	C:\Windows\System32\oleaut32.dll	Steam CE.exe
File opened for modification	C:\Windows\System32\msvcrt.dll	Steam CE.exe
File opened for modification	C:\Windows\SYSTEM32\uxtheme.dll	Steam CE.exe
File opened for modification	C:\Windows\SYSTEM32\winmm.dll	Steam CE.exe
File opened for modification	C:\Windows\System32\advapi32.dll	Steam CE.exe
File opened for modification	C:\Windows\System32\ole32.dll	Steam CE.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\WinSxS\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.19041.1110_none_60b5254171f9507e\comctl32.dll	Steam CE.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
544	Steam CE.exe
544	Steam CE.exe
544	Steam CE.exe
544	Steam CE.exe

Suspicious use of AdjustPrivilegeToken 16 IoCs

description	pid	Process
Token: SeDebugPrivilege	544	Steam CE.exe
Token: SeTcbPrivilege	544	Steam CE.exe
Token: SeTcbPrivilege	544	Steam CE.exe
Token: SeLoadDriverPrivilege	544	Steam CE.exe
Token: SeCreateGlobalPrivilege	544	Steam CE.exe
Token: SeLockMemoryPrivilege	544	Steam CE.exe
Token: 33	544	Steam CE.exe
Token: SeSecurityPrivilege	544	Steam CE.exe
Token: SeTakeOwnershipPrivilege	544	Steam CE.exe
Token: SeManageVolumePrivilege	544	Steam CE.exe
Token: SeBackupPrivilege	544	Steam CE.exe
Token: SeCreatePagefilePrivilege	544	Steam CE.exe
Token: SeShutdownPrivilege	544	Steam CE.exe
Token: SeRestorePrivilege	544	Steam CE.exe
Token: 33	544	Steam CE.exe
Token: SeIncBasePriorityPrivilege	544	Steam CE.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
544	Steam CE.exe

C:\Users\Admin\AppData\Local\Temp\Steam cheat engine\Files cheat\Steam CE.exe
"C:\Users\Admin\AppData\Local\Temp\Steam cheat engine\Files cheat\Steam CE.exe"
1⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:544

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/544-5-0x000000000F720000-0x000000000F721000-memory.dmp

Filesize
4KB

Download
memory/544-3-0x000000000F710000-0x000000000F711000-memory.dmp

Filesize
4KB

Download
memory/544-1-0x000000000F700000-0x000000000F701000-memory.dmp

Filesize
4KB

Download
memory/544-0-0x000000000F700000-0x000000000F701000-memory.dmp

Filesize
4KB

Download
memory/544-19-0x0000000006ED0000-0x0000000006ED1000-memory.dmp

Filesize
4KB

Download
memory/544-17-0x0000000006ED0000-0x0000000006ED1000-memory.dmp

Filesize
4KB

Download
memory/544-15-0x0000000006ED0000-0x0000000006ED1000-memory.dmp

Filesize
4KB

Download
memory/544-13-0x0000000006EC0000-0x0000000006EC1000-memory.dmp

Filesize
4KB

Download
memory/544-9-0x0000000006EC0000-0x0000000006EC1000-memory.dmp

Filesize
4KB

Download
memory/544-7-0x0000000006EB0000-0x0000000006EB1000-memory.dmp

Filesize
4KB

Download