Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

5

Static

static

3

ch/Cheat Engine.exe

windows7-x64

5

ch/Cheat Engine.exe

windows10-2004-x64

5

ch/CheatEngine.chm

windows7-x64

1

ch/CheatEngine.chm

windows10-2004-x64

1

ch/DotNetD...32.exe

windows7-x64

1

ch/DotNetD...32.exe

windows10-2004-x64

1

ch/DotNetD...64.exe

windows7-x64

1

ch/DotNetD...64.exe

windows10-2004-x64

1

ch/libipt-32.dll

windows7-x64

1

ch/libipt-32.dll

windows10-2004-x64

3

ch/libipt-64.dll

windows7-x64

1

ch/libipt-64.dll

windows10-2004-x64

1

ch/libmikmod32.dll

windows7-x64

1

ch/libmikmod32.dll

windows10-2004-x64

1

ch/libmikmod64.dll

windows7-x64

1

ch/libmikmod64.dll

windows10-2004-x64

1

ch/lua53-32.dll

windows7-x64

3

ch/lua53-32.dll

windows10-2004-x64

3

ch/lua53-64.dll

windows7-x64

1

ch/lua53-64.dll

windows10-2004-x64

1

ch/luaclient-i386.dll

windows7-x64

3

ch/luaclient-i386.dll

windows10-2004-x64

3

ch/luaclie...64.dll

windows7-x64

1

ch/luaclie...64.dll

windows10-2004-x64

1

ch/plugins...ple.js

windows7-x64

3

ch/plugins...ple.js

windows10-2004-x64

3

ch/plugins...orm.js

windows7-x64

3

ch/plugins...orm.js

windows10-2004-x64

3

ch/plugins...rm.vbs

windows7-x64

1

ch/plugins...rm.vbs

windows10-2004-x64

1

ch/plugins...le.dll

windows7-x64

1

ch/plugins...le.dll

windows10-2004-x64

1

Analysis

  • max time kernel
    300s
  • max time network
    163s
  • platform
    windows7_x64
  • resource
    win7-20240221-es
  • resource tags

    arch:x64arch:x86image:win7-20240221-eslocale:es-esos:windows7-x64systemwindows
  • submitted
    05/07/2024, 14:11

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    ch/Cheat Engine.exe

  • Size

    375KB

  • MD5

    2ce992abd25f22de9a9b737bc608cf89

  • SHA1

    d42cbe3f341b617f2565bacb7c1b9f40c89580e4

  • SHA256

    f194daf2370bf554d37377be46b93d5a6b3dfaef1326d24740aee0989745c881

  • SHA512

    e4f1fceea371d683ecb31ffac61ffa7a75ca8b87f8032ab1fc2624250cc8eef851cccfa12d117c0d104f8056a01ffb4260ac58774faaaef71ced5ecb66ae1ec2

  • SSDEEP

    6144:/e0N02QaC/5SkHic3ivvM87DeiyF7tWwQE8MktvyFgkiMggugEkkoSE5hsB:G0N02Qh/QkLyvxty+PwkVyFgkidgugEX

Score
5/10

Malware Config

Signatures

  • Drops file in System32 directory 52 IoCs
  • Drops file in Windows directory 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Script User-Agent 1 IoCs

    Uses user-agent string associated with script host/environment.

  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 16 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\ch\Cheat Engine.exe
    "C:\Users\Admin\AppData\Local\Temp\ch\Cheat Engine.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2832
    • C:\Users\Admin\AppData\Local\Temp\ch\cheatengine-x86_64-SSE4-AVX2.exe
      "C:\Users\Admin\AppData\Local\Temp\ch\cheatengine-x86_64-SSE4-AVX2.exe"
      2⤵
      • Drops file in System32 directory
      • Drops file in Windows directory
      • Suspicious behavior: GetForegroundWindowSpam
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of WriteProcessMemory
      PID:1172
      • C:\Users\Admin\AppData\Local\Temp\ch\Tutorial-i386.exe
        "C:\Users\Admin\AppData\Local\Temp\ch\Tutorial-i386.exe"
        3⤵
          PID:1104

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015
      Filesize

      70KB

      MD5

      49aebf8cbd62d92ac215b2923fb1b9f5

      SHA1

      1723be06719828dda65ad804298d0431f6aff976

      SHA256

      b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

      SHA512

      bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

      Download Submit

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
      Filesize

      342B

      MD5

      9a6224dd0136d063dfc8a3999a8f0457

      SHA1

      4c538303f0ce5b31226101c816281af3a1175047

      SHA256

      d8b2711b41a4c0148b98792934439ec4f4fec7a29e38d57acb96bc7b2bd4aaa2

      SHA512

      cc1b325c37f58d3f51a0c844712caff8497e77a0728d4c9c4346d9c455f546d3a132f7bfce3f26140ae98aac6e950f00467dd8f16b871a376ff373de44dd3fac

      Download Submit

    • C:\Users\Admin\AppData\Local\Temp\Cab5082.tmp
      Filesize

      65KB

      MD5

      ac05d27423a85adc1622c714f2cb6184

      SHA1

      b0fe2b1abddb97837ea0195be70ab2ff14d43198

      SHA256

      c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

      SHA512

      6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

      Download Submit

    • C:\Users\Admin\AppData\Local\Temp\Tar51A2.tmp
      Filesize

      181KB

      MD5

      4ea6026cf93ec6338144661bf1202cd1

      SHA1

      a1dec9044f750ad887935a01430bf49322fbdcb7

      SHA256

      8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

      SHA512

      6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

      Download Submit

    • memory/1172-97-0x0000000009740000-0x0000000009741000-memory.dmp

      Filesize

      4KB

      Download

    • memory/1172-103-0x0000000009740000-0x0000000009741000-memory.dmp

      Filesize

      4KB

      Download