Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Resubmissions
12/10/2024, 18:38
241012-w94h3avfja 10General
-
Target
CheatEngine75.exe
-
Size
28.5MB
-
Sample
241012-w94h3avfja
-
MD5
647a2177841aebe2f1bb1b3767f41287
-
SHA1
446575615e7fcc9c58fb04cad12909a183a2eb15
-
SHA256
07c1abb57c4498748c4f1344a786c2c136b82651786ed005d999ecbf6054fb2c
-
SHA512
f3165aec7a4b7adb7e6ffca56812f769b7b085000d50bf235ca1c7e74d76dfb5549de9561e281623c734c2dec9fc37b54af572c3e97fcb9fb1411102ae3da0c0
-
SSDEEP
786432:5l3LNCxuEnwFho+zM77UDZiZCd08jFZJAI5E70TZFHi6t:5l3LMEXFhV0KAcNjxAItjFt
Static task
static1
Behavioral task
behavioral1
Sample
CheatEngine75.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
CheatEngine75.exe
Resource
win10v2004-20241007-en
Malware Config
Targets
-
-
Target
CheatEngine75.exe
-
Size
28.5MB
-
MD5
647a2177841aebe2f1bb1b3767f41287
-
SHA1
446575615e7fcc9c58fb04cad12909a183a2eb15
-
SHA256
07c1abb57c4498748c4f1344a786c2c136b82651786ed005d999ecbf6054fb2c
-
SHA512
f3165aec7a4b7adb7e6ffca56812f769b7b085000d50bf235ca1c7e74d76dfb5549de9561e281623c734c2dec9fc37b54af572c3e97fcb9fb1411102ae3da0c0
-
SSDEEP
786432:5l3LNCxuEnwFho+zM77UDZiZCd08jFZJAI5E70TZFHi6t:5l3LMEXFhV0KAcNjxAItjFt
-
Cobalt Strike reflective loader
Detects the reflective loader used by Cobalt Strike.
-
Contains code to disable Windows Defender
A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.
-
Drops file in Drivers directory
-
Modifies file permissions
-
Adds Run key to start application
-
Checks for any installed AV software in registry
-
Downloads MZ/PE file
-
Event Triggered Execution: Image File Execution Options Injection
-
Writes to the Master Boot Record (MBR)
Bootkits write to the MBR to gain persistence at a level below the operating system.
-
AutoIT Executable
AutoIT scripts compiled to PE executables.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Drops file in System32 directory
-
Event Triggered Execution: Component Object Model Hijacking
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
-
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Event Triggered Execution
2Component Object Model Hijacking
1Image File Execution Options Injection
1Pre-OS Boot
1Bootkit
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Event Triggered Execution
2Component Object Model Hijacking
1Image File Execution Options Injection
1Defense Evasion
File and Directory Permissions Modification
1Impair Defenses
1Modify Registry
3Pre-OS Boot
1Bootkit
1Subvert Trust Controls
1Install Root Certificate
1Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Discovery
Browser Information Discovery
1Peripheral Device Discovery
1Query Registry
5Software Discovery
1Security Software Discovery
1System Information Discovery
4System Location Discovery
1System Language Discovery
1System Network Configuration Discovery
1Internet Connection Discovery
1