2575b49e96cf0027ea9469a23aa8ab722365f5fd614fa88c3d3ec2766a789f38 | Triage

Resubmissions

14/10/2024, 08:01

241014-jw3ndssckf 8

14/03/2024, 00:52

240314-a8eyesgh33 10

Sharing

General

Target

cheatchecker.exe
Size

7.8MB
Sample

241014-jw3ndssckf
MD5

64925f73451b96d282f4a3a6bd8d265a
SHA1

3ec096d5f78b5d62b6d02b41697ff36ad1076cce
SHA256

2575b49e96cf0027ea9469a23aa8ab722365f5fd614fa88c3d3ec2766a789f38
SHA512

4de9dbe9f3dc7fbac5c3af20c2caae571a73cdf5026d7e1eb1b1bb5ce97db8f1df033be07966351fdfdd4e16265970dfa85cda54a05a046066f3ded177fbe16c
SSDEEP

196608:7DA39sA6Lvn3QtRuQJShuxpVPoOGs2UqT9ZbWr39GSPV9p9N:PANsAG3QtRuf09oK2VVrMp

Score

8^/10

discovery execution

Malware Config

Targets

- Target
  
  cheatchecker.exe
- Size
  
  7.8MB
- MD5
  
  64925f73451b96d282f4a3a6bd8d265a
- SHA1
  
  3ec096d5f78b5d62b6d02b41697ff36ad1076cce
- SHA256
  
  2575b49e96cf0027ea9469a23aa8ab722365f5fd614fa88c3d3ec2766a789f38
- SHA512
  
  4de9dbe9f3dc7fbac5c3af20c2caae571a73cdf5026d7e1eb1b1bb5ce97db8f1df033be07966351fdfdd4e16265970dfa85cda54a05a046066f3ded177fbe16c
- SSDEEP
  
  196608:7DA39sA6Lvn3QtRuQJShuxpVPoOGs2UqT9ZbWr39GSPV9p9N:PANsAG3QtRuf09oK2VVrMp
Score

8^/10

discovery execution
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Command and Scripting Interpreter: PowerShell
  Run Powershell and hide display window.
  execution
- Legitimate hosting services abused for malware hosting/C2
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

PowerShell

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Web Service

Exfiltration

Impact

Tasks

static1

behavioral1

discoveryexecution

behavioral2

discoveryexecution