Analysis
-
max time kernel
143s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system -
submitted
24-10-2024 14:18
Behavioral task
behavioral1
Sample
Speed Cheats.exe
Resource
win7-20241010-en
windows7-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
Speed Cheats.exe
Resource
win10v2004-20241007-en
exelastealercollectiondefense_evasiondiscoveryevasionpersistenceprivilege_escalationpyinstallerspywarestealerupx
windows10-2004-x64
30 signatures
150 seconds
General
-
Target
Speed Cheats.exe
-
Size
10.8MB
-
MD5
616983ce8ef9198ae5d7e1376c3f4ec3
-
SHA1
9d8d1b6184f6fe522cf260e9f39f3e699d7056f8
-
SHA256
70e76d2265832e0d481afb02c2be15d96670bccfcf9efd5c612edd327b0b99e0
-
SHA512
eb19d4f91f1eeb9a2fc52ca597b3e901a3fa77cab0d885d0bce33fc322c4850353164f9d7ca240c6a7cf3abd38b5d9aff6fa848eb15858fd637401d8746524f8
-
SSDEEP
196608:wdDXBAY3Jb3tQk5tOeNvX+wfm/pf+xfdkRbYIWKRrIWOzW0DaqkH:8OY37v5tRvX+9/pWFGR0IBRrIWeRaDH
Score
7/10
Malware Config
Signatures
-
Loads dropped DLL 1 IoCs
pid Process 2876 Speed Cheats.exe -
resource yara_rule behavioral1/files/0x000500000001a4ad-45.dat upx -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1804 taskmgr.exe 1804 taskmgr.exe 1804 taskmgr.exe 1804 taskmgr.exe 1804 taskmgr.exe 1804 taskmgr.exe 1804 taskmgr.exe 1804 taskmgr.exe 1804 taskmgr.exe 1804 taskmgr.exe 1804 taskmgr.exe 1804 taskmgr.exe 1804 taskmgr.exe 1804 taskmgr.exe 1804 taskmgr.exe 1804 taskmgr.exe 1804 taskmgr.exe 1804 taskmgr.exe 1804 taskmgr.exe 1804 taskmgr.exe 1804 taskmgr.exe 1804 taskmgr.exe 1804 taskmgr.exe 1804 taskmgr.exe 1804 taskmgr.exe 1804 taskmgr.exe 1804 taskmgr.exe 1804 taskmgr.exe 1804 taskmgr.exe 1804 taskmgr.exe 1804 taskmgr.exe 1804 taskmgr.exe 1804 taskmgr.exe 1804 taskmgr.exe 1804 taskmgr.exe 1804 taskmgr.exe 1804 taskmgr.exe 1804 taskmgr.exe 1804 taskmgr.exe 1804 taskmgr.exe 1804 taskmgr.exe 1804 taskmgr.exe 1804 taskmgr.exe 1804 taskmgr.exe 1804 taskmgr.exe 1804 taskmgr.exe 1804 taskmgr.exe 1804 taskmgr.exe 1804 taskmgr.exe 1804 taskmgr.exe 1804 taskmgr.exe 1804 taskmgr.exe 1804 taskmgr.exe 1804 taskmgr.exe 1804 taskmgr.exe 1804 taskmgr.exe 1804 taskmgr.exe 1804 taskmgr.exe 1804 taskmgr.exe 1804 taskmgr.exe 1804 taskmgr.exe 1804 taskmgr.exe 1804 taskmgr.exe 1804 taskmgr.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 1804 taskmgr.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 1804 taskmgr.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 1804 taskmgr.exe 1804 taskmgr.exe 1804 taskmgr.exe 1804 taskmgr.exe 1804 taskmgr.exe 1804 taskmgr.exe 1804 taskmgr.exe 1804 taskmgr.exe 1804 taskmgr.exe 1804 taskmgr.exe 1804 taskmgr.exe 1804 taskmgr.exe 1804 taskmgr.exe 1804 taskmgr.exe 1804 taskmgr.exe 1804 taskmgr.exe 1804 taskmgr.exe 1804 taskmgr.exe 1804 taskmgr.exe 1804 taskmgr.exe 1804 taskmgr.exe 1804 taskmgr.exe 1804 taskmgr.exe 1804 taskmgr.exe 1804 taskmgr.exe 1804 taskmgr.exe 1804 taskmgr.exe 1804 taskmgr.exe 1804 taskmgr.exe 1804 taskmgr.exe 1804 taskmgr.exe 1804 taskmgr.exe 1804 taskmgr.exe 1804 taskmgr.exe 1804 taskmgr.exe 1804 taskmgr.exe 1804 taskmgr.exe 1804 taskmgr.exe 1804 taskmgr.exe 1804 taskmgr.exe 1804 taskmgr.exe 1804 taskmgr.exe 1804 taskmgr.exe 1804 taskmgr.exe 1804 taskmgr.exe 1804 taskmgr.exe 1804 taskmgr.exe 1804 taskmgr.exe 1804 taskmgr.exe 1804 taskmgr.exe 1804 taskmgr.exe 1804 taskmgr.exe 1804 taskmgr.exe 1804 taskmgr.exe 1804 taskmgr.exe 1804 taskmgr.exe 1804 taskmgr.exe 1804 taskmgr.exe 1804 taskmgr.exe 1804 taskmgr.exe 1804 taskmgr.exe 1804 taskmgr.exe 1804 taskmgr.exe 1804 taskmgr.exe -
Suspicious use of SendNotifyMessage 64 IoCs
pid Process 1804 taskmgr.exe 1804 taskmgr.exe 1804 taskmgr.exe 1804 taskmgr.exe 1804 taskmgr.exe 1804 taskmgr.exe 1804 taskmgr.exe 1804 taskmgr.exe 1804 taskmgr.exe 1804 taskmgr.exe 1804 taskmgr.exe 1804 taskmgr.exe 1804 taskmgr.exe 1804 taskmgr.exe 1804 taskmgr.exe 1804 taskmgr.exe 1804 taskmgr.exe 1804 taskmgr.exe 1804 taskmgr.exe 1804 taskmgr.exe 1804 taskmgr.exe 1804 taskmgr.exe 1804 taskmgr.exe 1804 taskmgr.exe 1804 taskmgr.exe 1804 taskmgr.exe 1804 taskmgr.exe 1804 taskmgr.exe 1804 taskmgr.exe 1804 taskmgr.exe 1804 taskmgr.exe 1804 taskmgr.exe 1804 taskmgr.exe 1804 taskmgr.exe 1804 taskmgr.exe 1804 taskmgr.exe 1804 taskmgr.exe 1804 taskmgr.exe 1804 taskmgr.exe 1804 taskmgr.exe 1804 taskmgr.exe 1804 taskmgr.exe 1804 taskmgr.exe 1804 taskmgr.exe 1804 taskmgr.exe 1804 taskmgr.exe 1804 taskmgr.exe 1804 taskmgr.exe 1804 taskmgr.exe 1804 taskmgr.exe 1804 taskmgr.exe 1804 taskmgr.exe 1804 taskmgr.exe 1804 taskmgr.exe 1804 taskmgr.exe 1804 taskmgr.exe 1804 taskmgr.exe 1804 taskmgr.exe 1804 taskmgr.exe 1804 taskmgr.exe 1804 taskmgr.exe 1804 taskmgr.exe 1804 taskmgr.exe 1804 taskmgr.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 1700 wrote to memory of 2876 1700 Speed Cheats.exe 28 PID 1700 wrote to memory of 2876 1700 Speed Cheats.exe 28 PID 1700 wrote to memory of 2876 1700 Speed Cheats.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\Speed Cheats.exe"C:\Users\Admin\AppData\Local\Temp\Speed Cheats.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1700 -
C:\Users\Admin\AppData\Local\Temp\Speed Cheats.exe"C:\Users\Admin\AppData\Local\Temp\Speed Cheats.exe"2⤵
- Loads dropped DLL
PID:2876
-
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1804
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.6MB
MD5db09c9bbec6134db1766d369c339a0a1
SHA1c156d9f2d0e80b4cf41794cd9b8b1e8a352e0a0b
SHA256b1aac1e461174bbae952434e4dac092590d72b9832a04457c94bd9bb7ee8ad79
SHA512653a7fff6a2b6bffb9ea2c0b72ddb83c9c53d555e798eea47101b0d932358180a01af2b9dab9c27723057439c1eaffb8d84b9b41f6f9cd1c3c934f1794104d45