Analysis
- max time kernel
150s - max time network
103s - platform
windows11-21h2_x64 - resource
win11-20250619-en - resource tags
arch:x64arch:x86image:win11-20250619-enlocale:en-usos:windows11-21h2-x64system - submitted
19/08/2025, 11:05
Behavioral task
behavioral1
Sample
cheat.exe
Resource
win10v2004-20250610-en
windows10-2004-x64
12 signatures
150 seconds
Behavioral task
behavioral2
Sample
cheat.exe
Resource
win11-20250619-en
windows11-21h2-x64
11 signatures
150 seconds
General
- Target cheat.exe
- Size 93KB
- Sample250819-m7acrsszat
- SHA256 0142c994af88662c8ad2dfcb4ad352dd44693c48a097239ec5ccdf4f87138cef
- MD5 c59c872d801011e60b20e11c5ea5c895
- SHA1 60528318a4ca5d3fad75932da36094372eb76327
- SHA512 d72615a8568ceae7bc86d469b364387ccb0dd555285c9ec7a49d46dad449b4a93255cffec4bce5b76476833c7ebc16ee2bfbaf65446bbfa8ee34c688b8e6318f
- SSDEEP 768:qY3HCpD9O/pBcxYsbae6GIXb9pDX2b98PL0OXLeuXxrjEtCdnl2pi1Rz4Rk3YsGz:JCLOx6baIa9RPj00ljEwzGi1dDwDPgS
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Signatures
- Disables Task Manager via registry modification
- Modifies Windows Firewall 2 TTPs 1 IoCs
pid Process 3784 netsh.exe - Drops startup file 4 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe server.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe server.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\9f0274cedabd2d4879d1e4696b84a35eWindows Update.exe server.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\9f0274cedabd2d4879d1e4696b84a35eWindows Update.exe server.exe - Executes dropped EXE 1 IoCs
pid Process 5432 server.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs
Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.
description ioc Process Key value enumerated \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe - System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cheat.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language server.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language netsh.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 5432 server.exe 5432 server.exe 5432 server.exe 5432 server.exe 5432 server.exe 5432 server.exe 5432 server.exe 5432 server.exe 5432 server.exe 5432 server.exe 5432 server.exe 5432 server.exe 5432 server.exe 5432 server.exe 5432 server.exe 5432 server.exe 5432 server.exe 5432 server.exe 5432 server.exe 5432 server.exe 5432 server.exe 5432 server.exe 5432 server.exe 5432 server.exe 5432 server.exe 5432 server.exe 5432 server.exe 5432 server.exe 5432 server.exe 5432 server.exe 5432 server.exe 5432 server.exe 5432 server.exe 5432 server.exe 5432 server.exe 5432 server.exe 5432 server.exe 5432 server.exe 5432 server.exe 5432 server.exe 5432 server.exe 5432 server.exe 5432 server.exe 5432 server.exe 5432 server.exe 5432 server.exe 5432 server.exe 5432 server.exe 5432 server.exe 5432 server.exe 5432 server.exe 5432 server.exe 5432 server.exe 5432 server.exe 5432 server.exe 5432 server.exe 5432 server.exe 5432 server.exe 5432 server.exe 5432 server.exe 5432 server.exe 5432 server.exe 5432 server.exe 5432 server.exe - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 5432 server.exe - Suspicious use of AdjustPrivilegeToken 35 IoCs
description pid Process Token: SeDebugPrivilege 5432 server.exe Token: 33 5432 server.exe Token: SeIncBasePriorityPrivilege 5432 server.exe Token: 33 5432 server.exe Token: SeIncBasePriorityPrivilege 5432 server.exe Token: 33 5432 server.exe Token: SeIncBasePriorityPrivilege 5432 server.exe Token: 33 5432 server.exe Token: SeIncBasePriorityPrivilege 5432 server.exe Token: 33 5432 server.exe Token: SeIncBasePriorityPrivilege 5432 server.exe Token: 33 5432 server.exe Token: SeIncBasePriorityPrivilege 5432 server.exe Token: 33 5432 server.exe Token: SeIncBasePriorityPrivilege 5432 server.exe Token: 33 5432 server.exe Token: SeIncBasePriorityPrivilege 5432 server.exe Token: 33 5432 server.exe Token: SeIncBasePriorityPrivilege 5432 server.exe Token: 33 5432 server.exe Token: SeIncBasePriorityPrivilege 5432 server.exe Token: 33 5432 server.exe Token: SeIncBasePriorityPrivilege 5432 server.exe Token: 33 5432 server.exe Token: SeIncBasePriorityPrivilege 5432 server.exe Token: 33 5432 server.exe Token: SeIncBasePriorityPrivilege 5432 server.exe Token: 33 5432 server.exe Token: SeIncBasePriorityPrivilege 5432 server.exe Token: 33 5432 server.exe Token: SeIncBasePriorityPrivilege 5432 server.exe Token: 33 5432 server.exe Token: SeIncBasePriorityPrivilege 5432 server.exe Token: 33 5432 server.exe Token: SeIncBasePriorityPrivilege 5432 server.exe - Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 5768 wrote to memory of 5432 5768 cheat.exe 78 PID 5768 wrote to memory of 5432 5768 cheat.exe 78 PID 5768 wrote to memory of 5432 5768 cheat.exe 78 PID 5432 wrote to memory of 3784 5432 server.exe 79 PID 5432 wrote to memory of 3784 5432 server.exe 79 PID 5432 wrote to memory of 3784 5432 server.exe 79
Processes
-
C:\Users\Admin\AppData\Local\Temp\cheat.exe"C:\Users\Admin\AppData\Local\Temp\cheat.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5768 -
C:\Users\Admin\AppData\Local\Temp\server.exe"C:\Users\Admin\AppData\Local\Temp\server.exe"2⤵
- Drops startup file
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5432 -
C:\Windows\SysWOW64\netsh.exenetsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\server.exe" "server.exe" ENABLE3⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
- System Location Discovery: System Language Discovery
PID:3784
-
-
Network
MITRE ATT&CK Enterprise v16
Persistence
Create or Modify System Process
1Windows Service
1Event Triggered Execution
1Netsh Helper DLL
1Privilege Escalation
Create or Modify System Process
1Windows Service
1Event Triggered Execution
1Netsh Helper DLL
1Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\server.exe
- Size 93KB
- SHA256 0142c994af88662c8ad2dfcb4ad352dd44693c48a097239ec5ccdf4f87138cef
- MD5 c59c872d801011e60b20e11c5ea5c895
- SHA1 60528318a4ca5d3fad75932da36094372eb76327
- SHA512 d72615a8568ceae7bc86d469b364387ccb0dd555285c9ec7a49d46dad449b4a93255cffec4bce5b76476833c7ebc16ee2bfbaf65446bbfa8ee34c688b8e6318f
- SSDEEP 768:qY3HCpD9O/pBcxYsbae6GIXb9pDX2b98PL0OXLeuXxrjEtCdnl2pi1Rz4Rk3YsGz:JCLOx6baIa9RPj00ljEwzGi1dDwDPgS
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\app
- Size 5B
- SHA256 d53ce6bdbd0c3cb4596ac3103f15824570a9858da95f63cedf64cec11dc44e2d
- MD5 2099bb64fd1770d321df364f99b658d1
- SHA1 3124edeaa14c060becfa8b980ed77db15d56a9e3
- SHA512 3481f2a02f7b1255ad0f3cd8a716de9c7414753b6f8657f0bf99738ff6623f8717469bc10e737d6c0d1d13846e726d50baeb5e8ef73efcfce7be5c63327c4895
- MD5 SHA1 SHA512