3712e6c6fc1615bc556db8437d5bc29cfaef472e15cc990a8ad52a1cd94001f5

Analysis

user interaction
yes
max time kernel
110s
max time network
24s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
12/07/2026, 22:25

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Cheat.exe
Size 19KB
Sample260712-2b8b9abv5x
SHA256 3712e6c6fc1615bc556db8437d5bc29cfaef472e15cc990a8ad52a1cd94001f5
MD5 a146bd693c2c2dba0586a00f996c69c4
SHA1 29742e0d6f01fa19983c4e3d9df4b8f8452ad193
SHA512 90f6ad1398a8208cebc74b89192912cc9cff1279f04bd19aabb6a7a521aea279e5a153a2a18ce9d2886ddcc0c7720f9a28a4df4bab3b892b4c4c6df5b310c6da
SSDEEP 384:S+132rFqQKTqKeGIMwb2SAwcBkWmnolfu3Uu:S/ReoGly1fcnmne23U
TLSH
T176923A1B7B5204EBC17982BACB736519D3B2B9234B3166CF23A0450D0FA62D17D7BE85
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Malware Config

Signatures

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	taskmgr.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	taskmgr.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	taskmgr.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\Local Settings	taskmgr.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
8	taskmgr.exe
8	taskmgr.exe
8	taskmgr.exe
8	taskmgr.exe
8	taskmgr.exe
8	taskmgr.exe
8	taskmgr.exe
8	taskmgr.exe
8	taskmgr.exe
8	taskmgr.exe
8	taskmgr.exe
8	taskmgr.exe
8	taskmgr.exe
8	taskmgr.exe
8	taskmgr.exe
8	taskmgr.exe
8	taskmgr.exe
8	taskmgr.exe
8	taskmgr.exe
8	taskmgr.exe
8	taskmgr.exe
8	taskmgr.exe
8	taskmgr.exe
8	taskmgr.exe
8	taskmgr.exe
8	taskmgr.exe
8	taskmgr.exe
8	taskmgr.exe
8	taskmgr.exe
8	taskmgr.exe
8	taskmgr.exe
8	taskmgr.exe
8	taskmgr.exe
8	taskmgr.exe
8	taskmgr.exe
8	taskmgr.exe
8	taskmgr.exe
8	taskmgr.exe
8	taskmgr.exe
8	taskmgr.exe
8	taskmgr.exe
8	taskmgr.exe
8	taskmgr.exe
8	taskmgr.exe
8	taskmgr.exe
8	taskmgr.exe
8	taskmgr.exe
8	taskmgr.exe
8	taskmgr.exe
8	taskmgr.exe
8	taskmgr.exe
8	taskmgr.exe
8	taskmgr.exe
8	taskmgr.exe
8	taskmgr.exe
8	taskmgr.exe
8	taskmgr.exe
8	taskmgr.exe
8	taskmgr.exe
8	taskmgr.exe
8	taskmgr.exe
8	taskmgr.exe
8	taskmgr.exe
8	taskmgr.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	8	taskmgr.exe
Token: SeSystemProfilePrivilege	8	taskmgr.exe
Token: SeCreateGlobalPrivilege	8	taskmgr.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
8	taskmgr.exe
8	taskmgr.exe
8	taskmgr.exe
8	taskmgr.exe
8	taskmgr.exe
8	taskmgr.exe
8	taskmgr.exe
8	taskmgr.exe
8	taskmgr.exe
8	taskmgr.exe
8	taskmgr.exe
8	taskmgr.exe
8	taskmgr.exe
8	taskmgr.exe
8	taskmgr.exe
8	taskmgr.exe
8	taskmgr.exe
8	taskmgr.exe
8	taskmgr.exe
8	taskmgr.exe
8	taskmgr.exe
8	taskmgr.exe
8	taskmgr.exe
8	taskmgr.exe
8	taskmgr.exe
8	taskmgr.exe
8	taskmgr.exe
8	taskmgr.exe
8	taskmgr.exe
8	taskmgr.exe
8	taskmgr.exe
8	taskmgr.exe
8	taskmgr.exe
8	taskmgr.exe
8	taskmgr.exe
8	taskmgr.exe
8	taskmgr.exe
8	taskmgr.exe
8	taskmgr.exe
8	taskmgr.exe
8	taskmgr.exe
8	taskmgr.exe
8	taskmgr.exe
8	taskmgr.exe
8	taskmgr.exe
8	taskmgr.exe
8	taskmgr.exe
8	taskmgr.exe
8	taskmgr.exe
8	taskmgr.exe
8	taskmgr.exe
8	taskmgr.exe
8	taskmgr.exe
8	taskmgr.exe
8	taskmgr.exe
8	taskmgr.exe
8	taskmgr.exe
8	taskmgr.exe
8	taskmgr.exe
8	taskmgr.exe
8	taskmgr.exe
8	taskmgr.exe
8	taskmgr.exe
8	taskmgr.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
8	taskmgr.exe
8	taskmgr.exe
8	taskmgr.exe
8	taskmgr.exe
8	taskmgr.exe
8	taskmgr.exe
8	taskmgr.exe
8	taskmgr.exe
8	taskmgr.exe
8	taskmgr.exe
8	taskmgr.exe
8	taskmgr.exe
8	taskmgr.exe
8	taskmgr.exe
8	taskmgr.exe
8	taskmgr.exe
8	taskmgr.exe
8	taskmgr.exe
8	taskmgr.exe
8	taskmgr.exe
8	taskmgr.exe
8	taskmgr.exe
8	taskmgr.exe
8	taskmgr.exe
8	taskmgr.exe
8	taskmgr.exe
8	taskmgr.exe
8	taskmgr.exe
8	taskmgr.exe
8	taskmgr.exe
8	taskmgr.exe
8	taskmgr.exe
8	taskmgr.exe
8	taskmgr.exe
8	taskmgr.exe
8	taskmgr.exe
8	taskmgr.exe
8	taskmgr.exe
8	taskmgr.exe
8	taskmgr.exe
8	taskmgr.exe
8	taskmgr.exe
8	taskmgr.exe
8	taskmgr.exe
8	taskmgr.exe
8	taskmgr.exe
8	taskmgr.exe
8	taskmgr.exe
8	taskmgr.exe
8	taskmgr.exe
8	taskmgr.exe
8	taskmgr.exe
8	taskmgr.exe
8	taskmgr.exe
8	taskmgr.exe
8	taskmgr.exe
8	taskmgr.exe
8	taskmgr.exe
8	taskmgr.exe
8	taskmgr.exe
8	taskmgr.exe
8	taskmgr.exe
8	taskmgr.exe
8	taskmgr.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
8	taskmgr.exe
8	taskmgr.exe

Suspicious use of WriteProcessMemory 49 IoCs

description	pid	Process	procid_target
PID 404 wrote to memory of 4900	404	Cheat.exe	89
PID 404 wrote to memory of 4332	404	Cheat.exe	90
PID 404 wrote to memory of 4100	404	Cheat.exe	91
PID 404 wrote to memory of 1388	404	Cheat.exe	92
PID 404 wrote to memory of 5044	404	Cheat.exe	93
PID 404 wrote to memory of 3412	404	Cheat.exe	94
PID 404 wrote to memory of 1104	404	Cheat.exe	95
PID 404 wrote to memory of 4872	404	Cheat.exe	96
PID 404 wrote to memory of 4808	404	Cheat.exe	97
PID 404 wrote to memory of 5852	404	Cheat.exe	99
PID 404 wrote to memory of 2256	404	Cheat.exe	100
PID 404 wrote to memory of 4916	404	Cheat.exe	101
PID 404 wrote to memory of 5068	404	Cheat.exe	102
PID 404 wrote to memory of 4336	404	Cheat.exe	103
PID 404 wrote to memory of 5704	404	Cheat.exe	104
PID 404 wrote to memory of 4720	404	Cheat.exe	105
PID 404 wrote to memory of 1512	404	Cheat.exe	106
PID 404 wrote to memory of 1648	404	Cheat.exe	107
PID 404 wrote to memory of 2448	404	Cheat.exe	108
PID 404 wrote to memory of 3476	404	Cheat.exe	109
PID 404 wrote to memory of 4612	404	Cheat.exe	110
PID 404 wrote to memory of 4216	404	Cheat.exe	111
PID 404 wrote to memory of 2948	404	Cheat.exe	112
PID 404 wrote to memory of 3176	404	Cheat.exe	113
PID 404 wrote to memory of 3512	404	Cheat.exe	114
PID 404 wrote to memory of 4520	404	Cheat.exe	115
PID 404 wrote to memory of 1796	404	Cheat.exe	116
PID 404 wrote to memory of 4576	404	Cheat.exe	117
PID 404 wrote to memory of 3576	404	Cheat.exe	118
PID 404 wrote to memory of 4616	404	Cheat.exe	119
PID 404 wrote to memory of 3888	404	Cheat.exe	120
PID 404 wrote to memory of 4492	404	Cheat.exe	121
PID 404 wrote to memory of 4628	404	Cheat.exe	122
PID 404 wrote to memory of 3948	404	Cheat.exe	123
PID 404 wrote to memory of 3848	404	Cheat.exe	124
PID 404 wrote to memory of 2676	404	Cheat.exe	125
PID 404 wrote to memory of 5224	404	Cheat.exe	126
PID 404 wrote to memory of 2988	404	Cheat.exe	127
PID 404 wrote to memory of 4904	404	Cheat.exe	128
PID 404 wrote to memory of 5808	404	Cheat.exe	129
PID 404 wrote to memory of 3620	404	Cheat.exe	130
PID 404 wrote to memory of 460	404	Cheat.exe	131
PID 404 wrote to memory of 1436	404	Cheat.exe	132
PID 404 wrote to memory of 5032	404	Cheat.exe	133
PID 404 wrote to memory of 3940	404	Cheat.exe	134
PID 404 wrote to memory of 1644	404	Cheat.exe	135
PID 404 wrote to memory of 6084	404	Cheat.exe	136
PID 404 wrote to memory of 5324	404	Cheat.exe	137
PID 404 wrote to memory of 4816	404	Cheat.exe	138

C:\Users\Admin\AppData\Local\Temp\Cheat.exe
"C:\Users\Admin\AppData\Local\Temp\Cheat.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:404
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:4900
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:4332
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:4100
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:1388
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:5044
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:3412
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:1104
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:4872
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:4808
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:5852
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:2256
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:4916
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:5068
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:4336
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:5704
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:4720
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:1512
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:1648
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:2448
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:3476
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:4612
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:4216
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:2948
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:3176
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:3512
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:4520
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:1796
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:4576
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:3576
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:4616
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:3888
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:4492
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:4628
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:3948
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:3848
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:2676
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:5224
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:2988
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:4904
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:5808
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:3620
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:460
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:1436
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:5032
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:3940
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:1644
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:6084
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:5324
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:4816

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /0
1⤵
- Checks SCSI registry key(s)
- Checks processor information in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:8

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:1200

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:5660

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/8-2-0x0000014793380000-0x0000014793381000-memory.dmp

Download

memory/8-0-0x0000014793380000-0x0000014793381000-memory.dmp

Download

memory/8-9-0x0000014793380000-0x0000014793381000-memory.dmp

Download

memory/8-11-0x0000014793380000-0x0000014793381000-memory.dmp

Download

memory/8-10-0x0000014793380000-0x0000014793381000-memory.dmp

Download

memory/8-7-0x0000014793380000-0x0000014793381000-memory.dmp

Download

memory/8-8-0x0000014793380000-0x0000014793381000-memory.dmp

Download

memory/8-6-0x0000014793380000-0x0000014793381000-memory.dmp

Download