Overview
overview
7Static
static
3Cheat_Menu.rar
windows10-2004-x64
7Cheat_Menu.rar
windows11-ltsc_2024-x64
1Cheat_Menu...er.exe
windows10-2004-x64
1Cheat_Menu...er.exe
windows11-ltsc_2024-x64
1Cheat_Menu...ins.sh
ubuntu-18.04-amd64
3Cheat_Menu...ins.sh
debian-9-armhf
3Cheat_Menu...ins.sh
debian-9-mips
Cheat_Menu...ins.sh
debian-9-mipsel
Cheat_Menu...ch.txt
windows10-2004-x64
1Cheat_Menu...ch.txt
windows11-ltsc_2024-x64
1Cheat_Menu...nu.css
windows10-2004-x64
7Cheat_Menu...nu.css
windows11-ltsc_2024-x64
3Cheat_Menu...enu.js
windows10-2004-x64
3Cheat_Menu...enu.js
windows11-ltsc_2024-x64
3Analysis
- user interaction
yes - max time kernel
149s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
02/08/2026, 17:24
Static task
static1
Behavioral task
behavioral1
Sample
Cheat_Menu.rar
Resource
win10v2004-20260513-en
Behavioral task
behavioral2
Sample
Cheat_Menu.rar
Resource
win11ltsc2024-20260709-en
Behavioral task
behavioral3
Sample
Cheat_Menu/MVPluginPatcher.exe
Resource
win10v2004-20260513-en
Behavioral task
behavioral4
Sample
Cheat_Menu/MVPluginPatcher.exe
Resource
win11ltsc2024-20260709-en
Behavioral task
behavioral5
Sample
Cheat_Menu/patchPlugins.sh
Resource
ubuntu1804-amd64-20260513-en
Behavioral task
behavioral6
Sample
Cheat_Menu/patchPlugins.sh
Resource
debian9-armhf-20260513-en
Behavioral task
behavioral7
Sample
Cheat_Menu/patchPlugins.sh
Resource
debian9-mipsbe-20260513-en
Behavioral task
behavioral8
Sample
Cheat_Menu/patchPlugins.sh
Resource
debian9-mipsel-20260513-en
Behavioral task
behavioral9
Sample
Cheat_Menu/plugins_patch.txt
Resource
win10v2004-20260513-en
Behavioral task
behavioral10
Sample
Cheat_Menu/plugins_patch.txt
Resource
win11ltsc2024-20260709-en
Behavioral task
behavioral11
Sample
Cheat_Menu/www/js/plugins/Cheat_Menu.css
Resource
win10v2004-20260513-en
Behavioral task
behavioral12
Sample
Cheat_Menu/www/js/plugins/Cheat_Menu.css
Resource
win11ltsc2024-20260709-en
Behavioral task
behavioral13
Sample
Cheat_Menu/www/js/plugins/Cheat_Menu.js
Resource
win10v2004-20260513-en
Behavioral task
behavioral14
Sample
Cheat_Menu/www/js/plugins/Cheat_Menu.js
Resource
win11ltsc2024-20260709-en
General
- Target Cheat_Menu.rar
- Size 25KB
- Sample260802-vyv7wadc55
- SHA256 0104a07d08fb95b0a9c5713aad5f3bc10e14da0aa63f50a3513bb6338456bbb9
- MD5 ff54cc0e373ed7be019ef080fae1e687
- SHA1 a82ca97486ff2d2270a1cc08f8950f753b578943
- SHA512 0bb9cc11da09c8e030ba3080073e2ccd94d90e635eecca3759e871d30e63fbb3d098dbbf111489f2987e8a44fa562851eea920cd58fcdc1f479b77bd822fc4bc
- SSDEEP 768:/+3F5jvM0YchSGdVfswEWGar3CeZVXmz1O:/+3HjvFhSQdsbarCa1a1O
- TLSH T14FC2E1F6406D3D7B4F775B4E078FC0B4718518A64E70ADB94BE50BAD6C016970AC458E
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Executes dropped EXE 5 IoCs
pid Process 672 MVPluginPatcher.exe 2612 MVPluginPatcher.exe 824 MVPluginPatcher.exe 1340 MVPluginPatcher.exe 4104 MVPluginPatcher.exe - Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeRestorePrivilege 4720 7zFM.exe Token: 35 4720 7zFM.exe Token: SeSecurityPrivilege 4720 7zFM.exe - Suspicious use of FindShellTrayWindow 3 IoCs
pid Process 4720 7zFM.exe 4720 7zFM.exe 4720 7zFM.exe
Processes
-
C:\Program Files\7-Zip\7zFM.exe"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\Cheat_Menu.rar"1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:4720
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵PID:4696
-
C:\Users\Admin\Desktop\Cheat_Menu\MVPluginPatcher.exe"C:\Users\Admin\Desktop\Cheat_Menu\MVPluginPatcher.exe"1⤵
- Executes dropped EXE
PID:672
-
C:\Users\Admin\Desktop\Cheat_Menu\MVPluginPatcher.exe"C:\Users\Admin\Desktop\Cheat_Menu\MVPluginPatcher.exe"1⤵
- Executes dropped EXE
PID:2612
-
C:\Users\Admin\Desktop\Cheat_Menu\MVPluginPatcher.exe"C:\Users\Admin\Desktop\Cheat_Menu\MVPluginPatcher.exe"1⤵
- Executes dropped EXE
PID:824
-
C:\Users\Admin\Desktop\Cheat_Menu\MVPluginPatcher.exe"C:\Users\Admin\Desktop\Cheat_Menu\MVPluginPatcher.exe"1⤵
- Executes dropped EXE
PID:1340
-
C:\Users\Admin\Desktop\Cheat_Menu\MVPluginPatcher.exe"C:\Users\Admin\Desktop\Cheat_Menu\MVPluginPatcher.exe"1⤵
- Executes dropped EXE
PID:4104
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\Desktop\Cheat_Menu\MVPluginPatcher.exe
- Size 37KB
- SHA256 89edcd5d47333c299c086a5278ed3db20f7b6e471e849f92102b1ef6e42eecf4
- MD5 e0cefcd0d34a5e59413344104d5d57a4
- SHA1 a7066bf504192e29c8e66ba648dac72fcb36ff23
- SHA512 b1e815417095fda58ccd8fc639fcce13db58f39b9e59c531a2672a1e1342e5321aa4a9ca5e1857ccbd5c38abf12e7f4d06ab9a017093eacbaac56379c2db7a87
- SSDEEP 768:k5xPI/BAnJBbX9+WM3dBCoa/IPPazJD7IY3w4:w+BAnJxN0YAuO4
- TLSH T1A203289B335A00E8D6A2D2B8A6879656C376BC01439163CF53E1C35A1F633E4797BB11
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\Desktop\Cheat_Menu\plugins_patch.txt
- Size 68B
- SHA256 1f2d20474fb494af1e0c9fe2c9676c22a72e3625820d4e00a345886bf5b0f71d
- MD5 5944db6786edb083d63196323182fb8c
- SHA1 9ad741a7def3bb9a90f26f4be61929ad4fe65d25
- SHA512 dc5bab03cf91301ceb5c78c4f37d10d117081cd31b836ee733c88d6f7ffc5d679e6557b85d42ed69261d855b34707284608630504b85426b733706ace214b213
- TLSH T159A002450B00D77584A52E102A7CAB18B9F90757344D4C816EDD2E9C14566F6D996106
- MD5 SHA1 SHA512 TLSH