Analysis
- user interaction
yes - max time kernel
598s - max time network
600s - platform
windows11-21h2_x64 - resource
win11-20260513-fr - resource tags
arch:x64arch:x86image:win11-20260513-frlocale:fr-fros:windows11-21h2-x64systemwindows - submitted
15/08/2026, 01:01
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
cs2 cheat test1.exe
Resource
win11-20260513-fr
3 signatures
600 seconds
General
- Target cs2 cheat test1.exe
- Size 149KB
- Sample260815-bc75rscn21
- SHA256 9eb7c350af5407b73848e57eee0e470e7a80959241ef3c8cfaa149bf36b6b814
- MD5 592172b541342b0a41c9185f5ecca21e
- SHA1 45adb7b9115c9ae2125dee088f635c22a0f02297
- SHA512 df3e4445253fb97517d8727347f34c166680ca1d25ffefe16614d9ef4b863bc42c237cae737d94a7fd961f4710f70047019e2eb8af3d31a6751207219544a66e
- SSDEEP 3072:3cHp9p7ShnTXBTOwxemzgUHrzYgasIh8tA8iNgRBTzM:3cHpP7YnzBTremzgUHrzYuICPtzM
- TLSH T18BE32A2ABA19107DD262D6F8D9530C02FB7278860775AFDF13805EB60E165D4FF3AA12
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Creates a file in the Startup directory 1 TTPs 2 IoCs
A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\WindowsUpdateHelper.exe cs2 cheat test1.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\WindowsUpdateHelper.exe cs2 cheat test1.exe - Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-125073035-2952146151-721812867-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsUpdateHelper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\cs2 cheat test1.exe" cs2 cheat test1.exe - Contacts third-party web service commonly abused for C2 1 TTPs 3 IoCs
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
flow ioc 1 discord.com 12 discord.com 24 discord.com
Processes
-
C:\Users\Admin\AppData\Local\Temp\cs2 cheat test1.exe"C:\Users\Admin\AppData\Local\Temp\cs2 cheat test1.exe"1⤵
- Creates a file in the Startup directory
- Adds Run key to start application
PID:1864
-
C:\Users\Admin\AppData\Local\Temp\cs2 cheat test1.exe"C:\Users\Admin\AppData\Local\Temp\cs2 cheat test1.exe"1⤵PID:5116
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\discord_last_id.txt
- Size 1B
- SHA256 5feceb66ffc86f38d952786c6d696c79c2dbc239dd4e91b46729d73a27fb57e9
- MD5 cfcd208495d565ef66e7dff9f98764da
- SHA1 b6589fc6ab0dc82cf12099d1c2d40ab994e8410c
- SHA512 31bca02094eb78126a517b206a88c73cfa9ec6f704c7030d18212cace820f025f00bf0ea68dbf3f3a5436ca63b53bf7bf80ad8d5de7d8359d0b7fed9dbc3ab99
- MD5 SHA1 SHA512