Resubmissions
07/11/2026, 15:04
261107-sf1njayw7p07/11/2026, 15:03
261107-sfgknafc2407/11/2026, 15:00
261107-sdnwysy1cs10Analysis
- user interaction
yes - max time kernel
54s - max time network
58s - platform
windows10-ltsc_2021_x64 - resource
win10ltsc2021-20260911-en - resource tags
arch:x64arch:x86image:win10ltsc2021-20260911-enlocale:en-usos:windows10-ltsc_2021-x64systemwindows - submitted
07/11/2026, 15:00
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
cheat.exe
Resource
win10ltsc2021-20260911-en
windows10-ltsc_2021-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
cheat.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
10 signatures
150 seconds
Errors
Reason
Machine shutdown
General
- Target cheat.exe
- Size 479KB
- Sample261107-sdnwysy1cs
- SHA256 803f0b646b2429bf6b0ea251874614238c5e01c309bf0b2508cfc324f9654bd4
- MD5 63243a853032bc831428040363db13a9
- SHA1 52d52dabc6ed71907c48ba6953cb98ca53215909
- SHA512 32344d4a22145a78b734eef66f1fdff624f7f7ea2ed59187e12163d68c201f7c8d2a44fc8e74b03728ee3a91853deb5756850aa7c129c057807dcda9eaa0b4ef
- SSDEEP 12288:8MSU4joci8M6PW1GVFeFd60DFUyhevYMun:bSUCpM2W1Gvgmyevv
- TLSH T1DEA48E23F690C473D16336B9DC1B96A4A8257E505D24644B3AF83E4C5F7A383B82629F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Malware Config
Signatures
- Modifies WinLogon for persistence 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3718455638-2296795630-1576855121-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "C:\\Users\\Admin\\AppData\\Local\\Temp\\cheat.exe" cheat.exe - Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3718455638-2296795630-1576855121-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\userini = "C:\\Users\\Admin\\AppData\\Local\\Temp\\cheat.exe" cheat.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cheat.exe - Modifies data under HKEY_USERS 15 IoCs
description ioc Process Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentColorMenu = "4292311040" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\EnableWindowColorization = "17" LogonUI.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History\AutoColor = "0" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\AccentColor = "4292311040" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColorBalance = "89" LogonUI.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentPalette = a6d8ff0076b9ed00429ce3000078d700005a9e000042750000264200f7630c00 LogonUI.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglow = "3288365271" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationBlurBalance = "1" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationGlassAttribute = "1" LogonUI.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\StartColorMenu = "4288567808" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColor = "3288365271" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglowBalance = "10" LogonUI.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 5036 cheat.exe 5036 cheat.exe 5036 cheat.exe 5036 cheat.exe 5036 cheat.exe 5036 cheat.exe 5036 cheat.exe 5036 cheat.exe 5036 cheat.exe 5036 cheat.exe 5036 cheat.exe 5036 cheat.exe 5036 cheat.exe 5036 cheat.exe 5036 cheat.exe 5036 cheat.exe 5036 cheat.exe 5036 cheat.exe 5036 cheat.exe 5036 cheat.exe 5036 cheat.exe 5036 cheat.exe 5036 cheat.exe 5036 cheat.exe 5036 cheat.exe 5036 cheat.exe 5036 cheat.exe 5036 cheat.exe 5036 cheat.exe 5036 cheat.exe 5036 cheat.exe 5036 cheat.exe 5036 cheat.exe 5036 cheat.exe 5036 cheat.exe 5036 cheat.exe 5036 cheat.exe 5036 cheat.exe 5036 cheat.exe 5036 cheat.exe 5036 cheat.exe 5036 cheat.exe 5036 cheat.exe 5036 cheat.exe 5036 cheat.exe 5036 cheat.exe 5036 cheat.exe 5036 cheat.exe 5036 cheat.exe 5036 cheat.exe 5036 cheat.exe 5036 cheat.exe 5036 cheat.exe 5036 cheat.exe 5036 cheat.exe 5036 cheat.exe 5036 cheat.exe 5036 cheat.exe 5036 cheat.exe 5036 cheat.exe 5036 cheat.exe 5036 cheat.exe 5036 cheat.exe 5036 cheat.exe - Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeShutdownPrivilege 5036 cheat.exe - Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 5036 cheat.exe 5036 cheat.exe 5036 cheat.exe 5036 cheat.exe 5036 cheat.exe 5036 cheat.exe 5036 cheat.exe 5036 cheat.exe 5036 cheat.exe 5036 cheat.exe 5036 cheat.exe 5036 cheat.exe 5036 cheat.exe 5036 cheat.exe 5036 cheat.exe 5036 cheat.exe 5036 cheat.exe 5036 cheat.exe 5036 cheat.exe 5036 cheat.exe 5036 cheat.exe 5036 cheat.exe 5036 cheat.exe 5036 cheat.exe 5036 cheat.exe 5036 cheat.exe 5036 cheat.exe 5036 cheat.exe 5036 cheat.exe 5036 cheat.exe 5036 cheat.exe 5036 cheat.exe 5036 cheat.exe 5036 cheat.exe 5036 cheat.exe 5036 cheat.exe 5036 cheat.exe 5036 cheat.exe 5036 cheat.exe 5036 cheat.exe 5036 cheat.exe 5036 cheat.exe 5036 cheat.exe 5036 cheat.exe 5036 cheat.exe 5036 cheat.exe 5036 cheat.exe 5036 cheat.exe 5036 cheat.exe 5036 cheat.exe 5036 cheat.exe 5036 cheat.exe 5036 cheat.exe 5036 cheat.exe 5036 cheat.exe 5036 cheat.exe 5036 cheat.exe 5036 cheat.exe 5036 cheat.exe 5036 cheat.exe 5036 cheat.exe 5036 cheat.exe 5036 cheat.exe 5036 cheat.exe - Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 2200 LogonUI.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\cheat.exe"C:\Users\Admin\AppData\Local\Temp\cheat.exe"1⤵
- Modifies WinLogon for persistence
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:5036
-
C:\Windows\explorer.exeexplorer.exe1⤵PID:2692
-
C:\Windows\system32\LogonUI.exe"LogonUI.exe" /flags:0x4 /state0:0xa3a33855 /state1:0x41c64e6d1⤵
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
PID:2200