Resubmissions
07/11/2026, 15:04
261107-sf1njayw7p07/11/2026, 15:03
261107-sfgknafc2407/11/2026, 15:00
261107-sdnwysy1cs10Analysis
- user interaction
yes - max time kernel
71s - max time network
73s - platform
windows10-2004_x64 - resource
win10v2004-20260911-en - resource tags
arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
07/11/2026, 15:00
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
cheat.exe
Resource
win10ltsc2021-20260911-en
windows10-ltsc_2021-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
cheat.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
10 signatures
150 seconds
Errors
Reason
Machine shutdown
General
- Target cheat.exe
- Size 479KB
- Sample261107-sdnwysy1cs
- SHA256 803f0b646b2429bf6b0ea251874614238c5e01c309bf0b2508cfc324f9654bd4
- MD5 63243a853032bc831428040363db13a9
- SHA1 52d52dabc6ed71907c48ba6953cb98ca53215909
- SHA512 32344d4a22145a78b734eef66f1fdff624f7f7ea2ed59187e12163d68c201f7c8d2a44fc8e74b03728ee3a91853deb5756850aa7c129c057807dcda9eaa0b4ef
- SSDEEP 12288:8MSU4joci8M6PW1GVFeFd60DFUyhevYMun:bSUCpM2W1Gvgmyevv
- TLSH T1DEA48E23F690C473D16336B9DC1B96A4A8257E505D24644B3AF83E4C5F7A383B82629F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Malware Config
Signatures
- Modifies WinLogon for persistence 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "C:\\Users\\Admin\\AppData\\Local\\Temp\\cheat.exe" cheat.exe - Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000\Software\Microsoft\Active Setup\Installed Components explorer.exe - Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\userini = "C:\\Users\\Admin\\AppData\\Local\\Temp\\cheat.exe" cheat.exe - Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
description ioc Process File opened for modification \??\PhysicalDrive0 cheat.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cheat.exe - Modifies data under HKEY_USERS 15 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\StartColorMenu = "4288567808" LogonUI.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglow = "3288365271" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglowBalance = "10" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\EnableWindowColorization = "83" LogonUI.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentPalette = a6d8ff0076b9ed00429ce3000078d700005a9e000042750000264200f7630c00 LogonUI.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentColorMenu = "4292311040" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColor = "3288365271" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationBlurBalance = "1" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History\AutoColor = "0" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\AccentColor = "4292311040" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColorBalance = "89" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationGlassAttribute = "1" LogonUI.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2692 cheat.exe 2692 cheat.exe 2692 cheat.exe 2692 cheat.exe 2692 cheat.exe 2692 cheat.exe 2692 cheat.exe 2692 cheat.exe 2692 cheat.exe 2692 cheat.exe 2692 cheat.exe 2692 cheat.exe 2692 cheat.exe 2692 cheat.exe 2692 cheat.exe 2692 cheat.exe 2692 cheat.exe 2692 cheat.exe 2692 cheat.exe 2692 cheat.exe 2692 cheat.exe 2692 cheat.exe 2692 cheat.exe 2692 cheat.exe 2692 cheat.exe 2692 cheat.exe 2692 cheat.exe 2692 cheat.exe 2692 cheat.exe 2692 cheat.exe 2692 cheat.exe 2692 cheat.exe 2692 cheat.exe 2692 cheat.exe 2692 cheat.exe 2692 cheat.exe 2692 cheat.exe 2692 cheat.exe 2692 cheat.exe 2692 cheat.exe 2692 cheat.exe 2692 cheat.exe 2692 cheat.exe 2692 cheat.exe 2692 cheat.exe 2692 cheat.exe 2692 cheat.exe 2692 cheat.exe 2692 cheat.exe 2692 cheat.exe 2692 cheat.exe 2692 cheat.exe 2692 cheat.exe 2692 cheat.exe 2692 cheat.exe 2692 cheat.exe 2692 cheat.exe 2692 cheat.exe 2692 cheat.exe 2692 cheat.exe 2692 cheat.exe 2692 cheat.exe 2692 cheat.exe 2692 cheat.exe - Suspicious use of AdjustPrivilegeToken 5 IoCs
description pid Process Token: SeShutdownPrivilege 5036 explorer.exe Token: SeCreatePagefilePrivilege 5036 explorer.exe Token: SeShutdownPrivilege 5036 explorer.exe Token: SeCreatePagefilePrivilege 5036 explorer.exe Token: SeShutdownPrivilege 2692 cheat.exe - Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 2692 cheat.exe 2692 cheat.exe 2692 cheat.exe 2692 cheat.exe 2692 cheat.exe 2692 cheat.exe 2692 cheat.exe 2692 cheat.exe 2692 cheat.exe 2692 cheat.exe 2692 cheat.exe 2692 cheat.exe 2692 cheat.exe 2692 cheat.exe 2692 cheat.exe 2692 cheat.exe 2692 cheat.exe 2692 cheat.exe 2692 cheat.exe 2692 cheat.exe 2692 cheat.exe 2692 cheat.exe 2692 cheat.exe 2692 cheat.exe 2692 cheat.exe 2692 cheat.exe 2692 cheat.exe 2692 cheat.exe 2692 cheat.exe 2692 cheat.exe 2692 cheat.exe 2692 cheat.exe 2692 cheat.exe 2692 cheat.exe 2692 cheat.exe 2692 cheat.exe 2692 cheat.exe 2692 cheat.exe 2692 cheat.exe 2692 cheat.exe 2692 cheat.exe 2692 cheat.exe 2692 cheat.exe 2692 cheat.exe 2692 cheat.exe 2692 cheat.exe 2692 cheat.exe 2692 cheat.exe 2692 cheat.exe 2692 cheat.exe 2692 cheat.exe 2692 cheat.exe 2692 cheat.exe 2692 cheat.exe 2692 cheat.exe 2692 cheat.exe 2692 cheat.exe 2692 cheat.exe 2692 cheat.exe 2692 cheat.exe 2692 cheat.exe 2692 cheat.exe 2692 cheat.exe 2692 cheat.exe - Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 5708 LogonUI.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\cheat.exe"C:\Users\Admin\AppData\Local\Temp\cheat.exe"1⤵
- Modifies WinLogon for persistence
- Adds Run key to start application
- Writes to the Master Boot Record (MBR)
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:2692
-
C:\Windows\explorer.exeexplorer.exe1⤵
- Boot or Logon Autostart Execution: Active Setup
- Suspicious use of AdjustPrivilegeToken
PID:5036
-
C:\Windows\system32\LogonUI.exe"LogonUI.exe" /flags:0x4 /state0:0xa38da055 /state1:0x41c64e6d1⤵
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
PID:5708
Network
MITRE ATT&CK Enterprise v16
Persistence
Boot or Logon Autostart Execution
3Active Setup
1Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Pre-OS Boot
1Bootkit
1