Overview

overview

8

Static

static

1

CheatEngine75.exe

windows7-x64

4

CheatEngine75.exe

windows10-2004-x64

8

Sharing

Copy URL
Twitter E-mail

General

  • Target

    CheatEngine75.exe

  • Size

    3.1MB

  • Sample

    230507-qbhaaaef96

  • MD5

    609fea742d34dc1d53f0eeb4873b1a0a

  • SHA1

    3232c52da3cb8f47a870162a35cdd75fcae60aea

  • SHA256

    e2e15826b69778e381f25ac8f2b109a377b23f7cf79b5f482e81f4d28c30f95e

  • SHA512

    27da89901268d153fd7158162fc8f2f3b99ec9a4aa24c281f93b500466552af776b00f0a33182386a62934c3e553561cbc23d3f5ebb0ea0366c04e046e1bcc90

  • SSDEEP

    98304:wSiW4opH4opH4op4U9tNz9RGa/xlbLP/h4:ZDBDBD1t3Hbb+

Score
8/10
discoveryevasion

Malware Config

Targets

    • Target

      CheatEngine75.exe

    • Size

      3.1MB

    • MD5

      609fea742d34dc1d53f0eeb4873b1a0a

    • SHA1

      3232c52da3cb8f47a870162a35cdd75fcae60aea

    • SHA256

      e2e15826b69778e381f25ac8f2b109a377b23f7cf79b5f482e81f4d28c30f95e

    • SHA512

      27da89901268d153fd7158162fc8f2f3b99ec9a4aa24c281f93b500466552af776b00f0a33182386a62934c3e553561cbc23d3f5ebb0ea0366c04e046e1bcc90

    • SSDEEP

      98304:wSiW4opH4opH4op4U9tNz9RGa/xlbLP/h4:ZDBDBD1t3Hbb+

    Score
    8/10
    discoveryevasion

    • Downloads MZ/PE file

    • Stops running service(s)

      evasion

    • Modifies file permissions

      discovery

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Modify Existing Service

1
T1031

Privilege Escalation

Defense Evasion

Impair Defenses

1
T1562

File Permissions Modification

1
T1222

Install Root Certificate

1
T1130

Modify Registry

1
T1112

Credential Access

Discovery

Query Registry

3
T1012

System Information Discovery

3
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Service Stop

1
T1489

Tasks