Overview

overview

8

Static

static

1

CheatEngine75.exe

windows10-2004-x64

8

Sharing

Copy URL
Twitter E-mail

General

  • Target

    CheatEngine75.exe

  • Size

    3.1MB

  • Sample

    230610-mhx3jaeg49

  • MD5

    609fea742d34dc1d53f0eeb4873b1a0a

  • SHA1

    3232c52da3cb8f47a870162a35cdd75fcae60aea

  • SHA256

    e2e15826b69778e381f25ac8f2b109a377b23f7cf79b5f482e81f4d28c30f95e

  • SHA512

    27da89901268d153fd7158162fc8f2f3b99ec9a4aa24c281f93b500466552af776b00f0a33182386a62934c3e553561cbc23d3f5ebb0ea0366c04e046e1bcc90

  • SSDEEP

    98304:wSiW4opH4opH4op4U9tNz9RGa/xlbLP/h4:ZDBDBD1t3Hbb+

Score
8/10
bootkitdiscoveryevasionpersistence

Malware Config

Targets

    • Target

      CheatEngine75.exe

    • Size

      3.1MB

    • MD5

      609fea742d34dc1d53f0eeb4873b1a0a

    • SHA1

      3232c52da3cb8f47a870162a35cdd75fcae60aea

    • SHA256

      e2e15826b69778e381f25ac8f2b109a377b23f7cf79b5f482e81f4d28c30f95e

    • SHA512

      27da89901268d153fd7158162fc8f2f3b99ec9a4aa24c281f93b500466552af776b00f0a33182386a62934c3e553561cbc23d3f5ebb0ea0366c04e046e1bcc90

    • SSDEEP

      98304:wSiW4opH4opH4op4U9tNz9RGa/xlbLP/h4:ZDBDBD1t3Hbb+

    Score
    8/10
    bootkitdiscoveryevasionpersistence

    • Creates new service(s)

      persistence

    • Downloads MZ/PE file

    • Stops running service(s)

      evasion

    • Modifies file permissions

      discovery

    • Checks for any installed AV software in registry

    • Writes to the Master Boot Record (MBR)

      Bootkits write to the MBR to gain persistence at a level below the operating system.

      bootkitpersistence

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    behavioral1

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

New Service

1
T1050

Modify Existing Service

1
T1031

Bootkit

1
T1067

Privilege Escalation

New Service

1
T1050

Defense Evasion

Impair Defenses

1
T1562

File Permissions Modification

1
T1222

Install Root Certificate

1
T1130

Modify Registry

1
T1112

Credential Access

Discovery

Security Software Discovery

1
T1063

Query Registry

2
T1012

System Information Discovery

3
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Service Stop

1
T1489

Tasks