Analysis
-
max time kernel
142s -
max time network
147s -
platform
windows10-2004_x64 -
resource
win10v2004-20231020-en -
resource tags
-
submitted
20/11/2023, 17:47
General
-
Target
CheatEngine75.exe
-
Size
3.1MB
-
MD5
96d1196bd8e52d9889656b2960a27e5b
-
SHA1
75b17106b9aa54ccea7583c8339b81993f27e69e
-
SHA256
75f32ab1a2e666ca53d9d8e3d9d6d7e64ee068aa92af66bdd1e4f6527e83e1ec
-
SHA512
a2dac9e62934a6bc23fc7dd420e6856f222afe069f2030521860e7d991f9f3395f5c10b2f32f65d326ec91bbd451c4e0772711c96d5b5f742748560d88f2c094
-
SSDEEP
49152:ZBuZrEU+43YpVog43YpVog43YpVoWgV+ZSA9ty/uzyG4EU+T9j6pjIMGFTKakR:vkL+4opH4opH4opIU9tNz939aEbJcR
Malware Config
Signatures
-
Checks for any installed AV software in registry 1 TTPs 9 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 1 IoCs
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Script User-Agent 1 IoCs
Uses user-agent string associated with script host/environment.
-
Suspicious behavior: EnumeratesProcesses 14 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\CheatEngine75.exe"C:\Users\Admin\AppData\Local\Temp\CheatEngine75.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-T8MCO.tmp\CheatEngine75.tmp"C:\Users\Admin\AppData\Local\Temp\is-T8MCO.tmp\CheatEngine75.tmp" /SL5="$11005E,2349502,832512,C:\Users\Admin\AppData\Local\Temp\CheatEngine75.exe"2⤵
- Checks for any installed AV software in registry
- Executes dropped EXE
- Loads dropped DLL
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
258KB
MD56b7cb2a5a8b301c788c3792802696fe8
SHA1da93950273b0c256dab64bb3bb755ac7c14f17f3
SHA2563eed2e41bc6ca0ae9a5d5ee6d57ca727e5cba6ac8e8c5234ac661f9080cedadf
SHA5124183dbb8fd7de5fd5526a79b62e77fc30b8d1ec34ebaa3793b4f28beb36124084533e08b595f77305522bc847edfed1f9388c0d2ece66e6ac8acb7049b48ee86
-
Filesize
2.0MB
MD5fad0877741da31ab87913ef1f1f2eb1a
SHA121abb83b8dfc92a6d7ee0a096a30000e05f84672
SHA25673ff938887449779e7a9d51100d7be2195198a5e2c4c7de5f93ceac7e98e3e02
SHA512f626b760628e16b9aa8b55e463c497658dd813cf5b48a3c26a85d681da1c3a33256cae012acc1257b1f47ea37894c3a306f348eb6bd4bbdf94c9d808646193ec
-
Filesize
3.1MB
MD52dbb23c62848635c596fa85ba7dee128
SHA1dcdbf91651828fe5834fed03e3416920efa690e3
SHA256296df81ad382686280652e45750ab5d9c0c35d4b308265fe5ff039017b7345a3
SHA5120710c2205ec00b361b9aa66ce332e892532560e8f92c69aac0c97d5e6750bc6c92315bc2804e9e546f6bf42f1bf3fcdc8e4496be375c6f4cf04a1e7d80d8c6e8
-
Filesize
4KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
3.1MB
-
Filesize
4KB
-
Filesize
1.2MB
-
Filesize
864KB
-
Filesize
864KB
