hxxp:// | Triage

Analysis

max time kernel
146s
max time network
151s
platform
windows10-1703_x64
resource
win10-20240404-en
resource tags

arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system
submitted
24/04/2024, 23:55

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

http://

Score

8^/10

Malware Config

Signatures

Downloads MZ/PE file

Executes dropped EXE 2 IoCs

pid	Process
5692	CheatEngine75.exe
5736	CheatEngine75.tmp

Loads dropped DLL 1 IoCs

pid	Process
5736	CheatEngine75.tmp

Checks for any installed AV software in registry 1 TTPs 9 IoCs

Security Software Discovery

T1518.001

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000\SOFTWARE\AVAST Software\Avast	CheatEngine75.tmp
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\AVG\AV\Dir	CheatEngine75.tmp
Key opened	\REGISTRY\MACHINE\SOFTWARE\AVG\AV\Dir	CheatEngine75.tmp
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Avira\Browser\Installed	CheatEngine75.tmp
Key opened	\REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000\SOFTWARE\Avira\Browser\Installed	CheatEngine75.tmp
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\AVAST Software\Avast	CheatEngine75.tmp
Key opened	\REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000\SOFTWARE\AVG\AV\Dir	CheatEngine75.tmp
Key opened	\REGISTRY\MACHINE\SOFTWARE\Avira\Browser\Installed	CheatEngine75.tmp
Key opened	\REGISTRY\MACHINE\SOFTWARE\AVAST Software\Avast	CheatEngine75.tmp

Drops file in Windows directory 4 IoCs

description	ioc	Process
File created	C:\Windows\rescache\_merged\3720402701\1568373884.pri	MicrosoftEdge.exe
File opened for modification	C:\Windows\Debug\ESE.TXT	MicrosoftEdge.exe
File created	C:\Windows\rescache\_merged\3720402701\1568373884.pri	MicrosoftEdgeCP.exe
File created	C:\Windows\rescache\_merged\3720402701\1568373884.pri	MicrosoftEdgeCP.exe

Checks processor information in registry 2 TTPs 7 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	CheatEngine75.tmp
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\	CheatEngine75.tmp
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe

Modifies Internet Explorer settings 1 TTPs 2 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000\Software\Microsoft\Internet Explorer\Main	browser_broker.exe
Key created	\REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000\Software\Microsoft\Internet Explorer\Main	MicrosoftEdgeCP.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\006\ACGStatus\ACGPolicyState = "6"	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\Internet Explorer	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Privacy\ClearBrowsingHistoryOnStart = "0"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ExtensionsStore\datastore	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Explorer\Main	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ServiceUI	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\ACGStatus\ACGPolicyState = "8"	MicrosoftEdgeCP.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Protected - It is a violation of Windows Policy to modify. See aka.ms/browserpolicy\Extensions	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\CIStatus	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\DataStore	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Recovery\PendingRecovery\ReadingStorePending = "1"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\Internet Explorer\Main\OperationalData = "1"	MicrosoftEdgeCP.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\CIStatusTimestamp = 85ef88eca296da01	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\CIStatusTimestamp = 414fc9eca296da01	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Recovery\PendingDelete\C:\Users\Admin\AppData\Local\Pack = "0"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\Internet Settings\Cache\Content	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\CIStatus\CIPolicyState = "0"	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\DummyPath\dummySetting = "1"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU	MicrosoftEdgeCP.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Protected - It is a violation of Windows Policy to modif = 010000002d44e0b63dc6283a173c087996e62e7905c39bbdc199227082d1d5ad3ef6d4361524bdcf86c6c33a395b22a45c64fb103d7ac682df6197a51849	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Protected - It is a violation of Windows Policy to modif	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Recovery\PendingRecovery\ReadingStorePending = "0"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Wow64-VendorId = "0"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\006\CIStatus\CIPolicyState = "0"	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\Internet Settings	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ExtensionsStore	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\CIStatus\SignaturePolicy = 06000000	MicrosoftEdgeCP.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\ACGStatus\DynamicCodePolicy = 05000000	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\Internet Settings\Cache\History\CacheLimit = "1"	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\CIStatus\CIPolicyState = "0"	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\ACGStatus	MicrosoftEdgeCP.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\AdapterInfo = "vendorId=\"0x1414\",deviceID=\"0x8c\",subSysID=\"0x0\",revision=\"0x0\",version=\"10.0.15063.0\"hypervisor=\"No Hypervisor (No SLAT)\""	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\DXFeatureLevel = "0"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\Internet Settings\Cache	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ServiceUI\IsSignedIn = "0"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\006\ACGStatus	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Recovery\PendingRecovery\Active = "0"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Main\DisallowDefaultBrowserPrompt = "0"	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\DataStore\LastCleanup = 4541c0f5a296da01	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Privacy	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Internet Settings\PrivacyAdvanced = "0"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation\CVListXMLVersionHigh = "0"	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\006\CIStatus\SignaturePolicy = 06000000	MicrosoftEdgeCP.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\ACGStatus\DynamicCodePolicy = 05000000	MicrosoftEdgeCP.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Internet Settings\Zones\3\{AEBA21FA-782A-4A90-978D-B7216 = 1a3761592352350c7a5f20172f1e1a190e2b017313371312141a152a	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\VersionHigh = "0"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\Internet Settings\Cache\History	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000_Classes\Local Settings	firefox.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Privacy\InProgressFlags = "262144"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Recovery\Active	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Recovery\PendingRecovery\Active = "1"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Internet Settings\Zones\3	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation\IECompatVersionHigh = "0"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\DeviceId = "0"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Main	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Main\LastClosedWidth = "1280"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\IETld\LowMic	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation\CVListXMLVersionLow = "0"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\006\CIStatus	MicrosoftEdgeCP.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\Internet Settings\Cache\Content\CachePrefix	MicrosoftEdgeCP.exe

NTFS ADS 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\Downloads\CheatEngine75.exe:Zone.Identifier	firefox.exe

Script User-Agent 1 IoCs

Uses user-agent string associated with script host/environment.

description	flow	ioc
HTTP User-Agent header	207	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)

Suspicious behavior: EnumeratesProcesses 30 IoCs

pid	Process
5736	CheatEngine75.tmp
5736	CheatEngine75.tmp
5736	CheatEngine75.tmp
5736	CheatEngine75.tmp
5736	CheatEngine75.tmp
5736	CheatEngine75.tmp
5736	CheatEngine75.tmp
5736	CheatEngine75.tmp
5736	CheatEngine75.tmp
5736	CheatEngine75.tmp
5736	CheatEngine75.tmp
5736	CheatEngine75.tmp
5736	CheatEngine75.tmp
5736	CheatEngine75.tmp
5736	CheatEngine75.tmp
5736	CheatEngine75.tmp
5736	CheatEngine75.tmp
5736	CheatEngine75.tmp
5736	CheatEngine75.tmp
5736	CheatEngine75.tmp
5736	CheatEngine75.tmp
5736	CheatEngine75.tmp
5736	CheatEngine75.tmp
5736	CheatEngine75.tmp
5736	CheatEngine75.tmp
5736	CheatEngine75.tmp
5736	CheatEngine75.tmp
5736	CheatEngine75.tmp
5736	CheatEngine75.tmp
5736	CheatEngine75.tmp

Suspicious behavior: MapViewOfSection 2 IoCs

pid	Process
4064	MicrosoftEdgeCP.exe
4064	MicrosoftEdgeCP.exe

Suspicious use of AdjustPrivilegeToken 11 IoCs

description	pid	Process
Token: SeDebugPrivilege	4812	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	4812	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	4812	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	4812	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	4692	MicrosoftEdge.exe
Token: SeDebugPrivilege	4692	MicrosoftEdge.exe
Token: SeDebugPrivilege	3736	firefox.exe
Token: SeDebugPrivilege	3736	firefox.exe
Token: SeDebugPrivilege	3736	firefox.exe
Token: SeDebugPrivilege	3736	firefox.exe
Token: SeDebugPrivilege	3736	firefox.exe

Suspicious use of FindShellTrayWindow 18 IoCs

pid	Process
3736	firefox.exe
3736	firefox.exe
3736	firefox.exe
3736	firefox.exe
3736	firefox.exe
3736	firefox.exe
3736	firefox.exe
3736	firefox.exe
3736	firefox.exe
3736	firefox.exe
3736	firefox.exe
3736	firefox.exe
3736	firefox.exe
3736	firefox.exe
3736	firefox.exe
3736	firefox.exe
3736	firefox.exe
3736	firefox.exe

Suspicious use of SendNotifyMessage 17 IoCs

pid	Process
3736	firefox.exe
3736	firefox.exe
3736	firefox.exe
3736	firefox.exe
3736	firefox.exe
3736	firefox.exe
3736	firefox.exe
3736	firefox.exe
3736	firefox.exe
3736	firefox.exe
3736	firefox.exe
3736	firefox.exe
3736	firefox.exe
3736	firefox.exe
3736	firefox.exe
3736	firefox.exe
3736	firefox.exe

Suspicious use of SetWindowsHookEx 11 IoCs

pid	Process
4692	MicrosoftEdge.exe
4064	MicrosoftEdgeCP.exe
4812	MicrosoftEdgeCP.exe
4064	MicrosoftEdgeCP.exe
3736	firefox.exe
3736	firefox.exe
3736	firefox.exe
3736	firefox.exe
3736	firefox.exe
3736	firefox.exe
3736	firefox.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4064 wrote to memory of 2968	4064	MicrosoftEdgeCP.exe	77
PID 4064 wrote to memory of 2968	4064	MicrosoftEdgeCP.exe	77
PID 4064 wrote to memory of 2968	4064	MicrosoftEdgeCP.exe	77
PID 4212 wrote to memory of 3736	4212	firefox.exe	80
PID 4212 wrote to memory of 3736	4212	firefox.exe	80
PID 4212 wrote to memory of 3736	4212	firefox.exe	80
PID 4212 wrote to memory of 3736	4212	firefox.exe	80
PID 4212 wrote to memory of 3736	4212	firefox.exe	80
PID 4212 wrote to memory of 3736	4212	firefox.exe	80
PID 4212 wrote to memory of 3736	4212	firefox.exe	80
PID 4212 wrote to memory of 3736	4212	firefox.exe	80
PID 4212 wrote to memory of 3736	4212	firefox.exe	80
PID 4212 wrote to memory of 3736	4212	firefox.exe	80
PID 4212 wrote to memory of 3736	4212	firefox.exe	80
PID 3736 wrote to memory of 4740	3736	firefox.exe	81
PID 3736 wrote to memory of 4740	3736	firefox.exe	81
PID 3736 wrote to memory of 2752	3736	firefox.exe	82
PID 3736 wrote to memory of 2752	3736	firefox.exe	82
PID 3736 wrote to memory of 2752	3736	firefox.exe	82
PID 3736 wrote to memory of 2752	3736	firefox.exe	82
PID 3736 wrote to memory of 2752	3736	firefox.exe	82
PID 3736 wrote to memory of 2752	3736	firefox.exe	82
PID 3736 wrote to memory of 2752	3736	firefox.exe	82
PID 3736 wrote to memory of 2752	3736	firefox.exe	82
PID 3736 wrote to memory of 2752	3736	firefox.exe	82
PID 3736 wrote to memory of 2752	3736	firefox.exe	82
PID 3736 wrote to memory of 2752	3736	firefox.exe	82
PID 3736 wrote to memory of 2752	3736	firefox.exe	82
PID 3736 wrote to memory of 2752	3736	firefox.exe	82
PID 3736 wrote to memory of 2752	3736	firefox.exe	82
PID 3736 wrote to memory of 2752	3736	firefox.exe	82
PID 3736 wrote to memory of 2752	3736	firefox.exe	82
PID 3736 wrote to memory of 2752	3736	firefox.exe	82
PID 3736 wrote to memory of 2752	3736	firefox.exe	82
PID 3736 wrote to memory of 2752	3736	firefox.exe	82
PID 3736 wrote to memory of 2752	3736	firefox.exe	82
PID 3736 wrote to memory of 2752	3736	firefox.exe	82
PID 3736 wrote to memory of 2752	3736	firefox.exe	82
PID 3736 wrote to memory of 2752	3736	firefox.exe	82
PID 3736 wrote to memory of 2752	3736	firefox.exe	82
PID 3736 wrote to memory of 2752	3736	firefox.exe	82
PID 3736 wrote to memory of 2752	3736	firefox.exe	82
PID 3736 wrote to memory of 2752	3736	firefox.exe	82
PID 3736 wrote to memory of 2752	3736	firefox.exe	82
PID 3736 wrote to memory of 2752	3736	firefox.exe	82
PID 3736 wrote to memory of 2752	3736	firefox.exe	82
PID 3736 wrote to memory of 2752	3736	firefox.exe	82
PID 3736 wrote to memory of 2752	3736	firefox.exe	82
PID 3736 wrote to memory of 2752	3736	firefox.exe	82
PID 3736 wrote to memory of 2752	3736	firefox.exe	82
PID 3736 wrote to memory of 2752	3736	firefox.exe	82
PID 3736 wrote to memory of 2752	3736	firefox.exe	82
PID 3736 wrote to memory of 2752	3736	firefox.exe	82
PID 3736 wrote to memory of 2752	3736	firefox.exe	82
PID 3736 wrote to memory of 2752	3736	firefox.exe	82
PID 3736 wrote to memory of 2752	3736	firefox.exe	82
PID 3736 wrote to memory of 2752	3736	firefox.exe	82
PID 3736 wrote to memory of 2752	3736	firefox.exe	82
PID 3736 wrote to memory of 2752	3736	firefox.exe	82
PID 3736 wrote to memory of 2752	3736	firefox.exe	82
PID 3736 wrote to memory of 2752	3736	firefox.exe	82
PID 3736 wrote to memory of 2752	3736	firefox.exe	82
PID 3736 wrote to memory of 2752	3736	firefox.exe	82
PID 3736 wrote to memory of 2752	3736	firefox.exe	82

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\system32\LaunchWinApp.exe
"C:\Windows\system32\LaunchWinApp.exe" "http://"
1⤵
PID:4664

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca
1⤵
- Drops file in Windows directory
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:4692

C:\Windows\system32\browser_broker.exe
C:\Windows\system32\browser_broker.exe -Embedding
1⤵
- Modifies Internet Explorer settings
PID:204

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Modifies registry class
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4064

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:4812

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Drops file in Windows directory
- Modifies registry class
PID:2968

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4212
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe"
  2⤵
  - Checks processor information in registry
  - Modifies registry class
  - NTFS ADS
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3736
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3736.0.294288021\657932738" -parentBuildID 20221007134813 -prefsHandle 1748 -prefMapHandle 1724 -prefsLen 20747 -prefMapSize 233444 -appDir "C:\Program Files\Mozilla Firefox\browser" - {36ab214a-e074-47bc-a362-98cf1e049f00} 3736 "\\.\pipe\gecko-crash-server-pipe.3736" 1828 242bfec2e58 gpu
    3⤵
    PID:4740
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3736.1.54621836\2101535661" -parentBuildID 20221007134813 -prefsHandle 2172 -prefMapHandle 2168 -prefsLen 20828 -prefMapSize 233444 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {201b2764-fe5d-496a-8e62-9997245db343} 3736 "\\.\pipe\gecko-crash-server-pipe.3736" 2184 242bfdfc558 socket
    3⤵
    PID:2752
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3736.2.1417033191\616195391" -childID 1 -isForBrowser -prefsHandle 2936 -prefMapHandle 2724 -prefsLen 20931 -prefMapSize 233444 -jsInitHandle 1280 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {5671af52-d723-431a-bf5f-6acd24794c02} 3736 "\\.\pipe\gecko-crash-server-pipe.3736" 2908 242c41cb858 tab
    3⤵
    PID:2316
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3736.3.1673889094\1433953760" -childID 2 -isForBrowser -prefsHandle 3400 -prefMapHandle 3396 -prefsLen 26109 -prefMapSize 233444 -jsInitHandle 1280 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {8c8b161b-3269-41ca-9ea1-da28d275cb14} 3736 "\\.\pipe\gecko-crash-server-pipe.3736" 3408 242adb69358 tab
    3⤵
    PID:3320
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3736.4.1409255149\957408179" -childID 3 -isForBrowser -prefsHandle 4320 -prefMapHandle 4304 -prefsLen 26168 -prefMapSize 233444 -jsInitHandle 1280 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {9a288ecd-700f-40d7-ae7e-b5e8e72516d0} 3736 "\\.\pipe\gecko-crash-server-pipe.3736" 4332 242c5caa858 tab
    3⤵
    PID:2268
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3736.5.571616281\1604648234" -childID 4 -isForBrowser -prefsHandle 4904 -prefMapHandle 4900 -prefsLen 26168 -prefMapSize 233444 -jsInitHandle 1280 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {f1d9c325-9778-4472-b858-8c28006f9177} 3736 "\\.\pipe\gecko-crash-server-pipe.3736" 4912 242c618a258 tab
    3⤵
    PID:1968
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3736.6.1258108020\743284378" -childID 5 -isForBrowser -prefsHandle 5048 -prefMapHandle 5052 -prefsLen 26168 -prefMapSize 233444 -jsInitHandle 1280 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {5f38e316-43b8-4c61-a6c2-c6f316a9ba94} 3736 "\\.\pipe\gecko-crash-server-pipe.3736" 5040 242c678f558 tab
    3⤵
    PID:1604
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3736.7.1343754103\74214877" -childID 6 -isForBrowser -prefsHandle 5192 -prefMapHandle 5196 -prefsLen 26168 -prefMapSize 233444 -jsInitHandle 1280 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {06f82393-7904-4e34-a1d7-25a23f7e3e7c} 3736 "\\.\pipe\gecko-crash-server-pipe.3736" 5184 242c678fb58 tab
    3⤵
    PID:3716
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3736.8.927407507\1729719350" -childID 7 -isForBrowser -prefsHandle 5420 -prefMapHandle 5596 -prefsLen 26249 -prefMapSize 233444 -jsInitHandle 1280 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {9621fe5a-ad27-4e9d-882a-2c698d9d5ec5} 3736 "\\.\pipe\gecko-crash-server-pipe.3736" 5628 242c672d558 tab
    3⤵
    PID:4892
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3736.9.180957152\382600649" -childID 8 -isForBrowser -prefsHandle 5804 -prefMapHandle 4288 -prefsLen 26689 -prefMapSize 233444 -jsInitHandle 1280 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {06107778-8891-41c2-af23-cca99c65987b} 3736 "\\.\pipe\gecko-crash-server-pipe.3736" 5800 242c8345658 tab
    3⤵
    PID:3932
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3736.10.309766100\1277270721" -childID 9 -isForBrowser -prefsHandle 5464 -prefMapHandle 5476 -prefsLen 26689 -prefMapSize 233444 -jsInitHandle 1280 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {e88af1b2-ad09-4143-9577-b07891a1ace0} 3736 "\\.\pipe\gecko-crash-server-pipe.3736" 5472 242c8346858 tab
    3⤵
    PID:1092
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3736.11.1029933241\517288687" -childID 10 -isForBrowser -prefsHandle 5736 -prefMapHandle 5732 -prefsLen 26689 -prefMapSize 233444 -jsInitHandle 1280 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {e835fd47-23f6-4f1b-b7b0-76f00873ebed} 3736 "\\.\pipe\gecko-crash-server-pipe.3736" 5724 242c8b1aa58 tab
    3⤵
    PID:4644
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3736.12.1404371329\559424738" -childID 11 -isForBrowser -prefsHandle 5840 -prefMapHandle 5856 -prefsLen 26689 -prefMapSize 233444 -jsInitHandle 1280 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {47481b8f-9088-4505-8a9d-4588fec729fd} 3736 "\\.\pipe\gecko-crash-server-pipe.3736" 5844 242c277ee58 tab
    3⤵
    PID:1532
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3736.13.1754562624\1323939890" -childID 12 -isForBrowser -prefsHandle 9832 -prefMapHandle 9828 -prefsLen 26689 -prefMapSize 233444 -jsInitHandle 1280 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {8e256ee1-678a-44f0-8202-5a2c28df5448} 3736 "\\.\pipe\gecko-crash-server-pipe.3736" 9932 242c277e258 tab
    3⤵
    PID:3596

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:5620

C:\Users\Admin\Downloads\CheatEngine75.exe
"C:\Users\Admin\Downloads\CheatEngine75.exe"
1⤵
- Executes dropped EXE
PID:5692
- C:\Users\Admin\AppData\Local\Temp\is-BLP8G.tmp\CheatEngine75.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-BLP8G.tmp\CheatEngine75.tmp" /SL5="$402B4,29019964,780800,C:\Users\Admin\Downloads\CheatEngine75.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Checks for any installed AV software in registry
  - Checks processor information in registry
  - Suspicious behavior: EnumeratesProcesses
  PID:5736

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

Software Discovery

T1518

Security Software Discovery

T1518.001

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\je1358xf.default-release\cache2\doomed\18176

Filesize
9KB

MD5
eb31c6117e4bfd50be2824041055ca06

SHA1
0aa49eea4dcc53c6245aa0efc32eb5e98429c24c

SHA256
231620e4127ff771c51a594c5862d18e0296374ae4a52771648d2a7d2bd1ff4f

SHA512
484c55accda47ef49ec8322d7eed2d6ee535d6866d5dc3f6795d6437f8461d7f49a08b2ca9cb4379ee81d13c8707a773df5dd0fffb11318aa622436a28f40e85

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\je1358xf.default-release\cache2\entries\E81C30F1E1133DCF9B4DCFFC191D3CFD30711B45

Filesize
60KB

MD5
359eff43f9c228a1a6a262b0c299bf88

SHA1
c5aa9cea848f045bafe90cab9aa431ac398570b7

SHA256
bc752820a33726b387e1627b3a4ff5aa3309dfde0a58f0cae051630ed9435d75

SHA512
f0d91993d64efb1c61bdde5813f213b89da671e12f4ed18b6c37ec85dab6a4acf8f4ac99b05dc3dd7877a1dba75ed74e8c505653de71e98023356dcd5914e114

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\Temp\~DFD24C031C6C5B77C7.TMP

Filesize
16KB

MD5
c545ad8292b081236f6e89bce4b18e3b

SHA1
955f05ec2ceed31cd6dfc25dcfb5dc71472e57bd

SHA256
321ae39efd7f54013e935b69297c161b60355098aa9812a8001281f8d8349a70

SHA512
2e0f213e9186a39f6bd1e6b2cdb1e1642077dd2ecb4d77d371e4ccc3842a2f6942a1f2ff32ee7711e793547aab2e4593036e664785c60d93bea987949926f7e9

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-BLP8G.tmp\CheatEngine75.tmp

Filesize
2.9MB

MD5
8d2602899890d3a9d9dbabf8f5361c3c

SHA1
5313c9b602af1858214f70ae2ed1f31ae17c2929

SHA256
62014799dc68f92bea98dd83bbda38b8c1eaa661b23518afb4eb617d02a9ab67

SHA512
912d8cf3d0d6d15578077406db503dd469c966d70953cc38d7465b818a6a34760d649f7239f6e45ebed8efb913699d38c1517da5389c837e00b9b021aa37fead

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-FRRLL.tmp\RAV_Cross.png

Filesize
74KB

MD5
cd09f361286d1ad2622ba8a57b7613bd

SHA1
4cd3e5d4063b3517a950b9d030841f51f3c5f1b1

SHA256
b92a31d4853d1b2c4e5b9d9624f40b439856d0c6a517e100978cbde8d3c47dc8

SHA512
f73d60c92644e0478107e0402d1c7b4dfa1674f69b41856f74f937a7b57ceaa2b3be9242f2b59f1fcf71063aac6cbe16c594618d1a8cdd181510de3240f31dff

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-FRRLL.tmp\logo.png

Filesize
246KB

MD5
f3d1b8cd125a67bafe54b8f31dda1ccd

SHA1
1c6b6bf1e785ad80fc7e9131a1d7acbba88e8303

SHA256
21dfa1ff331794fcb921695134a3ba1174d03ee7f1e3d69f4b1a3581fccd2cdf

SHA512
c57d36daa20b1827b2f8f9f98c9fd4696579de0de43f9bbeef63a544561a5f50648cc69220d9e8049164df97cb4b2176963089e14d58a6369d490d8c04354401

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\je1358xf.default-release\datareporting\glean\db\data.safe.bin

Filesize
2KB

MD5
a760db5b531d2cb6bce1d771f6a3c7f6

SHA1
952af7268a44370e49f1e6820add8c84f535711d

SHA256
dd4fbf39573db9ab6681e4b6ef29f1db3e0739894d3ddea2dadbabee11cb853f

SHA512
19b27196969b1b43d5e94aa0745981d88211ad7f1d040ec645c55b75b66b00efa34703fa7c06d4ccff0f2a0fd7cfc925d5eee48b6ddd76eb2d27d9ac841e519c

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\je1358xf.default-release\datareporting\glean\pending_pings\5ee61b90-69d5-4ab8-8f2b-4a59a274ac7f

Filesize
11KB

MD5
105bfdaa8c1755457e06792032a4cd8b

SHA1
e602efdac146f4dbe1855a4e07453cf1642d2650

SHA256
3d1eac3c03001cf6058519ac01aed15ecad3c27e09b717bd4c6384a49f9b8bf9

SHA512
75374d977ccd9bdff16b8dbf143d8923ed0f8f2c82e4c10d676aaec19c2a7f460f75cd220d724dc2b019f0f399c094fe79197378e573ddf363112f6e8ac9188f

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\je1358xf.default-release\datareporting\glean\pending_pings\d9543bdf-a79f-47e6-baa3-8b33e344e2e7

Filesize
746B

MD5
028a6c81b676c46174af64763ea41e0a

SHA1
21301c3690bdf481779983255f62978a41339705

SHA256
b797cb8dd53193402e36f77cde7e8f8f8f96d0caa8ac3c891c76065e29127728

SHA512
9a4c7a282052a2a23f47828e610824bef866c484f404a1f77a1a6f89e531548e396537cffd9df90198227985e632d2cdc112dfe9487b9c76fa9d341c876b8273

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\je1358xf.default-release\prefs-1.js

Filesize
6KB

MD5
26892d5a5ea0a6477fdd52d327085c6a

SHA1
35ee3b921e900215b2e1f2d1b2c5d41fe0a31127

SHA256
36a7f00a8e4e6219d98c6217b344d048305e4bea839b19f0c51e0b3a44a7761a

SHA512
1a7bcefd21203140a843005811564125854857f2a81a96886efb85663b901938cdc077282cded2085db1d081f436df758cab6bd9416ca3156c1f76616a94c0e0

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\je1358xf.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
3KB

MD5
56d996569173bded7649e220121868df

SHA1
1fab954703eb2cbfeecf94b23aadfa799d3af007

SHA256
d109656c2c1202325cc383536f5ebade7565f06996d72670250deadd54ed44fe

SHA512
e8e9e5dac105a5856dda5e002877d9d709e682f94946fb957864206f3cf56fe5b33222305e4e9bc89aa5f61982dc89a905c8c677ce95565ae60b0d21c27f0c2c

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\je1358xf.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
4KB

MD5
ef394aeca737a1dbf960b43d3452c482

SHA1
45a97903c3340e8de6907a4701a67d9fc82f4613

SHA256
c980a97ac965f53aeb6e88a690d9ae9a46fbc9a4960a1333068789f15d49dce8

SHA512
88d9b2b99a18e15584751cbe5c7ddb3a44dc0d10debaf2761836440b8fd54b7cbfce8216236ff6a74680385e8293fd8e4672cdf5443210e3cd432eace3b96076

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\je1358xf.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
6KB

MD5
5e8ba594f49dfb1b994437b11f250e12

SHA1
0ad509109f2efcfe944ef1056a9a10a7c787a434

SHA256
77bc6ac18705e24f336c187f26a62ce6fceff2008b49d915371038dc99e16187

SHA512
05e4060e6e8430ca8bdb5af94cbe88f677e7505e83bf01ab7937e46b26b58e4ea6b9b4607525adb8e18b6e778bc5959d8d4fdebd1193764591c09c4bcdc07e1c

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\je1358xf.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
38KB

MD5
aa06a6befe6dd5e15bb8c8f8f7b69961

SHA1
f24f9f629123b907c8ca44f8f7fc0f9769bdaa89

SHA256
704b70fe2a4e3129b927e3d3cc1ff354fdb9ce3af12389bcbe584b4259bf11ed

SHA512
13b6babeb9f47f7dafe5f58f0c022c69b4a924b88f004cef837a3b872619ba767a6023d356ecbebd5b5a982bda8daf3fd81ddabd8a1cc5e51278c9d9c4a1f114

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\je1358xf.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
4KB

MD5
362f619130e8021006d6e637e745af8a

SHA1
e782634a3907d3d094b4a600425e61fb0d3cd0c1

SHA256
49851266870c0f7ce4a670501c76d430deafa06596e78368cc1120db2185c535

SHA512
ef383ae2aec94a051f0e283700bdfd96feadce1fdd4deab33e60fc88e7bbe43153e8a3d231b2fe55952c45ee72db5b02f5988ddb0978900a98654d6df85e84b0

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\je1358xf.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
4KB

MD5
2a80cb4fc918040a018d633ec0b80308

SHA1
c28bbb4e18f03ce295370dc2c874cf4efd321a47

SHA256
1761c12c6fc5d128efdcc99d90eb43a3fd87169cba93ff4549ec8cf1096a8eaa

SHA512
0e04e5f3f01900a7da82a8b1ed5930b6157d5f6d96c298b11a0edce4495c5e0019f2124117c676e8f98656ae837465270e872a94674b15f1b79fe256c24e80f2

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\je1358xf.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
37KB

MD5
85c2dc49d1bae5cc1f264cb7d029526d

SHA1
36ee267ae2a15fee0bdacdb87a7293b64722a0d2

SHA256
8136c9d04fb4c600d2580679544e184ff29a3a015892de0af3acfee5604c2ebe

SHA512
b680987a1f543572563765ca753204d08d4e297b235b84dd9e3e99cbf7b94c0f3cb534dc14d4e5da36825eb23494e5cea46b77201356d7a41a2d75c44015f792

Download Submit
C:\Users\Admin\Downloads\CheatEngine75.9dgLnkm1.exe.part

Filesize
13KB

MD5
715191051f8d091649c1bcdeb3bff1b6

SHA1
ec735cd0087d1b450e4927c10d8f7ea3570a0627

SHA256
f1cc8ed41be71ab70612b270e0f78bacdf60ad456e9992fa7b8af0ee120da817

SHA512
e82b11f18008ffdaa56670dba691eaed9be4f087e55008741ab732d139feeb23dde4f047c99a112046b50e37abfe037f8012b28f3f60628cadccb961ff937a49

Download Submit
C:\Users\Admin\Downloads\CheatEngine75.exe

Filesize
28.5MB

MD5
1e2b14c4f25f109717f8cab97a050bf6

SHA1
188cabf0640e0203fd9c2612586b78ce173f4fd7

SHA256
2cd9a8ef0b8cb972210c0ff94c510034435771420cf404d8db55ab2d1083299f

SHA512
2783e9c4254b04ba35114b673a62d48b720dab2cbd1e2419bc69581d40112a0a7c20531aa47e78d56f1886eb337f9151d1fb969ab26999b186be33254a3c717b

Download Submit
\Users\Admin\AppData\Local\Temp\is-FRRLL.tmp\zbShieldUtils.dll

Filesize
2.0MB

MD5
b83f5833e96c2eb13f14dcca805d51a1

SHA1
9976b0a6ef3dabeab064b188d77d870dcdaf086d

SHA256
00e667b838a4125c8cf847936168bb77bb54580bc05669330cb32c0377c4a401

SHA512
8641b351e28b3c61ed6762adbca165f4a5f2ee26a023fd74dd2102a6258c0f22e91b78f4a3e9fba6094b68096001de21f10d6495f497580847103c428d30f7bb

Download Submit
memory/2968-53-0x000001DAF22B0000-0x000001DAF22B2000-memory.dmp

Filesize
8KB

Download
memory/2968-51-0x000001DAF20F0000-0x000001DAF20F2000-memory.dmp

Filesize
8KB

Download
memory/2968-48-0x000001DAF20C0000-0x000001DAF20C2000-memory.dmp

Filesize
8KB

Download
memory/4692-35-0x000001CDB6FC0000-0x000001CDB6FC2000-memory.dmp

Filesize
8KB

Download
memory/4692-73-0x000001CDB6FF0000-0x000001CDB6FF1000-memory.dmp

Filesize
4KB

Download
memory/4692-70-0x000001CDB9C20000-0x000001CDB9C22000-memory.dmp

Filesize
8KB

Download
memory/4692-77-0x000001CDB6FB0000-0x000001CDB6FB1000-memory.dmp

Filesize
4KB

Download
memory/4692-16-0x000001CDBA300000-0x000001CDBA310000-memory.dmp

Filesize
64KB

Download
memory/4692-0-0x000001CDB9A20000-0x000001CDB9A30000-memory.dmp

Filesize
64KB

Download
memory/5692-568-0x0000000000400000-0x00000000004CC000-memory.dmp

Filesize
816KB

Download
memory/5692-611-0x0000000000400000-0x00000000004CC000-memory.dmp

Filesize
816KB

Download
memory/5736-609-0x0000000004B50000-0x0000000004C90000-memory.dmp

Filesize
1.2MB

Download
memory/5736-610-0x0000000004B50000-0x0000000004C90000-memory.dmp

Filesize
1.2MB

Download
memory/5736-612-0x0000000000400000-0x00000000006EE000-memory.dmp

Filesize
2.9MB

Download
memory/5736-574-0x0000000000930000-0x0000000000931000-memory.dmp

Filesize
4KB

Download
memory/5736-616-0x0000000004B50000-0x0000000004C90000-memory.dmp

Filesize
1.2MB

Download
memory/5736-617-0x0000000000930000-0x0000000000931000-memory.dmp

Filesize
4KB

Download
memory/5736-618-0x0000000004B50000-0x0000000004C90000-memory.dmp

Filesize
1.2MB

Download