Overview

overview

8

Static

static

1

CheatEngine75.exe

windows7-x64

8

CheatEngine75.exe

windows10-2004-x64

7

Sharing

Copy URL Twitter E-mail

General

  • Target

    CheatEngine75.exe

  • Size

    3.1MB

  • Sample

    240808-s6l8tsyhna

  • MD5

    609fea742d34dc1d53f0eeb4873b1a0a

  • SHA1

    3232c52da3cb8f47a870162a35cdd75fcae60aea

  • SHA256

    e2e15826b69778e381f25ac8f2b109a377b23f7cf79b5f482e81f4d28c30f95e

  • SHA512

    27da89901268d153fd7158162fc8f2f3b99ec9a4aa24c281f93b500466552af776b00f0a33182386a62934c3e553561cbc23d3f5ebb0ea0366c04e046e1bcc90

  • SSDEEP

    98304:wSiW4opH4opH4op4U9tNz9RGa/xlbLP/h4:ZDBDBD1t3Hbb+

Score
8/10
discoveryevasionexecutionpersistenceprivilege_escalation

Malware Config

Targets

    • Target

      CheatEngine75.exe

    • Size

      3.1MB

    • MD5

      609fea742d34dc1d53f0eeb4873b1a0a

    • SHA1

      3232c52da3cb8f47a870162a35cdd75fcae60aea

    • SHA256

      e2e15826b69778e381f25ac8f2b109a377b23f7cf79b5f482e81f4d28c30f95e

    • SHA512

      27da89901268d153fd7158162fc8f2f3b99ec9a4aa24c281f93b500466552af776b00f0a33182386a62934c3e553561cbc23d3f5ebb0ea0366c04e046e1bcc90

    • SSDEEP

      98304:wSiW4opH4opH4op4U9tNz9RGa/xlbLP/h4:ZDBDBD1t3Hbb+

    Score
    8/10
    discoveryevasionexecutionpersistenceprivilege_escalation

    • Creates new service(s)

      persistenceexecution

    • Downloads MZ/PE file

    • Drops file in Drivers directory

    • Stops running service(s)

      evasionexecution

    • Executes dropped EXE

    • Loads dropped DLL

    • Modifies file permissions

      discovery

    • Adds Run key to start application

      persistence

    • Checks for any installed AV software in registry

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

System Services

2
T1569

Service Execution

2
T1569.002

Persistence

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Create or Modify System Process

2
T1543

Windows Service

2
T1543.003

Event Triggered Execution

1
T1546

Netsh Helper DLL

1
T1546.007

Privilege Escalation

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Create or Modify System Process

2
T1543

Windows Service

2
T1543.003

Event Triggered Execution

1
T1546

Netsh Helper DLL

1
T1546.007

Defense Evasion

File and Directory Permissions Modification

1
T1222

Impair Defenses

1
T1562

Modify Registry

2
T1112

Subvert Trust Controls

1
T1553

Install Root Certificate

1
T1553.004

Credential Access

Discovery

Browser Information Discovery

1
T1217

Query Registry

3
T1012

Software Discovery

1
T1518

Security Software Discovery

1
T1518.001

System Information Discovery

3
T1082

System Location Discovery

1
T1614

System Language Discovery

1
T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Service Stop

1
T1489

Tasks