General
-
Target
CheatEngine75.exe
-
Size
28.5MB
-
Sample
241026-f3hd9a1grn
-
MD5
ce2eed10fdd3e7e555391da0c3a5542e
-
SHA1
e9025b0124c3ed08f8964cc8c52ddb5739357d81
-
SHA256
ed74ed0f828003774fa8658fd64a47d2cb0130fe41f06e90cd5c9fdb7bbb500c
-
SHA512
81abb4d84f4bde6c22415ba47a3d05b494f71037c0a055625109c0f742280292a506e62ae86ba58f7c986722267fd595a5b6e85602a1e7ed67a37b6b9de8f514
-
SSDEEP
786432:ml3LNCxuEnwFho+zM77UDZiZCd08jFZJAI5E70TZFHJ5:ml3LMEXFhV0KAcNjxAItj/
Static task
static1
Behavioral task
behavioral1
Sample
CheatEngine75.exe
Resource
win7-20241010-en
Behavioral task
behavioral2
Sample
CheatEngine75.exe
Resource
win10v2004-20241007-en
Malware Config
Targets
-
-
Target
CheatEngine75.exe
-
Size
28.5MB
-
MD5
ce2eed10fdd3e7e555391da0c3a5542e
-
SHA1
e9025b0124c3ed08f8964cc8c52ddb5739357d81
-
SHA256
ed74ed0f828003774fa8658fd64a47d2cb0130fe41f06e90cd5c9fdb7bbb500c
-
SHA512
81abb4d84f4bde6c22415ba47a3d05b494f71037c0a055625109c0f742280292a506e62ae86ba58f7c986722267fd595a5b6e85602a1e7ed67a37b6b9de8f514
-
SSDEEP
786432:ml3LNCxuEnwFho+zM77UDZiZCd08jFZJAI5E70TZFHJ5:ml3LMEXFhV0KAcNjxAItj/
-
Adds Run key to start application
-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Checks for any installed AV software in registry
-
Downloads MZ/PE file
-
Event Triggered Execution: Image File Execution Options Injection
-
Writes to the Master Boot Record (MBR)
Bootkits write to the MBR to gain persistence at a level below the operating system.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Event Triggered Execution: Component Object Model Hijacking
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
-
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
2Active Setup
1Registry Run Keys / Startup Folder
1Event Triggered Execution
2Component Object Model Hijacking
1Image File Execution Options Injection
1Pre-OS Boot
1Bootkit
1Privilege Escalation
Boot or Logon Autostart Execution
2Active Setup
1Registry Run Keys / Startup Folder
1Event Triggered Execution
2Component Object Model Hijacking
1Image File Execution Options Injection
1Defense Evasion
Modify Registry
4Pre-OS Boot
1Bootkit
1Subvert Trust Controls
1Install Root Certificate
1Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Discovery
Browser Information Discovery
1Peripheral Device Discovery
1Query Registry
7Software Discovery
1Security Software Discovery
1System Information Discovery
7System Location Discovery
1System Language Discovery
1System Network Configuration Discovery
1Internet Connection Discovery
1