Overview
overview
5Static
static
3Cheat Engine.zip
windows11-21h2-x64
1Cheat Engi...32.exe
windows11-21h2-x64
3Cheat Engi...64.exe
windows11-21h2-x64
1Cheat Engi...64.exe
windows11-21h2-x64
1Cheat Engi...et.exe
windows11-21h2-x64
3Cheat Engi...86.exe
windows11-21h2-x64
5Cheat Engi...X2.exe
windows11-21h2-x64
5Cheat Engi...64.exe
windows11-21h2-x64
5Cheat Engi...86.exe
windows11-21h2-x64
3Cheat Engi...64.exe
windows11-21h2-x64
1Cheat Engi...00.exe
windows11-21h2-x64
4Cheat Engi...ir.exe
windows11-21h2-x64
3Analysis
- max time kernel
149s - max time network
150s - platform
windows11-21h2_x64 - resource
win11-20260513-uk - resource tags
arch:x64arch:x86image:win11-20260513-uklocale:uk-uaos:windows11-21h2-x64systemwindows - submitted
02/07/2026, 14:35
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
Cheat Engine.zip
Resource
win11-20260513-uk
windows11-21h2-x64
0 signatures
150 seconds
Behavioral task
behavioral2
Sample
Cheat Engine/DotNetDataCollector32.exe
Resource
win11-20260513-uk
windows11-21h2-x64
2 signatures
150 seconds
Behavioral task
behavioral3
Sample
Cheat Engine/DotNetDataCollector64.exe
Resource
win11-20260513-uk
windows11-21h2-x64
1 signatures
150 seconds
Behavioral task
behavioral4
Sample
Cheat Engine/Tutorial-x86_64.exe
Resource
win11-20260513-uk
windows11-21h2-x64
0 signatures
150 seconds
Behavioral task
behavioral5
Sample
Cheat Engine/ceregreset.exe
Resource
win11-20260513-uk
windows11-21h2-x64
1 signatures
150 seconds
Behavioral task
behavioral6
Sample
Cheat Engine/cheatengine-i386.exe
Resource
win11-20260513-uk
windows11-21h2-x64
8 signatures
150 seconds
Behavioral task
behavioral7
Sample
Cheat Engine/cheatengine-x86_64-SSE4-AVX2.exe
Resource
win11-20260513-uk
windows11-21h2-x64
6 signatures
150 seconds
Behavioral task
behavioral8
Sample
Cheat Engine/cheatengine-x86_64.exe
Resource
win11-20260513-uk
windows11-21h2-x64
6 signatures
150 seconds
Behavioral task
behavioral9
Sample
Cheat Engine/gtutorial-i386.exe
Resource
win11-20260513-uk
windows11-21h2-x64
1 signatures
150 seconds
Behavioral task
behavioral10
Sample
Cheat Engine/gtutorial-x86_64.exe
Resource
win11-20260513-uk
windows11-21h2-x64
0 signatures
150 seconds
Behavioral task
behavioral11
Sample
Cheat Engine/unins000.exe
Resource
win11-20260513-uk
windows11-21h2-x64
3 signatures
150 seconds
Behavioral task
behavioral12
Sample
Cheat Engine/windowsrepair.exe
Resource
win11-20260513-uk
windows11-21h2-x64
1 signatures
150 seconds
General
- Target Cheat Engine/cheatengine-x86_64-SSE4-AVX2.exe
- Size 17.7MB
- Sample260702-rydfaads5m
- SHA256 9d861d651ab9d1dc3c09ae34c8ed5dee3d1a29b080784c3c48773494c9350230
- MD5 28ec07010c396fb6943d5e554b9e5b26
- SHA1 c8620259c701fe012c8a20df49c496226634d66c
- SHA512 c7a02e7fe6ca24284738cf6a58063f19bfe9ec405aa6f66a25b33f12c15aec579e8713faebf6fb5af83fa69f4a7be059627c80084050217c1a2d4fb4ff52e989
- SSDEEP 393216:SCTKSJgVy21aJpbq1XEfHPX1qLYAbVjBtsMNHe8U:rTbq+HKB55eV
- TLSH T10D175BBBB6729B98C0CAC17155878BE15F31BD240876134732D5331E9FB68805EA9E8F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
5/10
Malware Config
Signatures
- Drops file in System32 directory 64 IoCs
description ioc Process File opened for modification C:\Windows\SYSTEM32\WINNSI.DLL cheatengine-x86_64-SSE4-AVX2.exe File opened for modification C:\Windows\System32\advapi32.dll cheatengine-x86_64-SSE4-AVX2.exe File opened for modification C:\Windows\SYSTEM32\GLU32.dll cheatengine-x86_64-SSE4-AVX2.exe File opened for modification C:\Windows\SYSTEM32\DEVOBJ.dll cheatengine-x86_64-SSE4-AVX2.exe File opened for modification C:\Windows\SYSTEM32\atlthunk.dll cheatengine-x86_64-SSE4-AVX2.exe File opened for modification C:\Windows\system32\schannel.DLL cheatengine-x86_64-SSE4-AVX2.exe File opened for modification C:\Windows\SYSTEM32\mskeyprotect.dll cheatengine-x86_64-SSE4-AVX2.exe File opened for modification C:\Windows\SYSTEM32\bcrypt.dll cheatengine-x86_64-SSE4-AVX2.exe File opened for modification C:\Windows\SYSTEM32\version.dll cheatengine-x86_64-SSE4-AVX2.exe File opened for modification C:\Windows\SYSTEM32\opengl32.dll cheatengine-x86_64-SSE4-AVX2.exe File opened for modification C:\Windows\System32\RPCRT4.dll cheatengine-x86_64-SSE4-AVX2.exe File opened for modification C:\Windows\System32\SHLWAPI.dll cheatengine-x86_64-SSE4-AVX2.exe File opened for modification C:\Windows\SYSTEM32\hhctrl.ocx cheatengine-x86_64-SSE4-AVX2.exe File opened for modification C:\Windows\SYSTEM32\SspiCli.dll cheatengine-x86_64-SSE4-AVX2.exe File opened for modification C:\Windows\System32\rasadhlp.dll cheatengine-x86_64-SSE4-AVX2.exe File opened for modification C:\Windows\System32\oleaut32.dll cheatengine-x86_64-SSE4-AVX2.exe File opened for modification C:\Windows\SYSTEM32\wsock32.dll cheatengine-x86_64-SSE4-AVX2.exe File opened for modification C:\Windows\SYSTEM32\IPHLPAPI.DLL cheatengine-x86_64-SSE4-AVX2.exe File opened for modification C:\Windows\System32\imagehlp.dll cheatengine-x86_64-SSE4-AVX2.exe File opened for modification C:\Windows\System32\clbcatq.dll cheatengine-x86_64-SSE4-AVX2.exe File opened for modification C:\Windows\system32\explorerframe.dll cheatengine-x86_64-SSE4-AVX2.exe File opened for modification C:\Windows\SYSTEM32\CoreMessaging.dll cheatengine-x86_64-SSE4-AVX2.exe File opened for modification C:\Windows\SYSTEM32\DUser.dll cheatengine-x86_64-SSE4-AVX2.exe File opened for modification C:\Windows\system32\ncryptsslp.dll cheatengine-x86_64-SSE4-AVX2.exe File opened for modification C:\Windows\system32\uxtheme.dll cheatengine-x86_64-SSE4-AVX2.exe File opened for modification C:\Windows\SYSTEM32\TextShaping.dll cheatengine-x86_64-SSE4-AVX2.exe File opened for modification C:\Windows\SYSTEM32\inputhost.dll cheatengine-x86_64-SSE4-AVX2.exe File opened for modification C:\Windows\System32\CRYPT32.dll cheatengine-x86_64-SSE4-AVX2.exe File opened for modification C:\Windows\SYSTEM32\MSASN1.dll cheatengine-x86_64-SSE4-AVX2.exe File opened for modification C:\Windows\System32\shell32.dll cheatengine-x86_64-SSE4-AVX2.exe File opened for modification C:\Windows\System32\ws2_32.dll cheatengine-x86_64-SSE4-AVX2.exe File opened for modification C:\Windows\SYSTEM32\PROPSYS.dll cheatengine-x86_64-SSE4-AVX2.exe File opened for modification C:\Windows\SYSTEM32\Xinput1_4.dll cheatengine-x86_64-SSE4-AVX2.exe File opened for modification C:\Windows\SYSTEM32\cfgmgr32.dll cheatengine-x86_64-SSE4-AVX2.exe File opened for modification C:\Windows\SYSTEM32\NTASN1.dll cheatengine-x86_64-SSE4-AVX2.exe File opened for modification C:\Windows\System32\GDI32.dll cheatengine-x86_64-SSE4-AVX2.exe File opened for modification C:\Windows\System32\psapi.dll cheatengine-x86_64-SSE4-AVX2.exe File opened for modification C:\Windows\SYSTEM32\kernel.appcore.dll cheatengine-x86_64-SSE4-AVX2.exe File opened for modification C:\Windows\System32\bcryptPrimitives.dll cheatengine-x86_64-SSE4-AVX2.exe File opened for modification C:\Windows\SYSTEM32\webio.dll cheatengine-x86_64-SSE4-AVX2.exe File opened for modification C:\Windows\SYSTEM32\DNSAPI.dll cheatengine-x86_64-SSE4-AVX2.exe File opened for modification C:\Windows\System32\gdi32full.dll cheatengine-x86_64-SSE4-AVX2.exe File opened for modification C:\Windows\SYSTEM32\windows.storage.dll cheatengine-x86_64-SSE4-AVX2.exe File opened for modification C:\Windows\System32\KERNELBASE.dll cheatengine-x86_64-SSE4-AVX2.exe File opened for modification C:\Windows\System32\shcore.dll cheatengine-x86_64-SSE4-AVX2.exe File opened for modification C:\Windows\System32\fwpuclnt.dll cheatengine-x86_64-SSE4-AVX2.exe File opened for modification C:\Windows\SYSTEM32\winmm.dll cheatengine-x86_64-SSE4-AVX2.exe File opened for modification C:\Windows\SYSTEM32\wintypes.dll cheatengine-x86_64-SSE4-AVX2.exe File opened for modification C:\Windows\System32\NSI.dll cheatengine-x86_64-SSE4-AVX2.exe File opened for modification C:\Windows\SYSTEM32\DPAPI.DLL cheatengine-x86_64-SSE4-AVX2.exe File opened for modification C:\Windows\SYSTEM32\ntdll.dll cheatengine-x86_64-SSE4-AVX2.exe File opened for modification C:\Windows\System32\win32u.dll cheatengine-x86_64-SSE4-AVX2.exe File opened for modification C:\Windows\System32\msvcp_win.dll cheatengine-x86_64-SSE4-AVX2.exe File opened for modification C:\Windows\SYSTEM32\msimg32.dll cheatengine-x86_64-SSE4-AVX2.exe File opened for modification C:\Windows\SYSTEM32\ncrypt.dll cheatengine-x86_64-SSE4-AVX2.exe File opened for modification C:\Windows\System32\KERNEL32.DLL cheatengine-x86_64-SSE4-AVX2.exe File opened for modification C:\Windows\SYSTEM32\textinputframework.dll cheatengine-x86_64-SSE4-AVX2.exe File opened for modification C:\Windows\system32\mswsock.dll cheatengine-x86_64-SSE4-AVX2.exe File opened for modification C:\Windows\System32\ucrtbase.dll cheatengine-x86_64-SSE4-AVX2.exe File opened for modification C:\Windows\System32\combase.dll cheatengine-x86_64-SSE4-AVX2.exe File opened for modification C:\Windows\System32\msvcrt.dll cheatengine-x86_64-SSE4-AVX2.exe File opened for modification C:\Windows\System32\ole32.dll cheatengine-x86_64-SSE4-AVX2.exe File opened for modification C:\Windows\SYSTEM32\dwmapi.dll cheatengine-x86_64-SSE4-AVX2.exe File opened for modification C:\Windows\System32\MSCTF.dll cheatengine-x86_64-SSE4-AVX2.exe - Drops file in Windows directory 1 IoCs
description ioc Process File opened for modification C:\Windows\WinSxS\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.22000.120_none_9d947278b86cc467\comctl32.dll cheatengine-x86_64-SSE4-AVX2.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Suspicious use of AdjustPrivilegeToken 16 IoCs
description pid Process Token: SeDebugPrivilege 3764 cheatengine-x86_64-SSE4-AVX2.exe Token: SeTcbPrivilege 3764 cheatengine-x86_64-SSE4-AVX2.exe Token: SeTcbPrivilege 3764 cheatengine-x86_64-SSE4-AVX2.exe Token: SeLoadDriverPrivilege 3764 cheatengine-x86_64-SSE4-AVX2.exe Token: SeCreateGlobalPrivilege 3764 cheatengine-x86_64-SSE4-AVX2.exe Token: SeLockMemoryPrivilege 3764 cheatengine-x86_64-SSE4-AVX2.exe Token: 33 3764 cheatengine-x86_64-SSE4-AVX2.exe Token: SeSecurityPrivilege 3764 cheatengine-x86_64-SSE4-AVX2.exe Token: SeTakeOwnershipPrivilege 3764 cheatengine-x86_64-SSE4-AVX2.exe Token: SeManageVolumePrivilege 3764 cheatengine-x86_64-SSE4-AVX2.exe Token: SeBackupPrivilege 3764 cheatengine-x86_64-SSE4-AVX2.exe Token: SeCreatePagefilePrivilege 3764 cheatengine-x86_64-SSE4-AVX2.exe Token: SeShutdownPrivilege 3764 cheatengine-x86_64-SSE4-AVX2.exe Token: SeRestorePrivilege 3764 cheatengine-x86_64-SSE4-AVX2.exe Token: 33 3764 cheatengine-x86_64-SSE4-AVX2.exe Token: SeIncBasePriorityPrivilege 3764 cheatengine-x86_64-SSE4-AVX2.exe - Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 3764 cheatengine-x86_64-SSE4-AVX2.exe - Suspicious use of WriteProcessMemory 1 IoCs
description pid Process procid_target PID 3764 wrote to memory of 2832 3764 cheatengine-x86_64-SSE4-AVX2.exe 80
Processes
-
C:\Users\Admin\AppData\Local\Temp\Cheat Engine\cheatengine-x86_64-SSE4-AVX2.exe"C:\Users\Admin\AppData\Local\Temp\Cheat Engine\cheatengine-x86_64-SSE4-AVX2.exe"1⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:3764 -
C:\Users\Admin\AppData\Local\Temp\Cheat Engine\Tutorial-x86_64.exe"C:\Users\Admin\AppData\Local\Temp\Cheat Engine\Tutorial-x86_64.exe"2⤵PID:2832
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\Cheat Engine\ExceptionAutoSave_noname.ct
- Size 142B
- SHA256 df3daba3a699b6d7ab4475e170a0a9c4f8c519b298527ef3c9d9cb9ed5059873
- MD5 3bf254bcf45367ac0e271002f7fbf4f9
- SHA1 0a9450a92e6440297afb2974f80661ac116bf2df
- SHA512 adec0b2180e738ccfa9d2911186bd4172a023bcdea23c4b5255bd1d14612086581b0806fd2cbdd0088daa1679df21d4ccdb94c812aff4683ab8d1e8a9222bd72
- TLSH T163C08C24938078394A7089E0121E481812A0B69329501C7C6C464A3B8B0B4240082E30
- MD5 SHA1 SHA512 TLSH