Analysis by: Joshua John Bantayan
ALIASES:

AdWare.Win32.OpenCandy.aa (KASPERSKY); Riskware/OpenCandy (FORTINET)

 PLATFORM:

Windows

 OVERALL RISK RATING:
 DAMAGE POTENTIAL:
 DISTRIBUTION POTENTIAL:
 REPORTED INFECTION:
 INFORMATION EXPOSURE:

  • Threat Type: Hacking Tool

  • Destructiveness: No

  • Encrypted:

  • In the wild: Yes

  OVERVIEW

This Hacking Tool arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

  TECHNICAL DETAILS

File Size: 9,052,192 bytes
File Type: EXE
Initial Samples Received Date: 25 Mar 2021

Arrival Details

This Hacking Tool arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Installation

This Hacking Tool drops the following files:

  • %Desktop%\Cheat Engine.lnk
  • %Common Programs%\Cheat Engine 6.4\Cheat Engine 6.4.lnk
  • %Common Programs%\Cheat Engine 6.4\Cheat Engine 6.4 (32-bit).lnk
  • %Common Programs%\Cheat Engine 6.4\Cheat Engine 6.4 (64-bit).lnk
  • %Common Programs%\Cheat Engine 6.4\Cheat Engine tutorial.lnk
  • %Common Programs%\Cheat Engine 6.4\Cheat Engine help.lnk
  • %Common Programs%\Cheat Engine 6.4\Kernel stuff\Unload kernel module.lnk
  • %Common Programs%\Cheat Engine 6.4\Reset settings.lnk
  • %Common Programs%\Cheat Engine 6.4\main.lua.lnk
  • %Common Programs%\Cheat Engine 6.4\Uninstall Cheat Engine.lnk
  • %Program Files%\Cheat Engine 6.4\unins000.msg
  • %Program Files%\Cheat Engine 6.4\unins000.dat
  • %Program Files%\Cheat Engine 6.4\unins000.exe
  • %Program Files%\Cheat Engine 6.4\Cheat Engine.exe
  • %Program Files%\Cheat Engine 6.4\cheatengine-i386.exe
  • %Program Files%\Cheat Engine 6.4\cheatengine-i386.exe.sig
  • %Program Files%\Cheat Engine 6.4\cheatengine-x86_64.exe
  • %Program Files%\Cheat Engine 6.4\cheatengine-x86_64.exe.sig
  • %Program Files%\Cheat Engine 6.4\win32\dbghelp.dll
  • %Program Files%\Cheat Engine 6.4\vmdisk.img
  • %Program Files%\Cheat Engine 6.4\vmdisk.img.sig
  • %Program Files%\Cheat Engine 6.4\speedhack-i386.dll
  • %Program Files%\Cheat Engine 6.4\speedhack-x86_64.dll
  • %Program Files%\Cheat Engine 6.4\vehdebug-i386.dll
  • %Program Files%\Cheat Engine 6.4\vehdebug-x86_64.dll
  • %Program Files%\Cheat Engine 6.4\allochook-i386.dll
  • %Program Files%\Cheat Engine 6.4\allochook-x86_64.dll
  • %Program Files%\Cheat Engine 6.4\lua5.1-32.dll
  • %Program Files%\Cheat Engine 6.4\lua5.1-64.dll
  • %Program Files%\Cheat Engine 6.4\luaclient-i386.dll
  • %Program Files%\Cheat Engine 6.4\luaclient-x86_64.dll
  • %Program Files%\Cheat Engine 6.4\DotNetDataCollector32.exe
  • %Program Files%\Cheat Engine 6.4\DotNetDataCollector64.exe
  • %Program Files%\Cheat Engine 6.4\d3dhook.dll
  • %Program Files%\Cheat Engine 6.4\ced3d9hook.dll
  • %Program Files%\Cheat Engine 6.4\ced3d10hook.dll
  • %Program Files%\Cheat Engine 6.4\ced3d11hook.dll
  • %Program Files%\Cheat Engine 6.4\d3dhook64.dll
  • %Program Files%\Cheat Engine 6.4\ced3d9hook64.dll
  • %Program Files%\Cheat Engine 6.4\ced3d10hook64.dll
  • %Program Files%\Cheat Engine 6.4\ced3d11hook64.dll
  • %Program Files%\Cheat Engine 6.4\overlay.fx
  • %Program Files%\Cheat Engine 6.4\tiny.dat
  • %Program Files%\Cheat Engine 6.4\standalonephase1.dat
  • %Program Files%\Cheat Engine 6.4\standalonephase2.dat
  • %Program Files%\Cheat Engine 6.4\xmplayer.exe
  • %Program Files%\Cheat Engine 6.4\languages\language.ini
  • %Program Files%\Cheat Engine 6.4\languages\cheatengine-x86_64.po
  • %Program Files%\Cheat Engine 6.4\languages\tutorial-x86_64.po
  • %Program Files%\Cheat Engine 6.4\languages\lclstrconsts.po
  • %Program Files%\Cheat Engine 6.4\languages\How to add languages.txt
  • %Program Files%\Cheat Engine 6.4\commonmodulelist.txt
  • %Program Files%\Cheat Engine 6.4\donottrace.txt
  • %Program Files%\Cheat Engine 6.4\ceregreset.exe
  • %Program Files%\Cheat Engine 6.4\Kernelmoduleunloader.exe
  • %Program Files%\Cheat Engine 6.4\Kernelmoduleunloader.exe.sig
  • %Program Files%\Cheat Engine 6.4\dbk32.sys
  • %Program Files%\Cheat Engine 6.4\dbk64.sys
  • %Program Files%\Cheat Engine 6.4\main.lua
  • %Program Files%\Cheat Engine 6.4\defines.lua
  • %Program Files%\Cheat Engine 6.4\autorun\Lua files in this folder get executed automatically.txt
  • %Program Files%\Cheat Engine 6.4\autorun\java.lua
  • %Program Files%\Cheat Engine 6.4\autorun\javaclass.lua
  • %Program Files%\Cheat Engine 6.4\autorun\javaClassEditor.lua
  • %Program Files%\Cheat Engine 6.4\autorun\monoscript.lua
  • %Program Files%\Cheat Engine 6.4\autorun\forms\MonoDataCollector.frm
  • %Program Files%\Cheat Engine 6.4\autorun\dlls\MonoDataCollector.dll
  • %Program Files%\Cheat Engine 6.4\autorun\dlls\32\CEJVMTI.dll
  • %Program Files%\Cheat Engine 6.4\autorun\dlls\64\CEJVMTI.dll
  • %Program Files%\Cheat Engine 6.4\autorun\dlls\src\Java\CEJVMTI\CEJVMTI.sln
  • %Program Files%\Cheat Engine 6.4\autorun\dlls\src\Java\CEJVMTI\CEJVMTI\CEJVMTI.cpp
  • %Program Files%\Cheat Engine 6.4\autorun\dlls\src\Java\CEJVMTI\CEJVMTI\CEJVMTI.h
  • %Program Files%\Cheat Engine 6.4\autorun\dlls\src\Java\CEJVMTI\CEJVMTI\CEJVMTI.vcproj
  • %Program Files%\Cheat Engine 6.4\autorun\dlls\src\Java\CEJVMTI\CEJVMTI\dllmain.cpp
  • %Program Files%\Cheat Engine 6.4\autorun\dlls\src\Java\CEJVMTI\CEJVMTI\JavaEventServer.cpp
  • %Program Files%\Cheat Engine 6.4\autorun\dlls\src\Java\CEJVMTI\CEJVMTI\JavaEventServer.h
  • %Program Files%\Cheat Engine 6.4\autorun\dlls\src\Java\CEJVMTI\CEJVMTI\JavaServer.cpp
  • %Program Files%\Cheat Engine 6.4\autorun\dlls\src\Java\CEJVMTI\CEJVMTI\JavaServer.h
  • %Program Files%\Cheat Engine 6.4\autorun\dlls\src\Java\CEJVMTI\CEJVMTI\stdafx.cpp
  • %Program Files%\Cheat Engine 6.4\autorun\dlls\src\Java\CEJVMTI\CEJVMTI\stdafx.h
  • %Program Files%\Cheat Engine 6.4\autorun\dlls\src\Java\CEJVMTI\CEJVMTI\targetver.h
  • %Program Files%\Cheat Engine 6.4\autorun\dlls\src\Mono\MonoDataCollector.sln
  • %Program Files%\Cheat Engine 6.4\autorun\dlls\src\Mono\MonoDataCollector\dllmain.cpp
  • %Program Files%\Cheat Engine 6.4\autorun\dlls\src\Mono\MonoDataCollector\Metadata.h
  • %Program Files%\Cheat Engine 6.4\autorun\dlls\src\Mono\MonoDataCollector\MonoDataCollector.cpp
  • %Program Files%\Cheat Engine 6.4\autorun\dlls\src\Mono\MonoDataCollector\MonoDataCollector.h
  • %Program Files%\Cheat Engine 6.4\autorun\dlls\src\Mono\MonoDataCollector\MonoDataCollector.vcproj
  • %Program Files%\Cheat Engine 6.4\autorun\dlls\src\Mono\MonoDataCollector\PipeServer.cpp
  • %Program Files%\Cheat Engine 6.4\autorun\dlls\src\Mono\MonoDataCollector\PipeServer.h
  • %Program Files%\Cheat Engine 6.4\autorun\dlls\src\Mono\MonoDataCollector\stdafx.cpp
  • %Program Files%\Cheat Engine 6.4\autorun\dlls\src\Mono\MonoDataCollector\targetver.h
  • %Program Files%\Cheat Engine 6.4\autorun\dlls\src\Common\Pipe.cpp
  • %Program Files%\Cheat Engine 6.4\autorun\dlls\src\Common\Pipe.h
  • %Program Files%\Cheat Engine 6.4\CheatEngine.chm
  • %Program Files%\Cheat Engine 6.4\Tutorial-i386.exe
  • %Program Files%\Cheat Engine 6.4\Tutorial-x86_64.exe
  • %Program Files%\Cheat Engine 6.4\plugins\cepluginsdk.h
  • %Program Files%\Cheat Engine 6.4\plugins\cepluginsdk.pas
  • %Program Files%\Cheat Engine 6.4\Plugins\example-c\example-c-32bit.dll
  • %Program Files%\Cheat Engine 6.4\Plugins\example-c\example-c-64bit.dll
  • %Program Files%\Cheat Engine 6.4\plugins\example-c\bla.cpp
  • %Program Files%\Cheat Engine 6.4\plugins\example-c\bla.h
  • %Program Files%\Cheat Engine 6.4\Plugins\example-c\example-c.c
  • %Program Files%\Cheat Engine 6.4\Plugins\example-c\example-c.def
  • %Program Files%\Cheat Engine 6.4\Plugins\example-c\example-c.sln
  • %Program Files%\Cheat Engine 6.4\Plugins\example-c\example-c.vcproj
  • %Program Files%\Cheat Engine 6.4\Plugins\example-lazarus\exampleplugin.lpi
  • %Program Files%\Cheat Engine 6.4\Plugins\example-lazarus\exampleplugin.lpr
  • %Program Files%\Cheat Engine 6.4\Plugins\example-lazarus\Unit1.pas
  • %Program Files%\Cheat Engine 6.4\Plugins\DebugEventLog\src\DebugEventLog.lpi
  • %Program Files%\Cheat Engine 6.4\Plugins\DebugEventLog\src\DebugEventLog.lpr
  • %Program Files%\Cheat Engine 6.4\Plugins\DebugEventLog\src\DebugEventLog.res
  • %Program Files%\Cheat Engine 6.4\Plugins\DebugEventLog\src\exportimplementation.pas
  • %Program Files%\Cheat Engine 6.4\Plugins\DebugEventLog\src\frmEventLogUnit.lfm
  • %Program Files%\Cheat Engine 6.4\Plugins\DebugEventLog\src\frmEventLogUnit.pas

(Note: %Desktop% is the current user's desktop, which is usually C:\Documents and Settings\{User Name}\Desktop on Windows 2000(32-bit), XP, and Server 2003(32-bit), or C:\Users\{user name}\Desktop on Windows Vista, 7, 8, 8.1, 2008(64-bit), 2012(64-bit) and 10(64-bit).. %Common Programs% is the folder that contains common program groups for all users, which is usually C:\Documents and Settings\All Users\Start Menu\Programs on Windows 2000, XP, and Server 2003, or C:\ProgramData\Microsoft\Windows\Start Menu\Programs on Windows Vista, 7, and 8.. %Program Files% is the default Program Files folder, usually C:\Program Files in Windows 2000(32-bit), Server 2003(32-bit), XP, Vista(64-bit), 7, 8, 8.1, 2008(64-bit), 2012(64-bit) and 10(64-bit) , or C:\Program Files (x86) in Windows XP(64-bit), Vista(64-bit), 7(64-bit), 8(64-bit), 8.1(64-bit), 2008(64-bit), 2012(64-bit) and 10(64-bit).)

It adds the following processes:

  • %Desktop%\Samples\gamecheat\cheat.exe
  • "%User Temp%\is-T7GP2.tmp\cheat.tmp" /SL5="$D054A,8784541,54272,%Desktop%\Samples\gamecheat\cheat.exe"
  • RunDll32.exe "%User Temp%\is-J5PEK.tmp\OCSetupHlp.dll",_OCPID736OpenCandy2@16 3272,CB15CB1E8B7E480E96E7D6A55B320944,0F2A60F7D3C742F2960180E35D09B682,55069E753EA04D83997A774A7250B5BB
  • "%Program Files%\Cheat Engine 6.4\Kernelmoduleunloader.exe" /SETUP
  • "%Program Files%\Cheat Engine 6.4\Cheat Engine.exe"
  • "%Program Files%\Cheat Engine 6.4\cheatengine-i386.exe"

(Note: %Desktop% is the current user's desktop, which is usually C:\Documents and Settings\{User Name}\Desktop on Windows 2000(32-bit), XP, and Server 2003(32-bit), or C:\Users\{user name}\Desktop on Windows Vista, 7, 8, 8.1, 2008(64-bit), 2012(64-bit) and 10(64-bit).. %User Temp% is the current user's Temp folder, which is usually C:\Documents and Settings\{user name}\Local Settings\Temp on Windows 2000(32-bit), XP, and Server 2003(32-bit), or C:\Users\{user name}\AppData\Local\Temp on Windows Vista, 7, 8, 8.1, 2008(64-bit), 2012(64-bit) and 10(64-bit).. %Program Files% is the default Program Files folder, usually C:\Program Files in Windows 2000(32-bit), Server 2003(32-bit), XP, Vista(64-bit), 7, 8, 8.1, 2008(64-bit), 2012(64-bit) and 10(64-bit) , or C:\Program Files (x86) in Windows XP(64-bit), Vista(64-bit), 7(64-bit), 8(64-bit), 8.1(64-bit), 2008(64-bit), 2012(64-bit) and 10(64-bit).)

Other System Modifications

This Hacking Tool adds the following registry entries:

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
.CETRAINER
" " = CheatEngine

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
.CT
" " = CheatEngine

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CheatEngine
" " = CheatEngine

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CheatEngine\DefaultIcon
" " = %Program Files%\Cheat Engine 6.4\Cheat Engine.exe,0

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CheatEngine\shell\open\
command
" " = "%Program Files%\Cheat Engine 6.4\Cheat Engine.exe" "%1"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Uninstall\
Cheat Engine 6.4_is1
Inno Setup: Setup Version = 5.4.0 (a)

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Uninstall\
Cheat Engine 6.4_is1
Inno Setup: App Path = %Program Files%\Cheat Engine 6.4

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Uninstall\
Cheat Engine 6.4_is1
InstallLocation = %Program Files%\Cheat Engine 6.4\

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Uninstall\
Cheat Engine 6.4_is1
Inno Setup: Icon Group = Cheat Engine 6.4

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Uninstall\
Cheat Engine 6.4_is1
Inno Setup: User = {User name}

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Uninstall\
Cheat Engine 6.4_is1
Inno Setup: Selected = desktopicon

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Uninstall\
Cheat Engine 6.4_is1
Inno Setup: Deselected Tasks = " "

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Uninstall\
Cheat Engine 6.4_is1
Inno Setup: Language = default

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Uninstall\
Cheat Engine 6.4_is1
DisplayName = Cheat Engine 6.4

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Uninstall\
Cheat Engine 6.4_is1
UninstallString = "%Program Files%\Cheat Engine 6.4\unins000.exe"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Uninstall\
Cheat Engine 6.4_is1
QuietUninstallString = "%Program Files%\Cheat Engine 6.4\unins000.exe" /SILENT

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Uninstall\
Cheat Engine 6.4_is1
Publisher = Cheat Engine

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Uninstall\
Cheat Engine 6.4_is1
URLInfoAbout = http://www.{BLOCKED}ngine.org/

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Uninstall\
Cheat Engine 6.4_is1
HelpLink = http://www.{BLOCKED}ngine.org/

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Uninstall\
Cheat Engine 6.4_is1
URLUpdateInfo = http://www.{BLOCKED}ngine.org/

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Uninstall\
Cheat Engine 6.4_is1
NoModify = 1

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Uninstall\
Cheat Engine 6.4_is1
NoRepair = 1

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Uninstall\
Cheat Engine 6.4_is1
InstallDate = {current date}

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Uninstall\
Cheat Engine 6.4_is1
EstimatedSize = 31760

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Explorer
GlobalAssocChangedCounter = 36

HKEY_CURRENT_USER\Software\Cheat Engine
First Time User = 0

Other Details

This Hacking Tool adds the following registry keys:

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CheatEngine

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CheatEngine\DefaultIcon

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CheatEngine\shell

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CheatEngine\shell\open

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CheatEngine\shell\open\
command

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
.CETRAINER

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
.CT

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Uninstall\
Cheat Engine 6.4_is1

HKEY_CURRENT_USER\Software\Cheat Engine

HKEY_CURRENT_USER\Software\Cheat Engine\
Java

It connects to the following possibly malicious URL:

  • dnsapi.{BLOCKED}ndy.com

  SOLUTION

Minimum Scan Engine: 9.800
SSAPI PATTERN File: 2.357.00
SSAPI PATTERN Date: 27 Nov 2020

Step 1

Before doing any scans, Windows 7, Windows 8, Windows 8.1, and Windows 10 users must disable System Restore to allow full scanning of their computers.

Step 2

Note that not all files, folders, and registry keys and entries are installed on your computer during this malware's/spyware's/grayware's execution. This may be due to incomplete installation or other operating system conditions. If you do not find the same files/folders/registry information, please proceed to the next step.

Step 3

Remove HackTool.Win32.GameHack.A by using its own Uninstall option

[ Learn More ]
To uninstall the grayware process

Step 4

Scan your computer with your Trend Micro product to delete files detected as HackTool.Win32.GameHack.A. If the detected files have already been cleaned, deleted, or quarantined by your Trend Micro product, no further step is required. You may opt to simply delete the quarantined files. Please check the following Trend Micro Support pages for more information:


Did this description help? Tell us how we did.