Analysis
- max time kernel
422s - max time network
266s - platform
windows10-2004_x64 - resource
win10v2004-en-20220113 - submitted
04/02/2022, 23:49
Static task
static1
Behavioral task
behavioral1
Sample
delete fortnie cheat + spoofer/deletefortnitecheat.exe
Resource
win7-en-20211208
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
delete fortnie cheat + spoofer/deletefortnitecheat.exe
Resource
win10v2004-en-20220113
windows10-2004_x64
0 signatures
0 seconds
Behavioral task
behavioral3
Sample
delete fortnie cheat + spoofer/deletespoofer.exe
Resource
win7-en-20211208
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral4
Sample
delete fortnie cheat + spoofer/deletespoofer.exe
Resource
win10v2004-en-20220113
windows10-2004_x64
0 signatures
0 seconds
General
- Target delete fortnie cheat + spoofer/deletefortnitecheat.exe
- Size 271KB
- Sample220204-3va2jafghm
- SHA256 c82d2bb57555ea8f65b5a37841044b2d5f569ea16955358ed55b03ea0a0eed14
- MD5 9bbf2e88e6ba430797350cbaaaccc532
- SHA1 0d32ac3a2cba07cdda18c18844bfd77babc586bc
- SHA512 f2b5ff57a8ce0bf5d23892a96492ef081db6db88553075cb05e5c6f3c08b5a7e17bb25e2536afae601de21f9ea493e0fd7f4fbf22e4b62fd7061aeb667ade25d
- MD5 SHA1 SHA512
Score
8/10
Malware Config
Signatures
- Sets service image path in registry 2 TTPs
- Drops file in Windows directory 6 IoCs
description ioc Process File opened for modification C:\Windows\SoftwareDistribution\ReportingEvents.log svchost.exe File opened for modification C:\Windows\WindowsUpdate.log svchost.exe File opened for modification C:\Windows\SoftwareDistribution\DataStore\Logs\edb.chk svchost.exe File opened for modification C:\Windows\SoftwareDistribution\DataStore\Logs\edb.log svchost.exe File opened for modification C:\Windows\SoftwareDistribution\DataStore\DataStore.edb svchost.exe File opened for modification C:\Windows\SoftwareDistribution\DataStore\DataStore.jfm svchost.exe - Modifies data under HKEY_USERS 41 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust WaaSMedicAgent.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3808 deletefortnitecheat.exe 3808 deletefortnitecheat.exe 3808 deletefortnitecheat.exe 3808 deletefortnitecheat.exe 3808 deletefortnitecheat.exe 3808 deletefortnitecheat.exe 3808 deletefortnitecheat.exe 3808 deletefortnitecheat.exe 3808 deletefortnitecheat.exe 3808 deletefortnitecheat.exe 3808 deletefortnitecheat.exe 3808 deletefortnitecheat.exe 3808 deletefortnitecheat.exe 3808 deletefortnitecheat.exe 3808 deletefortnitecheat.exe 3808 deletefortnitecheat.exe 3808 deletefortnitecheat.exe 3808 deletefortnitecheat.exe 3808 deletefortnitecheat.exe 3808 deletefortnitecheat.exe 3808 deletefortnitecheat.exe 3808 deletefortnitecheat.exe 3808 deletefortnitecheat.exe 3808 deletefortnitecheat.exe 3808 deletefortnitecheat.exe 3808 deletefortnitecheat.exe 3808 deletefortnitecheat.exe 3808 deletefortnitecheat.exe 3808 deletefortnitecheat.exe 3808 deletefortnitecheat.exe 3808 deletefortnitecheat.exe 3808 deletefortnitecheat.exe 3808 deletefortnitecheat.exe 3808 deletefortnitecheat.exe 3808 deletefortnitecheat.exe 3808 deletefortnitecheat.exe 3808 deletefortnitecheat.exe 3808 deletefortnitecheat.exe 3808 deletefortnitecheat.exe 3808 deletefortnitecheat.exe 3808 deletefortnitecheat.exe 3808 deletefortnitecheat.exe 3808 deletefortnitecheat.exe 3808 deletefortnitecheat.exe 3808 deletefortnitecheat.exe 3808 deletefortnitecheat.exe 3808 deletefortnitecheat.exe 3808 deletefortnitecheat.exe 3808 deletefortnitecheat.exe 3808 deletefortnitecheat.exe 3808 deletefortnitecheat.exe 3808 deletefortnitecheat.exe 3808 deletefortnitecheat.exe 3808 deletefortnitecheat.exe 3808 deletefortnitecheat.exe 3808 deletefortnitecheat.exe 3808 deletefortnitecheat.exe 3808 deletefortnitecheat.exe 3808 deletefortnitecheat.exe 3808 deletefortnitecheat.exe 3808 deletefortnitecheat.exe 3808 deletefortnitecheat.exe 3808 deletefortnitecheat.exe 3808 deletefortnitecheat.exe - Suspicious use of AdjustPrivilegeToken 6 IoCs
description pid Process Token: SeShutdownPrivilege 1132 svchost.exe Token: SeCreatePagefilePrivilege 1132 svchost.exe Token: SeShutdownPrivilege 1132 svchost.exe Token: SeCreatePagefilePrivilege 1132 svchost.exe Token: SeShutdownPrivilege 1132 svchost.exe Token: SeCreatePagefilePrivilege 1132 svchost.exe - Suspicious use of WriteProcessMemory 2 IoCs
description pid Process procid_target PID 3808 wrote to memory of 2032 3808 deletefortnitecheat.exe 83 PID 3808 wrote to memory of 2032 3808 deletefortnitecheat.exe 83
Processes
-
C:\Users\Admin\AppData\Local\Temp\delete fortnie cheat + spoofer\deletefortnitecheat.exe"C:\Users\Admin\AppData\Local\Temp\delete fortnie cheat + spoofer\deletefortnitecheat.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3808 -
C:\Windows\explorer.exe"C:\Windows\explorer.exe"2⤵PID:2032
-
-
C:\Windows\System32\WaaSMedicAgent.exeC:\Windows\System32\WaaSMedicAgent.exe e24fbc8135560032edb82aa7a9874cfb Q/195sg+A0+K/6RUnRZBxA.0.1.0.0.01⤵
- Modifies data under HKEY_USERS
PID:2624
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s wuauserv1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:1132