30cfcb63f3bfc1d3710fafec912040fe591b3ac1d442a29789fe28a8412dd113

General

Target

FortniteLauncher.exe
Size

34.4MB
MD5

8288fa56718ae7ffb3c6c3e7be7eb9e4
SHA1

a86827d83a3800928f6b4a22b8b853f9fc5275e7
SHA256

866efa2bd9932ad477e96c3829c1b1d202bddf9f536e23825a5bcb2bc2d0107d
SHA512

26fe82ff95c81ee7a645679d597b529b6bc3658f68bc39f36ec4c3a2c0f461199093a97006481345eef9921047becebb918aec81932d7c42629bb2a655d3c16f
SSDEEP

786432:bu55/xE6TpX5ovBt/F9zX04rMdlRtTJouvuD4v3K+tvF4+aXQgHiln:a5tvTTovTTL044dlf9ounv3JttfaXQU

Score

8^/10

persistence

Malware Config

Signatures

Registers COM server for autorun 1 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000_Classes\CLSID\{d20bfa03-c969-fcc2-e70f-45f385f2c53e}\LocalServer32	FortniteLauncher.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000_Classes\CLSID\{d20bfa03-c969-fcc2-e70f-45f385f2c53e}\LocalServer32\ = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\FortniteLauncher.exe\" -ToastActivated"	FortniteLauncher.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{d20bfa03-c969-fcc2-e70f-45f385f2c53e}\LocalServer32	FortniteLauncher.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{d20bfa03-c969-fcc2-e70f-45f385f2c53e}\LocalServer32\ = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\FortniteLauncher.exe\" -ToastActivated"	FortniteLauncher.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Control Panel\International\Geo\Nation	FortniteLauncher.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4756	4944	WerFault.exe	80

Modifies registry class 17 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000_Classes\CLSID	FortniteLauncher.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{d20bfa03-c969-fcc2-e70f-45f385f2c53e}\LocalServer32\ = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\FortniteLauncher.exe\" -ToastActivated"	FortniteLauncher.exe
Key created	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000_Classes\AppUserModelId	FortniteLauncher.exe
Key created	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000_Classes\CLSID\{d20bfa03-c969-fcc2-e70f-45f385f2c53e}\LocalServer32	FortniteLauncher.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{d20bfa03-c969-fcc2-e70f-45f385f2c53e}\AppId = "{d20bfa03-c969-fcc2-e70f-45f385f2c53e}"	FortniteLauncher.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{d20bfa03-c969-fcc2-e70f-45f385f2c53e}	FortniteLauncher.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000_Classes\AppUserModelId\C:/Users/Admin/AppData/Local/Temp/FortniteLauncher.exe\IconUri = "C:\\Users\\Admin\\AppData\\Local\\ToastNotificationManagerCompat\\Apps\\D20BFA03-C969-FCC2-E70F-45F385F2C53E\\Icon.png"	FortniteLauncher.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{d20bfa03-c969-fcc2-e70f-45f385f2c53e}	FortniteLauncher.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{d20bfa03-c969-fcc2-e70f-45f385f2c53e}\LocalServer32	FortniteLauncher.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{d20bfa03-c969-fcc2-e70f-45f385f2c53e}\RunAs = "Interactive User"	FortniteLauncher.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000_Classes\AppUserModelId\C:/Users/Admin/AppData/Local/Temp/FortniteLauncher.exe\DisplayName = "EraLauncher"	FortniteLauncher.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000_Classes\AppUserModelId\C:/Users/Admin/AppData/Local/Temp/FortniteLauncher.exe\Has7.0.1Fix = "1"	FortniteLauncher.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000_Classes\CLSID\{d20bfa03-c969-fcc2-e70f-45f385f2c53e}\LocalServer32\ = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\FortniteLauncher.exe\" -ToastActivated"	FortniteLauncher.exe
Key created	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000_Classes\AppUserModelId\C:/Users/Admin/AppData/Local/Temp/FortniteLauncher.exe	FortniteLauncher.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000_Classes\AppUserModelId\C:/Users/Admin/AppData/Local/Temp/FortniteLauncher.exe\IconBackgroundColor = "FFDDDDDD"	FortniteLauncher.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000_Classes\AppUserModelId\C:/Users/Admin/AppData/Local/Temp/FortniteLauncher.exe\CustomActivator = "{d20bfa03-c969-fcc2-e70f-45f385f2c53e}"	FortniteLauncher.exe
Key created	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000_Classes\CLSID\{d20bfa03-c969-fcc2-e70f-45f385f2c53e}	FortniteLauncher.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4944	FortniteLauncher.exe

C:\Users\Admin\AppData\Local\Temp\FortniteLauncher.exe
"C:\Users\Admin\AppData\Local\Temp\FortniteLauncher.exe"
1⤵
- Registers COM server for autorun
- Checks computer location settings
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:4944
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 4944 -s 2092
  2⤵
  - Program crash
  PID:4756

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 184 -p 4944 -ip 4944
1⤵
PID:2248

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4944-132-0x00007FFF6F780000-0x00007FFF70241000-memory.dmp

Filesize
10.8MB

Download
memory/4944-133-0x00000257BC780000-0x00000257BE9E6000-memory.dmp

Filesize
34.4MB

Download
memory/4944-134-0x00000257BEE70000-0x00000257BEE7E000-memory.dmp

Filesize
56KB

Download
memory/4944-135-0x00000257DDAC0000-0x00000257DDAC8000-memory.dmp

Filesize
32KB

Download
memory/4944-136-0x00000257DFA30000-0x00000257DFA68000-memory.dmp

Filesize
224KB

Download
memory/4944-137-0x00000257DF9F0000-0x00000257DF9FE000-memory.dmp

Filesize
56KB

Download
memory/4944-138-0x00007FFF6F780000-0x00007FFF70241000-memory.dmp

Filesize
10.8MB

Download
memory/4944-139-0x00000257E0BB0000-0x00000257E0BD8000-memory.dmp

Filesize
160KB

Download
memory/4944-140-0x00000257DFB60000-0x00000257DFB6A000-memory.dmp

Filesize
40KB

Download
memory/4944-141-0x00000257DFB70000-0x00000257DFB78000-memory.dmp

Filesize
32KB

Download
memory/4944-142-0x00000257E4BC0000-0x00000257E4BE6000-memory.dmp

Filesize
152KB

Download
memory/4944-143-0x00007FFF6F780000-0x00007FFF70241000-memory.dmp

Filesize
10.8MB

Download

Analysis

Sharing