7db3465af572c659119fd7da0d51d1a348016a2f4ee1f5e8af6fbaedd529fd5c

Analysis

max time kernel
499s
max time network
503s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
25-01-2023 21:29

Target

Atlas-Fortnite-Spoofer-v3-updated-main/FTSpoofer v4.rar
Size

5.9MB
MD5

b3ff557cdcfc25c9a9758e786e816c74
SHA1

43adc310f4e075934725ff94a9cb75c9309de534
SHA256

184e03f9d289f0b50c3002afe56631ce17c7b9dd69f0d0584c6cf57f315d11d1
SHA512

486e465ba9beb6963821741aa31bce1e975fd27b15936979e4ebb7ebebe39203d34b74418f6d8e6acec2f8b30b14d78277d37991e1bd4165590a283fc423bd8e
SSDEEP

98304:fPkA2UIdH3X3PIQ5e8Rl4/7ZPR0pGvjM42ThuHOqqctTwizmZhIsTAy3nvEcAKC3:kAZVQ5HY/7Zu+jM4quHOawizmvI1yvAZ

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies registry class 3 IoCs

Processes:

cmd.exeOpenWith.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000_Classes\.rar	OpenWith.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

Processes:

vlc.exe

pid process

3128 vlc.exe
Suspicious behavior: GetForegroundWindowSpam 2 IoCs

Processes:

OpenWith.exevlc.exe

pid process

2328 OpenWith.exe
3128 vlc.exe
Suspicious use of FindShellTrayWindow 9 IoCs

Processes:

vlc.exe

pid process

3128 vlc.exe
3128 vlc.exe
3128 vlc.exe
3128 vlc.exe
3128 vlc.exe
3128 vlc.exe
3128 vlc.exe
3128 vlc.exe
3128 vlc.exe
Suspicious use of SendNotifyMessage 8 IoCs

Processes:

vlc.exe

pid process

3128 vlc.exe
3128 vlc.exe
3128 vlc.exe
3128 vlc.exe
3128 vlc.exe
3128 vlc.exe
3128 vlc.exe
3128 vlc.exe
Suspicious use of SetWindowsHookEx 6 IoCs

Processes:

OpenWith.exevlc.exe

pid process

2328 OpenWith.exe
2328 OpenWith.exe
2328 OpenWith.exe
2328 OpenWith.exe
2328 OpenWith.exe
3128 vlc.exe
Suspicious use of WriteProcessMemory 2 IoCs

Processes:

OpenWith.exe

description pid process target process

PID 2328 wrote to memory of 3128 2328 OpenWith.exe vlc.exe
PID 2328 wrote to memory of 3128 2328 OpenWith.exe vlc.exe

pid	process
3128	vlc.exe

pid	process
2328	OpenWith.exe
3128	vlc.exe

description	pid	process	target process
PID 2328 wrote to memory of 3128	2328	OpenWith.exe	vlc.exe
PID 2328 wrote to memory of 3128	2328	OpenWith.exe	vlc.exe

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\Atlas-Fortnite-Spoofer-v3-updated-main\FTSpoofer v4.rar"
1⤵
- Modifies registry class
PID:752

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4080

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact