1a151aebec02f3a5dcf44e0301567088a1789ea1d6e81a69fc4242d7a0fd9265

Analysis

max time kernel
21s
max time network
19s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
16/03/2024, 06:13

Target

fortnite-external-evo.gj-master/evo.gj/cheat/aimbot/aimbot.cpp
Size

1KB
MD5

6e4305cc9ba359cf10beb3b35bbfc84a
SHA1

81d62af2ba6bf0f4c92d2523552fcea0f43b87ff
SHA256

0f56f2490a12820726c4f21298b518fb40cc0fed9f4028d3ecbcde33f1b45d55
SHA512

6bbde68a29ac80ee40f5086474b8a0dd43c934a777989b1165879236335b57c76846290162ed19870408940578526c4ab903aee03cab34d6346b04477512ecc2

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 12 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_Classes\Local Settings	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\.cpp\ = "cpp_auto_file"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\cpp_auto_file\shell	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\cpp_auto_file\shell\edit\command	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\cpp_auto_file\shell\open\command\ = "%SystemRoot%\\system32\\NOTEPAD.EXE %1"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\cpp_auto_file	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\cpp_auto_file\	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\.cpp	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\cpp_auto_file\shell\edit	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\cpp_auto_file\shell\edit\command\ = "%SystemRoot%\\system32\\NOTEPAD.EXE %1"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\cpp_auto_file\shell\open	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\cpp_auto_file\shell\open\command	rundll32.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 1952 wrote to memory of 2624	1952	cmd.exe	29
PID 1952 wrote to memory of 2624	1952	cmd.exe	29
PID 1952 wrote to memory of 2624	1952	cmd.exe	29
PID 2624 wrote to memory of 2264	2624	rundll32.exe	30
PID 2624 wrote to memory of 2264	2624	rundll32.exe	30
PID 2624 wrote to memory of 2264	2624	rundll32.exe	30

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\fortnite-external-evo.gj-master\evo.gj\cheat\aimbot\aimbot.cpp
1⤵
- Suspicious use of WriteProcessMemory
PID:1952
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\fortnite-external-evo.gj-master\evo.gj\cheat\aimbot\aimbot.cpp
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2624
- - C:\Windows\system32\NOTEPAD.EXE
    "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\Temp\fortnite-external-evo.gj-master\evo.gj\cheat\aimbot\aimbot.cpp
    3⤵
    PID:2264

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact