Overview
overview
10Static
static
1Best Fortn...nt.bat
windows10-2004-x64
1Best Fortn...ns.exe
windows10-2004-x64
1Best Fortn...er.exe
windows10-2004-x64
10Best Fortn...ps.bat
windows10-2004-x64
1Best Fortn...Up.lnk
windows10-2004-x64
7Best Fortn...d).bat
windows10-2004-x64
6Best Fortn...er.bat
windows10-2004-x64
8Best Fortn...t).bat
windows10-2004-x64
3Analysis
-
max time kernel
1562s -
max time network
1502s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
06-04-2024 13:25
Static task
static1
Behavioral task
behavioral1
Sample
Best Fortnite Tweaks/Best Fortnite Tweaks/0. Start/Make a restore point.bat
Resource
win10v2004-20240226-en
Behavioral task
behavioral2
Sample
Best Fortnite Tweaks/Best Fortnite Tweaks/1. Disable startup apps via autoruns/Autoruns.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral3
Sample
Best Fortnite Tweaks/Best Fortnite Tweaks/2. Windows Update Blocker/Windows Update Blocker.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral4
Sample
Best Fortnite Tweaks/Best Fortnite Tweaks/3. Uninstall Useless Apps/Uninstall Useless Apps.bat
Resource
win10v2004-20240226-en
Behavioral task
behavioral5
Sample
Best Fortnite Tweaks/Best Fortnite Tweaks/5. Clean Useless files/Disk Clean-Up.lnk
Resource
win10v2004-20240319-en
Behavioral task
behavioral6
Sample
Best Fortnite Tweaks/Best Fortnite Tweaks/6. Completely Optimize Your pc/Open MOH.PREMIUM.TWEAKS (Discord).bat
Resource
win10v2004-20240226-en
Behavioral task
behavioral7
Sample
Best Fortnite Tweaks/Best Fortnite Tweaks/9. Mouse and keyboard/Mouse and keyboard Optimizer.bat
Resource
win10v2004-20240226-en
Behavioral task
behavioral8
Sample
Best Fortnite Tweaks/Best Fortnite Tweaks/Tutorial (run this to open it).bat
Resource
win10v2004-20240226-en
General
-
Target
Best Fortnite Tweaks/Best Fortnite Tweaks/9. Mouse and keyboard/Mouse and keyboard Optimizer.bat
-
Size
11KB
-
MD5
e677c38cccec3aafd45c8f3dd5eaff66
-
SHA1
fc30b9f148ecfc926b699dbd0f814939b9a69f93
-
SHA256
c43e8cebf524659241a7595bd8dd3472f3e0751feadb42216a36f7bdcd9461e0
-
SHA512
52b5e69a00940c198698648c53abf6616d0a2fac5a287280e0e8a3e3ed5db3d3ec43c88ad20170c2c8fd9b128002e8ec5afa4bf745af75e4f0d56e332600ea7f
-
SSDEEP
96:60N/DixveGUIwegcDYUcRcc2scM0cGpj1awtWxEtWkNJmjRLTfJxR7a0B:zN/D+veBiwky0cGpjIuJmjRPJxQ2
Malware Config
Signatures
-
Sets file execution options in registry 2 TTPs 6 IoCs
Processes:
reg.exereg.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\csrss.exe\PerfOptions reg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options reg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\csrss.exe reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\csrss.exe\PerfOptions\CpuPriorityClass = "4" reg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\csrss.exe\PerfOptions reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\csrss.exe\PerfOptions\IoPriority = "3" reg.exe -
Delays execution with timeout.exe 9 IoCs
Processes:
timeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exepid process 4428 timeout.exe 1416 timeout.exe 4084 timeout.exe 1904 timeout.exe 4552 timeout.exe 1004 timeout.exe 2752 timeout.exe 860 timeout.exe 4728 timeout.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
svchost.exedescription pid process Token: SeManageVolumePrivilege 2880 svchost.exe -
Suspicious use of WriteProcessMemory 44 IoCs
Processes:
cmd.exedescription pid process target process PID 3696 wrote to memory of 1896 3696 cmd.exe chcp.com PID 3696 wrote to memory of 1896 3696 cmd.exe chcp.com PID 3696 wrote to memory of 2752 3696 cmd.exe timeout.exe PID 3696 wrote to memory of 2752 3696 cmd.exe timeout.exe PID 3696 wrote to memory of 1508 3696 cmd.exe reg.exe PID 3696 wrote to memory of 1508 3696 cmd.exe reg.exe PID 3696 wrote to memory of 4428 3696 cmd.exe timeout.exe PID 3696 wrote to memory of 4428 3696 cmd.exe timeout.exe PID 3696 wrote to memory of 4468 3696 cmd.exe reg.exe PID 3696 wrote to memory of 4468 3696 cmd.exe reg.exe PID 3696 wrote to memory of 1416 3696 cmd.exe timeout.exe PID 3696 wrote to memory of 1416 3696 cmd.exe timeout.exe PID 3696 wrote to memory of 4076 3696 cmd.exe reg.exe PID 3696 wrote to memory of 4076 3696 cmd.exe reg.exe PID 3696 wrote to memory of 4084 3696 cmd.exe timeout.exe PID 3696 wrote to memory of 4084 3696 cmd.exe timeout.exe PID 3696 wrote to memory of 4940 3696 cmd.exe reg.exe PID 3696 wrote to memory of 4940 3696 cmd.exe reg.exe PID 3696 wrote to memory of 3444 3696 cmd.exe reg.exe PID 3696 wrote to memory of 3444 3696 cmd.exe reg.exe PID 3696 wrote to memory of 5040 3696 cmd.exe reg.exe PID 3696 wrote to memory of 5040 3696 cmd.exe reg.exe PID 3696 wrote to memory of 652 3696 cmd.exe reg.exe PID 3696 wrote to memory of 652 3696 cmd.exe reg.exe PID 3696 wrote to memory of 1904 3696 cmd.exe timeout.exe PID 3696 wrote to memory of 1904 3696 cmd.exe timeout.exe PID 3696 wrote to memory of 448 3696 cmd.exe reg.exe PID 3696 wrote to memory of 448 3696 cmd.exe reg.exe PID 3696 wrote to memory of 860 3696 cmd.exe timeout.exe PID 3696 wrote to memory of 860 3696 cmd.exe timeout.exe PID 3696 wrote to memory of 752 3696 cmd.exe reg.exe PID 3696 wrote to memory of 752 3696 cmd.exe reg.exe PID 3696 wrote to memory of 4552 3696 cmd.exe timeout.exe PID 3696 wrote to memory of 4552 3696 cmd.exe timeout.exe PID 3696 wrote to memory of 2388 3696 cmd.exe reg.exe PID 3696 wrote to memory of 2388 3696 cmd.exe reg.exe PID 3696 wrote to memory of 1004 3696 cmd.exe timeout.exe PID 3696 wrote to memory of 1004 3696 cmd.exe timeout.exe PID 3696 wrote to memory of 1164 3696 cmd.exe reg.exe PID 3696 wrote to memory of 1164 3696 cmd.exe reg.exe PID 3696 wrote to memory of 2908 3696 cmd.exe reg.exe PID 3696 wrote to memory of 2908 3696 cmd.exe reg.exe PID 3696 wrote to memory of 4728 3696 cmd.exe timeout.exe PID 3696 wrote to memory of 4728 3696 cmd.exe timeout.exe
Processes
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\Best Fortnite Tweaks\Best Fortnite Tweaks\9. Mouse and keyboard\Mouse and keyboard Optimizer.bat"1⤵
- Suspicious use of WriteProcessMemory
PID:3696 -
C:\Windows\system32\chcp.comchcp 650012⤵PID:1896
-
C:\Windows\system32\timeout.exetimeout /t 1 /nobreak2⤵
- Delays execution with timeout.exe
PID:2752 -
C:\Windows\system32\reg.exeReg.exe add "HKCU\Control Panel\Accessibility\Keyboard Response" /v "Flags" /t REG_SZ /d "122" /f2⤵PID:1508
-
C:\Windows\system32\timeout.exetimeout /t 1 /nobreak2⤵
- Delays execution with timeout.exe
PID:4428 -
C:\Windows\system32\reg.exeReg.exe add "HKCU\Control Panel\Accessibility\ToggleKeys" /v "Flags" /t REG_SZ /d "58" /f2⤵PID:4468
-
C:\Windows\system32\timeout.exetimeout /t 1 /nobreak2⤵
- Delays execution with timeout.exe
PID:1416 -
C:\Windows\system32\reg.exeReg.exe add "HKCU\Control Panel\Accessibility\StickyKeys" /v "Flags" /t REG_SZ /d "506" /f2⤵PID:4076
-
C:\Windows\system32\timeout.exetimeout /t 1 /nobreak2⤵
- Delays execution with timeout.exe
PID:4084 -
C:\Windows\system32\reg.exeReg.exe add "HKCU\Control Panel\Accessibility\MouseKeys" /v "Flags" /t REG_SZ /d "0" /f2⤵PID:4940
-
C:\Windows\system32\reg.exeReg.exe add "HKCU\Control Panel\Mouse" /v "MouseSpeed" /t REG_SZ /d "0" /f2⤵PID:3444
-
C:\Windows\system32\reg.exeReg.exe add "HKCU\Control Panel\Mouse" /v "MouseThreshold1" /t REG_SZ /d "0" /f2⤵PID:5040
-
C:\Windows\system32\reg.exeReg.exe add "HKCU\Control Panel\Mouse" /v "MouseThreshold2" /t REG_SZ /d "0" /f2⤵PID:652
-
C:\Windows\system32\timeout.exetimeout /t 1 /nobreak2⤵
- Delays execution with timeout.exe
PID:1904 -
C:\Windows\system32\reg.exeReg.exe add "HKCU\Control Panel\Mouse" /v "MouseSensitivity" /t REG_SZ /d "10" /f2⤵PID:448
-
C:\Windows\system32\timeout.exetimeout /t 1 /nobreak2⤵
- Delays execution with timeout.exe
PID:860 -
C:\Windows\system32\reg.exeReg.exe add "HKCU\Control Panel\Keyboard" /v "KeyboardDelay" /t REG_SZ /d "0" /f2⤵PID:752
-
C:\Windows\system32\timeout.exetimeout /t 1 /nobreak2⤵
- Delays execution with timeout.exe
PID:4552 -
C:\Windows\system32\reg.exeReg.exe add "HKCU\Control Panel\Keyboard" /v "KeyboardSpeed" /t REG_SZ /d "31" /f2⤵PID:2388
-
C:\Windows\system32\timeout.exetimeout /t 1 /nobreak2⤵
- Delays execution with timeout.exe
PID:1004 -
C:\Windows\system32\reg.exeReg.exe add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\csrss.exe\PerfOptions" /v "CpuPriorityClass" /t REG_DWORD /d "4" /f2⤵
- Sets file execution options in registry
PID:1164 -
C:\Windows\system32\reg.exeReg.exe add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\csrss.exe\PerfOptions" /v "IoPriority" /t REG_DWORD /d "3" /f2⤵
- Sets file execution options in registry
PID:2908 -
C:\Windows\system32\timeout.exetimeout /t 1 /nobreak2⤵
- Delays execution with timeout.exe
PID:4728
-
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" "C:\Windows\SYSTEM32\EDGEHTML.dll",#141 Microsoft.VCLibs.140.00_8wekyb3d8bbwe1⤵PID:4044
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k UnistackSvcGroup1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2880