f1e17f0fcc295945bfc6c51e78350ff9c378285e8b4ef33d5b692e3e81159327

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240419-en
resource tags

arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
submitted
11-05-2024 09:49

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Fortnite-Injector.pyc
Size

69KB
MD5

325d7e26bc0ca8e0af0698c895b2822d
SHA1

7bf75d5ba9bf1cb9369e0977452d622367252f36
SHA256

9730c8a6656a264f5f59a5e3c4a392c5085361c36cfd8ba51793b310defb5d71
SHA512

9730c171ad07f663cf642ee72935f94e4c086bbdd45f17cd6dda69136cfbde967cba2ebe482ebe76aca8b7059c56837cd87e4a5db6c21c8767f5239b1c268f0d
SSDEEP

768:3nAIw3pYBdbM8v9YTNqvELkdI+2p3BXTxGVru1E7eNs0u9iAnjCenr+2n9n:3w3pyd1cdxZs0u9vmort

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 9 IoCs

Processes:

rundll32.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000_CLASSES\pyc_auto_file\shell\Read	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000_CLASSES\pyc_auto_file\shell	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000_CLASSES\pyc_auto_file\shell\Read\command	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000_CLASSES\pyc_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\""	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000_Classes\Local Settings	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000_CLASSES\pyc_auto_file	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000_CLASSES\pyc_auto_file\	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000_CLASSES\.pyc	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000_CLASSES\.pyc\ = "pyc_auto_file"	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

AcroRd32.exe

pid process

2680 AcroRd32.exe
Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

AcroRd32.exe

pid process

2680 AcroRd32.exe
2680 AcroRd32.exe

pid	process
2680	AcroRd32.exe

pid	process
2680	AcroRd32.exe
2680	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

cmd.exerundll32.exe

description	pid	process	target process
PID 3024 wrote to memory of 2628	3024	cmd.exe	rundll32.exe
PID 3024 wrote to memory of 2628	3024	cmd.exe	rundll32.exe
PID 3024 wrote to memory of 2628	3024	cmd.exe	rundll32.exe
PID 2628 wrote to memory of 2680	2628	rundll32.exe	AcroRd32.exe
PID 2628 wrote to memory of 2680	2628	rundll32.exe	AcroRd32.exe
PID 2628 wrote to memory of 2680	2628	rundll32.exe	AcroRd32.exe
PID 2628 wrote to memory of 2680	2628	rundll32.exe	AcroRd32.exe

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\Fortnite-Injector.pyc
1⤵
- Suspicious use of WriteProcessMemory
PID:3024

C:\Windows\system32\rundll32.exe
"C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\Fortnite-Injector.pyc
2⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2628

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\Fortnite-Injector.pyc"
3⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2680

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents
Filesize
3KB

MD5
c891f4808e525b24bf8393fa09a8a7e0

SHA1
ddd9bc215bbf160da97b451c4c603d2fa13c4280

SHA256
1c3fde00b1f22349a8a5da6dd3422e664ffc12bfbca7b5f748c92c7163abca5b

SHA512
e8969b353acb01a8eb58f97e19ba56bc34e2a91f4e1c238386e2706f4c43145efed37a447b02ad56cc2ee666337797631f9f8d74288800bb711dfe4d4dc2996a

Download Submit