ca6d4462d7f57c219043efbe84a1b6ac402c731a17cf822ca1b209cb1c0150c3

General

Target

Subz.rar
Size

705KB
MD5

f0703571bafb59196a372099890a8be8
SHA1

bb5358a9e54a77aab91bf1a3b47a0c675f76d2aa
SHA256

ca6d4462d7f57c219043efbe84a1b6ac402c731a17cf822ca1b209cb1c0150c3
SHA512

6c32f6ec2ef40d7d03966af20d382d5b6f10b1ca0a3516945ca50a970c394b04d07b7dad22ba8a52bc7b86d50f59d61ba3beed2e7d3fc416c2831906f02ce6c8
SSDEEP

12288:Tu8+l+Wm099Yycps+UZMyYWzKvVNGUZOw0WsoDwuCGCq6RheXuAIxP43tZtqLg:acHuSHpshZZ/zGKUZOTW1DojEpvt0g

Score

8^/10

persistence

Malware Config

Signatures

Sets service image path in registry 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

INJECTOR.EXE

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\frAQBc8Wsa1xVPfv\ImagePath = "\\??\\C:\\Users\\Admin\\AppData\\Local\\Temp\\frAQBc8Wsa1xVPfv"	INJECTOR.EXE

Executes dropped EXE 3 IoCs

Processes:

injector_1.exeINJECTOR (2).EXEINJECTOR.EXE

pid process

2452 injector_1.exe
2420 INJECTOR (2).EXE
2544 INJECTOR.EXE
Loads dropped DLL 7 IoCs

Processes:

injector_1.exeWerFault.exe

pid process

2452 injector_1.exe
2452 injector_1.exe
2708 WerFault.exe
2708 WerFault.exe
2708 WerFault.exe
2708 WerFault.exe
2708 WerFault.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2708 2420 WerFault.exe INJECTOR (2).EXE

pid	process
2452	injector_1.exe
2420	INJECTOR (2).EXE
2544	INJECTOR.EXE

pid	process
2452	injector_1.exe
2452	injector_1.exe
2708	WerFault.exe
2708	WerFault.exe
2708	WerFault.exe
2708	WerFault.exe
2708	WerFault.exe

pid	pid_target	process	target process
2708	2420	WerFault.exe	INJECTOR (2).EXE

Kills process with taskkill 63 IoCs

evasion

Processes:

taskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exe

pid	process
2788	taskkill.exe
688	taskkill.exe
1312	taskkill.exe
808	taskkill.exe
2212	taskkill.exe
1284	taskkill.exe
404	taskkill.exe
2992	taskkill.exe
1320	taskkill.exe
900	taskkill.exe
1252	taskkill.exe
3028	taskkill.exe
2964	taskkill.exe
804	taskkill.exe
2192	taskkill.exe
2584	taskkill.exe
2796	taskkill.exe
3044	taskkill.exe
1496	taskkill.exe
2396	taskkill.exe
2112	taskkill.exe
2792	taskkill.exe
2920	taskkill.exe
1440	taskkill.exe
2916	taskkill.exe
2344	taskkill.exe
2656	taskkill.exe
948	taskkill.exe
2920	taskkill.exe
1812	taskkill.exe
1912	taskkill.exe
1844	taskkill.exe
2540	taskkill.exe
2024	taskkill.exe
2720	taskkill.exe
1768	taskkill.exe
1028	taskkill.exe
2216	taskkill.exe
2968	taskkill.exe
2740	taskkill.exe
1808	taskkill.exe
1956	taskkill.exe
2536	taskkill.exe
2928	taskkill.exe
2964	taskkill.exe
2192	taskkill.exe
1504	taskkill.exe
3004	taskkill.exe
2764	taskkill.exe
1748	taskkill.exe
2916	taskkill.exe
836	taskkill.exe
2228	taskkill.exe
2996	taskkill.exe
640	taskkill.exe
2944	taskkill.exe
2304	taskkill.exe
380	taskkill.exe
2208	taskkill.exe
2844	taskkill.exe
2512	taskkill.exe
896	taskkill.exe
888	taskkill.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

Processes:

7zFM.exe

pid process

2564 7zFM.exe
2564 7zFM.exe
2564 7zFM.exe
Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

7zFM.exe

pid process

2564 7zFM.exe
Suspicious behavior: LoadsDriver 1 IoCs

Processes:

INJECTOR.EXE

pid process

2544 INJECTOR.EXE

pid	process
2564	7zFM.exe
2564	7zFM.exe
2564	7zFM.exe

pid	process
2564	7zFM.exe

pid	process
2544	INJECTOR.EXE

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

7zFM.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exeINJECTOR.EXEtaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exe

description	pid	process
Token: SeRestorePrivilege	2564	7zFM.exe
Token: 35	2564	7zFM.exe
Token: SeSecurityPrivilege	2564	7zFM.exe
Token: SeDebugPrivilege	2944	taskkill.exe
Token: SeDebugPrivilege	1812	taskkill.exe
Token: SeDebugPrivilege	1312	taskkill.exe
Token: SeDebugPrivilege	2720	taskkill.exe
Token: SeDebugPrivilege	1440	taskkill.exe
Token: SeDebugPrivilege	2740	taskkill.exe
Token: SeDebugPrivilege	2656	taskkill.exe
Token: SeDebugPrivilege	1808	taskkill.exe
Token: SeDebugPrivilege	2964	taskkill.exe
Token: SeDebugPrivilege	1912	taskkill.exe
Token: SeDebugPrivilege	1768	taskkill.exe
Token: SeDebugPrivilege	1320	taskkill.exe
Token: SeDebugPrivilege	808	taskkill.exe
Token: SeDebugPrivilege	948	taskkill.exe
Token: SeDebugPrivilege	2304	taskkill.exe
Token: SeDebugPrivilege	2212	taskkill.exe
Token: SeDebugPrivilege	2192	taskkill.exe
Token: SeDebugPrivilege	1284	taskkill.exe
Token: SeDebugPrivilege	1956	taskkill.exe
Token: SeDebugPrivilege	404	taskkill.exe
Token: SeDebugPrivilege	1504	taskkill.exe
Token: SeDebugPrivilege	2536	taskkill.exe
Token: SeDebugPrivilege	2928	taskkill.exe
Token: SeDebugPrivilege	3004	taskkill.exe
Token: SeDebugPrivilege	2112	taskkill.exe
Token: SeDebugPrivilege	2764	taskkill.exe
Token: SeDebugPrivilege	2992	taskkill.exe
Token: SeDebugPrivilege	2916	taskkill.exe
Token: SeDebugPrivilege	1252	taskkill.exe
Token: SeLoadDriverPrivilege	2544	INJECTOR.EXE
Token: SeDebugPrivilege	1748	taskkill.exe
Token: SeDebugPrivilege	900	taskkill.exe
Token: SeDebugPrivilege	836	taskkill.exe
Token: SeDebugPrivilege	804	taskkill.exe
Token: SeDebugPrivilege	2964	taskkill.exe
Token: SeDebugPrivilege	1844	taskkill.exe
Token: SeDebugPrivilege	1028	taskkill.exe
Token: SeDebugPrivilege	3044	taskkill.exe
Token: SeDebugPrivilege	2920	taskkill.exe
Token: SeDebugPrivilege	2228	taskkill.exe
Token: SeDebugPrivilege	1496	taskkill.exe
Token: SeDebugPrivilege	2216	taskkill.exe
Token: SeDebugPrivilege	2192	taskkill.exe
Token: SeDebugPrivilege	2344	taskkill.exe
Token: SeDebugPrivilege	2540	taskkill.exe
Token: SeDebugPrivilege	2788	taskkill.exe
Token: SeDebugPrivilege	3028	taskkill.exe
Token: SeDebugPrivilege	2584	taskkill.exe
Token: SeDebugPrivilege	2844	taskkill.exe
Token: SeDebugPrivilege	2512	taskkill.exe
Token: SeDebugPrivilege	2916	taskkill.exe
Token: SeDebugPrivilege	2996	taskkill.exe
Token: SeDebugPrivilege	896	taskkill.exe
Token: SeDebugPrivilege	2792	taskkill.exe
Token: SeDebugPrivilege	2968	taskkill.exe
Token: SeDebugPrivilege	380	taskkill.exe
Token: SeDebugPrivilege	2796	taskkill.exe
Token: SeDebugPrivilege	640	taskkill.exe
Token: SeDebugPrivilege	2396	taskkill.exe
Token: SeDebugPrivilege	688	taskkill.exe
Token: SeDebugPrivilege	2920	taskkill.exe

Suspicious use of FindShellTrayWindow 2 IoCs

Processes:

7zFM.exe

pid process

2564 7zFM.exe
2564 7zFM.exe

pid	process
2564	7zFM.exe
2564	7zFM.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

cmd.exe7zFM.exeinjector_1.exeINJECTOR.EXEcmd.execmd.execmd.execmd.execmd.execmd.execmd.exe

description	pid	process	target process
PID 1736 wrote to memory of 2564	1736	cmd.exe	7zFM.exe
PID 1736 wrote to memory of 2564	1736	cmd.exe	7zFM.exe
PID 1736 wrote to memory of 2564	1736	cmd.exe	7zFM.exe
PID 2564 wrote to memory of 2452	2564	7zFM.exe	injector_1.exe
PID 2564 wrote to memory of 2452	2564	7zFM.exe	injector_1.exe
PID 2564 wrote to memory of 2452	2564	7zFM.exe	injector_1.exe
PID 2564 wrote to memory of 2452	2564	7zFM.exe	injector_1.exe
PID 2452 wrote to memory of 2420	2452	injector_1.exe	INJECTOR (2).EXE
PID 2452 wrote to memory of 2420	2452	injector_1.exe	INJECTOR (2).EXE
PID 2452 wrote to memory of 2420	2452	injector_1.exe	INJECTOR (2).EXE
PID 2452 wrote to memory of 2420	2452	injector_1.exe	INJECTOR (2).EXE
PID 2452 wrote to memory of 2544	2452	injector_1.exe	INJECTOR.EXE
PID 2452 wrote to memory of 2544	2452	injector_1.exe	INJECTOR.EXE
PID 2452 wrote to memory of 2544	2452	injector_1.exe	INJECTOR.EXE
PID 2452 wrote to memory of 2544	2452	injector_1.exe	INJECTOR.EXE
PID 2544 wrote to memory of 2768	2544	INJECTOR.EXE	cmd.exe
PID 2544 wrote to memory of 2768	2544	INJECTOR.EXE	cmd.exe
PID 2544 wrote to memory of 2768	2544	INJECTOR.EXE	cmd.exe
PID 2544 wrote to memory of 2784	2544	INJECTOR.EXE	cmd.exe
PID 2544 wrote to memory of 2784	2544	INJECTOR.EXE	cmd.exe
PID 2544 wrote to memory of 2784	2544	INJECTOR.EXE	cmd.exe
PID 2544 wrote to memory of 2824	2544	INJECTOR.EXE	cmd.exe
PID 2544 wrote to memory of 2824	2544	INJECTOR.EXE	cmd.exe
PID 2544 wrote to memory of 2824	2544	INJECTOR.EXE	cmd.exe
PID 2768 wrote to memory of 2944	2768	cmd.exe	taskkill.exe
PID 2768 wrote to memory of 2944	2768	cmd.exe	taskkill.exe
PID 2768 wrote to memory of 2944	2768	cmd.exe	taskkill.exe
PID 2544 wrote to memory of 2984	2544	INJECTOR.EXE	cmd.exe
PID 2544 wrote to memory of 2984	2544	INJECTOR.EXE	cmd.exe
PID 2544 wrote to memory of 2984	2544	INJECTOR.EXE	cmd.exe
PID 2544 wrote to memory of 2728	2544	INJECTOR.EXE	cmd.exe
PID 2544 wrote to memory of 2728	2544	INJECTOR.EXE	cmd.exe
PID 2544 wrote to memory of 2728	2544	INJECTOR.EXE	cmd.exe
PID 2544 wrote to memory of 2980	2544	INJECTOR.EXE	cmd.exe
PID 2544 wrote to memory of 2980	2544	INJECTOR.EXE	cmd.exe
PID 2544 wrote to memory of 2980	2544	INJECTOR.EXE	cmd.exe
PID 2784 wrote to memory of 1812	2784	cmd.exe	taskkill.exe
PID 2784 wrote to memory of 1812	2784	cmd.exe	taskkill.exe
PID 2784 wrote to memory of 1812	2784	cmd.exe	taskkill.exe
PID 2544 wrote to memory of 876	2544	INJECTOR.EXE	cmd.exe
PID 2544 wrote to memory of 876	2544	INJECTOR.EXE	cmd.exe
PID 2544 wrote to memory of 876	2544	INJECTOR.EXE	cmd.exe
PID 2728 wrote to memory of 1440	2728	cmd.exe	taskkill.exe
PID 2728 wrote to memory of 1440	2728	cmd.exe	taskkill.exe
PID 2728 wrote to memory of 1440	2728	cmd.exe	taskkill.exe
PID 2824 wrote to memory of 1312	2824	cmd.exe	taskkill.exe
PID 2824 wrote to memory of 1312	2824	cmd.exe	taskkill.exe
PID 2824 wrote to memory of 1312	2824	cmd.exe	taskkill.exe
PID 2984 wrote to memory of 2740	2984	cmd.exe	taskkill.exe
PID 2984 wrote to memory of 2740	2984	cmd.exe	taskkill.exe
PID 2984 wrote to memory of 2740	2984	cmd.exe	taskkill.exe
PID 2980 wrote to memory of 2720	2980	cmd.exe	taskkill.exe
PID 2980 wrote to memory of 2720	2980	cmd.exe	taskkill.exe
PID 2980 wrote to memory of 2720	2980	cmd.exe	taskkill.exe
PID 876 wrote to memory of 2656	876	cmd.exe	taskkill.exe
PID 876 wrote to memory of 2656	876	cmd.exe	taskkill.exe
PID 876 wrote to memory of 2656	876	cmd.exe	taskkill.exe
PID 2544 wrote to memory of 676	2544	INJECTOR.EXE	cmd.exe
PID 2544 wrote to memory of 676	2544	INJECTOR.EXE	cmd.exe
PID 2544 wrote to memory of 676	2544	INJECTOR.EXE	cmd.exe
PID 2544 wrote to memory of 240	2544	INJECTOR.EXE	cmd.exe
PID 2544 wrote to memory of 240	2544	INJECTOR.EXE	cmd.exe
PID 2544 wrote to memory of 240	2544	INJECTOR.EXE	cmd.exe
PID 2544 wrote to memory of 1468	2544	INJECTOR.EXE	cmd.exe

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\Subz.rar
1⤵
- Suspicious use of WriteProcessMemory
PID:1736

C:\Program Files\7-Zip\7zFM.exe
"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\Subz.rar"
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:2564

C:\Users\Admin\AppData\Local\Temp\7zO40A749B6\injector_1.exe
"C:\Users\Admin\AppData\Local\Temp\7zO40A749B6\injector_1.exe"
3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2452

C:\Users\Admin\AppData\Local\Temp\INJECTOR (2).EXE
"C:\Users\Admin\AppData\Local\Temp\INJECTOR (2).EXE"
4⤵
- Executes dropped EXE
PID:2420

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2420 -s 592
5⤵
- Loads dropped DLL
- Program crash
PID:2708

C:\Users\Admin\AppData\Local\Temp\INJECTOR.EXE
"C:\Users\Admin\AppData\Local\Temp\INJECTOR.EXE"
4⤵
- Sets service image path in registry
- Executes dropped EXE
- Suspicious behavior: LoadsDriver
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2544

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /C taskkill /F /T /IM FortniteClient-Win64-Shipping.exe
5⤵
- Suspicious use of WriteProcessMemory
PID:2768

C:\Windows\system32\taskkill.exe
taskkill /F /T /IM FortniteClient-Win64-Shipping.exe
6⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2944

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /C taskkill/F /T /IM EpicGamesLauncher.exe
5⤵
- Suspicious use of WriteProcessMemory
PID:2784

C:\Windows\system32\taskkill.exe
taskkill /F /T /IM EpicGamesLauncher.exe
6⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1812

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /C taskkill/F /T /IM FortniteClient-Win64-Shipping_BE.exe
5⤵
- Suspicious use of WriteProcessMemory
PID:2824

C:\Windows\system32\taskkill.exe
taskkill /F /T /IM FortniteClient-Win64-Shipping_BE.exe
6⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1312

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /C taskkill/F /T /IM FortniteClient-Win64-Shipping_EAC.exe
5⤵
- Suspicious use of WriteProcessMemory
PID:2984

C:\Windows\system32\taskkill.exe
taskkill /F /T /IM FortniteClient-Win64-Shipping_EAC.exe
6⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2740

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /C taskkill/F /T /IM RiotClientServices.exe
5⤵
- Suspicious use of WriteProcessMemory
PID:2728

C:\Windows\system32\taskkill.exe
taskkill /F /T /IM RiotClientServices.exe
6⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1440

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /C taskkill/F /T /IM vgtray.exe
5⤵
- Suspicious use of WriteProcessMemory
PID:2980

C:\Windows\system32\taskkill.exe
taskkill /F /T /IM vgtray.exe
6⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2720

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /C taskkill/F /T /IM SteamService.exe
5⤵
- Suspicious use of WriteProcessMemory
PID:876

C:\Windows\system32\taskkill.exe
taskkill /F /T /IM SteamService.exe
6⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2656

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /C taskkill /F /T /IM FortniteClient-Win64-Shipping.exe
5⤵
PID:676

C:\Windows\system32\taskkill.exe
taskkill /F /T /IM FortniteClient-Win64-Shipping.exe
6⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2964

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /C taskkill/F /T /IM EpicGamesLauncher.exe
5⤵
PID:240

C:\Windows\system32\taskkill.exe
taskkill /F /T /IM EpicGamesLauncher.exe
6⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1808

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /C taskkill/F /T /IM FortniteClient-Win64-Shipping_BE.exe
5⤵
PID:1468

C:\Windows\system32\taskkill.exe
taskkill /F /T /IM FortniteClient-Win64-Shipping_BE.exe
6⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1320

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /C taskkill/F /T /IM FortniteClient-Win64-Shipping_EAC.exe
5⤵
PID:2292

C:\Windows\system32\taskkill.exe
taskkill /F /T /IM FortniteClient-Win64-Shipping_EAC.exe
6⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1768

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /C taskkill/F /T /IM RiotClientServices.exe
5⤵
PID:1088

C:\Windows\system32\taskkill.exe
taskkill /F /T /IM RiotClientServices.exe
6⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:808

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /C taskkill/F /T /IM vgtray.exe
5⤵
PID:1152

C:\Windows\system32\taskkill.exe
taskkill /F /T /IM vgtray.exe
6⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1912

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /C taskkill/F /T /IM SteamService.exe
5⤵
PID:2052

C:\Windows\system32\taskkill.exe
taskkill /F /T /IM SteamService.exe
6⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:948

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /C taskkill /F /T /IM FortniteClient-Win64-Shipping.exe
5⤵
PID:2100

C:\Windows\system32\taskkill.exe
taskkill /F /T /IM FortniteClient-Win64-Shipping.exe
6⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2304

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /C taskkill/F /T /IM EpicGamesLauncher.exe
5⤵
PID:2336

C:\Windows\system32\taskkill.exe
taskkill /F /T /IM EpicGamesLauncher.exe
6⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2192

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /C taskkill/F /T /IM FortniteClient-Win64-Shipping_BE.exe
5⤵
PID:1708

C:\Windows\system32\taskkill.exe
taskkill /F /T /IM FortniteClient-Win64-Shipping_BE.exe
6⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2212

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /C taskkill/F /T /IM FortniteClient-Win64-Shipping_EAC.exe
5⤵
PID:1920

C:\Windows\system32\taskkill.exe
taskkill /F /T /IM FortniteClient-Win64-Shipping_EAC.exe
6⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1284

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /C taskkill/F /T /IM RiotClientServices.exe
5⤵
PID:1604

C:\Windows\system32\taskkill.exe
taskkill /F /T /IM RiotClientServices.exe
6⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:404

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /C taskkill/F /T /IM vgtray.exe
5⤵
PID:2184

C:\Windows\system32\taskkill.exe
taskkill /F /T /IM vgtray.exe
6⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1956

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /C taskkill/F /T /IM SteamService.exe
5⤵
PID:2344

C:\Windows\system32\taskkill.exe
taskkill /F /T /IM SteamService.exe
6⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1504

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /C taskkill /F /T /IM FortniteClient-Win64-Shipping.exe
5⤵
PID:2584

C:\Windows\system32\taskkill.exe
taskkill /F /T /IM FortniteClient-Win64-Shipping.exe
6⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2536

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /C taskkill/F /T /IM EpicGamesLauncher.exe
5⤵
PID:2668

C:\Windows\system32\taskkill.exe
taskkill /F /T /IM EpicGamesLauncher.exe
6⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:3004

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /C taskkill/F /T /IM FortniteClient-Win64-Shipping_BE.exe
5⤵
PID:2444

C:\Windows\system32\taskkill.exe
taskkill /F /T /IM FortniteClient-Win64-Shipping_BE.exe
6⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2928

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /C taskkill/F /T /IM FortniteClient-Win64-Shipping_EAC.exe
5⤵
PID:2960

C:\Windows\system32\taskkill.exe
taskkill /F /T /IM FortniteClient-Win64-Shipping_EAC.exe
6⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2992

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /C taskkill/F /T /IM RiotClientServices.exe
5⤵
PID:2308

C:\Windows\system32\taskkill.exe
taskkill /F /T /IM RiotClientServices.exe
6⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2916

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /C taskkill/F /T /IM vgtray.exe
5⤵
PID:1308

C:\Windows\system32\taskkill.exe
taskkill /F /T /IM vgtray.exe
6⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2112

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /C taskkill/F /T /IM SteamService.exe
5⤵
PID:2972

C:\Windows\system32\taskkill.exe
taskkill /F /T /IM SteamService.exe
6⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2764

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /C taskkill /F /T /IM FortniteClient-Win64-Shipping.exe
5⤵
PID:2968

C:\Windows\system32\taskkill.exe
taskkill /F /T /IM FortniteClient-Win64-Shipping.exe
6⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1252

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /C taskkill/F /T /IM EpicGamesLauncher.exe
5⤵
PID:1784

C:\Windows\system32\taskkill.exe
taskkill /F /T /IM EpicGamesLauncher.exe
6⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1748

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /C taskkill/F /T /IM FortniteClient-Win64-Shipping_BE.exe
5⤵
PID:2976

C:\Windows\system32\taskkill.exe
taskkill /F /T /IM FortniteClient-Win64-Shipping_BE.exe
6⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:836

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /C taskkill/F /T /IM FortniteClient-Win64-Shipping_EAC.exe
5⤵
PID:2760

C:\Windows\system32\taskkill.exe
taskkill /F /T /IM FortniteClient-Win64-Shipping_EAC.exe
6⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:900

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /C taskkill/F /T /IM RiotClientServices.exe
5⤵
PID:2660

C:\Windows\system32\taskkill.exe
taskkill /F /T /IM RiotClientServices.exe
6⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:804

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /C taskkill/F /T /IM vgtray.exe
5⤵
PID:952

C:\Windows\system32\taskkill.exe
taskkill /F /T /IM vgtray.exe
6⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2964

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /C taskkill/F /T /IM SteamService.exe
5⤵
PID:868

C:\Windows\system32\taskkill.exe
taskkill /F /T /IM SteamService.exe
6⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1844

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /C taskkill /F /T /IM FortniteClient-Win64-Shipping.exe
5⤵
PID:1516

C:\Windows\system32\taskkill.exe
taskkill /F /T /IM FortniteClient-Win64-Shipping.exe
6⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1028

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /C taskkill/F /T /IM EpicGamesLauncher.exe
5⤵
PID:888

C:\Windows\system32\taskkill.exe
taskkill /F /T /IM EpicGamesLauncher.exe
6⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2920

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /C taskkill/F /T /IM FortniteClient-Win64-Shipping_BE.exe
5⤵
PID:1860

C:\Windows\system32\taskkill.exe
taskkill /F /T /IM FortniteClient-Win64-Shipping_BE.exe
6⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:3044

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /C taskkill/F /T /IM FortniteClient-Win64-Shipping_EAC.exe
5⤵
PID:2896

C:\Windows\system32\taskkill.exe
taskkill /F /T /IM FortniteClient-Win64-Shipping_EAC.exe
6⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2228

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /C taskkill/F /T /IM RiotClientServices.exe
5⤵
PID:3052

C:\Windows\system32\taskkill.exe
taskkill /F /T /IM RiotClientServices.exe
6⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1496

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /C taskkill/F /T /IM vgtray.exe
5⤵
PID:1652

C:\Windows\system32\taskkill.exe
taskkill /F /T /IM vgtray.exe
6⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2192

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /C taskkill/F /T /IM SteamService.exe
5⤵
PID:2304

C:\Windows\system32\taskkill.exe
taskkill /F /T /IM SteamService.exe
6⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2216

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /C taskkill /F /T /IM FortniteClient-Win64-Shipping.exe
5⤵
PID:2316

C:\Windows\system32\taskkill.exe
taskkill /F /T /IM FortniteClient-Win64-Shipping.exe
6⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2344

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /C taskkill/F /T /IM EpicGamesLauncher.exe
5⤵
PID:404

C:\Windows\system32\taskkill.exe
taskkill /F /T /IM EpicGamesLauncher.exe
6⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2788

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /C taskkill/F /T /IM FortniteClient-Win64-Shipping_BE.exe
5⤵
PID:2032

C:\Windows\system32\taskkill.exe
taskkill /F /T /IM FortniteClient-Win64-Shipping_BE.exe
6⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2540

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /C taskkill/F /T /IM FortniteClient-Win64-Shipping_EAC.exe
5⤵
PID:2324

C:\Windows\system32\taskkill.exe
taskkill /F /T /IM FortniteClient-Win64-Shipping_EAC.exe
6⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:3028

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /C taskkill/F /T /IM RiotClientServices.exe
5⤵
PID:2488

C:\Windows\system32\taskkill.exe
taskkill /F /T /IM RiotClientServices.exe
6⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2844

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /C taskkill/F /T /IM vgtray.exe
5⤵
PID:1936

C:\Windows\system32\taskkill.exe
taskkill /F /T /IM vgtray.exe
6⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2512

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /C taskkill/F /T /IM SteamService.exe
5⤵
PID:1068

C:\Windows\system32\taskkill.exe
taskkill /F /T /IM SteamService.exe
6⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2584

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /C taskkill /F /T /IM FortniteClient-Win64-Shipping.exe
5⤵
PID:1680

C:\Windows\system32\taskkill.exe
taskkill /F /T /IM FortniteClient-Win64-Shipping.exe
6⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2996

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /C taskkill/F /T /IM EpicGamesLauncher.exe
5⤵
PID:2992

C:\Windows\system32\taskkill.exe
taskkill /F /T /IM EpicGamesLauncher.exe
6⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2916

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /C taskkill/F /T /IM FortniteClient-Win64-Shipping_BE.exe
5⤵
PID:2764

C:\Windows\system32\taskkill.exe
taskkill /F /T /IM FortniteClient-Win64-Shipping_BE.exe
6⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:896

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /C taskkill/F /T /IM FortniteClient-Win64-Shipping_EAC.exe
5⤵
PID:2732

C:\Windows\system32\taskkill.exe
taskkill /F /T /IM FortniteClient-Win64-Shipping_EAC.exe
6⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2968

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /C taskkill/F /T /IM RiotClientServices.exe
5⤵
PID:2816

C:\Windows\system32\taskkill.exe
taskkill /F /T /IM RiotClientServices.exe
6⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2792

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /C taskkill/F /T /IM vgtray.exe
5⤵
PID:2820

C:\Windows\system32\taskkill.exe
taskkill /F /T /IM vgtray.exe
6⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2796

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /C taskkill/F /T /IM SteamService.exe
5⤵
PID:692

C:\Windows\system32\taskkill.exe
taskkill /F /T /IM SteamService.exe
6⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:380

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /C taskkill /F /T /IM FortniteClient-Win64-Shipping.exe
5⤵
PID:1856

C:\Windows\system32\taskkill.exe
taskkill /F /T /IM FortniteClient-Win64-Shipping.exe
6⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:640

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /C taskkill/F /T /IM EpicGamesLauncher.exe
5⤵
PID:2136

C:\Windows\system32\taskkill.exe
taskkill /F /T /IM EpicGamesLauncher.exe
6⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2396

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /C taskkill/F /T /IM FortniteClient-Win64-Shipping_BE.exe
5⤵
PID:1768

C:\Windows\system32\taskkill.exe
taskkill /F /T /IM FortniteClient-Win64-Shipping_BE.exe
6⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:688

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /C taskkill/F /T /IM FortniteClient-Win64-Shipping_EAC.exe
5⤵
PID:984

C:\Windows\system32\taskkill.exe
taskkill /F /T /IM FortniteClient-Win64-Shipping_EAC.exe
6⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2920

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /C taskkill/F /T /IM RiotClientServices.exe
5⤵
PID:1844

C:\Windows\system32\taskkill.exe
taskkill /F /T /IM RiotClientServices.exe
6⤵
- Kills process with taskkill
PID:2024

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /C taskkill/F /T /IM vgtray.exe
5⤵
PID:1360

C:\Windows\system32\taskkill.exe
taskkill /F /T /IM vgtray.exe
6⤵
- Kills process with taskkill
PID:888

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /C taskkill/F /T /IM SteamService.exe
5⤵
PID:2912

C:\Windows\system32\taskkill.exe
taskkill /F /T /IM SteamService.exe
6⤵
- Kills process with taskkill
PID:2208

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\7zO40A749B6\injector_1.exe
Filesize
6.1MB

MD5
6ef4b97c3b24f3f387f4f757287097ae

SHA1
12547946c8d4f50218464b29184337cbc2f4a8b6

SHA256
a179d9407628e966168c8c1cffbb0c85d5551864b70ab06aa5ffa65e8a6eb66e

SHA512
0469252f08301837003d8ffd90d9ecc21d43541bffe56c83dcedebf9625bac53d62f897f245a5a359e08c213686a495a62bba7ce7a08064502b283cd81b7853d

Download Submit
C:\Users\Admin\AppData\Local\Temp\INJECTOR.EXE
Filesize
6.0MB

MD5
883f82d264966f767d881d0247d35782

SHA1
a255b679824c4514d296cddeebb4bf5ab66aa3b6

SHA256
8f3abe6f403520bd76e9969da8f57c48eca0840c9c631ed12aeaa390f089a07e

SHA512
31d5aa29355c1a1d8b67546bfc32b3f9bbd81d7082b43e74e52f1fc7fcfd35a90e199ef9aded7752c8f88965ecb7f0a7eb8bb5771be0c1600915b3e3622c4936

Download Submit
\Users\Admin\AppData\Local\Temp\INJECTOR (2).EXE
Filesize
12KB

MD5
ea74d941f3d9b92bd05de9ef96b5f6c5

SHA1
e912ddd0828cbef8ff6555818fabf06e235d08f5

SHA256
fe6a6d1e57b00eef714b1e3bedbc96a786f6749d6eb822bc14a7a7e4913ce1b0

SHA512
11cdb3412abb0acfc3598f89741691094147bd421d0f4fd21cc66bff3797e40e9ff0c8f913821b898759d67e852584fb868e705c4fa217618589f8078b2a3213

Download Submit
memory/2420-48-0x0000000000E30000-0x0000000000E3C000-memory.dmp

Filesize
48KB

Download
memory/2420-49-0x00000000001A0000-0x00000000001BA000-memory.dmp

Filesize
104KB

Download
memory/2420-50-0x0000000000250000-0x000000000025A000-memory.dmp

Filesize
40KB

Download
memory/2544-51-0x000000013FBD0000-0x00000001401D6000-memory.dmp

Filesize
6.0MB

Download
memory/2544-58-0x0000000002F90000-0x0000000003578000-memory.dmp

Filesize
5.9MB

Download
memory/2544-59-0x000000013FBD0000-0x00000001401D6000-memory.dmp

Filesize
6.0MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads