darkvision | 74e66581cda6b55f9dbfcfe260faec1dad8a38d9fa0c5c2f45e64d16e6a11d4e

pid	Process
1984	schtasks.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4792	powershell.exe
4792	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4792	powershell.exe

Suspicious use of WriteProcessMemory 18 IoCs

description	pid	Process	procid_target
PID 1612 wrote to memory of 4704	1612	fortnite.exe	85
PID 1612 wrote to memory of 4704	1612	fortnite.exe	85
PID 1612 wrote to memory of 2452	1612	fortnite.exe	86
PID 1612 wrote to memory of 2452	1612	fortnite.exe	86
PID 2452 wrote to memory of 1932	2452	cmd.exe	87
PID 2452 wrote to memory of 1932	2452	cmd.exe	87
PID 1612 wrote to memory of 2080	1612	fortnite.exe	88
PID 1612 wrote to memory of 2080	1612	fortnite.exe	88
PID 2080 wrote to memory of 4792	2080	cmd.exe	89
PID 2080 wrote to memory of 4792	2080	cmd.exe	89
PID 1612 wrote to memory of 220	1612	fortnite.exe	90
PID 1612 wrote to memory of 220	1612	fortnite.exe	90
PID 220 wrote to memory of 1984	220	cmd.exe	91
PID 220 wrote to memory of 1984	220	cmd.exe	91
PID 1612 wrote to memory of 3516	1612	fortnite.exe	92
PID 1612 wrote to memory of 3516	1612	fortnite.exe	92
PID 1612 wrote to memory of 4324	1612	fortnite.exe	101
PID 1612 wrote to memory of 4324	1612	fortnite.exe	101

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

Views/modifies file attributes 1 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1564.001

pid	Process
1932	attrib.exe

C:\Users\Admin\AppData\Local\Temp\fortnite.exe
"C:\Users\Admin\AppData\Local\Temp\fortnite.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:1612
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c mkdir "C:\ProgramData\Microsoft\WindowsApps" >nul 2>&1
  2⤵
  PID:4704
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c attrib +h +s "C:\ProgramData\Microsoft\WindowsApps" >nul 2>&1
  2⤵
  - Hide Artifacts: Hidden Files and Directories
  - Suspicious use of WriteProcessMemory
  PID:2452
- - C:\Windows\system32\attrib.exe
    attrib +h +s "C:\ProgramData\Microsoft\WindowsApps"
    3⤵
    - Views/modifies file attributes
    PID:1932
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c powershell -Command "Add-MpPreference -ExclusionExtension 'exe'" >nul 2>&1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2080
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "Add-MpPreference -ExclusionExtension 'exe'"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4792
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "OperationEnigma" /tr "C:\ProgramData\Microsoft\WindowsApps\OperationEnigma4.exe" /sc onlogon /rl highest /f >nul 2>&1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:220
- - C:\Windows\system32\schtasks.exe
    schtasks /create /tn "OperationEnigma" /tr "C:\ProgramData\Microsoft\WindowsApps\OperationEnigma4.exe" /sc onlogon /rl highest /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1984
- C:\ProgramData\Microsoft\WindowsApps\OperationEnigma4.exe
  "C:\ProgramData\Microsoft\WindowsApps\OperationEnigma4.exe"
  2⤵
  - Executes dropped EXE
  PID:3516
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c color 3
  2⤵
  PID:4324

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

Persistence

Scheduled Task/Job

T1053

Scheduled Task

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Credential Access

Discovery

Query Registry

T1012

System Information Discovery