Analysis
-
max time kernel
150s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
24-11-2024 14:49
Behavioral task
behavioral1
Sample
Fortnite.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
Fortnite.exe
Resource
win10v2004-20241007-en
General
-
Target
Fortnite.exe
-
Size
77.7MB
-
MD5
97178a64f9575409687576147522c8d5
-
SHA1
cff8a2ed89c63e6151826d7f702a3bf6aab383a8
-
SHA256
6348a47d7e11f5d770e81795494e91620e32f531751bc29670f557ff1524422c
-
SHA512
843df4051021cc7a9a670cd7154c1340c65eca5a636b2fc9de82c777e1a96f28e11a894315ad13bfd90eee186192df74daab1e7b65ccc39cd8e674eb7e99604d
-
SSDEEP
1572864:Rx1lLW/10hSk8IpG7V+VPhqqxE7LlhpBB8iYweyJulZUdgP7Ul+aswzteN:H1B+uSkB05awqeLpnNpur741teN
Malware Config
Signatures
-
Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" explorer.exe -
Executes dropped EXE 8 IoCs
pid Process 1976 fortnite.exe 1540 fortnite.exe 2896 icsys.icn.exe 2916 explorer.exe 2284 spoolsv.exe 1172 Process not Found 2688 svchost.exe 444 spoolsv.exe -
Loads dropped DLL 14 IoCs
pid Process 3004 Fortnite.exe 1976 fortnite.exe 1540 fortnite.exe 1540 fortnite.exe 3004 Fortnite.exe 1540 fortnite.exe 1540 fortnite.exe 1540 fortnite.exe 1540 fortnite.exe 2896 icsys.icn.exe 1540 fortnite.exe 2916 explorer.exe 2284 spoolsv.exe 2688 svchost.exe -
Adds Run key to start application 2 TTPs 4 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\resources\\themes\\explorer.exe RO" explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\resources\\svchost.exe RO" explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\resources\\themes\\explorer.exe RO" svchost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\resources\\svchost.exe RO" svchost.exe -
Drops file in System32 directory 2 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\explorer.exe explorer.exe File opened for modification C:\Windows\SysWOW64\explorer.exe svchost.exe -
resource yara_rule behavioral1/files/0x0003000000020b3d-1336.dat upx behavioral1/memory/1540-1349-0x000007FEF6350000-0x000007FEF6A15000-memory.dmp upx behavioral1/memory/2688-1378-0x0000000000200000-0x000000000021F000-memory.dmp upx -
Drops file in Windows directory 5 IoCs
description ioc Process File opened for modification C:\Windows\Resources\Themes\icsys.icn.exe Fortnite.exe File opened for modification \??\c:\windows\resources\themes\explorer.exe icsys.icn.exe File opened for modification \??\c:\windows\resources\spoolsv.exe explorer.exe File opened for modification \??\c:\windows\resources\svchost.exe spoolsv.exe File opened for modification C:\Windows\Resources\tjud.exe explorer.exe -
System Location Discovery: System Language Discovery 1 TTPs 9 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Fortnite.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language icsys.icn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe -
Scheduled Task/Job: Scheduled Task 1 TTPs 3 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 952 schtasks.exe 2936 schtasks.exe 2084 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3004 Fortnite.exe 3004 Fortnite.exe 3004 Fortnite.exe 3004 Fortnite.exe 3004 Fortnite.exe 3004 Fortnite.exe 3004 Fortnite.exe 3004 Fortnite.exe 3004 Fortnite.exe 3004 Fortnite.exe 3004 Fortnite.exe 3004 Fortnite.exe 3004 Fortnite.exe 3004 Fortnite.exe 3004 Fortnite.exe 3004 Fortnite.exe 2896 icsys.icn.exe 2896 icsys.icn.exe 2896 icsys.icn.exe 2896 icsys.icn.exe 2896 icsys.icn.exe 2896 icsys.icn.exe 2896 icsys.icn.exe 2896 icsys.icn.exe 2896 icsys.icn.exe 2896 icsys.icn.exe 2896 icsys.icn.exe 2896 icsys.icn.exe 2896 icsys.icn.exe 2896 icsys.icn.exe 2896 icsys.icn.exe 2896 icsys.icn.exe 2896 icsys.icn.exe 2916 explorer.exe 2916 explorer.exe 2916 explorer.exe 2916 explorer.exe 2916 explorer.exe 2916 explorer.exe 2916 explorer.exe 2916 explorer.exe 2916 explorer.exe 2916 explorer.exe 2916 explorer.exe 2916 explorer.exe 2916 explorer.exe 2916 explorer.exe 2916 explorer.exe 2916 explorer.exe 2688 svchost.exe 2688 svchost.exe 2688 svchost.exe 2688 svchost.exe 2688 svchost.exe 2688 svchost.exe 2688 svchost.exe 2688 svchost.exe 2688 svchost.exe 2688 svchost.exe 2688 svchost.exe 2688 svchost.exe 2688 svchost.exe 2688 svchost.exe 2688 svchost.exe -
Suspicious behavior: GetForegroundWindowSpam 2 IoCs
pid Process 2916 explorer.exe 2688 svchost.exe -
Suspicious use of SetWindowsHookEx 12 IoCs
pid Process 3004 Fortnite.exe 3004 Fortnite.exe 2896 icsys.icn.exe 2896 icsys.icn.exe 2916 explorer.exe 2916 explorer.exe 2284 spoolsv.exe 2284 spoolsv.exe 2688 svchost.exe 2688 svchost.exe 444 spoolsv.exe 444 spoolsv.exe -
Suspicious use of WriteProcessMemory 43 IoCs
description pid Process procid_target PID 3004 wrote to memory of 1976 3004 Fortnite.exe 30 PID 3004 wrote to memory of 1976 3004 Fortnite.exe 30 PID 3004 wrote to memory of 1976 3004 Fortnite.exe 30 PID 3004 wrote to memory of 1976 3004 Fortnite.exe 30 PID 1976 wrote to memory of 1540 1976 fortnite.exe 31 PID 1976 wrote to memory of 1540 1976 fortnite.exe 31 PID 1976 wrote to memory of 1540 1976 fortnite.exe 31 PID 3004 wrote to memory of 2896 3004 Fortnite.exe 32 PID 3004 wrote to memory of 2896 3004 Fortnite.exe 32 PID 3004 wrote to memory of 2896 3004 Fortnite.exe 32 PID 3004 wrote to memory of 2896 3004 Fortnite.exe 32 PID 2896 wrote to memory of 2916 2896 icsys.icn.exe 33 PID 2896 wrote to memory of 2916 2896 icsys.icn.exe 33 PID 2896 wrote to memory of 2916 2896 icsys.icn.exe 33 PID 2896 wrote to memory of 2916 2896 icsys.icn.exe 33 PID 2916 wrote to memory of 2284 2916 explorer.exe 34 PID 2916 wrote to memory of 2284 2916 explorer.exe 34 PID 2916 wrote to memory of 2284 2916 explorer.exe 34 PID 2916 wrote to memory of 2284 2916 explorer.exe 34 PID 2284 wrote to memory of 2688 2284 spoolsv.exe 35 PID 2284 wrote to memory of 2688 2284 spoolsv.exe 35 PID 2284 wrote to memory of 2688 2284 spoolsv.exe 35 PID 2284 wrote to memory of 2688 2284 spoolsv.exe 35 PID 2688 wrote to memory of 444 2688 svchost.exe 36 PID 2688 wrote to memory of 444 2688 svchost.exe 36 PID 2688 wrote to memory of 444 2688 svchost.exe 36 PID 2688 wrote to memory of 444 2688 svchost.exe 36 PID 2916 wrote to memory of 1072 2916 explorer.exe 37 PID 2916 wrote to memory of 1072 2916 explorer.exe 37 PID 2916 wrote to memory of 1072 2916 explorer.exe 37 PID 2916 wrote to memory of 1072 2916 explorer.exe 37 PID 2688 wrote to memory of 952 2688 svchost.exe 38 PID 2688 wrote to memory of 952 2688 svchost.exe 38 PID 2688 wrote to memory of 952 2688 svchost.exe 38 PID 2688 wrote to memory of 952 2688 svchost.exe 38 PID 2688 wrote to memory of 2936 2688 svchost.exe 42 PID 2688 wrote to memory of 2936 2688 svchost.exe 42 PID 2688 wrote to memory of 2936 2688 svchost.exe 42 PID 2688 wrote to memory of 2936 2688 svchost.exe 42 PID 2688 wrote to memory of 2084 2688 svchost.exe 44 PID 2688 wrote to memory of 2084 2688 svchost.exe 44 PID 2688 wrote to memory of 2084 2688 svchost.exe 44 PID 2688 wrote to memory of 2084 2688 svchost.exe 44
Processes
-
C:\Users\Admin\AppData\Local\Temp\Fortnite.exe"C:\Users\Admin\AppData\Local\Temp\Fortnite.exe"1⤵
- Loads dropped DLL
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3004 -
\??\c:\users\admin\appdata\local\temp\fortnite.exec:\users\admin\appdata\local\temp\fortnite.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1976 -
\??\c:\users\admin\appdata\local\temp\fortnite.exec:\users\admin\appdata\local\temp\fortnite.exe3⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1540
-
-
-
C:\Windows\Resources\Themes\icsys.icn.exeC:\Windows\Resources\Themes\icsys.icn.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2896 -
\??\c:\windows\resources\themes\explorer.exec:\windows\resources\themes\explorer.exe3⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2916 -
\??\c:\windows\resources\spoolsv.exec:\windows\resources\spoolsv.exe SE4⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2284 -
\??\c:\windows\resources\svchost.exec:\windows\resources\svchost.exe5⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2688 -
\??\c:\windows\resources\spoolsv.exec:\windows\resources\spoolsv.exe PR6⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:444
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /tn "svchost" /tr "c:\windows\resources\svchost.exe" /sc daily /st 14:56 /f6⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
PID:952
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /tn "svchost" /tr "c:\windows\resources\svchost.exe" /sc daily /st 14:57 /f6⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
PID:2936
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /tn "svchost" /tr "c:\windows\resources\svchost.exe" /sc daily /st 14:58 /f6⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
PID:2084
-
-
-
-
C:\Windows\Explorer.exeC:\Windows\Explorer.exe4⤵PID:1072
-
-
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Scheduled Task
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
21KB
MD51c58526d681efe507deb8f1935c75487
SHA10e6d328faf3563f2aae029bc5f2272fb7a742672
SHA256ef13dce8f71173315dfc64ab839b033ab19a968ee15230e9d4d2c9d558efeee2
SHA5128edb9a0022f417648e2ece9e22c96e2727976332025c3e7d8f15bcf6d7d97e680d1bf008eb28e2e0bd57787dcbb71d38b2deb995b8edc35fa6852ab1d593f3d1
-
Filesize
18KB
MD5bfffa7117fd9b1622c66d949bac3f1d7
SHA1402b7b8f8dcfd321b1d12fc85a1ee5137a5569b2
SHA2561ea267a2e6284f17dd548c6f2285e19f7edb15d6e737a55391140ce5cb95225e
SHA512b319cc7b436b1be165cdf6ffcab8a87fe29de78f7e0b14c8f562be160481fb5483289bd5956fdc1d8660da7a3f86d8eede35c6cc2b7c3d4c852decf4b2dcdb7f
-
Filesize
21KB
MD5724223109e49cb01d61d63a8be926b8f
SHA1072a4d01e01dbbab7281d9bd3add76f9a3c8b23b
SHA2564e975f618df01a492ae433dff0dd713774d47568e44c377ceef9e5b34aad1210
SHA51219b0065b894dc66c30a602c9464f118e7f84d83010e74457d48e93aaca4422812b093b15247b24d5c398b42ef0319108700543d13f156067b169ccfb4d7b6b7c
-
Filesize
21KB
MD5517eb9e2cb671ae49f99173d7f7ce43f
SHA14ccf38fed56166ddbf0b7efb4f5314c1f7d3b7ab
SHA25657cc66bf0909c430364d35d92b64eb8b6a15dc201765403725fe323f39e8ac54
SHA512492be2445b10f6bfe6c561c1fc6f5d1af6d1365b7449bc57a8f073b44ae49c88e66841f5c258b041547fcd33cbdcb4eb9dd3e24f0924db32720e51651e9286be
-
Filesize
21KB
MD5d12403ee11359259ba2b0706e5e5111c
SHA103cc7827a30fd1dee38665c0cc993b4b533ac138
SHA256f60e1751a6ac41f08e46480bf8e6521b41e2e427803996b32bdc5e78e9560781
SHA5129004f4e59835af57f02e8d9625814db56f0e4a98467041da6f1367ef32366ad96e0338d48fff7cc65839a24148e2d9989883bcddc329d9f4d27cae3f843117d0
-
Filesize
1.7MB
MD571070618402c15a2fad5ca70c9ef7297
SHA134fedbf17a57010c5cd20ef4e690616859cc8e68
SHA2567d35a191edb95ccd85ef05d645deeca3ed1febd9acd659569fab56ae06c1ebdf
SHA51281ef8749f5c3dbd586ddbbcf26cd6c80607a5cc9c26e31c912f454ca56013082174e2012a507739ec1e9c5a2f019bf0ca6bd3ce18880abdbff0ba5f8f3cbbf28
-
Filesize
992KB
MD50e0bac3d1dcc1833eae4e3e4cf83c4ef
SHA14189f4459c54e69c6d3155a82524bda7549a75a6
SHA2568a91052ef261b5fbf3223ae9ce789af73dfe1e9b0ba5bdbc4d564870a24f2bae
SHA512a45946e3971816f66dd7ea3788aacc384a9e95011500b458212dc104741315b85659e0d56a41570731d338bdf182141c093d3ced222c007038583ceb808e26fd
-
Filesize
135KB
MD5c8758b3f0e8d08381f0a043ac761a5d4
SHA1c9eed42d292459614802d8b48423f9450555fb11
SHA256b225380e9c8c4126d6af09eb24c19c7a81ddcaa84771eea7a03b332409e4cbd7
SHA51228dadfd1cc0594ceb9bb0b832e87afa49cb17426360205b4eb51022a04086678c4231cf9288cac13db8c73a0e7f1e3a8bc65d2fcf4237fcf58ebf5e19850aa7a
-
Filesize
135KB
MD5af83eb64944dab17b4cc120961890257
SHA1026e472a982a5d57afd0f416c5829226b3520288
SHA2568e74ea8bfe7983543665da2b4ee61d67b07806343f500d1536aa447eb563292e
SHA512d5125abb2c9ecb211864c911b3c0939c75a68a53577d08d7db1cfb9e4d87bdcb6dca0a99fd0cec19b0a3cfe811bbba07071f699d95499872654c1d819d5d39d1
-
Filesize
135KB
MD578d7967df84a1d23c01cb0d91ef2506d
SHA1a9fee38d892c12ccbdea485f2498087d660da7bb
SHA2568b69c36b9729bd31b6b629be5c512c22a471a552351f8717295d8d9b847188e8
SHA51243873f75e558bb0f9e26dc14bc4f4ecec02ec3b23c1db61f4037f7e3931e074000b3e77d8e3bb28fabb4bb8439eca2f27f5f99f387575be5cb475d3cc302b109
-
Filesize
135KB
MD5f971285351fe6822bdde1cfb65a1534f
SHA1cdc4720bccbabf3618514d23b4754f6936778f03
SHA256ab6a27763d49e2170d0d8afbe1601b985351a1787820e00a65fcb1e2f01d0a25
SHA512d8602c4e3ad49d5ba2c3523b47f770e0502a3544392e4f9c789dcc1b3342314f1c23bddbe3908040467091af8bfc9c2ef54b14eeab489e4cee817a5309f914f2