0b0469b06437b67cc72a596ac417a8467a36e723c5691525c9af92aeec4f639b

Analysis

max time kernel
93s
max time network
137s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
26-11-2024 19:48

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

FORTNITE-MACROS-EDITOR-V2.5-main/Language/ru_RU.json
Size

125KB
MD5

90e5c3f55a7c8f95c34060f1c5b8cd2d
SHA1

4c5e9c01ebde4a0a9eb853d9373491f5244bf79a
SHA256

0d6326c48658396bc781e37d1b11260d524f04134e5abdfd4b8f5bc7d63b87ef
SHA512

d955721e2694eb0ff889a1fe4e8e40f8eeaa6843a30a29769579cea371ef8581b6caf54eb74ef1b0bbabe3b937121bb8dbe23d341cb4ab516d65a1ae28f2ea41
SSDEEP

1536:zp0zasru8IMgpSYxK950vxc0xab8YSmJScBUwi6A:zpSzu8IMgnxc0xabpJSoUwi6A

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 2 IoCs

Processes:

cmd.exeOpenWith.exe

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000_Classes\Local Settings	OpenWith.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

OpenWith.exe

pid	Process
4984	OpenWith.exe

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\FORTNITE-MACROS-EDITOR-V2.5-main\Language\ru_RU.json
1⤵
- Modifies registry class
PID:1924

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:4984

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads