0b0469b06437b67cc72a596ac417a8467a36e723c5691525c9af92aeec4f639b

Analysis

max time kernel
94s
max time network
138s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
26-11-2024 19:48

Target

FORTNITE-MACROS-EDITOR-V2.5-main/Language/tr_TR.json
Size

118KB
MD5

284fa4410964c1078fca93f3500758b7
SHA1

b742f38e9cb742e058b85375d7ec42bc12d2fd06
SHA256

57246c8e89c54b7df951ecf6c020992345d179bdcff9b4d2f49605e0e797d46e
SHA512

70471e109a262559ca222a2ca14b053b10320c875d23a7cfc0f58d51f206202ad3b0f90514c3a7e574171c069d2a37bb2c824b012a8abddb0efbdb23f593d140
SSDEEP

768:P3UZ9Vc1/YKXtVy4Gg0oRLIX582xVNAsKZrUnMTpTlkxzIY/znznv1KoA9DGHNv7:mVc1Aj4Gg0oRLIq2xZKyMTpTyfpVMY4A

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\Local Settings	cmd.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
100	OpenWith.exe

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\FORTNITE-MACROS-EDITOR-V2.5-main\Language\tr_TR.json
1⤵
- Modifies registry class
PID:3636

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact