Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Overview
overview
10Static
static
10FortniteAi...ed.exe
windows7-x64
10FortniteAi...ed.exe
windows10-2004-x64
10FortniteAi...ys.exe
windows7-x64
10FortniteAi...ys.exe
windows10-2004-x64
10FortniteAi...ip.dll
windows7-x64
1FortniteAi...ip.dll
windows10-2004-x64
1FortniteAi...er.exe
windows7-x64
8FortniteAi...er.exe
windows10-2004-x64
8FortniteAi...32.dll
windows7-x64
3FortniteAi...32.dll
windows10-2004-x64
3FortniteAi...ll.dll
windows7-x64
3FortniteAi...ll.dll
windows10-2004-x64
3FortniteAi...32.dll
windows7-x64
3FortniteAi...32.dll
windows10-2004-x64
3FortniteAi...ll.dll
windows7-x64
3FortniteAi...ll.dll
windows10-2004-x64
3Analysis
-
max time kernel
31s -
max time network
33s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
07/12/2024, 22:52
Behavioral task
behavioral1
Sample
FortniteAimbotESP Cracked/FortniteAimbotESPcracked.exe
Resource
win7-20241010-en
Behavioral task
behavioral2
Sample
FortniteAimbotESP Cracked/FortniteAimbotESPcracked.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral3
Sample
FortniteAimbotESP Cracked/db/Aimsys.exe
Resource
win7-20241023-en
Behavioral task
behavioral4
Sample
FortniteAimbotESP Cracked/db/Aimsys.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral5
Sample
FortniteAimbotESP Cracked/db/Ionic.Zip.dll
Resource
win7-20240729-en
Behavioral task
behavioral6
Sample
FortniteAimbotESP Cracked/db/Ionic.Zip.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral7
Sample
FortniteAimbotESP Cracked/db/Launcher.exe
Resource
win7-20240903-en
Behavioral task
behavioral8
Sample
FortniteAimbotESP Cracked/db/Launcher.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral9
Sample
FortniteAimbotESP Cracked/db/libeay32.dll
Resource
win7-20241023-en
Behavioral task
behavioral10
Sample
FortniteAimbotESP Cracked/db/libeay32.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral11
Sample
FortniteAimbotESP Cracked/db/tessdll.dll
Resource
win7-20241010-en
Behavioral task
behavioral12
Sample
FortniteAimbotESP Cracked/db/tessdll.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral13
Sample
FortniteAimbotESP Cracked/libeay32.dll
Resource
win7-20240708-en
Behavioral task
behavioral14
Sample
FortniteAimbotESP Cracked/libeay32.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral15
Sample
FortniteAimbotESP Cracked/tessdll.dll
Resource
win7-20241023-en
Behavioral task
behavioral16
Sample
FortniteAimbotESP Cracked/tessdll.dll
Resource
win10v2004-20241007-en
General
-
Target
FortniteAimbotESP Cracked/db/Launcher.exe
-
Size
53KB
-
MD5
c6d4c881112022eb30725978ecd7c6ec
-
SHA1
ba4f96dc374195d873b3eebdb28b633d9a1c5bf5
-
SHA256
0d87b9b141a592711c52e7409ec64de3ab296cddc890be761d9af57cea381b32
-
SHA512
3bece10b65dfda69b6defbf50d067a59d1cd1db403547fdf28a4cbc87c4985a4636acfcff8300bd77fb91f2693084634d940a91517c33b5425258835ab990981
-
SSDEEP
768:FKtnBTTQi/YqMFlVt52ftDhKeoNzZq8OujxUu5XEAb4b9yvMzUV5:qBTUgYFveDRuFEAb4b99QV5
Malware Config
Signatures
-
Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
pid Process 4144 powershell.exe 4172 powershell.exe -
Checks computer location settings 2 TTPs 3 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\Control Panel\International\Geo\Nation Windows Services.exe Key value queried \REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\Control Panel\International\Geo\Nation Runtime Explorer.exe Key value queried \REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\Control Panel\International\Geo\Nation Launcher.exe -
Drops startup file 1 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Startup.lnk Launcher.exe -
Executes dropped EXE 3 IoCs
pid Process 2396 Windows Services.exe 3060 Secure System Shell.exe 3720 Runtime Explorer.exe -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Runtime Explorer = "C:\\Windows\\IMF\\\\Windows Services.exe" Launcher.exe Set value (str) \REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Runtime Explorer = "\"C:\\Users\\Admin\\AppData\\Roaming\\Runtime Explorer.exe\"" Runtime Explorer.exe -
Drops file in Windows directory 9 IoCs
description ioc Process File created C:\Windows\IMF\LICENCE.zip Launcher.exe File opened for modification C:\Windows\IMF\LICENCE.zip Launcher.exe File created C:\Windows\IMF\Secure System Shell.exe.tmp Launcher.exe File opened for modification C:\Windows\IMF\Secure System Shell.exe Launcher.exe File created C:\Windows\IMF\LICENCE.dat Launcher.exe File created C:\Windows\IMF\Runtime Explorer.exe.tmp Launcher.exe File opened for modification C:\Windows\IMF\Runtime Explorer.exe Launcher.exe File created C:\Windows\IMF\Windows Services.exe.tmp Launcher.exe File opened for modification C:\Windows\IMF\Windows Services.exe Launcher.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 6 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Launcher.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language powershell.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Windows Services.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Secure System Shell.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Runtime Explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language powershell.exe -
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 taskmgr.exe -
Suspicious behavior: EnumeratesProcesses 20 IoCs
pid Process 4996 Launcher.exe 4144 powershell.exe 4144 powershell.exe 2396 Windows Services.exe 2396 Windows Services.exe 2396 Windows Services.exe 2396 Windows Services.exe 3060 Secure System Shell.exe 4172 powershell.exe 4172 powershell.exe 1996 taskmgr.exe 1996 taskmgr.exe 1996 taskmgr.exe 1996 taskmgr.exe 1996 taskmgr.exe 1996 taskmgr.exe 1996 taskmgr.exe 1996 taskmgr.exe 1996 taskmgr.exe 1996 taskmgr.exe -
Suspicious use of AdjustPrivilegeToken 8 IoCs
description pid Process Token: SeDebugPrivilege 4996 Launcher.exe Token: SeDebugPrivilege 4144 powershell.exe Token: SeDebugPrivilege 2396 Windows Services.exe Token: SeDebugPrivilege 3060 Secure System Shell.exe Token: SeDebugPrivilege 4172 powershell.exe Token: SeDebugPrivilege 1996 taskmgr.exe Token: SeSystemProfilePrivilege 1996 taskmgr.exe Token: SeCreateGlobalPrivilege 1996 taskmgr.exe -
Suspicious use of FindShellTrayWindow 21 IoCs
pid Process 1996 taskmgr.exe 1996 taskmgr.exe 1996 taskmgr.exe 1996 taskmgr.exe 1996 taskmgr.exe 1996 taskmgr.exe 1996 taskmgr.exe 1996 taskmgr.exe 1996 taskmgr.exe 1996 taskmgr.exe 1996 taskmgr.exe 1996 taskmgr.exe 1996 taskmgr.exe 1996 taskmgr.exe 1996 taskmgr.exe 1996 taskmgr.exe 1996 taskmgr.exe 1996 taskmgr.exe 1996 taskmgr.exe 1996 taskmgr.exe 1996 taskmgr.exe -
Suspicious use of SendNotifyMessage 21 IoCs
pid Process 1996 taskmgr.exe 1996 taskmgr.exe 1996 taskmgr.exe 1996 taskmgr.exe 1996 taskmgr.exe 1996 taskmgr.exe 1996 taskmgr.exe 1996 taskmgr.exe 1996 taskmgr.exe 1996 taskmgr.exe 1996 taskmgr.exe 1996 taskmgr.exe 1996 taskmgr.exe 1996 taskmgr.exe 1996 taskmgr.exe 1996 taskmgr.exe 1996 taskmgr.exe 1996 taskmgr.exe 1996 taskmgr.exe 1996 taskmgr.exe 1996 taskmgr.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 3720 Runtime Explorer.exe -
Suspicious use of WriteProcessMemory 15 IoCs
description pid Process procid_target PID 4996 wrote to memory of 4144 4996 Launcher.exe 85 PID 4996 wrote to memory of 4144 4996 Launcher.exe 85 PID 4996 wrote to memory of 4144 4996 Launcher.exe 85 PID 4996 wrote to memory of 2396 4996 Launcher.exe 87 PID 4996 wrote to memory of 2396 4996 Launcher.exe 87 PID 4996 wrote to memory of 2396 4996 Launcher.exe 87 PID 2396 wrote to memory of 3060 2396 Windows Services.exe 88 PID 2396 wrote to memory of 3060 2396 Windows Services.exe 88 PID 2396 wrote to memory of 3060 2396 Windows Services.exe 88 PID 2396 wrote to memory of 3720 2396 Windows Services.exe 89 PID 2396 wrote to memory of 3720 2396 Windows Services.exe 89 PID 2396 wrote to memory of 3720 2396 Windows Services.exe 89 PID 3720 wrote to memory of 4172 3720 Runtime Explorer.exe 90 PID 3720 wrote to memory of 4172 3720 Runtime Explorer.exe 90 PID 3720 wrote to memory of 4172 3720 Runtime Explorer.exe 90
Processes
-
C:\Users\Admin\AppData\Local\Temp\FortniteAimbotESP Cracked\db\Launcher.exe"C:\Users\Admin\AppData\Local\Temp\FortniteAimbotESP Cracked\db\Launcher.exe"1⤵
- Checks computer location settings
- Drops startup file
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4996 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" add-mppreference -exclusionpath C:\Windows\IMF\2⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4144
-
-
C:\Windows\IMF\Windows Services.exe"C:\Windows\IMF\Windows Services.exe" {Arguments If Needed}2⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2396 -
C:\Windows\IMF\Secure System Shell.exe"C:\Windows\IMF\Secure System Shell.exe"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3060
-
-
C:\Windows\IMF\Runtime Explorer.exe"C:\Windows\IMF\Runtime Explorer.exe"3⤵
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3720 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" add-mppreference -exclusionpath C:\Users\Admin\AppData\Roaming\4⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4172
-
-
-
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1996
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2KB
MD5968cb9309758126772781b83adb8a28f
SHA18da30e71accf186b2ba11da1797cf67f8f78b47c
SHA25692099c10776bb7e3f2a8d1b82d4d40d0c4627e4f1bf754a6e58dfd2c2e97042a
SHA5124bd50732f8af4d688d95999bddfd296115d7033ddc38f86c9fb1f47fde202bffa27e9088bebcaa3064ca946af2f5c1ca6cbde49d0907f0005c7ab42874515dd3
-
Filesize
18KB
MD5e118db82546e26dde81df21241a9a5bc
SHA14c4a0d4b2f6fb5c9aafe5a411318007d4e055e86
SHA256c832982d9480a6fdc3ee6f7f22034199179315068ed47bb8840ad7ab718bf4e0
SHA51215310f01c04ce82602cc43cdadba29332a86f134441886a395140a09e722419261553d588c5786262bdd707f9fd99648417da9364e41c4a11314729574a778c2
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
Filesize
1KB
MD563ab0e853958ee5618ecd36de6d12773
SHA14a4f2944b8875ed8f2e3d977028548e0dc737a31
SHA256b936f25dca1b959ef48aaa5e59a4c17498f645b2250f647ce7be157237abda6c
SHA512c97ceb3c20205cf472618d301d5340c1856057355f314e36e8bdf889b2b571c5f8918033519aa5b3247ecbb34304e404d239ee6908402387a545bb153dd1a4fc
-
Filesize
152KB
MD503f5e0141f4519f0c5ac26ce0b036a0f
SHA14f7a2a230e7a194a898cc9f2d563ac8777fe99c0
SHA25678a408c628e33e3332645f480ee7ce01b5dc24fc96cf16ffa0868d43f3d421ef
SHA51286a68f040654006e06b51c5714e0d7168d0d1bef7f3c39843632068104f773f771d21be4bc251d712f3e915cd1058f89ad31d9e3f3d9e7cf6da6785cbf22d8d7
-
Filesize
45KB
MD57d0c7359e5b2daa5665d01afdc98cc00
SHA1c3cc830c8ffd0f53f28d89dcd9f3426be87085cb
SHA256f1abd5ab03189e82971513e6ca04bd372fcf234d670079888f01cf4addd49809
SHA512a8f82b11b045d8dd744506f4f56f3382b33a03684a6aebc91a02ea901c101b91cb43b7d0213f72f39cbb22f616ecd5de8b9e6c99fb5669f26a3ea6bcb63c8407
-
Filesize
46KB
MD5ad0ce1302147fbdfecaec58480eb9cf9
SHA1874efbc76e5f91bc1425a43ea19400340f98d42b
SHA2562c339b52b82e73b4698a0110cdfe310c00c5c69078e9e1bd6fa1308652bf82a3
SHA512adccd5520e01b673c2fc5c451305fe31b1a3e74891aece558f75fefc50218adf1fb81bb8c7f19969929d3fecb0fdb2cb5b564400d51e0a5a1ad8d5bc2d4eed53