Trojan.MulDrop27.1446

Technical Information

Malicious functions

Executes the following

'<SYSTEM32>\taskkill.exe' /F /IM UnrealCEFSubProcess.exe /T
'<SYSTEM32>\taskkill.exe' /F /IM EpicGamesLauncher.exe /T
'<SYSTEM32>\taskkill.exe' /F /IM FortniteClient-Win64-Shipping.exe /T
'<SYSTEM32>\taskkill.exe' /F /IM FortniteLauncher.exe /T
'<SYSTEM32>\taskkill.exe' /F /IM FortniteClient-Win64-Shipping_BE.exe /T
'<SYSTEM32>\taskkill.exe' /F /IM FortniteClient-Win64-Shipping_EAC.exe /T

Launches a large number of processes

Modifies file system

Creates the following files

\device\harddiskvolume2
\device\harddiskvolume3
\device\filedisk\filedisk0

Miscellaneous

Searches for the following windows

ClassName: 'OleMainThreadWndClass' WindowName: ''
ClassName: '' WindowName: ''

Executes the following

'<SYSTEM32>\cmd.exe' /c color 0b
'<SYSTEM32>\cmd.exe' /c rmdir /S /Q C:\Users\%username%\AppData\Local\NVIDIA Corporation\GfeSDK
'<SYSTEM32>\cmd.exe' /c rmdir /S /Q %ALLUSERSPROFILE%\Intel\ShaderCache
'<SYSTEM32>\cmd.exe' /c rmdir /S /Q C:\Users\%username%\AppData\Local\FortniteGame\Saved\Config
'<SYSTEM32>\cmd.exe' /c rmdir /S /Q C:\Users\%username%\AppData\Local\FortniteGame\Saved\Cloud
'<SYSTEM32>\cmd.exe' /c rmdir /S /Q C:\Users\%username%\AppData\Local\FortniteGame\Saved\Demos
'<SYSTEM32>\cmd.exe' /c rmdir /S /Q C:\Users\%username%\AppData\Local\FortniteGame\Saved\Logs
'<SYSTEM32>\cmd.exe' /c rmdir /S /Q C:\Users\%username%\AppData\Local\FortniteGame\Saved\SaveGames
'<SYSTEM32>\cmd.exe' /c rmdir /S /Q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\Config\CrashReportClient
'<SYSTEM32>\cmd.exe' /c rmdir /S /Q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\Logs
'<SYSTEM32>\cmd.exe' /c rmdir /S /Q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\Data
'<SYSTEM32>\cmd.exe' /c rmdir /S /Q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\Config
'<SYSTEM32>\cmd.exe' /c rmdir /S /Q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\webcache
'<SYSTEM32>\cmd.exe' /c rmdir /S /Q %WINDIR%\Prefetch
'<SYSTEM32>\cmd.exe' /c rmdir /S /Q C:\Users\%username%\AppData\Local\Packages\Microsoft.XboxGamingOverlay_8wekyb3d8bbwe\TempState
'<SYSTEM32>\cmd.exe' /c del /f /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\webcache\Service Worker\CacheStorage\e60030e2e5440743857a39cacd108634434c91f1\index.txt
'<SYSTEM32>\cmd.exe' /c del /f /q %ProgramFiles(x86)%\EasyAntiCheat\EasyAntiCheat.sys
'<SYSTEM32>\cmd.exe' /c del /f /q C:\Users\%username%\AppData\Roaming\Microsoft\Windows\Recent\trace.lnk
'<SYSTEM32>\cmd.exe' /c del /f /q %WINDIR%\Logs\CBS\CBS.log
'<SYSTEM32>\cmd.exe' /c del /f /q <SYSTEM32>\eac_usermode_2277074302322.dll
'<SYSTEM32>\cmd.exe' /c del /f /q C:\Users\%username%\AppData\Local\FortniteGame\Saved\Cloud\04064286607c4c97b723d99d528c31f7\ClientSettings.Sav
'<SYSTEM32>\cmd.exe' /c del /f /q %WINDIR%\INF\oem7.PNF
'<SYSTEM32>\cmd.exe' /c del /f /q %ProgramFiles%\Epic Games\Fortnite\FortniteGame\PersistentDownloadDir\EMS\*
'<SYSTEM32>\cmd.exe' /c del /f /q C:\Users\%username%\AppData\Local\Microsoft\XboxLive\AuthStateCache.dat
'<SYSTEM32>\cmd.exe' /c del /f /q <SYSTEM32>\config\systemprofile\AppData\Local\Microsoft\XboxLive\AuthStateCache.dat
'<SYSTEM32>\cmd.exe' /c del /f /q <SYSTEM32>\LogFiles\WMI\RtBackup\EtwRTGraphicsPerfMonitorSession.etl
'<SYSTEM32>\cmd.exe' /c del /f /q %CommonProgramFiles(x86)%\BattlEye\BEDaisy.sys
'<SYSTEM32>\cmd.exe' /c rmdir /S /Q %ProgramFiles%\Epic Games\Fortnite\FortniteGame\PersistentDownloadDir\CMS\Files
'<SYSTEM32>\cmd.exe' /c reg delete HKEY_CURRENT_USER\Software\Epic Games\Unreal Engine\Hardware Survey /f
'<SYSTEM32>\cmd.exe' /c reg delete HKEY_LOCAL_MACHINE\SOFTWARE\Epic Games /f
'<SYSTEM32>\cmd.exe' /c rd /q /s d:\$Recycle.Bin
'<SYSTEM32>\reg.exe' delete HKEY_LOCAL_MACHINE\SOFTWARE\EpicGames /f
'<SYSTEM32>\cmd.exe' /c reg delete HKEY_LOCAL_MACHINE\SOFTWARE\EpicGames /f
'<SYSTEM32>\reg.exe' delete HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\EpicGames /f
'<SYSTEM32>\cmd.exe' /c reg delete HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\EpicGames /f
'<SYSTEM32>\reg.exe' delete HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Epic Games /f
'<SYSTEM32>\cmd.exe' /c reg delete HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Epic Games /f
'<SYSTEM32>\reg.exe' delete HKEY_LOCAL_MACHINE\SOFTWARE\Classes\com.epicgames.launcher /f
'<SYSTEM32>\cmd.exe' /c reg delete HKEY_LOCAL_MACHINE\SOFTWARE\Classes\com.epicgames.launcher /f
'<SYSTEM32>\reg.exe' delete HKEY_CLASSES_ROOT\com.epicgames.launcher /f
'<SYSTEM32>\cmd.exe' /c reg delete HKEY_CLASSES_ROOT\com.epicgames.launcher /f
'<SYSTEM32>\reg.exe' delete HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control /v SystemStartOptions /f
'<SYSTEM32>\cmd.exe' /c reg delete HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control /v SystemStartOptions /f
'<SYSTEM32>\cmd.exe' /c del /f /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\Logs\EpicGamesLauncher.log
'<SYSTEM32>\reg.exe' delete HKEY_CURRENT_USER\Software\Epic Games\Unreal Engine\Hardware Survey /f
'<SYSTEM32>\reg.exe' delete HKEY_CURRENT_USER\Software\Epic Games\Unreal Engine\Identifiers /f
'<SYSTEM32>\cmd.exe' /c reg delete HKEY_CURRENT_USER\Software\Epic Games\Unreal Engine\Identifiers /f
'<SYSTEM32>\reg.exe' delete HKEY_USERS\S-1-5-21-2097722829-2509645790-3642206209-1001\Software\Epic Games /f
'<SYSTEM32>\cmd.exe' /c reg delete HKEY_USERS\S-1-5-21-2097722829-2509645790-3642206209-1001\Software\Epic Games /f
'<SYSTEM32>\reg.exe' delete HKEY_CURRENT_USER\Software\Classes\com.epicgames.launcher /f
'<SYSTEM32>\cmd.exe' /c reg delete HKEY_CURRENT_USER\Software\Classes\com.epicgames.launcher /f
'<SYSTEM32>\reg.exe' delete HKEY_CURRENT_USER\Software\WOW6432Node\Epic Games /f
'<SYSTEM32>\cmd.exe' /c reg delete HKEY_CURRENT_USER\Software\WOW6432Node\Epic Games /f
'<SYSTEM32>\reg.exe' delete HKEY_CURRENT_USER\Software\Epic Games /f
'<SYSTEM32>\cmd.exe' /c reg delete HKEY_CURRENT_USER\Software\Epic Games /f
'<SYSTEM32>\cmd.exe' /c rd /q /s <Drive name for removable media>:\$Recycle.Bin
'<SYSTEM32>\cmd.exe' /c rd /q /s e:\$Recycle.Bin
'<SYSTEM32>\cmd.exe' /c rmdir /S /Q %ProgramFiles%\Epic Games\Fortnite\FortniteGame\PersistentDownloadDir\EMS
'<SYSTEM32>\cmd.exe' /c rd /q /s %systemdrive%\$Recycle.Bin
'<SYSTEM32>\cmd.exe' /c del /f /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\webcache\IndexedDB\https_www.epicgames.com_0.indexeddb.leveldb
'<SYSTEM32>\cmd.exe' /c del /f /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\Config\Windows\GameUserSettings.ini
'<SYSTEM32>\cmd.exe' /c del /f /q %ProgramFiles%\Epic Games\Fortnite\FortniteGame\Binaries\Win64\FortniteClient-Win64-Shipping.exe.local
'<SYSTEM32>\cmd.exe' /c del /f /q C:\Users\%username%\AppData\Local\NVIDIA Corporation\GfeSDK\FortniteClient-Win64-Shipping_9752.log
'<SYSTEM32>\cmd.exe' /c del /f /q C:\Users\%username%\AppData\Local\Temp\18e190413af045db88dfbd29609eb877.db.ses
'<SYSTEM32>\cmd.exe' /c del /f /q C:\Users\%username%\AppData\Local\Temp\mat-debug-2816.log
'<SYSTEM32>\cmd.exe' /c del /f /q %ProgramFiles%\Epic Games\Fortnite\FortniteGame\PersistentDownloadDir\CMS\CacheAccess.json
'<SYSTEM32>\cmd.exe' /c del /f /q C:\Users\%username%\AppData\Local\FortniteGame\Saved\Demos
'<SYSTEM32>\cmd.exe' /c del /f /q C:\Users\%username%\AppData\Local\Packages\Microsoft.XboxIdentityProvider_8wekyb3d8bbwe\Settings\settings.dat
'<SYSTEM32>\cmd.exe' /c del /f /q %ALLUSERSPROFILE%\Microsoft\Windows\AppRepository\Packages\Microsoft.XboxIdentityProvider_12.58.1001.0_x64__8wekyb3d8bbwe\ActivationStore.dat
'<SYSTEM32>\cmd.exe' /c del /f /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\Data\4da5179b225b49df81afeec6c65949ca.dat
'<SYSTEM32>\cmd.exe' /c del /f /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\Data\Staged\4da5179b225b49df81afeec6c65949ca.dat
'<SYSTEM32>\cmd.exe' /c del /f /q C:\Users\%username%\AppData\Local\FortniteGame\Saved\Logs\FortniteGame.log
'<SYSTEM32>\fsutil.exe' usn deletejournal /d F
'<SYSTEM32>\cmd.exe' /c del /f /q C:\Users\%username%\AppData\Roaming\EasyAntiCheat\gamelauncher.log
'<SYSTEM32>\cmd.exe' /c fsutil usn deletejournal /d F
'<SYSTEM32>\cmd.exe' /c fsutil usn deletejournal /d E
'<SYSTEM32>\fsutil.exe' usn deletejournal /d D
'<SYSTEM32>\cmd.exe' /c fsutil usn deletejournal /d D
'<SYSTEM32>\fsutil.exe' usn deletejournal /d C
'<SYSTEM32>\cmd.exe' /c fsutil usn deletejournal /d C
'<SYSTEM32>\cmd.exe' /c @TASKKILL /F /IM FortniteClient-Win64-Shipping_EAC.exe /T
'<SYSTEM32>\cmd.exe' /c @TASKKILL /F /IM FortniteClient-Win64-Shipping_BE.exe /T
'<SYSTEM32>\cmd.exe' /c @TASKKILL /F /IM FortniteLauncher.exe /T
'<SYSTEM32>\cmd.exe' /c @TASKKILL /F /IM FortniteClient-Win64-Shipping.exe /T
'<SYSTEM32>\cmd.exe' /c @TASKKILL /F /IM EpicGamesLauncher.exe /T
'<SYSTEM32>\cmd.exe' /c @TASKKILL /F /IM UnrealCEFSubProcess.exe /T
'<SYSTEM32>\cmd.exe' /c cls
'<SYSTEM32>\fsutil.exe' usn deletejournal /d E
'<SYSTEM32>\cmd.exe' /c del /f /q %ALLUSERSPROFILE%\Intel\ShaderCache\*
'<SYSTEM32>\cmd.exe' /c del /f /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\webcache\Cache\f_000055
'<SYSTEM32>\cmd.exe' /c del /f /q C:\Users\%username%\AppData\Local\FortniteGame\Saved\Config\WindowsClient\GameUserSettings.ini
'<SYSTEM32>\cmd.exe' /c del /f /q %WINDIR%\ServiceState\EventLog\Data\lastalive0.dat
'<SYSTEM32>\cmd.exe' /c del /f /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\Data\7a77559880614da4bc488cc46feb8d50.dat
'<SYSTEM32>\cmd.exe' /c del /f /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\Data\Staged\7a77559880614da4bc488cc46feb8d50.dat
'<SYSTEM32>\cmd.exe' /c del /f /q C:\Users\%username%\AppData\Local\FortniteGame\Saved\Logs\Online_Client_Tracing_Log.json
'<SYSTEM32>\cmd.exe' /c del /f /q /S C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\webcache\*
'<SYSTEM32>\cmd.exe' /c del /f /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\webcache\QuotaManager-journal
'<SYSTEM32>\cmd.exe' /c del /f /q C:\Users\%username%\AppData\Local\NVIDIA Corporation\GfeSDK\FortniteClient-Win64-Shipping_4324.log
'<SYSTEM32>\cmd.exe' /c del /f /q C:WindowsSystem32LogFilesWMIRtBackupEtwRTGraphicsPerfMonitorSession.etl
'<SYSTEM32>\cmd.exe' /c del /f /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\Logs\cef3.log
'<SYSTEM32>\cmd.exe' /c del /f /q %ALLUSERSPROFILE%\Intel\ShaderCache\dwm_1
'<SYSTEM32>\cmd.exe' /c del /f /q C:\Users\%username%\AppData\Local\FortniteGame\Saved\Logs\*
'<SYSTEM32>\cmd.exe' /c del /f /q C:\Users\%username%\AppData\Local\FortniteGame\Saved\Config\CrashReportClient\*
'<SYSTEM32>\cmd.exe' \c del \f \q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\webcache\IndexedDB\https_www.epicgames.com_0.indexeddb.leveldb\LOG.old~RF23c7f63.TMP
'<SYSTEM32>\cmd.exe' /c del /f /q C:\Users\%username%\AppData\Local\UnrealEngine\4.25\Saved\Config\WindowsClient\Manifest.ini
'<SYSTEM32>\cmd.exe' /c del /f /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\webcache\IndexedDB\https_www.epicgames.com_0.indexeddb.leveldb\LOG
'<SYSTEM32>\cmd.exe' /c del /f /q %ALLUSERSPROFILE%\Intel\ShaderCache\FortniteClient-Win64-Shipping_0
'<SYSTEM32>\cmd.exe' /c del /f /q %ALLUSERSPROFILE%\Intel\ShaderCache\FortniteClient-Win64-Shipping_1
'<SYSTEM32>\cmd.exe' /c del /f /q C:\Users\%username%\AppData\Local\NVIDIA Corporation\GfeSDK\*
'<SYSTEM32>\cmd.exe' /c del /f /q C:\Users\%username%\AppData\Local\ConnectedDevicesPlatform\b9d9ac09eca5bf86\ActivitiesCache.db-wal
'<SYSTEM32>\cmd.exe' /c del /f /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\Config\Windows\EditorPerProjectUserSettings.ini
'<SYSTEM32>\cmd.exe' /c del /f /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\Config\Windows\Hardware.ini
'<SYSTEM32>\cmd.exe' /c del /f /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\Config\Windows\Lightmass.ini
'<SYSTEM32>\cmd.exe' /c del /f /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\Config\Windows\Compat.ini
'<SYSTEM32>\cmd.exe' /c del /f /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\Config\Windows\Input.ini
'<SYSTEM32>\cmd.exe' /c del /f /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\Config\Windows\Game.ini
'<SYSTEM32>\cmd.exe' /c del /f /q %WINDIR%\Prefetch\UNREALCEFSUBPROCESS.EXE-2C8D5F1C.pf
'<SYSTEM32>\cmd.exe' /c del /f /q <SYSTEM32>\eac_usermode_15063687882226.dll
'<SYSTEM32>\reg.exe' delete HKEY_LOCAL_MACHINE\SOFTWARE\Epic Games /f

Технологии

Термины

Обучение и просвещение

Мифы

Technical Information

Рекомендации по лечению

Демо бесплатно на 14 дней