File name:

BrokenHeart Fortnite.rar

Full analysis: https://app.any.run/tasks/6c1678a6-524d-4740-82c9-88f73e16b13c
Verdict: Malicious activity
Analysis date: January 10, 2021, 18:34:40
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: application/x-rar
File info: RAR archive data, v5
MD5:

1956B4824274C42910A7FA850D6E4869

SHA1:

98CDD0D53AF30FF150BCB673CA526CC944FEE955

SHA256:

29A6B75384C4C40F13B946947FF44862652D3CA69843418ED71EAC7AB4DE58FB

SSDEEP:

393216:rNpTQAWHqxj+yJqhIUPHtK0T0usFJ9DvHj787bTmOxd:rNxWKxj+yJ+VKTFD47bSUd

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Drops executable file immediately after starts

      • BrokenHeart Cheats.exe (PID: 4056)
      • icsys.icn.exe (PID: 2104)
      • spoolsv.exe (PID: 2260)
      • explorer.exe (PID: 1756)

    • Application was dropped or rewritten from another process

      • BrokenHeart Cheats.exe (PID: 4056)
      • spoolsv.exe (PID: 2260)
      • icsys.icn.exe (PID: 2104)
      • explorer.exe (PID: 1756)
      • svchost.exe (PID: 3836)
      • brokenheart cheats.exe  (PID: 3272)
      • spoolsv.exe (PID: 3212)

    • Changes the autorun value in the registry

      • explorer.exe (PID: 1756)
      • svchost.exe (PID: 3836)

    • Uses Task Scheduler to run other applications

      • svchost.exe (PID: 3836)

    • Loads the Task Scheduler COM API

      • schtasks.exe (PID: 3692)

  • SUSPICIOUS

    • Drops a file that was compiled in debug mode

      • BrokenHeart Cheats.exe (PID: 4056)
      • WinRAR.exe (PID: 1732)

    • Creates files in the Windows directory

      • BrokenHeart Cheats.exe (PID: 4056)
      • explorer.exe (PID: 1756)
      • icsys.icn.exe (PID: 2104)
      • spoolsv.exe (PID: 2260)

    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 1732)
      • explorer.exe (PID: 1756)
      • BrokenHeart Cheats.exe (PID: 4056)
      • icsys.icn.exe (PID: 2104)
      • spoolsv.exe (PID: 2260)

    • Creates executable files which already exist in Windows

      • icsys.icn.exe (PID: 2104)
      • spoolsv.exe (PID: 2260)

    • Removes files from Windows directory

      • explorer.exe (PID: 1756)
      • icsys.icn.exe (PID: 2104)
      • spoolsv.exe (PID: 2260)

    • Starts itself from another location

      • explorer.exe (PID: 1756)
      • icsys.icn.exe (PID: 2104)
      • BrokenHeart Cheats.exe (PID: 4056)
      • svchost.exe (PID: 3836)
      • spoolsv.exe (PID: 2260)

    • Drops a file with too old compile date

      • BrokenHeart Cheats.exe (PID: 4056)

    • Starts application with an unusual extension

      • BrokenHeart Cheats.exe (PID: 4056)

    • Drops a file with a compile date too recent

      • WinRAR.exe (PID: 1732)

  • INFO

    • Manual execution by user

      • taskmgr.exe (PID: 3124)
      • BrokenHeart Cheats.exe (PID: 4056)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.rar | RAR compressed archive (v5.0) (61.5)
.rar | RAR compressed archive (gen) (38.4)
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
52
Monitored processes
10
Malicious processes
5
Suspicious processes
0

Behavior graph

Click at the process to see the details
start drop and start winrar.exe taskmgr.exe no specs brokenheart cheats.exe brokenheart cheats.exe  no specs icsys.icn.exe explorer.exe spoolsv.exe svchost.exe spoolsv.exe no specs schtasks.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
1732"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\AppData\Local\Temp\BrokenHeart Fortnite.rar"C:\Program Files\WinRAR\WinRAR.exe
explorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Exit code:
0
Version:
5.60.0
Modules
Images
c:\program files\winrar\winrar.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\comdlg32.dll
1756c:\windows\resources\themes\explorer.exec:\windows\resources\themes\explorer.exe
icsys.icn.exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
Version:
1.00
Modules
Images
c:\windows\resources\themes\explorer.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvbvm60.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
2104C:\Windows\Resources\Themes\icsys.icn.exeC:\Windows\Resources\Themes\icsys.icn.exe
BrokenHeart Cheats.exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
Version:
1.00
Modules
Images
c:\windows\resources\themes\icsys.icn.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvbvm60.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
2260c:\windows\resources\spoolsv.exe SEc:\windows\resources\spoolsv.exe
explorer.exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
Version:
1.00
Modules
Images
c:\windows\resources\spoolsv.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvbvm60.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
3124"C:\Windows\system32\taskmgr.exe" /4C:\Windows\system32\taskmgr.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Task Manager
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\taskmgr.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
3212c:\windows\resources\spoolsv.exe PRc:\windows\resources\spoolsv.exe—svchost.exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
Version:
1.00
Modules
Images
c:\windows\resources\spoolsv.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvbvm60.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
3272"c:\users\admin\desktop\brokenheart fortnite\brokenheart cheats.exe " c:\users\admin\desktop\brokenheart fortnite\brokenheart cheats.exe —BrokenHeart Cheats.exe
User:
admin
Company:
Nemesis-36767
Integrity Level:
HIGH
Description:
SOF-FN
Exit code:
0
Version:
1.0.0.0
Modules
Images
c:\users\admin\desktop\brokenheart fortnite\brokenheart cheats.exe 
c:\systemroot\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\microsoft.net\framework\v4.0.30319\mscoreei.dll
3692schtasks /create /tn "svchost" /tr "c:\windows\resources\svchost.exe" /sc daily /st 18:37 /fC:\Windows\system32\schtasks.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Manages scheduled tasks
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\schtasks.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\ole32.dll
3836c:\windows\resources\svchost.exec:\windows\resources\svchost.exe
spoolsv.exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
Version:
1.00
Modules
Images
c:\windows\resources\svchost.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvbvm60.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
4056"C:\Users\admin\Desktop\BrokenHeart Fortnite\BrokenHeart Cheats.exe" C:\Users\admin\Desktop\BrokenHeart Fortnite\BrokenHeart Cheats.exe
explorer.exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
Version:
1.00
Modules
Images
c:\users\admin\desktop\brokenheart fortnite\brokenheart cheats.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvbvm60.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
Total events
479
Read events
449
Write events
30
Delete events
0

Modification events

(PID) Process:(1732) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtBMP
Value:
(PID) Process:(1732) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtIcon
Value:
(PID) Process:(1732) WinRAR.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\13B\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(1732) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\AppData\Local\Temp\BrokenHeart Fortnite.rar
(PID) Process:(1732) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(1732) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(1732) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
(PID) Process:(1732) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:mtime
Value:
100
(PID) Process:(1732) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\MainWin
Operation:writeName:Placement
Value:
2C0000000000000001000000FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF42000000420000000204000037020000
(PID) Process:(1732) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\General
Operation:writeName:LastFolder
Value:
C:\Users\admin\AppData\Local\Temp
Executable files
17
Suspicious files
0
Text files
1
Unknown types
0

Dropped files

PID
Process
Filename
Type
3212spoolsv.exeC:\Users\admin\AppData\Local\Temp\~DF0BF18CCF85CC4CFE.TMP —
MD5:—
SHA256:—
2260spoolsv.exeC:\Users\admin\AppData\Local\Temp\~DF997C3B9C784360C5.TMP —
MD5:—
SHA256:—
4056BrokenHeart Cheats.exeC:\Users\admin\AppData\Local\Temp\~DFF91B4C6DC9F2EB16.TMP —
MD5:—
SHA256:—
2104icsys.icn.exeC:\Users\admin\AppData\Local\Temp\~DF94978C2DB69869A3.TMP —
MD5:—
SHA256:—
1732WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa1732.4002\BrokenHeart Fortnite\cleanerBETAS5.exeexecutable
MD5:—
SHA256:—
1732WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa1732.4002\BrokenHeart Fortnite\BrokenHeartFortnite.dllexecutable
MD5:—
SHA256:—
1732WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa1732.4002\BrokenHeart Fortnite\Driver.sysexecutable
MD5:—
SHA256:—
4056BrokenHeart Cheats.exeC:\Windows\Resources\Themes\icsys.icn.exeexecutable
MD5:—
SHA256:—
1732WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa1732.4002\BrokenHeart Fortnite\Georges Wipes.exeexecutable
MD5:—
SHA256:—
1732WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa1732.4002\BrokenHeart Fortnite\prflog_cfg.exeexecutable
MD5:—
SHA256:—
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
0
DNS requests
0
Threats
0

HTTP requests

No HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

No data

DNS requests

No data

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
BrokenHeart Fortnite.rar