1423053f90855d33858db47f354055b660943104c1c18f848c9b7b415979dc5f

description	ioc	Process
File created	C:\Program Files\Windows Defender Advanced Threat Protection\en-US\svchost.exe	wincommon.exe
File opened for modification	C:\Program Files\Windows Defender Advanced Threat Protection\en-US\svchost.exe	wincommon.exe
File created	C:\Program Files\Windows Defender Advanced Threat Protection\en-US\f4d236fdec2fd03914189c3b26e5cb0dfea9d761	wincommon.exe
File created	C:\Program Files\Windows Defender\Offline\taskhostw.exe	wincommon.exe
File created	C:\Program Files\Windows Defender\Offline\ea9f0e6c9e2dcd4dfacdaf29ba21541fb815a988	wincommon.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\CSC\svchost.exe	wincommon.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4388	2356	WerFault.exe	89

Creates scheduled task(s) 1 TTPs 3 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
1588	schtasks.exe
1884	schtasks.exe
2068	schtasks.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings	ForceOp 2.8.7 - By RaiSence.exe

Suspicious behavior: EnumeratesProcesses 16 IoCs

pid	Process
360	wincommon.exe
2356	taskhostw.exe
4388	WerFault.exe
4388	WerFault.exe
4388	WerFault.exe
4388	WerFault.exe
4388	WerFault.exe
4388	WerFault.exe
4388	WerFault.exe
4388	WerFault.exe
4388	WerFault.exe
4388	WerFault.exe
4388	WerFault.exe
4388	WerFault.exe
4388	WerFault.exe
4388	WerFault.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	360	wincommon.exe
Token: SeDebugPrivilege	2356	taskhostw.exe
Token: SeDebugPrivilege	4388	WerFault.exe

Suspicious use of WriteProcessMemory 19 IoCs

description	pid	Process	procid_target
PID 4688 wrote to memory of 4156	4688	ForceOp 2.8.7 - By RaiSence.exe	75
PID 4688 wrote to memory of 4156	4688	ForceOp 2.8.7 - By RaiSence.exe	75
PID 4688 wrote to memory of 4156	4688	ForceOp 2.8.7 - By RaiSence.exe	75
PID 4688 wrote to memory of 760	4688	ForceOp 2.8.7 - By RaiSence.exe	76
PID 4688 wrote to memory of 760	4688	ForceOp 2.8.7 - By RaiSence.exe	76
PID 4688 wrote to memory of 760	4688	ForceOp 2.8.7 - By RaiSence.exe	76
PID 4156 wrote to memory of 732	4156	WScript.exe	79
PID 4156 wrote to memory of 732	4156	WScript.exe	79
PID 4156 wrote to memory of 732	4156	WScript.exe	79
PID 732 wrote to memory of 360	732	cmd.exe	81
PID 732 wrote to memory of 360	732	cmd.exe	81
PID 360 wrote to memory of 1588	360	wincommon.exe	83
PID 360 wrote to memory of 1588	360	wincommon.exe	83
PID 360 wrote to memory of 1884	360	wincommon.exe	85
PID 360 wrote to memory of 1884	360	wincommon.exe	85
PID 360 wrote to memory of 2068	360	wincommon.exe	87
PID 360 wrote to memory of 2068	360	wincommon.exe	87
PID 360 wrote to memory of 2356	360	wincommon.exe	89
PID 360 wrote to memory of 2356	360	wincommon.exe	89

C:\Users\Admin\AppData\Local\Temp\ForceOp 2.8.7 - By RaiSence.exe
"C:\Users\Admin\AppData\Local\Temp\ForceOp 2.8.7 - By RaiSence.exe"
1⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4688
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\intofont\1Udi0TDz635jTrMWFNrE4kqnOIuYIi.vbe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4156
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\intofont\xLg6v1j1ZJy5DZ1pz826KfZq2BmfLM.bat" "
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:732
  - - C:\intofont\wincommon.exe
      "C:\intofont\wincommon.exe"
      4⤵
      Executes dropped EXE
      Drops file in Program Files directory
      Drops file in Windows directory
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:360
    - - C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "svchost" /sc ONLOGON /tr "'C:\Program Files\Windows Defender Advanced Threat Protection\en-US\svchost.exe'" /rl HIGHEST /f
        5⤵
        Creates scheduled task(s)
        
        PID:1588
    - - C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "svchost" /sc ONLOGON /tr "'C:\Users\Admin\NetHood\svchost.exe'" /rl HIGHEST /f
        5⤵
        Creates scheduled task(s)
        
        PID:1884
    - - C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "taskhostw" /sc ONLOGON /tr "'C:\Program Files\Windows Defender\Offline\taskhostw.exe'" /rl HIGHEST /f
        5⤵
        Creates scheduled task(s)
        
        PID:2068
    - - C:\Program Files\Windows Defender\Offline\taskhostw.exe
        
        "C:\Program Files\Windows Defender\Offline\taskhostw.exe"
        5⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2356
      - C:\Windows\system32\WerFault.exe
        
        C:\Windows\system32\WerFault.exe -u -p 2356 -s 1548
        6⤵
        Suspicious use of NtCreateProcessExOtherParentProcess
        Program crash
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4388
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\intofont\msg.vbs"
  2⤵
  PID:760

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/360-18-0x00007FFCF28D0000-0x00007FFCF32BC000-memory.dmp

Filesize
9.9MB

Download
memory/360-19-0x00000000009B0000-0x00000000009B1000-memory.dmp

Filesize
4KB

Download
memory/360-21-0x0000000001170000-0x0000000001171000-memory.dmp

Filesize
4KB

Download
memory/2356-28-0x00007FFCF28D0000-0x00007FFCF32BC000-memory.dmp

Filesize
9.9MB

Download
memory/4388-33-0x000001F913D70000-0x000001F913D71000-memory.dmp

Filesize
4KB

Download
memory/4388-32-0x000001F913D70000-0x000001F913D71000-memory.dmp

Filesize
4KB

Download
memory/4388-51-0x000001F914BE0000-0x000001F914BE1000-memory.dmp

Filesize
4KB

Download
memory/4388-52-0x000001F914BE0000-0x000001F914BE1000-memory.dmp

Filesize
4KB

Download