1423053f90855d33858db47f354055b660943104c1c18f848c9b7b415979dc5f

Suspicious use of NtCreateProcessExOtherParentProcess 1 IoCs

Processes:

WerFault.exe

description pid process target process

PID 4388 created 2356 4388 WerFault.exe taskhostw.exe
Executes dropped EXE 2 IoCs

Processes:

wincommon.exetaskhostw.exe

pid process

360 wincommon.exe
2356 taskhostw.exe

description	pid	process	target process
PID 4388 created 2356	4388	WerFault.exe	taskhostw.exe

Drops file in Program Files directory 5 IoCs

Processes:

wincommon.exe

description	ioc	process
File created	C:\Program Files\Windows Defender Advanced Threat Protection\en-US\svchost.exe	wincommon.exe
File opened for modification	C:\Program Files\Windows Defender Advanced Threat Protection\en-US\svchost.exe	wincommon.exe
File created	C:\Program Files\Windows Defender Advanced Threat Protection\en-US\f4d236fdec2fd03914189c3b26e5cb0dfea9d761	wincommon.exe
File created	C:\Program Files\Windows Defender\Offline\taskhostw.exe	wincommon.exe
File created	C:\Program Files\Windows Defender\Offline\ea9f0e6c9e2dcd4dfacdaf29ba21541fb815a988	wincommon.exe

Drops file in Windows directory 1 IoCs

Processes:

wincommon.exe

description ioc process

File created C:\Windows\CSC\svchost.exe wincommon.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

4388 2356 WerFault.exe taskhostw.exe
Creates scheduled task(s) 1 TTPs 3 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exeschtasks.exeschtasks.exe

pid process

1588 schtasks.exe
1884 schtasks.exe
2068 schtasks.exe
Modifies registry class 1 IoCs

Processes:

ForceOp 2.8.7 - By RaiSence.exe

description ioc process

Key created \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings ForceOp 2.8.7 - By RaiSence.exe

description	ioc	process
File created	C:\Windows\CSC\svchost.exe	wincommon.exe

pid	pid_target	process	target process
4388	2356	WerFault.exe	taskhostw.exe

pid	process
1588	schtasks.exe
1884	schtasks.exe
2068	schtasks.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings	ForceOp 2.8.7 - By RaiSence.exe

Suspicious behavior: EnumeratesProcesses 16 IoCs

Processes:

wincommon.exetaskhostw.exeWerFault.exe

pid	process
360	wincommon.exe
2356	taskhostw.exe
4388	WerFault.exe
4388	WerFault.exe
4388	WerFault.exe
4388	WerFault.exe
4388	WerFault.exe
4388	WerFault.exe
4388	WerFault.exe
4388	WerFault.exe
4388	WerFault.exe
4388	WerFault.exe
4388	WerFault.exe
4388	WerFault.exe
4388	WerFault.exe
4388	WerFault.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

wincommon.exetaskhostw.exeWerFault.exe

description pid process

Token: SeDebugPrivilege 360 wincommon.exe
Token: SeDebugPrivilege 2356 taskhostw.exe
Token: SeDebugPrivilege 4388 WerFault.exe

description	pid	process
Token: SeDebugPrivilege	360	wincommon.exe
Token: SeDebugPrivilege	2356	taskhostw.exe
Token: SeDebugPrivilege	4388	WerFault.exe

Suspicious use of WriteProcessMemory 19 IoCs

Processes:

ForceOp 2.8.7 - By RaiSence.exeWScript.execmd.exewincommon.exe

description	pid	process	target process
PID 4688 wrote to memory of 4156	4688	ForceOp 2.8.7 - By RaiSence.exe	WScript.exe
PID 4688 wrote to memory of 4156	4688	ForceOp 2.8.7 - By RaiSence.exe	WScript.exe
PID 4688 wrote to memory of 4156	4688	ForceOp 2.8.7 - By RaiSence.exe	WScript.exe
PID 4688 wrote to memory of 760	4688	ForceOp 2.8.7 - By RaiSence.exe	WScript.exe
PID 4688 wrote to memory of 760	4688	ForceOp 2.8.7 - By RaiSence.exe	WScript.exe
PID 4688 wrote to memory of 760	4688	ForceOp 2.8.7 - By RaiSence.exe	WScript.exe
PID 4156 wrote to memory of 732	4156	WScript.exe	cmd.exe
PID 4156 wrote to memory of 732	4156	WScript.exe	cmd.exe
PID 4156 wrote to memory of 732	4156	WScript.exe	cmd.exe
PID 732 wrote to memory of 360	732	cmd.exe	wincommon.exe
PID 732 wrote to memory of 360	732	cmd.exe	wincommon.exe
PID 360 wrote to memory of 1588	360	wincommon.exe	schtasks.exe
PID 360 wrote to memory of 1588	360	wincommon.exe	schtasks.exe
PID 360 wrote to memory of 1884	360	wincommon.exe	schtasks.exe
PID 360 wrote to memory of 1884	360	wincommon.exe	schtasks.exe
PID 360 wrote to memory of 2068	360	wincommon.exe	schtasks.exe
PID 360 wrote to memory of 2068	360	wincommon.exe	schtasks.exe
PID 360 wrote to memory of 2356	360	wincommon.exe	taskhostw.exe
PID 360 wrote to memory of 2356	360	wincommon.exe	taskhostw.exe

C:\Users\Admin\AppData\Local\Temp\ForceOp 2.8.7 - By RaiSence.exe
"C:\Users\Admin\AppData\Local\Temp\ForceOp 2.8.7 - By RaiSence.exe"
1⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4688
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\intofont\1Udi0TDz635jTrMWFNrE4kqnOIuYIi.vbe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4156
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\intofont\xLg6v1j1ZJy5DZ1pz826KfZq2BmfLM.bat" "
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:732
  - - C:\intofont\wincommon.exe
      "C:\intofont\wincommon.exe"
      4⤵
      Executes dropped EXE
      Drops file in Program Files directory
      Drops file in Windows directory
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:360
    - - C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "svchost" /sc ONLOGON /tr "'C:\Program Files\Windows Defender Advanced Threat Protection\en-US\svchost.exe'" /rl HIGHEST /f
        5⤵
        Creates scheduled task(s)
        
        PID:1588
    - - C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "svchost" /sc ONLOGON /tr "'C:\Users\Admin\NetHood\svchost.exe'" /rl HIGHEST /f
        5⤵
        Creates scheduled task(s)
        
        PID:1884
    - - C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "taskhostw" /sc ONLOGON /tr "'C:\Program Files\Windows Defender\Offline\taskhostw.exe'" /rl HIGHEST /f
        5⤵
        Creates scheduled task(s)
        
        PID:2068
    - - C:\Program Files\Windows Defender\Offline\taskhostw.exe
        
        "C:\Program Files\Windows Defender\Offline\taskhostw.exe"
        5⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2356
      - C:\Windows\system32\WerFault.exe
        
        C:\Windows\system32\WerFault.exe -u -p 2356 -s 1548
        6⤵
        Suspicious use of NtCreateProcessExOtherParentProcess
        Program crash
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4388
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\intofont\msg.vbs"
  2⤵
  PID:760

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\Windows Defender\Offline\taskhostw.exe

Download Submit
C:\Program Files\Windows Defender\Offline\taskhostw.exe

Download Submit
C:\intofont\1Udi0TDz635jTrMWFNrE4kqnOIuYIi.vbe

Download Submit
C:\intofont\MOS

Download Submit
C:\intofont\msg.vbs

Download Submit
C:\intofont\wincommon.exe

Download Submit
C:\intofont\wincommon.exe

Download Submit
C:\intofont\xLg6v1j1ZJy5DZ1pz826KfZq2BmfLM.bat

Download Submit
memory/360-15-0x0000000000000000-mapping.dmp

Download
memory/360-18-0x00007FFCF28D0000-0x00007FFCF32BC000-memory.dmp

Filesize
9.9MB

Download
memory/360-19-0x00000000009B0000-0x00000000009B1000-memory.dmp

Filesize
4KB

Download
memory/360-21-0x0000000001170000-0x0000000001171000-memory.dmp

Filesize
4KB

Download
memory/732-14-0x0000000000000000-mapping.dmp

Download
memory/760-9-0x0000000000000000-mapping.dmp

Download
memory/1588-22-0x0000000000000000-mapping.dmp

Download
memory/1884-23-0x0000000000000000-mapping.dmp

Download
memory/2068-24-0x0000000000000000-mapping.dmp

Download
memory/2356-42-0x0000000000000000-mapping.dmp

Download
memory/2356-41-0x0000000000000000-mapping.dmp

Download
memory/2356-28-0x00007FFCF28D0000-0x00007FFCF32BC000-memory.dmp

Filesize
9.9MB

Download
memory/2356-50-0x0000000000000000-mapping.dmp

Download
memory/2356-49-0x0000000000000000-mapping.dmp

Download
memory/2356-35-0x0000000000000000-mapping.dmp

Download
memory/2356-36-0x0000000000000000-mapping.dmp

Download
memory/2356-37-0x0000000000000000-mapping.dmp

Download
memory/2356-38-0x0000000000000000-mapping.dmp

Download
memory/2356-39-0x0000000000000000-mapping.dmp

Download
memory/2356-40-0x0000000000000000-mapping.dmp

Download
memory/2356-25-0x0000000000000000-mapping.dmp

Download
memory/2356-43-0x0000000000000000-mapping.dmp

Download
memory/2356-47-0x0000000000000000-mapping.dmp

Download
memory/2356-44-0x0000000000000000-mapping.dmp

Download
memory/2356-45-0x0000000000000000-mapping.dmp

Download
memory/2356-46-0x0000000000000000-mapping.dmp

Download
memory/2356-48-0x0000000000000000-mapping.dmp

Download
memory/4156-0-0x0000000000000000-mapping.dmp

Download
memory/4388-33-0x000001F913D70000-0x000001F913D71000-memory.dmp

Filesize
4KB

Download
memory/4388-32-0x000001F913D70000-0x000001F913D71000-memory.dmp

Filesize
4KB

Download
memory/4388-51-0x000001F914BE0000-0x000001F914BE1000-memory.dmp

Filesize
4KB

Download
memory/4388-52-0x000001F914BE0000-0x000001F914BE1000-memory.dmp

Filesize
4KB

Download