45790bd0bb5eef4380c93de089dd9bf9b137a70bdc2f78e976919b6dd4b6bb2b

General

Target

f67e9c9915e81bd08ebb0e2b57909677.exe
Size

1.2MB
MD5

f67e9c9915e81bd08ebb0e2b57909677
SHA1

9fd3f0658a7c285d6bdcd6f5b25d3995045a5b88
SHA256

45790bd0bb5eef4380c93de089dd9bf9b137a70bdc2f78e976919b6dd4b6bb2b
SHA512

c71df4adc7b5bc534b74a25e2b7aadefb1ca0e6c8d9380785f4012bb0974df8f382a8fa3ba21ca8f91a3cbc338821fc7f7e5d3d7ab9e1b2b4ce1e0e4d1fec0fe

Score

10^/10

persistence

Malware Config

Signatures

Process spawned unexpected child process 10 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

Processes:

schtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exe

description	pid	pid_target	process
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2852	2484	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2720	2484	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	396	2484	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	708	2484	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	356	2484	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	820	2484	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2180	2484	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	948	2484	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2132	2484	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3388	2484	schtasks.exe

Executes dropped EXE 2 IoCs

Processes:

WinsessionBrokernetIntohost.exetaskhostw.exe

pid process

1912 WinsessionBrokernetIntohost.exe
3572 taskhostw.exe

pid	process
1912	WinsessionBrokernetIntohost.exe
3572	taskhostw.exe

Adds Run key to start application 2 TTPs 10 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

WinsessionBrokernetIntohost.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\RuntimeBroker = "\"C:\\Windows\\ja-JP\\RuntimeBroker.exe\""	WinsessionBrokernetIntohost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\dllhost = "\"C:\\Windows\\System32\\provops\\dllhost.exe\""	WinsessionBrokernetIntohost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\taskhostw = "\"C:\\Windows\\System32\\iaspolcy\\taskhostw.exe\""	WinsessionBrokernetIntohost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Recovery\\WindowsRE\\csrss.exe\""	WinsessionBrokernetIntohost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\dwm = "\"C:\\Windows\\System32\\ntdll\\dwm.exe\""	WinsessionBrokernetIntohost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\cmd = "\"C:\\Windows\\SysWOW64\\KBDUSX\\cmd.exe\""	WinsessionBrokernetIntohost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\spoolsv = "\"C:\\Windows\\System32\\wclUnicode\\spoolsv.exe\""	WinsessionBrokernetIntohost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OfficeClickToRun = "\"C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2RINTL.ms-my\\OfficeClickToRun.exe\""	WinsessionBrokernetIntohost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\ProgramData\\Microsoft OneDrive\\setup\\csrss.exe\""	WinsessionBrokernetIntohost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\explorer = "\"C:\\odt\\explorer.exe\""	WinsessionBrokernetIntohost.exe

Drops file in System32 directory 10 IoCs

Processes:

WinsessionBrokernetIntohost.exe

description	ioc	process
File created	C:\Windows\System32\wclUnicode\f3b6ecef712a24f33798f5d2fb3790c3d9b894c4	WinsessionBrokernetIntohost.exe
File created	C:\Windows\System32\ntdll\dwm.exe	WinsessionBrokernetIntohost.exe
File created	C:\Windows\SysWOW64\KBDUSX\ebf1f9fa8afd6d1932bd65bc4cc3af89a4c8e228	WinsessionBrokernetIntohost.exe
File created	C:\Windows\System32\iaspolcy\taskhostw.exe	WinsessionBrokernetIntohost.exe
File created	C:\Windows\System32\iaspolcy\ea9f0e6c9e2dcd4dfacdaf29ba21541fb815a988	WinsessionBrokernetIntohost.exe
File created	C:\Windows\System32\wclUnicode\spoolsv.exe	WinsessionBrokernetIntohost.exe
File created	C:\Windows\System32\provops\dllhost.exe	WinsessionBrokernetIntohost.exe
File created	C:\Windows\System32\provops\5940a34987c99120d96dace90a3f93f329dcad63	WinsessionBrokernetIntohost.exe
File created	C:\Windows\System32\ntdll\6cb0b6c459d5d3455a3da700e713f2e2529862ff	WinsessionBrokernetIntohost.exe
File created	C:\Windows\SysWOW64\KBDUSX\cmd.exe	WinsessionBrokernetIntohost.exe

Drops file in Program Files directory 2 IoCs

Processes:

WinsessionBrokernetIntohost.exe

description	ioc	process
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.ms-my\OfficeClickToRun.exe	WinsessionBrokernetIntohost.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.ms-my\e6c9b481da804f07baff8eff543b0a1441069b5d	WinsessionBrokernetIntohost.exe

Drops file in Windows directory 2 IoCs

Processes:

WinsessionBrokernetIntohost.exe

description	ioc	process
File created	C:\Windows\ja-JP\RuntimeBroker.exe	WinsessionBrokernetIntohost.exe
File created	C:\Windows\ja-JP\9e8d7a4ca61bd92aff00cc37a7a4d62a2cac998d	WinsessionBrokernetIntohost.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 10 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

Processes:

schtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exe

pid	process
2132	schtasks.exe
2852	schtasks.exe
2720	schtasks.exe
708	schtasks.exe
356	schtasks.exe
820	schtasks.exe
2180	schtasks.exe
948	schtasks.exe
3388	schtasks.exe
396	schtasks.exe

Modifies registry class 1 IoCs

Processes:

f67e9c9915e81bd08ebb0e2b57909677.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\Local Settings	f67e9c9915e81bd08ebb0e2b57909677.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

WinsessionBrokernetIntohost.exetaskhostw.exe

pid process

1912 WinsessionBrokernetIntohost.exe
1912 WinsessionBrokernetIntohost.exe
1912 WinsessionBrokernetIntohost.exe
3572 taskhostw.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

WinsessionBrokernetIntohost.exetaskhostw.exe

description pid process

Token: SeDebugPrivilege 1912 WinsessionBrokernetIntohost.exe
Token: SeDebugPrivilege 3572 taskhostw.exe

pid	process
1912	WinsessionBrokernetIntohost.exe
1912	WinsessionBrokernetIntohost.exe
1912	WinsessionBrokernetIntohost.exe
3572	taskhostw.exe

description	pid	process
Token: SeDebugPrivilege	1912	WinsessionBrokernetIntohost.exe
Token: SeDebugPrivilege	3572	taskhostw.exe

Suspicious use of WriteProcessMemory 10 IoCs

Processes:

f67e9c9915e81bd08ebb0e2b57909677.exeWScript.execmd.exeWinsessionBrokernetIntohost.exe

description	pid	process	target process
PID 4056 wrote to memory of 1612	4056	f67e9c9915e81bd08ebb0e2b57909677.exe	WScript.exe
PID 4056 wrote to memory of 1612	4056	f67e9c9915e81bd08ebb0e2b57909677.exe	WScript.exe
PID 4056 wrote to memory of 1612	4056	f67e9c9915e81bd08ebb0e2b57909677.exe	WScript.exe
PID 1612 wrote to memory of 3780	1612	WScript.exe	cmd.exe
PID 1612 wrote to memory of 3780	1612	WScript.exe	cmd.exe
PID 1612 wrote to memory of 3780	1612	WScript.exe	cmd.exe
PID 3780 wrote to memory of 1912	3780	cmd.exe	WinsessionBrokernetIntohost.exe
PID 3780 wrote to memory of 1912	3780	cmd.exe	WinsessionBrokernetIntohost.exe
PID 1912 wrote to memory of 3572	1912	WinsessionBrokernetIntohost.exe	taskhostw.exe
PID 1912 wrote to memory of 3572	1912	WinsessionBrokernetIntohost.exe	taskhostw.exe

C:\Users\Admin\AppData\Local\Temp\f67e9c9915e81bd08ebb0e2b57909677.exe
"C:\Users\Admin\AppData\Local\Temp\f67e9c9915e81bd08ebb0e2b57909677.exe"
1⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4056

C:\Windows\SysWOW64\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\WinsessionBrokernet\ufqa67DL2gtzgC.vbe"
2⤵
- Suspicious use of WriteProcessMemory
PID:1612

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\WinsessionBrokernet\vxdOo.bat" "
3⤵
- Suspicious use of WriteProcessMemory
PID:3780

C:\Users\Admin\AppData\Roaming\WinsessionBrokernet\WinsessionBrokernetIntohost.exe
"C:\Users\Admin\AppData\Roaming\WinsessionBrokernet\WinsessionBrokernetIntohost.exe"
4⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1912

C:\Windows\System32\iaspolcy\taskhostw.exe
"C:\Windows\System32\iaspolcy\taskhostw.exe"
5⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3572

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2852

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Windows\ja-JP\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2720

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\Windows\System32\provops\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:396

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwm" /sc ONLOGON /tr "'C:\Windows\System32\ntdll\dwm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:708

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "cmd" /sc ONLOGON /tr "'C:\Windows\SysWOW64\KBDUSX\cmd.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:356

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostw" /sc ONLOGON /tr "'C:\Windows\System32\iaspolcy\taskhostw.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:820

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsv" /sc ONLOGON /tr "'C:\Windows\System32\wclUnicode\spoolsv.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2180

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OfficeClickToRun" /sc ONLOGON /tr "'C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.ms-my\OfficeClickToRun.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:948

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\ProgramData\Microsoft OneDrive\setup\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2132

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorer" /sc ONLOGON /tr "'C:\odt\explorer.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3388

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Registry Run Keys / Startup Folder

1

T1060

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\WinsessionBrokernet\WinsessionBrokernetIntohost.exe
MD5
3c0e66c07059d17b9dec156ae1f99fcf

SHA1
a9cf63368c43a839590f55a4896d503909d4ea76

SHA256
bd10ea4eeb2a7f1e9b3157ce51752336fe3d6dc56fb49bdc736bbe0ea34f5936

SHA512
4a7d7555e6cf982c62fe7185f7b147c959a82b3be5e33aeec7bc9f22ab8adcdf4cf9ca10a2a7be50a7f98c19402f8bde9fff22ff8de3e3727a8a35604767ab39

Download Submit
C:\Users\Admin\AppData\Roaming\WinsessionBrokernet\WinsessionBrokernetIntohost.exe
MD5
3c0e66c07059d17b9dec156ae1f99fcf

SHA1
a9cf63368c43a839590f55a4896d503909d4ea76

SHA256
bd10ea4eeb2a7f1e9b3157ce51752336fe3d6dc56fb49bdc736bbe0ea34f5936

SHA512
4a7d7555e6cf982c62fe7185f7b147c959a82b3be5e33aeec7bc9f22ab8adcdf4cf9ca10a2a7be50a7f98c19402f8bde9fff22ff8de3e3727a8a35604767ab39

Download Submit
C:\Users\Admin\AppData\Roaming\WinsessionBrokernet\ufqa67DL2gtzgC.vbe
MD5
79ec3118b469d48b8b3b6a1c0b330fb5

SHA1
9ef874c6a1ca3af5e07e83260dee0dc6ff7e3816

SHA256
b3bbe75c2eed62015193612b19c38eabb1c7a7b51797ad9ffa26b1eb7485839f

SHA512
0d085322c07d4553cbe7303a1a88ec329845a25ba07efe83989f912ab4e311f7ef891c2c071e87adb2de2b8b2c4e4ef5a2673b02ad8b45444e6663ead1fd0580

Download Submit
C:\Users\Admin\AppData\Roaming\WinsessionBrokernet\vxdOo.bat
MD5
ea5bc8528b06faf92eaa4f0d6194365b

SHA1
734509caf332eeffcdfea6d079b45653876e221d

SHA256
e1d8b03b08fd259e5a9cda84dc3f646bd68701ae82586e48072b62107dfb0f7a

SHA512
11cc2fd1bd98468908a197944fbd133c23899284fb745159b140d9e1f477d8c96a03c167a229814089fdc31ceed18d32992f05dd96369cbed290b3004d298edb

Download Submit
C:\Windows\System32\iaspolcy\taskhostw.exe
MD5
3c0e66c07059d17b9dec156ae1f99fcf

SHA1
a9cf63368c43a839590f55a4896d503909d4ea76

SHA256
bd10ea4eeb2a7f1e9b3157ce51752336fe3d6dc56fb49bdc736bbe0ea34f5936

SHA512
4a7d7555e6cf982c62fe7185f7b147c959a82b3be5e33aeec7bc9f22ab8adcdf4cf9ca10a2a7be50a7f98c19402f8bde9fff22ff8de3e3727a8a35604767ab39

Download Submit
C:\Windows\System32\iaspolcy\taskhostw.exe
MD5
3c0e66c07059d17b9dec156ae1f99fcf

SHA1
a9cf63368c43a839590f55a4896d503909d4ea76

SHA256
bd10ea4eeb2a7f1e9b3157ce51752336fe3d6dc56fb49bdc736bbe0ea34f5936

SHA512
4a7d7555e6cf982c62fe7185f7b147c959a82b3be5e33aeec7bc9f22ab8adcdf4cf9ca10a2a7be50a7f98c19402f8bde9fff22ff8de3e3727a8a35604767ab39

Download Submit
memory/1612-117-0x0000000000000000-mapping.dmp

Download
memory/1912-121-0x0000000000000000-mapping.dmp

Download
memory/1912-124-0x0000000000CC0000-0x0000000000CC1000-memory.dmp

Filesize
4KB

Download
memory/1912-126-0x000000001B920000-0x000000001B922000-memory.dmp

Filesize
8KB

Download
memory/3572-127-0x0000000000000000-mapping.dmp

Download
memory/3572-132-0x0000000003070000-0x0000000003072000-memory.dmp

Filesize
8KB

Download
memory/3780-120-0x0000000000000000-mapping.dmp

Download
memory/4056-115-0x0000000000940000-0x0000000000941000-memory.dmp

Filesize
4KB

Download
memory/4056-116-0x0000000000940000-0x0000000000941000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads