7a6e41f3064591e019a73c83144ab390ef45d47d1c66e7db3b2ec17ce6c4af65

General

Target
578edb8b414da23d4b6754bb7a0aa431.exe
Size 913KB
Sample211217-1ggaaaebg7
SHA256 7a6e41f3064591e019a73c83144ab390ef45d47d1c66e7db3b2ec17ce6c4af65
MD5 578edb8b414da23d4b6754bb7a0aa431
SHA1 a43a35264d3b0731cbb28d9f3cbcd0275851ff1b
SHA512 39b6ae26579cc8c6f585827742225f8479a3b259f2e1f294099c12fcb0d1f180f420cff5edc75de5a4bc423b3791ddb2446e17616e194999c6073fd6d3ca9683
MD5 SHA1 SHA512

Score

10^/10

persistence spyware stealer

Malware Config

Signatures

Process spawned unexpected child process 8 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3192	1328	schtasks.exe	74
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2536	1328	schtasks.exe	74
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2388	1328	schtasks.exe	74
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	724	1328	schtasks.exe	74
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1512	1328	schtasks.exe	74
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1232	1328	schtasks.exe	74
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1488	1328	schtasks.exe	74
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3656	1328	schtasks.exe	74

Executes dropped EXE 3 IoCs

pid	Process
1996	hgfdfds.exe
1844	brokerdllfontSaves.exe
3460	sihost.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Adds Run key to start application 2 TTPs 8 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\System = "\"C:\\odt\\System.exe\""	brokerdllfontSaves.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\services = "\"C:\\ProgramData\\Start Menu\\services.exe\""	brokerdllfontSaves.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\spoolsv = "\"C:\\Windows\\System32\\DefaultHrtfs\\spoolsv.exe\""	brokerdllfontSaves.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sihost = "\"C:\\brokerdll\\sihost.exe\""	brokerdllfontSaves.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\RuntimeBroker = "\"C:\\Windows\\System32\\BdeHdCfg\\RuntimeBroker.exe\""	brokerdllfontSaves.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\brokerdllfontSaves = "\"C:\\PerfLogs\\brokerdllfontSaves.exe\""	brokerdllfontSaves.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ShellExperienceHost = "\"C:\\Windows\\SystemApps\\ShellExperienceHost_cw5n1h2txyewy\\AppxBlockMap\\ShellExperienceHost.exe\""	brokerdllfontSaves.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OfficeClickToRun = "\"C:\\Program Files (x86)\\Windows Photo Viewer\\de-DE\\OfficeClickToRun.exe\""	brokerdllfontSaves.exe

Drops file in System32 directory 4 IoCs

description	ioc	Process
File created	C:\Windows\System32\DefaultHrtfs\spoolsv.exe	brokerdllfontSaves.exe
File created	C:\Windows\System32\DefaultHrtfs\f3b6ecef712a24f33798f5d2fb3790c3d9b894c4	brokerdllfontSaves.exe
File created	C:\Windows\System32\BdeHdCfg\RuntimeBroker.exe	brokerdllfontSaves.exe
File created	C:\Windows\System32\BdeHdCfg\9e8d7a4ca61bd92aff00cc37a7a4d62a2cac998d	brokerdllfontSaves.exe

Drops file in Program Files directory 4 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Windows Photo Viewer\de-DE\e6c9b481da804f07baff8eff543b0a1441069b5d	brokerdllfontSaves.exe
File created	C:\Program Files\WindowsApps\Microsoft.XboxGameOverlay_1.15.2003.0_neutral_~_8wekyb3d8bbwe\AppxMetadata\brokerdllfontSaves.exe	brokerdllfontSaves.exe
File created	C:\Program Files (x86)\Windows Photo Viewer\de-DE\OfficeClickToRun.exe	brokerdllfontSaves.exe
File opened for modification	C:\Program Files (x86)\Windows Photo Viewer\de-DE\OfficeClickToRun.exe	brokerdllfontSaves.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\AppxBlockMap\ShellExperienceHost.exe	brokerdllfontSaves.exe
File created	C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\AppxBlockMap\f8c8f1285d826bc63910aaf97db97186ba642b4f	brokerdllfontSaves.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 8 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
1232	schtasks.exe
1488	schtasks.exe
3656	schtasks.exe
3192	schtasks.exe
2536	schtasks.exe
2388	schtasks.exe
724	schtasks.exe
1512	schtasks.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000_Classes\Local Settings	hgfdfds.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
1844	brokerdllfontSaves.exe
3460	sihost.exe
3460	sihost.exe
3460	sihost.exe
3460	sihost.exe
3460	sihost.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3460	sihost.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1844	brokerdllfontSaves.exe
Token: SeDebugPrivilege	3460	sihost.exe

Suspicious use of WriteProcessMemory 13 IoCs

description	pid	Process	procid_target
PID 3264 wrote to memory of 1996	3264	578edb8b414da23d4b6754bb7a0aa431.exe	69
PID 3264 wrote to memory of 1996	3264	578edb8b414da23d4b6754bb7a0aa431.exe	69
PID 3264 wrote to memory of 1996	3264	578edb8b414da23d4b6754bb7a0aa431.exe	69
PID 1996 wrote to memory of 764	1996	hgfdfds.exe	70
PID 1996 wrote to memory of 764	1996	hgfdfds.exe	70
PID 1996 wrote to memory of 764	1996	hgfdfds.exe	70
PID 764 wrote to memory of 1020	764	WScript.exe	71
PID 764 wrote to memory of 1020	764	WScript.exe	71
PID 764 wrote to memory of 1020	764	WScript.exe	71
PID 1020 wrote to memory of 1844	1020	cmd.exe	73
PID 1020 wrote to memory of 1844	1020	cmd.exe	73
PID 1844 wrote to memory of 3460	1844	brokerdllfontSaves.exe	83
PID 1844 wrote to memory of 3460	1844	brokerdllfontSaves.exe	83

C:\Users\Admin\AppData\Local\Temp\578edb8b414da23d4b6754bb7a0aa431.exe
"C:\Users\Admin\AppData\Local\Temp\578edb8b414da23d4b6754bb7a0aa431.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3264
- C:\Users\Public\Videos\hgfdfds.exe
  "C:\Users\Public\Videos\hgfdfds.exe"
  2⤵
  - Executes dropped EXE
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:1996
- - C:\Windows\SysWOW64\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\brokerdll\0uqRajZu4PANmKEO5mXeA7es.vbe"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:764
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\brokerdll\ozqbAX.bat" "
      4⤵
      Suspicious use of WriteProcessMemory
      PID:1020
    - - C:\brokerdll\brokerdllfontSaves.exe
        
        "C:\brokerdll\brokerdllfontSaves.exe"
        5⤵
        Executes dropped EXE
        Adds Run key to start application
        Drops file in System32 directory
        Drops file in Program Files directory
        Drops file in Windows directory
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1844
      - C:\brokerdll\sihost.exe
        
        "C:\brokerdll\sihost.exe"
        6⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious behavior: GetForegroundWindowSpam
        Suspicious use of AdjustPrivilegeToken
        
        PID:3460

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OfficeClickToRun" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Photo Viewer\de-DE\OfficeClickToRun.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3192

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "System" /sc ONLOGON /tr "'C:\odt\System.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2536

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "services" /sc ONLOGON /tr "'C:\ProgramData\Start Menu\services.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2388

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsv" /sc ONLOGON /tr "'C:\Windows\System32\DefaultHrtfs\spoolsv.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:724

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sihost" /sc ONLOGON /tr "'C:\brokerdll\sihost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1512

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Windows\System32\BdeHdCfg\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1232

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "brokerdllfontSaves" /sc ONLOGON /tr "'C:\PerfLogs\brokerdllfontSaves.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1488

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "ShellExperienceHost" /sc ONLOGON /tr "'C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\AppxBlockMap\ShellExperienceHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3656