4bcbb8983fe7425976c5a1789deff73fb138e80981f5ebfef1f835bcc6757760

Resubmissions

14/04/2025, 07:51

250414-jp1kfssjz9 10

14/04/2025, 07:46

250414-jl9nyssjt9 10

08/04/2025, 15:58

250408-tevasswl18 10

08/04/2025, 14:19

250408-rm2nqsvqw2 10

Analysis

max time kernel
103s
max time network
106s
platform
windows10-ltsc_2021_x64
resource
win10ltsc2021-20250410-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20250410-enlocale:en-usos:windows10-ltsc_2021-x64system
submitted
14/04/2025, 07:51

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

fa942bbb984e2be3a2e1d8414cc00cd7.exe
Size

984KB
MD5

fa942bbb984e2be3a2e1d8414cc00cd7
SHA1

822821106f149cbc674cccf5d8cc1aec612bb8f4
SHA256

07419cc322e8ed4baae30a8ba72afc56634175dd54b57c513112e420a9cc69b4
SHA512

57f062fa5d5fbfa9ebba4ca401e42954b0ed16ec7bc4f28bc6ca00b06e273bbe6dbcab895fc6e460262fcb42cd3a0705a61bb4de2d8a2a08baabb738868af2dc
SSDEEP

12288:zzZvuvewk/0pPPXA5q/TQ9+n95vV25gnwHexSDwbwvDxlpaS98IUNldnd65EgF1s:zzZvuGD2PvA5YxwmbZB6Uv

Score

10^/10

persistence

Malware Config

Signatures

Process spawned unexpected child process 5 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4032	2516	schtasks.exe	81
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3164	2516	schtasks.exe	81
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5160	2516	schtasks.exe	81
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5496	2516	schtasks.exe	81
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5844	2516	schtasks.exe	81

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-4260291853-3905407524-539084913-1000\Control Panel\International\Geo\Nation	fa942bbb984e2be3a2e1d8414cc00cd7.exe

Executes dropped EXE 6 IoCs

pid	Process
240	RuntimeBroker.exe
3160	spoolsv.exe
1756	fontdrvhost.exe
5280	RuntimeBroker.exe
5144	sysmon.exe
720	fontdrvhost.exe

Adds Run key to start application 2 TTPs 5 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\RuntimeBroker = "\"C:\\Program Files\\Common Files\\microsoft shared\\TextConv\\en-US\\RuntimeBroker.exe\""	fa942bbb984e2be3a2e1d8414cc00cd7.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\RuntimeBroker = "\"C:\\Windows\\System32\\txflog\\RuntimeBroker.exe\""	fa942bbb984e2be3a2e1d8414cc00cd7.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\fontdrvhost = "\"C:\\Program Files (x86)\\Internet Explorer\\de-DE\\fontdrvhost.exe\""	fa942bbb984e2be3a2e1d8414cc00cd7.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sysmon = "\"C:\\Documents and Settings\\sysmon.exe\""	fa942bbb984e2be3a2e1d8414cc00cd7.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\spoolsv = "\"C:\\Windows\\System32\\MSAMRNBEncoder\\spoolsv.exe\""	fa942bbb984e2be3a2e1d8414cc00cd7.exe

Drops file in System32 directory 8 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\MSAMRNBEncoder\RCXB8A2.tmp	fa942bbb984e2be3a2e1d8414cc00cd7.exe
File opened for modification	C:\Windows\System32\MSAMRNBEncoder\spoolsv.exe	fa942bbb984e2be3a2e1d8414cc00cd7.exe
File opened for modification	C:\Windows\System32\txflog\RCXBCAC.tmp	fa942bbb984e2be3a2e1d8414cc00cd7.exe
File opened for modification	C:\Windows\System32\txflog\RuntimeBroker.exe	fa942bbb984e2be3a2e1d8414cc00cd7.exe
File created	C:\Windows\System32\MSAMRNBEncoder\spoolsv.exe	fa942bbb984e2be3a2e1d8414cc00cd7.exe
File created	C:\Windows\System32\MSAMRNBEncoder\f3b6ecef712a24	fa942bbb984e2be3a2e1d8414cc00cd7.exe
File created	C:\Windows\System32\txflog\RuntimeBroker.exe	fa942bbb984e2be3a2e1d8414cc00cd7.exe
File created	C:\Windows\System32\txflog\9e8d7a4ca61bd9	fa942bbb984e2be3a2e1d8414cc00cd7.exe

Drops file in Program Files directory 8 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Internet Explorer\de-DE\fontdrvhost.exe	fa942bbb984e2be3a2e1d8414cc00cd7.exe
File created	C:\Program Files (x86)\Internet Explorer\de-DE\5b884080fd4f94	fa942bbb984e2be3a2e1d8414cc00cd7.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\TextConv\en-US\RCXBAA7.tmp	fa942bbb984e2be3a2e1d8414cc00cd7.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\TextConv\en-US\RuntimeBroker.exe	fa942bbb984e2be3a2e1d8414cc00cd7.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\de-DE\RCXBEB0.tmp	fa942bbb984e2be3a2e1d8414cc00cd7.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\de-DE\fontdrvhost.exe	fa942bbb984e2be3a2e1d8414cc00cd7.exe
File created	C:\Program Files\Common Files\microsoft shared\TextConv\en-US\RuntimeBroker.exe	fa942bbb984e2be3a2e1d8414cc00cd7.exe
File created	C:\Program Files\Common Files\microsoft shared\TextConv\en-US\9e8d7a4ca61bd9	fa942bbb984e2be3a2e1d8414cc00cd7.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-4260291853-3905407524-539084913-1000_Classes\Local Settings	fa942bbb984e2be3a2e1d8414cc00cd7.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 5 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
5844	schtasks.exe
4032	schtasks.exe
3164	schtasks.exe
5160	schtasks.exe
5496	schtasks.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
2116	fa942bbb984e2be3a2e1d8414cc00cd7.exe
2116	fa942bbb984e2be3a2e1d8414cc00cd7.exe
2116	fa942bbb984e2be3a2e1d8414cc00cd7.exe

Suspicious use of AdjustPrivilegeToken 7 IoCs

description	pid	Process
Token: SeDebugPrivilege	2116	fa942bbb984e2be3a2e1d8414cc00cd7.exe
Token: SeDebugPrivilege	240	RuntimeBroker.exe
Token: SeDebugPrivilege	3160	spoolsv.exe
Token: SeDebugPrivilege	1756	fontdrvhost.exe
Token: SeDebugPrivilege	5144	sysmon.exe
Token: SeDebugPrivilege	5280	RuntimeBroker.exe
Token: SeDebugPrivilege	720	fontdrvhost.exe

Suspicious use of WriteProcessMemory 16 IoCs

description	pid	Process	procid_target
PID 4400 wrote to memory of 240	4400	cmd.exe	94
PID 4400 wrote to memory of 240	4400	cmd.exe	94
PID 560 wrote to memory of 3160	560	cmd.exe	98
PID 560 wrote to memory of 3160	560	cmd.exe	98
PID 972 wrote to memory of 1756	972	cmd.exe	99
PID 972 wrote to memory of 1756	972	cmd.exe	99
PID 4512 wrote to memory of 5280	4512	cmd.exe	100
PID 4512 wrote to memory of 5280	4512	cmd.exe	100
PID 216 wrote to memory of 5144	216	cmd.exe	101
PID 216 wrote to memory of 5144	216	cmd.exe	101
PID 2116 wrote to memory of 2148	2116	fa942bbb984e2be3a2e1d8414cc00cd7.exe	102
PID 2116 wrote to memory of 2148	2116	fa942bbb984e2be3a2e1d8414cc00cd7.exe	102
PID 2148 wrote to memory of 5500	2148	cmd.exe	104
PID 2148 wrote to memory of 5500	2148	cmd.exe	104
PID 2148 wrote to memory of 720	2148	cmd.exe	105
PID 2148 wrote to memory of 720	2148	cmd.exe	105

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\fa942bbb984e2be3a2e1d8414cc00cd7.exe
"C:\Users\Admin\AppData\Local\Temp\fa942bbb984e2be3a2e1d8414cc00cd7.exe"
1⤵
- Checks computer location settings
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Program Files directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2116
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\USsK0JUF9z.bat"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2148
- - C:\Windows\system32\w32tm.exe
    w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
    3⤵
    PID:5500
- - C:\Program Files (x86)\Internet Explorer\de-DE\fontdrvhost.exe
    "C:\Program Files (x86)\Internet Explorer\de-DE\fontdrvhost.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of AdjustPrivilegeToken
    PID:720

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsv" /sc ONLOGON /tr "'C:\Windows\System32\MSAMRNBEncoder\spoolsv.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4032

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Windows\System32\MSAMRNBEncoder\spoolsv.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:560
- C:\Windows\System32\MSAMRNBEncoder\spoolsv.exe
  C:\Windows\System32\MSAMRNBEncoder\spoolsv.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:3160

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Program Files\Common Files\microsoft shared\TextConv\en-US\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3164

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Program Files\Common Files\microsoft shared\TextConv\en-US\RuntimeBroker.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4400
- C:\Program Files\Common Files\microsoft shared\TextConv\en-US\RuntimeBroker.exe
  "C:\Program Files\Common Files\microsoft shared\TextConv\en-US\RuntimeBroker.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:240

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Windows\System32\txflog\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5160

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Windows\System32\txflog\RuntimeBroker.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4512
- C:\Windows\System32\txflog\RuntimeBroker.exe
  C:\Windows\System32\txflog\RuntimeBroker.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:5280

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhost" /sc ONLOGON /tr "'C:\Program Files (x86)\Internet Explorer\de-DE\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5496

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Program Files (x86)\Internet Explorer\de-DE\fontdrvhost.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:972
- C:\Program Files (x86)\Internet Explorer\de-DE\fontdrvhost.exe
  "C:\Program Files (x86)\Internet Explorer\de-DE\fontdrvhost.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:1756

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sysmon" /sc ONLOGON /tr "'C:\Documents and Settings\sysmon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5844

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Documents and Settings\sysmon.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:216
- C:\Documents and Settings\sysmon.exe
  "C:\Documents and Settings\sysmon.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:5144

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\Common Files\microsoft shared\TextConv\en-US\RuntimeBroker.exe

Filesize
984KB

MD5
fa942bbb984e2be3a2e1d8414cc00cd7

SHA1
822821106f149cbc674cccf5d8cc1aec612bb8f4

SHA256
07419cc322e8ed4baae30a8ba72afc56634175dd54b57c513112e420a9cc69b4

SHA512
57f062fa5d5fbfa9ebba4ca401e42954b0ed16ec7bc4f28bc6ca00b06e273bbe6dbcab895fc6e460262fcb42cd3a0705a61bb4de2d8a2a08baabb738868af2dc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\RuntimeBroker.exe.log

Filesize
1KB

MD5
b08c36ce99a5ed11891ef6fc6d8647e9

SHA1
db95af417857221948eb1882e60f98ab2914bf1d

SHA256
cc9248a177495f45ec70b86c34fc5746c56730af36ace98ac7eb365dbafda674

SHA512
07e62581eace395b0a9699d727761648103180c21155d84ea09140f9e1c9690705c419118545aa67a564334bbde32710225fe3aa92b0b4b4210cb91f0058b1ea

Download Submit
C:\Users\Admin\AppData\Local\Temp\USsK0JUF9z.bat

Filesize
226B

MD5
aa70b63a1ff907680f90d7be12b84dcf

SHA1
0f29b95789b7bc3beca1d35ea8a410e191d4c35b

SHA256
f251a107ac2c71a5f9cf2f13ae6201d35e465158dc7cf07ebfbea823f2096216

SHA512
2ef27540a5da28f1080836615ba85d112e23ecb9678d6a2f236de03cf7d7cef1b1f422c55b491a4c4f900dfc20522b79f5bd8334a94088fca9316e4aeb0a641b

Download Submit
memory/720-58-0x000000001B250000-0x000000001B262000-memory.dmp

Filesize
72KB

Download
memory/2116-6-0x000000001B440000-0x000000001B450000-memory.dmp

Filesize
64KB

Download
memory/2116-11-0x000000001BC90000-0x000000001C1B8000-memory.dmp

Filesize
5.2MB

Download
memory/2116-7-0x000000001B450000-0x000000001B458000-memory.dmp

Filesize
32KB

Download
memory/2116-8-0x000000001B460000-0x000000001B470000-memory.dmp

Filesize
64KB

Download
memory/2116-0-0x00007FF945FC3000-0x00007FF945FC5000-memory.dmp

Filesize
8KB

Download
memory/2116-9-0x000000001B470000-0x000000001B47C000-memory.dmp

Filesize
48KB

Download
memory/2116-10-0x000000001B480000-0x000000001B492000-memory.dmp

Filesize
72KB

Download
memory/2116-5-0x00000000024F0000-0x0000000002500000-memory.dmp

Filesize
64KB

Download
memory/2116-12-0x000000001B500000-0x000000001B50C000-memory.dmp

Filesize
48KB

Download
memory/2116-4-0x000000001B490000-0x000000001B4E0000-memory.dmp

Filesize
320KB

Download
memory/2116-3-0x00000000024D0000-0x00000000024EC000-memory.dmp

Filesize
112KB

Download
memory/2116-50-0x00007FF945FC0000-0x00007FF946A82000-memory.dmp

Filesize
10.8MB

Download
memory/2116-2-0x00007FF945FC0000-0x00007FF946A82000-memory.dmp

Filesize
10.8MB

Download
memory/2116-1-0x0000000000210000-0x000000000030C000-memory.dmp

Filesize
1008KB

Download