cbeec773f6bbe29a464a4f56c976e647b0232973eae95635d8e224bfeb8614ab

Analysis

user interaction
yes
max time kernel
14s
max time network
16s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
10/09/2026, 23:21

Target
RuntimeBroker.exe
Size 1.0MB
Sample260910-3b2edaxcrb
SHA256 cbeec773f6bbe29a464a4f56c976e647b0232973eae95635d8e224bfeb8614ab
MD5 ff6e2a39c096ec350ed8b6b20b7afb88
SHA1 797585b6c6ba4d8b8c9b134acced3119ac0645d3
SHA512 ac4c5532653297ad9960af2a6be6e3ffa15632f9e599ca6f5012420a01c7787971693dd7e67631f85c95c59cf00b5fbfacc9ed8fb64f8547d1d091f123bbc0fd
SSDEEP 24576:1pvpwvUvXbwxfxMTiMnkTbUhEpC5aVz6PK:1pv1ExI4TbUhEUaVzy
TLSH
T184353A57F2B354E8C57BD0B486629772FA30B4594534BF6E1E98E7311F31E608A2EB20
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

Adds Run key to start application 2 TTPs 1 IoCs

Registry Run Keys / Startup Folder

Modify Registry

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000\Software\Microsoft\Windows\CurrentVersion\Run\RuntimeBroker_GdUq = "C:\\Users\\Admin\\AppData\\Local\\Temp\\RuntimeBroker.exe"	RuntimeBroker.exe

Maps connected drives based on registry 3 TTPs 2 IoCs

Disk information is often read in order to detect sandboxing environments.

Query Registry

Peripheral Device Discovery

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0	RuntimeBroker.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum	RuntimeBroker.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

Scheduled Task

pid	Process
4232	schtasks.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1796	RuntimeBroker.exe
1796	RuntimeBroker.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 1796 wrote to memory of 4232	1796	RuntimeBroker.exe	89

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\RuntimeBroker.exe
"C:\Users\Admin\AppData\Local\Temp\RuntimeBroker.exe"
1⤵
- Adds Run key to start application
- Maps connected drives based on registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1796
- C:\Windows\SYSTEM32\schtasks.exe
  schtasks /create /tn "MicrosoftEdgeUpdateTaskMachineGdU" /tr "C:\Users\Admin\AppData\Local\Temp\RuntimeBroker.exe" /sc onlogon /rl highest /f
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:4232