AtBroker.exe

• File Path: C:\windows\system32\AtBroker.exe
• Description: Windows Assistive Technology Manager

Hashes

Type	Hash
MD5	D1D7C8EA7A0E3DAC58C69CD5BD431644
SHA1	8ED631CA213FF5F52D6FF523FBC2069F6A92AFF6
SHA256	63A92B2A5C99F4C339BC55BA45B61D0CD6A4E4970B6BA9613B7B0E19771E4CD1
SHA384	402E135FBD15D839ECD43C7910D8B313AD3F2AD0D83D00A87D864EFA3F03235CE466CB1BFEB631E8C8630FE22C8CBAF1
SHA512	625DA76A65CD18C08B65DED435ACCB2085E81E00BB3F5377C577987AB270D70F6BD52254929E8BD646789607A6B159CE84A61FDD18D445E0968B63BED9F85837
SSDEEP	768:EO713Y7bS1JqhnUhQ900m33uOFq2jhQpGM6Ypbn2ZpuejqhOfusLdInbBrYzl2PY:dr5Q900AH6pGrxfusund0RssgSZMV2L

Signature

• Status: The file C:\windows\system32\AtBroker.exe is not digitally signed. You cannot run this script on the current system. For more information about running scripts and setting execution policy, see about_Execution_Policies at http://go.microsoft.com/fwlink/?LinkID=135170
• Serial: ``
• Thumbprint: ``
• Issuer:
• Subject:

File Metadata

• Original Filename: ATBroker.exe.mui
• Product Name: Microsoft Windows Operating System
• Company Name: Microsoft Corporation
• File Version: 6.3.9600.16384 (winblue_rtm.130821-1623)
• Product Version: 6.3.9600.16384
• Language: English (United States)
• Legal Copyright: Microsoft Corporation. All rights reserved.

Possible Misuse

The following table contains possible examples of AtBroker.exe being misused. While AtBroker.exe is not inherently malicious, its legitimate functionality can be abused for malicious purposes.

Source	Source File	Example	License
sigma	proc_creation_win_install_reg_debugger_backdoor.yml	- 'atbroker.exe'	DRL 1.0
sigma	proc_creation_win_susp_atbroker.yml	title: Suspicious Atbroker Execution	DRL 1.0
sigma	proc_creation_win_susp_atbroker.yml	description: Atbroker executing non-deafualt Assistive Technology applications	DRL 1.0
sigma	proc_creation_win_susp_atbroker.yml	- https://lolbas-project.github.io/lolbas/Binaries/Atbroker/	DRL 1.0
sigma	proc_creation_win_susp_atbroker.yml	Image\|endswith: 'AtBroker.exe'	DRL 1.0
sigma	registry_event_susp_atbroker_change.yml	title: Atbroker Registry Change	DRL 1.0
sigma	registry_event_susp_atbroker_change.yml	- https://github.com/LOLBAS-Project/LOLBAS/blob/master/yml/OSBinaries/Atbroker.yml	DRL 1.0
LOLBAS	Atbroker.yml	Name: Atbroker.exe
LOLBAS	Atbroker.yml	- Command: ATBroker.exe /start malware
LOLBAS	Atbroker.yml	- Path: C:\Windows\System32\Atbroker.exe
LOLBAS	Atbroker.yml	- Path: C:\Windows\SysWOW64\Atbroker.exe
LOLBAS	Atbroker.yml	- IOC: Unknown AT starting C:\Windows\System32\ATBroker.exe /start malware
atomic-red-team	T1546.008.md	* App Switcher: C:\Windows\System32\AtBroker.exe</blockquote>	MIT License. © 2018 Red Canary
atomic-red-team	T1546.008.md	| parent_list | Comma separated list of system binaries to which you want to attach each #{attached_process}. Default: “osk.exe” | String | osk.exe, sethc.exe, utilman.exe, magnify.exe, narrator.exe, DisplaySwitch.exe, atbroker.exe|	MIT License. © 2018 Red Canary

MIT License. Copyright (c) 2020-2021 Strontic.