cybergate | 4c13f6f529db1ad620ffcf90975871198e189732eadd94b2159ce2e235ed803f

Modify Registry

Processes:

4c13f6f529db1ad620ffcf90975871198e189732eadd94b2159ce2e235ed803f.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	4c13f6f529db1ad620ffcf90975871198e189732eadd94b2159ce2e235ed803f.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Policies = "c:\\Java°\\install\\Java°.exe"	4c13f6f529db1ad620ffcf90975871198e189732eadd94b2159ce2e235ed803f.exe
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	4c13f6f529db1ad620ffcf90975871198e189732eadd94b2159ce2e235ed803f.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Policies = "c:\\Java°\\install\\Java°.exe"	4c13f6f529db1ad620ffcf90975871198e189732eadd94b2159ce2e235ed803f.exe

Executes dropped EXE 1 IoCs

Processes:

Java°.exe

pid process

4148 Java°.exe

pid	process
4148	Java°.exe

Modifies Installed Components in the registry 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

Modify Registry

Processes:

explorer.exe4c13f6f529db1ad620ffcf90975871198e189732eadd94b2159ce2e235ed803f.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{JL8123BA-J2V8-KWH6-35P7-57XX21RM12UJ}\StubPath = "c:\\Java°\\install\\Java°.exe"	explorer.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{JL8123BA-J2V8-KWH6-35P7-57XX21RM12UJ}	4c13f6f529db1ad620ffcf90975871198e189732eadd94b2159ce2e235ed803f.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{JL8123BA-J2V8-KWH6-35P7-57XX21RM12UJ}\StubPath = "c:\\Java°\\install\\Java°.exe Restart"	4c13f6f529db1ad620ffcf90975871198e189732eadd94b2159ce2e235ed803f.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{JL8123BA-J2V8-KWH6-35P7-57XX21RM12UJ}	explorer.exe

UPX packed file 17 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral2/memory/2200-133-0x0000000024010000-0x0000000024072000-memory.dmp	upx
behavioral2/memory/2200-138-0x0000000024080000-0x00000000240E2000-memory.dmp	upx
behavioral2/memory/5044-141-0x0000000024080000-0x00000000240E2000-memory.dmp	upx
behavioral2/memory/5044-144-0x0000000024080000-0x00000000240E2000-memory.dmp	upx
behavioral2/memory/2200-147-0x00000000240F0000-0x0000000024152000-memory.dmp	upx
behavioral2/memory/224-150-0x00000000240F0000-0x0000000024152000-memory.dmp	upx
behavioral2/memory/224-153-0x00000000240F0000-0x0000000024152000-memory.dmp	upx
behavioral2/memory/4148-154-0x0000000031BB0000-0x0000000031BBD000-memory.dmp	upx
behavioral2/memory/4868-155-0x0000000031BD0000-0x0000000031BDD000-memory.dmp	upx
behavioral2/memory/5044-156-0x0000000031BA0000-0x0000000031BAD000-memory.dmp	upx
behavioral2/memory/4148-157-0x0000000031BB0000-0x0000000031BBD000-memory.dmp	upx
behavioral2/memory/4868-158-0x0000000031BD0000-0x0000000031BDD000-memory.dmp	upx
behavioral2/memory/224-159-0x00000000240F0000-0x0000000024152000-memory.dmp	upx
behavioral2/memory/5044-160-0x0000000031BA0000-0x0000000031BAD000-memory.dmp	upx
behavioral2/memory/4868-161-0x0000000031BD0000-0x0000000031BDD000-memory.dmp	upx
behavioral2/memory/4868-162-0x0000000031BD0000-0x0000000031BDD000-memory.dmp	upx
behavioral2/memory/4148-163-0x0000000031BB0000-0x0000000031BBD000-memory.dmp	upx

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

System Information Discovery

Processes:

4c13f6f529db1ad620ffcf90975871198e189732eadd94b2159ce2e235ed803f.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation	4c13f6f529db1ad620ffcf90975871198e189732eadd94b2159ce2e235ed803f.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

Modify Registry

Processes:

4c13f6f529db1ad620ffcf90975871198e189732eadd94b2159ce2e235ed803f.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run	4c13f6f529db1ad620ffcf90975871198e189732eadd94b2159ce2e235ed803f.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Realtek = "c:\\Java°\\install\\Java°.exe"	4c13f6f529db1ad620ffcf90975871198e189732eadd94b2159ce2e235ed803f.exe
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Windows\CurrentVersion\Run	4c13f6f529db1ad620ffcf90975871198e189732eadd94b2159ce2e235ed803f.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\RealtekSound = "c:\\Java°\\install\\Java°.exe"	4c13f6f529db1ad620ffcf90975871198e189732eadd94b2159ce2e235ed803f.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

4868 4148 WerFault.exe Java°.exe

pid	pid_target	process	target process
4868	4148	WerFault.exe	Java°.exe

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

Processes:

WerFault.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	WerFault.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

System Information Discovery

Processes:

WerFault.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WerFault.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

4c13f6f529db1ad620ffcf90975871198e189732eadd94b2159ce2e235ed803f.exe4c13f6f529db1ad620ffcf90975871198e189732eadd94b2159ce2e235ed803f.exe

pid	process
2200	4c13f6f529db1ad620ffcf90975871198e189732eadd94b2159ce2e235ed803f.exe
2200	4c13f6f529db1ad620ffcf90975871198e189732eadd94b2159ce2e235ed803f.exe
224	4c13f6f529db1ad620ffcf90975871198e189732eadd94b2159ce2e235ed803f.exe
224	4c13f6f529db1ad620ffcf90975871198e189732eadd94b2159ce2e235ed803f.exe
224	4c13f6f529db1ad620ffcf90975871198e189732eadd94b2159ce2e235ed803f.exe
224	4c13f6f529db1ad620ffcf90975871198e189732eadd94b2159ce2e235ed803f.exe
224	4c13f6f529db1ad620ffcf90975871198e189732eadd94b2159ce2e235ed803f.exe
224	4c13f6f529db1ad620ffcf90975871198e189732eadd94b2159ce2e235ed803f.exe
224	4c13f6f529db1ad620ffcf90975871198e189732eadd94b2159ce2e235ed803f.exe
224	4c13f6f529db1ad620ffcf90975871198e189732eadd94b2159ce2e235ed803f.exe
224	4c13f6f529db1ad620ffcf90975871198e189732eadd94b2159ce2e235ed803f.exe
224	4c13f6f529db1ad620ffcf90975871198e189732eadd94b2159ce2e235ed803f.exe
224	4c13f6f529db1ad620ffcf90975871198e189732eadd94b2159ce2e235ed803f.exe
224	4c13f6f529db1ad620ffcf90975871198e189732eadd94b2159ce2e235ed803f.exe
224	4c13f6f529db1ad620ffcf90975871198e189732eadd94b2159ce2e235ed803f.exe
224	4c13f6f529db1ad620ffcf90975871198e189732eadd94b2159ce2e235ed803f.exe
224	4c13f6f529db1ad620ffcf90975871198e189732eadd94b2159ce2e235ed803f.exe
224	4c13f6f529db1ad620ffcf90975871198e189732eadd94b2159ce2e235ed803f.exe
224	4c13f6f529db1ad620ffcf90975871198e189732eadd94b2159ce2e235ed803f.exe
224	4c13f6f529db1ad620ffcf90975871198e189732eadd94b2159ce2e235ed803f.exe
224	4c13f6f529db1ad620ffcf90975871198e189732eadd94b2159ce2e235ed803f.exe
224	4c13f6f529db1ad620ffcf90975871198e189732eadd94b2159ce2e235ed803f.exe
224	4c13f6f529db1ad620ffcf90975871198e189732eadd94b2159ce2e235ed803f.exe
224	4c13f6f529db1ad620ffcf90975871198e189732eadd94b2159ce2e235ed803f.exe
224	4c13f6f529db1ad620ffcf90975871198e189732eadd94b2159ce2e235ed803f.exe
224	4c13f6f529db1ad620ffcf90975871198e189732eadd94b2159ce2e235ed803f.exe
224	4c13f6f529db1ad620ffcf90975871198e189732eadd94b2159ce2e235ed803f.exe
224	4c13f6f529db1ad620ffcf90975871198e189732eadd94b2159ce2e235ed803f.exe
224	4c13f6f529db1ad620ffcf90975871198e189732eadd94b2159ce2e235ed803f.exe
224	4c13f6f529db1ad620ffcf90975871198e189732eadd94b2159ce2e235ed803f.exe
224	4c13f6f529db1ad620ffcf90975871198e189732eadd94b2159ce2e235ed803f.exe
224	4c13f6f529db1ad620ffcf90975871198e189732eadd94b2159ce2e235ed803f.exe
224	4c13f6f529db1ad620ffcf90975871198e189732eadd94b2159ce2e235ed803f.exe
224	4c13f6f529db1ad620ffcf90975871198e189732eadd94b2159ce2e235ed803f.exe
224	4c13f6f529db1ad620ffcf90975871198e189732eadd94b2159ce2e235ed803f.exe
224	4c13f6f529db1ad620ffcf90975871198e189732eadd94b2159ce2e235ed803f.exe
224	4c13f6f529db1ad620ffcf90975871198e189732eadd94b2159ce2e235ed803f.exe
224	4c13f6f529db1ad620ffcf90975871198e189732eadd94b2159ce2e235ed803f.exe
224	4c13f6f529db1ad620ffcf90975871198e189732eadd94b2159ce2e235ed803f.exe
224	4c13f6f529db1ad620ffcf90975871198e189732eadd94b2159ce2e235ed803f.exe
224	4c13f6f529db1ad620ffcf90975871198e189732eadd94b2159ce2e235ed803f.exe
224	4c13f6f529db1ad620ffcf90975871198e189732eadd94b2159ce2e235ed803f.exe
224	4c13f6f529db1ad620ffcf90975871198e189732eadd94b2159ce2e235ed803f.exe
224	4c13f6f529db1ad620ffcf90975871198e189732eadd94b2159ce2e235ed803f.exe
224	4c13f6f529db1ad620ffcf90975871198e189732eadd94b2159ce2e235ed803f.exe
224	4c13f6f529db1ad620ffcf90975871198e189732eadd94b2159ce2e235ed803f.exe
224	4c13f6f529db1ad620ffcf90975871198e189732eadd94b2159ce2e235ed803f.exe
224	4c13f6f529db1ad620ffcf90975871198e189732eadd94b2159ce2e235ed803f.exe
224	4c13f6f529db1ad620ffcf90975871198e189732eadd94b2159ce2e235ed803f.exe
224	4c13f6f529db1ad620ffcf90975871198e189732eadd94b2159ce2e235ed803f.exe
224	4c13f6f529db1ad620ffcf90975871198e189732eadd94b2159ce2e235ed803f.exe
224	4c13f6f529db1ad620ffcf90975871198e189732eadd94b2159ce2e235ed803f.exe
224	4c13f6f529db1ad620ffcf90975871198e189732eadd94b2159ce2e235ed803f.exe
224	4c13f6f529db1ad620ffcf90975871198e189732eadd94b2159ce2e235ed803f.exe
224	4c13f6f529db1ad620ffcf90975871198e189732eadd94b2159ce2e235ed803f.exe
224	4c13f6f529db1ad620ffcf90975871198e189732eadd94b2159ce2e235ed803f.exe
224	4c13f6f529db1ad620ffcf90975871198e189732eadd94b2159ce2e235ed803f.exe
224	4c13f6f529db1ad620ffcf90975871198e189732eadd94b2159ce2e235ed803f.exe
224	4c13f6f529db1ad620ffcf90975871198e189732eadd94b2159ce2e235ed803f.exe
224	4c13f6f529db1ad620ffcf90975871198e189732eadd94b2159ce2e235ed803f.exe
224	4c13f6f529db1ad620ffcf90975871198e189732eadd94b2159ce2e235ed803f.exe
224	4c13f6f529db1ad620ffcf90975871198e189732eadd94b2159ce2e235ed803f.exe
224	4c13f6f529db1ad620ffcf90975871198e189732eadd94b2159ce2e235ed803f.exe
224	4c13f6f529db1ad620ffcf90975871198e189732eadd94b2159ce2e235ed803f.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

4c13f6f529db1ad620ffcf90975871198e189732eadd94b2159ce2e235ed803f.exe

pid process

224 4c13f6f529db1ad620ffcf90975871198e189732eadd94b2159ce2e235ed803f.exe

pid	process
224	4c13f6f529db1ad620ffcf90975871198e189732eadd94b2159ce2e235ed803f.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

4c13f6f529db1ad620ffcf90975871198e189732eadd94b2159ce2e235ed803f.exe

description	pid	process
Token: SeDebugPrivilege	224	4c13f6f529db1ad620ffcf90975871198e189732eadd94b2159ce2e235ed803f.exe
Token: SeDebugPrivilege	224	4c13f6f529db1ad620ffcf90975871198e189732eadd94b2159ce2e235ed803f.exe

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

4c13f6f529db1ad620ffcf90975871198e189732eadd94b2159ce2e235ed803f.exe

pid process

2200 4c13f6f529db1ad620ffcf90975871198e189732eadd94b2159ce2e235ed803f.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

4c13f6f529db1ad620ffcf90975871198e189732eadd94b2159ce2e235ed803f.exe

description	pid	process	target process
PID 2200 wrote to memory of 1124	2200	4c13f6f529db1ad620ffcf90975871198e189732eadd94b2159ce2e235ed803f.exe	Explorer.EXE
PID 2200 wrote to memory of 1124	2200	4c13f6f529db1ad620ffcf90975871198e189732eadd94b2159ce2e235ed803f.exe	Explorer.EXE
PID 2200 wrote to memory of 1124	2200	4c13f6f529db1ad620ffcf90975871198e189732eadd94b2159ce2e235ed803f.exe	Explorer.EXE
PID 2200 wrote to memory of 1124	2200	4c13f6f529db1ad620ffcf90975871198e189732eadd94b2159ce2e235ed803f.exe	Explorer.EXE
PID 2200 wrote to memory of 1124	2200	4c13f6f529db1ad620ffcf90975871198e189732eadd94b2159ce2e235ed803f.exe	Explorer.EXE
PID 2200 wrote to memory of 1124	2200	4c13f6f529db1ad620ffcf90975871198e189732eadd94b2159ce2e235ed803f.exe	Explorer.EXE
PID 2200 wrote to memory of 1124	2200	4c13f6f529db1ad620ffcf90975871198e189732eadd94b2159ce2e235ed803f.exe	Explorer.EXE
PID 2200 wrote to memory of 1124	2200	4c13f6f529db1ad620ffcf90975871198e189732eadd94b2159ce2e235ed803f.exe	Explorer.EXE
PID 2200 wrote to memory of 1124	2200	4c13f6f529db1ad620ffcf90975871198e189732eadd94b2159ce2e235ed803f.exe	Explorer.EXE
PID 2200 wrote to memory of 1124	2200	4c13f6f529db1ad620ffcf90975871198e189732eadd94b2159ce2e235ed803f.exe	Explorer.EXE
PID 2200 wrote to memory of 1124	2200	4c13f6f529db1ad620ffcf90975871198e189732eadd94b2159ce2e235ed803f.exe	Explorer.EXE
PID 2200 wrote to memory of 1124	2200	4c13f6f529db1ad620ffcf90975871198e189732eadd94b2159ce2e235ed803f.exe	Explorer.EXE
PID 2200 wrote to memory of 1124	2200	4c13f6f529db1ad620ffcf90975871198e189732eadd94b2159ce2e235ed803f.exe	Explorer.EXE
PID 2200 wrote to memory of 1124	2200	4c13f6f529db1ad620ffcf90975871198e189732eadd94b2159ce2e235ed803f.exe	Explorer.EXE
PID 2200 wrote to memory of 1124	2200	4c13f6f529db1ad620ffcf90975871198e189732eadd94b2159ce2e235ed803f.exe	Explorer.EXE
PID 2200 wrote to memory of 1124	2200	4c13f6f529db1ad620ffcf90975871198e189732eadd94b2159ce2e235ed803f.exe	Explorer.EXE
PID 2200 wrote to memory of 1124	2200	4c13f6f529db1ad620ffcf90975871198e189732eadd94b2159ce2e235ed803f.exe	Explorer.EXE
PID 2200 wrote to memory of 1124	2200	4c13f6f529db1ad620ffcf90975871198e189732eadd94b2159ce2e235ed803f.exe	Explorer.EXE
PID 2200 wrote to memory of 1124	2200	4c13f6f529db1ad620ffcf90975871198e189732eadd94b2159ce2e235ed803f.exe	Explorer.EXE
PID 2200 wrote to memory of 1124	2200	4c13f6f529db1ad620ffcf90975871198e189732eadd94b2159ce2e235ed803f.exe	Explorer.EXE
PID 2200 wrote to memory of 1124	2200	4c13f6f529db1ad620ffcf90975871198e189732eadd94b2159ce2e235ed803f.exe	Explorer.EXE
PID 2200 wrote to memory of 1124	2200	4c13f6f529db1ad620ffcf90975871198e189732eadd94b2159ce2e235ed803f.exe	Explorer.EXE
PID 2200 wrote to memory of 1124	2200	4c13f6f529db1ad620ffcf90975871198e189732eadd94b2159ce2e235ed803f.exe	Explorer.EXE
PID 2200 wrote to memory of 1124	2200	4c13f6f529db1ad620ffcf90975871198e189732eadd94b2159ce2e235ed803f.exe	Explorer.EXE
PID 2200 wrote to memory of 1124	2200	4c13f6f529db1ad620ffcf90975871198e189732eadd94b2159ce2e235ed803f.exe	Explorer.EXE
PID 2200 wrote to memory of 1124	2200	4c13f6f529db1ad620ffcf90975871198e189732eadd94b2159ce2e235ed803f.exe	Explorer.EXE
PID 2200 wrote to memory of 1124	2200	4c13f6f529db1ad620ffcf90975871198e189732eadd94b2159ce2e235ed803f.exe	Explorer.EXE
PID 2200 wrote to memory of 1124	2200	4c13f6f529db1ad620ffcf90975871198e189732eadd94b2159ce2e235ed803f.exe	Explorer.EXE
PID 2200 wrote to memory of 1124	2200	4c13f6f529db1ad620ffcf90975871198e189732eadd94b2159ce2e235ed803f.exe	Explorer.EXE
PID 2200 wrote to memory of 1124	2200	4c13f6f529db1ad620ffcf90975871198e189732eadd94b2159ce2e235ed803f.exe	Explorer.EXE
PID 2200 wrote to memory of 1124	2200	4c13f6f529db1ad620ffcf90975871198e189732eadd94b2159ce2e235ed803f.exe	Explorer.EXE
PID 2200 wrote to memory of 1124	2200	4c13f6f529db1ad620ffcf90975871198e189732eadd94b2159ce2e235ed803f.exe	Explorer.EXE
PID 2200 wrote to memory of 1124	2200	4c13f6f529db1ad620ffcf90975871198e189732eadd94b2159ce2e235ed803f.exe	Explorer.EXE
PID 2200 wrote to memory of 1124	2200	4c13f6f529db1ad620ffcf90975871198e189732eadd94b2159ce2e235ed803f.exe	Explorer.EXE
PID 2200 wrote to memory of 1124	2200	4c13f6f529db1ad620ffcf90975871198e189732eadd94b2159ce2e235ed803f.exe	Explorer.EXE
PID 2200 wrote to memory of 1124	2200	4c13f6f529db1ad620ffcf90975871198e189732eadd94b2159ce2e235ed803f.exe	Explorer.EXE
PID 2200 wrote to memory of 1124	2200	4c13f6f529db1ad620ffcf90975871198e189732eadd94b2159ce2e235ed803f.exe	Explorer.EXE
PID 2200 wrote to memory of 1124	2200	4c13f6f529db1ad620ffcf90975871198e189732eadd94b2159ce2e235ed803f.exe	Explorer.EXE
PID 2200 wrote to memory of 1124	2200	4c13f6f529db1ad620ffcf90975871198e189732eadd94b2159ce2e235ed803f.exe	Explorer.EXE
PID 2200 wrote to memory of 1124	2200	4c13f6f529db1ad620ffcf90975871198e189732eadd94b2159ce2e235ed803f.exe	Explorer.EXE
PID 2200 wrote to memory of 1124	2200	4c13f6f529db1ad620ffcf90975871198e189732eadd94b2159ce2e235ed803f.exe	Explorer.EXE
PID 2200 wrote to memory of 1124	2200	4c13f6f529db1ad620ffcf90975871198e189732eadd94b2159ce2e235ed803f.exe	Explorer.EXE
PID 2200 wrote to memory of 1124	2200	4c13f6f529db1ad620ffcf90975871198e189732eadd94b2159ce2e235ed803f.exe	Explorer.EXE
PID 2200 wrote to memory of 1124	2200	4c13f6f529db1ad620ffcf90975871198e189732eadd94b2159ce2e235ed803f.exe	Explorer.EXE
PID 2200 wrote to memory of 1124	2200	4c13f6f529db1ad620ffcf90975871198e189732eadd94b2159ce2e235ed803f.exe	Explorer.EXE
PID 2200 wrote to memory of 1124	2200	4c13f6f529db1ad620ffcf90975871198e189732eadd94b2159ce2e235ed803f.exe	Explorer.EXE
PID 2200 wrote to memory of 1124	2200	4c13f6f529db1ad620ffcf90975871198e189732eadd94b2159ce2e235ed803f.exe	Explorer.EXE
PID 2200 wrote to memory of 1124	2200	4c13f6f529db1ad620ffcf90975871198e189732eadd94b2159ce2e235ed803f.exe	Explorer.EXE
PID 2200 wrote to memory of 1124	2200	4c13f6f529db1ad620ffcf90975871198e189732eadd94b2159ce2e235ed803f.exe	Explorer.EXE
PID 2200 wrote to memory of 1124	2200	4c13f6f529db1ad620ffcf90975871198e189732eadd94b2159ce2e235ed803f.exe	Explorer.EXE
PID 2200 wrote to memory of 1124	2200	4c13f6f529db1ad620ffcf90975871198e189732eadd94b2159ce2e235ed803f.exe	Explorer.EXE
PID 2200 wrote to memory of 1124	2200	4c13f6f529db1ad620ffcf90975871198e189732eadd94b2159ce2e235ed803f.exe	Explorer.EXE
PID 2200 wrote to memory of 1124	2200	4c13f6f529db1ad620ffcf90975871198e189732eadd94b2159ce2e235ed803f.exe	Explorer.EXE
PID 2200 wrote to memory of 1124	2200	4c13f6f529db1ad620ffcf90975871198e189732eadd94b2159ce2e235ed803f.exe	Explorer.EXE
PID 2200 wrote to memory of 1124	2200	4c13f6f529db1ad620ffcf90975871198e189732eadd94b2159ce2e235ed803f.exe	Explorer.EXE
PID 2200 wrote to memory of 1124	2200	4c13f6f529db1ad620ffcf90975871198e189732eadd94b2159ce2e235ed803f.exe	Explorer.EXE
PID 2200 wrote to memory of 1124	2200	4c13f6f529db1ad620ffcf90975871198e189732eadd94b2159ce2e235ed803f.exe	Explorer.EXE
PID 2200 wrote to memory of 1124	2200	4c13f6f529db1ad620ffcf90975871198e189732eadd94b2159ce2e235ed803f.exe	Explorer.EXE
PID 2200 wrote to memory of 1124	2200	4c13f6f529db1ad620ffcf90975871198e189732eadd94b2159ce2e235ed803f.exe	Explorer.EXE
PID 2200 wrote to memory of 1124	2200	4c13f6f529db1ad620ffcf90975871198e189732eadd94b2159ce2e235ed803f.exe	Explorer.EXE
PID 2200 wrote to memory of 1124	2200	4c13f6f529db1ad620ffcf90975871198e189732eadd94b2159ce2e235ed803f.exe	Explorer.EXE
PID 2200 wrote to memory of 1124	2200	4c13f6f529db1ad620ffcf90975871198e189732eadd94b2159ce2e235ed803f.exe	Explorer.EXE
PID 2200 wrote to memory of 1124	2200	4c13f6f529db1ad620ffcf90975871198e189732eadd94b2159ce2e235ed803f.exe	Explorer.EXE
PID 2200 wrote to memory of 1124	2200	4c13f6f529db1ad620ffcf90975871198e189732eadd94b2159ce2e235ed803f.exe	Explorer.EXE

C:\Windows\system32\lsass.exe
C:\Windows\system32\lsass.exe
1⤵
PID:664

C:\Windows\system32\winlogon.exe
winlogon.exe
1⤵
PID:580

C:\Windows\system32\fontdrvhost.exe
"fontdrvhost.exe"
2⤵
PID:776

C:\Windows\system32\dwm.exe
"dwm.exe"
2⤵
PID:1020

C:\Windows\system32\fontdrvhost.exe
"fontdrvhost.exe"
1⤵
PID:768

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DcomLaunch -p
1⤵
PID:784

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
2⤵
PID:3464

C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
2⤵
PID:3560

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
2⤵
PID:3400

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
2⤵
PID:3304

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
2⤵
PID:3764

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
2⤵
PID:3996

C:\Windows\system32\wbem\wmiprvse.exe
C:\Windows\system32\wbem\wmiprvse.exe
2⤵
PID:528

C:\Windows\system32\SppExtComObj.exe
C:\Windows\system32\SppExtComObj.exe -Embedding
2⤵
PID:2144

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
2⤵
PID:824

C:\Windows\system32\backgroundTaskHost.exe
"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppX53ypgrj20bgndg05hj3tc7z654myszwp.mca
2⤵
PID:4508

C:\Windows\System32\mousocoreworker.exe
C:\Windows\System32\mousocoreworker.exe -Embedding
2⤵
PID:4780

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k RPCSS -p
1⤵
PID:896

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DcomLaunch -p -s LSM
1⤵
PID:944

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s gpsvc
1⤵
PID:372

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Schedule
1⤵
PID:888

C:\Windows\system32\taskhostw.exe
taskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}
2⤵
PID:2912

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s TimeBrokerSvc
1⤵
PID:428

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s NcbService
1⤵
PID:1036

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s lmhosts
1⤵
PID:744

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork -p
1⤵
PID:1064

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s ProfSvc
1⤵
PID:1144

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s Themes
1⤵
PID:1396

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetworkFirewall -p
1⤵
PID:1816

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc
1⤵
PID:3096

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:1124

C:\Users\Admin\AppData\Local\Temp\4c13f6f529db1ad620ffcf90975871198e189732eadd94b2159ce2e235ed803f.exe
"C:\Users\Admin\AppData\Local\Temp\4c13f6f529db1ad620ffcf90975871198e189732eadd94b2159ce2e235ed803f.exe"
2⤵
- Adds policy Run key to start application
- Modifies Installed Components in the registry
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:2200

C:\Windows\SysWOW64\explorer.exe
explorer.exe
3⤵
- Modifies Installed Components in the registry
PID:5044

C:\Users\Admin\AppData\Local\Temp\4c13f6f529db1ad620ffcf90975871198e189732eadd94b2159ce2e235ed803f.exe
"C:\Users\Admin\AppData\Local\Temp\4c13f6f529db1ad620ffcf90975871198e189732eadd94b2159ce2e235ed803f.exe"
3⤵
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
PID:224

C:\Java°\install\Java°.exe
"C:\Java°\install\Java°.exe"
4⤵
- Executes dropped EXE
PID:4148

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4148 -s 572
5⤵
- Program crash
- Checks processor information in registry
- Enumerates system info in registry
PID:4868

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc
1⤵
PID:2844

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
PID:2808

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Winmgmt
1⤵
PID:2532

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s WpnService
1⤵
PID:2512

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s TrkWks
1⤵
PID:2480

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s LanmanServer
1⤵
PID:2456

C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe
"C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" /service
1⤵
PID:2396

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkService -p -s CryptSvc
1⤵
PID:2388

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted -p -s PolicyAgent
1⤵
PID:2288

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s IKEEXT
1⤵
PID:2280

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -s RmSvc
1⤵
PID:2232

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s LanmanWorkstation
1⤵
PID:2100

C:\Windows\System32\spoolsv.exe
C:\Windows\System32\spoolsv.exe
1⤵
PID:1712

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s ShellHWDetection
1⤵
PID:2008

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p
1⤵
PID:1948

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s StorSvc
1⤵
PID:1964

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkService -p -s Dnscache
1⤵
PID:1940

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k appmodel -p -s StateRepository
1⤵
PID:1932

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s CDPSvc
1⤵
PID:2856

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s WinHttpAutoProxySvc
1⤵
PID:4908

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalService -p -s netprofm
1⤵
PID:1792

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p
1⤵
PID:1784

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager
1⤵
PID:1508

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -s W32Time
1⤵
PID:3956

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s FontCache
1⤵
PID:1652

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p
1⤵
PID:904

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s wlidsvc
1⤵
PID:3868

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s NlaSvc
1⤵
PID:1644

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k WerSvcGroup
1⤵
PID:3712

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 4148 -ip 4148
2⤵
PID:3980

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s AudioEndpointBuilder
1⤵
PID:1632

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s SENS
1⤵
PID:1572

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s Dhcp
1⤵
PID:1492

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s DispBrokerDesktopSvc
1⤵
PID:1408

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s EventSystem
1⤵
PID:1388

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s nsi
1⤵
PID:1344

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s UserManager
1⤵
PID:1232

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s EventLog
1⤵
PID:1224

C:\Windows\System32\WaaSMedicAgent.exe
C:\Windows\System32\WaaSMedicAgent.exe 760aafda4a4642cb61f20845dfaf8a89 +5RZNUi3skiBKai2z95vbQ.0.1.0.0.0
1⤵
PID:3496

C:\Windows\System32\Conhost.exe
\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
2⤵
PID:5092

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s wuauserv
1⤵
PID:4328

C:\Windows\servicing\TrustedInstaller.exe
C:\Windows\servicing\TrustedInstaller.exe
1⤵
PID:4576

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s UsoSvc
1⤵
PID:4660

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

3

Privilege Escalation

Defense Evasion

Modify Registry

3

Credential Access

Discovery

Query Registry

3

System Information Discovery

4