Analysis
-
max time kernel
152s -
max time network
130s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
23-11-2022 16:54
Behavioral task
behavioral1
Sample
f296b1aec0a33147e1ddf3c6ef58964f06e4e337d445059c6f18f7bea000dcf3.exe
Resource
win7-20221111-en
General
-
Target
f296b1aec0a33147e1ddf3c6ef58964f06e4e337d445059c6f18f7bea000dcf3.exe
-
Size
289KB
-
MD5
42deb207036b3a3e3c9cbbe95487dd6b
-
SHA1
f4c77ad7d41e7f87021ffbb18e5880771123c9fa
-
SHA256
f296b1aec0a33147e1ddf3c6ef58964f06e4e337d445059c6f18f7bea000dcf3
-
SHA512
88b61ef4b621d5508f195713814c4183741cc5431a3f804dcc2ab90a8da1f532cef695a125759d99a1845f9595f6d717dd713ded037178504e1f57a11d802ba1
-
SSDEEP
6144:2OpslFlquhdBCkWYxuukP1pjSKSNVkq/MVJb6:2wsl1TBd47GLRMTb6
Malware Config
Extracted
cybergate
v1.07.5
remote
127.0.0.1:6335
081T3YH70D6RD4
-
enable_keylogger
true
-
enable_message_box
false
-
ftp_directory
./logs/
-
ftp_interval
30
-
injected_process
explorer.exe
-
install_dir
install
-
install_file
server.exe
-
install_flag
true
-
keylogger_enable_ftp
false
-
message_box_caption
Remote Administration anywhere in the world.
-
message_box_title
CyberGate
-
password
ikaros
-
regkey_hkcu
1
-
regkey_hklm
1
Signatures
-
Adds policy Run key to start application 2 TTPs 4 IoCs
Processes:
f296b1aec0a33147e1ddf3c6ef58964f06e4e337d445059c6f18f7bea000dcf3.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run f296b1aec0a33147e1ddf3c6ef58964f06e4e337d445059c6f18f7bea000dcf3.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Policies = "C:\\Windows\\system32\\install\\server.exe" f296b1aec0a33147e1ddf3c6ef58964f06e4e337d445059c6f18f7bea000dcf3.exe Key created \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run f296b1aec0a33147e1ddf3c6ef58964f06e4e337d445059c6f18f7bea000dcf3.exe Set value (str) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Policies = "C:\\Windows\\system32\\install\\server.exe" f296b1aec0a33147e1ddf3c6ef58964f06e4e337d445059c6f18f7bea000dcf3.exe -
Executes dropped EXE 1 IoCs
Processes:
server.exepid process 3124 server.exe -
Modifies Installed Components in the registry 2 TTPs 2 IoCs
Processes:
f296b1aec0a33147e1ddf3c6ef58964f06e4e337d445059c6f18f7bea000dcf3.exedescription ioc process Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{103BA07J-G56X-6Y36-WX27-11WW0JY1W1K2} f296b1aec0a33147e1ddf3c6ef58964f06e4e337d445059c6f18f7bea000dcf3.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{103BA07J-G56X-6Y36-WX27-11WW0JY1W1K2}\StubPath = "C:\\Windows\\system32\\install\\server.exe Restart" f296b1aec0a33147e1ddf3c6ef58964f06e4e337d445059c6f18f7bea000dcf3.exe -
Processes:
resource yara_rule behavioral2/memory/880-134-0x0000000010410000-0x0000000010475000-memory.dmp upx behavioral2/memory/808-137-0x0000000010410000-0x0000000010475000-memory.dmp upx behavioral2/memory/808-138-0x0000000010410000-0x0000000010475000-memory.dmp upx behavioral2/memory/808-143-0x0000000010410000-0x0000000010475000-memory.dmp upx -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
f296b1aec0a33147e1ddf3c6ef58964f06e4e337d445059c6f18f7bea000dcf3.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\Geo\Nation f296b1aec0a33147e1ddf3c6ef58964f06e4e337d445059c6f18f7bea000dcf3.exe -
Adds Run key to start application 2 TTPs 4 IoCs
Processes:
f296b1aec0a33147e1ddf3c6ef58964f06e4e337d445059c6f18f7bea000dcf3.exedescription ioc process Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run f296b1aec0a33147e1ddf3c6ef58964f06e4e337d445059c6f18f7bea000dcf3.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\1 = "C:\\Windows\\system32\\install\\server.exe" f296b1aec0a33147e1ddf3c6ef58964f06e4e337d445059c6f18f7bea000dcf3.exe Key created \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Windows\CurrentVersion\Run f296b1aec0a33147e1ddf3c6ef58964f06e4e337d445059c6f18f7bea000dcf3.exe Set value (str) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\1 = "C:\\Windows\\system32\\install\\server.exe" f296b1aec0a33147e1ddf3c6ef58964f06e4e337d445059c6f18f7bea000dcf3.exe -
Drops file in System32 directory 2 IoCs
Processes:
f296b1aec0a33147e1ddf3c6ef58964f06e4e337d445059c6f18f7bea000dcf3.exedescription ioc process File created C:\Windows\SysWOW64\install\server.exe f296b1aec0a33147e1ddf3c6ef58964f06e4e337d445059c6f18f7bea000dcf3.exe File opened for modification C:\Windows\SysWOW64\install\server.exe f296b1aec0a33147e1ddf3c6ef58964f06e4e337d445059c6f18f7bea000dcf3.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 1576 3124 WerFault.exe server.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
f296b1aec0a33147e1ddf3c6ef58964f06e4e337d445059c6f18f7bea000dcf3.exepid process 808 f296b1aec0a33147e1ddf3c6ef58964f06e4e337d445059c6f18f7bea000dcf3.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
Processes:
f296b1aec0a33147e1ddf3c6ef58964f06e4e337d445059c6f18f7bea000dcf3.exedescription pid process Token: SeBackupPrivilege 808 f296b1aec0a33147e1ddf3c6ef58964f06e4e337d445059c6f18f7bea000dcf3.exe Token: SeRestorePrivilege 808 f296b1aec0a33147e1ddf3c6ef58964f06e4e337d445059c6f18f7bea000dcf3.exe Token: SeDebugPrivilege 808 f296b1aec0a33147e1ddf3c6ef58964f06e4e337d445059c6f18f7bea000dcf3.exe Token: SeDebugPrivilege 808 f296b1aec0a33147e1ddf3c6ef58964f06e4e337d445059c6f18f7bea000dcf3.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
f296b1aec0a33147e1ddf3c6ef58964f06e4e337d445059c6f18f7bea000dcf3.exedescription pid process target process PID 880 wrote to memory of 808 880 f296b1aec0a33147e1ddf3c6ef58964f06e4e337d445059c6f18f7bea000dcf3.exe f296b1aec0a33147e1ddf3c6ef58964f06e4e337d445059c6f18f7bea000dcf3.exe PID 880 wrote to memory of 808 880 f296b1aec0a33147e1ddf3c6ef58964f06e4e337d445059c6f18f7bea000dcf3.exe f296b1aec0a33147e1ddf3c6ef58964f06e4e337d445059c6f18f7bea000dcf3.exe PID 880 wrote to memory of 808 880 f296b1aec0a33147e1ddf3c6ef58964f06e4e337d445059c6f18f7bea000dcf3.exe f296b1aec0a33147e1ddf3c6ef58964f06e4e337d445059c6f18f7bea000dcf3.exe PID 880 wrote to memory of 808 880 f296b1aec0a33147e1ddf3c6ef58964f06e4e337d445059c6f18f7bea000dcf3.exe f296b1aec0a33147e1ddf3c6ef58964f06e4e337d445059c6f18f7bea000dcf3.exe PID 880 wrote to memory of 808 880 f296b1aec0a33147e1ddf3c6ef58964f06e4e337d445059c6f18f7bea000dcf3.exe f296b1aec0a33147e1ddf3c6ef58964f06e4e337d445059c6f18f7bea000dcf3.exe PID 880 wrote to memory of 808 880 f296b1aec0a33147e1ddf3c6ef58964f06e4e337d445059c6f18f7bea000dcf3.exe f296b1aec0a33147e1ddf3c6ef58964f06e4e337d445059c6f18f7bea000dcf3.exe PID 880 wrote to memory of 808 880 f296b1aec0a33147e1ddf3c6ef58964f06e4e337d445059c6f18f7bea000dcf3.exe f296b1aec0a33147e1ddf3c6ef58964f06e4e337d445059c6f18f7bea000dcf3.exe PID 880 wrote to memory of 808 880 f296b1aec0a33147e1ddf3c6ef58964f06e4e337d445059c6f18f7bea000dcf3.exe f296b1aec0a33147e1ddf3c6ef58964f06e4e337d445059c6f18f7bea000dcf3.exe PID 880 wrote to memory of 808 880 f296b1aec0a33147e1ddf3c6ef58964f06e4e337d445059c6f18f7bea000dcf3.exe f296b1aec0a33147e1ddf3c6ef58964f06e4e337d445059c6f18f7bea000dcf3.exe PID 880 wrote to memory of 808 880 f296b1aec0a33147e1ddf3c6ef58964f06e4e337d445059c6f18f7bea000dcf3.exe f296b1aec0a33147e1ddf3c6ef58964f06e4e337d445059c6f18f7bea000dcf3.exe PID 880 wrote to memory of 808 880 f296b1aec0a33147e1ddf3c6ef58964f06e4e337d445059c6f18f7bea000dcf3.exe f296b1aec0a33147e1ddf3c6ef58964f06e4e337d445059c6f18f7bea000dcf3.exe PID 880 wrote to memory of 808 880 f296b1aec0a33147e1ddf3c6ef58964f06e4e337d445059c6f18f7bea000dcf3.exe f296b1aec0a33147e1ddf3c6ef58964f06e4e337d445059c6f18f7bea000dcf3.exe PID 880 wrote to memory of 808 880 f296b1aec0a33147e1ddf3c6ef58964f06e4e337d445059c6f18f7bea000dcf3.exe f296b1aec0a33147e1ddf3c6ef58964f06e4e337d445059c6f18f7bea000dcf3.exe PID 880 wrote to memory of 808 880 f296b1aec0a33147e1ddf3c6ef58964f06e4e337d445059c6f18f7bea000dcf3.exe f296b1aec0a33147e1ddf3c6ef58964f06e4e337d445059c6f18f7bea000dcf3.exe PID 880 wrote to memory of 808 880 f296b1aec0a33147e1ddf3c6ef58964f06e4e337d445059c6f18f7bea000dcf3.exe f296b1aec0a33147e1ddf3c6ef58964f06e4e337d445059c6f18f7bea000dcf3.exe PID 880 wrote to memory of 808 880 f296b1aec0a33147e1ddf3c6ef58964f06e4e337d445059c6f18f7bea000dcf3.exe f296b1aec0a33147e1ddf3c6ef58964f06e4e337d445059c6f18f7bea000dcf3.exe PID 880 wrote to memory of 808 880 f296b1aec0a33147e1ddf3c6ef58964f06e4e337d445059c6f18f7bea000dcf3.exe f296b1aec0a33147e1ddf3c6ef58964f06e4e337d445059c6f18f7bea000dcf3.exe PID 880 wrote to memory of 808 880 f296b1aec0a33147e1ddf3c6ef58964f06e4e337d445059c6f18f7bea000dcf3.exe f296b1aec0a33147e1ddf3c6ef58964f06e4e337d445059c6f18f7bea000dcf3.exe PID 880 wrote to memory of 808 880 f296b1aec0a33147e1ddf3c6ef58964f06e4e337d445059c6f18f7bea000dcf3.exe f296b1aec0a33147e1ddf3c6ef58964f06e4e337d445059c6f18f7bea000dcf3.exe PID 880 wrote to memory of 808 880 f296b1aec0a33147e1ddf3c6ef58964f06e4e337d445059c6f18f7bea000dcf3.exe f296b1aec0a33147e1ddf3c6ef58964f06e4e337d445059c6f18f7bea000dcf3.exe PID 880 wrote to memory of 808 880 f296b1aec0a33147e1ddf3c6ef58964f06e4e337d445059c6f18f7bea000dcf3.exe f296b1aec0a33147e1ddf3c6ef58964f06e4e337d445059c6f18f7bea000dcf3.exe PID 880 wrote to memory of 808 880 f296b1aec0a33147e1ddf3c6ef58964f06e4e337d445059c6f18f7bea000dcf3.exe f296b1aec0a33147e1ddf3c6ef58964f06e4e337d445059c6f18f7bea000dcf3.exe PID 880 wrote to memory of 808 880 f296b1aec0a33147e1ddf3c6ef58964f06e4e337d445059c6f18f7bea000dcf3.exe f296b1aec0a33147e1ddf3c6ef58964f06e4e337d445059c6f18f7bea000dcf3.exe PID 880 wrote to memory of 808 880 f296b1aec0a33147e1ddf3c6ef58964f06e4e337d445059c6f18f7bea000dcf3.exe f296b1aec0a33147e1ddf3c6ef58964f06e4e337d445059c6f18f7bea000dcf3.exe PID 880 wrote to memory of 808 880 f296b1aec0a33147e1ddf3c6ef58964f06e4e337d445059c6f18f7bea000dcf3.exe f296b1aec0a33147e1ddf3c6ef58964f06e4e337d445059c6f18f7bea000dcf3.exe PID 880 wrote to memory of 808 880 f296b1aec0a33147e1ddf3c6ef58964f06e4e337d445059c6f18f7bea000dcf3.exe f296b1aec0a33147e1ddf3c6ef58964f06e4e337d445059c6f18f7bea000dcf3.exe PID 880 wrote to memory of 808 880 f296b1aec0a33147e1ddf3c6ef58964f06e4e337d445059c6f18f7bea000dcf3.exe f296b1aec0a33147e1ddf3c6ef58964f06e4e337d445059c6f18f7bea000dcf3.exe PID 880 wrote to memory of 808 880 f296b1aec0a33147e1ddf3c6ef58964f06e4e337d445059c6f18f7bea000dcf3.exe f296b1aec0a33147e1ddf3c6ef58964f06e4e337d445059c6f18f7bea000dcf3.exe PID 880 wrote to memory of 808 880 f296b1aec0a33147e1ddf3c6ef58964f06e4e337d445059c6f18f7bea000dcf3.exe f296b1aec0a33147e1ddf3c6ef58964f06e4e337d445059c6f18f7bea000dcf3.exe PID 880 wrote to memory of 808 880 f296b1aec0a33147e1ddf3c6ef58964f06e4e337d445059c6f18f7bea000dcf3.exe f296b1aec0a33147e1ddf3c6ef58964f06e4e337d445059c6f18f7bea000dcf3.exe PID 880 wrote to memory of 808 880 f296b1aec0a33147e1ddf3c6ef58964f06e4e337d445059c6f18f7bea000dcf3.exe f296b1aec0a33147e1ddf3c6ef58964f06e4e337d445059c6f18f7bea000dcf3.exe PID 880 wrote to memory of 808 880 f296b1aec0a33147e1ddf3c6ef58964f06e4e337d445059c6f18f7bea000dcf3.exe f296b1aec0a33147e1ddf3c6ef58964f06e4e337d445059c6f18f7bea000dcf3.exe PID 880 wrote to memory of 808 880 f296b1aec0a33147e1ddf3c6ef58964f06e4e337d445059c6f18f7bea000dcf3.exe f296b1aec0a33147e1ddf3c6ef58964f06e4e337d445059c6f18f7bea000dcf3.exe PID 880 wrote to memory of 808 880 f296b1aec0a33147e1ddf3c6ef58964f06e4e337d445059c6f18f7bea000dcf3.exe f296b1aec0a33147e1ddf3c6ef58964f06e4e337d445059c6f18f7bea000dcf3.exe PID 880 wrote to memory of 808 880 f296b1aec0a33147e1ddf3c6ef58964f06e4e337d445059c6f18f7bea000dcf3.exe f296b1aec0a33147e1ddf3c6ef58964f06e4e337d445059c6f18f7bea000dcf3.exe PID 880 wrote to memory of 808 880 f296b1aec0a33147e1ddf3c6ef58964f06e4e337d445059c6f18f7bea000dcf3.exe f296b1aec0a33147e1ddf3c6ef58964f06e4e337d445059c6f18f7bea000dcf3.exe PID 880 wrote to memory of 808 880 f296b1aec0a33147e1ddf3c6ef58964f06e4e337d445059c6f18f7bea000dcf3.exe f296b1aec0a33147e1ddf3c6ef58964f06e4e337d445059c6f18f7bea000dcf3.exe PID 880 wrote to memory of 808 880 f296b1aec0a33147e1ddf3c6ef58964f06e4e337d445059c6f18f7bea000dcf3.exe f296b1aec0a33147e1ddf3c6ef58964f06e4e337d445059c6f18f7bea000dcf3.exe PID 880 wrote to memory of 808 880 f296b1aec0a33147e1ddf3c6ef58964f06e4e337d445059c6f18f7bea000dcf3.exe f296b1aec0a33147e1ddf3c6ef58964f06e4e337d445059c6f18f7bea000dcf3.exe PID 880 wrote to memory of 808 880 f296b1aec0a33147e1ddf3c6ef58964f06e4e337d445059c6f18f7bea000dcf3.exe f296b1aec0a33147e1ddf3c6ef58964f06e4e337d445059c6f18f7bea000dcf3.exe PID 880 wrote to memory of 808 880 f296b1aec0a33147e1ddf3c6ef58964f06e4e337d445059c6f18f7bea000dcf3.exe f296b1aec0a33147e1ddf3c6ef58964f06e4e337d445059c6f18f7bea000dcf3.exe PID 880 wrote to memory of 808 880 f296b1aec0a33147e1ddf3c6ef58964f06e4e337d445059c6f18f7bea000dcf3.exe f296b1aec0a33147e1ddf3c6ef58964f06e4e337d445059c6f18f7bea000dcf3.exe PID 880 wrote to memory of 808 880 f296b1aec0a33147e1ddf3c6ef58964f06e4e337d445059c6f18f7bea000dcf3.exe f296b1aec0a33147e1ddf3c6ef58964f06e4e337d445059c6f18f7bea000dcf3.exe PID 880 wrote to memory of 808 880 f296b1aec0a33147e1ddf3c6ef58964f06e4e337d445059c6f18f7bea000dcf3.exe f296b1aec0a33147e1ddf3c6ef58964f06e4e337d445059c6f18f7bea000dcf3.exe PID 880 wrote to memory of 808 880 f296b1aec0a33147e1ddf3c6ef58964f06e4e337d445059c6f18f7bea000dcf3.exe f296b1aec0a33147e1ddf3c6ef58964f06e4e337d445059c6f18f7bea000dcf3.exe PID 880 wrote to memory of 808 880 f296b1aec0a33147e1ddf3c6ef58964f06e4e337d445059c6f18f7bea000dcf3.exe f296b1aec0a33147e1ddf3c6ef58964f06e4e337d445059c6f18f7bea000dcf3.exe PID 880 wrote to memory of 808 880 f296b1aec0a33147e1ddf3c6ef58964f06e4e337d445059c6f18f7bea000dcf3.exe f296b1aec0a33147e1ddf3c6ef58964f06e4e337d445059c6f18f7bea000dcf3.exe PID 880 wrote to memory of 808 880 f296b1aec0a33147e1ddf3c6ef58964f06e4e337d445059c6f18f7bea000dcf3.exe f296b1aec0a33147e1ddf3c6ef58964f06e4e337d445059c6f18f7bea000dcf3.exe PID 880 wrote to memory of 808 880 f296b1aec0a33147e1ddf3c6ef58964f06e4e337d445059c6f18f7bea000dcf3.exe f296b1aec0a33147e1ddf3c6ef58964f06e4e337d445059c6f18f7bea000dcf3.exe PID 880 wrote to memory of 808 880 f296b1aec0a33147e1ddf3c6ef58964f06e4e337d445059c6f18f7bea000dcf3.exe f296b1aec0a33147e1ddf3c6ef58964f06e4e337d445059c6f18f7bea000dcf3.exe PID 880 wrote to memory of 808 880 f296b1aec0a33147e1ddf3c6ef58964f06e4e337d445059c6f18f7bea000dcf3.exe f296b1aec0a33147e1ddf3c6ef58964f06e4e337d445059c6f18f7bea000dcf3.exe PID 880 wrote to memory of 808 880 f296b1aec0a33147e1ddf3c6ef58964f06e4e337d445059c6f18f7bea000dcf3.exe f296b1aec0a33147e1ddf3c6ef58964f06e4e337d445059c6f18f7bea000dcf3.exe PID 880 wrote to memory of 808 880 f296b1aec0a33147e1ddf3c6ef58964f06e4e337d445059c6f18f7bea000dcf3.exe f296b1aec0a33147e1ddf3c6ef58964f06e4e337d445059c6f18f7bea000dcf3.exe PID 880 wrote to memory of 808 880 f296b1aec0a33147e1ddf3c6ef58964f06e4e337d445059c6f18f7bea000dcf3.exe f296b1aec0a33147e1ddf3c6ef58964f06e4e337d445059c6f18f7bea000dcf3.exe PID 880 wrote to memory of 808 880 f296b1aec0a33147e1ddf3c6ef58964f06e4e337d445059c6f18f7bea000dcf3.exe f296b1aec0a33147e1ddf3c6ef58964f06e4e337d445059c6f18f7bea000dcf3.exe PID 880 wrote to memory of 808 880 f296b1aec0a33147e1ddf3c6ef58964f06e4e337d445059c6f18f7bea000dcf3.exe f296b1aec0a33147e1ddf3c6ef58964f06e4e337d445059c6f18f7bea000dcf3.exe PID 880 wrote to memory of 808 880 f296b1aec0a33147e1ddf3c6ef58964f06e4e337d445059c6f18f7bea000dcf3.exe f296b1aec0a33147e1ddf3c6ef58964f06e4e337d445059c6f18f7bea000dcf3.exe PID 880 wrote to memory of 808 880 f296b1aec0a33147e1ddf3c6ef58964f06e4e337d445059c6f18f7bea000dcf3.exe f296b1aec0a33147e1ddf3c6ef58964f06e4e337d445059c6f18f7bea000dcf3.exe PID 880 wrote to memory of 808 880 f296b1aec0a33147e1ddf3c6ef58964f06e4e337d445059c6f18f7bea000dcf3.exe f296b1aec0a33147e1ddf3c6ef58964f06e4e337d445059c6f18f7bea000dcf3.exe PID 880 wrote to memory of 808 880 f296b1aec0a33147e1ddf3c6ef58964f06e4e337d445059c6f18f7bea000dcf3.exe f296b1aec0a33147e1ddf3c6ef58964f06e4e337d445059c6f18f7bea000dcf3.exe PID 880 wrote to memory of 808 880 f296b1aec0a33147e1ddf3c6ef58964f06e4e337d445059c6f18f7bea000dcf3.exe f296b1aec0a33147e1ddf3c6ef58964f06e4e337d445059c6f18f7bea000dcf3.exe PID 880 wrote to memory of 808 880 f296b1aec0a33147e1ddf3c6ef58964f06e4e337d445059c6f18f7bea000dcf3.exe f296b1aec0a33147e1ddf3c6ef58964f06e4e337d445059c6f18f7bea000dcf3.exe PID 880 wrote to memory of 808 880 f296b1aec0a33147e1ddf3c6ef58964f06e4e337d445059c6f18f7bea000dcf3.exe f296b1aec0a33147e1ddf3c6ef58964f06e4e337d445059c6f18f7bea000dcf3.exe PID 880 wrote to memory of 808 880 f296b1aec0a33147e1ddf3c6ef58964f06e4e337d445059c6f18f7bea000dcf3.exe f296b1aec0a33147e1ddf3c6ef58964f06e4e337d445059c6f18f7bea000dcf3.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\f296b1aec0a33147e1ddf3c6ef58964f06e4e337d445059c6f18f7bea000dcf3.exe"C:\Users\Admin\AppData\Local\Temp\f296b1aec0a33147e1ddf3c6ef58964f06e4e337d445059c6f18f7bea000dcf3.exe"1⤵
- Adds policy Run key to start application
- Modifies Installed Components in the registry
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\f296b1aec0a33147e1ddf3c6ef58964f06e4e337d445059c6f18f7bea000dcf3.exe"C:\Users\Admin\AppData\Local\Temp\f296b1aec0a33147e1ddf3c6ef58964f06e4e337d445059c6f18f7bea000dcf3.exe"2⤵
- Checks computer location settings
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\install\server.exe"C:\Windows\system32\install\server.exe"3⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3124 -s 5844⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 3124 -ip 31241⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\Admin2.txtFilesize
224KB
MD5247840093f9f33b649bec75e9c4b5ad9
SHA11fa72099e4bf3564edfff947e0f6da8a3b27c70d
SHA2568df040225c0422ed2b0f20ef92aaafaaa17ded8ff9e88bd3757e0bba9b6c826e
SHA5122ae30ce21f5f449ea54ce03091bce8e3a1fb656bfa1112b6f549fe6864a732be6d86e644524069f508d0abbd0a3516e7c6b73b6a572455cdc0539972ac45656f
-
C:\Windows\SysWOW64\install\server.exeFilesize
289KB
MD542deb207036b3a3e3c9cbbe95487dd6b
SHA1f4c77ad7d41e7f87021ffbb18e5880771123c9fa
SHA256f296b1aec0a33147e1ddf3c6ef58964f06e4e337d445059c6f18f7bea000dcf3
SHA51288b61ef4b621d5508f195713814c4183741cc5431a3f804dcc2ab90a8da1f532cef695a125759d99a1845f9595f6d717dd713ded037178504e1f57a11d802ba1
-
C:\Windows\SysWOW64\install\server.exeFilesize
289KB
MD542deb207036b3a3e3c9cbbe95487dd6b
SHA1f4c77ad7d41e7f87021ffbb18e5880771123c9fa
SHA256f296b1aec0a33147e1ddf3c6ef58964f06e4e337d445059c6f18f7bea000dcf3
SHA51288b61ef4b621d5508f195713814c4183741cc5431a3f804dcc2ab90a8da1f532cef695a125759d99a1845f9595f6d717dd713ded037178504e1f57a11d802ba1
-
memory/808-133-0x0000000000000000-mapping.dmp
-
memory/808-137-0x0000000010410000-0x0000000010475000-memory.dmpFilesize
404KB
-
memory/808-138-0x0000000010410000-0x0000000010475000-memory.dmpFilesize
404KB
-
memory/808-143-0x0000000010410000-0x0000000010475000-memory.dmpFilesize
404KB
-
memory/880-134-0x0000000010410000-0x0000000010475000-memory.dmpFilesize
404KB
-
memory/3124-141-0x0000000000000000-mapping.dmp