cybergate | a10a98c2278206fa1f4f5bffb2a5a243779b2d9e71a0a7c8c4a124ef33322ca8

Modify Registry

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	a10a98c2278206fa1f4f5bffb2a5a243779b2d9e71a0a7c8c4a124ef33322ca8.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Policies = "C:\\Windows\\system32\\install\\server.exe"	a10a98c2278206fa1f4f5bffb2a5a243779b2d9e71a0a7c8c4a124ef33322ca8.exe
Key created	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	a10a98c2278206fa1f4f5bffb2a5a243779b2d9e71a0a7c8c4a124ef33322ca8.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Policies = "C:\\Windows\\system32\\install\\server.exe"	a10a98c2278206fa1f4f5bffb2a5a243779b2d9e71a0a7c8c4a124ef33322ca8.exe

Executes dropped EXE 1 IoCs

pid	Process
1420	server.exe

Modifies Installed Components in the registry 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

Modify Registry

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{08B0E5JF-4FCB-11CF-AAA5-00401C6XX500}	a10a98c2278206fa1f4f5bffb2a5a243779b2d9e71a0a7c8c4a124ef33322ca8.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{08B0E5JF-4FCB-11CF-AAA5-00401C6XX500}\StubPath = "C:\\Windows\\system32\\install\\server.exe Restart"	a10a98c2278206fa1f4f5bffb2a5a243779b2d9e71a0a7c8c4a124ef33322ca8.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{08B0E5JF-4FCB-11CF-AAA5-00401C6XX500}	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{08B0E5JF-4FCB-11CF-AAA5-00401C6XX500}\StubPath = "C:\\Windows\\system32\\install\\server.exe"	explorer.exe

UPX packed file 15 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/600-56-0x0000000000360000-0x0000000000398000-memory.dmp	upx
behavioral1/memory/600-57-0x0000000000360000-0x0000000000398000-memory.dmp	upx
behavioral1/memory/600-60-0x0000000024010000-0x0000000024072000-memory.dmp	upx
behavioral1/memory/600-66-0x0000000000360000-0x0000000000398000-memory.dmp	upx
behavioral1/memory/600-71-0x0000000024080000-0x00000000240E2000-memory.dmp	upx
behavioral1/memory/1492-76-0x0000000024080000-0x00000000240E2000-memory.dmp	upx
behavioral1/memory/1492-79-0x0000000024080000-0x00000000240E2000-memory.dmp	upx
behavioral1/memory/600-81-0x00000000240F0000-0x0000000024152000-memory.dmp	upx
behavioral1/memory/600-89-0x0000000024160000-0x00000000241C2000-memory.dmp	upx
behavioral1/memory/1360-94-0x0000000024160000-0x00000000241C2000-memory.dmp	upx
behavioral1/memory/1360-101-0x0000000024160000-0x00000000241C2000-memory.dmp	upx
behavioral1/memory/1420-104-0x00000000002F0000-0x0000000000328000-memory.dmp	upx
behavioral1/memory/1420-106-0x00000000002F0000-0x0000000000328000-memory.dmp	upx
behavioral1/memory/600-108-0x00000000027F0000-0x0000000002973000-memory.dmp	upx
behavioral1/memory/1360-109-0x0000000024160000-0x00000000241C2000-memory.dmp	upx

Checks BIOS information in registry 2 TTPs 4 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate	a10a98c2278206fa1f4f5bffb2a5a243779b2d9e71a0a7c8c4a124ef33322ca8.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	a10a98c2278206fa1f4f5bffb2a5a243779b2d9e71a0a7c8c4a124ef33322ca8.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate	server.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	server.exe

Loads dropped DLL 5 IoCs

pid	Process
1360	a10a98c2278206fa1f4f5bffb2a5a243779b2d9e71a0a7c8c4a124ef33322ca8.exe
1360	a10a98c2278206fa1f4f5bffb2a5a243779b2d9e71a0a7c8c4a124ef33322ca8.exe
1552	WerFault.exe
1552	WerFault.exe
1552	WerFault.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

Modify Registry

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run	a10a98c2278206fa1f4f5bffb2a5a243779b2d9e71a0a7c8c4a124ef33322ca8.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Win32 = "C:\\Windows\\system32\\install\\server.exe"	a10a98c2278206fa1f4f5bffb2a5a243779b2d9e71a0a7c8c4a124ef33322ca8.exe
Key created	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Run	a10a98c2278206fa1f4f5bffb2a5a243779b2d9e71a0a7c8c4a124ef33322ca8.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Run\Win32 = "C:\\Windows\\system32\\install\\server.exe"	a10a98c2278206fa1f4f5bffb2a5a243779b2d9e71a0a7c8c4a124ef33322ca8.exe

Drops file in System32 directory 7 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\nua.jpg	a10a98c2278206fa1f4f5bffb2a5a243779b2d9e71a0a7c8c4a124ef33322ca8.exe
File opened for modification	C:\Windows\SysWOW64\nua.jpg	DllHost.exe
File opened for modification	C:\Windows\SysWOW64\PerfCenterCpl.ico	DllHost.exe
File created	C:\Windows\SysWOW64\install\server.exe	a10a98c2278206fa1f4f5bffb2a5a243779b2d9e71a0a7c8c4a124ef33322ca8.exe
File opened for modification	C:\Windows\SysWOW64\install\server.exe	a10a98c2278206fa1f4f5bffb2a5a243779b2d9e71a0a7c8c4a124ef33322ca8.exe
File opened for modification	C:\Windows\SysWOW64\install\server.exe	a10a98c2278206fa1f4f5bffb2a5a243779b2d9e71a0a7c8c4a124ef33322ca8.exe
File opened for modification	C:\Windows\SysWOW64\install\	a10a98c2278206fa1f4f5bffb2a5a243779b2d9e71a0a7c8c4a124ef33322ca8.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Program crash 2 IoCs

pid	pid_target	Process	procid_target
1792	600	WerFault.exe	7
1552	1420	WerFault.exe	32

Checks processor information in registry 2 TTPs 16 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Platform ID	a10a98c2278206fa1f4f5bffb2a5a243779b2d9e71a0a7c8c4a124ef33322ca8.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	server.exe
Key queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	a10a98c2278206fa1f4f5bffb2a5a243779b2d9e71a0a7c8c4a124ef33322ca8.exe
Key value enumerated	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	server.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Platform ID	server.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	server.exe
Key value enumerated	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	a10a98c2278206fa1f4f5bffb2a5a243779b2d9e71a0a7c8c4a124ef33322ca8.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	a10a98c2278206fa1f4f5bffb2a5a243779b2d9e71a0a7c8c4a124ef33322ca8.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	a10a98c2278206fa1f4f5bffb2a5a243779b2d9e71a0a7c8c4a124ef33322ca8.exe
Key queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	server.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	server.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\FeatureSet	server.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	a10a98c2278206fa1f4f5bffb2a5a243779b2d9e71a0a7c8c4a124ef33322ca8.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	a10a98c2278206fa1f4f5bffb2a5a243779b2d9e71a0a7c8c4a124ef33322ca8.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\FeatureSet	a10a98c2278206fa1f4f5bffb2a5a243779b2d9e71a0a7c8c4a124ef33322ca8.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	server.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier	a10a98c2278206fa1f4f5bffb2a5a243779b2d9e71a0a7c8c4a124ef33322ca8.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier	server.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1360	a10a98c2278206fa1f4f5bffb2a5a243779b2d9e71a0a7c8c4a124ef33322ca8.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1360	a10a98c2278206fa1f4f5bffb2a5a243779b2d9e71a0a7c8c4a124ef33322ca8.exe
Token: SeDebugPrivilege	1360	a10a98c2278206fa1f4f5bffb2a5a243779b2d9e71a0a7c8c4a124ef33322ca8.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
600	a10a98c2278206fa1f4f5bffb2a5a243779b2d9e71a0a7c8c4a124ef33322ca8.exe
1344	DllHost.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 600 wrote to memory of 1212	600	a10a98c2278206fa1f4f5bffb2a5a243779b2d9e71a0a7c8c4a124ef33322ca8.exe	2
PID 600 wrote to memory of 1212	600	a10a98c2278206fa1f4f5bffb2a5a243779b2d9e71a0a7c8c4a124ef33322ca8.exe	2
PID 600 wrote to memory of 1212	600	a10a98c2278206fa1f4f5bffb2a5a243779b2d9e71a0a7c8c4a124ef33322ca8.exe	2
PID 600 wrote to memory of 1212	600	a10a98c2278206fa1f4f5bffb2a5a243779b2d9e71a0a7c8c4a124ef33322ca8.exe	2
PID 600 wrote to memory of 1212	600	a10a98c2278206fa1f4f5bffb2a5a243779b2d9e71a0a7c8c4a124ef33322ca8.exe	2
PID 600 wrote to memory of 1212	600	a10a98c2278206fa1f4f5bffb2a5a243779b2d9e71a0a7c8c4a124ef33322ca8.exe	2
PID 600 wrote to memory of 1212	600	a10a98c2278206fa1f4f5bffb2a5a243779b2d9e71a0a7c8c4a124ef33322ca8.exe	2
PID 600 wrote to memory of 1212	600	a10a98c2278206fa1f4f5bffb2a5a243779b2d9e71a0a7c8c4a124ef33322ca8.exe	2
PID 600 wrote to memory of 1212	600	a10a98c2278206fa1f4f5bffb2a5a243779b2d9e71a0a7c8c4a124ef33322ca8.exe	2
PID 600 wrote to memory of 1212	600	a10a98c2278206fa1f4f5bffb2a5a243779b2d9e71a0a7c8c4a124ef33322ca8.exe	2
PID 600 wrote to memory of 1212	600	a10a98c2278206fa1f4f5bffb2a5a243779b2d9e71a0a7c8c4a124ef33322ca8.exe	2
PID 600 wrote to memory of 1212	600	a10a98c2278206fa1f4f5bffb2a5a243779b2d9e71a0a7c8c4a124ef33322ca8.exe	2
PID 600 wrote to memory of 1212	600	a10a98c2278206fa1f4f5bffb2a5a243779b2d9e71a0a7c8c4a124ef33322ca8.exe	2
PID 600 wrote to memory of 1212	600	a10a98c2278206fa1f4f5bffb2a5a243779b2d9e71a0a7c8c4a124ef33322ca8.exe	2
PID 600 wrote to memory of 1212	600	a10a98c2278206fa1f4f5bffb2a5a243779b2d9e71a0a7c8c4a124ef33322ca8.exe	2
PID 600 wrote to memory of 1212	600	a10a98c2278206fa1f4f5bffb2a5a243779b2d9e71a0a7c8c4a124ef33322ca8.exe	2
PID 600 wrote to memory of 1212	600	a10a98c2278206fa1f4f5bffb2a5a243779b2d9e71a0a7c8c4a124ef33322ca8.exe	2
PID 600 wrote to memory of 1212	600	a10a98c2278206fa1f4f5bffb2a5a243779b2d9e71a0a7c8c4a124ef33322ca8.exe	2
PID 600 wrote to memory of 1212	600	a10a98c2278206fa1f4f5bffb2a5a243779b2d9e71a0a7c8c4a124ef33322ca8.exe	2
PID 600 wrote to memory of 1212	600	a10a98c2278206fa1f4f5bffb2a5a243779b2d9e71a0a7c8c4a124ef33322ca8.exe	2
PID 600 wrote to memory of 1212	600	a10a98c2278206fa1f4f5bffb2a5a243779b2d9e71a0a7c8c4a124ef33322ca8.exe	2
PID 600 wrote to memory of 1212	600	a10a98c2278206fa1f4f5bffb2a5a243779b2d9e71a0a7c8c4a124ef33322ca8.exe	2
PID 600 wrote to memory of 1212	600	a10a98c2278206fa1f4f5bffb2a5a243779b2d9e71a0a7c8c4a124ef33322ca8.exe	2
PID 600 wrote to memory of 1212	600	a10a98c2278206fa1f4f5bffb2a5a243779b2d9e71a0a7c8c4a124ef33322ca8.exe	2
PID 600 wrote to memory of 1212	600	a10a98c2278206fa1f4f5bffb2a5a243779b2d9e71a0a7c8c4a124ef33322ca8.exe	2
PID 600 wrote to memory of 1212	600	a10a98c2278206fa1f4f5bffb2a5a243779b2d9e71a0a7c8c4a124ef33322ca8.exe	2
PID 600 wrote to memory of 1212	600	a10a98c2278206fa1f4f5bffb2a5a243779b2d9e71a0a7c8c4a124ef33322ca8.exe	2
PID 600 wrote to memory of 1212	600	a10a98c2278206fa1f4f5bffb2a5a243779b2d9e71a0a7c8c4a124ef33322ca8.exe	2
PID 600 wrote to memory of 1212	600	a10a98c2278206fa1f4f5bffb2a5a243779b2d9e71a0a7c8c4a124ef33322ca8.exe	2
PID 600 wrote to memory of 1212	600	a10a98c2278206fa1f4f5bffb2a5a243779b2d9e71a0a7c8c4a124ef33322ca8.exe	2
PID 600 wrote to memory of 1212	600	a10a98c2278206fa1f4f5bffb2a5a243779b2d9e71a0a7c8c4a124ef33322ca8.exe	2
PID 600 wrote to memory of 1212	600	a10a98c2278206fa1f4f5bffb2a5a243779b2d9e71a0a7c8c4a124ef33322ca8.exe	2
PID 600 wrote to memory of 1212	600	a10a98c2278206fa1f4f5bffb2a5a243779b2d9e71a0a7c8c4a124ef33322ca8.exe	2
PID 600 wrote to memory of 1212	600	a10a98c2278206fa1f4f5bffb2a5a243779b2d9e71a0a7c8c4a124ef33322ca8.exe	2
PID 600 wrote to memory of 1212	600	a10a98c2278206fa1f4f5bffb2a5a243779b2d9e71a0a7c8c4a124ef33322ca8.exe	2
PID 600 wrote to memory of 1212	600	a10a98c2278206fa1f4f5bffb2a5a243779b2d9e71a0a7c8c4a124ef33322ca8.exe	2
PID 600 wrote to memory of 1212	600	a10a98c2278206fa1f4f5bffb2a5a243779b2d9e71a0a7c8c4a124ef33322ca8.exe	2
PID 600 wrote to memory of 1212	600	a10a98c2278206fa1f4f5bffb2a5a243779b2d9e71a0a7c8c4a124ef33322ca8.exe	2
PID 600 wrote to memory of 1212	600	a10a98c2278206fa1f4f5bffb2a5a243779b2d9e71a0a7c8c4a124ef33322ca8.exe	2
PID 600 wrote to memory of 1212	600	a10a98c2278206fa1f4f5bffb2a5a243779b2d9e71a0a7c8c4a124ef33322ca8.exe	2
PID 600 wrote to memory of 1212	600	a10a98c2278206fa1f4f5bffb2a5a243779b2d9e71a0a7c8c4a124ef33322ca8.exe	2
PID 600 wrote to memory of 1212	600	a10a98c2278206fa1f4f5bffb2a5a243779b2d9e71a0a7c8c4a124ef33322ca8.exe	2
PID 600 wrote to memory of 1212	600	a10a98c2278206fa1f4f5bffb2a5a243779b2d9e71a0a7c8c4a124ef33322ca8.exe	2
PID 600 wrote to memory of 1212	600	a10a98c2278206fa1f4f5bffb2a5a243779b2d9e71a0a7c8c4a124ef33322ca8.exe	2
PID 600 wrote to memory of 1212	600	a10a98c2278206fa1f4f5bffb2a5a243779b2d9e71a0a7c8c4a124ef33322ca8.exe	2
PID 600 wrote to memory of 1212	600	a10a98c2278206fa1f4f5bffb2a5a243779b2d9e71a0a7c8c4a124ef33322ca8.exe	2
PID 600 wrote to memory of 1212	600	a10a98c2278206fa1f4f5bffb2a5a243779b2d9e71a0a7c8c4a124ef33322ca8.exe	2
PID 600 wrote to memory of 1212	600	a10a98c2278206fa1f4f5bffb2a5a243779b2d9e71a0a7c8c4a124ef33322ca8.exe	2
PID 600 wrote to memory of 1212	600	a10a98c2278206fa1f4f5bffb2a5a243779b2d9e71a0a7c8c4a124ef33322ca8.exe	2
PID 600 wrote to memory of 1212	600	a10a98c2278206fa1f4f5bffb2a5a243779b2d9e71a0a7c8c4a124ef33322ca8.exe	2
PID 600 wrote to memory of 1212	600	a10a98c2278206fa1f4f5bffb2a5a243779b2d9e71a0a7c8c4a124ef33322ca8.exe	2
PID 600 wrote to memory of 1212	600	a10a98c2278206fa1f4f5bffb2a5a243779b2d9e71a0a7c8c4a124ef33322ca8.exe	2
PID 600 wrote to memory of 1212	600	a10a98c2278206fa1f4f5bffb2a5a243779b2d9e71a0a7c8c4a124ef33322ca8.exe	2
PID 600 wrote to memory of 1212	600	a10a98c2278206fa1f4f5bffb2a5a243779b2d9e71a0a7c8c4a124ef33322ca8.exe	2
PID 600 wrote to memory of 1212	600	a10a98c2278206fa1f4f5bffb2a5a243779b2d9e71a0a7c8c4a124ef33322ca8.exe	2
PID 600 wrote to memory of 1212	600	a10a98c2278206fa1f4f5bffb2a5a243779b2d9e71a0a7c8c4a124ef33322ca8.exe	2
PID 600 wrote to memory of 1212	600	a10a98c2278206fa1f4f5bffb2a5a243779b2d9e71a0a7c8c4a124ef33322ca8.exe	2
PID 600 wrote to memory of 1212	600	a10a98c2278206fa1f4f5bffb2a5a243779b2d9e71a0a7c8c4a124ef33322ca8.exe	2
PID 600 wrote to memory of 1212	600	a10a98c2278206fa1f4f5bffb2a5a243779b2d9e71a0a7c8c4a124ef33322ca8.exe	2
PID 600 wrote to memory of 1212	600	a10a98c2278206fa1f4f5bffb2a5a243779b2d9e71a0a7c8c4a124ef33322ca8.exe	2
PID 600 wrote to memory of 1212	600	a10a98c2278206fa1f4f5bffb2a5a243779b2d9e71a0a7c8c4a124ef33322ca8.exe	2
PID 600 wrote to memory of 1212	600	a10a98c2278206fa1f4f5bffb2a5a243779b2d9e71a0a7c8c4a124ef33322ca8.exe	2
PID 600 wrote to memory of 1212	600	a10a98c2278206fa1f4f5bffb2a5a243779b2d9e71a0a7c8c4a124ef33322ca8.exe	2
PID 600 wrote to memory of 1212	600	a10a98c2278206fa1f4f5bffb2a5a243779b2d9e71a0a7c8c4a124ef33322ca8.exe	2

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:1212
- C:\Users\Admin\AppData\Local\Temp\a10a98c2278206fa1f4f5bffb2a5a243779b2d9e71a0a7c8c4a124ef33322ca8.exe
  "C:\Users\Admin\AppData\Local\Temp\a10a98c2278206fa1f4f5bffb2a5a243779b2d9e71a0a7c8c4a124ef33322ca8.exe"
  2⤵
  - Adds policy Run key to start application
  - Modifies Installed Components in the registry
  - Checks BIOS information in registry
  - Adds Run key to start application
  - Drops file in System32 directory
  - Checks processor information in registry
  - Enumerates system info in registry
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:600
- - C:\Windows\SysWOW64\explorer.exe
    explorer.exe
    3⤵
    - Modifies Installed Components in the registry
    PID:1492
- - C:\Program Files\Internet Explorer\iexplore.exe
    "C:\Program Files\Internet Explorer\iexplore.exe"
    3⤵
    PID:964
- - C:\Users\Admin\AppData\Local\Temp\a10a98c2278206fa1f4f5bffb2a5a243779b2d9e71a0a7c8c4a124ef33322ca8.exe
    "C:\Users\Admin\AppData\Local\Temp\a10a98c2278206fa1f4f5bffb2a5a243779b2d9e71a0a7c8c4a124ef33322ca8.exe"
    3⤵
    - Loads dropped DLL
    - Drops file in System32 directory
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of AdjustPrivilegeToken
    PID:1360
  - - C:\Windows\SysWOW64\install\server.exe
      "C:\Windows\system32\install\server.exe"
      4⤵
      Executes dropped EXE
      Checks BIOS information in registry
      Checks processor information in registry
      Enumerates system info in registry
      PID:1420
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1420 -s 160
        5⤵
        Loads dropped DLL
        Program crash
        
        PID:1552
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 600 -s 160
    3⤵
    - Program crash
    PID:1792

C:\Windows\SysWOW64\DllHost.exe
C:\Windows\SysWOW64\DllHost.exe /Processid:{76D0CB12-7604-4048-B83C-1005C7DDC503}
1⤵
- Drops file in System32 directory
- Suspicious use of FindShellTrayWindow
PID:1344

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

Privilege Escalation

Defense Evasion

Modify Registry

Credential Access

Discovery

Query Registry

System Information Discovery