cybergate | d1431ffce4e448e941fb950a60bba15fd8fdcdad50bd75083e8d0d38c465b917

Modify Registry

Processes:

NBFile.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	NBFile.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Policies = "C:\\Windows\\install\\server.exe"	NBFile.exe
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	NBFile.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Policies = "C:\\Windows\\install\\server.exe"	NBFile.exe

Executes dropped EXE 6 IoCs

Processes:

NBFile.exeNBFile.exeserver.exeserver.exeserver.exeserver.exe

pid process

3504 NBFile.exe
2044 NBFile.exe
4064 server.exe
4176 server.exe
4480 server.exe
4416 server.exe

Modifies Installed Components in the registry 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

Modify Registry

Processes:

explorer.exeNBFile.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{T422O587-FR14-3T0Y-4800-7470IS27DBL6}\StubPath = "C:\\Windows\\install\\server.exe"	explorer.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{T422O587-FR14-3T0Y-4800-7470IS27DBL6}	NBFile.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{T422O587-FR14-3T0Y-4800-7470IS27DBL6}\StubPath = "C:\\Windows\\install\\server.exe Restart"	NBFile.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{T422O587-FR14-3T0Y-4800-7470IS27DBL6}	explorer.exe

UPX packed file 21 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral2/memory/2044-138-0x0000000000400000-0x0000000000458000-memory.dmp	upx
behavioral2/memory/2044-143-0x0000000000400000-0x0000000000458000-memory.dmp	upx
behavioral2/memory/2044-144-0x0000000000400000-0x0000000000458000-memory.dmp	upx
behavioral2/memory/2044-145-0x0000000000400000-0x0000000000458000-memory.dmp	upx
behavioral2/memory/2044-147-0x0000000010410000-0x0000000010475000-memory.dmp	upx
behavioral2/memory/2044-153-0x0000000010480000-0x00000000104E5000-memory.dmp	upx
behavioral2/memory/2368-156-0x0000000010480000-0x00000000104E5000-memory.dmp	upx
behavioral2/memory/2368-157-0x0000000010480000-0x00000000104E5000-memory.dmp	upx
behavioral2/memory/2044-162-0x00000000104F0000-0x0000000010555000-memory.dmp	upx
behavioral2/memory/4088-165-0x00000000104F0000-0x0000000010555000-memory.dmp	upx
behavioral2/memory/4088-166-0x00000000104F0000-0x0000000010555000-memory.dmp	upx
behavioral2/memory/2044-175-0x0000000000400000-0x0000000000458000-memory.dmp	upx
behavioral2/memory/4480-186-0x0000000000400000-0x0000000000458000-memory.dmp	upx
behavioral2/memory/4480-187-0x0000000000400000-0x0000000000458000-memory.dmp	upx
behavioral2/memory/4416-195-0x0000000000400000-0x0000000000458000-memory.dmp	upx
behavioral2/memory/4480-196-0x0000000000400000-0x0000000000458000-memory.dmp	upx
behavioral2/memory/2368-197-0x0000000010480000-0x00000000104E5000-memory.dmp	upx
behavioral2/memory/4088-198-0x00000000104F0000-0x0000000010555000-memory.dmp	upx
behavioral2/memory/4480-199-0x0000000000400000-0x0000000000458000-memory.dmp	upx
behavioral2/memory/4480-200-0x0000000000400000-0x0000000000458000-memory.dmp	upx
behavioral2/memory/4416-202-0x0000000000400000-0x0000000000458000-memory.dmp	upx

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

System Information Discovery

Processes:

d1431ffce4e448e941fb950a60bba15fd8fdcdad50bd75083e8d0d38c465b917.exeNBFile.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation	d1431ffce4e448e941fb950a60bba15fd8fdcdad50bd75083e8d0d38c465b917.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation	NBFile.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

Modify Registry

Processes:

NBFile.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run	NBFile.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Windows\\install\\server.exe"	NBFile.exe
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Windows\CurrentVersion\Run	NBFile.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\install\\server.exe"	NBFile.exe

Suspicious use of SetThreadContext 3 IoCs

Processes:

NBFile.exeserver.exeserver.exe

description	pid	process	target process
PID 3504 set thread context of 2044	3504	NBFile.exe	NBFile.exe
PID 4064 set thread context of 4480	4064	server.exe	server.exe
PID 4176 set thread context of 4416	4176	server.exe	server.exe

Drops file in Windows directory 4 IoCs

Processes:

NBFile.exeexplorer.exe

description	ioc	process
File created	C:\Windows\install\server.exe	NBFile.exe
File opened for modification	C:\Windows\install\server.exe	NBFile.exe
File opened for modification	C:\Windows\install\server.exe	explorer.exe
File opened for modification	C:\Windows\install\	explorer.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Program crash 2 IoCs

Processes:

WerFault.exeWerFault.exe

pid pid_target process target process

1796 4416 WerFault.exe server.exe
1800 4480 WerFault.exe server.exe

pid	pid_target	process	target process
1796	4416	WerFault.exe	server.exe
1800	4480	WerFault.exe	server.exe

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

Processes:

WINWORD.EXE

description	ioc	process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	WINWORD.EXE

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

System Information Discovery

Processes:

WINWORD.EXE

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WINWORD.EXE
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WINWORD.EXE

Modifies registry class 3 IoCs

Processes:

d1431ffce4e448e941fb950a60bba15fd8fdcdad50bd75083e8d0d38c465b917.exeNBFile.exeexplorer.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings	d1431ffce4e448e941fb950a60bba15fd8fdcdad50bd75083e8d0d38c465b917.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	NBFile.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	explorer.exe

Suspicious behavior: AddClipboardFormatListener 2 IoCs

Processes:

WINWORD.EXE

pid process

2032 WINWORD.EXE
2032 WINWORD.EXE
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

NBFile.exe

pid process

2044 NBFile.exe
2044 NBFile.exe
Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

explorer.exe

pid process

4088 explorer.exe

pid	process
2032	WINWORD.EXE
2032	WINWORD.EXE

pid	process
2044	NBFile.exe
2044	NBFile.exe

pid	process
4088	explorer.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

Processes:

explorer.exeexplorer.exe

description	pid	process
Token: SeBackupPrivilege	2368	explorer.exe
Token: SeRestorePrivilege	2368	explorer.exe
Token: SeBackupPrivilege	4088	explorer.exe
Token: SeRestorePrivilege	4088	explorer.exe
Token: SeDebugPrivilege	4088	explorer.exe
Token: SeDebugPrivilege	4088	explorer.exe

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

NBFile.exe

pid process

2044 NBFile.exe

pid	process
2044	NBFile.exe

Suspicious use of SetWindowsHookEx 10 IoCs

Processes:

NBFile.exeserver.exeserver.exeWINWORD.EXE

pid	process
3504	NBFile.exe
4064	server.exe
4176	server.exe
2032	WINWORD.EXE
2032	WINWORD.EXE
2032	WINWORD.EXE
2032	WINWORD.EXE
2032	WINWORD.EXE
2032	WINWORD.EXE
2032	WINWORD.EXE

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

d1431ffce4e448e941fb950a60bba15fd8fdcdad50bd75083e8d0d38c465b917.exeNBFile.exeNBFile.exe

description	pid	process	target process
PID 2628 wrote to memory of 3504	2628	d1431ffce4e448e941fb950a60bba15fd8fdcdad50bd75083e8d0d38c465b917.exe	NBFile.exe
PID 2628 wrote to memory of 3504	2628	d1431ffce4e448e941fb950a60bba15fd8fdcdad50bd75083e8d0d38c465b917.exe	NBFile.exe
PID 2628 wrote to memory of 3504	2628	d1431ffce4e448e941fb950a60bba15fd8fdcdad50bd75083e8d0d38c465b917.exe	NBFile.exe
PID 3504 wrote to memory of 2044	3504	NBFile.exe	NBFile.exe
PID 3504 wrote to memory of 2044	3504	NBFile.exe	NBFile.exe
PID 3504 wrote to memory of 2044	3504	NBFile.exe	NBFile.exe
PID 3504 wrote to memory of 2044	3504	NBFile.exe	NBFile.exe
PID 3504 wrote to memory of 2044	3504	NBFile.exe	NBFile.exe
PID 3504 wrote to memory of 2044	3504	NBFile.exe	NBFile.exe
PID 3504 wrote to memory of 2044	3504	NBFile.exe	NBFile.exe
PID 3504 wrote to memory of 2044	3504	NBFile.exe	NBFile.exe
PID 2044 wrote to memory of 376	2044	NBFile.exe	Explorer.EXE
PID 2044 wrote to memory of 376	2044	NBFile.exe	Explorer.EXE
PID 2044 wrote to memory of 376	2044	NBFile.exe	Explorer.EXE
PID 2044 wrote to memory of 376	2044	NBFile.exe	Explorer.EXE
PID 2044 wrote to memory of 376	2044	NBFile.exe	Explorer.EXE
PID 2044 wrote to memory of 376	2044	NBFile.exe	Explorer.EXE
PID 2044 wrote to memory of 376	2044	NBFile.exe	Explorer.EXE
PID 2044 wrote to memory of 376	2044	NBFile.exe	Explorer.EXE
PID 2044 wrote to memory of 376	2044	NBFile.exe	Explorer.EXE
PID 2044 wrote to memory of 376	2044	NBFile.exe	Explorer.EXE
PID 2044 wrote to memory of 376	2044	NBFile.exe	Explorer.EXE
PID 2044 wrote to memory of 376	2044	NBFile.exe	Explorer.EXE
PID 2044 wrote to memory of 376	2044	NBFile.exe	Explorer.EXE
PID 2044 wrote to memory of 376	2044	NBFile.exe	Explorer.EXE
PID 2044 wrote to memory of 376	2044	NBFile.exe	Explorer.EXE
PID 2044 wrote to memory of 376	2044	NBFile.exe	Explorer.EXE
PID 2044 wrote to memory of 376	2044	NBFile.exe	Explorer.EXE
PID 2044 wrote to memory of 376	2044	NBFile.exe	Explorer.EXE
PID 2044 wrote to memory of 376	2044	NBFile.exe	Explorer.EXE
PID 2044 wrote to memory of 376	2044	NBFile.exe	Explorer.EXE
PID 2044 wrote to memory of 376	2044	NBFile.exe	Explorer.EXE
PID 2044 wrote to memory of 376	2044	NBFile.exe	Explorer.EXE
PID 2044 wrote to memory of 376	2044	NBFile.exe	Explorer.EXE
PID 2044 wrote to memory of 376	2044	NBFile.exe	Explorer.EXE
PID 2044 wrote to memory of 376	2044	NBFile.exe	Explorer.EXE
PID 2044 wrote to memory of 376	2044	NBFile.exe	Explorer.EXE
PID 2044 wrote to memory of 376	2044	NBFile.exe	Explorer.EXE
PID 2044 wrote to memory of 376	2044	NBFile.exe	Explorer.EXE
PID 2044 wrote to memory of 376	2044	NBFile.exe	Explorer.EXE
PID 2044 wrote to memory of 376	2044	NBFile.exe	Explorer.EXE
PID 2044 wrote to memory of 376	2044	NBFile.exe	Explorer.EXE
PID 2044 wrote to memory of 376	2044	NBFile.exe	Explorer.EXE
PID 2044 wrote to memory of 376	2044	NBFile.exe	Explorer.EXE
PID 2044 wrote to memory of 376	2044	NBFile.exe	Explorer.EXE
PID 2044 wrote to memory of 376	2044	NBFile.exe	Explorer.EXE
PID 2044 wrote to memory of 376	2044	NBFile.exe	Explorer.EXE
PID 2044 wrote to memory of 376	2044	NBFile.exe	Explorer.EXE
PID 2044 wrote to memory of 376	2044	NBFile.exe	Explorer.EXE
PID 2044 wrote to memory of 376	2044	NBFile.exe	Explorer.EXE
PID 2044 wrote to memory of 376	2044	NBFile.exe	Explorer.EXE
PID 2044 wrote to memory of 376	2044	NBFile.exe	Explorer.EXE
PID 2044 wrote to memory of 376	2044	NBFile.exe	Explorer.EXE
PID 2044 wrote to memory of 376	2044	NBFile.exe	Explorer.EXE
PID 2044 wrote to memory of 376	2044	NBFile.exe	Explorer.EXE
PID 2044 wrote to memory of 376	2044	NBFile.exe	Explorer.EXE
PID 2044 wrote to memory of 376	2044	NBFile.exe	Explorer.EXE
PID 2044 wrote to memory of 376	2044	NBFile.exe	Explorer.EXE
PID 2044 wrote to memory of 376	2044	NBFile.exe	Explorer.EXE
PID 2044 wrote to memory of 376	2044	NBFile.exe	Explorer.EXE
PID 2044 wrote to memory of 376	2044	NBFile.exe	Explorer.EXE
PID 2044 wrote to memory of 376	2044	NBFile.exe	Explorer.EXE
PID 2044 wrote to memory of 376	2044	NBFile.exe	Explorer.EXE
PID 2044 wrote to memory of 376	2044	NBFile.exe	Explorer.EXE

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:376

C:\Users\Admin\AppData\Local\Temp\d1431ffce4e448e941fb950a60bba15fd8fdcdad50bd75083e8d0d38c465b917.exe
"C:\Users\Admin\AppData\Local\Temp\d1431ffce4e448e941fb950a60bba15fd8fdcdad50bd75083e8d0d38c465b917.exe"
2⤵
- Checks computer location settings
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2628

C:\Users\Admin\AppData\Local\Temp\NBFile.exe
"C:\Users\Admin\AppData\Local\Temp\NBFile.exe"
3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3504

C:\Users\Admin\AppData\Local\Temp\NBFile.exe
"C:\Users\Admin\AppData\Local\Temp\NBFile.exe"
4⤵
- Adds policy Run key to start application
- Executes dropped EXE
- Modifies Installed Components in the registry
- Checks computer location settings
- Adds Run key to start application
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:2044

C:\Windows\SysWOW64\explorer.exe
explorer.exe
5⤵
- Modifies Installed Components in the registry
- Suspicious use of AdjustPrivilegeToken
PID:2368

C:\Windows\SysWOW64\explorer.exe
explorer.exe
5⤵
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
PID:4088

C:\Windows\install\server.exe
"C:\Windows\install\server.exe"
6⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
PID:4176

C:\Windows\install\server.exe
"C:\Windows\install\server.exe"
7⤵
- Executes dropped EXE
PID:4416

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4416 -s 560
8⤵
- Program crash
PID:1796

C:\Windows\install\server.exe
"C:\Windows\install\server.exe"
5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
PID:4064

C:\Windows\install\server.exe
"C:\Windows\install\server.exe"
6⤵
- Executes dropped EXE
PID:4480

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4480 -s 548
7⤵
- Program crash
PID:1800

C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\Graficas1.docx" /o ""
3⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:2032

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 4416 -ip 4416
1⤵
PID:3344

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 4480 -ip 4480
1⤵
PID:696

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

Privilege Escalation

Defense Evasion

Modify Registry

Credential Access

Discovery

Query Registry

System Information Discovery