cybergate | 12975bce5682b4d6a0849c73a8924f074e9fc12e9807e1773e3d80656851d1d2

Windows Service

T1543.003

Processes:

regedit.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile	regedit.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0"	regedit.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile	regedit.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\DisableNotifications = "0"	regedit.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\EnableFirewall = "0"	regedit.exe

Modifies security service 2 TTPs 1 IoCs
evasion

Modify Registry
T1112

Windows Service
T1543.003

Processes:

regedit.exe

description ioc process

Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\mpssvc\Start = "4" regedit.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\mpssvc\Start = "4"	regedit.exe

Windows security bypass 2 TTPs 5 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

Processes:

regedit.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	regedit.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1"	regedit.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	regedit.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	regedit.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	regedit.exe

Adds policy Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

Modify Registry

Processes:

COM.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Policies = "c:\\dir\\install\\install\\COM HOST.exe"	COM.exe
Key created	\REGISTRY\USER\S-1-5-21-1574508946-349927670-1185736483-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	COM.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1574508946-349927670-1185736483-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Policies = "c:\\dir\\install\\install\\COM HOST.exe"	COM.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	COM.exe

Disables taskbar notifications via registry modification
evasion
Disables use of System Restore points 1 TTPs
evasion

Inhibit System Recovery
T1490

Modifies Installed Components in the registry 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

Modify Registry

Processes:

COM.exeexplorer.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{70NBI643-N58H-54IB-NF57-KHIF8DH40O3D}	COM.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{70NBI643-N58H-54IB-NF57-KHIF8DH40O3D}\StubPath = "c:\\dir\\install\\install\\COM HOST.exe Restart"	COM.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{70NBI643-N58H-54IB-NF57-KHIF8DH40O3D}	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{70NBI643-N58H-54IB-NF57-KHIF8DH40O3D}\StubPath = "c:\\dir\\install\\install\\COM HOST.exe"	explorer.exe

Checks computer location settings 2 TTPs 3 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

System Information Discovery

Processes:

4D670AC64FAE74BD0C53F58673C6D826.exe00.exeCOM.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-1574508946-349927670-1185736483-1000\Control Panel\International\Geo\Nation	4D670AC64FAE74BD0C53F58673C6D826.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1574508946-349927670-1185736483-1000\Control Panel\International\Geo\Nation	00.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1574508946-349927670-1185736483-1000\Control Panel\International\Geo\Nation	COM.exe

Executes dropped EXE 5 IoCs

Processes:

00.exeCOM.exeserver.exeCOM.exeCOM HOST.exe

pid process

1636 00.exe
240 COM.exe
1524 server.exe
2676 COM.exe
2792 COM HOST.exe

pid	process
1636	00.exe
240	COM.exe
1524	server.exe
2676	COM.exe
2792	COM HOST.exe

UPX packed file 22 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\COM.exe	upx
C:\Users\Admin\AppData\Local\Temp\COM.exe	upx
behavioral2/memory/240-26-0x0000000000400000-0x0000000000457000-memory.dmp	upx
C:\Users\Admin\AppData\Local\Temp\COM.exe	upx
behavioral2/memory/240-44-0x0000000024010000-0x0000000024072000-memory.dmp	upx
behavioral2/memory/240-51-0x0000000000400000-0x0000000000457000-memory.dmp	upx
behavioral2/memory/4204-123-0x0000000024080000-0x00000000240E2000-memory.dmp	upx
\??\c:\dir\install\install\COM HOST.exe	upx
C:\Users\Admin\AppData\Local\Temp\COM.exe	upx
behavioral2/memory/2676-136-0x0000000000400000-0x0000000000457000-memory.dmp	upx
behavioral2/memory/4204-196-0x0000000024080000-0x00000000240E2000-memory.dmp	upx
behavioral2/memory/240-197-0x0000000000400000-0x0000000000457000-memory.dmp	upx
behavioral2/memory/2676-198-0x0000000024160000-0x00000000241C2000-memory.dmp	upx
C:\dir\install\install\COM HOST.exe	upx
behavioral2/memory/2676-224-0x0000000007B70000-0x0000000007BBB000-memory.dmp	upx
behavioral2/memory/2676-226-0x0000000007CC0000-0x0000000007D0B000-memory.dmp	upx
behavioral2/memory/2676-228-0x0000000024160000-0x00000000241C2000-memory.dmp	upx
behavioral2/memory/2676-229-0x0000000007E10000-0x0000000007E5B000-memory.dmp	upx
behavioral2/memory/2792-552-0x0000000000400000-0x0000000000457000-memory.dmp	upx
behavioral2/memory/2676-657-0x0000000007B70000-0x0000000007BBB000-memory.dmp	upx
behavioral2/memory/2676-733-0x0000000007CC0000-0x0000000007D0B000-memory.dmp	upx
behavioral2/memory/2676-825-0x0000000007E10000-0x0000000007E5B000-memory.dmp	upx

Adds Run key to start application 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

Modify Registry

Processes:

COM.exeserver.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-1574508946-349927670-1185736483-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\HKCU = "c:\\dir\\install\\install\\COM HOST.exe"	COM.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\winlogon = "C:\\Windows\\win_sp.exe"	server.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "c:\\dir\\install\\install\\COM HOST.exe"	COM.exe

Drops file in System32 directory 7 IoCs

Processes:

svchost.exe

description	ioc	process
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\FB0D848F74F70BB2EAA93746D24D9749	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\80237EE4964FC9C409AAF55BF996A292_D46D6FA25B74360E1349F9015B5CCE53	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\80237EE4964FC9C409AAF55BF996A292_E503B048B745DFA14B81FCFC68D6DECE	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_CBDCCBFE4F7A916411C1E69BDD97BB04	svchost.exe

Drops file in Windows directory 5 IoCs

Processes:

4D670AC64FAE74BD0C53F58673C6D826.exeserver.exe

description	ioc	process
File opened for modification	C:\Windows\2-Alertas.reg	4D670AC64FAE74BD0C53F58673C6D826.exe
File opened for modification	C:\Windows\00.exe	4D670AC64FAE74BD0C53F58673C6D826.exe
File created	C:\Windows\win_sp.exe	server.exe
File opened for modification	C:\Windows\win_sp.exe	server.exe
File opened for modification	C:\Windows\1-seguridad.bat	4D670AC64FAE74BD0C53F58673C6D826.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2416 2792 WerFault.exe COM HOST.exe

pid	pid_target	process	target process
2416	2792	WerFault.exe	COM HOST.exe

Checks SCSI registry key(s) 3 TTPs 8 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

Peripheral Device Discovery

T1120

System Information Discovery

Processes:

COM.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000001	COM.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Phantom	COM.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000002	COM.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Phantom	COM.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_DADY_DVD-ROM\4&215468A5&0&010000	COM.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\ConfigFlags	COM.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000	COM.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\ConfigFlags	COM.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

Processes:

COM.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	COM.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	COM.exe

Modifies registry class 2 IoCs

Processes:

4D670AC64FAE74BD0C53F58673C6D826.exeCOM.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-1574508946-349927670-1185736483-1000_Classes\Local Settings	4D670AC64FAE74BD0C53F58673C6D826.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	COM.exe

Runs .reg file with regedit 1 IoCs

Processes:

regedit.exe

pid process

3472 regedit.exe
Runs net.exe
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

COM.exe

pid process

240 COM.exe
240 COM.exe
Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

COM.exe

pid process

2676 COM.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

COM.exe

description pid process

Token: SeDebugPrivilege 2676 COM.exe
Token: SeDebugPrivilege 2676 COM.exe
Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

COM.exe

pid process

240 COM.exe
Suspicious use of SetWindowsHookEx 3 IoCs

Processes:

4D670AC64FAE74BD0C53F58673C6D826.exeserver.exe

pid process

2216 4D670AC64FAE74BD0C53F58673C6D826.exe
1524 server.exe
1524 server.exe

pid	process
3472	regedit.exe

pid	process
240	COM.exe
240	COM.exe

pid	process
2676	COM.exe

description	pid	process
Token: SeDebugPrivilege	2676	COM.exe
Token: SeDebugPrivilege	2676	COM.exe

pid	process
240	COM.exe

pid	process
2216	4D670AC64FAE74BD0C53F58673C6D826.exe
1524	server.exe
1524	server.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

4D670AC64FAE74BD0C53F58673C6D826.execmd.exenet.exenet.exenet.exenet.exenet.exenet.exenet.exenet.exenet.exenet.exe

description	pid	process	target process
PID 2216 wrote to memory of 2512	2216	4D670AC64FAE74BD0C53F58673C6D826.exe	cmd.exe
PID 2216 wrote to memory of 2512	2216	4D670AC64FAE74BD0C53F58673C6D826.exe	cmd.exe
PID 2216 wrote to memory of 2512	2216	4D670AC64FAE74BD0C53F58673C6D826.exe	cmd.exe
PID 2512 wrote to memory of 1472	2512	cmd.exe	net.exe
PID 2512 wrote to memory of 1472	2512	cmd.exe	net.exe
PID 2512 wrote to memory of 1472	2512	cmd.exe	net.exe
PID 1472 wrote to memory of 4084	1472	net.exe	net1.exe
PID 1472 wrote to memory of 4084	1472	net.exe	net1.exe
PID 1472 wrote to memory of 4084	1472	net.exe	net1.exe
PID 2216 wrote to memory of 3472	2216	4D670AC64FAE74BD0C53F58673C6D826.exe	regedit.exe
PID 2216 wrote to memory of 3472	2216	4D670AC64FAE74BD0C53F58673C6D826.exe	regedit.exe
PID 2216 wrote to memory of 3472	2216	4D670AC64FAE74BD0C53F58673C6D826.exe	regedit.exe
PID 2512 wrote to memory of 3532	2512	cmd.exe	net.exe
PID 2512 wrote to memory of 3532	2512	cmd.exe	net.exe
PID 2512 wrote to memory of 3532	2512	cmd.exe	net.exe
PID 3532 wrote to memory of 4260	3532	net.exe	net1.exe
PID 3532 wrote to memory of 4260	3532	net.exe	net1.exe
PID 3532 wrote to memory of 4260	3532	net.exe	net1.exe
PID 2512 wrote to memory of 4124	2512	cmd.exe	net.exe
PID 2512 wrote to memory of 4124	2512	cmd.exe	net.exe
PID 2512 wrote to memory of 4124	2512	cmd.exe	net.exe
PID 4124 wrote to memory of 3260	4124	net.exe	net1.exe
PID 4124 wrote to memory of 3260	4124	net.exe	net1.exe
PID 4124 wrote to memory of 3260	4124	net.exe	net1.exe
PID 2512 wrote to memory of 780	2512	cmd.exe	net.exe
PID 2512 wrote to memory of 780	2512	cmd.exe	net.exe
PID 2512 wrote to memory of 780	2512	cmd.exe	net.exe
PID 780 wrote to memory of 3180	780	net.exe	net1.exe
PID 780 wrote to memory of 3180	780	net.exe	net1.exe
PID 780 wrote to memory of 3180	780	net.exe	net1.exe
PID 2512 wrote to memory of 472	2512	cmd.exe	net.exe
PID 2512 wrote to memory of 472	2512	cmd.exe	net.exe
PID 2512 wrote to memory of 472	2512	cmd.exe	net.exe
PID 472 wrote to memory of 872	472	net.exe	net1.exe
PID 472 wrote to memory of 872	472	net.exe	net1.exe
PID 472 wrote to memory of 872	472	net.exe	net1.exe
PID 2512 wrote to memory of 2496	2512	cmd.exe	net.exe
PID 2512 wrote to memory of 2496	2512	cmd.exe	net.exe
PID 2512 wrote to memory of 2496	2512	cmd.exe	net.exe
PID 2496 wrote to memory of 1644	2496	net.exe	net1.exe
PID 2496 wrote to memory of 1644	2496	net.exe	net1.exe
PID 2496 wrote to memory of 1644	2496	net.exe	net1.exe
PID 2512 wrote to memory of 3256	2512	cmd.exe	net.exe
PID 2512 wrote to memory of 3256	2512	cmd.exe	net.exe
PID 2512 wrote to memory of 3256	2512	cmd.exe	net.exe
PID 3256 wrote to memory of 3992	3256	net.exe	net1.exe
PID 3256 wrote to memory of 3992	3256	net.exe	net1.exe
PID 3256 wrote to memory of 3992	3256	net.exe	net1.exe
PID 2512 wrote to memory of 2764	2512	cmd.exe	net.exe
PID 2512 wrote to memory of 2764	2512	cmd.exe	net.exe
PID 2512 wrote to memory of 2764	2512	cmd.exe	net.exe
PID 2764 wrote to memory of 1656	2764	net.exe	net1.exe
PID 2764 wrote to memory of 1656	2764	net.exe	net1.exe
PID 2764 wrote to memory of 1656	2764	net.exe	net1.exe
PID 2512 wrote to memory of 2860	2512	cmd.exe	net.exe
PID 2512 wrote to memory of 2860	2512	cmd.exe	net.exe
PID 2512 wrote to memory of 2860	2512	cmd.exe	net.exe
PID 2860 wrote to memory of 2516	2860	net.exe	net1.exe
PID 2860 wrote to memory of 2516	2860	net.exe	net1.exe
PID 2860 wrote to memory of 2516	2860	net.exe	net1.exe
PID 2512 wrote to memory of 4368	2512	cmd.exe	net.exe
PID 2512 wrote to memory of 4368	2512	cmd.exe	net.exe
PID 2512 wrote to memory of 4368	2512	cmd.exe	net.exe
PID 4368 wrote to memory of 2116	4368	net.exe	net1.exe

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:3204

C:\Users\Admin\AppData\Local\Temp\4D670AC64FAE74BD0C53F58673C6D826.exe
"C:\Users\Admin\AppData\Local\Temp\4D670AC64FAE74BD0C53F58673C6D826.exe"
2⤵
- Checks computer location settings
- Drops file in Windows directory
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2216

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Windows\1-seguridad.bat" "
3⤵
- Suspicious use of WriteProcessMemory
PID:2512

C:\Windows\SysWOW64\net.exe
NET STOP "Dispositivo host de UPnP"
4⤵
- Suspicious use of WriteProcessMemory
PID:1472

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 STOP "Dispositivo host de UPnP"
5⤵
PID:4084

C:\Windows\SysWOW64\net.exe
NET STOP "AntiVirService"
4⤵
- Suspicious use of WriteProcessMemory
PID:3532

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 STOP "AntiVirService"
5⤵
PID:4260

C:\Windows\SysWOW64\net.exe
NET STOP "PDAgent"
4⤵
- Suspicious use of WriteProcessMemory
PID:4124

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 STOP "PDAgent"
5⤵
PID:3260

C:\Windows\SysWOW64\net.exe
NET STOP "Telefonia"
4⤵
- Suspicious use of WriteProcessMemory
PID:780

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 STOP "Telefonia"
5⤵
PID:3180

C:\Windows\SysWOW64\net.exe
NET STOP "Temas"
4⤵
- Suspicious use of WriteProcessMemory
PID:472

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 STOP "Temas"
5⤵
PID:872

C:\Windows\SysWOW64\net.exe
NET STOP "Centro de Seguridad"
4⤵
- Suspicious use of WriteProcessMemory
PID:2496

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 STOP "Centro de Seguridad"
5⤵
PID:1644

C:\Windows\SysWOW64\net.exe
NET STOP "Windows Defender"
4⤵
- Suspicious use of WriteProcessMemory
PID:3256

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 STOP "Windows Defender"
5⤵
PID:3992

C:\Windows\SysWOW64\net.exe
NET STOP "Firewall de Windows"
4⤵
- Suspicious use of WriteProcessMemory
PID:2764

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 STOP "Firewall de Windows"
5⤵
PID:1656

C:\Windows\SysWOW64\net.exe
NET STOP "Ready Boost"
4⤵
- Suspicious use of WriteProcessMemory
PID:2860

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 STOP "Ready Boost"
5⤵
PID:2516

C:\Windows\SysWOW64\net.exe
NET STOP "Busqueda de Windows"
4⤵
- Suspicious use of WriteProcessMemory
PID:4368

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 STOP "Busqueda de Windows"
5⤵
PID:2116

C:\Windows\SysWOW64\net.exe
NET STOP "Windows Update"
4⤵
PID:3236

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 STOP "Windows Update"
5⤵
PID:3064

C:\Windows\SysWOW64\net.exe
NET STOP "Inicio de Sesion secundario"
4⤵
PID:864

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 STOP "Inicio de Sesion secundario"
5⤵
PID:2856

C:\Windows\SysWOW64\net.exe
NET STOP "TapiSrv"
4⤵
PID:1624

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 STOP "TapiSrv"
5⤵
PID:4992

C:\Windows\SysWOW64\net.exe
NET STOP "CryptSvc"
4⤵
PID:2872

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 STOP "CryptSvc"
5⤵
PID:8

C:\Windows\SysWOW64\net.exe
NET STOP "WPDBusEnum"
4⤵
PID:4140

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 STOP "WPDBusEnum"
5⤵
PID:812

C:\Windows\SysWOW64\net.exe
NET STOP "BITS"
4⤵
PID:1104

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 STOP "BITS"
5⤵
PID:840

C:\Windows\SysWOW64\net.exe
NET STOP "seclogon"
4⤵
PID:2256

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 STOP "seclogon"
5⤵
PID:456

C:\Windows\SysWOW64\regedit.exe
"regedit.exe" "C:\Windows\2-Alertas.reg"
3⤵
- Modifies firewall policy service
- Modifies security service
- Windows security bypass
- Runs .reg file with regedit
PID:3472

C:\Windows\00.exe
"C:\Windows\00.exe"
3⤵
- Checks computer location settings
- Executes dropped EXE
PID:1636

C:\Users\Admin\AppData\Local\Temp\COM.exe
"C:\Users\Admin\AppData\Local\Temp\COM.exe"
4⤵
- Adds policy Run key to start application
- Modifies Installed Components in the registry
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
PID:240

C:\Windows\SysWOW64\explorer.exe
explorer.exe
5⤵
- Modifies Installed Components in the registry
PID:4204

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe"
5⤵
PID:1244

C:\Users\Admin\AppData\Local\Temp\COM.exe
"C:\Users\Admin\AppData\Local\Temp\COM.exe"
5⤵
- Checks computer location settings
- Executes dropped EXE
- Checks SCSI registry key(s)
- Checks processor information in registry
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
PID:2676

C:\dir\install\install\COM HOST.exe
"C:\dir\install\install\COM HOST.exe"
6⤵
- Executes dropped EXE
PID:2792

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2792 -s 576
7⤵
- Program crash
PID:2416

C:\Windows\SysWOW64\cscript.exe
"C:\Windows\system32\cscript.exe" "C:\Users\Admin\AppData\Local\Temp\teste.vbs"
6⤵
PID:4024

C:\Users\Admin\AppData\Local\Temp\server.exe
"C:\Users\Admin\AppData\Local\Temp\server.exe"
4⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
PID:1524

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkService -p -s CryptSvc
1⤵
- Drops file in System32 directory
PID:904

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 2792 -ip 2792
1⤵
PID:4276

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Credential Access

Discovery

Query Registry

System Information Discovery