description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	Crypted.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Policies = "C:\\Windows\\install\\server.exe"	Crypted.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	Crypted.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Policies = "C:\\Windows\\install\\server.exe"	Crypted.exe

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{3J8WYFF1-W284-8QF4-BA65-4664XG65L25P}	Crypted.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{3J8WYFF1-W284-8QF4-BA65-4664XG65L25P}\StubPath = "C:\\Windows\\install\\server.exe Restart"	Crypted.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{3J8WYFF1-W284-8QF4-BA65-4664XG65L25P}	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{3J8WYFF1-W284-8QF4-BA65-4664XG65L25P}\StubPath = "C:\\Windows\\install\\server.exe"	explorer.exe

resource	yara_rule
behavioral1/files/0x000d00000001232a-8.dat	upx
behavioral1/memory/2520-11-0x0000000000400000-0x0000000000455000-memory.dmp	upx
behavioral1/files/0x000d00000001232a-13.dat	upx
behavioral1/memory/1112-545-0x0000000010480000-0x00000000104E1000-memory.dmp	upx
behavioral1/memory/2520-846-0x0000000000400000-0x0000000000455000-memory.dmp	upx
behavioral1/memory/2768-845-0x00000000104F0000-0x0000000010551000-memory.dmp	upx
behavioral1/files/0x000a000000014703-865.dat	upx
behavioral1/memory/2016-870-0x0000000000400000-0x0000000000455000-memory.dmp	upx
behavioral1/files/0x000a000000014703-869.dat	upx
behavioral1/memory/2768-868-0x0000000006270000-0x00000000062C5000-memory.dmp	upx
behavioral1/memory/2768-867-0x0000000004BE0000-0x0000000004C35000-memory.dmp	upx
behavioral1/files/0x000a000000014703-866.dat	upx
behavioral1/memory/2016-873-0x0000000000400000-0x0000000000455000-memory.dmp	upx
behavioral1/memory/1112-1032-0x0000000010480000-0x00000000104E1000-memory.dmp	upx
behavioral1/memory/2768-1676-0x00000000104F0000-0x0000000010551000-memory.dmp	upx

description	ioc	Process
File created	C:\Windows\install\server.exe	Crypted.exe
File opened for modification	C:\Windows\install\server.exe	Crypted.exe

description	pid	Process
Token: SeDebugPrivilege	2768	explorer.exe
Token: SeDebugPrivilege	2768	explorer.exe

description	pid	Process	procid_target
PID 2216 wrote to memory of 2520	2216	3f6c54a9f85391e4dd50846190189032.exe	28
PID 2216 wrote to memory of 2520	2216	3f6c54a9f85391e4dd50846190189032.exe	28
PID 2216 wrote to memory of 2520	2216	3f6c54a9f85391e4dd50846190189032.exe	28
PID 2216 wrote to memory of 2520	2216	3f6c54a9f85391e4dd50846190189032.exe	28
PID 2520 wrote to memory of 1208	2520	Crypted.exe	15
PID 2520 wrote to memory of 1208	2520	Crypted.exe	15
PID 2520 wrote to memory of 1208	2520	Crypted.exe	15
PID 2520 wrote to memory of 1208	2520	Crypted.exe	15
PID 2520 wrote to memory of 1208	2520	Crypted.exe	15
PID 2520 wrote to memory of 1208	2520	Crypted.exe	15
PID 2520 wrote to memory of 1208	2520	Crypted.exe	15
PID 2520 wrote to memory of 1208	2520	Crypted.exe	15
PID 2520 wrote to memory of 1208	2520	Crypted.exe	15
PID 2520 wrote to memory of 1208	2520	Crypted.exe	15
PID 2520 wrote to memory of 1208	2520	Crypted.exe	15
PID 2520 wrote to memory of 1208	2520	Crypted.exe	15
PID 2520 wrote to memory of 1208	2520	Crypted.exe	15
PID 2520 wrote to memory of 1208	2520	Crypted.exe	15
PID 2520 wrote to memory of 1208	2520	Crypted.exe	15
PID 2520 wrote to memory of 1208	2520	Crypted.exe	15
PID 2520 wrote to memory of 1208	2520	Crypted.exe	15
PID 2520 wrote to memory of 1208	2520	Crypted.exe	15
PID 2520 wrote to memory of 1208	2520	Crypted.exe	15
PID 2520 wrote to memory of 1208	2520	Crypted.exe	15
PID 2520 wrote to memory of 1208	2520	Crypted.exe	15
PID 2520 wrote to memory of 1208	2520	Crypted.exe	15
PID 2520 wrote to memory of 1208	2520	Crypted.exe	15
PID 2520 wrote to memory of 1208	2520	Crypted.exe	15
PID 2520 wrote to memory of 1208	2520	Crypted.exe	15
PID 2520 wrote to memory of 1208	2520	Crypted.exe	15
PID 2520 wrote to memory of 1208	2520	Crypted.exe	15
PID 2520 wrote to memory of 1208	2520	Crypted.exe	15
PID 2520 wrote to memory of 1208	2520	Crypted.exe	15
PID 2520 wrote to memory of 1208	2520	Crypted.exe	15
PID 2520 wrote to memory of 1208	2520	Crypted.exe	15
PID 2520 wrote to memory of 1208	2520	Crypted.exe	15
PID 2520 wrote to memory of 1208	2520	Crypted.exe	15
PID 2520 wrote to memory of 1208	2520	Crypted.exe	15
PID 2520 wrote to memory of 1208	2520	Crypted.exe	15
PID 2520 wrote to memory of 1208	2520	Crypted.exe	15
PID 2520 wrote to memory of 1208	2520	Crypted.exe	15
PID 2520 wrote to memory of 1208	2520	Crypted.exe	15
PID 2520 wrote to memory of 1208	2520	Crypted.exe	15
PID 2520 wrote to memory of 1208	2520	Crypted.exe	15
PID 2520 wrote to memory of 1208	2520	Crypted.exe	15
PID 2520 wrote to memory of 1208	2520	Crypted.exe	15
PID 2520 wrote to memory of 1208	2520	Crypted.exe	15
PID 2520 wrote to memory of 1208	2520	Crypted.exe	15
PID 2520 wrote to memory of 1208	2520	Crypted.exe	15
PID 2520 wrote to memory of 1208	2520	Crypted.exe	15
PID 2520 wrote to memory of 1208	2520	Crypted.exe	15
PID 2520 wrote to memory of 1208	2520	Crypted.exe	15
PID 2520 wrote to memory of 1208	2520	Crypted.exe	15
PID 2520 wrote to memory of 1208	2520	Crypted.exe	15
PID 2520 wrote to memory of 1208	2520	Crypted.exe	15
PID 2520 wrote to memory of 1208	2520	Crypted.exe	15
PID 2520 wrote to memory of 1208	2520	Crypted.exe	15
PID 2520 wrote to memory of 1208	2520	Crypted.exe	15
PID 2520 wrote to memory of 1208	2520	Crypted.exe	15
PID 2520 wrote to memory of 1208	2520	Crypted.exe	15
PID 2520 wrote to memory of 1208	2520	Crypted.exe	15
PID 2520 wrote to memory of 1208	2520	Crypted.exe	15
PID 2520 wrote to memory of 1208	2520	Crypted.exe	15
PID 2520 wrote to memory of 1208	2520	Crypted.exe	15

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

DNS Request

DNS Response

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

We care about your privacy.