cybergate | 20ea4faa2783de82e7786ce2c89d5c1f87c9287eb10907226964d1a64c122396

Modify Registry

Processes:

b756cabdc438f199a443e6393ea04f0d.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-275798769-4264537674-1142822080-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	b756cabdc438f199a443e6393ea04f0d.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-275798769-4264537674-1142822080-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Policies = "C:\\Windows\\system32\\install\\server.exe"	b756cabdc438f199a443e6393ea04f0d.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	b756cabdc438f199a443e6393ea04f0d.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Policies = "C:\\Windows\\system32\\install\\server.exe"	b756cabdc438f199a443e6393ea04f0d.exe

Modifies Installed Components in the registry 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

Modify Registry

Processes:

b756cabdc438f199a443e6393ea04f0d.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{N0A1VPKU-2P00-H4RT-BX1A-R01Q0877408J}	b756cabdc438f199a443e6393ea04f0d.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{N0A1VPKU-2P00-H4RT-BX1A-R01Q0877408J}\StubPath = "C:\\Windows\\system32\\install\\server.exe Restart"	b756cabdc438f199a443e6393ea04f0d.exe

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral2/memory/3916-3-0x0000000010410000-0x0000000010475000-memory.dmp	upx
behavioral2/memory/3916-63-0x0000000010480000-0x00000000104E5000-memory.dmp	upx
behavioral2/memory/1996-67-0x0000000010480000-0x00000000104E5000-memory.dmp	upx
behavioral2/memory/1996-68-0x0000000010480000-0x00000000104E5000-memory.dmp	upx

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

Modify Registry

Processes:

b756cabdc438f199a443e6393ea04f0d.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Windows\\system32\\install\\server.exe"	b756cabdc438f199a443e6393ea04f0d.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-275798769-4264537674-1142822080-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\system32\\install\\server.exe"	b756cabdc438f199a443e6393ea04f0d.exe

Drops file in System32 directory 2 IoCs

Processes:

b756cabdc438f199a443e6393ea04f0d.exe

description	ioc	process
File created	C:\Windows\SysWOW64\install\server.exe	b756cabdc438f199a443e6393ea04f0d.exe
File opened for modification	C:\Windows\SysWOW64\install\server.exe	b756cabdc438f199a443e6393ea04f0d.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

b756cabdc438f199a443e6393ea04f0d.exe

pid process

3916 b756cabdc438f199a443e6393ea04f0d.exe
3916 b756cabdc438f199a443e6393ea04f0d.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

explorer.exe

description pid process

Token: SeBackupPrivilege 1996 explorer.exe
Token: SeRestorePrivilege 1996 explorer.exe
Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

b756cabdc438f199a443e6393ea04f0d.exe

pid process

3916 b756cabdc438f199a443e6393ea04f0d.exe

pid	process
3916	b756cabdc438f199a443e6393ea04f0d.exe
3916	b756cabdc438f199a443e6393ea04f0d.exe

description	pid	process
Token: SeBackupPrivilege	1996	explorer.exe
Token: SeRestorePrivilege	1996	explorer.exe

pid	process
3916	b756cabdc438f199a443e6393ea04f0d.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

b756cabdc438f199a443e6393ea04f0d.exe

description	pid	process	target process
PID 3916 wrote to memory of 3484	3916	b756cabdc438f199a443e6393ea04f0d.exe	Explorer.EXE
PID 3916 wrote to memory of 3484	3916	b756cabdc438f199a443e6393ea04f0d.exe	Explorer.EXE
PID 3916 wrote to memory of 3484	3916	b756cabdc438f199a443e6393ea04f0d.exe	Explorer.EXE
PID 3916 wrote to memory of 3484	3916	b756cabdc438f199a443e6393ea04f0d.exe	Explorer.EXE
PID 3916 wrote to memory of 3484	3916	b756cabdc438f199a443e6393ea04f0d.exe	Explorer.EXE
PID 3916 wrote to memory of 3484	3916	b756cabdc438f199a443e6393ea04f0d.exe	Explorer.EXE
PID 3916 wrote to memory of 3484	3916	b756cabdc438f199a443e6393ea04f0d.exe	Explorer.EXE
PID 3916 wrote to memory of 3484	3916	b756cabdc438f199a443e6393ea04f0d.exe	Explorer.EXE
PID 3916 wrote to memory of 3484	3916	b756cabdc438f199a443e6393ea04f0d.exe	Explorer.EXE
PID 3916 wrote to memory of 3484	3916	b756cabdc438f199a443e6393ea04f0d.exe	Explorer.EXE
PID 3916 wrote to memory of 3484	3916	b756cabdc438f199a443e6393ea04f0d.exe	Explorer.EXE
PID 3916 wrote to memory of 3484	3916	b756cabdc438f199a443e6393ea04f0d.exe	Explorer.EXE
PID 3916 wrote to memory of 3484	3916	b756cabdc438f199a443e6393ea04f0d.exe	Explorer.EXE
PID 3916 wrote to memory of 3484	3916	b756cabdc438f199a443e6393ea04f0d.exe	Explorer.EXE
PID 3916 wrote to memory of 3484	3916	b756cabdc438f199a443e6393ea04f0d.exe	Explorer.EXE
PID 3916 wrote to memory of 3484	3916	b756cabdc438f199a443e6393ea04f0d.exe	Explorer.EXE
PID 3916 wrote to memory of 3484	3916	b756cabdc438f199a443e6393ea04f0d.exe	Explorer.EXE
PID 3916 wrote to memory of 3484	3916	b756cabdc438f199a443e6393ea04f0d.exe	Explorer.EXE
PID 3916 wrote to memory of 3484	3916	b756cabdc438f199a443e6393ea04f0d.exe	Explorer.EXE
PID 3916 wrote to memory of 3484	3916	b756cabdc438f199a443e6393ea04f0d.exe	Explorer.EXE
PID 3916 wrote to memory of 3484	3916	b756cabdc438f199a443e6393ea04f0d.exe	Explorer.EXE
PID 3916 wrote to memory of 3484	3916	b756cabdc438f199a443e6393ea04f0d.exe	Explorer.EXE
PID 3916 wrote to memory of 3484	3916	b756cabdc438f199a443e6393ea04f0d.exe	Explorer.EXE
PID 3916 wrote to memory of 3484	3916	b756cabdc438f199a443e6393ea04f0d.exe	Explorer.EXE
PID 3916 wrote to memory of 3484	3916	b756cabdc438f199a443e6393ea04f0d.exe	Explorer.EXE
PID 3916 wrote to memory of 3484	3916	b756cabdc438f199a443e6393ea04f0d.exe	Explorer.EXE
PID 3916 wrote to memory of 3484	3916	b756cabdc438f199a443e6393ea04f0d.exe	Explorer.EXE
PID 3916 wrote to memory of 3484	3916	b756cabdc438f199a443e6393ea04f0d.exe	Explorer.EXE
PID 3916 wrote to memory of 3484	3916	b756cabdc438f199a443e6393ea04f0d.exe	Explorer.EXE
PID 3916 wrote to memory of 3484	3916	b756cabdc438f199a443e6393ea04f0d.exe	Explorer.EXE
PID 3916 wrote to memory of 3484	3916	b756cabdc438f199a443e6393ea04f0d.exe	Explorer.EXE
PID 3916 wrote to memory of 3484	3916	b756cabdc438f199a443e6393ea04f0d.exe	Explorer.EXE
PID 3916 wrote to memory of 3484	3916	b756cabdc438f199a443e6393ea04f0d.exe	Explorer.EXE
PID 3916 wrote to memory of 3484	3916	b756cabdc438f199a443e6393ea04f0d.exe	Explorer.EXE
PID 3916 wrote to memory of 3484	3916	b756cabdc438f199a443e6393ea04f0d.exe	Explorer.EXE
PID 3916 wrote to memory of 3484	3916	b756cabdc438f199a443e6393ea04f0d.exe	Explorer.EXE
PID 3916 wrote to memory of 3484	3916	b756cabdc438f199a443e6393ea04f0d.exe	Explorer.EXE
PID 3916 wrote to memory of 3484	3916	b756cabdc438f199a443e6393ea04f0d.exe	Explorer.EXE
PID 3916 wrote to memory of 3484	3916	b756cabdc438f199a443e6393ea04f0d.exe	Explorer.EXE
PID 3916 wrote to memory of 3484	3916	b756cabdc438f199a443e6393ea04f0d.exe	Explorer.EXE
PID 3916 wrote to memory of 3484	3916	b756cabdc438f199a443e6393ea04f0d.exe	Explorer.EXE
PID 3916 wrote to memory of 3484	3916	b756cabdc438f199a443e6393ea04f0d.exe	Explorer.EXE
PID 3916 wrote to memory of 3484	3916	b756cabdc438f199a443e6393ea04f0d.exe	Explorer.EXE
PID 3916 wrote to memory of 3484	3916	b756cabdc438f199a443e6393ea04f0d.exe	Explorer.EXE
PID 3916 wrote to memory of 3484	3916	b756cabdc438f199a443e6393ea04f0d.exe	Explorer.EXE
PID 3916 wrote to memory of 3484	3916	b756cabdc438f199a443e6393ea04f0d.exe	Explorer.EXE
PID 3916 wrote to memory of 3484	3916	b756cabdc438f199a443e6393ea04f0d.exe	Explorer.EXE
PID 3916 wrote to memory of 3484	3916	b756cabdc438f199a443e6393ea04f0d.exe	Explorer.EXE
PID 3916 wrote to memory of 3484	3916	b756cabdc438f199a443e6393ea04f0d.exe	Explorer.EXE
PID 3916 wrote to memory of 3484	3916	b756cabdc438f199a443e6393ea04f0d.exe	Explorer.EXE
PID 3916 wrote to memory of 3484	3916	b756cabdc438f199a443e6393ea04f0d.exe	Explorer.EXE
PID 3916 wrote to memory of 3484	3916	b756cabdc438f199a443e6393ea04f0d.exe	Explorer.EXE
PID 3916 wrote to memory of 3484	3916	b756cabdc438f199a443e6393ea04f0d.exe	Explorer.EXE
PID 3916 wrote to memory of 3484	3916	b756cabdc438f199a443e6393ea04f0d.exe	Explorer.EXE
PID 3916 wrote to memory of 3484	3916	b756cabdc438f199a443e6393ea04f0d.exe	Explorer.EXE
PID 3916 wrote to memory of 3484	3916	b756cabdc438f199a443e6393ea04f0d.exe	Explorer.EXE
PID 3916 wrote to memory of 3484	3916	b756cabdc438f199a443e6393ea04f0d.exe	Explorer.EXE
PID 3916 wrote to memory of 3484	3916	b756cabdc438f199a443e6393ea04f0d.exe	Explorer.EXE
PID 3916 wrote to memory of 3484	3916	b756cabdc438f199a443e6393ea04f0d.exe	Explorer.EXE
PID 3916 wrote to memory of 3484	3916	b756cabdc438f199a443e6393ea04f0d.exe	Explorer.EXE
PID 3916 wrote to memory of 3484	3916	b756cabdc438f199a443e6393ea04f0d.exe	Explorer.EXE
PID 3916 wrote to memory of 3484	3916	b756cabdc438f199a443e6393ea04f0d.exe	Explorer.EXE
PID 3916 wrote to memory of 3484	3916	b756cabdc438f199a443e6393ea04f0d.exe	Explorer.EXE
PID 3916 wrote to memory of 3484	3916	b756cabdc438f199a443e6393ea04f0d.exe	Explorer.EXE

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:3484

C:\Users\Admin\AppData\Local\Temp\b756cabdc438f199a443e6393ea04f0d.exe
"C:\Users\Admin\AppData\Local\Temp\b756cabdc438f199a443e6393ea04f0d.exe"
2⤵
- Adds policy Run key to start application
- Modifies Installed Components in the registry
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:3916

C:\Windows\SysWOW64\explorer.exe
explorer.exe
3⤵
- Suspicious use of AdjustPrivilegeToken
PID:1996

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe"
3⤵
PID:532

C:\Users\Admin\AppData\Local\Temp\b756cabdc438f199a443e6393ea04f0d.exe
"C:\Users\Admin\AppData\Local\Temp\b756cabdc438f199a443e6393ea04f0d.exe"
3⤵
PID:4804

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry