cybergate | 3c058a8e9c46df81f2cbc595282d8e46e25b0b4ecd883f901a30e59a660657ff

Modify Registry

Processes:

c4f764597e9912dca5e7c462d99b965d.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	c4f764597e9912dca5e7c462d99b965d.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Policies = "C:\\Windows\\Microsoft\\virus.exe"	c4f764597e9912dca5e7c462d99b965d.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	c4f764597e9912dca5e7c462d99b965d.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Policies = "C:\\Windows\\Microsoft\\virus.exe"	c4f764597e9912dca5e7c462d99b965d.exe

Modifies Installed Components in the registry 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

Modify Registry

Processes:

c4f764597e9912dca5e7c462d99b965d.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{H0V7856I-51L8-A3TD-175P-TP5W65L7VIYQ}\StubPath = "C:\\Windows\\Microsoft\\virus.exe Restart"	c4f764597e9912dca5e7c462d99b965d.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{H0V7856I-51L8-A3TD-175P-TP5W65L7VIYQ}	c4f764597e9912dca5e7c462d99b965d.exe

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral1/memory/2260-0-0x0000000000400000-0x00000000004E5000-memory.dmp	upx
behavioral1/memory/2260-17-0x0000000000400000-0x00000000004E5000-memory.dmp	upx
behavioral1/memory/2668-36-0x0000000000400000-0x00000000004E5000-memory.dmp	upx

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

Modify Registry

Processes:

c4f764597e9912dca5e7c462d99b965d.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\win32 = "C:\\Windows\\Microsoft\\virus.exe"	c4f764597e9912dca5e7c462d99b965d.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Windows\CurrentVersion\Run\win32 = "C:\\Windows\\Microsoft\\virus.exe"	c4f764597e9912dca5e7c462d99b965d.exe

AutoIT Executable 2 IoCs

AutoIT scripts compiled to PE executables.

Processes:

resource	yara_rule
behavioral1/memory/2260-17-0x0000000000400000-0x00000000004E5000-memory.dmp	autoit_exe
behavioral1/memory/1632-85-0x0000000002130000-0x0000000002215000-memory.dmp	autoit_exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

c4f764597e9912dca5e7c462d99b965d.exe

description pid process target process

PID 2260 set thread context of 1632 2260 c4f764597e9912dca5e7c462d99b965d.exe c4f764597e9912dca5e7c462d99b965d.exe

description	pid	process	target process
PID 2260 set thread context of 1632	2260	c4f764597e9912dca5e7c462d99b965d.exe	c4f764597e9912dca5e7c462d99b965d.exe

Drops file in Windows directory 2 IoCs

Processes:

c4f764597e9912dca5e7c462d99b965d.exe

description	ioc	process
File created	C:\Windows\Microsoft\virus.exe	c4f764597e9912dca5e7c462d99b965d.exe
File opened for modification	C:\Windows\Microsoft\virus.exe	c4f764597e9912dca5e7c462d99b965d.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

c4f764597e9912dca5e7c462d99b965d.exe

pid process

1632 c4f764597e9912dca5e7c462d99b965d.exe

pid	process
1632	c4f764597e9912dca5e7c462d99b965d.exe

Suspicious use of WriteProcessMemory 51 IoCs

Processes:

c4f764597e9912dca5e7c462d99b965d.exec4f764597e9912dca5e7c462d99b965d.exe

C:\Users\Admin\AppData\Local\Temp\c4f764597e9912dca5e7c462d99b965d.exe
"C:\Users\Admin\AppData\Local\Temp\c4f764597e9912dca5e7c462d99b965d.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2260

C:\Users\Admin\AppData\Local\Temp\c4f764597e9912dca5e7c462d99b965d.exe
"C:\Users\Admin\AppData\Local\Temp\c4f764597e9912dca5e7c462d99b965d.exe"
2⤵
- Adds policy Run key to start application
- Modifies Installed Components in the registry
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1632

C:\Users\Admin\AppData\Local\Temp\c4f764597e9912dca5e7c462d99b965d.exe
"C:\Users\Admin\AppData\Local\Temp\c4f764597e9912dca5e7c462d99b965d.exe"
3⤵
PID:2668

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry