cybergate | 10568f616c7ca7ea3ce0cdd69d3172420cf813beb7332cdc8e87a6068eb9a8b9

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	0F6E3.tmp
Set value (str)	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Policies = "C:\\Windows\\system32\\spynet\\server.exe"	0F6E3.tmp
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	0F6E3.tmp
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Policies = "C:\\Windows\\system32\\spynet\\server.exe"	0F6E3.tmp

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Control Panel\International\Geo\Nation	0F6E3.tmp

Executes dropped EXE 3 IoCs

pid	Process
4660	0F6E3.tmp
3192	0F6E3.tmp
1700	server.exe

Loads dropped DLL 1 IoCs

pid	Process
2552	MsiExec.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\system32\\spynet\\server.exe"	0F6E3.tmp

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

Peripheral Device Discovery

T1120

System Information Discovery

description	ioc	Process
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe

Drops file in System32 directory 4 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\spynet\server.exe	0F6E3.tmp
File opened for modification	C:\Windows\SysWOW64\spynet\server.exe	0F6E3.tmp
File opened for modification	C:\Windows\SysWOW64\spynet\server.exe	0F6E3.tmp
File opened for modification	C:\Windows\SysWOW64\spynet\	0F6E3.tmp

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4660-35-0x0000000024010000-0x0000000024072000-memory.dmp	upx
behavioral2/memory/4660-36-0x0000000024010000-0x0000000024072000-memory.dmp	upx
behavioral2/memory/4660-39-0x0000000024080000-0x00000000240E2000-memory.dmp	upx
behavioral2/memory/4660-96-0x0000000024080000-0x00000000240E2000-memory.dmp	upx

Drops file in Windows directory 8 IoCs

description	ioc	Process
File created	C:\Windows\Installer\e57f59b.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\e57f59b.msi	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File created	C:\Windows\Installer\SourceHash{1A317101-6339-43E7-839D-FDA3D2B34939}	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIF666.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIF696.tmp	msiexec.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 2 IoCs

pid	pid_target	Process	procid_target
1708	1700	WerFault.exe	100
2608	1708	WerFault.exe	103

System Location Discovery: System Language Discovery 1 TTPs 7 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	0F6E3.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	0F6E3.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	server.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_27591c678efc89b04036de69ca7789d1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	msiexec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe

Checks SCSI registry key(s) 3 TTPs 5 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

Peripheral Device Discovery

T1120

System Information Discovery

description	ioc	Process
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 00000000040000009fc5eef0dbaffe7c0000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff0000000027010100000800009fc5eef00000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed3a000000ffffffff0000000007000100006809009fc5eef0000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff3a0000000000000005000000ffffffff000000000700010000f87f1d9fc5eef0000000000000f0ff3a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000009fc5eef000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	WerFault.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WerFault.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	0F6E3.tmp

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3652	msiexec.exe
3652	msiexec.exe
4660	0F6E3.tmp
4660	0F6E3.tmp
3192	0F6E3.tmp
3192	0F6E3.tmp
3192	0F6E3.tmp
3192	0F6E3.tmp
3192	0F6E3.tmp
3192	0F6E3.tmp
3192	0F6E3.tmp
3192	0F6E3.tmp
3192	0F6E3.tmp
3192	0F6E3.tmp
2608	WerFault.exe
2608	WerFault.exe
3192	0F6E3.tmp
3192	0F6E3.tmp
3192	0F6E3.tmp
3192	0F6E3.tmp
3192	0F6E3.tmp
3192	0F6E3.tmp
3192	0F6E3.tmp
3192	0F6E3.tmp
3192	0F6E3.tmp
3192	0F6E3.tmp
3192	0F6E3.tmp
3192	0F6E3.tmp
3192	0F6E3.tmp
3192	0F6E3.tmp
3192	0F6E3.tmp
3192	0F6E3.tmp
3192	0F6E3.tmp
3192	0F6E3.tmp
3192	0F6E3.tmp
3192	0F6E3.tmp
3192	0F6E3.tmp
3192	0F6E3.tmp
3192	0F6E3.tmp
3192	0F6E3.tmp
3192	0F6E3.tmp
3192	0F6E3.tmp
3192	0F6E3.tmp
3192	0F6E3.tmp
3192	0F6E3.tmp
3192	0F6E3.tmp
3192	0F6E3.tmp
3192	0F6E3.tmp
3192	0F6E3.tmp
3192	0F6E3.tmp
3192	0F6E3.tmp
3192	0F6E3.tmp
3192	0F6E3.tmp
3192	0F6E3.tmp
3192	0F6E3.tmp
3192	0F6E3.tmp
3192	0F6E3.tmp
3192	0F6E3.tmp
3192	0F6E3.tmp
3192	0F6E3.tmp
3192	0F6E3.tmp
3192	0F6E3.tmp
3192	0F6E3.tmp
3192	0F6E3.tmp

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3192	0F6E3.tmp

Suspicious use of AdjustPrivilegeToken 59 IoCs

description	pid	Process
Token: SeShutdownPrivilege	3520	msiexec.exe
Token: SeIncreaseQuotaPrivilege	3520	msiexec.exe
Token: SeSecurityPrivilege	3652	msiexec.exe
Token: SeCreateTokenPrivilege	3520	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	3520	msiexec.exe
Token: SeLockMemoryPrivilege	3520	msiexec.exe
Token: SeIncreaseQuotaPrivilege	3520	msiexec.exe
Token: SeMachineAccountPrivilege	3520	msiexec.exe
Token: SeTcbPrivilege	3520	msiexec.exe
Token: SeSecurityPrivilege	3520	msiexec.exe
Token: SeTakeOwnershipPrivilege	3520	msiexec.exe
Token: SeLoadDriverPrivilege	3520	msiexec.exe
Token: SeSystemProfilePrivilege	3520	msiexec.exe
Token: SeSystemtimePrivilege	3520	msiexec.exe
Token: SeProfSingleProcessPrivilege	3520	msiexec.exe
Token: SeIncBasePriorityPrivilege	3520	msiexec.exe
Token: SeCreatePagefilePrivilege	3520	msiexec.exe
Token: SeCreatePermanentPrivilege	3520	msiexec.exe
Token: SeBackupPrivilege	3520	msiexec.exe
Token: SeRestorePrivilege	3520	msiexec.exe
Token: SeShutdownPrivilege	3520	msiexec.exe
Token: SeDebugPrivilege	3520	msiexec.exe
Token: SeAuditPrivilege	3520	msiexec.exe
Token: SeSystemEnvironmentPrivilege	3520	msiexec.exe
Token: SeChangeNotifyPrivilege	3520	msiexec.exe
Token: SeRemoteShutdownPrivilege	3520	msiexec.exe
Token: SeUndockPrivilege	3520	msiexec.exe
Token: SeSyncAgentPrivilege	3520	msiexec.exe
Token: SeEnableDelegationPrivilege	3520	msiexec.exe
Token: SeManageVolumePrivilege	3520	msiexec.exe
Token: SeImpersonatePrivilege	3520	msiexec.exe
Token: SeCreateGlobalPrivilege	3520	msiexec.exe
Token: SeBackupPrivilege	824	vssvc.exe
Token: SeRestorePrivilege	824	vssvc.exe
Token: SeAuditPrivilege	824	vssvc.exe
Token: SeBackupPrivilege	3652	msiexec.exe
Token: SeRestorePrivilege	3652	msiexec.exe
Token: SeRestorePrivilege	3652	msiexec.exe
Token: SeTakeOwnershipPrivilege	3652	msiexec.exe
Token: SeRestorePrivilege	3652	msiexec.exe
Token: SeTakeOwnershipPrivilege	3652	msiexec.exe
Token: SeRestorePrivilege	3652	msiexec.exe
Token: SeTakeOwnershipPrivilege	3652	msiexec.exe
Token: SeBackupPrivilege	4956	srtasks.exe
Token: SeRestorePrivilege	4956	srtasks.exe
Token: SeSecurityPrivilege	4956	srtasks.exe
Token: SeTakeOwnershipPrivilege	4956	srtasks.exe
Token: SeBackupPrivilege	4956	srtasks.exe
Token: SeRestorePrivilege	4956	srtasks.exe
Token: SeSecurityPrivilege	4956	srtasks.exe
Token: SeTakeOwnershipPrivilege	4956	srtasks.exe
Token: SeRestorePrivilege	3652	msiexec.exe
Token: SeTakeOwnershipPrivilege	3652	msiexec.exe
Token: SeRestorePrivilege	3652	msiexec.exe
Token: SeTakeOwnershipPrivilege	3652	msiexec.exe
Token: SeRestorePrivilege	3652	msiexec.exe
Token: SeTakeOwnershipPrivilege	3652	msiexec.exe
Token: SeDebugPrivilege	3192	0F6E3.tmp
Token: SeDebugPrivilege	3192	0F6E3.tmp

Suspicious use of FindShellTrayWindow 3 IoCs

pid	Process
3520	msiexec.exe
4660	0F6E3.tmp
3520	msiexec.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1056 wrote to memory of 3520	1056	JaffaCakes118_27591c678efc89b04036de69ca7789d1.exe	82
PID 1056 wrote to memory of 3520	1056	JaffaCakes118_27591c678efc89b04036de69ca7789d1.exe	82
PID 1056 wrote to memory of 3520	1056	JaffaCakes118_27591c678efc89b04036de69ca7789d1.exe	82
PID 3652 wrote to memory of 4956	3652	msiexec.exe	92
PID 3652 wrote to memory of 4956	3652	msiexec.exe	92
PID 3652 wrote to memory of 2552	3652	msiexec.exe	94
PID 3652 wrote to memory of 2552	3652	msiexec.exe	94
PID 3652 wrote to memory of 2552	3652	msiexec.exe	94
PID 2552 wrote to memory of 4660	2552	MsiExec.exe	95
PID 2552 wrote to memory of 4660	2552	MsiExec.exe	95
PID 2552 wrote to memory of 4660	2552	MsiExec.exe	95
PID 4660 wrote to memory of 3388	4660	0F6E3.tmp	56
PID 4660 wrote to memory of 3388	4660	0F6E3.tmp	56
PID 4660 wrote to memory of 3388	4660	0F6E3.tmp	56
PID 4660 wrote to memory of 3388	4660	0F6E3.tmp	56
PID 4660 wrote to memory of 3388	4660	0F6E3.tmp	56
PID 4660 wrote to memory of 3388	4660	0F6E3.tmp	56
PID 4660 wrote to memory of 3388	4660	0F6E3.tmp	56
PID 4660 wrote to memory of 3388	4660	0F6E3.tmp	56
PID 4660 wrote to memory of 3388	4660	0F6E3.tmp	56
PID 4660 wrote to memory of 3388	4660	0F6E3.tmp	56
PID 4660 wrote to memory of 3388	4660	0F6E3.tmp	56
PID 4660 wrote to memory of 3388	4660	0F6E3.tmp	56
PID 4660 wrote to memory of 3388	4660	0F6E3.tmp	56
PID 4660 wrote to memory of 3388	4660	0F6E3.tmp	56
PID 4660 wrote to memory of 3388	4660	0F6E3.tmp	56
PID 4660 wrote to memory of 3388	4660	0F6E3.tmp	56
PID 4660 wrote to memory of 3388	4660	0F6E3.tmp	56
PID 4660 wrote to memory of 3388	4660	0F6E3.tmp	56
PID 4660 wrote to memory of 3388	4660	0F6E3.tmp	56
PID 4660 wrote to memory of 3388	4660	0F6E3.tmp	56
PID 4660 wrote to memory of 3388	4660	0F6E3.tmp	56
PID 4660 wrote to memory of 3388	4660	0F6E3.tmp	56
PID 4660 wrote to memory of 3388	4660	0F6E3.tmp	56
PID 4660 wrote to memory of 3388	4660	0F6E3.tmp	56
PID 4660 wrote to memory of 3388	4660	0F6E3.tmp	56
PID 4660 wrote to memory of 3388	4660	0F6E3.tmp	56
PID 4660 wrote to memory of 3388	4660	0F6E3.tmp	56
PID 4660 wrote to memory of 3388	4660	0F6E3.tmp	56
PID 4660 wrote to memory of 3388	4660	0F6E3.tmp	56
PID 4660 wrote to memory of 3388	4660	0F6E3.tmp	56
PID 4660 wrote to memory of 3388	4660	0F6E3.tmp	56
PID 4660 wrote to memory of 3388	4660	0F6E3.tmp	56
PID 4660 wrote to memory of 3388	4660	0F6E3.tmp	56
PID 4660 wrote to memory of 3388	4660	0F6E3.tmp	56
PID 4660 wrote to memory of 3388	4660	0F6E3.tmp	56
PID 4660 wrote to memory of 3388	4660	0F6E3.tmp	56
PID 4660 wrote to memory of 3388	4660	0F6E3.tmp	56
PID 4660 wrote to memory of 3388	4660	0F6E3.tmp	56
PID 4660 wrote to memory of 3388	4660	0F6E3.tmp	56
PID 4660 wrote to memory of 3388	4660	0F6E3.tmp	56
PID 4660 wrote to memory of 3388	4660	0F6E3.tmp	56
PID 4660 wrote to memory of 3388	4660	0F6E3.tmp	56
PID 4660 wrote to memory of 3388	4660	0F6E3.tmp	56
PID 4660 wrote to memory of 3388	4660	0F6E3.tmp	56
PID 4660 wrote to memory of 3388	4660	0F6E3.tmp	56
PID 4660 wrote to memory of 3388	4660	0F6E3.tmp	56
PID 4660 wrote to memory of 3388	4660	0F6E3.tmp	56
PID 4660 wrote to memory of 3388	4660	0F6E3.tmp	56
PID 4660 wrote to memory of 3388	4660	0F6E3.tmp	56
PID 4660 wrote to memory of 3388	4660	0F6E3.tmp	56
PID 4660 wrote to memory of 3388	4660	0F6E3.tmp	56
PID 4660 wrote to memory of 3388	4660	0F6E3.tmp	56
PID 4660 wrote to memory of 3388	4660	0F6E3.tmp	56

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Windows\system32\winlogon.exe
winlogon.exe
1⤵
PID:612
- C:\Windows\system32\fontdrvhost.exe
  "fontdrvhost.exe"
  2⤵
  PID:788
- C:\Windows\system32\dwm.exe
  "dwm.exe"
  2⤵
  PID:388

C:\Windows\system32\lsass.exe
C:\Windows\system32\lsass.exe
1⤵
PID:668

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DcomLaunch -p
1⤵
PID:772
- C:\Windows\system32\wbem\unsecapp.exe
  C:\Windows\system32\wbem\unsecapp.exe -Embedding
  2⤵
  PID:2156
- C:\Windows\system32\DllHost.exe
  C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
  2⤵
  PID:3756
- C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
  "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
  2⤵
  PID:3924
- C:\Windows\System32\RuntimeBroker.exe
  C:\Windows\System32\RuntimeBroker.exe -Embedding
  2⤵
  PID:3992
- C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
  "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
  2⤵
  PID:4072
- C:\Windows\System32\RuntimeBroker.exe
  C:\Windows\System32\RuntimeBroker.exe -Embedding
  2⤵
  PID:4116
- C:\Windows\System32\RuntimeBroker.exe
  C:\Windows\System32\RuntimeBroker.exe -Embedding
  2⤵
  PID:2220
- C:\Windows\system32\SppExtComObj.exe
  C:\Windows\system32\SppExtComObj.exe -Embedding
  2⤵
  PID:2668
- C:\Windows\system32\DllHost.exe
  C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
  2⤵
  PID:4780
- C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe
  "C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe" -ServerName:InputApp.AppX9jnwykgrccxc8by3hsrsh07r423xzvav.mca
  2⤵
  PID:3376
- C:\Windows\system32\wbem\wmiprvse.exe
  C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
  2⤵
  PID:2804
- C:\Windows\System32\mousocoreworker.exe
  C:\Windows\System32\mousocoreworker.exe -Embedding
  2⤵
  PID:1276
- C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe
  C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe -Embedding
  2⤵
  PID:1964

C:\Windows\system32\fontdrvhost.exe
"fontdrvhost.exe"
1⤵
PID:780

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k RPCSS -p
1⤵
PID:888

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DcomLaunch -p -s LSM
1⤵
PID:944

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s gpsvc
1⤵
PID:432

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork -p
1⤵
PID:1040

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s lmhosts
1⤵
PID:1048

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s NcbService
1⤵
PID:1104

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s TimeBrokerSvc
1⤵
PID:1120

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Schedule
1⤵
PID:1172
- C:\Windows\system32\taskhostw.exe
  taskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}
  2⤵
  PID:2672

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s EventLog
1⤵
PID:1212

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s ProfSvc
1⤵
PID:1244

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s DispBrokerDesktopSvc
1⤵
PID:1284

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s nsi
1⤵
PID:1332

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s UserManager
1⤵
PID:1444
- C:\Windows\system32\sihost.exe
  sihost.exe
  2⤵
  PID:2488

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s Dhcp
1⤵
PID:1452

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s EventSystem
1⤵
PID:1520

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s Themes
1⤵
PID:1528

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s SENS
1⤵
PID:1668

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s NlaSvc
1⤵
PID:1688

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s AudioEndpointBuilder
1⤵
PID:1732

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p
1⤵
PID:1796

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalService -p -s netprofm
1⤵
PID:1804

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkService -p -s Dnscache
1⤵
PID:1924

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p
1⤵
PID:1944

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k appmodel -p -s StateRepository
1⤵
PID:1980

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s ShellHWDetection
1⤵
PID:2016

C:\Windows\System32\spoolsv.exe
C:\Windows\System32\spoolsv.exe
1⤵
PID:2064

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetworkFirewall -p
1⤵
PID:2132

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s LanmanWorkstation
1⤵
PID:2208

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -s RmSvc
1⤵
PID:2232

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Winmgmt
1⤵
PID:2284

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc
1⤵
PID:2524

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted -p -s PolicyAgent
1⤵
PID:2636

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s IKEEXT
1⤵
PID:2644

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkService -p -s CryptSvc
1⤵
PID:2692

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s TokenBroker
1⤵
PID:2728

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s LanmanServer
1⤵
PID:2776

C:\Windows\sysmon.exe
C:\Windows\sysmon.exe
1⤵
PID:2812

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s TrkWks
1⤵
PID:2836

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s WpnService
1⤵
PID:2848

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s CDPSvc
1⤵
PID:3268

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:3388
- C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_27591c678efc89b04036de69ca7789d1.exe
  "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_27591c678efc89b04036de69ca7789d1.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1056
- - C:\Windows\SysWOW64\msiexec.exe
    msiexec.exe /i C:\Users\Admin\AppData\Local\Temp\MSIC285.tmp
    3⤵
    - Enumerates connected drives
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of FindShellTrayWindow
    PID:3520

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc
1⤵
PID:3552

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s wlidsvc
1⤵
PID:4844

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s StorSvc
1⤵
PID:1064

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation -p -s SSDPSRV
1⤵
PID:1740

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s WinHttpAutoProxySvc
1⤵
PID:4224

C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe
"C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" /service
1⤵
PID:2168

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager
1⤵
PID:1072

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
PID:2108

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3652
- C:\Windows\system32\srtasks.exe
  C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:4956
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:4716
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 0385B3E5D31C44E656E6F51C36B3AC18
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2552
- - C:\Users\Admin\AppData\Local\Temp\0F6E3.tmp
    C:\Users\Admin\AppData\Local\Temp\0F6E3.tmp
    3⤵
    - Adds policy Run key to start application
    - Executes dropped EXE
    - Adds Run key to start application
    - Drops file in System32 directory
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:4660
  - - C:\Windows\SysWOW64\explorer.exe
      explorer.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:3912
  - - C:\Program Files\Internet Explorer\iexplore.exe
      "C:\Program Files\Internet Explorer\iexplore.exe"
      4⤵
      PID:2072
  - - C:\Users\Admin\AppData\Local\Temp\0F6E3.tmp
      "C:\Users\Admin\AppData\Local\Temp\0F6E3.tmp"
      4⤵
      Checks computer location settings
      Executes dropped EXE
      Drops file in System32 directory
      System Location Discovery: System Language Discovery
      Modifies registry class
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: GetForegroundWindowSpam
      Suspicious use of AdjustPrivilegeToken
      PID:3192
    - - C:\Windows\SysWOW64\spynet\server.exe
        
        "C:\Windows\system32\spynet\server.exe"
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:1700
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1700 -s 564
        6⤵
        Program crash
        
        PID:1708
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1708 -s 644
        7⤵
        Program crash
        Checks processor information in registry
        Enumerates system info in registry
        Suspicious behavior: EnumeratesProcesses
        
        PID:2608

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s PcaSvc
1⤵
PID:2540

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:824

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k swprv
1⤵
PID:4692

C:\Windows\System32\WaaSMedicAgent.exe
C:\Windows\System32\WaaSMedicAgent.exe 94ffd7e25ce9a686570f78025a718548 mlizo3T1BE6zrgEjjAlAjQ.0.1.0.0.0
1⤵
PID:1076
- C:\Windows\System32\Conhost.exe
  \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
  2⤵
  PID:868

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s wuauserv
1⤵
PID:3972

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s DsmSvc
1⤵
PID:3848

C:\Windows\servicing\TrustedInstaller.exe
C:\Windows\servicing\TrustedInstaller.exe
1⤵
PID:3208

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k WerSvcGroup
1⤵
PID:4736
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1700 -ip 1700
  2⤵
  PID:2552
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -pss -s 464 -p 1708 -ip 1708
  2⤵
  PID:2400

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s UsoSvc
1⤵
PID:348

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

System Information Discovery