cybergate | 31aeacc7e7fb38e62bd35346126264f356a8bb2a4968c7ed9412dca8acbba537

Modify Registry

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	vbc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	richie.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Policies = "C:\\Windows\\system32\\install\\svchost.exe"	richie.exe
Key created	\REGISTRY\USER\S-1-5-21-446031748-3036493239-2009529691-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	richie.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Policies = "C:\\Windows\\system32\\install\\svchost.exe"	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-446031748-3036493239-2009529691-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Policies = "C:\\Windows\\system32\\install\\svchost.exe"	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-446031748-3036493239-2009529691-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-446031748-3036493239-2009529691-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	vbc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Policies = "C:\\Windows\\system32\\WinDire\\server.exe"	vbc.exe
Key created	\REGISTRY\USER\S-1-5-21-446031748-3036493239-2009529691-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	vbc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Policies = "C:\\Windows\\system32\\WinDire\\server.exe"	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	vbc.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-446031748-3036493239-2009529691-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Policies = "C:\\Windows\\system32\\WinDire\\server.exe"	vbc.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-446031748-3036493239-2009529691-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Policies = "C:\\Windows\\system32\\WinDire\\server.exe"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Policies = "C:\\Windows\\system32\\WinDire\\server.exe"	vbc.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-446031748-3036493239-2009529691-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Policies = "C:\\Windows\\system32\\WinDire\\server.exe"	vbc.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-446031748-3036493239-2009529691-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Policies = "C:\\Windows\\system32\\install\\svchost.exe"	richie.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-446031748-3036493239-2009529691-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	explorer.exe

Boot or Logon Autostart Execution: Active Setup 2 TTPs 10 IoCs

Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

persistence

Active Setup

T1547.014

Modify Registry

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{1I3U5I35-1G14-8T0C-4015-R1218V372128}\StubPath = "C:\\Windows\\system32\\WinDire\\server.exe Restart"	vbc.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{450N2W58-X62T-QV0Q-OP4I-M2WA1C781C10}	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{450N2W58-X62T-QV0Q-OP4I-M2WA1C781C10}\StubPath = "C:\\Windows\\system32\\install\\svchost.exe"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{1I3U5I35-1G14-8T0C-4015-R1218V372128}\StubPath = "C:\\Windows\\system32\\WinDire\\server.exe"	explorer.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{1I3U5I35-1G14-8T0C-4015-R1218V372128}	vbc.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{450N2W58-X62T-QV0Q-OP4I-M2WA1C781C10}	richie.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{450N2W58-X62T-QV0Q-OP4I-M2WA1C781C10}\StubPath = "C:\\Windows\\system32\\install\\svchost.exe Restart"	richie.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{1I3U5I35-1G14-8T0C-4015-R1218V372128}	vbc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{1I3U5I35-1G14-8T0C-4015-R1218V372128}\StubPath = "C:\\Windows\\system32\\WinDire\\server.exe Restart"	vbc.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{1I3U5I35-1G14-8T0C-4015-R1218V372128}	explorer.exe

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-446031748-3036493239-2009529691-1000\Control Panel\International\Geo\Nation	JaffaCakes118_9ce34c6ac381ba630abaab0efcb651c7.exe
Key value queried	\REGISTRY\USER\S-1-5-21-446031748-3036493239-2009529691-1000\Control Panel\International\Geo\Nation	richie.exe

Executes dropped EXE 4 IoCs

pid	Process
2764	richie.exe
1212	msconfig.exe
4640	svchost.exe
5116	server.exe

Loads dropped DLL 1 IoCs

pid	Process
5328	richie.exe

Uses the VBS compiler for execution 1 TTPs

Command and Scripting Interpreter
T1059

Adds Run key to start application 2 TTPs 11 IoCs

persistence

Registry Run Keys / Startup Folder

Modify Registry

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Windows\\system32\\install\\svchost.exe"	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-446031748-3036493239-2009529691-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\system32\\install\\svchost.exe"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Windows\\system32\\WinDire\\server.exe"	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-446031748-3036493239-2009529691-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\system32\\WinDire\\server.exe"	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-446031748-3036493239-2009529691-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Microsoft Configuration = "C:\\Users\\Admin\\AppData\\Local\\Temp\\msconfig.exe"	JaffaCakes118_9ce34c6ac381ba630abaab0efcb651c7.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-446031748-3036493239-2009529691-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\system32\\WinDire\\server.exe"	vbc.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-446031748-3036493239-2009529691-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\system32\\install\\svchost.exe"	richie.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Windows\\system32\\WinDire\\server.exe"	vbc.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-446031748-3036493239-2009529691-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\system32\\WinDire\\server.exe"	vbc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Windows\\system32\\WinDire\\server.exe"	vbc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Windows\\system32\\install\\svchost.exe"	richie.exe

Drops file in System32 directory 10 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\WinDire\server.exe	vbc.exe
File opened for modification	C:\Windows\SysWOW64\install\	richie.exe
File opened for modification	C:\Windows\SysWOW64\WinDire\server.exe	vbc.exe
File opened for modification	C:\Windows\SysWOW64\WinDire\	vbc.exe
File created	C:\Windows\SysWOW64\WinDire\server.exe	vbc.exe
File opened for modification	C:\Windows\SysWOW64\WinDire\server.exe	vbc.exe
File opened for modification	C:\Windows\SysWOW64\install\svchost.exe	richie.exe
File created	C:\Windows\SysWOW64\WinDire\server.exe	vbc.exe
File opened for modification	C:\Windows\SysWOW64\install\svchost.exe	richie.exe
File created	C:\Windows\SysWOW64\install\svchost.exe	richie.exe

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 2604 set thread context of 3380	2604	JaffaCakes118_9ce34c6ac381ba630abaab0efcb651c7.exe	86
PID 1212 set thread context of 5336	1212	msconfig.exe	93

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/3380-34-0x0000000010410000-0x0000000010475000-memory.dmp	upx
behavioral1/memory/3380-38-0x0000000010480000-0x00000000104E5000-memory.dmp	upx
behavioral1/memory/2764-50-0x0000000010410000-0x0000000010471000-memory.dmp	upx
behavioral1/memory/2764-45-0x0000000010480000-0x00000000104E1000-memory.dmp	upx

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\AppCompat\Programs\Amcache.hve.tmp	dw20.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 3 IoCs

pid	pid_target	Process	procid_target
1632	4640	WerFault.exe	105
5760	3416	WerFault.exe	107
4336	3416	WerFault.exe	107

System Location Discovery: System Language Discovery 1 TTPs 14 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	richie.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vbc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	msconfig.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dw20.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vbc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vbc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	server.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_9ce34c6ac381ba630abaab0efcb651c7.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	richie.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dw20.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vbc.exe

Checks processor information in registry 2 TTPs 6 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	dw20.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	dw20.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	dw20.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	dw20.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	dw20.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	dw20.exe

Enumerates system info in registry 2 TTPs 4 IoCs

Query Registry

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	dw20.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	dw20.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	dw20.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	dw20.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	vbc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	richie.exe

Suspicious behavior: EnumeratesProcesses 9 IoCs

pid	Process
2604	JaffaCakes118_9ce34c6ac381ba630abaab0efcb651c7.exe
2604	JaffaCakes118_9ce34c6ac381ba630abaab0efcb651c7.exe
2604	JaffaCakes118_9ce34c6ac381ba630abaab0efcb651c7.exe
3380	vbc.exe
3380	vbc.exe
2764	richie.exe
2764	richie.exe
5336	vbc.exe
5336	vbc.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

pid	Process
5328	richie.exe
4372	vbc.exe

Suspicious use of AdjustPrivilegeToken 20 IoCs

description	pid	Process
Token: SeDebugPrivilege	2604	JaffaCakes118_9ce34c6ac381ba630abaab0efcb651c7.exe
Token: SeRestorePrivilege	4812	dw20.exe
Token: SeBackupPrivilege	4812	dw20.exe
Token: SeRestorePrivilege	4864	dw20.exe
Token: SeBackupPrivilege	4864	dw20.exe
Token: SeBackupPrivilege	4864	dw20.exe
Token: SeBackupPrivilege	4864	dw20.exe
Token: SeBackupPrivilege	4864	dw20.exe
Token: SeBackupPrivilege	4812	dw20.exe
Token: SeBackupPrivilege	4812	dw20.exe
Token: SeBackupPrivilege	4932	explorer.exe
Token: SeRestorePrivilege	4932	explorer.exe
Token: SeDebugPrivilege	5328	richie.exe
Token: SeDebugPrivilege	5328	richie.exe
Token: SeBackupPrivilege	4372	vbc.exe
Token: SeRestorePrivilege	4372	vbc.exe
Token: SeDebugPrivilege	4372	vbc.exe
Token: SeDebugPrivilege	4372	vbc.exe
Token: SeBackupPrivilege	3416	vbc.exe
Token: SeRestorePrivilege	3416	vbc.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
3380	vbc.exe
2764	richie.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2604 wrote to memory of 3380	2604	JaffaCakes118_9ce34c6ac381ba630abaab0efcb651c7.exe	86
PID 2604 wrote to memory of 3380	2604	JaffaCakes118_9ce34c6ac381ba630abaab0efcb651c7.exe	86
PID 2604 wrote to memory of 3380	2604	JaffaCakes118_9ce34c6ac381ba630abaab0efcb651c7.exe	86
PID 2604 wrote to memory of 3380	2604	JaffaCakes118_9ce34c6ac381ba630abaab0efcb651c7.exe	86
PID 2604 wrote to memory of 3380	2604	JaffaCakes118_9ce34c6ac381ba630abaab0efcb651c7.exe	86
PID 2604 wrote to memory of 3380	2604	JaffaCakes118_9ce34c6ac381ba630abaab0efcb651c7.exe	86
PID 2604 wrote to memory of 3380	2604	JaffaCakes118_9ce34c6ac381ba630abaab0efcb651c7.exe	86
PID 2604 wrote to memory of 3380	2604	JaffaCakes118_9ce34c6ac381ba630abaab0efcb651c7.exe	86
PID 2604 wrote to memory of 3380	2604	JaffaCakes118_9ce34c6ac381ba630abaab0efcb651c7.exe	86
PID 2604 wrote to memory of 3380	2604	JaffaCakes118_9ce34c6ac381ba630abaab0efcb651c7.exe	86
PID 2604 wrote to memory of 3380	2604	JaffaCakes118_9ce34c6ac381ba630abaab0efcb651c7.exe	86
PID 2604 wrote to memory of 3380	2604	JaffaCakes118_9ce34c6ac381ba630abaab0efcb651c7.exe	86
PID 2604 wrote to memory of 3380	2604	JaffaCakes118_9ce34c6ac381ba630abaab0efcb651c7.exe	86
PID 2604 wrote to memory of 2764	2604	JaffaCakes118_9ce34c6ac381ba630abaab0efcb651c7.exe	89
PID 2604 wrote to memory of 2764	2604	JaffaCakes118_9ce34c6ac381ba630abaab0efcb651c7.exe	89
PID 2604 wrote to memory of 2764	2604	JaffaCakes118_9ce34c6ac381ba630abaab0efcb651c7.exe	89
PID 2112 wrote to memory of 1212	2112	cmd.exe	92
PID 2112 wrote to memory of 1212	2112	cmd.exe	92
PID 2112 wrote to memory of 1212	2112	cmd.exe	92
PID 1212 wrote to memory of 5336	1212	msconfig.exe	93
PID 1212 wrote to memory of 5336	1212	msconfig.exe	93
PID 1212 wrote to memory of 5336	1212	msconfig.exe	93
PID 1212 wrote to memory of 5336	1212	msconfig.exe	93
PID 1212 wrote to memory of 5336	1212	msconfig.exe	93
PID 1212 wrote to memory of 5336	1212	msconfig.exe	93
PID 1212 wrote to memory of 5336	1212	msconfig.exe	93
PID 1212 wrote to memory of 5336	1212	msconfig.exe	93
PID 1212 wrote to memory of 5336	1212	msconfig.exe	93
PID 1212 wrote to memory of 5336	1212	msconfig.exe	93
PID 1212 wrote to memory of 5336	1212	msconfig.exe	93
PID 1212 wrote to memory of 5336	1212	msconfig.exe	93
PID 1212 wrote to memory of 5336	1212	msconfig.exe	93
PID 1212 wrote to memory of 4812	1212	msconfig.exe	94
PID 1212 wrote to memory of 4812	1212	msconfig.exe	94
PID 1212 wrote to memory of 4812	1212	msconfig.exe	94
PID 2604 wrote to memory of 4864	2604	JaffaCakes118_9ce34c6ac381ba630abaab0efcb651c7.exe	96
PID 2604 wrote to memory of 4864	2604	JaffaCakes118_9ce34c6ac381ba630abaab0efcb651c7.exe	96
PID 2604 wrote to memory of 4864	2604	JaffaCakes118_9ce34c6ac381ba630abaab0efcb651c7.exe	96
PID 3380 wrote to memory of 3472	3380	vbc.exe	56
PID 3380 wrote to memory of 3472	3380	vbc.exe	56
PID 3380 wrote to memory of 3472	3380	vbc.exe	56
PID 3380 wrote to memory of 3472	3380	vbc.exe	56
PID 3380 wrote to memory of 3472	3380	vbc.exe	56
PID 3380 wrote to memory of 3472	3380	vbc.exe	56
PID 3380 wrote to memory of 3472	3380	vbc.exe	56
PID 3380 wrote to memory of 3472	3380	vbc.exe	56
PID 3380 wrote to memory of 3472	3380	vbc.exe	56
PID 3380 wrote to memory of 3472	3380	vbc.exe	56
PID 3380 wrote to memory of 3472	3380	vbc.exe	56
PID 3380 wrote to memory of 3472	3380	vbc.exe	56
PID 3380 wrote to memory of 3472	3380	vbc.exe	56
PID 3380 wrote to memory of 3472	3380	vbc.exe	56
PID 3380 wrote to memory of 3472	3380	vbc.exe	56
PID 3380 wrote to memory of 3472	3380	vbc.exe	56
PID 3380 wrote to memory of 3472	3380	vbc.exe	56
PID 3380 wrote to memory of 3472	3380	vbc.exe	56
PID 3380 wrote to memory of 3472	3380	vbc.exe	56
PID 3380 wrote to memory of 3472	3380	vbc.exe	56
PID 3380 wrote to memory of 3472	3380	vbc.exe	56
PID 3380 wrote to memory of 3472	3380	vbc.exe	56
PID 3380 wrote to memory of 3472	3380	vbc.exe	56
PID 3380 wrote to memory of 3472	3380	vbc.exe	56
PID 3380 wrote to memory of 3472	3380	vbc.exe	56
PID 3380 wrote to memory of 3472	3380	vbc.exe	56

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:3472
- C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_9ce34c6ac381ba630abaab0efcb651c7.exe
  "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_9ce34c6ac381ba630abaab0efcb651c7.exe"
  2⤵
  - Checks computer location settings
  - Adds Run key to start application
  - Suspicious use of SetThreadContext
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2604
- - C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
    C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
    3⤵
    - Adds policy Run key to start application
    - Boot or Logon Autostart Execution: Active Setup
    - Adds Run key to start application
    - Drops file in System32 directory
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:3380
  - - C:\Windows\SysWOW64\explorer.exe
      explorer.exe
      4⤵
      Adds policy Run key to start application
      Boot or Logon Autostart Execution: Active Setup
      Adds Run key to start application
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4932
  - - C:\Program Files\Internet Explorer\iexplore.exe
      "C:\Program Files\Internet Explorer\iexplore.exe"
      4⤵
      PID:5164
  - - C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
      "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
      4⤵
      Drops file in System32 directory
      System Location Discovery: System Language Discovery
      Modifies registry class
      Suspicious behavior: GetForegroundWindowSpam
      Suspicious use of AdjustPrivilegeToken
      PID:4372
    - - C:\Windows\SysWOW64\WinDire\server.exe
        
        "C:\Windows\system32\WinDire\server.exe"
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:5116
- - C:\Users\Admin\AppData\Local\Temp\richie.exe
    "C:\Users\Admin\AppData\Local\Temp\richie.exe"
    3⤵
    - Adds policy Run key to start application
    - Boot or Logon Autostart Execution: Active Setup
    - Executes dropped EXE
    - Adds Run key to start application
    - Drops file in System32 directory
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of FindShellTrayWindow
    PID:2764
  - - C:\Windows\SysWOW64\explorer.exe
      explorer.exe
      4⤵
      Adds policy Run key to start application
      Boot or Logon Autostart Execution: Active Setup
      Adds Run key to start application
      System Location Discovery: System Language Discovery
      PID:3584
  - - C:\Program Files\Internet Explorer\iexplore.exe
      "C:\Program Files\Internet Explorer\iexplore.exe"
      4⤵
      PID:1944
  - - C:\Users\Admin\AppData\Local\Temp\richie.exe
      "C:\Users\Admin\AppData\Local\Temp\richie.exe"
      4⤵
      Checks computer location settings
      Loads dropped DLL
      Drops file in System32 directory
      System Location Discovery: System Language Discovery
      Modifies registry class
      Suspicious behavior: GetForegroundWindowSpam
      Suspicious use of AdjustPrivilegeToken
      PID:5328
    - - C:\Windows\SysWOW64\install\svchost.exe
        
        "C:\Windows\system32\install\svchost.exe"
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:4640
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4640 -s 580
        6⤵
        Program crash
        
        PID:1632
- - C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
    dw20.exe -x -s 2032
    3⤵
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    - Checks processor information in registry
    - Enumerates system info in registry
    - Suspicious use of AdjustPrivilegeToken
    PID:4864
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\msconfig.exe
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2112
- - C:\Users\Admin\AppData\Local\Temp\msconfig.exe
    C:\Users\Admin\AppData\Local\Temp\msconfig.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1212
  - - C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
      C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
      4⤵
      Adds policy Run key to start application
      Boot or Logon Autostart Execution: Active Setup
      Adds Run key to start application
      Drops file in System32 directory
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      PID:5336
    - - C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        5⤵
        
        PID:3972
    - - C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
        5⤵
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        
        PID:3416
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3416 -s 1036
        6⤵
        Program crash
        
        PID:5760
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3416 -s 1080
        6⤵
        Program crash
        
        PID:4336
  - - C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
      dw20.exe -x -s 872
      4⤵
      System Location Discovery: System Language Discovery
      Checks processor information in registry
      Enumerates system info in registry
      Suspicious use of AdjustPrivilegeToken
      PID:4812

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 4640 -ip 4640
1⤵
PID:3908

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 504 -p 3416 -ip 3416
1⤵
PID:5464

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 508 -p 3416 -ip 3416
1⤵
PID:5884

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

Credential Access

Discovery

Query Registry

System Information Discovery