Analysis
- user interaction
yes - max time kernel
149s - max time network
142s - platform
windows10-2004_x64 - resource
win10v2004-20260911-en - resource tags
arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
20/10/2026, 16:27
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
cat-cryptor-v1.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
34 signatures
150 seconds
Behavioral task
behavioral2
Sample
cat-cryptor-v1.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
37 signatures
150 seconds
General
- Target cat-cryptor-v1.exe
- Size 12.7MB
- Sample261020-tx31nastft
- SHA256 362cd24fe4581945c26748cbc4aa3db9e1c68e69c5739cb8d65f51ec7ea4ec9a
- MD5 297f98e0585d1c0c025280c92b7e56dc
- SHA1 f6627fbd581ef9ad7c5d22f7bf8c0e22dd41cd40
- SHA512 5e9e7718f2533f614d90d7bd2d6ae6a58dfc01f2e042bc6ccad733c335a1240496d73cc83a7c617e893bb262e64b7eb9758973174ebf58abf4f8df6051d979d0
- SSDEEP 49152:DJhuYE4KPTw++1Zzzs6fOCuEMr/KsaYgNBeESXZO6i43dNhpeF08eI0/SMASBR0z:DJhuYlKL8JOCuEMrKsa1JuZ
- TLSH T1B7D6F93479EB185DB3A79A9E4BD9B5EE5D1EF363230B21B82070334B83129418DE5B35
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Contains code to disable Windows Defender 2 IoCs
A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.
resource yara_rule behavioral1/memory/1868-0-0x00000000005B0000-0x000000000126A000-memory.dmp disable_win_def behavioral1/files/0x00070000000245b0-213.dat disable_win_def - Modifies WinLogon for persistence 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "\"C:\\Windows\\system32\\winlogon_fix.exe\"" cat-cryptor-v1.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\DisableAntiSpyware = "1" cat-cryptor-v1.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\DisableAntiSpyware = "1" def_none.exe - Modifies Windows Defender Real-time Protection settings 3 TTPs 18 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" cat-cryptor-v1.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRawWriteNotification = "1" def_none.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\IOAVMaxSize = "1" def_none.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" def_none.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\RealTimeScanDirection = "1" def_none.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" cat-cryptor-v1.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" cat-cryptor-v1.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" cat-cryptor-v1.exe Key created \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection def_none.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" def_none.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" def_none.exe Key created \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection cat-cryptor-v1.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRawWriteNotification = "1" cat-cryptor-v1.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" def_none.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIntrusionPreventionSystem = "1" def_none.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" def_none.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableInformationProtectionControl = "1" def_none.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" cat-cryptor-v1.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "4" def_none.exe - Modifies Windows Defender notification settings 3 TTPs 6 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender Security Center\Notifications\DisableEnhancedNotifications = "1" def_none.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender Security Center\Notifications\DisableEnhancedNotifications = "1" def_none.exe Key created \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender Security Center\Notifications def_none.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender Security Center\Notifications\DisableNotifications = "1" def_none.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender Security Center\Notifications def_none.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender Security Center\Notifications\DisableNotifications = "1" def_none.exe - Modifies firewall policy service 3 TTPs 8 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\EnableFirewall = "0" def_none.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile def_none.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" def_none.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile def_none.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile\EnableFirewall = "0" def_none.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\PrivateProfile def_none.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\PrivateProfile\EnableFirewall = "0" def_none.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile def_none.exe - Modifies security service 2 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\WinDefend\Start = "3" def_none.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wscsvc\Start = "4" def_none.exe - UAC bypass 3 TTPs 3 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" cat-cryptor-v1.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" cat-cryptor-v1.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" cat-cryptor-v1.exe - Modifies boot configuration data using bcdedit 1 TTPs 13 IoCs
pid Process 2824 bcdedit.exe 3220 bcdedit.exe 2984 bcdedit.exe 548 bcdedit.exe 5556 bcdedit.exe 1224 bcdedit.exe 1432 bcdedit.exe 4260 bcdedit.exe 3980 bcdedit.exe 3944 bcdedit.exe 820 bcdedit.exe 3900 bcdedit.exe 5268 bcdedit.exe - Renames multiple (72) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
- Disables RegEdit via registry modification 1 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" cat-cryptor-v1.exe - Drops file in Drivers directory 2 IoCs
description ioc Process File opened for modification C:\Windows\System32\drivers\etc\hosts cat-cryptor-v1.exe File created C:\Windows\System32\drivers\etc\hosts.n4an_backup cat-cryptor-v1.exe - Event Triggered Execution: Image File Execution Options Injection 1 TTPs 64 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regedt32.exe cat-cryptor-v1.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\fsmgmt.msc cat-cryptor-v1.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\NisSrv.exe\Debugger = "%SYSTEMROOT%\\System32\\taskkill.exe" def_none.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SgrmBroker.exe\Debugger = "%SYSTEMROOT%\\System32\\taskkill.exe" def_none.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\dfrg.msc cat-cryptor-v1.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe\Debugger = "C:\\Users\\Admin\\AppData\\Local\\Temp\\wallpaper_ncrypt.jpg" cat-cryptor-v1.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\compmgmt.msc\Debugger = "C:\\Users\\Admin\\AppData\\Local\\Temp\\wallpaper_ncrypt.jpg" cat-cryptor-v1.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\perfmon.msc\Debugger = "C:\\Users\\Admin\\AppData\\Local\\Temp\\wallpaper_ncrypt.jpg" cat-cryptor-v1.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rsop.msc\Debugger = "C:\\Users\\Admin\\AppData\\Local\\Temp\\wallpaper_ncrypt.jpg" cat-cryptor-v1.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\azman.msc cat-cryptor-v1.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SecurityHealthHost.exe def_none.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cmd.exe\Debugger = "C:\\Users\\Admin\\AppData\\Local\\Temp\\wallpaper_ncrypt.jpg" cat-cryptor-v1.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\secpol.msc cat-cryptor-v1.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\lusrmgr.msc\Debugger = "C:\\Users\\Admin\\AppData\\Local\\Temp\\wallpaper_ncrypt.jpg" cat-cryptor-v1.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\lusrmgr.msc cat-cryptor-v1.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MpDlpService.exe\Debugger = "%SYSTEMROOT%\\System32\\taskkill.exe" def_none.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SgrmLpac.exe\Debugger = "%SYSTEMROOT%\\System32\\taskkill.exe" def_none.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\eventvwr.msc cat-cryptor-v1.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ntmsmgr.msc cat-cryptor-v1.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\NisSrv.exe def_none.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regedit.exe cat-cryptor-v1.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\devmgmt.msc\Debugger = "C:\\Users\\Admin\\AppData\\Local\\Temp\\wallpaper_ncrypt.jpg" cat-cryptor-v1.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskschd.msc cat-cryptor-v1.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskschd.msc\Debugger = "C:\\Users\\Admin\\AppData\\Local\\Temp\\wallpaper_ncrypt.jpg" cat-cryptor-v1.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\comexp.msc\Debugger = "C:\\Users\\Admin\\AppData\\Local\\Temp\\wallpaper_ncrypt.jpg" cat-cryptor-v1.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MsMpEng.exe\Debugger = "%SYSTEMROOT%\\System32\\taskkill.exe" def_none.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MpCmdRun.exe\Debugger = "%SYSTEMROOT%\\System32\\taskkill.exe" def_none.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\dfrg.msc\Debugger = "C:\\Users\\Admin\\AppData\\Local\\Temp\\wallpaper_ncrypt.jpg" cat-cryptor-v1.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MpCmdRun.exe def_none.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MpDlpService.exe def_none.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe cat-cryptor-v1.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rsop.msc cat-cryptor-v1.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ConfigSecurityPolicy.exe def_none.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SgrmLpac.exe def_none.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regedit.exe\Debugger = "C:\\Users\\Admin\\AppData\\Local\\Temp\\wallpaper_ncrypt.jpg" cat-cryptor-v1.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msconfig.exe\Debugger = "C:\\Users\\Admin\\AppData\\Local\\Temp\\wallpaper_ncrypt.jpg" cat-cryptor-v1.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\fsmgmt.msc\Debugger = "C:\\Users\\Admin\\AppData\\Local\\Temp\\wallpaper_ncrypt.jpg" cat-cryptor-v1.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MpDefenderCoreService.exe def_none.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MpCopyAccelerator.exe\Debugger = "%SYSTEMROOT%\\System32\\taskkill.exe" def_none.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MpDlpCmd.exe def_none.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\smartscreen.exe def_none.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\services.msc\Debugger = "C:\\Users\\Admin\\AppData\\Local\\Temp\\wallpaper_ncrypt.jpg" cat-cryptor-v1.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\diskmgmt.msc\Debugger = "C:\\Users\\Admin\\AppData\\Local\\Temp\\wallpaper_ncrypt.jpg" cat-cryptor-v1.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\certmgr.msc cat-cryptor-v1.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\azman.msc\Debugger = "C:\\Users\\Admin\\AppData\\Local\\Temp\\wallpaper_ncrypt.jpg" cat-cryptor-v1.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cmd.exe cat-cryptor-v1.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\procexp.exe\Debugger = "C:\\Users\\Admin\\AppData\\Local\\Temp\\wallpaper_ncrypt.jpg" cat-cryptor-v1.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\gpedit.msc cat-cryptor-v1.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\compmgmt.msc cat-cryptor-v1.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\perfmon.msc cat-cryptor-v1.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SecurityHealthService.exe\Debugger = "%SYSTEMROOT%\\System32\\taskkill.exe" def_none.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SecurityHealthHost.exe\Debugger = "%SYSTEMROOT%\\System32\\taskkill.exe" def_none.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\procmon.exe\Debugger = "C:\\Users\\Admin\\AppData\\Local\\Temp\\wallpaper_ncrypt.jpg" cat-cryptor-v1.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\gpedit.msc\Debugger = "C:\\Users\\Admin\\AppData\\Local\\Temp\\wallpaper_ncrypt.jpg" cat-cryptor-v1.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ntmsmgr.msc\Debugger = "C:\\Users\\Admin\\AppData\\Local\\Temp\\wallpaper_ncrypt.jpg" cat-cryptor-v1.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MsMpEng.exe def_none.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ConfigSecurityPolicy.exe\Debugger = "%SYSTEMROOT%\\System32\\taskkill.exe" def_none.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\control.exe\Debugger = "C:\\Users\\Admin\\AppData\\Local\\Temp\\wallpaper_ncrypt.jpg" cat-cryptor-v1.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\explorer.exe cat-cryptor-v1.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\procmon.exe cat-cryptor-v1.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regedt32.exe\Debugger = "C:\\Users\\Admin\\AppData\\Local\\Temp\\wallpaper_ncrypt.jpg" cat-cryptor-v1.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\devmgmt.msc cat-cryptor-v1.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\powershell.exe cat-cryptor-v1.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\powershell.exe\Debugger = "C:\\Users\\Admin\\AppData\\Local\\Temp\\wallpaper_ncrypt.jpg" cat-cryptor-v1.exe - Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000\Control Panel\International\Geo\Nation cat-cryptor-v1.exe - Executes dropped EXE 2 IoCs
pid Process 4340 def_none.exe 4508 def_none.exe - Windows security modification 2 TTPs 13 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\MpEngine\MpCloudBlockLevel = "0" def_none.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\MpEngine\MpBafsExtendedTimeout = "50" def_none.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\ServiceStartStates = "0" def_none.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Real-Time Protection def_none.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" def_none.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\UX Configuration def_none.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtectionSource = "2" def_none.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\MpEngine def_none.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\IsServiceRunning = "0" def_none.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\DisableAntiSpyware = "1" def_none.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\UX Configuration\DisablePrivacyMode = "1" def_none.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features def_none.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "4" def_none.exe - Adds Run key to start application 2 TTPs 5 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\WINDOWS = "\"C:\\Windows\\system32\\winlogon_fix.exe\" --wininit" cat-cryptor-v1.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WindowsInstaller = "\"C:\\Windows\\system32\\winlogon_fix.exe\" -startup" cat-cryptor-v1.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MSEdgeUpdateX = "\"C:\\Windows\\system32\\winlogon_fix.exe\"" cat-cryptor-v1.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\System3264Wow = "\"C:\\Windows\\system32\\winlogon_fix.exe\" --init" cat-cryptor-v1.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\OneDrive10293 = "\"C:\\Windows\\system32\\winlogon_fix.exe\" /setup" cat-cryptor-v1.exe - Checks whether UAC is enabled 1 TTPs 2 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA cat-cryptor-v1.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" cat-cryptor-v1.exe - Looks up external IP address via web service 1 TTPs 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 15 api.ipify.org 16 api.ipify.org - Modifies Security services 2 TTPs 5 IoCs
Modifies the startup behavior of a security service.
description ioc Process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\WdNisDrv\Start = "4" def_none.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\WdFilter\Start = "4" def_none.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\WdBoot\Start = "4" def_none.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SecurityHealthService\Start = "4" def_none.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\WdNisSvc\Start = "4" def_none.exe - Drops file in System32 directory 7 IoCs
description ioc Process File created C:\Windows\system32\def_none.exe cat-cryptor-v1.exe File opened for modification C:\Windows\system32\Recovery ReAgentc.exe File opened for modification C:\Windows\system32\def_none.exe cat-cryptor-v1.exe File created C:\Windows\system32\winlogon_fix.exe cat-cryptor-v1.exe File opened for modification C:\Windows\system32\winlogon_fix.exe cat-cryptor-v1.exe File opened for modification C:\Windows\system32\config\reagent_backup.dat cat-cryptor-v1.exe File opened for modification C:\Windows\system32\Recovery\ReAgent.xml ReAgentc.exe - Drops file in Windows directory 4 IoCs
description ioc Process File opened for modification C:\Windows\Logs\ReAgent\ReAgent.log ReAgentc.exe File opened for modification C:\Windows\Panther\UnattendGC\setuperr.log ReAgentc.exe File opened for modification C:\Windows\Panther\UnattendGC\diagerr.xml ReAgentc.exe File opened for modification C:\Windows\Panther\UnattendGC\diagwrn.xml ReAgentc.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname cat-cryptor-v1.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain cat-cryptor-v1.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname def_none.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain def_none.exe - Kills process with taskkill 1 IoCs
pid Process 228 taskkill.exe - Modifies data under HKEY_USERS 39 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\PhishingFilter def_none.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion def_none.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\1 = "MsMpEng.exe" def_none.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\7 = "MpDlpCmd.exe" def_none.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\13 = "SecurityHealthHost.exe" def_none.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Notifications\Settings def_none.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Notifications\Settings\Windows.SystemToast.SecurityCenter\Enabled = "0" def_none.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer def_none.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun def_none.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\6 = "MpDlpService.exe" def_none.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Notifications\Settings\Windows.Defender def_none.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Notifications\Settings\Windows.Defender\Enabled = "0" def_none.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\AppHost\PreventOverride = "0" def_none.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows def_none.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\10 = "SgrmLpac.exe" def_none.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\PhishingFilter\EnabledV9 = "0" def_none.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Notifications\Settings\Windows.SystemToast.SecurityAndMaintenance def_none.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Notifications\Settings\Windows.SystemToast.SecurityCenter def_none.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows Script\Settings def_none.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\8 = "ConfigSecurityPolicy.exe" def_none.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\PhishingFilter\PreventOverride = "0" def_none.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Policies def_none.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\5 = "MpCopyAccelerator.exe" def_none.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\9 = "smartscreen.exe" def_none.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\11 = "SgrmBroker.exe" def_none.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\AppHost\EnableWebContentEvaluation = "0" def_none.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows Script\Settings\AmsiEnable = "0" def_none.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun = "1" def_none.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\4 = "MpDefenderCoreService.exe" def_none.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\12 = "SecurityHealthService.exe" def_none.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE def_none.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Notifications def_none.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Notifications\Settings\Windows.SystemToast.SecurityAndMaintenance\Enabled = "0" def_none.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\AppHost def_none.exe Key created \REGISTRY\USER\.DEFAULT\Software def_none.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\2 = "MpCmdRun.exe" def_none.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\3 = "NisSrv.exe" def_none.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft def_none.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Notifications\Settings\Windows.SystemToast.SecurityAndMaintenance def_none.exe - Modifies registry class 4 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Directory\shellex\ContextMenuHandlers\EPP def_none.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Directory\shellex\ContextMenuHandlers\EPP\ def_none.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Drive\shellex\ContextMenuHandlers\EPP def_none.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Drive\shellex\ContextMenuHandlers\EPP\ def_none.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1868 cat-cryptor-v1.exe 1868 cat-cryptor-v1.exe 1868 cat-cryptor-v1.exe 1868 cat-cryptor-v1.exe 1868 cat-cryptor-v1.exe 1868 cat-cryptor-v1.exe 1868 cat-cryptor-v1.exe 1868 cat-cryptor-v1.exe 1868 cat-cryptor-v1.exe 1868 cat-cryptor-v1.exe 1868 cat-cryptor-v1.exe 1868 cat-cryptor-v1.exe 1868 cat-cryptor-v1.exe 1868 cat-cryptor-v1.exe 1868 cat-cryptor-v1.exe 1868 cat-cryptor-v1.exe 1868 cat-cryptor-v1.exe 1868 cat-cryptor-v1.exe 1868 cat-cryptor-v1.exe 1868 cat-cryptor-v1.exe 1868 cat-cryptor-v1.exe 1868 cat-cryptor-v1.exe 1868 cat-cryptor-v1.exe 1868 cat-cryptor-v1.exe 1868 cat-cryptor-v1.exe 1868 cat-cryptor-v1.exe 1868 cat-cryptor-v1.exe 1868 cat-cryptor-v1.exe 1868 cat-cryptor-v1.exe 1868 cat-cryptor-v1.exe 1868 cat-cryptor-v1.exe 1868 cat-cryptor-v1.exe 1868 cat-cryptor-v1.exe 1868 cat-cryptor-v1.exe 1868 cat-cryptor-v1.exe 1868 cat-cryptor-v1.exe 1868 cat-cryptor-v1.exe 1868 cat-cryptor-v1.exe 1868 cat-cryptor-v1.exe 1868 cat-cryptor-v1.exe 1868 cat-cryptor-v1.exe 1868 cat-cryptor-v1.exe 1868 cat-cryptor-v1.exe 1868 cat-cryptor-v1.exe 1868 cat-cryptor-v1.exe 1868 cat-cryptor-v1.exe 1868 cat-cryptor-v1.exe 1868 cat-cryptor-v1.exe 1868 cat-cryptor-v1.exe 1868 cat-cryptor-v1.exe 1868 cat-cryptor-v1.exe 1868 cat-cryptor-v1.exe 1868 cat-cryptor-v1.exe 1868 cat-cryptor-v1.exe 1868 cat-cryptor-v1.exe 1868 cat-cryptor-v1.exe 1868 cat-cryptor-v1.exe 1868 cat-cryptor-v1.exe 1868 cat-cryptor-v1.exe 1868 cat-cryptor-v1.exe 1868 cat-cryptor-v1.exe 1868 cat-cryptor-v1.exe 1868 cat-cryptor-v1.exe 1868 cat-cryptor-v1.exe - Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 1868 cat-cryptor-v1.exe Token: SeDebugPrivilege 228 taskkill.exe - Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 1868 cat-cryptor-v1.exe - Suspicious use of WriteProcessMemory 16 IoCs
description pid Process procid_target PID 1868 wrote to memory of 228 1868 cat-cryptor-v1.exe 93 PID 1868 wrote to memory of 5476 1868 cat-cryptor-v1.exe 95 PID 1868 wrote to memory of 2824 1868 cat-cryptor-v1.exe 96 PID 1868 wrote to memory of 2984 1868 cat-cryptor-v1.exe 99 PID 1868 wrote to memory of 3220 1868 cat-cryptor-v1.exe 100 PID 1868 wrote to memory of 548 1868 cat-cryptor-v1.exe 103 PID 1868 wrote to memory of 1432 1868 cat-cryptor-v1.exe 105 PID 1868 wrote to memory of 5556 1868 cat-cryptor-v1.exe 106 PID 1868 wrote to memory of 1224 1868 cat-cryptor-v1.exe 107 PID 1868 wrote to memory of 4260 1868 cat-cryptor-v1.exe 111 PID 1868 wrote to memory of 3900 1868 cat-cryptor-v1.exe 113 PID 1868 wrote to memory of 820 1868 cat-cryptor-v1.exe 114 PID 1868 wrote to memory of 3944 1868 cat-cryptor-v1.exe 115 PID 1868 wrote to memory of 3980 1868 cat-cryptor-v1.exe 116 PID 1868 wrote to memory of 5268 1868 cat-cryptor-v1.exe 121 PID 1868 wrote to memory of 4340 1868 cat-cryptor-v1.exe 123 - System policy modification 1 TTPs 21 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" cat-cryptor-v1.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableTaskMgr = "1" cat-cryptor-v1.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" cat-cryptor-v1.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableChangePassword = "1" cat-cryptor-v1.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoViewContextMenu = "1" cat-cryptor-v1.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoDevMgrUpdate = "1" cat-cryptor-v1.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoClose = "1" cat-cryptor-v1.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableLockWorkstation = "1" cat-cryptor-v1.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\NoChangePassword = "1" cat-cryptor-v1.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoMsConfig = "1" cat-cryptor-v1.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoShutDown = "1" cat-cryptor-v1.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\NoLogoff = "1" cat-cryptor-v1.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\HideFastUserSwitching = "1" cat-cryptor-v1.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableCAD = "1" cat-cryptor-v1.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\NoClose = "1" cat-cryptor-v1.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoControlPanel = "1" cat-cryptor-v1.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoLogoff = "1" cat-cryptor-v1.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoRestart = "1" cat-cryptor-v1.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ShutdownWithoutLogon = "0" cat-cryptor-v1.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" cat-cryptor-v1.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" cat-cryptor-v1.exe - Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\cat-cryptor-v1.exe"C:\Users\Admin\AppData\Local\Temp\cat-cryptor-v1.exe"1⤵
- Modifies WinLogon for persistence
- Modifies Windows Defender DisableAntiSpyware settings
- Modifies Windows Defender Real-time Protection settings
- UAC bypass
- Disables RegEdit via registry modification
- Drops file in Drivers directory
- Event Triggered Execution: Image File Execution Options Injection
- Checks computer location settings
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops file in System32 directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
PID:1868 -
C:\Windows\SYSTEM32\taskkill.exetaskkill.exe /im Explorer.exe /f2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:228
-
-
C:\Windows\System32\ReAgentc.exe"C:\Windows\System32\ReAgentc.exe" /disable2⤵
- Drops file in System32 directory
- Drops file in Windows directory
PID:5476
-
-
C:\Windows\System32\bcdedit.exe"C:\Windows\System32\bcdedit.exe" /set {default} recoveryenabled No2⤵
- Modifies boot configuration data using bcdedit
PID:2824
-
-
C:\Windows\System32\bcdedit.exe"C:\Windows\System32\bcdedit.exe" /set {default} bootstatuspolicy ignoreallfailures2⤵
- Modifies boot configuration data using bcdedit
PID:2984
-
-
C:\Windows\System32\bcdedit.exe"C:\Windows\System32\bcdedit.exe" /set {current} recoveryenabled false2⤵
- Modifies boot configuration data using bcdedit
PID:3220
-
-
C:\Windows\System32\bcdedit.exe"C:\Windows\System32\bcdedit.exe" /set {current} optionsedit false2⤵
- Modifies boot configuration data using bcdedit
PID:548
-
-
C:\Windows\System32\bcdedit.exe"C:\Windows\System32\bcdedit.exe" /set {current} advancedoptions false2⤵
- Modifies boot configuration data using bcdedit
PID:1432
-
-
C:\Windows\System32\bcdedit.exe"C:\Windows\System32\bcdedit.exe" /set {current} bootmenupolicy legacy2⤵
- Modifies boot configuration data using bcdedit
PID:5556
-
-
C:\Windows\System32\bcdedit.exe"C:\Windows\System32\bcdedit.exe" /set {bootmgr} bootsequence {current}2⤵
- Modifies boot configuration data using bcdedit
PID:1224
-
-
C:\Windows\System32\bcdedit.exe"C:\Windows\System32\bcdedit.exe" /set {bootmgr} timeout 02⤵
- Modifies boot configuration data using bcdedit
PID:4260
-
-
C:\Windows\System32\bcdedit.exe"C:\Windows\System32\bcdedit.exe" /set {bootmgr} displaybootmenu no2⤵
- Modifies boot configuration data using bcdedit
PID:3900
-
-
C:\Windows\System32\bcdedit.exe"C:\Windows\System32\bcdedit.exe" /set {bootmgr} displayorder {default} /addfirst2⤵
- Modifies boot configuration data using bcdedit
PID:820
-
-
C:\Windows\System32\bcdedit.exe"C:\Windows\System32\bcdedit.exe" /set {fwbootmgr} displayorder {bootmgr} /addfirst2⤵
- Modifies boot configuration data using bcdedit
PID:3944
-
-
C:\Windows\System32\bcdedit.exe"C:\Windows\System32\bcdedit.exe" /set {current} safeboot No2⤵
- Modifies boot configuration data using bcdedit
PID:3980
-
-
C:\Windows\System32\bcdedit.exe"C:\Windows\System32\bcdedit.exe" /set {bootmgr} removeoptions2⤵
- Modifies boot configuration data using bcdedit
PID:5268
-
-
C:\Windows\system32\def_none.exe"C:\Windows\system32\def_none.exe"2⤵
- Executes dropped EXE
PID:4340
-
-
C:\Windows\system32\def_none.exeC:\Windows\system32\def_none.exe -s -worker -tilog1⤵
- Modifies Windows Defender DisableAntiSpyware settings
- Modifies Windows Defender Real-time Protection settings
- Modifies Windows Defender TamperProtection settings
- Modifies Windows Defender notification settings
- Modifies firewall policy service
- Modifies security service
- Event Triggered Execution: Image File Execution Options Injection
- Executes dropped EXE
- Windows security modification
- Modifies Security services
- Reads the TCP/IP host and domain name from the registry
- Modifies data under HKEY_USERS
- Modifies registry class
PID:4508 -
C:\Windows\system32\schtasks.exeschtasks.exe /Change /TN "\Microsoft\Windows\Windows Defender\Windows Defender Cache Maintenance" /DISABLE2⤵PID:5780
-
-
C:\Windows\system32\schtasks.exeschtasks.exe /Change /TN "\Microsoft\Windows\Windows Defender\Windows Defender Cleanup" /DISABLE2⤵PID:5636
-
-
C:\Windows\system32\schtasks.exeschtasks.exe /Change /TN "\Microsoft\Windows\Windows Defender\Windows Defender Scheduled Scan" /DISABLE2⤵PID:5416
-
-
C:\Windows\system32\schtasks.exeschtasks.exe /Change /TN "\Microsoft\Windows\Windows Defender\Windows Defender Verification" /DISABLE2⤵PID:1136
-
-
C:\Windows\system32\schtasks.exeschtasks.exe /Change /TN "\Microsoft\Windows\ExploitGuard\ExploitGuard MDM policy Refresh" /DISABLE2⤵PID:4660
-
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x4a0 0x4581⤵PID:5892
Network
MITRE ATT&CK Enterprise v16
Persistence
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Create or Modify System Process
6Windows Service
6Event Triggered Execution
1Image File Execution Options Injection
1Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Create or Modify System Process
6Windows Service
6Event Triggered Execution
1Image File Execution Options Injection
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
8Disable or Modify System Firewall
1Disable or Modify Tools
6Modify Registry
12Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\wallpaper_ncrypt.jpg
- Size 174KB
- SHA256 d301eb64ec3b61091a3e6ee997bf8d114f3e6c5eda46afd6a8d23ad78459ea82
- MD5 b3b323be74b228e9a547f37622af266b
- SHA1 35d656234e3de2f65c2a9c9b37f864eaa5e3104f
- SHA512 0a65b61cb4414921a1c2f69e69b3462b219c03c2a0b96a3b4f5e358be72c8f357423ace0f3c8cbe5b1b21e82e0c17cd1e98dfba923487dda8df0024ef454f191
- SSDEEP 3072:P/dxtnCBOYinwq34BHBcd/E63lUM629CeXqmUNkhpnaewa+ut6ZHgRxd49Sp:P1xtnr33Cr63lU329CeXKNkhpnaMFsgd
- TLSH T172045B1398049B82A17992E8FD170FAC1F592F0CE5D23AFF05235E8B3A617365D9E12D
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\Documents\Outlook Files\readme.txt
- Size 1KB
- SHA256 b8b6179f0ffae1a4feffbf0947be2895cb69d903ad5d43c308229b40125dee2b
- MD5 56682bcbe8a7ea8ea6aa48d986ef55ac
- SHA1 f6044ad8924722b8e58e592756af7e1d9628b517
- SHA512 fa20ce946fbfaae61589bd184254d7de7445cb756d9be66c829fffbcac6dcf2b0a2bb5e659843cd1fd043f4b8b7c134c53e836f44a6231c63a56233914726457
- TLSH T10111573E1592B0C63508B94F8864A509289770BBAAAB13C334CD680D3FE127CDB28319
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\Downloads\AssertTrace.m1v.aqd
- Size 405KB
- SHA256 775e9aeb273063d78eaade0620c7b32c79487c88541afc356cbc646c443c7331
- MD5 4a0503cea02f89cd68b8311c4d83096f
- SHA1 5655a53a4a1518b5f2b1b08c8754b1ac3570e41a
- SHA512 932fce50ebb0730a1f1db796988e7520ca1c95d0f070b275b5bbb5c91953ab47e27ec931a794b85a503c4e35ff2264cc6c9c1467417b7ac960e7c4ba97ff66d2
- SSDEEP 12288:LnzsOBDK+8aeO8zLMaQGSPdhBLsVwfIwJdgWIxkcu:LYOBDeRM5GSPdhBGWJr/cu
- TLSH T1F79423D665BF10C870CEFC8EF4A16BE7E6F0C319975694CEAA1A402E01E1900DF69DD6
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\Downloads\ExpandGroup.tif.aqd
- Size 1.1MB
- SHA256 cd3de0fd6046e0dd58d7225b3d329a473432c7141507d61497f92e6b6622862b
- MD5 b653e6c44b60ef7c8ca29d6cea43266d
- SHA1 88504dfd2f3218ff4dbb769a100ba379d8c5c36e
- SHA512 4f28f027236a697cbd681a269d748ddff7ef52c11772e7a8832cdf03776f7f527e6575a92ac660ef9598bc77658378ca1a881a2aa40e780e5cf165e8294ea1e1
- SSDEEP 24576:YCdRG92AGgJDeUleqgQOzY98MFOvZzhmOvngZGu3E:FKxVDeYeqgQ+7vZ1mQzOE
- TLSH T1C7353393BF1E8C44707E4A3CE57998912D2FA5CACB5FB192F150E515C9C821CEA8EF12
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\def_none.exe
- Size 280KB
- SHA256 897307c0487c3f7376eedf6b3f999559e0aa16855571f30aef4621583f7ff46e
- MD5 0497ba3a1c59ea1962f614e9acc8d57f
- SHA1 1e418cedaddfb827e4d04423aa64aefa0967f0e8
- SHA512 b09364147122589435e0c2e780f49aa16ab1991682ecb6270ca5b052fb4ebbff45cc1761b8a509080c1136c0d2b0eb014cb7ecf5df8de268b56665f9fd62a275
- SSDEEP 6144:lWRbN0Tc76mRE84jtv5Ewsg8jKM74mLvezQjjOQ7:lWRbNkcHQBEPg0KMFGQjN7
- TLSH T165544B25A7E805F9F67BC67CCDA25901EE72BC064B60E9DF039049561E33AD09E3D722
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\drivers\etc\hosts
- Size 24KB
- SHA256 d022c32633784ba9707b82d86a111fbcb5070dae9a724a94ab107bcd3bd109e8
- MD5 f9bde94b6b15e087a6e5b85762ac8c37
- SHA1 7672645dbdfe9777a7abe45dd0189deb0996ca53
- SHA512 3c54450ae74a0c5b7074727ca3c145d8ad6626a4fb39091b59c3034637c52466532cb44ee3812c09d792a9621d394fa24c9405e2764be7013181e59ed2a1e9a4
- SSDEEP 192:RrK9zBBfK0+TF1H/Q+sMt3mijYFCdSQiw3Lz/0kfd5b9rorz0n0eVtTCTJE/TJq/:RrK9a0SfNPhj33//f320n0eVtTCTJEV6
- TLSH T123B234664689C1FD56BAD055926EA36FE00FF2F308C3E9D90498C75E72701AD39C70AE
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\winlogon_fix.exe
- Size 12.7MB
- SHA256 362cd24fe4581945c26748cbc4aa3db9e1c68e69c5739cb8d65f51ec7ea4ec9a
- MD5 297f98e0585d1c0c025280c92b7e56dc
- SHA1 f6627fbd581ef9ad7c5d22f7bf8c0e22dd41cd40
- SHA512 5e9e7718f2533f614d90d7bd2d6ae6a58dfc01f2e042bc6ccad733c335a1240496d73cc83a7c617e893bb262e64b7eb9758973174ebf58abf4f8df6051d979d0
- SSDEEP 49152:DJhuYE4KPTw++1Zzzs6fOCuEMr/KsaYgNBeESXZO6i43dNhpeF08eI0/SMASBR0z:DJhuYlKL8JOCuEMrKsa1JuZ
- TLSH T1B7D6F93479EB185DB3A79A9E4BD9B5EE5D1EF363230B21B82070334B83129418DE5B35
- MD5 SHA1 SHA512 SSDEEP TLSH