Analysis
- max time kernel
150s - max time network
126s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
20/10/2026, 16:27
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
cat-cryptor-v1.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
34 signatures
150 seconds
Behavioral task
behavioral2
Sample
cat-cryptor-v1.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
37 signatures
150 seconds
General
- Target cat-cryptor-v1.exe
- Size 12.7MB
- Sample261020-tx31nastft
- SHA256 362cd24fe4581945c26748cbc4aa3db9e1c68e69c5739cb8d65f51ec7ea4ec9a
- MD5 297f98e0585d1c0c025280c92b7e56dc
- SHA1 f6627fbd581ef9ad7c5d22f7bf8c0e22dd41cd40
- SHA512 5e9e7718f2533f614d90d7bd2d6ae6a58dfc01f2e042bc6ccad733c335a1240496d73cc83a7c617e893bb262e64b7eb9758973174ebf58abf4f8df6051d979d0
- SSDEEP 49152:DJhuYE4KPTw++1Zzzs6fOCuEMr/KsaYgNBeESXZO6i43dNhpeF08eI0/SMASBR0z:DJhuYlKL8JOCuEMrKsa1JuZ
- TLSH T1B7D6F93479EB185DB3A79A9E4BD9B5EE5D1EF363230B21B82070334B83129418DE5B35
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Contains code to disable Windows Defender 1 IoCs
A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.
resource yara_rule behavioral2/memory/4644-1-0x0000000000D70000-0x0000000001A2A000-memory.dmp disable_win_def - Modifies WinLogon for persistence 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "\"C:\\Windows\\system32\\winlogon_fix.exe\"" cat-cryptor-v1.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\DisableAntiSpyware = "1" cat-cryptor-v1.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\DisableAntiSpyware = "1" def_none.exe - Modifies Windows Defender Real-time Protection settings 3 TTPs 18 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" cat-cryptor-v1.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" cat-cryptor-v1.exe Key created \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection def_none.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" def_none.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRawWriteNotification = "1" def_none.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" cat-cryptor-v1.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" def_none.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIntrusionPreventionSystem = "1" def_none.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\IOAVMaxSize = "1" def_none.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\RealTimeScanDirection = "1" def_none.exe Key created \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection cat-cryptor-v1.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" cat-cryptor-v1.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRawWriteNotification = "1" cat-cryptor-v1.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableInformationProtectionControl = "1" def_none.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" cat-cryptor-v1.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" def_none.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" def_none.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" def_none.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "4" def_none.exe - Modifies Windows Defender notification settings 3 TTPs 6 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender Security Center\Notifications def_none.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender Security Center\Notifications\DisableNotifications = "1" def_none.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender Security Center\Notifications def_none.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender Security Center\Notifications\DisableNotifications = "1" def_none.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender Security Center\Notifications\DisableEnhancedNotifications = "1" def_none.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender Security Center\Notifications\DisableEnhancedNotifications = "1" def_none.exe - Modifies firewall policy service 3 TTPs 8 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" def_none.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile def_none.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile\EnableFirewall = "0" def_none.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\PrivateProfile def_none.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\PrivateProfile\EnableFirewall = "0" def_none.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile def_none.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\EnableFirewall = "0" def_none.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile def_none.exe - Modifies security service 2 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\WinDefend\Start = "3" def_none.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wscsvc\Start = "4" def_none.exe - UAC bypass 3 TTPs 3 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" cat-cryptor-v1.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" cat-cryptor-v1.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" cat-cryptor-v1.exe - Modifies boot configuration data using bcdedit 1 TTPs 13 IoCs
pid Process 1500 bcdedit.exe 2456 bcdedit.exe 3364 bcdedit.exe 2000 bcdedit.exe 5328 bcdedit.exe 1420 bcdedit.exe 1780 bcdedit.exe 5792 bcdedit.exe 1012 bcdedit.exe 2804 bcdedit.exe 1572 bcdedit.exe 3412 bcdedit.exe 3084 bcdedit.exe - Renames multiple (71) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
- Disables RegEdit via registry modification 1 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" cat-cryptor-v1.exe - Disables one or more Microsoft Defender components 1 TTPs 1 IoCs
Uses the Powershell Set-MpPreference cmdlet to disable one or more Microsoft Defender components.
pid Process 1764 powershell.exe - Drops file in Drivers directory 2 IoCs
description ioc Process File opened for modification C:\Windows\System32\drivers\etc\hosts cat-cryptor-v1.exe File created C:\Windows\System32\drivers\etc\hosts.n4an_backup cat-cryptor-v1.exe - Event Triggered Execution: Image File Execution Options Injection 1 TTPs 64 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mmc.exe cat-cryptor-v1.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\compmgmt.msc cat-cryptor-v1.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\smartscreen.exe def_none.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regedit.exe cat-cryptor-v1.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\procmon.exe cat-cryptor-v1.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\eventvwr.msc\Debugger = "C:\\Users\\Admin\\AppData\\Local\\Temp\\wallpaper_ncrypt.jpg" cat-cryptor-v1.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MpDefenderCoreService.exe def_none.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\explorer.exe cat-cryptor-v1.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\procexp.exe\Debugger = "C:\\Users\\Admin\\AppData\\Local\\Temp\\wallpaper_ncrypt.jpg" cat-cryptor-v1.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\lusrmgr.msc cat-cryptor-v1.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\lusrmgr.msc\Debugger = "C:\\Users\\Admin\\AppData\\Local\\Temp\\wallpaper_ncrypt.jpg" cat-cryptor-v1.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\comexp.msc\Debugger = "C:\\Users\\Admin\\AppData\\Local\\Temp\\wallpaper_ncrypt.jpg" cat-cryptor-v1.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MpCmdRun.exe def_none.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regedit.exe\Debugger = "C:\\Users\\Admin\\AppData\\Local\\Temp\\wallpaper_ncrypt.jpg" cat-cryptor-v1.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\powershell.exe cat-cryptor-v1.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\diskmgmt.msc\Debugger = "C:\\Users\\Admin\\AppData\\Local\\Temp\\wallpaper_ncrypt.jpg" cat-cryptor-v1.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\fsmgmt.msc\Debugger = "C:\\Users\\Admin\\AppData\\Local\\Temp\\wallpaper_ncrypt.jpg" cat-cryptor-v1.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\azman.msc\Debugger = "C:\\Users\\Admin\\AppData\\Local\\Temp\\wallpaper_ncrypt.jpg" cat-cryptor-v1.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MpDlpService.exe def_none.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MpDlpCmd.exe def_none.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe cat-cryptor-v1.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\control.exe cat-cryptor-v1.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\services.msc\Debugger = "C:\\Users\\Admin\\AppData\\Local\\Temp\\wallpaper_ncrypt.jpg" cat-cryptor-v1.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\NisSrv.exe\Debugger = "%SYSTEMROOT%\\System32\\taskkill.exe" def_none.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SgrmLpac.exe\Debugger = "%SYSTEMROOT%\\System32\\taskkill.exe" def_none.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SecurityHealthService.exe\Debugger = "%SYSTEMROOT%\\System32\\taskkill.exe" def_none.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cmd.exe cat-cryptor-v1.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cmd.exe\Debugger = "C:\\Users\\Admin\\AppData\\Local\\Temp\\wallpaper_ncrypt.jpg" cat-cryptor-v1.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe\Debugger = "C:\\Users\\Admin\\AppData\\Local\\Temp\\wallpaper_ncrypt.jpg" cat-cryptor-v1.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msconfig.exe\Debugger = "C:\\Users\\Admin\\AppData\\Local\\Temp\\wallpaper_ncrypt.jpg" cat-cryptor-v1.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\eventvwr.msc cat-cryptor-v1.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\fsmgmt.msc cat-cryptor-v1.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\perfmon.msc cat-cryptor-v1.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rsop.msc cat-cryptor-v1.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\secpol.msc\Debugger = "C:\\Users\\Admin\\AppData\\Local\\Temp\\wallpaper_ncrypt.jpg" cat-cryptor-v1.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ntmsmgr.msc\Debugger = "C:\\Users\\Admin\\AppData\\Local\\Temp\\wallpaper_ncrypt.jpg" cat-cryptor-v1.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\dfrg.msc\Debugger = "C:\\Users\\Admin\\AppData\\Local\\Temp\\wallpaper_ncrypt.jpg" cat-cryptor-v1.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SgrmBroker.exe\Debugger = "%SYSTEMROOT%\\System32\\taskkill.exe" def_none.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SecurityHealthService.exe def_none.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SecurityHealthHost.exe\Debugger = "%SYSTEMROOT%\\System32\\taskkill.exe" def_none.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\procmon.exe\Debugger = "C:\\Users\\Admin\\AppData\\Local\\Temp\\wallpaper_ncrypt.jpg" cat-cryptor-v1.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\devmgmt.msc cat-cryptor-v1.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\perfmon.msc\Debugger = "C:\\Users\\Admin\\AppData\\Local\\Temp\\wallpaper_ncrypt.jpg" cat-cryptor-v1.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MsMpEng.exe\Debugger = "%SYSTEMROOT%\\System32\\taskkill.exe" def_none.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\powershell.exe\Debugger = "C:\\Users\\Admin\\AppData\\Local\\Temp\\wallpaper_ncrypt.jpg" cat-cryptor-v1.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msconfig.exe cat-cryptor-v1.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MpCmdRun.exe\Debugger = "%SYSTEMROOT%\\System32\\taskkill.exe" def_none.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MpCopyAccelerator.exe\Debugger = "%SYSTEMROOT%\\System32\\taskkill.exe" def_none.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\azman.msc cat-cryptor-v1.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SgrmLpac.exe def_none.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\explorer.exe\Debugger = "C:\\Users\\Admin\\AppData\\Local\\Temp\\wallpaper_ncrypt.jpg" cat-cryptor-v1.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\NisSrv.exe def_none.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MpDefenderCoreService.exe\Debugger = "%SYSTEMROOT%\\System32\\taskkill.exe" def_none.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MpCopyAccelerator.exe def_none.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\dfrg.msc cat-cryptor-v1.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\procexp.exe cat-cryptor-v1.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\secpol.msc cat-cryptor-v1.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskschd.msc\Debugger = "C:\\Users\\Admin\\AppData\\Local\\Temp\\wallpaper_ncrypt.jpg" cat-cryptor-v1.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regedt32.exe cat-cryptor-v1.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\gpedit.msc\Debugger = "C:\\Users\\Admin\\AppData\\Local\\Temp\\wallpaper_ncrypt.jpg" cat-cryptor-v1.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\devmgmt.msc\Debugger = "C:\\Users\\Admin\\AppData\\Local\\Temp\\wallpaper_ncrypt.jpg" cat-cryptor-v1.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\certmgr.msc cat-cryptor-v1.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\certmgr.msc\Debugger = "C:\\Users\\Admin\\AppData\\Local\\Temp\\wallpaper_ncrypt.jpg" cat-cryptor-v1.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SecurityHealthHost.exe def_none.exe - Executes dropped EXE 4 IoCs
pid Process 5956 023xwr2.exe 4316 def_none.exe 4168 def_none.exe 236 def_none.exe - Impair Defenses: Safe Mode Boot 1 TTPs 1 IoCs
description ioc Process Key deleted \REGISTRY\MACHINE\SYSTEM\CONTROLSET001\CONTROL\SAFEBOOT\MINIMAL\WINDEFEND def_none.exe - Windows security modification 2 TTPs 13 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\UX Configuration def_none.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\UX Configuration\DisablePrivacyMode = "1" def_none.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features def_none.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "4" def_none.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtectionSource = "2" def_none.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\MpEngine\MpCloudBlockLevel = "0" def_none.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\DisableAntiSpyware = "1" def_none.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Real-Time Protection def_none.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\MpEngine def_none.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\MpEngine\MpBafsExtendedTimeout = "50" def_none.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\ServiceStartStates = "0" def_none.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\IsServiceRunning = "0" def_none.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" def_none.exe - Adds Run key to start application 2 TTPs 5 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MSEdgeUpdateX = "\"C:\\Windows\\system32\\winlogon_fix.exe\"" cat-cryptor-v1.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\System3264Wow = "\"C:\\Windows\\system32\\winlogon_fix.exe\" --init" cat-cryptor-v1.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\OneDrive10293 = "\"C:\\Windows\\system32\\winlogon_fix.exe\" /setup" cat-cryptor-v1.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\WINDOWS = "\"C:\\Windows\\system32\\winlogon_fix.exe\" --wininit" cat-cryptor-v1.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WindowsInstaller = "\"C:\\Windows\\system32\\winlogon_fix.exe\" -startup" cat-cryptor-v1.exe - Checks whether UAC is enabled 1 TTPs 2 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA cat-cryptor-v1.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" cat-cryptor-v1.exe -
pid Process 1764 powershell.exe - Looks up external IP address via web service 1 TTPs 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 1 api.ipify.org 8 api.ipify.org - Modifies Security services 2 TTPs 1 IoCs
Modifies the startup behavior of a security service.
description ioc Process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SecurityHealthService\Start = "4" def_none.exe - Drops file in System32 directory 7 IoCs
description ioc Process File created C:\Windows\system32\def_none.exe cat-cryptor-v1.exe File opened for modification C:\Windows\system32\def_none.exe cat-cryptor-v1.exe File created C:\Windows\system32\winlogon_fix.exe cat-cryptor-v1.exe File opened for modification C:\Windows\system32\winlogon_fix.exe cat-cryptor-v1.exe File opened for modification C:\Windows\system32\config\reagent_backup.dat cat-cryptor-v1.exe File opened for modification C:\Windows\system32\Recovery\ReAgent.xml ReAgentc.exe File opened for modification C:\Windows\system32\Recovery ReAgentc.exe - Drops file in Windows directory 4 IoCs
description ioc Process File opened for modification C:\Windows\Panther\UnattendGC\diagerr.xml ReAgentc.exe File opened for modification C:\Windows\Panther\UnattendGC\diagwrn.xml ReAgentc.exe File opened for modification C:\Windows\Logs\ReAgent\ReAgent.log ReAgentc.exe File opened for modification C:\Windows\Panther\UnattendGC\setuperr.log ReAgentc.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 1 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 1600 cmd.exe - Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain def_none.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname cat-cryptor-v1.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain cat-cryptor-v1.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname def_none.exe - Kills process with taskkill 1 IoCs
pid Process 4980 taskkill.exe - Modifies data under HKEY_USERS 51 IoCs
description ioc Process Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\8 = "ConfigSecurityPolicy.exe" def_none.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\Software def_none.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion def_none.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage def_none.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe def_none.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion def_none.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Policies def_none.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\9 = "smartscreen.exe" def_none.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\11 = "SgrmBroker.exe" def_none.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE def_none.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\Software\Microsoft def_none.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\PhishingFilter\PreventOverride = "0" def_none.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Notifications\Settings def_none.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\AppHost def_none.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\AppHost\EnableWebContentEvaluation = "0" def_none.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows Script\Settings\AmsiEnable = "0" def_none.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun def_none.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Notifications def_none.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Notifications\Settings\Windows.Defender def_none.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Notifications\Settings\Windows.Defender\Enabled = "0" def_none.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\AppHost\PreventOverride = "0" def_none.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows def_none.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\3 = "NisSrv.exe" def_none.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\6 = "MpDlpService.exe" def_none.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\7 = "MpDlpCmd.exe" def_none.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\12 = "SecurityHealthService.exe" def_none.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Notifications\Settings\Windows.SystemToast.SecurityAndMaintenance def_none.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Notifications\Settings\Windows.SystemToast.SecurityCenter\Enabled = "0" def_none.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows Script def_none.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun = "1" def_none.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\1 = "MsMpEng.exe" def_none.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\10 = "SgrmLpac.exe" def_none.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes def_none.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\PhishingFilter def_none.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Notifications\Settings\Windows.SystemToast.SecurityAndMaintenance\Enabled = "0" def_none.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Notifications\Settings\Windows.SystemToast.SecurityCenter def_none.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\5 = "MpCopyAccelerator.exe" def_none.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Notifications\Settings\Windows.SystemToast.SecurityAndMaintenance def_none.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer def_none.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\13 = "SecurityHealthHost.exe" def_none.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\PhishingFilter def_none.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings def_none.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\Software\Microsoft\Windows def_none.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer def_none.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge def_none.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\PhishingFilter\EnabledV9 = "0" def_none.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows Script\Settings def_none.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\4 = "MpDefenderCoreService.exe" def_none.exe Key created \REGISTRY\USER\.DEFAULT\Software def_none.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft def_none.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\2 = "MpCmdRun.exe" def_none.exe - Modifies registry class 4 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Drive\shellex\ContextMenuHandlers\EPP def_none.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Drive\shellex\ContextMenuHandlers\EPP\ def_none.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Directory\shellex\ContextMenuHandlers\EPP def_none.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Directory\shellex\ContextMenuHandlers\EPP\ def_none.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4644 cat-cryptor-v1.exe 4644 cat-cryptor-v1.exe 4644 cat-cryptor-v1.exe 4644 cat-cryptor-v1.exe 4644 cat-cryptor-v1.exe 4644 cat-cryptor-v1.exe 4644 cat-cryptor-v1.exe 4644 cat-cryptor-v1.exe 4644 cat-cryptor-v1.exe 4644 cat-cryptor-v1.exe 4644 cat-cryptor-v1.exe 4644 cat-cryptor-v1.exe 4644 cat-cryptor-v1.exe 4644 cat-cryptor-v1.exe 4644 cat-cryptor-v1.exe 4644 cat-cryptor-v1.exe 4644 cat-cryptor-v1.exe 4644 cat-cryptor-v1.exe 4644 cat-cryptor-v1.exe 4644 cat-cryptor-v1.exe 4644 cat-cryptor-v1.exe 4644 cat-cryptor-v1.exe 4644 cat-cryptor-v1.exe 4644 cat-cryptor-v1.exe 4644 cat-cryptor-v1.exe 4644 cat-cryptor-v1.exe 4644 cat-cryptor-v1.exe 4644 cat-cryptor-v1.exe 4644 cat-cryptor-v1.exe 4644 cat-cryptor-v1.exe 4644 cat-cryptor-v1.exe 4644 cat-cryptor-v1.exe 4644 cat-cryptor-v1.exe 4644 cat-cryptor-v1.exe 4644 cat-cryptor-v1.exe 4644 cat-cryptor-v1.exe 4644 cat-cryptor-v1.exe 4644 cat-cryptor-v1.exe 4644 cat-cryptor-v1.exe 4644 cat-cryptor-v1.exe 4644 cat-cryptor-v1.exe 4644 cat-cryptor-v1.exe 4644 cat-cryptor-v1.exe 4644 cat-cryptor-v1.exe 4644 cat-cryptor-v1.exe 4644 cat-cryptor-v1.exe 4644 cat-cryptor-v1.exe 4644 cat-cryptor-v1.exe 4644 cat-cryptor-v1.exe 4644 cat-cryptor-v1.exe 4644 cat-cryptor-v1.exe 4644 cat-cryptor-v1.exe 4644 cat-cryptor-v1.exe 4644 cat-cryptor-v1.exe 4644 cat-cryptor-v1.exe 4644 cat-cryptor-v1.exe 4644 cat-cryptor-v1.exe 4644 cat-cryptor-v1.exe 4644 cat-cryptor-v1.exe 4644 cat-cryptor-v1.exe 4644 cat-cryptor-v1.exe 4644 cat-cryptor-v1.exe 4644 cat-cryptor-v1.exe 4644 cat-cryptor-v1.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 4644 cat-cryptor-v1.exe Token: SeDebugPrivilege 5956 023xwr2.exe Token: SeImpersonatePrivilege 5956 023xwr2.exe Token: SeDebugPrivilege 1764 powershell.exe Token: SeDebugPrivilege 236 def_none.exe Token: SeImpersonatePrivilege 236 def_none.exe Token: SeIncreaseQuotaPrivilege 1764 powershell.exe Token: SeSecurityPrivilege 1764 powershell.exe Token: SeTakeOwnershipPrivilege 1764 powershell.exe Token: SeLoadDriverPrivilege 1764 powershell.exe Token: SeSystemProfilePrivilege 1764 powershell.exe Token: SeSystemtimePrivilege 1764 powershell.exe Token: SeProfSingleProcessPrivilege 1764 powershell.exe Token: SeIncBasePriorityPrivilege 1764 powershell.exe Token: SeCreatePagefilePrivilege 1764 powershell.exe Token: SeBackupPrivilege 1764 powershell.exe Token: SeRestorePrivilege 1764 powershell.exe Token: SeShutdownPrivilege 1764 powershell.exe Token: SeDebugPrivilege 1764 powershell.exe Token: SeSystemEnvironmentPrivilege 1764 powershell.exe Token: SeRemoteShutdownPrivilege 1764 powershell.exe Token: SeUndockPrivilege 1764 powershell.exe Token: SeManageVolumePrivilege 1764 powershell.exe Token: 33 1764 powershell.exe Token: 34 1764 powershell.exe Token: 35 1764 powershell.exe Token: 36 1764 powershell.exe Token: SeTakeOwnershipPrivilege 4168 def_none.exe Token: SeRestorePrivilege 4168 def_none.exe Token: SeBackupPrivilege 4168 def_none.exe Token: SeTakeOwnershipPrivilege 4168 def_none.exe Token: SeRestorePrivilege 4168 def_none.exe Token: SeBackupPrivilege 4168 def_none.exe Token: SeTakeOwnershipPrivilege 4168 def_none.exe Token: SeRestorePrivilege 4168 def_none.exe Token: SeBackupPrivilege 4168 def_none.exe Token: SeTakeOwnershipPrivilege 4168 def_none.exe Token: SeRestorePrivilege 4168 def_none.exe Token: SeBackupPrivilege 4168 def_none.exe Token: SeTakeOwnershipPrivilege 4168 def_none.exe Token: SeRestorePrivilege 4168 def_none.exe Token: SeBackupPrivilege 4168 def_none.exe Token: SeDebugPrivilege 4980 taskkill.exe Token: SeSystemEnvironmentPrivilege 4536 svchost.exe Token: SeTakeOwnershipPrivilege 4168 def_none.exe Token: SeRestorePrivilege 4168 def_none.exe Token: SeBackupPrivilege 4168 def_none.exe Token: SeTakeOwnershipPrivilege 4168 def_none.exe Token: SeRestorePrivilege 4168 def_none.exe Token: SeBackupPrivilege 4168 def_none.exe Token: SeTakeOwnershipPrivilege 4168 def_none.exe Token: SeRestorePrivilege 4168 def_none.exe Token: SeBackupPrivilege 4168 def_none.exe Token: SeTakeOwnershipPrivilege 4168 def_none.exe Token: SeRestorePrivilege 4168 def_none.exe Token: SeBackupPrivilege 4168 def_none.exe Token: SeTakeOwnershipPrivilege 4168 def_none.exe Token: SeRestorePrivilege 4168 def_none.exe Token: SeBackupPrivilege 4168 def_none.exe Token: SeTakeOwnershipPrivilege 4168 def_none.exe Token: SeRestorePrivilege 4168 def_none.exe Token: SeBackupPrivilege 4168 def_none.exe Token: SeTakeOwnershipPrivilege 4168 def_none.exe Token: SeRestorePrivilege 4168 def_none.exe - Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 4644 cat-cryptor-v1.exe - Suspicious use of WriteProcessMemory 24 IoCs
description pid Process procid_target PID 4644 wrote to memory of 5956 4644 cat-cryptor-v1.exe 89 PID 4644 wrote to memory of 4316 4644 cat-cryptor-v1.exe 91 PID 4644 wrote to memory of 1764 4644 cat-cryptor-v1.exe 92 PID 236 wrote to memory of 1600 236 def_none.exe 100 PID 4644 wrote to memory of 4980 4644 cat-cryptor-v1.exe 101 PID 4644 wrote to memory of 4340 4644 cat-cryptor-v1.exe 102 PID 4644 wrote to memory of 3084 4644 cat-cryptor-v1.exe 104 PID 4644 wrote to memory of 3412 4644 cat-cryptor-v1.exe 105 PID 4644 wrote to memory of 1572 4644 cat-cryptor-v1.exe 106 PID 4644 wrote to memory of 2804 4644 cat-cryptor-v1.exe 107 PID 4644 wrote to memory of 1012 4644 cat-cryptor-v1.exe 108 PID 4644 wrote to memory of 5792 4644 cat-cryptor-v1.exe 109 PID 4644 wrote to memory of 1780 4644 cat-cryptor-v1.exe 110 PID 4644 wrote to memory of 1420 4644 cat-cryptor-v1.exe 111 PID 4644 wrote to memory of 5328 4644 cat-cryptor-v1.exe 112 PID 4644 wrote to memory of 2000 4644 cat-cryptor-v1.exe 113 PID 4644 wrote to memory of 3364 4644 cat-cryptor-v1.exe 114 PID 4644 wrote to memory of 2456 4644 cat-cryptor-v1.exe 115 PID 4644 wrote to memory of 1500 4644 cat-cryptor-v1.exe 116 PID 4168 wrote to memory of 2736 4168 def_none.exe 131 PID 4168 wrote to memory of 5980 4168 def_none.exe 133 PID 4168 wrote to memory of 2732 4168 def_none.exe 135 PID 4168 wrote to memory of 3504 4168 def_none.exe 137 PID 4168 wrote to memory of 3192 4168 def_none.exe 139 - System policy modification 1 TTPs 21 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ShutdownWithoutLogon = "0" cat-cryptor-v1.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\HideFastUserSwitching = "1" cat-cryptor-v1.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableLockWorkstation = "1" cat-cryptor-v1.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" cat-cryptor-v1.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" cat-cryptor-v1.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableChangePassword = "1" cat-cryptor-v1.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\NoChangePassword = "1" cat-cryptor-v1.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoShutDown = "1" cat-cryptor-v1.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\NoLogoff = "1" cat-cryptor-v1.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoControlPanel = "1" cat-cryptor-v1.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" cat-cryptor-v1.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoViewContextMenu = "1" cat-cryptor-v1.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoDevMgrUpdate = "1" cat-cryptor-v1.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoMsConfig = "1" cat-cryptor-v1.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoRestart = "1" cat-cryptor-v1.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\NoClose = "1" cat-cryptor-v1.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableCAD = "1" cat-cryptor-v1.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableTaskMgr = "1" cat-cryptor-v1.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoClose = "1" cat-cryptor-v1.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoLogoff = "1" cat-cryptor-v1.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" cat-cryptor-v1.exe - Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\cat-cryptor-v1.exe"C:\Users\Admin\AppData\Local\Temp\cat-cryptor-v1.exe"1⤵
- Modifies WinLogon for persistence
- Modifies Windows Defender DisableAntiSpyware settings
- Modifies Windows Defender Real-time Protection settings
- UAC bypass
- Disables RegEdit via registry modification
- Drops file in Drivers directory
- Event Triggered Execution: Image File Execution Options Injection
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops file in System32 directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
PID:4644 -
C:\Users\Admin\AppData\Local\Temp\023xwr2.exe"C:\Users\Admin\AppData\Local\Temp\023xwr2.exe" -kill -paralyze "SecurityHealthService.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5956
-
-
C:\Windows\system32\def_none.exe"C:\Windows\system32\def_none.exe"2⤵
- Executes dropped EXE
PID:4316
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" -Command "Set-MpPreference -DisableRealtimeMonitoring $true"2⤵
- Disables one or more Microsoft Defender components
- Command and Scripting Interpreter: PowerShell
- Suspicious use of AdjustPrivilegeToken
PID:1764
-
-
C:\Windows\SYSTEM32\taskkill.exetaskkill.exe /im Explorer.exe /f2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4980
-
-
C:\Windows\System32\ReAgentc.exe"C:\Windows\System32\ReAgentc.exe" /disable2⤵
- Drops file in System32 directory
- Drops file in Windows directory
PID:4340
-
-
C:\Windows\System32\bcdedit.exe"C:\Windows\System32\bcdedit.exe" /set {default} recoveryenabled No2⤵
- Modifies boot configuration data using bcdedit
PID:3084
-
-
C:\Windows\System32\bcdedit.exe"C:\Windows\System32\bcdedit.exe" /set {default} bootstatuspolicy ignoreallfailures2⤵
- Modifies boot configuration data using bcdedit
PID:3412
-
-
C:\Windows\System32\bcdedit.exe"C:\Windows\System32\bcdedit.exe" /set {current} recoveryenabled false2⤵
- Modifies boot configuration data using bcdedit
PID:1572
-
-
C:\Windows\System32\bcdedit.exe"C:\Windows\System32\bcdedit.exe" /set {current} optionsedit false2⤵
- Modifies boot configuration data using bcdedit
PID:2804
-
-
C:\Windows\System32\bcdedit.exe"C:\Windows\System32\bcdedit.exe" /set {current} advancedoptions false2⤵
- Modifies boot configuration data using bcdedit
PID:1012
-
-
C:\Windows\System32\bcdedit.exe"C:\Windows\System32\bcdedit.exe" /set {current} bootmenupolicy legacy2⤵
- Modifies boot configuration data using bcdedit
PID:5792
-
-
C:\Windows\System32\bcdedit.exe"C:\Windows\System32\bcdedit.exe" /set {bootmgr} bootsequence {current}2⤵
- Modifies boot configuration data using bcdedit
PID:1780
-
-
C:\Windows\System32\bcdedit.exe"C:\Windows\System32\bcdedit.exe" /set {bootmgr} timeout 02⤵
- Modifies boot configuration data using bcdedit
PID:1420
-
-
C:\Windows\System32\bcdedit.exe"C:\Windows\System32\bcdedit.exe" /set {bootmgr} displaybootmenu no2⤵
- Modifies boot configuration data using bcdedit
PID:5328
-
-
C:\Windows\System32\bcdedit.exe"C:\Windows\System32\bcdedit.exe" /set {bootmgr} displayorder {default} /addfirst2⤵
- Modifies boot configuration data using bcdedit
PID:2000
-
-
C:\Windows\System32\bcdedit.exe"C:\Windows\System32\bcdedit.exe" /set {fwbootmgr} displayorder {bootmgr} /addfirst2⤵
- Modifies boot configuration data using bcdedit
PID:3364
-
-
C:\Windows\System32\bcdedit.exe"C:\Windows\System32\bcdedit.exe" /set {current} safeboot No2⤵
- Modifies boot configuration data using bcdedit
PID:2456
-
-
C:\Windows\System32\bcdedit.exe"C:\Windows\System32\bcdedit.exe" /set {bootmgr} removeoptions2⤵
- Modifies boot configuration data using bcdedit
PID:1500
-
-
C:\Windows\system32\def_none.exe"C:\Windows\system32\def_none.exe" -s -worker -tilog1⤵
- Modifies Windows Defender DisableAntiSpyware settings
- Modifies Windows Defender Real-time Protection settings
- Modifies Windows Defender TamperProtection settings
- Modifies Windows Defender notification settings
- Modifies firewall policy service
- Modifies security service
- Event Triggered Execution: Image File Execution Options Injection
- Executes dropped EXE
- Impair Defenses: Safe Mode Boot
- Windows security modification
- Modifies Security services
- Reads the TCP/IP host and domain name from the registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4168 -
C:\Windows\system32\schtasks.exeschtasks.exe /Change /TN "\Microsoft\Windows\Windows Defender\Windows Defender Cache Maintenance" /DISABLE2⤵PID:2736
-
-
C:\Windows\system32\schtasks.exeschtasks.exe /Change /TN "\Microsoft\Windows\Windows Defender\Windows Defender Cleanup" /DISABLE2⤵PID:5980
-
-
C:\Windows\system32\schtasks.exeschtasks.exe /Change /TN "\Microsoft\Windows\Windows Defender\Windows Defender Scheduled Scan" /DISABLE2⤵PID:2732
-
-
C:\Windows\system32\schtasks.exeschtasks.exe /Change /TN "\Microsoft\Windows\Windows Defender\Windows Defender Verification" /DISABLE2⤵PID:3504
-
-
C:\Windows\system32\schtasks.exeschtasks.exe /Change /TN "\Microsoft\Windows\ExploitGuard\ExploitGuard MDM policy Refresh" /DISABLE2⤵PID:3192
-
-
C:\Windows\system32\def_none.exeC:\Windows\system32\def_none.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:236 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c pause2⤵
- Executes a command shell one-liner
PID:1600
-
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k netsvcs -p -s BDESVC1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4536
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x00000000000004BC 0x00000000000004C81⤵PID:2396
Network
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
2PowerShell
1Windows Command Shell
1Persistence
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Create or Modify System Process
6Windows Service
6Event Triggered Execution
1Image File Execution Options Injection
1Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Create or Modify System Process
6Windows Service
6Event Triggered Execution
1Image File Execution Options Injection
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
10Disable or Modify System Firewall
1Disable or Modify Tools
7Safe Mode Boot
1Modify Registry
12Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\023xwr2.exe
- Size 352KB
- SHA256 e23cfbd6b2c598758a2b5b20359c8d5b5cf2212f57ee0a95f5aac55bd7cf9f2e
- MD5 28951cb8572003e3b55c81e3c083684e
- SHA1 13767769dd14a3d0e0e676ed6afc670b4e20c1da
- SHA512 db16ca609a39ff27be2bed0f60ca60203fd7c67e2ed2ba8954a0d30e26c0b43ecf9fff18bcc2c644938ba9ba087158a53f5d27736f23d7c68210516c7e08b9ec
- SSDEEP 6144:9FjaS5rOS0ZAAeyB6JaZcmJg2R027gqqjA:3j/7AewGaJJg2RY
- TLSH T1FE749E18E3A611F9E5B7C57CCD934506EB727C524B71DAEF03A0899A2F236908E3D721
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_h0c5io3j.zav.psm1
- Size 60B
- SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
- MD5 d17fe0a3f47be24a6453e9ef58c94641
- SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
- SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
- TLSH T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\wallpaper_ncrypt.jpg
- Size 285KB
- SHA256 3b6bf14a07555e31366473efe5f5b55a706deaf16db7aa8bbad487193965d129
- MD5 024f8028630f48beeabcdf8d1e4f97ce
- SHA1 91ef1dcf52305d4d0ff5553e1b804730a6557e04
- SHA512 48e7da7e965655b0ee0a2bf11a9ddb8a474b1b224ad450ad78e6887ada0e12f2c9a022b2ba57b41da0b1d1f2c9af906740df82702846f81e08da1b2d49000189
- SSDEEP 6144:eXghfyl2LEYYfOC2yQaru8nTypbKPnqU3v56hIk1+VfsDKi3GmnVEBR:Sghql2wNh2C68uY7/50Ik4e9SR
- TLSH T1345413634D2A00B2B83E0760FEEB7E887AE4AE9E555D23EF01D43DDD7B414974A46234
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\Downloads\ExpandUnpublish.3gp.aqd
- Size 710KB
- SHA256 afa5666c60f4c3415746ad1dfdc824308cb81986957aa7185aa0714b9bb2d12f
- MD5 8c527a5c0793850210bcbb0540bc4d60
- SHA1 bdded33533e0f4b99dc822318c1e0e51f619d023
- SHA512 ad68f212c049ba67af981fe38c410e3cf20e0cd5670f201388592ec4be8968c1346f1c7bfae9b9a8428395d66f06534acba20609ca4f212e29a4779d6b30a1c9
- SSDEEP 12288:hyIOdyJEmBIG7HGvLgQWeigEy1gHnsCPGsxClbpFQFy2t2B5SAhx2tRnHueHwXZb:hyIOsEvnsQug1QsCPGsxClbpn2tkyfne
- TLSH T1FEF423884D2BC1FEDB72DF51BF96B1E1AC429EBE3271500A45414C6BD0E1AB983FC568
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\Downloads\GroupMeasure.xltx
- Size 651KB
- SHA256 24f2edef4d86d0f27f5f9ebdb39b98b4d26e8b2c2f5a85da4290a4a31f0eff37
- MD5 2ebded916f69eaec54eca0c262b7ae27
- SHA1 ff881031f035143e4fba3715dc80d04b32f427df
- SHA512 20223fc9d3ed07bc68aa263ff2ddbc79d46f3c135d593d4d89cb6911a0efaf246ab58d604689cfd7c48e15a233637cff17f94953bd61f792ac39cba32601fc44
- SSDEEP 12288:osexjOeaeO3IShuTeTC3x25GvhNbccG3iWxBgFyz66fWbNAsrfG:osuO9eO3ISUiTC3x2cnbch1x1hWRM
- TLSH T15EE423647561AC386575C75428DBA7CB92F139C3AD4281C8E2FCE9090F6BAFC9D304B9
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\Downloads\readme.txt
- Size 1KB
- SHA256 b8b6179f0ffae1a4feffbf0947be2895cb69d903ad5d43c308229b40125dee2b
- MD5 56682bcbe8a7ea8ea6aa48d986ef55ac
- SHA1 f6044ad8924722b8e58e592756af7e1d9628b517
- SHA512 fa20ce946fbfaae61589bd184254d7de7445cb756d9be66c829fffbcac6dcf2b0a2bb5e659843cd1fd043f4b8b7c134c53e836f44a6231c63a56233914726457
- TLSH T10111573E1592B0C63508B94F8864A509289770BBAAAB13C334CD680D3FE127CDB28319
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\System32\def_none.exe
- Size 280KB
- SHA256 897307c0487c3f7376eedf6b3f999559e0aa16855571f30aef4621583f7ff46e
- MD5 0497ba3a1c59ea1962f614e9acc8d57f
- SHA1 1e418cedaddfb827e4d04423aa64aefa0967f0e8
- SHA512 b09364147122589435e0c2e780f49aa16ab1991682ecb6270ca5b052fb4ebbff45cc1761b8a509080c1136c0d2b0eb014cb7ecf5df8de268b56665f9fd62a275
- SSDEEP 6144:lWRbN0Tc76mRE84jtv5Ewsg8jKM74mLvezQjjOQ7:lWRbNkcHQBEPg0KMFGQjN7
- TLSH T165544B25A7E805F9F67BC67CCDA25901EE72BC064B60E9DF039049561E33AD09E3D722
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\drivers\etc\hosts
- Size 24KB
- SHA256 0baccbd2a842b900894d48f3c0e53079fc9752408018b604a03346a5af0f77f6
- MD5 d6630e7d03c3b97ba879430b4a9c5186
- SHA1 0e755cf402dd6d4e8f07be3a39a497710b9e49d3
- SHA512 76da1b2929aeaa4e133ed5e73ce21272f0671af07400db81235a86e945b7d527c9dad57c77c5975aefa1f630f9a028e4ea9761db6b82a495a7670de528edf3b5
- SSDEEP 192:RrK9zBzfK0+TF1H/Q+sMt3mijYFCdSQiw3Lz/0kfd5b9rorz0n0eVtTCTJE/TJq/:RrK9Y0SfNPhj33//f320n0eVtTCTJEV6
- TLSH T1AEB234664689C1FD56BAD055926EA36FE00FF2F308C3E9D90498C75E72701AD39C70AE
- MD5 SHA1 SHA512 SSDEEP TLSH