2cf44b30026d86372f690373d99012b3d63f63ca76bc86020d50679520b2fc5d

Peripheral Device Discovery

System Information Discovery

description	ioc	Process
File opened (read-only)	\??\D:	DevManView.exe

Maps connected drives based on registry 3 TTPs 2 IoCs

Disk information is often read in order to detect sandboxing environments.

Query Registry

Peripheral Device Discovery

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum	DevManView.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0	DevManView.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 4 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

Peripheral Device Discovery

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_Dell&Prod_THINAIR_DISK	DevManView.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	DevManView.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	DevManView.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	DevManView.exe

Kills process with taskkill 3 IoCs

evasion

pid	Process
1208	taskkill.exe
1588	taskkill.exe
1936	taskkill.exe

Runs ping.exe 1 TTPs 14 IoCs

Remote System Discovery

T1018

pid	Process
1572	PING.EXE
1124	PING.EXE
880	PING.EXE
1472	PING.EXE
1220	PING.EXE
300	PING.EXE
856	PING.EXE
1836	PING.EXE
1748	PING.EXE
592	PING.EXE
916	PING.EXE
1224	PING.EXE
1748	PING.EXE
1432	PING.EXE

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
560	DevManView.exe

Suspicious use of AdjustPrivilegeToken 23 IoCs

description	pid	Process
Token: SeBackupPrivilege	560	DevManView.exe
Token: SeRestorePrivilege	560	DevManView.exe
Token: SeTakeOwnershipPrivilege	560	DevManView.exe
Token: SeImpersonatePrivilege	560	DevManView.exe
Token: SeLoadDriverPrivilege	560	DevManView.exe
Token: SeLoadDriverPrivilege	560	DevManView.exe
Token: SeLoadDriverPrivilege	560	DevManView.exe
Token: SeLoadDriverPrivilege	560	DevManView.exe
Token: SeLoadDriverPrivilege	560	DevManView.exe
Token: SeLoadDriverPrivilege	560	DevManView.exe
Token: SeLoadDriverPrivilege	560	DevManView.exe
Token: SeLoadDriverPrivilege	560	DevManView.exe
Token: SeLoadDriverPrivilege	560	DevManView.exe
Token: SeLoadDriverPrivilege	560	DevManView.exe
Token: SeLoadDriverPrivilege	560	DevManView.exe
Token: SeLoadDriverPrivilege	560	DevManView.exe
Token: SeLoadDriverPrivilege	560	DevManView.exe
Token: SeLoadDriverPrivilege	560	DevManView.exe
Token: SeLoadDriverPrivilege	560	DevManView.exe
Token: SeLoadDriverPrivilege	560	DevManView.exe
Token: SeDebugPrivilege	1208	taskkill.exe
Token: SeDebugPrivilege	1588	taskkill.exe
Token: SeDebugPrivilege	1936	taskkill.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 288 wrote to memory of 1492	288	SPOOFER.exe	29
PID 288 wrote to memory of 1492	288	SPOOFER.exe	29
PID 288 wrote to memory of 1492	288	SPOOFER.exe	29
PID 1492 wrote to memory of 784	1492	cmd.exe	30
PID 1492 wrote to memory of 784	1492	cmd.exe	30
PID 1492 wrote to memory of 784	1492	cmd.exe	30
PID 1492 wrote to memory of 1572	1492	cmd.exe	31
PID 1492 wrote to memory of 1572	1492	cmd.exe	31
PID 1492 wrote to memory of 1572	1492	cmd.exe	31
PID 784 wrote to memory of 1376	784	FIXusrTEMPv6.exe	32
PID 784 wrote to memory of 1376	784	FIXusrTEMPv6.exe	32
PID 784 wrote to memory of 1376	784	FIXusrTEMPv6.exe	32
PID 1376 wrote to memory of 1124	1376	cmd.exe	33
PID 1376 wrote to memory of 1124	1376	cmd.exe	33
PID 1376 wrote to memory of 1124	1376	cmd.exe	33
PID 1376 wrote to memory of 1748	1376	cmd.exe	34
PID 1376 wrote to memory of 1748	1376	cmd.exe	34
PID 1376 wrote to memory of 1748	1376	cmd.exe	34
PID 1376 wrote to memory of 1224	1376	cmd.exe	35
PID 1376 wrote to memory of 1224	1376	cmd.exe	35
PID 1376 wrote to memory of 1224	1376	cmd.exe	35
PID 1376 wrote to memory of 1220	1376	cmd.exe	36
PID 1376 wrote to memory of 1220	1376	cmd.exe	36
PID 1376 wrote to memory of 1220	1376	cmd.exe	36
PID 1492 wrote to memory of 300	1492	cmd.exe	37
PID 1492 wrote to memory of 300	1492	cmd.exe	37
PID 1492 wrote to memory of 300	1492	cmd.exe	37
PID 1492 wrote to memory of 560	1492	cmd.exe	38
PID 1492 wrote to memory of 560	1492	cmd.exe	38
PID 1492 wrote to memory of 560	1492	cmd.exe	38
PID 1492 wrote to memory of 592	1492	cmd.exe	39
PID 1492 wrote to memory of 592	1492	cmd.exe	39
PID 1492 wrote to memory of 592	1492	cmd.exe	39
PID 1492 wrote to memory of 1208	1492	cmd.exe	41
PID 1492 wrote to memory of 1208	1492	cmd.exe	41
PID 1492 wrote to memory of 1208	1492	cmd.exe	41
PID 1492 wrote to memory of 1588	1492	cmd.exe	43
PID 1492 wrote to memory of 1588	1492	cmd.exe	43
PID 1492 wrote to memory of 1588	1492	cmd.exe	43
PID 1492 wrote to memory of 1936	1492	cmd.exe	44
PID 1492 wrote to memory of 1936	1492	cmd.exe	44
PID 1492 wrote to memory of 1936	1492	cmd.exe	44
PID 1492 wrote to memory of 880	1492	cmd.exe	45
PID 1492 wrote to memory of 880	1492	cmd.exe	45
PID 1492 wrote to memory of 880	1492	cmd.exe	45
PID 1492 wrote to memory of 856	1492	cmd.exe	46
PID 1492 wrote to memory of 856	1492	cmd.exe	46
PID 1492 wrote to memory of 856	1492	cmd.exe	46
PID 1492 wrote to memory of 1244	1492	cmd.exe	47
PID 1492 wrote to memory of 1244	1492	cmd.exe	47
PID 1492 wrote to memory of 1244	1492	cmd.exe	47
PID 1492 wrote to memory of 1076	1492	cmd.exe	48
PID 1492 wrote to memory of 1076	1492	cmd.exe	48
PID 1492 wrote to memory of 1076	1492	cmd.exe	48
PID 1492 wrote to memory of 1748	1492	cmd.exe	49
PID 1492 wrote to memory of 1748	1492	cmd.exe	49
PID 1492 wrote to memory of 1748	1492	cmd.exe	49
PID 1076 wrote to memory of 1040	1076	FIXusrTEMPv6.exe	50
PID 1076 wrote to memory of 1040	1076	FIXusrTEMPv6.exe	50
PID 1076 wrote to memory of 1040	1076	FIXusrTEMPv6.exe	50
PID 1040 wrote to memory of 1472	1040	cmd.exe	51
PID 1040 wrote to memory of 1472	1040	cmd.exe	51
PID 1040 wrote to memory of 1472	1040	cmd.exe	51
PID 1040 wrote to memory of 1432	1040	cmd.exe	52

C:\Users\Admin\AppData\Local\Temp\SPOOFER.exe
"C:\Users\Admin\AppData\Local\Temp\SPOOFER.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:288
- C:\Windows\system32\cmd.exe
  "C:\Windows\system32\cmd" /c "C:\Users\Admin\AppData\Local\Temp\FF56.tmp\FF57.tmp\FF58.bat C:\Users\Admin\AppData\Local\Temp\SPOOFER.exe"
  2⤵
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:1492
- - C:\Users\Admin\AppData\Roaming\FIXusrTEMPv6.exe
    "C:\Users\Admin\AppData\Roaming\FIXusrTEMPv6.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:784
  - - C:\Windows\system32\cmd.exe
      "C:\Windows\system32\cmd" /c "C:\Users\Admin\AppData\Local\Temp\1881.tmp\1882.tmp\1883.bat C:\Users\Admin\AppData\Roaming\FIXusrTEMPv6.exe"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:1376
    - - C:\Windows\system32\PING.EXE
        
        ping /n 1 localhost
        5⤵
        Runs ping.exe
        
        PID:1124
    - - C:\Windows\system32\PING.EXE
        
        ping /n 1 localhost
        5⤵
        Runs ping.exe
        
        PID:1748
    - - C:\Windows\system32\PING.EXE
        
        ping /n 1 localhost
        5⤵
        Runs ping.exe
        
        PID:1224
    - - C:\Windows\system32\PING.EXE
        
        ping /n 2 localhost
        5⤵
        Runs ping.exe
        
        PID:1220
- - C:\Windows\system32\PING.EXE
    PING localhost -n 3
    3⤵
    - Runs ping.exe
    PID:1572
- - C:\Windows\system32\PING.EXE
    PING localhost -n 3
    3⤵
    - Runs ping.exe
    PID:300
- - C:\Users\Admin\AppData\Roaming\DevManView.exe
    ""DevManView.exe /uninstall "WAN Miniport*" /use_wildcard""
    3⤵
    - Executes dropped EXE
    - Enumerates connected drives
    - Maps connected drives based on registry
    - Checks SCSI registry key(s)
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:560
- - C:\Windows\system32\PING.EXE
    PING localhost -n 3
    3⤵
    - Runs ping.exe
    PID:592
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im DevManView.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:1208
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im DeviceCleanupCmd.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:1588
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im DriveCleanup.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:1936
- - C:\Windows\system32\PING.EXE
    ping 1.2.3.4 -n 1 -w 1000
    3⤵
    - Runs ping.exe
    PID:880
- - C:\Windows\system32\PING.EXE
    ping www.google.com -n 1
    3⤵
    - Runs ping.exe
    PID:856
- - C:\Windows\system32\find.exe
    find "TTL="
    3⤵
    PID:1244
- - C:\Users\Admin\AppData\Roaming\FIXusrTEMPv6.exe
    "C:\Users\Admin\AppData\Roaming\FIXusrTEMPv6.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:1076
  - - C:\Windows\system32\cmd.exe
      "C:\Windows\system32\cmd" /c "C:\Users\Admin\AppData\Local\Temp\3257.tmp\3258.tmp\3259.bat C:\Users\Admin\AppData\Roaming\FIXusrTEMPv6.exe"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:1040
    - - C:\Windows\system32\PING.EXE
        
        ping /n 1 localhost
        5⤵
        Runs ping.exe
        
        PID:1472
    - - C:\Windows\system32\PING.EXE
        
        ping /n 1 localhost
        5⤵
        Runs ping.exe
        
        PID:1432
    - - C:\Windows\system32\PING.EXE
        
        ping /n 1 localhost
        5⤵
        Runs ping.exe
        
        PID:916
    - - C:\Windows\system32\PING.EXE
        
        ping /n 2 localhost
        5⤵
        Runs ping.exe
        
        PID:1836
- - C:\Windows\system32\PING.EXE
    PING localhost -n 2
    3⤵
    - Runs ping.exe
    PID:1748

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe shell32.dll,SHCreateLocalServerRunDll {995C996E-D918-4a8c-A302-45719A6F4EA7} -Embedding
1⤵
PID:1504

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

Remote System Discovery

T1018

System Information Discovery