3f5836a58eb47fcce6dc259c19023b4a9ae7e358e5d09cce078f6782259e9d48

Virtualization/Sandbox Evasion

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxGuest	Yaseh.exe

Looks for VirtualBox Guest Additions in registry 2 TTPs 1 IoCs

defense_evasion

Query Registry

Virtualization/Sandbox Evasion

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Oracle\VirtualBox Guest Additions	Yaseh.exe

Looks for VMWare Tools registry key 2 TTPs 1 IoCs

defense_evasion

Query Registry

Virtualization/Sandbox Evasion

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\VMware, Inc.\VMware Tools	Yaseh.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\Control Panel\International\Geo\Nation	Yaseh.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
2444	powershell.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 6 IoCs

pid	Process
4148	Yaseh.exe
4148	Yaseh.exe
4148	Yaseh.exe
4148	Yaseh.exe
4148	Yaseh.exe
4148	Yaseh.exe

Checks SCSI registry key(s) 3 TTPs 5 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

Peripheral Device Discovery

T1120

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 0000000004000000306421734df6c2060000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff000000002701010000080000306421730000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed35000000ffffffff00000000070001000068090030642173000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff350000000000000005000000ffffffff000000000700010000f8ff1a30642173000000000000f0ff350000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff3a0000000000000005000000ffffffff000000000700010000f87f1d30642173000000000000f0ff3a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	Yaseh.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	Yaseh.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemVersion	Yaseh.exe

Suspicious behavior: EnumeratesProcesses 43 IoCs

pid	Process
4148	Yaseh.exe
4148	Yaseh.exe
4148	Yaseh.exe
4148	Yaseh.exe
4148	Yaseh.exe
4148	Yaseh.exe
4148	Yaseh.exe
4148	Yaseh.exe
4148	Yaseh.exe
4148	Yaseh.exe
4148	Yaseh.exe
4148	Yaseh.exe
4148	Yaseh.exe
4148	Yaseh.exe
4148	Yaseh.exe
4148	Yaseh.exe
4148	Yaseh.exe
4148	Yaseh.exe
4148	Yaseh.exe
4148	Yaseh.exe
4148	Yaseh.exe
4148	Yaseh.exe
4148	Yaseh.exe
4148	Yaseh.exe
4148	Yaseh.exe
4148	Yaseh.exe
4148	Yaseh.exe
4148	Yaseh.exe
4148	Yaseh.exe
4148	Yaseh.exe
4148	Yaseh.exe
4148	Yaseh.exe
4148	Yaseh.exe
2444	powershell.exe
2444	powershell.exe
2444	powershell.exe
4148	Yaseh.exe
4148	Yaseh.exe
4148	Yaseh.exe
4148	Yaseh.exe
4148	Yaseh.exe
4148	Yaseh.exe
4148	Yaseh.exe

Suspicious use of AdjustPrivilegeToken 13 IoCs

description	pid	Process
Token: SeDebugPrivilege	4148	Yaseh.exe
Token: SeDebugPrivilege	2444	powershell.exe
Token: SeBackupPrivilege	3292	vssvc.exe
Token: SeRestorePrivilege	3292	vssvc.exe
Token: SeAuditPrivilege	3292	vssvc.exe
Token: SeBackupPrivilege	3244	srtasks.exe
Token: SeRestorePrivilege	3244	srtasks.exe
Token: SeSecurityPrivilege	3244	srtasks.exe
Token: SeTakeOwnershipPrivilege	3244	srtasks.exe
Token: SeBackupPrivilege	3244	srtasks.exe
Token: SeRestorePrivilege	3244	srtasks.exe
Token: SeSecurityPrivilege	3244	srtasks.exe
Token: SeTakeOwnershipPrivilege	3244	srtasks.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
4148	Yaseh.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 4148 wrote to memory of 3916	4148	Yaseh.exe	97
PID 3916 wrote to memory of 2444	3916	cmd.exe	99
PID 4148 wrote to memory of 4040	4148	Yaseh.exe	103
PID 4040 wrote to memory of 4412	4040	cmd.exe	105
PID 4148 wrote to memory of 4676	4148	Yaseh.exe	106
PID 4676 wrote to memory of 1372	4676	cmd.exe	109
PID 4148 wrote to memory of 2132	4148	Yaseh.exe	110
PID 2132 wrote to memory of 4788	2132	cmd.exe	112
PID 4148 wrote to memory of 4888	4148	Yaseh.exe	113
PID 4888 wrote to memory of 4336	4888	cmd.exe	115

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\Yaseh.exe
"C:\Users\Admin\AppData\Local\Temp\Yaseh.exe"
1⤵
- Enumerates VirtualBox registry keys
- Looks for VirtualBox Guest Additions in registry
- Looks for VMWare Tools registry key
- Checks computer location settings
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:4148
- C:\Windows\SYSTEM32\cmd.exe
  "cmd.exe" /c powershell -NoProfile -ExecutionPolicy Bypass -Command "Checkpoint-Computer -Description 'Komatuze Pre-Optimization' -RestorePointType MODIFY_SETTINGS"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3916
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -ExecutionPolicy Bypass -Command "Checkpoint-Computer -Description 'Komatuze Pre-Optimization' -RestorePointType MODIFY_SETTINGS"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2444
- C:\Windows\SYSTEM32\cmd.exe
  "cmd.exe" /c reg export "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Power" "C:\Users\Admin\AppData\Roaming\KomatuzeOptimizer\backups\registry_backup_20260702_205022.reg_HKEY_LOCAL_MACHINE_SYSTEM_CurrentControlSet_Control_Power.reg" /y
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4040
- - C:\Windows\system32\reg.exe
    reg export "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Power" "C:\Users\Admin\AppData\Roaming\KomatuzeOptimizer\backups\registry_backup_20260702_205022.reg_HKEY_LOCAL_MACHINE_SYSTEM_CurrentControlSet_Control_Power.reg" /y
    3⤵
    PID:4412
- C:\Windows\SYSTEM32\cmd.exe
  "cmd.exe" /c reg export "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager" "C:\Users\Admin\AppData\Roaming\KomatuzeOptimizer\backups\registry_backup_20260702_205022.reg_HKEY_LOCAL_MACHINE_SYSTEM_CurrentControlSet_Control_Session Manager.reg" /y
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4676
- - C:\Windows\system32\reg.exe
    reg export "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager" "C:\Users\Admin\AppData\Roaming\KomatuzeOptimizer\backups\registry_backup_20260702_205022.reg_HKEY_LOCAL_MACHINE_SYSTEM_CurrentControlSet_Control_Session Manager.reg" /y
    3⤵
    PID:1372
- C:\Windows\SYSTEM32\cmd.exe
  "cmd.exe" /c reg export "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\nvlddmkm" "C:\Users\Admin\AppData\Roaming\KomatuzeOptimizer\backups\registry_backup_20260702_205022.reg_HKEY_LOCAL_MACHINE_SYSTEM_CurrentControlSet_Services_nvlddmkm.reg" /y
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2132
- - C:\Windows\system32\reg.exe
    reg export "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\nvlddmkm" "C:\Users\Admin\AppData\Roaming\KomatuzeOptimizer\backups\registry_backup_20260702_205022.reg_HKEY_LOCAL_MACHINE_SYSTEM_CurrentControlSet_Services_nvlddmkm.reg" /y
    3⤵
    PID:4788
- C:\Windows\SYSTEM32\cmd.exe
  "cmd.exe" /c reg export "HKEY_CURRENT_USER\Software\Microsoft\Windows\DWM" "C:\Users\Admin\AppData\Roaming\KomatuzeOptimizer\backups\registry_backup_20260702_205022.reg_HKEY_CURRENT_USER_Software_Microsoft_Windows_DWM.reg" /y
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4888
- - C:\Windows\system32\reg.exe
    reg export "HKEY_CURRENT_USER\Software\Microsoft\Windows\DWM" "C:\Users\Admin\AppData\Roaming\KomatuzeOptimizer\backups\registry_backup_20260702_205022.reg_HKEY_CURRENT_USER_Software_Microsoft_Windows_DWM.reg" /y
    3⤵
    PID:4336

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
PID:4732

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:3292

C:\Windows\system32\srtasks.exe
C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3244

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

System Information Discovery

Virtualization/Sandbox Evasion