cerber | 3a457fa0e4997b1b11fcfbaa8b7fb763731a92ee95e5489af345fbcb586c3505

Analysis

user interaction
yes
max time kernel
84s
max time network
87s
platform
windows10-ltsc_2021_x64
resource
win10ltsc2021-20260513-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20260513-enlocale:en-usos:windows10-ltsc_2021-x64systemwindows
submitted
02/08/2026, 12:57

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

Reason

Machine shutdown

General

Target
free_perm.zip
Size 10.5MB
Sample260802-p679hstbmd
SHA256 3a457fa0e4997b1b11fcfbaa8b7fb763731a92ee95e5489af345fbcb586c3505
MD5 c9263541fb9de3a9a0b6bf0861c658f5
SHA1 957ab55de8c56487178f09324887cef5e58d98cc
SHA512 0669d7e0afca7fb1fb7fc71313fb2e5db8194982fc70ebc91c6b9cb42b848e9b12c37168a1d068c3f8686ced1afa0c2bf989f520e173254e46de17032e0c28b6
SSDEEP 196608:lpDSiMGYRZ3gvggT1FjdK7yN4b+eiCtULc9PCylSrroKVmGx8HcdJqaTWqkHKEP5:lpDnZmKnLZBSb+eimSc9P/ic7Gicdgam
TLSH
T111B63385BBE06D9D353C0AD3DB98E9C58EBEC04447EFE930B85D25BD2DC5204E2187A6
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion execution cerber persistence ransomware

Malware Config

Signatures

Family: Cerber 13 IoCs

Cerber is a widely used ransomware-as-a-service (RaaS), first seen in 2017.

ransomware cerber

description	ioc	pid	Process
Mutant created	AFUWIN.{5b5b8120-cd0e-11d9-b61b-0001294c3bd8}		winxsrcsv64.exe
Mutant created	AFUWIN.{5b5b8120-cd0e-11d9-b61b-0001294c3bd8}		winxsrcsv64.exe
Mutant created	AFUWIN.{5b5b8120-cd0e-11d9-b61b-0001294c3bd8}		winxsrcsv64.exe
Mutant created	AFUWIN.{5b5b8120-cd0e-11d9-b61b-0001294c3bd8}		winxsrcsv64.exe
Mutant created	AFUWIN.{5b5b8120-cd0e-11d9-b61b-0001294c3bd8}		winxsrcsv64.exe
Mutant created	AFUWIN.{5b5b8120-cd0e-11d9-b61b-0001294c3bd8}		winxsrcsv64.exe
Mutant created	AFUWIN.{5b5b8120-cd0e-11d9-b61b-0001294c3bd8}		winxsrcsv64.exe
Mutant created	AFUWIN.{5b5b8120-cd0e-11d9-b61b-0001294c3bd8}		winxsrcsv64.exe
		4908	taskkill.exe
Mutant created	AFUWIN.{5b5b8120-cd0e-11d9-b61b-0001294c3bd8}		winxsrcsv64.exe
Mutant created	AFUWIN.{5b5b8120-cd0e-11d9-b61b-0001294c3bd8}		winxsrcsv64.exe
Mutant created	AFUWIN.{5b5b8120-cd0e-11d9-b61b-0001294c3bd8}		winxsrcsv64.exe
Mutant created	AFUWIN.{5b5b8120-cd0e-11d9-b61b-0001294c3bd8}		winxsrcsv64.exe

Drops file in Drivers directory 33 IoCs

description	ioc	Process
File created	C:\Windows\System32\drivers\spoofer_svc.txt	cmd.exe
File opened for modification	C:\Windows\System32\drivers\sawaf.exe	cmd.exe
File created	C:\Windows\System32\drivers\sawaf64e.sys	cmd.exe
File created	C:\Windows\System32\drivers\SawafV1X64_1.sys	cmd.exe
File opened for modification	C:\Windows\System32\drivers\winxsrcsv64.sys	cmd.exe
File opened for modification	C:\Windows\System32\drivers\sawaf.exe	cmd.exe
File opened for modification	C:\Windows\System32\drivers\z.exe	cmd.exe
File opened for modification	C:\Windows\System32\drivers\f8874c68e578.sys	cmd.exe
File created	C:\Windows\System32\drivers\winxsrcsv64.exe	cmd.exe
File created	C:\Windows\System32\drivers\z.exe	cmd.exe
File opened for modification	C:\Windows\System32\drivers\rtkiow10x64.sys	cmd.exe
File created	C:\Windows\System32\drivers\winxsrcsv64.sys	cmd.exe
File created	C:\Windows\System32\drivers\rtkiow10x64.sys	cmd.exe
File opened for modification	C:\Windows\System32\drivers\rtkiow10x64.sys	cmd.exe
File opened for modification	C:\Windows\System32\drivers\sawaf64e.sys	cmd.exe
File opened for modification	C:\Windows\System32\drivers\winxsrcsv64.exe	cmd.exe
File opened for modification	C:\Windows\System32\drivers\sawafio64.dll	cmd.exe
File opened for modification	C:\Windows\System32\drivers\z.exe	cmd.exe
File opened for modification	C:\Windows\System32\drivers\f5164e478e5d.sys	cmd.exe
File opened for modification	C:\Windows\System32\drivers\spoofer_svc.txt	cmd.exe
File opened for modification	C:\Windows\System32\drivers\Sawaf_1.exe	cmd.exe
File opened for modification	C:\Windows\System32\drivers\sawafio64.dll	cmd.exe
File opened for modification	C:\Windows\System32\drivers\Sawaf_1.exe	cmd.exe
File opened for modification	C:\Windows\System32\drivers\winxsrcsv64.exe	cmd.exe
File created	C:\Windows\System32\drivers\f8874c68e578.sys	cmd.exe
File opened for modification	C:\Windows\System32\drivers\winxsrcsv64.sys	cmd.exe
File created	C:\Windows\System32\drivers\sawafio64.dll	cmd.exe
File created	C:\Windows\System32\drivers\sawaf.exe	cmd.exe
File created	C:\Windows\System32\drivers\Sawaf_1.exe	cmd.exe
File opened for modification	C:\Windows\System32\drivers\sawaf64e.sys	cmd.exe
File opened for modification	C:\Windows\System32\drivers\SawafV1X64_1.sys	cmd.exe
File created	C:\Windows\System32\drivers\f5164e478e5d.sys	cmd.exe
File opened for modification	C:\Windows\System32\drivers\SawafV1X64_1.sys	cmd.exe

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 13 IoCs

pid	Process
1496	winxsrcsv64.exe
3704	winxsrcsv64.exe
1896	winxsrcsv64.exe
1208	winxsrcsv64.exe
3352	winxsrcsv64.exe
2944	winxsrcsv64.exe
5044	winxsrcsv64.sys
1052	winxsrcsv64.exe
3048	winxsrcsv64.exe
1544	winxsrcsv64.exe
4324	winxsrcsv64.exe
2820	winxsrcsv64.exe
1808	winxsrcsv64.exe

Stops running service(s) 4 TTPs
defense_evasion execution

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

Service Execution
T1569.002

Power Settings 1 TTPs 2 IoCs

powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.

persistence

Power Settings

T1653

pid	Process
1044	powercfg.exe
2664	powercfg.exe

Hide Artifacts: Ignore Process Interrupts 1 TTPs 2 IoCs

Command interpreters often include specific commands/flags that ignore errors and other hangups.

defense_evasion

Ignore Process Interrupts

T1564.011

pid	Process
4788	powershell.exe
776	powershell.exe

Launches sc.exe 9 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
1484	sc.exe
372	sc.exe
3656	sc.exe
2260	sc.exe
3052	sc.exe
4948	sc.exe
5040	sc.exe
3944	sc.exe
3708	sc.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 6 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
3220	powershell.exe
448	powershell.exe
1596	powershell.exe
4392	powershell.exe
3216	powershell.exe
1120	powershell.exe

Executes a command shell one-liner 1 TTPs 10 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2064	cmd.exe
388	cmd.exe
4560	cmd.exe
3000	cmd.exe
2356	cmd.exe
1864	cmd.exe
3192	cmd.exe
2212	cmd.exe
4048	cmd.exe
1856	cmd.exe

Kills process with taskkill 2 IoCs

defense_evasion

pid	Process
4908	taskkill.exe
3892	taskkill.exe

Modifies data under HKEY_USERS 15 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationBlurBalance = "1"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationGlassAttribute = "1"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\AccentColor = "4292311040"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColor = "3288365271"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColorBalance = "89"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglow = "3288365271"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentColorMenu = "4292311040"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\EnableWindowColorization = "134"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglowBalance = "10"	LogonUI.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentPalette = a6d8ff0076b9ed00429ce3000078d700005a9e000042750000264200f7630c00	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History\AutoColor = "0"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\StartColorMenu = "4288567808"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History	LogonUI.exe

Opens file in notepad (likely ransom note) 1 IoCs

ransomware

pid	Process
4056	NOTEPAD.EXE

Suspicious behavior: EnumeratesProcesses 16 IoCs

pid	Process
3220	powershell.exe
3220	powershell.exe
448	powershell.exe
448	powershell.exe
4788	powershell.exe
4788	powershell.exe
1596	powershell.exe
1596	powershell.exe
4392	powershell.exe
4392	powershell.exe
3216	powershell.exe
3216	powershell.exe
776	powershell.exe
776	powershell.exe
1120	powershell.exe
1120	powershell.exe

Suspicious behavior: LoadsDriver 12 IoCs

pid	Process
680	Process not Found
680	Process not Found
680	Process not Found
680	Process not Found
680	Process not Found
680	Process not Found
680	Process not Found
680	Process not Found
680	Process not Found
680	Process not Found
680	Process not Found
680	Process not Found

Suspicious use of AdjustPrivilegeToken 62 IoCs

description	pid	Process
Token: SeDebugPrivilege	3220	powershell.exe
Token: SeDebugPrivilege	4908	taskkill.exe
Token: SeDebugPrivilege	448	powershell.exe
Token: SeDebugPrivilege	4788	powershell.exe
Token: SeIncreaseQuotaPrivilege	4788	powershell.exe
Token: SeSecurityPrivilege	4788	powershell.exe
Token: SeTakeOwnershipPrivilege	4788	powershell.exe
Token: SeLoadDriverPrivilege	4788	powershell.exe
Token: SeSystemProfilePrivilege	4788	powershell.exe
Token: SeSystemtimePrivilege	4788	powershell.exe
Token: SeProfSingleProcessPrivilege	4788	powershell.exe
Token: SeIncBasePriorityPrivilege	4788	powershell.exe
Token: SeCreatePagefilePrivilege	4788	powershell.exe
Token: SeBackupPrivilege	4788	powershell.exe
Token: SeRestorePrivilege	4788	powershell.exe
Token: SeShutdownPrivilege	4788	powershell.exe
Token: SeDebugPrivilege	4788	powershell.exe
Token: SeSystemEnvironmentPrivilege	4788	powershell.exe
Token: SeRemoteShutdownPrivilege	4788	powershell.exe
Token: SeUndockPrivilege	4788	powershell.exe
Token: SeManageVolumePrivilege	4788	powershell.exe
Token: 33	4788	powershell.exe
Token: 34	4788	powershell.exe
Token: 35	4788	powershell.exe
Token: 36	4788	powershell.exe
Token: SeDebugPrivilege	1596	powershell.exe
Token: SeShutdownPrivilege	1044	powercfg.exe
Token: SeCreatePagefilePrivilege	1044	powercfg.exe
Token: SeShutdownPrivilege	1044	powercfg.exe
Token: SeCreatePagefilePrivilege	1044	powercfg.exe
Token: SeDebugPrivilege	4392	powershell.exe
Token: SeDebugPrivilege	3892	taskkill.exe
Token: SeDebugPrivilege	3216	powershell.exe
Token: SeDebugPrivilege	776	powershell.exe
Token: SeIncreaseQuotaPrivilege	776	powershell.exe
Token: SeSecurityPrivilege	776	powershell.exe
Token: SeTakeOwnershipPrivilege	776	powershell.exe
Token: SeLoadDriverPrivilege	776	powershell.exe
Token: SeSystemProfilePrivilege	776	powershell.exe
Token: SeSystemtimePrivilege	776	powershell.exe
Token: SeProfSingleProcessPrivilege	776	powershell.exe
Token: SeIncBasePriorityPrivilege	776	powershell.exe
Token: SeCreatePagefilePrivilege	776	powershell.exe
Token: SeBackupPrivilege	776	powershell.exe
Token: SeRestorePrivilege	776	powershell.exe
Token: SeShutdownPrivilege	776	powershell.exe
Token: SeDebugPrivilege	776	powershell.exe
Token: SeSystemEnvironmentPrivilege	776	powershell.exe
Token: SeRemoteShutdownPrivilege	776	powershell.exe
Token: SeUndockPrivilege	776	powershell.exe
Token: SeManageVolumePrivilege	776	powershell.exe
Token: 33	776	powershell.exe
Token: 34	776	powershell.exe
Token: 35	776	powershell.exe
Token: 36	776	powershell.exe
Token: SeDebugPrivilege	1120	powershell.exe
Token: SeShutdownPrivilege	2664	powercfg.exe
Token: SeCreatePagefilePrivilege	2664	powercfg.exe
Token: SeShutdownPrivilege	2664	powercfg.exe
Token: SeCreatePagefilePrivilege	2664	powercfg.exe
Token: SeShutdownPrivilege	3868	shutdown.exe
Token: SeRemoteShutdownPrivilege	3868	shutdown.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3732	LogonUI.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4560 wrote to memory of 3000	4560	cmd.exe	91
PID 3000 wrote to memory of 3220	3000	cmd.exe	92
PID 4560 wrote to memory of 1960	4560	cmd.exe	93
PID 4560 wrote to memory of 1472	4560	cmd.exe	94
PID 4560 wrote to memory of 2384	4560	cmd.exe	95
PID 4560 wrote to memory of 1368	4560	cmd.exe	96
PID 4560 wrote to memory of 1484	4560	cmd.exe	97
PID 4560 wrote to memory of 4208	4560	cmd.exe	98
PID 4560 wrote to memory of 372	4560	cmd.exe	99
PID 4560 wrote to memory of 3944	4560	cmd.exe	100
PID 4560 wrote to memory of 4908	4560	cmd.exe	101
PID 4560 wrote to memory of 2356	4560	cmd.exe	103
PID 2356 wrote to memory of 448	2356	cmd.exe	104
PID 4560 wrote to memory of 1496	4560	cmd.exe	105
PID 4560 wrote to memory of 3704	4560	cmd.exe	106
PID 4560 wrote to memory of 1896	4560	cmd.exe	107
PID 4560 wrote to memory of 1208	4560	cmd.exe	108
PID 4560 wrote to memory of 3352	4560	cmd.exe	109
PID 4560 wrote to memory of 2944	4560	cmd.exe	111
PID 4560 wrote to memory of 2212	4560	cmd.exe	112
PID 2212 wrote to memory of 4788	2212	cmd.exe	113
PID 4560 wrote to memory of 4540	4560	cmd.exe	116
PID 4560 wrote to memory of 4968	4560	cmd.exe	117
PID 4560 wrote to memory of 1596	4560	cmd.exe	118
PID 1596 wrote to memory of 4048	1596	powershell.exe	119
PID 4048 wrote to memory of 4796	4048	cmd.exe	120
PID 4560 wrote to memory of 3268	4560	cmd.exe	121
PID 4560 wrote to memory of 3560	4560	cmd.exe	122
PID 4560 wrote to memory of 1044	4560	cmd.exe	123
PID 4560 wrote to memory of 3396	4560	cmd.exe	124
PID 4860 wrote to memory of 3656	4860	cmd.exe	135
PID 1856 wrote to memory of 2064	1856	cmd.exe	138
PID 2064 wrote to memory of 4392	2064	cmd.exe	139
PID 1856 wrote to memory of 4308	1856	cmd.exe	140
PID 1856 wrote to memory of 344	1856	cmd.exe	141
PID 1856 wrote to memory of 4212	1856	cmd.exe	142
PID 1856 wrote to memory of 3352	1856	cmd.exe	143
PID 1856 wrote to memory of 2260	1856	cmd.exe	144
PID 1856 wrote to memory of 1292	1856	cmd.exe	145
PID 1856 wrote to memory of 3052	1856	cmd.exe	146
PID 1856 wrote to memory of 4948	1856	cmd.exe	147
PID 1856 wrote to memory of 5040	1856	cmd.exe	148
PID 1856 wrote to memory of 3708	1856	cmd.exe	149
PID 1856 wrote to memory of 3892	1856	cmd.exe	150
PID 1856 wrote to memory of 1864	1856	cmd.exe	151
PID 1864 wrote to memory of 3216	1864	cmd.exe	152
PID 1856 wrote to memory of 1052	1856	cmd.exe	153
PID 1856 wrote to memory of 3048	1856	cmd.exe	154
PID 1856 wrote to memory of 1544	1856	cmd.exe	155
PID 1856 wrote to memory of 4324	1856	cmd.exe	156
PID 1856 wrote to memory of 2820	1856	cmd.exe	157
PID 1856 wrote to memory of 1808	1856	cmd.exe	158
PID 1856 wrote to memory of 388	1856	cmd.exe	159
PID 388 wrote to memory of 776	388	cmd.exe	160
PID 1856 wrote to memory of 556	1856	cmd.exe	162
PID 1856 wrote to memory of 3860	1856	cmd.exe	163
PID 1856 wrote to memory of 1120	1856	cmd.exe	164
PID 1120 wrote to memory of 3192	1120	powershell.exe	165
PID 3192 wrote to memory of 4916	3192	cmd.exe	166
PID 1856 wrote to memory of 2704	1856	cmd.exe	167
PID 1856 wrote to memory of 4388	1856	cmd.exe	168
PID 1856 wrote to memory of 2664	1856	cmd.exe	169
PID 1856 wrote to memory of 2208	1856	cmd.exe	170
PID 1856 wrote to memory of 3868	1856	cmd.exe	171

C:\Windows\Explorer.exe
C:\Windows\Explorer.exe /idlist,,C:\Users\Admin\AppData\Local\Temp\free_perm.zip
1⤵
PID:1120

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:2312

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\Desktop\free_perm\spoof.bat"
1⤵
- Drops file in Drivers directory
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4560
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c powershell -NoProfile -Command "$c='0123456789abcdef';$n='';1..12|ForEach-Object{$n+=$c[(Get-Random -Maximum 16)]};$n"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3000
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -Command "$c='0123456789abcdef';$n='';1..12|ForEach-Object{$n+=$c[(Get-Random -Maximum 16)]};$n"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3220
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Spoofer" /v ServiceName /t REG_SZ /d f8874c68e578 /f
  2⤵
  PID:1960
- C:\Windows\system32\reg.exe
  reg add "HKLM\SYSTEM\CurrentControlSet\Policies" /v Valid /t REG_DWORD /d 0 /f
  2⤵
  PID:1472
- C:\Windows\system32\reg.exe
  reg add "HKLM\SYSTEM\CurrentControlSet\Policies" /v Efi /t REG_DWORD /d 0 /f
  2⤵
  PID:2384
- C:\Windows\system32\reg.exe
  reg add "HKLM\SYSTEM\CurrentControlSet\Policies" /v Load /t REG_DWORD /d 0 /f
  2⤵
  PID:1368
- C:\Windows\system32\sc.exe
  sc create f8874c68e578 type= kernel start= boot error= normal group= "System Bus Extender" binpath= "C:\Windows\System32\drivers\f8874c68e578.sys"
  2⤵
  - Launches sc.exe
  PID:1484
- C:\Windows\system32\reg.exe
  reg add "HKLM\System\CurrentControlSet\Services\f8874c68e578" /v Tag /t REG_DWORD /d 1 /f
  2⤵
  PID:4208
- C:\Windows\system32\sc.exe
  sc query winxsrcsv64
  2⤵
  - Launches sc.exe
  PID:372
- C:\Windows\system32\sc.exe
  sc create winxsrcsv64 type= kernel start= demand error= normal binpath= "\SystemRoot\System32\drivers\winxsrcsv64.sys"
  2⤵
  - Launches sc.exe
  PID:3944
- C:\Windows\system32\taskkill.exe
  taskkill /F /IM WmiPrvSE.exe
  2⤵
  - Family: Cerber
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:4908
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c powershell -NoProfile -Command "$b=[Environment]::OSVersion.Version.Build;if($b -ge 22000){'8'}elseif($b -ge 19041){'7'}elseif($b -ge 17763){'6'}elseif($b -ge 10240){'5'}elseif($b -ge 9600){'4'}elseif($b -ge 9200){'3'}elseif($b -ge 7601){'2'}else{'1'}"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2356
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -Command "$b=[Environment]::OSVersion.Version.Build;if($b -ge 22000){'8'}elseif($b -ge 19041){'7'}elseif($b -ge 17763){'6'}elseif($b -ge 10240){'5'}elseif($b -ge 9600){'4'}elseif($b -ge 9200){'3'}elseif($b -ge 7601){'2'}else{'1'}"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:448
- C:\Windows\System32\drivers\winxsrcsv64.exe
  winxsrcsv64.exe /OS 7
  2⤵
  - Family: Cerber
  - Executes dropped EXE
  PID:1496
- C:\Windows\System32\drivers\winxsrcsv64.exe
  winxsrcsv64.exe /SF "To be filled by O.E.M."
  2⤵
  - Family: Cerber
  - Executes dropped EXE
  PID:3704
- C:\Windows\System32\drivers\winxsrcsv64.exe
  winxsrcsv64.exe /PAT "To be filled by O.E.M."
  2⤵
  - Family: Cerber
  - Executes dropped EXE
  PID:1896
- C:\Windows\System32\drivers\winxsrcsv64.exe
  winxsrcsv64.exe /PPN "To be filled by O.E.M."
  2⤵
  - Family: Cerber
  - Executes dropped EXE
  PID:1208
- C:\Windows\System32\drivers\winxsrcsv64.exe
  winxsrcsv64.exe /PSN "To be filled by O.E.M."
  2⤵
  - Family: Cerber
  - Executes dropped EXE
  PID:3352
- C:\Windows\System32\drivers\winxsrcsv64.exe
  winxsrcsv64.exe /BT "Default string"
  2⤵
  - Family: Cerber
  - Executes dropped EXE
  PID:2944
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c powershell -NoProfile -Command "(Get-CimInstance Win32_BaseBoard -ErrorAction SilentlyContinue).Manufacturer"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2212
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -Command "(Get-CimInstance Win32_BaseBoard -ErrorAction SilentlyContinue).Manufacturer"
    3⤵
    - Hide Artifacts: Ignore Process Interrupts
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4788
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" echo Unknown "
  2⤵
  PID:4540
- C:\Windows\system32\findstr.exe
  findstr /I /C:"Hewlett-Packard" /C:"HP"
  2⤵
  PID:4968
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -Command "$c='0123456789ABCDEF';$g={-join (1..5|ForEach-Object{$c[(Get-Random -Maximum 16)]})};$v=(& $g)+'-'+(& $g)+'-'+(& $g)+'-00AEM';cmd /c reg add \"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\" /v ProductId /t REG_SZ /d \"$v\" /f"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1596
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c reg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion" /v ProductId /t REG_SZ /d D43D8-09CDF-B96D9-00AEM /f
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4048
  - - C:\Windows\system32\reg.exe
      reg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion" /v ProductId /t REG_SZ /d D43D8-09CDF-B96D9-00AEM /f
      4⤵
      PID:4796
- C:\Windows\system32\reg.exe
  reg add "HKEY_LOCAL_MACHINE\HARDWARE\DEVICEMAP\Scsi\Scsi Port 0\Scsi Bus 0\Target Id 0\Logical Unit Id 0" /v Identifier /t REG_SZ /d 2617-31245 /f
  2⤵
  PID:3268
- C:\Windows\system32\reg.exe
  reg add "HKEY_LOCAL_MACHINE\HARDWARE\DEVICEMAP\Scsi\Scsi Port 0\Scsi Bus 0\Target Id 0\Logical Unit Id 0" /v SerialNumber /t REG_SZ /d 20009-29563 /f
  2⤵
  PID:3560
- C:\Windows\system32\powercfg.exe
  powercfg /h off
  2⤵
  - Power Settings
  - Suspicious use of AdjustPrivilegeToken
  PID:1044
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon" /v PowerdownAfterShutdown /t REG_SZ /d 1 /f
  2⤵
  PID:3396

C:\Windows\System32\drivers\winxsrcsv64.sys
C:\Windows\System32\drivers\winxsrcsv64.sys
1⤵
- Executes dropped EXE
PID:5044

C:\Windows\System32\NOTEPAD.EXE
"C:\Windows\System32\NOTEPAD.EXE" C:\Users\Admin\Desktop\free_perm\spoof.bat
1⤵
- Opens file in notepad (likely ransom note)
PID:4056

C:\Windows\system32\cmd.exe
"C:\Windows\system32\cmd.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4860
- C:\Windows\system32\sc.exe
  sc stop winxsrcsv64
  2⤵
  - Launches sc.exe
  PID:3656

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\Desktop\free_perm\spoof.bat"
1⤵
- Drops file in Drivers directory
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:1856
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c powershell -NoProfile -Command "$c='0123456789abcdef';$n='';1..12|ForEach-Object{$n+=$c[(Get-Random -Maximum 16)]};$n"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2064
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -Command "$c='0123456789abcdef';$n='';1..12|ForEach-Object{$n+=$c[(Get-Random -Maximum 16)]};$n"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4392
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Spoofer" /v ServiceName /t REG_SZ /d f5164e478e5d /f
  2⤵
  PID:4308
- C:\Windows\system32\reg.exe
  reg add "HKLM\SYSTEM\CurrentControlSet\Policies" /v Valid /t REG_DWORD /d 0 /f
  2⤵
  PID:344
- C:\Windows\system32\reg.exe
  reg add "HKLM\SYSTEM\CurrentControlSet\Policies" /v Efi /t REG_DWORD /d 0 /f
  2⤵
  PID:4212
- C:\Windows\system32\reg.exe
  reg add "HKLM\SYSTEM\CurrentControlSet\Policies" /v Load /t REG_DWORD /d 0 /f
  2⤵
  PID:3352
- C:\Windows\system32\sc.exe
  sc create f5164e478e5d type= kernel start= boot error= normal group= "System Bus Extender" binpath= "C:\Windows\System32\drivers\f5164e478e5d.sys"
  2⤵
  - Launches sc.exe
  PID:2260
- C:\Windows\system32\reg.exe
  reg add "HKLM\System\CurrentControlSet\Services\f5164e478e5d" /v Tag /t REG_DWORD /d 1 /f
  2⤵
  PID:1292
- C:\Windows\system32\sc.exe
  sc query winxsrcsv64
  2⤵
  - Launches sc.exe
  PID:3052
- C:\Windows\system32\sc.exe
  sc stop winxsrcsv64
  2⤵
  - Launches sc.exe
  PID:4948
- C:\Windows\system32\sc.exe
  sc delete winxsrcsv64
  2⤵
  - Launches sc.exe
  PID:5040
- C:\Windows\system32\sc.exe
  sc create winxsrcsv64 type= kernel start= demand error= normal binpath= "\SystemRoot\System32\drivers\winxsrcsv64.sys"
  2⤵
  - Launches sc.exe
  PID:3708
- C:\Windows\system32\taskkill.exe
  taskkill /F /IM WmiPrvSE.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:3892
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c powershell -NoProfile -Command "$b=[Environment]::OSVersion.Version.Build;if($b -ge 22000){'8'}elseif($b -ge 19041){'7'}elseif($b -ge 17763){'6'}elseif($b -ge 10240){'5'}elseif($b -ge 9600){'4'}elseif($b -ge 9200){'3'}elseif($b -ge 7601){'2'}else{'1'}"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1864
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -Command "$b=[Environment]::OSVersion.Version.Build;if($b -ge 22000){'8'}elseif($b -ge 19041){'7'}elseif($b -ge 17763){'6'}elseif($b -ge 10240){'5'}elseif($b -ge 9600){'4'}elseif($b -ge 9200){'3'}elseif($b -ge 7601){'2'}else{'1'}"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3216
- C:\Windows\System32\drivers\winxsrcsv64.exe
  winxsrcsv64.exe /OS 7
  2⤵
  - Family: Cerber
  - Executes dropped EXE
  PID:1052
- C:\Windows\System32\drivers\winxsrcsv64.exe
  winxsrcsv64.exe /SF "To be filled by O.E.M."
  2⤵
  - Family: Cerber
  - Executes dropped EXE
  PID:3048
- C:\Windows\System32\drivers\winxsrcsv64.exe
  winxsrcsv64.exe /PAT "To be filled by O.E.M."
  2⤵
  - Family: Cerber
  - Executes dropped EXE
  PID:1544
- C:\Windows\System32\drivers\winxsrcsv64.exe
  winxsrcsv64.exe /PPN "To be filled by O.E.M."
  2⤵
  - Family: Cerber
  - Executes dropped EXE
  PID:4324
- C:\Windows\System32\drivers\winxsrcsv64.exe
  winxsrcsv64.exe /PSN "To be filled by O.E.M."
  2⤵
  - Family: Cerber
  - Executes dropped EXE
  PID:2820
- C:\Windows\System32\drivers\winxsrcsv64.exe
  winxsrcsv64.exe /BT "Default string"
  2⤵
  - Family: Cerber
  - Executes dropped EXE
  PID:1808
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c powershell -NoProfile -Command "(Get-CimInstance Win32_BaseBoard -ErrorAction SilentlyContinue).Manufacturer"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:388
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -Command "(Get-CimInstance Win32_BaseBoard -ErrorAction SilentlyContinue).Manufacturer"
    3⤵
    - Hide Artifacts: Ignore Process Interrupts
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:776
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" echo Unknown "
  2⤵
  PID:556
- C:\Windows\system32\findstr.exe
  findstr /I /C:"Hewlett-Packard" /C:"HP"
  2⤵
  PID:3860
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -Command "$c='0123456789ABCDEF';$g={-join (1..5|ForEach-Object{$c[(Get-Random -Maximum 16)]})};$v=(& $g)+'-'+(& $g)+'-'+(& $g)+'-00AEM';cmd /c reg add \"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\" /v ProductId /t REG_SZ /d \"$v\" /f"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1120
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c reg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion" /v ProductId /t REG_SZ /d EF5D7-A63B5-36860-00AEM /f
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:3192
  - - C:\Windows\system32\reg.exe
      reg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion" /v ProductId /t REG_SZ /d EF5D7-A63B5-36860-00AEM /f
      4⤵
      PID:4916
- C:\Windows\system32\reg.exe
  reg add "HKEY_LOCAL_MACHINE\HARDWARE\DEVICEMAP\Scsi\Scsi Port 0\Scsi Bus 0\Target Id 0\Logical Unit Id 0" /v Identifier /t REG_SZ /d 2793-21835 /f
  2⤵
  PID:2704
- C:\Windows\system32\reg.exe
  reg add "HKEY_LOCAL_MACHINE\HARDWARE\DEVICEMAP\Scsi\Scsi Port 0\Scsi Bus 0\Target Id 0\Logical Unit Id 0" /v SerialNumber /t REG_SZ /d 1635-18262 /f
  2⤵
  PID:4388
- C:\Windows\system32\powercfg.exe
  powercfg /h off
  2⤵
  - Power Settings
  - Suspicious use of AdjustPrivilegeToken
  PID:2664
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon" /v PowerdownAfterShutdown /t REG_SZ /d 1 /f
  2⤵
  PID:2208
- C:\Windows\system32\shutdown.exe
  shutdown /r /t 0
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:3868

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x4 /state0:0xa39cd055 /state1:0x41c64e6d
1⤵
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
PID:3732

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

System Services

T1569

Service Execution

T1569.002

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Power Settings

T1653

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Hide Artifacts

T1564

Ignore Process Interrupts

T1564.011

Impair Defenses

T1562

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Service Stop

T1489

Replay Monitor

Loading Replay Monitor...