devman

T1078Valid Accounts

Use of valid credentials (malharbi) to access systems.

T1210Exploitation of Remote Services

Use of the MS17-010 (EternalBlue) exploit.

T1059.001PowerShell

Execution of PowerShell commands to extract files.

T1203Exploitation for Client Execution

Command execution using MS17-010 via Metasploit.

T1078Valid Accounts

Maintaining access with created administrator account.

T1068Exploitation for Privilege Escalation

Escalation to SYSTEM privileges.

T1036Masquerading

Use of an innocuous name for the ransomware payload (iamdidy.e).

T1562.001Disable or Modify Tools

No security tools detected on target systems.

T1003OS Credential Dumping

Implied by acquisition and use of admin credentials.

T1018Remote System Discovery

Network mapping using CrackMapExec.

T1046Network Service Scanning

Scanning IP ranges and SMB services.

T1082System Information Discovery

Using tasklist and whoami to collect system info.

T1021.002SMB/Windows Admin Shares

Lateral movement through SMB confirmed by CME.

T1005Data from Local System

File extraction from local system using PowerShell.

T1041Exfiltration Over C2 Channel

Downloading files like notepad.exe via smbclient.

T1486Data Encrypted for Impact

Encryption of files with .devman extension (changed at operator's request).

T1489Service Stop

Halting operations and rendering systems unavailable.

T1490Inhibit System Recovery

Disabling backups and system recovery.

T1491Defacement

Ransom notes (ransom.txt) deployed across infected systems.