#Farfli (2023-06-22)

心醉咖啡

金山毒霸扫描miss

郢都离人

腾管

隔山打空气

S1 双击kill
最近这几个是不是一家的啊，都是ypager.exe（

Exploitation
Detected a shellcode that loads a DLL with socket APIs after process creation
MITRE : Defense Evasion [T1055.001]
MITRE : Privilege Escalation [T1055.001]

Persistence
Detected persistency via scheduled task
MITRE : Persistence [T1053.005]
MITRE : Execution [T1053.005]
MITRE : Privilege Escalation [T1053.005]
Application registered itself to become persistent via scheduled task
MITRE : Persistence [T1053.005]
MITRE : Execution [T1053.005]
MITRE : Privilege Escalation [T1053.005]

Injection
Library was injected to a remote process
MITRE : Defense Evasion [T1055]
MITRE : Privilege Escalation [T1055]

Packer
Process suspicious as packed
MITRE : Defense Evasion [T1027][T1480.001]

Evasion
Process started with a spoofed parent process
MITRE : Defense Evasion [T1134.004]
MITRE : Privilege Escalation [T1134.004]

846472713

ESET

wenshui1013

G DATA企业版

yaokai815

金山毒霸kill