Analysis
- max time kernel
149s - max time network
145s - platform
windows10-2004_x64 - resource
win10v2004-20260130-en - resource tags
arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
05/05/2026, 12:12
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
ciuscenter.org_hyber.exe
Resource
win10v2004-20260130-en
windows10-2004-x64
37 signatures
150 seconds
Behavioral task
behavioral2
Sample
ciuscenter.org_hyber.exe
Resource
win11-20260130-en
windows11-21h2-x64
35 signatures
150 seconds
General
- Target ciuscenter.org_hyber.exe
- Size 51KB
- Sample260505-pdbpvae18y
- SHA256 a8a9f30697664b488ba07a8716167b94350c162c2f424b4e15ef59d9552d0710
- MD5 fbf8476865de6c5e32069758ccc065d2
- SHA1 5c1d6ac63bcacf2f89420e484a14a9a818f33b17
- SHA512 59105f73dd0c0072f19aa3f04f7d2db5f0f9c6e654518290bf09f02d5ccaab0bd15dccf8a583f481bd3501d5f9c15e271b2b29a9311b65f6479c2c81cc500398
- SSDEEP 768:eVTtLYhD+7o19oDJLnk5zATSulgSs/lnhaeG7MPLf9jSvB8hE2R:sYhD+YuhnUSgL/GuljS587R
- TLSH T13233084837ED4112E5BF4EBE95B190529332F463DD22DB8E0AD8459E09E3B44CC68B6B
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Contains code to disable Windows Defender 2 IoCs
A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.
resource yara_rule behavioral1/memory/4724-0-0x0000000000DE0000-0x0000000000DF4000-memory.dmp disable_win_def behavioral1/files/0x000700000002492d-2278.dat disable_win_def -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\DisableAntiSpyware = "1" ciuscenter.org_hyber.exe - Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell and hide display window.
pid Process 764 powershell.exe - Disables RegEdit via registry modification 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-643422742-1162610606-620613169-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" ciuscenter.org_hyber.exe - Disables Task Manager via registry modification
- Drops file in Drivers directory 1 IoCs
description ioc Process File opened for modification C:\Windows\System32\drivers\etc\hosts ciuscenter.org_hyber.exe - Modifies Windows Firewall 2 TTPs 1 IoCs
pid Process 2972 netsh.exe - Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-643422742-1162610606-620613169-1000\Control Panel\International\Geo\Nation ciuscenter.org_hyber.exe - Disables service(s) 3 TTPs
- Drops startup file 64 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_14.pdf ciuscenter.org_hyber.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_18.pdf ciuscenter.org_hyber.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_29.pdf ciuscenter.org_hyber.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_82.pdf ciuscenter.org_hyber.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_107.pdf ciuscenter.org_hyber.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_134.pdf ciuscenter.org_hyber.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_146.pdf ciuscenter.org_hyber.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_151.pdf ciuscenter.org_hyber.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_31.pdf ciuscenter.org_hyber.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_105.pdf ciuscenter.org_hyber.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_123.pdf ciuscenter.org_hyber.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_125.pdf ciuscenter.org_hyber.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_169.pdf ciuscenter.org_hyber.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_184.pdf ciuscenter.org_hyber.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_189.pdf ciuscenter.org_hyber.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_199.pdf ciuscenter.org_hyber.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_13.pdf ciuscenter.org_hyber.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_75.pdf ciuscenter.org_hyber.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_101.pdf ciuscenter.org_hyber.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_112.pdf ciuscenter.org_hyber.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_129.pdf ciuscenter.org_hyber.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_190.pdf ciuscenter.org_hyber.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_9.pdf ciuscenter.org_hyber.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_89.pdf ciuscenter.org_hyber.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_144.pdf ciuscenter.org_hyber.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_196.pdf ciuscenter.org_hyber.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_136.pdf ciuscenter.org_hyber.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_140.pdf ciuscenter.org_hyber.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_142.pdf ciuscenter.org_hyber.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_145.pdf ciuscenter.org_hyber.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_149.pdf ciuscenter.org_hyber.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_182.pdf ciuscenter.org_hyber.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_184.pdf ciuscenter.org_hyber.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_19.pdf ciuscenter.org_hyber.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_21.pdf ciuscenter.org_hyber.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_35.pdf ciuscenter.org_hyber.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_95.pdf ciuscenter.org_hyber.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_111.pdf ciuscenter.org_hyber.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_137.pdf ciuscenter.org_hyber.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_153.pdf ciuscenter.org_hyber.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_177.pdf ciuscenter.org_hyber.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_92.pdf ciuscenter.org_hyber.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_122.pdf ciuscenter.org_hyber.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_139.pdf ciuscenter.org_hyber.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_188.pdf ciuscenter.org_hyber.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_11.pdf ciuscenter.org_hyber.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_41.pdf ciuscenter.org_hyber.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_48.pdf ciuscenter.org_hyber.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_67.pdf ciuscenter.org_hyber.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_94.pdf ciuscenter.org_hyber.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_102.pdf ciuscenter.org_hyber.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_112.pdf ciuscenter.org_hyber.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_121.pdf ciuscenter.org_hyber.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_108.pdf ciuscenter.org_hyber.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_119.pdf ciuscenter.org_hyber.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_125.pdf ciuscenter.org_hyber.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_126.pdf ciuscenter.org_hyber.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_127.pdf ciuscenter.org_hyber.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_133.pdf ciuscenter.org_hyber.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_150.pdf ciuscenter.org_hyber.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_155.pdf ciuscenter.org_hyber.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_1.pdf ciuscenter.org_hyber.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_3.pdf ciuscenter.org_hyber.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_64.pdf ciuscenter.org_hyber.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Stops running service(s) 4 TTPs
- Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-643422742-1162610606-620613169-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Malware = "C:\\Users\\Admin\\AppData\\Local\\Temp\\ciuscenter.org_hyber.exe" ciuscenter.org_hyber.exe Set value (str) \REGISTRY\USER\S-1-5-21-643422742-1162610606-620613169-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SysUpdate = "C:\\Users\\Admin\\AppData\\Local\\Temp\\ciuscenter.org_hyber.exe" ciuscenter.org_hyber.exe - Drops desktop.ini file(s) 1 IoCs
description ioc Process File opened for modification C:\$RECYCLE.BIN\S-1-5-18\desktop.ini LogonUI.exe - Drops file in System32 directory 3 IoCs
description ioc Process File created C:\Windows\system32\svchost.exe ciuscenter.org_hyber.exe File created C:\Windows\system32\sysupdate.exe ciuscenter.org_hyber.exe File opened for modification C:\Windows\system32\sysupdate.exe ciuscenter.org_hyber.exe - Enumerates processes with tasklist 1 TTPs 1 IoCs
pid Process 5280 tasklist.exe - Sets desktop wallpaper using registry 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-643422742-1162610606-620613169-1000\Control Panel\Desktop\Wallpaper = "C:\\ProgramData\\SysUpdate\\wall.bmp" ciuscenter.org_hyber.exe - Launches sc.exe 10 IoCs
Sc.exe is a Windows utlilty to control services on the system.
pid Process 3092 sc.exe 1788 sc.exe 6044 sc.exe 1720 sc.exe 4756 sc.exe 3952 sc.exe 3152 sc.exe 3316 sc.exe 1692 sc.exe 5548 sc.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs
Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.
description ioc Process Key opened \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe - Gathers network information 2 TTPs 2 IoCs
Uses commandline utility to view network configuration.
pid Process 5304 NETSTAT.EXE 2760 ipconfig.exe - Gathers system information 1 TTPs 1 IoCs
Runs systeminfo.exe.
pid Process 3724 systeminfo.exe - Interacts with shadow copies 3 TTPs 2 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
pid Process 6132 vssadmin.exe 2768 vssadmin.exe - Modifies Control Panel 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-643422742-1162610606-620613169-1000\Control Panel\Desktop\WallpaperStyle = "2" ciuscenter.org_hyber.exe - Modifies data under HKEY_USERS 25 IoCs
description ioc Process Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglow = "3288365271" LogonUI.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached LogonUI.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\TelemetrySalt = "3" LogonUI.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\BitBucket\Volume LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationBlurBalance = "1" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationGlassAttribute = "1" LogonUI.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{40DD6E20-7C17-11CE-A804-00AA003CA9F6} {000214FC-0000-0000-C000-000000000046} 0xFFFF = 0100000000000000cd2a4b6e88dcdc01 LogonUI.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\BitBucket\Volume\{6fcb6a2b-0000-0000-0000-d01200000000} LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\BitBucket\Volume\{6fcb6a2b-0000-0000-0000-d01200000000}\MaxCapacity = "13092" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\EnableWindowColorization = "149" LogonUI.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\StartColorMenu = "4288567808" LogonUI.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColorBalance = "89" LogonUI.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\system32\shell32.dll,-50176 = "File Operation" LogonUI.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\BitBucket LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\BitBucket\Volume\{6fcb6a2b-0000-0000-0000-d01200000000}\NukeOnDelete = "0" LogonUI.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent LogonUI.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentPalette = a6d8ff0076b9ed00429ce3000078d700005a9e000042750000264200f7630c00 LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColor = "3288365271" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglowBalance = "10" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History\AutoColor = "0" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentColorMenu = "4292311040" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\AccentColor = "4292311040" LogonUI.exe - Modifies registry class 16 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-643422742-1162610606-620613169-1000_Classes\ms-settings\shell ciuscenter.org_hyber.exe Key deleted \REGISTRY\USER\S-1-5-21-643422742-1162610606-620613169-1000_Classes\ms-settings\shell\open\command ciuscenter.org_hyber.exe Set value (str) \REGISTRY\USER\S-1-5-21-643422742-1162610606-620613169-1000_Classes\.pdf\ = "PDFBotnet" ciuscenter.org_hyber.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\PDFBotnet\shell\open ciuscenter.org_hyber.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\PDFBotnet\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\ciuscenter.org_hyber.exe\" \"%1\"" ciuscenter.org_hyber.exe Key created \REGISTRY\USER\S-1-5-21-643422742-1162610606-620613169-1000_Classes\ms-settings\shell\open\command ciuscenter.org_hyber.exe Key deleted \REGISTRY\USER\S-1-5-21-643422742-1162610606-620613169-1000_Classes\ms-settings\shell\open ciuscenter.org_hyber.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\PDFBotnet ciuscenter.org_hyber.exe Key created \REGISTRY\USER\S-1-5-21-643422742-1162610606-620613169-1000_Classes\ms-settings ciuscenter.org_hyber.exe Set value (str) \REGISTRY\USER\S-1-5-21-643422742-1162610606-620613169-1000_Classes\ms-settings\shell\open\command\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\ciuscenter.org_hyber.exe" ciuscenter.org_hyber.exe Set value (str) \REGISTRY\USER\S-1-5-21-643422742-1162610606-620613169-1000_Classes\ms-settings\shell\open\command\DelegateExecute ciuscenter.org_hyber.exe Key deleted \REGISTRY\USER\S-1-5-21-643422742-1162610606-620613169-1000_Classes\ms-settings\shell ciuscenter.org_hyber.exe Key created \REGISTRY\USER\S-1-5-21-643422742-1162610606-620613169-1000_Classes\ms-settings\shell\open ciuscenter.org_hyber.exe Key deleted \REGISTRY\USER\S-1-5-21-643422742-1162610606-620613169-1000_Classes\ms-settings ciuscenter.org_hyber.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\PDFBotnet\shell\open\command ciuscenter.org_hyber.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\PDFBotnet\shell ciuscenter.org_hyber.exe - Runs net.exe
- Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 640 schtasks.exe 3668 schtasks.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 764 powershell.exe 764 powershell.exe 4724 ciuscenter.org_hyber.exe 4724 ciuscenter.org_hyber.exe 4724 ciuscenter.org_hyber.exe 4724 ciuscenter.org_hyber.exe 4724 ciuscenter.org_hyber.exe 4724 ciuscenter.org_hyber.exe 4724 ciuscenter.org_hyber.exe 4724 ciuscenter.org_hyber.exe 4724 ciuscenter.org_hyber.exe 4724 ciuscenter.org_hyber.exe 4724 ciuscenter.org_hyber.exe 4724 ciuscenter.org_hyber.exe 4724 ciuscenter.org_hyber.exe 4724 ciuscenter.org_hyber.exe 4724 ciuscenter.org_hyber.exe 4724 ciuscenter.org_hyber.exe 4724 ciuscenter.org_hyber.exe 4724 ciuscenter.org_hyber.exe 4724 ciuscenter.org_hyber.exe 4724 ciuscenter.org_hyber.exe 4724 ciuscenter.org_hyber.exe 4724 ciuscenter.org_hyber.exe 4724 ciuscenter.org_hyber.exe 4724 ciuscenter.org_hyber.exe 4724 ciuscenter.org_hyber.exe 4724 ciuscenter.org_hyber.exe 4724 ciuscenter.org_hyber.exe 4724 ciuscenter.org_hyber.exe 4724 ciuscenter.org_hyber.exe 4724 ciuscenter.org_hyber.exe 4724 ciuscenter.org_hyber.exe 4724 ciuscenter.org_hyber.exe 4724 ciuscenter.org_hyber.exe 4724 ciuscenter.org_hyber.exe 4724 ciuscenter.org_hyber.exe 4724 ciuscenter.org_hyber.exe 4724 ciuscenter.org_hyber.exe 4724 ciuscenter.org_hyber.exe 4724 ciuscenter.org_hyber.exe 4724 ciuscenter.org_hyber.exe 4724 ciuscenter.org_hyber.exe 4724 ciuscenter.org_hyber.exe 4724 ciuscenter.org_hyber.exe 4724 ciuscenter.org_hyber.exe 4724 ciuscenter.org_hyber.exe 4724 ciuscenter.org_hyber.exe 4724 ciuscenter.org_hyber.exe 4724 ciuscenter.org_hyber.exe 4724 ciuscenter.org_hyber.exe 4724 ciuscenter.org_hyber.exe 4724 ciuscenter.org_hyber.exe 4724 ciuscenter.org_hyber.exe 4724 ciuscenter.org_hyber.exe 4724 ciuscenter.org_hyber.exe 4724 ciuscenter.org_hyber.exe 4724 ciuscenter.org_hyber.exe 4724 ciuscenter.org_hyber.exe 4724 ciuscenter.org_hyber.exe 4724 ciuscenter.org_hyber.exe 4724 ciuscenter.org_hyber.exe 4724 ciuscenter.org_hyber.exe 4724 ciuscenter.org_hyber.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 4780 LogonUI.exe Token: SeCreatePagefilePrivilege 4780 LogonUI.exe Token: SeDebugPrivilege 4724 ciuscenter.org_hyber.exe Token: SeDebugPrivilege 764 powershell.exe Token: SeIncBasePriorityPrivilege 4724 ciuscenter.org_hyber.exe Token: SeDebugPrivilege 5280 tasklist.exe Token: SeDebugPrivilege 5304 NETSTAT.EXE Token: SeDebugPrivilege 2304 whoami.exe Token: SeBackupPrivilege 3296 vssvc.exe Token: SeRestorePrivilege 3296 vssvc.exe Token: SeAuditPrivilege 3296 vssvc.exe Token: SeIncreaseQuotaPrivilege 5992 WMIC.exe Token: SeSecurityPrivilege 5992 WMIC.exe Token: SeTakeOwnershipPrivilege 5992 WMIC.exe Token: SeLoadDriverPrivilege 5992 WMIC.exe Token: SeSystemProfilePrivilege 5992 WMIC.exe Token: SeSystemtimePrivilege 5992 WMIC.exe Token: SeProfSingleProcessPrivilege 5992 WMIC.exe Token: SeIncBasePriorityPrivilege 5992 WMIC.exe Token: SeCreatePagefilePrivilege 5992 WMIC.exe Token: SeBackupPrivilege 5992 WMIC.exe Token: SeRestorePrivilege 5992 WMIC.exe Token: SeShutdownPrivilege 5992 WMIC.exe Token: SeDebugPrivilege 5992 WMIC.exe Token: SeSystemEnvironmentPrivilege 5992 WMIC.exe Token: SeRemoteShutdownPrivilege 5992 WMIC.exe Token: SeUndockPrivilege 5992 WMIC.exe Token: SeManageVolumePrivilege 5992 WMIC.exe Token: 33 5992 WMIC.exe Token: 34 5992 WMIC.exe Token: 35 5992 WMIC.exe Token: 36 5992 WMIC.exe Token: SeIncreaseQuotaPrivilege 5992 WMIC.exe Token: SeSecurityPrivilege 5992 WMIC.exe Token: SeTakeOwnershipPrivilege 5992 WMIC.exe Token: SeLoadDriverPrivilege 5992 WMIC.exe Token: SeSystemProfilePrivilege 5992 WMIC.exe Token: SeSystemtimePrivilege 5992 WMIC.exe Token: SeProfSingleProcessPrivilege 5992 WMIC.exe Token: SeIncBasePriorityPrivilege 5992 WMIC.exe Token: SeCreatePagefilePrivilege 5992 WMIC.exe Token: SeBackupPrivilege 5992 WMIC.exe Token: SeRestorePrivilege 5992 WMIC.exe Token: SeShutdownPrivilege 5992 WMIC.exe Token: SeDebugPrivilege 5992 WMIC.exe Token: SeSystemEnvironmentPrivilege 5992 WMIC.exe Token: SeRemoteShutdownPrivilege 5992 WMIC.exe Token: SeUndockPrivilege 5992 WMIC.exe Token: SeManageVolumePrivilege 5992 WMIC.exe Token: 33 5992 WMIC.exe Token: 34 5992 WMIC.exe Token: 35 5992 WMIC.exe Token: 36 5992 WMIC.exe Token: SeIncreaseQuotaPrivilege 764 WMIC.exe Token: SeSecurityPrivilege 764 WMIC.exe Token: SeTakeOwnershipPrivilege 764 WMIC.exe Token: SeLoadDriverPrivilege 764 WMIC.exe Token: SeSystemProfilePrivilege 764 WMIC.exe Token: SeSystemtimePrivilege 764 WMIC.exe Token: SeProfSingleProcessPrivilege 764 WMIC.exe Token: SeIncBasePriorityPrivilege 764 WMIC.exe Token: SeCreatePagefilePrivilege 764 WMIC.exe Token: SeBackupPrivilege 764 WMIC.exe Token: SeRestorePrivilege 764 WMIC.exe - Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 4724 ciuscenter.org_hyber.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 4780 LogonUI.exe 4724 ciuscenter.org_hyber.exe - Suspicious use of WriteProcessMemory 39 IoCs
description pid Process procid_target PID 4724 wrote to memory of 764 4724 ciuscenter.org_hyber.exe 85 PID 4724 wrote to memory of 3092 4724 ciuscenter.org_hyber.exe 87 PID 4724 wrote to memory of 1788 4724 ciuscenter.org_hyber.exe 89 PID 4724 wrote to memory of 6044 4724 ciuscenter.org_hyber.exe 91 PID 4724 wrote to memory of 1720 4724 ciuscenter.org_hyber.exe 93 PID 4724 wrote to memory of 3152 4724 ciuscenter.org_hyber.exe 95 PID 4724 wrote to memory of 3316 4724 ciuscenter.org_hyber.exe 97 PID 4724 wrote to memory of 4756 4724 ciuscenter.org_hyber.exe 99 PID 4724 wrote to memory of 3952 4724 ciuscenter.org_hyber.exe 101 PID 4724 wrote to memory of 1944 4724 ciuscenter.org_hyber.exe 103 PID 1944 wrote to memory of 624 1944 fodhelper.exe 104 PID 4724 wrote to memory of 5644 4724 ciuscenter.org_hyber.exe 106 PID 4724 wrote to memory of 640 4724 ciuscenter.org_hyber.exe 107 PID 4724 wrote to memory of 1072 4724 ciuscenter.org_hyber.exe 111 PID 4724 wrote to memory of 1448 4724 ciuscenter.org_hyber.exe 112 PID 4724 wrote to memory of 2020 4724 ciuscenter.org_hyber.exe 113 PID 4724 wrote to memory of 2588 4724 ciuscenter.org_hyber.exe 114 PID 4724 wrote to memory of 3940 4724 ciuscenter.org_hyber.exe 115 PID 4724 wrote to memory of 4484 4724 ciuscenter.org_hyber.exe 116 PID 4724 wrote to memory of 4124 4724 ciuscenter.org_hyber.exe 117 PID 4724 wrote to memory of 3668 4724 ciuscenter.org_hyber.exe 125 PID 4724 wrote to memory of 736 4724 ciuscenter.org_hyber.exe 126 PID 4124 wrote to memory of 5304 4124 cmd.exe 128 PID 2020 wrote to memory of 5280 2020 cmd.exe 129 PID 2588 wrote to memory of 2304 2588 cmd.exe 130 PID 4484 wrote to memory of 2760 4484 cmd.exe 131 PID 1448 wrote to memory of 3724 1448 cmd.exe 132 PID 3940 wrote to memory of 6024 3940 cmd.exe 133 PID 1072 wrote to memory of 6132 1072 cmd.exe 134 PID 6024 wrote to memory of 2816 6024 net.exe 135 PID 4724 wrote to memory of 2868 4724 ciuscenter.org_hyber.exe 138 PID 1072 wrote to memory of 5992 1072 cmd.exe 139 PID 4724 wrote to memory of 2768 4724 ciuscenter.org_hyber.exe 140 PID 4724 wrote to memory of 764 4724 ciuscenter.org_hyber.exe 141 PID 4724 wrote to memory of 4072 4724 ciuscenter.org_hyber.exe 142 PID 4724 wrote to memory of 2972 4724 ciuscenter.org_hyber.exe 143 PID 4724 wrote to memory of 5548 4724 ciuscenter.org_hyber.exe 146 PID 4724 wrote to memory of 1692 4724 ciuscenter.org_hyber.exe 148 PID 4072 wrote to memory of 2500 4072 net.exe 156 - Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
- Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\ciuscenter.org_hyber.exe"C:\Users\Admin\AppData\Local\Temp\ciuscenter.org_hyber.exe"1⤵
- Modifies Windows Defender DisableAntiSpyware settings
- Disables RegEdit via registry modification
- Drops file in Drivers directory
- Checks computer location settings
- Drops startup file
- Adds Run key to start application
- Drops file in System32 directory
- Sets desktop wallpaper using registry
- Modifies Control Panel
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4724 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoP -NonI -W Hidden -Exec Bypass -Enc UwBlAHQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARABpAHMAYQBiAGwAZQBSAGUAYQBsAHQAaQBtAGUATQBvAG4AaQB0AG8AcgBpAG4AZwAgACQAdAByAHUAZQA7ACAAUwBlAHQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARABpAHMAYQBiAGwAZQBCAGUAaABhAHYAaQBvAHIATQBvAG4AaQB0AG8AcgBpAG4AZwAgACQAdAByAHUAZQA=2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:764
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" stop wscsvc2⤵
- Launches sc.exe
PID:3092
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" config wscsvc start= disabled2⤵
- Launches sc.exe
PID:1788
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" stop SecurityHealthService2⤵
- Launches sc.exe
PID:6044
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" config SecurityHealthService start= disabled2⤵
- Launches sc.exe
PID:1720
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" stop WinDefend2⤵
- Launches sc.exe
PID:3152
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" config WinDefend start= disabled2⤵
- Launches sc.exe
PID:3316
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" stop MsMpSvc2⤵
- Launches sc.exe
PID:4756
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" config MsMpSvc start= disabled2⤵
- Launches sc.exe
PID:3952
-
-
C:\Windows\System32\fodhelper.exe"C:\Windows\System32\fodhelper.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:1944 -
C:\Users\Admin\AppData\Local\Temp\ciuscenter.org_hyber.exe"C:\Users\Admin\AppData\Local\Temp\ciuscenter.org_hyber.exe"3⤵PID:624
-
-
-
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" C:\Users\Admin\AppData\Local\Temp\makelnk.vbs2⤵PID:5644
-
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks" /create /tn "SysUpdateTask" /tr "C:\Users\Admin\AppData\Local\Temp\ciuscenter.org_hyber.exe" /sc onlogon /f2⤵
- Scheduled Task/Job: Scheduled Task
PID:640
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\del.bat" "2⤵
- Suspicious use of WriteProcessMemory
PID:1072 -
C:\Windows\system32\vssadmin.exevssadmin delete shadows /all /quiet3⤵
- Interacts with shadow copies
PID:6132
-
-
C:\Windows\System32\Wbem\WMIC.exewmic shadowcopy delete3⤵
- Suspicious use of AdjustPrivilegeToken
PID:5992
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c systeminfo > "C:\ProgramData\SysUpdate\Logs\sysinfo.txt"2⤵
- Suspicious use of WriteProcessMemory
PID:1448 -
C:\Windows\system32\systeminfo.exesysteminfo3⤵
- Gathers system information
PID:3724
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c tasklist > "C:\ProgramData\SysUpdate\Logs\tasklist.txt"2⤵
- Suspicious use of WriteProcessMemory
PID:2020 -
C:\Windows\system32\tasklist.exetasklist3⤵
- Enumerates processes with tasklist
- Suspicious use of AdjustPrivilegeToken
PID:5280
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c whoami > "C:\ProgramData\SysUpdate\Logs\whoami.txt"2⤵
- Suspicious use of WriteProcessMemory
PID:2588 -
C:\Windows\system32\whoami.exewhoami3⤵
- Suspicious use of AdjustPrivilegeToken
PID:2304
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c net user > "C:\ProgramData\SysUpdate\Logs\netuser.txt"2⤵
- Suspicious use of WriteProcessMemory
PID:3940 -
C:\Windows\system32\net.exenet user3⤵
- Suspicious use of WriteProcessMemory
PID:6024 -
C:\Windows\system32\net1.exeC:\Windows\system32\net1 user4⤵PID:2816
-
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c ipconfig /all > "C:\ProgramData\SysUpdate\Logs\ipconfig.txt"2⤵
- Suspicious use of WriteProcessMemory
PID:4484 -
C:\Windows\system32\ipconfig.exeipconfig /all3⤵
- Gathers network information
PID:2760
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c netstat -an > "C:\ProgramData\SysUpdate\Logs\netstat.txt"2⤵
- Suspicious use of WriteProcessMemory
PID:4124 -
C:\Windows\system32\NETSTAT.EXEnetstat -an3⤵
- Gathers network information
- Suspicious use of AdjustPrivilegeToken
PID:5304
-
-
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks" /create /tn "RansomwareCheck" /tr "C:\Users\Admin\AppData\Local\Temp\ciuscenter.org_hyber.exe" /sc daily /f2⤵
- Scheduled Task/Job: Scheduled Task
PID:3668
-
-
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" C:\Users\Admin\AppData\Local\Temp\createshortcut.vbs2⤵PID:736
-
-
C:\Windows\System32\notepad.exe"C:\Windows\System32\notepad.exe"2⤵PID:2868
-
-
C:\Windows\System32\vssadmin.exe"C:\Windows\System32\vssadmin.exe" delete shadows /all /quiet2⤵
- Interacts with shadow copies
PID:2768
-
-
C:\Windows\System32\wbem\WMIC.exe"C:\Windows\System32\wbem\WMIC.exe" shadowcopy delete2⤵
- Suspicious use of AdjustPrivilegeToken
PID:764
-
-
C:\Windows\System32\net.exe"C:\Windows\System32\net.exe" stop srservice2⤵
- Suspicious use of WriteProcessMemory
PID:4072 -
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop srservice3⤵PID:2500
-
-
-
C:\Windows\System32\netsh.exe"C:\Windows\System32\netsh.exe" advfirewall set allprofiles state off2⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
PID:2972
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" config i8042prt start= disabled2⤵
- Launches sc.exe
PID:5548
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" stop i8042prt2⤵
- Launches sc.exe
PID:1692
-
-
C:\Windows\system32\LogonUI.exe"LogonUI.exe" /flags:0x0 /state0:0xa39ab855 /state1:0x41c64e6d1⤵
- Drops desktop.ini file(s)
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:4780
-
C:\Users\Admin\AppData\Local\Temp\ciuscenter.org_hyber.exeC:\Users\Admin\AppData\Local\Temp\ciuscenter.org_hyber.exe1⤵PID:544
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3296
Network
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
2PowerShell
1Scheduled Task/Job
1Scheduled Task
1System Services
2Service Execution
2Windows Management Instrumentation
1Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
4Windows Service
4Event Triggered Execution
1Netsh Helper DLL
1Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
4Windows Service
4Event Triggered Execution
1Netsh Helper DLL
1Scheduled Task/Job
1Scheduled Task
1Defense Evasion
Direct Volume Access
1Impair Defenses
3Disable or Modify System Firewall
1Disable or Modify Tools
1Indicator Removal
2File Deletion
2Modify Registry
3Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\ProgramData\Microsoft\Windows\SystemData\S-1-5-21-643422742-1162610606-620613169-1000\ReadOnly\LockScreen_O\LockScreen___1920_1080_notdimmed.jpg
- Size 698KB
- SHA256 1cc5623a64bb53aa4bc79eaa58b220bc4aaa36404ae51a3a76ba3e1bbb9dc180
- MD5 f501cf66769fa83d4a5b7dab1bb16bf3
- SHA1 1282b9885c9b9d66a5837d391aa4e899f8ec0c76
- SHA512 cf020e5933f2f457faadf3ee67e9b1beb4c1842507ef8c9b981308ff9d48c6ee5663807f4a3171ebf6b60d438dc60cefb7a8a1883d82526967b835225d4a2348
- SSDEEP 12288:3pQyHmW2eDmruEcK3jTJC41OwdXp5f5DW8nf+40CHi9A/e12eRaVaysrLi5OpRbN:3pxmZ/ruEcKzTsKOwBp5f57G6i9w/A8m
- TLSH T1E3E4331EAA658A8BB83DCD2D81C641C638742FE450C451FFF02AFA48DB71DC5E768AC5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\invoice_1.pdf
- Size 69KB
- SHA256 37a1f0c8e8700ceb764c2719384758ca85993e41a32979ec92b6652d028a27a3
- MD5 60fb14ca66ea7fb7b4a15282f6d41d22
- SHA1 aad9d4622ff358512123965fd948b461d15f8c4b
- SHA512 9f2ee2bea3b5fc322ae9abe8f23c49cfdef12a8ac3de3bb1dd6f19f2c48e93f98d8582739b991b659aded7c2bff3b4ee0d3f65df0830fb9dfe098608fe7bf38e
- SSDEEP 1536:43PIB0d9vnV1TBp2tm9GErXzlpa5+IcbdUrvcE/a44V8OI89zReLvj80Cte4:4Nn19p2A/rzLa5+yUI4V8T89zReLvo0c
- TLSH T1D5634A379A23FCC1673F2D80F05439960C853A6B87B466ACFFC50A9A29D5644DF2E49C
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\SystemVolumeInformation\doc_3.pdf
- Size 68KB
- SHA256 768ae0fb4cba56c43fe69ecca35067a0092bbe2cd6b50501b8d46e9f813c38c5
- MD5 91854fd5eaa541352a642882cbc9a9c3
- SHA1 b22d3fe4cbbfb05dc2ac616acae170f1d6629154
- SHA512 c98c512b5413710614cc24aa7a2403c4d77258c304894014ec4140b66de6458cbfc2afec088124038a65608114d9a3e3bb50a1855945869046a52c754e7ad32e
- SSDEEP 1536:Y3PIB0d9vnV1TBp2tm9GErXzlpa5+IcbdUrvcE/a44V8OI89zReLvj80CteT:YNn19p2A/rzLa5+yUI4V8T89zReLvo0/
- TLSH T11C633A379A23FCC1673F2D80F05439950C853A6B97B4666CFFC50A9A29E6244DF2E49C
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\ciuscenter.org_hyber.exe.log
- Size 660B
- SHA256 f424c891fbc7385e9826beed2dd8755aeac5495744b5de0a1e370891a7beaf7a
- MD5 1c5e1d0ff3381486370760b0f2eb656b
- SHA1 f9df6be8804ef611063f1ff277e323b1215372de
- SHA512 78f5fc40a185d04c9e4a02a3d1b10b4bd684c579a45a0d1e8f49f8dee9018ed7bc8875cbf21f98632f93ead667214a41904226ce54817b85caeeb4b0de54a743
- TLSH T1CF014970227BA0D888152F942C2E2BC403BF0336B5509E187998729EEE264571F212E6
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_fgkzdcrd.vit.ps1
- Size 60B
- SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
- MD5 d17fe0a3f47be24a6453e9ef58c94641
- SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
- SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
- TLSH T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\createshortcut.vbs
- Size 245B
- SHA256 84086f6a65c3ba195609d120eb20100eadcc2eca13bfc2de478e4c21106b49fb
- MD5 f8e2b2fdb98c428f68dbafe5d33fe850
- SHA1 329a67102bdadebd67367b6c1352e8b5cacbb416
- SHA512 b0cd81a7ef964b19fc83d13e5bb3f89ad75f89651e84dadb2d8389eeb1a83fcc452ac1c33c9e80ce05c2ed80702545d2b317e68562313af19e378964c435dc37
- TLSH T173D0A557754DC5650001627741F38D4CD5E5841837577E618955DD4E31D148585F5543
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\del.bat
- Size 59B
- SHA256 a51f2a0f053ac35b4158bb02b75421ab3698e1d0ee4f926abf1bae3af1570c53
- MD5 9cecbebdcdd60358132849714a3b82f7
- SHA1 be6e20834a5726f3742f05e6bdfaff16118b147f
- SHA512 7b48bd66b4c741d2de2e8b7bc0eab8f438ddc1ed0c73e8b70add9bee400f6640f692884965032616e2d6911a22a17d1d3762421aa49fe021660c9052cfc0675a
- TLSH T13DA002620F961E5469529E5AD73425239D1F104CD1390012F05232903DA98DE0EC2144
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\makelnk.vbs
- Size 246B
- SHA256 48045b6380959c55cfa38147ca056090ac425d89249d9fd013534a9f636de365
- MD5 c9a684ab56a151e3b9cad9cdf0dff3ee
- SHA1 cb31bbce93323b0ce71a64b56fc0aed35e996e89
- SHA512 8dc69c93d118ba3d12208e6658d4fa5897cdf3eb78e1a119e729521fa2afcf52a0ab88602c7cec0fa59680452daf67ea98073cfc659cc20bf42f342f3f6f1760
- TLSH T10FD0A597754DC5650001627B40F38D4CD6D184183B577E61D955DD0F32D144585F5543
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\System32\sysupdate.exe
- Size 51KB
- SHA256 a8a9f30697664b488ba07a8716167b94350c162c2f424b4e15ef59d9552d0710
- MD5 fbf8476865de6c5e32069758ccc065d2
- SHA1 5c1d6ac63bcacf2f89420e484a14a9a818f33b17
- SHA512 59105f73dd0c0072f19aa3f04f7d2db5f0f9c6e654518290bf09f02d5ccaab0bd15dccf8a583f481bd3501d5f9c15e271b2b29a9311b65f6479c2c81cc500398
- SSDEEP 768:eVTtLYhD+7o19oDJLnk5zATSulgSs/lnhaeG7MPLf9jSvB8hE2R:sYhD+YuhnUSgL/GuljS587R
- TLSH T13233084837ED4112E5BF4EBE95B190529332F463DD22DB8E0AD8459E09E3B44CC68B6B
- MD5 SHA1 SHA512 SSDEEP TLSH