Overview
overview
8Static
static
3iOS_Indexi...on.zip
windows10-2004-x64
1iOS_Indexi...on.zip
windows11-ltsc_2024-x64
1IosIndexin...ss.exe
windows10-2004-x64
7IosIndexin...ss.exe
windows11-ltsc_2024-x64
7IosIndexin...ss.pyc
windows10-2004-x64
3IosIndexin...ss.pyc
windows11-ltsc_2024-x64
8README_One...on.txt
windows10-2004-x64
1README_One...on.txt
windows11-ltsc_2024-x64
1Start-iOS-...er.cmd
windows10-2004-x64
3Start-iOS-...er.cmd
windows11-ltsc_2024-x64
3Start-iOS-...er.ps1
windows10-2004-x64
3Start-iOS-...er.ps1
windows11-ltsc_2024-x64
3Analysis
- max time kernel
149s - max time network
129s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
22/06/2026, 15:01
Behavioral task
behavioral1
Sample
iOS_Indexing_Checker_Windows_NoPython.zip
Resource
win10v2004-20260513-en
Behavioral task
behavioral2
Sample
iOS_Indexing_Checker_Windows_NoPython.zip
Resource
win11ltsc2024-20260617-en
Behavioral task
behavioral3
Sample
IosIndexingProgress.exe
Resource
win10v2004-20260513-en
Behavioral task
behavioral4
Sample
IosIndexingProgress.exe
Resource
win11ltsc2024-20260617-en
Behavioral task
behavioral5
Sample
IosIndexingProgress.pyc
Resource
win10v2004-20260513-en
Behavioral task
behavioral6
Sample
IosIndexingProgress.pyc
Resource
win11ltsc2024-20260617-en
Behavioral task
behavioral7
Sample
README_OneClick_Distribution.txt
Resource
win10v2004-20260513-en
Behavioral task
behavioral8
Sample
README_OneClick_Distribution.txt
Resource
win11ltsc2024-20260617-en
Behavioral task
behavioral9
Sample
Start-iOS-Indexing-Checker.cmd
Resource
win10v2004-20260513-en
Behavioral task
behavioral10
Sample
Start-iOS-Indexing-Checker.cmd
Resource
win11ltsc2024-20260618-en
Behavioral task
behavioral11
Sample
Start-iOS-Indexing-Checker.ps1
Resource
win10v2004-20260513-en
Behavioral task
behavioral12
Sample
Start-iOS-Indexing-Checker.ps1
Resource
win11ltsc2024-20260618-en
General
- Target IosIndexingProgress.pyc
- Size 8KB
- Sample260622-sd87wsdw8n
- SHA256 6449a03fafc886c6713abd7de4d3c7e10dc3c1547355a66960b5673d4231b3d5
- MD5 aa3aaaee23b422aa3dd3074a6b97e1cb
- SHA1 927813c06e17c69fa3ed00d0b62da82bd83b7306
- SHA512 0b6ffc0681b499147a3dadef7e46151c6676d20bfcf9607c6a871bed10096af4bf55b57788e37a505f2a84c44c061f4587b4a5cc79ebaf3fed7922343710b9a0
- SSDEEP 192:QNmFsPMbDgTR2ottYnR5FQ2fRvXnMH6w8y6XGVb:myIqkdJtWR5TfhXnMLaYb
- TLSH T182125C443A088663FCABF0FD550483282D71162C6B9855E39A4F83EEEF85790683D3D9
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Modifies registry class 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings cmd.exe Key created \REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings OpenWith.exe - Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 4996 OpenWith.exe