Analysis

  • max time kernel
    150s
  • max time network
    130s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    02/08/2026, 19:58

General

  • Target
    OOSU10.exe
  • Size 76.3MB
  • Sample260802-yp7fbsfa52
  • SHA256 616a90bffc2f290c3f51bc5852b665445af9fcb17d863ed92dcdf68fb297bb47
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
4/10

Malware Config

Signatures

  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Loads dropped DLL 50 IoCs
  • Suspicious use of AdjustPrivilegeToken 5 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\OOSU10.exe
    "C:\Users\Admin\AppData\Local\Temp\OOSU10.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of AdjustPrivilegeToken
    PID:4212

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        OOSU10.cfg

        • Path C:\Users\Admin\AppData\Local\OO Software\OO ShutUp10\OOSU10.cfg
        • Size 1KB
        • SHA256 61c4f0a9d10714c644a307fe04596315de184b9b984c950b6040b641a80c0642
        • MD5 SHA1 SHA512 TLSH

        OOSU10.cfg

        • Path C:\Users\Admin\AppData\Local\OO Software\OO ShutUp10\OOSU10.cfg
        • Size 16KB
        • SHA256 079395cd6dc160ba43a24b184118ff424e8788036168cdb552b927a6623b68b2
        • MD5 SHA1 SHA512 SSDEEP TLSH

        OOSU10.cfg~RFe5973cf.TMP

        • Path C:\Users\Admin\AppData\Local\OO Software\OO ShutUp10\OOSU10.cfg~RFe5973cf.TMP
        • Size 1KB
        • SHA256 2fe9624d5552671ad5ece9f11e0a117b69fb09d5c4a32b463d3b138cf3d9a99d
        • MD5 SHA1 SHA512 TLSH

        D3DCompiler_47_cor3.dll

        • Path C:\Users\Admin\AppData\Local\Temp\.net\OOSU10\NBkwFNUEeiOtmLHPhdf7HfEizaVDHyQ=\D3DCompiler_47_cor3.dll
        • Size 4.7MB
        • SHA256 a05d04a270f68c8c6d6ea2d23bebf8cd1d5453b26b5442fa54965f90f1c62082
        • MD5 SHA1 SHA512 SSDEEP TLSH

        DirectWriteForwarder.dll

        • Path C:\Users\Admin\AppData\Local\Temp\.net\OOSU10\NBkwFNUEeiOtmLHPhdf7HfEizaVDHyQ=\DirectWriteForwarder.dll
        • Size 490KB
        • SHA256 a8d135a59a84ef85b0a1ee517f2e4f40b45a02a4c4e3d268aef7e29583579c18
        • MD5 SHA1 SHA512 SSDEEP TLSH

        Microsoft.Win32.Registry.dll

        • Path C:\Users\Admin\AppData\Local\Temp\.net\OOSU10\NBkwFNUEeiOtmLHPhdf7HfEizaVDHyQ=\Microsoft.Win32.Registry.dll
        • Size 118KB
        • SHA256 7e2c5dde6a8ac83a9075b4ae3052175541d3a3cd57da23f50070f93701e077c8
        • MD5 SHA1 SHA512 SSDEEP TLSH

        PresentationCore.dll

        • Path C:\Users\Admin\AppData\Local\Temp\.net\OOSU10\NBkwFNUEeiOtmLHPhdf7HfEizaVDHyQ=\PresentationCore.dll
        • Size 8.1MB
        • SHA256 f27377e45fd2676f7ca1b119113539181726d1bc0150e39f1c477adcabd7e7ea
        • MD5 SHA1 SHA512 SSDEEP TLSH

        PresentationFramework-SystemXml.dll

        • Path C:\Users\Admin\AppData\Local\Temp\.net\OOSU10\NBkwFNUEeiOtmLHPhdf7HfEizaVDHyQ=\PresentationFramework-SystemXml.dll
        • Size 34KB
        • SHA256 f860512d489645ff8d8740a20f852642a73970f471ec4eca01233dea73c1a4a2
        • MD5 SHA1 SHA512 SSDEEP TLSH

        PresentationFramework.Aero2.dll

        • Path C:\Users\Admin\AppData\Local\Temp\.net\OOSU10\NBkwFNUEeiOtmLHPhdf7HfEizaVDHyQ=\PresentationFramework.Aero2.dll
        • Size 438KB
        • SHA256 8c2130b6729351398ca93b1794500d5d109546fc1b8bc3d596dfe8e9d73d051f
        • MD5 SHA1 SHA512 SSDEEP TLSH

        PresentationFramework.dll

        • Path C:\Users\Admin\AppData\Local\Temp\.net\OOSU10\NBkwFNUEeiOtmLHPhdf7HfEizaVDHyQ=\PresentationFramework.dll
        • Size 15.4MB
        • SHA256 750acfdebb8ab33851b91069b647491806d074a374828c8723b6e034b821ec85
        • MD5 SHA1 SHA512 SSDEEP TLSH

        PresentationNative_cor3.dll

        • Path C:\Users\Admin\AppData\Local\Temp\.net\OOSU10\NBkwFNUEeiOtmLHPhdf7HfEizaVDHyQ=\PresentationNative_cor3.dll
        • Size 1.2MB
        • SHA256 36a4da0eef1dfec37488a065efdac01e7c7757539c5d4b58964a6ba50ae122d9
        • MD5 SHA1 SHA512 SSDEEP TLSH

        System.Collections.Concurrent.dll

        • Path C:\Users\Admin\AppData\Local\Temp\.net\OOSU10\NBkwFNUEeiOtmLHPhdf7HfEizaVDHyQ=\System.Collections.Concurrent.dll
        • Size 270KB
        • SHA256 a7d310161f28456c02121ff37e10a156ed61a35fd92173bbb188992706a3d94e
        • MD5 SHA1 SHA512 SSDEEP TLSH

        System.Collections.NonGeneric.dll

        • Path C:\Users\Admin\AppData\Local\Temp\.net\OOSU10\NBkwFNUEeiOtmLHPhdf7HfEizaVDHyQ=\System.Collections.NonGeneric.dll
        • Size 102KB
        • SHA256 41ccd641bf2ea9e80a4e3b50178361fc3c425e45260fa0ced110b1f12cb56db4
        • MD5 SHA1 SHA512 SSDEEP TLSH

        System.Collections.Specialized.dll

        • Path C:\Users\Admin\AppData\Local\Temp\.net\OOSU10\NBkwFNUEeiOtmLHPhdf7HfEizaVDHyQ=\System.Collections.Specialized.dll
        • Size 102KB
        • SHA256 9060cb537394bec915c1e57b0516725b1a7d5115b995da1857548f271330061f
        • MD5 SHA1 SHA512 SSDEEP TLSH

        System.Collections.dll

        • Path C:\Users\Admin\AppData\Local\Temp\.net\OOSU10\NBkwFNUEeiOtmLHPhdf7HfEizaVDHyQ=\System.Collections.dll
        • Size 254KB
        • SHA256 e0c2f5d45c0b99d8afe0234e8527cc1097f220b6aa256ea751611c2d7763742e
        • MD5 SHA1 SHA512 SSDEEP TLSH

        System.ComponentModel.Primitives.dll

        • Path C:\Users\Admin\AppData\Local\Temp\.net\OOSU10\NBkwFNUEeiOtmLHPhdf7HfEizaVDHyQ=\System.ComponentModel.Primitives.dll
        • Size 78KB
        • SHA256 078f044ded212ad3e6f20bd4d1434bcb5c69165e1e128c97c5603e2d8cef58f1
        • MD5 SHA1 SHA512 SSDEEP TLSH

        System.ComponentModel.TypeConverter.dll

        • Path C:\Users\Admin\AppData\Local\Temp\.net\OOSU10\NBkwFNUEeiOtmLHPhdf7HfEizaVDHyQ=\System.ComponentModel.TypeConverter.dll
        • Size 730KB
        • SHA256 ce6d8dcd842765f56c63518245439bb42c258e6a1577e7e1fe121d857fb23cd3
        • MD5 SHA1 SHA512 SSDEEP TLSH

        System.ComponentModel.dll

        • Path C:\Users\Admin\AppData\Local\Temp\.net\OOSU10\NBkwFNUEeiOtmLHPhdf7HfEizaVDHyQ=\System.ComponentModel.dll
        • Size 30KB
        • SHA256 fdff94b67d5dbecc4cb17a187575e30b8d6ea137b577ea446502c8f25193a860
        • MD5 SHA1 SHA512 SSDEEP TLSH

        System.Configuration.ConfigurationManager.dll

        • Path C:\Users\Admin\AppData\Local\Temp\.net\OOSU10\NBkwFNUEeiOtmLHPhdf7HfEizaVDHyQ=\System.Configuration.ConfigurationManager.dll
        • Size 1.0MB
        • SHA256 a7eb879d6e3fd7a661735b8a22c0acd15b3394f0f7728066313513e50f87036f
        • MD5 SHA1 SHA512 SSDEEP TLSH

        System.Diagnostics.EventLog.dll

        • Path C:\Users\Admin\AppData\Local\Temp\.net\OOSU10\NBkwFNUEeiOtmLHPhdf7HfEizaVDHyQ=\System.Diagnostics.EventLog.dll
        • Size 378KB
        • SHA256 4205d2b0e6a5685b855f0b87633e94a3d7ab798fcc44e3de0595373be6ffac81
        • MD5 SHA1 SHA512 SSDEEP TLSH

        System.Diagnostics.FileVersionInfo.dll

        • Path C:\Users\Admin\AppData\Local\Temp\.net\OOSU10\NBkwFNUEeiOtmLHPhdf7HfEizaVDHyQ=\System.Diagnostics.FileVersionInfo.dll
        • Size 46KB
        • SHA256 9a704d87f286e72f69ad1c9417d5c6ca7a3af4cd9b056257543e996f48236f29
        • MD5 SHA1 SHA512 SSDEEP TLSH

        System.Diagnostics.Process.dll

        • Path C:\Users\Admin\AppData\Local\Temp\.net\OOSU10\NBkwFNUEeiOtmLHPhdf7HfEizaVDHyQ=\System.Diagnostics.Process.dll
        • Size 330KB
        • SHA256 9c500ae62a3337d1209c9de3fe3fef18077b9eb3e091a591150208f16f2f6e66
        • MD5 SHA1 SHA512 SSDEEP TLSH

        System.Diagnostics.TraceSource.dll

        • Path C:\Users\Admin\AppData\Local\Temp\.net\OOSU10\NBkwFNUEeiOtmLHPhdf7HfEizaVDHyQ=\System.Diagnostics.TraceSource.dll
        • Size 142KB
        • SHA256 3171986ac1851460357b4360e6ed8117aa40c1f135f85899ace3ae8f27d01db2
        • MD5 SHA1 SHA512 SSDEEP TLSH

        System.IO.Packaging.dll

        • Path C:\Users\Admin\AppData\Local\Temp\.net\OOSU10\NBkwFNUEeiOtmLHPhdf7HfEizaVDHyQ=\System.IO.Packaging.dll
        • Size 286KB
        • SHA256 f3fe995b844e558c2e7a17f2a211846c4710ca095acf6a2380aba23cebcbab11
        • MD5 SHA1 SHA512 SSDEEP TLSH

        System.Linq.Expressions.dll

        • Path C:\Users\Admin\AppData\Local\Temp\.net\OOSU10\NBkwFNUEeiOtmLHPhdf7HfEizaVDHyQ=\System.Linq.Expressions.dll
        • Size 3.5MB
        • SHA256 59619711c91b3e28a34b602ec5591a7794248a6d0648b0c4a426fed322234b77
        • MD5 SHA1 SHA512 SSDEEP TLSH

        System.Linq.dll

        • Path C:\Users\Admin\AppData\Local\Temp\.net\OOSU10\NBkwFNUEeiOtmLHPhdf7HfEizaVDHyQ=\System.Linq.dll
        • Size 530KB
        • SHA256 814d7e5fc33feee1d8820bc7f5e5f47b424872934b3391dd482876b57d8b680a
        • MD5 SHA1 SHA512 SSDEEP TLSH

        System.Memory.dll

        • Path C:\Users\Admin\AppData\Local\Temp\.net\OOSU10\NBkwFNUEeiOtmLHPhdf7HfEizaVDHyQ=\System.Memory.dll
        • Size 154KB
        • SHA256 de74fb773a3e814faca816b78194de7d9fede29f2910e834083da87d82e6dc1e
        • MD5 SHA1 SHA512 SSDEEP TLSH

        System.Net.Primitives.dll

        • Path C:\Users\Admin\AppData\Local\Temp\.net\OOSU10\NBkwFNUEeiOtmLHPhdf7HfEizaVDHyQ=\System.Net.Primitives.dll
        • Size 226KB
        • SHA256 f3aea69a4c7654a2c5f40802f3f5f3e3cd30d2713d694064bfd7eabf620b5a94
        • MD5 SHA1 SHA512 SSDEEP TLSH

        System.Net.Requests.dll

        • Path C:\Users\Admin\AppData\Local\Temp\.net\OOSU10\NBkwFNUEeiOtmLHPhdf7HfEizaVDHyQ=\System.Net.Requests.dll
        • Size 338KB
        • SHA256 7dcc705fa786d12ad0225bc7f1a07f4b541f23c2a7e88d1f2a2e6efd34079026
        • MD5 SHA1 SHA512 SSDEEP TLSH

        System.Net.WebClient.dll

        • Path C:\Users\Admin\AppData\Local\Temp\.net\OOSU10\NBkwFNUEeiOtmLHPhdf7HfEizaVDHyQ=\System.Net.WebClient.dll
        • Size 166KB
        • SHA256 1ad829174debb701de93d21b643d70dc13caaff4f56f388a669aa6452dfcea14
        • MD5 SHA1 SHA512 SSDEEP TLSH

        System.Net.WebHeaderCollection.dll

        • Path C:\Users\Admin\AppData\Local\Temp\.net\OOSU10\NBkwFNUEeiOtmLHPhdf7HfEizaVDHyQ=\System.Net.WebHeaderCollection.dll
        • Size 66KB
        • SHA256 a49230c81d7b5e26a27029b1c63ff95e65dc1fd37834d080fced081123044a32
        • MD5 SHA1 SHA512 SSDEEP TLSH

        System.ObjectModel.dll

        • Path C:\Users\Admin\AppData\Local\Temp\.net\OOSU10\NBkwFNUEeiOtmLHPhdf7HfEizaVDHyQ=\System.ObjectModel.dll
        • Size 78KB
        • SHA256 ff432fa3ac22a819e720c6d567124ff88810c6bbf4fa469ec19b1fa775e0a974
        • MD5 SHA1 SHA512 SSDEEP TLSH

        System.Private.CoreLib.dll

        • Path C:\Users\Admin\AppData\Local\Temp\.net\OOSU10\NBkwFNUEeiOtmLHPhdf7HfEizaVDHyQ=\System.Private.CoreLib.dll
        • Size 12.6MB
        • SHA256 20027d6cc9cf4c9c08d24d9c8319cbb233316a7f245c91c6c2ca7cb0f11d062c
        • MD5 SHA1 SHA512 SSDEEP TLSH

        System.Private.Uri.dll

        • Path C:\Users\Admin\AppData\Local\Temp\.net\OOSU10\NBkwFNUEeiOtmLHPhdf7HfEizaVDHyQ=\System.Private.Uri.dll
        • Size 254KB
        • SHA256 9fa3db97acb6e635acd24be072678b32f5d6755118b816d928eb4c265c9971ce
        • MD5 SHA1 SHA512 SSDEEP TLSH

        System.Private.Xml.dll

        • Path C:\Users\Admin\AppData\Local\Temp\.net\OOSU10\NBkwFNUEeiOtmLHPhdf7HfEizaVDHyQ=\System.Private.Xml.dll
        • Size 7.6MB
        • SHA256 c16b5d65ef4e6bdeea7f9bbfa91864bcdeca1b388bc4d7f7d2458138bdb4246d
        • MD5 SHA1 SHA512 SSDEEP TLSH

        System.Reflection.Emit.dll

        • Path C:\Users\Admin\AppData\Local\Temp\.net\OOSU10\NBkwFNUEeiOtmLHPhdf7HfEizaVDHyQ=\System.Reflection.Emit.dll
        • Size 126KB
        • SHA256 faf9c1e47e7275ed735af780d17f4cc59c164714ef44e3b1bea4d2bde7c4dd3a
        • MD5 SHA1 SHA512 SSDEEP TLSH

        System.Runtime.CompilerServices.VisualC.dll

        • Path C:\Users\Admin\AppData\Local\Temp\.net\OOSU10\NBkwFNUEeiOtmLHPhdf7HfEizaVDHyQ=\System.Runtime.CompilerServices.VisualC.dll
        • Size 30KB
        • SHA256 df2acba7f8f1dbbca2e34865bbad65a61195646784741aeb6d6c2428d5bc9dfc
        • MD5 SHA1 SHA512 SSDEEP TLSH

        System.Runtime.InteropServices.dll

        • Path C:\Users\Admin\AppData\Local\Temp\.net\OOSU10\NBkwFNUEeiOtmLHPhdf7HfEizaVDHyQ=\System.Runtime.InteropServices.dll
        • Size 94KB
        • SHA256 3bd73211a2b2ab42f2c67832ea6228577a3dde9ea3975d81459406d6692f498c
        • MD5 SHA1 SHA512 SSDEEP TLSH

        System.Runtime.Serialization.Formatters.dll

        • Path C:\Users\Admin\AppData\Local\Temp\.net\OOSU10\NBkwFNUEeiOtmLHPhdf7HfEizaVDHyQ=\System.Runtime.Serialization.Formatters.dll
        • Size 302KB
        • SHA256 1c7aae00e0616f7d189fd5a7819331ccd29bb759585b9a757e13229661ba0a9b
        • MD5 SHA1 SHA512 SSDEEP TLSH

        System.Security.AccessControl.dll

        • Path C:\Users\Admin\AppData\Local\Temp\.net\OOSU10\NBkwFNUEeiOtmLHPhdf7HfEizaVDHyQ=\System.Security.AccessControl.dll
        • Size 226KB
        • SHA256 c28adbf37cd9ccf0c5f553862e81e5fbdb1bfbff4927f74d2f876fbe4392f7d6
        • MD5 SHA1 SHA512 SSDEEP TLSH

        System.Security.Claims.dll

        • Path C:\Users\Admin\AppData\Local\Temp\.net\OOSU10\NBkwFNUEeiOtmLHPhdf7HfEizaVDHyQ=\System.Security.Claims.dll
        • Size 98KB
        • SHA256 819e9afaa6a35ea1b6fc8262cd77062d4ec3d73388ef0bdcd4331e8ddea576f2
        • MD5 SHA1 SHA512 SSDEEP TLSH

        System.Security.Cryptography.dll

        • Path C:\Users\Admin\AppData\Local\Temp\.net\OOSU10\NBkwFNUEeiOtmLHPhdf7HfEizaVDHyQ=\System.Security.Cryptography.dll
        • Size 2.0MB
        • SHA256 567f78033312b3b25d64729e0742bd9c682d5f0f332279cda8e4d65d7f81770a
        • MD5 SHA1 SHA512 SSDEEP TLSH

        System.Security.Principal.Windows.dll

        • Path C:\Users\Admin\AppData\Local\Temp\.net\OOSU10\NBkwFNUEeiOtmLHPhdf7HfEizaVDHyQ=\System.Security.Principal.Windows.dll
        • Size 182KB
        • SHA256 de28649435d9760187ab357adbf52db198d47ee2daf4fe947c57e749fcbe8e30
        • MD5 SHA1 SHA512 SSDEEP TLSH

        System.Text.Json.dll

        • Path C:\Users\Admin\AppData\Local\Temp\.net\OOSU10\NBkwFNUEeiOtmLHPhdf7HfEizaVDHyQ=\System.Text.Json.dll
        • Size 1.4MB
        • SHA256 246cfbc6b0ded01b8b271cc3d0ae7547387cb3128b717d8d83b09a4d3e734c25
        • MD5 SHA1 SHA512 SSDEEP TLSH

        System.Text.RegularExpressions.dll

        • Path C:\Users\Admin\AppData\Local\Temp\.net\OOSU10\NBkwFNUEeiOtmLHPhdf7HfEizaVDHyQ=\System.Text.RegularExpressions.dll
        • Size 998KB
        • SHA256 0652b627743ad6f609bc115a27991c2723bf4fdd5f8d7148236fa5c90e24608c
        • MD5 SHA1 SHA512 SSDEEP TLSH

        System.Threading.dll

        • Path C:\Users\Admin\AppData\Local\Temp\.net\OOSU10\NBkwFNUEeiOtmLHPhdf7HfEizaVDHyQ=\System.Threading.dll
        • Size 82KB
        • SHA256 769428cfe7f319abbef27990f0a6bbd3034305271fc7f2a4f409abd15215546f
        • MD5 SHA1 SHA512 SSDEEP TLSH

        System.Windows.Controls.Ribbon.dll

        • Path C:\Users\Admin\AppData\Local\Temp\.net\OOSU10\NBkwFNUEeiOtmLHPhdf7HfEizaVDHyQ=\System.Windows.Controls.Ribbon.dll
        • Size 1.4MB
        • SHA256 4b5f181cbfc7a06462fa8ecccd98e2d62d1ecb0fdeee999ae4d1172e83dfa18b
        • MD5 SHA1 SHA512 SSDEEP TLSH

        System.Windows.Extensions.dll

        • Path C:\Users\Admin\AppData\Local\Temp\.net\OOSU10\NBkwFNUEeiOtmLHPhdf7HfEizaVDHyQ=\System.Windows.Extensions.dll
        • Size 114KB
        • SHA256 d0749fc8357a23c232ea925043d793cf1b285da928d84693efe9788fd0cdb133
        • MD5 SHA1 SHA512 SSDEEP TLSH

        System.Xaml.dll

        • Path C:\Users\Admin\AppData\Local\Temp\.net\OOSU10\NBkwFNUEeiOtmLHPhdf7HfEizaVDHyQ=\System.Xaml.dll
        • Size 1.4MB
        • SHA256 9677126b79d48a86ad1cbaec0b3122592c4804988e6837909827817c0b92bc1a
        • MD5 SHA1 SHA512 SSDEEP TLSH

        UIAutomationProvider.dll

        • Path C:\Users\Admin\AppData\Local\Temp\.net\OOSU10\NBkwFNUEeiOtmLHPhdf7HfEizaVDHyQ=\UIAutomationProvider.dll
        • Size 58KB
        • SHA256 e15113539458ab464524f6703fe825db8d2cc2ea0fbd07b3a28e17f8a275d31d
        • MD5 SHA1 SHA512 SSDEEP TLSH

        UIAutomationTypes.dll

        • Path C:\Users\Admin\AppData\Local\Temp\.net\OOSU10\NBkwFNUEeiOtmLHPhdf7HfEizaVDHyQ=\UIAutomationTypes.dll
        • Size 306KB
        • SHA256 27b0972dc81447c573321ff02271fe8f0ca48ed62b56bb1dc7d76499dff0461a
        • MD5 SHA1 SHA512 SSDEEP TLSH

        WindowsBase.dll

        • Path C:\Users\Admin\AppData\Local\Temp\.net\OOSU10\NBkwFNUEeiOtmLHPhdf7HfEizaVDHyQ=\WindowsBase.dll
        • Size 2.2MB
        • SHA256 ec652aa106ce75cbe84a983294a3705986c1834b8ba3e0dce4425f14817bad6c
        • MD5 SHA1 SHA512 SSDEEP TLSH

        wpfgfx_cor3.dll

        • Path C:\Users\Admin\AppData\Local\Temp\.net\OOSU10\NBkwFNUEeiOtmLHPhdf7HfEizaVDHyQ=\wpfgfx_cor3.dll
        • Size 1.9MB
        • SHA256 5087b22c46f17c25c665d6ddbc851c05da4d9a603e2818a98b3a03dc4364bc1b
        • MD5 SHA1 SHA512 SSDEEP TLSH