Analysis
- max time kernel
150s - max time network
149s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
13/08/2026, 14:07
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
socolivexc.io_hyber.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
39 signatures
150 seconds
Behavioral task
behavioral2
Sample
socolivexc.io_hyber.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
39 signatures
150 seconds
General
- Target socolivexc.io_hyber.exe
- Size 49KB
- Sample260813-rezt6sbd95
- SHA256 2633dea5bb2842859ed6ebddb3361558ea28d563ee0a144e011b35d10ceac6b5
- MD5 be9787a6ea8ea9b8cd2eec2d7118ae53
- SHA1 5b9f2277d885caf4c2d5d455b9f09a3d315a30ff
- SHA512 eb42154536d0161d3287a0c6f34cc0a74b3f119d854cb7e5a32d4fe3f2361775ec63a7d6c0a376e500674cacb958779c01b3ddb067db2f51c4c001971570557c
- SSDEEP 768:RrVZZ6zs0h16cFdQuSKqj/NKPzfX/fwl4U:5Z6HhIxLjGP/fwl4U
- TLSH T1A733060537ED4521E1BF9ABE89B251128731F463DC23DB9E1AD8459E09F3700CDA8B6B
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Contains code to disable Windows Defender 1 IoCs
A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.
resource yara_rule behavioral2/memory/5532-1-0x0000000000700000-0x0000000000712000-memory.dmp disable_win_def -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\DisableAntiSpyware = "1" socolivexc.io_hyber.exe - Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell and hide display window.
pid Process 1124 powershell.exe - Disables RegEdit via registry modification 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" socolivexc.io_hyber.exe - Disables Task Manager via registry modification
- Drops file in Drivers directory 1 IoCs
description ioc Process File opened for modification C:\Windows\System32\drivers\etc\hosts socolivexc.io_hyber.exe - Modifies Windows Firewall 2 TTPs 1 IoCs
pid Process 1944 netsh.exe - Creates a file in the Startup directory 1 TTPs 64 IoCs
A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.
description ioc Process File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_52.pdf socolivexc.io_hyber.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_156.pdf socolivexc.io_hyber.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_159.pdf socolivexc.io_hyber.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_182.pdf socolivexc.io_hyber.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_33.pdf socolivexc.io_hyber.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_49.pdf socolivexc.io_hyber.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_72.pdf socolivexc.io_hyber.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_113.pdf socolivexc.io_hyber.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_172.pdf socolivexc.io_hyber.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_8.pdf socolivexc.io_hyber.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_20.pdf socolivexc.io_hyber.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_21.pdf socolivexc.io_hyber.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_24.pdf socolivexc.io_hyber.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_61.pdf socolivexc.io_hyber.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_150.pdf socolivexc.io_hyber.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_187.pdf socolivexc.io_hyber.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_188.pdf socolivexc.io_hyber.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_22.pdf socolivexc.io_hyber.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_91.pdf socolivexc.io_hyber.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_100.pdf socolivexc.io_hyber.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_103.pdf socolivexc.io_hyber.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_106.pdf socolivexc.io_hyber.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_126.pdf socolivexc.io_hyber.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_140.pdf socolivexc.io_hyber.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_147.pdf socolivexc.io_hyber.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_23.pdf socolivexc.io_hyber.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_38.pdf socolivexc.io_hyber.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_56.pdf socolivexc.io_hyber.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_75.pdf socolivexc.io_hyber.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_144.pdf socolivexc.io_hyber.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_150.pdf socolivexc.io_hyber.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_171.pdf socolivexc.io_hyber.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_68.pdf socolivexc.io_hyber.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_91.pdf socolivexc.io_hyber.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_149.pdf socolivexc.io_hyber.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_200.pdf socolivexc.io_hyber.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_41.pdf socolivexc.io_hyber.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_63.pdf socolivexc.io_hyber.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_84.pdf socolivexc.io_hyber.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_93.pdf socolivexc.io_hyber.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_130.pdf socolivexc.io_hyber.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_132.pdf socolivexc.io_hyber.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_144.pdf socolivexc.io_hyber.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\system.bat socolivexc.io_hyber.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_32.pdf socolivexc.io_hyber.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_42.pdf socolivexc.io_hyber.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_126.pdf socolivexc.io_hyber.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_129.pdf socolivexc.io_hyber.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_159.pdf socolivexc.io_hyber.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_179.pdf socolivexc.io_hyber.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_179.pdf socolivexc.io_hyber.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_191.pdf socolivexc.io_hyber.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_59.pdf socolivexc.io_hyber.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_119.pdf socolivexc.io_hyber.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_148.pdf socolivexc.io_hyber.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_194.pdf socolivexc.io_hyber.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_2.pdf socolivexc.io_hyber.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_18.pdf socolivexc.io_hyber.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_77.pdf socolivexc.io_hyber.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_118.pdf socolivexc.io_hyber.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_127.pdf socolivexc.io_hyber.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_146.pdf socolivexc.io_hyber.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_147.pdf socolivexc.io_hyber.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_152.pdf socolivexc.io_hyber.exe - Disables service(s) 3 TTPs
- Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Stops running service(s) 4 TTPs
- Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Windows\CurrentVersion\Run\SysUpdate = "C:\\Users\\Admin\\AppData\\Local\\Temp\\socolivexc.io_hyber.exe" socolivexc.io_hyber.exe - Discovers running processes 1 TTPs 1 IoCs
Running process information can be used to identify security tools or plan follow-on actions.
pid Process 3416 tasklist.exe - Drops file in System32 directory 4 IoCs
description ioc Process File created C:\Windows\system32\svchost.exe socolivexc.io_hyber.exe File created C:\Windows\system32\sysupdate.exe socolivexc.io_hyber.exe File opened for modification C:\Windows\system32\sysupdate.exe socolivexc.io_hyber.exe File opened for modification C:\Windows\system32\LogFiles\WMI\FaceUnlockManually.etl LogonUI.exe - Executes a VBScript file via the Windows Script Host. 1 TTPs 2 IoCs
pid Process 4724 wscript.exe 4532 wscript.exe - Sets desktop wallpaper using registry 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Control Panel\Desktop\Wallpaper = "C:\\ProgramData\\SysUpdate\\wall.bmp" socolivexc.io_hyber.exe - Drops file in Windows directory 1 IoCs
description ioc Process File created C:\Windows\rescache\_merged\1190018277\1293781730.pri LogonUI.exe - Launches sc.exe 10 IoCs
Sc.exe is a Windows utlilty to control services on the system.
pid Process 3840 sc.exe 2672 sc.exe 1648 sc.exe 2636 sc.exe 1340 sc.exe 2708 sc.exe 992 sc.exe 5596 sc.exe 4484 sc.exe 2080 sc.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs
Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.
description ioc Process Key opened \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe - Executes a command shell one-liner 1 TTPs 7 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 2712 cmd.exe 3068 cmd.exe 3008 cmd.exe 4356 cmd.exe 4144 cmd.exe 4452 cmd.exe 4136 cmd.exe - Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0 LogonUI.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz LogonUI.exe - Gathers network information 2 TTPs 2 IoCs
Uses commandline utility to view network configuration.
pid Process 4652 ipconfig.exe 688 NETSTAT.EXE - Gathers system information 1 TTPs 1 IoCs
Runs systeminfo.exe.
pid Process 3684 systeminfo.exe - Interacts with shadow copies 3 TTPs 2 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
pid Process 3428 vssadmin.exe 5832 vssadmin.exe - Modifies Control Panel 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Control Panel\Desktop\WallpaperStyle = "2" socolivexc.io_hyber.exe - Modifies data under HKEY_USERS 4 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent LogonUI.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentPalette = 99ebff004cc2ff000091f8000078d4000067c000003e9200001a6800f7630c00 LogonUI.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History\AutoColor = "0" LogonUI.exe - Modifies registry class 16 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\ms-settings socolivexc.io_hyber.exe Key created \REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\ms-settings\shell\open socolivexc.io_hyber.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.pdf\ = "PDFBotnet" socolivexc.io_hyber.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\PDFBotnet\shell\open\command socolivexc.io_hyber.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\PDFBotnet\shell socolivexc.io_hyber.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\PDFBotnet\shell\open socolivexc.io_hyber.exe Key created \REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\ms-settings\shell socolivexc.io_hyber.exe Set value (str) \REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\ms-settings\shell\open\command\DelegateExecute socolivexc.io_hyber.exe Key deleted \REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\ms-settings socolivexc.io_hyber.exe Set value (str) \REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\ms-settings\shell\open\command\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\socolivexc.io_hyber.exe" socolivexc.io_hyber.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\PDFBotnet socolivexc.io_hyber.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\PDFBotnet\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\socolivexc.io_hyber.exe\" \"%1\"" socolivexc.io_hyber.exe Key deleted \REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\ms-settings\shell\open\command socolivexc.io_hyber.exe Key deleted \REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\ms-settings\shell\open socolivexc.io_hyber.exe Key deleted \REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\ms-settings\shell socolivexc.io_hyber.exe Key created \REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\ms-settings\shell\open\command socolivexc.io_hyber.exe - Runs net.exe
- Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 2556 schtasks.exe 4700 schtasks.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1124 powershell.exe 1124 powershell.exe 1124 powershell.exe 5532 socolivexc.io_hyber.exe 5532 socolivexc.io_hyber.exe 5532 socolivexc.io_hyber.exe 5532 socolivexc.io_hyber.exe 5532 socolivexc.io_hyber.exe 5532 socolivexc.io_hyber.exe 5532 socolivexc.io_hyber.exe 5532 socolivexc.io_hyber.exe 5532 socolivexc.io_hyber.exe 5532 socolivexc.io_hyber.exe 5532 socolivexc.io_hyber.exe 5532 socolivexc.io_hyber.exe 5532 socolivexc.io_hyber.exe 5532 socolivexc.io_hyber.exe 3052 WMIC.exe 3052 WMIC.exe 3052 WMIC.exe 3052 WMIC.exe 5532 socolivexc.io_hyber.exe 5532 socolivexc.io_hyber.exe 5532 socolivexc.io_hyber.exe 5532 socolivexc.io_hyber.exe 5532 socolivexc.io_hyber.exe 5532 socolivexc.io_hyber.exe 5532 socolivexc.io_hyber.exe 5532 socolivexc.io_hyber.exe 5532 socolivexc.io_hyber.exe 5532 socolivexc.io_hyber.exe 5532 socolivexc.io_hyber.exe 5532 socolivexc.io_hyber.exe 5532 socolivexc.io_hyber.exe 5532 socolivexc.io_hyber.exe 5532 socolivexc.io_hyber.exe 5532 socolivexc.io_hyber.exe 5532 socolivexc.io_hyber.exe 5532 socolivexc.io_hyber.exe 5532 socolivexc.io_hyber.exe 5532 socolivexc.io_hyber.exe 5532 socolivexc.io_hyber.exe 5532 socolivexc.io_hyber.exe 5928 WMIC.exe 5928 WMIC.exe 5928 WMIC.exe 5928 WMIC.exe 5532 socolivexc.io_hyber.exe 5532 socolivexc.io_hyber.exe 5532 socolivexc.io_hyber.exe 5532 socolivexc.io_hyber.exe 5532 socolivexc.io_hyber.exe 5532 socolivexc.io_hyber.exe 5532 socolivexc.io_hyber.exe 5532 socolivexc.io_hyber.exe 5532 socolivexc.io_hyber.exe 5532 socolivexc.io_hyber.exe 5532 socolivexc.io_hyber.exe 5532 socolivexc.io_hyber.exe 5532 socolivexc.io_hyber.exe 5532 socolivexc.io_hyber.exe 5532 socolivexc.io_hyber.exe 5532 socolivexc.io_hyber.exe 5532 socolivexc.io_hyber.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 2464 LogonUI.exe Token: SeCreatePagefilePrivilege 2464 LogonUI.exe Token: SeDebugPrivilege 5532 socolivexc.io_hyber.exe Token: SeDebugPrivilege 1124 powershell.exe Token: SeIncreaseQuotaPrivilege 1124 powershell.exe Token: SeSecurityPrivilege 1124 powershell.exe Token: SeTakeOwnershipPrivilege 1124 powershell.exe Token: SeLoadDriverPrivilege 1124 powershell.exe Token: SeSystemProfilePrivilege 1124 powershell.exe Token: SeSystemtimePrivilege 1124 powershell.exe Token: SeProfSingleProcessPrivilege 1124 powershell.exe Token: SeIncBasePriorityPrivilege 1124 powershell.exe Token: SeCreatePagefilePrivilege 1124 powershell.exe Token: SeBackupPrivilege 1124 powershell.exe Token: SeRestorePrivilege 1124 powershell.exe Token: SeShutdownPrivilege 1124 powershell.exe Token: SeDebugPrivilege 1124 powershell.exe Token: SeSystemEnvironmentPrivilege 1124 powershell.exe Token: SeRemoteShutdownPrivilege 1124 powershell.exe Token: SeUndockPrivilege 1124 powershell.exe Token: SeManageVolumePrivilege 1124 powershell.exe Token: 33 1124 powershell.exe Token: 34 1124 powershell.exe Token: 35 1124 powershell.exe Token: 36 1124 powershell.exe Token: SeIncBasePriorityPrivilege 5532 socolivexc.io_hyber.exe Token: SeDebugPrivilege 3416 tasklist.exe Token: SeDebugPrivilege 688 NETSTAT.EXE Token: SeIncreaseQuotaPrivilege 3052 WMIC.exe Token: SeSecurityPrivilege 3052 WMIC.exe Token: SeTakeOwnershipPrivilege 3052 WMIC.exe Token: SeLoadDriverPrivilege 3052 WMIC.exe Token: SeSystemProfilePrivilege 3052 WMIC.exe Token: SeSystemtimePrivilege 3052 WMIC.exe Token: SeProfSingleProcessPrivilege 3052 WMIC.exe Token: SeIncBasePriorityPrivilege 3052 WMIC.exe Token: SeCreatePagefilePrivilege 3052 WMIC.exe Token: SeBackupPrivilege 3052 WMIC.exe Token: SeRestorePrivilege 3052 WMIC.exe Token: SeShutdownPrivilege 3052 WMIC.exe Token: SeDebugPrivilege 3052 WMIC.exe Token: SeSystemEnvironmentPrivilege 3052 WMIC.exe Token: SeRemoteShutdownPrivilege 3052 WMIC.exe Token: SeUndockPrivilege 3052 WMIC.exe Token: SeManageVolumePrivilege 3052 WMIC.exe Token: 33 3052 WMIC.exe Token: 34 3052 WMIC.exe Token: 35 3052 WMIC.exe Token: 36 3052 WMIC.exe Token: SeDebugPrivilege 2168 whoami.exe Token: SeIncreaseQuotaPrivilege 1124 powershell.exe Token: SeSecurityPrivilege 1124 powershell.exe Token: SeTakeOwnershipPrivilege 1124 powershell.exe Token: SeLoadDriverPrivilege 1124 powershell.exe Token: SeSystemProfilePrivilege 1124 powershell.exe Token: SeSystemtimePrivilege 1124 powershell.exe Token: SeProfSingleProcessPrivilege 1124 powershell.exe Token: SeIncBasePriorityPrivilege 1124 powershell.exe Token: SeCreatePagefilePrivilege 1124 powershell.exe Token: SeBackupPrivilege 1124 powershell.exe Token: SeRestorePrivilege 1124 powershell.exe Token: SeShutdownPrivilege 1124 powershell.exe Token: SeDebugPrivilege 1124 powershell.exe Token: SeSystemEnvironmentPrivilege 1124 powershell.exe - Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 5532 socolivexc.io_hyber.exe - Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 2464 LogonUI.exe 2464 LogonUI.exe 5532 socolivexc.io_hyber.exe - Suspicious use of WriteProcessMemory 39 IoCs
description pid Process procid_target PID 5532 wrote to memory of 1124 5532 socolivexc.io_hyber.exe 91 PID 5532 wrote to memory of 5596 5532 socolivexc.io_hyber.exe 93 PID 5532 wrote to memory of 1648 5532 socolivexc.io_hyber.exe 95 PID 5532 wrote to memory of 4484 5532 socolivexc.io_hyber.exe 97 PID 5532 wrote to memory of 2080 5532 socolivexc.io_hyber.exe 114 PID 5532 wrote to memory of 3840 5532 socolivexc.io_hyber.exe 101 PID 5532 wrote to memory of 2672 5532 socolivexc.io_hyber.exe 103 PID 5532 wrote to memory of 2636 5532 socolivexc.io_hyber.exe 105 PID 5532 wrote to memory of 1340 5532 socolivexc.io_hyber.exe 107 PID 5532 wrote to memory of 848 5532 socolivexc.io_hyber.exe 108 PID 848 wrote to memory of 3856 848 fodhelper.exe 110 PID 5532 wrote to memory of 4724 5532 socolivexc.io_hyber.exe 112 PID 5532 wrote to memory of 2556 5532 socolivexc.io_hyber.exe 113 PID 5532 wrote to memory of 2712 5532 socolivexc.io_hyber.exe 120 PID 5532 wrote to memory of 4136 5532 socolivexc.io_hyber.exe 121 PID 5532 wrote to memory of 4452 5532 socolivexc.io_hyber.exe 122 PID 5532 wrote to memory of 4144 5532 socolivexc.io_hyber.exe 123 PID 5532 wrote to memory of 4356 5532 socolivexc.io_hyber.exe 124 PID 5532 wrote to memory of 3008 5532 socolivexc.io_hyber.exe 125 PID 5532 wrote to memory of 3068 5532 socolivexc.io_hyber.exe 126 PID 5532 wrote to memory of 4700 5532 socolivexc.io_hyber.exe 129 PID 5532 wrote to memory of 4532 5532 socolivexc.io_hyber.exe 136 PID 5532 wrote to memory of 5472 5532 socolivexc.io_hyber.exe 137 PID 4452 wrote to memory of 3416 4452 cmd.exe 138 PID 5532 wrote to memory of 3428 5532 socolivexc.io_hyber.exe 139 PID 4356 wrote to memory of 1228 4356 cmd.exe 140 PID 5532 wrote to memory of 3052 5532 socolivexc.io_hyber.exe 141 PID 5532 wrote to memory of 6052 5532 socolivexc.io_hyber.exe 142 PID 5532 wrote to memory of 1944 5532 socolivexc.io_hyber.exe 143 PID 5532 wrote to memory of 992 5532 socolivexc.io_hyber.exe 144 PID 5532 wrote to memory of 2708 5532 socolivexc.io_hyber.exe 145 PID 3008 wrote to memory of 4652 3008 cmd.exe 149 PID 1228 wrote to memory of 1452 1228 net.exe 152 PID 4144 wrote to memory of 2168 4144 cmd.exe 154 PID 3068 wrote to memory of 688 3068 cmd.exe 155 PID 4136 wrote to memory of 3684 4136 cmd.exe 156 PID 6052 wrote to memory of 4480 6052 net.exe 157 PID 2712 wrote to memory of 5832 2712 cmd.exe 159 PID 2712 wrote to memory of 5928 2712 cmd.exe 161 - Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
- Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\socolivexc.io_hyber.exe"C:\Users\Admin\AppData\Local\Temp\socolivexc.io_hyber.exe"1⤵
- Modifies Windows Defender DisableAntiSpyware settings
- Disables RegEdit via registry modification
- Drops file in Drivers directory
- Creates a file in the Startup directory
- Adds Run key to start application
- Drops file in System32 directory
- Sets desktop wallpaper using registry
- Modifies Control Panel
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5532 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoP -NonI -W Hidden -Exec Bypass -Enc UwBlAHQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARABpAHMAYQBiAGwAZQBSAGUAYQBsAHQAaQBtAGUATQBvAG4AaQB0AG8AcgBpAG4AZwAgACQAdAByAHUAZQA7ACAAUwBlAHQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARABpAHMAYQBiAGwAZQBCAGUAaABhAHYAaQBvAHIATQBvAG4AaQB0AG8AcgBpAG4AZwAgACQAdAByAHUAZQA=2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1124
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" stop wscsvc2⤵
- Launches sc.exe
PID:5596
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" config wscsvc start= disabled2⤵
- Launches sc.exe
PID:1648
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" stop SecurityHealthService2⤵
- Launches sc.exe
PID:4484
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" config SecurityHealthService start= disabled2⤵
- Launches sc.exe
PID:2080
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" stop WinDefend2⤵
- Launches sc.exe
PID:3840
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" config WinDefend start= disabled2⤵
- Launches sc.exe
PID:2672
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" stop MsMpSvc2⤵
- Launches sc.exe
PID:2636
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" config MsMpSvc start= disabled2⤵
- Launches sc.exe
PID:1340
-
-
C:\Windows\System32\fodhelper.exe"C:\Windows\System32\fodhelper.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:848 -
C:\Users\Admin\AppData\Local\Temp\socolivexc.io_hyber.exe"C:\Users\Admin\AppData\Local\Temp\socolivexc.io_hyber.exe"3⤵PID:3856
-
-
-
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" C:\Users\Admin\AppData\Local\Temp\makelnk.vbs2⤵
- Executes a VBScript file via the Windows Script Host.
PID:4724
-
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks" /create /tn "SysUpdateTask" /tr "C:\Users\Admin\AppData\Local\Temp\socolivexc.io_hyber.exe" /sc onlogon /f2⤵
- Scheduled Task/Job: Scheduled Task
PID:2556 -
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV13⤵PID:2080
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\del.bat" "2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2712 -
C:\Windows\system32\vssadmin.exevssadmin delete shadows /all /quiet3⤵
- Interacts with shadow copies
PID:5832
-
-
C:\Windows\System32\Wbem\WMIC.exewmic shadowcopy delete3⤵
- Suspicious behavior: EnumeratesProcesses
PID:5928
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c systeminfo > "C:\ProgramData\SysUpdate\Logs\sysinfo.txt"2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4136 -
C:\Windows\system32\systeminfo.exesysteminfo3⤵
- Gathers system information
PID:3684
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c tasklist > "C:\ProgramData\SysUpdate\Logs\tasklist.txt"2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4452 -
C:\Windows\system32\tasklist.exetasklist3⤵
- Discovers running processes
- Suspicious use of AdjustPrivilegeToken
PID:3416
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c whoami > "C:\ProgramData\SysUpdate\Logs\whoami.txt"2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4144 -
C:\Windows\system32\whoami.exewhoami3⤵
- Suspicious use of AdjustPrivilegeToken
PID:2168
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c net user > "C:\ProgramData\SysUpdate\Logs\netuser.txt"2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4356 -
C:\Windows\system32\net.exenet user3⤵
- Suspicious use of WriteProcessMemory
PID:1228 -
C:\Windows\system32\net1.exeC:\Windows\system32\net1 user4⤵PID:1452
-
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c ipconfig /all > "C:\ProgramData\SysUpdate\Logs\ipconfig.txt"2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:3008 -
C:\Windows\system32\ipconfig.exeipconfig /all3⤵
- Gathers network information
PID:4652
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c netstat -an > "C:\ProgramData\SysUpdate\Logs\netstat.txt"2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:3068 -
C:\Windows\system32\NETSTAT.EXEnetstat -an3⤵
- Gathers network information
- Suspicious use of AdjustPrivilegeToken
PID:688
-
-
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks" /create /tn "RansomwareCheck" /tr "C:\Users\Admin\AppData\Local\Temp\socolivexc.io_hyber.exe" /sc daily /f2⤵
- Scheduled Task/Job: Scheduled Task
PID:4700
-
-
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" C:\Users\Admin\AppData\Local\Temp\createshortcut.vbs2⤵
- Executes a VBScript file via the Windows Script Host.
PID:4532
-
-
C:\Windows\System32\notepad.exe"C:\Windows\System32\notepad.exe"2⤵PID:5472
-
-
C:\Windows\System32\vssadmin.exe"C:\Windows\System32\vssadmin.exe" delete shadows /all /quiet2⤵
- Interacts with shadow copies
PID:3428
-
-
C:\Windows\System32\wbem\WMIC.exe"C:\Windows\System32\wbem\WMIC.exe" shadowcopy delete2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3052
-
-
C:\Windows\System32\net.exe"C:\Windows\System32\net.exe" stop srservice2⤵
- Suspicious use of WriteProcessMemory
PID:6052 -
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop srservice3⤵PID:4480
-
-
-
C:\Windows\System32\netsh.exe"C:\Windows\System32\netsh.exe" advfirewall set allprofiles state off2⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
PID:1944
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" config i8042prt start= disabled2⤵
- Launches sc.exe
PID:992
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" stop i8042prt2⤵
- Launches sc.exe
PID:2708
-
-
C:\Windows\system32\LogonUI.exe"LogonUI.exe" /flags:0x0 /state0:0xa3a20055 /state1:0x41c64e6d1⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Checks processor information in registry
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:2464
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k CameraMonitor1⤵PID:6032
-
C:\Users\Admin\AppData\Local\Temp\socolivexc.io_hyber.exeC:\Users\Admin\AppData\Local\Temp\socolivexc.io_hyber.exe1⤵PID:5828
-
C:\Users\Admin\AppData\Local\Temp\socolivexc.io_hyber.exeC:\Users\Admin\AppData\Local\Temp\socolivexc.io_hyber.exe1⤵PID:4176
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵PID:5272
Network
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
4PowerShell
1Visual Basic
1Windows Command Shell
1Scheduled Task/Job
1Scheduled Task
1System Services
2Service Execution
2Windows Management Instrumentation
1Persistence
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
2Create or Modify System Process
4Windows Service
4Event Triggered Execution
1Netsh Helper DLL
1Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
2Create or Modify System Process
4Windows Service
4Event Triggered Execution
1Netsh Helper DLL
1Scheduled Task/Job
1Scheduled Task
1Defense Evasion
Direct Volume Access
1Impair Defenses
3Disable or Modify System Firewall
1Disable or Modify Tools
1Indicator Removal
2File Deletion
2Modify Registry
3Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\ProgramData\invoice_1.pdf
- Size 66KB
- SHA256 52398291c59a4728846ad32f56ffb00bab97c60fd2fdc20bf06bb510df7ba368
- MD5 2afdb5da44ae77e930ff1c1ac854a55f
- SHA1 4d72d59a7a33a70598d5977504426fafdbac1927
- SHA512 fe2312fb1ed724a6bb0b356a3aa4163a529a56c593a6a28abfe82c3a3fa7666daa45acea868eff531c71218a832277cb0bb87562cd9f5ce978fcb60a4f075413
- SSDEEP 1536:H2Rveo0zwn1+7cRMa3EJb2TeDTkXhEVO5IWoqojXQQdGU4I13Vxsd8E1Ih:HgvQzwnA81EQ6TkRM5XQQoRIJVxsd8E+
- TLSH T12F633B338A23FCC5677F3D40F1543D920C883A678775666CFBC90A5538A6688EF2D998
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\SystemVolumeInformation\doc_3.pdf
- Size 66KB
- SHA256 17852c44414b26d4b68179ede1a063fdf99bc8e2ef1cdce719b33f3a16417eb1
- MD5 d9f4891f6488b1c8b54983359a0a512e
- SHA1 fcdb9b0439ad7b8c17b503e99f277e641f2b4ce6
- SHA512 1a545b8c0afbe7e69b3ba675eb4bade4b0a58187f448f6bc4759044d5936d91a06b07ff75a7869ab4d35dc8c25e8e6b739d2dd4dee41d69825a6934ece320251
- SSDEEP 1536:n2Rveo0zwn1+7cRMa3EJb2TeDTkXhEVO5IWoqojXQQdGU4I13Vxsd8E1IY:ngvQzwnA81EQ6TkRM5XQQoRIJVxsd8E5
- TLSH T1DC632B738A23FCC5677F3D40F0542D920C883A678775676CFBC90A9538A6688DF2D998
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\createshortcut.vbs
- Size 244B
- SHA256 65bba1f1e19ebc848878e670ade53af0fb931194c3221e94034e18184f974ba0
- MD5 bf5ab7ca4bcad2d1539c7c1e340b2fec
- SHA1 363803a50ac1168900730a35f784d7415a8a3613
- SHA512 fcded55b810696500a10e0eac53d05183a498112f2a25e3de8f9b4223f970e7cf35a281d2cb11976fff4dfe41617826de72a56e5725505f6fceda2247ca4e98c
- TLSH T12BD0A78BB14EC6B90001123B81F3DE8CEAA558693B9BBF705AA5DD4E329188589F6543
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\del.bat
- Size 59B
- SHA256 a51f2a0f053ac35b4158bb02b75421ab3698e1d0ee4f926abf1bae3af1570c53
- MD5 9cecbebdcdd60358132849714a3b82f7
- SHA1 be6e20834a5726f3742f05e6bdfaff16118b147f
- SHA512 7b48bd66b4c741d2de2e8b7bc0eab8f438ddc1ed0c73e8b70add9bee400f6640f692884965032616e2d6911a22a17d1d3762421aa49fe021660c9052cfc0675a
- TLSH T13DA002620F961E5469529E5AD73425239D1F104CD1390012F05232903DA98DE0EC2144
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\makelnk.vbs
- Size 245B
- SHA256 263d09bb8881abbe559c232793be79fcd21b4ad5f9e186262a0c5fe437242cd5
- MD5 cdf4411664e0e9dc78f1923cb67258f7
- SHA1 96cf23a3fd6cbfef6408c445df13345456fb209a
- SHA512 3f442b882296e41c57461e87b0d884cae24379583c4c8ba4b0f4dd9fcca096d802967122c394de1f1d7e4a4f9a79935d7e4d108e50b84dcb7462cd4181051f36
- TLSH T1E2D0A587B14DC5750001113B40F3DD4CD6D154593B5B7F705555DD0F328144549F5543
- MD5 SHA1 SHA512 TLSH