Analysis
- max time kernel
150s - max time network
154s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
07/09/2026, 12:29
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
persuaded.io_hyber.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
38 signatures
150 seconds
Behavioral task
behavioral2
Sample
persuaded.io_hyber.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
39 signatures
150 seconds
General
- Target persuaded.io_hyber.exe
- Size 49KB
- Sample260907-ppa8fsvtfw
- SHA256 4592a5e5051c6658cad3641a07e55663b541aa99d7bd6848946e9170ddf80716
- MD5 bbf0e81e46bad19fccc822e1be0f4b22
- SHA1 139cfb90b8b06a793dab24204fce3b8b777dc6c6
- SHA512 629bb23afe7847887434cb84de279cf9be01a39126206b3ef09760fa2679be9efa4f66c3c3f591776c65f81424da953a58bc55001faf0b10b0c3b82ee4bf6f4d
- SSDEEP 768:rrVZZ6zs0hP4NaFkz0Cbqp/NaPzfX/faq44:bZ6HhAN+JXpmP/faq44
- TLSH T16E33F74937ED4521D1BF9ABE89B291118731F493DC23DB8E1AD9459E09F3700CCA8B6B
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Contains code to disable Windows Defender 1 IoCs
A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.
resource yara_rule behavioral2/memory/5460-1-0x00000000005F0000-0x0000000000602000-memory.dmp disable_win_def -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\DisableAntiSpyware = "1" persuaded.io_hyber.exe - Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell and hide display window.
pid Process 700 powershell.exe - Disables RegEdit via registry modification 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" persuaded.io_hyber.exe - Disables Task Manager via registry modification
- Drops file in Drivers directory 1 IoCs
description ioc Process File opened for modification C:\Windows\System32\drivers\etc\hosts persuaded.io_hyber.exe - Modifies Windows Firewall 2 TTPs 1 IoCs
pid Process 5840 netsh.exe - Creates a file in the Startup directory 1 TTPs 64 IoCs
A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.
description ioc Process File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_66.pdf persuaded.io_hyber.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_78.pdf persuaded.io_hyber.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_112.pdf persuaded.io_hyber.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_120.pdf persuaded.io_hyber.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_150.pdf persuaded.io_hyber.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_43.pdf persuaded.io_hyber.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_68.pdf persuaded.io_hyber.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_162.pdf persuaded.io_hyber.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_197.pdf persuaded.io_hyber.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_15.pdf persuaded.io_hyber.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_23.pdf persuaded.io_hyber.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_28.pdf persuaded.io_hyber.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_35.pdf persuaded.io_hyber.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_39.pdf persuaded.io_hyber.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_106.pdf persuaded.io_hyber.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_116.pdf persuaded.io_hyber.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_126.pdf persuaded.io_hyber.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_27.pdf persuaded.io_hyber.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_32.pdf persuaded.io_hyber.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_44.pdf persuaded.io_hyber.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_92.pdf persuaded.io_hyber.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_94.pdf persuaded.io_hyber.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_103.pdf persuaded.io_hyber.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_121.pdf persuaded.io_hyber.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_129.pdf persuaded.io_hyber.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_9.pdf persuaded.io_hyber.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_106.pdf persuaded.io_hyber.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_136.pdf persuaded.io_hyber.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_139.pdf persuaded.io_hyber.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_165.pdf persuaded.io_hyber.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_168.pdf persuaded.io_hyber.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_195.pdf persuaded.io_hyber.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_6.pdf persuaded.io_hyber.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_7.pdf persuaded.io_hyber.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_32.pdf persuaded.io_hyber.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_50.pdf persuaded.io_hyber.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_109.pdf persuaded.io_hyber.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_142.pdf persuaded.io_hyber.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_157.pdf persuaded.io_hyber.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_191.pdf persuaded.io_hyber.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_101.pdf persuaded.io_hyber.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_125.pdf persuaded.io_hyber.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_36.pdf persuaded.io_hyber.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_178.pdf persuaded.io_hyber.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_80.pdf persuaded.io_hyber.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_97.pdf persuaded.io_hyber.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_107.pdf persuaded.io_hyber.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_30.pdf persuaded.io_hyber.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_79.pdf persuaded.io_hyber.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_121.pdf persuaded.io_hyber.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_122.pdf persuaded.io_hyber.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_136.pdf persuaded.io_hyber.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_15.pdf persuaded.io_hyber.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_5.pdf persuaded.io_hyber.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_9.pdf persuaded.io_hyber.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_76.pdf persuaded.io_hyber.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_116.pdf persuaded.io_hyber.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_141.pdf persuaded.io_hyber.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_143.pdf persuaded.io_hyber.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_159.pdf persuaded.io_hyber.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_4.pdf persuaded.io_hyber.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_122.pdf persuaded.io_hyber.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_134.pdf persuaded.io_hyber.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_155.pdf persuaded.io_hyber.exe - Disables service(s) 3 TTPs
- Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Stops running service(s) 4 TTPs
- Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Windows\CurrentVersion\Run\SysUpdate = "C:\\Users\\Admin\\AppData\\Local\\Temp\\persuaded.io_hyber.exe" persuaded.io_hyber.exe - Discovers running processes 1 TTPs 1 IoCs
Running process information can be used to identify security tools or plan follow-on actions.
pid Process 2712 tasklist.exe - Drops file in System32 directory 4 IoCs
description ioc Process File opened for modification C:\Windows\system32\LogFiles\WMI\FaceUnlockManually.etl LogonUI.exe File created C:\Windows\system32\svchost.exe persuaded.io_hyber.exe File created C:\Windows\system32\sysupdate.exe persuaded.io_hyber.exe File opened for modification C:\Windows\system32\sysupdate.exe persuaded.io_hyber.exe - Executes a VBScript file via the Windows Script Host. 1 TTPs 2 IoCs
pid Process 5956 wscript.exe 6136 wscript.exe - Sets desktop wallpaper using registry 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Control Panel\Desktop\Wallpaper = "C:\\ProgramData\\SysUpdate\\wall.bmp" persuaded.io_hyber.exe - Drops file in Windows directory 1 IoCs
description ioc Process File created C:\Windows\rescache\_merged\1190018277\1190384399.pri LogonUI.exe - Launches sc.exe 10 IoCs
Sc.exe is a Windows utlilty to control services on the system.
pid Process 4912 sc.exe 3024 sc.exe 4336 sc.exe 2816 sc.exe 4528 sc.exe 6000 sc.exe 2468 sc.exe 4472 sc.exe 1056 sc.exe 1372 sc.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs
Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.
description ioc Process Key opened \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe - Executes a command shell one-liner 1 TTPs 7 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 4948 cmd.exe 2996 cmd.exe 4704 cmd.exe 3456 cmd.exe 4732 cmd.exe 4744 cmd.exe 5680 cmd.exe - Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0 LogonUI.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz LogonUI.exe - Gathers network information 2 TTPs 2 IoCs
Uses commandline utility to view network configuration.
pid Process 2144 NETSTAT.EXE 2112 ipconfig.exe - Gathers system information 1 TTPs 1 IoCs
Runs systeminfo.exe.
pid Process 760 systeminfo.exe - Interacts with shadow copies 3 TTPs 2 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
pid Process 2812 vssadmin.exe 4796 vssadmin.exe - Modifies Control Panel 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Control Panel\Desktop\WallpaperStyle = "2" persuaded.io_hyber.exe - Modifies data under HKEY_USERS 4 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent LogonUI.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentPalette = 99ebff004cc2ff000091f8000078d4000067c000003e9200001a6800f7630c00 LogonUI.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History\AutoColor = "0" LogonUI.exe - Modifies registry class 16 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\PDFBotnet\shell\open persuaded.io_hyber.exe Key created \REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\ms-settings\shell\open\command persuaded.io_hyber.exe Key created \REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\ms-settings persuaded.io_hyber.exe Key created \REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\ms-settings\shell\open persuaded.io_hyber.exe Set value (str) \REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\ms-settings\shell\open\command\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\persuaded.io_hyber.exe" persuaded.io_hyber.exe Key deleted \REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\ms-settings\shell\open\command persuaded.io_hyber.exe Key deleted \REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\ms-settings persuaded.io_hyber.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\PDFBotnet\shell\open\command persuaded.io_hyber.exe Set value (str) \REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\ms-settings\shell\open\command\DelegateExecute persuaded.io_hyber.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\PDFBotnet\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\persuaded.io_hyber.exe\" \"%1\"" persuaded.io_hyber.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\PDFBotnet persuaded.io_hyber.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.pdf\ = "PDFBotnet" persuaded.io_hyber.exe Key created \REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\ms-settings\shell persuaded.io_hyber.exe Key deleted \REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\ms-settings\shell\open persuaded.io_hyber.exe Key deleted \REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\ms-settings\shell persuaded.io_hyber.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\PDFBotnet\shell persuaded.io_hyber.exe - Runs net.exe
- Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 4768 schtasks.exe 3032 schtasks.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 700 powershell.exe 700 powershell.exe 700 powershell.exe 5460 persuaded.io_hyber.exe 5460 persuaded.io_hyber.exe 5460 persuaded.io_hyber.exe 5460 persuaded.io_hyber.exe 5460 persuaded.io_hyber.exe 5460 persuaded.io_hyber.exe 5460 persuaded.io_hyber.exe 5460 persuaded.io_hyber.exe 5460 persuaded.io_hyber.exe 5460 persuaded.io_hyber.exe 5460 persuaded.io_hyber.exe 5460 persuaded.io_hyber.exe 5460 persuaded.io_hyber.exe 5460 persuaded.io_hyber.exe 4192 WMIC.exe 4192 WMIC.exe 4192 WMIC.exe 4192 WMIC.exe 5460 persuaded.io_hyber.exe 5460 persuaded.io_hyber.exe 5460 persuaded.io_hyber.exe 5460 persuaded.io_hyber.exe 5460 persuaded.io_hyber.exe 5460 persuaded.io_hyber.exe 5460 persuaded.io_hyber.exe 3240 WMIC.exe 3240 WMIC.exe 3240 WMIC.exe 3240 WMIC.exe 5460 persuaded.io_hyber.exe 5460 persuaded.io_hyber.exe 5460 persuaded.io_hyber.exe 5460 persuaded.io_hyber.exe 5460 persuaded.io_hyber.exe 5460 persuaded.io_hyber.exe 5460 persuaded.io_hyber.exe 5460 persuaded.io_hyber.exe 5460 persuaded.io_hyber.exe 5460 persuaded.io_hyber.exe 5460 persuaded.io_hyber.exe 5460 persuaded.io_hyber.exe 5460 persuaded.io_hyber.exe 5460 persuaded.io_hyber.exe 5460 persuaded.io_hyber.exe 5460 persuaded.io_hyber.exe 5460 persuaded.io_hyber.exe 5460 persuaded.io_hyber.exe 5460 persuaded.io_hyber.exe 5460 persuaded.io_hyber.exe 5460 persuaded.io_hyber.exe 5460 persuaded.io_hyber.exe 5460 persuaded.io_hyber.exe 5460 persuaded.io_hyber.exe 5460 persuaded.io_hyber.exe 5460 persuaded.io_hyber.exe 5460 persuaded.io_hyber.exe 5460 persuaded.io_hyber.exe 5460 persuaded.io_hyber.exe 5460 persuaded.io_hyber.exe 5460 persuaded.io_hyber.exe 5460 persuaded.io_hyber.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 3232 LogonUI.exe Token: SeCreatePagefilePrivilege 3232 LogonUI.exe Token: SeDebugPrivilege 5460 persuaded.io_hyber.exe Token: SeDebugPrivilege 700 powershell.exe Token: SeIncreaseQuotaPrivilege 700 powershell.exe Token: SeSecurityPrivilege 700 powershell.exe Token: SeTakeOwnershipPrivilege 700 powershell.exe Token: SeLoadDriverPrivilege 700 powershell.exe Token: SeSystemProfilePrivilege 700 powershell.exe Token: SeSystemtimePrivilege 700 powershell.exe Token: SeProfSingleProcessPrivilege 700 powershell.exe Token: SeIncBasePriorityPrivilege 700 powershell.exe Token: SeCreatePagefilePrivilege 700 powershell.exe Token: SeBackupPrivilege 700 powershell.exe Token: SeRestorePrivilege 700 powershell.exe Token: SeShutdownPrivilege 700 powershell.exe Token: SeDebugPrivilege 700 powershell.exe Token: SeSystemEnvironmentPrivilege 700 powershell.exe Token: SeRemoteShutdownPrivilege 700 powershell.exe Token: SeUndockPrivilege 700 powershell.exe Token: SeManageVolumePrivilege 700 powershell.exe Token: 33 700 powershell.exe Token: 34 700 powershell.exe Token: 35 700 powershell.exe Token: 36 700 powershell.exe Token: SeIncBasePriorityPrivilege 5460 persuaded.io_hyber.exe Token: SeDebugPrivilege 1428 whoami.exe Token: SeDebugPrivilege 2712 tasklist.exe Token: SeIncreaseQuotaPrivilege 700 powershell.exe Token: SeSecurityPrivilege 700 powershell.exe Token: SeTakeOwnershipPrivilege 700 powershell.exe Token: SeLoadDriverPrivilege 700 powershell.exe Token: SeSystemProfilePrivilege 700 powershell.exe Token: SeSystemtimePrivilege 700 powershell.exe Token: SeProfSingleProcessPrivilege 700 powershell.exe Token: SeIncBasePriorityPrivilege 700 powershell.exe Token: SeCreatePagefilePrivilege 700 powershell.exe Token: SeBackupPrivilege 700 powershell.exe Token: SeRestorePrivilege 700 powershell.exe Token: SeShutdownPrivilege 700 powershell.exe Token: SeDebugPrivilege 700 powershell.exe Token: SeSystemEnvironmentPrivilege 700 powershell.exe Token: SeRemoteShutdownPrivilege 700 powershell.exe Token: SeUndockPrivilege 700 powershell.exe Token: SeManageVolumePrivilege 700 powershell.exe Token: 33 700 powershell.exe Token: 34 700 powershell.exe Token: 35 700 powershell.exe Token: 36 700 powershell.exe Token: SeIncreaseQuotaPrivilege 4192 WMIC.exe Token: SeSecurityPrivilege 4192 WMIC.exe Token: SeTakeOwnershipPrivilege 4192 WMIC.exe Token: SeLoadDriverPrivilege 4192 WMIC.exe Token: SeSystemProfilePrivilege 4192 WMIC.exe Token: SeSystemtimePrivilege 4192 WMIC.exe Token: SeProfSingleProcessPrivilege 4192 WMIC.exe Token: SeIncBasePriorityPrivilege 4192 WMIC.exe Token: SeCreatePagefilePrivilege 4192 WMIC.exe Token: SeBackupPrivilege 4192 WMIC.exe Token: SeRestorePrivilege 4192 WMIC.exe Token: SeShutdownPrivilege 4192 WMIC.exe Token: SeDebugPrivilege 4192 WMIC.exe Token: SeSystemEnvironmentPrivilege 4192 WMIC.exe Token: SeRemoteShutdownPrivilege 4192 WMIC.exe - Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 5460 persuaded.io_hyber.exe - Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 3232 LogonUI.exe 3232 LogonUI.exe 5460 persuaded.io_hyber.exe - Suspicious use of WriteProcessMemory 39 IoCs
description pid Process procid_target PID 5460 wrote to memory of 700 5460 persuaded.io_hyber.exe 91 PID 5460 wrote to memory of 4912 5460 persuaded.io_hyber.exe 93 PID 5460 wrote to memory of 3024 5460 persuaded.io_hyber.exe 95 PID 5460 wrote to memory of 4336 5460 persuaded.io_hyber.exe 132 PID 5460 wrote to memory of 2816 5460 persuaded.io_hyber.exe 99 PID 5460 wrote to memory of 2468 5460 persuaded.io_hyber.exe 101 PID 5460 wrote to memory of 4472 5460 persuaded.io_hyber.exe 103 PID 5460 wrote to memory of 4528 5460 persuaded.io_hyber.exe 105 PID 5460 wrote to memory of 1056 5460 persuaded.io_hyber.exe 107 PID 5460 wrote to memory of 5828 5460 persuaded.io_hyber.exe 109 PID 5828 wrote to memory of 4208 5828 fodhelper.exe 110 PID 5460 wrote to memory of 5956 5460 persuaded.io_hyber.exe 113 PID 5460 wrote to memory of 4768 5460 persuaded.io_hyber.exe 114 PID 5460 wrote to memory of 2996 5460 persuaded.io_hyber.exe 120 PID 5460 wrote to memory of 4948 5460 persuaded.io_hyber.exe 121 PID 5460 wrote to memory of 5680 5460 persuaded.io_hyber.exe 122 PID 5460 wrote to memory of 4744 5460 persuaded.io_hyber.exe 123 PID 5460 wrote to memory of 4732 5460 persuaded.io_hyber.exe 124 PID 5460 wrote to memory of 3456 5460 persuaded.io_hyber.exe 125 PID 5460 wrote to memory of 4704 5460 persuaded.io_hyber.exe 126 PID 5460 wrote to memory of 3032 5460 persuaded.io_hyber.exe 130 PID 5460 wrote to memory of 6136 5460 persuaded.io_hyber.exe 136 PID 4704 wrote to memory of 2144 4704 cmd.exe 137 PID 5460 wrote to memory of 2484 5460 persuaded.io_hyber.exe 138 PID 4732 wrote to memory of 1924 4732 cmd.exe 139 PID 5680 wrote to memory of 2712 5680 cmd.exe 140 PID 4948 wrote to memory of 760 4948 cmd.exe 142 PID 4744 wrote to memory of 1428 4744 cmd.exe 141 PID 3456 wrote to memory of 2112 3456 cmd.exe 143 PID 5460 wrote to memory of 2812 5460 persuaded.io_hyber.exe 144 PID 5460 wrote to memory of 4192 5460 persuaded.io_hyber.exe 145 PID 5460 wrote to memory of 2340 5460 persuaded.io_hyber.exe 146 PID 5460 wrote to memory of 5840 5460 persuaded.io_hyber.exe 147 PID 5460 wrote to memory of 1372 5460 persuaded.io_hyber.exe 148 PID 5460 wrote to memory of 6000 5460 persuaded.io_hyber.exe 149 PID 1924 wrote to memory of 4904 1924 net.exe 156 PID 2996 wrote to memory of 4796 2996 cmd.exe 157 PID 2340 wrote to memory of 4552 2340 net.exe 159 PID 2996 wrote to memory of 3240 2996 cmd.exe 161 - Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
- Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\persuaded.io_hyber.exe"C:\Users\Admin\AppData\Local\Temp\persuaded.io_hyber.exe"1⤵
- Modifies Windows Defender DisableAntiSpyware settings
- Disables RegEdit via registry modification
- Drops file in Drivers directory
- Creates a file in the Startup directory
- Adds Run key to start application
- Drops file in System32 directory
- Sets desktop wallpaper using registry
- Modifies Control Panel
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5460 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoP -NonI -W Hidden -Exec Bypass -Enc UwBlAHQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARABpAHMAYQBiAGwAZQBSAGUAYQBsAHQAaQBtAGUATQBvAG4AaQB0AG8AcgBpAG4AZwAgACQAdAByAHUAZQA7ACAAUwBlAHQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARABpAHMAYQBiAGwAZQBCAGUAaABhAHYAaQBvAHIATQBvAG4AaQB0AG8AcgBpAG4AZwAgACQAdAByAHUAZQA=2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:700
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" stop wscsvc2⤵
- Launches sc.exe
PID:4912
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" config wscsvc start= disabled2⤵
- Launches sc.exe
PID:3024
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" stop SecurityHealthService2⤵
- Launches sc.exe
PID:4336
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" config SecurityHealthService start= disabled2⤵
- Launches sc.exe
PID:2816
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" stop WinDefend2⤵
- Launches sc.exe
PID:2468
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" config WinDefend start= disabled2⤵
- Launches sc.exe
PID:4472
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" stop MsMpSvc2⤵
- Launches sc.exe
PID:4528
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" config MsMpSvc start= disabled2⤵
- Launches sc.exe
PID:1056
-
-
C:\Windows\System32\fodhelper.exe"C:\Windows\System32\fodhelper.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:5828 -
C:\Users\Admin\AppData\Local\Temp\persuaded.io_hyber.exe"C:\Users\Admin\AppData\Local\Temp\persuaded.io_hyber.exe"3⤵PID:4208
-
-
-
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" C:\Users\Admin\AppData\Local\Temp\makelnk.vbs2⤵
- Executes a VBScript file via the Windows Script Host.
PID:5956
-
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks" /create /tn "SysUpdateTask" /tr "C:\Users\Admin\AppData\Local\Temp\persuaded.io_hyber.exe" /sc onlogon /f2⤵
- Scheduled Task/Job: Scheduled Task
PID:4768
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\del.bat" "2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2996 -
C:\Windows\system32\vssadmin.exevssadmin delete shadows /all /quiet3⤵
- Interacts with shadow copies
PID:4796
-
-
C:\Windows\System32\Wbem\WMIC.exewmic shadowcopy delete3⤵
- Suspicious behavior: EnumeratesProcesses
PID:3240
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c systeminfo > "C:\ProgramData\SysUpdate\Logs\sysinfo.txt"2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4948 -
C:\Windows\system32\systeminfo.exesysteminfo3⤵
- Gathers system information
PID:760
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c tasklist > "C:\ProgramData\SysUpdate\Logs\tasklist.txt"2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5680 -
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV13⤵PID:4336
-
-
C:\Windows\system32\tasklist.exetasklist3⤵
- Discovers running processes
- Suspicious use of AdjustPrivilegeToken
PID:2712
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c whoami > "C:\ProgramData\SysUpdate\Logs\whoami.txt"2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4744 -
C:\Windows\system32\whoami.exewhoami3⤵
- Suspicious use of AdjustPrivilegeToken
PID:1428
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c net user > "C:\ProgramData\SysUpdate\Logs\netuser.txt"2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4732 -
C:\Windows\system32\net.exenet user3⤵
- Suspicious use of WriteProcessMemory
PID:1924 -
C:\Windows\system32\net1.exeC:\Windows\system32\net1 user4⤵PID:4904
-
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c ipconfig /all > "C:\ProgramData\SysUpdate\Logs\ipconfig.txt"2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:3456 -
C:\Windows\system32\ipconfig.exeipconfig /all3⤵
- Gathers network information
PID:2112
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c netstat -an > "C:\ProgramData\SysUpdate\Logs\netstat.txt"2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4704 -
C:\Windows\system32\NETSTAT.EXEnetstat -an3⤵
- Gathers network information
PID:2144
-
-
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks" /create /tn "RansomwareCheck" /tr "C:\Users\Admin\AppData\Local\Temp\persuaded.io_hyber.exe" /sc daily /f2⤵
- Scheduled Task/Job: Scheduled Task
PID:3032
-
-
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" C:\Users\Admin\AppData\Local\Temp\createshortcut.vbs2⤵
- Executes a VBScript file via the Windows Script Host.
PID:6136
-
-
C:\Windows\System32\notepad.exe"C:\Windows\System32\notepad.exe"2⤵PID:2484
-
-
C:\Windows\System32\vssadmin.exe"C:\Windows\System32\vssadmin.exe" delete shadows /all /quiet2⤵
- Interacts with shadow copies
PID:2812
-
-
C:\Windows\System32\wbem\WMIC.exe"C:\Windows\System32\wbem\WMIC.exe" shadowcopy delete2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4192
-
-
C:\Windows\System32\net.exe"C:\Windows\System32\net.exe" stop srservice2⤵
- Suspicious use of WriteProcessMemory
PID:2340 -
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop srservice3⤵PID:4552
-
-
-
C:\Windows\System32\netsh.exe"C:\Windows\System32\netsh.exe" advfirewall set allprofiles state off2⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
PID:5840
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" config i8042prt start= disabled2⤵
- Launches sc.exe
PID:1372
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" stop i8042prt2⤵
- Launches sc.exe
PID:6000
-
-
C:\Windows\system32\LogonUI.exe"LogonUI.exe" /flags:0x0 /state0:0xa3a21855 /state1:0x41c64e6d1⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Checks processor information in registry
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:3232
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k CameraMonitor1⤵PID:4468
-
C:\Users\Admin\AppData\Local\Temp\persuaded.io_hyber.exeC:\Users\Admin\AppData\Local\Temp\persuaded.io_hyber.exe1⤵PID:5576
-
C:\Users\Admin\AppData\Local\Temp\persuaded.io_hyber.exeC:\Users\Admin\AppData\Local\Temp\persuaded.io_hyber.exe1⤵PID:2832
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵PID:4416
Network
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
4PowerShell
1Visual Basic
1Windows Command Shell
1Scheduled Task/Job
1Scheduled Task
1System Services
2Service Execution
2Windows Management Instrumentation
1Persistence
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
2Create or Modify System Process
4Windows Service
4Event Triggered Execution
1Netsh Helper DLL
1Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
2Create or Modify System Process
4Windows Service
4Event Triggered Execution
1Netsh Helper DLL
1Scheduled Task/Job
1Scheduled Task
1Defense Evasion
Direct Volume Access
1Impair Defenses
3Disable or Modify System Firewall
1Disable or Modify Tools
1Indicator Removal
2File Deletion
2Modify Registry
3Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\ProgramData\invoice_1.pdf
- Size 66KB
- SHA256 49999ac70a406123cb37594e930b8308f8fac12672246783697fce5be5b85a3b
- MD5 45f63a409d30bf3b9ae554b20d9dfee9
- SHA1 ce8deac57546c3a6dffb839b8f45d589fe5378a8
- SHA512 126a09af903f2e9ca69ea2bdc2dc0f160b90808559abc4e86c22177899cbfdbf8ecbc4966336f162f467288e4413ffaaf2f36ac2f55dc47ea5dd535b0c1a71f9
- SSDEEP 1536:D2Rveo0zwn1+7cRMa3EJd7OrjWjoC9LWojXQQdGU4I13Vx7tse8EJ:DgvQzwnA81Erm+FLXQQoRIJVx7tse8EJ
- TLSH T16B632A334B23FDC5577F3D80F1942E520C883A6B87B5666CFBC90A5938A5284DF2E598
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\SystemVolumeInformation\doc_3.pdf
- Size 66KB
- SHA256 9b92f0634f5af34a4b9ccaf3c07980c72a638be7e17fddfcacca80f6c3edef93
- MD5 e0ed5bb02728c5bab520816a35bd0223
- SHA1 4bede05000548db33aebad205ff89f3ce6295f0e
- SHA512 ecbbb720632f0e929788a73427a322c811cb54f64323d5994533e9b10b8667761a40a8801bd3332d184dd4a09db5be68184419e3b737c1e110a84b6897764938
- SSDEEP 1536:j2Rveo0zwn1+7cRMa3EJd7OrjWjoC9LWojXQQdGU4I13Vx7tse8EA:jgvQzwnA81Erm+FLXQQoRIJVx7tse8EA
- TLSH T1AF6329734B23FDC5577F3D80F0A42E510C883A6B87B5666CFBC90A6938A5284DF2D598
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\createshortcut.vbs
- Size 243B
- SHA256 81028b8a4c0a438b4abc69acb3b3871dd5fe6db50a3f67886e6f1f96cb90eae1
- MD5 4fd2b0847c935c6d66491acd98b07b6b
- SHA1 18cf720230151ce0b12fbb2fbbfc3c5effb78709
- SHA512 6815e37eb20c67382f8803ff012d7f865a051c5bdea90b6605e7f057a59ddd07901445b16ba52e165daf7e2f85b105dd9542e187326839a2c25113102992c03a
- TLSH T113D0979BB10DC2AC0000123B80F3CE8CE5B148283B0BBF704AA1CC0E32C08858DF6443
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\del.bat
- Size 59B
- SHA256 a51f2a0f053ac35b4158bb02b75421ab3698e1d0ee4f926abf1bae3af1570c53
- MD5 9cecbebdcdd60358132849714a3b82f7
- SHA1 be6e20834a5726f3742f05e6bdfaff16118b147f
- SHA512 7b48bd66b4c741d2de2e8b7bc0eab8f438ddc1ed0c73e8b70add9bee400f6640f692884965032616e2d6911a22a17d1d3762421aa49fe021660c9052cfc0675a
- TLSH T13DA002620F961E5469529E5AD73425239D1F104CD1390012F05232903DA98DE0EC2144
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\makelnk.vbs
- Size 244B
- SHA256 73e2d49464321126f928278fb9050211888ee983479f5f9e45ed51d95d89fd7e
- MD5 b612ad5502d0dc4c9b7c4a29334ccc27
- SHA1 1aed0df973d0f14d410a8c1a2ad60c3d115d3f48
- SHA512 c425934ad22d47bcdfa77c874a18cb5122ad3063d564c3313b651d06fdcc742bfbd2eaf20e96fe26c1e475a1d1941be8763716b1c3dfe8273e35f1147ca84498
- TLSH T1E7D0A79BB54DC6AD0011123B80F3CE8DE6F258693B1BBF709AA5DD0E36C08859DF6543
- MD5 SHA1 SHA512 TLSH