Analysis
- max time kernel
148s - max time network
142s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
10/09/2026, 12:31
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
unhide.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
10 signatures
150 seconds
General
- Target unhide.exe
- Size 389KB
- Sample260910-pp3mpswyhv
- SHA256 4f68c751ca08888c6cf5eba888e9385d52f42e0c1a60ec7888c34841a7540b53
- MD5 2529406e348278e6cb3ff7fcb104c54f
- SHA1 b3a189605458d333a8defd92cb4975e0e9b03e46
- SHA512 e35482df0f545f7dca6380d9d18875d052180d3dcc74c387bf98f2528d84074f9f60f56235c9ac30f012410f338503d05766619ab2b15e0df04ba85362fb312c
- SSDEEP 6144:NUuTTTKHFpSDUISjVcSPf/Ke4Kk/jrjzc6r6IFLpjZ4R7fRXN:2u0FpBISxcSPfv4hTc6rDL74R7j
- TLSH T1A9843A60E1D885B3D5EA02304CB17B30156EFE982675C18F574C3BAA3ABEBC35136B19
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Drops file in Drivers directory 31 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\Drivers\gm.dls unhide.exe File opened for modification C:\Windows\SysWOW64\Drivers\it-IT\ndiscap.sys.mui unhide.exe File opened for modification C:\Windows\SysWOW64\Drivers\it-IT\NdisImPlatform.sys.mui unhide.exe File opened for modification C:\Windows\SysWOW64\Drivers\ja-JP unhide.exe File opened for modification C:\Windows\SysWOW64\Drivers\de-DE unhide.exe File opened for modification C:\Windows\SysWOW64\Drivers\de-DE\wfplwfs.sys.mui unhide.exe File opened for modification C:\Windows\SysWOW64\Drivers\en-US\wfplwfs.sys.mui unhide.exe File opened for modification C:\Windows\SysWOW64\Drivers\es-ES unhide.exe File opened for modification C:\Windows\SysWOW64\Drivers\ja-JP\ndiscap.sys.mui unhide.exe File opened for modification C:\Windows\SysWOW64\Drivers\uk-UA\NdisImPlatform.sys.mui unhide.exe File opened for modification C:\Windows\SysWOW64\Drivers\afunix.sys unhide.exe File opened for modification C:\Windows\SysWOW64\Drivers\de-DE\ndiscap.sys.mui unhide.exe File opened for modification C:\Windows\SysWOW64\Drivers\en-US\ndiscap.sys.mui unhide.exe File opened for modification C:\Windows\SysWOW64\Drivers\es-ES\ndiscap.sys.mui unhide.exe File opened for modification C:\Windows\SysWOW64\Drivers\fr-FR unhide.exe File opened for modification C:\Windows\SysWOW64\Drivers\ja-JP\wfplwfs.sys.mui unhide.exe File opened for modification C:\Windows\SysWOW64\Drivers\uk-UA unhide.exe File opened for modification C:\Windows\SysWOW64\Drivers\fr-FR\NdisImPlatform.sys.mui unhide.exe File opened for modification C:\Windows\SysWOW64\Drivers\gmreadme.txt unhide.exe File opened for modification C:\Windows\SysWOW64\Drivers\it-IT unhide.exe File opened for modification C:\Windows\SysWOW64\Drivers\UMDF\en-US unhide.exe File opened for modification C:\Windows\SysWOW64\Drivers\es-ES\NdisImPlatform.sys.mui unhide.exe File opened for modification C:\Windows\SysWOW64\Drivers\ja-JP\NdisImPlatform.sys.mui unhide.exe File opened for modification C:\Windows\SysWOW64\Drivers\en-US\NdisImPlatform.sys.mui unhide.exe File opened for modification C:\Windows\SysWOW64\Drivers\fr-FR\wfplwfs.sys.mui unhide.exe File opened for modification C:\Windows\SysWOW64\Drivers\it-IT\wfplwfs.sys.mui unhide.exe File opened for modification C:\Windows\SysWOW64\Drivers\en-US unhide.exe File opened for modification C:\Windows\SysWOW64\Drivers\UMDF unhide.exe File opened for modification C:\Windows\SysWOW64\Drivers\de-DE\NdisImPlatform.sys.mui unhide.exe File opened for modification C:\Windows\SysWOW64\Drivers\es-ES\wfplwfs.sys.mui unhide.exe File opened for modification C:\Windows\SysWOW64\Drivers\fr-FR\ndiscap.sys.mui unhide.exe - Manipulates Digital Signatures 1 IoCs
Attackers can apply techniques such as modifying certain DLL exports to make their binary seem valid.
description ioc Process File opened for modification C:\Windows\SysWOW64\wintrust.dll unhide.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Drops desktop.ini file(s) 36 IoCs
description ioc Process File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\DataServices\DESKTOP.INI unhide.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-s..32-kf-commondesktop_31bf3856ad364e35_10.0.26100.1_none_ef1cce0418e0ca2e\desktop.ini unhide.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-s..32-kf-commonstartup_31bf3856ad364e35_10.0.26100.1_none_f903e633b39522d3\desktop.ini unhide.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-s..kf-commonadmintools_31bf3856ad364e35_10.0.26100.1_none_520ba6927730f124\desktop.ini unhide.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-s..ktopini-maintenance_31bf3856ad364e35_10.0.26100.1_none_5b8ddc5d05b3ae46\Desktop.ini unhide.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-s..sktopini-sendtouser_31bf3856ad364e35_10.0.26100.1_none_053839e1fca5597b\Desktop.ini unhide.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-fontext_31bf3856ad364e35_10.0.26100.1591_none_3a4593a9a3a42262\desktop.ini unhide.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-s..ini-systemtoolsuser_31bf3856ad364e35_10.0.26100.1_none_1d9f561f4c141236\Desktop.ini unhide.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-s..opini-accessibility_31bf3856ad364e35_10.0.26100.1_none_d75f0561e5d53d5b\Desktop.ini unhide.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-shell-wallpaper-themea_31bf3856ad364e35_10.0.26100.1_none_d3c965ed0d7f5b0d\Desktop.ini unhide.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-s..er-content-extended_31bf3856ad364e35_10.0.26100.1_none_e78a517c04a5f782\Desktop.ini unhide.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-s..ktopini-systemtools_31bf3856ad364e35_10.0.26100.1_none_7b60e8f9f0308735\Desktop.ini unhide.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-shell-wallpaper-themeb_31bf3856ad364e35_10.0.26100.1_none_d3c94f250d7f74ae\Desktop.ini unhide.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-s..2-kf-commonpictures_31bf3856ad364e35_10.0.26100.1_none_7d46065ee5cd8613\desktop.ini unhide.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-ie-objectcontrolviewer_31bf3856ad364e35_11.0.26100.1150_none_16c5cc95ed81961d\desktop.ini unhide.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-s..-kf-commonstartmenu_31bf3856ad364e35_10.0.26100.1_none_3df18355654b83e7\desktop.ini unhide.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-s..ktopini-accessories_31bf3856ad364e35_10.0.26100.1_none_e90ac44521f6781d\Desktop.ini unhide.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-s..l32-kf-programfiles_31bf3856ad364e35_10.0.26100.1_none_128f27879ad1c14e\desktop.ini unhide.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-shell-wallpaper-themed_31bf3856ad364e35_10.0.26100.1_none_d3c921950d7fa7f0\Desktop.ini unhide.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-shell32-kf-commonmusic_31bf3856ad364e35_10.0.26100.1_none_760a3fa79d0dd71f\desktop.ini unhide.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-ie-offlinefavorites_31bf3856ad364e35_11.0.26100.1150_none_40cb47622b181101\desktop.ini unhide.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-s..-kf-publiclibraries_31bf3856ad364e35_10.0.26100.1_none_12dc48264ff839df\desktop.ini unhide.exe File opened for modification C:\Windows\Fonts\desktop.ini unhide.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-s..-kf-commondocuments_31bf3856ad364e35_10.0.26100.1_none_4bc4edc230be4464\desktop.ini unhide.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-s..-kf-commondownloads_31bf3856ad364e35_10.0.26100.1_none_f0177ec0bacc01ab\desktop.ini unhide.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-s..l32-kf-commonvideos_31bf3856ad364e35_10.0.26100.1_none_d939b1ba77084dd2\desktop.ini unhide.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-s..2-kf-commonprograms_31bf3856ad364e35_10.0.26100.1_none_4b82445892b64521\desktop.ini unhide.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-s..ini-accessoriesuser_31bf3856ad364e35_10.0.26100.1_none_20f7d6167cb25b4e\Desktop.ini unhide.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-s..ini-maintenanceuser_31bf3856ad364e35_10.0.26100.1_none_02fb486cbe6baf65\Desktop.ini unhide.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-shell-sounds_31bf3856ad364e35_10.0.26100.1_none_140624931e1631ac\Desktop.ini unhide.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-shell-wallpaper-themec_31bf3856ad364e35_10.0.26100.1_none_d3c9385d0d7f8e4f\Desktop.ini unhide.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-s..l32-kf-userprofiles_31bf3856ad364e35_10.0.26100.1_none_80d96be390261ff6\desktop.ini unhide.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\History\desktop.ini unhide.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-s..-kf-programfilesx86_31bf3856ad364e35_10.0.26100.1_none_7f736e321868c082\desktop.ini unhide.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-s..i-accessibilityuser_31bf3856ad364e35_10.0.26100.1_none_6038226271499ae0\Desktop.ini unhide.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-shell32-kf-public_31bf3856ad364e35_10.0.26100.1_none_53f4413b5b0ec6c8\desktop.ini unhide.exe - Drops file in System32 directory 64 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\de-DE\ir32_32original.dll.mui unhide.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\ehstorpwddrv.inf_amd64_8e65b5edf0074fc9\EhStorPwdDrv.dll unhide.exe File opened for modification C:\Windows\SysWOW64\wevtutil.exe unhide.exe File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\NetTCPIP\Test-NetConnection.psm1 unhide.exe File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\Get-DscConfigurationStatus.cdxml unhide.exe File opened for modification C:\Windows\System32\catroot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-OneCore-SecureStartup-Foundation-Package~31bf3856ad364e35~amd64~uk-UA~10.0.26100.1.cat unhide.exe File opened for modification C:\Windows\System32\catroot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-DirectoryServices-ADAM-Client-FOD-Package~31bf3856ad364e35~wow64~~10.0.26100.1742.cat unhide.exe File opened for modification C:\Windows\System32\catroot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-EnterpriseClientSync-Host-FOD-Package~31bf3856ad364e35~amd64~~10.0.26100.1742.cat unhide.exe File opened for modification C:\Windows\System32\catroot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-PAW-Package~31bf3856ad364e35~amd64~ja-JP~10.0.26100.1.cat unhide.exe File opened for modification C:\Windows\System32\catroot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-StepsRecorder-Package~31bf3856ad364e35~wow64~~10.0.26100.1742.cat unhide.exe File opened for modification C:\Windows\System32\DriverStore\ja-JP\c_fscfsmetadataserver.inf_loc unhide.exe File opened for modification C:\Windows\SysWOW64\WinMetadata\Windows.Web.winmd unhide.exe File opened for modification C:\Windows\System32\catroot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\MultiPoint-Connector-Opt-Package~31bf3856ad364e35~amd64~en-US~10.0.26100.1.cat unhide.exe File opened for modification C:\Windows\System32\catroot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-UtilityVM-Containers-Package~31bf3856ad364e35~amd64~en-US~10.0.26100.1591.cat unhide.exe File opened for modification C:\Windows\System32\catroot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Multimedia-MF-Package~31bf3856ad364e35~amd64~uk-UA~10.0.26100.1.cat unhide.exe File opened for modification C:\Windows\System32\catroot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-ProjFS-Package~31bf3856ad364e35~amd64~en-US~10.0.26100.1.cat unhide.exe File opened for modification C:\Windows\SysWOW64\it-IT\winmsipc.dll.mui unhide.exe File opened for modification C:\Windows\System32\catroot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Multimedia-RestrictedCodecsCore-WCOSMinusHeadless-WOW64-Package~31bf3856ad364e35~amd64~ja-JP~10.0.26100.1.cat unhide.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\mdmzyxlg.inf_amd64_abdea4fc1a7172cd unhide.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\npsvctrig.inf_amd64_d94cf1b3e0fa7b40\npsvctrig.sys unhide.exe File opened for modification C:\Windows\SysWOW64\ka-GE unhide.exe File opened for modification C:\Windows\SysWOW64\pt-BR\windows.ui.xaml.dll.mui unhide.exe File opened for modification C:\Windows\System32\catroot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\HyperV-Compute-Host-Containers-merged-Package~31bf3856ad364e35~amd64~de-DE~10.0.26100.1.cat unhide.exe File opened for modification C:\Windows\System32\DriverStore\fr-FR\c_netdriver.inf_loc unhide.exe File opened for modification C:\Windows\SysWOW64\ksxbar.ax unhide.exe File opened for modification C:\Windows\SysWOW64\nl-NL unhide.exe File opened for modification C:\Windows\SysWOW64\print.exe unhide.exe File opened for modification C:\Windows\SysWOW64\sdiagnhost.exe unhide.exe File opened for modification C:\Windows\SysWOW64\C_IS2022.DLL unhide.exe File opened for modification C:\Windows\System32\DriverStore\it-IT\iaLPSS2i_GPIO2_BXT_P.inf_loc unhide.exe File opened for modification C:\Windows\System32\catroot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-WMIC-WOW64-Package~31bf3856ad364e35~wow64~it-IT~10.0.26100.1.cat unhide.exe File opened for modification C:\Windows\System32\catroot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Containers-Server-Package~31bf3856ad364e35~amd64~de-DE~10.0.26100.1.cat unhide.exe File opened for modification C:\Windows\System32\catroot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\HyperV-Networking-VirtualDevice-Synthetic-Package~31bf3856ad364e35~amd64~it-IT~10.0.26100.1.cat unhide.exe File opened for modification C:\Windows\SysWOW64\gdi32full.dll unhide.exe File opened for modification C:\Windows\SysWOW64\Windows.StateRepositoryCore.dll unhide.exe File opened for modification C:\Windows\System32\catroot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Hyper-V-Offline-Core-Group-merged-Package~31bf3856ad364e35~amd64~es-ES~10.0.26100.1.cat unhide.exe File opened for modification C:\Windows\System32\catroot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-OneCore-Containers-merged-Package~31bf3856ad364e35~amd64~es-ES~10.0.26100.1.cat unhide.exe File opened for modification C:\Windows\System32\catroot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-ErrorReportingFaults-Package~31bf3856ad364e35~amd64~it-IT~10.0.26100.1.cat unhide.exe File opened for modification C:\Windows\SysWOW64\en-US\taskschd.msc unhide.exe File opened for modification C:\Windows\SysWOW64\es-ES\Windows.Graphics.Printing.3D.dll.mui unhide.exe File opened for modification C:\Windows\SysWOW64\Printing_Admin_Scripts\it-IT unhide.exe File opened for modification C:\Windows\System32\catroot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-OneCore-Common-DriverClasses-Package~31bf3856ad364e35~amd64~ja-JP~10.0.26100.1.cat unhide.exe File opened for modification C:\Windows\System32\catroot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-OneCore-OverlayFilter-Package~31bf3856ad364e35~amd64~uk-UA~10.0.26100.1.cat unhide.exe File opened for modification C:\Windows\System32\catroot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-OneCore-Pnp-OnlineDriverStore-WOW64-Package~31bf3856ad364e35~amd64~de-DE~10.0.26100.1.cat unhide.exe File opened for modification C:\Windows\System32\DriverStore\it-IT\netl1e64.inf_loc unhide.exe File opened for modification C:\Windows\SysWOW64\en-US\charmap.exe.mui unhide.exe File opened for modification C:\Windows\SysWOW64\ja-JP\Licenses\OEM\IoTEnterpriseS unhide.exe File opened for modification C:\Windows\System32\catroot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\HyperV-RDP4VS-Package~31bf3856ad364e35~amd64~en-US~10.0.26100.1.cat unhide.exe File opened for modification C:\Windows\System32\catroot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package0011~31bf3856ad364e35~amd64~~10.0.26100.1742.cat unhide.exe File opened for modification C:\Windows\System32\catroot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package01~31bf3856ad364e35~amd64~ja-JP~10.0.26100.1.cat unhide.exe File opened for modification C:\Windows\System32\catroot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Windows-ClientCore-Shutdown-Package~31bf3856ad364e35~amd64~ja-JP~10.0.26100.1.cat unhide.exe File opened for modification C:\Windows\SysWOW64\cnvfat.dll unhide.exe File opened for modification C:\Windows\System32\DriverStore\en-US\iaLPSS2i_I2C_GLK.inf_loc unhide.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\cht4nulx64.inf_amd64_c8526fef8160095c unhide.exe File opened for modification C:\Windows\System32\DriverStore\ja-JP\c_scmdisk.inf_loc unhide.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\mdmairte.inf_amd64_2f3fd088bcf459d6\mdmairte.inf unhide.exe File opened for modification C:\Windows\SysWOW64\en-US\msdrm.dll.mui unhide.exe File opened for modification C:\Windows\SysWOW64\MapGeocoder.dll unhide.exe File opened for modification C:\Windows\SysWOW64\LockScreenData.dll unhide.exe File opened for modification C:\Windows\System32\catroot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\MultiPoint-Tools-Opt-Package~31bf3856ad364e35~amd64~uk-UA~10.0.26100.1.cat unhide.exe File opened for modification C:\Windows\System32\catroot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Foundation-Win0-merged-Package~31bf3856ad364e35~amd64~es-ES~10.0.26100.1.cat unhide.exe File opened for modification C:\Windows\System32\catroot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Media-Streaming-WOW64-merged-Package~31bf3856ad364e35~amd64~es-ES~10.0.26100.1.cat unhide.exe File opened for modification C:\Windows\System32\DriverStore\de-DE\bthspp.inf_loc unhide.exe File opened for modification C:\Windows\SysWOW64\fdeploy.dll unhide.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Microsoft Office\root\Office16\SHAREPOINTPROVIDER.DLL unhide.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\ResiliencyLinks\Locales\uk.pak.DATA unhide.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\ko-kr unhide.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files unhide.exe File opened for modification C:\Program Files (x86)\Common Files\System\ado\de-DE\msader15.dll.mui unhide.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\Microsoft.VisualBasic.Core.dll unhide.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ko\UIAutomationTypes.resources.dll unhide.exe File opened for modification C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Colors\Violet.xml unhide.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGMN054.XML unhide.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\js unhide.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\js\nls\zh-tw\ui-strings.js unhide.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\upsell.png unhide.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\pages-app\images\rhp_world_icon.png unhide.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\ug-CN unhide.exe File opened for modification C:\Program Files (x86)\Common Files\Microsoft Shared\ink\uk-UA\TabTip32.exe.mui unhide.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft Analysis Services unhide.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\ru-ru unhide.exe File opened for modification C:\Program Files (x86)\Common Files\Microsoft Shared\ink\mshwgst.dll unhide.exe File opened for modification C:\Program Files\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\MSFT_PackageManagementSource\ja-JP\MSFT_PackageManagementSource.strings.psd1 unhide.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\js\nls\eu-es unhide.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-core-util-l1-1-0.dll unhide.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\images\themes\dark\icons_retina.png unhide.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\js\nls\sk-sk unhide.exe File opened for modification C:\Program Files (x86)\Common Files\System\msadc\es-ES\msdaremr.dll.mui unhide.exe File opened for modification C:\Program Files\Common Files\microsoft shared\VSTO\vstoee100.tlb unhide.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\HomeBusiness2019R_Grace-ul-oob.xrm-ms unhide.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\O365EduCloudEDUR_Subscription-pl.xrm-ms unhide.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\js\nls\ru-ru\ui-strings.js unhide.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\ResiliencyLinks\Extensions\external_extensions.json.DATA unhide.exe File opened for modification C:\Program Files (x86)\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\MSFT_PackageManagement\de-DE\MSFT_PackageManagement.schema.mfl unhide.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\Microsoft.VisualBasic.Forms.dll unhide.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\Power Map Excel Add-in\EXCELPLUGINDATAPROVIDER.DLL unhide.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\[email protected] unhide.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Analysis Services\AS OLEDB\140\Cartridges\msjet.xsl unhide.exe File opened for modification C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\it\System.Data.Linq.Resources.dll unhide.exe File opened for modification C:\Program Files (x86)\WindowsPowerShell\Modules\Pester\3.4.0\Functions\Describe.Tests.ps1 unhide.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\dialogs\error_window.html unhide.exe File opened for modification C:\Program Files\VideoLAN\VLC\NEWS.txt unhide.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins3d\prcr.x3d unhide.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\js\nls\ar-ae unhide.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\js\nls\ja-jp\ui-strings.js unhide.exe File opened for modification C:\Program Files\Google\Chrome\Application\SetupMetrics unhide.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\js\nls\ru-ru unhide.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\LanguageNames2\DisplayLanguageNames.en_US_POSIX.txt unhide.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\elevation_service.exe unhide.exe File opened for modification C:\Program Files (x86)\WindowsPowerShell\Modules\PowerShellGet\1.0.0.1\es-ES\PSGet.Resource.psd1 unhide.exe File opened for modification C:\Program Files\Microsoft Office\root\Integration\C2RManifest.osmmui.msi.16.en-us.xml unhide.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\DataModel\Microsoft.Data.DataFeedClient.dll unhide.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\win8-scrollbar\arrow-up-pressed.gif unhide.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\reviews\js\nls\root unhide.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\cstm_brand_preview.png unhide.exe File opened for modification C:\Program Files (x86)\Windows Photo Viewer\PhotoAcq.dll unhide.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\cs\UIAutomationClientSideProviders.resources.dll unhide.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\ku_IQ unhide.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\js\nls\ja-jp\ui-strings.js unhide.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\HomeStudent2019R_Retail-pl.xrm-ms unhide.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ProjectProXC2RVL_MAKC2R-ul-oob.xrm-ms unhide.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Microsoft.reportviewer.winforms.dll unhide.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\OFFICE16\api-ms-win-crt-conio-l1-1-0.dll unhide.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\cgg\LC_MESSAGES\vlc.mo unhide.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\fi-fi unhide.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\js\nls\it-it unhide.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\msedgeupdateres_bg.dll unhide.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\ja\System.Windows.Controls.Ribbon.resources.dll unhide.exe - Drops file in Windows directory 64 IoCs
description ioc Process File opened for modification C:\Windows\WinSxS\wow64_microsoft-windows-d..w-capture.resources_31bf3856ad364e35_10.0.26100.1_fr-fr_217aa571f15185d1\vfwwdm32.dll.mui unhide.exe File opened for modification C:\Windows\WinSxS\wow64_microsoft-windows-eapteap_31bf3856ad364e35_10.0.26100.1_none_28fbcd60f689f962 unhide.exe File opened for modification C:\Windows\es-ES\bfsvc.exe.mui unhide.exe File opened for modification C:\Windows\INF\.NET Data Provider for Oracle\_DataOracleClientPerfCounters_shared12_neutral.h unhide.exe File opened for modification C:\Windows\servicing\Packages\Microsoft-Windows-PowerShell-ISE-FOD-Package~31bf3856ad364e35~amd64~de-DE~10.0.26100.1.cat unhide.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-m..oledb-rll.resources_31bf3856ad364e35_10.0.26100.1_ja-jp_a33cbd901f89e7b8\oledb32r.dll.mui unhide.exe File opened for modification C:\Windows\WinSxS\amd64_wvmic_heartbeat.inf.resources_31bf3856ad364e35_10.0.26100.1_en-us_895072367e0a308b unhide.exe File opened for modification C:\Windows\WinSxS\Backup\wow64_microsoft-windows-winsock-helper-tcpip_31bf3856ad364e35_10.0.26100.1_none_d2fb5874ce74e1da.manifest unhide.exe File opened for modification C:\Windows\WinSxS\Manifests\amd64_microsoft-windows-ncrypt.resources_31bf3856ad364e35_10.0.26100.1_it-it_53987209892fe9bb.manifest unhide.exe File opened for modification C:\Windows\PLA\Rules\it-IT\Rules.System.Configuration.xml unhide.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-diskraid.resources_31bf3856ad364e35_10.0.26100.1_en-us_bd9abd4346dc93c9\diskraid.exe.mui unhide.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-shwebsvc.resources_31bf3856ad364e35_10.0.26100.1_de-de_85a1031c201713aa unhide.exe File opened for modification C:\Windows\WinSxS\Manifests\amd64_microsoft-windows-m..oyment-languagepack_31bf3856ad364e35_10.0.26100.1_es-es_44b2bff46bc720c0.manifest unhide.exe File opened for modification C:\Windows\WinSxS\Manifests\amd64_runlevel-win3-merge..oyment-languagepack_31bf3856ad364e35_10.0.26100.1_en-us_768e60d97419eae6.manifest unhide.exe File opened for modification C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts unhide.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-diskdiagnostic-adm_31bf3856ad364e35_10.0.26100.1_none_59b8aa76134f1d08 unhide.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-e..-host-adm.resources_31bf3856ad364e35_10.0.26100.1_ja-jp_7daf1246410cf30f\WorkFolders-Client.adml unhide.exe File opened for modification C:\Windows\WinSxS\Manifests\amd64_presentationcore.resources_31bf3856ad364e35_4.0.15912.0_en-us_4176cea6e85ac5de.manifest unhide.exe File opened for modification C:\Windows\servicing\Packages\Microsoft-OneCore-Console-Driver-Package~31bf3856ad364e35~amd64~ja-JP~10.0.26100.1.cat unhide.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-onecore-u..latform-updateagent_31bf3856ad364e35_10.0.26100.1591_none_afbc9eb7b97a360f unhide.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-s..terysaver.resources_31bf3856ad364e35_10.0.26100.1_fr-fr_3c6b975e6f350ca5 unhide.exe File opened for modification C:\Windows\WinSxS\wow64_microsoft-windows-devices-usb-winrt_31bf3856ad364e35_10.0.26100.1591_none_19803a09244ebb10\Windows.Devices.Usb.dll unhide.exe File opened for modification C:\Windows\INF\.NET CLR Data unhide.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-deviceconfidence_31bf3856ad364e35_10.0.26100.1150_none_2156f931ba552b53\ConsentUX.dll unhide.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-netadaptercim_31bf3856ad364e35_10.0.26100.1591_none_14e844c0a0a26efb\NetAdapterCimTrace.mof unhide.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-r..ouppolicy.resources_31bf3856ad364e35_10.0.26100.1_it-it_f23d018b9940f704 unhide.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-t..-workspacebroker-ax_31bf3856ad364e35_10.0.26100.1150_none_dd8a955e1e93df24\r\wkspbrokerAx.dll unhide.exe File opened for modification C:\Windows\WinSxS\Manifests\amd64_microsoft-windows-winbio.resources_31bf3856ad364e35_10.0.26100.1_es-es_9899c92653f488b3.manifest unhide.exe File opened for modification C:\Windows\WinSxS\x86_microsoft-windows-l..terprises.resources_31bf3856ad364e35_10.0.26100.1_uk-ua_cdbbfa5b0b7ff794 unhide.exe File opened for modification C:\Windows\servicing\Packages\Microsoft-Windows-Kernel-Package-DriverVerifier-Xdv-Package~31bf3856ad364e35~amd64~es-ES~10.0.26100.1.cat unhide.exe File opened for modification C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.GPowerShell.Resources\v4.0_3.0.0.0_fr_31bf3856ad364e35 unhide.exe File opened for modification C:\Windows\servicing\Packages\HyperV-Compute-System-AzureVirtualMachine-Package~31bf3856ad364e35~amd64~~10.0.26100.1742.mum unhide.exe File opened for modification C:\Windows\SystemApps\LKG\MicrosoftWindows.LKG.Search_cw5n1h2txyewy\Cortana.UI\cache\WV2Local\desktopdefault\29.js unhide.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-networkicon.resources_31bf3856ad364e35_10.0.26100.1_fr-fr_8a3734bb7134c90e unhide.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-s..ouppolicy.resources_31bf3856ad364e35_10.0.26100.712_en-us_c522970f533c7ee1\SettingSync.adml unhide.exe File opened for modification C:\Windows\WinSxS\Catalogs\e1698ee107fca933b9050d6d513de958dfc4198ef579afd7f469c220fec92d09.cat unhide.exe File opened for modification C:\Windows\WinSxS\Manifests\amd64_microsoft-windows-media-mp3acm.resources_31bf3856ad364e35_10.0.26100.1_fr-fr_caad72daec740625.manifest unhide.exe File opened for modification C:\Windows\servicing\Packages\Microsoft-Windows-TS-Optional-Client-WOW64-Package~31bf3856ad364e35~amd64~~10.0.26100.1591.mum unhide.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-w..ty-client.resources_31bf3856ad364e35_10.0.26100.1_en-us_13750fd03c1ca21d unhide.exe File opened for modification C:\Windows\WinSxS\amd64_userexperience-fileexp_31bf3856ad364e35_10.0.26100.1591_none_ed01032043c8051c\FileExp\FileExplorerExtensions\Assets\images\contrast-black\windows.nextdesktopimage.svg unhide.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-b..iagnostic.resources_31bf3856ad364e35_10.0.26100.1_it-it_4087c8eabdc39e5f_memtest.efi.mui_71e15c22 unhide.exe File opened for modification C:\Windows\WinSxS\amd64_dual_wmiacpi.inf_31bf3856ad364e35_10.0.26100.1150_none_7ce4df141075ee19\wmiacpi.sys unhide.exe File opened for modification C:\Windows\WinSxS\amd64_hyperv-devicevirtualizationlib_31bf3856ad364e35_10.0.26100.1150_none_2523d7666cb89919\vmdevicehost.dll unhide.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-n..quickstart.appxmain_31bf3856ad364e35_10.0.26100.1591_none_300773bc06dfa2f0\NarratorAppList.targetsize-16_altform-lightunplated.png unhide.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-s..structure.resources_31bf3856ad364e35_10.0.26100.1_fr-fr_3e75f80b92029ccd unhide.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft.powershell.psget.resources_31bf3856ad364e35_10.0.26100.1_de-de_de170ef6686b2fd4 unhide.exe File opened for modification C:\Windows\WinSxS\amd64_userexperience-oobe_31bf3856ad364e35_10.0.26100.1591_none_54983d2d7a4908c4\OOBE\webapps\guidedsetup\network\area-content\as-IN\area-content.local.json unhide.exe File opened for modification C:\Windows\WinSxS\Manifests\amd64_microsoft-windows-ping-utilities_31bf3856ad364e35_10.0.26100.1150_none_4518f57e3fc4b0d8.manifest unhide.exe File opened for modification C:\Windows\WinSxS\Manifests\wow64_microsoft-windows-i..ntscriptingtools-gc_31bf3856ad364e35_10.0.26100.1_none_4571ed970a46d1ec.manifest unhide.exe File opened for modification C:\Windows\assembly\GAC_MSIL\System.ServiceModel.Web.Resources\3.5.0.0_es_31bf3856ad364e35\System.ServiceModel.Web.resources.dll unhide.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-management-oobe_31bf3856ad364e35_10.0.26100.1_none_6f199304b59d97ee\devicesetupcategoryviewmodel.js unhide.exe File opened for modification C:\Windows\WinSxS\Manifests\wow64_microsoft-windows-security-spp-wga_31bf3856ad364e35_10.0.26100.1_none_0699dcb54042cf94.manifest unhide.exe File opened for modification C:\Windows\WinSxS\Manifests\wow64_microsoft-windows-t..omruntime.resources_31bf3856ad364e35_10.0.26100.1_de-de_332bedd3a27e59f1.manifest unhide.exe File opened for modification C:\Windows\WinSxS\Manifests\wow64_microsoft-windows-t..ut-ninput.resources_31bf3856ad364e35_10.0.26100.1_en-us_276d672fff53b07e.manifest unhide.exe File opened for modification C:\Windows\WinSxS\Manifests\x86_microsoft-windows-v..re-codecs.resources_31bf3856ad364e35_10.0.26100.1_en-us_f839491a88b3ddea.manifest unhide.exe File opened for modification C:\Windows\WinSxS\x86_microsoft-windows-d..-dsdbutil.resources_31bf3856ad364e35_10.0.26100.1_de-de_37e81016c60aa2eb\dsdbutil.exe.mui unhide.exe File opened for modification C:\Windows\INF\ServiceModelService 3.0.0.0\0410\_ServiceModelServicePerfCounters_D.ini unhide.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-rasbase.resources_31bf3856ad364e35_10.0.26100.1_de-de_b21a63ad2f4feb6a unhide.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-ui-shell-component_31bf3856ad364e35_10.0.26100.1150_none_e988d1d7ba71eb54\RequestedDownloadsLargeCloudIcon.contrast-white_scale-200.png unhide.exe File opened for modification C:\Windows\WinSxS\Manifests\amd64_microsoft.transactions.bridge.dtc_b03f5f7f11d50a3a_4.0.15912.0_none_4c0da8997b3a40ab.manifest unhide.exe File opened for modification C:\Windows\servicing\Packages\HyperV-IsolatedVm-merged-Package~31bf3856ad364e35~amd64~~10.0.26100.1742.mum unhide.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-inputprocessors_31bf3856ad364e35_10.0.26100.1591_none_3605722c2da8a369\r\jpninputrouter.dll unhide.exe File opened for modification C:\Windows\WinSxS\amd64_rt640x64.inf.resources_31bf3856ad364e35_10.0.26100.1_en-us_dee405a1904bfcb6\rt640x64.inf_loc unhide.exe File opened for modification C:\Windows\WinSxS\amd64_usbcir.inf.resources_31bf3856ad364e35_10.0.26100.1_en-us_a128a2929e9b5376\usbcir.inf_loc unhide.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language unhide.exe - Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 3516 unhide.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\unhide.exe"C:\Users\Admin\AppData\Local\Temp\unhide.exe"1⤵
- Drops file in Drivers directory
- Manipulates Digital Signatures
- Drops desktop.ini file(s)
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:3516