Analysis
- max time kernel
148s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
10/09/2026, 12:33
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
unhide.exe
Resource
win10v2004-20260513-en
10 signatures
150 seconds
General
- Target unhide.exe
- Size 389KB
- Sample260910-prjydatbqb
- SHA256 4f68c751ca08888c6cf5eba888e9385d52f42e0c1a60ec7888c34841a7540b53
- MD5 2529406e348278e6cb3ff7fcb104c54f
- SHA1 b3a189605458d333a8defd92cb4975e0e9b03e46
- SHA512 e35482df0f545f7dca6380d9d18875d052180d3dcc74c387bf98f2528d84074f9f60f56235c9ac30f012410f338503d05766619ab2b15e0df04ba85362fb312c
- SSDEEP 6144:NUuTTTKHFpSDUISjVcSPf/Ke4Kk/jrjzc6r6IFLpjZ4R7fRXN:2u0FpBISxcSPfv4hTc6rDL74R7j
- TLSH T1A9843A60E1D885B3D5EA02304CB17B30156EFE982675C18F574C3BAA3ABEBC35136B19
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Drops file in Drivers directory 31 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\Drivers\ja-JP\wfplwfs.sys.mui unhide.exe File opened for modification C:\Windows\SysWOW64\Drivers\es-ES unhide.exe File opened for modification C:\Windows\SysWOW64\Drivers\gmreadme.txt unhide.exe File opened for modification C:\Windows\SysWOW64\Drivers\it-IT unhide.exe File opened for modification C:\Windows\SysWOW64\Drivers\it-IT\ndiscap.sys.mui unhide.exe File opened for modification C:\Windows\SysWOW64\Drivers\ja-JP unhide.exe File opened for modification C:\Windows\SysWOW64\Drivers\ja-JP\ndiscap.sys.mui unhide.exe File opened for modification C:\Windows\SysWOW64\Drivers\fr-FR\wfplwfs.sys.mui unhide.exe File opened for modification C:\Windows\SysWOW64\Drivers\uk-UA unhide.exe File opened for modification C:\Windows\SysWOW64\Drivers\afunix.sys unhide.exe File opened for modification C:\Windows\SysWOW64\Drivers\de-DE unhide.exe File opened for modification C:\Windows\SysWOW64\Drivers\de-DE\ndiscap.sys.mui unhide.exe File opened for modification C:\Windows\SysWOW64\Drivers\UMDF unhide.exe File opened for modification C:\Windows\SysWOW64\Drivers\UMDF\en-US unhide.exe File opened for modification C:\Windows\SysWOW64\Drivers\es-ES\wfplwfs.sys.mui unhide.exe File opened for modification C:\Windows\SysWOW64\Drivers\it-IT\NdisImPlatform.sys.mui unhide.exe File opened for modification C:\Windows\SysWOW64\Drivers\ja-JP\NdisImPlatform.sys.mui unhide.exe File opened for modification C:\Windows\SysWOW64\Drivers\fr-FR unhide.exe File opened for modification C:\Windows\SysWOW64\Drivers\en-US\ndiscap.sys.mui unhide.exe File opened for modification C:\Windows\SysWOW64\Drivers\es-ES\ndiscap.sys.mui unhide.exe File opened for modification C:\Windows\SysWOW64\Drivers\de-DE\NdisImPlatform.sys.mui unhide.exe File opened for modification C:\Windows\SysWOW64\Drivers\en-US\NdisImPlatform.sys.mui unhide.exe File opened for modification C:\Windows\SysWOW64\Drivers\en-US\wfplwfs.sys.mui unhide.exe File opened for modification C:\Windows\SysWOW64\Drivers\es-ES\NdisImPlatform.sys.mui unhide.exe File opened for modification C:\Windows\SysWOW64\Drivers\fr-FR\ndiscap.sys.mui unhide.exe File opened for modification C:\Windows\SysWOW64\Drivers\it-IT\wfplwfs.sys.mui unhide.exe File opened for modification C:\Windows\SysWOW64\Drivers\uk-UA\NdisImPlatform.sys.mui unhide.exe File opened for modification C:\Windows\SysWOW64\Drivers\de-DE\wfplwfs.sys.mui unhide.exe File opened for modification C:\Windows\SysWOW64\Drivers\en-US unhide.exe File opened for modification C:\Windows\SysWOW64\Drivers\gm.dls unhide.exe File opened for modification C:\Windows\SysWOW64\Drivers\fr-FR\NdisImPlatform.sys.mui unhide.exe - Manipulates Digital Signatures 1 IoCs
Attackers can apply techniques such as modifying certain DLL exports to make their binary seem valid.
description ioc Process File opened for modification C:\Windows\SysWOW64\wintrust.dll unhide.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Drops desktop.ini file(s) 36 IoCs
description ioc Process File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-s..-kf-programfilesx86_31bf3856ad364e35_10.0.26100.1_none_7f736e321868c082\desktop.ini unhide.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-s..ini-systemtoolsuser_31bf3856ad364e35_10.0.26100.1_none_1d9f561f4c141236\Desktop.ini unhide.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-shell-sounds_31bf3856ad364e35_10.0.26100.1_none_140624931e1631ac\Desktop.ini unhide.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-shell-wallpaper-themea_31bf3856ad364e35_10.0.26100.1_none_d3c965ed0d7f5b0d\Desktop.ini unhide.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-shell32-kf-public_31bf3856ad364e35_10.0.26100.1_none_53f4413b5b0ec6c8\desktop.ini unhide.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-fontext_31bf3856ad364e35_10.0.26100.1591_none_3a4593a9a3a42262\desktop.ini unhide.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-s..32-kf-commondesktop_31bf3856ad364e35_10.0.26100.1_none_ef1cce0418e0ca2e\desktop.ini unhide.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-s..32-kf-commonstartup_31bf3856ad364e35_10.0.26100.1_none_f903e633b39522d3\desktop.ini unhide.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-s..l32-kf-userprofiles_31bf3856ad364e35_10.0.26100.1_none_80d96be390261ff6\desktop.ini unhide.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-shell-wallpaper-themed_31bf3856ad364e35_10.0.26100.1_none_d3c921950d7fa7f0\Desktop.ini unhide.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-s..-kf-publiclibraries_31bf3856ad364e35_10.0.26100.1_none_12dc48264ff839df\desktop.ini unhide.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-s..2-kf-commonpictures_31bf3856ad364e35_10.0.26100.1_none_7d46065ee5cd8613\desktop.ini unhide.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-s..ini-maintenanceuser_31bf3856ad364e35_10.0.26100.1_none_02fb486cbe6baf65\Desktop.ini unhide.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-s..l32-kf-commonvideos_31bf3856ad364e35_10.0.26100.1_none_d939b1ba77084dd2\desktop.ini unhide.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-s..opini-accessibility_31bf3856ad364e35_10.0.26100.1_none_d75f0561e5d53d5b\Desktop.ini unhide.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-s..sktopini-sendtouser_31bf3856ad364e35_10.0.26100.1_none_053839e1fca5597b\Desktop.ini unhide.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-s..-kf-commondocuments_31bf3856ad364e35_10.0.26100.1_none_4bc4edc230be4464\desktop.ini unhide.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-s..kf-commonadmintools_31bf3856ad364e35_10.0.26100.1_none_520ba6927730f124\desktop.ini unhide.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-shell32-kf-commonmusic_31bf3856ad364e35_10.0.26100.1_none_760a3fa79d0dd71f\desktop.ini unhide.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-s..2-kf-commonprograms_31bf3856ad364e35_10.0.26100.1_none_4b82445892b64521\desktop.ini unhide.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-s..er-content-extended_31bf3856ad364e35_10.0.26100.1_none_e78a517c04a5f782\Desktop.ini unhide.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-shell-wallpaper-themeb_31bf3856ad364e35_10.0.26100.1_none_d3c94f250d7f74ae\Desktop.ini unhide.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-ie-objectcontrolviewer_31bf3856ad364e35_11.0.26100.1150_none_16c5cc95ed81961d\desktop.ini unhide.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-ie-offlinefavorites_31bf3856ad364e35_11.0.26100.1150_none_40cb47622b181101\desktop.ini unhide.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-s..-kf-commondownloads_31bf3856ad364e35_10.0.26100.1_none_f0177ec0bacc01ab\desktop.ini unhide.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-s..ktopini-maintenance_31bf3856ad364e35_10.0.26100.1_none_5b8ddc5d05b3ae46\Desktop.ini unhide.exe File opened for modification C:\Windows\Fonts\desktop.ini unhide.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-s..ktopini-accessories_31bf3856ad364e35_10.0.26100.1_none_e90ac44521f6781d\Desktop.ini unhide.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-s..ktopini-systemtools_31bf3856ad364e35_10.0.26100.1_none_7b60e8f9f0308735\Desktop.ini unhide.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\History\desktop.ini unhide.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-s..-kf-commonstartmenu_31bf3856ad364e35_10.0.26100.1_none_3df18355654b83e7\desktop.ini unhide.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-s..i-accessibilityuser_31bf3856ad364e35_10.0.26100.1_none_6038226271499ae0\Desktop.ini unhide.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-s..ini-accessoriesuser_31bf3856ad364e35_10.0.26100.1_none_20f7d6167cb25b4e\Desktop.ini unhide.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-s..l32-kf-programfiles_31bf3856ad364e35_10.0.26100.1_none_128f27879ad1c14e\desktop.ini unhide.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-shell-wallpaper-themec_31bf3856ad364e35_10.0.26100.1_none_d3c9385d0d7f8e4f\Desktop.ini unhide.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\DataServices\DESKTOP.INI unhide.exe - Drops file in System32 directory 64 IoCs
description ioc Process File opened for modification C:\Windows\System32\catroot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Onecore-Identity-TenantRestrictions-WOW64-Package~31bf3856ad364e35~amd64~uk-UA~10.0.26100.1.cat unhide.exe File opened for modification C:\Windows\System32\catroot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-CoreSystem-DriverSupport-merged-Package~31bf3856ad364e35~amd64~it-IT~10.0.26100.1.cat unhide.exe File opened for modification C:\Windows\System32\DriverStore\en-US\percsas3i.inf_loc unhide.exe File opened for modification C:\Windows\System32\DriverStore\fr-FR\xinputhid.inf_loc unhide.exe File opened for modification C:\Windows\SysWOW64\kbd101b.DLL unhide.exe File opened for modification C:\Windows\SysWOW64\rtmpltfm.dll unhide.exe File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\NetAdapter\MSFT_NetAdapterQos.cdxml unhide.exe File opened for modification C:\Windows\System32\catroot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-DirectPlay-OC-Opt-Package~31bf3856ad364e35~amd64~~10.0.26100.1150.cat unhide.exe File opened for modification C:\Windows\SysWOW64\de-DE\Windows.ApplicationModel.Store.dll.mui unhide.exe File opened for modification C:\Windows\System32\DriverStore\es-ES\HvService.inf_loc unhide.exe File opened for modification C:\Windows\System32\DriverStore\ja-JP\basicdisplay.inf_loc unhide.exe File opened for modification C:\Windows\SysWOW64\OneCoreUAPCommonProxyStub.dll unhide.exe File opened for modification C:\Windows\System32\catroot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-OneCore-Wer-WOW64-Package~31bf3856ad364e35~amd64~en-US~10.0.26100.1.cat unhide.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\ntprint.inf_x86_5083be912240d5a2\I386\PS_SCHM.GDL unhide.exe File opened for modification C:\Windows\System32\DriverStore\it-IT\keyboard.inf_loc unhide.exe File opened for modification C:\Windows\SysWOW64\KeyboardFilterCore.dll unhide.exe File opened for modification C:\Windows\SysWOW64\oobe\it-IT\SetupCleanupTask.dll.mui unhide.exe File opened for modification C:\Windows\SysWOW64\wbem\it-IT\netswitchteamcim.dll.mui unhide.exe File opened for modification C:\Windows\System32\catroot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Windows-ClientCore-DWM-merged-Package~31bf3856ad364e35~amd64~fr-FR~10.0.26100.1.cat unhide.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\c_infrared.inf_amd64_2e7bb8b4a527afc3\c_infrared.inf unhide.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\displayoverride.inf_amd64_ad2569d6b92e9e9a unhide.exe File opened for modification C:\Windows\System32\DriverStore\it-IT\hidbatt.inf_loc unhide.exe File opened for modification C:\Windows\SysWOW64\eappprxy.dll unhide.exe File opened for modification C:\Windows\SysWOW64\it-IT\PresentationHost.exe.mui unhide.exe File opened for modification C:\Windows\SysWOW64\wbem\fr-FR\msfeedsbs.mfl unhide.exe File opened for modification C:\Windows\SysWOW64\wbem\Winsat.mof unhide.exe File opened for modification C:\Windows\SysWOW64\Windows.Devices.Custom.dll unhide.exe File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Schemas\PSMaml\troubleshooting.xsd unhide.exe File opened for modification C:\Windows\SysWOW64\mfc140chs.dll unhide.exe File opened for modification C:\Windows\SysWOW64\wbem\it-IT\storagewmi_uninstall.mfl unhide.exe File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\Provisioning unhide.exe File opened for modification C:\Windows\System32\catroot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-EditionPack-Professional-Package~31bf3856ad364e35~amd64~fr-FR~10.0.26100.1.cat unhide.exe File opened for modification C:\Windows\System32\catroot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Foundation-Group-WOW64-Package~31bf3856ad364e35~amd64~it-IT~10.0.26100.1.cat unhide.exe File opened for modification C:\Windows\System32\catroot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-PAW-Package~31bf3856ad364e35~amd64~it-IT~10.0.26100.1.cat unhide.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\c_firmware.inf_amd64_9c46e65b506725c3 unhide.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\msdri.inf_amd64_fdc036dc83da2115 unhide.exe File opened for modification C:\Windows\SysWOW64\it-IT\mapistub.dll.mui unhide.exe File opened for modification C:\Windows\System32\catroot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-OneCore-HWN-Wdf-Class-Extensions-Package~31bf3856ad364e35~amd64~en-US~10.0.26100.1.cat unhide.exe File opened for modification C:\Windows\System32\catroot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Dedup-ChunkLibrary-Package~31bf3856ad364e35~amd64~it-IT~10.0.26100.1.cat unhide.exe File opened for modification C:\Windows\System32\catroot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-DirectPlay-OC-Opt-WOW64-Package~31bf3856ad364e35~amd64~es-ES~10.0.26100.1.cat unhide.exe File opened for modification C:\Windows\System32\catroot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Legacy-Components-OC-Package~31bf3856ad364e35~amd64~ja-JP~10.0.26100.1.cat unhide.exe File opened for modification C:\Windows\System32\DriverStore\fr-FR\pci.inf_loc unhide.exe File opened for modification C:\Windows\SysWOW64\it-IT\taskschd.msc unhide.exe File opened for modification C:\Windows\SysWOW64\KBDTH2.DLL unhide.exe File opened for modification C:\Windows\SysWOW64\wbem\iscsiwmiv2_uninstall.mof unhide.exe File opened for modification C:\Windows\System32\catroot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\HyperV-VmBus-VirtualDevice-Package~31bf3856ad364e35~amd64~de-DE~10.0.26100.1.cat unhide.exe File opened for modification C:\Windows\System32\catroot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-CoreSystem-WINNLS-Core-Package~31bf3856ad364e35~amd64~en-US~10.0.26100.1.cat unhide.exe File opened for modification C:\Windows\System32\catroot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-NFS-ClientCore-D-Opt-Package~31bf3856ad364e35~amd64~en-US~10.0.26100.1.cat unhide.exe File opened for modification C:\Windows\System32\catroot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-WinOcr-FOD-Package-Wrapper~31bf3856ad364e35~wow64~~10.0.26100.1742.cat unhide.exe File opened for modification C:\Windows\System32\catroot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Windows-ClientCore-Win32Bridge-WOW64-Package~31bf3856ad364e35~amd64~it-IT~10.0.26100.1.cat unhide.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\hdaudio.inf_amd64_22f2127ec785fb8d\HdAudio.sys unhide.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\prnms005.inf_amd64_3de64f94f420c01f\prnms005.PNF unhide.exe File opened for modification C:\Windows\System32\DriverStore\ja-JP\c_ucm.inf_loc unhide.exe File opened for modification C:\Windows\System32\catroot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-DirectoryServices-ADAM-Client-OptGroup-Package~31bf3856ad364e35~amd64~uk-UA~10.0.26100.1.cat unhide.exe File opened for modification C:\Windows\System32\catroot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Runlevel-Win0-WOW64-Package~31bf3856ad364e35~amd64~es-ES~10.0.26100.1.cat unhide.exe File opened for modification C:\Windows\SysWOW64\dbghelp.dll unhide.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\prnms011.inf_amd64_a6a75ae7ea7e42da\Amd64\MSAppMon-pipelineconfig.xml unhide.exe File opened for modification C:\Windows\System32\DriverStore\it-IT\wvmbus.inf_loc unhide.exe File opened for modification C:\Windows\SysWOW64\mk-MK\windows.ui.xaml.dll.mui unhide.exe File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\NetAdapter\MSFT_NetAdapterVmq.cmdletDefinition.cdxml unhide.exe File opened for modification C:\Windows\System32\catroot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\HyperV-Vpci-VSP-merged-Package~31bf3856ad364e35~amd64~es-ES~10.0.26100.1.cat unhide.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\mdmiodat.inf_amd64_fb447a854b12a8c6\mdmiodat.inf unhide.exe File opened for modification C:\Windows\System32\DriverStore\ja-JP\wdma_usb.inf_loc unhide.exe File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\DSCResources\ja-JP\RunAsHelper.strings.psd1 unhide.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Xml.XmlDocument.dll unhide.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\Locales\pt-PT.pak unhide.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\s_link_18.svg unhide.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\reviews\js\nls\da-dk\ui-strings.js unhide.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls unhide.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\EBWebView\x64\EmbeddedBrowserWebView.dll unhide.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\Trust Protection Lists\Mu\Cryptomining unhide.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Security.Cryptography.OpenSsl.dll unhide.exe File opened for modification C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\de\System.RunTime.Serialization.Resources.dll unhide.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\BHO\ie_to_edge_bho.dll unhide.exe File opened for modification C:\Program Files (x86)\Windows Defender\MpCmdRun.exe unhide.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Reflection.Primitives.dll unhide.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\PenImc_cor3.dll unhide.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\Trust Protection Lists\Sigma\Analytics unhide.exe File opened for modification C:\Program Files\Windows Defender Advanced Threat Protection\WATPCSP.dll unhide.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\System.Globalization.Calendars.dll unhide.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\QuickStyles unhide.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\api-ms-win-core-xstate-l2-1-0.dll unhide.exe File opened for modification C:\Program Files\Mozilla Firefox\updater.exe unhide.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\misc\libgnutls_plugin.dll unhide.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\js\nls\en-ae unhide.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\az-Latn-AZ unhide.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ja\PresentationUI.resources.dll unhide.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\management.dll unhide.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft Analysis Services\AS OLEDB\140 unhide.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\ku_IQ\LC_MESSAGES\vlc.mo unhide.exe File opened for modification C:\Program Files\Windows Photo Viewer\it-IT\PhotoViewer.dll.mui unhide.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\sl-si\ui-strings.js unhide.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\139.0.3405.125.manifest unhide.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\System.Data.dll unhide.exe File opened for modification C:\Program Files\Internet Explorer\fr-FR\ieinstal.exe.mui unhide.exe File opened for modification C:\Program Files\Java\jre-1.8\lib\rt.jar unhide.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\O365BusinessR_Subscription-ul-oob.xrm-ms unhide.exe File opened for modification C:\Program Files\Windows Defender\ProtectionManagement.dll unhide.exe File opened for modification C:\Program Files (x86)\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\ja-JP\PackageManagementDscUtilities.strings.psd1 unhide.exe File opened for modification C:\Program Files\Internet Explorer\uk-UA unhide.exe File opened for modification C:\Program Files\Java\jre-1.8\lib\security\policy\unlimited\local_policy.jar unhide.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\hu-hu\ui-strings.js unhide.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\SONORA\PREVIEW.GIF unhide.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Tracker\form_responses.gif unhide.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\core_icons_retina.png unhide.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\s_selectlist_checkmark_18.svg unhide.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\walk-through\css\main-selector.css unhide.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\es\System.Windows.Forms.resources.dll unhide.exe File opened for modification C:\Program Files\Microsoft Office\root\Templates unhide.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\apple-touch-icon-57x57-precomposed.png unhide.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\en-il unhide.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\images\themes\dark\s_empty_folder_state.svg unhide.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\Locales\qu.pak unhide.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\LAYERS\THMBNAIL.PNG unhide.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\VBA\VBA7.1\1033\VBUI6.CHM unhide.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft Analysis Services\AS OLEDB\140\Resources unhide.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\js\nls\ca-es unhide.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ko\System.Windows.Input.Manipulations.resources.dll unhide.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.SecHealthUI_1000.26100.1.0_x64__8wekyb3d8bbwe\Assets\WDSC_Illustration_Do_Not_Reuse_834x834.png unhide.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\ro-ro\ui-strings.js unhide.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\sr-Latn-RS unhide.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\OneNoteR_Trial-ul-oob.xrm-ms unhide.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Web Server Extensions\16\BIN unhide.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\api-ms-win-crt-math-l1-1-0.dll unhide.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\zh-cn\ui-strings.js unhide.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\js\nls\pl-pl unhide.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-recent-files\js\nls\he-il unhide.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.pl-pl.dll unhide.exe - Drops file in Windows directory 64 IoCs
description ioc Process File opened for modification C:\Windows\SystemApps\Microsoft.AAD.BrokerPlugin_cw5n1h2txyewy\Assets\PasswordExpiry.contrast-white_scale-200.png unhide.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-wincredui.resources_31bf3856ad364e35_10.0.26100.1_es-es_a8b047d6698788c9 unhide.exe File opened for modification C:\Windows\WinSxS\amd64_windows-gaming-input-winrt.resources_31bf3856ad364e35_10.0.26100.1_en-us_0296e0cde5a82b76 unhide.exe File opened for modification C:\Windows\WinSxS\Manifests\amd64_microsoft-onecore-c..cy-bluetoothadapter_31bf3856ad364e35_10.0.26100.1_none_b5494b18bdf171ae.manifest unhide.exe File opened for modification C:\Windows\WinSxS\Manifests\amd64_microsoft-windows-mssecwfp.resources_31bf3856ad364e35_10.0.26100.1_it-it_712a3099d8cf78cd.manifest unhide.exe File opened for modification C:\Windows\servicing\Packages\Microsoft-Windows-Embedded-KeyboardFilter-Core-Package~31bf3856ad364e35~amd64~en-US~10.0.26100.1.cat unhide.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-s..ers-about.resources_31bf3856ad364e35_10.0.26100.1_de-de_1700ff0f5452bba0\AboutSettingsHandlers.dll.mui unhide.exe File opened for modification C:\Windows\WinSxS\Manifests\amd64_microsoft-windows-s..ilenotify.resources_31bf3856ad364e35_7.0.26100.1_it-it_0fe4aed4ff8bcdca.manifest unhide.exe File opened for modification C:\Windows\WinSxS\wow64_microsoft-windows-mapi.resources_31bf3856ad364e35_10.0.26100.1_en-us_31c372e4872586be unhide.exe File opened for modification C:\Windows\WinSxS\wow64_microsoft-windows-wsp-health.resources_31bf3856ad364e35_10.0.26100.1_de-de_f396fe422844e60d\wsp_health_uninstall.mfl unhide.exe File opened for modification C:\Windows\diagnostics\system\Video\uk-UA\CL_LocalizationData.psd1 unhide.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-ui-search.resources_31bf3856ad364e35_10.0.26100.1_es-es_70683e17d6d624d2\Windows.UI.Search.es-ES.pri unhide.exe File opened for modification C:\Windows\WinSxS\Manifests\amd64_microsoft-windows-twinui_31bf3856ad364e35_10.0.26100.1742_none_0f4cbac5697cd3b6.manifest unhide.exe File opened for modification C:\Windows\WinSxS\msil_aspnet_regsql.resources_b03f5f7f11d50a3a_10.0.26100.1_fr-fr_669c83b0b303decc unhide.exe File opened for modification C:\Windows\WinSxS\wow64_microsoft-windows-errorreportingcore_31bf3856ad364e35_10.0.26100.1591_none_c68b578eea4bd528\wermgr.exe unhide.exe File opened for modification C:\Windows\servicing\Packages\HyperV-Compute-Host-VirtualMachines-merged-Package~31bf3856ad364e35~amd64~de-DE~10.0.26100.1.mum unhide.exe File opened for modification C:\Windows\WinSxS\amd64_dual_netathr10x.inf_31bf3856ad364e35_10.0.26100.1_none_4b60dfaa057a7db6\netathr10x.INF unhide.exe File opened for modification C:\Windows\WinSxS\amd64_hid-dll.resources_31bf3856ad364e35_10.0.26100.1_fr-fr_b752e1b190d81144\hid.dll.mui unhide.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-comctl32-v5.resources_31bf3856ad364e35_10.0.26100.1591_sr-..-rs_494190a19c8f8ac4\r\comctl32.dll.mui unhide.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-security-kerberos_31bf3856ad364e35_10.0.26100.1742_none_827c204060e93a0c\r\kerb3961.dll unhide.exe File opened for modification C:\Windows\WinSxS\FileMaps\$$_inf_.net_data_provider_for_sqlserver_0411_22ef188b81b08c67.cdf-ms unhide.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-comdlg32.resources_31bf3856ad364e35_10.0.26100.1_ur-pk_16170ff303f42258 unhide.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-s..component.resources_31bf3856ad364e35_10.0.26100.1_de-de_d57e299833557234 unhide.exe File opened for modification C:\Windows\WinSxS\Manifests\amd64_c_swcomponent.inf-languagepack_31bf3856ad364e35_10.0.26100.1_it-it_f6fb4df7bd52d9df.manifest unhide.exe File opened for modification C:\Windows\WinSxS\Manifests\amd64_microsoft-windows-n..ork-setup.resources_31bf3856ad364e35_10.0.26100.1_de-de_30e7ad96cd477cc9.manifest unhide.exe File opened for modification C:\Windows\WinSxS\wow64_microsoft-windows-i..p-support.resources_31bf3856ad364e35_11.0.26100.1_uk-ua_045427f5879c850b unhide.exe File opened for modification C:\Windows\WinSxS\wow64_microsoft-windows-s..erexperience-common_31bf3856ad364e35_10.0.26100.1_none_96206619f3829be4\sapi.cpl unhide.exe File opened for modification C:\Windows\WinSxS\x86_microsoft-windows-n..xcorecomp.resources_31bf3856ad364e35_10.0.26100.1_it-it_31028c560caa8650\error.aspx.it.resx unhide.exe File opened for modification C:\Windows\WinSxS\amd64_bth.inf.resources_31bf3856ad364e35_10.0.26100.1_fr-fr_f8022cd3d53c7bb9\bthport.sys.mui unhide.exe File opened for modification C:\Windows\WinSxS\amd64_dual_netcxrd.inf_31bf3856ad364e35_10.0.26100.1591_none_0348023004c8fa8c\netcxrd.sys unhide.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-i..l-keyboard-0000045c_31bf3856ad364e35_10.0.26100.1_none_fa61c1bfbe83b692 unhide.exe File opened for modification C:\Windows\WinSxS\Manifests\amd64_datasvcutil.resources_b77a5c561934e089_4.0.15912.0_es-es_2d4069f847866a2c.manifest unhide.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-p..g-fdprint.resources_31bf3856ad364e35_10.0.26100.1_it-it_f8ebd674bccb610a\resource.xml unhide.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-s..actor-adm.resources_31bf3856ad364e35_10.0.26100.1_fr-fr_fa54d9badb3e65c0 unhide.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-videodiagnostic_31bf3856ad364e35_10.0.26100.1150_none_18c9788aeec7cfc7\RC_viddrv_driverblocklist.ps1 unhide.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-w..cationcompatibility_31bf3856ad364e35_10.0.26100.1_none_6b1dd60d470ec55c\WPDSp.dll unhide.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-winsrv-adm.resources_31bf3856ad364e35_10.0.26100.1_fr-fr_03a0063faf062dd3\Winsrv.adml unhide.exe File opened for modification C:\Windows\WinSxS\Manifests\amd64_microsoft-windows-h..rvice-client-events_31bf3856ad364e35_10.0.26100.1_none_87e1a7e9e558a94d.manifest unhide.exe File opened for modification C:\Windows\WinSxS\Manifests\amd64_microsoft-windows-n..oyment-languagepack_31bf3856ad364e35_10.0.26100.1_ja-jp_b19616376a530ac4.manifest unhide.exe File opened for modification C:\Windows\WinSxS\wow64_microsoft-windows-n..kexplorer.resources_31bf3856ad364e35_10.0.26100.1_it-it_1bc61e8b8ed3e9a5 unhide.exe File opened for modification C:\Windows\Microsoft.NET\Framework\v2.0.50727\ASP.NETWebAdminFiles\AppConfig\App_LocalResources\DebugAndTrace.aspx.de.resx unhide.exe File opened for modification C:\Windows\WinSxS\amd64_userexperience-lkg_31bf3856ad364e35_10.0.26100.1742_none_3c72368675eae921\LKG.Search\Cortana.UI\cache\WV2Local\desktopdefault\13.js unhide.exe File opened for modification C:\Windows\WinSxS\Manifests\amd64_dual_c_securitydevices.inf_31bf3856ad364e35_10.0.26100.1_none_02d27b9cd7827250.manifest unhide.exe File opened for modification C:\Windows\WinSxS\Manifests\amd64_windows-system-user..diagnosticssettings_31bf3856ad364e35_10.0.26100.1_none_bc85b8a50e116d72.manifest unhide.exe File opened for modification C:\Windows\WinSxS\Manifests\wow64_microsoft-windows-dot3svc-mof_31bf3856ad364e35_10.0.26100.1_none_9da2f346e98492bd.manifest unhide.exe File opened for modification C:\Windows\WinSxS\wow64_microsoft-windows-n..omain-clients-netsh_31bf3856ad364e35_10.0.26100.1_none_01aa9ae7e15ec584\nshipsec.dll unhide.exe File opened for modification C:\Windows\WinSxS\amd64_userexperience-core_31bf3856ad364e35_10.0.26100.1591_none_53ec4fcd7ac99448\Core\StartMenu\Assets\FileIcons\32\mpp.scale-400.png unhide.exe File opened for modification C:\Windows\WinSxS\Catalogs\871f599502d1fd513e066a2ddd20b5d7bbc26f4df3425bf493a63e6495771998.cat unhide.exe File opened for modification C:\Windows\WinSxS\Manifests\amd64_microsoft-windows-i..oyment-languagepack_31bf3856ad364e35_10.0.26100.1_it-it_f265e4a2794382ca.manifest unhide.exe File opened for modification C:\Windows\WinSxS\Manifests\x86_microsoft-windows-comctl32-v5.resources_31bf3856ad364e35_10.0.26100.1591_eu-es_a220e07a8dc394bb.manifest unhide.exe File opened for modification C:\Windows\WinSxS\wow64_microsoft-windows-b..iagnostic.resources_31bf3856ad364e35_10.0.26100.1_hu-hu_a824fd3dff5249f8 unhide.exe File opened for modification C:\Windows\WinSxS\x86_microsoft-windows-ieinstal_31bf3856ad364e35_11.0.26100.1_none_bd6260d3acab64a7 unhide.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\es\aspnet_compiler.resources.dll unhide.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-iesecuritydiagnostic_31bf3856ad364e35_10.0.26100.1_none_9158b6c37052c268\TS_IEsecuritylevels.ps1 unhide.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-s..turalauthentication_31bf3856ad364e35_10.0.26100.1591_none_8f7af7004f680970_naturalauth.dll_90858e23 unhide.exe File opened for modification C:\Windows\WinSxS\Backup\x86_microsoft.windows.c..-controls.resources_6595b64144ccf1df_5.82.26100.1591_fil-ph_28ca13bcf5ac9023.manifest unhide.exe File opened for modification C:\Windows\WinSxS\Catalogs\6235e6e421e23a7f31afb3bb8dbdd39ebf568f04db1f1a522c80f973c927b910.cat unhide.exe File opened for modification C:\Windows\WinSxS\x86_microsoft-windows-comctl32-v5.resources_31bf3856ad364e35_10.0.26100.1591_sr-..-rs_ed22f51de432198e\comctl32.dll.mui unhide.exe File opened for modification C:\Windows\SystemApps\Microsoft.Windows.CloudExperienceHost_cw5n1h2txyewy\UnifiedEnrollment.DataModel.winmd unhide.exe File opened for modification C:\Windows\SystemApps\Microsoft.Windows.CloudExperienceHost_cw5n1h2txyewy\webapps\inclusiveOobe\js\oobelocalaccount-page.js unhide.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-s..okerplugin.appxmain_31bf3856ad364e35_10.0.26100.1591_none_f781c7c3859127ad\PasswordExpiry.contrast-white_scale-150.png unhide.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-s..ouppolicy.resources_31bf3856ad364e35_10.0.26100.1_it-it_ac9ef11c9d0cfa67\StartMenu.adml unhide.exe File opened for modification C:\Windows\WinSxS\Catalogs\e7ee75ddcc79180d31380d49b13afec2677cd7268f13a3018f7dd3fde3034573.cat unhide.exe File opened for modification C:\Windows\WinSxS\Manifests\amd64_wsdprint.inf.resources_31bf3856ad364e35_10.0.26100.1_it-it_b5fea222d1045510.manifest unhide.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language unhide.exe - Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 800 unhide.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\unhide.exe"C:\Users\Admin\AppData\Local\Temp\unhide.exe"1⤵
- Drops file in Drivers directory
- Manipulates Digital Signatures
- Drops desktop.ini file(s)
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:800