Analysis
- max time kernel
148s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
13/09/2026, 00:17
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
unhide.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
10 signatures
150 seconds
General
- Target unhide.exe
- Size 389KB
- Sample260913-algthazydv
- SHA256 4f68c751ca08888c6cf5eba888e9385d52f42e0c1a60ec7888c34841a7540b53
- MD5 2529406e348278e6cb3ff7fcb104c54f
- SHA1 b3a189605458d333a8defd92cb4975e0e9b03e46
- SHA512 e35482df0f545f7dca6380d9d18875d052180d3dcc74c387bf98f2528d84074f9f60f56235c9ac30f012410f338503d05766619ab2b15e0df04ba85362fb312c
- SSDEEP 6144:NUuTTTKHFpSDUISjVcSPf/Ke4Kk/jrjzc6r6IFLpjZ4R7fRXN:2u0FpBISxcSPfv4hTc6rDL74R7j
- TLSH T1A9843A60E1D885B3D5EA02304CB17B30156EFE982675C18F574C3BAA3ABEBC35136B19
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Drops file in Drivers directory 31 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\Drivers\en-US unhide.exe File opened for modification C:\Windows\SysWOW64\Drivers\en-US\wfplwfs.sys.mui unhide.exe File opened for modification C:\Windows\SysWOW64\Drivers\es-ES unhide.exe File opened for modification C:\Windows\SysWOW64\Drivers\es-ES\wfplwfs.sys.mui unhide.exe File opened for modification C:\Windows\SysWOW64\Drivers\ja-JP\wfplwfs.sys.mui unhide.exe File opened for modification C:\Windows\SysWOW64\Drivers\fr-FR unhide.exe File opened for modification C:\Windows\SysWOW64\Drivers\afunix.sys unhide.exe File opened for modification C:\Windows\SysWOW64\Drivers\de-DE unhide.exe File opened for modification C:\Windows\SysWOW64\Drivers\de-DE\NdisImPlatform.sys.mui unhide.exe File opened for modification C:\Windows\SysWOW64\Drivers\it-IT\NdisImPlatform.sys.mui unhide.exe File opened for modification C:\Windows\SysWOW64\Drivers\it-IT\wfplwfs.sys.mui unhide.exe File opened for modification C:\Windows\SysWOW64\Drivers\UMDF unhide.exe File opened for modification C:\Windows\SysWOW64\Drivers\fr-FR\wfplwfs.sys.mui unhide.exe File opened for modification C:\Windows\SysWOW64\Drivers\gmreadme.txt unhide.exe File opened for modification C:\Windows\SysWOW64\Drivers\it-IT unhide.exe File opened for modification C:\Windows\SysWOW64\Drivers\ja-JP unhide.exe File opened for modification C:\Windows\SysWOW64\Drivers\ja-JP\ndiscap.sys.mui unhide.exe File opened for modification C:\Windows\SysWOW64\Drivers\uk-UA unhide.exe File opened for modification C:\Windows\SysWOW64\Drivers\de-DE\ndiscap.sys.mui unhide.exe File opened for modification C:\Windows\SysWOW64\Drivers\en-US\NdisImPlatform.sys.mui unhide.exe File opened for modification C:\Windows\SysWOW64\Drivers\es-ES\NdisImPlatform.sys.mui unhide.exe File opened for modification C:\Windows\SysWOW64\Drivers\gm.dls unhide.exe File opened for modification C:\Windows\SysWOW64\Drivers\it-IT\ndiscap.sys.mui unhide.exe File opened for modification C:\Windows\SysWOW64\Drivers\uk-UA\NdisImPlatform.sys.mui unhide.exe File opened for modification C:\Windows\SysWOW64\Drivers\de-DE\wfplwfs.sys.mui unhide.exe File opened for modification C:\Windows\SysWOW64\Drivers\UMDF\en-US unhide.exe File opened for modification C:\Windows\SysWOW64\Drivers\en-US\ndiscap.sys.mui unhide.exe File opened for modification C:\Windows\SysWOW64\Drivers\es-ES\ndiscap.sys.mui unhide.exe File opened for modification C:\Windows\SysWOW64\Drivers\ja-JP\NdisImPlatform.sys.mui unhide.exe File opened for modification C:\Windows\SysWOW64\Drivers\fr-FR\ndiscap.sys.mui unhide.exe File opened for modification C:\Windows\SysWOW64\Drivers\fr-FR\NdisImPlatform.sys.mui unhide.exe - Manipulates Digital Signatures 1 IoCs
Attackers can apply techniques such as modifying certain DLL exports to make their binary seem valid.
description ioc Process File opened for modification C:\Windows\SysWOW64\wintrust.dll unhide.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Drops desktop.ini file(s) 36 IoCs
description ioc Process File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-s..-kf-publiclibraries_31bf3856ad364e35_10.0.26100.1_none_12dc48264ff839df\desktop.ini unhide.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-s..32-kf-commonstartup_31bf3856ad364e35_10.0.26100.1_none_f903e633b39522d3\desktop.ini unhide.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-s..ktopini-systemtools_31bf3856ad364e35_10.0.26100.1_none_7b60e8f9f0308735\Desktop.ini unhide.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-shell-wallpaper-themed_31bf3856ad364e35_10.0.26100.1_none_d3c921950d7fa7f0\Desktop.ini unhide.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-fontext_31bf3856ad364e35_10.0.26100.1591_none_3a4593a9a3a42262\desktop.ini unhide.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-s..er-content-extended_31bf3856ad364e35_10.0.26100.1_none_e78a517c04a5f782\Desktop.ini unhide.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-s..l32-kf-userprofiles_31bf3856ad364e35_10.0.26100.1_none_80d96be390261ff6\desktop.ini unhide.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-shell-wallpaper-themea_31bf3856ad364e35_10.0.26100.1_none_d3c965ed0d7f5b0d\Desktop.ini unhide.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-s..2-kf-commonprograms_31bf3856ad364e35_10.0.26100.1_none_4b82445892b64521\desktop.ini unhide.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-s..32-kf-commondesktop_31bf3856ad364e35_10.0.26100.1_none_ef1cce0418e0ca2e\desktop.ini unhide.exe File opened for modification C:\Windows\Fonts\desktop.ini unhide.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-s..-kf-commondownloads_31bf3856ad364e35_10.0.26100.1_none_f0177ec0bacc01ab\desktop.ini unhide.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-s..opini-accessibility_31bf3856ad364e35_10.0.26100.1_none_d75f0561e5d53d5b\Desktop.ini unhide.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-s..sktopini-sendtouser_31bf3856ad364e35_10.0.26100.1_none_053839e1fca5597b\Desktop.ini unhide.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\DataServices\DESKTOP.INI unhide.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-s..i-accessibilityuser_31bf3856ad364e35_10.0.26100.1_none_6038226271499ae0\Desktop.ini unhide.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-s..ini-accessoriesuser_31bf3856ad364e35_10.0.26100.1_none_20f7d6167cb25b4e\Desktop.ini unhide.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-s..ini-systemtoolsuser_31bf3856ad364e35_10.0.26100.1_none_1d9f561f4c141236\Desktop.ini unhide.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-s..ktopini-accessories_31bf3856ad364e35_10.0.26100.1_none_e90ac44521f6781d\Desktop.ini unhide.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-s..l32-kf-commonvideos_31bf3856ad364e35_10.0.26100.1_none_d939b1ba77084dd2\desktop.ini unhide.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-shell-sounds_31bf3856ad364e35_10.0.26100.1_none_140624931e1631ac\Desktop.ini unhide.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-s..l32-kf-programfiles_31bf3856ad364e35_10.0.26100.1_none_128f27879ad1c14e\desktop.ini unhide.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-s..2-kf-commonpictures_31bf3856ad364e35_10.0.26100.1_none_7d46065ee5cd8613\desktop.ini unhide.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-ie-objectcontrolviewer_31bf3856ad364e35_11.0.26100.1150_none_16c5cc95ed81961d\desktop.ini unhide.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-ie-offlinefavorites_31bf3856ad364e35_11.0.26100.1150_none_40cb47622b181101\desktop.ini unhide.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-s..-kf-programfilesx86_31bf3856ad364e35_10.0.26100.1_none_7f736e321868c082\desktop.ini unhide.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-s..ktopini-maintenance_31bf3856ad364e35_10.0.26100.1_none_5b8ddc5d05b3ae46\Desktop.ini unhide.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-shell-wallpaper-themeb_31bf3856ad364e35_10.0.26100.1_none_d3c94f250d7f74ae\Desktop.ini unhide.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-shell-wallpaper-themec_31bf3856ad364e35_10.0.26100.1_none_d3c9385d0d7f8e4f\Desktop.ini unhide.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-s..kf-commonadmintools_31bf3856ad364e35_10.0.26100.1_none_520ba6927730f124\desktop.ini unhide.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-s..-kf-commondocuments_31bf3856ad364e35_10.0.26100.1_none_4bc4edc230be4464\desktop.ini unhide.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-s..-kf-commonstartmenu_31bf3856ad364e35_10.0.26100.1_none_3df18355654b83e7\desktop.ini unhide.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-shell32-kf-commonmusic_31bf3856ad364e35_10.0.26100.1_none_760a3fa79d0dd71f\desktop.ini unhide.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-shell32-kf-public_31bf3856ad364e35_10.0.26100.1_none_53f4413b5b0ec6c8\desktop.ini unhide.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\History\desktop.ini unhide.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-s..ini-maintenanceuser_31bf3856ad364e35_10.0.26100.1_none_02fb486cbe6baf65\Desktop.ini unhide.exe - Drops file in System32 directory 64 IoCs
description ioc Process File opened for modification C:\Windows\System32\catroot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-OneCore-Multimedia-MFPMP-Package~31bf3856ad364e35~amd64~en-US~10.0.26100.1.cat unhide.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\kdnic.inf_amd64_a9d04a55194853d2\kdnic.sys unhide.exe File opened for modification C:\Windows\System32\DriverStore\fr-FR\remoteposdrv.inf_loc unhide.exe File opened for modification C:\Windows\SysWOW64\fr-FR\rsop.msc unhide.exe File opened for modification C:\Windows\SysWOW64\SMI unhide.exe File opened for modification C:\Windows\SysWOW64\uk-UA\mycomput.dll.mui unhide.exe File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\DSCResources\MSFT_GroupResource\fr-FR\MSFT_GroupResource.schema.mfl unhide.exe File opened for modification C:\Windows\System32\catroot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-ErrorReportingFaults-WOW64-Package~31bf3856ad364e35~amd64~it-IT~10.0.26100.1.cat unhide.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\wvid.inf_amd64_d5372cf5de74c97e unhide.exe File opened for modification C:\Windows\SysWOW64\fr-FR\Windows.ApplicationModel.Store.TestingFramework.dll.mui unhide.exe File opened for modification C:\Windows\SysWOW64\wbem\de-DE\npivwmi.mfl unhide.exe File opened for modification C:\Windows\System32\catroot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SmbDirect-Package~31bf3856ad364e35~amd64~es-ES~10.0.26100.1.cat unhide.exe File opened for modification C:\Windows\System32\DriverStore\fr-FR\c_net.inf_loc unhide.exe File opened for modification C:\Windows\System32\DriverStore\fr-FR\nete1e3e.inf_loc unhide.exe File opened for modification C:\Windows\SysWOW64\en-US\netshell.dll.mui unhide.exe File opened for modification C:\Windows\SysWOW64\Speech\SpeechUX\uk-UA unhide.exe File opened for modification C:\Windows\System32\catroot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\HyperV-Vpci-VSP-merged-Package~31bf3856ad364e35~amd64~it-IT~10.0.26100.1.cat unhide.exe File opened for modification C:\Windows\System32\catroot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-CoreSystem-CredSSP-Package~31bf3856ad364e35~amd64~ja-JP~10.0.26100.1.cat unhide.exe File opened for modification C:\Windows\System32\DriverStore\de-DE\netevbd0a.inf_loc unhide.exe File opened for modification C:\Windows\System32\DriverStore\en-US\mgtdyn.inf_loc unhide.exe File opened for modification C:\Windows\SysWOW64\hu-HU\comctl32.dll.mui unhide.exe File opened for modification C:\Windows\SysWOW64\verclsid.exe unhide.exe File opened for modification C:\Windows\System32\catroot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-CoreSystem-Security-UserMgr-Package~31bf3856ad364e35~amd64~ja-JP~10.0.26100.1.cat unhide.exe File opened for modification C:\Windows\System32\catroot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Internet-Browser-Package~31bf3856ad364e35~amd64~it-IT~10.0.26100.1.cat unhide.exe File opened for modification C:\Windows\System32\DriverStore\es-ES\lltdio.inf_loc unhide.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\ntprint.inf_x86_5083be912240d5a2\I386\PSCRPTFE.NTF unhide.exe File opened for modification C:\Windows\SysWOW64\wbem\polstore.mof unhide.exe File opened for modification C:\Windows\System32\catroot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-CoreSystem-DXG-Common-Package~31bf3856ad364e35~amd64~de-DE~10.0.26100.1.cat unhide.exe File opened for modification C:\Windows\System32\catroot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-DirectoryServices-ADAM-Client-Admin-Package~31bf3856ad364e35~amd64~ja-JP~10.0.26100.1.cat unhide.exe File opened for modification C:\Windows\System32\catroot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-ErrorReportingFaults-Package~31bf3856ad364e35~amd64~~10.0.26100.1591.cat unhide.exe File opened for modification C:\Windows\System32\catroot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Media-Format-WOW64-merged-Package~31bf3856ad364e35~amd64~uk-UA~10.0.26100.1.cat unhide.exe File opened for modification C:\Windows\System32\DriverStore\es-ES\c_fsphysicalquotamgmt.inf_loc unhide.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\c_pcmcia.inf_amd64_94a68204a2135886 unhide.exe File opened for modification C:\Windows\SysWOW64\fr-FR\msfeedsbs.dll.mui unhide.exe File opened for modification C:\Windows\System32\catroot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\HyperV-RDP4VS-Package~31bf3856ad364e35~amd64~ja-JP~10.0.26100.1.cat unhide.exe File opened for modification C:\Windows\System32\catroot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-MSPaint-FoD-Package~31bf3856ad364e35~amd64~de-DE~10.0.26100.1.cat unhide.exe File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Schemas unhide.exe File opened for modification C:\Windows\System32\catroot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-OneCore-HWN-Wdf-Class-Extensions-Package~31bf3856ad364e35~amd64~it-IT~10.0.26100.1.cat unhide.exe File opened for modification C:\Windows\System32\catroot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-WinOcr-Package~31bf3856ad364e35~amd64~es-ES~10.0.26100.1.cat unhide.exe File opened for modification C:\Windows\SysWOW64\fr-FR\LockAppBroker.dll.mui unhide.exe File opened for modification C:\Windows\SysWOW64\it-IT\dot3gpui.dll.mui unhide.exe File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\NetAdapter\MSFT_NetAdapterSriovVf.cmdletDefinition.cdxml unhide.exe File opened for modification C:\Windows\System32\DriverStore\de-DE\usb.inf_loc unhide.exe File opened for modification C:\Windows\System32\DriverStore\es-ES\usbxhci.inf_loc unhide.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\c_usb.inf_amd64_a96b7e7764e3cb58\c_usb.inf unhide.exe File opened for modification C:\Windows\System32\DriverStore\it-IT\nete1e3e.inf_loc unhide.exe File opened for modification C:\Windows\System32\DriverStore\ja-JP\wnetvsc_vfpp.inf_loc unhide.exe File opened for modification C:\Windows\SysWOW64\IME\IMEKR unhide.exe File opened for modification C:\Windows\SysWOW64\ja-JP\mmcbase.dll.mui unhide.exe File opened for modification C:\Windows\SysWOW64\TaskApis.dll unhide.exe File opened for modification C:\Windows\System32\catroot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-VBSCRIPT-FoD-Package~31bf3856ad364e35~wow64~fr-FR~10.0.26100.1.cat unhide.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\tpm.inf_amd64_781799b99d4537ce unhide.exe File opened for modification C:\Windows\System32\DriverStore\it-IT\netmyk64.inf_loc unhide.exe File opened for modification C:\Windows\System32\DriverStore\ja-JP\usbprint.inf_loc unhide.exe File opened for modification C:\Windows\SysWOW64\HdcpHandler.dll unhide.exe File opened for modification C:\Windows\SysWOW64\it-IT\systeminfo.exe.mui unhide.exe File opened for modification C:\Windows\SysWOW64\uk-UA\schedsvc.dll.mui unhide.exe File opened for modification C:\Windows\SysWOW64\uReFS.dll unhide.exe File opened for modification C:\Windows\System32\catroot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-OneCore-Wer-merged-Package~31bf3856ad364e35~amd64~en-US~10.0.26100.1.cat unhide.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\ntprint.inf_amd64_5083be912240d5a2\Amd64\LOCALE.GPD unhide.exe File opened for modification C:\Windows\System32\DriverStore\it-IT\iai2c.inf_loc unhide.exe File opened for modification C:\Windows\System32\catroot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-OneCore-Console-Driver-Boot-Package~31bf3856ad364e35~amd64~de-DE~10.0.26100.1.cat unhide.exe File opened for modification C:\Windows\System32\DriverStore\es-ES\hdaudbus.inf_loc unhide.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\mdmwhql0.inf_amd64_61a6722ee00b3f61\mdmwhql0.inf unhide.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\EQUATION\api-ms-win-crt-string-l1-1-0.dll unhide.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\TRANSLAT\FREN\WT61FR.LEX unhide.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\js\nls\pt-br unhide.exe File opened for modification C:\Program Files (x86)\Common Files\Microsoft Shared\ink\en-US\TabTip32.exe.mui unhide.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\Locales\ne.pak unhide.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\PublisherR_OEM_Perp-ul-phn.xrm-ms unhide.exe File opened for modification C:\Program Files\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\it-IT unhide.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\VBA unhide.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.SecHealthUI_1000.26100.1.0_x64__8wekyb3d8bbwe\Assets\contrast-white\WindowsSecuritySplashScreen.scale-125_contrast-white.png unhide.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.SecHealthUI_1000.26100.1.0_x64__8wekyb3d8bbwe\Assets\PerfhealthJumpListLogo.png unhide.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AGM.dll unhide.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\js\nls\es-es unhide.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\js\nls\eu-es\ui-strings.js unhide.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\Trust Protection Lists\Mu\Fingerprinting unhide.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\System unhide.exe File opened for modification C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\System.AddIn.dll unhide.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.SecHealthUI_1000.26100.1.0_x64__8wekyb3d8bbwe\Assets\contrast-white\WindowsSecurityAppList.scale-400_contrast-white.png unhide.exe File opened for modification C:\Program Files\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\Microsoft.PackageManagement.CoreProviders.dll unhide.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\js\nls\ru-ru\ui-strings.js unhide.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\StandardVL_MAK-ul-phn.xrm-ms unhide.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\EduWorks Data Streamer Add-In\Microsoft.Office.Tools.Excel.dll unhide.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\LAYERS\LAYERS.INF unhide.exe File opened for modification C:\Program Files\Windows Media Player\fr-FR unhide.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\ResiliencyLinks\Trust Protection Lists\Mu\Other.DATA unhide.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\Locales\de.pak unhide.exe File opened for modification C:\Program Files (x86)\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\1.0.1\Test\Modules unhide.exe File opened for modification C:\Program Files (x86)\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\1.0.1\Test\Modules\Example2.Diagnostics\1.0.1\Diagnostics\Simple unhide.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\TellMeOneNote.nrr unhide.exe File opened for modification C:\Program Files\WindowsPowerShell\Modules\Pester\3.4.0\Functions\TestDrive.ps1 unhide.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account-select\css\main.css unhide.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\Trust Protection Lists\Mu\Cryptomining unhide.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\System.Diagnostics.Tools.dll unhide.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\Power Map Excel Add-in\EXCELPLUGINSHELL.DLL unhide.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_SubTrial3-ul-oob.xrm-ms unhide.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\js\nls\pt-br\ui-strings.js unhide.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\Locales\gd.pak unhide.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\Locales\hi.pak unhide.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\msedgeupdateres_sr.dll unhide.exe File opened for modification C:\Program Files\Mozilla Firefox\notificationserver.dll unhide.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\codec\libg711_plugin.dll unhide.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\js\nls\ko-kr\ui-strings.js unhide.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\nb-no unhide.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\EdgeUpdate.dat unhide.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\control\libntservice_plugin.dll unhide.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\js\nls\de-de unhide.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\Locales\sr.pak unhide.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\Microsoft.Win32.Primitives.dll unhide.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\images\themes\dark\files_icons2x.png unhide.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\Locales\id_NEUTER.pak unhide.exe File opened for modification C:\Program Files\Java\jre-1.8\lib\security\blacklist unhide.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\Configuration\ssn_high_group_info.txt unhide.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe unhide.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn unhide.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\js\nls\ru-ru unhide.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\km-KH unhide.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\cy\LC_MESSAGES\vlc.mo unhide.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\it unhide.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\s_ellipses_selected.svg unhide.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe unhide.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\prism_common.dll unhide.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\msoasb.exe unhide.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\api-ms-win-crt-heap-l1-1-0.dll unhide.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\js\nls\tr-tr unhide.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\PROOF\MSHY7ES.DLL unhide.exe - Drops file in Windows directory 64 IoCs
description ioc Process File opened for modification C:\Windows\WinSxS\Manifests\amd64_microsoft-windows-t..torclient.resources_31bf3856ad364e35_10.0.26100.1_es-es_3b5dc7caa60e2224.manifest unhide.exe File opened for modification C:\Windows\WinSxS\Manifests\x86_netfx35linq-microsoft.build.framework_31bf3856ad364e35_3.5.26100.1_none_ed9f5d0fc551d021.manifest unhide.exe File opened for modification C:\Windows\WinSxS\x86_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.1738_none_48e47fdfbf0a33b1\GlobMerger.dll unhide.exe File opened for modification C:\Windows\servicing\Packages\Microsoft-Windows-Printing-Foundation-Package~31bf3856ad364e35~amd64~en-US~10.0.26100.1.mum unhide.exe File opened for modification C:\Windows\SystemApps\Microsoft.UI.Xaml.CBS_8wekyb3d8bbwe\Microsoft.UI.Xaml\Assets unhide.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-m..xe-common.resources_31bf3856ad364e35_10.0.26100.1_uk-ua_82bf5b0c79b611c9 unhide.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.26100.1_cy-gb_d2aebc054336f9c2 unhide.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-mspaint-shell_31bf3856ad364e35_10.0.26100.1_none_59415351e2c0d944\Paint.lnk unhide.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-w..ty-client.resources_31bf3856ad364e35_10.0.26100.1_en-us_13750fd03c1ca21d unhide.exe File opened for modification C:\Windows\WinSxS\Manifests\amd64_microsoft-windows-c..ement-wmi.resources_31bf3856ad364e35_10.0.26100.1_uk-ua_6634bf1b11a6829c.manifest unhide.exe File opened for modification C:\Windows\WinSxS\msil_uiautomationprovider_31bf3856ad364e35_10.0.26100.1_none_132242972a4e92f7\UIAutomationProvider.dll unhide.exe File opened for modification C:\Windows\servicing\Packages\Microsoft-Windows-CoreSystem-WINNLS-Core-WOW64-Package~31bf3856ad364e35~amd64~ja-JP~10.0.26100.1.cat unhide.exe File opened for modification C:\Windows\WinSxS\amd64_dual_rawsilo.inf_31bf3856ad364e35_10.0.26100.1_none_924358c1f8c87dec unhide.exe File opened for modification C:\Windows\WinSxS\amd64_netfx4-aspnet_counters_dll_b03f5f7f11d50a3a_4.0.15912.0_none_a2d058fc9ff90a16 unhide.exe File opened for modification C:\Windows\WinSxS\amd64_system.web.resources_b03f5f7f11d50a3a_4.0.15912.0_it-it_920f056ef985e9db unhide.exe File opened for modification C:\Windows\WinSxS\Manifests\amd64_microsoft-windows-c..ty-wow64-deployment_31bf3856ad364e35_10.0.26100.712_none_12c4d367df9b4271.manifest unhide.exe File opened for modification C:\Windows\WinSxS\amd64_hidspi_km.inf.resources_31bf3856ad364e35_10.0.26100.1_ja-jp_3d5620764a5cbca2\hidspi_km.inf_loc unhide.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft.powershel..resources.resources_31bf3856ad364e35_10.0.26100.1_en-us_7ebf65b116b35f9f\PSDSCxMachine.strings.psd1 unhide.exe File opened for modification C:\Windows\WinSxS\amd64_system.net.http.resources_b03f5f7f11d50a3a_4.0.15912.0_ja-jp_f9161c35e560d359\System.Net.Http.resources.dll unhide.exe File opened for modification C:\Windows\WinSxS\Manifests\amd64_microsoft-windows-ntdll.resources_31bf3856ad364e35_10.0.26100.1_ja-jp_9458a3ac81f48d7e.manifest unhide.exe File opened for modification C:\Windows\WinSxS\Temp\InFlight\7352b1a64e42dd01db0400008c16ac16 unhide.exe File opened for modification C:\Windows\debug\NetSetup.LOG unhide.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-i..airingexperiencemem_31bf3856ad364e35_10.0.26100.1150_none_c76e09b6d22df932\r\DevicePairingExperienceMEM.dll unhide.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-mfwmaaec_31bf3856ad364e35_10.0.26100.1_none_913a2a4c9cf058aa unhide.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-mlang.resources_31bf3856ad364e35_10.0.26100.1_fr-fr_25b91e176e54526a unhide.exe File opened for modification C:\Windows\WinSxS\wow64_microsoft-windows-i..e-defaultcasingfile_31bf3856ad364e35_10.0.26100.1_none_7b57a96b2c789653\l_intl.nls unhide.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-c..r-name-ui.resources_31bf3856ad364e35_10.0.26100.1_de-de_0d6525fe16f0f22d unhide.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-k..container.resources_31bf3856ad364e35_10.0.26100.1_de-de_3419b9d660e3ac05 unhide.exe File opened for modification C:\Windows\WinSxS\Manifests\amd64_microsoft-windows-a..imeserver.resources_31bf3856ad364e35_10.0.26100.1_it-it_c8cda0615bdbe468.manifest unhide.exe File opened for modification C:\Windows\WinSxS\wow64_microsoft-windows-runtime-metadata_31bf3856ad364e35_10.0.26100.1591_none_d706e0c6ec417f05\Windows.Gaming.winmd unhide.exe File opened for modification C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.BackgroundIntelligentTransfer.Management\v4.0_10.0.0.0__31bf3856ad364e35 unhide.exe File opened for modification C:\Windows\servicing\Packages\Microsoft-OneCore-SystemCounters-Package~31bf3856ad364e35~amd64~uk-UA~10.0.26100.1.cat unhide.exe File opened for modification C:\Windows\servicing\Packages\Microsoft-Windows-WMIC-WOW64-Package~31bf3856ad364e35~wow64~ja-JP~10.0.26100.1.mum unhide.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-a..imeserver.resources_31bf3856ad364e35_10.0.26100.1_uk-ua_662c064ebfcc2522 unhide.exe File opened for modification C:\Windows\WinSxS\Catalogs\7325aec0e1390a4992bf60bc63f0dc183d7cc40479a246bb9315cbf35f0092db.cat unhide.exe File opened for modification C:\Windows\WinSxS\Manifests\amd64_microsoft-windows-security-spp.resources_31bf3856ad364e35_10.0.26100.1_fr-fr_3c3e725592603ddb.manifest unhide.exe File opened for modification C:\Windows\WinSxS\Manifests\amd64_microsoft-windows-time-service_31bf3856ad364e35_10.0.26100.1591_none_24675ed61d517c73.manifest unhide.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-p..oler-core.resources_31bf3856ad364e35_10.0.26100.1_es-es_2496654a6a29444f unhide.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-shutdownux.resources_31bf3856ad364e35_10.0.26100.1_de-de_d4bc906346504d62\ShutdownUX.dll.mui unhide.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-iconcodecservice_31bf3856ad364e35_10.0.26100.1_none_242c4c2df2a0db27 unhide.exe File opened for modification C:\Windows\WinSxS\amd64_networking-mpssvc-svc.resources_31bf3856ad364e35_10.0.26100.1_es-es_8427b976f72bb7ca\mpssvc.dll.mui unhide.exe File opened for modification C:\Windows\WinSxS\amd64_userexperience-photon_31bf3856ad364e35_10.0.26100.1591_none_faf85d9f2170dfcf\r\Photon\Public\wsxpacks\AccountControl\assets\strings\ne-NP.json unhide.exe File opened for modification C:\Windows\WinSxS\Manifests\amd64_c_dot4print.inf-languagepack_31bf3856ad364e35_10.0.26100.1_it-it_43b00bea5b572328.manifest unhide.exe File opened for modification C:\Windows\WinSxS\Manifests\amd64_rtucx21x64.inf.resources_31bf3856ad364e35_10.0.26100.1_en-us_47e0ad6b8e8606f1.manifest unhide.exe File opened for modification C:\Windows\WinSxS\msil_napinit.resources_31bf3856ad364e35_10.0.26100.1_fr-fr_bc8a4b0b676dd5ee\napinit.Resources.dll unhide.exe File opened for modification C:\Windows\PolicyDefinitions\es-ES\TouchInput.adml unhide.exe File opened for modification C:\Windows\SystemApps\MicrosoftWindows.Client.FileExp_cw5n1h2txyewy\FileExplorerExtensions\Assets\images unhide.exe File opened for modification C:\Windows\SystemApps\MicrosoftWindows.Client.FileExp_cw5n1h2txyewy\FileExplorerExtensions\Assets\images\contrast-standard\theme-light\windows.navpane.svg unhide.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.26100.1455_zh-cn_7a24ce15801184fc_bootmgfw_ex.efi.mui_afb6c5ba unhide.exe File opened for modification C:\Windows\WinSxS\Manifests\amd64_microsoft-windows-p..gging-adm.resources_31bf3856ad364e35_10.0.26100.1_ja-jp_c7680b592d37d0ba.manifest unhide.exe File opened for modification C:\Windows\WinSxS\Manifests\amd64_netfx35linq-system...s.accountmanagement_31bf3856ad364e35_10.0.26100.1_none_7be1d16af8559d46.manifest unhide.exe File opened for modification C:\Windows\Microsoft.NET\Framework\v3.0\WPF\PenIMC.dll unhide.exe File opened for modification C:\Windows\servicing\Packages\Microsoft-Windows-ErrorReporting-Adm-Package~31bf3856ad364e35~amd64~ja-JP~10.0.26100.1.mum unhide.exe File opened for modification C:\Windows\servicing\Packages\Microsoft-Windows-Legacy-Components-OC-WOW64-Package~31bf3856ad364e35~amd64~~10.0.26100.1.mum unhide.exe File opened for modification C:\Windows\WinSxS\amd64_eventviewersettings.resources_31bf3856ad364e35_10.0.26100.1_de-de_eb34c4df0d92ee2b unhide.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-n..xcorecomp.resources_31bf3856ad364e35_10.0.26100.1_fr-fr_a2f93192edd61208\wizard.aspx.fr.resx unhide.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-time-tool.resources_31bf3856ad364e35_10.0.26100.1_fr-fr_1e0c4d0a2bed8d03 unhide.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-w..cywmdmapi.resources_31bf3856ad364e35_10.0.26100.1_it-it_051e1f9a1665351f\MSWMDM.dll.mui unhide.exe File opened for modification C:\Windows\WinSxS\Manifests\amd64_hyperv-compute-containerdiagnosticstool_31bf3856ad364e35_10.0.26100.1150_none_234860e0e753c908.manifest unhide.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\Microsoft.Transactions.Bridge.Dtc.dll unhide.exe File opened for modification C:\Windows\WinSxS\amd64_hid-user.resources_31bf3856ad364e35_10.0.26100.1_en-us_6296385c53bf0882\hidserv.dll.mui unhide.exe File opened for modification C:\Windows\WinSxS\Manifests\wow64_windows-id-connecte..r-configuration-int_31bf3856ad364e35_10.0.26100.1_none_06bbb6f3863d8dfd.manifest unhide.exe File opened for modification C:\Windows\WinSxS\x86_microsoft-windows-m..-autoplay.resources_31bf3856ad364e35_10.0.26100.1_it-it_a0ad6828262ad34c\wmlaunch.exe.mui unhide.exe File opened for modification C:\Windows\servicing\Packages\Microsoft-OneCore-HWN-Wdf-Class-Extensions-Package~31bf3856ad364e35~amd64~de-DE~10.0.26100.1.cat unhide.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language unhide.exe - Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 5736 unhide.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\unhide.exe"C:\Users\Admin\AppData\Local\Temp\unhide.exe"1⤵
- Drops file in Drivers directory
- Manipulates Digital Signatures
- Drops desktop.ini file(s)
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:5736