Analysis
- max time kernel
148s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
13/09/2026, 00:18
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
unhide.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
9 signatures
150 seconds
General
- Target unhide.exe
- Size 389KB
- Sample260913-almpracd89
- SHA256 4f68c751ca08888c6cf5eba888e9385d52f42e0c1a60ec7888c34841a7540b53
- MD5 2529406e348278e6cb3ff7fcb104c54f
- SHA1 b3a189605458d333a8defd92cb4975e0e9b03e46
- SHA512 e35482df0f545f7dca6380d9d18875d052180d3dcc74c387bf98f2528d84074f9f60f56235c9ac30f012410f338503d05766619ab2b15e0df04ba85362fb312c
- SSDEEP 6144:NUuTTTKHFpSDUISjVcSPf/Ke4Kk/jrjzc6r6IFLpjZ4R7fRXN:2u0FpBISxcSPfv4hTc6rDL74R7j
- TLSH T1A9843A60E1D885B3D5EA02304CB17B30156EFE982675C18F574C3BAA3ABEBC35136B19
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Drops file in Drivers directory 31 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\Drivers\de-DE\NdisImPlatform.sys.mui unhide.exe File opened for modification C:\Windows\SysWOW64\Drivers\de-DE\wfplwfs.sys.mui unhide.exe File opened for modification C:\Windows\SysWOW64\Drivers\gmreadme.txt unhide.exe File opened for modification C:\Windows\SysWOW64\Drivers\ja-JP\NdisImPlatform.sys.mui unhide.exe File opened for modification C:\Windows\SysWOW64\Drivers\en-US\ndiscap.sys.mui unhide.exe File opened for modification C:\Windows\SysWOW64\Drivers\en-US\NdisImPlatform.sys.mui unhide.exe File opened for modification C:\Windows\SysWOW64\Drivers\es-ES unhide.exe File opened for modification C:\Windows\SysWOW64\Drivers\UMDF unhide.exe File opened for modification C:\Windows\SysWOW64\Drivers\UMDF\en-US unhide.exe File opened for modification C:\Windows\SysWOW64\Drivers\de-DE unhide.exe File opened for modification C:\Windows\SysWOW64\Drivers\en-US\wfplwfs.sys.mui unhide.exe File opened for modification C:\Windows\SysWOW64\Drivers\es-ES\wfplwfs.sys.mui unhide.exe File opened for modification C:\Windows\SysWOW64\Drivers\uk-UA unhide.exe File opened for modification C:\Windows\SysWOW64\Drivers\uk-UA\NdisImPlatform.sys.mui unhide.exe File opened for modification C:\Windows\SysWOW64\Drivers\afunix.sys unhide.exe File opened for modification C:\Windows\SysWOW64\Drivers\en-US unhide.exe File opened for modification C:\Windows\SysWOW64\Drivers\ja-JP unhide.exe File opened for modification C:\Windows\SysWOW64\Drivers\fr-FR\wfplwfs.sys.mui unhide.exe File opened for modification C:\Windows\SysWOW64\Drivers\gm.dls unhide.exe File opened for modification C:\Windows\SysWOW64\Drivers\it-IT\NdisImPlatform.sys.mui unhide.exe File opened for modification C:\Windows\SysWOW64\Drivers\ja-JP\wfplwfs.sys.mui unhide.exe File opened for modification C:\Windows\SysWOW64\Drivers\es-ES\NdisImPlatform.sys.mui unhide.exe File opened for modification C:\Windows\SysWOW64\Drivers\fr-FR unhide.exe File opened for modification C:\Windows\SysWOW64\Drivers\it-IT unhide.exe File opened for modification C:\Windows\SysWOW64\Drivers\it-IT\wfplwfs.sys.mui unhide.exe File opened for modification C:\Windows\SysWOW64\Drivers\de-DE\ndiscap.sys.mui unhide.exe File opened for modification C:\Windows\SysWOW64\Drivers\es-ES\ndiscap.sys.mui unhide.exe File opened for modification C:\Windows\SysWOW64\Drivers\fr-FR\ndiscap.sys.mui unhide.exe File opened for modification C:\Windows\SysWOW64\Drivers\fr-FR\NdisImPlatform.sys.mui unhide.exe File opened for modification C:\Windows\SysWOW64\Drivers\it-IT\ndiscap.sys.mui unhide.exe File opened for modification C:\Windows\SysWOW64\Drivers\ja-JP\ndiscap.sys.mui unhide.exe - Manipulates Digital Signatures 1 IoCs
Attackers can apply techniques such as modifying certain DLL exports to make their binary seem valid.
description ioc Process File opened for modification C:\Windows\SysWOW64\wintrust.dll unhide.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Drops desktop.ini file(s) 36 IoCs
description ioc Process File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-s..ini-maintenanceuser_31bf3856ad364e35_10.0.26100.1_none_02fb486cbe6baf65\Desktop.ini unhide.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-s..ini-systemtoolsuser_31bf3856ad364e35_10.0.26100.1_none_1d9f561f4c141236\Desktop.ini unhide.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-shell-sounds_31bf3856ad364e35_10.0.26100.1_none_140624931e1631ac\Desktop.ini unhide.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-shell-wallpaper-themeb_31bf3856ad364e35_10.0.26100.1_none_d3c94f250d7f74ae\Desktop.ini unhide.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\History\desktop.ini unhide.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-s..32-kf-commondesktop_31bf3856ad364e35_10.0.26100.1_none_ef1cce0418e0ca2e\desktop.ini unhide.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-s..kf-commonadmintools_31bf3856ad364e35_10.0.26100.1_none_520ba6927730f124\desktop.ini unhide.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-s..l32-kf-userprofiles_31bf3856ad364e35_10.0.26100.1_none_80d96be390261ff6\desktop.ini unhide.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-shell-wallpaper-themea_31bf3856ad364e35_10.0.26100.1_none_d3c965ed0d7f5b0d\Desktop.ini unhide.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-shell-wallpaper-themed_31bf3856ad364e35_10.0.26100.1_none_d3c921950d7fa7f0\Desktop.ini unhide.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-s..l32-kf-commonvideos_31bf3856ad364e35_10.0.26100.1_none_d939b1ba77084dd2\desktop.ini unhide.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-s..l32-kf-programfiles_31bf3856ad364e35_10.0.26100.1_none_128f27879ad1c14e\desktop.ini unhide.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-s..opini-accessibility_31bf3856ad364e35_10.0.26100.1_none_d75f0561e5d53d5b\Desktop.ini unhide.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-s..-kf-publiclibraries_31bf3856ad364e35_10.0.26100.1_none_12dc48264ff839df\desktop.ini unhide.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-s..2-kf-commonprograms_31bf3856ad364e35_10.0.26100.1_none_4b82445892b64521\desktop.ini unhide.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-s..ini-accessoriesuser_31bf3856ad364e35_10.0.26100.1_none_20f7d6167cb25b4e\Desktop.ini unhide.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-shell-wallpaper-themec_31bf3856ad364e35_10.0.26100.1_none_d3c9385d0d7f8e4f\Desktop.ini unhide.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-shell32-kf-commonmusic_31bf3856ad364e35_10.0.26100.1_none_760a3fa79d0dd71f\desktop.ini unhide.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-ie-objectcontrolviewer_31bf3856ad364e35_11.0.26100.1150_none_16c5cc95ed81961d\desktop.ini unhide.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-ie-offlinefavorites_31bf3856ad364e35_11.0.26100.1150_none_40cb47622b181101\desktop.ini unhide.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-s..i-accessibilityuser_31bf3856ad364e35_10.0.26100.1_none_6038226271499ae0\Desktop.ini unhide.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-s..ktopini-maintenance_31bf3856ad364e35_10.0.26100.1_none_5b8ddc5d05b3ae46\Desktop.ini unhide.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-s..sktopini-sendtouser_31bf3856ad364e35_10.0.26100.1_none_053839e1fca5597b\Desktop.ini unhide.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-s..-kf-commondownloads_31bf3856ad364e35_10.0.26100.1_none_f0177ec0bacc01ab\desktop.ini unhide.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-s..-kf-commonstartmenu_31bf3856ad364e35_10.0.26100.1_none_3df18355654b83e7\desktop.ini unhide.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-s..er-content-extended_31bf3856ad364e35_10.0.26100.1_none_e78a517c04a5f782\Desktop.ini unhide.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-s..ktopini-accessories_31bf3856ad364e35_10.0.26100.1_none_e90ac44521f6781d\Desktop.ini unhide.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-fontext_31bf3856ad364e35_10.0.26100.1591_none_3a4593a9a3a42262\desktop.ini unhide.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-s..-kf-programfilesx86_31bf3856ad364e35_10.0.26100.1_none_7f736e321868c082\desktop.ini unhide.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-s..ktopini-systemtools_31bf3856ad364e35_10.0.26100.1_none_7b60e8f9f0308735\Desktop.ini unhide.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-shell32-kf-public_31bf3856ad364e35_10.0.26100.1_none_53f4413b5b0ec6c8\desktop.ini unhide.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-s..32-kf-commonstartup_31bf3856ad364e35_10.0.26100.1_none_f903e633b39522d3\desktop.ini unhide.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\DataServices\DESKTOP.INI unhide.exe File opened for modification C:\Windows\Fonts\desktop.ini unhide.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-s..-kf-commondocuments_31bf3856ad364e35_10.0.26100.1_none_4bc4edc230be4464\desktop.ini unhide.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-s..2-kf-commonpictures_31bf3856ad364e35_10.0.26100.1_none_7d46065ee5cd8613\desktop.ini unhide.exe - Drops file in System32 directory 64 IoCs
description ioc Process File opened for modification C:\Windows\System32\catroot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-OneCore-Pnp-PlatformServices-Package~31bf3856ad364e35~amd64~es-ES~10.0.26100.1.cat unhide.exe File opened for modification C:\Windows\SysWOW64\ja-JP\netsh.exe.mui unhide.exe File opened for modification C:\Windows\SysWOW64\wbem\uk-UA\schedprov.mfl unhide.exe File opened for modification C:\Windows\System32\catroot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\HyperV-Host-Compute-PowerShell-Module-Package~31bf3856ad364e35~amd64~it-IT~10.0.26100.1.cat unhide.exe File opened for modification C:\Windows\System32\DriverStore\it-IT\HalExtPL080.inf_loc unhide.exe File opened for modification C:\Windows\SysWOW64\uk-UA\taskcomp.dll.mui unhide.exe File opened for modification C:\Windows\SysWOW64\cryptext.dll unhide.exe File opened for modification C:\Windows\System32\DriverStore\it-IT\wmiacpi.inf_loc unhide.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\netl260a.inf_amd64_39ee03ea6ee818e4\l260x64.sys unhide.exe File opened for modification C:\Windows\SysWOW64\uk-UA\onexui.dll.mui unhide.exe File opened for modification C:\Windows\SysWOW64\utildll.dll unhide.exe File opened for modification C:\Windows\System32\catroot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-OneCore-FileSystem-Support-WOW64-Package~31bf3856ad364e35~amd64~it-IT~10.0.26100.1.cat unhide.exe File opened for modification C:\Windows\System32\catroot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Optional-Features-Package~31bf3856ad364e35~amd64~en-US~10.0.26100.1591.cat unhide.exe File opened for modification C:\Windows\SysWOW64\downlevel\api-ms-win-core-threadpool-legacy-l1-1-0.dll unhide.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\ialpss2i_gpio2_skl.inf_amd64_b68199ad84607c21\iaLPSS2i_GPIO2.sys unhide.exe File opened for modification C:\Windows\System32\LogFiles\Scm\SCM.EVM.2 unhide.exe File opened for modification C:\Windows\SysWOW64\ThumbnailExtractionHost.exe unhide.exe File opened for modification C:\Windows\SysWOW64\wbem\fr-FR\schedprov.mfl unhide.exe File opened for modification C:\Windows\System32\DriverStore\de-DE\c_fsquotamgmt.inf_loc unhide.exe File opened for modification C:\Windows\SysWOW64\ja-JP\slc.dll.mui unhide.exe File opened for modification C:\Windows\SysWOW64\uk-UA\hgcpl.dll.mui unhide.exe File opened for modification C:\Windows\System32\catroot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Foundation-Group-Package~31bf3856ad364e35~amd64~fr-FR~10.0.26100.1.cat unhide.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\ipmidrv.inf_amd64_05b174c4f94b6cb8 unhide.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\ntprint.inf_x86_5083be912240d5a2 unhide.exe File opened for modification C:\Windows\SysWOW64\en-US\PSModuleDiscoveryProvider.dll.mui unhide.exe File opened for modification C:\Windows\SysWOW64\es-ES\PhoneUtilRes.dll.mui unhide.exe File opened for modification C:\Windows\SysWOW64\spp\tokens\pkeyconfig\pkeyconfig-downlevel.xrm-ms unhide.exe File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\NetQos\MSFT_NetQosPolicy.Types.ps1xml unhide.exe File opened for modification C:\Windows\SysWOW64\DxpTaskSync.dll unhide.exe File opened for modification C:\Windows\System32\catroot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\HyperV-UX-Common-Package~31bf3856ad364e35~amd64~es-ES~10.0.26100.1.cat unhide.exe File opened for modification C:\Windows\System32\catroot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-OneCore-IsolatedUserMode-merged-Package~31bf3856ad364e35~amd64~uk-UA~10.0.26100.1.cat unhide.exe File opened for modification C:\Windows\System32\catroot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-WinOcr-Opt-WOW64-Package~31bf3856ad364e35~wow64~en-US~10.0.26100.1.cat unhide.exe File opened for modification C:\Windows\System32\DriverStore\de-DE\rtwlanu_oldIC.inf_loc unhide.exe File opened for modification C:\Windows\System32\DriverStore\en-US\NdisImPlatform.inf_loc unhide.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\qcwlan64.inf_amd64_71c84e1405061462\bdwlan.elf unhide.exe File opened for modification C:\Windows\SysWOW64\it-IT\iyuv_32.dll.mui unhide.exe File opened for modification C:\Windows\System32\catroot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\HyperV-Compute-Host-Containers-Package~31bf3856ad364e35~amd64~fr-FR~10.0.26100.1.cat unhide.exe File opened for modification C:\Windows\System32\catroot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Hyper-V-Offline-Core-Group-Package~31bf3856ad364e35~amd64~fr-FR~10.0.26100.1.cat unhide.exe File opened for modification C:\Windows\System32\catroot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-CoreSystem-CredSSP-WOW64-Package~31bf3856ad364e35~amd64~de-DE~10.0.26100.1.cat unhide.exe File opened for modification C:\Windows\System32\catroot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-PeerDist-Client-Group-WOW64-Package~31bf3856ad364e35~amd64~es-ES~10.0.26100.1.cat unhide.exe File opened for modification C:\Windows\System32\catroot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Multimedia-RestrictedCodecsCore-Full-Package~31bf3856ad364e35~amd64~uk-UA~10.0.26100.1.cat unhide.exe File opened for modification C:\Windows\SysWOW64\en-US\PlayToStatusProvider.dll.mui unhide.exe File opened for modification C:\Windows\SysWOW64\ja-JP\azroleui.dll.mui unhide.exe File opened for modification C:\Windows\SysWOW64\Windows.Media.Streaming.ps.dll unhide.exe File opened for modification C:\Windows\System32\catroot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-OneCore-Pnp-PlatformServices-WOW64-Package~31bf3856ad364e35~amd64~en-US~10.0.26100.1.cat unhide.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\helloface.inf_amd64_7acb0f078135c491\helloface.inf unhide.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\netathr10x.inf_amd64_e4b0b7be4ba10fc1\LE_CTL_ar6320_3p0_NFA344a_highTX_K.bin unhide.exe File opened for modification C:\Windows\SysWOW64\ja-JP\odbcji32.dll.mui unhide.exe File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\DSCResources\MSFT_LogResource\uk-UA\MSFT_LogResource.schema.mfl unhide.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\mpi3drvi.inf_amd64_1ba85cce0a3d163d unhide.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\netax88179_178a.inf_amd64_be76888d30e8464a unhide.exe File opened for modification C:\Windows\SysWOW64\ja-JP\Microsoft.Uev.AppAgent.dll.mui unhide.exe File opened for modification C:\Windows\SysWOW64\wbem\uk-UA\nlmcim.dll.mui unhide.exe File opened for modification C:\Windows\SysWOW64\wtsapi32.dll unhide.exe File opened for modification C:\Windows\System32\catroot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\HyperV-HvSocket-Package~31bf3856ad364e35~amd64~es-ES~10.0.26100.1.cat unhide.exe File opened for modification C:\Windows\System32\catroot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-CoreSystem-DXG-Common-WOW64-merged-Package~31bf3856ad364e35~amd64~fr-FR~10.0.26100.1.cat unhide.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\battery.inf_amd64_7d642b0d17377530\battc.sys unhide.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\mdmhaeu.inf_amd64_869cf3ae1e1b0424 unhide.exe File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\ScheduledTasks\MSFT_ScheduledTask.format.ps1xml unhide.exe File opened for modification C:\Windows\System32\catroot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Embedded-DialogBlocking-WOW64-Package~31bf3856ad364e35~amd64~~10.0.26100.1.cat unhide.exe File opened for modification C:\Windows\System32\DriverStore\es-ES\netnvma.inf_loc unhide.exe File opened for modification C:\Windows\SysWOW64\es-ES\Licenses\OEM\IoTEnterpriseSK unhide.exe File opened for modification C:\Windows\System32\catroot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-OneCore-CorePrivacySettingsStore-Package~31bf3856ad364e35~amd64~es-ES~10.0.26100.1.cat unhide.exe File opened for modification C:\Windows\System32\catroot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-DataCenterBridging-Opt-Package~31bf3856ad364e35~amd64~it-IT~10.0.26100.1.cat unhide.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Common Files\System\msadc\en-US unhide.exe File opened for modification C:\Program Files\Java\jre-1.8\lib\fonts\LucidaBrightDemiBold.ttf unhide.exe File opened for modification C:\Program Files\MeasurePublish.au unhide.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Tracker\forms_received.gif unhide.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\pages-app\js\nls\da-dk\ui-strings.js unhide.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ru\PresentationFramework.resources.dll unhide.exe File opened for modification C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Colors\Red Violet.xml unhide.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\VisioProO365R_Subscription-ppd.xrm-ms unhide.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\VisioStdCO365R_Subscription-ppd.xrm-ms unhide.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\msouc.exe unhide.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\codec\libsubsusf_plugin.dll unhide.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\Download_on_the_App_Store_Badge_pt_135x40.svg unhide.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\assets\Sample Files\Adobe Sign White Paper.pdf unhide.exe File opened for modification C:\Program Files\Java\jre-1.8\lib\images\cursors\win32_LinkNoDrop32x32.gif unhide.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\ACEODBC.DLL unhide.exe File opened for modification C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\WinFXList.xml unhide.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\nl-nl unhide.exe File opened for modification C:\Program Files\Microsoft Office\root\Integration\C2RManifest.Word.Word.x-none.msi.16.x-none.xml unhide.exe File opened for modification C:\Program Files (x86)\Windows Media Player\it-IT\setup_wm.exe.mui unhide.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\af-ZA\tipresx.dll.mui unhide.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\PresentationFramework-SystemData.dll unhide.exe File opened for modification C:\Program Files\Java\jre-1.8\lib\currency.data unhide.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\Bibliography\BIBFORM.XML unhide.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\RHP_icons.png unhide.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\wdag.dll unhide.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\ResiliencyLinks\Locales\fi.pak.DATA unhide.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ODBC Drivers\Redshift\lib\sbicuuc53_64.dll unhide.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\css\main-cef-mac.css unhide.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\images\themes\dark\rhp_world_icon_2x.png unhide.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\sl_get.svg unhide.exe File opened for modification C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\Contracts\Microsoft.VisualStudio.Tools.Applications.Contract.v9.0.dll unhide.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Smart Tag\LISTS\1033\PHONE.XML unhide.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF unhide.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\video_chroma\libi422_i420_plugin.dll unhide.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\js\nls\nl-nl\ui-strings.js unhide.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\images\email\empty.png unhide.exe File opened for modification C:\Program Files (x86)\Common Files\Microsoft Shared\DAO unhide.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\ResiliencyLinks\msedge_100_percent.pak.DATA unhide.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\dxcompiler.dll unhide.exe File opened for modification C:\Program Files (x86)\WindowsPowerShell\Modules\Pester\3.4.0\Functions\TestDrive.Tests.ps1 unhide.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\js\nls\sv-se\ui-strings.js unhide.exe File opened for modification C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\de\System.Web.Entity.Resources.dll unhide.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSIPC\th unhide.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\Locales\is.pak unhide.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\COPYRIGHT unhide.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MIMEDIR.DLL unhide.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\it-it unhide.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\dc-annotations\css unhide.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\keypad.xml unhide.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\SCNPST64.DLL unhide.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\AIRWER.DLL unhide.exe File opened for modification C:\Program Files\Microsoft Office\root\vreg unhide.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\text_renderer\libsapi_plugin.dll unhide.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\video_filter\libhqdn3d_plugin.dll unhide.exe File opened for modification C:\Program Files\Windows Defender Advanced Threat Protection\Classification\mce.dll unhide.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Playstore\da_get.svg unhide.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\plugin2 unhide.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\de\LC_MESSAGES unhide.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\sq unhide.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\Locales\en-GB.pak unhide.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\[email protected] unhide.exe File opened for modification C:\Program Files\Microsoft Office\root\Templates\1033\BillingStatement.xltx unhide.exe File opened for modification C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\es\UIAutomationClientsideProviders.resources.dll unhide.exe File opened for modification C:\Program Files\Common Files\System\msadc\adcvbs.inc unhide.exe - Drops file in Windows directory 64 IoCs
description ioc Process File opened for modification C:\Windows\servicing\Packages\Microsoft-OneCore-SecureStartup-Foundation-WOW64-Package~31bf3856ad364e35~amd64~uk-UA~10.0.26100.1.mum unhide.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-s..ementwmi-powershell_31bf3856ad364e35_10.0.26100.1_none_e63d982ff040a6e0\Partition.cdxml unhide.exe File opened for modification C:\Windows\WinSxS\FileMaps\$$_microsoft.net_assembly_gac_msil_system.net.http_v4.0_4.0.0.0_b03f5f7f11d50a3a_c02456e4349fe25c.cdf-ms unhide.exe File opened for modification C:\Windows\WinSxS\Manifests\amd64_microsoft-onecore-p..oyment-languagepack_31bf3856ad364e35_10.0.26100.1_en-us_85cf1499a38e3418.manifest unhide.exe File opened for modification C:\Windows\WinSxS\Manifests\wow64_microsoft-windows-wmpnss-api.resources_31bf3856ad364e35_10.0.26100.1_de-de_c321f044ceaf9141.manifest unhide.exe File opened for modification C:\Windows\WinSxS\wow64_microsoft-windows-d..ers-image.resources_31bf3856ad364e35_10.0.26100.1_it-it_67c2494fa99f54bb\GenericProvider.dll.mui unhide.exe File opened for modification C:\Windows\Microsoft.NET\Framework\v4.0.30319\fr\System.Transactions.resources.dll unhide.exe File opened for modification C:\Windows\WinSxS\amd64_userexperience-desktop_31bf3856ad364e35_10.0.26100.1591_none_c815e77f1a5104dd\CBS\Microsoft.Winjs-reduced\js\base.js unhide.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-c..xperfcore.resources_31bf3856ad364e35_10.0.26100.1_it-it_d0148ea4f047d3b6 unhide.exe File opened for modification C:\Windows\WinSxS\Manifests\amd64_microsoft-hyper-v-vhd-parser_31bf3856ad364e35_10.0.26100.1150_none_1aaeba58f29a2e1d.manifest unhide.exe File opened for modification C:\Windows\WinSxS\Manifests\amd64_microsoft-windows-time-tool.resources_31bf3856ad364e35_10.0.26100.1_fr-fr_1e0c4d0a2bed8d03.manifest unhide.exe File opened for modification C:\Windows\WinSxS\wow64_microsoft-windows-web-app-host.resources_31bf3856ad364e35_10.0.26100.1_de-de_f6a505a5153466f5\WWAHost.exe.mui unhide.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-mountvol.resources_31bf3856ad364e35_10.0.26100.1_es-es_803183132dceb393 unhide.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-n..2provider.resources_31bf3856ad364e35_10.0.26100.1_de-de_6547e95d6e76a921\netNat.mfl unhide.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-p..gssystems.resources_31bf3856ad364e35_10.0.26100.1_es-es_58c0910541ae36c1\oflc-nz.rs.mui unhide.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-update-uus-core_31bf3856ad364e35_10.0.26100.1591_none_944de837a97599ab\r\UpdatePlatformAggregators.dll unhide.exe File opened for modification C:\Windows\WinSxS\amd64_userexperience-oobe_31bf3856ad364e35_10.0.26100.1591_none_54983d2d7a4908c4\OOBE\webapps\guidedsetup\network\area-content unhide.exe File opened for modification C:\Windows\WinSxS\Manifests\amd64_microsoft-windows-p..i-prnfldr.resources_31bf3856ad364e35_10.0.26100.1_fr-fr_cbc87d28801f2668.manifest unhide.exe File opened for modification C:\Windows\WinSxS\x86_microsoft-windows-n..xcorecomp.resources_31bf3856ad364e35_10.0.26100.1_ja-jp_d3280b62ffc5982b\ShFusRes.dll unhide.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-c..riencehost.appxmain_31bf3856ad364e35_10.0.26100.1591_none_9e7873f8fda6cd33\knockout-winjs-wrapper.js unhide.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-mmc-adm.resources_31bf3856ad364e35_10.0.26100.1_ja-jp_ee8acca2c11686f8\MMC.adml unhide.exe File opened for modification C:\Windows\WinSxS\FileMaps\$$_system32_de-de_licenses_oem_enterprises_a0f69752346cb32a.cdf-ms unhide.exe File opened for modification C:\Windows\WinSxS\x86_microsoft-windows-m..ntrol-rll.resources_31bf3856ad364e35_10.0.26100.1_en-us_a09c8e5ae2f959b7 unhide.exe File opened for modification C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\web_hightrust.config unhide.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-font-fms.resources_31bf3856ad364e35_10.0.26100.1_sl-si_e6c68494b5f0f19e unhide.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-taskbarcpl.resources_31bf3856ad364e35_10.0.26100.1_ja-jp_a0c3af2a67a26dc3 unhide.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-wmpnss-ux.resources_31bf3856ad364e35_10.0.26100.1_fr-fr_6023b57180ab1ddf\wmpnscfg.exe.mui unhide.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft.windows.c..-controls.resources_6595b64144ccf1df_5.82.26100.1591_ar-sa_095bd8c8e1cf6db7\comctl32.dll.mui unhide.exe File opened for modification C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\data\prod\navigation-getstarted.json unhide.exe File opened for modification C:\Windows\WinSxS\amd64_nett4x64.inf.resources_31bf3856ad364e35_10.0.26100.1_de-de_8d607f735a1a9ec0 unhide.exe File opened for modification C:\Windows\WinSxS\amd64_userexperience-desktop_31bf3856ad364e35_10.0.26100.1591_none_c815e77f1a5104dd\CBS\WindowsBackupClient.exe unhide.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-g..licy-base.resources_31bf3856ad364e35_10.0.26100.1_es-es_bdf3a0dfd999bbdc_gpsvc.dll.mui_0c160ac2 unhide.exe File opened for modification C:\Windows\WinSxS\Manifests\amd64_wpcip.inf.resources_31bf3856ad364e35_10.0.26100.1_de-de_b01215ac4964797a.manifest unhide.exe File opened for modification C:\Windows\WinSxS\amd64_dual_whvcrash.inf_31bf3856ad364e35_10.0.26100.1150_none_79354243a53674a3\whvcrash.inf unhide.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-hyper-v-vstack-config_31bf3856ad364e35_10.0.26100.1150_none_913251ed0664bac8\r\vsconfig.dll unhide.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-htmlhelp.resources_31bf3856ad364e35_10.0.26100.1_ja-jp_e112373ea6da788e\hhctrl.ocx.mui unhide.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-management-oobe_31bf3856ad364e35_10.0.26100.1_none_6f199304b59d97ee\commercialDiagnosticsUtilities.js unhide.exe File opened for modification C:\Windows\WinSxS\msil_microsoft.managementconsole.resources_31bf3856ad364e35_10.0.26100.1_it-it_301a7fb9c7fab5e3\Microsoft.ManagementConsole.Resources.dll unhide.exe File opened for modification C:\Windows\INF\TAPISRV\0409 unhide.exe File opened for modification C:\Windows\WinSxS\amd64_security-octagon-broker.resources_31bf3856ad364e35_10.0.26100.1_de-de_676e048bf9c7f050 unhide.exe File opened for modification C:\Windows\WinSxS\amd64_sysglobl.resources_b03f5f7f11d50a3a_4.0.15912.0_es-es_c079832a66a675c1\sysglobl.resources.dll unhide.exe File opened for modification C:\Windows\WinSxS\wow64_microsoft-windows-m..yer-setup.resources_31bf3856ad364e35_10.0.26100.1_de-de_3d53e99880d02b83 unhide.exe File opened for modification C:\Windows\WinSxS\wow64_microsoft-windows-tcpip-wmiv2provider_31bf3856ad364e35_10.0.26100.1_none_2446214132a02071\MSFT_NetTCPSetting.cdxml unhide.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-a..wdm-audio.resources_31bf3856ad364e35_10.0.26100.1_en-us_6da781a56a672a0f unhide.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-d..se-roaming-binaries_31bf3856ad364e35_10.0.26100.1591_none_60004ac7c11d8180\ChsRoaming.DLL unhide.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-font-bitmap-fixed_31bf3856ad364e35_10.0.26100.1_none_7c038aae972c23b7\85f874.fon unhide.exe File opened for modification C:\Windows\WinSxS\Catalogs\83c6096d3ce08e23d41556d174b575beb75c794ca144c16b5eb0e2b613cc476a.cat unhide.exe File opened for modification C:\Windows\WinSxS\Manifests\amd64_microsoft-windows-a..epository.resources_31bf3856ad364e35_10.0.26100.1_es-es_259cede688d64fa3.manifest unhide.exe File opened for modification C:\Windows\WinSxS\Manifests\amd64_microsoft-windows-s..iagnostic.resources_31bf3856ad364e35_10.0.26100.1_es-es_a892a1fe76af09cc.manifest unhide.exe File opened for modification C:\Windows\WinSxS\Manifests\amd64_server-help-deploym..se.chm-languagepack_31bf3856ad364e35_10.0.26100.1_uk-ua_6d54539efb5aca1e.manifest unhide.exe File opened for modification C:\Windows\WinSxS\msil_microsoft-windows-p..shell-adm.resources_31bf3856ad364e35_10.0.26100.1_fr-fr_0719f65e3a4263f2\PowerShellExecutionPolicy.adml unhide.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.EnterpriseServices.Thunk.dll unhide.exe File opened for modification C:\Windows\PolicyDefinitions\PenTraining.admx unhide.exe File opened for modification C:\Windows\WinSxS\amd64_dual_rspndr.inf_31bf3856ad364e35_10.0.26100.1_none_f6ae9ee98fadd48e unhide.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-eapmethods_31bf3856ad364e35_10.0.26100.1_none_a37f5cafe9cafad5\mschapv2connectionpropertiesv1.xsd unhide.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-s..iagnostic.resources_31bf3856ad364e35_10.0.26100.1_ja-jp_ae24b3afdc98fb33 unhide.exe File opened for modification C:\Windows\WinSxS\FileMaps\$$_microsoft.net_assembly_gac_msil_system.servicemodel.channels_v4.0_4.0.0.0_31bf3856ad364e35_3b879384d8488ea3.cdf-ms unhide.exe File opened for modification C:\Windows\WinSxS\Manifests\amd64_microsoft-windows-m..oyment-languagepack_31bf3856ad364e35_10.0.26100.1_es-es_c6744f53f2f161d1.manifest unhide.exe File opened for modification C:\Windows\WinSxS\msil_multipoint-wms.coll..lecontrol.resources_31bf3856ad364e35_10.0.26100.1_fr-fr_a7b96cc8a2a0eced\Wms.CollapsibleControl.Resources.dll unhide.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-printing-workflow_31bf3856ad364e35_10.0.26100.1591_none_8c481d5e18bbee5f\Windows.Graphics.Printing.Workflow.Native.dll unhide.exe File opened for modification C:\Windows\WinSxS\amd64_systemresource-wind..tscontrol.resources_31bf3856ad364e35_10.0.26100.1_en-us_671128c06d98954f\Windows.UI.AccountsControl.en-US.pri unhide.exe File opened for modification C:\Windows\WinSxS\Fusion\x86_microsoft.vc90.mfcloc_1fc8b3b9a1e18e3b_none_389bb7490f8d1de8\9.0\9.0.30729.6161\MFC90ITA.DLL unhide.exe File opened for modification C:\Windows\WinSxS\wow64_microsoft-windows-peerdist.resources_31bf3856ad364e35_10.0.26100.1_uk-ua_421642ddff2d8600\PeerDist.dll.mui unhide.exe File opened for modification C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management.Instrumentation.resources\v4.0_4.0.0.0_fr_b77a5c561934e089 unhide.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language unhide.exe - Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 4256 unhide.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\unhide.exe"C:\Users\Admin\AppData\Local\Temp\unhide.exe"1⤵
- Drops file in Drivers directory
- Manipulates Digital Signatures
- Drops desktop.ini file(s)
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:4256