Analysis

  • user interaction
    yes
  • max time kernel
    141s
  • max time network
    130s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260911-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    02/10/2026, 23:52

General

  • Target
    OOSU10.exe
  • Size 81.7MB
  • Sample261002-3w5brsysbs
  • SHA256 925ccd8164a90f6a1c8d907415f38df353a4ff00db73f07598a29b8f7928bb52
  • MD5 SHA1 SHA512 SSDEEP TLSH

Malware Config

Signatures

  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Loads dropped DLL 52 IoCs
  • Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

    The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

  • Checks SCSI registry key(s) 3 TTPs 5 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Modifies Control Panel 1 IoCs
  • Modifies registry class 15 IoCs
  • Suspicious use of AdjustPrivilegeToken 29 IoCs
  • System policy modification 1 TTPs 7 IoCs
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

Processes

  • C:\Users\Admin\AppData\Local\Temp\OOSU10.exe
    "C:\Users\Admin\AppData\Local\Temp\OOSU10.exe"
    1⤵
    • Loads dropped DLL
    • Reads the TCP/IP host and domain name from the registry
    • Modifies Control Panel
    • Modifies registry class
    • Suspicious use of AdjustPrivilegeToken
    • System policy modification
    PID:3700
  • C:\Windows\system32\vssvc.exe
    C:\Windows\system32\vssvc.exe
    1⤵
    • Checks SCSI registry key(s)
    • Suspicious use of AdjustPrivilegeToken
    PID:2960

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        OOSU10.cfg

        • Path C:\Users\Admin\AppData\Local\OO Software\OO ShutUp10\OOSU10.cfg
        • Size 1KB
        • SHA256 37dc102a1e133daeea2682e885d5947ef2ee37e4a48a0c3d72d46a937eea4de1
        • MD5 SHA1 SHA512 TLSH

        OOSU10.cfg.tmp

        • Path C:\Users\Admin\AppData\Local\OO Software\OO ShutUp10\OOSU10.cfg.tmp
        • Size 1KB
        • SHA256 f3c59f7fe55684063499fa642756e0d4cb1e995f21c1c171441a8db60a9a3af1
        • MD5 SHA1 SHA512 TLSH

        OOSU10.cfg.tmp

        • Path C:\Users\Admin\AppData\Local\OO Software\OO ShutUp10\OOSU10.cfg.tmp
        • Size 17KB
        • SHA256 f0f4a45c22e931a7fdb1ec21c41652b43f4a24c2f886d20b0e4690a92f9f4b02
        • MD5 SHA1 SHA512 SSDEEP TLSH

        D3DCompiler_47_cor3.dll

        • Path C:\Users\Admin\AppData\Local\Temp\.net\OOSU10\2YVyfa3Ppry9\D3DCompiler_47_cor3.dll
        • Size 4.5MB
        • SHA256 a05f99734f7c4822fefc12b367af21fd0976ed6608752fb1e1e80b6ece7ecbbb
        • MD5 SHA1 SHA512 SSDEEP TLSH

        DirectWriteForwarder.dll

        • Path C:\Users\Admin\AppData\Local\Temp\.net\OOSU10\2YVyfa3Ppry9\DirectWriteForwarder.dll
        • Size 493KB
        • SHA256 2526dcb41392b1756fd8fdb517fdca1c852b774b957e6e6c66715f616e5fc027
        • MD5 SHA1 SHA512 SSDEEP TLSH

        Microsoft.Win32.Registry.dll

        • Path C:\Users\Admin\AppData\Local\Temp\.net\OOSU10\2YVyfa3Ppry9\Microsoft.Win32.Registry.dll
        • Size 113KB
        • SHA256 5f7623b92c1ef07c98546f63c83613f5f5f7af6513dc52e2e9e11447b6c1c7f6
        • MD5 SHA1 SHA512 SSDEEP TLSH

        PresentationCore.dll

        • Path C:\Users\Admin\AppData\Local\Temp\.net\OOSU10\2YVyfa3Ppry9\PresentationCore.dll
        • Size 7.9MB
        • SHA256 c2ac0752b0a3018331519b8aec6fa085346bfc59609ea29954821a0ab19ee839
        • MD5 SHA1 SHA512 SSDEEP TLSH

        PresentationFramework-SystemXml.dll

        • Path C:\Users\Admin\AppData\Local\Temp\.net\OOSU10\2YVyfa3Ppry9\PresentationFramework-SystemXml.dll
        • Size 33KB
        • SHA256 bf68aa126af58c0733846e1df00f705a18a2dda051ce120754eca5e27b585cf5
        • MD5 SHA1 SHA512 SSDEEP TLSH

        PresentationFramework.Aero2.dll

        • Path C:\Users\Admin\AppData\Local\Temp\.net\OOSU10\2YVyfa3Ppry9\PresentationFramework.Aero2.dll
        • Size 433KB
        • SHA256 5673f7f99321cef2eba08453b5c94f723a48fe94e8b746c6882c022696fea7ea
        • MD5 SHA1 SHA512 SSDEEP TLSH

        PresentationFramework.dll

        • Path C:\Users\Admin\AppData\Local\Temp\.net\OOSU10\2YVyfa3Ppry9\PresentationFramework.dll
        • Size 15.1MB
        • SHA256 fa9aa188f9c92dc95b4e56f303b1875244bf45786733948c79034fe95fb0cd86
        • MD5 SHA1 SHA512 SSDEEP TLSH

        PresentationNative_cor3.dll

        • Path C:\Users\Admin\AppData\Local\Temp\.net\OOSU10\2YVyfa3Ppry9\PresentationNative_cor3.dll
        • Size 1.2MB
        • SHA256 42e2e543c17e1b37499baf00d956433b8afb655348ec0fae89c926fb7d149b6e
        • MD5 SHA1 SHA512 SSDEEP TLSH

        System.Collections.Concurrent.dll

        • Path C:\Users\Admin\AppData\Local\Temp\.net\OOSU10\2YVyfa3Ppry9\System.Collections.Concurrent.dll
        • Size 225KB
        • SHA256 569667e92dda0af323a9f289c6bbe7a046bab7354f9fa0d37fc97404a0499ed3
        • MD5 SHA1 SHA512 SSDEEP TLSH

        System.Collections.NonGeneric.dll

        • Path C:\Users\Admin\AppData\Local\Temp\.net\OOSU10\2YVyfa3Ppry9\System.Collections.NonGeneric.dll
        • Size 101KB
        • SHA256 8cf296b4868c0dea441c452c50ed5c322837bf736a7c173f46dda4ebdfeb4c0b
        • MD5 SHA1 SHA512 SSDEEP TLSH

        System.Collections.Specialized.dll

        • Path C:\Users\Admin\AppData\Local\Temp\.net\OOSU10\2YVyfa3Ppry9\System.Collections.Specialized.dll
        • Size 101KB
        • SHA256 61702e1173c49f32e7b1804667a249f8709680f01859d46cf30e74197fedc1c5
        • MD5 SHA1 SHA512 SSDEEP TLSH

        System.Collections.dll

        • Path C:\Users\Admin\AppData\Local\Temp\.net\OOSU10\2YVyfa3Ppry9\System.Collections.dll
        • Size 289KB
        • SHA256 5aea9c285f011d1e83f05834e12632ee5ebf65da1d546e696f525af47101a3b0
        • MD5 SHA1 SHA512 SSDEEP TLSH

        System.ComponentModel.Primitives.dll

        • Path C:\Users\Admin\AppData\Local\Temp\.net\OOSU10\2YVyfa3Ppry9\System.ComponentModel.Primitives.dll
        • Size 77KB
        • SHA256 b671ae0e9463f65d2ad08366c890043fd570f7d3149bb57bc16b8d427d9684f5
        • MD5 SHA1 SHA512 SSDEEP TLSH

        System.ComponentModel.TypeConverter.dll

        • Path C:\Users\Admin\AppData\Local\Temp\.net\OOSU10\2YVyfa3Ppry9\System.ComponentModel.TypeConverter.dll
        • Size 749KB
        • SHA256 d24ca7be9b39ff4117edb0d207ff5ab1a0e1587557a3daaa44391f0b04d93816
        • MD5 SHA1 SHA512 SSDEEP TLSH

        System.ComponentModel.dll

        • Path C:\Users\Admin\AppData\Local\Temp\.net\OOSU10\2YVyfa3Ppry9\System.ComponentModel.dll
        • Size 29KB
        • SHA256 615f1d4f821d25f46e61bc70dd879b4129daa754f42f427a23fa68c4dc74f09a
        • MD5 SHA1 SHA512 SSDEEP TLSH

        System.Configuration.ConfigurationManager.dll

        • Path C:\Users\Admin\AppData\Local\Temp\.net\OOSU10\2YVyfa3Ppry9\System.Configuration.ConfigurationManager.dll
        • Size 1021KB
        • SHA256 bd36ea6b9d4cb140d6f2b88b30678d9e2559a4ecde7ac5956828a84ae1f7a6d3
        • MD5 SHA1 SHA512 SSDEEP TLSH

        System.Diagnostics.EventLog.dll

        • Path C:\Users\Admin\AppData\Local\Temp\.net\OOSU10\2YVyfa3Ppry9\System.Diagnostics.EventLog.dll
        • Size 357KB
        • SHA256 9d49f6a312b511677c6aa47fb50c5f8ca3f0041090dd76c3363dea99428b13e0
        • MD5 SHA1 SHA512 SSDEEP TLSH

        System.Diagnostics.FileVersionInfo.dll

        • Path C:\Users\Admin\AppData\Local\Temp\.net\OOSU10\2YVyfa3Ppry9\System.Diagnostics.FileVersionInfo.dll
        • Size 45KB
        • SHA256 cbf1da7048153697f1c47175b61579e5f8e79e178d62b04787d626055ed9792e
        • MD5 SHA1 SHA512 SSDEEP TLSH

        System.Diagnostics.Process.dll

        • Path C:\Users\Admin\AppData\Local\Temp\.net\OOSU10\2YVyfa3Ppry9\System.Diagnostics.Process.dll
        • Size 321KB
        • SHA256 2b4871e02b366113c6ccf3b1436fadde5e69fc0a3e3ac421e2fa0f7af8c2bc3b
        • MD5 SHA1 SHA512 SSDEEP TLSH

        System.Diagnostics.StackTrace.dll

        • Path C:\Users\Admin\AppData\Local\Temp\.net\OOSU10\2YVyfa3Ppry9\System.Diagnostics.StackTrace.dll
        • Size 45KB
        • SHA256 6578cef25cba5dcd0f7c34f2bbe6fad5c2cb59b601ab708c5f3e8d1dbfc60a95
        • MD5 SHA1 SHA512 SSDEEP TLSH

        System.Diagnostics.TraceSource.dll

        • Path C:\Users\Admin\AppData\Local\Temp\.net\OOSU10\2YVyfa3Ppry9\System.Diagnostics.TraceSource.dll
        • Size 137KB
        • SHA256 63e22e512f3db18ab51d57663364479ce56fcd924085fd0d6bd136f299106fa6
        • MD5 SHA1 SHA512 SSDEEP TLSH

        System.IO.Packaging.dll

        • Path C:\Users\Admin\AppData\Local\Temp\.net\OOSU10\2YVyfa3Ppry9\System.IO.Packaging.dll
        • Size 313KB
        • SHA256 81b79f1aa729fc08fb39d56682f82378589f2f2b5a0b9997a7a1cd10be5d3a11
        • MD5 SHA1 SHA512 SSDEEP TLSH

        System.Linq.Expressions.dll

        • Path C:\Users\Admin\AppData\Local\Temp\.net\OOSU10\2YVyfa3Ppry9\System.Linq.Expressions.dll
        • Size 3.5MB
        • SHA256 f5d05f16c2f31ae822bca8db63019067c8d83b09376b0a60c38b9c98fa0e088f
        • MD5 SHA1 SHA512 SSDEEP TLSH

        System.Linq.dll

        • Path C:\Users\Admin\AppData\Local\Temp\.net\OOSU10\2YVyfa3Ppry9\System.Linq.dll
        • Size 681KB
        • SHA256 139264775432faf15a813e607e1919ea869d3321079ba134ffa36b350577c271
        • MD5 SHA1 SHA512 SSDEEP TLSH

        System.Memory.dll

        • Path C:\Users\Admin\AppData\Local\Temp\.net\OOSU10\2YVyfa3Ppry9\System.Memory.dll
        • Size 157KB
        • SHA256 58a4dc8a9efac1fe0ee67138b0dda35b2b812addc14c5d8251cc222b278a5c2d
        • MD5 SHA1 SHA512 SSDEEP TLSH

        System.Net.Primitives.dll

        • Path C:\Users\Admin\AppData\Local\Temp\.net\OOSU10\2YVyfa3Ppry9\System.Net.Primitives.dll
        • Size 205KB
        • SHA256 e678e0129a87751c624cbe2e3ab83d55055a091a5b77d8138f02255deda4b6c4
        • MD5 SHA1 SHA512 SSDEEP TLSH

        System.Net.Requests.dll

        • Path C:\Users\Admin\AppData\Local\Temp\.net\OOSU10\2YVyfa3Ppry9\System.Net.Requests.dll
        • Size 365KB
        • SHA256 f2735dd7adbc04c505805e9f069f9d545f34f1ff689e2a9d6bcda1a2480d3da7
        • MD5 SHA1 SHA512 SSDEEP TLSH

        System.Net.WebClient.dll

        • Path C:\Users\Admin\AppData\Local\Temp\.net\OOSU10\2YVyfa3Ppry9\System.Net.WebClient.dll
        • Size 161KB
        • SHA256 ab06cb5eaff5ca00045dd847e167f0107a53114aca47d26ed3500adf38bd142b
        • MD5 SHA1 SHA512 SSDEEP TLSH

        System.Net.WebHeaderCollection.dll

        • Path C:\Users\Admin\AppData\Local\Temp\.net\OOSU10\2YVyfa3Ppry9\System.Net.WebHeaderCollection.dll
        • Size 61KB
        • SHA256 7abfc26269a95cec0d93ca2a6b8148aa45d504c8f50a62fbbbad72408966d45a
        • MD5 SHA1 SHA512 SSDEEP TLSH

        System.ObjectModel.dll

        • Path C:\Users\Admin\AppData\Local\Temp\.net\OOSU10\2YVyfa3Ppry9\System.ObjectModel.dll
        • Size 77KB
        • SHA256 16d9a18630f1d33ec7a709ab2f31652c91ebdfbc7a5a481378aebe2e1102ffc2
        • MD5 SHA1 SHA512 SSDEEP TLSH

        System.Private.CoreLib.dll

        • Path C:\Users\Admin\AppData\Local\Temp\.net\OOSU10\2YVyfa3Ppry9\System.Private.CoreLib.dll
        • Size 15.3MB
        • SHA256 ed80a1a5dd066c0407ad59686f9af90a4f3e55dbf3e4c973b53cc8c9d0706f82
        • MD5 SHA1 SHA512 SSDEEP TLSH

        System.Private.Uri.dll

        • Path C:\Users\Admin\AppData\Local\Temp\.net\OOSU10\2YVyfa3Ppry9\System.Private.Uri.dll
        • Size 249KB
        • SHA256 0546093ec627bf832c244be56d9acca471778385c534e0107f2a6dc6a78f93d2
        • MD5 SHA1 SHA512 SSDEEP TLSH

        System.Private.Xml.dll

        • Path C:\Users\Admin\AppData\Local\Temp\.net\OOSU10\2YVyfa3Ppry9\System.Private.Xml.dll
        • Size 7.4MB
        • SHA256 d570b8cb9507f2fcac88f80a2fe7597d3e2331a84f337820a7d794632a67ed5d
        • MD5 SHA1 SHA512 SSDEEP TLSH

        System.Reflection.Emit.dll

        • Path C:\Users\Admin\AppData\Local\Temp\.net\OOSU10\2YVyfa3Ppry9\System.Reflection.Emit.dll
        • Size 301KB
        • SHA256 b4208981583d74994aa4d855e12788676fdebce63ba848be63a6e0a7fbe2cb3d
        • MD5 SHA1 SHA512 SSDEEP TLSH

        System.Runtime.CompilerServices.VisualC.dll

        • Path C:\Users\Admin\AppData\Local\Temp\.net\OOSU10\2YVyfa3Ppry9\System.Runtime.CompilerServices.VisualC.dll
        • Size 29KB
        • SHA256 67483e224e8019d1d725876485a6fca81dd977d5254cf26d79a26f2a73207fa9
        • MD5 SHA1 SHA512 SSDEEP TLSH

        System.Runtime.InteropServices.dll

        • Path C:\Users\Admin\AppData\Local\Temp\.net\OOSU10\2YVyfa3Ppry9\System.Runtime.InteropServices.dll
        • Size 109KB
        • SHA256 9d0621f1e573bd20525287533bea24ec7824813eada7820a0c82252ede072ab9
        • MD5 SHA1 SHA512 SSDEEP TLSH

        System.Runtime.Serialization.Formatters.dll

        • Path C:\Users\Admin\AppData\Local\Temp\.net\OOSU10\2YVyfa3Ppry9\System.Runtime.Serialization.Formatters.dll
        • Size 121KB
        • SHA256 ae2d71a1c6231a7e4c9f0264666acf90f743460ae7983d5331e9ad0271e7ad88
        • MD5 SHA1 SHA512 SSDEEP TLSH

        System.Security.AccessControl.dll

        • Path C:\Users\Admin\AppData\Local\Temp\.net\OOSU10\2YVyfa3Ppry9\System.Security.AccessControl.dll
        • Size 221KB
        • SHA256 5fda871ac0ab09ba62884ba4160b5c84f8d9513d16c773b7d01e3b82dae905b4
        • MD5 SHA1 SHA512 SSDEEP TLSH

        System.Security.Claims.dll

        • Path C:\Users\Admin\AppData\Local\Temp\.net\OOSU10\2YVyfa3Ppry9\System.Security.Claims.dll
        • Size 97KB
        • SHA256 ca5a036a17ed63c6f90d92570c657bcec451dc2c894b1ffff0688855b61e455c
        • MD5 SHA1 SHA512 SSDEEP TLSH

        System.Security.Cryptography.dll

        • Path C:\Users\Admin\AppData\Local\Temp\.net\OOSU10\2YVyfa3Ppry9\System.Security.Cryptography.dll
        • Size 2.4MB
        • SHA256 bee61e6bdeff9fb0c4f3cbf9d48e9d1d97d12a8bb85d1eeab9178e818b582eee
        • MD5 SHA1 SHA512 SSDEEP TLSH

        System.Security.Principal.Windows.dll

        • Path C:\Users\Admin\AppData\Local\Temp\.net\OOSU10\2YVyfa3Ppry9\System.Security.Principal.Windows.dll
        • Size 173KB
        • SHA256 ed56739aabc1fb6f81e8f71db89531beea985550f654d4d0e6c9a64c67e4e349
        • MD5 SHA1 SHA512 SSDEEP TLSH

        System.Text.Json.dll

        • Path C:\Users\Admin\AppData\Local\Temp\.net\OOSU10\2YVyfa3Ppry9\System.Text.Json.dll
        • Size 1.8MB
        • SHA256 ed5f0f3773c89948471e3691f31963ea00d3577e17296ac4dfb97772e78b6fa3
        • MD5 SHA1 SHA512 SSDEEP TLSH

        System.Text.RegularExpressions.dll

        • Path C:\Users\Admin\AppData\Local\Temp\.net\OOSU10\2YVyfa3Ppry9\System.Text.RegularExpressions.dll
        • Size 1009KB
        • SHA256 b8494ba41da52018409cccd851753717c6bd035fccdf5e4d5ac83e420d4678f4
        • MD5 SHA1 SHA512 SSDEEP TLSH

        System.Threading.AccessControl.dll

        • Path C:\Users\Admin\AppData\Local\Temp\.net\OOSU10\2YVyfa3Ppry9\System.Threading.AccessControl.dll
        • Size 73KB
        • SHA256 eec9d6f83ec123602039ec449b402c1bcb74ff00518eb87f8d007558e48c2b89
        • MD5 SHA1 SHA512 SSDEEP TLSH

        System.Threading.dll

        • Path C:\Users\Admin\AppData\Local\Temp\.net\OOSU10\2YVyfa3Ppry9\System.Threading.dll
        • Size 81KB
        • SHA256 cadf13029ac996abaceccfd7c242e55888b669246163342a3b335eee9851b531
        • MD5 SHA1 SHA512 SSDEEP TLSH

        System.Windows.Controls.Ribbon.dll

        • Path C:\Users\Admin\AppData\Local\Temp\.net\OOSU10\2YVyfa3Ppry9\System.Windows.Controls.Ribbon.dll
        • Size 1.4MB
        • SHA256 d21e5e5c9737c3bee3c723328a829cfffd91ebb0dea95cc7c989304ddad5fb39
        • MD5 SHA1 SHA512 SSDEEP TLSH

        System.Windows.Extensions.dll

        • Path C:\Users\Admin\AppData\Local\Temp\.net\OOSU10\2YVyfa3Ppry9\System.Windows.Extensions.dll
        • Size 117KB
        • SHA256 6b7a0939a35d28442e94dfe3fc6c6433efc85985ba765c4891be66d113b3e4a7
        • MD5 SHA1 SHA512 SSDEEP TLSH

        System.Xaml.dll

        • Path C:\Users\Admin\AppData\Local\Temp\.net\OOSU10\2YVyfa3Ppry9\System.Xaml.dll
        • Size 1.3MB
        • SHA256 8f5eeaedc35f82a9b457d5562b688b6e1892732ecf6c0c18dd3159b976458d27
        • MD5 SHA1 SHA512 SSDEEP TLSH

        UIAutomationProvider.dll

        • Path C:\Users\Admin\AppData\Local\Temp\.net\OOSU10\2YVyfa3Ppry9\UIAutomationProvider.dll
        • Size 61KB
        • SHA256 4c7676ed72bdcb17714ad11ee838d416fcbbdac4101ec1af9248cca91e9470b0
        • MD5 SHA1 SHA512 SSDEEP TLSH

        UIAutomationTypes.dll

        • Path C:\Users\Admin\AppData\Local\Temp\.net\OOSU10\2YVyfa3Ppry9\UIAutomationTypes.dll
        • Size 289KB
        • SHA256 903fe486e2a90299568fc90e61fc735a2b6826de967bccb7e16ae77f1b5ca92f
        • MD5 SHA1 SHA512 SSDEEP TLSH

        WindowsBase.dll

        • Path C:\Users\Admin\AppData\Local\Temp\.net\OOSU10\2YVyfa3Ppry9\WindowsBase.dll
        • Size 2.1MB
        • SHA256 42e05225d944bde54e4f2cbe0142105fce822c574267b6f8e305ee8c45c664e8
        • MD5 SHA1 SHA512 SSDEEP TLSH

        wpfgfx_cor3.dll

        • Path C:\Users\Admin\AppData\Local\Temp\.net\OOSU10\2YVyfa3Ppry9\wpfgfx_cor3.dll
        • Size 1.9MB
        • SHA256 0ba67759d290f5d75ff92979394077dcd533fe484511db3ea161d7e102246a73
        • MD5 SHA1 SHA512 SSDEEP TLSH