Analysis
- max time kernel
149s - max time network
149s - platform
windows10-2004_x64 - resource
win10v2004-20260911-en - resource tags
arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
02/10/2026, 19:58
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
cleancarbon.io_hyber.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
41 signatures
150 seconds
Behavioral task
behavioral2
Sample
cleancarbon.io_hyber.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
41 signatures
150 seconds
General
- Target cleancarbon.io_hyber.exe
- Size 49KB
- Sample261002-yp9kpazbme
- SHA256 db0dc054faac8835c15ab85dff86d882b7feacfdf17c28ba0063d8a70701e1f0
- MD5 758fb781398a2863027ac21842d09def
- SHA1 af1a61e03c360d8da28ee1e6232edda844fe5022
- SHA512 908cf03b2015ac028634e9889f309e5c74a7b029378cba9746dde4135d474006d960668e73f24ff03c466098d1c043502fa239fa861938c2f5794a86110ac2ec
- SSDEEP 384:tFrb51vIFF66z9S0huAozGYKg+9wFfYjid2+0xNcKKKKmI2hM6ZRSb7RQH9iUXFt:PrVZZ6zs0hjh17XqQ/NaPzfX/fXJ4R
- TLSH T15633F64937FD4522E1BF9ABE49B290119731F453DC23DB8E1AD8459E09F37008DA8B6B
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Contains code to disable Windows Defender 2 IoCs
A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.
resource yara_rule behavioral1/memory/2512-0-0x0000000000AD0000-0x0000000000AE2000-memory.dmp disable_win_def behavioral1/files/0x00070000000248f4-2262.dat disable_win_def -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\DisableAntiSpyware = "1" cleancarbon.io_hyber.exe - Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell and hide display window.
pid Process 2104 powershell.exe - Disables RegEdit via registry modification 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" cleancarbon.io_hyber.exe - Disables Task Manager via registry modification
- Drops file in Drivers directory 1 IoCs
description ioc Process File opened for modification C:\Windows\System32\drivers\etc\hosts cleancarbon.io_hyber.exe - Modifies Windows Firewall 2 TTPs 1 IoCs
pid Process 3464 netsh.exe - Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000\Control Panel\International\Geo\Nation cleancarbon.io_hyber.exe - Creates a file in the Startup directory 1 TTPs 64 IoCs
A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_111.pdf cleancarbon.io_hyber.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_129.pdf cleancarbon.io_hyber.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_184.pdf cleancarbon.io_hyber.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_18.pdf cleancarbon.io_hyber.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_6.pdf cleancarbon.io_hyber.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_33.pdf cleancarbon.io_hyber.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_91.pdf cleancarbon.io_hyber.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_93.pdf cleancarbon.io_hyber.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_112.pdf cleancarbon.io_hyber.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_116.pdf cleancarbon.io_hyber.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_185.pdf cleancarbon.io_hyber.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_35.pdf cleancarbon.io_hyber.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_45.pdf cleancarbon.io_hyber.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_56.pdf cleancarbon.io_hyber.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_72.pdf cleancarbon.io_hyber.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_103.pdf cleancarbon.io_hyber.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_148.pdf cleancarbon.io_hyber.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_160.pdf cleancarbon.io_hyber.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_7.pdf cleancarbon.io_hyber.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_80.pdf cleancarbon.io_hyber.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_81.pdf cleancarbon.io_hyber.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_117.pdf cleancarbon.io_hyber.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_143.pdf cleancarbon.io_hyber.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_162.pdf cleancarbon.io_hyber.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_180.pdf cleancarbon.io_hyber.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_187.pdf cleancarbon.io_hyber.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_37.pdf cleancarbon.io_hyber.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_57.pdf cleancarbon.io_hyber.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_102.pdf cleancarbon.io_hyber.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_50.pdf cleancarbon.io_hyber.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_125.pdf cleancarbon.io_hyber.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_140.pdf cleancarbon.io_hyber.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_85.pdf cleancarbon.io_hyber.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_107.pdf cleancarbon.io_hyber.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_190.pdf cleancarbon.io_hyber.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_193.pdf cleancarbon.io_hyber.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_48.pdf cleancarbon.io_hyber.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_177.pdf cleancarbon.io_hyber.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_184.pdf cleancarbon.io_hyber.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_18.pdf cleancarbon.io_hyber.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_3.pdf cleancarbon.io_hyber.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_35.pdf cleancarbon.io_hyber.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_47.pdf cleancarbon.io_hyber.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_95.pdf cleancarbon.io_hyber.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_113.pdf cleancarbon.io_hyber.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_152.pdf cleancarbon.io_hyber.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_187.pdf cleancarbon.io_hyber.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_11.pdf cleancarbon.io_hyber.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_43.pdf cleancarbon.io_hyber.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_82.pdf cleancarbon.io_hyber.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_134.pdf cleancarbon.io_hyber.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_135.pdf cleancarbon.io_hyber.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_149.pdf cleancarbon.io_hyber.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_166.pdf cleancarbon.io_hyber.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_198.pdf cleancarbon.io_hyber.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_99.pdf cleancarbon.io_hyber.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_107.pdf cleancarbon.io_hyber.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_135.pdf cleancarbon.io_hyber.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_165.pdf cleancarbon.io_hyber.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_32.pdf cleancarbon.io_hyber.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_53.pdf cleancarbon.io_hyber.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_119.pdf cleancarbon.io_hyber.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_123.pdf cleancarbon.io_hyber.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_130.pdf cleancarbon.io_hyber.exe - Disables service(s) 3 TTPs
- Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Stops running service(s) 4 TTPs
- Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SysUpdate = "C:\\Users\\Admin\\AppData\\Local\\Temp\\cleancarbon.io_hyber.exe" cleancarbon.io_hyber.exe Set value (str) \REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Malware = "C:\\Users\\Admin\\AppData\\Local\\Temp\\cleancarbon.io_hyber.exe" cleancarbon.io_hyber.exe - Drops desktop.ini file(s) 1 IoCs
description ioc Process File opened for modification C:\$RECYCLE.BIN\S-1-5-18\desktop.ini LogonUI.exe - Enumerates connected drives 3 TTPs 1 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
ioc Process \??\F:\ powershell.exe - Discovers running processes 1 TTPs 1 IoCs
Running process information can be used to identify security tools or plan follow-on actions.
pid Process 816 tasklist.exe - Drops file in System32 directory 3 IoCs
description ioc Process File created C:\Windows\system32\svchost.exe cleancarbon.io_hyber.exe File created C:\Windows\system32\sysupdate.exe cleancarbon.io_hyber.exe File opened for modification C:\Windows\system32\sysupdate.exe cleancarbon.io_hyber.exe - Executes a VBScript file via the Windows Script Host. 1 TTPs 2 IoCs
pid Process 1780 wscript.exe 3036 wscript.exe - Sets desktop wallpaper using registry 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000\Control Panel\Desktop\Wallpaper = "C:\\ProgramData\\SysUpdate\\wall.bmp" cleancarbon.io_hyber.exe - Launches sc.exe 10 IoCs
Sc.exe is a Windows utlilty to control services on the system.
pid Process 3276 sc.exe 688 sc.exe 5080 sc.exe 4484 sc.exe 2800 sc.exe 4144 sc.exe 4596 sc.exe 1896 sc.exe 3112 sc.exe 1780 sc.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs
Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.
description ioc Process Key opened \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe - Executes a command shell one-liner 1 TTPs 7 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 3500 cmd.exe 5048 cmd.exe 3168 cmd.exe 3636 cmd.exe 4972 cmd.exe 208 cmd.exe 228 cmd.exe - Reads the TCP/IP host and domain name from the registry 1 TTPs 6 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname WMIC.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain WMIC.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain cleancarbon.io_hyber.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname cleancarbon.io_hyber.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname WMIC.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain WMIC.exe - Gathers network information 2 TTPs 2 IoCs
Uses commandline utility to view network configuration.
pid Process 2336 NETSTAT.EXE 4740 ipconfig.exe - Gathers system information 1 TTPs 1 IoCs
Runs systeminfo.exe.
pid Process 436 systeminfo.exe - Interacts with shadow copies 3 TTPs 2 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
pid Process 2204 vssadmin.exe 4488 vssadmin.exe - Modifies Control Panel 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000\Control Panel\Desktop\WallpaperStyle = "2" cleancarbon.io_hyber.exe - Modifies data under HKEY_USERS 25 IoCs
description ioc Process Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationGlassAttribute = "1" LogonUI.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\system32\shell32.dll,-50176 = "File Operation" LogonUI.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached LogonUI.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History\AutoColor = "0" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColor = "3288365271" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColorBalance = "89" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglow = "3288365271" LogonUI.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{40DD6E20-7C17-11CE-A804-00AA003CA9F6} {000214FC-0000-0000-C000-000000000046} 0xFFFF = 0100000000000000c7c05d75a852dd01 LogonUI.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\BitBucket\Volume\{efdbfdc7-0000-0000-0000-d01200000000}\MaxCapacity = "13092" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\StartColorMenu = "4288567808" LogonUI.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationBlurBalance = "1" LogonUI.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\BitBucket\Volume\{efdbfdc7-0000-0000-0000-d01200000000} LogonUI.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\BitBucket LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\BitBucket\Volume\{efdbfdc7-0000-0000-0000-d01200000000}\NukeOnDelete = "0" LogonUI.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\AccentColor = "4292311040" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglowBalance = "10" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\TelemetrySalt = "4" LogonUI.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\BitBucket\Volume LogonUI.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentPalette = a6d8ff0076b9ed00429ce3000078d700005a9e000042750000264200f7630c00 LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentColorMenu = "4292311040" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\EnableWindowColorization = "20" LogonUI.exe - Modifies registry class 16 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000_Classes\ms-settings\shell cleancarbon.io_hyber.exe Set value (str) \REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000_Classes\.pdf\ = "PDFBotnet" cleancarbon.io_hyber.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\PDFBotnet\shell cleancarbon.io_hyber.exe Set value (str) \REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000_Classes\ms-settings\shell\open\command\DelegateExecute cleancarbon.io_hyber.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\PDFBotnet\shell\open\command cleancarbon.io_hyber.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\PDFBotnet\shell\open cleancarbon.io_hyber.exe Key created \REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000_Classes\ms-settings\shell\open\command cleancarbon.io_hyber.exe Key created \REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000_Classes\ms-settings\shell\open cleancarbon.io_hyber.exe Set value (str) \REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000_Classes\ms-settings\shell\open\command\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\cleancarbon.io_hyber.exe" cleancarbon.io_hyber.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\PDFBotnet\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\cleancarbon.io_hyber.exe\" \"%1\"" cleancarbon.io_hyber.exe Key deleted \REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000_Classes\ms-settings\shell cleancarbon.io_hyber.exe Key created \REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000_Classes\ms-settings cleancarbon.io_hyber.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\PDFBotnet cleancarbon.io_hyber.exe Key deleted \REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000_Classes\ms-settings\shell\open\command cleancarbon.io_hyber.exe Key deleted \REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000_Classes\ms-settings\shell\open cleancarbon.io_hyber.exe Key deleted \REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000_Classes\ms-settings cleancarbon.io_hyber.exe - Runs net.exe
- Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 2264 schtasks.exe 3760 schtasks.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2104 powershell.exe 2104 powershell.exe 2104 powershell.exe 2512 cleancarbon.io_hyber.exe 2512 cleancarbon.io_hyber.exe 2512 cleancarbon.io_hyber.exe 2512 cleancarbon.io_hyber.exe 2512 cleancarbon.io_hyber.exe 2512 cleancarbon.io_hyber.exe 2512 cleancarbon.io_hyber.exe 2512 cleancarbon.io_hyber.exe 2512 cleancarbon.io_hyber.exe 2512 cleancarbon.io_hyber.exe 2512 cleancarbon.io_hyber.exe 2512 cleancarbon.io_hyber.exe 2512 cleancarbon.io_hyber.exe 2512 cleancarbon.io_hyber.exe 2512 cleancarbon.io_hyber.exe 2512 cleancarbon.io_hyber.exe 2512 cleancarbon.io_hyber.exe 2512 cleancarbon.io_hyber.exe 2512 cleancarbon.io_hyber.exe 2512 cleancarbon.io_hyber.exe 2512 cleancarbon.io_hyber.exe 2512 cleancarbon.io_hyber.exe 2512 cleancarbon.io_hyber.exe 2512 cleancarbon.io_hyber.exe 2512 cleancarbon.io_hyber.exe 2512 cleancarbon.io_hyber.exe 2512 cleancarbon.io_hyber.exe 2512 cleancarbon.io_hyber.exe 2512 cleancarbon.io_hyber.exe 2512 cleancarbon.io_hyber.exe 2512 cleancarbon.io_hyber.exe 2512 cleancarbon.io_hyber.exe 2512 cleancarbon.io_hyber.exe 2512 cleancarbon.io_hyber.exe 2512 cleancarbon.io_hyber.exe 2512 cleancarbon.io_hyber.exe 2512 cleancarbon.io_hyber.exe 2512 cleancarbon.io_hyber.exe 2512 cleancarbon.io_hyber.exe 2512 cleancarbon.io_hyber.exe 2512 cleancarbon.io_hyber.exe 2512 cleancarbon.io_hyber.exe 2512 cleancarbon.io_hyber.exe 2512 cleancarbon.io_hyber.exe 2512 cleancarbon.io_hyber.exe 2512 cleancarbon.io_hyber.exe 2512 cleancarbon.io_hyber.exe 2512 cleancarbon.io_hyber.exe 2512 cleancarbon.io_hyber.exe 2512 cleancarbon.io_hyber.exe 2512 cleancarbon.io_hyber.exe 2512 cleancarbon.io_hyber.exe 2512 cleancarbon.io_hyber.exe 2512 cleancarbon.io_hyber.exe 2512 cleancarbon.io_hyber.exe 2512 cleancarbon.io_hyber.exe 2512 cleancarbon.io_hyber.exe 2512 cleancarbon.io_hyber.exe 2512 cleancarbon.io_hyber.exe 2512 cleancarbon.io_hyber.exe 2512 cleancarbon.io_hyber.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 2208 LogonUI.exe Token: SeCreatePagefilePrivilege 2208 LogonUI.exe Token: SeDebugPrivilege 2512 cleancarbon.io_hyber.exe Token: SeDebugPrivilege 2104 powershell.exe Token: SeIncBasePriorityPrivilege 2512 cleancarbon.io_hyber.exe Token: SeDebugPrivilege 5116 whoami.exe Token: SeDebugPrivilege 2336 NETSTAT.EXE Token: SeDebugPrivilege 816 tasklist.exe Token: SeBackupPrivilege 3356 vssvc.exe Token: SeRestorePrivilege 3356 vssvc.exe Token: SeAuditPrivilege 3356 vssvc.exe Token: SeIncreaseQuotaPrivilege 4732 WMIC.exe Token: SeSecurityPrivilege 4732 WMIC.exe Token: SeTakeOwnershipPrivilege 4732 WMIC.exe Token: SeLoadDriverPrivilege 4732 WMIC.exe Token: SeSystemProfilePrivilege 4732 WMIC.exe Token: SeSystemtimePrivilege 4732 WMIC.exe Token: SeProfSingleProcessPrivilege 4732 WMIC.exe Token: SeIncBasePriorityPrivilege 4732 WMIC.exe Token: SeCreatePagefilePrivilege 4732 WMIC.exe Token: SeBackupPrivilege 4732 WMIC.exe Token: SeRestorePrivilege 4732 WMIC.exe Token: SeShutdownPrivilege 4732 WMIC.exe Token: SeDebugPrivilege 4732 WMIC.exe Token: SeSystemEnvironmentPrivilege 4732 WMIC.exe Token: SeRemoteShutdownPrivilege 4732 WMIC.exe Token: SeUndockPrivilege 4732 WMIC.exe Token: SeManageVolumePrivilege 4732 WMIC.exe Token: 33 4732 WMIC.exe Token: 34 4732 WMIC.exe Token: 35 4732 WMIC.exe Token: 36 4732 WMIC.exe Token: SeIncreaseQuotaPrivilege 4732 WMIC.exe Token: SeSecurityPrivilege 4732 WMIC.exe Token: SeTakeOwnershipPrivilege 4732 WMIC.exe Token: SeLoadDriverPrivilege 4732 WMIC.exe Token: SeSystemProfilePrivilege 4732 WMIC.exe Token: SeSystemtimePrivilege 4732 WMIC.exe Token: SeProfSingleProcessPrivilege 4732 WMIC.exe Token: SeIncBasePriorityPrivilege 4732 WMIC.exe Token: SeCreatePagefilePrivilege 4732 WMIC.exe Token: SeBackupPrivilege 4732 WMIC.exe Token: SeRestorePrivilege 4732 WMIC.exe Token: SeShutdownPrivilege 4732 WMIC.exe Token: SeDebugPrivilege 4732 WMIC.exe Token: SeSystemEnvironmentPrivilege 4732 WMIC.exe Token: SeRemoteShutdownPrivilege 4732 WMIC.exe Token: SeUndockPrivilege 4732 WMIC.exe Token: SeManageVolumePrivilege 4732 WMIC.exe Token: 33 4732 WMIC.exe Token: 34 4732 WMIC.exe Token: 35 4732 WMIC.exe Token: 36 4732 WMIC.exe Token: SeIncreaseQuotaPrivilege 4248 WMIC.exe Token: SeSecurityPrivilege 4248 WMIC.exe Token: SeTakeOwnershipPrivilege 4248 WMIC.exe Token: SeLoadDriverPrivilege 4248 WMIC.exe Token: SeSystemProfilePrivilege 4248 WMIC.exe Token: SeSystemtimePrivilege 4248 WMIC.exe Token: SeProfSingleProcessPrivilege 4248 WMIC.exe Token: SeIncBasePriorityPrivilege 4248 WMIC.exe Token: SeCreatePagefilePrivilege 4248 WMIC.exe Token: SeBackupPrivilege 4248 WMIC.exe Token: SeRestorePrivilege 4248 WMIC.exe - Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2512 cleancarbon.io_hyber.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2208 LogonUI.exe 2512 cleancarbon.io_hyber.exe - Suspicious use of WriteProcessMemory 39 IoCs
description pid Process procid_target PID 2512 wrote to memory of 2104 2512 cleancarbon.io_hyber.exe 87 PID 2512 wrote to memory of 1780 2512 cleancarbon.io_hyber.exe 108 PID 2512 wrote to memory of 3276 2512 cleancarbon.io_hyber.exe 91 PID 2512 wrote to memory of 4144 2512 cleancarbon.io_hyber.exe 93 PID 2512 wrote to memory of 4596 2512 cleancarbon.io_hyber.exe 106 PID 2512 wrote to memory of 1896 2512 cleancarbon.io_hyber.exe 97 PID 2512 wrote to memory of 3112 2512 cleancarbon.io_hyber.exe 99 PID 2512 wrote to memory of 688 2512 cleancarbon.io_hyber.exe 101 PID 2512 wrote to memory of 5080 2512 cleancarbon.io_hyber.exe 103 PID 2512 wrote to memory of 3712 2512 cleancarbon.io_hyber.exe 104 PID 3712 wrote to memory of 4596 3712 fodhelper.exe 106 PID 2512 wrote to memory of 1780 2512 cleancarbon.io_hyber.exe 108 PID 2512 wrote to memory of 2264 2512 cleancarbon.io_hyber.exe 109 PID 2512 wrote to memory of 228 2512 cleancarbon.io_hyber.exe 115 PID 2512 wrote to memory of 208 2512 cleancarbon.io_hyber.exe 117 PID 2512 wrote to memory of 4972 2512 cleancarbon.io_hyber.exe 118 PID 2512 wrote to memory of 3636 2512 cleancarbon.io_hyber.exe 119 PID 2512 wrote to memory of 3168 2512 cleancarbon.io_hyber.exe 120 PID 2512 wrote to memory of 5048 2512 cleancarbon.io_hyber.exe 121 PID 2512 wrote to memory of 3500 2512 cleancarbon.io_hyber.exe 122 PID 2512 wrote to memory of 3760 2512 cleancarbon.io_hyber.exe 129 PID 2512 wrote to memory of 3036 2512 cleancarbon.io_hyber.exe 130 PID 3168 wrote to memory of 456 3168 cmd.exe 132 PID 208 wrote to memory of 436 208 cmd.exe 133 PID 3636 wrote to memory of 5116 3636 cmd.exe 134 PID 3500 wrote to memory of 2336 3500 cmd.exe 135 PID 456 wrote to memory of 4172 456 net.exe 136 PID 4972 wrote to memory of 816 4972 cmd.exe 137 PID 5048 wrote to memory of 4740 5048 cmd.exe 138 PID 2512 wrote to memory of 4480 2512 cleancarbon.io_hyber.exe 139 PID 228 wrote to memory of 2204 228 cmd.exe 140 PID 2512 wrote to memory of 4488 2512 cleancarbon.io_hyber.exe 143 PID 2512 wrote to memory of 4732 2512 cleancarbon.io_hyber.exe 144 PID 2512 wrote to memory of 3796 2512 cleancarbon.io_hyber.exe 145 PID 2512 wrote to memory of 3464 2512 cleancarbon.io_hyber.exe 149 PID 2512 wrote to memory of 2800 2512 cleancarbon.io_hyber.exe 150 PID 2512 wrote to memory of 4484 2512 cleancarbon.io_hyber.exe 151 PID 3796 wrote to memory of 2860 3796 net.exe 155 PID 228 wrote to memory of 4248 228 cmd.exe 157 - Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
- Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\cleancarbon.io_hyber.exe"C:\Users\Admin\AppData\Local\Temp\cleancarbon.io_hyber.exe"1⤵
- Modifies Windows Defender DisableAntiSpyware settings
- Disables RegEdit via registry modification
- Drops file in Drivers directory
- Checks computer location settings
- Creates a file in the Startup directory
- Adds Run key to start application
- Drops file in System32 directory
- Sets desktop wallpaper using registry
- Reads the TCP/IP host and domain name from the registry
- Modifies Control Panel
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2512 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoP -NonI -W Hidden -Exec Bypass -Enc UwBlAHQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARABpAHMAYQBiAGwAZQBSAGUAYQBsAHQAaQBtAGUATQBvAG4AaQB0AG8AcgBpAG4AZwAgACQAdAByAHUAZQA7ACAAUwBlAHQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARABpAHMAYQBiAGwAZQBCAGUAaABhAHYAaQBvAHIATQBvAG4AaQB0AG8AcgBpAG4AZwAgACQAdAByAHUAZQA=2⤵
- Command and Scripting Interpreter: PowerShell
- Enumerates connected drives
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2104
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" stop wscsvc2⤵
- Launches sc.exe
PID:1780
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" config wscsvc start= disabled2⤵
- Launches sc.exe
PID:3276
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" stop SecurityHealthService2⤵
- Launches sc.exe
PID:4144
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" config SecurityHealthService start= disabled2⤵
- Launches sc.exe
PID:4596
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" stop WinDefend2⤵
- Launches sc.exe
PID:1896
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" config WinDefend start= disabled2⤵
- Launches sc.exe
PID:3112
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" stop MsMpSvc2⤵
- Launches sc.exe
PID:688
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" config MsMpSvc start= disabled2⤵
- Launches sc.exe
PID:5080
-
-
C:\Windows\System32\fodhelper.exe"C:\Windows\System32\fodhelper.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:3712 -
C:\Users\Admin\AppData\Local\Temp\cleancarbon.io_hyber.exe"C:\Users\Admin\AppData\Local\Temp\cleancarbon.io_hyber.exe"3⤵PID:4596
-
-
-
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" C:\Users\Admin\AppData\Local\Temp\makelnk.vbs2⤵
- Executes a VBScript file via the Windows Script Host.
PID:1780
-
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks" /create /tn "SysUpdateTask" /tr "C:\Users\Admin\AppData\Local\Temp\cleancarbon.io_hyber.exe" /sc onlogon /f2⤵
- Scheduled Task/Job: Scheduled Task
PID:2264
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\del.bat" "2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:228 -
C:\Windows\system32\vssadmin.exevssadmin delete shadows /all /quiet3⤵
- Interacts with shadow copies
PID:2204
-
-
C:\Windows\System32\Wbem\WMIC.exewmic shadowcopy delete3⤵
- Reads the TCP/IP host and domain name from the registry
- Suspicious use of AdjustPrivilegeToken
PID:4248
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c systeminfo > "C:\ProgramData\SysUpdate\Logs\sysinfo.txt"2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:208 -
C:\Windows\system32\systeminfo.exesysteminfo3⤵
- Gathers system information
PID:436
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c tasklist > "C:\ProgramData\SysUpdate\Logs\tasklist.txt"2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4972 -
C:\Windows\system32\tasklist.exetasklist3⤵
- Discovers running processes
- Suspicious use of AdjustPrivilegeToken
PID:816
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c whoami > "C:\ProgramData\SysUpdate\Logs\whoami.txt"2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:3636 -
C:\Windows\system32\whoami.exewhoami3⤵
- Suspicious use of AdjustPrivilegeToken
PID:5116
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c net user > "C:\ProgramData\SysUpdate\Logs\netuser.txt"2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:3168 -
C:\Windows\system32\net.exenet user3⤵
- Suspicious use of WriteProcessMemory
PID:456 -
C:\Windows\system32\net1.exeC:\Windows\system32\net1 user4⤵PID:4172
-
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c ipconfig /all > "C:\ProgramData\SysUpdate\Logs\ipconfig.txt"2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5048 -
C:\Windows\system32\ipconfig.exeipconfig /all3⤵
- Gathers network information
PID:4740
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c netstat -an > "C:\ProgramData\SysUpdate\Logs\netstat.txt"2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:3500 -
C:\Windows\system32\NETSTAT.EXEnetstat -an3⤵
- Gathers network information
- Suspicious use of AdjustPrivilegeToken
PID:2336
-
-
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks" /create /tn "RansomwareCheck" /tr "C:\Users\Admin\AppData\Local\Temp\cleancarbon.io_hyber.exe" /sc daily /f2⤵
- Scheduled Task/Job: Scheduled Task
PID:3760
-
-
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" C:\Users\Admin\AppData\Local\Temp\createshortcut.vbs2⤵
- Executes a VBScript file via the Windows Script Host.
PID:3036
-
-
C:\Windows\System32\notepad.exe"C:\Windows\System32\notepad.exe"2⤵PID:4480
-
-
C:\Windows\System32\vssadmin.exe"C:\Windows\System32\vssadmin.exe" delete shadows /all /quiet2⤵
- Interacts with shadow copies
PID:4488
-
-
C:\Windows\System32\wbem\WMIC.exe"C:\Windows\System32\wbem\WMIC.exe" shadowcopy delete2⤵
- Reads the TCP/IP host and domain name from the registry
- Suspicious use of AdjustPrivilegeToken
PID:4732
-
-
C:\Windows\System32\net.exe"C:\Windows\System32\net.exe" stop srservice2⤵
- Suspicious use of WriteProcessMemory
PID:3796 -
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop srservice3⤵PID:2860
-
-
-
C:\Windows\System32\netsh.exe"C:\Windows\System32\netsh.exe" advfirewall set allprofiles state off2⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
PID:3464
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" config i8042prt start= disabled2⤵
- Launches sc.exe
PID:2800
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" stop i8042prt2⤵
- Launches sc.exe
PID:4484
-
-
C:\Windows\system32\LogonUI.exe"LogonUI.exe" /flags:0x0 /state0:0xa3960055 /state1:0x41c64e6d1⤵
- Drops desktop.ini file(s)
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:2208
-
C:\Users\Admin\AppData\Local\Temp\cleancarbon.io_hyber.exeC:\Users\Admin\AppData\Local\Temp\cleancarbon.io_hyber.exe1⤵PID:1160
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3356
Network
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
4PowerShell
1Visual Basic
1Windows Command Shell
1Scheduled Task/Job
1Scheduled Task
1System Services
2Service Execution
2Windows Management Instrumentation
1Persistence
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
2Create or Modify System Process
4Windows Service
4Event Triggered Execution
1Netsh Helper DLL
1Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
2Create or Modify System Process
4Windows Service
4Event Triggered Execution
1Netsh Helper DLL
1Scheduled Task/Job
1Scheduled Task
1Defense Evasion
Direct Volume Access
1Impair Defenses
3Disable or Modify System Firewall
1Disable or Modify Tools
1Indicator Removal
2File Deletion
2Modify Registry
3Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\ProgramData\Microsoft\Windows\SystemData\S-1-5-21-524788801-3318743092-4051225893-1000\ReadOnly\LockScreen_O\~ockScreen___1920_1080_notdimmed.tmp
- Size 754KB
- SHA256 c356fbbda4339ee694a685e1451bdb4a1f641e7a0c7df368496388497bd4fb6a
- MD5 de3d507ca415cbb3f6c58c0448c4429c
- SHA1 93eee9d1b665ebc57d0d746f160eb4a3dbc7a614
- SHA512 d068d85b6645bebd732221b3f098307221a531b0b80941f59b8d2f47929f55997b2b849e32222ff08d18f22a406ce0eadb6f8e75094ece9523a0730bc6c49bfa
- SSDEEP 12288:1aY8Km4kLi6cdu6bJpT3ec5IIHUM/qYwVtANjexiOCkylcbEnafo/dHT:8Ydmd7cdu6bJpT3eAICqpXANKAC40uZT
- TLSH T1AEF4238947A077EDE7B4FD890FCC03872D9E63F16A46A640B1B61909CA710F377641AB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\SystemVolumeInformation\doc_2.pdf
- Size 66KB
- SHA256 b37cb34b9d5dd45d37489e1e1c67d1fa55a386161615827d659ca9f68a125296
- MD5 dc6288f9b928ff7b330b7d05fb2c5fe5
- SHA1 ba376e347e9749073be7b995487eebfa906c8cf1
- SHA512 bb6d1dff6b3a9d86af20697fec92f627f6c4c65511b9ee62f6333617b81030bd9d8334a7c39caa8513c90cf7c53ab74df2b9be86736210ad4eb8044348dc4d3a
- SSDEEP 1536:s2Rveo0zwn1+7cRMa3EJp885FR8v8A0XtKkcON/EbczBcxhCBJA8ezply9ueJzR5:sgvQzwnA81EgsFRa10XtKkcONOczBcxM
- TLSH T18B633B378B27FCD1677F3E80F05429920C84396747B1A668FBC509A93CA5684EF2D998
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\cleancarbon.io_hyber.exe.log
- Size 660B
- SHA256 f424c891fbc7385e9826beed2dd8755aeac5495744b5de0a1e370891a7beaf7a
- MD5 1c5e1d0ff3381486370760b0f2eb656b
- SHA1 f9df6be8804ef611063f1ff277e323b1215372de
- SHA512 78f5fc40a185d04c9e4a02a3d1b10b4bd684c579a45a0d1e8f49f8dee9018ed7bc8875cbf21f98632f93ead667214a41904226ce54817b85caeeb4b0de54a743
- TLSH T1CF014970227BA0D888152F942C2E2BC403BF0336B5509E187998729EEE264571F212E6
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_vyhvlky4.tga.ps1
- Size 60B
- SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
- MD5 d17fe0a3f47be24a6453e9ef58c94641
- SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
- SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
- TLSH T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\createshortcut.vbs
- Size 245B
- SHA256 49ee5dfb783f23627367a1cdcf173d43787bf78770432e414870dd3c6bedba46
- MD5 3017754c203ab6bfe6b211bb5ad59395
- SHA1 8d30f39a4e40eb79c48694fa2d45d745c0a51c65
- SHA512 0786839ef8b26b848f1e35e8c2019558dfeae69f5e6aca2bdba36f23e4a00ad007d800d7c1e946b884eefadead9dc2dcb2501150da7edcbd2a508106b517cfd8
- TLSH T1F7D0A78BF14DC6A90011523B81F3CE8DEAB548693B57BF704AA5DD4E32908C58AF6543
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\del.bat
- Size 59B
- SHA256 a51f2a0f053ac35b4158bb02b75421ab3698e1d0ee4f926abf1bae3af1570c53
- MD5 9cecbebdcdd60358132849714a3b82f7
- SHA1 be6e20834a5726f3742f05e6bdfaff16118b147f
- SHA512 7b48bd66b4c741d2de2e8b7bc0eab8f438ddc1ed0c73e8b70add9bee400f6640f692884965032616e2d6911a22a17d1d3762421aa49fe021660c9052cfc0675a
- TLSH T13DA002620F961E5469529E5AD73425239D1F104CD1390012F05232903DA98DE0EC2144
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\makelnk.vbs
- Size 246B
- SHA256 096ecb08fefd0090ecb5de5a661e7346257da9c8dee7fd07162cc7509f26a6f1
- MD5 898a576a0d0262b3a7beceecbc66e449
- SHA1 099fcf69893941f0ed052d83fcd5e502e1370316
- SHA512 79e7e88f90f47b91ee58e75e9cecbb3219b735ee7b740eb2d18e3274c30b082dd2c3fed4e59560291b53944d374b780c77eb342f6d452f112abfb33464480352
- TLSH T1B6D0A78BF14DC6A90011523B80F3CE8DEAE248693B57BF709AA5DD0E32808858AF6543
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\Documents\invoice_1.pdf
- Size 66KB
- SHA256 3e4766a1d499c461c947fa5ff82a22c1673ef73ea9fbd3262e3704c779634acc
- MD5 f95d2a502c493f5cb2453290f918edeb
- SHA1 be8039258045629f26faf0f51a71e5b98296a938
- SHA512 f12500226e8bdfbb20085ddee5d74cf8bdc9c9fe4b155d43eeb13db94d9a7d4a1508e03098bf741d686491d91122abf4e04790ce88bd7a84541d4d3458404ae5
- SSDEEP 1536:M2Rveo0zwn1+7cRMa3EJp885FR8v8A0XtKkcON/EbczBcxhCBJA8ezply9ueJzR+:MgvQzwnA81EgsFRa10XtKkcONOczBcxt
- TLSH T101634B378B27FCC5677F3E80F05439920C84396747B1A668FBC5099938A56C4EF2D998
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\sysupdate.exe
- Size 49KB
- SHA256 db0dc054faac8835c15ab85dff86d882b7feacfdf17c28ba0063d8a70701e1f0
- MD5 758fb781398a2863027ac21842d09def
- SHA1 af1a61e03c360d8da28ee1e6232edda844fe5022
- SHA512 908cf03b2015ac028634e9889f309e5c74a7b029378cba9746dde4135d474006d960668e73f24ff03c466098d1c043502fa239fa861938c2f5794a86110ac2ec
- SSDEEP 384:tFrb51vIFF66z9S0huAozGYKg+9wFfYjid2+0xNcKKKKmI2hM6ZRSb7RQH9iUXFt:PrVZZ6zs0hjh17XqQ/NaPzfX/fXJ4R
- TLSH T15633F64937FD4522E1BF9ABE49B290119731F453DC23DB8E1AD8459E09F37008DA8B6B
- MD5 SHA1 SHA512 SSDEEP TLSH