Overview
overview
10Static
static
5! SETUP.bat
windows10-2004-x64
10! SETUP.bat
windows11-ltsc_2024-x64
7Cyber.exe
windows10-2004-x64
1Cyber.exe
windows11-ltsc_2024-x64
1sslconf.exe
windows10-2004-x64
10sslconf.exe
windows11-ltsc_2024-x64
6tempdir.dll
windows10-2004-x64
7tempdir.dll
windows11-ltsc_2024-x64
7vcruntime140.dll
windows10-2004-x64
1vcruntime140.dll
windows11-ltsc_2024-x64
1Analysis
- max time kernel
149s - max time network
146s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
20/10/2026, 22:59
Behavioral task
behavioral1
Sample
! SETUP.bat
Resource
win10v2004-20260911-en
windows10-2004-x64
16 signatures
150 seconds
Behavioral task
behavioral2
Sample
! SETUP.bat
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
12 signatures
150 seconds
Behavioral task
behavioral3
Sample
Cyber.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral4
Sample
Cyber.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
Behavioral task
behavioral5
Sample
sslconf.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
15 signatures
150 seconds
Behavioral task
behavioral6
Sample
sslconf.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
13 signatures
150 seconds
Behavioral task
behavioral7
Sample
tempdir.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
6 signatures
150 seconds
Behavioral task
behavioral8
Sample
tempdir.dll
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
7 signatures
150 seconds
Behavioral task
behavioral9
Sample
vcruntime140.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral10
Sample
vcruntime140.dll
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
General
- Target ! SETUP.bat
- Size 3KB
- Sample261020-2yctvsys4p
- SHA256 066d5d62e1ed8bcea4de4394ebe4b050fbb705e21e15b15e849c2705eade7f72
- MD5 9a41445e799e55b272c82f43fa520a2c
- SHA1 c4a6a57a9771822197edb24afe2f3c14b7185eda
- SHA512 5f8d92c0b3cb0f500a90c134ca4a34e3a13b1f070d540b059128bd8d058e34d7b23df64e0d2305437a1e38429e4c2ab50840522037007183d7e5217d73a47172
- TLSH T1936134327C18A73106B8CE104976FD19F35961DB82354950F1EE92E0AF707C9AEBD9C5
- MD5 SHA1 SHA512 TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
pid Process 3576 sslconf.exe - Loads dropped DLL 2 IoCs
pid Process 3576 sslconf.exe 3576 sslconf.exe - Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\LightGoldenRodYellowLightCoral = "\"C:\\Windows\\System32\\cmd.exe\" /c cd /d \"C:\\ProgramData\\TomatoMistyRose\" && \"C:\\Windows\\System32\\wscript.exe\" \"C:\\ProgramData\\TomatoMistyRose\\LightGoldenRodYellowLightCoral.js\" //B //Nologo" sslconf.exe - Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 3576 set thread context of 4840 3576 sslconf.exe 100 -
resource yara_rule behavioral2/memory/1996-15-0x00007FFA12160000-0x00007FFA12887000-memory.dmp upx behavioral2/memory/1996-19-0x00007FFA12160000-0x00007FFA12887000-memory.dmp upx behavioral2/files/0x000d00000001c5a3-21.dat upx behavioral2/memory/3576-22-0x00007FFA12160000-0x00007FFA12887000-memory.dmp upx behavioral2/memory/3576-40-0x00007FFA12160000-0x00007FFA12887000-memory.dmp upx behavioral2/memory/3576-57-0x00007FFA12160000-0x00007FFA12887000-memory.dmp upx - Command and Scripting Interpreter: JavaScript 1 TTPs
- Executes a command shell one-liner 1 TTPs 2 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 300 cmd.exe 4692 cmd.exe - Checks SCSI registry key(s) 3 TTPs 12 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName sslconf.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID sslconf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000 sslconf.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID sslconf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000 sslconf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000 sslconf.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName sslconf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000 sslconf.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\HardwareID sslconf.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName sslconf.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName sslconf.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\HardwareID sslconf.exe - Checks processor information in registry 2 TTPs 4 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 sslconf.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString sslconf.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 sslconf.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString sslconf.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1996 sslconf.exe 1996 sslconf.exe 1996 sslconf.exe 1996 sslconf.exe 1996 sslconf.exe 1996 sslconf.exe 1996 sslconf.exe 1996 sslconf.exe 1996 sslconf.exe 1996 sslconf.exe 1996 sslconf.exe 1996 sslconf.exe 1996 sslconf.exe 1996 sslconf.exe 1996 sslconf.exe 1996 sslconf.exe 1996 sslconf.exe 1996 sslconf.exe 1996 sslconf.exe 1996 sslconf.exe 1996 sslconf.exe 1996 sslconf.exe 1996 sslconf.exe 1996 sslconf.exe 1996 sslconf.exe 1996 sslconf.exe 1996 sslconf.exe 1996 sslconf.exe 1996 sslconf.exe 1996 sslconf.exe 3576 sslconf.exe 3576 sslconf.exe 3576 sslconf.exe 3576 sslconf.exe 3576 sslconf.exe 3576 sslconf.exe 3576 sslconf.exe 3576 sslconf.exe 3576 sslconf.exe 3576 sslconf.exe 3576 sslconf.exe 3576 sslconf.exe 3576 sslconf.exe 3576 sslconf.exe 3576 sslconf.exe 3576 sslconf.exe 3576 sslconf.exe 3576 sslconf.exe 3576 sslconf.exe 3576 sslconf.exe 3576 sslconf.exe 3576 sslconf.exe 3576 sslconf.exe 3576 sslconf.exe 3576 sslconf.exe 3576 sslconf.exe 3576 sslconf.exe 3576 sslconf.exe 3576 sslconf.exe 3576 sslconf.exe 3576 sslconf.exe 3576 sslconf.exe 3576 sslconf.exe 3576 sslconf.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 1996 sslconf.exe Token: SeDebugPrivilege 1996 sslconf.exe Token: SeDebugPrivilege 1996 sslconf.exe Token: SeDebugPrivilege 1996 sslconf.exe Token: SeDebugPrivilege 1996 sslconf.exe Token: SeDebugPrivilege 1996 sslconf.exe Token: SeDebugPrivilege 1996 sslconf.exe Token: SeDebugPrivilege 1996 sslconf.exe Token: SeDebugPrivilege 1996 sslconf.exe Token: SeDebugPrivilege 1996 sslconf.exe Token: SeDebugPrivilege 1996 sslconf.exe Token: SeDebugPrivilege 1996 sslconf.exe Token: SeDebugPrivilege 1996 sslconf.exe Token: SeDebugPrivilege 1996 sslconf.exe Token: SeDebugPrivilege 1996 sslconf.exe Token: SeDebugPrivilege 1996 sslconf.exe Token: SeDebugPrivilege 1996 sslconf.exe Token: SeDebugPrivilege 1996 sslconf.exe Token: SeDebugPrivilege 1996 sslconf.exe Token: SeDebugPrivilege 1996 sslconf.exe Token: SeDebugPrivilege 1996 sslconf.exe Token: SeDebugPrivilege 1996 sslconf.exe Token: SeDebugPrivilege 1996 sslconf.exe Token: SeDebugPrivilege 1996 sslconf.exe Token: SeDebugPrivilege 1996 sslconf.exe Token: SeDebugPrivilege 1996 sslconf.exe Token: SeDebugPrivilege 1996 sslconf.exe Token: SeDebugPrivilege 1996 sslconf.exe Token: SeDebugPrivilege 1996 sslconf.exe Token: SeDebugPrivilege 1996 sslconf.exe Token: SeDebugPrivilege 1996 sslconf.exe Token: SeDebugPrivilege 1996 sslconf.exe Token: SeDebugPrivilege 1996 sslconf.exe Token: SeDebugPrivilege 1996 sslconf.exe Token: SeDebugPrivilege 1996 sslconf.exe Token: SeDebugPrivilege 1996 sslconf.exe Token: SeDebugPrivilege 1996 sslconf.exe Token: SeDebugPrivilege 1996 sslconf.exe Token: SeDebugPrivilege 1996 sslconf.exe Token: SeDebugPrivilege 1996 sslconf.exe Token: SeDebugPrivilege 1996 sslconf.exe Token: SeDebugPrivilege 1996 sslconf.exe Token: SeDebugPrivilege 1996 sslconf.exe Token: SeDebugPrivilege 1996 sslconf.exe Token: SeDebugPrivilege 1996 sslconf.exe Token: SeDebugPrivilege 1996 sslconf.exe Token: SeDebugPrivilege 1996 sslconf.exe Token: SeDebugPrivilege 1996 sslconf.exe Token: SeDebugPrivilege 1996 sslconf.exe Token: SeDebugPrivilege 1996 sslconf.exe Token: SeDebugPrivilege 1996 sslconf.exe Token: SeDebugPrivilege 1996 sslconf.exe Token: SeDebugPrivilege 1996 sslconf.exe Token: SeDebugPrivilege 1996 sslconf.exe Token: SeDebugPrivilege 1996 sslconf.exe Token: SeDebugPrivilege 1996 sslconf.exe Token: SeDebugPrivilege 1996 sslconf.exe Token: SeDebugPrivilege 1996 sslconf.exe Token: SeDebugPrivilege 1996 sslconf.exe Token: SeDebugPrivilege 1996 sslconf.exe Token: SeDebugPrivilege 1996 sslconf.exe Token: SeDebugPrivilege 1996 sslconf.exe Token: SeDebugPrivilege 1996 sslconf.exe Token: SeDebugPrivilege 1996 sslconf.exe - Suspicious use of WriteProcessMemory 13 IoCs
description pid Process procid_target PID 300 wrote to memory of 2604 300 cmd.exe 90 PID 300 wrote to memory of 4688 300 cmd.exe 91 PID 300 wrote to memory of 1996 300 cmd.exe 92 PID 300 wrote to memory of 1392 300 cmd.exe 94 PID 1996 wrote to memory of 3576 1996 sslconf.exe 95 PID 3576 wrote to memory of 4840 3576 sslconf.exe 100 PID 3576 wrote to memory of 4840 3576 sslconf.exe 100 PID 3576 wrote to memory of 4840 3576 sslconf.exe 100 PID 3576 wrote to memory of 4840 3576 sslconf.exe 100 PID 3576 wrote to memory of 4840 3576 sslconf.exe 100 PID 3576 wrote to memory of 4840 3576 sslconf.exe 100 PID 3576 wrote to memory of 4840 3576 sslconf.exe 100 PID 3576 wrote to memory of 4840 3576 sslconf.exe 100
Processes
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\! SETUP.bat"1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:300 -
C:\Windows\system32\mode.commode con: cols=72 lines=242⤵PID:2604
-
-
C:\Windows\system32\cacls.exe"C:\Windows\system32\cacls.exe" "C:\Windows\system32\config\system"2⤵PID:4688
-
-
C:\Users\Admin\AppData\Local\Temp\sslconf.exesslconf.exe2⤵
- Checks SCSI registry key(s)
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1996 -
C:\ProgramData\TomatoMistyRose\sslconf.exe"C:\ProgramData\TomatoMistyRose\sslconf.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Checks SCSI registry key(s)
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3576 -
C:\Windows\helpPane.exe"C:\Windows\helpPane.exe"4⤵PID:4840
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Cyber.execyber.exe2⤵PID:1392
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c cd /d "C:\ProgramData\TomatoMistyRose"1⤵
- Executes a command shell one-liner
PID:4692
-
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" "C:\ProgramData\TomatoMistyRose\LightGoldenRodYellowLightCoral.js" //B //Nologo1⤵PID:5732
Network
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
2JavaScript
1Windows Command Shell
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\ProgramData\TomatoMistyRose\LightGoldenRodYellowLightCoral.js
- Size 70B
- SHA256 a9ff5d2faeb2316bf5b57a2a7abf65b1cf17bc48f8009558016426c91dd6893a
- MD5 d6c662b8b605e325c2ef0a80d0de6119
- SHA1 2f592d5d35b6fa8a1ba6b2e63c348a4e69e9a660
- SHA512 923692a14346f755561649c4d113fb266fef2603365c5b77f1fd224d0d9630cfeb1ec48b36294f5e0b9e6bc8dff070b07d2181e7bbc09e7a3322c90c88164909
- TLSH T19DA0220028BCF88C8283C3FA0000E30A0AC38CC23002B8280000CBECFB28000028888B
- MD5 SHA1 SHA512 TLSH
- Path C:\ProgramData\TomatoMistyRose\sslconf.exe
- Size 29KB
- SHA256 fd826215add30c1319eefa291b6eaf8ddfa7720cfe816c49aef6fe8a88de7939
- MD5 71fdd6fb7f0acd3e9a6206851452e11b
- SHA1 82011a9ff3692236df69427eb200ba05799205b0
- SHA512 f3648fc671e5300b386fb4412fb015144bd6d2d5e919aece6eeb6247889ace6fb4ecd04386f271f0978ea2072501122ae0b5f77695709aac1748e4ae5c3439cc
- SSDEEP 384:51FiQ200ruE3ae6GIlp3HQIYiB53y1ny8RbmL4nNytn:piPuE3aplB5Yi05AL3
- TLSH T15BD26C47DB911CC6D937CE31A4F11A2AE672755107B1C2EB1328825A4FA27817E7D3EC
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\TomatoMistyRose\tempdir.dll
- Size 10.5MB
- SHA256 ddd6e694ebfec6022ee6312ada1aca7d75f33d1d44fa6a788f0cefbf9767b585
- MD5 b58125e3f39c7a5de88ba48c9ca5f452
- SHA1 80eb5314a7fc807b49a5f82769456f7297737ebe
- SHA512 bdbc4fc524a0092fceed4e6de5f5824d1ceaa87a08edf48bbecf5e877d55f9efbf71084dce2ef91e5542fd35b35043a8f1c6176e7a7d40a0c101b65440199846
- SSDEEP 196608:DAOqMQKTuV/iveYmJFKsXItEdtw6Iu5Zq3vwk9RPFvG:DA/KyEaKsXTk/3Yk9RPpG
- TLSH T116B633E720E6D1F0CB092E3A4E5CA945DD310B48E9A4654B1F19E01FC729663C3F6A6F
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\TomatoMistyRose\vcruntime140.dll
- Size 130KB
- SHA256 a5437c6e669b83b5ae336cdddb79fed6425408f3f72ee367441986495e3e56fd
- MD5 6a969b545789b0be2178d2d79ca603fc
- SHA1 ecc0dcea5f747007eed5621c54f6d03564cde9fd
- SHA512 8c4a40e7e3ebe7ecfa7b92686428779f99fd7cabafb1bd3f331bbda67edfb36654ce03324f38975a8713ef5ad9d4ad474f1fdd8f06b8bef8cbc5a0306b6a6b1a
- SSDEEP 1536:Z9pCUgtBAVcxStMXcfG8VwfmpcGLOI5Sv+vecbeQ6N7lngAezG/yLzt7nD:9yA+3EOfmpcGSdOecbeQ6NxnQ+sBn
- TLSH T104D38B4272B801FBC56BD1708292EE27FBB6F50687609BDB07AA86650F537D06D3C385
- MD5 SHA1 SHA512 SSDEEP TLSH