Overview
overview
10Static
static
5! SETUP.bat
windows10-2004-x64
10! SETUP.bat
windows11-ltsc_2024-x64
7Cyber.exe
windows10-2004-x64
1Cyber.exe
windows11-ltsc_2024-x64
1sslconf.exe
windows10-2004-x64
10sslconf.exe
windows11-ltsc_2024-x64
6tempdir.dll
windows10-2004-x64
7tempdir.dll
windows11-ltsc_2024-x64
7vcruntime140.dll
windows10-2004-x64
1vcruntime140.dll
windows11-ltsc_2024-x64
1Analysis
- max time kernel
148s - max time network
112s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
20/10/2026, 22:59
Behavioral task
behavioral1
Sample
! SETUP.bat
Resource
win10v2004-20260911-en
windows10-2004-x64
16 signatures
150 seconds
Behavioral task
behavioral2
Sample
! SETUP.bat
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
12 signatures
150 seconds
Behavioral task
behavioral3
Sample
Cyber.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral4
Sample
Cyber.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
Behavioral task
behavioral5
Sample
sslconf.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
15 signatures
150 seconds
Behavioral task
behavioral6
Sample
sslconf.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
13 signatures
150 seconds
Behavioral task
behavioral7
Sample
tempdir.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
6 signatures
150 seconds
Behavioral task
behavioral8
Sample
tempdir.dll
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
7 signatures
150 seconds
Behavioral task
behavioral9
Sample
vcruntime140.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral10
Sample
vcruntime140.dll
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
General
- Target sslconf.exe
- Size 29KB
- Sample261020-2yctvsys4p
- SHA256 fd826215add30c1319eefa291b6eaf8ddfa7720cfe816c49aef6fe8a88de7939
- MD5 71fdd6fb7f0acd3e9a6206851452e11b
- SHA1 82011a9ff3692236df69427eb200ba05799205b0
- SHA512 f3648fc671e5300b386fb4412fb015144bd6d2d5e919aece6eeb6247889ace6fb4ecd04386f271f0978ea2072501122ae0b5f77695709aac1748e4ae5c3439cc
- SSDEEP 384:51FiQ200ruE3ae6GIlp3HQIYiB53y1ny8RbmL4nNytn:piPuE3aplB5Yi05AL3
- TLSH T15BD26C47DB911CC6D937CE31A4F11A2AE672755107B1C2EB1328825A4FA27817E7D3EC
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
6/10
Malware Config
Signatures
- Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\LightGoldenRodYellowLightCoral = "\"C:\\Windows\\System32\\cmd.exe\" /c cd /d \"C:\\ProgramData\\TomatoMistyRose\" && \"C:\\Windows\\System32\\wscript.exe\" \"C:\\ProgramData\\TomatoMistyRose\\LightGoldenRodYellowLightCoral.js\" //B //Nologo" sslconf.exe - Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 2200 set thread context of 4208 2200 sslconf.exe 94 -
resource yara_rule behavioral6/memory/5956-0-0x00007FFDCD8A0000-0x00007FFDCDFC7000-memory.dmp upx behavioral6/memory/5956-2-0x00007FFDCD8A0000-0x00007FFDCDFC7000-memory.dmp upx behavioral6/files/0x000d00000001c601-4.dat upx behavioral6/memory/2200-5-0x00007FFDCD8A0000-0x00007FFDCDFC7000-memory.dmp upx behavioral6/memory/2200-20-0x00007FFDCD8A0000-0x00007FFDCDFC7000-memory.dmp upx behavioral6/memory/2200-19-0x00007FFDCD8A0000-0x00007FFDCDFC7000-memory.dmp upx behavioral6/memory/2200-38-0x00007FFDCD8A0000-0x00007FFDCDFC7000-memory.dmp upx - Executes dropped EXE 1 IoCs
pid Process 2200 sslconf.exe - Loads dropped DLL 2 IoCs
pid Process 2200 sslconf.exe 2200 sslconf.exe - Command and Scripting Interpreter: JavaScript 1 TTPs
- Executes a command shell one-liner 1 TTPs 1 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 4852 cmd.exe - Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname sslconf.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain sslconf.exe - Checks SCSI registry key(s) 3 TTPs 12 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName sslconf.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName sslconf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000 sslconf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000 sslconf.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\HardwareID sslconf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000 sslconf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000 sslconf.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\HardwareID sslconf.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID sslconf.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName sslconf.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName sslconf.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID sslconf.exe - Checks processor information in registry 2 TTPs 4 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString sslconf.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 sslconf.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString sslconf.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 sslconf.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 5956 sslconf.exe 5956 sslconf.exe 5956 sslconf.exe 5956 sslconf.exe 5956 sslconf.exe 5956 sslconf.exe 5956 sslconf.exe 5956 sslconf.exe 5956 sslconf.exe 5956 sslconf.exe 5956 sslconf.exe 5956 sslconf.exe 5956 sslconf.exe 5956 sslconf.exe 5956 sslconf.exe 5956 sslconf.exe 5956 sslconf.exe 5956 sslconf.exe 5956 sslconf.exe 5956 sslconf.exe 5956 sslconf.exe 5956 sslconf.exe 5956 sslconf.exe 5956 sslconf.exe 5956 sslconf.exe 5956 sslconf.exe 5956 sslconf.exe 5956 sslconf.exe 5956 sslconf.exe 5956 sslconf.exe 2200 sslconf.exe 2200 sslconf.exe 2200 sslconf.exe 2200 sslconf.exe 2200 sslconf.exe 2200 sslconf.exe 2200 sslconf.exe 2200 sslconf.exe 2200 sslconf.exe 2200 sslconf.exe 2200 sslconf.exe 2200 sslconf.exe 2200 sslconf.exe 2200 sslconf.exe 2200 sslconf.exe 2200 sslconf.exe 2200 sslconf.exe 2200 sslconf.exe 2200 sslconf.exe 2200 sslconf.exe 2200 sslconf.exe 2200 sslconf.exe 2200 sslconf.exe 2200 sslconf.exe 2200 sslconf.exe 2200 sslconf.exe 2200 sslconf.exe 2200 sslconf.exe 2200 sslconf.exe 2200 sslconf.exe 2200 sslconf.exe 2200 sslconf.exe 2200 sslconf.exe 2200 sslconf.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 5956 sslconf.exe Token: SeDebugPrivilege 5956 sslconf.exe Token: SeDebugPrivilege 5956 sslconf.exe Token: SeDebugPrivilege 5956 sslconf.exe Token: SeDebugPrivilege 5956 sslconf.exe Token: SeDebugPrivilege 5956 sslconf.exe Token: SeDebugPrivilege 5956 sslconf.exe Token: SeDebugPrivilege 5956 sslconf.exe Token: SeDebugPrivilege 5956 sslconf.exe Token: SeDebugPrivilege 5956 sslconf.exe Token: SeDebugPrivilege 5956 sslconf.exe Token: SeDebugPrivilege 5956 sslconf.exe Token: SeDebugPrivilege 5956 sslconf.exe Token: SeDebugPrivilege 5956 sslconf.exe Token: SeDebugPrivilege 5956 sslconf.exe Token: SeDebugPrivilege 5956 sslconf.exe Token: SeDebugPrivilege 5956 sslconf.exe Token: SeDebugPrivilege 5956 sslconf.exe Token: SeDebugPrivilege 5956 sslconf.exe Token: SeDebugPrivilege 5956 sslconf.exe Token: SeDebugPrivilege 5956 sslconf.exe Token: SeDebugPrivilege 5956 sslconf.exe Token: SeDebugPrivilege 5956 sslconf.exe Token: SeDebugPrivilege 5956 sslconf.exe Token: SeDebugPrivilege 5956 sslconf.exe Token: SeDebugPrivilege 5956 sslconf.exe Token: SeDebugPrivilege 5956 sslconf.exe Token: SeDebugPrivilege 5956 sslconf.exe Token: SeDebugPrivilege 5956 sslconf.exe Token: SeDebugPrivilege 5956 sslconf.exe Token: SeDebugPrivilege 5956 sslconf.exe Token: SeDebugPrivilege 5956 sslconf.exe Token: SeDebugPrivilege 5956 sslconf.exe Token: SeDebugPrivilege 5956 sslconf.exe Token: SeDebugPrivilege 5956 sslconf.exe Token: SeDebugPrivilege 5956 sslconf.exe Token: SeDebugPrivilege 5956 sslconf.exe Token: SeDebugPrivilege 5956 sslconf.exe Token: SeDebugPrivilege 5956 sslconf.exe Token: SeDebugPrivilege 5956 sslconf.exe Token: SeDebugPrivilege 5956 sslconf.exe Token: SeDebugPrivilege 5956 sslconf.exe Token: SeDebugPrivilege 5956 sslconf.exe Token: SeDebugPrivilege 5956 sslconf.exe Token: SeDebugPrivilege 5956 sslconf.exe Token: SeDebugPrivilege 5956 sslconf.exe Token: SeDebugPrivilege 5956 sslconf.exe Token: SeDebugPrivilege 5956 sslconf.exe Token: SeDebugPrivilege 5956 sslconf.exe Token: SeDebugPrivilege 5956 sslconf.exe Token: SeDebugPrivilege 5956 sslconf.exe Token: SeDebugPrivilege 5956 sslconf.exe Token: SeDebugPrivilege 5956 sslconf.exe Token: SeDebugPrivilege 5956 sslconf.exe Token: SeDebugPrivilege 5956 sslconf.exe Token: SeDebugPrivilege 5956 sslconf.exe Token: SeDebugPrivilege 5956 sslconf.exe Token: SeDebugPrivilege 5956 sslconf.exe Token: SeDebugPrivilege 5956 sslconf.exe Token: SeDebugPrivilege 5956 sslconf.exe Token: SeDebugPrivilege 5956 sslconf.exe Token: SeDebugPrivilege 5956 sslconf.exe Token: SeDebugPrivilege 5956 sslconf.exe Token: SeDebugPrivilege 5956 sslconf.exe - Suspicious use of WriteProcessMemory 9 IoCs
description pid Process procid_target PID 5956 wrote to memory of 2200 5956 sslconf.exe 89 PID 2200 wrote to memory of 4208 2200 sslconf.exe 94 PID 2200 wrote to memory of 4208 2200 sslconf.exe 94 PID 2200 wrote to memory of 4208 2200 sslconf.exe 94 PID 2200 wrote to memory of 4208 2200 sslconf.exe 94 PID 2200 wrote to memory of 4208 2200 sslconf.exe 94 PID 2200 wrote to memory of 4208 2200 sslconf.exe 94 PID 2200 wrote to memory of 4208 2200 sslconf.exe 94 PID 2200 wrote to memory of 4208 2200 sslconf.exe 94
Processes
-
C:\Users\Admin\AppData\Local\Temp\sslconf.exe"C:\Users\Admin\AppData\Local\Temp\sslconf.exe"1⤵
- Reads the TCP/IP host and domain name from the registry
- Checks SCSI registry key(s)
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5956 -
C:\ProgramData\TomatoMistyRose\sslconf.exe"C:\ProgramData\TomatoMistyRose\sslconf.exe"2⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Executes dropped EXE
- Loads dropped DLL
- Checks SCSI registry key(s)
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2200 -
C:\Windows\helpPane.exe"C:\Windows\helpPane.exe"3⤵PID:4208
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c cd /d "C:\ProgramData\TomatoMistyRose"1⤵
- Executes a command shell one-liner
PID:4852
-
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" "C:\ProgramData\TomatoMistyRose\LightGoldenRodYellowLightCoral.js" //B //Nologo1⤵PID:5376
Network
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
2JavaScript
1Windows Command Shell
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\ProgramData\TomatoMistyRose\LightGoldenRodYellowLightCoral.js
- Size 70B
- SHA256 a9ff5d2faeb2316bf5b57a2a7abf65b1cf17bc48f8009558016426c91dd6893a
- MD5 d6c662b8b605e325c2ef0a80d0de6119
- SHA1 2f592d5d35b6fa8a1ba6b2e63c348a4e69e9a660
- SHA512 923692a14346f755561649c4d113fb266fef2603365c5b77f1fd224d0d9630cfeb1ec48b36294f5e0b9e6bc8dff070b07d2181e7bbc09e7a3322c90c88164909
- TLSH T19DA0220028BCF88C8283C3FA0000E30A0AC38CC23002B8280000CBECFB28000028888B
- MD5 SHA1 SHA512 TLSH
- Path C:\ProgramData\TomatoMistyRose\sslconf.exe
- Size 29KB
- SHA256 fd826215add30c1319eefa291b6eaf8ddfa7720cfe816c49aef6fe8a88de7939
- MD5 71fdd6fb7f0acd3e9a6206851452e11b
- SHA1 82011a9ff3692236df69427eb200ba05799205b0
- SHA512 f3648fc671e5300b386fb4412fb015144bd6d2d5e919aece6eeb6247889ace6fb4ecd04386f271f0978ea2072501122ae0b5f77695709aac1748e4ae5c3439cc
- SSDEEP 384:51FiQ200ruE3ae6GIlp3HQIYiB53y1ny8RbmL4nNytn:piPuE3aplB5Yi05AL3
- TLSH T15BD26C47DB911CC6D937CE31A4F11A2AE672755107B1C2EB1328825A4FA27817E7D3EC
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\TomatoMistyRose\tempdir.dll
- Size 10.5MB
- SHA256 ddd6e694ebfec6022ee6312ada1aca7d75f33d1d44fa6a788f0cefbf9767b585
- MD5 b58125e3f39c7a5de88ba48c9ca5f452
- SHA1 80eb5314a7fc807b49a5f82769456f7297737ebe
- SHA512 bdbc4fc524a0092fceed4e6de5f5824d1ceaa87a08edf48bbecf5e877d55f9efbf71084dce2ef91e5542fd35b35043a8f1c6176e7a7d40a0c101b65440199846
- SSDEEP 196608:DAOqMQKTuV/iveYmJFKsXItEdtw6Iu5Zq3vwk9RPFvG:DA/KyEaKsXTk/3Yk9RPpG
- TLSH T116B633E720E6D1F0CB092E3A4E5CA945DD310B48E9A4654B1F19E01FC729663C3F6A6F
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\TomatoMistyRose\vcruntime140.dll
- Size 130KB
- SHA256 a5437c6e669b83b5ae336cdddb79fed6425408f3f72ee367441986495e3e56fd
- MD5 6a969b545789b0be2178d2d79ca603fc
- SHA1 ecc0dcea5f747007eed5621c54f6d03564cde9fd
- SHA512 8c4a40e7e3ebe7ecfa7b92686428779f99fd7cabafb1bd3f331bbda67edfb36654ce03324f38975a8713ef5ad9d4ad474f1fdd8f06b8bef8cbc5a0306b6a6b1a
- SSDEEP 1536:Z9pCUgtBAVcxStMXcfG8VwfmpcGLOI5Sv+vecbeQ6N7lngAezG/yLzt7nD:9yA+3EOfmpcGSdOecbeQ6NxnQ+sBn
- TLSH T104D38B4272B801FBC56BD1708292EE27FBB6F50687609BDB07AA86650F537D06D3C385
- MD5 SHA1 SHA512 SSDEEP TLSH