Overview
overview
10Static
static
5! SETUP.bat
windows10-2004-x64
10! SETUP.bat
windows11-ltsc_2024-x64
7Cyber.exe
windows10-2004-x64
1Cyber.exe
windows11-ltsc_2024-x64
1sslconf.exe
windows10-2004-x64
10sslconf.exe
windows11-ltsc_2024-x64
6tempdir.dll
windows10-2004-x64
7tempdir.dll
windows11-ltsc_2024-x64
7vcruntime140.dll
windows10-2004-x64
1vcruntime140.dll
windows11-ltsc_2024-x64
1Analysis
- max time kernel
148s - max time network
126s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
20/10/2026, 22:59
Behavioral task
behavioral1
Sample
! SETUP.bat
Resource
win10v2004-20260911-en
windows10-2004-x64
16 signatures
150 seconds
Behavioral task
behavioral2
Sample
! SETUP.bat
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
12 signatures
150 seconds
Behavioral task
behavioral3
Sample
Cyber.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral4
Sample
Cyber.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
Behavioral task
behavioral5
Sample
sslconf.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
15 signatures
150 seconds
Behavioral task
behavioral6
Sample
sslconf.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
13 signatures
150 seconds
Behavioral task
behavioral7
Sample
tempdir.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
6 signatures
150 seconds
Behavioral task
behavioral8
Sample
tempdir.dll
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
7 signatures
150 seconds
Behavioral task
behavioral9
Sample
vcruntime140.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral10
Sample
vcruntime140.dll
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
General
- Target tempdir.dll
- Size 10.5MB
- Sample261020-2yctvsys4p
- SHA256 ddd6e694ebfec6022ee6312ada1aca7d75f33d1d44fa6a788f0cefbf9767b585
- MD5 b58125e3f39c7a5de88ba48c9ca5f452
- SHA1 80eb5314a7fc807b49a5f82769456f7297737ebe
- SHA512 bdbc4fc524a0092fceed4e6de5f5824d1ceaa87a08edf48bbecf5e877d55f9efbf71084dce2ef91e5542fd35b35043a8f1c6176e7a7d40a0c101b65440199846
- SSDEEP 196608:DAOqMQKTuV/iveYmJFKsXItEdtw6Iu5Zq3vwk9RPFvG:DA/KyEaKsXTk/3Yk9RPpG
- TLSH T116B633E720E6D1F0CB092E3A4E5CA945DD310B48E9A4654B1F19E01FC729663C3F6A6F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
pid Process 3576 regsvr32.exe -
resource yara_rule behavioral8/memory/932-0-0x00007FFECDB10000-0x00007FFECE237000-memory.dmp upx behavioral8/memory/932-3-0x00007FFECDB10000-0x00007FFECE237000-memory.dmp upx - Checks SCSI registry key(s) 3 TTPs 6 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000 regsvr32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID regsvr32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName regsvr32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000 regsvr32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\HardwareID regsvr32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName regsvr32.exe - Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 regsvr32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString regsvr32.exe - Suspicious behavior: EnumeratesProcesses 16 IoCs
pid Process 932 regsvr32.exe 932 regsvr32.exe 932 regsvr32.exe 932 regsvr32.exe 932 regsvr32.exe 932 regsvr32.exe 932 regsvr32.exe 932 regsvr32.exe 932 regsvr32.exe 932 regsvr32.exe 932 regsvr32.exe 932 regsvr32.exe 932 regsvr32.exe 932 regsvr32.exe 932 regsvr32.exe 932 regsvr32.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 932 regsvr32.exe Token: SeDebugPrivilege 932 regsvr32.exe Token: SeDebugPrivilege 932 regsvr32.exe Token: SeDebugPrivilege 932 regsvr32.exe Token: SeDebugPrivilege 932 regsvr32.exe Token: SeDebugPrivilege 932 regsvr32.exe Token: SeDebugPrivilege 932 regsvr32.exe Token: SeDebugPrivilege 932 regsvr32.exe Token: SeDebugPrivilege 932 regsvr32.exe Token: SeDebugPrivilege 932 regsvr32.exe Token: SeDebugPrivilege 932 regsvr32.exe Token: SeDebugPrivilege 932 regsvr32.exe Token: SeDebugPrivilege 932 regsvr32.exe Token: SeDebugPrivilege 932 regsvr32.exe Token: SeDebugPrivilege 932 regsvr32.exe Token: SeDebugPrivilege 932 regsvr32.exe Token: SeDebugPrivilege 932 regsvr32.exe Token: SeDebugPrivilege 932 regsvr32.exe Token: SeDebugPrivilege 932 regsvr32.exe Token: SeDebugPrivilege 932 regsvr32.exe Token: SeDebugPrivilege 932 regsvr32.exe Token: SeDebugPrivilege 932 regsvr32.exe Token: SeDebugPrivilege 932 regsvr32.exe Token: SeDebugPrivilege 932 regsvr32.exe Token: SeDebugPrivilege 932 regsvr32.exe Token: SeDebugPrivilege 932 regsvr32.exe Token: SeDebugPrivilege 932 regsvr32.exe Token: SeDebugPrivilege 932 regsvr32.exe Token: SeDebugPrivilege 932 regsvr32.exe Token: SeDebugPrivilege 932 regsvr32.exe Token: SeDebugPrivilege 932 regsvr32.exe Token: SeDebugPrivilege 932 regsvr32.exe Token: SeDebugPrivilege 932 regsvr32.exe Token: SeDebugPrivilege 932 regsvr32.exe Token: SeDebugPrivilege 932 regsvr32.exe Token: SeDebugPrivilege 932 regsvr32.exe Token: SeDebugPrivilege 932 regsvr32.exe Token: SeDebugPrivilege 932 regsvr32.exe Token: SeDebugPrivilege 932 regsvr32.exe Token: SeDebugPrivilege 932 regsvr32.exe Token: SeDebugPrivilege 932 regsvr32.exe Token: SeDebugPrivilege 932 regsvr32.exe Token: SeDebugPrivilege 932 regsvr32.exe Token: SeDebugPrivilege 932 regsvr32.exe Token: SeDebugPrivilege 932 regsvr32.exe Token: SeDebugPrivilege 932 regsvr32.exe Token: SeDebugPrivilege 932 regsvr32.exe Token: SeDebugPrivilege 932 regsvr32.exe Token: SeDebugPrivilege 932 regsvr32.exe Token: SeDebugPrivilege 932 regsvr32.exe Token: SeDebugPrivilege 932 regsvr32.exe Token: SeDebugPrivilege 932 regsvr32.exe Token: SeDebugPrivilege 932 regsvr32.exe Token: SeDebugPrivilege 932 regsvr32.exe Token: SeDebugPrivilege 932 regsvr32.exe Token: SeDebugPrivilege 932 regsvr32.exe Token: SeDebugPrivilege 932 regsvr32.exe Token: SeDebugPrivilege 932 regsvr32.exe Token: SeDebugPrivilege 932 regsvr32.exe Token: SeDebugPrivilege 932 regsvr32.exe Token: SeDebugPrivilege 932 regsvr32.exe Token: SeDebugPrivilege 932 regsvr32.exe Token: SeDebugPrivilege 932 regsvr32.exe Token: SeDebugPrivilege 932 regsvr32.exe - Suspicious use of WriteProcessMemory 1 IoCs
description pid Process procid_target PID 932 wrote to memory of 3576 932 regsvr32.exe 89
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\tempdir.dll1⤵
- Checks SCSI registry key(s)
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:932 -
C:\ProgramData\TomatoMistyRose\regsvr32.exe"C:\ProgramData\TomatoMistyRose\regsvr32.exe"2⤵
- Executes dropped EXE
PID:3576
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\ProgramData\TomatoMistyRose\regsvr32.exe
- Size 52KB
- SHA256 eab4d04b91b95333d9d8ddeec5efc5fbd96ae1ab6a2d53905df6d3e9674926a2
- MD5 c6fa446ed75472648ab2cc9d391298aa
- SHA1 5f2d2e73c88a183477abbf4fc88d23e388d9092e
- SHA512 ea32d49c982195035894beb77ebfb81e830ff37d3ef08e064ad1596f389a50a1e2237b330205e3e48087503e54d1245a1c1d3e6044a1ff0f11cb16ad1302f7fe
- SSDEEP 384:zIATU0Vid2R57hHZhq78sQ7yvTWp5HZ4XrTZ9FCQl7v9rA9WrHLHW:3TUNQ7Hwwn7yvTWHHyZrC47v9BL
- TLSH T17F33080E67AA34E4E5BA473444731225D771B53127218EFF68E4C17A4F26AE0DA31F4B
- MD5 SHA1 SHA512 SSDEEP TLSH