Analysis
- user interaction
yes - max time kernel
48s - max time network
24s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
23/10/2026, 23:22
Behavioral task
behavioral1
Sample
! SETUP.bat
Resource
win10v2004-20260911-en
windows10-2004-x64
15 signatures
150 seconds
Behavioral task
behavioral2
Sample
! SETUP.bat
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
13 signatures
150 seconds
Behavioral task
behavioral3
Sample
Cyber.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral4
Sample
Cyber.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
General
- Target ! SETUP.bat
- Size 3KB
- Sample261023-3cprzaev8x
- SHA256 066d5d62e1ed8bcea4de4394ebe4b050fbb705e21e15b15e849c2705eade7f72
- MD5 9a41445e799e55b272c82f43fa520a2c
- SHA1 c4a6a57a9771822197edb24afe2f3c14b7185eda
- SHA512 5f8d92c0b3cb0f500a90c134ca4a34e3a13b1f070d540b059128bd8d058e34d7b23df64e0d2305437a1e38429e4c2ab50840522037007183d7e5217d73a47172
- TLSH T1936134327C18A73106B8CE104976FD19F35961DB82354950F1EE92E0AF707C9AEBD9C5
- MD5 SHA1 SHA512 TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
pid Process 124 sslconf.exe - Loads dropped DLL 2 IoCs
pid Process 124 sslconf.exe 124 sslconf.exe - Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\LightGoldenRodYellowLightCoral = "\"C:\\Windows\\System32\\cmd.exe\" /c cd /d \"C:\\ProgramData\\TomatoMistyRose\" && \"C:\\Windows\\System32\\wscript.exe\" \"C:\\ProgramData\\TomatoMistyRose\\LightGoldenRodYellowLightCoral.js\" //B //Nologo" sslconf.exe - Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 124 set thread context of 2132 124 sslconf.exe 100 -
resource yara_rule behavioral2/memory/4804-15-0x00007FFE61DA0000-0x00007FFE624C7000-memory.dmp upx behavioral2/memory/4804-19-0x00007FFE61DA0000-0x00007FFE624C7000-memory.dmp upx behavioral2/memory/4804-22-0x00007FFE61DA0000-0x00007FFE624C7000-memory.dmp upx behavioral2/files/0x000d00000001c464-24.dat upx behavioral2/memory/124-25-0x00007FFE61DA0000-0x00007FFE624C7000-memory.dmp upx behavioral2/memory/124-31-0x00007FFE61DA0000-0x00007FFE624C7000-memory.dmp upx behavioral2/memory/124-59-0x00007FFE61DA0000-0x00007FFE624C7000-memory.dmp upx - Command and Scripting Interpreter: JavaScript 1 TTPs
- Executes a command shell one-liner 1 TTPs 2 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 3720 cmd.exe 1200 cmd.exe - Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain sslconf.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname sslconf.exe - Checks SCSI registry key(s) 3 TTPs 12 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\HardwareID sslconf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000 sslconf.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID sslconf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000 sslconf.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\HardwareID sslconf.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName sslconf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000 sslconf.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID sslconf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000 sslconf.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName sslconf.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName sslconf.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName sslconf.exe - Checks processor information in registry 2 TTPs 4 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 sslconf.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString sslconf.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 sslconf.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString sslconf.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4804 sslconf.exe 4804 sslconf.exe 4804 sslconf.exe 4804 sslconf.exe 4804 sslconf.exe 4804 sslconf.exe 4804 sslconf.exe 4804 sslconf.exe 4804 sslconf.exe 4804 sslconf.exe 4804 sslconf.exe 4804 sslconf.exe 4804 sslconf.exe 4804 sslconf.exe 4804 sslconf.exe 4804 sslconf.exe 4804 sslconf.exe 4804 sslconf.exe 4804 sslconf.exe 4804 sslconf.exe 4804 sslconf.exe 4804 sslconf.exe 4804 sslconf.exe 4804 sslconf.exe 4804 sslconf.exe 4804 sslconf.exe 4804 sslconf.exe 4804 sslconf.exe 4804 sslconf.exe 4804 sslconf.exe 124 sslconf.exe 124 sslconf.exe 124 sslconf.exe 124 sslconf.exe 124 sslconf.exe 124 sslconf.exe 124 sslconf.exe 124 sslconf.exe 124 sslconf.exe 124 sslconf.exe 124 sslconf.exe 124 sslconf.exe 124 sslconf.exe 124 sslconf.exe 124 sslconf.exe 124 sslconf.exe 124 sslconf.exe 124 sslconf.exe 124 sslconf.exe 124 sslconf.exe 124 sslconf.exe 124 sslconf.exe 124 sslconf.exe 124 sslconf.exe 124 sslconf.exe 124 sslconf.exe 124 sslconf.exe 124 sslconf.exe 124 sslconf.exe 124 sslconf.exe 124 sslconf.exe 124 sslconf.exe 124 sslconf.exe 124 sslconf.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 4804 sslconf.exe Token: SeDebugPrivilege 4804 sslconf.exe Token: SeDebugPrivilege 4804 sslconf.exe Token: SeDebugPrivilege 4804 sslconf.exe Token: SeDebugPrivilege 4804 sslconf.exe Token: SeDebugPrivilege 4804 sslconf.exe Token: SeDebugPrivilege 4804 sslconf.exe Token: SeDebugPrivilege 4804 sslconf.exe Token: SeDebugPrivilege 4804 sslconf.exe Token: SeDebugPrivilege 4804 sslconf.exe Token: SeDebugPrivilege 4804 sslconf.exe Token: SeDebugPrivilege 4804 sslconf.exe Token: SeDebugPrivilege 4804 sslconf.exe Token: SeDebugPrivilege 4804 sslconf.exe Token: SeDebugPrivilege 4804 sslconf.exe Token: SeDebugPrivilege 4804 sslconf.exe Token: SeDebugPrivilege 4804 sslconf.exe Token: SeDebugPrivilege 4804 sslconf.exe Token: SeDebugPrivilege 4804 sslconf.exe Token: SeDebugPrivilege 4804 sslconf.exe Token: SeDebugPrivilege 4804 sslconf.exe Token: SeDebugPrivilege 4804 sslconf.exe Token: SeDebugPrivilege 4804 sslconf.exe Token: SeDebugPrivilege 4804 sslconf.exe Token: SeDebugPrivilege 4804 sslconf.exe Token: SeDebugPrivilege 4804 sslconf.exe Token: SeDebugPrivilege 4804 sslconf.exe Token: SeDebugPrivilege 4804 sslconf.exe Token: SeDebugPrivilege 4804 sslconf.exe Token: SeDebugPrivilege 4804 sslconf.exe Token: SeDebugPrivilege 4804 sslconf.exe Token: SeDebugPrivilege 4804 sslconf.exe Token: SeDebugPrivilege 4804 sslconf.exe Token: SeDebugPrivilege 4804 sslconf.exe Token: SeDebugPrivilege 4804 sslconf.exe Token: SeDebugPrivilege 4804 sslconf.exe Token: SeDebugPrivilege 4804 sslconf.exe Token: SeDebugPrivilege 4804 sslconf.exe Token: SeDebugPrivilege 4804 sslconf.exe Token: SeDebugPrivilege 4804 sslconf.exe Token: SeDebugPrivilege 4804 sslconf.exe Token: SeDebugPrivilege 4804 sslconf.exe Token: SeDebugPrivilege 4804 sslconf.exe Token: SeDebugPrivilege 4804 sslconf.exe Token: SeDebugPrivilege 4804 sslconf.exe Token: SeDebugPrivilege 4804 sslconf.exe Token: SeDebugPrivilege 4804 sslconf.exe Token: SeDebugPrivilege 4804 sslconf.exe Token: SeDebugPrivilege 4804 sslconf.exe Token: SeDebugPrivilege 4804 sslconf.exe Token: SeDebugPrivilege 4804 sslconf.exe Token: SeDebugPrivilege 4804 sslconf.exe Token: SeDebugPrivilege 4804 sslconf.exe Token: SeDebugPrivilege 4804 sslconf.exe Token: SeDebugPrivilege 4804 sslconf.exe Token: SeDebugPrivilege 4804 sslconf.exe Token: SeDebugPrivilege 4804 sslconf.exe Token: SeDebugPrivilege 4804 sslconf.exe Token: SeDebugPrivilege 4804 sslconf.exe Token: SeDebugPrivilege 4804 sslconf.exe Token: SeDebugPrivilege 4804 sslconf.exe Token: SeDebugPrivilege 4804 sslconf.exe Token: SeDebugPrivilege 4804 sslconf.exe Token: SeDebugPrivilege 4804 sslconf.exe - Suspicious use of WriteProcessMemory 13 IoCs
description pid Process procid_target PID 3720 wrote to memory of 3260 3720 cmd.exe 90 PID 3720 wrote to memory of 3648 3720 cmd.exe 91 PID 3720 wrote to memory of 4804 3720 cmd.exe 92 PID 3720 wrote to memory of 4748 3720 cmd.exe 94 PID 4804 wrote to memory of 124 4804 sslconf.exe 95 PID 124 wrote to memory of 2132 124 sslconf.exe 100 PID 124 wrote to memory of 2132 124 sslconf.exe 100 PID 124 wrote to memory of 2132 124 sslconf.exe 100 PID 124 wrote to memory of 2132 124 sslconf.exe 100 PID 124 wrote to memory of 2132 124 sslconf.exe 100 PID 124 wrote to memory of 2132 124 sslconf.exe 100 PID 124 wrote to memory of 2132 124 sslconf.exe 100 PID 124 wrote to memory of 2132 124 sslconf.exe 100
Processes
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\! SETUP.bat"1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:3720 -
C:\Windows\system32\mode.commode con: cols=72 lines=242⤵PID:3260
-
-
C:\Windows\system32\cacls.exe"C:\Windows\system32\cacls.exe" "C:\Windows\system32\config\system"2⤵PID:3648
-
-
C:\Users\Admin\AppData\Local\Temp\sslconf.exesslconf.exe2⤵
- Checks SCSI registry key(s)
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4804 -
C:\ProgramData\TomatoMistyRose\sslconf.exe"C:\ProgramData\TomatoMistyRose\sslconf.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Reads the TCP/IP host and domain name from the registry
- Checks SCSI registry key(s)
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:124 -
C:\Windows\helpPane.exe"C:\Windows\helpPane.exe"4⤵PID:2132
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Cyber.execyber.exe2⤵PID:4748
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c cd /d "C:\ProgramData\TomatoMistyRose"1⤵
- Executes a command shell one-liner
PID:1200
-
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" "C:\ProgramData\TomatoMistyRose\LightGoldenRodYellowLightCoral.js" //B //Nologo1⤵PID:2576
Network
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
2JavaScript
1Windows Command Shell
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\ProgramData\TomatoMistyRose\LightGoldenRodYellowLightCoral.js
- Size 70B
- SHA256 a9ff5d2faeb2316bf5b57a2a7abf65b1cf17bc48f8009558016426c91dd6893a
- MD5 d6c662b8b605e325c2ef0a80d0de6119
- SHA1 2f592d5d35b6fa8a1ba6b2e63c348a4e69e9a660
- SHA512 923692a14346f755561649c4d113fb266fef2603365c5b77f1fd224d0d9630cfeb1ec48b36294f5e0b9e6bc8dff070b07d2181e7bbc09e7a3322c90c88164909
- TLSH T19DA0220028BCF88C8283C3FA0000E30A0AC38CC23002B8280000CBECFB28000028888B
- MD5 SHA1 SHA512 TLSH
- Path C:\ProgramData\TomatoMistyRose\sslconf.exe
- Size 29KB
- SHA256 fd826215add30c1319eefa291b6eaf8ddfa7720cfe816c49aef6fe8a88de7939
- MD5 71fdd6fb7f0acd3e9a6206851452e11b
- SHA1 82011a9ff3692236df69427eb200ba05799205b0
- SHA512 f3648fc671e5300b386fb4412fb015144bd6d2d5e919aece6eeb6247889ace6fb4ecd04386f271f0978ea2072501122ae0b5f77695709aac1748e4ae5c3439cc
- SSDEEP 384:51FiQ200ruE3ae6GIlp3HQIYiB53y1ny8RbmL4nNytn:piPuE3aplB5Yi05AL3
- TLSH T15BD26C47DB911CC6D937CE31A4F11A2AE672755107B1C2EB1328825A4FA27817E7D3EC
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\TomatoMistyRose\tempdir.dll
- Size 10.5MB
- SHA256 ddd6e694ebfec6022ee6312ada1aca7d75f33d1d44fa6a788f0cefbf9767b585
- MD5 b58125e3f39c7a5de88ba48c9ca5f452
- SHA1 80eb5314a7fc807b49a5f82769456f7297737ebe
- SHA512 bdbc4fc524a0092fceed4e6de5f5824d1ceaa87a08edf48bbecf5e877d55f9efbf71084dce2ef91e5542fd35b35043a8f1c6176e7a7d40a0c101b65440199846
- SSDEEP 196608:DAOqMQKTuV/iveYmJFKsXItEdtw6Iu5Zq3vwk9RPFvG:DA/KyEaKsXTk/3Yk9RPpG
- TLSH T116B633E720E6D1F0CB092E3A4E5CA945DD310B48E9A4654B1F19E01FC729663C3F6A6F
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\TomatoMistyRose\vcruntime140.dll
- Size 130KB
- SHA256 a5437c6e669b83b5ae336cdddb79fed6425408f3f72ee367441986495e3e56fd
- MD5 6a969b545789b0be2178d2d79ca603fc
- SHA1 ecc0dcea5f747007eed5621c54f6d03564cde9fd
- SHA512 8c4a40e7e3ebe7ecfa7b92686428779f99fd7cabafb1bd3f331bbda67edfb36654ce03324f38975a8713ef5ad9d4ad474f1fdd8f06b8bef8cbc5a0306b6a6b1a
- SSDEEP 1536:Z9pCUgtBAVcxStMXcfG8VwfmpcGLOI5Sv+vecbeQ6N7lngAezG/yLzt7nD:9yA+3EOfmpcGSdOecbeQ6NxnQ+sBn
- TLSH T104D38B4272B801FBC56BD1708292EE27FBB6F50687609BDB07AA86650F537D06D3C385
- MD5 SHA1 SHA512 SSDEEP TLSH