Analysis
- max time kernel
150s - max time network
143s - platform
windows10-2004_x64 - resource
win10v2004-20260911-en - resource tags
arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
14/10/2026, 10:23
Behavioral task
behavioral1
Sample
xoilac17.live_chrome.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
41 signatures
150 seconds
Behavioral task
behavioral2
Sample
xoilac17.live_chrome.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
39 signatures
150 seconds
General
- Target xoilac17.live_chrome.exe
- Size 57KB
- Sample261014-mes96sff36
- SHA256 292595753d74b6fa2799de2a483a40cc59e95c05b2db6ce6de14a6246e9e9db7
- MD5 6df536a128433f509b1f9ca74760a68b
- SHA1 bc98bf7c82fe5672327b817fcd400cd5d43a62c9
- SHA512 a288fe3110e8b646493bfc2434f21bca0d3ee9c1037bd78684386b69ccf03011d89f3b20a9bec0fe3a3fbf709a1ae04d2e517234153d39795cdab19b48ba8828
- SSDEEP 768:njwie26yfCe3OEtHLsb+GyKSZdaYMP44N1XXGb5fAdOTFKFum1t:njpfB/E+LKSvnE44LXGb5feOTFuuC
- TLSH T1F443E74477FD4111E5BF8EBA5DB191518B33B8A7AC22C38D0AD4068E19B2B40CDA8F77
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Extracted
Family
-
nanocore
Version
-
1.2.2.0
C2
-
http://xoilac17.live
Mutex
-
ac7e2f05-8df7-4c55-8841-78385f6bb064
Attributes
-
c2_url
http://xoilac17.live
-
default_group
xoilac
-
primary_dns
ali.ns.cloudflare.com
-
secondary_dns
woz.ns.cloudflare.com
-
version
1.2.2.0
Signatures
- Contains code to disable Windows Defender 2 IoCs
A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.
resource yara_rule behavioral1/memory/3064-0-0x0000000000CB0000-0x0000000000CC4000-memory.dmp disable_win_def behavioral1/files/0x000700000002489b-2265.dat disable_win_def -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\DisableAntiSpyware = "1" xoilac17.live_chrome.exe - Modifies security service 2 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wscsvc\Start = "4" xoilac17.live_chrome.exe - Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell and hide display window.
pid Process 2464 powershell.exe - Disables RegEdit via registry modification 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" xoilac17.live_chrome.exe - Disables Task Manager via registry modification
- Drops file in Drivers directory 1 IoCs
description ioc Process File opened for modification C:\Windows\System32\drivers\etc\hosts xoilac17.live_chrome.exe - Event Triggered Execution: Image File Execution Options Injection 1 TTPs 6 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe\Debugger = "C:\\Users\\Admin\\AppData\\Local\\Temp\\xoilac17.live_chrome.exe" xoilac17.live_chrome.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regedit.exe xoilac17.live_chrome.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regedit.exe\Debugger = "C:\\Users\\Admin\\AppData\\Local\\Temp\\xoilac17.live_chrome.exe" xoilac17.live_chrome.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msconfig.exe xoilac17.live_chrome.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msconfig.exe\Debugger = "C:\\Users\\Admin\\AppData\\Local\\Temp\\xoilac17.live_chrome.exe" xoilac17.live_chrome.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe xoilac17.live_chrome.exe - Modifies Windows Firewall 2 TTPs 1 IoCs
pid Process 1232 netsh.exe - Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000\Control Panel\International\Geo\Nation xoilac17.live_chrome.exe - Creates a file in the Startup directory 1 TTPs 64 IoCs
A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.
description ioc Process File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_183.pdf xoilac17.live_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_3.pdf xoilac17.live_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_31.pdf xoilac17.live_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_43.pdf xoilac17.live_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_61.pdf xoilac17.live_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_98.pdf xoilac17.live_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_140.pdf xoilac17.live_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_152.pdf xoilac17.live_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SysUpdate.exe xoilac17.live_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_17.pdf xoilac17.live_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_40.pdf xoilac17.live_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_75.pdf xoilac17.live_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_78.pdf xoilac17.live_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_136.pdf xoilac17.live_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_160.pdf xoilac17.live_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_186.pdf xoilac17.live_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_35.pdf xoilac17.live_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_97.pdf xoilac17.live_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_103.pdf xoilac17.live_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_129.pdf xoilac17.live_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_156.pdf xoilac17.live_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_166.pdf xoilac17.live_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_59.pdf xoilac17.live_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_75.pdf xoilac17.live_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_147.pdf xoilac17.live_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_196.pdf xoilac17.live_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\system.bat xoilac17.live_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_62.pdf xoilac17.live_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_81.pdf xoilac17.live_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_81.pdf xoilac17.live_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_136.pdf xoilac17.live_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_157.pdf xoilac17.live_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_50.pdf xoilac17.live_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_143.pdf xoilac17.live_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_163.pdf xoilac17.live_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_176.pdf xoilac17.live_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_189.pdf xoilac17.live_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_11.pdf xoilac17.live_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_94.pdf xoilac17.live_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_139.pdf xoilac17.live_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_155.pdf xoilac17.live_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_177.pdf xoilac17.live_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_181.pdf xoilac17.live_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_198.pdf xoilac17.live_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SysUpdate.exe xoilac17.live_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_14.pdf xoilac17.live_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_19.pdf xoilac17.live_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_64.pdf xoilac17.live_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_69.pdf xoilac17.live_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_82.pdf xoilac17.live_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_95.pdf xoilac17.live_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_116.pdf xoilac17.live_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_138.pdf xoilac17.live_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_27.pdf xoilac17.live_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_34.pdf xoilac17.live_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_70.pdf xoilac17.live_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_108.pdf xoilac17.live_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_145.pdf xoilac17.live_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_185.pdf xoilac17.live_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_53.pdf xoilac17.live_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_54.pdf xoilac17.live_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_71.pdf xoilac17.live_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_73.pdf xoilac17.live_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_90.pdf xoilac17.live_chrome.exe - Disables service(s) 3 TTPs
- Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Stops running service(s) 4 TTPs
- Adds Run key to start application 2 TTPs 4 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SysUpdate = "C:\\Users\\Admin\\AppData\\Local\\Temp\\xoilac17.live_chrome.exe" xoilac17.live_chrome.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SysUpdate = "C:\\Users\\Admin\\AppData\\Local\\Temp\\xoilac17.live_chrome.exe" xoilac17.live_chrome.exe Set value (str) \REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Malware = "C:\\Users\\Admin\\AppData\\Local\\Temp\\xoilac17.live_chrome.exe" xoilac17.live_chrome.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Malware = "C:\\Users\\Admin\\AppData\\Local\\Temp\\xoilac17.live_chrome.exe" xoilac17.live_chrome.exe - Discovers running processes 1 TTPs 1 IoCs
Running process information can be used to identify security tools or plan follow-on actions.
pid Process 1832 tasklist.exe - Drops file in System32 directory 3 IoCs
description ioc Process File created C:\Windows\system32\svchost.exe xoilac17.live_chrome.exe File created C:\Windows\system32\sysupdate.exe xoilac17.live_chrome.exe File opened for modification C:\Windows\system32\sysupdate.exe xoilac17.live_chrome.exe - Executes a VBScript file via the Windows Script Host. 1 TTPs 2 IoCs
pid Process 4684 wscript.exe 900 wscript.exe - Sets desktop wallpaper using registry 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000\Control Panel\Desktop\Wallpaper = "C:\\ProgramData\\SysUpdate\\wall.bmp" xoilac17.live_chrome.exe Set value (str) \REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\wallpaper.bmp" xoilac17.live_chrome.exe - Launches sc.exe 12 IoCs
Sc.exe is a Windows utlilty to control services on the system.
pid Process 2620 sc.exe 2244 sc.exe 3004 sc.exe 3708 sc.exe 4260 sc.exe 3260 sc.exe 1504 sc.exe 1372 sc.exe 3900 sc.exe 4508 sc.exe 3772 sc.exe 1308 sc.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs
Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.
description ioc Process Key opened \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe - Executes a command shell one-liner 1 TTPs 7 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 2116 cmd.exe 3504 cmd.exe 404 cmd.exe 3740 cmd.exe 4260 cmd.exe 3820 cmd.exe 3148 cmd.exe - Reads the TCP/IP host and domain name from the registry 1 TTPs 8 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname xoilac17.live_chrome.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain WMIC.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain xoilac17.live_chrome.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname WMIC.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain WMIC.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname WMIC.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname WMIC.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain WMIC.exe - Gathers network information 2 TTPs 2 IoCs
Uses commandline utility to view network configuration.
pid Process 4508 NETSTAT.EXE 5116 ipconfig.exe - Gathers system information 1 TTPs 1 IoCs
Runs systeminfo.exe.
pid Process 3664 systeminfo.exe - Interacts with shadow copies 3 TTPs 3 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
pid Process 4692 vssadmin.exe 3484 vssadmin.exe 1712 vssadmin.exe - Modifies Control Panel 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000\Control Panel\Desktop\WallpaperStyle = "2" xoilac17.live_chrome.exe - Modifies registry class 16 IoCs
description ioc Process Key deleted \REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000_Classes\ms-settings\shell\open\command xoilac17.live_chrome.exe Key deleted \REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000_Classes\ms-settings\shell\open xoilac17.live_chrome.exe Key created \REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000_Classes\ms-settings xoilac17.live_chrome.exe Key created \REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000_Classes\ms-settings\shell xoilac17.live_chrome.exe Set value (str) \REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000_Classes\ms-settings\shell\open\command\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\xoilac17.live_chrome.exe" xoilac17.live_chrome.exe Key created \REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000_Classes\ms-settings\shell\open\command xoilac17.live_chrome.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\PDFBotnet\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\xoilac17.live_chrome.exe\" \"%1\"" xoilac17.live_chrome.exe Key deleted \REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000_Classes\ms-settings\shell xoilac17.live_chrome.exe Key deleted \REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000_Classes\ms-settings xoilac17.live_chrome.exe Set value (str) \REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000_Classes\.pdf\ = "PDFBotnet" xoilac17.live_chrome.exe Key created \REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000_Classes\ms-settings\shell\open xoilac17.live_chrome.exe Set value (str) \REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000_Classes\ms-settings\shell\open\command\DelegateExecute xoilac17.live_chrome.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\PDFBotnet\shell\open\command xoilac17.live_chrome.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\PDFBotnet xoilac17.live_chrome.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\PDFBotnet\shell xoilac17.live_chrome.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\PDFBotnet\shell\open xoilac17.live_chrome.exe - Runs net.exe
- Scheduled Task/Job: Scheduled Task 1 TTPs 3 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 3228 schtasks.exe 2032 schtasks.exe 1232 schtasks.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2464 powershell.exe 2464 powershell.exe 3064 xoilac17.live_chrome.exe 3064 xoilac17.live_chrome.exe 3064 xoilac17.live_chrome.exe 3064 xoilac17.live_chrome.exe 3064 xoilac17.live_chrome.exe 3064 xoilac17.live_chrome.exe 3064 xoilac17.live_chrome.exe 3064 xoilac17.live_chrome.exe 3064 xoilac17.live_chrome.exe 3064 xoilac17.live_chrome.exe 3064 xoilac17.live_chrome.exe 3064 xoilac17.live_chrome.exe 3064 xoilac17.live_chrome.exe 3064 xoilac17.live_chrome.exe 3064 xoilac17.live_chrome.exe 3064 xoilac17.live_chrome.exe 3064 xoilac17.live_chrome.exe 3064 xoilac17.live_chrome.exe 3064 xoilac17.live_chrome.exe 3064 xoilac17.live_chrome.exe 3064 xoilac17.live_chrome.exe 3064 xoilac17.live_chrome.exe 3064 xoilac17.live_chrome.exe 3064 xoilac17.live_chrome.exe 3064 xoilac17.live_chrome.exe 3064 xoilac17.live_chrome.exe 3064 xoilac17.live_chrome.exe 3064 xoilac17.live_chrome.exe 3064 xoilac17.live_chrome.exe 3064 xoilac17.live_chrome.exe 3064 xoilac17.live_chrome.exe 3064 xoilac17.live_chrome.exe 3064 xoilac17.live_chrome.exe 3064 xoilac17.live_chrome.exe 3064 xoilac17.live_chrome.exe 3064 xoilac17.live_chrome.exe 3064 xoilac17.live_chrome.exe 3064 xoilac17.live_chrome.exe 3064 xoilac17.live_chrome.exe 3064 xoilac17.live_chrome.exe 3064 xoilac17.live_chrome.exe 3064 xoilac17.live_chrome.exe 3064 xoilac17.live_chrome.exe 3064 xoilac17.live_chrome.exe 3064 xoilac17.live_chrome.exe 3064 xoilac17.live_chrome.exe 3064 xoilac17.live_chrome.exe 3064 xoilac17.live_chrome.exe 3064 xoilac17.live_chrome.exe 3064 xoilac17.live_chrome.exe 3064 xoilac17.live_chrome.exe 3064 xoilac17.live_chrome.exe 3064 xoilac17.live_chrome.exe 3064 xoilac17.live_chrome.exe 3064 xoilac17.live_chrome.exe 3064 xoilac17.live_chrome.exe 3064 xoilac17.live_chrome.exe 3064 xoilac17.live_chrome.exe 3064 xoilac17.live_chrome.exe 3064 xoilac17.live_chrome.exe 3064 xoilac17.live_chrome.exe 3064 xoilac17.live_chrome.exe - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 3064 xoilac17.live_chrome.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 2464 powershell.exe Token: SeIncreaseQuotaPrivilege 4592 WMIC.exe Token: SeSecurityPrivilege 4592 WMIC.exe Token: SeTakeOwnershipPrivilege 4592 WMIC.exe Token: SeLoadDriverPrivilege 4592 WMIC.exe Token: SeSystemProfilePrivilege 4592 WMIC.exe Token: SeSystemtimePrivilege 4592 WMIC.exe Token: SeProfSingleProcessPrivilege 4592 WMIC.exe Token: SeIncBasePriorityPrivilege 4592 WMIC.exe Token: SeCreatePagefilePrivilege 4592 WMIC.exe Token: SeBackupPrivilege 4592 WMIC.exe Token: SeRestorePrivilege 4592 WMIC.exe Token: SeShutdownPrivilege 4592 WMIC.exe Token: SeDebugPrivilege 4592 WMIC.exe Token: SeSystemEnvironmentPrivilege 4592 WMIC.exe Token: SeRemoteShutdownPrivilege 4592 WMIC.exe Token: SeUndockPrivilege 4592 WMIC.exe Token: SeManageVolumePrivilege 4592 WMIC.exe Token: 33 4592 WMIC.exe Token: 34 4592 WMIC.exe Token: 35 4592 WMIC.exe Token: 36 4592 WMIC.exe Token: SeBackupPrivilege 4304 vssvc.exe Token: SeRestorePrivilege 4304 vssvc.exe Token: SeAuditPrivilege 4304 vssvc.exe Token: SeIncreaseQuotaPrivilege 4592 WMIC.exe Token: SeSecurityPrivilege 4592 WMIC.exe Token: SeTakeOwnershipPrivilege 4592 WMIC.exe Token: SeLoadDriverPrivilege 4592 WMIC.exe Token: SeSystemProfilePrivilege 4592 WMIC.exe Token: SeSystemtimePrivilege 4592 WMIC.exe Token: SeProfSingleProcessPrivilege 4592 WMIC.exe Token: SeIncBasePriorityPrivilege 4592 WMIC.exe Token: SeCreatePagefilePrivilege 4592 WMIC.exe Token: SeBackupPrivilege 4592 WMIC.exe Token: SeRestorePrivilege 4592 WMIC.exe Token: SeShutdownPrivilege 4592 WMIC.exe Token: SeDebugPrivilege 4592 WMIC.exe Token: SeSystemEnvironmentPrivilege 4592 WMIC.exe Token: SeRemoteShutdownPrivilege 4592 WMIC.exe Token: SeUndockPrivilege 4592 WMIC.exe Token: SeManageVolumePrivilege 4592 WMIC.exe Token: 33 4592 WMIC.exe Token: 34 4592 WMIC.exe Token: 35 4592 WMIC.exe Token: 36 4592 WMIC.exe Token: SeDebugPrivilege 3064 xoilac17.live_chrome.exe Token: SeIncBasePriorityPrivilege 3064 xoilac17.live_chrome.exe Token: SeDebugPrivilege 4508 NETSTAT.EXE Token: SeDebugPrivilege 1832 tasklist.exe Token: SeDebugPrivilege 4952 whoami.exe Token: SeIncreaseQuotaPrivilege 4340 WMIC.exe Token: SeSecurityPrivilege 4340 WMIC.exe Token: SeTakeOwnershipPrivilege 4340 WMIC.exe Token: SeLoadDriverPrivilege 4340 WMIC.exe Token: SeSystemProfilePrivilege 4340 WMIC.exe Token: SeSystemtimePrivilege 4340 WMIC.exe Token: SeProfSingleProcessPrivilege 4340 WMIC.exe Token: SeIncBasePriorityPrivilege 4340 WMIC.exe Token: SeCreatePagefilePrivilege 4340 WMIC.exe Token: SeBackupPrivilege 4340 WMIC.exe Token: SeRestorePrivilege 4340 WMIC.exe Token: SeShutdownPrivilege 4340 WMIC.exe Token: SeDebugPrivilege 4340 WMIC.exe - Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 3064 xoilac17.live_chrome.exe - Suspicious use of WriteProcessMemory 44 IoCs
description pid Process procid_target PID 3064 wrote to memory of 2464 3064 xoilac17.live_chrome.exe 86 PID 3064 wrote to memory of 1504 3064 xoilac17.live_chrome.exe 88 PID 3064 wrote to memory of 2620 3064 xoilac17.live_chrome.exe 90 PID 3064 wrote to memory of 2244 3064 xoilac17.live_chrome.exe 92 PID 3064 wrote to memory of 3004 3064 xoilac17.live_chrome.exe 94 PID 3064 wrote to memory of 1372 3064 xoilac17.live_chrome.exe 96 PID 3064 wrote to memory of 3900 3064 xoilac17.live_chrome.exe 98 PID 3064 wrote to memory of 4508 3064 xoilac17.live_chrome.exe 170 PID 3064 wrote to memory of 3708 3064 xoilac17.live_chrome.exe 102 PID 3064 wrote to memory of 2024 3064 xoilac17.live_chrome.exe 104 PID 3064 wrote to memory of 4260 3064 xoilac17.live_chrome.exe 132 PID 3064 wrote to memory of 3260 3064 xoilac17.live_chrome.exe 107 PID 3064 wrote to memory of 3484 3064 xoilac17.live_chrome.exe 109 PID 3064 wrote to memory of 4592 3064 xoilac17.live_chrome.exe 111 PID 2024 wrote to memory of 2060 2024 fodhelper.exe 113 PID 3064 wrote to memory of 4684 3064 xoilac17.live_chrome.exe 118 PID 3064 wrote to memory of 2032 3064 xoilac17.live_chrome.exe 119 PID 3064 wrote to memory of 1232 3064 xoilac17.live_chrome.exe 162 PID 3064 wrote to memory of 404 3064 xoilac17.live_chrome.exe 126 PID 3064 wrote to memory of 3504 3064 xoilac17.live_chrome.exe 128 PID 3064 wrote to memory of 2116 3064 xoilac17.live_chrome.exe 129 PID 3064 wrote to memory of 3148 3064 xoilac17.live_chrome.exe 130 PID 3064 wrote to memory of 3820 3064 xoilac17.live_chrome.exe 131 PID 3064 wrote to memory of 4260 3064 xoilac17.live_chrome.exe 132 PID 3064 wrote to memory of 3740 3064 xoilac17.live_chrome.exe 133 PID 3064 wrote to memory of 3228 3064 xoilac17.live_chrome.exe 134 PID 3064 wrote to memory of 900 3064 xoilac17.live_chrome.exe 135 PID 2116 wrote to memory of 1832 2116 cmd.exe 143 PID 3740 wrote to memory of 4508 3740 cmd.exe 170 PID 3504 wrote to memory of 3664 3504 cmd.exe 145 PID 3820 wrote to memory of 4996 3820 cmd.exe 146 PID 404 wrote to memory of 1712 404 cmd.exe 147 PID 4260 wrote to memory of 5116 4260 cmd.exe 148 PID 4996 wrote to memory of 2472 4996 net.exe 149 PID 3148 wrote to memory of 4952 3148 cmd.exe 150 PID 404 wrote to memory of 4340 404 cmd.exe 151 PID 3064 wrote to memory of 1420 3064 xoilac17.live_chrome.exe 152 PID 3064 wrote to memory of 4692 3064 xoilac17.live_chrome.exe 156 PID 3064 wrote to memory of 4016 3064 xoilac17.live_chrome.exe 158 PID 3064 wrote to memory of 4464 3064 xoilac17.live_chrome.exe 160 PID 3064 wrote to memory of 1232 3064 xoilac17.live_chrome.exe 162 PID 3064 wrote to memory of 3772 3064 xoilac17.live_chrome.exe 163 PID 3064 wrote to memory of 1308 3064 xoilac17.live_chrome.exe 165 PID 4464 wrote to memory of 3508 4464 net.exe 168 - Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
- Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\xoilac17.live_chrome.exe"C:\Users\Admin\AppData\Local\Temp\xoilac17.live_chrome.exe"1⤵
- Modifies Windows Defender DisableAntiSpyware settings
- Modifies security service
- Disables RegEdit via registry modification
- Drops file in Drivers directory
- Event Triggered Execution: Image File Execution Options Injection
- Checks computer location settings
- Creates a file in the Startup directory
- Adds Run key to start application
- Drops file in System32 directory
- Sets desktop wallpaper using registry
- Reads the TCP/IP host and domain name from the registry
- Modifies Control Panel
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3064 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoP -NonI -W Hidden -Exec Bypass -Enc UwBlAHQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARABpAHMAYQBiAGwAZQBSAGUAYQBsAHQAaQBtAGUATQBvAG4AaQB0AG8AcgBpAG4AZwAgACQAdAByAHUAZQA7ACAAUwBlAHQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARABpAHMAYQBiAGwAZQBCAGUAaABhAHYAaQBvAHIATQBvAG4AaQB0AG8AcgBpAG4AZwAgACQAdAByAHUAZQA7ACAAQQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgACIAQwA6AFwAUAByAG8AZwByAGEAbQBEAGEAdABhAFwAUwB5AHMAVQBwAGQAYQB0AGUAIgAgAC0ARgBvAHIAYwBlAA==2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2464
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" stop wscsvc2⤵
- Launches sc.exe
PID:1504
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" config wscsvc start= disabled2⤵
- Launches sc.exe
PID:2620
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" stop SecurityHealthService2⤵
- Launches sc.exe
PID:2244
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" config SecurityHealthService start= disabled2⤵
- Launches sc.exe
PID:3004
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" stop WinDefend2⤵
- Launches sc.exe
PID:1372
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" config WinDefend start= disabled2⤵
- Launches sc.exe
PID:3900
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" stop MsMpSvc2⤵
- Launches sc.exe
PID:4508
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" config MsMpSvc start= disabled2⤵
- Launches sc.exe
PID:3708
-
-
C:\Windows\System32\fodhelper.exe"C:\Windows\System32\fodhelper.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:2024 -
C:\Users\Admin\AppData\Local\Temp\xoilac17.live_chrome.exe"C:\Users\Admin\AppData\Local\Temp\xoilac17.live_chrome.exe"3⤵PID:2060
-
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" stop wscsvc2⤵
- Launches sc.exe
PID:4260
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" stop wuauserv2⤵
- Launches sc.exe
PID:3260
-
-
C:\Windows\System32\vssadmin.exe"C:\Windows\System32\vssadmin.exe" delete shadows /all /quiet2⤵
- Interacts with shadow copies
PID:3484
-
-
C:\Windows\System32\wbem\WMIC.exe"C:\Windows\System32\wbem\WMIC.exe" shadowcopy delete2⤵
- Reads the TCP/IP host and domain name from the registry
- Suspicious use of AdjustPrivilegeToken
PID:4592
-
-
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" C:\Users\Admin\AppData\Local\Temp\makelnk.vbs2⤵
- Executes a VBScript file via the Windows Script Host.
PID:4684
-
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /tn "SysUpdateTask" /tr "C:\Users\Admin\AppData\Local\Temp\xoilac17.live_chrome.exe" /sc onlogon /f2⤵
- Scheduled Task/Job: Scheduled Task
PID:2032
-
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /tn "SysUpdateBackup" /tr "C:\Users\Admin\AppData\Local\Temp\xoilac17.live_chrome.exe" /sc minute /mo 30 /f2⤵
- Scheduled Task/Job: Scheduled Task
PID:1232
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\del.bat" "2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:404 -
C:\Windows\system32\vssadmin.exevssadmin delete shadows /all /quiet3⤵
- Interacts with shadow copies
PID:1712
-
-
C:\Windows\System32\Wbem\WMIC.exewmic shadowcopy delete3⤵
- Reads the TCP/IP host and domain name from the registry
- Suspicious use of AdjustPrivilegeToken
PID:4340
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c systeminfo > "C:\ProgramData\SysUpdate\Logs\sysinfo.txt"2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:3504 -
C:\Windows\system32\systeminfo.exesysteminfo3⤵
- Gathers system information
PID:3664
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c tasklist > "C:\ProgramData\SysUpdate\Logs\tasklist.txt"2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2116 -
C:\Windows\system32\tasklist.exetasklist3⤵
- Discovers running processes
- Suspicious use of AdjustPrivilegeToken
PID:1832
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c whoami > "C:\ProgramData\SysUpdate\Logs\whoami.txt"2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:3148 -
C:\Windows\system32\whoami.exewhoami3⤵
- Suspicious use of AdjustPrivilegeToken
PID:4952
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c net user > "C:\ProgramData\SysUpdate\Logs\netuser.txt"2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:3820 -
C:\Windows\system32\net.exenet user3⤵
- Suspicious use of WriteProcessMemory
PID:4996 -
C:\Windows\system32\net1.exeC:\Windows\system32\net1 user4⤵PID:2472
-
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c ipconfig /all > "C:\ProgramData\SysUpdate\Logs\ipconfig.txt"2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4260 -
C:\Windows\system32\ipconfig.exeipconfig /all3⤵
- Gathers network information
PID:5116
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c netstat -an > "C:\ProgramData\SysUpdate\Logs\netstat.txt"2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:3740 -
C:\Windows\system32\NETSTAT.EXEnetstat -an3⤵
- Gathers network information
- Suspicious use of AdjustPrivilegeToken
PID:4508
-
-
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks" /create /tn "RansomwareCheck" /tr "C:\Users\Admin\AppData\Local\Temp\xoilac17.live_chrome.exe" /sc daily /f2⤵
- Scheduled Task/Job: Scheduled Task
PID:3228
-
-
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" C:\Users\Admin\AppData\Local\Temp\createshortcut.vbs2⤵
- Executes a VBScript file via the Windows Script Host.
PID:900
-
-
C:\Windows\System32\notepad.exe"C:\Windows\System32\notepad.exe"2⤵PID:1420
-
-
C:\Windows\System32\vssadmin.exe"C:\Windows\System32\vssadmin.exe" delete shadows /all /quiet2⤵
- Interacts with shadow copies
PID:4692
-
-
C:\Windows\System32\wbem\WMIC.exe"C:\Windows\System32\wbem\WMIC.exe" shadowcopy delete2⤵
- Reads the TCP/IP host and domain name from the registry
PID:4016
-
-
C:\Windows\System32\net.exe"C:\Windows\System32\net.exe" stop srservice2⤵
- Suspicious use of WriteProcessMemory
PID:4464 -
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop srservice3⤵PID:3508
-
-
-
C:\Windows\System32\netsh.exe"C:\Windows\System32\netsh.exe" advfirewall set allprofiles state off2⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
PID:1232
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" config i8042prt start= disabled2⤵
- Launches sc.exe
PID:3772
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" stop i8042prt2⤵
- Launches sc.exe
PID:1308
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4304
-
C:\Users\Admin\AppData\Local\Temp\xoilac17.live_chrome.exeC:\Users\Admin\AppData\Local\Temp\xoilac17.live_chrome.exe1⤵PID:2844
-
C:\Users\Admin\AppData\Local\Temp\xoilac17.live_chrome.exeC:\Users\Admin\AppData\Local\Temp\xoilac17.live_chrome.exe1⤵PID:1652
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV11⤵PID:4508
Network
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
4PowerShell
1Visual Basic
1Windows Command Shell
1Scheduled Task/Job
1Scheduled Task
1System Services
2Service Execution
2Windows Management Instrumentation
1Persistence
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
2Create or Modify System Process
5Windows Service
5Event Triggered Execution
2Image File Execution Options Injection
1Netsh Helper DLL
1Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
2Create or Modify System Process
5Windows Service
5Event Triggered Execution
2Image File Execution Options Injection
1Netsh Helper DLL
1Scheduled Task/Job
1Scheduled Task
1Defense Evasion
Direct Volume Access
1Impair Defenses
3Disable or Modify System Firewall
1Disable or Modify Tools
1Indicator Removal
2File Deletion
2Modify Registry
4Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\ProgramData\SysUpdate\Scr\scr_20261014_112416.jpg
- Size 75KB
- SHA256 f6cbc712fbda489180a57c0978556c0554e9ca1cf1c0ef9f284c4abd3e33d7f7
- MD5 74b5e446642e07cd858a3a52bed37e84
- SHA1 5f5136ed79c215b5a8f1964aa6ab4091f422abf5
- SHA512 18e946344535e6c3506c600aebf03c5ff77db82e54e2ad134098e0cca6c7f3ef6e22506e08118f71f9dbe5dd5e260726ea2558497f9fe2bf5c0d283a1359d092
- SSDEEP 1536:IcxN00000000000000000000000000000000000000000000000000000000000d:nEPQOpn7cU
- TLSH T18273F457DD159F93A428D3E9BE475FAC1F4A3F08E5823AEB04264EC67B702260C4F529
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\SystemVolumeInformation\doc_2.pdf
- Size 76KB
- SHA256 dac8b7d11b905ec209d7f249364e6dfffec6a13a5d38aecb556c524fffb7781f
- MD5 a5f6cb7a63c0ede6f3d87951ce3cf14b
- SHA1 4dc2a4b0f270c20ad624e65c8d786b73a57bc586
- SHA512 90c86c5a0e968fb5b7a00108b81de991b236e0bb8806fa362eaa86295889994cb9a08babd94f2bd278cfbe62a3a1583b2334d057a035ea081af17f6d75ff8afa
- SSDEEP 1536:AOjZTHDKoukdeMBBbkNP3PyKsGw6lDPo8XW1NJiqYMuvc140zzOCJVQwcKP4iBG:AOjZvjukQ6bEsGv1o8XW1NJiqYDUe0zO
- TLSH T15A73F8368F23FCD4277E3D90E0503E462C882E6B8775667CFA850DA66AA5640CF3D59C
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\xoilac17.live_chrome.exe.log
- Size 660B
- SHA256 f424c891fbc7385e9826beed2dd8755aeac5495744b5de0a1e370891a7beaf7a
- MD5 1c5e1d0ff3381486370760b0f2eb656b
- SHA1 f9df6be8804ef611063f1ff277e323b1215372de
- SHA512 78f5fc40a185d04c9e4a02a3d1b10b4bd684c579a45a0d1e8f49f8dee9018ed7bc8875cbf21f98632f93ead667214a41904226ce54817b85caeeb4b0de54a743
- TLSH T1CF014970227BA0D888152F942C2E2BC403BF0336B5509E187998729EEE264571F212E6
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_ci4vlbf3.aoi.ps1
- Size 60B
- SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
- MD5 d17fe0a3f47be24a6453e9ef58c94641
- SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
- SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
- TLSH T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\createshortcut.vbs
- Size 245B
- SHA256 33f129a8fc1220fde779db290bf9b276f3b90c360c1aefdad27aacf7b553d895
- MD5 33ec570e7a8392ac9a86483f1129742e
- SHA1 deb184c0f1ac078dadc5c1c47c0e11297acda81f
- SHA512 893ceb1eaf853423b4b5c15de31f350b310d8f602e1e145c92e0d5dedfc03c29bc95c1321ae7afd3fd359d8aaacbadc5ce45de8c2189f8f00321b084e4dbc5f3
- TLSH T15FD0A79FB248C6BE0001163B81F3DD4DE9E5886C3B13BEA05AE5DD4D36918858DF6543
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\del.bat
- Size 59B
- SHA256 a51f2a0f053ac35b4158bb02b75421ab3698e1d0ee4f926abf1bae3af1570c53
- MD5 9cecbebdcdd60358132849714a3b82f7
- SHA1 be6e20834a5726f3742f05e6bdfaff16118b147f
- SHA512 7b48bd66b4c741d2de2e8b7bc0eab8f438ddc1ed0c73e8b70add9bee400f6640f692884965032616e2d6911a22a17d1d3762421aa49fe021660c9052cfc0675a
- TLSH T13DA002620F961E5469529E5AD73425239D1F104CD1390012F05232903DA98DE0EC2144
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\makelnk.vbs
- Size 246B
- SHA256 572862520223061f8c66b0fbe570e2b98f5ec00a9af8abd34e36648341755f9a
- MD5 ada7c6a1a867b6fe13235b9314a772e9
- SHA1 32c36070d88197cb488609e1fd0360ddde40e05c
- SHA512 b500d40b3c65147b8a5f08fb093fd03d752d32af3df4f755596bfca396054fb865e44b3efb3e7ad5257e295e91dfa3117cd39b1f94cb0fb472198d5be572ebe2
- TLSH T101D0A7DFB248C6BE0001163F80F3DD4DEAE1886C3F23AE609AA5DD0E36818858DF6543
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\temp_steal.log
- Size 100KB
- SHA256 01166767bcb4852bc0a406607a6048fd78740b73e7a57cefc1c8eaa1e0518248
- MD5 7c43a4673c6f3cfd0f56019dbae321a1
- SHA1 61a91003ad9dd368ba4c5c07e3cecee3431d390c
- SHA512 db6e9a2f9cc7703e775099f86f47bbde6a69a4393efb17f926c25c8a81b028875a30a59ecce5af12ae59c4c9a7eb4afa2383e78df95523209abc92f38a4d8553
- SSDEEP 768:UYg4X0cD+OThPdp3ErOoEdejyTDlzmxymSxxbEmpLk7ht7Ob1Csdu+Nk:3ZEi9XcOoExTDk8mObpohuCsA+C
- TLSH T1B8A33C40D3B28F3E05965AEB0C1672D1A579B7F092ECC1FB65A7AF17F066CE2D219210
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\Desktop\stolen_data_here.txt
- Size 100KB
- SHA256 60f7f9962ec86d15051c370faf35e1f22889c4d3b0e591804f0365b8317b954f
- MD5 b114b2033330c5ef9281f41212635279
- SHA1 c323cb1520ef643624f050ca34efbf3fe1c5de4f
- SHA512 dbab23d91fe313237fdccca273a65d7e71e0cad10f51711dcb4c92229763305ae9824b188481d958b92612585e7ce926cca0dcbdf38fda80c91586cec9770f9d
- SSDEEP 768:7Yg4X0cD+OThPdp3ErOoEdejyTDlzmxymSxxbEmpLk7ht7Ob1Csdu+Nm:8ZEi9XcOoExTDk8mObpohuCsA+o
- TLSH T193A33C40D3B28F3E05965AEB0C1672D1A579B7F092ECC1FB61A7AF17F066CE2D219210
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\Documents\invoice_1.pdf
- Size 76KB
- SHA256 f5f9db9c81cc60ecb91cef4b213523ae4a7351798695de1dd5c86886aecef7a0
- MD5 ba960fb2d4e431bc52a71aeb06a9eaba
- SHA1 dcaee5c671d9747b842f2ab70df0968852165713
- SHA512 9566cd1daaa08a8cb69580dd81e1c1b4ed2b0ce5e81990e8bf023d9aeeadde2e405774708a87172c39127b8b943f81f8b6ade0821d05376f4d7046af1a3ead14
- SSDEEP 1536:gOjZTHDKoukdeMBBbkNP3PyKsGw6lDPo8XW1NJiqYMuvc140zzOCJVQwcKP4iBH:gOjZvjukQ6bEsGv1o8XW1NJiqYDUe0zv
- TLSH T11A73F8368F22FCD4277E3D90E0503E462C883E6787B5667CFA850DA66AA5640CF3D59C
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\READ_ME_NANOCORE.txt
- Size 145B
- SHA256 7057e5f2042a9706c5d18b7d05214373577eb0293599d361bf66cfba3a3eee4f
- MD5 d7ea02f4c4953d6a3f52b5d0ecbeb047
- SHA1 ce3a66707cabbbeaa0980b91d3b6271fc84145cb
- SHA512 441ac2261f8c29eed640bdddfd5195f9fe5fe5fb0f08a77bbebdb4507819e8717855e5485f554986eb0f69ee55d1fa5939c3f7dc84a333f9d78a15973df56f70
- TLSH T156C02B572EE03298B1C036C20A0A4CA2A76D470CD605C6582A2FC42033001EE2E41130
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\System32\sysupdate.exe
- Size 57KB
- SHA256 292595753d74b6fa2799de2a483a40cc59e95c05b2db6ce6de14a6246e9e9db7
- MD5 6df536a128433f509b1f9ca74760a68b
- SHA1 bc98bf7c82fe5672327b817fcd400cd5d43a62c9
- SHA512 a288fe3110e8b646493bfc2434f21bca0d3ee9c1037bd78684386b69ccf03011d89f3b20a9bec0fe3a3fbf709a1ae04d2e517234153d39795cdab19b48ba8828
- SSDEEP 768:njwie26yfCe3OEtHLsb+GyKSZdaYMP44N1XXGb5fAdOTFKFum1t:njpfB/E+LKSvnE44LXGb5feOTFuuC
- TLSH T1F443E74477FD4111E5BF8EBA5DB191518B33B8A7AC22C38D0AD4068E19B2B40CDA8F77
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path F:\RANSOM_NOTE.txt
- Size 177B
- SHA256 bfd4ed4bcd78100294aeaee2c2b4b8e37fb372b61cdcaa2a14f50ebe4b708e93
- MD5 c381da16f24527b361930429b75608ad
- SHA1 cc68fc2b7246e2b7611b3a1798a7dd3ad5b1c912
- SHA512 e79ae7b36ed481285d8fd080a69e080b637b0eaff67bcb53d0f27c89a984dd70f913d1f69cb306e0b96116b898227814eea36e8e3cfd03302c4455b28da89545
- TLSH T121C0C00B3EC4377822CC21E209018C12914EEA0CAA044254022BC9109EA496D30D44B3
- MD5 SHA1 SHA512 TLSH