Analysis
- max time kernel
149s - max time network
145s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
15/10/2026, 04:39
Behavioral task
behavioral1
Sample
www.flabba.io_chrome.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
41 signatures
150 seconds
Behavioral task
behavioral2
Sample
www.flabba.io_chrome.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
39 signatures
150 seconds
General
- Target www.flabba.io_chrome.exe
- Size 57KB
- Sample261015-e973tady2m
- SHA256 7293e13e9a4c70a87a4fb19f40964adea1f460b2f4d0bbe425f575180533dfbf
- MD5 8b8e05e5b94948f9b0193ca981e8e502
- SHA1 2edaa059d4ffbf388be0fb29793f17b00a22aba2
- SHA512 2238a7d5f048d6d98cfd47c1ef4ac01e378f58feb4a5c76ded8ac654d6a6da0f746774fddb527852df871743785b0d2b53ef133232ab92304176824818d680ae
- SSDEEP 768:yjwie26yfCe3OEtHLsb+GyKSQdzYMQ4HN1XXGb5fAdOTTKFum1G:yjpfB/E+LKSIUz4HLXGb5feOTTuuR
- TLSH T15443E74477FD4111E5BF8EBA5DB191518B33B8A7AD22C38D0AD4068E19B2B40CDA8F77
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Extracted
Family
-
nanocore
Version
-
1.2.2.0
C2
-
http://www.flabba.io
Mutex
-
ac7e2f05-8df7-4c55-8841-78385f6bb064
Attributes
-
c2_url
http://www.flabba.io
-
default_group
xoilac
-
primary_dns
ali.ns.cloudflare.com
-
secondary_dns
woz.ns.cloudflare.com
-
version
1.2.2.0
Signatures
- Contains code to disable Windows Defender 1 IoCs
A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.
resource yara_rule behavioral2/memory/2932-1-0x0000000000BC0000-0x0000000000BD4000-memory.dmp disable_win_def -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\DisableAntiSpyware = "1" www.flabba.io_chrome.exe - Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell and hide display window.
pid Process 4104 powershell.exe - Disables RegEdit via registry modification 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-2304238888-3968896904-642854331-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" www.flabba.io_chrome.exe - Disables Task Manager via registry modification
- Drops file in Drivers directory 1 IoCs
description ioc Process File opened for modification C:\Windows\System32\drivers\etc\hosts www.flabba.io_chrome.exe - Event Triggered Execution: Image File Execution Options Injection 1 TTPs 6 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msconfig.exe www.flabba.io_chrome.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msconfig.exe\Debugger = "C:\\Users\\Admin\\AppData\\Local\\Temp\\www.flabba.io_chrome.exe" www.flabba.io_chrome.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe www.flabba.io_chrome.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe\Debugger = "C:\\Users\\Admin\\AppData\\Local\\Temp\\www.flabba.io_chrome.exe" www.flabba.io_chrome.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regedit.exe www.flabba.io_chrome.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regedit.exe\Debugger = "C:\\Users\\Admin\\AppData\\Local\\Temp\\www.flabba.io_chrome.exe" www.flabba.io_chrome.exe - Modifies Windows Firewall 2 TTPs 1 IoCs
pid Process 5464 netsh.exe - Creates a file in the Startup directory 1 TTPs 64 IoCs
A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_194.pdf www.flabba.io_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_4.pdf www.flabba.io_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_49.pdf www.flabba.io_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_59.pdf www.flabba.io_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_110.pdf www.flabba.io_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_153.pdf www.flabba.io_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_168.pdf www.flabba.io_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_173.pdf www.flabba.io_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_48.pdf www.flabba.io_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_87.pdf www.flabba.io_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_147.pdf www.flabba.io_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_166.pdf www.flabba.io_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_77.pdf www.flabba.io_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_86.pdf www.flabba.io_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_97.pdf www.flabba.io_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_6.pdf www.flabba.io_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_125.pdf www.flabba.io_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_186.pdf www.flabba.io_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_48.pdf www.flabba.io_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_184.pdf www.flabba.io_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_20.pdf www.flabba.io_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_32.pdf www.flabba.io_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_88.pdf www.flabba.io_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_112.pdf www.flabba.io_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_141.pdf www.flabba.io_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_161.pdf www.flabba.io_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_186.pdf www.flabba.io_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_43.pdf www.flabba.io_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_57.pdf www.flabba.io_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_72.pdf www.flabba.io_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_92.pdf www.flabba.io_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_61.pdf www.flabba.io_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_64.pdf www.flabba.io_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_119.pdf www.flabba.io_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_188.pdf www.flabba.io_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_24.pdf www.flabba.io_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_66.pdf www.flabba.io_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_76.pdf www.flabba.io_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_89.pdf www.flabba.io_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_113.pdf www.flabba.io_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_116.pdf www.flabba.io_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_195.pdf www.flabba.io_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_32.pdf www.flabba.io_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_35.pdf www.flabba.io_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_55.pdf www.flabba.io_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_56.pdf www.flabba.io_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_67.pdf www.flabba.io_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_106.pdf www.flabba.io_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_111.pdf www.flabba.io_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_120.pdf www.flabba.io_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_145.pdf www.flabba.io_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_169.pdf www.flabba.io_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_176.pdf www.flabba.io_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_187.pdf www.flabba.io_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_196.pdf www.flabba.io_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_83.pdf www.flabba.io_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_87.pdf www.flabba.io_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_95.pdf www.flabba.io_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_8.pdf www.flabba.io_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_30.pdf www.flabba.io_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_85.pdf www.flabba.io_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_109.pdf www.flabba.io_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_162.pdf www.flabba.io_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_166.pdf www.flabba.io_chrome.exe - Disables service(s) 3 TTPs
- Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Stops running service(s) 4 TTPs
- Adds Run key to start application 2 TTPs 3 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2304238888-3968896904-642854331-1000\Software\Microsoft\Windows\CurrentVersion\Run\SysUpdate = "C:\\Users\\Admin\\AppData\\Local\\Temp\\www.flabba.io_chrome.exe" www.flabba.io_chrome.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SysUpdate = "C:\\Users\\Admin\\AppData\\Local\\Temp\\www.flabba.io_chrome.exe" www.flabba.io_chrome.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Malware = "C:\\Users\\Admin\\AppData\\Local\\Temp\\www.flabba.io_chrome.exe" www.flabba.io_chrome.exe - Discovers running processes 1 TTPs 1 IoCs
Running process information can be used to identify security tools or plan follow-on actions.
pid Process 5964 tasklist.exe - Drops file in System32 directory 3 IoCs
description ioc Process File created C:\Windows\system32\svchost.exe www.flabba.io_chrome.exe File created C:\Windows\system32\sysupdate.exe www.flabba.io_chrome.exe File opened for modification C:\Windows\system32\sysupdate.exe www.flabba.io_chrome.exe - Executes a VBScript file via the Windows Script Host. 1 TTPs 2 IoCs
pid Process 292 wscript.exe 4444 wscript.exe - Sets desktop wallpaper using registry 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2304238888-3968896904-642854331-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\wallpaper.bmp" www.flabba.io_chrome.exe Set value (str) \REGISTRY\USER\S-1-5-21-2304238888-3968896904-642854331-1000\Control Panel\Desktop\Wallpaper = "C:\\ProgramData\\SysUpdate\\wall.bmp" www.flabba.io_chrome.exe - Launches sc.exe 12 IoCs
Sc.exe is a Windows utlilty to control services on the system.
pid Process 4164 sc.exe 4640 sc.exe 5288 sc.exe 5876 sc.exe 2796 sc.exe 1240 sc.exe 2920 sc.exe 1204 sc.exe 1112 sc.exe 1948 sc.exe 2448 sc.exe 4876 sc.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs
Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.
description ioc Process Key opened \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe - Executes a command shell one-liner 1 TTPs 7 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 5208 cmd.exe 5456 cmd.exe 5736 cmd.exe 2312 cmd.exe 5104 cmd.exe 4612 cmd.exe 4468 cmd.exe - Reads the TCP/IP host and domain name from the registry 1 TTPs 8 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname WMIC.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain WMIC.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain www.flabba.io_chrome.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname www.flabba.io_chrome.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname WMIC.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain WMIC.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname WMIC.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain WMIC.exe - Gathers network information 2 TTPs 2 IoCs
Uses commandline utility to view network configuration.
pid Process 2580 NETSTAT.EXE 4628 ipconfig.exe - Gathers system information 1 TTPs 1 IoCs
Runs systeminfo.exe.
pid Process 2756 systeminfo.exe - Interacts with shadow copies 3 TTPs 3 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
pid Process 4340 vssadmin.exe 3800 vssadmin.exe 4492 vssadmin.exe - Modifies Control Panel 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2304238888-3968896904-642854331-1000\Control Panel\Desktop\WallpaperStyle = "2" www.flabba.io_chrome.exe - Modifies registry class 16 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\PDFBotnet www.flabba.io_chrome.exe Key created \REGISTRY\USER\S-1-5-21-2304238888-3968896904-642854331-1000_Classes\ms-settings www.flabba.io_chrome.exe Set value (str) \REGISTRY\USER\S-1-5-21-2304238888-3968896904-642854331-1000_Classes\ms-settings\shell\open\command\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\www.flabba.io_chrome.exe" www.flabba.io_chrome.exe Key deleted \REGISTRY\USER\S-1-5-21-2304238888-3968896904-642854331-1000_Classes\ms-settings\shell\open www.flabba.io_chrome.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\PDFBotnet\shell\open\command www.flabba.io_chrome.exe Key deleted \REGISTRY\USER\S-1-5-21-2304238888-3968896904-642854331-1000_Classes\ms-settings www.flabba.io_chrome.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.pdf\ = "PDFBotnet" www.flabba.io_chrome.exe Key created \REGISTRY\USER\S-1-5-21-2304238888-3968896904-642854331-1000_Classes\ms-settings\shell\open\command www.flabba.io_chrome.exe Key created \REGISTRY\USER\S-1-5-21-2304238888-3968896904-642854331-1000_Classes\ms-settings\shell www.flabba.io_chrome.exe Key created \REGISTRY\USER\S-1-5-21-2304238888-3968896904-642854331-1000_Classes\ms-settings\shell\open www.flabba.io_chrome.exe Set value (str) \REGISTRY\USER\S-1-5-21-2304238888-3968896904-642854331-1000_Classes\ms-settings\shell\open\command\DelegateExecute www.flabba.io_chrome.exe Key deleted \REGISTRY\USER\S-1-5-21-2304238888-3968896904-642854331-1000_Classes\ms-settings\shell\open\command www.flabba.io_chrome.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\PDFBotnet\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\www.flabba.io_chrome.exe\" \"%1\"" www.flabba.io_chrome.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\PDFBotnet\shell www.flabba.io_chrome.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\PDFBotnet\shell\open www.flabba.io_chrome.exe Key deleted \REGISTRY\USER\S-1-5-21-2304238888-3968896904-642854331-1000_Classes\ms-settings\shell www.flabba.io_chrome.exe - Runs net.exe
- Scheduled Task/Job: Scheduled Task 1 TTPs 3 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 3508 schtasks.exe 3180 schtasks.exe 3024 schtasks.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4104 powershell.exe 4104 powershell.exe 4104 powershell.exe 3520 WMIC.exe 3520 WMIC.exe 3520 WMIC.exe 3520 WMIC.exe 2932 www.flabba.io_chrome.exe 2932 www.flabba.io_chrome.exe 3436 WMIC.exe 3436 WMIC.exe 3436 WMIC.exe 3436 WMIC.exe 2932 www.flabba.io_chrome.exe 2932 www.flabba.io_chrome.exe 2932 www.flabba.io_chrome.exe 2932 www.flabba.io_chrome.exe 2932 www.flabba.io_chrome.exe 2932 www.flabba.io_chrome.exe 2932 www.flabba.io_chrome.exe 5048 WMIC.exe 5048 WMIC.exe 5048 WMIC.exe 5048 WMIC.exe 2932 www.flabba.io_chrome.exe 2932 www.flabba.io_chrome.exe 2932 www.flabba.io_chrome.exe 2932 www.flabba.io_chrome.exe 2932 www.flabba.io_chrome.exe 2932 www.flabba.io_chrome.exe 2932 www.flabba.io_chrome.exe 2932 www.flabba.io_chrome.exe 2932 www.flabba.io_chrome.exe 2932 www.flabba.io_chrome.exe 2932 www.flabba.io_chrome.exe 2932 www.flabba.io_chrome.exe 2932 www.flabba.io_chrome.exe 2932 www.flabba.io_chrome.exe 2932 www.flabba.io_chrome.exe 2932 www.flabba.io_chrome.exe 2932 www.flabba.io_chrome.exe 2932 www.flabba.io_chrome.exe 2932 www.flabba.io_chrome.exe 2932 www.flabba.io_chrome.exe 2932 www.flabba.io_chrome.exe 2932 www.flabba.io_chrome.exe 2932 www.flabba.io_chrome.exe 2932 www.flabba.io_chrome.exe 2932 www.flabba.io_chrome.exe 2932 www.flabba.io_chrome.exe 2932 www.flabba.io_chrome.exe 2932 www.flabba.io_chrome.exe 2932 www.flabba.io_chrome.exe 2932 www.flabba.io_chrome.exe 2932 www.flabba.io_chrome.exe 2932 www.flabba.io_chrome.exe 2932 www.flabba.io_chrome.exe 2932 www.flabba.io_chrome.exe 2932 www.flabba.io_chrome.exe 2932 www.flabba.io_chrome.exe 2932 www.flabba.io_chrome.exe 2932 www.flabba.io_chrome.exe 2932 www.flabba.io_chrome.exe 2932 www.flabba.io_chrome.exe - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2932 www.flabba.io_chrome.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 4104 powershell.exe Token: SeIncreaseQuotaPrivilege 3520 WMIC.exe Token: SeSecurityPrivilege 3520 WMIC.exe Token: SeTakeOwnershipPrivilege 3520 WMIC.exe Token: SeLoadDriverPrivilege 3520 WMIC.exe Token: SeSystemProfilePrivilege 3520 WMIC.exe Token: SeSystemtimePrivilege 3520 WMIC.exe Token: SeProfSingleProcessPrivilege 3520 WMIC.exe Token: SeIncBasePriorityPrivilege 3520 WMIC.exe Token: SeCreatePagefilePrivilege 3520 WMIC.exe Token: SeBackupPrivilege 3520 WMIC.exe Token: SeRestorePrivilege 3520 WMIC.exe Token: SeShutdownPrivilege 3520 WMIC.exe Token: SeDebugPrivilege 3520 WMIC.exe Token: SeSystemEnvironmentPrivilege 3520 WMIC.exe Token: SeRemoteShutdownPrivilege 3520 WMIC.exe Token: SeUndockPrivilege 3520 WMIC.exe Token: SeManageVolumePrivilege 3520 WMIC.exe Token: 33 3520 WMIC.exe Token: 34 3520 WMIC.exe Token: 35 3520 WMIC.exe Token: 36 3520 WMIC.exe Token: SeBackupPrivilege 3608 vssvc.exe Token: SeRestorePrivilege 3608 vssvc.exe Token: SeAuditPrivilege 3608 vssvc.exe Token: SeIncreaseQuotaPrivilege 3520 WMIC.exe Token: SeSecurityPrivilege 3520 WMIC.exe Token: SeTakeOwnershipPrivilege 3520 WMIC.exe Token: SeLoadDriverPrivilege 3520 WMIC.exe Token: SeSystemProfilePrivilege 3520 WMIC.exe Token: SeSystemtimePrivilege 3520 WMIC.exe Token: SeProfSingleProcessPrivilege 3520 WMIC.exe Token: SeIncBasePriorityPrivilege 3520 WMIC.exe Token: SeCreatePagefilePrivilege 3520 WMIC.exe Token: SeBackupPrivilege 3520 WMIC.exe Token: SeRestorePrivilege 3520 WMIC.exe Token: SeShutdownPrivilege 3520 WMIC.exe Token: SeDebugPrivilege 3520 WMIC.exe Token: SeSystemEnvironmentPrivilege 3520 WMIC.exe Token: SeRemoteShutdownPrivilege 3520 WMIC.exe Token: SeUndockPrivilege 3520 WMIC.exe Token: SeManageVolumePrivilege 3520 WMIC.exe Token: 33 3520 WMIC.exe Token: 34 3520 WMIC.exe Token: 35 3520 WMIC.exe Token: 36 3520 WMIC.exe Token: SeIncreaseQuotaPrivilege 4104 powershell.exe Token: SeSecurityPrivilege 4104 powershell.exe Token: SeTakeOwnershipPrivilege 4104 powershell.exe Token: SeLoadDriverPrivilege 4104 powershell.exe Token: SeSystemProfilePrivilege 4104 powershell.exe Token: SeSystemtimePrivilege 4104 powershell.exe Token: SeProfSingleProcessPrivilege 4104 powershell.exe Token: SeIncBasePriorityPrivilege 4104 powershell.exe Token: SeCreatePagefilePrivilege 4104 powershell.exe Token: SeBackupPrivilege 4104 powershell.exe Token: SeRestorePrivilege 4104 powershell.exe Token: SeShutdownPrivilege 4104 powershell.exe Token: SeDebugPrivilege 4104 powershell.exe Token: SeSystemEnvironmentPrivilege 4104 powershell.exe Token: SeRemoteShutdownPrivilege 4104 powershell.exe Token: SeUndockPrivilege 4104 powershell.exe Token: SeManageVolumePrivilege 4104 powershell.exe Token: 33 4104 powershell.exe - Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 2932 www.flabba.io_chrome.exe - Suspicious use of WriteProcessMemory 44 IoCs
description pid Process procid_target PID 2932 wrote to memory of 4104 2932 www.flabba.io_chrome.exe 89 PID 2932 wrote to memory of 4164 2932 www.flabba.io_chrome.exe 91 PID 2932 wrote to memory of 4640 2932 www.flabba.io_chrome.exe 93 PID 2932 wrote to memory of 2920 2932 www.flabba.io_chrome.exe 95 PID 2932 wrote to memory of 5288 2932 www.flabba.io_chrome.exe 166 PID 2932 wrote to memory of 5876 2932 www.flabba.io_chrome.exe 99 PID 2932 wrote to memory of 2796 2932 www.flabba.io_chrome.exe 101 PID 2932 wrote to memory of 1204 2932 www.flabba.io_chrome.exe 103 PID 2932 wrote to memory of 1112 2932 www.flabba.io_chrome.exe 105 PID 2932 wrote to memory of 2028 2932 www.flabba.io_chrome.exe 107 PID 2932 wrote to memory of 1948 2932 www.flabba.io_chrome.exe 163 PID 2932 wrote to memory of 1240 2932 www.flabba.io_chrome.exe 110 PID 2028 wrote to memory of 6012 2028 fodhelper.exe 111 PID 2932 wrote to memory of 4340 2932 www.flabba.io_chrome.exe 113 PID 2932 wrote to memory of 3520 2932 www.flabba.io_chrome.exe 115 PID 2932 wrote to memory of 292 2932 www.flabba.io_chrome.exe 122 PID 2932 wrote to memory of 3508 2932 www.flabba.io_chrome.exe 123 PID 2932 wrote to memory of 3180 2932 www.flabba.io_chrome.exe 125 PID 2932 wrote to memory of 2312 2932 www.flabba.io_chrome.exe 130 PID 2932 wrote to memory of 5736 2932 www.flabba.io_chrome.exe 132 PID 2932 wrote to memory of 5456 2932 www.flabba.io_chrome.exe 133 PID 2932 wrote to memory of 5208 2932 www.flabba.io_chrome.exe 134 PID 2932 wrote to memory of 4468 2932 www.flabba.io_chrome.exe 135 PID 2932 wrote to memory of 4612 2932 www.flabba.io_chrome.exe 136 PID 2932 wrote to memory of 5104 2932 www.flabba.io_chrome.exe 137 PID 2932 wrote to memory of 3024 2932 www.flabba.io_chrome.exe 144 PID 2932 wrote to memory of 4444 2932 www.flabba.io_chrome.exe 146 PID 2312 wrote to memory of 3800 2312 cmd.exe 147 PID 5208 wrote to memory of 5944 5208 cmd.exe 148 PID 5104 wrote to memory of 2580 5104 cmd.exe 149 PID 4468 wrote to memory of 4292 4468 cmd.exe 150 PID 4612 wrote to memory of 4628 4612 cmd.exe 151 PID 5456 wrote to memory of 5964 5456 cmd.exe 152 PID 4292 wrote to memory of 4284 4292 net.exe 153 PID 5736 wrote to memory of 2756 5736 cmd.exe 154 PID 2312 wrote to memory of 3436 2312 cmd.exe 155 PID 2932 wrote to memory of 1964 2932 www.flabba.io_chrome.exe 156 PID 2932 wrote to memory of 4492 2932 www.flabba.io_chrome.exe 157 PID 2932 wrote to memory of 5048 2932 www.flabba.io_chrome.exe 158 PID 2932 wrote to memory of 6008 2932 www.flabba.io_chrome.exe 159 PID 2932 wrote to memory of 5464 2932 www.flabba.io_chrome.exe 160 PID 2932 wrote to memory of 4876 2932 www.flabba.io_chrome.exe 161 PID 2932 wrote to memory of 2448 2932 www.flabba.io_chrome.exe 162 PID 6008 wrote to memory of 5276 6008 net.exe 169 - Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
- Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\www.flabba.io_chrome.exe"C:\Users\Admin\AppData\Local\Temp\www.flabba.io_chrome.exe"1⤵
- Modifies Windows Defender DisableAntiSpyware settings
- Disables RegEdit via registry modification
- Drops file in Drivers directory
- Event Triggered Execution: Image File Execution Options Injection
- Creates a file in the Startup directory
- Adds Run key to start application
- Drops file in System32 directory
- Sets desktop wallpaper using registry
- Reads the TCP/IP host and domain name from the registry
- Modifies Control Panel
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2932 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoP -NonI -W Hidden -Exec Bypass -Enc UwBlAHQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARABpAHMAYQBiAGwAZQBSAGUAYQBsAHQAaQBtAGUATQBvAG4AaQB0AG8AcgBpAG4AZwAgACQAdAByAHUAZQA7ACAAUwBlAHQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARABpAHMAYQBiAGwAZQBCAGUAaABhAHYAaQBvAHIATQBvAG4AaQB0AG8AcgBpAG4AZwAgACQAdAByAHUAZQA7ACAAQQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgACIAQwA6AFwAUAByAG8AZwByAGEAbQBEAGEAdABhAFwAUwB5AHMAVQBwAGQAYQB0AGUAIgAgAC0ARgBvAHIAYwBlAA==2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4104
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" stop wscsvc2⤵
- Launches sc.exe
PID:4164
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" config wscsvc start= disabled2⤵
- Launches sc.exe
PID:4640
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" stop SecurityHealthService2⤵
- Launches sc.exe
PID:2920
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" config SecurityHealthService start= disabled2⤵
- Launches sc.exe
PID:5288
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" stop WinDefend2⤵
- Launches sc.exe
PID:5876
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" config WinDefend start= disabled2⤵
- Launches sc.exe
PID:2796
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" stop MsMpSvc2⤵
- Launches sc.exe
PID:1204
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" config MsMpSvc start= disabled2⤵
- Launches sc.exe
PID:1112
-
-
C:\Windows\System32\fodhelper.exe"C:\Windows\System32\fodhelper.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:2028 -
C:\Users\Admin\AppData\Local\Temp\www.flabba.io_chrome.exe"C:\Users\Admin\AppData\Local\Temp\www.flabba.io_chrome.exe"3⤵PID:6012
-
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" stop wscsvc2⤵
- Launches sc.exe
PID:1948
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" stop wuauserv2⤵
- Launches sc.exe
PID:1240
-
-
C:\Windows\System32\vssadmin.exe"C:\Windows\System32\vssadmin.exe" delete shadows /all /quiet2⤵
- Interacts with shadow copies
PID:4340
-
-
C:\Windows\System32\wbem\WMIC.exe"C:\Windows\System32\wbem\WMIC.exe" shadowcopy delete2⤵
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3520
-
-
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" C:\Users\Admin\AppData\Local\Temp\makelnk.vbs2⤵
- Executes a VBScript file via the Windows Script Host.
PID:292
-
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /tn "SysUpdateTask" /tr "C:\Users\Admin\AppData\Local\Temp\www.flabba.io_chrome.exe" /sc onlogon /f2⤵
- Scheduled Task/Job: Scheduled Task
PID:3508
-
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /tn "SysUpdateBackup" /tr "C:\Users\Admin\AppData\Local\Temp\www.flabba.io_chrome.exe" /sc minute /mo 30 /f2⤵
- Scheduled Task/Job: Scheduled Task
PID:3180
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\del.bat" "2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2312 -
C:\Windows\system32\vssadmin.exevssadmin delete shadows /all /quiet3⤵
- Interacts with shadow copies
PID:3800
-
-
C:\Windows\System32\Wbem\WMIC.exewmic shadowcopy delete3⤵
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
PID:3436
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c systeminfo > "C:\ProgramData\SysUpdate\Logs\sysinfo.txt"2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5736 -
C:\Windows\system32\systeminfo.exesysteminfo3⤵
- Gathers system information
PID:2756
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c tasklist > "C:\ProgramData\SysUpdate\Logs\tasklist.txt"2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5456 -
C:\Windows\system32\tasklist.exetasklist3⤵
- Discovers running processes
PID:5964
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c whoami > "C:\ProgramData\SysUpdate\Logs\whoami.txt"2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5208 -
C:\Windows\system32\whoami.exewhoami3⤵PID:5944
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c net user > "C:\ProgramData\SysUpdate\Logs\netuser.txt"2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4468 -
C:\Windows\system32\net.exenet user3⤵
- Suspicious use of WriteProcessMemory
PID:4292 -
C:\Windows\system32\net1.exeC:\Windows\system32\net1 user4⤵PID:4284
-
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c ipconfig /all > "C:\ProgramData\SysUpdate\Logs\ipconfig.txt"2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4612 -
C:\Windows\system32\ipconfig.exeipconfig /all3⤵
- Gathers network information
PID:4628
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c netstat -an > "C:\ProgramData\SysUpdate\Logs\netstat.txt"2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5104 -
C:\Windows\system32\NETSTAT.EXEnetstat -an3⤵
- Gathers network information
PID:2580
-
-
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks" /create /tn "RansomwareCheck" /tr "C:\Users\Admin\AppData\Local\Temp\www.flabba.io_chrome.exe" /sc daily /f2⤵
- Scheduled Task/Job: Scheduled Task
PID:3024
-
-
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" C:\Users\Admin\AppData\Local\Temp\createshortcut.vbs2⤵
- Executes a VBScript file via the Windows Script Host.
PID:4444
-
-
C:\Windows\System32\notepad.exe"C:\Windows\System32\notepad.exe"2⤵PID:1964
-
-
C:\Windows\System32\vssadmin.exe"C:\Windows\System32\vssadmin.exe" delete shadows /all /quiet2⤵
- Interacts with shadow copies
PID:4492
-
-
C:\Windows\System32\wbem\WMIC.exe"C:\Windows\System32\wbem\WMIC.exe" shadowcopy delete2⤵
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
PID:5048 -
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV13⤵PID:1948
-
-
-
C:\Windows\System32\net.exe"C:\Windows\System32\net.exe" stop srservice2⤵
- Suspicious use of WriteProcessMemory
PID:6008 -
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop srservice3⤵PID:5276
-
-
-
C:\Windows\System32\netsh.exe"C:\Windows\System32\netsh.exe" advfirewall set allprofiles state off2⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
PID:5464
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" config i8042prt start= disabled2⤵
- Launches sc.exe
PID:4876
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" stop i8042prt2⤵
- Launches sc.exe
PID:2448 -
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV13⤵PID:5288
-
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3608
-
C:\Users\Admin\AppData\Local\Temp\www.flabba.io_chrome.exeC:\Users\Admin\AppData\Local\Temp\www.flabba.io_chrome.exe1⤵PID:4396
-
C:\Users\Admin\AppData\Local\Temp\www.flabba.io_chrome.exeC:\Users\Admin\AppData\Local\Temp\www.flabba.io_chrome.exe1⤵PID:2884
Network
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
4PowerShell
1Visual Basic
1Windows Command Shell
1Scheduled Task/Job
1Scheduled Task
1System Services
2Service Execution
2Windows Management Instrumentation
1Persistence
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
2Create or Modify System Process
4Windows Service
4Event Triggered Execution
2Image File Execution Options Injection
1Netsh Helper DLL
1Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
2Create or Modify System Process
4Windows Service
4Event Triggered Execution
2Image File Execution Options Injection
1Netsh Helper DLL
1Scheduled Task/Job
1Scheduled Task
1Defense Evasion
Direct Volume Access
1Impair Defenses
3Disable or Modify System Firewall
1Disable or Modify Tools
1Indicator Removal
2File Deletion
2Modify Registry
3Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\ProgramData\SysUpdate\Scr\scr_20261015_054047.jpg
- Size 110KB
- SHA256 436dc5c2bdfb6bfcc52ecf8f3546b06b8304df39f73aabcee0344a4eeade9799
- MD5 ffeb1233d011bcb182b3eb366f81559f
- SHA1 96ab70e11ce1eda855fa73eafced0481d6f9e51f
- SHA512 82ee86e5c0195c80a52e59b507b277044596efedfa4d0fab52a4302a88cbbeb5de12d0a206bfae0893622517a53e3677f2bece74163e3fe554957d0cb79f7459
- SSDEEP 1536:S+QintPUNEyCvSlUAP75ZkxQFABDcFuBoooooooooooooooo3ooooooooooooW2f:dntPUGyaSlUqLKuAtcF3qH
- TLSH T10CB3FD539909CB43657892D8BE430FAC2F5A2F0CE8C139EF11661E8B7E653625CCE06D
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\SystemVolumeInformation\doc_2.pdf
- Size 76KB
- SHA256 c258f034ffe3a9660517625a96e19c2c2084f247f218f37542c58624def12e06
- MD5 a208614f528d5410038c74e9656321db
- SHA1 f6975f364087e8e09bbede1cacce26e8a4c41e98
- SHA512 35b42b12da7555b2ed9a789fdf2055d6001ab201f9baba68a4cc019b6708c4af7f81ac60d1136a8c7232c009233a81c4eb2076d493e3f7fbe02f69119cc5412e
- SSDEEP 1536:zOjZTHDKoukdeMBBbkNP3PyKsGw6lDPT8XW1jJiOaMuvc140zzOCJVQwzKP4iM5:zOjZvjukQ6bEsGv1T8XW1jJiOaDUe0zd
- TLSH T1E073F9368F23FCD4277E3D90E0502E462C882E678775767CFA850DA66AA5640CF3D59C
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_gyjbw0ky.dou.ps1
- Size 60B
- SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
- MD5 d17fe0a3f47be24a6453e9ef58c94641
- SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
- SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
- TLSH T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\createshortcut.vbs
- Size 245B
- SHA256 e39fc4a0661bfab6370de47651ae9b6871c7f72c6834c45f4155a1ad92359f0e
- MD5 cd13d14caa972469eb7b0cd046021b42
- SHA1 725e2a57986f3dfee8cbab82fad19a9edcdbdde9
- SHA512 57e210c731a8fef2d3b460331b8aca1c6aa50707c19fdc710fe319cd7021641ff29c3d861162c7c5d04600dbccfd228152806b5445c0ffcec8a6b4b38f5604dc
- TLSH T197D0A79BB248C6B90001127F81F3CE4CE9E5882C3B13BF715AA5DD4E369188589F6543
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\del.bat
- Size 59B
- SHA256 a51f2a0f053ac35b4158bb02b75421ab3698e1d0ee4f926abf1bae3af1570c53
- MD5 9cecbebdcdd60358132849714a3b82f7
- SHA1 be6e20834a5726f3742f05e6bdfaff16118b147f
- SHA512 7b48bd66b4c741d2de2e8b7bc0eab8f438ddc1ed0c73e8b70add9bee400f6640f692884965032616e2d6911a22a17d1d3762421aa49fe021660c9052cfc0675a
- TLSH T13DA002620F961E5469529E5AD73425239D1F104CD1390012F05232903DA98DE0EC2144
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\makelnk.vbs
- Size 246B
- SHA256 8b5ee0b4ef3f8a20e6ecfc904f97a2ee2262bb7041fdfde8daa097c5a6a4d03e
- MD5 7ebaf8a7d5bb37b639eac99a7aa8c04a
- SHA1 bfeda057fc28e7e4630918ee0c6066038028987e
- SHA512 dfc4c009f3255663eda654b7e5884f0c67a6ec4e270cb6089cd273378ed134b7c13846eb6d6f0b40437e684bb88088bfc7e84a17b8c6f7dadb8f5445f3546f5f
- TLSH T191D0A5DBB148C5B90001117F40F3CD4CE5D1442C3F136F315555DD0E378184585F6543
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\temp_steal.log
- Size 147KB
- SHA256 5dfbf62d88cba99d130e40f3a8174b560217465382f47037f0e2d52ea9c0c6b6
- MD5 6ad9bed6f293233d52e32a6afd3cafb0
- SHA1 ca3f5167e1c2d038bf77e46c48e3ef1731b8cf4e
- SHA512 6aeb474902c8e03d470c1bc481b507837caaffa7043f963136ef3e4340af6b9b7550acbc69647608638eb8c2b5e92b1bd92dd82c207e5d08da44fc5696bee3ac
- SSDEEP 1536:7DxJom/Jp9cR0tWFDQhc04IEq3olK5oRXi/Cw5orVWHwV/SvGecBDEjMDWhA:5JoWp9cR0tiN5V+Cw5oIW/SPcBw4DWhA
- TLSH T174E31E04C7B29F3A15460ADF5C1732C0A43DF7B482ECD5BB71A6EE67F0A2DA2C249254
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\Desktop\stolen_data_here.txt
- Size 147KB
- SHA256 04c55e13c4617dde06e6b175fe9a9eeeb41886c8b7f7c048b6d31ba01cfeb42b
- MD5 9591ec94f4454eeb185af57e53905a14
- SHA1 f351972d1e31d01dafbf5a5bf0d974f176683154
- SHA512 ccd15b345821eb61ee57585dbfb7c3e64580c77d95bb6657e254453fdcf1ca57f6515cacb5429ca3bbfa114633f2d26e8570c171ef6e6b5012863436caf566fa
- SSDEEP 1536:JDxJom/Jp9cR0tWFDQhc04IEq3olK5oRXi/Cw5orVWHwV/SvGecBDEjMDWhA:DJoWp9cR0tiN5V+Cw5oIW/SPcBw4DWhA
- TLSH T10EE31E04C7B29F3A15460ADF5C1732C0A43DF7B482ECD5BB71A6EE67F0A6DA2C249254
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\Documents\invoice_1.pdf
- Size 76KB
- SHA256 e3828b581ba01135d8ea431df72ab93ef03acee4a0cfde343bc07e8bd594e4af
- MD5 aef7fcb170876eb6073e5183713c52e3
- SHA1 b1bd440e48719cad533b83686e86ffa7ff3c7061
- SHA512 dd8295acd0e0e456b9f8279b37c96bd2e654fbd7c1377f39043e20ba3a0920b9d0314e8791c0370b83a955512c1bf1e45c34ecf7567a52f3ed37b3e33fc472e1
- SSDEEP 1536:TOjZTHDKoukdeMBBbkNP3PyKsGw6lDPT8XW1jJiOaMuvc140zzOCJVQwzKP4iM+:TOjZvjukQ6bEsGv1T8XW1jJiOaDUe0zq
- TLSH T11E73F8368F22FCD4277E3D90E0503E462C883E6787B5667CFA850DA66AA5640CF3D59C
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\READ_ME_NANOCORE.txt
- Size 145B
- SHA256 7057e5f2042a9706c5d18b7d05214373577eb0293599d361bf66cfba3a3eee4f
- MD5 d7ea02f4c4953d6a3f52b5d0ecbeb047
- SHA1 ce3a66707cabbbeaa0980b91d3b6271fc84145cb
- SHA512 441ac2261f8c29eed640bdddfd5195f9fe5fe5fb0f08a77bbebdb4507819e8717855e5485f554986eb0f69ee55d1fa5939c3f7dc84a333f9d78a15973df56f70
- TLSH T156C02B572EE03298B1C036C20A0A4CA2A76D470CD605C6582A2FC42033001EE2E41130
- MD5 SHA1 SHA512 TLSH
- Path F:\RANSOM_NOTE.txt
- Size 177B
- SHA256 bfd4ed4bcd78100294aeaee2c2b4b8e37fb372b61cdcaa2a14f50ebe4b708e93
- MD5 c381da16f24527b361930429b75608ad
- SHA1 cc68fc2b7246e2b7611b3a1798a7dd3ad5b1c912
- SHA512 e79ae7b36ed481285d8fd080a69e080b637b0eaff67bcb53d0f27c89a984dd70f913d1f69cb306e0b96116b898227814eea36e8e3cfd03302c4455b28da89545
- TLSH T121C0C00B3EC4377822CC21E209018C12914EEA0CAA044254022BC9109EA496D30D44B3
- MD5 SHA1 SHA512 TLSH