3facc445894405f975ef70d3993f6d02c7fe3d143e5ee363bb7d578c6abb0db1

Analysis

max time kernel
125s
max time network
110s
platform
windows10_x64
resource
win10v20210410
submitted
13-05-2021 12:57

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3facc445894405f975ef70d3993f6d02c7fe3d143e5ee363bb7d578c6abb0db1.exe
Size

375KB
MD5

bc22725a285b7498e1b6389462cc59b4
SHA1

f87eee2da7ed9e90fba9453138e57bb983910be0
SHA256

3facc445894405f975ef70d3993f6d02c7fe3d143e5ee363bb7d578c6abb0db1
SHA512

39b73760ddd3bca6654beb7afdbbe94035a6f07eccc4bac9a64261dba67228b86115d213ec69c89d9b68b5b910a0bb70c6f77d52f811367fe207475a38c5783e

Score

10^/10

evasion persistence

Malware Config

Signatures

Modifies visibility of file extensions in Explorer 2 TTPs
evasion

Hidden Files and Directories
T1158

Modify Registry
T1112
Modifies visiblity of hidden/system files in Explorer 2 TTPs
evasion

Hidden Files and Directories
T1158

Modify Registry
T1112

Adds policy Run key to start application 2 TTPs 6 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

WScript.exeWScript.exeWScript.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\RJMQBVDN = "W_X_C.bat"	WScript.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	WScript.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\RJMQBVDN = "W_X_C.bat"	WScript.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	WScript.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\RJMQBVDN = "W_X_C.bat"	WScript.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	WScript.exe

Executes dropped EXE 6 IoCs

Processes:

avscan.exeavscan.exehosts.exeavscan.exehosts.exehosts.exe

pid process

3836 avscan.exe
1104 avscan.exe
2784 hosts.exe
1256 avscan.exe
1680 hosts.exe
3496 hosts.exe

pid	process
3836	avscan.exe
1104	avscan.exe
2784	hosts.exe
1256	avscan.exe
1680	hosts.exe
3496	hosts.exe

Adds Run key to start application 2 TTPs 6 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

avscan.exehosts.exe3facc445894405f975ef70d3993f6d02c7fe3d143e5ee363bb7d578c6abb0db1.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\avscan = "C:\\Users\\Admin\\AppData\\Local\\Temp\\avscan.exe"	avscan.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run	hosts.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\avscan = "C:\\Users\\Admin\\AppData\\Local\\Temp\\avscan.exe"	hosts.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run	3facc445894405f975ef70d3993f6d02c7fe3d143e5ee363bb7d578c6abb0db1.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\avscan = "C:\\Users\\Admin\\AppData\\Local\\Temp\\avscan.exe"	3facc445894405f975ef70d3993f6d02c7fe3d143e5ee363bb7d578c6abb0db1.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run	avscan.exe

Drops file in Windows directory 5 IoCs

Processes:

3facc445894405f975ef70d3993f6d02c7fe3d143e5ee363bb7d578c6abb0db1.exeavscan.exehosts.exe

description	ioc	process
File created	C:\windows\W_X_C.vbs	3facc445894405f975ef70d3993f6d02c7fe3d143e5ee363bb7d578c6abb0db1.exe
File created	\??\c:\windows\W_X_C.bat	3facc445894405f975ef70d3993f6d02c7fe3d143e5ee363bb7d578c6abb0db1.exe
File opened for modification	C:\Windows\hosts.exe	3facc445894405f975ef70d3993f6d02c7fe3d143e5ee363bb7d578c6abb0db1.exe
File opened for modification	C:\Windows\hosts.exe	avscan.exe
File opened for modification	C:\Windows\hosts.exe	hosts.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies registry class 4 IoCs

Processes:

cmd.execmd.exe3facc445894405f975ef70d3993f6d02c7fe3d143e5ee363bb7d578c6abb0db1.execmd.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings	3facc445894405f975ef70d3993f6d02c7fe3d143e5ee363bb7d578c6abb0db1.exe
Key created	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings	cmd.exe

Modifies registry key 1 TTPs 9 IoCs

Modify Registry
T1112

Processes:

REG.exeREG.exeREG.exeREG.exeREG.exeREG.exeREG.exeREG.exeREG.exe

pid process

856 REG.exe
2348 REG.exe
3860 REG.exe
1588 REG.exe
1132 REG.exe
1684 REG.exe
4064 REG.exe
2756 REG.exe
396 REG.exe
Suspicious behavior: GetForegroundWindowSpam 2 IoCs

Processes:

avscan.exehosts.exe

pid process

3836 avscan.exe
2784 hosts.exe

pid	process
856	REG.exe
2348	REG.exe
3860	REG.exe
1588	REG.exe
1132	REG.exe
1684	REG.exe
4064	REG.exe
2756	REG.exe
396	REG.exe

pid	process
3836	avscan.exe
2784	hosts.exe

Suspicious use of SetWindowsHookEx 7 IoCs

Processes:

3facc445894405f975ef70d3993f6d02c7fe3d143e5ee363bb7d578c6abb0db1.exeavscan.exeavscan.exehosts.exeavscan.exehosts.exehosts.exe

pid	process
2208	3facc445894405f975ef70d3993f6d02c7fe3d143e5ee363bb7d578c6abb0db1.exe
3836	avscan.exe
1104	avscan.exe
2784	hosts.exe
1256	avscan.exe
1680	hosts.exe
3496	hosts.exe

Suspicious use of WriteProcessMemory 63 IoCs

Processes:

3facc445894405f975ef70d3993f6d02c7fe3d143e5ee363bb7d578c6abb0db1.exeavscan.execmd.exehosts.execmd.execmd.exe

description	pid	process	target process
PID 2208 wrote to memory of 1588	2208	3facc445894405f975ef70d3993f6d02c7fe3d143e5ee363bb7d578c6abb0db1.exe	REG.exe
PID 2208 wrote to memory of 1588	2208	3facc445894405f975ef70d3993f6d02c7fe3d143e5ee363bb7d578c6abb0db1.exe	REG.exe
PID 2208 wrote to memory of 1588	2208	3facc445894405f975ef70d3993f6d02c7fe3d143e5ee363bb7d578c6abb0db1.exe	REG.exe
PID 2208 wrote to memory of 3836	2208	3facc445894405f975ef70d3993f6d02c7fe3d143e5ee363bb7d578c6abb0db1.exe	avscan.exe
PID 2208 wrote to memory of 3836	2208	3facc445894405f975ef70d3993f6d02c7fe3d143e5ee363bb7d578c6abb0db1.exe	avscan.exe
PID 2208 wrote to memory of 3836	2208	3facc445894405f975ef70d3993f6d02c7fe3d143e5ee363bb7d578c6abb0db1.exe	avscan.exe
PID 3836 wrote to memory of 1104	3836	avscan.exe	avscan.exe
PID 3836 wrote to memory of 1104	3836	avscan.exe	avscan.exe
PID 3836 wrote to memory of 1104	3836	avscan.exe	avscan.exe
PID 3836 wrote to memory of 3952	3836	avscan.exe	cmd.exe
PID 3836 wrote to memory of 3952	3836	avscan.exe	cmd.exe
PID 3836 wrote to memory of 3952	3836	avscan.exe	cmd.exe
PID 2208 wrote to memory of 60	2208	3facc445894405f975ef70d3993f6d02c7fe3d143e5ee363bb7d578c6abb0db1.exe	cmd.exe
PID 2208 wrote to memory of 60	2208	3facc445894405f975ef70d3993f6d02c7fe3d143e5ee363bb7d578c6abb0db1.exe	cmd.exe
PID 2208 wrote to memory of 60	2208	3facc445894405f975ef70d3993f6d02c7fe3d143e5ee363bb7d578c6abb0db1.exe	cmd.exe
PID 60 wrote to memory of 2784	60	cmd.exe	hosts.exe
PID 60 wrote to memory of 2784	60	cmd.exe	hosts.exe
PID 60 wrote to memory of 2784	60	cmd.exe	hosts.exe
PID 2784 wrote to memory of 1256	2784	hosts.exe	avscan.exe
PID 2784 wrote to memory of 1256	2784	hosts.exe	avscan.exe
PID 2784 wrote to memory of 1256	2784	hosts.exe	avscan.exe
PID 2784 wrote to memory of 2420	2784	hosts.exe	cmd.exe
PID 2784 wrote to memory of 2420	2784	hosts.exe	cmd.exe
PID 2784 wrote to memory of 2420	2784	hosts.exe	cmd.exe
PID 3952 wrote to memory of 1680	3952	cmd.exe	hosts.exe
PID 3952 wrote to memory of 1680	3952	cmd.exe	hosts.exe
PID 3952 wrote to memory of 1680	3952	cmd.exe	hosts.exe
PID 60 wrote to memory of 1752	60	cmd.exe	WScript.exe
PID 60 wrote to memory of 1752	60	cmd.exe	WScript.exe
PID 60 wrote to memory of 1752	60	cmd.exe	WScript.exe
PID 2420 wrote to memory of 3496	2420	cmd.exe	hosts.exe
PID 2420 wrote to memory of 3496	2420	cmd.exe	hosts.exe
PID 2420 wrote to memory of 3496	2420	cmd.exe	hosts.exe
PID 3952 wrote to memory of 1104	3952	cmd.exe	WScript.exe
PID 3952 wrote to memory of 1104	3952	cmd.exe	WScript.exe
PID 3952 wrote to memory of 1104	3952	cmd.exe	WScript.exe
PID 2420 wrote to memory of 1684	2420	cmd.exe	WScript.exe
PID 2420 wrote to memory of 1684	2420	cmd.exe	WScript.exe
PID 2420 wrote to memory of 1684	2420	cmd.exe	WScript.exe
PID 3836 wrote to memory of 1132	3836	avscan.exe	REG.exe
PID 3836 wrote to memory of 1132	3836	avscan.exe	REG.exe
PID 3836 wrote to memory of 1132	3836	avscan.exe	REG.exe
PID 2784 wrote to memory of 1684	2784	hosts.exe	REG.exe
PID 2784 wrote to memory of 1684	2784	hosts.exe	REG.exe
PID 2784 wrote to memory of 1684	2784	hosts.exe	REG.exe
PID 3836 wrote to memory of 4064	3836	avscan.exe	REG.exe
PID 3836 wrote to memory of 4064	3836	avscan.exe	REG.exe
PID 3836 wrote to memory of 4064	3836	avscan.exe	REG.exe
PID 2784 wrote to memory of 2756	2784	hosts.exe	REG.exe
PID 2784 wrote to memory of 2756	2784	hosts.exe	REG.exe
PID 2784 wrote to memory of 2756	2784	hosts.exe	REG.exe
PID 3836 wrote to memory of 856	3836	avscan.exe	REG.exe
PID 3836 wrote to memory of 856	3836	avscan.exe	REG.exe
PID 3836 wrote to memory of 856	3836	avscan.exe	REG.exe
PID 2784 wrote to memory of 396	2784	hosts.exe	REG.exe
PID 2784 wrote to memory of 396	2784	hosts.exe	REG.exe
PID 2784 wrote to memory of 396	2784	hosts.exe	REG.exe
PID 3836 wrote to memory of 2348	3836	avscan.exe	REG.exe
PID 3836 wrote to memory of 2348	3836	avscan.exe	REG.exe
PID 3836 wrote to memory of 2348	3836	avscan.exe	REG.exe
PID 2784 wrote to memory of 3860	2784	hosts.exe	REG.exe
PID 2784 wrote to memory of 3860	2784	hosts.exe	REG.exe
PID 2784 wrote to memory of 3860	2784	hosts.exe	REG.exe

C:\Users\Admin\AppData\Local\Temp\3facc445894405f975ef70d3993f6d02c7fe3d143e5ee363bb7d578c6abb0db1.exe
"C:\Users\Admin\AppData\Local\Temp\3facc445894405f975ef70d3993f6d02c7fe3d143e5ee363bb7d578c6abb0db1.exe"
1⤵
- Adds Run key to start application
- Drops file in Windows directory
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2208

C:\Windows\SysWOW64\REG.exe
REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
2⤵
- Modifies registry key
PID:1588

C:\Users\Admin\AppData\Local\Temp\avscan.exe
C:\Users\Admin\AppData\Local\Temp\avscan.exe
2⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3836

C:\Users\Admin\AppData\Local\Temp\avscan.exe
C:\Users\Admin\AppData\Local\Temp\avscan.exe
3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1104

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c c:\windows\W_X_C.bat
3⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3952

C:\windows\hosts.exe
C:\windows\hosts.exe
4⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1680

C:\Windows\SysWOW64\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Windows\W_X_C.vbs"
4⤵
- Adds policy Run key to start application
PID:1104

C:\Windows\SysWOW64\REG.exe
REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
3⤵
- Modifies registry key
PID:1132

C:\Windows\SysWOW64\REG.exe
REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
3⤵
- Modifies registry key
PID:4064

C:\Windows\SysWOW64\REG.exe
REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
3⤵
- Modifies registry key
PID:856

C:\Windows\SysWOW64\REG.exe
REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
3⤵
- Modifies registry key
PID:2348

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c c:\windows\W_X_C.bat
2⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:60

C:\windows\hosts.exe
C:\windows\hosts.exe
3⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2784

C:\Users\Admin\AppData\Local\Temp\avscan.exe
C:\Users\Admin\AppData\Local\Temp\avscan.exe
4⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1256

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c c:\windows\W_X_C.bat
4⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2420

C:\windows\hosts.exe
C:\windows\hosts.exe
5⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:3496

C:\Windows\SysWOW64\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Windows\W_X_C.vbs"
5⤵
- Adds policy Run key to start application
PID:1684

C:\Windows\SysWOW64\REG.exe
REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
4⤵
- Modifies registry key
PID:1684

C:\Windows\SysWOW64\REG.exe
REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
4⤵
- Modifies registry key
PID:2756

C:\Windows\SysWOW64\REG.exe
REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
4⤵
- Modifies registry key
PID:396

C:\Windows\SysWOW64\REG.exe
REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
4⤵
- Modifies registry key
PID:3860

C:\Windows\SysWOW64\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Windows\W_X_C.vbs"
3⤵
- Adds policy Run key to start application
PID:1752

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {3eef301f-b596-4c0b-bd92-013beafce793} -Embedding
1⤵
PID:348

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4036

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Hidden Files and Directories

T1158

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Hidden Files and Directories

T1158

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\avscan.exe
MD5
6de9af0e4728e6c1e130f0412f2d6b28

SHA1
6a435156c35d4bc57daf48c2d49076b28638111a

SHA256
970bc0a44c85aa5c64482897ac813a89eef7618c30dc57fa2c80b6f3afa32c86

SHA512
c2432984b06d57d90fb6b4278fefe41b3f9faac0614807ca6ac77c22c004f6ba4dd8b4e427ab6cf8a7ec9da409732a14a22051d935a56b89d73597e00366080c

Download Submit
C:\Users\Admin\AppData\Local\Temp\avscan.exe
MD5
6de9af0e4728e6c1e130f0412f2d6b28

SHA1
6a435156c35d4bc57daf48c2d49076b28638111a

SHA256
970bc0a44c85aa5c64482897ac813a89eef7618c30dc57fa2c80b6f3afa32c86

SHA512
c2432984b06d57d90fb6b4278fefe41b3f9faac0614807ca6ac77c22c004f6ba4dd8b4e427ab6cf8a7ec9da409732a14a22051d935a56b89d73597e00366080c

Download Submit
C:\Users\Admin\AppData\Local\Temp\avscan.exe
MD5
6de9af0e4728e6c1e130f0412f2d6b28

SHA1
6a435156c35d4bc57daf48c2d49076b28638111a

SHA256
970bc0a44c85aa5c64482897ac813a89eef7618c30dc57fa2c80b6f3afa32c86

SHA512
c2432984b06d57d90fb6b4278fefe41b3f9faac0614807ca6ac77c22c004f6ba4dd8b4e427ab6cf8a7ec9da409732a14a22051d935a56b89d73597e00366080c

Download Submit
C:\Users\Admin\AppData\Local\Temp\avscan.exe
MD5
6de9af0e4728e6c1e130f0412f2d6b28

SHA1
6a435156c35d4bc57daf48c2d49076b28638111a

SHA256
970bc0a44c85aa5c64482897ac813a89eef7618c30dc57fa2c80b6f3afa32c86

SHA512
c2432984b06d57d90fb6b4278fefe41b3f9faac0614807ca6ac77c22c004f6ba4dd8b4e427ab6cf8a7ec9da409732a14a22051d935a56b89d73597e00366080c

Download Submit
C:\Windows\W_X_C.vbs
MD5
1ef29533f8090ea70ed13bfd4067b045

SHA1
e132d5ddf40ffab8aceaca25a20d8808f7edf34d

SHA256
f2a4b9f1fd74f03ebf937c3775d7038214c64d798f5a70d462ee39185c55ba02

SHA512
991821088f965608f3f5d33b15c283a89ff2a4f3703d73253ff346cd78473009c588ae6671872653f67eb5454593085eccba1f204f28ce60013c4c4af95cd91c

Download Submit
C:\Windows\hosts.exe
MD5
c33419c36ea991c0aec60b63b23d8a9a

SHA1
9a0026726dd1ce37ea3b560b4d51b02532652ff8

SHA256
f3938d67a22d8a1bc491501a0e90dbb4f84f247f8719dc1f82b27d30e8496741

SHA512
86e7ffc14d5799e34d26ec13969ec5431a54d3f3ea1fb0a9da00bba0275bfac14f5c266633beff16d1c47fc82feaa8d10230e19c2c6293384eeba6cd060d9656

Download Submit
C:\Windows\hosts.exe
MD5
c33419c36ea991c0aec60b63b23d8a9a

SHA1
9a0026726dd1ce37ea3b560b4d51b02532652ff8

SHA256
f3938d67a22d8a1bc491501a0e90dbb4f84f247f8719dc1f82b27d30e8496741

SHA512
86e7ffc14d5799e34d26ec13969ec5431a54d3f3ea1fb0a9da00bba0275bfac14f5c266633beff16d1c47fc82feaa8d10230e19c2c6293384eeba6cd060d9656

Download Submit
C:\Windows\hosts.exe
MD5
c33419c36ea991c0aec60b63b23d8a9a

SHA1
9a0026726dd1ce37ea3b560b4d51b02532652ff8

SHA256
f3938d67a22d8a1bc491501a0e90dbb4f84f247f8719dc1f82b27d30e8496741

SHA512
86e7ffc14d5799e34d26ec13969ec5431a54d3f3ea1fb0a9da00bba0275bfac14f5c266633beff16d1c47fc82feaa8d10230e19c2c6293384eeba6cd060d9656

Download Submit
C:\Windows\hosts.exe
MD5
c33419c36ea991c0aec60b63b23d8a9a

SHA1
9a0026726dd1ce37ea3b560b4d51b02532652ff8

SHA256
f3938d67a22d8a1bc491501a0e90dbb4f84f247f8719dc1f82b27d30e8496741

SHA512
86e7ffc14d5799e34d26ec13969ec5431a54d3f3ea1fb0a9da00bba0275bfac14f5c266633beff16d1c47fc82feaa8d10230e19c2c6293384eeba6cd060d9656

Download Submit
C:\windows\hosts.exe
MD5
c33419c36ea991c0aec60b63b23d8a9a

SHA1
9a0026726dd1ce37ea3b560b4d51b02532652ff8

SHA256
f3938d67a22d8a1bc491501a0e90dbb4f84f247f8719dc1f82b27d30e8496741

SHA512
86e7ffc14d5799e34d26ec13969ec5431a54d3f3ea1fb0a9da00bba0275bfac14f5c266633beff16d1c47fc82feaa8d10230e19c2c6293384eeba6cd060d9656

Download Submit
\??\c:\windows\W_X_C.bat
MD5
4db9f8b6175722b62ececeeeba1ce307

SHA1
3b3ba8414706e72a6fa19e884a97b87609e11e47

SHA256
d2150b9e5a4ce55e140f0ca91c4e300715d42095c8fddf58c77037cdd2cfaf78

SHA512
1d6dc274cf7a3dd704f840e6a5ad57ab4c4e35d5f09489aeff520bb797e1c825bac53fc335156fe41e767a46520d031855fe42fe7b175409ebe5e9e986fb9b8b

Download Submit
memory/60-138-0x0000000000000000-mapping.dmp

Download
memory/396-185-0x0000000000000000-mapping.dmp

Download
memory/856-184-0x0000000000000000-mapping.dmp

Download
memory/1104-131-0x0000000066000000-0x0000000066153000-memory.dmp

Filesize
1.3MB

Download
memory/1104-171-0x0000000000000000-mapping.dmp

Download
memory/1104-129-0x0000000000000000-mapping.dmp

Download
memory/1132-180-0x0000000000000000-mapping.dmp

Download
memory/1256-151-0x0000000066000000-0x0000000066153000-memory.dmp

Filesize
1.3MB

Download
memory/1256-149-0x0000000000000000-mapping.dmp

Download
memory/1588-120-0x0000000000000000-mapping.dmp

Download
memory/1680-159-0x0000000066000000-0x0000000066153000-memory.dmp

Filesize
1.3MB

Download
memory/1680-156-0x0000000000000000-mapping.dmp

Download
memory/1684-177-0x0000000000000000-mapping.dmp

Download
memory/1684-181-0x0000000000000000-mapping.dmp

Download
memory/1752-160-0x0000000000000000-mapping.dmp

Download
memory/2208-115-0x0000000000400000-0x0000000000425000-memory.dmp

Filesize
148KB

Download
memory/2208-116-0x0000000000030000-0x0000000000034000-memory.dmp

Filesize
16KB

Download
memory/2208-117-0x0000000000401000-0x000000000041D000-memory.dmp

Filesize
112KB

Download
memory/2208-114-0x0000000066000000-0x0000000066153000-memory.dmp

Filesize
1.3MB

Download
memory/2348-186-0x0000000000000000-mapping.dmp

Download
memory/2420-155-0x0000000000000000-mapping.dmp

Download
memory/2756-183-0x0000000000000000-mapping.dmp

Download
memory/2784-142-0x0000000000000000-mapping.dmp

Download
memory/2784-145-0x0000000066000000-0x0000000066153000-memory.dmp

Filesize
1.3MB

Download
memory/3496-170-0x0000000000000000-mapping.dmp

Download
memory/3496-173-0x0000000066000000-0x0000000066153000-memory.dmp

Filesize
1.3MB

Download
memory/3836-121-0x0000000000000000-mapping.dmp

Download
memory/3836-124-0x0000000066000000-0x0000000066153000-memory.dmp

Filesize
1.3MB

Download
memory/3860-187-0x0000000000000000-mapping.dmp

Download
memory/3952-136-0x0000000000000000-mapping.dmp

Download
memory/4064-182-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads