f48a7dd16b186a612101118825d9149e5bdbdd73686c30a8fc05352a3e20bcb3

Analysis

max time kernel
134s
max time network
54s
platform
windows10_x64
resource
win10v20210408
submitted
13-05-2021 12:53

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

f48a7dd16b186a612101118825d9149e5bdbdd73686c30a8fc05352a3e20bcb3.exe
Size

414KB
MD5

bf1583e63f772d707c116cc80c76e3d7
SHA1

7442f1317aeb7fdd6da7274e8abe115f20a5958b
SHA256

f48a7dd16b186a612101118825d9149e5bdbdd73686c30a8fc05352a3e20bcb3
SHA512

b0770e6edeebd12e19a6facb14b7537a88ecfbd5f670cf80a6c4a55ff5bb3f9268e9c7f786b2c6aaffecec663a3b457e8aefbfcc24d05fbec0d542e17d4e04e7

Score

10^/10

evasion persistence

Malware Config

Signatures

Modifies visibility of file extensions in Explorer 2 TTPs
evasion

Hidden Files and Directories
T1158

Modify Registry
T1112
Modifies visiblity of hidden/system files in Explorer 2 TTPs
evasion

Hidden Files and Directories
T1158

Modify Registry
T1112

Adds policy Run key to start application 2 TTPs 6 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

WScript.exeWScript.exeWScript.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	WScript.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	WScript.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\GFBFPSXA = "W_X_C.bat"	WScript.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	WScript.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\GFBFPSXA = "W_X_C.bat"	WScript.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\GFBFPSXA = "W_X_C.bat"	WScript.exe

Executes dropped EXE 6 IoCs

Processes:

avscan.exeavscan.exehosts.exehosts.exeavscan.exehosts.exe

pid process

2608 avscan.exe
1588 avscan.exe
2112 hosts.exe
2976 hosts.exe
3920 avscan.exe
2384 hosts.exe

pid	process
2608	avscan.exe
1588	avscan.exe
2112	hosts.exe
2976	hosts.exe
3920	avscan.exe
2384	hosts.exe

Adds Run key to start application 2 TTPs 6 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

f48a7dd16b186a612101118825d9149e5bdbdd73686c30a8fc05352a3e20bcb3.exeavscan.exehosts.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run	f48a7dd16b186a612101118825d9149e5bdbdd73686c30a8fc05352a3e20bcb3.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\avscan = "C:\\Users\\Admin\\AppData\\Local\\Temp\\avscan.exe"	f48a7dd16b186a612101118825d9149e5bdbdd73686c30a8fc05352a3e20bcb3.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run	avscan.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\avscan = "C:\\Users\\Admin\\AppData\\Local\\Temp\\avscan.exe"	avscan.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run	hosts.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\avscan = "C:\\Users\\Admin\\AppData\\Local\\Temp\\avscan.exe"	hosts.exe

Drops file in Windows directory 5 IoCs

Processes:

avscan.exehosts.exef48a7dd16b186a612101118825d9149e5bdbdd73686c30a8fc05352a3e20bcb3.exe

description	ioc	process
File opened for modification	C:\Windows\hosts.exe	avscan.exe
File opened for modification	C:\Windows\hosts.exe	hosts.exe
File created	C:\windows\W_X_C.vbs	f48a7dd16b186a612101118825d9149e5bdbdd73686c30a8fc05352a3e20bcb3.exe
File created	\??\c:\windows\W_X_C.bat	f48a7dd16b186a612101118825d9149e5bdbdd73686c30a8fc05352a3e20bcb3.exe
File opened for modification	C:\Windows\hosts.exe	f48a7dd16b186a612101118825d9149e5bdbdd73686c30a8fc05352a3e20bcb3.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies registry class 4 IoCs

Processes:

cmd.execmd.execmd.exef48a7dd16b186a612101118825d9149e5bdbdd73686c30a8fc05352a3e20bcb3.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings	f48a7dd16b186a612101118825d9149e5bdbdd73686c30a8fc05352a3e20bcb3.exe

Modifies registry key 1 TTPs 9 IoCs

Modify Registry
T1112

Processes:

REG.exeREG.exeREG.exeREG.exeREG.exeREG.exeREG.exeREG.exeREG.exe

pid process

3420 REG.exe
1348 REG.exe
2888 REG.exe
3620 REG.exe
3856 REG.exe
64 REG.exe
2292 REG.exe
2644 REG.exe
3028 REG.exe
Suspicious behavior: GetForegroundWindowSpam 3 IoCs

Processes:

f48a7dd16b186a612101118825d9149e5bdbdd73686c30a8fc05352a3e20bcb3.exeavscan.exehosts.exe

pid process

1000 f48a7dd16b186a612101118825d9149e5bdbdd73686c30a8fc05352a3e20bcb3.exe
2608 avscan.exe
2112 hosts.exe

pid	process
3420	REG.exe
1348	REG.exe
2888	REG.exe
3620	REG.exe
3856	REG.exe
64	REG.exe
2292	REG.exe
2644	REG.exe
3028	REG.exe

Suspicious use of SetWindowsHookEx 7 IoCs

Processes:

f48a7dd16b186a612101118825d9149e5bdbdd73686c30a8fc05352a3e20bcb3.exeavscan.exeavscan.exehosts.exehosts.exeavscan.exehosts.exe

pid	process
1000	f48a7dd16b186a612101118825d9149e5bdbdd73686c30a8fc05352a3e20bcb3.exe
2608	avscan.exe
1588	avscan.exe
2112	hosts.exe
2976	hosts.exe
3920	avscan.exe
2384	hosts.exe

Suspicious use of WriteProcessMemory 63 IoCs

Processes:

f48a7dd16b186a612101118825d9149e5bdbdd73686c30a8fc05352a3e20bcb3.exeavscan.execmd.execmd.exehosts.execmd.exe

description	pid	process	target process
PID 1000 wrote to memory of 3620	1000	f48a7dd16b186a612101118825d9149e5bdbdd73686c30a8fc05352a3e20bcb3.exe	REG.exe
PID 1000 wrote to memory of 3620	1000	f48a7dd16b186a612101118825d9149e5bdbdd73686c30a8fc05352a3e20bcb3.exe	REG.exe
PID 1000 wrote to memory of 3620	1000	f48a7dd16b186a612101118825d9149e5bdbdd73686c30a8fc05352a3e20bcb3.exe	REG.exe
PID 1000 wrote to memory of 2608	1000	f48a7dd16b186a612101118825d9149e5bdbdd73686c30a8fc05352a3e20bcb3.exe	avscan.exe
PID 1000 wrote to memory of 2608	1000	f48a7dd16b186a612101118825d9149e5bdbdd73686c30a8fc05352a3e20bcb3.exe	avscan.exe
PID 1000 wrote to memory of 2608	1000	f48a7dd16b186a612101118825d9149e5bdbdd73686c30a8fc05352a3e20bcb3.exe	avscan.exe
PID 2608 wrote to memory of 1588	2608	avscan.exe	avscan.exe
PID 2608 wrote to memory of 1588	2608	avscan.exe	avscan.exe
PID 2608 wrote to memory of 1588	2608	avscan.exe	avscan.exe
PID 2608 wrote to memory of 2616	2608	avscan.exe	cmd.exe
PID 2608 wrote to memory of 2616	2608	avscan.exe	cmd.exe
PID 2608 wrote to memory of 2616	2608	avscan.exe	cmd.exe
PID 1000 wrote to memory of 2700	1000	f48a7dd16b186a612101118825d9149e5bdbdd73686c30a8fc05352a3e20bcb3.exe	cmd.exe
PID 1000 wrote to memory of 2700	1000	f48a7dd16b186a612101118825d9149e5bdbdd73686c30a8fc05352a3e20bcb3.exe	cmd.exe
PID 1000 wrote to memory of 2700	1000	f48a7dd16b186a612101118825d9149e5bdbdd73686c30a8fc05352a3e20bcb3.exe	cmd.exe
PID 2700 wrote to memory of 2976	2700	cmd.exe	hosts.exe
PID 2700 wrote to memory of 2976	2700	cmd.exe	hosts.exe
PID 2700 wrote to memory of 2976	2700	cmd.exe	hosts.exe
PID 2616 wrote to memory of 2112	2616	cmd.exe	hosts.exe
PID 2616 wrote to memory of 2112	2616	cmd.exe	hosts.exe
PID 2616 wrote to memory of 2112	2616	cmd.exe	hosts.exe
PID 2112 wrote to memory of 3920	2112	hosts.exe	avscan.exe
PID 2112 wrote to memory of 3920	2112	hosts.exe	avscan.exe
PID 2112 wrote to memory of 3920	2112	hosts.exe	avscan.exe
PID 2112 wrote to memory of 2648	2112	hosts.exe	cmd.exe
PID 2112 wrote to memory of 2648	2112	hosts.exe	cmd.exe
PID 2112 wrote to memory of 2648	2112	hosts.exe	cmd.exe
PID 2648 wrote to memory of 2384	2648	cmd.exe	hosts.exe
PID 2648 wrote to memory of 2384	2648	cmd.exe	hosts.exe
PID 2648 wrote to memory of 2384	2648	cmd.exe	hosts.exe
PID 2700 wrote to memory of 1164	2700	cmd.exe	WScript.exe
PID 2700 wrote to memory of 1164	2700	cmd.exe	WScript.exe
PID 2700 wrote to memory of 1164	2700	cmd.exe	WScript.exe
PID 2648 wrote to memory of 2020	2648	cmd.exe	WScript.exe
PID 2648 wrote to memory of 2020	2648	cmd.exe	WScript.exe
PID 2648 wrote to memory of 2020	2648	cmd.exe	WScript.exe
PID 2616 wrote to memory of 3000	2616	cmd.exe	WScript.exe
PID 2616 wrote to memory of 3000	2616	cmd.exe	WScript.exe
PID 2616 wrote to memory of 3000	2616	cmd.exe	WScript.exe
PID 2608 wrote to memory of 3028	2608	avscan.exe	REG.exe
PID 2608 wrote to memory of 3028	2608	avscan.exe	REG.exe
PID 2608 wrote to memory of 3028	2608	avscan.exe	REG.exe
PID 2112 wrote to memory of 3420	2112	hosts.exe	REG.exe
PID 2112 wrote to memory of 3420	2112	hosts.exe	REG.exe
PID 2112 wrote to memory of 3420	2112	hosts.exe	REG.exe
PID 2608 wrote to memory of 1348	2608	avscan.exe	REG.exe
PID 2608 wrote to memory of 1348	2608	avscan.exe	REG.exe
PID 2608 wrote to memory of 1348	2608	avscan.exe	REG.exe
PID 2112 wrote to memory of 2888	2112	hosts.exe	REG.exe
PID 2112 wrote to memory of 2888	2112	hosts.exe	REG.exe
PID 2112 wrote to memory of 2888	2112	hosts.exe	REG.exe
PID 2608 wrote to memory of 3856	2608	avscan.exe	REG.exe
PID 2608 wrote to memory of 3856	2608	avscan.exe	REG.exe
PID 2608 wrote to memory of 3856	2608	avscan.exe	REG.exe
PID 2112 wrote to memory of 64	2112	hosts.exe	REG.exe
PID 2112 wrote to memory of 64	2112	hosts.exe	REG.exe
PID 2112 wrote to memory of 64	2112	hosts.exe	REG.exe
PID 2608 wrote to memory of 2292	2608	avscan.exe	REG.exe
PID 2608 wrote to memory of 2292	2608	avscan.exe	REG.exe
PID 2608 wrote to memory of 2292	2608	avscan.exe	REG.exe
PID 2112 wrote to memory of 2644	2112	hosts.exe	REG.exe
PID 2112 wrote to memory of 2644	2112	hosts.exe	REG.exe
PID 2112 wrote to memory of 2644	2112	hosts.exe	REG.exe

C:\Users\Admin\AppData\Local\Temp\f48a7dd16b186a612101118825d9149e5bdbdd73686c30a8fc05352a3e20bcb3.exe
"C:\Users\Admin\AppData\Local\Temp\f48a7dd16b186a612101118825d9149e5bdbdd73686c30a8fc05352a3e20bcb3.exe"
1⤵
- Adds Run key to start application
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1000

C:\Windows\SysWOW64\REG.exe
REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
2⤵
- Modifies registry key
PID:3620

C:\Users\Admin\AppData\Local\Temp\avscan.exe
C:\Users\Admin\AppData\Local\Temp\avscan.exe
2⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2608

C:\Users\Admin\AppData\Local\Temp\avscan.exe
C:\Users\Admin\AppData\Local\Temp\avscan.exe
3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1588

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c c:\windows\W_X_C.bat
3⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2616

C:\windows\hosts.exe
C:\windows\hosts.exe
4⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2112

C:\Users\Admin\AppData\Local\Temp\avscan.exe
C:\Users\Admin\AppData\Local\Temp\avscan.exe
5⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:3920

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c c:\windows\W_X_C.bat
5⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2648

C:\windows\hosts.exe
C:\windows\hosts.exe
6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2384

C:\Windows\SysWOW64\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Windows\W_X_C.vbs"
6⤵
- Adds policy Run key to start application
PID:2020

C:\Windows\SysWOW64\REG.exe
REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
5⤵
- Modifies registry key
PID:3420

C:\Windows\SysWOW64\REG.exe
REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
5⤵
- Modifies registry key
PID:2888

C:\Windows\SysWOW64\REG.exe
REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
5⤵
- Modifies registry key
PID:64

C:\Windows\SysWOW64\REG.exe
REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
5⤵
- Modifies registry key
PID:2644

C:\Windows\SysWOW64\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Windows\W_X_C.vbs"
4⤵
- Adds policy Run key to start application
PID:3000

C:\Windows\SysWOW64\REG.exe
REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
3⤵
- Modifies registry key
PID:3028

C:\Windows\SysWOW64\REG.exe
REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
3⤵
- Modifies registry key
PID:1348

C:\Windows\SysWOW64\REG.exe
REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
3⤵
- Modifies registry key
PID:3856

C:\Windows\SysWOW64\REG.exe
REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
3⤵
- Modifies registry key
PID:2292

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c c:\windows\W_X_C.bat
2⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2700

C:\windows\hosts.exe
C:\windows\hosts.exe
3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2976

C:\Windows\SysWOW64\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Windows\W_X_C.vbs"
3⤵
- Adds policy Run key to start application
PID:1164

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:1484

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Hidden Files and Directories

T1158

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Hidden Files and Directories

T1158

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\avscan.exe
MD5
4ae0047bdae14ccdde1a43907726d921

SHA1
f8abf3c61e32fcddd678fadf37d47c69a2d2179e

SHA256
9b25e63e883bd7d516e4a80c1ff63adf457a634ae03c43cfe97f93592cd37cbe

SHA512
437d59224063d7ce683762d1d0e025163b109dc80561f8bb5612df2e69ecfe7f7ee339e254d088eed7ae3f15e896f52ea7f574f5697d7dfaf8f27810dfe7efbc

Download Submit
C:\Users\Admin\AppData\Local\Temp\avscan.exe
MD5
4ae0047bdae14ccdde1a43907726d921

SHA1
f8abf3c61e32fcddd678fadf37d47c69a2d2179e

SHA256
9b25e63e883bd7d516e4a80c1ff63adf457a634ae03c43cfe97f93592cd37cbe

SHA512
437d59224063d7ce683762d1d0e025163b109dc80561f8bb5612df2e69ecfe7f7ee339e254d088eed7ae3f15e896f52ea7f574f5697d7dfaf8f27810dfe7efbc

Download Submit
C:\Users\Admin\AppData\Local\Temp\avscan.exe
MD5
4ae0047bdae14ccdde1a43907726d921

SHA1
f8abf3c61e32fcddd678fadf37d47c69a2d2179e

SHA256
9b25e63e883bd7d516e4a80c1ff63adf457a634ae03c43cfe97f93592cd37cbe

SHA512
437d59224063d7ce683762d1d0e025163b109dc80561f8bb5612df2e69ecfe7f7ee339e254d088eed7ae3f15e896f52ea7f574f5697d7dfaf8f27810dfe7efbc

Download Submit
C:\Users\Admin\AppData\Local\Temp\avscan.exe
MD5
4ae0047bdae14ccdde1a43907726d921

SHA1
f8abf3c61e32fcddd678fadf37d47c69a2d2179e

SHA256
9b25e63e883bd7d516e4a80c1ff63adf457a634ae03c43cfe97f93592cd37cbe

SHA512
437d59224063d7ce683762d1d0e025163b109dc80561f8bb5612df2e69ecfe7f7ee339e254d088eed7ae3f15e896f52ea7f574f5697d7dfaf8f27810dfe7efbc

Download Submit
C:\Windows\W_X_C.vbs
MD5
56f244ad0dfcdd0da2b8d260e2393116

SHA1
38f6054606babdcf6b802e5d142a4ea4a033cca3

SHA256
604dc87b988ded73d2266948fadd4584a8bf8e9f3118bcb96e15b03f27f7179e

SHA512
e52a2736aa7405df61aa8d473e3be06734dca45410f66666c687c25248b9789eb398d6e01bb4438a8219fbb771f2b86c009e6193f014d1b38d1b5250dc3b667c

Download Submit
C:\Windows\hosts.exe
MD5
3856821090be5f490ff1efc886a6a5cb

SHA1
8e0e98d850d1d684c66ef7fab3c159f86eeb33b9

SHA256
115e9757eae768c96b4c27ab610fa84fd78ad42095b587a778546e8e23fc1d7e

SHA512
b0772e2c8c5f06ed3bd70eb703927e9d53d68bd0d6727eb1472301b8fe8602731d91ff9a93e0a1a3632aab8a2c818437ba5d1fa953603dcf1b20072a5041749e

Download Submit
C:\Windows\hosts.exe
MD5
3856821090be5f490ff1efc886a6a5cb

SHA1
8e0e98d850d1d684c66ef7fab3c159f86eeb33b9

SHA256
115e9757eae768c96b4c27ab610fa84fd78ad42095b587a778546e8e23fc1d7e

SHA512
b0772e2c8c5f06ed3bd70eb703927e9d53d68bd0d6727eb1472301b8fe8602731d91ff9a93e0a1a3632aab8a2c818437ba5d1fa953603dcf1b20072a5041749e

Download Submit
C:\Windows\hosts.exe
MD5
3856821090be5f490ff1efc886a6a5cb

SHA1
8e0e98d850d1d684c66ef7fab3c159f86eeb33b9

SHA256
115e9757eae768c96b4c27ab610fa84fd78ad42095b587a778546e8e23fc1d7e

SHA512
b0772e2c8c5f06ed3bd70eb703927e9d53d68bd0d6727eb1472301b8fe8602731d91ff9a93e0a1a3632aab8a2c818437ba5d1fa953603dcf1b20072a5041749e

Download Submit
C:\Windows\hosts.exe
MD5
3856821090be5f490ff1efc886a6a5cb

SHA1
8e0e98d850d1d684c66ef7fab3c159f86eeb33b9

SHA256
115e9757eae768c96b4c27ab610fa84fd78ad42095b587a778546e8e23fc1d7e

SHA512
b0772e2c8c5f06ed3bd70eb703927e9d53d68bd0d6727eb1472301b8fe8602731d91ff9a93e0a1a3632aab8a2c818437ba5d1fa953603dcf1b20072a5041749e

Download Submit
C:\windows\hosts.exe
MD5
3856821090be5f490ff1efc886a6a5cb

SHA1
8e0e98d850d1d684c66ef7fab3c159f86eeb33b9

SHA256
115e9757eae768c96b4c27ab610fa84fd78ad42095b587a778546e8e23fc1d7e

SHA512
b0772e2c8c5f06ed3bd70eb703927e9d53d68bd0d6727eb1472301b8fe8602731d91ff9a93e0a1a3632aab8a2c818437ba5d1fa953603dcf1b20072a5041749e

Download Submit
\??\c:\windows\W_X_C.bat
MD5
4db9f8b6175722b62ececeeeba1ce307

SHA1
3b3ba8414706e72a6fa19e884a97b87609e11e47

SHA256
d2150b9e5a4ce55e140f0ca91c4e300715d42095c8fddf58c77037cdd2cfaf78

SHA512
1d6dc274cf7a3dd704f840e6a5ad57ab4c4e35d5f09489aeff520bb797e1c825bac53fc335156fe41e767a46520d031855fe42fe7b175409ebe5e9e986fb9b8b

Download Submit
memory/64-185-0x0000000000000000-mapping.dmp

Download
memory/1000-114-0x0000000000030000-0x0000000000034000-memory.dmp

Filesize
16KB

Download
memory/1000-115-0x0000000066000000-0x0000000066153000-memory.dmp

Filesize
1.3MB

Download
memory/1000-116-0x0000000000400000-0x0000000000425000-memory.dmp

Filesize
148KB

Download
memory/1000-119-0x0000000000401000-0x000000000041D000-memory.dmp

Filesize
112KB

Download
memory/1164-176-0x0000000000000000-mapping.dmp

Download
memory/1348-182-0x0000000000000000-mapping.dmp

Download
memory/1588-129-0x0000000000000000-mapping.dmp

Download
memory/1588-131-0x0000000066000000-0x0000000066153000-memory.dmp

Filesize
1.3MB

Download
memory/2020-177-0x0000000000000000-mapping.dmp

Download
memory/2112-147-0x0000000066000000-0x0000000066153000-memory.dmp

Filesize
1.3MB

Download
memory/2112-143-0x0000000000000000-mapping.dmp

Download
memory/2292-186-0x0000000000000000-mapping.dmp

Download
memory/2384-171-0x0000000066000000-0x0000000066153000-memory.dmp

Filesize
1.3MB

Download
memory/2384-168-0x0000000000000000-mapping.dmp

Download
memory/2608-121-0x0000000000000000-mapping.dmp

Download
memory/2608-124-0x0000000066000000-0x0000000066153000-memory.dmp

Filesize
1.3MB

Download
memory/2616-139-0x0000000000000000-mapping.dmp

Download
memory/2644-187-0x0000000000000000-mapping.dmp

Download
memory/2648-167-0x0000000000000000-mapping.dmp

Download
memory/2700-140-0x0000000000000000-mapping.dmp

Download
memory/2888-183-0x0000000000000000-mapping.dmp

Download
memory/2976-148-0x0000000066000000-0x0000000066153000-memory.dmp

Filesize
1.3MB

Download
memory/2976-142-0x0000000000000000-mapping.dmp

Download
memory/3000-175-0x0000000000000000-mapping.dmp

Download
memory/3028-180-0x0000000000000000-mapping.dmp

Download
memory/3420-181-0x0000000000000000-mapping.dmp

Download
memory/3620-120-0x0000000000000000-mapping.dmp

Download
memory/3856-184-0x0000000000000000-mapping.dmp

Download
memory/3920-157-0x0000000066000000-0x0000000066153000-memory.dmp

Filesize
1.3MB

Download
memory/3920-155-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads