2cd8889544fbbdf7f6dd2b1b1488ca807ff471891fe3376213a6bd06bbb85472

Analysis

max time kernel
132s
max time network
136s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
19/09/2022, 09:49

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

2cd8889544fbbdf7f6dd2b1b1488ca807ff471891fe3376213a6bd06bbb85472.exe
Size

246KB
MD5

2b3349497a043955fc62d4d2904db91b
SHA1

6c12d6b6827a5a74d5a8386b98a47df81f0210f0
SHA256

2cd8889544fbbdf7f6dd2b1b1488ca807ff471891fe3376213a6bd06bbb85472
SHA512

b07c093c44a67e9a21007e74bfb9bf76288584ec1bd742752244e9bdab8e302066c729778cdc31db442f7507c429c3c77e409e6c24068861772dd18afde85df4
SSDEEP

3072:obpDCw1p3vmLvsZIaVwiwDcIbDHDCmkMB07sGhD83uj4VwI+04rIqK0dEqvz:gDCwfG1bnxpBnOQ3ujVzKv0Sqvz

Score

10^/10

evasion persistence

Malware Config

Signatures

Modifies visibility of file extensions in Explorer 2 TTPs 3 IoCs

evasion

Hidden Files and Directories

T1158

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	2cd8889544fbbdf7f6dd2b1b1488ca807ff471891fe3376213a6bd06bbb85472.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	avscan.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	hosts.exe

Modifies visiblity of hidden/system files in Explorer 2 TTPs 3 IoCs

evasion

Hidden Files and Directories

T1158

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	avscan.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	hosts.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	2cd8889544fbbdf7f6dd2b1b1488ca807ff471891fe3376213a6bd06bbb85472.exe

Adds policy Run key to start application 2 TTPs 6 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	WScript.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	WScript.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\XZIOFAVD = "W_X_C.bat"	WScript.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	WScript.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\XZIOFAVD = "W_X_C.bat"	WScript.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\XZIOFAVD = "W_X_C.bat"	WScript.exe

Executes dropped EXE 6 IoCs

pid	Process
1624	avscan.exe
4216	avscan.exe
4528	hosts.exe
3680	hosts.exe
1312	avscan.exe
764	hosts.exe

Checks computer location settings 2 TTPs 3 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\Geo\Nation	cmd.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\Geo\Nation	cmd.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\Geo\Nation	cmd.exe

Adds Run key to start application 2 TTPs 6 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\avscan = "C:\\Users\\Admin\\AppData\\Local\\Temp\\avscan.exe"	2cd8889544fbbdf7f6dd2b1b1488ca807ff471891fe3376213a6bd06bbb85472.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run	avscan.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\avscan = "C:\\Users\\Admin\\AppData\\Local\\Temp\\avscan.exe"	avscan.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run	hosts.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\avscan = "C:\\Users\\Admin\\AppData\\Local\\Temp\\avscan.exe"	hosts.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run	2cd8889544fbbdf7f6dd2b1b1488ca807ff471891fe3376213a6bd06bbb85472.exe

Drops file in Windows directory 5 IoCs

description	ioc	Process
File created	C:\windows\W_X_C.vbs	2cd8889544fbbdf7f6dd2b1b1488ca807ff471891fe3376213a6bd06bbb85472.exe
File created	\??\c:\windows\W_X_C.bat	2cd8889544fbbdf7f6dd2b1b1488ca807ff471891fe3376213a6bd06bbb85472.exe
File opened for modification	C:\Windows\hosts.exe	2cd8889544fbbdf7f6dd2b1b1488ca807ff471891fe3376213a6bd06bbb85472.exe
File opened for modification	C:\Windows\hosts.exe	avscan.exe
File opened for modification	C:\Windows\hosts.exe	hosts.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies registry class 4 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000_Classes\Local Settings	2cd8889544fbbdf7f6dd2b1b1488ca807ff471891fe3376213a6bd06bbb85472.exe
Key created	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000_Classes\Local Settings	cmd.exe

Modifies registry key 1 TTPs 9 IoCs

Modify Registry

T1112

pid	Process
3488	REG.exe
3228	REG.exe
2332	REG.exe
2480	REG.exe
4496	REG.exe
944	REG.exe
364	REG.exe
2792	REG.exe
1080	REG.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

pid	Process
1624	avscan.exe
4528	hosts.exe

Suspicious use of SetWindowsHookEx 7 IoCs

pid	Process
4760	2cd8889544fbbdf7f6dd2b1b1488ca807ff471891fe3376213a6bd06bbb85472.exe
1624	avscan.exe
4216	avscan.exe
3680	hosts.exe
4528	hosts.exe
1312	avscan.exe
764	hosts.exe

Suspicious use of WriteProcessMemory 63 IoCs

description	pid	Process	procid_target
PID 4760 wrote to memory of 3488	4760	2cd8889544fbbdf7f6dd2b1b1488ca807ff471891fe3376213a6bd06bbb85472.exe	81
PID 4760 wrote to memory of 3488	4760	2cd8889544fbbdf7f6dd2b1b1488ca807ff471891fe3376213a6bd06bbb85472.exe	81
PID 4760 wrote to memory of 3488	4760	2cd8889544fbbdf7f6dd2b1b1488ca807ff471891fe3376213a6bd06bbb85472.exe	81
PID 4760 wrote to memory of 1624	4760	2cd8889544fbbdf7f6dd2b1b1488ca807ff471891fe3376213a6bd06bbb85472.exe	83
PID 4760 wrote to memory of 1624	4760	2cd8889544fbbdf7f6dd2b1b1488ca807ff471891fe3376213a6bd06bbb85472.exe	83
PID 4760 wrote to memory of 1624	4760	2cd8889544fbbdf7f6dd2b1b1488ca807ff471891fe3376213a6bd06bbb85472.exe	83
PID 1624 wrote to memory of 4216	1624	avscan.exe	84
PID 1624 wrote to memory of 4216	1624	avscan.exe	84
PID 1624 wrote to memory of 4216	1624	avscan.exe	84
PID 1624 wrote to memory of 3308	1624	avscan.exe	85
PID 1624 wrote to memory of 3308	1624	avscan.exe	85
PID 1624 wrote to memory of 3308	1624	avscan.exe	85
PID 4760 wrote to memory of 4336	4760	2cd8889544fbbdf7f6dd2b1b1488ca807ff471891fe3376213a6bd06bbb85472.exe	86
PID 4760 wrote to memory of 4336	4760	2cd8889544fbbdf7f6dd2b1b1488ca807ff471891fe3376213a6bd06bbb85472.exe	86
PID 4760 wrote to memory of 4336	4760	2cd8889544fbbdf7f6dd2b1b1488ca807ff471891fe3376213a6bd06bbb85472.exe	86
PID 3308 wrote to memory of 3680	3308	cmd.exe	90
PID 3308 wrote to memory of 3680	3308	cmd.exe	90
PID 3308 wrote to memory of 3680	3308	cmd.exe	90
PID 4336 wrote to memory of 4528	4336	cmd.exe	89
PID 4336 wrote to memory of 4528	4336	cmd.exe	89
PID 4336 wrote to memory of 4528	4336	cmd.exe	89
PID 4528 wrote to memory of 1312	4528	hosts.exe	91
PID 4528 wrote to memory of 1312	4528	hosts.exe	91
PID 4528 wrote to memory of 1312	4528	hosts.exe	91
PID 4528 wrote to memory of 1800	4528	hosts.exe	92
PID 4528 wrote to memory of 1800	4528	hosts.exe	92
PID 4528 wrote to memory of 1800	4528	hosts.exe	92
PID 1800 wrote to memory of 764	1800	cmd.exe	94
PID 1800 wrote to memory of 764	1800	cmd.exe	94
PID 1800 wrote to memory of 764	1800	cmd.exe	94
PID 3308 wrote to memory of 4724	3308	cmd.exe	97
PID 3308 wrote to memory of 4724	3308	cmd.exe	97
PID 3308 wrote to memory of 4724	3308	cmd.exe	97
PID 1800 wrote to memory of 3816	1800	cmd.exe	95
PID 1800 wrote to memory of 3816	1800	cmd.exe	95
PID 1800 wrote to memory of 3816	1800	cmd.exe	95
PID 4336 wrote to memory of 3964	4336	cmd.exe	96
PID 4336 wrote to memory of 3964	4336	cmd.exe	96
PID 4336 wrote to memory of 3964	4336	cmd.exe	96
PID 1624 wrote to memory of 944	1624	avscan.exe	106
PID 1624 wrote to memory of 944	1624	avscan.exe	106
PID 1624 wrote to memory of 944	1624	avscan.exe	106
PID 4528 wrote to memory of 3228	4528	hosts.exe	108
PID 4528 wrote to memory of 3228	4528	hosts.exe	108
PID 4528 wrote to memory of 3228	4528	hosts.exe	108
PID 1624 wrote to memory of 2332	1624	avscan.exe	110
PID 1624 wrote to memory of 2332	1624	avscan.exe	110
PID 1624 wrote to memory of 2332	1624	avscan.exe	110
PID 4528 wrote to memory of 364	4528	hosts.exe	112
PID 4528 wrote to memory of 364	4528	hosts.exe	112
PID 4528 wrote to memory of 364	4528	hosts.exe	112
PID 1624 wrote to memory of 2480	1624	avscan.exe	114
PID 1624 wrote to memory of 2480	1624	avscan.exe	114
PID 1624 wrote to memory of 2480	1624	avscan.exe	114
PID 4528 wrote to memory of 2792	4528	hosts.exe	116
PID 4528 wrote to memory of 2792	4528	hosts.exe	116
PID 4528 wrote to memory of 2792	4528	hosts.exe	116
PID 1624 wrote to memory of 4496	1624	avscan.exe	118
PID 1624 wrote to memory of 4496	1624	avscan.exe	118
PID 1624 wrote to memory of 4496	1624	avscan.exe	118
PID 4528 wrote to memory of 1080	4528	hosts.exe	120
PID 4528 wrote to memory of 1080	4528	hosts.exe	120
PID 4528 wrote to memory of 1080	4528	hosts.exe	120

C:\Users\Admin\AppData\Local\Temp\2cd8889544fbbdf7f6dd2b1b1488ca807ff471891fe3376213a6bd06bbb85472.exe
"C:\Users\Admin\AppData\Local\Temp\2cd8889544fbbdf7f6dd2b1b1488ca807ff471891fe3376213a6bd06bbb85472.exe"
1⤵
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- Adds Run key to start application
- Drops file in Windows directory
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4760
- C:\Windows\SysWOW64\REG.exe
  REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
  2⤵
  - Modifies registry key
  PID:3488
- C:\Users\Admin\AppData\Local\Temp\avscan.exe
  C:\Users\Admin\AppData\Local\Temp\avscan.exe
  2⤵
  - Modifies visibility of file extensions in Explorer
  - Modifies visiblity of hidden/system files in Explorer
  - Executes dropped EXE
  - Adds Run key to start application
  - Drops file in Windows directory
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1624
- - C:\Users\Admin\AppData\Local\Temp\avscan.exe
    C:\Users\Admin\AppData\Local\Temp\avscan.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:4216
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c c:\windows\W_X_C.bat
    3⤵
    - Checks computer location settings
    - Modifies registry class
    - Suspicious use of WriteProcessMemory
    PID:3308
  - - C:\windows\hosts.exe
      C:\windows\hosts.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3680
  - - C:\Windows\SysWOW64\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Windows\W_X_C.vbs"
      4⤵
      Adds policy Run key to start application
      PID:4724
- - C:\Windows\SysWOW64\REG.exe
    REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
    3⤵
    - Modifies registry key
    PID:944
- - C:\Windows\SysWOW64\REG.exe
    REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
    3⤵
    - Modifies registry key
    PID:2332
- - C:\Windows\SysWOW64\REG.exe
    REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
    3⤵
    - Modifies registry key
    PID:2480
- - C:\Windows\SysWOW64\REG.exe
    REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
    3⤵
    - Modifies registry key
    PID:4496
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c c:\windows\W_X_C.bat
  2⤵
  - Checks computer location settings
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:4336
- - C:\windows\hosts.exe
    C:\windows\hosts.exe
    3⤵
    - Modifies visibility of file extensions in Explorer
    - Modifies visiblity of hidden/system files in Explorer
    - Executes dropped EXE
    - Adds Run key to start application
    - Drops file in Windows directory
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:4528
  - - C:\Users\Admin\AppData\Local\Temp\avscan.exe
      C:\Users\Admin\AppData\Local\Temp\avscan.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1312
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c c:\windows\W_X_C.bat
      4⤵
      Checks computer location settings
      Modifies registry class
      Suspicious use of WriteProcessMemory
      PID:1800
    - - C:\windows\hosts.exe
        
        C:\windows\hosts.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:764
    - - C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Windows\W_X_C.vbs"
        5⤵
        Adds policy Run key to start application
        
        PID:3816
  - - C:\Windows\SysWOW64\REG.exe
      REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
      4⤵
      Modifies registry key
      PID:3228
  - - C:\Windows\SysWOW64\REG.exe
      REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
      4⤵
      Modifies registry key
      PID:364
  - - C:\Windows\SysWOW64\REG.exe
      REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
      4⤵
      Modifies registry key
      PID:2792
  - - C:\Windows\SysWOW64\REG.exe
      REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
      4⤵
      Modifies registry key
      PID:1080
- - C:\Windows\SysWOW64\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Windows\W_X_C.vbs"
    3⤵
    - Adds policy Run key to start application
    PID:3964

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:2252

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Hidden Files and Directories

T1158

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Hidden Files and Directories

T1158

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\avscan.exe

Filesize
246KB

MD5
50dae5d52d6710e756f061904db3039f

SHA1
21e3ef26e03b80a286a891377afedc6e032cf3dc

SHA256
21edc3ce38ec6aa93c9ef06f9d4fde5a941eda28e4d0e964f769db1fb9aece71

SHA512
6d514572c531d8a76cf5d07e2b4b2ace816609690fc00a0f54f5d847270d7fb83b4a4c09a25382c8e53ad88eb508744a5e34ea602445513780090935669eeb63

Download Submit
C:\Users\Admin\AppData\Local\Temp\avscan.exe

Filesize
246KB

MD5
50dae5d52d6710e756f061904db3039f

SHA1
21e3ef26e03b80a286a891377afedc6e032cf3dc

SHA256
21edc3ce38ec6aa93c9ef06f9d4fde5a941eda28e4d0e964f769db1fb9aece71

SHA512
6d514572c531d8a76cf5d07e2b4b2ace816609690fc00a0f54f5d847270d7fb83b4a4c09a25382c8e53ad88eb508744a5e34ea602445513780090935669eeb63

Download Submit
C:\Users\Admin\AppData\Local\Temp\avscan.exe

Filesize
246KB

MD5
50dae5d52d6710e756f061904db3039f

SHA1
21e3ef26e03b80a286a891377afedc6e032cf3dc

SHA256
21edc3ce38ec6aa93c9ef06f9d4fde5a941eda28e4d0e964f769db1fb9aece71

SHA512
6d514572c531d8a76cf5d07e2b4b2ace816609690fc00a0f54f5d847270d7fb83b4a4c09a25382c8e53ad88eb508744a5e34ea602445513780090935669eeb63

Download Submit
C:\Users\Admin\AppData\Local\Temp\avscan.exe

Filesize
246KB

MD5
50dae5d52d6710e756f061904db3039f

SHA1
21e3ef26e03b80a286a891377afedc6e032cf3dc

SHA256
21edc3ce38ec6aa93c9ef06f9d4fde5a941eda28e4d0e964f769db1fb9aece71

SHA512
6d514572c531d8a76cf5d07e2b4b2ace816609690fc00a0f54f5d847270d7fb83b4a4c09a25382c8e53ad88eb508744a5e34ea602445513780090935669eeb63

Download Submit
C:\Windows\W_X_C.vbs

Filesize
195B

MD5
7fc0db81060e343fd209dc050b401f77

SHA1
08ce8975b023bf90c21b8e64cd54fdd39debce04

SHA256
4a21d378652d4291a6b9e88a1934ac51e9eccd5c9a42aa09076219301509367f

SHA512
e0d13ba3713707f7cb9be56240930a8f47d8c302e692b49dcb01f7bdf3e3475f829e1ead60ce6a5f98bed591be96456e9c3ef67bb27f88dc70343c1412e9de57

Download Submit
C:\Windows\hosts.exe

Filesize
246KB

MD5
36ba918c6d03d0c4c4172d5d6a24ff2d

SHA1
fe6bad9ff97fa8211a462c5195751f044ee6138b

SHA256
e361e2512f1b8ae307ea15226ad823dbe15df3d02489c51050b83d82a4aae96f

SHA512
fd6f8335b69651c2e78ae161fa4e9924ea98aef08134e7aceb0bcc9101a7e9c9879ecf18d0336136222cb8e97519a91ab78d2bd5c646d2f8ae580cd4eef77ccc

Download Submit
C:\Windows\hosts.exe

Filesize
246KB

MD5
36ba918c6d03d0c4c4172d5d6a24ff2d

SHA1
fe6bad9ff97fa8211a462c5195751f044ee6138b

SHA256
e361e2512f1b8ae307ea15226ad823dbe15df3d02489c51050b83d82a4aae96f

SHA512
fd6f8335b69651c2e78ae161fa4e9924ea98aef08134e7aceb0bcc9101a7e9c9879ecf18d0336136222cb8e97519a91ab78d2bd5c646d2f8ae580cd4eef77ccc

Download Submit
C:\Windows\hosts.exe

Filesize
246KB

MD5
36ba918c6d03d0c4c4172d5d6a24ff2d

SHA1
fe6bad9ff97fa8211a462c5195751f044ee6138b

SHA256
e361e2512f1b8ae307ea15226ad823dbe15df3d02489c51050b83d82a4aae96f

SHA512
fd6f8335b69651c2e78ae161fa4e9924ea98aef08134e7aceb0bcc9101a7e9c9879ecf18d0336136222cb8e97519a91ab78d2bd5c646d2f8ae580cd4eef77ccc

Download Submit
C:\Windows\hosts.exe

Filesize
246KB

MD5
36ba918c6d03d0c4c4172d5d6a24ff2d

SHA1
fe6bad9ff97fa8211a462c5195751f044ee6138b

SHA256
e361e2512f1b8ae307ea15226ad823dbe15df3d02489c51050b83d82a4aae96f

SHA512
fd6f8335b69651c2e78ae161fa4e9924ea98aef08134e7aceb0bcc9101a7e9c9879ecf18d0336136222cb8e97519a91ab78d2bd5c646d2f8ae580cd4eef77ccc

Download Submit
C:\windows\hosts.exe

Filesize
246KB

MD5
36ba918c6d03d0c4c4172d5d6a24ff2d

SHA1
fe6bad9ff97fa8211a462c5195751f044ee6138b

SHA256
e361e2512f1b8ae307ea15226ad823dbe15df3d02489c51050b83d82a4aae96f

SHA512
fd6f8335b69651c2e78ae161fa4e9924ea98aef08134e7aceb0bcc9101a7e9c9879ecf18d0336136222cb8e97519a91ab78d2bd5c646d2f8ae580cd4eef77ccc

Download Submit
\??\c:\windows\W_X_C.bat

Filesize
336B

MD5
4db9f8b6175722b62ececeeeba1ce307

SHA1
3b3ba8414706e72a6fa19e884a97b87609e11e47

SHA256
d2150b9e5a4ce55e140f0ca91c4e300715d42095c8fddf58c77037cdd2cfaf78

SHA512
1d6dc274cf7a3dd704f840e6a5ad57ab4c4e35d5f09489aeff520bb797e1c825bac53fc335156fe41e767a46520d031855fe42fe7b175409ebe5e9e986fb9b8b

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads