a0c5e39b6bafe3193e0b3e8787b32b3d5d2de6b5f34e5df7830d1c729d192761

Analysis

max time kernel
138s
max time network
136s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
02/10/2022, 07:31

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a0c5e39b6bafe3193e0b3e8787b32b3d5d2de6b5f34e5df7830d1c729d192761.exe
Size

1.0MB
MD5

6dfbfd3efd9eb2a1b9f39b161191c6e0
SHA1

320d332f817b4d770c672021dae574ee82a95c4d
SHA256

a0c5e39b6bafe3193e0b3e8787b32b3d5d2de6b5f34e5df7830d1c729d192761
SHA512

90ef1fb5d192bade98e58aa38294a110cd0561f39ffda222ed23198b68acf310fc3ab62a2d265e2be644e0532ab1dddc5b532da252690b7f1dadefd3e15b5c01
SSDEEP

12288:g72bn2Yp72bn2Yr72bn2Yp72bn2YC72bn2Yp72bn2Yw:g72zF72zf72zF72zm72zF72zs

Score

10^/10

evasion persistence

Malware Config

Signatures

Modifies visibility of file extensions in Explorer 2 TTPs 3 IoCs

evasion

Hidden Files and Directories

T1158

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	hosts.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	a0c5e39b6bafe3193e0b3e8787b32b3d5d2de6b5f34e5df7830d1c729d192761.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	avscan.exe

Modifies visiblity of hidden/system files in Explorer 2 TTPs 3 IoCs

evasion

Hidden Files and Directories

T1158

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	hosts.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	a0c5e39b6bafe3193e0b3e8787b32b3d5d2de6b5f34e5df7830d1c729d192761.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	avscan.exe

Adds policy Run key to start application 2 TTPs 6 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\XZIOFAVD = "W_X_C.bat"	WScript.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	WScript.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\XZIOFAVD = "W_X_C.bat"	WScript.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	WScript.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\XZIOFAVD = "W_X_C.bat"	WScript.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	WScript.exe

Executes dropped EXE 6 IoCs

pid	Process
1512	avscan.exe
2288	avscan.exe
2280	hosts.exe
1916	hosts.exe
228	avscan.exe
4392	hosts.exe

Checks computer location settings 2 TTPs 3 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\Geo\Nation	cmd.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\Geo\Nation	cmd.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\Geo\Nation	cmd.exe

Adds Run key to start application 2 TTPs 6 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\avscan = "C:\\Users\\Admin\\AppData\\Local\\Temp\\avscan.exe"	a0c5e39b6bafe3193e0b3e8787b32b3d5d2de6b5f34e5df7830d1c729d192761.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run	avscan.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\avscan = "C:\\Users\\Admin\\AppData\\Local\\Temp\\avscan.exe"	avscan.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run	hosts.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\avscan = "C:\\Users\\Admin\\AppData\\Local\\Temp\\avscan.exe"	hosts.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run	a0c5e39b6bafe3193e0b3e8787b32b3d5d2de6b5f34e5df7830d1c729d192761.exe

Drops file in Windows directory 5 IoCs

description	ioc	Process
File opened for modification	C:\Windows\hosts.exe	hosts.exe
File created	C:\windows\W_X_C.vbs	a0c5e39b6bafe3193e0b3e8787b32b3d5d2de6b5f34e5df7830d1c729d192761.exe
File created	\??\c:\windows\W_X_C.bat	a0c5e39b6bafe3193e0b3e8787b32b3d5d2de6b5f34e5df7830d1c729d192761.exe
File opened for modification	C:\Windows\hosts.exe	a0c5e39b6bafe3193e0b3e8787b32b3d5d2de6b5f34e5df7830d1c729d192761.exe
File opened for modification	C:\Windows\hosts.exe	avscan.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies registry class 4 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000_Classes\Local Settings	a0c5e39b6bafe3193e0b3e8787b32b3d5d2de6b5f34e5df7830d1c729d192761.exe
Key created	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000_Classes\Local Settings	cmd.exe

Modifies registry key 1 TTPs 9 IoCs

Modify Registry

T1112

pid	Process
5008	REG.exe
4200	REG.exe
4952	REG.exe
4748	REG.exe
3536	REG.exe
3196	REG.exe
3912	REG.exe
4220	REG.exe
2848	REG.exe

Suspicious behavior: GetForegroundWindowSpam 3 IoCs

pid	Process
4756	a0c5e39b6bafe3193e0b3e8787b32b3d5d2de6b5f34e5df7830d1c729d192761.exe
1512	avscan.exe
1916	hosts.exe

Suspicious use of SetWindowsHookEx 7 IoCs

pid	Process
4756	a0c5e39b6bafe3193e0b3e8787b32b3d5d2de6b5f34e5df7830d1c729d192761.exe
1512	avscan.exe
2288	avscan.exe
1916	hosts.exe
2280	hosts.exe
228	avscan.exe
4392	hosts.exe

Suspicious use of WriteProcessMemory 63 IoCs

description	pid	Process	procid_target
PID 4756 wrote to memory of 4952	4756	a0c5e39b6bafe3193e0b3e8787b32b3d5d2de6b5f34e5df7830d1c729d192761.exe	81
PID 4756 wrote to memory of 4952	4756	a0c5e39b6bafe3193e0b3e8787b32b3d5d2de6b5f34e5df7830d1c729d192761.exe	81
PID 4756 wrote to memory of 4952	4756	a0c5e39b6bafe3193e0b3e8787b32b3d5d2de6b5f34e5df7830d1c729d192761.exe	81
PID 4756 wrote to memory of 1512	4756	a0c5e39b6bafe3193e0b3e8787b32b3d5d2de6b5f34e5df7830d1c729d192761.exe	83
PID 4756 wrote to memory of 1512	4756	a0c5e39b6bafe3193e0b3e8787b32b3d5d2de6b5f34e5df7830d1c729d192761.exe	83
PID 4756 wrote to memory of 1512	4756	a0c5e39b6bafe3193e0b3e8787b32b3d5d2de6b5f34e5df7830d1c729d192761.exe	83
PID 1512 wrote to memory of 2288	1512	avscan.exe	84
PID 1512 wrote to memory of 2288	1512	avscan.exe	84
PID 1512 wrote to memory of 2288	1512	avscan.exe	84
PID 1512 wrote to memory of 2312	1512	avscan.exe	85
PID 1512 wrote to memory of 2312	1512	avscan.exe	85
PID 1512 wrote to memory of 2312	1512	avscan.exe	85
PID 4756 wrote to memory of 3908	4756	a0c5e39b6bafe3193e0b3e8787b32b3d5d2de6b5f34e5df7830d1c729d192761.exe	86
PID 4756 wrote to memory of 3908	4756	a0c5e39b6bafe3193e0b3e8787b32b3d5d2de6b5f34e5df7830d1c729d192761.exe	86
PID 4756 wrote to memory of 3908	4756	a0c5e39b6bafe3193e0b3e8787b32b3d5d2de6b5f34e5df7830d1c729d192761.exe	86
PID 3908 wrote to memory of 1916	3908	cmd.exe	90
PID 2312 wrote to memory of 2280	2312	cmd.exe	89
PID 3908 wrote to memory of 1916	3908	cmd.exe	90
PID 3908 wrote to memory of 1916	3908	cmd.exe	90
PID 2312 wrote to memory of 2280	2312	cmd.exe	89
PID 2312 wrote to memory of 2280	2312	cmd.exe	89
PID 1916 wrote to memory of 228	1916	hosts.exe	91
PID 1916 wrote to memory of 228	1916	hosts.exe	91
PID 1916 wrote to memory of 228	1916	hosts.exe	91
PID 1916 wrote to memory of 5116	1916	hosts.exe	92
PID 1916 wrote to memory of 5116	1916	hosts.exe	92
PID 1916 wrote to memory of 5116	1916	hosts.exe	92
PID 5116 wrote to memory of 4392	5116	cmd.exe	94
PID 5116 wrote to memory of 4392	5116	cmd.exe	94
PID 5116 wrote to memory of 4392	5116	cmd.exe	94
PID 3908 wrote to memory of 3400	3908	cmd.exe	97
PID 3908 wrote to memory of 3400	3908	cmd.exe	97
PID 3908 wrote to memory of 3400	3908	cmd.exe	97
PID 2312 wrote to memory of 4976	2312	cmd.exe	96
PID 2312 wrote to memory of 4976	2312	cmd.exe	96
PID 2312 wrote to memory of 4976	2312	cmd.exe	96
PID 5116 wrote to memory of 5056	5116	cmd.exe	95
PID 5116 wrote to memory of 5056	5116	cmd.exe	95
PID 5116 wrote to memory of 5056	5116	cmd.exe	95
PID 1512 wrote to memory of 4748	1512	avscan.exe	107
PID 1512 wrote to memory of 4748	1512	avscan.exe	107
PID 1512 wrote to memory of 4748	1512	avscan.exe	107
PID 1916 wrote to memory of 3912	1916	hosts.exe	109
PID 1916 wrote to memory of 3912	1916	hosts.exe	109
PID 1916 wrote to memory of 3912	1916	hosts.exe	109
PID 1512 wrote to memory of 3536	1512	avscan.exe	111
PID 1512 wrote to memory of 3536	1512	avscan.exe	111
PID 1512 wrote to memory of 3536	1512	avscan.exe	111
PID 1916 wrote to memory of 5008	1916	hosts.exe	113
PID 1916 wrote to memory of 5008	1916	hosts.exe	113
PID 1916 wrote to memory of 5008	1916	hosts.exe	113
PID 1512 wrote to memory of 4220	1512	avscan.exe	115
PID 1512 wrote to memory of 4220	1512	avscan.exe	115
PID 1512 wrote to memory of 4220	1512	avscan.exe	115
PID 1916 wrote to memory of 2848	1916	hosts.exe	117
PID 1916 wrote to memory of 2848	1916	hosts.exe	117
PID 1916 wrote to memory of 2848	1916	hosts.exe	117
PID 1512 wrote to memory of 3196	1512	avscan.exe	119
PID 1512 wrote to memory of 3196	1512	avscan.exe	119
PID 1512 wrote to memory of 3196	1512	avscan.exe	119
PID 1916 wrote to memory of 4200	1916	hosts.exe	121
PID 1916 wrote to memory of 4200	1916	hosts.exe	121
PID 1916 wrote to memory of 4200	1916	hosts.exe	121

C:\Users\Admin\AppData\Local\Temp\a0c5e39b6bafe3193e0b3e8787b32b3d5d2de6b5f34e5df7830d1c729d192761.exe
"C:\Users\Admin\AppData\Local\Temp\a0c5e39b6bafe3193e0b3e8787b32b3d5d2de6b5f34e5df7830d1c729d192761.exe"
1⤵
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- Adds Run key to start application
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4756
- C:\Windows\SysWOW64\REG.exe
  REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
  2⤵
  - Modifies registry key
  PID:4952
- C:\Users\Admin\AppData\Local\Temp\avscan.exe
  C:\Users\Admin\AppData\Local\Temp\avscan.exe
  2⤵
  - Modifies visibility of file extensions in Explorer
  - Modifies visiblity of hidden/system files in Explorer
  - Executes dropped EXE
  - Adds Run key to start application
  - Drops file in Windows directory
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1512
- - C:\Users\Admin\AppData\Local\Temp\avscan.exe
    C:\Users\Admin\AppData\Local\Temp\avscan.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2288
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c c:\windows\W_X_C.bat
    3⤵
    - Checks computer location settings
    - Modifies registry class
    - Suspicious use of WriteProcessMemory
    PID:2312
  - - C:\windows\hosts.exe
      C:\windows\hosts.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2280
  - - C:\Windows\SysWOW64\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Windows\W_X_C.vbs"
      4⤵
      Adds policy Run key to start application
      PID:4976
- - C:\Windows\SysWOW64\REG.exe
    REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
    3⤵
    - Modifies registry key
    PID:4748
- - C:\Windows\SysWOW64\REG.exe
    REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
    3⤵
    - Modifies registry key
    PID:3536
- - C:\Windows\SysWOW64\REG.exe
    REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
    3⤵
    - Modifies registry key
    PID:4220
- - C:\Windows\SysWOW64\REG.exe
    REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
    3⤵
    - Modifies registry key
    PID:3196
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c c:\windows\W_X_C.bat
  2⤵
  - Checks computer location settings
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:3908
- - C:\windows\hosts.exe
    C:\windows\hosts.exe
    3⤵
    - Modifies visibility of file extensions in Explorer
    - Modifies visiblity of hidden/system files in Explorer
    - Executes dropped EXE
    - Adds Run key to start application
    - Drops file in Windows directory
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:1916
  - - C:\Users\Admin\AppData\Local\Temp\avscan.exe
      C:\Users\Admin\AppData\Local\Temp\avscan.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:228
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c c:\windows\W_X_C.bat
      4⤵
      Checks computer location settings
      Modifies registry class
      Suspicious use of WriteProcessMemory
      PID:5116
    - - C:\windows\hosts.exe
        
        C:\windows\hosts.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4392
    - - C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Windows\W_X_C.vbs"
        5⤵
        Adds policy Run key to start application
        
        PID:5056
  - - C:\Windows\SysWOW64\REG.exe
      REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
      4⤵
      Modifies registry key
      PID:3912
  - - C:\Windows\SysWOW64\REG.exe
      REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
      4⤵
      Modifies registry key
      PID:5008
  - - C:\Windows\SysWOW64\REG.exe
      REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
      4⤵
      Modifies registry key
      PID:2848
  - - C:\Windows\SysWOW64\REG.exe
      REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
      4⤵
      Modifies registry key
      PID:4200
- - C:\Windows\SysWOW64\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Windows\W_X_C.vbs"
    3⤵
    - Adds policy Run key to start application
    PID:3400

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:1712

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Hidden Files and Directories

T1158

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Hidden Files and Directories

T1158

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\avscan.exe

Filesize
1.0MB

MD5
1eae6062a338722369e10b19153dc042

SHA1
aaf3725877dec43d854335b5675d1df2b988bcc1

SHA256
743b99dfc7a83516e4fa0aed8d7d8fcb130373f069792cfbed30f9e63116c97b

SHA512
453c171bf6ecc4b3a3847e33dd5d94570c7d521c795dd54f745baa6d5c2b99a50112d5c9996be0a3462544b3e5ea37346f20643ad38d09c52dc36d77fb7932a5

Download Submit
C:\Users\Admin\AppData\Local\Temp\avscan.exe

Filesize
1.0MB

MD5
1eae6062a338722369e10b19153dc042

SHA1
aaf3725877dec43d854335b5675d1df2b988bcc1

SHA256
743b99dfc7a83516e4fa0aed8d7d8fcb130373f069792cfbed30f9e63116c97b

SHA512
453c171bf6ecc4b3a3847e33dd5d94570c7d521c795dd54f745baa6d5c2b99a50112d5c9996be0a3462544b3e5ea37346f20643ad38d09c52dc36d77fb7932a5

Download Submit
C:\Users\Admin\AppData\Local\Temp\avscan.exe

Filesize
1.0MB

MD5
1eae6062a338722369e10b19153dc042

SHA1
aaf3725877dec43d854335b5675d1df2b988bcc1

SHA256
743b99dfc7a83516e4fa0aed8d7d8fcb130373f069792cfbed30f9e63116c97b

SHA512
453c171bf6ecc4b3a3847e33dd5d94570c7d521c795dd54f745baa6d5c2b99a50112d5c9996be0a3462544b3e5ea37346f20643ad38d09c52dc36d77fb7932a5

Download Submit
C:\Users\Admin\AppData\Local\Temp\avscan.exe

Filesize
1.0MB

MD5
1eae6062a338722369e10b19153dc042

SHA1
aaf3725877dec43d854335b5675d1df2b988bcc1

SHA256
743b99dfc7a83516e4fa0aed8d7d8fcb130373f069792cfbed30f9e63116c97b

SHA512
453c171bf6ecc4b3a3847e33dd5d94570c7d521c795dd54f745baa6d5c2b99a50112d5c9996be0a3462544b3e5ea37346f20643ad38d09c52dc36d77fb7932a5

Download Submit
C:\Windows\W_X_C.vbs

Filesize
195B

MD5
7fc0db81060e343fd209dc050b401f77

SHA1
08ce8975b023bf90c21b8e64cd54fdd39debce04

SHA256
4a21d378652d4291a6b9e88a1934ac51e9eccd5c9a42aa09076219301509367f

SHA512
e0d13ba3713707f7cb9be56240930a8f47d8c302e692b49dcb01f7bdf3e3475f829e1ead60ce6a5f98bed591be96456e9c3ef67bb27f88dc70343c1412e9de57

Download Submit
C:\Windows\hosts.exe

Filesize
1.0MB

MD5
56e1b68d671fa69ec41f5e98e36d98bb

SHA1
9e2da8b6981c8632791e751ee4984a244f71ba0d

SHA256
4be43796b5510daf3d79a4fd2d821facbf5d90d121de5790a5090e98f1262f1f

SHA512
bf11b554704f59bb92c15ef618163837382c5637d29223b4872ff16e7aaccce118cdf95df621836c62463cd1d07b6de4e1871d04779041637b1b41ace3a772e1

Download Submit
C:\Windows\hosts.exe

Filesize
1.0MB

MD5
56e1b68d671fa69ec41f5e98e36d98bb

SHA1
9e2da8b6981c8632791e751ee4984a244f71ba0d

SHA256
4be43796b5510daf3d79a4fd2d821facbf5d90d121de5790a5090e98f1262f1f

SHA512
bf11b554704f59bb92c15ef618163837382c5637d29223b4872ff16e7aaccce118cdf95df621836c62463cd1d07b6de4e1871d04779041637b1b41ace3a772e1

Download Submit
C:\Windows\hosts.exe

Filesize
1.0MB

MD5
56e1b68d671fa69ec41f5e98e36d98bb

SHA1
9e2da8b6981c8632791e751ee4984a244f71ba0d

SHA256
4be43796b5510daf3d79a4fd2d821facbf5d90d121de5790a5090e98f1262f1f

SHA512
bf11b554704f59bb92c15ef618163837382c5637d29223b4872ff16e7aaccce118cdf95df621836c62463cd1d07b6de4e1871d04779041637b1b41ace3a772e1

Download Submit
C:\Windows\hosts.exe

Filesize
1.0MB

MD5
56e1b68d671fa69ec41f5e98e36d98bb

SHA1
9e2da8b6981c8632791e751ee4984a244f71ba0d

SHA256
4be43796b5510daf3d79a4fd2d821facbf5d90d121de5790a5090e98f1262f1f

SHA512
bf11b554704f59bb92c15ef618163837382c5637d29223b4872ff16e7aaccce118cdf95df621836c62463cd1d07b6de4e1871d04779041637b1b41ace3a772e1

Download Submit
C:\windows\hosts.exe

Filesize
1.0MB

MD5
56e1b68d671fa69ec41f5e98e36d98bb

SHA1
9e2da8b6981c8632791e751ee4984a244f71ba0d

SHA256
4be43796b5510daf3d79a4fd2d821facbf5d90d121de5790a5090e98f1262f1f

SHA512
bf11b554704f59bb92c15ef618163837382c5637d29223b4872ff16e7aaccce118cdf95df621836c62463cd1d07b6de4e1871d04779041637b1b41ace3a772e1

Download Submit
\??\c:\windows\W_X_C.bat

Filesize
336B

MD5
4db9f8b6175722b62ececeeeba1ce307

SHA1
3b3ba8414706e72a6fa19e884a97b87609e11e47

SHA256
d2150b9e5a4ce55e140f0ca91c4e300715d42095c8fddf58c77037cdd2cfaf78

SHA512
1d6dc274cf7a3dd704f840e6a5ad57ab4c4e35d5f09489aeff520bb797e1c825bac53fc335156fe41e767a46520d031855fe42fe7b175409ebe5e9e986fb9b8b

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads