1aef7435075ad557a69ecf5035909f71727d8d041793434ba6f1881eaa1c66ce

Analysis

max time kernel
123s
max time network
141s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
04/10/2022, 06:42

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1aef7435075ad557a69ecf5035909f71727d8d041793434ba6f1881eaa1c66ce.exe
Size

171KB
MD5

39cef4688d19860be64c672b4f7ca770
SHA1

dd4bd21431386d5f474c460255760ebad566ce20
SHA256

1aef7435075ad557a69ecf5035909f71727d8d041793434ba6f1881eaa1c66ce
SHA512

8a1f038d75122b665034cc54d04d40fe53a7ad3589cd7131446acca93b6ae03abc73b2aee1202df43698ab3f32fddf161bd830a16fd1ff6474dc918ebffd6228
SSDEEP

3072:obpDCw1p3vmLvsZIaVwiwDcIbDHDCmzy8J1ywvOs:gDCwfG1bnxG8DBvOs

Score

10^/10

evasion persistence

Malware Config

Signatures

Modifies visibility of file extensions in Explorer 2 TTPs 3 IoCs

evasion

Hidden Files and Directories

T1158

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	1aef7435075ad557a69ecf5035909f71727d8d041793434ba6f1881eaa1c66ce.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	avscan.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	hosts.exe

Modifies visiblity of hidden/system files in Explorer 2 TTPs 3 IoCs

evasion

Hidden Files and Directories

T1158

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	1aef7435075ad557a69ecf5035909f71727d8d041793434ba6f1881eaa1c66ce.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	avscan.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	hosts.exe

Adds policy Run key to start application 2 TTPs 6 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	WScript.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\TMKNGOMU = "W_X_C.bat"	WScript.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	WScript.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\TMKNGOMU = "W_X_C.bat"	WScript.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	WScript.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\TMKNGOMU = "W_X_C.bat"	WScript.exe

Executes dropped EXE 6 IoCs

pid	Process
5096	avscan.exe
508	avscan.exe
4276	hosts.exe
4348	hosts.exe
4464	avscan.exe
2636	hosts.exe

Checks computer location settings 2 TTPs 3 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation	cmd.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation	cmd.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation	cmd.exe

Adds Run key to start application 2 TTPs 6 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\avscan = "C:\\Users\\Admin\\AppData\\Local\\Temp\\avscan.exe"	hosts.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run	1aef7435075ad557a69ecf5035909f71727d8d041793434ba6f1881eaa1c66ce.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\avscan = "C:\\Users\\Admin\\AppData\\Local\\Temp\\avscan.exe"	1aef7435075ad557a69ecf5035909f71727d8d041793434ba6f1881eaa1c66ce.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run	avscan.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\avscan = "C:\\Users\\Admin\\AppData\\Local\\Temp\\avscan.exe"	avscan.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run	hosts.exe

Drops file in Windows directory 5 IoCs

description	ioc	Process
File created	C:\windows\W_X_C.vbs	1aef7435075ad557a69ecf5035909f71727d8d041793434ba6f1881eaa1c66ce.exe
File created	\??\c:\windows\W_X_C.bat	1aef7435075ad557a69ecf5035909f71727d8d041793434ba6f1881eaa1c66ce.exe
File opened for modification	C:\Windows\hosts.exe	1aef7435075ad557a69ecf5035909f71727d8d041793434ba6f1881eaa1c66ce.exe
File opened for modification	C:\Windows\hosts.exe	avscan.exe
File opened for modification	C:\Windows\hosts.exe	hosts.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies registry class 4 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings	1aef7435075ad557a69ecf5035909f71727d8d041793434ba6f1881eaa1c66ce.exe

Modifies registry key 1 TTPs 9 IoCs

Modify Registry

T1112

pid	Process
3592	REG.exe
4512	REG.exe
428	REG.exe
2036	REG.exe
1296	REG.exe
3476	REG.exe
3960	REG.exe
4736	REG.exe
1860	REG.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

pid	Process
5096	avscan.exe
4348	hosts.exe

Suspicious use of SetWindowsHookEx 7 IoCs

pid	Process
1748	1aef7435075ad557a69ecf5035909f71727d8d041793434ba6f1881eaa1c66ce.exe
5096	avscan.exe
508	avscan.exe
4348	hosts.exe
4276	hosts.exe
4464	avscan.exe
2636	hosts.exe

Suspicious use of WriteProcessMemory 63 IoCs

description	pid	Process	procid_target
PID 1748 wrote to memory of 2036	1748	1aef7435075ad557a69ecf5035909f71727d8d041793434ba6f1881eaa1c66ce.exe	82
PID 1748 wrote to memory of 2036	1748	1aef7435075ad557a69ecf5035909f71727d8d041793434ba6f1881eaa1c66ce.exe	82
PID 1748 wrote to memory of 2036	1748	1aef7435075ad557a69ecf5035909f71727d8d041793434ba6f1881eaa1c66ce.exe	82
PID 1748 wrote to memory of 5096	1748	1aef7435075ad557a69ecf5035909f71727d8d041793434ba6f1881eaa1c66ce.exe	84
PID 1748 wrote to memory of 5096	1748	1aef7435075ad557a69ecf5035909f71727d8d041793434ba6f1881eaa1c66ce.exe	84
PID 1748 wrote to memory of 5096	1748	1aef7435075ad557a69ecf5035909f71727d8d041793434ba6f1881eaa1c66ce.exe	84
PID 5096 wrote to memory of 508	5096	avscan.exe	85
PID 5096 wrote to memory of 508	5096	avscan.exe	85
PID 5096 wrote to memory of 508	5096	avscan.exe	85
PID 5096 wrote to memory of 4816	5096	avscan.exe	86
PID 5096 wrote to memory of 4816	5096	avscan.exe	86
PID 5096 wrote to memory of 4816	5096	avscan.exe	86
PID 1748 wrote to memory of 4756	1748	1aef7435075ad557a69ecf5035909f71727d8d041793434ba6f1881eaa1c66ce.exe	89
PID 1748 wrote to memory of 4756	1748	1aef7435075ad557a69ecf5035909f71727d8d041793434ba6f1881eaa1c66ce.exe	89
PID 1748 wrote to memory of 4756	1748	1aef7435075ad557a69ecf5035909f71727d8d041793434ba6f1881eaa1c66ce.exe	89
PID 4816 wrote to memory of 4276	4816	cmd.exe	90
PID 4816 wrote to memory of 4276	4816	cmd.exe	90
PID 4816 wrote to memory of 4276	4816	cmd.exe	90
PID 4756 wrote to memory of 4348	4756	cmd.exe	91
PID 4756 wrote to memory of 4348	4756	cmd.exe	91
PID 4756 wrote to memory of 4348	4756	cmd.exe	91
PID 4348 wrote to memory of 4464	4348	hosts.exe	92
PID 4348 wrote to memory of 4464	4348	hosts.exe	92
PID 4348 wrote to memory of 4464	4348	hosts.exe	92
PID 4348 wrote to memory of 1560	4348	hosts.exe	94
PID 4348 wrote to memory of 1560	4348	hosts.exe	94
PID 4348 wrote to memory of 1560	4348	hosts.exe	94
PID 1560 wrote to memory of 2636	1560	cmd.exe	96
PID 1560 wrote to memory of 2636	1560	cmd.exe	96
PID 1560 wrote to memory of 2636	1560	cmd.exe	96
PID 4816 wrote to memory of 676	4816	cmd.exe	97
PID 4816 wrote to memory of 676	4816	cmd.exe	97
PID 4816 wrote to memory of 676	4816	cmd.exe	97
PID 4756 wrote to memory of 1388	4756	cmd.exe	98
PID 4756 wrote to memory of 1388	4756	cmd.exe	98
PID 4756 wrote to memory of 1388	4756	cmd.exe	98
PID 1560 wrote to memory of 600	1560	cmd.exe	99
PID 1560 wrote to memory of 600	1560	cmd.exe	99
PID 1560 wrote to memory of 600	1560	cmd.exe	99
PID 5096 wrote to memory of 1296	5096	avscan.exe	107
PID 5096 wrote to memory of 1296	5096	avscan.exe	107
PID 5096 wrote to memory of 1296	5096	avscan.exe	107
PID 4348 wrote to memory of 3476	4348	hosts.exe	109
PID 4348 wrote to memory of 3476	4348	hosts.exe	109
PID 4348 wrote to memory of 3476	4348	hosts.exe	109
PID 5096 wrote to memory of 3592	5096	avscan.exe	111
PID 5096 wrote to memory of 3592	5096	avscan.exe	111
PID 5096 wrote to memory of 3592	5096	avscan.exe	111
PID 4348 wrote to memory of 4512	4348	hosts.exe	113
PID 4348 wrote to memory of 4512	4348	hosts.exe	113
PID 4348 wrote to memory of 4512	4348	hosts.exe	113
PID 5096 wrote to memory of 428	5096	avscan.exe	115
PID 5096 wrote to memory of 428	5096	avscan.exe	115
PID 5096 wrote to memory of 428	5096	avscan.exe	115
PID 4348 wrote to memory of 3960	4348	hosts.exe	117
PID 4348 wrote to memory of 3960	4348	hosts.exe	117
PID 4348 wrote to memory of 3960	4348	hosts.exe	117
PID 5096 wrote to memory of 4736	5096	avscan.exe	119
PID 5096 wrote to memory of 4736	5096	avscan.exe	119
PID 5096 wrote to memory of 4736	5096	avscan.exe	119
PID 4348 wrote to memory of 1860	4348	hosts.exe	121
PID 4348 wrote to memory of 1860	4348	hosts.exe	121
PID 4348 wrote to memory of 1860	4348	hosts.exe	121

C:\Users\Admin\AppData\Local\Temp\1aef7435075ad557a69ecf5035909f71727d8d041793434ba6f1881eaa1c66ce.exe
"C:\Users\Admin\AppData\Local\Temp\1aef7435075ad557a69ecf5035909f71727d8d041793434ba6f1881eaa1c66ce.exe"
1⤵
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- Adds Run key to start application
- Drops file in Windows directory
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1748
- C:\Windows\SysWOW64\REG.exe
  REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
  2⤵
  - Modifies registry key
  PID:2036
- C:\Users\Admin\AppData\Local\Temp\avscan.exe
  C:\Users\Admin\AppData\Local\Temp\avscan.exe
  2⤵
  - Modifies visibility of file extensions in Explorer
  - Modifies visiblity of hidden/system files in Explorer
  - Executes dropped EXE
  - Adds Run key to start application
  - Drops file in Windows directory
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:5096
- - C:\Users\Admin\AppData\Local\Temp\avscan.exe
    C:\Users\Admin\AppData\Local\Temp\avscan.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:508
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c c:\windows\W_X_C.bat
    3⤵
    - Checks computer location settings
    - Modifies registry class
    - Suspicious use of WriteProcessMemory
    PID:4816
  - - C:\windows\hosts.exe
      C:\windows\hosts.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4276
  - - C:\Windows\SysWOW64\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Windows\W_X_C.vbs"
      4⤵
      Adds policy Run key to start application
      PID:676
- - C:\Windows\SysWOW64\REG.exe
    REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
    3⤵
    - Modifies registry key
    PID:1296
- - C:\Windows\SysWOW64\REG.exe
    REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
    3⤵
    - Modifies registry key
    PID:3592
- - C:\Windows\SysWOW64\REG.exe
    REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
    3⤵
    - Modifies registry key
    PID:428
- - C:\Windows\SysWOW64\REG.exe
    REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
    3⤵
    - Modifies registry key
    PID:4736
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c c:\windows\W_X_C.bat
  2⤵
  - Checks computer location settings
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:4756
- - C:\windows\hosts.exe
    C:\windows\hosts.exe
    3⤵
    - Modifies visibility of file extensions in Explorer
    - Modifies visiblity of hidden/system files in Explorer
    - Executes dropped EXE
    - Adds Run key to start application
    - Drops file in Windows directory
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:4348
  - - C:\Users\Admin\AppData\Local\Temp\avscan.exe
      C:\Users\Admin\AppData\Local\Temp\avscan.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4464
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c c:\windows\W_X_C.bat
      4⤵
      Checks computer location settings
      Modifies registry class
      Suspicious use of WriteProcessMemory
      PID:1560
    - - C:\windows\hosts.exe
        
        C:\windows\hosts.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2636
    - - C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Windows\W_X_C.vbs"
        5⤵
        Adds policy Run key to start application
        
        PID:600
  - - C:\Windows\SysWOW64\REG.exe
      REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
      4⤵
      Modifies registry key
      PID:3476
  - - C:\Windows\SysWOW64\REG.exe
      REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
      4⤵
      Modifies registry key
      PID:4512
  - - C:\Windows\SysWOW64\REG.exe
      REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
      4⤵
      Modifies registry key
      PID:3960
  - - C:\Windows\SysWOW64\REG.exe
      REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
      4⤵
      Modifies registry key
      PID:1860
- - C:\Windows\SysWOW64\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Windows\W_X_C.vbs"
    3⤵
    - Adds policy Run key to start application
    PID:1388

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:1644

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Hidden Files and Directories

T1158

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Hidden Files and Directories

T1158

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\avscan.exe

Filesize
171KB

MD5
e0930f6dd3e316e2f459672799de7814

SHA1
53e31ae4eb042d1e76791206cc4b5ff6de3d84b1

SHA256
cfac2ed4741d457f61a41293a3145702183ec06d5368fe1efb3a1246a25ccd02

SHA512
36bd5403fbb804ebcf808e36692898cdfb35b046046fab89b302a2a00c12d6fddf6f75564f8ee6b1729c1d881fca155f1905aca45d1655a892194949232fd5b8

Download Submit
C:\Users\Admin\AppData\Local\Temp\avscan.exe

Filesize
171KB

MD5
e0930f6dd3e316e2f459672799de7814

SHA1
53e31ae4eb042d1e76791206cc4b5ff6de3d84b1

SHA256
cfac2ed4741d457f61a41293a3145702183ec06d5368fe1efb3a1246a25ccd02

SHA512
36bd5403fbb804ebcf808e36692898cdfb35b046046fab89b302a2a00c12d6fddf6f75564f8ee6b1729c1d881fca155f1905aca45d1655a892194949232fd5b8

Download Submit
C:\Users\Admin\AppData\Local\Temp\avscan.exe

Filesize
171KB

MD5
e0930f6dd3e316e2f459672799de7814

SHA1
53e31ae4eb042d1e76791206cc4b5ff6de3d84b1

SHA256
cfac2ed4741d457f61a41293a3145702183ec06d5368fe1efb3a1246a25ccd02

SHA512
36bd5403fbb804ebcf808e36692898cdfb35b046046fab89b302a2a00c12d6fddf6f75564f8ee6b1729c1d881fca155f1905aca45d1655a892194949232fd5b8

Download Submit
C:\Users\Admin\AppData\Local\Temp\avscan.exe

Filesize
171KB

MD5
e0930f6dd3e316e2f459672799de7814

SHA1
53e31ae4eb042d1e76791206cc4b5ff6de3d84b1

SHA256
cfac2ed4741d457f61a41293a3145702183ec06d5368fe1efb3a1246a25ccd02

SHA512
36bd5403fbb804ebcf808e36692898cdfb35b046046fab89b302a2a00c12d6fddf6f75564f8ee6b1729c1d881fca155f1905aca45d1655a892194949232fd5b8

Download Submit
C:\Windows\W_X_C.vbs

Filesize
195B

MD5
c35f93e634b81f2cb003c72a1fb9d1f2

SHA1
9b6c533eebab7958e9e167ab93a412d5411c7a89

SHA256
6afae199db9be5b7c4c5dac778ec8c45051666d11f93dd93c1700beb20e1136f

SHA512
5cc512763da54bc66ffff42e02dc28ad9cda03e46a8b9181425c619815fb7c7afe3a71fc73742e151e26de7a21ade101e59d6853fe70b7d99ea93195325c010d

Download Submit
C:\Windows\hosts.exe

Filesize
171KB

MD5
4c8d094eec47c32f0a1ff25036324ae2

SHA1
4716a033cb113f0e3ade30a71f2c253b41390944

SHA256
4862fe36b1eb28ef3350736734eb7ec17c96219ba9dafe0d03554a85acac0823

SHA512
41bd9ace6b4a79e641303b320b96cb0e1b382ac86a724aef8cef57403aeb489c0ad42ee86f8955491a9e1a92f771987237a8feded1caf642458057d6b316e752

Download Submit
C:\Windows\hosts.exe

Filesize
171KB

MD5
4c8d094eec47c32f0a1ff25036324ae2

SHA1
4716a033cb113f0e3ade30a71f2c253b41390944

SHA256
4862fe36b1eb28ef3350736734eb7ec17c96219ba9dafe0d03554a85acac0823

SHA512
41bd9ace6b4a79e641303b320b96cb0e1b382ac86a724aef8cef57403aeb489c0ad42ee86f8955491a9e1a92f771987237a8feded1caf642458057d6b316e752

Download Submit
C:\Windows\hosts.exe

Filesize
171KB

MD5
4c8d094eec47c32f0a1ff25036324ae2

SHA1
4716a033cb113f0e3ade30a71f2c253b41390944

SHA256
4862fe36b1eb28ef3350736734eb7ec17c96219ba9dafe0d03554a85acac0823

SHA512
41bd9ace6b4a79e641303b320b96cb0e1b382ac86a724aef8cef57403aeb489c0ad42ee86f8955491a9e1a92f771987237a8feded1caf642458057d6b316e752

Download Submit
C:\Windows\hosts.exe

Filesize
171KB

MD5
4c8d094eec47c32f0a1ff25036324ae2

SHA1
4716a033cb113f0e3ade30a71f2c253b41390944

SHA256
4862fe36b1eb28ef3350736734eb7ec17c96219ba9dafe0d03554a85acac0823

SHA512
41bd9ace6b4a79e641303b320b96cb0e1b382ac86a724aef8cef57403aeb489c0ad42ee86f8955491a9e1a92f771987237a8feded1caf642458057d6b316e752

Download Submit
C:\windows\hosts.exe

Filesize
171KB

MD5
4c8d094eec47c32f0a1ff25036324ae2

SHA1
4716a033cb113f0e3ade30a71f2c253b41390944

SHA256
4862fe36b1eb28ef3350736734eb7ec17c96219ba9dafe0d03554a85acac0823

SHA512
41bd9ace6b4a79e641303b320b96cb0e1b382ac86a724aef8cef57403aeb489c0ad42ee86f8955491a9e1a92f771987237a8feded1caf642458057d6b316e752

Download Submit
\??\c:\windows\W_X_C.bat

Filesize
336B

MD5
4db9f8b6175722b62ececeeeba1ce307

SHA1
3b3ba8414706e72a6fa19e884a97b87609e11e47

SHA256
d2150b9e5a4ce55e140f0ca91c4e300715d42095c8fddf58c77037cdd2cfaf78

SHA512
1d6dc274cf7a3dd704f840e6a5ad57ab4c4e35d5f09489aeff520bb797e1c825bac53fc335156fe41e767a46520d031855fe42fe7b175409ebe5e9e986fb9b8b

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads