c0c71726ae07bded4d2dbb380eaccb837361a8b72cb528222ecc5615e33a67a2

Analysis

max time kernel
128s
max time network
144s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
12/10/2022, 14:50

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c0c71726ae07bded4d2dbb380eaccb837361a8b72cb528222ecc5615e33a67a2.exe
Size

190KB
MD5

02741a4953e2eb08e64422d494cb999b
SHA1

0cb5e676d12b2ec65fc32b40bc9156b9e68fb005
SHA256

c0c71726ae07bded4d2dbb380eaccb837361a8b72cb528222ecc5615e33a67a2
SHA512

05095f24cc71e410f89309940414f0c547c4653559250478bdc8addcd171f3641b563ae0019585f9bb2ee1eef3c80f586beea1c0c52beb6d86c5f681de4fd24c
SSDEEP

3072:obpDCw1p3vmLvsZIaVwiwDcIbDHDCm/DER4eQ9pssU9Z:gDCwfG1bnxLERResdZ

Score

10^/10

evasion persistence

Malware Config

Signatures

Modifies visibility of file extensions in Explorer 2 TTPs 3 IoCs

evasion

Hidden Files and Directories

T1158

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	hosts.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	c0c71726ae07bded4d2dbb380eaccb837361a8b72cb528222ecc5615e33a67a2.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	avscan.exe

Modifies visiblity of hidden/system files in Explorer 2 TTPs 3 IoCs

evasion

Hidden Files and Directories

T1158

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	c0c71726ae07bded4d2dbb380eaccb837361a8b72cb528222ecc5615e33a67a2.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	avscan.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	hosts.exe

Adds policy Run key to start application 2 TTPs 6 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\GBQHURCC = "W_X_C.bat"	WScript.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	WScript.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\GBQHURCC = "W_X_C.bat"	WScript.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	WScript.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\GBQHURCC = "W_X_C.bat"	WScript.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	WScript.exe

Executes dropped EXE 6 IoCs

pid	Process
4984	avscan.exe
2236	avscan.exe
3092	hosts.exe
1624	hosts.exe
112	avscan.exe
1852	hosts.exe

Checks computer location settings 2 TTPs 3 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation	cmd.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation	cmd.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation	cmd.exe

Adds Run key to start application 2 TTPs 6 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\avscan = "C:\\Users\\Admin\\AppData\\Local\\Temp\\avscan.exe"	hosts.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run	c0c71726ae07bded4d2dbb380eaccb837361a8b72cb528222ecc5615e33a67a2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\avscan = "C:\\Users\\Admin\\AppData\\Local\\Temp\\avscan.exe"	c0c71726ae07bded4d2dbb380eaccb837361a8b72cb528222ecc5615e33a67a2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run	avscan.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\avscan = "C:\\Users\\Admin\\AppData\\Local\\Temp\\avscan.exe"	avscan.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run	hosts.exe

Drops file in Windows directory 5 IoCs

description	ioc	Process
File opened for modification	C:\Windows\hosts.exe	c0c71726ae07bded4d2dbb380eaccb837361a8b72cb528222ecc5615e33a67a2.exe
File opened for modification	C:\Windows\hosts.exe	avscan.exe
File opened for modification	C:\Windows\hosts.exe	hosts.exe
File created	C:\windows\W_X_C.vbs	c0c71726ae07bded4d2dbb380eaccb837361a8b72cb528222ecc5615e33a67a2.exe
File created	\??\c:\windows\W_X_C.bat	c0c71726ae07bded4d2dbb380eaccb837361a8b72cb528222ecc5615e33a67a2.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies registry class 4 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\Local Settings	c0c71726ae07bded4d2dbb380eaccb837361a8b72cb528222ecc5615e33a67a2.exe
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\Local Settings	cmd.exe

Modifies registry key 1 TTPs 9 IoCs

Modify Registry

T1112

pid	Process
2168	REG.exe
5028	REG.exe
2376	REG.exe
3908	REG.exe
3276	REG.exe
4744	REG.exe
1112	REG.exe
4228	REG.exe
1896	REG.exe

Suspicious behavior: GetForegroundWindowSpam 3 IoCs

pid	Process
4964	c0c71726ae07bded4d2dbb380eaccb837361a8b72cb528222ecc5615e33a67a2.exe
4984	avscan.exe
3092	hosts.exe

Suspicious use of SetWindowsHookEx 7 IoCs

pid	Process
4964	c0c71726ae07bded4d2dbb380eaccb837361a8b72cb528222ecc5615e33a67a2.exe
4984	avscan.exe
2236	avscan.exe
1624	hosts.exe
3092	hosts.exe
112	avscan.exe
1852	hosts.exe

Suspicious use of WriteProcessMemory 63 IoCs

description	pid	Process	procid_target
PID 4964 wrote to memory of 4744	4964	c0c71726ae07bded4d2dbb380eaccb837361a8b72cb528222ecc5615e33a67a2.exe	82
PID 4964 wrote to memory of 4744	4964	c0c71726ae07bded4d2dbb380eaccb837361a8b72cb528222ecc5615e33a67a2.exe	82
PID 4964 wrote to memory of 4744	4964	c0c71726ae07bded4d2dbb380eaccb837361a8b72cb528222ecc5615e33a67a2.exe	82
PID 4964 wrote to memory of 4984	4964	c0c71726ae07bded4d2dbb380eaccb837361a8b72cb528222ecc5615e33a67a2.exe	84
PID 4964 wrote to memory of 4984	4964	c0c71726ae07bded4d2dbb380eaccb837361a8b72cb528222ecc5615e33a67a2.exe	84
PID 4964 wrote to memory of 4984	4964	c0c71726ae07bded4d2dbb380eaccb837361a8b72cb528222ecc5615e33a67a2.exe	84
PID 4984 wrote to memory of 2236	4984	avscan.exe	85
PID 4984 wrote to memory of 2236	4984	avscan.exe	85
PID 4984 wrote to memory of 2236	4984	avscan.exe	85
PID 4984 wrote to memory of 516	4984	avscan.exe	86
PID 4984 wrote to memory of 516	4984	avscan.exe	86
PID 4984 wrote to memory of 516	4984	avscan.exe	86
PID 4964 wrote to memory of 4312	4964	c0c71726ae07bded4d2dbb380eaccb837361a8b72cb528222ecc5615e33a67a2.exe	88
PID 4964 wrote to memory of 4312	4964	c0c71726ae07bded4d2dbb380eaccb837361a8b72cb528222ecc5615e33a67a2.exe	88
PID 4964 wrote to memory of 4312	4964	c0c71726ae07bded4d2dbb380eaccb837361a8b72cb528222ecc5615e33a67a2.exe	88
PID 4312 wrote to memory of 1624	4312	cmd.exe	90
PID 4312 wrote to memory of 1624	4312	cmd.exe	90
PID 4312 wrote to memory of 1624	4312	cmd.exe	90
PID 516 wrote to memory of 3092	516	cmd.exe	91
PID 516 wrote to memory of 3092	516	cmd.exe	91
PID 516 wrote to memory of 3092	516	cmd.exe	91
PID 3092 wrote to memory of 112	3092	hosts.exe	92
PID 3092 wrote to memory of 112	3092	hosts.exe	92
PID 3092 wrote to memory of 112	3092	hosts.exe	92
PID 3092 wrote to memory of 4648	3092	hosts.exe	94
PID 3092 wrote to memory of 4648	3092	hosts.exe	94
PID 3092 wrote to memory of 4648	3092	hosts.exe	94
PID 4648 wrote to memory of 1852	4648	cmd.exe	96
PID 4648 wrote to memory of 1852	4648	cmd.exe	96
PID 4648 wrote to memory of 1852	4648	cmd.exe	96
PID 516 wrote to memory of 1472	516	cmd.exe	97
PID 516 wrote to memory of 1472	516	cmd.exe	97
PID 516 wrote to memory of 1472	516	cmd.exe	97
PID 4312 wrote to memory of 4380	4312	cmd.exe	98
PID 4312 wrote to memory of 4380	4312	cmd.exe	98
PID 4312 wrote to memory of 4380	4312	cmd.exe	98
PID 4648 wrote to memory of 3464	4648	cmd.exe	99
PID 4648 wrote to memory of 3464	4648	cmd.exe	99
PID 4648 wrote to memory of 3464	4648	cmd.exe	99
PID 4984 wrote to memory of 2168	4984	avscan.exe	107
PID 4984 wrote to memory of 2168	4984	avscan.exe	107
PID 4984 wrote to memory of 2168	4984	avscan.exe	107
PID 3092 wrote to memory of 5028	3092	hosts.exe	109
PID 3092 wrote to memory of 5028	3092	hosts.exe	109
PID 3092 wrote to memory of 5028	3092	hosts.exe	109
PID 4984 wrote to memory of 1112	4984	avscan.exe	111
PID 4984 wrote to memory of 1112	4984	avscan.exe	111
PID 4984 wrote to memory of 1112	4984	avscan.exe	111
PID 3092 wrote to memory of 4228	3092	hosts.exe	113
PID 3092 wrote to memory of 4228	3092	hosts.exe	113
PID 3092 wrote to memory of 4228	3092	hosts.exe	113
PID 4984 wrote to memory of 2376	4984	avscan.exe	115
PID 4984 wrote to memory of 2376	4984	avscan.exe	115
PID 4984 wrote to memory of 2376	4984	avscan.exe	115
PID 3092 wrote to memory of 3908	3092	hosts.exe	117
PID 3092 wrote to memory of 3908	3092	hosts.exe	117
PID 3092 wrote to memory of 3908	3092	hosts.exe	117
PID 4984 wrote to memory of 1896	4984	avscan.exe	119
PID 4984 wrote to memory of 1896	4984	avscan.exe	119
PID 4984 wrote to memory of 1896	4984	avscan.exe	119
PID 3092 wrote to memory of 3276	3092	hosts.exe	121
PID 3092 wrote to memory of 3276	3092	hosts.exe	121
PID 3092 wrote to memory of 3276	3092	hosts.exe	121

C:\Users\Admin\AppData\Local\Temp\c0c71726ae07bded4d2dbb380eaccb837361a8b72cb528222ecc5615e33a67a2.exe
"C:\Users\Admin\AppData\Local\Temp\c0c71726ae07bded4d2dbb380eaccb837361a8b72cb528222ecc5615e33a67a2.exe"
1⤵
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- Adds Run key to start application
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4964
- C:\Windows\SysWOW64\REG.exe
  REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
  2⤵
  - Modifies registry key
  PID:4744
- C:\Users\Admin\AppData\Local\Temp\avscan.exe
  C:\Users\Admin\AppData\Local\Temp\avscan.exe
  2⤵
  - Modifies visibility of file extensions in Explorer
  - Modifies visiblity of hidden/system files in Explorer
  - Executes dropped EXE
  - Adds Run key to start application
  - Drops file in Windows directory
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4984
- - C:\Users\Admin\AppData\Local\Temp\avscan.exe
    C:\Users\Admin\AppData\Local\Temp\avscan.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2236
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c c:\windows\W_X_C.bat
    3⤵
    - Checks computer location settings
    - Modifies registry class
    - Suspicious use of WriteProcessMemory
    PID:516
  - - C:\windows\hosts.exe
      C:\windows\hosts.exe
      4⤵
      Modifies visibility of file extensions in Explorer
      Modifies visiblity of hidden/system files in Explorer
      Executes dropped EXE
      Adds Run key to start application
      Drops file in Windows directory
      Suspicious behavior: GetForegroundWindowSpam
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:3092
    - - C:\Users\Admin\AppData\Local\Temp\avscan.exe
        
        C:\Users\Admin\AppData\Local\Temp\avscan.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:112
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c c:\windows\W_X_C.bat
        5⤵
        Checks computer location settings
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4648
      - C:\windows\hosts.exe
        
        C:\windows\hosts.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1852
      - C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Windows\W_X_C.vbs"
        6⤵
        Adds policy Run key to start application
        
        PID:3464
    - - C:\Windows\SysWOW64\REG.exe
        
        REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
        5⤵
        Modifies registry key
        
        PID:5028
    - - C:\Windows\SysWOW64\REG.exe
        
        REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
        5⤵
        Modifies registry key
        
        PID:4228
    - - C:\Windows\SysWOW64\REG.exe
        
        REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
        5⤵
        Modifies registry key
        
        PID:3908
    - - C:\Windows\SysWOW64\REG.exe
        
        REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
        5⤵
        Modifies registry key
        
        PID:3276
  - - C:\Windows\SysWOW64\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Windows\W_X_C.vbs"
      4⤵
      Adds policy Run key to start application
      PID:1472
- - C:\Windows\SysWOW64\REG.exe
    REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
    3⤵
    - Modifies registry key
    PID:2168
- - C:\Windows\SysWOW64\REG.exe
    REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
    3⤵
    - Modifies registry key
    PID:1112
- - C:\Windows\SysWOW64\REG.exe
    REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
    3⤵
    - Modifies registry key
    PID:2376
- - C:\Windows\SysWOW64\REG.exe
    REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
    3⤵
    - Modifies registry key
    PID:1896
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c c:\windows\W_X_C.bat
  2⤵
  - Checks computer location settings
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:4312
- - C:\windows\hosts.exe
    C:\windows\hosts.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1624
- - C:\Windows\SysWOW64\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Windows\W_X_C.vbs"
    3⤵
    - Adds policy Run key to start application
    PID:4380

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4716

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Hidden Files and Directories

T1158

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Hidden Files and Directories

T1158

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\avscan.exe

Filesize
190KB

MD5
33c25bcba1d95afd58445f2a44edb657

SHA1
4a3794e0377658b8b86d912bbe1384118ba84d50

SHA256
e76a1b3f720a9bd69da08709d6dfe5adf683e033711e09aa38e0346b76a1a9f8

SHA512
6aa18727d5b73c38aae37b989f8dda6caaed1f08875a54a091948461727af28e8a63c494d99992315d5acd80bb5edf473fa41682ce027813acd2774b8e6297ac

Download Submit
C:\Users\Admin\AppData\Local\Temp\avscan.exe

Filesize
190KB

MD5
33c25bcba1d95afd58445f2a44edb657

SHA1
4a3794e0377658b8b86d912bbe1384118ba84d50

SHA256
e76a1b3f720a9bd69da08709d6dfe5adf683e033711e09aa38e0346b76a1a9f8

SHA512
6aa18727d5b73c38aae37b989f8dda6caaed1f08875a54a091948461727af28e8a63c494d99992315d5acd80bb5edf473fa41682ce027813acd2774b8e6297ac

Download Submit
C:\Users\Admin\AppData\Local\Temp\avscan.exe

Filesize
190KB

MD5
33c25bcba1d95afd58445f2a44edb657

SHA1
4a3794e0377658b8b86d912bbe1384118ba84d50

SHA256
e76a1b3f720a9bd69da08709d6dfe5adf683e033711e09aa38e0346b76a1a9f8

SHA512
6aa18727d5b73c38aae37b989f8dda6caaed1f08875a54a091948461727af28e8a63c494d99992315d5acd80bb5edf473fa41682ce027813acd2774b8e6297ac

Download Submit
C:\Users\Admin\AppData\Local\Temp\avscan.exe

Filesize
190KB

MD5
33c25bcba1d95afd58445f2a44edb657

SHA1
4a3794e0377658b8b86d912bbe1384118ba84d50

SHA256
e76a1b3f720a9bd69da08709d6dfe5adf683e033711e09aa38e0346b76a1a9f8

SHA512
6aa18727d5b73c38aae37b989f8dda6caaed1f08875a54a091948461727af28e8a63c494d99992315d5acd80bb5edf473fa41682ce027813acd2774b8e6297ac

Download Submit
C:\Windows\W_X_C.vbs

Filesize
195B

MD5
5b87381bf407d7c6018a8b11c3e20f92

SHA1
bb61b28d9c8fd7dfeb13a397c49a1be3abc06ca2

SHA256
4785d6a229d0872fe90c75ab620de9a680d7f07ccd27a134da2afc4ee88f34f3

SHA512
05db1178f671e9d6c3a1c601349093447b04ebddcd071a06f7cc92cbaf7efb53027bc92523a19372a08ca5af715cc9955649255f8be1909b5e594385b3dcbe3d

Download Submit
C:\Windows\hosts.exe

Filesize
190KB

MD5
7207d103e2fcc294dd761dc201fb3845

SHA1
4190c97c2cc6e54a39775c8797b39b832bb6b098

SHA256
849b9ce66c97206338aca9292ec79c6f738a8eb9cebc6f6ea8664dd4009b4348

SHA512
e105b689d23af6b535020ae14371ffc3cc3e55c3bd129f1ba71ae6c4452cfbd6a90f1dbd1132c729cbde6aa34094d8e9a6f74a961ec919cda5bae7e09a37ce3f

Download Submit
C:\Windows\hosts.exe

Filesize
190KB

MD5
7207d103e2fcc294dd761dc201fb3845

SHA1
4190c97c2cc6e54a39775c8797b39b832bb6b098

SHA256
849b9ce66c97206338aca9292ec79c6f738a8eb9cebc6f6ea8664dd4009b4348

SHA512
e105b689d23af6b535020ae14371ffc3cc3e55c3bd129f1ba71ae6c4452cfbd6a90f1dbd1132c729cbde6aa34094d8e9a6f74a961ec919cda5bae7e09a37ce3f

Download Submit
C:\Windows\hosts.exe

Filesize
190KB

MD5
7207d103e2fcc294dd761dc201fb3845

SHA1
4190c97c2cc6e54a39775c8797b39b832bb6b098

SHA256
849b9ce66c97206338aca9292ec79c6f738a8eb9cebc6f6ea8664dd4009b4348

SHA512
e105b689d23af6b535020ae14371ffc3cc3e55c3bd129f1ba71ae6c4452cfbd6a90f1dbd1132c729cbde6aa34094d8e9a6f74a961ec919cda5bae7e09a37ce3f

Download Submit
C:\Windows\hosts.exe

Filesize
190KB

MD5
7207d103e2fcc294dd761dc201fb3845

SHA1
4190c97c2cc6e54a39775c8797b39b832bb6b098

SHA256
849b9ce66c97206338aca9292ec79c6f738a8eb9cebc6f6ea8664dd4009b4348

SHA512
e105b689d23af6b535020ae14371ffc3cc3e55c3bd129f1ba71ae6c4452cfbd6a90f1dbd1132c729cbde6aa34094d8e9a6f74a961ec919cda5bae7e09a37ce3f

Download Submit
C:\windows\hosts.exe

Filesize
190KB

MD5
7207d103e2fcc294dd761dc201fb3845

SHA1
4190c97c2cc6e54a39775c8797b39b832bb6b098

SHA256
849b9ce66c97206338aca9292ec79c6f738a8eb9cebc6f6ea8664dd4009b4348

SHA512
e105b689d23af6b535020ae14371ffc3cc3e55c3bd129f1ba71ae6c4452cfbd6a90f1dbd1132c729cbde6aa34094d8e9a6f74a961ec919cda5bae7e09a37ce3f

Download Submit
\??\c:\windows\W_X_C.bat

Filesize
336B

MD5
4db9f8b6175722b62ececeeeba1ce307

SHA1
3b3ba8414706e72a6fa19e884a97b87609e11e47

SHA256
d2150b9e5a4ce55e140f0ca91c4e300715d42095c8fddf58c77037cdd2cfaf78

SHA512
1d6dc274cf7a3dd704f840e6a5ad57ab4c4e35d5f09489aeff520bb797e1c825bac53fc335156fe41e767a46520d031855fe42fe7b175409ebe5e9e986fb9b8b

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads