0f82feba9e0a27ad85d50aa679d752be2bbd01a2da26288b0ea910d167dd5d4b

Analysis

max time kernel
124s
max time network
107s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
21-10-2022 02:31

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0f82feba9e0a27ad85d50aa679d752be2bbd01a2da26288b0ea910d167dd5d4b.exe
Size

175KB
MD5

72233adb99cb8500659a93deed9d93e7
SHA1

8c5e0775b9315c3815eb1eb4ed7b999499318c1a
SHA256

0f82feba9e0a27ad85d50aa679d752be2bbd01a2da26288b0ea910d167dd5d4b
SHA512

90375e23ac78d0319e3b58c663669c28599fbbfb5fe6f0b727b4525848c0c2d0f787cf4861c87f4de685ea0c1681bf4c4304729efdbf14f78700e3404e6cf207
SSDEEP

3072:obpDCw1p3vmLvsZIaVwiwDcIbDHDCmT47++M4lJiSp:gDCwfG1bnxM6+MIJ1

Score

10^/10

evasion persistence

Malware Config

Signatures

Modifies visibility of file extensions in Explorer 2 TTPs 3 IoCs

evasion

Hidden Files and Directories

T1158

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	0f82feba9e0a27ad85d50aa679d752be2bbd01a2da26288b0ea910d167dd5d4b.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	avscan.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	hosts.exe

Modifies visiblity of hidden/system files in Explorer 2 TTPs 3 IoCs

evasion

Hidden Files and Directories

T1158

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	0f82feba9e0a27ad85d50aa679d752be2bbd01a2da26288b0ea910d167dd5d4b.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	avscan.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	hosts.exe

Adds policy Run key to start application 2 TTPs 6 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	WScript.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\IYMUGYHL = "W_X_C.bat"	WScript.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	WScript.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\IYMUGYHL = "W_X_C.bat"	WScript.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	WScript.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\IYMUGYHL = "W_X_C.bat"	WScript.exe

Executes dropped EXE 6 IoCs

pid	Process
4124	avscan.exe
4008	avscan.exe
1096	hosts.exe
5104	hosts.exe
3708	avscan.exe
4412	hosts.exe

Checks computer location settings 2 TTPs 3 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation	cmd.exe
Key value queried	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation	cmd.exe
Key value queried	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation	cmd.exe

Adds Run key to start application 2 TTPs 6 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run	0f82feba9e0a27ad85d50aa679d752be2bbd01a2da26288b0ea910d167dd5d4b.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\avscan = "C:\\Users\\Admin\\AppData\\Local\\Temp\\avscan.exe"	0f82feba9e0a27ad85d50aa679d752be2bbd01a2da26288b0ea910d167dd5d4b.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run	avscan.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\avscan = "C:\\Users\\Admin\\AppData\\Local\\Temp\\avscan.exe"	avscan.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run	hosts.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\avscan = "C:\\Users\\Admin\\AppData\\Local\\Temp\\avscan.exe"	hosts.exe

Drops file in Windows directory 5 IoCs

description	ioc	Process
File created	\??\c:\windows\W_X_C.bat	0f82feba9e0a27ad85d50aa679d752be2bbd01a2da26288b0ea910d167dd5d4b.exe
File opened for modification	C:\Windows\hosts.exe	0f82feba9e0a27ad85d50aa679d752be2bbd01a2da26288b0ea910d167dd5d4b.exe
File opened for modification	C:\Windows\hosts.exe	avscan.exe
File opened for modification	C:\Windows\hosts.exe	hosts.exe
File created	C:\windows\W_X_C.vbs	0f82feba9e0a27ad85d50aa679d752be2bbd01a2da26288b0ea910d167dd5d4b.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies registry class 4 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\Local Settings	0f82feba9e0a27ad85d50aa679d752be2bbd01a2da26288b0ea910d167dd5d4b.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\Local Settings	cmd.exe

Modifies registry key 1 TTPs 9 IoCs

Modify Registry

T1112

pid	Process
1776	REG.exe
5000	REG.exe
1600	REG.exe
4160	REG.exe
2440	REG.exe
796	REG.exe
2780	REG.exe
4988	REG.exe
4028	REG.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

pid	Process
4124	avscan.exe
1096	hosts.exe

Suspicious use of SetWindowsHookEx 7 IoCs

pid	Process
2228	0f82feba9e0a27ad85d50aa679d752be2bbd01a2da26288b0ea910d167dd5d4b.exe
4124	avscan.exe
4008	avscan.exe
1096	hosts.exe
5104	hosts.exe
3708	avscan.exe
4412	hosts.exe

Suspicious use of WriteProcessMemory 63 IoCs

description	pid	Process	procid_target
PID 2228 wrote to memory of 2440	2228	0f82feba9e0a27ad85d50aa679d752be2bbd01a2da26288b0ea910d167dd5d4b.exe	83
PID 2228 wrote to memory of 2440	2228	0f82feba9e0a27ad85d50aa679d752be2bbd01a2da26288b0ea910d167dd5d4b.exe	83
PID 2228 wrote to memory of 2440	2228	0f82feba9e0a27ad85d50aa679d752be2bbd01a2da26288b0ea910d167dd5d4b.exe	83
PID 2228 wrote to memory of 4124	2228	0f82feba9e0a27ad85d50aa679d752be2bbd01a2da26288b0ea910d167dd5d4b.exe	85
PID 2228 wrote to memory of 4124	2228	0f82feba9e0a27ad85d50aa679d752be2bbd01a2da26288b0ea910d167dd5d4b.exe	85
PID 2228 wrote to memory of 4124	2228	0f82feba9e0a27ad85d50aa679d752be2bbd01a2da26288b0ea910d167dd5d4b.exe	85
PID 4124 wrote to memory of 4008	4124	avscan.exe	86
PID 4124 wrote to memory of 4008	4124	avscan.exe	86
PID 4124 wrote to memory of 4008	4124	avscan.exe	86
PID 4124 wrote to memory of 1756	4124	avscan.exe	87
PID 4124 wrote to memory of 1756	4124	avscan.exe	87
PID 4124 wrote to memory of 1756	4124	avscan.exe	87
PID 2228 wrote to memory of 3988	2228	0f82feba9e0a27ad85d50aa679d752be2bbd01a2da26288b0ea910d167dd5d4b.exe	88
PID 2228 wrote to memory of 3988	2228	0f82feba9e0a27ad85d50aa679d752be2bbd01a2da26288b0ea910d167dd5d4b.exe	88
PID 2228 wrote to memory of 3988	2228	0f82feba9e0a27ad85d50aa679d752be2bbd01a2da26288b0ea910d167dd5d4b.exe	88
PID 1756 wrote to memory of 1096	1756	cmd.exe	92
PID 1756 wrote to memory of 1096	1756	cmd.exe	92
PID 1756 wrote to memory of 1096	1756	cmd.exe	92
PID 3988 wrote to memory of 5104	3988	cmd.exe	91
PID 3988 wrote to memory of 5104	3988	cmd.exe	91
PID 3988 wrote to memory of 5104	3988	cmd.exe	91
PID 1096 wrote to memory of 3708	1096	hosts.exe	93
PID 1096 wrote to memory of 3708	1096	hosts.exe	93
PID 1096 wrote to memory of 3708	1096	hosts.exe	93
PID 1096 wrote to memory of 4012	1096	hosts.exe	95
PID 1096 wrote to memory of 4012	1096	hosts.exe	95
PID 1096 wrote to memory of 4012	1096	hosts.exe	95
PID 1756 wrote to memory of 2152	1756	cmd.exe	98
PID 1756 wrote to memory of 2152	1756	cmd.exe	98
PID 1756 wrote to memory of 2152	1756	cmd.exe	98
PID 3988 wrote to memory of 2404	3988	cmd.exe	97
PID 3988 wrote to memory of 2404	3988	cmd.exe	97
PID 3988 wrote to memory of 2404	3988	cmd.exe	97
PID 4012 wrote to memory of 4412	4012	cmd.exe	99
PID 4012 wrote to memory of 4412	4012	cmd.exe	99
PID 4012 wrote to memory of 4412	4012	cmd.exe	99
PID 4012 wrote to memory of 4140	4012	cmd.exe	100
PID 4012 wrote to memory of 4140	4012	cmd.exe	100
PID 4012 wrote to memory of 4140	4012	cmd.exe	100
PID 4124 wrote to memory of 796	4124	avscan.exe	108
PID 4124 wrote to memory of 796	4124	avscan.exe	108
PID 4124 wrote to memory of 796	4124	avscan.exe	108
PID 1096 wrote to memory of 2780	1096	hosts.exe	111
PID 1096 wrote to memory of 2780	1096	hosts.exe	111
PID 1096 wrote to memory of 2780	1096	hosts.exe	111
PID 4124 wrote to memory of 4988	4124	avscan.exe	112
PID 4124 wrote to memory of 4988	4124	avscan.exe	112
PID 4124 wrote to memory of 4988	4124	avscan.exe	112
PID 1096 wrote to memory of 1776	1096	hosts.exe	114
PID 1096 wrote to memory of 1776	1096	hosts.exe	114
PID 1096 wrote to memory of 1776	1096	hosts.exe	114
PID 4124 wrote to memory of 5000	4124	avscan.exe	116
PID 4124 wrote to memory of 5000	4124	avscan.exe	116
PID 4124 wrote to memory of 5000	4124	avscan.exe	116
PID 1096 wrote to memory of 1600	1096	hosts.exe	118
PID 1096 wrote to memory of 1600	1096	hosts.exe	118
PID 1096 wrote to memory of 1600	1096	hosts.exe	118
PID 4124 wrote to memory of 4160	4124	avscan.exe	120
PID 4124 wrote to memory of 4160	4124	avscan.exe	120
PID 4124 wrote to memory of 4160	4124	avscan.exe	120
PID 1096 wrote to memory of 4028	1096	hosts.exe	122
PID 1096 wrote to memory of 4028	1096	hosts.exe	122
PID 1096 wrote to memory of 4028	1096	hosts.exe	122

C:\Users\Admin\AppData\Local\Temp\0f82feba9e0a27ad85d50aa679d752be2bbd01a2da26288b0ea910d167dd5d4b.exe
"C:\Users\Admin\AppData\Local\Temp\0f82feba9e0a27ad85d50aa679d752be2bbd01a2da26288b0ea910d167dd5d4b.exe"
1⤵
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- Adds Run key to start application
- Drops file in Windows directory
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2228
- C:\Windows\SysWOW64\REG.exe
  REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
  2⤵
  - Modifies registry key
  PID:2440
- C:\Users\Admin\AppData\Local\Temp\avscan.exe
  C:\Users\Admin\AppData\Local\Temp\avscan.exe
  2⤵
  - Modifies visibility of file extensions in Explorer
  - Modifies visiblity of hidden/system files in Explorer
  - Executes dropped EXE
  - Adds Run key to start application
  - Drops file in Windows directory
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4124
- - C:\Users\Admin\AppData\Local\Temp\avscan.exe
    C:\Users\Admin\AppData\Local\Temp\avscan.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:4008
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c c:\windows\W_X_C.bat
    3⤵
    - Checks computer location settings
    - Modifies registry class
    - Suspicious use of WriteProcessMemory
    PID:1756
  - - C:\windows\hosts.exe
      C:\windows\hosts.exe
      4⤵
      Modifies visibility of file extensions in Explorer
      Modifies visiblity of hidden/system files in Explorer
      Executes dropped EXE
      Adds Run key to start application
      Drops file in Windows directory
      Suspicious behavior: GetForegroundWindowSpam
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:1096
    - - C:\Users\Admin\AppData\Local\Temp\avscan.exe
        
        C:\Users\Admin\AppData\Local\Temp\avscan.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3708
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c c:\windows\W_X_C.bat
        5⤵
        Checks computer location settings
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4012
      - C:\windows\hosts.exe
        
        C:\windows\hosts.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4412
      - C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Windows\W_X_C.vbs"
        6⤵
        Adds policy Run key to start application
        
        PID:4140
    - - C:\Windows\SysWOW64\REG.exe
        
        REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
        5⤵
        Modifies registry key
        
        PID:2780
    - - C:\Windows\SysWOW64\REG.exe
        
        REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
        5⤵
        Modifies registry key
        
        PID:1776
    - - C:\Windows\SysWOW64\REG.exe
        
        REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
        5⤵
        Modifies registry key
        
        PID:1600
    - - C:\Windows\SysWOW64\REG.exe
        
        REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
        5⤵
        Modifies registry key
        
        PID:4028
  - - C:\Windows\SysWOW64\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Windows\W_X_C.vbs"
      4⤵
      Adds policy Run key to start application
      PID:2152
- - C:\Windows\SysWOW64\REG.exe
    REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
    3⤵
    - Modifies registry key
    PID:796
- - C:\Windows\SysWOW64\REG.exe
    REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
    3⤵
    - Modifies registry key
    PID:4988
- - C:\Windows\SysWOW64\REG.exe
    REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
    3⤵
    - Modifies registry key
    PID:5000
- - C:\Windows\SysWOW64\REG.exe
    REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
    3⤵
    - Modifies registry key
    PID:4160
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c c:\windows\W_X_C.bat
  2⤵
  - Checks computer location settings
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:3988
- - C:\windows\hosts.exe
    C:\windows\hosts.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:5104
- - C:\Windows\SysWOW64\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Windows\W_X_C.vbs"
    3⤵
    - Adds policy Run key to start application
    PID:2404

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:1740

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Hidden Files and Directories

T1158

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Hidden Files and Directories

T1158

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\avscan.exe

Filesize
175KB

MD5
dfccca897fd0592f51af858f22888565

SHA1
218b09b85d94455b3ef753ea5935f131e4af0887

SHA256
c2e5c4370d14fc5089df714bba779ccdb926cc6ed89ee6ab87cf1afd615ebaeb

SHA512
aae983ab7ee29e8dac8ef1fa20b2529bbd59f1d7232f92566eab57db114b08395fcf1f1e02005cff79fc3bc7773b2ee5c855aff46dc77f193e5d4e6ad4defc3f

Download Submit
C:\Users\Admin\AppData\Local\Temp\avscan.exe

Filesize
175KB

MD5
dfccca897fd0592f51af858f22888565

SHA1
218b09b85d94455b3ef753ea5935f131e4af0887

SHA256
c2e5c4370d14fc5089df714bba779ccdb926cc6ed89ee6ab87cf1afd615ebaeb

SHA512
aae983ab7ee29e8dac8ef1fa20b2529bbd59f1d7232f92566eab57db114b08395fcf1f1e02005cff79fc3bc7773b2ee5c855aff46dc77f193e5d4e6ad4defc3f

Download Submit
C:\Users\Admin\AppData\Local\Temp\avscan.exe

Filesize
175KB

MD5
dfccca897fd0592f51af858f22888565

SHA1
218b09b85d94455b3ef753ea5935f131e4af0887

SHA256
c2e5c4370d14fc5089df714bba779ccdb926cc6ed89ee6ab87cf1afd615ebaeb

SHA512
aae983ab7ee29e8dac8ef1fa20b2529bbd59f1d7232f92566eab57db114b08395fcf1f1e02005cff79fc3bc7773b2ee5c855aff46dc77f193e5d4e6ad4defc3f

Download Submit
C:\Users\Admin\AppData\Local\Temp\avscan.exe

Filesize
175KB

MD5
dfccca897fd0592f51af858f22888565

SHA1
218b09b85d94455b3ef753ea5935f131e4af0887

SHA256
c2e5c4370d14fc5089df714bba779ccdb926cc6ed89ee6ab87cf1afd615ebaeb

SHA512
aae983ab7ee29e8dac8ef1fa20b2529bbd59f1d7232f92566eab57db114b08395fcf1f1e02005cff79fc3bc7773b2ee5c855aff46dc77f193e5d4e6ad4defc3f

Download Submit
C:\Windows\W_X_C.vbs

Filesize
195B

MD5
0e0483d4802632100b6bfe8bc2e5d661

SHA1
767e0deb7dcaa7676004e6053957c36cecfeeefa

SHA256
81bbebb8d0e77ffffbc7b7d24afdcdce4089f4b04d1a12284eda861c25e03f9f

SHA512
8279b0559ca30a0adc6c8614870c3e445866c20f0617a7153cab41982b451dfe9ea44478f37b884465235714623ef26a56f5ea3d1cb81767487c494d3703ab29

Download Submit
C:\Windows\hosts.exe

Filesize
175KB

MD5
21ad212380818ba7892abb49040c8a51

SHA1
3d1ac318c86229c89b0aa0d4547975b4ebcfcf98

SHA256
bd8c9f5bcec5e7dad791bccaeee853d64c625212cd50f86fab3c92e5a8487cb4

SHA512
f8923fe465176801bdef98d2bbb502f3175f5afce722da0d92bb74ca339f66db70bce1064c46ca3126201adc7761e5f2a40c37887cfa01e5978df77b8935b5f6

Download Submit
C:\Windows\hosts.exe

Filesize
175KB

MD5
21ad212380818ba7892abb49040c8a51

SHA1
3d1ac318c86229c89b0aa0d4547975b4ebcfcf98

SHA256
bd8c9f5bcec5e7dad791bccaeee853d64c625212cd50f86fab3c92e5a8487cb4

SHA512
f8923fe465176801bdef98d2bbb502f3175f5afce722da0d92bb74ca339f66db70bce1064c46ca3126201adc7761e5f2a40c37887cfa01e5978df77b8935b5f6

Download Submit
C:\Windows\hosts.exe

Filesize
175KB

MD5
21ad212380818ba7892abb49040c8a51

SHA1
3d1ac318c86229c89b0aa0d4547975b4ebcfcf98

SHA256
bd8c9f5bcec5e7dad791bccaeee853d64c625212cd50f86fab3c92e5a8487cb4

SHA512
f8923fe465176801bdef98d2bbb502f3175f5afce722da0d92bb74ca339f66db70bce1064c46ca3126201adc7761e5f2a40c37887cfa01e5978df77b8935b5f6

Download Submit
C:\Windows\hosts.exe

Filesize
175KB

MD5
21ad212380818ba7892abb49040c8a51

SHA1
3d1ac318c86229c89b0aa0d4547975b4ebcfcf98

SHA256
bd8c9f5bcec5e7dad791bccaeee853d64c625212cd50f86fab3c92e5a8487cb4

SHA512
f8923fe465176801bdef98d2bbb502f3175f5afce722da0d92bb74ca339f66db70bce1064c46ca3126201adc7761e5f2a40c37887cfa01e5978df77b8935b5f6

Download Submit
C:\windows\hosts.exe

Filesize
175KB

MD5
21ad212380818ba7892abb49040c8a51

SHA1
3d1ac318c86229c89b0aa0d4547975b4ebcfcf98

SHA256
bd8c9f5bcec5e7dad791bccaeee853d64c625212cd50f86fab3c92e5a8487cb4

SHA512
f8923fe465176801bdef98d2bbb502f3175f5afce722da0d92bb74ca339f66db70bce1064c46ca3126201adc7761e5f2a40c37887cfa01e5978df77b8935b5f6

Download Submit
\??\c:\windows\W_X_C.bat

Filesize
336B

MD5
4db9f8b6175722b62ececeeeba1ce307

SHA1
3b3ba8414706e72a6fa19e884a97b87609e11e47

SHA256
d2150b9e5a4ce55e140f0ca91c4e300715d42095c8fddf58c77037cdd2cfaf78

SHA512
1d6dc274cf7a3dd704f840e6a5ad57ab4c4e35d5f09489aeff520bb797e1c825bac53fc335156fe41e767a46520d031855fe42fe7b175409ebe5e9e986fb9b8b

Download Submit
memory/796-170-0x0000000000000000-mapping.dmp

Download
memory/1096-148-0x0000000000000000-mapping.dmp

Download
memory/1600-175-0x0000000000000000-mapping.dmp

Download
memory/1756-145-0x0000000000000000-mapping.dmp

Download
memory/1776-173-0x0000000000000000-mapping.dmp

Download
memory/2152-163-0x0000000000000000-mapping.dmp

Download
memory/2404-164-0x0000000000000000-mapping.dmp

Download
memory/2440-134-0x0000000000000000-mapping.dmp

Download
memory/2780-171-0x0000000000000000-mapping.dmp

Download
memory/3708-157-0x0000000000000000-mapping.dmp

Download
memory/3988-146-0x0000000000000000-mapping.dmp

Download
memory/4008-141-0x0000000000000000-mapping.dmp

Download
memory/4012-161-0x0000000000000000-mapping.dmp

Download
memory/4028-177-0x0000000000000000-mapping.dmp

Download
memory/4124-135-0x0000000000000000-mapping.dmp

Download
memory/4140-169-0x0000000000000000-mapping.dmp

Download
memory/4160-176-0x0000000000000000-mapping.dmp

Download
memory/4412-165-0x0000000000000000-mapping.dmp

Download
memory/4988-172-0x0000000000000000-mapping.dmp

Download
memory/5000-174-0x0000000000000000-mapping.dmp

Download
memory/5104-149-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads