67d04e6fb2a0e48ad23fd6444466083e3219ce3aca508063622d380e15cccf94

Analysis

max time kernel
124s
max time network
135s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
28/10/2022, 17:41

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

67d04e6fb2a0e48ad23fd6444466083e3219ce3aca508063622d380e15cccf94.exe
Size

170KB
MD5

0b00408bbad98cb9f841bfa2ee907cab
SHA1

aec0674fdc5686b67babcc9030561983c50c870e
SHA256

67d04e6fb2a0e48ad23fd6444466083e3219ce3aca508063622d380e15cccf94
SHA512

4a72d8dd919823eb678286dd080beaa86049e36a73c4cd13918f71122faf7f88ac9c4727a491b22a295fddee597adf72c1d39dfd871d048e58104e15d78ebe83
SSDEEP

3072:obpDCw1p3vmLvsZIaVwiwDcIbDHDCmT4k3hsaIeQ0:gDCwfG1bnxM6saBh

Score

10^/10

evasion persistence

Malware Config

Signatures

Modifies visibility of file extensions in Explorer 2 TTPs 3 IoCs

evasion

Hidden Files and Directories

T1158

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	67d04e6fb2a0e48ad23fd6444466083e3219ce3aca508063622d380e15cccf94.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	avscan.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	hosts.exe

Modifies visiblity of hidden/system files in Explorer 2 TTPs 3 IoCs

evasion

Hidden Files and Directories

T1158

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	hosts.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	67d04e6fb2a0e48ad23fd6444466083e3219ce3aca508063622d380e15cccf94.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	avscan.exe

Adds policy Run key to start application 2 TTPs 6 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	WScript.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\IYMUGYHL = "W_X_C.bat"	WScript.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	WScript.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\IYMUGYHL = "W_X_C.bat"	WScript.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	WScript.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\IYMUGYHL = "W_X_C.bat"	WScript.exe

Executes dropped EXE 6 IoCs

pid	Process
1936	avscan.exe
4824	avscan.exe
4788	hosts.exe
3164	hosts.exe
3464	avscan.exe
4648	hosts.exe

Checks computer location settings 2 TTPs 3 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation	cmd.exe
Key value queried	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation	cmd.exe
Key value queried	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation	cmd.exe

Adds Run key to start application 2 TTPs 6 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run	67d04e6fb2a0e48ad23fd6444466083e3219ce3aca508063622d380e15cccf94.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\avscan = "C:\\Users\\Admin\\AppData\\Local\\Temp\\avscan.exe"	67d04e6fb2a0e48ad23fd6444466083e3219ce3aca508063622d380e15cccf94.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run	avscan.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\avscan = "C:\\Users\\Admin\\AppData\\Local\\Temp\\avscan.exe"	avscan.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run	hosts.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\avscan = "C:\\Users\\Admin\\AppData\\Local\\Temp\\avscan.exe"	hosts.exe

Drops file in Windows directory 5 IoCs

description	ioc	Process
File opened for modification	C:\Windows\hosts.exe	avscan.exe
File opened for modification	C:\Windows\hosts.exe	hosts.exe
File created	C:\windows\W_X_C.vbs	67d04e6fb2a0e48ad23fd6444466083e3219ce3aca508063622d380e15cccf94.exe
File created	\??\c:\windows\W_X_C.bat	67d04e6fb2a0e48ad23fd6444466083e3219ce3aca508063622d380e15cccf94.exe
File opened for modification	C:\Windows\hosts.exe	67d04e6fb2a0e48ad23fd6444466083e3219ce3aca508063622d380e15cccf94.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies registry class 4 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\Local Settings	67d04e6fb2a0e48ad23fd6444466083e3219ce3aca508063622d380e15cccf94.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\Local Settings	cmd.exe

Modifies registry key 1 TTPs 9 IoCs

Modify Registry

T1112

pid	Process
3828	REG.exe
444	REG.exe
612	REG.exe
3508	REG.exe
4240	REG.exe
4936	REG.exe
4064	REG.exe
4456	REG.exe
2412	REG.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

pid	Process
1936	avscan.exe
4788	hosts.exe

Suspicious use of SetWindowsHookEx 7 IoCs

pid	Process
2824	67d04e6fb2a0e48ad23fd6444466083e3219ce3aca508063622d380e15cccf94.exe
1936	avscan.exe
4824	avscan.exe
3164	hosts.exe
4788	hosts.exe
3464	avscan.exe
4648	hosts.exe

Suspicious use of WriteProcessMemory 63 IoCs

description	pid	Process	procid_target
PID 2824 wrote to memory of 3508	2824	67d04e6fb2a0e48ad23fd6444466083e3219ce3aca508063622d380e15cccf94.exe	84
PID 2824 wrote to memory of 3508	2824	67d04e6fb2a0e48ad23fd6444466083e3219ce3aca508063622d380e15cccf94.exe	84
PID 2824 wrote to memory of 3508	2824	67d04e6fb2a0e48ad23fd6444466083e3219ce3aca508063622d380e15cccf94.exe	84
PID 2824 wrote to memory of 1936	2824	67d04e6fb2a0e48ad23fd6444466083e3219ce3aca508063622d380e15cccf94.exe	86
PID 2824 wrote to memory of 1936	2824	67d04e6fb2a0e48ad23fd6444466083e3219ce3aca508063622d380e15cccf94.exe	86
PID 2824 wrote to memory of 1936	2824	67d04e6fb2a0e48ad23fd6444466083e3219ce3aca508063622d380e15cccf94.exe	86
PID 1936 wrote to memory of 4824	1936	avscan.exe	87
PID 1936 wrote to memory of 4824	1936	avscan.exe	87
PID 1936 wrote to memory of 4824	1936	avscan.exe	87
PID 1936 wrote to memory of 4660	1936	avscan.exe	88
PID 1936 wrote to memory of 4660	1936	avscan.exe	88
PID 1936 wrote to memory of 4660	1936	avscan.exe	88
PID 2824 wrote to memory of 2420	2824	67d04e6fb2a0e48ad23fd6444466083e3219ce3aca508063622d380e15cccf94.exe	89
PID 2824 wrote to memory of 2420	2824	67d04e6fb2a0e48ad23fd6444466083e3219ce3aca508063622d380e15cccf94.exe	89
PID 2824 wrote to memory of 2420	2824	67d04e6fb2a0e48ad23fd6444466083e3219ce3aca508063622d380e15cccf94.exe	89
PID 4660 wrote to memory of 4788	4660	cmd.exe	93
PID 4660 wrote to memory of 4788	4660	cmd.exe	93
PID 4660 wrote to memory of 4788	4660	cmd.exe	93
PID 2420 wrote to memory of 3164	2420	cmd.exe	92
PID 2420 wrote to memory of 3164	2420	cmd.exe	92
PID 2420 wrote to memory of 3164	2420	cmd.exe	92
PID 4788 wrote to memory of 3464	4788	hosts.exe	95
PID 4788 wrote to memory of 3464	4788	hosts.exe	95
PID 4788 wrote to memory of 3464	4788	hosts.exe	95
PID 4788 wrote to memory of 1956	4788	hosts.exe	96
PID 4788 wrote to memory of 1956	4788	hosts.exe	96
PID 4788 wrote to memory of 1956	4788	hosts.exe	96
PID 1956 wrote to memory of 4648	1956	cmd.exe	98
PID 1956 wrote to memory of 4648	1956	cmd.exe	98
PID 1956 wrote to memory of 4648	1956	cmd.exe	98
PID 2420 wrote to memory of 2364	2420	cmd.exe	100
PID 2420 wrote to memory of 2364	2420	cmd.exe	100
PID 2420 wrote to memory of 2364	2420	cmd.exe	100
PID 4660 wrote to memory of 4228	4660	cmd.exe	99
PID 4660 wrote to memory of 4228	4660	cmd.exe	99
PID 4660 wrote to memory of 4228	4660	cmd.exe	99
PID 1956 wrote to memory of 4416	1956	cmd.exe	101
PID 1956 wrote to memory of 4416	1956	cmd.exe	101
PID 1956 wrote to memory of 4416	1956	cmd.exe	101
PID 1936 wrote to memory of 4456	1936	avscan.exe	109
PID 1936 wrote to memory of 4456	1936	avscan.exe	109
PID 1936 wrote to memory of 4456	1936	avscan.exe	109
PID 4788 wrote to memory of 4240	4788	hosts.exe	111
PID 4788 wrote to memory of 4240	4788	hosts.exe	111
PID 4788 wrote to memory of 4240	4788	hosts.exe	111
PID 1936 wrote to memory of 3828	1936	avscan.exe	113
PID 1936 wrote to memory of 3828	1936	avscan.exe	113
PID 1936 wrote to memory of 3828	1936	avscan.exe	113
PID 4788 wrote to memory of 444	4788	hosts.exe	115
PID 4788 wrote to memory of 444	4788	hosts.exe	115
PID 4788 wrote to memory of 444	4788	hosts.exe	115
PID 1936 wrote to memory of 2412	1936	avscan.exe	117
PID 1936 wrote to memory of 2412	1936	avscan.exe	117
PID 1936 wrote to memory of 2412	1936	avscan.exe	117
PID 4788 wrote to memory of 4936	4788	hosts.exe	119
PID 4788 wrote to memory of 4936	4788	hosts.exe	119
PID 4788 wrote to memory of 4936	4788	hosts.exe	119
PID 1936 wrote to memory of 4064	1936	avscan.exe	121
PID 1936 wrote to memory of 4064	1936	avscan.exe	121
PID 1936 wrote to memory of 4064	1936	avscan.exe	121
PID 4788 wrote to memory of 612	4788	hosts.exe	123
PID 4788 wrote to memory of 612	4788	hosts.exe	123
PID 4788 wrote to memory of 612	4788	hosts.exe	123

C:\Users\Admin\AppData\Local\Temp\67d04e6fb2a0e48ad23fd6444466083e3219ce3aca508063622d380e15cccf94.exe
"C:\Users\Admin\AppData\Local\Temp\67d04e6fb2a0e48ad23fd6444466083e3219ce3aca508063622d380e15cccf94.exe"
1⤵
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- Adds Run key to start application
- Drops file in Windows directory
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2824
- C:\Windows\SysWOW64\REG.exe
  REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
  2⤵
  - Modifies registry key
  PID:3508
- C:\Users\Admin\AppData\Local\Temp\avscan.exe
  C:\Users\Admin\AppData\Local\Temp\avscan.exe
  2⤵
  - Modifies visibility of file extensions in Explorer
  - Modifies visiblity of hidden/system files in Explorer
  - Executes dropped EXE
  - Adds Run key to start application
  - Drops file in Windows directory
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1936
- - C:\Users\Admin\AppData\Local\Temp\avscan.exe
    C:\Users\Admin\AppData\Local\Temp\avscan.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:4824
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c c:\windows\W_X_C.bat
    3⤵
    - Checks computer location settings
    - Modifies registry class
    - Suspicious use of WriteProcessMemory
    PID:4660
  - - C:\windows\hosts.exe
      C:\windows\hosts.exe
      4⤵
      Modifies visibility of file extensions in Explorer
      Modifies visiblity of hidden/system files in Explorer
      Executes dropped EXE
      Adds Run key to start application
      Drops file in Windows directory
      Suspicious behavior: GetForegroundWindowSpam
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:4788
    - - C:\Users\Admin\AppData\Local\Temp\avscan.exe
        
        C:\Users\Admin\AppData\Local\Temp\avscan.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3464
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c c:\windows\W_X_C.bat
        5⤵
        Checks computer location settings
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1956
      - C:\windows\hosts.exe
        
        C:\windows\hosts.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4648
      - C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Windows\W_X_C.vbs"
        6⤵
        Adds policy Run key to start application
        
        PID:4416
    - - C:\Windows\SysWOW64\REG.exe
        
        REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
        5⤵
        Modifies registry key
        
        PID:4240
    - - C:\Windows\SysWOW64\REG.exe
        
        REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
        5⤵
        Modifies registry key
        
        PID:444
    - - C:\Windows\SysWOW64\REG.exe
        
        REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
        5⤵
        Modifies registry key
        
        PID:4936
    - - C:\Windows\SysWOW64\REG.exe
        
        REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
        5⤵
        Modifies registry key
        
        PID:612
  - - C:\Windows\SysWOW64\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Windows\W_X_C.vbs"
      4⤵
      Adds policy Run key to start application
      PID:4228
- - C:\Windows\SysWOW64\REG.exe
    REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
    3⤵
    - Modifies registry key
    PID:4456
- - C:\Windows\SysWOW64\REG.exe
    REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
    3⤵
    - Modifies registry key
    PID:3828
- - C:\Windows\SysWOW64\REG.exe
    REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
    3⤵
    - Modifies registry key
    PID:2412
- - C:\Windows\SysWOW64\REG.exe
    REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
    3⤵
    - Modifies registry key
    PID:4064
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c c:\windows\W_X_C.bat
  2⤵
  - Checks computer location settings
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2420
- - C:\windows\hosts.exe
    C:\windows\hosts.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:3164
- - C:\Windows\SysWOW64\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Windows\W_X_C.vbs"
    3⤵
    - Adds policy Run key to start application
    PID:2364

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4080

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Hidden Files and Directories

T1158

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Hidden Files and Directories

T1158

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\avscan.exe

Filesize
170KB

MD5
4c2fa27ebdbeea1f9fad44ac49e0a0fe

SHA1
f42b32a192289c0e0d8bff17de57375e9b46ba83

SHA256
5b5d0f46934e8ec8dc059b5878dead266ea08082aec3f09bf52fdd9ebcd772e4

SHA512
b6f1164d16acbce95ac3151e87a30e7d5165d30706041c415e323081439d1289dc5de33ca4bc2ebcacc9083fa7ef457167ab7034a8fb7363a0f1b9144914612e

Download Submit
C:\Users\Admin\AppData\Local\Temp\avscan.exe

Filesize
170KB

MD5
4c2fa27ebdbeea1f9fad44ac49e0a0fe

SHA1
f42b32a192289c0e0d8bff17de57375e9b46ba83

SHA256
5b5d0f46934e8ec8dc059b5878dead266ea08082aec3f09bf52fdd9ebcd772e4

SHA512
b6f1164d16acbce95ac3151e87a30e7d5165d30706041c415e323081439d1289dc5de33ca4bc2ebcacc9083fa7ef457167ab7034a8fb7363a0f1b9144914612e

Download Submit
C:\Users\Admin\AppData\Local\Temp\avscan.exe

Filesize
170KB

MD5
4c2fa27ebdbeea1f9fad44ac49e0a0fe

SHA1
f42b32a192289c0e0d8bff17de57375e9b46ba83

SHA256
5b5d0f46934e8ec8dc059b5878dead266ea08082aec3f09bf52fdd9ebcd772e4

SHA512
b6f1164d16acbce95ac3151e87a30e7d5165d30706041c415e323081439d1289dc5de33ca4bc2ebcacc9083fa7ef457167ab7034a8fb7363a0f1b9144914612e

Download Submit
C:\Users\Admin\AppData\Local\Temp\avscan.exe

Filesize
170KB

MD5
4c2fa27ebdbeea1f9fad44ac49e0a0fe

SHA1
f42b32a192289c0e0d8bff17de57375e9b46ba83

SHA256
5b5d0f46934e8ec8dc059b5878dead266ea08082aec3f09bf52fdd9ebcd772e4

SHA512
b6f1164d16acbce95ac3151e87a30e7d5165d30706041c415e323081439d1289dc5de33ca4bc2ebcacc9083fa7ef457167ab7034a8fb7363a0f1b9144914612e

Download Submit
C:\Windows\W_X_C.vbs

Filesize
195B

MD5
0e0483d4802632100b6bfe8bc2e5d661

SHA1
767e0deb7dcaa7676004e6053957c36cecfeeefa

SHA256
81bbebb8d0e77ffffbc7b7d24afdcdce4089f4b04d1a12284eda861c25e03f9f

SHA512
8279b0559ca30a0adc6c8614870c3e445866c20f0617a7153cab41982b451dfe9ea44478f37b884465235714623ef26a56f5ea3d1cb81767487c494d3703ab29

Download Submit
C:\Windows\hosts.exe

Filesize
170KB

MD5
a9a7f60963b28e7c65d384e3685a8dc0

SHA1
32f8b8e6c2e9d692c0a2a56e70947c634c66f962

SHA256
8c46b949cefddd175dbc8c7dbde2c949246601181ef8e12fca9de39e9db48a9b

SHA512
903c4c85fb3363b0d17f9558feaeb3db957fcc95fb72f379d1f016e38c25a53cbca2567c34100e95fb5111a151c44b9ebfdcae1351ba0662cf143c84df9f968c

Download Submit
C:\Windows\hosts.exe

Filesize
170KB

MD5
a9a7f60963b28e7c65d384e3685a8dc0

SHA1
32f8b8e6c2e9d692c0a2a56e70947c634c66f962

SHA256
8c46b949cefddd175dbc8c7dbde2c949246601181ef8e12fca9de39e9db48a9b

SHA512
903c4c85fb3363b0d17f9558feaeb3db957fcc95fb72f379d1f016e38c25a53cbca2567c34100e95fb5111a151c44b9ebfdcae1351ba0662cf143c84df9f968c

Download Submit
C:\Windows\hosts.exe

Filesize
170KB

MD5
a9a7f60963b28e7c65d384e3685a8dc0

SHA1
32f8b8e6c2e9d692c0a2a56e70947c634c66f962

SHA256
8c46b949cefddd175dbc8c7dbde2c949246601181ef8e12fca9de39e9db48a9b

SHA512
903c4c85fb3363b0d17f9558feaeb3db957fcc95fb72f379d1f016e38c25a53cbca2567c34100e95fb5111a151c44b9ebfdcae1351ba0662cf143c84df9f968c

Download Submit
C:\Windows\hosts.exe

Filesize
170KB

MD5
a9a7f60963b28e7c65d384e3685a8dc0

SHA1
32f8b8e6c2e9d692c0a2a56e70947c634c66f962

SHA256
8c46b949cefddd175dbc8c7dbde2c949246601181ef8e12fca9de39e9db48a9b

SHA512
903c4c85fb3363b0d17f9558feaeb3db957fcc95fb72f379d1f016e38c25a53cbca2567c34100e95fb5111a151c44b9ebfdcae1351ba0662cf143c84df9f968c

Download Submit
C:\windows\hosts.exe

Filesize
170KB

MD5
a9a7f60963b28e7c65d384e3685a8dc0

SHA1
32f8b8e6c2e9d692c0a2a56e70947c634c66f962

SHA256
8c46b949cefddd175dbc8c7dbde2c949246601181ef8e12fca9de39e9db48a9b

SHA512
903c4c85fb3363b0d17f9558feaeb3db957fcc95fb72f379d1f016e38c25a53cbca2567c34100e95fb5111a151c44b9ebfdcae1351ba0662cf143c84df9f968c

Download Submit
\??\c:\windows\W_X_C.bat

Filesize
336B

MD5
4db9f8b6175722b62ececeeeba1ce307

SHA1
3b3ba8414706e72a6fa19e884a97b87609e11e47

SHA256
d2150b9e5a4ce55e140f0ca91c4e300715d42095c8fddf58c77037cdd2cfaf78

SHA512
1d6dc274cf7a3dd704f840e6a5ad57ab4c4e35d5f09489aeff520bb797e1c825bac53fc335156fe41e767a46520d031855fe42fe7b175409ebe5e9e986fb9b8b

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads