59a22515331c0b5b37278aa74edeb75af874776b8c0be0699cf924ef8a59e7e7

Analysis

max time kernel
130s
max time network
164s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
28/10/2022, 17:41

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

59a22515331c0b5b37278aa74edeb75af874776b8c0be0699cf924ef8a59e7e7.exe
Size

366KB
MD5

004fc72bbbaf2d64590c336d07200218
SHA1

b600ce844a8605e323880894424d1dc6b6194b33
SHA256

59a22515331c0b5b37278aa74edeb75af874776b8c0be0699cf924ef8a59e7e7
SHA512

a2eb7655d10b22af330d5fdbc87cdf156b011453d23cd8b92655cd474d3ae4045c58dd67d8380498a992a920e3a1cdb5f9ad27af155906c5ca89e4d0db2dfce4
SSDEEP

6144:gDCwfG1bnxL8CQo6DCwfG1bnxL8CQoeYK:g72bntdQ572bntdQbZ

Score

10^/10

evasion persistence

Malware Config

Signatures

Modifies visibility of file extensions in Explorer 2 TTPs 3 IoCs

evasion

Hidden Files and Directories

T1158

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	hosts.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	59a22515331c0b5b37278aa74edeb75af874776b8c0be0699cf924ef8a59e7e7.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	avscan.exe

Modifies visiblity of hidden/system files in Explorer 2 TTPs 3 IoCs

evasion

Hidden Files and Directories

T1158

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	59a22515331c0b5b37278aa74edeb75af874776b8c0be0699cf924ef8a59e7e7.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	avscan.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	hosts.exe

Adds policy Run key to start application 2 TTPs 6 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	WScript.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\GBQHURCC = "W_X_C.bat"	WScript.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	WScript.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\GBQHURCC = "W_X_C.bat"	WScript.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	WScript.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\GBQHURCC = "W_X_C.bat"	WScript.exe

Executes dropped EXE 6 IoCs

pid	Process
3524	avscan.exe
4336	avscan.exe
2420	hosts.exe
912	hosts.exe
4668	avscan.exe
4572	hosts.exe

Checks computer location settings 2 TTPs 3 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation	cmd.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation	cmd.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation	cmd.exe

Adds Run key to start application 2 TTPs 6 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run	avscan.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\avscan = "C:\\Users\\Admin\\AppData\\Local\\Temp\\avscan.exe"	avscan.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run	hosts.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\avscan = "C:\\Users\\Admin\\AppData\\Local\\Temp\\avscan.exe"	hosts.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run	59a22515331c0b5b37278aa74edeb75af874776b8c0be0699cf924ef8a59e7e7.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\avscan = "C:\\Users\\Admin\\AppData\\Local\\Temp\\avscan.exe"	59a22515331c0b5b37278aa74edeb75af874776b8c0be0699cf924ef8a59e7e7.exe

Drops file in Windows directory 5 IoCs

description	ioc	Process
File opened for modification	C:\Windows\hosts.exe	hosts.exe
File created	C:\windows\W_X_C.vbs	59a22515331c0b5b37278aa74edeb75af874776b8c0be0699cf924ef8a59e7e7.exe
File created	\??\c:\windows\W_X_C.bat	59a22515331c0b5b37278aa74edeb75af874776b8c0be0699cf924ef8a59e7e7.exe
File opened for modification	C:\Windows\hosts.exe	59a22515331c0b5b37278aa74edeb75af874776b8c0be0699cf924ef8a59e7e7.exe
File opened for modification	C:\Windows\hosts.exe	avscan.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies registry class 4 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\Local Settings	59a22515331c0b5b37278aa74edeb75af874776b8c0be0699cf924ef8a59e7e7.exe
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\Local Settings	cmd.exe

Modifies registry key 1 TTPs 9 IoCs

Modify Registry

T1112

pid	Process
2184	REG.exe
1124	REG.exe
4416	REG.exe
2660	REG.exe
4364	REG.exe
3940	REG.exe
5076	REG.exe
3388	REG.exe
1120	REG.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

pid	Process
3524	avscan.exe
2420	hosts.exe

Suspicious use of SetWindowsHookEx 7 IoCs

pid	Process
2232	59a22515331c0b5b37278aa74edeb75af874776b8c0be0699cf924ef8a59e7e7.exe
3524	avscan.exe
4336	avscan.exe
2420	hosts.exe
912	hosts.exe
4668	avscan.exe
4572	hosts.exe

Suspicious use of WriteProcessMemory 63 IoCs

description	pid	Process	procid_target
PID 2232 wrote to memory of 4364	2232	59a22515331c0b5b37278aa74edeb75af874776b8c0be0699cf924ef8a59e7e7.exe	82
PID 2232 wrote to memory of 4364	2232	59a22515331c0b5b37278aa74edeb75af874776b8c0be0699cf924ef8a59e7e7.exe	82
PID 2232 wrote to memory of 4364	2232	59a22515331c0b5b37278aa74edeb75af874776b8c0be0699cf924ef8a59e7e7.exe	82
PID 2232 wrote to memory of 3524	2232	59a22515331c0b5b37278aa74edeb75af874776b8c0be0699cf924ef8a59e7e7.exe	98
PID 2232 wrote to memory of 3524	2232	59a22515331c0b5b37278aa74edeb75af874776b8c0be0699cf924ef8a59e7e7.exe	98
PID 2232 wrote to memory of 3524	2232	59a22515331c0b5b37278aa74edeb75af874776b8c0be0699cf924ef8a59e7e7.exe	98
PID 3524 wrote to memory of 4336	3524	avscan.exe	83
PID 3524 wrote to memory of 4336	3524	avscan.exe	83
PID 3524 wrote to memory of 4336	3524	avscan.exe	83
PID 3524 wrote to memory of 5104	3524	avscan.exe	97
PID 3524 wrote to memory of 5104	3524	avscan.exe	97
PID 3524 wrote to memory of 5104	3524	avscan.exe	97
PID 2232 wrote to memory of 5048	2232	59a22515331c0b5b37278aa74edeb75af874776b8c0be0699cf924ef8a59e7e7.exe	96
PID 2232 wrote to memory of 5048	2232	59a22515331c0b5b37278aa74edeb75af874776b8c0be0699cf924ef8a59e7e7.exe	96
PID 2232 wrote to memory of 5048	2232	59a22515331c0b5b37278aa74edeb75af874776b8c0be0699cf924ef8a59e7e7.exe	96
PID 5104 wrote to memory of 912	5104	cmd.exe	86
PID 5104 wrote to memory of 912	5104	cmd.exe	86
PID 5104 wrote to memory of 912	5104	cmd.exe	86
PID 5048 wrote to memory of 2420	5048	cmd.exe	87
PID 5048 wrote to memory of 2420	5048	cmd.exe	87
PID 5048 wrote to memory of 2420	5048	cmd.exe	87
PID 2420 wrote to memory of 4668	2420	hosts.exe	89
PID 2420 wrote to memory of 4668	2420	hosts.exe	89
PID 2420 wrote to memory of 4668	2420	hosts.exe	89
PID 2420 wrote to memory of 4864	2420	hosts.exe	95
PID 2420 wrote to memory of 4864	2420	hosts.exe	95
PID 2420 wrote to memory of 4864	2420	hosts.exe	95
PID 4864 wrote to memory of 4572	4864	cmd.exe	91
PID 4864 wrote to memory of 4572	4864	cmd.exe	91
PID 4864 wrote to memory of 4572	4864	cmd.exe	91
PID 4864 wrote to memory of 2224	4864	cmd.exe	94
PID 4864 wrote to memory of 2224	4864	cmd.exe	94
PID 4864 wrote to memory of 2224	4864	cmd.exe	94
PID 5048 wrote to memory of 1436	5048	cmd.exe	93
PID 5048 wrote to memory of 1436	5048	cmd.exe	93
PID 5048 wrote to memory of 1436	5048	cmd.exe	93
PID 5104 wrote to memory of 1528	5104	cmd.exe	92
PID 5104 wrote to memory of 1528	5104	cmd.exe	92
PID 5104 wrote to memory of 1528	5104	cmd.exe	92
PID 3524 wrote to memory of 3940	3524	avscan.exe	106
PID 3524 wrote to memory of 3940	3524	avscan.exe	106
PID 3524 wrote to memory of 3940	3524	avscan.exe	106
PID 2420 wrote to memory of 5076	2420	hosts.exe	108
PID 2420 wrote to memory of 5076	2420	hosts.exe	108
PID 2420 wrote to memory of 5076	2420	hosts.exe	108
PID 3524 wrote to memory of 3388	3524	avscan.exe	110
PID 3524 wrote to memory of 3388	3524	avscan.exe	110
PID 3524 wrote to memory of 3388	3524	avscan.exe	110
PID 2420 wrote to memory of 2184	2420	hosts.exe	112
PID 2420 wrote to memory of 2184	2420	hosts.exe	112
PID 2420 wrote to memory of 2184	2420	hosts.exe	112
PID 3524 wrote to memory of 1124	3524	avscan.exe	114
PID 3524 wrote to memory of 1124	3524	avscan.exe	114
PID 3524 wrote to memory of 1124	3524	avscan.exe	114
PID 2420 wrote to memory of 4416	2420	hosts.exe	116
PID 2420 wrote to memory of 4416	2420	hosts.exe	116
PID 2420 wrote to memory of 4416	2420	hosts.exe	116
PID 3524 wrote to memory of 1120	3524	avscan.exe	118
PID 3524 wrote to memory of 1120	3524	avscan.exe	118
PID 3524 wrote to memory of 1120	3524	avscan.exe	118
PID 2420 wrote to memory of 2660	2420	hosts.exe	120
PID 2420 wrote to memory of 2660	2420	hosts.exe	120
PID 2420 wrote to memory of 2660	2420	hosts.exe	120

C:\Users\Admin\AppData\Local\Temp\59a22515331c0b5b37278aa74edeb75af874776b8c0be0699cf924ef8a59e7e7.exe
"C:\Users\Admin\AppData\Local\Temp\59a22515331c0b5b37278aa74edeb75af874776b8c0be0699cf924ef8a59e7e7.exe"
1⤵
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- Adds Run key to start application
- Drops file in Windows directory
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2232
- C:\Windows\SysWOW64\REG.exe
  REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
  2⤵
  - Modifies registry key
  PID:4364
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c c:\windows\W_X_C.bat
  2⤵
  - Checks computer location settings
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:5048
- C:\Users\Admin\AppData\Local\Temp\avscan.exe
  C:\Users\Admin\AppData\Local\Temp\avscan.exe
  2⤵
  - Modifies visibility of file extensions in Explorer
  - Modifies visiblity of hidden/system files in Explorer
  - Executes dropped EXE
  - Adds Run key to start application
  - Drops file in Windows directory
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3524
- - C:\Windows\SysWOW64\REG.exe
    REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
    3⤵
    - Modifies registry key
    PID:3940
- - C:\Windows\SysWOW64\REG.exe
    REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
    3⤵
    - Modifies registry key
    PID:3388
- - C:\Windows\SysWOW64\REG.exe
    REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
    3⤵
    - Modifies registry key
    PID:1124
- - C:\Windows\SysWOW64\REG.exe
    REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
    3⤵
    - Modifies registry key
    PID:1120

C:\Users\Admin\AppData\Local\Temp\avscan.exe
C:\Users\Admin\AppData\Local\Temp\avscan.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4336

C:\windows\hosts.exe
C:\windows\hosts.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:912

C:\windows\hosts.exe
C:\windows\hosts.exe
1⤵
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2420
- C:\Users\Admin\AppData\Local\Temp\avscan.exe
  C:\Users\Admin\AppData\Local\Temp\avscan.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:4668
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c c:\windows\W_X_C.bat
  2⤵
  - Checks computer location settings
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:4864
- C:\Windows\SysWOW64\REG.exe
  REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
  2⤵
  - Modifies registry key
  PID:5076
- C:\Windows\SysWOW64\REG.exe
  REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
  2⤵
  - Modifies registry key
  PID:2184
- C:\Windows\SysWOW64\REG.exe
  REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
  2⤵
  - Modifies registry key
  PID:4416
- C:\Windows\SysWOW64\REG.exe
  REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
  2⤵
  - Modifies registry key
  PID:2660

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4028

C:\windows\hosts.exe
C:\windows\hosts.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4572

C:\Windows\SysWOW64\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Windows\W_X_C.vbs"
1⤵
- Adds policy Run key to start application
PID:1528

C:\Windows\SysWOW64\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Windows\W_X_C.vbs"
1⤵
- Adds policy Run key to start application
PID:1436

C:\Windows\SysWOW64\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Windows\W_X_C.vbs"
1⤵
- Adds policy Run key to start application
PID:2224

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c c:\windows\W_X_C.bat
1⤵
- Checks computer location settings
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:5104

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Hidden Files and Directories

T1158

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Hidden Files and Directories

T1158

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\avscan.exe

Filesize
366KB

MD5
15bcad09a99b9eb614fe205dc14f1ba0

SHA1
fb72a996cc378218a4095f4de7bb49059061573b

SHA256
5191214eeb098dff5adc7fd37ac8f20f817436747fbead2aa70c2d0aa8c6295c

SHA512
96f391f143e3715e5b567ae5c56fb20cd3eda8523d72cd1d2a6a5e60722d6f0db157a06daa6f32e3271bf7cc662f5a1360838919da58d6b63ac0a229adf28268

Download Submit
C:\Users\Admin\AppData\Local\Temp\avscan.exe

Filesize
366KB

MD5
15bcad09a99b9eb614fe205dc14f1ba0

SHA1
fb72a996cc378218a4095f4de7bb49059061573b

SHA256
5191214eeb098dff5adc7fd37ac8f20f817436747fbead2aa70c2d0aa8c6295c

SHA512
96f391f143e3715e5b567ae5c56fb20cd3eda8523d72cd1d2a6a5e60722d6f0db157a06daa6f32e3271bf7cc662f5a1360838919da58d6b63ac0a229adf28268

Download Submit
C:\Users\Admin\AppData\Local\Temp\avscan.exe

Filesize
366KB

MD5
15bcad09a99b9eb614fe205dc14f1ba0

SHA1
fb72a996cc378218a4095f4de7bb49059061573b

SHA256
5191214eeb098dff5adc7fd37ac8f20f817436747fbead2aa70c2d0aa8c6295c

SHA512
96f391f143e3715e5b567ae5c56fb20cd3eda8523d72cd1d2a6a5e60722d6f0db157a06daa6f32e3271bf7cc662f5a1360838919da58d6b63ac0a229adf28268

Download Submit
C:\Users\Admin\AppData\Local\Temp\avscan.exe

Filesize
366KB

MD5
15bcad09a99b9eb614fe205dc14f1ba0

SHA1
fb72a996cc378218a4095f4de7bb49059061573b

SHA256
5191214eeb098dff5adc7fd37ac8f20f817436747fbead2aa70c2d0aa8c6295c

SHA512
96f391f143e3715e5b567ae5c56fb20cd3eda8523d72cd1d2a6a5e60722d6f0db157a06daa6f32e3271bf7cc662f5a1360838919da58d6b63ac0a229adf28268

Download Submit
C:\Windows\W_X_C.vbs

Filesize
195B

MD5
5b87381bf407d7c6018a8b11c3e20f92

SHA1
bb61b28d9c8fd7dfeb13a397c49a1be3abc06ca2

SHA256
4785d6a229d0872fe90c75ab620de9a680d7f07ccd27a134da2afc4ee88f34f3

SHA512
05db1178f671e9d6c3a1c601349093447b04ebddcd071a06f7cc92cbaf7efb53027bc92523a19372a08ca5af715cc9955649255f8be1909b5e594385b3dcbe3d

Download Submit
C:\Windows\hosts.exe

Filesize
366KB

MD5
744410d3ac1b96a0cc0b527168fe7529

SHA1
97f467a1fa95861a530f5904feb7b8e21c11007d

SHA256
ed7da04404c7adbf58654bd09d1ab5d439c6d988a16fa279b36a9cd840b50b85

SHA512
a15dbdbce9b53af72d3cd83474377024fbe84b905bd28f23a925fd19cb43bb9fba478486fa6e16741ecbdc7362231a9560bfb5feb6df138da3bb79e696977646

Download Submit
C:\Windows\hosts.exe

Filesize
366KB

MD5
744410d3ac1b96a0cc0b527168fe7529

SHA1
97f467a1fa95861a530f5904feb7b8e21c11007d

SHA256
ed7da04404c7adbf58654bd09d1ab5d439c6d988a16fa279b36a9cd840b50b85

SHA512
a15dbdbce9b53af72d3cd83474377024fbe84b905bd28f23a925fd19cb43bb9fba478486fa6e16741ecbdc7362231a9560bfb5feb6df138da3bb79e696977646

Download Submit
C:\Windows\hosts.exe

Filesize
366KB

MD5
744410d3ac1b96a0cc0b527168fe7529

SHA1
97f467a1fa95861a530f5904feb7b8e21c11007d

SHA256
ed7da04404c7adbf58654bd09d1ab5d439c6d988a16fa279b36a9cd840b50b85

SHA512
a15dbdbce9b53af72d3cd83474377024fbe84b905bd28f23a925fd19cb43bb9fba478486fa6e16741ecbdc7362231a9560bfb5feb6df138da3bb79e696977646

Download Submit
C:\Windows\hosts.exe

Filesize
366KB

MD5
744410d3ac1b96a0cc0b527168fe7529

SHA1
97f467a1fa95861a530f5904feb7b8e21c11007d

SHA256
ed7da04404c7adbf58654bd09d1ab5d439c6d988a16fa279b36a9cd840b50b85

SHA512
a15dbdbce9b53af72d3cd83474377024fbe84b905bd28f23a925fd19cb43bb9fba478486fa6e16741ecbdc7362231a9560bfb5feb6df138da3bb79e696977646

Download Submit
C:\windows\hosts.exe

Filesize
366KB

MD5
744410d3ac1b96a0cc0b527168fe7529

SHA1
97f467a1fa95861a530f5904feb7b8e21c11007d

SHA256
ed7da04404c7adbf58654bd09d1ab5d439c6d988a16fa279b36a9cd840b50b85

SHA512
a15dbdbce9b53af72d3cd83474377024fbe84b905bd28f23a925fd19cb43bb9fba478486fa6e16741ecbdc7362231a9560bfb5feb6df138da3bb79e696977646

Download Submit
\??\c:\windows\W_X_C.bat

Filesize
336B

MD5
4db9f8b6175722b62ececeeeba1ce307

SHA1
3b3ba8414706e72a6fa19e884a97b87609e11e47

SHA256
d2150b9e5a4ce55e140f0ca91c4e300715d42095c8fddf58c77037cdd2cfaf78

SHA512
1d6dc274cf7a3dd704f840e6a5ad57ab4c4e35d5f09489aeff520bb797e1c825bac53fc335156fe41e767a46520d031855fe42fe7b175409ebe5e9e986fb9b8b

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads