9905a9b56a5e88edaf6d43badfdf6db9ce86837f5a8436164033e6b0bf381c1c

Analysis

max time kernel
148s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
06/11/2022, 13:07

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

9905a9b56a5e88edaf6d43badfdf6db9ce86837f5a8436164033e6b0bf381c1c.exe
Size

367KB
MD5

03d59a294951b4b4a8026e5dede58ec7
SHA1

bdeb0d484970a309c655019755d6604ec42a2b20
SHA256

9905a9b56a5e88edaf6d43badfdf6db9ce86837f5a8436164033e6b0bf381c1c
SHA512

cbc09e48cdb5e41e27f8099c33a0f1709ddab131494aadaca7caa8f30e03c35b168294d331bfed8d01ae5ada4e34772909bffedb05e0f1c2d4725742c88bdfce
SSDEEP

6144:gDCwfG1bnxLERR9saMDCwfG1bnxLERR9satG14W:g72bntEL9/M72bntEL9/tG1p

Score

10^/10

evasion persistence

Malware Config

Signatures

Modifies visibility of file extensions in Explorer 2 TTPs 3 IoCs

evasion

Hidden Files and Directories

T1158

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	9905a9b56a5e88edaf6d43badfdf6db9ce86837f5a8436164033e6b0bf381c1c.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	avscan.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	hosts.exe

Modifies visiblity of hidden/system files in Explorer 2 TTPs 3 IoCs

evasion

Hidden Files and Directories

T1158

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	9905a9b56a5e88edaf6d43badfdf6db9ce86837f5a8436164033e6b0bf381c1c.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	avscan.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	hosts.exe

Adds policy Run key to start application 2 TTPs 6 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	WScript.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\XZIOFAVD = "W_X_C.bat"	WScript.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	WScript.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\XZIOFAVD = "W_X_C.bat"	WScript.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	WScript.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\XZIOFAVD = "W_X_C.bat"	WScript.exe

Executes dropped EXE 6 IoCs

pid	Process
4564	avscan.exe
4960	avscan.exe
612	hosts.exe
4808	hosts.exe
3504	avscan.exe
4420	hosts.exe

Checks computer location settings 2 TTPs 3 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\Geo\Nation	cmd.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\Geo\Nation	cmd.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\Geo\Nation	cmd.exe

Adds Run key to start application 2 TTPs 6 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run	9905a9b56a5e88edaf6d43badfdf6db9ce86837f5a8436164033e6b0bf381c1c.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\avscan = "C:\\Users\\Admin\\AppData\\Local\\Temp\\avscan.exe"	9905a9b56a5e88edaf6d43badfdf6db9ce86837f5a8436164033e6b0bf381c1c.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run	avscan.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\avscan = "C:\\Users\\Admin\\AppData\\Local\\Temp\\avscan.exe"	avscan.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run	hosts.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\avscan = "C:\\Users\\Admin\\AppData\\Local\\Temp\\avscan.exe"	hosts.exe

Drops file in Windows directory 5 IoCs

description	ioc	Process
File created	C:\windows\W_X_C.vbs	9905a9b56a5e88edaf6d43badfdf6db9ce86837f5a8436164033e6b0bf381c1c.exe
File created	\??\c:\windows\W_X_C.bat	9905a9b56a5e88edaf6d43badfdf6db9ce86837f5a8436164033e6b0bf381c1c.exe
File opened for modification	C:\Windows\hosts.exe	9905a9b56a5e88edaf6d43badfdf6db9ce86837f5a8436164033e6b0bf381c1c.exe
File opened for modification	C:\Windows\hosts.exe	avscan.exe
File opened for modification	C:\Windows\hosts.exe	hosts.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies registry class 4 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000_Classes\Local Settings	9905a9b56a5e88edaf6d43badfdf6db9ce86837f5a8436164033e6b0bf381c1c.exe
Key created	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000_Classes\Local Settings	cmd.exe

Modifies registry key 1 TTPs 9 IoCs

Modify Registry

T1112

pid	Process
3060	REG.exe
1756	REG.exe
4220	REG.exe
408	REG.exe
4772	REG.exe
4200	REG.exe
1460	REG.exe
3628	REG.exe
3364	REG.exe

Suspicious behavior: GetForegroundWindowSpam 3 IoCs

pid	Process
4040	9905a9b56a5e88edaf6d43badfdf6db9ce86837f5a8436164033e6b0bf381c1c.exe
4564	avscan.exe
4808	hosts.exe

Suspicious use of SetWindowsHookEx 7 IoCs

pid	Process
4040	9905a9b56a5e88edaf6d43badfdf6db9ce86837f5a8436164033e6b0bf381c1c.exe
4564	avscan.exe
4960	avscan.exe
612	hosts.exe
4808	hosts.exe
3504	avscan.exe
4420	hosts.exe

Suspicious use of WriteProcessMemory 63 IoCs

description	pid	Process	procid_target
PID 4040 wrote to memory of 3060	4040	9905a9b56a5e88edaf6d43badfdf6db9ce86837f5a8436164033e6b0bf381c1c.exe	79
PID 4040 wrote to memory of 3060	4040	9905a9b56a5e88edaf6d43badfdf6db9ce86837f5a8436164033e6b0bf381c1c.exe	79
PID 4040 wrote to memory of 3060	4040	9905a9b56a5e88edaf6d43badfdf6db9ce86837f5a8436164033e6b0bf381c1c.exe	79
PID 4040 wrote to memory of 4564	4040	9905a9b56a5e88edaf6d43badfdf6db9ce86837f5a8436164033e6b0bf381c1c.exe	81
PID 4040 wrote to memory of 4564	4040	9905a9b56a5e88edaf6d43badfdf6db9ce86837f5a8436164033e6b0bf381c1c.exe	81
PID 4040 wrote to memory of 4564	4040	9905a9b56a5e88edaf6d43badfdf6db9ce86837f5a8436164033e6b0bf381c1c.exe	81
PID 4564 wrote to memory of 4960	4564	avscan.exe	82
PID 4564 wrote to memory of 4960	4564	avscan.exe	82
PID 4564 wrote to memory of 4960	4564	avscan.exe	82
PID 4564 wrote to memory of 4892	4564	avscan.exe	83
PID 4564 wrote to memory of 4892	4564	avscan.exe	83
PID 4564 wrote to memory of 4892	4564	avscan.exe	83
PID 4040 wrote to memory of 1496	4040	9905a9b56a5e88edaf6d43badfdf6db9ce86837f5a8436164033e6b0bf381c1c.exe	84
PID 4040 wrote to memory of 1496	4040	9905a9b56a5e88edaf6d43badfdf6db9ce86837f5a8436164033e6b0bf381c1c.exe	84
PID 4040 wrote to memory of 1496	4040	9905a9b56a5e88edaf6d43badfdf6db9ce86837f5a8436164033e6b0bf381c1c.exe	84
PID 4892 wrote to memory of 612	4892	cmd.exe	88
PID 4892 wrote to memory of 612	4892	cmd.exe	88
PID 4892 wrote to memory of 612	4892	cmd.exe	88
PID 1496 wrote to memory of 4808	1496	cmd.exe	87
PID 1496 wrote to memory of 4808	1496	cmd.exe	87
PID 1496 wrote to memory of 4808	1496	cmd.exe	87
PID 4808 wrote to memory of 3504	4808	hosts.exe	89
PID 4808 wrote to memory of 3504	4808	hosts.exe	89
PID 4808 wrote to memory of 3504	4808	hosts.exe	89
PID 4808 wrote to memory of 4832	4808	hosts.exe	90
PID 4808 wrote to memory of 4832	4808	hosts.exe	90
PID 4808 wrote to memory of 4832	4808	hosts.exe	90
PID 4832 wrote to memory of 4420	4832	cmd.exe	92
PID 4832 wrote to memory of 4420	4832	cmd.exe	92
PID 4832 wrote to memory of 4420	4832	cmd.exe	92
PID 4892 wrote to memory of 1244	4892	cmd.exe	95
PID 4892 wrote to memory of 1244	4892	cmd.exe	95
PID 4892 wrote to memory of 1244	4892	cmd.exe	95
PID 4832 wrote to memory of 3320	4832	cmd.exe	94
PID 4832 wrote to memory of 3320	4832	cmd.exe	94
PID 4832 wrote to memory of 3320	4832	cmd.exe	94
PID 1496 wrote to memory of 2012	1496	cmd.exe	93
PID 1496 wrote to memory of 2012	1496	cmd.exe	93
PID 1496 wrote to memory of 2012	1496	cmd.exe	93
PID 4564 wrote to memory of 4200	4564	avscan.exe	106
PID 4564 wrote to memory of 4200	4564	avscan.exe	106
PID 4564 wrote to memory of 4200	4564	avscan.exe	106
PID 4808 wrote to memory of 1460	4808	hosts.exe	107
PID 4808 wrote to memory of 1460	4808	hosts.exe	107
PID 4808 wrote to memory of 1460	4808	hosts.exe	107
PID 4564 wrote to memory of 3628	4564	avscan.exe	109
PID 4564 wrote to memory of 3628	4564	avscan.exe	109
PID 4564 wrote to memory of 3628	4564	avscan.exe	109
PID 4808 wrote to memory of 1756	4808	hosts.exe	111
PID 4808 wrote to memory of 1756	4808	hosts.exe	111
PID 4808 wrote to memory of 1756	4808	hosts.exe	111
PID 4564 wrote to memory of 4220	4564	avscan.exe	113
PID 4564 wrote to memory of 4220	4564	avscan.exe	113
PID 4564 wrote to memory of 4220	4564	avscan.exe	113
PID 4808 wrote to memory of 408	4808	hosts.exe	115
PID 4808 wrote to memory of 408	4808	hosts.exe	115
PID 4808 wrote to memory of 408	4808	hosts.exe	115
PID 4564 wrote to memory of 3364	4564	avscan.exe	117
PID 4564 wrote to memory of 3364	4564	avscan.exe	117
PID 4564 wrote to memory of 3364	4564	avscan.exe	117
PID 4808 wrote to memory of 4772	4808	hosts.exe	119
PID 4808 wrote to memory of 4772	4808	hosts.exe	119
PID 4808 wrote to memory of 4772	4808	hosts.exe	119

C:\Users\Admin\AppData\Local\Temp\9905a9b56a5e88edaf6d43badfdf6db9ce86837f5a8436164033e6b0bf381c1c.exe
"C:\Users\Admin\AppData\Local\Temp\9905a9b56a5e88edaf6d43badfdf6db9ce86837f5a8436164033e6b0bf381c1c.exe"
1⤵
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- Adds Run key to start application
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4040
- C:\Windows\SysWOW64\REG.exe
  REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
  2⤵
  - Modifies registry key
  PID:3060
- C:\Users\Admin\AppData\Local\Temp\avscan.exe
  C:\Users\Admin\AppData\Local\Temp\avscan.exe
  2⤵
  - Modifies visibility of file extensions in Explorer
  - Modifies visiblity of hidden/system files in Explorer
  - Executes dropped EXE
  - Adds Run key to start application
  - Drops file in Windows directory
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4564
- - C:\Users\Admin\AppData\Local\Temp\avscan.exe
    C:\Users\Admin\AppData\Local\Temp\avscan.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:4960
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c c:\windows\W_X_C.bat
    3⤵
    - Checks computer location settings
    - Modifies registry class
    - Suspicious use of WriteProcessMemory
    PID:4892
  - - C:\windows\hosts.exe
      C:\windows\hosts.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:612
  - - C:\Windows\SysWOW64\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Windows\W_X_C.vbs"
      4⤵
      Adds policy Run key to start application
      PID:1244
- - C:\Windows\SysWOW64\REG.exe
    REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
    3⤵
    - Modifies registry key
    PID:4200
- - C:\Windows\SysWOW64\REG.exe
    REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
    3⤵
    - Modifies registry key
    PID:3628
- - C:\Windows\SysWOW64\REG.exe
    REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
    3⤵
    - Modifies registry key
    PID:4220
- - C:\Windows\SysWOW64\REG.exe
    REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
    3⤵
    - Modifies registry key
    PID:3364
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c c:\windows\W_X_C.bat
  2⤵
  - Checks computer location settings
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:1496
- - C:\windows\hosts.exe
    C:\windows\hosts.exe
    3⤵
    - Modifies visibility of file extensions in Explorer
    - Modifies visiblity of hidden/system files in Explorer
    - Executes dropped EXE
    - Adds Run key to start application
    - Drops file in Windows directory
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:4808
  - - C:\Users\Admin\AppData\Local\Temp\avscan.exe
      C:\Users\Admin\AppData\Local\Temp\avscan.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3504
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c c:\windows\W_X_C.bat
      4⤵
      Checks computer location settings
      Modifies registry class
      Suspicious use of WriteProcessMemory
      PID:4832
    - - C:\windows\hosts.exe
        
        C:\windows\hosts.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4420
    - - C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Windows\W_X_C.vbs"
        5⤵
        Adds policy Run key to start application
        
        PID:3320
  - - C:\Windows\SysWOW64\REG.exe
      REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
      4⤵
      Modifies registry key
      PID:1460
  - - C:\Windows\SysWOW64\REG.exe
      REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
      4⤵
      Modifies registry key
      PID:1756
  - - C:\Windows\SysWOW64\REG.exe
      REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
      4⤵
      Modifies registry key
      PID:408
  - - C:\Windows\SysWOW64\REG.exe
      REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
      4⤵
      Modifies registry key
      PID:4772
- - C:\Windows\SysWOW64\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Windows\W_X_C.vbs"
    3⤵
    - Adds policy Run key to start application
    PID:2012

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:392

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Hidden Files and Directories

T1158

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Hidden Files and Directories

T1158

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\avscan.exe

Filesize
367KB

MD5
871fa402e866bd7ef90f15c1c6a0b760

SHA1
dff5ec58a7127e0cce3ee2fa50f66d435853d3be

SHA256
d2761215adb8393686a70765b905d487edcdedf3d0089c127b6a465ee449999f

SHA512
82d0742f3c7b307ddbda3cde49517547c0d23f2a82bff0024797d83ada191be47d3082ccd58e3c2ba2c7d3b0b1848244bce172246e50eaceb0202c1f284b029f

Download Submit
C:\Users\Admin\AppData\Local\Temp\avscan.exe

Filesize
367KB

MD5
871fa402e866bd7ef90f15c1c6a0b760

SHA1
dff5ec58a7127e0cce3ee2fa50f66d435853d3be

SHA256
d2761215adb8393686a70765b905d487edcdedf3d0089c127b6a465ee449999f

SHA512
82d0742f3c7b307ddbda3cde49517547c0d23f2a82bff0024797d83ada191be47d3082ccd58e3c2ba2c7d3b0b1848244bce172246e50eaceb0202c1f284b029f

Download Submit
C:\Users\Admin\AppData\Local\Temp\avscan.exe

Filesize
367KB

MD5
871fa402e866bd7ef90f15c1c6a0b760

SHA1
dff5ec58a7127e0cce3ee2fa50f66d435853d3be

SHA256
d2761215adb8393686a70765b905d487edcdedf3d0089c127b6a465ee449999f

SHA512
82d0742f3c7b307ddbda3cde49517547c0d23f2a82bff0024797d83ada191be47d3082ccd58e3c2ba2c7d3b0b1848244bce172246e50eaceb0202c1f284b029f

Download Submit
C:\Users\Admin\AppData\Local\Temp\avscan.exe

Filesize
367KB

MD5
871fa402e866bd7ef90f15c1c6a0b760

SHA1
dff5ec58a7127e0cce3ee2fa50f66d435853d3be

SHA256
d2761215adb8393686a70765b905d487edcdedf3d0089c127b6a465ee449999f

SHA512
82d0742f3c7b307ddbda3cde49517547c0d23f2a82bff0024797d83ada191be47d3082ccd58e3c2ba2c7d3b0b1848244bce172246e50eaceb0202c1f284b029f

Download Submit
C:\Windows\W_X_C.vbs

Filesize
195B

MD5
7fc0db81060e343fd209dc050b401f77

SHA1
08ce8975b023bf90c21b8e64cd54fdd39debce04

SHA256
4a21d378652d4291a6b9e88a1934ac51e9eccd5c9a42aa09076219301509367f

SHA512
e0d13ba3713707f7cb9be56240930a8f47d8c302e692b49dcb01f7bdf3e3475f829e1ead60ce6a5f98bed591be96456e9c3ef67bb27f88dc70343c1412e9de57

Download Submit
C:\Windows\hosts.exe

Filesize
367KB

MD5
5001a027bbd2b1ed054f6cb40ebc7121

SHA1
6811a19f357ba494da5d4f3bb8d0f45b9bd35022

SHA256
aa78a5ff15dc36f6fb7aaa764722f463f2c9f3724ce1df1e8f3e5638620838ae

SHA512
2af020f707d1542a76e7ca581f0531331dcd2553f618cad9a44ccc2830652a6fece526ba35f09bb5e989a93e79c425dc727377eaff21aed8e033f95f981af287

Download Submit
C:\Windows\hosts.exe

Filesize
367KB

MD5
5001a027bbd2b1ed054f6cb40ebc7121

SHA1
6811a19f357ba494da5d4f3bb8d0f45b9bd35022

SHA256
aa78a5ff15dc36f6fb7aaa764722f463f2c9f3724ce1df1e8f3e5638620838ae

SHA512
2af020f707d1542a76e7ca581f0531331dcd2553f618cad9a44ccc2830652a6fece526ba35f09bb5e989a93e79c425dc727377eaff21aed8e033f95f981af287

Download Submit
C:\Windows\hosts.exe

Filesize
367KB

MD5
5001a027bbd2b1ed054f6cb40ebc7121

SHA1
6811a19f357ba494da5d4f3bb8d0f45b9bd35022

SHA256
aa78a5ff15dc36f6fb7aaa764722f463f2c9f3724ce1df1e8f3e5638620838ae

SHA512
2af020f707d1542a76e7ca581f0531331dcd2553f618cad9a44ccc2830652a6fece526ba35f09bb5e989a93e79c425dc727377eaff21aed8e033f95f981af287

Download Submit
C:\Windows\hosts.exe

Filesize
367KB

MD5
5001a027bbd2b1ed054f6cb40ebc7121

SHA1
6811a19f357ba494da5d4f3bb8d0f45b9bd35022

SHA256
aa78a5ff15dc36f6fb7aaa764722f463f2c9f3724ce1df1e8f3e5638620838ae

SHA512
2af020f707d1542a76e7ca581f0531331dcd2553f618cad9a44ccc2830652a6fece526ba35f09bb5e989a93e79c425dc727377eaff21aed8e033f95f981af287

Download Submit
C:\windows\hosts.exe

Filesize
367KB

MD5
5001a027bbd2b1ed054f6cb40ebc7121

SHA1
6811a19f357ba494da5d4f3bb8d0f45b9bd35022

SHA256
aa78a5ff15dc36f6fb7aaa764722f463f2c9f3724ce1df1e8f3e5638620838ae

SHA512
2af020f707d1542a76e7ca581f0531331dcd2553f618cad9a44ccc2830652a6fece526ba35f09bb5e989a93e79c425dc727377eaff21aed8e033f95f981af287

Download Submit
\??\c:\windows\W_X_C.bat

Filesize
336B

MD5
4db9f8b6175722b62ececeeeba1ce307

SHA1
3b3ba8414706e72a6fa19e884a97b87609e11e47

SHA256
d2150b9e5a4ce55e140f0ca91c4e300715d42095c8fddf58c77037cdd2cfaf78

SHA512
1d6dc274cf7a3dd704f840e6a5ad57ab4c4e35d5f09489aeff520bb797e1c825bac53fc335156fe41e767a46520d031855fe42fe7b175409ebe5e9e986fb9b8b

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads