7824c05703ad4666728b8eab9a86dffb4803185e5f7428ffabea682dc8e16bde

Analysis

max time kernel
126s
max time network
47s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
06/11/2022, 13:08

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

7824c05703ad4666728b8eab9a86dffb4803185e5f7428ffabea682dc8e16bde.exe
Size

179KB
MD5

0ea35c285df718f07ae76eb2ba5dc1ab
SHA1

31f7406913ae32cf41337c63ba4d58740dd5a062
SHA256

7824c05703ad4666728b8eab9a86dffb4803185e5f7428ffabea682dc8e16bde
SHA512

9e29f03f2c7c3293634b2ff1fa86bc5b631492cad1aebbf07b550b8bbf0bd9e22d0e7f2660ec5bee5d3ebe69f5788092614aa6180a076f58a8742ca624701563
SSDEEP

3072:obpDCw1p3vmLvsZIaVwiwDcIbDHDCm/DER4eQSRuy8Jy:gDCwfG1bnxLERRLRr8Y

Score

10^/10

evasion persistence

Malware Config

Signatures

Modifies visibility of file extensions in Explorer 2 TTPs 3 IoCs

evasion

Hidden Files and Directories

T1158

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	hosts.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	7824c05703ad4666728b8eab9a86dffb4803185e5f7428ffabea682dc8e16bde.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	avscan.exe

Modifies visiblity of hidden/system files in Explorer 2 TTPs 3 IoCs

evasion

Hidden Files and Directories

T1158

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	avscan.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	hosts.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	7824c05703ad4666728b8eab9a86dffb4803185e5f7428ffabea682dc8e16bde.exe

Adds policy Run key to start application 2 TTPs 6 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	WScript.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\RYNKSFQE = "W_X_C.bat"	WScript.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	WScript.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\RYNKSFQE = "W_X_C.bat"	WScript.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	WScript.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\RYNKSFQE = "W_X_C.bat"	WScript.exe

Executes dropped EXE 6 IoCs

pid	Process
1692	avscan.exe
1784	avscan.exe
872	hosts.exe
452	hosts.exe
1272	avscan.exe
1376	hosts.exe

Loads dropped DLL 5 IoCs

pid	Process
1672	7824c05703ad4666728b8eab9a86dffb4803185e5f7428ffabea682dc8e16bde.exe
1672	7824c05703ad4666728b8eab9a86dffb4803185e5f7428ffabea682dc8e16bde.exe
1692	avscan.exe
872	hosts.exe
872	hosts.exe

Adds Run key to start application 2 TTPs 6 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run	7824c05703ad4666728b8eab9a86dffb4803185e5f7428ffabea682dc8e16bde.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\avscan = "C:\\Users\\Admin\\AppData\\Local\\Temp\\avscan.exe"	7824c05703ad4666728b8eab9a86dffb4803185e5f7428ffabea682dc8e16bde.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run	avscan.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\avscan = "C:\\Users\\Admin\\AppData\\Local\\Temp\\avscan.exe"	avscan.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run	hosts.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\avscan = "C:\\Users\\Admin\\AppData\\Local\\Temp\\avscan.exe"	hosts.exe

Drops file in Windows directory 5 IoCs

description	ioc	Process
File created	\??\c:\windows\W_X_C.bat	7824c05703ad4666728b8eab9a86dffb4803185e5f7428ffabea682dc8e16bde.exe
File opened for modification	C:\Windows\hosts.exe	7824c05703ad4666728b8eab9a86dffb4803185e5f7428ffabea682dc8e16bde.exe
File opened for modification	C:\Windows\hosts.exe	avscan.exe
File opened for modification	C:\Windows\hosts.exe	hosts.exe
File created	C:\windows\W_X_C.vbs	7824c05703ad4666728b8eab9a86dffb4803185e5f7428ffabea682dc8e16bde.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies registry key 1 TTPs 9 IoCs

Modify Registry

T1112

pid	Process
1500	REG.exe
1572	REG.exe
1876	REG.exe
904	REG.exe
684	REG.exe
1636	REG.exe
788	REG.exe
1624	REG.exe
516	REG.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

pid	Process
1692	avscan.exe
872	hosts.exe

Suspicious use of SetWindowsHookEx 7 IoCs

pid	Process
1672	7824c05703ad4666728b8eab9a86dffb4803185e5f7428ffabea682dc8e16bde.exe
1692	avscan.exe
1784	avscan.exe
452	hosts.exe
872	hosts.exe
1272	avscan.exe
1376	hosts.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1672 wrote to memory of 1624	1672	7824c05703ad4666728b8eab9a86dffb4803185e5f7428ffabea682dc8e16bde.exe	27
PID 1672 wrote to memory of 1624	1672	7824c05703ad4666728b8eab9a86dffb4803185e5f7428ffabea682dc8e16bde.exe	27
PID 1672 wrote to memory of 1624	1672	7824c05703ad4666728b8eab9a86dffb4803185e5f7428ffabea682dc8e16bde.exe	27
PID 1672 wrote to memory of 1624	1672	7824c05703ad4666728b8eab9a86dffb4803185e5f7428ffabea682dc8e16bde.exe	27
PID 1672 wrote to memory of 1692	1672	7824c05703ad4666728b8eab9a86dffb4803185e5f7428ffabea682dc8e16bde.exe	29
PID 1672 wrote to memory of 1692	1672	7824c05703ad4666728b8eab9a86dffb4803185e5f7428ffabea682dc8e16bde.exe	29
PID 1672 wrote to memory of 1692	1672	7824c05703ad4666728b8eab9a86dffb4803185e5f7428ffabea682dc8e16bde.exe	29
PID 1672 wrote to memory of 1692	1672	7824c05703ad4666728b8eab9a86dffb4803185e5f7428ffabea682dc8e16bde.exe	29
PID 1692 wrote to memory of 1784	1692	avscan.exe	30
PID 1692 wrote to memory of 1784	1692	avscan.exe	30
PID 1692 wrote to memory of 1784	1692	avscan.exe	30
PID 1692 wrote to memory of 1784	1692	avscan.exe	30
PID 1692 wrote to memory of 976	1692	avscan.exe	31
PID 1692 wrote to memory of 976	1692	avscan.exe	31
PID 1692 wrote to memory of 976	1692	avscan.exe	31
PID 1692 wrote to memory of 976	1692	avscan.exe	31
PID 1672 wrote to memory of 1060	1672	7824c05703ad4666728b8eab9a86dffb4803185e5f7428ffabea682dc8e16bde.exe	32
PID 1672 wrote to memory of 1060	1672	7824c05703ad4666728b8eab9a86dffb4803185e5f7428ffabea682dc8e16bde.exe	32
PID 1672 wrote to memory of 1060	1672	7824c05703ad4666728b8eab9a86dffb4803185e5f7428ffabea682dc8e16bde.exe	32
PID 1672 wrote to memory of 1060	1672	7824c05703ad4666728b8eab9a86dffb4803185e5f7428ffabea682dc8e16bde.exe	32
PID 1060 wrote to memory of 452	1060	cmd.exe	35
PID 1060 wrote to memory of 452	1060	cmd.exe	35
PID 1060 wrote to memory of 452	1060	cmd.exe	35
PID 1060 wrote to memory of 452	1060	cmd.exe	35
PID 976 wrote to memory of 872	976	cmd.exe	36
PID 976 wrote to memory of 872	976	cmd.exe	36
PID 976 wrote to memory of 872	976	cmd.exe	36
PID 976 wrote to memory of 872	976	cmd.exe	36
PID 976 wrote to memory of 1280	976	cmd.exe	37
PID 976 wrote to memory of 1280	976	cmd.exe	37
PID 976 wrote to memory of 1280	976	cmd.exe	37
PID 976 wrote to memory of 1280	976	cmd.exe	37
PID 872 wrote to memory of 1272	872	hosts.exe	38
PID 872 wrote to memory of 1272	872	hosts.exe	38
PID 872 wrote to memory of 1272	872	hosts.exe	38
PID 872 wrote to memory of 1272	872	hosts.exe	38
PID 1060 wrote to memory of 1296	1060	cmd.exe	39
PID 1060 wrote to memory of 1296	1060	cmd.exe	39
PID 1060 wrote to memory of 1296	1060	cmd.exe	39
PID 1060 wrote to memory of 1296	1060	cmd.exe	39
PID 872 wrote to memory of 1960	872	hosts.exe	40
PID 872 wrote to memory of 1960	872	hosts.exe	40
PID 872 wrote to memory of 1960	872	hosts.exe	40
PID 872 wrote to memory of 1960	872	hosts.exe	40
PID 1960 wrote to memory of 1376	1960	cmd.exe	42
PID 1960 wrote to memory of 1376	1960	cmd.exe	42
PID 1960 wrote to memory of 1376	1960	cmd.exe	42
PID 1960 wrote to memory of 1376	1960	cmd.exe	42
PID 1960 wrote to memory of 964	1960	cmd.exe	43
PID 1960 wrote to memory of 964	1960	cmd.exe	43
PID 1960 wrote to memory of 964	1960	cmd.exe	43
PID 1960 wrote to memory of 964	1960	cmd.exe	43
PID 1692 wrote to memory of 904	1692	avscan.exe	44
PID 1692 wrote to memory of 904	1692	avscan.exe	44
PID 1692 wrote to memory of 904	1692	avscan.exe	44
PID 1692 wrote to memory of 904	1692	avscan.exe	44
PID 872 wrote to memory of 684	872	hosts.exe	46
PID 872 wrote to memory of 684	872	hosts.exe	46
PID 872 wrote to memory of 684	872	hosts.exe	46
PID 872 wrote to memory of 684	872	hosts.exe	46
PID 872 wrote to memory of 1500	872	hosts.exe	48
PID 872 wrote to memory of 1500	872	hosts.exe	48
PID 872 wrote to memory of 1500	872	hosts.exe	48
PID 872 wrote to memory of 1500	872	hosts.exe	48

C:\Users\Admin\AppData\Local\Temp\7824c05703ad4666728b8eab9a86dffb4803185e5f7428ffabea682dc8e16bde.exe
"C:\Users\Admin\AppData\Local\Temp\7824c05703ad4666728b8eab9a86dffb4803185e5f7428ffabea682dc8e16bde.exe"
1⤵
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- Loads dropped DLL
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1672
- C:\Windows\SysWOW64\REG.exe
  REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
  2⤵
  - Modifies registry key
  PID:1624
- C:\Users\Admin\AppData\Local\Temp\avscan.exe
  C:\Users\Admin\AppData\Local\Temp\avscan.exe
  2⤵
  - Modifies visibility of file extensions in Explorer
  - Modifies visiblity of hidden/system files in Explorer
  - Executes dropped EXE
  - Loads dropped DLL
  - Adds Run key to start application
  - Drops file in Windows directory
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1692
- - C:\Users\Admin\AppData\Local\Temp\avscan.exe
    C:\Users\Admin\AppData\Local\Temp\avscan.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1784
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c c:\windows\W_X_C.bat
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:976
  - - C:\windows\hosts.exe
      C:\windows\hosts.exe
      4⤵
      Modifies visibility of file extensions in Explorer
      Modifies visiblity of hidden/system files in Explorer
      Executes dropped EXE
      Loads dropped DLL
      Adds Run key to start application
      Drops file in Windows directory
      Suspicious behavior: GetForegroundWindowSpam
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:872
    - - C:\Users\Admin\AppData\Local\Temp\avscan.exe
        
        C:\Users\Admin\AppData\Local\Temp\avscan.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1272
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd /c c:\windows\W_X_C.bat
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:1960
      - C:\windows\hosts.exe
        
        C:\windows\hosts.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1376
      - C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Windows\W_X_C.vbs"
        6⤵
        Adds policy Run key to start application
        
        PID:964
    - - C:\Windows\SysWOW64\REG.exe
        
        REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
        5⤵
        Modifies registry key
        
        PID:684
    - - C:\Windows\SysWOW64\REG.exe
        
        REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
        5⤵
        Modifies registry key
        
        PID:1500
    - - C:\Windows\SysWOW64\REG.exe
        
        REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
        5⤵
        Modifies registry key
        
        PID:1876
    - - C:\Windows\SysWOW64\REG.exe
        
        REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
        5⤵
        Modifies registry key
        
        PID:788
  - - C:\Windows\SysWOW64\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Windows\W_X_C.vbs"
      4⤵
      Adds policy Run key to start application
      PID:1280
- - C:\Windows\SysWOW64\REG.exe
    REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
    3⤵
    - Modifies registry key
    PID:904
- - C:\Windows\SysWOW64\REG.exe
    REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
    3⤵
    - Modifies registry key
    PID:516
- - C:\Windows\SysWOW64\REG.exe
    REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
    3⤵
    - Modifies registry key
    PID:1572
- - C:\Windows\SysWOW64\REG.exe
    REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
    3⤵
    - Modifies registry key
    PID:1636
- C:\Windows\SysWOW64\cmd.exe
  cmd /c c:\windows\W_X_C.bat
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1060
- - C:\windows\hosts.exe
    C:\windows\hosts.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:452
- - C:\Windows\SysWOW64\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Windows\W_X_C.vbs"
    3⤵
    - Adds policy Run key to start application
    PID:1296

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Hidden Files and Directories

T1158

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Hidden Files and Directories

T1158

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Admin.bmp

Filesize
406KB

MD5
23e5b8595244370fb490e7fccad8cd4e

SHA1
79964dfd49fec1823aebbecefffe91f893ac5d0b

SHA256
768acf2f1e92954cb87c34a30f7654070e3ed50cac17f6d9031d923ed0d27fc9

SHA512
244c723b730a808fc3d20b1f2d650f52059410f5906c92346c32a1d2cf6bc26b9652533e36033285a6141bd7584535a79a00af4101a2662bdf513c8640df35de

Download Submit
C:\Users\Admin\AppData\Local\Temp\Admin.bmp

Filesize
765KB

MD5
907e52ad72b10c549ce90afa52c0b5ec

SHA1
8f9a8a72836349552b43a3542a3a73ca8a238cc9

SHA256
fb7dadb501c24776a3d7bf2106e28a131784083f6696693ec20a9be231cc3de5

SHA512
acb1386b4dc492d14dbb85085f9050624b69ca875c1a59eb8f1604db5feba04241cf870256ce96eac3d5db45c01e11a390072cccb451394b78585340cf6937cd

Download Submit
C:\Users\Admin\AppData\Local\Temp\Admin.bmp

Filesize
765KB

MD5
a0a6582d44875993dbc4643f7e591154

SHA1
afb48843a208f6e8f36acc834010a44cee6530cd

SHA256
b0b2f0db7a5f574d3d6825d162562053643e7663d8ec582c52362116d6e5e42b

SHA512
fcf6ab9468bbb08dae4e3158e05d7f84eb9fe86eeb63f5e1286f20785ce9498344190d098b2287d8e5afd19d945ad0f79713b6aa8e9b6632ffeee1b14e967478

Download Submit
C:\Users\Admin\AppData\Local\Temp\Admin.bmp

Filesize
1.1MB

MD5
d768ddd7ddb17ed49ba6cc1ca7c5c950

SHA1
e30fd2646554126e246b4ffd03d2245d37b8c8b2

SHA256
a7ba4acd1726b324014cac2ce4531aa4106a6a9c52639234f0bfa57332f61e54

SHA512
b69a491859f3833f97d267cfefc15257576df7a653f60ca5aa5cb8afd8bfd44e79034e841b1690ae46bf31b64ca21e3baac87c24addf5f4bb78df470919ff1b1

Download Submit
C:\Users\Admin\AppData\Local\Temp\Admin.bmp

Filesize
1.4MB

MD5
f5cda0fed8c1440cce7ad53f9c8ec6a0

SHA1
a008d7f6b22a0e6cda4ee38c7272e7c63e8850b7

SHA256
eaa9d257eb9128cdcbddc044f20bf5b1c9c9836bcec91c89a7a18edc0bf94447

SHA512
89076294408ca016e48b4ff1cfbdaa037db23264a766905651374b353c366215a9a89381ff1c7b39631cf3895afabd0f987dc0448483121f81bc34f1a7ecffe1

Download Submit
C:\Users\Admin\AppData\Local\Temp\Admin.bmp

Filesize
1.4MB

MD5
52a228a8e9bfe7ead08a6f21a3334bae

SHA1
189baee834eb5f31f02027bfea0200ddc73d2e01

SHA256
02661ed59a3ee89ca62687e25770d7206210beaf2cdc345db707b4850cecdfdf

SHA512
baaa23b4bf5b51b24b990eef7956e43ddffe31b30a55a5fa952ed1a963c2fba6c3ac3daa136a20098c505fb5bd58c6eb714354f01eeb3186847582e4d607a731

Download Submit
C:\Users\Admin\AppData\Local\Temp\avscan.exe

Filesize
179KB

MD5
2db08648bece13b810c729e1dcfb15ed

SHA1
44a7aa9fe4c0336db4bb6ef77eac378e8ad2f440

SHA256
d093ba8c44fb3a8259038056a54fb4616e2a3debaa1be9565746a7323ce9c039

SHA512
c53278c1deb7c74c52fcbf8633b839c7479466a35ff98cb1eee6843ade70d124316fb57b4cc0d480998c9dabfb503ae8d117f31b5c5114181ed2868a763e1df0

Download Submit
C:\Users\Admin\AppData\Local\Temp\avscan.exe

Filesize
179KB

MD5
2db08648bece13b810c729e1dcfb15ed

SHA1
44a7aa9fe4c0336db4bb6ef77eac378e8ad2f440

SHA256
d093ba8c44fb3a8259038056a54fb4616e2a3debaa1be9565746a7323ce9c039

SHA512
c53278c1deb7c74c52fcbf8633b839c7479466a35ff98cb1eee6843ade70d124316fb57b4cc0d480998c9dabfb503ae8d117f31b5c5114181ed2868a763e1df0

Download Submit
C:\Users\Admin\AppData\Local\Temp\avscan.exe

Filesize
179KB

MD5
2db08648bece13b810c729e1dcfb15ed

SHA1
44a7aa9fe4c0336db4bb6ef77eac378e8ad2f440

SHA256
d093ba8c44fb3a8259038056a54fb4616e2a3debaa1be9565746a7323ce9c039

SHA512
c53278c1deb7c74c52fcbf8633b839c7479466a35ff98cb1eee6843ade70d124316fb57b4cc0d480998c9dabfb503ae8d117f31b5c5114181ed2868a763e1df0

Download Submit
C:\Users\Admin\AppData\Local\Temp\avscan.exe

Filesize
179KB

MD5
2db08648bece13b810c729e1dcfb15ed

SHA1
44a7aa9fe4c0336db4bb6ef77eac378e8ad2f440

SHA256
d093ba8c44fb3a8259038056a54fb4616e2a3debaa1be9565746a7323ce9c039

SHA512
c53278c1deb7c74c52fcbf8633b839c7479466a35ff98cb1eee6843ade70d124316fb57b4cc0d480998c9dabfb503ae8d117f31b5c5114181ed2868a763e1df0

Download Submit
C:\Windows\W_X_C.vbs

Filesize
195B

MD5
8efab902a61f6cddc318bb5818c2f2e0

SHA1
9608751279ae04ba710d84c61e3937c12950b393

SHA256
a81d0e86c651ead3e4d9c7f64e637006e787c81c8ba3e784648c2786306bfb87

SHA512
aabd0e45609a39584c68c35e16124b399e9a4932bf6c98c22aa8c6ff71b2fbfc80333102960fcfca1abb38b344245f9cdf4cdc0c827c48235f618011a5fbfe18

Download Submit
C:\Windows\hosts.exe

Filesize
179KB

MD5
98888f8eb6a8c46b280651da9507da3d

SHA1
7e3873588f9d4da2ac359d8af8a8f3c4921e3445

SHA256
1f95ea13145f1d798100dfc2a4db60114b1c4635fdadb09877434f3000fcb653

SHA512
cd86d4faa4643a0acb02c54e6ab15aaf423926ca0fbdde1b0d7e4fded6245b72442ad2dca5bd9925a54993de188948d958eabc159ae73622dea509f8f447f16a

Download Submit
C:\Windows\hosts.exe

Filesize
179KB

MD5
98888f8eb6a8c46b280651da9507da3d

SHA1
7e3873588f9d4da2ac359d8af8a8f3c4921e3445

SHA256
1f95ea13145f1d798100dfc2a4db60114b1c4635fdadb09877434f3000fcb653

SHA512
cd86d4faa4643a0acb02c54e6ab15aaf423926ca0fbdde1b0d7e4fded6245b72442ad2dca5bd9925a54993de188948d958eabc159ae73622dea509f8f447f16a

Download Submit
C:\Windows\hosts.exe

Filesize
179KB

MD5
98888f8eb6a8c46b280651da9507da3d

SHA1
7e3873588f9d4da2ac359d8af8a8f3c4921e3445

SHA256
1f95ea13145f1d798100dfc2a4db60114b1c4635fdadb09877434f3000fcb653

SHA512
cd86d4faa4643a0acb02c54e6ab15aaf423926ca0fbdde1b0d7e4fded6245b72442ad2dca5bd9925a54993de188948d958eabc159ae73622dea509f8f447f16a

Download Submit
C:\Windows\hosts.exe

Filesize
179KB

MD5
98888f8eb6a8c46b280651da9507da3d

SHA1
7e3873588f9d4da2ac359d8af8a8f3c4921e3445

SHA256
1f95ea13145f1d798100dfc2a4db60114b1c4635fdadb09877434f3000fcb653

SHA512
cd86d4faa4643a0acb02c54e6ab15aaf423926ca0fbdde1b0d7e4fded6245b72442ad2dca5bd9925a54993de188948d958eabc159ae73622dea509f8f447f16a

Download Submit
C:\windows\hosts.exe

Filesize
179KB

MD5
98888f8eb6a8c46b280651da9507da3d

SHA1
7e3873588f9d4da2ac359d8af8a8f3c4921e3445

SHA256
1f95ea13145f1d798100dfc2a4db60114b1c4635fdadb09877434f3000fcb653

SHA512
cd86d4faa4643a0acb02c54e6ab15aaf423926ca0fbdde1b0d7e4fded6245b72442ad2dca5bd9925a54993de188948d958eabc159ae73622dea509f8f447f16a

Download Submit
\??\c:\windows\W_X_C.bat

Filesize
336B

MD5
4db9f8b6175722b62ececeeeba1ce307

SHA1
3b3ba8414706e72a6fa19e884a97b87609e11e47

SHA256
d2150b9e5a4ce55e140f0ca91c4e300715d42095c8fddf58c77037cdd2cfaf78

SHA512
1d6dc274cf7a3dd704f840e6a5ad57ab4c4e35d5f09489aeff520bb797e1c825bac53fc335156fe41e767a46520d031855fe42fe7b175409ebe5e9e986fb9b8b

Download Submit
\Users\Admin\AppData\Local\Temp\avscan.exe

Filesize
179KB

MD5
2db08648bece13b810c729e1dcfb15ed

SHA1
44a7aa9fe4c0336db4bb6ef77eac378e8ad2f440

SHA256
d093ba8c44fb3a8259038056a54fb4616e2a3debaa1be9565746a7323ce9c039

SHA512
c53278c1deb7c74c52fcbf8633b839c7479466a35ff98cb1eee6843ade70d124316fb57b4cc0d480998c9dabfb503ae8d117f31b5c5114181ed2868a763e1df0

Download Submit
\Users\Admin\AppData\Local\Temp\avscan.exe

Filesize
179KB

MD5
2db08648bece13b810c729e1dcfb15ed

SHA1
44a7aa9fe4c0336db4bb6ef77eac378e8ad2f440

SHA256
d093ba8c44fb3a8259038056a54fb4616e2a3debaa1be9565746a7323ce9c039

SHA512
c53278c1deb7c74c52fcbf8633b839c7479466a35ff98cb1eee6843ade70d124316fb57b4cc0d480998c9dabfb503ae8d117f31b5c5114181ed2868a763e1df0

Download Submit
\Users\Admin\AppData\Local\Temp\avscan.exe

Filesize
179KB

MD5
2db08648bece13b810c729e1dcfb15ed

SHA1
44a7aa9fe4c0336db4bb6ef77eac378e8ad2f440

SHA256
d093ba8c44fb3a8259038056a54fb4616e2a3debaa1be9565746a7323ce9c039

SHA512
c53278c1deb7c74c52fcbf8633b839c7479466a35ff98cb1eee6843ade70d124316fb57b4cc0d480998c9dabfb503ae8d117f31b5c5114181ed2868a763e1df0

Download Submit
\Users\Admin\AppData\Local\Temp\avscan.exe

Filesize
179KB

MD5
2db08648bece13b810c729e1dcfb15ed

SHA1
44a7aa9fe4c0336db4bb6ef77eac378e8ad2f440

SHA256
d093ba8c44fb3a8259038056a54fb4616e2a3debaa1be9565746a7323ce9c039

SHA512
c53278c1deb7c74c52fcbf8633b839c7479466a35ff98cb1eee6843ade70d124316fb57b4cc0d480998c9dabfb503ae8d117f31b5c5114181ed2868a763e1df0

Download Submit
\Users\Admin\AppData\Local\Temp\avscan.exe

Filesize
179KB

MD5
2db08648bece13b810c729e1dcfb15ed

SHA1
44a7aa9fe4c0336db4bb6ef77eac378e8ad2f440

SHA256
d093ba8c44fb3a8259038056a54fb4616e2a3debaa1be9565746a7323ce9c039

SHA512
c53278c1deb7c74c52fcbf8633b839c7479466a35ff98cb1eee6843ade70d124316fb57b4cc0d480998c9dabfb503ae8d117f31b5c5114181ed2868a763e1df0

Download Submit
memory/1672-56-0x0000000075111000-0x0000000075113000-memory.dmp

Filesize
8KB

Download
memory/1672-58-0x0000000074061000-0x0000000074063000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads