7824c05703ad4666728b8eab9a86dffb4803185e5f7428ffabea682dc8e16bde

Analysis

max time kernel
125s
max time network
158s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
06/11/2022, 13:08

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

7824c05703ad4666728b8eab9a86dffb4803185e5f7428ffabea682dc8e16bde.exe
Size

179KB
MD5

0ea35c285df718f07ae76eb2ba5dc1ab
SHA1

31f7406913ae32cf41337c63ba4d58740dd5a062
SHA256

7824c05703ad4666728b8eab9a86dffb4803185e5f7428ffabea682dc8e16bde
SHA512

9e29f03f2c7c3293634b2ff1fa86bc5b631492cad1aebbf07b550b8bbf0bd9e22d0e7f2660ec5bee5d3ebe69f5788092614aa6180a076f58a8742ca624701563
SSDEEP

3072:obpDCw1p3vmLvsZIaVwiwDcIbDHDCm/DER4eQSRuy8Jy:gDCwfG1bnxLERRLRr8Y

Score

10^/10

evasion persistence

Malware Config

Signatures

Modifies visibility of file extensions in Explorer 2 TTPs 3 IoCs

evasion

Hidden Files and Directories

T1158

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	7824c05703ad4666728b8eab9a86dffb4803185e5f7428ffabea682dc8e16bde.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	avscan.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	hosts.exe

Modifies visiblity of hidden/system files in Explorer 2 TTPs 3 IoCs

evasion

Hidden Files and Directories

T1158

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	avscan.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	hosts.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	7824c05703ad4666728b8eab9a86dffb4803185e5f7428ffabea682dc8e16bde.exe

Adds policy Run key to start application 2 TTPs 6 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\IYMUGYHL = "W_X_C.bat"	WScript.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	WScript.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\IYMUGYHL = "W_X_C.bat"	WScript.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	WScript.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\IYMUGYHL = "W_X_C.bat"	WScript.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	WScript.exe

Executes dropped EXE 6 IoCs

pid	Process
4260	avscan.exe
2784	avscan.exe
1668	hosts.exe
376	hosts.exe
4964	avscan.exe
2464	hosts.exe

Checks computer location settings 2 TTPs 3 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation	cmd.exe
Key value queried	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation	cmd.exe
Key value queried	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation	cmd.exe

Adds Run key to start application 2 TTPs 6 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run	7824c05703ad4666728b8eab9a86dffb4803185e5f7428ffabea682dc8e16bde.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\avscan = "C:\\Users\\Admin\\AppData\\Local\\Temp\\avscan.exe"	7824c05703ad4666728b8eab9a86dffb4803185e5f7428ffabea682dc8e16bde.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run	avscan.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\avscan = "C:\\Users\\Admin\\AppData\\Local\\Temp\\avscan.exe"	avscan.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run	hosts.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\avscan = "C:\\Users\\Admin\\AppData\\Local\\Temp\\avscan.exe"	hosts.exe

Drops file in Windows directory 5 IoCs

description	ioc	Process
File created	\??\c:\windows\W_X_C.bat	7824c05703ad4666728b8eab9a86dffb4803185e5f7428ffabea682dc8e16bde.exe
File opened for modification	C:\Windows\hosts.exe	7824c05703ad4666728b8eab9a86dffb4803185e5f7428ffabea682dc8e16bde.exe
File opened for modification	C:\Windows\hosts.exe	avscan.exe
File opened for modification	C:\Windows\hosts.exe	hosts.exe
File created	C:\windows\W_X_C.vbs	7824c05703ad4666728b8eab9a86dffb4803185e5f7428ffabea682dc8e16bde.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies registry class 4 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\Local Settings	7824c05703ad4666728b8eab9a86dffb4803185e5f7428ffabea682dc8e16bde.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\Local Settings	cmd.exe

Modifies registry key 1 TTPs 9 IoCs

Modify Registry

T1112

pid	Process
3136	REG.exe
4544	REG.exe
2100	REG.exe
1932	REG.exe
3016	REG.exe
2356	REG.exe
3312	REG.exe
3492	REG.exe
2028	REG.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

pid	Process
4260	avscan.exe
1668	hosts.exe

Suspicious use of SetWindowsHookEx 7 IoCs

pid	Process
5080	7824c05703ad4666728b8eab9a86dffb4803185e5f7428ffabea682dc8e16bde.exe
4260	avscan.exe
2784	avscan.exe
1668	hosts.exe
376	hosts.exe
4964	avscan.exe
2464	hosts.exe

Suspicious use of WriteProcessMemory 63 IoCs

description	pid	Process	procid_target
PID 5080 wrote to memory of 2100	5080	7824c05703ad4666728b8eab9a86dffb4803185e5f7428ffabea682dc8e16bde.exe	82
PID 5080 wrote to memory of 2100	5080	7824c05703ad4666728b8eab9a86dffb4803185e5f7428ffabea682dc8e16bde.exe	82
PID 5080 wrote to memory of 2100	5080	7824c05703ad4666728b8eab9a86dffb4803185e5f7428ffabea682dc8e16bde.exe	82
PID 5080 wrote to memory of 4260	5080	7824c05703ad4666728b8eab9a86dffb4803185e5f7428ffabea682dc8e16bde.exe	84
PID 5080 wrote to memory of 4260	5080	7824c05703ad4666728b8eab9a86dffb4803185e5f7428ffabea682dc8e16bde.exe	84
PID 5080 wrote to memory of 4260	5080	7824c05703ad4666728b8eab9a86dffb4803185e5f7428ffabea682dc8e16bde.exe	84
PID 4260 wrote to memory of 2784	4260	avscan.exe	85
PID 4260 wrote to memory of 2784	4260	avscan.exe	85
PID 4260 wrote to memory of 2784	4260	avscan.exe	85
PID 4260 wrote to memory of 4232	4260	avscan.exe	86
PID 4260 wrote to memory of 4232	4260	avscan.exe	86
PID 4260 wrote to memory of 4232	4260	avscan.exe	86
PID 5080 wrote to memory of 3496	5080	7824c05703ad4666728b8eab9a86dffb4803185e5f7428ffabea682dc8e16bde.exe	87
PID 5080 wrote to memory of 3496	5080	7824c05703ad4666728b8eab9a86dffb4803185e5f7428ffabea682dc8e16bde.exe	87
PID 5080 wrote to memory of 3496	5080	7824c05703ad4666728b8eab9a86dffb4803185e5f7428ffabea682dc8e16bde.exe	87
PID 4232 wrote to memory of 376	4232	cmd.exe	91
PID 4232 wrote to memory of 376	4232	cmd.exe	91
PID 4232 wrote to memory of 376	4232	cmd.exe	91
PID 3496 wrote to memory of 1668	3496	cmd.exe	90
PID 3496 wrote to memory of 1668	3496	cmd.exe	90
PID 3496 wrote to memory of 1668	3496	cmd.exe	90
PID 1668 wrote to memory of 4964	1668	hosts.exe	92
PID 1668 wrote to memory of 4964	1668	hosts.exe	92
PID 1668 wrote to memory of 4964	1668	hosts.exe	92
PID 1668 wrote to memory of 4928	1668	hosts.exe	94
PID 1668 wrote to memory of 4928	1668	hosts.exe	94
PID 1668 wrote to memory of 4928	1668	hosts.exe	94
PID 3496 wrote to memory of 2944	3496	cmd.exe	97
PID 3496 wrote to memory of 2944	3496	cmd.exe	97
PID 3496 wrote to memory of 2944	3496	cmd.exe	97
PID 4232 wrote to memory of 2288	4232	cmd.exe	96
PID 4232 wrote to memory of 2288	4232	cmd.exe	96
PID 4232 wrote to memory of 2288	4232	cmd.exe	96
PID 4928 wrote to memory of 2464	4928	cmd.exe	98
PID 4928 wrote to memory of 2464	4928	cmd.exe	98
PID 4928 wrote to memory of 2464	4928	cmd.exe	98
PID 4928 wrote to memory of 3020	4928	cmd.exe	99
PID 4928 wrote to memory of 3020	4928	cmd.exe	99
PID 4928 wrote to memory of 3020	4928	cmd.exe	99
PID 4260 wrote to memory of 1932	4260	avscan.exe	107
PID 4260 wrote to memory of 1932	4260	avscan.exe	107
PID 4260 wrote to memory of 1932	4260	avscan.exe	107
PID 1668 wrote to memory of 3016	1668	hosts.exe	109
PID 1668 wrote to memory of 3016	1668	hosts.exe	109
PID 1668 wrote to memory of 3016	1668	hosts.exe	109
PID 4260 wrote to memory of 2356	4260	avscan.exe	111
PID 4260 wrote to memory of 2356	4260	avscan.exe	111
PID 4260 wrote to memory of 2356	4260	avscan.exe	111
PID 1668 wrote to memory of 3492	1668	hosts.exe	113
PID 1668 wrote to memory of 3492	1668	hosts.exe	113
PID 1668 wrote to memory of 3492	1668	hosts.exe	113
PID 4260 wrote to memory of 3312	4260	avscan.exe	115
PID 4260 wrote to memory of 3312	4260	avscan.exe	115
PID 4260 wrote to memory of 3312	4260	avscan.exe	115
PID 1668 wrote to memory of 3136	1668	hosts.exe	117
PID 1668 wrote to memory of 3136	1668	hosts.exe	117
PID 1668 wrote to memory of 3136	1668	hosts.exe	117
PID 4260 wrote to memory of 2028	4260	avscan.exe	119
PID 4260 wrote to memory of 2028	4260	avscan.exe	119
PID 4260 wrote to memory of 2028	4260	avscan.exe	119
PID 1668 wrote to memory of 4544	1668	hosts.exe	121
PID 1668 wrote to memory of 4544	1668	hosts.exe	121
PID 1668 wrote to memory of 4544	1668	hosts.exe	121

C:\Users\Admin\AppData\Local\Temp\7824c05703ad4666728b8eab9a86dffb4803185e5f7428ffabea682dc8e16bde.exe
"C:\Users\Admin\AppData\Local\Temp\7824c05703ad4666728b8eab9a86dffb4803185e5f7428ffabea682dc8e16bde.exe"
1⤵
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- Adds Run key to start application
- Drops file in Windows directory
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5080
- C:\Windows\SysWOW64\REG.exe
  REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
  2⤵
  - Modifies registry key
  PID:2100
- C:\Users\Admin\AppData\Local\Temp\avscan.exe
  C:\Users\Admin\AppData\Local\Temp\avscan.exe
  2⤵
  - Modifies visibility of file extensions in Explorer
  - Modifies visiblity of hidden/system files in Explorer
  - Executes dropped EXE
  - Adds Run key to start application
  - Drops file in Windows directory
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4260
- - C:\Users\Admin\AppData\Local\Temp\avscan.exe
    C:\Users\Admin\AppData\Local\Temp\avscan.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2784
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c c:\windows\W_X_C.bat
    3⤵
    - Checks computer location settings
    - Modifies registry class
    - Suspicious use of WriteProcessMemory
    PID:4232
  - - C:\windows\hosts.exe
      C:\windows\hosts.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:376
  - - C:\Windows\SysWOW64\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Windows\W_X_C.vbs"
      4⤵
      Adds policy Run key to start application
      PID:2288
- - C:\Windows\SysWOW64\REG.exe
    REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
    3⤵
    - Modifies registry key
    PID:1932
- - C:\Windows\SysWOW64\REG.exe
    REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
    3⤵
    - Modifies registry key
    PID:2356
- - C:\Windows\SysWOW64\REG.exe
    REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
    3⤵
    - Modifies registry key
    PID:3312
- - C:\Windows\SysWOW64\REG.exe
    REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
    3⤵
    - Modifies registry key
    PID:2028
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c c:\windows\W_X_C.bat
  2⤵
  - Checks computer location settings
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:3496
- - C:\windows\hosts.exe
    C:\windows\hosts.exe
    3⤵
    - Modifies visibility of file extensions in Explorer
    - Modifies visiblity of hidden/system files in Explorer
    - Executes dropped EXE
    - Adds Run key to start application
    - Drops file in Windows directory
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:1668
  - - C:\Users\Admin\AppData\Local\Temp\avscan.exe
      C:\Users\Admin\AppData\Local\Temp\avscan.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4964
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c c:\windows\W_X_C.bat
      4⤵
      Checks computer location settings
      Modifies registry class
      Suspicious use of WriteProcessMemory
      PID:4928
    - - C:\windows\hosts.exe
        
        C:\windows\hosts.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2464
    - - C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Windows\W_X_C.vbs"
        5⤵
        Adds policy Run key to start application
        
        PID:3020
  - - C:\Windows\SysWOW64\REG.exe
      REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
      4⤵
      Modifies registry key
      PID:3016
  - - C:\Windows\SysWOW64\REG.exe
      REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
      4⤵
      Modifies registry key
      PID:3492
  - - C:\Windows\SysWOW64\REG.exe
      REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
      4⤵
      Modifies registry key
      PID:3136
  - - C:\Windows\SysWOW64\REG.exe
      REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
      4⤵
      Modifies registry key
      PID:4544
- - C:\Windows\SysWOW64\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Windows\W_X_C.vbs"
    3⤵
    - Adds policy Run key to start application
    PID:2944

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4920

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Hidden Files and Directories

T1158

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Hidden Files and Directories

T1158

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\avscan.exe

Filesize
179KB

MD5
046de5194e5c76a0fe53896472dccc2b

SHA1
db8cf5a05bbf8c8708aebf187ab192a0d24612bf

SHA256
2f2fd12f22a8c50216fb314377e039092c6c6ab40fc213183914ea8cfd26461f

SHA512
8c2763b0c9509c8f2cda8de972215506c2f7391d90e1fbde5d73051b2464c1cd56e134b773e8aa6f29150fe5371ecc12d246b58a5da8b0ac806e70ff796ced7f

Download Submit
C:\Users\Admin\AppData\Local\Temp\avscan.exe

Filesize
179KB

MD5
046de5194e5c76a0fe53896472dccc2b

SHA1
db8cf5a05bbf8c8708aebf187ab192a0d24612bf

SHA256
2f2fd12f22a8c50216fb314377e039092c6c6ab40fc213183914ea8cfd26461f

SHA512
8c2763b0c9509c8f2cda8de972215506c2f7391d90e1fbde5d73051b2464c1cd56e134b773e8aa6f29150fe5371ecc12d246b58a5da8b0ac806e70ff796ced7f

Download Submit
C:\Users\Admin\AppData\Local\Temp\avscan.exe

Filesize
179KB

MD5
046de5194e5c76a0fe53896472dccc2b

SHA1
db8cf5a05bbf8c8708aebf187ab192a0d24612bf

SHA256
2f2fd12f22a8c50216fb314377e039092c6c6ab40fc213183914ea8cfd26461f

SHA512
8c2763b0c9509c8f2cda8de972215506c2f7391d90e1fbde5d73051b2464c1cd56e134b773e8aa6f29150fe5371ecc12d246b58a5da8b0ac806e70ff796ced7f

Download Submit
C:\Users\Admin\AppData\Local\Temp\avscan.exe

Filesize
179KB

MD5
046de5194e5c76a0fe53896472dccc2b

SHA1
db8cf5a05bbf8c8708aebf187ab192a0d24612bf

SHA256
2f2fd12f22a8c50216fb314377e039092c6c6ab40fc213183914ea8cfd26461f

SHA512
8c2763b0c9509c8f2cda8de972215506c2f7391d90e1fbde5d73051b2464c1cd56e134b773e8aa6f29150fe5371ecc12d246b58a5da8b0ac806e70ff796ced7f

Download Submit
C:\Windows\W_X_C.vbs

Filesize
195B

MD5
0e0483d4802632100b6bfe8bc2e5d661

SHA1
767e0deb7dcaa7676004e6053957c36cecfeeefa

SHA256
81bbebb8d0e77ffffbc7b7d24afdcdce4089f4b04d1a12284eda861c25e03f9f

SHA512
8279b0559ca30a0adc6c8614870c3e445866c20f0617a7153cab41982b451dfe9ea44478f37b884465235714623ef26a56f5ea3d1cb81767487c494d3703ab29

Download Submit
C:\Windows\hosts.exe

Filesize
179KB

MD5
ea5357cb9b78e4bbc0f46c1029d1a4a9

SHA1
01bced8cffb0178e5c67594de2a45eeeca35662e

SHA256
36d5207a1f42138fe0549f5ada66436ff45c41f63d3f3687c3b1e7247c5d510c

SHA512
d7bee29373bf5d8b419d9b1b54ff4915e731bdd8e15fafb65ffc93c0c9ac0d7ba31d01021370b85ee8676d32616f3bba2f44a5188731420a341296ed01167585

Download Submit
C:\Windows\hosts.exe

Filesize
179KB

MD5
ea5357cb9b78e4bbc0f46c1029d1a4a9

SHA1
01bced8cffb0178e5c67594de2a45eeeca35662e

SHA256
36d5207a1f42138fe0549f5ada66436ff45c41f63d3f3687c3b1e7247c5d510c

SHA512
d7bee29373bf5d8b419d9b1b54ff4915e731bdd8e15fafb65ffc93c0c9ac0d7ba31d01021370b85ee8676d32616f3bba2f44a5188731420a341296ed01167585

Download Submit
C:\Windows\hosts.exe

Filesize
179KB

MD5
ea5357cb9b78e4bbc0f46c1029d1a4a9

SHA1
01bced8cffb0178e5c67594de2a45eeeca35662e

SHA256
36d5207a1f42138fe0549f5ada66436ff45c41f63d3f3687c3b1e7247c5d510c

SHA512
d7bee29373bf5d8b419d9b1b54ff4915e731bdd8e15fafb65ffc93c0c9ac0d7ba31d01021370b85ee8676d32616f3bba2f44a5188731420a341296ed01167585

Download Submit
C:\Windows\hosts.exe

Filesize
179KB

MD5
ea5357cb9b78e4bbc0f46c1029d1a4a9

SHA1
01bced8cffb0178e5c67594de2a45eeeca35662e

SHA256
36d5207a1f42138fe0549f5ada66436ff45c41f63d3f3687c3b1e7247c5d510c

SHA512
d7bee29373bf5d8b419d9b1b54ff4915e731bdd8e15fafb65ffc93c0c9ac0d7ba31d01021370b85ee8676d32616f3bba2f44a5188731420a341296ed01167585

Download Submit
C:\windows\hosts.exe

Filesize
179KB

MD5
ea5357cb9b78e4bbc0f46c1029d1a4a9

SHA1
01bced8cffb0178e5c67594de2a45eeeca35662e

SHA256
36d5207a1f42138fe0549f5ada66436ff45c41f63d3f3687c3b1e7247c5d510c

SHA512
d7bee29373bf5d8b419d9b1b54ff4915e731bdd8e15fafb65ffc93c0c9ac0d7ba31d01021370b85ee8676d32616f3bba2f44a5188731420a341296ed01167585

Download Submit
\??\c:\windows\W_X_C.bat

Filesize
336B

MD5
4db9f8b6175722b62ececeeeba1ce307

SHA1
3b3ba8414706e72a6fa19e884a97b87609e11e47

SHA256
d2150b9e5a4ce55e140f0ca91c4e300715d42095c8fddf58c77037cdd2cfaf78

SHA512
1d6dc274cf7a3dd704f840e6a5ad57ab4c4e35d5f09489aeff520bb797e1c825bac53fc335156fe41e767a46520d031855fe42fe7b175409ebe5e9e986fb9b8b

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads