74d065cb68f2227f628d1c0fe32fa6169742b30e31cd6e590c04ec4f6bdbaa06

Analysis

max time kernel
133s
max time network
42s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
06-11-2022 13:08

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

74d065cb68f2227f628d1c0fe32fa6169742b30e31cd6e590c04ec4f6bdbaa06.exe
Size

184KB
MD5

0d3cdfe1e28e154dd45e5352c7ee4c4b
SHA1

544caea70a385753381554a299924960fc77b668
SHA256

74d065cb68f2227f628d1c0fe32fa6169742b30e31cd6e590c04ec4f6bdbaa06
SHA512

026712e5fcda55f89acb2d900d070e7eb02f54f47bfa95a7e53f3c7091bb12af1467820879137da6167bcd60495615f9b263691bad5154de8ff53c6c1a297b85
SSDEEP

3072:obpDCw1p3vmLvsZIaVwiwDcIbDHDCm/DELU31fIcPh3GFtD:gDCwfG1bnxLED24tD

Score

10^/10

evasion persistence

Malware Config

Signatures

Modifies visibility of file extensions in Explorer 2 TTPs 3 IoCs

evasion

Hidden Files and Directories

T1158

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	74d065cb68f2227f628d1c0fe32fa6169742b30e31cd6e590c04ec4f6bdbaa06.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	avscan.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	hosts.exe

Modifies visiblity of hidden/system files in Explorer 2 TTPs 3 IoCs

evasion

Hidden Files and Directories

T1158

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	74d065cb68f2227f628d1c0fe32fa6169742b30e31cd6e590c04ec4f6bdbaa06.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	avscan.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	hosts.exe

Adds policy Run key to start application 2 TTPs 6 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\ORXGKKZC = "W_X_C.bat"	WScript.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	WScript.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\ORXGKKZC = "W_X_C.bat"	WScript.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	WScript.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\ORXGKKZC = "W_X_C.bat"	WScript.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	WScript.exe

Executes dropped EXE 6 IoCs

pid	Process
1696	avscan.exe
848	avscan.exe
972	hosts.exe
1704	hosts.exe
1400	avscan.exe
1328	hosts.exe

Loads dropped DLL 5 IoCs

pid	Process
2036	74d065cb68f2227f628d1c0fe32fa6169742b30e31cd6e590c04ec4f6bdbaa06.exe
2036	74d065cb68f2227f628d1c0fe32fa6169742b30e31cd6e590c04ec4f6bdbaa06.exe
1696	avscan.exe
1704	hosts.exe
1704	hosts.exe

Adds Run key to start application 2 TTPs 6 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\avscan = "C:\\Users\\Admin\\AppData\\Local\\Temp\\avscan.exe"	74d065cb68f2227f628d1c0fe32fa6169742b30e31cd6e590c04ec4f6bdbaa06.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run	avscan.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\avscan = "C:\\Users\\Admin\\AppData\\Local\\Temp\\avscan.exe"	avscan.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run	hosts.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\avscan = "C:\\Users\\Admin\\AppData\\Local\\Temp\\avscan.exe"	hosts.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run	74d065cb68f2227f628d1c0fe32fa6169742b30e31cd6e590c04ec4f6bdbaa06.exe

Drops file in Windows directory 5 IoCs

description	ioc	Process
File opened for modification	C:\Windows\hosts.exe	avscan.exe
File opened for modification	C:\Windows\hosts.exe	hosts.exe
File created	C:\windows\W_X_C.vbs	74d065cb68f2227f628d1c0fe32fa6169742b30e31cd6e590c04ec4f6bdbaa06.exe
File created	\??\c:\windows\W_X_C.bat	74d065cb68f2227f628d1c0fe32fa6169742b30e31cd6e590c04ec4f6bdbaa06.exe
File opened for modification	C:\Windows\hosts.exe	74d065cb68f2227f628d1c0fe32fa6169742b30e31cd6e590c04ec4f6bdbaa06.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies registry key 1 TTPs 9 IoCs

Modify Registry

T1112

pid	Process
1464	REG.exe
428	REG.exe
832	REG.exe
1576	REG.exe
1652	REG.exe
1596	REG.exe
2040	REG.exe
2020	REG.exe
360	REG.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

pid	Process
1696	avscan.exe
1704	hosts.exe

Suspicious use of SetWindowsHookEx 7 IoCs

pid	Process
2036	74d065cb68f2227f628d1c0fe32fa6169742b30e31cd6e590c04ec4f6bdbaa06.exe
1696	avscan.exe
848	avscan.exe
1704	hosts.exe
972	hosts.exe
1400	avscan.exe
1328	hosts.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2036 wrote to memory of 2040	2036	74d065cb68f2227f628d1c0fe32fa6169742b30e31cd6e590c04ec4f6bdbaa06.exe	27
PID 2036 wrote to memory of 2040	2036	74d065cb68f2227f628d1c0fe32fa6169742b30e31cd6e590c04ec4f6bdbaa06.exe	27
PID 2036 wrote to memory of 2040	2036	74d065cb68f2227f628d1c0fe32fa6169742b30e31cd6e590c04ec4f6bdbaa06.exe	27
PID 2036 wrote to memory of 2040	2036	74d065cb68f2227f628d1c0fe32fa6169742b30e31cd6e590c04ec4f6bdbaa06.exe	27
PID 2036 wrote to memory of 1696	2036	74d065cb68f2227f628d1c0fe32fa6169742b30e31cd6e590c04ec4f6bdbaa06.exe	29
PID 2036 wrote to memory of 1696	2036	74d065cb68f2227f628d1c0fe32fa6169742b30e31cd6e590c04ec4f6bdbaa06.exe	29
PID 2036 wrote to memory of 1696	2036	74d065cb68f2227f628d1c0fe32fa6169742b30e31cd6e590c04ec4f6bdbaa06.exe	29
PID 2036 wrote to memory of 1696	2036	74d065cb68f2227f628d1c0fe32fa6169742b30e31cd6e590c04ec4f6bdbaa06.exe	29
PID 1696 wrote to memory of 848	1696	avscan.exe	30
PID 1696 wrote to memory of 848	1696	avscan.exe	30
PID 1696 wrote to memory of 848	1696	avscan.exe	30
PID 1696 wrote to memory of 848	1696	avscan.exe	30
PID 1696 wrote to memory of 1820	1696	avscan.exe	31
PID 1696 wrote to memory of 1820	1696	avscan.exe	31
PID 1696 wrote to memory of 1820	1696	avscan.exe	31
PID 1696 wrote to memory of 1820	1696	avscan.exe	31
PID 2036 wrote to memory of 1332	2036	74d065cb68f2227f628d1c0fe32fa6169742b30e31cd6e590c04ec4f6bdbaa06.exe	32
PID 2036 wrote to memory of 1332	2036	74d065cb68f2227f628d1c0fe32fa6169742b30e31cd6e590c04ec4f6bdbaa06.exe	32
PID 2036 wrote to memory of 1332	2036	74d065cb68f2227f628d1c0fe32fa6169742b30e31cd6e590c04ec4f6bdbaa06.exe	32
PID 2036 wrote to memory of 1332	2036	74d065cb68f2227f628d1c0fe32fa6169742b30e31cd6e590c04ec4f6bdbaa06.exe	32
PID 1820 wrote to memory of 972	1820	cmd.exe	35
PID 1820 wrote to memory of 972	1820	cmd.exe	35
PID 1820 wrote to memory of 972	1820	cmd.exe	35
PID 1820 wrote to memory of 972	1820	cmd.exe	35
PID 1332 wrote to memory of 1704	1332	cmd.exe	36
PID 1332 wrote to memory of 1704	1332	cmd.exe	36
PID 1332 wrote to memory of 1704	1332	cmd.exe	36
PID 1332 wrote to memory of 1704	1332	cmd.exe	36
PID 1704 wrote to memory of 1400	1704	hosts.exe	37
PID 1704 wrote to memory of 1400	1704	hosts.exe	37
PID 1704 wrote to memory of 1400	1704	hosts.exe	37
PID 1704 wrote to memory of 1400	1704	hosts.exe	37
PID 1820 wrote to memory of 1756	1820	cmd.exe	39
PID 1820 wrote to memory of 1756	1820	cmd.exe	39
PID 1820 wrote to memory of 1756	1820	cmd.exe	39
PID 1820 wrote to memory of 1756	1820	cmd.exe	39
PID 1332 wrote to memory of 1292	1332	cmd.exe	38
PID 1332 wrote to memory of 1292	1332	cmd.exe	38
PID 1332 wrote to memory of 1292	1332	cmd.exe	38
PID 1332 wrote to memory of 1292	1332	cmd.exe	38
PID 1704 wrote to memory of 700	1704	hosts.exe	40
PID 1704 wrote to memory of 700	1704	hosts.exe	40
PID 1704 wrote to memory of 700	1704	hosts.exe	40
PID 1704 wrote to memory of 700	1704	hosts.exe	40
PID 700 wrote to memory of 1328	700	cmd.exe	42
PID 700 wrote to memory of 1328	700	cmd.exe	42
PID 700 wrote to memory of 1328	700	cmd.exe	42
PID 700 wrote to memory of 1328	700	cmd.exe	42
PID 700 wrote to memory of 1684	700	cmd.exe	43
PID 700 wrote to memory of 1684	700	cmd.exe	43
PID 700 wrote to memory of 1684	700	cmd.exe	43
PID 700 wrote to memory of 1684	700	cmd.exe	43
PID 1696 wrote to memory of 2020	1696	avscan.exe	44
PID 1696 wrote to memory of 2020	1696	avscan.exe	44
PID 1696 wrote to memory of 2020	1696	avscan.exe	44
PID 1696 wrote to memory of 2020	1696	avscan.exe	44
PID 1704 wrote to memory of 832	1704	hosts.exe	46
PID 1704 wrote to memory of 832	1704	hosts.exe	46
PID 1704 wrote to memory of 832	1704	hosts.exe	46
PID 1704 wrote to memory of 832	1704	hosts.exe	46
PID 1696 wrote to memory of 1576	1696	avscan.exe	48
PID 1696 wrote to memory of 1576	1696	avscan.exe	48
PID 1696 wrote to memory of 1576	1696	avscan.exe	48
PID 1696 wrote to memory of 1576	1696	avscan.exe	48

C:\Users\Admin\AppData\Local\Temp\74d065cb68f2227f628d1c0fe32fa6169742b30e31cd6e590c04ec4f6bdbaa06.exe
"C:\Users\Admin\AppData\Local\Temp\74d065cb68f2227f628d1c0fe32fa6169742b30e31cd6e590c04ec4f6bdbaa06.exe"
1⤵
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- Loads dropped DLL
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2036
- C:\Windows\SysWOW64\REG.exe
  REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
  2⤵
  - Modifies registry key
  PID:2040
- C:\Users\Admin\AppData\Local\Temp\avscan.exe
  C:\Users\Admin\AppData\Local\Temp\avscan.exe
  2⤵
  - Modifies visibility of file extensions in Explorer
  - Modifies visiblity of hidden/system files in Explorer
  - Executes dropped EXE
  - Loads dropped DLL
  - Adds Run key to start application
  - Drops file in Windows directory
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1696
- - C:\Users\Admin\AppData\Local\Temp\avscan.exe
    C:\Users\Admin\AppData\Local\Temp\avscan.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:848
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c c:\windows\W_X_C.bat
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1820
  - - C:\windows\hosts.exe
      C:\windows\hosts.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:972
  - - C:\Windows\SysWOW64\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Windows\W_X_C.vbs"
      4⤵
      Adds policy Run key to start application
      PID:1756
- - C:\Windows\SysWOW64\REG.exe
    REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
    3⤵
    - Modifies registry key
    PID:2020
- - C:\Windows\SysWOW64\REG.exe
    REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
    3⤵
    - Modifies registry key
    PID:1576
- - C:\Windows\SysWOW64\REG.exe
    REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
    3⤵
    - Modifies registry key
    PID:1464
- - C:\Windows\SysWOW64\REG.exe
    REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
    3⤵
    - Modifies registry key
    PID:1596
- C:\Windows\SysWOW64\cmd.exe
  cmd /c c:\windows\W_X_C.bat
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1332
- - C:\windows\hosts.exe
    C:\windows\hosts.exe
    3⤵
    - Modifies visibility of file extensions in Explorer
    - Modifies visiblity of hidden/system files in Explorer
    - Executes dropped EXE
    - Loads dropped DLL
    - Adds Run key to start application
    - Drops file in Windows directory
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:1704
  - - C:\Users\Admin\AppData\Local\Temp\avscan.exe
      C:\Users\Admin\AppData\Local\Temp\avscan.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1400
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c c:\windows\W_X_C.bat
      4⤵
      Suspicious use of WriteProcessMemory
      PID:700
    - - C:\windows\hosts.exe
        
        C:\windows\hosts.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1328
    - - C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Windows\W_X_C.vbs"
        5⤵
        Adds policy Run key to start application
        
        PID:1684
  - - C:\Windows\SysWOW64\REG.exe
      REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
      4⤵
      Modifies registry key
      PID:832
  - - C:\Windows\SysWOW64\REG.exe
      REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
      4⤵
      Modifies registry key
      PID:1652
  - - C:\Windows\SysWOW64\REG.exe
      REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
      4⤵
      Modifies registry key
      PID:360
  - - C:\Windows\SysWOW64\REG.exe
      REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
      4⤵
      Modifies registry key
      PID:428
- - C:\Windows\SysWOW64\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Windows\W_X_C.vbs"
    3⤵
    - Adds policy Run key to start application
    PID:1292

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Hidden Files and Directories

T1158

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Hidden Files and Directories

T1158

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Admin.bmp

Filesize
416KB

MD5
b8e44e7ca086e7834a4f9f4c4f711ed3

SHA1
aedb64fdaf6aa8aea1a180c0ee0ca5228b770905

SHA256
7301256b8dfdd1e8b3c2c6610dc1da827a89609a97a3db1aa40e0b3042ba3778

SHA512
29d3973da2127ee0d03042f93ab847359e68cbd0ff10644426709f49de2d4795d05c409fdd486429b7489d6b5500588b940df3e06d62af18c1792144c13d4eae

Download Submit
C:\Users\Admin\AppData\Local\Temp\Admin.bmp

Filesize
600KB

MD5
d453b845bb9ddcf44d0d3b926119c669

SHA1
e15b9bfc4430cecca7d0aa55222bdf0ce02a833a

SHA256
d03a80556e2120a6e5056a0f590c34ef95a1bb848e35b147f1cb9a16a3ed8d13

SHA512
49951eb69c11e163c4245e9e8f24d6c46ab4fea4316dd3268f46ce08e18e6f69a5451f6bf5dfd57e4db72ea3551eccdcc237b84b24453ea1851c8c0ec480492a

Download Submit
C:\Users\Admin\AppData\Local\Temp\Admin.bmp

Filesize
784KB

MD5
12f5b4dc7649982c0bdc8e38c14f10d5

SHA1
f0ca8439d80f67a00aed644e8f251b60a3ebf186

SHA256
dbefa0e070acca6ca28219b3461eba83dabf4d97fc24ddad26b2dc841ffbf749

SHA512
a624df6c07d20e8fbc7deebc71fe9a30635da2e9bf4904810d30ca8e8ffea9fb62b0e792f8c29e6a2c333ada9827d7bde247b01333dce5cb9af21a1a50423ac8

Download Submit
C:\Users\Admin\AppData\Local\Temp\Admin.bmp

Filesize
968KB

MD5
a47886598f053f1aefd97b88c25de927

SHA1
5d84d2c7554ab77d045e141c06a68b4dc23adb43

SHA256
07d17984cc297ef8ec2d5a0640c59c711023f0345d46aeed939ea577565c84be

SHA512
804808430c9fdc730374736cbec854e7a83558ee189fc2881778d2526c9e45d976b3d95805bcc0ecf60be2c492259d4af52ab900a27049144e1f3b35792d6319

Download Submit
C:\Users\Admin\AppData\Local\Temp\Admin.bmp

Filesize
1.1MB

MD5
2cf0893469a2b46fed31c44adf139367

SHA1
5120b55a5f2c86e19f9cf7691a4de30cfeb925ba

SHA256
676a6809fb81745c00667e0794e2f50da9c24a96b08e36fb447ce7561273363e

SHA512
6442ef541a8fdcafd9a9c92d24f8e7a7c7941325c6604514f3e0fa4329360f5ccaf223ed4507f41d1e4ae5912e83bd01f14c1abd70d663017b45c4092d1b0ed5

Download Submit
C:\Users\Admin\AppData\Local\Temp\Admin.bmp

Filesize
1.3MB

MD5
743dc80a7cded35f2144d8fd66638993

SHA1
1201d73973dd23499169159fe55b11d43a8eec13

SHA256
2631d82b8094d9b1c9c07bad7c4bb51d359c2c4977463680d5df6d02b54adc0d

SHA512
f0e5d5fd32ddf2a77683d79df611627223415bfe538c25bc7a0ff560502693d4658be6fe263a067d6a3986ee3c5f3a0b2b898dc92b9d02e3534305b895a36fc4

Download Submit
C:\Users\Admin\AppData\Local\Temp\Admin.bmp

Filesize
1.5MB

MD5
78633362d2c948f229e793c51c5033d2

SHA1
14b9fef3dd11d18d982d6310ef4d7989706e6af0

SHA256
e865085eb042a183bd62b8c42c6286f23a95f43375a7a2a7443ba9d183b2d757

SHA512
2bdec8d6663595ca408c05da0338073ad70e2ee7375ad44dd60fb2dfc09f9fdc30c7ca025169c9387bfdd73ebaf20515afb855cdfbbcfa24502fb0c324449dcc

Download Submit
C:\Users\Admin\AppData\Local\Temp\avscan.exe

Filesize
184KB

MD5
c125851ad65161f1dd31b4fdeb4be1c7

SHA1
eda478a8156e46f0268236bdeec11c6dc0afb767

SHA256
8ddd3cf584d6b615e250c91d945f465758f077f535f47d1ff41fe6a851e592ce

SHA512
05fc54af08ed560339a7851d9adfd2acc8f9b3a9421fa140f203bfc69645f47197204eb096820629aed3e50a9b697015f5b4a85d0425b03c75bbb7a5dfaf8ad3

Download Submit
C:\Users\Admin\AppData\Local\Temp\avscan.exe

Filesize
184KB

MD5
c125851ad65161f1dd31b4fdeb4be1c7

SHA1
eda478a8156e46f0268236bdeec11c6dc0afb767

SHA256
8ddd3cf584d6b615e250c91d945f465758f077f535f47d1ff41fe6a851e592ce

SHA512
05fc54af08ed560339a7851d9adfd2acc8f9b3a9421fa140f203bfc69645f47197204eb096820629aed3e50a9b697015f5b4a85d0425b03c75bbb7a5dfaf8ad3

Download Submit
C:\Users\Admin\AppData\Local\Temp\avscan.exe

Filesize
184KB

MD5
c125851ad65161f1dd31b4fdeb4be1c7

SHA1
eda478a8156e46f0268236bdeec11c6dc0afb767

SHA256
8ddd3cf584d6b615e250c91d945f465758f077f535f47d1ff41fe6a851e592ce

SHA512
05fc54af08ed560339a7851d9adfd2acc8f9b3a9421fa140f203bfc69645f47197204eb096820629aed3e50a9b697015f5b4a85d0425b03c75bbb7a5dfaf8ad3

Download Submit
C:\Users\Admin\AppData\Local\Temp\avscan.exe

Filesize
184KB

MD5
c125851ad65161f1dd31b4fdeb4be1c7

SHA1
eda478a8156e46f0268236bdeec11c6dc0afb767

SHA256
8ddd3cf584d6b615e250c91d945f465758f077f535f47d1ff41fe6a851e592ce

SHA512
05fc54af08ed560339a7851d9adfd2acc8f9b3a9421fa140f203bfc69645f47197204eb096820629aed3e50a9b697015f5b4a85d0425b03c75bbb7a5dfaf8ad3

Download Submit
C:\Windows\W_X_C.vbs

Filesize
195B

MD5
6cb1a862c5d3015502be64b07c6b5ec7

SHA1
055b4b97bd55f4f0f47fd8c981fc216709e91936

SHA256
6ae3ae6c1d057e9376efd0711d9912dfddebd9f8a8b257cee104cba98195c48e

SHA512
5f8f0cdbbd70f06bc8783c0e762208a3c54daf0f2b064abd450116cb31963d0802bc59648e868d647031e0e321d151a20f1b71ccba613f6e1c0c7fbb7ee974ab

Download Submit
C:\Windows\hosts.exe

Filesize
184KB

MD5
82d79b06d0122f8bf017003250f85c01

SHA1
cb5fb77483fa0123ebb655b5ec8f3cb874d618f1

SHA256
82decf01e33dd402eff8f1c2d83e3c55d74dc379e10553ceda5bcc6e9f77b1fa

SHA512
0c202cd44628b6be0636010e5de2c800418784b2057af3c9d6d8af8bf1e9bc672387ca3eab74affb3b77d38c6415a9231f41eb45fb8e544d5d96131ab1245010

Download Submit
C:\Windows\hosts.exe

Filesize
184KB

MD5
82d79b06d0122f8bf017003250f85c01

SHA1
cb5fb77483fa0123ebb655b5ec8f3cb874d618f1

SHA256
82decf01e33dd402eff8f1c2d83e3c55d74dc379e10553ceda5bcc6e9f77b1fa

SHA512
0c202cd44628b6be0636010e5de2c800418784b2057af3c9d6d8af8bf1e9bc672387ca3eab74affb3b77d38c6415a9231f41eb45fb8e544d5d96131ab1245010

Download Submit
C:\Windows\hosts.exe

Filesize
184KB

MD5
82d79b06d0122f8bf017003250f85c01

SHA1
cb5fb77483fa0123ebb655b5ec8f3cb874d618f1

SHA256
82decf01e33dd402eff8f1c2d83e3c55d74dc379e10553ceda5bcc6e9f77b1fa

SHA512
0c202cd44628b6be0636010e5de2c800418784b2057af3c9d6d8af8bf1e9bc672387ca3eab74affb3b77d38c6415a9231f41eb45fb8e544d5d96131ab1245010

Download Submit
C:\Windows\hosts.exe

Filesize
184KB

MD5
82d79b06d0122f8bf017003250f85c01

SHA1
cb5fb77483fa0123ebb655b5ec8f3cb874d618f1

SHA256
82decf01e33dd402eff8f1c2d83e3c55d74dc379e10553ceda5bcc6e9f77b1fa

SHA512
0c202cd44628b6be0636010e5de2c800418784b2057af3c9d6d8af8bf1e9bc672387ca3eab74affb3b77d38c6415a9231f41eb45fb8e544d5d96131ab1245010

Download Submit
C:\windows\hosts.exe

Filesize
184KB

MD5
82d79b06d0122f8bf017003250f85c01

SHA1
cb5fb77483fa0123ebb655b5ec8f3cb874d618f1

SHA256
82decf01e33dd402eff8f1c2d83e3c55d74dc379e10553ceda5bcc6e9f77b1fa

SHA512
0c202cd44628b6be0636010e5de2c800418784b2057af3c9d6d8af8bf1e9bc672387ca3eab74affb3b77d38c6415a9231f41eb45fb8e544d5d96131ab1245010

Download Submit
\??\c:\windows\W_X_C.bat

Filesize
336B

MD5
4db9f8b6175722b62ececeeeba1ce307

SHA1
3b3ba8414706e72a6fa19e884a97b87609e11e47

SHA256
d2150b9e5a4ce55e140f0ca91c4e300715d42095c8fddf58c77037cdd2cfaf78

SHA512
1d6dc274cf7a3dd704f840e6a5ad57ab4c4e35d5f09489aeff520bb797e1c825bac53fc335156fe41e767a46520d031855fe42fe7b175409ebe5e9e986fb9b8b

Download Submit
\Users\Admin\AppData\Local\Temp\avscan.exe

Filesize
184KB

MD5
c125851ad65161f1dd31b4fdeb4be1c7

SHA1
eda478a8156e46f0268236bdeec11c6dc0afb767

SHA256
8ddd3cf584d6b615e250c91d945f465758f077f535f47d1ff41fe6a851e592ce

SHA512
05fc54af08ed560339a7851d9adfd2acc8f9b3a9421fa140f203bfc69645f47197204eb096820629aed3e50a9b697015f5b4a85d0425b03c75bbb7a5dfaf8ad3

Download Submit
\Users\Admin\AppData\Local\Temp\avscan.exe

Filesize
184KB

MD5
c125851ad65161f1dd31b4fdeb4be1c7

SHA1
eda478a8156e46f0268236bdeec11c6dc0afb767

SHA256
8ddd3cf584d6b615e250c91d945f465758f077f535f47d1ff41fe6a851e592ce

SHA512
05fc54af08ed560339a7851d9adfd2acc8f9b3a9421fa140f203bfc69645f47197204eb096820629aed3e50a9b697015f5b4a85d0425b03c75bbb7a5dfaf8ad3

Download Submit
\Users\Admin\AppData\Local\Temp\avscan.exe

Filesize
184KB

MD5
c125851ad65161f1dd31b4fdeb4be1c7

SHA1
eda478a8156e46f0268236bdeec11c6dc0afb767

SHA256
8ddd3cf584d6b615e250c91d945f465758f077f535f47d1ff41fe6a851e592ce

SHA512
05fc54af08ed560339a7851d9adfd2acc8f9b3a9421fa140f203bfc69645f47197204eb096820629aed3e50a9b697015f5b4a85d0425b03c75bbb7a5dfaf8ad3

Download Submit
\Users\Admin\AppData\Local\Temp\avscan.exe

Filesize
184KB

MD5
c125851ad65161f1dd31b4fdeb4be1c7

SHA1
eda478a8156e46f0268236bdeec11c6dc0afb767

SHA256
8ddd3cf584d6b615e250c91d945f465758f077f535f47d1ff41fe6a851e592ce

SHA512
05fc54af08ed560339a7851d9adfd2acc8f9b3a9421fa140f203bfc69645f47197204eb096820629aed3e50a9b697015f5b4a85d0425b03c75bbb7a5dfaf8ad3

Download Submit
\Users\Admin\AppData\Local\Temp\avscan.exe

Filesize
184KB

MD5
c125851ad65161f1dd31b4fdeb4be1c7

SHA1
eda478a8156e46f0268236bdeec11c6dc0afb767

SHA256
8ddd3cf584d6b615e250c91d945f465758f077f535f47d1ff41fe6a851e592ce

SHA512
05fc54af08ed560339a7851d9adfd2acc8f9b3a9421fa140f203bfc69645f47197204eb096820629aed3e50a9b697015f5b4a85d0425b03c75bbb7a5dfaf8ad3

Download Submit
memory/2036-58-0x0000000074141000-0x0000000074143000-memory.dmp

Filesize
8KB

Download
memory/2036-56-0x0000000075C61000-0x0000000075C63000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads