74d065cb68f2227f628d1c0fe32fa6169742b30e31cd6e590c04ec4f6bdbaa06

Analysis

max time kernel
136s
max time network
130s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
06-11-2022 13:08

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

74d065cb68f2227f628d1c0fe32fa6169742b30e31cd6e590c04ec4f6bdbaa06.exe
Size

184KB
MD5

0d3cdfe1e28e154dd45e5352c7ee4c4b
SHA1

544caea70a385753381554a299924960fc77b668
SHA256

74d065cb68f2227f628d1c0fe32fa6169742b30e31cd6e590c04ec4f6bdbaa06
SHA512

026712e5fcda55f89acb2d900d070e7eb02f54f47bfa95a7e53f3c7091bb12af1467820879137da6167bcd60495615f9b263691bad5154de8ff53c6c1a297b85
SSDEEP

3072:obpDCw1p3vmLvsZIaVwiwDcIbDHDCm/DELU31fIcPh3GFtD:gDCwfG1bnxLED24tD

Score

10^/10

evasion persistence

Malware Config

Signatures

Modifies visibility of file extensions in Explorer 2 TTPs 3 IoCs

evasion

Hidden Files and Directories

T1158

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	74d065cb68f2227f628d1c0fe32fa6169742b30e31cd6e590c04ec4f6bdbaa06.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	avscan.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	hosts.exe

Modifies visiblity of hidden/system files in Explorer 2 TTPs 3 IoCs

evasion

Hidden Files and Directories

T1158

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	74d065cb68f2227f628d1c0fe32fa6169742b30e31cd6e590c04ec4f6bdbaa06.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	avscan.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	hosts.exe

Adds policy Run key to start application 2 TTPs 6 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	WScript.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\XZIOFAVD = "W_X_C.bat"	WScript.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	WScript.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\XZIOFAVD = "W_X_C.bat"	WScript.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\XZIOFAVD = "W_X_C.bat"	WScript.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	WScript.exe

Executes dropped EXE 6 IoCs

pid	Process
4908	avscan.exe
4940	avscan.exe
2124	hosts.exe
2312	hosts.exe
3600	avscan.exe
4056	hosts.exe

Checks computer location settings 2 TTPs 3 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\Geo\Nation	cmd.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\Geo\Nation	cmd.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\Geo\Nation	cmd.exe

Adds Run key to start application 2 TTPs 6 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run	hosts.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\avscan = "C:\\Users\\Admin\\AppData\\Local\\Temp\\avscan.exe"	hosts.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run	74d065cb68f2227f628d1c0fe32fa6169742b30e31cd6e590c04ec4f6bdbaa06.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\avscan = "C:\\Users\\Admin\\AppData\\Local\\Temp\\avscan.exe"	74d065cb68f2227f628d1c0fe32fa6169742b30e31cd6e590c04ec4f6bdbaa06.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run	avscan.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\avscan = "C:\\Users\\Admin\\AppData\\Local\\Temp\\avscan.exe"	avscan.exe

Drops file in Windows directory 5 IoCs

description	ioc	Process
File created	C:\windows\W_X_C.vbs	74d065cb68f2227f628d1c0fe32fa6169742b30e31cd6e590c04ec4f6bdbaa06.exe
File created	\??\c:\windows\W_X_C.bat	74d065cb68f2227f628d1c0fe32fa6169742b30e31cd6e590c04ec4f6bdbaa06.exe
File opened for modification	C:\Windows\hosts.exe	74d065cb68f2227f628d1c0fe32fa6169742b30e31cd6e590c04ec4f6bdbaa06.exe
File opened for modification	C:\Windows\hosts.exe	avscan.exe
File opened for modification	C:\Windows\hosts.exe	hosts.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies registry class 4 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000_Classes\Local Settings	74d065cb68f2227f628d1c0fe32fa6169742b30e31cd6e590c04ec4f6bdbaa06.exe
Key created	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000_Classes\Local Settings	cmd.exe

Modifies registry key 1 TTPs 9 IoCs

Modify Registry

T1112

pid	Process
2316	REG.exe
3484	REG.exe
4412	REG.exe
2872	REG.exe
3076	REG.exe
2472	REG.exe
3156	REG.exe
1592	REG.exe
3424	REG.exe

Suspicious behavior: GetForegroundWindowSpam 3 IoCs

pid	Process
3012	74d065cb68f2227f628d1c0fe32fa6169742b30e31cd6e590c04ec4f6bdbaa06.exe
4908	avscan.exe
2124	hosts.exe

Suspicious use of SetWindowsHookEx 7 IoCs

pid	Process
3012	74d065cb68f2227f628d1c0fe32fa6169742b30e31cd6e590c04ec4f6bdbaa06.exe
4908	avscan.exe
4940	avscan.exe
2124	hosts.exe
2312	hosts.exe
3600	avscan.exe
4056	hosts.exe

Suspicious use of WriteProcessMemory 63 IoCs

description	pid	Process	procid_target
PID 3012 wrote to memory of 2872	3012	74d065cb68f2227f628d1c0fe32fa6169742b30e31cd6e590c04ec4f6bdbaa06.exe	78
PID 3012 wrote to memory of 2872	3012	74d065cb68f2227f628d1c0fe32fa6169742b30e31cd6e590c04ec4f6bdbaa06.exe	78
PID 3012 wrote to memory of 2872	3012	74d065cb68f2227f628d1c0fe32fa6169742b30e31cd6e590c04ec4f6bdbaa06.exe	78
PID 3012 wrote to memory of 4908	3012	74d065cb68f2227f628d1c0fe32fa6169742b30e31cd6e590c04ec4f6bdbaa06.exe	80
PID 3012 wrote to memory of 4908	3012	74d065cb68f2227f628d1c0fe32fa6169742b30e31cd6e590c04ec4f6bdbaa06.exe	80
PID 3012 wrote to memory of 4908	3012	74d065cb68f2227f628d1c0fe32fa6169742b30e31cd6e590c04ec4f6bdbaa06.exe	80
PID 4908 wrote to memory of 4940	4908	avscan.exe	81
PID 4908 wrote to memory of 4940	4908	avscan.exe	81
PID 4908 wrote to memory of 4940	4908	avscan.exe	81
PID 4908 wrote to memory of 2064	4908	avscan.exe	82
PID 4908 wrote to memory of 2064	4908	avscan.exe	82
PID 4908 wrote to memory of 2064	4908	avscan.exe	82
PID 3012 wrote to memory of 1256	3012	74d065cb68f2227f628d1c0fe32fa6169742b30e31cd6e590c04ec4f6bdbaa06.exe	84
PID 3012 wrote to memory of 1256	3012	74d065cb68f2227f628d1c0fe32fa6169742b30e31cd6e590c04ec4f6bdbaa06.exe	84
PID 3012 wrote to memory of 1256	3012	74d065cb68f2227f628d1c0fe32fa6169742b30e31cd6e590c04ec4f6bdbaa06.exe	84
PID 2064 wrote to memory of 2312	2064	cmd.exe	87
PID 2064 wrote to memory of 2312	2064	cmd.exe	87
PID 2064 wrote to memory of 2312	2064	cmd.exe	87
PID 1256 wrote to memory of 2124	1256	cmd.exe	86
PID 1256 wrote to memory of 2124	1256	cmd.exe	86
PID 1256 wrote to memory of 2124	1256	cmd.exe	86
PID 2124 wrote to memory of 3600	2124	hosts.exe	88
PID 2124 wrote to memory of 3600	2124	hosts.exe	88
PID 2124 wrote to memory of 3600	2124	hosts.exe	88
PID 2124 wrote to memory of 1888	2124	hosts.exe	89
PID 2124 wrote to memory of 1888	2124	hosts.exe	89
PID 2124 wrote to memory of 1888	2124	hosts.exe	89
PID 1888 wrote to memory of 4056	1888	cmd.exe	91
PID 1888 wrote to memory of 4056	1888	cmd.exe	91
PID 1888 wrote to memory of 4056	1888	cmd.exe	91
PID 2064 wrote to memory of 1232	2064	cmd.exe	93
PID 2064 wrote to memory of 1232	2064	cmd.exe	93
PID 2064 wrote to memory of 1232	2064	cmd.exe	93
PID 1888 wrote to memory of 4728	1888	cmd.exe	94
PID 1888 wrote to memory of 4728	1888	cmd.exe	94
PID 1888 wrote to memory of 4728	1888	cmd.exe	94
PID 1256 wrote to memory of 5080	1256	cmd.exe	92
PID 1256 wrote to memory of 5080	1256	cmd.exe	92
PID 1256 wrote to memory of 5080	1256	cmd.exe	92
PID 4908 wrote to memory of 3076	4908	avscan.exe	104
PID 4908 wrote to memory of 3076	4908	avscan.exe	104
PID 4908 wrote to memory of 3076	4908	avscan.exe	104
PID 2124 wrote to memory of 2316	2124	hosts.exe	106
PID 2124 wrote to memory of 2316	2124	hosts.exe	106
PID 2124 wrote to memory of 2316	2124	hosts.exe	106
PID 4908 wrote to memory of 3484	4908	avscan.exe	108
PID 4908 wrote to memory of 3484	4908	avscan.exe	108
PID 4908 wrote to memory of 3484	4908	avscan.exe	108
PID 2124 wrote to memory of 2472	2124	hosts.exe	110
PID 2124 wrote to memory of 2472	2124	hosts.exe	110
PID 2124 wrote to memory of 2472	2124	hosts.exe	110
PID 4908 wrote to memory of 3156	4908	avscan.exe	112
PID 4908 wrote to memory of 3156	4908	avscan.exe	112
PID 4908 wrote to memory of 3156	4908	avscan.exe	112
PID 2124 wrote to memory of 1592	2124	hosts.exe	114
PID 2124 wrote to memory of 1592	2124	hosts.exe	114
PID 2124 wrote to memory of 1592	2124	hosts.exe	114
PID 4908 wrote to memory of 4412	4908	avscan.exe	116
PID 4908 wrote to memory of 4412	4908	avscan.exe	116
PID 4908 wrote to memory of 4412	4908	avscan.exe	116
PID 2124 wrote to memory of 3424	2124	hosts.exe	118
PID 2124 wrote to memory of 3424	2124	hosts.exe	118
PID 2124 wrote to memory of 3424	2124	hosts.exe	118

C:\Users\Admin\AppData\Local\Temp\74d065cb68f2227f628d1c0fe32fa6169742b30e31cd6e590c04ec4f6bdbaa06.exe
"C:\Users\Admin\AppData\Local\Temp\74d065cb68f2227f628d1c0fe32fa6169742b30e31cd6e590c04ec4f6bdbaa06.exe"
1⤵
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- Adds Run key to start application
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3012
- C:\Windows\SysWOW64\REG.exe
  REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
  2⤵
  - Modifies registry key
  PID:2872
- C:\Users\Admin\AppData\Local\Temp\avscan.exe
  C:\Users\Admin\AppData\Local\Temp\avscan.exe
  2⤵
  - Modifies visibility of file extensions in Explorer
  - Modifies visiblity of hidden/system files in Explorer
  - Executes dropped EXE
  - Adds Run key to start application
  - Drops file in Windows directory
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4908
- - C:\Users\Admin\AppData\Local\Temp\avscan.exe
    C:\Users\Admin\AppData\Local\Temp\avscan.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:4940
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c c:\windows\W_X_C.bat
    3⤵
    - Checks computer location settings
    - Modifies registry class
    - Suspicious use of WriteProcessMemory
    PID:2064
  - - C:\windows\hosts.exe
      C:\windows\hosts.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2312
  - - C:\Windows\SysWOW64\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Windows\W_X_C.vbs"
      4⤵
      Adds policy Run key to start application
      PID:1232
- - C:\Windows\SysWOW64\REG.exe
    REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
    3⤵
    - Modifies registry key
    PID:3076
- - C:\Windows\SysWOW64\REG.exe
    REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
    3⤵
    - Modifies registry key
    PID:3484
- - C:\Windows\SysWOW64\REG.exe
    REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
    3⤵
    - Modifies registry key
    PID:3156
- - C:\Windows\SysWOW64\REG.exe
    REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
    3⤵
    - Modifies registry key
    PID:4412
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c c:\windows\W_X_C.bat
  2⤵
  - Checks computer location settings
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:1256
- - C:\windows\hosts.exe
    C:\windows\hosts.exe
    3⤵
    - Modifies visibility of file extensions in Explorer
    - Modifies visiblity of hidden/system files in Explorer
    - Executes dropped EXE
    - Adds Run key to start application
    - Drops file in Windows directory
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2124
  - - C:\Users\Admin\AppData\Local\Temp\avscan.exe
      C:\Users\Admin\AppData\Local\Temp\avscan.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3600
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c c:\windows\W_X_C.bat
      4⤵
      Checks computer location settings
      Modifies registry class
      Suspicious use of WriteProcessMemory
      PID:1888
    - - C:\windows\hosts.exe
        
        C:\windows\hosts.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4056
    - - C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Windows\W_X_C.vbs"
        5⤵
        Adds policy Run key to start application
        
        PID:4728
  - - C:\Windows\SysWOW64\REG.exe
      REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
      4⤵
      Modifies registry key
      PID:2316
  - - C:\Windows\SysWOW64\REG.exe
      REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
      4⤵
      Modifies registry key
      PID:2472
  - - C:\Windows\SysWOW64\REG.exe
      REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
      4⤵
      Modifies registry key
      PID:1592
  - - C:\Windows\SysWOW64\REG.exe
      REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
      4⤵
      Modifies registry key
      PID:3424
- - C:\Windows\SysWOW64\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Windows\W_X_C.vbs"
    3⤵
    - Adds policy Run key to start application
    PID:5080

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4488

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Hidden Files and Directories

T1158

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Hidden Files and Directories

T1158

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\avscan.exe

Filesize
184KB

MD5
1b9f685e765e1911c350b5886fba5383

SHA1
988854c0b011ade19cca98c4d9384d00a7b1eb0e

SHA256
3cdb173c63f1b7033d8e5b9ed2559c4b6c46622e78448b60afc4b583acd38e40

SHA512
b25b3f0976b46cf813810b33477a472f8a2252d65ad77c0fb180cedafbafbf7d856d252b779d091810e6a1e5f532ef2a13935128c682d66e99ea5b1d219b8094

Download Submit
C:\Users\Admin\AppData\Local\Temp\avscan.exe

Filesize
184KB

MD5
1b9f685e765e1911c350b5886fba5383

SHA1
988854c0b011ade19cca98c4d9384d00a7b1eb0e

SHA256
3cdb173c63f1b7033d8e5b9ed2559c4b6c46622e78448b60afc4b583acd38e40

SHA512
b25b3f0976b46cf813810b33477a472f8a2252d65ad77c0fb180cedafbafbf7d856d252b779d091810e6a1e5f532ef2a13935128c682d66e99ea5b1d219b8094

Download Submit
C:\Users\Admin\AppData\Local\Temp\avscan.exe

Filesize
184KB

MD5
1b9f685e765e1911c350b5886fba5383

SHA1
988854c0b011ade19cca98c4d9384d00a7b1eb0e

SHA256
3cdb173c63f1b7033d8e5b9ed2559c4b6c46622e78448b60afc4b583acd38e40

SHA512
b25b3f0976b46cf813810b33477a472f8a2252d65ad77c0fb180cedafbafbf7d856d252b779d091810e6a1e5f532ef2a13935128c682d66e99ea5b1d219b8094

Download Submit
C:\Users\Admin\AppData\Local\Temp\avscan.exe

Filesize
184KB

MD5
1b9f685e765e1911c350b5886fba5383

SHA1
988854c0b011ade19cca98c4d9384d00a7b1eb0e

SHA256
3cdb173c63f1b7033d8e5b9ed2559c4b6c46622e78448b60afc4b583acd38e40

SHA512
b25b3f0976b46cf813810b33477a472f8a2252d65ad77c0fb180cedafbafbf7d856d252b779d091810e6a1e5f532ef2a13935128c682d66e99ea5b1d219b8094

Download Submit
C:\Windows\W_X_C.vbs

Filesize
195B

MD5
7fc0db81060e343fd209dc050b401f77

SHA1
08ce8975b023bf90c21b8e64cd54fdd39debce04

SHA256
4a21d378652d4291a6b9e88a1934ac51e9eccd5c9a42aa09076219301509367f

SHA512
e0d13ba3713707f7cb9be56240930a8f47d8c302e692b49dcb01f7bdf3e3475f829e1ead60ce6a5f98bed591be96456e9c3ef67bb27f88dc70343c1412e9de57

Download Submit
C:\Windows\hosts.exe

Filesize
184KB

MD5
8b74387c2e26ba3a75c1ac158e6a2e1d

SHA1
dcb412a0c07375bc776d30c211277aeb174f6ba6

SHA256
5c15e7e551c598cfa433abde64d4cbccf71398e11d940c1e56f77756b95a35ff

SHA512
3415daa721c2f22b936fd1356c2f5268a5f2797183397db3849c1b2bb17456cc09507d4bbb0ea5340b190b367266c996d9c49f2337e95db6c6982688b7637deb

Download Submit
C:\Windows\hosts.exe

Filesize
184KB

MD5
8b74387c2e26ba3a75c1ac158e6a2e1d

SHA1
dcb412a0c07375bc776d30c211277aeb174f6ba6

SHA256
5c15e7e551c598cfa433abde64d4cbccf71398e11d940c1e56f77756b95a35ff

SHA512
3415daa721c2f22b936fd1356c2f5268a5f2797183397db3849c1b2bb17456cc09507d4bbb0ea5340b190b367266c996d9c49f2337e95db6c6982688b7637deb

Download Submit
C:\Windows\hosts.exe

Filesize
184KB

MD5
8b74387c2e26ba3a75c1ac158e6a2e1d

SHA1
dcb412a0c07375bc776d30c211277aeb174f6ba6

SHA256
5c15e7e551c598cfa433abde64d4cbccf71398e11d940c1e56f77756b95a35ff

SHA512
3415daa721c2f22b936fd1356c2f5268a5f2797183397db3849c1b2bb17456cc09507d4bbb0ea5340b190b367266c996d9c49f2337e95db6c6982688b7637deb

Download Submit
C:\Windows\hosts.exe

Filesize
184KB

MD5
8b74387c2e26ba3a75c1ac158e6a2e1d

SHA1
dcb412a0c07375bc776d30c211277aeb174f6ba6

SHA256
5c15e7e551c598cfa433abde64d4cbccf71398e11d940c1e56f77756b95a35ff

SHA512
3415daa721c2f22b936fd1356c2f5268a5f2797183397db3849c1b2bb17456cc09507d4bbb0ea5340b190b367266c996d9c49f2337e95db6c6982688b7637deb

Download Submit
C:\windows\hosts.exe

Filesize
184KB

MD5
8b74387c2e26ba3a75c1ac158e6a2e1d

SHA1
dcb412a0c07375bc776d30c211277aeb174f6ba6

SHA256
5c15e7e551c598cfa433abde64d4cbccf71398e11d940c1e56f77756b95a35ff

SHA512
3415daa721c2f22b936fd1356c2f5268a5f2797183397db3849c1b2bb17456cc09507d4bbb0ea5340b190b367266c996d9c49f2337e95db6c6982688b7637deb

Download Submit
\??\c:\windows\W_X_C.bat

Filesize
336B

MD5
4db9f8b6175722b62ececeeeba1ce307

SHA1
3b3ba8414706e72a6fa19e884a97b87609e11e47

SHA256
d2150b9e5a4ce55e140f0ca91c4e300715d42095c8fddf58c77037cdd2cfaf78

SHA512
1d6dc274cf7a3dd704f840e6a5ad57ab4c4e35d5f09489aeff520bb797e1c825bac53fc335156fe41e767a46520d031855fe42fe7b175409ebe5e9e986fb9b8b

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads