6811e301ae138c11b7672ff3290f199587404f77489ff0c87fa7d9baebe0da17

Analysis

max time kernel
160s
max time network
47s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
06-11-2022 13:08

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6811e301ae138c11b7672ff3290f199587404f77489ff0c87fa7d9baebe0da17.exe
Size

182KB
MD5

0d7674f0a25edca77e9f3c02e2e47704
SHA1

a511681b2d73fa86f001c79c6bc3533ec6c17625
SHA256

6811e301ae138c11b7672ff3290f199587404f77489ff0c87fa7d9baebe0da17
SHA512

cda7a9d997ed2daa126724afc243de66901ac4aed2688e7498b0fa708f7e99f90c5aab4131366500c2d40b4147de45a5a4cd6496c60d81afaebdf82265d03045
SSDEEP

3072:obpDCw1p3vmLvsZIaVwiwDcIbDHDCm/DER4eQ8Ob:gDCwfG1bnxLERRUb

Score

10^/10

evasion persistence

Malware Config

Signatures

Modifies visibility of file extensions in Explorer 2 TTPs 3 IoCs

evasion

Hidden Files and Directories

T1158

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	6811e301ae138c11b7672ff3290f199587404f77489ff0c87fa7d9baebe0da17.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	avscan.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	hosts.exe

Modifies visiblity of hidden/system files in Explorer 2 TTPs 3 IoCs

evasion

Hidden Files and Directories

T1158

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	avscan.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	hosts.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	6811e301ae138c11b7672ff3290f199587404f77489ff0c87fa7d9baebe0da17.exe

Adds policy Run key to start application 2 TTPs 6 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\ZERMMMDR = "W_X_C.bat"	WScript.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	WScript.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\ZERMMMDR = "W_X_C.bat"	WScript.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	WScript.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\ZERMMMDR = "W_X_C.bat"	WScript.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	WScript.exe

Executes dropped EXE 6 IoCs

pid	Process
1732	avscan.exe
2032	avscan.exe
1488	hosts.exe
1632	hosts.exe
672	avscan.exe
1952	hosts.exe

Loads dropped DLL 5 IoCs

pid	Process
1168	6811e301ae138c11b7672ff3290f199587404f77489ff0c87fa7d9baebe0da17.exe
1168	6811e301ae138c11b7672ff3290f199587404f77489ff0c87fa7d9baebe0da17.exe
1732	avscan.exe
1488	hosts.exe
1488	hosts.exe

Adds Run key to start application 2 TTPs 6 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run	hosts.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\avscan = "C:\\Users\\Admin\\AppData\\Local\\Temp\\avscan.exe"	hosts.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run	6811e301ae138c11b7672ff3290f199587404f77489ff0c87fa7d9baebe0da17.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\avscan = "C:\\Users\\Admin\\AppData\\Local\\Temp\\avscan.exe"	6811e301ae138c11b7672ff3290f199587404f77489ff0c87fa7d9baebe0da17.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run	avscan.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\avscan = "C:\\Users\\Admin\\AppData\\Local\\Temp\\avscan.exe"	avscan.exe

Drops file in Windows directory 5 IoCs

description	ioc	Process
File created	C:\windows\W_X_C.vbs	6811e301ae138c11b7672ff3290f199587404f77489ff0c87fa7d9baebe0da17.exe
File created	\??\c:\windows\W_X_C.bat	6811e301ae138c11b7672ff3290f199587404f77489ff0c87fa7d9baebe0da17.exe
File opened for modification	C:\Windows\hosts.exe	6811e301ae138c11b7672ff3290f199587404f77489ff0c87fa7d9baebe0da17.exe
File opened for modification	C:\Windows\hosts.exe	avscan.exe
File opened for modification	C:\Windows\hosts.exe	hosts.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies registry key 1 TTPs 9 IoCs

Modify Registry

T1112

pid	Process
1088	REG.exe
1932	REG.exe
112	REG.exe
2040	REG.exe
1548	REG.exe
1432	REG.exe
1076	REG.exe
2000	REG.exe
948	REG.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

pid	Process
1732	avscan.exe
1488	hosts.exe

Suspicious use of SetWindowsHookEx 7 IoCs

pid	Process
1168	6811e301ae138c11b7672ff3290f199587404f77489ff0c87fa7d9baebe0da17.exe
1732	avscan.exe
2032	avscan.exe
1632	hosts.exe
1488	hosts.exe
672	avscan.exe
1952	hosts.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1168 wrote to memory of 1932	1168	6811e301ae138c11b7672ff3290f199587404f77489ff0c87fa7d9baebe0da17.exe	27
PID 1168 wrote to memory of 1932	1168	6811e301ae138c11b7672ff3290f199587404f77489ff0c87fa7d9baebe0da17.exe	27
PID 1168 wrote to memory of 1932	1168	6811e301ae138c11b7672ff3290f199587404f77489ff0c87fa7d9baebe0da17.exe	27
PID 1168 wrote to memory of 1932	1168	6811e301ae138c11b7672ff3290f199587404f77489ff0c87fa7d9baebe0da17.exe	27
PID 1168 wrote to memory of 1732	1168	6811e301ae138c11b7672ff3290f199587404f77489ff0c87fa7d9baebe0da17.exe	29
PID 1168 wrote to memory of 1732	1168	6811e301ae138c11b7672ff3290f199587404f77489ff0c87fa7d9baebe0da17.exe	29
PID 1168 wrote to memory of 1732	1168	6811e301ae138c11b7672ff3290f199587404f77489ff0c87fa7d9baebe0da17.exe	29
PID 1168 wrote to memory of 1732	1168	6811e301ae138c11b7672ff3290f199587404f77489ff0c87fa7d9baebe0da17.exe	29
PID 1732 wrote to memory of 2032	1732	avscan.exe	30
PID 1732 wrote to memory of 2032	1732	avscan.exe	30
PID 1732 wrote to memory of 2032	1732	avscan.exe	30
PID 1732 wrote to memory of 2032	1732	avscan.exe	30
PID 1732 wrote to memory of 520	1732	avscan.exe	31
PID 1732 wrote to memory of 520	1732	avscan.exe	31
PID 1732 wrote to memory of 520	1732	avscan.exe	31
PID 1732 wrote to memory of 520	1732	avscan.exe	31
PID 1168 wrote to memory of 1456	1168	6811e301ae138c11b7672ff3290f199587404f77489ff0c87fa7d9baebe0da17.exe	33
PID 1168 wrote to memory of 1456	1168	6811e301ae138c11b7672ff3290f199587404f77489ff0c87fa7d9baebe0da17.exe	33
PID 1168 wrote to memory of 1456	1168	6811e301ae138c11b7672ff3290f199587404f77489ff0c87fa7d9baebe0da17.exe	33
PID 1168 wrote to memory of 1456	1168	6811e301ae138c11b7672ff3290f199587404f77489ff0c87fa7d9baebe0da17.exe	33
PID 520 wrote to memory of 1632	520	cmd.exe	36
PID 520 wrote to memory of 1632	520	cmd.exe	36
PID 520 wrote to memory of 1632	520	cmd.exe	36
PID 520 wrote to memory of 1632	520	cmd.exe	36
PID 1456 wrote to memory of 1488	1456	cmd.exe	35
PID 1456 wrote to memory of 1488	1456	cmd.exe	35
PID 1456 wrote to memory of 1488	1456	cmd.exe	35
PID 1456 wrote to memory of 1488	1456	cmd.exe	35
PID 1488 wrote to memory of 672	1488	hosts.exe	37
PID 1488 wrote to memory of 672	1488	hosts.exe	37
PID 1488 wrote to memory of 672	1488	hosts.exe	37
PID 1488 wrote to memory of 672	1488	hosts.exe	37
PID 1488 wrote to memory of 1816	1488	hosts.exe	38
PID 1488 wrote to memory of 1816	1488	hosts.exe	38
PID 1488 wrote to memory of 1816	1488	hosts.exe	38
PID 1488 wrote to memory of 1816	1488	hosts.exe	38
PID 1816 wrote to memory of 1952	1816	cmd.exe	42
PID 1816 wrote to memory of 1952	1816	cmd.exe	42
PID 1816 wrote to memory of 1952	1816	cmd.exe	42
PID 1816 wrote to memory of 1952	1816	cmd.exe	42
PID 1456 wrote to memory of 1208	1456	cmd.exe	41
PID 1456 wrote to memory of 1208	1456	cmd.exe	41
PID 1456 wrote to memory of 1208	1456	cmd.exe	41
PID 1456 wrote to memory of 1208	1456	cmd.exe	41
PID 1816 wrote to memory of 632	1816	cmd.exe	43
PID 1816 wrote to memory of 632	1816	cmd.exe	43
PID 1816 wrote to memory of 632	1816	cmd.exe	43
PID 1816 wrote to memory of 632	1816	cmd.exe	43
PID 520 wrote to memory of 1596	520	cmd.exe	40
PID 520 wrote to memory of 1596	520	cmd.exe	40
PID 520 wrote to memory of 1596	520	cmd.exe	40
PID 520 wrote to memory of 1596	520	cmd.exe	40
PID 1488 wrote to memory of 112	1488	hosts.exe	44
PID 1488 wrote to memory of 112	1488	hosts.exe	44
PID 1488 wrote to memory of 112	1488	hosts.exe	44
PID 1488 wrote to memory of 112	1488	hosts.exe	44
PID 1732 wrote to memory of 1076	1732	avscan.exe	45
PID 1732 wrote to memory of 1076	1732	avscan.exe	45
PID 1732 wrote to memory of 1076	1732	avscan.exe	45
PID 1732 wrote to memory of 1076	1732	avscan.exe	45
PID 1488 wrote to memory of 2040	1488	hosts.exe	48
PID 1488 wrote to memory of 2040	1488	hosts.exe	48
PID 1488 wrote to memory of 2040	1488	hosts.exe	48
PID 1488 wrote to memory of 2040	1488	hosts.exe	48

C:\Users\Admin\AppData\Local\Temp\6811e301ae138c11b7672ff3290f199587404f77489ff0c87fa7d9baebe0da17.exe
"C:\Users\Admin\AppData\Local\Temp\6811e301ae138c11b7672ff3290f199587404f77489ff0c87fa7d9baebe0da17.exe"
1⤵
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- Loads dropped DLL
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1168
- C:\Windows\SysWOW64\REG.exe
  REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
  2⤵
  - Modifies registry key
  PID:1932
- C:\Users\Admin\AppData\Local\Temp\avscan.exe
  C:\Users\Admin\AppData\Local\Temp\avscan.exe
  2⤵
  - Modifies visibility of file extensions in Explorer
  - Modifies visiblity of hidden/system files in Explorer
  - Executes dropped EXE
  - Loads dropped DLL
  - Adds Run key to start application
  - Drops file in Windows directory
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1732
- - C:\Users\Admin\AppData\Local\Temp\avscan.exe
    C:\Users\Admin\AppData\Local\Temp\avscan.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2032
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c c:\windows\W_X_C.bat
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:520
  - - C:\windows\hosts.exe
      C:\windows\hosts.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1632
  - - C:\Windows\SysWOW64\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Windows\W_X_C.vbs"
      4⤵
      Adds policy Run key to start application
      PID:1596
- - C:\Windows\SysWOW64\REG.exe
    REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
    3⤵
    - Modifies registry key
    PID:1076
- - C:\Windows\SysWOW64\REG.exe
    REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
    3⤵
    - Modifies registry key
    PID:2000
- - C:\Windows\SysWOW64\REG.exe
    REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
    3⤵
    - Modifies registry key
    PID:948
- - C:\Windows\SysWOW64\REG.exe
    REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
    3⤵
    - Modifies registry key
    PID:1548
- C:\Windows\SysWOW64\cmd.exe
  cmd /c c:\windows\W_X_C.bat
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1456
- - C:\windows\hosts.exe
    C:\windows\hosts.exe
    3⤵
    - Modifies visibility of file extensions in Explorer
    - Modifies visiblity of hidden/system files in Explorer
    - Executes dropped EXE
    - Loads dropped DLL
    - Adds Run key to start application
    - Drops file in Windows directory
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:1488
  - - C:\Users\Admin\AppData\Local\Temp\avscan.exe
      C:\Users\Admin\AppData\Local\Temp\avscan.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:672
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c c:\windows\W_X_C.bat
      4⤵
      Suspicious use of WriteProcessMemory
      PID:1816
    - - C:\windows\hosts.exe
        
        C:\windows\hosts.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1952
    - - C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Windows\W_X_C.vbs"
        5⤵
        Adds policy Run key to start application
        
        PID:632
  - - C:\Windows\SysWOW64\REG.exe
      REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
      4⤵
      Modifies registry key
      PID:112
  - - C:\Windows\SysWOW64\REG.exe
      REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
      4⤵
      Modifies registry key
      PID:2040
  - - C:\Windows\SysWOW64\REG.exe
      REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
      4⤵
      Modifies registry key
      PID:1088
  - - C:\Windows\SysWOW64\REG.exe
      REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
      4⤵
      Modifies registry key
      PID:1432
- - C:\Windows\SysWOW64\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Windows\W_X_C.vbs"
    3⤵
    - Adds policy Run key to start application
    PID:1208

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Hidden Files and Directories

T1158

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Hidden Files and Directories

T1158

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Admin.bmp

Filesize
412KB

MD5
d5cb7ba12d5a782abf3f1709e1dcf814

SHA1
2500ee5c83c5c95ec443220cb439018b04c0b688

SHA256
487ab2e297bcdd501b216002748801fad4dbec88c135498f477b883cafa7ae22

SHA512
a1d647f42b01747bc57060d2b69456ca3487d75d32e9f0aab0304aa81472a693fe87ed95e0045b035239767772828a494d541d0a5be4c2c2f932bbc7ba3840a0

Download Submit
C:\Users\Admin\AppData\Local\Temp\Admin.bmp

Filesize
777KB

MD5
dd22745d09270a0305f387ccad568749

SHA1
d904107434a079576c574d69e757129b40c95927

SHA256
b707419dc6bd96a1aa2415582e411692a0b5911e5f5aa860cc640ed27ec53579

SHA512
79a687de32d55ff511f22c913663ea7f696af138f4accd999452196d46405f7193fdac0fdde5f0ef4004fbd5c3103a0db2cb0d777f8f4c913edba06d12e0fa18

Download Submit
C:\Users\Admin\AppData\Local\Temp\Admin.bmp

Filesize
777KB

MD5
dd22745d09270a0305f387ccad568749

SHA1
d904107434a079576c574d69e757129b40c95927

SHA256
b707419dc6bd96a1aa2415582e411692a0b5911e5f5aa860cc640ed27ec53579

SHA512
79a687de32d55ff511f22c913663ea7f696af138f4accd999452196d46405f7193fdac0fdde5f0ef4004fbd5c3103a0db2cb0d777f8f4c913edba06d12e0fa18

Download Submit
C:\Users\Admin\AppData\Local\Temp\Admin.bmp

Filesize
1.1MB

MD5
1c7c554946579578679923fc385eed76

SHA1
5bf3d948cf424630cf24904f7bac1fcf9beaa162

SHA256
b135a8e1ab849586e02c882265ebcadd7f90bd39e95f019113d14a415261ad87

SHA512
835203bb481a53d6f9ded4f20487e06f1ac5bc55a9fdfa6b5b9958d59bdb2f7e231b39c72a92eea18fa31a5175040ed01f96da045ebe09bae3245016c37c1563

Download Submit
C:\Users\Admin\AppData\Local\Temp\Admin.bmp

Filesize
1.1MB

MD5
d688d1b138d2550e95dfa992835ab053

SHA1
7c1991d5642a23115fab873ed752bd54c9785319

SHA256
9f276a3d5dfd573b3c77b259b94344660e5a69bdb2e3cd185e78f9be228f820f

SHA512
2a222714af34b944c040865426907b665015f2e163e90d2752aab693caf0ba45548c2b3154a1c88c5df1af2b66f0e8cf6d2f0666ab8537ca8b1ef2a4c78ca6c8

Download Submit
C:\Users\Admin\AppData\Local\Temp\Admin.bmp

Filesize
1.3MB

MD5
9cd6e49e16f0e6fa141d34335d50641f

SHA1
ce59fc866df60e27d2f35c050489c2d344aaa27e

SHA256
d31a640d136c7476e985033ea4cbac3ac0cf34c97b1e08f6c11e887d2fb8cac7

SHA512
4d1c37a161d474a75df14831676a65d135ac049a43038337337c5bd7777ce6014e191098de00d75266e8d9ae9c5b950909262e2f982d3baab301375d11f3f269

Download Submit
C:\Users\Admin\AppData\Local\Temp\Admin.bmp

Filesize
1.5MB

MD5
fcba829b05495f2c558586c55265db76

SHA1
b9f42c0c013c3b3c31b813bc167ca5972476fc30

SHA256
b27edc8f81cc2b1adcc266337953e545c66410ebccadca4f898874115fb489f4

SHA512
65e939c8b1dc350a877ea97b37ed0ed614aa416e29f993eb0e09a352a243ea83934bbc624480460c038d543711e74435bdac508fbe95575c39f091e2396d09bf

Download Submit
C:\Users\Admin\AppData\Local\Temp\avscan.exe

Filesize
182KB

MD5
6f26bbf89c32fc7aa116126ef4b350cf

SHA1
92a28bb8bd08d093f95fbbe7b597e00a9c875977

SHA256
5b3ef114702942f4d05c8809aec567f9974689e670c1e81f26c7414c0a28be2c

SHA512
fa6d29c5da148c951655e3cc36328a74eeea083ab056e75707b6678b328850dc257a9ff242d911e67f32eb214949d14d9a81dbc55f9c8bb0f3d29d805649a03d

Download Submit
C:\Users\Admin\AppData\Local\Temp\avscan.exe

Filesize
182KB

MD5
6f26bbf89c32fc7aa116126ef4b350cf

SHA1
92a28bb8bd08d093f95fbbe7b597e00a9c875977

SHA256
5b3ef114702942f4d05c8809aec567f9974689e670c1e81f26c7414c0a28be2c

SHA512
fa6d29c5da148c951655e3cc36328a74eeea083ab056e75707b6678b328850dc257a9ff242d911e67f32eb214949d14d9a81dbc55f9c8bb0f3d29d805649a03d

Download Submit
C:\Users\Admin\AppData\Local\Temp\avscan.exe

Filesize
182KB

MD5
6f26bbf89c32fc7aa116126ef4b350cf

SHA1
92a28bb8bd08d093f95fbbe7b597e00a9c875977

SHA256
5b3ef114702942f4d05c8809aec567f9974689e670c1e81f26c7414c0a28be2c

SHA512
fa6d29c5da148c951655e3cc36328a74eeea083ab056e75707b6678b328850dc257a9ff242d911e67f32eb214949d14d9a81dbc55f9c8bb0f3d29d805649a03d

Download Submit
C:\Users\Admin\AppData\Local\Temp\avscan.exe

Filesize
182KB

MD5
6f26bbf89c32fc7aa116126ef4b350cf

SHA1
92a28bb8bd08d093f95fbbe7b597e00a9c875977

SHA256
5b3ef114702942f4d05c8809aec567f9974689e670c1e81f26c7414c0a28be2c

SHA512
fa6d29c5da148c951655e3cc36328a74eeea083ab056e75707b6678b328850dc257a9ff242d911e67f32eb214949d14d9a81dbc55f9c8bb0f3d29d805649a03d

Download Submit
C:\Windows\W_X_C.vbs

Filesize
195B

MD5
b147c267b47c4a6cfa3a72c41407541b

SHA1
062231bf7639b26f92e6d5ef78d515f8eaa9639d

SHA256
c9b7b5b912ab24c729de962727ac33835dd58f17754f9368ac702b9987f3baf6

SHA512
4f646fee7eaa29f33604b3f349b3d90a65bec39fdbe80bac6dcd2cd67b17475e51f833a66a5207d3008fede867792605bab132d6672e206bfefaa83aa344ac64

Download Submit
C:\Windows\hosts.exe

Filesize
182KB

MD5
6dec63fc61ef866f3847aa1f0d32d2a6

SHA1
a7d65cc39353fbd05de58b6a86f2faa22c073e12

SHA256
b53a2be428e34734c53f1c256190cd887b687db80eb3d1218b89a14a9315c597

SHA512
70026c190bf1b699cb2975b9eb4d70f633f581bbb5e52bdd0f28bb43d9bedbb79b7b94bc362b107778c9ec01b46d45f22b97d9b0d101241c8821b9163f6e95d7

Download Submit
C:\Windows\hosts.exe

Filesize
182KB

MD5
6dec63fc61ef866f3847aa1f0d32d2a6

SHA1
a7d65cc39353fbd05de58b6a86f2faa22c073e12

SHA256
b53a2be428e34734c53f1c256190cd887b687db80eb3d1218b89a14a9315c597

SHA512
70026c190bf1b699cb2975b9eb4d70f633f581bbb5e52bdd0f28bb43d9bedbb79b7b94bc362b107778c9ec01b46d45f22b97d9b0d101241c8821b9163f6e95d7

Download Submit
C:\Windows\hosts.exe

Filesize
182KB

MD5
6dec63fc61ef866f3847aa1f0d32d2a6

SHA1
a7d65cc39353fbd05de58b6a86f2faa22c073e12

SHA256
b53a2be428e34734c53f1c256190cd887b687db80eb3d1218b89a14a9315c597

SHA512
70026c190bf1b699cb2975b9eb4d70f633f581bbb5e52bdd0f28bb43d9bedbb79b7b94bc362b107778c9ec01b46d45f22b97d9b0d101241c8821b9163f6e95d7

Download Submit
C:\Windows\hosts.exe

Filesize
182KB

MD5
6dec63fc61ef866f3847aa1f0d32d2a6

SHA1
a7d65cc39353fbd05de58b6a86f2faa22c073e12

SHA256
b53a2be428e34734c53f1c256190cd887b687db80eb3d1218b89a14a9315c597

SHA512
70026c190bf1b699cb2975b9eb4d70f633f581bbb5e52bdd0f28bb43d9bedbb79b7b94bc362b107778c9ec01b46d45f22b97d9b0d101241c8821b9163f6e95d7

Download Submit
C:\windows\hosts.exe

Filesize
182KB

MD5
6dec63fc61ef866f3847aa1f0d32d2a6

SHA1
a7d65cc39353fbd05de58b6a86f2faa22c073e12

SHA256
b53a2be428e34734c53f1c256190cd887b687db80eb3d1218b89a14a9315c597

SHA512
70026c190bf1b699cb2975b9eb4d70f633f581bbb5e52bdd0f28bb43d9bedbb79b7b94bc362b107778c9ec01b46d45f22b97d9b0d101241c8821b9163f6e95d7

Download Submit
\??\c:\windows\W_X_C.bat

Filesize
336B

MD5
4db9f8b6175722b62ececeeeba1ce307

SHA1
3b3ba8414706e72a6fa19e884a97b87609e11e47

SHA256
d2150b9e5a4ce55e140f0ca91c4e300715d42095c8fddf58c77037cdd2cfaf78

SHA512
1d6dc274cf7a3dd704f840e6a5ad57ab4c4e35d5f09489aeff520bb797e1c825bac53fc335156fe41e767a46520d031855fe42fe7b175409ebe5e9e986fb9b8b

Download Submit
\Users\Admin\AppData\Local\Temp\avscan.exe

Filesize
182KB

MD5
6f26bbf89c32fc7aa116126ef4b350cf

SHA1
92a28bb8bd08d093f95fbbe7b597e00a9c875977

SHA256
5b3ef114702942f4d05c8809aec567f9974689e670c1e81f26c7414c0a28be2c

SHA512
fa6d29c5da148c951655e3cc36328a74eeea083ab056e75707b6678b328850dc257a9ff242d911e67f32eb214949d14d9a81dbc55f9c8bb0f3d29d805649a03d

Download Submit
\Users\Admin\AppData\Local\Temp\avscan.exe

Filesize
182KB

MD5
6f26bbf89c32fc7aa116126ef4b350cf

SHA1
92a28bb8bd08d093f95fbbe7b597e00a9c875977

SHA256
5b3ef114702942f4d05c8809aec567f9974689e670c1e81f26c7414c0a28be2c

SHA512
fa6d29c5da148c951655e3cc36328a74eeea083ab056e75707b6678b328850dc257a9ff242d911e67f32eb214949d14d9a81dbc55f9c8bb0f3d29d805649a03d

Download Submit
\Users\Admin\AppData\Local\Temp\avscan.exe

Filesize
182KB

MD5
6f26bbf89c32fc7aa116126ef4b350cf

SHA1
92a28bb8bd08d093f95fbbe7b597e00a9c875977

SHA256
5b3ef114702942f4d05c8809aec567f9974689e670c1e81f26c7414c0a28be2c

SHA512
fa6d29c5da148c951655e3cc36328a74eeea083ab056e75707b6678b328850dc257a9ff242d911e67f32eb214949d14d9a81dbc55f9c8bb0f3d29d805649a03d

Download Submit
\Users\Admin\AppData\Local\Temp\avscan.exe

Filesize
182KB

MD5
6f26bbf89c32fc7aa116126ef4b350cf

SHA1
92a28bb8bd08d093f95fbbe7b597e00a9c875977

SHA256
5b3ef114702942f4d05c8809aec567f9974689e670c1e81f26c7414c0a28be2c

SHA512
fa6d29c5da148c951655e3cc36328a74eeea083ab056e75707b6678b328850dc257a9ff242d911e67f32eb214949d14d9a81dbc55f9c8bb0f3d29d805649a03d

Download Submit
\Users\Admin\AppData\Local\Temp\avscan.exe

Filesize
182KB

MD5
6f26bbf89c32fc7aa116126ef4b350cf

SHA1
92a28bb8bd08d093f95fbbe7b597e00a9c875977

SHA256
5b3ef114702942f4d05c8809aec567f9974689e670c1e81f26c7414c0a28be2c

SHA512
fa6d29c5da148c951655e3cc36328a74eeea083ab056e75707b6678b328850dc257a9ff242d911e67f32eb214949d14d9a81dbc55f9c8bb0f3d29d805649a03d

Download Submit
memory/112-107-0x0000000000000000-mapping.dmp

Download
memory/520-73-0x0000000000000000-mapping.dmp

Download
memory/632-99-0x0000000000000000-mapping.dmp

Download
memory/672-88-0x0000000000000000-mapping.dmp

Download
memory/948-114-0x0000000000000000-mapping.dmp

Download
memory/1076-108-0x0000000000000000-mapping.dmp

Download
memory/1088-115-0x0000000000000000-mapping.dmp

Download
memory/1168-56-0x0000000076401000-0x0000000076403000-memory.dmp

Filesize
8KB

Download
memory/1168-58-0x0000000074D61000-0x0000000074D63000-memory.dmp

Filesize
8KB

Download
memory/1208-100-0x0000000000000000-mapping.dmp

Download
memory/1432-120-0x0000000000000000-mapping.dmp

Download
memory/1456-74-0x0000000000000000-mapping.dmp

Download
memory/1488-77-0x0000000000000000-mapping.dmp

Download
memory/1548-121-0x0000000000000000-mapping.dmp

Download
memory/1596-101-0x0000000000000000-mapping.dmp

Download
memory/1632-76-0x0000000000000000-mapping.dmp

Download
memory/1732-61-0x0000000000000000-mapping.dmp

Download
memory/1816-93-0x0000000000000000-mapping.dmp

Download
memory/1932-57-0x0000000000000000-mapping.dmp

Download
memory/1952-94-0x0000000000000000-mapping.dmp

Download
memory/2000-111-0x0000000000000000-mapping.dmp

Download
memory/2032-68-0x0000000000000000-mapping.dmp

Download
memory/2040-110-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads