0bbfe4a93ccda69d3aa428db0e590b6227afb7b913945f19d729c41900f97d3c

Analysis

max time kernel
183s
max time network
199s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
07/11/2022, 18:24

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0bbfe4a93ccda69d3aa428db0e590b6227afb7b913945f19d729c41900f97d3c.exe
Size

183KB
MD5

0fc54212e276e7b20d020ee246330a6a
SHA1

91aefc8cc86674a9a05a9ae27d0d6a8b8934c4b0
SHA256

0bbfe4a93ccda69d3aa428db0e590b6227afb7b913945f19d729c41900f97d3c
SHA512

97457f2e160845f22230ffe12905744beabc990cf85165a466b298e85ef732cc22299dd7cd379c25bef30d83ad1760e011eac072030580aa029a59e193b59733
SSDEEP

3072:obpDCw1p3vmLvsZIaVwiwDcIbDHDCm/DEcdwvz:gDCwfG1bnxLEc6vz

Score

10^/10

evasion persistence

Malware Config

Signatures

Modifies visibility of file extensions in Explorer 2 TTPs 3 IoCs

evasion

Hidden Files and Directories

T1158

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	0bbfe4a93ccda69d3aa428db0e590b6227afb7b913945f19d729c41900f97d3c.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	avscan.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	hosts.exe

Modifies visiblity of hidden/system files in Explorer 2 TTPs 3 IoCs

evasion

Hidden Files and Directories

T1158

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	0bbfe4a93ccda69d3aa428db0e590b6227afb7b913945f19d729c41900f97d3c.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	avscan.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	hosts.exe

Adds policy Run key to start application 2 TTPs 6 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	WScript.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\GBQHURCC = "W_X_C.bat"	WScript.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	WScript.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\GBQHURCC = "W_X_C.bat"	WScript.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	WScript.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\GBQHURCC = "W_X_C.bat"	WScript.exe

Executes dropped EXE 6 IoCs

pid	Process
4932	avscan.exe
4820	avscan.exe
1736	hosts.exe
1492	hosts.exe
948	avscan.exe
220	hosts.exe

Checks computer location settings 2 TTPs 3 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation	cmd.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation	cmd.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation	cmd.exe

Adds Run key to start application 2 TTPs 6 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run	0bbfe4a93ccda69d3aa428db0e590b6227afb7b913945f19d729c41900f97d3c.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\avscan = "C:\\Users\\Admin\\AppData\\Local\\Temp\\avscan.exe"	0bbfe4a93ccda69d3aa428db0e590b6227afb7b913945f19d729c41900f97d3c.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run	avscan.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\avscan = "C:\\Users\\Admin\\AppData\\Local\\Temp\\avscan.exe"	avscan.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run	hosts.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\avscan = "C:\\Users\\Admin\\AppData\\Local\\Temp\\avscan.exe"	hosts.exe

Drops file in Windows directory 5 IoCs

description	ioc	Process
File opened for modification	C:\Windows\hosts.exe	hosts.exe
File created	C:\windows\W_X_C.vbs	0bbfe4a93ccda69d3aa428db0e590b6227afb7b913945f19d729c41900f97d3c.exe
File created	\??\c:\windows\W_X_C.bat	0bbfe4a93ccda69d3aa428db0e590b6227afb7b913945f19d729c41900f97d3c.exe
File opened for modification	C:\Windows\hosts.exe	0bbfe4a93ccda69d3aa428db0e590b6227afb7b913945f19d729c41900f97d3c.exe
File opened for modification	C:\Windows\hosts.exe	avscan.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies registry class 4 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\Local Settings	0bbfe4a93ccda69d3aa428db0e590b6227afb7b913945f19d729c41900f97d3c.exe
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\Local Settings	cmd.exe

Modifies registry key 1 TTPs 9 IoCs

Modify Registry

T1112

pid	Process
4976	REG.exe
1528	REG.exe
4268	REG.exe
3528	REG.exe
2728	REG.exe
1036	REG.exe
3684	REG.exe
4012	REG.exe
2764	REG.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

pid	Process
4932	avscan.exe
1492	hosts.exe

Suspicious use of SetWindowsHookEx 7 IoCs

pid	Process
4092	0bbfe4a93ccda69d3aa428db0e590b6227afb7b913945f19d729c41900f97d3c.exe
4932	avscan.exe
4820	avscan.exe
1492	hosts.exe
1736	hosts.exe
948	avscan.exe
220	hosts.exe

Suspicious use of WriteProcessMemory 63 IoCs

description	pid	Process	procid_target
PID 4092 wrote to memory of 3684	4092	0bbfe4a93ccda69d3aa428db0e590b6227afb7b913945f19d729c41900f97d3c.exe	79
PID 4092 wrote to memory of 3684	4092	0bbfe4a93ccda69d3aa428db0e590b6227afb7b913945f19d729c41900f97d3c.exe	79
PID 4092 wrote to memory of 3684	4092	0bbfe4a93ccda69d3aa428db0e590b6227afb7b913945f19d729c41900f97d3c.exe	79
PID 4092 wrote to memory of 4932	4092	0bbfe4a93ccda69d3aa428db0e590b6227afb7b913945f19d729c41900f97d3c.exe	81
PID 4092 wrote to memory of 4932	4092	0bbfe4a93ccda69d3aa428db0e590b6227afb7b913945f19d729c41900f97d3c.exe	81
PID 4092 wrote to memory of 4932	4092	0bbfe4a93ccda69d3aa428db0e590b6227afb7b913945f19d729c41900f97d3c.exe	81
PID 4932 wrote to memory of 4820	4932	avscan.exe	82
PID 4932 wrote to memory of 4820	4932	avscan.exe	82
PID 4932 wrote to memory of 4820	4932	avscan.exe	82
PID 4932 wrote to memory of 4328	4932	avscan.exe	83
PID 4932 wrote to memory of 4328	4932	avscan.exe	83
PID 4932 wrote to memory of 4328	4932	avscan.exe	83
PID 4092 wrote to memory of 2476	4092	0bbfe4a93ccda69d3aa428db0e590b6227afb7b913945f19d729c41900f97d3c.exe	85
PID 4092 wrote to memory of 2476	4092	0bbfe4a93ccda69d3aa428db0e590b6227afb7b913945f19d729c41900f97d3c.exe	85
PID 4092 wrote to memory of 2476	4092	0bbfe4a93ccda69d3aa428db0e590b6227afb7b913945f19d729c41900f97d3c.exe	85
PID 4328 wrote to memory of 1492	4328	cmd.exe	88
PID 4328 wrote to memory of 1492	4328	cmd.exe	88
PID 4328 wrote to memory of 1492	4328	cmd.exe	88
PID 2476 wrote to memory of 1736	2476	cmd.exe	87
PID 2476 wrote to memory of 1736	2476	cmd.exe	87
PID 2476 wrote to memory of 1736	2476	cmd.exe	87
PID 1492 wrote to memory of 948	1492	hosts.exe	90
PID 1492 wrote to memory of 948	1492	hosts.exe	90
PID 1492 wrote to memory of 948	1492	hosts.exe	90
PID 1492 wrote to memory of 1232	1492	hosts.exe	91
PID 1492 wrote to memory of 1232	1492	hosts.exe	91
PID 1492 wrote to memory of 1232	1492	hosts.exe	91
PID 1232 wrote to memory of 220	1232	cmd.exe	93
PID 1232 wrote to memory of 220	1232	cmd.exe	93
PID 1232 wrote to memory of 220	1232	cmd.exe	93
PID 4328 wrote to memory of 3848	4328	cmd.exe	95
PID 4328 wrote to memory of 3848	4328	cmd.exe	95
PID 4328 wrote to memory of 3848	4328	cmd.exe	95
PID 1232 wrote to memory of 4680	1232	cmd.exe	94
PID 1232 wrote to memory of 4680	1232	cmd.exe	94
PID 1232 wrote to memory of 4680	1232	cmd.exe	94
PID 2476 wrote to memory of 2032	2476	cmd.exe	96
PID 2476 wrote to memory of 2032	2476	cmd.exe	96
PID 2476 wrote to memory of 2032	2476	cmd.exe	96
PID 4932 wrote to memory of 4268	4932	avscan.exe	97
PID 4932 wrote to memory of 4268	4932	avscan.exe	97
PID 4932 wrote to memory of 4268	4932	avscan.exe	97
PID 1492 wrote to memory of 3528	1492	hosts.exe	99
PID 1492 wrote to memory of 3528	1492	hosts.exe	99
PID 1492 wrote to memory of 3528	1492	hosts.exe	99
PID 4932 wrote to memory of 2728	4932	avscan.exe	101
PID 4932 wrote to memory of 2728	4932	avscan.exe	101
PID 4932 wrote to memory of 2728	4932	avscan.exe	101
PID 1492 wrote to memory of 1036	1492	hosts.exe	103
PID 1492 wrote to memory of 1036	1492	hosts.exe	103
PID 1492 wrote to memory of 1036	1492	hosts.exe	103
PID 4932 wrote to memory of 4012	4932	avscan.exe	109
PID 4932 wrote to memory of 4012	4932	avscan.exe	109
PID 4932 wrote to memory of 4012	4932	avscan.exe	109
PID 1492 wrote to memory of 2764	1492	hosts.exe	111
PID 1492 wrote to memory of 2764	1492	hosts.exe	111
PID 1492 wrote to memory of 2764	1492	hosts.exe	111
PID 4932 wrote to memory of 4976	4932	avscan.exe	115
PID 4932 wrote to memory of 4976	4932	avscan.exe	115
PID 4932 wrote to memory of 4976	4932	avscan.exe	115
PID 1492 wrote to memory of 1528	1492	hosts.exe	117
PID 1492 wrote to memory of 1528	1492	hosts.exe	117
PID 1492 wrote to memory of 1528	1492	hosts.exe	117

C:\Users\Admin\AppData\Local\Temp\0bbfe4a93ccda69d3aa428db0e590b6227afb7b913945f19d729c41900f97d3c.exe
"C:\Users\Admin\AppData\Local\Temp\0bbfe4a93ccda69d3aa428db0e590b6227afb7b913945f19d729c41900f97d3c.exe"
1⤵
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- Adds Run key to start application
- Drops file in Windows directory
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4092
- C:\Windows\SysWOW64\REG.exe
  REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
  2⤵
  - Modifies registry key
  PID:3684
- C:\Users\Admin\AppData\Local\Temp\avscan.exe
  C:\Users\Admin\AppData\Local\Temp\avscan.exe
  2⤵
  - Modifies visibility of file extensions in Explorer
  - Modifies visiblity of hidden/system files in Explorer
  - Executes dropped EXE
  - Adds Run key to start application
  - Drops file in Windows directory
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4932
- - C:\Users\Admin\AppData\Local\Temp\avscan.exe
    C:\Users\Admin\AppData\Local\Temp\avscan.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:4820
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c c:\windows\W_X_C.bat
    3⤵
    - Checks computer location settings
    - Modifies registry class
    - Suspicious use of WriteProcessMemory
    PID:4328
  - - C:\windows\hosts.exe
      C:\windows\hosts.exe
      4⤵
      Modifies visibility of file extensions in Explorer
      Modifies visiblity of hidden/system files in Explorer
      Executes dropped EXE
      Adds Run key to start application
      Drops file in Windows directory
      Suspicious behavior: GetForegroundWindowSpam
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:1492
    - - C:\Users\Admin\AppData\Local\Temp\avscan.exe
        
        C:\Users\Admin\AppData\Local\Temp\avscan.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:948
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c c:\windows\W_X_C.bat
        5⤵
        Checks computer location settings
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1232
      - C:\windows\hosts.exe
        
        C:\windows\hosts.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:220
      - C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Windows\W_X_C.vbs"
        6⤵
        Adds policy Run key to start application
        
        PID:4680
    - - C:\Windows\SysWOW64\REG.exe
        
        REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
        5⤵
        Modifies registry key
        
        PID:3528
    - - C:\Windows\SysWOW64\REG.exe
        
        REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
        5⤵
        Modifies registry key
        
        PID:1036
    - - C:\Windows\SysWOW64\REG.exe
        
        REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
        5⤵
        Modifies registry key
        
        PID:2764
    - - C:\Windows\SysWOW64\REG.exe
        
        REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
        5⤵
        Modifies registry key
        
        PID:1528
  - - C:\Windows\SysWOW64\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Windows\W_X_C.vbs"
      4⤵
      Adds policy Run key to start application
      PID:3848
- - C:\Windows\SysWOW64\REG.exe
    REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
    3⤵
    - Modifies registry key
    PID:4268
- - C:\Windows\SysWOW64\REG.exe
    REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
    3⤵
    - Modifies registry key
    PID:2728
- - C:\Windows\SysWOW64\REG.exe
    REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
    3⤵
    - Modifies registry key
    PID:4012
- - C:\Windows\SysWOW64\REG.exe
    REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
    3⤵
    - Modifies registry key
    PID:4976
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c c:\windows\W_X_C.bat
  2⤵
  - Checks computer location settings
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2476
- - C:\windows\hosts.exe
    C:\windows\hosts.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1736
- - C:\Windows\SysWOW64\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Windows\W_X_C.vbs"
    3⤵
    - Adds policy Run key to start application
    PID:2032

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:3436

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Hidden Files and Directories

T1158

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Hidden Files and Directories

T1158

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\avscan.exe

Filesize
183KB

MD5
01dc86009bc8e2b7f1b58ff4f0494582

SHA1
5ea72e7681e6e49dcbc7fd84fe2fced1280e1782

SHA256
6f729ef86b92503abc48f94ccdd3b7c0565f1085847713db6bf9719511241235

SHA512
a53e670eea718e701ee84a64c0b190a474878533a22963577da653e5f5cdcacb7ff12018d9f443443117a9062b57830d3014774ba124b0c8b6a1ddeb5fe0ce30

Download Submit
C:\Users\Admin\AppData\Local\Temp\avscan.exe

Filesize
183KB

MD5
01dc86009bc8e2b7f1b58ff4f0494582

SHA1
5ea72e7681e6e49dcbc7fd84fe2fced1280e1782

SHA256
6f729ef86b92503abc48f94ccdd3b7c0565f1085847713db6bf9719511241235

SHA512
a53e670eea718e701ee84a64c0b190a474878533a22963577da653e5f5cdcacb7ff12018d9f443443117a9062b57830d3014774ba124b0c8b6a1ddeb5fe0ce30

Download Submit
C:\Users\Admin\AppData\Local\Temp\avscan.exe

Filesize
183KB

MD5
01dc86009bc8e2b7f1b58ff4f0494582

SHA1
5ea72e7681e6e49dcbc7fd84fe2fced1280e1782

SHA256
6f729ef86b92503abc48f94ccdd3b7c0565f1085847713db6bf9719511241235

SHA512
a53e670eea718e701ee84a64c0b190a474878533a22963577da653e5f5cdcacb7ff12018d9f443443117a9062b57830d3014774ba124b0c8b6a1ddeb5fe0ce30

Download Submit
C:\Users\Admin\AppData\Local\Temp\avscan.exe

Filesize
183KB

MD5
01dc86009bc8e2b7f1b58ff4f0494582

SHA1
5ea72e7681e6e49dcbc7fd84fe2fced1280e1782

SHA256
6f729ef86b92503abc48f94ccdd3b7c0565f1085847713db6bf9719511241235

SHA512
a53e670eea718e701ee84a64c0b190a474878533a22963577da653e5f5cdcacb7ff12018d9f443443117a9062b57830d3014774ba124b0c8b6a1ddeb5fe0ce30

Download Submit
C:\Windows\W_X_C.vbs

Filesize
195B

MD5
5b87381bf407d7c6018a8b11c3e20f92

SHA1
bb61b28d9c8fd7dfeb13a397c49a1be3abc06ca2

SHA256
4785d6a229d0872fe90c75ab620de9a680d7f07ccd27a134da2afc4ee88f34f3

SHA512
05db1178f671e9d6c3a1c601349093447b04ebddcd071a06f7cc92cbaf7efb53027bc92523a19372a08ca5af715cc9955649255f8be1909b5e594385b3dcbe3d

Download Submit
C:\Windows\hosts.exe

Filesize
183KB

MD5
7c2be9504727f546e9faa4288dcaf453

SHA1
4e64e537087c8372f251e3e1c64a9331e11fb421

SHA256
6740dd64b171f9302078a8e60087b971eca4fd074ed97a262627f6a12e8c420e

SHA512
27568f285420fab2214d51a9190c1e40f0060ffc43086e7e9a85bb1e4bf60b65cdfdff3009043318ab386797ba57be0c1d6a63289df34a85e28ae7c2e08c7321

Download Submit
C:\Windows\hosts.exe

Filesize
183KB

MD5
7c2be9504727f546e9faa4288dcaf453

SHA1
4e64e537087c8372f251e3e1c64a9331e11fb421

SHA256
6740dd64b171f9302078a8e60087b971eca4fd074ed97a262627f6a12e8c420e

SHA512
27568f285420fab2214d51a9190c1e40f0060ffc43086e7e9a85bb1e4bf60b65cdfdff3009043318ab386797ba57be0c1d6a63289df34a85e28ae7c2e08c7321

Download Submit
C:\Windows\hosts.exe

Filesize
183KB

MD5
7c2be9504727f546e9faa4288dcaf453

SHA1
4e64e537087c8372f251e3e1c64a9331e11fb421

SHA256
6740dd64b171f9302078a8e60087b971eca4fd074ed97a262627f6a12e8c420e

SHA512
27568f285420fab2214d51a9190c1e40f0060ffc43086e7e9a85bb1e4bf60b65cdfdff3009043318ab386797ba57be0c1d6a63289df34a85e28ae7c2e08c7321

Download Submit
C:\Windows\hosts.exe

Filesize
183KB

MD5
7c2be9504727f546e9faa4288dcaf453

SHA1
4e64e537087c8372f251e3e1c64a9331e11fb421

SHA256
6740dd64b171f9302078a8e60087b971eca4fd074ed97a262627f6a12e8c420e

SHA512
27568f285420fab2214d51a9190c1e40f0060ffc43086e7e9a85bb1e4bf60b65cdfdff3009043318ab386797ba57be0c1d6a63289df34a85e28ae7c2e08c7321

Download Submit
C:\windows\hosts.exe

Filesize
183KB

MD5
7c2be9504727f546e9faa4288dcaf453

SHA1
4e64e537087c8372f251e3e1c64a9331e11fb421

SHA256
6740dd64b171f9302078a8e60087b971eca4fd074ed97a262627f6a12e8c420e

SHA512
27568f285420fab2214d51a9190c1e40f0060ffc43086e7e9a85bb1e4bf60b65cdfdff3009043318ab386797ba57be0c1d6a63289df34a85e28ae7c2e08c7321

Download Submit
\??\c:\windows\W_X_C.bat

Filesize
336B

MD5
4db9f8b6175722b62ececeeeba1ce307

SHA1
3b3ba8414706e72a6fa19e884a97b87609e11e47

SHA256
d2150b9e5a4ce55e140f0ca91c4e300715d42095c8fddf58c77037cdd2cfaf78

SHA512
1d6dc274cf7a3dd704f840e6a5ad57ab4c4e35d5f09489aeff520bb797e1c825bac53fc335156fe41e767a46520d031855fe42fe7b175409ebe5e9e986fb9b8b

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads