2607f044ff766d27493b4c42fb6dd7b2dd4c50cbb4b916f22e7e023479004bef

Analysis

max time kernel
149s
max time network
187s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
07-11-2022 18:23

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2607f044ff766d27493b4c42fb6dd7b2dd4c50cbb4b916f22e7e023479004bef.exe
Size

207KB
MD5

0f5e7c4efcd50e0f8eb1695276a951b9
SHA1

17cc25ca6e577f15444b19038051e475df80861b
SHA256

2607f044ff766d27493b4c42fb6dd7b2dd4c50cbb4b916f22e7e023479004bef
SHA512

c5be03e751f63d85bba0e099b9ec32d3cd4f2d21e4b337fbd223a3b1dd969418c8001b9546a9eea30de9f2e9185a7d375e7b191b314c5b5f87b9ee1b1e388b5e
SSDEEP

3072:obpDCw1p3vmLvsZIaVwiwDcIbDHDCm/DER4eQ8O7ZnX:gDCwfG1bnxLERRU7d

Score

10^/10

evasion persistence

Malware Config

Signatures

Modifies visibility of file extensions in Explorer 2 TTPs 3 IoCs

evasion

Hidden Files and Directories

T1158

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	2607f044ff766d27493b4c42fb6dd7b2dd4c50cbb4b916f22e7e023479004bef.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	avscan.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	hosts.exe

Modifies visiblity of hidden/system files in Explorer 2 TTPs 3 IoCs

evasion

Hidden Files and Directories

T1158

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	2607f044ff766d27493b4c42fb6dd7b2dd4c50cbb4b916f22e7e023479004bef.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	avscan.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	hosts.exe

Adds policy Run key to start application 2 TTPs 6 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	WScript.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\GBQHURCC = "W_X_C.bat"	WScript.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	WScript.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\GBQHURCC = "W_X_C.bat"	WScript.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	WScript.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\GBQHURCC = "W_X_C.bat"	WScript.exe

Executes dropped EXE 6 IoCs

pid	Process
5056	avscan.exe
4772	avscan.exe
1912	hosts.exe
4932	hosts.exe
4420	avscan.exe
4428	hosts.exe

Checks computer location settings 2 TTPs 3 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation	cmd.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation	cmd.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation	cmd.exe

Adds Run key to start application 2 TTPs 6 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\avscan = "C:\\Users\\Admin\\AppData\\Local\\Temp\\avscan.exe"	hosts.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run	2607f044ff766d27493b4c42fb6dd7b2dd4c50cbb4b916f22e7e023479004bef.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\avscan = "C:\\Users\\Admin\\AppData\\Local\\Temp\\avscan.exe"	2607f044ff766d27493b4c42fb6dd7b2dd4c50cbb4b916f22e7e023479004bef.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run	avscan.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\avscan = "C:\\Users\\Admin\\AppData\\Local\\Temp\\avscan.exe"	avscan.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run	hosts.exe

Drops file in Windows directory 5 IoCs

description	ioc	Process
File created	C:\windows\W_X_C.vbs	2607f044ff766d27493b4c42fb6dd7b2dd4c50cbb4b916f22e7e023479004bef.exe
File created	\??\c:\windows\W_X_C.bat	2607f044ff766d27493b4c42fb6dd7b2dd4c50cbb4b916f22e7e023479004bef.exe
File opened for modification	C:\Windows\hosts.exe	2607f044ff766d27493b4c42fb6dd7b2dd4c50cbb4b916f22e7e023479004bef.exe
File opened for modification	C:\Windows\hosts.exe	avscan.exe
File opened for modification	C:\Windows\hosts.exe	hosts.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies registry class 4 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\Local Settings	2607f044ff766d27493b4c42fb6dd7b2dd4c50cbb4b916f22e7e023479004bef.exe
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\Local Settings	cmd.exe

Modifies registry key 1 TTPs 9 IoCs

Modify Registry

T1112

pid	Process
524	REG.exe
2392	REG.exe
1344	REG.exe
2164	REG.exe
4608	REG.exe
1964	REG.exe
3708	REG.exe
4184	REG.exe
4744	REG.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

pid	Process
5056	avscan.exe
1912	hosts.exe

Suspicious use of SetWindowsHookEx 7 IoCs

pid	Process
3416	2607f044ff766d27493b4c42fb6dd7b2dd4c50cbb4b916f22e7e023479004bef.exe
5056	avscan.exe
4772	avscan.exe
1912	hosts.exe
4932	hosts.exe
4420	avscan.exe
4428	hosts.exe

Suspicious use of WriteProcessMemory 63 IoCs

description	pid	Process	procid_target
PID 3416 wrote to memory of 1344	3416	2607f044ff766d27493b4c42fb6dd7b2dd4c50cbb4b916f22e7e023479004bef.exe	78
PID 3416 wrote to memory of 1344	3416	2607f044ff766d27493b4c42fb6dd7b2dd4c50cbb4b916f22e7e023479004bef.exe	78
PID 3416 wrote to memory of 1344	3416	2607f044ff766d27493b4c42fb6dd7b2dd4c50cbb4b916f22e7e023479004bef.exe	78
PID 3416 wrote to memory of 5056	3416	2607f044ff766d27493b4c42fb6dd7b2dd4c50cbb4b916f22e7e023479004bef.exe	80
PID 3416 wrote to memory of 5056	3416	2607f044ff766d27493b4c42fb6dd7b2dd4c50cbb4b916f22e7e023479004bef.exe	80
PID 3416 wrote to memory of 5056	3416	2607f044ff766d27493b4c42fb6dd7b2dd4c50cbb4b916f22e7e023479004bef.exe	80
PID 5056 wrote to memory of 4772	5056	avscan.exe	81
PID 5056 wrote to memory of 4772	5056	avscan.exe	81
PID 5056 wrote to memory of 4772	5056	avscan.exe	81
PID 5056 wrote to memory of 4852	5056	avscan.exe	82
PID 5056 wrote to memory of 4852	5056	avscan.exe	82
PID 5056 wrote to memory of 4852	5056	avscan.exe	82
PID 3416 wrote to memory of 4860	3416	2607f044ff766d27493b4c42fb6dd7b2dd4c50cbb4b916f22e7e023479004bef.exe	84
PID 3416 wrote to memory of 4860	3416	2607f044ff766d27493b4c42fb6dd7b2dd4c50cbb4b916f22e7e023479004bef.exe	84
PID 3416 wrote to memory of 4860	3416	2607f044ff766d27493b4c42fb6dd7b2dd4c50cbb4b916f22e7e023479004bef.exe	84
PID 4852 wrote to memory of 1912	4852	cmd.exe	86
PID 4852 wrote to memory of 1912	4852	cmd.exe	86
PID 4852 wrote to memory of 1912	4852	cmd.exe	86
PID 4860 wrote to memory of 4932	4860	cmd.exe	87
PID 4860 wrote to memory of 4932	4860	cmd.exe	87
PID 4860 wrote to memory of 4932	4860	cmd.exe	87
PID 1912 wrote to memory of 4420	1912	hosts.exe	88
PID 1912 wrote to memory of 4420	1912	hosts.exe	88
PID 1912 wrote to memory of 4420	1912	hosts.exe	88
PID 1912 wrote to memory of 4408	1912	hosts.exe	89
PID 1912 wrote to memory of 4408	1912	hosts.exe	89
PID 1912 wrote to memory of 4408	1912	hosts.exe	89
PID 4860 wrote to memory of 4040	4860	cmd.exe	92
PID 4860 wrote to memory of 4040	4860	cmd.exe	92
PID 4860 wrote to memory of 4040	4860	cmd.exe	92
PID 4852 wrote to memory of 3896	4852	cmd.exe	93
PID 4852 wrote to memory of 3896	4852	cmd.exe	93
PID 4852 wrote to memory of 3896	4852	cmd.exe	93
PID 4408 wrote to memory of 4428	4408	cmd.exe	94
PID 4408 wrote to memory of 4428	4408	cmd.exe	94
PID 4408 wrote to memory of 4428	4408	cmd.exe	94
PID 4408 wrote to memory of 4676	4408	cmd.exe	95
PID 4408 wrote to memory of 4676	4408	cmd.exe	95
PID 4408 wrote to memory of 4676	4408	cmd.exe	95
PID 5056 wrote to memory of 4744	5056	avscan.exe	98
PID 5056 wrote to memory of 4744	5056	avscan.exe	98
PID 5056 wrote to memory of 4744	5056	avscan.exe	98
PID 1912 wrote to memory of 2164	1912	hosts.exe	100
PID 1912 wrote to memory of 2164	1912	hosts.exe	100
PID 1912 wrote to memory of 2164	1912	hosts.exe	100
PID 5056 wrote to memory of 524	5056	avscan.exe	105
PID 5056 wrote to memory of 524	5056	avscan.exe	105
PID 5056 wrote to memory of 524	5056	avscan.exe	105
PID 1912 wrote to memory of 4608	1912	hosts.exe	107
PID 1912 wrote to memory of 4608	1912	hosts.exe	107
PID 1912 wrote to memory of 4608	1912	hosts.exe	107
PID 5056 wrote to memory of 2392	5056	avscan.exe	112
PID 5056 wrote to memory of 2392	5056	avscan.exe	112
PID 5056 wrote to memory of 2392	5056	avscan.exe	112
PID 1912 wrote to memory of 1964	1912	hosts.exe	114
PID 1912 wrote to memory of 1964	1912	hosts.exe	114
PID 1912 wrote to memory of 1964	1912	hosts.exe	114
PID 5056 wrote to memory of 3708	5056	avscan.exe	116
PID 5056 wrote to memory of 3708	5056	avscan.exe	116
PID 5056 wrote to memory of 3708	5056	avscan.exe	116
PID 1912 wrote to memory of 4184	1912	hosts.exe	118
PID 1912 wrote to memory of 4184	1912	hosts.exe	118
PID 1912 wrote to memory of 4184	1912	hosts.exe	118

C:\Users\Admin\AppData\Local\Temp\2607f044ff766d27493b4c42fb6dd7b2dd4c50cbb4b916f22e7e023479004bef.exe
"C:\Users\Admin\AppData\Local\Temp\2607f044ff766d27493b4c42fb6dd7b2dd4c50cbb4b916f22e7e023479004bef.exe"
1⤵
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- Adds Run key to start application
- Drops file in Windows directory
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3416
- C:\Windows\SysWOW64\REG.exe
  REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
  2⤵
  - Modifies registry key
  PID:1344
- C:\Users\Admin\AppData\Local\Temp\avscan.exe
  C:\Users\Admin\AppData\Local\Temp\avscan.exe
  2⤵
  - Modifies visibility of file extensions in Explorer
  - Modifies visiblity of hidden/system files in Explorer
  - Executes dropped EXE
  - Adds Run key to start application
  - Drops file in Windows directory
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:5056
- - C:\Users\Admin\AppData\Local\Temp\avscan.exe
    C:\Users\Admin\AppData\Local\Temp\avscan.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:4772
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c c:\windows\W_X_C.bat
    3⤵
    - Checks computer location settings
    - Modifies registry class
    - Suspicious use of WriteProcessMemory
    PID:4852
  - - C:\windows\hosts.exe
      C:\windows\hosts.exe
      4⤵
      Modifies visibility of file extensions in Explorer
      Modifies visiblity of hidden/system files in Explorer
      Executes dropped EXE
      Adds Run key to start application
      Drops file in Windows directory
      Suspicious behavior: GetForegroundWindowSpam
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:1912
    - - C:\Users\Admin\AppData\Local\Temp\avscan.exe
        
        C:\Users\Admin\AppData\Local\Temp\avscan.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4420
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c c:\windows\W_X_C.bat
        5⤵
        Checks computer location settings
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4408
      - C:\windows\hosts.exe
        
        C:\windows\hosts.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4428
      - C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Windows\W_X_C.vbs"
        6⤵
        Adds policy Run key to start application
        
        PID:4676
    - - C:\Windows\SysWOW64\REG.exe
        
        REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
        5⤵
        Modifies registry key
        
        PID:2164
    - - C:\Windows\SysWOW64\REG.exe
        
        REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
        5⤵
        Modifies registry key
        
        PID:4608
    - - C:\Windows\SysWOW64\REG.exe
        
        REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
        5⤵
        Modifies registry key
        
        PID:1964
    - - C:\Windows\SysWOW64\REG.exe
        
        REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
        5⤵
        Modifies registry key
        
        PID:4184
  - - C:\Windows\SysWOW64\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Windows\W_X_C.vbs"
      4⤵
      Adds policy Run key to start application
      PID:3896
- - C:\Windows\SysWOW64\REG.exe
    REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
    3⤵
    - Modifies registry key
    PID:4744
- - C:\Windows\SysWOW64\REG.exe
    REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
    3⤵
    - Modifies registry key
    PID:524
- - C:\Windows\SysWOW64\REG.exe
    REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
    3⤵
    - Modifies registry key
    PID:2392
- - C:\Windows\SysWOW64\REG.exe
    REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
    3⤵
    - Modifies registry key
    PID:3708
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c c:\windows\W_X_C.bat
  2⤵
  - Checks computer location settings
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:4860
- - C:\windows\hosts.exe
    C:\windows\hosts.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:4932
- - C:\Windows\SysWOW64\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Windows\W_X_C.vbs"
    3⤵
    - Adds policy Run key to start application
    PID:4040

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4124

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Hidden Files and Directories

T1158

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Hidden Files and Directories

T1158

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\avscan.exe

Filesize
207KB

MD5
94735fffab35e9629cbe873e983e22ab

SHA1
e2dd01e3430c6e657ef106f0d1bdeb9cdf658acf

SHA256
7c197d5a142d57e4c36e3158d1eed7dfb072a2307fa648a06a70b5413b1688dc

SHA512
d8229fb6111eb9808a1728a881817d9ca7700819800f1952812f78754e7d01d803f63d36a773d9dc4cf3e46f826bad304bd63ee9b926c966c80e5f04387ef643

Download Submit
C:\Users\Admin\AppData\Local\Temp\avscan.exe

Filesize
207KB

MD5
94735fffab35e9629cbe873e983e22ab

SHA1
e2dd01e3430c6e657ef106f0d1bdeb9cdf658acf

SHA256
7c197d5a142d57e4c36e3158d1eed7dfb072a2307fa648a06a70b5413b1688dc

SHA512
d8229fb6111eb9808a1728a881817d9ca7700819800f1952812f78754e7d01d803f63d36a773d9dc4cf3e46f826bad304bd63ee9b926c966c80e5f04387ef643

Download Submit
C:\Users\Admin\AppData\Local\Temp\avscan.exe

Filesize
207KB

MD5
94735fffab35e9629cbe873e983e22ab

SHA1
e2dd01e3430c6e657ef106f0d1bdeb9cdf658acf

SHA256
7c197d5a142d57e4c36e3158d1eed7dfb072a2307fa648a06a70b5413b1688dc

SHA512
d8229fb6111eb9808a1728a881817d9ca7700819800f1952812f78754e7d01d803f63d36a773d9dc4cf3e46f826bad304bd63ee9b926c966c80e5f04387ef643

Download Submit
C:\Users\Admin\AppData\Local\Temp\avscan.exe

Filesize
207KB

MD5
94735fffab35e9629cbe873e983e22ab

SHA1
e2dd01e3430c6e657ef106f0d1bdeb9cdf658acf

SHA256
7c197d5a142d57e4c36e3158d1eed7dfb072a2307fa648a06a70b5413b1688dc

SHA512
d8229fb6111eb9808a1728a881817d9ca7700819800f1952812f78754e7d01d803f63d36a773d9dc4cf3e46f826bad304bd63ee9b926c966c80e5f04387ef643

Download Submit
C:\Windows\W_X_C.vbs

Filesize
195B

MD5
5b87381bf407d7c6018a8b11c3e20f92

SHA1
bb61b28d9c8fd7dfeb13a397c49a1be3abc06ca2

SHA256
4785d6a229d0872fe90c75ab620de9a680d7f07ccd27a134da2afc4ee88f34f3

SHA512
05db1178f671e9d6c3a1c601349093447b04ebddcd071a06f7cc92cbaf7efb53027bc92523a19372a08ca5af715cc9955649255f8be1909b5e594385b3dcbe3d

Download Submit
C:\Windows\hosts.exe

Filesize
207KB

MD5
c62f976cd30613dde3d57558262486a1

SHA1
dd1dc4feb4abc759843aaedde10cde75a705eb69

SHA256
d8c784ad8602688bb06d7ad623ed21ee7201b8517778e91ca232c6b1de26cb5e

SHA512
93e620b70225c73f74e3e8fc487836945802fed15f381cdead895ac130f6e5140067803f05b054d96a9c7f14cfcaaadfc2d187750c55efcdba82f76a56546ad2

Download Submit
C:\Windows\hosts.exe

Filesize
207KB

MD5
c62f976cd30613dde3d57558262486a1

SHA1
dd1dc4feb4abc759843aaedde10cde75a705eb69

SHA256
d8c784ad8602688bb06d7ad623ed21ee7201b8517778e91ca232c6b1de26cb5e

SHA512
93e620b70225c73f74e3e8fc487836945802fed15f381cdead895ac130f6e5140067803f05b054d96a9c7f14cfcaaadfc2d187750c55efcdba82f76a56546ad2

Download Submit
C:\Windows\hosts.exe

Filesize
207KB

MD5
c62f976cd30613dde3d57558262486a1

SHA1
dd1dc4feb4abc759843aaedde10cde75a705eb69

SHA256
d8c784ad8602688bb06d7ad623ed21ee7201b8517778e91ca232c6b1de26cb5e

SHA512
93e620b70225c73f74e3e8fc487836945802fed15f381cdead895ac130f6e5140067803f05b054d96a9c7f14cfcaaadfc2d187750c55efcdba82f76a56546ad2

Download Submit
C:\Windows\hosts.exe

Filesize
207KB

MD5
c62f976cd30613dde3d57558262486a1

SHA1
dd1dc4feb4abc759843aaedde10cde75a705eb69

SHA256
d8c784ad8602688bb06d7ad623ed21ee7201b8517778e91ca232c6b1de26cb5e

SHA512
93e620b70225c73f74e3e8fc487836945802fed15f381cdead895ac130f6e5140067803f05b054d96a9c7f14cfcaaadfc2d187750c55efcdba82f76a56546ad2

Download Submit
C:\windows\hosts.exe

Filesize
207KB

MD5
c62f976cd30613dde3d57558262486a1

SHA1
dd1dc4feb4abc759843aaedde10cde75a705eb69

SHA256
d8c784ad8602688bb06d7ad623ed21ee7201b8517778e91ca232c6b1de26cb5e

SHA512
93e620b70225c73f74e3e8fc487836945802fed15f381cdead895ac130f6e5140067803f05b054d96a9c7f14cfcaaadfc2d187750c55efcdba82f76a56546ad2

Download Submit
\??\c:\windows\W_X_C.bat

Filesize
336B

MD5
4db9f8b6175722b62ececeeeba1ce307

SHA1
3b3ba8414706e72a6fa19e884a97b87609e11e47

SHA256
d2150b9e5a4ce55e140f0ca91c4e300715d42095c8fddf58c77037cdd2cfaf78

SHA512
1d6dc274cf7a3dd704f840e6a5ad57ab4c4e35d5f09489aeff520bb797e1c825bac53fc335156fe41e767a46520d031855fe42fe7b175409ebe5e9e986fb9b8b

Download Submit
memory/524-172-0x0000000000000000-mapping.dmp

Download
memory/1344-134-0x0000000000000000-mapping.dmp

Download
memory/1912-148-0x0000000000000000-mapping.dmp

Download
memory/1964-175-0x0000000000000000-mapping.dmp

Download
memory/2164-171-0x0000000000000000-mapping.dmp

Download
memory/2392-174-0x0000000000000000-mapping.dmp

Download
memory/3708-176-0x0000000000000000-mapping.dmp

Download
memory/3896-164-0x0000000000000000-mapping.dmp

Download
memory/4040-163-0x0000000000000000-mapping.dmp

Download
memory/4184-177-0x0000000000000000-mapping.dmp

Download
memory/4408-161-0x0000000000000000-mapping.dmp

Download
memory/4420-155-0x0000000000000000-mapping.dmp

Download
memory/4428-165-0x0000000000000000-mapping.dmp

Download
memory/4608-173-0x0000000000000000-mapping.dmp

Download
memory/4676-169-0x0000000000000000-mapping.dmp

Download
memory/4744-170-0x0000000000000000-mapping.dmp

Download
memory/4772-141-0x0000000000000000-mapping.dmp

Download
memory/4852-145-0x0000000000000000-mapping.dmp

Download
memory/4860-146-0x0000000000000000-mapping.dmp

Download
memory/4932-151-0x0000000000000000-mapping.dmp

Download
memory/5056-135-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads