215e5912e68742d153b50b7afb977682cbbdf10743b18bf5fe3605517e2e922b

Analysis

max time kernel
144s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
07-11-2022 18:23

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

215e5912e68742d153b50b7afb977682cbbdf10743b18bf5fe3605517e2e922b.exe
Size

241KB
MD5

0f98f79bbde9fedacbea7da9449b7506
SHA1

6a6af4979adad12fde9a9bda7684bbf5ff0de35a
SHA256

215e5912e68742d153b50b7afb977682cbbdf10743b18bf5fe3605517e2e922b
SHA512

764cbf18b073d966fb422beb8c029c923cbc40e50745de5af801ceec5213a863b04e4aaf66fe0e4ba45681567ca04a1796eafcac1e00af50de25d58ec478ae00
SSDEEP

3072:obpDCw1p3vmLvsZIaVwiwDcIbDHDCm/DER4eQyMWoe0c8TilDcq1WC6dS:gDCwfG1bnxLERRh5yc8TO91WC6dS

Score

10^/10

evasion persistence

Malware Config

Signatures

Modifies visibility of file extensions in Explorer 2 TTPs 3 IoCs

evasion

Hidden Files and Directories

T1158

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	215e5912e68742d153b50b7afb977682cbbdf10743b18bf5fe3605517e2e922b.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	avscan.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	hosts.exe

Modifies visiblity of hidden/system files in Explorer 2 TTPs 3 IoCs

evasion

Hidden Files and Directories

T1158

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	215e5912e68742d153b50b7afb977682cbbdf10743b18bf5fe3605517e2e922b.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	avscan.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	hosts.exe

Adds policy Run key to start application 2 TTPs 6 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\IYMUGYHL = "W_X_C.bat"	WScript.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	WScript.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\IYMUGYHL = "W_X_C.bat"	WScript.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	WScript.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\IYMUGYHL = "W_X_C.bat"	WScript.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	WScript.exe

Executes dropped EXE 6 IoCs

pid	Process
944	avscan.exe
1012	avscan.exe
3732	hosts.exe
4976	hosts.exe
2260	avscan.exe
724	hosts.exe

Checks computer location settings 2 TTPs 3 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation	cmd.exe
Key value queried	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation	cmd.exe
Key value queried	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation	cmd.exe

Adds Run key to start application 2 TTPs 6 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run	avscan.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\avscan = "C:\\Users\\Admin\\AppData\\Local\\Temp\\avscan.exe"	avscan.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run	hosts.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\avscan = "C:\\Users\\Admin\\AppData\\Local\\Temp\\avscan.exe"	hosts.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run	215e5912e68742d153b50b7afb977682cbbdf10743b18bf5fe3605517e2e922b.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\avscan = "C:\\Users\\Admin\\AppData\\Local\\Temp\\avscan.exe"	215e5912e68742d153b50b7afb977682cbbdf10743b18bf5fe3605517e2e922b.exe

Drops file in Windows directory 5 IoCs

description	ioc	Process
File opened for modification	C:\Windows\hosts.exe	215e5912e68742d153b50b7afb977682cbbdf10743b18bf5fe3605517e2e922b.exe
File opened for modification	C:\Windows\hosts.exe	avscan.exe
File opened for modification	C:\Windows\hosts.exe	hosts.exe
File created	C:\windows\W_X_C.vbs	215e5912e68742d153b50b7afb977682cbbdf10743b18bf5fe3605517e2e922b.exe
File created	\??\c:\windows\W_X_C.bat	215e5912e68742d153b50b7afb977682cbbdf10743b18bf5fe3605517e2e922b.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies registry class 4 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\Local Settings	215e5912e68742d153b50b7afb977682cbbdf10743b18bf5fe3605517e2e922b.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\Local Settings	cmd.exe

Modifies registry key 1 TTPs 9 IoCs

Modify Registry

T1112

pid	Process
4320	REG.exe
3804	REG.exe
2256	REG.exe
1992	REG.exe
2160	REG.exe
4964	REG.exe
1412	REG.exe
400	REG.exe
4520	REG.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

pid	Process
944	avscan.exe
3732	hosts.exe

Suspicious use of SetWindowsHookEx 7 IoCs

pid	Process
4904	215e5912e68742d153b50b7afb977682cbbdf10743b18bf5fe3605517e2e922b.exe
944	avscan.exe
1012	avscan.exe
3732	hosts.exe
2260	avscan.exe
4976	hosts.exe
724	hosts.exe

Suspicious use of WriteProcessMemory 63 IoCs

description	pid	Process	procid_target
PID 4904 wrote to memory of 2256	4904	215e5912e68742d153b50b7afb977682cbbdf10743b18bf5fe3605517e2e922b.exe	82
PID 4904 wrote to memory of 2256	4904	215e5912e68742d153b50b7afb977682cbbdf10743b18bf5fe3605517e2e922b.exe	82
PID 4904 wrote to memory of 2256	4904	215e5912e68742d153b50b7afb977682cbbdf10743b18bf5fe3605517e2e922b.exe	82
PID 4904 wrote to memory of 944	4904	215e5912e68742d153b50b7afb977682cbbdf10743b18bf5fe3605517e2e922b.exe	84
PID 4904 wrote to memory of 944	4904	215e5912e68742d153b50b7afb977682cbbdf10743b18bf5fe3605517e2e922b.exe	84
PID 4904 wrote to memory of 944	4904	215e5912e68742d153b50b7afb977682cbbdf10743b18bf5fe3605517e2e922b.exe	84
PID 944 wrote to memory of 1012	944	avscan.exe	85
PID 944 wrote to memory of 1012	944	avscan.exe	85
PID 944 wrote to memory of 1012	944	avscan.exe	85
PID 944 wrote to memory of 2288	944	avscan.exe	86
PID 944 wrote to memory of 2288	944	avscan.exe	86
PID 944 wrote to memory of 2288	944	avscan.exe	86
PID 4904 wrote to memory of 5076	4904	215e5912e68742d153b50b7afb977682cbbdf10743b18bf5fe3605517e2e922b.exe	87
PID 4904 wrote to memory of 5076	4904	215e5912e68742d153b50b7afb977682cbbdf10743b18bf5fe3605517e2e922b.exe	87
PID 4904 wrote to memory of 5076	4904	215e5912e68742d153b50b7afb977682cbbdf10743b18bf5fe3605517e2e922b.exe	87
PID 2288 wrote to memory of 3732	2288	cmd.exe	90
PID 2288 wrote to memory of 3732	2288	cmd.exe	90
PID 2288 wrote to memory of 3732	2288	cmd.exe	90
PID 5076 wrote to memory of 4976	5076	cmd.exe	92
PID 5076 wrote to memory of 4976	5076	cmd.exe	92
PID 5076 wrote to memory of 4976	5076	cmd.exe	92
PID 3732 wrote to memory of 2260	3732	hosts.exe	91
PID 3732 wrote to memory of 2260	3732	hosts.exe	91
PID 3732 wrote to memory of 2260	3732	hosts.exe	91
PID 3732 wrote to memory of 3272	3732	hosts.exe	94
PID 3732 wrote to memory of 3272	3732	hosts.exe	94
PID 3732 wrote to memory of 3272	3732	hosts.exe	94
PID 5076 wrote to memory of 4840	5076	cmd.exe	96
PID 5076 wrote to memory of 4840	5076	cmd.exe	96
PID 5076 wrote to memory of 4840	5076	cmd.exe	96
PID 2288 wrote to memory of 2324	2288	cmd.exe	97
PID 2288 wrote to memory of 2324	2288	cmd.exe	97
PID 2288 wrote to memory of 2324	2288	cmd.exe	97
PID 3272 wrote to memory of 724	3272	cmd.exe	98
PID 3272 wrote to memory of 724	3272	cmd.exe	98
PID 3272 wrote to memory of 724	3272	cmd.exe	98
PID 3272 wrote to memory of 4604	3272	cmd.exe	99
PID 3272 wrote to memory of 4604	3272	cmd.exe	99
PID 3272 wrote to memory of 4604	3272	cmd.exe	99
PID 944 wrote to memory of 1992	944	avscan.exe	107
PID 944 wrote to memory of 1992	944	avscan.exe	107
PID 944 wrote to memory of 1992	944	avscan.exe	107
PID 3732 wrote to memory of 1412	3732	hosts.exe	109
PID 3732 wrote to memory of 1412	3732	hosts.exe	109
PID 3732 wrote to memory of 1412	3732	hosts.exe	109
PID 944 wrote to memory of 2160	944	avscan.exe	111
PID 944 wrote to memory of 2160	944	avscan.exe	111
PID 944 wrote to memory of 2160	944	avscan.exe	111
PID 3732 wrote to memory of 4320	3732	hosts.exe	113
PID 3732 wrote to memory of 4320	3732	hosts.exe	113
PID 3732 wrote to memory of 4320	3732	hosts.exe	113
PID 944 wrote to memory of 400	944	avscan.exe	116
PID 944 wrote to memory of 400	944	avscan.exe	116
PID 944 wrote to memory of 400	944	avscan.exe	116
PID 3732 wrote to memory of 3804	3732	hosts.exe	118
PID 3732 wrote to memory of 3804	3732	hosts.exe	118
PID 3732 wrote to memory of 3804	3732	hosts.exe	118
PID 944 wrote to memory of 4520	944	avscan.exe	120
PID 944 wrote to memory of 4520	944	avscan.exe	120
PID 944 wrote to memory of 4520	944	avscan.exe	120
PID 3732 wrote to memory of 4964	3732	hosts.exe	122
PID 3732 wrote to memory of 4964	3732	hosts.exe	122
PID 3732 wrote to memory of 4964	3732	hosts.exe	122

C:\Users\Admin\AppData\Local\Temp\215e5912e68742d153b50b7afb977682cbbdf10743b18bf5fe3605517e2e922b.exe
"C:\Users\Admin\AppData\Local\Temp\215e5912e68742d153b50b7afb977682cbbdf10743b18bf5fe3605517e2e922b.exe"
1⤵
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- Adds Run key to start application
- Drops file in Windows directory
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4904
- C:\Windows\SysWOW64\REG.exe
  REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
  2⤵
  - Modifies registry key
  PID:2256
- C:\Users\Admin\AppData\Local\Temp\avscan.exe
  C:\Users\Admin\AppData\Local\Temp\avscan.exe
  2⤵
  - Modifies visibility of file extensions in Explorer
  - Modifies visiblity of hidden/system files in Explorer
  - Executes dropped EXE
  - Adds Run key to start application
  - Drops file in Windows directory
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:944
- - C:\Users\Admin\AppData\Local\Temp\avscan.exe
    C:\Users\Admin\AppData\Local\Temp\avscan.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1012
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c c:\windows\W_X_C.bat
    3⤵
    - Checks computer location settings
    - Modifies registry class
    - Suspicious use of WriteProcessMemory
    PID:2288
  - - C:\windows\hosts.exe
      C:\windows\hosts.exe
      4⤵
      Modifies visibility of file extensions in Explorer
      Modifies visiblity of hidden/system files in Explorer
      Executes dropped EXE
      Adds Run key to start application
      Drops file in Windows directory
      Suspicious behavior: GetForegroundWindowSpam
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:3732
    - - C:\Users\Admin\AppData\Local\Temp\avscan.exe
        
        C:\Users\Admin\AppData\Local\Temp\avscan.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2260
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c c:\windows\W_X_C.bat
        5⤵
        Checks computer location settings
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3272
      - C:\windows\hosts.exe
        
        C:\windows\hosts.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:724
      - C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Windows\W_X_C.vbs"
        6⤵
        Adds policy Run key to start application
        
        PID:4604
    - - C:\Windows\SysWOW64\REG.exe
        
        REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
        5⤵
        Modifies registry key
        
        PID:1412
    - - C:\Windows\SysWOW64\REG.exe
        
        REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
        5⤵
        Modifies registry key
        
        PID:4320
    - - C:\Windows\SysWOW64\REG.exe
        
        REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
        5⤵
        Modifies registry key
        
        PID:3804
    - - C:\Windows\SysWOW64\REG.exe
        
        REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
        5⤵
        Modifies registry key
        
        PID:4964
  - - C:\Windows\SysWOW64\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Windows\W_X_C.vbs"
      4⤵
      Adds policy Run key to start application
      PID:2324
- - C:\Windows\SysWOW64\REG.exe
    REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
    3⤵
    - Modifies registry key
    PID:1992
- - C:\Windows\SysWOW64\REG.exe
    REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
    3⤵
    - Modifies registry key
    PID:2160
- - C:\Windows\SysWOW64\REG.exe
    REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
    3⤵
    - Modifies registry key
    PID:400
- - C:\Windows\SysWOW64\REG.exe
    REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
    3⤵
    - Modifies registry key
    PID:4520
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c c:\windows\W_X_C.bat
  2⤵
  - Checks computer location settings
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:5076
- - C:\windows\hosts.exe
    C:\windows\hosts.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:4976
- - C:\Windows\SysWOW64\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Windows\W_X_C.vbs"
    3⤵
    - Adds policy Run key to start application
    PID:4840

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:3972

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Hidden Files and Directories

T1158

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Hidden Files and Directories

T1158

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\avscan.exe

Filesize
241KB

MD5
962c7eba6bdbb72b2598514b4f4ba0c8

SHA1
190c003fbacb23ef59391942c34e0ee832c8ef15

SHA256
86b15861fc8d7762b7ee0071b3421533b6e0e45dd19e345a74bd12c9aed14084

SHA512
d26dbd793e23c63aa128c44500cdc3d124b03e0c5a0f20c6ad1ecc22caa02d4b992276816256bd235c5a9522f00d5f8507b43611bd6aafccc896500edfdaa15e

Download Submit
C:\Users\Admin\AppData\Local\Temp\avscan.exe

Filesize
241KB

MD5
962c7eba6bdbb72b2598514b4f4ba0c8

SHA1
190c003fbacb23ef59391942c34e0ee832c8ef15

SHA256
86b15861fc8d7762b7ee0071b3421533b6e0e45dd19e345a74bd12c9aed14084

SHA512
d26dbd793e23c63aa128c44500cdc3d124b03e0c5a0f20c6ad1ecc22caa02d4b992276816256bd235c5a9522f00d5f8507b43611bd6aafccc896500edfdaa15e

Download Submit
C:\Users\Admin\AppData\Local\Temp\avscan.exe

Filesize
241KB

MD5
962c7eba6bdbb72b2598514b4f4ba0c8

SHA1
190c003fbacb23ef59391942c34e0ee832c8ef15

SHA256
86b15861fc8d7762b7ee0071b3421533b6e0e45dd19e345a74bd12c9aed14084

SHA512
d26dbd793e23c63aa128c44500cdc3d124b03e0c5a0f20c6ad1ecc22caa02d4b992276816256bd235c5a9522f00d5f8507b43611bd6aafccc896500edfdaa15e

Download Submit
C:\Users\Admin\AppData\Local\Temp\avscan.exe

Filesize
241KB

MD5
962c7eba6bdbb72b2598514b4f4ba0c8

SHA1
190c003fbacb23ef59391942c34e0ee832c8ef15

SHA256
86b15861fc8d7762b7ee0071b3421533b6e0e45dd19e345a74bd12c9aed14084

SHA512
d26dbd793e23c63aa128c44500cdc3d124b03e0c5a0f20c6ad1ecc22caa02d4b992276816256bd235c5a9522f00d5f8507b43611bd6aafccc896500edfdaa15e

Download Submit
C:\Windows\W_X_C.vbs

Filesize
195B

MD5
0e0483d4802632100b6bfe8bc2e5d661

SHA1
767e0deb7dcaa7676004e6053957c36cecfeeefa

SHA256
81bbebb8d0e77ffffbc7b7d24afdcdce4089f4b04d1a12284eda861c25e03f9f

SHA512
8279b0559ca30a0adc6c8614870c3e445866c20f0617a7153cab41982b451dfe9ea44478f37b884465235714623ef26a56f5ea3d1cb81767487c494d3703ab29

Download Submit
C:\Windows\hosts.exe

Filesize
241KB

MD5
e4050ca11096ddac6011453660de0f7e

SHA1
6d28b66690ed5ff2c0320028184e6d1087546843

SHA256
16e35ebab697f5ec64bfab030aea267aa1d2f046021c88291a6e4bb69e5fc0a9

SHA512
cd8941a8259b79037e52258f54263979788e0af6808a17bade685c09e1bdb484a5be41bb6ffb477c53b1bc78e5404080f86186a52dfc4a2dd5ed53c14071404f

Download Submit
C:\Windows\hosts.exe

Filesize
241KB

MD5
e4050ca11096ddac6011453660de0f7e

SHA1
6d28b66690ed5ff2c0320028184e6d1087546843

SHA256
16e35ebab697f5ec64bfab030aea267aa1d2f046021c88291a6e4bb69e5fc0a9

SHA512
cd8941a8259b79037e52258f54263979788e0af6808a17bade685c09e1bdb484a5be41bb6ffb477c53b1bc78e5404080f86186a52dfc4a2dd5ed53c14071404f

Download Submit
C:\Windows\hosts.exe

Filesize
241KB

MD5
e4050ca11096ddac6011453660de0f7e

SHA1
6d28b66690ed5ff2c0320028184e6d1087546843

SHA256
16e35ebab697f5ec64bfab030aea267aa1d2f046021c88291a6e4bb69e5fc0a9

SHA512
cd8941a8259b79037e52258f54263979788e0af6808a17bade685c09e1bdb484a5be41bb6ffb477c53b1bc78e5404080f86186a52dfc4a2dd5ed53c14071404f

Download Submit
C:\Windows\hosts.exe

Filesize
241KB

MD5
e4050ca11096ddac6011453660de0f7e

SHA1
6d28b66690ed5ff2c0320028184e6d1087546843

SHA256
16e35ebab697f5ec64bfab030aea267aa1d2f046021c88291a6e4bb69e5fc0a9

SHA512
cd8941a8259b79037e52258f54263979788e0af6808a17bade685c09e1bdb484a5be41bb6ffb477c53b1bc78e5404080f86186a52dfc4a2dd5ed53c14071404f

Download Submit
C:\windows\hosts.exe

Filesize
241KB

MD5
e4050ca11096ddac6011453660de0f7e

SHA1
6d28b66690ed5ff2c0320028184e6d1087546843

SHA256
16e35ebab697f5ec64bfab030aea267aa1d2f046021c88291a6e4bb69e5fc0a9

SHA512
cd8941a8259b79037e52258f54263979788e0af6808a17bade685c09e1bdb484a5be41bb6ffb477c53b1bc78e5404080f86186a52dfc4a2dd5ed53c14071404f

Download Submit
\??\c:\windows\W_X_C.bat

Filesize
336B

MD5
4db9f8b6175722b62ececeeeba1ce307

SHA1
3b3ba8414706e72a6fa19e884a97b87609e11e47

SHA256
d2150b9e5a4ce55e140f0ca91c4e300715d42095c8fddf58c77037cdd2cfaf78

SHA512
1d6dc274cf7a3dd704f840e6a5ad57ab4c4e35d5f09489aeff520bb797e1c825bac53fc335156fe41e767a46520d031855fe42fe7b175409ebe5e9e986fb9b8b

Download Submit
memory/400-174-0x0000000000000000-mapping.dmp

Download
memory/724-165-0x0000000000000000-mapping.dmp

Download
memory/944-135-0x0000000000000000-mapping.dmp

Download
memory/1012-141-0x0000000000000000-mapping.dmp

Download
memory/1412-171-0x0000000000000000-mapping.dmp

Download
memory/1992-170-0x0000000000000000-mapping.dmp

Download
memory/2160-172-0x0000000000000000-mapping.dmp

Download
memory/2256-134-0x0000000000000000-mapping.dmp

Download
memory/2260-154-0x0000000000000000-mapping.dmp

Download
memory/2288-145-0x0000000000000000-mapping.dmp

Download
memory/2324-163-0x0000000000000000-mapping.dmp

Download
memory/3272-162-0x0000000000000000-mapping.dmp

Download
memory/3732-148-0x0000000000000000-mapping.dmp

Download
memory/3804-175-0x0000000000000000-mapping.dmp

Download
memory/4320-173-0x0000000000000000-mapping.dmp

Download
memory/4520-176-0x0000000000000000-mapping.dmp

Download
memory/4604-169-0x0000000000000000-mapping.dmp

Download
memory/4840-164-0x0000000000000000-mapping.dmp

Download
memory/4964-177-0x0000000000000000-mapping.dmp

Download
memory/4976-153-0x0000000000000000-mapping.dmp

Download
memory/5076-146-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads