14d714a58c70a002a1dc790b32dcda98658d23fda260c282ce21edd014f40f88

Analysis

max time kernel
126s
max time network
39s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
07/11/2022, 18:23

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

14d714a58c70a002a1dc790b32dcda98658d23fda260c282ce21edd014f40f88.exe
Size

351KB
MD5

0e48a80ea90bc0b2493a18af347e55c0
SHA1

e3a981c17307dbe73a2f4011559d1bed29a53391
SHA256

14d714a58c70a002a1dc790b32dcda98658d23fda260c282ce21edd014f40f88
SHA512

ad34a74f8ee903ac1b868b98b27122f8c6f28ded808bb79595ed639546eeeeffa6957eaf38870437710736dba4c652d482ec2f1c3238db507e65340f9b4282be
SSDEEP

3072:obpDCw1p3vmLvsZIaVwiwDcIbDHDCmHV5F11Z++M42bpDCw1p3vmLvsZIaVwiwDw:gDCwfG1bnxHXG+MfDCwfG1bnxHXG+MX

Score

10^/10

evasion persistence

Malware Config

Signatures

Modifies visibility of file extensions in Explorer 2 TTPs 3 IoCs

evasion

Hidden Files and Directories

T1158

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	14d714a58c70a002a1dc790b32dcda98658d23fda260c282ce21edd014f40f88.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	avscan.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	hosts.exe

Modifies visiblity of hidden/system files in Explorer 2 TTPs 3 IoCs

evasion

Hidden Files and Directories

T1158

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	avscan.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	hosts.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	14d714a58c70a002a1dc790b32dcda98658d23fda260c282ce21edd014f40f88.exe

Adds policy Run key to start application 2 TTPs 6 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	WScript.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\ORXGKKZC = "W_X_C.bat"	WScript.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\ORXGKKZC = "W_X_C.bat"	WScript.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	WScript.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\ORXGKKZC = "W_X_C.bat"	WScript.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	WScript.exe

Executes dropped EXE 6 IoCs

pid	Process
1416	avscan.exe
1328	avscan.exe
1736	hosts.exe
824	hosts.exe
1612	avscan.exe
1976	hosts.exe

Loads dropped DLL 5 IoCs

pid	Process
836	14d714a58c70a002a1dc790b32dcda98658d23fda260c282ce21edd014f40f88.exe
836	14d714a58c70a002a1dc790b32dcda98658d23fda260c282ce21edd014f40f88.exe
1416	avscan.exe
1736	hosts.exe
1736	hosts.exe

Adds Run key to start application 2 TTPs 6 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run	hosts.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\avscan = "C:\\Users\\Admin\\AppData\\Local\\Temp\\avscan.exe"	hosts.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run	14d714a58c70a002a1dc790b32dcda98658d23fda260c282ce21edd014f40f88.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\avscan = "C:\\Users\\Admin\\AppData\\Local\\Temp\\avscan.exe"	14d714a58c70a002a1dc790b32dcda98658d23fda260c282ce21edd014f40f88.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run	avscan.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\avscan = "C:\\Users\\Admin\\AppData\\Local\\Temp\\avscan.exe"	avscan.exe

Drops file in Windows directory 5 IoCs

description	ioc	Process
File created	C:\windows\W_X_C.vbs	14d714a58c70a002a1dc790b32dcda98658d23fda260c282ce21edd014f40f88.exe
File created	\??\c:\windows\W_X_C.bat	14d714a58c70a002a1dc790b32dcda98658d23fda260c282ce21edd014f40f88.exe
File opened for modification	C:\Windows\hosts.exe	14d714a58c70a002a1dc790b32dcda98658d23fda260c282ce21edd014f40f88.exe
File opened for modification	C:\Windows\hosts.exe	avscan.exe
File opened for modification	C:\Windows\hosts.exe	hosts.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies registry key 1 TTPs 9 IoCs

Modify Registry

T1112

pid	Process
1964	REG.exe
1872	REG.exe
1968	REG.exe
952	REG.exe
1932	REG.exe
2040	REG.exe
1456	REG.exe
1800	REG.exe
1532	REG.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

pid	Process
1416	avscan.exe
1736	hosts.exe

Suspicious use of SetWindowsHookEx 7 IoCs

pid	Process
836	14d714a58c70a002a1dc790b32dcda98658d23fda260c282ce21edd014f40f88.exe
1416	avscan.exe
1328	avscan.exe
1736	hosts.exe
824	hosts.exe
1612	avscan.exe
1976	hosts.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 836 wrote to memory of 1964	836	14d714a58c70a002a1dc790b32dcda98658d23fda260c282ce21edd014f40f88.exe	27
PID 836 wrote to memory of 1964	836	14d714a58c70a002a1dc790b32dcda98658d23fda260c282ce21edd014f40f88.exe	27
PID 836 wrote to memory of 1964	836	14d714a58c70a002a1dc790b32dcda98658d23fda260c282ce21edd014f40f88.exe	27
PID 836 wrote to memory of 1964	836	14d714a58c70a002a1dc790b32dcda98658d23fda260c282ce21edd014f40f88.exe	27
PID 836 wrote to memory of 1416	836	14d714a58c70a002a1dc790b32dcda98658d23fda260c282ce21edd014f40f88.exe	29
PID 836 wrote to memory of 1416	836	14d714a58c70a002a1dc790b32dcda98658d23fda260c282ce21edd014f40f88.exe	29
PID 836 wrote to memory of 1416	836	14d714a58c70a002a1dc790b32dcda98658d23fda260c282ce21edd014f40f88.exe	29
PID 836 wrote to memory of 1416	836	14d714a58c70a002a1dc790b32dcda98658d23fda260c282ce21edd014f40f88.exe	29
PID 1416 wrote to memory of 1328	1416	avscan.exe	30
PID 1416 wrote to memory of 1328	1416	avscan.exe	30
PID 1416 wrote to memory of 1328	1416	avscan.exe	30
PID 1416 wrote to memory of 1328	1416	avscan.exe	30
PID 1416 wrote to memory of 1300	1416	avscan.exe	31
PID 1416 wrote to memory of 1300	1416	avscan.exe	31
PID 1416 wrote to memory of 1300	1416	avscan.exe	31
PID 1416 wrote to memory of 1300	1416	avscan.exe	31
PID 836 wrote to memory of 1700	836	14d714a58c70a002a1dc790b32dcda98658d23fda260c282ce21edd014f40f88.exe	32
PID 836 wrote to memory of 1700	836	14d714a58c70a002a1dc790b32dcda98658d23fda260c282ce21edd014f40f88.exe	32
PID 836 wrote to memory of 1700	836	14d714a58c70a002a1dc790b32dcda98658d23fda260c282ce21edd014f40f88.exe	32
PID 836 wrote to memory of 1700	836	14d714a58c70a002a1dc790b32dcda98658d23fda260c282ce21edd014f40f88.exe	32
PID 1700 wrote to memory of 1736	1700	cmd.exe	35
PID 1700 wrote to memory of 1736	1700	cmd.exe	35
PID 1700 wrote to memory of 1736	1700	cmd.exe	35
PID 1700 wrote to memory of 1736	1700	cmd.exe	35
PID 1300 wrote to memory of 824	1300	cmd.exe	36
PID 1300 wrote to memory of 824	1300	cmd.exe	36
PID 1300 wrote to memory of 824	1300	cmd.exe	36
PID 1300 wrote to memory of 824	1300	cmd.exe	36
PID 1736 wrote to memory of 1612	1736	hosts.exe	37
PID 1736 wrote to memory of 1612	1736	hosts.exe	37
PID 1736 wrote to memory of 1612	1736	hosts.exe	37
PID 1736 wrote to memory of 1612	1736	hosts.exe	37
PID 1736 wrote to memory of 1072	1736	hosts.exe	38
PID 1736 wrote to memory of 1072	1736	hosts.exe	38
PID 1736 wrote to memory of 1072	1736	hosts.exe	38
PID 1736 wrote to memory of 1072	1736	hosts.exe	38
PID 1072 wrote to memory of 1976	1072	cmd.exe	40
PID 1072 wrote to memory of 1976	1072	cmd.exe	40
PID 1072 wrote to memory of 1976	1072	cmd.exe	40
PID 1072 wrote to memory of 1976	1072	cmd.exe	40
PID 1300 wrote to memory of 1536	1300	cmd.exe	41
PID 1300 wrote to memory of 1536	1300	cmd.exe	41
PID 1300 wrote to memory of 1536	1300	cmd.exe	41
PID 1300 wrote to memory of 1536	1300	cmd.exe	41
PID 1700 wrote to memory of 1448	1700	cmd.exe	42
PID 1700 wrote to memory of 1448	1700	cmd.exe	42
PID 1700 wrote to memory of 1448	1700	cmd.exe	42
PID 1700 wrote to memory of 1448	1700	cmd.exe	42
PID 1072 wrote to memory of 1108	1072	cmd.exe	43
PID 1072 wrote to memory of 1108	1072	cmd.exe	43
PID 1072 wrote to memory of 1108	1072	cmd.exe	43
PID 1072 wrote to memory of 1108	1072	cmd.exe	43
PID 1416 wrote to memory of 1872	1416	avscan.exe	44
PID 1416 wrote to memory of 1872	1416	avscan.exe	44
PID 1416 wrote to memory of 1872	1416	avscan.exe	44
PID 1416 wrote to memory of 1872	1416	avscan.exe	44
PID 1736 wrote to memory of 1932	1736	hosts.exe	46
PID 1736 wrote to memory of 1932	1736	hosts.exe	46
PID 1736 wrote to memory of 1932	1736	hosts.exe	46
PID 1736 wrote to memory of 1932	1736	hosts.exe	46
PID 1416 wrote to memory of 1968	1416	avscan.exe	48
PID 1416 wrote to memory of 1968	1416	avscan.exe	48
PID 1416 wrote to memory of 1968	1416	avscan.exe	48
PID 1416 wrote to memory of 1968	1416	avscan.exe	48

C:\Users\Admin\AppData\Local\Temp\14d714a58c70a002a1dc790b32dcda98658d23fda260c282ce21edd014f40f88.exe
"C:\Users\Admin\AppData\Local\Temp\14d714a58c70a002a1dc790b32dcda98658d23fda260c282ce21edd014f40f88.exe"
1⤵
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- Loads dropped DLL
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:836
- C:\Windows\SysWOW64\REG.exe
  REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
  2⤵
  - Modifies registry key
  PID:1964
- C:\Users\Admin\AppData\Local\Temp\avscan.exe
  C:\Users\Admin\AppData\Local\Temp\avscan.exe
  2⤵
  - Modifies visibility of file extensions in Explorer
  - Modifies visiblity of hidden/system files in Explorer
  - Executes dropped EXE
  - Loads dropped DLL
  - Adds Run key to start application
  - Drops file in Windows directory
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1416
- - C:\Users\Admin\AppData\Local\Temp\avscan.exe
    C:\Users\Admin\AppData\Local\Temp\avscan.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1328
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c c:\windows\W_X_C.bat
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1300
  - - C:\windows\hosts.exe
      C:\windows\hosts.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:824
  - - C:\Windows\SysWOW64\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Windows\W_X_C.vbs"
      4⤵
      Adds policy Run key to start application
      PID:1536
- - C:\Windows\SysWOW64\REG.exe
    REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
    3⤵
    - Modifies registry key
    PID:1872
- - C:\Windows\SysWOW64\REG.exe
    REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
    3⤵
    - Modifies registry key
    PID:1968
- - C:\Windows\SysWOW64\REG.exe
    REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
    3⤵
    - Modifies registry key
    PID:1456
- - C:\Windows\SysWOW64\REG.exe
    REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
    3⤵
    - Modifies registry key
    PID:1532
- C:\Windows\SysWOW64\cmd.exe
  cmd /c c:\windows\W_X_C.bat
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1700
- - C:\windows\hosts.exe
    C:\windows\hosts.exe
    3⤵
    - Modifies visibility of file extensions in Explorer
    - Modifies visiblity of hidden/system files in Explorer
    - Executes dropped EXE
    - Loads dropped DLL
    - Adds Run key to start application
    - Drops file in Windows directory
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:1736
  - - C:\Users\Admin\AppData\Local\Temp\avscan.exe
      C:\Users\Admin\AppData\Local\Temp\avscan.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1612
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c c:\windows\W_X_C.bat
      4⤵
      Suspicious use of WriteProcessMemory
      PID:1072
    - - C:\windows\hosts.exe
        
        C:\windows\hosts.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1976
    - - C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Windows\W_X_C.vbs"
        5⤵
        Adds policy Run key to start application
        
        PID:1108
  - - C:\Windows\SysWOW64\REG.exe
      REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
      4⤵
      Modifies registry key
      PID:1932
  - - C:\Windows\SysWOW64\REG.exe
      REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
      4⤵
      Modifies registry key
      PID:2040
  - - C:\Windows\SysWOW64\REG.exe
      REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
      4⤵
      Modifies registry key
      PID:1800
  - - C:\Windows\SysWOW64\REG.exe
      REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
      4⤵
      Modifies registry key
      PID:952
- - C:\Windows\SysWOW64\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Windows\W_X_C.vbs"
    3⤵
    - Adds policy Run key to start application
    PID:1448

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Hidden Files and Directories

T1158

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Hidden Files and Directories

T1158

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Admin.bmp

Filesize
750KB

MD5
d8493e38cafccbbc867bfb9bd9c96f7f

SHA1
79853b777259e3036bff09eacc31c81883747b1e

SHA256
4c2b0a50518691c88b93e9b09bfbb7c5da804a380a498e56a31d13e5dfcdd6b5

SHA512
5c6349d12b40f7c86105cd172241006558bb9c963b008ef0cc36242d39d26840762f158cf5c267409168362585d46cbadabed19d84cc1e2d51d2836c7f82dac3

Download Submit
C:\Users\Admin\AppData\Local\Temp\Admin.bmp

Filesize
1.1MB

MD5
80a7cebeecba8564581333316d58fff1

SHA1
e1a560d30b461943bf3384fc062e1812220288bf

SHA256
089fabbef56906231768017b8283698548594bee55b012c80a8f8b1d63742a0f

SHA512
c565afed483c2a748ffd3fd4249af4bcc277c2f1b0e733aed704e1944c456075355af3115d6d146014523ea33b956eb4108996f7bf5d17df871c01a4a660e658

Download Submit
C:\Users\Admin\AppData\Local\Temp\Admin.bmp

Filesize
1.4MB

MD5
6bac9b0ac59fcbdf29f98d645572d749

SHA1
a94ca9d85c525cf22ba35d5743226e93c06fa065

SHA256
b351e99e20769584627d40d3b8df5ae99c01e7f9e00858f1e14b81f67e055b4d

SHA512
9c949175c1b0b987724372eba145c07316e147550a3e24b61ac41f386a249f89ed0589dfa6f5c1d31327b93ed9e6faf71122b26af8bb3a5911acf4931b693abb

Download Submit
C:\Users\Admin\AppData\Local\Temp\Admin.bmp

Filesize
1.8MB

MD5
d2feb1a7754b2f159df704a5643d2ba4

SHA1
442ec88b80b3a300bd547725619593efa486b668

SHA256
5827b71af5522d45928f07916ff34cd50474d193f3b75aff54aa067c26202ec8

SHA512
102ce974a526959d29e96224f2b8213ed8d7cc7935fa6f7e67c185df75d89dc147a7d6b9b84e0ba0eb97b7ecba4db0704cc38ae8498116819c87284d58f80473

Download Submit
C:\Users\Admin\AppData\Local\Temp\Admin.bmp

Filesize
2.1MB

MD5
70bee04a55b564ef26cace41df18a3ab

SHA1
1b2ccf286bcf0fc47d583e0861470d2eb28f2dc5

SHA256
985130a8217958cf5d049d55a610720af71e86c29cec941a2a8843112bf94fde

SHA512
54f4883371c33249f7dc2d0dce24d2d69d03acc614efda65f6442794da274be187aa2b24342478ee27a7e46bd6a1a9c090bee5d3c1217e40d31babcce0dac00c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Admin.bmp

Filesize
2.4MB

MD5
137b227d066de5f55e08a9f637e91240

SHA1
7d6d33d1b5f8ca41e669e51de5c899b7cc59e33c

SHA256
860dea39f7ec85d037cf762f86c67d73d307abfc673b56f6775657839504f8dd

SHA512
9fead3a7d2f79d615fd2c1ef8d0f5144039420e3312c8bc5a46c75b8a61a4a90bf9c5ab9c0bb02a1e2560510efe047ef6a5eb37040b78d81eafe4c574a43bccc

Download Submit
C:\Users\Admin\AppData\Local\Temp\Admin.bmp

Filesize
2.8MB

MD5
87b310f2e208936433636e33ac6fc0ca

SHA1
9a1856be983796f376ea2849bc68656140ed3c6c

SHA256
a02187f34bc143a57cb7a13eb4db78b7974a2a2b650550834afb2e74302a17c2

SHA512
8ef15df19395a3d722970be447b3b6f2218608435b058956d13385f90c0aa47b46479b358f5898ee0fe4baf531e76fd06feec6e66fdf6c029c993da05f2c5edc

Download Submit
C:\Users\Admin\AppData\Local\Temp\avscan.exe

Filesize
351KB

MD5
5194d5b1de13a77512a5c5e887da7be7

SHA1
5a296cab03b3d146ffb4aaa579ac94c7f82e0630

SHA256
458d24f560273c0f0ad38f578d4e35cda5bd4c672a22723836d1ceefd68f6d06

SHA512
6cd3fe934d128f527f0c16e35857eafe71b90b772dfba6df916e8de67d915bfb3506bea142430dbc9ed09c377b51d1046e472348cb2ce7d11d132e6c213d89c2

Download Submit
C:\Users\Admin\AppData\Local\Temp\avscan.exe

Filesize
351KB

MD5
5194d5b1de13a77512a5c5e887da7be7

SHA1
5a296cab03b3d146ffb4aaa579ac94c7f82e0630

SHA256
458d24f560273c0f0ad38f578d4e35cda5bd4c672a22723836d1ceefd68f6d06

SHA512
6cd3fe934d128f527f0c16e35857eafe71b90b772dfba6df916e8de67d915bfb3506bea142430dbc9ed09c377b51d1046e472348cb2ce7d11d132e6c213d89c2

Download Submit
C:\Users\Admin\AppData\Local\Temp\avscan.exe

Filesize
351KB

MD5
5194d5b1de13a77512a5c5e887da7be7

SHA1
5a296cab03b3d146ffb4aaa579ac94c7f82e0630

SHA256
458d24f560273c0f0ad38f578d4e35cda5bd4c672a22723836d1ceefd68f6d06

SHA512
6cd3fe934d128f527f0c16e35857eafe71b90b772dfba6df916e8de67d915bfb3506bea142430dbc9ed09c377b51d1046e472348cb2ce7d11d132e6c213d89c2

Download Submit
C:\Users\Admin\AppData\Local\Temp\avscan.exe

Filesize
351KB

MD5
5194d5b1de13a77512a5c5e887da7be7

SHA1
5a296cab03b3d146ffb4aaa579ac94c7f82e0630

SHA256
458d24f560273c0f0ad38f578d4e35cda5bd4c672a22723836d1ceefd68f6d06

SHA512
6cd3fe934d128f527f0c16e35857eafe71b90b772dfba6df916e8de67d915bfb3506bea142430dbc9ed09c377b51d1046e472348cb2ce7d11d132e6c213d89c2

Download Submit
C:\Windows\W_X_C.vbs

Filesize
195B

MD5
6cb1a862c5d3015502be64b07c6b5ec7

SHA1
055b4b97bd55f4f0f47fd8c981fc216709e91936

SHA256
6ae3ae6c1d057e9376efd0711d9912dfddebd9f8a8b257cee104cba98195c48e

SHA512
5f8f0cdbbd70f06bc8783c0e762208a3c54daf0f2b064abd450116cb31963d0802bc59648e868d647031e0e321d151a20f1b71ccba613f6e1c0c7fbb7ee974ab

Download Submit
C:\Windows\hosts.exe

Filesize
351KB

MD5
5f4b1c015f1466894f4c6e5c8f416073

SHA1
0a2fe3df92e0b2364acf1592027841db5b34ec92

SHA256
860373f8d777d654ac97f934b41006d1462a8db0b4f947b47401300de64c82e1

SHA512
8fe79bf667735495f6798cc83346f685b03cb700edf32be4c6424857a174f8eed0d94ed7087327e45e31b7ca9cedacbf0d8577cd454de2b5f7fec0f2e9ba4d4f

Download Submit
C:\Windows\hosts.exe

Filesize
351KB

MD5
5f4b1c015f1466894f4c6e5c8f416073

SHA1
0a2fe3df92e0b2364acf1592027841db5b34ec92

SHA256
860373f8d777d654ac97f934b41006d1462a8db0b4f947b47401300de64c82e1

SHA512
8fe79bf667735495f6798cc83346f685b03cb700edf32be4c6424857a174f8eed0d94ed7087327e45e31b7ca9cedacbf0d8577cd454de2b5f7fec0f2e9ba4d4f

Download Submit
C:\Windows\hosts.exe

Filesize
351KB

MD5
5f4b1c015f1466894f4c6e5c8f416073

SHA1
0a2fe3df92e0b2364acf1592027841db5b34ec92

SHA256
860373f8d777d654ac97f934b41006d1462a8db0b4f947b47401300de64c82e1

SHA512
8fe79bf667735495f6798cc83346f685b03cb700edf32be4c6424857a174f8eed0d94ed7087327e45e31b7ca9cedacbf0d8577cd454de2b5f7fec0f2e9ba4d4f

Download Submit
C:\Windows\hosts.exe

Filesize
351KB

MD5
5f4b1c015f1466894f4c6e5c8f416073

SHA1
0a2fe3df92e0b2364acf1592027841db5b34ec92

SHA256
860373f8d777d654ac97f934b41006d1462a8db0b4f947b47401300de64c82e1

SHA512
8fe79bf667735495f6798cc83346f685b03cb700edf32be4c6424857a174f8eed0d94ed7087327e45e31b7ca9cedacbf0d8577cd454de2b5f7fec0f2e9ba4d4f

Download Submit
C:\windows\hosts.exe

Filesize
351KB

MD5
5f4b1c015f1466894f4c6e5c8f416073

SHA1
0a2fe3df92e0b2364acf1592027841db5b34ec92

SHA256
860373f8d777d654ac97f934b41006d1462a8db0b4f947b47401300de64c82e1

SHA512
8fe79bf667735495f6798cc83346f685b03cb700edf32be4c6424857a174f8eed0d94ed7087327e45e31b7ca9cedacbf0d8577cd454de2b5f7fec0f2e9ba4d4f

Download Submit
\??\c:\windows\W_X_C.bat

Filesize
336B

MD5
4db9f8b6175722b62ececeeeba1ce307

SHA1
3b3ba8414706e72a6fa19e884a97b87609e11e47

SHA256
d2150b9e5a4ce55e140f0ca91c4e300715d42095c8fddf58c77037cdd2cfaf78

SHA512
1d6dc274cf7a3dd704f840e6a5ad57ab4c4e35d5f09489aeff520bb797e1c825bac53fc335156fe41e767a46520d031855fe42fe7b175409ebe5e9e986fb9b8b

Download Submit
\Users\Admin\AppData\Local\Temp\avscan.exe

Filesize
351KB

MD5
5194d5b1de13a77512a5c5e887da7be7

SHA1
5a296cab03b3d146ffb4aaa579ac94c7f82e0630

SHA256
458d24f560273c0f0ad38f578d4e35cda5bd4c672a22723836d1ceefd68f6d06

SHA512
6cd3fe934d128f527f0c16e35857eafe71b90b772dfba6df916e8de67d915bfb3506bea142430dbc9ed09c377b51d1046e472348cb2ce7d11d132e6c213d89c2

Download Submit
\Users\Admin\AppData\Local\Temp\avscan.exe

Filesize
351KB

MD5
5194d5b1de13a77512a5c5e887da7be7

SHA1
5a296cab03b3d146ffb4aaa579ac94c7f82e0630

SHA256
458d24f560273c0f0ad38f578d4e35cda5bd4c672a22723836d1ceefd68f6d06

SHA512
6cd3fe934d128f527f0c16e35857eafe71b90b772dfba6df916e8de67d915bfb3506bea142430dbc9ed09c377b51d1046e472348cb2ce7d11d132e6c213d89c2

Download Submit
\Users\Admin\AppData\Local\Temp\avscan.exe

Filesize
351KB

MD5
5194d5b1de13a77512a5c5e887da7be7

SHA1
5a296cab03b3d146ffb4aaa579ac94c7f82e0630

SHA256
458d24f560273c0f0ad38f578d4e35cda5bd4c672a22723836d1ceefd68f6d06

SHA512
6cd3fe934d128f527f0c16e35857eafe71b90b772dfba6df916e8de67d915bfb3506bea142430dbc9ed09c377b51d1046e472348cb2ce7d11d132e6c213d89c2

Download Submit
\Users\Admin\AppData\Local\Temp\avscan.exe

Filesize
351KB

MD5
5194d5b1de13a77512a5c5e887da7be7

SHA1
5a296cab03b3d146ffb4aaa579ac94c7f82e0630

SHA256
458d24f560273c0f0ad38f578d4e35cda5bd4c672a22723836d1ceefd68f6d06

SHA512
6cd3fe934d128f527f0c16e35857eafe71b90b772dfba6df916e8de67d915bfb3506bea142430dbc9ed09c377b51d1046e472348cb2ce7d11d132e6c213d89c2

Download Submit
\Users\Admin\AppData\Local\Temp\avscan.exe

Filesize
351KB

MD5
5194d5b1de13a77512a5c5e887da7be7

SHA1
5a296cab03b3d146ffb4aaa579ac94c7f82e0630

SHA256
458d24f560273c0f0ad38f578d4e35cda5bd4c672a22723836d1ceefd68f6d06

SHA512
6cd3fe934d128f527f0c16e35857eafe71b90b772dfba6df916e8de67d915bfb3506bea142430dbc9ed09c377b51d1046e472348cb2ce7d11d132e6c213d89c2

Download Submit
memory/836-58-0x0000000074B91000-0x0000000074B93000-memory.dmp

Filesize
8KB

Download
memory/836-56-0x0000000075AD1000-0x0000000075AD3000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads