49d8995d916d70954f10342a02df7615946cf813fed31134ce40bfd43637261d

Analysis

max time kernel
128s
max time network
47s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
07/11/2022, 18:22

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

49d8995d916d70954f10342a02df7615946cf813fed31134ce40bfd43637261d.exe
Size

222KB
MD5

02a69354c57dbbc3c39cc463efff5b5a
SHA1

b00657df7a66d3d344a023a725bff6908b8ce784
SHA256

49d8995d916d70954f10342a02df7615946cf813fed31134ce40bfd43637261d
SHA512

b6bf45607c5f9b68f3f546a516e8a551f7bbe27bc4e60261b8d972a580e7a34ab6e97f675ea26ac985627d51cd1f75c203a0ba7807bd2110922f329b0c8e3cee
SSDEEP

3072:obpDCw1p3vmLvsZIaVwiwDcIbDHDCm/DER4eQaYG:gDCwfG1bnxLERRNYG

Score

10^/10

evasion persistence

Malware Config

Signatures

Modifies visibility of file extensions in Explorer 2 TTPs 3 IoCs

evasion

Hidden Files and Directories

T1158

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	49d8995d916d70954f10342a02df7615946cf813fed31134ce40bfd43637261d.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	hosts.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	avscan.exe

Modifies visiblity of hidden/system files in Explorer 2 TTPs 3 IoCs

evasion

Hidden Files and Directories

T1158

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	49d8995d916d70954f10342a02df7615946cf813fed31134ce40bfd43637261d.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	hosts.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	avscan.exe

Adds policy Run key to start application 2 TTPs 6 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\ORXGKKZC = "W_X_C.bat"	WScript.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	WScript.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\ORXGKKZC = "W_X_C.bat"	WScript.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	WScript.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	WScript.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\ORXGKKZC = "W_X_C.bat"	WScript.exe

Executes dropped EXE 6 IoCs

pid	Process
1116	avscan.exe
1204	avscan.exe
1680	hosts.exe
2016	hosts.exe
1872	avscan.exe
1708	hosts.exe

Loads dropped DLL 5 IoCs

pid	Process
1184	49d8995d916d70954f10342a02df7615946cf813fed31134ce40bfd43637261d.exe
1184	49d8995d916d70954f10342a02df7615946cf813fed31134ce40bfd43637261d.exe
1116	avscan.exe
2016	hosts.exe
2016	hosts.exe

Adds Run key to start application 2 TTPs 6 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run	hosts.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\avscan = "C:\\Users\\Admin\\AppData\\Local\\Temp\\avscan.exe"	hosts.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run	avscan.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\avscan = "C:\\Users\\Admin\\AppData\\Local\\Temp\\avscan.exe"	avscan.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run	49d8995d916d70954f10342a02df7615946cf813fed31134ce40bfd43637261d.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\avscan = "C:\\Users\\Admin\\AppData\\Local\\Temp\\avscan.exe"	49d8995d916d70954f10342a02df7615946cf813fed31134ce40bfd43637261d.exe

Drops file in Windows directory 5 IoCs

description	ioc	Process
File created	C:\windows\W_X_C.vbs	49d8995d916d70954f10342a02df7615946cf813fed31134ce40bfd43637261d.exe
File created	\??\c:\windows\W_X_C.bat	49d8995d916d70954f10342a02df7615946cf813fed31134ce40bfd43637261d.exe
File opened for modification	C:\Windows\hosts.exe	49d8995d916d70954f10342a02df7615946cf813fed31134ce40bfd43637261d.exe
File opened for modification	C:\Windows\hosts.exe	avscan.exe
File opened for modification	C:\Windows\hosts.exe	hosts.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies registry key 1 TTPs 9 IoCs

Modify Registry

T1112

pid	Process
900	REG.exe
1800	REG.exe
1600	REG.exe
1604	REG.exe
1956	REG.exe
2020	REG.exe
800	REG.exe
1148	REG.exe
1612	REG.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

pid	Process
1116	avscan.exe
2016	hosts.exe

Suspicious use of SetWindowsHookEx 7 IoCs

pid	Process
1184	49d8995d916d70954f10342a02df7615946cf813fed31134ce40bfd43637261d.exe
1116	avscan.exe
1204	avscan.exe
1680	hosts.exe
2016	hosts.exe
1872	avscan.exe
1708	hosts.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1184 wrote to memory of 1800	1184	49d8995d916d70954f10342a02df7615946cf813fed31134ce40bfd43637261d.exe	26
PID 1184 wrote to memory of 1800	1184	49d8995d916d70954f10342a02df7615946cf813fed31134ce40bfd43637261d.exe	26
PID 1184 wrote to memory of 1800	1184	49d8995d916d70954f10342a02df7615946cf813fed31134ce40bfd43637261d.exe	26
PID 1184 wrote to memory of 1800	1184	49d8995d916d70954f10342a02df7615946cf813fed31134ce40bfd43637261d.exe	26
PID 1184 wrote to memory of 1116	1184	49d8995d916d70954f10342a02df7615946cf813fed31134ce40bfd43637261d.exe	28
PID 1184 wrote to memory of 1116	1184	49d8995d916d70954f10342a02df7615946cf813fed31134ce40bfd43637261d.exe	28
PID 1184 wrote to memory of 1116	1184	49d8995d916d70954f10342a02df7615946cf813fed31134ce40bfd43637261d.exe	28
PID 1184 wrote to memory of 1116	1184	49d8995d916d70954f10342a02df7615946cf813fed31134ce40bfd43637261d.exe	28
PID 1116 wrote to memory of 1204	1116	avscan.exe	29
PID 1116 wrote to memory of 1204	1116	avscan.exe	29
PID 1116 wrote to memory of 1204	1116	avscan.exe	29
PID 1116 wrote to memory of 1204	1116	avscan.exe	29
PID 1116 wrote to memory of 2028	1116	avscan.exe	30
PID 1116 wrote to memory of 2028	1116	avscan.exe	30
PID 1116 wrote to memory of 2028	1116	avscan.exe	30
PID 1116 wrote to memory of 2028	1116	avscan.exe	30
PID 1184 wrote to memory of 364	1184	49d8995d916d70954f10342a02df7615946cf813fed31134ce40bfd43637261d.exe	31
PID 1184 wrote to memory of 364	1184	49d8995d916d70954f10342a02df7615946cf813fed31134ce40bfd43637261d.exe	31
PID 1184 wrote to memory of 364	1184	49d8995d916d70954f10342a02df7615946cf813fed31134ce40bfd43637261d.exe	31
PID 1184 wrote to memory of 364	1184	49d8995d916d70954f10342a02df7615946cf813fed31134ce40bfd43637261d.exe	31
PID 2028 wrote to memory of 2016	2028	cmd.exe	34
PID 2028 wrote to memory of 2016	2028	cmd.exe	34
PID 2028 wrote to memory of 2016	2028	cmd.exe	34
PID 2028 wrote to memory of 2016	2028	cmd.exe	34
PID 364 wrote to memory of 1680	364	cmd.exe	35
PID 364 wrote to memory of 1680	364	cmd.exe	35
PID 364 wrote to memory of 1680	364	cmd.exe	35
PID 364 wrote to memory of 1680	364	cmd.exe	35
PID 2016 wrote to memory of 1872	2016	hosts.exe	36
PID 2016 wrote to memory of 1872	2016	hosts.exe	36
PID 2016 wrote to memory of 1872	2016	hosts.exe	36
PID 2016 wrote to memory of 1872	2016	hosts.exe	36
PID 2016 wrote to memory of 1972	2016	hosts.exe	37
PID 2016 wrote to memory of 1972	2016	hosts.exe	37
PID 2016 wrote to memory of 1972	2016	hosts.exe	37
PID 2016 wrote to memory of 1972	2016	hosts.exe	37
PID 364 wrote to memory of 1568	364	cmd.exe	38
PID 364 wrote to memory of 1568	364	cmd.exe	38
PID 364 wrote to memory of 1568	364	cmd.exe	38
PID 364 wrote to memory of 1568	364	cmd.exe	38
PID 2028 wrote to memory of 1352	2028	cmd.exe	39
PID 2028 wrote to memory of 1352	2028	cmd.exe	39
PID 2028 wrote to memory of 1352	2028	cmd.exe	39
PID 2028 wrote to memory of 1352	2028	cmd.exe	39
PID 1972 wrote to memory of 1708	1972	cmd.exe	41
PID 1972 wrote to memory of 1708	1972	cmd.exe	41
PID 1972 wrote to memory of 1708	1972	cmd.exe	41
PID 1972 wrote to memory of 1708	1972	cmd.exe	41
PID 1972 wrote to memory of 1528	1972	cmd.exe	42
PID 1972 wrote to memory of 1528	1972	cmd.exe	42
PID 1972 wrote to memory of 1528	1972	cmd.exe	42
PID 1972 wrote to memory of 1528	1972	cmd.exe	42
PID 1116 wrote to memory of 800	1116	avscan.exe	43
PID 1116 wrote to memory of 800	1116	avscan.exe	43
PID 1116 wrote to memory of 800	1116	avscan.exe	43
PID 1116 wrote to memory of 800	1116	avscan.exe	43
PID 2016 wrote to memory of 1148	2016	hosts.exe	44
PID 2016 wrote to memory of 1148	2016	hosts.exe	44
PID 2016 wrote to memory of 1148	2016	hosts.exe	44
PID 2016 wrote to memory of 1148	2016	hosts.exe	44
PID 1116 wrote to memory of 1600	1116	avscan.exe	47
PID 1116 wrote to memory of 1600	1116	avscan.exe	47
PID 1116 wrote to memory of 1600	1116	avscan.exe	47
PID 1116 wrote to memory of 1600	1116	avscan.exe	47

C:\Users\Admin\AppData\Local\Temp\49d8995d916d70954f10342a02df7615946cf813fed31134ce40bfd43637261d.exe
"C:\Users\Admin\AppData\Local\Temp\49d8995d916d70954f10342a02df7615946cf813fed31134ce40bfd43637261d.exe"
1⤵
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- Loads dropped DLL
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1184
- C:\Windows\SysWOW64\REG.exe
  REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
  2⤵
  - Modifies registry key
  PID:1800
- C:\Users\Admin\AppData\Local\Temp\avscan.exe
  C:\Users\Admin\AppData\Local\Temp\avscan.exe
  2⤵
  - Modifies visibility of file extensions in Explorer
  - Modifies visiblity of hidden/system files in Explorer
  - Executes dropped EXE
  - Loads dropped DLL
  - Adds Run key to start application
  - Drops file in Windows directory
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1116
- - C:\Users\Admin\AppData\Local\Temp\avscan.exe
    C:\Users\Admin\AppData\Local\Temp\avscan.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1204
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c c:\windows\W_X_C.bat
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2028
  - - C:\windows\hosts.exe
      C:\windows\hosts.exe
      4⤵
      Modifies visibility of file extensions in Explorer
      Modifies visiblity of hidden/system files in Explorer
      Executes dropped EXE
      Loads dropped DLL
      Adds Run key to start application
      Drops file in Windows directory
      Suspicious behavior: GetForegroundWindowSpam
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:2016
    - - C:\Users\Admin\AppData\Local\Temp\avscan.exe
        
        C:\Users\Admin\AppData\Local\Temp\avscan.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1872
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd /c c:\windows\W_X_C.bat
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:1972
      - C:\windows\hosts.exe
        
        C:\windows\hosts.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1708
      - C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Windows\W_X_C.vbs"
        6⤵
        Adds policy Run key to start application
        
        PID:1528
    - - C:\Windows\SysWOW64\REG.exe
        
        REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
        5⤵
        Modifies registry key
        
        PID:1148
    - - C:\Windows\SysWOW64\REG.exe
        
        REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
        5⤵
        Modifies registry key
        
        PID:1604
    - - C:\Windows\SysWOW64\REG.exe
        
        REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
        5⤵
        Modifies registry key
        
        PID:1956
    - - C:\Windows\SysWOW64\REG.exe
        
        REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
        5⤵
        Modifies registry key
        
        PID:900
  - - C:\Windows\SysWOW64\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Windows\W_X_C.vbs"
      4⤵
      Adds policy Run key to start application
      PID:1352
- - C:\Windows\SysWOW64\REG.exe
    REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
    3⤵
    - Modifies registry key
    PID:800
- - C:\Windows\SysWOW64\REG.exe
    REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
    3⤵
    - Modifies registry key
    PID:1600
- - C:\Windows\SysWOW64\REG.exe
    REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
    3⤵
    - Modifies registry key
    PID:2020
- - C:\Windows\SysWOW64\REG.exe
    REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
    3⤵
    - Modifies registry key
    PID:1612
- C:\Windows\SysWOW64\cmd.exe
  cmd /c c:\windows\W_X_C.bat
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:364
- - C:\windows\hosts.exe
    C:\windows\hosts.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1680
- - C:\Windows\SysWOW64\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Windows\W_X_C.vbs"
    3⤵
    - Adds policy Run key to start application
    PID:1568

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Hidden Files and Directories

T1158

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Hidden Files and Directories

T1158

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Admin.bmp

Filesize
492KB

MD5
9af81b3b6ff6c88bc5fe456c06d5afcd

SHA1
9d44b44de0a581949f83538fa5cb3f06c983ce3b

SHA256
2ade14c5208647eb132a5a409f836deef56117639e3fe9ed224704828433f03d

SHA512
8dc82c98483fcf0a46442bba7bf14fa5e5e74570e4b45a5fb143277caa8066e6c32bb862dbcde1fb5c3658297cb5a14fdf632652e55dbccb217cf6a3e3893a59

Download Submit
C:\Users\Admin\AppData\Local\Temp\Admin.bmp

Filesize
936KB

MD5
f4de5637a042bf450fd30736ae7a10ec

SHA1
8a491bb7de4aa372bd5e1fd065936387fffca102

SHA256
e7a6f7ce1ff1f7293bd49e7b75672a25e1fc4f1d686954a330714225e769c0d0

SHA512
89dc7159105454f199f264f316c8875d6617cff2a5c737d6635d2d7819c9af461fd51a0fcf0227427d88c85ea9d209725dc2541f2e0ec8a2ced9145ca9adc319

Download Submit
C:\Users\Admin\AppData\Local\Temp\Admin.bmp

Filesize
1.3MB

MD5
aefb03b8c0cff6d767fc965500937804

SHA1
5d1a5248dcf582d15bf7f92b24e94d5114f7322b

SHA256
f9999f9b1fb5712492d6c3447e279e34e91ec142ddcda86ceee4e52560104cd9

SHA512
fd00aa2f9c7bc40f19dc918581e168ec9c71145e98f50df9a3f99564f33797ebbde4cdab824771e00bfd27fe4da9fc69c8cfe3286bfc967f9b5f54de40f2f37c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Admin.bmp

Filesize
1.8MB

MD5
b1ae6310fe94455af9b5270d2ad86f3f

SHA1
7be30fa1394d1223ec7c043c84ca3b14624d394f

SHA256
98e0cd6a8dda607076fb60876384416cc6a2a172ac8db117a666a4dda0e96f2d

SHA512
a4a919c666c197c89ab824c10dd8f1c1b82cd5e126ac308a867ee74b055c20479b75693d47611b8da2002b86c90c8dc1149e6d024a74d723db72e770824162ce

Download Submit
C:\Users\Admin\AppData\Local\Temp\Admin.bmp

Filesize
1.8MB

MD5
a9a6ba3a099d6c46afba0b67510404da

SHA1
d5b15285ba381daf0c587d9c774fee0084457ccf

SHA256
866666f19044184ac9c1b4bea1b34827a9e7d5723833edf530f4bcb6cfe83962

SHA512
0616a5e9ade67f2ca59f4357c838830bfbde32f4ed1e0c1cf21efdc0b9abd4568b99671902307211f7770183d21b26e8936f444dee63cfe5c41b09b010899ed8

Download Submit
C:\Users\Admin\AppData\Local\Temp\avscan.exe

Filesize
222KB

MD5
273b9aa45f10f4b182a56d1bf5cc4124

SHA1
750e2424df98f604dbf3642260c0f19298420980

SHA256
7717a37889e9f0b666e40ab795111399e60e209aecd42b600b98ac616638b667

SHA512
8fc3b21bf152101dd90b9379e5a37ae6c936bf2fbefb67450801d82b993dd6a62fbcb33a58dee70480a8b90c6bd000387c4374e221d31ddd9d9a190633770931

Download Submit
C:\Users\Admin\AppData\Local\Temp\avscan.exe

Filesize
222KB

MD5
273b9aa45f10f4b182a56d1bf5cc4124

SHA1
750e2424df98f604dbf3642260c0f19298420980

SHA256
7717a37889e9f0b666e40ab795111399e60e209aecd42b600b98ac616638b667

SHA512
8fc3b21bf152101dd90b9379e5a37ae6c936bf2fbefb67450801d82b993dd6a62fbcb33a58dee70480a8b90c6bd000387c4374e221d31ddd9d9a190633770931

Download Submit
C:\Users\Admin\AppData\Local\Temp\avscan.exe

Filesize
222KB

MD5
273b9aa45f10f4b182a56d1bf5cc4124

SHA1
750e2424df98f604dbf3642260c0f19298420980

SHA256
7717a37889e9f0b666e40ab795111399e60e209aecd42b600b98ac616638b667

SHA512
8fc3b21bf152101dd90b9379e5a37ae6c936bf2fbefb67450801d82b993dd6a62fbcb33a58dee70480a8b90c6bd000387c4374e221d31ddd9d9a190633770931

Download Submit
C:\Users\Admin\AppData\Local\Temp\avscan.exe

Filesize
222KB

MD5
273b9aa45f10f4b182a56d1bf5cc4124

SHA1
750e2424df98f604dbf3642260c0f19298420980

SHA256
7717a37889e9f0b666e40ab795111399e60e209aecd42b600b98ac616638b667

SHA512
8fc3b21bf152101dd90b9379e5a37ae6c936bf2fbefb67450801d82b993dd6a62fbcb33a58dee70480a8b90c6bd000387c4374e221d31ddd9d9a190633770931

Download Submit
C:\Windows\W_X_C.vbs

Filesize
195B

MD5
6cb1a862c5d3015502be64b07c6b5ec7

SHA1
055b4b97bd55f4f0f47fd8c981fc216709e91936

SHA256
6ae3ae6c1d057e9376efd0711d9912dfddebd9f8a8b257cee104cba98195c48e

SHA512
5f8f0cdbbd70f06bc8783c0e762208a3c54daf0f2b064abd450116cb31963d0802bc59648e868d647031e0e321d151a20f1b71ccba613f6e1c0c7fbb7ee974ab

Download Submit
C:\Windows\hosts.exe

Filesize
222KB

MD5
a018a7fc636d12274ad16bc8c01bd627

SHA1
d0ce730b44fb79345de474f2b1d0eaebc99b976a

SHA256
901450e59d2b90be76d92c88477abbdc7813e90ad2c2f07929d9feebc8b2ddf3

SHA512
02398dc2d5e4a5ade7b13d3e9e714e8f3d15ee2406abc476b6646a7fac60cea60ec8085286f00d9b8b19904c1b58e0b6d783a2bbc2fe69d22637e9594e6e50dd

Download Submit
C:\Windows\hosts.exe

Filesize
222KB

MD5
a018a7fc636d12274ad16bc8c01bd627

SHA1
d0ce730b44fb79345de474f2b1d0eaebc99b976a

SHA256
901450e59d2b90be76d92c88477abbdc7813e90ad2c2f07929d9feebc8b2ddf3

SHA512
02398dc2d5e4a5ade7b13d3e9e714e8f3d15ee2406abc476b6646a7fac60cea60ec8085286f00d9b8b19904c1b58e0b6d783a2bbc2fe69d22637e9594e6e50dd

Download Submit
C:\Windows\hosts.exe

Filesize
222KB

MD5
a018a7fc636d12274ad16bc8c01bd627

SHA1
d0ce730b44fb79345de474f2b1d0eaebc99b976a

SHA256
901450e59d2b90be76d92c88477abbdc7813e90ad2c2f07929d9feebc8b2ddf3

SHA512
02398dc2d5e4a5ade7b13d3e9e714e8f3d15ee2406abc476b6646a7fac60cea60ec8085286f00d9b8b19904c1b58e0b6d783a2bbc2fe69d22637e9594e6e50dd

Download Submit
C:\Windows\hosts.exe

Filesize
222KB

MD5
a018a7fc636d12274ad16bc8c01bd627

SHA1
d0ce730b44fb79345de474f2b1d0eaebc99b976a

SHA256
901450e59d2b90be76d92c88477abbdc7813e90ad2c2f07929d9feebc8b2ddf3

SHA512
02398dc2d5e4a5ade7b13d3e9e714e8f3d15ee2406abc476b6646a7fac60cea60ec8085286f00d9b8b19904c1b58e0b6d783a2bbc2fe69d22637e9594e6e50dd

Download Submit
C:\windows\hosts.exe

Filesize
222KB

MD5
a018a7fc636d12274ad16bc8c01bd627

SHA1
d0ce730b44fb79345de474f2b1d0eaebc99b976a

SHA256
901450e59d2b90be76d92c88477abbdc7813e90ad2c2f07929d9feebc8b2ddf3

SHA512
02398dc2d5e4a5ade7b13d3e9e714e8f3d15ee2406abc476b6646a7fac60cea60ec8085286f00d9b8b19904c1b58e0b6d783a2bbc2fe69d22637e9594e6e50dd

Download Submit
\??\c:\windows\W_X_C.bat

Filesize
336B

MD5
4db9f8b6175722b62ececeeeba1ce307

SHA1
3b3ba8414706e72a6fa19e884a97b87609e11e47

SHA256
d2150b9e5a4ce55e140f0ca91c4e300715d42095c8fddf58c77037cdd2cfaf78

SHA512
1d6dc274cf7a3dd704f840e6a5ad57ab4c4e35d5f09489aeff520bb797e1c825bac53fc335156fe41e767a46520d031855fe42fe7b175409ebe5e9e986fb9b8b

Download Submit
\Users\Admin\AppData\Local\Temp\avscan.exe

Filesize
222KB

MD5
273b9aa45f10f4b182a56d1bf5cc4124

SHA1
750e2424df98f604dbf3642260c0f19298420980

SHA256
7717a37889e9f0b666e40ab795111399e60e209aecd42b600b98ac616638b667

SHA512
8fc3b21bf152101dd90b9379e5a37ae6c936bf2fbefb67450801d82b993dd6a62fbcb33a58dee70480a8b90c6bd000387c4374e221d31ddd9d9a190633770931

Download Submit
\Users\Admin\AppData\Local\Temp\avscan.exe

Filesize
222KB

MD5
273b9aa45f10f4b182a56d1bf5cc4124

SHA1
750e2424df98f604dbf3642260c0f19298420980

SHA256
7717a37889e9f0b666e40ab795111399e60e209aecd42b600b98ac616638b667

SHA512
8fc3b21bf152101dd90b9379e5a37ae6c936bf2fbefb67450801d82b993dd6a62fbcb33a58dee70480a8b90c6bd000387c4374e221d31ddd9d9a190633770931

Download Submit
\Users\Admin\AppData\Local\Temp\avscan.exe

Filesize
222KB

MD5
273b9aa45f10f4b182a56d1bf5cc4124

SHA1
750e2424df98f604dbf3642260c0f19298420980

SHA256
7717a37889e9f0b666e40ab795111399e60e209aecd42b600b98ac616638b667

SHA512
8fc3b21bf152101dd90b9379e5a37ae6c936bf2fbefb67450801d82b993dd6a62fbcb33a58dee70480a8b90c6bd000387c4374e221d31ddd9d9a190633770931

Download Submit
\Users\Admin\AppData\Local\Temp\avscan.exe

Filesize
222KB

MD5
273b9aa45f10f4b182a56d1bf5cc4124

SHA1
750e2424df98f604dbf3642260c0f19298420980

SHA256
7717a37889e9f0b666e40ab795111399e60e209aecd42b600b98ac616638b667

SHA512
8fc3b21bf152101dd90b9379e5a37ae6c936bf2fbefb67450801d82b993dd6a62fbcb33a58dee70480a8b90c6bd000387c4374e221d31ddd9d9a190633770931

Download Submit
\Users\Admin\AppData\Local\Temp\avscan.exe

Filesize
222KB

MD5
273b9aa45f10f4b182a56d1bf5cc4124

SHA1
750e2424df98f604dbf3642260c0f19298420980

SHA256
7717a37889e9f0b666e40ab795111399e60e209aecd42b600b98ac616638b667

SHA512
8fc3b21bf152101dd90b9379e5a37ae6c936bf2fbefb67450801d82b993dd6a62fbcb33a58dee70480a8b90c6bd000387c4374e221d31ddd9d9a190633770931

Download Submit
memory/1184-58-0x0000000074361000-0x0000000074363000-memory.dmp

Filesize
8KB

Download
memory/1184-56-0x0000000074BB1000-0x0000000074BB3000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads