490abd45a6ab106ba5b5b2f2f5febf5330d20cc6191a916f2400864eba1b48f9

Analysis

max time kernel
150s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
07-11-2022 18:22

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

490abd45a6ab106ba5b5b2f2f5febf5330d20cc6191a916f2400864eba1b48f9.exe
Size

212KB
MD5

0cefbca50a38c7eceab0c685084dde2a
SHA1

8669e329abad25eddbcfa0d969f180e3421dab29
SHA256

490abd45a6ab106ba5b5b2f2f5febf5330d20cc6191a916f2400864eba1b48f9
SHA512

c81a1264cfb4b553afbcf0e9c538dea3a9d9b8d52e7441e456b314e70c6f42803974d83ac8232050a3af5d7e384cb4863fd55f0332731f1564ded96ce71ff2f8
SSDEEP

3072:obpDCw1p3vmLvsZIaVwiwDcIbDHDCm/DER4eQ6++M4EE0yxoFwq+hbWX3M:gDCwfG1bnxLERRy+Ml6/q+hKX3M

Score

10^/10

evasion persistence

Malware Config

Signatures

Modifies visibility of file extensions in Explorer 2 TTPs 3 IoCs

evasion

Hidden Files and Directories

T1158

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	490abd45a6ab106ba5b5b2f2f5febf5330d20cc6191a916f2400864eba1b48f9.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	avscan.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	hosts.exe

Modifies visiblity of hidden/system files in Explorer 2 TTPs 3 IoCs

evasion

Hidden Files and Directories

T1158

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	490abd45a6ab106ba5b5b2f2f5febf5330d20cc6191a916f2400864eba1b48f9.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	avscan.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	hosts.exe

Adds policy Run key to start application 2 TTPs 6 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	WScript.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\GBQHURCC = "W_X_C.bat"	WScript.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	WScript.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\GBQHURCC = "W_X_C.bat"	WScript.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	WScript.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\GBQHURCC = "W_X_C.bat"	WScript.exe

Executes dropped EXE 6 IoCs

pid	Process
2920	avscan.exe
4644	avscan.exe
752	hosts.exe
1392	hosts.exe
1080	avscan.exe
1488	hosts.exe

Checks computer location settings 2 TTPs 3 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation	cmd.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation	cmd.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation	cmd.exe

Adds Run key to start application 2 TTPs 6 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run	490abd45a6ab106ba5b5b2f2f5febf5330d20cc6191a916f2400864eba1b48f9.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\avscan = "C:\\Users\\Admin\\AppData\\Local\\Temp\\avscan.exe"	490abd45a6ab106ba5b5b2f2f5febf5330d20cc6191a916f2400864eba1b48f9.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run	avscan.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\avscan = "C:\\Users\\Admin\\AppData\\Local\\Temp\\avscan.exe"	avscan.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run	hosts.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\avscan = "C:\\Users\\Admin\\AppData\\Local\\Temp\\avscan.exe"	hosts.exe

Drops file in Windows directory 5 IoCs

description	ioc	Process
File created	C:\windows\W_X_C.vbs	490abd45a6ab106ba5b5b2f2f5febf5330d20cc6191a916f2400864eba1b48f9.exe
File created	\??\c:\windows\W_X_C.bat	490abd45a6ab106ba5b5b2f2f5febf5330d20cc6191a916f2400864eba1b48f9.exe
File opened for modification	C:\Windows\hosts.exe	490abd45a6ab106ba5b5b2f2f5febf5330d20cc6191a916f2400864eba1b48f9.exe
File opened for modification	C:\Windows\hosts.exe	avscan.exe
File opened for modification	C:\Windows\hosts.exe	hosts.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies registry class 4 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\Local Settings	490abd45a6ab106ba5b5b2f2f5febf5330d20cc6191a916f2400864eba1b48f9.exe
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\Local Settings	cmd.exe

Modifies registry key 1 TTPs 9 IoCs

Modify Registry

T1112

pid	Process
1404	REG.exe
2256	REG.exe
2924	REG.exe
3636	REG.exe
4796	REG.exe
4472	REG.exe
528	REG.exe
2796	REG.exe
4220	REG.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

pid	Process
2920	avscan.exe
1392	hosts.exe

Suspicious use of SetWindowsHookEx 7 IoCs

pid	Process
880	490abd45a6ab106ba5b5b2f2f5febf5330d20cc6191a916f2400864eba1b48f9.exe
2920	avscan.exe
4644	avscan.exe
1392	hosts.exe
752	hosts.exe
1080	avscan.exe
1488	hosts.exe

Suspicious use of WriteProcessMemory 63 IoCs

description	pid	Process	procid_target
PID 880 wrote to memory of 528	880	490abd45a6ab106ba5b5b2f2f5febf5330d20cc6191a916f2400864eba1b48f9.exe	81
PID 880 wrote to memory of 528	880	490abd45a6ab106ba5b5b2f2f5febf5330d20cc6191a916f2400864eba1b48f9.exe	81
PID 880 wrote to memory of 528	880	490abd45a6ab106ba5b5b2f2f5febf5330d20cc6191a916f2400864eba1b48f9.exe	81
PID 880 wrote to memory of 2920	880	490abd45a6ab106ba5b5b2f2f5febf5330d20cc6191a916f2400864eba1b48f9.exe	83
PID 880 wrote to memory of 2920	880	490abd45a6ab106ba5b5b2f2f5febf5330d20cc6191a916f2400864eba1b48f9.exe	83
PID 880 wrote to memory of 2920	880	490abd45a6ab106ba5b5b2f2f5febf5330d20cc6191a916f2400864eba1b48f9.exe	83
PID 2920 wrote to memory of 4644	2920	avscan.exe	84
PID 2920 wrote to memory of 4644	2920	avscan.exe	84
PID 2920 wrote to memory of 4644	2920	avscan.exe	84
PID 2920 wrote to memory of 4500	2920	avscan.exe	85
PID 2920 wrote to memory of 4500	2920	avscan.exe	85
PID 2920 wrote to memory of 4500	2920	avscan.exe	85
PID 880 wrote to memory of 5072	880	490abd45a6ab106ba5b5b2f2f5febf5330d20cc6191a916f2400864eba1b48f9.exe	86
PID 880 wrote to memory of 5072	880	490abd45a6ab106ba5b5b2f2f5febf5330d20cc6191a916f2400864eba1b48f9.exe	86
PID 880 wrote to memory of 5072	880	490abd45a6ab106ba5b5b2f2f5febf5330d20cc6191a916f2400864eba1b48f9.exe	86
PID 5072 wrote to memory of 1392	5072	cmd.exe	90
PID 5072 wrote to memory of 1392	5072	cmd.exe	90
PID 5072 wrote to memory of 1392	5072	cmd.exe	90
PID 4500 wrote to memory of 752	4500	cmd.exe	89
PID 4500 wrote to memory of 752	4500	cmd.exe	89
PID 4500 wrote to memory of 752	4500	cmd.exe	89
PID 1392 wrote to memory of 1080	1392	hosts.exe	91
PID 1392 wrote to memory of 1080	1392	hosts.exe	91
PID 1392 wrote to memory of 1080	1392	hosts.exe	91
PID 1392 wrote to memory of 3668	1392	hosts.exe	93
PID 1392 wrote to memory of 3668	1392	hosts.exe	93
PID 1392 wrote to memory of 3668	1392	hosts.exe	93
PID 4500 wrote to memory of 4452	4500	cmd.exe	95
PID 4500 wrote to memory of 4452	4500	cmd.exe	95
PID 4500 wrote to memory of 4452	4500	cmd.exe	95
PID 5072 wrote to memory of 112	5072	cmd.exe	96
PID 5072 wrote to memory of 112	5072	cmd.exe	96
PID 5072 wrote to memory of 112	5072	cmd.exe	96
PID 3668 wrote to memory of 1488	3668	cmd.exe	97
PID 3668 wrote to memory of 1488	3668	cmd.exe	97
PID 3668 wrote to memory of 1488	3668	cmd.exe	97
PID 3668 wrote to memory of 3172	3668	cmd.exe	98
PID 3668 wrote to memory of 3172	3668	cmd.exe	98
PID 3668 wrote to memory of 3172	3668	cmd.exe	98
PID 2920 wrote to memory of 1404	2920	avscan.exe	100
PID 2920 wrote to memory of 1404	2920	avscan.exe	100
PID 2920 wrote to memory of 1404	2920	avscan.exe	100
PID 1392 wrote to memory of 4220	1392	hosts.exe	102
PID 1392 wrote to memory of 4220	1392	hosts.exe	102
PID 1392 wrote to memory of 4220	1392	hosts.exe	102
PID 2920 wrote to memory of 2256	2920	avscan.exe	104
PID 2920 wrote to memory of 2256	2920	avscan.exe	104
PID 2920 wrote to memory of 2256	2920	avscan.exe	104
PID 1392 wrote to memory of 2924	1392	hosts.exe	106
PID 1392 wrote to memory of 2924	1392	hosts.exe	106
PID 1392 wrote to memory of 2924	1392	hosts.exe	106
PID 2920 wrote to memory of 4796	2920	avscan.exe	116
PID 2920 wrote to memory of 4796	2920	avscan.exe	116
PID 2920 wrote to memory of 4796	2920	avscan.exe	116
PID 1392 wrote to memory of 3636	1392	hosts.exe	114
PID 1392 wrote to memory of 3636	1392	hosts.exe	114
PID 1392 wrote to memory of 3636	1392	hosts.exe	114
PID 2920 wrote to memory of 4472	2920	avscan.exe	119
PID 2920 wrote to memory of 4472	2920	avscan.exe	119
PID 2920 wrote to memory of 4472	2920	avscan.exe	119
PID 1392 wrote to memory of 2796	1392	hosts.exe	118
PID 1392 wrote to memory of 2796	1392	hosts.exe	118
PID 1392 wrote to memory of 2796	1392	hosts.exe	118

C:\Users\Admin\AppData\Local\Temp\490abd45a6ab106ba5b5b2f2f5febf5330d20cc6191a916f2400864eba1b48f9.exe
"C:\Users\Admin\AppData\Local\Temp\490abd45a6ab106ba5b5b2f2f5febf5330d20cc6191a916f2400864eba1b48f9.exe"
1⤵
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- Adds Run key to start application
- Drops file in Windows directory
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:880
- C:\Windows\SysWOW64\REG.exe
  REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
  2⤵
  - Modifies registry key
  PID:528
- C:\Users\Admin\AppData\Local\Temp\avscan.exe
  C:\Users\Admin\AppData\Local\Temp\avscan.exe
  2⤵
  - Modifies visibility of file extensions in Explorer
  - Modifies visiblity of hidden/system files in Explorer
  - Executes dropped EXE
  - Adds Run key to start application
  - Drops file in Windows directory
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2920
- - C:\Users\Admin\AppData\Local\Temp\avscan.exe
    C:\Users\Admin\AppData\Local\Temp\avscan.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:4644
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c c:\windows\W_X_C.bat
    3⤵
    - Checks computer location settings
    - Modifies registry class
    - Suspicious use of WriteProcessMemory
    PID:4500
  - - C:\windows\hosts.exe
      C:\windows\hosts.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:752
  - - C:\Windows\SysWOW64\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Windows\W_X_C.vbs"
      4⤵
      Adds policy Run key to start application
      PID:4452
- - C:\Windows\SysWOW64\REG.exe
    REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
    3⤵
    - Modifies registry key
    PID:1404
- - C:\Windows\SysWOW64\REG.exe
    REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
    3⤵
    - Modifies registry key
    PID:2256
- - C:\Windows\SysWOW64\REG.exe
    REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
    3⤵
    - Modifies registry key
    PID:4796
- - C:\Windows\SysWOW64\REG.exe
    REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
    3⤵
    - Modifies registry key
    PID:4472
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c c:\windows\W_X_C.bat
  2⤵
  - Checks computer location settings
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:5072
- - C:\windows\hosts.exe
    C:\windows\hosts.exe
    3⤵
    - Modifies visibility of file extensions in Explorer
    - Modifies visiblity of hidden/system files in Explorer
    - Executes dropped EXE
    - Adds Run key to start application
    - Drops file in Windows directory
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:1392
  - - C:\Users\Admin\AppData\Local\Temp\avscan.exe
      C:\Users\Admin\AppData\Local\Temp\avscan.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1080
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c c:\windows\W_X_C.bat
      4⤵
      Checks computer location settings
      Modifies registry class
      Suspicious use of WriteProcessMemory
      PID:3668
    - - C:\windows\hosts.exe
        
        C:\windows\hosts.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1488
    - - C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Windows\W_X_C.vbs"
        5⤵
        Adds policy Run key to start application
        
        PID:3172
  - - C:\Windows\SysWOW64\REG.exe
      REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
      4⤵
      Modifies registry key
      PID:4220
  - - C:\Windows\SysWOW64\REG.exe
      REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
      4⤵
      Modifies registry key
      PID:2924
  - - C:\Windows\SysWOW64\REG.exe
      REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
      4⤵
      Modifies registry key
      PID:3636
  - - C:\Windows\SysWOW64\REG.exe
      REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
      4⤵
      Modifies registry key
      PID:2796
- - C:\Windows\SysWOW64\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Windows\W_X_C.vbs"
    3⤵
    - Adds policy Run key to start application
    PID:112

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:3988

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Hidden Files and Directories

T1158

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Hidden Files and Directories

T1158

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\avscan.exe

Filesize
212KB

MD5
6da1f3372fe7a5102e3eeb38628aad6c

SHA1
cf69e79e5e1556ec03505bb28158f7c748898ebe

SHA256
985546d86f511c6acd569fadf063c936e4721301357b2dd93a1672d4b88dec1a

SHA512
3528429babfb8fe635f8b714dc99007e5120d913c7cfd3a48b89e30b9c87f07717eb3aae598f9a92793d0779cd0f4046d374f25177662070fa499e59eb67344e

Download Submit
C:\Users\Admin\AppData\Local\Temp\avscan.exe

Filesize
212KB

MD5
6da1f3372fe7a5102e3eeb38628aad6c

SHA1
cf69e79e5e1556ec03505bb28158f7c748898ebe

SHA256
985546d86f511c6acd569fadf063c936e4721301357b2dd93a1672d4b88dec1a

SHA512
3528429babfb8fe635f8b714dc99007e5120d913c7cfd3a48b89e30b9c87f07717eb3aae598f9a92793d0779cd0f4046d374f25177662070fa499e59eb67344e

Download Submit
C:\Users\Admin\AppData\Local\Temp\avscan.exe

Filesize
212KB

MD5
6da1f3372fe7a5102e3eeb38628aad6c

SHA1
cf69e79e5e1556ec03505bb28158f7c748898ebe

SHA256
985546d86f511c6acd569fadf063c936e4721301357b2dd93a1672d4b88dec1a

SHA512
3528429babfb8fe635f8b714dc99007e5120d913c7cfd3a48b89e30b9c87f07717eb3aae598f9a92793d0779cd0f4046d374f25177662070fa499e59eb67344e

Download Submit
C:\Users\Admin\AppData\Local\Temp\avscan.exe

Filesize
212KB

MD5
6da1f3372fe7a5102e3eeb38628aad6c

SHA1
cf69e79e5e1556ec03505bb28158f7c748898ebe

SHA256
985546d86f511c6acd569fadf063c936e4721301357b2dd93a1672d4b88dec1a

SHA512
3528429babfb8fe635f8b714dc99007e5120d913c7cfd3a48b89e30b9c87f07717eb3aae598f9a92793d0779cd0f4046d374f25177662070fa499e59eb67344e

Download Submit
C:\Windows\W_X_C.vbs

Filesize
195B

MD5
5b87381bf407d7c6018a8b11c3e20f92

SHA1
bb61b28d9c8fd7dfeb13a397c49a1be3abc06ca2

SHA256
4785d6a229d0872fe90c75ab620de9a680d7f07ccd27a134da2afc4ee88f34f3

SHA512
05db1178f671e9d6c3a1c601349093447b04ebddcd071a06f7cc92cbaf7efb53027bc92523a19372a08ca5af715cc9955649255f8be1909b5e594385b3dcbe3d

Download Submit
C:\Windows\hosts.exe

Filesize
212KB

MD5
e208f7dda37fa4802f72e531dfe910b0

SHA1
a973f987dee05ea24a3b7c0a024b1a67c3e3f326

SHA256
38e32fa43332fbe15b21904900e1e2edd782a8b44877979385206be05c29e09b

SHA512
b6b537fa2d8a1a1b71558364363544127420b4840a96f5ec1d3298404a7d845f68b1eb1bd7655542cb1622222279997f4f74760862092e11276bff11f8269b55

Download Submit
C:\Windows\hosts.exe

Filesize
212KB

MD5
e208f7dda37fa4802f72e531dfe910b0

SHA1
a973f987dee05ea24a3b7c0a024b1a67c3e3f326

SHA256
38e32fa43332fbe15b21904900e1e2edd782a8b44877979385206be05c29e09b

SHA512
b6b537fa2d8a1a1b71558364363544127420b4840a96f5ec1d3298404a7d845f68b1eb1bd7655542cb1622222279997f4f74760862092e11276bff11f8269b55

Download Submit
C:\Windows\hosts.exe

Filesize
212KB

MD5
e208f7dda37fa4802f72e531dfe910b0

SHA1
a973f987dee05ea24a3b7c0a024b1a67c3e3f326

SHA256
38e32fa43332fbe15b21904900e1e2edd782a8b44877979385206be05c29e09b

SHA512
b6b537fa2d8a1a1b71558364363544127420b4840a96f5ec1d3298404a7d845f68b1eb1bd7655542cb1622222279997f4f74760862092e11276bff11f8269b55

Download Submit
C:\Windows\hosts.exe

Filesize
212KB

MD5
e208f7dda37fa4802f72e531dfe910b0

SHA1
a973f987dee05ea24a3b7c0a024b1a67c3e3f326

SHA256
38e32fa43332fbe15b21904900e1e2edd782a8b44877979385206be05c29e09b

SHA512
b6b537fa2d8a1a1b71558364363544127420b4840a96f5ec1d3298404a7d845f68b1eb1bd7655542cb1622222279997f4f74760862092e11276bff11f8269b55

Download Submit
C:\windows\hosts.exe

Filesize
212KB

MD5
e208f7dda37fa4802f72e531dfe910b0

SHA1
a973f987dee05ea24a3b7c0a024b1a67c3e3f326

SHA256
38e32fa43332fbe15b21904900e1e2edd782a8b44877979385206be05c29e09b

SHA512
b6b537fa2d8a1a1b71558364363544127420b4840a96f5ec1d3298404a7d845f68b1eb1bd7655542cb1622222279997f4f74760862092e11276bff11f8269b55

Download Submit
\??\c:\windows\W_X_C.bat

Filesize
336B

MD5
4db9f8b6175722b62ececeeeba1ce307

SHA1
3b3ba8414706e72a6fa19e884a97b87609e11e47

SHA256
d2150b9e5a4ce55e140f0ca91c4e300715d42095c8fddf58c77037cdd2cfaf78

SHA512
1d6dc274cf7a3dd704f840e6a5ad57ab4c4e35d5f09489aeff520bb797e1c825bac53fc335156fe41e767a46520d031855fe42fe7b175409ebe5e9e986fb9b8b

Download Submit
memory/112-166-0x0000000000000000-mapping.dmp

Download
memory/528-137-0x0000000000000000-mapping.dmp

Download
memory/752-152-0x0000000000000000-mapping.dmp

Download
memory/1080-160-0x0000000000000000-mapping.dmp

Download
memory/1392-151-0x0000000000000000-mapping.dmp

Download
memory/1404-173-0x0000000000000000-mapping.dmp

Download
memory/1488-168-0x0000000000000000-mapping.dmp

Download
memory/2256-175-0x0000000000000000-mapping.dmp

Download
memory/2796-180-0x0000000000000000-mapping.dmp

Download
memory/2920-138-0x0000000000000000-mapping.dmp

Download
memory/2924-176-0x0000000000000000-mapping.dmp

Download
memory/3172-172-0x0000000000000000-mapping.dmp

Download
memory/3636-178-0x0000000000000000-mapping.dmp

Download
memory/3668-165-0x0000000000000000-mapping.dmp

Download
memory/4220-174-0x0000000000000000-mapping.dmp

Download
memory/4452-167-0x0000000000000000-mapping.dmp

Download
memory/4472-179-0x0000000000000000-mapping.dmp

Download
memory/4500-148-0x0000000000000000-mapping.dmp

Download
memory/4644-144-0x0000000000000000-mapping.dmp

Download
memory/4796-177-0x0000000000000000-mapping.dmp

Download
memory/5072-149-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads