1d0f660959abdd07b7f4002a77e2c33424513fb47fbad7be27f24ee689644c21

Analysis

max time kernel
134s
max time network
46s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
23-11-2022 19:01

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1d0f660959abdd07b7f4002a77e2c33424513fb47fbad7be27f24ee689644c21.exe
Size

339KB
MD5

539c64d71bc9395464850b6183ef641a
SHA1

c09da93b232d660f3d7554a257fefdc8be4678de
SHA256

1d0f660959abdd07b7f4002a77e2c33424513fb47fbad7be27f24ee689644c21
SHA512

b3158d308916e4dbbeeb9019faff7790c2630a95e69f898d5f3ff0ef021750130e681f26c5acd29914abf9b06732785d3f8518e42623d137b707e5c21cbd2005
SSDEEP

3072:obpDCw1p3vmLvsZIaVwiwDcIbDHDCm/DER4eQwbpDCw1p3vmLvsZIaVwiwDcIbDO:gDCwfG1bnxLERR7DCwfG1bnxLERR3

Score

10^/10

evasion persistence

Malware Config

Signatures

Modifies visibility of file extensions in Explorer 2 TTPs 3 IoCs

evasion

Hidden Files and Directories

T1158

Modify Registry

T1112

Processes:

avscan.exehosts.exe1d0f660959abdd07b7f4002a77e2c33424513fb47fbad7be27f24ee689644c21.exe

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	avscan.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	hosts.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	1d0f660959abdd07b7f4002a77e2c33424513fb47fbad7be27f24ee689644c21.exe

Modifies visiblity of hidden/system files in Explorer 2 TTPs 3 IoCs

evasion

Hidden Files and Directories

T1158

Modify Registry

T1112

Processes:

1d0f660959abdd07b7f4002a77e2c33424513fb47fbad7be27f24ee689644c21.exeavscan.exehosts.exe

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	1d0f660959abdd07b7f4002a77e2c33424513fb47fbad7be27f24ee689644c21.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	avscan.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	hosts.exe

Adds policy Run key to start application 2 TTPs 6 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

WScript.exeWScript.exeWScript.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	WScript.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\GRXNNIIE = "W_X_C.bat"	WScript.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	WScript.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\GRXNNIIE = "W_X_C.bat"	WScript.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	WScript.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\GRXNNIIE = "W_X_C.bat"	WScript.exe

Executes dropped EXE 6 IoCs

Processes:

avscan.exeavscan.exehosts.exehosts.exeavscan.exehosts.exe

pid process

1116 avscan.exe
888 avscan.exe
628 hosts.exe
1592 hosts.exe
1068 avscan.exe
1904 hosts.exe

pid	process
1116	avscan.exe
888	avscan.exe
628	hosts.exe
1592	hosts.exe
1068	avscan.exe
1904	hosts.exe

Loads dropped DLL 5 IoCs

Processes:

1d0f660959abdd07b7f4002a77e2c33424513fb47fbad7be27f24ee689644c21.exeavscan.exehosts.exe

pid	process
1968	1d0f660959abdd07b7f4002a77e2c33424513fb47fbad7be27f24ee689644c21.exe
1968	1d0f660959abdd07b7f4002a77e2c33424513fb47fbad7be27f24ee689644c21.exe
1116	avscan.exe
628	hosts.exe
628	hosts.exe

Adds Run key to start application 2 TTPs 6 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

hosts.exe1d0f660959abdd07b7f4002a77e2c33424513fb47fbad7be27f24ee689644c21.exeavscan.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\avscan = "C:\\Users\\Admin\\AppData\\Local\\Temp\\avscan.exe"	hosts.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run	1d0f660959abdd07b7f4002a77e2c33424513fb47fbad7be27f24ee689644c21.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\avscan = "C:\\Users\\Admin\\AppData\\Local\\Temp\\avscan.exe"	1d0f660959abdd07b7f4002a77e2c33424513fb47fbad7be27f24ee689644c21.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run	avscan.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\avscan = "C:\\Users\\Admin\\AppData\\Local\\Temp\\avscan.exe"	avscan.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run	hosts.exe

Drops file in Windows directory 5 IoCs

Processes:

avscan.exehosts.exe1d0f660959abdd07b7f4002a77e2c33424513fb47fbad7be27f24ee689644c21.exe

description	ioc	process
File opened for modification	C:\Windows\hosts.exe	avscan.exe
File opened for modification	C:\Windows\hosts.exe	hosts.exe
File created	C:\windows\W_X_C.vbs	1d0f660959abdd07b7f4002a77e2c33424513fb47fbad7be27f24ee689644c21.exe
File created	\??\c:\windows\W_X_C.bat	1d0f660959abdd07b7f4002a77e2c33424513fb47fbad7be27f24ee689644c21.exe
File opened for modification	C:\Windows\hosts.exe	1d0f660959abdd07b7f4002a77e2c33424513fb47fbad7be27f24ee689644c21.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Modifies registry key 1 TTPs 9 IoCs

Modify Registry
T1112

Processes:

REG.exeREG.exeREG.exeREG.exeREG.exeREG.exeREG.exeREG.exeREG.exe

pid process

820 REG.exe
1888 REG.exe
1220 REG.exe
316 REG.exe
1220 REG.exe
952 REG.exe
1820 REG.exe
1156 REG.exe
900 REG.exe
Suspicious behavior: GetForegroundWindowSpam 2 IoCs

Processes:

avscan.exehosts.exe

pid process

1116 avscan.exe
628 hosts.exe

pid	process
820	REG.exe
1888	REG.exe
1220	REG.exe
316	REG.exe
1220	REG.exe
952	REG.exe
1820	REG.exe
1156	REG.exe
900	REG.exe

pid	process
1116	avscan.exe
628	hosts.exe

Suspicious use of SetWindowsHookEx 7 IoCs

Processes:

1d0f660959abdd07b7f4002a77e2c33424513fb47fbad7be27f24ee689644c21.exeavscan.exeavscan.exehosts.exehosts.exeavscan.exehosts.exe

pid	process
1968	1d0f660959abdd07b7f4002a77e2c33424513fb47fbad7be27f24ee689644c21.exe
1116	avscan.exe
888	avscan.exe
1592	hosts.exe
628	hosts.exe
1068	avscan.exe
1904	hosts.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

1d0f660959abdd07b7f4002a77e2c33424513fb47fbad7be27f24ee689644c21.exeavscan.execmd.execmd.exehosts.execmd.exe

description	pid	process	target process
PID 1968 wrote to memory of 1220	1968	1d0f660959abdd07b7f4002a77e2c33424513fb47fbad7be27f24ee689644c21.exe	REG.exe
PID 1968 wrote to memory of 1220	1968	1d0f660959abdd07b7f4002a77e2c33424513fb47fbad7be27f24ee689644c21.exe	REG.exe
PID 1968 wrote to memory of 1220	1968	1d0f660959abdd07b7f4002a77e2c33424513fb47fbad7be27f24ee689644c21.exe	REG.exe
PID 1968 wrote to memory of 1220	1968	1d0f660959abdd07b7f4002a77e2c33424513fb47fbad7be27f24ee689644c21.exe	REG.exe
PID 1968 wrote to memory of 1116	1968	1d0f660959abdd07b7f4002a77e2c33424513fb47fbad7be27f24ee689644c21.exe	avscan.exe
PID 1968 wrote to memory of 1116	1968	1d0f660959abdd07b7f4002a77e2c33424513fb47fbad7be27f24ee689644c21.exe	avscan.exe
PID 1968 wrote to memory of 1116	1968	1d0f660959abdd07b7f4002a77e2c33424513fb47fbad7be27f24ee689644c21.exe	avscan.exe
PID 1968 wrote to memory of 1116	1968	1d0f660959abdd07b7f4002a77e2c33424513fb47fbad7be27f24ee689644c21.exe	avscan.exe
PID 1116 wrote to memory of 888	1116	avscan.exe	avscan.exe
PID 1116 wrote to memory of 888	1116	avscan.exe	avscan.exe
PID 1116 wrote to memory of 888	1116	avscan.exe	avscan.exe
PID 1116 wrote to memory of 888	1116	avscan.exe	avscan.exe
PID 1116 wrote to memory of 1496	1116	avscan.exe	cmd.exe
PID 1116 wrote to memory of 1496	1116	avscan.exe	cmd.exe
PID 1116 wrote to memory of 1496	1116	avscan.exe	cmd.exe
PID 1116 wrote to memory of 1496	1116	avscan.exe	cmd.exe
PID 1968 wrote to memory of 756	1968	1d0f660959abdd07b7f4002a77e2c33424513fb47fbad7be27f24ee689644c21.exe	cmd.exe
PID 1968 wrote to memory of 756	1968	1d0f660959abdd07b7f4002a77e2c33424513fb47fbad7be27f24ee689644c21.exe	cmd.exe
PID 1968 wrote to memory of 756	1968	1d0f660959abdd07b7f4002a77e2c33424513fb47fbad7be27f24ee689644c21.exe	cmd.exe
PID 1968 wrote to memory of 756	1968	1d0f660959abdd07b7f4002a77e2c33424513fb47fbad7be27f24ee689644c21.exe	cmd.exe
PID 1496 wrote to memory of 628	1496	cmd.exe	hosts.exe
PID 1496 wrote to memory of 628	1496	cmd.exe	hosts.exe
PID 1496 wrote to memory of 628	1496	cmd.exe	hosts.exe
PID 1496 wrote to memory of 628	1496	cmd.exe	hosts.exe
PID 756 wrote to memory of 1592	756	cmd.exe	hosts.exe
PID 756 wrote to memory of 1592	756	cmd.exe	hosts.exe
PID 756 wrote to memory of 1592	756	cmd.exe	hosts.exe
PID 756 wrote to memory of 1592	756	cmd.exe	hosts.exe
PID 1496 wrote to memory of 664	1496	cmd.exe	WScript.exe
PID 1496 wrote to memory of 664	1496	cmd.exe	WScript.exe
PID 1496 wrote to memory of 664	1496	cmd.exe	WScript.exe
PID 1496 wrote to memory of 664	1496	cmd.exe	WScript.exe
PID 628 wrote to memory of 1068	628	hosts.exe	avscan.exe
PID 628 wrote to memory of 1068	628	hosts.exe	avscan.exe
PID 628 wrote to memory of 1068	628	hosts.exe	avscan.exe
PID 628 wrote to memory of 1068	628	hosts.exe	avscan.exe
PID 756 wrote to memory of 832	756	cmd.exe	WScript.exe
PID 756 wrote to memory of 832	756	cmd.exe	WScript.exe
PID 756 wrote to memory of 832	756	cmd.exe	WScript.exe
PID 756 wrote to memory of 832	756	cmd.exe	WScript.exe
PID 628 wrote to memory of 1476	628	hosts.exe	cmd.exe
PID 628 wrote to memory of 1476	628	hosts.exe	cmd.exe
PID 628 wrote to memory of 1476	628	hosts.exe	cmd.exe
PID 628 wrote to memory of 1476	628	hosts.exe	cmd.exe
PID 1476 wrote to memory of 1904	1476	cmd.exe	hosts.exe
PID 1476 wrote to memory of 1904	1476	cmd.exe	hosts.exe
PID 1476 wrote to memory of 1904	1476	cmd.exe	hosts.exe
PID 1476 wrote to memory of 1904	1476	cmd.exe	hosts.exe
PID 1476 wrote to memory of 1264	1476	cmd.exe	WScript.exe
PID 1476 wrote to memory of 1264	1476	cmd.exe	WScript.exe
PID 1476 wrote to memory of 1264	1476	cmd.exe	WScript.exe
PID 1476 wrote to memory of 1264	1476	cmd.exe	WScript.exe
PID 1116 wrote to memory of 1820	1116	avscan.exe	REG.exe
PID 1116 wrote to memory of 1820	1116	avscan.exe	REG.exe
PID 1116 wrote to memory of 1820	1116	avscan.exe	REG.exe
PID 1116 wrote to memory of 1820	1116	avscan.exe	REG.exe
PID 628 wrote to memory of 316	628	hosts.exe	REG.exe
PID 628 wrote to memory of 316	628	hosts.exe	REG.exe
PID 628 wrote to memory of 316	628	hosts.exe	REG.exe
PID 628 wrote to memory of 316	628	hosts.exe	REG.exe
PID 628 wrote to memory of 1220	628	hosts.exe	REG.exe
PID 628 wrote to memory of 1220	628	hosts.exe	REG.exe
PID 628 wrote to memory of 1220	628	hosts.exe	REG.exe
PID 628 wrote to memory of 1220	628	hosts.exe	REG.exe

C:\Users\Admin\AppData\Local\Temp\1d0f660959abdd07b7f4002a77e2c33424513fb47fbad7be27f24ee689644c21.exe
"C:\Users\Admin\AppData\Local\Temp\1d0f660959abdd07b7f4002a77e2c33424513fb47fbad7be27f24ee689644c21.exe"
1⤵
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- Loads dropped DLL
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1968

C:\Windows\SysWOW64\REG.exe
REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
2⤵
- Modifies registry key
PID:1220

C:\Users\Admin\AppData\Local\Temp\avscan.exe
C:\Users\Admin\AppData\Local\Temp\avscan.exe
2⤵
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1116

C:\Users\Admin\AppData\Local\Temp\avscan.exe
C:\Users\Admin\AppData\Local\Temp\avscan.exe
3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:888

C:\Windows\SysWOW64\cmd.exe
cmd /c c:\windows\W_X_C.bat
3⤵
- Suspicious use of WriteProcessMemory
PID:1496

C:\windows\hosts.exe
C:\windows\hosts.exe
4⤵
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:628

C:\Users\Admin\AppData\Local\Temp\avscan.exe
C:\Users\Admin\AppData\Local\Temp\avscan.exe
5⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1068

C:\Windows\SysWOW64\cmd.exe
cmd /c c:\windows\W_X_C.bat
5⤵
- Suspicious use of WriteProcessMemory
PID:1476

C:\windows\hosts.exe
C:\windows\hosts.exe
6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1904

C:\Windows\SysWOW64\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Windows\W_X_C.vbs"
6⤵
- Adds policy Run key to start application
PID:1264

C:\Windows\SysWOW64\REG.exe
REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
5⤵
- Modifies registry key
PID:316

C:\Windows\SysWOW64\REG.exe
REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
5⤵
- Modifies registry key
PID:1220

C:\Windows\SysWOW64\REG.exe
REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
5⤵
- Modifies registry key
PID:820

C:\Windows\SysWOW64\REG.exe
REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
5⤵
- Modifies registry key
PID:900

C:\Windows\SysWOW64\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Windows\W_X_C.vbs"
4⤵
- Adds policy Run key to start application
PID:664

C:\Windows\SysWOW64\REG.exe
REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
3⤵
- Modifies registry key
PID:1820

C:\Windows\SysWOW64\REG.exe
REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
3⤵
- Modifies registry key
PID:952

C:\Windows\SysWOW64\REG.exe
REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
3⤵
- Modifies registry key
PID:1156

C:\Windows\SysWOW64\REG.exe
REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
3⤵
- Modifies registry key
PID:1888

C:\Windows\SysWOW64\cmd.exe
cmd /c c:\windows\W_X_C.bat
2⤵
- Suspicious use of WriteProcessMemory
PID:756

C:\windows\hosts.exe
C:\windows\hosts.exe
3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1592

C:\Windows\SysWOW64\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Windows\W_X_C.vbs"
3⤵
- Adds policy Run key to start application
PID:832

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Hidden Files and Directories

T1158

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Hidden Files and Directories

T1158

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Admin.bmp
Filesize
387KB

MD5
16464fc13e717dd639d5414b50fbbe3a

SHA1
d956e670ef2e0cd1bd8623b26ef733e56a74588c

SHA256
2a5307251729bd9aa2d0b74b31a6a8a0e932c90ece95834532f5eed3f4f998df

SHA512
ead552b2eaf985b60904c8203e0ed36fd7c30f53ee566f04672146e81bb3c338eaa6f3bafef26d51592acb239a8e93669a62ffff35ceddd0418307136ea2603b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Admin.bmp
Filesize
1.4MB

MD5
e3a8779fb6d733f65da4bffb15763728

SHA1
218208be93affa13bf770dc3c0da357627390d02

SHA256
c65661559130c21b5273d290ff8908b246b407f2b3fca1fcb88bb62d1f30e97d

SHA512
0a6ed73a0b1159a473488514ae638ef5a22e0fd6ab15b1c9547804b2b0726c21719203f723381460cc10eef117a0127be8367deb9678f10d4357f89b199516b6

Download Submit
C:\Users\Admin\AppData\Local\Temp\Admin.bmp
Filesize
2.0MB

MD5
44de7808f8d5c047e03817d01634b02b

SHA1
2a32e11a1d1a4c911f1edeb4ad97e1eb7d0b63d2

SHA256
29cf7afe3ff949089175ba843ea97a059dcd8e7aea3f0ecfd496a26974b3a840

SHA512
35d5bcabc736bc984350747e9d56de938f7baa727414e6aca8341e19812c2edd08da72f447dc894064c11b4e5dee20394211ed1a008d10691012281c6912954a

Download Submit
C:\Users\Admin\AppData\Local\Temp\Admin.bmp
Filesize
2.0MB

MD5
d2d1eac4f009da0e63b6eb3a4b5dcbe8

SHA1
7b0dbd7fd6deb48a0dffeeddaf7662abe0c408a2

SHA256
fc3da7430764df5a4de2a2ed4dcbd6b33c0386826091a5118806c8956bae04ca

SHA512
a986234706c20e71a7e04f9bae069cdad24f7b3458267a0b9f9187c3668a1b84d90e367c10efcbaef5a39479abd24f4aae75a842823303f586b1a4b687202421

Download Submit
C:\Users\Admin\AppData\Local\Temp\Admin.bmp
Filesize
2.4MB

MD5
4df23db65698c960f22e323a5e77ef32

SHA1
bad215a7ef0a91b55fec86bd492bb34ccfc00aec

SHA256
058445560a71b68cfb887ff30e4fbe5e481f7a2f1830753c175dc5ccb6e65aa2

SHA512
01954f1d345f4f43b12ea659fb1a82be95dc18ced1f957ed1ac2a6c1a9c46eb21c4b653956091b9c8a06d0256352723334a641ba1a10e0ac051269ff3d42e13b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Admin.bmp
Filesize
2.4MB

MD5
20e2896b9b7e5cbccf89dc4e52c6a4ea

SHA1
4d28c1c5109fbf793445823a5e54c43c0960eb09

SHA256
f49b50589473be0648fe45b74921e167fe1835028bb8ef36140ff242e7407342

SHA512
e6f24b8a7c437e6bbe2924eb4b0ff1d2cc47e0b787664d252b0e5b9f4439151d0474562007de393d586dd68ed18d412bc89fe2870659f11015a94a37e28ec114

Download Submit
C:\Users\Admin\AppData\Local\Temp\avscan.exe
Filesize
339KB

MD5
20a5c36d042240befcf51e9b3510ce4d

SHA1
85fc0f5619d2af33ae6e14ec0df9990279e11a91

SHA256
6f2b310cc758a8b4dfae2661e9e0a8dfe14f2edcf622a8dd555ddc67a2978499

SHA512
1be7ee2495c1e34b9f764c1b1d301e84360efb92f7b7962f8e4c028838e8b932d0c2bf85fe293b622329a20ab783cbf87a744aed10b89d6614253b5f8cc722d7

Download Submit
C:\Users\Admin\AppData\Local\Temp\avscan.exe
Filesize
339KB

MD5
20a5c36d042240befcf51e9b3510ce4d

SHA1
85fc0f5619d2af33ae6e14ec0df9990279e11a91

SHA256
6f2b310cc758a8b4dfae2661e9e0a8dfe14f2edcf622a8dd555ddc67a2978499

SHA512
1be7ee2495c1e34b9f764c1b1d301e84360efb92f7b7962f8e4c028838e8b932d0c2bf85fe293b622329a20ab783cbf87a744aed10b89d6614253b5f8cc722d7

Download Submit
C:\Users\Admin\AppData\Local\Temp\avscan.exe
Filesize
339KB

MD5
20a5c36d042240befcf51e9b3510ce4d

SHA1
85fc0f5619d2af33ae6e14ec0df9990279e11a91

SHA256
6f2b310cc758a8b4dfae2661e9e0a8dfe14f2edcf622a8dd555ddc67a2978499

SHA512
1be7ee2495c1e34b9f764c1b1d301e84360efb92f7b7962f8e4c028838e8b932d0c2bf85fe293b622329a20ab783cbf87a744aed10b89d6614253b5f8cc722d7

Download Submit
C:\Users\Admin\AppData\Local\Temp\avscan.exe
Filesize
339KB

MD5
20a5c36d042240befcf51e9b3510ce4d

SHA1
85fc0f5619d2af33ae6e14ec0df9990279e11a91

SHA256
6f2b310cc758a8b4dfae2661e9e0a8dfe14f2edcf622a8dd555ddc67a2978499

SHA512
1be7ee2495c1e34b9f764c1b1d301e84360efb92f7b7962f8e4c028838e8b932d0c2bf85fe293b622329a20ab783cbf87a744aed10b89d6614253b5f8cc722d7

Download Submit
C:\Windows\W_X_C.vbs
Filesize
195B

MD5
9eb0c6074d8e54f7da6508b5f6809e78

SHA1
61f003a28c45377e9fc641a0dd1382e6931c11f0

SHA256
df6f01f8c7c5ad4b1e66d19309ad60f0189bc607d7a07c184d9d94abd29c3ee8

SHA512
f6db15038cf4312647c59574cf2352c132c36cd060293977427b719066e5519838c6fed059d3a1d4e3277b575d9132d29d150c45cebd8a3852e705f3297f6d08

Download Submit
C:\Windows\hosts.exe
Filesize
339KB

MD5
9e3b8ef88d83cdc120152b29e11d5f52

SHA1
45702b6572f8a6d27523c32469c27ae7c13eac1a

SHA256
27c73dc9c28185fe9e7281e4df2f0088f9c4a5580a13e580bd1081d907da2432

SHA512
a6b79b9d4cb41d8e13f7265fcad35db9db281583e7005258c2afe632e1646a6e8ddd745159103ea77ca0f9ac44d2e3eee7ba546a497ef043ef7b242176256733

Download Submit
C:\Windows\hosts.exe
Filesize
339KB

MD5
9e3b8ef88d83cdc120152b29e11d5f52

SHA1
45702b6572f8a6d27523c32469c27ae7c13eac1a

SHA256
27c73dc9c28185fe9e7281e4df2f0088f9c4a5580a13e580bd1081d907da2432

SHA512
a6b79b9d4cb41d8e13f7265fcad35db9db281583e7005258c2afe632e1646a6e8ddd745159103ea77ca0f9ac44d2e3eee7ba546a497ef043ef7b242176256733

Download Submit
C:\Windows\hosts.exe
Filesize
339KB

MD5
9e3b8ef88d83cdc120152b29e11d5f52

SHA1
45702b6572f8a6d27523c32469c27ae7c13eac1a

SHA256
27c73dc9c28185fe9e7281e4df2f0088f9c4a5580a13e580bd1081d907da2432

SHA512
a6b79b9d4cb41d8e13f7265fcad35db9db281583e7005258c2afe632e1646a6e8ddd745159103ea77ca0f9ac44d2e3eee7ba546a497ef043ef7b242176256733

Download Submit
C:\Windows\hosts.exe
Filesize
339KB

MD5
9e3b8ef88d83cdc120152b29e11d5f52

SHA1
45702b6572f8a6d27523c32469c27ae7c13eac1a

SHA256
27c73dc9c28185fe9e7281e4df2f0088f9c4a5580a13e580bd1081d907da2432

SHA512
a6b79b9d4cb41d8e13f7265fcad35db9db281583e7005258c2afe632e1646a6e8ddd745159103ea77ca0f9ac44d2e3eee7ba546a497ef043ef7b242176256733

Download Submit
C:\windows\hosts.exe
Filesize
339KB

MD5
9e3b8ef88d83cdc120152b29e11d5f52

SHA1
45702b6572f8a6d27523c32469c27ae7c13eac1a

SHA256
27c73dc9c28185fe9e7281e4df2f0088f9c4a5580a13e580bd1081d907da2432

SHA512
a6b79b9d4cb41d8e13f7265fcad35db9db281583e7005258c2afe632e1646a6e8ddd745159103ea77ca0f9ac44d2e3eee7ba546a497ef043ef7b242176256733

Download Submit
\??\c:\windows\W_X_C.bat
Filesize
336B

MD5
4db9f8b6175722b62ececeeeba1ce307

SHA1
3b3ba8414706e72a6fa19e884a97b87609e11e47

SHA256
d2150b9e5a4ce55e140f0ca91c4e300715d42095c8fddf58c77037cdd2cfaf78

SHA512
1d6dc274cf7a3dd704f840e6a5ad57ab4c4e35d5f09489aeff520bb797e1c825bac53fc335156fe41e767a46520d031855fe42fe7b175409ebe5e9e986fb9b8b

Download Submit
\Users\Admin\AppData\Local\Temp\avscan.exe
Filesize
339KB

MD5
20a5c36d042240befcf51e9b3510ce4d

SHA1
85fc0f5619d2af33ae6e14ec0df9990279e11a91

SHA256
6f2b310cc758a8b4dfae2661e9e0a8dfe14f2edcf622a8dd555ddc67a2978499

SHA512
1be7ee2495c1e34b9f764c1b1d301e84360efb92f7b7962f8e4c028838e8b932d0c2bf85fe293b622329a20ab783cbf87a744aed10b89d6614253b5f8cc722d7

Download Submit
\Users\Admin\AppData\Local\Temp\avscan.exe
Filesize
339KB

MD5
20a5c36d042240befcf51e9b3510ce4d

SHA1
85fc0f5619d2af33ae6e14ec0df9990279e11a91

SHA256
6f2b310cc758a8b4dfae2661e9e0a8dfe14f2edcf622a8dd555ddc67a2978499

SHA512
1be7ee2495c1e34b9f764c1b1d301e84360efb92f7b7962f8e4c028838e8b932d0c2bf85fe293b622329a20ab783cbf87a744aed10b89d6614253b5f8cc722d7

Download Submit
\Users\Admin\AppData\Local\Temp\avscan.exe
Filesize
339KB

MD5
20a5c36d042240befcf51e9b3510ce4d

SHA1
85fc0f5619d2af33ae6e14ec0df9990279e11a91

SHA256
6f2b310cc758a8b4dfae2661e9e0a8dfe14f2edcf622a8dd555ddc67a2978499

SHA512
1be7ee2495c1e34b9f764c1b1d301e84360efb92f7b7962f8e4c028838e8b932d0c2bf85fe293b622329a20ab783cbf87a744aed10b89d6614253b5f8cc722d7

Download Submit
\Users\Admin\AppData\Local\Temp\avscan.exe
Filesize
339KB

MD5
20a5c36d042240befcf51e9b3510ce4d

SHA1
85fc0f5619d2af33ae6e14ec0df9990279e11a91

SHA256
6f2b310cc758a8b4dfae2661e9e0a8dfe14f2edcf622a8dd555ddc67a2978499

SHA512
1be7ee2495c1e34b9f764c1b1d301e84360efb92f7b7962f8e4c028838e8b932d0c2bf85fe293b622329a20ab783cbf87a744aed10b89d6614253b5f8cc722d7

Download Submit
\Users\Admin\AppData\Local\Temp\avscan.exe
Filesize
339KB

MD5
20a5c36d042240befcf51e9b3510ce4d

SHA1
85fc0f5619d2af33ae6e14ec0df9990279e11a91

SHA256
6f2b310cc758a8b4dfae2661e9e0a8dfe14f2edcf622a8dd555ddc67a2978499

SHA512
1be7ee2495c1e34b9f764c1b1d301e84360efb92f7b7962f8e4c028838e8b932d0c2bf85fe293b622329a20ab783cbf87a744aed10b89d6614253b5f8cc722d7

Download Submit
memory/316-108-0x0000000000000000-mapping.dmp

Download
memory/628-76-0x0000000000000000-mapping.dmp

Download
memory/664-86-0x0000000000000000-mapping.dmp

Download
memory/756-74-0x0000000000000000-mapping.dmp

Download
memory/820-113-0x0000000000000000-mapping.dmp

Download
memory/832-91-0x0000000000000000-mapping.dmp

Download
memory/888-68-0x0000000000000000-mapping.dmp

Download
memory/900-119-0x0000000000000000-mapping.dmp

Download
memory/952-111-0x0000000000000000-mapping.dmp

Download
memory/1068-90-0x0000000000000000-mapping.dmp

Download
memory/1116-61-0x0000000000000000-mapping.dmp

Download
memory/1156-114-0x0000000000000000-mapping.dmp

Download
memory/1220-57-0x0000000000000000-mapping.dmp

Download
memory/1220-110-0x0000000000000000-mapping.dmp

Download
memory/1264-103-0x0000000000000000-mapping.dmp

Download
memory/1476-95-0x0000000000000000-mapping.dmp

Download
memory/1496-73-0x0000000000000000-mapping.dmp

Download
memory/1592-77-0x0000000000000000-mapping.dmp

Download
memory/1820-106-0x0000000000000000-mapping.dmp

Download
memory/1888-120-0x0000000000000000-mapping.dmp

Download
memory/1904-98-0x0000000000000000-mapping.dmp

Download
memory/1968-56-0x0000000075141000-0x0000000075143000-memory.dmp

Filesize
8KB

Download
memory/1968-58-0x0000000074321000-0x0000000074323000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads