Analysis
- max time kernel
146s - max time network
146s - platform
windows10-2004_x64 - resource
win10v2004-20221111-en - resource tags
arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system - submitted
24/11/2022, 04:25
Static task
static1
Behavioral task
behavioral1
Sample
abe29190d3ff4371f25249cdcbc3cfc1434b7db9d3d0bb4428f321f0a03cc679.exe
Resource
win7-20221111-en
windows7-x64
12 signatures
150 seconds
Behavioral task
behavioral2
Sample
abe29190d3ff4371f25249cdcbc3cfc1434b7db9d3d0bb4428f321f0a03cc679.exe
Resource
win10v2004-20221111-en
windows10-2004-x64
13 signatures
150 seconds
General
- Target abe29190d3ff4371f25249cdcbc3cfc1434b7db9d3d0bb4428f321f0a03cc679.exe
- Size 2.6MB
- Sample221124-e118xacb81
- SHA256 abe29190d3ff4371f25249cdcbc3cfc1434b7db9d3d0bb4428f321f0a03cc679
- MD5 ae8bbde35ae59e3f26f0deb76d3b6918
- SHA1 54dd77953b08d22ba8427df84318a8441e3bc8b2
- SHA512 1b05a9b126f816e2d7fcd003f9a310296a574b54cb14c34d0f800ad2321fb04561a896926ea3a62308a29647bd3b5df06c631379ac0ea266c9a614e4d35fc7d4
- SSDEEP 49152:g7yC7yD7yC7y67yC7yD7yC7yD7yD7yC7yD7yC7yD7yC7yD7yC7yD7yC7yb:gmCmDmCm6mCmDmCmDmDmCmDmCmDmCmDp
- MD5 SHA1 SHA512 SSDEEP
Score
10/10
Malware Config
Signatures
- Modifies visibility of file extensions in Explorer 2 TTPs 3 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" abe29190d3ff4371f25249cdcbc3cfc1434b7db9d3d0bb4428f321f0a03cc679.exe Set value (int) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" avscan.exe Set value (int) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" hosts.exe - Modifies visiblity of hidden/system files in Explorer 2 TTPs 3 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" abe29190d3ff4371f25249cdcbc3cfc1434b7db9d3d0bb4428f321f0a03cc679.exe Set value (int) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" avscan.exe Set value (int) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" hosts.exe - Adds policy Run key to start application 2 TTPs 6 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run WScript.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\WIJBFSKT = "W_X_C.bat" WScript.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run WScript.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\WIJBFSKT = "W_X_C.bat" WScript.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run WScript.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\WIJBFSKT = "W_X_C.bat" WScript.exe - Executes dropped EXE 6 IoCs
pid Process 216 avscan.exe 1648 avscan.exe 996 hosts.exe 2224 hosts.exe 4964 avscan.exe 4380 hosts.exe - Checks computer location settings 2 TTPs 3 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Control Panel\International\Geo\Nation cmd.exe Key value queried \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Control Panel\International\Geo\Nation cmd.exe Key value queried \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Control Panel\International\Geo\Nation cmd.exe - Adds Run key to start application 2 TTPs 6 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run abe29190d3ff4371f25249cdcbc3cfc1434b7db9d3d0bb4428f321f0a03cc679.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\avscan = "C:\\Users\\Admin\\AppData\\Local\\Temp\\avscan.exe" abe29190d3ff4371f25249cdcbc3cfc1434b7db9d3d0bb4428f321f0a03cc679.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run avscan.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\avscan = "C:\\Users\\Admin\\AppData\\Local\\Temp\\avscan.exe" avscan.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run hosts.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\avscan = "C:\\Users\\Admin\\AppData\\Local\\Temp\\avscan.exe" hosts.exe - Drops file in Windows directory 5 IoCs
description ioc Process File opened for modification C:\Windows\hosts.exe abe29190d3ff4371f25249cdcbc3cfc1434b7db9d3d0bb4428f321f0a03cc679.exe File opened for modification C:\Windows\hosts.exe avscan.exe File opened for modification C:\Windows\hosts.exe hosts.exe File created C:\windows\W_X_C.vbs abe29190d3ff4371f25249cdcbc3cfc1434b7db9d3d0bb4428f321f0a03cc679.exe File created \??\c:\windows\W_X_C.bat abe29190d3ff4371f25249cdcbc3cfc1434b7db9d3d0bb4428f321f0a03cc679.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
- Modifies registry class 4 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000_Classes\Local Settings abe29190d3ff4371f25249cdcbc3cfc1434b7db9d3d0bb4428f321f0a03cc679.exe Key created \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000_Classes\Local Settings cmd.exe Key created \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000_Classes\Local Settings cmd.exe Key created \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000_Classes\Local Settings cmd.exe - Modifies registry key 1 TTPs 9 IoCs
pid Process 2616 REG.exe 4448 REG.exe 2460 REG.exe 2348 REG.exe 3776 REG.exe 1396 REG.exe 2896 REG.exe 4348 REG.exe 4520 REG.exe - Suspicious behavior: GetForegroundWindowSpam 2 IoCs
pid Process 216 avscan.exe 996 hosts.exe - Suspicious use of SetWindowsHookEx 7 IoCs
pid Process 1912 abe29190d3ff4371f25249cdcbc3cfc1434b7db9d3d0bb4428f321f0a03cc679.exe 216 avscan.exe 1648 avscan.exe 996 hosts.exe 2224 hosts.exe 4964 avscan.exe 4380 hosts.exe - Suspicious use of WriteProcessMemory 63 IoCs
description pid Process procid_target PID 1912 wrote to memory of 2616 1912 abe29190d3ff4371f25249cdcbc3cfc1434b7db9d3d0bb4428f321f0a03cc679.exe 83 PID 1912 wrote to memory of 2616 1912 abe29190d3ff4371f25249cdcbc3cfc1434b7db9d3d0bb4428f321f0a03cc679.exe 83 PID 1912 wrote to memory of 2616 1912 abe29190d3ff4371f25249cdcbc3cfc1434b7db9d3d0bb4428f321f0a03cc679.exe 83 PID 1912 wrote to memory of 216 1912 abe29190d3ff4371f25249cdcbc3cfc1434b7db9d3d0bb4428f321f0a03cc679.exe 85 PID 1912 wrote to memory of 216 1912 abe29190d3ff4371f25249cdcbc3cfc1434b7db9d3d0bb4428f321f0a03cc679.exe 85 PID 1912 wrote to memory of 216 1912 abe29190d3ff4371f25249cdcbc3cfc1434b7db9d3d0bb4428f321f0a03cc679.exe 85 PID 216 wrote to memory of 1648 216 avscan.exe 86 PID 216 wrote to memory of 1648 216 avscan.exe 86 PID 216 wrote to memory of 1648 216 avscan.exe 86 PID 216 wrote to memory of 3820 216 avscan.exe 87 PID 216 wrote to memory of 3820 216 avscan.exe 87 PID 216 wrote to memory of 3820 216 avscan.exe 87 PID 1912 wrote to memory of 3628 1912 abe29190d3ff4371f25249cdcbc3cfc1434b7db9d3d0bb4428f321f0a03cc679.exe 89 PID 1912 wrote to memory of 3628 1912 abe29190d3ff4371f25249cdcbc3cfc1434b7db9d3d0bb4428f321f0a03cc679.exe 89 PID 1912 wrote to memory of 3628 1912 abe29190d3ff4371f25249cdcbc3cfc1434b7db9d3d0bb4428f321f0a03cc679.exe 89 PID 3628 wrote to memory of 2224 3628 cmd.exe 93 PID 3628 wrote to memory of 2224 3628 cmd.exe 93 PID 3628 wrote to memory of 2224 3628 cmd.exe 93 PID 3820 wrote to memory of 996 3820 cmd.exe 92 PID 3820 wrote to memory of 996 3820 cmd.exe 92 PID 3820 wrote to memory of 996 3820 cmd.exe 92 PID 996 wrote to memory of 4964 996 hosts.exe 94 PID 996 wrote to memory of 4964 996 hosts.exe 94 PID 996 wrote to memory of 4964 996 hosts.exe 94 PID 996 wrote to memory of 408 996 hosts.exe 95 PID 996 wrote to memory of 408 996 hosts.exe 95 PID 996 wrote to memory of 408 996 hosts.exe 95 PID 408 wrote to memory of 4380 408 cmd.exe 97 PID 408 wrote to memory of 4380 408 cmd.exe 97 PID 408 wrote to memory of 4380 408 cmd.exe 97 PID 3820 wrote to memory of 3680 3820 cmd.exe 99 PID 3628 wrote to memory of 3168 3628 cmd.exe 98 PID 3820 wrote to memory of 3680 3820 cmd.exe 99 PID 3820 wrote to memory of 3680 3820 cmd.exe 99 PID 3628 wrote to memory of 3168 3628 cmd.exe 98 PID 3628 wrote to memory of 3168 3628 cmd.exe 98 PID 408 wrote to memory of 4040 408 cmd.exe 100 PID 408 wrote to memory of 4040 408 cmd.exe 100 PID 408 wrote to memory of 4040 408 cmd.exe 100 PID 216 wrote to memory of 4448 216 avscan.exe 102 PID 216 wrote to memory of 4448 216 avscan.exe 102 PID 216 wrote to memory of 4448 216 avscan.exe 102 PID 996 wrote to memory of 2460 996 hosts.exe 104 PID 996 wrote to memory of 2460 996 hosts.exe 104 PID 996 wrote to memory of 2460 996 hosts.exe 104 PID 216 wrote to memory of 3776 216 avscan.exe 109 PID 216 wrote to memory of 3776 216 avscan.exe 109 PID 216 wrote to memory of 3776 216 avscan.exe 109 PID 996 wrote to memory of 2348 996 hosts.exe 108 PID 996 wrote to memory of 2348 996 hosts.exe 108 PID 996 wrote to memory of 2348 996 hosts.exe 108 PID 996 wrote to memory of 1396 996 hosts.exe 119 PID 996 wrote to memory of 1396 996 hosts.exe 119 PID 996 wrote to memory of 1396 996 hosts.exe 119 PID 216 wrote to memory of 4348 216 avscan.exe 118 PID 216 wrote to memory of 4348 216 avscan.exe 118 PID 216 wrote to memory of 4348 216 avscan.exe 118 PID 996 wrote to memory of 2896 996 hosts.exe 126 PID 996 wrote to memory of 2896 996 hosts.exe 126 PID 996 wrote to memory of 2896 996 hosts.exe 126 PID 216 wrote to memory of 4520 216 avscan.exe 127 PID 216 wrote to memory of 4520 216 avscan.exe 127 PID 216 wrote to memory of 4520 216 avscan.exe 127
Processes
-
C:\Users\Admin\AppData\Local\Temp\abe29190d3ff4371f25249cdcbc3cfc1434b7db9d3d0bb4428f321f0a03cc679.exe"C:\Users\Admin\AppData\Local\Temp\abe29190d3ff4371f25249cdcbc3cfc1434b7db9d3d0bb4428f321f0a03cc679.exe"1⤵
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- Adds Run key to start application
- Drops file in Windows directory
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1912 -
C:\Windows\SysWOW64\REG.exeREG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f2⤵
- Modifies registry key
PID:2616
-
-
C:\Users\Admin\AppData\Local\Temp\avscan.exeC:\Users\Admin\AppData\Local\Temp\avscan.exe2⤵
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:216 -
C:\Users\Admin\AppData\Local\Temp\avscan.exeC:\Users\Admin\AppData\Local\Temp\avscan.exe3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1648
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c c:\windows\W_X_C.bat3⤵
- Checks computer location settings
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3820 -
C:\windows\hosts.exeC:\windows\hosts.exe4⤵
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:996 -
C:\Users\Admin\AppData\Local\Temp\avscan.exeC:\Users\Admin\AppData\Local\Temp\avscan.exe5⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4964
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c c:\windows\W_X_C.bat5⤵
- Checks computer location settings
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:408 -
C:\windows\hosts.exeC:\windows\hosts.exe6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4380
-
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Windows\W_X_C.vbs"6⤵
- Adds policy Run key to start application
PID:4040
-
-
-
C:\Windows\SysWOW64\REG.exeREG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f5⤵
- Modifies registry key
PID:2460
-
-
C:\Windows\SysWOW64\REG.exeREG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f5⤵
- Modifies registry key
PID:2348
-
-
C:\Windows\SysWOW64\REG.exeREG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f5⤵
- Modifies registry key
PID:1396
-
-
C:\Windows\SysWOW64\REG.exeREG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f5⤵
- Modifies registry key
PID:2896
-
-
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Windows\W_X_C.vbs"4⤵
- Adds policy Run key to start application
PID:3680
-
-
-
C:\Windows\SysWOW64\REG.exeREG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f3⤵
- Modifies registry key
PID:4448
-
-
C:\Windows\SysWOW64\REG.exeREG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f3⤵
- Modifies registry key
PID:3776
-
-
C:\Windows\SysWOW64\REG.exeREG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f3⤵
- Modifies registry key
PID:4348
-
-
C:\Windows\SysWOW64\REG.exeREG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f3⤵
- Modifies registry key
PID:4520
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c c:\windows\W_X_C.bat2⤵
- Checks computer location settings
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3628 -
C:\windows\hosts.exeC:\windows\hosts.exe3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2224
-
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Windows\W_X_C.vbs"3⤵
- Adds policy Run key to start application
PID:3168
-
-
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵PID:4280
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\avscan.exe
- Size 2.6MB
- SHA256 5b49d3990abe8e1788905577df2f49868ef0c9a4c1d97b87a536d012a63bd851
- MD5 42ba43ab13ee8881cd5a4373016e75fa
- SHA1 36165f834e36578bface866608b7841ec73a98b8
- SHA512 0429f7c916a9373f715bf38b63bf37cfefe96e7f22b9618ea7f09b69a1fc5050c82cc456590bd617d13bb193432e840cbd38a134e82d98ae65a56a004a41a03c
- SSDEEP 49152:g7yC7yD7yC7y67yC7yD7yC7yD7yD7yC7yD7yC7yD7yC7yD7yC7yD7yC7yx:gmCmDmCm6mCmDmCmDmDmCmDmCmDmCmD/
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\avscan.exe
- Size 2.6MB
- SHA256 5b49d3990abe8e1788905577df2f49868ef0c9a4c1d97b87a536d012a63bd851
- MD5 42ba43ab13ee8881cd5a4373016e75fa
- SHA1 36165f834e36578bface866608b7841ec73a98b8
- SHA512 0429f7c916a9373f715bf38b63bf37cfefe96e7f22b9618ea7f09b69a1fc5050c82cc456590bd617d13bb193432e840cbd38a134e82d98ae65a56a004a41a03c
- SSDEEP 49152:g7yC7yD7yC7y67yC7yD7yC7yD7yD7yC7yD7yC7yD7yC7yD7yC7yD7yC7yx:gmCmDmCm6mCmDmCmDmDmCmDmCmDmCmD/
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\avscan.exe
- Size 2.6MB
- SHA256 5b49d3990abe8e1788905577df2f49868ef0c9a4c1d97b87a536d012a63bd851
- MD5 42ba43ab13ee8881cd5a4373016e75fa
- SHA1 36165f834e36578bface866608b7841ec73a98b8
- SHA512 0429f7c916a9373f715bf38b63bf37cfefe96e7f22b9618ea7f09b69a1fc5050c82cc456590bd617d13bb193432e840cbd38a134e82d98ae65a56a004a41a03c
- SSDEEP 49152:g7yC7yD7yC7y67yC7yD7yC7yD7yD7yC7yD7yC7yD7yC7yD7yC7yD7yC7yx:gmCmDmCm6mCmDmCmDmDmCmDmCmDmCmD/
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\avscan.exe
- Size 2.6MB
- SHA256 5b49d3990abe8e1788905577df2f49868ef0c9a4c1d97b87a536d012a63bd851
- MD5 42ba43ab13ee8881cd5a4373016e75fa
- SHA1 36165f834e36578bface866608b7841ec73a98b8
- SHA512 0429f7c916a9373f715bf38b63bf37cfefe96e7f22b9618ea7f09b69a1fc5050c82cc456590bd617d13bb193432e840cbd38a134e82d98ae65a56a004a41a03c
- SSDEEP 49152:g7yC7yD7yC7y67yC7yD7yC7yD7yD7yC7yD7yC7yD7yC7yD7yC7yD7yC7yx:gmCmDmCm6mCmDmCmDmDmCmDmCmDmCmD/
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\W_X_C.vbs
- Size 195B
- SHA256 f77ac566569872134310abf6755aaf712f96ddf7e544cd73fa03555415676777
- MD5 5f95187376125e68821db0d42b6e0a01
- SHA1 24db87fd4f2e71873b08b285de3f584ed606bd7d
- SHA512 cecd0b1ab60ed7471870c6b5bb90d65b2e833d535f9a91aea96aae50a86e17fb15f23cd49da74d3ab6d50e54de75e02d9727d9b1d9ec2c32e3b80a4183c0a31c
- MD5 SHA1 SHA512
- Path C:\Windows\hosts.exe
- Size 2.6MB
- SHA256 8eb1978e08cbaef1abd719dc9c8852b980b3bf53129f18b06649a2ae3e330cb5
- MD5 3adcd6fdf4df907a4fe6971951dc717f
- SHA1 aaa27b9f7c2dc0475f4c6411b2665210a0ff1a2e
- SHA512 9ba4eb54d6093c4df52a1fce91bf11c2597b0f5fdd4d06f6d968ecc1cd92c170f704bcbb68340a9acbddbdd941ca62c3f79a0b59ef459b0b45a0b73a04559942
- SSDEEP 49152:g7yC7yD7yC7y67yC7yD7yC7yD7yD7yC7yD7yC7yD7yC7yD7yC7yD7yC7ym:gmCmDmCm6mCmDmCmDmDmCmDmCmDmCmDk
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\hosts.exe
- Size 2.6MB
- SHA256 8eb1978e08cbaef1abd719dc9c8852b980b3bf53129f18b06649a2ae3e330cb5
- MD5 3adcd6fdf4df907a4fe6971951dc717f
- SHA1 aaa27b9f7c2dc0475f4c6411b2665210a0ff1a2e
- SHA512 9ba4eb54d6093c4df52a1fce91bf11c2597b0f5fdd4d06f6d968ecc1cd92c170f704bcbb68340a9acbddbdd941ca62c3f79a0b59ef459b0b45a0b73a04559942
- SSDEEP 49152:g7yC7yD7yC7y67yC7yD7yC7yD7yD7yC7yD7yC7yD7yC7yD7yC7yD7yC7ym:gmCmDmCm6mCmDmCmDmDmCmDmCmDmCmDk
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\hosts.exe
- Size 2.6MB
- SHA256 8eb1978e08cbaef1abd719dc9c8852b980b3bf53129f18b06649a2ae3e330cb5
- MD5 3adcd6fdf4df907a4fe6971951dc717f
- SHA1 aaa27b9f7c2dc0475f4c6411b2665210a0ff1a2e
- SHA512 9ba4eb54d6093c4df52a1fce91bf11c2597b0f5fdd4d06f6d968ecc1cd92c170f704bcbb68340a9acbddbdd941ca62c3f79a0b59ef459b0b45a0b73a04559942
- SSDEEP 49152:g7yC7yD7yC7y67yC7yD7yC7yD7yD7yC7yD7yC7yD7yC7yD7yC7yD7yC7ym:gmCmDmCm6mCmDmCmDmDmCmDmCmDmCmDk
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\hosts.exe
- Size 2.6MB
- SHA256 8eb1978e08cbaef1abd719dc9c8852b980b3bf53129f18b06649a2ae3e330cb5
- MD5 3adcd6fdf4df907a4fe6971951dc717f
- SHA1 aaa27b9f7c2dc0475f4c6411b2665210a0ff1a2e
- SHA512 9ba4eb54d6093c4df52a1fce91bf11c2597b0f5fdd4d06f6d968ecc1cd92c170f704bcbb68340a9acbddbdd941ca62c3f79a0b59ef459b0b45a0b73a04559942
- SSDEEP 49152:g7yC7yD7yC7y67yC7yD7yC7yD7yD7yC7yD7yC7yD7yC7yD7yC7yD7yC7ym:gmCmDmCm6mCmDmCmDmDmCmDmCmDmCmDk
- MD5 SHA1 SHA512 SSDEEP
- Path C:\windows\hosts.exe
- Size 2.6MB
- SHA256 8eb1978e08cbaef1abd719dc9c8852b980b3bf53129f18b06649a2ae3e330cb5
- MD5 3adcd6fdf4df907a4fe6971951dc717f
- SHA1 aaa27b9f7c2dc0475f4c6411b2665210a0ff1a2e
- SHA512 9ba4eb54d6093c4df52a1fce91bf11c2597b0f5fdd4d06f6d968ecc1cd92c170f704bcbb68340a9acbddbdd941ca62c3f79a0b59ef459b0b45a0b73a04559942
- SSDEEP 49152:g7yC7yD7yC7y67yC7yD7yC7yD7yD7yC7yD7yC7yD7yC7yD7yC7yD7yC7ym:gmCmDmCm6mCmDmCmDmDmCmDmCmDmCmDk
- MD5 SHA1 SHA512 SSDEEP
- Path \??\c:\windows\W_X_C.bat
- Size 336B
- SHA256 d2150b9e5a4ce55e140f0ca91c4e300715d42095c8fddf58c77037cdd2cfaf78
- MD5 4db9f8b6175722b62ececeeeba1ce307
- SHA1 3b3ba8414706e72a6fa19e884a97b87609e11e47
- SHA512 1d6dc274cf7a3dd704f840e6a5ad57ab4c4e35d5f09489aeff520bb797e1c825bac53fc335156fe41e767a46520d031855fe42fe7b175409ebe5e9e986fb9b8b
- MD5 SHA1 SHA512