bee5372c533bd0360453415eaedad5edceb45d5ccc3e32740960e593046a5b9b

Analysis

max time kernel
125s
max time network
49s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
29/11/2022, 16:25

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

bee5372c533bd0360453415eaedad5edceb45d5ccc3e32740960e593046a5b9b.exe
Size

312KB
MD5

058bab922ada7d64cc364c35f09f1040
SHA1

cac31ebb2a785a1e254299f69a9c2199e8b3a508
SHA256

bee5372c533bd0360453415eaedad5edceb45d5ccc3e32740960e593046a5b9b
SHA512

2a482056f46cf87b0256fa6eb8f9397020d68db5cfe9a639fef528a8adfea6a1fef953a11ba0d0367f2b4311d5a5a0cf538898bafe105178682ae5a8093b1c59
SSDEEP

6144:gDCwfG1bnxLERRLT3YYhLrgX6lk55Qcpp5n+mu:g72bntELLrjLry6lkTQyE

Score

10^/10

evasion persistence

Malware Config

Signatures

Modifies visibility of file extensions in Explorer 2 TTPs 3 IoCs

evasion

Hidden Files and Directories

T1158

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	hosts.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	avscan.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	bee5372c533bd0360453415eaedad5edceb45d5ccc3e32740960e593046a5b9b.exe

Modifies visiblity of hidden/system files in Explorer 2 TTPs 3 IoCs

evasion

Hidden Files and Directories

T1158

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	bee5372c533bd0360453415eaedad5edceb45d5ccc3e32740960e593046a5b9b.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	hosts.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	avscan.exe

Adds policy Run key to start application 2 TTPs 6 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	WScript.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\RYNKSFQE = "W_X_C.bat"	WScript.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	WScript.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\RYNKSFQE = "W_X_C.bat"	WScript.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	WScript.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\RYNKSFQE = "W_X_C.bat"	WScript.exe

Executes dropped EXE 6 IoCs

pid	Process
624	avscan.exe
1496	avscan.exe
1864	hosts.exe
1576	hosts.exe
1524	avscan.exe
1888	hosts.exe

Loads dropped DLL 5 IoCs

pid	Process
1368	bee5372c533bd0360453415eaedad5edceb45d5ccc3e32740960e593046a5b9b.exe
1368	bee5372c533bd0360453415eaedad5edceb45d5ccc3e32740960e593046a5b9b.exe
624	avscan.exe
1864	hosts.exe
1864	hosts.exe

Adds Run key to start application 2 TTPs 6 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run	bee5372c533bd0360453415eaedad5edceb45d5ccc3e32740960e593046a5b9b.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\avscan = "C:\\Users\\Admin\\AppData\\Local\\Temp\\avscan.exe"	bee5372c533bd0360453415eaedad5edceb45d5ccc3e32740960e593046a5b9b.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run	hosts.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\avscan = "C:\\Users\\Admin\\AppData\\Local\\Temp\\avscan.exe"	hosts.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run	avscan.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\avscan = "C:\\Users\\Admin\\AppData\\Local\\Temp\\avscan.exe"	avscan.exe

Drops file in Windows directory 5 IoCs

description	ioc	Process
File opened for modification	C:\Windows\hosts.exe	avscan.exe
File opened for modification	C:\Windows\hosts.exe	hosts.exe
File created	C:\windows\W_X_C.vbs	bee5372c533bd0360453415eaedad5edceb45d5ccc3e32740960e593046a5b9b.exe
File created	\??\c:\windows\W_X_C.bat	bee5372c533bd0360453415eaedad5edceb45d5ccc3e32740960e593046a5b9b.exe
File opened for modification	C:\Windows\hosts.exe	bee5372c533bd0360453415eaedad5edceb45d5ccc3e32740960e593046a5b9b.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies registry key 1 TTPs 9 IoCs

Modify Registry

T1112

pid	Process
1156	REG.exe
892	REG.exe
1984	REG.exe
1028	REG.exe
944	REG.exe
1968	REG.exe
1952	REG.exe
336	REG.exe
1192	REG.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

pid	Process
624	avscan.exe
1864	hosts.exe

Suspicious use of SetWindowsHookEx 7 IoCs

pid	Process
1368	bee5372c533bd0360453415eaedad5edceb45d5ccc3e32740960e593046a5b9b.exe
624	avscan.exe
1496	avscan.exe
1864	hosts.exe
1576	hosts.exe
1524	avscan.exe
1888	hosts.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1368 wrote to memory of 944	1368	bee5372c533bd0360453415eaedad5edceb45d5ccc3e32740960e593046a5b9b.exe	27
PID 1368 wrote to memory of 944	1368	bee5372c533bd0360453415eaedad5edceb45d5ccc3e32740960e593046a5b9b.exe	27
PID 1368 wrote to memory of 944	1368	bee5372c533bd0360453415eaedad5edceb45d5ccc3e32740960e593046a5b9b.exe	27
PID 1368 wrote to memory of 944	1368	bee5372c533bd0360453415eaedad5edceb45d5ccc3e32740960e593046a5b9b.exe	27
PID 1368 wrote to memory of 624	1368	bee5372c533bd0360453415eaedad5edceb45d5ccc3e32740960e593046a5b9b.exe	29
PID 1368 wrote to memory of 624	1368	bee5372c533bd0360453415eaedad5edceb45d5ccc3e32740960e593046a5b9b.exe	29
PID 1368 wrote to memory of 624	1368	bee5372c533bd0360453415eaedad5edceb45d5ccc3e32740960e593046a5b9b.exe	29
PID 1368 wrote to memory of 624	1368	bee5372c533bd0360453415eaedad5edceb45d5ccc3e32740960e593046a5b9b.exe	29
PID 624 wrote to memory of 1496	624	avscan.exe	30
PID 624 wrote to memory of 1496	624	avscan.exe	30
PID 624 wrote to memory of 1496	624	avscan.exe	30
PID 624 wrote to memory of 1496	624	avscan.exe	30
PID 624 wrote to memory of 1768	624	avscan.exe	32
PID 624 wrote to memory of 1768	624	avscan.exe	32
PID 624 wrote to memory of 1768	624	avscan.exe	32
PID 624 wrote to memory of 1768	624	avscan.exe	32
PID 1368 wrote to memory of 800	1368	bee5372c533bd0360453415eaedad5edceb45d5ccc3e32740960e593046a5b9b.exe	31
PID 1368 wrote to memory of 800	1368	bee5372c533bd0360453415eaedad5edceb45d5ccc3e32740960e593046a5b9b.exe	31
PID 1368 wrote to memory of 800	1368	bee5372c533bd0360453415eaedad5edceb45d5ccc3e32740960e593046a5b9b.exe	31
PID 1368 wrote to memory of 800	1368	bee5372c533bd0360453415eaedad5edceb45d5ccc3e32740960e593046a5b9b.exe	31
PID 800 wrote to memory of 1576	800	cmd.exe	36
PID 800 wrote to memory of 1576	800	cmd.exe	36
PID 800 wrote to memory of 1576	800	cmd.exe	36
PID 800 wrote to memory of 1576	800	cmd.exe	36
PID 1768 wrote to memory of 1864	1768	cmd.exe	35
PID 1768 wrote to memory of 1864	1768	cmd.exe	35
PID 1768 wrote to memory of 1864	1768	cmd.exe	35
PID 1768 wrote to memory of 1864	1768	cmd.exe	35
PID 1864 wrote to memory of 1524	1864	hosts.exe	37
PID 1864 wrote to memory of 1524	1864	hosts.exe	37
PID 1864 wrote to memory of 1524	1864	hosts.exe	37
PID 1864 wrote to memory of 1524	1864	hosts.exe	37
PID 1864 wrote to memory of 1928	1864	hosts.exe	39
PID 1864 wrote to memory of 1928	1864	hosts.exe	39
PID 1864 wrote to memory of 1928	1864	hosts.exe	39
PID 1864 wrote to memory of 1928	1864	hosts.exe	39
PID 800 wrote to memory of 1904	800	cmd.exe	38
PID 800 wrote to memory of 1904	800	cmd.exe	38
PID 800 wrote to memory of 1904	800	cmd.exe	38
PID 800 wrote to memory of 1904	800	cmd.exe	38
PID 1928 wrote to memory of 1888	1928	cmd.exe	41
PID 1928 wrote to memory of 1888	1928	cmd.exe	41
PID 1928 wrote to memory of 1888	1928	cmd.exe	41
PID 1928 wrote to memory of 1888	1928	cmd.exe	41
PID 1768 wrote to memory of 1748	1768	cmd.exe	42
PID 1768 wrote to memory of 1748	1768	cmd.exe	42
PID 1768 wrote to memory of 1748	1768	cmd.exe	42
PID 1768 wrote to memory of 1748	1768	cmd.exe	42
PID 1928 wrote to memory of 1684	1928	cmd.exe	43
PID 1928 wrote to memory of 1684	1928	cmd.exe	43
PID 1928 wrote to memory of 1684	1928	cmd.exe	43
PID 1928 wrote to memory of 1684	1928	cmd.exe	43
PID 1864 wrote to memory of 1968	1864	hosts.exe	44
PID 1864 wrote to memory of 1968	1864	hosts.exe	44
PID 1864 wrote to memory of 1968	1864	hosts.exe	44
PID 1864 wrote to memory of 1968	1864	hosts.exe	44
PID 624 wrote to memory of 1952	624	avscan.exe	45
PID 624 wrote to memory of 1952	624	avscan.exe	45
PID 624 wrote to memory of 1952	624	avscan.exe	45
PID 624 wrote to memory of 1952	624	avscan.exe	45
PID 1864 wrote to memory of 1192	1864	hosts.exe	49
PID 1864 wrote to memory of 1192	1864	hosts.exe	49
PID 1864 wrote to memory of 1192	1864	hosts.exe	49
PID 1864 wrote to memory of 1192	1864	hosts.exe	49

C:\Users\Admin\AppData\Local\Temp\bee5372c533bd0360453415eaedad5edceb45d5ccc3e32740960e593046a5b9b.exe
"C:\Users\Admin\AppData\Local\Temp\bee5372c533bd0360453415eaedad5edceb45d5ccc3e32740960e593046a5b9b.exe"
1⤵
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- Loads dropped DLL
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1368
- C:\Windows\SysWOW64\REG.exe
  REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
  2⤵
  - Modifies registry key
  PID:944
- C:\Users\Admin\AppData\Local\Temp\avscan.exe
  C:\Users\Admin\AppData\Local\Temp\avscan.exe
  2⤵
  - Modifies visibility of file extensions in Explorer
  - Modifies visiblity of hidden/system files in Explorer
  - Executes dropped EXE
  - Loads dropped DLL
  - Adds Run key to start application
  - Drops file in Windows directory
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:624
- - C:\Users\Admin\AppData\Local\Temp\avscan.exe
    C:\Users\Admin\AppData\Local\Temp\avscan.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1496
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c c:\windows\W_X_C.bat
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1768
  - - C:\windows\hosts.exe
      C:\windows\hosts.exe
      4⤵
      Modifies visibility of file extensions in Explorer
      Modifies visiblity of hidden/system files in Explorer
      Executes dropped EXE
      Loads dropped DLL
      Adds Run key to start application
      Drops file in Windows directory
      Suspicious behavior: GetForegroundWindowSpam
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:1864
    - - C:\Users\Admin\AppData\Local\Temp\avscan.exe
        
        C:\Users\Admin\AppData\Local\Temp\avscan.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1524
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd /c c:\windows\W_X_C.bat
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:1928
      - C:\windows\hosts.exe
        
        C:\windows\hosts.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1888
      - C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Windows\W_X_C.vbs"
        6⤵
        Adds policy Run key to start application
        
        PID:1684
    - - C:\Windows\SysWOW64\REG.exe
        
        REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
        5⤵
        Modifies registry key
        
        PID:1968
    - - C:\Windows\SysWOW64\REG.exe
        
        REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
        5⤵
        Modifies registry key
        
        PID:1192
    - - C:\Windows\SysWOW64\REG.exe
        
        REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
        5⤵
        Modifies registry key
        
        PID:1984
    - - C:\Windows\SysWOW64\REG.exe
        
        REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
        5⤵
        Modifies registry key
        
        PID:1156
  - - C:\Windows\SysWOW64\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Windows\W_X_C.vbs"
      4⤵
      Adds policy Run key to start application
      PID:1748
- - C:\Windows\SysWOW64\REG.exe
    REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
    3⤵
    - Modifies registry key
    PID:1952
- - C:\Windows\SysWOW64\REG.exe
    REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
    3⤵
    - Modifies registry key
    PID:336
- - C:\Windows\SysWOW64\REG.exe
    REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
    3⤵
    - Modifies registry key
    PID:892
- - C:\Windows\SysWOW64\REG.exe
    REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
    3⤵
    - Modifies registry key
    PID:1028
- C:\Windows\SysWOW64\cmd.exe
  cmd /c c:\windows\W_X_C.bat
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:800
- - C:\windows\hosts.exe
    C:\windows\hosts.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1576
- - C:\Windows\SysWOW64\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Windows\W_X_C.vbs"
    3⤵
    - Adds policy Run key to start application
    PID:1904

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Hidden Files and Directories

T1158

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Hidden Files and Directories

T1158

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Admin.bmp

Filesize
673KB

MD5
52b49842815a8317f0641bcf3290d80a

SHA1
6127f5165a4de3e1be79dde7a7b6527a8dad2c16

SHA256
86d4e46c017f41c739d4ee89cb68197c90dc60dbe06eb6e4caa60328a0757345

SHA512
d3bd5bb382c06cd5a00d9265f5b583738c5c11a816ce238cf7d432c0f56a719291c957809603874ec06c72aef86478e58f43ce1f8a7c9373b79eb7aabd4797d8

Download Submit
C:\Users\Admin\AppData\Local\Temp\Admin.bmp

Filesize
986KB

MD5
e058b72a3d04ff52681e72d62fbb28ac

SHA1
91c4698207b72bb6f28bf2d05803916f398d946e

SHA256
66236585c6f29d8e53a4f842f86ff1420fa3e875de9305145a6747b515a7ad38

SHA512
8a53ad76640cd11656d80b5becaed4b2e9ab6a4446b40baa09f5e50819c4f4a0e118a48191c9ca14608ee4d6b5117d3e6c380632842e4072ee58c80e5674bb3b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Admin.bmp

Filesize
986KB

MD5
e058b72a3d04ff52681e72d62fbb28ac

SHA1
91c4698207b72bb6f28bf2d05803916f398d946e

SHA256
66236585c6f29d8e53a4f842f86ff1420fa3e875de9305145a6747b515a7ad38

SHA512
8a53ad76640cd11656d80b5becaed4b2e9ab6a4446b40baa09f5e50819c4f4a0e118a48191c9ca14608ee4d6b5117d3e6c380632842e4072ee58c80e5674bb3b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Admin.bmp

Filesize
1.6MB

MD5
dd8a87ed7d3054604d68252e1854291d

SHA1
a0cc5379676649e14323a24a320d1256b494fb3a

SHA256
33a294b12e07cc70509f9c580036bbee8c49e8e792bd5de1a196416f4fc77b42

SHA512
7d1548d62847164eff1b8aba261bedcc79b0c09efbec3ea204b8fded356baf2d0fa4d0e7e3bad097fde282e2d8a81066f0765127270f19a78fd1f41b26d150bc

Download Submit
C:\Users\Admin\AppData\Local\Temp\Admin.bmp

Filesize
1.9MB

MD5
1f6bfcd30dd244106c88b8387021cad2

SHA1
c17393247da6ef4ed106a77fe2b4b07aa41e4690

SHA256
ae446b8484ce1d2d6197b2c8dc72606c0b3e9168a15f5845dd8d6d9296e5f343

SHA512
c893e86cf539c78fc5cc4696cf398b23c543df021e0abd84a33b2fff8e4b5c21e7631c7f82f8024532a6779c088f8e2793abc3ef72136a9205f34d548e5008aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Admin.bmp

Filesize
1.9MB

MD5
1f6bfcd30dd244106c88b8387021cad2

SHA1
c17393247da6ef4ed106a77fe2b4b07aa41e4690

SHA256
ae446b8484ce1d2d6197b2c8dc72606c0b3e9168a15f5845dd8d6d9296e5f343

SHA512
c893e86cf539c78fc5cc4696cf398b23c543df021e0abd84a33b2fff8e4b5c21e7631c7f82f8024532a6779c088f8e2793abc3ef72136a9205f34d548e5008aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\avscan.exe

Filesize
312KB

MD5
aa624a9c6850cc94ccf35610ee01586b

SHA1
60c634e17ece6c11e4dfad267c7e3f06e48da249

SHA256
9f423f1ef02e4f1d62d50424b8337e21883b08dc3e4fbdf4ff0040593fe3521b

SHA512
193d96ffc285541816eba925811848807865b82d5ab356027d954550326755d21b8809f941fcaccabc6b6c35e3d864483a233e3dcd9e84945c5545942391ab32

Download Submit
C:\Users\Admin\AppData\Local\Temp\avscan.exe

Filesize
312KB

MD5
aa624a9c6850cc94ccf35610ee01586b

SHA1
60c634e17ece6c11e4dfad267c7e3f06e48da249

SHA256
9f423f1ef02e4f1d62d50424b8337e21883b08dc3e4fbdf4ff0040593fe3521b

SHA512
193d96ffc285541816eba925811848807865b82d5ab356027d954550326755d21b8809f941fcaccabc6b6c35e3d864483a233e3dcd9e84945c5545942391ab32

Download Submit
C:\Users\Admin\AppData\Local\Temp\avscan.exe

Filesize
312KB

MD5
aa624a9c6850cc94ccf35610ee01586b

SHA1
60c634e17ece6c11e4dfad267c7e3f06e48da249

SHA256
9f423f1ef02e4f1d62d50424b8337e21883b08dc3e4fbdf4ff0040593fe3521b

SHA512
193d96ffc285541816eba925811848807865b82d5ab356027d954550326755d21b8809f941fcaccabc6b6c35e3d864483a233e3dcd9e84945c5545942391ab32

Download Submit
C:\Users\Admin\AppData\Local\Temp\avscan.exe

Filesize
312KB

MD5
aa624a9c6850cc94ccf35610ee01586b

SHA1
60c634e17ece6c11e4dfad267c7e3f06e48da249

SHA256
9f423f1ef02e4f1d62d50424b8337e21883b08dc3e4fbdf4ff0040593fe3521b

SHA512
193d96ffc285541816eba925811848807865b82d5ab356027d954550326755d21b8809f941fcaccabc6b6c35e3d864483a233e3dcd9e84945c5545942391ab32

Download Submit
C:\Windows\W_X_C.vbs

Filesize
195B

MD5
8efab902a61f6cddc318bb5818c2f2e0

SHA1
9608751279ae04ba710d84c61e3937c12950b393

SHA256
a81d0e86c651ead3e4d9c7f64e637006e787c81c8ba3e784648c2786306bfb87

SHA512
aabd0e45609a39584c68c35e16124b399e9a4932bf6c98c22aa8c6ff71b2fbfc80333102960fcfca1abb38b344245f9cdf4cdc0c827c48235f618011a5fbfe18

Download Submit
C:\Windows\hosts.exe

Filesize
312KB

MD5
e3d2e4d71a2ae5a67bd04eecf63c73b7

SHA1
590d8a1e11c20b9777392d88882d92ca432d6159

SHA256
368cd67f4fce6eb5731414cce33f7a0a7f6eeaf7b87f54ba755fc419a0eed89c

SHA512
b647248b2fb2a77fd001760766f1fc92a8f3c3c2f07f0573af241731f81af3646c66624e5b9e88f33a9f05f3e6e9d712488ee6bee3220b152bd2c5d3fbee0d3c

Download Submit
C:\Windows\hosts.exe

Filesize
312KB

MD5
e3d2e4d71a2ae5a67bd04eecf63c73b7

SHA1
590d8a1e11c20b9777392d88882d92ca432d6159

SHA256
368cd67f4fce6eb5731414cce33f7a0a7f6eeaf7b87f54ba755fc419a0eed89c

SHA512
b647248b2fb2a77fd001760766f1fc92a8f3c3c2f07f0573af241731f81af3646c66624e5b9e88f33a9f05f3e6e9d712488ee6bee3220b152bd2c5d3fbee0d3c

Download Submit
C:\Windows\hosts.exe

Filesize
312KB

MD5
e3d2e4d71a2ae5a67bd04eecf63c73b7

SHA1
590d8a1e11c20b9777392d88882d92ca432d6159

SHA256
368cd67f4fce6eb5731414cce33f7a0a7f6eeaf7b87f54ba755fc419a0eed89c

SHA512
b647248b2fb2a77fd001760766f1fc92a8f3c3c2f07f0573af241731f81af3646c66624e5b9e88f33a9f05f3e6e9d712488ee6bee3220b152bd2c5d3fbee0d3c

Download Submit
C:\Windows\hosts.exe

Filesize
312KB

MD5
e3d2e4d71a2ae5a67bd04eecf63c73b7

SHA1
590d8a1e11c20b9777392d88882d92ca432d6159

SHA256
368cd67f4fce6eb5731414cce33f7a0a7f6eeaf7b87f54ba755fc419a0eed89c

SHA512
b647248b2fb2a77fd001760766f1fc92a8f3c3c2f07f0573af241731f81af3646c66624e5b9e88f33a9f05f3e6e9d712488ee6bee3220b152bd2c5d3fbee0d3c

Download Submit
C:\windows\hosts.exe

Filesize
312KB

MD5
e3d2e4d71a2ae5a67bd04eecf63c73b7

SHA1
590d8a1e11c20b9777392d88882d92ca432d6159

SHA256
368cd67f4fce6eb5731414cce33f7a0a7f6eeaf7b87f54ba755fc419a0eed89c

SHA512
b647248b2fb2a77fd001760766f1fc92a8f3c3c2f07f0573af241731f81af3646c66624e5b9e88f33a9f05f3e6e9d712488ee6bee3220b152bd2c5d3fbee0d3c

Download Submit
\??\c:\windows\W_X_C.bat

Filesize
336B

MD5
4db9f8b6175722b62ececeeeba1ce307

SHA1
3b3ba8414706e72a6fa19e884a97b87609e11e47

SHA256
d2150b9e5a4ce55e140f0ca91c4e300715d42095c8fddf58c77037cdd2cfaf78

SHA512
1d6dc274cf7a3dd704f840e6a5ad57ab4c4e35d5f09489aeff520bb797e1c825bac53fc335156fe41e767a46520d031855fe42fe7b175409ebe5e9e986fb9b8b

Download Submit
\Users\Admin\AppData\Local\Temp\avscan.exe

Filesize
312KB

MD5
aa624a9c6850cc94ccf35610ee01586b

SHA1
60c634e17ece6c11e4dfad267c7e3f06e48da249

SHA256
9f423f1ef02e4f1d62d50424b8337e21883b08dc3e4fbdf4ff0040593fe3521b

SHA512
193d96ffc285541816eba925811848807865b82d5ab356027d954550326755d21b8809f941fcaccabc6b6c35e3d864483a233e3dcd9e84945c5545942391ab32

Download Submit
\Users\Admin\AppData\Local\Temp\avscan.exe

Filesize
312KB

MD5
aa624a9c6850cc94ccf35610ee01586b

SHA1
60c634e17ece6c11e4dfad267c7e3f06e48da249

SHA256
9f423f1ef02e4f1d62d50424b8337e21883b08dc3e4fbdf4ff0040593fe3521b

SHA512
193d96ffc285541816eba925811848807865b82d5ab356027d954550326755d21b8809f941fcaccabc6b6c35e3d864483a233e3dcd9e84945c5545942391ab32

Download Submit
\Users\Admin\AppData\Local\Temp\avscan.exe

Filesize
312KB

MD5
aa624a9c6850cc94ccf35610ee01586b

SHA1
60c634e17ece6c11e4dfad267c7e3f06e48da249

SHA256
9f423f1ef02e4f1d62d50424b8337e21883b08dc3e4fbdf4ff0040593fe3521b

SHA512
193d96ffc285541816eba925811848807865b82d5ab356027d954550326755d21b8809f941fcaccabc6b6c35e3d864483a233e3dcd9e84945c5545942391ab32

Download Submit
\Users\Admin\AppData\Local\Temp\avscan.exe

Filesize
312KB

MD5
aa624a9c6850cc94ccf35610ee01586b

SHA1
60c634e17ece6c11e4dfad267c7e3f06e48da249

SHA256
9f423f1ef02e4f1d62d50424b8337e21883b08dc3e4fbdf4ff0040593fe3521b

SHA512
193d96ffc285541816eba925811848807865b82d5ab356027d954550326755d21b8809f941fcaccabc6b6c35e3d864483a233e3dcd9e84945c5545942391ab32

Download Submit
\Users\Admin\AppData\Local\Temp\avscan.exe

Filesize
312KB

MD5
aa624a9c6850cc94ccf35610ee01586b

SHA1
60c634e17ece6c11e4dfad267c7e3f06e48da249

SHA256
9f423f1ef02e4f1d62d50424b8337e21883b08dc3e4fbdf4ff0040593fe3521b

SHA512
193d96ffc285541816eba925811848807865b82d5ab356027d954550326755d21b8809f941fcaccabc6b6c35e3d864483a233e3dcd9e84945c5545942391ab32

Download Submit
memory/1368-58-0x0000000074051000-0x0000000074053000-memory.dmp

Filesize
8KB

Download
memory/1368-56-0x0000000074E41000-0x0000000074E43000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads