9a25c7125083aa08700889082a1d830344e4bbc6a441b22600d4d40ca507da87

Analysis

max time kernel
183s
max time network
189s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
29-11-2022 16:26

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

9a25c7125083aa08700889082a1d830344e4bbc6a441b22600d4d40ca507da87.exe
Size

775KB
MD5

6181dcc0e984b0d0ac6d3bdbe7de5678
SHA1

c1c3e8c738f274ed483322f42c55ab3ba41e99b5
SHA256

9a25c7125083aa08700889082a1d830344e4bbc6a441b22600d4d40ca507da87
SHA512

24310cad7b1e6aa4558e87ae4383d90e8522457819be04a72bb7bfb5af13258af360e2b9f086db13609ba5501bde788146ec1a1b0879bcf2bb3b99b8157dfe5e
SSDEEP

12288:g72bnuwsO0ADREQ772bnuwsO0ADREQTkTQyH:g72zp9EE72zp9E1QK

Score

10^/10

evasion persistence

Malware Config

Signatures

Modifies visibility of file extensions in Explorer 2 TTPs 3 IoCs

evasion

Hidden Files and Directories

T1158

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	9a25c7125083aa08700889082a1d830344e4bbc6a441b22600d4d40ca507da87.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	avscan.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	hosts.exe

Modifies visiblity of hidden/system files in Explorer 2 TTPs 3 IoCs

evasion

Hidden Files and Directories

T1158

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	9a25c7125083aa08700889082a1d830344e4bbc6a441b22600d4d40ca507da87.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	avscan.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	hosts.exe

Adds policy Run key to start application 2 TTPs 6 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	WScript.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\GBQHURCC = "W_X_C.bat"	WScript.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	WScript.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\GBQHURCC = "W_X_C.bat"	WScript.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	WScript.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\GBQHURCC = "W_X_C.bat"	WScript.exe

Executes dropped EXE 6 IoCs

pid	Process
4768	avscan.exe
4716	avscan.exe
3944	hosts.exe
2464	avscan.exe
3412	hosts.exe
2192	hosts.exe

Checks computer location settings 2 TTPs 3 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation	cmd.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation	cmd.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation	cmd.exe

Adds Run key to start application 2 TTPs 6 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run	avscan.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\avscan = "C:\\Users\\Admin\\AppData\\Local\\Temp\\avscan.exe"	avscan.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run	hosts.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\avscan = "C:\\Users\\Admin\\AppData\\Local\\Temp\\avscan.exe"	hosts.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run	9a25c7125083aa08700889082a1d830344e4bbc6a441b22600d4d40ca507da87.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\avscan = "C:\\Users\\Admin\\AppData\\Local\\Temp\\avscan.exe"	9a25c7125083aa08700889082a1d830344e4bbc6a441b22600d4d40ca507da87.exe

Drops file in Windows directory 5 IoCs

description	ioc	Process
File created	C:\windows\W_X_C.vbs	9a25c7125083aa08700889082a1d830344e4bbc6a441b22600d4d40ca507da87.exe
File created	\??\c:\windows\W_X_C.bat	9a25c7125083aa08700889082a1d830344e4bbc6a441b22600d4d40ca507da87.exe
File opened for modification	C:\Windows\hosts.exe	9a25c7125083aa08700889082a1d830344e4bbc6a441b22600d4d40ca507da87.exe
File opened for modification	C:\Windows\hosts.exe	avscan.exe
File opened for modification	C:\Windows\hosts.exe	hosts.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies registry class 4 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\Local Settings	9a25c7125083aa08700889082a1d830344e4bbc6a441b22600d4d40ca507da87.exe
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\Local Settings	cmd.exe

Modifies registry key 1 TTPs 9 IoCs

Modify Registry

T1112

pid	Process
4904	REG.exe
4160	REG.exe
2332	REG.exe
2808	REG.exe
2460	REG.exe
932	REG.exe
1988	REG.exe
1452	REG.exe
868	REG.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

pid	Process
4768	avscan.exe
3944	hosts.exe

Suspicious use of SetWindowsHookEx 7 IoCs

pid	Process
4952	9a25c7125083aa08700889082a1d830344e4bbc6a441b22600d4d40ca507da87.exe
4768	avscan.exe
4716	avscan.exe
3944	hosts.exe
2464	avscan.exe
3412	hosts.exe
2192	hosts.exe

Suspicious use of WriteProcessMemory 63 IoCs

description	pid	Process	procid_target
PID 4952 wrote to memory of 932	4952	9a25c7125083aa08700889082a1d830344e4bbc6a441b22600d4d40ca507da87.exe	80
PID 4952 wrote to memory of 932	4952	9a25c7125083aa08700889082a1d830344e4bbc6a441b22600d4d40ca507da87.exe	80
PID 4952 wrote to memory of 932	4952	9a25c7125083aa08700889082a1d830344e4bbc6a441b22600d4d40ca507da87.exe	80
PID 4952 wrote to memory of 4768	4952	9a25c7125083aa08700889082a1d830344e4bbc6a441b22600d4d40ca507da87.exe	82
PID 4952 wrote to memory of 4768	4952	9a25c7125083aa08700889082a1d830344e4bbc6a441b22600d4d40ca507da87.exe	82
PID 4952 wrote to memory of 4768	4952	9a25c7125083aa08700889082a1d830344e4bbc6a441b22600d4d40ca507da87.exe	82
PID 4768 wrote to memory of 4716	4768	avscan.exe	83
PID 4768 wrote to memory of 4716	4768	avscan.exe	83
PID 4768 wrote to memory of 4716	4768	avscan.exe	83
PID 4768 wrote to memory of 2116	4768	avscan.exe	84
PID 4768 wrote to memory of 2116	4768	avscan.exe	84
PID 4768 wrote to memory of 2116	4768	avscan.exe	84
PID 4952 wrote to memory of 1352	4952	9a25c7125083aa08700889082a1d830344e4bbc6a441b22600d4d40ca507da87.exe	85
PID 4952 wrote to memory of 1352	4952	9a25c7125083aa08700889082a1d830344e4bbc6a441b22600d4d40ca507da87.exe	85
PID 4952 wrote to memory of 1352	4952	9a25c7125083aa08700889082a1d830344e4bbc6a441b22600d4d40ca507da87.exe	85
PID 2116 wrote to memory of 3944	2116	cmd.exe	88
PID 2116 wrote to memory of 3944	2116	cmd.exe	88
PID 2116 wrote to memory of 3944	2116	cmd.exe	88
PID 3944 wrote to memory of 2464	3944	hosts.exe	90
PID 3944 wrote to memory of 2464	3944	hosts.exe	90
PID 3944 wrote to memory of 2464	3944	hosts.exe	90
PID 1352 wrote to memory of 3412	1352	cmd.exe	91
PID 1352 wrote to memory of 3412	1352	cmd.exe	91
PID 1352 wrote to memory of 3412	1352	cmd.exe	91
PID 3944 wrote to memory of 224	3944	hosts.exe	92
PID 3944 wrote to memory of 224	3944	hosts.exe	92
PID 3944 wrote to memory of 224	3944	hosts.exe	92
PID 224 wrote to memory of 2192	224	cmd.exe	94
PID 224 wrote to memory of 2192	224	cmd.exe	94
PID 224 wrote to memory of 2192	224	cmd.exe	94
PID 2116 wrote to memory of 3016	2116	cmd.exe	95
PID 2116 wrote to memory of 3016	2116	cmd.exe	95
PID 2116 wrote to memory of 3016	2116	cmd.exe	95
PID 1352 wrote to memory of 3456	1352	cmd.exe	96
PID 1352 wrote to memory of 3456	1352	cmd.exe	96
PID 1352 wrote to memory of 3456	1352	cmd.exe	96
PID 224 wrote to memory of 4756	224	cmd.exe	97
PID 224 wrote to memory of 4756	224	cmd.exe	97
PID 224 wrote to memory of 4756	224	cmd.exe	97
PID 4768 wrote to memory of 4160	4768	avscan.exe	98
PID 4768 wrote to memory of 4160	4768	avscan.exe	98
PID 4768 wrote to memory of 4160	4768	avscan.exe	98
PID 3944 wrote to memory of 2332	3944	hosts.exe	100
PID 3944 wrote to memory of 2332	3944	hosts.exe	100
PID 3944 wrote to memory of 2332	3944	hosts.exe	100
PID 3944 wrote to memory of 1988	3944	hosts.exe	103
PID 3944 wrote to memory of 1988	3944	hosts.exe	103
PID 3944 wrote to memory of 1988	3944	hosts.exe	103
PID 4768 wrote to memory of 2808	4768	avscan.exe	102
PID 4768 wrote to memory of 2808	4768	avscan.exe	102
PID 4768 wrote to memory of 2808	4768	avscan.exe	102
PID 3944 wrote to memory of 1452	3944	hosts.exe	112
PID 3944 wrote to memory of 1452	3944	hosts.exe	112
PID 3944 wrote to memory of 1452	3944	hosts.exe	112
PID 4768 wrote to memory of 868	4768	avscan.exe	113
PID 4768 wrote to memory of 868	4768	avscan.exe	113
PID 4768 wrote to memory of 868	4768	avscan.exe	113
PID 4768 wrote to memory of 4904	4768	avscan.exe	117
PID 4768 wrote to memory of 4904	4768	avscan.exe	117
PID 4768 wrote to memory of 4904	4768	avscan.exe	117
PID 3944 wrote to memory of 2460	3944	hosts.exe	116
PID 3944 wrote to memory of 2460	3944	hosts.exe	116
PID 3944 wrote to memory of 2460	3944	hosts.exe	116

C:\Users\Admin\AppData\Local\Temp\9a25c7125083aa08700889082a1d830344e4bbc6a441b22600d4d40ca507da87.exe
"C:\Users\Admin\AppData\Local\Temp\9a25c7125083aa08700889082a1d830344e4bbc6a441b22600d4d40ca507da87.exe"
1⤵
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- Adds Run key to start application
- Drops file in Windows directory
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4952
- C:\Windows\SysWOW64\REG.exe
  REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
  2⤵
  - Modifies registry key
  PID:932
- C:\Users\Admin\AppData\Local\Temp\avscan.exe
  C:\Users\Admin\AppData\Local\Temp\avscan.exe
  2⤵
  - Modifies visibility of file extensions in Explorer
  - Modifies visiblity of hidden/system files in Explorer
  - Executes dropped EXE
  - Adds Run key to start application
  - Drops file in Windows directory
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4768
- - C:\Users\Admin\AppData\Local\Temp\avscan.exe
    C:\Users\Admin\AppData\Local\Temp\avscan.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:4716
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c c:\windows\W_X_C.bat
    3⤵
    - Checks computer location settings
    - Modifies registry class
    - Suspicious use of WriteProcessMemory
    PID:2116
  - - C:\windows\hosts.exe
      C:\windows\hosts.exe
      4⤵
      Modifies visibility of file extensions in Explorer
      Modifies visiblity of hidden/system files in Explorer
      Executes dropped EXE
      Adds Run key to start application
      Drops file in Windows directory
      Suspicious behavior: GetForegroundWindowSpam
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:3944
    - - C:\Users\Admin\AppData\Local\Temp\avscan.exe
        
        C:\Users\Admin\AppData\Local\Temp\avscan.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2464
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c c:\windows\W_X_C.bat
        5⤵
        Checks computer location settings
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:224
      - C:\windows\hosts.exe
        
        C:\windows\hosts.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2192
      - C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Windows\W_X_C.vbs"
        6⤵
        Adds policy Run key to start application
        
        PID:4756
    - - C:\Windows\SysWOW64\REG.exe
        
        REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
        5⤵
        Modifies registry key
        
        PID:2332
    - - C:\Windows\SysWOW64\REG.exe
        
        REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
        5⤵
        Modifies registry key
        
        PID:1988
    - - C:\Windows\SysWOW64\REG.exe
        
        REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
        5⤵
        Modifies registry key
        
        PID:1452
    - - C:\Windows\SysWOW64\REG.exe
        
        REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
        5⤵
        Modifies registry key
        
        PID:2460
  - - C:\Windows\SysWOW64\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Windows\W_X_C.vbs"
      4⤵
      Adds policy Run key to start application
      PID:3016
- - C:\Windows\SysWOW64\REG.exe
    REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
    3⤵
    - Modifies registry key
    PID:4160
- - C:\Windows\SysWOW64\REG.exe
    REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
    3⤵
    - Modifies registry key
    PID:2808
- - C:\Windows\SysWOW64\REG.exe
    REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
    3⤵
    - Modifies registry key
    PID:868
- - C:\Windows\SysWOW64\REG.exe
    REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
    3⤵
    - Modifies registry key
    PID:4904
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c c:\windows\W_X_C.bat
  2⤵
  - Checks computer location settings
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:1352
- - C:\windows\hosts.exe
    C:\windows\hosts.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:3412
- - C:\Windows\SysWOW64\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Windows\W_X_C.vbs"
    3⤵
    - Adds policy Run key to start application
    PID:3456

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:2184

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Hidden Files and Directories

T1158

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Hidden Files and Directories

T1158

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\avscan.exe

Filesize
775KB

MD5
a17a64c98a1d9cae0595f1f3dfc0f5c0

SHA1
5ed2c6e4a5547801928df68e86c83ea11e3744f9

SHA256
91294cd5f8c3fe1dce3e38e96cfaaf71e6595317d04a71d75d81631951fc4907

SHA512
642668a85f1f432f4c7a2793315cfdaf41c28916483e09b126cb4147b5b298b7d879e2fcae501f94b820b0697396a8bcd0a8352d5bf78df50cd5f8fcb8b13dd5

Download Submit
C:\Users\Admin\AppData\Local\Temp\avscan.exe

Filesize
775KB

MD5
a17a64c98a1d9cae0595f1f3dfc0f5c0

SHA1
5ed2c6e4a5547801928df68e86c83ea11e3744f9

SHA256
91294cd5f8c3fe1dce3e38e96cfaaf71e6595317d04a71d75d81631951fc4907

SHA512
642668a85f1f432f4c7a2793315cfdaf41c28916483e09b126cb4147b5b298b7d879e2fcae501f94b820b0697396a8bcd0a8352d5bf78df50cd5f8fcb8b13dd5

Download Submit
C:\Users\Admin\AppData\Local\Temp\avscan.exe

Filesize
775KB

MD5
a17a64c98a1d9cae0595f1f3dfc0f5c0

SHA1
5ed2c6e4a5547801928df68e86c83ea11e3744f9

SHA256
91294cd5f8c3fe1dce3e38e96cfaaf71e6595317d04a71d75d81631951fc4907

SHA512
642668a85f1f432f4c7a2793315cfdaf41c28916483e09b126cb4147b5b298b7d879e2fcae501f94b820b0697396a8bcd0a8352d5bf78df50cd5f8fcb8b13dd5

Download Submit
C:\Users\Admin\AppData\Local\Temp\avscan.exe

Filesize
775KB

MD5
a17a64c98a1d9cae0595f1f3dfc0f5c0

SHA1
5ed2c6e4a5547801928df68e86c83ea11e3744f9

SHA256
91294cd5f8c3fe1dce3e38e96cfaaf71e6595317d04a71d75d81631951fc4907

SHA512
642668a85f1f432f4c7a2793315cfdaf41c28916483e09b126cb4147b5b298b7d879e2fcae501f94b820b0697396a8bcd0a8352d5bf78df50cd5f8fcb8b13dd5

Download Submit
C:\Windows\W_X_C.vbs

Filesize
195B

MD5
5b87381bf407d7c6018a8b11c3e20f92

SHA1
bb61b28d9c8fd7dfeb13a397c49a1be3abc06ca2

SHA256
4785d6a229d0872fe90c75ab620de9a680d7f07ccd27a134da2afc4ee88f34f3

SHA512
05db1178f671e9d6c3a1c601349093447b04ebddcd071a06f7cc92cbaf7efb53027bc92523a19372a08ca5af715cc9955649255f8be1909b5e594385b3dcbe3d

Download Submit
C:\Windows\hosts.exe

Filesize
775KB

MD5
07f9e5c5128479f2353ae8387566bbf1

SHA1
7e8a9889b2e6005248f770328faf68c32a40b409

SHA256
68e56d263d9758c775722ae640167f547a8caa126fbc291ab372fa84f2353401

SHA512
c93569e5fa30e088c0c485a298acb6751e1a063da28241abfa6a2b639d2e91b72dc8deab87616ddd6e9f8b7a8b7e7a522012d292a95a93edb8aad5abd4a39d7d

Download Submit
C:\Windows\hosts.exe

Filesize
775KB

MD5
07f9e5c5128479f2353ae8387566bbf1

SHA1
7e8a9889b2e6005248f770328faf68c32a40b409

SHA256
68e56d263d9758c775722ae640167f547a8caa126fbc291ab372fa84f2353401

SHA512
c93569e5fa30e088c0c485a298acb6751e1a063da28241abfa6a2b639d2e91b72dc8deab87616ddd6e9f8b7a8b7e7a522012d292a95a93edb8aad5abd4a39d7d

Download Submit
C:\Windows\hosts.exe

Filesize
775KB

MD5
07f9e5c5128479f2353ae8387566bbf1

SHA1
7e8a9889b2e6005248f770328faf68c32a40b409

SHA256
68e56d263d9758c775722ae640167f547a8caa126fbc291ab372fa84f2353401

SHA512
c93569e5fa30e088c0c485a298acb6751e1a063da28241abfa6a2b639d2e91b72dc8deab87616ddd6e9f8b7a8b7e7a522012d292a95a93edb8aad5abd4a39d7d

Download Submit
C:\Windows\hosts.exe

Filesize
775KB

MD5
07f9e5c5128479f2353ae8387566bbf1

SHA1
7e8a9889b2e6005248f770328faf68c32a40b409

SHA256
68e56d263d9758c775722ae640167f547a8caa126fbc291ab372fa84f2353401

SHA512
c93569e5fa30e088c0c485a298acb6751e1a063da28241abfa6a2b639d2e91b72dc8deab87616ddd6e9f8b7a8b7e7a522012d292a95a93edb8aad5abd4a39d7d

Download Submit
C:\windows\hosts.exe

Filesize
775KB

MD5
07f9e5c5128479f2353ae8387566bbf1

SHA1
7e8a9889b2e6005248f770328faf68c32a40b409

SHA256
68e56d263d9758c775722ae640167f547a8caa126fbc291ab372fa84f2353401

SHA512
c93569e5fa30e088c0c485a298acb6751e1a063da28241abfa6a2b639d2e91b72dc8deab87616ddd6e9f8b7a8b7e7a522012d292a95a93edb8aad5abd4a39d7d

Download Submit
\??\c:\windows\W_X_C.bat

Filesize
336B

MD5
4db9f8b6175722b62ececeeeba1ce307

SHA1
3b3ba8414706e72a6fa19e884a97b87609e11e47

SHA256
d2150b9e5a4ce55e140f0ca91c4e300715d42095c8fddf58c77037cdd2cfaf78

SHA512
1d6dc274cf7a3dd704f840e6a5ad57ab4c4e35d5f09489aeff520bb797e1c825bac53fc335156fe41e767a46520d031855fe42fe7b175409ebe5e9e986fb9b8b

Download Submit
memory/224-159-0x0000000000000000-mapping.dmp

Download
memory/868-175-0x0000000000000000-mapping.dmp

Download
memory/932-134-0x0000000000000000-mapping.dmp

Download
memory/1352-146-0x0000000000000000-mapping.dmp

Download
memory/1452-174-0x0000000000000000-mapping.dmp

Download
memory/1988-172-0x0000000000000000-mapping.dmp

Download
memory/2116-145-0x0000000000000000-mapping.dmp

Download
memory/2192-163-0x0000000000000000-mapping.dmp

Download
memory/2332-171-0x0000000000000000-mapping.dmp

Download
memory/2460-177-0x0000000000000000-mapping.dmp

Download
memory/2464-153-0x0000000000000000-mapping.dmp

Download
memory/2808-173-0x0000000000000000-mapping.dmp

Download
memory/3016-165-0x0000000000000000-mapping.dmp

Download
memory/3412-157-0x0000000000000000-mapping.dmp

Download
memory/3456-166-0x0000000000000000-mapping.dmp

Download
memory/3944-148-0x0000000000000000-mapping.dmp

Download
memory/4160-170-0x0000000000000000-mapping.dmp

Download
memory/4716-141-0x0000000000000000-mapping.dmp

Download
memory/4756-169-0x0000000000000000-mapping.dmp

Download
memory/4768-135-0x0000000000000000-mapping.dmp

Download
memory/4904-176-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads