7c2ff9ddb3f4a1a0f8c29764134cd3c54f586c9e2e409583797c8726f9d927b2

Analysis

max time kernel
126s
max time network
128s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
29/11/2022, 16:27

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

7c2ff9ddb3f4a1a0f8c29764134cd3c54f586c9e2e409583797c8726f9d927b2.exe
Size

695KB
MD5

66137fe37f88e4d841cafb127426cd0d
SHA1

9f2bd68ccc54ee352dfcb99e4d163ab0da1fe304
SHA256

7c2ff9ddb3f4a1a0f8c29764134cd3c54f586c9e2e409583797c8726f9d927b2
SHA512

f022997bcedf93a284da095a26cc4e50d341b7a6746ee956ae4374b210860c1aaf6d7d079f29322b7a692352cdb1cb2efedecfba663b95103bdeae7f883e86eb
SSDEEP

12288:g72bntEDs72bntED8A72bntEDs72bntED84F:g72zms72zmP72zms72zmP

Score

10^/10

evasion persistence

Malware Config

Signatures

Modifies visibility of file extensions in Explorer 2 TTPs 3 IoCs

evasion

Hidden Files and Directories

T1158

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	avscan.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	hosts.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	7c2ff9ddb3f4a1a0f8c29764134cd3c54f586c9e2e409583797c8726f9d927b2.exe

Modifies visiblity of hidden/system files in Explorer 2 TTPs 3 IoCs

evasion

Hidden Files and Directories

T1158

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	7c2ff9ddb3f4a1a0f8c29764134cd3c54f586c9e2e409583797c8726f9d927b2.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	avscan.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	hosts.exe

Adds policy Run key to start application 2 TTPs 6 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	WScript.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\IYMUGYHL = "W_X_C.bat"	WScript.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	WScript.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\IYMUGYHL = "W_X_C.bat"	WScript.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	WScript.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\IYMUGYHL = "W_X_C.bat"	WScript.exe

Executes dropped EXE 6 IoCs

pid	Process
1336	avscan.exe
2288	avscan.exe
3588	hosts.exe
3368	hosts.exe
3376	avscan.exe
4416	hosts.exe

Checks computer location settings 2 TTPs 3 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation	cmd.exe
Key value queried	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation	cmd.exe
Key value queried	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation	cmd.exe

Adds Run key to start application 2 TTPs 6 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run	hosts.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\avscan = "C:\\Users\\Admin\\AppData\\Local\\Temp\\avscan.exe"	hosts.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run	7c2ff9ddb3f4a1a0f8c29764134cd3c54f586c9e2e409583797c8726f9d927b2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\avscan = "C:\\Users\\Admin\\AppData\\Local\\Temp\\avscan.exe"	7c2ff9ddb3f4a1a0f8c29764134cd3c54f586c9e2e409583797c8726f9d927b2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run	avscan.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\avscan = "C:\\Users\\Admin\\AppData\\Local\\Temp\\avscan.exe"	avscan.exe

Drops file in Windows directory 5 IoCs

description	ioc	Process
File opened for modification	C:\Windows\hosts.exe	hosts.exe
File created	C:\windows\W_X_C.vbs	7c2ff9ddb3f4a1a0f8c29764134cd3c54f586c9e2e409583797c8726f9d927b2.exe
File created	\??\c:\windows\W_X_C.bat	7c2ff9ddb3f4a1a0f8c29764134cd3c54f586c9e2e409583797c8726f9d927b2.exe
File opened for modification	C:\Windows\hosts.exe	7c2ff9ddb3f4a1a0f8c29764134cd3c54f586c9e2e409583797c8726f9d927b2.exe
File opened for modification	C:\Windows\hosts.exe	avscan.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies registry class 4 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\Local Settings	7c2ff9ddb3f4a1a0f8c29764134cd3c54f586c9e2e409583797c8726f9d927b2.exe

Modifies registry key 1 TTPs 9 IoCs

Modify Registry

T1112

pid	Process
2648	REG.exe
4580	REG.exe
3384	REG.exe
3904	REG.exe
3068	REG.exe
3708	REG.exe
4992	REG.exe
4804	REG.exe
2396	REG.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

pid	Process
1336	avscan.exe
3368	hosts.exe

Suspicious use of SetWindowsHookEx 7 IoCs

pid	Process
4876	7c2ff9ddb3f4a1a0f8c29764134cd3c54f586c9e2e409583797c8726f9d927b2.exe
1336	avscan.exe
2288	avscan.exe
3588	hosts.exe
3368	hosts.exe
3376	avscan.exe
4416	hosts.exe

Suspicious use of WriteProcessMemory 63 IoCs

description	pid	Process	procid_target
PID 4876 wrote to memory of 4804	4876	7c2ff9ddb3f4a1a0f8c29764134cd3c54f586c9e2e409583797c8726f9d927b2.exe	82
PID 4876 wrote to memory of 4804	4876	7c2ff9ddb3f4a1a0f8c29764134cd3c54f586c9e2e409583797c8726f9d927b2.exe	82
PID 4876 wrote to memory of 4804	4876	7c2ff9ddb3f4a1a0f8c29764134cd3c54f586c9e2e409583797c8726f9d927b2.exe	82
PID 4876 wrote to memory of 1336	4876	7c2ff9ddb3f4a1a0f8c29764134cd3c54f586c9e2e409583797c8726f9d927b2.exe	84
PID 4876 wrote to memory of 1336	4876	7c2ff9ddb3f4a1a0f8c29764134cd3c54f586c9e2e409583797c8726f9d927b2.exe	84
PID 4876 wrote to memory of 1336	4876	7c2ff9ddb3f4a1a0f8c29764134cd3c54f586c9e2e409583797c8726f9d927b2.exe	84
PID 1336 wrote to memory of 2288	1336	avscan.exe	85
PID 1336 wrote to memory of 2288	1336	avscan.exe	85
PID 1336 wrote to memory of 2288	1336	avscan.exe	85
PID 1336 wrote to memory of 2364	1336	avscan.exe	86
PID 1336 wrote to memory of 2364	1336	avscan.exe	86
PID 1336 wrote to memory of 2364	1336	avscan.exe	86
PID 4876 wrote to memory of 1576	4876	7c2ff9ddb3f4a1a0f8c29764134cd3c54f586c9e2e409583797c8726f9d927b2.exe	87
PID 4876 wrote to memory of 1576	4876	7c2ff9ddb3f4a1a0f8c29764134cd3c54f586c9e2e409583797c8726f9d927b2.exe	87
PID 4876 wrote to memory of 1576	4876	7c2ff9ddb3f4a1a0f8c29764134cd3c54f586c9e2e409583797c8726f9d927b2.exe	87
PID 2364 wrote to memory of 3368	2364	cmd.exe	91
PID 2364 wrote to memory of 3368	2364	cmd.exe	91
PID 2364 wrote to memory of 3368	2364	cmd.exe	91
PID 1576 wrote to memory of 3588	1576	cmd.exe	90
PID 1576 wrote to memory of 3588	1576	cmd.exe	90
PID 1576 wrote to memory of 3588	1576	cmd.exe	90
PID 3368 wrote to memory of 3376	3368	hosts.exe	92
PID 3368 wrote to memory of 3376	3368	hosts.exe	92
PID 3368 wrote to memory of 3376	3368	hosts.exe	92
PID 3368 wrote to memory of 32	3368	hosts.exe	93
PID 3368 wrote to memory of 32	3368	hosts.exe	93
PID 3368 wrote to memory of 32	3368	hosts.exe	93
PID 32 wrote to memory of 4416	32	cmd.exe	95
PID 32 wrote to memory of 4416	32	cmd.exe	95
PID 32 wrote to memory of 4416	32	cmd.exe	95
PID 32 wrote to memory of 1512	32	cmd.exe	99
PID 32 wrote to memory of 1512	32	cmd.exe	99
PID 32 wrote to memory of 1512	32	cmd.exe	99
PID 2364 wrote to memory of 1308	2364	cmd.exe	98
PID 2364 wrote to memory of 1308	2364	cmd.exe	98
PID 2364 wrote to memory of 1308	2364	cmd.exe	98
PID 1576 wrote to memory of 2264	1576	cmd.exe	97
PID 1576 wrote to memory of 2264	1576	cmd.exe	97
PID 1576 wrote to memory of 2264	1576	cmd.exe	97
PID 1336 wrote to memory of 2396	1336	avscan.exe	107
PID 1336 wrote to memory of 2396	1336	avscan.exe	107
PID 1336 wrote to memory of 2396	1336	avscan.exe	107
PID 3368 wrote to memory of 4580	3368	hosts.exe	109
PID 3368 wrote to memory of 4580	3368	hosts.exe	109
PID 3368 wrote to memory of 4580	3368	hosts.exe	109
PID 1336 wrote to memory of 3904	1336	avscan.exe	111
PID 1336 wrote to memory of 3904	1336	avscan.exe	111
PID 1336 wrote to memory of 3904	1336	avscan.exe	111
PID 3368 wrote to memory of 3068	3368	hosts.exe	113
PID 3368 wrote to memory of 3068	3368	hosts.exe	113
PID 3368 wrote to memory of 3068	3368	hosts.exe	113
PID 1336 wrote to memory of 3384	1336	avscan.exe	115
PID 1336 wrote to memory of 3384	1336	avscan.exe	115
PID 1336 wrote to memory of 3384	1336	avscan.exe	115
PID 3368 wrote to memory of 3708	3368	hosts.exe	117
PID 3368 wrote to memory of 3708	3368	hosts.exe	117
PID 3368 wrote to memory of 3708	3368	hosts.exe	117
PID 1336 wrote to memory of 2648	1336	avscan.exe	119
PID 1336 wrote to memory of 2648	1336	avscan.exe	119
PID 1336 wrote to memory of 2648	1336	avscan.exe	119
PID 3368 wrote to memory of 4992	3368	hosts.exe	121
PID 3368 wrote to memory of 4992	3368	hosts.exe	121
PID 3368 wrote to memory of 4992	3368	hosts.exe	121

C:\Users\Admin\AppData\Local\Temp\7c2ff9ddb3f4a1a0f8c29764134cd3c54f586c9e2e409583797c8726f9d927b2.exe
"C:\Users\Admin\AppData\Local\Temp\7c2ff9ddb3f4a1a0f8c29764134cd3c54f586c9e2e409583797c8726f9d927b2.exe"
1⤵
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- Adds Run key to start application
- Drops file in Windows directory
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4876
- C:\Windows\SysWOW64\REG.exe
  REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
  2⤵
  - Modifies registry key
  PID:4804
- C:\Users\Admin\AppData\Local\Temp\avscan.exe
  C:\Users\Admin\AppData\Local\Temp\avscan.exe
  2⤵
  - Modifies visibility of file extensions in Explorer
  - Modifies visiblity of hidden/system files in Explorer
  - Executes dropped EXE
  - Adds Run key to start application
  - Drops file in Windows directory
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1336
- - C:\Users\Admin\AppData\Local\Temp\avscan.exe
    C:\Users\Admin\AppData\Local\Temp\avscan.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2288
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c c:\windows\W_X_C.bat
    3⤵
    - Checks computer location settings
    - Modifies registry class
    - Suspicious use of WriteProcessMemory
    PID:2364
  - - C:\windows\hosts.exe
      C:\windows\hosts.exe
      4⤵
      Modifies visibility of file extensions in Explorer
      Modifies visiblity of hidden/system files in Explorer
      Executes dropped EXE
      Adds Run key to start application
      Drops file in Windows directory
      Suspicious behavior: GetForegroundWindowSpam
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:3368
    - - C:\Users\Admin\AppData\Local\Temp\avscan.exe
        
        C:\Users\Admin\AppData\Local\Temp\avscan.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3376
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c c:\windows\W_X_C.bat
        5⤵
        Checks computer location settings
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:32
      - C:\windows\hosts.exe
        
        C:\windows\hosts.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4416
      - C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Windows\W_X_C.vbs"
        6⤵
        Adds policy Run key to start application
        
        PID:1512
    - - C:\Windows\SysWOW64\REG.exe
        
        REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
        5⤵
        Modifies registry key
        
        PID:4580
    - - C:\Windows\SysWOW64\REG.exe
        
        REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
        5⤵
        Modifies registry key
        
        PID:3068
    - - C:\Windows\SysWOW64\REG.exe
        
        REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
        5⤵
        Modifies registry key
        
        PID:3708
    - - C:\Windows\SysWOW64\REG.exe
        
        REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
        5⤵
        Modifies registry key
        
        PID:4992
  - - C:\Windows\SysWOW64\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Windows\W_X_C.vbs"
      4⤵
      Adds policy Run key to start application
      PID:1308
- - C:\Windows\SysWOW64\REG.exe
    REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
    3⤵
    - Modifies registry key
    PID:2396
- - C:\Windows\SysWOW64\REG.exe
    REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
    3⤵
    - Modifies registry key
    PID:3904
- - C:\Windows\SysWOW64\REG.exe
    REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
    3⤵
    - Modifies registry key
    PID:3384
- - C:\Windows\SysWOW64\REG.exe
    REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
    3⤵
    - Modifies registry key
    PID:2648
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c c:\windows\W_X_C.bat
  2⤵
  - Checks computer location settings
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:1576
- - C:\windows\hosts.exe
    C:\windows\hosts.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:3588
- - C:\Windows\SysWOW64\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Windows\W_X_C.vbs"
    3⤵
    - Adds policy Run key to start application
    PID:2264

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:3336

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Hidden Files and Directories

T1158

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Hidden Files and Directories

T1158

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\avscan.exe

Filesize
695KB

MD5
6e49870b6a8102241350a58900efa2af

SHA1
b6718dedd1fce30479bb71dda43a61e75ba66515

SHA256
e176feca0dcce810a338843d65dc61931395c88abba1df05ad5ee0a2663c3694

SHA512
eed901e8815e9aa1cb6a810c02af46322d37df42b88c29c3473d472004c46ff0b78bb3babe33660953a2ff7579734d11476a5276b74bf2c6b0aa3d2f43b85d4e

Download Submit
C:\Users\Admin\AppData\Local\Temp\avscan.exe

Filesize
695KB

MD5
6e49870b6a8102241350a58900efa2af

SHA1
b6718dedd1fce30479bb71dda43a61e75ba66515

SHA256
e176feca0dcce810a338843d65dc61931395c88abba1df05ad5ee0a2663c3694

SHA512
eed901e8815e9aa1cb6a810c02af46322d37df42b88c29c3473d472004c46ff0b78bb3babe33660953a2ff7579734d11476a5276b74bf2c6b0aa3d2f43b85d4e

Download Submit
C:\Users\Admin\AppData\Local\Temp\avscan.exe

Filesize
695KB

MD5
6e49870b6a8102241350a58900efa2af

SHA1
b6718dedd1fce30479bb71dda43a61e75ba66515

SHA256
e176feca0dcce810a338843d65dc61931395c88abba1df05ad5ee0a2663c3694

SHA512
eed901e8815e9aa1cb6a810c02af46322d37df42b88c29c3473d472004c46ff0b78bb3babe33660953a2ff7579734d11476a5276b74bf2c6b0aa3d2f43b85d4e

Download Submit
C:\Users\Admin\AppData\Local\Temp\avscan.exe

Filesize
695KB

MD5
6e49870b6a8102241350a58900efa2af

SHA1
b6718dedd1fce30479bb71dda43a61e75ba66515

SHA256
e176feca0dcce810a338843d65dc61931395c88abba1df05ad5ee0a2663c3694

SHA512
eed901e8815e9aa1cb6a810c02af46322d37df42b88c29c3473d472004c46ff0b78bb3babe33660953a2ff7579734d11476a5276b74bf2c6b0aa3d2f43b85d4e

Download Submit
C:\Windows\W_X_C.vbs

Filesize
195B

MD5
0e0483d4802632100b6bfe8bc2e5d661

SHA1
767e0deb7dcaa7676004e6053957c36cecfeeefa

SHA256
81bbebb8d0e77ffffbc7b7d24afdcdce4089f4b04d1a12284eda861c25e03f9f

SHA512
8279b0559ca30a0adc6c8614870c3e445866c20f0617a7153cab41982b451dfe9ea44478f37b884465235714623ef26a56f5ea3d1cb81767487c494d3703ab29

Download Submit
C:\Windows\hosts.exe

Filesize
695KB

MD5
b51af1be6fb12ce36dd5933e9c48c32a

SHA1
5d67e4a132743303b3ba78b370040cd818a872b7

SHA256
d4dca78e76f3dd4e5b982a0083ec343de35312e583346ff07c5d3bebaa44c23a

SHA512
0d67b1b26c4bf8fe4dd80b1bb5ab26f1e2c38bcae36d8e8f333fa38d019d4d005d56c3769eae3826aba6bf1477b9ad829375ee1062da11842fe69206531e3974

Download Submit
C:\Windows\hosts.exe

Filesize
695KB

MD5
b51af1be6fb12ce36dd5933e9c48c32a

SHA1
5d67e4a132743303b3ba78b370040cd818a872b7

SHA256
d4dca78e76f3dd4e5b982a0083ec343de35312e583346ff07c5d3bebaa44c23a

SHA512
0d67b1b26c4bf8fe4dd80b1bb5ab26f1e2c38bcae36d8e8f333fa38d019d4d005d56c3769eae3826aba6bf1477b9ad829375ee1062da11842fe69206531e3974

Download Submit
C:\Windows\hosts.exe

Filesize
695KB

MD5
b51af1be6fb12ce36dd5933e9c48c32a

SHA1
5d67e4a132743303b3ba78b370040cd818a872b7

SHA256
d4dca78e76f3dd4e5b982a0083ec343de35312e583346ff07c5d3bebaa44c23a

SHA512
0d67b1b26c4bf8fe4dd80b1bb5ab26f1e2c38bcae36d8e8f333fa38d019d4d005d56c3769eae3826aba6bf1477b9ad829375ee1062da11842fe69206531e3974

Download Submit
C:\Windows\hosts.exe

Filesize
695KB

MD5
b51af1be6fb12ce36dd5933e9c48c32a

SHA1
5d67e4a132743303b3ba78b370040cd818a872b7

SHA256
d4dca78e76f3dd4e5b982a0083ec343de35312e583346ff07c5d3bebaa44c23a

SHA512
0d67b1b26c4bf8fe4dd80b1bb5ab26f1e2c38bcae36d8e8f333fa38d019d4d005d56c3769eae3826aba6bf1477b9ad829375ee1062da11842fe69206531e3974

Download Submit
C:\windows\hosts.exe

Filesize
695KB

MD5
b51af1be6fb12ce36dd5933e9c48c32a

SHA1
5d67e4a132743303b3ba78b370040cd818a872b7

SHA256
d4dca78e76f3dd4e5b982a0083ec343de35312e583346ff07c5d3bebaa44c23a

SHA512
0d67b1b26c4bf8fe4dd80b1bb5ab26f1e2c38bcae36d8e8f333fa38d019d4d005d56c3769eae3826aba6bf1477b9ad829375ee1062da11842fe69206531e3974

Download Submit
\??\c:\windows\W_X_C.bat

Filesize
336B

MD5
4db9f8b6175722b62ececeeeba1ce307

SHA1
3b3ba8414706e72a6fa19e884a97b87609e11e47

SHA256
d2150b9e5a4ce55e140f0ca91c4e300715d42095c8fddf58c77037cdd2cfaf78

SHA512
1d6dc274cf7a3dd704f840e6a5ad57ab4c4e35d5f09489aeff520bb797e1c825bac53fc335156fe41e767a46520d031855fe42fe7b175409ebe5e9e986fb9b8b

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads