75c8d3ddc165be49625de0675f8e67dbab3ccef72c4332e4e2ef61a960ff050a

Analysis

max time kernel
127s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
29/11/2022, 16:27

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

75c8d3ddc165be49625de0675f8e67dbab3ccef72c4332e4e2ef61a960ff050a.exe
Size

708KB
MD5

53aa77528dcccbdcda93a9df77fab463
SHA1

ec3d0863d693f32c3637e2490564cf7c434ef59a
SHA256

75c8d3ddc165be49625de0675f8e67dbab3ccef72c4332e4e2ef61a960ff050a
SHA512

f8483b9ec12742ca2b045cf60688e03c3d6be914433bdf488d17da46302feeb992eb760202ac2a81d010b5deff0294492c786ccfb42f1b479b5d38bb0dd39841
SSDEEP

12288:g72bnI+w8GNA72bnI+w8GN472bnI+w8GNA72bnI+w8GNe:g72zd72zJ72zd72zr

Score

10^/10

evasion persistence

Malware Config

Signatures

Modifies visibility of file extensions in Explorer 2 TTPs 3 IoCs

evasion

Hidden Files and Directories

T1158

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	75c8d3ddc165be49625de0675f8e67dbab3ccef72c4332e4e2ef61a960ff050a.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	avscan.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	hosts.exe

Modifies visiblity of hidden/system files in Explorer 2 TTPs 3 IoCs

evasion

Hidden Files and Directories

T1158

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	75c8d3ddc165be49625de0675f8e67dbab3ccef72c4332e4e2ef61a960ff050a.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	avscan.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	hosts.exe

Adds policy Run key to start application 2 TTPs 6 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\IYMUGYHL = "W_X_C.bat"	WScript.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	WScript.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\IYMUGYHL = "W_X_C.bat"	WScript.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	WScript.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\IYMUGYHL = "W_X_C.bat"	WScript.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	WScript.exe

Executes dropped EXE 6 IoCs

pid	Process
3772	avscan.exe
4668	avscan.exe
3976	hosts.exe
3412	hosts.exe
1588	avscan.exe
4576	hosts.exe

Checks computer location settings 2 TTPs 3 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation	cmd.exe
Key value queried	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation	cmd.exe
Key value queried	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation	cmd.exe

Adds Run key to start application 2 TTPs 6 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run	hosts.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\avscan = "C:\\Users\\Admin\\AppData\\Local\\Temp\\avscan.exe"	hosts.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run	75c8d3ddc165be49625de0675f8e67dbab3ccef72c4332e4e2ef61a960ff050a.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\avscan = "C:\\Users\\Admin\\AppData\\Local\\Temp\\avscan.exe"	75c8d3ddc165be49625de0675f8e67dbab3ccef72c4332e4e2ef61a960ff050a.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run	avscan.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\avscan = "C:\\Users\\Admin\\AppData\\Local\\Temp\\avscan.exe"	avscan.exe

Drops file in Windows directory 5 IoCs

description	ioc	Process
File opened for modification	C:\Windows\hosts.exe	avscan.exe
File opened for modification	C:\Windows\hosts.exe	hosts.exe
File created	C:\windows\W_X_C.vbs	75c8d3ddc165be49625de0675f8e67dbab3ccef72c4332e4e2ef61a960ff050a.exe
File created	\??\c:\windows\W_X_C.bat	75c8d3ddc165be49625de0675f8e67dbab3ccef72c4332e4e2ef61a960ff050a.exe
File opened for modification	C:\Windows\hosts.exe	75c8d3ddc165be49625de0675f8e67dbab3ccef72c4332e4e2ef61a960ff050a.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies registry class 4 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\Local Settings	75c8d3ddc165be49625de0675f8e67dbab3ccef72c4332e4e2ef61a960ff050a.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\Local Settings	cmd.exe

Modifies registry key 1 TTPs 9 IoCs

Modify Registry

T1112

pid	Process
4280	REG.exe
5064	REG.exe
4000	REG.exe
456	REG.exe
1092	REG.exe
3680	REG.exe
1984	REG.exe
4084	REG.exe
2148	REG.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

pid	Process
3772	avscan.exe
3976	hosts.exe

Suspicious use of SetWindowsHookEx 7 IoCs

pid	Process
400	75c8d3ddc165be49625de0675f8e67dbab3ccef72c4332e4e2ef61a960ff050a.exe
3772	avscan.exe
4668	avscan.exe
3976	hosts.exe
3412	hosts.exe
1588	avscan.exe
4576	hosts.exe

Suspicious use of WriteProcessMemory 63 IoCs

description	pid	Process	procid_target
PID 400 wrote to memory of 1984	400	75c8d3ddc165be49625de0675f8e67dbab3ccef72c4332e4e2ef61a960ff050a.exe	82
PID 400 wrote to memory of 1984	400	75c8d3ddc165be49625de0675f8e67dbab3ccef72c4332e4e2ef61a960ff050a.exe	82
PID 400 wrote to memory of 1984	400	75c8d3ddc165be49625de0675f8e67dbab3ccef72c4332e4e2ef61a960ff050a.exe	82
PID 400 wrote to memory of 3772	400	75c8d3ddc165be49625de0675f8e67dbab3ccef72c4332e4e2ef61a960ff050a.exe	84
PID 400 wrote to memory of 3772	400	75c8d3ddc165be49625de0675f8e67dbab3ccef72c4332e4e2ef61a960ff050a.exe	84
PID 400 wrote to memory of 3772	400	75c8d3ddc165be49625de0675f8e67dbab3ccef72c4332e4e2ef61a960ff050a.exe	84
PID 3772 wrote to memory of 4668	3772	avscan.exe	85
PID 3772 wrote to memory of 4668	3772	avscan.exe	85
PID 3772 wrote to memory of 4668	3772	avscan.exe	85
PID 3772 wrote to memory of 1380	3772	avscan.exe	86
PID 3772 wrote to memory of 1380	3772	avscan.exe	86
PID 3772 wrote to memory of 1380	3772	avscan.exe	86
PID 400 wrote to memory of 4600	400	75c8d3ddc165be49625de0675f8e67dbab3ccef72c4332e4e2ef61a960ff050a.exe	87
PID 400 wrote to memory of 4600	400	75c8d3ddc165be49625de0675f8e67dbab3ccef72c4332e4e2ef61a960ff050a.exe	87
PID 400 wrote to memory of 4600	400	75c8d3ddc165be49625de0675f8e67dbab3ccef72c4332e4e2ef61a960ff050a.exe	87
PID 1380 wrote to memory of 3976	1380	cmd.exe	90
PID 1380 wrote to memory of 3976	1380	cmd.exe	90
PID 1380 wrote to memory of 3976	1380	cmd.exe	90
PID 4600 wrote to memory of 3412	4600	cmd.exe	92
PID 4600 wrote to memory of 3412	4600	cmd.exe	92
PID 4600 wrote to memory of 3412	4600	cmd.exe	92
PID 3976 wrote to memory of 1588	3976	hosts.exe	93
PID 3976 wrote to memory of 1588	3976	hosts.exe	93
PID 3976 wrote to memory of 1588	3976	hosts.exe	93
PID 3976 wrote to memory of 2372	3976	hosts.exe	94
PID 3976 wrote to memory of 2372	3976	hosts.exe	94
PID 3976 wrote to memory of 2372	3976	hosts.exe	94
PID 2372 wrote to memory of 4576	2372	cmd.exe	96
PID 2372 wrote to memory of 4576	2372	cmd.exe	96
PID 2372 wrote to memory of 4576	2372	cmd.exe	96
PID 1380 wrote to memory of 4416	1380	cmd.exe	98
PID 1380 wrote to memory of 4416	1380	cmd.exe	98
PID 1380 wrote to memory of 4416	1380	cmd.exe	98
PID 2372 wrote to memory of 3944	2372	cmd.exe	99
PID 2372 wrote to memory of 3944	2372	cmd.exe	99
PID 2372 wrote to memory of 3944	2372	cmd.exe	99
PID 4600 wrote to memory of 1820	4600	cmd.exe	97
PID 4600 wrote to memory of 1820	4600	cmd.exe	97
PID 4600 wrote to memory of 1820	4600	cmd.exe	97
PID 3772 wrote to memory of 4084	3772	avscan.exe	107
PID 3772 wrote to memory of 4084	3772	avscan.exe	107
PID 3772 wrote to memory of 4084	3772	avscan.exe	107
PID 3976 wrote to memory of 4280	3976	hosts.exe	109
PID 3976 wrote to memory of 4280	3976	hosts.exe	109
PID 3976 wrote to memory of 4280	3976	hosts.exe	109
PID 3772 wrote to memory of 5064	3772	avscan.exe	111
PID 3772 wrote to memory of 5064	3772	avscan.exe	111
PID 3772 wrote to memory of 5064	3772	avscan.exe	111
PID 3976 wrote to memory of 2148	3976	hosts.exe	113
PID 3976 wrote to memory of 2148	3976	hosts.exe	113
PID 3976 wrote to memory of 2148	3976	hosts.exe	113
PID 3772 wrote to memory of 456	3772	avscan.exe	115
PID 3772 wrote to memory of 456	3772	avscan.exe	115
PID 3772 wrote to memory of 456	3772	avscan.exe	115
PID 3976 wrote to memory of 4000	3976	hosts.exe	117
PID 3976 wrote to memory of 4000	3976	hosts.exe	117
PID 3976 wrote to memory of 4000	3976	hosts.exe	117
PID 3772 wrote to memory of 1092	3772	avscan.exe	119
PID 3772 wrote to memory of 1092	3772	avscan.exe	119
PID 3772 wrote to memory of 1092	3772	avscan.exe	119
PID 3976 wrote to memory of 3680	3976	hosts.exe	121
PID 3976 wrote to memory of 3680	3976	hosts.exe	121
PID 3976 wrote to memory of 3680	3976	hosts.exe	121

C:\Users\Admin\AppData\Local\Temp\75c8d3ddc165be49625de0675f8e67dbab3ccef72c4332e4e2ef61a960ff050a.exe
"C:\Users\Admin\AppData\Local\Temp\75c8d3ddc165be49625de0675f8e67dbab3ccef72c4332e4e2ef61a960ff050a.exe"
1⤵
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- Adds Run key to start application
- Drops file in Windows directory
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:400
- C:\Windows\SysWOW64\REG.exe
  REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
  2⤵
  - Modifies registry key
  PID:1984
- C:\Users\Admin\AppData\Local\Temp\avscan.exe
  C:\Users\Admin\AppData\Local\Temp\avscan.exe
  2⤵
  - Modifies visibility of file extensions in Explorer
  - Modifies visiblity of hidden/system files in Explorer
  - Executes dropped EXE
  - Adds Run key to start application
  - Drops file in Windows directory
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3772
- - C:\Users\Admin\AppData\Local\Temp\avscan.exe
    C:\Users\Admin\AppData\Local\Temp\avscan.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:4668
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c c:\windows\W_X_C.bat
    3⤵
    - Checks computer location settings
    - Modifies registry class
    - Suspicious use of WriteProcessMemory
    PID:1380
  - - C:\windows\hosts.exe
      C:\windows\hosts.exe
      4⤵
      Modifies visibility of file extensions in Explorer
      Modifies visiblity of hidden/system files in Explorer
      Executes dropped EXE
      Adds Run key to start application
      Drops file in Windows directory
      Suspicious behavior: GetForegroundWindowSpam
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:3976
    - - C:\Users\Admin\AppData\Local\Temp\avscan.exe
        
        C:\Users\Admin\AppData\Local\Temp\avscan.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1588
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c c:\windows\W_X_C.bat
        5⤵
        Checks computer location settings
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2372
      - C:\windows\hosts.exe
        
        C:\windows\hosts.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4576
      - C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Windows\W_X_C.vbs"
        6⤵
        Adds policy Run key to start application
        
        PID:3944
    - - C:\Windows\SysWOW64\REG.exe
        
        REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
        5⤵
        Modifies registry key
        
        PID:4280
    - - C:\Windows\SysWOW64\REG.exe
        
        REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
        5⤵
        Modifies registry key
        
        PID:2148
    - - C:\Windows\SysWOW64\REG.exe
        
        REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
        5⤵
        Modifies registry key
        
        PID:4000
    - - C:\Windows\SysWOW64\REG.exe
        
        REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
        5⤵
        Modifies registry key
        
        PID:3680
  - - C:\Windows\SysWOW64\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Windows\W_X_C.vbs"
      4⤵
      Adds policy Run key to start application
      PID:4416
- - C:\Windows\SysWOW64\REG.exe
    REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
    3⤵
    - Modifies registry key
    PID:4084
- - C:\Windows\SysWOW64\REG.exe
    REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
    3⤵
    - Modifies registry key
    PID:5064
- - C:\Windows\SysWOW64\REG.exe
    REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
    3⤵
    - Modifies registry key
    PID:456
- - C:\Windows\SysWOW64\REG.exe
    REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
    3⤵
    - Modifies registry key
    PID:1092
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c c:\windows\W_X_C.bat
  2⤵
  - Checks computer location settings
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:4600
- - C:\windows\hosts.exe
    C:\windows\hosts.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:3412
- - C:\Windows\SysWOW64\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Windows\W_X_C.vbs"
    3⤵
    - Adds policy Run key to start application
    PID:1820

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4440

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Hidden Files and Directories

T1158

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Hidden Files and Directories

T1158

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\avscan.exe

Filesize
708KB

MD5
737d3269dcab4dc070f2640a0e06fb95

SHA1
9ebf2000d2772c38cc462e651bf7b967044f5e6f

SHA256
74245a73767f5bf6a89377ebfb4d18038dd59bd1bbe2df1ec52ab9cac408c699

SHA512
08c47c5f10196ee99ed47923ef538a854bbf41a5932b9eff471fa0d9dfe7f1dd3fbaab886aebc090c60753dde0438c99727a4fbeb4e9eece1e20f9b3f3280c2f

Download Submit
C:\Users\Admin\AppData\Local\Temp\avscan.exe

Filesize
708KB

MD5
737d3269dcab4dc070f2640a0e06fb95

SHA1
9ebf2000d2772c38cc462e651bf7b967044f5e6f

SHA256
74245a73767f5bf6a89377ebfb4d18038dd59bd1bbe2df1ec52ab9cac408c699

SHA512
08c47c5f10196ee99ed47923ef538a854bbf41a5932b9eff471fa0d9dfe7f1dd3fbaab886aebc090c60753dde0438c99727a4fbeb4e9eece1e20f9b3f3280c2f

Download Submit
C:\Users\Admin\AppData\Local\Temp\avscan.exe

Filesize
708KB

MD5
737d3269dcab4dc070f2640a0e06fb95

SHA1
9ebf2000d2772c38cc462e651bf7b967044f5e6f

SHA256
74245a73767f5bf6a89377ebfb4d18038dd59bd1bbe2df1ec52ab9cac408c699

SHA512
08c47c5f10196ee99ed47923ef538a854bbf41a5932b9eff471fa0d9dfe7f1dd3fbaab886aebc090c60753dde0438c99727a4fbeb4e9eece1e20f9b3f3280c2f

Download Submit
C:\Users\Admin\AppData\Local\Temp\avscan.exe

Filesize
708KB

MD5
737d3269dcab4dc070f2640a0e06fb95

SHA1
9ebf2000d2772c38cc462e651bf7b967044f5e6f

SHA256
74245a73767f5bf6a89377ebfb4d18038dd59bd1bbe2df1ec52ab9cac408c699

SHA512
08c47c5f10196ee99ed47923ef538a854bbf41a5932b9eff471fa0d9dfe7f1dd3fbaab886aebc090c60753dde0438c99727a4fbeb4e9eece1e20f9b3f3280c2f

Download Submit
C:\Windows\W_X_C.vbs

Filesize
195B

MD5
0e0483d4802632100b6bfe8bc2e5d661

SHA1
767e0deb7dcaa7676004e6053957c36cecfeeefa

SHA256
81bbebb8d0e77ffffbc7b7d24afdcdce4089f4b04d1a12284eda861c25e03f9f

SHA512
8279b0559ca30a0adc6c8614870c3e445866c20f0617a7153cab41982b451dfe9ea44478f37b884465235714623ef26a56f5ea3d1cb81767487c494d3703ab29

Download Submit
C:\Windows\hosts.exe

Filesize
708KB

MD5
9f84d222e2561e6e8a5e20bd3edcc85a

SHA1
5fc7f86fa31671017b60f7f2eb217df94597ed64

SHA256
be6a05e4b754a6dfc8972182a6689eae210ce113b75c236b0fe019afbea7efbf

SHA512
888dcc440b473faa835a3e841a618cc881ead6e23bf5e5257bb48aad67a2f109b2510a18b2ae42ec12015326c5aeed8965f9866d7bc6ced87b6d58f90e83c92a

Download Submit
C:\Windows\hosts.exe

Filesize
708KB

MD5
9f84d222e2561e6e8a5e20bd3edcc85a

SHA1
5fc7f86fa31671017b60f7f2eb217df94597ed64

SHA256
be6a05e4b754a6dfc8972182a6689eae210ce113b75c236b0fe019afbea7efbf

SHA512
888dcc440b473faa835a3e841a618cc881ead6e23bf5e5257bb48aad67a2f109b2510a18b2ae42ec12015326c5aeed8965f9866d7bc6ced87b6d58f90e83c92a

Download Submit
C:\Windows\hosts.exe

Filesize
708KB

MD5
9f84d222e2561e6e8a5e20bd3edcc85a

SHA1
5fc7f86fa31671017b60f7f2eb217df94597ed64

SHA256
be6a05e4b754a6dfc8972182a6689eae210ce113b75c236b0fe019afbea7efbf

SHA512
888dcc440b473faa835a3e841a618cc881ead6e23bf5e5257bb48aad67a2f109b2510a18b2ae42ec12015326c5aeed8965f9866d7bc6ced87b6d58f90e83c92a

Download Submit
C:\Windows\hosts.exe

Filesize
708KB

MD5
9f84d222e2561e6e8a5e20bd3edcc85a

SHA1
5fc7f86fa31671017b60f7f2eb217df94597ed64

SHA256
be6a05e4b754a6dfc8972182a6689eae210ce113b75c236b0fe019afbea7efbf

SHA512
888dcc440b473faa835a3e841a618cc881ead6e23bf5e5257bb48aad67a2f109b2510a18b2ae42ec12015326c5aeed8965f9866d7bc6ced87b6d58f90e83c92a

Download Submit
C:\windows\hosts.exe

Filesize
708KB

MD5
9f84d222e2561e6e8a5e20bd3edcc85a

SHA1
5fc7f86fa31671017b60f7f2eb217df94597ed64

SHA256
be6a05e4b754a6dfc8972182a6689eae210ce113b75c236b0fe019afbea7efbf

SHA512
888dcc440b473faa835a3e841a618cc881ead6e23bf5e5257bb48aad67a2f109b2510a18b2ae42ec12015326c5aeed8965f9866d7bc6ced87b6d58f90e83c92a

Download Submit
\??\c:\windows\W_X_C.bat

Filesize
336B

MD5
4db9f8b6175722b62ececeeeba1ce307

SHA1
3b3ba8414706e72a6fa19e884a97b87609e11e47

SHA256
d2150b9e5a4ce55e140f0ca91c4e300715d42095c8fddf58c77037cdd2cfaf78

SHA512
1d6dc274cf7a3dd704f840e6a5ad57ab4c4e35d5f09489aeff520bb797e1c825bac53fc335156fe41e767a46520d031855fe42fe7b175409ebe5e9e986fb9b8b

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads