ff2313e885a32218c9dd0130d425e6cc1fe6b97dd8a310fc9254587ab7c1cab7

Analysis

max time kernel
124s
max time network
129s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
02-12-2022 23:18

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ff2313e885a32218c9dd0130d425e6cc1fe6b97dd8a310fc9254587ab7c1cab7.exe
Size

396KB
MD5

ec33e4311c03637d2a1259874d9005ed
SHA1

27641285e02f073c4c1e19c081435179e8cbc0a9
SHA256

ff2313e885a32218c9dd0130d425e6cc1fe6b97dd8a310fc9254587ab7c1cab7
SHA512

8c3cd27e04832f4d20794d59a1ed7db1b2113b3a9c954346e77466fa33540fb9f0563066c8d3ca2c6ec883a551267ea2151c90adf9b359a6d0ab5b9d2507ba83
SSDEEP

6144:gDCwfG1bnxLEDuG14dDCwfG1bnxLEDuG143XK:g72bntEDuG1A72bntEDuG1r

Score

10^/10

evasion persistence

Malware Config

Signatures

Modifies visibility of file extensions in Explorer 2 TTPs 3 IoCs

evasion

Hidden Files and Directories

T1158

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	ff2313e885a32218c9dd0130d425e6cc1fe6b97dd8a310fc9254587ab7c1cab7.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	avscan.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	hosts.exe

Modifies visiblity of hidden/system files in Explorer 2 TTPs 3 IoCs

evasion

Hidden Files and Directories

T1158

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	ff2313e885a32218c9dd0130d425e6cc1fe6b97dd8a310fc9254587ab7c1cab7.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	avscan.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	hosts.exe

Adds policy Run key to start application 2 TTPs 6 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\IYMUGYHL = "W_X_C.bat"	WScript.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	WScript.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\IYMUGYHL = "W_X_C.bat"	WScript.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	WScript.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\IYMUGYHL = "W_X_C.bat"	WScript.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	WScript.exe

Executes dropped EXE 6 IoCs

pid	Process
1672	avscan.exe
2368	avscan.exe
2240	hosts.exe
3480	hosts.exe
240	avscan.exe
4688	hosts.exe

Checks computer location settings 2 TTPs 3 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation	cmd.exe
Key value queried	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation	cmd.exe
Key value queried	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation	cmd.exe

Adds Run key to start application 2 TTPs 6 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\avscan = "C:\\Users\\Admin\\AppData\\Local\\Temp\\avscan.exe"	avscan.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run	hosts.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\avscan = "C:\\Users\\Admin\\AppData\\Local\\Temp\\avscan.exe"	hosts.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run	ff2313e885a32218c9dd0130d425e6cc1fe6b97dd8a310fc9254587ab7c1cab7.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\avscan = "C:\\Users\\Admin\\AppData\\Local\\Temp\\avscan.exe"	ff2313e885a32218c9dd0130d425e6cc1fe6b97dd8a310fc9254587ab7c1cab7.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run	avscan.exe

Drops file in Windows directory 5 IoCs

description	ioc	Process
File created	C:\windows\W_X_C.vbs	ff2313e885a32218c9dd0130d425e6cc1fe6b97dd8a310fc9254587ab7c1cab7.exe
File created	\??\c:\windows\W_X_C.bat	ff2313e885a32218c9dd0130d425e6cc1fe6b97dd8a310fc9254587ab7c1cab7.exe
File opened for modification	C:\Windows\hosts.exe	ff2313e885a32218c9dd0130d425e6cc1fe6b97dd8a310fc9254587ab7c1cab7.exe
File opened for modification	C:\Windows\hosts.exe	avscan.exe
File opened for modification	C:\Windows\hosts.exe	hosts.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies registry class 4 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\Local Settings	ff2313e885a32218c9dd0130d425e6cc1fe6b97dd8a310fc9254587ab7c1cab7.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\Local Settings	cmd.exe

Modifies registry key 1 TTPs 9 IoCs

Modify Registry

T1112

pid	Process
2292	REG.exe
4276	REG.exe
2312	REG.exe
2920	REG.exe
4464	REG.exe
668	REG.exe
1840	REG.exe
3484	REG.exe
2144	REG.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

pid	Process
1672	avscan.exe
2240	hosts.exe

Suspicious use of SetWindowsHookEx 7 IoCs

pid	Process
4928	ff2313e885a32218c9dd0130d425e6cc1fe6b97dd8a310fc9254587ab7c1cab7.exe
1672	avscan.exe
2368	avscan.exe
2240	hosts.exe
3480	hosts.exe
240	avscan.exe
4688	hosts.exe

Suspicious use of WriteProcessMemory 63 IoCs

description	pid	Process	procid_target
PID 4928 wrote to memory of 2920	4928	ff2313e885a32218c9dd0130d425e6cc1fe6b97dd8a310fc9254587ab7c1cab7.exe	81
PID 4928 wrote to memory of 2920	4928	ff2313e885a32218c9dd0130d425e6cc1fe6b97dd8a310fc9254587ab7c1cab7.exe	81
PID 4928 wrote to memory of 2920	4928	ff2313e885a32218c9dd0130d425e6cc1fe6b97dd8a310fc9254587ab7c1cab7.exe	81
PID 4928 wrote to memory of 1672	4928	ff2313e885a32218c9dd0130d425e6cc1fe6b97dd8a310fc9254587ab7c1cab7.exe	83
PID 4928 wrote to memory of 1672	4928	ff2313e885a32218c9dd0130d425e6cc1fe6b97dd8a310fc9254587ab7c1cab7.exe	83
PID 4928 wrote to memory of 1672	4928	ff2313e885a32218c9dd0130d425e6cc1fe6b97dd8a310fc9254587ab7c1cab7.exe	83
PID 1672 wrote to memory of 2368	1672	avscan.exe	84
PID 1672 wrote to memory of 2368	1672	avscan.exe	84
PID 1672 wrote to memory of 2368	1672	avscan.exe	84
PID 1672 wrote to memory of 2300	1672	avscan.exe	85
PID 1672 wrote to memory of 2300	1672	avscan.exe	85
PID 1672 wrote to memory of 2300	1672	avscan.exe	85
PID 4928 wrote to memory of 632	4928	ff2313e885a32218c9dd0130d425e6cc1fe6b97dd8a310fc9254587ab7c1cab7.exe	87
PID 4928 wrote to memory of 632	4928	ff2313e885a32218c9dd0130d425e6cc1fe6b97dd8a310fc9254587ab7c1cab7.exe	87
PID 4928 wrote to memory of 632	4928	ff2313e885a32218c9dd0130d425e6cc1fe6b97dd8a310fc9254587ab7c1cab7.exe	87
PID 2300 wrote to memory of 2240	2300	cmd.exe	89
PID 2300 wrote to memory of 2240	2300	cmd.exe	89
PID 2300 wrote to memory of 2240	2300	cmd.exe	89
PID 632 wrote to memory of 3480	632	cmd.exe	90
PID 632 wrote to memory of 3480	632	cmd.exe	90
PID 632 wrote to memory of 3480	632	cmd.exe	90
PID 2240 wrote to memory of 240	2240	hosts.exe	92
PID 2240 wrote to memory of 240	2240	hosts.exe	92
PID 2240 wrote to memory of 240	2240	hosts.exe	92
PID 2240 wrote to memory of 4596	2240	hosts.exe	93
PID 2240 wrote to memory of 4596	2240	hosts.exe	93
PID 2240 wrote to memory of 4596	2240	hosts.exe	93
PID 2300 wrote to memory of 1176	2300	cmd.exe	94
PID 2300 wrote to memory of 1176	2300	cmd.exe	94
PID 2300 wrote to memory of 1176	2300	cmd.exe	94
PID 632 wrote to memory of 2860	632	cmd.exe	96
PID 632 wrote to memory of 2860	632	cmd.exe	96
PID 632 wrote to memory of 2860	632	cmd.exe	96
PID 4596 wrote to memory of 4688	4596	cmd.exe	97
PID 4596 wrote to memory of 4688	4596	cmd.exe	97
PID 4596 wrote to memory of 4688	4596	cmd.exe	97
PID 4596 wrote to memory of 3888	4596	cmd.exe	98
PID 4596 wrote to memory of 3888	4596	cmd.exe	98
PID 4596 wrote to memory of 3888	4596	cmd.exe	98
PID 1672 wrote to memory of 4464	1672	avscan.exe	107
PID 1672 wrote to memory of 4464	1672	avscan.exe	107
PID 1672 wrote to memory of 4464	1672	avscan.exe	107
PID 2240 wrote to memory of 668	2240	hosts.exe	109
PID 2240 wrote to memory of 668	2240	hosts.exe	109
PID 2240 wrote to memory of 668	2240	hosts.exe	109
PID 1672 wrote to memory of 1840	1672	avscan.exe	111
PID 1672 wrote to memory of 1840	1672	avscan.exe	111
PID 1672 wrote to memory of 1840	1672	avscan.exe	111
PID 2240 wrote to memory of 3484	2240	hosts.exe	113
PID 2240 wrote to memory of 3484	2240	hosts.exe	113
PID 2240 wrote to memory of 3484	2240	hosts.exe	113
PID 1672 wrote to memory of 2144	1672	avscan.exe	115
PID 1672 wrote to memory of 2144	1672	avscan.exe	115
PID 1672 wrote to memory of 2144	1672	avscan.exe	115
PID 2240 wrote to memory of 4276	2240	hosts.exe	117
PID 2240 wrote to memory of 4276	2240	hosts.exe	117
PID 2240 wrote to memory of 4276	2240	hosts.exe	117
PID 1672 wrote to memory of 2312	1672	avscan.exe	119
PID 1672 wrote to memory of 2312	1672	avscan.exe	119
PID 1672 wrote to memory of 2312	1672	avscan.exe	119
PID 2240 wrote to memory of 2292	2240	hosts.exe	121
PID 2240 wrote to memory of 2292	2240	hosts.exe	121
PID 2240 wrote to memory of 2292	2240	hosts.exe	121

C:\Users\Admin\AppData\Local\Temp\ff2313e885a32218c9dd0130d425e6cc1fe6b97dd8a310fc9254587ab7c1cab7.exe
"C:\Users\Admin\AppData\Local\Temp\ff2313e885a32218c9dd0130d425e6cc1fe6b97dd8a310fc9254587ab7c1cab7.exe"
1⤵
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- Adds Run key to start application
- Drops file in Windows directory
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4928
- C:\Windows\SysWOW64\REG.exe
  REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
  2⤵
  - Modifies registry key
  PID:2920
- C:\Users\Admin\AppData\Local\Temp\avscan.exe
  C:\Users\Admin\AppData\Local\Temp\avscan.exe
  2⤵
  - Modifies visibility of file extensions in Explorer
  - Modifies visiblity of hidden/system files in Explorer
  - Executes dropped EXE
  - Adds Run key to start application
  - Drops file in Windows directory
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1672
- - C:\Users\Admin\AppData\Local\Temp\avscan.exe
    C:\Users\Admin\AppData\Local\Temp\avscan.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2368
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c c:\windows\W_X_C.bat
    3⤵
    - Checks computer location settings
    - Modifies registry class
    - Suspicious use of WriteProcessMemory
    PID:2300
  - - C:\windows\hosts.exe
      C:\windows\hosts.exe
      4⤵
      Modifies visibility of file extensions in Explorer
      Modifies visiblity of hidden/system files in Explorer
      Executes dropped EXE
      Adds Run key to start application
      Drops file in Windows directory
      Suspicious behavior: GetForegroundWindowSpam
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:2240
    - - C:\Users\Admin\AppData\Local\Temp\avscan.exe
        
        C:\Users\Admin\AppData\Local\Temp\avscan.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:240
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c c:\windows\W_X_C.bat
        5⤵
        Checks computer location settings
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4596
      - C:\windows\hosts.exe
        
        C:\windows\hosts.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4688
      - C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Windows\W_X_C.vbs"
        6⤵
        Adds policy Run key to start application
        
        PID:3888
    - - C:\Windows\SysWOW64\REG.exe
        
        REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
        5⤵
        Modifies registry key
        
        PID:668
    - - C:\Windows\SysWOW64\REG.exe
        
        REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
        5⤵
        Modifies registry key
        
        PID:3484
    - - C:\Windows\SysWOW64\REG.exe
        
        REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
        5⤵
        Modifies registry key
        
        PID:4276
    - - C:\Windows\SysWOW64\REG.exe
        
        REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
        5⤵
        Modifies registry key
        
        PID:2292
  - - C:\Windows\SysWOW64\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Windows\W_X_C.vbs"
      4⤵
      Adds policy Run key to start application
      PID:1176
- - C:\Windows\SysWOW64\REG.exe
    REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
    3⤵
    - Modifies registry key
    PID:4464
- - C:\Windows\SysWOW64\REG.exe
    REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
    3⤵
    - Modifies registry key
    PID:1840
- - C:\Windows\SysWOW64\REG.exe
    REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
    3⤵
    - Modifies registry key
    PID:2144
- - C:\Windows\SysWOW64\REG.exe
    REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
    3⤵
    - Modifies registry key
    PID:2312
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c c:\windows\W_X_C.bat
  2⤵
  - Checks computer location settings
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:632
- - C:\windows\hosts.exe
    C:\windows\hosts.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:3480
- - C:\Windows\SysWOW64\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Windows\W_X_C.vbs"
    3⤵
    - Adds policy Run key to start application
    PID:2860

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4976

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Hidden Files and Directories

T1158

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Hidden Files and Directories

T1158

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\avscan.exe

Filesize
396KB

MD5
5e97b07c4060023385502ee18afdea83

SHA1
ca227c80dd3d446dfc5c183c22315cbc50859781

SHA256
3a596f92253322537dc3b66f9e6c38c1a58db6d760d9e28104820cbda5d15890

SHA512
d8518ec4ef71b58d0d442b4f18d6eb97dcdccc0496b36815555fe9133623aa07148a647995bb7055c9bbaa350989bfa6a33c826adb70ee18b608b1b74a79ce1e

Download Submit
C:\Users\Admin\AppData\Local\Temp\avscan.exe

Filesize
396KB

MD5
5e97b07c4060023385502ee18afdea83

SHA1
ca227c80dd3d446dfc5c183c22315cbc50859781

SHA256
3a596f92253322537dc3b66f9e6c38c1a58db6d760d9e28104820cbda5d15890

SHA512
d8518ec4ef71b58d0d442b4f18d6eb97dcdccc0496b36815555fe9133623aa07148a647995bb7055c9bbaa350989bfa6a33c826adb70ee18b608b1b74a79ce1e

Download Submit
C:\Users\Admin\AppData\Local\Temp\avscan.exe

Filesize
396KB

MD5
5e97b07c4060023385502ee18afdea83

SHA1
ca227c80dd3d446dfc5c183c22315cbc50859781

SHA256
3a596f92253322537dc3b66f9e6c38c1a58db6d760d9e28104820cbda5d15890

SHA512
d8518ec4ef71b58d0d442b4f18d6eb97dcdccc0496b36815555fe9133623aa07148a647995bb7055c9bbaa350989bfa6a33c826adb70ee18b608b1b74a79ce1e

Download Submit
C:\Users\Admin\AppData\Local\Temp\avscan.exe

Filesize
396KB

MD5
5e97b07c4060023385502ee18afdea83

SHA1
ca227c80dd3d446dfc5c183c22315cbc50859781

SHA256
3a596f92253322537dc3b66f9e6c38c1a58db6d760d9e28104820cbda5d15890

SHA512
d8518ec4ef71b58d0d442b4f18d6eb97dcdccc0496b36815555fe9133623aa07148a647995bb7055c9bbaa350989bfa6a33c826adb70ee18b608b1b74a79ce1e

Download Submit
C:\Windows\W_X_C.vbs

Filesize
195B

MD5
0e0483d4802632100b6bfe8bc2e5d661

SHA1
767e0deb7dcaa7676004e6053957c36cecfeeefa

SHA256
81bbebb8d0e77ffffbc7b7d24afdcdce4089f4b04d1a12284eda861c25e03f9f

SHA512
8279b0559ca30a0adc6c8614870c3e445866c20f0617a7153cab41982b451dfe9ea44478f37b884465235714623ef26a56f5ea3d1cb81767487c494d3703ab29

Download Submit
C:\Windows\hosts.exe

Filesize
396KB

MD5
ab1cdd7ffe2ff3f148a11fd76f7465fa

SHA1
c28729798b108cd25143e0f2af1004894c76015f

SHA256
e782446ed62038da7e3b0a75f3e534348507b4dc4408123ad697b4b937968b25

SHA512
e59afb8720ca8cf5c4042997306946aaa2bd84defc7c6f09ca9d06e3035e3f44b46e57ca8d19182e032fb01465431d63df2eb144a4bbff5e96404731acc9eb32

Download Submit
C:\Windows\hosts.exe

Filesize
396KB

MD5
ab1cdd7ffe2ff3f148a11fd76f7465fa

SHA1
c28729798b108cd25143e0f2af1004894c76015f

SHA256
e782446ed62038da7e3b0a75f3e534348507b4dc4408123ad697b4b937968b25

SHA512
e59afb8720ca8cf5c4042997306946aaa2bd84defc7c6f09ca9d06e3035e3f44b46e57ca8d19182e032fb01465431d63df2eb144a4bbff5e96404731acc9eb32

Download Submit
C:\Windows\hosts.exe

Filesize
396KB

MD5
ab1cdd7ffe2ff3f148a11fd76f7465fa

SHA1
c28729798b108cd25143e0f2af1004894c76015f

SHA256
e782446ed62038da7e3b0a75f3e534348507b4dc4408123ad697b4b937968b25

SHA512
e59afb8720ca8cf5c4042997306946aaa2bd84defc7c6f09ca9d06e3035e3f44b46e57ca8d19182e032fb01465431d63df2eb144a4bbff5e96404731acc9eb32

Download Submit
C:\Windows\hosts.exe

Filesize
396KB

MD5
ab1cdd7ffe2ff3f148a11fd76f7465fa

SHA1
c28729798b108cd25143e0f2af1004894c76015f

SHA256
e782446ed62038da7e3b0a75f3e534348507b4dc4408123ad697b4b937968b25

SHA512
e59afb8720ca8cf5c4042997306946aaa2bd84defc7c6f09ca9d06e3035e3f44b46e57ca8d19182e032fb01465431d63df2eb144a4bbff5e96404731acc9eb32

Download Submit
C:\windows\hosts.exe

Filesize
396KB

MD5
ab1cdd7ffe2ff3f148a11fd76f7465fa

SHA1
c28729798b108cd25143e0f2af1004894c76015f

SHA256
e782446ed62038da7e3b0a75f3e534348507b4dc4408123ad697b4b937968b25

SHA512
e59afb8720ca8cf5c4042997306946aaa2bd84defc7c6f09ca9d06e3035e3f44b46e57ca8d19182e032fb01465431d63df2eb144a4bbff5e96404731acc9eb32

Download Submit
\??\c:\windows\W_X_C.bat

Filesize
336B

MD5
4db9f8b6175722b62ececeeeba1ce307

SHA1
3b3ba8414706e72a6fa19e884a97b87609e11e47

SHA256
d2150b9e5a4ce55e140f0ca91c4e300715d42095c8fddf58c77037cdd2cfaf78

SHA512
1d6dc274cf7a3dd704f840e6a5ad57ab4c4e35d5f09489aeff520bb797e1c825bac53fc335156fe41e767a46520d031855fe42fe7b175409ebe5e9e986fb9b8b

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads