c0bff27a4891f5b51d7ed8206583b619473c40376b16ed96f294c8ffbd0e341d

Analysis

max time kernel
125s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
02-12-2022 23:20

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c0bff27a4891f5b51d7ed8206583b619473c40376b16ed96f294c8ffbd0e341d.exe
Size

171KB
MD5

90d0c8ef653543c5fd37db1a5a3d0503
SHA1

2281a8e206ad4919ce2eeb8425e6ec5131bf5c6b
SHA256

c0bff27a4891f5b51d7ed8206583b619473c40376b16ed96f294c8ffbd0e341d
SHA512

eabb585b1f9d16ebc69a7406c8561f5300387bb9bf122693e6fbbd9cf5f1f5f9bf9ad7afd9c1b6203682334a2def0db487a4deb2a7d148afdfe3a91526391bbc
SSDEEP

3072:obpDCw1p3vmLvsZIaVwiwDcIbDHDCm/DE5aXbTqT:gDCwfG1bnxLEMXb2T

Score

10^/10

evasion persistence

Malware Config

Signatures

Modifies visibility of file extensions in Explorer 2 TTPs 3 IoCs

evasion

Hidden Files and Directories

T1158

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	c0bff27a4891f5b51d7ed8206583b619473c40376b16ed96f294c8ffbd0e341d.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	avscan.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	hosts.exe

Modifies visiblity of hidden/system files in Explorer 2 TTPs 3 IoCs

evasion

Hidden Files and Directories

T1158

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	c0bff27a4891f5b51d7ed8206583b619473c40376b16ed96f294c8ffbd0e341d.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	avscan.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	hosts.exe

Adds policy Run key to start application 2 TTPs 6 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	WScript.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\IYMUGYHL = "W_X_C.bat"	WScript.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	WScript.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\IYMUGYHL = "W_X_C.bat"	WScript.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	WScript.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\IYMUGYHL = "W_X_C.bat"	WScript.exe

Executes dropped EXE 6 IoCs

pid	Process
1512	avscan.exe
3996	avscan.exe
216	hosts.exe
4856	hosts.exe
1240	avscan.exe
5076	hosts.exe

Checks computer location settings 2 TTPs 3 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation	cmd.exe
Key value queried	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation	cmd.exe
Key value queried	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation	cmd.exe

Adds Run key to start application 2 TTPs 6 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run	hosts.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\avscan = "C:\\Users\\Admin\\AppData\\Local\\Temp\\avscan.exe"	hosts.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run	c0bff27a4891f5b51d7ed8206583b619473c40376b16ed96f294c8ffbd0e341d.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\avscan = "C:\\Users\\Admin\\AppData\\Local\\Temp\\avscan.exe"	c0bff27a4891f5b51d7ed8206583b619473c40376b16ed96f294c8ffbd0e341d.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run	avscan.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\avscan = "C:\\Users\\Admin\\AppData\\Local\\Temp\\avscan.exe"	avscan.exe

Drops file in Windows directory 5 IoCs

description	ioc	Process
File created	\??\c:\windows\W_X_C.bat	c0bff27a4891f5b51d7ed8206583b619473c40376b16ed96f294c8ffbd0e341d.exe
File opened for modification	C:\Windows\hosts.exe	c0bff27a4891f5b51d7ed8206583b619473c40376b16ed96f294c8ffbd0e341d.exe
File opened for modification	C:\Windows\hosts.exe	avscan.exe
File opened for modification	C:\Windows\hosts.exe	hosts.exe
File created	C:\windows\W_X_C.vbs	c0bff27a4891f5b51d7ed8206583b619473c40376b16ed96f294c8ffbd0e341d.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies registry class 4 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\Local Settings	c0bff27a4891f5b51d7ed8206583b619473c40376b16ed96f294c8ffbd0e341d.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\Local Settings	cmd.exe

Modifies registry key 1 TTPs 9 IoCs

Modify Registry

T1112

pid	Process
4284	REG.exe
4772	REG.exe
4008	REG.exe
4264	REG.exe
3096	REG.exe
4508	REG.exe
864	REG.exe
3320	REG.exe
4372	REG.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

pid	Process
1512	avscan.exe
216	hosts.exe

Suspicious use of SetWindowsHookEx 7 IoCs

pid	Process
632	c0bff27a4891f5b51d7ed8206583b619473c40376b16ed96f294c8ffbd0e341d.exe
1512	avscan.exe
3996	avscan.exe
216	hosts.exe
4856	hosts.exe
1240	avscan.exe
5076	hosts.exe

Suspicious use of WriteProcessMemory 63 IoCs

description	pid	Process	procid_target
PID 632 wrote to memory of 864	632	c0bff27a4891f5b51d7ed8206583b619473c40376b16ed96f294c8ffbd0e341d.exe	82
PID 632 wrote to memory of 864	632	c0bff27a4891f5b51d7ed8206583b619473c40376b16ed96f294c8ffbd0e341d.exe	82
PID 632 wrote to memory of 864	632	c0bff27a4891f5b51d7ed8206583b619473c40376b16ed96f294c8ffbd0e341d.exe	82
PID 632 wrote to memory of 1512	632	c0bff27a4891f5b51d7ed8206583b619473c40376b16ed96f294c8ffbd0e341d.exe	84
PID 632 wrote to memory of 1512	632	c0bff27a4891f5b51d7ed8206583b619473c40376b16ed96f294c8ffbd0e341d.exe	84
PID 632 wrote to memory of 1512	632	c0bff27a4891f5b51d7ed8206583b619473c40376b16ed96f294c8ffbd0e341d.exe	84
PID 1512 wrote to memory of 3996	1512	avscan.exe	85
PID 1512 wrote to memory of 3996	1512	avscan.exe	85
PID 1512 wrote to memory of 3996	1512	avscan.exe	85
PID 1512 wrote to memory of 3568	1512	avscan.exe	86
PID 1512 wrote to memory of 3568	1512	avscan.exe	86
PID 1512 wrote to memory of 3568	1512	avscan.exe	86
PID 632 wrote to memory of 3600	632	c0bff27a4891f5b51d7ed8206583b619473c40376b16ed96f294c8ffbd0e341d.exe	87
PID 632 wrote to memory of 3600	632	c0bff27a4891f5b51d7ed8206583b619473c40376b16ed96f294c8ffbd0e341d.exe	87
PID 632 wrote to memory of 3600	632	c0bff27a4891f5b51d7ed8206583b619473c40376b16ed96f294c8ffbd0e341d.exe	87
PID 3568 wrote to memory of 216	3568	cmd.exe	90
PID 3568 wrote to memory of 216	3568	cmd.exe	90
PID 3568 wrote to memory of 216	3568	cmd.exe	90
PID 3600 wrote to memory of 4856	3600	cmd.exe	91
PID 3600 wrote to memory of 4856	3600	cmd.exe	91
PID 3600 wrote to memory of 4856	3600	cmd.exe	91
PID 216 wrote to memory of 1240	216	hosts.exe	93
PID 216 wrote to memory of 1240	216	hosts.exe	93
PID 216 wrote to memory of 1240	216	hosts.exe	93
PID 216 wrote to memory of 3356	216	hosts.exe	94
PID 216 wrote to memory of 3356	216	hosts.exe	94
PID 216 wrote to memory of 3356	216	hosts.exe	94
PID 3356 wrote to memory of 5076	3356	cmd.exe	96
PID 3356 wrote to memory of 5076	3356	cmd.exe	96
PID 3356 wrote to memory of 5076	3356	cmd.exe	96
PID 3600 wrote to memory of 4984	3600	cmd.exe	98
PID 3600 wrote to memory of 4984	3600	cmd.exe	98
PID 3600 wrote to memory of 4984	3600	cmd.exe	98
PID 3568 wrote to memory of 5036	3568	cmd.exe	99
PID 3568 wrote to memory of 5036	3568	cmd.exe	99
PID 3568 wrote to memory of 5036	3568	cmd.exe	99
PID 3356 wrote to memory of 2564	3356	cmd.exe	97
PID 3356 wrote to memory of 2564	3356	cmd.exe	97
PID 3356 wrote to memory of 2564	3356	cmd.exe	97
PID 1512 wrote to memory of 3320	1512	avscan.exe	107
PID 1512 wrote to memory of 3320	1512	avscan.exe	107
PID 1512 wrote to memory of 3320	1512	avscan.exe	107
PID 216 wrote to memory of 4372	216	hosts.exe	109
PID 216 wrote to memory of 4372	216	hosts.exe	109
PID 216 wrote to memory of 4372	216	hosts.exe	109
PID 1512 wrote to memory of 4008	1512	avscan.exe	111
PID 1512 wrote to memory of 4008	1512	avscan.exe	111
PID 1512 wrote to memory of 4008	1512	avscan.exe	111
PID 216 wrote to memory of 4264	216	hosts.exe	114
PID 216 wrote to memory of 4264	216	hosts.exe	114
PID 216 wrote to memory of 4264	216	hosts.exe	114
PID 1512 wrote to memory of 3096	1512	avscan.exe	115
PID 1512 wrote to memory of 3096	1512	avscan.exe	115
PID 1512 wrote to memory of 3096	1512	avscan.exe	115
PID 216 wrote to memory of 4284	216	hosts.exe	117
PID 216 wrote to memory of 4284	216	hosts.exe	117
PID 216 wrote to memory of 4284	216	hosts.exe	117
PID 1512 wrote to memory of 4508	1512	avscan.exe	119
PID 1512 wrote to memory of 4508	1512	avscan.exe	119
PID 1512 wrote to memory of 4508	1512	avscan.exe	119
PID 216 wrote to memory of 4772	216	hosts.exe	121
PID 216 wrote to memory of 4772	216	hosts.exe	121
PID 216 wrote to memory of 4772	216	hosts.exe	121

C:\Users\Admin\AppData\Local\Temp\c0bff27a4891f5b51d7ed8206583b619473c40376b16ed96f294c8ffbd0e341d.exe
"C:\Users\Admin\AppData\Local\Temp\c0bff27a4891f5b51d7ed8206583b619473c40376b16ed96f294c8ffbd0e341d.exe"
1⤵
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- Adds Run key to start application
- Drops file in Windows directory
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:632
- C:\Windows\SysWOW64\REG.exe
  REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
  2⤵
  - Modifies registry key
  PID:864
- C:\Users\Admin\AppData\Local\Temp\avscan.exe
  C:\Users\Admin\AppData\Local\Temp\avscan.exe
  2⤵
  - Modifies visibility of file extensions in Explorer
  - Modifies visiblity of hidden/system files in Explorer
  - Executes dropped EXE
  - Adds Run key to start application
  - Drops file in Windows directory
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1512
- - C:\Users\Admin\AppData\Local\Temp\avscan.exe
    C:\Users\Admin\AppData\Local\Temp\avscan.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:3996
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c c:\windows\W_X_C.bat
    3⤵
    - Checks computer location settings
    - Modifies registry class
    - Suspicious use of WriteProcessMemory
    PID:3568
  - - C:\windows\hosts.exe
      C:\windows\hosts.exe
      4⤵
      Modifies visibility of file extensions in Explorer
      Modifies visiblity of hidden/system files in Explorer
      Executes dropped EXE
      Adds Run key to start application
      Drops file in Windows directory
      Suspicious behavior: GetForegroundWindowSpam
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:216
    - - C:\Users\Admin\AppData\Local\Temp\avscan.exe
        
        C:\Users\Admin\AppData\Local\Temp\avscan.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1240
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c c:\windows\W_X_C.bat
        5⤵
        Checks computer location settings
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3356
      - C:\windows\hosts.exe
        
        C:\windows\hosts.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:5076
      - C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Windows\W_X_C.vbs"
        6⤵
        Adds policy Run key to start application
        
        PID:2564
    - - C:\Windows\SysWOW64\REG.exe
        
        REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
        5⤵
        Modifies registry key
        
        PID:4372
    - - C:\Windows\SysWOW64\REG.exe
        
        REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
        5⤵
        Modifies registry key
        
        PID:4264
    - - C:\Windows\SysWOW64\REG.exe
        
        REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
        5⤵
        Modifies registry key
        
        PID:4284
    - - C:\Windows\SysWOW64\REG.exe
        
        REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
        5⤵
        Modifies registry key
        
        PID:4772
  - - C:\Windows\SysWOW64\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Windows\W_X_C.vbs"
      4⤵
      Adds policy Run key to start application
      PID:5036
- - C:\Windows\SysWOW64\REG.exe
    REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
    3⤵
    - Modifies registry key
    PID:3320
- - C:\Windows\SysWOW64\REG.exe
    REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
    3⤵
    - Modifies registry key
    PID:4008
- - C:\Windows\SysWOW64\REG.exe
    REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
    3⤵
    - Modifies registry key
    PID:3096
- - C:\Windows\SysWOW64\REG.exe
    REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
    3⤵
    - Modifies registry key
    PID:4508
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c c:\windows\W_X_C.bat
  2⤵
  - Checks computer location settings
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:3600
- - C:\windows\hosts.exe
    C:\windows\hosts.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:4856
- - C:\Windows\SysWOW64\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Windows\W_X_C.vbs"
    3⤵
    - Adds policy Run key to start application
    PID:4984

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4200

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Hidden Files and Directories

T1158

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Hidden Files and Directories

T1158

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\avscan.exe

Filesize
171KB

MD5
04863a1526e87e6b6f324ee4276d0b7c

SHA1
d7590be20dd49ab96c056b16bb5522b6b990fc74

SHA256
ec1764853099207ef0f0ef22183ce00fad6ce335229b5621c8616058efdbef4f

SHA512
3e7da7df0e84168158963bed85e693f4f5cba11ddfa08c737298d4a99cd5fc605933ba892dbb8c147473ba2963433b91bc23d9a5c35e33554fc3b03ff18ecb13

Download Submit
C:\Users\Admin\AppData\Local\Temp\avscan.exe

Filesize
171KB

MD5
04863a1526e87e6b6f324ee4276d0b7c

SHA1
d7590be20dd49ab96c056b16bb5522b6b990fc74

SHA256
ec1764853099207ef0f0ef22183ce00fad6ce335229b5621c8616058efdbef4f

SHA512
3e7da7df0e84168158963bed85e693f4f5cba11ddfa08c737298d4a99cd5fc605933ba892dbb8c147473ba2963433b91bc23d9a5c35e33554fc3b03ff18ecb13

Download Submit
C:\Users\Admin\AppData\Local\Temp\avscan.exe

Filesize
171KB

MD5
04863a1526e87e6b6f324ee4276d0b7c

SHA1
d7590be20dd49ab96c056b16bb5522b6b990fc74

SHA256
ec1764853099207ef0f0ef22183ce00fad6ce335229b5621c8616058efdbef4f

SHA512
3e7da7df0e84168158963bed85e693f4f5cba11ddfa08c737298d4a99cd5fc605933ba892dbb8c147473ba2963433b91bc23d9a5c35e33554fc3b03ff18ecb13

Download Submit
C:\Users\Admin\AppData\Local\Temp\avscan.exe

Filesize
171KB

MD5
04863a1526e87e6b6f324ee4276d0b7c

SHA1
d7590be20dd49ab96c056b16bb5522b6b990fc74

SHA256
ec1764853099207ef0f0ef22183ce00fad6ce335229b5621c8616058efdbef4f

SHA512
3e7da7df0e84168158963bed85e693f4f5cba11ddfa08c737298d4a99cd5fc605933ba892dbb8c147473ba2963433b91bc23d9a5c35e33554fc3b03ff18ecb13

Download Submit
C:\Windows\W_X_C.vbs

Filesize
195B

MD5
0e0483d4802632100b6bfe8bc2e5d661

SHA1
767e0deb7dcaa7676004e6053957c36cecfeeefa

SHA256
81bbebb8d0e77ffffbc7b7d24afdcdce4089f4b04d1a12284eda861c25e03f9f

SHA512
8279b0559ca30a0adc6c8614870c3e445866c20f0617a7153cab41982b451dfe9ea44478f37b884465235714623ef26a56f5ea3d1cb81767487c494d3703ab29

Download Submit
C:\Windows\hosts.exe

Filesize
171KB

MD5
c9a18d56c6a70fd3ad3aedaeac711ed2

SHA1
d6443000841f28df4614080553d528308e0ce476

SHA256
fd23048586849bbca917a0b8cefdfc70ef708b0ed4f3d6bc77e6b40b43c1ec9a

SHA512
542989b86ee53c582c0a2709dfd814a52fba70ea522fe01b6ad09c599a647e8530ed5a3e8abb050f2566914f1a0f63d4bbef72fb9674e13cb55140a78ef5951d

Download Submit
C:\Windows\hosts.exe

Filesize
171KB

MD5
c9a18d56c6a70fd3ad3aedaeac711ed2

SHA1
d6443000841f28df4614080553d528308e0ce476

SHA256
fd23048586849bbca917a0b8cefdfc70ef708b0ed4f3d6bc77e6b40b43c1ec9a

SHA512
542989b86ee53c582c0a2709dfd814a52fba70ea522fe01b6ad09c599a647e8530ed5a3e8abb050f2566914f1a0f63d4bbef72fb9674e13cb55140a78ef5951d

Download Submit
C:\Windows\hosts.exe

Filesize
171KB

MD5
c9a18d56c6a70fd3ad3aedaeac711ed2

SHA1
d6443000841f28df4614080553d528308e0ce476

SHA256
fd23048586849bbca917a0b8cefdfc70ef708b0ed4f3d6bc77e6b40b43c1ec9a

SHA512
542989b86ee53c582c0a2709dfd814a52fba70ea522fe01b6ad09c599a647e8530ed5a3e8abb050f2566914f1a0f63d4bbef72fb9674e13cb55140a78ef5951d

Download Submit
C:\Windows\hosts.exe

Filesize
171KB

MD5
c9a18d56c6a70fd3ad3aedaeac711ed2

SHA1
d6443000841f28df4614080553d528308e0ce476

SHA256
fd23048586849bbca917a0b8cefdfc70ef708b0ed4f3d6bc77e6b40b43c1ec9a

SHA512
542989b86ee53c582c0a2709dfd814a52fba70ea522fe01b6ad09c599a647e8530ed5a3e8abb050f2566914f1a0f63d4bbef72fb9674e13cb55140a78ef5951d

Download Submit
C:\windows\hosts.exe

Filesize
171KB

MD5
c9a18d56c6a70fd3ad3aedaeac711ed2

SHA1
d6443000841f28df4614080553d528308e0ce476

SHA256
fd23048586849bbca917a0b8cefdfc70ef708b0ed4f3d6bc77e6b40b43c1ec9a

SHA512
542989b86ee53c582c0a2709dfd814a52fba70ea522fe01b6ad09c599a647e8530ed5a3e8abb050f2566914f1a0f63d4bbef72fb9674e13cb55140a78ef5951d

Download Submit
\??\c:\windows\W_X_C.bat

Filesize
336B

MD5
4db9f8b6175722b62ececeeeba1ce307

SHA1
3b3ba8414706e72a6fa19e884a97b87609e11e47

SHA256
d2150b9e5a4ce55e140f0ca91c4e300715d42095c8fddf58c77037cdd2cfaf78

SHA512
1d6dc274cf7a3dd704f840e6a5ad57ab4c4e35d5f09489aeff520bb797e1c825bac53fc335156fe41e767a46520d031855fe42fe7b175409ebe5e9e986fb9b8b

Download Submit
memory/216-148-0x0000000000000000-mapping.dmp

Download
memory/864-134-0x0000000000000000-mapping.dmp

Download
memory/1240-157-0x0000000000000000-mapping.dmp

Download
memory/1512-135-0x0000000000000000-mapping.dmp

Download
memory/2564-168-0x0000000000000000-mapping.dmp

Download
memory/3096-174-0x0000000000000000-mapping.dmp

Download
memory/3320-170-0x0000000000000000-mapping.dmp

Download
memory/3356-161-0x0000000000000000-mapping.dmp

Download
memory/3568-145-0x0000000000000000-mapping.dmp

Download
memory/3600-146-0x0000000000000000-mapping.dmp

Download
memory/3996-141-0x0000000000000000-mapping.dmp

Download
memory/4008-172-0x0000000000000000-mapping.dmp

Download
memory/4264-173-0x0000000000000000-mapping.dmp

Download
memory/4284-175-0x0000000000000000-mapping.dmp

Download
memory/4372-171-0x0000000000000000-mapping.dmp

Download
memory/4508-176-0x0000000000000000-mapping.dmp

Download
memory/4772-177-0x0000000000000000-mapping.dmp

Download
memory/4856-152-0x0000000000000000-mapping.dmp

Download
memory/4984-169-0x0000000000000000-mapping.dmp

Download
memory/5036-167-0x0000000000000000-mapping.dmp

Download
memory/5076-163-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads