44da43b39e86d7d67da9b05feb586f7077f935c23c780a1033774702c76f8c36

Analysis

max time kernel
125s
max time network
47s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
02/12/2022, 23:23

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

44da43b39e86d7d67da9b05feb586f7077f935c23c780a1033774702c76f8c36.exe
Size

195KB
MD5

9468c8093437fcb3e5a83662398990a4
SHA1

883a0c3cfc7302255124420f2fa763665e1a08f4
SHA256

44da43b39e86d7d67da9b05feb586f7077f935c23c780a1033774702c76f8c36
SHA512

98b35ad9b4815f7dcbeb1e9d348ded8b91054fdfc95c5db37ac76e0b27ba591e9d65a803a1ce4af20215e829e8912d3810b5e169eaa35c4963abef4cae456838
SSDEEP

3072:obpDCw1p3vmLvsZIaVwiwDcIbDHDCm/DEeoUsDnukbDktLgr7E:gDCwfG1bnxLE3bDnu3tZ

Score

10^/10

evasion persistence

Malware Config

Signatures

Modifies visibility of file extensions in Explorer 2 TTPs 3 IoCs

evasion

Hidden Files and Directories

T1158

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	44da43b39e86d7d67da9b05feb586f7077f935c23c780a1033774702c76f8c36.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	avscan.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	hosts.exe

Modifies visiblity of hidden/system files in Explorer 2 TTPs 3 IoCs

evasion

Hidden Files and Directories

T1158

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	avscan.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	hosts.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	44da43b39e86d7d67da9b05feb586f7077f935c23c780a1033774702c76f8c36.exe

Adds policy Run key to start application 2 TTPs 6 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	WScript.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\RYNKSFQE = "W_X_C.bat"	WScript.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	WScript.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\RYNKSFQE = "W_X_C.bat"	WScript.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	WScript.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\RYNKSFQE = "W_X_C.bat"	WScript.exe

Executes dropped EXE 6 IoCs

pid	Process
876	avscan.exe
588	avscan.exe
1704	hosts.exe
1492	hosts.exe
1672	avscan.exe
2040	hosts.exe

Loads dropped DLL 5 IoCs

pid	Process
1000	44da43b39e86d7d67da9b05feb586f7077f935c23c780a1033774702c76f8c36.exe
1000	44da43b39e86d7d67da9b05feb586f7077f935c23c780a1033774702c76f8c36.exe
876	avscan.exe
1704	hosts.exe
1704	hosts.exe

Adds Run key to start application 2 TTPs 6 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\avscan = "C:\\Users\\Admin\\AppData\\Local\\Temp\\avscan.exe"	44da43b39e86d7d67da9b05feb586f7077f935c23c780a1033774702c76f8c36.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run	avscan.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\avscan = "C:\\Users\\Admin\\AppData\\Local\\Temp\\avscan.exe"	avscan.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run	hosts.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\avscan = "C:\\Users\\Admin\\AppData\\Local\\Temp\\avscan.exe"	hosts.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run	44da43b39e86d7d67da9b05feb586f7077f935c23c780a1033774702c76f8c36.exe

Drops file in Windows directory 5 IoCs

description	ioc	Process
File created	C:\windows\W_X_C.vbs	44da43b39e86d7d67da9b05feb586f7077f935c23c780a1033774702c76f8c36.exe
File created	\??\c:\windows\W_X_C.bat	44da43b39e86d7d67da9b05feb586f7077f935c23c780a1033774702c76f8c36.exe
File opened for modification	C:\Windows\hosts.exe	44da43b39e86d7d67da9b05feb586f7077f935c23c780a1033774702c76f8c36.exe
File opened for modification	C:\Windows\hosts.exe	avscan.exe
File opened for modification	C:\Windows\hosts.exe	hosts.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies registry key 1 TTPs 9 IoCs

Modify Registry

T1112

pid	Process
1036	REG.exe
636	REG.exe
1468	REG.exe
916	REG.exe
1392	REG.exe
1696	REG.exe
1816	REG.exe
628	REG.exe
1412	REG.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

pid	Process
876	avscan.exe
1704	hosts.exe

Suspicious use of SetWindowsHookEx 7 IoCs

pid	Process
1000	44da43b39e86d7d67da9b05feb586f7077f935c23c780a1033774702c76f8c36.exe
876	avscan.exe
588	avscan.exe
1704	hosts.exe
1492	hosts.exe
1672	avscan.exe
2040	hosts.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1000 wrote to memory of 916	1000	44da43b39e86d7d67da9b05feb586f7077f935c23c780a1033774702c76f8c36.exe	27
PID 1000 wrote to memory of 916	1000	44da43b39e86d7d67da9b05feb586f7077f935c23c780a1033774702c76f8c36.exe	27
PID 1000 wrote to memory of 916	1000	44da43b39e86d7d67da9b05feb586f7077f935c23c780a1033774702c76f8c36.exe	27
PID 1000 wrote to memory of 916	1000	44da43b39e86d7d67da9b05feb586f7077f935c23c780a1033774702c76f8c36.exe	27
PID 1000 wrote to memory of 876	1000	44da43b39e86d7d67da9b05feb586f7077f935c23c780a1033774702c76f8c36.exe	29
PID 1000 wrote to memory of 876	1000	44da43b39e86d7d67da9b05feb586f7077f935c23c780a1033774702c76f8c36.exe	29
PID 1000 wrote to memory of 876	1000	44da43b39e86d7d67da9b05feb586f7077f935c23c780a1033774702c76f8c36.exe	29
PID 1000 wrote to memory of 876	1000	44da43b39e86d7d67da9b05feb586f7077f935c23c780a1033774702c76f8c36.exe	29
PID 876 wrote to memory of 588	876	avscan.exe	30
PID 876 wrote to memory of 588	876	avscan.exe	30
PID 876 wrote to memory of 588	876	avscan.exe	30
PID 876 wrote to memory of 588	876	avscan.exe	30
PID 876 wrote to memory of 1052	876	avscan.exe	31
PID 876 wrote to memory of 1052	876	avscan.exe	31
PID 876 wrote to memory of 1052	876	avscan.exe	31
PID 876 wrote to memory of 1052	876	avscan.exe	31
PID 1000 wrote to memory of 1828	1000	44da43b39e86d7d67da9b05feb586f7077f935c23c780a1033774702c76f8c36.exe	33
PID 1000 wrote to memory of 1828	1000	44da43b39e86d7d67da9b05feb586f7077f935c23c780a1033774702c76f8c36.exe	33
PID 1000 wrote to memory of 1828	1000	44da43b39e86d7d67da9b05feb586f7077f935c23c780a1033774702c76f8c36.exe	33
PID 1000 wrote to memory of 1828	1000	44da43b39e86d7d67da9b05feb586f7077f935c23c780a1033774702c76f8c36.exe	33
PID 1828 wrote to memory of 1704	1828	cmd.exe	36
PID 1828 wrote to memory of 1704	1828	cmd.exe	36
PID 1828 wrote to memory of 1704	1828	cmd.exe	36
PID 1828 wrote to memory of 1704	1828	cmd.exe	36
PID 1052 wrote to memory of 1492	1052	cmd.exe	35
PID 1052 wrote to memory of 1492	1052	cmd.exe	35
PID 1052 wrote to memory of 1492	1052	cmd.exe	35
PID 1052 wrote to memory of 1492	1052	cmd.exe	35
PID 1828 wrote to memory of 1912	1828	cmd.exe	38
PID 1828 wrote to memory of 1912	1828	cmd.exe	38
PID 1828 wrote to memory of 1912	1828	cmd.exe	38
PID 1828 wrote to memory of 1912	1828	cmd.exe	38
PID 1052 wrote to memory of 1916	1052	cmd.exe	37
PID 1052 wrote to memory of 1916	1052	cmd.exe	37
PID 1052 wrote to memory of 1916	1052	cmd.exe	37
PID 1052 wrote to memory of 1916	1052	cmd.exe	37
PID 1704 wrote to memory of 1672	1704	hosts.exe	39
PID 1704 wrote to memory of 1672	1704	hosts.exe	39
PID 1704 wrote to memory of 1672	1704	hosts.exe	39
PID 1704 wrote to memory of 1672	1704	hosts.exe	39
PID 1704 wrote to memory of 1752	1704	hosts.exe	40
PID 1704 wrote to memory of 1752	1704	hosts.exe	40
PID 1704 wrote to memory of 1752	1704	hosts.exe	40
PID 1704 wrote to memory of 1752	1704	hosts.exe	40
PID 1752 wrote to memory of 2040	1752	cmd.exe	42
PID 1752 wrote to memory of 2040	1752	cmd.exe	42
PID 1752 wrote to memory of 2040	1752	cmd.exe	42
PID 1752 wrote to memory of 2040	1752	cmd.exe	42
PID 1752 wrote to memory of 772	1752	cmd.exe	43
PID 1752 wrote to memory of 772	1752	cmd.exe	43
PID 1752 wrote to memory of 772	1752	cmd.exe	43
PID 1752 wrote to memory of 772	1752	cmd.exe	43
PID 876 wrote to memory of 628	876	avscan.exe	44
PID 876 wrote to memory of 628	876	avscan.exe	44
PID 876 wrote to memory of 628	876	avscan.exe	44
PID 876 wrote to memory of 628	876	avscan.exe	44
PID 1704 wrote to memory of 1412	1704	hosts.exe	46
PID 1704 wrote to memory of 1412	1704	hosts.exe	46
PID 1704 wrote to memory of 1412	1704	hosts.exe	46
PID 1704 wrote to memory of 1412	1704	hosts.exe	46
PID 876 wrote to memory of 1392	876	avscan.exe	48
PID 876 wrote to memory of 1392	876	avscan.exe	48
PID 876 wrote to memory of 1392	876	avscan.exe	48
PID 876 wrote to memory of 1392	876	avscan.exe	48

C:\Users\Admin\AppData\Local\Temp\44da43b39e86d7d67da9b05feb586f7077f935c23c780a1033774702c76f8c36.exe
"C:\Users\Admin\AppData\Local\Temp\44da43b39e86d7d67da9b05feb586f7077f935c23c780a1033774702c76f8c36.exe"
1⤵
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- Loads dropped DLL
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1000
- C:\Windows\SysWOW64\REG.exe
  REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
  2⤵
  - Modifies registry key
  PID:916
- C:\Users\Admin\AppData\Local\Temp\avscan.exe
  C:\Users\Admin\AppData\Local\Temp\avscan.exe
  2⤵
  - Modifies visibility of file extensions in Explorer
  - Modifies visiblity of hidden/system files in Explorer
  - Executes dropped EXE
  - Loads dropped DLL
  - Adds Run key to start application
  - Drops file in Windows directory
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:876
- - C:\Users\Admin\AppData\Local\Temp\avscan.exe
    C:\Users\Admin\AppData\Local\Temp\avscan.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:588
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c c:\windows\W_X_C.bat
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1052
  - - C:\windows\hosts.exe
      C:\windows\hosts.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1492
  - - C:\Windows\SysWOW64\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Windows\W_X_C.vbs"
      4⤵
      Adds policy Run key to start application
      PID:1916
- - C:\Windows\SysWOW64\REG.exe
    REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
    3⤵
    - Modifies registry key
    PID:628
- - C:\Windows\SysWOW64\REG.exe
    REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
    3⤵
    - Modifies registry key
    PID:1392
- - C:\Windows\SysWOW64\REG.exe
    REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
    3⤵
    - Modifies registry key
    PID:636
- - C:\Windows\SysWOW64\REG.exe
    REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
    3⤵
    - Modifies registry key
    PID:1696
- C:\Windows\SysWOW64\cmd.exe
  cmd /c c:\windows\W_X_C.bat
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1828
- - C:\windows\hosts.exe
    C:\windows\hosts.exe
    3⤵
    - Modifies visibility of file extensions in Explorer
    - Modifies visiblity of hidden/system files in Explorer
    - Executes dropped EXE
    - Loads dropped DLL
    - Adds Run key to start application
    - Drops file in Windows directory
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:1704
  - - C:\Users\Admin\AppData\Local\Temp\avscan.exe
      C:\Users\Admin\AppData\Local\Temp\avscan.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1672
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c c:\windows\W_X_C.bat
      4⤵
      Suspicious use of WriteProcessMemory
      PID:1752
    - - C:\windows\hosts.exe
        
        C:\windows\hosts.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2040
    - - C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Windows\W_X_C.vbs"
        5⤵
        Adds policy Run key to start application
        
        PID:772
  - - C:\Windows\SysWOW64\REG.exe
      REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
      4⤵
      Modifies registry key
      PID:1412
  - - C:\Windows\SysWOW64\REG.exe
      REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
      4⤵
      Modifies registry key
      PID:1036
  - - C:\Windows\SysWOW64\REG.exe
      REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
      4⤵
      Modifies registry key
      PID:1468
  - - C:\Windows\SysWOW64\REG.exe
      REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
      4⤵
      Modifies registry key
      PID:1816
- - C:\Windows\SysWOW64\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Windows\W_X_C.vbs"
    3⤵
    - Adds policy Run key to start application
    PID:1912

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Hidden Files and Directories

T1158

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Hidden Files and Directories

T1158

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Admin.bmp

Filesize
243KB

MD5
76894a92b5cd85d0f8c9ca7c394b6be7

SHA1
15a80793013ce361af184172fe470fc7a26f063a

SHA256
069eea67d1b5947b5823f76672c80f565cf64c177a34b7f3e2b0e3c9847e1bbd

SHA512
f71cdd810665484c6b7363faf435ca6893b5a0e977edd5da6a17b4e3aac17d6db6f55b466173ad2f02846d152c1f8aadc5da9e94693495393402bff91bf69fac

Download Submit
C:\Users\Admin\AppData\Local\Temp\Admin.bmp

Filesize
635KB

MD5
fd5e9289c64a1914cb2d7be057d71daa

SHA1
7946311fd190945bfd74df6e44b7cfc05befd7c6

SHA256
f7cfc257fc168c7ab65202cd3585e8a0422eee4c28fa102f868e34a4658ad914

SHA512
c41ca6359c380b235b31d8695fe48fde2718565375851036353d735d047207de349de25da3074c0c38fc99243f520afcbe9e03b9aa1b3ffd34dc27602c2631ab

Download Submit
C:\Users\Admin\AppData\Local\Temp\Admin.bmp

Filesize
831KB

MD5
74b8cc7e3d5f63bad748c7ecf38c217b

SHA1
e648ebe6efe66fb4e37639872b6d152050df07bf

SHA256
cb107c7f0d95a87a51a91d695e3c1f5c8482c3e4abe8e70d233c400193e6668e

SHA512
0945fb92debdf08836c726ae0ca3643e75a868a66ef4c310bc5944dd588e533001fb48e205fff1d18f549f7f55eae45bf3b6c3a3e1df6b62bf5fe548d02c7356

Download Submit
C:\Users\Admin\AppData\Local\Temp\Admin.bmp

Filesize
1.0MB

MD5
22ad5ff1264202db61c421ec19755da8

SHA1
5341ce8374b5f0c49735b297467edc92b7ca125b

SHA256
574d3ada67f22ab52953fce90a25444603e9b17fe3cefa06e93aad403f2319b1

SHA512
f10c16e3efbcd712844e7ab9490ae227af71d8ac0ab9be5b943a475b7f2d065b44585dcaae42a2088a84074b9699e0ab0c23e6ef99e0d573d9f2e6a763bbd6b8

Download Submit
C:\Users\Admin\AppData\Local\Temp\Admin.bmp

Filesize
1.2MB

MD5
942ff9c067eb9b0a5818132ea6f233c4

SHA1
92480fe01093607e024d1680d8a3992e73a57ade

SHA256
0fba6395124b9774251fb2cfbdb4d76d2c5cf56faefe057ae15d9928f5f9adf2

SHA512
4707df5955561c956fe0c2b4208f37a721508b8b8e81d6a7361addd409b31ec74e1818bdebb32512e6ad6b2b2995bde24a532e28fba338d05475781982eaff53

Download Submit
C:\Users\Admin\AppData\Local\Temp\Admin.bmp

Filesize
1.4MB

MD5
04cb6dd7c696e70d212f17cdb64fd682

SHA1
be330a388d64f78b8dba9d34d232fe79b685da08

SHA256
0d6d3346c00a17f448831d159226a31524feef9d11947757d6523d05e43ba8f4

SHA512
824f23fd5e1757ca83b637068a58f9bd16797101c3f97b97dd0d211c5848946744b1b98b819d3930057876bab0dfe5ab30bd70695fd7fbd79e20c1e7104d57ed

Download Submit
C:\Users\Admin\AppData\Local\Temp\Admin.bmp

Filesize
1.6MB

MD5
a99228593c2a724009ce72b0a83bf458

SHA1
7db8cae5175b6ae3b5cb69a006d064eea830b231

SHA256
8de73de35af3f149d6388a414fb00cbd249e5e264e4c21514d1a9e0c0365e2d6

SHA512
3f79e6f078f771563792374e4eeb24b0f5ee81618e62c7656d60591fb94157ed4e74e401a789629c792ecde77b158f7dcd7f7ec6a9a34b5eb96c2c7de424f6cc

Download Submit
C:\Users\Admin\AppData\Local\Temp\avscan.exe

Filesize
195KB

MD5
a955283f7b2b3f285b3000da3a4efdb6

SHA1
6edc173f3b14c575f51a327080dba46bd5aef412

SHA256
753a9ce81a424affa3a676b1c6675ed438a033f8b1bff397bae11f5f865d7537

SHA512
2724ac96e4f812a509fe86370e66b29a1c4ccd2465e7df6aafc3594f057cb7501f0c299e501174413102ec2f5fd4c24f6a17363c0e2eb0d521011d8881a15b83

Download Submit
C:\Users\Admin\AppData\Local\Temp\avscan.exe

Filesize
195KB

MD5
a955283f7b2b3f285b3000da3a4efdb6

SHA1
6edc173f3b14c575f51a327080dba46bd5aef412

SHA256
753a9ce81a424affa3a676b1c6675ed438a033f8b1bff397bae11f5f865d7537

SHA512
2724ac96e4f812a509fe86370e66b29a1c4ccd2465e7df6aafc3594f057cb7501f0c299e501174413102ec2f5fd4c24f6a17363c0e2eb0d521011d8881a15b83

Download Submit
C:\Users\Admin\AppData\Local\Temp\avscan.exe

Filesize
195KB

MD5
a955283f7b2b3f285b3000da3a4efdb6

SHA1
6edc173f3b14c575f51a327080dba46bd5aef412

SHA256
753a9ce81a424affa3a676b1c6675ed438a033f8b1bff397bae11f5f865d7537

SHA512
2724ac96e4f812a509fe86370e66b29a1c4ccd2465e7df6aafc3594f057cb7501f0c299e501174413102ec2f5fd4c24f6a17363c0e2eb0d521011d8881a15b83

Download Submit
C:\Users\Admin\AppData\Local\Temp\avscan.exe

Filesize
195KB

MD5
a955283f7b2b3f285b3000da3a4efdb6

SHA1
6edc173f3b14c575f51a327080dba46bd5aef412

SHA256
753a9ce81a424affa3a676b1c6675ed438a033f8b1bff397bae11f5f865d7537

SHA512
2724ac96e4f812a509fe86370e66b29a1c4ccd2465e7df6aafc3594f057cb7501f0c299e501174413102ec2f5fd4c24f6a17363c0e2eb0d521011d8881a15b83

Download Submit
C:\Windows\W_X_C.vbs

Filesize
195B

MD5
8efab902a61f6cddc318bb5818c2f2e0

SHA1
9608751279ae04ba710d84c61e3937c12950b393

SHA256
a81d0e86c651ead3e4d9c7f64e637006e787c81c8ba3e784648c2786306bfb87

SHA512
aabd0e45609a39584c68c35e16124b399e9a4932bf6c98c22aa8c6ff71b2fbfc80333102960fcfca1abb38b344245f9cdf4cdc0c827c48235f618011a5fbfe18

Download Submit
C:\Windows\hosts.exe

Filesize
195KB

MD5
3606b6e089f1720eb77a660605b2382d

SHA1
336238aec2ed71738f292c66cfc8d6644881f253

SHA256
a7fbd7480965fb803576d281c7c01998548c74ad0da21c694d4899300b778676

SHA512
acb32bbea549e6a276b85123db54e3ff69019dcf6520cb766df6edb998da6dfb6e07a6afbc1f759177436a58fbde20583867252afeb0152ea64d4fa02d99fd9c

Download Submit
C:\Windows\hosts.exe

Filesize
195KB

MD5
3606b6e089f1720eb77a660605b2382d

SHA1
336238aec2ed71738f292c66cfc8d6644881f253

SHA256
a7fbd7480965fb803576d281c7c01998548c74ad0da21c694d4899300b778676

SHA512
acb32bbea549e6a276b85123db54e3ff69019dcf6520cb766df6edb998da6dfb6e07a6afbc1f759177436a58fbde20583867252afeb0152ea64d4fa02d99fd9c

Download Submit
C:\Windows\hosts.exe

Filesize
195KB

MD5
3606b6e089f1720eb77a660605b2382d

SHA1
336238aec2ed71738f292c66cfc8d6644881f253

SHA256
a7fbd7480965fb803576d281c7c01998548c74ad0da21c694d4899300b778676

SHA512
acb32bbea549e6a276b85123db54e3ff69019dcf6520cb766df6edb998da6dfb6e07a6afbc1f759177436a58fbde20583867252afeb0152ea64d4fa02d99fd9c

Download Submit
C:\Windows\hosts.exe

Filesize
195KB

MD5
3606b6e089f1720eb77a660605b2382d

SHA1
336238aec2ed71738f292c66cfc8d6644881f253

SHA256
a7fbd7480965fb803576d281c7c01998548c74ad0da21c694d4899300b778676

SHA512
acb32bbea549e6a276b85123db54e3ff69019dcf6520cb766df6edb998da6dfb6e07a6afbc1f759177436a58fbde20583867252afeb0152ea64d4fa02d99fd9c

Download Submit
C:\windows\hosts.exe

Filesize
195KB

MD5
3606b6e089f1720eb77a660605b2382d

SHA1
336238aec2ed71738f292c66cfc8d6644881f253

SHA256
a7fbd7480965fb803576d281c7c01998548c74ad0da21c694d4899300b778676

SHA512
acb32bbea549e6a276b85123db54e3ff69019dcf6520cb766df6edb998da6dfb6e07a6afbc1f759177436a58fbde20583867252afeb0152ea64d4fa02d99fd9c

Download Submit
\??\c:\windows\W_X_C.bat

Filesize
336B

MD5
4db9f8b6175722b62ececeeeba1ce307

SHA1
3b3ba8414706e72a6fa19e884a97b87609e11e47

SHA256
d2150b9e5a4ce55e140f0ca91c4e300715d42095c8fddf58c77037cdd2cfaf78

SHA512
1d6dc274cf7a3dd704f840e6a5ad57ab4c4e35d5f09489aeff520bb797e1c825bac53fc335156fe41e767a46520d031855fe42fe7b175409ebe5e9e986fb9b8b

Download Submit
\Users\Admin\AppData\Local\Temp\avscan.exe

Filesize
195KB

MD5
a955283f7b2b3f285b3000da3a4efdb6

SHA1
6edc173f3b14c575f51a327080dba46bd5aef412

SHA256
753a9ce81a424affa3a676b1c6675ed438a033f8b1bff397bae11f5f865d7537

SHA512
2724ac96e4f812a509fe86370e66b29a1c4ccd2465e7df6aafc3594f057cb7501f0c299e501174413102ec2f5fd4c24f6a17363c0e2eb0d521011d8881a15b83

Download Submit
\Users\Admin\AppData\Local\Temp\avscan.exe

Filesize
195KB

MD5
a955283f7b2b3f285b3000da3a4efdb6

SHA1
6edc173f3b14c575f51a327080dba46bd5aef412

SHA256
753a9ce81a424affa3a676b1c6675ed438a033f8b1bff397bae11f5f865d7537

SHA512
2724ac96e4f812a509fe86370e66b29a1c4ccd2465e7df6aafc3594f057cb7501f0c299e501174413102ec2f5fd4c24f6a17363c0e2eb0d521011d8881a15b83

Download Submit
\Users\Admin\AppData\Local\Temp\avscan.exe

Filesize
195KB

MD5
a955283f7b2b3f285b3000da3a4efdb6

SHA1
6edc173f3b14c575f51a327080dba46bd5aef412

SHA256
753a9ce81a424affa3a676b1c6675ed438a033f8b1bff397bae11f5f865d7537

SHA512
2724ac96e4f812a509fe86370e66b29a1c4ccd2465e7df6aafc3594f057cb7501f0c299e501174413102ec2f5fd4c24f6a17363c0e2eb0d521011d8881a15b83

Download Submit
\Users\Admin\AppData\Local\Temp\avscan.exe

Filesize
195KB

MD5
a955283f7b2b3f285b3000da3a4efdb6

SHA1
6edc173f3b14c575f51a327080dba46bd5aef412

SHA256
753a9ce81a424affa3a676b1c6675ed438a033f8b1bff397bae11f5f865d7537

SHA512
2724ac96e4f812a509fe86370e66b29a1c4ccd2465e7df6aafc3594f057cb7501f0c299e501174413102ec2f5fd4c24f6a17363c0e2eb0d521011d8881a15b83

Download Submit
\Users\Admin\AppData\Local\Temp\avscan.exe

Filesize
195KB

MD5
a955283f7b2b3f285b3000da3a4efdb6

SHA1
6edc173f3b14c575f51a327080dba46bd5aef412

SHA256
753a9ce81a424affa3a676b1c6675ed438a033f8b1bff397bae11f5f865d7537

SHA512
2724ac96e4f812a509fe86370e66b29a1c4ccd2465e7df6aafc3594f057cb7501f0c299e501174413102ec2f5fd4c24f6a17363c0e2eb0d521011d8881a15b83

Download Submit
memory/1000-58-0x0000000074961000-0x0000000074963000-memory.dmp

Filesize
8KB

Download
memory/1000-56-0x0000000076561000-0x0000000076563000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads