bdcedbdf02b51d0b53e116edda0d39155d7c5d4374bfc5a8b9d7bbf1a6664b88

Analysis

max time kernel
127s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
03-12-2022 20:06

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

bdcedbdf02b51d0b53e116edda0d39155d7c5d4374bfc5a8b9d7bbf1a6664b88.exe
Size

749KB
MD5

829698894b4a13b4a683f97301b0f682
SHA1

353513afd1d98071ebe6090cb4b793e30422a2c3
SHA256

bdcedbdf02b51d0b53e116edda0d39155d7c5d4374bfc5a8b9d7bbf1a6664b88
SHA512

8500418d814d1cc145492c73a82b3a247f83fb6a89a3c6506fe925107795c1060038636e58b55e47f196ae1e07b851e4f99cb5a733bfdbe4d574b31a323aea5b
SSDEEP

12288:g72bntEL772bntELDRFj47+572bntEL772bntELDRFj47+HDn0:g72ze72z2Ky72ze72z2K80

Score

10^/10

evasion persistence

Malware Config

Signatures

Modifies visibility of file extensions in Explorer 2 TTPs 3 IoCs

evasion

Hidden Files and Directories

T1158

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	bdcedbdf02b51d0b53e116edda0d39155d7c5d4374bfc5a8b9d7bbf1a6664b88.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	avscan.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	hosts.exe

Modifies visiblity of hidden/system files in Explorer 2 TTPs 3 IoCs

evasion

Hidden Files and Directories

T1158

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	bdcedbdf02b51d0b53e116edda0d39155d7c5d4374bfc5a8b9d7bbf1a6664b88.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	avscan.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	hosts.exe

Adds policy Run key to start application 2 TTPs 6 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\IYMUGYHL = "W_X_C.bat"	WScript.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	WScript.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\IYMUGYHL = "W_X_C.bat"	WScript.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	WScript.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\IYMUGYHL = "W_X_C.bat"	WScript.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	WScript.exe

Executes dropped EXE 6 IoCs

pid	Process
1940	avscan.exe
1224	avscan.exe
3148	hosts.exe
4176	hosts.exe
3540	avscan.exe
5084	hosts.exe

Checks computer location settings 2 TTPs 3 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation	cmd.exe
Key value queried	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation	cmd.exe
Key value queried	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation	cmd.exe

Adds Run key to start application 2 TTPs 6 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run	avscan.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\avscan = "C:\\Users\\Admin\\AppData\\Local\\Temp\\avscan.exe"	avscan.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run	hosts.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\avscan = "C:\\Users\\Admin\\AppData\\Local\\Temp\\avscan.exe"	hosts.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run	bdcedbdf02b51d0b53e116edda0d39155d7c5d4374bfc5a8b9d7bbf1a6664b88.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\avscan = "C:\\Users\\Admin\\AppData\\Local\\Temp\\avscan.exe"	bdcedbdf02b51d0b53e116edda0d39155d7c5d4374bfc5a8b9d7bbf1a6664b88.exe

Drops file in Windows directory 5 IoCs

description	ioc	Process
File created	C:\windows\W_X_C.vbs	bdcedbdf02b51d0b53e116edda0d39155d7c5d4374bfc5a8b9d7bbf1a6664b88.exe
File created	\??\c:\windows\W_X_C.bat	bdcedbdf02b51d0b53e116edda0d39155d7c5d4374bfc5a8b9d7bbf1a6664b88.exe
File opened for modification	C:\Windows\hosts.exe	bdcedbdf02b51d0b53e116edda0d39155d7c5d4374bfc5a8b9d7bbf1a6664b88.exe
File opened for modification	C:\Windows\hosts.exe	avscan.exe
File opened for modification	C:\Windows\hosts.exe	hosts.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies registry class 4 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\Local Settings	bdcedbdf02b51d0b53e116edda0d39155d7c5d4374bfc5a8b9d7bbf1a6664b88.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\Local Settings	cmd.exe

Modifies registry key 1 TTPs 9 IoCs

Modify Registry

T1112

pid	Process
3756	REG.exe
3712	REG.exe
2916	REG.exe
636	REG.exe
1624	REG.exe
4332	REG.exe
4976	REG.exe
4944	REG.exe
3560	REG.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

pid	Process
1940	avscan.exe
3148	hosts.exe

Suspicious use of SetWindowsHookEx 7 IoCs

pid	Process
4788	bdcedbdf02b51d0b53e116edda0d39155d7c5d4374bfc5a8b9d7bbf1a6664b88.exe
1940	avscan.exe
1224	avscan.exe
3148	hosts.exe
4176	hosts.exe
3540	avscan.exe
5084	hosts.exe

Suspicious use of WriteProcessMemory 63 IoCs

description	pid	Process	procid_target
PID 4788 wrote to memory of 1624	4788	bdcedbdf02b51d0b53e116edda0d39155d7c5d4374bfc5a8b9d7bbf1a6664b88.exe	81
PID 4788 wrote to memory of 1624	4788	bdcedbdf02b51d0b53e116edda0d39155d7c5d4374bfc5a8b9d7bbf1a6664b88.exe	81
PID 4788 wrote to memory of 1624	4788	bdcedbdf02b51d0b53e116edda0d39155d7c5d4374bfc5a8b9d7bbf1a6664b88.exe	81
PID 4788 wrote to memory of 1940	4788	bdcedbdf02b51d0b53e116edda0d39155d7c5d4374bfc5a8b9d7bbf1a6664b88.exe	83
PID 4788 wrote to memory of 1940	4788	bdcedbdf02b51d0b53e116edda0d39155d7c5d4374bfc5a8b9d7bbf1a6664b88.exe	83
PID 4788 wrote to memory of 1940	4788	bdcedbdf02b51d0b53e116edda0d39155d7c5d4374bfc5a8b9d7bbf1a6664b88.exe	83
PID 1940 wrote to memory of 1224	1940	avscan.exe	84
PID 1940 wrote to memory of 1224	1940	avscan.exe	84
PID 1940 wrote to memory of 1224	1940	avscan.exe	84
PID 1940 wrote to memory of 4052	1940	avscan.exe	85
PID 1940 wrote to memory of 4052	1940	avscan.exe	85
PID 1940 wrote to memory of 4052	1940	avscan.exe	85
PID 4788 wrote to memory of 4784	4788	bdcedbdf02b51d0b53e116edda0d39155d7c5d4374bfc5a8b9d7bbf1a6664b88.exe	87
PID 4788 wrote to memory of 4784	4788	bdcedbdf02b51d0b53e116edda0d39155d7c5d4374bfc5a8b9d7bbf1a6664b88.exe	87
PID 4788 wrote to memory of 4784	4788	bdcedbdf02b51d0b53e116edda0d39155d7c5d4374bfc5a8b9d7bbf1a6664b88.exe	87
PID 4052 wrote to memory of 4176	4052	cmd.exe	89
PID 4052 wrote to memory of 4176	4052	cmd.exe	89
PID 4052 wrote to memory of 4176	4052	cmd.exe	89
PID 4784 wrote to memory of 3148	4784	cmd.exe	90
PID 4784 wrote to memory of 3148	4784	cmd.exe	90
PID 4784 wrote to memory of 3148	4784	cmd.exe	90
PID 3148 wrote to memory of 3540	3148	hosts.exe	92
PID 3148 wrote to memory of 3540	3148	hosts.exe	92
PID 3148 wrote to memory of 3540	3148	hosts.exe	92
PID 3148 wrote to memory of 2352	3148	hosts.exe	93
PID 3148 wrote to memory of 2352	3148	hosts.exe	93
PID 3148 wrote to memory of 2352	3148	hosts.exe	93
PID 4052 wrote to memory of 1348	4052	cmd.exe	95
PID 4052 wrote to memory of 1348	4052	cmd.exe	95
PID 4052 wrote to memory of 1348	4052	cmd.exe	95
PID 4784 wrote to memory of 1380	4784	cmd.exe	96
PID 4784 wrote to memory of 1380	4784	cmd.exe	96
PID 4784 wrote to memory of 1380	4784	cmd.exe	96
PID 2352 wrote to memory of 5084	2352	cmd.exe	97
PID 2352 wrote to memory of 5084	2352	cmd.exe	97
PID 2352 wrote to memory of 5084	2352	cmd.exe	97
PID 2352 wrote to memory of 2940	2352	cmd.exe	98
PID 2352 wrote to memory of 2940	2352	cmd.exe	98
PID 2352 wrote to memory of 2940	2352	cmd.exe	98
PID 1940 wrote to memory of 4332	1940	avscan.exe	107
PID 1940 wrote to memory of 4332	1940	avscan.exe	107
PID 1940 wrote to memory of 4332	1940	avscan.exe	107
PID 3148 wrote to memory of 4976	3148	hosts.exe	109
PID 3148 wrote to memory of 4976	3148	hosts.exe	109
PID 3148 wrote to memory of 4976	3148	hosts.exe	109
PID 1940 wrote to memory of 4944	1940	avscan.exe	111
PID 1940 wrote to memory of 4944	1940	avscan.exe	111
PID 1940 wrote to memory of 4944	1940	avscan.exe	111
PID 3148 wrote to memory of 3756	3148	hosts.exe	113
PID 3148 wrote to memory of 3756	3148	hosts.exe	113
PID 3148 wrote to memory of 3756	3148	hosts.exe	113
PID 1940 wrote to memory of 3712	1940	avscan.exe	115
PID 1940 wrote to memory of 3712	1940	avscan.exe	115
PID 1940 wrote to memory of 3712	1940	avscan.exe	115
PID 3148 wrote to memory of 2916	3148	hosts.exe	117
PID 3148 wrote to memory of 2916	3148	hosts.exe	117
PID 3148 wrote to memory of 2916	3148	hosts.exe	117
PID 1940 wrote to memory of 636	1940	avscan.exe	119
PID 1940 wrote to memory of 636	1940	avscan.exe	119
PID 1940 wrote to memory of 636	1940	avscan.exe	119
PID 3148 wrote to memory of 3560	3148	hosts.exe	121
PID 3148 wrote to memory of 3560	3148	hosts.exe	121
PID 3148 wrote to memory of 3560	3148	hosts.exe	121

C:\Users\Admin\AppData\Local\Temp\bdcedbdf02b51d0b53e116edda0d39155d7c5d4374bfc5a8b9d7bbf1a6664b88.exe
"C:\Users\Admin\AppData\Local\Temp\bdcedbdf02b51d0b53e116edda0d39155d7c5d4374bfc5a8b9d7bbf1a6664b88.exe"
1⤵
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- Adds Run key to start application
- Drops file in Windows directory
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4788
- C:\Windows\SysWOW64\REG.exe
  REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
  2⤵
  - Modifies registry key
  PID:1624
- C:\Users\Admin\AppData\Local\Temp\avscan.exe
  C:\Users\Admin\AppData\Local\Temp\avscan.exe
  2⤵
  - Modifies visibility of file extensions in Explorer
  - Modifies visiblity of hidden/system files in Explorer
  - Executes dropped EXE
  - Adds Run key to start application
  - Drops file in Windows directory
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1940
- - C:\Users\Admin\AppData\Local\Temp\avscan.exe
    C:\Users\Admin\AppData\Local\Temp\avscan.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1224
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c c:\windows\W_X_C.bat
    3⤵
    - Checks computer location settings
    - Modifies registry class
    - Suspicious use of WriteProcessMemory
    PID:4052
  - - C:\windows\hosts.exe
      C:\windows\hosts.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4176
  - - C:\Windows\SysWOW64\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Windows\W_X_C.vbs"
      4⤵
      Adds policy Run key to start application
      PID:1348
- - C:\Windows\SysWOW64\REG.exe
    REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
    3⤵
    - Modifies registry key
    PID:4332
- - C:\Windows\SysWOW64\REG.exe
    REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
    3⤵
    - Modifies registry key
    PID:4944
- - C:\Windows\SysWOW64\REG.exe
    REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
    3⤵
    - Modifies registry key
    PID:3712
- - C:\Windows\SysWOW64\REG.exe
    REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
    3⤵
    - Modifies registry key
    PID:636
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c c:\windows\W_X_C.bat
  2⤵
  - Checks computer location settings
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:4784
- - C:\windows\hosts.exe
    C:\windows\hosts.exe
    3⤵
    - Modifies visibility of file extensions in Explorer
    - Modifies visiblity of hidden/system files in Explorer
    - Executes dropped EXE
    - Adds Run key to start application
    - Drops file in Windows directory
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:3148
  - - C:\Users\Admin\AppData\Local\Temp\avscan.exe
      C:\Users\Admin\AppData\Local\Temp\avscan.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3540
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c c:\windows\W_X_C.bat
      4⤵
      Checks computer location settings
      Modifies registry class
      Suspicious use of WriteProcessMemory
      PID:2352
    - - C:\windows\hosts.exe
        
        C:\windows\hosts.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:5084
    - - C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Windows\W_X_C.vbs"
        5⤵
        Adds policy Run key to start application
        
        PID:2940
  - - C:\Windows\SysWOW64\REG.exe
      REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
      4⤵
      Modifies registry key
      PID:4976
  - - C:\Windows\SysWOW64\REG.exe
      REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
      4⤵
      Modifies registry key
      PID:3756
  - - C:\Windows\SysWOW64\REG.exe
      REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
      4⤵
      Modifies registry key
      PID:2916
  - - C:\Windows\SysWOW64\REG.exe
      REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
      4⤵
      Modifies registry key
      PID:3560
- - C:\Windows\SysWOW64\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Windows\W_X_C.vbs"
    3⤵
    - Adds policy Run key to start application
    PID:1380

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:3204

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Hidden Files and Directories

T1158

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Hidden Files and Directories

T1158

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\avscan.exe

Filesize
749KB

MD5
3ea1a61012ee1579f7bf5adae38bd0f3

SHA1
aef1897811f45afaa3c67c6489eee4ed5f48e051

SHA256
a59fac89da4c7847743adb398faf9e1eea038fc6a6627fb878bc00d0ced8fce5

SHA512
bf5f364e1bfe692ed2908b57e9f9267f83b93e9e8cab53c7ebda3966f7fd333576ee0c8289b9c9650c2bb9734ce4eaca9ca637f8e534758880c2db018a7d2a00

Download Submit
C:\Users\Admin\AppData\Local\Temp\avscan.exe

Filesize
749KB

MD5
3ea1a61012ee1579f7bf5adae38bd0f3

SHA1
aef1897811f45afaa3c67c6489eee4ed5f48e051

SHA256
a59fac89da4c7847743adb398faf9e1eea038fc6a6627fb878bc00d0ced8fce5

SHA512
bf5f364e1bfe692ed2908b57e9f9267f83b93e9e8cab53c7ebda3966f7fd333576ee0c8289b9c9650c2bb9734ce4eaca9ca637f8e534758880c2db018a7d2a00

Download Submit
C:\Users\Admin\AppData\Local\Temp\avscan.exe

Filesize
749KB

MD5
3ea1a61012ee1579f7bf5adae38bd0f3

SHA1
aef1897811f45afaa3c67c6489eee4ed5f48e051

SHA256
a59fac89da4c7847743adb398faf9e1eea038fc6a6627fb878bc00d0ced8fce5

SHA512
bf5f364e1bfe692ed2908b57e9f9267f83b93e9e8cab53c7ebda3966f7fd333576ee0c8289b9c9650c2bb9734ce4eaca9ca637f8e534758880c2db018a7d2a00

Download Submit
C:\Users\Admin\AppData\Local\Temp\avscan.exe

Filesize
749KB

MD5
3ea1a61012ee1579f7bf5adae38bd0f3

SHA1
aef1897811f45afaa3c67c6489eee4ed5f48e051

SHA256
a59fac89da4c7847743adb398faf9e1eea038fc6a6627fb878bc00d0ced8fce5

SHA512
bf5f364e1bfe692ed2908b57e9f9267f83b93e9e8cab53c7ebda3966f7fd333576ee0c8289b9c9650c2bb9734ce4eaca9ca637f8e534758880c2db018a7d2a00

Download Submit
C:\Windows\W_X_C.vbs

Filesize
195B

MD5
0e0483d4802632100b6bfe8bc2e5d661

SHA1
767e0deb7dcaa7676004e6053957c36cecfeeefa

SHA256
81bbebb8d0e77ffffbc7b7d24afdcdce4089f4b04d1a12284eda861c25e03f9f

SHA512
8279b0559ca30a0adc6c8614870c3e445866c20f0617a7153cab41982b451dfe9ea44478f37b884465235714623ef26a56f5ea3d1cb81767487c494d3703ab29

Download Submit
C:\Windows\hosts.exe

Filesize
749KB

MD5
8feae7e6cdcec727f184b1a19edef034

SHA1
c86e8c4fcea41294d99803002520104738757706

SHA256
41fe91a27202a338e5553e85552f7899b41612f66cc84e342dbed1c70431dbc1

SHA512
02fb90be50163f0f5518b8154cb92e56c5a552f3cd777dca1e3028af2eb0ad411c10f0fdb4999fd02979374abc8d9a37715fba7ac00cf8a7eab693b581dc4b87

Download Submit
C:\Windows\hosts.exe

Filesize
749KB

MD5
8feae7e6cdcec727f184b1a19edef034

SHA1
c86e8c4fcea41294d99803002520104738757706

SHA256
41fe91a27202a338e5553e85552f7899b41612f66cc84e342dbed1c70431dbc1

SHA512
02fb90be50163f0f5518b8154cb92e56c5a552f3cd777dca1e3028af2eb0ad411c10f0fdb4999fd02979374abc8d9a37715fba7ac00cf8a7eab693b581dc4b87

Download Submit
C:\Windows\hosts.exe

Filesize
749KB

MD5
8feae7e6cdcec727f184b1a19edef034

SHA1
c86e8c4fcea41294d99803002520104738757706

SHA256
41fe91a27202a338e5553e85552f7899b41612f66cc84e342dbed1c70431dbc1

SHA512
02fb90be50163f0f5518b8154cb92e56c5a552f3cd777dca1e3028af2eb0ad411c10f0fdb4999fd02979374abc8d9a37715fba7ac00cf8a7eab693b581dc4b87

Download Submit
C:\Windows\hosts.exe

Filesize
749KB

MD5
8feae7e6cdcec727f184b1a19edef034

SHA1
c86e8c4fcea41294d99803002520104738757706

SHA256
41fe91a27202a338e5553e85552f7899b41612f66cc84e342dbed1c70431dbc1

SHA512
02fb90be50163f0f5518b8154cb92e56c5a552f3cd777dca1e3028af2eb0ad411c10f0fdb4999fd02979374abc8d9a37715fba7ac00cf8a7eab693b581dc4b87

Download Submit
C:\windows\hosts.exe

Filesize
749KB

MD5
8feae7e6cdcec727f184b1a19edef034

SHA1
c86e8c4fcea41294d99803002520104738757706

SHA256
41fe91a27202a338e5553e85552f7899b41612f66cc84e342dbed1c70431dbc1

SHA512
02fb90be50163f0f5518b8154cb92e56c5a552f3cd777dca1e3028af2eb0ad411c10f0fdb4999fd02979374abc8d9a37715fba7ac00cf8a7eab693b581dc4b87

Download Submit
\??\c:\windows\W_X_C.bat

Filesize
336B

MD5
4db9f8b6175722b62ececeeeba1ce307

SHA1
3b3ba8414706e72a6fa19e884a97b87609e11e47

SHA256
d2150b9e5a4ce55e140f0ca91c4e300715d42095c8fddf58c77037cdd2cfaf78

SHA512
1d6dc274cf7a3dd704f840e6a5ad57ab4c4e35d5f09489aeff520bb797e1c825bac53fc335156fe41e767a46520d031855fe42fe7b175409ebe5e9e986fb9b8b

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads