c1da29ce2cfa6e74ae682affb4e91b5d147c5b31edabf5cbb5248ecb5c50b9e4

Analysis

max time kernel
150s
max time network
70s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
05/12/2022, 21:55

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c1da29ce2cfa6e74ae682affb4e91b5d147c5b31edabf5cbb5248ecb5c50b9e4.exe
Size

852KB
MD5

e331cdb066e98f0cbff4990f29e73c2d
SHA1

3457b3edc567271a2a87367349a168fa1fcde1be
SHA256

c1da29ce2cfa6e74ae682affb4e91b5d147c5b31edabf5cbb5248ecb5c50b9e4
SHA512

09a76247885d8850e4e3db07a16862e03ad177e24adccc141adabed504d6158a84a2df3b2db610bd82f8075912afcf824d87e504d31e53905e562aed7abce38f
SSDEEP

12288:g72bnI+w8GNA72bnI+w8GNPg72bnI+w8GNA72bnI+w8GNPbo:g72zd72zsg72zd72zsbo

Score

10^/10

evasion persistence

Malware Config

Signatures

Modifies visibility of file extensions in Explorer 2 TTPs 3 IoCs

evasion

Hidden Files and Directories

T1158

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	avscan.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	hosts.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	c1da29ce2cfa6e74ae682affb4e91b5d147c5b31edabf5cbb5248ecb5c50b9e4.exe

Modifies visiblity of hidden/system files in Explorer 2 TTPs 3 IoCs

evasion

Hidden Files and Directories

T1158

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	c1da29ce2cfa6e74ae682affb4e91b5d147c5b31edabf5cbb5248ecb5c50b9e4.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	avscan.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	hosts.exe

Adds policy Run key to start application 2 TTPs 6 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	WScript.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\SABDUHNY = "W_X_C.bat"	WScript.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	WScript.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\SABDUHNY = "W_X_C.bat"	WScript.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	WScript.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\SABDUHNY = "W_X_C.bat"	WScript.exe

Executes dropped EXE 6 IoCs

pid	Process
1904	avscan.exe
1728	avscan.exe
796	hosts.exe
1004	hosts.exe
1516	avscan.exe
1028	hosts.exe

Loads dropped DLL 5 IoCs

pid	Process
956	c1da29ce2cfa6e74ae682affb4e91b5d147c5b31edabf5cbb5248ecb5c50b9e4.exe
956	c1da29ce2cfa6e74ae682affb4e91b5d147c5b31edabf5cbb5248ecb5c50b9e4.exe
1904	avscan.exe
796	hosts.exe
796	hosts.exe

Adds Run key to start application 2 TTPs 6 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run	c1da29ce2cfa6e74ae682affb4e91b5d147c5b31edabf5cbb5248ecb5c50b9e4.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\avscan = "C:\\Users\\Admin\\AppData\\Local\\Temp\\avscan.exe"	c1da29ce2cfa6e74ae682affb4e91b5d147c5b31edabf5cbb5248ecb5c50b9e4.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run	avscan.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\avscan = "C:\\Users\\Admin\\AppData\\Local\\Temp\\avscan.exe"	avscan.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run	hosts.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\avscan = "C:\\Users\\Admin\\AppData\\Local\\Temp\\avscan.exe"	hosts.exe

Drops file in Windows directory 5 IoCs

description	ioc	Process
File created	C:\windows\W_X_C.vbs	c1da29ce2cfa6e74ae682affb4e91b5d147c5b31edabf5cbb5248ecb5c50b9e4.exe
File created	\??\c:\windows\W_X_C.bat	c1da29ce2cfa6e74ae682affb4e91b5d147c5b31edabf5cbb5248ecb5c50b9e4.exe
File opened for modification	C:\Windows\hosts.exe	c1da29ce2cfa6e74ae682affb4e91b5d147c5b31edabf5cbb5248ecb5c50b9e4.exe
File opened for modification	C:\Windows\hosts.exe	avscan.exe
File opened for modification	C:\Windows\hosts.exe	hosts.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies registry key 1 TTPs 9 IoCs

Modify Registry

T1112

pid	Process
1324	REG.exe
1580	REG.exe
1588	REG.exe
996	REG.exe
808	REG.exe
592	REG.exe
888	REG.exe
824	REG.exe
684	REG.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

pid	Process
1904	avscan.exe
796	hosts.exe

Suspicious use of SetWindowsHookEx 7 IoCs

pid	Process
956	c1da29ce2cfa6e74ae682affb4e91b5d147c5b31edabf5cbb5248ecb5c50b9e4.exe
1904	avscan.exe
1728	avscan.exe
796	hosts.exe
1004	hosts.exe
1516	avscan.exe
1028	hosts.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 956 wrote to memory of 888	956	c1da29ce2cfa6e74ae682affb4e91b5d147c5b31edabf5cbb5248ecb5c50b9e4.exe	28
PID 956 wrote to memory of 888	956	c1da29ce2cfa6e74ae682affb4e91b5d147c5b31edabf5cbb5248ecb5c50b9e4.exe	28
PID 956 wrote to memory of 888	956	c1da29ce2cfa6e74ae682affb4e91b5d147c5b31edabf5cbb5248ecb5c50b9e4.exe	28
PID 956 wrote to memory of 888	956	c1da29ce2cfa6e74ae682affb4e91b5d147c5b31edabf5cbb5248ecb5c50b9e4.exe	28
PID 956 wrote to memory of 1904	956	c1da29ce2cfa6e74ae682affb4e91b5d147c5b31edabf5cbb5248ecb5c50b9e4.exe	30
PID 956 wrote to memory of 1904	956	c1da29ce2cfa6e74ae682affb4e91b5d147c5b31edabf5cbb5248ecb5c50b9e4.exe	30
PID 956 wrote to memory of 1904	956	c1da29ce2cfa6e74ae682affb4e91b5d147c5b31edabf5cbb5248ecb5c50b9e4.exe	30
PID 956 wrote to memory of 1904	956	c1da29ce2cfa6e74ae682affb4e91b5d147c5b31edabf5cbb5248ecb5c50b9e4.exe	30
PID 1904 wrote to memory of 1728	1904	avscan.exe	31
PID 1904 wrote to memory of 1728	1904	avscan.exe	31
PID 1904 wrote to memory of 1728	1904	avscan.exe	31
PID 1904 wrote to memory of 1728	1904	avscan.exe	31
PID 1904 wrote to memory of 1520	1904	avscan.exe	32
PID 1904 wrote to memory of 1520	1904	avscan.exe	32
PID 1904 wrote to memory of 1520	1904	avscan.exe	32
PID 1904 wrote to memory of 1520	1904	avscan.exe	32
PID 956 wrote to memory of 1020	956	c1da29ce2cfa6e74ae682affb4e91b5d147c5b31edabf5cbb5248ecb5c50b9e4.exe	33
PID 956 wrote to memory of 1020	956	c1da29ce2cfa6e74ae682affb4e91b5d147c5b31edabf5cbb5248ecb5c50b9e4.exe	33
PID 956 wrote to memory of 1020	956	c1da29ce2cfa6e74ae682affb4e91b5d147c5b31edabf5cbb5248ecb5c50b9e4.exe	33
PID 956 wrote to memory of 1020	956	c1da29ce2cfa6e74ae682affb4e91b5d147c5b31edabf5cbb5248ecb5c50b9e4.exe	33
PID 1520 wrote to memory of 1004	1520	cmd.exe	37
PID 1520 wrote to memory of 1004	1520	cmd.exe	37
PID 1520 wrote to memory of 1004	1520	cmd.exe	37
PID 1520 wrote to memory of 1004	1520	cmd.exe	37
PID 1020 wrote to memory of 796	1020	cmd.exe	36
PID 1020 wrote to memory of 796	1020	cmd.exe	36
PID 1020 wrote to memory of 796	1020	cmd.exe	36
PID 1020 wrote to memory of 796	1020	cmd.exe	36
PID 796 wrote to memory of 1516	796	hosts.exe	38
PID 796 wrote to memory of 1516	796	hosts.exe	38
PID 796 wrote to memory of 1516	796	hosts.exe	38
PID 796 wrote to memory of 1516	796	hosts.exe	38
PID 1020 wrote to memory of 1560	1020	cmd.exe	39
PID 1020 wrote to memory of 1560	1020	cmd.exe	39
PID 1020 wrote to memory of 1560	1020	cmd.exe	39
PID 1020 wrote to memory of 1560	1020	cmd.exe	39
PID 1520 wrote to memory of 1228	1520	cmd.exe	40
PID 1520 wrote to memory of 1228	1520	cmd.exe	40
PID 1520 wrote to memory of 1228	1520	cmd.exe	40
PID 1520 wrote to memory of 1228	1520	cmd.exe	40
PID 796 wrote to memory of 1988	796	hosts.exe	41
PID 796 wrote to memory of 1988	796	hosts.exe	41
PID 796 wrote to memory of 1988	796	hosts.exe	41
PID 796 wrote to memory of 1988	796	hosts.exe	41
PID 1988 wrote to memory of 1028	1988	cmd.exe	43
PID 1988 wrote to memory of 1028	1988	cmd.exe	43
PID 1988 wrote to memory of 1028	1988	cmd.exe	43
PID 1988 wrote to memory of 1028	1988	cmd.exe	43
PID 1988 wrote to memory of 360	1988	cmd.exe	44
PID 1988 wrote to memory of 360	1988	cmd.exe	44
PID 1988 wrote to memory of 360	1988	cmd.exe	44
PID 1988 wrote to memory of 360	1988	cmd.exe	44
PID 796 wrote to memory of 824	796	hosts.exe	45
PID 796 wrote to memory of 824	796	hosts.exe	45
PID 796 wrote to memory of 824	796	hosts.exe	45
PID 796 wrote to memory of 824	796	hosts.exe	45
PID 1904 wrote to memory of 1324	1904	avscan.exe	47
PID 1904 wrote to memory of 1324	1904	avscan.exe	47
PID 1904 wrote to memory of 1324	1904	avscan.exe	47
PID 1904 wrote to memory of 1324	1904	avscan.exe	47
PID 796 wrote to memory of 1580	796	hosts.exe	49
PID 796 wrote to memory of 1580	796	hosts.exe	49
PID 796 wrote to memory of 1580	796	hosts.exe	49
PID 796 wrote to memory of 1580	796	hosts.exe	49

C:\Users\Admin\AppData\Local\Temp\c1da29ce2cfa6e74ae682affb4e91b5d147c5b31edabf5cbb5248ecb5c50b9e4.exe
"C:\Users\Admin\AppData\Local\Temp\c1da29ce2cfa6e74ae682affb4e91b5d147c5b31edabf5cbb5248ecb5c50b9e4.exe"
1⤵
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- Loads dropped DLL
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:956
- C:\Windows\SysWOW64\REG.exe
  REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
  2⤵
  - Modifies registry key
  PID:888
- C:\Users\Admin\AppData\Local\Temp\avscan.exe
  C:\Users\Admin\AppData\Local\Temp\avscan.exe
  2⤵
  - Modifies visibility of file extensions in Explorer
  - Modifies visiblity of hidden/system files in Explorer
  - Executes dropped EXE
  - Loads dropped DLL
  - Adds Run key to start application
  - Drops file in Windows directory
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1904
- - C:\Users\Admin\AppData\Local\Temp\avscan.exe
    C:\Users\Admin\AppData\Local\Temp\avscan.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1728
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c c:\windows\W_X_C.bat
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1520
  - - C:\windows\hosts.exe
      C:\windows\hosts.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1004
  - - C:\Windows\SysWOW64\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Windows\W_X_C.vbs"
      4⤵
      Adds policy Run key to start application
      PID:1228
- - C:\Windows\SysWOW64\REG.exe
    REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
    3⤵
    - Modifies registry key
    PID:1324
- - C:\Windows\SysWOW64\REG.exe
    REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
    3⤵
    - Modifies registry key
    PID:1588
- - C:\Windows\SysWOW64\REG.exe
    REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
    3⤵
    - Modifies registry key
    PID:808
- - C:\Windows\SysWOW64\REG.exe
    REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
    3⤵
    - Modifies registry key
    PID:592
- C:\Windows\SysWOW64\cmd.exe
  cmd /c c:\windows\W_X_C.bat
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1020
- - C:\windows\hosts.exe
    C:\windows\hosts.exe
    3⤵
    - Modifies visibility of file extensions in Explorer
    - Modifies visiblity of hidden/system files in Explorer
    - Executes dropped EXE
    - Loads dropped DLL
    - Adds Run key to start application
    - Drops file in Windows directory
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:796
  - - C:\Users\Admin\AppData\Local\Temp\avscan.exe
      C:\Users\Admin\AppData\Local\Temp\avscan.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1516
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c c:\windows\W_X_C.bat
      4⤵
      Suspicious use of WriteProcessMemory
      PID:1988
    - - C:\windows\hosts.exe
        
        C:\windows\hosts.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1028
    - - C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Windows\W_X_C.vbs"
        5⤵
        Adds policy Run key to start application
        
        PID:360
  - - C:\Windows\SysWOW64\REG.exe
      REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
      4⤵
      Modifies registry key
      PID:824
  - - C:\Windows\SysWOW64\REG.exe
      REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
      4⤵
      Modifies registry key
      PID:1580
  - - C:\Windows\SysWOW64\REG.exe
      REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
      4⤵
      Modifies registry key
      PID:996
  - - C:\Windows\SysWOW64\REG.exe
      REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
      4⤵
      Modifies registry key
      PID:684
- - C:\Windows\SysWOW64\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Windows\W_X_C.vbs"
    3⤵
    - Adds policy Run key to start application
    PID:1560

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Hidden Files and Directories

T1158

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Hidden Files and Directories

T1158

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Admin.bmp

Filesize
900KB

MD5
e8a5178f6c4bd33d2374e178eaa13f41

SHA1
f6d422c3b02f82b4994b87d2e300fe4cc9ee0965

SHA256
2e502b90b64db6c1b97b1d7b607d692354f6ef29cf55dd047ce58ae6ab5c1af5

SHA512
486093c413e85ce5d026ca58923bf691b08d0f89ae70f4e7bb8f46fedc8247941e587e4151d659941568c8776d5f17645e4fc69dacdc8757ad025ace0510eaa3

Download Submit
C:\Users\Admin\AppData\Local\Temp\Admin.bmp

Filesize
2.5MB

MD5
f90403afe16fa9727c11066786acd4cb

SHA1
960c17bd9bd5f3320c2270565afeb71960b70e2e

SHA256
40440c3ccd75ca726af229f652b258dea4771e114c67922164014040a93d1fa9

SHA512
9a98149b9d0e725ec2c990158249c42064484c022390dfd337d3876a164e6c4031b1cd58d8df0057a9af1d60aa0e13147380115090b536fe7c411dd4456adab4

Download Submit
C:\Users\Admin\AppData\Local\Temp\Admin.bmp

Filesize
2.5MB

MD5
06285fd4f95c9474f9d325b53df1f060

SHA1
48fb8e82f1c99a0aeb7325108b3951be4fbcf877

SHA256
a1b0c27ba359c39e3eb3bf000e9ec81fc3f510b8f22d8b8464e348d08188e70e

SHA512
16407fad1dffe6866028e1ec8d0793065417fabf67c8e8d74b79af0da474d607a97daaae22b3a8e2a3dd8277b776f3a23502d3b28de4f5bbd46df7cd06002032

Download Submit
C:\Users\Admin\AppData\Local\Temp\Admin.bmp

Filesize
4.2MB

MD5
0b924fa349c6588e55b82ac81d0c6da6

SHA1
a0627ecb3cb86e64980ea71273cfbeef2a3663be

SHA256
7a2818dd98fa9aa238fa93249552ce6eafc6b9ff41d1fb1b2c2027d7cd073607

SHA512
924d4c0ee74cfd2b100f322eb5d607b76d0b36e74b2cb04cb55f4224ecf745d4ee01d77c4b26633eaae209182071f19b212ff7b38ed8e578852ea2a38d0e3307

Download Submit
C:\Users\Admin\AppData\Local\Temp\Admin.bmp

Filesize
4.2MB

MD5
8e549923d64cb2282cb7689c49ab76d6

SHA1
e34aed4addd22c0852c7e254fa3033a05ddc2a40

SHA256
152372ad3036d0e1b2660e23b17d60ebc63abd0ac4e02158fb3ef70b0d3eb55f

SHA512
d03525a371c4eef98ba5beb02327f2bd1af87dffb0bcd519013db84c751a59a2ae627c8d27477b9459b1a5850eed9ea842f21ce4470c4a0d6f34b6cd6281be15

Download Submit
C:\Users\Admin\AppData\Local\Temp\Admin.bmp

Filesize
5.9MB

MD5
0af155846a1ff4077144ea58c1c20bac

SHA1
7d47bc32d78c093244d9b9be524e160e3cbab6b2

SHA256
91c5b815e82acffebf480c01911f10077f458e59d398f27326e3747951c0a1b0

SHA512
277be7853a633194c550e18f27e84c7e79a4a0230b8ab2134e738569b0a9722cd309d167068e3542a8d13339cf1a3c3102c22dbd8aa45d88d7078feaa59bb597

Download Submit
C:\Users\Admin\AppData\Local\Temp\Admin.bmp

Filesize
5.9MB

MD5
27b10061927f1ac67be175500cbf022b

SHA1
9bc96e5860cb2d873d452a2f695470e3bfe2c60b

SHA256
bd8f8440bb185939b5791d22e72fa5bd37df16c12dff731a0dbf648da08e6471

SHA512
eea6e7cd20d9e54ff3537e7d7221d4174cfed70fd46865da14b4b7d93dbba83ba71307d88764e39be4f7d75863f35eebd3319a3ff02f9e18cd461cf7778f2612

Download Submit
C:\Users\Admin\AppData\Local\Temp\avscan.exe

Filesize
852KB

MD5
7adc32fd85163555aa84ccad497596e6

SHA1
0df52a5e4d50d8406c5e3f354fb483b6da1ec4a9

SHA256
96bafb9fb01c638c301f77f5c51accf9e3b5ebea1a5b1e5e709b5a63d31f81af

SHA512
f365ef408a9ed1b2b336b0fc277078f12157bcea1193f89bd7865f93042a0170f1b51f34f00d131a65b250e83875230df21c315a6561e7a08f8737599b5d4453

Download Submit
C:\Users\Admin\AppData\Local\Temp\avscan.exe

Filesize
852KB

MD5
7adc32fd85163555aa84ccad497596e6

SHA1
0df52a5e4d50d8406c5e3f354fb483b6da1ec4a9

SHA256
96bafb9fb01c638c301f77f5c51accf9e3b5ebea1a5b1e5e709b5a63d31f81af

SHA512
f365ef408a9ed1b2b336b0fc277078f12157bcea1193f89bd7865f93042a0170f1b51f34f00d131a65b250e83875230df21c315a6561e7a08f8737599b5d4453

Download Submit
C:\Users\Admin\AppData\Local\Temp\avscan.exe

Filesize
852KB

MD5
7adc32fd85163555aa84ccad497596e6

SHA1
0df52a5e4d50d8406c5e3f354fb483b6da1ec4a9

SHA256
96bafb9fb01c638c301f77f5c51accf9e3b5ebea1a5b1e5e709b5a63d31f81af

SHA512
f365ef408a9ed1b2b336b0fc277078f12157bcea1193f89bd7865f93042a0170f1b51f34f00d131a65b250e83875230df21c315a6561e7a08f8737599b5d4453

Download Submit
C:\Users\Admin\AppData\Local\Temp\avscan.exe

Filesize
852KB

MD5
7adc32fd85163555aa84ccad497596e6

SHA1
0df52a5e4d50d8406c5e3f354fb483b6da1ec4a9

SHA256
96bafb9fb01c638c301f77f5c51accf9e3b5ebea1a5b1e5e709b5a63d31f81af

SHA512
f365ef408a9ed1b2b336b0fc277078f12157bcea1193f89bd7865f93042a0170f1b51f34f00d131a65b250e83875230df21c315a6561e7a08f8737599b5d4453

Download Submit
C:\Windows\W_X_C.vbs

Filesize
195B

MD5
6d7a78ec09068987a6bec39d91fa2997

SHA1
e74ad929b10ad126cab230e0ea5ec239cbeaf12b

SHA256
d87abc4daf79735e1afda9ba17e27ca3e8c8775af50c18e67579da6384da53c6

SHA512
e912df74b128cb69c204fe6395f2237f7b2f240642312a66ff4e89004ac7736125155078e47591b26e686ec4f09d25bc4cf1575cc590bffe587962c02fa8e395

Download Submit
C:\Windows\hosts.exe

Filesize
852KB

MD5
d785f10271b2d4d9c1fbb06cca6fe483

SHA1
a492145bb7b60b23922f59d206e45c117d68c0b6

SHA256
623d55cc7f4bc3ce87cf6132e4cf59993436e9e62445cbf411a15e84dfe1939e

SHA512
bde308e73416d052e3586bf4013faf587643e813d0185bce5c53c04dd733f88acf56f7da7919cbc0a2f829f19e851f3c3bd7088bd607ab525308dedb99a86fa8

Download Submit
C:\Windows\hosts.exe

Filesize
852KB

MD5
7adc32fd85163555aa84ccad497596e6

SHA1
0df52a5e4d50d8406c5e3f354fb483b6da1ec4a9

SHA256
96bafb9fb01c638c301f77f5c51accf9e3b5ebea1a5b1e5e709b5a63d31f81af

SHA512
f365ef408a9ed1b2b336b0fc277078f12157bcea1193f89bd7865f93042a0170f1b51f34f00d131a65b250e83875230df21c315a6561e7a08f8737599b5d4453

Download Submit
C:\Windows\hosts.exe

Filesize
852KB

MD5
d785f10271b2d4d9c1fbb06cca6fe483

SHA1
a492145bb7b60b23922f59d206e45c117d68c0b6

SHA256
623d55cc7f4bc3ce87cf6132e4cf59993436e9e62445cbf411a15e84dfe1939e

SHA512
bde308e73416d052e3586bf4013faf587643e813d0185bce5c53c04dd733f88acf56f7da7919cbc0a2f829f19e851f3c3bd7088bd607ab525308dedb99a86fa8

Download Submit
C:\Windows\hosts.exe

Filesize
852KB

MD5
d785f10271b2d4d9c1fbb06cca6fe483

SHA1
a492145bb7b60b23922f59d206e45c117d68c0b6

SHA256
623d55cc7f4bc3ce87cf6132e4cf59993436e9e62445cbf411a15e84dfe1939e

SHA512
bde308e73416d052e3586bf4013faf587643e813d0185bce5c53c04dd733f88acf56f7da7919cbc0a2f829f19e851f3c3bd7088bd607ab525308dedb99a86fa8

Download Submit
C:\windows\hosts.exe

Filesize
852KB

MD5
d785f10271b2d4d9c1fbb06cca6fe483

SHA1
a492145bb7b60b23922f59d206e45c117d68c0b6

SHA256
623d55cc7f4bc3ce87cf6132e4cf59993436e9e62445cbf411a15e84dfe1939e

SHA512
bde308e73416d052e3586bf4013faf587643e813d0185bce5c53c04dd733f88acf56f7da7919cbc0a2f829f19e851f3c3bd7088bd607ab525308dedb99a86fa8

Download Submit
\??\c:\windows\W_X_C.bat

Filesize
336B

MD5
4db9f8b6175722b62ececeeeba1ce307

SHA1
3b3ba8414706e72a6fa19e884a97b87609e11e47

SHA256
d2150b9e5a4ce55e140f0ca91c4e300715d42095c8fddf58c77037cdd2cfaf78

SHA512
1d6dc274cf7a3dd704f840e6a5ad57ab4c4e35d5f09489aeff520bb797e1c825bac53fc335156fe41e767a46520d031855fe42fe7b175409ebe5e9e986fb9b8b

Download Submit
\Users\Admin\AppData\Local\Temp\avscan.exe

Filesize
852KB

MD5
7adc32fd85163555aa84ccad497596e6

SHA1
0df52a5e4d50d8406c5e3f354fb483b6da1ec4a9

SHA256
96bafb9fb01c638c301f77f5c51accf9e3b5ebea1a5b1e5e709b5a63d31f81af

SHA512
f365ef408a9ed1b2b336b0fc277078f12157bcea1193f89bd7865f93042a0170f1b51f34f00d131a65b250e83875230df21c315a6561e7a08f8737599b5d4453

Download Submit
\Users\Admin\AppData\Local\Temp\avscan.exe

Filesize
852KB

MD5
7adc32fd85163555aa84ccad497596e6

SHA1
0df52a5e4d50d8406c5e3f354fb483b6da1ec4a9

SHA256
96bafb9fb01c638c301f77f5c51accf9e3b5ebea1a5b1e5e709b5a63d31f81af

SHA512
f365ef408a9ed1b2b336b0fc277078f12157bcea1193f89bd7865f93042a0170f1b51f34f00d131a65b250e83875230df21c315a6561e7a08f8737599b5d4453

Download Submit
\Users\Admin\AppData\Local\Temp\avscan.exe

Filesize
852KB

MD5
7adc32fd85163555aa84ccad497596e6

SHA1
0df52a5e4d50d8406c5e3f354fb483b6da1ec4a9

SHA256
96bafb9fb01c638c301f77f5c51accf9e3b5ebea1a5b1e5e709b5a63d31f81af

SHA512
f365ef408a9ed1b2b336b0fc277078f12157bcea1193f89bd7865f93042a0170f1b51f34f00d131a65b250e83875230df21c315a6561e7a08f8737599b5d4453

Download Submit
\Users\Admin\AppData\Local\Temp\avscan.exe

Filesize
852KB

MD5
7adc32fd85163555aa84ccad497596e6

SHA1
0df52a5e4d50d8406c5e3f354fb483b6da1ec4a9

SHA256
96bafb9fb01c638c301f77f5c51accf9e3b5ebea1a5b1e5e709b5a63d31f81af

SHA512
f365ef408a9ed1b2b336b0fc277078f12157bcea1193f89bd7865f93042a0170f1b51f34f00d131a65b250e83875230df21c315a6561e7a08f8737599b5d4453

Download Submit
\Users\Admin\AppData\Local\Temp\avscan.exe

Filesize
852KB

MD5
7adc32fd85163555aa84ccad497596e6

SHA1
0df52a5e4d50d8406c5e3f354fb483b6da1ec4a9

SHA256
96bafb9fb01c638c301f77f5c51accf9e3b5ebea1a5b1e5e709b5a63d31f81af

SHA512
f365ef408a9ed1b2b336b0fc277078f12157bcea1193f89bd7865f93042a0170f1b51f34f00d131a65b250e83875230df21c315a6561e7a08f8737599b5d4453

Download Submit
memory/956-58-0x0000000074541000-0x0000000074543000-memory.dmp

Filesize
8KB

Download
memory/956-56-0x0000000075B61000-0x0000000075B63000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads