c1da29ce2cfa6e74ae682affb4e91b5d147c5b31edabf5cbb5248ecb5c50b9e4

Analysis

max time kernel
190s
max time network
210s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
05/12/2022, 21:55

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c1da29ce2cfa6e74ae682affb4e91b5d147c5b31edabf5cbb5248ecb5c50b9e4.exe
Size

852KB
MD5

e331cdb066e98f0cbff4990f29e73c2d
SHA1

3457b3edc567271a2a87367349a168fa1fcde1be
SHA256

c1da29ce2cfa6e74ae682affb4e91b5d147c5b31edabf5cbb5248ecb5c50b9e4
SHA512

09a76247885d8850e4e3db07a16862e03ad177e24adccc141adabed504d6158a84a2df3b2db610bd82f8075912afcf824d87e504d31e53905e562aed7abce38f
SSDEEP

12288:g72bnI+w8GNA72bnI+w8GNPg72bnI+w8GNA72bnI+w8GNPbo:g72zd72zsg72zd72zsbo

Score

10^/10

evasion persistence

Malware Config

Signatures

Modifies visibility of file extensions in Explorer 2 TTPs 3 IoCs

evasion

Hidden Files and Directories

T1158

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	c1da29ce2cfa6e74ae682affb4e91b5d147c5b31edabf5cbb5248ecb5c50b9e4.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	avscan.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	hosts.exe

Modifies visiblity of hidden/system files in Explorer 2 TTPs 3 IoCs

evasion

Hidden Files and Directories

T1158

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	avscan.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	hosts.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	c1da29ce2cfa6e74ae682affb4e91b5d147c5b31edabf5cbb5248ecb5c50b9e4.exe

Adds policy Run key to start application 2 TTPs 6 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	WScript.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	WScript.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\SOCAAGDT = "W_X_C.bat"	WScript.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\SOCAAGDT = "W_X_C.bat"	WScript.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\SOCAAGDT = "W_X_C.bat"	WScript.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	WScript.exe

Executes dropped EXE 6 IoCs

pid	Process
3476	avscan.exe
3884	avscan.exe
3988	hosts.exe
2168	hosts.exe
1824	avscan.exe
2096	hosts.exe

Checks computer location settings 2 TTPs 3 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\Control Panel\International\Geo\Nation	cmd.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\Control Panel\International\Geo\Nation	cmd.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\Control Panel\International\Geo\Nation	cmd.exe

Adds Run key to start application 2 TTPs 6 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run	hosts.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\avscan = "C:\\Users\\Admin\\AppData\\Local\\Temp\\avscan.exe"	hosts.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run	c1da29ce2cfa6e74ae682affb4e91b5d147c5b31edabf5cbb5248ecb5c50b9e4.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\avscan = "C:\\Users\\Admin\\AppData\\Local\\Temp\\avscan.exe"	c1da29ce2cfa6e74ae682affb4e91b5d147c5b31edabf5cbb5248ecb5c50b9e4.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run	avscan.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\avscan = "C:\\Users\\Admin\\AppData\\Local\\Temp\\avscan.exe"	avscan.exe

Drops file in Windows directory 5 IoCs

description	ioc	Process
File created	C:\windows\W_X_C.vbs	c1da29ce2cfa6e74ae682affb4e91b5d147c5b31edabf5cbb5248ecb5c50b9e4.exe
File created	\??\c:\windows\W_X_C.bat	c1da29ce2cfa6e74ae682affb4e91b5d147c5b31edabf5cbb5248ecb5c50b9e4.exe
File opened for modification	C:\Windows\hosts.exe	c1da29ce2cfa6e74ae682affb4e91b5d147c5b31edabf5cbb5248ecb5c50b9e4.exe
File opened for modification	C:\Windows\hosts.exe	avscan.exe
File opened for modification	C:\Windows\hosts.exe	hosts.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies registry class 4 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000_Classes\Local Settings	c1da29ce2cfa6e74ae682affb4e91b5d147c5b31edabf5cbb5248ecb5c50b9e4.exe
Key created	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000_Classes\Local Settings	cmd.exe

Modifies registry key 1 TTPs 7 IoCs

Modify Registry

T1112

pid	Process
408	REG.exe
3240	REG.exe
456	REG.exe
3720	REG.exe
1584	REG.exe
2860	REG.exe
3228	REG.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

pid	Process
3476	avscan.exe
3988	hosts.exe

Suspicious use of SetWindowsHookEx 7 IoCs

pid	Process
2020	c1da29ce2cfa6e74ae682affb4e91b5d147c5b31edabf5cbb5248ecb5c50b9e4.exe
3476	avscan.exe
3884	avscan.exe
3988	hosts.exe
2168	hosts.exe
1824	avscan.exe
2096	hosts.exe

Suspicious use of WriteProcessMemory 57 IoCs

description	pid	Process	procid_target
PID 2020 wrote to memory of 3720	2020	c1da29ce2cfa6e74ae682affb4e91b5d147c5b31edabf5cbb5248ecb5c50b9e4.exe	85
PID 2020 wrote to memory of 3720	2020	c1da29ce2cfa6e74ae682affb4e91b5d147c5b31edabf5cbb5248ecb5c50b9e4.exe	85
PID 2020 wrote to memory of 3720	2020	c1da29ce2cfa6e74ae682affb4e91b5d147c5b31edabf5cbb5248ecb5c50b9e4.exe	85
PID 2020 wrote to memory of 3476	2020	c1da29ce2cfa6e74ae682affb4e91b5d147c5b31edabf5cbb5248ecb5c50b9e4.exe	88
PID 2020 wrote to memory of 3476	2020	c1da29ce2cfa6e74ae682affb4e91b5d147c5b31edabf5cbb5248ecb5c50b9e4.exe	88
PID 2020 wrote to memory of 3476	2020	c1da29ce2cfa6e74ae682affb4e91b5d147c5b31edabf5cbb5248ecb5c50b9e4.exe	88
PID 3476 wrote to memory of 3884	3476	avscan.exe	89
PID 3476 wrote to memory of 3884	3476	avscan.exe	89
PID 3476 wrote to memory of 3884	3476	avscan.exe	89
PID 3476 wrote to memory of 3932	3476	avscan.exe	90
PID 3476 wrote to memory of 3932	3476	avscan.exe	90
PID 3476 wrote to memory of 3932	3476	avscan.exe	90
PID 2020 wrote to memory of 3132	2020	c1da29ce2cfa6e74ae682affb4e91b5d147c5b31edabf5cbb5248ecb5c50b9e4.exe	93
PID 2020 wrote to memory of 3132	2020	c1da29ce2cfa6e74ae682affb4e91b5d147c5b31edabf5cbb5248ecb5c50b9e4.exe	93
PID 2020 wrote to memory of 3132	2020	c1da29ce2cfa6e74ae682affb4e91b5d147c5b31edabf5cbb5248ecb5c50b9e4.exe	93
PID 3932 wrote to memory of 2168	3932	cmd.exe	94
PID 3932 wrote to memory of 2168	3932	cmd.exe	94
PID 3932 wrote to memory of 2168	3932	cmd.exe	94
PID 3132 wrote to memory of 3988	3132	cmd.exe	95
PID 3132 wrote to memory of 3988	3132	cmd.exe	95
PID 3132 wrote to memory of 3988	3132	cmd.exe	95
PID 3988 wrote to memory of 1824	3988	hosts.exe	96
PID 3988 wrote to memory of 1824	3988	hosts.exe	96
PID 3988 wrote to memory of 1824	3988	hosts.exe	96
PID 3988 wrote to memory of 4620	3988	hosts.exe	97
PID 3988 wrote to memory of 4620	3988	hosts.exe	97
PID 3988 wrote to memory of 4620	3988	hosts.exe	97
PID 4620 wrote to memory of 2096	4620	cmd.exe	99
PID 4620 wrote to memory of 2096	4620	cmd.exe	99
PID 4620 wrote to memory of 2096	4620	cmd.exe	99
PID 4620 wrote to memory of 4648	4620	cmd.exe	104
PID 4620 wrote to memory of 4648	4620	cmd.exe	104
PID 4620 wrote to memory of 4648	4620	cmd.exe	104
PID 3132 wrote to memory of 4296	3132	cmd.exe	103
PID 3132 wrote to memory of 4296	3132	cmd.exe	103
PID 3132 wrote to memory of 4296	3132	cmd.exe	103
PID 3932 wrote to memory of 2292	3932	cmd.exe	102
PID 3932 wrote to memory of 2292	3932	cmd.exe	102
PID 3932 wrote to memory of 2292	3932	cmd.exe	102
PID 3476 wrote to memory of 1584	3476	avscan.exe	105
PID 3476 wrote to memory of 1584	3476	avscan.exe	105
PID 3476 wrote to memory of 1584	3476	avscan.exe	105
PID 3988 wrote to memory of 2860	3988	hosts.exe	107
PID 3988 wrote to memory of 2860	3988	hosts.exe	107
PID 3988 wrote to memory of 2860	3988	hosts.exe	107
PID 3476 wrote to memory of 3228	3476	avscan.exe	112
PID 3476 wrote to memory of 3228	3476	avscan.exe	112
PID 3476 wrote to memory of 3228	3476	avscan.exe	112
PID 3988 wrote to memory of 408	3988	hosts.exe	114
PID 3988 wrote to memory of 408	3988	hosts.exe	114
PID 3988 wrote to memory of 408	3988	hosts.exe	114
PID 3476 wrote to memory of 3240	3476	avscan.exe	121
PID 3476 wrote to memory of 3240	3476	avscan.exe	121
PID 3476 wrote to memory of 3240	3476	avscan.exe	121
PID 3988 wrote to memory of 456	3988	hosts.exe	123
PID 3988 wrote to memory of 456	3988	hosts.exe	123
PID 3988 wrote to memory of 456	3988	hosts.exe	123

C:\Users\Admin\AppData\Local\Temp\c1da29ce2cfa6e74ae682affb4e91b5d147c5b31edabf5cbb5248ecb5c50b9e4.exe
"C:\Users\Admin\AppData\Local\Temp\c1da29ce2cfa6e74ae682affb4e91b5d147c5b31edabf5cbb5248ecb5c50b9e4.exe"
1⤵
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- Adds Run key to start application
- Drops file in Windows directory
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2020
- C:\Windows\SysWOW64\REG.exe
  REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
  2⤵
  - Modifies registry key
  PID:3720
- C:\Users\Admin\AppData\Local\Temp\avscan.exe
  C:\Users\Admin\AppData\Local\Temp\avscan.exe
  2⤵
  - Modifies visibility of file extensions in Explorer
  - Modifies visiblity of hidden/system files in Explorer
  - Executes dropped EXE
  - Adds Run key to start application
  - Drops file in Windows directory
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3476
- - C:\Users\Admin\AppData\Local\Temp\avscan.exe
    C:\Users\Admin\AppData\Local\Temp\avscan.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:3884
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c c:\windows\W_X_C.bat
    3⤵
    - Checks computer location settings
    - Modifies registry class
    - Suspicious use of WriteProcessMemory
    PID:3932
  - - C:\windows\hosts.exe
      C:\windows\hosts.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2168
  - - C:\Windows\SysWOW64\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Windows\W_X_C.vbs"
      4⤵
      Adds policy Run key to start application
      PID:2292
- - C:\Windows\SysWOW64\REG.exe
    REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
    3⤵
    - Modifies registry key
    PID:1584
- - C:\Windows\SysWOW64\REG.exe
    REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
    3⤵
    - Modifies registry key
    PID:3228
- - C:\Windows\SysWOW64\REG.exe
    REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
    3⤵
    - Modifies registry key
    PID:3240
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c c:\windows\W_X_C.bat
  2⤵
  - Checks computer location settings
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:3132
- - C:\windows\hosts.exe
    C:\windows\hosts.exe
    3⤵
    - Modifies visibility of file extensions in Explorer
    - Modifies visiblity of hidden/system files in Explorer
    - Executes dropped EXE
    - Adds Run key to start application
    - Drops file in Windows directory
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:3988
  - - C:\Users\Admin\AppData\Local\Temp\avscan.exe
      C:\Users\Admin\AppData\Local\Temp\avscan.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1824
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c c:\windows\W_X_C.bat
      4⤵
      Checks computer location settings
      Modifies registry class
      Suspicious use of WriteProcessMemory
      PID:4620
    - - C:\windows\hosts.exe
        
        C:\windows\hosts.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2096
    - - C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Windows\W_X_C.vbs"
        5⤵
        Adds policy Run key to start application
        
        PID:4648
  - - C:\Windows\SysWOW64\REG.exe
      REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
      4⤵
      Modifies registry key
      PID:2860
  - - C:\Windows\SysWOW64\REG.exe
      REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
      4⤵
      Modifies registry key
      PID:408
  - - C:\Windows\SysWOW64\REG.exe
      REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
      4⤵
      Modifies registry key
      PID:456
- - C:\Windows\SysWOW64\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Windows\W_X_C.vbs"
    3⤵
    - Adds policy Run key to start application
    PID:4296

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:3212

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Hidden Files and Directories

T1158

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Hidden Files and Directories

T1158

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\avscan.exe

Filesize
852KB

MD5
332f11c2474a6dbbc008245396eed463

SHA1
524cbfe0e406d0303a65bcee7e0869da3c6dab3e

SHA256
9a938ad93f27b8bcdeef507a39fb70fd83e75e3dbffeb3c446f0a379c47e35ac

SHA512
da705228fd608676b75bbe61fc70f8e41627fd0250ae9ee07e8c5fbdc2fee05bbda5a711b4c7c6cc503aa4fc797db1badf3bd3fe327ca6571a013948f5855efa

Download Submit
C:\Users\Admin\AppData\Local\Temp\avscan.exe

Filesize
852KB

MD5
332f11c2474a6dbbc008245396eed463

SHA1
524cbfe0e406d0303a65bcee7e0869da3c6dab3e

SHA256
9a938ad93f27b8bcdeef507a39fb70fd83e75e3dbffeb3c446f0a379c47e35ac

SHA512
da705228fd608676b75bbe61fc70f8e41627fd0250ae9ee07e8c5fbdc2fee05bbda5a711b4c7c6cc503aa4fc797db1badf3bd3fe327ca6571a013948f5855efa

Download Submit
C:\Users\Admin\AppData\Local\Temp\avscan.exe

Filesize
852KB

MD5
332f11c2474a6dbbc008245396eed463

SHA1
524cbfe0e406d0303a65bcee7e0869da3c6dab3e

SHA256
9a938ad93f27b8bcdeef507a39fb70fd83e75e3dbffeb3c446f0a379c47e35ac

SHA512
da705228fd608676b75bbe61fc70f8e41627fd0250ae9ee07e8c5fbdc2fee05bbda5a711b4c7c6cc503aa4fc797db1badf3bd3fe327ca6571a013948f5855efa

Download Submit
C:\Users\Admin\AppData\Local\Temp\avscan.exe

Filesize
852KB

MD5
332f11c2474a6dbbc008245396eed463

SHA1
524cbfe0e406d0303a65bcee7e0869da3c6dab3e

SHA256
9a938ad93f27b8bcdeef507a39fb70fd83e75e3dbffeb3c446f0a379c47e35ac

SHA512
da705228fd608676b75bbe61fc70f8e41627fd0250ae9ee07e8c5fbdc2fee05bbda5a711b4c7c6cc503aa4fc797db1badf3bd3fe327ca6571a013948f5855efa

Download Submit
C:\Windows\W_X_C.vbs

Filesize
195B

MD5
b53e5ef6d903f57c7c038b3d3d3db0cb

SHA1
57f5ec8ae3c79e86657ca29d4463ee475becf39b

SHA256
a04a3493a1c2d3d58fc9180512aed93cff63f94c2202f1ce9d62c1c7d82b8d0a

SHA512
603af007038ea2416d7616c38cf020d985f0498955e37c8270fd1b0c4fafa70b1e7c927a5d21d659717e2a6382bb7038711c6bf7a8b9ce1e1d2a9a3cf4a955cf

Download Submit
C:\Windows\hosts.exe

Filesize
852KB

MD5
ec94394865c69e5a2d3e54bbcdcf7346

SHA1
4c3cfe67ce5c400b6bfc09a5f059614e0c010bd8

SHA256
551e67664e5beb6d10408911617d926e119e61ea76f24f52320ded886ee80f21

SHA512
21397eb46d77e83e465d65b43e28c1fe7020f9cbd09bfceeb9fe5aa3161e889931ca92d1ee2c4c256a6a9dd45f5ad80e3af9598b77197301d28843350ee1eaaf

Download Submit
C:\Windows\hosts.exe

Filesize
852KB

MD5
ec94394865c69e5a2d3e54bbcdcf7346

SHA1
4c3cfe67ce5c400b6bfc09a5f059614e0c010bd8

SHA256
551e67664e5beb6d10408911617d926e119e61ea76f24f52320ded886ee80f21

SHA512
21397eb46d77e83e465d65b43e28c1fe7020f9cbd09bfceeb9fe5aa3161e889931ca92d1ee2c4c256a6a9dd45f5ad80e3af9598b77197301d28843350ee1eaaf

Download Submit
C:\Windows\hosts.exe

Filesize
852KB

MD5
ec94394865c69e5a2d3e54bbcdcf7346

SHA1
4c3cfe67ce5c400b6bfc09a5f059614e0c010bd8

SHA256
551e67664e5beb6d10408911617d926e119e61ea76f24f52320ded886ee80f21

SHA512
21397eb46d77e83e465d65b43e28c1fe7020f9cbd09bfceeb9fe5aa3161e889931ca92d1ee2c4c256a6a9dd45f5ad80e3af9598b77197301d28843350ee1eaaf

Download Submit
C:\Windows\hosts.exe

Filesize
852KB

MD5
ec94394865c69e5a2d3e54bbcdcf7346

SHA1
4c3cfe67ce5c400b6bfc09a5f059614e0c010bd8

SHA256
551e67664e5beb6d10408911617d926e119e61ea76f24f52320ded886ee80f21

SHA512
21397eb46d77e83e465d65b43e28c1fe7020f9cbd09bfceeb9fe5aa3161e889931ca92d1ee2c4c256a6a9dd45f5ad80e3af9598b77197301d28843350ee1eaaf

Download Submit
C:\windows\hosts.exe

Filesize
852KB

MD5
ec94394865c69e5a2d3e54bbcdcf7346

SHA1
4c3cfe67ce5c400b6bfc09a5f059614e0c010bd8

SHA256
551e67664e5beb6d10408911617d926e119e61ea76f24f52320ded886ee80f21

SHA512
21397eb46d77e83e465d65b43e28c1fe7020f9cbd09bfceeb9fe5aa3161e889931ca92d1ee2c4c256a6a9dd45f5ad80e3af9598b77197301d28843350ee1eaaf

Download Submit
\??\c:\windows\W_X_C.bat

Filesize
336B

MD5
4db9f8b6175722b62ececeeeba1ce307

SHA1
3b3ba8414706e72a6fa19e884a97b87609e11e47

SHA256
d2150b9e5a4ce55e140f0ca91c4e300715d42095c8fddf58c77037cdd2cfaf78

SHA512
1d6dc274cf7a3dd704f840e6a5ad57ab4c4e35d5f09489aeff520bb797e1c825bac53fc335156fe41e767a46520d031855fe42fe7b175409ebe5e9e986fb9b8b

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads