8ab298f486811beabfc16f34829598ec701d27d42f22a499b4186d7402153219

Analysis

max time kernel
127s
max time network
45s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
05/12/2022, 21:57

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

8ab298f486811beabfc16f34829598ec701d27d42f22a499b4186d7402153219.exe
Size

348KB
MD5

3909ca20eaf5f8f23af553418c9cb400
SHA1

b5069e4181276460ce4f364a74c3030f7da15c9d
SHA256

8ab298f486811beabfc16f34829598ec701d27d42f22a499b4186d7402153219
SHA512

349f9dbed04845cad7246261f577edf00c7e4f4692b658cb46d598e0993cf71a588ac23ee870651f0dadff63cf770bd7b3eaaf6143cde292b581c5dd74f16e84
SSDEEP

6144:gDCwfG1bnxLE3faDCwfG1bnxLE3fbmaGc:g72bntEi72bntEzTGc

Score

10^/10

evasion persistence

Malware Config

Signatures

Modifies visibility of file extensions in Explorer 2 TTPs 3 IoCs

evasion

Hidden Files and Directories

T1158

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	8ab298f486811beabfc16f34829598ec701d27d42f22a499b4186d7402153219.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	avscan.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	hosts.exe

Modifies visiblity of hidden/system files in Explorer 2 TTPs 3 IoCs

evasion

Hidden Files and Directories

T1158

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	8ab298f486811beabfc16f34829598ec701d27d42f22a499b4186d7402153219.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	avscan.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	hosts.exe

Adds policy Run key to start application 2 TTPs 6 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	WScript.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\GRXNNIIE = "W_X_C.bat"	WScript.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	WScript.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\GRXNNIIE = "W_X_C.bat"	WScript.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	WScript.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\GRXNNIIE = "W_X_C.bat"	WScript.exe

Executes dropped EXE 6 IoCs

pid	Process
1204	avscan.exe
1984	avscan.exe
1744	hosts.exe
340	hosts.exe
824	avscan.exe
564	hosts.exe

Loads dropped DLL 5 IoCs

pid	Process
868	8ab298f486811beabfc16f34829598ec701d27d42f22a499b4186d7402153219.exe
868	8ab298f486811beabfc16f34829598ec701d27d42f22a499b4186d7402153219.exe
1204	avscan.exe
1744	hosts.exe
1744	hosts.exe

Adds Run key to start application 2 TTPs 6 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\avscan = "C:\\Users\\Admin\\AppData\\Local\\Temp\\avscan.exe"	8ab298f486811beabfc16f34829598ec701d27d42f22a499b4186d7402153219.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run	avscan.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\avscan = "C:\\Users\\Admin\\AppData\\Local\\Temp\\avscan.exe"	avscan.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run	hosts.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\avscan = "C:\\Users\\Admin\\AppData\\Local\\Temp\\avscan.exe"	hosts.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run	8ab298f486811beabfc16f34829598ec701d27d42f22a499b4186d7402153219.exe

Drops file in Windows directory 5 IoCs

description	ioc	Process
File opened for modification	C:\Windows\hosts.exe	8ab298f486811beabfc16f34829598ec701d27d42f22a499b4186d7402153219.exe
File opened for modification	C:\Windows\hosts.exe	avscan.exe
File opened for modification	C:\Windows\hosts.exe	hosts.exe
File created	C:\windows\W_X_C.vbs	8ab298f486811beabfc16f34829598ec701d27d42f22a499b4186d7402153219.exe
File created	\??\c:\windows\W_X_C.bat	8ab298f486811beabfc16f34829598ec701d27d42f22a499b4186d7402153219.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies registry key 1 TTPs 9 IoCs

Modify Registry

T1112

pid	Process
1732	REG.exe
1836	REG.exe
1492	REG.exe
1968	REG.exe
1604	REG.exe
1496	REG.exe
832	REG.exe
2032	REG.exe
1736	REG.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

pid	Process
1204	avscan.exe
1744	hosts.exe

Suspicious use of SetWindowsHookEx 7 IoCs

pid	Process
868	8ab298f486811beabfc16f34829598ec701d27d42f22a499b4186d7402153219.exe
1204	avscan.exe
1984	avscan.exe
1744	hosts.exe
340	hosts.exe
824	avscan.exe
564	hosts.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 868 wrote to memory of 1496	868	8ab298f486811beabfc16f34829598ec701d27d42f22a499b4186d7402153219.exe	27
PID 868 wrote to memory of 1496	868	8ab298f486811beabfc16f34829598ec701d27d42f22a499b4186d7402153219.exe	27
PID 868 wrote to memory of 1496	868	8ab298f486811beabfc16f34829598ec701d27d42f22a499b4186d7402153219.exe	27
PID 868 wrote to memory of 1496	868	8ab298f486811beabfc16f34829598ec701d27d42f22a499b4186d7402153219.exe	27
PID 868 wrote to memory of 1204	868	8ab298f486811beabfc16f34829598ec701d27d42f22a499b4186d7402153219.exe	29
PID 868 wrote to memory of 1204	868	8ab298f486811beabfc16f34829598ec701d27d42f22a499b4186d7402153219.exe	29
PID 868 wrote to memory of 1204	868	8ab298f486811beabfc16f34829598ec701d27d42f22a499b4186d7402153219.exe	29
PID 868 wrote to memory of 1204	868	8ab298f486811beabfc16f34829598ec701d27d42f22a499b4186d7402153219.exe	29
PID 1204 wrote to memory of 1984	1204	avscan.exe	30
PID 1204 wrote to memory of 1984	1204	avscan.exe	30
PID 1204 wrote to memory of 1984	1204	avscan.exe	30
PID 1204 wrote to memory of 1984	1204	avscan.exe	30
PID 1204 wrote to memory of 1096	1204	avscan.exe	31
PID 1204 wrote to memory of 1096	1204	avscan.exe	31
PID 1204 wrote to memory of 1096	1204	avscan.exe	31
PID 1204 wrote to memory of 1096	1204	avscan.exe	31
PID 868 wrote to memory of 1812	868	8ab298f486811beabfc16f34829598ec701d27d42f22a499b4186d7402153219.exe	32
PID 868 wrote to memory of 1812	868	8ab298f486811beabfc16f34829598ec701d27d42f22a499b4186d7402153219.exe	32
PID 868 wrote to memory of 1812	868	8ab298f486811beabfc16f34829598ec701d27d42f22a499b4186d7402153219.exe	32
PID 868 wrote to memory of 1812	868	8ab298f486811beabfc16f34829598ec701d27d42f22a499b4186d7402153219.exe	32
PID 1096 wrote to memory of 1744	1096	cmd.exe	36
PID 1096 wrote to memory of 1744	1096	cmd.exe	36
PID 1096 wrote to memory of 1744	1096	cmd.exe	36
PID 1096 wrote to memory of 1744	1096	cmd.exe	36
PID 1812 wrote to memory of 340	1812	cmd.exe	35
PID 1812 wrote to memory of 340	1812	cmd.exe	35
PID 1812 wrote to memory of 340	1812	cmd.exe	35
PID 1812 wrote to memory of 340	1812	cmd.exe	35
PID 1744 wrote to memory of 824	1744	hosts.exe	37
PID 1744 wrote to memory of 824	1744	hosts.exe	37
PID 1744 wrote to memory of 824	1744	hosts.exe	37
PID 1744 wrote to memory of 824	1744	hosts.exe	37
PID 1744 wrote to memory of 1768	1744	hosts.exe	40
PID 1744 wrote to memory of 1768	1744	hosts.exe	40
PID 1744 wrote to memory of 1768	1744	hosts.exe	40
PID 1744 wrote to memory of 1768	1744	hosts.exe	40
PID 1096 wrote to memory of 1060	1096	cmd.exe	39
PID 1096 wrote to memory of 1060	1096	cmd.exe	39
PID 1096 wrote to memory of 1060	1096	cmd.exe	39
PID 1096 wrote to memory of 1060	1096	cmd.exe	39
PID 1812 wrote to memory of 1556	1812	cmd.exe	38
PID 1812 wrote to memory of 1556	1812	cmd.exe	38
PID 1812 wrote to memory of 1556	1812	cmd.exe	38
PID 1812 wrote to memory of 1556	1812	cmd.exe	38
PID 1768 wrote to memory of 564	1768	cmd.exe	42
PID 1768 wrote to memory of 564	1768	cmd.exe	42
PID 1768 wrote to memory of 564	1768	cmd.exe	42
PID 1768 wrote to memory of 564	1768	cmd.exe	42
PID 1768 wrote to memory of 1140	1768	cmd.exe	43
PID 1768 wrote to memory of 1140	1768	cmd.exe	43
PID 1768 wrote to memory of 1140	1768	cmd.exe	43
PID 1768 wrote to memory of 1140	1768	cmd.exe	43
PID 1204 wrote to memory of 832	1204	avscan.exe	44
PID 1204 wrote to memory of 832	1204	avscan.exe	44
PID 1204 wrote to memory of 832	1204	avscan.exe	44
PID 1204 wrote to memory of 832	1204	avscan.exe	44
PID 1744 wrote to memory of 2032	1744	hosts.exe	46
PID 1744 wrote to memory of 2032	1744	hosts.exe	46
PID 1744 wrote to memory of 2032	1744	hosts.exe	46
PID 1744 wrote to memory of 2032	1744	hosts.exe	46
PID 1744 wrote to memory of 1732	1744	hosts.exe	48
PID 1744 wrote to memory of 1732	1744	hosts.exe	48
PID 1744 wrote to memory of 1732	1744	hosts.exe	48
PID 1744 wrote to memory of 1732	1744	hosts.exe	48

C:\Users\Admin\AppData\Local\Temp\8ab298f486811beabfc16f34829598ec701d27d42f22a499b4186d7402153219.exe
"C:\Users\Admin\AppData\Local\Temp\8ab298f486811beabfc16f34829598ec701d27d42f22a499b4186d7402153219.exe"
1⤵
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- Loads dropped DLL
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:868
- C:\Windows\SysWOW64\REG.exe
  REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
  2⤵
  - Modifies registry key
  PID:1496
- C:\Users\Admin\AppData\Local\Temp\avscan.exe
  C:\Users\Admin\AppData\Local\Temp\avscan.exe
  2⤵
  - Modifies visibility of file extensions in Explorer
  - Modifies visiblity of hidden/system files in Explorer
  - Executes dropped EXE
  - Loads dropped DLL
  - Adds Run key to start application
  - Drops file in Windows directory
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1204
- - C:\Users\Admin\AppData\Local\Temp\avscan.exe
    C:\Users\Admin\AppData\Local\Temp\avscan.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1984
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c c:\windows\W_X_C.bat
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1096
  - - C:\windows\hosts.exe
      C:\windows\hosts.exe
      4⤵
      Modifies visibility of file extensions in Explorer
      Modifies visiblity of hidden/system files in Explorer
      Executes dropped EXE
      Loads dropped DLL
      Adds Run key to start application
      Drops file in Windows directory
      Suspicious behavior: GetForegroundWindowSpam
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:1744
    - - C:\Users\Admin\AppData\Local\Temp\avscan.exe
        
        C:\Users\Admin\AppData\Local\Temp\avscan.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:824
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd /c c:\windows\W_X_C.bat
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:1768
      - C:\windows\hosts.exe
        
        C:\windows\hosts.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:564
      - C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Windows\W_X_C.vbs"
        6⤵
        Adds policy Run key to start application
        
        PID:1140
    - - C:\Windows\SysWOW64\REG.exe
        
        REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
        5⤵
        Modifies registry key
        
        PID:2032
    - - C:\Windows\SysWOW64\REG.exe
        
        REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
        5⤵
        Modifies registry key
        
        PID:1732
    - - C:\Windows\SysWOW64\REG.exe
        
        REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
        5⤵
        Modifies registry key
        
        PID:1968
    - - C:\Windows\SysWOW64\REG.exe
        
        REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
        5⤵
        Modifies registry key
        
        PID:1492
  - - C:\Windows\SysWOW64\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Windows\W_X_C.vbs"
      4⤵
      Adds policy Run key to start application
      PID:1060
- - C:\Windows\SysWOW64\REG.exe
    REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
    3⤵
    - Modifies registry key
    PID:832
- - C:\Windows\SysWOW64\REG.exe
    REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
    3⤵
    - Modifies registry key
    PID:1736
- - C:\Windows\SysWOW64\REG.exe
    REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
    3⤵
    - Modifies registry key
    PID:1836
- - C:\Windows\SysWOW64\REG.exe
    REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
    3⤵
    - Modifies registry key
    PID:1604
- C:\Windows\SysWOW64\cmd.exe
  cmd /c c:\windows\W_X_C.bat
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1812
- - C:\windows\hosts.exe
    C:\windows\hosts.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:340
- - C:\Windows\SysWOW64\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Windows\W_X_C.vbs"
    3⤵
    - Adds policy Run key to start application
    PID:1556

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Hidden Files and Directories

T1158

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Hidden Files and Directories

T1158

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Admin.bmp

Filesize
396KB

MD5
f90d1f4067eccda778dffe0fc313e260

SHA1
08c5e7db9f66caf3b7a347db8c854abf010202fa

SHA256
1a861953afb53caa2a2e92b573dadca7da03cf9491759f6444e785435976443b

SHA512
4c524f9bbef7b79d6ba7e6d92544ffb463526b4fe0a1363fc65ceb24f25d7390db2fa9bd75d452589ef0a0e740f27784b31369f2038addfcb1322e85896854ee

Download Submit
C:\Users\Admin\AppData\Local\Temp\Admin.bmp

Filesize
1.4MB

MD5
2c9c009af425ae6856d4c68c1b24dfc4

SHA1
5e671a2716ec8c1587ae8ea1c0e9d96ef2aa7e40

SHA256
fffcad66cc5c1f6bfdceafcd5485b7f00fe45fb5845fa5e63249158a02d0ff5b

SHA512
56a99771517e3040a602066ce5e679ccdcbb43fa28ff1d2c6d8269eb5a7de2e231f61a3a34ff7b9428d80b273d5dab32da935ec37770cd22e7462f11b97142a7

Download Submit
C:\Users\Admin\AppData\Local\Temp\Admin.bmp

Filesize
2.1MB

MD5
4a5fd898ab54ebb3d0de7bde11f394ba

SHA1
2f21082127d738a8e23c0da8a0d42afa8b0737a6

SHA256
e559161ebf56f434d7b4e63163225cd17c880ef5c27010142df3866b98f17024

SHA512
f1def2170e17c95c53bd2ed1bf958a194122b861982eff407dcd8fc19b0e5ab1b3f13e76c5276b8f95e07158cb35be305add0b127a145e58aaaa465a874beb61

Download Submit
C:\Users\Admin\AppData\Local\Temp\Admin.bmp

Filesize
2.1MB

MD5
b89068e055ed6552dfa55f8b2cf777bf

SHA1
45b14fed170d2227beaea4ef872887b2f414f44f

SHA256
9be2dcdcb51ef75a1eb93729491cfd34ad97a12012ef3c7fd296fdb63702e378

SHA512
2469e22fdb87037e2850318e6c9c648f4e645262ffb7e932ec696a9257f08192c9e64bbf5ca41563e74e348e2e210f8326892c3885dcf838ceffaeb0ea27de65

Download Submit
C:\Users\Admin\AppData\Local\Temp\Admin.bmp

Filesize
2.8MB

MD5
cda759b4bdf95c5f5b18f3fdf077203c

SHA1
66cf53cb0414daf3e371b2d8273ec297fdaea042

SHA256
bacb4666d765e4b34d046fb86fdc1c89628c8bbab568e5dbb600a45b7684d109

SHA512
1df801b8e3068ed48006a42ae91af6c38b0b5257d84a520c400aa4e5fc769f6611c0df43b274b68700be2652919b1132011e55295aabb3de73e2240f600a7014

Download Submit
C:\Users\Admin\AppData\Local\Temp\Admin.bmp

Filesize
2.8MB

MD5
cda759b4bdf95c5f5b18f3fdf077203c

SHA1
66cf53cb0414daf3e371b2d8273ec297fdaea042

SHA256
bacb4666d765e4b34d046fb86fdc1c89628c8bbab568e5dbb600a45b7684d109

SHA512
1df801b8e3068ed48006a42ae91af6c38b0b5257d84a520c400aa4e5fc769f6611c0df43b274b68700be2652919b1132011e55295aabb3de73e2240f600a7014

Download Submit
C:\Users\Admin\AppData\Local\Temp\avscan.exe

Filesize
348KB

MD5
f4f81adca030e540bd30b71d91afd857

SHA1
b15d024f2aab23899f1842787b90be20b36105ad

SHA256
86c39792d1e5a6021d022ba27e00ff553937a74bf932bdcadefa1886dfb1fbd7

SHA512
3c850b579d983f9819c49d96e09b8728dba296f2978c5924776601dba499be35824f625136ada23d610e1c8790995a2fba9f8dfc8cb8dfc9ee7f2b55cbede5df

Download Submit
C:\Users\Admin\AppData\Local\Temp\avscan.exe

Filesize
348KB

MD5
f4f81adca030e540bd30b71d91afd857

SHA1
b15d024f2aab23899f1842787b90be20b36105ad

SHA256
86c39792d1e5a6021d022ba27e00ff553937a74bf932bdcadefa1886dfb1fbd7

SHA512
3c850b579d983f9819c49d96e09b8728dba296f2978c5924776601dba499be35824f625136ada23d610e1c8790995a2fba9f8dfc8cb8dfc9ee7f2b55cbede5df

Download Submit
C:\Users\Admin\AppData\Local\Temp\avscan.exe

Filesize
348KB

MD5
f4f81adca030e540bd30b71d91afd857

SHA1
b15d024f2aab23899f1842787b90be20b36105ad

SHA256
86c39792d1e5a6021d022ba27e00ff553937a74bf932bdcadefa1886dfb1fbd7

SHA512
3c850b579d983f9819c49d96e09b8728dba296f2978c5924776601dba499be35824f625136ada23d610e1c8790995a2fba9f8dfc8cb8dfc9ee7f2b55cbede5df

Download Submit
C:\Users\Admin\AppData\Local\Temp\avscan.exe

Filesize
348KB

MD5
f4f81adca030e540bd30b71d91afd857

SHA1
b15d024f2aab23899f1842787b90be20b36105ad

SHA256
86c39792d1e5a6021d022ba27e00ff553937a74bf932bdcadefa1886dfb1fbd7

SHA512
3c850b579d983f9819c49d96e09b8728dba296f2978c5924776601dba499be35824f625136ada23d610e1c8790995a2fba9f8dfc8cb8dfc9ee7f2b55cbede5df

Download Submit
C:\Windows\W_X_C.vbs

Filesize
195B

MD5
9eb0c6074d8e54f7da6508b5f6809e78

SHA1
61f003a28c45377e9fc641a0dd1382e6931c11f0

SHA256
df6f01f8c7c5ad4b1e66d19309ad60f0189bc607d7a07c184d9d94abd29c3ee8

SHA512
f6db15038cf4312647c59574cf2352c132c36cd060293977427b719066e5519838c6fed059d3a1d4e3277b575d9132d29d150c45cebd8a3852e705f3297f6d08

Download Submit
C:\Windows\hosts.exe

Filesize
348KB

MD5
f4f81adca030e540bd30b71d91afd857

SHA1
b15d024f2aab23899f1842787b90be20b36105ad

SHA256
86c39792d1e5a6021d022ba27e00ff553937a74bf932bdcadefa1886dfb1fbd7

SHA512
3c850b579d983f9819c49d96e09b8728dba296f2978c5924776601dba499be35824f625136ada23d610e1c8790995a2fba9f8dfc8cb8dfc9ee7f2b55cbede5df

Download Submit
C:\Windows\hosts.exe

Filesize
348KB

MD5
696e285eec77df2d2f1835154b68ef16

SHA1
afbb6364c4d34382c7d236573c5bcdb69fac51b2

SHA256
5c295977743b26617a512011f678ba85e3f97312c9595b0023f5e56f0c70d58c

SHA512
3285aa102347c941315a54ca69846742d24a69eeda5ff85f0fb5e93971ba3845e5efe95fcda358d28698477643bd39e6631c4bf9bd799a4f83eb7ec5732aa077

Download Submit
C:\Windows\hosts.exe

Filesize
348KB

MD5
696e285eec77df2d2f1835154b68ef16

SHA1
afbb6364c4d34382c7d236573c5bcdb69fac51b2

SHA256
5c295977743b26617a512011f678ba85e3f97312c9595b0023f5e56f0c70d58c

SHA512
3285aa102347c941315a54ca69846742d24a69eeda5ff85f0fb5e93971ba3845e5efe95fcda358d28698477643bd39e6631c4bf9bd799a4f83eb7ec5732aa077

Download Submit
C:\Windows\hosts.exe

Filesize
348KB

MD5
696e285eec77df2d2f1835154b68ef16

SHA1
afbb6364c4d34382c7d236573c5bcdb69fac51b2

SHA256
5c295977743b26617a512011f678ba85e3f97312c9595b0023f5e56f0c70d58c

SHA512
3285aa102347c941315a54ca69846742d24a69eeda5ff85f0fb5e93971ba3845e5efe95fcda358d28698477643bd39e6631c4bf9bd799a4f83eb7ec5732aa077

Download Submit
C:\windows\hosts.exe

Filesize
348KB

MD5
696e285eec77df2d2f1835154b68ef16

SHA1
afbb6364c4d34382c7d236573c5bcdb69fac51b2

SHA256
5c295977743b26617a512011f678ba85e3f97312c9595b0023f5e56f0c70d58c

SHA512
3285aa102347c941315a54ca69846742d24a69eeda5ff85f0fb5e93971ba3845e5efe95fcda358d28698477643bd39e6631c4bf9bd799a4f83eb7ec5732aa077

Download Submit
\??\c:\windows\W_X_C.bat

Filesize
336B

MD5
4db9f8b6175722b62ececeeeba1ce307

SHA1
3b3ba8414706e72a6fa19e884a97b87609e11e47

SHA256
d2150b9e5a4ce55e140f0ca91c4e300715d42095c8fddf58c77037cdd2cfaf78

SHA512
1d6dc274cf7a3dd704f840e6a5ad57ab4c4e35d5f09489aeff520bb797e1c825bac53fc335156fe41e767a46520d031855fe42fe7b175409ebe5e9e986fb9b8b

Download Submit
\Users\Admin\AppData\Local\Temp\avscan.exe

Filesize
348KB

MD5
f4f81adca030e540bd30b71d91afd857

SHA1
b15d024f2aab23899f1842787b90be20b36105ad

SHA256
86c39792d1e5a6021d022ba27e00ff553937a74bf932bdcadefa1886dfb1fbd7

SHA512
3c850b579d983f9819c49d96e09b8728dba296f2978c5924776601dba499be35824f625136ada23d610e1c8790995a2fba9f8dfc8cb8dfc9ee7f2b55cbede5df

Download Submit
\Users\Admin\AppData\Local\Temp\avscan.exe

Filesize
348KB

MD5
f4f81adca030e540bd30b71d91afd857

SHA1
b15d024f2aab23899f1842787b90be20b36105ad

SHA256
86c39792d1e5a6021d022ba27e00ff553937a74bf932bdcadefa1886dfb1fbd7

SHA512
3c850b579d983f9819c49d96e09b8728dba296f2978c5924776601dba499be35824f625136ada23d610e1c8790995a2fba9f8dfc8cb8dfc9ee7f2b55cbede5df

Download Submit
\Users\Admin\AppData\Local\Temp\avscan.exe

Filesize
348KB

MD5
f4f81adca030e540bd30b71d91afd857

SHA1
b15d024f2aab23899f1842787b90be20b36105ad

SHA256
86c39792d1e5a6021d022ba27e00ff553937a74bf932bdcadefa1886dfb1fbd7

SHA512
3c850b579d983f9819c49d96e09b8728dba296f2978c5924776601dba499be35824f625136ada23d610e1c8790995a2fba9f8dfc8cb8dfc9ee7f2b55cbede5df

Download Submit
\Users\Admin\AppData\Local\Temp\avscan.exe

Filesize
348KB

MD5
f4f81adca030e540bd30b71d91afd857

SHA1
b15d024f2aab23899f1842787b90be20b36105ad

SHA256
86c39792d1e5a6021d022ba27e00ff553937a74bf932bdcadefa1886dfb1fbd7

SHA512
3c850b579d983f9819c49d96e09b8728dba296f2978c5924776601dba499be35824f625136ada23d610e1c8790995a2fba9f8dfc8cb8dfc9ee7f2b55cbede5df

Download Submit
\Users\Admin\AppData\Local\Temp\avscan.exe

Filesize
348KB

MD5
f4f81adca030e540bd30b71d91afd857

SHA1
b15d024f2aab23899f1842787b90be20b36105ad

SHA256
86c39792d1e5a6021d022ba27e00ff553937a74bf932bdcadefa1886dfb1fbd7

SHA512
3c850b579d983f9819c49d96e09b8728dba296f2978c5924776601dba499be35824f625136ada23d610e1c8790995a2fba9f8dfc8cb8dfc9ee7f2b55cbede5df

Download Submit
memory/868-56-0x0000000075131000-0x0000000075133000-memory.dmp

Filesize
8KB

Download
memory/868-58-0x0000000074211000-0x0000000074213000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads