5749aacb875ebfba59bf45743ac5cc98a186590956d22c9e8c58c9029791b761

Analysis

max time kernel
126s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
05/12/2022, 21:58

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

5749aacb875ebfba59bf45743ac5cc98a186590956d22c9e8c58c9029791b761.exe
Size

779KB
MD5

5c8e07e7725e48c3c5b5b335f3f0e510
SHA1

c0f6c5240c811b6142d6f15fa3575e14fd671ab4
SHA256

5749aacb875ebfba59bf45743ac5cc98a186590956d22c9e8c58c9029791b761
SHA512

c2e173592e17a139e284cd7529d19e3f8293403dc6e9a050f82db07d676fc6ee7895cbfd245d1ac7d4da9c1a1e339530c27267fea2cd0aa41526cc9be3f856b1
SSDEEP

12288:g72bnI+kL72bnI+kDO472bnI+kL72bnI+kDOaj:g72z072z3472z072z3k

Score

10^/10

evasion persistence

Malware Config

Signatures

Modifies visibility of file extensions in Explorer 2 TTPs 3 IoCs

evasion

Hidden Files and Directories

T1158

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	5749aacb875ebfba59bf45743ac5cc98a186590956d22c9e8c58c9029791b761.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	avscan.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	hosts.exe

Modifies visiblity of hidden/system files in Explorer 2 TTPs 3 IoCs

evasion

Hidden Files and Directories

T1158

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	5749aacb875ebfba59bf45743ac5cc98a186590956d22c9e8c58c9029791b761.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	avscan.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	hosts.exe

Adds policy Run key to start application 2 TTPs 6 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\IYMUGYHL = "W_X_C.bat"	WScript.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	WScript.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\IYMUGYHL = "W_X_C.bat"	WScript.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	WScript.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\IYMUGYHL = "W_X_C.bat"	WScript.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	WScript.exe

Executes dropped EXE 6 IoCs

pid	Process
3772	avscan.exe
4896	avscan.exe
3804	hosts.exe
4140	hosts.exe
4136	avscan.exe
2364	hosts.exe

Checks computer location settings 2 TTPs 3 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation	cmd.exe
Key value queried	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation	cmd.exe
Key value queried	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation	cmd.exe

Adds Run key to start application 2 TTPs 6 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\avscan = "C:\\Users\\Admin\\AppData\\Local\\Temp\\avscan.exe"	5749aacb875ebfba59bf45743ac5cc98a186590956d22c9e8c58c9029791b761.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run	avscan.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\avscan = "C:\\Users\\Admin\\AppData\\Local\\Temp\\avscan.exe"	avscan.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run	hosts.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\avscan = "C:\\Users\\Admin\\AppData\\Local\\Temp\\avscan.exe"	hosts.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run	5749aacb875ebfba59bf45743ac5cc98a186590956d22c9e8c58c9029791b761.exe

Drops file in Windows directory 5 IoCs

description	ioc	Process
File opened for modification	C:\Windows\hosts.exe	5749aacb875ebfba59bf45743ac5cc98a186590956d22c9e8c58c9029791b761.exe
File opened for modification	C:\Windows\hosts.exe	avscan.exe
File opened for modification	C:\Windows\hosts.exe	hosts.exe
File created	C:\windows\W_X_C.vbs	5749aacb875ebfba59bf45743ac5cc98a186590956d22c9e8c58c9029791b761.exe
File created	\??\c:\windows\W_X_C.bat	5749aacb875ebfba59bf45743ac5cc98a186590956d22c9e8c58c9029791b761.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies registry class 4 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\Local Settings	5749aacb875ebfba59bf45743ac5cc98a186590956d22c9e8c58c9029791b761.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\Local Settings	cmd.exe

Modifies registry key 1 TTPs 9 IoCs

Modify Registry

T1112

pid	Process
544	REG.exe
2028	REG.exe
4132	REG.exe
4368	REG.exe
3668	REG.exe
2976	REG.exe
2304	REG.exe
4060	REG.exe
2164	REG.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

pid	Process
3772	avscan.exe
4140	hosts.exe

Suspicious use of SetWindowsHookEx 7 IoCs

pid	Process
1376	5749aacb875ebfba59bf45743ac5cc98a186590956d22c9e8c58c9029791b761.exe
3772	avscan.exe
4896	avscan.exe
3804	hosts.exe
4140	hosts.exe
4136	avscan.exe
2364	hosts.exe

Suspicious use of WriteProcessMemory 63 IoCs

description	pid	Process	procid_target
PID 1376 wrote to memory of 2164	1376	5749aacb875ebfba59bf45743ac5cc98a186590956d22c9e8c58c9029791b761.exe	81
PID 1376 wrote to memory of 2164	1376	5749aacb875ebfba59bf45743ac5cc98a186590956d22c9e8c58c9029791b761.exe	81
PID 1376 wrote to memory of 2164	1376	5749aacb875ebfba59bf45743ac5cc98a186590956d22c9e8c58c9029791b761.exe	81
PID 1376 wrote to memory of 3772	1376	5749aacb875ebfba59bf45743ac5cc98a186590956d22c9e8c58c9029791b761.exe	83
PID 1376 wrote to memory of 3772	1376	5749aacb875ebfba59bf45743ac5cc98a186590956d22c9e8c58c9029791b761.exe	83
PID 1376 wrote to memory of 3772	1376	5749aacb875ebfba59bf45743ac5cc98a186590956d22c9e8c58c9029791b761.exe	83
PID 3772 wrote to memory of 4896	3772	avscan.exe	84
PID 3772 wrote to memory of 4896	3772	avscan.exe	84
PID 3772 wrote to memory of 4896	3772	avscan.exe	84
PID 3772 wrote to memory of 3084	3772	avscan.exe	85
PID 3772 wrote to memory of 3084	3772	avscan.exe	85
PID 3772 wrote to memory of 3084	3772	avscan.exe	85
PID 1376 wrote to memory of 3892	1376	5749aacb875ebfba59bf45743ac5cc98a186590956d22c9e8c58c9029791b761.exe	87
PID 1376 wrote to memory of 3892	1376	5749aacb875ebfba59bf45743ac5cc98a186590956d22c9e8c58c9029791b761.exe	87
PID 1376 wrote to memory of 3892	1376	5749aacb875ebfba59bf45743ac5cc98a186590956d22c9e8c58c9029791b761.exe	87
PID 3892 wrote to memory of 3804	3892	cmd.exe	90
PID 3892 wrote to memory of 3804	3892	cmd.exe	90
PID 3892 wrote to memory of 3804	3892	cmd.exe	90
PID 3084 wrote to memory of 4140	3084	cmd.exe	89
PID 3084 wrote to memory of 4140	3084	cmd.exe	89
PID 3084 wrote to memory of 4140	3084	cmd.exe	89
PID 4140 wrote to memory of 4136	4140	hosts.exe	92
PID 4140 wrote to memory of 4136	4140	hosts.exe	92
PID 4140 wrote to memory of 4136	4140	hosts.exe	92
PID 4140 wrote to memory of 4336	4140	hosts.exe	93
PID 4140 wrote to memory of 4336	4140	hosts.exe	93
PID 4140 wrote to memory of 4336	4140	hosts.exe	93
PID 3084 wrote to memory of 1272	3084	cmd.exe	97
PID 3084 wrote to memory of 1272	3084	cmd.exe	97
PID 3084 wrote to memory of 1272	3084	cmd.exe	97
PID 3892 wrote to memory of 2552	3892	cmd.exe	96
PID 3892 wrote to memory of 2552	3892	cmd.exe	96
PID 3892 wrote to memory of 2552	3892	cmd.exe	96
PID 4336 wrote to memory of 2364	4336	cmd.exe	95
PID 4336 wrote to memory of 2364	4336	cmd.exe	95
PID 4336 wrote to memory of 2364	4336	cmd.exe	95
PID 4336 wrote to memory of 4276	4336	cmd.exe	98
PID 4336 wrote to memory of 4276	4336	cmd.exe	98
PID 4336 wrote to memory of 4276	4336	cmd.exe	98
PID 3772 wrote to memory of 2028	3772	avscan.exe	106
PID 3772 wrote to memory of 2028	3772	avscan.exe	106
PID 3772 wrote to memory of 2028	3772	avscan.exe	106
PID 4140 wrote to memory of 4132	4140	hosts.exe	108
PID 4140 wrote to memory of 4132	4140	hosts.exe	108
PID 4140 wrote to memory of 4132	4140	hosts.exe	108
PID 3772 wrote to memory of 4368	3772	avscan.exe	110
PID 3772 wrote to memory of 4368	3772	avscan.exe	110
PID 3772 wrote to memory of 4368	3772	avscan.exe	110
PID 4140 wrote to memory of 3668	4140	hosts.exe	112
PID 4140 wrote to memory of 3668	4140	hosts.exe	112
PID 4140 wrote to memory of 3668	4140	hosts.exe	112
PID 3772 wrote to memory of 544	3772	avscan.exe	114
PID 3772 wrote to memory of 544	3772	avscan.exe	114
PID 3772 wrote to memory of 544	3772	avscan.exe	114
PID 4140 wrote to memory of 2976	4140	hosts.exe	116
PID 4140 wrote to memory of 2976	4140	hosts.exe	116
PID 4140 wrote to memory of 2976	4140	hosts.exe	116
PID 3772 wrote to memory of 2304	3772	avscan.exe	118
PID 3772 wrote to memory of 2304	3772	avscan.exe	118
PID 3772 wrote to memory of 2304	3772	avscan.exe	118
PID 4140 wrote to memory of 4060	4140	hosts.exe	120
PID 4140 wrote to memory of 4060	4140	hosts.exe	120
PID 4140 wrote to memory of 4060	4140	hosts.exe	120

C:\Users\Admin\AppData\Local\Temp\5749aacb875ebfba59bf45743ac5cc98a186590956d22c9e8c58c9029791b761.exe
"C:\Users\Admin\AppData\Local\Temp\5749aacb875ebfba59bf45743ac5cc98a186590956d22c9e8c58c9029791b761.exe"
1⤵
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- Adds Run key to start application
- Drops file in Windows directory
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1376
- C:\Windows\SysWOW64\REG.exe
  REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
  2⤵
  - Modifies registry key
  PID:2164
- C:\Users\Admin\AppData\Local\Temp\avscan.exe
  C:\Users\Admin\AppData\Local\Temp\avscan.exe
  2⤵
  - Modifies visibility of file extensions in Explorer
  - Modifies visiblity of hidden/system files in Explorer
  - Executes dropped EXE
  - Adds Run key to start application
  - Drops file in Windows directory
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3772
- - C:\Users\Admin\AppData\Local\Temp\avscan.exe
    C:\Users\Admin\AppData\Local\Temp\avscan.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:4896
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c c:\windows\W_X_C.bat
    3⤵
    - Checks computer location settings
    - Modifies registry class
    - Suspicious use of WriteProcessMemory
    PID:3084
  - - C:\windows\hosts.exe
      C:\windows\hosts.exe
      4⤵
      Modifies visibility of file extensions in Explorer
      Modifies visiblity of hidden/system files in Explorer
      Executes dropped EXE
      Adds Run key to start application
      Drops file in Windows directory
      Suspicious behavior: GetForegroundWindowSpam
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:4140
    - - C:\Users\Admin\AppData\Local\Temp\avscan.exe
        
        C:\Users\Admin\AppData\Local\Temp\avscan.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4136
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c c:\windows\W_X_C.bat
        5⤵
        Checks computer location settings
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4336
      - C:\windows\hosts.exe
        
        C:\windows\hosts.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2364
      - C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Windows\W_X_C.vbs"
        6⤵
        Adds policy Run key to start application
        
        PID:4276
    - - C:\Windows\SysWOW64\REG.exe
        
        REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
        5⤵
        Modifies registry key
        
        PID:4132
    - - C:\Windows\SysWOW64\REG.exe
        
        REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
        5⤵
        Modifies registry key
        
        PID:3668
    - - C:\Windows\SysWOW64\REG.exe
        
        REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
        5⤵
        Modifies registry key
        
        PID:2976
    - - C:\Windows\SysWOW64\REG.exe
        
        REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
        5⤵
        Modifies registry key
        
        PID:4060
  - - C:\Windows\SysWOW64\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Windows\W_X_C.vbs"
      4⤵
      Adds policy Run key to start application
      PID:1272
- - C:\Windows\SysWOW64\REG.exe
    REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
    3⤵
    - Modifies registry key
    PID:2028
- - C:\Windows\SysWOW64\REG.exe
    REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
    3⤵
    - Modifies registry key
    PID:4368
- - C:\Windows\SysWOW64\REG.exe
    REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
    3⤵
    - Modifies registry key
    PID:544
- - C:\Windows\SysWOW64\REG.exe
    REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
    3⤵
    - Modifies registry key
    PID:2304
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c c:\windows\W_X_C.bat
  2⤵
  - Checks computer location settings
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:3892
- - C:\windows\hosts.exe
    C:\windows\hosts.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:3804
- - C:\Windows\SysWOW64\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Windows\W_X_C.vbs"
    3⤵
    - Adds policy Run key to start application
    PID:2552

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:1976

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Hidden Files and Directories

T1158

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Hidden Files and Directories

T1158

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\avscan.exe

Filesize
779KB

MD5
88e6640ca497b75e27cf6015dd41692e

SHA1
f2708ddc45f2906b56c004fe1fe39cda4731ed7f

SHA256
993df807529f1c797830305ba2a83b32fc3f42f585467cbeec570c5bc29bed5a

SHA512
176279d279e9794ae4ce02daf0c82a512b892eeb24f97c56dd23b7c90982009f6b0dccbedf73b023be2a475518d25ed5306acf0160de6c22a086f06816f2dd7a

Download Submit
C:\Users\Admin\AppData\Local\Temp\avscan.exe

Filesize
779KB

MD5
88e6640ca497b75e27cf6015dd41692e

SHA1
f2708ddc45f2906b56c004fe1fe39cda4731ed7f

SHA256
993df807529f1c797830305ba2a83b32fc3f42f585467cbeec570c5bc29bed5a

SHA512
176279d279e9794ae4ce02daf0c82a512b892eeb24f97c56dd23b7c90982009f6b0dccbedf73b023be2a475518d25ed5306acf0160de6c22a086f06816f2dd7a

Download Submit
C:\Users\Admin\AppData\Local\Temp\avscan.exe

Filesize
779KB

MD5
88e6640ca497b75e27cf6015dd41692e

SHA1
f2708ddc45f2906b56c004fe1fe39cda4731ed7f

SHA256
993df807529f1c797830305ba2a83b32fc3f42f585467cbeec570c5bc29bed5a

SHA512
176279d279e9794ae4ce02daf0c82a512b892eeb24f97c56dd23b7c90982009f6b0dccbedf73b023be2a475518d25ed5306acf0160de6c22a086f06816f2dd7a

Download Submit
C:\Users\Admin\AppData\Local\Temp\avscan.exe

Filesize
779KB

MD5
88e6640ca497b75e27cf6015dd41692e

SHA1
f2708ddc45f2906b56c004fe1fe39cda4731ed7f

SHA256
993df807529f1c797830305ba2a83b32fc3f42f585467cbeec570c5bc29bed5a

SHA512
176279d279e9794ae4ce02daf0c82a512b892eeb24f97c56dd23b7c90982009f6b0dccbedf73b023be2a475518d25ed5306acf0160de6c22a086f06816f2dd7a

Download Submit
C:\Windows\W_X_C.vbs

Filesize
195B

MD5
0e0483d4802632100b6bfe8bc2e5d661

SHA1
767e0deb7dcaa7676004e6053957c36cecfeeefa

SHA256
81bbebb8d0e77ffffbc7b7d24afdcdce4089f4b04d1a12284eda861c25e03f9f

SHA512
8279b0559ca30a0adc6c8614870c3e445866c20f0617a7153cab41982b451dfe9ea44478f37b884465235714623ef26a56f5ea3d1cb81767487c494d3703ab29

Download Submit
C:\Windows\hosts.exe

Filesize
779KB

MD5
95b02503d63375fec31ba4e38d75a2cc

SHA1
3df73cb4c3a137e86d0ecca92a43ee22b6f26df5

SHA256
23ead9af9f8949e9abb82ffa731a2b823aef029b4556187c1de53d7fd46e9290

SHA512
29b68b29d4ec3ab466d27d0761cfba3c29e3de732398cbc506b8615764cf92e6c1100af817891f216ec2099733d3530fb043cb4f08a4b6206bc565a2e528c8e6

Download Submit
C:\Windows\hosts.exe

Filesize
779KB

MD5
95b02503d63375fec31ba4e38d75a2cc

SHA1
3df73cb4c3a137e86d0ecca92a43ee22b6f26df5

SHA256
23ead9af9f8949e9abb82ffa731a2b823aef029b4556187c1de53d7fd46e9290

SHA512
29b68b29d4ec3ab466d27d0761cfba3c29e3de732398cbc506b8615764cf92e6c1100af817891f216ec2099733d3530fb043cb4f08a4b6206bc565a2e528c8e6

Download Submit
C:\Windows\hosts.exe

Filesize
779KB

MD5
95b02503d63375fec31ba4e38d75a2cc

SHA1
3df73cb4c3a137e86d0ecca92a43ee22b6f26df5

SHA256
23ead9af9f8949e9abb82ffa731a2b823aef029b4556187c1de53d7fd46e9290

SHA512
29b68b29d4ec3ab466d27d0761cfba3c29e3de732398cbc506b8615764cf92e6c1100af817891f216ec2099733d3530fb043cb4f08a4b6206bc565a2e528c8e6

Download Submit
C:\Windows\hosts.exe

Filesize
779KB

MD5
95b02503d63375fec31ba4e38d75a2cc

SHA1
3df73cb4c3a137e86d0ecca92a43ee22b6f26df5

SHA256
23ead9af9f8949e9abb82ffa731a2b823aef029b4556187c1de53d7fd46e9290

SHA512
29b68b29d4ec3ab466d27d0761cfba3c29e3de732398cbc506b8615764cf92e6c1100af817891f216ec2099733d3530fb043cb4f08a4b6206bc565a2e528c8e6

Download Submit
C:\windows\hosts.exe

Filesize
779KB

MD5
95b02503d63375fec31ba4e38d75a2cc

SHA1
3df73cb4c3a137e86d0ecca92a43ee22b6f26df5

SHA256
23ead9af9f8949e9abb82ffa731a2b823aef029b4556187c1de53d7fd46e9290

SHA512
29b68b29d4ec3ab466d27d0761cfba3c29e3de732398cbc506b8615764cf92e6c1100af817891f216ec2099733d3530fb043cb4f08a4b6206bc565a2e528c8e6

Download Submit
\??\c:\windows\W_X_C.bat

Filesize
336B

MD5
4db9f8b6175722b62ececeeeba1ce307

SHA1
3b3ba8414706e72a6fa19e884a97b87609e11e47

SHA256
d2150b9e5a4ce55e140f0ca91c4e300715d42095c8fddf58c77037cdd2cfaf78

SHA512
1d6dc274cf7a3dd704f840e6a5ad57ab4c4e35d5f09489aeff520bb797e1c825bac53fc335156fe41e767a46520d031855fe42fe7b175409ebe5e9e986fb9b8b

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads