99fcfa72a4c12834c344d89a1db6a708e356cd0bf7d80fec62e7113c84ebead7

Resubmissions

15/06/2026, 01:28

260615-bv4kasgv4x

10/06/2026, 07:32

21/04/2026, 03:57

26/02/2026, 11:07

20/10/2025, 19:02

23/02/2024, 14:33

Analysis

max time kernel
117s
max time network
121s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
23/02/2024, 14:33

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
1- Hosts blocker/EaseUS hosts blocker.bat
Size 3KB
Sample240223-rw7aksbb35
SHA256 0124f42ac03a8f0ccacb35cf2e57d8ce96a323d66fbe4ebe06ad1def2e4d3b20
MD5 a20bef352c605997b09e2da7bca1f16e
SHA1 732df89434737131afb0ebaa94bbdafee76181af
SHA512 4951e502b532506c7071ca014f2e08fb60731c877ce07af4903433074f710ccce8887e39efb2f5ef7456b206947f3457fc16405c9a4048d53470b7d0c4d620d5
MD5 SHA1 SHA512

Score

8^/10

discovery

Malware Config

Signatures

Drops file in Drivers directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\drivers\etc\hosts	attrib.exe
File opened for modification	C:\Windows\system32\drivers\etc\hosts	cmd.exe

Modifies file permissions 1 TTPs 1 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
3000	icacls.exe

Gathers network information 2 TTPs 1 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
2424	ipconfig.exe

Suspicious use of WriteProcessMemory 63 IoCs

description	pid	Process	procid_target
PID 3036 wrote to memory of 1164	3036	cmd.exe	29
PID 3036 wrote to memory of 1164	3036	cmd.exe	29
PID 3036 wrote to memory of 1164	3036	cmd.exe	29
PID 3036 wrote to memory of 3000	3036	cmd.exe	30
PID 3036 wrote to memory of 3000	3036	cmd.exe	30
PID 3036 wrote to memory of 3000	3036	cmd.exe	30
PID 3036 wrote to memory of 2912	3036	cmd.exe	31
PID 3036 wrote to memory of 2912	3036	cmd.exe	31
PID 3036 wrote to memory of 2912	3036	cmd.exe	31
PID 3036 wrote to memory of 2988	3036	cmd.exe	32
PID 3036 wrote to memory of 2988	3036	cmd.exe	32
PID 3036 wrote to memory of 2988	3036	cmd.exe	32
PID 3036 wrote to memory of 2516	3036	cmd.exe	33
PID 3036 wrote to memory of 2516	3036	cmd.exe	33
PID 3036 wrote to memory of 2516	3036	cmd.exe	33
PID 3036 wrote to memory of 2104	3036	cmd.exe	34
PID 3036 wrote to memory of 2104	3036	cmd.exe	34
PID 3036 wrote to memory of 2104	3036	cmd.exe	34
PID 3036 wrote to memory of 2564	3036	cmd.exe	35
PID 3036 wrote to memory of 2564	3036	cmd.exe	35
PID 3036 wrote to memory of 2564	3036	cmd.exe	35
PID 3036 wrote to memory of 2624	3036	cmd.exe	36
PID 3036 wrote to memory of 2624	3036	cmd.exe	36
PID 3036 wrote to memory of 2624	3036	cmd.exe	36
PID 3036 wrote to memory of 2644	3036	cmd.exe	37
PID 3036 wrote to memory of 2644	3036	cmd.exe	37
PID 3036 wrote to memory of 2644	3036	cmd.exe	37
PID 3036 wrote to memory of 2848	3036	cmd.exe	38
PID 3036 wrote to memory of 2848	3036	cmd.exe	38
PID 3036 wrote to memory of 2848	3036	cmd.exe	38
PID 3036 wrote to memory of 2580	3036	cmd.exe	39
PID 3036 wrote to memory of 2580	3036	cmd.exe	39
PID 3036 wrote to memory of 2580	3036	cmd.exe	39
PID 3036 wrote to memory of 2840	3036	cmd.exe	40
PID 3036 wrote to memory of 2840	3036	cmd.exe	40
PID 3036 wrote to memory of 2840	3036	cmd.exe	40
PID 3036 wrote to memory of 2668	3036	cmd.exe	41
PID 3036 wrote to memory of 2668	3036	cmd.exe	41
PID 3036 wrote to memory of 2668	3036	cmd.exe	41
PID 3036 wrote to memory of 2288	3036	cmd.exe	42
PID 3036 wrote to memory of 2288	3036	cmd.exe	42
PID 3036 wrote to memory of 2288	3036	cmd.exe	42
PID 3036 wrote to memory of 2540	3036	cmd.exe	43
PID 3036 wrote to memory of 2540	3036	cmd.exe	43
PID 3036 wrote to memory of 2540	3036	cmd.exe	43
PID 3036 wrote to memory of 2460	3036	cmd.exe	44
PID 3036 wrote to memory of 2460	3036	cmd.exe	44
PID 3036 wrote to memory of 2460	3036	cmd.exe	44
PID 3036 wrote to memory of 2652	3036	cmd.exe	45
PID 3036 wrote to memory of 2652	3036	cmd.exe	45
PID 3036 wrote to memory of 2652	3036	cmd.exe	45
PID 3036 wrote to memory of 2600	3036	cmd.exe	46
PID 3036 wrote to memory of 2600	3036	cmd.exe	46
PID 3036 wrote to memory of 2600	3036	cmd.exe	46
PID 3036 wrote to memory of 2560	3036	cmd.exe	47
PID 3036 wrote to memory of 2560	3036	cmd.exe	47
PID 3036 wrote to memory of 2560	3036	cmd.exe	47
PID 3036 wrote to memory of 2472	3036	cmd.exe	48
PID 3036 wrote to memory of 2472	3036	cmd.exe	48
PID 3036 wrote to memory of 2472	3036	cmd.exe	48
PID 3036 wrote to memory of 2424	3036	cmd.exe	49
PID 3036 wrote to memory of 2424	3036	cmd.exe	49
PID 3036 wrote to memory of 2424	3036	cmd.exe	49

Views/modifies file attributes 1 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1564.001

pid	Process
2912	attrib.exe

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\1- Hosts blocker\EaseUS hosts blocker.bat"
1⤵
- Drops file in Drivers directory
- Suspicious use of WriteProcessMemory
PID:3036
- C:\Windows\system32\fltMC.exe
  fltmc
  2⤵
  PID:1164
- C:\Windows\system32\icacls.exe
  icacls "C:\Windows\System32\drivers\etc\hosts" /grant administrators:F
  2⤵
  - Modifies file permissions
  PID:3000
- C:\Windows\system32\attrib.exe
  attrib -h -r -s "C:\Windows\System32\drivers\etc\hosts"
  2⤵
  - Drops file in Drivers directory
  - Views/modifies file attributes
  PID:2912
- C:\Windows\system32\find.exe
  FIND /C /I "easeus.com" C:\Windows\system32\drivers\etc\hosts
  2⤵
  PID:2988
- C:\Windows\system32\find.exe
  FIND /C /I "www.easeus.com" C:\Windows\system32\drivers\etc\hosts
  2⤵
  PID:2516
- C:\Windows\system32\find.exe
  FIND /C /I "activation.easeus.com" C:\Windows\system32\drivers\etc\hosts
  2⤵
  PID:2104
- C:\Windows\system32\find.exe
  FIND /C /I "easeus.com.cn" C:\Windows\system32\drivers\etc\hosts
  2⤵
  PID:2564
- C:\Windows\system32\find.exe
  FIND /C /I "www.easeus.com.cn" C:\Windows\system32\drivers\etc\hosts
  2⤵
  PID:2624
- C:\Windows\system32\find.exe
  FIND /C /I "track.easeus.com" C:\Windows\system32\drivers\etc\hosts
  2⤵
  PID:2644
- C:\Windows\system32\find.exe
  FIND /C /I "track.easeus.com.cn" C:\Windows\system32\drivers\etc\hosts
  2⤵
  PID:2848
- C:\Windows\system32\find.exe
  FIND /C /I "api.easeus.com" C:\Windows\system32\drivers\etc\hosts
  2⤵
  PID:2580
- C:\Windows\system32\find.exe
  FIND /C /I "update.easeus.com" C:\Windows\system32\drivers\etc\hosts
  2⤵
  PID:2840
- C:\Windows\system32\find.exe
  FIND /C /I "map2.hwcdn.net" C:\Windows\system32\drivers\etc\hosts
  2⤵
  PID:2668
- C:\Windows\system32\find.exe
  FIND /C /I "easeusinfo.us-east-1.log.aliyuncs.com" C:\Windows\system32\drivers\etc\hosts
  2⤵
  PID:2288
- C:\Windows\system32\find.exe
  FIND /C /I "aaa100cd68bbe03f3.awsglobalaccelerator.com" C:\Windows\system32\drivers\etc\hosts
  2⤵
  PID:2540
- C:\Windows\system32\find.exe
  FIND /C /I "uompro.easeus.com" C:\Windows\system32\drivers\etc\hosts
  2⤵
  PID:2460
- C:\Windows\system32\find.exe
  FIND /C /I "order.easeus.com" C:\Windows\system32\drivers\etc\hosts
  2⤵
  PID:2652
- C:\Windows\system32\find.exe
  FIND /C /I "curl.haxx.se" C:\Windows\system32\drivers\etc\hosts
  2⤵
  PID:2600
- C:\Windows\system32\find.exe
  FIND /C /I "buy.easeus.com" C:\Windows\system32\drivers\etc\hosts
  2⤵
  PID:2560
- C:\Windows\system32\find.exe
  FIND /C /I "v2api-uoss.easeus.com" C:\Windows\system32\drivers\etc\hosts
  2⤵
  PID:2472
- C:\Windows\system32\ipconfig.exe
  ipconfig /flushdns
  2⤵
  - Gathers network information
  PID:2424

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

hosts

Path C:\Windows\system32\drivers\etc\hosts
Size 999B
SHA256 31fbac3ac012102c5aaea456c87612fb602a2a82d8e15f54ee80521496084157
MD5 985ff949ec21161d7d1b6545a66ef527
SHA1 f92682853d1bb930aac31aa716c74f03266c0c6a
SHA512 bc4a69e60a6559c135720a7f8c81e4f74d0b2d94b0e1e4226fc31358b3a98f052b0ca3f33f84f486513a7d5df0cb570c3f3ade1620ccdf42629b3f1155a97939
MD5 SHA1 SHA512

Submit Download

hosts

Path C:\Windows\system32\drivers\etc\hosts
Size 1KB
SHA256 9062c8d2ca10aa5f804f4c1642770140115970f436d525f553c6f4f36ab816b0
MD5 6430229ee7989daee4c0cb7c57a2f931
SHA1 333efeb8688514c7a34deefd798b152e7b75f68c
SHA512 2dd1e63e3478237a71b8ed6861fab56ade59b1f5fe4a05e98681a4f85558a1a0795b8546d734e12229047759ecd995b125a2527a83e38a1e415f9553947cd760
MD5 SHA1 SHA512

Submit Download

hosts

Path C:\Windows\system32\drivers\etc\hosts
Size 1KB
SHA256 9aaed2e99e5334429173703a4c0a4d1725b4e713f1a45a90123886b7181adfed
MD5 0e4a9adeb0f0fa47aeedcf493ca42134
SHA1 d341ac5f73c0746eadfcac405e32f05a4ed9e52c
SHA512 f72601abe4b64f70cb263350501c402b278fe5e43d1172fe37c26fe301e3224666eb7a8177b1f1bb3f7906c0f59f392409df8477f85890f4e01b3eec62689d2b
MD5 SHA1 SHA512

Submit Download

hosts

Path C:\Windows\system32\drivers\etc\hosts
Size 1KB
SHA256 de67e72203d3678d16cda2750910c40795de76892f4323df85c2418b8b6e9f8c
MD5 b68960ab49f95f66732dd47c67261d5b
SHA1 956e0a714ce8ab5679c3825097ca78dc5645ccc5
SHA512 5beb2347a3a1940bc19273e49b70e2377acebcb3d9ca3bd4303614f32a3cceac877885a388e9c8c89ce8012c8d2d4394d85afa2354cfa6b700469c6aff200b00
MD5 SHA1 SHA512

Submit Download

hosts

Path C:\Windows\system32\drivers\etc\hosts
Size 1KB
SHA256 f4bcb05c0e041632eafe30387f4a051ef213a7d0f66bd6a7240bbe473b13bfe0
MD5 c5afe95d01c8960320c75a50f0f8d23e
SHA1 28f5dd5abd9773c7399ca99629e2c3c9976f0971
SHA512 452459a23984c67a2b3a2efe71b226499518fe07b82a7144507731cef55800ceaa63e7eb906bfe7dce1548f4fc9eb7d4611910fc61d8c76723035d74d1642649
MD5 SHA1 SHA512

Submit Download

hosts

Path C:\Windows\system32\drivers\etc\hosts
Size 1KB
SHA256 e847b6391eb0838dd76e83a45ae44248a43f8ef995cd27d7eb920674ab0b34df
MD5 57d6c020bfe8a146005515424b6b4bb2
SHA1 2d4c5824ec2ed5cc8ea5ee6c425f9d7b35267f90
SHA512 a232dae7694db351fb8cdde913863c4e113e142725f4342445eaab5982c89b769e08cf73a484f9c2f6d4394f18380963620978d7294cb68e1d6783eb149c7354
MD5 SHA1 SHA512

Submit Download

hosts

Path C:\Windows\system32\drivers\etc\hosts
Size 1KB
SHA256 77711bd54c2d8b84453e55d37aa724581aaac0982202eddbeb86eeb2895da79a
MD5 04fdbd4fa5a5db1c0ca5b99d1024e019
SHA1 4b2160fed143fa38d9ff97e209745fddfb389105
SHA512 7933bdcc62a9c2b14f3150f3974391c4e7961b34f49141f5905369ccaa97d1c16059431249031abaf5f7773b49fad67762c9c7351a8127434ae88b5884df48ec
MD5 SHA1 SHA512

Submit Download

hosts

Path C:\Windows\system32\drivers\etc\hosts
Size 1KB
SHA256 10253d3abdd28cc6fc6d1dda893e8a9215104736ec217229c931c07254170f32
MD5 8767fa532b73b43fa990807dc231e4e0
SHA1 19f8940082c1f3b7a0c18ad39694405158f7034f
SHA512 cae530f3751e9278768de8cfdee788af7fbc691603b0b4219f4c5e2a10dab8264391db2cf5659181acda7ac5ebf79e8ecb77be00e03a5a6d0a10ffcbb7d81bfc
MD5 SHA1 SHA512

Submit Download

hosts

Path C:\Windows\system32\drivers\etc\hosts
Size 1KB
SHA256 24bef2aefa3dafa54cd6a5ea4a4bcb8dfc4f13379be12c2fba06928125bf5865
MD5 9ae969e86d872155dcc7bd938a753eaf
SHA1 aab4036401a489bde71e86bf21aa126e2c78a9c7
SHA512 5e90199ea93404523bf11bda20530874146d4f76f26907927214903091a7abc652a76b6ce7cf7114241db1b6f376824aca6a78d3402f552979e769509508339c
MD5 SHA1 SHA512

Submit Download

hosts

Path C:\Windows\system32\drivers\etc\hosts
Size 1KB
SHA256 928ac0ffb61bba3d6dddaa070926ff1026805a6b4011173d519b629ff243f66d
MD5 9d286f65ad1878317fb87822ea2b73db
SHA1 b6150de238a357d236dee57cedfd45e9af74791b
SHA512 fffe823ef110c4b396a700843df401a6510f6379bf39b8e22f5f2b3be7b1389f530a4c70640c1c5d94d1536bc8dded16471b4b6b17894790b272617ee18b3a77
MD5 SHA1 SHA512

Submit Download

hosts

Path C:\Windows\system32\drivers\etc\hosts
Size 1KB
SHA256 17fca0ed0c1686b3b92ac1a4da0692c3fbf2ce8a8b99396c526e0eae0c18eb48
MD5 67ed5d09d6d70d5a3eceae6836909490
SHA1 5e6626090efc2622aae9fc959ea47cc32a8e6c84
SHA512 9e9849bd5210641dc5e46929b955115428c895fcaaa5d017e897d50cd3a97ab1bf4e77502bbd71597498588b75102aa1a13f7cca78a25609a46a08a1be19c30f
MD5 SHA1 SHA512

Submit Download

hosts

Path C:\Windows\system32\drivers\etc\hosts
Size 1KB
SHA256 5d6186b987472584099be763d66843c30f0fd2b824473d44c3efa30804b338d9
MD5 0db7fbe530295be36132d0c2ac464b09
SHA1 c0f2b61195aa3828f5bc8c85cc372123e243db50
SHA512 3f0dc33cd462b98adc1fb9a892abd21851a5c7743675a349bc286b204a0da29e3008d3c95f48f550dc5b8ece66b919a695bb64a349702cf0f94aeda89937d122
MD5 SHA1 SHA512

Submit Download

hosts

Path C:\Windows\system32\drivers\etc\hosts
Size 1KB
SHA256 dc395ded6b7d284fd3c4efe71c3906c9ac04d68eb9dfdd7a856b4549bbda26da
MD5 aff175b544323d8b1f8fb589f40313fc
SHA1 b62fc6585aa67bb214741a94e49e72a0fabc95ea
SHA512 cb473a99c76d669cc34fe68b3726eabff453068573288a0b0e371e755462275b519ccb35ddc0e14fe3b050e93e45ac9f1c05196b8e72350759c7b47c7238dae4
MD5 SHA1 SHA512

Submit Download

hosts

Path C:\Windows\system32\drivers\etc\hosts
Size 1KB
SHA256 693884f7ac3547db5636f43b4b394351db794ae6e54d483b7efe33eece315155
MD5 9699d1b0385a5031d4d311c3ed30f6c1
SHA1 d748b26ce2d559226bad6774395d222269ca0662
SHA512 88a0ccc4d4970e93707e9cd18807bc4ec3389f5bc69eb7a7835145fda890cad3fb47140d0718ff669ecd8af68f8fed065ca79504f6b061d08e02da181f78ee34
MD5 SHA1 SHA512

Submit Download

hosts

Path C:\Windows\system32\drivers\etc\hosts
Size 1KB
SHA256 367b932e565d71089e49c438dd58533b783bc9c2691ec68d8164e191db164ad4
MD5 c3936bc3e82d5affb2af09b0e543dfe0
SHA1 9aa1a30ff0710565342a2cbfa794ce52f50453ba
SHA512 313a1ee3dd7218df8ea468a204e456eb6796b81f3550aed41a176851d83035a4cb9d3bc90a94a3ea75e6dbe0ca2ce1329e54c84d4df43611b71c859553fe2d71
MD5 SHA1 SHA512

Submit Download

hosts

Path C:\Windows\system32\drivers\etc\hosts
Size 1KB
SHA256 0e35bc3cc4accedf48ba688ac0f511d9941d24137de61b1c1790ea05cf28f48d
MD5 b22f287fb2e46ea9dce4068029d67451
SHA1 c724902aeeae547a2931cc8c2b0eef4f5932840e
SHA512 8b429903159558e5112b4189055008edf80d5db89743706675ea9cc2bf44d1b78c4305a45c7a52d5b7fcbbf7a83092a3d3fd511bda02159dc138416091fda6fa
MD5 SHA1 SHA512

Submit Download

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads