Malware Analysis Report

2025-01-06 10:34

Sample ID 240601-etq5cshf4w
Target dde8d4ae8edc613152f11b263b7a00d74d15cc38a2a3c036466a135ee96f09b5
SHA256 dde8d4ae8edc613152f11b263b7a00d74d15cc38a2a3c036466a135ee96f09b5
Tags
evasion persistence
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

dde8d4ae8edc613152f11b263b7a00d74d15cc38a2a3c036466a135ee96f09b5

Threat Level: Known bad

The file dde8d4ae8edc613152f11b263b7a00d74d15cc38a2a3c036466a135ee96f09b5 was found to be: Known bad.

Malicious Activity Summary

evasion persistence

Modifies visibility of file extensions in Explorer

Modifies visiblity of hidden/system files in Explorer

Adds policy Run key to start application

Checks computer location settings

Loads dropped DLL

Executes dropped EXE

Adds Run key to start application

Drops file in Windows directory

Unsigned PE

Enumerates physical storage devices

Modifies registry class

Suspicious use of WriteProcessMemory

Suspicious use of SetWindowsHookEx

Modifies registry key

Suspicious behavior: GetForegroundWindowSpam

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-06-01 04:14

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-06-01 04:14

Reported

2024-06-01 04:16

Platform

win7-20240215-en

Max time kernel

121s

Max time network

118s

Command Line

"C:\Users\Admin\AppData\Local\Temp\dde8d4ae8edc613152f11b263b7a00d74d15cc38a2a3c036466a135ee96f09b5.exe"

Signatures

Modifies visibility of file extensions in Explorer

evasion
Description Indicator Process Target
Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" C:\Users\Admin\AppData\Local\Temp\dde8d4ae8edc613152f11b263b7a00d74d15cc38a2a3c036466a135ee96f09b5.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" C:\Users\Admin\AppData\Local\Temp\avscan.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" C:\windows\hosts.exe N/A

Modifies visiblity of hidden/system files in Explorer

evasion
Description Indicator Process Target
Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" C:\Users\Admin\AppData\Local\Temp\dde8d4ae8edc613152f11b263b7a00d74d15cc38a2a3c036466a135ee96f09b5.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" C:\Users\Admin\AppData\Local\Temp\avscan.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" C:\windows\hosts.exe N/A

Adds policy Run key to start application

persistence
Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run C:\Windows\SysWOW64\WScript.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\GHPZRGFC = "W_X_C.bat" C:\Windows\SysWOW64\WScript.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run C:\Windows\SysWOW64\WScript.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\GHPZRGFC = "W_X_C.bat" C:\Windows\SysWOW64\WScript.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run C:\Windows\SysWOW64\WScript.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\GHPZRGFC = "W_X_C.bat" C:\Windows\SysWOW64\WScript.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\avscan = "C:\\Users\\Admin\\AppData\\Local\\Temp\\avscan.exe" C:\Users\Admin\AppData\Local\Temp\dde8d4ae8edc613152f11b263b7a00d74d15cc38a2a3c036466a135ee96f09b5.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\avscan = "C:\\Users\\Admin\\AppData\\Local\\Temp\\avscan.exe" C:\Users\Admin\AppData\Local\Temp\avscan.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\avscan = "C:\\Users\\Admin\\AppData\\Local\\Temp\\avscan.exe" C:\windows\hosts.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File created C:\windows\W_X_C.vbs C:\Users\Admin\AppData\Local\Temp\dde8d4ae8edc613152f11b263b7a00d74d15cc38a2a3c036466a135ee96f09b5.exe N/A
File created \??\c:\windows\W_X_C.bat C:\Users\Admin\AppData\Local\Temp\dde8d4ae8edc613152f11b263b7a00d74d15cc38a2a3c036466a135ee96f09b5.exe N/A
File opened for modification C:\Windows\hosts.exe C:\Users\Admin\AppData\Local\Temp\dde8d4ae8edc613152f11b263b7a00d74d15cc38a2a3c036466a135ee96f09b5.exe N/A
File opened for modification C:\Windows\hosts.exe C:\Users\Admin\AppData\Local\Temp\avscan.exe N/A
File opened for modification C:\Windows\hosts.exe C:\windows\hosts.exe N/A

Enumerates physical storage devices

Suspicious behavior: GetForegroundWindowSpam

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\avscan.exe N/A
N/A N/A C:\windows\hosts.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 3028 wrote to memory of 3044 N/A C:\Users\Admin\AppData\Local\Temp\dde8d4ae8edc613152f11b263b7a00d74d15cc38a2a3c036466a135ee96f09b5.exe C:\Windows\SysWOW64\REG.exe
PID 3028 wrote to memory of 3044 N/A C:\Users\Admin\AppData\Local\Temp\dde8d4ae8edc613152f11b263b7a00d74d15cc38a2a3c036466a135ee96f09b5.exe C:\Windows\SysWOW64\REG.exe
PID 3028 wrote to memory of 3044 N/A C:\Users\Admin\AppData\Local\Temp\dde8d4ae8edc613152f11b263b7a00d74d15cc38a2a3c036466a135ee96f09b5.exe C:\Windows\SysWOW64\REG.exe
PID 3028 wrote to memory of 3044 N/A C:\Users\Admin\AppData\Local\Temp\dde8d4ae8edc613152f11b263b7a00d74d15cc38a2a3c036466a135ee96f09b5.exe C:\Windows\SysWOW64\REG.exe
PID 3028 wrote to memory of 2544 N/A C:\Users\Admin\AppData\Local\Temp\dde8d4ae8edc613152f11b263b7a00d74d15cc38a2a3c036466a135ee96f09b5.exe C:\Users\Admin\AppData\Local\Temp\avscan.exe
PID 3028 wrote to memory of 2544 N/A C:\Users\Admin\AppData\Local\Temp\dde8d4ae8edc613152f11b263b7a00d74d15cc38a2a3c036466a135ee96f09b5.exe C:\Users\Admin\AppData\Local\Temp\avscan.exe
PID 3028 wrote to memory of 2544 N/A C:\Users\Admin\AppData\Local\Temp\dde8d4ae8edc613152f11b263b7a00d74d15cc38a2a3c036466a135ee96f09b5.exe C:\Users\Admin\AppData\Local\Temp\avscan.exe
PID 3028 wrote to memory of 2544 N/A C:\Users\Admin\AppData\Local\Temp\dde8d4ae8edc613152f11b263b7a00d74d15cc38a2a3c036466a135ee96f09b5.exe C:\Users\Admin\AppData\Local\Temp\avscan.exe
PID 2544 wrote to memory of 2660 N/A C:\Users\Admin\AppData\Local\Temp\avscan.exe C:\Users\Admin\AppData\Local\Temp\avscan.exe
PID 2544 wrote to memory of 2660 N/A C:\Users\Admin\AppData\Local\Temp\avscan.exe C:\Users\Admin\AppData\Local\Temp\avscan.exe
PID 2544 wrote to memory of 2660 N/A C:\Users\Admin\AppData\Local\Temp\avscan.exe C:\Users\Admin\AppData\Local\Temp\avscan.exe
PID 2544 wrote to memory of 2660 N/A C:\Users\Admin\AppData\Local\Temp\avscan.exe C:\Users\Admin\AppData\Local\Temp\avscan.exe
PID 2544 wrote to memory of 2652 N/A C:\Users\Admin\AppData\Local\Temp\avscan.exe C:\Windows\SysWOW64\cmd.exe
PID 2544 wrote to memory of 2652 N/A C:\Users\Admin\AppData\Local\Temp\avscan.exe C:\Windows\SysWOW64\cmd.exe
PID 2544 wrote to memory of 2652 N/A C:\Users\Admin\AppData\Local\Temp\avscan.exe C:\Windows\SysWOW64\cmd.exe
PID 2544 wrote to memory of 2652 N/A C:\Users\Admin\AppData\Local\Temp\avscan.exe C:\Windows\SysWOW64\cmd.exe
PID 3028 wrote to memory of 2608 N/A C:\Users\Admin\AppData\Local\Temp\dde8d4ae8edc613152f11b263b7a00d74d15cc38a2a3c036466a135ee96f09b5.exe C:\Windows\SysWOW64\cmd.exe
PID 3028 wrote to memory of 2608 N/A C:\Users\Admin\AppData\Local\Temp\dde8d4ae8edc613152f11b263b7a00d74d15cc38a2a3c036466a135ee96f09b5.exe C:\Windows\SysWOW64\cmd.exe
PID 3028 wrote to memory of 2608 N/A C:\Users\Admin\AppData\Local\Temp\dde8d4ae8edc613152f11b263b7a00d74d15cc38a2a3c036466a135ee96f09b5.exe C:\Windows\SysWOW64\cmd.exe
PID 3028 wrote to memory of 2608 N/A C:\Users\Admin\AppData\Local\Temp\dde8d4ae8edc613152f11b263b7a00d74d15cc38a2a3c036466a135ee96f09b5.exe C:\Windows\SysWOW64\cmd.exe
PID 2608 wrote to memory of 2612 N/A C:\Windows\SysWOW64\cmd.exe C:\windows\hosts.exe
PID 2608 wrote to memory of 2612 N/A C:\Windows\SysWOW64\cmd.exe C:\windows\hosts.exe
PID 2608 wrote to memory of 2612 N/A C:\Windows\SysWOW64\cmd.exe C:\windows\hosts.exe
PID 2608 wrote to memory of 2612 N/A C:\Windows\SysWOW64\cmd.exe C:\windows\hosts.exe
PID 2652 wrote to memory of 2696 N/A C:\Windows\SysWOW64\cmd.exe C:\windows\hosts.exe
PID 2652 wrote to memory of 2696 N/A C:\Windows\SysWOW64\cmd.exe C:\windows\hosts.exe
PID 2652 wrote to memory of 2696 N/A C:\Windows\SysWOW64\cmd.exe C:\windows\hosts.exe
PID 2652 wrote to memory of 2696 N/A C:\Windows\SysWOW64\cmd.exe C:\windows\hosts.exe
PID 2696 wrote to memory of 2588 N/A C:\windows\hosts.exe C:\Users\Admin\AppData\Local\Temp\avscan.exe
PID 2696 wrote to memory of 2588 N/A C:\windows\hosts.exe C:\Users\Admin\AppData\Local\Temp\avscan.exe
PID 2696 wrote to memory of 2588 N/A C:\windows\hosts.exe C:\Users\Admin\AppData\Local\Temp\avscan.exe
PID 2696 wrote to memory of 2588 N/A C:\windows\hosts.exe C:\Users\Admin\AppData\Local\Temp\avscan.exe
PID 2696 wrote to memory of 2780 N/A C:\windows\hosts.exe C:\Windows\SysWOW64\cmd.exe
PID 2696 wrote to memory of 2780 N/A C:\windows\hosts.exe C:\Windows\SysWOW64\cmd.exe
PID 2696 wrote to memory of 2780 N/A C:\windows\hosts.exe C:\Windows\SysWOW64\cmd.exe
PID 2696 wrote to memory of 2780 N/A C:\windows\hosts.exe C:\Windows\SysWOW64\cmd.exe
PID 2652 wrote to memory of 2124 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\WScript.exe
PID 2652 wrote to memory of 2124 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\WScript.exe
PID 2652 wrote to memory of 2124 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\WScript.exe
PID 2652 wrote to memory of 2124 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\WScript.exe
PID 2608 wrote to memory of 1764 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\WScript.exe
PID 2608 wrote to memory of 1764 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\WScript.exe
PID 2608 wrote to memory of 1764 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\WScript.exe
PID 2608 wrote to memory of 1764 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\WScript.exe
PID 2780 wrote to memory of 2836 N/A C:\Windows\SysWOW64\cmd.exe C:\windows\hosts.exe
PID 2780 wrote to memory of 2836 N/A C:\Windows\SysWOW64\cmd.exe C:\windows\hosts.exe
PID 2780 wrote to memory of 2836 N/A C:\Windows\SysWOW64\cmd.exe C:\windows\hosts.exe
PID 2780 wrote to memory of 2836 N/A C:\Windows\SysWOW64\cmd.exe C:\windows\hosts.exe
PID 2780 wrote to memory of 240 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\WScript.exe
PID 2780 wrote to memory of 240 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\WScript.exe
PID 2780 wrote to memory of 240 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\WScript.exe
PID 2780 wrote to memory of 240 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\WScript.exe
PID 2544 wrote to memory of 2140 N/A C:\Users\Admin\AppData\Local\Temp\avscan.exe C:\Windows\SysWOW64\REG.exe
PID 2544 wrote to memory of 2140 N/A C:\Users\Admin\AppData\Local\Temp\avscan.exe C:\Windows\SysWOW64\REG.exe
PID 2544 wrote to memory of 2140 N/A C:\Users\Admin\AppData\Local\Temp\avscan.exe C:\Windows\SysWOW64\REG.exe
PID 2544 wrote to memory of 2140 N/A C:\Users\Admin\AppData\Local\Temp\avscan.exe C:\Windows\SysWOW64\REG.exe
PID 2696 wrote to memory of 2144 N/A C:\windows\hosts.exe C:\Windows\SysWOW64\REG.exe
PID 2696 wrote to memory of 2144 N/A C:\windows\hosts.exe C:\Windows\SysWOW64\REG.exe
PID 2696 wrote to memory of 2144 N/A C:\windows\hosts.exe C:\Windows\SysWOW64\REG.exe
PID 2696 wrote to memory of 2144 N/A C:\windows\hosts.exe C:\Windows\SysWOW64\REG.exe
PID 2544 wrote to memory of 1480 N/A C:\Users\Admin\AppData\Local\Temp\avscan.exe C:\Windows\SysWOW64\REG.exe
PID 2544 wrote to memory of 1480 N/A C:\Users\Admin\AppData\Local\Temp\avscan.exe C:\Windows\SysWOW64\REG.exe
PID 2544 wrote to memory of 1480 N/A C:\Users\Admin\AppData\Local\Temp\avscan.exe C:\Windows\SysWOW64\REG.exe
PID 2544 wrote to memory of 1480 N/A C:\Users\Admin\AppData\Local\Temp\avscan.exe C:\Windows\SysWOW64\REG.exe

Processes

C:\Users\Admin\AppData\Local\Temp\dde8d4ae8edc613152f11b263b7a00d74d15cc38a2a3c036466a135ee96f09b5.exe

"C:\Users\Admin\AppData\Local\Temp\dde8d4ae8edc613152f11b263b7a00d74d15cc38a2a3c036466a135ee96f09b5.exe"

C:\Windows\SysWOW64\REG.exe

REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f

C:\Users\Admin\AppData\Local\Temp\avscan.exe

C:\Users\Admin\AppData\Local\Temp\avscan.exe

C:\Users\Admin\AppData\Local\Temp\avscan.exe

C:\Users\Admin\AppData\Local\Temp\avscan.exe

C:\Windows\SysWOW64\cmd.exe

cmd /c c:\windows\W_X_C.bat

C:\Windows\SysWOW64\cmd.exe

cmd /c c:\windows\W_X_C.bat

C:\windows\hosts.exe

C:\windows\hosts.exe

C:\windows\hosts.exe

C:\windows\hosts.exe

C:\Users\Admin\AppData\Local\Temp\avscan.exe

C:\Users\Admin\AppData\Local\Temp\avscan.exe

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Windows\W_X_C.vbs"

C:\Windows\SysWOW64\cmd.exe

cmd /c c:\windows\W_X_C.bat

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Windows\W_X_C.vbs"

C:\windows\hosts.exe

C:\windows\hosts.exe

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Windows\W_X_C.vbs"

C:\Windows\SysWOW64\REG.exe

REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f

C:\Windows\SysWOW64\REG.exe

REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f

C:\Windows\SysWOW64\REG.exe

REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f

C:\Windows\SysWOW64\REG.exe

REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f

C:\Windows\SysWOW64\REG.exe

REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f

C:\Windows\SysWOW64\REG.exe

REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f

C:\Windows\SysWOW64\REG.exe

REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f

C:\Windows\SysWOW64\REG.exe

REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f

Network

N/A

Files

\Users\Admin\AppData\Local\Temp\avscan.exe

MD5 cf4d3fbc015f4c37066b34a9a8c52efa
SHA1 91aad5161bdb1dcdb6d02cbdf502eebcb5cd1fe3
SHA256 a904b867bd3bd25cb205351aed0119ac61a51e481cd38fcfaaadf605890391e1
SHA512 2645b4906f894ec8d751df3c7963b9d11ec3c41dde1fb010eb33e46d7c6a142a7e31d89ea1eb228895603fc2d6ef61e388009a1cda8b2c6734efd2190237cd2d

C:\Windows\hosts.exe

MD5 d6cd1601321274adeb125960572cc3ba
SHA1 588ed5d49261213e4125a2a8d8d0ff869eed8ec7
SHA256 e0818e175e2bb4d035d7a1350318a8e4925cc7d141cc0c9b570facfa910d9c80
SHA512 6dfaa7501c412e532e45dcf202a36c33497422e229e4de109c24b0852993b36a4842e9bd48b63295f28d7657b727329d8c711309c055880b3518d591332dc71f

\??\c:\windows\W_X_C.bat

MD5 4db9f8b6175722b62ececeeeba1ce307
SHA1 3b3ba8414706e72a6fa19e884a97b87609e11e47
SHA256 d2150b9e5a4ce55e140f0ca91c4e300715d42095c8fddf58c77037cdd2cfaf78
SHA512 1d6dc274cf7a3dd704f840e6a5ad57ab4c4e35d5f09489aeff520bb797e1c825bac53fc335156fe41e767a46520d031855fe42fe7b175409ebe5e9e986fb9b8b

memory/2588-60-0x00000000003A0000-0x00000000003B0000-memory.dmp

memory/2588-59-0x00000000003A0000-0x00000000003B0000-memory.dmp

C:\Windows\W_X_C.vbs

MD5 37db5f485bd6b2a1d44ecf8e9f0ae054
SHA1 ccd424458443af86d0b76b39a9be5c4e71ec95a5
SHA256 3ad1ab8bde22e2a3038d9f095cf39ef4fdc280cd7418a88c24fb5935758c0f41
SHA512 35497843e87a8c152d62c152f68378551fc4036cd78e999fae311dc64097a478b133ad677476def865acea0a2532a982f2e934744dd8ad6fc469ac09d6b00d72

C:\Users\Admin\AppData\Local\Temp\Admin.bmp

MD5 b2a10d832578f2a598c0fdb9dd91f1d9
SHA1 18aced33e6cadaa1d4f3ead1dbda183fbb0bbb17
SHA256 ce398d957a28d17404c82b1f4410980b7c2159475a127d8d8b0a2c867a130693
SHA512 9c1eaf744734d3267d85f7f40eac3c7f3ef7e8377f418db90a070ff781952a82d8f646fe0b106acf91171c6d60fcc395df221931de488ab494fff10e68a8a721

C:\Users\Admin\AppData\Local\Temp\Admin.bmp

MD5 b620964c692efe9d1b64e588e4a4f7fc
SHA1 e8450dae877d7ae15c2730e066fe42ddf688b83d
SHA256 c11bbdab55672a788757746d6d1e6f3f0a6bec42ec3a46b531230671c8cf5588
SHA512 bd1b9b876f0fe93cc31600228451ba8863af5a9e0d9c91d28bd791fdd19f8b39680019532084d74f63ce11e80a7b077cd66f18eaf34160e4a91ffeafa05d9394

C:\Users\Admin\AppData\Local\Temp\Admin.bmp

MD5 cfa1dd28c7be3d50ba4eaf8fc6c97532
SHA1 ce8e2bc16e6116c35ffb08344f7d33ab7622dfe5
SHA256 f070fd0ba407bb8ccff7df13c5176e793c615d9bbc2f3d9e9341a138ed9b66f1
SHA512 a7b84f01a8fd6a031c0fd41089443b995d8fa53275f4dfba15ef42b182df9abcb2fefc198fe1e9f48f5bfa1161d5842fb002f8aa3e3268a9160c89bb195446ff

C:\Users\Admin\AppData\Local\Temp\Admin.bmp

MD5 dd6bdf4a7513f90a12cca5671794b709
SHA1 2c2d96dc0e83889f38d1430ba3f1c034d4f3df54
SHA256 028b329a922882611c1cedace43841dbfe499f7ea6496f4ccd00d2607636fa6c
SHA512 78f0bdd4b945a5d2e9620c1761a2fb880478c1222da41453c5d826aaf568ac6fc13d3834167a990649f927414ffb02a41c40f42c3d64097d34dd7b68b5d763a3

C:\Users\Admin\AppData\Local\Temp\Admin.bmp

MD5 3bb728140354064aac68e54837e9aadc
SHA1 82a3dc934dc88c77586592d7c1db290524ab8c1a
SHA256 72e7f0bea4b25556b973588bc6d18119f19f21efef2f780ffe3316f29d6cffa6
SHA512 fe24f86ec2abe25e53c47ba900287f07fdd38ee4f1d271fd8c579f2817df2df67ea6a5b21810df673347fed51f43055cb714a842bf6cd969d6b1e33a2ffadd69

C:\Users\Admin\AppData\Local\Temp\Admin.bmp

MD5 7388a9749796107769ee4e7628ceaa2a
SHA1 c68bc817ad9d395ab08a43f33209e84055c59894
SHA256 7261ee168efbcd06751eb6e1f4b732dfba6e0f624c270e50e74667a4aed52f5c
SHA512 7d7c4bf4f07a6f9545330720dfb6a020bf462a08def79acefb007e64b44b07255c9f7c3f87d10c9606ae926786a5471730a0d084faf8a7eafe0295511badbd0a

Analysis: behavioral2

Detonation Overview

Submitted

2024-06-01 04:14

Reported

2024-06-01 04:16

Platform

win10v2004-20240508-en

Max time kernel

135s

Max time network

149s

Command Line

"C:\Users\Admin\AppData\Local\Temp\dde8d4ae8edc613152f11b263b7a00d74d15cc38a2a3c036466a135ee96f09b5.exe"

Signatures

Modifies visibility of file extensions in Explorer

evasion
Description Indicator Process Target
Set value (int) \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" C:\Users\Admin\AppData\Local\Temp\dde8d4ae8edc613152f11b263b7a00d74d15cc38a2a3c036466a135ee96f09b5.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" C:\Users\Admin\AppData\Local\Temp\avscan.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" C:\windows\hosts.exe N/A

Modifies visiblity of hidden/system files in Explorer

evasion
Description Indicator Process Target
Set value (int) \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" C:\Users\Admin\AppData\Local\Temp\dde8d4ae8edc613152f11b263b7a00d74d15cc38a2a3c036466a135ee96f09b5.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" C:\Users\Admin\AppData\Local\Temp\avscan.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" C:\windows\hosts.exe N/A

Adds policy Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\SNFVGQLU = "W_X_C.bat" C:\Windows\SysWOW64\WScript.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run C:\Windows\SysWOW64\WScript.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\SNFVGQLU = "W_X_C.bat" C:\Windows\SysWOW64\WScript.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run C:\Windows\SysWOW64\WScript.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\SNFVGQLU = "W_X_C.bat" C:\Windows\SysWOW64\WScript.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run C:\Windows\SysWOW64\WScript.exe N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\Control Panel\International\Geo\Nation C:\Windows\SysWOW64\cmd.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\Control Panel\International\Geo\Nation C:\Windows\SysWOW64\cmd.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\Control Panel\International\Geo\Nation C:\Windows\SysWOW64\cmd.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\avscan = "C:\\Users\\Admin\\AppData\\Local\\Temp\\avscan.exe" C:\Users\Admin\AppData\Local\Temp\dde8d4ae8edc613152f11b263b7a00d74d15cc38a2a3c036466a135ee96f09b5.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\avscan = "C:\\Users\\Admin\\AppData\\Local\\Temp\\avscan.exe" C:\Users\Admin\AppData\Local\Temp\avscan.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\avscan = "C:\\Users\\Admin\\AppData\\Local\\Temp\\avscan.exe" C:\windows\hosts.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File opened for modification C:\Windows\hosts.exe C:\windows\hosts.exe N/A
File created C:\windows\W_X_C.vbs C:\Users\Admin\AppData\Local\Temp\dde8d4ae8edc613152f11b263b7a00d74d15cc38a2a3c036466a135ee96f09b5.exe N/A
File created \??\c:\windows\W_X_C.bat C:\Users\Admin\AppData\Local\Temp\dde8d4ae8edc613152f11b263b7a00d74d15cc38a2a3c036466a135ee96f09b5.exe N/A
File opened for modification C:\Windows\hosts.exe C:\Users\Admin\AppData\Local\Temp\dde8d4ae8edc613152f11b263b7a00d74d15cc38a2a3c036466a135ee96f09b5.exe N/A
File opened for modification C:\Windows\hosts.exe C:\Users\Admin\AppData\Local\Temp\avscan.exe N/A

Enumerates physical storage devices

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000_Classes\Local Settings C:\Users\Admin\AppData\Local\Temp\dde8d4ae8edc613152f11b263b7a00d74d15cc38a2a3c036466a135ee96f09b5.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000_Classes\Local Settings C:\Windows\SysWOW64\cmd.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000_Classes\Local Settings C:\Windows\SysWOW64\cmd.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000_Classes\Local Settings C:\Windows\SysWOW64\cmd.exe N/A

Suspicious behavior: GetForegroundWindowSpam

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\avscan.exe N/A
N/A N/A C:\windows\hosts.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 220 wrote to memory of 744 N/A C:\Users\Admin\AppData\Local\Temp\dde8d4ae8edc613152f11b263b7a00d74d15cc38a2a3c036466a135ee96f09b5.exe C:\Windows\SysWOW64\REG.exe
PID 220 wrote to memory of 744 N/A C:\Users\Admin\AppData\Local\Temp\dde8d4ae8edc613152f11b263b7a00d74d15cc38a2a3c036466a135ee96f09b5.exe C:\Windows\SysWOW64\REG.exe
PID 220 wrote to memory of 744 N/A C:\Users\Admin\AppData\Local\Temp\dde8d4ae8edc613152f11b263b7a00d74d15cc38a2a3c036466a135ee96f09b5.exe C:\Windows\SysWOW64\REG.exe
PID 220 wrote to memory of 892 N/A C:\Users\Admin\AppData\Local\Temp\dde8d4ae8edc613152f11b263b7a00d74d15cc38a2a3c036466a135ee96f09b5.exe C:\Users\Admin\AppData\Local\Temp\avscan.exe
PID 220 wrote to memory of 892 N/A C:\Users\Admin\AppData\Local\Temp\dde8d4ae8edc613152f11b263b7a00d74d15cc38a2a3c036466a135ee96f09b5.exe C:\Users\Admin\AppData\Local\Temp\avscan.exe
PID 220 wrote to memory of 892 N/A C:\Users\Admin\AppData\Local\Temp\dde8d4ae8edc613152f11b263b7a00d74d15cc38a2a3c036466a135ee96f09b5.exe C:\Users\Admin\AppData\Local\Temp\avscan.exe
PID 892 wrote to memory of 4732 N/A C:\Users\Admin\AppData\Local\Temp\avscan.exe C:\Users\Admin\AppData\Local\Temp\avscan.exe
PID 892 wrote to memory of 4732 N/A C:\Users\Admin\AppData\Local\Temp\avscan.exe C:\Users\Admin\AppData\Local\Temp\avscan.exe
PID 892 wrote to memory of 4732 N/A C:\Users\Admin\AppData\Local\Temp\avscan.exe C:\Users\Admin\AppData\Local\Temp\avscan.exe
PID 892 wrote to memory of 4100 N/A C:\Users\Admin\AppData\Local\Temp\avscan.exe C:\Windows\SysWOW64\cmd.exe
PID 892 wrote to memory of 4100 N/A C:\Users\Admin\AppData\Local\Temp\avscan.exe C:\Windows\SysWOW64\cmd.exe
PID 892 wrote to memory of 4100 N/A C:\Users\Admin\AppData\Local\Temp\avscan.exe C:\Windows\SysWOW64\cmd.exe
PID 220 wrote to memory of 1912 N/A C:\Users\Admin\AppData\Local\Temp\dde8d4ae8edc613152f11b263b7a00d74d15cc38a2a3c036466a135ee96f09b5.exe C:\Windows\SysWOW64\cmd.exe
PID 220 wrote to memory of 1912 N/A C:\Users\Admin\AppData\Local\Temp\dde8d4ae8edc613152f11b263b7a00d74d15cc38a2a3c036466a135ee96f09b5.exe C:\Windows\SysWOW64\cmd.exe
PID 220 wrote to memory of 1912 N/A C:\Users\Admin\AppData\Local\Temp\dde8d4ae8edc613152f11b263b7a00d74d15cc38a2a3c036466a135ee96f09b5.exe C:\Windows\SysWOW64\cmd.exe
PID 1912 wrote to memory of 2168 N/A C:\Windows\SysWOW64\cmd.exe C:\windows\hosts.exe
PID 1912 wrote to memory of 2168 N/A C:\Windows\SysWOW64\cmd.exe C:\windows\hosts.exe
PID 1912 wrote to memory of 2168 N/A C:\Windows\SysWOW64\cmd.exe C:\windows\hosts.exe
PID 4100 wrote to memory of 3624 N/A C:\Windows\SysWOW64\cmd.exe C:\windows\hosts.exe
PID 4100 wrote to memory of 3624 N/A C:\Windows\SysWOW64\cmd.exe C:\windows\hosts.exe
PID 4100 wrote to memory of 3624 N/A C:\Windows\SysWOW64\cmd.exe C:\windows\hosts.exe
PID 2168 wrote to memory of 3960 N/A C:\windows\hosts.exe C:\Users\Admin\AppData\Local\Temp\avscan.exe
PID 2168 wrote to memory of 3960 N/A C:\windows\hosts.exe C:\Users\Admin\AppData\Local\Temp\avscan.exe
PID 2168 wrote to memory of 3960 N/A C:\windows\hosts.exe C:\Users\Admin\AppData\Local\Temp\avscan.exe
PID 4100 wrote to memory of 5092 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\WScript.exe
PID 4100 wrote to memory of 5092 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\WScript.exe
PID 4100 wrote to memory of 5092 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\WScript.exe
PID 1912 wrote to memory of 4592 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\WScript.exe
PID 1912 wrote to memory of 4592 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\WScript.exe
PID 1912 wrote to memory of 4592 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\WScript.exe
PID 2168 wrote to memory of 2900 N/A C:\windows\hosts.exe C:\Windows\SysWOW64\cmd.exe
PID 2168 wrote to memory of 2900 N/A C:\windows\hosts.exe C:\Windows\SysWOW64\cmd.exe
PID 2168 wrote to memory of 2900 N/A C:\windows\hosts.exe C:\Windows\SysWOW64\cmd.exe
PID 2900 wrote to memory of 1896 N/A C:\Windows\SysWOW64\cmd.exe C:\windows\hosts.exe
PID 2900 wrote to memory of 1896 N/A C:\Windows\SysWOW64\cmd.exe C:\windows\hosts.exe
PID 2900 wrote to memory of 1896 N/A C:\Windows\SysWOW64\cmd.exe C:\windows\hosts.exe
PID 2900 wrote to memory of 3496 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\WScript.exe
PID 2900 wrote to memory of 3496 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\WScript.exe
PID 2900 wrote to memory of 3496 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\WScript.exe
PID 892 wrote to memory of 4632 N/A C:\Users\Admin\AppData\Local\Temp\avscan.exe C:\Windows\SysWOW64\REG.exe
PID 892 wrote to memory of 4632 N/A C:\Users\Admin\AppData\Local\Temp\avscan.exe C:\Windows\SysWOW64\REG.exe
PID 892 wrote to memory of 4632 N/A C:\Users\Admin\AppData\Local\Temp\avscan.exe C:\Windows\SysWOW64\REG.exe
PID 2168 wrote to memory of 2680 N/A C:\windows\hosts.exe C:\Windows\SysWOW64\REG.exe
PID 2168 wrote to memory of 2680 N/A C:\windows\hosts.exe C:\Windows\SysWOW64\REG.exe
PID 2168 wrote to memory of 2680 N/A C:\windows\hosts.exe C:\Windows\SysWOW64\REG.exe
PID 892 wrote to memory of 924 N/A C:\Users\Admin\AppData\Local\Temp\avscan.exe C:\Windows\SysWOW64\REG.exe
PID 892 wrote to memory of 924 N/A C:\Users\Admin\AppData\Local\Temp\avscan.exe C:\Windows\SysWOW64\REG.exe
PID 892 wrote to memory of 924 N/A C:\Users\Admin\AppData\Local\Temp\avscan.exe C:\Windows\SysWOW64\REG.exe
PID 2168 wrote to memory of 1412 N/A C:\windows\hosts.exe C:\Windows\SysWOW64\REG.exe
PID 2168 wrote to memory of 1412 N/A C:\windows\hosts.exe C:\Windows\SysWOW64\REG.exe
PID 2168 wrote to memory of 1412 N/A C:\windows\hosts.exe C:\Windows\SysWOW64\REG.exe
PID 892 wrote to memory of 1612 N/A C:\Users\Admin\AppData\Local\Temp\avscan.exe C:\Windows\SysWOW64\REG.exe
PID 892 wrote to memory of 1612 N/A C:\Users\Admin\AppData\Local\Temp\avscan.exe C:\Windows\SysWOW64\REG.exe
PID 892 wrote to memory of 1612 N/A C:\Users\Admin\AppData\Local\Temp\avscan.exe C:\Windows\SysWOW64\REG.exe
PID 2168 wrote to memory of 4904 N/A C:\windows\hosts.exe C:\Windows\SysWOW64\REG.exe
PID 2168 wrote to memory of 4904 N/A C:\windows\hosts.exe C:\Windows\SysWOW64\REG.exe
PID 2168 wrote to memory of 4904 N/A C:\windows\hosts.exe C:\Windows\SysWOW64\REG.exe
PID 892 wrote to memory of 3092 N/A C:\Users\Admin\AppData\Local\Temp\avscan.exe C:\Windows\SysWOW64\REG.exe
PID 892 wrote to memory of 3092 N/A C:\Users\Admin\AppData\Local\Temp\avscan.exe C:\Windows\SysWOW64\REG.exe
PID 892 wrote to memory of 3092 N/A C:\Users\Admin\AppData\Local\Temp\avscan.exe C:\Windows\SysWOW64\REG.exe
PID 2168 wrote to memory of 3272 N/A C:\windows\hosts.exe C:\Windows\SysWOW64\REG.exe
PID 2168 wrote to memory of 3272 N/A C:\windows\hosts.exe C:\Windows\SysWOW64\REG.exe
PID 2168 wrote to memory of 3272 N/A C:\windows\hosts.exe C:\Windows\SysWOW64\REG.exe

Processes

C:\Users\Admin\AppData\Local\Temp\dde8d4ae8edc613152f11b263b7a00d74d15cc38a2a3c036466a135ee96f09b5.exe

"C:\Users\Admin\AppData\Local\Temp\dde8d4ae8edc613152f11b263b7a00d74d15cc38a2a3c036466a135ee96f09b5.exe"

C:\Windows\SysWOW64\REG.exe

REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f

C:\Users\Admin\AppData\Local\Temp\avscan.exe

C:\Users\Admin\AppData\Local\Temp\avscan.exe

C:\Users\Admin\AppData\Local\Temp\avscan.exe

C:\Users\Admin\AppData\Local\Temp\avscan.exe

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c c:\windows\W_X_C.bat

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c c:\windows\W_X_C.bat

C:\Windows\System32\rundll32.exe

C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding

C:\windows\hosts.exe

C:\windows\hosts.exe

C:\windows\hosts.exe

C:\windows\hosts.exe

C:\Users\Admin\AppData\Local\Temp\avscan.exe

C:\Users\Admin\AppData\Local\Temp\avscan.exe

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Windows\W_X_C.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Windows\W_X_C.vbs"

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c c:\windows\W_X_C.bat

C:\windows\hosts.exe

C:\windows\hosts.exe

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Windows\W_X_C.vbs"

C:\Windows\SysWOW64\REG.exe

REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f

C:\Windows\SysWOW64\REG.exe

REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f

C:\Windows\SysWOW64\REG.exe

REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f

C:\Windows\SysWOW64\REG.exe

REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f

C:\Windows\SysWOW64\REG.exe

REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f

C:\Windows\SysWOW64\REG.exe

REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f

C:\Windows\SysWOW64\REG.exe

REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f

C:\Windows\SysWOW64\REG.exe

REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f

Network

Country Destination Domain Proto
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 154.239.44.20.in-addr.arpa udp
US 8.8.8.8:53 0.205.248.87.in-addr.arpa udp
US 8.8.8.8:53 g.bing.com udp
US 204.79.197.237:443 g.bing.com tcp
NL 23.62.61.194:443 www.bing.com tcp
US 8.8.8.8:53 68.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 237.197.79.204.in-addr.arpa udp
US 8.8.8.8:53 194.61.62.23.in-addr.arpa udp
NL 23.62.61.194:443 www.bing.com tcp
US 8.8.8.8:53 43.58.199.20.in-addr.arpa udp
US 8.8.8.8:53 183.59.114.20.in-addr.arpa udp
US 8.8.8.8:53 56.126.166.20.in-addr.arpa udp
US 8.8.8.8:53 91.90.14.23.in-addr.arpa udp
US 8.8.8.8:53 14.227.111.52.in-addr.arpa udp
US 8.8.8.8:53 55.36.223.20.in-addr.arpa udp

Files

C:\Users\Admin\AppData\Local\Temp\avscan.exe

MD5 64f493e3c79ff15a075d3e3f9cff1fcc
SHA1 a7a189ed6ec1ddbc189c03d17c5253d5c9f9e383
SHA256 86c2719d00a472edde323f2baffb50df466373ca10b354588a69435ef28a6745
SHA512 45ff7e7b877ead8aff60a7e6f5b534895e0d561c3024f8f5b30f850972e3c8bba6f7a8124c1bca0756d7df349413fb7f9ecade3fa5d1c2aa7e58228b41b8681b

C:\Windows\hosts.exe

MD5 436b244bac17e0b0abd0cc08bbb46ca1
SHA1 3e90c4c6206cec5f741b8afbc702772ebae46a75
SHA256 5ce7d9a3cdb961bfd75a294801eec699f950a6a86093f5a36236180562f42c1e
SHA512 fdfcda9b7b555fcefaef76f945f011a258706a6fa28cc5ea0ef92bc41287732169384b240adcbc2d098893eb6f346c97debbf3ea091b6ca4851220fd32697961

\??\c:\windows\W_X_C.bat

MD5 4db9f8b6175722b62ececeeeba1ce307
SHA1 3b3ba8414706e72a6fa19e884a97b87609e11e47
SHA256 d2150b9e5a4ce55e140f0ca91c4e300715d42095c8fddf58c77037cdd2cfaf78
SHA512 1d6dc274cf7a3dd704f840e6a5ad57ab4c4e35d5f09489aeff520bb797e1c825bac53fc335156fe41e767a46520d031855fe42fe7b175409ebe5e9e986fb9b8b

C:\Windows\W_X_C.vbs

MD5 0953620670e50597b2091ac367400887
SHA1 79bf81920160f36c97a9e09d8bb5af351f5db018
SHA256 de3f462a7eb421fa2b2edb89a05d17b8439e2c1b14955e07b41f154122592234
SHA512 0cf720ddaa9959426f4589d607bb3259f451f3fd9dbab36a6f5bf25489b5a43ed7db4ae97509509a03b9c593f416b5739da59083cdc3e58ab415f09e8a04cb08