0832262231a604ed62b4111a0d4e023957e78b97435c67d77937292b63d3d46d

Analysis

max time kernel
135s
max time network
129s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
03/06/2024, 22:28

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
0b1f3f55322b383f08b58a89bb03f520_NeikiAnalytics.exe
Size 2.9MB
Sample240603-2dz4nacb95
SHA256 0832262231a604ed62b4111a0d4e023957e78b97435c67d77937292b63d3d46d
MD5 0b1f3f55322b383f08b58a89bb03f520
SHA1 a780c2133fa3793f8a3d01ce742abe20f1e30515
SHA512 e7d4a45b20c0ba0a2363756062e5ab8513787adeaef4f4b188f031e25d1880d80ae2490a498d30ffcd30afa62191b26937fa1549b6cf80aff2e088f1815ea3a2
SSDEEP 49152:g7q7yD7A7yD7q7yD7C7q7yD7A7yD7q7yD747q7yD7A7yD7q7yD7t:g2mDMmD2mDe2mDMmD2mDc2mDMmD2mD5
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

evasion persistence

Malware Config

Signatures

Modifies visibility of file extensions in Explorer 2 TTPs 3 IoCs

evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	0b1f3f55322b383f08b58a89bb03f520_NeikiAnalytics.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	avscan.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	hosts.exe

Modifies visiblity of hidden/system files in Explorer 2 TTPs 3 IoCs

evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	0b1f3f55322b383f08b58a89bb03f520_NeikiAnalytics.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	avscan.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	hosts.exe

Adds policy Run key to start application 2 TTPs 6 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	WScript.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\GYLQWJCN = "W_X_C.bat"	WScript.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	WScript.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\GYLQWJCN = "W_X_C.bat"	WScript.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	WScript.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\GYLQWJCN = "W_X_C.bat"	WScript.exe

Checks computer location settings 2 TTPs 3 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Control Panel\International\Geo\Nation	cmd.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Control Panel\International\Geo\Nation	cmd.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Control Panel\International\Geo\Nation	cmd.exe

Executes dropped EXE 6 IoCs

pid	Process
628	avscan.exe
2952	avscan.exe
2256	hosts.exe
1692	hosts.exe
1868	avscan.exe
4536	hosts.exe

Adds Run key to start application 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\avscan = "C:\\Users\\Admin\\AppData\\Local\\Temp\\avscan.exe"	0b1f3f55322b383f08b58a89bb03f520_NeikiAnalytics.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\avscan = "C:\\Users\\Admin\\AppData\\Local\\Temp\\avscan.exe"	avscan.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\avscan = "C:\\Users\\Admin\\AppData\\Local\\Temp\\avscan.exe"	hosts.exe

Drops file in Windows directory 5 IoCs

description	ioc	Process
File created	C:\windows\W_X_C.vbs	0b1f3f55322b383f08b58a89bb03f520_NeikiAnalytics.exe
File created	\??\c:\windows\W_X_C.bat	0b1f3f55322b383f08b58a89bb03f520_NeikiAnalytics.exe
File opened for modification	C:\Windows\hosts.exe	0b1f3f55322b383f08b58a89bb03f520_NeikiAnalytics.exe
File opened for modification	C:\Windows\hosts.exe	avscan.exe
File opened for modification	C:\Windows\hosts.exe	hosts.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 4 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000_Classes\Local Settings	0b1f3f55322b383f08b58a89bb03f520_NeikiAnalytics.exe
Key created	\REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000_Classes\Local Settings	cmd.exe

Modifies registry key 1 TTPs 9 IoCs

Modify Registry

T1112

pid	Process
2868	REG.exe
4428	REG.exe
4860	REG.exe
3688	REG.exe
456	REG.exe
4508	REG.exe
4076	REG.exe
1924	REG.exe
464	REG.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

pid	Process
628	avscan.exe
2256	hosts.exe

Suspicious use of SetWindowsHookEx 7 IoCs

pid	Process
2644	0b1f3f55322b383f08b58a89bb03f520_NeikiAnalytics.exe
628	avscan.exe
2952	avscan.exe
1692	hosts.exe
2256	hosts.exe
1868	avscan.exe
4536	hosts.exe

Suspicious use of WriteProcessMemory 63 IoCs

description	pid	Process	procid_target
PID 2644 wrote to memory of 2868	2644	0b1f3f55322b383f08b58a89bb03f520_NeikiAnalytics.exe	93
PID 2644 wrote to memory of 2868	2644	0b1f3f55322b383f08b58a89bb03f520_NeikiAnalytics.exe	93
PID 2644 wrote to memory of 2868	2644	0b1f3f55322b383f08b58a89bb03f520_NeikiAnalytics.exe	93
PID 2644 wrote to memory of 628	2644	0b1f3f55322b383f08b58a89bb03f520_NeikiAnalytics.exe	95
PID 2644 wrote to memory of 628	2644	0b1f3f55322b383f08b58a89bb03f520_NeikiAnalytics.exe	95
PID 2644 wrote to memory of 628	2644	0b1f3f55322b383f08b58a89bb03f520_NeikiAnalytics.exe	95
PID 628 wrote to memory of 2952	628	avscan.exe	96
PID 628 wrote to memory of 2952	628	avscan.exe	96
PID 628 wrote to memory of 2952	628	avscan.exe	96
PID 628 wrote to memory of 4768	628	avscan.exe	97
PID 628 wrote to memory of 4768	628	avscan.exe	97
PID 628 wrote to memory of 4768	628	avscan.exe	97
PID 2644 wrote to memory of 4348	2644	0b1f3f55322b383f08b58a89bb03f520_NeikiAnalytics.exe	98
PID 2644 wrote to memory of 4348	2644	0b1f3f55322b383f08b58a89bb03f520_NeikiAnalytics.exe	98
PID 2644 wrote to memory of 4348	2644	0b1f3f55322b383f08b58a89bb03f520_NeikiAnalytics.exe	98
PID 4768 wrote to memory of 2256	4768	cmd.exe	103
PID 4768 wrote to memory of 2256	4768	cmd.exe	103
PID 4768 wrote to memory of 2256	4768	cmd.exe	103
PID 4348 wrote to memory of 1692	4348	cmd.exe	102
PID 4348 wrote to memory of 1692	4348	cmd.exe	102
PID 4348 wrote to memory of 1692	4348	cmd.exe	102
PID 2256 wrote to memory of 1868	2256	hosts.exe	104
PID 2256 wrote to memory of 1868	2256	hosts.exe	104
PID 2256 wrote to memory of 1868	2256	hosts.exe	104
PID 4768 wrote to memory of 4368	4768	cmd.exe	105
PID 4768 wrote to memory of 4368	4768	cmd.exe	105
PID 4768 wrote to memory of 4368	4768	cmd.exe	105
PID 2256 wrote to memory of 1876	2256	hosts.exe	106
PID 2256 wrote to memory of 1876	2256	hosts.exe	106
PID 2256 wrote to memory of 1876	2256	hosts.exe	106
PID 4348 wrote to memory of 4504	4348	cmd.exe	107
PID 4348 wrote to memory of 4504	4348	cmd.exe	107
PID 4348 wrote to memory of 4504	4348	cmd.exe	107
PID 1876 wrote to memory of 4536	1876	cmd.exe	109
PID 1876 wrote to memory of 4536	1876	cmd.exe	109
PID 1876 wrote to memory of 4536	1876	cmd.exe	109
PID 1876 wrote to memory of 4596	1876	cmd.exe	110
PID 1876 wrote to memory of 4596	1876	cmd.exe	110
PID 1876 wrote to memory of 4596	1876	cmd.exe	110
PID 628 wrote to memory of 4076	628	avscan.exe	124
PID 628 wrote to memory of 4076	628	avscan.exe	124
PID 628 wrote to memory of 4076	628	avscan.exe	124
PID 2256 wrote to memory of 1924	2256	hosts.exe	126
PID 2256 wrote to memory of 1924	2256	hosts.exe	126
PID 2256 wrote to memory of 1924	2256	hosts.exe	126
PID 628 wrote to memory of 4428	628	avscan.exe	129
PID 628 wrote to memory of 4428	628	avscan.exe	129
PID 628 wrote to memory of 4428	628	avscan.exe	129
PID 2256 wrote to memory of 464	2256	hosts.exe	131
PID 2256 wrote to memory of 464	2256	hosts.exe	131
PID 2256 wrote to memory of 464	2256	hosts.exe	131
PID 628 wrote to memory of 4860	628	avscan.exe	134
PID 628 wrote to memory of 4860	628	avscan.exe	134
PID 628 wrote to memory of 4860	628	avscan.exe	134
PID 2256 wrote to memory of 3688	2256	hosts.exe	136
PID 2256 wrote to memory of 3688	2256	hosts.exe	136
PID 2256 wrote to memory of 3688	2256	hosts.exe	136
PID 628 wrote to memory of 456	628	avscan.exe	144
PID 628 wrote to memory of 456	628	avscan.exe	144
PID 628 wrote to memory of 456	628	avscan.exe	144
PID 2256 wrote to memory of 4508	2256	hosts.exe	146
PID 2256 wrote to memory of 4508	2256	hosts.exe	146
PID 2256 wrote to memory of 4508	2256	hosts.exe	146

C:\Users\Admin\AppData\Local\Temp\0b1f3f55322b383f08b58a89bb03f520_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\0b1f3f55322b383f08b58a89bb03f520_NeikiAnalytics.exe"
1⤵
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- Adds Run key to start application
- Drops file in Windows directory
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2644
- C:\Windows\SysWOW64\REG.exe
  REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
  2⤵
  - Modifies registry key
  PID:2868
- C:\Users\Admin\AppData\Local\Temp\avscan.exe
  C:\Users\Admin\AppData\Local\Temp\avscan.exe
  2⤵
  - Modifies visibility of file extensions in Explorer
  - Modifies visiblity of hidden/system files in Explorer
  - Executes dropped EXE
  - Adds Run key to start application
  - Drops file in Windows directory
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:628
- - C:\Users\Admin\AppData\Local\Temp\avscan.exe
    C:\Users\Admin\AppData\Local\Temp\avscan.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2952
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c c:\windows\W_X_C.bat
    3⤵
    - Checks computer location settings
    - Modifies registry class
    - Suspicious use of WriteProcessMemory
    PID:4768
  - - C:\windows\hosts.exe
      C:\windows\hosts.exe
      4⤵
      Modifies visibility of file extensions in Explorer
      Modifies visiblity of hidden/system files in Explorer
      Executes dropped EXE
      Adds Run key to start application
      Drops file in Windows directory
      Suspicious behavior: GetForegroundWindowSpam
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:2256
    - - C:\Users\Admin\AppData\Local\Temp\avscan.exe
        
        C:\Users\Admin\AppData\Local\Temp\avscan.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1868
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c c:\windows\W_X_C.bat
        5⤵
        Checks computer location settings
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1876
      - C:\windows\hosts.exe
        
        C:\windows\hosts.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4536
      - C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Windows\W_X_C.vbs"
        6⤵
        Adds policy Run key to start application
        
        PID:4596
    - - C:\Windows\SysWOW64\REG.exe
        
        REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
        5⤵
        Modifies registry key
        
        PID:1924
    - - C:\Windows\SysWOW64\REG.exe
        
        REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
        5⤵
        Modifies registry key
        
        PID:464
    - - C:\Windows\SysWOW64\REG.exe
        
        REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
        5⤵
        Modifies registry key
        
        PID:3688
    - - C:\Windows\SysWOW64\REG.exe
        
        REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
        5⤵
        Modifies registry key
        
        PID:4508
  - - C:\Windows\SysWOW64\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Windows\W_X_C.vbs"
      4⤵
      Adds policy Run key to start application
      PID:4368
- - C:\Windows\SysWOW64\REG.exe
    REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
    3⤵
    - Modifies registry key
    PID:4076
- - C:\Windows\SysWOW64\REG.exe
    REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
    3⤵
    - Modifies registry key
    PID:4428
- - C:\Windows\SysWOW64\REG.exe
    REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
    3⤵
    - Modifies registry key
    PID:4860
- - C:\Windows\SysWOW64\REG.exe
    REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
    3⤵
    - Modifies registry key
    PID:456
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c c:\windows\W_X_C.bat
  2⤵
  - Checks computer location settings
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:4348
- - C:\windows\hosts.exe
    C:\windows\hosts.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1692
- - C:\Windows\SysWOW64\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Windows\W_X_C.vbs"
    3⤵
    - Adds policy Run key to start application
    PID:4504

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:3684

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=4340,i,17096020621006928097,15544233752327415349,262144 --variations-seed-version --mojo-platform-channel-handle=4036 /prefetch:8
1⤵
PID:3688

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

avscan.exe

Path C:\Users\Admin\AppData\Local\Temp\avscan.exe
Size 2.9MB
SHA256 ee6a58353f5421b4d93ab4ee4dc3e7475f2946dbad043463703e9688ad2b3972
MD5 6df6cfb0068112d95c1c2e52b5224ac7
SHA1 8299043c96abc9b5a2a21cad8a0fc0eae78c818c
SHA512 727245717b75646b472dde4e4e90a12d26ee23004c7b24ff9b3ca482a8fc2931ee8e8ad07744ba8765e7ca5fa80a4ea14a8647aa93539276df22a7e266b4d8bc
SSDEEP 49152:g7q7yD7A7yD7q7yD7C7q7yD7A7yD7q7yD747q7yD7A7yD7q7yD7B:g2mDMmD2mDe2mDMmD2mDc2mDMmD2mD1
MD5 SHA1 SHA512 SSDEEP

Submit Download

128.png

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir1472_918258677\CRX_INSTALL\128.png
Size 5.7MB
SHA256 48e05656899192812ace80fa5989da1edc09d2c4c12b841c76f83abdd4e79237
MD5 d4aa0437410e1ed7242eb4b21e01c3f4
SHA1 ca7f6f55cc5406c60eb6b0423b57130f9a8660d8
SHA512 5aed6735b05674554ec73d16dddcb79b3858acfb8327a174c15806b3dbde5c1d20b402179be5b43f129289d997654c731ef3858cc6e725b50c0bbb3070f864d4
SSDEEP 98304:g2mDMmD2mDe2mDMmD2mDc2mDMmD2mDN2mDMmD2mDe2mDMmD2mDc2mDMmD2mDL:g2mDMmD2mDe2mDMmD2mDc2mDMmD2mDNJ
MD5 SHA1 SHA512 SSDEEP

Submit Download

128.png

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir1472_918258677\CRX_INSTALL\128.png
Size 8.6MB
SHA256 88f488942eaf4541ab8ba57a8d60648cddce4abc0465ffe978503725b67c1e90
MD5 e633ca16c75acc2db1bc3331b344e8ce
SHA1 5409a1b97c7b0bbe1459da0b88ca9e2754f7f009
SHA512 ad6387a1098e609993479700c2c399177d7afa8c851538250e0cc533acc4abf42a7c94f384b92b3c4f932b478080a80609359f2e9a11d3b1f17986b6082c04df
SSDEEP 196608:g2mDMmD2mDe2mDMmD2mDc2mDMmD2mDH2mDMmD2mDe2mDMmD2mDc2mDMmD2mDN2m4:d
MD5 SHA1 SHA512 SSDEEP

Submit Download

128.png

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir1472_918258677\CRX_INSTALL\128.png
Size 11.5MB
SHA256 d67dafcbcb4fd9808c86f905ccf097801b686cc321d00daeb7768754f23fbc06
MD5 e3f68346a6f7600e4d612840dc24effd
SHA1 a7f5f63bc2c8f88ba156e7542155c6e5dfbef71d
SHA512 f40b5ab3ab937bf0eed3769a0bde36bd06910fd2ec2ddc25a8213af43548f4764895104d83b4bb0cbf1b6d4413148345b4a57a7fde83e59f3d1d5c22e518e1ce
SSDEEP 196608:g2mDMmD2mDe2mDMmD2mDc2mDMmD2mDN2mDMmD2mDe2mDMmD2mDc2mDMmD2mDH2mN:Y
MD5 SHA1 SHA512 SSDEEP

Submit Download

128.png

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir1472_918258677\CRX_INSTALL\128.png
Size 14.3MB
SHA256 9fa8a2d687ccd02262fc640e6c61a456b30a5ea1dca145ece5b372b8fedf84b2
MD5 d8fd4b4968dfe0a6facf55dd7d15bb5f
SHA1 ce5a7eb83bc386d4036708050401cb311b239f15
SHA512 1df637cc865bb3c8f54f27ea7495ce7ad0857612608770899945e6c4f7aba7574c599f4070bd9750461e3838e39754ed668a62d19f3b0331497bae0d19b087fa
SSDEEP 196608:g2mDMmD2mDe2mDMmD2mDc2mDMmD2mDH2mDMmD2mDe2mDMmD2mDc2mDMmD2mDN2mQ:V
MD5 SHA1 SHA512 SSDEEP

Submit Download

128.png

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir1472_918258677\CRX_INSTALL\128.png
Size 17.2MB
SHA256 9a5061bc594c017a776157771fd6fbd5ae9932c3b93069f188cdd8926f329e99
MD5 58833f56287520c984a629eea3f6231f
SHA1 1a7a9cad69850d9ad31bd6a3760520e2dd4479da
SHA512 5b714b731fc5044102d0f1cc6e671dc1fb3a7a32f8ac24361b5877d0509273ed532dbd37b7df868823d95312f436810908441fc0d4e773ce89facc6d7b6ca11b
SSDEEP 196608:g2mDMmD2mDe2mDMmD2mDc2mDMmD2mDN2mDMmD2mDe2mDMmD2mDc2mDMmD2mDH2m7:q
MD5 SHA1 SHA512 SSDEEP

Submit Download

128.png

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir1472_918258677\CRX_INSTALL\128.png
Size 20.1MB
SHA256 023e2c7d54f03bafb6ac1a169f1bf9c11ab214787a11204560b85a3b671c850b
MD5 f541f40cd994053b72ec21568a5e89f8
SHA1 f09540f9314314cc41a6e342259a0d2d89efd447
SHA512 dcc88b4319a33482d66bcd87f1a80129928ea46dc0782b5a8af9ccb80646116e02f881a78ed9b6e182f9195b4a8d2f2d87b9dd77f9eacfeaf0bc9c7c543f671b
SSDEEP 196608:g2mDMmD2mDe2mDMmD2mDc2mDMmD2mDH2mDMmD2mDe2mDMmD2mDc2mDMmD2mDN2mm:X
MD5 SHA1 SHA512 SSDEEP

Submit Download

128.png

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir1472_918258677\CRX_INSTALL\128.png
Size 23.0MB
SHA256 d4401631098aba26fed12418db45f7ecdf5d76da42ffb2715a65660470fed21e
MD5 c32bf4bf2368952f9da4616bea6c2c91
SHA1 01e7d4e24dd94b8180e7605f69e4d7948ec61840
SHA512 39f78834d2cdf7b66873bca63405c05f1c1ae517d8e94c84358c537188fe5452ec342dfc437de6bb45c949c2c782bb4343499c31440b539afc3afe2e11ef5dea
SSDEEP 196608:g2mDMmD2mDe2mDMmD2mDc2mDMmD2mDN2mDMmD2mDe2mDMmD2mDc2mDMmD2mDH2mp:U
MD5 SHA1 SHA512 SSDEEP

Submit Download

W_X_C.vbs

Path C:\Windows\W_X_C.vbs
Size 195B
SHA256 51bf743d50e234c7c57b6582b58bb711c4bef11cf52749cdaeb22d76cd15c8c7
MD5 8f735b6fa10bd618193513b30d8abad1
SHA1 ab79bb62e58c79a4850ebfc474f4a3740f377b1e
SHA512 5239ee1757c0000755ded41db303154a5d964c52f6d7b93751e0023eb181ae43a96fac81d6368b175e61fe6e572f39d84d374c6d268a09485c5fc18ea7929282
MD5 SHA1 SHA512

Submit Download

hosts.exe

Path C:\Windows\hosts.exe
Size 2.9MB
SHA256 d03691e60958d52410444d27bcc47f662fcec7f90b520d79240cc558fc666cde
MD5 157c7242f6b8caa5b51caee55fe577c4
SHA1 2d1b842e0568457c15a9241af47a6af7909f9097
SHA512 57f4ccadd069b80eb41c696cbd6d82df3e055c8a3a63494f355e277eb94511c1a6eadac4eb415f2459b39cb3184356615e734fc0b016a117aa1c90c9d649f5fc
SSDEEP 49152:g7q7yD7A7yD7q7yD7C7q7yD7A7yD7q7yD747q7yD7A7yD7q7yD78:g2mDMmD2mDe2mDMmD2mDc2mDMmD2mDw
MD5 SHA1 SHA512 SSDEEP

Submit Download

W_X_C.bat

Path \??\c:\windows\W_X_C.bat
Size 336B
SHA256 d2150b9e5a4ce55e140f0ca91c4e300715d42095c8fddf58c77037cdd2cfaf78
MD5 4db9f8b6175722b62ececeeeba1ce307
SHA1 3b3ba8414706e72a6fa19e884a97b87609e11e47
SHA512 1d6dc274cf7a3dd704f840e6a5ad57ab4c4e35d5f09489aeff520bb797e1c825bac53fc335156fe41e767a46520d031855fe42fe7b175409ebe5e9e986fb9b8b
MD5 SHA1 SHA512

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads