6cdd5c06e2a3b298c98b43fa01abbc5e18c4c57590c93ffe8c66a744af273104

Analysis

max time kernel
123s
max time network
94s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
03/06/2024, 22:41

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
6cdd5c06e2a3b298c98b43fa01abbc5e18c4c57590c93ffe8c66a744af273104.exe
Size 3.6MB
Sample240603-2mg97sce82
SHA256 6cdd5c06e2a3b298c98b43fa01abbc5e18c4c57590c93ffe8c66a744af273104
MD5 123c575fe9a1d5ef302d0f0f02319e41
SHA1 43315cd1803ba379d145f7f9327f03ce7dcc89d5
SHA512 8460fcffde2aff5a4df40207bcee5c2d23b39f2529dabc76a0fb5c8c3915fd540c02fbfd71aed4f0664c2171c2f4fc84188ec6dffe144f63a3340bfd8985124c
SSDEEP 98304:grc2mDMmD2mD6c2mDMmD2mDrc2mDMmD2mDB:grc2mDMmD2mD6c2mDMmD2mDrc2mDMmDL
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

evasion persistence

Malware Config

Signatures

Modifies visibility of file extensions in Explorer 2 TTPs 3 IoCs

evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	6cdd5c06e2a3b298c98b43fa01abbc5e18c4c57590c93ffe8c66a744af273104.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	avscan.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	hosts.exe

Modifies visiblity of hidden/system files in Explorer 2 TTPs 3 IoCs

evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	hosts.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	6cdd5c06e2a3b298c98b43fa01abbc5e18c4c57590c93ffe8c66a744af273104.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	avscan.exe

Adds policy Run key to start application 2 TTPs 6 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\GSAGMHCQ = "W_X_C.bat"	WScript.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	WScript.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\GSAGMHCQ = "W_X_C.bat"	WScript.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	WScript.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\GSAGMHCQ = "W_X_C.bat"	WScript.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	WScript.exe

Checks computer location settings 2 TTPs 3 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\Control Panel\International\Geo\Nation	cmd.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\Control Panel\International\Geo\Nation	cmd.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\Control Panel\International\Geo\Nation	cmd.exe

Executes dropped EXE 6 IoCs

pid	Process
4604	avscan.exe
512	avscan.exe
3868	hosts.exe
532	hosts.exe
1496	avscan.exe
2296	hosts.exe

Adds Run key to start application 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\avscan = "C:\\Users\\Admin\\AppData\\Local\\Temp\\avscan.exe"	hosts.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\avscan = "C:\\Users\\Admin\\AppData\\Local\\Temp\\avscan.exe"	6cdd5c06e2a3b298c98b43fa01abbc5e18c4c57590c93ffe8c66a744af273104.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\avscan = "C:\\Users\\Admin\\AppData\\Local\\Temp\\avscan.exe"	avscan.exe

Drops file in Windows directory 5 IoCs

description	ioc	Process
File opened for modification	C:\Windows\hosts.exe	hosts.exe
File created	C:\windows\W_X_C.vbs	6cdd5c06e2a3b298c98b43fa01abbc5e18c4c57590c93ffe8c66a744af273104.exe
File created	\??\c:\windows\W_X_C.bat	6cdd5c06e2a3b298c98b43fa01abbc5e18c4c57590c93ffe8c66a744af273104.exe
File opened for modification	C:\Windows\hosts.exe	6cdd5c06e2a3b298c98b43fa01abbc5e18c4c57590c93ffe8c66a744af273104.exe
File opened for modification	C:\Windows\hosts.exe	avscan.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 4 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000_Classes\Local Settings	6cdd5c06e2a3b298c98b43fa01abbc5e18c4c57590c93ffe8c66a744af273104.exe
Key created	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000_Classes\Local Settings	cmd.exe

Modifies registry key 1 TTPs 9 IoCs

Modify Registry

T1112

pid	Process
4844	REG.exe
4716	REG.exe
1072	REG.exe
3136	REG.exe
4448	REG.exe
1604	REG.exe
1920	REG.exe
3080	REG.exe
1596	REG.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

pid	Process
4604	avscan.exe
3868	hosts.exe

Suspicious use of SetWindowsHookEx 7 IoCs

pid	Process
4788	6cdd5c06e2a3b298c98b43fa01abbc5e18c4c57590c93ffe8c66a744af273104.exe
4604	avscan.exe
512	avscan.exe
3868	hosts.exe
532	hosts.exe
1496	avscan.exe
2296	hosts.exe

Suspicious use of WriteProcessMemory 63 IoCs

description	pid	Process	procid_target
PID 4788 wrote to memory of 4448	4788	6cdd5c06e2a3b298c98b43fa01abbc5e18c4c57590c93ffe8c66a744af273104.exe	83
PID 4788 wrote to memory of 4448	4788	6cdd5c06e2a3b298c98b43fa01abbc5e18c4c57590c93ffe8c66a744af273104.exe	83
PID 4788 wrote to memory of 4448	4788	6cdd5c06e2a3b298c98b43fa01abbc5e18c4c57590c93ffe8c66a744af273104.exe	83
PID 4788 wrote to memory of 4604	4788	6cdd5c06e2a3b298c98b43fa01abbc5e18c4c57590c93ffe8c66a744af273104.exe	85
PID 4788 wrote to memory of 4604	4788	6cdd5c06e2a3b298c98b43fa01abbc5e18c4c57590c93ffe8c66a744af273104.exe	85
PID 4788 wrote to memory of 4604	4788	6cdd5c06e2a3b298c98b43fa01abbc5e18c4c57590c93ffe8c66a744af273104.exe	85
PID 4604 wrote to memory of 512	4604	avscan.exe	86
PID 4604 wrote to memory of 512	4604	avscan.exe	86
PID 4604 wrote to memory of 512	4604	avscan.exe	86
PID 4604 wrote to memory of 4868	4604	avscan.exe	87
PID 4604 wrote to memory of 4868	4604	avscan.exe	87
PID 4604 wrote to memory of 4868	4604	avscan.exe	87
PID 4788 wrote to memory of 836	4788	6cdd5c06e2a3b298c98b43fa01abbc5e18c4c57590c93ffe8c66a744af273104.exe	88
PID 4788 wrote to memory of 836	4788	6cdd5c06e2a3b298c98b43fa01abbc5e18c4c57590c93ffe8c66a744af273104.exe	88
PID 4788 wrote to memory of 836	4788	6cdd5c06e2a3b298c98b43fa01abbc5e18c4c57590c93ffe8c66a744af273104.exe	88
PID 4868 wrote to memory of 3868	4868	cmd.exe	93
PID 4868 wrote to memory of 3868	4868	cmd.exe	93
PID 4868 wrote to memory of 3868	4868	cmd.exe	93
PID 836 wrote to memory of 532	836	cmd.exe	94
PID 836 wrote to memory of 532	836	cmd.exe	94
PID 836 wrote to memory of 532	836	cmd.exe	94
PID 3868 wrote to memory of 1496	3868	hosts.exe	95
PID 3868 wrote to memory of 1496	3868	hosts.exe	95
PID 3868 wrote to memory of 1496	3868	hosts.exe	95
PID 836 wrote to memory of 3108	836	cmd.exe	96
PID 836 wrote to memory of 3108	836	cmd.exe	96
PID 836 wrote to memory of 3108	836	cmd.exe	96
PID 4868 wrote to memory of 3536	4868	cmd.exe	97
PID 4868 wrote to memory of 3536	4868	cmd.exe	97
PID 4868 wrote to memory of 3536	4868	cmd.exe	97
PID 3868 wrote to memory of 3764	3868	hosts.exe	98
PID 3868 wrote to memory of 3764	3868	hosts.exe	98
PID 3868 wrote to memory of 3764	3868	hosts.exe	98
PID 3764 wrote to memory of 2296	3764	cmd.exe	100
PID 3764 wrote to memory of 2296	3764	cmd.exe	100
PID 3764 wrote to memory of 2296	3764	cmd.exe	100
PID 3764 wrote to memory of 4556	3764	cmd.exe	102
PID 3764 wrote to memory of 4556	3764	cmd.exe	102
PID 3764 wrote to memory of 4556	3764	cmd.exe	102
PID 4604 wrote to memory of 1604	4604	avscan.exe	112
PID 4604 wrote to memory of 1604	4604	avscan.exe	112
PID 4604 wrote to memory of 1604	4604	avscan.exe	112
PID 3868 wrote to memory of 4844	3868	hosts.exe	114
PID 3868 wrote to memory of 4844	3868	hosts.exe	114
PID 3868 wrote to memory of 4844	3868	hosts.exe	114
PID 4604 wrote to memory of 1920	4604	avscan.exe	117
PID 4604 wrote to memory of 1920	4604	avscan.exe	117
PID 4604 wrote to memory of 1920	4604	avscan.exe	117
PID 3868 wrote to memory of 4716	3868	hosts.exe	119
PID 3868 wrote to memory of 4716	3868	hosts.exe	119
PID 3868 wrote to memory of 4716	3868	hosts.exe	119
PID 4604 wrote to memory of 3080	4604	avscan.exe	121
PID 4604 wrote to memory of 3080	4604	avscan.exe	121
PID 4604 wrote to memory of 3080	4604	avscan.exe	121
PID 3868 wrote to memory of 1596	3868	hosts.exe	123
PID 3868 wrote to memory of 1596	3868	hosts.exe	123
PID 3868 wrote to memory of 1596	3868	hosts.exe	123
PID 4604 wrote to memory of 1072	4604	avscan.exe	125
PID 4604 wrote to memory of 1072	4604	avscan.exe	125
PID 4604 wrote to memory of 1072	4604	avscan.exe	125
PID 3868 wrote to memory of 3136	3868	hosts.exe	127
PID 3868 wrote to memory of 3136	3868	hosts.exe	127
PID 3868 wrote to memory of 3136	3868	hosts.exe	127

C:\Users\Admin\AppData\Local\Temp\6cdd5c06e2a3b298c98b43fa01abbc5e18c4c57590c93ffe8c66a744af273104.exe
"C:\Users\Admin\AppData\Local\Temp\6cdd5c06e2a3b298c98b43fa01abbc5e18c4c57590c93ffe8c66a744af273104.exe"
1⤵
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- Adds Run key to start application
- Drops file in Windows directory
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4788
- C:\Windows\SysWOW64\REG.exe
  REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
  2⤵
  - Modifies registry key
  PID:4448
- C:\Users\Admin\AppData\Local\Temp\avscan.exe
  C:\Users\Admin\AppData\Local\Temp\avscan.exe
  2⤵
  - Modifies visibility of file extensions in Explorer
  - Modifies visiblity of hidden/system files in Explorer
  - Executes dropped EXE
  - Adds Run key to start application
  - Drops file in Windows directory
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4604
- - C:\Users\Admin\AppData\Local\Temp\avscan.exe
    C:\Users\Admin\AppData\Local\Temp\avscan.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:512
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c c:\windows\W_X_C.bat
    3⤵
    - Checks computer location settings
    - Modifies registry class
    - Suspicious use of WriteProcessMemory
    PID:4868
  - - C:\windows\hosts.exe
      C:\windows\hosts.exe
      4⤵
      Modifies visibility of file extensions in Explorer
      Modifies visiblity of hidden/system files in Explorer
      Executes dropped EXE
      Adds Run key to start application
      Drops file in Windows directory
      Suspicious behavior: GetForegroundWindowSpam
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:3868
    - - C:\Users\Admin\AppData\Local\Temp\avscan.exe
        
        C:\Users\Admin\AppData\Local\Temp\avscan.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1496
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c c:\windows\W_X_C.bat
        5⤵
        Checks computer location settings
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3764
      - C:\windows\hosts.exe
        
        C:\windows\hosts.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2296
      - C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Windows\W_X_C.vbs"
        6⤵
        Adds policy Run key to start application
        
        PID:4556
    - - C:\Windows\SysWOW64\REG.exe
        
        REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
        5⤵
        Modifies registry key
        
        PID:4844
    - - C:\Windows\SysWOW64\REG.exe
        
        REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
        5⤵
        Modifies registry key
        
        PID:4716
    - - C:\Windows\SysWOW64\REG.exe
        
        REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
        5⤵
        Modifies registry key
        
        PID:1596
    - - C:\Windows\SysWOW64\REG.exe
        
        REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
        5⤵
        Modifies registry key
        
        PID:3136
  - - C:\Windows\SysWOW64\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Windows\W_X_C.vbs"
      4⤵
      Adds policy Run key to start application
      PID:3536
- - C:\Windows\SysWOW64\REG.exe
    REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
    3⤵
    - Modifies registry key
    PID:1604
- - C:\Windows\SysWOW64\REG.exe
    REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
    3⤵
    - Modifies registry key
    PID:1920
- - C:\Windows\SysWOW64\REG.exe
    REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
    3⤵
    - Modifies registry key
    PID:3080
- - C:\Windows\SysWOW64\REG.exe
    REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
    3⤵
    - Modifies registry key
    PID:1072
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c c:\windows\W_X_C.bat
  2⤵
  - Checks computer location settings
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:836
- - C:\windows\hosts.exe
    C:\windows\hosts.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:532
- - C:\Windows\SysWOW64\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Windows\W_X_C.vbs"
    3⤵
    - Adds policy Run key to start application
    PID:3108

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4836

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

avscan.exe

Path C:\Users\Admin\AppData\Local\Temp\avscan.exe
Size 3.6MB
SHA256 ff035a35ab4eb213c88270e30454dee22560b62ed02ffb2eae17c4036a8a94a6
MD5 abf7dc31ec71a87dd57e4a7e97b15ff5
SHA1 9643251e95562a1fcc81e3f867fcb4d510cf8a87
SHA512 853ecd203eb277fa78aaecf02b0532b8b0798b49548306d89cb59fbcd6efcefe3a314bb666553b17cba5b16c23c2944338378cde335fecf6f8fe48a162e33f92
SSDEEP 98304:grc2mDMmD2mD6c2mDMmD2mDrc2mDMmD2mDI:grc2mDMmD2mD6c2mDMmD2mDrc2mDMmDK
MD5 SHA1 SHA512 SSDEEP

Submit Download

W_X_C.vbs

Path C:\Windows\W_X_C.vbs
Size 195B
SHA256 5248f9121ef1e7529aa4a2ca8556fdcdb78cdb33bd9908e8d8e15d6b625c4740
MD5 52bacc7bb948324274f50a15cc06257e
SHA1 735ee78395c7e4d0c2fe265c2f018d120aa747b2
SHA512 ce7f90a86fbdab8f320705f3ee185d8aa70b65433cb52d0087b76ea0810ad4298bc19258bd7f93ef36bc018b8c7557a5aa14156f070c6f14cba25a0c5f23437c
MD5 SHA1 SHA512

Submit Download

hosts.exe

Path C:\Windows\hosts.exe
Size 3.6MB
SHA256 3adbf47f0f2c683b78f0586e9bbc3c9020a6d0e32d9279755c25d91d874d197e
MD5 3c6ffc85705d0d98bad308e8e33df0c4
SHA1 4fad431b465f3b054d0482b1d17ccddb3bdf2581
SHA512 6c790d6b2fb1e66e659ce50d40cfb619add41951a2fe58490f1800b9c911789445472b50c567aed22e05f5358023ca1450606cf822a2f2b0a9ea982e09de0453
SSDEEP 98304:grc2mDMmD2mD6c2mDMmD2mDrc2mDMmD2mD1:grc2mDMmD2mD6c2mDMmD2mDrc2mDMmD/
MD5 SHA1 SHA512 SSDEEP

Submit Download

W_X_C.bat

Path \??\c:\windows\W_X_C.bat
Size 336B
SHA256 d2150b9e5a4ce55e140f0ca91c4e300715d42095c8fddf58c77037cdd2cfaf78
MD5 4db9f8b6175722b62ececeeeba1ce307
SHA1 3b3ba8414706e72a6fa19e884a97b87609e11e47
SHA512 1d6dc274cf7a3dd704f840e6a5ad57ab4c4e35d5f09489aeff520bb797e1c825bac53fc335156fe41e767a46520d031855fe42fe7b175409ebe5e9e986fb9b8b
MD5 SHA1 SHA512

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads