Malware Analysis Report

2025-01-06 12:28

Sample ID 240614-e8vfbsyhlq
Target d705057413dc54e9b1866a194f00a1ce63871d99a4ff76ff7f4035eacf2ff733
SHA256 d705057413dc54e9b1866a194f00a1ce63871d99a4ff76ff7f4035eacf2ff733
Tags
evasion persistence
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

d705057413dc54e9b1866a194f00a1ce63871d99a4ff76ff7f4035eacf2ff733

Threat Level: Known bad

The file d705057413dc54e9b1866a194f00a1ce63871d99a4ff76ff7f4035eacf2ff733 was found to be: Known bad.

Malicious Activity Summary

evasion persistence

Modifies visiblity of hidden/system files in Explorer

Modifies visibility of file extensions in Explorer

Adds policy Run key to start application

Checks computer location settings

Loads dropped DLL

Executes dropped EXE

Adds Run key to start application

Drops file in Windows directory

Unsigned PE

Enumerates physical storage devices

Modifies registry key

Suspicious use of WriteProcessMemory

Suspicious behavior: GetForegroundWindowSpam

Suspicious use of SetWindowsHookEx

Modifies registry class

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-06-14 04:37

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-06-14 04:37

Reported

2024-06-14 04:39

Platform

win7-20240221-en

Max time kernel

122s

Max time network

126s

Command Line

"C:\Users\Admin\AppData\Local\Temp\d705057413dc54e9b1866a194f00a1ce63871d99a4ff76ff7f4035eacf2ff733.exe"

Signatures

Modifies visibility of file extensions in Explorer

evasion
Description Indicator Process Target
Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" C:\Users\Admin\AppData\Local\Temp\avscan.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" C:\windows\hosts.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" C:\Users\Admin\AppData\Local\Temp\d705057413dc54e9b1866a194f00a1ce63871d99a4ff76ff7f4035eacf2ff733.exe N/A

Modifies visiblity of hidden/system files in Explorer

evasion
Description Indicator Process Target
Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" C:\Users\Admin\AppData\Local\Temp\d705057413dc54e9b1866a194f00a1ce63871d99a4ff76ff7f4035eacf2ff733.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" C:\Users\Admin\AppData\Local\Temp\avscan.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" C:\windows\hosts.exe N/A

Adds policy Run key to start application

persistence
Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run C:\Windows\SysWOW64\WScript.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\IZKCKOTP = "W_X_C.bat" C:\Windows\SysWOW64\WScript.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run C:\Windows\SysWOW64\WScript.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\IZKCKOTP = "W_X_C.bat" C:\Windows\SysWOW64\WScript.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run C:\Windows\SysWOW64\WScript.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\IZKCKOTP = "W_X_C.bat" C:\Windows\SysWOW64\WScript.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\avscan = "C:\\Users\\Admin\\AppData\\Local\\Temp\\avscan.exe" C:\windows\hosts.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\avscan = "C:\\Users\\Admin\\AppData\\Local\\Temp\\avscan.exe" C:\Users\Admin\AppData\Local\Temp\d705057413dc54e9b1866a194f00a1ce63871d99a4ff76ff7f4035eacf2ff733.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\avscan = "C:\\Users\\Admin\\AppData\\Local\\Temp\\avscan.exe" C:\Users\Admin\AppData\Local\Temp\avscan.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File opened for modification C:\Windows\hosts.exe C:\windows\hosts.exe N/A
File created C:\windows\W_X_C.vbs C:\Users\Admin\AppData\Local\Temp\d705057413dc54e9b1866a194f00a1ce63871d99a4ff76ff7f4035eacf2ff733.exe N/A
File created \??\c:\windows\W_X_C.bat C:\Users\Admin\AppData\Local\Temp\d705057413dc54e9b1866a194f00a1ce63871d99a4ff76ff7f4035eacf2ff733.exe N/A
File opened for modification C:\Windows\hosts.exe C:\Users\Admin\AppData\Local\Temp\d705057413dc54e9b1866a194f00a1ce63871d99a4ff76ff7f4035eacf2ff733.exe N/A
File opened for modification C:\Windows\hosts.exe C:\Users\Admin\AppData\Local\Temp\avscan.exe N/A

Enumerates physical storage devices

Suspicious behavior: GetForegroundWindowSpam

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\avscan.exe N/A
N/A N/A C:\windows\hosts.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2252 wrote to memory of 2492 N/A C:\Users\Admin\AppData\Local\Temp\d705057413dc54e9b1866a194f00a1ce63871d99a4ff76ff7f4035eacf2ff733.exe C:\Windows\SysWOW64\REG.exe
PID 2252 wrote to memory of 2492 N/A C:\Users\Admin\AppData\Local\Temp\d705057413dc54e9b1866a194f00a1ce63871d99a4ff76ff7f4035eacf2ff733.exe C:\Windows\SysWOW64\REG.exe
PID 2252 wrote to memory of 2492 N/A C:\Users\Admin\AppData\Local\Temp\d705057413dc54e9b1866a194f00a1ce63871d99a4ff76ff7f4035eacf2ff733.exe C:\Windows\SysWOW64\REG.exe
PID 2252 wrote to memory of 2492 N/A C:\Users\Admin\AppData\Local\Temp\d705057413dc54e9b1866a194f00a1ce63871d99a4ff76ff7f4035eacf2ff733.exe C:\Windows\SysWOW64\REG.exe
PID 2252 wrote to memory of 2712 N/A C:\Users\Admin\AppData\Local\Temp\d705057413dc54e9b1866a194f00a1ce63871d99a4ff76ff7f4035eacf2ff733.exe C:\Users\Admin\AppData\Local\Temp\avscan.exe
PID 2252 wrote to memory of 2712 N/A C:\Users\Admin\AppData\Local\Temp\d705057413dc54e9b1866a194f00a1ce63871d99a4ff76ff7f4035eacf2ff733.exe C:\Users\Admin\AppData\Local\Temp\avscan.exe
PID 2252 wrote to memory of 2712 N/A C:\Users\Admin\AppData\Local\Temp\d705057413dc54e9b1866a194f00a1ce63871d99a4ff76ff7f4035eacf2ff733.exe C:\Users\Admin\AppData\Local\Temp\avscan.exe
PID 2252 wrote to memory of 2712 N/A C:\Users\Admin\AppData\Local\Temp\d705057413dc54e9b1866a194f00a1ce63871d99a4ff76ff7f4035eacf2ff733.exe C:\Users\Admin\AppData\Local\Temp\avscan.exe
PID 2712 wrote to memory of 864 N/A C:\Users\Admin\AppData\Local\Temp\avscan.exe C:\Users\Admin\AppData\Local\Temp\avscan.exe
PID 2712 wrote to memory of 864 N/A C:\Users\Admin\AppData\Local\Temp\avscan.exe C:\Users\Admin\AppData\Local\Temp\avscan.exe
PID 2712 wrote to memory of 864 N/A C:\Users\Admin\AppData\Local\Temp\avscan.exe C:\Users\Admin\AppData\Local\Temp\avscan.exe
PID 2712 wrote to memory of 864 N/A C:\Users\Admin\AppData\Local\Temp\avscan.exe C:\Users\Admin\AppData\Local\Temp\avscan.exe
PID 2712 wrote to memory of 2424 N/A C:\Users\Admin\AppData\Local\Temp\avscan.exe C:\Windows\SysWOW64\cmd.exe
PID 2712 wrote to memory of 2424 N/A C:\Users\Admin\AppData\Local\Temp\avscan.exe C:\Windows\SysWOW64\cmd.exe
PID 2712 wrote to memory of 2424 N/A C:\Users\Admin\AppData\Local\Temp\avscan.exe C:\Windows\SysWOW64\cmd.exe
PID 2712 wrote to memory of 2424 N/A C:\Users\Admin\AppData\Local\Temp\avscan.exe C:\Windows\SysWOW64\cmd.exe
PID 2252 wrote to memory of 2536 N/A C:\Users\Admin\AppData\Local\Temp\d705057413dc54e9b1866a194f00a1ce63871d99a4ff76ff7f4035eacf2ff733.exe C:\Windows\SysWOW64\cmd.exe
PID 2252 wrote to memory of 2536 N/A C:\Users\Admin\AppData\Local\Temp\d705057413dc54e9b1866a194f00a1ce63871d99a4ff76ff7f4035eacf2ff733.exe C:\Windows\SysWOW64\cmd.exe
PID 2252 wrote to memory of 2536 N/A C:\Users\Admin\AppData\Local\Temp\d705057413dc54e9b1866a194f00a1ce63871d99a4ff76ff7f4035eacf2ff733.exe C:\Windows\SysWOW64\cmd.exe
PID 2252 wrote to memory of 2536 N/A C:\Users\Admin\AppData\Local\Temp\d705057413dc54e9b1866a194f00a1ce63871d99a4ff76ff7f4035eacf2ff733.exe C:\Windows\SysWOW64\cmd.exe
PID 2424 wrote to memory of 2568 N/A C:\Windows\SysWOW64\cmd.exe C:\windows\hosts.exe
PID 2424 wrote to memory of 2568 N/A C:\Windows\SysWOW64\cmd.exe C:\windows\hosts.exe
PID 2424 wrote to memory of 2568 N/A C:\Windows\SysWOW64\cmd.exe C:\windows\hosts.exe
PID 2424 wrote to memory of 2568 N/A C:\Windows\SysWOW64\cmd.exe C:\windows\hosts.exe
PID 2536 wrote to memory of 2476 N/A C:\Windows\SysWOW64\cmd.exe C:\windows\hosts.exe
PID 2536 wrote to memory of 2476 N/A C:\Windows\SysWOW64\cmd.exe C:\windows\hosts.exe
PID 2536 wrote to memory of 2476 N/A C:\Windows\SysWOW64\cmd.exe C:\windows\hosts.exe
PID 2536 wrote to memory of 2476 N/A C:\Windows\SysWOW64\cmd.exe C:\windows\hosts.exe
PID 2424 wrote to memory of 2576 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\WScript.exe
PID 2424 wrote to memory of 2576 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\WScript.exe
PID 2424 wrote to memory of 2576 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\WScript.exe
PID 2424 wrote to memory of 2576 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\WScript.exe
PID 2536 wrote to memory of 2736 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\WScript.exe
PID 2536 wrote to memory of 2736 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\WScript.exe
PID 2536 wrote to memory of 2736 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\WScript.exe
PID 2536 wrote to memory of 2736 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\WScript.exe
PID 2476 wrote to memory of 1616 N/A C:\windows\hosts.exe C:\Users\Admin\AppData\Local\Temp\avscan.exe
PID 2476 wrote to memory of 1616 N/A C:\windows\hosts.exe C:\Users\Admin\AppData\Local\Temp\avscan.exe
PID 2476 wrote to memory of 1616 N/A C:\windows\hosts.exe C:\Users\Admin\AppData\Local\Temp\avscan.exe
PID 2476 wrote to memory of 1616 N/A C:\windows\hosts.exe C:\Users\Admin\AppData\Local\Temp\avscan.exe
PID 2476 wrote to memory of 2336 N/A C:\windows\hosts.exe C:\Windows\SysWOW64\cmd.exe
PID 2476 wrote to memory of 2336 N/A C:\windows\hosts.exe C:\Windows\SysWOW64\cmd.exe
PID 2476 wrote to memory of 2336 N/A C:\windows\hosts.exe C:\Windows\SysWOW64\cmd.exe
PID 2476 wrote to memory of 2336 N/A C:\windows\hosts.exe C:\Windows\SysWOW64\cmd.exe
PID 2336 wrote to memory of 1796 N/A C:\Windows\SysWOW64\cmd.exe C:\windows\hosts.exe
PID 2336 wrote to memory of 1796 N/A C:\Windows\SysWOW64\cmd.exe C:\windows\hosts.exe
PID 2336 wrote to memory of 1796 N/A C:\Windows\SysWOW64\cmd.exe C:\windows\hosts.exe
PID 2336 wrote to memory of 1796 N/A C:\Windows\SysWOW64\cmd.exe C:\windows\hosts.exe
PID 2336 wrote to memory of 1956 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\WScript.exe
PID 2336 wrote to memory of 1956 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\WScript.exe
PID 2336 wrote to memory of 1956 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\WScript.exe
PID 2336 wrote to memory of 1956 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\WScript.exe
PID 2712 wrote to memory of 1408 N/A C:\Users\Admin\AppData\Local\Temp\avscan.exe C:\Windows\SysWOW64\REG.exe
PID 2712 wrote to memory of 1408 N/A C:\Users\Admin\AppData\Local\Temp\avscan.exe C:\Windows\SysWOW64\REG.exe
PID 2712 wrote to memory of 1408 N/A C:\Users\Admin\AppData\Local\Temp\avscan.exe C:\Windows\SysWOW64\REG.exe
PID 2712 wrote to memory of 1408 N/A C:\Users\Admin\AppData\Local\Temp\avscan.exe C:\Windows\SysWOW64\REG.exe
PID 2476 wrote to memory of 628 N/A C:\windows\hosts.exe C:\Windows\SysWOW64\REG.exe
PID 2476 wrote to memory of 628 N/A C:\windows\hosts.exe C:\Windows\SysWOW64\REG.exe
PID 2476 wrote to memory of 628 N/A C:\windows\hosts.exe C:\Windows\SysWOW64\REG.exe
PID 2476 wrote to memory of 628 N/A C:\windows\hosts.exe C:\Windows\SysWOW64\REG.exe
PID 2712 wrote to memory of 2596 N/A C:\Users\Admin\AppData\Local\Temp\avscan.exe C:\Windows\SysWOW64\REG.exe
PID 2712 wrote to memory of 2596 N/A C:\Users\Admin\AppData\Local\Temp\avscan.exe C:\Windows\SysWOW64\REG.exe
PID 2712 wrote to memory of 2596 N/A C:\Users\Admin\AppData\Local\Temp\avscan.exe C:\Windows\SysWOW64\REG.exe
PID 2712 wrote to memory of 2596 N/A C:\Users\Admin\AppData\Local\Temp\avscan.exe C:\Windows\SysWOW64\REG.exe

Processes

C:\Users\Admin\AppData\Local\Temp\d705057413dc54e9b1866a194f00a1ce63871d99a4ff76ff7f4035eacf2ff733.exe

"C:\Users\Admin\AppData\Local\Temp\d705057413dc54e9b1866a194f00a1ce63871d99a4ff76ff7f4035eacf2ff733.exe"

C:\Windows\SysWOW64\REG.exe

REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f

C:\Users\Admin\AppData\Local\Temp\avscan.exe

C:\Users\Admin\AppData\Local\Temp\avscan.exe

C:\Users\Admin\AppData\Local\Temp\avscan.exe

C:\Users\Admin\AppData\Local\Temp\avscan.exe

C:\Windows\SysWOW64\cmd.exe

cmd /c c:\windows\W_X_C.bat

C:\Windows\SysWOW64\cmd.exe

cmd /c c:\windows\W_X_C.bat

C:\windows\hosts.exe

C:\windows\hosts.exe

C:\windows\hosts.exe

C:\windows\hosts.exe

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Windows\W_X_C.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Windows\W_X_C.vbs"

C:\Users\Admin\AppData\Local\Temp\avscan.exe

C:\Users\Admin\AppData\Local\Temp\avscan.exe

C:\Windows\SysWOW64\cmd.exe

cmd /c c:\windows\W_X_C.bat

C:\windows\hosts.exe

C:\windows\hosts.exe

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Windows\W_X_C.vbs"

C:\Windows\SysWOW64\REG.exe

REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f

C:\Windows\SysWOW64\REG.exe

REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f

C:\Windows\SysWOW64\REG.exe

REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f

C:\Windows\SysWOW64\REG.exe

REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f

C:\Windows\SysWOW64\REG.exe

REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f

C:\Windows\SysWOW64\REG.exe

REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f

C:\Windows\SysWOW64\REG.exe

REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f

C:\Windows\SysWOW64\REG.exe

REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f

Network

N/A

Files

\Users\Admin\AppData\Local\Temp\avscan.exe

MD5 a675c9a7730ee67627e97530246ac897
SHA1 486dde1a44be463beae1979abd00dec65147d699
SHA256 9296b3755508648639b0cc5869c0f9d56fc4b77606acf2ca384aa005da0049c2
SHA512 e22aa16b9c05e2cac97cf0bc4fe0cc5e4c7ad851d039f74abf1d4b3644258a6f9179ebc4ee8380adbc37f7f3cc35243417f3f4599b9838b91cea30f9b6795ee6

C:\Windows\hosts.exe

MD5 0209c052a3ddedbb1312c7886e5ed35e
SHA1 9d31a6776552a496d2e0702dc86bd7f1e423ec0f
SHA256 fcb5f876d8bbf2ca477101b6999ed39b6c424768b27c864ce1a67b1e7cc08bb4
SHA512 9c54faed8fa574175a122ae764ab79a356574bc6c113a280ed325e36d7a1b66fbd233d966a5ef739d35b901ff80a0a38fe028b38fed9611604eafb8ac33a72c9

\??\c:\windows\W_X_C.bat

MD5 4db9f8b6175722b62ececeeeba1ce307
SHA1 3b3ba8414706e72a6fa19e884a97b87609e11e47
SHA256 d2150b9e5a4ce55e140f0ca91c4e300715d42095c8fddf58c77037cdd2cfaf78
SHA512 1d6dc274cf7a3dd704f840e6a5ad57ab4c4e35d5f09489aeff520bb797e1c825bac53fc335156fe41e767a46520d031855fe42fe7b175409ebe5e9e986fb9b8b

C:\Windows\W_X_C.vbs

MD5 953cf5c915c9c58501354c4826dea466
SHA1 2934232a159f5c3738212aa3ece4cdd45ba8cfe4
SHA256 bbdb3fb588b1aca990fbc6355f577bdd40c60e69d9951142da5e8dc84e0b33ed
SHA512 77472ee7f75bee37380d22c14e698b07240c0177b1b4850b72b5ee05136cf17ac3e391b26c6876bfed15049326cd0e2717d0f1de8c4fffba4cd83446218c3147

memory/1616-63-0x0000000000220000-0x0000000000230000-memory.dmp

memory/1616-62-0x0000000000220000-0x0000000000230000-memory.dmp

memory/2568-61-0x0000000000220000-0x0000000000230000-memory.dmp

memory/2568-60-0x0000000000220000-0x0000000000230000-memory.dmp

memory/2536-54-0x00000000024E0000-0x00000000025E0000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\Admin.bmp

MD5 3d28f6b0764292d6d75f229775f794dc
SHA1 1bd9e2f5441cfa9432a0b0f93d8df3db58c17d76
SHA256 981ea45547f538f99131564c0fd7ae40551ee8aaac8dbd5d5c843c4edc589646
SHA512 0af11d4718e9f529e260bbd8b7772d9b986bdb80d3bf87973dbad84bfd0c541af0ca52048e323eeea3a4f3d666884d5a591ff5fb667ecaf07282852424a1b18f

C:\Users\Admin\AppData\Local\Temp\Admin.bmp

MD5 4444344f1bd137b4a31a301ed6396a85
SHA1 8a13fea20364346c769e92ec4d2a3f9c9b35db86
SHA256 336b277b9b168bc265f3cf9ff876deee66f6d29e25f15d0747e1a5a3f7d9a8b9
SHA512 e11dfcbb6c7467fe8db6e4c5ddf5f22c7edefb1eb4e5883a40f0925c51325477af8e65268609801d1cdc37aa6f5477a27c8754a34c59ff13dbc90028ab3c7820

C:\Users\Admin\AppData\Local\Temp\Admin.bmp

MD5 bc134e95f783945f773813d07b6f0a24
SHA1 b831b4f7226eca9b884346c9697605e9476b7e07
SHA256 b0cde599ff36e3ee8afae7b82b32003b2d78b7de50226ad4cbc41a6a49cb7f21
SHA512 5466482189582ae3f180ea8fda968b876a7fd6a97fe403bf1f5c134ee1e213c82ef0a17ac3215274c8bda1be77f38e6a577f1450adc5553cee46bb1cc6159276

C:\Users\Admin\AppData\Local\Temp\Admin.bmp

MD5 c0198cb6707b435c5ad24f0d2765efba
SHA1 ce8888f7fe4fd8104ca35ee27f19257181d42902
SHA256 638dbbadde7b390f809b56479317c41861ecee44b713776ebe5a0e127ce6f1b6
SHA512 8b2719ee3b90015f39e0932c22393e4e94617d620f73769ada36e1a3263ffc995c59a343fcc8981e66fe1db1b09914e60d903c98fba07c8a1bb4af9f9eefb8a6

C:\Users\Admin\AppData\Local\Temp\Admin.bmp

MD5 426d7465f26dcfe7c0ccc0ff8fa70904
SHA1 7b1d509f0f3f265a36c9f4056db47fb57c944464
SHA256 030650ef3ad0ad4394825d7795a960bb34a05462b694e7549ba066cca5848e95
SHA512 c3199ea13094e26a5189fbc138feb4e87204e36099db52dc36effc8034709c8e8b4f310fcc37ca8c0f5e1964256856b114054afbff9da00bcc31c69dd0062238

C:\Users\Admin\AppData\Local\Temp\Admin.bmp

MD5 6bc4eeff6010720fccb0deb6289fefdb
SHA1 af6f7511b53f61e82f8444343bddd5fb883ecc33
SHA256 eca0acc98f3093bfe9ae6db5508c2a7d9ce0d1210433643657912e88108e87d2
SHA512 67ca87c3ab39500be0231f1469e686020a8693311e20be48cf459d96f6f074b180507e6e845ad502e026bba28f2149d77bd1d777e6cf5526da6195da7848f29c

C:\Users\Admin\AppData\Local\Temp\Admin.bmp

MD5 77c0b8ddeed4328dbcde227b14dbd26b
SHA1 a8e46ddff07b7287e10619f60950491c686801ee
SHA256 63f28c924a98a42eefb7b6866ae7734f53ee2382dfc59ef0ff643e2e1ebae81b
SHA512 d1c15f6dec00922739a8e2636739c16f47080f96d6bd788f932100788d99b8710efbd81444cb3ac2b76a412594785feabd3f0173e41c37df259fdfd660a2430a

Analysis: behavioral2

Detonation Overview

Submitted

2024-06-14 04:37

Reported

2024-06-14 04:39

Platform

win10v2004-20240226-en

Max time kernel

143s

Max time network

158s

Command Line

"C:\Users\Admin\AppData\Local\Temp\d705057413dc54e9b1866a194f00a1ce63871d99a4ff76ff7f4035eacf2ff733.exe"

Signatures

Modifies visibility of file extensions in Explorer

evasion
Description Indicator Process Target
Set value (int) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" C:\windows\hosts.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" C:\Users\Admin\AppData\Local\Temp\d705057413dc54e9b1866a194f00a1ce63871d99a4ff76ff7f4035eacf2ff733.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" C:\Users\Admin\AppData\Local\Temp\avscan.exe N/A

Modifies visiblity of hidden/system files in Explorer

evasion
Description Indicator Process Target
Set value (int) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" C:\Users\Admin\AppData\Local\Temp\d705057413dc54e9b1866a194f00a1ce63871d99a4ff76ff7f4035eacf2ff733.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" C:\Users\Admin\AppData\Local\Temp\avscan.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" C:\windows\hosts.exe N/A

Adds policy Run key to start application

persistence
Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run C:\Windows\SysWOW64\WScript.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\OAILVCNY = "W_X_C.bat" C:\Windows\SysWOW64\WScript.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run C:\Windows\SysWOW64\WScript.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\OAILVCNY = "W_X_C.bat" C:\Windows\SysWOW64\WScript.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run C:\Windows\SysWOW64\WScript.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\OAILVCNY = "W_X_C.bat" C:\Windows\SysWOW64\WScript.exe N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation C:\Windows\SysWOW64\cmd.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation C:\Windows\SysWOW64\cmd.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation C:\Windows\SysWOW64\cmd.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\avscan = "C:\\Users\\Admin\\AppData\\Local\\Temp\\avscan.exe" C:\Users\Admin\AppData\Local\Temp\d705057413dc54e9b1866a194f00a1ce63871d99a4ff76ff7f4035eacf2ff733.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\avscan = "C:\\Users\\Admin\\AppData\\Local\\Temp\\avscan.exe" C:\Users\Admin\AppData\Local\Temp\avscan.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\avscan = "C:\\Users\\Admin\\AppData\\Local\\Temp\\avscan.exe" C:\windows\hosts.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File created C:\windows\W_X_C.vbs C:\Users\Admin\AppData\Local\Temp\d705057413dc54e9b1866a194f00a1ce63871d99a4ff76ff7f4035eacf2ff733.exe N/A
File created \??\c:\windows\W_X_C.bat C:\Users\Admin\AppData\Local\Temp\d705057413dc54e9b1866a194f00a1ce63871d99a4ff76ff7f4035eacf2ff733.exe N/A
File opened for modification C:\Windows\hosts.exe C:\Users\Admin\AppData\Local\Temp\d705057413dc54e9b1866a194f00a1ce63871d99a4ff76ff7f4035eacf2ff733.exe N/A
File opened for modification C:\Windows\hosts.exe C:\Users\Admin\AppData\Local\Temp\avscan.exe N/A
File opened for modification C:\Windows\hosts.exe C:\windows\hosts.exe N/A

Enumerates physical storage devices

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Local Settings C:\Users\Admin\AppData\Local\Temp\d705057413dc54e9b1866a194f00a1ce63871d99a4ff76ff7f4035eacf2ff733.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Local Settings C:\Windows\SysWOW64\cmd.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Local Settings C:\Windows\SysWOW64\cmd.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Local Settings C:\Windows\SysWOW64\cmd.exe N/A

Suspicious behavior: GetForegroundWindowSpam

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\d705057413dc54e9b1866a194f00a1ce63871d99a4ff76ff7f4035eacf2ff733.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\avscan.exe N/A
N/A N/A C:\windows\hosts.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 3684 wrote to memory of 3776 N/A C:\Users\Admin\AppData\Local\Temp\d705057413dc54e9b1866a194f00a1ce63871d99a4ff76ff7f4035eacf2ff733.exe C:\Windows\SysWOW64\REG.exe
PID 3684 wrote to memory of 3776 N/A C:\Users\Admin\AppData\Local\Temp\d705057413dc54e9b1866a194f00a1ce63871d99a4ff76ff7f4035eacf2ff733.exe C:\Windows\SysWOW64\REG.exe
PID 3684 wrote to memory of 3776 N/A C:\Users\Admin\AppData\Local\Temp\d705057413dc54e9b1866a194f00a1ce63871d99a4ff76ff7f4035eacf2ff733.exe C:\Windows\SysWOW64\REG.exe
PID 3684 wrote to memory of 4956 N/A C:\Users\Admin\AppData\Local\Temp\d705057413dc54e9b1866a194f00a1ce63871d99a4ff76ff7f4035eacf2ff733.exe C:\Users\Admin\AppData\Local\Temp\avscan.exe
PID 3684 wrote to memory of 4956 N/A C:\Users\Admin\AppData\Local\Temp\d705057413dc54e9b1866a194f00a1ce63871d99a4ff76ff7f4035eacf2ff733.exe C:\Users\Admin\AppData\Local\Temp\avscan.exe
PID 3684 wrote to memory of 4956 N/A C:\Users\Admin\AppData\Local\Temp\d705057413dc54e9b1866a194f00a1ce63871d99a4ff76ff7f4035eacf2ff733.exe C:\Users\Admin\AppData\Local\Temp\avscan.exe
PID 4956 wrote to memory of 1496 N/A C:\Users\Admin\AppData\Local\Temp\avscan.exe C:\Users\Admin\AppData\Local\Temp\avscan.exe
PID 4956 wrote to memory of 1496 N/A C:\Users\Admin\AppData\Local\Temp\avscan.exe C:\Users\Admin\AppData\Local\Temp\avscan.exe
PID 4956 wrote to memory of 1496 N/A C:\Users\Admin\AppData\Local\Temp\avscan.exe C:\Users\Admin\AppData\Local\Temp\avscan.exe
PID 4956 wrote to memory of 2076 N/A C:\Users\Admin\AppData\Local\Temp\avscan.exe C:\Windows\SysWOW64\cmd.exe
PID 4956 wrote to memory of 2076 N/A C:\Users\Admin\AppData\Local\Temp\avscan.exe C:\Windows\SysWOW64\cmd.exe
PID 4956 wrote to memory of 2076 N/A C:\Users\Admin\AppData\Local\Temp\avscan.exe C:\Windows\SysWOW64\cmd.exe
PID 3684 wrote to memory of 116 N/A C:\Users\Admin\AppData\Local\Temp\d705057413dc54e9b1866a194f00a1ce63871d99a4ff76ff7f4035eacf2ff733.exe C:\Windows\SysWOW64\cmd.exe
PID 3684 wrote to memory of 116 N/A C:\Users\Admin\AppData\Local\Temp\d705057413dc54e9b1866a194f00a1ce63871d99a4ff76ff7f4035eacf2ff733.exe C:\Windows\SysWOW64\cmd.exe
PID 3684 wrote to memory of 116 N/A C:\Users\Admin\AppData\Local\Temp\d705057413dc54e9b1866a194f00a1ce63871d99a4ff76ff7f4035eacf2ff733.exe C:\Windows\SysWOW64\cmd.exe
PID 2076 wrote to memory of 4848 N/A C:\Windows\SysWOW64\cmd.exe C:\windows\hosts.exe
PID 116 wrote to memory of 4684 N/A C:\Windows\SysWOW64\cmd.exe C:\windows\hosts.exe
PID 2076 wrote to memory of 4848 N/A C:\Windows\SysWOW64\cmd.exe C:\windows\hosts.exe
PID 2076 wrote to memory of 4848 N/A C:\Windows\SysWOW64\cmd.exe C:\windows\hosts.exe
PID 116 wrote to memory of 4684 N/A C:\Windows\SysWOW64\cmd.exe C:\windows\hosts.exe
PID 116 wrote to memory of 4684 N/A C:\Windows\SysWOW64\cmd.exe C:\windows\hosts.exe
PID 4848 wrote to memory of 652 N/A C:\windows\hosts.exe C:\Users\Admin\AppData\Local\Temp\avscan.exe
PID 4848 wrote to memory of 652 N/A C:\windows\hosts.exe C:\Users\Admin\AppData\Local\Temp\avscan.exe
PID 4848 wrote to memory of 652 N/A C:\windows\hosts.exe C:\Users\Admin\AppData\Local\Temp\avscan.exe
PID 4848 wrote to memory of 1640 N/A C:\windows\hosts.exe C:\Windows\SysWOW64\cmd.exe
PID 4848 wrote to memory of 1640 N/A C:\windows\hosts.exe C:\Windows\SysWOW64\cmd.exe
PID 4848 wrote to memory of 1640 N/A C:\windows\hosts.exe C:\Windows\SysWOW64\cmd.exe
PID 1640 wrote to memory of 3484 N/A C:\Windows\SysWOW64\cmd.exe C:\windows\hosts.exe
PID 1640 wrote to memory of 3484 N/A C:\Windows\SysWOW64\cmd.exe C:\windows\hosts.exe
PID 1640 wrote to memory of 3484 N/A C:\Windows\SysWOW64\cmd.exe C:\windows\hosts.exe
PID 116 wrote to memory of 1440 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\WScript.exe
PID 116 wrote to memory of 1440 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\WScript.exe
PID 116 wrote to memory of 1440 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\WScript.exe
PID 1640 wrote to memory of 1248 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\WScript.exe
PID 1640 wrote to memory of 1248 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\WScript.exe
PID 1640 wrote to memory of 1248 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\WScript.exe
PID 2076 wrote to memory of 3600 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\WScript.exe
PID 2076 wrote to memory of 3600 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\WScript.exe
PID 2076 wrote to memory of 3600 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\WScript.exe
PID 4956 wrote to memory of 1452 N/A C:\Users\Admin\AppData\Local\Temp\avscan.exe C:\Windows\SysWOW64\REG.exe
PID 4956 wrote to memory of 1452 N/A C:\Users\Admin\AppData\Local\Temp\avscan.exe C:\Windows\SysWOW64\REG.exe
PID 4956 wrote to memory of 1452 N/A C:\Users\Admin\AppData\Local\Temp\avscan.exe C:\Windows\SysWOW64\REG.exe
PID 4848 wrote to memory of 1284 N/A C:\windows\hosts.exe C:\Windows\SysWOW64\REG.exe
PID 4848 wrote to memory of 1284 N/A C:\windows\hosts.exe C:\Windows\SysWOW64\REG.exe
PID 4848 wrote to memory of 1284 N/A C:\windows\hosts.exe C:\Windows\SysWOW64\REG.exe
PID 4956 wrote to memory of 4124 N/A C:\Users\Admin\AppData\Local\Temp\avscan.exe C:\Windows\SysWOW64\REG.exe
PID 4956 wrote to memory of 4124 N/A C:\Users\Admin\AppData\Local\Temp\avscan.exe C:\Windows\SysWOW64\REG.exe
PID 4956 wrote to memory of 4124 N/A C:\Users\Admin\AppData\Local\Temp\avscan.exe C:\Windows\SysWOW64\REG.exe
PID 4848 wrote to memory of 3924 N/A C:\windows\hosts.exe C:\Windows\SysWOW64\REG.exe
PID 4848 wrote to memory of 3924 N/A C:\windows\hosts.exe C:\Windows\SysWOW64\REG.exe
PID 4848 wrote to memory of 3924 N/A C:\windows\hosts.exe C:\Windows\SysWOW64\REG.exe
PID 4956 wrote to memory of 4156 N/A C:\Users\Admin\AppData\Local\Temp\avscan.exe C:\Windows\SysWOW64\REG.exe
PID 4956 wrote to memory of 4156 N/A C:\Users\Admin\AppData\Local\Temp\avscan.exe C:\Windows\SysWOW64\REG.exe
PID 4956 wrote to memory of 4156 N/A C:\Users\Admin\AppData\Local\Temp\avscan.exe C:\Windows\SysWOW64\REG.exe
PID 4848 wrote to memory of 3400 N/A C:\windows\hosts.exe C:\Windows\SysWOW64\REG.exe
PID 4848 wrote to memory of 3400 N/A C:\windows\hosts.exe C:\Windows\SysWOW64\REG.exe
PID 4848 wrote to memory of 3400 N/A C:\windows\hosts.exe C:\Windows\SysWOW64\REG.exe
PID 4956 wrote to memory of 1548 N/A C:\Users\Admin\AppData\Local\Temp\avscan.exe C:\Windows\SysWOW64\REG.exe
PID 4956 wrote to memory of 1548 N/A C:\Users\Admin\AppData\Local\Temp\avscan.exe C:\Windows\SysWOW64\REG.exe
PID 4956 wrote to memory of 1548 N/A C:\Users\Admin\AppData\Local\Temp\avscan.exe C:\Windows\SysWOW64\REG.exe
PID 4848 wrote to memory of 1152 N/A C:\windows\hosts.exe C:\Windows\SysWOW64\REG.exe
PID 4848 wrote to memory of 1152 N/A C:\windows\hosts.exe C:\Windows\SysWOW64\REG.exe
PID 4848 wrote to memory of 1152 N/A C:\windows\hosts.exe C:\Windows\SysWOW64\REG.exe

Processes

C:\Users\Admin\AppData\Local\Temp\d705057413dc54e9b1866a194f00a1ce63871d99a4ff76ff7f4035eacf2ff733.exe

"C:\Users\Admin\AppData\Local\Temp\d705057413dc54e9b1866a194f00a1ce63871d99a4ff76ff7f4035eacf2ff733.exe"

C:\Windows\SysWOW64\REG.exe

REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f

C:\Users\Admin\AppData\Local\Temp\avscan.exe

C:\Users\Admin\AppData\Local\Temp\avscan.exe

C:\Users\Admin\AppData\Local\Temp\avscan.exe

C:\Users\Admin\AppData\Local\Temp\avscan.exe

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c c:\windows\W_X_C.bat

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c c:\windows\W_X_C.bat

C:\windows\hosts.exe

C:\windows\hosts.exe

C:\windows\hosts.exe

C:\windows\hosts.exe

C:\Users\Admin\AppData\Local\Temp\avscan.exe

C:\Users\Admin\AppData\Local\Temp\avscan.exe

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c c:\windows\W_X_C.bat

C:\windows\hosts.exe

C:\windows\hosts.exe

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Windows\W_X_C.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Windows\W_X_C.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Windows\W_X_C.vbs"

C:\Windows\System32\rundll32.exe

C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4256 --field-trial-handle=2252,i,16022092570067181109,3235558581947505669,262144 --variations-seed-version /prefetch:8

C:\Windows\SysWOW64\REG.exe

REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f

C:\Windows\SysWOW64\REG.exe

REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f

C:\Windows\SysWOW64\REG.exe

REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f

C:\Windows\SysWOW64\REG.exe

REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f

C:\Windows\SysWOW64\REG.exe

REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f

C:\Windows\SysWOW64\REG.exe

REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f

C:\Windows\SysWOW64\REG.exe

REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f

C:\Windows\SysWOW64\REG.exe

REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f

Network

Country Destination Domain Proto
US 8.8.8.8:53 228.249.119.40.in-addr.arpa udp
US 8.8.8.8:53 172.214.232.199.in-addr.arpa udp
US 8.8.8.8:53 72.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 154.239.44.20.in-addr.arpa udp
US 8.8.8.8:53 157.123.68.40.in-addr.arpa udp
US 8.8.8.8:53 18.31.95.13.in-addr.arpa udp
US 8.8.8.8:53 13.227.111.52.in-addr.arpa udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 8.8.8.8:53 213.143.182.52.in-addr.arpa udp

Files

C:\Users\Admin\AppData\Local\Temp\avscan.exe

MD5 2a8dcf9eac68d7b232bedad5e38c7f59
SHA1 fc4148160b1958c024d5380d24f6c890eef019b2
SHA256 4b33ab5ce9c5b26694d1549c9d4eaaa2550f96336e401ab2f91c6b8f54b0a8f7
SHA512 253976ace1f16dcd49f5410867f96350805873518668bdeb2c927b4c4f792ca4fecd3c9181b63906b52c7830c6331d7195994343c63c96d46975e6a76af49f20

C:\Windows\hosts.exe

MD5 46410692a3b4db8d613d2592afeb392b
SHA1 a808009cec4eec85c3d040478a715d353cc6f83b
SHA256 a2dc78ea89cd069ee4ae116f3e032720a23b66e019580ae2ed74512162b09d56
SHA512 31d2f81b31e2da4d06e973cb99f8c9535d892ab8b84c1392e7eddcf87017cef948a50e1c033b011b6899a89794e64f7bb3eef7283aadb8b3041c0588372d3255

\??\c:\windows\W_X_C.bat

MD5 4db9f8b6175722b62ececeeeba1ce307
SHA1 3b3ba8414706e72a6fa19e884a97b87609e11e47
SHA256 d2150b9e5a4ce55e140f0ca91c4e300715d42095c8fddf58c77037cdd2cfaf78
SHA512 1d6dc274cf7a3dd704f840e6a5ad57ab4c4e35d5f09489aeff520bb797e1c825bac53fc335156fe41e767a46520d031855fe42fe7b175409ebe5e9e986fb9b8b

C:\Windows\W_X_C.vbs

MD5 0b7843cfac17421f5112f317542457da
SHA1 60383d2b53c315cef3e26e2254448623fbf75de2
SHA256 b5006a0ac0b2c3200787642471940c08570b8f21eb46a03b5e53d103cb99a8c7
SHA512 cf57206cd2828e2e4ca2f6b2ac8818cf30c5c6d69854f719bcb3296b674d7d02d6067453965220948418fc995aa6d8441a30736f5fa9ce46d01d4056801ff918