Malware Analysis Report

2025-01-06 12:11

Sample ID 240614-f11stawfmd
Target e609755ba4dca66179e8fd79e85423623d51fc183e5bbc840e0784f4c781aaf1
SHA256 e609755ba4dca66179e8fd79e85423623d51fc183e5bbc840e0784f4c781aaf1
Tags
evasion persistence
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

e609755ba4dca66179e8fd79e85423623d51fc183e5bbc840e0784f4c781aaf1

Threat Level: Known bad

The file e609755ba4dca66179e8fd79e85423623d51fc183e5bbc840e0784f4c781aaf1 was found to be: Known bad.

Malicious Activity Summary

evasion persistence

Modifies visiblity of hidden/system files in Explorer

Modifies visibility of file extensions in Explorer

Adds policy Run key to start application

Checks computer location settings

Loads dropped DLL

Executes dropped EXE

Adds Run key to start application

Drops file in Windows directory

Enumerates physical storage devices

Unsigned PE

Suspicious behavior: GetForegroundWindowSpam

Suspicious use of WriteProcessMemory

Modifies registry class

Suspicious use of SetWindowsHookEx

Modifies registry key

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-06-14 05:21

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-06-14 05:21

Reported

2024-06-14 05:23

Platform

win7-20240611-en

Max time kernel

121s

Max time network

118s

Command Line

"C:\Users\Admin\AppData\Local\Temp\e609755ba4dca66179e8fd79e85423623d51fc183e5bbc840e0784f4c781aaf1.exe"

Signatures

Modifies visibility of file extensions in Explorer

evasion
Description Indicator Process Target
Set value (int) \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" C:\Users\Admin\AppData\Local\Temp\e609755ba4dca66179e8fd79e85423623d51fc183e5bbc840e0784f4c781aaf1.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" C:\Users\Admin\AppData\Local\Temp\avscan.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" C:\windows\hosts.exe N/A

Modifies visiblity of hidden/system files in Explorer

evasion
Description Indicator Process Target
Set value (int) \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" C:\windows\hosts.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" C:\Users\Admin\AppData\Local\Temp\e609755ba4dca66179e8fd79e85423623d51fc183e5bbc840e0784f4c781aaf1.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" C:\Users\Admin\AppData\Local\Temp\avscan.exe N/A

Adds policy Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\JAFTUVRJ = "W_X_C.bat" C:\Windows\SysWOW64\WScript.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run C:\Windows\SysWOW64\WScript.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\JAFTUVRJ = "W_X_C.bat" C:\Windows\SysWOW64\WScript.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run C:\Windows\SysWOW64\WScript.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\JAFTUVRJ = "W_X_C.bat" C:\Windows\SysWOW64\WScript.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run C:\Windows\SysWOW64\WScript.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\avscan = "C:\\Users\\Admin\\AppData\\Local\\Temp\\avscan.exe" C:\Users\Admin\AppData\Local\Temp\e609755ba4dca66179e8fd79e85423623d51fc183e5bbc840e0784f4c781aaf1.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\avscan = "C:\\Users\\Admin\\AppData\\Local\\Temp\\avscan.exe" C:\Users\Admin\AppData\Local\Temp\avscan.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\avscan = "C:\\Users\\Admin\\AppData\\Local\\Temp\\avscan.exe" C:\windows\hosts.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File opened for modification C:\Windows\hosts.exe C:\Users\Admin\AppData\Local\Temp\avscan.exe N/A
File opened for modification C:\Windows\hosts.exe C:\windows\hosts.exe N/A
File created C:\windows\W_X_C.vbs C:\Users\Admin\AppData\Local\Temp\e609755ba4dca66179e8fd79e85423623d51fc183e5bbc840e0784f4c781aaf1.exe N/A
File created \??\c:\windows\W_X_C.bat C:\Users\Admin\AppData\Local\Temp\e609755ba4dca66179e8fd79e85423623d51fc183e5bbc840e0784f4c781aaf1.exe N/A
File opened for modification C:\Windows\hosts.exe C:\Users\Admin\AppData\Local\Temp\e609755ba4dca66179e8fd79e85423623d51fc183e5bbc840e0784f4c781aaf1.exe N/A

Enumerates physical storage devices

Suspicious behavior: GetForegroundWindowSpam

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\avscan.exe N/A
N/A N/A C:\windows\hosts.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2044 wrote to memory of 3040 N/A C:\Users\Admin\AppData\Local\Temp\e609755ba4dca66179e8fd79e85423623d51fc183e5bbc840e0784f4c781aaf1.exe C:\Windows\SysWOW64\REG.exe
PID 2044 wrote to memory of 3040 N/A C:\Users\Admin\AppData\Local\Temp\e609755ba4dca66179e8fd79e85423623d51fc183e5bbc840e0784f4c781aaf1.exe C:\Windows\SysWOW64\REG.exe
PID 2044 wrote to memory of 3040 N/A C:\Users\Admin\AppData\Local\Temp\e609755ba4dca66179e8fd79e85423623d51fc183e5bbc840e0784f4c781aaf1.exe C:\Windows\SysWOW64\REG.exe
PID 2044 wrote to memory of 3040 N/A C:\Users\Admin\AppData\Local\Temp\e609755ba4dca66179e8fd79e85423623d51fc183e5bbc840e0784f4c781aaf1.exe C:\Windows\SysWOW64\REG.exe
PID 2044 wrote to memory of 2732 N/A C:\Users\Admin\AppData\Local\Temp\e609755ba4dca66179e8fd79e85423623d51fc183e5bbc840e0784f4c781aaf1.exe C:\Users\Admin\AppData\Local\Temp\avscan.exe
PID 2044 wrote to memory of 2732 N/A C:\Users\Admin\AppData\Local\Temp\e609755ba4dca66179e8fd79e85423623d51fc183e5bbc840e0784f4c781aaf1.exe C:\Users\Admin\AppData\Local\Temp\avscan.exe
PID 2044 wrote to memory of 2732 N/A C:\Users\Admin\AppData\Local\Temp\e609755ba4dca66179e8fd79e85423623d51fc183e5bbc840e0784f4c781aaf1.exe C:\Users\Admin\AppData\Local\Temp\avscan.exe
PID 2044 wrote to memory of 2732 N/A C:\Users\Admin\AppData\Local\Temp\e609755ba4dca66179e8fd79e85423623d51fc183e5bbc840e0784f4c781aaf1.exe C:\Users\Admin\AppData\Local\Temp\avscan.exe
PID 2732 wrote to memory of 2540 N/A C:\Users\Admin\AppData\Local\Temp\avscan.exe C:\Users\Admin\AppData\Local\Temp\avscan.exe
PID 2732 wrote to memory of 2540 N/A C:\Users\Admin\AppData\Local\Temp\avscan.exe C:\Users\Admin\AppData\Local\Temp\avscan.exe
PID 2732 wrote to memory of 2540 N/A C:\Users\Admin\AppData\Local\Temp\avscan.exe C:\Users\Admin\AppData\Local\Temp\avscan.exe
PID 2732 wrote to memory of 2540 N/A C:\Users\Admin\AppData\Local\Temp\avscan.exe C:\Users\Admin\AppData\Local\Temp\avscan.exe
PID 2732 wrote to memory of 2808 N/A C:\Users\Admin\AppData\Local\Temp\avscan.exe C:\Windows\SysWOW64\cmd.exe
PID 2732 wrote to memory of 2808 N/A C:\Users\Admin\AppData\Local\Temp\avscan.exe C:\Windows\SysWOW64\cmd.exe
PID 2732 wrote to memory of 2808 N/A C:\Users\Admin\AppData\Local\Temp\avscan.exe C:\Windows\SysWOW64\cmd.exe
PID 2732 wrote to memory of 2808 N/A C:\Users\Admin\AppData\Local\Temp\avscan.exe C:\Windows\SysWOW64\cmd.exe
PID 2044 wrote to memory of 2792 N/A C:\Users\Admin\AppData\Local\Temp\e609755ba4dca66179e8fd79e85423623d51fc183e5bbc840e0784f4c781aaf1.exe C:\Windows\SysWOW64\cmd.exe
PID 2044 wrote to memory of 2792 N/A C:\Users\Admin\AppData\Local\Temp\e609755ba4dca66179e8fd79e85423623d51fc183e5bbc840e0784f4c781aaf1.exe C:\Windows\SysWOW64\cmd.exe
PID 2044 wrote to memory of 2792 N/A C:\Users\Admin\AppData\Local\Temp\e609755ba4dca66179e8fd79e85423623d51fc183e5bbc840e0784f4c781aaf1.exe C:\Windows\SysWOW64\cmd.exe
PID 2044 wrote to memory of 2792 N/A C:\Users\Admin\AppData\Local\Temp\e609755ba4dca66179e8fd79e85423623d51fc183e5bbc840e0784f4c781aaf1.exe C:\Windows\SysWOW64\cmd.exe
PID 2792 wrote to memory of 2772 N/A C:\Windows\SysWOW64\cmd.exe C:\windows\hosts.exe
PID 2792 wrote to memory of 2772 N/A C:\Windows\SysWOW64\cmd.exe C:\windows\hosts.exe
PID 2792 wrote to memory of 2772 N/A C:\Windows\SysWOW64\cmd.exe C:\windows\hosts.exe
PID 2792 wrote to memory of 2772 N/A C:\Windows\SysWOW64\cmd.exe C:\windows\hosts.exe
PID 2808 wrote to memory of 2668 N/A C:\Windows\SysWOW64\cmd.exe C:\windows\hosts.exe
PID 2808 wrote to memory of 2668 N/A C:\Windows\SysWOW64\cmd.exe C:\windows\hosts.exe
PID 2808 wrote to memory of 2668 N/A C:\Windows\SysWOW64\cmd.exe C:\windows\hosts.exe
PID 2808 wrote to memory of 2668 N/A C:\Windows\SysWOW64\cmd.exe C:\windows\hosts.exe
PID 2668 wrote to memory of 2528 N/A C:\windows\hosts.exe C:\Users\Admin\AppData\Local\Temp\avscan.exe
PID 2668 wrote to memory of 2528 N/A C:\windows\hosts.exe C:\Users\Admin\AppData\Local\Temp\avscan.exe
PID 2668 wrote to memory of 2528 N/A C:\windows\hosts.exe C:\Users\Admin\AppData\Local\Temp\avscan.exe
PID 2668 wrote to memory of 2528 N/A C:\windows\hosts.exe C:\Users\Admin\AppData\Local\Temp\avscan.exe
PID 2668 wrote to memory of 2040 N/A C:\windows\hosts.exe C:\Windows\SysWOW64\cmd.exe
PID 2668 wrote to memory of 2040 N/A C:\windows\hosts.exe C:\Windows\SysWOW64\cmd.exe
PID 2668 wrote to memory of 2040 N/A C:\windows\hosts.exe C:\Windows\SysWOW64\cmd.exe
PID 2668 wrote to memory of 2040 N/A C:\windows\hosts.exe C:\Windows\SysWOW64\cmd.exe
PID 2792 wrote to memory of 2008 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\WScript.exe
PID 2792 wrote to memory of 2008 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\WScript.exe
PID 2792 wrote to memory of 2008 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\WScript.exe
PID 2792 wrote to memory of 2008 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\WScript.exe
PID 2040 wrote to memory of 2276 N/A C:\Windows\SysWOW64\cmd.exe C:\windows\hosts.exe
PID 2040 wrote to memory of 2276 N/A C:\Windows\SysWOW64\cmd.exe C:\windows\hosts.exe
PID 2040 wrote to memory of 2276 N/A C:\Windows\SysWOW64\cmd.exe C:\windows\hosts.exe
PID 2040 wrote to memory of 2276 N/A C:\Windows\SysWOW64\cmd.exe C:\windows\hosts.exe
PID 2808 wrote to memory of 2620 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\WScript.exe
PID 2808 wrote to memory of 2620 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\WScript.exe
PID 2808 wrote to memory of 2620 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\WScript.exe
PID 2808 wrote to memory of 2620 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\WScript.exe
PID 2040 wrote to memory of 1924 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\WScript.exe
PID 2040 wrote to memory of 1924 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\WScript.exe
PID 2040 wrote to memory of 1924 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\WScript.exe
PID 2040 wrote to memory of 1924 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\WScript.exe
PID 2732 wrote to memory of 1508 N/A C:\Users\Admin\AppData\Local\Temp\avscan.exe C:\Windows\SysWOW64\REG.exe
PID 2732 wrote to memory of 1508 N/A C:\Users\Admin\AppData\Local\Temp\avscan.exe C:\Windows\SysWOW64\REG.exe
PID 2732 wrote to memory of 1508 N/A C:\Users\Admin\AppData\Local\Temp\avscan.exe C:\Windows\SysWOW64\REG.exe
PID 2732 wrote to memory of 1508 N/A C:\Users\Admin\AppData\Local\Temp\avscan.exe C:\Windows\SysWOW64\REG.exe
PID 2668 wrote to memory of 2836 N/A C:\windows\hosts.exe C:\Windows\SysWOW64\REG.exe
PID 2668 wrote to memory of 2836 N/A C:\windows\hosts.exe C:\Windows\SysWOW64\REG.exe
PID 2668 wrote to memory of 2836 N/A C:\windows\hosts.exe C:\Windows\SysWOW64\REG.exe
PID 2668 wrote to memory of 2836 N/A C:\windows\hosts.exe C:\Windows\SysWOW64\REG.exe
PID 2732 wrote to memory of 1608 N/A C:\Users\Admin\AppData\Local\Temp\avscan.exe C:\Windows\SysWOW64\REG.exe
PID 2732 wrote to memory of 1608 N/A C:\Users\Admin\AppData\Local\Temp\avscan.exe C:\Windows\SysWOW64\REG.exe
PID 2732 wrote to memory of 1608 N/A C:\Users\Admin\AppData\Local\Temp\avscan.exe C:\Windows\SysWOW64\REG.exe
PID 2732 wrote to memory of 1608 N/A C:\Users\Admin\AppData\Local\Temp\avscan.exe C:\Windows\SysWOW64\REG.exe

Processes

C:\Users\Admin\AppData\Local\Temp\e609755ba4dca66179e8fd79e85423623d51fc183e5bbc840e0784f4c781aaf1.exe

"C:\Users\Admin\AppData\Local\Temp\e609755ba4dca66179e8fd79e85423623d51fc183e5bbc840e0784f4c781aaf1.exe"

C:\Windows\SysWOW64\REG.exe

REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f

C:\Users\Admin\AppData\Local\Temp\avscan.exe

C:\Users\Admin\AppData\Local\Temp\avscan.exe

C:\Users\Admin\AppData\Local\Temp\avscan.exe

C:\Users\Admin\AppData\Local\Temp\avscan.exe

C:\Windows\SysWOW64\cmd.exe

cmd /c c:\windows\W_X_C.bat

C:\Windows\SysWOW64\cmd.exe

cmd /c c:\windows\W_X_C.bat

C:\windows\hosts.exe

C:\windows\hosts.exe

C:\windows\hosts.exe

C:\windows\hosts.exe

C:\Users\Admin\AppData\Local\Temp\avscan.exe

C:\Users\Admin\AppData\Local\Temp\avscan.exe

C:\Windows\SysWOW64\cmd.exe

cmd /c c:\windows\W_X_C.bat

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Windows\W_X_C.vbs"

C:\windows\hosts.exe

C:\windows\hosts.exe

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Windows\W_X_C.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Windows\W_X_C.vbs"

C:\Windows\SysWOW64\REG.exe

REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f

C:\Windows\SysWOW64\REG.exe

REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f

C:\Windows\SysWOW64\REG.exe

REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f

C:\Windows\SysWOW64\REG.exe

REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f

C:\Windows\SysWOW64\REG.exe

REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f

C:\Windows\SysWOW64\REG.exe

REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f

C:\Windows\SysWOW64\REG.exe

REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f

C:\Windows\SysWOW64\REG.exe

REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f

Network

N/A

Files

\Users\Admin\AppData\Local\Temp\avscan.exe

MD5 df874e396d203675edbacdcbe51c95da
SHA1 1f2925b2130c54641e52e18a59c505d043168934
SHA256 ad96eb42433457811089874a8ff2b658cbae30c3c953a67bab1c91d882e3f3ea
SHA512 a7f3567dca1e6ce354a88f775542e2fcf7005bee21142835e23118d25c5989b5909a2a39023c2e40d6b0efe370f7b6e0e41b959b62a09ef784f89ff18ef7b6ea

C:\Windows\hosts.exe

MD5 eb074ced6670448ffcae4e37b132ac14
SHA1 65b3386055a607a1b03824cc76117ffba2debe72
SHA256 0047a3a070befb9a8de971e2f1b0bbeaf0f4b6897eeee32aa56d9e567688e43c
SHA512 5ed934d1155abe880b4685e31fbde63b994437c0762a587545a5af889ea70374233bb2cc5a7dd9f49a958fe0155593cf592b1f62bb52710e0ed4a9085c652fbf

\??\c:\windows\W_X_C.bat

MD5 4db9f8b6175722b62ececeeeba1ce307
SHA1 3b3ba8414706e72a6fa19e884a97b87609e11e47
SHA256 d2150b9e5a4ce55e140f0ca91c4e300715d42095c8fddf58c77037cdd2cfaf78
SHA512 1d6dc274cf7a3dd704f840e6a5ad57ab4c4e35d5f09489aeff520bb797e1c825bac53fc335156fe41e767a46520d031855fe42fe7b175409ebe5e9e986fb9b8b

C:\Windows\W_X_C.vbs

MD5 f95358465555a555747e89f1ff9648ec
SHA1 c49cf9463efca89b6e07f06ccbb2e6d17d6fc645
SHA256 f40d0daff2b4d5f62032c405ece6f2ad5482a2fcc53a29a41393ee72d996528f
SHA512 6a9ad835557fb4c74c826abab42eb8c35a7c2d9f7d61dab15e244d2aeab00cde77abb2669a805ef79f0cf3b07f732ef2267668e1397e623ce543948b99fdbad5

C:\Users\Admin\AppData\Local\Temp\Admin.bmp

MD5 a53c96dfbb79f3e792c13e5ecdd32830
SHA1 4a11cfd1ca1b8769bf3be054b54bf5d549604c90
SHA256 cf3bfedc5cd172228218fadc4fdb0866aa19222b80f9cc68e3916441df2da5e7
SHA512 8b4b07dcc77b291885d8308993dd3cf38aed7041c741680c02534cf46dc76900d5a8e236df74f49a98bd9d1701e1e11d04a61eb25713f88bcce9ba1b7b1a6572

C:\Users\Admin\AppData\Local\Temp\Admin.bmp

MD5 817002cba8ffd240e5f75aa51b77dc15
SHA1 643b2e724f85c2ca2a24c16df2f8be0cd7931759
SHA256 0d6b8981f4dd3b4e0fc1fcca024d871c7bee48a6f9532c5c2c4bcd0476b0f140
SHA512 9f740803a8a925b32c0c84f160f8c05b6ea8a042d5d0ad99d823983bf34e72e0543c4f172b061a20658d4d124ce817a444d03c5998940cb4ef98932a8b5790a6

C:\Users\Admin\AppData\Local\Temp\Admin.bmp

MD5 516199f1cbcea565b4aa4a85e97e8f16
SHA1 7095762624103d2982bd9d7e8e2dae2940295b72
SHA256 90cd8697d4ddf69a5007dd26b22319615a5e497c62640a2a8bb8dafec951e3a6
SHA512 84af6625b505d8693f06038c44b1bb008a639d6dbd0e5c38a1c740fca04444b63232758618df78394c5cfed448a486ee3dc3e3dbe1190954c59f20b917cbf27a

C:\Users\Admin\AppData\Local\Temp\Admin.bmp

MD5 7c192209c52348cbac776b3ed785adee
SHA1 9a98e73ac33d18d0bef1094c4bfa4c68c16b56b7
SHA256 5ffe3b7acf81c325b2388a54e477ed7b6752b1911cc530d2d17a89c326627827
SHA512 527d7828597ee67da95a5217df7639ee91dc57f7706b58f8a82c8e0a14970cb83f2dfa9eaa805eadce5591b01a01479b0f9c758d3edf74db06656d5e3118e87e

C:\Users\Admin\AppData\Local\Temp\Admin.bmp

MD5 a1a53a6ab5b8a43ed06d839925980a1e
SHA1 4028d13360b1c54eccfdb9a7ba8306bef0d80523
SHA256 cbd692fb2d3e9469092cf6bfc8349bd55963626bc974154576ca22531b5c968e
SHA512 e5b98fb8418f17cdfb57c748d362a90a6fab281e3e37a56a7584d940daacab4c9b8755d2dde6cb0682304405640afe4f78856d83dcf900e82fc542eadf04f012

C:\Users\Admin\AppData\Local\Temp\Admin.bmp

MD5 4330ac0b888e1caa10bd7e0be1b3524f
SHA1 2f18b357b64011683ba0767a9136ae556071df75
SHA256 431e5b2fe6a2346b8da56200b03e46b283407836787bbfbec0b23b13101a6170
SHA512 59088b54ffc5ad87963e0f69e144aece8fbdd9724d3639ffa1e290e497106c99df4e917a4b2718d2088815cd56e39def2019b47401b93729e507230988a7a2d3

C:\Users\Admin\AppData\Local\Temp\Admin.bmp

MD5 bed1d56b80b6a3ec3d99e762a0a39bcb
SHA1 c9f5081b2c60055657be7c3fe5ac5dbbb590cedf
SHA256 bcefdb471b871543db8972bc5aabfc218180415c9833a4d6eee9eb8ca2d2c113
SHA512 81a2331dcf7bbfa8fcbfbca0a620144888cbf60c1c927304095f002fc58b01c1ca51476b151e553af19cf1ad9fcf4ba6cb0115ddc1798b321f0090212433c64f

Analysis: behavioral2

Detonation Overview

Submitted

2024-06-14 05:21

Reported

2024-06-14 05:23

Platform

win10v2004-20240226-en

Max time kernel

136s

Max time network

146s

Command Line

"C:\Users\Admin\AppData\Local\Temp\e609755ba4dca66179e8fd79e85423623d51fc183e5bbc840e0784f4c781aaf1.exe"

Signatures

Modifies visibility of file extensions in Explorer

evasion
Description Indicator Process Target
Set value (int) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" C:\Users\Admin\AppData\Local\Temp\e609755ba4dca66179e8fd79e85423623d51fc183e5bbc840e0784f4c781aaf1.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" C:\Users\Admin\AppData\Local\Temp\avscan.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" C:\windows\hosts.exe N/A

Modifies visiblity of hidden/system files in Explorer

evasion
Description Indicator Process Target
Set value (int) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" C:\Users\Admin\AppData\Local\Temp\e609755ba4dca66179e8fd79e85423623d51fc183e5bbc840e0784f4c781aaf1.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" C:\Users\Admin\AppData\Local\Temp\avscan.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" C:\windows\hosts.exe N/A

Adds policy Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\OAILVCNY = "W_X_C.bat" C:\Windows\SysWOW64\WScript.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run C:\Windows\SysWOW64\WScript.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\OAILVCNY = "W_X_C.bat" C:\Windows\SysWOW64\WScript.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run C:\Windows\SysWOW64\WScript.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\OAILVCNY = "W_X_C.bat" C:\Windows\SysWOW64\WScript.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run C:\Windows\SysWOW64\WScript.exe N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation C:\Windows\SysWOW64\cmd.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation C:\Windows\SysWOW64\cmd.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation C:\Windows\SysWOW64\cmd.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\avscan = "C:\\Users\\Admin\\AppData\\Local\\Temp\\avscan.exe" C:\Users\Admin\AppData\Local\Temp\e609755ba4dca66179e8fd79e85423623d51fc183e5bbc840e0784f4c781aaf1.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\avscan = "C:\\Users\\Admin\\AppData\\Local\\Temp\\avscan.exe" C:\Users\Admin\AppData\Local\Temp\avscan.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\avscan = "C:\\Users\\Admin\\AppData\\Local\\Temp\\avscan.exe" C:\windows\hosts.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File created C:\windows\W_X_C.vbs C:\Users\Admin\AppData\Local\Temp\e609755ba4dca66179e8fd79e85423623d51fc183e5bbc840e0784f4c781aaf1.exe N/A
File created \??\c:\windows\W_X_C.bat C:\Users\Admin\AppData\Local\Temp\e609755ba4dca66179e8fd79e85423623d51fc183e5bbc840e0784f4c781aaf1.exe N/A
File opened for modification C:\Windows\hosts.exe C:\Users\Admin\AppData\Local\Temp\e609755ba4dca66179e8fd79e85423623d51fc183e5bbc840e0784f4c781aaf1.exe N/A
File opened for modification C:\Windows\hosts.exe C:\Users\Admin\AppData\Local\Temp\avscan.exe N/A
File opened for modification C:\Windows\hosts.exe C:\windows\hosts.exe N/A

Enumerates physical storage devices

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Local Settings C:\Users\Admin\AppData\Local\Temp\e609755ba4dca66179e8fd79e85423623d51fc183e5bbc840e0784f4c781aaf1.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Local Settings C:\Windows\SysWOW64\cmd.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Local Settings C:\Windows\SysWOW64\cmd.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Local Settings C:\Windows\SysWOW64\cmd.exe N/A

Suspicious behavior: GetForegroundWindowSpam

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\e609755ba4dca66179e8fd79e85423623d51fc183e5bbc840e0784f4c781aaf1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\avscan.exe N/A
N/A N/A C:\windows\hosts.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 4028 wrote to memory of 3964 N/A C:\Users\Admin\AppData\Local\Temp\e609755ba4dca66179e8fd79e85423623d51fc183e5bbc840e0784f4c781aaf1.exe C:\Windows\SysWOW64\REG.exe
PID 4028 wrote to memory of 3964 N/A C:\Users\Admin\AppData\Local\Temp\e609755ba4dca66179e8fd79e85423623d51fc183e5bbc840e0784f4c781aaf1.exe C:\Windows\SysWOW64\REG.exe
PID 4028 wrote to memory of 3964 N/A C:\Users\Admin\AppData\Local\Temp\e609755ba4dca66179e8fd79e85423623d51fc183e5bbc840e0784f4c781aaf1.exe C:\Windows\SysWOW64\REG.exe
PID 4028 wrote to memory of 3036 N/A C:\Users\Admin\AppData\Local\Temp\e609755ba4dca66179e8fd79e85423623d51fc183e5bbc840e0784f4c781aaf1.exe C:\Users\Admin\AppData\Local\Temp\avscan.exe
PID 4028 wrote to memory of 3036 N/A C:\Users\Admin\AppData\Local\Temp\e609755ba4dca66179e8fd79e85423623d51fc183e5bbc840e0784f4c781aaf1.exe C:\Users\Admin\AppData\Local\Temp\avscan.exe
PID 4028 wrote to memory of 3036 N/A C:\Users\Admin\AppData\Local\Temp\e609755ba4dca66179e8fd79e85423623d51fc183e5bbc840e0784f4c781aaf1.exe C:\Users\Admin\AppData\Local\Temp\avscan.exe
PID 3036 wrote to memory of 3740 N/A C:\Users\Admin\AppData\Local\Temp\avscan.exe C:\Users\Admin\AppData\Local\Temp\avscan.exe
PID 3036 wrote to memory of 3740 N/A C:\Users\Admin\AppData\Local\Temp\avscan.exe C:\Users\Admin\AppData\Local\Temp\avscan.exe
PID 3036 wrote to memory of 3740 N/A C:\Users\Admin\AppData\Local\Temp\avscan.exe C:\Users\Admin\AppData\Local\Temp\avscan.exe
PID 3036 wrote to memory of 224 N/A C:\Users\Admin\AppData\Local\Temp\avscan.exe C:\Windows\SysWOW64\cmd.exe
PID 3036 wrote to memory of 224 N/A C:\Users\Admin\AppData\Local\Temp\avscan.exe C:\Windows\SysWOW64\cmd.exe
PID 3036 wrote to memory of 224 N/A C:\Users\Admin\AppData\Local\Temp\avscan.exe C:\Windows\SysWOW64\cmd.exe
PID 4028 wrote to memory of 3648 N/A C:\Users\Admin\AppData\Local\Temp\e609755ba4dca66179e8fd79e85423623d51fc183e5bbc840e0784f4c781aaf1.exe C:\Windows\SysWOW64\cmd.exe
PID 4028 wrote to memory of 3648 N/A C:\Users\Admin\AppData\Local\Temp\e609755ba4dca66179e8fd79e85423623d51fc183e5bbc840e0784f4c781aaf1.exe C:\Windows\SysWOW64\cmd.exe
PID 4028 wrote to memory of 3648 N/A C:\Users\Admin\AppData\Local\Temp\e609755ba4dca66179e8fd79e85423623d51fc183e5bbc840e0784f4c781aaf1.exe C:\Windows\SysWOW64\cmd.exe
PID 3648 wrote to memory of 4304 N/A C:\Windows\SysWOW64\cmd.exe C:\windows\hosts.exe
PID 3648 wrote to memory of 4304 N/A C:\Windows\SysWOW64\cmd.exe C:\windows\hosts.exe
PID 3648 wrote to memory of 4304 N/A C:\Windows\SysWOW64\cmd.exe C:\windows\hosts.exe
PID 224 wrote to memory of 3724 N/A C:\Windows\SysWOW64\cmd.exe C:\windows\hosts.exe
PID 224 wrote to memory of 3724 N/A C:\Windows\SysWOW64\cmd.exe C:\windows\hosts.exe
PID 224 wrote to memory of 3724 N/A C:\Windows\SysWOW64\cmd.exe C:\windows\hosts.exe
PID 4304 wrote to memory of 5016 N/A C:\windows\hosts.exe C:\Users\Admin\AppData\Local\Temp\avscan.exe
PID 4304 wrote to memory of 5016 N/A C:\windows\hosts.exe C:\Users\Admin\AppData\Local\Temp\avscan.exe
PID 4304 wrote to memory of 5016 N/A C:\windows\hosts.exe C:\Users\Admin\AppData\Local\Temp\avscan.exe
PID 4304 wrote to memory of 3980 N/A C:\windows\hosts.exe C:\Windows\SysWOW64\cmd.exe
PID 4304 wrote to memory of 3980 N/A C:\windows\hosts.exe C:\Windows\SysWOW64\cmd.exe
PID 4304 wrote to memory of 3980 N/A C:\windows\hosts.exe C:\Windows\SysWOW64\cmd.exe
PID 3980 wrote to memory of 1200 N/A C:\Windows\SysWOW64\cmd.exe C:\windows\hosts.exe
PID 3980 wrote to memory of 1200 N/A C:\Windows\SysWOW64\cmd.exe C:\windows\hosts.exe
PID 3980 wrote to memory of 1200 N/A C:\Windows\SysWOW64\cmd.exe C:\windows\hosts.exe
PID 3648 wrote to memory of 3696 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\WScript.exe
PID 3648 wrote to memory of 3696 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\WScript.exe
PID 3648 wrote to memory of 3696 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\WScript.exe
PID 224 wrote to memory of 4476 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\WScript.exe
PID 224 wrote to memory of 4476 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\WScript.exe
PID 224 wrote to memory of 4476 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\WScript.exe
PID 3980 wrote to memory of 4448 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\WScript.exe
PID 3980 wrote to memory of 4448 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\WScript.exe
PID 3980 wrote to memory of 4448 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\WScript.exe
PID 3036 wrote to memory of 2628 N/A C:\Users\Admin\AppData\Local\Temp\avscan.exe C:\Windows\SysWOW64\REG.exe
PID 3036 wrote to memory of 2628 N/A C:\Users\Admin\AppData\Local\Temp\avscan.exe C:\Windows\SysWOW64\REG.exe
PID 3036 wrote to memory of 2628 N/A C:\Users\Admin\AppData\Local\Temp\avscan.exe C:\Windows\SysWOW64\REG.exe
PID 4304 wrote to memory of 4028 N/A C:\windows\hosts.exe C:\Windows\SysWOW64\REG.exe
PID 4304 wrote to memory of 4028 N/A C:\windows\hosts.exe C:\Windows\SysWOW64\REG.exe
PID 4304 wrote to memory of 4028 N/A C:\windows\hosts.exe C:\Windows\SysWOW64\REG.exe
PID 3036 wrote to memory of 2452 N/A C:\Users\Admin\AppData\Local\Temp\avscan.exe C:\Windows\SysWOW64\REG.exe
PID 3036 wrote to memory of 2452 N/A C:\Users\Admin\AppData\Local\Temp\avscan.exe C:\Windows\SysWOW64\REG.exe
PID 3036 wrote to memory of 2452 N/A C:\Users\Admin\AppData\Local\Temp\avscan.exe C:\Windows\SysWOW64\REG.exe
PID 4304 wrote to memory of 1968 N/A C:\windows\hosts.exe C:\Windows\SysWOW64\REG.exe
PID 4304 wrote to memory of 1968 N/A C:\windows\hosts.exe C:\Windows\SysWOW64\REG.exe
PID 4304 wrote to memory of 1968 N/A C:\windows\hosts.exe C:\Windows\SysWOW64\REG.exe
PID 3036 wrote to memory of 4776 N/A C:\Users\Admin\AppData\Local\Temp\avscan.exe C:\Windows\SysWOW64\REG.exe
PID 3036 wrote to memory of 4776 N/A C:\Users\Admin\AppData\Local\Temp\avscan.exe C:\Windows\SysWOW64\REG.exe
PID 3036 wrote to memory of 4776 N/A C:\Users\Admin\AppData\Local\Temp\avscan.exe C:\Windows\SysWOW64\REG.exe
PID 4304 wrote to memory of 4860 N/A C:\windows\hosts.exe C:\Windows\SysWOW64\REG.exe
PID 4304 wrote to memory of 4860 N/A C:\windows\hosts.exe C:\Windows\SysWOW64\REG.exe
PID 4304 wrote to memory of 4860 N/A C:\windows\hosts.exe C:\Windows\SysWOW64\REG.exe
PID 3036 wrote to memory of 1668 N/A C:\Users\Admin\AppData\Local\Temp\avscan.exe C:\Windows\SysWOW64\REG.exe
PID 3036 wrote to memory of 1668 N/A C:\Users\Admin\AppData\Local\Temp\avscan.exe C:\Windows\SysWOW64\REG.exe
PID 3036 wrote to memory of 1668 N/A C:\Users\Admin\AppData\Local\Temp\avscan.exe C:\Windows\SysWOW64\REG.exe
PID 4304 wrote to memory of 1284 N/A C:\windows\hosts.exe C:\Windows\SysWOW64\REG.exe
PID 4304 wrote to memory of 1284 N/A C:\windows\hosts.exe C:\Windows\SysWOW64\REG.exe
PID 4304 wrote to memory of 1284 N/A C:\windows\hosts.exe C:\Windows\SysWOW64\REG.exe

Processes

C:\Users\Admin\AppData\Local\Temp\e609755ba4dca66179e8fd79e85423623d51fc183e5bbc840e0784f4c781aaf1.exe

"C:\Users\Admin\AppData\Local\Temp\e609755ba4dca66179e8fd79e85423623d51fc183e5bbc840e0784f4c781aaf1.exe"

C:\Windows\SysWOW64\REG.exe

REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f

C:\Users\Admin\AppData\Local\Temp\avscan.exe

C:\Users\Admin\AppData\Local\Temp\avscan.exe

C:\Users\Admin\AppData\Local\Temp\avscan.exe

C:\Users\Admin\AppData\Local\Temp\avscan.exe

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c c:\windows\W_X_C.bat

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c c:\windows\W_X_C.bat

C:\windows\hosts.exe

C:\windows\hosts.exe

C:\windows\hosts.exe

C:\windows\hosts.exe

C:\Users\Admin\AppData\Local\Temp\avscan.exe

C:\Users\Admin\AppData\Local\Temp\avscan.exe

C:\Windows\System32\rundll32.exe

C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c c:\windows\W_X_C.bat

C:\windows\hosts.exe

C:\windows\hosts.exe

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Windows\W_X_C.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Windows\W_X_C.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Windows\W_X_C.vbs"

C:\Windows\SysWOW64\REG.exe

REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f

C:\Windows\SysWOW64\REG.exe

REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4164 --field-trial-handle=3084,i,4016110471176367543,14287608422419064331,262144 --variations-seed-version /prefetch:8

C:\Windows\SysWOW64\REG.exe

REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f

C:\Windows\SysWOW64\REG.exe

REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f

C:\Windows\SysWOW64\REG.exe

REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f

C:\Windows\SysWOW64\REG.exe

REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f

C:\Windows\SysWOW64\REG.exe

REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f

C:\Windows\SysWOW64\REG.exe

REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f

Network

Country Destination Domain Proto
GB 96.16.110.114:80 tcp
US 8.8.8.8:53 104.219.191.52.in-addr.arpa udp
US 8.8.8.8:53 81.144.22.2.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 73.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 154.239.44.20.in-addr.arpa udp
US 13.107.253.64:443 tcp
US 8.8.8.8:53 103.169.127.40.in-addr.arpa udp
US 8.8.8.8:53 76.234.34.23.in-addr.arpa udp
US 8.8.8.8:53 18.31.95.13.in-addr.arpa udp
US 8.8.8.8:53 149.220.183.52.in-addr.arpa udp
US 8.8.8.8:53 102.144.22.2.in-addr.arpa udp
US 8.8.8.8:53 13.227.111.52.in-addr.arpa udp
US 8.8.8.8:53 83.210.23.2.in-addr.arpa udp
US 8.8.8.8:53 84.65.42.20.in-addr.arpa udp

Files

C:\Users\Admin\AppData\Local\Temp\avscan.exe

MD5 2a5352988ff49576c23c54c4933b629e
SHA1 36ff12d65755f6c1c564833aa97f895eeb02e6d3
SHA256 1fe9f38009a72efa65dd07895a946a35d7f8152647023de111ac749f5722da38
SHA512 be07de1866918d1aaaf27db38e5a0f350a5c11bd968222b1ba59f7c073531172175248af8fa649637743d2a68ab9ebde2eaf74474fd9407e2c78382d5258c10d

C:\Windows\hosts.exe

MD5 d77348c7bed8df48dc41c89c9feb3beb
SHA1 b271574a365f216deeaeee5098e846c1e3c11c15
SHA256 3e04d16b2ae5e6407d1e05434f725601030d9f73e57c72cb570a7c2ccd147471
SHA512 49ff974265e35a9b618201e93cba4eab6fb0129c4f0b2ef1039427ac0453376bed020968c89570c10926d8db44c930190cfa6294fc471675a32fae24f3da4135

\??\c:\windows\W_X_C.bat

MD5 4db9f8b6175722b62ececeeeba1ce307
SHA1 3b3ba8414706e72a6fa19e884a97b87609e11e47
SHA256 d2150b9e5a4ce55e140f0ca91c4e300715d42095c8fddf58c77037cdd2cfaf78
SHA512 1d6dc274cf7a3dd704f840e6a5ad57ab4c4e35d5f09489aeff520bb797e1c825bac53fc335156fe41e767a46520d031855fe42fe7b175409ebe5e9e986fb9b8b

C:\Windows\W_X_C.vbs

MD5 0b7843cfac17421f5112f317542457da
SHA1 60383d2b53c315cef3e26e2254448623fbf75de2
SHA256 b5006a0ac0b2c3200787642471940c08570b8f21eb46a03b5e53d103cb99a8c7
SHA512 cf57206cd2828e2e4ca2f6b2ac8818cf30c5c6d69854f719bcb3296b674d7d02d6067453965220948418fc995aa6d8441a30736f5fa9ce46d01d4056801ff918