63ad247fa5ab8cbedfae1f70f4d29b4a80f9b8dc6ae19f5a685b5c264fe661ce

Analysis

max time kernel
96s
max time network
97s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
20-09-2024 23:02

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

63ad247fa5ab8cbedfae1f70f4d29b4a80f9b8dc6ae19f5a685b5c264fe661ceN.exe
Size

3.3MB
MD5

ceef92d4499e291b76822c9a08501970
SHA1

ad234fb1df0a24e7bcda9dfbdbc1a3ae6bd1499d
SHA256

63ad247fa5ab8cbedfae1f70f4d29b4a80f9b8dc6ae19f5a685b5c264fe661ce
SHA512

5289f5451a996f891fda629150d52e000a351ed5eb122ffb791a811d4add18e3f71fd5e8d6dada95c572dca673f95ecbb404b2d9ba28014004a2f1e5aa0c0a69
SSDEEP

49152:g7J7A7yD7q7yD7c747q7yD7A7yD7q7yD7H747q7yD7A7yD7q7yD727Q:gdMmD2mDAc2mDMmD2mDrc2mDMmD2mD6c

Score

10^/10

defense_evasion discovery evasion persistence

Malware Config

Signatures

Modifies visibility of file extensions in Explorer 2 TTPs 3 IoCs

evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	63ad247fa5ab8cbedfae1f70f4d29b4a80f9b8dc6ae19f5a685b5c264fe661ceN.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	avscan.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	hosts.exe

Modifies visiblity of hidden/system files in Explorer 2 TTPs 3 IoCs

evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	63ad247fa5ab8cbedfae1f70f4d29b4a80f9b8dc6ae19f5a685b5c264fe661ceN.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	avscan.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	hosts.exe

Adds policy Run key to start application 2 TTPs 6 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\KVIWLPUJ = "W_X_C.bat"	WScript.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	WScript.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\KVIWLPUJ = "W_X_C.bat"	WScript.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	WScript.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\KVIWLPUJ = "W_X_C.bat"	WScript.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	WScript.exe

Checks computer location settings 2 TTPs 3 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\Control Panel\International\Geo\Nation	cmd.exe
Key value queried	\REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\Control Panel\International\Geo\Nation	cmd.exe
Key value queried	\REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\Control Panel\International\Geo\Nation	cmd.exe

Executes dropped EXE 6 IoCs

pid	Process
3148	avscan.exe
4856	avscan.exe
2672	hosts.exe
3800	hosts.exe
2940	avscan.exe
976	hosts.exe

Impair Defenses: Safe Mode Boot 1 TTPs 6 IoCs

defense_evasion

Safe Mode Boot

T1562.009

description	ioc	Process
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\UserManager	REG.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\CBDHSvc	REG.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\iai2c.sys	REG.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\Power	REG.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\ProfSvc	REG.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\SerCx2.sys	REG.exe

Adds Run key to start application 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\avscan = "C:\\Users\\Admin\\AppData\\Local\\Temp\\avscan.exe"	63ad247fa5ab8cbedfae1f70f4d29b4a80f9b8dc6ae19f5a685b5c264fe661ceN.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\avscan = "C:\\Users\\Admin\\AppData\\Local\\Temp\\avscan.exe"	avscan.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\avscan = "C:\\Users\\Admin\\AppData\\Local\\Temp\\avscan.exe"	hosts.exe

Drops file in Windows directory 5 IoCs

description	ioc	Process
File opened for modification	C:\Windows\hosts.exe	avscan.exe
File opened for modification	C:\Windows\hosts.exe	hosts.exe
File created	C:\windows\W_X_C.vbs	63ad247fa5ab8cbedfae1f70f4d29b4a80f9b8dc6ae19f5a685b5c264fe661ceN.exe
File created	\??\c:\windows\W_X_C.bat	63ad247fa5ab8cbedfae1f70f4d29b4a80f9b8dc6ae19f5a685b5c264fe661ceN.exe
File opened for modification	C:\Windows\hosts.exe	63ad247fa5ab8cbedfae1f70f4d29b4a80f9b8dc6ae19f5a685b5c264fe661ceN.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 20 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hosts.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hosts.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	REG.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	REG.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	REG.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	REG.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	avscan.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	REG.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	avscan.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	REG.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hosts.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	REG.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	63ad247fa5ab8cbedfae1f70f4d29b4a80f9b8dc6ae19f5a685b5c264fe661ceN.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	avscan.exe

Modifies registry class 4 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000_Classes\Local Settings	63ad247fa5ab8cbedfae1f70f4d29b4a80f9b8dc6ae19f5a685b5c264fe661ceN.exe
Key created	\REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000_Classes\Local Settings	cmd.exe

Modifies registry key 1 TTPs 7 IoCs

Modify Registry

T1112

pid	Process
3816	REG.exe
2824	REG.exe
2184	REG.exe
4512	REG.exe
4440	REG.exe
1848	REG.exe
4936	REG.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

pid	Process
3148	avscan.exe
2672	hosts.exe

Suspicious use of SetWindowsHookEx 7 IoCs

pid	Process
1124	63ad247fa5ab8cbedfae1f70f4d29b4a80f9b8dc6ae19f5a685b5c264fe661ceN.exe
3148	avscan.exe
4856	avscan.exe
2672	hosts.exe
3800	hosts.exe
2940	avscan.exe
976	hosts.exe

Suspicious use of WriteProcessMemory 57 IoCs

description	pid	Process	procid_target
PID 1124 wrote to memory of 4936	1124	63ad247fa5ab8cbedfae1f70f4d29b4a80f9b8dc6ae19f5a685b5c264fe661ceN.exe	82
PID 1124 wrote to memory of 4936	1124	63ad247fa5ab8cbedfae1f70f4d29b4a80f9b8dc6ae19f5a685b5c264fe661ceN.exe	82
PID 1124 wrote to memory of 4936	1124	63ad247fa5ab8cbedfae1f70f4d29b4a80f9b8dc6ae19f5a685b5c264fe661ceN.exe	82
PID 1124 wrote to memory of 3148	1124	63ad247fa5ab8cbedfae1f70f4d29b4a80f9b8dc6ae19f5a685b5c264fe661ceN.exe	84
PID 1124 wrote to memory of 3148	1124	63ad247fa5ab8cbedfae1f70f4d29b4a80f9b8dc6ae19f5a685b5c264fe661ceN.exe	84
PID 1124 wrote to memory of 3148	1124	63ad247fa5ab8cbedfae1f70f4d29b4a80f9b8dc6ae19f5a685b5c264fe661ceN.exe	84
PID 3148 wrote to memory of 4856	3148	avscan.exe	85
PID 3148 wrote to memory of 4856	3148	avscan.exe	85
PID 3148 wrote to memory of 4856	3148	avscan.exe	85
PID 3148 wrote to memory of 4828	3148	avscan.exe	86
PID 3148 wrote to memory of 4828	3148	avscan.exe	86
PID 3148 wrote to memory of 4828	3148	avscan.exe	86
PID 1124 wrote to memory of 1052	1124	63ad247fa5ab8cbedfae1f70f4d29b4a80f9b8dc6ae19f5a685b5c264fe661ceN.exe	87
PID 1124 wrote to memory of 1052	1124	63ad247fa5ab8cbedfae1f70f4d29b4a80f9b8dc6ae19f5a685b5c264fe661ceN.exe	87
PID 1124 wrote to memory of 1052	1124	63ad247fa5ab8cbedfae1f70f4d29b4a80f9b8dc6ae19f5a685b5c264fe661ceN.exe	87
PID 1052 wrote to memory of 2672	1052	cmd.exe	91
PID 1052 wrote to memory of 2672	1052	cmd.exe	91
PID 1052 wrote to memory of 2672	1052	cmd.exe	91
PID 4828 wrote to memory of 3800	4828	cmd.exe	92
PID 4828 wrote to memory of 3800	4828	cmd.exe	92
PID 4828 wrote to memory of 3800	4828	cmd.exe	92
PID 2672 wrote to memory of 2940	2672	hosts.exe	93
PID 2672 wrote to memory of 2940	2672	hosts.exe	93
PID 2672 wrote to memory of 2940	2672	hosts.exe	93
PID 2672 wrote to memory of 2004	2672	hosts.exe	94
PID 2672 wrote to memory of 2004	2672	hosts.exe	94
PID 2672 wrote to memory of 2004	2672	hosts.exe	94
PID 2004 wrote to memory of 976	2004	cmd.exe	96
PID 2004 wrote to memory of 976	2004	cmd.exe	96
PID 2004 wrote to memory of 976	2004	cmd.exe	96
PID 1052 wrote to memory of 2920	1052	cmd.exe	97
PID 1052 wrote to memory of 2920	1052	cmd.exe	97
PID 1052 wrote to memory of 2920	1052	cmd.exe	97
PID 4828 wrote to memory of 1952	4828	cmd.exe	98
PID 4828 wrote to memory of 1952	4828	cmd.exe	98
PID 4828 wrote to memory of 1952	4828	cmd.exe	98
PID 2004 wrote to memory of 1892	2004	cmd.exe	99
PID 2004 wrote to memory of 1892	2004	cmd.exe	99
PID 2004 wrote to memory of 1892	2004	cmd.exe	99
PID 3148 wrote to memory of 3816	3148	avscan.exe	108
PID 3148 wrote to memory of 3816	3148	avscan.exe	108
PID 3148 wrote to memory of 3816	3148	avscan.exe	108
PID 2672 wrote to memory of 2824	2672	hosts.exe	110
PID 2672 wrote to memory of 2824	2672	hosts.exe	110
PID 2672 wrote to memory of 2824	2672	hosts.exe	110
PID 3148 wrote to memory of 2184	3148	avscan.exe	114
PID 3148 wrote to memory of 2184	3148	avscan.exe	114
PID 3148 wrote to memory of 2184	3148	avscan.exe	114
PID 2672 wrote to memory of 4512	2672	hosts.exe	116
PID 2672 wrote to memory of 4512	2672	hosts.exe	116
PID 2672 wrote to memory of 4512	2672	hosts.exe	116
PID 3148 wrote to memory of 4440	3148	avscan.exe	118
PID 3148 wrote to memory of 4440	3148	avscan.exe	118
PID 3148 wrote to memory of 4440	3148	avscan.exe	118
PID 2672 wrote to memory of 1848	2672	hosts.exe	120
PID 2672 wrote to memory of 1848	2672	hosts.exe	120
PID 2672 wrote to memory of 1848	2672	hosts.exe	120

C:\Users\Admin\AppData\Local\Temp\63ad247fa5ab8cbedfae1f70f4d29b4a80f9b8dc6ae19f5a685b5c264fe661ceN.exe
"C:\Users\Admin\AppData\Local\Temp\63ad247fa5ab8cbedfae1f70f4d29b4a80f9b8dc6ae19f5a685b5c264fe661ceN.exe"
1⤵
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1124
- C:\Windows\SysWOW64\REG.exe
  REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
  2⤵
  - Impair Defenses: Safe Mode Boot
  - System Location Discovery: System Language Discovery
  - Modifies registry key
  PID:4936
- C:\Users\Admin\AppData\Local\Temp\avscan.exe
  C:\Users\Admin\AppData\Local\Temp\avscan.exe
  2⤵
  - Modifies visibility of file extensions in Explorer
  - Modifies visiblity of hidden/system files in Explorer
  - Executes dropped EXE
  - Adds Run key to start application
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3148
- - C:\Users\Admin\AppData\Local\Temp\avscan.exe
    C:\Users\Admin\AppData\Local\Temp\avscan.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:4856
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c c:\windows\W_X_C.bat
    3⤵
    - Checks computer location settings
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    - Suspicious use of WriteProcessMemory
    PID:4828
  - - C:\windows\hosts.exe
      C:\windows\hosts.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:3800
  - - C:\Windows\SysWOW64\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Windows\W_X_C.vbs"
      4⤵
      Adds policy Run key to start application
      System Location Discovery: System Language Discovery
      PID:1952
- - C:\Windows\SysWOW64\REG.exe
    REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies registry key
    PID:3816
- - C:\Windows\SysWOW64\REG.exe
    REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies registry key
    PID:2184
- - C:\Windows\SysWOW64\REG.exe
    REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies registry key
    PID:4440
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c c:\windows\W_X_C.bat
  2⤵
  - Checks computer location settings
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:1052
- - C:\windows\hosts.exe
    C:\windows\hosts.exe
    3⤵
    - Modifies visibility of file extensions in Explorer
    - Modifies visiblity of hidden/system files in Explorer
    - Executes dropped EXE
    - Adds Run key to start application
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2672
  - - C:\Users\Admin\AppData\Local\Temp\avscan.exe
      C:\Users\Admin\AppData\Local\Temp\avscan.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:2940
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c c:\windows\W_X_C.bat
      4⤵
      Checks computer location settings
      System Location Discovery: System Language Discovery
      Modifies registry class
      Suspicious use of WriteProcessMemory
      PID:2004
    - - C:\windows\hosts.exe
        
        C:\windows\hosts.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:976
    - - C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Windows\W_X_C.vbs"
        5⤵
        Adds policy Run key to start application
        System Location Discovery: System Language Discovery
        
        PID:1892
  - - C:\Windows\SysWOW64\REG.exe
      REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
      4⤵
      System Location Discovery: System Language Discovery
      Modifies registry key
      PID:2824
  - - C:\Windows\SysWOW64\REG.exe
      REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
      4⤵
      System Location Discovery: System Language Discovery
      Modifies registry key
      PID:4512
  - - C:\Windows\SysWOW64\REG.exe
      REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
      4⤵
      System Location Discovery: System Language Discovery
      Modifies registry key
      PID:1848
- - C:\Windows\SysWOW64\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Windows\W_X_C.vbs"
    3⤵
    - Adds policy Run key to start application
    - System Location Discovery: System Language Discovery
    PID:2920

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:3452

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Impair Defenses

T1562

Safe Mode Boot

T1562.009

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\avscan.exe

Filesize
3.3MB

MD5
d339c121a6c9e327d9ed350b7de7c1dc

SHA1
d09da4bb6305372921385a1425ea3a5def914300

SHA256
6f7e608be05bf1e7a48f8b053aacd6677d57ff62cac12b83ae6fdffff2d4f073

SHA512
052620c231e574f5389588512bcba96f1e6d7336cd3a4f2adef4261b2964bdbd819a6143d7feef840a14c5562761a926f5c2446757cc4dd5f1e72ed1c2bfd82a

Download Submit
C:\Windows\W_X_C.vbs

Filesize
195B

MD5
43821a7ed1f44fcb3080fa45c1b42476

SHA1
b73173c1fe649c72861945cd79382c0e3a004a52

SHA256
2cc918d5ebb977a9a9270efe50600f17ec5de5c0a57021649846b94aa435caaa

SHA512
cf601e67e5e4a110ae285ebc3fa73014b8379015eee018c17e434fc06c4b1b2be5d266ae9db42ff0268dd224f098ad453b58ba088da37ce0df7771a40adf1de5

Download Submit
C:\Windows\hosts.exe

Filesize
3.3MB

MD5
29214476423d4074dbe716901d2c3a27

SHA1
795fae8d6c24e022e326bfba4358f5f7286f7769

SHA256
6afee5af5253074c081e8a9846ee74dc32c790255f4e9d3c2c68111895403b1c

SHA512
4db7fcd43b988c48242bcb64a8ae072740420cd446bee4619c4b382655e19553936b04b21d31639b6f47dde1573265b168bbca979669009768b3a5973d5d8f3c

Download Submit
\??\c:\windows\W_X_C.bat

Filesize
336B

MD5
4db9f8b6175722b62ececeeeba1ce307

SHA1
3b3ba8414706e72a6fa19e884a97b87609e11e47

SHA256
d2150b9e5a4ce55e140f0ca91c4e300715d42095c8fddf58c77037cdd2cfaf78

SHA512
1d6dc274cf7a3dd704f840e6a5ad57ab4c4e35d5f09489aeff520bb797e1c825bac53fc335156fe41e767a46520d031855fe42fe7b175409ebe5e9e986fb9b8b

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads