5ddd1c512708614222713e090b65417e588289519c991de4f159a74f901c8cc4

Analysis

max time kernel
121s
max time network
97s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
11/10/2024, 22:11

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

5ddd1c512708614222713e090b65417e588289519c991de4f159a74f901c8cc4.exe
Size

1.2MB
MD5

420f785e369c8ed6d62ba20d477fabe5
SHA1

4293b964712e8e904e81bdc52f6b6b837689d773
SHA256

5ddd1c512708614222713e090b65417e588289519c991de4f159a74f901c8cc4
SHA512

19a0dde318e564c2361bead529d34779dcffcddbc23c97dae9fb5154a1a5ffe585bc2420b48e72570c5df58aab92fa37834036970f0ecc94962c58774ce07702
SSDEEP

6144:gDCwfazhDCwfazrDCwfqDCwfyDDCwfADCwfyDDCwfqDCwfyDDC1:g7azh7azr7q7yD7A7yD7q7yD0

Score

10^/10

defense_evasion discovery evasion persistence

Malware Config

Signatures

Modifies visibility of file extensions in Explorer 2 TTPs 3 IoCs

evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	5ddd1c512708614222713e090b65417e588289519c991de4f159a74f901c8cc4.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	avscan.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	hosts.exe

Modifies visiblity of hidden/system files in Explorer 2 TTPs 3 IoCs

evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	5ddd1c512708614222713e090b65417e588289519c991de4f159a74f901c8cc4.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	avscan.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	hosts.exe

Adds policy Run key to start application 2 TTPs 6 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\UTKBEBLO = "W_X_C.bat"	WScript.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	WScript.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\UTKBEBLO = "W_X_C.bat"	WScript.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	WScript.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\UTKBEBLO = "W_X_C.bat"	WScript.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	WScript.exe

Checks computer location settings 2 TTPs 3 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\International\Geo\Nation	cmd.exe
Key value queried	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\International\Geo\Nation	cmd.exe
Key value queried	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\International\Geo\Nation	cmd.exe

Executes dropped EXE 6 IoCs

pid	Process
4136	avscan.exe
2384	avscan.exe
3692	hosts.exe
4308	hosts.exe
3556	avscan.exe
4752	hosts.exe

Impair Defenses: Safe Mode Boot 1 TTPs 6 IoCs

defense_evasion

Safe Mode Boot

T1562.009

description	ioc	Process
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\ProfSvc	REG.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\SerCx2.sys	REG.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\UserManager	REG.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\CBDHSvc	REG.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\iai2c.sys	REG.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\Power	REG.exe

Adds Run key to start application 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\avscan = "C:\\Users\\Admin\\AppData\\Local\\Temp\\avscan.exe"	5ddd1c512708614222713e090b65417e588289519c991de4f159a74f901c8cc4.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\avscan = "C:\\Users\\Admin\\AppData\\Local\\Temp\\avscan.exe"	avscan.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\avscan = "C:\\Users\\Admin\\AppData\\Local\\Temp\\avscan.exe"	hosts.exe

Drops file in Windows directory 5 IoCs

description	ioc	Process
File opened for modification	C:\Windows\hosts.exe	avscan.exe
File opened for modification	C:\Windows\hosts.exe	hosts.exe
File created	C:\windows\W_X_C.vbs	5ddd1c512708614222713e090b65417e588289519c991de4f159a74f901c8cc4.exe
File created	\??\c:\windows\W_X_C.bat	5ddd1c512708614222713e090b65417e588289519c991de4f159a74f901c8cc4.exe
File opened for modification	C:\Windows\hosts.exe	5ddd1c512708614222713e090b65417e588289519c991de4f159a74f901c8cc4.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 22 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	avscan.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	avscan.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	avscan.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hosts.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	REG.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	REG.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	REG.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	REG.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	REG.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hosts.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	REG.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	5ddd1c512708614222713e090b65417e588289519c991de4f159a74f901c8cc4.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	REG.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	REG.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hosts.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	REG.exe

Modifies registry class 4 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000_Classes\Local Settings	5ddd1c512708614222713e090b65417e588289519c991de4f159a74f901c8cc4.exe
Key created	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000_Classes\Local Settings	cmd.exe

Modifies registry key 1 TTPs 9 IoCs

Modify Registry

T1112

pid	Process
2560	REG.exe
1988	REG.exe
4264	REG.exe
3584	REG.exe
4008	REG.exe
1388	REG.exe
3124	REG.exe
2352	REG.exe
2292	REG.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

pid	Process
4136	avscan.exe
3692	hosts.exe

Suspicious use of SetWindowsHookEx 7 IoCs

pid	Process
1664	5ddd1c512708614222713e090b65417e588289519c991de4f159a74f901c8cc4.exe
4136	avscan.exe
2384	avscan.exe
3692	hosts.exe
4308	hosts.exe
3556	avscan.exe
4752	hosts.exe

Suspicious use of WriteProcessMemory 63 IoCs

description	pid	Process	procid_target
PID 1664 wrote to memory of 4008	1664	5ddd1c512708614222713e090b65417e588289519c991de4f159a74f901c8cc4.exe	85
PID 1664 wrote to memory of 4008	1664	5ddd1c512708614222713e090b65417e588289519c991de4f159a74f901c8cc4.exe	85
PID 1664 wrote to memory of 4008	1664	5ddd1c512708614222713e090b65417e588289519c991de4f159a74f901c8cc4.exe	85
PID 1664 wrote to memory of 4136	1664	5ddd1c512708614222713e090b65417e588289519c991de4f159a74f901c8cc4.exe	88
PID 1664 wrote to memory of 4136	1664	5ddd1c512708614222713e090b65417e588289519c991de4f159a74f901c8cc4.exe	88
PID 1664 wrote to memory of 4136	1664	5ddd1c512708614222713e090b65417e588289519c991de4f159a74f901c8cc4.exe	88
PID 4136 wrote to memory of 2384	4136	avscan.exe	89
PID 4136 wrote to memory of 2384	4136	avscan.exe	89
PID 4136 wrote to memory of 2384	4136	avscan.exe	89
PID 4136 wrote to memory of 4044	4136	avscan.exe	90
PID 4136 wrote to memory of 4044	4136	avscan.exe	90
PID 4136 wrote to memory of 4044	4136	avscan.exe	90
PID 1664 wrote to memory of 4732	1664	5ddd1c512708614222713e090b65417e588289519c991de4f159a74f901c8cc4.exe	91
PID 1664 wrote to memory of 4732	1664	5ddd1c512708614222713e090b65417e588289519c991de4f159a74f901c8cc4.exe	91
PID 1664 wrote to memory of 4732	1664	5ddd1c512708614222713e090b65417e588289519c991de4f159a74f901c8cc4.exe	91
PID 4044 wrote to memory of 3692	4044	cmd.exe	94
PID 4044 wrote to memory of 3692	4044	cmd.exe	94
PID 4044 wrote to memory of 3692	4044	cmd.exe	94
PID 4732 wrote to memory of 4308	4732	cmd.exe	95
PID 4732 wrote to memory of 4308	4732	cmd.exe	95
PID 4732 wrote to memory of 4308	4732	cmd.exe	95
PID 3692 wrote to memory of 3556	3692	hosts.exe	96
PID 3692 wrote to memory of 3556	3692	hosts.exe	96
PID 3692 wrote to memory of 3556	3692	hosts.exe	96
PID 3692 wrote to memory of 740	3692	hosts.exe	98
PID 3692 wrote to memory of 740	3692	hosts.exe	98
PID 3692 wrote to memory of 740	3692	hosts.exe	98
PID 4732 wrote to memory of 1624	4732	cmd.exe	100
PID 4732 wrote to memory of 1624	4732	cmd.exe	100
PID 4732 wrote to memory of 1624	4732	cmd.exe	100
PID 4044 wrote to memory of 3180	4044	cmd.exe	101
PID 4044 wrote to memory of 3180	4044	cmd.exe	101
PID 4044 wrote to memory of 3180	4044	cmd.exe	101
PID 740 wrote to memory of 4752	740	cmd.exe	102
PID 740 wrote to memory of 4752	740	cmd.exe	102
PID 740 wrote to memory of 4752	740	cmd.exe	102
PID 740 wrote to memory of 3076	740	cmd.exe	103
PID 740 wrote to memory of 3076	740	cmd.exe	103
PID 740 wrote to memory of 3076	740	cmd.exe	103
PID 4136 wrote to memory of 2292	4136	avscan.exe	107
PID 4136 wrote to memory of 2292	4136	avscan.exe	107
PID 4136 wrote to memory of 2292	4136	avscan.exe	107
PID 3692 wrote to memory of 2560	3692	hosts.exe	109
PID 3692 wrote to memory of 2560	3692	hosts.exe	109
PID 3692 wrote to memory of 2560	3692	hosts.exe	109
PID 4136 wrote to memory of 1988	4136	avscan.exe	112
PID 4136 wrote to memory of 1988	4136	avscan.exe	112
PID 4136 wrote to memory of 1988	4136	avscan.exe	112
PID 3692 wrote to memory of 1388	3692	hosts.exe	114
PID 3692 wrote to memory of 1388	3692	hosts.exe	114
PID 3692 wrote to memory of 1388	3692	hosts.exe	114
PID 4136 wrote to memory of 4264	4136	avscan.exe	117
PID 4136 wrote to memory of 4264	4136	avscan.exe	117
PID 4136 wrote to memory of 4264	4136	avscan.exe	117
PID 3692 wrote to memory of 3124	3692	hosts.exe	119
PID 3692 wrote to memory of 3124	3692	hosts.exe	119
PID 3692 wrote to memory of 3124	3692	hosts.exe	119
PID 4136 wrote to memory of 3584	4136	avscan.exe	121
PID 4136 wrote to memory of 3584	4136	avscan.exe	121
PID 4136 wrote to memory of 3584	4136	avscan.exe	121
PID 3692 wrote to memory of 2352	3692	hosts.exe	123
PID 3692 wrote to memory of 2352	3692	hosts.exe	123
PID 3692 wrote to memory of 2352	3692	hosts.exe	123

C:\Users\Admin\AppData\Local\Temp\5ddd1c512708614222713e090b65417e588289519c991de4f159a74f901c8cc4.exe
"C:\Users\Admin\AppData\Local\Temp\5ddd1c512708614222713e090b65417e588289519c991de4f159a74f901c8cc4.exe"
1⤵
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1664
- C:\Windows\SysWOW64\REG.exe
  REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
  2⤵
  - Impair Defenses: Safe Mode Boot
  - System Location Discovery: System Language Discovery
  - Modifies registry key
  PID:4008
- C:\Users\Admin\AppData\Local\Temp\avscan.exe
  C:\Users\Admin\AppData\Local\Temp\avscan.exe
  2⤵
  - Modifies visibility of file extensions in Explorer
  - Modifies visiblity of hidden/system files in Explorer
  - Executes dropped EXE
  - Adds Run key to start application
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4136
- - C:\Users\Admin\AppData\Local\Temp\avscan.exe
    C:\Users\Admin\AppData\Local\Temp\avscan.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:2384
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c c:\windows\W_X_C.bat
    3⤵
    - Checks computer location settings
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    - Suspicious use of WriteProcessMemory
    PID:4044
  - - C:\windows\hosts.exe
      C:\windows\hosts.exe
      4⤵
      Modifies visibility of file extensions in Explorer
      Modifies visiblity of hidden/system files in Explorer
      Executes dropped EXE
      Adds Run key to start application
      Drops file in Windows directory
      System Location Discovery: System Language Discovery
      Suspicious behavior: GetForegroundWindowSpam
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:3692
    - - C:\Users\Admin\AppData\Local\Temp\avscan.exe
        
        C:\Users\Admin\AppData\Local\Temp\avscan.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:3556
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c c:\windows\W_X_C.bat
        5⤵
        Checks computer location settings
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:740
      - C:\windows\hosts.exe
        
        C:\windows\hosts.exe
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:4752
      - C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Windows\W_X_C.vbs"
        6⤵
        Adds policy Run key to start application
        System Location Discovery: System Language Discovery
        
        PID:3076
    - - C:\Windows\SysWOW64\REG.exe
        
        REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
        5⤵
        System Location Discovery: System Language Discovery
        Modifies registry key
        
        PID:2560
    - - C:\Windows\SysWOW64\REG.exe
        
        REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
        5⤵
        System Location Discovery: System Language Discovery
        Modifies registry key
        
        PID:1388
    - - C:\Windows\SysWOW64\REG.exe
        
        REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
        5⤵
        System Location Discovery: System Language Discovery
        Modifies registry key
        
        PID:3124
    - - C:\Windows\SysWOW64\REG.exe
        
        REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
        5⤵
        System Location Discovery: System Language Discovery
        Modifies registry key
        
        PID:2352
  - - C:\Windows\SysWOW64\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Windows\W_X_C.vbs"
      4⤵
      Adds policy Run key to start application
      System Location Discovery: System Language Discovery
      PID:3180
- - C:\Windows\SysWOW64\REG.exe
    REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies registry key
    PID:2292
- - C:\Windows\SysWOW64\REG.exe
    REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies registry key
    PID:1988
- - C:\Windows\SysWOW64\REG.exe
    REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies registry key
    PID:4264
- - C:\Windows\SysWOW64\REG.exe
    REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies registry key
    PID:3584
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c c:\windows\W_X_C.bat
  2⤵
  - Checks computer location settings
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:4732
- - C:\windows\hosts.exe
    C:\windows\hosts.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:4308
- - C:\Windows\SysWOW64\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Windows\W_X_C.vbs"
    3⤵
    - Adds policy Run key to start application
    - System Location Discovery: System Language Discovery
    PID:1624

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:3788

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Impair Defenses

T1562

Safe Mode Boot

T1562.009

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\avscan.exe

Filesize
1.2MB

MD5
035ef349ed48548ead897bddc1484f66

SHA1
dabcc621482c555cbea3fe114fb5d3117a57268b

SHA256
7f5af74a19150f4190f81b66ed0073dd79e09f5d900973e3337b78794807e392

SHA512
a06b7ed733a959d92c742c61d078a3fbfbfa5dbcb67e97274c991df4d491a1b44414651a83a21d61f842599ccc2f4a2c3d5492629e3ec20f3b560cd2a075b054

Download Submit
C:\Windows\W_X_C.vbs

Filesize
195B

MD5
a0fd009027b53a7b2b428664c8a41b15

SHA1
29ab6988e303371794bf89b5f65ffbd4bcb96c1b

SHA256
fc0183881672bc2a97f476aad8a54dd4c8d6a0bb25ae84f52020e3e407f63e05

SHA512
5b0f5ee78608095988a96a89f8b6584640525c20722b1ef2f6bd12ec0e7bec6830b364ad1ed70607ca82e6b1169de0f7006518c146f4e6852b281e40967af81e

Download Submit
C:\Windows\hosts.exe

Filesize
1.2MB

MD5
3ec1af1812cbce2b44a7b785bfb65740

SHA1
78249092779b3580f26a9c0c5c1bd7a4ed8be3ff

SHA256
95f7a5b25599d38b9a7204ee658fb21ebd6f43d7a147c46cd92795408b8171b6

SHA512
f76dcbbab84258a3e8e8874c55f5825be89edbbb045fc4e6afd748ab17e0c25702fd6825a6eead36aac71cfcc0188de53eeb0b1d0a187cdb115656d75991170f

Download Submit
\??\c:\windows\W_X_C.bat

Filesize
336B

MD5
4db9f8b6175722b62ececeeeba1ce307

SHA1
3b3ba8414706e72a6fa19e884a97b87609e11e47

SHA256
d2150b9e5a4ce55e140f0ca91c4e300715d42095c8fddf58c77037cdd2cfaf78

SHA512
1d6dc274cf7a3dd704f840e6a5ad57ab4c4e35d5f09489aeff520bb797e1c825bac53fc335156fe41e767a46520d031855fe42fe7b175409ebe5e9e986fb9b8b

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads