9d8133b2138a8f1e1e2035d0b8a82827675d77e6307ccd943f209ca5e7e5ba81

Analysis

max time kernel
122s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
13/10/2024, 01:06

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

9d8133b2138a8f1e1e2035d0b8a82827675d77e6307ccd943f209ca5e7e5ba81.exe
Size

2.1MB
MD5

8e3c20227c45fb59c9a595c3a78448de
SHA1

85b16583812a18d1d718222bd423dc0dd92eaddb
SHA256

9d8133b2138a8f1e1e2035d0b8a82827675d77e6307ccd943f209ca5e7e5ba81
SHA512

30fdcf629c43cc0ed2118a3d4ddb591d803b93e2b54c3451b7f046d662315dd5a0916ec4a22068d423a977e6847b697a8f597b749f7a505dda3b660486f7c9e1
SSDEEP

49152:g727d7A7yD7q7yD72747q7yD7A7yD7q7yDD:g65MmD2mD6c2mDMmD2mDD

Score

10^/10

defense_evasion discovery evasion persistence

Malware Config

Signatures

Modifies visibility of file extensions in Explorer 2 TTPs 3 IoCs

evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	9d8133b2138a8f1e1e2035d0b8a82827675d77e6307ccd943f209ca5e7e5ba81.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	avscan.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	hosts.exe

Modifies visiblity of hidden/system files in Explorer 2 TTPs 3 IoCs

evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	9d8133b2138a8f1e1e2035d0b8a82827675d77e6307ccd943f209ca5e7e5ba81.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	avscan.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	hosts.exe

Adds policy Run key to start application 2 TTPs 6 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	WScript.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\ZTSLLRFH = "W_X_C.bat"	WScript.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	WScript.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\ZTSLLRFH = "W_X_C.bat"	WScript.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	WScript.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\ZTSLLRFH = "W_X_C.bat"	WScript.exe

Checks computer location settings 2 TTPs 3 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\International\Geo\Nation	cmd.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\International\Geo\Nation	cmd.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\International\Geo\Nation	cmd.exe

Executes dropped EXE 6 IoCs

pid	Process
5008	avscan.exe
2260	avscan.exe
3340	hosts.exe
5100	hosts.exe
724	avscan.exe
1704	hosts.exe

Impair Defenses: Safe Mode Boot 1 TTPs 6 IoCs

defense_evasion

Safe Mode Boot

T1562.009

description	ioc	Process
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\ProfSvc	REG.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\SerCx2.sys	REG.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\UserManager	REG.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\CBDHSvc	REG.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\iai2c.sys	REG.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\Power	REG.exe

Adds Run key to start application 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\avscan = "C:\\Users\\Admin\\AppData\\Local\\Temp\\avscan.exe"	hosts.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\avscan = "C:\\Users\\Admin\\AppData\\Local\\Temp\\avscan.exe"	9d8133b2138a8f1e1e2035d0b8a82827675d77e6307ccd943f209ca5e7e5ba81.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\avscan = "C:\\Users\\Admin\\AppData\\Local\\Temp\\avscan.exe"	avscan.exe

Drops file in Windows directory 5 IoCs

description	ioc	Process
File created	\??\c:\windows\W_X_C.bat	9d8133b2138a8f1e1e2035d0b8a82827675d77e6307ccd943f209ca5e7e5ba81.exe
File opened for modification	C:\Windows\hosts.exe	9d8133b2138a8f1e1e2035d0b8a82827675d77e6307ccd943f209ca5e7e5ba81.exe
File opened for modification	C:\Windows\hosts.exe	avscan.exe
File opened for modification	C:\Windows\hosts.exe	hosts.exe
File created	C:\windows\W_X_C.vbs	9d8133b2138a8f1e1e2035d0b8a82827675d77e6307ccd943f209ca5e7e5ba81.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 22 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	9d8133b2138a8f1e1e2035d0b8a82827675d77e6307ccd943f209ca5e7e5ba81.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	REG.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	avscan.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	avscan.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hosts.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	REG.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	avscan.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	REG.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	REG.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	REG.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	REG.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hosts.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hosts.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	REG.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	REG.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	REG.exe

Modifies registry class 4 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000_Classes\Local Settings	9d8133b2138a8f1e1e2035d0b8a82827675d77e6307ccd943f209ca5e7e5ba81.exe
Key created	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000_Classes\Local Settings	cmd.exe

Modifies registry key 1 TTPs 9 IoCs

Modify Registry

T1112

pid	Process
4348	REG.exe
5068	REG.exe
3736	REG.exe
1572	REG.exe
1932	REG.exe
3364	REG.exe
544	REG.exe
2804	REG.exe
3852	REG.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

pid	Process
5008	avscan.exe
3340	hosts.exe

Suspicious use of SetWindowsHookEx 7 IoCs

pid	Process
4728	9d8133b2138a8f1e1e2035d0b8a82827675d77e6307ccd943f209ca5e7e5ba81.exe
5008	avscan.exe
2260	avscan.exe
3340	hosts.exe
5100	hosts.exe
724	avscan.exe
1704	hosts.exe

Suspicious use of WriteProcessMemory 63 IoCs

description	pid	Process	procid_target
PID 4728 wrote to memory of 3364	4728	9d8133b2138a8f1e1e2035d0b8a82827675d77e6307ccd943f209ca5e7e5ba81.exe	84
PID 4728 wrote to memory of 3364	4728	9d8133b2138a8f1e1e2035d0b8a82827675d77e6307ccd943f209ca5e7e5ba81.exe	84
PID 4728 wrote to memory of 3364	4728	9d8133b2138a8f1e1e2035d0b8a82827675d77e6307ccd943f209ca5e7e5ba81.exe	84
PID 4728 wrote to memory of 5008	4728	9d8133b2138a8f1e1e2035d0b8a82827675d77e6307ccd943f209ca5e7e5ba81.exe	87
PID 4728 wrote to memory of 5008	4728	9d8133b2138a8f1e1e2035d0b8a82827675d77e6307ccd943f209ca5e7e5ba81.exe	87
PID 4728 wrote to memory of 5008	4728	9d8133b2138a8f1e1e2035d0b8a82827675d77e6307ccd943f209ca5e7e5ba81.exe	87
PID 5008 wrote to memory of 2260	5008	avscan.exe	88
PID 5008 wrote to memory of 2260	5008	avscan.exe	88
PID 5008 wrote to memory of 2260	5008	avscan.exe	88
PID 5008 wrote to memory of 344	5008	avscan.exe	89
PID 5008 wrote to memory of 344	5008	avscan.exe	89
PID 5008 wrote to memory of 344	5008	avscan.exe	89
PID 4728 wrote to memory of 1532	4728	9d8133b2138a8f1e1e2035d0b8a82827675d77e6307ccd943f209ca5e7e5ba81.exe	90
PID 4728 wrote to memory of 1532	4728	9d8133b2138a8f1e1e2035d0b8a82827675d77e6307ccd943f209ca5e7e5ba81.exe	90
PID 4728 wrote to memory of 1532	4728	9d8133b2138a8f1e1e2035d0b8a82827675d77e6307ccd943f209ca5e7e5ba81.exe	90
PID 1532 wrote to memory of 3340	1532	cmd.exe	93
PID 1532 wrote to memory of 3340	1532	cmd.exe	93
PID 1532 wrote to memory of 3340	1532	cmd.exe	93
PID 344 wrote to memory of 5100	344	cmd.exe	94
PID 344 wrote to memory of 5100	344	cmd.exe	94
PID 344 wrote to memory of 5100	344	cmd.exe	94
PID 3340 wrote to memory of 724	3340	hosts.exe	95
PID 3340 wrote to memory of 724	3340	hosts.exe	95
PID 3340 wrote to memory of 724	3340	hosts.exe	95
PID 3340 wrote to memory of 3076	3340	hosts.exe	97
PID 3340 wrote to memory of 3076	3340	hosts.exe	97
PID 3340 wrote to memory of 3076	3340	hosts.exe	97
PID 1532 wrote to memory of 2972	1532	cmd.exe	98
PID 1532 wrote to memory of 2972	1532	cmd.exe	98
PID 1532 wrote to memory of 2972	1532	cmd.exe	98
PID 344 wrote to memory of 4436	344	cmd.exe	100
PID 344 wrote to memory of 4436	344	cmd.exe	100
PID 344 wrote to memory of 4436	344	cmd.exe	100
PID 3076 wrote to memory of 1704	3076	cmd.exe	101
PID 3076 wrote to memory of 1704	3076	cmd.exe	101
PID 3076 wrote to memory of 1704	3076	cmd.exe	101
PID 3076 wrote to memory of 2900	3076	cmd.exe	102
PID 3076 wrote to memory of 2900	3076	cmd.exe	102
PID 3076 wrote to memory of 2900	3076	cmd.exe	102
PID 5008 wrote to memory of 4348	5008	avscan.exe	107
PID 5008 wrote to memory of 4348	5008	avscan.exe	107
PID 5008 wrote to memory of 4348	5008	avscan.exe	107
PID 3340 wrote to memory of 544	3340	hosts.exe	109
PID 3340 wrote to memory of 544	3340	hosts.exe	109
PID 3340 wrote to memory of 544	3340	hosts.exe	109
PID 5008 wrote to memory of 5068	5008	avscan.exe	112
PID 5008 wrote to memory of 5068	5008	avscan.exe	112
PID 5008 wrote to memory of 5068	5008	avscan.exe	112
PID 3340 wrote to memory of 2804	3340	hosts.exe	114
PID 3340 wrote to memory of 2804	3340	hosts.exe	114
PID 3340 wrote to memory of 2804	3340	hosts.exe	114
PID 5008 wrote to memory of 3852	5008	avscan.exe	117
PID 5008 wrote to memory of 3852	5008	avscan.exe	117
PID 5008 wrote to memory of 3852	5008	avscan.exe	117
PID 3340 wrote to memory of 3736	3340	hosts.exe	119
PID 3340 wrote to memory of 3736	3340	hosts.exe	119
PID 3340 wrote to memory of 3736	3340	hosts.exe	119
PID 5008 wrote to memory of 1572	5008	avscan.exe	121
PID 5008 wrote to memory of 1572	5008	avscan.exe	121
PID 5008 wrote to memory of 1572	5008	avscan.exe	121
PID 3340 wrote to memory of 1932	3340	hosts.exe	123
PID 3340 wrote to memory of 1932	3340	hosts.exe	123
PID 3340 wrote to memory of 1932	3340	hosts.exe	123

C:\Users\Admin\AppData\Local\Temp\9d8133b2138a8f1e1e2035d0b8a82827675d77e6307ccd943f209ca5e7e5ba81.exe
"C:\Users\Admin\AppData\Local\Temp\9d8133b2138a8f1e1e2035d0b8a82827675d77e6307ccd943f209ca5e7e5ba81.exe"
1⤵
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4728
- C:\Windows\SysWOW64\REG.exe
  REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
  2⤵
  - Impair Defenses: Safe Mode Boot
  - System Location Discovery: System Language Discovery
  - Modifies registry key
  PID:3364
- C:\Users\Admin\AppData\Local\Temp\avscan.exe
  C:\Users\Admin\AppData\Local\Temp\avscan.exe
  2⤵
  - Modifies visibility of file extensions in Explorer
  - Modifies visiblity of hidden/system files in Explorer
  - Executes dropped EXE
  - Adds Run key to start application
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:5008
- - C:\Users\Admin\AppData\Local\Temp\avscan.exe
    C:\Users\Admin\AppData\Local\Temp\avscan.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:2260
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c c:\windows\W_X_C.bat
    3⤵
    - Checks computer location settings
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    - Suspicious use of WriteProcessMemory
    PID:344
  - - C:\windows\hosts.exe
      C:\windows\hosts.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:5100
  - - C:\Windows\SysWOW64\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Windows\W_X_C.vbs"
      4⤵
      Adds policy Run key to start application
      System Location Discovery: System Language Discovery
      PID:4436
- - C:\Windows\SysWOW64\REG.exe
    REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies registry key
    PID:4348
- - C:\Windows\SysWOW64\REG.exe
    REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies registry key
    PID:5068
- - C:\Windows\SysWOW64\REG.exe
    REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies registry key
    PID:3852
- - C:\Windows\SysWOW64\REG.exe
    REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies registry key
    PID:1572
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c c:\windows\W_X_C.bat
  2⤵
  - Checks computer location settings
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:1532
- - C:\windows\hosts.exe
    C:\windows\hosts.exe
    3⤵
    - Modifies visibility of file extensions in Explorer
    - Modifies visiblity of hidden/system files in Explorer
    - Executes dropped EXE
    - Adds Run key to start application
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:3340
  - - C:\Users\Admin\AppData\Local\Temp\avscan.exe
      C:\Users\Admin\AppData\Local\Temp\avscan.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:724
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c c:\windows\W_X_C.bat
      4⤵
      Checks computer location settings
      System Location Discovery: System Language Discovery
      Modifies registry class
      Suspicious use of WriteProcessMemory
      PID:3076
    - - C:\windows\hosts.exe
        
        C:\windows\hosts.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:1704
    - - C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Windows\W_X_C.vbs"
        5⤵
        Adds policy Run key to start application
        System Location Discovery: System Language Discovery
        
        PID:2900
  - - C:\Windows\SysWOW64\REG.exe
      REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
      4⤵
      System Location Discovery: System Language Discovery
      Modifies registry key
      PID:544
  - - C:\Windows\SysWOW64\REG.exe
      REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
      4⤵
      System Location Discovery: System Language Discovery
      Modifies registry key
      PID:2804
  - - C:\Windows\SysWOW64\REG.exe
      REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
      4⤵
      System Location Discovery: System Language Discovery
      Modifies registry key
      PID:3736
  - - C:\Windows\SysWOW64\REG.exe
      REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
      4⤵
      System Location Discovery: System Language Discovery
      Modifies registry key
      PID:1932
- - C:\Windows\SysWOW64\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Windows\W_X_C.vbs"
    3⤵
    - Adds policy Run key to start application
    - System Location Discovery: System Language Discovery
    PID:2972

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4800

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Impair Defenses

T1562

Safe Mode Boot

T1562.009

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\avscan.exe

Filesize
2.1MB

MD5
aa665b1fdbd57a3b8aed40ccf3262d5b

SHA1
33c466ea18e1736155893643ca18878258b6b011

SHA256
30a1bd417e66adbbc041042573bbbbfec8d5c5198cd29e795a822b85eddd3fe9

SHA512
dc10dba1df8885c9956917c0497d8066f0f3de426c58087935bec7b23d310ca27fb97642ead677983563f8b03776a902815c07024875bd139a1a4473eb49b385

Download Submit
C:\Windows\W_X_C.vbs

Filesize
195B

MD5
cf0c3c4d1cfde4ae4bd2841efd95456c

SHA1
46c1689e60cdea314b197bf489c4079517c9b834

SHA256
72b796e24c5e22d9780a44f6abc051cad66c5d6ead97e3856709509954e72575

SHA512
4fe00e6e317432796fa47238e13d6ce5f3d25e561fa3d1e21cf95cd0af46fc3d461c2b4badb2da8d671b2422bc7b39c536e7cba358d84bf59f8801d5470461c0

Download Submit
C:\Windows\hosts.exe

Filesize
2.1MB

MD5
c33d4074c50cb627fe9e8240acd871e9

SHA1
09ec3aa9e6353b3c03b05a7b3a95b5cc22402082

SHA256
c11b74162a45e03595a78bc3054a7d4eb1cf83f71858053bb1322c7fbc0342ab

SHA512
1b02f91038ab6a20b650a5b1f9621ee509c149422dc4554043f57b82fe02e971f75f1709409422957e21f3686ad805240a2760a670cc4ce0d7e0fbfe78d8bdca

Download Submit
\??\c:\windows\W_X_C.bat

Filesize
336B

MD5
4db9f8b6175722b62ececeeeba1ce307

SHA1
3b3ba8414706e72a6fa19e884a97b87609e11e47

SHA256
d2150b9e5a4ce55e140f0ca91c4e300715d42095c8fddf58c77037cdd2cfaf78

SHA512
1d6dc274cf7a3dd704f840e6a5ad57ab4c4e35d5f09489aeff520bb797e1c825bac53fc335156fe41e767a46520d031855fe42fe7b175409ebe5e9e986fb9b8b

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads