73e1debe3f0503cd360e4a59256c5a677bad7350b14615ee904a8fa117e595b7

Resubmissions

04/08/2026, 14:31

260804-rvvkdszsdt8

04/08/2026, 14:28

260804-rs196acc398

Analysis

user interaction
yes
max time kernel
149s
max time network
150s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
04/08/2026, 14:28

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Hosts_Patch.cmd
Size 1KB
Sample260804-rs196acc39
SHA256 73e1debe3f0503cd360e4a59256c5a677bad7350b14615ee904a8fa117e595b7
MD5 09dda74b02658694dcad9d4479679bb9
SHA1 361a8d604a9cd47b099cb79fb430096ba16b04be
SHA512 5ce5652dbe526cae430af8e9d425e5867d241cc089d056f5bfded3e627653a72045ecf9fe9a63b6f2c662543f35e8fb92589b56c94579115441e790ccbb9513a
TLSH
T1C8215A6C0B0DAA20AAB11158B37B40F1E736A23B6E0625117D6D6506B7F1BCD2A35AF4
MD5 SHA1 SHA512 TLSH

Score

8^/10

defense_evasion execution ransomware

Malware Config

Signatures

Drops file in Drivers directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\drivers\etc\hosts	attrib.exe
File opened for modification	C:\Windows\system32\drivers\etc\hosts	cmd.exe
File opened for modification	C:\Windows\system32\drivers\etc\hosts	attrib.exe

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3376	cmd.exe

Opens file in notepad (likely ransom note) 1 IoCs

ransomware

pid	Process
2908	NOTEPAD.EXE

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 3376 wrote to memory of 4232	3376	cmd.exe	81
PID 3376 wrote to memory of 2584	3376	cmd.exe	82
PID 3376 wrote to memory of 4804	3376	cmd.exe	83
PID 3376 wrote to memory of 4268	3376	cmd.exe	84
PID 3376 wrote to memory of 3828	3376	cmd.exe	85

Views/modifies file attributes 1 TTPs 2 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
4232	attrib.exe
3828	attrib.exe

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\Hosts_Patch.cmd"
1⤵
- Drops file in Drivers directory
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:3376
- C:\Windows\system32\attrib.exe
  attrib.exe -r -s -h "C:\Windows\system32\drivers\etc\hosts"
  2⤵
  - Drops file in Drivers directory
  - Views/modifies file attributes
  PID:4232
- C:\Windows\system32\openfiles.exe
  OPENFILES
  2⤵
  PID:2584
- C:\Windows\system32\find.exe
  FIND /C /I "127.0.0.1 license.serato.com" "C:\Windows\system32\drivers\etc\hosts"
  2⤵
  PID:4804
- C:\Windows\system32\find.exe
  FIND /C /I "127.0.0.1 license.serato.io" "C:\Windows\system32\drivers\etc\hosts"
  2⤵
  PID:4268
- C:\Windows\system32\attrib.exe
  attrib.exe +r "C:\Windows\system32\drivers\etc\hosts"
  2⤵
  - Drops file in Drivers directory
  - Views/modifies file attributes
  PID:3828

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:2404

C:\Windows\System32\NOTEPAD.EXE
"C:\Windows\System32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\Temp\Hosts_Patch.cmd
1⤵
- Opens file in notepad (likely ransom note)
PID:2908

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

hosts

Path C:\Windows\system32\drivers\etc\hosts
Size 1KB
SHA256 ee6b49de1555f8f9ac6d82a902745119b502181b6fba1673895c802570a2afd5
MD5 c353bbcefd4ca52bd605b2b5618ac76c
SHA1 b525b002ed96ad0625f9b639653abb632e9160cf
SHA512 ebfaf3daf1c6ed54c83539f707059a8ab40dea636e14bd61663400370ab123b8bfe45d60f9ba9aae472b7fee6fc2de0ed97397359fedfa4ab28090328e148516
TLSH
T12621DD2A0649915D26F341E5091CB42FA31FD0EF0E3B8DCD3E8E454F7BA2A1C5366746
MD5 SHA1 SHA512 TLSH

Submit Download