lunam | 03b13a715da2a01ab1f027e3c35631d3708a2e6c88c57bcdddf31eb8ed90f9d8

Analysis

max time kernel
148s
max time network
137s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
24/08/2026, 14:05

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
03b13a715da2a01ab1f027e3c35631d3708a2e6c88c57bcdddf31eb8ed90f9d8.exe
Size 9.0MB
Sample260824-rdtxjayfqe
SHA256 03b13a715da2a01ab1f027e3c35631d3708a2e6c88c57bcdddf31eb8ed90f9d8
MD5 289b6228bb92543153d427dcb1272aa4
SHA1 6c2d162d46d2cf03a158178cb9784ab53048dd46
SHA512 ca468590cf9a3e1579a79bca66b72ee0659dcdaf7dfe7e86986e2f1570981cfe131e951545ec05db38ba843ba892f0fd34dacede666a2bc00c9d11e0820bdaa9
SSDEEP 12288:b7IoSkaoSdaoS4aoSDaoS4aoSDaoS4aoSDaoS4aoS4aoS4aoSDaoS4aoSDaoS4aR:b737k
TLSH
T1E5A69F537757A50BF0268A390A11879D5396FE328E027897B2D43E3B3C332CB6E59971
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery execution lunam persistence trojan upx

Malware Config

Signatures

Family: Lunam
Lunam is a Windows trojan written in Visual Basic.
trojan lunam

Detects Lunam 12 IoCs

resource	yara_rule
behavioral1/files/0x00070000000244ff-9.dat	family_lunam
behavioral1/files/0x0007000000024500-13.dat	family_lunam
behavioral1/files/0x00010000000237c0-48.dat	family_lunam
behavioral1/files/0x000200000001dc54-50.dat	family_lunam
behavioral1/files/0x00010000000237c0-52.dat	family_lunam
behavioral1/files/0x000200000001dc54-54.dat	family_lunam
behavioral1/files/0x00010000000237c0-56.dat	family_lunam
behavioral1/files/0x000200000001dc54-58.dat	family_lunam
behavioral1/files/0x00010000000237c0-60.dat	family_lunam
behavioral1/files/0x000200000001dc54-62.dat	family_lunam
behavioral1/files/0x00010000000237c0-64.dat	family_lunam
behavioral1/files/0x000200000001dc54-66.dat	family_lunam

Modifies visibility of file extensions in Explorer 2 TTPs 3 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	03b13a715da2a01ab1f027e3c35631d3708a2e6c88c57bcdddf31eb8ed90f9d8.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	avscan.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	hosts.exe

Modifies visibility of hidden/system files in Explorer 2 TTPs 3 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	03b13a715da2a01ab1f027e3c35631d3708a2e6c88c57bcdddf31eb8ed90f9d8.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	avscan.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	hosts.exe

Adds policy Run key to start application 2 TTPs 6 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	WScript.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\TIGMGOLM = "W_X_C.bat"	WScript.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	WScript.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\TIGMGOLM = "W_X_C.bat"	WScript.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	WScript.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\TIGMGOLM = "W_X_C.bat"	WScript.exe

Checks computer location settings 2 TTPs 3 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000\Control Panel\International\Geo\Nation	cmd.exe
Key value queried	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000\Control Panel\International\Geo\Nation	cmd.exe
Key value queried	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000\Control Panel\International\Geo\Nation	cmd.exe

Executes dropped EXE 6 IoCs

pid	Process
1636	avscan.exe
5028	avscan.exe
4328	hosts.exe
4496	hosts.exe
2968	avscan.exe
2064	hosts.exe

Impair Defenses: Safe Mode Boot 1 TTPs 6 IoCs

defense_evasion

Safe Mode Boot

T1562.009

description	ioc	Process
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\Power	REG.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\ProfSvc	REG.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\SerCx2.sys	REG.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\UserManager	REG.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\CBDHSvc	REG.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\iai2c.sys	REG.exe

Adds Run key to start application 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\avscan = "C:\\Users\\Admin\\AppData\\Local\\Temp\\avscan.exe"	03b13a715da2a01ab1f027e3c35631d3708a2e6c88c57bcdddf31eb8ed90f9d8.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\avscan = "C:\\Users\\Admin\\AppData\\Local\\Temp\\avscan.exe"	avscan.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\avscan = "C:\\Users\\Admin\\AppData\\Local\\Temp\\avscan.exe"	hosts.exe

Executes a VBScript file via the Windows Script Host. 1 TTPs 3 IoCs

execution

Visual Basic

T1059.005

pid	Process
4428	WScript.exe
624	WScript.exe
4988	WScript.exe

UPX packed file 21 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/1996-0-0x0000000000400000-0x000000000042E000-memory.dmp	upx
behavioral1/files/0x00070000000244ff-9.dat	upx
behavioral1/files/0x0007000000024500-13.dat	upx
behavioral1/memory/5028-16-0x0000000000400000-0x000000000042E000-memory.dmp	upx
behavioral1/memory/1996-21-0x0000000000400000-0x000000000042E000-memory.dmp	upx
behavioral1/memory/5028-22-0x0000000000400000-0x000000000042E000-memory.dmp	upx
behavioral1/memory/4496-35-0x0000000000400000-0x000000000042E000-memory.dmp	upx
behavioral1/memory/2968-39-0x0000000000400000-0x000000000042E000-memory.dmp	upx
behavioral1/memory/2064-43-0x0000000000400000-0x000000000042E000-memory.dmp	upx
behavioral1/memory/1636-44-0x0000000000400000-0x000000000042E000-memory.dmp	upx
behavioral1/memory/4328-45-0x0000000000400000-0x000000000042E000-memory.dmp	upx
behavioral1/files/0x00010000000237c0-48.dat	upx
behavioral1/files/0x000200000001dc54-50.dat	upx
behavioral1/files/0x00010000000237c0-52.dat	upx
behavioral1/files/0x000200000001dc54-54.dat	upx
behavioral1/files/0x00010000000237c0-56.dat	upx
behavioral1/files/0x000200000001dc54-58.dat	upx
behavioral1/files/0x00010000000237c0-60.dat	upx
behavioral1/files/0x000200000001dc54-62.dat	upx
behavioral1/files/0x00010000000237c0-64.dat	upx
behavioral1/files/0x000200000001dc54-66.dat	upx

Drops file in Windows directory 5 IoCs

description	ioc	Process
File created	C:\windows\W_X_C.vbs	03b13a715da2a01ab1f027e3c35631d3708a2e6c88c57bcdddf31eb8ed90f9d8.exe
File created	\??\c:\windows\W_X_C.bat	03b13a715da2a01ab1f027e3c35631d3708a2e6c88c57bcdddf31eb8ed90f9d8.exe
File opened for modification	C:\Windows\hosts.exe	03b13a715da2a01ab1f027e3c35631d3708a2e6c88c57bcdddf31eb8ed90f9d8.exe
File opened for modification	C:\Windows\hosts.exe	avscan.exe
File opened for modification	C:\Windows\hosts.exe	hosts.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
1792	cmd.exe
3040	cmd.exe
2388	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 22 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	avscan.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	REG.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	REG.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	REG.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hosts.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	REG.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	REG.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	avscan.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hosts.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	REG.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	REG.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	REG.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	REG.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	avscan.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hosts.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	03b13a715da2a01ab1f027e3c35631d3708a2e6c88c57bcdddf31eb8ed90f9d8.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe

Modifies registry class 4 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings	03b13a715da2a01ab1f027e3c35631d3708a2e6c88c57bcdddf31eb8ed90f9d8.exe
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings	cmd.exe

Modifies registry key 1 TTPs 9 IoCs

Modify Registry

T1112

pid	Process
1068	REG.exe
4124	REG.exe
3776	REG.exe
1144	REG.exe
3936	REG.exe
1744	REG.exe
3384	REG.exe
1940	REG.exe
1544	REG.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

pid	Process
1636	avscan.exe
4328	hosts.exe

Suspicious use of SetWindowsHookEx 7 IoCs

pid	Process
1996	03b13a715da2a01ab1f027e3c35631d3708a2e6c88c57bcdddf31eb8ed90f9d8.exe
1636	avscan.exe
5028	avscan.exe
4328	hosts.exe
4496	hosts.exe
2968	avscan.exe
2064	hosts.exe

Suspicious use of WriteProcessMemory 21 IoCs

description	pid	Process	procid_target
PID 1996 wrote to memory of 1068	1996	03b13a715da2a01ab1f027e3c35631d3708a2e6c88c57bcdddf31eb8ed90f9d8.exe	86
PID 1996 wrote to memory of 1636	1996	03b13a715da2a01ab1f027e3c35631d3708a2e6c88c57bcdddf31eb8ed90f9d8.exe	88
PID 1636 wrote to memory of 5028	1636	avscan.exe	89
PID 1636 wrote to memory of 1792	1636	avscan.exe	90
PID 1996 wrote to memory of 3040	1996	03b13a715da2a01ab1f027e3c35631d3708a2e6c88c57bcdddf31eb8ed90f9d8.exe	91
PID 3040 wrote to memory of 4328	3040	cmd.exe	95
PID 1792 wrote to memory of 4496	1792	cmd.exe	96
PID 3040 wrote to memory of 4428	3040	cmd.exe	97
PID 4328 wrote to memory of 2968	4328	hosts.exe	98
PID 4328 wrote to memory of 2388	4328	hosts.exe	99
PID 1792 wrote to memory of 624	1792	cmd.exe	103
PID 2388 wrote to memory of 2064	2388	cmd.exe	104
PID 2388 wrote to memory of 4988	2388	cmd.exe	106
PID 1636 wrote to memory of 1744	1636	avscan.exe	112
PID 4328 wrote to memory of 4124	4328	hosts.exe	115
PID 1636 wrote to memory of 3776	1636	avscan.exe	117
PID 4328 wrote to memory of 3384	4328	hosts.exe	119
PID 1636 wrote to memory of 1940	1636	avscan.exe	121
PID 4328 wrote to memory of 1544	4328	hosts.exe	123
PID 1636 wrote to memory of 1144	1636	avscan.exe	125
PID 4328 wrote to memory of 3936	4328	hosts.exe	127

C:\Users\Admin\AppData\Local\Temp\03b13a715da2a01ab1f027e3c35631d3708a2e6c88c57bcdddf31eb8ed90f9d8.exe
"C:\Users\Admin\AppData\Local\Temp\03b13a715da2a01ab1f027e3c35631d3708a2e6c88c57bcdddf31eb8ed90f9d8.exe"
1⤵
- Modifies visibility of file extensions in Explorer
- Modifies visibility of hidden/system files in Explorer
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1996
- C:\Windows\SysWOW64\REG.exe
  REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
  2⤵
  - Impair Defenses: Safe Mode Boot
  - System Location Discovery: System Language Discovery
  - Modifies registry key
  PID:1068
- C:\Users\Admin\AppData\Local\Temp\avscan.exe
  C:\Users\Admin\AppData\Local\Temp\avscan.exe
  2⤵
  - Modifies visibility of file extensions in Explorer
  - Modifies visibility of hidden/system files in Explorer
  - Executes dropped EXE
  - Adds Run key to start application
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1636
- - C:\Users\Admin\AppData\Local\Temp\avscan.exe
    C:\Users\Admin\AppData\Local\Temp\avscan.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:5028
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c c:\windows\W_X_C.bat
    3⤵
    - Checks computer location settings
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    - Suspicious use of WriteProcessMemory
    PID:1792
  - - C:\windows\hosts.exe
      C:\windows\hosts.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:4496
  - - C:\Windows\SysWOW64\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Windows\W_X_C.vbs"
      4⤵
      Adds policy Run key to start application
      Executes a VBScript file via the Windows Script Host.
      System Location Discovery: System Language Discovery
      PID:624
- - C:\Windows\SysWOW64\REG.exe
    REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies registry key
    PID:1744
- - C:\Windows\SysWOW64\REG.exe
    REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies registry key
    PID:3776
- - C:\Windows\SysWOW64\REG.exe
    REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies registry key
    PID:1940
- - C:\Windows\SysWOW64\REG.exe
    REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies registry key
    PID:1144
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c c:\windows\W_X_C.bat
  2⤵
  - Checks computer location settings
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:3040
- - C:\windows\hosts.exe
    C:\windows\hosts.exe
    3⤵
    - Modifies visibility of file extensions in Explorer
    - Modifies visibility of hidden/system files in Explorer
    - Executes dropped EXE
    - Adds Run key to start application
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:4328
  - - C:\Users\Admin\AppData\Local\Temp\avscan.exe
      C:\Users\Admin\AppData\Local\Temp\avscan.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:2968
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c c:\windows\W_X_C.bat
      4⤵
      Checks computer location settings
      Executes a command shell one-liner
      System Location Discovery: System Language Discovery
      Modifies registry class
      Suspicious use of WriteProcessMemory
      PID:2388
    - - C:\windows\hosts.exe
        
        C:\windows\hosts.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:2064
    - - C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Windows\W_X_C.vbs"
        5⤵
        Adds policy Run key to start application
        Executes a VBScript file via the Windows Script Host.
        System Location Discovery: System Language Discovery
        
        PID:4988
  - - C:\Windows\SysWOW64\REG.exe
      REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
      4⤵
      System Location Discovery: System Language Discovery
      Modifies registry key
      PID:4124
  - - C:\Windows\SysWOW64\REG.exe
      REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
      4⤵
      System Location Discovery: System Language Discovery
      Modifies registry key
      PID:3384
  - - C:\Windows\SysWOW64\REG.exe
      REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
      4⤵
      System Location Discovery: System Language Discovery
      Modifies registry key
      PID:1544
  - - C:\Windows\SysWOW64\REG.exe
      REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
      4⤵
      System Location Discovery: System Language Discovery
      Modifies registry key
      PID:3936
- - C:\Windows\SysWOW64\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Windows\W_X_C.vbs"
    3⤵
    - Adds policy Run key to start application
    - Executes a VBScript file via the Windows Script Host.
    - System Location Discovery: System Language Discovery
    PID:4428

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4072

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Visual Basic

T1059.005

Windows Command Shell

T1059.003

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Impair Defenses

T1562

Safe Mode Boot

T1562.009

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

avscan.exe

Path C:\Users\Admin\AppData\Local\Temp\avscan.exe
Size 9.0MB
SHA256 e8bd7872ffff622ca32b94b48df96627b278b7935222447f904de964b362b781
MD5 9d225565cd547e89fa9a55f27a0d2ccc
SHA1 73c6d53cf5689750c4b59ef69a4a49689367e11e
SHA512 afa112e062403cc3bd744541cac676a69bcf5254a66e83227e48d28da14311ed948e76f337ad0c3f0eadf01e76f2ff682b7213875f488a1eb1d351a638cbcd18
SSDEEP 12288:b7IoSkaoSdaoS4aoSDaoS4aoSDaoS4aoSDaoS4aoS4aoS4aoSDaoS4aoSDaoS4ah:b737o
TLSH
T102A69F537757A50BF0268A390A11879D5396FE328E027897B2D43E3B3C332CB6E59971
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

128.png

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir3988_1880305382\CRX_INSTALL\128.png
Size 18.1MB
SHA256 bf4d0c65afcfdd2de219b85910c39b561490f71aa3b15abc481d19a1348770b9
MD5 c9ae032651ce96ffb415a8cd18116ab4
SHA1 f06bce1389dd9d1712a2b8c495e78f7a72bc458c
SHA512 4ec59d78e6e1c84c31a9ccf3bf5b57e38e13de658182accaf2e9c0c5795167b703a892d90b0f2c4f5c84810be3b040fd7455a1b83fe23c876080d76c4710c116
SSDEEP 12288:b7IoSkaoSdaoS4aoSDaoS4aoSDaoS4aoSDaoS4aoS4aoS4aoSDaoS4aoSDaoS4ad:b737y737z
TLSH
T1A7179F537757A50BF0268A390A11879D5396FE328E027897B2D43E3B3C332CB6E59971
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

128.png

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir3988_1880305382\CRX_INSTALL\128.png
Size 27.1MB
SHA256 b2927cc73d577a1a446fe883f7f69478bc8984d8f5643094c0c9ca726caaf1d1
MD5 9c38fc1aaa9a2a4023463f2409cfd676
SHA1 0d0a7da47926ef69a3081c908063402db34d2a88
SHA512 1444b40270c6f4e51b415260694cf62db832172339dd7d29c976f90dad43825cafc8318c88a4032e4da1fc374b92cebd034e60973459393770b74ca822a52130
SSDEEP 12288:b7IoSkaoSdaoS4aoSDaoS4aoSDaoS4aoSDaoS4aoS4aoS4aoSDaoS4aoSDaoS4ap:b737g737y737k
TLSH
T116579F537757A50BF0268A390A11879D5396FE328E027897B2D43E3B3C332CB6E59971
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

128.png

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir3988_1880305382\CRX_INSTALL\128.png
Size 36.2MB
SHA256 43984969a4fb55052808b72ac6afe09f7271912afc3b7d0355b3ae52d2e410a0
MD5 275648465a6fecbcc6b5b19deb8ee5c9
SHA1 399d936fb34f021839627d4f9c3215abb32b0da8
SHA512 13558013aa81b410ab0c6f50f811301b3bc5e0efe2a41f69f04d95726471116c15c129fa9ccb8b68be4d158017baa840a1898418d636ce322559bf25aa94a935
SSDEEP 12288:b7IoSkaoSdaoS4aoSDaoS4aoSDaoS4aoSDaoS4aoS4aoS4aoSDaoS4aoSDaoS4aX:b737y737g737y737p
TLSH
T11F879F537757A50BF0268A390A11879D5396FE328E027897B2D43E3B3C332CB6E59971
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

128.png

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir3988_1880305382\CRX_INSTALL\128.png
Size 45.2MB
SHA256 8ccf543c88b11f21ff0417e524008ccf9d9cf631b8f3d6dbf4ab671f2bc7c6b2
MD5 5656060cf740257f2771031f84a97e55
SHA1 6006478a8dc727194e4ed5ea0de5c10061b2d2f3
SHA512 99183ff56e986c11581bf1770d9c447e130b4f00886219d96f718cca739d78b713b7b2875635c5cb7d09ebfa3480c60120e26dd610670c81f59b775619d938a6
SSDEEP 12288:b7IoSkaoSdaoS4aoSDaoS4aoSDaoS4aoSDaoS4aoS4aoS4aoSDaoS4aoSDaoS4a7:b737g737y737g737y737C
TLSH
T1AAA79F537757A50BF0268A390A11879D5396FE328E027897B2D43E3B3C332CB6E59971
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

128.png

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir3988_1880305382\CRX_INSTALL\128.png
Size 54.3MB
SHA256 0e8315d2fc02004f8eda6057e1bc296bf79d34b22a56674201e424abeb494966
MD5 ca1b5bb16095edee06f5f53d177af402
SHA1 4b243bd0c88ebce651799a178a4c3b1723887c7f
SHA512 a0f440a510081658b4a611a36942f13a44c1e18c2bef7bdb20ed885aaa5a1e38cc04a11ffc7a013760683528a80115f3043b7323ad8b5c5e46f333afa25b345d
SSDEEP 12288:b7IoSkaoSdaoS4aoSDaoS4aoSDaoS4aoSDaoS4aoS4aoS4aoSDaoS4aoSDaoS4a/:b737y737g737y737g737y7375
TLSH
T1D5C79F537757A50BF0268A390A11879D5396FE328E027897B2D43E3B3C332CB6E59971
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

128.png

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir704_917838842\CRX_INSTALL\128.png
Size 18.1MB
SHA256 089fe94e9b78f066098ce59eafe6d8477c9b43d7e2f2f2368ac9bc370ce9d59e
MD5 4e0680dd35776a7c4a4af183c308f643
SHA1 4c585dfed7f2f91ec34f87a4e07c0657eab6c16b
SHA512 83a4320b73a76cced9b26d295cc6fba00f60957108ec4863baff5066e5af059b4d116e6e5b1c9ba519b616f8fd93630c8221453a0a0816bb9a880a262aa76e64
SSDEEP 12288:b7IoSkaoSdaoS4aoSDaoS4aoSDaoS4aoSDaoS4aoS4aoS4aoSDaoS4aoSDaoS4a8:b737y737G
TLSH
T113179F537757A50BF0268A390A11879D5396FE328E027897B2D43E3B3C332CB6E59971
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

128.png

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir704_917838842\CRX_INSTALL\128.png
Size 27.1MB
SHA256 2f5b7fd87845f3565c7162e8107c627e7c9fd1ff1d6b89b36b526bb5a6951510
MD5 5f96b09836f6a8dd4b07bdecc0d1366d
SHA1 4c985a3f68410cdd71db9ca0d7be6ea153f889bb
SHA512 d9475e89dbd9728679aa217c1be95fc6b49ae6bda2af6205970d27bc5f40bf11835f69e964ad902944ea344042862419782c2bc181d26ef1a3bf2c74a6dd0e6f
SSDEEP 12288:b7IoSkaoSdaoS4aoSDaoS4aoSDaoS4aoSDaoS4aoS4aoS4aoSDaoS4aoSDaoS4aQ:b737g737y737t
TLSH
T1D5579F537757A50BF0268A390A11879D5396FE328E027897B2D43E3B3C332CB6E59971
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

128.png

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir704_917838842\CRX_INSTALL\128.png
Size 36.2MB
SHA256 4d3825e654359c429b40e93e6e2d00c01a23af0c6044ced5e33900c708600c7c
MD5 79c5bd8e21e6501aa19f10844e71888a
SHA1 5c89ab09b5fc45e4d35807c7a568ffc6654b3a67
SHA512 530d50b15785b58ea510bc6523d2ecd45b190417945b4cf2670f94a1feb7c0d3300e0512e6219a7e18d872e9b853c5d1b342bf8590c6358ec1f6622b5a75a27b
SSDEEP 12288:b7IoSkaoSdaoS4aoSDaoS4aoSDaoS4aoSDaoS4aoS4aoS4aoSDaoS4aoSDaoS4aH:b737y737g737y737R
TLSH
T1EE879F537757A50BF0268A390A11879D5396FE328E027897B2D43E3B3C332CB6E59971
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

128.png

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir704_917838842\CRX_INSTALL\128.png
Size 45.2MB
SHA256 6f79d789dd0052220b993a0a4e3dd65d71ac98772eb48fb9bf60e1e7e690bfff
MD5 1b8518e893a75ec92b81f97ef106181f
SHA1 b01406d3a28eb1f257a98ed7d250b3f7ec94833a
SHA512 b1a7b57a2240415b9024853f03eb851ec63f4777d1bd5b21b10f2f7fd42901d2dafe4e0de435dc34828dc5228127071709939e1bcefda86e2b16f73b3179b363
SSDEEP 12288:b7IoSkaoSdaoS4aoSDaoS4aoSDaoS4aoSDaoS4aoS4aoS4aoSDaoS4aoSDaoS4af:b737g737y737g737y737e
TLSH
T1C3A79F537757A50BF0268A390A11879D5396FE328E027897B2D43E3B3C332CB6E59971
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

128.png

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir704_917838842\CRX_INSTALL\128.png
Size 54.3MB
SHA256 769dff3d95c1e7d85b0744a709657ab62b9668de714b2001da62356886a2e35c
MD5 3eb2196657e128567f6e61e540203347
SHA1 26a3884bc57df773d51d703d8fe52f6edcd1c344
SHA512 b1a89896bc6a721ab4ad1addd73810d43129054a091868ae9c0e869fedc90cecbf93992c97105def5a7d82c6382a133cd6e76a2174fa1f646eeb6cd2e2f30062
SSDEEP 12288:b7IoSkaoSdaoS4aoSDaoS4aoSDaoS4aoSDaoS4aoS4aoS4aoSDaoS4aoSDaoS4ap:b737K737T737y737g737y737O
TLSH
T105C79F537757A50BF0268A390A11879D5396FE328E027897B2D43E3B3C332CB6E59971
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

W_X_C.vbs

Path C:\Windows\W_X_C.vbs
Size 195B
SHA256 6e1f1a5cf696df3d046d9f41dc8d79dbe266b6c8d84cb4e6527088dc5e2f3029
MD5 54e6b9b4bf49d02d6de6be7f3dadb921
SHA1 8a7634f87f967a66889d08f386c07f15f0ac4863
SHA512 30363aa7586f6142473bcc467cd4a0cfc8ccbca79c647cb23065499f40471f08451456e25489fa8b03c999b3d4480b3753d3fc9ff64c5651a7feec308d6e6273
TLSH
T14FD0C0D1662A4033C27671D2131AC0458774D0403132DB2196CDAC003133FC3407C2CF
MD5 SHA1 SHA512 TLSH

Submit Download

hosts.exe

Path C:\Windows\hosts.exe
Size 9.0MB
SHA256 449bbe51a0fdd7caa033ba974364930def8327e1335d3948f6102223e8734163
MD5 8c994f5fcdd8840bd85c68525cd8e43c
SHA1 f8c6931a0874147af5bc5ae2efa0648a8d4d90c0
SHA512 c875fb602a66abdde9c3c4240a2105443420e624dae9d8b62ff38533d2a176a51c0faccc06b8767128acfba3c7384f2193544133aa45cc50a1812b9ee9b546e6
SSDEEP 12288:b7IoSkaoSdaoS4aoSDaoS4aoSDaoS4aoSDaoS4aoS4aoS4aoSDaoS4aoSDaoS4al:b737g
TLSH
T1CEA69F537757A50BF0268A390A11879D5396FE328E027897B2D43E3B3C332CB6E59971
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

W_X_C.bat

Path \??\c:\windows\W_X_C.bat
Size 336B
SHA256 d2150b9e5a4ce55e140f0ca91c4e300715d42095c8fddf58c77037cdd2cfaf78
MD5 4db9f8b6175722b62ececeeeba1ce307
SHA1 3b3ba8414706e72a6fa19e884a97b87609e11e47
SHA512 1d6dc274cf7a3dd704f840e6a5ad57ab4c4e35d5f09489aeff520bb797e1c825bac53fc335156fe41e767a46520d031855fe42fe7b175409ebe5e9e986fb9b8b
TLSH
T180E07D5E45D89471DA3107CC62CABE50785342479F84B99963D98D80FECA520D09667C
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1636-44-0x0000000000400000-0x000000000042E000-memory.dmp

Download

memory/1996-0-0x0000000000400000-0x000000000042E000-memory.dmp

Download

memory/1996-21-0x0000000000400000-0x000000000042E000-memory.dmp

Download

memory/2064-43-0x0000000000400000-0x000000000042E000-memory.dmp

Download

memory/2968-39-0x0000000000400000-0x000000000042E000-memory.dmp

Download

memory/4328-45-0x0000000000400000-0x000000000042E000-memory.dmp

Download

memory/4496-35-0x0000000000400000-0x000000000042E000-memory.dmp

Download

memory/5028-22-0x0000000000400000-0x000000000042E000-memory.dmp

Download

memory/5028-16-0x0000000000400000-0x000000000042E000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads