49e3e5e9497d12669e9c5b651f72c037c1e767be71be245527b19c77af28e9cc

Analysis

max time kernel
149s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
25/08/2026, 12:19

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
49e3e5e9497d12669e9c5b651f72c037c1e767be71be245527b19c77af28e9cc.exe
Size 8.3MB
Sample260825-phdd8sysdx
SHA256 49e3e5e9497d12669e9c5b651f72c037c1e767be71be245527b19c77af28e9cc
MD5 666ad552ffea81c5d9da4bd1ec6196aa
SHA1 8104c6cf9cafe870f3e58b857af122d4c32022a3
SHA512 9e16ec13d543a9a732f0edb0ee782414714fea2ce3928be3ae1c3888f5b002eeb768927b4ffa096fa4dd4034bc6b159200191f581ca4e920b0f526b18caf07c0
SSDEEP 12288:0aoSDaoSxaoS4aoSDaoS4aoSDaoS4aoS4aoS4aoSDaoS4aoSDaoS4aoSDaoS7aoA:P
TLSH
T1159690537757A50BF02A8A390A11879D5396FE328E033997B2D43E3B2D331CB6E19971
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery execution persistence upx

Malware Config

Signatures

Modifies visibility of file extensions in Explorer 2 TTPs 3 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	avscan.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	hosts.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	49e3e5e9497d12669e9c5b651f72c037c1e767be71be245527b19c77af28e9cc.exe

Modifies visibility of hidden/system files in Explorer 2 TTPs 3 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	49e3e5e9497d12669e9c5b651f72c037c1e767be71be245527b19c77af28e9cc.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	avscan.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	hosts.exe

Adds policy Run key to start application 2 TTPs 6 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	WScript.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\XHBCZSSI = "W_X_C.bat"	WScript.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	WScript.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\XHBCZSSI = "W_X_C.bat"	WScript.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	WScript.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\XHBCZSSI = "W_X_C.bat"	WScript.exe

Checks computer location settings 2 TTPs 3 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000\Control Panel\International\Geo\Nation	cmd.exe
Key value queried	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000\Control Panel\International\Geo\Nation	cmd.exe
Key value queried	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000\Control Panel\International\Geo\Nation	cmd.exe

Executes dropped EXE 7 IoCs

pid	Process
1544	avscan.exe
832	avscan.exe
2624	avscan.exe
664	hosts.exe
4888	hosts.exe
4728	avscan.exe
3400	hosts.exe

Impair Defenses: Safe Mode Boot 1 TTPs 6 IoCs

defense_evasion

Safe Mode Boot

T1562.009

description	ioc	Process
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\iai2c.sys	REG.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\Power	REG.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\ProfSvc	REG.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\SerCx2.sys	REG.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\UserManager	REG.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\CBDHSvc	REG.exe

Adds Run key to start application 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\avscan = "C:\\Users\\Admin\\AppData\\Local\\Temp\\avscan.exe"	49e3e5e9497d12669e9c5b651f72c037c1e767be71be245527b19c77af28e9cc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\avscan = "C:\\Users\\Admin\\AppData\\Local\\Temp\\avscan.exe"	avscan.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\avscan = "C:\\Users\\Admin\\AppData\\Local\\Temp\\avscan.exe"	hosts.exe

Executes a VBScript file via the Windows Script Host. 1 TTPs 3 IoCs

execution

Visual Basic

T1059.005

pid	Process
1616	WScript.exe
1340	WScript.exe
3768	WScript.exe

UPX packed file 14 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/4340-0-0x0000000000400000-0x000000000042D000-memory.dmp	upx
behavioral1/files/0x000700000002447f-9.dat	upx
behavioral1/memory/1544-12-0x0000000000400000-0x000000000042D000-memory.dmp	upx
behavioral1/files/0x000400000001dbbc-18.dat	upx
behavioral1/memory/832-20-0x0000000000400000-0x000000000042D000-memory.dmp	upx
behavioral1/memory/2624-25-0x0000000000400000-0x000000000042D000-memory.dmp	upx
behavioral1/memory/4340-27-0x0000000000400000-0x000000000042D000-memory.dmp	upx
behavioral1/memory/4888-42-0x0000000000400000-0x000000000042D000-memory.dmp	upx
behavioral1/memory/4728-44-0x0000000000400000-0x000000000042D000-memory.dmp	upx
behavioral1/memory/4728-48-0x0000000000400000-0x000000000042D000-memory.dmp	upx
behavioral1/memory/3400-50-0x0000000000400000-0x000000000042D000-memory.dmp	upx
behavioral1/memory/3400-53-0x0000000000400000-0x000000000042D000-memory.dmp	upx
behavioral1/memory/1544-54-0x0000000000400000-0x000000000042D000-memory.dmp	upx
behavioral1/memory/664-56-0x0000000000400000-0x000000000042D000-memory.dmp	upx

Drops file in Windows directory 5 IoCs

description	ioc	Process
File created	C:\windows\W_X_C.vbs	49e3e5e9497d12669e9c5b651f72c037c1e767be71be245527b19c77af28e9cc.exe
File created	\??\c:\windows\W_X_C.bat	49e3e5e9497d12669e9c5b651f72c037c1e767be71be245527b19c77af28e9cc.exe
File opened for modification	C:\Windows\hosts.exe	49e3e5e9497d12669e9c5b651f72c037c1e767be71be245527b19c77af28e9cc.exe
File opened for modification	C:\Windows\hosts.exe	avscan.exe
File opened for modification	C:\Windows\hosts.exe	hosts.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
400	cmd.exe
2352	cmd.exe
1184	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 23 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	49e3e5e9497d12669e9c5b651f72c037c1e767be71be245527b19c77af28e9cc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	avscan.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	avscan.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	REG.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	REG.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	avscan.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hosts.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hosts.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	REG.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	REG.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	REG.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	REG.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	REG.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	REG.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	avscan.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hosts.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	REG.exe

Modifies registry class 4 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings	49e3e5e9497d12669e9c5b651f72c037c1e767be71be245527b19c77af28e9cc.exe
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings	cmd.exe

Modifies registry key 1 TTPs 9 IoCs

Modify Registry

T1112

pid	Process
2944	REG.exe
3292	REG.exe
1128	REG.exe
1836	REG.exe
404	REG.exe
3512	REG.exe
2840	REG.exe
3392	REG.exe
1128	REG.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

pid	Process
1544	avscan.exe
664	hosts.exe

Suspicious use of SetWindowsHookEx 8 IoCs

pid	Process
4340	49e3e5e9497d12669e9c5b651f72c037c1e767be71be245527b19c77af28e9cc.exe
832	avscan.exe
1544	avscan.exe
2624	avscan.exe
664	hosts.exe
4888	hosts.exe
4728	avscan.exe
3400	hosts.exe

Suspicious use of WriteProcessMemory 21 IoCs

description	pid	Process	procid_target
PID 4340 wrote to memory of 3512	4340	49e3e5e9497d12669e9c5b651f72c037c1e767be71be245527b19c77af28e9cc.exe	86
PID 4340 wrote to memory of 1544	4340	49e3e5e9497d12669e9c5b651f72c037c1e767be71be245527b19c77af28e9cc.exe	89
PID 1544 wrote to memory of 2624	1544	avscan.exe	91
PID 1544 wrote to memory of 2352	1544	avscan.exe	92
PID 4340 wrote to memory of 400	4340	49e3e5e9497d12669e9c5b651f72c037c1e767be71be245527b19c77af28e9cc.exe	93
PID 400 wrote to memory of 664	400	cmd.exe	96
PID 2352 wrote to memory of 4888	2352	cmd.exe	97
PID 664 wrote to memory of 4728	664	hosts.exe	99
PID 400 wrote to memory of 1340	400	cmd.exe	100
PID 664 wrote to memory of 1184	664	hosts.exe	101
PID 2352 wrote to memory of 1616	2352	cmd.exe	102
PID 1184 wrote to memory of 3400	1184	cmd.exe	104
PID 1184 wrote to memory of 3768	1184	cmd.exe	105
PID 1544 wrote to memory of 2944	1544	avscan.exe	113
PID 664 wrote to memory of 3292	664	hosts.exe	115
PID 1544 wrote to memory of 2840	1544	avscan.exe	122
PID 664 wrote to memory of 1128	664	hosts.exe	124
PID 1544 wrote to memory of 1836	1544	avscan.exe	127
PID 664 wrote to memory of 3392	664	hosts.exe	129
PID 1544 wrote to memory of 1128	1544	avscan.exe	139
PID 664 wrote to memory of 404	664	hosts.exe	141

C:\Users\Admin\AppData\Local\Temp\49e3e5e9497d12669e9c5b651f72c037c1e767be71be245527b19c77af28e9cc.exe
"C:\Users\Admin\AppData\Local\Temp\49e3e5e9497d12669e9c5b651f72c037c1e767be71be245527b19c77af28e9cc.exe"
1⤵
- Modifies visibility of file extensions in Explorer
- Modifies visibility of hidden/system files in Explorer
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4340
- C:\Windows\SysWOW64\REG.exe
  REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
  2⤵
  - Impair Defenses: Safe Mode Boot
  - System Location Discovery: System Language Discovery
  - Modifies registry key
  PID:3512
- C:\Users\Admin\AppData\Local\Temp\avscan.exe
  C:\Users\Admin\AppData\Local\Temp\avscan.exe
  2⤵
  - Modifies visibility of file extensions in Explorer
  - Modifies visibility of hidden/system files in Explorer
  - Executes dropped EXE
  - Adds Run key to start application
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1544
- - C:\Users\Admin\AppData\Local\Temp\avscan.exe
    C:\Users\Admin\AppData\Local\Temp\avscan.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:2624
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c c:\windows\W_X_C.bat
    3⤵
    - Checks computer location settings
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    - Suspicious use of WriteProcessMemory
    PID:2352
  - - C:\windows\hosts.exe
      C:\windows\hosts.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:4888
  - - C:\Windows\SysWOW64\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Windows\W_X_C.vbs"
      4⤵
      Adds policy Run key to start application
      Executes a VBScript file via the Windows Script Host.
      System Location Discovery: System Language Discovery
      PID:1616
- - C:\Windows\SysWOW64\REG.exe
    REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies registry key
    PID:2944
- - C:\Windows\SysWOW64\REG.exe
    REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies registry key
    PID:2840
- - C:\Windows\SysWOW64\REG.exe
    REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies registry key
    PID:1836
- - C:\Windows\SysWOW64\REG.exe
    REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies registry key
    PID:1128
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c c:\windows\W_X_C.bat
  2⤵
  - Checks computer location settings
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:400
- - C:\windows\hosts.exe
    C:\windows\hosts.exe
    3⤵
    - Modifies visibility of file extensions in Explorer
    - Modifies visibility of hidden/system files in Explorer
    - Executes dropped EXE
    - Adds Run key to start application
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:664
  - - C:\Users\Admin\AppData\Local\Temp\avscan.exe
      C:\Users\Admin\AppData\Local\Temp\avscan.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:4728
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c c:\windows\W_X_C.bat
      4⤵
      Checks computer location settings
      Executes a command shell one-liner
      System Location Discovery: System Language Discovery
      Modifies registry class
      Suspicious use of WriteProcessMemory
      PID:1184
    - - C:\windows\hosts.exe
        
        C:\windows\hosts.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:3400
    - - C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Windows\W_X_C.vbs"
        5⤵
        Adds policy Run key to start application
        Executes a VBScript file via the Windows Script Host.
        System Location Discovery: System Language Discovery
        
        PID:3768
  - - C:\Windows\SysWOW64\REG.exe
      REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
      4⤵
      System Location Discovery: System Language Discovery
      Modifies registry key
      PID:3292
  - - C:\Windows\SysWOW64\REG.exe
      REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
      4⤵
      System Location Discovery: System Language Discovery
      Modifies registry key
      PID:1128
  - - C:\Windows\SysWOW64\REG.exe
      REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
      4⤵
      System Location Discovery: System Language Discovery
      Modifies registry key
      PID:3392
  - - C:\Windows\SysWOW64\REG.exe
      REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
      4⤵
      System Location Discovery: System Language Discovery
      Modifies registry key
      PID:404
- - C:\Windows\SysWOW64\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Windows\W_X_C.vbs"
    3⤵
    - Adds policy Run key to start application
    - Executes a VBScript file via the Windows Script Host.
    - System Location Discovery: System Language Discovery
    PID:1340

C:\Users\Admin\AppData\Local\Temp\avscan.exe
C:\Users\Admin\AppData\Local\Temp\avscan.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:832

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:3164

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Visual Basic

T1059.005

Windows Command Shell

T1059.003

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Impair Defenses

T1562

Safe Mode Boot

T1562.009

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

avscan.exe

Path C:\Users\Admin\AppData\Local\Temp\avscan.exe
Size 8.3MB
SHA256 a557491c6e501c6d4c9cd4ed33c704f0f942d41294f321170595245430dd9226
MD5 76ed938cb7eb7c91b4cdf204211b37f4
SHA1 2117ed3fe931a8400e899696f79a8fef471f364c
SHA512 81b1e5467e5c691a87e4737a71b1e222939ef7e415313237ca1ddc6a1281d173fc55e86adf22e8b3853343d164dd22bcfb8a4a19b2e62355a7ff8d5b188cbe79
SSDEEP 12288:0aoSDaoSxaoS4aoSDaoS4aoSDaoS4aoS4aoS4aoSDaoS4aoSDaoS4aoSDaoS7aoU:T
TLSH
T1399690537757A50BF02A8A390A11879D5396FE328E033997B2D43E3B2D331CB6E19971
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

W_X_C.vbs

Path C:\Windows\W_X_C.vbs
Size 195B
SHA256 b39688c8dc37d88a1280ec43e1005296491faecd1e150cbf2e1159f17f34b518
MD5 e0bbeba8855aa71af96d69acbab63649
SHA1 0a82aebac177670d8d342b6f13b3550e00e40a4d
SHA512 05e0400305d2e6ebec51c776993ae6654d87afdcf2454dbd4acca0206f8f5bd30f2041953ed75ff4530794c39bd9fedebb03c8faa286fa6fb8459a53dc5fef47
TLSH
T1CBD0C0D1662245339232F2D00309C4054734D0013132DB21A1CCAC003133FC3407C28F
MD5 SHA1 SHA512 TLSH

Submit Download

hosts.exe

Path C:\Windows\hosts.exe
Size 8.3MB
SHA256 114e317e0934691b428086356765cb0e65c56e761c61c9503892eb981e900d61
MD5 79fcdab17920a3bf66317849a1f41a00
SHA1 044ebf38da25c3d31587be92cb8c179429ec6842
SHA512 3a94979100d65bb8891085c98d63ceb0dd9f258ff937a94174548dff6d6456366b4b87004d21141b9547d970f1002b8c89fbd66a592ec7e2d2dd4b937bcffeee
SSDEEP 12288:0aoSDaoSxaoS4aoSDaoS4aoSDaoS4aoS4aoS4aoSDaoS4aoSDaoS4aoSDaoS7ao9:S
TLSH
T1FB9690537757A50BF02A8A390A11879D5396FE328E033997B2D43E3B2D331CB6E19971
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

W_X_C.bat

Path \??\c:\windows\W_X_C.bat
Size 336B
SHA256 d2150b9e5a4ce55e140f0ca91c4e300715d42095c8fddf58c77037cdd2cfaf78
MD5 4db9f8b6175722b62ececeeeba1ce307
SHA1 3b3ba8414706e72a6fa19e884a97b87609e11e47
SHA512 1d6dc274cf7a3dd704f840e6a5ad57ab4c4e35d5f09489aeff520bb797e1c825bac53fc335156fe41e767a46520d031855fe42fe7b175409ebe5e9e986fb9b8b
TLSH
T180E07D5E45D89471DA3107CC62CABE50785342479F84B99963D98D80FECA520D09667C
MD5 SHA1 SHA512 TLSH

Submit Download

memory/664-56-0x0000000000400000-0x000000000042D000-memory.dmp

Download

memory/832-20-0x0000000000400000-0x000000000042D000-memory.dmp

Download

memory/1544-12-0x0000000000400000-0x000000000042D000-memory.dmp

Download

memory/1544-54-0x0000000000400000-0x000000000042D000-memory.dmp

Download

memory/2624-25-0x0000000000400000-0x000000000042D000-memory.dmp

Download

memory/3400-50-0x0000000000400000-0x000000000042D000-memory.dmp

Download

memory/3400-53-0x0000000000400000-0x000000000042D000-memory.dmp

Download

memory/4340-0-0x0000000000400000-0x000000000042D000-memory.dmp

Download

memory/4340-27-0x0000000000400000-0x000000000042D000-memory.dmp

Download

memory/4728-44-0x0000000000400000-0x000000000042D000-memory.dmp

Download

memory/4728-48-0x0000000000400000-0x000000000042D000-memory.dmp

Download

memory/4888-42-0x0000000000400000-0x000000000042D000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads