884fecad40f2f723cf3d2c9fd7ae481a1d93d8d3d5fd05b47d84820475d60a9e

Analysis

max time kernel
149s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
25/08/2026, 12:19

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
884fecad40f2f723cf3d2c9fd7ae481a1d93d8d3d5fd05b47d84820475d60a9e.exe
Size 9.2MB
Sample260825-phlevaysf1
SHA256 884fecad40f2f723cf3d2c9fd7ae481a1d93d8d3d5fd05b47d84820475d60a9e
MD5 5cd7be1c3d35f551f71156f60a6a7f20
SHA1 68a34b8bc31f3873fce991b68c978bea4f689172
SHA512 d35009d42e3a057b2fb7cf79b9dc7896d5691f88b3c1a7c228b76d75cfaa47819ca7dce4e7e6636874e6bba971500b55b7f8b86bce6178a3083409d4730be003
SSDEEP 12288:0aoSDaoS4aoS4aoS4aoSDaoS4aoSDaoS4aoSDaoSeaoS4aoSDaoS4aoSDaoS4aop:E
TLSH
T17FA690537757A50BF02A8A390A11879D5396FE328E023997B2D43E3B2D331CB6E1D971
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery execution persistence upx

Malware Config

Signatures

Modifies visibility of file extensions in Explorer 2 TTPs 3 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	884fecad40f2f723cf3d2c9fd7ae481a1d93d8d3d5fd05b47d84820475d60a9e.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	avscan.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	hosts.exe

Modifies visibility of hidden/system files in Explorer 2 TTPs 3 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	884fecad40f2f723cf3d2c9fd7ae481a1d93d8d3d5fd05b47d84820475d60a9e.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	avscan.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	hosts.exe

Adds policy Run key to start application 2 TTPs 6 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	WScript.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\RYSBVXZE = "W_X_C.bat"	WScript.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	WScript.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\RYSBVXZE = "W_X_C.bat"	WScript.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	WScript.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\RYSBVXZE = "W_X_C.bat"	WScript.exe

Checks computer location settings 2 TTPs 3 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\Control Panel\International\Geo\Nation	cmd.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\Control Panel\International\Geo\Nation	cmd.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\Control Panel\International\Geo\Nation	cmd.exe

Executes dropped EXE 6 IoCs

pid	Process
3772	avscan.exe
960	avscan.exe
4108	hosts.exe
4016	hosts.exe
5092	avscan.exe
3808	hosts.exe

Impair Defenses: Safe Mode Boot 1 TTPs 6 IoCs

defense_evasion

Safe Mode Boot

T1562.009

description	ioc	Process
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\Power	REG.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\ProfSvc	REG.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\SerCx2.sys	REG.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\UserManager	REG.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\CBDHSvc	REG.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\iai2c.sys	REG.exe

Adds Run key to start application 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\avscan = "C:\\Users\\Admin\\AppData\\Local\\Temp\\avscan.exe"	hosts.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\avscan = "C:\\Users\\Admin\\AppData\\Local\\Temp\\avscan.exe"	884fecad40f2f723cf3d2c9fd7ae481a1d93d8d3d5fd05b47d84820475d60a9e.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\avscan = "C:\\Users\\Admin\\AppData\\Local\\Temp\\avscan.exe"	avscan.exe

Executes a VBScript file via the Windows Script Host. 1 TTPs 3 IoCs

execution

Visual Basic

T1059.005

pid	Process
1216	WScript.exe
764	WScript.exe
1540	WScript.exe

UPX packed file 17 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/1308-0-0x0000000000400000-0x000000000042D000-memory.dmp	upx
behavioral1/files/0x00070000000243fa-10.dat	upx
behavioral1/memory/3772-11-0x0000000000400000-0x000000000042D000-memory.dmp	upx
behavioral1/files/0x00070000000243fb-14.dat	upx
behavioral1/memory/960-22-0x0000000000400000-0x000000000042D000-memory.dmp	upx
behavioral1/memory/1308-24-0x0000000000400000-0x000000000042D000-memory.dmp	upx
behavioral1/memory/4016-34-0x0000000000400000-0x000000000042D000-memory.dmp	upx
behavioral1/memory/4016-42-0x0000000000400000-0x000000000042D000-memory.dmp	upx
behavioral1/memory/5092-44-0x0000000000400000-0x000000000042D000-memory.dmp	upx
behavioral1/memory/3808-49-0x0000000000400000-0x000000000042D000-memory.dmp	upx
behavioral1/memory/3772-50-0x0000000000400000-0x000000000042D000-memory.dmp	upx
behavioral1/memory/4108-51-0x0000000000400000-0x000000000042D000-memory.dmp	upx
behavioral1/files/0x00070000000243d4-59.dat	upx
behavioral1/files/0x00070000000243d4-66.dat	upx
behavioral1/files/0x00070000000243d4-69.dat	upx
behavioral1/files/0x00070000000243d4-76.dat	upx
behavioral1/files/0x00070000000243d4-79.dat	upx

Drops file in Windows directory 5 IoCs

description	ioc	Process
File created	\??\c:\windows\W_X_C.bat	884fecad40f2f723cf3d2c9fd7ae481a1d93d8d3d5fd05b47d84820475d60a9e.exe
File opened for modification	C:\Windows\hosts.exe	884fecad40f2f723cf3d2c9fd7ae481a1d93d8d3d5fd05b47d84820475d60a9e.exe
File opened for modification	C:\Windows\hosts.exe	avscan.exe
File opened for modification	C:\Windows\hosts.exe	hosts.exe
File created	C:\windows\W_X_C.vbs	884fecad40f2f723cf3d2c9fd7ae481a1d93d8d3d5fd05b47d84820475d60a9e.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4728	cmd.exe
2012	cmd.exe
2240	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 22 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	avscan.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	avscan.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hosts.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	REG.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hosts.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hosts.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	REG.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	REG.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	REG.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	REG.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	REG.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	REG.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	REG.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	884fecad40f2f723cf3d2c9fd7ae481a1d93d8d3d5fd05b47d84820475d60a9e.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	REG.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	avscan.exe

Modifies registry class 4 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings	884fecad40f2f723cf3d2c9fd7ae481a1d93d8d3d5fd05b47d84820475d60a9e.exe
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings	cmd.exe

Modifies registry key 1 TTPs 9 IoCs

Modify Registry

T1112

pid	Process
3540	REG.exe
2388	REG.exe
2252	REG.exe
3872	REG.exe
3440	REG.exe
4452	REG.exe
1212	REG.exe
464	REG.exe
3512	REG.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

pid	Process
3772	avscan.exe
4108	hosts.exe

Suspicious use of SetWindowsHookEx 7 IoCs

pid	Process
1308	884fecad40f2f723cf3d2c9fd7ae481a1d93d8d3d5fd05b47d84820475d60a9e.exe
3772	avscan.exe
960	avscan.exe
4108	hosts.exe
4016	hosts.exe
5092	avscan.exe
3808	hosts.exe

Suspicious use of WriteProcessMemory 21 IoCs

description	pid	Process	procid_target
PID 1308 wrote to memory of 3540	1308	884fecad40f2f723cf3d2c9fd7ae481a1d93d8d3d5fd05b47d84820475d60a9e.exe	84
PID 1308 wrote to memory of 3772	1308	884fecad40f2f723cf3d2c9fd7ae481a1d93d8d3d5fd05b47d84820475d60a9e.exe	87
PID 3772 wrote to memory of 960	3772	avscan.exe	88
PID 3772 wrote to memory of 4728	3772	avscan.exe	89
PID 1308 wrote to memory of 2012	1308	884fecad40f2f723cf3d2c9fd7ae481a1d93d8d3d5fd05b47d84820475d60a9e.exe	90
PID 2012 wrote to memory of 4108	2012	cmd.exe	93
PID 4728 wrote to memory of 4016	4728	cmd.exe	94
PID 4108 wrote to memory of 5092	4108	hosts.exe	95
PID 2012 wrote to memory of 1216	2012	cmd.exe	97
PID 4728 wrote to memory of 764	4728	cmd.exe	98
PID 4108 wrote to memory of 2240	4108	hosts.exe	99
PID 2240 wrote to memory of 3808	2240	cmd.exe	101
PID 2240 wrote to memory of 1540	2240	cmd.exe	102
PID 3772 wrote to memory of 2388	3772	avscan.exe	108
PID 4108 wrote to memory of 2252	4108	hosts.exe	111
PID 3772 wrote to memory of 3872	3772	avscan.exe	113
PID 4108 wrote to memory of 3440	4108	hosts.exe	115
PID 3772 wrote to memory of 464	3772	avscan.exe	117
PID 4108 wrote to memory of 3512	4108	hosts.exe	122
PID 3772 wrote to memory of 4452	3772	avscan.exe	131
PID 4108 wrote to memory of 1212	4108	hosts.exe	133

C:\Users\Admin\AppData\Local\Temp\884fecad40f2f723cf3d2c9fd7ae481a1d93d8d3d5fd05b47d84820475d60a9e.exe
"C:\Users\Admin\AppData\Local\Temp\884fecad40f2f723cf3d2c9fd7ae481a1d93d8d3d5fd05b47d84820475d60a9e.exe"
1⤵
- Modifies visibility of file extensions in Explorer
- Modifies visibility of hidden/system files in Explorer
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1308
- C:\Windows\SysWOW64\REG.exe
  REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
  2⤵
  - Impair Defenses: Safe Mode Boot
  - System Location Discovery: System Language Discovery
  - Modifies registry key
  PID:3540
- C:\Users\Admin\AppData\Local\Temp\avscan.exe
  C:\Users\Admin\AppData\Local\Temp\avscan.exe
  2⤵
  - Modifies visibility of file extensions in Explorer
  - Modifies visibility of hidden/system files in Explorer
  - Executes dropped EXE
  - Adds Run key to start application
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3772
- - C:\Users\Admin\AppData\Local\Temp\avscan.exe
    C:\Users\Admin\AppData\Local\Temp\avscan.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:960
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c c:\windows\W_X_C.bat
    3⤵
    - Checks computer location settings
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    - Suspicious use of WriteProcessMemory
    PID:4728
  - - C:\windows\hosts.exe
      C:\windows\hosts.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:4016
  - - C:\Windows\SysWOW64\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Windows\W_X_C.vbs"
      4⤵
      Adds policy Run key to start application
      Executes a VBScript file via the Windows Script Host.
      System Location Discovery: System Language Discovery
      PID:764
- - C:\Windows\SysWOW64\REG.exe
    REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies registry key
    PID:2388
- - C:\Windows\SysWOW64\REG.exe
    REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies registry key
    PID:3872
- - C:\Windows\SysWOW64\REG.exe
    REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies registry key
    PID:464
- - C:\Windows\SysWOW64\REG.exe
    REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies registry key
    PID:4452
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c c:\windows\W_X_C.bat
  2⤵
  - Checks computer location settings
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2012
- - C:\windows\hosts.exe
    C:\windows\hosts.exe
    3⤵
    - Modifies visibility of file extensions in Explorer
    - Modifies visibility of hidden/system files in Explorer
    - Executes dropped EXE
    - Adds Run key to start application
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:4108
  - - C:\Users\Admin\AppData\Local\Temp\avscan.exe
      C:\Users\Admin\AppData\Local\Temp\avscan.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:5092
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c c:\windows\W_X_C.bat
      4⤵
      Checks computer location settings
      Executes a command shell one-liner
      System Location Discovery: System Language Discovery
      Modifies registry class
      Suspicious use of WriteProcessMemory
      PID:2240
    - - C:\windows\hosts.exe
        
        C:\windows\hosts.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:3808
    - - C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Windows\W_X_C.vbs"
        5⤵
        Adds policy Run key to start application
        Executes a VBScript file via the Windows Script Host.
        System Location Discovery: System Language Discovery
        
        PID:1540
  - - C:\Windows\SysWOW64\REG.exe
      REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
      4⤵
      System Location Discovery: System Language Discovery
      Modifies registry key
      PID:2252
  - - C:\Windows\SysWOW64\REG.exe
      REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
      4⤵
      System Location Discovery: System Language Discovery
      Modifies registry key
      PID:3440
  - - C:\Windows\SysWOW64\REG.exe
      REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
      4⤵
      System Location Discovery: System Language Discovery
      Modifies registry key
      PID:3512
  - - C:\Windows\SysWOW64\REG.exe
      REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
      4⤵
      System Location Discovery: System Language Discovery
      Modifies registry key
      PID:1212
- - C:\Windows\SysWOW64\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Windows\W_X_C.vbs"
    3⤵
    - Adds policy Run key to start application
    - Executes a VBScript file via the Windows Script Host.
    - System Location Discovery: System Language Discovery
    PID:1216

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4304

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Visual Basic

T1059.005

Windows Command Shell

T1059.003

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Impair Defenses

T1562

Safe Mode Boot

T1562.009

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

avscan.exe

Path C:\Users\Admin\AppData\Local\Temp\avscan.exe
Size 9.2MB
SHA256 75a443fc5a965a960a373b8c69b6b07db53d8b0bb991cf1104a62c3f2e71f1a4
MD5 a1a1274a85f405db8c43b37433c52597
SHA1 07fe0280c52729352a667b3d457aefbc59429def
SHA512 994d90ea239f7dd259efc831f7a8f2fedbf724bde0ef3fa09eedda666310565a55a62c97f4313691c8465bda6b94e1e40a2f6dc862bae564a32c762f35e2a9de
SSDEEP 12288:0aoSDaoS4aoS4aoS4aoSDaoS4aoSDaoS4aoSDaoSeaoS4aoSDaoS4aoSDaoS4aoL:S
TLSH
T16EA690537757A50BF02A8A390A11879D5396FE328E023997B2D43E3B2D331CB6E1D971
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

128.png

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir3276_2058340836\CRX_INSTALL\128.png
Size 18.3MB
SHA256 bc2027556faec50a5b11208e8281a7a84e72414cad602cf7434e71ccfaf0f5ea
MD5 0fa533175ed7ea66fe62414be46b00a5
SHA1 19ef2f76a1eab7d0394d64b0fb535e0ae9a6e62c
SHA512 93b47e7a8dee243e5ff52fd7f5aff3292108eccbf427eb94c21b9730765b3bd03e72b96f2dd38c898eb22680ffc96aa2c72ee3886141155620af8d19fb48fa84
SSDEEP 12288:0aoSDaoS4aoS4aoS4aoSDaoS4aoSDaoS4aoSDaoSeaoS4aoSDaoS4aoSDaoS4aoA:1
TLSH
T1AF1790537757A50BF02A8A390A11879D5396FE328E023997B2D43E3B2D331CB6E1D971
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

128.png

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir3276_2058340836\CRX_INSTALL\128.png
Size 36.6MB
SHA256 e1630284c2ef870a70fd3a0c816d659ccb5a690e9d33a457df4e4d151a9fc2ba
MD5 809826a1e0ee106da67dbc95bd5c0dd3
SHA1 d7279d4aceb0ab754f7f51efc90bd5515c4eb659
SHA512 9803d9d73acfab4d8a6f762ef9e7f6dff6f2aeb43f7548768514d31719f8461fe1058b381b8d502164fd5329b86eff335bee7c7e28322a726bdc8ace8d169eb7
SSDEEP 12288:0aoSDaoS4aoS4aoS4aoSDaoS4aoSDaoS4aoSDaoSeaoS4aoSDaoS4aoSDaoS4aoV:4
TLSH
T1458790537757A50BF02A8A390A11879D5396FE328E023997B2D43E3B2D331CB6E1D971
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

128.png

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir3276_2058340836\CRX_INSTALL\128.png
Size 36.6MB
SHA256 0b54b3353ff134e8743c58a8b62ac0fc119cd315236549847ba236cd600f1f51
MD5 621aec650de56827be22e3651d7a5cf6
SHA1 15a92bee03d777224ec42a2edfeb7a6a41989c45
SHA512 dd5256f99c9da10d54fcf834dd96c66724848a8598fb70312b0a453c73f9622636070bb81f04af821f5dad26dc157082f70a60eec5a9cbfde18cbc48ee75a7c4
SSDEEP 12288:0aoSDaoS4aoS4aoS4aoSDaoS4aoSDaoS4aoSDaoSeaoS4aoSDaoS4aoSDaoS4aoV:I
TLSH
T1108790537757A50BF02A8A390A11879D5396FE328E023997B2D43E3B2D331CB6E1D971
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

128.png

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir3276_2058340836\CRX_INSTALL\128.png
Size 54.9MB
SHA256 6dee49c41e796b696c1b362c52446c37bb4df4c76922cd2f5e132f427085fb03
MD5 307c50c8e4c16440a5d60adf2f0cb74c
SHA1 bf00f4cde549da049c15c55bc1483d2b93d0591c
SHA512 838bed432e2480ceb99bc6bf56b8a32e20090f35c8b5b71f04675e99982441f8220f82bd59d9a6335e75e15c45a592098cbf88a7845803883316e9cca3fc87de
SSDEEP 12288:0aoSDaoS4aoS4aoS4aoSDaoS4aoSDaoS4aoSDaoSeaoS4aoSDaoS4aoSDaoS4aoZ:0
TLSH
T191C790537757A50BF02A8A390A11879D5396FE328E023997B2D43E3B2D331CB6E1D971
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

128.png

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir3276_2058340836\CRX_INSTALL\128.png
Size 54.9MB
SHA256 b1c36c292274c5b2de51c27992f90d84ab21691c90fab5d03006dcdaa649025a
MD5 252796b2eadcec0f2f4614b5b296f2cd
SHA1 a340c064bedc77cdc18cb49c7791562bedf3eb4e
SHA512 20dcd8b625c4713356b147297f46f0b5bc7dce18558629e085683115ce398a802cd58ede54072f0432636b5ff2a211e4e5d315fbaad298cf0fe6c6314ea6a99f
SSDEEP 12288:0aoSDaoS4aoS4aoS4aoSDaoS4aoSDaoS4aoSDaoSeaoS4aoSDaoS4aoSDaoS4aoG:L
TLSH
T1A8C790537757A50BF02A8A390A11879D5396FE328E023997B2D43E3B2D331CB6E1D971
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

W_X_C.vbs

Path C:\Windows\W_X_C.vbs
Size 195B
SHA256 2aff5215f11225a8a0a30dd1e218f23014f0d50abc1ab6aa9af90cad4a1f810c
MD5 7fea68fcee7f2be16504995060874a11
SHA1 452097b7fb78b5b810178689a146daa245a7c7d6
SHA512 23f79bc17bd5f9983383ebc764c2f1c249116300eec95d9f94ab173f4296a62f9d6862d16d404013bf82c01b84b1d8b0f8b3ad86f503810bb71038945703f35e
TLSH
T1E2D022A266224023827261D003098005477490003132DB219188AC002133FD2807828F
MD5 SHA1 SHA512 TLSH

Submit Download

hosts.exe

Path C:\Windows\hosts.exe
Size 9.2MB
SHA256 8012c232b31524c15f43ff073674c04f91c1e9a53757a681c05a7018fb5ed112
MD5 50d0b708da399b8de83265f783ad9f1a
SHA1 b681bc9f27bef392388904363e670393deee23ea
SHA512 4d14944ee0ed2ee713f4c933c9baa0050155fc0e02838e1b7775041a304347db1704618aaca23a956c77e8421cbc731dbf3f2c3580742694c4280da4149b7299
SSDEEP 12288:0aoSDaoS4aoS4aoS4aoSDaoS4aoSDaoS4aoSDaoSeaoS4aoSDaoS4aoSDaoS4aoA:p
TLSH
T18EA690537757A50BF02A8A390A11879D5396FE328E023997B2D43E3B2D331CB6E1D971
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

W_X_C.bat

Path \??\c:\windows\W_X_C.bat
Size 336B
SHA256 d2150b9e5a4ce55e140f0ca91c4e300715d42095c8fddf58c77037cdd2cfaf78
MD5 4db9f8b6175722b62ececeeeba1ce307
SHA1 3b3ba8414706e72a6fa19e884a97b87609e11e47
SHA512 1d6dc274cf7a3dd704f840e6a5ad57ab4c4e35d5f09489aeff520bb797e1c825bac53fc335156fe41e767a46520d031855fe42fe7b175409ebe5e9e986fb9b8b
TLSH
T180E07D5E45D89471DA3107CC62CABE50785342479F84B99963D98D80FECA520D09667C
MD5 SHA1 SHA512 TLSH

Submit Download

memory/960-22-0x0000000000400000-0x000000000042D000-memory.dmp

Download

memory/1308-24-0x0000000000400000-0x000000000042D000-memory.dmp

Download

memory/1308-0-0x0000000000400000-0x000000000042D000-memory.dmp

Download

memory/3772-50-0x0000000000400000-0x000000000042D000-memory.dmp

Download

memory/3772-11-0x0000000000400000-0x000000000042D000-memory.dmp

Download

memory/3808-49-0x0000000000400000-0x000000000042D000-memory.dmp

Download

memory/4016-42-0x0000000000400000-0x000000000042D000-memory.dmp

Download

memory/4016-34-0x0000000000400000-0x000000000042D000-memory.dmp

Download

memory/4108-51-0x0000000000400000-0x000000000042D000-memory.dmp

Download

memory/5092-44-0x0000000000400000-0x000000000042D000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads