5d8116083861d62eda020a4b6316fc0f319c427287b5f42ecefe34d2bee9ed65

Analysis

max time kernel
149s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
25/08/2026, 13:33

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
5d8116083861d62eda020a4b6316fc0f319c427287b5f42ecefe34d2bee9ed65.exe
Size 9.3MB
Sample260825-qtnj1sshnd
SHA256 5d8116083861d62eda020a4b6316fc0f319c427287b5f42ecefe34d2bee9ed65
MD5 d3124e2a18cbd8707018c2c40e37e9f2
SHA1 381c78cb066815341c22e0125abe21a068775583
SHA512 3790102a6f6c90c63794ff95825c64e773cc4f8c8f01d71aee2e4d7a0f679079a1c9dc482397f25adcd9991d2df8d84c8946466adc03eef29207899025d77d26
SSDEEP 12288:0aoSDaoS4aoSDaoS4aoSDaoS4aoSDaoSZaoSDaoS2aoSDaoS4aoS4aoSDaoS4aos:h
TLSH
T19BA6A0537757A507F02A8A390A12879D5396FE328E023997B2D43E3B2D331CB6E1D971
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery execution persistence upx

Malware Config

Signatures

Modifies visibility of file extensions in Explorer 2 TTPs 3 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	5d8116083861d62eda020a4b6316fc0f319c427287b5f42ecefe34d2bee9ed65.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	avscan.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	hosts.exe

Modifies visibility of hidden/system files in Explorer 2 TTPs 3 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	5d8116083861d62eda020a4b6316fc0f319c427287b5f42ecefe34d2bee9ed65.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	avscan.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	hosts.exe

Adds policy Run key to start application 2 TTPs 6 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	WScript.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\OCPZFHHI = "W_X_C.bat"	WScript.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	WScript.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\OCPZFHHI = "W_X_C.bat"	WScript.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	WScript.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\OCPZFHHI = "W_X_C.bat"	WScript.exe

Checks computer location settings 2 TTPs 3 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\Control Panel\International\Geo\Nation	cmd.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\Control Panel\International\Geo\Nation	cmd.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\Control Panel\International\Geo\Nation	cmd.exe

Executes dropped EXE 6 IoCs

pid	Process
1840	avscan.exe
2088	avscan.exe
2452	hosts.exe
1656	hosts.exe
556	avscan.exe
2544	hosts.exe

Impair Defenses: Safe Mode Boot 1 TTPs 6 IoCs

defense_evasion

Safe Mode Boot

T1562.009

description	ioc	Process
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\iai2c.sys	REG.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\Power	REG.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\ProfSvc	REG.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\SerCx2.sys	REG.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\UserManager	REG.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\CBDHSvc	REG.exe

Adds Run key to start application 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\avscan = "C:\\Users\\Admin\\AppData\\Local\\Temp\\avscan.exe"	5d8116083861d62eda020a4b6316fc0f319c427287b5f42ecefe34d2bee9ed65.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\avscan = "C:\\Users\\Admin\\AppData\\Local\\Temp\\avscan.exe"	avscan.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\avscan = "C:\\Users\\Admin\\AppData\\Local\\Temp\\avscan.exe"	hosts.exe

Executes a VBScript file via the Windows Script Host. 1 TTPs 3 IoCs

execution

Visual Basic

T1059.005

pid	Process
4808	WScript.exe
5008	WScript.exe
4600	WScript.exe

UPX packed file 17 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/1104-0-0x0000000000400000-0x000000000042D000-memory.dmp	upx
behavioral1/files/0x000300000001e6a3-9.dat	upx
behavioral1/files/0x000300000001e6a5-14.dat	upx
behavioral1/memory/2088-16-0x0000000000400000-0x000000000042D000-memory.dmp	upx
behavioral1/memory/1104-24-0x0000000000400000-0x000000000042D000-memory.dmp	upx
behavioral1/memory/2088-23-0x0000000000400000-0x000000000042D000-memory.dmp	upx
behavioral1/memory/1656-41-0x0000000000400000-0x000000000042D000-memory.dmp	upx
behavioral1/memory/556-43-0x0000000000400000-0x000000000042D000-memory.dmp	upx
behavioral1/memory/2544-45-0x0000000000400000-0x000000000042D000-memory.dmp	upx
behavioral1/memory/2544-49-0x0000000000400000-0x000000000042D000-memory.dmp	upx
behavioral1/memory/1840-50-0x0000000000400000-0x000000000042D000-memory.dmp	upx
behavioral1/memory/2452-52-0x0000000000400000-0x000000000042D000-memory.dmp	upx
behavioral1/files/0x00070000000244ca-59.dat	upx
behavioral1/files/0x00070000000244ca-66.dat	upx
behavioral1/files/0x00070000000244ca-69.dat	upx
behavioral1/files/0x00070000000244ca-76.dat	upx
behavioral1/files/0x00070000000244ca-79.dat	upx

Drops file in Windows directory 5 IoCs

description	ioc	Process
File opened for modification	C:\Windows\hosts.exe	5d8116083861d62eda020a4b6316fc0f319c427287b5f42ecefe34d2bee9ed65.exe
File opened for modification	C:\Windows\hosts.exe	avscan.exe
File opened for modification	C:\Windows\hosts.exe	hosts.exe
File created	C:\windows\W_X_C.vbs	5d8116083861d62eda020a4b6316fc0f319c427287b5f42ecefe34d2bee9ed65.exe
File created	\??\c:\windows\W_X_C.bat	5d8116083861d62eda020a4b6316fc0f319c427287b5f42ecefe34d2bee9ed65.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3376	cmd.exe
4028	cmd.exe
5108	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 22 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	REG.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	REG.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	5d8116083861d62eda020a4b6316fc0f319c427287b5f42ecefe34d2bee9ed65.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	REG.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	REG.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hosts.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hosts.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	REG.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	REG.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	REG.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	avscan.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	avscan.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	REG.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	REG.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	avscan.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hosts.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe

Modifies registry class 4 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Local Settings	5d8116083861d62eda020a4b6316fc0f319c427287b5f42ecefe34d2bee9ed65.exe

Modifies registry key 1 TTPs 9 IoCs

Modify Registry

T1112

pid	Process
2080	REG.exe
2088	REG.exe
4928	REG.exe
2624	REG.exe
2400	REG.exe
4700	REG.exe
1056	REG.exe
3360	REG.exe
4408	REG.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

pid	Process
1840	avscan.exe
2452	hosts.exe

Suspicious use of SetWindowsHookEx 7 IoCs

pid	Process
1104	5d8116083861d62eda020a4b6316fc0f319c427287b5f42ecefe34d2bee9ed65.exe
1840	avscan.exe
2088	avscan.exe
2452	hosts.exe
1656	hosts.exe
556	avscan.exe
2544	hosts.exe

Suspicious use of WriteProcessMemory 21 IoCs

description	pid	Process	procid_target
PID 1104 wrote to memory of 2080	1104	5d8116083861d62eda020a4b6316fc0f319c427287b5f42ecefe34d2bee9ed65.exe	86
PID 1104 wrote to memory of 1840	1104	5d8116083861d62eda020a4b6316fc0f319c427287b5f42ecefe34d2bee9ed65.exe	88
PID 1840 wrote to memory of 2088	1840	avscan.exe	89
PID 1840 wrote to memory of 3376	1840	avscan.exe	90
PID 1104 wrote to memory of 5108	1104	5d8116083861d62eda020a4b6316fc0f319c427287b5f42ecefe34d2bee9ed65.exe	91
PID 3376 wrote to memory of 2452	3376	cmd.exe	96
PID 5108 wrote to memory of 1656	5108	cmd.exe	97
PID 2452 wrote to memory of 556	2452	hosts.exe	98
PID 3376 wrote to memory of 4808	3376	cmd.exe	99
PID 2452 wrote to memory of 4028	2452	hosts.exe	100
PID 5108 wrote to memory of 5008	5108	cmd.exe	102
PID 4028 wrote to memory of 2544	4028	cmd.exe	103
PID 4028 wrote to memory of 4600	4028	cmd.exe	104
PID 1840 wrote to memory of 2400	1840	avscan.exe	113
PID 2452 wrote to memory of 4700	2452	hosts.exe	115
PID 1840 wrote to memory of 2088	1840	avscan.exe	118
PID 2452 wrote to memory of 4928	2452	hosts.exe	120
PID 1840 wrote to memory of 1056	1840	avscan.exe	122
PID 2452 wrote to memory of 2624	2452	hosts.exe	124
PID 1840 wrote to memory of 3360	1840	avscan.exe	126
PID 2452 wrote to memory of 4408	2452	hosts.exe	128

C:\Users\Admin\AppData\Local\Temp\5d8116083861d62eda020a4b6316fc0f319c427287b5f42ecefe34d2bee9ed65.exe
"C:\Users\Admin\AppData\Local\Temp\5d8116083861d62eda020a4b6316fc0f319c427287b5f42ecefe34d2bee9ed65.exe"
1⤵
- Modifies visibility of file extensions in Explorer
- Modifies visibility of hidden/system files in Explorer
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1104
- C:\Windows\SysWOW64\REG.exe
  REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
  2⤵
  - Impair Defenses: Safe Mode Boot
  - System Location Discovery: System Language Discovery
  - Modifies registry key
  PID:2080
- C:\Users\Admin\AppData\Local\Temp\avscan.exe
  C:\Users\Admin\AppData\Local\Temp\avscan.exe
  2⤵
  - Modifies visibility of file extensions in Explorer
  - Modifies visibility of hidden/system files in Explorer
  - Executes dropped EXE
  - Adds Run key to start application
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1840
- - C:\Users\Admin\AppData\Local\Temp\avscan.exe
    C:\Users\Admin\AppData\Local\Temp\avscan.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:2088
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c c:\windows\W_X_C.bat
    3⤵
    - Checks computer location settings
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    - Suspicious use of WriteProcessMemory
    PID:3376
  - - C:\windows\hosts.exe
      C:\windows\hosts.exe
      4⤵
      Modifies visibility of file extensions in Explorer
      Modifies visibility of hidden/system files in Explorer
      Executes dropped EXE
      Adds Run key to start application
      Drops file in Windows directory
      System Location Discovery: System Language Discovery
      Suspicious behavior: GetForegroundWindowSpam
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:2452
    - - C:\Users\Admin\AppData\Local\Temp\avscan.exe
        
        C:\Users\Admin\AppData\Local\Temp\avscan.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:556
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c c:\windows\W_X_C.bat
        5⤵
        Checks computer location settings
        Executes a command shell one-liner
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4028
      - C:\windows\hosts.exe
        
        C:\windows\hosts.exe
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:2544
      - C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Windows\W_X_C.vbs"
        6⤵
        Adds policy Run key to start application
        Executes a VBScript file via the Windows Script Host.
        System Location Discovery: System Language Discovery
        
        PID:4600
    - - C:\Windows\SysWOW64\REG.exe
        
        REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
        5⤵
        System Location Discovery: System Language Discovery
        Modifies registry key
        
        PID:4700
    - - C:\Windows\SysWOW64\REG.exe
        
        REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
        5⤵
        System Location Discovery: System Language Discovery
        Modifies registry key
        
        PID:4928
    - - C:\Windows\SysWOW64\REG.exe
        
        REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
        5⤵
        System Location Discovery: System Language Discovery
        Modifies registry key
        
        PID:2624
    - - C:\Windows\SysWOW64\REG.exe
        
        REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
        5⤵
        System Location Discovery: System Language Discovery
        Modifies registry key
        
        PID:4408
  - - C:\Windows\SysWOW64\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Windows\W_X_C.vbs"
      4⤵
      Adds policy Run key to start application
      Executes a VBScript file via the Windows Script Host.
      System Location Discovery: System Language Discovery
      PID:4808
- - C:\Windows\SysWOW64\REG.exe
    REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies registry key
    PID:2400
- - C:\Windows\SysWOW64\REG.exe
    REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies registry key
    PID:2088
- - C:\Windows\SysWOW64\REG.exe
    REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies registry key
    PID:1056
- - C:\Windows\SysWOW64\REG.exe
    REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies registry key
    PID:3360
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c c:\windows\W_X_C.bat
  2⤵
  - Checks computer location settings
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:5108
- - C:\windows\hosts.exe
    C:\windows\hosts.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:1656
- - C:\Windows\SysWOW64\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Windows\W_X_C.vbs"
    3⤵
    - Adds policy Run key to start application
    - Executes a VBScript file via the Windows Script Host.
    - System Location Discovery: System Language Discovery
    PID:5008

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:2384

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Visual Basic

T1059.005

Windows Command Shell

T1059.003

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Impair Defenses

T1562

Safe Mode Boot

T1562.009

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

avscan.exe

Path C:\Users\Admin\AppData\Local\Temp\avscan.exe
Size 9.3MB
SHA256 1157b984f46996af2a8b801a734cd404f9d495cede323ddf19204366ab680fbd
MD5 7946ca5d088c9adee71d35f79ff4ab00
SHA1 981eb4b800e2ad65f1d0e9bc0b491a240bd482d3
SHA512 ec77942bc024dfb04e9e3671558e0f649606e6f8722d1bed8e64ee267d06cada4c877ba9fceb0b680d8e50bba12820e9ee5181fad515a70c9a626b0ddae20cc0
SSDEEP 12288:0aoSDaoS4aoSDaoS4aoSDaoS4aoSDaoSZaoSDaoS2aoSDaoS4aoS4aoSDaoS4aod:4
TLSH
T13AA6A0537757A507F02A8A390A12879D5396FE328E023997B2D43E3B2D331CB6E1D971
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

128.png

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir3088_1433419378\CRX_INSTALL\128.png
Size 18.6MB
SHA256 e50fe19455d4ab643ea63e568ecf695063eb414268cff4e86a0c58a6e867b2ea
MD5 828e384afc0dd92a224943f8ecb466c0
SHA1 6ac85bb9f312d1dec17a95c2b0c0cf9d6f0c61f2
SHA512 28925aed1c6a211c6f1d38c2a3756f5f734ba7f8efe4d703a3725fffa65f9ac1216e7be9f2406e8b358492a815b67dd8c4a85743745632659894c8043ca1df00
SSDEEP 12288:0aoSDaoS4aoSDaoS4aoSDaoS4aoSDaoSZaoSDaoS2aoSDaoS4aoS4aoSDaoS4ao2:h
TLSH
T1EF17A0537757A507F02A8A390A12879D5396FE328E023997B2D43E3B2D331CB6E1D971
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

128.png

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir3088_1433419378\CRX_INSTALL\128.png
Size 27.8MB
SHA256 cee4e782125a7c6d9fa596844a24b3282b2209687c867e15093b649a58e97002
MD5 afdd7d0d0c936395b77d7ce33111f3fd
SHA1 942e2044dd184b6fc8f3aca5d391a676c829c517
SHA512 65cb0f0138dfa3e6a9e7887bb1e1022b7aaef7c5ba459b6c6a07594029da5d47c1eab2525e8c6fc1797643b036e6fb043002f3df788242296a90fd67b509247f
SSDEEP 12288:0aoSDaoS4aoSDaoS4aoSDaoS4aoSDaoSZaoSDaoS2aoSDaoS4aoS4aoSDaoS4aoI:h
TLSH
T16357A0537757A507F02A8A390A12879D5396FE328E023997B2D43E3B2D331CB6E1D971
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

128.png

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir3088_1433419378\CRX_INSTALL\128.png
Size 37.1MB
SHA256 d2ce134afdd280fcf06078a883dcbb9c47272e2bf529e6de195b27ccb4d19b5b
MD5 605201d063b148e9a746dc875678baf3
SHA1 8937ce861deee5133522c8aaa20ad9b91682098c
SHA512 b64954491479025d5e3f5dfcdbbfae6f4d4fff49c7b185678d0c0d2582adeeb74b5a8908edd179a83c3569d0e4d9a291f9e265ac500c64d35ebef8a1b8e5b7b8
SSDEEP 12288:0aoSDaoS4aoSDaoS4aoSDaoS4aoSDaoSZaoSDaoS2aoSDaoS4aoS4aoSDaoS4aor:c
TLSH
T1A187A0537757A507F02A8A390A12879D5396FE328E023997B2D43E3B2D331CB6E1D971
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

128.png

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir3088_1433419378\CRX_INSTALL\128.png
Size 46.4MB
SHA256 9e6379f7e9405640eb53fafab0822f5b655b1bca45dbac0e9f191548f31be0ac
MD5 6ea321449485b2cc62d50607cd80be77
SHA1 68c2accec2970f88f92207e21406abe1134a53a5
SHA512 c82dd8ecb2311db427be85e46082a1ff06bcfce6fae710b4435ee96887c5d0e2451d409c08943ea16c93a5f5e226012b96fc7f490bdc2b2981198772f19f219f
SSDEEP 12288:0aoSDaoS4aoSDaoS4aoSDaoS4aoSDaoSZaoSDaoS2aoSDaoS4aoS4aoSDaoS4aoZ:g
TLSH
T143B7A0537757A507F02A8A390A12879D5396FE328E023997B2D43E3B2D331CB6E1D971
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

128.png

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir3088_1433419378\CRX_INSTALL\128.png
Size 55.7MB
SHA256 d18363218774cac42c2e82067650bbc873f2555595a2849a21057b9cc406429e
MD5 9cdd569b7a150a10d3619aa638078946
SHA1 975b44a9fb9445a2c96813b0c62df76575d3ff83
SHA512 19760fcdfff995ae004eba6e58917652433227281717b064ccad2c7abaeed2b714da300a286469b3e27615bb718a5dee0add9918fc82d18655fee1b655890da6
SSDEEP 12288:0aoSDaoS4aoSDaoS4aoSDaoS4aoSDaoSZaoSDaoS2aoSDaoS4aoS4aoSDaoS4aok:b
TLSH
T142D7A0537757A507F02A8A390A12879D5396FE328E023997B2D43E3B2D331CB6E1D971
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

W_X_C.vbs

Path C:\Windows\W_X_C.vbs
Size 195B
SHA256 b665224204f325db623a41a643f8ab4b53c83c7d7b7e64e8d5c2ddd074ba2be0
MD5 c2c69d91a8e3e84994a1b2cf2230380e
SHA1 60e116e89cb917659721ac4a877ba04f12a0a07b
SHA512 ca8cac02e5ac677403bf3721bedbbc24840c91740d22fe89a3f5728c17dd181dfdeaefc4fd6b4575f3f3c21dfdd59addb8a644609033ec054112a4b452a20d94
TLSH
T19DD022E166224423923271D003098005073890023132EB21A188AC502132ECA407828F
MD5 SHA1 SHA512 TLSH

Submit Download

hosts.exe

Path C:\Windows\hosts.exe
Size 9.3MB
SHA256 ccdc3c88659010708f84ebb33c678b2ec34615530c528ef0900105a455eb6110
MD5 f3024ea0ee8dde1d49f0023fb17d947c
SHA1 5dad3229d39efd1154ee896710a73a43c1879dd3
SHA512 c3de25f37a3596fe522c271deac2611876109e3a4e4a98f4acf445ff5183810de33c5ef42cd257b92f14adf654556bdd5dad200130c39c2049b92961dd183745
SSDEEP 12288:0aoSDaoS4aoSDaoS4aoSDaoS4aoSDaoSZaoSDaoS2aoSDaoS4aoS4aoSDaoS4aoX:S
TLSH
T169A6A0537757A507F02A8A390A12879D5396FE328E023997B2D43E3B2D331CB6E1D971
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

W_X_C.bat

Path \??\c:\windows\W_X_C.bat
Size 336B
SHA256 d2150b9e5a4ce55e140f0ca91c4e300715d42095c8fddf58c77037cdd2cfaf78
MD5 4db9f8b6175722b62ececeeeba1ce307
SHA1 3b3ba8414706e72a6fa19e884a97b87609e11e47
SHA512 1d6dc274cf7a3dd704f840e6a5ad57ab4c4e35d5f09489aeff520bb797e1c825bac53fc335156fe41e767a46520d031855fe42fe7b175409ebe5e9e986fb9b8b
TLSH
T180E07D5E45D89471DA3107CC62CABE50785342479F84B99963D98D80FECA520D09667C
MD5 SHA1 SHA512 TLSH

Submit Download

memory/556-43-0x0000000000400000-0x000000000042D000-memory.dmp

Download

memory/1104-24-0x0000000000400000-0x000000000042D000-memory.dmp

Download

memory/1104-0-0x0000000000400000-0x000000000042D000-memory.dmp

Download

memory/1656-41-0x0000000000400000-0x000000000042D000-memory.dmp

Download

memory/1840-50-0x0000000000400000-0x000000000042D000-memory.dmp

Download

memory/2088-23-0x0000000000400000-0x000000000042D000-memory.dmp

Download

memory/2088-16-0x0000000000400000-0x000000000042D000-memory.dmp

Download

memory/2452-52-0x0000000000400000-0x000000000042D000-memory.dmp

Download

memory/2544-49-0x0000000000400000-0x000000000042D000-memory.dmp

Download

memory/2544-45-0x0000000000400000-0x000000000042D000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads