ab0845e63a6dfb051a5fc42c268cd8e82f614dfa34e6d21b108936cb62c33c84

Analysis

max time kernel
149s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
26/08/2026, 07:14

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
ab0845e63a6dfb051a5fc42c268cd8e82f614dfa34e6d21b108936cb62c33c84.exe
Size 6.2MB
Sample260826-h2rmmscb42
SHA256 ab0845e63a6dfb051a5fc42c268cd8e82f614dfa34e6d21b108936cb62c33c84
MD5 05af8154424f9414b2ddd7c74fe23402
SHA1 a0b3be8d098e2116292c345e2cf586c84530110a
SHA512 4015e5a2f39bf0a54fd555ff8c97025c90222d2bcb470b3fccbaf6ed7a0f7ba578bc3d0293ba478da39aa459036b287a73d5e5008845abe5052ff07f5fb79a35
SSDEEP 12288:0aoSZaoSDaoS2aoSDaoS4aoS4aoSDaoS4aoSDaoS4aoSDaoS4aoSDaoS+aoSDaoK:x
TLSH
T1BC66A0537757A507F02A8A390A12879D5396FE328E023997B2D43E3B2D331CB6E1D971
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery execution persistence upx

Malware Config

Signatures

Modifies visibility of file extensions in Explorer 2 TTPs 3 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	hosts.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	ab0845e63a6dfb051a5fc42c268cd8e82f614dfa34e6d21b108936cb62c33c84.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	avscan.exe

Modifies visibility of hidden/system files in Explorer 2 TTPs 3 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	ab0845e63a6dfb051a5fc42c268cd8e82f614dfa34e6d21b108936cb62c33c84.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	avscan.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	hosts.exe

Adds policy Run key to start application 2 TTPs 6 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	WScript.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\EPSYDAFZ = "W_X_C.bat"	WScript.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	WScript.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\EPSYDAFZ = "W_X_C.bat"	WScript.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	WScript.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\EPSYDAFZ = "W_X_C.bat"	WScript.exe

Checks computer location settings 2 TTPs 3 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\Control Panel\International\Geo\Nation	cmd.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\Control Panel\International\Geo\Nation	cmd.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\Control Panel\International\Geo\Nation	cmd.exe

Executes dropped EXE 6 IoCs

pid	Process
4684	avscan.exe
4980	avscan.exe
3608	hosts.exe
4456	hosts.exe
2344	avscan.exe
1956	hosts.exe

Impair Defenses: Safe Mode Boot 1 TTPs 6 IoCs

defense_evasion

Safe Mode Boot

T1562.009

description	ioc	Process
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\SerCx2.sys	REG.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\UserManager	REG.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\CBDHSvc	REG.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\iai2c.sys	REG.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\Power	REG.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\ProfSvc	REG.exe

Adds Run key to start application 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\avscan = "C:\\Users\\Admin\\AppData\\Local\\Temp\\avscan.exe"	ab0845e63a6dfb051a5fc42c268cd8e82f614dfa34e6d21b108936cb62c33c84.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\avscan = "C:\\Users\\Admin\\AppData\\Local\\Temp\\avscan.exe"	avscan.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\avscan = "C:\\Users\\Admin\\AppData\\Local\\Temp\\avscan.exe"	hosts.exe

Executes a VBScript file via the Windows Script Host. 1 TTPs 3 IoCs

execution

Visual Basic

T1059.005

pid	Process
5088	WScript.exe
1516	WScript.exe
1568	WScript.exe

UPX packed file 19 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/3848-0-0x0000000000400000-0x000000000042D000-memory.dmp	upx
behavioral1/files/0x00070000000244ee-10.dat	upx
behavioral1/files/0x00070000000244ef-13.dat	upx
behavioral1/memory/4980-16-0x0000000000400000-0x000000000042D000-memory.dmp	upx
behavioral1/memory/3848-24-0x0000000000400000-0x000000000042D000-memory.dmp	upx
behavioral1/memory/4980-22-0x0000000000400000-0x000000000042D000-memory.dmp	upx
behavioral1/memory/2344-39-0x0000000000400000-0x000000000042D000-memory.dmp	upx
behavioral1/memory/4456-38-0x0000000000400000-0x000000000042D000-memory.dmp	upx
behavioral1/memory/2344-44-0x0000000000400000-0x000000000042D000-memory.dmp	upx
behavioral1/memory/1956-49-0x0000000000400000-0x000000000042D000-memory.dmp	upx
behavioral1/memory/4684-50-0x0000000000400000-0x000000000042D000-memory.dmp	upx
behavioral1/memory/3608-52-0x0000000000400000-0x000000000042D000-memory.dmp	upx
behavioral1/files/0x0007000000024442-59.dat	upx
behavioral1/files/0x0007000000024442-66.dat	upx
behavioral1/files/0x0007000000024442-69.dat	upx
behavioral1/files/0x0007000000024442-76.dat	upx
behavioral1/files/0x0007000000024442-79.dat	upx
behavioral1/files/0x0007000000024442-87.dat	upx
behavioral1/files/0x0007000000024442-89.dat	upx

Drops file in Windows directory 5 IoCs

description	ioc	Process
File created	C:\windows\W_X_C.vbs	ab0845e63a6dfb051a5fc42c268cd8e82f614dfa34e6d21b108936cb62c33c84.exe
File created	\??\c:\windows\W_X_C.bat	ab0845e63a6dfb051a5fc42c268cd8e82f614dfa34e6d21b108936cb62c33c84.exe
File opened for modification	C:\Windows\hosts.exe	ab0845e63a6dfb051a5fc42c268cd8e82f614dfa34e6d21b108936cb62c33c84.exe
File opened for modification	C:\Windows\hosts.exe	avscan.exe
File opened for modification	C:\Windows\hosts.exe	hosts.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
1104	cmd.exe
3308	cmd.exe
640	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 22 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	REG.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	REG.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	REG.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	REG.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	REG.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	avscan.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hosts.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hosts.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	avscan.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	REG.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	REG.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hosts.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ab0845e63a6dfb051a5fc42c268cd8e82f614dfa34e6d21b108936cb62c33c84.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	avscan.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	REG.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	REG.exe

Modifies registry class 4 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings	ab0845e63a6dfb051a5fc42c268cd8e82f614dfa34e6d21b108936cb62c33c84.exe
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings	cmd.exe

Modifies registry key 1 TTPs 9 IoCs

Modify Registry

T1112

pid	Process
4452	REG.exe
1972	REG.exe
4776	REG.exe
2228	REG.exe
4664	REG.exe
4608	REG.exe
2276	REG.exe
2616	REG.exe
4720	REG.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

pid	Process
4684	avscan.exe
3608	hosts.exe

Suspicious use of SetWindowsHookEx 7 IoCs

pid	Process
3848	ab0845e63a6dfb051a5fc42c268cd8e82f614dfa34e6d21b108936cb62c33c84.exe
4684	avscan.exe
4980	avscan.exe
3608	hosts.exe
4456	hosts.exe
2344	avscan.exe
1956	hosts.exe

Suspicious use of WriteProcessMemory 21 IoCs

description	pid	Process	procid_target
PID 3848 wrote to memory of 4452	3848	ab0845e63a6dfb051a5fc42c268cd8e82f614dfa34e6d21b108936cb62c33c84.exe	85
PID 3848 wrote to memory of 4684	3848	ab0845e63a6dfb051a5fc42c268cd8e82f614dfa34e6d21b108936cb62c33c84.exe	87
PID 4684 wrote to memory of 4980	4684	avscan.exe	88
PID 4684 wrote to memory of 3308	4684	avscan.exe	89
PID 3848 wrote to memory of 1104	3848	ab0845e63a6dfb051a5fc42c268cd8e82f614dfa34e6d21b108936cb62c33c84.exe	90
PID 3308 wrote to memory of 3608	3308	cmd.exe	93
PID 1104 wrote to memory of 4456	1104	cmd.exe	94
PID 3608 wrote to memory of 2344	3608	hosts.exe	96
PID 3308 wrote to memory of 5088	3308	cmd.exe	98
PID 1104 wrote to memory of 1516	1104	cmd.exe	100
PID 3608 wrote to memory of 640	3608	hosts.exe	99
PID 640 wrote to memory of 1956	640	cmd.exe	104
PID 640 wrote to memory of 1568	640	cmd.exe	105
PID 4684 wrote to memory of 4664	4684	avscan.exe	115
PID 3608 wrote to memory of 4608	3608	hosts.exe	118
PID 4684 wrote to memory of 2276	4684	avscan.exe	123
PID 3608 wrote to memory of 1972	3608	hosts.exe	125
PID 4684 wrote to memory of 2616	4684	avscan.exe	128
PID 3608 wrote to memory of 4776	3608	hosts.exe	130
PID 4684 wrote to memory of 4720	4684	avscan.exe	137
PID 3608 wrote to memory of 2228	3608	hosts.exe	139

C:\Users\Admin\AppData\Local\Temp\ab0845e63a6dfb051a5fc42c268cd8e82f614dfa34e6d21b108936cb62c33c84.exe
"C:\Users\Admin\AppData\Local\Temp\ab0845e63a6dfb051a5fc42c268cd8e82f614dfa34e6d21b108936cb62c33c84.exe"
1⤵
- Modifies visibility of file extensions in Explorer
- Modifies visibility of hidden/system files in Explorer
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3848
- C:\Windows\SysWOW64\REG.exe
  REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
  2⤵
  - Impair Defenses: Safe Mode Boot
  - System Location Discovery: System Language Discovery
  - Modifies registry key
  PID:4452
- C:\Users\Admin\AppData\Local\Temp\avscan.exe
  C:\Users\Admin\AppData\Local\Temp\avscan.exe
  2⤵
  - Modifies visibility of file extensions in Explorer
  - Modifies visibility of hidden/system files in Explorer
  - Executes dropped EXE
  - Adds Run key to start application
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4684
- - C:\Users\Admin\AppData\Local\Temp\avscan.exe
    C:\Users\Admin\AppData\Local\Temp\avscan.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:4980
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c c:\windows\W_X_C.bat
    3⤵
    - Checks computer location settings
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    - Suspicious use of WriteProcessMemory
    PID:3308
  - - C:\windows\hosts.exe
      C:\windows\hosts.exe
      4⤵
      Modifies visibility of file extensions in Explorer
      Modifies visibility of hidden/system files in Explorer
      Executes dropped EXE
      Adds Run key to start application
      Drops file in Windows directory
      System Location Discovery: System Language Discovery
      Suspicious behavior: GetForegroundWindowSpam
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:3608
    - - C:\Users\Admin\AppData\Local\Temp\avscan.exe
        
        C:\Users\Admin\AppData\Local\Temp\avscan.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:2344
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c c:\windows\W_X_C.bat
        5⤵
        Checks computer location settings
        Executes a command shell one-liner
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:640
      - C:\windows\hosts.exe
        
        C:\windows\hosts.exe
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:1956
      - C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Windows\W_X_C.vbs"
        6⤵
        Adds policy Run key to start application
        Executes a VBScript file via the Windows Script Host.
        System Location Discovery: System Language Discovery
        
        PID:1568
    - - C:\Windows\SysWOW64\REG.exe
        
        REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
        5⤵
        System Location Discovery: System Language Discovery
        Modifies registry key
        
        PID:4608
    - - C:\Windows\SysWOW64\REG.exe
        
        REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
        5⤵
        System Location Discovery: System Language Discovery
        Modifies registry key
        
        PID:1972
    - - C:\Windows\SysWOW64\REG.exe
        
        REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
        5⤵
        System Location Discovery: System Language Discovery
        Modifies registry key
        
        PID:4776
    - - C:\Windows\SysWOW64\REG.exe
        
        REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
        5⤵
        System Location Discovery: System Language Discovery
        Modifies registry key
        
        PID:2228
  - - C:\Windows\SysWOW64\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Windows\W_X_C.vbs"
      4⤵
      Adds policy Run key to start application
      Executes a VBScript file via the Windows Script Host.
      System Location Discovery: System Language Discovery
      PID:5088
- - C:\Windows\SysWOW64\REG.exe
    REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies registry key
    PID:4664
- - C:\Windows\SysWOW64\REG.exe
    REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies registry key
    PID:2276
- - C:\Windows\SysWOW64\REG.exe
    REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies registry key
    PID:2616
- - C:\Windows\SysWOW64\REG.exe
    REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies registry key
    PID:4720
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c c:\windows\W_X_C.bat
  2⤵
  - Checks computer location settings
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:1104
- - C:\windows\hosts.exe
    C:\windows\hosts.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:4456
- - C:\Windows\SysWOW64\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Windows\W_X_C.vbs"
    3⤵
    - Adds policy Run key to start application
    - Executes a VBScript file via the Windows Script Host.
    - System Location Discovery: System Language Discovery
    PID:1516

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:3724

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Visual Basic

T1059.005

Windows Command Shell

T1059.003

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Impair Defenses

T1562

Safe Mode Boot

T1562.009

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

avscan.exe

Path C:\Users\Admin\AppData\Local\Temp\avscan.exe
Size 6.2MB
SHA256 9744c713d53f093704b521cea8b13363ba67395690ef91fffae9a4f1874954bf
MD5 a771db5f36e91c3a39f8136603f2e485
SHA1 d003a659d1cbcf960d255eaa307a818e93d75e8e
SHA512 596ff4143370da3c20c770afb95661e18f0699ccf4f93df5efd73ea793e28819cca8fb66929b79c4c4dc2df0b6868df9f91673021bc28998c68510d4e5957be6
SSDEEP 12288:0aoSZaoSDaoS2aoSDaoS4aoS4aoSDaoS4aoSDaoS4aoSDaoS4aoSDaoS+aoSDaoL:k
TLSH
T19966A0537757A507F02A8A390A12879D5396FE328E023997B2D43E3B2D331CB6E1D971
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

128.png

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir1684_2146625571\CRX_INSTALL\128.png
Size 12.4MB
SHA256 1f02818d193377b35b1c2cef26d2f1d6dbeb96a16d1b7b2c11fd40e3e39a60c6
MD5 eb3705c264553d0d62e1518159baaa7a
SHA1 683c8c2fd31ef206ad3924702453305304f0ac6a
SHA512 31007b33515c5a0242518f807df87b1286d51513e1b08da57aa014306bc68001854c1153447c3e5f25406f7e9abc8d4cc7c91050a7a6ad3b41c91aacaabe138c
SSDEEP 12288:0aoSZaoSDaoS2aoSDaoS4aoS4aoSDaoS4aoSDaoS4aoSDaoS4aoSDaoS+aoSDaov:K
TLSH
T177D6A0537757A507F02A8A390A12879D5396FE328E023997B2D43E3B2D331CB6E1D971
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

128.png

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir1684_2146625571\CRX_INSTALL\128.png
Size 18.6MB
SHA256 215a8ef28f4645e4986aa644d1f70f859f393a1d5db4175b42fd35613ef817cb
MD5 e65e6d288467fd8e76ba0d227a6c2630
SHA1 fc5b793e6fe4e12cb5fc17b9632379c7213d4e11
SHA512 182e194aaba4d65f200efc36a135d1c2f6b405dbeaea51994256ddf75390f87d00edae86d10bcb06210f8e6458209241ad0c9fa33a36942176703c2625b204b5
SSDEEP 12288:0aoSZaoSDaoS2aoSDaoS4aoS4aoSDaoS4aoSDaoS4aoSDaoS4aoSDaoS+aoSDaoO:F
TLSH
T13817A0537757A507F02A8A390A12879D5396FE328E023997B2D43E3B2D331CB6E1D971
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

128.png

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir1684_2146625571\CRX_INSTALL\128.png
Size 24.8MB
SHA256 852c6d12c09a58dc1911e67576e1b3697b38b4282e335a8c9f7d5077a4cdead5
MD5 4bf1f32eb4cbc746b0ce237a2a1cec51
SHA1 03a614c52f44527077ad2538722c6f8b67070643
SHA512 fe7fe213cec719a418deba8377d1526120bea45c120a96bdb45fec58de56a69e6432f0528dbcd57bd508519050787fdbfe054a08adf27fcf3815b3f045597877
SSDEEP 12288:0aoSZaoSDaoS2aoSDaoS4aoS4aoSDaoS4aoSDaoS4aoSDaoS4aoSDaoS+aoSDao5:U
TLSH
T14647A0537757A507F02A8A390A12879D5396FE328E023997B2D43E3B2D331CB6E1D971
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

128.png

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir1684_2146625571\CRX_INSTALL\128.png
Size 31.0MB
SHA256 df38c0fe7b3e56f91e3f9b93eda13471d47de28d3699393943e55ab4596fff78
MD5 35acc77eb258dcdd6443fb799614f589
SHA1 fbc4403e936bf9c962f83e8ce4e4a4cf62779281
SHA512 9993f10c27ad7e754d7296c6e85eae0e644137d2fee1194c67ab193871bdf67c647751d1e23a10e4f0fca64d89b3198b285b2f24c2f363a4615c8b710e57762d
SSDEEP 12288:0aoSZaoSDaoS2aoSDaoS4aoS4aoSDaoS4aoSDaoS4aoSDaoS4aoSDaoS+aoSDaow:r
TLSH
T14967A0537757A507F02A8A390A12879D5396FE328E023997B2D43E3B2D331CB6E1D971
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

128.png

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir1684_2146625571\CRX_INSTALL\128.png
Size 37.1MB
SHA256 9a2f10f0b3506702c275e539d3f9c4fc4e5a711b3c55cb0c96a51f4e30dae2df
MD5 f293f12b62854253a85a003c175ece75
SHA1 babc5ccfb0f423618ae94c305928c1c5a42d1f21
SHA512 3d1d1e96367e94c5ac24af62733357079508e4764d16df6d3d2bc63ceb1caf13c231a41b99529b4d33609600cbf3d56aa43ffe9967b0e2b74e5c02685f4baab7
SSDEEP 12288:0aoSZaoSDaoS2aoSDaoS4aoS4aoSDaoS4aoSDaoS4aoSDaoS4aoSDaoS+aoSDaol:o
TLSH
T1BC87A0537757A507F02A8A390A12879D5396FE328E023997B2D43E3B2D331CB6E1D971
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

128.png

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir1684_2146625571\CRX_INSTALL\128.png
Size 43.3MB
SHA256 1f64e190fb506420d1de2a92741f3b9ff4d6b08d526b7b0dce4a3b58bf6fd5e1
MD5 14eabd13c1c9156b43bc6f6a9cd5ba7f
SHA1 78ba3e950e1097e326f8d11ea979f26491983de8
SHA512 c370b34bc34ad65f670fdcd339182df6f6497f01364b0724a24623ba26bf8afe97ef11fc3d0d30ac7b79b5f567e89d8b8fda1e5d1de8170c6e5d5b5686c59c4a
SSDEEP 12288:0aoSZaoSDaoS2aoSDaoS4aoS4aoSDaoS4aoSDaoS4aoSDaoS4aoSDaoS+aoSDaog:b
TLSH
T1E6A7A0537757A507F02A8A390A12879D5396FE328E023997B2D43E3B2D331CB6E1D971
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

128.png

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir1684_2146625571\CRX_INSTALL\128.png
Size 49.5MB
SHA256 5dadf12771c1462abf6f949fcf7575e35e52fa9f4966907afba0a891ef9154a6
MD5 dae195db58695cdaa2af5d734fa86739
SHA1 4a9d0bfacd2c449e13eec287f903c1d52eb029aa
SHA512 623bb281f5d974c168bb7d0712bc190b7861c910680962be6b8eda519a0fd7a0807f1e2e3611631126b79c0dcc09e7b8aaa661d29b0b540bdb159c65e448d731
SSDEEP 12288:0aoSZaoSDaoS2aoSDaoS4aoS4aoSDaoS4aoSDaoS4aoSDaoS4aoSDaoS+aoSDao8:F
TLSH
T192B7A0537757A507F02A8A390A12879D5396FE328E023997B2D43E3B2D331CB6E1D971
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

W_X_C.vbs

Path C:\Windows\W_X_C.vbs
Size 195B
SHA256 94d9f204b19ccac6031612f6e9d8ae30d903c42e315c9e225642ff619bfcc7c3
MD5 29e4644aff7c07adbf5dc9c50bfb9f4f
SHA1 49912cdbfbc0d8b268444c99d0c952ccdc6efefe
SHA512 472033228a1ade9d1408f82762c673696688c5fb2f6196548aedb63f574c353f36386257ecee2ecfff851051197f17c2bcefb575ea986eb90c5e38f778eac7d5
TLSH
T168D022A1762A4023827661D003098009073490483532DB359188A9402232EC640B828F
MD5 SHA1 SHA512 TLSH

Submit Download

hosts.exe

Path C:\Windows\hosts.exe
Size 6.2MB
SHA256 4882c85d376b6ccf6558d8c6228f3c130e9c0bfdc65b46442ba8f1875394b56e
MD5 42ebed8b7652a73d18a30d859258234a
SHA1 e3671f5cda7d9a2101226605915feba55bd845d3
SHA512 b388b1d3b6e2026533ec7846c87ac2cc71780c7331ea52e10855bc680a86cd19c1893223a6c425d7626e88facb08aafad940bcf111de8a71bc41c3c55637dd70
SSDEEP 12288:0aoSZaoSDaoS2aoSDaoS4aoS4aoSDaoS4aoSDaoS4aoSDaoS4aoSDaoS+aoSDaof:c
TLSH
T1E166A0537757A507F02A8A390A12879D5396FE328E023997B2D43E3B2D331CB6E1D971
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

W_X_C.bat

Path \??\c:\windows\W_X_C.bat
Size 336B
SHA256 d2150b9e5a4ce55e140f0ca91c4e300715d42095c8fddf58c77037cdd2cfaf78
MD5 4db9f8b6175722b62ececeeeba1ce307
SHA1 3b3ba8414706e72a6fa19e884a97b87609e11e47
SHA512 1d6dc274cf7a3dd704f840e6a5ad57ab4c4e35d5f09489aeff520bb797e1c825bac53fc335156fe41e767a46520d031855fe42fe7b175409ebe5e9e986fb9b8b
TLSH
T180E07D5E45D89471DA3107CC62CABE50785342479F84B99963D98D80FECA520D09667C
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1956-49-0x0000000000400000-0x000000000042D000-memory.dmp

Download

memory/2344-44-0x0000000000400000-0x000000000042D000-memory.dmp

Download

memory/2344-39-0x0000000000400000-0x000000000042D000-memory.dmp

Download

memory/3608-52-0x0000000000400000-0x000000000042D000-memory.dmp

Download

memory/3848-0-0x0000000000400000-0x000000000042D000-memory.dmp

Download

memory/3848-24-0x0000000000400000-0x000000000042D000-memory.dmp

Download

memory/4456-38-0x0000000000400000-0x000000000042D000-memory.dmp

Download

memory/4684-50-0x0000000000400000-0x000000000042D000-memory.dmp

Download

memory/4980-22-0x0000000000400000-0x000000000042D000-memory.dmp

Download

memory/4980-16-0x0000000000400000-0x000000000042D000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads