lunam | e8a08ea6a03940f427c65458a06bebcb54a171b9e0a3fe85f81d781ddea90287

Analysis

max time kernel
149s
max time network
143s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
27/08/2026, 10:54

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
e8a08ea6a03940f427c65458a06bebcb54a171b9e0a3fe85f81d781ddea90287.exe
Size 10.0MB
Sample260827-mzpsgsstdw
SHA256 e8a08ea6a03940f427c65458a06bebcb54a171b9e0a3fe85f81d781ddea90287
MD5 62f950587c2d8dbccb3205375ed95dfa
SHA1 e5394593d96e30237ee58669e41aac167d704325
SHA512 380b66aa767f3d0109a2ce1cc58905261845be6bd4f256a734c2a222608c0c04a9810292cf16806b23e3b699b966f6cde9b8641df64bb0b1f2197bd1b02ae6cb
SSDEEP 12288:0aoSDaoSaaoSDaoS4aoSDaoS4aoSDaoS4aoS4aoS4aoSDaoS4aoSDaoS4aoSDaoT:L7t
TLSH
T1E8B6AF537757A50BF02A8A390A11879D5396FE328E027897B2D43E3B3C331CB6E59971
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery execution lunam persistence trojan upx

Malware Config

Signatures

Family: Lunam
Lunam is a Windows trojan written in Visual Basic.
trojan lunam

Detects Lunam 7 IoCs

resource	yara_rule
behavioral1/files/0x00070000000244a4-9.dat	family_lunam
behavioral1/files/0x00070000000244a5-14.dat	family_lunam
behavioral1/files/0x0007000000024459-59.dat	family_lunam
behavioral1/files/0x0007000000024459-67.dat	family_lunam
behavioral1/files/0x0007000000024459-69.dat	family_lunam
behavioral1/files/0x0007000000024459-77.dat	family_lunam
behavioral1/files/0x0007000000024459-79.dat	family_lunam

Modifies visibility of file extensions in Explorer 2 TTPs 3 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	e8a08ea6a03940f427c65458a06bebcb54a171b9e0a3fe85f81d781ddea90287.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	avscan.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	hosts.exe

Modifies visibility of hidden/system files in Explorer 2 TTPs 3 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	e8a08ea6a03940f427c65458a06bebcb54a171b9e0a3fe85f81d781ddea90287.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	avscan.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	hosts.exe

Adds policy Run key to start application 2 TTPs 6 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	WScript.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\RYSBVXZE = "W_X_C.bat"	WScript.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	WScript.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\RYSBVXZE = "W_X_C.bat"	WScript.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	WScript.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\RYSBVXZE = "W_X_C.bat"	WScript.exe

Checks computer location settings 2 TTPs 3 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\Control Panel\International\Geo\Nation	cmd.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\Control Panel\International\Geo\Nation	cmd.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\Control Panel\International\Geo\Nation	cmd.exe

Executes dropped EXE 6 IoCs

pid	Process
2932	avscan.exe
2996	avscan.exe
4528	hosts.exe
2236	hosts.exe
3908	avscan.exe
2340	hosts.exe

Impair Defenses: Safe Mode Boot 1 TTPs 6 IoCs

defense_evasion

Safe Mode Boot

T1562.009

description	ioc	Process
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\CBDHSvc	REG.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\iai2c.sys	REG.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\Power	REG.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\ProfSvc	REG.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\SerCx2.sys	REG.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\UserManager	REG.exe

Adds Run key to start application 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\avscan = "C:\\Users\\Admin\\AppData\\Local\\Temp\\avscan.exe"	e8a08ea6a03940f427c65458a06bebcb54a171b9e0a3fe85f81d781ddea90287.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\avscan = "C:\\Users\\Admin\\AppData\\Local\\Temp\\avscan.exe"	avscan.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\avscan = "C:\\Users\\Admin\\AppData\\Local\\Temp\\avscan.exe"	hosts.exe

Executes a VBScript file via the Windows Script Host. 1 TTPs 3 IoCs

execution

Visual Basic

T1059.005

pid	Process
972	WScript.exe
3496	WScript.exe
4836	WScript.exe

UPX packed file 17 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/816-0-0x0000000000400000-0x000000000042D000-memory.dmp	upx
behavioral1/files/0x00070000000244a4-9.dat	upx
behavioral1/memory/2932-11-0x0000000000400000-0x000000000042D000-memory.dmp	upx
behavioral1/files/0x00070000000244a5-14.dat	upx
behavioral1/memory/816-22-0x0000000000400000-0x000000000042D000-memory.dmp	upx
behavioral1/memory/2996-24-0x0000000000400000-0x000000000042D000-memory.dmp	upx
behavioral1/memory/4528-30-0x0000000000400000-0x000000000042D000-memory.dmp	upx
behavioral1/memory/2236-38-0x0000000000400000-0x000000000042D000-memory.dmp	upx
behavioral1/memory/3908-44-0x0000000000400000-0x000000000042D000-memory.dmp	upx
behavioral1/memory/2340-49-0x0000000000400000-0x000000000042D000-memory.dmp	upx
behavioral1/memory/2932-50-0x0000000000400000-0x000000000042D000-memory.dmp	upx
behavioral1/memory/4528-51-0x0000000000400000-0x000000000042D000-memory.dmp	upx
behavioral1/files/0x0007000000024459-59.dat	upx
behavioral1/files/0x0007000000024459-67.dat	upx
behavioral1/files/0x0007000000024459-69.dat	upx
behavioral1/files/0x0007000000024459-77.dat	upx
behavioral1/files/0x0007000000024459-79.dat	upx

Drops file in Windows directory 5 IoCs

description	ioc	Process
File created	C:\windows\W_X_C.vbs	e8a08ea6a03940f427c65458a06bebcb54a171b9e0a3fe85f81d781ddea90287.exe
File created	\??\c:\windows\W_X_C.bat	e8a08ea6a03940f427c65458a06bebcb54a171b9e0a3fe85f81d781ddea90287.exe
File opened for modification	C:\Windows\hosts.exe	e8a08ea6a03940f427c65458a06bebcb54a171b9e0a3fe85f81d781ddea90287.exe
File opened for modification	C:\Windows\hosts.exe	avscan.exe
File opened for modification	C:\Windows\hosts.exe	hosts.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4120	cmd.exe
4784	cmd.exe
3216	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 22 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	REG.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	REG.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	REG.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hosts.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hosts.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	REG.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	REG.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	avscan.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	avscan.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	REG.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	REG.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	REG.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hosts.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	REG.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	e8a08ea6a03940f427c65458a06bebcb54a171b9e0a3fe85f81d781ddea90287.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	avscan.exe

Modifies registry class 4 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings	e8a08ea6a03940f427c65458a06bebcb54a171b9e0a3fe85f81d781ddea90287.exe
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings	cmd.exe

Modifies registry key 1 TTPs 9 IoCs

Modify Registry

T1112

pid	Process
3320	REG.exe
436	REG.exe
2420	REG.exe
2640	REG.exe
4208	REG.exe
4856	REG.exe
1688	REG.exe
4056	REG.exe
3904	REG.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

pid	Process
2932	avscan.exe
4528	hosts.exe

Suspicious use of SetWindowsHookEx 7 IoCs

pid	Process
816	e8a08ea6a03940f427c65458a06bebcb54a171b9e0a3fe85f81d781ddea90287.exe
2932	avscan.exe
2996	avscan.exe
4528	hosts.exe
2236	hosts.exe
3908	avscan.exe
2340	hosts.exe

Suspicious use of WriteProcessMemory 21 IoCs

description	pid	Process	procid_target
PID 816 wrote to memory of 2640	816	e8a08ea6a03940f427c65458a06bebcb54a171b9e0a3fe85f81d781ddea90287.exe	84
PID 816 wrote to memory of 2932	816	e8a08ea6a03940f427c65458a06bebcb54a171b9e0a3fe85f81d781ddea90287.exe	86
PID 2932 wrote to memory of 2996	2932	avscan.exe	87
PID 2932 wrote to memory of 3216	2932	avscan.exe	88
PID 816 wrote to memory of 4120	816	e8a08ea6a03940f427c65458a06bebcb54a171b9e0a3fe85f81d781ddea90287.exe	89
PID 4120 wrote to memory of 4528	4120	cmd.exe	92
PID 3216 wrote to memory of 2236	3216	cmd.exe	93
PID 4528 wrote to memory of 3908	4528	hosts.exe	95
PID 4120 wrote to memory of 972	4120	cmd.exe	96
PID 4528 wrote to memory of 4784	4528	hosts.exe	97
PID 3216 wrote to memory of 3496	3216	cmd.exe	99
PID 4784 wrote to memory of 2340	4784	cmd.exe	100
PID 4784 wrote to memory of 4836	4784	cmd.exe	101
PID 2932 wrote to memory of 3320	2932	avscan.exe	112
PID 4528 wrote to memory of 4208	4528	hosts.exe	114
PID 2932 wrote to memory of 4856	2932	avscan.exe	118
PID 4528 wrote to memory of 1688	4528	hosts.exe	120
PID 2932 wrote to memory of 436	2932	avscan.exe	122
PID 4528 wrote to memory of 4056	4528	hosts.exe	124
PID 2932 wrote to memory of 2420	2932	avscan.exe	126
PID 4528 wrote to memory of 3904	4528	hosts.exe	128

C:\Users\Admin\AppData\Local\Temp\e8a08ea6a03940f427c65458a06bebcb54a171b9e0a3fe85f81d781ddea90287.exe
"C:\Users\Admin\AppData\Local\Temp\e8a08ea6a03940f427c65458a06bebcb54a171b9e0a3fe85f81d781ddea90287.exe"
1⤵
- Modifies visibility of file extensions in Explorer
- Modifies visibility of hidden/system files in Explorer
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:816
- C:\Windows\SysWOW64\REG.exe
  REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
  2⤵
  - Impair Defenses: Safe Mode Boot
  - System Location Discovery: System Language Discovery
  - Modifies registry key
  PID:2640
- C:\Users\Admin\AppData\Local\Temp\avscan.exe
  C:\Users\Admin\AppData\Local\Temp\avscan.exe
  2⤵
  - Modifies visibility of file extensions in Explorer
  - Modifies visibility of hidden/system files in Explorer
  - Executes dropped EXE
  - Adds Run key to start application
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2932
- - C:\Users\Admin\AppData\Local\Temp\avscan.exe
    C:\Users\Admin\AppData\Local\Temp\avscan.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:2996
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c c:\windows\W_X_C.bat
    3⤵
    - Checks computer location settings
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    - Suspicious use of WriteProcessMemory
    PID:3216
  - - C:\windows\hosts.exe
      C:\windows\hosts.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:2236
  - - C:\Windows\SysWOW64\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Windows\W_X_C.vbs"
      4⤵
      Adds policy Run key to start application
      Executes a VBScript file via the Windows Script Host.
      System Location Discovery: System Language Discovery
      PID:3496
- - C:\Windows\SysWOW64\REG.exe
    REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies registry key
    PID:3320
- - C:\Windows\SysWOW64\REG.exe
    REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies registry key
    PID:4856
- - C:\Windows\SysWOW64\REG.exe
    REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies registry key
    PID:436
- - C:\Windows\SysWOW64\REG.exe
    REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies registry key
    PID:2420
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c c:\windows\W_X_C.bat
  2⤵
  - Checks computer location settings
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:4120
- - C:\windows\hosts.exe
    C:\windows\hosts.exe
    3⤵
    - Modifies visibility of file extensions in Explorer
    - Modifies visibility of hidden/system files in Explorer
    - Executes dropped EXE
    - Adds Run key to start application
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:4528
  - - C:\Users\Admin\AppData\Local\Temp\avscan.exe
      C:\Users\Admin\AppData\Local\Temp\avscan.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:3908
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c c:\windows\W_X_C.bat
      4⤵
      Checks computer location settings
      Executes a command shell one-liner
      System Location Discovery: System Language Discovery
      Modifies registry class
      Suspicious use of WriteProcessMemory
      PID:4784
    - - C:\windows\hosts.exe
        
        C:\windows\hosts.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:2340
    - - C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Windows\W_X_C.vbs"
        5⤵
        Adds policy Run key to start application
        Executes a VBScript file via the Windows Script Host.
        System Location Discovery: System Language Discovery
        
        PID:4836
  - - C:\Windows\SysWOW64\REG.exe
      REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
      4⤵
      System Location Discovery: System Language Discovery
      Modifies registry key
      PID:4208
  - - C:\Windows\SysWOW64\REG.exe
      REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
      4⤵
      System Location Discovery: System Language Discovery
      Modifies registry key
      PID:1688
  - - C:\Windows\SysWOW64\REG.exe
      REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
      4⤵
      System Location Discovery: System Language Discovery
      Modifies registry key
      PID:4056
  - - C:\Windows\SysWOW64\REG.exe
      REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
      4⤵
      System Location Discovery: System Language Discovery
      Modifies registry key
      PID:3904
- - C:\Windows\SysWOW64\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Windows\W_X_C.vbs"
    3⤵
    - Adds policy Run key to start application
    - Executes a VBScript file via the Windows Script Host.
    - System Location Discovery: System Language Discovery
    PID:972

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:1624

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Visual Basic

T1059.005

Windows Command Shell

T1059.003

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Impair Defenses

T1562

Safe Mode Boot

T1562.009

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

avscan.exe

Path C:\Users\Admin\AppData\Local\Temp\avscan.exe
Size 10.0MB
SHA256 9344b85d3b44e47f474e4084b6d51d1d8b80d0aedd13bbe71276633910fa4bb7
MD5 b4820649e78b21e04ad7b9efed82be6e
SHA1 2e3f660001269bbd25803c0b1eac657af9bf11f6
SHA512 4c26fcffafe19b4d9bc92980d40170ee1549c7f1a54c37ed4bec99fff08c49543f8cbcfb88a279e20c737545b5232cc3a291d26516f13a67b7e8648c259a2538
SSDEEP 12288:0aoSDaoSaaoSDaoS4aoSDaoS4aoSDaoS4aoS4aoS4aoSDaoS4aoSDaoS4aoSDaos:L7+
TLSH
T17DB6AF537757A50BF02A8A390A11879D5396FE328E027897B2D43E3B3C331CB6E59971
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

128.png

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir5012_858218355\CRX_INSTALL\128.png
Size 20.0MB
SHA256 52e3b126e21041f2e1fd182ce6f084b20cd17b75b3af817ca345569096fe0eae
MD5 61c62589db1a6e69a6bb87269adaf472
SHA1 7f50af520c3f01afe3fdfc12d0506d6af229c185
SHA512 7635d6f0292e0ede5fdcf5c314d3b343e1cc02cc0ac801ace43c5e43ef4d2b4b12b17a2a55de1341aace911727ae358ec6483972bea5418d92d921766ed4cf16
SSDEEP 12288:0aoSDaoSaaoSDaoS4aoSDaoS4aoSDaoS4aoS4aoS4aoSDaoS4aoSDaoS4aoSDao1:L7G7s
TLSH
T17F27AF537757A50BF02A8A390A11879D5396FE328E027897B2D43E3B3C331CB6E59971
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

128.png

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir5012_858218355\CRX_INSTALL\128.png
Size 30.0MB
SHA256 5c5f1304a6f0e2bd4c400d9cd8caa676ed37899e2248c8370b4bbc09df5a7122
MD5 c8ca88339ed72c9d3a79056ee313bed2
SHA1 030b66e6de58cad162483638419bafa3f0402a5b
SHA512 e4f01cd019b54caca66e3d96ae5d71306bd6398ab08d5b688fd9327f1537f3acaf98ad125dfc34f7ed8ac9837c5984b7d4ab36b48c1d235461b139faa85ee856
SSDEEP 12288:0aoSDaoSaaoSDaoS4aoSDaoS4aoSDaoS4aoS4aoS4aoSDaoS4aoSDaoS4aoSDaoY:L7t7G77
TLSH
T1C767AF537757A50BF02A8A390A11879D5396FE328E027897B2D43E3B3C331CB6E59971
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

128.png

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir5012_858218355\CRX_INSTALL\128.png
Size 40.0MB
SHA256 0ad82e41d2d847650ecf1a563e1c4b1c90babc47abeea96d430c963633ae8162
MD5 5efa744e1d3677131ed8d64ad1a9d07b
SHA1 6c46646e4b0823422a2e0ca3eaf82acf3d001945
SHA512 6470ed53b99f009a98947f5ba8afcd261fb8e76b3ae613337cef8221d9702911efea270418d7a3d55ae689bf21af68df86686ff265a8ea710276dcdf32852ec9
SSDEEP 12288:0aoSDaoSaaoSDaoS4aoSDaoS4aoSDaoS4aoS4aoS4aoSDaoS4aoSDaoS4aoSDaoK:L7G7t7G7e
TLSH
T1A097AF537757A50BF02A8A390A11879D5396FE328E027897B2D43E3B3C331CB6E59971
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

128.png

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir5012_858218355\CRX_INSTALL\128.png
Size 50.0MB
SHA256 fa7bf62177e2b09dcd94ae4516d64c676f0bfdc622e581c5bb2bc80838e308dc
MD5 318d08ca50c8df01a650f50071f0eabb
SHA1 665cff83dc716da9d36247f93be5fd2d8118aa38
SHA512 bad916e2c995c3c9230e72da8b4cdbbc3b60c266f05792b69bc08b53a26aa90c4acbe748fd2c6c4148f6a34657498afbc5cbe5c4dcc8e27f5a6325a43dfd7cc8
SSDEEP 12288:0aoSDaoSaaoSDaoS4aoSDaoS4aoSDaoS4aoS4aoS4aoSDaoS4aoSDaoS4aoSDaoT:L7t7G7t7G7Z
TLSH
T1B8B7AF537757A50BF02A8A390A11879D5396FE328E027897B2D43E3B3C331CB6E59971
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

128.png

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir5012_858218355\CRX_INSTALL\128.png
Size 59.9MB
SHA256 f51f221c47846b758e480d734a7cadb651b6dcf35b0454f71355f4eeeac27ba5
MD5 80fccd1e33e11e162e7f06a9df5570d4
SHA1 9cc27b903083b425907cc0f7a587370703b60412
SHA512 1ceaa24bfa76fd51498550ae3f15447c19714abbf88c9157cc678d867a5fd6cd8b5c8232fb65f4469412b86cad3c33c7cf0a55743219fcfaf396a0019b7df6e2
SSDEEP 12288:0aoSDaoSaaoSDaoS4aoSDaoS4aoSDaoS4aoS4aoS4aoSDaoS4aoSDaoS4aoSDaoP:L7G7t7G7t7G7O
TLSH
T131D7AF537757A50BF02A8A390A11879D5396FE328E027897B2D43E3B3C331CB6E59971
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

W_X_C.vbs

Path C:\Windows\W_X_C.vbs
Size 195B
SHA256 2aff5215f11225a8a0a30dd1e218f23014f0d50abc1ab6aa9af90cad4a1f810c
MD5 7fea68fcee7f2be16504995060874a11
SHA1 452097b7fb78b5b810178689a146daa245a7c7d6
SHA512 23f79bc17bd5f9983383ebc764c2f1c249116300eec95d9f94ab173f4296a62f9d6862d16d404013bf82c01b84b1d8b0f8b3ad86f503810bb71038945703f35e
TLSH
T1E2D022A266224023827261D003098005477490003132DB219188AC002133FD2807828F
MD5 SHA1 SHA512 TLSH

Submit Download

hosts.exe

Path C:\Windows\hosts.exe
Size 10.0MB
SHA256 0a1f2f984880cb6fa03a274007c99db2ab984057f6e79658ca416084e9c09f74
MD5 0b549b578f5faf87fcf8dffd1733673c
SHA1 ac815be06305335ecc5f5dd443648b0600dbd27e
SHA512 7e9674a4ab48ca8f9cfae585e78fd020a98b90b9fb863a6bb1a4e1fc8a9db1e224d67b670fec0c52dbbaf6432623461587ec9a9e00fe234f9648ccf2773a3b76
SSDEEP 12288:0aoSDaoSaaoSDaoS4aoSDaoS4aoSDaoS4aoS4aoS4aoSDaoS4aoSDaoS4aoSDaoZ:L7P
TLSH
T17AB6AF537757A50BF02A8A390A11879D5396FE328E027897B2D43E3B3C331CB6E59971
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

W_X_C.bat

Path \??\c:\windows\W_X_C.bat
Size 336B
SHA256 d2150b9e5a4ce55e140f0ca91c4e300715d42095c8fddf58c77037cdd2cfaf78
MD5 4db9f8b6175722b62ececeeeba1ce307
SHA1 3b3ba8414706e72a6fa19e884a97b87609e11e47
SHA512 1d6dc274cf7a3dd704f840e6a5ad57ab4c4e35d5f09489aeff520bb797e1c825bac53fc335156fe41e767a46520d031855fe42fe7b175409ebe5e9e986fb9b8b
TLSH
T180E07D5E45D89471DA3107CC62CABE50785342479F84B99963D98D80FECA520D09667C
MD5 SHA1 SHA512 TLSH

Submit Download

memory/816-22-0x0000000000400000-0x000000000042D000-memory.dmp

Download

memory/816-0-0x0000000000400000-0x000000000042D000-memory.dmp

Download

memory/2236-38-0x0000000000400000-0x000000000042D000-memory.dmp

Download

memory/2340-49-0x0000000000400000-0x000000000042D000-memory.dmp

Download

memory/2932-50-0x0000000000400000-0x000000000042D000-memory.dmp

Download

memory/2932-11-0x0000000000400000-0x000000000042D000-memory.dmp

Download

memory/2996-24-0x0000000000400000-0x000000000042D000-memory.dmp

Download

memory/3908-44-0x0000000000400000-0x000000000042D000-memory.dmp

Download

memory/4528-51-0x0000000000400000-0x000000000042D000-memory.dmp

Download

memory/4528-30-0x0000000000400000-0x000000000042D000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads