c68474010868fd816084220384d53167094be8569d3e987099cb562bbe79a27d

Analysis

max time kernel
27s
max time network
47s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
23-11-2022 10:12

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c68474010868fd816084220384d53167094be8569d3e987099cb562bbe79a27d.exe
Size

601KB
MD5

b9c558cc07dbc82eb4c3d055872cc56f
SHA1

a99ec3965fdceb01b031fcb4ecf970eff9339b2f
SHA256

c68474010868fd816084220384d53167094be8569d3e987099cb562bbe79a27d
SHA512

ade2032e4d4402bf09dd44766bc28361f5976f6308e4d0d7826bb1758b1692e37e176b8decd3dad0a4eb0298b8f681f90c6227f8e21715c88d77fe5093ed837d
SSDEEP

12288:BIny5DYTtJXVe38KhDYd/DvoDNv5rFqF2VLhIHM:9UTt9E38Khsd/0NvJFqmIH

Score

8^/10

discovery

Malware Config

Signatures

Drops file in Drivers directory 1 IoCs

Processes:

c68474010868fd816084220384d53167094be8569d3e987099cb562bbe79a27d.exe

description ioc process

File created C:\Windows\system32\drivers\nethfdrv.sys c68474010868fd816084220384d53167094be8569d3e987099cb562bbe79a27d.exe
Executes dropped EXE 5 IoCs

Processes:

installd.exenethtsrv.exenetupdsrv.exenethtsrv.exenetupdsrv.exe

pid process

896 installd.exe
1816 nethtsrv.exe
1528 netupdsrv.exe
964 nethtsrv.exe
1020 netupdsrv.exe

description	ioc	process
File created	C:\Windows\system32\drivers\nethfdrv.sys	c68474010868fd816084220384d53167094be8569d3e987099cb562bbe79a27d.exe

pid	process
896	installd.exe
1816	nethtsrv.exe
1528	netupdsrv.exe
964	nethtsrv.exe
1020	netupdsrv.exe

Loads dropped DLL 13 IoCs

Processes:

c68474010868fd816084220384d53167094be8569d3e987099cb562bbe79a27d.exeinstalld.exenethtsrv.exenethtsrv.exe

pid	process
1920	c68474010868fd816084220384d53167094be8569d3e987099cb562bbe79a27d.exe
1920	c68474010868fd816084220384d53167094be8569d3e987099cb562bbe79a27d.exe
1920	c68474010868fd816084220384d53167094be8569d3e987099cb562bbe79a27d.exe
1920	c68474010868fd816084220384d53167094be8569d3e987099cb562bbe79a27d.exe
896	installd.exe
1920	c68474010868fd816084220384d53167094be8569d3e987099cb562bbe79a27d.exe
1816	nethtsrv.exe
1816	nethtsrv.exe
1920	c68474010868fd816084220384d53167094be8569d3e987099cb562bbe79a27d.exe
1920	c68474010868fd816084220384d53167094be8569d3e987099cb562bbe79a27d.exe
964	nethtsrv.exe
964	nethtsrv.exe
1920	c68474010868fd816084220384d53167094be8569d3e987099cb562bbe79a27d.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in System32 directory 5 IoCs

Processes:

c68474010868fd816084220384d53167094be8569d3e987099cb562bbe79a27d.exe

description	ioc	process
File created	C:\Windows\SysWOW64\hfnapi.dll	c68474010868fd816084220384d53167094be8569d3e987099cb562bbe79a27d.exe
File created	C:\Windows\SysWOW64\hfpapi.dll	c68474010868fd816084220384d53167094be8569d3e987099cb562bbe79a27d.exe
File created	C:\Windows\SysWOW64\installd.exe	c68474010868fd816084220384d53167094be8569d3e987099cb562bbe79a27d.exe
File created	C:\Windows\SysWOW64\nethtsrv.exe	c68474010868fd816084220384d53167094be8569d3e987099cb562bbe79a27d.exe
File created	C:\Windows\SysWOW64\netupdsrv.exe	c68474010868fd816084220384d53167094be8569d3e987099cb562bbe79a27d.exe

Drops file in Program Files directory 3 IoCs

Processes:

c68474010868fd816084220384d53167094be8569d3e987099cb562bbe79a27d.exe

description	ioc	process
File created	C:\Program Files (x86)\Common Files\Config\data.xml	c68474010868fd816084220384d53167094be8569d3e987099cb562bbe79a27d.exe
File created	C:\Program Files (x86)\Common Files\Config\ver.xml	c68474010868fd816084220384d53167094be8569d3e987099cb562bbe79a27d.exe
File created	C:\Program Files (x86)\Common Files\config\uninstinethnfd.exe	c68474010868fd816084220384d53167094be8569d3e987099cb562bbe79a27d.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Runs net.exe
Suspicious behavior: LoadsDriver 1 IoCs

Processes:

pid process

460
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

nethtsrv.exe

description pid process

Token: SeDebugPrivilege 964 nethtsrv.exe

pid	process
460

description	pid	process
Token: SeDebugPrivilege	964	nethtsrv.exe

Suspicious use of WriteProcessMemory 50 IoCs

Processes:

c68474010868fd816084220384d53167094be8569d3e987099cb562bbe79a27d.exenet.exenet.exenet.exenet.exe

description	pid	process	target process
PID 1920 wrote to memory of 1896	1920	c68474010868fd816084220384d53167094be8569d3e987099cb562bbe79a27d.exe	net.exe
PID 1920 wrote to memory of 1896	1920	c68474010868fd816084220384d53167094be8569d3e987099cb562bbe79a27d.exe	net.exe
PID 1920 wrote to memory of 1896	1920	c68474010868fd816084220384d53167094be8569d3e987099cb562bbe79a27d.exe	net.exe
PID 1920 wrote to memory of 1896	1920	c68474010868fd816084220384d53167094be8569d3e987099cb562bbe79a27d.exe	net.exe
PID 1896 wrote to memory of 1964	1896	net.exe	net1.exe
PID 1896 wrote to memory of 1964	1896	net.exe	net1.exe
PID 1896 wrote to memory of 1964	1896	net.exe	net1.exe
PID 1896 wrote to memory of 1964	1896	net.exe	net1.exe
PID 1920 wrote to memory of 1480	1920	c68474010868fd816084220384d53167094be8569d3e987099cb562bbe79a27d.exe	net.exe
PID 1920 wrote to memory of 1480	1920	c68474010868fd816084220384d53167094be8569d3e987099cb562bbe79a27d.exe	net.exe
PID 1920 wrote to memory of 1480	1920	c68474010868fd816084220384d53167094be8569d3e987099cb562bbe79a27d.exe	net.exe
PID 1920 wrote to memory of 1480	1920	c68474010868fd816084220384d53167094be8569d3e987099cb562bbe79a27d.exe	net.exe
PID 1480 wrote to memory of 984	1480	net.exe	net1.exe
PID 1480 wrote to memory of 984	1480	net.exe	net1.exe
PID 1480 wrote to memory of 984	1480	net.exe	net1.exe
PID 1480 wrote to memory of 984	1480	net.exe	net1.exe
PID 1920 wrote to memory of 896	1920	c68474010868fd816084220384d53167094be8569d3e987099cb562bbe79a27d.exe	installd.exe
PID 1920 wrote to memory of 896	1920	c68474010868fd816084220384d53167094be8569d3e987099cb562bbe79a27d.exe	installd.exe
PID 1920 wrote to memory of 896	1920	c68474010868fd816084220384d53167094be8569d3e987099cb562bbe79a27d.exe	installd.exe
PID 1920 wrote to memory of 896	1920	c68474010868fd816084220384d53167094be8569d3e987099cb562bbe79a27d.exe	installd.exe
PID 1920 wrote to memory of 896	1920	c68474010868fd816084220384d53167094be8569d3e987099cb562bbe79a27d.exe	installd.exe
PID 1920 wrote to memory of 896	1920	c68474010868fd816084220384d53167094be8569d3e987099cb562bbe79a27d.exe	installd.exe
PID 1920 wrote to memory of 896	1920	c68474010868fd816084220384d53167094be8569d3e987099cb562bbe79a27d.exe	installd.exe
PID 1920 wrote to memory of 1816	1920	c68474010868fd816084220384d53167094be8569d3e987099cb562bbe79a27d.exe	nethtsrv.exe
PID 1920 wrote to memory of 1816	1920	c68474010868fd816084220384d53167094be8569d3e987099cb562bbe79a27d.exe	nethtsrv.exe
PID 1920 wrote to memory of 1816	1920	c68474010868fd816084220384d53167094be8569d3e987099cb562bbe79a27d.exe	nethtsrv.exe
PID 1920 wrote to memory of 1816	1920	c68474010868fd816084220384d53167094be8569d3e987099cb562bbe79a27d.exe	nethtsrv.exe
PID 1920 wrote to memory of 1528	1920	c68474010868fd816084220384d53167094be8569d3e987099cb562bbe79a27d.exe	netupdsrv.exe
PID 1920 wrote to memory of 1528	1920	c68474010868fd816084220384d53167094be8569d3e987099cb562bbe79a27d.exe	netupdsrv.exe
PID 1920 wrote to memory of 1528	1920	c68474010868fd816084220384d53167094be8569d3e987099cb562bbe79a27d.exe	netupdsrv.exe
PID 1920 wrote to memory of 1528	1920	c68474010868fd816084220384d53167094be8569d3e987099cb562bbe79a27d.exe	netupdsrv.exe
PID 1920 wrote to memory of 1528	1920	c68474010868fd816084220384d53167094be8569d3e987099cb562bbe79a27d.exe	netupdsrv.exe
PID 1920 wrote to memory of 1528	1920	c68474010868fd816084220384d53167094be8569d3e987099cb562bbe79a27d.exe	netupdsrv.exe
PID 1920 wrote to memory of 1528	1920	c68474010868fd816084220384d53167094be8569d3e987099cb562bbe79a27d.exe	netupdsrv.exe
PID 1920 wrote to memory of 1192	1920	c68474010868fd816084220384d53167094be8569d3e987099cb562bbe79a27d.exe	net.exe
PID 1920 wrote to memory of 1192	1920	c68474010868fd816084220384d53167094be8569d3e987099cb562bbe79a27d.exe	net.exe
PID 1920 wrote to memory of 1192	1920	c68474010868fd816084220384d53167094be8569d3e987099cb562bbe79a27d.exe	net.exe
PID 1920 wrote to memory of 1192	1920	c68474010868fd816084220384d53167094be8569d3e987099cb562bbe79a27d.exe	net.exe
PID 1192 wrote to memory of 268	1192	net.exe	net1.exe
PID 1192 wrote to memory of 268	1192	net.exe	net1.exe
PID 1192 wrote to memory of 268	1192	net.exe	net1.exe
PID 1192 wrote to memory of 268	1192	net.exe	net1.exe
PID 1920 wrote to memory of 2028	1920	c68474010868fd816084220384d53167094be8569d3e987099cb562bbe79a27d.exe	net.exe
PID 1920 wrote to memory of 2028	1920	c68474010868fd816084220384d53167094be8569d3e987099cb562bbe79a27d.exe	net.exe
PID 1920 wrote to memory of 2028	1920	c68474010868fd816084220384d53167094be8569d3e987099cb562bbe79a27d.exe	net.exe
PID 1920 wrote to memory of 2028	1920	c68474010868fd816084220384d53167094be8569d3e987099cb562bbe79a27d.exe	net.exe
PID 2028 wrote to memory of 676	2028	net.exe	net1.exe
PID 2028 wrote to memory of 676	2028	net.exe	net1.exe
PID 2028 wrote to memory of 676	2028	net.exe	net1.exe
PID 2028 wrote to memory of 676	2028	net.exe	net1.exe

C:\Users\Admin\AppData\Local\Temp\c68474010868fd816084220384d53167094be8569d3e987099cb562bbe79a27d.exe
"C:\Users\Admin\AppData\Local\Temp\c68474010868fd816084220384d53167094be8569d3e987099cb562bbe79a27d.exe"
1⤵
- Drops file in Drivers directory
- Loads dropped DLL
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:1920

C:\Windows\SysWOW64\net.exe
net stop nethttpservice
2⤵
- Suspicious use of WriteProcessMemory
PID:1896

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop nethttpservice
3⤵
PID:1964

C:\Windows\SysWOW64\net.exe
net stop serviceupdater
2⤵
- Suspicious use of WriteProcessMemory
PID:1480

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop serviceupdater
3⤵
PID:984

C:\Windows\SysWOW64\installd.exe
"C:\Windows\system32\installd.exe" nethfdrv
2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:896

C:\Windows\SysWOW64\nethtsrv.exe
"C:\Windows\system32\nethtsrv.exe" -nfdi
2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1816

C:\Windows\SysWOW64\netupdsrv.exe
"C:\Windows\system32\netupdsrv.exe" -nfdi
2⤵
- Executes dropped EXE
PID:1528

C:\Windows\SysWOW64\net.exe
net start nethttpservice
2⤵
- Suspicious use of WriteProcessMemory
PID:1192

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 start nethttpservice
3⤵
PID:268

C:\Windows\SysWOW64\net.exe
net start serviceupdater
2⤵
- Suspicious use of WriteProcessMemory
PID:2028

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 start serviceupdater
3⤵
PID:676

C:\Windows\SysWOW64\nethtsrv.exe
C:\Windows\SysWOW64\nethtsrv.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:964

C:\Windows\SysWOW64\netupdsrv.exe
C:\Windows\SysWOW64\netupdsrv.exe
1⤵
- Executes dropped EXE
PID:1020

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\hfnapi.dll
Filesize
106KB

MD5
703731e683b505b25247fd24550d4d41

SHA1
e09f664e7378d7496fb93a62a18e49d9218ac171

SHA256
13718aa4653e1ee2ea3b66905a50555d8ad7faec1a435aec2f43b1f2e2f38869

SHA512
5165746984322166ef30227167693108c6696a37acbcf3cafec04f056aab5de6bbac371fc7908dd486bb4657b3792134d3088163b2a4f54536936588cc0c6cba

Download Submit
C:\Windows\SysWOW64\hfpapi.dll
Filesize
241KB

MD5
065fb0fbec3f504e89e90b8985a3e193

SHA1
2f86f8816419629cff2888cf789f780677a1ab50

SHA256
6025ae2d45df3d45ad8928e6f5db08e4fee1a647f6efa5da983821a887a818af

SHA512
38a15efb18e73672259697d5e5ad8c0df9dd33c479c3dda08fa01ee1da2cdc90883cf771220fbf5ab8a4afc13b2a417973f82a370d5f5d412f60dab7b51f79d2

Download Submit
C:\Windows\SysWOW64\installd.exe
Filesize
108KB

MD5
5d0e3de80b3c935a209581538d47275d

SHA1
d0c91958f8fb30aeac85d5822a992b6475444677

SHA256
15b4ea64c7d22f239ae6f2d3ec8dbacdf166e2ea0e917e636b9ad3a593cf6b1f

SHA512
1e0e21a312091c4523cfb4ae21d641756f9097befcb027d550b6e931b0804c039ee766d236407d4b6156b86d00d2fc7c8dc3be1309285b79df370fbd65dafb62

Download Submit
C:\Windows\SysWOW64\nethtsrv.exe
Filesize
176KB

MD5
3c8fb3232498e946698429bed2528b7c

SHA1
554b94f228af39ff47c85849da8b324252becf1a

SHA256
8e1b63bb0365cd75e4865276a29b5758cd8b4c695c334bc5294f6467c3459cbd

SHA512
345b3143c96560ac186246f99ab27efeeff0724cd2e19e33f8b86a4a95713b9bdd4ca337e6b5d6ce5fe751facf1d8c68a9ac51659b2b5eb88e8c79bd253bbcc6

Download Submit
C:\Windows\SysWOW64\nethtsrv.exe
Filesize
176KB

MD5
3c8fb3232498e946698429bed2528b7c

SHA1
554b94f228af39ff47c85849da8b324252becf1a

SHA256
8e1b63bb0365cd75e4865276a29b5758cd8b4c695c334bc5294f6467c3459cbd

SHA512
345b3143c96560ac186246f99ab27efeeff0724cd2e19e33f8b86a4a95713b9bdd4ca337e6b5d6ce5fe751facf1d8c68a9ac51659b2b5eb88e8c79bd253bbcc6

Download Submit
C:\Windows\SysWOW64\netupdsrv.exe
Filesize
158KB

MD5
fc1ca4ead423537b923b97a2a45d2427

SHA1
7d367774a744d50bc82876c04c332c1b1a66cc8b

SHA256
b9f8c7d88e086024935a7ff079fee72f70632bfd4e4fc0f15378943e6759f500

SHA512
990c2170c0cd28cd95dc2719a23af5ebaa6f6b9171e3ba43710a39d8688157192efd5e06d6c34bf6a92b7a5c74ed0ce2d3133c4a71e0e520efd169f4f68e6926

Download Submit
C:\Windows\SysWOW64\netupdsrv.exe
Filesize
158KB

MD5
fc1ca4ead423537b923b97a2a45d2427

SHA1
7d367774a744d50bc82876c04c332c1b1a66cc8b

SHA256
b9f8c7d88e086024935a7ff079fee72f70632bfd4e4fc0f15378943e6759f500

SHA512
990c2170c0cd28cd95dc2719a23af5ebaa6f6b9171e3ba43710a39d8688157192efd5e06d6c34bf6a92b7a5c74ed0ce2d3133c4a71e0e520efd169f4f68e6926

Download Submit
\Users\Admin\AppData\Local\Temp\nsoA306.tmp\System.dll
Filesize
11KB

MD5
c17103ae9072a06da581dec998343fc1

SHA1
b72148c6bdfaada8b8c3f950e610ee7cf1da1f8d

SHA256
dc58d8ad81cacb0c1ed72e33bff8f23ea40b5252b5bb55d393a0903e6819ae2f

SHA512
d32a71aaef18e993f28096d536e41c4d016850721b31171513ce28bbd805a54fd290b7c3e9d935f72e676a1acfb4f0dcc89d95040a0dd29f2b6975855c18986f

Download Submit
\Users\Admin\AppData\Local\Temp\nsoA306.tmp\nsExec.dll
Filesize
6KB

MD5
acc2b699edfea5bf5aae45aba3a41e96

SHA1
d2accf4d494e43ceb2cff69abe4dd17147d29cc2

SHA256
168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e

SHA512
e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe

Download Submit
\Users\Admin\AppData\Local\Temp\nsoA306.tmp\nsExec.dll
Filesize
6KB

MD5
acc2b699edfea5bf5aae45aba3a41e96

SHA1
d2accf4d494e43ceb2cff69abe4dd17147d29cc2

SHA256
168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e

SHA512
e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe

Download Submit
\Users\Admin\AppData\Local\Temp\nsoA306.tmp\nsExec.dll
Filesize
6KB

MD5
acc2b699edfea5bf5aae45aba3a41e96

SHA1
d2accf4d494e43ceb2cff69abe4dd17147d29cc2

SHA256
168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e

SHA512
e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe

Download Submit
\Users\Admin\AppData\Local\Temp\nsoA306.tmp\nsExec.dll
Filesize
6KB

MD5
acc2b699edfea5bf5aae45aba3a41e96

SHA1
d2accf4d494e43ceb2cff69abe4dd17147d29cc2

SHA256
168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e

SHA512
e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe

Download Submit
\Windows\SysWOW64\hfnapi.dll
Filesize
106KB

MD5
703731e683b505b25247fd24550d4d41

SHA1
e09f664e7378d7496fb93a62a18e49d9218ac171

SHA256
13718aa4653e1ee2ea3b66905a50555d8ad7faec1a435aec2f43b1f2e2f38869

SHA512
5165746984322166ef30227167693108c6696a37acbcf3cafec04f056aab5de6bbac371fc7908dd486bb4657b3792134d3088163b2a4f54536936588cc0c6cba

Download Submit
\Windows\SysWOW64\hfnapi.dll
Filesize
106KB

MD5
703731e683b505b25247fd24550d4d41

SHA1
e09f664e7378d7496fb93a62a18e49d9218ac171

SHA256
13718aa4653e1ee2ea3b66905a50555d8ad7faec1a435aec2f43b1f2e2f38869

SHA512
5165746984322166ef30227167693108c6696a37acbcf3cafec04f056aab5de6bbac371fc7908dd486bb4657b3792134d3088163b2a4f54536936588cc0c6cba

Download Submit
\Windows\SysWOW64\hfnapi.dll
Filesize
106KB

MD5
703731e683b505b25247fd24550d4d41

SHA1
e09f664e7378d7496fb93a62a18e49d9218ac171

SHA256
13718aa4653e1ee2ea3b66905a50555d8ad7faec1a435aec2f43b1f2e2f38869

SHA512
5165746984322166ef30227167693108c6696a37acbcf3cafec04f056aab5de6bbac371fc7908dd486bb4657b3792134d3088163b2a4f54536936588cc0c6cba

Download Submit
\Windows\SysWOW64\hfpapi.dll
Filesize
241KB

MD5
065fb0fbec3f504e89e90b8985a3e193

SHA1
2f86f8816419629cff2888cf789f780677a1ab50

SHA256
6025ae2d45df3d45ad8928e6f5db08e4fee1a647f6efa5da983821a887a818af

SHA512
38a15efb18e73672259697d5e5ad8c0df9dd33c479c3dda08fa01ee1da2cdc90883cf771220fbf5ab8a4afc13b2a417973f82a370d5f5d412f60dab7b51f79d2

Download Submit
\Windows\SysWOW64\hfpapi.dll
Filesize
241KB

MD5
065fb0fbec3f504e89e90b8985a3e193

SHA1
2f86f8816419629cff2888cf789f780677a1ab50

SHA256
6025ae2d45df3d45ad8928e6f5db08e4fee1a647f6efa5da983821a887a818af

SHA512
38a15efb18e73672259697d5e5ad8c0df9dd33c479c3dda08fa01ee1da2cdc90883cf771220fbf5ab8a4afc13b2a417973f82a370d5f5d412f60dab7b51f79d2

Download Submit
\Windows\SysWOW64\installd.exe
Filesize
108KB

MD5
5d0e3de80b3c935a209581538d47275d

SHA1
d0c91958f8fb30aeac85d5822a992b6475444677

SHA256
15b4ea64c7d22f239ae6f2d3ec8dbacdf166e2ea0e917e636b9ad3a593cf6b1f

SHA512
1e0e21a312091c4523cfb4ae21d641756f9097befcb027d550b6e931b0804c039ee766d236407d4b6156b86d00d2fc7c8dc3be1309285b79df370fbd65dafb62

Download Submit
\Windows\SysWOW64\nethtsrv.exe
Filesize
176KB

MD5
3c8fb3232498e946698429bed2528b7c

SHA1
554b94f228af39ff47c85849da8b324252becf1a

SHA256
8e1b63bb0365cd75e4865276a29b5758cd8b4c695c334bc5294f6467c3459cbd

SHA512
345b3143c96560ac186246f99ab27efeeff0724cd2e19e33f8b86a4a95713b9bdd4ca337e6b5d6ce5fe751facf1d8c68a9ac51659b2b5eb88e8c79bd253bbcc6

Download Submit
\Windows\SysWOW64\netupdsrv.exe
Filesize
158KB

MD5
fc1ca4ead423537b923b97a2a45d2427

SHA1
7d367774a744d50bc82876c04c332c1b1a66cc8b

SHA256
b9f8c7d88e086024935a7ff079fee72f70632bfd4e4fc0f15378943e6759f500

SHA512
990c2170c0cd28cd95dc2719a23af5ebaa6f6b9171e3ba43710a39d8688157192efd5e06d6c34bf6a92b7a5c74ed0ce2d3133c4a71e0e520efd169f4f68e6926

Download Submit
memory/268-82-0x0000000000000000-mapping.dmp

Download
memory/676-88-0x0000000000000000-mapping.dmp

Download
memory/896-64-0x0000000000000000-mapping.dmp

Download
memory/984-62-0x0000000000000000-mapping.dmp

Download
memory/1192-81-0x0000000000000000-mapping.dmp

Download
memory/1480-61-0x0000000000000000-mapping.dmp

Download
memory/1528-77-0x0000000000000000-mapping.dmp

Download
memory/1816-70-0x0000000000000000-mapping.dmp

Download
memory/1896-57-0x0000000000000000-mapping.dmp

Download
memory/1920-54-0x0000000076121000-0x0000000076123000-memory.dmp

Filesize
8KB

Download
memory/1920-59-0x0000000000360000-0x00000000007BE000-memory.dmp

Filesize
4.4MB

Download
memory/1920-75-0x0000000000360000-0x00000000007BE000-memory.dmp

Filesize
4.4MB

Download
memory/1920-91-0x0000000000360000-0x00000000007BE000-memory.dmp

Filesize
4.4MB

Download
memory/1964-58-0x0000000000000000-mapping.dmp

Download
memory/2028-87-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads