c0255d311c6857028a81b7eb3237840c8d5e1cbaee46c2fe2bba9393de963ad8

Analysis

max time kernel
17s
max time network
2s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
23-11-2022 10:13

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c0255d311c6857028a81b7eb3237840c8d5e1cbaee46c2fe2bba9393de963ad8.exe
Size

602KB
MD5

45401d6435f0af5828a279b9b7ced000
SHA1

d9efd4a916cf225b2fb42c5e67244aa24950e320
SHA256

c0255d311c6857028a81b7eb3237840c8d5e1cbaee46c2fe2bba9393de963ad8
SHA512

3fadc340e42fc5c54495814fc8f617dec9fa6557e5e0229bec7a0c32b4d9f1bbf663f3e4a7b96f95454da266de42be60f9e3d2f359f73349a8678fa25b3bb5f2
SSDEEP

12288:1Iny5DYTZIujTagHMPuoARK/AjlWxCUNilGN39Zoi11cd0+L:BUTZJjxMGonwlHUN6eJ1L+

Score

8^/10

discovery

Malware Config

Signatures

Drops file in Drivers directory 1 IoCs

Processes:

c0255d311c6857028a81b7eb3237840c8d5e1cbaee46c2fe2bba9393de963ad8.exe

description ioc process

File created C:\Windows\system32\drivers\nethfdrv.sys c0255d311c6857028a81b7eb3237840c8d5e1cbaee46c2fe2bba9393de963ad8.exe
Executes dropped EXE 5 IoCs

Processes:

installd.exenethtsrv.exenetupdsrv.exenethtsrv.exenetupdsrv.exe

pid process

1660 installd.exe
1520 nethtsrv.exe
5040 netupdsrv.exe
3876 nethtsrv.exe
5008 netupdsrv.exe

description	ioc	process
File created	C:\Windows\system32\drivers\nethfdrv.sys	c0255d311c6857028a81b7eb3237840c8d5e1cbaee46c2fe2bba9393de963ad8.exe

pid	process
1660	installd.exe
1520	nethtsrv.exe
5040	netupdsrv.exe
3876	nethtsrv.exe
5008	netupdsrv.exe

Loads dropped DLL 14 IoCs

Processes:

c0255d311c6857028a81b7eb3237840c8d5e1cbaee46c2fe2bba9393de963ad8.exeinstalld.exenethtsrv.exenethtsrv.exe

pid	process
1152	c0255d311c6857028a81b7eb3237840c8d5e1cbaee46c2fe2bba9393de963ad8.exe
1152	c0255d311c6857028a81b7eb3237840c8d5e1cbaee46c2fe2bba9393de963ad8.exe
1152	c0255d311c6857028a81b7eb3237840c8d5e1cbaee46c2fe2bba9393de963ad8.exe
1152	c0255d311c6857028a81b7eb3237840c8d5e1cbaee46c2fe2bba9393de963ad8.exe
1152	c0255d311c6857028a81b7eb3237840c8d5e1cbaee46c2fe2bba9393de963ad8.exe
1660	installd.exe
1520	nethtsrv.exe
1520	nethtsrv.exe
1152	c0255d311c6857028a81b7eb3237840c8d5e1cbaee46c2fe2bba9393de963ad8.exe
1152	c0255d311c6857028a81b7eb3237840c8d5e1cbaee46c2fe2bba9393de963ad8.exe
3876	nethtsrv.exe
3876	nethtsrv.exe
1152	c0255d311c6857028a81b7eb3237840c8d5e1cbaee46c2fe2bba9393de963ad8.exe
1152	c0255d311c6857028a81b7eb3237840c8d5e1cbaee46c2fe2bba9393de963ad8.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in System32 directory 5 IoCs

Processes:

c0255d311c6857028a81b7eb3237840c8d5e1cbaee46c2fe2bba9393de963ad8.exe

description	ioc	process
File created	C:\Windows\SysWOW64\nethtsrv.exe	c0255d311c6857028a81b7eb3237840c8d5e1cbaee46c2fe2bba9393de963ad8.exe
File created	C:\Windows\SysWOW64\netupdsrv.exe	c0255d311c6857028a81b7eb3237840c8d5e1cbaee46c2fe2bba9393de963ad8.exe
File created	C:\Windows\SysWOW64\hfnapi.dll	c0255d311c6857028a81b7eb3237840c8d5e1cbaee46c2fe2bba9393de963ad8.exe
File created	C:\Windows\SysWOW64\hfpapi.dll	c0255d311c6857028a81b7eb3237840c8d5e1cbaee46c2fe2bba9393de963ad8.exe
File created	C:\Windows\SysWOW64\installd.exe	c0255d311c6857028a81b7eb3237840c8d5e1cbaee46c2fe2bba9393de963ad8.exe

Drops file in Program Files directory 3 IoCs

Processes:

c0255d311c6857028a81b7eb3237840c8d5e1cbaee46c2fe2bba9393de963ad8.exe

description	ioc	process
File created	C:\Program Files (x86)\Common Files\Config\data.xml	c0255d311c6857028a81b7eb3237840c8d5e1cbaee46c2fe2bba9393de963ad8.exe
File created	C:\Program Files (x86)\Common Files\Config\ver.xml	c0255d311c6857028a81b7eb3237840c8d5e1cbaee46c2fe2bba9393de963ad8.exe
File created	C:\Program Files (x86)\Common Files\config\uninstinethnfd.exe	c0255d311c6857028a81b7eb3237840c8d5e1cbaee46c2fe2bba9393de963ad8.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Modifies data under HKEY_USERS 1 IoCs

Processes:

nethtsrv.exe

description ioc process

Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections nethtsrv.exe
Runs net.exe
Suspicious behavior: LoadsDriver 1 IoCs

Processes:

pid process

648
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

nethtsrv.exe

description pid process

Token: SeDebugPrivilege 3876 nethtsrv.exe

description	ioc	process
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	nethtsrv.exe

pid	process
648

description	pid	process
Token: SeDebugPrivilege	3876	nethtsrv.exe

Suspicious use of WriteProcessMemory 33 IoCs

Processes:

c0255d311c6857028a81b7eb3237840c8d5e1cbaee46c2fe2bba9393de963ad8.exenet.exenet.exenet.exenet.exe

description	pid	process	target process
PID 1152 wrote to memory of 2660	1152	c0255d311c6857028a81b7eb3237840c8d5e1cbaee46c2fe2bba9393de963ad8.exe	net.exe
PID 1152 wrote to memory of 2660	1152	c0255d311c6857028a81b7eb3237840c8d5e1cbaee46c2fe2bba9393de963ad8.exe	net.exe
PID 1152 wrote to memory of 2660	1152	c0255d311c6857028a81b7eb3237840c8d5e1cbaee46c2fe2bba9393de963ad8.exe	net.exe
PID 2660 wrote to memory of 1996	2660	net.exe	net1.exe
PID 2660 wrote to memory of 1996	2660	net.exe	net1.exe
PID 2660 wrote to memory of 1996	2660	net.exe	net1.exe
PID 1152 wrote to memory of 3560	1152	c0255d311c6857028a81b7eb3237840c8d5e1cbaee46c2fe2bba9393de963ad8.exe	net.exe
PID 1152 wrote to memory of 3560	1152	c0255d311c6857028a81b7eb3237840c8d5e1cbaee46c2fe2bba9393de963ad8.exe	net.exe
PID 1152 wrote to memory of 3560	1152	c0255d311c6857028a81b7eb3237840c8d5e1cbaee46c2fe2bba9393de963ad8.exe	net.exe
PID 3560 wrote to memory of 1196	3560	net.exe	net1.exe
PID 3560 wrote to memory of 1196	3560	net.exe	net1.exe
PID 3560 wrote to memory of 1196	3560	net.exe	net1.exe
PID 1152 wrote to memory of 1660	1152	c0255d311c6857028a81b7eb3237840c8d5e1cbaee46c2fe2bba9393de963ad8.exe	installd.exe
PID 1152 wrote to memory of 1660	1152	c0255d311c6857028a81b7eb3237840c8d5e1cbaee46c2fe2bba9393de963ad8.exe	installd.exe
PID 1152 wrote to memory of 1660	1152	c0255d311c6857028a81b7eb3237840c8d5e1cbaee46c2fe2bba9393de963ad8.exe	installd.exe
PID 1152 wrote to memory of 1520	1152	c0255d311c6857028a81b7eb3237840c8d5e1cbaee46c2fe2bba9393de963ad8.exe	nethtsrv.exe
PID 1152 wrote to memory of 1520	1152	c0255d311c6857028a81b7eb3237840c8d5e1cbaee46c2fe2bba9393de963ad8.exe	nethtsrv.exe
PID 1152 wrote to memory of 1520	1152	c0255d311c6857028a81b7eb3237840c8d5e1cbaee46c2fe2bba9393de963ad8.exe	nethtsrv.exe
PID 1152 wrote to memory of 5040	1152	c0255d311c6857028a81b7eb3237840c8d5e1cbaee46c2fe2bba9393de963ad8.exe	netupdsrv.exe
PID 1152 wrote to memory of 5040	1152	c0255d311c6857028a81b7eb3237840c8d5e1cbaee46c2fe2bba9393de963ad8.exe	netupdsrv.exe
PID 1152 wrote to memory of 5040	1152	c0255d311c6857028a81b7eb3237840c8d5e1cbaee46c2fe2bba9393de963ad8.exe	netupdsrv.exe
PID 1152 wrote to memory of 2476	1152	c0255d311c6857028a81b7eb3237840c8d5e1cbaee46c2fe2bba9393de963ad8.exe	net.exe
PID 1152 wrote to memory of 2476	1152	c0255d311c6857028a81b7eb3237840c8d5e1cbaee46c2fe2bba9393de963ad8.exe	net.exe
PID 1152 wrote to memory of 2476	1152	c0255d311c6857028a81b7eb3237840c8d5e1cbaee46c2fe2bba9393de963ad8.exe	net.exe
PID 2476 wrote to memory of 4888	2476	net.exe	net1.exe
PID 2476 wrote to memory of 4888	2476	net.exe	net1.exe
PID 2476 wrote to memory of 4888	2476	net.exe	net1.exe
PID 1152 wrote to memory of 4300	1152	c0255d311c6857028a81b7eb3237840c8d5e1cbaee46c2fe2bba9393de963ad8.exe	net.exe
PID 1152 wrote to memory of 4300	1152	c0255d311c6857028a81b7eb3237840c8d5e1cbaee46c2fe2bba9393de963ad8.exe	net.exe
PID 1152 wrote to memory of 4300	1152	c0255d311c6857028a81b7eb3237840c8d5e1cbaee46c2fe2bba9393de963ad8.exe	net.exe
PID 4300 wrote to memory of 4932	4300	net.exe	net1.exe
PID 4300 wrote to memory of 4932	4300	net.exe	net1.exe
PID 4300 wrote to memory of 4932	4300	net.exe	net1.exe

C:\Users\Admin\AppData\Local\Temp\c0255d311c6857028a81b7eb3237840c8d5e1cbaee46c2fe2bba9393de963ad8.exe
"C:\Users\Admin\AppData\Local\Temp\c0255d311c6857028a81b7eb3237840c8d5e1cbaee46c2fe2bba9393de963ad8.exe"
1⤵
- Drops file in Drivers directory
- Loads dropped DLL
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:1152

C:\Windows\SysWOW64\net.exe
net stop nethttpservice
2⤵
- Suspicious use of WriteProcessMemory
PID:2660

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop nethttpservice
3⤵
PID:1996

C:\Windows\SysWOW64\net.exe
net stop serviceupdater
2⤵
- Suspicious use of WriteProcessMemory
PID:3560

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop serviceupdater
3⤵
PID:1196

C:\Windows\SysWOW64\installd.exe
"C:\Windows\system32\installd.exe" nethfdrv
2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1660

C:\Windows\SysWOW64\nethtsrv.exe
"C:\Windows\system32\nethtsrv.exe" -nfdi
2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1520

C:\Windows\SysWOW64\netupdsrv.exe
"C:\Windows\system32\netupdsrv.exe" -nfdi
2⤵
- Executes dropped EXE
PID:5040

C:\Windows\SysWOW64\net.exe
net start nethttpservice
2⤵
- Suspicious use of WriteProcessMemory
PID:2476

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 start nethttpservice
3⤵
PID:4888

C:\Windows\SysWOW64\net.exe
net start serviceupdater
2⤵
- Suspicious use of WriteProcessMemory
PID:4300

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 start serviceupdater
3⤵
PID:4932

C:\Windows\SysWOW64\nethtsrv.exe
C:\Windows\SysWOW64\nethtsrv.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:3876

C:\Windows\SysWOW64\netupdsrv.exe
C:\Windows\SysWOW64\netupdsrv.exe
1⤵
- Executes dropped EXE
PID:5008

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\nswFEF8.tmp\System.dll
Filesize
11KB

MD5
c17103ae9072a06da581dec998343fc1

SHA1
b72148c6bdfaada8b8c3f950e610ee7cf1da1f8d

SHA256
dc58d8ad81cacb0c1ed72e33bff8f23ea40b5252b5bb55d393a0903e6819ae2f

SHA512
d32a71aaef18e993f28096d536e41c4d016850721b31171513ce28bbd805a54fd290b7c3e9d935f72e676a1acfb4f0dcc89d95040a0dd29f2b6975855c18986f

Download Submit
C:\Users\Admin\AppData\Local\Temp\nswFEF8.tmp\nsExec.dll
Filesize
6KB

MD5
acc2b699edfea5bf5aae45aba3a41e96

SHA1
d2accf4d494e43ceb2cff69abe4dd17147d29cc2

SHA256
168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e

SHA512
e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe

Download Submit
C:\Users\Admin\AppData\Local\Temp\nswFEF8.tmp\nsExec.dll
Filesize
6KB

MD5
acc2b699edfea5bf5aae45aba3a41e96

SHA1
d2accf4d494e43ceb2cff69abe4dd17147d29cc2

SHA256
168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e

SHA512
e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe

Download Submit
C:\Users\Admin\AppData\Local\Temp\nswFEF8.tmp\nsExec.dll
Filesize
6KB

MD5
acc2b699edfea5bf5aae45aba3a41e96

SHA1
d2accf4d494e43ceb2cff69abe4dd17147d29cc2

SHA256
168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e

SHA512
e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe

Download Submit
C:\Users\Admin\AppData\Local\Temp\nswFEF8.tmp\nsExec.dll
Filesize
6KB

MD5
acc2b699edfea5bf5aae45aba3a41e96

SHA1
d2accf4d494e43ceb2cff69abe4dd17147d29cc2

SHA256
168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e

SHA512
e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe

Download Submit
C:\Users\Admin\AppData\Local\Temp\nswFEF8.tmp\nsExec.dll
Filesize
6KB

MD5
acc2b699edfea5bf5aae45aba3a41e96

SHA1
d2accf4d494e43ceb2cff69abe4dd17147d29cc2

SHA256
168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e

SHA512
e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe

Download Submit
C:\Users\Admin\AppData\Local\Temp\nswFEF8.tmp\nsExec.dll
Filesize
6KB

MD5
acc2b699edfea5bf5aae45aba3a41e96

SHA1
d2accf4d494e43ceb2cff69abe4dd17147d29cc2

SHA256
168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e

SHA512
e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe

Download Submit
C:\Users\Admin\AppData\Local\Temp\nswFEF8.tmp\nsExec.dll
Filesize
6KB

MD5
acc2b699edfea5bf5aae45aba3a41e96

SHA1
d2accf4d494e43ceb2cff69abe4dd17147d29cc2

SHA256
168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e

SHA512
e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe

Download Submit
C:\Users\Admin\AppData\Local\Temp\nswFEF8.tmp\nsExec.dll
Filesize
6KB

MD5
acc2b699edfea5bf5aae45aba3a41e96

SHA1
d2accf4d494e43ceb2cff69abe4dd17147d29cc2

SHA256
168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e

SHA512
e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe

Download Submit
C:\Windows\SysWOW64\hfnapi.dll
Filesize
106KB

MD5
9ae3b1d90b2faa2a9b937499702ab515

SHA1
99a6a8a7016facdc642ebe46b84befa12a8cc918

SHA256
abb6c10bdd442b4118b054da977fab616eebff884385aaeb211fd00f1913310d

SHA512
96a001e3107527e59cf5727cc2719838c6f478c661b98b68ce005e995532fb8f7ed674e6618bfae9b4f6b32a3ff8864843645a544c5c970bb02e3a0a52476534

Download Submit
C:\Windows\SysWOW64\hfnapi.dll
Filesize
106KB

MD5
9ae3b1d90b2faa2a9b937499702ab515

SHA1
99a6a8a7016facdc642ebe46b84befa12a8cc918

SHA256
abb6c10bdd442b4118b054da977fab616eebff884385aaeb211fd00f1913310d

SHA512
96a001e3107527e59cf5727cc2719838c6f478c661b98b68ce005e995532fb8f7ed674e6618bfae9b4f6b32a3ff8864843645a544c5c970bb02e3a0a52476534

Download Submit
C:\Windows\SysWOW64\hfnapi.dll
Filesize
106KB

MD5
9ae3b1d90b2faa2a9b937499702ab515

SHA1
99a6a8a7016facdc642ebe46b84befa12a8cc918

SHA256
abb6c10bdd442b4118b054da977fab616eebff884385aaeb211fd00f1913310d

SHA512
96a001e3107527e59cf5727cc2719838c6f478c661b98b68ce005e995532fb8f7ed674e6618bfae9b4f6b32a3ff8864843645a544c5c970bb02e3a0a52476534

Download Submit
C:\Windows\SysWOW64\hfnapi.dll
Filesize
106KB

MD5
9ae3b1d90b2faa2a9b937499702ab515

SHA1
99a6a8a7016facdc642ebe46b84befa12a8cc918

SHA256
abb6c10bdd442b4118b054da977fab616eebff884385aaeb211fd00f1913310d

SHA512
96a001e3107527e59cf5727cc2719838c6f478c661b98b68ce005e995532fb8f7ed674e6618bfae9b4f6b32a3ff8864843645a544c5c970bb02e3a0a52476534

Download Submit
C:\Windows\SysWOW64\hfpapi.dll
Filesize
244KB

MD5
c06cdf10963437f5c897c62362902971

SHA1
795b9b6c298b0ead39c3ccabe4b943ce03b113b3

SHA256
1d51107c38a163cef3300dbb2013e348c851a8bf9c44256365e0815034aa3bff

SHA512
8aabff1b4fa2c4007c68f7da58d87fa5a49669889c89553d1cd89d6c34ace210020a063b801185012bff206ddbb9f82fe25c8d09c23dc78721f2aeaeaf0b042f

Download Submit
C:\Windows\SysWOW64\hfpapi.dll
Filesize
244KB

MD5
c06cdf10963437f5c897c62362902971

SHA1
795b9b6c298b0ead39c3ccabe4b943ce03b113b3

SHA256
1d51107c38a163cef3300dbb2013e348c851a8bf9c44256365e0815034aa3bff

SHA512
8aabff1b4fa2c4007c68f7da58d87fa5a49669889c89553d1cd89d6c34ace210020a063b801185012bff206ddbb9f82fe25c8d09c23dc78721f2aeaeaf0b042f

Download Submit
C:\Windows\SysWOW64\hfpapi.dll
Filesize
244KB

MD5
c06cdf10963437f5c897c62362902971

SHA1
795b9b6c298b0ead39c3ccabe4b943ce03b113b3

SHA256
1d51107c38a163cef3300dbb2013e348c851a8bf9c44256365e0815034aa3bff

SHA512
8aabff1b4fa2c4007c68f7da58d87fa5a49669889c89553d1cd89d6c34ace210020a063b801185012bff206ddbb9f82fe25c8d09c23dc78721f2aeaeaf0b042f

Download Submit
C:\Windows\SysWOW64\installd.exe
Filesize
108KB

MD5
3c8f3131fdd2e316e6ac30fd24c92802

SHA1
4521d21222c516c14b426aaa4514446ac75e20fa

SHA256
660ad0a7f4e88b381da6c37f9000b98c070ce753def77f030c4daa17ee168fd4

SHA512
8d491dc0dcbf87e4e6e2b8c2e56a281e5f5dfc067ef661ff31c9b7cdcedc9963a93d921de9c6ae5c19cfa12f1a2dc436ea2fa940d39127dce6f1a356b14c59be

Download Submit
C:\Windows\SysWOW64\installd.exe
Filesize
108KB

MD5
3c8f3131fdd2e316e6ac30fd24c92802

SHA1
4521d21222c516c14b426aaa4514446ac75e20fa

SHA256
660ad0a7f4e88b381da6c37f9000b98c070ce753def77f030c4daa17ee168fd4

SHA512
8d491dc0dcbf87e4e6e2b8c2e56a281e5f5dfc067ef661ff31c9b7cdcedc9963a93d921de9c6ae5c19cfa12f1a2dc436ea2fa940d39127dce6f1a356b14c59be

Download Submit
C:\Windows\SysWOW64\nethtsrv.exe
Filesize
176KB

MD5
22837be03d5cf8ef2a8775defcce7a3c

SHA1
8f8b4ea5f19862fb1f6985c70bc01c5fd6673061

SHA256
9ea2395f8b1acc61f66ab8938e66b494492ffaedc088fdc4892f2b296852fd99

SHA512
bf9a87c4f7bf747c3f3f67b92149f0ee10e03ef91c69b38f0bad986fcc4fdc58f4daf5a42427249b77eb18af7ec33b028668ded3c75ca6f40b6b3e6ad56af7c5

Download Submit
C:\Windows\SysWOW64\nethtsrv.exe
Filesize
176KB

MD5
22837be03d5cf8ef2a8775defcce7a3c

SHA1
8f8b4ea5f19862fb1f6985c70bc01c5fd6673061

SHA256
9ea2395f8b1acc61f66ab8938e66b494492ffaedc088fdc4892f2b296852fd99

SHA512
bf9a87c4f7bf747c3f3f67b92149f0ee10e03ef91c69b38f0bad986fcc4fdc58f4daf5a42427249b77eb18af7ec33b028668ded3c75ca6f40b6b3e6ad56af7c5

Download Submit
C:\Windows\SysWOW64\nethtsrv.exe
Filesize
176KB

MD5
22837be03d5cf8ef2a8775defcce7a3c

SHA1
8f8b4ea5f19862fb1f6985c70bc01c5fd6673061

SHA256
9ea2395f8b1acc61f66ab8938e66b494492ffaedc088fdc4892f2b296852fd99

SHA512
bf9a87c4f7bf747c3f3f67b92149f0ee10e03ef91c69b38f0bad986fcc4fdc58f4daf5a42427249b77eb18af7ec33b028668ded3c75ca6f40b6b3e6ad56af7c5

Download Submit
C:\Windows\SysWOW64\netupdsrv.exe
Filesize
158KB

MD5
941ebf6a2bbeb4b420ce13c32eadab96

SHA1
57c142875ffad7608a056fef137bf271aafb6435

SHA256
c7454f3596bc03650540f505cd31fac3c370c7417c348049f1a5b7fb1da1cdd9

SHA512
223e5f51b74ed37e7dc24d4d9442b47d68658cb171097f012dda73f9367bc3a79bc910f90965fbe2bd2836d67d4609bdcbff3e90bb87a6f21f411844c35604f3

Download Submit
C:\Windows\SysWOW64\netupdsrv.exe
Filesize
158KB

MD5
941ebf6a2bbeb4b420ce13c32eadab96

SHA1
57c142875ffad7608a056fef137bf271aafb6435

SHA256
c7454f3596bc03650540f505cd31fac3c370c7417c348049f1a5b7fb1da1cdd9

SHA512
223e5f51b74ed37e7dc24d4d9442b47d68658cb171097f012dda73f9367bc3a79bc910f90965fbe2bd2836d67d4609bdcbff3e90bb87a6f21f411844c35604f3

Download Submit
C:\Windows\SysWOW64\netupdsrv.exe
Filesize
158KB

MD5
941ebf6a2bbeb4b420ce13c32eadab96

SHA1
57c142875ffad7608a056fef137bf271aafb6435

SHA256
c7454f3596bc03650540f505cd31fac3c370c7417c348049f1a5b7fb1da1cdd9

SHA512
223e5f51b74ed37e7dc24d4d9442b47d68658cb171097f012dda73f9367bc3a79bc910f90965fbe2bd2836d67d4609bdcbff3e90bb87a6f21f411844c35604f3

Download Submit
memory/1152-132-0x0000000000360000-0x00000000007BE000-memory.dmp

Filesize
4.4MB

Download
memory/1152-168-0x0000000000360000-0x00000000007BE000-memory.dmp

Filesize
4.4MB

Download
memory/1196-141-0x0000000000000000-mapping.dmp

Download
memory/1520-147-0x0000000000000000-mapping.dmp

Download
memory/1660-142-0x0000000000000000-mapping.dmp

Download
memory/1996-137-0x0000000000000000-mapping.dmp

Download
memory/2476-158-0x0000000000000000-mapping.dmp

Download
memory/2660-136-0x0000000000000000-mapping.dmp

Download
memory/3560-140-0x0000000000000000-mapping.dmp

Download
memory/4300-165-0x0000000000000000-mapping.dmp

Download
memory/4888-159-0x0000000000000000-mapping.dmp

Download
memory/4932-166-0x0000000000000000-mapping.dmp

Download
memory/5040-153-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads