22d808f824182cd852e51364fcd874882662cff07a73fa315fe01d54e18eca36

Analysis

max time kernel
92s
max time network
29s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
23-11-2022 10:59

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

22d808f824182cd852e51364fcd874882662cff07a73fa315fe01d54e18eca36.exe
Size

445KB
MD5

3d7d08bd7086c0feb0f7a9b6472a9c14
SHA1

2548ef5b847f24226f5bd214a447e7655ad37eda
SHA256

22d808f824182cd852e51364fcd874882662cff07a73fa315fe01d54e18eca36
SHA512

ac2de0c81e584318c3e394809519904d98fa8ebb394a8105991890bcfbdd1c764d80f9e4b7a0de135d6f922713e913a8a1b4f9cb5943cba07a24d226f567df59
SSDEEP

12288:LleMi6iMNOcgNvROVMs4183/Qrmax2LpV1BfoPXvvC:LoMJNORNvROVMx1HxkpVjwvvvC

Score

8^/10

discovery

Malware Config

Signatures

Drops file in Drivers directory 1 IoCs

Processes:

22d808f824182cd852e51364fcd874882662cff07a73fa315fe01d54e18eca36.exe

description ioc process

File created C:\Windows\system32\drivers\nethfdrv.sys 22d808f824182cd852e51364fcd874882662cff07a73fa315fe01d54e18eca36.exe
Executes dropped EXE 5 IoCs

Processes:

installd.exenethtsrv.exenetupdsrv.exenethtsrv.exenetupdsrv.exe

pid process

1860 installd.exe
1640 nethtsrv.exe
1724 netupdsrv.exe
1364 nethtsrv.exe
1756 netupdsrv.exe

description	ioc	process
File created	C:\Windows\system32\drivers\nethfdrv.sys	22d808f824182cd852e51364fcd874882662cff07a73fa315fe01d54e18eca36.exe

pid	process
1860	installd.exe
1640	nethtsrv.exe
1724	netupdsrv.exe
1364	nethtsrv.exe
1756	netupdsrv.exe

Loads dropped DLL 13 IoCs

Processes:

22d808f824182cd852e51364fcd874882662cff07a73fa315fe01d54e18eca36.exeinstalld.exenethtsrv.exenethtsrv.exe

pid	process
1452	22d808f824182cd852e51364fcd874882662cff07a73fa315fe01d54e18eca36.exe
1452	22d808f824182cd852e51364fcd874882662cff07a73fa315fe01d54e18eca36.exe
1452	22d808f824182cd852e51364fcd874882662cff07a73fa315fe01d54e18eca36.exe
1452	22d808f824182cd852e51364fcd874882662cff07a73fa315fe01d54e18eca36.exe
1860	installd.exe
1452	22d808f824182cd852e51364fcd874882662cff07a73fa315fe01d54e18eca36.exe
1640	nethtsrv.exe
1640	nethtsrv.exe
1452	22d808f824182cd852e51364fcd874882662cff07a73fa315fe01d54e18eca36.exe
1452	22d808f824182cd852e51364fcd874882662cff07a73fa315fe01d54e18eca36.exe
1364	nethtsrv.exe
1364	nethtsrv.exe
1452	22d808f824182cd852e51364fcd874882662cff07a73fa315fe01d54e18eca36.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in System32 directory 5 IoCs

Processes:

22d808f824182cd852e51364fcd874882662cff07a73fa315fe01d54e18eca36.exe

description	ioc	process
File created	C:\Windows\SysWOW64\nethtsrv.exe	22d808f824182cd852e51364fcd874882662cff07a73fa315fe01d54e18eca36.exe
File created	C:\Windows\SysWOW64\netupdsrv.exe	22d808f824182cd852e51364fcd874882662cff07a73fa315fe01d54e18eca36.exe
File created	C:\Windows\SysWOW64\hfnapi.dll	22d808f824182cd852e51364fcd874882662cff07a73fa315fe01d54e18eca36.exe
File created	C:\Windows\SysWOW64\hfpapi.dll	22d808f824182cd852e51364fcd874882662cff07a73fa315fe01d54e18eca36.exe
File created	C:\Windows\SysWOW64\installd.exe	22d808f824182cd852e51364fcd874882662cff07a73fa315fe01d54e18eca36.exe

Drops file in Program Files directory 3 IoCs

Processes:

22d808f824182cd852e51364fcd874882662cff07a73fa315fe01d54e18eca36.exe

description	ioc	process
File created	C:\Program Files (x86)\Common Files\Config\data.xml	22d808f824182cd852e51364fcd874882662cff07a73fa315fe01d54e18eca36.exe
File created	C:\Program Files (x86)\Common Files\Config\ver.xml	22d808f824182cd852e51364fcd874882662cff07a73fa315fe01d54e18eca36.exe
File created	C:\Program Files (x86)\Common Files\config\uninstinethnfd.exe	22d808f824182cd852e51364fcd874882662cff07a73fa315fe01d54e18eca36.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Runs net.exe
Suspicious behavior: LoadsDriver 1 IoCs

Processes:

pid process

464
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

nethtsrv.exe

description pid process

Token: SeDebugPrivilege 1364 nethtsrv.exe

pid	process
464

description	pid	process
Token: SeDebugPrivilege	1364	nethtsrv.exe

Suspicious use of WriteProcessMemory 50 IoCs

Processes:

22d808f824182cd852e51364fcd874882662cff07a73fa315fe01d54e18eca36.exenet.exenet.exenet.exenet.exe

description	pid	process	target process
PID 1452 wrote to memory of 1064	1452	22d808f824182cd852e51364fcd874882662cff07a73fa315fe01d54e18eca36.exe	net.exe
PID 1452 wrote to memory of 1064	1452	22d808f824182cd852e51364fcd874882662cff07a73fa315fe01d54e18eca36.exe	net.exe
PID 1452 wrote to memory of 1064	1452	22d808f824182cd852e51364fcd874882662cff07a73fa315fe01d54e18eca36.exe	net.exe
PID 1452 wrote to memory of 1064	1452	22d808f824182cd852e51364fcd874882662cff07a73fa315fe01d54e18eca36.exe	net.exe
PID 1064 wrote to memory of 524	1064	net.exe	net1.exe
PID 1064 wrote to memory of 524	1064	net.exe	net1.exe
PID 1064 wrote to memory of 524	1064	net.exe	net1.exe
PID 1064 wrote to memory of 524	1064	net.exe	net1.exe
PID 1452 wrote to memory of 664	1452	22d808f824182cd852e51364fcd874882662cff07a73fa315fe01d54e18eca36.exe	net.exe
PID 1452 wrote to memory of 664	1452	22d808f824182cd852e51364fcd874882662cff07a73fa315fe01d54e18eca36.exe	net.exe
PID 1452 wrote to memory of 664	1452	22d808f824182cd852e51364fcd874882662cff07a73fa315fe01d54e18eca36.exe	net.exe
PID 1452 wrote to memory of 664	1452	22d808f824182cd852e51364fcd874882662cff07a73fa315fe01d54e18eca36.exe	net.exe
PID 664 wrote to memory of 1460	664	net.exe	net1.exe
PID 664 wrote to memory of 1460	664	net.exe	net1.exe
PID 664 wrote to memory of 1460	664	net.exe	net1.exe
PID 664 wrote to memory of 1460	664	net.exe	net1.exe
PID 1452 wrote to memory of 1860	1452	22d808f824182cd852e51364fcd874882662cff07a73fa315fe01d54e18eca36.exe	installd.exe
PID 1452 wrote to memory of 1860	1452	22d808f824182cd852e51364fcd874882662cff07a73fa315fe01d54e18eca36.exe	installd.exe
PID 1452 wrote to memory of 1860	1452	22d808f824182cd852e51364fcd874882662cff07a73fa315fe01d54e18eca36.exe	installd.exe
PID 1452 wrote to memory of 1860	1452	22d808f824182cd852e51364fcd874882662cff07a73fa315fe01d54e18eca36.exe	installd.exe
PID 1452 wrote to memory of 1860	1452	22d808f824182cd852e51364fcd874882662cff07a73fa315fe01d54e18eca36.exe	installd.exe
PID 1452 wrote to memory of 1860	1452	22d808f824182cd852e51364fcd874882662cff07a73fa315fe01d54e18eca36.exe	installd.exe
PID 1452 wrote to memory of 1860	1452	22d808f824182cd852e51364fcd874882662cff07a73fa315fe01d54e18eca36.exe	installd.exe
PID 1452 wrote to memory of 1640	1452	22d808f824182cd852e51364fcd874882662cff07a73fa315fe01d54e18eca36.exe	nethtsrv.exe
PID 1452 wrote to memory of 1640	1452	22d808f824182cd852e51364fcd874882662cff07a73fa315fe01d54e18eca36.exe	nethtsrv.exe
PID 1452 wrote to memory of 1640	1452	22d808f824182cd852e51364fcd874882662cff07a73fa315fe01d54e18eca36.exe	nethtsrv.exe
PID 1452 wrote to memory of 1640	1452	22d808f824182cd852e51364fcd874882662cff07a73fa315fe01d54e18eca36.exe	nethtsrv.exe
PID 1452 wrote to memory of 1724	1452	22d808f824182cd852e51364fcd874882662cff07a73fa315fe01d54e18eca36.exe	netupdsrv.exe
PID 1452 wrote to memory of 1724	1452	22d808f824182cd852e51364fcd874882662cff07a73fa315fe01d54e18eca36.exe	netupdsrv.exe
PID 1452 wrote to memory of 1724	1452	22d808f824182cd852e51364fcd874882662cff07a73fa315fe01d54e18eca36.exe	netupdsrv.exe
PID 1452 wrote to memory of 1724	1452	22d808f824182cd852e51364fcd874882662cff07a73fa315fe01d54e18eca36.exe	netupdsrv.exe
PID 1452 wrote to memory of 1724	1452	22d808f824182cd852e51364fcd874882662cff07a73fa315fe01d54e18eca36.exe	netupdsrv.exe
PID 1452 wrote to memory of 1724	1452	22d808f824182cd852e51364fcd874882662cff07a73fa315fe01d54e18eca36.exe	netupdsrv.exe
PID 1452 wrote to memory of 1724	1452	22d808f824182cd852e51364fcd874882662cff07a73fa315fe01d54e18eca36.exe	netupdsrv.exe
PID 1452 wrote to memory of 684	1452	22d808f824182cd852e51364fcd874882662cff07a73fa315fe01d54e18eca36.exe	net.exe
PID 1452 wrote to memory of 684	1452	22d808f824182cd852e51364fcd874882662cff07a73fa315fe01d54e18eca36.exe	net.exe
PID 1452 wrote to memory of 684	1452	22d808f824182cd852e51364fcd874882662cff07a73fa315fe01d54e18eca36.exe	net.exe
PID 1452 wrote to memory of 684	1452	22d808f824182cd852e51364fcd874882662cff07a73fa315fe01d54e18eca36.exe	net.exe
PID 684 wrote to memory of 1892	684	net.exe	net1.exe
PID 684 wrote to memory of 1892	684	net.exe	net1.exe
PID 684 wrote to memory of 1892	684	net.exe	net1.exe
PID 684 wrote to memory of 1892	684	net.exe	net1.exe
PID 1452 wrote to memory of 1440	1452	22d808f824182cd852e51364fcd874882662cff07a73fa315fe01d54e18eca36.exe	net.exe
PID 1452 wrote to memory of 1440	1452	22d808f824182cd852e51364fcd874882662cff07a73fa315fe01d54e18eca36.exe	net.exe
PID 1452 wrote to memory of 1440	1452	22d808f824182cd852e51364fcd874882662cff07a73fa315fe01d54e18eca36.exe	net.exe
PID 1452 wrote to memory of 1440	1452	22d808f824182cd852e51364fcd874882662cff07a73fa315fe01d54e18eca36.exe	net.exe
PID 1440 wrote to memory of 1868	1440	net.exe	net1.exe
PID 1440 wrote to memory of 1868	1440	net.exe	net1.exe
PID 1440 wrote to memory of 1868	1440	net.exe	net1.exe
PID 1440 wrote to memory of 1868	1440	net.exe	net1.exe

C:\Users\Admin\AppData\Local\Temp\22d808f824182cd852e51364fcd874882662cff07a73fa315fe01d54e18eca36.exe
"C:\Users\Admin\AppData\Local\Temp\22d808f824182cd852e51364fcd874882662cff07a73fa315fe01d54e18eca36.exe"
1⤵
- Drops file in Drivers directory
- Loads dropped DLL
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:1452

C:\Windows\SysWOW64\net.exe
net stop nethttpservice
2⤵
- Suspicious use of WriteProcessMemory
PID:1064

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop nethttpservice
3⤵
PID:524

C:\Windows\SysWOW64\net.exe
net stop serviceupdater
2⤵
- Suspicious use of WriteProcessMemory
PID:664

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop serviceupdater
3⤵
PID:1460

C:\Windows\SysWOW64\installd.exe
"C:\Windows\system32\installd.exe" nethfdrv
2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1860

C:\Windows\SysWOW64\nethtsrv.exe
"C:\Windows\system32\nethtsrv.exe" -nfdi
2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1640

C:\Windows\SysWOW64\netupdsrv.exe
"C:\Windows\system32\netupdsrv.exe" -nfdi
2⤵
- Executes dropped EXE
PID:1724

C:\Windows\SysWOW64\net.exe
net start nethttpservice
2⤵
- Suspicious use of WriteProcessMemory
PID:684

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 start nethttpservice
3⤵
PID:1892

C:\Windows\SysWOW64\net.exe
net start serviceupdater
2⤵
- Suspicious use of WriteProcessMemory
PID:1440

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 start serviceupdater
3⤵
PID:1868

C:\Windows\SysWOW64\nethtsrv.exe
C:\Windows\SysWOW64\nethtsrv.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:1364

C:\Windows\SysWOW64\netupdsrv.exe
C:\Windows\SysWOW64\netupdsrv.exe
1⤵
- Executes dropped EXE
PID:1756

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\hfnapi.dll
Filesize
106KB

MD5
3d79ad4f8d3b2d944c7535f0cb57d392

SHA1
64ce47229786b3af5587bb7208e7b3eb530597a5

SHA256
639fc26cd6fbf36ef6efd856a74adf91eaa63274b95cb1f640001720a6295e0c

SHA512
7f044cb09252b081fded5932a29c0948f90224a85810e94d898a4c844ab24eee1e77cd535c745bdc7667c2999e966a3796e29908240094f1d54d64684efc5eb1

Download Submit
C:\Windows\SysWOW64\hfpapi.dll
Filesize
241KB

MD5
9f8db90e7d3313acd1b45f0bcf713a60

SHA1
20b62f6ff8706e148ac16ee90bc4e83196cb3af1

SHA256
8b0da05e1b2417d8f85ce164886cb1ce686152b92501feb3b361659f7e0a5e0f

SHA512
4df86fcf2da3ff864420425297e3c32206b261ccd613091e6e6a7440307016a167c13f531f787c0e3cd3441da0bed8547cff447feb1987355e9b072067008b38

Download Submit
C:\Windows\SysWOW64\installd.exe
Filesize
108KB

MD5
15f305808566b61036cba981c888245e

SHA1
622d02b3c537809826c31626ac89681ce94aec83

SHA256
4bfd286e84b5c368e051ea64d528a98109a47b62138ccfb113b40dab355d9884

SHA512
3718e4e7be6fc94fdb63ee8abbaf6824a52fa652542c0c92eca51d26aaa3ca48617a852e55037176747fea9b07aa8dde50615e01a8db4484f4f181eb660fb5f7

Download Submit
C:\Windows\SysWOW64\nethtsrv.exe
Filesize
176KB

MD5
9892a2bc0ebdc9c0217539002cfb7523

SHA1
53dbfa0ead4231df6df1fa3e6203d85af9338ebf

SHA256
304671145cd811a91459323d881166d901a4536d489b42278c39e345154091db

SHA512
a9aec260ac97d1bd344dbc917920b5cadfb4fdbfff99e2d333be4de3a44763a74185fa5c5aa65e831dc756bcbd51d9ff3833da3e0ad09be8fb834587183bb5fb

Download Submit
C:\Windows\SysWOW64\nethtsrv.exe
Filesize
176KB

MD5
9892a2bc0ebdc9c0217539002cfb7523

SHA1
53dbfa0ead4231df6df1fa3e6203d85af9338ebf

SHA256
304671145cd811a91459323d881166d901a4536d489b42278c39e345154091db

SHA512
a9aec260ac97d1bd344dbc917920b5cadfb4fdbfff99e2d333be4de3a44763a74185fa5c5aa65e831dc756bcbd51d9ff3833da3e0ad09be8fb834587183bb5fb

Download Submit
C:\Windows\SysWOW64\netupdsrv.exe
Filesize
158KB

MD5
873d529d2caeaa78b1be698f142ba226

SHA1
bc4b4b8710f55774693753d0dfdc3b4f7e1dcf30

SHA256
fd392a05bfcad6f892e8032bc7f9391f0f878051ad1d2abb8cd96f0933284422

SHA512
ed6f36d0fe1cbb37274708ba03d5d2797e27cff55f01c4e41074f8465f8b241c93ba9cff528e003e8cf508813d87e934475efad719fa464598a1bd358fa841f6

Download Submit
C:\Windows\SysWOW64\netupdsrv.exe
Filesize
158KB

MD5
873d529d2caeaa78b1be698f142ba226

SHA1
bc4b4b8710f55774693753d0dfdc3b4f7e1dcf30

SHA256
fd392a05bfcad6f892e8032bc7f9391f0f878051ad1d2abb8cd96f0933284422

SHA512
ed6f36d0fe1cbb37274708ba03d5d2797e27cff55f01c4e41074f8465f8b241c93ba9cff528e003e8cf508813d87e934475efad719fa464598a1bd358fa841f6

Download Submit
\Users\Admin\AppData\Local\Temp\nsyE820.tmp\System.dll
Filesize
11KB

MD5
c17103ae9072a06da581dec998343fc1

SHA1
b72148c6bdfaada8b8c3f950e610ee7cf1da1f8d

SHA256
dc58d8ad81cacb0c1ed72e33bff8f23ea40b5252b5bb55d393a0903e6819ae2f

SHA512
d32a71aaef18e993f28096d536e41c4d016850721b31171513ce28bbd805a54fd290b7c3e9d935f72e676a1acfb4f0dcc89d95040a0dd29f2b6975855c18986f

Download Submit
\Users\Admin\AppData\Local\Temp\nsyE820.tmp\nsExec.dll
Filesize
6KB

MD5
acc2b699edfea5bf5aae45aba3a41e96

SHA1
d2accf4d494e43ceb2cff69abe4dd17147d29cc2

SHA256
168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e

SHA512
e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe

Download Submit
\Users\Admin\AppData\Local\Temp\nsyE820.tmp\nsExec.dll
Filesize
6KB

MD5
acc2b699edfea5bf5aae45aba3a41e96

SHA1
d2accf4d494e43ceb2cff69abe4dd17147d29cc2

SHA256
168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e

SHA512
e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe

Download Submit
\Users\Admin\AppData\Local\Temp\nsyE820.tmp\nsExec.dll
Filesize
6KB

MD5
acc2b699edfea5bf5aae45aba3a41e96

SHA1
d2accf4d494e43ceb2cff69abe4dd17147d29cc2

SHA256
168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e

SHA512
e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe

Download Submit
\Users\Admin\AppData\Local\Temp\nsyE820.tmp\nsExec.dll
Filesize
6KB

MD5
acc2b699edfea5bf5aae45aba3a41e96

SHA1
d2accf4d494e43ceb2cff69abe4dd17147d29cc2

SHA256
168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e

SHA512
e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe

Download Submit
\Windows\SysWOW64\hfnapi.dll
Filesize
106KB

MD5
3d79ad4f8d3b2d944c7535f0cb57d392

SHA1
64ce47229786b3af5587bb7208e7b3eb530597a5

SHA256
639fc26cd6fbf36ef6efd856a74adf91eaa63274b95cb1f640001720a6295e0c

SHA512
7f044cb09252b081fded5932a29c0948f90224a85810e94d898a4c844ab24eee1e77cd535c745bdc7667c2999e966a3796e29908240094f1d54d64684efc5eb1

Download Submit
\Windows\SysWOW64\hfnapi.dll
Filesize
106KB

MD5
3d79ad4f8d3b2d944c7535f0cb57d392

SHA1
64ce47229786b3af5587bb7208e7b3eb530597a5

SHA256
639fc26cd6fbf36ef6efd856a74adf91eaa63274b95cb1f640001720a6295e0c

SHA512
7f044cb09252b081fded5932a29c0948f90224a85810e94d898a4c844ab24eee1e77cd535c745bdc7667c2999e966a3796e29908240094f1d54d64684efc5eb1

Download Submit
\Windows\SysWOW64\hfnapi.dll
Filesize
106KB

MD5
3d79ad4f8d3b2d944c7535f0cb57d392

SHA1
64ce47229786b3af5587bb7208e7b3eb530597a5

SHA256
639fc26cd6fbf36ef6efd856a74adf91eaa63274b95cb1f640001720a6295e0c

SHA512
7f044cb09252b081fded5932a29c0948f90224a85810e94d898a4c844ab24eee1e77cd535c745bdc7667c2999e966a3796e29908240094f1d54d64684efc5eb1

Download Submit
\Windows\SysWOW64\hfpapi.dll
Filesize
241KB

MD5
9f8db90e7d3313acd1b45f0bcf713a60

SHA1
20b62f6ff8706e148ac16ee90bc4e83196cb3af1

SHA256
8b0da05e1b2417d8f85ce164886cb1ce686152b92501feb3b361659f7e0a5e0f

SHA512
4df86fcf2da3ff864420425297e3c32206b261ccd613091e6e6a7440307016a167c13f531f787c0e3cd3441da0bed8547cff447feb1987355e9b072067008b38

Download Submit
\Windows\SysWOW64\hfpapi.dll
Filesize
241KB

MD5
9f8db90e7d3313acd1b45f0bcf713a60

SHA1
20b62f6ff8706e148ac16ee90bc4e83196cb3af1

SHA256
8b0da05e1b2417d8f85ce164886cb1ce686152b92501feb3b361659f7e0a5e0f

SHA512
4df86fcf2da3ff864420425297e3c32206b261ccd613091e6e6a7440307016a167c13f531f787c0e3cd3441da0bed8547cff447feb1987355e9b072067008b38

Download Submit
\Windows\SysWOW64\installd.exe
Filesize
108KB

MD5
15f305808566b61036cba981c888245e

SHA1
622d02b3c537809826c31626ac89681ce94aec83

SHA256
4bfd286e84b5c368e051ea64d528a98109a47b62138ccfb113b40dab355d9884

SHA512
3718e4e7be6fc94fdb63ee8abbaf6824a52fa652542c0c92eca51d26aaa3ca48617a852e55037176747fea9b07aa8dde50615e01a8db4484f4f181eb660fb5f7

Download Submit
\Windows\SysWOW64\nethtsrv.exe
Filesize
176KB

MD5
9892a2bc0ebdc9c0217539002cfb7523

SHA1
53dbfa0ead4231df6df1fa3e6203d85af9338ebf

SHA256
304671145cd811a91459323d881166d901a4536d489b42278c39e345154091db

SHA512
a9aec260ac97d1bd344dbc917920b5cadfb4fdbfff99e2d333be4de3a44763a74185fa5c5aa65e831dc756bcbd51d9ff3833da3e0ad09be8fb834587183bb5fb

Download Submit
\Windows\SysWOW64\netupdsrv.exe
Filesize
158KB

MD5
873d529d2caeaa78b1be698f142ba226

SHA1
bc4b4b8710f55774693753d0dfdc3b4f7e1dcf30

SHA256
fd392a05bfcad6f892e8032bc7f9391f0f878051ad1d2abb8cd96f0933284422

SHA512
ed6f36d0fe1cbb37274708ba03d5d2797e27cff55f01c4e41074f8465f8b241c93ba9cff528e003e8cf508813d87e934475efad719fa464598a1bd358fa841f6

Download Submit
memory/524-58-0x0000000000000000-mapping.dmp

Download
memory/664-60-0x0000000000000000-mapping.dmp

Download
memory/684-79-0x0000000000000000-mapping.dmp

Download
memory/1064-57-0x0000000000000000-mapping.dmp

Download
memory/1440-85-0x0000000000000000-mapping.dmp

Download
memory/1452-54-0x0000000075C81000-0x0000000075C83000-memory.dmp

Filesize
8KB

Download
memory/1460-61-0x0000000000000000-mapping.dmp

Download
memory/1640-69-0x0000000000000000-mapping.dmp

Download
memory/1724-75-0x0000000000000000-mapping.dmp

Download
memory/1860-63-0x0000000000000000-mapping.dmp

Download
memory/1868-86-0x0000000000000000-mapping.dmp

Download
memory/1892-80-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads