9cb7b4ee670775a51670477c14d5993e27829909a890274df47af992bedc19b6

Analysis

max time kernel
52s
max time network
34s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
23-11-2022 10:18

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

9cb7b4ee670775a51670477c14d5993e27829909a890274df47af992bedc19b6.exe
Size

601KB
MD5

98794db85c5fbd8705fcc439f7a2c06a
SHA1

65c8e38af309be8f7258090d6cdc6a67eb485fdd
SHA256

9cb7b4ee670775a51670477c14d5993e27829909a890274df47af992bedc19b6
SHA512

4ffb12db318bd6c148e2bfd342d8072efe0d2211e5c185c95b8076d7a354b4c7f0c07cbd2d0ccd0b1c6eb49c26b6f8b22ee3bed67c2754ac15f5516e570f5ed3
SSDEEP

12288:tIny5DYTjgwDcd+nVg4lXEhryVReVcwmtRiW6wZXD3hP2OyaSW3:5UTMwDcCS4lKmHeKwaAWvFReXW

Score

8^/10

discovery

Malware Config

Signatures

Drops file in Drivers directory 1 IoCs

Processes:

9cb7b4ee670775a51670477c14d5993e27829909a890274df47af992bedc19b6.exe

description ioc process

File created C:\Windows\system32\drivers\nethfdrv.sys 9cb7b4ee670775a51670477c14d5993e27829909a890274df47af992bedc19b6.exe
Executes dropped EXE 5 IoCs

Processes:

installd.exenethtsrv.exenetupdsrv.exenethtsrv.exenetupdsrv.exe

pid process

884 installd.exe
792 nethtsrv.exe
852 netupdsrv.exe
1620 nethtsrv.exe
1412 netupdsrv.exe

description	ioc	process
File created	C:\Windows\system32\drivers\nethfdrv.sys	9cb7b4ee670775a51670477c14d5993e27829909a890274df47af992bedc19b6.exe

pid	process
884	installd.exe
792	nethtsrv.exe
852	netupdsrv.exe
1620	nethtsrv.exe
1412	netupdsrv.exe

Loads dropped DLL 13 IoCs

Processes:

9cb7b4ee670775a51670477c14d5993e27829909a890274df47af992bedc19b6.exeinstalld.exenethtsrv.exenethtsrv.exe

pid	process
944	9cb7b4ee670775a51670477c14d5993e27829909a890274df47af992bedc19b6.exe
944	9cb7b4ee670775a51670477c14d5993e27829909a890274df47af992bedc19b6.exe
944	9cb7b4ee670775a51670477c14d5993e27829909a890274df47af992bedc19b6.exe
944	9cb7b4ee670775a51670477c14d5993e27829909a890274df47af992bedc19b6.exe
884	installd.exe
944	9cb7b4ee670775a51670477c14d5993e27829909a890274df47af992bedc19b6.exe
792	nethtsrv.exe
792	nethtsrv.exe
944	9cb7b4ee670775a51670477c14d5993e27829909a890274df47af992bedc19b6.exe
944	9cb7b4ee670775a51670477c14d5993e27829909a890274df47af992bedc19b6.exe
1620	nethtsrv.exe
1620	nethtsrv.exe
944	9cb7b4ee670775a51670477c14d5993e27829909a890274df47af992bedc19b6.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in System32 directory 5 IoCs

Processes:

9cb7b4ee670775a51670477c14d5993e27829909a890274df47af992bedc19b6.exe

description	ioc	process
File created	C:\Windows\SysWOW64\installd.exe	9cb7b4ee670775a51670477c14d5993e27829909a890274df47af992bedc19b6.exe
File created	C:\Windows\SysWOW64\nethtsrv.exe	9cb7b4ee670775a51670477c14d5993e27829909a890274df47af992bedc19b6.exe
File created	C:\Windows\SysWOW64\netupdsrv.exe	9cb7b4ee670775a51670477c14d5993e27829909a890274df47af992bedc19b6.exe
File created	C:\Windows\SysWOW64\hfnapi.dll	9cb7b4ee670775a51670477c14d5993e27829909a890274df47af992bedc19b6.exe
File created	C:\Windows\SysWOW64\hfpapi.dll	9cb7b4ee670775a51670477c14d5993e27829909a890274df47af992bedc19b6.exe

Drops file in Program Files directory 3 IoCs

Processes:

9cb7b4ee670775a51670477c14d5993e27829909a890274df47af992bedc19b6.exe

description	ioc	process
File created	C:\Program Files (x86)\Common Files\config\uninstinethnfd.exe	9cb7b4ee670775a51670477c14d5993e27829909a890274df47af992bedc19b6.exe
File created	C:\Program Files (x86)\Common Files\Config\data.xml	9cb7b4ee670775a51670477c14d5993e27829909a890274df47af992bedc19b6.exe
File created	C:\Program Files (x86)\Common Files\Config\ver.xml	9cb7b4ee670775a51670477c14d5993e27829909a890274df47af992bedc19b6.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Runs net.exe
Suspicious behavior: LoadsDriver 1 IoCs

Processes:

pid process

468
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

nethtsrv.exe

description pid process

Token: SeDebugPrivilege 1620 nethtsrv.exe

pid	process
468

description	pid	process
Token: SeDebugPrivilege	1620	nethtsrv.exe

Suspicious use of WriteProcessMemory 50 IoCs

Processes:

9cb7b4ee670775a51670477c14d5993e27829909a890274df47af992bedc19b6.exenet.exenet.exenet.exenet.exe

description	pid	process	target process
PID 944 wrote to memory of 276	944	9cb7b4ee670775a51670477c14d5993e27829909a890274df47af992bedc19b6.exe	net.exe
PID 944 wrote to memory of 276	944	9cb7b4ee670775a51670477c14d5993e27829909a890274df47af992bedc19b6.exe	net.exe
PID 944 wrote to memory of 276	944	9cb7b4ee670775a51670477c14d5993e27829909a890274df47af992bedc19b6.exe	net.exe
PID 944 wrote to memory of 276	944	9cb7b4ee670775a51670477c14d5993e27829909a890274df47af992bedc19b6.exe	net.exe
PID 276 wrote to memory of 376	276	net.exe	net1.exe
PID 276 wrote to memory of 376	276	net.exe	net1.exe
PID 276 wrote to memory of 376	276	net.exe	net1.exe
PID 276 wrote to memory of 376	276	net.exe	net1.exe
PID 944 wrote to memory of 1180	944	9cb7b4ee670775a51670477c14d5993e27829909a890274df47af992bedc19b6.exe	net.exe
PID 944 wrote to memory of 1180	944	9cb7b4ee670775a51670477c14d5993e27829909a890274df47af992bedc19b6.exe	net.exe
PID 944 wrote to memory of 1180	944	9cb7b4ee670775a51670477c14d5993e27829909a890274df47af992bedc19b6.exe	net.exe
PID 944 wrote to memory of 1180	944	9cb7b4ee670775a51670477c14d5993e27829909a890274df47af992bedc19b6.exe	net.exe
PID 1180 wrote to memory of 1532	1180	net.exe	net1.exe
PID 1180 wrote to memory of 1532	1180	net.exe	net1.exe
PID 1180 wrote to memory of 1532	1180	net.exe	net1.exe
PID 1180 wrote to memory of 1532	1180	net.exe	net1.exe
PID 944 wrote to memory of 884	944	9cb7b4ee670775a51670477c14d5993e27829909a890274df47af992bedc19b6.exe	installd.exe
PID 944 wrote to memory of 884	944	9cb7b4ee670775a51670477c14d5993e27829909a890274df47af992bedc19b6.exe	installd.exe
PID 944 wrote to memory of 884	944	9cb7b4ee670775a51670477c14d5993e27829909a890274df47af992bedc19b6.exe	installd.exe
PID 944 wrote to memory of 884	944	9cb7b4ee670775a51670477c14d5993e27829909a890274df47af992bedc19b6.exe	installd.exe
PID 944 wrote to memory of 884	944	9cb7b4ee670775a51670477c14d5993e27829909a890274df47af992bedc19b6.exe	installd.exe
PID 944 wrote to memory of 884	944	9cb7b4ee670775a51670477c14d5993e27829909a890274df47af992bedc19b6.exe	installd.exe
PID 944 wrote to memory of 884	944	9cb7b4ee670775a51670477c14d5993e27829909a890274df47af992bedc19b6.exe	installd.exe
PID 944 wrote to memory of 792	944	9cb7b4ee670775a51670477c14d5993e27829909a890274df47af992bedc19b6.exe	nethtsrv.exe
PID 944 wrote to memory of 792	944	9cb7b4ee670775a51670477c14d5993e27829909a890274df47af992bedc19b6.exe	nethtsrv.exe
PID 944 wrote to memory of 792	944	9cb7b4ee670775a51670477c14d5993e27829909a890274df47af992bedc19b6.exe	nethtsrv.exe
PID 944 wrote to memory of 792	944	9cb7b4ee670775a51670477c14d5993e27829909a890274df47af992bedc19b6.exe	nethtsrv.exe
PID 944 wrote to memory of 852	944	9cb7b4ee670775a51670477c14d5993e27829909a890274df47af992bedc19b6.exe	netupdsrv.exe
PID 944 wrote to memory of 852	944	9cb7b4ee670775a51670477c14d5993e27829909a890274df47af992bedc19b6.exe	netupdsrv.exe
PID 944 wrote to memory of 852	944	9cb7b4ee670775a51670477c14d5993e27829909a890274df47af992bedc19b6.exe	netupdsrv.exe
PID 944 wrote to memory of 852	944	9cb7b4ee670775a51670477c14d5993e27829909a890274df47af992bedc19b6.exe	netupdsrv.exe
PID 944 wrote to memory of 852	944	9cb7b4ee670775a51670477c14d5993e27829909a890274df47af992bedc19b6.exe	netupdsrv.exe
PID 944 wrote to memory of 852	944	9cb7b4ee670775a51670477c14d5993e27829909a890274df47af992bedc19b6.exe	netupdsrv.exe
PID 944 wrote to memory of 852	944	9cb7b4ee670775a51670477c14d5993e27829909a890274df47af992bedc19b6.exe	netupdsrv.exe
PID 944 wrote to memory of 1872	944	9cb7b4ee670775a51670477c14d5993e27829909a890274df47af992bedc19b6.exe	net.exe
PID 944 wrote to memory of 1872	944	9cb7b4ee670775a51670477c14d5993e27829909a890274df47af992bedc19b6.exe	net.exe
PID 944 wrote to memory of 1872	944	9cb7b4ee670775a51670477c14d5993e27829909a890274df47af992bedc19b6.exe	net.exe
PID 944 wrote to memory of 1872	944	9cb7b4ee670775a51670477c14d5993e27829909a890274df47af992bedc19b6.exe	net.exe
PID 1872 wrote to memory of 820	1872	net.exe	net1.exe
PID 1872 wrote to memory of 820	1872	net.exe	net1.exe
PID 1872 wrote to memory of 820	1872	net.exe	net1.exe
PID 1872 wrote to memory of 820	1872	net.exe	net1.exe
PID 944 wrote to memory of 1740	944	9cb7b4ee670775a51670477c14d5993e27829909a890274df47af992bedc19b6.exe	net.exe
PID 944 wrote to memory of 1740	944	9cb7b4ee670775a51670477c14d5993e27829909a890274df47af992bedc19b6.exe	net.exe
PID 944 wrote to memory of 1740	944	9cb7b4ee670775a51670477c14d5993e27829909a890274df47af992bedc19b6.exe	net.exe
PID 944 wrote to memory of 1740	944	9cb7b4ee670775a51670477c14d5993e27829909a890274df47af992bedc19b6.exe	net.exe
PID 1740 wrote to memory of 612	1740	net.exe	net1.exe
PID 1740 wrote to memory of 612	1740	net.exe	net1.exe
PID 1740 wrote to memory of 612	1740	net.exe	net1.exe
PID 1740 wrote to memory of 612	1740	net.exe	net1.exe

C:\Users\Admin\AppData\Local\Temp\9cb7b4ee670775a51670477c14d5993e27829909a890274df47af992bedc19b6.exe
"C:\Users\Admin\AppData\Local\Temp\9cb7b4ee670775a51670477c14d5993e27829909a890274df47af992bedc19b6.exe"
1⤵
- Drops file in Drivers directory
- Loads dropped DLL
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:944

C:\Windows\SysWOW64\net.exe
net stop nethttpservice
2⤵
- Suspicious use of WriteProcessMemory
PID:276

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop nethttpservice
3⤵
PID:376

C:\Windows\SysWOW64\net.exe
net stop serviceupdater
2⤵
- Suspicious use of WriteProcessMemory
PID:1180

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop serviceupdater
3⤵
PID:1532

C:\Windows\SysWOW64\installd.exe
"C:\Windows\system32\installd.exe" nethfdrv
2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:884

C:\Windows\SysWOW64\nethtsrv.exe
"C:\Windows\system32\nethtsrv.exe" -nfdi
2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:792

C:\Windows\SysWOW64\netupdsrv.exe
"C:\Windows\system32\netupdsrv.exe" -nfdi
2⤵
- Executes dropped EXE
PID:852

C:\Windows\SysWOW64\net.exe
net start nethttpservice
2⤵
- Suspicious use of WriteProcessMemory
PID:1872

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 start nethttpservice
3⤵
PID:820

C:\Windows\SysWOW64\net.exe
net start serviceupdater
2⤵
- Suspicious use of WriteProcessMemory
PID:1740

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 start serviceupdater
3⤵
PID:612

C:\Windows\SysWOW64\nethtsrv.exe
C:\Windows\SysWOW64\nethtsrv.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:1620

C:\Windows\SysWOW64\netupdsrv.exe
C:\Windows\SysWOW64\netupdsrv.exe
1⤵
- Executes dropped EXE
PID:1412

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\hfnapi.dll
Filesize
106KB

MD5
b859a901f2e203e32e6371a977c770b2

SHA1
2184e3bfd4e77e5cb4598a7d0e22d6254819eadf

SHA256
6e85d4ec6526e9a99877e95106bf43b1c1f89e492411d86264cc70ad6ae9e85d

SHA512
a5e027d5c979d96436a8058e297dbf430e5190bb469464a2cc68a2650875c9ce32631279cb9a0b86929747fd772ef853d283e6c5ded5d0ef043035d3248a1ede

Download Submit
C:\Windows\SysWOW64\hfpapi.dll
Filesize
241KB

MD5
360bcc881253eec2a9dc5d7b914483c2

SHA1
d9c1f8bd92463e8775c180fb948ed67903f62cde

SHA256
b489b104b12f15217452e64533943abe490d496be71160232be5f824ef084f13

SHA512
fe4d3e750b6f9a32f57b2d1807835f00af527c7165e88203a9f121289b5bd98542759812cb3b4a62fdb8e250e303668d9f47b3ad58ad2a65727d79daf092d256

Download Submit
C:\Windows\SysWOW64\installd.exe
Filesize
108KB

MD5
90fb253e2f5718e3b3fa7bdbf710ae91

SHA1
65b4aff7040e9673afc68d7c015b3e3db712b313

SHA256
b7a322282056795003729e15f0debe8215756c4f1368b0b4c00ec8b3a8a8ba8a

SHA512
a87aab95c747348bae89a2099d76aec12f22f4b12bb60ef088cfd5ef7977390a517ee39e5f445560233e1a74db4d00e40a076b97ae7c8e003dab10701ce98512

Download Submit
C:\Windows\SysWOW64\nethtsrv.exe
Filesize
176KB

MD5
6d6751df6c1942b12c65ecbbb0a3be31

SHA1
444f2ad6ed704ec117095b79d37f38c5c1db9a0a

SHA256
255ae1e2232f96ebe71678bae1c52c74403d7fbcc8173a7d7fac807c0e89a94d

SHA512
f6febed273e387572fc9de9b3b78229c449e23c48068313b3c8ca7ebbf4eb2e168cd10551229c91ecab050d67dee49364f2f03b5a675558b893531535f672a09

Download Submit
C:\Windows\SysWOW64\nethtsrv.exe
Filesize
176KB

MD5
6d6751df6c1942b12c65ecbbb0a3be31

SHA1
444f2ad6ed704ec117095b79d37f38c5c1db9a0a

SHA256
255ae1e2232f96ebe71678bae1c52c74403d7fbcc8173a7d7fac807c0e89a94d

SHA512
f6febed273e387572fc9de9b3b78229c449e23c48068313b3c8ca7ebbf4eb2e168cd10551229c91ecab050d67dee49364f2f03b5a675558b893531535f672a09

Download Submit
C:\Windows\SysWOW64\netupdsrv.exe
Filesize
158KB

MD5
aeed8d1ace4b6926a84903f07cefdbc6

SHA1
7d20b76039dd3dd52686f318df2d9e4d0380e85c

SHA256
be63256c6515fffd81d1be41f93bdf375e350475e7c479b2c06a067b437fce56

SHA512
f367f4b205a2d9a489e8cffb645aef939d0d003803c2da099b7f90f17b7d484459c63dba90e1b6bc8d199fae9c08b458e031ced6311fd8513a9828f1f39f99cb

Download Submit
C:\Windows\SysWOW64\netupdsrv.exe
Filesize
158KB

MD5
aeed8d1ace4b6926a84903f07cefdbc6

SHA1
7d20b76039dd3dd52686f318df2d9e4d0380e85c

SHA256
be63256c6515fffd81d1be41f93bdf375e350475e7c479b2c06a067b437fce56

SHA512
f367f4b205a2d9a489e8cffb645aef939d0d003803c2da099b7f90f17b7d484459c63dba90e1b6bc8d199fae9c08b458e031ced6311fd8513a9828f1f39f99cb

Download Submit
\Users\Admin\AppData\Local\Temp\nsjA863.tmp\System.dll
Filesize
11KB

MD5
c17103ae9072a06da581dec998343fc1

SHA1
b72148c6bdfaada8b8c3f950e610ee7cf1da1f8d

SHA256
dc58d8ad81cacb0c1ed72e33bff8f23ea40b5252b5bb55d393a0903e6819ae2f

SHA512
d32a71aaef18e993f28096d536e41c4d016850721b31171513ce28bbd805a54fd290b7c3e9d935f72e676a1acfb4f0dcc89d95040a0dd29f2b6975855c18986f

Download Submit
\Users\Admin\AppData\Local\Temp\nsjA863.tmp\nsExec.dll
Filesize
6KB

MD5
acc2b699edfea5bf5aae45aba3a41e96

SHA1
d2accf4d494e43ceb2cff69abe4dd17147d29cc2

SHA256
168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e

SHA512
e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe

Download Submit
\Users\Admin\AppData\Local\Temp\nsjA863.tmp\nsExec.dll
Filesize
6KB

MD5
acc2b699edfea5bf5aae45aba3a41e96

SHA1
d2accf4d494e43ceb2cff69abe4dd17147d29cc2

SHA256
168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e

SHA512
e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe

Download Submit
\Users\Admin\AppData\Local\Temp\nsjA863.tmp\nsExec.dll
Filesize
6KB

MD5
acc2b699edfea5bf5aae45aba3a41e96

SHA1
d2accf4d494e43ceb2cff69abe4dd17147d29cc2

SHA256
168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e

SHA512
e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe

Download Submit
\Users\Admin\AppData\Local\Temp\nsjA863.tmp\nsExec.dll
Filesize
6KB

MD5
acc2b699edfea5bf5aae45aba3a41e96

SHA1
d2accf4d494e43ceb2cff69abe4dd17147d29cc2

SHA256
168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e

SHA512
e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe

Download Submit
\Windows\SysWOW64\hfnapi.dll
Filesize
106KB

MD5
b859a901f2e203e32e6371a977c770b2

SHA1
2184e3bfd4e77e5cb4598a7d0e22d6254819eadf

SHA256
6e85d4ec6526e9a99877e95106bf43b1c1f89e492411d86264cc70ad6ae9e85d

SHA512
a5e027d5c979d96436a8058e297dbf430e5190bb469464a2cc68a2650875c9ce32631279cb9a0b86929747fd772ef853d283e6c5ded5d0ef043035d3248a1ede

Download Submit
\Windows\SysWOW64\hfnapi.dll
Filesize
106KB

MD5
b859a901f2e203e32e6371a977c770b2

SHA1
2184e3bfd4e77e5cb4598a7d0e22d6254819eadf

SHA256
6e85d4ec6526e9a99877e95106bf43b1c1f89e492411d86264cc70ad6ae9e85d

SHA512
a5e027d5c979d96436a8058e297dbf430e5190bb469464a2cc68a2650875c9ce32631279cb9a0b86929747fd772ef853d283e6c5ded5d0ef043035d3248a1ede

Download Submit
\Windows\SysWOW64\hfnapi.dll
Filesize
106KB

MD5
b859a901f2e203e32e6371a977c770b2

SHA1
2184e3bfd4e77e5cb4598a7d0e22d6254819eadf

SHA256
6e85d4ec6526e9a99877e95106bf43b1c1f89e492411d86264cc70ad6ae9e85d

SHA512
a5e027d5c979d96436a8058e297dbf430e5190bb469464a2cc68a2650875c9ce32631279cb9a0b86929747fd772ef853d283e6c5ded5d0ef043035d3248a1ede

Download Submit
\Windows\SysWOW64\hfpapi.dll
Filesize
241KB

MD5
360bcc881253eec2a9dc5d7b914483c2

SHA1
d9c1f8bd92463e8775c180fb948ed67903f62cde

SHA256
b489b104b12f15217452e64533943abe490d496be71160232be5f824ef084f13

SHA512
fe4d3e750b6f9a32f57b2d1807835f00af527c7165e88203a9f121289b5bd98542759812cb3b4a62fdb8e250e303668d9f47b3ad58ad2a65727d79daf092d256

Download Submit
\Windows\SysWOW64\hfpapi.dll
Filesize
241KB

MD5
360bcc881253eec2a9dc5d7b914483c2

SHA1
d9c1f8bd92463e8775c180fb948ed67903f62cde

SHA256
b489b104b12f15217452e64533943abe490d496be71160232be5f824ef084f13

SHA512
fe4d3e750b6f9a32f57b2d1807835f00af527c7165e88203a9f121289b5bd98542759812cb3b4a62fdb8e250e303668d9f47b3ad58ad2a65727d79daf092d256

Download Submit
\Windows\SysWOW64\installd.exe
Filesize
108KB

MD5
90fb253e2f5718e3b3fa7bdbf710ae91

SHA1
65b4aff7040e9673afc68d7c015b3e3db712b313

SHA256
b7a322282056795003729e15f0debe8215756c4f1368b0b4c00ec8b3a8a8ba8a

SHA512
a87aab95c747348bae89a2099d76aec12f22f4b12bb60ef088cfd5ef7977390a517ee39e5f445560233e1a74db4d00e40a076b97ae7c8e003dab10701ce98512

Download Submit
\Windows\SysWOW64\nethtsrv.exe
Filesize
176KB

MD5
6d6751df6c1942b12c65ecbbb0a3be31

SHA1
444f2ad6ed704ec117095b79d37f38c5c1db9a0a

SHA256
255ae1e2232f96ebe71678bae1c52c74403d7fbcc8173a7d7fac807c0e89a94d

SHA512
f6febed273e387572fc9de9b3b78229c449e23c48068313b3c8ca7ebbf4eb2e168cd10551229c91ecab050d67dee49364f2f03b5a675558b893531535f672a09

Download Submit
\Windows\SysWOW64\netupdsrv.exe
Filesize
158KB

MD5
aeed8d1ace4b6926a84903f07cefdbc6

SHA1
7d20b76039dd3dd52686f318df2d9e4d0380e85c

SHA256
be63256c6515fffd81d1be41f93bdf375e350475e7c479b2c06a067b437fce56

SHA512
f367f4b205a2d9a489e8cffb645aef939d0d003803c2da099b7f90f17b7d484459c63dba90e1b6bc8d199fae9c08b458e031ced6311fd8513a9828f1f39f99cb

Download Submit
memory/276-58-0x0000000000000000-mapping.dmp

Download
memory/376-59-0x0000000000000000-mapping.dmp

Download
memory/612-87-0x0000000000000000-mapping.dmp

Download
memory/792-70-0x0000000000000000-mapping.dmp

Download
memory/820-81-0x0000000000000000-mapping.dmp

Download
memory/852-76-0x0000000000000000-mapping.dmp

Download
memory/884-64-0x0000000000000000-mapping.dmp

Download
memory/944-54-0x0000000074F01000-0x0000000074F03000-memory.dmp

Filesize
8KB

Download
memory/944-90-0x0000000000360000-0x00000000007BE000-memory.dmp

Filesize
4.4MB

Download
memory/944-55-0x0000000000360000-0x00000000007BE000-memory.dmp

Filesize
4.4MB

Download
memory/1180-61-0x0000000000000000-mapping.dmp

Download
memory/1532-62-0x0000000000000000-mapping.dmp

Download
memory/1740-86-0x0000000000000000-mapping.dmp

Download
memory/1872-80-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads