96eb61cb3c6c90aa99ca54abacf8b708599a13fefa2a88d461a13d7eaf90073d

Analysis

max time kernel
9s
max time network
2s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
23-11-2022 10:18

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

96eb61cb3c6c90aa99ca54abacf8b708599a13fefa2a88d461a13d7eaf90073d.exe
Size

602KB
MD5

224a2a5630048cc4ac980f861feeebbd
SHA1

c4383451d506123a2d6e4333d76e76f6c390ff9d
SHA256

96eb61cb3c6c90aa99ca54abacf8b708599a13fefa2a88d461a13d7eaf90073d
SHA512

db6c974240cd49889174d8cb561d075aba8fab260a632ba5f9dbfa85d7337d4f8be74aedf3b40eccba261c21cf6cc8180016f0f9717edf00ab0562999e0f9358
SSDEEP

12288:iIny5DYTWLMkg/swRq+zR5OKegjmHGqWUpfY2dYEONrI:EUTWLRg/NqaSV4bqLi2dpON

Score

8^/10

discovery

Malware Config

Signatures

Drops file in Drivers directory 1 IoCs

Processes:

96eb61cb3c6c90aa99ca54abacf8b708599a13fefa2a88d461a13d7eaf90073d.exe

description ioc process

File created C:\Windows\system32\drivers\nethfdrv.sys 96eb61cb3c6c90aa99ca54abacf8b708599a13fefa2a88d461a13d7eaf90073d.exe
Executes dropped EXE 5 IoCs

Processes:

installd.exenethtsrv.exenetupdsrv.exenethtsrv.exenetupdsrv.exe

pid process

3628 installd.exe
1520 nethtsrv.exe
3200 netupdsrv.exe
4580 nethtsrv.exe
4992 netupdsrv.exe

description	ioc	process
File created	C:\Windows\system32\drivers\nethfdrv.sys	96eb61cb3c6c90aa99ca54abacf8b708599a13fefa2a88d461a13d7eaf90073d.exe

pid	process
3628	installd.exe
1520	nethtsrv.exe
3200	netupdsrv.exe
4580	nethtsrv.exe
4992	netupdsrv.exe

Loads dropped DLL 14 IoCs

Processes:

96eb61cb3c6c90aa99ca54abacf8b708599a13fefa2a88d461a13d7eaf90073d.exeinstalld.exenethtsrv.exenethtsrv.exe

pid	process
1152	96eb61cb3c6c90aa99ca54abacf8b708599a13fefa2a88d461a13d7eaf90073d.exe
1152	96eb61cb3c6c90aa99ca54abacf8b708599a13fefa2a88d461a13d7eaf90073d.exe
1152	96eb61cb3c6c90aa99ca54abacf8b708599a13fefa2a88d461a13d7eaf90073d.exe
1152	96eb61cb3c6c90aa99ca54abacf8b708599a13fefa2a88d461a13d7eaf90073d.exe
1152	96eb61cb3c6c90aa99ca54abacf8b708599a13fefa2a88d461a13d7eaf90073d.exe
3628	installd.exe
1520	nethtsrv.exe
1520	nethtsrv.exe
1152	96eb61cb3c6c90aa99ca54abacf8b708599a13fefa2a88d461a13d7eaf90073d.exe
1152	96eb61cb3c6c90aa99ca54abacf8b708599a13fefa2a88d461a13d7eaf90073d.exe
4580	nethtsrv.exe
4580	nethtsrv.exe
1152	96eb61cb3c6c90aa99ca54abacf8b708599a13fefa2a88d461a13d7eaf90073d.exe
1152	96eb61cb3c6c90aa99ca54abacf8b708599a13fefa2a88d461a13d7eaf90073d.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in System32 directory 5 IoCs

Processes:

96eb61cb3c6c90aa99ca54abacf8b708599a13fefa2a88d461a13d7eaf90073d.exe

description	ioc	process
File created	C:\Windows\SysWOW64\netupdsrv.exe	96eb61cb3c6c90aa99ca54abacf8b708599a13fefa2a88d461a13d7eaf90073d.exe
File created	C:\Windows\SysWOW64\hfnapi.dll	96eb61cb3c6c90aa99ca54abacf8b708599a13fefa2a88d461a13d7eaf90073d.exe
File created	C:\Windows\SysWOW64\hfpapi.dll	96eb61cb3c6c90aa99ca54abacf8b708599a13fefa2a88d461a13d7eaf90073d.exe
File created	C:\Windows\SysWOW64\installd.exe	96eb61cb3c6c90aa99ca54abacf8b708599a13fefa2a88d461a13d7eaf90073d.exe
File created	C:\Windows\SysWOW64\nethtsrv.exe	96eb61cb3c6c90aa99ca54abacf8b708599a13fefa2a88d461a13d7eaf90073d.exe

Drops file in Program Files directory 3 IoCs

Processes:

96eb61cb3c6c90aa99ca54abacf8b708599a13fefa2a88d461a13d7eaf90073d.exe

description	ioc	process
File created	C:\Program Files (x86)\Common Files\Config\data.xml	96eb61cb3c6c90aa99ca54abacf8b708599a13fefa2a88d461a13d7eaf90073d.exe
File created	C:\Program Files (x86)\Common Files\Config\ver.xml	96eb61cb3c6c90aa99ca54abacf8b708599a13fefa2a88d461a13d7eaf90073d.exe
File created	C:\Program Files (x86)\Common Files\config\uninstinethnfd.exe	96eb61cb3c6c90aa99ca54abacf8b708599a13fefa2a88d461a13d7eaf90073d.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Modifies data under HKEY_USERS 1 IoCs

Processes:

nethtsrv.exe

description ioc process

Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections nethtsrv.exe
Runs net.exe
Suspicious behavior: LoadsDriver 1 IoCs

Processes:

pid process

648
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

nethtsrv.exe

description pid process

Token: SeDebugPrivilege 4580 nethtsrv.exe

description	ioc	process
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	nethtsrv.exe

pid	process
648

description	pid	process
Token: SeDebugPrivilege	4580	nethtsrv.exe

Suspicious use of WriteProcessMemory 33 IoCs

Processes:

96eb61cb3c6c90aa99ca54abacf8b708599a13fefa2a88d461a13d7eaf90073d.exenet.exenet.exenet.exenet.exe

description	pid	process	target process
PID 1152 wrote to memory of 3928	1152	96eb61cb3c6c90aa99ca54abacf8b708599a13fefa2a88d461a13d7eaf90073d.exe	net.exe
PID 1152 wrote to memory of 3928	1152	96eb61cb3c6c90aa99ca54abacf8b708599a13fefa2a88d461a13d7eaf90073d.exe	net.exe
PID 1152 wrote to memory of 3928	1152	96eb61cb3c6c90aa99ca54abacf8b708599a13fefa2a88d461a13d7eaf90073d.exe	net.exe
PID 3928 wrote to memory of 3232	3928	net.exe	net1.exe
PID 3928 wrote to memory of 3232	3928	net.exe	net1.exe
PID 3928 wrote to memory of 3232	3928	net.exe	net1.exe
PID 1152 wrote to memory of 3080	1152	96eb61cb3c6c90aa99ca54abacf8b708599a13fefa2a88d461a13d7eaf90073d.exe	net.exe
PID 1152 wrote to memory of 3080	1152	96eb61cb3c6c90aa99ca54abacf8b708599a13fefa2a88d461a13d7eaf90073d.exe	net.exe
PID 1152 wrote to memory of 3080	1152	96eb61cb3c6c90aa99ca54abacf8b708599a13fefa2a88d461a13d7eaf90073d.exe	net.exe
PID 3080 wrote to memory of 1288	3080	net.exe	net1.exe
PID 3080 wrote to memory of 1288	3080	net.exe	net1.exe
PID 3080 wrote to memory of 1288	3080	net.exe	net1.exe
PID 1152 wrote to memory of 3628	1152	96eb61cb3c6c90aa99ca54abacf8b708599a13fefa2a88d461a13d7eaf90073d.exe	installd.exe
PID 1152 wrote to memory of 3628	1152	96eb61cb3c6c90aa99ca54abacf8b708599a13fefa2a88d461a13d7eaf90073d.exe	installd.exe
PID 1152 wrote to memory of 3628	1152	96eb61cb3c6c90aa99ca54abacf8b708599a13fefa2a88d461a13d7eaf90073d.exe	installd.exe
PID 1152 wrote to memory of 1520	1152	96eb61cb3c6c90aa99ca54abacf8b708599a13fefa2a88d461a13d7eaf90073d.exe	nethtsrv.exe
PID 1152 wrote to memory of 1520	1152	96eb61cb3c6c90aa99ca54abacf8b708599a13fefa2a88d461a13d7eaf90073d.exe	nethtsrv.exe
PID 1152 wrote to memory of 1520	1152	96eb61cb3c6c90aa99ca54abacf8b708599a13fefa2a88d461a13d7eaf90073d.exe	nethtsrv.exe
PID 1152 wrote to memory of 3200	1152	96eb61cb3c6c90aa99ca54abacf8b708599a13fefa2a88d461a13d7eaf90073d.exe	netupdsrv.exe
PID 1152 wrote to memory of 3200	1152	96eb61cb3c6c90aa99ca54abacf8b708599a13fefa2a88d461a13d7eaf90073d.exe	netupdsrv.exe
PID 1152 wrote to memory of 3200	1152	96eb61cb3c6c90aa99ca54abacf8b708599a13fefa2a88d461a13d7eaf90073d.exe	netupdsrv.exe
PID 1152 wrote to memory of 3220	1152	96eb61cb3c6c90aa99ca54abacf8b708599a13fefa2a88d461a13d7eaf90073d.exe	net.exe
PID 1152 wrote to memory of 3220	1152	96eb61cb3c6c90aa99ca54abacf8b708599a13fefa2a88d461a13d7eaf90073d.exe	net.exe
PID 1152 wrote to memory of 3220	1152	96eb61cb3c6c90aa99ca54abacf8b708599a13fefa2a88d461a13d7eaf90073d.exe	net.exe
PID 3220 wrote to memory of 400	3220	net.exe	net1.exe
PID 3220 wrote to memory of 400	3220	net.exe	net1.exe
PID 3220 wrote to memory of 400	3220	net.exe	net1.exe
PID 1152 wrote to memory of 4288	1152	96eb61cb3c6c90aa99ca54abacf8b708599a13fefa2a88d461a13d7eaf90073d.exe	net.exe
PID 1152 wrote to memory of 4288	1152	96eb61cb3c6c90aa99ca54abacf8b708599a13fefa2a88d461a13d7eaf90073d.exe	net.exe
PID 1152 wrote to memory of 4288	1152	96eb61cb3c6c90aa99ca54abacf8b708599a13fefa2a88d461a13d7eaf90073d.exe	net.exe
PID 4288 wrote to memory of 4948	4288	net.exe	net1.exe
PID 4288 wrote to memory of 4948	4288	net.exe	net1.exe
PID 4288 wrote to memory of 4948	4288	net.exe	net1.exe

C:\Users\Admin\AppData\Local\Temp\96eb61cb3c6c90aa99ca54abacf8b708599a13fefa2a88d461a13d7eaf90073d.exe
"C:\Users\Admin\AppData\Local\Temp\96eb61cb3c6c90aa99ca54abacf8b708599a13fefa2a88d461a13d7eaf90073d.exe"
1⤵
- Drops file in Drivers directory
- Loads dropped DLL
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:1152

C:\Windows\SysWOW64\net.exe
net stop nethttpservice
2⤵
- Suspicious use of WriteProcessMemory
PID:3928

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop nethttpservice
3⤵
PID:3232

C:\Windows\SysWOW64\net.exe
net stop serviceupdater
2⤵
- Suspicious use of WriteProcessMemory
PID:3080

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop serviceupdater
3⤵
PID:1288

C:\Windows\SysWOW64\installd.exe
"C:\Windows\system32\installd.exe" nethfdrv
2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3628

C:\Windows\SysWOW64\nethtsrv.exe
"C:\Windows\system32\nethtsrv.exe" -nfdi
2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1520

C:\Windows\SysWOW64\netupdsrv.exe
"C:\Windows\system32\netupdsrv.exe" -nfdi
2⤵
- Executes dropped EXE
PID:3200

C:\Windows\SysWOW64\net.exe
net start nethttpservice
2⤵
- Suspicious use of WriteProcessMemory
PID:3220

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 start nethttpservice
3⤵
PID:400

C:\Windows\SysWOW64\net.exe
net start serviceupdater
2⤵
- Suspicious use of WriteProcessMemory
PID:4288

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 start serviceupdater
3⤵
PID:4948

C:\Windows\SysWOW64\nethtsrv.exe
C:\Windows\SysWOW64\nethtsrv.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:4580

C:\Windows\SysWOW64\netupdsrv.exe
C:\Windows\SysWOW64\netupdsrv.exe
1⤵
- Executes dropped EXE
PID:4992

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\nswF246.tmp\System.dll
Filesize
11KB

MD5
c17103ae9072a06da581dec998343fc1

SHA1
b72148c6bdfaada8b8c3f950e610ee7cf1da1f8d

SHA256
dc58d8ad81cacb0c1ed72e33bff8f23ea40b5252b5bb55d393a0903e6819ae2f

SHA512
d32a71aaef18e993f28096d536e41c4d016850721b31171513ce28bbd805a54fd290b7c3e9d935f72e676a1acfb4f0dcc89d95040a0dd29f2b6975855c18986f

Download Submit
C:\Users\Admin\AppData\Local\Temp\nswF246.tmp\nsExec.dll
Filesize
6KB

MD5
acc2b699edfea5bf5aae45aba3a41e96

SHA1
d2accf4d494e43ceb2cff69abe4dd17147d29cc2

SHA256
168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e

SHA512
e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe

Download Submit
C:\Users\Admin\AppData\Local\Temp\nswF246.tmp\nsExec.dll
Filesize
6KB

MD5
acc2b699edfea5bf5aae45aba3a41e96

SHA1
d2accf4d494e43ceb2cff69abe4dd17147d29cc2

SHA256
168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e

SHA512
e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe

Download Submit
C:\Users\Admin\AppData\Local\Temp\nswF246.tmp\nsExec.dll
Filesize
6KB

MD5
acc2b699edfea5bf5aae45aba3a41e96

SHA1
d2accf4d494e43ceb2cff69abe4dd17147d29cc2

SHA256
168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e

SHA512
e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe

Download Submit
C:\Users\Admin\AppData\Local\Temp\nswF246.tmp\nsExec.dll
Filesize
6KB

MD5
acc2b699edfea5bf5aae45aba3a41e96

SHA1
d2accf4d494e43ceb2cff69abe4dd17147d29cc2

SHA256
168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e

SHA512
e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe

Download Submit
C:\Users\Admin\AppData\Local\Temp\nswF246.tmp\nsExec.dll
Filesize
6KB

MD5
acc2b699edfea5bf5aae45aba3a41e96

SHA1
d2accf4d494e43ceb2cff69abe4dd17147d29cc2

SHA256
168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e

SHA512
e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe

Download Submit
C:\Users\Admin\AppData\Local\Temp\nswF246.tmp\nsExec.dll
Filesize
6KB

MD5
acc2b699edfea5bf5aae45aba3a41e96

SHA1
d2accf4d494e43ceb2cff69abe4dd17147d29cc2

SHA256
168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e

SHA512
e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe

Download Submit
C:\Users\Admin\AppData\Local\Temp\nswF246.tmp\nsExec.dll
Filesize
6KB

MD5
acc2b699edfea5bf5aae45aba3a41e96

SHA1
d2accf4d494e43ceb2cff69abe4dd17147d29cc2

SHA256
168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e

SHA512
e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe

Download Submit
C:\Users\Admin\AppData\Local\Temp\nswF246.tmp\nsExec.dll
Filesize
6KB

MD5
acc2b699edfea5bf5aae45aba3a41e96

SHA1
d2accf4d494e43ceb2cff69abe4dd17147d29cc2

SHA256
168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e

SHA512
e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe

Download Submit
C:\Windows\SysWOW64\hfnapi.dll
Filesize
106KB

MD5
0ff8cdbe282cc7de06e265313e0ecba6

SHA1
cce4a5cfb3dd2261db7ad53d6624160e7a762669

SHA256
505c77a8d4ef8fc4669689ad78c7df5e007e0c12c5fae4d420363c9b701c69c6

SHA512
5f2a4a08e00246cd6b88c623a84aa22ae2c1cad92f745cdee26b3094534bc068c78dcce311e925699ab024e961b1121c776370d48b1c2976e3ea84427b0b1fdd

Download Submit
C:\Windows\SysWOW64\hfnapi.dll
Filesize
106KB

MD5
0ff8cdbe282cc7de06e265313e0ecba6

SHA1
cce4a5cfb3dd2261db7ad53d6624160e7a762669

SHA256
505c77a8d4ef8fc4669689ad78c7df5e007e0c12c5fae4d420363c9b701c69c6

SHA512
5f2a4a08e00246cd6b88c623a84aa22ae2c1cad92f745cdee26b3094534bc068c78dcce311e925699ab024e961b1121c776370d48b1c2976e3ea84427b0b1fdd

Download Submit
C:\Windows\SysWOW64\hfnapi.dll
Filesize
106KB

MD5
0ff8cdbe282cc7de06e265313e0ecba6

SHA1
cce4a5cfb3dd2261db7ad53d6624160e7a762669

SHA256
505c77a8d4ef8fc4669689ad78c7df5e007e0c12c5fae4d420363c9b701c69c6

SHA512
5f2a4a08e00246cd6b88c623a84aa22ae2c1cad92f745cdee26b3094534bc068c78dcce311e925699ab024e961b1121c776370d48b1c2976e3ea84427b0b1fdd

Download Submit
C:\Windows\SysWOW64\hfnapi.dll
Filesize
106KB

MD5
0ff8cdbe282cc7de06e265313e0ecba6

SHA1
cce4a5cfb3dd2261db7ad53d6624160e7a762669

SHA256
505c77a8d4ef8fc4669689ad78c7df5e007e0c12c5fae4d420363c9b701c69c6

SHA512
5f2a4a08e00246cd6b88c623a84aa22ae2c1cad92f745cdee26b3094534bc068c78dcce311e925699ab024e961b1121c776370d48b1c2976e3ea84427b0b1fdd

Download Submit
C:\Windows\SysWOW64\hfpapi.dll
Filesize
241KB

MD5
f33d0eaac26330293936ecebe30f60b4

SHA1
c61f82880ea9eca3494b7ca8d33efe7e8307b6e5

SHA256
e023b2dfc16786ebe2a498396e9bf91b92bfb6264d9e2fb6362b558d4b90e45e

SHA512
9840e8969efd3218499b785b874e4b640597a072e404ebb0a7ffcf44668a6047ac1725fe7df05cea9d7c2f60d786fe9bf25fa3e62ea6dd0fa858291e21b7ad41

Download Submit
C:\Windows\SysWOW64\hfpapi.dll
Filesize
241KB

MD5
f33d0eaac26330293936ecebe30f60b4

SHA1
c61f82880ea9eca3494b7ca8d33efe7e8307b6e5

SHA256
e023b2dfc16786ebe2a498396e9bf91b92bfb6264d9e2fb6362b558d4b90e45e

SHA512
9840e8969efd3218499b785b874e4b640597a072e404ebb0a7ffcf44668a6047ac1725fe7df05cea9d7c2f60d786fe9bf25fa3e62ea6dd0fa858291e21b7ad41

Download Submit
C:\Windows\SysWOW64\hfpapi.dll
Filesize
241KB

MD5
f33d0eaac26330293936ecebe30f60b4

SHA1
c61f82880ea9eca3494b7ca8d33efe7e8307b6e5

SHA256
e023b2dfc16786ebe2a498396e9bf91b92bfb6264d9e2fb6362b558d4b90e45e

SHA512
9840e8969efd3218499b785b874e4b640597a072e404ebb0a7ffcf44668a6047ac1725fe7df05cea9d7c2f60d786fe9bf25fa3e62ea6dd0fa858291e21b7ad41

Download Submit
C:\Windows\SysWOW64\installd.exe
Filesize
108KB

MD5
6e18a73ca4c93bf408746fe250933f01

SHA1
518c83fdccd3c66496f985db6dc30a812bd968e3

SHA256
0db2bbaf6a62d905e3e929ab448c3e545a79f0902d9cd0f72b364d5d0d85892a

SHA512
4261b5d1ec8ce4f386bde691eeafe0669b52201dfb00cebf490ad3e1f314018ef6f604670e6e822674b4917e820d9fc93f50a56e3c5e02b46c014714db6e63b0

Download Submit
C:\Windows\SysWOW64\installd.exe
Filesize
108KB

MD5
6e18a73ca4c93bf408746fe250933f01

SHA1
518c83fdccd3c66496f985db6dc30a812bd968e3

SHA256
0db2bbaf6a62d905e3e929ab448c3e545a79f0902d9cd0f72b364d5d0d85892a

SHA512
4261b5d1ec8ce4f386bde691eeafe0669b52201dfb00cebf490ad3e1f314018ef6f604670e6e822674b4917e820d9fc93f50a56e3c5e02b46c014714db6e63b0

Download Submit
C:\Windows\SysWOW64\nethtsrv.exe
Filesize
176KB

MD5
6f381fea9e2c5a05e2f5ea15cc0a5244

SHA1
40d006e3e4bbc0e6061bece915f82549eb1e545e

SHA256
3cafe4c6d88ebfaefc9826c47dbc2f2052b98379f994d286e3f4b4f8ea8e32f8

SHA512
19cd699aafd60b0bbe4acfabc50b4ea67d580ce2ca657582e56bccab814df629ca298812c22f855f43179eaff91904e22fafff9473a81dc022f0661c0498f70a

Download Submit
C:\Windows\SysWOW64\nethtsrv.exe
Filesize
176KB

MD5
6f381fea9e2c5a05e2f5ea15cc0a5244

SHA1
40d006e3e4bbc0e6061bece915f82549eb1e545e

SHA256
3cafe4c6d88ebfaefc9826c47dbc2f2052b98379f994d286e3f4b4f8ea8e32f8

SHA512
19cd699aafd60b0bbe4acfabc50b4ea67d580ce2ca657582e56bccab814df629ca298812c22f855f43179eaff91904e22fafff9473a81dc022f0661c0498f70a

Download Submit
C:\Windows\SysWOW64\nethtsrv.exe
Filesize
176KB

MD5
6f381fea9e2c5a05e2f5ea15cc0a5244

SHA1
40d006e3e4bbc0e6061bece915f82549eb1e545e

SHA256
3cafe4c6d88ebfaefc9826c47dbc2f2052b98379f994d286e3f4b4f8ea8e32f8

SHA512
19cd699aafd60b0bbe4acfabc50b4ea67d580ce2ca657582e56bccab814df629ca298812c22f855f43179eaff91904e22fafff9473a81dc022f0661c0498f70a

Download Submit
C:\Windows\SysWOW64\netupdsrv.exe
Filesize
159KB

MD5
b0842d56248c11e4ab09ad38e1474562

SHA1
c81d4be031de4a933536d375d5391ee176c4a0e3

SHA256
28726f6f706ef5793298fe191c6ef1c8a4ee094ec51ea6f224cecfd370be63b7

SHA512
5a221c80a4f72eab3749af437e4644725a16ca0b9d47d3ffe7e29a5cfa65b444faa5d2eafc6d6eb0fb1a46b7ad538fa898a573298c3c6a5cf911c94cd11463e9

Download Submit
C:\Windows\SysWOW64\netupdsrv.exe
Filesize
159KB

MD5
b0842d56248c11e4ab09ad38e1474562

SHA1
c81d4be031de4a933536d375d5391ee176c4a0e3

SHA256
28726f6f706ef5793298fe191c6ef1c8a4ee094ec51ea6f224cecfd370be63b7

SHA512
5a221c80a4f72eab3749af437e4644725a16ca0b9d47d3ffe7e29a5cfa65b444faa5d2eafc6d6eb0fb1a46b7ad538fa898a573298c3c6a5cf911c94cd11463e9

Download Submit
C:\Windows\SysWOW64\netupdsrv.exe
Filesize
159KB

MD5
b0842d56248c11e4ab09ad38e1474562

SHA1
c81d4be031de4a933536d375d5391ee176c4a0e3

SHA256
28726f6f706ef5793298fe191c6ef1c8a4ee094ec51ea6f224cecfd370be63b7

SHA512
5a221c80a4f72eab3749af437e4644725a16ca0b9d47d3ffe7e29a5cfa65b444faa5d2eafc6d6eb0fb1a46b7ad538fa898a573298c3c6a5cf911c94cd11463e9

Download Submit
memory/400-159-0x0000000000000000-mapping.dmp

Download
memory/1152-132-0x0000000000360000-0x00000000007BE000-memory.dmp

Filesize
4.4MB

Download
memory/1152-168-0x0000000000360000-0x00000000007BE000-memory.dmp

Filesize
4.4MB

Download
memory/1288-141-0x0000000000000000-mapping.dmp

Download
memory/1520-147-0x0000000000000000-mapping.dmp

Download
memory/3080-140-0x0000000000000000-mapping.dmp

Download
memory/3200-153-0x0000000000000000-mapping.dmp

Download
memory/3220-158-0x0000000000000000-mapping.dmp

Download
memory/3232-137-0x0000000000000000-mapping.dmp

Download
memory/3628-142-0x0000000000000000-mapping.dmp

Download
memory/3928-136-0x0000000000000000-mapping.dmp

Download
memory/4288-165-0x0000000000000000-mapping.dmp

Download
memory/4948-166-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads