49240577ac533c9058a1dc944623734f2467ae10a6f76af9c748bc7300df1604

Analysis

max time kernel
63s
max time network
34s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
23-11-2022 10:26

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

49240577ac533c9058a1dc944623734f2467ae10a6f76af9c748bc7300df1604.exe
Size

601KB
MD5

a56f31a149f0f672ee1ec528a171668d
SHA1

65a20122287dfd1b03b6d8a1f5669518ee213593
SHA256

49240577ac533c9058a1dc944623734f2467ae10a6f76af9c748bc7300df1604
SHA512

db548361610322fd95756fe032fa921c1a94511dd15146ac0045c7d73715fdc2ec597d40727302542f65bfe465a88fe683752f8939d4bf253b0bc0acd636bf9e
SSDEEP

12288:XIny5DYT4xgZ71buQvJ0baRcw+qkdjN0wKI6QR:/UT4xg7bu1baZ+qkF6wj6S

Score

8^/10

discovery

Malware Config

Signatures

Drops file in Drivers directory 1 IoCs

Processes:

49240577ac533c9058a1dc944623734f2467ae10a6f76af9c748bc7300df1604.exe

description ioc process

File created C:\Windows\system32\drivers\nethfdrv.sys 49240577ac533c9058a1dc944623734f2467ae10a6f76af9c748bc7300df1604.exe
Executes dropped EXE 5 IoCs

Processes:

installd.exenethtsrv.exenetupdsrv.exenethtsrv.exenetupdsrv.exe

pid process

1364 installd.exe
1592 nethtsrv.exe
1856 netupdsrv.exe
1484 nethtsrv.exe
1660 netupdsrv.exe

description	ioc	process
File created	C:\Windows\system32\drivers\nethfdrv.sys	49240577ac533c9058a1dc944623734f2467ae10a6f76af9c748bc7300df1604.exe

pid	process
1364	installd.exe
1592	nethtsrv.exe
1856	netupdsrv.exe
1484	nethtsrv.exe
1660	netupdsrv.exe

Loads dropped DLL 13 IoCs

Processes:

49240577ac533c9058a1dc944623734f2467ae10a6f76af9c748bc7300df1604.exeinstalld.exenethtsrv.exenethtsrv.exe

pid	process
748	49240577ac533c9058a1dc944623734f2467ae10a6f76af9c748bc7300df1604.exe
748	49240577ac533c9058a1dc944623734f2467ae10a6f76af9c748bc7300df1604.exe
748	49240577ac533c9058a1dc944623734f2467ae10a6f76af9c748bc7300df1604.exe
748	49240577ac533c9058a1dc944623734f2467ae10a6f76af9c748bc7300df1604.exe
1364	installd.exe
748	49240577ac533c9058a1dc944623734f2467ae10a6f76af9c748bc7300df1604.exe
1592	nethtsrv.exe
1592	nethtsrv.exe
748	49240577ac533c9058a1dc944623734f2467ae10a6f76af9c748bc7300df1604.exe
748	49240577ac533c9058a1dc944623734f2467ae10a6f76af9c748bc7300df1604.exe
1484	nethtsrv.exe
1484	nethtsrv.exe
748	49240577ac533c9058a1dc944623734f2467ae10a6f76af9c748bc7300df1604.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in System32 directory 5 IoCs

Processes:

49240577ac533c9058a1dc944623734f2467ae10a6f76af9c748bc7300df1604.exe

description	ioc	process
File created	C:\Windows\SysWOW64\netupdsrv.exe	49240577ac533c9058a1dc944623734f2467ae10a6f76af9c748bc7300df1604.exe
File created	C:\Windows\SysWOW64\hfnapi.dll	49240577ac533c9058a1dc944623734f2467ae10a6f76af9c748bc7300df1604.exe
File created	C:\Windows\SysWOW64\hfpapi.dll	49240577ac533c9058a1dc944623734f2467ae10a6f76af9c748bc7300df1604.exe
File created	C:\Windows\SysWOW64\installd.exe	49240577ac533c9058a1dc944623734f2467ae10a6f76af9c748bc7300df1604.exe
File created	C:\Windows\SysWOW64\nethtsrv.exe	49240577ac533c9058a1dc944623734f2467ae10a6f76af9c748bc7300df1604.exe

Drops file in Program Files directory 3 IoCs

Processes:

49240577ac533c9058a1dc944623734f2467ae10a6f76af9c748bc7300df1604.exe

description	ioc	process
File created	C:\Program Files (x86)\Common Files\Config\ver.xml	49240577ac533c9058a1dc944623734f2467ae10a6f76af9c748bc7300df1604.exe
File created	C:\Program Files (x86)\Common Files\config\uninstinethnfd.exe	49240577ac533c9058a1dc944623734f2467ae10a6f76af9c748bc7300df1604.exe
File created	C:\Program Files (x86)\Common Files\Config\data.xml	49240577ac533c9058a1dc944623734f2467ae10a6f76af9c748bc7300df1604.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Runs net.exe
Suspicious behavior: LoadsDriver 1 IoCs

Processes:

pid process

464
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

nethtsrv.exe

description pid process

Token: SeDebugPrivilege 1484 nethtsrv.exe

pid	process
464

description	pid	process
Token: SeDebugPrivilege	1484	nethtsrv.exe

Suspicious use of WriteProcessMemory 50 IoCs

Processes:

49240577ac533c9058a1dc944623734f2467ae10a6f76af9c748bc7300df1604.exenet.exenet.exenet.exenet.exe

description	pid	process	target process
PID 748 wrote to memory of 272	748	49240577ac533c9058a1dc944623734f2467ae10a6f76af9c748bc7300df1604.exe	net.exe
PID 748 wrote to memory of 272	748	49240577ac533c9058a1dc944623734f2467ae10a6f76af9c748bc7300df1604.exe	net.exe
PID 748 wrote to memory of 272	748	49240577ac533c9058a1dc944623734f2467ae10a6f76af9c748bc7300df1604.exe	net.exe
PID 748 wrote to memory of 272	748	49240577ac533c9058a1dc944623734f2467ae10a6f76af9c748bc7300df1604.exe	net.exe
PID 272 wrote to memory of 332	272	net.exe	net1.exe
PID 272 wrote to memory of 332	272	net.exe	net1.exe
PID 272 wrote to memory of 332	272	net.exe	net1.exe
PID 272 wrote to memory of 332	272	net.exe	net1.exe
PID 748 wrote to memory of 928	748	49240577ac533c9058a1dc944623734f2467ae10a6f76af9c748bc7300df1604.exe	net.exe
PID 748 wrote to memory of 928	748	49240577ac533c9058a1dc944623734f2467ae10a6f76af9c748bc7300df1604.exe	net.exe
PID 748 wrote to memory of 928	748	49240577ac533c9058a1dc944623734f2467ae10a6f76af9c748bc7300df1604.exe	net.exe
PID 748 wrote to memory of 928	748	49240577ac533c9058a1dc944623734f2467ae10a6f76af9c748bc7300df1604.exe	net.exe
PID 928 wrote to memory of 568	928	net.exe	net1.exe
PID 928 wrote to memory of 568	928	net.exe	net1.exe
PID 928 wrote to memory of 568	928	net.exe	net1.exe
PID 928 wrote to memory of 568	928	net.exe	net1.exe
PID 748 wrote to memory of 1364	748	49240577ac533c9058a1dc944623734f2467ae10a6f76af9c748bc7300df1604.exe	installd.exe
PID 748 wrote to memory of 1364	748	49240577ac533c9058a1dc944623734f2467ae10a6f76af9c748bc7300df1604.exe	installd.exe
PID 748 wrote to memory of 1364	748	49240577ac533c9058a1dc944623734f2467ae10a6f76af9c748bc7300df1604.exe	installd.exe
PID 748 wrote to memory of 1364	748	49240577ac533c9058a1dc944623734f2467ae10a6f76af9c748bc7300df1604.exe	installd.exe
PID 748 wrote to memory of 1364	748	49240577ac533c9058a1dc944623734f2467ae10a6f76af9c748bc7300df1604.exe	installd.exe
PID 748 wrote to memory of 1364	748	49240577ac533c9058a1dc944623734f2467ae10a6f76af9c748bc7300df1604.exe	installd.exe
PID 748 wrote to memory of 1364	748	49240577ac533c9058a1dc944623734f2467ae10a6f76af9c748bc7300df1604.exe	installd.exe
PID 748 wrote to memory of 1592	748	49240577ac533c9058a1dc944623734f2467ae10a6f76af9c748bc7300df1604.exe	nethtsrv.exe
PID 748 wrote to memory of 1592	748	49240577ac533c9058a1dc944623734f2467ae10a6f76af9c748bc7300df1604.exe	nethtsrv.exe
PID 748 wrote to memory of 1592	748	49240577ac533c9058a1dc944623734f2467ae10a6f76af9c748bc7300df1604.exe	nethtsrv.exe
PID 748 wrote to memory of 1592	748	49240577ac533c9058a1dc944623734f2467ae10a6f76af9c748bc7300df1604.exe	nethtsrv.exe
PID 748 wrote to memory of 1856	748	49240577ac533c9058a1dc944623734f2467ae10a6f76af9c748bc7300df1604.exe	netupdsrv.exe
PID 748 wrote to memory of 1856	748	49240577ac533c9058a1dc944623734f2467ae10a6f76af9c748bc7300df1604.exe	netupdsrv.exe
PID 748 wrote to memory of 1856	748	49240577ac533c9058a1dc944623734f2467ae10a6f76af9c748bc7300df1604.exe	netupdsrv.exe
PID 748 wrote to memory of 1856	748	49240577ac533c9058a1dc944623734f2467ae10a6f76af9c748bc7300df1604.exe	netupdsrv.exe
PID 748 wrote to memory of 1856	748	49240577ac533c9058a1dc944623734f2467ae10a6f76af9c748bc7300df1604.exe	netupdsrv.exe
PID 748 wrote to memory of 1856	748	49240577ac533c9058a1dc944623734f2467ae10a6f76af9c748bc7300df1604.exe	netupdsrv.exe
PID 748 wrote to memory of 1856	748	49240577ac533c9058a1dc944623734f2467ae10a6f76af9c748bc7300df1604.exe	netupdsrv.exe
PID 748 wrote to memory of 304	748	49240577ac533c9058a1dc944623734f2467ae10a6f76af9c748bc7300df1604.exe	net.exe
PID 748 wrote to memory of 304	748	49240577ac533c9058a1dc944623734f2467ae10a6f76af9c748bc7300df1604.exe	net.exe
PID 748 wrote to memory of 304	748	49240577ac533c9058a1dc944623734f2467ae10a6f76af9c748bc7300df1604.exe	net.exe
PID 748 wrote to memory of 304	748	49240577ac533c9058a1dc944623734f2467ae10a6f76af9c748bc7300df1604.exe	net.exe
PID 304 wrote to memory of 1680	304	net.exe	net1.exe
PID 304 wrote to memory of 1680	304	net.exe	net1.exe
PID 304 wrote to memory of 1680	304	net.exe	net1.exe
PID 304 wrote to memory of 1680	304	net.exe	net1.exe
PID 748 wrote to memory of 1936	748	49240577ac533c9058a1dc944623734f2467ae10a6f76af9c748bc7300df1604.exe	net.exe
PID 748 wrote to memory of 1936	748	49240577ac533c9058a1dc944623734f2467ae10a6f76af9c748bc7300df1604.exe	net.exe
PID 748 wrote to memory of 1936	748	49240577ac533c9058a1dc944623734f2467ae10a6f76af9c748bc7300df1604.exe	net.exe
PID 748 wrote to memory of 1936	748	49240577ac533c9058a1dc944623734f2467ae10a6f76af9c748bc7300df1604.exe	net.exe
PID 1936 wrote to memory of 1976	1936	net.exe	net1.exe
PID 1936 wrote to memory of 1976	1936	net.exe	net1.exe
PID 1936 wrote to memory of 1976	1936	net.exe	net1.exe
PID 1936 wrote to memory of 1976	1936	net.exe	net1.exe

C:\Users\Admin\AppData\Local\Temp\49240577ac533c9058a1dc944623734f2467ae10a6f76af9c748bc7300df1604.exe
"C:\Users\Admin\AppData\Local\Temp\49240577ac533c9058a1dc944623734f2467ae10a6f76af9c748bc7300df1604.exe"
1⤵
- Drops file in Drivers directory
- Loads dropped DLL
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:748

C:\Windows\SysWOW64\net.exe
net stop nethttpservice
2⤵
- Suspicious use of WriteProcessMemory
PID:272

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop nethttpservice
3⤵
PID:332

C:\Windows\SysWOW64\net.exe
net stop serviceupdater
2⤵
- Suspicious use of WriteProcessMemory
PID:928

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop serviceupdater
3⤵
PID:568

C:\Windows\SysWOW64\installd.exe
"C:\Windows\system32\installd.exe" nethfdrv
2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1364

C:\Windows\SysWOW64\nethtsrv.exe
"C:\Windows\system32\nethtsrv.exe" -nfdi
2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1592

C:\Windows\SysWOW64\netupdsrv.exe
"C:\Windows\system32\netupdsrv.exe" -nfdi
2⤵
- Executes dropped EXE
PID:1856

C:\Windows\SysWOW64\net.exe
net start nethttpservice
2⤵
- Suspicious use of WriteProcessMemory
PID:304

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 start nethttpservice
3⤵
PID:1680

C:\Windows\SysWOW64\net.exe
net start serviceupdater
2⤵
- Suspicious use of WriteProcessMemory
PID:1936

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 start serviceupdater
3⤵
PID:1976

C:\Windows\SysWOW64\nethtsrv.exe
C:\Windows\SysWOW64\nethtsrv.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:1484

C:\Windows\SysWOW64\netupdsrv.exe
C:\Windows\SysWOW64\netupdsrv.exe
1⤵
- Executes dropped EXE
PID:1660

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\hfnapi.dll
Filesize
106KB

MD5
29e14f39cd2ba81487bfccc5fd43c9f7

SHA1
4c30ace02553d1c194715e17516f72960a187c68

SHA256
b31c354410893aff706f9c9b38b951aa09a98053c05770233c07b62e8a0fcfca

SHA512
cf8a476e7799e8aa935b3818ac22d6acf5b8676425b1ef4c6f95de19b98181ab192ee2bc034a155be3fd735debc6a7359ce1d2f25d6d36145f7a3c14820107b8

Download Submit
C:\Windows\SysWOW64\hfpapi.dll
Filesize
241KB

MD5
84d128ef3bbd826934557d4f3726c254

SHA1
3da19997f64dfb42c358a527aa8e816ced4e9e97

SHA256
505aa499fcbe00b9b461f00d967e2d0b67cb15d6364671f037b6589e4b67b686

SHA512
27e11a4d2e3b2b992c3a3988eba7848584b316ffa890506e47f2c7628f44e7a7553fbbd8d386cc376e13913ac492cbbf1d30d3148a30cd106d0d4672a3846cc3

Download Submit
C:\Windows\SysWOW64\installd.exe
Filesize
108KB

MD5
bcecf24bbdd90bd339b60aee688cd1be

SHA1
5c50f85815af8f7d620278ab23151d4766ebf133

SHA256
70f13ec8044b324af6393970ae12b631d47682e4c1f6a563bf58fd189f70971c

SHA512
ea096504ab49ee223d34005ab78dfb5a9f709194aa0c7cae290d41e3accb63af237a852095e09c027e5111ce04af51e91ff278f4db77b31954a4670229e8428e

Download Submit
C:\Windows\SysWOW64\nethtsrv.exe
Filesize
176KB

MD5
92df8b2dd7081684b0c0df948b4e1446

SHA1
a0ca4d069ebaf53f396b691bd89909645d42974f

SHA256
68dde1abfe2ece8806f67c6308a1f51e73a289de5f833dbd0390e513c8cd632a

SHA512
0ede8f8820b4d8f3aacab588397d2ec17f37d34c91506e949c57bea3ef3fac3d5ad59ab28b89cc9a9d10f2e3f14bc883ea76f5e52798bad74375e2dc430ec390

Download Submit
C:\Windows\SysWOW64\nethtsrv.exe
Filesize
176KB

MD5
92df8b2dd7081684b0c0df948b4e1446

SHA1
a0ca4d069ebaf53f396b691bd89909645d42974f

SHA256
68dde1abfe2ece8806f67c6308a1f51e73a289de5f833dbd0390e513c8cd632a

SHA512
0ede8f8820b4d8f3aacab588397d2ec17f37d34c91506e949c57bea3ef3fac3d5ad59ab28b89cc9a9d10f2e3f14bc883ea76f5e52798bad74375e2dc430ec390

Download Submit
C:\Windows\SysWOW64\netupdsrv.exe
Filesize
158KB

MD5
262293caeaea23975ce5d2bdd81ad835

SHA1
a2ae45df151eb8ca8473e3bd141f5fc7c748a376

SHA256
44d80aebcde0d03e268f3433c3a984098427273e0f7f638c39096aaec8c3cba7

SHA512
360385114787d61dffd5b2464674f8a10da4791452644544c0ef5a4973aa35942716dd9d36b0dff2589212a1f2966706dbe9460437a649e46e40d74d58b091ce

Download Submit
C:\Windows\SysWOW64\netupdsrv.exe
Filesize
158KB

MD5
262293caeaea23975ce5d2bdd81ad835

SHA1
a2ae45df151eb8ca8473e3bd141f5fc7c748a376

SHA256
44d80aebcde0d03e268f3433c3a984098427273e0f7f638c39096aaec8c3cba7

SHA512
360385114787d61dffd5b2464674f8a10da4791452644544c0ef5a4973aa35942716dd9d36b0dff2589212a1f2966706dbe9460437a649e46e40d74d58b091ce

Download Submit
\Users\Admin\AppData\Local\Temp\nsj83D3.tmp\System.dll
Filesize
11KB

MD5
c17103ae9072a06da581dec998343fc1

SHA1
b72148c6bdfaada8b8c3f950e610ee7cf1da1f8d

SHA256
dc58d8ad81cacb0c1ed72e33bff8f23ea40b5252b5bb55d393a0903e6819ae2f

SHA512
d32a71aaef18e993f28096d536e41c4d016850721b31171513ce28bbd805a54fd290b7c3e9d935f72e676a1acfb4f0dcc89d95040a0dd29f2b6975855c18986f

Download Submit
\Users\Admin\AppData\Local\Temp\nsj83D3.tmp\nsExec.dll
Filesize
6KB

MD5
acc2b699edfea5bf5aae45aba3a41e96

SHA1
d2accf4d494e43ceb2cff69abe4dd17147d29cc2

SHA256
168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e

SHA512
e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe

Download Submit
\Users\Admin\AppData\Local\Temp\nsj83D3.tmp\nsExec.dll
Filesize
6KB

MD5
acc2b699edfea5bf5aae45aba3a41e96

SHA1
d2accf4d494e43ceb2cff69abe4dd17147d29cc2

SHA256
168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e

SHA512
e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe

Download Submit
\Users\Admin\AppData\Local\Temp\nsj83D3.tmp\nsExec.dll
Filesize
6KB

MD5
acc2b699edfea5bf5aae45aba3a41e96

SHA1
d2accf4d494e43ceb2cff69abe4dd17147d29cc2

SHA256
168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e

SHA512
e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe

Download Submit
\Users\Admin\AppData\Local\Temp\nsj83D3.tmp\nsExec.dll
Filesize
6KB

MD5
acc2b699edfea5bf5aae45aba3a41e96

SHA1
d2accf4d494e43ceb2cff69abe4dd17147d29cc2

SHA256
168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e

SHA512
e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe

Download Submit
\Windows\SysWOW64\hfnapi.dll
Filesize
106KB

MD5
29e14f39cd2ba81487bfccc5fd43c9f7

SHA1
4c30ace02553d1c194715e17516f72960a187c68

SHA256
b31c354410893aff706f9c9b38b951aa09a98053c05770233c07b62e8a0fcfca

SHA512
cf8a476e7799e8aa935b3818ac22d6acf5b8676425b1ef4c6f95de19b98181ab192ee2bc034a155be3fd735debc6a7359ce1d2f25d6d36145f7a3c14820107b8

Download Submit
\Windows\SysWOW64\hfnapi.dll
Filesize
106KB

MD5
29e14f39cd2ba81487bfccc5fd43c9f7

SHA1
4c30ace02553d1c194715e17516f72960a187c68

SHA256
b31c354410893aff706f9c9b38b951aa09a98053c05770233c07b62e8a0fcfca

SHA512
cf8a476e7799e8aa935b3818ac22d6acf5b8676425b1ef4c6f95de19b98181ab192ee2bc034a155be3fd735debc6a7359ce1d2f25d6d36145f7a3c14820107b8

Download Submit
\Windows\SysWOW64\hfnapi.dll
Filesize
106KB

MD5
29e14f39cd2ba81487bfccc5fd43c9f7

SHA1
4c30ace02553d1c194715e17516f72960a187c68

SHA256
b31c354410893aff706f9c9b38b951aa09a98053c05770233c07b62e8a0fcfca

SHA512
cf8a476e7799e8aa935b3818ac22d6acf5b8676425b1ef4c6f95de19b98181ab192ee2bc034a155be3fd735debc6a7359ce1d2f25d6d36145f7a3c14820107b8

Download Submit
\Windows\SysWOW64\hfpapi.dll
Filesize
241KB

MD5
84d128ef3bbd826934557d4f3726c254

SHA1
3da19997f64dfb42c358a527aa8e816ced4e9e97

SHA256
505aa499fcbe00b9b461f00d967e2d0b67cb15d6364671f037b6589e4b67b686

SHA512
27e11a4d2e3b2b992c3a3988eba7848584b316ffa890506e47f2c7628f44e7a7553fbbd8d386cc376e13913ac492cbbf1d30d3148a30cd106d0d4672a3846cc3

Download Submit
\Windows\SysWOW64\hfpapi.dll
Filesize
241KB

MD5
84d128ef3bbd826934557d4f3726c254

SHA1
3da19997f64dfb42c358a527aa8e816ced4e9e97

SHA256
505aa499fcbe00b9b461f00d967e2d0b67cb15d6364671f037b6589e4b67b686

SHA512
27e11a4d2e3b2b992c3a3988eba7848584b316ffa890506e47f2c7628f44e7a7553fbbd8d386cc376e13913ac492cbbf1d30d3148a30cd106d0d4672a3846cc3

Download Submit
\Windows\SysWOW64\installd.exe
Filesize
108KB

MD5
bcecf24bbdd90bd339b60aee688cd1be

SHA1
5c50f85815af8f7d620278ab23151d4766ebf133

SHA256
70f13ec8044b324af6393970ae12b631d47682e4c1f6a563bf58fd189f70971c

SHA512
ea096504ab49ee223d34005ab78dfb5a9f709194aa0c7cae290d41e3accb63af237a852095e09c027e5111ce04af51e91ff278f4db77b31954a4670229e8428e

Download Submit
\Windows\SysWOW64\nethtsrv.exe
Filesize
176KB

MD5
92df8b2dd7081684b0c0df948b4e1446

SHA1
a0ca4d069ebaf53f396b691bd89909645d42974f

SHA256
68dde1abfe2ece8806f67c6308a1f51e73a289de5f833dbd0390e513c8cd632a

SHA512
0ede8f8820b4d8f3aacab588397d2ec17f37d34c91506e949c57bea3ef3fac3d5ad59ab28b89cc9a9d10f2e3f14bc883ea76f5e52798bad74375e2dc430ec390

Download Submit
\Windows\SysWOW64\netupdsrv.exe
Filesize
158KB

MD5
262293caeaea23975ce5d2bdd81ad835

SHA1
a2ae45df151eb8ca8473e3bd141f5fc7c748a376

SHA256
44d80aebcde0d03e268f3433c3a984098427273e0f7f638c39096aaec8c3cba7

SHA512
360385114787d61dffd5b2464674f8a10da4791452644544c0ef5a4973aa35942716dd9d36b0dff2589212a1f2966706dbe9460437a649e46e40d74d58b091ce

Download Submit
memory/272-57-0x0000000000000000-mapping.dmp

Download
memory/304-81-0x0000000000000000-mapping.dmp

Download
memory/332-58-0x0000000000000000-mapping.dmp

Download
memory/568-61-0x0000000000000000-mapping.dmp

Download
memory/748-62-0x0000000000360000-0x00000000007BE000-memory.dmp

Filesize
4.4MB

Download
memory/748-69-0x0000000000360000-0x00000000007BE000-memory.dmp

Filesize
4.4MB

Download
memory/748-54-0x0000000075FF1000-0x0000000075FF3000-memory.dmp

Filesize
8KB

Download
memory/748-91-0x0000000000360000-0x00000000007BE000-memory.dmp

Filesize
4.4MB

Download
memory/928-60-0x0000000000000000-mapping.dmp

Download
memory/1364-64-0x0000000000000000-mapping.dmp

Download
memory/1592-71-0x0000000000000000-mapping.dmp

Download
memory/1680-82-0x0000000000000000-mapping.dmp

Download
memory/1856-77-0x0000000000000000-mapping.dmp

Download
memory/1936-87-0x0000000000000000-mapping.dmp

Download
memory/1976-88-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads