26bdd9f7de671ed157eb020d9359b1be741503322f442dae3868946a0f368306

Analysis

max time kernel
40s
max time network
44s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
23-11-2022 10:31

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

26bdd9f7de671ed157eb020d9359b1be741503322f442dae3868946a0f368306.exe
Size

602KB
MD5

762816f13bf33e8b4a36ab8b650c8a6a
SHA1

e1c58d6c922add149ee0525fd066074a6a77209f
SHA256

26bdd9f7de671ed157eb020d9359b1be741503322f442dae3868946a0f368306
SHA512

0d1b60b0a33fbb469c156e8592f4e8a3bc41a8738540a643c4fa7ad2befc3015bd0636ad55740ccaae72f17827a01216e434cb01ac673ea1abb29dc7d55b38eb
SSDEEP

12288:cIny5DYTgrFdN0GwvRfxgm83sYgNyWqiJvwH5U:6UTghXgRfh8jiRwZ

Score

8^/10

discovery

Malware Config

Signatures

Drops file in Drivers directory 1 IoCs

Processes:

26bdd9f7de671ed157eb020d9359b1be741503322f442dae3868946a0f368306.exe

description ioc process

File created C:\Windows\system32\drivers\nethfdrv.sys 26bdd9f7de671ed157eb020d9359b1be741503322f442dae3868946a0f368306.exe
Executes dropped EXE 5 IoCs

Processes:

installd.exenethtsrv.exenetupdsrv.exenethtsrv.exenetupdsrv.exe

pid process

2036 installd.exe
1068 nethtsrv.exe
1660 netupdsrv.exe
1948 nethtsrv.exe
732 netupdsrv.exe

description	ioc	process
File created	C:\Windows\system32\drivers\nethfdrv.sys	26bdd9f7de671ed157eb020d9359b1be741503322f442dae3868946a0f368306.exe

pid	process
2036	installd.exe
1068	nethtsrv.exe
1660	netupdsrv.exe
1948	nethtsrv.exe
732	netupdsrv.exe

Loads dropped DLL 13 IoCs

Processes:

26bdd9f7de671ed157eb020d9359b1be741503322f442dae3868946a0f368306.exeinstalld.exenethtsrv.exenethtsrv.exe

pid	process
1148	26bdd9f7de671ed157eb020d9359b1be741503322f442dae3868946a0f368306.exe
1148	26bdd9f7de671ed157eb020d9359b1be741503322f442dae3868946a0f368306.exe
1148	26bdd9f7de671ed157eb020d9359b1be741503322f442dae3868946a0f368306.exe
1148	26bdd9f7de671ed157eb020d9359b1be741503322f442dae3868946a0f368306.exe
2036	installd.exe
1148	26bdd9f7de671ed157eb020d9359b1be741503322f442dae3868946a0f368306.exe
1068	nethtsrv.exe
1068	nethtsrv.exe
1148	26bdd9f7de671ed157eb020d9359b1be741503322f442dae3868946a0f368306.exe
1148	26bdd9f7de671ed157eb020d9359b1be741503322f442dae3868946a0f368306.exe
1948	nethtsrv.exe
1948	nethtsrv.exe
1148	26bdd9f7de671ed157eb020d9359b1be741503322f442dae3868946a0f368306.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in System32 directory 5 IoCs

Processes:

26bdd9f7de671ed157eb020d9359b1be741503322f442dae3868946a0f368306.exe

description	ioc	process
File created	C:\Windows\SysWOW64\nethtsrv.exe	26bdd9f7de671ed157eb020d9359b1be741503322f442dae3868946a0f368306.exe
File created	C:\Windows\SysWOW64\netupdsrv.exe	26bdd9f7de671ed157eb020d9359b1be741503322f442dae3868946a0f368306.exe
File created	C:\Windows\SysWOW64\hfnapi.dll	26bdd9f7de671ed157eb020d9359b1be741503322f442dae3868946a0f368306.exe
File created	C:\Windows\SysWOW64\hfpapi.dll	26bdd9f7de671ed157eb020d9359b1be741503322f442dae3868946a0f368306.exe
File created	C:\Windows\SysWOW64\installd.exe	26bdd9f7de671ed157eb020d9359b1be741503322f442dae3868946a0f368306.exe

Drops file in Program Files directory 3 IoCs

Processes:

26bdd9f7de671ed157eb020d9359b1be741503322f442dae3868946a0f368306.exe

description	ioc	process
File created	C:\Program Files (x86)\Common Files\Config\data.xml	26bdd9f7de671ed157eb020d9359b1be741503322f442dae3868946a0f368306.exe
File created	C:\Program Files (x86)\Common Files\Config\ver.xml	26bdd9f7de671ed157eb020d9359b1be741503322f442dae3868946a0f368306.exe
File created	C:\Program Files (x86)\Common Files\config\uninstinethnfd.exe	26bdd9f7de671ed157eb020d9359b1be741503322f442dae3868946a0f368306.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Runs net.exe
Suspicious behavior: LoadsDriver 1 IoCs

Processes:

pid process

460
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

nethtsrv.exe

description pid process

Token: SeDebugPrivilege 1948 nethtsrv.exe

pid	process
460

description	pid	process
Token: SeDebugPrivilege	1948	nethtsrv.exe

Suspicious use of WriteProcessMemory 50 IoCs

Processes:

26bdd9f7de671ed157eb020d9359b1be741503322f442dae3868946a0f368306.exenet.exenet.exenet.exenet.exe

description	pid	process	target process
PID 1148 wrote to memory of 1792	1148	26bdd9f7de671ed157eb020d9359b1be741503322f442dae3868946a0f368306.exe	net.exe
PID 1148 wrote to memory of 1792	1148	26bdd9f7de671ed157eb020d9359b1be741503322f442dae3868946a0f368306.exe	net.exe
PID 1148 wrote to memory of 1792	1148	26bdd9f7de671ed157eb020d9359b1be741503322f442dae3868946a0f368306.exe	net.exe
PID 1148 wrote to memory of 1792	1148	26bdd9f7de671ed157eb020d9359b1be741503322f442dae3868946a0f368306.exe	net.exe
PID 1792 wrote to memory of 844	1792	net.exe	net1.exe
PID 1792 wrote to memory of 844	1792	net.exe	net1.exe
PID 1792 wrote to memory of 844	1792	net.exe	net1.exe
PID 1792 wrote to memory of 844	1792	net.exe	net1.exe
PID 1148 wrote to memory of 1108	1148	26bdd9f7de671ed157eb020d9359b1be741503322f442dae3868946a0f368306.exe	net.exe
PID 1148 wrote to memory of 1108	1148	26bdd9f7de671ed157eb020d9359b1be741503322f442dae3868946a0f368306.exe	net.exe
PID 1148 wrote to memory of 1108	1148	26bdd9f7de671ed157eb020d9359b1be741503322f442dae3868946a0f368306.exe	net.exe
PID 1148 wrote to memory of 1108	1148	26bdd9f7de671ed157eb020d9359b1be741503322f442dae3868946a0f368306.exe	net.exe
PID 1108 wrote to memory of 1516	1108	net.exe	net1.exe
PID 1108 wrote to memory of 1516	1108	net.exe	net1.exe
PID 1108 wrote to memory of 1516	1108	net.exe	net1.exe
PID 1108 wrote to memory of 1516	1108	net.exe	net1.exe
PID 1148 wrote to memory of 2036	1148	26bdd9f7de671ed157eb020d9359b1be741503322f442dae3868946a0f368306.exe	installd.exe
PID 1148 wrote to memory of 2036	1148	26bdd9f7de671ed157eb020d9359b1be741503322f442dae3868946a0f368306.exe	installd.exe
PID 1148 wrote to memory of 2036	1148	26bdd9f7de671ed157eb020d9359b1be741503322f442dae3868946a0f368306.exe	installd.exe
PID 1148 wrote to memory of 2036	1148	26bdd9f7de671ed157eb020d9359b1be741503322f442dae3868946a0f368306.exe	installd.exe
PID 1148 wrote to memory of 2036	1148	26bdd9f7de671ed157eb020d9359b1be741503322f442dae3868946a0f368306.exe	installd.exe
PID 1148 wrote to memory of 2036	1148	26bdd9f7de671ed157eb020d9359b1be741503322f442dae3868946a0f368306.exe	installd.exe
PID 1148 wrote to memory of 2036	1148	26bdd9f7de671ed157eb020d9359b1be741503322f442dae3868946a0f368306.exe	installd.exe
PID 1148 wrote to memory of 1068	1148	26bdd9f7de671ed157eb020d9359b1be741503322f442dae3868946a0f368306.exe	nethtsrv.exe
PID 1148 wrote to memory of 1068	1148	26bdd9f7de671ed157eb020d9359b1be741503322f442dae3868946a0f368306.exe	nethtsrv.exe
PID 1148 wrote to memory of 1068	1148	26bdd9f7de671ed157eb020d9359b1be741503322f442dae3868946a0f368306.exe	nethtsrv.exe
PID 1148 wrote to memory of 1068	1148	26bdd9f7de671ed157eb020d9359b1be741503322f442dae3868946a0f368306.exe	nethtsrv.exe
PID 1148 wrote to memory of 1660	1148	26bdd9f7de671ed157eb020d9359b1be741503322f442dae3868946a0f368306.exe	netupdsrv.exe
PID 1148 wrote to memory of 1660	1148	26bdd9f7de671ed157eb020d9359b1be741503322f442dae3868946a0f368306.exe	netupdsrv.exe
PID 1148 wrote to memory of 1660	1148	26bdd9f7de671ed157eb020d9359b1be741503322f442dae3868946a0f368306.exe	netupdsrv.exe
PID 1148 wrote to memory of 1660	1148	26bdd9f7de671ed157eb020d9359b1be741503322f442dae3868946a0f368306.exe	netupdsrv.exe
PID 1148 wrote to memory of 1660	1148	26bdd9f7de671ed157eb020d9359b1be741503322f442dae3868946a0f368306.exe	netupdsrv.exe
PID 1148 wrote to memory of 1660	1148	26bdd9f7de671ed157eb020d9359b1be741503322f442dae3868946a0f368306.exe	netupdsrv.exe
PID 1148 wrote to memory of 1660	1148	26bdd9f7de671ed157eb020d9359b1be741503322f442dae3868946a0f368306.exe	netupdsrv.exe
PID 1148 wrote to memory of 1200	1148	26bdd9f7de671ed157eb020d9359b1be741503322f442dae3868946a0f368306.exe	net.exe
PID 1148 wrote to memory of 1200	1148	26bdd9f7de671ed157eb020d9359b1be741503322f442dae3868946a0f368306.exe	net.exe
PID 1148 wrote to memory of 1200	1148	26bdd9f7de671ed157eb020d9359b1be741503322f442dae3868946a0f368306.exe	net.exe
PID 1148 wrote to memory of 1200	1148	26bdd9f7de671ed157eb020d9359b1be741503322f442dae3868946a0f368306.exe	net.exe
PID 1200 wrote to memory of 1336	1200	net.exe	net1.exe
PID 1200 wrote to memory of 1336	1200	net.exe	net1.exe
PID 1200 wrote to memory of 1336	1200	net.exe	net1.exe
PID 1200 wrote to memory of 1336	1200	net.exe	net1.exe
PID 1148 wrote to memory of 1884	1148	26bdd9f7de671ed157eb020d9359b1be741503322f442dae3868946a0f368306.exe	net.exe
PID 1148 wrote to memory of 1884	1148	26bdd9f7de671ed157eb020d9359b1be741503322f442dae3868946a0f368306.exe	net.exe
PID 1148 wrote to memory of 1884	1148	26bdd9f7de671ed157eb020d9359b1be741503322f442dae3868946a0f368306.exe	net.exe
PID 1148 wrote to memory of 1884	1148	26bdd9f7de671ed157eb020d9359b1be741503322f442dae3868946a0f368306.exe	net.exe
PID 1884 wrote to memory of 1176	1884	net.exe	net1.exe
PID 1884 wrote to memory of 1176	1884	net.exe	net1.exe
PID 1884 wrote to memory of 1176	1884	net.exe	net1.exe
PID 1884 wrote to memory of 1176	1884	net.exe	net1.exe

C:\Users\Admin\AppData\Local\Temp\26bdd9f7de671ed157eb020d9359b1be741503322f442dae3868946a0f368306.exe
"C:\Users\Admin\AppData\Local\Temp\26bdd9f7de671ed157eb020d9359b1be741503322f442dae3868946a0f368306.exe"
1⤵
- Drops file in Drivers directory
- Loads dropped DLL
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:1148

C:\Windows\SysWOW64\net.exe
net stop nethttpservice
2⤵
- Suspicious use of WriteProcessMemory
PID:1792

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop nethttpservice
3⤵
PID:844

C:\Windows\SysWOW64\net.exe
net stop serviceupdater
2⤵
- Suspicious use of WriteProcessMemory
PID:1108

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop serviceupdater
3⤵
PID:1516

C:\Windows\SysWOW64\installd.exe
"C:\Windows\system32\installd.exe" nethfdrv
2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2036

C:\Windows\SysWOW64\nethtsrv.exe
"C:\Windows\system32\nethtsrv.exe" -nfdi
2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1068

C:\Windows\SysWOW64\netupdsrv.exe
"C:\Windows\system32\netupdsrv.exe" -nfdi
2⤵
- Executes dropped EXE
PID:1660

C:\Windows\SysWOW64\net.exe
net start nethttpservice
2⤵
- Suspicious use of WriteProcessMemory
PID:1200

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 start nethttpservice
3⤵
PID:1336

C:\Windows\SysWOW64\net.exe
net start serviceupdater
2⤵
- Suspicious use of WriteProcessMemory
PID:1884

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 start serviceupdater
3⤵
PID:1176

C:\Windows\SysWOW64\nethtsrv.exe
C:\Windows\SysWOW64\nethtsrv.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:1948

C:\Windows\SysWOW64\netupdsrv.exe
C:\Windows\SysWOW64\netupdsrv.exe
1⤵
- Executes dropped EXE
PID:732

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\hfnapi.dll
Filesize
106KB

MD5
32bcbb88206de605bf22ea460ded225a

SHA1
c46630e5bc1b46b19d4431e294e3e19988328a63

SHA256
cdb081bba5358a79e960ea56799a8797b7c9991f39f271367751c45e6344313c

SHA512
4754c09233f7b2d6087fb6322dde72fc2f6ef71756521ff0c34098d2e95848cdda804a0632d9a750930ff94866e2672a2e470efd12ec314b2bdd538bd5687070

Download Submit
C:\Windows\SysWOW64\hfpapi.dll
Filesize
241KB

MD5
73fd2d9cc685a4d20d4aa37f1d68c3d3

SHA1
31256cc6141d33fb2ccaf7733462330d1d6f13a7

SHA256
2f2f09e8425b1ecf120f5142dfbea7284de1cd37cebe2e383181d7c742c8d64e

SHA512
4a2899c079bb76683498fe27b93dbb28ea96069e2e110bdb14be408942831fb83448ef8c10b856da87650a43081208ca9868951e428caf2cfc9a7096cff84ca2

Download Submit
C:\Windows\SysWOW64\installd.exe
Filesize
108KB

MD5
6eb73d001db44f83fa6c127c1509485c

SHA1
d9944475620845b071cedc545b17211b5352b9f1

SHA256
f2a07addf0b168698069ec90f07e604d4282b9e668dfa048bf08c5d594387af1

SHA512
d7421eb2947d103148117c6675424df91b57fa22289f95388fbb59ff443ff3c615a045fa4c7f48c21ad2e4192746549cc9cbd8e333cf9fa465905e45f1c99a76

Download Submit
C:\Windows\SysWOW64\nethtsrv.exe
Filesize
176KB

MD5
65729d9e79e53140eec38b8c16753149

SHA1
d427b31a5b9d7179a9e449e041e51d0bc43ef7fc

SHA256
0aa2135266ba754dd0cf519a78230a7dca800916f40604bd8a40232b0fc4720b

SHA512
a5df083bbb0f6abe7446f39d454b4e22742eac469f31a446513a69d2806a83e797e7964a98f33c0df2f79d8b363cd718e192ad0c135b42bdec504bd442cc662d

Download Submit
C:\Windows\SysWOW64\nethtsrv.exe
Filesize
176KB

MD5
65729d9e79e53140eec38b8c16753149

SHA1
d427b31a5b9d7179a9e449e041e51d0bc43ef7fc

SHA256
0aa2135266ba754dd0cf519a78230a7dca800916f40604bd8a40232b0fc4720b

SHA512
a5df083bbb0f6abe7446f39d454b4e22742eac469f31a446513a69d2806a83e797e7964a98f33c0df2f79d8b363cd718e192ad0c135b42bdec504bd442cc662d

Download Submit
C:\Windows\SysWOW64\netupdsrv.exe
Filesize
158KB

MD5
4a30720f2431f3956fa02760b74470a0

SHA1
2b92803df0f6b26aa5bb0e09b3eb749a49a2c136

SHA256
e17beb416487101e6d6ceed6f712f8481d415417397a91a9a25eb521ffab0c93

SHA512
0ad96d5f72442044cca930a79d48b627e12f5230096f2e8cac471cfbd1ab8d7f187afdfe6fe0f29c2b620e96a6efb04f26b8d68b7132b8fc45d0389677b3559a

Download Submit
C:\Windows\SysWOW64\netupdsrv.exe
Filesize
158KB

MD5
4a30720f2431f3956fa02760b74470a0

SHA1
2b92803df0f6b26aa5bb0e09b3eb749a49a2c136

SHA256
e17beb416487101e6d6ceed6f712f8481d415417397a91a9a25eb521ffab0c93

SHA512
0ad96d5f72442044cca930a79d48b627e12f5230096f2e8cac471cfbd1ab8d7f187afdfe6fe0f29c2b620e96a6efb04f26b8d68b7132b8fc45d0389677b3559a

Download Submit
\Users\Admin\AppData\Local\Temp\nso283C.tmp\System.dll
Filesize
11KB

MD5
c17103ae9072a06da581dec998343fc1

SHA1
b72148c6bdfaada8b8c3f950e610ee7cf1da1f8d

SHA256
dc58d8ad81cacb0c1ed72e33bff8f23ea40b5252b5bb55d393a0903e6819ae2f

SHA512
d32a71aaef18e993f28096d536e41c4d016850721b31171513ce28bbd805a54fd290b7c3e9d935f72e676a1acfb4f0dcc89d95040a0dd29f2b6975855c18986f

Download Submit
\Users\Admin\AppData\Local\Temp\nso283C.tmp\nsExec.dll
Filesize
6KB

MD5
acc2b699edfea5bf5aae45aba3a41e96

SHA1
d2accf4d494e43ceb2cff69abe4dd17147d29cc2

SHA256
168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e

SHA512
e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe

Download Submit
\Users\Admin\AppData\Local\Temp\nso283C.tmp\nsExec.dll
Filesize
6KB

MD5
acc2b699edfea5bf5aae45aba3a41e96

SHA1
d2accf4d494e43ceb2cff69abe4dd17147d29cc2

SHA256
168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e

SHA512
e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe

Download Submit
\Users\Admin\AppData\Local\Temp\nso283C.tmp\nsExec.dll
Filesize
6KB

MD5
acc2b699edfea5bf5aae45aba3a41e96

SHA1
d2accf4d494e43ceb2cff69abe4dd17147d29cc2

SHA256
168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e

SHA512
e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe

Download Submit
\Users\Admin\AppData\Local\Temp\nso283C.tmp\nsExec.dll
Filesize
6KB

MD5
acc2b699edfea5bf5aae45aba3a41e96

SHA1
d2accf4d494e43ceb2cff69abe4dd17147d29cc2

SHA256
168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e

SHA512
e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe

Download Submit
\Windows\SysWOW64\hfnapi.dll
Filesize
106KB

MD5
32bcbb88206de605bf22ea460ded225a

SHA1
c46630e5bc1b46b19d4431e294e3e19988328a63

SHA256
cdb081bba5358a79e960ea56799a8797b7c9991f39f271367751c45e6344313c

SHA512
4754c09233f7b2d6087fb6322dde72fc2f6ef71756521ff0c34098d2e95848cdda804a0632d9a750930ff94866e2672a2e470efd12ec314b2bdd538bd5687070

Download Submit
\Windows\SysWOW64\hfnapi.dll
Filesize
106KB

MD5
32bcbb88206de605bf22ea460ded225a

SHA1
c46630e5bc1b46b19d4431e294e3e19988328a63

SHA256
cdb081bba5358a79e960ea56799a8797b7c9991f39f271367751c45e6344313c

SHA512
4754c09233f7b2d6087fb6322dde72fc2f6ef71756521ff0c34098d2e95848cdda804a0632d9a750930ff94866e2672a2e470efd12ec314b2bdd538bd5687070

Download Submit
\Windows\SysWOW64\hfnapi.dll
Filesize
106KB

MD5
32bcbb88206de605bf22ea460ded225a

SHA1
c46630e5bc1b46b19d4431e294e3e19988328a63

SHA256
cdb081bba5358a79e960ea56799a8797b7c9991f39f271367751c45e6344313c

SHA512
4754c09233f7b2d6087fb6322dde72fc2f6ef71756521ff0c34098d2e95848cdda804a0632d9a750930ff94866e2672a2e470efd12ec314b2bdd538bd5687070

Download Submit
\Windows\SysWOW64\hfpapi.dll
Filesize
241KB

MD5
73fd2d9cc685a4d20d4aa37f1d68c3d3

SHA1
31256cc6141d33fb2ccaf7733462330d1d6f13a7

SHA256
2f2f09e8425b1ecf120f5142dfbea7284de1cd37cebe2e383181d7c742c8d64e

SHA512
4a2899c079bb76683498fe27b93dbb28ea96069e2e110bdb14be408942831fb83448ef8c10b856da87650a43081208ca9868951e428caf2cfc9a7096cff84ca2

Download Submit
\Windows\SysWOW64\hfpapi.dll
Filesize
241KB

MD5
73fd2d9cc685a4d20d4aa37f1d68c3d3

SHA1
31256cc6141d33fb2ccaf7733462330d1d6f13a7

SHA256
2f2f09e8425b1ecf120f5142dfbea7284de1cd37cebe2e383181d7c742c8d64e

SHA512
4a2899c079bb76683498fe27b93dbb28ea96069e2e110bdb14be408942831fb83448ef8c10b856da87650a43081208ca9868951e428caf2cfc9a7096cff84ca2

Download Submit
\Windows\SysWOW64\installd.exe
Filesize
108KB

MD5
6eb73d001db44f83fa6c127c1509485c

SHA1
d9944475620845b071cedc545b17211b5352b9f1

SHA256
f2a07addf0b168698069ec90f07e604d4282b9e668dfa048bf08c5d594387af1

SHA512
d7421eb2947d103148117c6675424df91b57fa22289f95388fbb59ff443ff3c615a045fa4c7f48c21ad2e4192746549cc9cbd8e333cf9fa465905e45f1c99a76

Download Submit
\Windows\SysWOW64\nethtsrv.exe
Filesize
176KB

MD5
65729d9e79e53140eec38b8c16753149

SHA1
d427b31a5b9d7179a9e449e041e51d0bc43ef7fc

SHA256
0aa2135266ba754dd0cf519a78230a7dca800916f40604bd8a40232b0fc4720b

SHA512
a5df083bbb0f6abe7446f39d454b4e22742eac469f31a446513a69d2806a83e797e7964a98f33c0df2f79d8b363cd718e192ad0c135b42bdec504bd442cc662d

Download Submit
\Windows\SysWOW64\netupdsrv.exe
Filesize
158KB

MD5
4a30720f2431f3956fa02760b74470a0

SHA1
2b92803df0f6b26aa5bb0e09b3eb749a49a2c136

SHA256
e17beb416487101e6d6ceed6f712f8481d415417397a91a9a25eb521ffab0c93

SHA512
0ad96d5f72442044cca930a79d48b627e12f5230096f2e8cac471cfbd1ab8d7f187afdfe6fe0f29c2b620e96a6efb04f26b8d68b7132b8fc45d0389677b3559a

Download Submit
memory/844-59-0x0000000000000000-mapping.dmp

Download
memory/1068-70-0x0000000000000000-mapping.dmp

Download
memory/1108-61-0x0000000000000000-mapping.dmp

Download
memory/1148-90-0x0000000000360000-0x00000000007BE000-memory.dmp

Filesize
4.4MB

Download
memory/1148-55-0x0000000000360000-0x00000000007BE000-memory.dmp

Filesize
4.4MB

Download
memory/1148-54-0x0000000074C11000-0x0000000074C13000-memory.dmp

Filesize
8KB

Download
memory/1176-87-0x0000000000000000-mapping.dmp

Download
memory/1200-80-0x0000000000000000-mapping.dmp

Download
memory/1336-81-0x0000000000000000-mapping.dmp

Download
memory/1516-62-0x0000000000000000-mapping.dmp

Download
memory/1660-76-0x0000000000000000-mapping.dmp

Download
memory/1792-58-0x0000000000000000-mapping.dmp

Download
memory/1884-86-0x0000000000000000-mapping.dmp

Download
memory/2036-64-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads