266844d698b7a413cd59e029b30958739a88a6930de74299a29551ce05ef468a

Analysis

max time kernel
63s
max time network
35s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
23-11-2022 10:31

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

266844d698b7a413cd59e029b30958739a88a6930de74299a29551ce05ef468a.exe
Size

602KB
MD5

8914d19e23b4b8935bfdd82cfe4564a3
SHA1

7f49587be3f797ecb93c76114ef07cc35059c0d5
SHA256

266844d698b7a413cd59e029b30958739a88a6930de74299a29551ce05ef468a
SHA512

cc2a1cc702ce94e67625bc77332f6ef6a315dd2b56dfb666971ee6b727543abfcde1852bb9e88beba18dbf154116c4e5b11ad2467bf3ac4ff821c41f4a3e555d
SSDEEP

12288:oIny5DYTuctf81KHZ14u6mYO6wlFs7fU8UT1UWg1WZBB7uEeG6SOG4:mUTurKHjP8dYs3UTO4ZBd4DSg

Score

8^/10

discovery

Malware Config

Signatures

Drops file in Drivers directory 1 IoCs

Processes:

266844d698b7a413cd59e029b30958739a88a6930de74299a29551ce05ef468a.exe

description ioc process

File created C:\Windows\system32\drivers\nethfdrv.sys 266844d698b7a413cd59e029b30958739a88a6930de74299a29551ce05ef468a.exe
Executes dropped EXE 5 IoCs

Processes:

installd.exenethtsrv.exenetupdsrv.exenethtsrv.exenetupdsrv.exe

pid process

756 installd.exe
532 nethtsrv.exe
1252 netupdsrv.exe
1516 nethtsrv.exe
948 netupdsrv.exe

description	ioc	process
File created	C:\Windows\system32\drivers\nethfdrv.sys	266844d698b7a413cd59e029b30958739a88a6930de74299a29551ce05ef468a.exe

pid	process
756	installd.exe
532	nethtsrv.exe
1252	netupdsrv.exe
1516	nethtsrv.exe
948	netupdsrv.exe

Loads dropped DLL 13 IoCs

Processes:

266844d698b7a413cd59e029b30958739a88a6930de74299a29551ce05ef468a.exeinstalld.exenethtsrv.exenethtsrv.exe

pid	process
1632	266844d698b7a413cd59e029b30958739a88a6930de74299a29551ce05ef468a.exe
1632	266844d698b7a413cd59e029b30958739a88a6930de74299a29551ce05ef468a.exe
1632	266844d698b7a413cd59e029b30958739a88a6930de74299a29551ce05ef468a.exe
1632	266844d698b7a413cd59e029b30958739a88a6930de74299a29551ce05ef468a.exe
756	installd.exe
1632	266844d698b7a413cd59e029b30958739a88a6930de74299a29551ce05ef468a.exe
532	nethtsrv.exe
532	nethtsrv.exe
1632	266844d698b7a413cd59e029b30958739a88a6930de74299a29551ce05ef468a.exe
1632	266844d698b7a413cd59e029b30958739a88a6930de74299a29551ce05ef468a.exe
1516	nethtsrv.exe
1516	nethtsrv.exe
1632	266844d698b7a413cd59e029b30958739a88a6930de74299a29551ce05ef468a.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in System32 directory 5 IoCs

Processes:

266844d698b7a413cd59e029b30958739a88a6930de74299a29551ce05ef468a.exe

description	ioc	process
File created	C:\Windows\SysWOW64\netupdsrv.exe	266844d698b7a413cd59e029b30958739a88a6930de74299a29551ce05ef468a.exe
File created	C:\Windows\SysWOW64\hfnapi.dll	266844d698b7a413cd59e029b30958739a88a6930de74299a29551ce05ef468a.exe
File created	C:\Windows\SysWOW64\hfpapi.dll	266844d698b7a413cd59e029b30958739a88a6930de74299a29551ce05ef468a.exe
File created	C:\Windows\SysWOW64\installd.exe	266844d698b7a413cd59e029b30958739a88a6930de74299a29551ce05ef468a.exe
File created	C:\Windows\SysWOW64\nethtsrv.exe	266844d698b7a413cd59e029b30958739a88a6930de74299a29551ce05ef468a.exe

Drops file in Program Files directory 3 IoCs

Processes:

266844d698b7a413cd59e029b30958739a88a6930de74299a29551ce05ef468a.exe

description	ioc	process
File created	C:\Program Files (x86)\Common Files\Config\data.xml	266844d698b7a413cd59e029b30958739a88a6930de74299a29551ce05ef468a.exe
File created	C:\Program Files (x86)\Common Files\Config\ver.xml	266844d698b7a413cd59e029b30958739a88a6930de74299a29551ce05ef468a.exe
File created	C:\Program Files (x86)\Common Files\config\uninstinethnfd.exe	266844d698b7a413cd59e029b30958739a88a6930de74299a29551ce05ef468a.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Runs net.exe
Suspicious behavior: LoadsDriver 1 IoCs

Processes:

pid process

460
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

nethtsrv.exe

description pid process

Token: SeDebugPrivilege 1516 nethtsrv.exe

pid	process
460

description	pid	process
Token: SeDebugPrivilege	1516	nethtsrv.exe

Suspicious use of WriteProcessMemory 50 IoCs

Processes:

266844d698b7a413cd59e029b30958739a88a6930de74299a29551ce05ef468a.exenet.exenet.exenet.exenet.exe

description	pid	process	target process
PID 1632 wrote to memory of 1408	1632	266844d698b7a413cd59e029b30958739a88a6930de74299a29551ce05ef468a.exe	net.exe
PID 1632 wrote to memory of 1408	1632	266844d698b7a413cd59e029b30958739a88a6930de74299a29551ce05ef468a.exe	net.exe
PID 1632 wrote to memory of 1408	1632	266844d698b7a413cd59e029b30958739a88a6930de74299a29551ce05ef468a.exe	net.exe
PID 1632 wrote to memory of 1408	1632	266844d698b7a413cd59e029b30958739a88a6930de74299a29551ce05ef468a.exe	net.exe
PID 1408 wrote to memory of 1772	1408	net.exe	net1.exe
PID 1408 wrote to memory of 1772	1408	net.exe	net1.exe
PID 1408 wrote to memory of 1772	1408	net.exe	net1.exe
PID 1408 wrote to memory of 1772	1408	net.exe	net1.exe
PID 1632 wrote to memory of 1776	1632	266844d698b7a413cd59e029b30958739a88a6930de74299a29551ce05ef468a.exe	net.exe
PID 1632 wrote to memory of 1776	1632	266844d698b7a413cd59e029b30958739a88a6930de74299a29551ce05ef468a.exe	net.exe
PID 1632 wrote to memory of 1776	1632	266844d698b7a413cd59e029b30958739a88a6930de74299a29551ce05ef468a.exe	net.exe
PID 1632 wrote to memory of 1776	1632	266844d698b7a413cd59e029b30958739a88a6930de74299a29551ce05ef468a.exe	net.exe
PID 1776 wrote to memory of 660	1776	net.exe	net1.exe
PID 1776 wrote to memory of 660	1776	net.exe	net1.exe
PID 1776 wrote to memory of 660	1776	net.exe	net1.exe
PID 1776 wrote to memory of 660	1776	net.exe	net1.exe
PID 1632 wrote to memory of 756	1632	266844d698b7a413cd59e029b30958739a88a6930de74299a29551ce05ef468a.exe	installd.exe
PID 1632 wrote to memory of 756	1632	266844d698b7a413cd59e029b30958739a88a6930de74299a29551ce05ef468a.exe	installd.exe
PID 1632 wrote to memory of 756	1632	266844d698b7a413cd59e029b30958739a88a6930de74299a29551ce05ef468a.exe	installd.exe
PID 1632 wrote to memory of 756	1632	266844d698b7a413cd59e029b30958739a88a6930de74299a29551ce05ef468a.exe	installd.exe
PID 1632 wrote to memory of 756	1632	266844d698b7a413cd59e029b30958739a88a6930de74299a29551ce05ef468a.exe	installd.exe
PID 1632 wrote to memory of 756	1632	266844d698b7a413cd59e029b30958739a88a6930de74299a29551ce05ef468a.exe	installd.exe
PID 1632 wrote to memory of 756	1632	266844d698b7a413cd59e029b30958739a88a6930de74299a29551ce05ef468a.exe	installd.exe
PID 1632 wrote to memory of 532	1632	266844d698b7a413cd59e029b30958739a88a6930de74299a29551ce05ef468a.exe	nethtsrv.exe
PID 1632 wrote to memory of 532	1632	266844d698b7a413cd59e029b30958739a88a6930de74299a29551ce05ef468a.exe	nethtsrv.exe
PID 1632 wrote to memory of 532	1632	266844d698b7a413cd59e029b30958739a88a6930de74299a29551ce05ef468a.exe	nethtsrv.exe
PID 1632 wrote to memory of 532	1632	266844d698b7a413cd59e029b30958739a88a6930de74299a29551ce05ef468a.exe	nethtsrv.exe
PID 1632 wrote to memory of 1252	1632	266844d698b7a413cd59e029b30958739a88a6930de74299a29551ce05ef468a.exe	netupdsrv.exe
PID 1632 wrote to memory of 1252	1632	266844d698b7a413cd59e029b30958739a88a6930de74299a29551ce05ef468a.exe	netupdsrv.exe
PID 1632 wrote to memory of 1252	1632	266844d698b7a413cd59e029b30958739a88a6930de74299a29551ce05ef468a.exe	netupdsrv.exe
PID 1632 wrote to memory of 1252	1632	266844d698b7a413cd59e029b30958739a88a6930de74299a29551ce05ef468a.exe	netupdsrv.exe
PID 1632 wrote to memory of 1252	1632	266844d698b7a413cd59e029b30958739a88a6930de74299a29551ce05ef468a.exe	netupdsrv.exe
PID 1632 wrote to memory of 1252	1632	266844d698b7a413cd59e029b30958739a88a6930de74299a29551ce05ef468a.exe	netupdsrv.exe
PID 1632 wrote to memory of 1252	1632	266844d698b7a413cd59e029b30958739a88a6930de74299a29551ce05ef468a.exe	netupdsrv.exe
PID 1632 wrote to memory of 736	1632	266844d698b7a413cd59e029b30958739a88a6930de74299a29551ce05ef468a.exe	net.exe
PID 1632 wrote to memory of 736	1632	266844d698b7a413cd59e029b30958739a88a6930de74299a29551ce05ef468a.exe	net.exe
PID 1632 wrote to memory of 736	1632	266844d698b7a413cd59e029b30958739a88a6930de74299a29551ce05ef468a.exe	net.exe
PID 1632 wrote to memory of 736	1632	266844d698b7a413cd59e029b30958739a88a6930de74299a29551ce05ef468a.exe	net.exe
PID 736 wrote to memory of 1528	736	net.exe	net1.exe
PID 736 wrote to memory of 1528	736	net.exe	net1.exe
PID 736 wrote to memory of 1528	736	net.exe	net1.exe
PID 736 wrote to memory of 1528	736	net.exe	net1.exe
PID 1632 wrote to memory of 1556	1632	266844d698b7a413cd59e029b30958739a88a6930de74299a29551ce05ef468a.exe	net.exe
PID 1632 wrote to memory of 1556	1632	266844d698b7a413cd59e029b30958739a88a6930de74299a29551ce05ef468a.exe	net.exe
PID 1632 wrote to memory of 1556	1632	266844d698b7a413cd59e029b30958739a88a6930de74299a29551ce05ef468a.exe	net.exe
PID 1632 wrote to memory of 1556	1632	266844d698b7a413cd59e029b30958739a88a6930de74299a29551ce05ef468a.exe	net.exe
PID 1556 wrote to memory of 940	1556	net.exe	net1.exe
PID 1556 wrote to memory of 940	1556	net.exe	net1.exe
PID 1556 wrote to memory of 940	1556	net.exe	net1.exe
PID 1556 wrote to memory of 940	1556	net.exe	net1.exe

C:\Users\Admin\AppData\Local\Temp\266844d698b7a413cd59e029b30958739a88a6930de74299a29551ce05ef468a.exe
"C:\Users\Admin\AppData\Local\Temp\266844d698b7a413cd59e029b30958739a88a6930de74299a29551ce05ef468a.exe"
1⤵
- Drops file in Drivers directory
- Loads dropped DLL
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:1632

C:\Windows\SysWOW64\net.exe
net stop nethttpservice
2⤵
- Suspicious use of WriteProcessMemory
PID:1408

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop nethttpservice
3⤵
PID:1772

C:\Windows\SysWOW64\net.exe
net stop serviceupdater
2⤵
- Suspicious use of WriteProcessMemory
PID:1776

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop serviceupdater
3⤵
PID:660

C:\Windows\SysWOW64\installd.exe
"C:\Windows\system32\installd.exe" nethfdrv
2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:756

C:\Windows\SysWOW64\nethtsrv.exe
"C:\Windows\system32\nethtsrv.exe" -nfdi
2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:532

C:\Windows\SysWOW64\netupdsrv.exe
"C:\Windows\system32\netupdsrv.exe" -nfdi
2⤵
- Executes dropped EXE
PID:1252

C:\Windows\SysWOW64\net.exe
net start nethttpservice
2⤵
- Suspicious use of WriteProcessMemory
PID:736

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 start nethttpservice
3⤵
PID:1528

C:\Windows\SysWOW64\net.exe
net start serviceupdater
2⤵
- Suspicious use of WriteProcessMemory
PID:1556

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 start serviceupdater
3⤵
PID:940

C:\Windows\SysWOW64\nethtsrv.exe
C:\Windows\SysWOW64\nethtsrv.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:1516

C:\Windows\SysWOW64\netupdsrv.exe
C:\Windows\SysWOW64\netupdsrv.exe
1⤵
- Executes dropped EXE
PID:948

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\hfnapi.dll
Filesize
106KB

MD5
4fa103af3aa269d39ae918770a3554fe

SHA1
12a4d73d5c4a748364147347fb2ed337a2629676

SHA256
1a00155ae289c3d823e33e3fa6b69c24921b01e749597c04d078bef8b114bef1

SHA512
e1838c6cd48b562b6b5926400f3de91838c422ce759ad63756d72b9680ed0401d756fc5aabd1064d7c401add1e27550caa3e29e9c014bbbc196ec967fad9d85f

Download Submit
C:\Windows\SysWOW64\hfpapi.dll
Filesize
241KB

MD5
58e0aafaecf3c75c15686285a9f1da58

SHA1
1921ffb00f11d5b65f4c26ea11559a85a8832d72

SHA256
b4d52028ccc4afc828f5af70818e859529438912dd278179b96dd652e6e36f26

SHA512
ee0ffd47fc0e0cc3ebddd8137bcfc7173b0277bc6d8d33ce1bf70ad5e641a7b4f2c74746dbf1e4056f3e16a98a7718efc311ea5ed72bc788bf9f0657a57902ee

Download Submit
C:\Windows\SysWOW64\installd.exe
Filesize
108KB

MD5
97b8b88d726ab0cc5b5b1f694964c1ca

SHA1
b0c70d2dcd9467263149209d4b4b8d82693f33e4

SHA256
dcb259b7e68acbb3bbc4fad0e58d87a3e57187b0c88d3c9a44f3420d72c33ecf

SHA512
7a2983cd332b093f1813571116f1542835d2807d881f3f9325a6be4549ec6d8002a91024149541a95974545ae9013401ca00ea3adc52a9451b1c2c96f0e9dd74

Download Submit
C:\Windows\SysWOW64\nethtsrv.exe
Filesize
176KB

MD5
02bbe191c6a7f9eea91e6b2bb7d6465a

SHA1
7711c1459a2b3e92192e8112d6a5e9867204b876

SHA256
1df0c2f4ae8151e910e2ef962a9fd8698e811eb3f07484c3d377bc05e124700a

SHA512
b941ee6c7e26518bff140a0f368cca963d4ea3ae5946091101a487bbde1b8dce526e1c1f74706a85cadab2c9ead2944984011ef93e4c280bd6d10191eb61496f

Download Submit
C:\Windows\SysWOW64\nethtsrv.exe
Filesize
176KB

MD5
02bbe191c6a7f9eea91e6b2bb7d6465a

SHA1
7711c1459a2b3e92192e8112d6a5e9867204b876

SHA256
1df0c2f4ae8151e910e2ef962a9fd8698e811eb3f07484c3d377bc05e124700a

SHA512
b941ee6c7e26518bff140a0f368cca963d4ea3ae5946091101a487bbde1b8dce526e1c1f74706a85cadab2c9ead2944984011ef93e4c280bd6d10191eb61496f

Download Submit
C:\Windows\SysWOW64\netupdsrv.exe
Filesize
158KB

MD5
1183ba3b6a3ad39a7fec1d93dae6a646

SHA1
07187b0a8828f5b7bdc64f79e8fe0a1e1019dd37

SHA256
e6e9a7e31f28161d5369603bca3df31838627de2979dfa60e7ef151f556a97f7

SHA512
a24e6a8001626b4c8739b3ecf00e619ba0d3cbdd25c4a0cbb302b574f7ba01763f308daf92d2a1bde51c399bfee34e2865420c77fbbbfddc5b81c2697a353989

Download Submit
C:\Windows\SysWOW64\netupdsrv.exe
Filesize
158KB

MD5
1183ba3b6a3ad39a7fec1d93dae6a646

SHA1
07187b0a8828f5b7bdc64f79e8fe0a1e1019dd37

SHA256
e6e9a7e31f28161d5369603bca3df31838627de2979dfa60e7ef151f556a97f7

SHA512
a24e6a8001626b4c8739b3ecf00e619ba0d3cbdd25c4a0cbb302b574f7ba01763f308daf92d2a1bde51c399bfee34e2865420c77fbbbfddc5b81c2697a353989

Download Submit
\Users\Admin\AppData\Local\Temp\nsj6D95.tmp\System.dll
Filesize
11KB

MD5
c17103ae9072a06da581dec998343fc1

SHA1
b72148c6bdfaada8b8c3f950e610ee7cf1da1f8d

SHA256
dc58d8ad81cacb0c1ed72e33bff8f23ea40b5252b5bb55d393a0903e6819ae2f

SHA512
d32a71aaef18e993f28096d536e41c4d016850721b31171513ce28bbd805a54fd290b7c3e9d935f72e676a1acfb4f0dcc89d95040a0dd29f2b6975855c18986f

Download Submit
\Users\Admin\AppData\Local\Temp\nsj6D95.tmp\nsExec.dll
Filesize
6KB

MD5
acc2b699edfea5bf5aae45aba3a41e96

SHA1
d2accf4d494e43ceb2cff69abe4dd17147d29cc2

SHA256
168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e

SHA512
e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe

Download Submit
\Users\Admin\AppData\Local\Temp\nsj6D95.tmp\nsExec.dll
Filesize
6KB

MD5
acc2b699edfea5bf5aae45aba3a41e96

SHA1
d2accf4d494e43ceb2cff69abe4dd17147d29cc2

SHA256
168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e

SHA512
e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe

Download Submit
\Users\Admin\AppData\Local\Temp\nsj6D95.tmp\nsExec.dll
Filesize
6KB

MD5
acc2b699edfea5bf5aae45aba3a41e96

SHA1
d2accf4d494e43ceb2cff69abe4dd17147d29cc2

SHA256
168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e

SHA512
e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe

Download Submit
\Users\Admin\AppData\Local\Temp\nsj6D95.tmp\nsExec.dll
Filesize
6KB

MD5
acc2b699edfea5bf5aae45aba3a41e96

SHA1
d2accf4d494e43ceb2cff69abe4dd17147d29cc2

SHA256
168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e

SHA512
e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe

Download Submit
\Windows\SysWOW64\hfnapi.dll
Filesize
106KB

MD5
4fa103af3aa269d39ae918770a3554fe

SHA1
12a4d73d5c4a748364147347fb2ed337a2629676

SHA256
1a00155ae289c3d823e33e3fa6b69c24921b01e749597c04d078bef8b114bef1

SHA512
e1838c6cd48b562b6b5926400f3de91838c422ce759ad63756d72b9680ed0401d756fc5aabd1064d7c401add1e27550caa3e29e9c014bbbc196ec967fad9d85f

Download Submit
\Windows\SysWOW64\hfnapi.dll
Filesize
106KB

MD5
4fa103af3aa269d39ae918770a3554fe

SHA1
12a4d73d5c4a748364147347fb2ed337a2629676

SHA256
1a00155ae289c3d823e33e3fa6b69c24921b01e749597c04d078bef8b114bef1

SHA512
e1838c6cd48b562b6b5926400f3de91838c422ce759ad63756d72b9680ed0401d756fc5aabd1064d7c401add1e27550caa3e29e9c014bbbc196ec967fad9d85f

Download Submit
\Windows\SysWOW64\hfnapi.dll
Filesize
106KB

MD5
4fa103af3aa269d39ae918770a3554fe

SHA1
12a4d73d5c4a748364147347fb2ed337a2629676

SHA256
1a00155ae289c3d823e33e3fa6b69c24921b01e749597c04d078bef8b114bef1

SHA512
e1838c6cd48b562b6b5926400f3de91838c422ce759ad63756d72b9680ed0401d756fc5aabd1064d7c401add1e27550caa3e29e9c014bbbc196ec967fad9d85f

Download Submit
\Windows\SysWOW64\hfpapi.dll
Filesize
241KB

MD5
58e0aafaecf3c75c15686285a9f1da58

SHA1
1921ffb00f11d5b65f4c26ea11559a85a8832d72

SHA256
b4d52028ccc4afc828f5af70818e859529438912dd278179b96dd652e6e36f26

SHA512
ee0ffd47fc0e0cc3ebddd8137bcfc7173b0277bc6d8d33ce1bf70ad5e641a7b4f2c74746dbf1e4056f3e16a98a7718efc311ea5ed72bc788bf9f0657a57902ee

Download Submit
\Windows\SysWOW64\hfpapi.dll
Filesize
241KB

MD5
58e0aafaecf3c75c15686285a9f1da58

SHA1
1921ffb00f11d5b65f4c26ea11559a85a8832d72

SHA256
b4d52028ccc4afc828f5af70818e859529438912dd278179b96dd652e6e36f26

SHA512
ee0ffd47fc0e0cc3ebddd8137bcfc7173b0277bc6d8d33ce1bf70ad5e641a7b4f2c74746dbf1e4056f3e16a98a7718efc311ea5ed72bc788bf9f0657a57902ee

Download Submit
\Windows\SysWOW64\installd.exe
Filesize
108KB

MD5
97b8b88d726ab0cc5b5b1f694964c1ca

SHA1
b0c70d2dcd9467263149209d4b4b8d82693f33e4

SHA256
dcb259b7e68acbb3bbc4fad0e58d87a3e57187b0c88d3c9a44f3420d72c33ecf

SHA512
7a2983cd332b093f1813571116f1542835d2807d881f3f9325a6be4549ec6d8002a91024149541a95974545ae9013401ca00ea3adc52a9451b1c2c96f0e9dd74

Download Submit
\Windows\SysWOW64\nethtsrv.exe
Filesize
176KB

MD5
02bbe191c6a7f9eea91e6b2bb7d6465a

SHA1
7711c1459a2b3e92192e8112d6a5e9867204b876

SHA256
1df0c2f4ae8151e910e2ef962a9fd8698e811eb3f07484c3d377bc05e124700a

SHA512
b941ee6c7e26518bff140a0f368cca963d4ea3ae5946091101a487bbde1b8dce526e1c1f74706a85cadab2c9ead2944984011ef93e4c280bd6d10191eb61496f

Download Submit
\Windows\SysWOW64\netupdsrv.exe
Filesize
158KB

MD5
1183ba3b6a3ad39a7fec1d93dae6a646

SHA1
07187b0a8828f5b7bdc64f79e8fe0a1e1019dd37

SHA256
e6e9a7e31f28161d5369603bca3df31838627de2979dfa60e7ef151f556a97f7

SHA512
a24e6a8001626b4c8739b3ecf00e619ba0d3cbdd25c4a0cbb302b574f7ba01763f308daf92d2a1bde51c399bfee34e2865420c77fbbbfddc5b81c2697a353989

Download Submit
memory/532-71-0x0000000000000000-mapping.dmp

Download
memory/660-62-0x0000000000000000-mapping.dmp

Download
memory/736-81-0x0000000000000000-mapping.dmp

Download
memory/756-64-0x0000000000000000-mapping.dmp

Download
memory/940-88-0x0000000000000000-mapping.dmp

Download
memory/1252-77-0x0000000000000000-mapping.dmp

Download
memory/1408-58-0x0000000000000000-mapping.dmp

Download
memory/1528-82-0x0000000000000000-mapping.dmp

Download
memory/1556-87-0x0000000000000000-mapping.dmp

Download
memory/1632-54-0x0000000075BE1000-0x0000000075BE3000-memory.dmp

Filesize
8KB

Download
memory/1632-69-0x0000000000360000-0x00000000007BE000-memory.dmp

Filesize
4.4MB

Download
memory/1632-55-0x0000000000360000-0x00000000007BE000-memory.dmp

Filesize
4.4MB

Download
memory/1632-91-0x0000000000360000-0x00000000007BE000-memory.dmp

Filesize
4.4MB

Download
memory/1772-59-0x0000000000000000-mapping.dmp

Download
memory/1776-61-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads