42e701f99294b784445812bb6e707326c7c522dc5151e1c12f919ce47f53f1c7

Analysis

max time kernel
125s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
22/11/2022, 00:04

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
42e701f99294b784445812bb6e707326c7c522dc5151e1c12f919ce47f53f1c7.exe
Size 602KB
Sample221122-ac4lxacc86
SHA256 42e701f99294b784445812bb6e707326c7c522dc5151e1c12f919ce47f53f1c7
MD5 abb29007781aabcc01e554e44ee836cd
SHA1 c0e4852538a05b06c7f9a1613bf6745cc451f295
SHA512 7be312807efd4e50a8773eab1d4f1a0e38cf3cf4dd92b4ee1fdf764a304c9a0e717e52a37f263dbcd1fa491d42dd82b3cbbb6e7dea07d3f642b7b77e177a1b7c
SSDEEP 12288:KIny5DYTNv42uIexZ3s8bTktCxpN8dySx4y/isK0q:MUTN4ZIenl/ktgL8wVyK30q
MD5 SHA1 SHA512 SSDEEP

Score

8^/10

discovery

Malware Config

Signatures

Drops file in Drivers directory 1 IoCs

description	ioc	Process
File created	C:\Windows\system32\drivers\nethfdrv.sys	42e701f99294b784445812bb6e707326c7c522dc5151e1c12f919ce47f53f1c7.exe

Executes dropped EXE 5 IoCs

pid	Process
3980	installd.exe
4764	nethtsrv.exe
3124	netupdsrv.exe
4856	nethtsrv.exe
4852	netupdsrv.exe

Loads dropped DLL 14 IoCs

pid	Process
3008	42e701f99294b784445812bb6e707326c7c522dc5151e1c12f919ce47f53f1c7.exe
3008	42e701f99294b784445812bb6e707326c7c522dc5151e1c12f919ce47f53f1c7.exe
3008	42e701f99294b784445812bb6e707326c7c522dc5151e1c12f919ce47f53f1c7.exe
3008	42e701f99294b784445812bb6e707326c7c522dc5151e1c12f919ce47f53f1c7.exe
3008	42e701f99294b784445812bb6e707326c7c522dc5151e1c12f919ce47f53f1c7.exe
3980	installd.exe
4764	nethtsrv.exe
4764	nethtsrv.exe
3008	42e701f99294b784445812bb6e707326c7c522dc5151e1c12f919ce47f53f1c7.exe
3008	42e701f99294b784445812bb6e707326c7c522dc5151e1c12f919ce47f53f1c7.exe
4856	nethtsrv.exe
4856	nethtsrv.exe
3008	42e701f99294b784445812bb6e707326c7c522dc5151e1c12f919ce47f53f1c7.exe
3008	42e701f99294b784445812bb6e707326c7c522dc5151e1c12f919ce47f53f1c7.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in System32 directory 5 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\hfpapi.dll	42e701f99294b784445812bb6e707326c7c522dc5151e1c12f919ce47f53f1c7.exe
File created	C:\Windows\SysWOW64\installd.exe	42e701f99294b784445812bb6e707326c7c522dc5151e1c12f919ce47f53f1c7.exe
File created	C:\Windows\SysWOW64\nethtsrv.exe	42e701f99294b784445812bb6e707326c7c522dc5151e1c12f919ce47f53f1c7.exe
File created	C:\Windows\SysWOW64\netupdsrv.exe	42e701f99294b784445812bb6e707326c7c522dc5151e1c12f919ce47f53f1c7.exe
File created	C:\Windows\SysWOW64\hfnapi.dll	42e701f99294b784445812bb6e707326c7c522dc5151e1c12f919ce47f53f1c7.exe

Drops file in Program Files directory 3 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Common Files\Config\ver.xml	42e701f99294b784445812bb6e707326c7c522dc5151e1c12f919ce47f53f1c7.exe
File created	C:\Program Files (x86)\Common Files\config\uninstinethnfd.exe	42e701f99294b784445812bb6e707326c7c522dc5151e1c12f919ce47f53f1c7.exe
File created	C:\Program Files (x86)\Common Files\Config\data.xml	42e701f99294b784445812bb6e707326c7c522dc5151e1c12f919ce47f53f1c7.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies data under HKEY_USERS 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	nethtsrv.exe

Runs net.exe

Suspicious behavior: LoadsDriver 1 IoCs

pid	Process
672	Process not Found

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4856	nethtsrv.exe

Suspicious use of WriteProcessMemory 33 IoCs

description	pid	Process	procid_target
PID 3008 wrote to memory of 2032	3008	42e701f99294b784445812bb6e707326c7c522dc5151e1c12f919ce47f53f1c7.exe	83
PID 3008 wrote to memory of 2032	3008	42e701f99294b784445812bb6e707326c7c522dc5151e1c12f919ce47f53f1c7.exe	83
PID 3008 wrote to memory of 2032	3008	42e701f99294b784445812bb6e707326c7c522dc5151e1c12f919ce47f53f1c7.exe	83
PID 2032 wrote to memory of 3740	2032	net.exe	85
PID 2032 wrote to memory of 3740	2032	net.exe	85
PID 2032 wrote to memory of 3740	2032	net.exe	85
PID 3008 wrote to memory of 2872	3008	42e701f99294b784445812bb6e707326c7c522dc5151e1c12f919ce47f53f1c7.exe	86
PID 3008 wrote to memory of 2872	3008	42e701f99294b784445812bb6e707326c7c522dc5151e1c12f919ce47f53f1c7.exe	86
PID 3008 wrote to memory of 2872	3008	42e701f99294b784445812bb6e707326c7c522dc5151e1c12f919ce47f53f1c7.exe	86
PID 2872 wrote to memory of 3984	2872	net.exe	88
PID 2872 wrote to memory of 3984	2872	net.exe	88
PID 2872 wrote to memory of 3984	2872	net.exe	88
PID 3008 wrote to memory of 3980	3008	42e701f99294b784445812bb6e707326c7c522dc5151e1c12f919ce47f53f1c7.exe	89
PID 3008 wrote to memory of 3980	3008	42e701f99294b784445812bb6e707326c7c522dc5151e1c12f919ce47f53f1c7.exe	89
PID 3008 wrote to memory of 3980	3008	42e701f99294b784445812bb6e707326c7c522dc5151e1c12f919ce47f53f1c7.exe	89
PID 3008 wrote to memory of 4764	3008	42e701f99294b784445812bb6e707326c7c522dc5151e1c12f919ce47f53f1c7.exe	90
PID 3008 wrote to memory of 4764	3008	42e701f99294b784445812bb6e707326c7c522dc5151e1c12f919ce47f53f1c7.exe	90
PID 3008 wrote to memory of 4764	3008	42e701f99294b784445812bb6e707326c7c522dc5151e1c12f919ce47f53f1c7.exe	90
PID 3008 wrote to memory of 3124	3008	42e701f99294b784445812bb6e707326c7c522dc5151e1c12f919ce47f53f1c7.exe	92
PID 3008 wrote to memory of 3124	3008	42e701f99294b784445812bb6e707326c7c522dc5151e1c12f919ce47f53f1c7.exe	92
PID 3008 wrote to memory of 3124	3008	42e701f99294b784445812bb6e707326c7c522dc5151e1c12f919ce47f53f1c7.exe	92
PID 3008 wrote to memory of 3200	3008	42e701f99294b784445812bb6e707326c7c522dc5151e1c12f919ce47f53f1c7.exe	94
PID 3008 wrote to memory of 3200	3008	42e701f99294b784445812bb6e707326c7c522dc5151e1c12f919ce47f53f1c7.exe	94
PID 3008 wrote to memory of 3200	3008	42e701f99294b784445812bb6e707326c7c522dc5151e1c12f919ce47f53f1c7.exe	94
PID 3200 wrote to memory of 4948	3200	net.exe	96
PID 3200 wrote to memory of 4948	3200	net.exe	96
PID 3200 wrote to memory of 4948	3200	net.exe	96
PID 3008 wrote to memory of 2412	3008	42e701f99294b784445812bb6e707326c7c522dc5151e1c12f919ce47f53f1c7.exe	98
PID 3008 wrote to memory of 2412	3008	42e701f99294b784445812bb6e707326c7c522dc5151e1c12f919ce47f53f1c7.exe	98
PID 3008 wrote to memory of 2412	3008	42e701f99294b784445812bb6e707326c7c522dc5151e1c12f919ce47f53f1c7.exe	98
PID 2412 wrote to memory of 4560	2412	net.exe	100
PID 2412 wrote to memory of 4560	2412	net.exe	100
PID 2412 wrote to memory of 4560	2412	net.exe	100

C:\Users\Admin\AppData\Local\Temp\42e701f99294b784445812bb6e707326c7c522dc5151e1c12f919ce47f53f1c7.exe
"C:\Users\Admin\AppData\Local\Temp\42e701f99294b784445812bb6e707326c7c522dc5151e1c12f919ce47f53f1c7.exe"
1⤵
- Drops file in Drivers directory
- Loads dropped DLL
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:3008
- C:\Windows\SysWOW64\net.exe
  net stop nethttpservice
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2032
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop nethttpservice
    3⤵
    PID:3740
- C:\Windows\SysWOW64\net.exe
  net stop serviceupdater
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2872
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop serviceupdater
    3⤵
    PID:3984
- C:\Windows\SysWOW64\installd.exe
  "C:\Windows\system32\installd.exe" nethfdrv
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:3980
- C:\Windows\SysWOW64\nethtsrv.exe
  "C:\Windows\system32\nethtsrv.exe" -nfdi
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:4764
- C:\Windows\SysWOW64\netupdsrv.exe
  "C:\Windows\system32\netupdsrv.exe" -nfdi
  2⤵
  - Executes dropped EXE
  PID:3124
- C:\Windows\SysWOW64\net.exe
  net start nethttpservice
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3200
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 start nethttpservice
    3⤵
    PID:4948
- C:\Windows\SysWOW64\net.exe
  net start serviceupdater
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2412
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 start serviceupdater
    3⤵
    PID:4560

C:\Windows\SysWOW64\nethtsrv.exe
C:\Windows\SysWOW64\nethtsrv.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:4856

C:\Windows\SysWOW64\netupdsrv.exe
C:\Windows\SysWOW64\netupdsrv.exe
1⤵
- Executes dropped EXE
PID:4852

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

System.dll

Path C:\Users\Admin\AppData\Local\Temp\nsbCAC9.tmp\System.dll
Size 11KB
SHA256 dc58d8ad81cacb0c1ed72e33bff8f23ea40b5252b5bb55d393a0903e6819ae2f
MD5 c17103ae9072a06da581dec998343fc1
SHA1 b72148c6bdfaada8b8c3f950e610ee7cf1da1f8d
SHA512 d32a71aaef18e993f28096d536e41c4d016850721b31171513ce28bbd805a54fd290b7c3e9d935f72e676a1acfb4f0dcc89d95040a0dd29f2b6975855c18986f
SSDEEP 192:7DKnJZCv6VmbJQC+tFiUdK7ckD4gRXKQx+LQ2CSF:7ViJrtFRdbmXK8+PCw
MD5 SHA1 SHA512 SSDEEP

Submit Download

nsExec.dll

Path C:\Users\Admin\AppData\Local\Temp\nsbCAC9.tmp\nsExec.dll
Size 6KB
SHA256 168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e
MD5 acc2b699edfea5bf5aae45aba3a41e96
SHA1 d2accf4d494e43ceb2cff69abe4dd17147d29cc2
SHA512 e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe
SSDEEP 96:M7GUb+YNfwgcr8zyKwZ5S4JxN8BS0ef9/3VI9d0qqyVgNk32E:eKgfwgcr8zylsB49Ud0qJVgNX
MD5 SHA1 SHA512 SSDEEP

Submit Download

nsExec.dll

Path C:\Users\Admin\AppData\Local\Temp\nsbCAC9.tmp\nsExec.dll
Size 6KB
SHA256 168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e
MD5 acc2b699edfea5bf5aae45aba3a41e96
SHA1 d2accf4d494e43ceb2cff69abe4dd17147d29cc2
SHA512 e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe
SSDEEP 96:M7GUb+YNfwgcr8zyKwZ5S4JxN8BS0ef9/3VI9d0qqyVgNk32E:eKgfwgcr8zylsB49Ud0qJVgNX
MD5 SHA1 SHA512 SSDEEP

Submit Download

nsExec.dll

Path C:\Users\Admin\AppData\Local\Temp\nsbCAC9.tmp\nsExec.dll
Size 6KB
SHA256 168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e
MD5 acc2b699edfea5bf5aae45aba3a41e96
SHA1 d2accf4d494e43ceb2cff69abe4dd17147d29cc2
SHA512 e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe
SSDEEP 96:M7GUb+YNfwgcr8zyKwZ5S4JxN8BS0ef9/3VI9d0qqyVgNk32E:eKgfwgcr8zylsB49Ud0qJVgNX
MD5 SHA1 SHA512 SSDEEP

Submit Download

nsExec.dll

Path C:\Users\Admin\AppData\Local\Temp\nsbCAC9.tmp\nsExec.dll
Size 6KB
SHA256 168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e
MD5 acc2b699edfea5bf5aae45aba3a41e96
SHA1 d2accf4d494e43ceb2cff69abe4dd17147d29cc2
SHA512 e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe
SSDEEP 96:M7GUb+YNfwgcr8zyKwZ5S4JxN8BS0ef9/3VI9d0qqyVgNk32E:eKgfwgcr8zylsB49Ud0qJVgNX
MD5 SHA1 SHA512 SSDEEP

Submit Download

nsExec.dll

Path C:\Users\Admin\AppData\Local\Temp\nsbCAC9.tmp\nsExec.dll
Size 6KB
SHA256 168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e
MD5 acc2b699edfea5bf5aae45aba3a41e96
SHA1 d2accf4d494e43ceb2cff69abe4dd17147d29cc2
SHA512 e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe
SSDEEP 96:M7GUb+YNfwgcr8zyKwZ5S4JxN8BS0ef9/3VI9d0qqyVgNk32E:eKgfwgcr8zylsB49Ud0qJVgNX
MD5 SHA1 SHA512 SSDEEP

Submit Download

nsExec.dll

Path C:\Users\Admin\AppData\Local\Temp\nsbCAC9.tmp\nsExec.dll
Size 6KB
SHA256 168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e
MD5 acc2b699edfea5bf5aae45aba3a41e96
SHA1 d2accf4d494e43ceb2cff69abe4dd17147d29cc2
SHA512 e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe
SSDEEP 96:M7GUb+YNfwgcr8zyKwZ5S4JxN8BS0ef9/3VI9d0qqyVgNk32E:eKgfwgcr8zylsB49Ud0qJVgNX
MD5 SHA1 SHA512 SSDEEP

Submit Download

nsExec.dll

Path C:\Users\Admin\AppData\Local\Temp\nsbCAC9.tmp\nsExec.dll
Size 6KB
SHA256 168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e
MD5 acc2b699edfea5bf5aae45aba3a41e96
SHA1 d2accf4d494e43ceb2cff69abe4dd17147d29cc2
SHA512 e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe
SSDEEP 96:M7GUb+YNfwgcr8zyKwZ5S4JxN8BS0ef9/3VI9d0qqyVgNk32E:eKgfwgcr8zylsB49Ud0qJVgNX
MD5 SHA1 SHA512 SSDEEP

Submit Download

nsExec.dll

Path C:\Users\Admin\AppData\Local\Temp\nsbCAC9.tmp\nsExec.dll
Size 6KB
SHA256 168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e
MD5 acc2b699edfea5bf5aae45aba3a41e96
SHA1 d2accf4d494e43ceb2cff69abe4dd17147d29cc2
SHA512 e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe
SSDEEP 96:M7GUb+YNfwgcr8zyKwZ5S4JxN8BS0ef9/3VI9d0qqyVgNk32E:eKgfwgcr8zylsB49Ud0qJVgNX
MD5 SHA1 SHA512 SSDEEP

Submit Download

hfnapi.dll

Path C:\Windows\SysWOW64\hfnapi.dll
Size 106KB
SHA256 a558e29ba9773f14d37bac92cc3798e83430df234083581897187b4ee569f01b
MD5 ad7e3bc82b29f3918dc3c84bfd8a57f5
SHA1 6ad25b9b73cee13c97bec4d1c5db732fd3899398
SHA512 87b9c47f93a6c0460fc72e6fdca2d4d72fe72b1f63e12cc318f6b0a88d3fa1192045536f8f2b0a7629e1085182b77ace158ae86b309e34432e0c6b681297257d
SSDEEP 1536:2xT29gA9Fx64FvIiR/C2xwb6ewMdDA8/p6IH50nGVskUtxElLU3D1bQDQTV:Oub/xHFvIiRz9eQE93iwL8D+u
MD5 SHA1 SHA512 SSDEEP

Submit Download

hfnapi.dll

Path C:\Windows\SysWOW64\hfnapi.dll
Size 106KB
SHA256 a558e29ba9773f14d37bac92cc3798e83430df234083581897187b4ee569f01b
MD5 ad7e3bc82b29f3918dc3c84bfd8a57f5
SHA1 6ad25b9b73cee13c97bec4d1c5db732fd3899398
SHA512 87b9c47f93a6c0460fc72e6fdca2d4d72fe72b1f63e12cc318f6b0a88d3fa1192045536f8f2b0a7629e1085182b77ace158ae86b309e34432e0c6b681297257d
SSDEEP 1536:2xT29gA9Fx64FvIiR/C2xwb6ewMdDA8/p6IH50nGVskUtxElLU3D1bQDQTV:Oub/xHFvIiRz9eQE93iwL8D+u
MD5 SHA1 SHA512 SSDEEP

Submit Download

hfnapi.dll

Path C:\Windows\SysWOW64\hfnapi.dll
Size 106KB
SHA256 a558e29ba9773f14d37bac92cc3798e83430df234083581897187b4ee569f01b
MD5 ad7e3bc82b29f3918dc3c84bfd8a57f5
SHA1 6ad25b9b73cee13c97bec4d1c5db732fd3899398
SHA512 87b9c47f93a6c0460fc72e6fdca2d4d72fe72b1f63e12cc318f6b0a88d3fa1192045536f8f2b0a7629e1085182b77ace158ae86b309e34432e0c6b681297257d
SSDEEP 1536:2xT29gA9Fx64FvIiR/C2xwb6ewMdDA8/p6IH50nGVskUtxElLU3D1bQDQTV:Oub/xHFvIiRz9eQE93iwL8D+u
MD5 SHA1 SHA512 SSDEEP

Submit Download

hfnapi.dll

Path C:\Windows\SysWOW64\hfnapi.dll
Size 106KB
SHA256 a558e29ba9773f14d37bac92cc3798e83430df234083581897187b4ee569f01b
MD5 ad7e3bc82b29f3918dc3c84bfd8a57f5
SHA1 6ad25b9b73cee13c97bec4d1c5db732fd3899398
SHA512 87b9c47f93a6c0460fc72e6fdca2d4d72fe72b1f63e12cc318f6b0a88d3fa1192045536f8f2b0a7629e1085182b77ace158ae86b309e34432e0c6b681297257d
SSDEEP 1536:2xT29gA9Fx64FvIiR/C2xwb6ewMdDA8/p6IH50nGVskUtxElLU3D1bQDQTV:Oub/xHFvIiRz9eQE93iwL8D+u
MD5 SHA1 SHA512 SSDEEP

Submit Download

hfpapi.dll

Path C:\Windows\SysWOW64\hfpapi.dll
Size 241KB
SHA256 5c67222f3b330f20b8ea47c627b634b1fcf39beeabb72578ae0599826260f5f2
MD5 daf454f8c5cec1109e7b910ad3de8fd2
SHA1 45c91beaa1c176a407bd9c43106bed74192d0395
SHA512 6e15c84bd4e3f78ae4414b9ab94130b96b1238c90b8020698a4b8ae550235d9153f890b29e843144571924eb36d7adb95d99c2de3b9d700865c4f1896a5b16bc
SSDEEP 3072:uZEaMzvkP9PQ8i/cSnoyZU4QsYmCX5amXXXFXiKBG3ZCilPWtv4TBfrgm8J87Ags:uZaPx/bnCNMq5V/BkZCiUtv4TBT/8
MD5 SHA1 SHA512 SSDEEP

Submit Download

hfpapi.dll

Path C:\Windows\SysWOW64\hfpapi.dll
Size 241KB
SHA256 5c67222f3b330f20b8ea47c627b634b1fcf39beeabb72578ae0599826260f5f2
MD5 daf454f8c5cec1109e7b910ad3de8fd2
SHA1 45c91beaa1c176a407bd9c43106bed74192d0395
SHA512 6e15c84bd4e3f78ae4414b9ab94130b96b1238c90b8020698a4b8ae550235d9153f890b29e843144571924eb36d7adb95d99c2de3b9d700865c4f1896a5b16bc
SSDEEP 3072:uZEaMzvkP9PQ8i/cSnoyZU4QsYmCX5amXXXFXiKBG3ZCilPWtv4TBfrgm8J87Ags:uZaPx/bnCNMq5V/BkZCiUtv4TBT/8
MD5 SHA1 SHA512 SSDEEP

Submit Download

hfpapi.dll

Path C:\Windows\SysWOW64\hfpapi.dll
Size 241KB
SHA256 5c67222f3b330f20b8ea47c627b634b1fcf39beeabb72578ae0599826260f5f2
MD5 daf454f8c5cec1109e7b910ad3de8fd2
SHA1 45c91beaa1c176a407bd9c43106bed74192d0395
SHA512 6e15c84bd4e3f78ae4414b9ab94130b96b1238c90b8020698a4b8ae550235d9153f890b29e843144571924eb36d7adb95d99c2de3b9d700865c4f1896a5b16bc
SSDEEP 3072:uZEaMzvkP9PQ8i/cSnoyZU4QsYmCX5amXXXFXiKBG3ZCilPWtv4TBfrgm8J87Ags:uZaPx/bnCNMq5V/BkZCiUtv4TBT/8
MD5 SHA1 SHA512 SSDEEP

Submit Download

installd.exe

Path C:\Windows\SysWOW64\installd.exe
Size 108KB
SHA256 232a9a843e32a0540071057f57b6e76b74bc5020db7ebb3b6cb2552c3fd20ead
MD5 59a9b9b867cd2dd3a776206ebd9d3ed0
SHA1 29fcc583950989b36a0b6838283d94612f04b8a6
SHA512 fd28a0df2eff1ce282d5d5e086f37e64dd25f7fccf2bc42504905c2f054da1460d2bc154d6776d63a84c2974a0b373a527af503ca3a1d1a2b8bbc5ccbcd8ca8f
SSDEEP 1536:5gjhjNsOSOuBSTzkKByhy1yYWquB5QrN1MKzogDnFhzkAMxUViYP1:5gjhjCOZGCyhy1y3MMTgrHMxoiYP1
MD5 SHA1 SHA512 SSDEEP

Submit Download

installd.exe

Path C:\Windows\SysWOW64\installd.exe
Size 108KB
SHA256 232a9a843e32a0540071057f57b6e76b74bc5020db7ebb3b6cb2552c3fd20ead
MD5 59a9b9b867cd2dd3a776206ebd9d3ed0
SHA1 29fcc583950989b36a0b6838283d94612f04b8a6
SHA512 fd28a0df2eff1ce282d5d5e086f37e64dd25f7fccf2bc42504905c2f054da1460d2bc154d6776d63a84c2974a0b373a527af503ca3a1d1a2b8bbc5ccbcd8ca8f
SSDEEP 1536:5gjhjNsOSOuBSTzkKByhy1yYWquB5QrN1MKzogDnFhzkAMxUViYP1:5gjhjCOZGCyhy1y3MMTgrHMxoiYP1
MD5 SHA1 SHA512 SSDEEP

Submit Download

nethtsrv.exe

Path C:\Windows\SysWOW64\nethtsrv.exe
Size 176KB
SHA256 ce486fe528d01fc8816bcf097cac120920ac54086c86b6cc393bc4171b5e4890
MD5 03cb7d5a667a68b75608ff59388cacf1
SHA1 5aa94c13e8cde8df00590d07be39a7aa288746e6
SHA512 0e4c4e81f7a826906d26698f66169a45927ce45c9f92279ed5c47b40345efced3ccb0a7587cbfadc9c4bceac95e1c2da005574b0ecb28ff2ac4a82f9a4cd68a0
SSDEEP 3072:TOLv+IUyla4MeKzDGFvABZqAE0UdZwtrM1jnz23W45w2ss7cCOZP21ZQ:Wv+IUa7RCDGdeZqqU3w5Enz23fMs
MD5 SHA1 SHA512 SSDEEP

Submit Download

nethtsrv.exe

Path C:\Windows\SysWOW64\nethtsrv.exe
Size 176KB
SHA256 ce486fe528d01fc8816bcf097cac120920ac54086c86b6cc393bc4171b5e4890
MD5 03cb7d5a667a68b75608ff59388cacf1
SHA1 5aa94c13e8cde8df00590d07be39a7aa288746e6
SHA512 0e4c4e81f7a826906d26698f66169a45927ce45c9f92279ed5c47b40345efced3ccb0a7587cbfadc9c4bceac95e1c2da005574b0ecb28ff2ac4a82f9a4cd68a0
SSDEEP 3072:TOLv+IUyla4MeKzDGFvABZqAE0UdZwtrM1jnz23W45w2ss7cCOZP21ZQ:Wv+IUa7RCDGdeZqqU3w5Enz23fMs
MD5 SHA1 SHA512 SSDEEP

Submit Download

nethtsrv.exe

Path C:\Windows\SysWOW64\nethtsrv.exe
Size 176KB
SHA256 ce486fe528d01fc8816bcf097cac120920ac54086c86b6cc393bc4171b5e4890
MD5 03cb7d5a667a68b75608ff59388cacf1
SHA1 5aa94c13e8cde8df00590d07be39a7aa288746e6
SHA512 0e4c4e81f7a826906d26698f66169a45927ce45c9f92279ed5c47b40345efced3ccb0a7587cbfadc9c4bceac95e1c2da005574b0ecb28ff2ac4a82f9a4cd68a0
SSDEEP 3072:TOLv+IUyla4MeKzDGFvABZqAE0UdZwtrM1jnz23W45w2ss7cCOZP21ZQ:Wv+IUa7RCDGdeZqqU3w5Enz23fMs
MD5 SHA1 SHA512 SSDEEP

Submit Download

netupdsrv.exe

Path C:\Windows\SysWOW64\netupdsrv.exe
Size 158KB
SHA256 de260aaebe531d0b36c05513831e9af8e114cae7ff71bbfa9d04228311fca723
MD5 bd93fa649e7ea8c1566bbe220af7b196
SHA1 1f069fb8557f76a12e659a7dc2c4401c80ba913d
SHA512 dd5a48a72c7e3ca19a65396e521e57a10c82be18c757d488d79abd342c22515cbce61469b91a64796bb29c82c78cf760354b11a0be697968e97e9ac83b25d0a2
SSDEEP 3072:6OJWNPW5UJeETZgnnfoID5QrJnu6da8mi4a3YU/1GiF+pAqfA/OZw:dJWlW5UJeCZ8nbsnTNmi4cYU/1tNmC
MD5 SHA1 SHA512 SSDEEP

Submit Download

netupdsrv.exe

Path C:\Windows\SysWOW64\netupdsrv.exe
Size 158KB
SHA256 de260aaebe531d0b36c05513831e9af8e114cae7ff71bbfa9d04228311fca723
MD5 bd93fa649e7ea8c1566bbe220af7b196
SHA1 1f069fb8557f76a12e659a7dc2c4401c80ba913d
SHA512 dd5a48a72c7e3ca19a65396e521e57a10c82be18c757d488d79abd342c22515cbce61469b91a64796bb29c82c78cf760354b11a0be697968e97e9ac83b25d0a2
SSDEEP 3072:6OJWNPW5UJeETZgnnfoID5QrJnu6da8mi4a3YU/1GiF+pAqfA/OZw:dJWlW5UJeCZ8nbsnTNmi4cYU/1tNmC
MD5 SHA1 SHA512 SSDEEP

Submit Download

netupdsrv.exe

Path C:\Windows\SysWOW64\netupdsrv.exe
Size 158KB
SHA256 de260aaebe531d0b36c05513831e9af8e114cae7ff71bbfa9d04228311fca723
MD5 bd93fa649e7ea8c1566bbe220af7b196
SHA1 1f069fb8557f76a12e659a7dc2c4401c80ba913d
SHA512 dd5a48a72c7e3ca19a65396e521e57a10c82be18c757d488d79abd342c22515cbce61469b91a64796bb29c82c78cf760354b11a0be697968e97e9ac83b25d0a2
SSDEEP 3072:6OJWNPW5UJeETZgnnfoID5QrJnu6da8mi4a3YU/1GiF+pAqfA/OZw:dJWlW5UJeCZ8nbsnTNmi4cYU/1tNmC
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/3008-168-0x0000000000360000-0x00000000007BE000-memory.dmp

Download

memory/3008-137-0x0000000000360000-0x00000000007BE000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads