f3d819c88b12186a1cd2b702ccbef758ea9b7995e1cc2faf2c722e5c89562559

Analysis

max time kernel
48s
max time network
34s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
23-11-2022 10:07

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

f3d819c88b12186a1cd2b702ccbef758ea9b7995e1cc2faf2c722e5c89562559.exe
Size

602KB
MD5

99a15d135b09ca74571a70be3ed80a04
SHA1

42045cca30b57a42cafa45ed8e643128d0ee86b1
SHA256

f3d819c88b12186a1cd2b702ccbef758ea9b7995e1cc2faf2c722e5c89562559
SHA512

06856c3e30cb0d68a2d86a61b9a61cab7fc6c608c1505f57f5c935586897c30099b0c4bafde262afbf865ca5b4dd168a23db1cc0db64c91c2747cf002e5375fd
SSDEEP

12288:/Iny5DYTZIspwUtOSAghYrKHO2YWE+e3zKd60UDIkgkxT/H4kDC5:nUTZjp3ZbhnHcWKzKd60UD9gkv4l5

Score

8^/10

discovery

Malware Config

Signatures

Drops file in Drivers directory 1 IoCs

Processes:

f3d819c88b12186a1cd2b702ccbef758ea9b7995e1cc2faf2c722e5c89562559.exe

description ioc process

File created C:\Windows\system32\drivers\nethfdrv.sys f3d819c88b12186a1cd2b702ccbef758ea9b7995e1cc2faf2c722e5c89562559.exe
Executes dropped EXE 5 IoCs

Processes:

installd.exenethtsrv.exenetupdsrv.exenethtsrv.exenetupdsrv.exe

pid process

608 installd.exe
1680 nethtsrv.exe
1924 netupdsrv.exe
1876 nethtsrv.exe
1308 netupdsrv.exe

description	ioc	process
File created	C:\Windows\system32\drivers\nethfdrv.sys	f3d819c88b12186a1cd2b702ccbef758ea9b7995e1cc2faf2c722e5c89562559.exe

pid	process
608	installd.exe
1680	nethtsrv.exe
1924	netupdsrv.exe
1876	nethtsrv.exe
1308	netupdsrv.exe

Loads dropped DLL 13 IoCs

Processes:

f3d819c88b12186a1cd2b702ccbef758ea9b7995e1cc2faf2c722e5c89562559.exeinstalld.exenethtsrv.exenethtsrv.exe

pid	process
1472	f3d819c88b12186a1cd2b702ccbef758ea9b7995e1cc2faf2c722e5c89562559.exe
1472	f3d819c88b12186a1cd2b702ccbef758ea9b7995e1cc2faf2c722e5c89562559.exe
1472	f3d819c88b12186a1cd2b702ccbef758ea9b7995e1cc2faf2c722e5c89562559.exe
1472	f3d819c88b12186a1cd2b702ccbef758ea9b7995e1cc2faf2c722e5c89562559.exe
608	installd.exe
1472	f3d819c88b12186a1cd2b702ccbef758ea9b7995e1cc2faf2c722e5c89562559.exe
1680	nethtsrv.exe
1680	nethtsrv.exe
1472	f3d819c88b12186a1cd2b702ccbef758ea9b7995e1cc2faf2c722e5c89562559.exe
1472	f3d819c88b12186a1cd2b702ccbef758ea9b7995e1cc2faf2c722e5c89562559.exe
1876	nethtsrv.exe
1876	nethtsrv.exe
1472	f3d819c88b12186a1cd2b702ccbef758ea9b7995e1cc2faf2c722e5c89562559.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in System32 directory 5 IoCs

Processes:

f3d819c88b12186a1cd2b702ccbef758ea9b7995e1cc2faf2c722e5c89562559.exe

description	ioc	process
File created	C:\Windows\SysWOW64\nethtsrv.exe	f3d819c88b12186a1cd2b702ccbef758ea9b7995e1cc2faf2c722e5c89562559.exe
File created	C:\Windows\SysWOW64\netupdsrv.exe	f3d819c88b12186a1cd2b702ccbef758ea9b7995e1cc2faf2c722e5c89562559.exe
File created	C:\Windows\SysWOW64\hfnapi.dll	f3d819c88b12186a1cd2b702ccbef758ea9b7995e1cc2faf2c722e5c89562559.exe
File created	C:\Windows\SysWOW64\hfpapi.dll	f3d819c88b12186a1cd2b702ccbef758ea9b7995e1cc2faf2c722e5c89562559.exe
File created	C:\Windows\SysWOW64\installd.exe	f3d819c88b12186a1cd2b702ccbef758ea9b7995e1cc2faf2c722e5c89562559.exe

Drops file in Program Files directory 3 IoCs

Processes:

f3d819c88b12186a1cd2b702ccbef758ea9b7995e1cc2faf2c722e5c89562559.exe

description	ioc	process
File created	C:\Program Files (x86)\Common Files\Config\data.xml	f3d819c88b12186a1cd2b702ccbef758ea9b7995e1cc2faf2c722e5c89562559.exe
File created	C:\Program Files (x86)\Common Files\Config\ver.xml	f3d819c88b12186a1cd2b702ccbef758ea9b7995e1cc2faf2c722e5c89562559.exe
File created	C:\Program Files (x86)\Common Files\config\uninstinethnfd.exe	f3d819c88b12186a1cd2b702ccbef758ea9b7995e1cc2faf2c722e5c89562559.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Runs net.exe
Suspicious behavior: LoadsDriver 1 IoCs

Processes:

pid process

468
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

nethtsrv.exe

description pid process

Token: SeDebugPrivilege 1876 nethtsrv.exe

pid	process
468

description	pid	process
Token: SeDebugPrivilege	1876	nethtsrv.exe

Suspicious use of WriteProcessMemory 50 IoCs

Processes:

f3d819c88b12186a1cd2b702ccbef758ea9b7995e1cc2faf2c722e5c89562559.exenet.exenet.exenet.exenet.exe

description	pid	process	target process
PID 1472 wrote to memory of 320	1472	f3d819c88b12186a1cd2b702ccbef758ea9b7995e1cc2faf2c722e5c89562559.exe	net.exe
PID 1472 wrote to memory of 320	1472	f3d819c88b12186a1cd2b702ccbef758ea9b7995e1cc2faf2c722e5c89562559.exe	net.exe
PID 1472 wrote to memory of 320	1472	f3d819c88b12186a1cd2b702ccbef758ea9b7995e1cc2faf2c722e5c89562559.exe	net.exe
PID 1472 wrote to memory of 320	1472	f3d819c88b12186a1cd2b702ccbef758ea9b7995e1cc2faf2c722e5c89562559.exe	net.exe
PID 320 wrote to memory of 672	320	net.exe	net1.exe
PID 320 wrote to memory of 672	320	net.exe	net1.exe
PID 320 wrote to memory of 672	320	net.exe	net1.exe
PID 320 wrote to memory of 672	320	net.exe	net1.exe
PID 1472 wrote to memory of 588	1472	f3d819c88b12186a1cd2b702ccbef758ea9b7995e1cc2faf2c722e5c89562559.exe	net.exe
PID 1472 wrote to memory of 588	1472	f3d819c88b12186a1cd2b702ccbef758ea9b7995e1cc2faf2c722e5c89562559.exe	net.exe
PID 1472 wrote to memory of 588	1472	f3d819c88b12186a1cd2b702ccbef758ea9b7995e1cc2faf2c722e5c89562559.exe	net.exe
PID 1472 wrote to memory of 588	1472	f3d819c88b12186a1cd2b702ccbef758ea9b7995e1cc2faf2c722e5c89562559.exe	net.exe
PID 588 wrote to memory of 1820	588	net.exe	net1.exe
PID 588 wrote to memory of 1820	588	net.exe	net1.exe
PID 588 wrote to memory of 1820	588	net.exe	net1.exe
PID 588 wrote to memory of 1820	588	net.exe	net1.exe
PID 1472 wrote to memory of 608	1472	f3d819c88b12186a1cd2b702ccbef758ea9b7995e1cc2faf2c722e5c89562559.exe	installd.exe
PID 1472 wrote to memory of 608	1472	f3d819c88b12186a1cd2b702ccbef758ea9b7995e1cc2faf2c722e5c89562559.exe	installd.exe
PID 1472 wrote to memory of 608	1472	f3d819c88b12186a1cd2b702ccbef758ea9b7995e1cc2faf2c722e5c89562559.exe	installd.exe
PID 1472 wrote to memory of 608	1472	f3d819c88b12186a1cd2b702ccbef758ea9b7995e1cc2faf2c722e5c89562559.exe	installd.exe
PID 1472 wrote to memory of 608	1472	f3d819c88b12186a1cd2b702ccbef758ea9b7995e1cc2faf2c722e5c89562559.exe	installd.exe
PID 1472 wrote to memory of 608	1472	f3d819c88b12186a1cd2b702ccbef758ea9b7995e1cc2faf2c722e5c89562559.exe	installd.exe
PID 1472 wrote to memory of 608	1472	f3d819c88b12186a1cd2b702ccbef758ea9b7995e1cc2faf2c722e5c89562559.exe	installd.exe
PID 1472 wrote to memory of 1680	1472	f3d819c88b12186a1cd2b702ccbef758ea9b7995e1cc2faf2c722e5c89562559.exe	nethtsrv.exe
PID 1472 wrote to memory of 1680	1472	f3d819c88b12186a1cd2b702ccbef758ea9b7995e1cc2faf2c722e5c89562559.exe	nethtsrv.exe
PID 1472 wrote to memory of 1680	1472	f3d819c88b12186a1cd2b702ccbef758ea9b7995e1cc2faf2c722e5c89562559.exe	nethtsrv.exe
PID 1472 wrote to memory of 1680	1472	f3d819c88b12186a1cd2b702ccbef758ea9b7995e1cc2faf2c722e5c89562559.exe	nethtsrv.exe
PID 1472 wrote to memory of 1924	1472	f3d819c88b12186a1cd2b702ccbef758ea9b7995e1cc2faf2c722e5c89562559.exe	netupdsrv.exe
PID 1472 wrote to memory of 1924	1472	f3d819c88b12186a1cd2b702ccbef758ea9b7995e1cc2faf2c722e5c89562559.exe	netupdsrv.exe
PID 1472 wrote to memory of 1924	1472	f3d819c88b12186a1cd2b702ccbef758ea9b7995e1cc2faf2c722e5c89562559.exe	netupdsrv.exe
PID 1472 wrote to memory of 1924	1472	f3d819c88b12186a1cd2b702ccbef758ea9b7995e1cc2faf2c722e5c89562559.exe	netupdsrv.exe
PID 1472 wrote to memory of 1924	1472	f3d819c88b12186a1cd2b702ccbef758ea9b7995e1cc2faf2c722e5c89562559.exe	netupdsrv.exe
PID 1472 wrote to memory of 1924	1472	f3d819c88b12186a1cd2b702ccbef758ea9b7995e1cc2faf2c722e5c89562559.exe	netupdsrv.exe
PID 1472 wrote to memory of 1924	1472	f3d819c88b12186a1cd2b702ccbef758ea9b7995e1cc2faf2c722e5c89562559.exe	netupdsrv.exe
PID 1472 wrote to memory of 1288	1472	f3d819c88b12186a1cd2b702ccbef758ea9b7995e1cc2faf2c722e5c89562559.exe	net.exe
PID 1472 wrote to memory of 1288	1472	f3d819c88b12186a1cd2b702ccbef758ea9b7995e1cc2faf2c722e5c89562559.exe	net.exe
PID 1472 wrote to memory of 1288	1472	f3d819c88b12186a1cd2b702ccbef758ea9b7995e1cc2faf2c722e5c89562559.exe	net.exe
PID 1472 wrote to memory of 1288	1472	f3d819c88b12186a1cd2b702ccbef758ea9b7995e1cc2faf2c722e5c89562559.exe	net.exe
PID 1288 wrote to memory of 556	1288	net.exe	net1.exe
PID 1288 wrote to memory of 556	1288	net.exe	net1.exe
PID 1288 wrote to memory of 556	1288	net.exe	net1.exe
PID 1288 wrote to memory of 556	1288	net.exe	net1.exe
PID 1472 wrote to memory of 1004	1472	f3d819c88b12186a1cd2b702ccbef758ea9b7995e1cc2faf2c722e5c89562559.exe	net.exe
PID 1472 wrote to memory of 1004	1472	f3d819c88b12186a1cd2b702ccbef758ea9b7995e1cc2faf2c722e5c89562559.exe	net.exe
PID 1472 wrote to memory of 1004	1472	f3d819c88b12186a1cd2b702ccbef758ea9b7995e1cc2faf2c722e5c89562559.exe	net.exe
PID 1472 wrote to memory of 1004	1472	f3d819c88b12186a1cd2b702ccbef758ea9b7995e1cc2faf2c722e5c89562559.exe	net.exe
PID 1004 wrote to memory of 1804	1004	net.exe	net1.exe
PID 1004 wrote to memory of 1804	1004	net.exe	net1.exe
PID 1004 wrote to memory of 1804	1004	net.exe	net1.exe
PID 1004 wrote to memory of 1804	1004	net.exe	net1.exe

C:\Users\Admin\AppData\Local\Temp\f3d819c88b12186a1cd2b702ccbef758ea9b7995e1cc2faf2c722e5c89562559.exe
"C:\Users\Admin\AppData\Local\Temp\f3d819c88b12186a1cd2b702ccbef758ea9b7995e1cc2faf2c722e5c89562559.exe"
1⤵
- Drops file in Drivers directory
- Loads dropped DLL
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:1472

C:\Windows\SysWOW64\net.exe
net stop nethttpservice
2⤵
- Suspicious use of WriteProcessMemory
PID:320

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop nethttpservice
3⤵
PID:672

C:\Windows\SysWOW64\net.exe
net stop serviceupdater
2⤵
- Suspicious use of WriteProcessMemory
PID:588

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop serviceupdater
3⤵
PID:1820

C:\Windows\SysWOW64\installd.exe
"C:\Windows\system32\installd.exe" nethfdrv
2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:608

C:\Windows\SysWOW64\nethtsrv.exe
"C:\Windows\system32\nethtsrv.exe" -nfdi
2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1680

C:\Windows\SysWOW64\netupdsrv.exe
"C:\Windows\system32\netupdsrv.exe" -nfdi
2⤵
- Executes dropped EXE
PID:1924

C:\Windows\SysWOW64\net.exe
net start nethttpservice
2⤵
- Suspicious use of WriteProcessMemory
PID:1288

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 start nethttpservice
3⤵
PID:556

C:\Windows\SysWOW64\net.exe
net start serviceupdater
2⤵
- Suspicious use of WriteProcessMemory
PID:1004

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 start serviceupdater
3⤵
PID:1804

C:\Windows\SysWOW64\nethtsrv.exe
C:\Windows\SysWOW64\nethtsrv.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:1876

C:\Windows\SysWOW64\netupdsrv.exe
C:\Windows\SysWOW64\netupdsrv.exe
1⤵
- Executes dropped EXE
PID:1308

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\hfnapi.dll
Filesize
106KB

MD5
fa6f3e35a889aa12ca110d268b0612e7

SHA1
6961be38b53ab4bc1eb7c0cb99da32ffde1d849c

SHA256
84afdeddae12646b767b63b1ba3d78529cf8b3944d68a1542809c6ef2f89b476

SHA512
f33058fbd4e9f96fcd905d984762fdb152e771e531c330a13f04f159aeef47656ca54308fe97739d2b64dc081a4017ba6e1271411368401f2904894780cfd86d

Download Submit
C:\Windows\SysWOW64\hfpapi.dll
Filesize
241KB

MD5
f1f6066446f158c7ca7d212d69a893fc

SHA1
acafbdac752f3aa109d4d8e6fab9204dc415e6ec

SHA256
61e27be39c99f36cead1ad5fca63af4378fc79e9b8db3f44e96b9474f19b32e2

SHA512
503b35c549c4c864846d73e119e0798f51da9035d71b52ddf4dc8bc7aaef12c26806c1160ac1b4ac87f3e80a91c313f153888fd024a9bb42daa0b0e1a21d3cba

Download Submit
C:\Windows\SysWOW64\installd.exe
Filesize
108KB

MD5
b7784bc519d030ba00838e09e62731cb

SHA1
c8d27335b378eb59ed256c3d4196fe5ff694bd0b

SHA256
11b8c01620d370725b8bdb9e24653676b834f661f3a59bb597627c7f325f55cb

SHA512
80ceb9bf6ed540abf42f0c89be2df433a579234daaecf5f58907652f96ae2c3cfac7e3ddcc0eea5fe9c63cb66936612e72c815a709bba7610e0d3ad988a04fec

Download Submit
C:\Windows\SysWOW64\nethtsrv.exe
Filesize
176KB

MD5
5d939a96410a5732f434165106e3e4c2

SHA1
3f98a875f1e1bece51020b29a7a2b8f53e248af2

SHA256
af7266fa1a371ce444af16ac4752ad3b7a551189ec8e684469423b3dc22220b8

SHA512
b539ff35cd6d111f132b74f4f59663253fe204932b6ac7e27d8c23d76b3b21209186919da344982c256cfcfa0edda17e0cf17498cfb4947382acd573006b59b1

Download Submit
C:\Windows\SysWOW64\nethtsrv.exe
Filesize
176KB

MD5
5d939a96410a5732f434165106e3e4c2

SHA1
3f98a875f1e1bece51020b29a7a2b8f53e248af2

SHA256
af7266fa1a371ce444af16ac4752ad3b7a551189ec8e684469423b3dc22220b8

SHA512
b539ff35cd6d111f132b74f4f59663253fe204932b6ac7e27d8c23d76b3b21209186919da344982c256cfcfa0edda17e0cf17498cfb4947382acd573006b59b1

Download Submit
C:\Windows\SysWOW64\netupdsrv.exe
Filesize
158KB

MD5
ea661a33988240cda0db7338be6556d7

SHA1
db983fb2cd1f2841e1bd5424946c400d682b41c5

SHA256
d5092f83319dc36f895efdae88260f6a0164e09d79b3f3efdc0e98732d0291f2

SHA512
e71eff619363ecc84b453dc9a4c06b39ce7a2be5f93748496ec3b1b4fa1e361649bd8a871c051eb05f93962cee7e2c4fa5acc2e90bb72b50233a4fa272205f22

Download Submit
C:\Windows\SysWOW64\netupdsrv.exe
Filesize
158KB

MD5
ea661a33988240cda0db7338be6556d7

SHA1
db983fb2cd1f2841e1bd5424946c400d682b41c5

SHA256
d5092f83319dc36f895efdae88260f6a0164e09d79b3f3efdc0e98732d0291f2

SHA512
e71eff619363ecc84b453dc9a4c06b39ce7a2be5f93748496ec3b1b4fa1e361649bd8a871c051eb05f93962cee7e2c4fa5acc2e90bb72b50233a4fa272205f22

Download Submit
\Users\Admin\AppData\Local\Temp\nsoB500.tmp\System.dll
Filesize
11KB

MD5
c17103ae9072a06da581dec998343fc1

SHA1
b72148c6bdfaada8b8c3f950e610ee7cf1da1f8d

SHA256
dc58d8ad81cacb0c1ed72e33bff8f23ea40b5252b5bb55d393a0903e6819ae2f

SHA512
d32a71aaef18e993f28096d536e41c4d016850721b31171513ce28bbd805a54fd290b7c3e9d935f72e676a1acfb4f0dcc89d95040a0dd29f2b6975855c18986f

Download Submit
\Users\Admin\AppData\Local\Temp\nsoB500.tmp\nsExec.dll
Filesize
6KB

MD5
acc2b699edfea5bf5aae45aba3a41e96

SHA1
d2accf4d494e43ceb2cff69abe4dd17147d29cc2

SHA256
168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e

SHA512
e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe

Download Submit
\Users\Admin\AppData\Local\Temp\nsoB500.tmp\nsExec.dll
Filesize
6KB

MD5
acc2b699edfea5bf5aae45aba3a41e96

SHA1
d2accf4d494e43ceb2cff69abe4dd17147d29cc2

SHA256
168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e

SHA512
e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe

Download Submit
\Users\Admin\AppData\Local\Temp\nsoB500.tmp\nsExec.dll
Filesize
6KB

MD5
acc2b699edfea5bf5aae45aba3a41e96

SHA1
d2accf4d494e43ceb2cff69abe4dd17147d29cc2

SHA256
168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e

SHA512
e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe

Download Submit
\Users\Admin\AppData\Local\Temp\nsoB500.tmp\nsExec.dll
Filesize
6KB

MD5
acc2b699edfea5bf5aae45aba3a41e96

SHA1
d2accf4d494e43ceb2cff69abe4dd17147d29cc2

SHA256
168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e

SHA512
e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe

Download Submit
\Windows\SysWOW64\hfnapi.dll
Filesize
106KB

MD5
fa6f3e35a889aa12ca110d268b0612e7

SHA1
6961be38b53ab4bc1eb7c0cb99da32ffde1d849c

SHA256
84afdeddae12646b767b63b1ba3d78529cf8b3944d68a1542809c6ef2f89b476

SHA512
f33058fbd4e9f96fcd905d984762fdb152e771e531c330a13f04f159aeef47656ca54308fe97739d2b64dc081a4017ba6e1271411368401f2904894780cfd86d

Download Submit
\Windows\SysWOW64\hfnapi.dll
Filesize
106KB

MD5
fa6f3e35a889aa12ca110d268b0612e7

SHA1
6961be38b53ab4bc1eb7c0cb99da32ffde1d849c

SHA256
84afdeddae12646b767b63b1ba3d78529cf8b3944d68a1542809c6ef2f89b476

SHA512
f33058fbd4e9f96fcd905d984762fdb152e771e531c330a13f04f159aeef47656ca54308fe97739d2b64dc081a4017ba6e1271411368401f2904894780cfd86d

Download Submit
\Windows\SysWOW64\hfnapi.dll
Filesize
106KB

MD5
fa6f3e35a889aa12ca110d268b0612e7

SHA1
6961be38b53ab4bc1eb7c0cb99da32ffde1d849c

SHA256
84afdeddae12646b767b63b1ba3d78529cf8b3944d68a1542809c6ef2f89b476

SHA512
f33058fbd4e9f96fcd905d984762fdb152e771e531c330a13f04f159aeef47656ca54308fe97739d2b64dc081a4017ba6e1271411368401f2904894780cfd86d

Download Submit
\Windows\SysWOW64\hfpapi.dll
Filesize
241KB

MD5
f1f6066446f158c7ca7d212d69a893fc

SHA1
acafbdac752f3aa109d4d8e6fab9204dc415e6ec

SHA256
61e27be39c99f36cead1ad5fca63af4378fc79e9b8db3f44e96b9474f19b32e2

SHA512
503b35c549c4c864846d73e119e0798f51da9035d71b52ddf4dc8bc7aaef12c26806c1160ac1b4ac87f3e80a91c313f153888fd024a9bb42daa0b0e1a21d3cba

Download Submit
\Windows\SysWOW64\hfpapi.dll
Filesize
241KB

MD5
f1f6066446f158c7ca7d212d69a893fc

SHA1
acafbdac752f3aa109d4d8e6fab9204dc415e6ec

SHA256
61e27be39c99f36cead1ad5fca63af4378fc79e9b8db3f44e96b9474f19b32e2

SHA512
503b35c549c4c864846d73e119e0798f51da9035d71b52ddf4dc8bc7aaef12c26806c1160ac1b4ac87f3e80a91c313f153888fd024a9bb42daa0b0e1a21d3cba

Download Submit
\Windows\SysWOW64\installd.exe
Filesize
108KB

MD5
b7784bc519d030ba00838e09e62731cb

SHA1
c8d27335b378eb59ed256c3d4196fe5ff694bd0b

SHA256
11b8c01620d370725b8bdb9e24653676b834f661f3a59bb597627c7f325f55cb

SHA512
80ceb9bf6ed540abf42f0c89be2df433a579234daaecf5f58907652f96ae2c3cfac7e3ddcc0eea5fe9c63cb66936612e72c815a709bba7610e0d3ad988a04fec

Download Submit
\Windows\SysWOW64\nethtsrv.exe
Filesize
176KB

MD5
5d939a96410a5732f434165106e3e4c2

SHA1
3f98a875f1e1bece51020b29a7a2b8f53e248af2

SHA256
af7266fa1a371ce444af16ac4752ad3b7a551189ec8e684469423b3dc22220b8

SHA512
b539ff35cd6d111f132b74f4f59663253fe204932b6ac7e27d8c23d76b3b21209186919da344982c256cfcfa0edda17e0cf17498cfb4947382acd573006b59b1

Download Submit
\Windows\SysWOW64\netupdsrv.exe
Filesize
158KB

MD5
ea661a33988240cda0db7338be6556d7

SHA1
db983fb2cd1f2841e1bd5424946c400d682b41c5

SHA256
d5092f83319dc36f895efdae88260f6a0164e09d79b3f3efdc0e98732d0291f2

SHA512
e71eff619363ecc84b453dc9a4c06b39ce7a2be5f93748496ec3b1b4fa1e361649bd8a871c051eb05f93962cee7e2c4fa5acc2e90bb72b50233a4fa272205f22

Download Submit
memory/320-57-0x0000000000000000-mapping.dmp

Download
memory/556-82-0x0000000000000000-mapping.dmp

Download
memory/588-61-0x0000000000000000-mapping.dmp

Download
memory/608-64-0x0000000000000000-mapping.dmp

Download
memory/672-58-0x0000000000000000-mapping.dmp

Download
memory/1004-87-0x0000000000000000-mapping.dmp

Download
memory/1288-81-0x0000000000000000-mapping.dmp

Download
memory/1472-54-0x0000000075F21000-0x0000000075F23000-memory.dmp

Filesize
8KB

Download
memory/1472-69-0x0000000000360000-0x00000000007BE000-memory.dmp

Filesize
4.4MB

Download
memory/1472-91-0x0000000000360000-0x00000000007BE000-memory.dmp

Filesize
4.4MB

Download
memory/1472-59-0x0000000000360000-0x00000000007BE000-memory.dmp

Filesize
4.4MB

Download
memory/1680-71-0x0000000000000000-mapping.dmp

Download
memory/1804-88-0x0000000000000000-mapping.dmp

Download
memory/1820-62-0x0000000000000000-mapping.dmp

Download
memory/1924-77-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads