f2275070d92cdad82c3d0ec885693ea7539fdb20829ddc97bddb3aa22db1a9f5

Analysis

max time kernel
89s
max time network
31s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
23-11-2022 10:07

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

f2275070d92cdad82c3d0ec885693ea7539fdb20829ddc97bddb3aa22db1a9f5.exe
Size

602KB
MD5

73085265070e6da3cde8fc627c3d44ee
SHA1

a7ab29e090b0602ad1bf26a8b6e92460eed897bd
SHA256

f2275070d92cdad82c3d0ec885693ea7539fdb20829ddc97bddb3aa22db1a9f5
SHA512

f1aba8dc480549961162c88796e8ced96cef2255c9837fdceceb57ff120768803c2d4d07de845dae19f08be60fa6e6a4bf7d341f1c6c1a062c2dff486bbdc1b7
SSDEEP

12288:KIny5DYTjXN7qGqtfX96w3TUqx4OADQZqydWemlhyvah:MUTjdOGFw3TlWZDQFYlGah

Score

8^/10

discovery

Malware Config

Signatures

Drops file in Drivers directory 1 IoCs

Processes:

f2275070d92cdad82c3d0ec885693ea7539fdb20829ddc97bddb3aa22db1a9f5.exe

description ioc process

File created C:\Windows\system32\drivers\nethfdrv.sys f2275070d92cdad82c3d0ec885693ea7539fdb20829ddc97bddb3aa22db1a9f5.exe
Executes dropped EXE 5 IoCs

Processes:

installd.exenethtsrv.exenetupdsrv.exenethtsrv.exenetupdsrv.exe

pid process

1376 installd.exe
1540 nethtsrv.exe
892 netupdsrv.exe
1936 nethtsrv.exe
972 netupdsrv.exe

description	ioc	process
File created	C:\Windows\system32\drivers\nethfdrv.sys	f2275070d92cdad82c3d0ec885693ea7539fdb20829ddc97bddb3aa22db1a9f5.exe

pid	process
1376	installd.exe
1540	nethtsrv.exe
892	netupdsrv.exe
1936	nethtsrv.exe
972	netupdsrv.exe

Loads dropped DLL 13 IoCs

Processes:

f2275070d92cdad82c3d0ec885693ea7539fdb20829ddc97bddb3aa22db1a9f5.exeinstalld.exenethtsrv.exenethtsrv.exe

pid	process
2020	f2275070d92cdad82c3d0ec885693ea7539fdb20829ddc97bddb3aa22db1a9f5.exe
2020	f2275070d92cdad82c3d0ec885693ea7539fdb20829ddc97bddb3aa22db1a9f5.exe
2020	f2275070d92cdad82c3d0ec885693ea7539fdb20829ddc97bddb3aa22db1a9f5.exe
2020	f2275070d92cdad82c3d0ec885693ea7539fdb20829ddc97bddb3aa22db1a9f5.exe
1376	installd.exe
2020	f2275070d92cdad82c3d0ec885693ea7539fdb20829ddc97bddb3aa22db1a9f5.exe
1540	nethtsrv.exe
1540	nethtsrv.exe
2020	f2275070d92cdad82c3d0ec885693ea7539fdb20829ddc97bddb3aa22db1a9f5.exe
2020	f2275070d92cdad82c3d0ec885693ea7539fdb20829ddc97bddb3aa22db1a9f5.exe
1936	nethtsrv.exe
1936	nethtsrv.exe
2020	f2275070d92cdad82c3d0ec885693ea7539fdb20829ddc97bddb3aa22db1a9f5.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in System32 directory 5 IoCs

Processes:

f2275070d92cdad82c3d0ec885693ea7539fdb20829ddc97bddb3aa22db1a9f5.exe

description	ioc	process
File created	C:\Windows\SysWOW64\hfnapi.dll	f2275070d92cdad82c3d0ec885693ea7539fdb20829ddc97bddb3aa22db1a9f5.exe
File created	C:\Windows\SysWOW64\hfpapi.dll	f2275070d92cdad82c3d0ec885693ea7539fdb20829ddc97bddb3aa22db1a9f5.exe
File created	C:\Windows\SysWOW64\installd.exe	f2275070d92cdad82c3d0ec885693ea7539fdb20829ddc97bddb3aa22db1a9f5.exe
File created	C:\Windows\SysWOW64\nethtsrv.exe	f2275070d92cdad82c3d0ec885693ea7539fdb20829ddc97bddb3aa22db1a9f5.exe
File created	C:\Windows\SysWOW64\netupdsrv.exe	f2275070d92cdad82c3d0ec885693ea7539fdb20829ddc97bddb3aa22db1a9f5.exe

Drops file in Program Files directory 3 IoCs

Processes:

f2275070d92cdad82c3d0ec885693ea7539fdb20829ddc97bddb3aa22db1a9f5.exe

description	ioc	process
File created	C:\Program Files (x86)\Common Files\Config\data.xml	f2275070d92cdad82c3d0ec885693ea7539fdb20829ddc97bddb3aa22db1a9f5.exe
File created	C:\Program Files (x86)\Common Files\Config\ver.xml	f2275070d92cdad82c3d0ec885693ea7539fdb20829ddc97bddb3aa22db1a9f5.exe
File created	C:\Program Files (x86)\Common Files\config\uninstinethnfd.exe	f2275070d92cdad82c3d0ec885693ea7539fdb20829ddc97bddb3aa22db1a9f5.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Runs net.exe
Suspicious behavior: LoadsDriver 1 IoCs

Processes:

pid process

464
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

nethtsrv.exe

description pid process

Token: SeDebugPrivilege 1936 nethtsrv.exe

pid	process
464

description	pid	process
Token: SeDebugPrivilege	1936	nethtsrv.exe

Suspicious use of WriteProcessMemory 50 IoCs

Processes:

f2275070d92cdad82c3d0ec885693ea7539fdb20829ddc97bddb3aa22db1a9f5.exenet.exenet.exenet.exenet.exe

description	pid	process	target process
PID 2020 wrote to memory of 1040	2020	f2275070d92cdad82c3d0ec885693ea7539fdb20829ddc97bddb3aa22db1a9f5.exe	net.exe
PID 2020 wrote to memory of 1040	2020	f2275070d92cdad82c3d0ec885693ea7539fdb20829ddc97bddb3aa22db1a9f5.exe	net.exe
PID 2020 wrote to memory of 1040	2020	f2275070d92cdad82c3d0ec885693ea7539fdb20829ddc97bddb3aa22db1a9f5.exe	net.exe
PID 2020 wrote to memory of 1040	2020	f2275070d92cdad82c3d0ec885693ea7539fdb20829ddc97bddb3aa22db1a9f5.exe	net.exe
PID 1040 wrote to memory of 1500	1040	net.exe	net1.exe
PID 1040 wrote to memory of 1500	1040	net.exe	net1.exe
PID 1040 wrote to memory of 1500	1040	net.exe	net1.exe
PID 1040 wrote to memory of 1500	1040	net.exe	net1.exe
PID 2020 wrote to memory of 564	2020	f2275070d92cdad82c3d0ec885693ea7539fdb20829ddc97bddb3aa22db1a9f5.exe	net.exe
PID 2020 wrote to memory of 564	2020	f2275070d92cdad82c3d0ec885693ea7539fdb20829ddc97bddb3aa22db1a9f5.exe	net.exe
PID 2020 wrote to memory of 564	2020	f2275070d92cdad82c3d0ec885693ea7539fdb20829ddc97bddb3aa22db1a9f5.exe	net.exe
PID 2020 wrote to memory of 564	2020	f2275070d92cdad82c3d0ec885693ea7539fdb20829ddc97bddb3aa22db1a9f5.exe	net.exe
PID 564 wrote to memory of 580	564	net.exe	net1.exe
PID 564 wrote to memory of 580	564	net.exe	net1.exe
PID 564 wrote to memory of 580	564	net.exe	net1.exe
PID 564 wrote to memory of 580	564	net.exe	net1.exe
PID 2020 wrote to memory of 1376	2020	f2275070d92cdad82c3d0ec885693ea7539fdb20829ddc97bddb3aa22db1a9f5.exe	installd.exe
PID 2020 wrote to memory of 1376	2020	f2275070d92cdad82c3d0ec885693ea7539fdb20829ddc97bddb3aa22db1a9f5.exe	installd.exe
PID 2020 wrote to memory of 1376	2020	f2275070d92cdad82c3d0ec885693ea7539fdb20829ddc97bddb3aa22db1a9f5.exe	installd.exe
PID 2020 wrote to memory of 1376	2020	f2275070d92cdad82c3d0ec885693ea7539fdb20829ddc97bddb3aa22db1a9f5.exe	installd.exe
PID 2020 wrote to memory of 1376	2020	f2275070d92cdad82c3d0ec885693ea7539fdb20829ddc97bddb3aa22db1a9f5.exe	installd.exe
PID 2020 wrote to memory of 1376	2020	f2275070d92cdad82c3d0ec885693ea7539fdb20829ddc97bddb3aa22db1a9f5.exe	installd.exe
PID 2020 wrote to memory of 1376	2020	f2275070d92cdad82c3d0ec885693ea7539fdb20829ddc97bddb3aa22db1a9f5.exe	installd.exe
PID 2020 wrote to memory of 1540	2020	f2275070d92cdad82c3d0ec885693ea7539fdb20829ddc97bddb3aa22db1a9f5.exe	nethtsrv.exe
PID 2020 wrote to memory of 1540	2020	f2275070d92cdad82c3d0ec885693ea7539fdb20829ddc97bddb3aa22db1a9f5.exe	nethtsrv.exe
PID 2020 wrote to memory of 1540	2020	f2275070d92cdad82c3d0ec885693ea7539fdb20829ddc97bddb3aa22db1a9f5.exe	nethtsrv.exe
PID 2020 wrote to memory of 1540	2020	f2275070d92cdad82c3d0ec885693ea7539fdb20829ddc97bddb3aa22db1a9f5.exe	nethtsrv.exe
PID 2020 wrote to memory of 892	2020	f2275070d92cdad82c3d0ec885693ea7539fdb20829ddc97bddb3aa22db1a9f5.exe	netupdsrv.exe
PID 2020 wrote to memory of 892	2020	f2275070d92cdad82c3d0ec885693ea7539fdb20829ddc97bddb3aa22db1a9f5.exe	netupdsrv.exe
PID 2020 wrote to memory of 892	2020	f2275070d92cdad82c3d0ec885693ea7539fdb20829ddc97bddb3aa22db1a9f5.exe	netupdsrv.exe
PID 2020 wrote to memory of 892	2020	f2275070d92cdad82c3d0ec885693ea7539fdb20829ddc97bddb3aa22db1a9f5.exe	netupdsrv.exe
PID 2020 wrote to memory of 892	2020	f2275070d92cdad82c3d0ec885693ea7539fdb20829ddc97bddb3aa22db1a9f5.exe	netupdsrv.exe
PID 2020 wrote to memory of 892	2020	f2275070d92cdad82c3d0ec885693ea7539fdb20829ddc97bddb3aa22db1a9f5.exe	netupdsrv.exe
PID 2020 wrote to memory of 892	2020	f2275070d92cdad82c3d0ec885693ea7539fdb20829ddc97bddb3aa22db1a9f5.exe	netupdsrv.exe
PID 2020 wrote to memory of 1732	2020	f2275070d92cdad82c3d0ec885693ea7539fdb20829ddc97bddb3aa22db1a9f5.exe	net.exe
PID 2020 wrote to memory of 1732	2020	f2275070d92cdad82c3d0ec885693ea7539fdb20829ddc97bddb3aa22db1a9f5.exe	net.exe
PID 2020 wrote to memory of 1732	2020	f2275070d92cdad82c3d0ec885693ea7539fdb20829ddc97bddb3aa22db1a9f5.exe	net.exe
PID 2020 wrote to memory of 1732	2020	f2275070d92cdad82c3d0ec885693ea7539fdb20829ddc97bddb3aa22db1a9f5.exe	net.exe
PID 1732 wrote to memory of 1636	1732	net.exe	net1.exe
PID 1732 wrote to memory of 1636	1732	net.exe	net1.exe
PID 1732 wrote to memory of 1636	1732	net.exe	net1.exe
PID 1732 wrote to memory of 1636	1732	net.exe	net1.exe
PID 2020 wrote to memory of 1296	2020	f2275070d92cdad82c3d0ec885693ea7539fdb20829ddc97bddb3aa22db1a9f5.exe	net.exe
PID 2020 wrote to memory of 1296	2020	f2275070d92cdad82c3d0ec885693ea7539fdb20829ddc97bddb3aa22db1a9f5.exe	net.exe
PID 2020 wrote to memory of 1296	2020	f2275070d92cdad82c3d0ec885693ea7539fdb20829ddc97bddb3aa22db1a9f5.exe	net.exe
PID 2020 wrote to memory of 1296	2020	f2275070d92cdad82c3d0ec885693ea7539fdb20829ddc97bddb3aa22db1a9f5.exe	net.exe
PID 1296 wrote to memory of 908	1296	net.exe	net1.exe
PID 1296 wrote to memory of 908	1296	net.exe	net1.exe
PID 1296 wrote to memory of 908	1296	net.exe	net1.exe
PID 1296 wrote to memory of 908	1296	net.exe	net1.exe

C:\Users\Admin\AppData\Local\Temp\f2275070d92cdad82c3d0ec885693ea7539fdb20829ddc97bddb3aa22db1a9f5.exe
"C:\Users\Admin\AppData\Local\Temp\f2275070d92cdad82c3d0ec885693ea7539fdb20829ddc97bddb3aa22db1a9f5.exe"
1⤵
- Drops file in Drivers directory
- Loads dropped DLL
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:2020

C:\Windows\SysWOW64\net.exe
net stop nethttpservice
2⤵
- Suspicious use of WriteProcessMemory
PID:1040

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop nethttpservice
3⤵
PID:1500

C:\Windows\SysWOW64\net.exe
net stop serviceupdater
2⤵
- Suspicious use of WriteProcessMemory
PID:564

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop serviceupdater
3⤵
PID:580

C:\Windows\SysWOW64\installd.exe
"C:\Windows\system32\installd.exe" nethfdrv
2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1376

C:\Windows\SysWOW64\nethtsrv.exe
"C:\Windows\system32\nethtsrv.exe" -nfdi
2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1540

C:\Windows\SysWOW64\netupdsrv.exe
"C:\Windows\system32\netupdsrv.exe" -nfdi
2⤵
- Executes dropped EXE
PID:892

C:\Windows\SysWOW64\net.exe
net start nethttpservice
2⤵
- Suspicious use of WriteProcessMemory
PID:1732

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 start nethttpservice
3⤵
PID:1636

C:\Windows\SysWOW64\net.exe
net start serviceupdater
2⤵
- Suspicious use of WriteProcessMemory
PID:1296

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 start serviceupdater
3⤵
PID:908

C:\Windows\SysWOW64\nethtsrv.exe
C:\Windows\SysWOW64\nethtsrv.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:1936

C:\Windows\SysWOW64\netupdsrv.exe
C:\Windows\SysWOW64\netupdsrv.exe
1⤵
- Executes dropped EXE
PID:972

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\hfnapi.dll
Filesize
106KB

MD5
c218a4b733b3209dfbce7b18c19a28d9

SHA1
ebff55084422833e5f7a65e1881cda60f0df5f95

SHA256
9a2e167285cbcb8e79ac63fde9292c210f2c2c926230a431f4975643663f065e

SHA512
d7d576b00510972c920bfad17409989ec8dee9045e53636eac9c37972ba5c697a71ca78cd5d6a0cd2ee4bb1f9eab1c7b74db917af5252b7cd3b0d92b388d150c

Download Submit
C:\Windows\SysWOW64\hfpapi.dll
Filesize
241KB

MD5
25ea4abc05336999aac4b605b3961839

SHA1
af36a5827daea256a8bc970c66a3c7987cd74b7b

SHA256
01c46682c2e8733cf698b8206cd0265b62989770ac59457c591568d2cc8b70b2

SHA512
028bba42a1930d436c2c42c3cedc7042067b83bc7100206bf18b9f04a092bca507afe0830b6d5d8e43c2338e7a083315955119a9114cb0629d6c0322ddc34801

Download Submit
C:\Windows\SysWOW64\installd.exe
Filesize
108KB

MD5
80c7a4349de653a520152144e60051f4

SHA1
d048989d867446d825a28f96fbe15bccee85aff4

SHA256
c37e1b9619e5ab5a38ea3b461adb0037ecfc680efd22eb2766d2c1a1a1d51a94

SHA512
1f5c4235135c9f2812257db17f2f7e0b006284e3d38682654e9693406b8f518fa8ede3f8519783f85f98fa221183af5c0a22d913b79351a0064398546d4374ec

Download Submit
C:\Windows\SysWOW64\nethtsrv.exe
Filesize
176KB

MD5
70f6457c9af98c502cb471af0a1f8b28

SHA1
30edeb377d2457b4b345f2142ab8ccbbfcd9fec6

SHA256
aba7ddd12ad149688d9e85b945e7baddc04abaa0d50c3ed7542e0519f107f15c

SHA512
596c3891e976a151e51adde0f49e78b88190a9ccdabebcdb3b626bcbf4d72c97b3d504b0be4b43b6aa97b854917354ef27e40614ae7c2b123def6fdebbdf12f9

Download Submit
C:\Windows\SysWOW64\nethtsrv.exe
Filesize
176KB

MD5
70f6457c9af98c502cb471af0a1f8b28

SHA1
30edeb377d2457b4b345f2142ab8ccbbfcd9fec6

SHA256
aba7ddd12ad149688d9e85b945e7baddc04abaa0d50c3ed7542e0519f107f15c

SHA512
596c3891e976a151e51adde0f49e78b88190a9ccdabebcdb3b626bcbf4d72c97b3d504b0be4b43b6aa97b854917354ef27e40614ae7c2b123def6fdebbdf12f9

Download Submit
C:\Windows\SysWOW64\netupdsrv.exe
Filesize
158KB

MD5
594370e1d92fdf6d0a81e22dc4c96ac3

SHA1
0020ba6243c7d9cb0a37f8bc6df910498b117cb4

SHA256
661722c1392e875a44783645d18d76a8598160a6d38ff1469c896ac890c086f9

SHA512
3377ec7003d5479e77cddf64a8d9d361bbefbbee2f99e07b17a980fe31996de43161391cdb370dd71153309f3f95dd10786bf81874b3a2c3f4b7d88527719bdf

Download Submit
C:\Windows\SysWOW64\netupdsrv.exe
Filesize
158KB

MD5
594370e1d92fdf6d0a81e22dc4c96ac3

SHA1
0020ba6243c7d9cb0a37f8bc6df910498b117cb4

SHA256
661722c1392e875a44783645d18d76a8598160a6d38ff1469c896ac890c086f9

SHA512
3377ec7003d5479e77cddf64a8d9d361bbefbbee2f99e07b17a980fe31996de43161391cdb370dd71153309f3f95dd10786bf81874b3a2c3f4b7d88527719bdf

Download Submit
\Users\Admin\AppData\Local\Temp\nsjBC31.tmp\System.dll
Filesize
11KB

MD5
c17103ae9072a06da581dec998343fc1

SHA1
b72148c6bdfaada8b8c3f950e610ee7cf1da1f8d

SHA256
dc58d8ad81cacb0c1ed72e33bff8f23ea40b5252b5bb55d393a0903e6819ae2f

SHA512
d32a71aaef18e993f28096d536e41c4d016850721b31171513ce28bbd805a54fd290b7c3e9d935f72e676a1acfb4f0dcc89d95040a0dd29f2b6975855c18986f

Download Submit
\Users\Admin\AppData\Local\Temp\nsjBC31.tmp\nsExec.dll
Filesize
6KB

MD5
acc2b699edfea5bf5aae45aba3a41e96

SHA1
d2accf4d494e43ceb2cff69abe4dd17147d29cc2

SHA256
168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e

SHA512
e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe

Download Submit
\Users\Admin\AppData\Local\Temp\nsjBC31.tmp\nsExec.dll
Filesize
6KB

MD5
acc2b699edfea5bf5aae45aba3a41e96

SHA1
d2accf4d494e43ceb2cff69abe4dd17147d29cc2

SHA256
168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e

SHA512
e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe

Download Submit
\Users\Admin\AppData\Local\Temp\nsjBC31.tmp\nsExec.dll
Filesize
6KB

MD5
acc2b699edfea5bf5aae45aba3a41e96

SHA1
d2accf4d494e43ceb2cff69abe4dd17147d29cc2

SHA256
168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e

SHA512
e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe

Download Submit
\Users\Admin\AppData\Local\Temp\nsjBC31.tmp\nsExec.dll
Filesize
6KB

MD5
acc2b699edfea5bf5aae45aba3a41e96

SHA1
d2accf4d494e43ceb2cff69abe4dd17147d29cc2

SHA256
168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e

SHA512
e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe

Download Submit
\Windows\SysWOW64\hfnapi.dll
Filesize
106KB

MD5
c218a4b733b3209dfbce7b18c19a28d9

SHA1
ebff55084422833e5f7a65e1881cda60f0df5f95

SHA256
9a2e167285cbcb8e79ac63fde9292c210f2c2c926230a431f4975643663f065e

SHA512
d7d576b00510972c920bfad17409989ec8dee9045e53636eac9c37972ba5c697a71ca78cd5d6a0cd2ee4bb1f9eab1c7b74db917af5252b7cd3b0d92b388d150c

Download Submit
\Windows\SysWOW64\hfnapi.dll
Filesize
106KB

MD5
c218a4b733b3209dfbce7b18c19a28d9

SHA1
ebff55084422833e5f7a65e1881cda60f0df5f95

SHA256
9a2e167285cbcb8e79ac63fde9292c210f2c2c926230a431f4975643663f065e

SHA512
d7d576b00510972c920bfad17409989ec8dee9045e53636eac9c37972ba5c697a71ca78cd5d6a0cd2ee4bb1f9eab1c7b74db917af5252b7cd3b0d92b388d150c

Download Submit
\Windows\SysWOW64\hfnapi.dll
Filesize
106KB

MD5
c218a4b733b3209dfbce7b18c19a28d9

SHA1
ebff55084422833e5f7a65e1881cda60f0df5f95

SHA256
9a2e167285cbcb8e79ac63fde9292c210f2c2c926230a431f4975643663f065e

SHA512
d7d576b00510972c920bfad17409989ec8dee9045e53636eac9c37972ba5c697a71ca78cd5d6a0cd2ee4bb1f9eab1c7b74db917af5252b7cd3b0d92b388d150c

Download Submit
\Windows\SysWOW64\hfpapi.dll
Filesize
241KB

MD5
25ea4abc05336999aac4b605b3961839

SHA1
af36a5827daea256a8bc970c66a3c7987cd74b7b

SHA256
01c46682c2e8733cf698b8206cd0265b62989770ac59457c591568d2cc8b70b2

SHA512
028bba42a1930d436c2c42c3cedc7042067b83bc7100206bf18b9f04a092bca507afe0830b6d5d8e43c2338e7a083315955119a9114cb0629d6c0322ddc34801

Download Submit
\Windows\SysWOW64\hfpapi.dll
Filesize
241KB

MD5
25ea4abc05336999aac4b605b3961839

SHA1
af36a5827daea256a8bc970c66a3c7987cd74b7b

SHA256
01c46682c2e8733cf698b8206cd0265b62989770ac59457c591568d2cc8b70b2

SHA512
028bba42a1930d436c2c42c3cedc7042067b83bc7100206bf18b9f04a092bca507afe0830b6d5d8e43c2338e7a083315955119a9114cb0629d6c0322ddc34801

Download Submit
\Windows\SysWOW64\installd.exe
Filesize
108KB

MD5
80c7a4349de653a520152144e60051f4

SHA1
d048989d867446d825a28f96fbe15bccee85aff4

SHA256
c37e1b9619e5ab5a38ea3b461adb0037ecfc680efd22eb2766d2c1a1a1d51a94

SHA512
1f5c4235135c9f2812257db17f2f7e0b006284e3d38682654e9693406b8f518fa8ede3f8519783f85f98fa221183af5c0a22d913b79351a0064398546d4374ec

Download Submit
\Windows\SysWOW64\nethtsrv.exe
Filesize
176KB

MD5
70f6457c9af98c502cb471af0a1f8b28

SHA1
30edeb377d2457b4b345f2142ab8ccbbfcd9fec6

SHA256
aba7ddd12ad149688d9e85b945e7baddc04abaa0d50c3ed7542e0519f107f15c

SHA512
596c3891e976a151e51adde0f49e78b88190a9ccdabebcdb3b626bcbf4d72c97b3d504b0be4b43b6aa97b854917354ef27e40614ae7c2b123def6fdebbdf12f9

Download Submit
\Windows\SysWOW64\netupdsrv.exe
Filesize
158KB

MD5
594370e1d92fdf6d0a81e22dc4c96ac3

SHA1
0020ba6243c7d9cb0a37f8bc6df910498b117cb4

SHA256
661722c1392e875a44783645d18d76a8598160a6d38ff1469c896ac890c086f9

SHA512
3377ec7003d5479e77cddf64a8d9d361bbefbbee2f99e07b17a980fe31996de43161391cdb370dd71153309f3f95dd10786bf81874b3a2c3f4b7d88527719bdf

Download Submit
memory/564-61-0x0000000000000000-mapping.dmp

Download
memory/580-62-0x0000000000000000-mapping.dmp

Download
memory/892-77-0x0000000000000000-mapping.dmp

Download
memory/908-88-0x0000000000000000-mapping.dmp

Download
memory/1040-57-0x0000000000000000-mapping.dmp

Download
memory/1296-87-0x0000000000000000-mapping.dmp

Download
memory/1376-64-0x0000000000000000-mapping.dmp

Download
memory/1500-58-0x0000000000000000-mapping.dmp

Download
memory/1540-71-0x0000000000000000-mapping.dmp

Download
memory/1636-82-0x0000000000000000-mapping.dmp

Download
memory/1732-81-0x0000000000000000-mapping.dmp

Download
memory/2020-69-0x0000000000360000-0x00000000007BE000-memory.dmp

Filesize
4.4MB

Download
memory/2020-54-0x00000000760B1000-0x00000000760B3000-memory.dmp

Filesize
8KB

Download
memory/2020-59-0x0000000000360000-0x00000000007BE000-memory.dmp

Filesize
4.4MB

Download
memory/2020-91-0x0000000000360000-0x00000000007BE000-memory.dmp

Filesize
4.4MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads