fafa02136ab83334ff91531e2cfd9911ba7c5759df63beae12cbd225822440b2

Analysis

max time kernel
44s
max time network
50s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
23-11-2022 10:06

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

fafa02136ab83334ff91531e2cfd9911ba7c5759df63beae12cbd225822440b2.exe
Size

602KB
MD5

75af14b7612dddb7239768b8d376eede
SHA1

9e8044cb12c86e7526fd7913d1d5ca882efdd9ae
SHA256

fafa02136ab83334ff91531e2cfd9911ba7c5759df63beae12cbd225822440b2
SHA512

56cb245c9a13292cf927dc3e4b97877c5f0aae47122db2f98276e2fc4b610f8650c0e2363f76177da6bac57627b6e1715632d4f2537a1c8ca1eafa0a7bf1269a
SSDEEP

12288:/Iny5DYTkI7yUDl6pL2cM/64A0l8mnvHtfIDUmqzgaU4b0q:nUTk0yUst7MN/82vtNm4gG4

Score

8^/10

discovery

Malware Config

Signatures

Drops file in Drivers directory 1 IoCs

Processes:

fafa02136ab83334ff91531e2cfd9911ba7c5759df63beae12cbd225822440b2.exe

description ioc process

File created C:\Windows\system32\drivers\nethfdrv.sys fafa02136ab83334ff91531e2cfd9911ba7c5759df63beae12cbd225822440b2.exe
Executes dropped EXE 5 IoCs

Processes:

installd.exenethtsrv.exenetupdsrv.exenethtsrv.exenetupdsrv.exe

pid process

860 installd.exe
1536 nethtsrv.exe
1568 netupdsrv.exe
1064 nethtsrv.exe
1432 netupdsrv.exe

description	ioc	process
File created	C:\Windows\system32\drivers\nethfdrv.sys	fafa02136ab83334ff91531e2cfd9911ba7c5759df63beae12cbd225822440b2.exe

pid	process
860	installd.exe
1536	nethtsrv.exe
1568	netupdsrv.exe
1064	nethtsrv.exe
1432	netupdsrv.exe

Loads dropped DLL 13 IoCs

Processes:

fafa02136ab83334ff91531e2cfd9911ba7c5759df63beae12cbd225822440b2.exeinstalld.exenethtsrv.exenethtsrv.exe

pid	process
852	fafa02136ab83334ff91531e2cfd9911ba7c5759df63beae12cbd225822440b2.exe
852	fafa02136ab83334ff91531e2cfd9911ba7c5759df63beae12cbd225822440b2.exe
852	fafa02136ab83334ff91531e2cfd9911ba7c5759df63beae12cbd225822440b2.exe
852	fafa02136ab83334ff91531e2cfd9911ba7c5759df63beae12cbd225822440b2.exe
860	installd.exe
852	fafa02136ab83334ff91531e2cfd9911ba7c5759df63beae12cbd225822440b2.exe
1536	nethtsrv.exe
1536	nethtsrv.exe
852	fafa02136ab83334ff91531e2cfd9911ba7c5759df63beae12cbd225822440b2.exe
852	fafa02136ab83334ff91531e2cfd9911ba7c5759df63beae12cbd225822440b2.exe
1064	nethtsrv.exe
1064	nethtsrv.exe
852	fafa02136ab83334ff91531e2cfd9911ba7c5759df63beae12cbd225822440b2.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in System32 directory 5 IoCs

Processes:

fafa02136ab83334ff91531e2cfd9911ba7c5759df63beae12cbd225822440b2.exe

description	ioc	process
File created	C:\Windows\SysWOW64\hfnapi.dll	fafa02136ab83334ff91531e2cfd9911ba7c5759df63beae12cbd225822440b2.exe
File created	C:\Windows\SysWOW64\hfpapi.dll	fafa02136ab83334ff91531e2cfd9911ba7c5759df63beae12cbd225822440b2.exe
File created	C:\Windows\SysWOW64\installd.exe	fafa02136ab83334ff91531e2cfd9911ba7c5759df63beae12cbd225822440b2.exe
File created	C:\Windows\SysWOW64\nethtsrv.exe	fafa02136ab83334ff91531e2cfd9911ba7c5759df63beae12cbd225822440b2.exe
File created	C:\Windows\SysWOW64\netupdsrv.exe	fafa02136ab83334ff91531e2cfd9911ba7c5759df63beae12cbd225822440b2.exe

Drops file in Program Files directory 3 IoCs

Processes:

fafa02136ab83334ff91531e2cfd9911ba7c5759df63beae12cbd225822440b2.exe

description	ioc	process
File created	C:\Program Files (x86)\Common Files\Config\data.xml	fafa02136ab83334ff91531e2cfd9911ba7c5759df63beae12cbd225822440b2.exe
File created	C:\Program Files (x86)\Common Files\Config\ver.xml	fafa02136ab83334ff91531e2cfd9911ba7c5759df63beae12cbd225822440b2.exe
File created	C:\Program Files (x86)\Common Files\config\uninstinethnfd.exe	fafa02136ab83334ff91531e2cfd9911ba7c5759df63beae12cbd225822440b2.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Runs net.exe
Suspicious behavior: LoadsDriver 1 IoCs

Processes:

pid process

468
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

nethtsrv.exe

description pid process

Token: SeDebugPrivilege 1064 nethtsrv.exe

pid	process
468

description	pid	process
Token: SeDebugPrivilege	1064	nethtsrv.exe

Suspicious use of WriteProcessMemory 50 IoCs

Processes:

fafa02136ab83334ff91531e2cfd9911ba7c5759df63beae12cbd225822440b2.exenet.exenet.exenet.exenet.exe

description	pid	process	target process
PID 852 wrote to memory of 940	852	fafa02136ab83334ff91531e2cfd9911ba7c5759df63beae12cbd225822440b2.exe	net.exe
PID 852 wrote to memory of 940	852	fafa02136ab83334ff91531e2cfd9911ba7c5759df63beae12cbd225822440b2.exe	net.exe
PID 852 wrote to memory of 940	852	fafa02136ab83334ff91531e2cfd9911ba7c5759df63beae12cbd225822440b2.exe	net.exe
PID 852 wrote to memory of 940	852	fafa02136ab83334ff91531e2cfd9911ba7c5759df63beae12cbd225822440b2.exe	net.exe
PID 940 wrote to memory of 584	940	net.exe	net1.exe
PID 940 wrote to memory of 584	940	net.exe	net1.exe
PID 940 wrote to memory of 584	940	net.exe	net1.exe
PID 940 wrote to memory of 584	940	net.exe	net1.exe
PID 852 wrote to memory of 1248	852	fafa02136ab83334ff91531e2cfd9911ba7c5759df63beae12cbd225822440b2.exe	net.exe
PID 852 wrote to memory of 1248	852	fafa02136ab83334ff91531e2cfd9911ba7c5759df63beae12cbd225822440b2.exe	net.exe
PID 852 wrote to memory of 1248	852	fafa02136ab83334ff91531e2cfd9911ba7c5759df63beae12cbd225822440b2.exe	net.exe
PID 852 wrote to memory of 1248	852	fafa02136ab83334ff91531e2cfd9911ba7c5759df63beae12cbd225822440b2.exe	net.exe
PID 1248 wrote to memory of 1872	1248	net.exe	net1.exe
PID 1248 wrote to memory of 1872	1248	net.exe	net1.exe
PID 1248 wrote to memory of 1872	1248	net.exe	net1.exe
PID 1248 wrote to memory of 1872	1248	net.exe	net1.exe
PID 852 wrote to memory of 860	852	fafa02136ab83334ff91531e2cfd9911ba7c5759df63beae12cbd225822440b2.exe	installd.exe
PID 852 wrote to memory of 860	852	fafa02136ab83334ff91531e2cfd9911ba7c5759df63beae12cbd225822440b2.exe	installd.exe
PID 852 wrote to memory of 860	852	fafa02136ab83334ff91531e2cfd9911ba7c5759df63beae12cbd225822440b2.exe	installd.exe
PID 852 wrote to memory of 860	852	fafa02136ab83334ff91531e2cfd9911ba7c5759df63beae12cbd225822440b2.exe	installd.exe
PID 852 wrote to memory of 860	852	fafa02136ab83334ff91531e2cfd9911ba7c5759df63beae12cbd225822440b2.exe	installd.exe
PID 852 wrote to memory of 860	852	fafa02136ab83334ff91531e2cfd9911ba7c5759df63beae12cbd225822440b2.exe	installd.exe
PID 852 wrote to memory of 860	852	fafa02136ab83334ff91531e2cfd9911ba7c5759df63beae12cbd225822440b2.exe	installd.exe
PID 852 wrote to memory of 1536	852	fafa02136ab83334ff91531e2cfd9911ba7c5759df63beae12cbd225822440b2.exe	nethtsrv.exe
PID 852 wrote to memory of 1536	852	fafa02136ab83334ff91531e2cfd9911ba7c5759df63beae12cbd225822440b2.exe	nethtsrv.exe
PID 852 wrote to memory of 1536	852	fafa02136ab83334ff91531e2cfd9911ba7c5759df63beae12cbd225822440b2.exe	nethtsrv.exe
PID 852 wrote to memory of 1536	852	fafa02136ab83334ff91531e2cfd9911ba7c5759df63beae12cbd225822440b2.exe	nethtsrv.exe
PID 852 wrote to memory of 1568	852	fafa02136ab83334ff91531e2cfd9911ba7c5759df63beae12cbd225822440b2.exe	netupdsrv.exe
PID 852 wrote to memory of 1568	852	fafa02136ab83334ff91531e2cfd9911ba7c5759df63beae12cbd225822440b2.exe	netupdsrv.exe
PID 852 wrote to memory of 1568	852	fafa02136ab83334ff91531e2cfd9911ba7c5759df63beae12cbd225822440b2.exe	netupdsrv.exe
PID 852 wrote to memory of 1568	852	fafa02136ab83334ff91531e2cfd9911ba7c5759df63beae12cbd225822440b2.exe	netupdsrv.exe
PID 852 wrote to memory of 1568	852	fafa02136ab83334ff91531e2cfd9911ba7c5759df63beae12cbd225822440b2.exe	netupdsrv.exe
PID 852 wrote to memory of 1568	852	fafa02136ab83334ff91531e2cfd9911ba7c5759df63beae12cbd225822440b2.exe	netupdsrv.exe
PID 852 wrote to memory of 1568	852	fafa02136ab83334ff91531e2cfd9911ba7c5759df63beae12cbd225822440b2.exe	netupdsrv.exe
PID 852 wrote to memory of 1908	852	fafa02136ab83334ff91531e2cfd9911ba7c5759df63beae12cbd225822440b2.exe	net.exe
PID 852 wrote to memory of 1908	852	fafa02136ab83334ff91531e2cfd9911ba7c5759df63beae12cbd225822440b2.exe	net.exe
PID 852 wrote to memory of 1908	852	fafa02136ab83334ff91531e2cfd9911ba7c5759df63beae12cbd225822440b2.exe	net.exe
PID 852 wrote to memory of 1908	852	fafa02136ab83334ff91531e2cfd9911ba7c5759df63beae12cbd225822440b2.exe	net.exe
PID 1908 wrote to memory of 2012	1908	net.exe	net1.exe
PID 1908 wrote to memory of 2012	1908	net.exe	net1.exe
PID 1908 wrote to memory of 2012	1908	net.exe	net1.exe
PID 1908 wrote to memory of 2012	1908	net.exe	net1.exe
PID 852 wrote to memory of 1256	852	fafa02136ab83334ff91531e2cfd9911ba7c5759df63beae12cbd225822440b2.exe	net.exe
PID 852 wrote to memory of 1256	852	fafa02136ab83334ff91531e2cfd9911ba7c5759df63beae12cbd225822440b2.exe	net.exe
PID 852 wrote to memory of 1256	852	fafa02136ab83334ff91531e2cfd9911ba7c5759df63beae12cbd225822440b2.exe	net.exe
PID 852 wrote to memory of 1256	852	fafa02136ab83334ff91531e2cfd9911ba7c5759df63beae12cbd225822440b2.exe	net.exe
PID 1256 wrote to memory of 1392	1256	net.exe	net1.exe
PID 1256 wrote to memory of 1392	1256	net.exe	net1.exe
PID 1256 wrote to memory of 1392	1256	net.exe	net1.exe
PID 1256 wrote to memory of 1392	1256	net.exe	net1.exe

C:\Users\Admin\AppData\Local\Temp\fafa02136ab83334ff91531e2cfd9911ba7c5759df63beae12cbd225822440b2.exe
"C:\Users\Admin\AppData\Local\Temp\fafa02136ab83334ff91531e2cfd9911ba7c5759df63beae12cbd225822440b2.exe"
1⤵
- Drops file in Drivers directory
- Loads dropped DLL
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:852

C:\Windows\SysWOW64\net.exe
net stop nethttpservice
2⤵
- Suspicious use of WriteProcessMemory
PID:940

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop nethttpservice
3⤵
PID:584

C:\Windows\SysWOW64\net.exe
net stop serviceupdater
2⤵
- Suspicious use of WriteProcessMemory
PID:1248

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop serviceupdater
3⤵
PID:1872

C:\Windows\SysWOW64\installd.exe
"C:\Windows\system32\installd.exe" nethfdrv
2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:860

C:\Windows\SysWOW64\nethtsrv.exe
"C:\Windows\system32\nethtsrv.exe" -nfdi
2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1536

C:\Windows\SysWOW64\netupdsrv.exe
"C:\Windows\system32\netupdsrv.exe" -nfdi
2⤵
- Executes dropped EXE
PID:1568

C:\Windows\SysWOW64\net.exe
net start nethttpservice
2⤵
- Suspicious use of WriteProcessMemory
PID:1908

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 start nethttpservice
3⤵
PID:2012

C:\Windows\SysWOW64\net.exe
net start serviceupdater
2⤵
- Suspicious use of WriteProcessMemory
PID:1256

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 start serviceupdater
3⤵
PID:1392

C:\Windows\SysWOW64\nethtsrv.exe
C:\Windows\SysWOW64\nethtsrv.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:1064

C:\Windows\SysWOW64\netupdsrv.exe
C:\Windows\SysWOW64\netupdsrv.exe
1⤵
- Executes dropped EXE
PID:1432

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\hfnapi.dll
Filesize
106KB

MD5
9f6d5e9b22477a9151b46486cebe8bc0

SHA1
d6596a88e3bfb52ee820fbf862ea3bb71ad6370d

SHA256
d435a2920f1a8adab2481bfcdd82cfd0ca9f2e9aa4eab3a7d519d05baa9fceee

SHA512
88ae3376d3cef76a52c0264bd3fa42decbcecaf8d908498099ce235b83a644359c643233baec5836d579d7a3ce337fab4e49ca951227626475ad7612692d3ddd

Download Submit
C:\Windows\SysWOW64\hfpapi.dll
Filesize
244KB

MD5
d2d7ae2bc9a53705b3ff4a512eaac18e

SHA1
fea9b082964e12b0df5d3e5b1fc1dc48aaff5ece

SHA256
0b17ca8fb071ded9bc95c5752f90da4ae8c5a8fd497cbc04b4665d88706650de

SHA512
1bc87187fe9738404ce5e0bc47258fdc2e5e5eeb6f651df35689d0835c77b12551ccf7238d5d95a2d0816f06a4115375be0c68c28c41c14aa6423864a9a805c0

Download Submit
C:\Windows\SysWOW64\installd.exe
Filesize
108KB

MD5
d4e66692b3bdd00a380b3606e80fe6a7

SHA1
237d63d33298230162f4c1224d5026c8db6fcfca

SHA256
742e7524670755614225afab1d66858b87d76e2acb33cbd97ae3abd7bbf4bf9f

SHA512
f820d894b0c9a88634a7064f40894a5bdca5b8245b77fd5d690b33a2c21fe5c2cae6392fdf7de4a3f1b251e6a7d9cba98547d4bec11ad25225283dda7e1fda87

Download Submit
C:\Windows\SysWOW64\nethtsrv.exe
Filesize
176KB

MD5
85fd8da724798805a8f2fe9e720bb2c0

SHA1
d95d85f47a21364d8b900cf4a8551db399a78957

SHA256
0d5eb2cc4e5b21049e7013bee0684a956563f1c356b366da3426575c8958b56b

SHA512
55a3dcccb602fb14dd11f7d3e4256bc6455a6a02ce7b695cf696a16b7f08bcc30dc12a7e457474109eaaff522eb3a18d9b667a59143c29cdb1485cadbbcef4ae

Download Submit
C:\Windows\SysWOW64\nethtsrv.exe
Filesize
176KB

MD5
85fd8da724798805a8f2fe9e720bb2c0

SHA1
d95d85f47a21364d8b900cf4a8551db399a78957

SHA256
0d5eb2cc4e5b21049e7013bee0684a956563f1c356b366da3426575c8958b56b

SHA512
55a3dcccb602fb14dd11f7d3e4256bc6455a6a02ce7b695cf696a16b7f08bcc30dc12a7e457474109eaaff522eb3a18d9b667a59143c29cdb1485cadbbcef4ae

Download Submit
C:\Windows\SysWOW64\netupdsrv.exe
Filesize
158KB

MD5
e24f32592fb47b82ebe9bf662b1e571a

SHA1
1028899e485bdd25b385cf6c8e4304772c931e03

SHA256
0a40aed0bf18c11a4c43cc8ede3f624093ddb8dc46d0f670e707da9e3f4032db

SHA512
03007dd051a45a6951e85742ec8f7fec45ee14a3fdceadb2feb0b5431dd73c22973adf69f83c77ce1edc43ec23bc64ac4214776679eb5f07b402fb345c777d7a

Download Submit
C:\Windows\SysWOW64\netupdsrv.exe
Filesize
158KB

MD5
e24f32592fb47b82ebe9bf662b1e571a

SHA1
1028899e485bdd25b385cf6c8e4304772c931e03

SHA256
0a40aed0bf18c11a4c43cc8ede3f624093ddb8dc46d0f670e707da9e3f4032db

SHA512
03007dd051a45a6951e85742ec8f7fec45ee14a3fdceadb2feb0b5431dd73c22973adf69f83c77ce1edc43ec23bc64ac4214776679eb5f07b402fb345c777d7a

Download Submit
\Users\Admin\AppData\Local\Temp\nst2FAB.tmp\System.dll
Filesize
11KB

MD5
c17103ae9072a06da581dec998343fc1

SHA1
b72148c6bdfaada8b8c3f950e610ee7cf1da1f8d

SHA256
dc58d8ad81cacb0c1ed72e33bff8f23ea40b5252b5bb55d393a0903e6819ae2f

SHA512
d32a71aaef18e993f28096d536e41c4d016850721b31171513ce28bbd805a54fd290b7c3e9d935f72e676a1acfb4f0dcc89d95040a0dd29f2b6975855c18986f

Download Submit
\Users\Admin\AppData\Local\Temp\nst2FAB.tmp\nsExec.dll
Filesize
6KB

MD5
acc2b699edfea5bf5aae45aba3a41e96

SHA1
d2accf4d494e43ceb2cff69abe4dd17147d29cc2

SHA256
168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e

SHA512
e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe

Download Submit
\Users\Admin\AppData\Local\Temp\nst2FAB.tmp\nsExec.dll
Filesize
6KB

MD5
acc2b699edfea5bf5aae45aba3a41e96

SHA1
d2accf4d494e43ceb2cff69abe4dd17147d29cc2

SHA256
168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e

SHA512
e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe

Download Submit
\Users\Admin\AppData\Local\Temp\nst2FAB.tmp\nsExec.dll
Filesize
6KB

MD5
acc2b699edfea5bf5aae45aba3a41e96

SHA1
d2accf4d494e43ceb2cff69abe4dd17147d29cc2

SHA256
168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e

SHA512
e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe

Download Submit
\Users\Admin\AppData\Local\Temp\nst2FAB.tmp\nsExec.dll
Filesize
6KB

MD5
acc2b699edfea5bf5aae45aba3a41e96

SHA1
d2accf4d494e43ceb2cff69abe4dd17147d29cc2

SHA256
168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e

SHA512
e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe

Download Submit
\Windows\SysWOW64\hfnapi.dll
Filesize
106KB

MD5
9f6d5e9b22477a9151b46486cebe8bc0

SHA1
d6596a88e3bfb52ee820fbf862ea3bb71ad6370d

SHA256
d435a2920f1a8adab2481bfcdd82cfd0ca9f2e9aa4eab3a7d519d05baa9fceee

SHA512
88ae3376d3cef76a52c0264bd3fa42decbcecaf8d908498099ce235b83a644359c643233baec5836d579d7a3ce337fab4e49ca951227626475ad7612692d3ddd

Download Submit
\Windows\SysWOW64\hfnapi.dll
Filesize
106KB

MD5
9f6d5e9b22477a9151b46486cebe8bc0

SHA1
d6596a88e3bfb52ee820fbf862ea3bb71ad6370d

SHA256
d435a2920f1a8adab2481bfcdd82cfd0ca9f2e9aa4eab3a7d519d05baa9fceee

SHA512
88ae3376d3cef76a52c0264bd3fa42decbcecaf8d908498099ce235b83a644359c643233baec5836d579d7a3ce337fab4e49ca951227626475ad7612692d3ddd

Download Submit
\Windows\SysWOW64\hfnapi.dll
Filesize
106KB

MD5
9f6d5e9b22477a9151b46486cebe8bc0

SHA1
d6596a88e3bfb52ee820fbf862ea3bb71ad6370d

SHA256
d435a2920f1a8adab2481bfcdd82cfd0ca9f2e9aa4eab3a7d519d05baa9fceee

SHA512
88ae3376d3cef76a52c0264bd3fa42decbcecaf8d908498099ce235b83a644359c643233baec5836d579d7a3ce337fab4e49ca951227626475ad7612692d3ddd

Download Submit
\Windows\SysWOW64\hfpapi.dll
Filesize
244KB

MD5
d2d7ae2bc9a53705b3ff4a512eaac18e

SHA1
fea9b082964e12b0df5d3e5b1fc1dc48aaff5ece

SHA256
0b17ca8fb071ded9bc95c5752f90da4ae8c5a8fd497cbc04b4665d88706650de

SHA512
1bc87187fe9738404ce5e0bc47258fdc2e5e5eeb6f651df35689d0835c77b12551ccf7238d5d95a2d0816f06a4115375be0c68c28c41c14aa6423864a9a805c0

Download Submit
\Windows\SysWOW64\hfpapi.dll
Filesize
244KB

MD5
d2d7ae2bc9a53705b3ff4a512eaac18e

SHA1
fea9b082964e12b0df5d3e5b1fc1dc48aaff5ece

SHA256
0b17ca8fb071ded9bc95c5752f90da4ae8c5a8fd497cbc04b4665d88706650de

SHA512
1bc87187fe9738404ce5e0bc47258fdc2e5e5eeb6f651df35689d0835c77b12551ccf7238d5d95a2d0816f06a4115375be0c68c28c41c14aa6423864a9a805c0

Download Submit
\Windows\SysWOW64\installd.exe
Filesize
108KB

MD5
d4e66692b3bdd00a380b3606e80fe6a7

SHA1
237d63d33298230162f4c1224d5026c8db6fcfca

SHA256
742e7524670755614225afab1d66858b87d76e2acb33cbd97ae3abd7bbf4bf9f

SHA512
f820d894b0c9a88634a7064f40894a5bdca5b8245b77fd5d690b33a2c21fe5c2cae6392fdf7de4a3f1b251e6a7d9cba98547d4bec11ad25225283dda7e1fda87

Download Submit
\Windows\SysWOW64\nethtsrv.exe
Filesize
176KB

MD5
85fd8da724798805a8f2fe9e720bb2c0

SHA1
d95d85f47a21364d8b900cf4a8551db399a78957

SHA256
0d5eb2cc4e5b21049e7013bee0684a956563f1c356b366da3426575c8958b56b

SHA512
55a3dcccb602fb14dd11f7d3e4256bc6455a6a02ce7b695cf696a16b7f08bcc30dc12a7e457474109eaaff522eb3a18d9b667a59143c29cdb1485cadbbcef4ae

Download Submit
\Windows\SysWOW64\netupdsrv.exe
Filesize
158KB

MD5
e24f32592fb47b82ebe9bf662b1e571a

SHA1
1028899e485bdd25b385cf6c8e4304772c931e03

SHA256
0a40aed0bf18c11a4c43cc8ede3f624093ddb8dc46d0f670e707da9e3f4032db

SHA512
03007dd051a45a6951e85742ec8f7fec45ee14a3fdceadb2feb0b5431dd73c22973adf69f83c77ce1edc43ec23bc64ac4214776679eb5f07b402fb345c777d7a

Download Submit
memory/584-59-0x0000000000000000-mapping.dmp

Download
memory/852-90-0x0000000000360000-0x00000000007BE000-memory.dmp

Filesize
4.4MB

Download
memory/852-54-0x0000000074E41000-0x0000000074E43000-memory.dmp

Filesize
8KB

Download
memory/852-58-0x0000000000360000-0x00000000007BE000-memory.dmp

Filesize
4.4MB

Download
memory/860-64-0x0000000000000000-mapping.dmp

Download
memory/940-57-0x0000000000000000-mapping.dmp

Download
memory/1248-61-0x0000000000000000-mapping.dmp

Download
memory/1256-86-0x0000000000000000-mapping.dmp

Download
memory/1392-87-0x0000000000000000-mapping.dmp

Download
memory/1536-70-0x0000000000000000-mapping.dmp

Download
memory/1568-76-0x0000000000000000-mapping.dmp

Download
memory/1872-62-0x0000000000000000-mapping.dmp

Download
memory/1908-80-0x0000000000000000-mapping.dmp

Download
memory/2012-81-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads