d5801fde5ded2bc1c4783e8cf1a1117f860d7b7373045df4fc0105d176012e0c

Analysis

max time kernel
75s
max time network
35s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
23-11-2022 10:11

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d5801fde5ded2bc1c4783e8cf1a1117f860d7b7373045df4fc0105d176012e0c.exe
Size

603KB
MD5

5443d6e0a6422547f397f1f60fdc72f9
SHA1

d2343b1f0b5686a5002eb7767d1e1c573d587dc1
SHA256

d5801fde5ded2bc1c4783e8cf1a1117f860d7b7373045df4fc0105d176012e0c
SHA512

73116c83f8419b2a9d014b06ce60e5d60ea70c4ea1ea8fff7cb2f0cd0d80c5fd1f194616954a318c0375ac2b339c4bf8add5db7a7434eb8d10ffdd5d2b315eb8
SSDEEP

12288:LIny5DYTfIPTms6GkqFZVjk8OHMYS+peJ6o:zUTfgTms6nQjk9S+A6

Score

8^/10

discovery

Malware Config

Signatures

Drops file in Drivers directory 1 IoCs

Processes:

d5801fde5ded2bc1c4783e8cf1a1117f860d7b7373045df4fc0105d176012e0c.exe

description ioc process

File created C:\Windows\system32\drivers\nethfdrv.sys d5801fde5ded2bc1c4783e8cf1a1117f860d7b7373045df4fc0105d176012e0c.exe
Executes dropped EXE 5 IoCs

Processes:

installd.exenethtsrv.exenetupdsrv.exenethtsrv.exenetupdsrv.exe

pid process

1740 installd.exe
848 nethtsrv.exe
1100 netupdsrv.exe
1352 nethtsrv.exe
1600 netupdsrv.exe

description	ioc	process
File created	C:\Windows\system32\drivers\nethfdrv.sys	d5801fde5ded2bc1c4783e8cf1a1117f860d7b7373045df4fc0105d176012e0c.exe

pid	process
1740	installd.exe
848	nethtsrv.exe
1100	netupdsrv.exe
1352	nethtsrv.exe
1600	netupdsrv.exe

Loads dropped DLL 13 IoCs

Processes:

d5801fde5ded2bc1c4783e8cf1a1117f860d7b7373045df4fc0105d176012e0c.exeinstalld.exenethtsrv.exenethtsrv.exe

pid	process
1748	d5801fde5ded2bc1c4783e8cf1a1117f860d7b7373045df4fc0105d176012e0c.exe
1748	d5801fde5ded2bc1c4783e8cf1a1117f860d7b7373045df4fc0105d176012e0c.exe
1748	d5801fde5ded2bc1c4783e8cf1a1117f860d7b7373045df4fc0105d176012e0c.exe
1748	d5801fde5ded2bc1c4783e8cf1a1117f860d7b7373045df4fc0105d176012e0c.exe
1740	installd.exe
1748	d5801fde5ded2bc1c4783e8cf1a1117f860d7b7373045df4fc0105d176012e0c.exe
848	nethtsrv.exe
848	nethtsrv.exe
1748	d5801fde5ded2bc1c4783e8cf1a1117f860d7b7373045df4fc0105d176012e0c.exe
1748	d5801fde5ded2bc1c4783e8cf1a1117f860d7b7373045df4fc0105d176012e0c.exe
1352	nethtsrv.exe
1352	nethtsrv.exe
1748	d5801fde5ded2bc1c4783e8cf1a1117f860d7b7373045df4fc0105d176012e0c.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in System32 directory 5 IoCs

Processes:

d5801fde5ded2bc1c4783e8cf1a1117f860d7b7373045df4fc0105d176012e0c.exe

description	ioc	process
File created	C:\Windows\SysWOW64\nethtsrv.exe	d5801fde5ded2bc1c4783e8cf1a1117f860d7b7373045df4fc0105d176012e0c.exe
File created	C:\Windows\SysWOW64\netupdsrv.exe	d5801fde5ded2bc1c4783e8cf1a1117f860d7b7373045df4fc0105d176012e0c.exe
File created	C:\Windows\SysWOW64\hfnapi.dll	d5801fde5ded2bc1c4783e8cf1a1117f860d7b7373045df4fc0105d176012e0c.exe
File created	C:\Windows\SysWOW64\hfpapi.dll	d5801fde5ded2bc1c4783e8cf1a1117f860d7b7373045df4fc0105d176012e0c.exe
File created	C:\Windows\SysWOW64\installd.exe	d5801fde5ded2bc1c4783e8cf1a1117f860d7b7373045df4fc0105d176012e0c.exe

Drops file in Program Files directory 3 IoCs

Processes:

d5801fde5ded2bc1c4783e8cf1a1117f860d7b7373045df4fc0105d176012e0c.exe

description	ioc	process
File created	C:\Program Files (x86)\Common Files\Config\data.xml	d5801fde5ded2bc1c4783e8cf1a1117f860d7b7373045df4fc0105d176012e0c.exe
File created	C:\Program Files (x86)\Common Files\Config\ver.xml	d5801fde5ded2bc1c4783e8cf1a1117f860d7b7373045df4fc0105d176012e0c.exe
File created	C:\Program Files (x86)\Common Files\config\uninstinethnfd.exe	d5801fde5ded2bc1c4783e8cf1a1117f860d7b7373045df4fc0105d176012e0c.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Runs net.exe
Suspicious behavior: LoadsDriver 1 IoCs

Processes:

pid process

460
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

nethtsrv.exe

description pid process

Token: SeDebugPrivilege 1352 nethtsrv.exe

pid	process
460

description	pid	process
Token: SeDebugPrivilege	1352	nethtsrv.exe

Suspicious use of WriteProcessMemory 50 IoCs

Processes:

d5801fde5ded2bc1c4783e8cf1a1117f860d7b7373045df4fc0105d176012e0c.exenet.exenet.exenet.exenet.exe

description	pid	process	target process
PID 1748 wrote to memory of 892	1748	d5801fde5ded2bc1c4783e8cf1a1117f860d7b7373045df4fc0105d176012e0c.exe	net.exe
PID 1748 wrote to memory of 892	1748	d5801fde5ded2bc1c4783e8cf1a1117f860d7b7373045df4fc0105d176012e0c.exe	net.exe
PID 1748 wrote to memory of 892	1748	d5801fde5ded2bc1c4783e8cf1a1117f860d7b7373045df4fc0105d176012e0c.exe	net.exe
PID 1748 wrote to memory of 892	1748	d5801fde5ded2bc1c4783e8cf1a1117f860d7b7373045df4fc0105d176012e0c.exe	net.exe
PID 892 wrote to memory of 432	892	net.exe	net1.exe
PID 892 wrote to memory of 432	892	net.exe	net1.exe
PID 892 wrote to memory of 432	892	net.exe	net1.exe
PID 892 wrote to memory of 432	892	net.exe	net1.exe
PID 1748 wrote to memory of 564	1748	d5801fde5ded2bc1c4783e8cf1a1117f860d7b7373045df4fc0105d176012e0c.exe	net.exe
PID 1748 wrote to memory of 564	1748	d5801fde5ded2bc1c4783e8cf1a1117f860d7b7373045df4fc0105d176012e0c.exe	net.exe
PID 1748 wrote to memory of 564	1748	d5801fde5ded2bc1c4783e8cf1a1117f860d7b7373045df4fc0105d176012e0c.exe	net.exe
PID 1748 wrote to memory of 564	1748	d5801fde5ded2bc1c4783e8cf1a1117f860d7b7373045df4fc0105d176012e0c.exe	net.exe
PID 564 wrote to memory of 1816	564	net.exe	net1.exe
PID 564 wrote to memory of 1816	564	net.exe	net1.exe
PID 564 wrote to memory of 1816	564	net.exe	net1.exe
PID 564 wrote to memory of 1816	564	net.exe	net1.exe
PID 1748 wrote to memory of 1740	1748	d5801fde5ded2bc1c4783e8cf1a1117f860d7b7373045df4fc0105d176012e0c.exe	installd.exe
PID 1748 wrote to memory of 1740	1748	d5801fde5ded2bc1c4783e8cf1a1117f860d7b7373045df4fc0105d176012e0c.exe	installd.exe
PID 1748 wrote to memory of 1740	1748	d5801fde5ded2bc1c4783e8cf1a1117f860d7b7373045df4fc0105d176012e0c.exe	installd.exe
PID 1748 wrote to memory of 1740	1748	d5801fde5ded2bc1c4783e8cf1a1117f860d7b7373045df4fc0105d176012e0c.exe	installd.exe
PID 1748 wrote to memory of 1740	1748	d5801fde5ded2bc1c4783e8cf1a1117f860d7b7373045df4fc0105d176012e0c.exe	installd.exe
PID 1748 wrote to memory of 1740	1748	d5801fde5ded2bc1c4783e8cf1a1117f860d7b7373045df4fc0105d176012e0c.exe	installd.exe
PID 1748 wrote to memory of 1740	1748	d5801fde5ded2bc1c4783e8cf1a1117f860d7b7373045df4fc0105d176012e0c.exe	installd.exe
PID 1748 wrote to memory of 848	1748	d5801fde5ded2bc1c4783e8cf1a1117f860d7b7373045df4fc0105d176012e0c.exe	nethtsrv.exe
PID 1748 wrote to memory of 848	1748	d5801fde5ded2bc1c4783e8cf1a1117f860d7b7373045df4fc0105d176012e0c.exe	nethtsrv.exe
PID 1748 wrote to memory of 848	1748	d5801fde5ded2bc1c4783e8cf1a1117f860d7b7373045df4fc0105d176012e0c.exe	nethtsrv.exe
PID 1748 wrote to memory of 848	1748	d5801fde5ded2bc1c4783e8cf1a1117f860d7b7373045df4fc0105d176012e0c.exe	nethtsrv.exe
PID 1748 wrote to memory of 1100	1748	d5801fde5ded2bc1c4783e8cf1a1117f860d7b7373045df4fc0105d176012e0c.exe	netupdsrv.exe
PID 1748 wrote to memory of 1100	1748	d5801fde5ded2bc1c4783e8cf1a1117f860d7b7373045df4fc0105d176012e0c.exe	netupdsrv.exe
PID 1748 wrote to memory of 1100	1748	d5801fde5ded2bc1c4783e8cf1a1117f860d7b7373045df4fc0105d176012e0c.exe	netupdsrv.exe
PID 1748 wrote to memory of 1100	1748	d5801fde5ded2bc1c4783e8cf1a1117f860d7b7373045df4fc0105d176012e0c.exe	netupdsrv.exe
PID 1748 wrote to memory of 1100	1748	d5801fde5ded2bc1c4783e8cf1a1117f860d7b7373045df4fc0105d176012e0c.exe	netupdsrv.exe
PID 1748 wrote to memory of 1100	1748	d5801fde5ded2bc1c4783e8cf1a1117f860d7b7373045df4fc0105d176012e0c.exe	netupdsrv.exe
PID 1748 wrote to memory of 1100	1748	d5801fde5ded2bc1c4783e8cf1a1117f860d7b7373045df4fc0105d176012e0c.exe	netupdsrv.exe
PID 1748 wrote to memory of 1876	1748	d5801fde5ded2bc1c4783e8cf1a1117f860d7b7373045df4fc0105d176012e0c.exe	net.exe
PID 1748 wrote to memory of 1876	1748	d5801fde5ded2bc1c4783e8cf1a1117f860d7b7373045df4fc0105d176012e0c.exe	net.exe
PID 1748 wrote to memory of 1876	1748	d5801fde5ded2bc1c4783e8cf1a1117f860d7b7373045df4fc0105d176012e0c.exe	net.exe
PID 1748 wrote to memory of 1876	1748	d5801fde5ded2bc1c4783e8cf1a1117f860d7b7373045df4fc0105d176012e0c.exe	net.exe
PID 1876 wrote to memory of 1768	1876	net.exe	net1.exe
PID 1876 wrote to memory of 1768	1876	net.exe	net1.exe
PID 1876 wrote to memory of 1768	1876	net.exe	net1.exe
PID 1876 wrote to memory of 1768	1876	net.exe	net1.exe
PID 1748 wrote to memory of 1868	1748	d5801fde5ded2bc1c4783e8cf1a1117f860d7b7373045df4fc0105d176012e0c.exe	net.exe
PID 1748 wrote to memory of 1868	1748	d5801fde5ded2bc1c4783e8cf1a1117f860d7b7373045df4fc0105d176012e0c.exe	net.exe
PID 1748 wrote to memory of 1868	1748	d5801fde5ded2bc1c4783e8cf1a1117f860d7b7373045df4fc0105d176012e0c.exe	net.exe
PID 1748 wrote to memory of 1868	1748	d5801fde5ded2bc1c4783e8cf1a1117f860d7b7373045df4fc0105d176012e0c.exe	net.exe
PID 1868 wrote to memory of 1332	1868	net.exe	net1.exe
PID 1868 wrote to memory of 1332	1868	net.exe	net1.exe
PID 1868 wrote to memory of 1332	1868	net.exe	net1.exe
PID 1868 wrote to memory of 1332	1868	net.exe	net1.exe

C:\Users\Admin\AppData\Local\Temp\d5801fde5ded2bc1c4783e8cf1a1117f860d7b7373045df4fc0105d176012e0c.exe
"C:\Users\Admin\AppData\Local\Temp\d5801fde5ded2bc1c4783e8cf1a1117f860d7b7373045df4fc0105d176012e0c.exe"
1⤵
- Drops file in Drivers directory
- Loads dropped DLL
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:1748

C:\Windows\SysWOW64\net.exe
net stop nethttpservice
2⤵
- Suspicious use of WriteProcessMemory
PID:892

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop nethttpservice
3⤵
PID:432

C:\Windows\SysWOW64\net.exe
net stop serviceupdater
2⤵
- Suspicious use of WriteProcessMemory
PID:564

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop serviceupdater
3⤵
PID:1816

C:\Windows\SysWOW64\installd.exe
"C:\Windows\system32\installd.exe" nethfdrv
2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1740

C:\Windows\SysWOW64\nethtsrv.exe
"C:\Windows\system32\nethtsrv.exe" -nfdi
2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:848

C:\Windows\SysWOW64\netupdsrv.exe
"C:\Windows\system32\netupdsrv.exe" -nfdi
2⤵
- Executes dropped EXE
PID:1100

C:\Windows\SysWOW64\net.exe
net start nethttpservice
2⤵
- Suspicious use of WriteProcessMemory
PID:1876

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 start nethttpservice
3⤵
PID:1768

C:\Windows\SysWOW64\net.exe
net start serviceupdater
2⤵
- Suspicious use of WriteProcessMemory
PID:1868

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 start serviceupdater
3⤵
PID:1332

C:\Windows\SysWOW64\nethtsrv.exe
C:\Windows\SysWOW64\nethtsrv.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:1352

C:\Windows\SysWOW64\netupdsrv.exe
C:\Windows\SysWOW64\netupdsrv.exe
1⤵
- Executes dropped EXE
PID:1600

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\hfnapi.dll
Filesize
106KB

MD5
a12b379a32fc25ff2e0107c4baa66ef1

SHA1
79626fea20de71bb08efd8a92d170f7fce93beca

SHA256
7a84f0fd9007555b686d9cf932b048ce726107058bbbd7d5b9cd4fca740a500e

SHA512
07cf482b6473950b69e2bc6075fc6520959798314a43fabbdd6715edd5b1df8b85d1d488f3c53255104fee62ecc4340b8f321a78aff333b074e4d38fe8d5dc4a

Download Submit
C:\Windows\SysWOW64\hfpapi.dll
Filesize
244KB

MD5
d0de598bdefa22257c7ad55a36522f63

SHA1
f77a808509e1851fd09ba545ab4a5521edb86fd8

SHA256
5cd56b73f134d512befeab82cd55b7fe70cae8cf79b4784a9b41e8aaa9a15de8

SHA512
ffa7ddbc95824e800b950aa553f0ab4bd101e8ea5c34e7ef970d2bf6003e5750d24dd9f7c528748d2d340bad002ebb9dc802b6b0a357bc8f32b656543274279e

Download Submit
C:\Windows\SysWOW64\installd.exe
Filesize
108KB

MD5
e1aff4cbe353ef6ad04150150fdd0e11

SHA1
fbb7bef55e472175ea8e7e8f585184fef8c997b3

SHA256
0b92432c7d802fa8714a3a79338dc7f4162c61b385f106ce07e710843d1c9457

SHA512
74b2d65cb69bdb994c031ff64d83e1c5f4f57f38b230d1f172576d1377ae77d177ab047c78f17e167bb33212c31b2ed9f30657a33dffbb0b42d47479d22d9b36

Download Submit
C:\Windows\SysWOW64\nethtsrv.exe
Filesize
176KB

MD5
ea561abfd9ba7fbc18c812edee336e84

SHA1
48c4bf7a3cebe805a1e9ba86e4541790171c9fe8

SHA256
791683ee0b394b9e843c89a115e6fbacc0e80f5bd90c6b7376a6b5d65adf9241

SHA512
2133cd69db68c420df592e1833554a4210460d9133588eab3b499ce68cc7275b46da217337737d4ba1e7e28f7105eed73b82d1635a2207b7508896c297f77f8f

Download Submit
C:\Windows\SysWOW64\nethtsrv.exe
Filesize
176KB

MD5
ea561abfd9ba7fbc18c812edee336e84

SHA1
48c4bf7a3cebe805a1e9ba86e4541790171c9fe8

SHA256
791683ee0b394b9e843c89a115e6fbacc0e80f5bd90c6b7376a6b5d65adf9241

SHA512
2133cd69db68c420df592e1833554a4210460d9133588eab3b499ce68cc7275b46da217337737d4ba1e7e28f7105eed73b82d1635a2207b7508896c297f77f8f

Download Submit
C:\Windows\SysWOW64\netupdsrv.exe
Filesize
159KB

MD5
66c79b46c43aedd2dc040ef956018a14

SHA1
402fd6f62f575e74c91dc77c1e3eee84ec9429df

SHA256
e548886de680f0b81cce994908e88f4973296451337adfc328c94e52f7d42513

SHA512
bb7512151ca224f3e94e6b6edb46dd5ebfe79dcd6eb5f43359080ab64f70cda0ee6fe9eea48803959ec24c678d432657c0611aa2aa5bcf5fea64450d5f3c8f8b

Download Submit
C:\Windows\SysWOW64\netupdsrv.exe
Filesize
159KB

MD5
66c79b46c43aedd2dc040ef956018a14

SHA1
402fd6f62f575e74c91dc77c1e3eee84ec9429df

SHA256
e548886de680f0b81cce994908e88f4973296451337adfc328c94e52f7d42513

SHA512
bb7512151ca224f3e94e6b6edb46dd5ebfe79dcd6eb5f43359080ab64f70cda0ee6fe9eea48803959ec24c678d432657c0611aa2aa5bcf5fea64450d5f3c8f8b

Download Submit
\Users\Admin\AppData\Local\Temp\nsj7005.tmp\System.dll
Filesize
11KB

MD5
c17103ae9072a06da581dec998343fc1

SHA1
b72148c6bdfaada8b8c3f950e610ee7cf1da1f8d

SHA256
dc58d8ad81cacb0c1ed72e33bff8f23ea40b5252b5bb55d393a0903e6819ae2f

SHA512
d32a71aaef18e993f28096d536e41c4d016850721b31171513ce28bbd805a54fd290b7c3e9d935f72e676a1acfb4f0dcc89d95040a0dd29f2b6975855c18986f

Download Submit
\Users\Admin\AppData\Local\Temp\nsj7005.tmp\nsExec.dll
Filesize
6KB

MD5
acc2b699edfea5bf5aae45aba3a41e96

SHA1
d2accf4d494e43ceb2cff69abe4dd17147d29cc2

SHA256
168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e

SHA512
e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe

Download Submit
\Users\Admin\AppData\Local\Temp\nsj7005.tmp\nsExec.dll
Filesize
6KB

MD5
acc2b699edfea5bf5aae45aba3a41e96

SHA1
d2accf4d494e43ceb2cff69abe4dd17147d29cc2

SHA256
168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e

SHA512
e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe

Download Submit
\Users\Admin\AppData\Local\Temp\nsj7005.tmp\nsExec.dll
Filesize
6KB

MD5
acc2b699edfea5bf5aae45aba3a41e96

SHA1
d2accf4d494e43ceb2cff69abe4dd17147d29cc2

SHA256
168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e

SHA512
e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe

Download Submit
\Users\Admin\AppData\Local\Temp\nsj7005.tmp\nsExec.dll
Filesize
6KB

MD5
acc2b699edfea5bf5aae45aba3a41e96

SHA1
d2accf4d494e43ceb2cff69abe4dd17147d29cc2

SHA256
168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e

SHA512
e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe

Download Submit
\Windows\SysWOW64\hfnapi.dll
Filesize
106KB

MD5
a12b379a32fc25ff2e0107c4baa66ef1

SHA1
79626fea20de71bb08efd8a92d170f7fce93beca

SHA256
7a84f0fd9007555b686d9cf932b048ce726107058bbbd7d5b9cd4fca740a500e

SHA512
07cf482b6473950b69e2bc6075fc6520959798314a43fabbdd6715edd5b1df8b85d1d488f3c53255104fee62ecc4340b8f321a78aff333b074e4d38fe8d5dc4a

Download Submit
\Windows\SysWOW64\hfnapi.dll
Filesize
106KB

MD5
a12b379a32fc25ff2e0107c4baa66ef1

SHA1
79626fea20de71bb08efd8a92d170f7fce93beca

SHA256
7a84f0fd9007555b686d9cf932b048ce726107058bbbd7d5b9cd4fca740a500e

SHA512
07cf482b6473950b69e2bc6075fc6520959798314a43fabbdd6715edd5b1df8b85d1d488f3c53255104fee62ecc4340b8f321a78aff333b074e4d38fe8d5dc4a

Download Submit
\Windows\SysWOW64\hfnapi.dll
Filesize
106KB

MD5
a12b379a32fc25ff2e0107c4baa66ef1

SHA1
79626fea20de71bb08efd8a92d170f7fce93beca

SHA256
7a84f0fd9007555b686d9cf932b048ce726107058bbbd7d5b9cd4fca740a500e

SHA512
07cf482b6473950b69e2bc6075fc6520959798314a43fabbdd6715edd5b1df8b85d1d488f3c53255104fee62ecc4340b8f321a78aff333b074e4d38fe8d5dc4a

Download Submit
\Windows\SysWOW64\hfpapi.dll
Filesize
244KB

MD5
d0de598bdefa22257c7ad55a36522f63

SHA1
f77a808509e1851fd09ba545ab4a5521edb86fd8

SHA256
5cd56b73f134d512befeab82cd55b7fe70cae8cf79b4784a9b41e8aaa9a15de8

SHA512
ffa7ddbc95824e800b950aa553f0ab4bd101e8ea5c34e7ef970d2bf6003e5750d24dd9f7c528748d2d340bad002ebb9dc802b6b0a357bc8f32b656543274279e

Download Submit
\Windows\SysWOW64\hfpapi.dll
Filesize
244KB

MD5
d0de598bdefa22257c7ad55a36522f63

SHA1
f77a808509e1851fd09ba545ab4a5521edb86fd8

SHA256
5cd56b73f134d512befeab82cd55b7fe70cae8cf79b4784a9b41e8aaa9a15de8

SHA512
ffa7ddbc95824e800b950aa553f0ab4bd101e8ea5c34e7ef970d2bf6003e5750d24dd9f7c528748d2d340bad002ebb9dc802b6b0a357bc8f32b656543274279e

Download Submit
\Windows\SysWOW64\installd.exe
Filesize
108KB

MD5
e1aff4cbe353ef6ad04150150fdd0e11

SHA1
fbb7bef55e472175ea8e7e8f585184fef8c997b3

SHA256
0b92432c7d802fa8714a3a79338dc7f4162c61b385f106ce07e710843d1c9457

SHA512
74b2d65cb69bdb994c031ff64d83e1c5f4f57f38b230d1f172576d1377ae77d177ab047c78f17e167bb33212c31b2ed9f30657a33dffbb0b42d47479d22d9b36

Download Submit
\Windows\SysWOW64\nethtsrv.exe
Filesize
176KB

MD5
ea561abfd9ba7fbc18c812edee336e84

SHA1
48c4bf7a3cebe805a1e9ba86e4541790171c9fe8

SHA256
791683ee0b394b9e843c89a115e6fbacc0e80f5bd90c6b7376a6b5d65adf9241

SHA512
2133cd69db68c420df592e1833554a4210460d9133588eab3b499ce68cc7275b46da217337737d4ba1e7e28f7105eed73b82d1635a2207b7508896c297f77f8f

Download Submit
\Windows\SysWOW64\netupdsrv.exe
Filesize
159KB

MD5
66c79b46c43aedd2dc040ef956018a14

SHA1
402fd6f62f575e74c91dc77c1e3eee84ec9429df

SHA256
e548886de680f0b81cce994908e88f4973296451337adfc328c94e52f7d42513

SHA512
bb7512151ca224f3e94e6b6edb46dd5ebfe79dcd6eb5f43359080ab64f70cda0ee6fe9eea48803959ec24c678d432657c0611aa2aa5bcf5fea64450d5f3c8f8b

Download Submit
memory/432-58-0x0000000000000000-mapping.dmp

Download
memory/564-60-0x0000000000000000-mapping.dmp

Download
memory/848-71-0x0000000000000000-mapping.dmp

Download
memory/892-57-0x0000000000000000-mapping.dmp

Download
memory/1100-77-0x0000000000000000-mapping.dmp

Download
memory/1332-88-0x0000000000000000-mapping.dmp

Download
memory/1740-65-0x0000000000000000-mapping.dmp

Download
memory/1748-54-0x0000000075D01000-0x0000000075D03000-memory.dmp

Filesize
8KB

Download
memory/1748-91-0x0000000000360000-0x00000000007BE000-memory.dmp

Filesize
4.4MB

Download
memory/1748-62-0x0000000000360000-0x00000000007BE000-memory.dmp

Filesize
4.4MB

Download
memory/1748-64-0x0000000000360000-0x00000000007BE000-memory.dmp

Filesize
4.4MB

Download
memory/1768-82-0x0000000000000000-mapping.dmp

Download
memory/1816-61-0x0000000000000000-mapping.dmp

Download
memory/1868-87-0x0000000000000000-mapping.dmp

Download
memory/1876-81-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads