d2a3d9c1d4ab18e98681e280fac4b7c19609a4aba224302c6cf481310cd22100

Analysis

max time kernel
28s
max time network
47s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
23-11-2022 10:11

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d2a3d9c1d4ab18e98681e280fac4b7c19609a4aba224302c6cf481310cd22100.exe
Size

602KB
MD5

598a147ec30d6353d961851e166fedfa
SHA1

b5bdfbd1e76c44d80a2a188b9d6c1c52c423a8ea
SHA256

d2a3d9c1d4ab18e98681e280fac4b7c19609a4aba224302c6cf481310cd22100
SHA512

60f2b9976d7a0ce663266c560cfb6a1e677a8232e763905dcf8318874e19addc1a45688dd66e5778eab1a5c2f1b5899824fde21f391d2611066bb732ada768d3
SSDEEP

12288:7Iny5DYTZI4m/if6rJg/zutRNj3lWNeDNWhAbXxGOwJ5xW2c2s:DUTZfm/iEAuRNj3lEepFMJm2Ps

Score

8^/10

discovery

Malware Config

Signatures

Drops file in Drivers directory 1 IoCs

Processes:

d2a3d9c1d4ab18e98681e280fac4b7c19609a4aba224302c6cf481310cd22100.exe

description ioc process

File created C:\Windows\system32\drivers\nethfdrv.sys d2a3d9c1d4ab18e98681e280fac4b7c19609a4aba224302c6cf481310cd22100.exe
Executes dropped EXE 5 IoCs

Processes:

installd.exenethtsrv.exenetupdsrv.exenethtsrv.exenetupdsrv.exe

pid process

1164 installd.exe
876 nethtsrv.exe
636 netupdsrv.exe
528 nethtsrv.exe
1916 netupdsrv.exe

description	ioc	process
File created	C:\Windows\system32\drivers\nethfdrv.sys	d2a3d9c1d4ab18e98681e280fac4b7c19609a4aba224302c6cf481310cd22100.exe

pid	process
1164	installd.exe
876	nethtsrv.exe
636	netupdsrv.exe
528	nethtsrv.exe
1916	netupdsrv.exe

Loads dropped DLL 13 IoCs

Processes:

d2a3d9c1d4ab18e98681e280fac4b7c19609a4aba224302c6cf481310cd22100.exeinstalld.exenethtsrv.exenethtsrv.exe

pid	process
916	d2a3d9c1d4ab18e98681e280fac4b7c19609a4aba224302c6cf481310cd22100.exe
916	d2a3d9c1d4ab18e98681e280fac4b7c19609a4aba224302c6cf481310cd22100.exe
916	d2a3d9c1d4ab18e98681e280fac4b7c19609a4aba224302c6cf481310cd22100.exe
916	d2a3d9c1d4ab18e98681e280fac4b7c19609a4aba224302c6cf481310cd22100.exe
1164	installd.exe
916	d2a3d9c1d4ab18e98681e280fac4b7c19609a4aba224302c6cf481310cd22100.exe
876	nethtsrv.exe
876	nethtsrv.exe
916	d2a3d9c1d4ab18e98681e280fac4b7c19609a4aba224302c6cf481310cd22100.exe
916	d2a3d9c1d4ab18e98681e280fac4b7c19609a4aba224302c6cf481310cd22100.exe
528	nethtsrv.exe
528	nethtsrv.exe
916	d2a3d9c1d4ab18e98681e280fac4b7c19609a4aba224302c6cf481310cd22100.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in System32 directory 5 IoCs

Processes:

d2a3d9c1d4ab18e98681e280fac4b7c19609a4aba224302c6cf481310cd22100.exe

description	ioc	process
File created	C:\Windows\SysWOW64\installd.exe	d2a3d9c1d4ab18e98681e280fac4b7c19609a4aba224302c6cf481310cd22100.exe
File created	C:\Windows\SysWOW64\nethtsrv.exe	d2a3d9c1d4ab18e98681e280fac4b7c19609a4aba224302c6cf481310cd22100.exe
File created	C:\Windows\SysWOW64\netupdsrv.exe	d2a3d9c1d4ab18e98681e280fac4b7c19609a4aba224302c6cf481310cd22100.exe
File created	C:\Windows\SysWOW64\hfnapi.dll	d2a3d9c1d4ab18e98681e280fac4b7c19609a4aba224302c6cf481310cd22100.exe
File created	C:\Windows\SysWOW64\hfpapi.dll	d2a3d9c1d4ab18e98681e280fac4b7c19609a4aba224302c6cf481310cd22100.exe

Drops file in Program Files directory 3 IoCs

Processes:

d2a3d9c1d4ab18e98681e280fac4b7c19609a4aba224302c6cf481310cd22100.exe

description	ioc	process
File created	C:\Program Files (x86)\Common Files\Config\data.xml	d2a3d9c1d4ab18e98681e280fac4b7c19609a4aba224302c6cf481310cd22100.exe
File created	C:\Program Files (x86)\Common Files\Config\ver.xml	d2a3d9c1d4ab18e98681e280fac4b7c19609a4aba224302c6cf481310cd22100.exe
File created	C:\Program Files (x86)\Common Files\config\uninstinethnfd.exe	d2a3d9c1d4ab18e98681e280fac4b7c19609a4aba224302c6cf481310cd22100.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Runs net.exe
Suspicious behavior: LoadsDriver 1 IoCs

Processes:

pid process

460
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

nethtsrv.exe

description pid process

Token: SeDebugPrivilege 528 nethtsrv.exe

pid	process
460

description	pid	process
Token: SeDebugPrivilege	528	nethtsrv.exe

Suspicious use of WriteProcessMemory 50 IoCs

Processes:

d2a3d9c1d4ab18e98681e280fac4b7c19609a4aba224302c6cf481310cd22100.exenet.exenet.exenet.exenet.exe

description	pid	process	target process
PID 916 wrote to memory of 960	916	d2a3d9c1d4ab18e98681e280fac4b7c19609a4aba224302c6cf481310cd22100.exe	net.exe
PID 916 wrote to memory of 960	916	d2a3d9c1d4ab18e98681e280fac4b7c19609a4aba224302c6cf481310cd22100.exe	net.exe
PID 916 wrote to memory of 960	916	d2a3d9c1d4ab18e98681e280fac4b7c19609a4aba224302c6cf481310cd22100.exe	net.exe
PID 916 wrote to memory of 960	916	d2a3d9c1d4ab18e98681e280fac4b7c19609a4aba224302c6cf481310cd22100.exe	net.exe
PID 960 wrote to memory of 1992	960	net.exe	net1.exe
PID 960 wrote to memory of 1992	960	net.exe	net1.exe
PID 960 wrote to memory of 1992	960	net.exe	net1.exe
PID 960 wrote to memory of 1992	960	net.exe	net1.exe
PID 916 wrote to memory of 2024	916	d2a3d9c1d4ab18e98681e280fac4b7c19609a4aba224302c6cf481310cd22100.exe	net.exe
PID 916 wrote to memory of 2024	916	d2a3d9c1d4ab18e98681e280fac4b7c19609a4aba224302c6cf481310cd22100.exe	net.exe
PID 916 wrote to memory of 2024	916	d2a3d9c1d4ab18e98681e280fac4b7c19609a4aba224302c6cf481310cd22100.exe	net.exe
PID 916 wrote to memory of 2024	916	d2a3d9c1d4ab18e98681e280fac4b7c19609a4aba224302c6cf481310cd22100.exe	net.exe
PID 2024 wrote to memory of 1976	2024	net.exe	net1.exe
PID 2024 wrote to memory of 1976	2024	net.exe	net1.exe
PID 2024 wrote to memory of 1976	2024	net.exe	net1.exe
PID 2024 wrote to memory of 1976	2024	net.exe	net1.exe
PID 916 wrote to memory of 1164	916	d2a3d9c1d4ab18e98681e280fac4b7c19609a4aba224302c6cf481310cd22100.exe	installd.exe
PID 916 wrote to memory of 1164	916	d2a3d9c1d4ab18e98681e280fac4b7c19609a4aba224302c6cf481310cd22100.exe	installd.exe
PID 916 wrote to memory of 1164	916	d2a3d9c1d4ab18e98681e280fac4b7c19609a4aba224302c6cf481310cd22100.exe	installd.exe
PID 916 wrote to memory of 1164	916	d2a3d9c1d4ab18e98681e280fac4b7c19609a4aba224302c6cf481310cd22100.exe	installd.exe
PID 916 wrote to memory of 1164	916	d2a3d9c1d4ab18e98681e280fac4b7c19609a4aba224302c6cf481310cd22100.exe	installd.exe
PID 916 wrote to memory of 1164	916	d2a3d9c1d4ab18e98681e280fac4b7c19609a4aba224302c6cf481310cd22100.exe	installd.exe
PID 916 wrote to memory of 1164	916	d2a3d9c1d4ab18e98681e280fac4b7c19609a4aba224302c6cf481310cd22100.exe	installd.exe
PID 916 wrote to memory of 876	916	d2a3d9c1d4ab18e98681e280fac4b7c19609a4aba224302c6cf481310cd22100.exe	nethtsrv.exe
PID 916 wrote to memory of 876	916	d2a3d9c1d4ab18e98681e280fac4b7c19609a4aba224302c6cf481310cd22100.exe	nethtsrv.exe
PID 916 wrote to memory of 876	916	d2a3d9c1d4ab18e98681e280fac4b7c19609a4aba224302c6cf481310cd22100.exe	nethtsrv.exe
PID 916 wrote to memory of 876	916	d2a3d9c1d4ab18e98681e280fac4b7c19609a4aba224302c6cf481310cd22100.exe	nethtsrv.exe
PID 916 wrote to memory of 636	916	d2a3d9c1d4ab18e98681e280fac4b7c19609a4aba224302c6cf481310cd22100.exe	netupdsrv.exe
PID 916 wrote to memory of 636	916	d2a3d9c1d4ab18e98681e280fac4b7c19609a4aba224302c6cf481310cd22100.exe	netupdsrv.exe
PID 916 wrote to memory of 636	916	d2a3d9c1d4ab18e98681e280fac4b7c19609a4aba224302c6cf481310cd22100.exe	netupdsrv.exe
PID 916 wrote to memory of 636	916	d2a3d9c1d4ab18e98681e280fac4b7c19609a4aba224302c6cf481310cd22100.exe	netupdsrv.exe
PID 916 wrote to memory of 636	916	d2a3d9c1d4ab18e98681e280fac4b7c19609a4aba224302c6cf481310cd22100.exe	netupdsrv.exe
PID 916 wrote to memory of 636	916	d2a3d9c1d4ab18e98681e280fac4b7c19609a4aba224302c6cf481310cd22100.exe	netupdsrv.exe
PID 916 wrote to memory of 636	916	d2a3d9c1d4ab18e98681e280fac4b7c19609a4aba224302c6cf481310cd22100.exe	netupdsrv.exe
PID 916 wrote to memory of 1664	916	d2a3d9c1d4ab18e98681e280fac4b7c19609a4aba224302c6cf481310cd22100.exe	net.exe
PID 916 wrote to memory of 1664	916	d2a3d9c1d4ab18e98681e280fac4b7c19609a4aba224302c6cf481310cd22100.exe	net.exe
PID 916 wrote to memory of 1664	916	d2a3d9c1d4ab18e98681e280fac4b7c19609a4aba224302c6cf481310cd22100.exe	net.exe
PID 916 wrote to memory of 1664	916	d2a3d9c1d4ab18e98681e280fac4b7c19609a4aba224302c6cf481310cd22100.exe	net.exe
PID 1664 wrote to memory of 1248	1664	net.exe	net1.exe
PID 1664 wrote to memory of 1248	1664	net.exe	net1.exe
PID 1664 wrote to memory of 1248	1664	net.exe	net1.exe
PID 1664 wrote to memory of 1248	1664	net.exe	net1.exe
PID 916 wrote to memory of 1420	916	d2a3d9c1d4ab18e98681e280fac4b7c19609a4aba224302c6cf481310cd22100.exe	net.exe
PID 916 wrote to memory of 1420	916	d2a3d9c1d4ab18e98681e280fac4b7c19609a4aba224302c6cf481310cd22100.exe	net.exe
PID 916 wrote to memory of 1420	916	d2a3d9c1d4ab18e98681e280fac4b7c19609a4aba224302c6cf481310cd22100.exe	net.exe
PID 916 wrote to memory of 1420	916	d2a3d9c1d4ab18e98681e280fac4b7c19609a4aba224302c6cf481310cd22100.exe	net.exe
PID 1420 wrote to memory of 1560	1420	net.exe	net1.exe
PID 1420 wrote to memory of 1560	1420	net.exe	net1.exe
PID 1420 wrote to memory of 1560	1420	net.exe	net1.exe
PID 1420 wrote to memory of 1560	1420	net.exe	net1.exe

C:\Users\Admin\AppData\Local\Temp\d2a3d9c1d4ab18e98681e280fac4b7c19609a4aba224302c6cf481310cd22100.exe
"C:\Users\Admin\AppData\Local\Temp\d2a3d9c1d4ab18e98681e280fac4b7c19609a4aba224302c6cf481310cd22100.exe"
1⤵
- Drops file in Drivers directory
- Loads dropped DLL
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:916

C:\Windows\SysWOW64\net.exe
net stop nethttpservice
2⤵
- Suspicious use of WriteProcessMemory
PID:960

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop nethttpservice
3⤵
PID:1992

C:\Windows\SysWOW64\net.exe
net stop serviceupdater
2⤵
- Suspicious use of WriteProcessMemory
PID:2024

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop serviceupdater
3⤵
PID:1976

C:\Windows\SysWOW64\installd.exe
"C:\Windows\system32\installd.exe" nethfdrv
2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1164

C:\Windows\SysWOW64\nethtsrv.exe
"C:\Windows\system32\nethtsrv.exe" -nfdi
2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:876

C:\Windows\SysWOW64\netupdsrv.exe
"C:\Windows\system32\netupdsrv.exe" -nfdi
2⤵
- Executes dropped EXE
PID:636

C:\Windows\SysWOW64\net.exe
net start nethttpservice
2⤵
- Suspicious use of WriteProcessMemory
PID:1664

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 start nethttpservice
3⤵
PID:1248

C:\Windows\SysWOW64\net.exe
net start serviceupdater
2⤵
- Suspicious use of WriteProcessMemory
PID:1420

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 start serviceupdater
3⤵
PID:1560

C:\Windows\SysWOW64\nethtsrv.exe
C:\Windows\SysWOW64\nethtsrv.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:528

C:\Windows\SysWOW64\netupdsrv.exe
C:\Windows\SysWOW64\netupdsrv.exe
1⤵
- Executes dropped EXE
PID:1916

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\hfnapi.dll
Filesize
106KB

MD5
a603dc0e13becc88ea8d695dc9bcc75a

SHA1
f0579e76c2c41a28f9b6085479d0da5abe64a95c

SHA256
2dbbf38313e0e447bfdc941e2c8e93100d6ed5df99cb2c26249549249ca45ad9

SHA512
fe9585cec823665061be7015550b4528c34f8d4921772f6058cd6c16f470dea11da1451ec2291e12fb51597190b1e92d5fc84606f22738ec20798cbb198e9db4

Download Submit
C:\Windows\SysWOW64\hfpapi.dll
Filesize
244KB

MD5
3d8c4163b9df4ee07033b27bfc7b2721

SHA1
8e323aba21463e7d11c1f060c810388c30b579d1

SHA256
da985b87617f6b4b8a61ea87b772f3133225379e9b818a066516c12ce61b13c2

SHA512
c56a8fc9d0210d572a629ae575130c0eab5783b09f5ea46601d68bb103dd8020c39c308bfce891bda995054c33a6648d1afb2c03cd3e110aca64ef92c9340794

Download Submit
C:\Windows\SysWOW64\installd.exe
Filesize
108KB

MD5
a868cbdd1fc4a73b3fce04bb6e5c72b5

SHA1
e337573f937755fbe1e412363dd9939aebe4b934

SHA256
cc7634cd0513a51fd3ce5d67fab47729a92f755c760e48105814da9d9df596cf

SHA512
0e4c81eee450840f590ed9ea2d703bdb090f352caaa4ec4d9d6cb4a0762806c6bb10a66c78c09bfdf9a118f3312721661d1885e7d48e2aed511e4c6e0496c87c

Download Submit
C:\Windows\SysWOW64\nethtsrv.exe
Filesize
176KB

MD5
361ed33ab2b428f9657b5cc9e7046b12

SHA1
7a96e819ee045fd263b12511611eca2b9d185981

SHA256
3739cc1cc779de6dbfdc515a6cb5160474de68a34f4c58863e869a25fe16f004

SHA512
4c09817957d2ea4a7cbe30b9839ba8015dfdf9011c5affd915a3bf76e5b2101cb5fd3dc025e5b798e1a8ce3fd293853783dd53846c6dbd69b09fc0d73c9b5fee

Download Submit
C:\Windows\SysWOW64\nethtsrv.exe
Filesize
176KB

MD5
361ed33ab2b428f9657b5cc9e7046b12

SHA1
7a96e819ee045fd263b12511611eca2b9d185981

SHA256
3739cc1cc779de6dbfdc515a6cb5160474de68a34f4c58863e869a25fe16f004

SHA512
4c09817957d2ea4a7cbe30b9839ba8015dfdf9011c5affd915a3bf76e5b2101cb5fd3dc025e5b798e1a8ce3fd293853783dd53846c6dbd69b09fc0d73c9b5fee

Download Submit
C:\Windows\SysWOW64\netupdsrv.exe
Filesize
158KB

MD5
01491ad092035f2baffdbf5f4a9eaea5

SHA1
27ef6158b0508ce04542ed8fce8a81cc3da3a2af

SHA256
e7b0e7b05a48330a8781c042a88497ea54706cf9910a2f360c55747adc23dfbd

SHA512
6a286767f27148af775587167a1e7e7962923a45af28be4e268b4343237f6c40a49d9719b43c37be5d4ba180ade82775132075c0ba7e8f42bc84306684d9b13f

Download Submit
C:\Windows\SysWOW64\netupdsrv.exe
Filesize
158KB

MD5
01491ad092035f2baffdbf5f4a9eaea5

SHA1
27ef6158b0508ce04542ed8fce8a81cc3da3a2af

SHA256
e7b0e7b05a48330a8781c042a88497ea54706cf9910a2f360c55747adc23dfbd

SHA512
6a286767f27148af775587167a1e7e7962923a45af28be4e268b4343237f6c40a49d9719b43c37be5d4ba180ade82775132075c0ba7e8f42bc84306684d9b13f

Download Submit
\Users\Admin\AppData\Local\Temp\nsy8A48.tmp\System.dll
Filesize
11KB

MD5
c17103ae9072a06da581dec998343fc1

SHA1
b72148c6bdfaada8b8c3f950e610ee7cf1da1f8d

SHA256
dc58d8ad81cacb0c1ed72e33bff8f23ea40b5252b5bb55d393a0903e6819ae2f

SHA512
d32a71aaef18e993f28096d536e41c4d016850721b31171513ce28bbd805a54fd290b7c3e9d935f72e676a1acfb4f0dcc89d95040a0dd29f2b6975855c18986f

Download Submit
\Users\Admin\AppData\Local\Temp\nsy8A48.tmp\nsExec.dll
Filesize
6KB

MD5
acc2b699edfea5bf5aae45aba3a41e96

SHA1
d2accf4d494e43ceb2cff69abe4dd17147d29cc2

SHA256
168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e

SHA512
e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe

Download Submit
\Users\Admin\AppData\Local\Temp\nsy8A48.tmp\nsExec.dll
Filesize
6KB

MD5
acc2b699edfea5bf5aae45aba3a41e96

SHA1
d2accf4d494e43ceb2cff69abe4dd17147d29cc2

SHA256
168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e

SHA512
e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe

Download Submit
\Users\Admin\AppData\Local\Temp\nsy8A48.tmp\nsExec.dll
Filesize
6KB

MD5
acc2b699edfea5bf5aae45aba3a41e96

SHA1
d2accf4d494e43ceb2cff69abe4dd17147d29cc2

SHA256
168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e

SHA512
e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe

Download Submit
\Users\Admin\AppData\Local\Temp\nsy8A48.tmp\nsExec.dll
Filesize
6KB

MD5
acc2b699edfea5bf5aae45aba3a41e96

SHA1
d2accf4d494e43ceb2cff69abe4dd17147d29cc2

SHA256
168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e

SHA512
e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe

Download Submit
\Windows\SysWOW64\hfnapi.dll
Filesize
106KB

MD5
a603dc0e13becc88ea8d695dc9bcc75a

SHA1
f0579e76c2c41a28f9b6085479d0da5abe64a95c

SHA256
2dbbf38313e0e447bfdc941e2c8e93100d6ed5df99cb2c26249549249ca45ad9

SHA512
fe9585cec823665061be7015550b4528c34f8d4921772f6058cd6c16f470dea11da1451ec2291e12fb51597190b1e92d5fc84606f22738ec20798cbb198e9db4

Download Submit
\Windows\SysWOW64\hfnapi.dll
Filesize
106KB

MD5
a603dc0e13becc88ea8d695dc9bcc75a

SHA1
f0579e76c2c41a28f9b6085479d0da5abe64a95c

SHA256
2dbbf38313e0e447bfdc941e2c8e93100d6ed5df99cb2c26249549249ca45ad9

SHA512
fe9585cec823665061be7015550b4528c34f8d4921772f6058cd6c16f470dea11da1451ec2291e12fb51597190b1e92d5fc84606f22738ec20798cbb198e9db4

Download Submit
\Windows\SysWOW64\hfnapi.dll
Filesize
106KB

MD5
a603dc0e13becc88ea8d695dc9bcc75a

SHA1
f0579e76c2c41a28f9b6085479d0da5abe64a95c

SHA256
2dbbf38313e0e447bfdc941e2c8e93100d6ed5df99cb2c26249549249ca45ad9

SHA512
fe9585cec823665061be7015550b4528c34f8d4921772f6058cd6c16f470dea11da1451ec2291e12fb51597190b1e92d5fc84606f22738ec20798cbb198e9db4

Download Submit
\Windows\SysWOW64\hfpapi.dll
Filesize
244KB

MD5
3d8c4163b9df4ee07033b27bfc7b2721

SHA1
8e323aba21463e7d11c1f060c810388c30b579d1

SHA256
da985b87617f6b4b8a61ea87b772f3133225379e9b818a066516c12ce61b13c2

SHA512
c56a8fc9d0210d572a629ae575130c0eab5783b09f5ea46601d68bb103dd8020c39c308bfce891bda995054c33a6648d1afb2c03cd3e110aca64ef92c9340794

Download Submit
\Windows\SysWOW64\hfpapi.dll
Filesize
244KB

MD5
3d8c4163b9df4ee07033b27bfc7b2721

SHA1
8e323aba21463e7d11c1f060c810388c30b579d1

SHA256
da985b87617f6b4b8a61ea87b772f3133225379e9b818a066516c12ce61b13c2

SHA512
c56a8fc9d0210d572a629ae575130c0eab5783b09f5ea46601d68bb103dd8020c39c308bfce891bda995054c33a6648d1afb2c03cd3e110aca64ef92c9340794

Download Submit
\Windows\SysWOW64\installd.exe
Filesize
108KB

MD5
a868cbdd1fc4a73b3fce04bb6e5c72b5

SHA1
e337573f937755fbe1e412363dd9939aebe4b934

SHA256
cc7634cd0513a51fd3ce5d67fab47729a92f755c760e48105814da9d9df596cf

SHA512
0e4c81eee450840f590ed9ea2d703bdb090f352caaa4ec4d9d6cb4a0762806c6bb10a66c78c09bfdf9a118f3312721661d1885e7d48e2aed511e4c6e0496c87c

Download Submit
\Windows\SysWOW64\nethtsrv.exe
Filesize
176KB

MD5
361ed33ab2b428f9657b5cc9e7046b12

SHA1
7a96e819ee045fd263b12511611eca2b9d185981

SHA256
3739cc1cc779de6dbfdc515a6cb5160474de68a34f4c58863e869a25fe16f004

SHA512
4c09817957d2ea4a7cbe30b9839ba8015dfdf9011c5affd915a3bf76e5b2101cb5fd3dc025e5b798e1a8ce3fd293853783dd53846c6dbd69b09fc0d73c9b5fee

Download Submit
\Windows\SysWOW64\netupdsrv.exe
Filesize
158KB

MD5
01491ad092035f2baffdbf5f4a9eaea5

SHA1
27ef6158b0508ce04542ed8fce8a81cc3da3a2af

SHA256
e7b0e7b05a48330a8781c042a88497ea54706cf9910a2f360c55747adc23dfbd

SHA512
6a286767f27148af775587167a1e7e7962923a45af28be4e268b4343237f6c40a49d9719b43c37be5d4ba180ade82775132075c0ba7e8f42bc84306684d9b13f

Download Submit
memory/636-77-0x0000000000000000-mapping.dmp

Download
memory/876-70-0x0000000000000000-mapping.dmp

Download
memory/916-91-0x0000000000360000-0x00000000007BE000-memory.dmp

Filesize
4.4MB

Download
memory/916-75-0x0000000000360000-0x00000000007BE000-memory.dmp

Filesize
4.4MB

Download
memory/916-55-0x0000000000360000-0x00000000007BE000-memory.dmp

Filesize
4.4MB

Download
memory/916-54-0x0000000076871000-0x0000000076873000-memory.dmp

Filesize
8KB

Download
memory/960-58-0x0000000000000000-mapping.dmp

Download
memory/1164-64-0x0000000000000000-mapping.dmp

Download
memory/1248-82-0x0000000000000000-mapping.dmp

Download
memory/1420-87-0x0000000000000000-mapping.dmp

Download
memory/1560-88-0x0000000000000000-mapping.dmp

Download
memory/1664-81-0x0000000000000000-mapping.dmp

Download
memory/1976-62-0x0000000000000000-mapping.dmp

Download
memory/1992-59-0x0000000000000000-mapping.dmp

Download
memory/2024-61-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads