d167d0b2144b39041956ca12d5e6f3dfc1f929c3f27b4c2442b6b3fd2412ee94

Analysis

max time kernel
42s
max time network
46s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
23-11-2022 10:11

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d167d0b2144b39041956ca12d5e6f3dfc1f929c3f27b4c2442b6b3fd2412ee94.exe
Size

603KB
MD5

4f0bd7f4e586decdc172b1326673ea95
SHA1

fca2dbd1c4f6dc7e2a13d60f7380e73dccecc96f
SHA256

d167d0b2144b39041956ca12d5e6f3dfc1f929c3f27b4c2442b6b3fd2412ee94
SHA512

e1a7ea8368fa6e2558a304bf4cc97606a4bc5b7a9edabad0e802100ac74cf9d7b7e1c8ad73454ec937b5f2d6f89943c3f9405baaae2e09a6baa828eb405aef78
SSDEEP

12288:gIny5DYTMIJ3arK/rGy8eHN8PxuLihQULokxF0gJSmbEJ:eUTMO3fR8iN8aenx6gJSIE

Score

8^/10

discovery

Malware Config

Signatures

Drops file in Drivers directory 1 IoCs

Processes:

d167d0b2144b39041956ca12d5e6f3dfc1f929c3f27b4c2442b6b3fd2412ee94.exe

description ioc process

File created C:\Windows\system32\drivers\nethfdrv.sys d167d0b2144b39041956ca12d5e6f3dfc1f929c3f27b4c2442b6b3fd2412ee94.exe
Executes dropped EXE 5 IoCs

Processes:

installd.exenethtsrv.exenetupdsrv.exenethtsrv.exenetupdsrv.exe

pid process

624 installd.exe
392 nethtsrv.exe
276 netupdsrv.exe
584 nethtsrv.exe
1344 netupdsrv.exe

description	ioc	process
File created	C:\Windows\system32\drivers\nethfdrv.sys	d167d0b2144b39041956ca12d5e6f3dfc1f929c3f27b4c2442b6b3fd2412ee94.exe

pid	process
624	installd.exe
392	nethtsrv.exe
276	netupdsrv.exe
584	nethtsrv.exe
1344	netupdsrv.exe

Loads dropped DLL 13 IoCs

Processes:

d167d0b2144b39041956ca12d5e6f3dfc1f929c3f27b4c2442b6b3fd2412ee94.exeinstalld.exenethtsrv.exenethtsrv.exe

pid	process
1672	d167d0b2144b39041956ca12d5e6f3dfc1f929c3f27b4c2442b6b3fd2412ee94.exe
1672	d167d0b2144b39041956ca12d5e6f3dfc1f929c3f27b4c2442b6b3fd2412ee94.exe
1672	d167d0b2144b39041956ca12d5e6f3dfc1f929c3f27b4c2442b6b3fd2412ee94.exe
1672	d167d0b2144b39041956ca12d5e6f3dfc1f929c3f27b4c2442b6b3fd2412ee94.exe
624	installd.exe
1672	d167d0b2144b39041956ca12d5e6f3dfc1f929c3f27b4c2442b6b3fd2412ee94.exe
392	nethtsrv.exe
392	nethtsrv.exe
1672	d167d0b2144b39041956ca12d5e6f3dfc1f929c3f27b4c2442b6b3fd2412ee94.exe
1672	d167d0b2144b39041956ca12d5e6f3dfc1f929c3f27b4c2442b6b3fd2412ee94.exe
584	nethtsrv.exe
584	nethtsrv.exe
1672	d167d0b2144b39041956ca12d5e6f3dfc1f929c3f27b4c2442b6b3fd2412ee94.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in System32 directory 5 IoCs

Processes:

d167d0b2144b39041956ca12d5e6f3dfc1f929c3f27b4c2442b6b3fd2412ee94.exe

description	ioc	process
File created	C:\Windows\SysWOW64\hfnapi.dll	d167d0b2144b39041956ca12d5e6f3dfc1f929c3f27b4c2442b6b3fd2412ee94.exe
File created	C:\Windows\SysWOW64\hfpapi.dll	d167d0b2144b39041956ca12d5e6f3dfc1f929c3f27b4c2442b6b3fd2412ee94.exe
File created	C:\Windows\SysWOW64\installd.exe	d167d0b2144b39041956ca12d5e6f3dfc1f929c3f27b4c2442b6b3fd2412ee94.exe
File created	C:\Windows\SysWOW64\nethtsrv.exe	d167d0b2144b39041956ca12d5e6f3dfc1f929c3f27b4c2442b6b3fd2412ee94.exe
File created	C:\Windows\SysWOW64\netupdsrv.exe	d167d0b2144b39041956ca12d5e6f3dfc1f929c3f27b4c2442b6b3fd2412ee94.exe

Drops file in Program Files directory 3 IoCs

Processes:

d167d0b2144b39041956ca12d5e6f3dfc1f929c3f27b4c2442b6b3fd2412ee94.exe

description	ioc	process
File created	C:\Program Files (x86)\Common Files\Config\data.xml	d167d0b2144b39041956ca12d5e6f3dfc1f929c3f27b4c2442b6b3fd2412ee94.exe
File created	C:\Program Files (x86)\Common Files\Config\ver.xml	d167d0b2144b39041956ca12d5e6f3dfc1f929c3f27b4c2442b6b3fd2412ee94.exe
File created	C:\Program Files (x86)\Common Files\config\uninstinethnfd.exe	d167d0b2144b39041956ca12d5e6f3dfc1f929c3f27b4c2442b6b3fd2412ee94.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Runs net.exe
Suspicious behavior: LoadsDriver 1 IoCs

Processes:

pid process

460
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

nethtsrv.exe

description pid process

Token: SeDebugPrivilege 584 nethtsrv.exe

pid	process
460

description	pid	process
Token: SeDebugPrivilege	584	nethtsrv.exe

Suspicious use of WriteProcessMemory 50 IoCs

Processes:

d167d0b2144b39041956ca12d5e6f3dfc1f929c3f27b4c2442b6b3fd2412ee94.exenet.exenet.exenet.exenet.exe

description	pid	process	target process
PID 1672 wrote to memory of 1696	1672	d167d0b2144b39041956ca12d5e6f3dfc1f929c3f27b4c2442b6b3fd2412ee94.exe	net.exe
PID 1672 wrote to memory of 1696	1672	d167d0b2144b39041956ca12d5e6f3dfc1f929c3f27b4c2442b6b3fd2412ee94.exe	net.exe
PID 1672 wrote to memory of 1696	1672	d167d0b2144b39041956ca12d5e6f3dfc1f929c3f27b4c2442b6b3fd2412ee94.exe	net.exe
PID 1672 wrote to memory of 1696	1672	d167d0b2144b39041956ca12d5e6f3dfc1f929c3f27b4c2442b6b3fd2412ee94.exe	net.exe
PID 1696 wrote to memory of 1176	1696	net.exe	net1.exe
PID 1696 wrote to memory of 1176	1696	net.exe	net1.exe
PID 1696 wrote to memory of 1176	1696	net.exe	net1.exe
PID 1696 wrote to memory of 1176	1696	net.exe	net1.exe
PID 1672 wrote to memory of 1540	1672	d167d0b2144b39041956ca12d5e6f3dfc1f929c3f27b4c2442b6b3fd2412ee94.exe	net.exe
PID 1672 wrote to memory of 1540	1672	d167d0b2144b39041956ca12d5e6f3dfc1f929c3f27b4c2442b6b3fd2412ee94.exe	net.exe
PID 1672 wrote to memory of 1540	1672	d167d0b2144b39041956ca12d5e6f3dfc1f929c3f27b4c2442b6b3fd2412ee94.exe	net.exe
PID 1672 wrote to memory of 1540	1672	d167d0b2144b39041956ca12d5e6f3dfc1f929c3f27b4c2442b6b3fd2412ee94.exe	net.exe
PID 1540 wrote to memory of 1648	1540	net.exe	net1.exe
PID 1540 wrote to memory of 1648	1540	net.exe	net1.exe
PID 1540 wrote to memory of 1648	1540	net.exe	net1.exe
PID 1540 wrote to memory of 1648	1540	net.exe	net1.exe
PID 1672 wrote to memory of 624	1672	d167d0b2144b39041956ca12d5e6f3dfc1f929c3f27b4c2442b6b3fd2412ee94.exe	installd.exe
PID 1672 wrote to memory of 624	1672	d167d0b2144b39041956ca12d5e6f3dfc1f929c3f27b4c2442b6b3fd2412ee94.exe	installd.exe
PID 1672 wrote to memory of 624	1672	d167d0b2144b39041956ca12d5e6f3dfc1f929c3f27b4c2442b6b3fd2412ee94.exe	installd.exe
PID 1672 wrote to memory of 624	1672	d167d0b2144b39041956ca12d5e6f3dfc1f929c3f27b4c2442b6b3fd2412ee94.exe	installd.exe
PID 1672 wrote to memory of 624	1672	d167d0b2144b39041956ca12d5e6f3dfc1f929c3f27b4c2442b6b3fd2412ee94.exe	installd.exe
PID 1672 wrote to memory of 624	1672	d167d0b2144b39041956ca12d5e6f3dfc1f929c3f27b4c2442b6b3fd2412ee94.exe	installd.exe
PID 1672 wrote to memory of 624	1672	d167d0b2144b39041956ca12d5e6f3dfc1f929c3f27b4c2442b6b3fd2412ee94.exe	installd.exe
PID 1672 wrote to memory of 392	1672	d167d0b2144b39041956ca12d5e6f3dfc1f929c3f27b4c2442b6b3fd2412ee94.exe	nethtsrv.exe
PID 1672 wrote to memory of 392	1672	d167d0b2144b39041956ca12d5e6f3dfc1f929c3f27b4c2442b6b3fd2412ee94.exe	nethtsrv.exe
PID 1672 wrote to memory of 392	1672	d167d0b2144b39041956ca12d5e6f3dfc1f929c3f27b4c2442b6b3fd2412ee94.exe	nethtsrv.exe
PID 1672 wrote to memory of 392	1672	d167d0b2144b39041956ca12d5e6f3dfc1f929c3f27b4c2442b6b3fd2412ee94.exe	nethtsrv.exe
PID 1672 wrote to memory of 276	1672	d167d0b2144b39041956ca12d5e6f3dfc1f929c3f27b4c2442b6b3fd2412ee94.exe	netupdsrv.exe
PID 1672 wrote to memory of 276	1672	d167d0b2144b39041956ca12d5e6f3dfc1f929c3f27b4c2442b6b3fd2412ee94.exe	netupdsrv.exe
PID 1672 wrote to memory of 276	1672	d167d0b2144b39041956ca12d5e6f3dfc1f929c3f27b4c2442b6b3fd2412ee94.exe	netupdsrv.exe
PID 1672 wrote to memory of 276	1672	d167d0b2144b39041956ca12d5e6f3dfc1f929c3f27b4c2442b6b3fd2412ee94.exe	netupdsrv.exe
PID 1672 wrote to memory of 276	1672	d167d0b2144b39041956ca12d5e6f3dfc1f929c3f27b4c2442b6b3fd2412ee94.exe	netupdsrv.exe
PID 1672 wrote to memory of 276	1672	d167d0b2144b39041956ca12d5e6f3dfc1f929c3f27b4c2442b6b3fd2412ee94.exe	netupdsrv.exe
PID 1672 wrote to memory of 276	1672	d167d0b2144b39041956ca12d5e6f3dfc1f929c3f27b4c2442b6b3fd2412ee94.exe	netupdsrv.exe
PID 1672 wrote to memory of 1524	1672	d167d0b2144b39041956ca12d5e6f3dfc1f929c3f27b4c2442b6b3fd2412ee94.exe	net.exe
PID 1672 wrote to memory of 1524	1672	d167d0b2144b39041956ca12d5e6f3dfc1f929c3f27b4c2442b6b3fd2412ee94.exe	net.exe
PID 1672 wrote to memory of 1524	1672	d167d0b2144b39041956ca12d5e6f3dfc1f929c3f27b4c2442b6b3fd2412ee94.exe	net.exe
PID 1672 wrote to memory of 1524	1672	d167d0b2144b39041956ca12d5e6f3dfc1f929c3f27b4c2442b6b3fd2412ee94.exe	net.exe
PID 1524 wrote to memory of 1260	1524	net.exe	net1.exe
PID 1524 wrote to memory of 1260	1524	net.exe	net1.exe
PID 1524 wrote to memory of 1260	1524	net.exe	net1.exe
PID 1524 wrote to memory of 1260	1524	net.exe	net1.exe
PID 1672 wrote to memory of 1640	1672	d167d0b2144b39041956ca12d5e6f3dfc1f929c3f27b4c2442b6b3fd2412ee94.exe	net.exe
PID 1672 wrote to memory of 1640	1672	d167d0b2144b39041956ca12d5e6f3dfc1f929c3f27b4c2442b6b3fd2412ee94.exe	net.exe
PID 1672 wrote to memory of 1640	1672	d167d0b2144b39041956ca12d5e6f3dfc1f929c3f27b4c2442b6b3fd2412ee94.exe	net.exe
PID 1672 wrote to memory of 1640	1672	d167d0b2144b39041956ca12d5e6f3dfc1f929c3f27b4c2442b6b3fd2412ee94.exe	net.exe
PID 1640 wrote to memory of 1440	1640	net.exe	net1.exe
PID 1640 wrote to memory of 1440	1640	net.exe	net1.exe
PID 1640 wrote to memory of 1440	1640	net.exe	net1.exe
PID 1640 wrote to memory of 1440	1640	net.exe	net1.exe

C:\Users\Admin\AppData\Local\Temp\d167d0b2144b39041956ca12d5e6f3dfc1f929c3f27b4c2442b6b3fd2412ee94.exe
"C:\Users\Admin\AppData\Local\Temp\d167d0b2144b39041956ca12d5e6f3dfc1f929c3f27b4c2442b6b3fd2412ee94.exe"
1⤵
- Drops file in Drivers directory
- Loads dropped DLL
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:1672

C:\Windows\SysWOW64\net.exe
net stop nethttpservice
2⤵
- Suspicious use of WriteProcessMemory
PID:1696

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop nethttpservice
3⤵
PID:1176

C:\Windows\SysWOW64\net.exe
net stop serviceupdater
2⤵
- Suspicious use of WriteProcessMemory
PID:1540

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop serviceupdater
3⤵
PID:1648

C:\Windows\SysWOW64\installd.exe
"C:\Windows\system32\installd.exe" nethfdrv
2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:624

C:\Windows\SysWOW64\nethtsrv.exe
"C:\Windows\system32\nethtsrv.exe" -nfdi
2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:392

C:\Windows\SysWOW64\netupdsrv.exe
"C:\Windows\system32\netupdsrv.exe" -nfdi
2⤵
- Executes dropped EXE
PID:276

C:\Windows\SysWOW64\net.exe
net start nethttpservice
2⤵
- Suspicious use of WriteProcessMemory
PID:1524

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 start nethttpservice
3⤵
PID:1260

C:\Windows\SysWOW64\net.exe
net start serviceupdater
2⤵
- Suspicious use of WriteProcessMemory
PID:1640

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 start serviceupdater
3⤵
PID:1440

C:\Windows\SysWOW64\nethtsrv.exe
C:\Windows\SysWOW64\nethtsrv.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:584

C:\Windows\SysWOW64\netupdsrv.exe
C:\Windows\SysWOW64\netupdsrv.exe
1⤵
- Executes dropped EXE
PID:1344

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\hfnapi.dll
Filesize
106KB

MD5
e8ffe4177e81165a99ce4c7c193e4766

SHA1
96fc2261b589d2d391a11aa5cc7236c8f7341c54

SHA256
ed54063c5a965d09094cd15755b66511361795e692ce8eb2382629157875ca04

SHA512
02014a0d39721f6e10a9be582be2d83d50db262e9e1e7be2805831b21f088af411db97f1d3e4b9dc6ed4daeb9552395b4f6351fbadc75ee6b8a2c88cf9bf7229

Download Submit
C:\Windows\SysWOW64\hfpapi.dll
Filesize
244KB

MD5
7cf863857f38c24fc23d0aa50c090320

SHA1
ba94eb48a0f884c9ac8765e6d547424841fc53f0

SHA256
8a91b96e43ceadea32cb1684f19321b0a8988c3c270a6d239c34e200672ec427

SHA512
d55a24d16c29c2e3791fd9903ef129bdb5bba092a9fe1323736ed9df17bc60e515141d9dd901d4fbc89b35c62d227114fd4df67a1354e4e7ebce2ea6bcdbd761

Download Submit
C:\Windows\SysWOW64\installd.exe
Filesize
108KB

MD5
e63632332a7236bd4f25dd07144ddcfe

SHA1
0763cb46fa46ab0f5d3992beff740ada9af515e3

SHA256
898cff8e198670d5765f260eda62a3003c374737a59743bcca8f9e107163985e

SHA512
3582347ff0158cf14651e23963c423cb23ef0926b582a450dde17ecdbd9497dfb3d98f753b26c28a9f9abde2fa93460bd79c5414acbb7d1223ec97969c882c07

Download Submit
C:\Windows\SysWOW64\nethtsrv.exe
Filesize
176KB

MD5
5861368188685c50628ef3d3428f3a51

SHA1
96aace800e27af01e3d2c392ba918be75b4fa87b

SHA256
6f5ae3f63d4c8d3e2ec11f1cd472b62c6f09e6d4d86033adb0348050cc6840cd

SHA512
11d83b7a966da3f3675ed89b0fe900158a810891506df1b4ceda601ccf67fef580788684b4b7fef1de7539e9271391fca55342ca7b04dc5b14b5702584d2923f

Download Submit
C:\Windows\SysWOW64\nethtsrv.exe
Filesize
176KB

MD5
5861368188685c50628ef3d3428f3a51

SHA1
96aace800e27af01e3d2c392ba918be75b4fa87b

SHA256
6f5ae3f63d4c8d3e2ec11f1cd472b62c6f09e6d4d86033adb0348050cc6840cd

SHA512
11d83b7a966da3f3675ed89b0fe900158a810891506df1b4ceda601ccf67fef580788684b4b7fef1de7539e9271391fca55342ca7b04dc5b14b5702584d2923f

Download Submit
C:\Windows\SysWOW64\netupdsrv.exe
Filesize
159KB

MD5
da345cce0d2229c1523273b3a02afa4b

SHA1
75d60efb5814220e32148f3a3f12126b79a48884

SHA256
75e8bbb83eb8aa29b4734b9568ea018346c3dff33a61ab358f68dc3751b7f590

SHA512
3cd27861527b8266813cdb8d7b77612c55b59fb22c8b8b860e0e58fa0ca6e2e759c0685fe2651e2fb934dc6bd4dbbeb7a83e27087f489bd90eee678bc3f98c26

Download Submit
C:\Windows\SysWOW64\netupdsrv.exe
Filesize
159KB

MD5
da345cce0d2229c1523273b3a02afa4b

SHA1
75d60efb5814220e32148f3a3f12126b79a48884

SHA256
75e8bbb83eb8aa29b4734b9568ea018346c3dff33a61ab358f68dc3751b7f590

SHA512
3cd27861527b8266813cdb8d7b77612c55b59fb22c8b8b860e0e58fa0ca6e2e759c0685fe2651e2fb934dc6bd4dbbeb7a83e27087f489bd90eee678bc3f98c26

Download Submit
\Users\Admin\AppData\Local\Temp\nsd1087.tmp\System.dll
Filesize
11KB

MD5
c17103ae9072a06da581dec998343fc1

SHA1
b72148c6bdfaada8b8c3f950e610ee7cf1da1f8d

SHA256
dc58d8ad81cacb0c1ed72e33bff8f23ea40b5252b5bb55d393a0903e6819ae2f

SHA512
d32a71aaef18e993f28096d536e41c4d016850721b31171513ce28bbd805a54fd290b7c3e9d935f72e676a1acfb4f0dcc89d95040a0dd29f2b6975855c18986f

Download Submit
\Users\Admin\AppData\Local\Temp\nsd1087.tmp\nsExec.dll
Filesize
6KB

MD5
acc2b699edfea5bf5aae45aba3a41e96

SHA1
d2accf4d494e43ceb2cff69abe4dd17147d29cc2

SHA256
168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e

SHA512
e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe

Download Submit
\Users\Admin\AppData\Local\Temp\nsd1087.tmp\nsExec.dll
Filesize
6KB

MD5
acc2b699edfea5bf5aae45aba3a41e96

SHA1
d2accf4d494e43ceb2cff69abe4dd17147d29cc2

SHA256
168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e

SHA512
e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe

Download Submit
\Users\Admin\AppData\Local\Temp\nsd1087.tmp\nsExec.dll
Filesize
6KB

MD5
acc2b699edfea5bf5aae45aba3a41e96

SHA1
d2accf4d494e43ceb2cff69abe4dd17147d29cc2

SHA256
168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e

SHA512
e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe

Download Submit
\Users\Admin\AppData\Local\Temp\nsd1087.tmp\nsExec.dll
Filesize
6KB

MD5
acc2b699edfea5bf5aae45aba3a41e96

SHA1
d2accf4d494e43ceb2cff69abe4dd17147d29cc2

SHA256
168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e

SHA512
e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe

Download Submit
\Windows\SysWOW64\hfnapi.dll
Filesize
106KB

MD5
e8ffe4177e81165a99ce4c7c193e4766

SHA1
96fc2261b589d2d391a11aa5cc7236c8f7341c54

SHA256
ed54063c5a965d09094cd15755b66511361795e692ce8eb2382629157875ca04

SHA512
02014a0d39721f6e10a9be582be2d83d50db262e9e1e7be2805831b21f088af411db97f1d3e4b9dc6ed4daeb9552395b4f6351fbadc75ee6b8a2c88cf9bf7229

Download Submit
\Windows\SysWOW64\hfnapi.dll
Filesize
106KB

MD5
e8ffe4177e81165a99ce4c7c193e4766

SHA1
96fc2261b589d2d391a11aa5cc7236c8f7341c54

SHA256
ed54063c5a965d09094cd15755b66511361795e692ce8eb2382629157875ca04

SHA512
02014a0d39721f6e10a9be582be2d83d50db262e9e1e7be2805831b21f088af411db97f1d3e4b9dc6ed4daeb9552395b4f6351fbadc75ee6b8a2c88cf9bf7229

Download Submit
\Windows\SysWOW64\hfnapi.dll
Filesize
106KB

MD5
e8ffe4177e81165a99ce4c7c193e4766

SHA1
96fc2261b589d2d391a11aa5cc7236c8f7341c54

SHA256
ed54063c5a965d09094cd15755b66511361795e692ce8eb2382629157875ca04

SHA512
02014a0d39721f6e10a9be582be2d83d50db262e9e1e7be2805831b21f088af411db97f1d3e4b9dc6ed4daeb9552395b4f6351fbadc75ee6b8a2c88cf9bf7229

Download Submit
\Windows\SysWOW64\hfpapi.dll
Filesize
244KB

MD5
7cf863857f38c24fc23d0aa50c090320

SHA1
ba94eb48a0f884c9ac8765e6d547424841fc53f0

SHA256
8a91b96e43ceadea32cb1684f19321b0a8988c3c270a6d239c34e200672ec427

SHA512
d55a24d16c29c2e3791fd9903ef129bdb5bba092a9fe1323736ed9df17bc60e515141d9dd901d4fbc89b35c62d227114fd4df67a1354e4e7ebce2ea6bcdbd761

Download Submit
\Windows\SysWOW64\hfpapi.dll
Filesize
244KB

MD5
7cf863857f38c24fc23d0aa50c090320

SHA1
ba94eb48a0f884c9ac8765e6d547424841fc53f0

SHA256
8a91b96e43ceadea32cb1684f19321b0a8988c3c270a6d239c34e200672ec427

SHA512
d55a24d16c29c2e3791fd9903ef129bdb5bba092a9fe1323736ed9df17bc60e515141d9dd901d4fbc89b35c62d227114fd4df67a1354e4e7ebce2ea6bcdbd761

Download Submit
\Windows\SysWOW64\installd.exe
Filesize
108KB

MD5
e63632332a7236bd4f25dd07144ddcfe

SHA1
0763cb46fa46ab0f5d3992beff740ada9af515e3

SHA256
898cff8e198670d5765f260eda62a3003c374737a59743bcca8f9e107163985e

SHA512
3582347ff0158cf14651e23963c423cb23ef0926b582a450dde17ecdbd9497dfb3d98f753b26c28a9f9abde2fa93460bd79c5414acbb7d1223ec97969c882c07

Download Submit
\Windows\SysWOW64\nethtsrv.exe
Filesize
176KB

MD5
5861368188685c50628ef3d3428f3a51

SHA1
96aace800e27af01e3d2c392ba918be75b4fa87b

SHA256
6f5ae3f63d4c8d3e2ec11f1cd472b62c6f09e6d4d86033adb0348050cc6840cd

SHA512
11d83b7a966da3f3675ed89b0fe900158a810891506df1b4ceda601ccf67fef580788684b4b7fef1de7539e9271391fca55342ca7b04dc5b14b5702584d2923f

Download Submit
\Windows\SysWOW64\netupdsrv.exe
Filesize
159KB

MD5
da345cce0d2229c1523273b3a02afa4b

SHA1
75d60efb5814220e32148f3a3f12126b79a48884

SHA256
75e8bbb83eb8aa29b4734b9568ea018346c3dff33a61ab358f68dc3751b7f590

SHA512
3cd27861527b8266813cdb8d7b77612c55b59fb22c8b8b860e0e58fa0ca6e2e759c0685fe2651e2fb934dc6bd4dbbeb7a83e27087f489bd90eee678bc3f98c26

Download Submit
memory/276-76-0x0000000000000000-mapping.dmp

Download
memory/392-70-0x0000000000000000-mapping.dmp

Download
memory/624-64-0x0000000000000000-mapping.dmp

Download
memory/1176-58-0x0000000000000000-mapping.dmp

Download
memory/1260-81-0x0000000000000000-mapping.dmp

Download
memory/1440-87-0x0000000000000000-mapping.dmp

Download
memory/1524-80-0x0000000000000000-mapping.dmp

Download
memory/1540-60-0x0000000000000000-mapping.dmp

Download
memory/1640-86-0x0000000000000000-mapping.dmp

Download
memory/1648-61-0x0000000000000000-mapping.dmp

Download
memory/1672-54-0x0000000075201000-0x0000000075203000-memory.dmp

Filesize
8KB

Download
memory/1672-62-0x0000000000360000-0x00000000007BE000-memory.dmp

Filesize
4.4MB

Download
memory/1672-90-0x0000000000360000-0x00000000007BE000-memory.dmp

Filesize
4.4MB

Download
memory/1696-57-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads