df38b6c6a861e717c95280e4f4f8b3841456f9f2e01d3a3cf97577daf6a13cc2

Analysis

max time kernel
46s
max time network
35s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
23-11-2022 10:10

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

df38b6c6a861e717c95280e4f4f8b3841456f9f2e01d3a3cf97577daf6a13cc2.exe
Size

601KB
MD5

0268955717e2772854ec64e4ef135b73
SHA1

f9ef17ae2b13dfd6842ae705f1cbfd90fc81b468
SHA256

df38b6c6a861e717c95280e4f4f8b3841456f9f2e01d3a3cf97577daf6a13cc2
SHA512

56d7ab616f0130d844034fe109d1bcf4ad9ef1ec8fcbb514ffce67be3fbbb482424b08e7b0ef127c143d68794b72af05e10ac46148adb186b931f7adab0e8423
SSDEEP

12288:KIny5DYTt9CoBObMNbvxg4baJIcRlX63DbIrm30SRCt:MUTt9CaOAVvxfpcH6zbI63rMt

Score

8^/10

discovery

Malware Config

Signatures

Drops file in Drivers directory 1 IoCs

Processes:

df38b6c6a861e717c95280e4f4f8b3841456f9f2e01d3a3cf97577daf6a13cc2.exe

description ioc process

File created C:\Windows\system32\drivers\nethfdrv.sys df38b6c6a861e717c95280e4f4f8b3841456f9f2e01d3a3cf97577daf6a13cc2.exe
Executes dropped EXE 5 IoCs

Processes:

installd.exenethtsrv.exenetupdsrv.exenethtsrv.exenetupdsrv.exe

pid process

1592 installd.exe
1588 nethtsrv.exe
1824 netupdsrv.exe
1724 nethtsrv.exe
1344 netupdsrv.exe

description	ioc	process
File created	C:\Windows\system32\drivers\nethfdrv.sys	df38b6c6a861e717c95280e4f4f8b3841456f9f2e01d3a3cf97577daf6a13cc2.exe

pid	process
1592	installd.exe
1588	nethtsrv.exe
1824	netupdsrv.exe
1724	nethtsrv.exe
1344	netupdsrv.exe

Loads dropped DLL 13 IoCs

Processes:

df38b6c6a861e717c95280e4f4f8b3841456f9f2e01d3a3cf97577daf6a13cc2.exeinstalld.exenethtsrv.exenethtsrv.exe

pid	process
316	df38b6c6a861e717c95280e4f4f8b3841456f9f2e01d3a3cf97577daf6a13cc2.exe
316	df38b6c6a861e717c95280e4f4f8b3841456f9f2e01d3a3cf97577daf6a13cc2.exe
316	df38b6c6a861e717c95280e4f4f8b3841456f9f2e01d3a3cf97577daf6a13cc2.exe
316	df38b6c6a861e717c95280e4f4f8b3841456f9f2e01d3a3cf97577daf6a13cc2.exe
1592	installd.exe
316	df38b6c6a861e717c95280e4f4f8b3841456f9f2e01d3a3cf97577daf6a13cc2.exe
1588	nethtsrv.exe
1588	nethtsrv.exe
316	df38b6c6a861e717c95280e4f4f8b3841456f9f2e01d3a3cf97577daf6a13cc2.exe
316	df38b6c6a861e717c95280e4f4f8b3841456f9f2e01d3a3cf97577daf6a13cc2.exe
1724	nethtsrv.exe
1724	nethtsrv.exe
316	df38b6c6a861e717c95280e4f4f8b3841456f9f2e01d3a3cf97577daf6a13cc2.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in System32 directory 5 IoCs

Processes:

df38b6c6a861e717c95280e4f4f8b3841456f9f2e01d3a3cf97577daf6a13cc2.exe

description	ioc	process
File created	C:\Windows\SysWOW64\hfnapi.dll	df38b6c6a861e717c95280e4f4f8b3841456f9f2e01d3a3cf97577daf6a13cc2.exe
File created	C:\Windows\SysWOW64\hfpapi.dll	df38b6c6a861e717c95280e4f4f8b3841456f9f2e01d3a3cf97577daf6a13cc2.exe
File created	C:\Windows\SysWOW64\installd.exe	df38b6c6a861e717c95280e4f4f8b3841456f9f2e01d3a3cf97577daf6a13cc2.exe
File created	C:\Windows\SysWOW64\nethtsrv.exe	df38b6c6a861e717c95280e4f4f8b3841456f9f2e01d3a3cf97577daf6a13cc2.exe
File created	C:\Windows\SysWOW64\netupdsrv.exe	df38b6c6a861e717c95280e4f4f8b3841456f9f2e01d3a3cf97577daf6a13cc2.exe

Drops file in Program Files directory 3 IoCs

Processes:

df38b6c6a861e717c95280e4f4f8b3841456f9f2e01d3a3cf97577daf6a13cc2.exe

description	ioc	process
File created	C:\Program Files (x86)\Common Files\Config\data.xml	df38b6c6a861e717c95280e4f4f8b3841456f9f2e01d3a3cf97577daf6a13cc2.exe
File created	C:\Program Files (x86)\Common Files\Config\ver.xml	df38b6c6a861e717c95280e4f4f8b3841456f9f2e01d3a3cf97577daf6a13cc2.exe
File created	C:\Program Files (x86)\Common Files\config\uninstinethnfd.exe	df38b6c6a861e717c95280e4f4f8b3841456f9f2e01d3a3cf97577daf6a13cc2.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Runs net.exe
Suspicious behavior: LoadsDriver 1 IoCs

Processes:

pid process

464
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

nethtsrv.exe

description pid process

Token: SeDebugPrivilege 1724 nethtsrv.exe

pid	process
464

description	pid	process
Token: SeDebugPrivilege	1724	nethtsrv.exe

Suspicious use of WriteProcessMemory 50 IoCs

Processes:

df38b6c6a861e717c95280e4f4f8b3841456f9f2e01d3a3cf97577daf6a13cc2.exenet.exenet.exenet.exenet.exe

description	pid	process	target process
PID 316 wrote to memory of 676	316	df38b6c6a861e717c95280e4f4f8b3841456f9f2e01d3a3cf97577daf6a13cc2.exe	net.exe
PID 316 wrote to memory of 676	316	df38b6c6a861e717c95280e4f4f8b3841456f9f2e01d3a3cf97577daf6a13cc2.exe	net.exe
PID 316 wrote to memory of 676	316	df38b6c6a861e717c95280e4f4f8b3841456f9f2e01d3a3cf97577daf6a13cc2.exe	net.exe
PID 316 wrote to memory of 676	316	df38b6c6a861e717c95280e4f4f8b3841456f9f2e01d3a3cf97577daf6a13cc2.exe	net.exe
PID 676 wrote to memory of 784	676	net.exe	net1.exe
PID 676 wrote to memory of 784	676	net.exe	net1.exe
PID 676 wrote to memory of 784	676	net.exe	net1.exe
PID 676 wrote to memory of 784	676	net.exe	net1.exe
PID 316 wrote to memory of 896	316	df38b6c6a861e717c95280e4f4f8b3841456f9f2e01d3a3cf97577daf6a13cc2.exe	net.exe
PID 316 wrote to memory of 896	316	df38b6c6a861e717c95280e4f4f8b3841456f9f2e01d3a3cf97577daf6a13cc2.exe	net.exe
PID 316 wrote to memory of 896	316	df38b6c6a861e717c95280e4f4f8b3841456f9f2e01d3a3cf97577daf6a13cc2.exe	net.exe
PID 316 wrote to memory of 896	316	df38b6c6a861e717c95280e4f4f8b3841456f9f2e01d3a3cf97577daf6a13cc2.exe	net.exe
PID 896 wrote to memory of 916	896	net.exe	net1.exe
PID 896 wrote to memory of 916	896	net.exe	net1.exe
PID 896 wrote to memory of 916	896	net.exe	net1.exe
PID 896 wrote to memory of 916	896	net.exe	net1.exe
PID 316 wrote to memory of 1592	316	df38b6c6a861e717c95280e4f4f8b3841456f9f2e01d3a3cf97577daf6a13cc2.exe	installd.exe
PID 316 wrote to memory of 1592	316	df38b6c6a861e717c95280e4f4f8b3841456f9f2e01d3a3cf97577daf6a13cc2.exe	installd.exe
PID 316 wrote to memory of 1592	316	df38b6c6a861e717c95280e4f4f8b3841456f9f2e01d3a3cf97577daf6a13cc2.exe	installd.exe
PID 316 wrote to memory of 1592	316	df38b6c6a861e717c95280e4f4f8b3841456f9f2e01d3a3cf97577daf6a13cc2.exe	installd.exe
PID 316 wrote to memory of 1592	316	df38b6c6a861e717c95280e4f4f8b3841456f9f2e01d3a3cf97577daf6a13cc2.exe	installd.exe
PID 316 wrote to memory of 1592	316	df38b6c6a861e717c95280e4f4f8b3841456f9f2e01d3a3cf97577daf6a13cc2.exe	installd.exe
PID 316 wrote to memory of 1592	316	df38b6c6a861e717c95280e4f4f8b3841456f9f2e01d3a3cf97577daf6a13cc2.exe	installd.exe
PID 316 wrote to memory of 1588	316	df38b6c6a861e717c95280e4f4f8b3841456f9f2e01d3a3cf97577daf6a13cc2.exe	nethtsrv.exe
PID 316 wrote to memory of 1588	316	df38b6c6a861e717c95280e4f4f8b3841456f9f2e01d3a3cf97577daf6a13cc2.exe	nethtsrv.exe
PID 316 wrote to memory of 1588	316	df38b6c6a861e717c95280e4f4f8b3841456f9f2e01d3a3cf97577daf6a13cc2.exe	nethtsrv.exe
PID 316 wrote to memory of 1588	316	df38b6c6a861e717c95280e4f4f8b3841456f9f2e01d3a3cf97577daf6a13cc2.exe	nethtsrv.exe
PID 316 wrote to memory of 1824	316	df38b6c6a861e717c95280e4f4f8b3841456f9f2e01d3a3cf97577daf6a13cc2.exe	netupdsrv.exe
PID 316 wrote to memory of 1824	316	df38b6c6a861e717c95280e4f4f8b3841456f9f2e01d3a3cf97577daf6a13cc2.exe	netupdsrv.exe
PID 316 wrote to memory of 1824	316	df38b6c6a861e717c95280e4f4f8b3841456f9f2e01d3a3cf97577daf6a13cc2.exe	netupdsrv.exe
PID 316 wrote to memory of 1824	316	df38b6c6a861e717c95280e4f4f8b3841456f9f2e01d3a3cf97577daf6a13cc2.exe	netupdsrv.exe
PID 316 wrote to memory of 1824	316	df38b6c6a861e717c95280e4f4f8b3841456f9f2e01d3a3cf97577daf6a13cc2.exe	netupdsrv.exe
PID 316 wrote to memory of 1824	316	df38b6c6a861e717c95280e4f4f8b3841456f9f2e01d3a3cf97577daf6a13cc2.exe	netupdsrv.exe
PID 316 wrote to memory of 1824	316	df38b6c6a861e717c95280e4f4f8b3841456f9f2e01d3a3cf97577daf6a13cc2.exe	netupdsrv.exe
PID 316 wrote to memory of 912	316	df38b6c6a861e717c95280e4f4f8b3841456f9f2e01d3a3cf97577daf6a13cc2.exe	net.exe
PID 316 wrote to memory of 912	316	df38b6c6a861e717c95280e4f4f8b3841456f9f2e01d3a3cf97577daf6a13cc2.exe	net.exe
PID 316 wrote to memory of 912	316	df38b6c6a861e717c95280e4f4f8b3841456f9f2e01d3a3cf97577daf6a13cc2.exe	net.exe
PID 316 wrote to memory of 912	316	df38b6c6a861e717c95280e4f4f8b3841456f9f2e01d3a3cf97577daf6a13cc2.exe	net.exe
PID 912 wrote to memory of 1184	912	net.exe	net1.exe
PID 912 wrote to memory of 1184	912	net.exe	net1.exe
PID 912 wrote to memory of 1184	912	net.exe	net1.exe
PID 912 wrote to memory of 1184	912	net.exe	net1.exe
PID 316 wrote to memory of 2036	316	df38b6c6a861e717c95280e4f4f8b3841456f9f2e01d3a3cf97577daf6a13cc2.exe	net.exe
PID 316 wrote to memory of 2036	316	df38b6c6a861e717c95280e4f4f8b3841456f9f2e01d3a3cf97577daf6a13cc2.exe	net.exe
PID 316 wrote to memory of 2036	316	df38b6c6a861e717c95280e4f4f8b3841456f9f2e01d3a3cf97577daf6a13cc2.exe	net.exe
PID 316 wrote to memory of 2036	316	df38b6c6a861e717c95280e4f4f8b3841456f9f2e01d3a3cf97577daf6a13cc2.exe	net.exe
PID 2036 wrote to memory of 1336	2036	net.exe	net1.exe
PID 2036 wrote to memory of 1336	2036	net.exe	net1.exe
PID 2036 wrote to memory of 1336	2036	net.exe	net1.exe
PID 2036 wrote to memory of 1336	2036	net.exe	net1.exe

C:\Users\Admin\AppData\Local\Temp\df38b6c6a861e717c95280e4f4f8b3841456f9f2e01d3a3cf97577daf6a13cc2.exe
"C:\Users\Admin\AppData\Local\Temp\df38b6c6a861e717c95280e4f4f8b3841456f9f2e01d3a3cf97577daf6a13cc2.exe"
1⤵
- Drops file in Drivers directory
- Loads dropped DLL
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:316

C:\Windows\SysWOW64\net.exe
net stop nethttpservice
2⤵
- Suspicious use of WriteProcessMemory
PID:676

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop nethttpservice
3⤵
PID:784

C:\Windows\SysWOW64\net.exe
net stop serviceupdater
2⤵
- Suspicious use of WriteProcessMemory
PID:896

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop serviceupdater
3⤵
PID:916

C:\Windows\SysWOW64\installd.exe
"C:\Windows\system32\installd.exe" nethfdrv
2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1592

C:\Windows\SysWOW64\nethtsrv.exe
"C:\Windows\system32\nethtsrv.exe" -nfdi
2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1588

C:\Windows\SysWOW64\netupdsrv.exe
"C:\Windows\system32\netupdsrv.exe" -nfdi
2⤵
- Executes dropped EXE
PID:1824

C:\Windows\SysWOW64\net.exe
net start nethttpservice
2⤵
- Suspicious use of WriteProcessMemory
PID:912

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 start nethttpservice
3⤵
PID:1184

C:\Windows\SysWOW64\net.exe
net start serviceupdater
2⤵
- Suspicious use of WriteProcessMemory
PID:2036

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 start serviceupdater
3⤵
PID:1336

C:\Windows\SysWOW64\nethtsrv.exe
C:\Windows\SysWOW64\nethtsrv.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:1724

C:\Windows\SysWOW64\netupdsrv.exe
C:\Windows\SysWOW64\netupdsrv.exe
1⤵
- Executes dropped EXE
PID:1344

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\hfnapi.dll
Filesize
106KB

MD5
862daf046edb2b69f92adf2ffc99a32a

SHA1
58bff97d9247d52efeaa045dffffd5fac49b7dfa

SHA256
2825bd1a6ffd88a3503b7a5e8b3d524bb9f0d1f96acc8d975bf49e3a6df2d15f

SHA512
70ae643ba9e3344c7ab7aceb0758100db7cb3733993de303a1d9a68041674c5a0407c655371014f624c4635de22ee27e157989c9ee0fc89d958a34f8c5970e77

Download Submit
C:\Windows\SysWOW64\hfpapi.dll
Filesize
241KB

MD5
1e6b66256a2639517424e55c62eb1548

SHA1
a44e6ddf7afe0e42af0c8ceae0f79f942318ab65

SHA256
e70cc411c6c734e1a0d340c989d75672acd06d13eac099abfe4333688afe35f6

SHA512
3cb70f60209df5c51d41801aa07e08d85c47ad11cf36d747f74bfa3fec44e32af8d06117378d65a61b21cf2ba9da64f35b722a338c628982f7c5b142898f1538

Download Submit
C:\Windows\SysWOW64\installd.exe
Filesize
108KB

MD5
c9e3e1d4f1fd4b1fd307ccc4c24f83e7

SHA1
723e848381faa36cff4fa891a7bb61d758e729c6

SHA256
eb5370e97f65ca0487096ff9305b0eeded40a2dc86694954b54ad541fb489308

SHA512
2b926a82098969435b6a089e693ad5732d226f0632f4063d062abae9c048fd99f341bd33f4138eab8dd0ecc226ed3203ad565bea8b09c64116a4b1ff44ea796e

Download Submit
C:\Windows\SysWOW64\nethtsrv.exe
Filesize
176KB

MD5
21e50a8247c6d0a022c7f53f686cc0b9

SHA1
a474190fbaf64f98053b8912f0e86d1d105bf60b

SHA256
bc85fdb19f215d6d4b22a829570abe24fa9183aa0527e36007b96e98c4db64b1

SHA512
c66f2cd507aa12879341407d673c02eb397f7fe00b3e4b969ac3bf5f1e00b70ba543497b83bfa46a4ced03b1fc0d61ee2c66befc04ab5bfd91978c985bc0a303

Download Submit
C:\Windows\SysWOW64\nethtsrv.exe
Filesize
176KB

MD5
21e50a8247c6d0a022c7f53f686cc0b9

SHA1
a474190fbaf64f98053b8912f0e86d1d105bf60b

SHA256
bc85fdb19f215d6d4b22a829570abe24fa9183aa0527e36007b96e98c4db64b1

SHA512
c66f2cd507aa12879341407d673c02eb397f7fe00b3e4b969ac3bf5f1e00b70ba543497b83bfa46a4ced03b1fc0d61ee2c66befc04ab5bfd91978c985bc0a303

Download Submit
C:\Windows\SysWOW64\netupdsrv.exe
Filesize
158KB

MD5
1eef8a060380df12cee181089c78a6a3

SHA1
63df4685809cde19ffa37d6da2cee3854a05100f

SHA256
33ec888728b19c9ff4b26d7973b79b570d479fd86cb957bd17f4ff01cc9e29af

SHA512
626413cc28fd542b79026f16bd96109d2c01bc9cdfd44adffb6ae490ceff11d900e9996e4a2bb618afd31bd741b8750741d407efcd59fa3c5534fb217ec3328f

Download Submit
C:\Windows\SysWOW64\netupdsrv.exe
Filesize
158KB

MD5
1eef8a060380df12cee181089c78a6a3

SHA1
63df4685809cde19ffa37d6da2cee3854a05100f

SHA256
33ec888728b19c9ff4b26d7973b79b570d479fd86cb957bd17f4ff01cc9e29af

SHA512
626413cc28fd542b79026f16bd96109d2c01bc9cdfd44adffb6ae490ceff11d900e9996e4a2bb618afd31bd741b8750741d407efcd59fa3c5534fb217ec3328f

Download Submit
\Users\Admin\AppData\Local\Temp\nsyACB6.tmp\System.dll
Filesize
11KB

MD5
c17103ae9072a06da581dec998343fc1

SHA1
b72148c6bdfaada8b8c3f950e610ee7cf1da1f8d

SHA256
dc58d8ad81cacb0c1ed72e33bff8f23ea40b5252b5bb55d393a0903e6819ae2f

SHA512
d32a71aaef18e993f28096d536e41c4d016850721b31171513ce28bbd805a54fd290b7c3e9d935f72e676a1acfb4f0dcc89d95040a0dd29f2b6975855c18986f

Download Submit
\Users\Admin\AppData\Local\Temp\nsyACB6.tmp\nsExec.dll
Filesize
6KB

MD5
acc2b699edfea5bf5aae45aba3a41e96

SHA1
d2accf4d494e43ceb2cff69abe4dd17147d29cc2

SHA256
168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e

SHA512
e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe

Download Submit
\Users\Admin\AppData\Local\Temp\nsyACB6.tmp\nsExec.dll
Filesize
6KB

MD5
acc2b699edfea5bf5aae45aba3a41e96

SHA1
d2accf4d494e43ceb2cff69abe4dd17147d29cc2

SHA256
168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e

SHA512
e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe

Download Submit
\Users\Admin\AppData\Local\Temp\nsyACB6.tmp\nsExec.dll
Filesize
6KB

MD5
acc2b699edfea5bf5aae45aba3a41e96

SHA1
d2accf4d494e43ceb2cff69abe4dd17147d29cc2

SHA256
168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e

SHA512
e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe

Download Submit
\Users\Admin\AppData\Local\Temp\nsyACB6.tmp\nsExec.dll
Filesize
6KB

MD5
acc2b699edfea5bf5aae45aba3a41e96

SHA1
d2accf4d494e43ceb2cff69abe4dd17147d29cc2

SHA256
168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e

SHA512
e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe

Download Submit
\Windows\SysWOW64\hfnapi.dll
Filesize
106KB

MD5
862daf046edb2b69f92adf2ffc99a32a

SHA1
58bff97d9247d52efeaa045dffffd5fac49b7dfa

SHA256
2825bd1a6ffd88a3503b7a5e8b3d524bb9f0d1f96acc8d975bf49e3a6df2d15f

SHA512
70ae643ba9e3344c7ab7aceb0758100db7cb3733993de303a1d9a68041674c5a0407c655371014f624c4635de22ee27e157989c9ee0fc89d958a34f8c5970e77

Download Submit
\Windows\SysWOW64\hfnapi.dll
Filesize
106KB

MD5
862daf046edb2b69f92adf2ffc99a32a

SHA1
58bff97d9247d52efeaa045dffffd5fac49b7dfa

SHA256
2825bd1a6ffd88a3503b7a5e8b3d524bb9f0d1f96acc8d975bf49e3a6df2d15f

SHA512
70ae643ba9e3344c7ab7aceb0758100db7cb3733993de303a1d9a68041674c5a0407c655371014f624c4635de22ee27e157989c9ee0fc89d958a34f8c5970e77

Download Submit
\Windows\SysWOW64\hfnapi.dll
Filesize
106KB

MD5
862daf046edb2b69f92adf2ffc99a32a

SHA1
58bff97d9247d52efeaa045dffffd5fac49b7dfa

SHA256
2825bd1a6ffd88a3503b7a5e8b3d524bb9f0d1f96acc8d975bf49e3a6df2d15f

SHA512
70ae643ba9e3344c7ab7aceb0758100db7cb3733993de303a1d9a68041674c5a0407c655371014f624c4635de22ee27e157989c9ee0fc89d958a34f8c5970e77

Download Submit
\Windows\SysWOW64\hfpapi.dll
Filesize
241KB

MD5
1e6b66256a2639517424e55c62eb1548

SHA1
a44e6ddf7afe0e42af0c8ceae0f79f942318ab65

SHA256
e70cc411c6c734e1a0d340c989d75672acd06d13eac099abfe4333688afe35f6

SHA512
3cb70f60209df5c51d41801aa07e08d85c47ad11cf36d747f74bfa3fec44e32af8d06117378d65a61b21cf2ba9da64f35b722a338c628982f7c5b142898f1538

Download Submit
\Windows\SysWOW64\hfpapi.dll
Filesize
241KB

MD5
1e6b66256a2639517424e55c62eb1548

SHA1
a44e6ddf7afe0e42af0c8ceae0f79f942318ab65

SHA256
e70cc411c6c734e1a0d340c989d75672acd06d13eac099abfe4333688afe35f6

SHA512
3cb70f60209df5c51d41801aa07e08d85c47ad11cf36d747f74bfa3fec44e32af8d06117378d65a61b21cf2ba9da64f35b722a338c628982f7c5b142898f1538

Download Submit
\Windows\SysWOW64\installd.exe
Filesize
108KB

MD5
c9e3e1d4f1fd4b1fd307ccc4c24f83e7

SHA1
723e848381faa36cff4fa891a7bb61d758e729c6

SHA256
eb5370e97f65ca0487096ff9305b0eeded40a2dc86694954b54ad541fb489308

SHA512
2b926a82098969435b6a089e693ad5732d226f0632f4063d062abae9c048fd99f341bd33f4138eab8dd0ecc226ed3203ad565bea8b09c64116a4b1ff44ea796e

Download Submit
\Windows\SysWOW64\nethtsrv.exe
Filesize
176KB

MD5
21e50a8247c6d0a022c7f53f686cc0b9

SHA1
a474190fbaf64f98053b8912f0e86d1d105bf60b

SHA256
bc85fdb19f215d6d4b22a829570abe24fa9183aa0527e36007b96e98c4db64b1

SHA512
c66f2cd507aa12879341407d673c02eb397f7fe00b3e4b969ac3bf5f1e00b70ba543497b83bfa46a4ced03b1fc0d61ee2c66befc04ab5bfd91978c985bc0a303

Download Submit
\Windows\SysWOW64\netupdsrv.exe
Filesize
158KB

MD5
1eef8a060380df12cee181089c78a6a3

SHA1
63df4685809cde19ffa37d6da2cee3854a05100f

SHA256
33ec888728b19c9ff4b26d7973b79b570d479fd86cb957bd17f4ff01cc9e29af

SHA512
626413cc28fd542b79026f16bd96109d2c01bc9cdfd44adffb6ae490ceff11d900e9996e4a2bb618afd31bd741b8750741d407efcd59fa3c5534fb217ec3328f

Download Submit
memory/316-62-0x0000000000360000-0x00000000007BE000-memory.dmp

Filesize
4.4MB

Download
memory/316-90-0x0000000000360000-0x00000000007BE000-memory.dmp

Filesize
4.4MB

Download
memory/316-54-0x0000000075891000-0x0000000075893000-memory.dmp

Filesize
8KB

Download
memory/676-57-0x0000000000000000-mapping.dmp

Download
memory/784-58-0x0000000000000000-mapping.dmp

Download
memory/896-60-0x0000000000000000-mapping.dmp

Download
memory/912-80-0x0000000000000000-mapping.dmp

Download
memory/916-61-0x0000000000000000-mapping.dmp

Download
memory/1184-81-0x0000000000000000-mapping.dmp

Download
memory/1336-87-0x0000000000000000-mapping.dmp

Download
memory/1588-70-0x0000000000000000-mapping.dmp

Download
memory/1592-64-0x0000000000000000-mapping.dmp

Download
memory/1824-76-0x0000000000000000-mapping.dmp

Download
memory/2036-86-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads