d622d8fd96d98dfe91a22fe18ad0b6140de2109f49961c562dcaeb28d6eafc65

Analysis

max time kernel
78s
max time network
33s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
23-11-2022 10:11

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d622d8fd96d98dfe91a22fe18ad0b6140de2109f49961c562dcaeb28d6eafc65.exe
Size

603KB
MD5

2dfa4a83264a3d4e7c1227a0761b32ce
SHA1

238f679c3ac3a7bb2fdb82aba5c9a0ee0548b180
SHA256

d622d8fd96d98dfe91a22fe18ad0b6140de2109f49961c562dcaeb28d6eafc65
SHA512

5ec014179f8f1f81909a8fd7626c64f796d0f401484949b16deda58ce23e98c570bca3dac16a5b9f0432b70a14288827aba682ce5958e71b520aac32f38d6c7f
SSDEEP

12288:ZIny5DYTHu3hrSizrb7GqKWDsTzI9tMzuj3vFtBShMY5qOanRfnMy:VUTOxoBzy3vFtBSh+pnJ

Score

8^/10

discovery

Malware Config

Signatures

Drops file in Drivers directory 1 IoCs

Processes:

d622d8fd96d98dfe91a22fe18ad0b6140de2109f49961c562dcaeb28d6eafc65.exe

description ioc process

File created C:\Windows\system32\drivers\nethfdrv.sys d622d8fd96d98dfe91a22fe18ad0b6140de2109f49961c562dcaeb28d6eafc65.exe
Executes dropped EXE 5 IoCs

Processes:

installd.exenethtsrv.exenetupdsrv.exenethtsrv.exenetupdsrv.exe

pid process

1540 installd.exe
1160 nethtsrv.exe
1912 netupdsrv.exe
1944 nethtsrv.exe
1752 netupdsrv.exe

description	ioc	process
File created	C:\Windows\system32\drivers\nethfdrv.sys	d622d8fd96d98dfe91a22fe18ad0b6140de2109f49961c562dcaeb28d6eafc65.exe

pid	process
1540	installd.exe
1160	nethtsrv.exe
1912	netupdsrv.exe
1944	nethtsrv.exe
1752	netupdsrv.exe

Loads dropped DLL 13 IoCs

Processes:

d622d8fd96d98dfe91a22fe18ad0b6140de2109f49961c562dcaeb28d6eafc65.exeinstalld.exenethtsrv.exenethtsrv.exe

pid	process
1140	d622d8fd96d98dfe91a22fe18ad0b6140de2109f49961c562dcaeb28d6eafc65.exe
1140	d622d8fd96d98dfe91a22fe18ad0b6140de2109f49961c562dcaeb28d6eafc65.exe
1140	d622d8fd96d98dfe91a22fe18ad0b6140de2109f49961c562dcaeb28d6eafc65.exe
1140	d622d8fd96d98dfe91a22fe18ad0b6140de2109f49961c562dcaeb28d6eafc65.exe
1540	installd.exe
1140	d622d8fd96d98dfe91a22fe18ad0b6140de2109f49961c562dcaeb28d6eafc65.exe
1160	nethtsrv.exe
1160	nethtsrv.exe
1140	d622d8fd96d98dfe91a22fe18ad0b6140de2109f49961c562dcaeb28d6eafc65.exe
1140	d622d8fd96d98dfe91a22fe18ad0b6140de2109f49961c562dcaeb28d6eafc65.exe
1944	nethtsrv.exe
1944	nethtsrv.exe
1140	d622d8fd96d98dfe91a22fe18ad0b6140de2109f49961c562dcaeb28d6eafc65.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in System32 directory 5 IoCs

Processes:

d622d8fd96d98dfe91a22fe18ad0b6140de2109f49961c562dcaeb28d6eafc65.exe

description	ioc	process
File created	C:\Windows\SysWOW64\hfnapi.dll	d622d8fd96d98dfe91a22fe18ad0b6140de2109f49961c562dcaeb28d6eafc65.exe
File created	C:\Windows\SysWOW64\hfpapi.dll	d622d8fd96d98dfe91a22fe18ad0b6140de2109f49961c562dcaeb28d6eafc65.exe
File created	C:\Windows\SysWOW64\installd.exe	d622d8fd96d98dfe91a22fe18ad0b6140de2109f49961c562dcaeb28d6eafc65.exe
File created	C:\Windows\SysWOW64\nethtsrv.exe	d622d8fd96d98dfe91a22fe18ad0b6140de2109f49961c562dcaeb28d6eafc65.exe
File created	C:\Windows\SysWOW64\netupdsrv.exe	d622d8fd96d98dfe91a22fe18ad0b6140de2109f49961c562dcaeb28d6eafc65.exe

Drops file in Program Files directory 3 IoCs

Processes:

d622d8fd96d98dfe91a22fe18ad0b6140de2109f49961c562dcaeb28d6eafc65.exe

description	ioc	process
File created	C:\Program Files (x86)\Common Files\Config\data.xml	d622d8fd96d98dfe91a22fe18ad0b6140de2109f49961c562dcaeb28d6eafc65.exe
File created	C:\Program Files (x86)\Common Files\Config\ver.xml	d622d8fd96d98dfe91a22fe18ad0b6140de2109f49961c562dcaeb28d6eafc65.exe
File created	C:\Program Files (x86)\Common Files\config\uninstinethnfd.exe	d622d8fd96d98dfe91a22fe18ad0b6140de2109f49961c562dcaeb28d6eafc65.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Runs net.exe
Suspicious behavior: LoadsDriver 1 IoCs

Processes:

pid process

464
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

nethtsrv.exe

description pid process

Token: SeDebugPrivilege 1944 nethtsrv.exe

pid	process
464

description	pid	process
Token: SeDebugPrivilege	1944	nethtsrv.exe

Suspicious use of WriteProcessMemory 50 IoCs

Processes:

d622d8fd96d98dfe91a22fe18ad0b6140de2109f49961c562dcaeb28d6eafc65.exenet.exenet.exenet.exenet.exe

description	pid	process	target process
PID 1140 wrote to memory of 1464	1140	d622d8fd96d98dfe91a22fe18ad0b6140de2109f49961c562dcaeb28d6eafc65.exe	net.exe
PID 1140 wrote to memory of 1464	1140	d622d8fd96d98dfe91a22fe18ad0b6140de2109f49961c562dcaeb28d6eafc65.exe	net.exe
PID 1140 wrote to memory of 1464	1140	d622d8fd96d98dfe91a22fe18ad0b6140de2109f49961c562dcaeb28d6eafc65.exe	net.exe
PID 1140 wrote to memory of 1464	1140	d622d8fd96d98dfe91a22fe18ad0b6140de2109f49961c562dcaeb28d6eafc65.exe	net.exe
PID 1464 wrote to memory of 472	1464	net.exe	net1.exe
PID 1464 wrote to memory of 472	1464	net.exe	net1.exe
PID 1464 wrote to memory of 472	1464	net.exe	net1.exe
PID 1464 wrote to memory of 472	1464	net.exe	net1.exe
PID 1140 wrote to memory of 944	1140	d622d8fd96d98dfe91a22fe18ad0b6140de2109f49961c562dcaeb28d6eafc65.exe	net.exe
PID 1140 wrote to memory of 944	1140	d622d8fd96d98dfe91a22fe18ad0b6140de2109f49961c562dcaeb28d6eafc65.exe	net.exe
PID 1140 wrote to memory of 944	1140	d622d8fd96d98dfe91a22fe18ad0b6140de2109f49961c562dcaeb28d6eafc65.exe	net.exe
PID 1140 wrote to memory of 944	1140	d622d8fd96d98dfe91a22fe18ad0b6140de2109f49961c562dcaeb28d6eafc65.exe	net.exe
PID 944 wrote to memory of 1924	944	net.exe	net1.exe
PID 944 wrote to memory of 1924	944	net.exe	net1.exe
PID 944 wrote to memory of 1924	944	net.exe	net1.exe
PID 944 wrote to memory of 1924	944	net.exe	net1.exe
PID 1140 wrote to memory of 1540	1140	d622d8fd96d98dfe91a22fe18ad0b6140de2109f49961c562dcaeb28d6eafc65.exe	installd.exe
PID 1140 wrote to memory of 1540	1140	d622d8fd96d98dfe91a22fe18ad0b6140de2109f49961c562dcaeb28d6eafc65.exe	installd.exe
PID 1140 wrote to memory of 1540	1140	d622d8fd96d98dfe91a22fe18ad0b6140de2109f49961c562dcaeb28d6eafc65.exe	installd.exe
PID 1140 wrote to memory of 1540	1140	d622d8fd96d98dfe91a22fe18ad0b6140de2109f49961c562dcaeb28d6eafc65.exe	installd.exe
PID 1140 wrote to memory of 1540	1140	d622d8fd96d98dfe91a22fe18ad0b6140de2109f49961c562dcaeb28d6eafc65.exe	installd.exe
PID 1140 wrote to memory of 1540	1140	d622d8fd96d98dfe91a22fe18ad0b6140de2109f49961c562dcaeb28d6eafc65.exe	installd.exe
PID 1140 wrote to memory of 1540	1140	d622d8fd96d98dfe91a22fe18ad0b6140de2109f49961c562dcaeb28d6eafc65.exe	installd.exe
PID 1140 wrote to memory of 1160	1140	d622d8fd96d98dfe91a22fe18ad0b6140de2109f49961c562dcaeb28d6eafc65.exe	nethtsrv.exe
PID 1140 wrote to memory of 1160	1140	d622d8fd96d98dfe91a22fe18ad0b6140de2109f49961c562dcaeb28d6eafc65.exe	nethtsrv.exe
PID 1140 wrote to memory of 1160	1140	d622d8fd96d98dfe91a22fe18ad0b6140de2109f49961c562dcaeb28d6eafc65.exe	nethtsrv.exe
PID 1140 wrote to memory of 1160	1140	d622d8fd96d98dfe91a22fe18ad0b6140de2109f49961c562dcaeb28d6eafc65.exe	nethtsrv.exe
PID 1140 wrote to memory of 1912	1140	d622d8fd96d98dfe91a22fe18ad0b6140de2109f49961c562dcaeb28d6eafc65.exe	netupdsrv.exe
PID 1140 wrote to memory of 1912	1140	d622d8fd96d98dfe91a22fe18ad0b6140de2109f49961c562dcaeb28d6eafc65.exe	netupdsrv.exe
PID 1140 wrote to memory of 1912	1140	d622d8fd96d98dfe91a22fe18ad0b6140de2109f49961c562dcaeb28d6eafc65.exe	netupdsrv.exe
PID 1140 wrote to memory of 1912	1140	d622d8fd96d98dfe91a22fe18ad0b6140de2109f49961c562dcaeb28d6eafc65.exe	netupdsrv.exe
PID 1140 wrote to memory of 1912	1140	d622d8fd96d98dfe91a22fe18ad0b6140de2109f49961c562dcaeb28d6eafc65.exe	netupdsrv.exe
PID 1140 wrote to memory of 1912	1140	d622d8fd96d98dfe91a22fe18ad0b6140de2109f49961c562dcaeb28d6eafc65.exe	netupdsrv.exe
PID 1140 wrote to memory of 1912	1140	d622d8fd96d98dfe91a22fe18ad0b6140de2109f49961c562dcaeb28d6eafc65.exe	netupdsrv.exe
PID 1140 wrote to memory of 916	1140	d622d8fd96d98dfe91a22fe18ad0b6140de2109f49961c562dcaeb28d6eafc65.exe	net.exe
PID 1140 wrote to memory of 916	1140	d622d8fd96d98dfe91a22fe18ad0b6140de2109f49961c562dcaeb28d6eafc65.exe	net.exe
PID 1140 wrote to memory of 916	1140	d622d8fd96d98dfe91a22fe18ad0b6140de2109f49961c562dcaeb28d6eafc65.exe	net.exe
PID 1140 wrote to memory of 916	1140	d622d8fd96d98dfe91a22fe18ad0b6140de2109f49961c562dcaeb28d6eafc65.exe	net.exe
PID 916 wrote to memory of 1184	916	net.exe	net1.exe
PID 916 wrote to memory of 1184	916	net.exe	net1.exe
PID 916 wrote to memory of 1184	916	net.exe	net1.exe
PID 916 wrote to memory of 1184	916	net.exe	net1.exe
PID 1140 wrote to memory of 2012	1140	d622d8fd96d98dfe91a22fe18ad0b6140de2109f49961c562dcaeb28d6eafc65.exe	net.exe
PID 1140 wrote to memory of 2012	1140	d622d8fd96d98dfe91a22fe18ad0b6140de2109f49961c562dcaeb28d6eafc65.exe	net.exe
PID 1140 wrote to memory of 2012	1140	d622d8fd96d98dfe91a22fe18ad0b6140de2109f49961c562dcaeb28d6eafc65.exe	net.exe
PID 1140 wrote to memory of 2012	1140	d622d8fd96d98dfe91a22fe18ad0b6140de2109f49961c562dcaeb28d6eafc65.exe	net.exe
PID 2012 wrote to memory of 2036	2012	net.exe	net1.exe
PID 2012 wrote to memory of 2036	2012	net.exe	net1.exe
PID 2012 wrote to memory of 2036	2012	net.exe	net1.exe
PID 2012 wrote to memory of 2036	2012	net.exe	net1.exe

C:\Users\Admin\AppData\Local\Temp\d622d8fd96d98dfe91a22fe18ad0b6140de2109f49961c562dcaeb28d6eafc65.exe
"C:\Users\Admin\AppData\Local\Temp\d622d8fd96d98dfe91a22fe18ad0b6140de2109f49961c562dcaeb28d6eafc65.exe"
1⤵
- Drops file in Drivers directory
- Loads dropped DLL
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:1140

C:\Windows\SysWOW64\net.exe
net stop nethttpservice
2⤵
- Suspicious use of WriteProcessMemory
PID:1464

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop nethttpservice
3⤵
PID:472

C:\Windows\SysWOW64\net.exe
net stop serviceupdater
2⤵
- Suspicious use of WriteProcessMemory
PID:944

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop serviceupdater
3⤵
PID:1924

C:\Windows\SysWOW64\installd.exe
"C:\Windows\system32\installd.exe" nethfdrv
2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1540

C:\Windows\SysWOW64\nethtsrv.exe
"C:\Windows\system32\nethtsrv.exe" -nfdi
2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1160

C:\Windows\SysWOW64\netupdsrv.exe
"C:\Windows\system32\netupdsrv.exe" -nfdi
2⤵
- Executes dropped EXE
PID:1912

C:\Windows\SysWOW64\net.exe
net start nethttpservice
2⤵
- Suspicious use of WriteProcessMemory
PID:916

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 start nethttpservice
3⤵
PID:1184

C:\Windows\SysWOW64\net.exe
net start serviceupdater
2⤵
- Suspicious use of WriteProcessMemory
PID:2012

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 start serviceupdater
3⤵
PID:2036

C:\Windows\SysWOW64\nethtsrv.exe
C:\Windows\SysWOW64\nethtsrv.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:1944

C:\Windows\SysWOW64\netupdsrv.exe
C:\Windows\SysWOW64\netupdsrv.exe
1⤵
- Executes dropped EXE
PID:1752

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\hfnapi.dll
Filesize
106KB

MD5
f93083a166c3b802abe3892609e5a971

SHA1
f96c47b703137769cad3b9876556219540d7fd0e

SHA256
0ac3c340d559a0cce8fe4b0e980091b35167884914f66651171d336c887122ed

SHA512
132441cc601dee9d3367c6fd6353dab390de8ae620d7c2861408b15023bd6faeb412df0eebe18d5116cd148b3c81f22544854b1a2bf8b5167ca8c2b4a3bf7fca

Download Submit
C:\Windows\SysWOW64\hfpapi.dll
Filesize
244KB

MD5
4003c587e02b399b424c3843f68d5855

SHA1
8930848b1dd62840d7a4571b9ddf0b2988eb0901

SHA256
41005a89a6513c16d6ae0a47fa97ca09c9425a98a729b0f565b718a58b4f432d

SHA512
ec8e657d53b3f9f729b8806d8afde0fe17a086a65cf2da77cf8ef253acd2f712e43381a0a78518b004584922c94cb389df539ef50bdb6c92e6099e18fbc2b6f3

Download Submit
C:\Windows\SysWOW64\installd.exe
Filesize
108KB

MD5
bd90827885cf621141874ce2b4e4c174

SHA1
ee24eded23cbee51ce2cd073ce278ab30f543c61

SHA256
455e84afb4865a2147b5a0c256841703a9b3135fcafddfc9468fa450512ce9bb

SHA512
d5d529e11ef0812558e207736c57b8ac97b7673f2afe1e0cf105c3da640d28b2bbbb2ae810186d9f1619e595e2bd7820c9f4a2de055fa9a63260cfd2e9cbd9aa

Download Submit
C:\Windows\SysWOW64\nethtsrv.exe
Filesize
176KB

MD5
201f136a33709e27d79547caebd00cdc

SHA1
d9229d35a9fc2bd48293b7e91fb624077aeb0611

SHA256
bf0ccc7c4753c91fbc9342ef783d9e0e8d36c09e7e2bea71487916ee937dda2f

SHA512
4897e268699697cabdbf9347ac744c1a440dfedc557bcabb788ba03106ed113510ce1f163cca009378c9f15dfe7a3c663f2f0ff2242224b8393317b97e82bafa

Download Submit
C:\Windows\SysWOW64\nethtsrv.exe
Filesize
176KB

MD5
201f136a33709e27d79547caebd00cdc

SHA1
d9229d35a9fc2bd48293b7e91fb624077aeb0611

SHA256
bf0ccc7c4753c91fbc9342ef783d9e0e8d36c09e7e2bea71487916ee937dda2f

SHA512
4897e268699697cabdbf9347ac744c1a440dfedc557bcabb788ba03106ed113510ce1f163cca009378c9f15dfe7a3c663f2f0ff2242224b8393317b97e82bafa

Download Submit
C:\Windows\SysWOW64\netupdsrv.exe
Filesize
158KB

MD5
419268bda19ab230682a19c400ab6f79

SHA1
91d1332c22be496ef453b3b451cff013c52105ab

SHA256
21c5177480a2d075d1102af33921c50d13eab89fa0a971b34e0317f30ba608b3

SHA512
60f54ce1c408f71970332f4d64d565f08038777e6423df6c7d4d8489cb64a105ea8142443d515a46ae38deb20d984a9dcd0c067fece54b1256934421ecf5a94e

Download Submit
C:\Windows\SysWOW64\netupdsrv.exe
Filesize
158KB

MD5
419268bda19ab230682a19c400ab6f79

SHA1
91d1332c22be496ef453b3b451cff013c52105ab

SHA256
21c5177480a2d075d1102af33921c50d13eab89fa0a971b34e0317f30ba608b3

SHA512
60f54ce1c408f71970332f4d64d565f08038777e6423df6c7d4d8489cb64a105ea8142443d515a46ae38deb20d984a9dcd0c067fece54b1256934421ecf5a94e

Download Submit
\Users\Admin\AppData\Local\Temp\nsjB5CB.tmp\System.dll
Filesize
11KB

MD5
c17103ae9072a06da581dec998343fc1

SHA1
b72148c6bdfaada8b8c3f950e610ee7cf1da1f8d

SHA256
dc58d8ad81cacb0c1ed72e33bff8f23ea40b5252b5bb55d393a0903e6819ae2f

SHA512
d32a71aaef18e993f28096d536e41c4d016850721b31171513ce28bbd805a54fd290b7c3e9d935f72e676a1acfb4f0dcc89d95040a0dd29f2b6975855c18986f

Download Submit
\Users\Admin\AppData\Local\Temp\nsjB5CB.tmp\nsExec.dll
Filesize
6KB

MD5
acc2b699edfea5bf5aae45aba3a41e96

SHA1
d2accf4d494e43ceb2cff69abe4dd17147d29cc2

SHA256
168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e

SHA512
e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe

Download Submit
\Users\Admin\AppData\Local\Temp\nsjB5CB.tmp\nsExec.dll
Filesize
6KB

MD5
acc2b699edfea5bf5aae45aba3a41e96

SHA1
d2accf4d494e43ceb2cff69abe4dd17147d29cc2

SHA256
168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e

SHA512
e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe

Download Submit
\Users\Admin\AppData\Local\Temp\nsjB5CB.tmp\nsExec.dll
Filesize
6KB

MD5
acc2b699edfea5bf5aae45aba3a41e96

SHA1
d2accf4d494e43ceb2cff69abe4dd17147d29cc2

SHA256
168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e

SHA512
e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe

Download Submit
\Users\Admin\AppData\Local\Temp\nsjB5CB.tmp\nsExec.dll
Filesize
6KB

MD5
acc2b699edfea5bf5aae45aba3a41e96

SHA1
d2accf4d494e43ceb2cff69abe4dd17147d29cc2

SHA256
168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e

SHA512
e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe

Download Submit
\Windows\SysWOW64\hfnapi.dll
Filesize
106KB

MD5
f93083a166c3b802abe3892609e5a971

SHA1
f96c47b703137769cad3b9876556219540d7fd0e

SHA256
0ac3c340d559a0cce8fe4b0e980091b35167884914f66651171d336c887122ed

SHA512
132441cc601dee9d3367c6fd6353dab390de8ae620d7c2861408b15023bd6faeb412df0eebe18d5116cd148b3c81f22544854b1a2bf8b5167ca8c2b4a3bf7fca

Download Submit
\Windows\SysWOW64\hfnapi.dll
Filesize
106KB

MD5
f93083a166c3b802abe3892609e5a971

SHA1
f96c47b703137769cad3b9876556219540d7fd0e

SHA256
0ac3c340d559a0cce8fe4b0e980091b35167884914f66651171d336c887122ed

SHA512
132441cc601dee9d3367c6fd6353dab390de8ae620d7c2861408b15023bd6faeb412df0eebe18d5116cd148b3c81f22544854b1a2bf8b5167ca8c2b4a3bf7fca

Download Submit
\Windows\SysWOW64\hfnapi.dll
Filesize
106KB

MD5
f93083a166c3b802abe3892609e5a971

SHA1
f96c47b703137769cad3b9876556219540d7fd0e

SHA256
0ac3c340d559a0cce8fe4b0e980091b35167884914f66651171d336c887122ed

SHA512
132441cc601dee9d3367c6fd6353dab390de8ae620d7c2861408b15023bd6faeb412df0eebe18d5116cd148b3c81f22544854b1a2bf8b5167ca8c2b4a3bf7fca

Download Submit
\Windows\SysWOW64\hfpapi.dll
Filesize
244KB

MD5
4003c587e02b399b424c3843f68d5855

SHA1
8930848b1dd62840d7a4571b9ddf0b2988eb0901

SHA256
41005a89a6513c16d6ae0a47fa97ca09c9425a98a729b0f565b718a58b4f432d

SHA512
ec8e657d53b3f9f729b8806d8afde0fe17a086a65cf2da77cf8ef253acd2f712e43381a0a78518b004584922c94cb389df539ef50bdb6c92e6099e18fbc2b6f3

Download Submit
\Windows\SysWOW64\hfpapi.dll
Filesize
244KB

MD5
4003c587e02b399b424c3843f68d5855

SHA1
8930848b1dd62840d7a4571b9ddf0b2988eb0901

SHA256
41005a89a6513c16d6ae0a47fa97ca09c9425a98a729b0f565b718a58b4f432d

SHA512
ec8e657d53b3f9f729b8806d8afde0fe17a086a65cf2da77cf8ef253acd2f712e43381a0a78518b004584922c94cb389df539ef50bdb6c92e6099e18fbc2b6f3

Download Submit
\Windows\SysWOW64\installd.exe
Filesize
108KB

MD5
bd90827885cf621141874ce2b4e4c174

SHA1
ee24eded23cbee51ce2cd073ce278ab30f543c61

SHA256
455e84afb4865a2147b5a0c256841703a9b3135fcafddfc9468fa450512ce9bb

SHA512
d5d529e11ef0812558e207736c57b8ac97b7673f2afe1e0cf105c3da640d28b2bbbb2ae810186d9f1619e595e2bd7820c9f4a2de055fa9a63260cfd2e9cbd9aa

Download Submit
\Windows\SysWOW64\nethtsrv.exe
Filesize
176KB

MD5
201f136a33709e27d79547caebd00cdc

SHA1
d9229d35a9fc2bd48293b7e91fb624077aeb0611

SHA256
bf0ccc7c4753c91fbc9342ef783d9e0e8d36c09e7e2bea71487916ee937dda2f

SHA512
4897e268699697cabdbf9347ac744c1a440dfedc557bcabb788ba03106ed113510ce1f163cca009378c9f15dfe7a3c663f2f0ff2242224b8393317b97e82bafa

Download Submit
\Windows\SysWOW64\netupdsrv.exe
Filesize
158KB

MD5
419268bda19ab230682a19c400ab6f79

SHA1
91d1332c22be496ef453b3b451cff013c52105ab

SHA256
21c5177480a2d075d1102af33921c50d13eab89fa0a971b34e0317f30ba608b3

SHA512
60f54ce1c408f71970332f4d64d565f08038777e6423df6c7d4d8489cb64a105ea8142443d515a46ae38deb20d984a9dcd0c067fece54b1256934421ecf5a94e

Download Submit
memory/472-58-0x0000000000000000-mapping.dmp

Download
memory/916-81-0x0000000000000000-mapping.dmp

Download
memory/944-60-0x0000000000000000-mapping.dmp

Download
memory/1140-62-0x0000000000360000-0x00000000007BE000-memory.dmp

Filesize
4.4MB

Download
memory/1140-75-0x0000000000360000-0x00000000007BE000-memory.dmp

Filesize
4.4MB

Download
memory/1140-54-0x0000000075DF1000-0x0000000075DF3000-memory.dmp

Filesize
8KB

Download
memory/1140-91-0x0000000000360000-0x00000000007BE000-memory.dmp

Filesize
4.4MB

Download
memory/1160-70-0x0000000000000000-mapping.dmp

Download
memory/1184-82-0x0000000000000000-mapping.dmp

Download
memory/1464-57-0x0000000000000000-mapping.dmp

Download
memory/1540-64-0x0000000000000000-mapping.dmp

Download
memory/1912-77-0x0000000000000000-mapping.dmp

Download
memory/1924-61-0x0000000000000000-mapping.dmp

Download
memory/2012-87-0x0000000000000000-mapping.dmp

Download
memory/2036-88-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads