c55b0e2e30aa53dc2e9f9f346d1ca6ccbb9080227bbec9a298bf4cc19d72e19f

Analysis

max time kernel
102s
max time network
31s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
23-11-2022 10:13

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c55b0e2e30aa53dc2e9f9f346d1ca6ccbb9080227bbec9a298bf4cc19d72e19f.exe
Size

603KB
MD5

e5490a4c35293ae6017a08774eef5d9e
SHA1

f054171de30255d32e8b188185f30e9e0ebd3550
SHA256

c55b0e2e30aa53dc2e9f9f346d1ca6ccbb9080227bbec9a298bf4cc19d72e19f
SHA512

17655567bf7cf029e8266bc8de67784e4e5c6763533518e1a143c4153da2990217eb8e9c60cbaee7ee4300eceec93c4572c279afd7f2cead7f010966de06a86c
SSDEEP

12288:iIny5DYTQIrwDHBOEQuyGJ9jPoJoTl+tyx+TNiaJyJe7Y/di:EUTQgOHBOEpyGdTl+g+VJEet

Score

8^/10

discovery

Malware Config

Signatures

Drops file in Drivers directory 1 IoCs

Processes:

c55b0e2e30aa53dc2e9f9f346d1ca6ccbb9080227bbec9a298bf4cc19d72e19f.exe

description ioc process

File created C:\Windows\system32\drivers\nethfdrv.sys c55b0e2e30aa53dc2e9f9f346d1ca6ccbb9080227bbec9a298bf4cc19d72e19f.exe
Executes dropped EXE 5 IoCs

Processes:

installd.exenethtsrv.exenetupdsrv.exenethtsrv.exenetupdsrv.exe

pid process

1912 installd.exe
316 nethtsrv.exe
1936 netupdsrv.exe
1656 nethtsrv.exe
1308 netupdsrv.exe

description	ioc	process
File created	C:\Windows\system32\drivers\nethfdrv.sys	c55b0e2e30aa53dc2e9f9f346d1ca6ccbb9080227bbec9a298bf4cc19d72e19f.exe

pid	process
1912	installd.exe
316	nethtsrv.exe
1936	netupdsrv.exe
1656	nethtsrv.exe
1308	netupdsrv.exe

Loads dropped DLL 13 IoCs

Processes:

c55b0e2e30aa53dc2e9f9f346d1ca6ccbb9080227bbec9a298bf4cc19d72e19f.exeinstalld.exenethtsrv.exenethtsrv.exe

pid	process
2024	c55b0e2e30aa53dc2e9f9f346d1ca6ccbb9080227bbec9a298bf4cc19d72e19f.exe
2024	c55b0e2e30aa53dc2e9f9f346d1ca6ccbb9080227bbec9a298bf4cc19d72e19f.exe
2024	c55b0e2e30aa53dc2e9f9f346d1ca6ccbb9080227bbec9a298bf4cc19d72e19f.exe
2024	c55b0e2e30aa53dc2e9f9f346d1ca6ccbb9080227bbec9a298bf4cc19d72e19f.exe
1912	installd.exe
2024	c55b0e2e30aa53dc2e9f9f346d1ca6ccbb9080227bbec9a298bf4cc19d72e19f.exe
316	nethtsrv.exe
316	nethtsrv.exe
2024	c55b0e2e30aa53dc2e9f9f346d1ca6ccbb9080227bbec9a298bf4cc19d72e19f.exe
2024	c55b0e2e30aa53dc2e9f9f346d1ca6ccbb9080227bbec9a298bf4cc19d72e19f.exe
1656	nethtsrv.exe
1656	nethtsrv.exe
2024	c55b0e2e30aa53dc2e9f9f346d1ca6ccbb9080227bbec9a298bf4cc19d72e19f.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in System32 directory 5 IoCs

Processes:

c55b0e2e30aa53dc2e9f9f346d1ca6ccbb9080227bbec9a298bf4cc19d72e19f.exe

description	ioc	process
File created	C:\Windows\SysWOW64\hfnapi.dll	c55b0e2e30aa53dc2e9f9f346d1ca6ccbb9080227bbec9a298bf4cc19d72e19f.exe
File created	C:\Windows\SysWOW64\hfpapi.dll	c55b0e2e30aa53dc2e9f9f346d1ca6ccbb9080227bbec9a298bf4cc19d72e19f.exe
File created	C:\Windows\SysWOW64\installd.exe	c55b0e2e30aa53dc2e9f9f346d1ca6ccbb9080227bbec9a298bf4cc19d72e19f.exe
File created	C:\Windows\SysWOW64\nethtsrv.exe	c55b0e2e30aa53dc2e9f9f346d1ca6ccbb9080227bbec9a298bf4cc19d72e19f.exe
File created	C:\Windows\SysWOW64\netupdsrv.exe	c55b0e2e30aa53dc2e9f9f346d1ca6ccbb9080227bbec9a298bf4cc19d72e19f.exe

Drops file in Program Files directory 3 IoCs

Processes:

c55b0e2e30aa53dc2e9f9f346d1ca6ccbb9080227bbec9a298bf4cc19d72e19f.exe

description	ioc	process
File created	C:\Program Files (x86)\Common Files\Config\ver.xml	c55b0e2e30aa53dc2e9f9f346d1ca6ccbb9080227bbec9a298bf4cc19d72e19f.exe
File created	C:\Program Files (x86)\Common Files\config\uninstinethnfd.exe	c55b0e2e30aa53dc2e9f9f346d1ca6ccbb9080227bbec9a298bf4cc19d72e19f.exe
File created	C:\Program Files (x86)\Common Files\Config\data.xml	c55b0e2e30aa53dc2e9f9f346d1ca6ccbb9080227bbec9a298bf4cc19d72e19f.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Runs net.exe
Suspicious behavior: LoadsDriver 1 IoCs

Processes:

pid process

464
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

nethtsrv.exe

description pid process

Token: SeDebugPrivilege 1656 nethtsrv.exe

pid	process
464

description	pid	process
Token: SeDebugPrivilege	1656	nethtsrv.exe

Suspicious use of WriteProcessMemory 50 IoCs

Processes:

c55b0e2e30aa53dc2e9f9f346d1ca6ccbb9080227bbec9a298bf4cc19d72e19f.exenet.exenet.exenet.exenet.exe

description	pid	process	target process
PID 2024 wrote to memory of 1576	2024	c55b0e2e30aa53dc2e9f9f346d1ca6ccbb9080227bbec9a298bf4cc19d72e19f.exe	net.exe
PID 2024 wrote to memory of 1576	2024	c55b0e2e30aa53dc2e9f9f346d1ca6ccbb9080227bbec9a298bf4cc19d72e19f.exe	net.exe
PID 2024 wrote to memory of 1576	2024	c55b0e2e30aa53dc2e9f9f346d1ca6ccbb9080227bbec9a298bf4cc19d72e19f.exe	net.exe
PID 2024 wrote to memory of 1576	2024	c55b0e2e30aa53dc2e9f9f346d1ca6ccbb9080227bbec9a298bf4cc19d72e19f.exe	net.exe
PID 1576 wrote to memory of 676	1576	net.exe	net1.exe
PID 1576 wrote to memory of 676	1576	net.exe	net1.exe
PID 1576 wrote to memory of 676	1576	net.exe	net1.exe
PID 1576 wrote to memory of 676	1576	net.exe	net1.exe
PID 2024 wrote to memory of 524	2024	c55b0e2e30aa53dc2e9f9f346d1ca6ccbb9080227bbec9a298bf4cc19d72e19f.exe	net.exe
PID 2024 wrote to memory of 524	2024	c55b0e2e30aa53dc2e9f9f346d1ca6ccbb9080227bbec9a298bf4cc19d72e19f.exe	net.exe
PID 2024 wrote to memory of 524	2024	c55b0e2e30aa53dc2e9f9f346d1ca6ccbb9080227bbec9a298bf4cc19d72e19f.exe	net.exe
PID 2024 wrote to memory of 524	2024	c55b0e2e30aa53dc2e9f9f346d1ca6ccbb9080227bbec9a298bf4cc19d72e19f.exe	net.exe
PID 524 wrote to memory of 1640	524	net.exe	net1.exe
PID 524 wrote to memory of 1640	524	net.exe	net1.exe
PID 524 wrote to memory of 1640	524	net.exe	net1.exe
PID 524 wrote to memory of 1640	524	net.exe	net1.exe
PID 2024 wrote to memory of 1912	2024	c55b0e2e30aa53dc2e9f9f346d1ca6ccbb9080227bbec9a298bf4cc19d72e19f.exe	installd.exe
PID 2024 wrote to memory of 1912	2024	c55b0e2e30aa53dc2e9f9f346d1ca6ccbb9080227bbec9a298bf4cc19d72e19f.exe	installd.exe
PID 2024 wrote to memory of 1912	2024	c55b0e2e30aa53dc2e9f9f346d1ca6ccbb9080227bbec9a298bf4cc19d72e19f.exe	installd.exe
PID 2024 wrote to memory of 1912	2024	c55b0e2e30aa53dc2e9f9f346d1ca6ccbb9080227bbec9a298bf4cc19d72e19f.exe	installd.exe
PID 2024 wrote to memory of 1912	2024	c55b0e2e30aa53dc2e9f9f346d1ca6ccbb9080227bbec9a298bf4cc19d72e19f.exe	installd.exe
PID 2024 wrote to memory of 1912	2024	c55b0e2e30aa53dc2e9f9f346d1ca6ccbb9080227bbec9a298bf4cc19d72e19f.exe	installd.exe
PID 2024 wrote to memory of 1912	2024	c55b0e2e30aa53dc2e9f9f346d1ca6ccbb9080227bbec9a298bf4cc19d72e19f.exe	installd.exe
PID 2024 wrote to memory of 316	2024	c55b0e2e30aa53dc2e9f9f346d1ca6ccbb9080227bbec9a298bf4cc19d72e19f.exe	nethtsrv.exe
PID 2024 wrote to memory of 316	2024	c55b0e2e30aa53dc2e9f9f346d1ca6ccbb9080227bbec9a298bf4cc19d72e19f.exe	nethtsrv.exe
PID 2024 wrote to memory of 316	2024	c55b0e2e30aa53dc2e9f9f346d1ca6ccbb9080227bbec9a298bf4cc19d72e19f.exe	nethtsrv.exe
PID 2024 wrote to memory of 316	2024	c55b0e2e30aa53dc2e9f9f346d1ca6ccbb9080227bbec9a298bf4cc19d72e19f.exe	nethtsrv.exe
PID 2024 wrote to memory of 1936	2024	c55b0e2e30aa53dc2e9f9f346d1ca6ccbb9080227bbec9a298bf4cc19d72e19f.exe	netupdsrv.exe
PID 2024 wrote to memory of 1936	2024	c55b0e2e30aa53dc2e9f9f346d1ca6ccbb9080227bbec9a298bf4cc19d72e19f.exe	netupdsrv.exe
PID 2024 wrote to memory of 1936	2024	c55b0e2e30aa53dc2e9f9f346d1ca6ccbb9080227bbec9a298bf4cc19d72e19f.exe	netupdsrv.exe
PID 2024 wrote to memory of 1936	2024	c55b0e2e30aa53dc2e9f9f346d1ca6ccbb9080227bbec9a298bf4cc19d72e19f.exe	netupdsrv.exe
PID 2024 wrote to memory of 1936	2024	c55b0e2e30aa53dc2e9f9f346d1ca6ccbb9080227bbec9a298bf4cc19d72e19f.exe	netupdsrv.exe
PID 2024 wrote to memory of 1936	2024	c55b0e2e30aa53dc2e9f9f346d1ca6ccbb9080227bbec9a298bf4cc19d72e19f.exe	netupdsrv.exe
PID 2024 wrote to memory of 1936	2024	c55b0e2e30aa53dc2e9f9f346d1ca6ccbb9080227bbec9a298bf4cc19d72e19f.exe	netupdsrv.exe
PID 2024 wrote to memory of 984	2024	c55b0e2e30aa53dc2e9f9f346d1ca6ccbb9080227bbec9a298bf4cc19d72e19f.exe	net.exe
PID 2024 wrote to memory of 984	2024	c55b0e2e30aa53dc2e9f9f346d1ca6ccbb9080227bbec9a298bf4cc19d72e19f.exe	net.exe
PID 2024 wrote to memory of 984	2024	c55b0e2e30aa53dc2e9f9f346d1ca6ccbb9080227bbec9a298bf4cc19d72e19f.exe	net.exe
PID 2024 wrote to memory of 984	2024	c55b0e2e30aa53dc2e9f9f346d1ca6ccbb9080227bbec9a298bf4cc19d72e19f.exe	net.exe
PID 984 wrote to memory of 1932	984	net.exe	net1.exe
PID 984 wrote to memory of 1932	984	net.exe	net1.exe
PID 984 wrote to memory of 1932	984	net.exe	net1.exe
PID 984 wrote to memory of 1932	984	net.exe	net1.exe
PID 2024 wrote to memory of 1476	2024	c55b0e2e30aa53dc2e9f9f346d1ca6ccbb9080227bbec9a298bf4cc19d72e19f.exe	net.exe
PID 2024 wrote to memory of 1476	2024	c55b0e2e30aa53dc2e9f9f346d1ca6ccbb9080227bbec9a298bf4cc19d72e19f.exe	net.exe
PID 2024 wrote to memory of 1476	2024	c55b0e2e30aa53dc2e9f9f346d1ca6ccbb9080227bbec9a298bf4cc19d72e19f.exe	net.exe
PID 2024 wrote to memory of 1476	2024	c55b0e2e30aa53dc2e9f9f346d1ca6ccbb9080227bbec9a298bf4cc19d72e19f.exe	net.exe
PID 1476 wrote to memory of 1944	1476	net.exe	net1.exe
PID 1476 wrote to memory of 1944	1476	net.exe	net1.exe
PID 1476 wrote to memory of 1944	1476	net.exe	net1.exe
PID 1476 wrote to memory of 1944	1476	net.exe	net1.exe

C:\Users\Admin\AppData\Local\Temp\c55b0e2e30aa53dc2e9f9f346d1ca6ccbb9080227bbec9a298bf4cc19d72e19f.exe
"C:\Users\Admin\AppData\Local\Temp\c55b0e2e30aa53dc2e9f9f346d1ca6ccbb9080227bbec9a298bf4cc19d72e19f.exe"
1⤵
- Drops file in Drivers directory
- Loads dropped DLL
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:2024

C:\Windows\SysWOW64\net.exe
net stop nethttpservice
2⤵
- Suspicious use of WriteProcessMemory
PID:1576

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop nethttpservice
3⤵
PID:676

C:\Windows\SysWOW64\net.exe
net stop serviceupdater
2⤵
- Suspicious use of WriteProcessMemory
PID:524

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop serviceupdater
3⤵
PID:1640

C:\Windows\SysWOW64\installd.exe
"C:\Windows\system32\installd.exe" nethfdrv
2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1912

C:\Windows\SysWOW64\nethtsrv.exe
"C:\Windows\system32\nethtsrv.exe" -nfdi
2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:316

C:\Windows\SysWOW64\netupdsrv.exe
"C:\Windows\system32\netupdsrv.exe" -nfdi
2⤵
- Executes dropped EXE
PID:1936

C:\Windows\SysWOW64\net.exe
net start nethttpservice
2⤵
- Suspicious use of WriteProcessMemory
PID:984

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 start nethttpservice
3⤵
PID:1932

C:\Windows\SysWOW64\net.exe
net start serviceupdater
2⤵
- Suspicious use of WriteProcessMemory
PID:1476

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 start serviceupdater
3⤵
PID:1944

C:\Windows\SysWOW64\nethtsrv.exe
C:\Windows\SysWOW64\nethtsrv.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:1656

C:\Windows\SysWOW64\netupdsrv.exe
C:\Windows\SysWOW64\netupdsrv.exe
1⤵
- Executes dropped EXE
PID:1308

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\hfnapi.dll
Filesize
106KB

MD5
6eba603ead229e404c4bd6c83ac99455

SHA1
f6ebafa236e040cb4eb9225f483c22d9a8aeda7d

SHA256
6f888fce2b60cbf210146aaeb43324bfdeba4344bd202edf7ab673ab7a381925

SHA512
22fb97d873d68e8fcbaedd59ce678011165c98a56e655be3fd514bc1b88ead3ab3e8fbc3f376e70b21ab79d193191e9c4e6b1bed06b9b10f8b488e1eff374510

Download Submit
C:\Windows\SysWOW64\hfpapi.dll
Filesize
244KB

MD5
1053b5c3789fae9b22a349168940d0ff

SHA1
d0f9ee6fb8278cf3b61bd7145cb87c8b7743d58e

SHA256
e54c8bb39eaa286467500cb95c69106511b873a57d270e7b1bbb876ee71ece7d

SHA512
14990dfc4282e1932e1e9d1a4863e3b06e42aebcc97f2664c407ebfb1c7e26fc3b0309f52286b525d8376f29da72ff971206cd0cb606f9c90df235f261895208

Download Submit
C:\Windows\SysWOW64\installd.exe
Filesize
108KB

MD5
14ee20fa93ad4b03a61693395766d972

SHA1
e8a41e28413a6610923a3ae25008eadcac2886d9

SHA256
4543eb020c4d2cc3a1b791d710b4cec9b1f165fdcc70d07f7b89ed8d33c721ee

SHA512
6e8d44d0e18dbfe4fed5709e48878059f816af14b86ef97d64a19727d652918873003eb999c583c031706fa9d38cbcecdb68c5718c676d929a5cd6618ff28e45

Download Submit
C:\Windows\SysWOW64\nethtsrv.exe
Filesize
176KB

MD5
bde21137f09e9ef1fd66e83677f8ce23

SHA1
67227fa178519877c8671a746ddf548319ac9f69

SHA256
98db5a1d2f75da3af9042c3430ad1f9f2e19ab965b8230fdb140eb18b45dfecf

SHA512
8ca5890291a7588597fef4e0a51c22b545282d9661db430645f37d8bfdeb5b4eef6c688dabfd0968fe40763bb60e3e286182f5d8638988a6986853b0919a3f90

Download Submit
C:\Windows\SysWOW64\nethtsrv.exe
Filesize
176KB

MD5
bde21137f09e9ef1fd66e83677f8ce23

SHA1
67227fa178519877c8671a746ddf548319ac9f69

SHA256
98db5a1d2f75da3af9042c3430ad1f9f2e19ab965b8230fdb140eb18b45dfecf

SHA512
8ca5890291a7588597fef4e0a51c22b545282d9661db430645f37d8bfdeb5b4eef6c688dabfd0968fe40763bb60e3e286182f5d8638988a6986853b0919a3f90

Download Submit
C:\Windows\SysWOW64\netupdsrv.exe
Filesize
159KB

MD5
505859c460903fa061ab49fb57e0d593

SHA1
c364f410cc6033a1638520720c8f5a0da3b65e46

SHA256
e48011f3e0d842cd512e3911112dc51e1eaa7747ba8aeff4a142d151a6206119

SHA512
c621bbb72a493b2dd1fab7914a7246a02832de3549fce583e816744a07e3dfa18f08857c829b26abb07b0c3bc8eedd3502cfcb128a635ec5b0577f0d76f7da1a

Download Submit
C:\Windows\SysWOW64\netupdsrv.exe
Filesize
159KB

MD5
505859c460903fa061ab49fb57e0d593

SHA1
c364f410cc6033a1638520720c8f5a0da3b65e46

SHA256
e48011f3e0d842cd512e3911112dc51e1eaa7747ba8aeff4a142d151a6206119

SHA512
c621bbb72a493b2dd1fab7914a7246a02832de3549fce583e816744a07e3dfa18f08857c829b26abb07b0c3bc8eedd3502cfcb128a635ec5b0577f0d76f7da1a

Download Submit
\Users\Admin\AppData\Local\Temp\nsnBA7.tmp\System.dll
Filesize
11KB

MD5
c17103ae9072a06da581dec998343fc1

SHA1
b72148c6bdfaada8b8c3f950e610ee7cf1da1f8d

SHA256
dc58d8ad81cacb0c1ed72e33bff8f23ea40b5252b5bb55d393a0903e6819ae2f

SHA512
d32a71aaef18e993f28096d536e41c4d016850721b31171513ce28bbd805a54fd290b7c3e9d935f72e676a1acfb4f0dcc89d95040a0dd29f2b6975855c18986f

Download Submit
\Users\Admin\AppData\Local\Temp\nsnBA7.tmp\nsExec.dll
Filesize
6KB

MD5
acc2b699edfea5bf5aae45aba3a41e96

SHA1
d2accf4d494e43ceb2cff69abe4dd17147d29cc2

SHA256
168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e

SHA512
e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe

Download Submit
\Users\Admin\AppData\Local\Temp\nsnBA7.tmp\nsExec.dll
Filesize
6KB

MD5
acc2b699edfea5bf5aae45aba3a41e96

SHA1
d2accf4d494e43ceb2cff69abe4dd17147d29cc2

SHA256
168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e

SHA512
e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe

Download Submit
\Users\Admin\AppData\Local\Temp\nsnBA7.tmp\nsExec.dll
Filesize
6KB

MD5
acc2b699edfea5bf5aae45aba3a41e96

SHA1
d2accf4d494e43ceb2cff69abe4dd17147d29cc2

SHA256
168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e

SHA512
e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe

Download Submit
\Users\Admin\AppData\Local\Temp\nsnBA7.tmp\nsExec.dll
Filesize
6KB

MD5
acc2b699edfea5bf5aae45aba3a41e96

SHA1
d2accf4d494e43ceb2cff69abe4dd17147d29cc2

SHA256
168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e

SHA512
e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe

Download Submit
\Windows\SysWOW64\hfnapi.dll
Filesize
106KB

MD5
6eba603ead229e404c4bd6c83ac99455

SHA1
f6ebafa236e040cb4eb9225f483c22d9a8aeda7d

SHA256
6f888fce2b60cbf210146aaeb43324bfdeba4344bd202edf7ab673ab7a381925

SHA512
22fb97d873d68e8fcbaedd59ce678011165c98a56e655be3fd514bc1b88ead3ab3e8fbc3f376e70b21ab79d193191e9c4e6b1bed06b9b10f8b488e1eff374510

Download Submit
\Windows\SysWOW64\hfnapi.dll
Filesize
106KB

MD5
6eba603ead229e404c4bd6c83ac99455

SHA1
f6ebafa236e040cb4eb9225f483c22d9a8aeda7d

SHA256
6f888fce2b60cbf210146aaeb43324bfdeba4344bd202edf7ab673ab7a381925

SHA512
22fb97d873d68e8fcbaedd59ce678011165c98a56e655be3fd514bc1b88ead3ab3e8fbc3f376e70b21ab79d193191e9c4e6b1bed06b9b10f8b488e1eff374510

Download Submit
\Windows\SysWOW64\hfnapi.dll
Filesize
106KB

MD5
6eba603ead229e404c4bd6c83ac99455

SHA1
f6ebafa236e040cb4eb9225f483c22d9a8aeda7d

SHA256
6f888fce2b60cbf210146aaeb43324bfdeba4344bd202edf7ab673ab7a381925

SHA512
22fb97d873d68e8fcbaedd59ce678011165c98a56e655be3fd514bc1b88ead3ab3e8fbc3f376e70b21ab79d193191e9c4e6b1bed06b9b10f8b488e1eff374510

Download Submit
\Windows\SysWOW64\hfpapi.dll
Filesize
244KB

MD5
1053b5c3789fae9b22a349168940d0ff

SHA1
d0f9ee6fb8278cf3b61bd7145cb87c8b7743d58e

SHA256
e54c8bb39eaa286467500cb95c69106511b873a57d270e7b1bbb876ee71ece7d

SHA512
14990dfc4282e1932e1e9d1a4863e3b06e42aebcc97f2664c407ebfb1c7e26fc3b0309f52286b525d8376f29da72ff971206cd0cb606f9c90df235f261895208

Download Submit
\Windows\SysWOW64\hfpapi.dll
Filesize
244KB

MD5
1053b5c3789fae9b22a349168940d0ff

SHA1
d0f9ee6fb8278cf3b61bd7145cb87c8b7743d58e

SHA256
e54c8bb39eaa286467500cb95c69106511b873a57d270e7b1bbb876ee71ece7d

SHA512
14990dfc4282e1932e1e9d1a4863e3b06e42aebcc97f2664c407ebfb1c7e26fc3b0309f52286b525d8376f29da72ff971206cd0cb606f9c90df235f261895208

Download Submit
\Windows\SysWOW64\installd.exe
Filesize
108KB

MD5
14ee20fa93ad4b03a61693395766d972

SHA1
e8a41e28413a6610923a3ae25008eadcac2886d9

SHA256
4543eb020c4d2cc3a1b791d710b4cec9b1f165fdcc70d07f7b89ed8d33c721ee

SHA512
6e8d44d0e18dbfe4fed5709e48878059f816af14b86ef97d64a19727d652918873003eb999c583c031706fa9d38cbcecdb68c5718c676d929a5cd6618ff28e45

Download Submit
\Windows\SysWOW64\nethtsrv.exe
Filesize
176KB

MD5
bde21137f09e9ef1fd66e83677f8ce23

SHA1
67227fa178519877c8671a746ddf548319ac9f69

SHA256
98db5a1d2f75da3af9042c3430ad1f9f2e19ab965b8230fdb140eb18b45dfecf

SHA512
8ca5890291a7588597fef4e0a51c22b545282d9661db430645f37d8bfdeb5b4eef6c688dabfd0968fe40763bb60e3e286182f5d8638988a6986853b0919a3f90

Download Submit
\Windows\SysWOW64\netupdsrv.exe
Filesize
159KB

MD5
505859c460903fa061ab49fb57e0d593

SHA1
c364f410cc6033a1638520720c8f5a0da3b65e46

SHA256
e48011f3e0d842cd512e3911112dc51e1eaa7747ba8aeff4a142d151a6206119

SHA512
c621bbb72a493b2dd1fab7914a7246a02832de3549fce583e816744a07e3dfa18f08857c829b26abb07b0c3bc8eedd3502cfcb128a635ec5b0577f0d76f7da1a

Download Submit
memory/316-71-0x0000000000000000-mapping.dmp

Download
memory/524-61-0x0000000000000000-mapping.dmp

Download
memory/676-59-0x0000000000000000-mapping.dmp

Download
memory/984-81-0x0000000000000000-mapping.dmp

Download
memory/1476-87-0x0000000000000000-mapping.dmp

Download
memory/1576-58-0x0000000000000000-mapping.dmp

Download
memory/1640-62-0x0000000000000000-mapping.dmp

Download
memory/1912-65-0x0000000000000000-mapping.dmp

Download
memory/1932-82-0x0000000000000000-mapping.dmp

Download
memory/1936-77-0x0000000000000000-mapping.dmp

Download
memory/1944-88-0x0000000000000000-mapping.dmp

Download
memory/2024-54-0x00000000767F1000-0x00000000767F3000-memory.dmp

Filesize
8KB

Download
memory/2024-64-0x0000000000360000-0x00000000007BE000-memory.dmp

Filesize
4.4MB

Download
memory/2024-55-0x0000000000360000-0x00000000007BE000-memory.dmp

Filesize
4.4MB

Download
memory/2024-91-0x0000000000360000-0x00000000007BE000-memory.dmp

Filesize
4.4MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads