d11ad38f6f0bb50401980379560b7b1c656baf576df1b76dd9605779a7f1f0c0

Analysis

max time kernel
46s
max time network
34s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
23-11-2022 10:11

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d11ad38f6f0bb50401980379560b7b1c656baf576df1b76dd9605779a7f1f0c0.exe
Size

602KB
MD5

9f6f08f5bba8bcdc8df85f81a3c063a7
SHA1

bb5476524a4a92ea40e9ae455ee972bada3dd66a
SHA256

d11ad38f6f0bb50401980379560b7b1c656baf576df1b76dd9605779a7f1f0c0
SHA512

07e6b23625d0e1bc17e676a70280e767b5447dbe9d324bf4938b42b684513fd66d62ee8728253106c0728ce5d40efd0aafa79a49ae775069bf52da3f210690c5
SSDEEP

12288:jIny5DYT5ITCtr6t/KNc7FYvRqZ1vNu+cOcLb8RK:rUTeCGpKwNZnh8b8R

Score

8^/10

discovery

Malware Config

Signatures

Drops file in Drivers directory 1 IoCs

Processes:

d11ad38f6f0bb50401980379560b7b1c656baf576df1b76dd9605779a7f1f0c0.exe

description ioc process

File created C:\Windows\system32\drivers\nethfdrv.sys d11ad38f6f0bb50401980379560b7b1c656baf576df1b76dd9605779a7f1f0c0.exe
Executes dropped EXE 5 IoCs

Processes:

installd.exenethtsrv.exenetupdsrv.exenethtsrv.exenetupdsrv.exe

pid process

668 installd.exe
1664 nethtsrv.exe
1992 netupdsrv.exe
1612 nethtsrv.exe
520 netupdsrv.exe

description	ioc	process
File created	C:\Windows\system32\drivers\nethfdrv.sys	d11ad38f6f0bb50401980379560b7b1c656baf576df1b76dd9605779a7f1f0c0.exe

pid	process
668	installd.exe
1664	nethtsrv.exe
1992	netupdsrv.exe
1612	nethtsrv.exe
520	netupdsrv.exe

Loads dropped DLL 13 IoCs

Processes:

d11ad38f6f0bb50401980379560b7b1c656baf576df1b76dd9605779a7f1f0c0.exeinstalld.exenethtsrv.exenethtsrv.exe

pid	process
1552	d11ad38f6f0bb50401980379560b7b1c656baf576df1b76dd9605779a7f1f0c0.exe
1552	d11ad38f6f0bb50401980379560b7b1c656baf576df1b76dd9605779a7f1f0c0.exe
1552	d11ad38f6f0bb50401980379560b7b1c656baf576df1b76dd9605779a7f1f0c0.exe
1552	d11ad38f6f0bb50401980379560b7b1c656baf576df1b76dd9605779a7f1f0c0.exe
668	installd.exe
1552	d11ad38f6f0bb50401980379560b7b1c656baf576df1b76dd9605779a7f1f0c0.exe
1664	nethtsrv.exe
1664	nethtsrv.exe
1552	d11ad38f6f0bb50401980379560b7b1c656baf576df1b76dd9605779a7f1f0c0.exe
1552	d11ad38f6f0bb50401980379560b7b1c656baf576df1b76dd9605779a7f1f0c0.exe
1612	nethtsrv.exe
1612	nethtsrv.exe
1552	d11ad38f6f0bb50401980379560b7b1c656baf576df1b76dd9605779a7f1f0c0.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in System32 directory 5 IoCs

Processes:

d11ad38f6f0bb50401980379560b7b1c656baf576df1b76dd9605779a7f1f0c0.exe

description	ioc	process
File created	C:\Windows\SysWOW64\netupdsrv.exe	d11ad38f6f0bb50401980379560b7b1c656baf576df1b76dd9605779a7f1f0c0.exe
File created	C:\Windows\SysWOW64\hfnapi.dll	d11ad38f6f0bb50401980379560b7b1c656baf576df1b76dd9605779a7f1f0c0.exe
File created	C:\Windows\SysWOW64\hfpapi.dll	d11ad38f6f0bb50401980379560b7b1c656baf576df1b76dd9605779a7f1f0c0.exe
File created	C:\Windows\SysWOW64\installd.exe	d11ad38f6f0bb50401980379560b7b1c656baf576df1b76dd9605779a7f1f0c0.exe
File created	C:\Windows\SysWOW64\nethtsrv.exe	d11ad38f6f0bb50401980379560b7b1c656baf576df1b76dd9605779a7f1f0c0.exe

Drops file in Program Files directory 3 IoCs

Processes:

d11ad38f6f0bb50401980379560b7b1c656baf576df1b76dd9605779a7f1f0c0.exe

description	ioc	process
File created	C:\Program Files (x86)\Common Files\Config\data.xml	d11ad38f6f0bb50401980379560b7b1c656baf576df1b76dd9605779a7f1f0c0.exe
File created	C:\Program Files (x86)\Common Files\Config\ver.xml	d11ad38f6f0bb50401980379560b7b1c656baf576df1b76dd9605779a7f1f0c0.exe
File created	C:\Program Files (x86)\Common Files\config\uninstinethnfd.exe	d11ad38f6f0bb50401980379560b7b1c656baf576df1b76dd9605779a7f1f0c0.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Runs net.exe
Suspicious behavior: LoadsDriver 1 IoCs

Processes:

pid process

460
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

nethtsrv.exe

description pid process

Token: SeDebugPrivilege 1612 nethtsrv.exe

pid	process
460

description	pid	process
Token: SeDebugPrivilege	1612	nethtsrv.exe

Suspicious use of WriteProcessMemory 50 IoCs

Processes:

d11ad38f6f0bb50401980379560b7b1c656baf576df1b76dd9605779a7f1f0c0.exenet.exenet.exenet.exenet.exe

description	pid	process	target process
PID 1552 wrote to memory of 1608	1552	d11ad38f6f0bb50401980379560b7b1c656baf576df1b76dd9605779a7f1f0c0.exe	net.exe
PID 1552 wrote to memory of 1608	1552	d11ad38f6f0bb50401980379560b7b1c656baf576df1b76dd9605779a7f1f0c0.exe	net.exe
PID 1552 wrote to memory of 1608	1552	d11ad38f6f0bb50401980379560b7b1c656baf576df1b76dd9605779a7f1f0c0.exe	net.exe
PID 1552 wrote to memory of 1608	1552	d11ad38f6f0bb50401980379560b7b1c656baf576df1b76dd9605779a7f1f0c0.exe	net.exe
PID 1608 wrote to memory of 1000	1608	net.exe	net1.exe
PID 1608 wrote to memory of 1000	1608	net.exe	net1.exe
PID 1608 wrote to memory of 1000	1608	net.exe	net1.exe
PID 1608 wrote to memory of 1000	1608	net.exe	net1.exe
PID 1552 wrote to memory of 752	1552	d11ad38f6f0bb50401980379560b7b1c656baf576df1b76dd9605779a7f1f0c0.exe	net.exe
PID 1552 wrote to memory of 752	1552	d11ad38f6f0bb50401980379560b7b1c656baf576df1b76dd9605779a7f1f0c0.exe	net.exe
PID 1552 wrote to memory of 752	1552	d11ad38f6f0bb50401980379560b7b1c656baf576df1b76dd9605779a7f1f0c0.exe	net.exe
PID 1552 wrote to memory of 752	1552	d11ad38f6f0bb50401980379560b7b1c656baf576df1b76dd9605779a7f1f0c0.exe	net.exe
PID 752 wrote to memory of 872	752	net.exe	net1.exe
PID 752 wrote to memory of 872	752	net.exe	net1.exe
PID 752 wrote to memory of 872	752	net.exe	net1.exe
PID 752 wrote to memory of 872	752	net.exe	net1.exe
PID 1552 wrote to memory of 668	1552	d11ad38f6f0bb50401980379560b7b1c656baf576df1b76dd9605779a7f1f0c0.exe	installd.exe
PID 1552 wrote to memory of 668	1552	d11ad38f6f0bb50401980379560b7b1c656baf576df1b76dd9605779a7f1f0c0.exe	installd.exe
PID 1552 wrote to memory of 668	1552	d11ad38f6f0bb50401980379560b7b1c656baf576df1b76dd9605779a7f1f0c0.exe	installd.exe
PID 1552 wrote to memory of 668	1552	d11ad38f6f0bb50401980379560b7b1c656baf576df1b76dd9605779a7f1f0c0.exe	installd.exe
PID 1552 wrote to memory of 668	1552	d11ad38f6f0bb50401980379560b7b1c656baf576df1b76dd9605779a7f1f0c0.exe	installd.exe
PID 1552 wrote to memory of 668	1552	d11ad38f6f0bb50401980379560b7b1c656baf576df1b76dd9605779a7f1f0c0.exe	installd.exe
PID 1552 wrote to memory of 668	1552	d11ad38f6f0bb50401980379560b7b1c656baf576df1b76dd9605779a7f1f0c0.exe	installd.exe
PID 1552 wrote to memory of 1664	1552	d11ad38f6f0bb50401980379560b7b1c656baf576df1b76dd9605779a7f1f0c0.exe	nethtsrv.exe
PID 1552 wrote to memory of 1664	1552	d11ad38f6f0bb50401980379560b7b1c656baf576df1b76dd9605779a7f1f0c0.exe	nethtsrv.exe
PID 1552 wrote to memory of 1664	1552	d11ad38f6f0bb50401980379560b7b1c656baf576df1b76dd9605779a7f1f0c0.exe	nethtsrv.exe
PID 1552 wrote to memory of 1664	1552	d11ad38f6f0bb50401980379560b7b1c656baf576df1b76dd9605779a7f1f0c0.exe	nethtsrv.exe
PID 1552 wrote to memory of 1992	1552	d11ad38f6f0bb50401980379560b7b1c656baf576df1b76dd9605779a7f1f0c0.exe	netupdsrv.exe
PID 1552 wrote to memory of 1992	1552	d11ad38f6f0bb50401980379560b7b1c656baf576df1b76dd9605779a7f1f0c0.exe	netupdsrv.exe
PID 1552 wrote to memory of 1992	1552	d11ad38f6f0bb50401980379560b7b1c656baf576df1b76dd9605779a7f1f0c0.exe	netupdsrv.exe
PID 1552 wrote to memory of 1992	1552	d11ad38f6f0bb50401980379560b7b1c656baf576df1b76dd9605779a7f1f0c0.exe	netupdsrv.exe
PID 1552 wrote to memory of 1992	1552	d11ad38f6f0bb50401980379560b7b1c656baf576df1b76dd9605779a7f1f0c0.exe	netupdsrv.exe
PID 1552 wrote to memory of 1992	1552	d11ad38f6f0bb50401980379560b7b1c656baf576df1b76dd9605779a7f1f0c0.exe	netupdsrv.exe
PID 1552 wrote to memory of 1992	1552	d11ad38f6f0bb50401980379560b7b1c656baf576df1b76dd9605779a7f1f0c0.exe	netupdsrv.exe
PID 1552 wrote to memory of 1736	1552	d11ad38f6f0bb50401980379560b7b1c656baf576df1b76dd9605779a7f1f0c0.exe	net.exe
PID 1552 wrote to memory of 1736	1552	d11ad38f6f0bb50401980379560b7b1c656baf576df1b76dd9605779a7f1f0c0.exe	net.exe
PID 1552 wrote to memory of 1736	1552	d11ad38f6f0bb50401980379560b7b1c656baf576df1b76dd9605779a7f1f0c0.exe	net.exe
PID 1552 wrote to memory of 1736	1552	d11ad38f6f0bb50401980379560b7b1c656baf576df1b76dd9605779a7f1f0c0.exe	net.exe
PID 1736 wrote to memory of 1844	1736	net.exe	net1.exe
PID 1736 wrote to memory of 1844	1736	net.exe	net1.exe
PID 1736 wrote to memory of 1844	1736	net.exe	net1.exe
PID 1736 wrote to memory of 1844	1736	net.exe	net1.exe
PID 1552 wrote to memory of 780	1552	d11ad38f6f0bb50401980379560b7b1c656baf576df1b76dd9605779a7f1f0c0.exe	net.exe
PID 1552 wrote to memory of 780	1552	d11ad38f6f0bb50401980379560b7b1c656baf576df1b76dd9605779a7f1f0c0.exe	net.exe
PID 1552 wrote to memory of 780	1552	d11ad38f6f0bb50401980379560b7b1c656baf576df1b76dd9605779a7f1f0c0.exe	net.exe
PID 1552 wrote to memory of 780	1552	d11ad38f6f0bb50401980379560b7b1c656baf576df1b76dd9605779a7f1f0c0.exe	net.exe
PID 780 wrote to memory of 848	780	net.exe	net1.exe
PID 780 wrote to memory of 848	780	net.exe	net1.exe
PID 780 wrote to memory of 848	780	net.exe	net1.exe
PID 780 wrote to memory of 848	780	net.exe	net1.exe

C:\Users\Admin\AppData\Local\Temp\d11ad38f6f0bb50401980379560b7b1c656baf576df1b76dd9605779a7f1f0c0.exe
"C:\Users\Admin\AppData\Local\Temp\d11ad38f6f0bb50401980379560b7b1c656baf576df1b76dd9605779a7f1f0c0.exe"
1⤵
- Drops file in Drivers directory
- Loads dropped DLL
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:1552

C:\Windows\SysWOW64\net.exe
net stop nethttpservice
2⤵
- Suspicious use of WriteProcessMemory
PID:1608

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop nethttpservice
3⤵
PID:1000

C:\Windows\SysWOW64\net.exe
net stop serviceupdater
2⤵
- Suspicious use of WriteProcessMemory
PID:752

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop serviceupdater
3⤵
PID:872

C:\Windows\SysWOW64\installd.exe
"C:\Windows\system32\installd.exe" nethfdrv
2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:668

C:\Windows\SysWOW64\nethtsrv.exe
"C:\Windows\system32\nethtsrv.exe" -nfdi
2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1664

C:\Windows\SysWOW64\netupdsrv.exe
"C:\Windows\system32\netupdsrv.exe" -nfdi
2⤵
- Executes dropped EXE
PID:1992

C:\Windows\SysWOW64\net.exe
net start nethttpservice
2⤵
- Suspicious use of WriteProcessMemory
PID:1736

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 start nethttpservice
3⤵
PID:1844

C:\Windows\SysWOW64\net.exe
net start serviceupdater
2⤵
- Suspicious use of WriteProcessMemory
PID:780

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 start serviceupdater
3⤵
PID:848

C:\Windows\SysWOW64\nethtsrv.exe
C:\Windows\SysWOW64\nethtsrv.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:1612

C:\Windows\SysWOW64\netupdsrv.exe
C:\Windows\SysWOW64\netupdsrv.exe
1⤵
- Executes dropped EXE
PID:520

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\hfnapi.dll
Filesize
106KB

MD5
3e56633b5d1e3fe092f061520c9eca53

SHA1
731ee965636b2421538971840da3b855e98a3d5f

SHA256
70e0177b9cca3de001f46356247ae2eda2998eb8edddfe13284b66ba0f8c0e83

SHA512
457009bafa7691f756585d5f85abbafb83406ac69c688f919dd1e5305b73fddcd0d7851b3949a8a4f537bb6cfb8e7cf77c65221191f693d4d36140d052011e81

Download Submit
C:\Windows\SysWOW64\hfpapi.dll
Filesize
241KB

MD5
8b71677cc5f3f4838598b089d397fd74

SHA1
a9dbef713e67d7eecf0900aaa9646f81775907f7

SHA256
d875ba81952d43d68047f1ba10d62444ef22ffff78d5548dd68a3dbdbd9fe58e

SHA512
719403a7e46fffbaa4cbf694c53c6db7c61e19ff86430a88512a5d28d8fc1d61c979e31ea43572c46f02b8bd7ce29c04677c17b90124119fc0db154cbfdaf59e

Download Submit
C:\Windows\SysWOW64\installd.exe
Filesize
108KB

MD5
79281cf060bbef7f6f328642a2441560

SHA1
eeeab0d7302fb6e1ff8f4af1809815def567a59b

SHA256
f61c89c3c18162fb76ae870d5e817f6401dec8c73589f45e649b8cdcb0a48b5d

SHA512
fda002ea5b8ee78d93a761516532b02bb26249bf91a44c82b74b4c1c25b99c72a2def64c04511635af7b3c0e06cb1ef7ffe79d5d18f7e63748d489ff687d752a

Download Submit
C:\Windows\SysWOW64\nethtsrv.exe
Filesize
176KB

MD5
ea2b7c21807a1bec0596dae76e25645f

SHA1
994e6e8504a95092d9e4d86fde3b72cd22557c7d

SHA256
99b5a085fcd6ad22208f72a9d3aca3bfddfeb4aa6a4e4727cf80740686c518b6

SHA512
5e095590fa6b048d7abd51945ce42b6045ddb7103c5c2d0e1756d75c1318c47ae651395aa1d30c0421e31fa9b529e8fdc70d5614340a8dfab2dbd6f09558a22a

Download Submit
C:\Windows\SysWOW64\nethtsrv.exe
Filesize
176KB

MD5
ea2b7c21807a1bec0596dae76e25645f

SHA1
994e6e8504a95092d9e4d86fde3b72cd22557c7d

SHA256
99b5a085fcd6ad22208f72a9d3aca3bfddfeb4aa6a4e4727cf80740686c518b6

SHA512
5e095590fa6b048d7abd51945ce42b6045ddb7103c5c2d0e1756d75c1318c47ae651395aa1d30c0421e31fa9b529e8fdc70d5614340a8dfab2dbd6f09558a22a

Download Submit
C:\Windows\SysWOW64\netupdsrv.exe
Filesize
158KB

MD5
a9c51ba68503839e795bc215cc95e62e

SHA1
26658c2ad2591e6d4748e1e61cfa2b3cbbfc23c2

SHA256
44b40532f2d3c287c83d27d05a2557a0624b80d05286bcf97d2c729da0c000ab

SHA512
176c79af15c42f776ba364ccb9fbdc80e8982155dc95a078e473bd5e43c682594686347ec86864bae28688f7ba3fb89c9cfeb4103a0bd26dee6f2dd75f09e780

Download Submit
C:\Windows\SysWOW64\netupdsrv.exe
Filesize
158KB

MD5
a9c51ba68503839e795bc215cc95e62e

SHA1
26658c2ad2591e6d4748e1e61cfa2b3cbbfc23c2

SHA256
44b40532f2d3c287c83d27d05a2557a0624b80d05286bcf97d2c729da0c000ab

SHA512
176c79af15c42f776ba364ccb9fbdc80e8982155dc95a078e473bd5e43c682594686347ec86864bae28688f7ba3fb89c9cfeb4103a0bd26dee6f2dd75f09e780

Download Submit
\Users\Admin\AppData\Local\Temp\nseBC12.tmp\System.dll
Filesize
11KB

MD5
c17103ae9072a06da581dec998343fc1

SHA1
b72148c6bdfaada8b8c3f950e610ee7cf1da1f8d

SHA256
dc58d8ad81cacb0c1ed72e33bff8f23ea40b5252b5bb55d393a0903e6819ae2f

SHA512
d32a71aaef18e993f28096d536e41c4d016850721b31171513ce28bbd805a54fd290b7c3e9d935f72e676a1acfb4f0dcc89d95040a0dd29f2b6975855c18986f

Download Submit
\Users\Admin\AppData\Local\Temp\nseBC12.tmp\nsExec.dll
Filesize
6KB

MD5
acc2b699edfea5bf5aae45aba3a41e96

SHA1
d2accf4d494e43ceb2cff69abe4dd17147d29cc2

SHA256
168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e

SHA512
e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe

Download Submit
\Users\Admin\AppData\Local\Temp\nseBC12.tmp\nsExec.dll
Filesize
6KB

MD5
acc2b699edfea5bf5aae45aba3a41e96

SHA1
d2accf4d494e43ceb2cff69abe4dd17147d29cc2

SHA256
168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e

SHA512
e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe

Download Submit
\Users\Admin\AppData\Local\Temp\nseBC12.tmp\nsExec.dll
Filesize
6KB

MD5
acc2b699edfea5bf5aae45aba3a41e96

SHA1
d2accf4d494e43ceb2cff69abe4dd17147d29cc2

SHA256
168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e

SHA512
e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe

Download Submit
\Users\Admin\AppData\Local\Temp\nseBC12.tmp\nsExec.dll
Filesize
6KB

MD5
acc2b699edfea5bf5aae45aba3a41e96

SHA1
d2accf4d494e43ceb2cff69abe4dd17147d29cc2

SHA256
168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e

SHA512
e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe

Download Submit
\Windows\SysWOW64\hfnapi.dll
Filesize
106KB

MD5
3e56633b5d1e3fe092f061520c9eca53

SHA1
731ee965636b2421538971840da3b855e98a3d5f

SHA256
70e0177b9cca3de001f46356247ae2eda2998eb8edddfe13284b66ba0f8c0e83

SHA512
457009bafa7691f756585d5f85abbafb83406ac69c688f919dd1e5305b73fddcd0d7851b3949a8a4f537bb6cfb8e7cf77c65221191f693d4d36140d052011e81

Download Submit
\Windows\SysWOW64\hfnapi.dll
Filesize
106KB

MD5
3e56633b5d1e3fe092f061520c9eca53

SHA1
731ee965636b2421538971840da3b855e98a3d5f

SHA256
70e0177b9cca3de001f46356247ae2eda2998eb8edddfe13284b66ba0f8c0e83

SHA512
457009bafa7691f756585d5f85abbafb83406ac69c688f919dd1e5305b73fddcd0d7851b3949a8a4f537bb6cfb8e7cf77c65221191f693d4d36140d052011e81

Download Submit
\Windows\SysWOW64\hfnapi.dll
Filesize
106KB

MD5
3e56633b5d1e3fe092f061520c9eca53

SHA1
731ee965636b2421538971840da3b855e98a3d5f

SHA256
70e0177b9cca3de001f46356247ae2eda2998eb8edddfe13284b66ba0f8c0e83

SHA512
457009bafa7691f756585d5f85abbafb83406ac69c688f919dd1e5305b73fddcd0d7851b3949a8a4f537bb6cfb8e7cf77c65221191f693d4d36140d052011e81

Download Submit
\Windows\SysWOW64\hfpapi.dll
Filesize
241KB

MD5
8b71677cc5f3f4838598b089d397fd74

SHA1
a9dbef713e67d7eecf0900aaa9646f81775907f7

SHA256
d875ba81952d43d68047f1ba10d62444ef22ffff78d5548dd68a3dbdbd9fe58e

SHA512
719403a7e46fffbaa4cbf694c53c6db7c61e19ff86430a88512a5d28d8fc1d61c979e31ea43572c46f02b8bd7ce29c04677c17b90124119fc0db154cbfdaf59e

Download Submit
\Windows\SysWOW64\hfpapi.dll
Filesize
241KB

MD5
8b71677cc5f3f4838598b089d397fd74

SHA1
a9dbef713e67d7eecf0900aaa9646f81775907f7

SHA256
d875ba81952d43d68047f1ba10d62444ef22ffff78d5548dd68a3dbdbd9fe58e

SHA512
719403a7e46fffbaa4cbf694c53c6db7c61e19ff86430a88512a5d28d8fc1d61c979e31ea43572c46f02b8bd7ce29c04677c17b90124119fc0db154cbfdaf59e

Download Submit
\Windows\SysWOW64\installd.exe
Filesize
108KB

MD5
79281cf060bbef7f6f328642a2441560

SHA1
eeeab0d7302fb6e1ff8f4af1809815def567a59b

SHA256
f61c89c3c18162fb76ae870d5e817f6401dec8c73589f45e649b8cdcb0a48b5d

SHA512
fda002ea5b8ee78d93a761516532b02bb26249bf91a44c82b74b4c1c25b99c72a2def64c04511635af7b3c0e06cb1ef7ffe79d5d18f7e63748d489ff687d752a

Download Submit
\Windows\SysWOW64\nethtsrv.exe
Filesize
176KB

MD5
ea2b7c21807a1bec0596dae76e25645f

SHA1
994e6e8504a95092d9e4d86fde3b72cd22557c7d

SHA256
99b5a085fcd6ad22208f72a9d3aca3bfddfeb4aa6a4e4727cf80740686c518b6

SHA512
5e095590fa6b048d7abd51945ce42b6045ddb7103c5c2d0e1756d75c1318c47ae651395aa1d30c0421e31fa9b529e8fdc70d5614340a8dfab2dbd6f09558a22a

Download Submit
\Windows\SysWOW64\netupdsrv.exe
Filesize
158KB

MD5
a9c51ba68503839e795bc215cc95e62e

SHA1
26658c2ad2591e6d4748e1e61cfa2b3cbbfc23c2

SHA256
44b40532f2d3c287c83d27d05a2557a0624b80d05286bcf97d2c729da0c000ab

SHA512
176c79af15c42f776ba364ccb9fbdc80e8982155dc95a078e473bd5e43c682594686347ec86864bae28688f7ba3fb89c9cfeb4103a0bd26dee6f2dd75f09e780

Download Submit
memory/668-64-0x0000000000000000-mapping.dmp

Download
memory/752-61-0x0000000000000000-mapping.dmp

Download
memory/780-87-0x0000000000000000-mapping.dmp

Download
memory/848-88-0x0000000000000000-mapping.dmp

Download
memory/872-62-0x0000000000000000-mapping.dmp

Download
memory/1000-59-0x0000000000000000-mapping.dmp

Download
memory/1552-69-0x0000000000360000-0x00000000007BE000-memory.dmp

Filesize
4.4MB

Download
memory/1552-54-0x0000000075C81000-0x0000000075C83000-memory.dmp

Filesize
8KB

Download
memory/1552-55-0x0000000000360000-0x00000000007BE000-memory.dmp

Filesize
4.4MB

Download
memory/1552-91-0x0000000000360000-0x00000000007BE000-memory.dmp

Filesize
4.4MB

Download
memory/1608-58-0x0000000000000000-mapping.dmp

Download
memory/1664-71-0x0000000000000000-mapping.dmp

Download
memory/1736-81-0x0000000000000000-mapping.dmp

Download
memory/1844-82-0x0000000000000000-mapping.dmp

Download
memory/1992-77-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads