cf23761c00599c73e3f0f24d755f181c22e9c6424dcdb3737b64b5a0911bc270

Analysis

max time kernel
43s
max time network
48s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
23-11-2022 10:11

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

cf23761c00599c73e3f0f24d755f181c22e9c6424dcdb3737b64b5a0911bc270.exe
Size

602KB
MD5

dff4dc95156f7ec606b2c6e00ce5f7bb
SHA1

4691f1ca655f1a5b580005d85d773a0df3ff9a36
SHA256

cf23761c00599c73e3f0f24d755f181c22e9c6424dcdb3737b64b5a0911bc270
SHA512

dca4f229a3a62888e731d9a4ddf7a1f41b01825a5b7975df9f1711b5a342796a0053e10823bc695f0c371ecb17621d7a036558e814682323f7daf9d514a58ee3
SSDEEP

12288:rIny5DYTcI6waRPpzao2ka7O8+GTga6EHNu8/xYznsOdkI:TUTcNvRPpeyWoIztu8/xYznsOd

Score

8^/10

discovery

Malware Config

Signatures

Drops file in Drivers directory 1 IoCs

Processes:

cf23761c00599c73e3f0f24d755f181c22e9c6424dcdb3737b64b5a0911bc270.exe

description ioc process

File created C:\Windows\system32\drivers\nethfdrv.sys cf23761c00599c73e3f0f24d755f181c22e9c6424dcdb3737b64b5a0911bc270.exe
Executes dropped EXE 5 IoCs

Processes:

installd.exenethtsrv.exenetupdsrv.exenethtsrv.exenetupdsrv.exe

pid process

1756 installd.exe
764 nethtsrv.exe
1804 netupdsrv.exe
960 nethtsrv.exe
2040 netupdsrv.exe

description	ioc	process
File created	C:\Windows\system32\drivers\nethfdrv.sys	cf23761c00599c73e3f0f24d755f181c22e9c6424dcdb3737b64b5a0911bc270.exe

pid	process
1756	installd.exe
764	nethtsrv.exe
1804	netupdsrv.exe
960	nethtsrv.exe
2040	netupdsrv.exe

Loads dropped DLL 13 IoCs

Processes:

cf23761c00599c73e3f0f24d755f181c22e9c6424dcdb3737b64b5a0911bc270.exeinstalld.exenethtsrv.exenethtsrv.exe

pid	process
1720	cf23761c00599c73e3f0f24d755f181c22e9c6424dcdb3737b64b5a0911bc270.exe
1720	cf23761c00599c73e3f0f24d755f181c22e9c6424dcdb3737b64b5a0911bc270.exe
1720	cf23761c00599c73e3f0f24d755f181c22e9c6424dcdb3737b64b5a0911bc270.exe
1720	cf23761c00599c73e3f0f24d755f181c22e9c6424dcdb3737b64b5a0911bc270.exe
1756	installd.exe
1720	cf23761c00599c73e3f0f24d755f181c22e9c6424dcdb3737b64b5a0911bc270.exe
764	nethtsrv.exe
764	nethtsrv.exe
1720	cf23761c00599c73e3f0f24d755f181c22e9c6424dcdb3737b64b5a0911bc270.exe
1720	cf23761c00599c73e3f0f24d755f181c22e9c6424dcdb3737b64b5a0911bc270.exe
960	nethtsrv.exe
960	nethtsrv.exe
1720	cf23761c00599c73e3f0f24d755f181c22e9c6424dcdb3737b64b5a0911bc270.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in System32 directory 5 IoCs

Processes:

cf23761c00599c73e3f0f24d755f181c22e9c6424dcdb3737b64b5a0911bc270.exe

description	ioc	process
File created	C:\Windows\SysWOW64\hfpapi.dll	cf23761c00599c73e3f0f24d755f181c22e9c6424dcdb3737b64b5a0911bc270.exe
File created	C:\Windows\SysWOW64\installd.exe	cf23761c00599c73e3f0f24d755f181c22e9c6424dcdb3737b64b5a0911bc270.exe
File created	C:\Windows\SysWOW64\nethtsrv.exe	cf23761c00599c73e3f0f24d755f181c22e9c6424dcdb3737b64b5a0911bc270.exe
File created	C:\Windows\SysWOW64\netupdsrv.exe	cf23761c00599c73e3f0f24d755f181c22e9c6424dcdb3737b64b5a0911bc270.exe
File created	C:\Windows\SysWOW64\hfnapi.dll	cf23761c00599c73e3f0f24d755f181c22e9c6424dcdb3737b64b5a0911bc270.exe

Drops file in Program Files directory 3 IoCs

Processes:

cf23761c00599c73e3f0f24d755f181c22e9c6424dcdb3737b64b5a0911bc270.exe

description	ioc	process
File created	C:\Program Files (x86)\Common Files\Config\data.xml	cf23761c00599c73e3f0f24d755f181c22e9c6424dcdb3737b64b5a0911bc270.exe
File created	C:\Program Files (x86)\Common Files\Config\ver.xml	cf23761c00599c73e3f0f24d755f181c22e9c6424dcdb3737b64b5a0911bc270.exe
File created	C:\Program Files (x86)\Common Files\config\uninstinethnfd.exe	cf23761c00599c73e3f0f24d755f181c22e9c6424dcdb3737b64b5a0911bc270.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Runs net.exe
Suspicious behavior: LoadsDriver 1 IoCs

Processes:

pid process

472
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

nethtsrv.exe

description pid process

Token: SeDebugPrivilege 960 nethtsrv.exe

pid	process
472

description	pid	process
Token: SeDebugPrivilege	960	nethtsrv.exe

Suspicious use of WriteProcessMemory 50 IoCs

Processes:

cf23761c00599c73e3f0f24d755f181c22e9c6424dcdb3737b64b5a0911bc270.exenet.exenet.exenet.exenet.exe

description	pid	process	target process
PID 1720 wrote to memory of 1640	1720	cf23761c00599c73e3f0f24d755f181c22e9c6424dcdb3737b64b5a0911bc270.exe	net.exe
PID 1720 wrote to memory of 1640	1720	cf23761c00599c73e3f0f24d755f181c22e9c6424dcdb3737b64b5a0911bc270.exe	net.exe
PID 1720 wrote to memory of 1640	1720	cf23761c00599c73e3f0f24d755f181c22e9c6424dcdb3737b64b5a0911bc270.exe	net.exe
PID 1720 wrote to memory of 1640	1720	cf23761c00599c73e3f0f24d755f181c22e9c6424dcdb3737b64b5a0911bc270.exe	net.exe
PID 1640 wrote to memory of 1000	1640	net.exe	net1.exe
PID 1640 wrote to memory of 1000	1640	net.exe	net1.exe
PID 1640 wrote to memory of 1000	1640	net.exe	net1.exe
PID 1640 wrote to memory of 1000	1640	net.exe	net1.exe
PID 1720 wrote to memory of 292	1720	cf23761c00599c73e3f0f24d755f181c22e9c6424dcdb3737b64b5a0911bc270.exe	net.exe
PID 1720 wrote to memory of 292	1720	cf23761c00599c73e3f0f24d755f181c22e9c6424dcdb3737b64b5a0911bc270.exe	net.exe
PID 1720 wrote to memory of 292	1720	cf23761c00599c73e3f0f24d755f181c22e9c6424dcdb3737b64b5a0911bc270.exe	net.exe
PID 1720 wrote to memory of 292	1720	cf23761c00599c73e3f0f24d755f181c22e9c6424dcdb3737b64b5a0911bc270.exe	net.exe
PID 292 wrote to memory of 1044	292	net.exe	net1.exe
PID 292 wrote to memory of 1044	292	net.exe	net1.exe
PID 292 wrote to memory of 1044	292	net.exe	net1.exe
PID 292 wrote to memory of 1044	292	net.exe	net1.exe
PID 1720 wrote to memory of 1756	1720	cf23761c00599c73e3f0f24d755f181c22e9c6424dcdb3737b64b5a0911bc270.exe	installd.exe
PID 1720 wrote to memory of 1756	1720	cf23761c00599c73e3f0f24d755f181c22e9c6424dcdb3737b64b5a0911bc270.exe	installd.exe
PID 1720 wrote to memory of 1756	1720	cf23761c00599c73e3f0f24d755f181c22e9c6424dcdb3737b64b5a0911bc270.exe	installd.exe
PID 1720 wrote to memory of 1756	1720	cf23761c00599c73e3f0f24d755f181c22e9c6424dcdb3737b64b5a0911bc270.exe	installd.exe
PID 1720 wrote to memory of 1756	1720	cf23761c00599c73e3f0f24d755f181c22e9c6424dcdb3737b64b5a0911bc270.exe	installd.exe
PID 1720 wrote to memory of 1756	1720	cf23761c00599c73e3f0f24d755f181c22e9c6424dcdb3737b64b5a0911bc270.exe	installd.exe
PID 1720 wrote to memory of 1756	1720	cf23761c00599c73e3f0f24d755f181c22e9c6424dcdb3737b64b5a0911bc270.exe	installd.exe
PID 1720 wrote to memory of 764	1720	cf23761c00599c73e3f0f24d755f181c22e9c6424dcdb3737b64b5a0911bc270.exe	nethtsrv.exe
PID 1720 wrote to memory of 764	1720	cf23761c00599c73e3f0f24d755f181c22e9c6424dcdb3737b64b5a0911bc270.exe	nethtsrv.exe
PID 1720 wrote to memory of 764	1720	cf23761c00599c73e3f0f24d755f181c22e9c6424dcdb3737b64b5a0911bc270.exe	nethtsrv.exe
PID 1720 wrote to memory of 764	1720	cf23761c00599c73e3f0f24d755f181c22e9c6424dcdb3737b64b5a0911bc270.exe	nethtsrv.exe
PID 1720 wrote to memory of 1804	1720	cf23761c00599c73e3f0f24d755f181c22e9c6424dcdb3737b64b5a0911bc270.exe	netupdsrv.exe
PID 1720 wrote to memory of 1804	1720	cf23761c00599c73e3f0f24d755f181c22e9c6424dcdb3737b64b5a0911bc270.exe	netupdsrv.exe
PID 1720 wrote to memory of 1804	1720	cf23761c00599c73e3f0f24d755f181c22e9c6424dcdb3737b64b5a0911bc270.exe	netupdsrv.exe
PID 1720 wrote to memory of 1804	1720	cf23761c00599c73e3f0f24d755f181c22e9c6424dcdb3737b64b5a0911bc270.exe	netupdsrv.exe
PID 1720 wrote to memory of 1804	1720	cf23761c00599c73e3f0f24d755f181c22e9c6424dcdb3737b64b5a0911bc270.exe	netupdsrv.exe
PID 1720 wrote to memory of 1804	1720	cf23761c00599c73e3f0f24d755f181c22e9c6424dcdb3737b64b5a0911bc270.exe	netupdsrv.exe
PID 1720 wrote to memory of 1804	1720	cf23761c00599c73e3f0f24d755f181c22e9c6424dcdb3737b64b5a0911bc270.exe	netupdsrv.exe
PID 1720 wrote to memory of 1972	1720	cf23761c00599c73e3f0f24d755f181c22e9c6424dcdb3737b64b5a0911bc270.exe	net.exe
PID 1720 wrote to memory of 1972	1720	cf23761c00599c73e3f0f24d755f181c22e9c6424dcdb3737b64b5a0911bc270.exe	net.exe
PID 1720 wrote to memory of 1972	1720	cf23761c00599c73e3f0f24d755f181c22e9c6424dcdb3737b64b5a0911bc270.exe	net.exe
PID 1720 wrote to memory of 1972	1720	cf23761c00599c73e3f0f24d755f181c22e9c6424dcdb3737b64b5a0911bc270.exe	net.exe
PID 1972 wrote to memory of 2024	1972	net.exe	net1.exe
PID 1972 wrote to memory of 2024	1972	net.exe	net1.exe
PID 1972 wrote to memory of 2024	1972	net.exe	net1.exe
PID 1972 wrote to memory of 2024	1972	net.exe	net1.exe
PID 1720 wrote to memory of 1544	1720	cf23761c00599c73e3f0f24d755f181c22e9c6424dcdb3737b64b5a0911bc270.exe	net.exe
PID 1720 wrote to memory of 1544	1720	cf23761c00599c73e3f0f24d755f181c22e9c6424dcdb3737b64b5a0911bc270.exe	net.exe
PID 1720 wrote to memory of 1544	1720	cf23761c00599c73e3f0f24d755f181c22e9c6424dcdb3737b64b5a0911bc270.exe	net.exe
PID 1720 wrote to memory of 1544	1720	cf23761c00599c73e3f0f24d755f181c22e9c6424dcdb3737b64b5a0911bc270.exe	net.exe
PID 1544 wrote to memory of 1108	1544	net.exe	net1.exe
PID 1544 wrote to memory of 1108	1544	net.exe	net1.exe
PID 1544 wrote to memory of 1108	1544	net.exe	net1.exe
PID 1544 wrote to memory of 1108	1544	net.exe	net1.exe

C:\Users\Admin\AppData\Local\Temp\cf23761c00599c73e3f0f24d755f181c22e9c6424dcdb3737b64b5a0911bc270.exe
"C:\Users\Admin\AppData\Local\Temp\cf23761c00599c73e3f0f24d755f181c22e9c6424dcdb3737b64b5a0911bc270.exe"
1⤵
- Drops file in Drivers directory
- Loads dropped DLL
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:1720

C:\Windows\SysWOW64\net.exe
net stop nethttpservice
2⤵
- Suspicious use of WriteProcessMemory
PID:1640

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop nethttpservice
3⤵
PID:1000

C:\Windows\SysWOW64\net.exe
net stop serviceupdater
2⤵
- Suspicious use of WriteProcessMemory
PID:292

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop serviceupdater
3⤵
PID:1044

C:\Windows\SysWOW64\installd.exe
"C:\Windows\system32\installd.exe" nethfdrv
2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1756

C:\Windows\SysWOW64\nethtsrv.exe
"C:\Windows\system32\nethtsrv.exe" -nfdi
2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:764

C:\Windows\SysWOW64\netupdsrv.exe
"C:\Windows\system32\netupdsrv.exe" -nfdi
2⤵
- Executes dropped EXE
PID:1804

C:\Windows\SysWOW64\net.exe
net start nethttpservice
2⤵
- Suspicious use of WriteProcessMemory
PID:1972

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 start nethttpservice
3⤵
PID:2024

C:\Windows\SysWOW64\net.exe
net start serviceupdater
2⤵
- Suspicious use of WriteProcessMemory
PID:1544

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 start serviceupdater
3⤵
PID:1108

C:\Windows\SysWOW64\nethtsrv.exe
C:\Windows\SysWOW64\nethtsrv.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:960

C:\Windows\SysWOW64\netupdsrv.exe
C:\Windows\SysWOW64\netupdsrv.exe
1⤵
- Executes dropped EXE
PID:2040

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\hfnapi.dll
Filesize
106KB

MD5
93e21764429136c65ec090ccf092196a

SHA1
44eb00fc02e17f17e59be6656c43a3ea774f49e0

SHA256
57049136a2ad474e2522939ab3b63b0d63672ab8b29d8e2de67450b69b31906b

SHA512
b1137b98855e74109304dda59543bc746e05e11ea2c507e7b98cb622fc5088e4b4979d07c346d5eaedf908a30885b44f5bbcf40fb9470185c7d95401fcba5a07

Download Submit
C:\Windows\SysWOW64\hfpapi.dll
Filesize
244KB

MD5
5d4ba73d662c14d5cefa7ffd0d2fd63e

SHA1
ff7400a134a040d66cdce5584e0dbb31f61dd233

SHA256
4f998d89fbe446a3d73a44174878046c86faddef2cf3a68430e419654923738c

SHA512
eadc631e5abdf573443bfc90d58baeb77ca02d655b537335145e3708a5749554a4c6a73a3965634546f9b56081674a89c9fa82deb79041e19096c2dd9e93062a

Download Submit
C:\Windows\SysWOW64\installd.exe
Filesize
108KB

MD5
0c1206089a9b43b490346c9a92e53577

SHA1
2184c234caf3884db90764069f098eafc72d9b94

SHA256
1d88f015ef9956e18a751b40494aecb344ca8b5794fd0beba43f7da311295701

SHA512
1cff20b555fa0f04585f13b3aa09f73a95faf0553ea467b3090430464ab2f3ced2519b1ec711c031ec8aabef21f4720eab8a26dd1dd711866dd3c5dfffe429b0

Download Submit
C:\Windows\SysWOW64\nethtsrv.exe
Filesize
176KB

MD5
9e322cc910335aaddf15fd5295aac3f8

SHA1
56f6346b74de0fac6cfd2e8c1acfc1c80c6b5455

SHA256
9fd1e67fddaa7065f313eceddc5e3026d78a98fadd92a0611b1bab994f4ba62e

SHA512
ad8943956ad86b864582968f124b1ede59a8b51ea9fadc30a52b8af33e3124e1ed9de4ff758bef461ef3ef348f7601f88a29d134de97d3b05a4163e43bb1623a

Download Submit
C:\Windows\SysWOW64\nethtsrv.exe
Filesize
176KB

MD5
9e322cc910335aaddf15fd5295aac3f8

SHA1
56f6346b74de0fac6cfd2e8c1acfc1c80c6b5455

SHA256
9fd1e67fddaa7065f313eceddc5e3026d78a98fadd92a0611b1bab994f4ba62e

SHA512
ad8943956ad86b864582968f124b1ede59a8b51ea9fadc30a52b8af33e3124e1ed9de4ff758bef461ef3ef348f7601f88a29d134de97d3b05a4163e43bb1623a

Download Submit
C:\Windows\SysWOW64\netupdsrv.exe
Filesize
159KB

MD5
44e43634913a0909b66f27f3e4036b59

SHA1
7ece6e0f2f5a3e74aaabfc1c584a817adb8cad8f

SHA256
46bd81fa59f7d1dcbd817cf6e137786682d5a362de137360793f1164f96f34b6

SHA512
787b80b1e88985ac95eee00023039e1599afe9336c68714e7b4b6e3d8ad042146ee7b37aecd2b95dbf54cbd6c2a387ae9099e36e8cc6f873014820fbeb350e3e

Download Submit
C:\Windows\SysWOW64\netupdsrv.exe
Filesize
159KB

MD5
44e43634913a0909b66f27f3e4036b59

SHA1
7ece6e0f2f5a3e74aaabfc1c584a817adb8cad8f

SHA256
46bd81fa59f7d1dcbd817cf6e137786682d5a362de137360793f1164f96f34b6

SHA512
787b80b1e88985ac95eee00023039e1599afe9336c68714e7b4b6e3d8ad042146ee7b37aecd2b95dbf54cbd6c2a387ae9099e36e8cc6f873014820fbeb350e3e

Download Submit
\Users\Admin\AppData\Local\Temp\nsy20DC.tmp\System.dll
Filesize
11KB

MD5
c17103ae9072a06da581dec998343fc1

SHA1
b72148c6bdfaada8b8c3f950e610ee7cf1da1f8d

SHA256
dc58d8ad81cacb0c1ed72e33bff8f23ea40b5252b5bb55d393a0903e6819ae2f

SHA512
d32a71aaef18e993f28096d536e41c4d016850721b31171513ce28bbd805a54fd290b7c3e9d935f72e676a1acfb4f0dcc89d95040a0dd29f2b6975855c18986f

Download Submit
\Users\Admin\AppData\Local\Temp\nsy20DC.tmp\nsExec.dll
Filesize
6KB

MD5
acc2b699edfea5bf5aae45aba3a41e96

SHA1
d2accf4d494e43ceb2cff69abe4dd17147d29cc2

SHA256
168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e

SHA512
e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe

Download Submit
\Users\Admin\AppData\Local\Temp\nsy20DC.tmp\nsExec.dll
Filesize
6KB

MD5
acc2b699edfea5bf5aae45aba3a41e96

SHA1
d2accf4d494e43ceb2cff69abe4dd17147d29cc2

SHA256
168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e

SHA512
e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe

Download Submit
\Users\Admin\AppData\Local\Temp\nsy20DC.tmp\nsExec.dll
Filesize
6KB

MD5
acc2b699edfea5bf5aae45aba3a41e96

SHA1
d2accf4d494e43ceb2cff69abe4dd17147d29cc2

SHA256
168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e

SHA512
e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe

Download Submit
\Users\Admin\AppData\Local\Temp\nsy20DC.tmp\nsExec.dll
Filesize
6KB

MD5
acc2b699edfea5bf5aae45aba3a41e96

SHA1
d2accf4d494e43ceb2cff69abe4dd17147d29cc2

SHA256
168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e

SHA512
e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe

Download Submit
\Windows\SysWOW64\hfnapi.dll
Filesize
106KB

MD5
93e21764429136c65ec090ccf092196a

SHA1
44eb00fc02e17f17e59be6656c43a3ea774f49e0

SHA256
57049136a2ad474e2522939ab3b63b0d63672ab8b29d8e2de67450b69b31906b

SHA512
b1137b98855e74109304dda59543bc746e05e11ea2c507e7b98cb622fc5088e4b4979d07c346d5eaedf908a30885b44f5bbcf40fb9470185c7d95401fcba5a07

Download Submit
\Windows\SysWOW64\hfnapi.dll
Filesize
106KB

MD5
93e21764429136c65ec090ccf092196a

SHA1
44eb00fc02e17f17e59be6656c43a3ea774f49e0

SHA256
57049136a2ad474e2522939ab3b63b0d63672ab8b29d8e2de67450b69b31906b

SHA512
b1137b98855e74109304dda59543bc746e05e11ea2c507e7b98cb622fc5088e4b4979d07c346d5eaedf908a30885b44f5bbcf40fb9470185c7d95401fcba5a07

Download Submit
\Windows\SysWOW64\hfnapi.dll
Filesize
106KB

MD5
93e21764429136c65ec090ccf092196a

SHA1
44eb00fc02e17f17e59be6656c43a3ea774f49e0

SHA256
57049136a2ad474e2522939ab3b63b0d63672ab8b29d8e2de67450b69b31906b

SHA512
b1137b98855e74109304dda59543bc746e05e11ea2c507e7b98cb622fc5088e4b4979d07c346d5eaedf908a30885b44f5bbcf40fb9470185c7d95401fcba5a07

Download Submit
\Windows\SysWOW64\hfpapi.dll
Filesize
244KB

MD5
5d4ba73d662c14d5cefa7ffd0d2fd63e

SHA1
ff7400a134a040d66cdce5584e0dbb31f61dd233

SHA256
4f998d89fbe446a3d73a44174878046c86faddef2cf3a68430e419654923738c

SHA512
eadc631e5abdf573443bfc90d58baeb77ca02d655b537335145e3708a5749554a4c6a73a3965634546f9b56081674a89c9fa82deb79041e19096c2dd9e93062a

Download Submit
\Windows\SysWOW64\hfpapi.dll
Filesize
244KB

MD5
5d4ba73d662c14d5cefa7ffd0d2fd63e

SHA1
ff7400a134a040d66cdce5584e0dbb31f61dd233

SHA256
4f998d89fbe446a3d73a44174878046c86faddef2cf3a68430e419654923738c

SHA512
eadc631e5abdf573443bfc90d58baeb77ca02d655b537335145e3708a5749554a4c6a73a3965634546f9b56081674a89c9fa82deb79041e19096c2dd9e93062a

Download Submit
\Windows\SysWOW64\installd.exe
Filesize
108KB

MD5
0c1206089a9b43b490346c9a92e53577

SHA1
2184c234caf3884db90764069f098eafc72d9b94

SHA256
1d88f015ef9956e18a751b40494aecb344ca8b5794fd0beba43f7da311295701

SHA512
1cff20b555fa0f04585f13b3aa09f73a95faf0553ea467b3090430464ab2f3ced2519b1ec711c031ec8aabef21f4720eab8a26dd1dd711866dd3c5dfffe429b0

Download Submit
\Windows\SysWOW64\nethtsrv.exe
Filesize
176KB

MD5
9e322cc910335aaddf15fd5295aac3f8

SHA1
56f6346b74de0fac6cfd2e8c1acfc1c80c6b5455

SHA256
9fd1e67fddaa7065f313eceddc5e3026d78a98fadd92a0611b1bab994f4ba62e

SHA512
ad8943956ad86b864582968f124b1ede59a8b51ea9fadc30a52b8af33e3124e1ed9de4ff758bef461ef3ef348f7601f88a29d134de97d3b05a4163e43bb1623a

Download Submit
\Windows\SysWOW64\netupdsrv.exe
Filesize
159KB

MD5
44e43634913a0909b66f27f3e4036b59

SHA1
7ece6e0f2f5a3e74aaabfc1c584a817adb8cad8f

SHA256
46bd81fa59f7d1dcbd817cf6e137786682d5a362de137360793f1164f96f34b6

SHA512
787b80b1e88985ac95eee00023039e1599afe9336c68714e7b4b6e3d8ad042146ee7b37aecd2b95dbf54cbd6c2a387ae9099e36e8cc6f873014820fbeb350e3e

Download Submit
memory/292-61-0x0000000000000000-mapping.dmp

Download
memory/764-70-0x0000000000000000-mapping.dmp

Download
memory/1000-58-0x0000000000000000-mapping.dmp

Download
memory/1044-62-0x0000000000000000-mapping.dmp

Download
memory/1108-87-0x0000000000000000-mapping.dmp

Download
memory/1544-86-0x0000000000000000-mapping.dmp

Download
memory/1640-57-0x0000000000000000-mapping.dmp

Download
memory/1720-54-0x00000000765B1000-0x00000000765B3000-memory.dmp

Filesize
8KB

Download
memory/1720-59-0x0000000000360000-0x00000000007BE000-memory.dmp

Filesize
4.4MB

Download
memory/1720-90-0x0000000000360000-0x00000000007BE000-memory.dmp

Filesize
4.4MB

Download
memory/1756-64-0x0000000000000000-mapping.dmp

Download
memory/1804-76-0x0000000000000000-mapping.dmp

Download
memory/1972-80-0x0000000000000000-mapping.dmp

Download
memory/2024-81-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads