caa901081326558e2a7975e0bf0acd9b9c77c746124c626e9d992b8d81740e30

Analysis

max time kernel
41s
max time network
45s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
23-11-2022 10:12

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

caa901081326558e2a7975e0bf0acd9b9c77c746124c626e9d992b8d81740e30.exe
Size

603KB
MD5

b869f26a5a813b514d47c121064d462e
SHA1

1e6b36c1855b386ada407e7744b9750a559233da
SHA256

caa901081326558e2a7975e0bf0acd9b9c77c746124c626e9d992b8d81740e30
SHA512

7aebcc08959b0a1421fb593e6b204266474d298167a0a0bc71a6d81b301bd53116e8759fe4101c6fa6fecd36482b2b6793df96ddc1fef4aaeb60116fcf056bd5
SSDEEP

12288:6Iny5DYTfIgXjF657xv2yoSnD9pkdQTHqpZUHA9LLViQArHBF8:cUTfXZ65t+yo6xFHQesp2FF

Score

8^/10

discovery

Malware Config

Signatures

Drops file in Drivers directory 1 IoCs

Processes:

caa901081326558e2a7975e0bf0acd9b9c77c746124c626e9d992b8d81740e30.exe

description ioc process

File created C:\Windows\system32\drivers\nethfdrv.sys caa901081326558e2a7975e0bf0acd9b9c77c746124c626e9d992b8d81740e30.exe
Executes dropped EXE 5 IoCs

Processes:

installd.exenethtsrv.exenetupdsrv.exenethtsrv.exenetupdsrv.exe

pid process

1796 installd.exe
1560 nethtsrv.exe
1688 netupdsrv.exe
1928 nethtsrv.exe
1704 netupdsrv.exe

description	ioc	process
File created	C:\Windows\system32\drivers\nethfdrv.sys	caa901081326558e2a7975e0bf0acd9b9c77c746124c626e9d992b8d81740e30.exe

pid	process
1796	installd.exe
1560	nethtsrv.exe
1688	netupdsrv.exe
1928	nethtsrv.exe
1704	netupdsrv.exe

Loads dropped DLL 13 IoCs

Processes:

caa901081326558e2a7975e0bf0acd9b9c77c746124c626e9d992b8d81740e30.exeinstalld.exenethtsrv.exenethtsrv.exe

pid	process
2024	caa901081326558e2a7975e0bf0acd9b9c77c746124c626e9d992b8d81740e30.exe
2024	caa901081326558e2a7975e0bf0acd9b9c77c746124c626e9d992b8d81740e30.exe
2024	caa901081326558e2a7975e0bf0acd9b9c77c746124c626e9d992b8d81740e30.exe
2024	caa901081326558e2a7975e0bf0acd9b9c77c746124c626e9d992b8d81740e30.exe
1796	installd.exe
2024	caa901081326558e2a7975e0bf0acd9b9c77c746124c626e9d992b8d81740e30.exe
1560	nethtsrv.exe
1560	nethtsrv.exe
2024	caa901081326558e2a7975e0bf0acd9b9c77c746124c626e9d992b8d81740e30.exe
2024	caa901081326558e2a7975e0bf0acd9b9c77c746124c626e9d992b8d81740e30.exe
1928	nethtsrv.exe
1928	nethtsrv.exe
2024	caa901081326558e2a7975e0bf0acd9b9c77c746124c626e9d992b8d81740e30.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in System32 directory 5 IoCs

Processes:

caa901081326558e2a7975e0bf0acd9b9c77c746124c626e9d992b8d81740e30.exe

description	ioc	process
File created	C:\Windows\SysWOW64\hfnapi.dll	caa901081326558e2a7975e0bf0acd9b9c77c746124c626e9d992b8d81740e30.exe
File created	C:\Windows\SysWOW64\hfpapi.dll	caa901081326558e2a7975e0bf0acd9b9c77c746124c626e9d992b8d81740e30.exe
File created	C:\Windows\SysWOW64\installd.exe	caa901081326558e2a7975e0bf0acd9b9c77c746124c626e9d992b8d81740e30.exe
File created	C:\Windows\SysWOW64\nethtsrv.exe	caa901081326558e2a7975e0bf0acd9b9c77c746124c626e9d992b8d81740e30.exe
File created	C:\Windows\SysWOW64\netupdsrv.exe	caa901081326558e2a7975e0bf0acd9b9c77c746124c626e9d992b8d81740e30.exe

Drops file in Program Files directory 3 IoCs

Processes:

caa901081326558e2a7975e0bf0acd9b9c77c746124c626e9d992b8d81740e30.exe

description	ioc	process
File created	C:\Program Files (x86)\Common Files\Config\data.xml	caa901081326558e2a7975e0bf0acd9b9c77c746124c626e9d992b8d81740e30.exe
File created	C:\Program Files (x86)\Common Files\Config\ver.xml	caa901081326558e2a7975e0bf0acd9b9c77c746124c626e9d992b8d81740e30.exe
File created	C:\Program Files (x86)\Common Files\config\uninstinethnfd.exe	caa901081326558e2a7975e0bf0acd9b9c77c746124c626e9d992b8d81740e30.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Runs net.exe
Suspicious behavior: LoadsDriver 1 IoCs

Processes:

pid process

460
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

nethtsrv.exe

description pid process

Token: SeDebugPrivilege 1928 nethtsrv.exe

pid	process
460

description	pid	process
Token: SeDebugPrivilege	1928	nethtsrv.exe

Suspicious use of WriteProcessMemory 50 IoCs

Processes:

caa901081326558e2a7975e0bf0acd9b9c77c746124c626e9d992b8d81740e30.exenet.exenet.exenet.exenet.exe

description	pid	process	target process
PID 2024 wrote to memory of 1784	2024	caa901081326558e2a7975e0bf0acd9b9c77c746124c626e9d992b8d81740e30.exe	net.exe
PID 2024 wrote to memory of 1784	2024	caa901081326558e2a7975e0bf0acd9b9c77c746124c626e9d992b8d81740e30.exe	net.exe
PID 2024 wrote to memory of 1784	2024	caa901081326558e2a7975e0bf0acd9b9c77c746124c626e9d992b8d81740e30.exe	net.exe
PID 2024 wrote to memory of 1784	2024	caa901081326558e2a7975e0bf0acd9b9c77c746124c626e9d992b8d81740e30.exe	net.exe
PID 1784 wrote to memory of 952	1784	net.exe	net1.exe
PID 1784 wrote to memory of 952	1784	net.exe	net1.exe
PID 1784 wrote to memory of 952	1784	net.exe	net1.exe
PID 1784 wrote to memory of 952	1784	net.exe	net1.exe
PID 2024 wrote to memory of 1644	2024	caa901081326558e2a7975e0bf0acd9b9c77c746124c626e9d992b8d81740e30.exe	net.exe
PID 2024 wrote to memory of 1644	2024	caa901081326558e2a7975e0bf0acd9b9c77c746124c626e9d992b8d81740e30.exe	net.exe
PID 2024 wrote to memory of 1644	2024	caa901081326558e2a7975e0bf0acd9b9c77c746124c626e9d992b8d81740e30.exe	net.exe
PID 2024 wrote to memory of 1644	2024	caa901081326558e2a7975e0bf0acd9b9c77c746124c626e9d992b8d81740e30.exe	net.exe
PID 1644 wrote to memory of 1576	1644	net.exe	net1.exe
PID 1644 wrote to memory of 1576	1644	net.exe	net1.exe
PID 1644 wrote to memory of 1576	1644	net.exe	net1.exe
PID 1644 wrote to memory of 1576	1644	net.exe	net1.exe
PID 2024 wrote to memory of 1796	2024	caa901081326558e2a7975e0bf0acd9b9c77c746124c626e9d992b8d81740e30.exe	installd.exe
PID 2024 wrote to memory of 1796	2024	caa901081326558e2a7975e0bf0acd9b9c77c746124c626e9d992b8d81740e30.exe	installd.exe
PID 2024 wrote to memory of 1796	2024	caa901081326558e2a7975e0bf0acd9b9c77c746124c626e9d992b8d81740e30.exe	installd.exe
PID 2024 wrote to memory of 1796	2024	caa901081326558e2a7975e0bf0acd9b9c77c746124c626e9d992b8d81740e30.exe	installd.exe
PID 2024 wrote to memory of 1796	2024	caa901081326558e2a7975e0bf0acd9b9c77c746124c626e9d992b8d81740e30.exe	installd.exe
PID 2024 wrote to memory of 1796	2024	caa901081326558e2a7975e0bf0acd9b9c77c746124c626e9d992b8d81740e30.exe	installd.exe
PID 2024 wrote to memory of 1796	2024	caa901081326558e2a7975e0bf0acd9b9c77c746124c626e9d992b8d81740e30.exe	installd.exe
PID 2024 wrote to memory of 1560	2024	caa901081326558e2a7975e0bf0acd9b9c77c746124c626e9d992b8d81740e30.exe	nethtsrv.exe
PID 2024 wrote to memory of 1560	2024	caa901081326558e2a7975e0bf0acd9b9c77c746124c626e9d992b8d81740e30.exe	nethtsrv.exe
PID 2024 wrote to memory of 1560	2024	caa901081326558e2a7975e0bf0acd9b9c77c746124c626e9d992b8d81740e30.exe	nethtsrv.exe
PID 2024 wrote to memory of 1560	2024	caa901081326558e2a7975e0bf0acd9b9c77c746124c626e9d992b8d81740e30.exe	nethtsrv.exe
PID 2024 wrote to memory of 1688	2024	caa901081326558e2a7975e0bf0acd9b9c77c746124c626e9d992b8d81740e30.exe	netupdsrv.exe
PID 2024 wrote to memory of 1688	2024	caa901081326558e2a7975e0bf0acd9b9c77c746124c626e9d992b8d81740e30.exe	netupdsrv.exe
PID 2024 wrote to memory of 1688	2024	caa901081326558e2a7975e0bf0acd9b9c77c746124c626e9d992b8d81740e30.exe	netupdsrv.exe
PID 2024 wrote to memory of 1688	2024	caa901081326558e2a7975e0bf0acd9b9c77c746124c626e9d992b8d81740e30.exe	netupdsrv.exe
PID 2024 wrote to memory of 1688	2024	caa901081326558e2a7975e0bf0acd9b9c77c746124c626e9d992b8d81740e30.exe	netupdsrv.exe
PID 2024 wrote to memory of 1688	2024	caa901081326558e2a7975e0bf0acd9b9c77c746124c626e9d992b8d81740e30.exe	netupdsrv.exe
PID 2024 wrote to memory of 1688	2024	caa901081326558e2a7975e0bf0acd9b9c77c746124c626e9d992b8d81740e30.exe	netupdsrv.exe
PID 2024 wrote to memory of 1168	2024	caa901081326558e2a7975e0bf0acd9b9c77c746124c626e9d992b8d81740e30.exe	net.exe
PID 2024 wrote to memory of 1168	2024	caa901081326558e2a7975e0bf0acd9b9c77c746124c626e9d992b8d81740e30.exe	net.exe
PID 2024 wrote to memory of 1168	2024	caa901081326558e2a7975e0bf0acd9b9c77c746124c626e9d992b8d81740e30.exe	net.exe
PID 2024 wrote to memory of 1168	2024	caa901081326558e2a7975e0bf0acd9b9c77c746124c626e9d992b8d81740e30.exe	net.exe
PID 1168 wrote to memory of 1156	1168	net.exe	net1.exe
PID 1168 wrote to memory of 1156	1168	net.exe	net1.exe
PID 1168 wrote to memory of 1156	1168	net.exe	net1.exe
PID 1168 wrote to memory of 1156	1168	net.exe	net1.exe
PID 2024 wrote to memory of 1652	2024	caa901081326558e2a7975e0bf0acd9b9c77c746124c626e9d992b8d81740e30.exe	net.exe
PID 2024 wrote to memory of 1652	2024	caa901081326558e2a7975e0bf0acd9b9c77c746124c626e9d992b8d81740e30.exe	net.exe
PID 2024 wrote to memory of 1652	2024	caa901081326558e2a7975e0bf0acd9b9c77c746124c626e9d992b8d81740e30.exe	net.exe
PID 2024 wrote to memory of 1652	2024	caa901081326558e2a7975e0bf0acd9b9c77c746124c626e9d992b8d81740e30.exe	net.exe
PID 1652 wrote to memory of 1004	1652	net.exe	net1.exe
PID 1652 wrote to memory of 1004	1652	net.exe	net1.exe
PID 1652 wrote to memory of 1004	1652	net.exe	net1.exe
PID 1652 wrote to memory of 1004	1652	net.exe	net1.exe

C:\Users\Admin\AppData\Local\Temp\caa901081326558e2a7975e0bf0acd9b9c77c746124c626e9d992b8d81740e30.exe
"C:\Users\Admin\AppData\Local\Temp\caa901081326558e2a7975e0bf0acd9b9c77c746124c626e9d992b8d81740e30.exe"
1⤵
- Drops file in Drivers directory
- Loads dropped DLL
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:2024

C:\Windows\SysWOW64\net.exe
net stop nethttpservice
2⤵
- Suspicious use of WriteProcessMemory
PID:1784

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop nethttpservice
3⤵
PID:952

C:\Windows\SysWOW64\net.exe
net stop serviceupdater
2⤵
- Suspicious use of WriteProcessMemory
PID:1644

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop serviceupdater
3⤵
PID:1576

C:\Windows\SysWOW64\installd.exe
"C:\Windows\system32\installd.exe" nethfdrv
2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1796

C:\Windows\SysWOW64\nethtsrv.exe
"C:\Windows\system32\nethtsrv.exe" -nfdi
2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1560

C:\Windows\SysWOW64\netupdsrv.exe
"C:\Windows\system32\netupdsrv.exe" -nfdi
2⤵
- Executes dropped EXE
PID:1688

C:\Windows\SysWOW64\net.exe
net start nethttpservice
2⤵
- Suspicious use of WriteProcessMemory
PID:1168

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 start nethttpservice
3⤵
PID:1156

C:\Windows\SysWOW64\net.exe
net start serviceupdater
2⤵
- Suspicious use of WriteProcessMemory
PID:1652

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 start serviceupdater
3⤵
PID:1004

C:\Windows\SysWOW64\nethtsrv.exe
C:\Windows\SysWOW64\nethtsrv.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:1928

C:\Windows\SysWOW64\netupdsrv.exe
C:\Windows\SysWOW64\netupdsrv.exe
1⤵
- Executes dropped EXE
PID:1704

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\hfnapi.dll
Filesize
106KB

MD5
065171536f25cf6a1704e28e83fdeba6

SHA1
9811e8f24b0f6126bcb4efc5992af8adeac5d6ff

SHA256
5dcaabbbd4765af80c7e2ec6dac4da24df68fed71c074b94baff36baa593a9b5

SHA512
a1dbb32026e4dfb4e4d4e42d14634bb4844f826b16284d12ba37f35f818112588e8992577e2ca52b14608ad1d58e9d4bb3b9173e0dc9be7a24711d2bdcd31c26

Download Submit
C:\Windows\SysWOW64\hfpapi.dll
Filesize
244KB

MD5
094fb92c53e144fb0c54a18fcc8d570a

SHA1
62b34a204b7d74e0715e121f1d32e5a22d8bb930

SHA256
cf547f7ad4d48cb4bc17302e34c6d6efadd5acfc99d8bbfa2f6dd6d65911cb81

SHA512
e6f6d61e8a68508b19537c82915a1aa123182824f636615a8a2dc71e2dbc549200dfc461380cd3480289aa3b902686e13192d764ef3f7fc4e496c7dde365cb1c

Download Submit
C:\Windows\SysWOW64\installd.exe
Filesize
108KB

MD5
881b4283170fb7cbc3e3d60960f2bec6

SHA1
1e4d949887ed4438bda52c14fe6101fc37551b2d

SHA256
12a2912b42aac37fea642da790f313f44f30ad2b3c22fc27d7f0e429dde7fd64

SHA512
522e4f88f36be775e6d1627714f46c99871e766f31f5878e015cd7202a08629bba31df7dd4eb401cbe09b6529431add97268a0ba3df21ae64f582e10ea438315

Download Submit
C:\Windows\SysWOW64\nethtsrv.exe
Filesize
176KB

MD5
11a8902f482669ad62b9bb24c2385808

SHA1
756d29fd6d904ac66e0d29604ed8e45eea7fc9fe

SHA256
05976265470ef11ee39bc578a84df717def91af26ebf0abb4ca8e9e27f25d82c

SHA512
4b3cbe2845f4c4aa143b4fea80f266ecc0ea16e7571f9f28245d51a94e0c2383742887500184a46f020d621e249d4ceec06ea165deb44bae633d56de92a5a18e

Download Submit
C:\Windows\SysWOW64\nethtsrv.exe
Filesize
176KB

MD5
11a8902f482669ad62b9bb24c2385808

SHA1
756d29fd6d904ac66e0d29604ed8e45eea7fc9fe

SHA256
05976265470ef11ee39bc578a84df717def91af26ebf0abb4ca8e9e27f25d82c

SHA512
4b3cbe2845f4c4aa143b4fea80f266ecc0ea16e7571f9f28245d51a94e0c2383742887500184a46f020d621e249d4ceec06ea165deb44bae633d56de92a5a18e

Download Submit
C:\Windows\SysWOW64\netupdsrv.exe
Filesize
158KB

MD5
d3a5d15c9fb1d4277c1c188fc26f2ce1

SHA1
f74e6e99c429d476dce470a5c92a216a73778c7e

SHA256
4ca2cb5f09117062f437cd6fa7aadb10ca07d685440fb726fcc913e877d2050f

SHA512
aada7cf4777c3eefd79eacca9a135a8295d26ef01388f05e8dd37d3aac6e3a9786f5f3b895ae1d318fa881cb446cb62a84c4f8d86483a762b4d5cf8cc24c8c17

Download Submit
C:\Windows\SysWOW64\netupdsrv.exe
Filesize
158KB

MD5
d3a5d15c9fb1d4277c1c188fc26f2ce1

SHA1
f74e6e99c429d476dce470a5c92a216a73778c7e

SHA256
4ca2cb5f09117062f437cd6fa7aadb10ca07d685440fb726fcc913e877d2050f

SHA512
aada7cf4777c3eefd79eacca9a135a8295d26ef01388f05e8dd37d3aac6e3a9786f5f3b895ae1d318fa881cb446cb62a84c4f8d86483a762b4d5cf8cc24c8c17

Download Submit
\Users\Admin\AppData\Local\Temp\nsj41B5.tmp\System.dll
Filesize
11KB

MD5
c17103ae9072a06da581dec998343fc1

SHA1
b72148c6bdfaada8b8c3f950e610ee7cf1da1f8d

SHA256
dc58d8ad81cacb0c1ed72e33bff8f23ea40b5252b5bb55d393a0903e6819ae2f

SHA512
d32a71aaef18e993f28096d536e41c4d016850721b31171513ce28bbd805a54fd290b7c3e9d935f72e676a1acfb4f0dcc89d95040a0dd29f2b6975855c18986f

Download Submit
\Users\Admin\AppData\Local\Temp\nsj41B5.tmp\nsExec.dll
Filesize
6KB

MD5
acc2b699edfea5bf5aae45aba3a41e96

SHA1
d2accf4d494e43ceb2cff69abe4dd17147d29cc2

SHA256
168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e

SHA512
e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe

Download Submit
\Users\Admin\AppData\Local\Temp\nsj41B5.tmp\nsExec.dll
Filesize
6KB

MD5
acc2b699edfea5bf5aae45aba3a41e96

SHA1
d2accf4d494e43ceb2cff69abe4dd17147d29cc2

SHA256
168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e

SHA512
e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe

Download Submit
\Users\Admin\AppData\Local\Temp\nsj41B5.tmp\nsExec.dll
Filesize
6KB

MD5
acc2b699edfea5bf5aae45aba3a41e96

SHA1
d2accf4d494e43ceb2cff69abe4dd17147d29cc2

SHA256
168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e

SHA512
e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe

Download Submit
\Users\Admin\AppData\Local\Temp\nsj41B5.tmp\nsExec.dll
Filesize
6KB

MD5
acc2b699edfea5bf5aae45aba3a41e96

SHA1
d2accf4d494e43ceb2cff69abe4dd17147d29cc2

SHA256
168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e

SHA512
e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe

Download Submit
\Windows\SysWOW64\hfnapi.dll
Filesize
106KB

MD5
065171536f25cf6a1704e28e83fdeba6

SHA1
9811e8f24b0f6126bcb4efc5992af8adeac5d6ff

SHA256
5dcaabbbd4765af80c7e2ec6dac4da24df68fed71c074b94baff36baa593a9b5

SHA512
a1dbb32026e4dfb4e4d4e42d14634bb4844f826b16284d12ba37f35f818112588e8992577e2ca52b14608ad1d58e9d4bb3b9173e0dc9be7a24711d2bdcd31c26

Download Submit
\Windows\SysWOW64\hfnapi.dll
Filesize
106KB

MD5
065171536f25cf6a1704e28e83fdeba6

SHA1
9811e8f24b0f6126bcb4efc5992af8adeac5d6ff

SHA256
5dcaabbbd4765af80c7e2ec6dac4da24df68fed71c074b94baff36baa593a9b5

SHA512
a1dbb32026e4dfb4e4d4e42d14634bb4844f826b16284d12ba37f35f818112588e8992577e2ca52b14608ad1d58e9d4bb3b9173e0dc9be7a24711d2bdcd31c26

Download Submit
\Windows\SysWOW64\hfnapi.dll
Filesize
106KB

MD5
065171536f25cf6a1704e28e83fdeba6

SHA1
9811e8f24b0f6126bcb4efc5992af8adeac5d6ff

SHA256
5dcaabbbd4765af80c7e2ec6dac4da24df68fed71c074b94baff36baa593a9b5

SHA512
a1dbb32026e4dfb4e4d4e42d14634bb4844f826b16284d12ba37f35f818112588e8992577e2ca52b14608ad1d58e9d4bb3b9173e0dc9be7a24711d2bdcd31c26

Download Submit
\Windows\SysWOW64\hfpapi.dll
Filesize
244KB

MD5
094fb92c53e144fb0c54a18fcc8d570a

SHA1
62b34a204b7d74e0715e121f1d32e5a22d8bb930

SHA256
cf547f7ad4d48cb4bc17302e34c6d6efadd5acfc99d8bbfa2f6dd6d65911cb81

SHA512
e6f6d61e8a68508b19537c82915a1aa123182824f636615a8a2dc71e2dbc549200dfc461380cd3480289aa3b902686e13192d764ef3f7fc4e496c7dde365cb1c

Download Submit
\Windows\SysWOW64\hfpapi.dll
Filesize
244KB

MD5
094fb92c53e144fb0c54a18fcc8d570a

SHA1
62b34a204b7d74e0715e121f1d32e5a22d8bb930

SHA256
cf547f7ad4d48cb4bc17302e34c6d6efadd5acfc99d8bbfa2f6dd6d65911cb81

SHA512
e6f6d61e8a68508b19537c82915a1aa123182824f636615a8a2dc71e2dbc549200dfc461380cd3480289aa3b902686e13192d764ef3f7fc4e496c7dde365cb1c

Download Submit
\Windows\SysWOW64\installd.exe
Filesize
108KB

MD5
881b4283170fb7cbc3e3d60960f2bec6

SHA1
1e4d949887ed4438bda52c14fe6101fc37551b2d

SHA256
12a2912b42aac37fea642da790f313f44f30ad2b3c22fc27d7f0e429dde7fd64

SHA512
522e4f88f36be775e6d1627714f46c99871e766f31f5878e015cd7202a08629bba31df7dd4eb401cbe09b6529431add97268a0ba3df21ae64f582e10ea438315

Download Submit
\Windows\SysWOW64\nethtsrv.exe
Filesize
176KB

MD5
11a8902f482669ad62b9bb24c2385808

SHA1
756d29fd6d904ac66e0d29604ed8e45eea7fc9fe

SHA256
05976265470ef11ee39bc578a84df717def91af26ebf0abb4ca8e9e27f25d82c

SHA512
4b3cbe2845f4c4aa143b4fea80f266ecc0ea16e7571f9f28245d51a94e0c2383742887500184a46f020d621e249d4ceec06ea165deb44bae633d56de92a5a18e

Download Submit
\Windows\SysWOW64\netupdsrv.exe
Filesize
158KB

MD5
d3a5d15c9fb1d4277c1c188fc26f2ce1

SHA1
f74e6e99c429d476dce470a5c92a216a73778c7e

SHA256
4ca2cb5f09117062f437cd6fa7aadb10ca07d685440fb726fcc913e877d2050f

SHA512
aada7cf4777c3eefd79eacca9a135a8295d26ef01388f05e8dd37d3aac6e3a9786f5f3b895ae1d318fa881cb446cb62a84c4f8d86483a762b4d5cf8cc24c8c17

Download Submit
memory/952-58-0x0000000000000000-mapping.dmp

Download
memory/1004-87-0x0000000000000000-mapping.dmp

Download
memory/1156-81-0x0000000000000000-mapping.dmp

Download
memory/1168-80-0x0000000000000000-mapping.dmp

Download
memory/1560-70-0x0000000000000000-mapping.dmp

Download
memory/1576-61-0x0000000000000000-mapping.dmp

Download
memory/1644-60-0x0000000000000000-mapping.dmp

Download
memory/1652-86-0x0000000000000000-mapping.dmp

Download
memory/1688-76-0x0000000000000000-mapping.dmp

Download
memory/1784-57-0x0000000000000000-mapping.dmp

Download
memory/1796-64-0x0000000000000000-mapping.dmp

Download
memory/2024-54-0x0000000075F81000-0x0000000075F83000-memory.dmp

Filesize
8KB

Download
memory/2024-62-0x0000000000360000-0x00000000007BE000-memory.dmp

Filesize
4.4MB

Download
memory/2024-90-0x0000000000360000-0x00000000007BE000-memory.dmp

Filesize
4.4MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads