c8e77fdda48d3c7eeaf6d3216fe2f6527a783ce313806d06d6ff2a83d1d6f37c

Analysis

max time kernel
42s
max time network
46s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
23-11-2022 10:12

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c8e77fdda48d3c7eeaf6d3216fe2f6527a783ce313806d06d6ff2a83d1d6f37c.exe
Size

602KB
MD5

92a1521e97a1377f10fd4c598b71c04e
SHA1

ac614e6163f40c81694eb385038e7d1d5c5ac0ab
SHA256

c8e77fdda48d3c7eeaf6d3216fe2f6527a783ce313806d06d6ff2a83d1d6f37c
SHA512

498937a748dc5ee3df9a6c054475c58f05f2d581940917edda9b5aa7804dac35f7aea664484befb7fbebf6b63580aac069575fef3443abe49ef41ab68eaa35e5
SSDEEP

12288:iIny5DYTaxoM0vg31y0BFrllwopgAddngWcS974FqGF:EUTa+M0vSQ0Btwu3dZAS92h

Score

8^/10

discovery

Malware Config

Signatures

Drops file in Drivers directory 1 IoCs

Processes:

c8e77fdda48d3c7eeaf6d3216fe2f6527a783ce313806d06d6ff2a83d1d6f37c.exe

description ioc process

File created C:\Windows\system32\drivers\nethfdrv.sys c8e77fdda48d3c7eeaf6d3216fe2f6527a783ce313806d06d6ff2a83d1d6f37c.exe
Executes dropped EXE 5 IoCs

Processes:

installd.exenethtsrv.exenetupdsrv.exenethtsrv.exenetupdsrv.exe

pid process

896 installd.exe
1384 nethtsrv.exe
1112 netupdsrv.exe
544 nethtsrv.exe
1236 netupdsrv.exe

description	ioc	process
File created	C:\Windows\system32\drivers\nethfdrv.sys	c8e77fdda48d3c7eeaf6d3216fe2f6527a783ce313806d06d6ff2a83d1d6f37c.exe

pid	process
896	installd.exe
1384	nethtsrv.exe
1112	netupdsrv.exe
544	nethtsrv.exe
1236	netupdsrv.exe

Loads dropped DLL 13 IoCs

Processes:

c8e77fdda48d3c7eeaf6d3216fe2f6527a783ce313806d06d6ff2a83d1d6f37c.exeinstalld.exenethtsrv.exenethtsrv.exe

pid	process
996	c8e77fdda48d3c7eeaf6d3216fe2f6527a783ce313806d06d6ff2a83d1d6f37c.exe
996	c8e77fdda48d3c7eeaf6d3216fe2f6527a783ce313806d06d6ff2a83d1d6f37c.exe
996	c8e77fdda48d3c7eeaf6d3216fe2f6527a783ce313806d06d6ff2a83d1d6f37c.exe
996	c8e77fdda48d3c7eeaf6d3216fe2f6527a783ce313806d06d6ff2a83d1d6f37c.exe
896	installd.exe
996	c8e77fdda48d3c7eeaf6d3216fe2f6527a783ce313806d06d6ff2a83d1d6f37c.exe
1384	nethtsrv.exe
1384	nethtsrv.exe
996	c8e77fdda48d3c7eeaf6d3216fe2f6527a783ce313806d06d6ff2a83d1d6f37c.exe
996	c8e77fdda48d3c7eeaf6d3216fe2f6527a783ce313806d06d6ff2a83d1d6f37c.exe
544	nethtsrv.exe
544	nethtsrv.exe
996	c8e77fdda48d3c7eeaf6d3216fe2f6527a783ce313806d06d6ff2a83d1d6f37c.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in System32 directory 5 IoCs

Processes:

c8e77fdda48d3c7eeaf6d3216fe2f6527a783ce313806d06d6ff2a83d1d6f37c.exe

description	ioc	process
File created	C:\Windows\SysWOW64\hfnapi.dll	c8e77fdda48d3c7eeaf6d3216fe2f6527a783ce313806d06d6ff2a83d1d6f37c.exe
File created	C:\Windows\SysWOW64\hfpapi.dll	c8e77fdda48d3c7eeaf6d3216fe2f6527a783ce313806d06d6ff2a83d1d6f37c.exe
File created	C:\Windows\SysWOW64\installd.exe	c8e77fdda48d3c7eeaf6d3216fe2f6527a783ce313806d06d6ff2a83d1d6f37c.exe
File created	C:\Windows\SysWOW64\nethtsrv.exe	c8e77fdda48d3c7eeaf6d3216fe2f6527a783ce313806d06d6ff2a83d1d6f37c.exe
File created	C:\Windows\SysWOW64\netupdsrv.exe	c8e77fdda48d3c7eeaf6d3216fe2f6527a783ce313806d06d6ff2a83d1d6f37c.exe

Drops file in Program Files directory 3 IoCs

Processes:

c8e77fdda48d3c7eeaf6d3216fe2f6527a783ce313806d06d6ff2a83d1d6f37c.exe

description	ioc	process
File created	C:\Program Files (x86)\Common Files\Config\data.xml	c8e77fdda48d3c7eeaf6d3216fe2f6527a783ce313806d06d6ff2a83d1d6f37c.exe
File created	C:\Program Files (x86)\Common Files\Config\ver.xml	c8e77fdda48d3c7eeaf6d3216fe2f6527a783ce313806d06d6ff2a83d1d6f37c.exe
File created	C:\Program Files (x86)\Common Files\config\uninstinethnfd.exe	c8e77fdda48d3c7eeaf6d3216fe2f6527a783ce313806d06d6ff2a83d1d6f37c.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Runs net.exe
Suspicious behavior: LoadsDriver 1 IoCs

Processes:

pid process

464
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

nethtsrv.exe

description pid process

Token: SeDebugPrivilege 544 nethtsrv.exe

pid	process
464

description	pid	process
Token: SeDebugPrivilege	544	nethtsrv.exe

Suspicious use of WriteProcessMemory 50 IoCs

Processes:

c8e77fdda48d3c7eeaf6d3216fe2f6527a783ce313806d06d6ff2a83d1d6f37c.exenet.exenet.exenet.exenet.exe

description	pid	process	target process
PID 996 wrote to memory of 1168	996	c8e77fdda48d3c7eeaf6d3216fe2f6527a783ce313806d06d6ff2a83d1d6f37c.exe	net.exe
PID 996 wrote to memory of 1168	996	c8e77fdda48d3c7eeaf6d3216fe2f6527a783ce313806d06d6ff2a83d1d6f37c.exe	net.exe
PID 996 wrote to memory of 1168	996	c8e77fdda48d3c7eeaf6d3216fe2f6527a783ce313806d06d6ff2a83d1d6f37c.exe	net.exe
PID 996 wrote to memory of 1168	996	c8e77fdda48d3c7eeaf6d3216fe2f6527a783ce313806d06d6ff2a83d1d6f37c.exe	net.exe
PID 1168 wrote to memory of 1240	1168	net.exe	net1.exe
PID 1168 wrote to memory of 1240	1168	net.exe	net1.exe
PID 1168 wrote to memory of 1240	1168	net.exe	net1.exe
PID 1168 wrote to memory of 1240	1168	net.exe	net1.exe
PID 996 wrote to memory of 1736	996	c8e77fdda48d3c7eeaf6d3216fe2f6527a783ce313806d06d6ff2a83d1d6f37c.exe	net.exe
PID 996 wrote to memory of 1736	996	c8e77fdda48d3c7eeaf6d3216fe2f6527a783ce313806d06d6ff2a83d1d6f37c.exe	net.exe
PID 996 wrote to memory of 1736	996	c8e77fdda48d3c7eeaf6d3216fe2f6527a783ce313806d06d6ff2a83d1d6f37c.exe	net.exe
PID 996 wrote to memory of 1736	996	c8e77fdda48d3c7eeaf6d3216fe2f6527a783ce313806d06d6ff2a83d1d6f37c.exe	net.exe
PID 1736 wrote to memory of 1200	1736	net.exe	net1.exe
PID 1736 wrote to memory of 1200	1736	net.exe	net1.exe
PID 1736 wrote to memory of 1200	1736	net.exe	net1.exe
PID 1736 wrote to memory of 1200	1736	net.exe	net1.exe
PID 996 wrote to memory of 896	996	c8e77fdda48d3c7eeaf6d3216fe2f6527a783ce313806d06d6ff2a83d1d6f37c.exe	installd.exe
PID 996 wrote to memory of 896	996	c8e77fdda48d3c7eeaf6d3216fe2f6527a783ce313806d06d6ff2a83d1d6f37c.exe	installd.exe
PID 996 wrote to memory of 896	996	c8e77fdda48d3c7eeaf6d3216fe2f6527a783ce313806d06d6ff2a83d1d6f37c.exe	installd.exe
PID 996 wrote to memory of 896	996	c8e77fdda48d3c7eeaf6d3216fe2f6527a783ce313806d06d6ff2a83d1d6f37c.exe	installd.exe
PID 996 wrote to memory of 896	996	c8e77fdda48d3c7eeaf6d3216fe2f6527a783ce313806d06d6ff2a83d1d6f37c.exe	installd.exe
PID 996 wrote to memory of 896	996	c8e77fdda48d3c7eeaf6d3216fe2f6527a783ce313806d06d6ff2a83d1d6f37c.exe	installd.exe
PID 996 wrote to memory of 896	996	c8e77fdda48d3c7eeaf6d3216fe2f6527a783ce313806d06d6ff2a83d1d6f37c.exe	installd.exe
PID 996 wrote to memory of 1384	996	c8e77fdda48d3c7eeaf6d3216fe2f6527a783ce313806d06d6ff2a83d1d6f37c.exe	nethtsrv.exe
PID 996 wrote to memory of 1384	996	c8e77fdda48d3c7eeaf6d3216fe2f6527a783ce313806d06d6ff2a83d1d6f37c.exe	nethtsrv.exe
PID 996 wrote to memory of 1384	996	c8e77fdda48d3c7eeaf6d3216fe2f6527a783ce313806d06d6ff2a83d1d6f37c.exe	nethtsrv.exe
PID 996 wrote to memory of 1384	996	c8e77fdda48d3c7eeaf6d3216fe2f6527a783ce313806d06d6ff2a83d1d6f37c.exe	nethtsrv.exe
PID 996 wrote to memory of 1112	996	c8e77fdda48d3c7eeaf6d3216fe2f6527a783ce313806d06d6ff2a83d1d6f37c.exe	netupdsrv.exe
PID 996 wrote to memory of 1112	996	c8e77fdda48d3c7eeaf6d3216fe2f6527a783ce313806d06d6ff2a83d1d6f37c.exe	netupdsrv.exe
PID 996 wrote to memory of 1112	996	c8e77fdda48d3c7eeaf6d3216fe2f6527a783ce313806d06d6ff2a83d1d6f37c.exe	netupdsrv.exe
PID 996 wrote to memory of 1112	996	c8e77fdda48d3c7eeaf6d3216fe2f6527a783ce313806d06d6ff2a83d1d6f37c.exe	netupdsrv.exe
PID 996 wrote to memory of 1112	996	c8e77fdda48d3c7eeaf6d3216fe2f6527a783ce313806d06d6ff2a83d1d6f37c.exe	netupdsrv.exe
PID 996 wrote to memory of 1112	996	c8e77fdda48d3c7eeaf6d3216fe2f6527a783ce313806d06d6ff2a83d1d6f37c.exe	netupdsrv.exe
PID 996 wrote to memory of 1112	996	c8e77fdda48d3c7eeaf6d3216fe2f6527a783ce313806d06d6ff2a83d1d6f37c.exe	netupdsrv.exe
PID 996 wrote to memory of 332	996	c8e77fdda48d3c7eeaf6d3216fe2f6527a783ce313806d06d6ff2a83d1d6f37c.exe	net.exe
PID 996 wrote to memory of 332	996	c8e77fdda48d3c7eeaf6d3216fe2f6527a783ce313806d06d6ff2a83d1d6f37c.exe	net.exe
PID 996 wrote to memory of 332	996	c8e77fdda48d3c7eeaf6d3216fe2f6527a783ce313806d06d6ff2a83d1d6f37c.exe	net.exe
PID 996 wrote to memory of 332	996	c8e77fdda48d3c7eeaf6d3216fe2f6527a783ce313806d06d6ff2a83d1d6f37c.exe	net.exe
PID 332 wrote to memory of 1988	332	net.exe	net1.exe
PID 332 wrote to memory of 1988	332	net.exe	net1.exe
PID 332 wrote to memory of 1988	332	net.exe	net1.exe
PID 332 wrote to memory of 1988	332	net.exe	net1.exe
PID 996 wrote to memory of 1100	996	c8e77fdda48d3c7eeaf6d3216fe2f6527a783ce313806d06d6ff2a83d1d6f37c.exe	net.exe
PID 996 wrote to memory of 1100	996	c8e77fdda48d3c7eeaf6d3216fe2f6527a783ce313806d06d6ff2a83d1d6f37c.exe	net.exe
PID 996 wrote to memory of 1100	996	c8e77fdda48d3c7eeaf6d3216fe2f6527a783ce313806d06d6ff2a83d1d6f37c.exe	net.exe
PID 996 wrote to memory of 1100	996	c8e77fdda48d3c7eeaf6d3216fe2f6527a783ce313806d06d6ff2a83d1d6f37c.exe	net.exe
PID 1100 wrote to memory of 1064	1100	net.exe	net1.exe
PID 1100 wrote to memory of 1064	1100	net.exe	net1.exe
PID 1100 wrote to memory of 1064	1100	net.exe	net1.exe
PID 1100 wrote to memory of 1064	1100	net.exe	net1.exe

C:\Users\Admin\AppData\Local\Temp\c8e77fdda48d3c7eeaf6d3216fe2f6527a783ce313806d06d6ff2a83d1d6f37c.exe
"C:\Users\Admin\AppData\Local\Temp\c8e77fdda48d3c7eeaf6d3216fe2f6527a783ce313806d06d6ff2a83d1d6f37c.exe"
1⤵
- Drops file in Drivers directory
- Loads dropped DLL
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:996

C:\Windows\SysWOW64\net.exe
net stop nethttpservice
2⤵
- Suspicious use of WriteProcessMemory
PID:1168

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop nethttpservice
3⤵
PID:1240

C:\Windows\SysWOW64\net.exe
net stop serviceupdater
2⤵
- Suspicious use of WriteProcessMemory
PID:1736

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop serviceupdater
3⤵
PID:1200

C:\Windows\SysWOW64\installd.exe
"C:\Windows\system32\installd.exe" nethfdrv
2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:896

C:\Windows\SysWOW64\nethtsrv.exe
"C:\Windows\system32\nethtsrv.exe" -nfdi
2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1384

C:\Windows\SysWOW64\netupdsrv.exe
"C:\Windows\system32\netupdsrv.exe" -nfdi
2⤵
- Executes dropped EXE
PID:1112

C:\Windows\SysWOW64\net.exe
net start nethttpservice
2⤵
- Suspicious use of WriteProcessMemory
PID:332

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 start nethttpservice
3⤵
PID:1988

C:\Windows\SysWOW64\net.exe
net start serviceupdater
2⤵
- Suspicious use of WriteProcessMemory
PID:1100

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 start serviceupdater
3⤵
PID:1064

C:\Windows\SysWOW64\nethtsrv.exe
C:\Windows\SysWOW64\nethtsrv.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:544

C:\Windows\SysWOW64\netupdsrv.exe
C:\Windows\SysWOW64\netupdsrv.exe
1⤵
- Executes dropped EXE
PID:1236

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\hfnapi.dll
Filesize
106KB

MD5
a1d98b5fb74c0be150cc069edd1de063

SHA1
431a302f6cf1a2dcf7ceda5186bcca3cd8578519

SHA256
86f47c532993e3d9fd573be5a3c283d8d7c8fac3a59d10b7c2d1325dc8f372d3

SHA512
f59aba8656a506b52e91073da1b6ab0d1ca36af44aab62718dfb550ca348f5f07534a5e78b3362e6a22ce524e655d2e6d9f5d6f9a53465b18f548d66527803b9

Download Submit
C:\Windows\SysWOW64\hfpapi.dll
Filesize
241KB

MD5
da1e6b60fec2677778cdccd4399c7bf9

SHA1
f703749ea76bd45e91ef27c8fcc060099a9b8326

SHA256
7ae6bdba6e756e1b8b71a1262c79ada9255e7048ebd9377e6eb3d9961df515fb

SHA512
3503022ae7d2b763628fbe783d1642a532c99e4290e85c600c01bb6f2c28e65cc50e5b56c573618753e9416d820d0502410511fb9d569290ff69baf816b0366f

Download Submit
C:\Windows\SysWOW64\installd.exe
Filesize
108KB

MD5
6084b865bcd1f8e93e320d52dd0a26d7

SHA1
40a178c55df82a3f5e97f3b22f79374612ec7451

SHA256
0e69200fb47d4b3519bb65a533124ce4068fa21da32e616597f51088f06c9353

SHA512
7233c91ee75b2dd308c2197033dd4e2807bf8cfd3bd3557e08b0c961bef216de47fa1a2c32f290d01f3e6a8873200bd1c818a25f53d573e6a4fa213ae13b7569

Download Submit
C:\Windows\SysWOW64\nethtsrv.exe
Filesize
176KB

MD5
4791f8db2a53f9ade29bf9b62285ee14

SHA1
26b49ed8deea34e99ada16d860c35a8077b04b8a

SHA256
1523c54dc579b5a0f2071d3a7b3c7c0132084a88772d5c090b1298fb19031f0e

SHA512
8a775c4954d733b5de0f2498f46a0344b88295534ac87d2c9ed1992f18dbeb067760167b8040d2fcccff49c4f49b33857fa7b488b275ddd855f1ba43fe7f6caa

Download Submit
C:\Windows\SysWOW64\nethtsrv.exe
Filesize
176KB

MD5
4791f8db2a53f9ade29bf9b62285ee14

SHA1
26b49ed8deea34e99ada16d860c35a8077b04b8a

SHA256
1523c54dc579b5a0f2071d3a7b3c7c0132084a88772d5c090b1298fb19031f0e

SHA512
8a775c4954d733b5de0f2498f46a0344b88295534ac87d2c9ed1992f18dbeb067760167b8040d2fcccff49c4f49b33857fa7b488b275ddd855f1ba43fe7f6caa

Download Submit
C:\Windows\SysWOW64\netupdsrv.exe
Filesize
158KB

MD5
c13be4b60c64569362c8c619541de24d

SHA1
7dc709c565ca3bdf37ed184b33efa79eee1ae246

SHA256
0ef600cf051f6fad3c71723343b6c6f6903653c76d9d821511eba84d382739fa

SHA512
3a3f2c98649726562a9df3260cfc8344437d03a3d9c2321705aaf1167b7c72170281b8c798ebc2d68d966e9dab77909edb9bfff4b8c5a8503ea3b00b9aa29de1

Download Submit
C:\Windows\SysWOW64\netupdsrv.exe
Filesize
158KB

MD5
c13be4b60c64569362c8c619541de24d

SHA1
7dc709c565ca3bdf37ed184b33efa79eee1ae246

SHA256
0ef600cf051f6fad3c71723343b6c6f6903653c76d9d821511eba84d382739fa

SHA512
3a3f2c98649726562a9df3260cfc8344437d03a3d9c2321705aaf1167b7c72170281b8c798ebc2d68d966e9dab77909edb9bfff4b8c5a8503ea3b00b9aa29de1

Download Submit
\Users\Admin\AppData\Local\Temp\nst5489.tmp\System.dll
Filesize
11KB

MD5
c17103ae9072a06da581dec998343fc1

SHA1
b72148c6bdfaada8b8c3f950e610ee7cf1da1f8d

SHA256
dc58d8ad81cacb0c1ed72e33bff8f23ea40b5252b5bb55d393a0903e6819ae2f

SHA512
d32a71aaef18e993f28096d536e41c4d016850721b31171513ce28bbd805a54fd290b7c3e9d935f72e676a1acfb4f0dcc89d95040a0dd29f2b6975855c18986f

Download Submit
\Users\Admin\AppData\Local\Temp\nst5489.tmp\nsExec.dll
Filesize
6KB

MD5
acc2b699edfea5bf5aae45aba3a41e96

SHA1
d2accf4d494e43ceb2cff69abe4dd17147d29cc2

SHA256
168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e

SHA512
e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe

Download Submit
\Users\Admin\AppData\Local\Temp\nst5489.tmp\nsExec.dll
Filesize
6KB

MD5
acc2b699edfea5bf5aae45aba3a41e96

SHA1
d2accf4d494e43ceb2cff69abe4dd17147d29cc2

SHA256
168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e

SHA512
e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe

Download Submit
\Users\Admin\AppData\Local\Temp\nst5489.tmp\nsExec.dll
Filesize
6KB

MD5
acc2b699edfea5bf5aae45aba3a41e96

SHA1
d2accf4d494e43ceb2cff69abe4dd17147d29cc2

SHA256
168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e

SHA512
e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe

Download Submit
\Users\Admin\AppData\Local\Temp\nst5489.tmp\nsExec.dll
Filesize
6KB

MD5
acc2b699edfea5bf5aae45aba3a41e96

SHA1
d2accf4d494e43ceb2cff69abe4dd17147d29cc2

SHA256
168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e

SHA512
e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe

Download Submit
\Windows\SysWOW64\hfnapi.dll
Filesize
106KB

MD5
a1d98b5fb74c0be150cc069edd1de063

SHA1
431a302f6cf1a2dcf7ceda5186bcca3cd8578519

SHA256
86f47c532993e3d9fd573be5a3c283d8d7c8fac3a59d10b7c2d1325dc8f372d3

SHA512
f59aba8656a506b52e91073da1b6ab0d1ca36af44aab62718dfb550ca348f5f07534a5e78b3362e6a22ce524e655d2e6d9f5d6f9a53465b18f548d66527803b9

Download Submit
\Windows\SysWOW64\hfnapi.dll
Filesize
106KB

MD5
a1d98b5fb74c0be150cc069edd1de063

SHA1
431a302f6cf1a2dcf7ceda5186bcca3cd8578519

SHA256
86f47c532993e3d9fd573be5a3c283d8d7c8fac3a59d10b7c2d1325dc8f372d3

SHA512
f59aba8656a506b52e91073da1b6ab0d1ca36af44aab62718dfb550ca348f5f07534a5e78b3362e6a22ce524e655d2e6d9f5d6f9a53465b18f548d66527803b9

Download Submit
\Windows\SysWOW64\hfnapi.dll
Filesize
106KB

MD5
a1d98b5fb74c0be150cc069edd1de063

SHA1
431a302f6cf1a2dcf7ceda5186bcca3cd8578519

SHA256
86f47c532993e3d9fd573be5a3c283d8d7c8fac3a59d10b7c2d1325dc8f372d3

SHA512
f59aba8656a506b52e91073da1b6ab0d1ca36af44aab62718dfb550ca348f5f07534a5e78b3362e6a22ce524e655d2e6d9f5d6f9a53465b18f548d66527803b9

Download Submit
\Windows\SysWOW64\hfpapi.dll
Filesize
241KB

MD5
da1e6b60fec2677778cdccd4399c7bf9

SHA1
f703749ea76bd45e91ef27c8fcc060099a9b8326

SHA256
7ae6bdba6e756e1b8b71a1262c79ada9255e7048ebd9377e6eb3d9961df515fb

SHA512
3503022ae7d2b763628fbe783d1642a532c99e4290e85c600c01bb6f2c28e65cc50e5b56c573618753e9416d820d0502410511fb9d569290ff69baf816b0366f

Download Submit
\Windows\SysWOW64\hfpapi.dll
Filesize
241KB

MD5
da1e6b60fec2677778cdccd4399c7bf9

SHA1
f703749ea76bd45e91ef27c8fcc060099a9b8326

SHA256
7ae6bdba6e756e1b8b71a1262c79ada9255e7048ebd9377e6eb3d9961df515fb

SHA512
3503022ae7d2b763628fbe783d1642a532c99e4290e85c600c01bb6f2c28e65cc50e5b56c573618753e9416d820d0502410511fb9d569290ff69baf816b0366f

Download Submit
\Windows\SysWOW64\installd.exe
Filesize
108KB

MD5
6084b865bcd1f8e93e320d52dd0a26d7

SHA1
40a178c55df82a3f5e97f3b22f79374612ec7451

SHA256
0e69200fb47d4b3519bb65a533124ce4068fa21da32e616597f51088f06c9353

SHA512
7233c91ee75b2dd308c2197033dd4e2807bf8cfd3bd3557e08b0c961bef216de47fa1a2c32f290d01f3e6a8873200bd1c818a25f53d573e6a4fa213ae13b7569

Download Submit
\Windows\SysWOW64\nethtsrv.exe
Filesize
176KB

MD5
4791f8db2a53f9ade29bf9b62285ee14

SHA1
26b49ed8deea34e99ada16d860c35a8077b04b8a

SHA256
1523c54dc579b5a0f2071d3a7b3c7c0132084a88772d5c090b1298fb19031f0e

SHA512
8a775c4954d733b5de0f2498f46a0344b88295534ac87d2c9ed1992f18dbeb067760167b8040d2fcccff49c4f49b33857fa7b488b275ddd855f1ba43fe7f6caa

Download Submit
\Windows\SysWOW64\netupdsrv.exe
Filesize
158KB

MD5
c13be4b60c64569362c8c619541de24d

SHA1
7dc709c565ca3bdf37ed184b33efa79eee1ae246

SHA256
0ef600cf051f6fad3c71723343b6c6f6903653c76d9d821511eba84d382739fa

SHA512
3a3f2c98649726562a9df3260cfc8344437d03a3d9c2321705aaf1167b7c72170281b8c798ebc2d68d966e9dab77909edb9bfff4b8c5a8503ea3b00b9aa29de1

Download Submit
memory/332-80-0x0000000000000000-mapping.dmp

Download
memory/896-64-0x0000000000000000-mapping.dmp

Download
memory/996-62-0x0000000000360000-0x00000000007BE000-memory.dmp

Filesize
4.4MB

Download
memory/996-90-0x0000000000360000-0x00000000007BE000-memory.dmp

Filesize
4.4MB

Download
memory/996-54-0x0000000075E11000-0x0000000075E13000-memory.dmp

Filesize
8KB

Download
memory/1064-87-0x0000000000000000-mapping.dmp

Download
memory/1100-86-0x0000000000000000-mapping.dmp

Download
memory/1112-76-0x0000000000000000-mapping.dmp

Download
memory/1168-57-0x0000000000000000-mapping.dmp

Download
memory/1200-61-0x0000000000000000-mapping.dmp

Download
memory/1240-58-0x0000000000000000-mapping.dmp

Download
memory/1384-70-0x0000000000000000-mapping.dmp

Download
memory/1736-60-0x0000000000000000-mapping.dmp

Download
memory/1988-81-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads