556b3b9938a5b7ec50ad5b9868e42047d0f29a80a4f21f5d3b29de0429e5d487

Analysis

max time kernel
117s
max time network
31s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
23-11-2022 10:56

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

556b3b9938a5b7ec50ad5b9868e42047d0f29a80a4f21f5d3b29de0429e5d487.exe
Size

446KB
MD5

46c1d9a34a5edc1263f36f0ab4095b9d
SHA1

6115bf04bffe9017005241d71f5d58cad30ed51b
SHA256

556b3b9938a5b7ec50ad5b9868e42047d0f29a80a4f21f5d3b29de0429e5d487
SHA512

e8d57d938a1ff4008e8fb1a01dd94d7e2ff0d4b7059158dfea51190f0b60102c13d24138ad3f6acffa22306b0967594cf60daaa0dfcbdbad35dbb1a5bbad3e38
SSDEEP

12288:5fKzW7QejZA6SSaxs1ZQV4PVYGCmBdOiEJrgB:5fKzmNSRxy0L6OfgB

Score

8^/10

discovery

Malware Config

Signatures

Drops file in Drivers directory 1 IoCs

Processes:

556b3b9938a5b7ec50ad5b9868e42047d0f29a80a4f21f5d3b29de0429e5d487.exe

description ioc process

File created C:\Windows\system32\drivers\nethfdrv.sys 556b3b9938a5b7ec50ad5b9868e42047d0f29a80a4f21f5d3b29de0429e5d487.exe
Executes dropped EXE 5 IoCs

Processes:

installd.exenethtsrv.exenetupdsrv.exenethtsrv.exenetupdsrv.exe

pid process

1488 installd.exe
1604 nethtsrv.exe
1452 netupdsrv.exe
1916 nethtsrv.exe
1356 netupdsrv.exe

description	ioc	process
File created	C:\Windows\system32\drivers\nethfdrv.sys	556b3b9938a5b7ec50ad5b9868e42047d0f29a80a4f21f5d3b29de0429e5d487.exe

pid	process
1488	installd.exe
1604	nethtsrv.exe
1452	netupdsrv.exe
1916	nethtsrv.exe
1356	netupdsrv.exe

Loads dropped DLL 13 IoCs

Processes:

556b3b9938a5b7ec50ad5b9868e42047d0f29a80a4f21f5d3b29de0429e5d487.exeinstalld.exenethtsrv.exenethtsrv.exe

pid	process
692	556b3b9938a5b7ec50ad5b9868e42047d0f29a80a4f21f5d3b29de0429e5d487.exe
692	556b3b9938a5b7ec50ad5b9868e42047d0f29a80a4f21f5d3b29de0429e5d487.exe
692	556b3b9938a5b7ec50ad5b9868e42047d0f29a80a4f21f5d3b29de0429e5d487.exe
692	556b3b9938a5b7ec50ad5b9868e42047d0f29a80a4f21f5d3b29de0429e5d487.exe
1488	installd.exe
692	556b3b9938a5b7ec50ad5b9868e42047d0f29a80a4f21f5d3b29de0429e5d487.exe
1604	nethtsrv.exe
1604	nethtsrv.exe
692	556b3b9938a5b7ec50ad5b9868e42047d0f29a80a4f21f5d3b29de0429e5d487.exe
692	556b3b9938a5b7ec50ad5b9868e42047d0f29a80a4f21f5d3b29de0429e5d487.exe
1916	nethtsrv.exe
1916	nethtsrv.exe
692	556b3b9938a5b7ec50ad5b9868e42047d0f29a80a4f21f5d3b29de0429e5d487.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in System32 directory 5 IoCs

Processes:

556b3b9938a5b7ec50ad5b9868e42047d0f29a80a4f21f5d3b29de0429e5d487.exe

description	ioc	process
File created	C:\Windows\SysWOW64\hfnapi.dll	556b3b9938a5b7ec50ad5b9868e42047d0f29a80a4f21f5d3b29de0429e5d487.exe
File created	C:\Windows\SysWOW64\hfpapi.dll	556b3b9938a5b7ec50ad5b9868e42047d0f29a80a4f21f5d3b29de0429e5d487.exe
File created	C:\Windows\SysWOW64\installd.exe	556b3b9938a5b7ec50ad5b9868e42047d0f29a80a4f21f5d3b29de0429e5d487.exe
File created	C:\Windows\SysWOW64\nethtsrv.exe	556b3b9938a5b7ec50ad5b9868e42047d0f29a80a4f21f5d3b29de0429e5d487.exe
File created	C:\Windows\SysWOW64\netupdsrv.exe	556b3b9938a5b7ec50ad5b9868e42047d0f29a80a4f21f5d3b29de0429e5d487.exe

Drops file in Program Files directory 3 IoCs

Processes:

556b3b9938a5b7ec50ad5b9868e42047d0f29a80a4f21f5d3b29de0429e5d487.exe

description	ioc	process
File created	C:\Program Files (x86)\Common Files\Config\data.xml	556b3b9938a5b7ec50ad5b9868e42047d0f29a80a4f21f5d3b29de0429e5d487.exe
File created	C:\Program Files (x86)\Common Files\Config\ver.xml	556b3b9938a5b7ec50ad5b9868e42047d0f29a80a4f21f5d3b29de0429e5d487.exe
File created	C:\Program Files (x86)\Common Files\config\uninstinethnfd.exe	556b3b9938a5b7ec50ad5b9868e42047d0f29a80a4f21f5d3b29de0429e5d487.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Runs net.exe
Suspicious behavior: LoadsDriver 1 IoCs

Processes:

pid process

464
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

nethtsrv.exe

description pid process

Token: SeDebugPrivilege 1916 nethtsrv.exe

pid	process
464

description	pid	process
Token: SeDebugPrivilege	1916	nethtsrv.exe

Suspicious use of WriteProcessMemory 50 IoCs

Processes:

556b3b9938a5b7ec50ad5b9868e42047d0f29a80a4f21f5d3b29de0429e5d487.exenet.exenet.exenet.exenet.exe

description	pid	process	target process
PID 692 wrote to memory of 1000	692	556b3b9938a5b7ec50ad5b9868e42047d0f29a80a4f21f5d3b29de0429e5d487.exe	net.exe
PID 692 wrote to memory of 1000	692	556b3b9938a5b7ec50ad5b9868e42047d0f29a80a4f21f5d3b29de0429e5d487.exe	net.exe
PID 692 wrote to memory of 1000	692	556b3b9938a5b7ec50ad5b9868e42047d0f29a80a4f21f5d3b29de0429e5d487.exe	net.exe
PID 692 wrote to memory of 1000	692	556b3b9938a5b7ec50ad5b9868e42047d0f29a80a4f21f5d3b29de0429e5d487.exe	net.exe
PID 1000 wrote to memory of 668	1000	net.exe	net1.exe
PID 1000 wrote to memory of 668	1000	net.exe	net1.exe
PID 1000 wrote to memory of 668	1000	net.exe	net1.exe
PID 1000 wrote to memory of 668	1000	net.exe	net1.exe
PID 692 wrote to memory of 1188	692	556b3b9938a5b7ec50ad5b9868e42047d0f29a80a4f21f5d3b29de0429e5d487.exe	net.exe
PID 692 wrote to memory of 1188	692	556b3b9938a5b7ec50ad5b9868e42047d0f29a80a4f21f5d3b29de0429e5d487.exe	net.exe
PID 692 wrote to memory of 1188	692	556b3b9938a5b7ec50ad5b9868e42047d0f29a80a4f21f5d3b29de0429e5d487.exe	net.exe
PID 692 wrote to memory of 1188	692	556b3b9938a5b7ec50ad5b9868e42047d0f29a80a4f21f5d3b29de0429e5d487.exe	net.exe
PID 1188 wrote to memory of 1416	1188	net.exe	net1.exe
PID 1188 wrote to memory of 1416	1188	net.exe	net1.exe
PID 1188 wrote to memory of 1416	1188	net.exe	net1.exe
PID 1188 wrote to memory of 1416	1188	net.exe	net1.exe
PID 692 wrote to memory of 1488	692	556b3b9938a5b7ec50ad5b9868e42047d0f29a80a4f21f5d3b29de0429e5d487.exe	installd.exe
PID 692 wrote to memory of 1488	692	556b3b9938a5b7ec50ad5b9868e42047d0f29a80a4f21f5d3b29de0429e5d487.exe	installd.exe
PID 692 wrote to memory of 1488	692	556b3b9938a5b7ec50ad5b9868e42047d0f29a80a4f21f5d3b29de0429e5d487.exe	installd.exe
PID 692 wrote to memory of 1488	692	556b3b9938a5b7ec50ad5b9868e42047d0f29a80a4f21f5d3b29de0429e5d487.exe	installd.exe
PID 692 wrote to memory of 1488	692	556b3b9938a5b7ec50ad5b9868e42047d0f29a80a4f21f5d3b29de0429e5d487.exe	installd.exe
PID 692 wrote to memory of 1488	692	556b3b9938a5b7ec50ad5b9868e42047d0f29a80a4f21f5d3b29de0429e5d487.exe	installd.exe
PID 692 wrote to memory of 1488	692	556b3b9938a5b7ec50ad5b9868e42047d0f29a80a4f21f5d3b29de0429e5d487.exe	installd.exe
PID 692 wrote to memory of 1604	692	556b3b9938a5b7ec50ad5b9868e42047d0f29a80a4f21f5d3b29de0429e5d487.exe	nethtsrv.exe
PID 692 wrote to memory of 1604	692	556b3b9938a5b7ec50ad5b9868e42047d0f29a80a4f21f5d3b29de0429e5d487.exe	nethtsrv.exe
PID 692 wrote to memory of 1604	692	556b3b9938a5b7ec50ad5b9868e42047d0f29a80a4f21f5d3b29de0429e5d487.exe	nethtsrv.exe
PID 692 wrote to memory of 1604	692	556b3b9938a5b7ec50ad5b9868e42047d0f29a80a4f21f5d3b29de0429e5d487.exe	nethtsrv.exe
PID 692 wrote to memory of 1452	692	556b3b9938a5b7ec50ad5b9868e42047d0f29a80a4f21f5d3b29de0429e5d487.exe	netupdsrv.exe
PID 692 wrote to memory of 1452	692	556b3b9938a5b7ec50ad5b9868e42047d0f29a80a4f21f5d3b29de0429e5d487.exe	netupdsrv.exe
PID 692 wrote to memory of 1452	692	556b3b9938a5b7ec50ad5b9868e42047d0f29a80a4f21f5d3b29de0429e5d487.exe	netupdsrv.exe
PID 692 wrote to memory of 1452	692	556b3b9938a5b7ec50ad5b9868e42047d0f29a80a4f21f5d3b29de0429e5d487.exe	netupdsrv.exe
PID 692 wrote to memory of 1452	692	556b3b9938a5b7ec50ad5b9868e42047d0f29a80a4f21f5d3b29de0429e5d487.exe	netupdsrv.exe
PID 692 wrote to memory of 1452	692	556b3b9938a5b7ec50ad5b9868e42047d0f29a80a4f21f5d3b29de0429e5d487.exe	netupdsrv.exe
PID 692 wrote to memory of 1452	692	556b3b9938a5b7ec50ad5b9868e42047d0f29a80a4f21f5d3b29de0429e5d487.exe	netupdsrv.exe
PID 692 wrote to memory of 796	692	556b3b9938a5b7ec50ad5b9868e42047d0f29a80a4f21f5d3b29de0429e5d487.exe	net.exe
PID 692 wrote to memory of 796	692	556b3b9938a5b7ec50ad5b9868e42047d0f29a80a4f21f5d3b29de0429e5d487.exe	net.exe
PID 692 wrote to memory of 796	692	556b3b9938a5b7ec50ad5b9868e42047d0f29a80a4f21f5d3b29de0429e5d487.exe	net.exe
PID 692 wrote to memory of 796	692	556b3b9938a5b7ec50ad5b9868e42047d0f29a80a4f21f5d3b29de0429e5d487.exe	net.exe
PID 796 wrote to memory of 876	796	net.exe	net1.exe
PID 796 wrote to memory of 876	796	net.exe	net1.exe
PID 796 wrote to memory of 876	796	net.exe	net1.exe
PID 796 wrote to memory of 876	796	net.exe	net1.exe
PID 692 wrote to memory of 632	692	556b3b9938a5b7ec50ad5b9868e42047d0f29a80a4f21f5d3b29de0429e5d487.exe	net.exe
PID 692 wrote to memory of 632	692	556b3b9938a5b7ec50ad5b9868e42047d0f29a80a4f21f5d3b29de0429e5d487.exe	net.exe
PID 692 wrote to memory of 632	692	556b3b9938a5b7ec50ad5b9868e42047d0f29a80a4f21f5d3b29de0429e5d487.exe	net.exe
PID 692 wrote to memory of 632	692	556b3b9938a5b7ec50ad5b9868e42047d0f29a80a4f21f5d3b29de0429e5d487.exe	net.exe
PID 632 wrote to memory of 860	632	net.exe	net1.exe
PID 632 wrote to memory of 860	632	net.exe	net1.exe
PID 632 wrote to memory of 860	632	net.exe	net1.exe
PID 632 wrote to memory of 860	632	net.exe	net1.exe

C:\Users\Admin\AppData\Local\Temp\556b3b9938a5b7ec50ad5b9868e42047d0f29a80a4f21f5d3b29de0429e5d487.exe
"C:\Users\Admin\AppData\Local\Temp\556b3b9938a5b7ec50ad5b9868e42047d0f29a80a4f21f5d3b29de0429e5d487.exe"
1⤵
- Drops file in Drivers directory
- Loads dropped DLL
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:692

C:\Windows\SysWOW64\net.exe
net stop nethttpservice
2⤵
- Suspicious use of WriteProcessMemory
PID:1000

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop nethttpservice
3⤵
PID:668

C:\Windows\SysWOW64\net.exe
net stop serviceupdater
2⤵
- Suspicious use of WriteProcessMemory
PID:1188

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop serviceupdater
3⤵
PID:1416

C:\Windows\SysWOW64\installd.exe
"C:\Windows\system32\installd.exe" nethfdrv
2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1488

C:\Windows\SysWOW64\nethtsrv.exe
"C:\Windows\system32\nethtsrv.exe" -nfdi
2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1604

C:\Windows\SysWOW64\netupdsrv.exe
"C:\Windows\system32\netupdsrv.exe" -nfdi
2⤵
- Executes dropped EXE
PID:1452

C:\Windows\SysWOW64\net.exe
net start nethttpservice
2⤵
- Suspicious use of WriteProcessMemory
PID:796

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 start nethttpservice
3⤵
PID:876

C:\Windows\SysWOW64\net.exe
net start serviceupdater
2⤵
- Suspicious use of WriteProcessMemory
PID:632

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 start serviceupdater
3⤵
PID:860

C:\Windows\SysWOW64\nethtsrv.exe
C:\Windows\SysWOW64\nethtsrv.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:1916

C:\Windows\SysWOW64\netupdsrv.exe
C:\Windows\SysWOW64\netupdsrv.exe
1⤵
- Executes dropped EXE
PID:1356

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\hfnapi.dll
Filesize
106KB

MD5
4fe9e092e152682ab70061186988fcc2

SHA1
36f346866503b9aaf6a22f5074e19fcb7308c9c2

SHA256
0df8cfa3d00bb191a23b628bc057ad8914e365a903e64d83eadb74e3c934819c

SHA512
131678dad59e18614e50ffd56667d2414d6029112a31d33a8c7a55d5fb0d94f803d647db3236439321a0bcde662c0dec9302b010035eb5b0262beda16e6fddca

Download Submit
C:\Windows\SysWOW64\hfpapi.dll
Filesize
241KB

MD5
c885bdbbd58972c476dce31883bf7e98

SHA1
6a7dd682cb8b046a6e383f5faf5102782d0a18fd

SHA256
171660730479df77a4c95634f46ef56185a9361b72dcb420ed1cbd3e8326004c

SHA512
9939299a42d960f4e3029b64146a09aca1d528c0f8503eae38a28e227ab652df849d48a853ca994ada4004d8d32c92bca4b6ab7d7d23d03b2ea718b0692b02b7

Download Submit
C:\Windows\SysWOW64\installd.exe
Filesize
108KB

MD5
2f4cee1c752459af1576ae10447eb025

SHA1
04e3bebe9f19da66014169fef8f28085b8c73ce3

SHA256
6c996f850ec23cf0b69b91c7031610ef5ee9583d215f1dfb2f8bc7f1e7be42a3

SHA512
7ce2cd22fc94604a34781e59b9d7a473379e37ea87962eb112015d65aea0579f9d137723a0d47c2bbb87c3c6e500c8b13baf377e1d6add2f65ad96406efd46a2

Download Submit
C:\Windows\SysWOW64\nethtsrv.exe
Filesize
176KB

MD5
2d87323f78999d61211298f96f61a569

SHA1
0edcc1a51ce77d1522dc2584c05e6dab6dc03e0a

SHA256
a38593bed8eb607cafe835cd34c7b29ec37ea6977cd2ba86852c7ce673166ff2

SHA512
7b8c3f979696567f5ed05562434a9c09d5ebfe69843067046ab5847a3a575ae3f29634b7a8bf7d848d947d2e5b2d295153fd18691b03940871d5576bbeaff094

Download Submit
C:\Windows\SysWOW64\nethtsrv.exe
Filesize
176KB

MD5
2d87323f78999d61211298f96f61a569

SHA1
0edcc1a51ce77d1522dc2584c05e6dab6dc03e0a

SHA256
a38593bed8eb607cafe835cd34c7b29ec37ea6977cd2ba86852c7ce673166ff2

SHA512
7b8c3f979696567f5ed05562434a9c09d5ebfe69843067046ab5847a3a575ae3f29634b7a8bf7d848d947d2e5b2d295153fd18691b03940871d5576bbeaff094

Download Submit
C:\Windows\SysWOW64\netupdsrv.exe
Filesize
158KB

MD5
bc70b7c7c9199ca3034ca06ab8ce6361

SHA1
d606946430b8757816a841cfc30977d442e72d23

SHA256
a044d3796f120492de2fc70e47d203c2f934e6a9959171ec938f3e2f5f7528ed

SHA512
d9d93dd899efa9eadbdaebbfc607b29407392f1e389e8be9a649933c1d1af44d394806236199ca306ee0e3b7a5bfcfc13efb2a79bfc8f04e294cebf9c19966b1

Download Submit
C:\Windows\SysWOW64\netupdsrv.exe
Filesize
158KB

MD5
bc70b7c7c9199ca3034ca06ab8ce6361

SHA1
d606946430b8757816a841cfc30977d442e72d23

SHA256
a044d3796f120492de2fc70e47d203c2f934e6a9959171ec938f3e2f5f7528ed

SHA512
d9d93dd899efa9eadbdaebbfc607b29407392f1e389e8be9a649933c1d1af44d394806236199ca306ee0e3b7a5bfcfc13efb2a79bfc8f04e294cebf9c19966b1

Download Submit
\Users\Admin\AppData\Local\Temp\nst4F3.tmp\System.dll
Filesize
11KB

MD5
c17103ae9072a06da581dec998343fc1

SHA1
b72148c6bdfaada8b8c3f950e610ee7cf1da1f8d

SHA256
dc58d8ad81cacb0c1ed72e33bff8f23ea40b5252b5bb55d393a0903e6819ae2f

SHA512
d32a71aaef18e993f28096d536e41c4d016850721b31171513ce28bbd805a54fd290b7c3e9d935f72e676a1acfb4f0dcc89d95040a0dd29f2b6975855c18986f

Download Submit
\Users\Admin\AppData\Local\Temp\nst4F3.tmp\nsExec.dll
Filesize
6KB

MD5
acc2b699edfea5bf5aae45aba3a41e96

SHA1
d2accf4d494e43ceb2cff69abe4dd17147d29cc2

SHA256
168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e

SHA512
e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe

Download Submit
\Users\Admin\AppData\Local\Temp\nst4F3.tmp\nsExec.dll
Filesize
6KB

MD5
acc2b699edfea5bf5aae45aba3a41e96

SHA1
d2accf4d494e43ceb2cff69abe4dd17147d29cc2

SHA256
168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e

SHA512
e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe

Download Submit
\Users\Admin\AppData\Local\Temp\nst4F3.tmp\nsExec.dll
Filesize
6KB

MD5
acc2b699edfea5bf5aae45aba3a41e96

SHA1
d2accf4d494e43ceb2cff69abe4dd17147d29cc2

SHA256
168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e

SHA512
e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe

Download Submit
\Users\Admin\AppData\Local\Temp\nst4F3.tmp\nsExec.dll
Filesize
6KB

MD5
acc2b699edfea5bf5aae45aba3a41e96

SHA1
d2accf4d494e43ceb2cff69abe4dd17147d29cc2

SHA256
168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e

SHA512
e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe

Download Submit
\Windows\SysWOW64\hfnapi.dll
Filesize
106KB

MD5
4fe9e092e152682ab70061186988fcc2

SHA1
36f346866503b9aaf6a22f5074e19fcb7308c9c2

SHA256
0df8cfa3d00bb191a23b628bc057ad8914e365a903e64d83eadb74e3c934819c

SHA512
131678dad59e18614e50ffd56667d2414d6029112a31d33a8c7a55d5fb0d94f803d647db3236439321a0bcde662c0dec9302b010035eb5b0262beda16e6fddca

Download Submit
\Windows\SysWOW64\hfnapi.dll
Filesize
106KB

MD5
4fe9e092e152682ab70061186988fcc2

SHA1
36f346866503b9aaf6a22f5074e19fcb7308c9c2

SHA256
0df8cfa3d00bb191a23b628bc057ad8914e365a903e64d83eadb74e3c934819c

SHA512
131678dad59e18614e50ffd56667d2414d6029112a31d33a8c7a55d5fb0d94f803d647db3236439321a0bcde662c0dec9302b010035eb5b0262beda16e6fddca

Download Submit
\Windows\SysWOW64\hfnapi.dll
Filesize
106KB

MD5
4fe9e092e152682ab70061186988fcc2

SHA1
36f346866503b9aaf6a22f5074e19fcb7308c9c2

SHA256
0df8cfa3d00bb191a23b628bc057ad8914e365a903e64d83eadb74e3c934819c

SHA512
131678dad59e18614e50ffd56667d2414d6029112a31d33a8c7a55d5fb0d94f803d647db3236439321a0bcde662c0dec9302b010035eb5b0262beda16e6fddca

Download Submit
\Windows\SysWOW64\hfpapi.dll
Filesize
241KB

MD5
c885bdbbd58972c476dce31883bf7e98

SHA1
6a7dd682cb8b046a6e383f5faf5102782d0a18fd

SHA256
171660730479df77a4c95634f46ef56185a9361b72dcb420ed1cbd3e8326004c

SHA512
9939299a42d960f4e3029b64146a09aca1d528c0f8503eae38a28e227ab652df849d48a853ca994ada4004d8d32c92bca4b6ab7d7d23d03b2ea718b0692b02b7

Download Submit
\Windows\SysWOW64\hfpapi.dll
Filesize
241KB

MD5
c885bdbbd58972c476dce31883bf7e98

SHA1
6a7dd682cb8b046a6e383f5faf5102782d0a18fd

SHA256
171660730479df77a4c95634f46ef56185a9361b72dcb420ed1cbd3e8326004c

SHA512
9939299a42d960f4e3029b64146a09aca1d528c0f8503eae38a28e227ab652df849d48a853ca994ada4004d8d32c92bca4b6ab7d7d23d03b2ea718b0692b02b7

Download Submit
\Windows\SysWOW64\installd.exe
Filesize
108KB

MD5
2f4cee1c752459af1576ae10447eb025

SHA1
04e3bebe9f19da66014169fef8f28085b8c73ce3

SHA256
6c996f850ec23cf0b69b91c7031610ef5ee9583d215f1dfb2f8bc7f1e7be42a3

SHA512
7ce2cd22fc94604a34781e59b9d7a473379e37ea87962eb112015d65aea0579f9d137723a0d47c2bbb87c3c6e500c8b13baf377e1d6add2f65ad96406efd46a2

Download Submit
\Windows\SysWOW64\nethtsrv.exe
Filesize
176KB

MD5
2d87323f78999d61211298f96f61a569

SHA1
0edcc1a51ce77d1522dc2584c05e6dab6dc03e0a

SHA256
a38593bed8eb607cafe835cd34c7b29ec37ea6977cd2ba86852c7ce673166ff2

SHA512
7b8c3f979696567f5ed05562434a9c09d5ebfe69843067046ab5847a3a575ae3f29634b7a8bf7d848d947d2e5b2d295153fd18691b03940871d5576bbeaff094

Download Submit
\Windows\SysWOW64\netupdsrv.exe
Filesize
158KB

MD5
bc70b7c7c9199ca3034ca06ab8ce6361

SHA1
d606946430b8757816a841cfc30977d442e72d23

SHA256
a044d3796f120492de2fc70e47d203c2f934e6a9959171ec938f3e2f5f7528ed

SHA512
d9d93dd899efa9eadbdaebbfc607b29407392f1e389e8be9a649933c1d1af44d394806236199ca306ee0e3b7a5bfcfc13efb2a79bfc8f04e294cebf9c19966b1

Download Submit
memory/632-85-0x0000000000000000-mapping.dmp

Download
memory/668-58-0x0000000000000000-mapping.dmp

Download
memory/692-54-0x0000000076691000-0x0000000076693000-memory.dmp

Filesize
8KB

Download
memory/796-79-0x0000000000000000-mapping.dmp

Download
memory/860-86-0x0000000000000000-mapping.dmp

Download
memory/876-80-0x0000000000000000-mapping.dmp

Download
memory/1000-57-0x0000000000000000-mapping.dmp

Download
memory/1188-60-0x0000000000000000-mapping.dmp

Download
memory/1416-61-0x0000000000000000-mapping.dmp

Download
memory/1452-75-0x0000000000000000-mapping.dmp

Download
memory/1488-63-0x0000000000000000-mapping.dmp

Download
memory/1604-69-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads