54abd2edb025be1c6b228fc77651c6f6e0ad3d8a2e5c3ccc79397db454ac3f7d

Analysis

max time kernel
68s
max time network
34s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
23-11-2022 10:56

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

54abd2edb025be1c6b228fc77651c6f6e0ad3d8a2e5c3ccc79397db454ac3f7d.exe
Size

446KB
MD5

c707fea18751581a1dff8663e968811d
SHA1

f5facd607387de51e8a82ea21f33bf58552e55e8
SHA256

54abd2edb025be1c6b228fc77651c6f6e0ad3d8a2e5c3ccc79397db454ac3f7d
SHA512

290ba962c7f460c66baec8759015fee3b0f25c0a09a82e95ddda9a08854227a202f60f7355db4cf8d640870db517b7991a5ee4289d6f8a3f020230664276c318
SSDEEP

12288:Ws7wcCpRPx1glVhHQ6Db/4epsBM7IeFAR9JsvQSKcP:WKwnRPA9Dz4b+8eSRUKA

Score

8^/10

discovery

Malware Config

Signatures

Drops file in Drivers directory 1 IoCs

Processes:

54abd2edb025be1c6b228fc77651c6f6e0ad3d8a2e5c3ccc79397db454ac3f7d.exe

description ioc process

File created C:\Windows\system32\drivers\nethfdrv.sys 54abd2edb025be1c6b228fc77651c6f6e0ad3d8a2e5c3ccc79397db454ac3f7d.exe
Executes dropped EXE 5 IoCs

Processes:

installd.exenethtsrv.exenetupdsrv.exenethtsrv.exenetupdsrv.exe

pid process

1464 installd.exe
1860 nethtsrv.exe
272 netupdsrv.exe
968 nethtsrv.exe
1292 netupdsrv.exe

description	ioc	process
File created	C:\Windows\system32\drivers\nethfdrv.sys	54abd2edb025be1c6b228fc77651c6f6e0ad3d8a2e5c3ccc79397db454ac3f7d.exe

pid	process
1464	installd.exe
1860	nethtsrv.exe
272	netupdsrv.exe
968	nethtsrv.exe
1292	netupdsrv.exe

Loads dropped DLL 13 IoCs

Processes:

54abd2edb025be1c6b228fc77651c6f6e0ad3d8a2e5c3ccc79397db454ac3f7d.exeinstalld.exenethtsrv.exenethtsrv.exe

pid	process
2044	54abd2edb025be1c6b228fc77651c6f6e0ad3d8a2e5c3ccc79397db454ac3f7d.exe
2044	54abd2edb025be1c6b228fc77651c6f6e0ad3d8a2e5c3ccc79397db454ac3f7d.exe
2044	54abd2edb025be1c6b228fc77651c6f6e0ad3d8a2e5c3ccc79397db454ac3f7d.exe
2044	54abd2edb025be1c6b228fc77651c6f6e0ad3d8a2e5c3ccc79397db454ac3f7d.exe
1464	installd.exe
2044	54abd2edb025be1c6b228fc77651c6f6e0ad3d8a2e5c3ccc79397db454ac3f7d.exe
1860	nethtsrv.exe
1860	nethtsrv.exe
2044	54abd2edb025be1c6b228fc77651c6f6e0ad3d8a2e5c3ccc79397db454ac3f7d.exe
2044	54abd2edb025be1c6b228fc77651c6f6e0ad3d8a2e5c3ccc79397db454ac3f7d.exe
968	nethtsrv.exe
968	nethtsrv.exe
2044	54abd2edb025be1c6b228fc77651c6f6e0ad3d8a2e5c3ccc79397db454ac3f7d.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in System32 directory 5 IoCs

Processes:

54abd2edb025be1c6b228fc77651c6f6e0ad3d8a2e5c3ccc79397db454ac3f7d.exe

description	ioc	process
File created	C:\Windows\SysWOW64\hfnapi.dll	54abd2edb025be1c6b228fc77651c6f6e0ad3d8a2e5c3ccc79397db454ac3f7d.exe
File created	C:\Windows\SysWOW64\hfpapi.dll	54abd2edb025be1c6b228fc77651c6f6e0ad3d8a2e5c3ccc79397db454ac3f7d.exe
File created	C:\Windows\SysWOW64\installd.exe	54abd2edb025be1c6b228fc77651c6f6e0ad3d8a2e5c3ccc79397db454ac3f7d.exe
File created	C:\Windows\SysWOW64\nethtsrv.exe	54abd2edb025be1c6b228fc77651c6f6e0ad3d8a2e5c3ccc79397db454ac3f7d.exe
File created	C:\Windows\SysWOW64\netupdsrv.exe	54abd2edb025be1c6b228fc77651c6f6e0ad3d8a2e5c3ccc79397db454ac3f7d.exe

Drops file in Program Files directory 3 IoCs

Processes:

54abd2edb025be1c6b228fc77651c6f6e0ad3d8a2e5c3ccc79397db454ac3f7d.exe

description	ioc	process
File created	C:\Program Files (x86)\Common Files\Config\data.xml	54abd2edb025be1c6b228fc77651c6f6e0ad3d8a2e5c3ccc79397db454ac3f7d.exe
File created	C:\Program Files (x86)\Common Files\Config\ver.xml	54abd2edb025be1c6b228fc77651c6f6e0ad3d8a2e5c3ccc79397db454ac3f7d.exe
File created	C:\Program Files (x86)\Common Files\config\uninstinethnfd.exe	54abd2edb025be1c6b228fc77651c6f6e0ad3d8a2e5c3ccc79397db454ac3f7d.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Runs net.exe
Suspicious behavior: LoadsDriver 1 IoCs

Processes:

pid process

464
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

nethtsrv.exe

description pid process

Token: SeDebugPrivilege 968 nethtsrv.exe

pid	process
464

description	pid	process
Token: SeDebugPrivilege	968	nethtsrv.exe

Suspicious use of WriteProcessMemory 50 IoCs

Processes:

54abd2edb025be1c6b228fc77651c6f6e0ad3d8a2e5c3ccc79397db454ac3f7d.exenet.exenet.exenet.exenet.exe

description	pid	process	target process
PID 2044 wrote to memory of 1564	2044	54abd2edb025be1c6b228fc77651c6f6e0ad3d8a2e5c3ccc79397db454ac3f7d.exe	net.exe
PID 2044 wrote to memory of 1564	2044	54abd2edb025be1c6b228fc77651c6f6e0ad3d8a2e5c3ccc79397db454ac3f7d.exe	net.exe
PID 2044 wrote to memory of 1564	2044	54abd2edb025be1c6b228fc77651c6f6e0ad3d8a2e5c3ccc79397db454ac3f7d.exe	net.exe
PID 2044 wrote to memory of 1564	2044	54abd2edb025be1c6b228fc77651c6f6e0ad3d8a2e5c3ccc79397db454ac3f7d.exe	net.exe
PID 1564 wrote to memory of 688	1564	net.exe	net1.exe
PID 1564 wrote to memory of 688	1564	net.exe	net1.exe
PID 1564 wrote to memory of 688	1564	net.exe	net1.exe
PID 1564 wrote to memory of 688	1564	net.exe	net1.exe
PID 2044 wrote to memory of 776	2044	54abd2edb025be1c6b228fc77651c6f6e0ad3d8a2e5c3ccc79397db454ac3f7d.exe	net.exe
PID 2044 wrote to memory of 776	2044	54abd2edb025be1c6b228fc77651c6f6e0ad3d8a2e5c3ccc79397db454ac3f7d.exe	net.exe
PID 2044 wrote to memory of 776	2044	54abd2edb025be1c6b228fc77651c6f6e0ad3d8a2e5c3ccc79397db454ac3f7d.exe	net.exe
PID 2044 wrote to memory of 776	2044	54abd2edb025be1c6b228fc77651c6f6e0ad3d8a2e5c3ccc79397db454ac3f7d.exe	net.exe
PID 776 wrote to memory of 472	776	net.exe	net1.exe
PID 776 wrote to memory of 472	776	net.exe	net1.exe
PID 776 wrote to memory of 472	776	net.exe	net1.exe
PID 776 wrote to memory of 472	776	net.exe	net1.exe
PID 2044 wrote to memory of 1464	2044	54abd2edb025be1c6b228fc77651c6f6e0ad3d8a2e5c3ccc79397db454ac3f7d.exe	installd.exe
PID 2044 wrote to memory of 1464	2044	54abd2edb025be1c6b228fc77651c6f6e0ad3d8a2e5c3ccc79397db454ac3f7d.exe	installd.exe
PID 2044 wrote to memory of 1464	2044	54abd2edb025be1c6b228fc77651c6f6e0ad3d8a2e5c3ccc79397db454ac3f7d.exe	installd.exe
PID 2044 wrote to memory of 1464	2044	54abd2edb025be1c6b228fc77651c6f6e0ad3d8a2e5c3ccc79397db454ac3f7d.exe	installd.exe
PID 2044 wrote to memory of 1464	2044	54abd2edb025be1c6b228fc77651c6f6e0ad3d8a2e5c3ccc79397db454ac3f7d.exe	installd.exe
PID 2044 wrote to memory of 1464	2044	54abd2edb025be1c6b228fc77651c6f6e0ad3d8a2e5c3ccc79397db454ac3f7d.exe	installd.exe
PID 2044 wrote to memory of 1464	2044	54abd2edb025be1c6b228fc77651c6f6e0ad3d8a2e5c3ccc79397db454ac3f7d.exe	installd.exe
PID 2044 wrote to memory of 1860	2044	54abd2edb025be1c6b228fc77651c6f6e0ad3d8a2e5c3ccc79397db454ac3f7d.exe	nethtsrv.exe
PID 2044 wrote to memory of 1860	2044	54abd2edb025be1c6b228fc77651c6f6e0ad3d8a2e5c3ccc79397db454ac3f7d.exe	nethtsrv.exe
PID 2044 wrote to memory of 1860	2044	54abd2edb025be1c6b228fc77651c6f6e0ad3d8a2e5c3ccc79397db454ac3f7d.exe	nethtsrv.exe
PID 2044 wrote to memory of 1860	2044	54abd2edb025be1c6b228fc77651c6f6e0ad3d8a2e5c3ccc79397db454ac3f7d.exe	nethtsrv.exe
PID 2044 wrote to memory of 272	2044	54abd2edb025be1c6b228fc77651c6f6e0ad3d8a2e5c3ccc79397db454ac3f7d.exe	netupdsrv.exe
PID 2044 wrote to memory of 272	2044	54abd2edb025be1c6b228fc77651c6f6e0ad3d8a2e5c3ccc79397db454ac3f7d.exe	netupdsrv.exe
PID 2044 wrote to memory of 272	2044	54abd2edb025be1c6b228fc77651c6f6e0ad3d8a2e5c3ccc79397db454ac3f7d.exe	netupdsrv.exe
PID 2044 wrote to memory of 272	2044	54abd2edb025be1c6b228fc77651c6f6e0ad3d8a2e5c3ccc79397db454ac3f7d.exe	netupdsrv.exe
PID 2044 wrote to memory of 272	2044	54abd2edb025be1c6b228fc77651c6f6e0ad3d8a2e5c3ccc79397db454ac3f7d.exe	netupdsrv.exe
PID 2044 wrote to memory of 272	2044	54abd2edb025be1c6b228fc77651c6f6e0ad3d8a2e5c3ccc79397db454ac3f7d.exe	netupdsrv.exe
PID 2044 wrote to memory of 272	2044	54abd2edb025be1c6b228fc77651c6f6e0ad3d8a2e5c3ccc79397db454ac3f7d.exe	netupdsrv.exe
PID 2044 wrote to memory of 904	2044	54abd2edb025be1c6b228fc77651c6f6e0ad3d8a2e5c3ccc79397db454ac3f7d.exe	net.exe
PID 2044 wrote to memory of 904	2044	54abd2edb025be1c6b228fc77651c6f6e0ad3d8a2e5c3ccc79397db454ac3f7d.exe	net.exe
PID 2044 wrote to memory of 904	2044	54abd2edb025be1c6b228fc77651c6f6e0ad3d8a2e5c3ccc79397db454ac3f7d.exe	net.exe
PID 2044 wrote to memory of 904	2044	54abd2edb025be1c6b228fc77651c6f6e0ad3d8a2e5c3ccc79397db454ac3f7d.exe	net.exe
PID 904 wrote to memory of 924	904	net.exe	net1.exe
PID 904 wrote to memory of 924	904	net.exe	net1.exe
PID 904 wrote to memory of 924	904	net.exe	net1.exe
PID 904 wrote to memory of 924	904	net.exe	net1.exe
PID 2044 wrote to memory of 1728	2044	54abd2edb025be1c6b228fc77651c6f6e0ad3d8a2e5c3ccc79397db454ac3f7d.exe	net.exe
PID 2044 wrote to memory of 1728	2044	54abd2edb025be1c6b228fc77651c6f6e0ad3d8a2e5c3ccc79397db454ac3f7d.exe	net.exe
PID 2044 wrote to memory of 1728	2044	54abd2edb025be1c6b228fc77651c6f6e0ad3d8a2e5c3ccc79397db454ac3f7d.exe	net.exe
PID 2044 wrote to memory of 1728	2044	54abd2edb025be1c6b228fc77651c6f6e0ad3d8a2e5c3ccc79397db454ac3f7d.exe	net.exe
PID 1728 wrote to memory of 1264	1728	net.exe	net1.exe
PID 1728 wrote to memory of 1264	1728	net.exe	net1.exe
PID 1728 wrote to memory of 1264	1728	net.exe	net1.exe
PID 1728 wrote to memory of 1264	1728	net.exe	net1.exe

C:\Users\Admin\AppData\Local\Temp\54abd2edb025be1c6b228fc77651c6f6e0ad3d8a2e5c3ccc79397db454ac3f7d.exe
"C:\Users\Admin\AppData\Local\Temp\54abd2edb025be1c6b228fc77651c6f6e0ad3d8a2e5c3ccc79397db454ac3f7d.exe"
1⤵
- Drops file in Drivers directory
- Loads dropped DLL
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:2044

C:\Windows\SysWOW64\net.exe
net stop nethttpservice
2⤵
- Suspicious use of WriteProcessMemory
PID:1564

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop nethttpservice
3⤵
PID:688

C:\Windows\SysWOW64\net.exe
net stop serviceupdater
2⤵
- Suspicious use of WriteProcessMemory
PID:776

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop serviceupdater
3⤵
PID:472

C:\Windows\SysWOW64\installd.exe
"C:\Windows\system32\installd.exe" nethfdrv
2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1464

C:\Windows\SysWOW64\nethtsrv.exe
"C:\Windows\system32\nethtsrv.exe" -nfdi
2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1860

C:\Windows\SysWOW64\netupdsrv.exe
"C:\Windows\system32\netupdsrv.exe" -nfdi
2⤵
- Executes dropped EXE
PID:272

C:\Windows\SysWOW64\net.exe
net start nethttpservice
2⤵
- Suspicious use of WriteProcessMemory
PID:904

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 start nethttpservice
3⤵
PID:924

C:\Windows\SysWOW64\net.exe
net start serviceupdater
2⤵
- Suspicious use of WriteProcessMemory
PID:1728

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 start serviceupdater
3⤵
PID:1264

C:\Windows\SysWOW64\nethtsrv.exe
C:\Windows\SysWOW64\nethtsrv.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:968

C:\Windows\SysWOW64\netupdsrv.exe
C:\Windows\SysWOW64\netupdsrv.exe
1⤵
- Executes dropped EXE
PID:1292

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\hfnapi.dll
Filesize
106KB

MD5
c3e339abd620c9f8608d546184708bf2

SHA1
88d278756a7025dc6ee2e16d18e93b91ac17a52d

SHA256
ae9a2f1b0d1e499d13f0318885a8e658b3ba2eb8fbdcdbe7657542aeb9914270

SHA512
2c1f0d530b2519578165e2707a33c3b0ebcac3376683b78ec88804a777407774351b68bed9fc827d547ac190e2eb38ff062936210b671d38eb7d65cd96fffc65

Download Submit
C:\Windows\SysWOW64\hfpapi.dll
Filesize
244KB

MD5
c0ebdab4439d7b4915afd779e8e1b03f

SHA1
3f58e6bc7f70f97d2c9e4b90d06e67a768aa81aa

SHA256
692cd189548e2c93bc80efa14592aeee584b9b2a37f4a72a811f931152527f33

SHA512
a0b3e29f63dd34aa443be8d325fd9a63d3140b2d1cda1114031946fc2b562effa438ad573212bad6b79b6348087d551faddf3052bc697ba7422a14271b1eace1

Download Submit
C:\Windows\SysWOW64\installd.exe
Filesize
108KB

MD5
80b33fad7a1cef3d3c90c97a15ec3ef2

SHA1
472bd8f37fbba3a72b6f28f64b708f9330ec2e62

SHA256
a1cb293f41fd8b54f0b81c10db470bdffd7e7d0b9ac05440fabaad07722371c8

SHA512
1e78176332702724c0e7413816a9ae4af5a139abb8a2588a915fc036b2e98aec24ba322ff71f8befff22d485eb389c350d3d083a91dc8aad1385e10bd8442400

Download Submit
C:\Windows\SysWOW64\nethtsrv.exe
Filesize
176KB

MD5
094cfa8f2d4be8e365abcd74a1566128

SHA1
50788bfb2f79e9c22d9f0407991c6c627b25013e

SHA256
57b94e7aed8d1ef82ae5562841f55f1d92b16c9774b88fdba47b04e6c1aa1dae

SHA512
2f1a4e9669fe0b473b3b886e3721a372b97e4f48b0b37e58d4a21f83399285c3b1ffc4ec67b361f8d1cd80fd0cb366943f10e95bb3cc7e6472556301d588e021

Download Submit
C:\Windows\SysWOW64\nethtsrv.exe
Filesize
176KB

MD5
094cfa8f2d4be8e365abcd74a1566128

SHA1
50788bfb2f79e9c22d9f0407991c6c627b25013e

SHA256
57b94e7aed8d1ef82ae5562841f55f1d92b16c9774b88fdba47b04e6c1aa1dae

SHA512
2f1a4e9669fe0b473b3b886e3721a372b97e4f48b0b37e58d4a21f83399285c3b1ffc4ec67b361f8d1cd80fd0cb366943f10e95bb3cc7e6472556301d588e021

Download Submit
C:\Windows\SysWOW64\netupdsrv.exe
Filesize
158KB

MD5
34495b52bae8ae9703f60d7e5d176d32

SHA1
34af6197885fda694695d51670ad7c3aafd11edf

SHA256
e886225aea224b66eb1e6f92f64940fa9d6d4d643da2f55a1307b49ee6e69f39

SHA512
dccbbddb98a1efa40b0ad808c069e99efcf33513c2cf18f975ae7a7d2df5a8e0e3c50f8d53e6478de96d17cbc8c014185e8f7e3caff4b0753d9eb4748d200228

Download Submit
C:\Windows\SysWOW64\netupdsrv.exe
Filesize
158KB

MD5
34495b52bae8ae9703f60d7e5d176d32

SHA1
34af6197885fda694695d51670ad7c3aafd11edf

SHA256
e886225aea224b66eb1e6f92f64940fa9d6d4d643da2f55a1307b49ee6e69f39

SHA512
dccbbddb98a1efa40b0ad808c069e99efcf33513c2cf18f975ae7a7d2df5a8e0e3c50f8d53e6478de96d17cbc8c014185e8f7e3caff4b0753d9eb4748d200228

Download Submit
\Users\Admin\AppData\Local\Temp\nsjF48F.tmp\System.dll
Filesize
11KB

MD5
c17103ae9072a06da581dec998343fc1

SHA1
b72148c6bdfaada8b8c3f950e610ee7cf1da1f8d

SHA256
dc58d8ad81cacb0c1ed72e33bff8f23ea40b5252b5bb55d393a0903e6819ae2f

SHA512
d32a71aaef18e993f28096d536e41c4d016850721b31171513ce28bbd805a54fd290b7c3e9d935f72e676a1acfb4f0dcc89d95040a0dd29f2b6975855c18986f

Download Submit
\Users\Admin\AppData\Local\Temp\nsjF48F.tmp\nsExec.dll
Filesize
6KB

MD5
acc2b699edfea5bf5aae45aba3a41e96

SHA1
d2accf4d494e43ceb2cff69abe4dd17147d29cc2

SHA256
168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e

SHA512
e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe

Download Submit
\Users\Admin\AppData\Local\Temp\nsjF48F.tmp\nsExec.dll
Filesize
6KB

MD5
acc2b699edfea5bf5aae45aba3a41e96

SHA1
d2accf4d494e43ceb2cff69abe4dd17147d29cc2

SHA256
168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e

SHA512
e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe

Download Submit
\Users\Admin\AppData\Local\Temp\nsjF48F.tmp\nsExec.dll
Filesize
6KB

MD5
acc2b699edfea5bf5aae45aba3a41e96

SHA1
d2accf4d494e43ceb2cff69abe4dd17147d29cc2

SHA256
168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e

SHA512
e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe

Download Submit
\Users\Admin\AppData\Local\Temp\nsjF48F.tmp\nsExec.dll
Filesize
6KB

MD5
acc2b699edfea5bf5aae45aba3a41e96

SHA1
d2accf4d494e43ceb2cff69abe4dd17147d29cc2

SHA256
168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e

SHA512
e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe

Download Submit
\Windows\SysWOW64\hfnapi.dll
Filesize
106KB

MD5
c3e339abd620c9f8608d546184708bf2

SHA1
88d278756a7025dc6ee2e16d18e93b91ac17a52d

SHA256
ae9a2f1b0d1e499d13f0318885a8e658b3ba2eb8fbdcdbe7657542aeb9914270

SHA512
2c1f0d530b2519578165e2707a33c3b0ebcac3376683b78ec88804a777407774351b68bed9fc827d547ac190e2eb38ff062936210b671d38eb7d65cd96fffc65

Download Submit
\Windows\SysWOW64\hfnapi.dll
Filesize
106KB

MD5
c3e339abd620c9f8608d546184708bf2

SHA1
88d278756a7025dc6ee2e16d18e93b91ac17a52d

SHA256
ae9a2f1b0d1e499d13f0318885a8e658b3ba2eb8fbdcdbe7657542aeb9914270

SHA512
2c1f0d530b2519578165e2707a33c3b0ebcac3376683b78ec88804a777407774351b68bed9fc827d547ac190e2eb38ff062936210b671d38eb7d65cd96fffc65

Download Submit
\Windows\SysWOW64\hfnapi.dll
Filesize
106KB

MD5
c3e339abd620c9f8608d546184708bf2

SHA1
88d278756a7025dc6ee2e16d18e93b91ac17a52d

SHA256
ae9a2f1b0d1e499d13f0318885a8e658b3ba2eb8fbdcdbe7657542aeb9914270

SHA512
2c1f0d530b2519578165e2707a33c3b0ebcac3376683b78ec88804a777407774351b68bed9fc827d547ac190e2eb38ff062936210b671d38eb7d65cd96fffc65

Download Submit
\Windows\SysWOW64\hfpapi.dll
Filesize
244KB

MD5
c0ebdab4439d7b4915afd779e8e1b03f

SHA1
3f58e6bc7f70f97d2c9e4b90d06e67a768aa81aa

SHA256
692cd189548e2c93bc80efa14592aeee584b9b2a37f4a72a811f931152527f33

SHA512
a0b3e29f63dd34aa443be8d325fd9a63d3140b2d1cda1114031946fc2b562effa438ad573212bad6b79b6348087d551faddf3052bc697ba7422a14271b1eace1

Download Submit
\Windows\SysWOW64\hfpapi.dll
Filesize
244KB

MD5
c0ebdab4439d7b4915afd779e8e1b03f

SHA1
3f58e6bc7f70f97d2c9e4b90d06e67a768aa81aa

SHA256
692cd189548e2c93bc80efa14592aeee584b9b2a37f4a72a811f931152527f33

SHA512
a0b3e29f63dd34aa443be8d325fd9a63d3140b2d1cda1114031946fc2b562effa438ad573212bad6b79b6348087d551faddf3052bc697ba7422a14271b1eace1

Download Submit
\Windows\SysWOW64\installd.exe
Filesize
108KB

MD5
80b33fad7a1cef3d3c90c97a15ec3ef2

SHA1
472bd8f37fbba3a72b6f28f64b708f9330ec2e62

SHA256
a1cb293f41fd8b54f0b81c10db470bdffd7e7d0b9ac05440fabaad07722371c8

SHA512
1e78176332702724c0e7413816a9ae4af5a139abb8a2588a915fc036b2e98aec24ba322ff71f8befff22d485eb389c350d3d083a91dc8aad1385e10bd8442400

Download Submit
\Windows\SysWOW64\nethtsrv.exe
Filesize
176KB

MD5
094cfa8f2d4be8e365abcd74a1566128

SHA1
50788bfb2f79e9c22d9f0407991c6c627b25013e

SHA256
57b94e7aed8d1ef82ae5562841f55f1d92b16c9774b88fdba47b04e6c1aa1dae

SHA512
2f1a4e9669fe0b473b3b886e3721a372b97e4f48b0b37e58d4a21f83399285c3b1ffc4ec67b361f8d1cd80fd0cb366943f10e95bb3cc7e6472556301d588e021

Download Submit
\Windows\SysWOW64\netupdsrv.exe
Filesize
158KB

MD5
34495b52bae8ae9703f60d7e5d176d32

SHA1
34af6197885fda694695d51670ad7c3aafd11edf

SHA256
e886225aea224b66eb1e6f92f64940fa9d6d4d643da2f55a1307b49ee6e69f39

SHA512
dccbbddb98a1efa40b0ad808c069e99efcf33513c2cf18f975ae7a7d2df5a8e0e3c50f8d53e6478de96d17cbc8c014185e8f7e3caff4b0753d9eb4748d200228

Download Submit
memory/272-75-0x0000000000000000-mapping.dmp

Download
memory/472-61-0x0000000000000000-mapping.dmp

Download
memory/688-58-0x0000000000000000-mapping.dmp

Download
memory/776-60-0x0000000000000000-mapping.dmp

Download
memory/904-79-0x0000000000000000-mapping.dmp

Download
memory/924-80-0x0000000000000000-mapping.dmp

Download
memory/1264-86-0x0000000000000000-mapping.dmp

Download
memory/1464-63-0x0000000000000000-mapping.dmp

Download
memory/1564-57-0x0000000000000000-mapping.dmp

Download
memory/1728-85-0x0000000000000000-mapping.dmp

Download
memory/1860-69-0x0000000000000000-mapping.dmp

Download
memory/2044-54-0x0000000075E61000-0x0000000075E63000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads