46ff71f529360dd96a098dc828172e1b72cdfd645ef9eeb5424e7dca1c00baba

Analysis

max time kernel
63s
max time network
34s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
23-11-2022 10:57

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

46ff71f529360dd96a098dc828172e1b72cdfd645ef9eeb5424e7dca1c00baba.exe
Size

446KB
MD5

beaf90e8791f1b4e909b3acd3ba7bd95
SHA1

4205a996ca30c206b20ffddeb463ac686607b143
SHA256

46ff71f529360dd96a098dc828172e1b72cdfd645ef9eeb5424e7dca1c00baba
SHA512

7f795f03a69387df094b3ca9e62c0458b32d719ceb627a4aedca2ab6d5bda00cbcd08e77124f9e7321703738e61b364e7f920269446ccb4c800490790063b4cb
SSDEEP

6144:XzfZ1oqhQ6lXWa/jqbEBfLKWkWHhqq7rNRAeJdhJP0q+CCPyFUu4g8DBm8za/iL0:lJhTujWHoqVRAWHP0F7hDBLa6mt

Score

8^/10

discovery

Malware Config

Signatures

Drops file in Drivers directory 1 IoCs

Processes:

46ff71f529360dd96a098dc828172e1b72cdfd645ef9eeb5424e7dca1c00baba.exe

description ioc process

File created C:\Windows\system32\drivers\nethfdrv.sys 46ff71f529360dd96a098dc828172e1b72cdfd645ef9eeb5424e7dca1c00baba.exe
Executes dropped EXE 5 IoCs

Processes:

installd.exenethtsrv.exenetupdsrv.exenethtsrv.exenetupdsrv.exe

pid process

1944 installd.exe
1008 nethtsrv.exe
1204 netupdsrv.exe
640 nethtsrv.exe
1708 netupdsrv.exe

description	ioc	process
File created	C:\Windows\system32\drivers\nethfdrv.sys	46ff71f529360dd96a098dc828172e1b72cdfd645ef9eeb5424e7dca1c00baba.exe

pid	process
1944	installd.exe
1008	nethtsrv.exe
1204	netupdsrv.exe
640	nethtsrv.exe
1708	netupdsrv.exe

Loads dropped DLL 13 IoCs

Processes:

46ff71f529360dd96a098dc828172e1b72cdfd645ef9eeb5424e7dca1c00baba.exeinstalld.exenethtsrv.exenethtsrv.exe

pid	process
1260	46ff71f529360dd96a098dc828172e1b72cdfd645ef9eeb5424e7dca1c00baba.exe
1260	46ff71f529360dd96a098dc828172e1b72cdfd645ef9eeb5424e7dca1c00baba.exe
1260	46ff71f529360dd96a098dc828172e1b72cdfd645ef9eeb5424e7dca1c00baba.exe
1260	46ff71f529360dd96a098dc828172e1b72cdfd645ef9eeb5424e7dca1c00baba.exe
1944	installd.exe
1260	46ff71f529360dd96a098dc828172e1b72cdfd645ef9eeb5424e7dca1c00baba.exe
1008	nethtsrv.exe
1008	nethtsrv.exe
1260	46ff71f529360dd96a098dc828172e1b72cdfd645ef9eeb5424e7dca1c00baba.exe
1260	46ff71f529360dd96a098dc828172e1b72cdfd645ef9eeb5424e7dca1c00baba.exe
640	nethtsrv.exe
640	nethtsrv.exe
1260	46ff71f529360dd96a098dc828172e1b72cdfd645ef9eeb5424e7dca1c00baba.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in System32 directory 5 IoCs

Processes:

46ff71f529360dd96a098dc828172e1b72cdfd645ef9eeb5424e7dca1c00baba.exe

description	ioc	process
File created	C:\Windows\SysWOW64\hfnapi.dll	46ff71f529360dd96a098dc828172e1b72cdfd645ef9eeb5424e7dca1c00baba.exe
File created	C:\Windows\SysWOW64\hfpapi.dll	46ff71f529360dd96a098dc828172e1b72cdfd645ef9eeb5424e7dca1c00baba.exe
File created	C:\Windows\SysWOW64\installd.exe	46ff71f529360dd96a098dc828172e1b72cdfd645ef9eeb5424e7dca1c00baba.exe
File created	C:\Windows\SysWOW64\nethtsrv.exe	46ff71f529360dd96a098dc828172e1b72cdfd645ef9eeb5424e7dca1c00baba.exe
File created	C:\Windows\SysWOW64\netupdsrv.exe	46ff71f529360dd96a098dc828172e1b72cdfd645ef9eeb5424e7dca1c00baba.exe

Drops file in Program Files directory 3 IoCs

Processes:

46ff71f529360dd96a098dc828172e1b72cdfd645ef9eeb5424e7dca1c00baba.exe

description	ioc	process
File created	C:\Program Files (x86)\Common Files\Config\data.xml	46ff71f529360dd96a098dc828172e1b72cdfd645ef9eeb5424e7dca1c00baba.exe
File created	C:\Program Files (x86)\Common Files\Config\ver.xml	46ff71f529360dd96a098dc828172e1b72cdfd645ef9eeb5424e7dca1c00baba.exe
File created	C:\Program Files (x86)\Common Files\config\uninstinethnfd.exe	46ff71f529360dd96a098dc828172e1b72cdfd645ef9eeb5424e7dca1c00baba.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Runs net.exe
Suspicious behavior: LoadsDriver 1 IoCs

Processes:

pid process

464
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

nethtsrv.exe

description pid process

Token: SeDebugPrivilege 640 nethtsrv.exe

pid	process
464

description	pid	process
Token: SeDebugPrivilege	640	nethtsrv.exe

Suspicious use of WriteProcessMemory 50 IoCs

Processes:

46ff71f529360dd96a098dc828172e1b72cdfd645ef9eeb5424e7dca1c00baba.exenet.exenet.exenet.exenet.exe

description	pid	process	target process
PID 1260 wrote to memory of 872	1260	46ff71f529360dd96a098dc828172e1b72cdfd645ef9eeb5424e7dca1c00baba.exe	net.exe
PID 1260 wrote to memory of 872	1260	46ff71f529360dd96a098dc828172e1b72cdfd645ef9eeb5424e7dca1c00baba.exe	net.exe
PID 1260 wrote to memory of 872	1260	46ff71f529360dd96a098dc828172e1b72cdfd645ef9eeb5424e7dca1c00baba.exe	net.exe
PID 1260 wrote to memory of 872	1260	46ff71f529360dd96a098dc828172e1b72cdfd645ef9eeb5424e7dca1c00baba.exe	net.exe
PID 872 wrote to memory of 584	872	net.exe	net1.exe
PID 872 wrote to memory of 584	872	net.exe	net1.exe
PID 872 wrote to memory of 584	872	net.exe	net1.exe
PID 872 wrote to memory of 584	872	net.exe	net1.exe
PID 1260 wrote to memory of 548	1260	46ff71f529360dd96a098dc828172e1b72cdfd645ef9eeb5424e7dca1c00baba.exe	net.exe
PID 1260 wrote to memory of 548	1260	46ff71f529360dd96a098dc828172e1b72cdfd645ef9eeb5424e7dca1c00baba.exe	net.exe
PID 1260 wrote to memory of 548	1260	46ff71f529360dd96a098dc828172e1b72cdfd645ef9eeb5424e7dca1c00baba.exe	net.exe
PID 1260 wrote to memory of 548	1260	46ff71f529360dd96a098dc828172e1b72cdfd645ef9eeb5424e7dca1c00baba.exe	net.exe
PID 548 wrote to memory of 576	548	net.exe	net1.exe
PID 548 wrote to memory of 576	548	net.exe	net1.exe
PID 548 wrote to memory of 576	548	net.exe	net1.exe
PID 548 wrote to memory of 576	548	net.exe	net1.exe
PID 1260 wrote to memory of 1944	1260	46ff71f529360dd96a098dc828172e1b72cdfd645ef9eeb5424e7dca1c00baba.exe	installd.exe
PID 1260 wrote to memory of 1944	1260	46ff71f529360dd96a098dc828172e1b72cdfd645ef9eeb5424e7dca1c00baba.exe	installd.exe
PID 1260 wrote to memory of 1944	1260	46ff71f529360dd96a098dc828172e1b72cdfd645ef9eeb5424e7dca1c00baba.exe	installd.exe
PID 1260 wrote to memory of 1944	1260	46ff71f529360dd96a098dc828172e1b72cdfd645ef9eeb5424e7dca1c00baba.exe	installd.exe
PID 1260 wrote to memory of 1944	1260	46ff71f529360dd96a098dc828172e1b72cdfd645ef9eeb5424e7dca1c00baba.exe	installd.exe
PID 1260 wrote to memory of 1944	1260	46ff71f529360dd96a098dc828172e1b72cdfd645ef9eeb5424e7dca1c00baba.exe	installd.exe
PID 1260 wrote to memory of 1944	1260	46ff71f529360dd96a098dc828172e1b72cdfd645ef9eeb5424e7dca1c00baba.exe	installd.exe
PID 1260 wrote to memory of 1008	1260	46ff71f529360dd96a098dc828172e1b72cdfd645ef9eeb5424e7dca1c00baba.exe	nethtsrv.exe
PID 1260 wrote to memory of 1008	1260	46ff71f529360dd96a098dc828172e1b72cdfd645ef9eeb5424e7dca1c00baba.exe	nethtsrv.exe
PID 1260 wrote to memory of 1008	1260	46ff71f529360dd96a098dc828172e1b72cdfd645ef9eeb5424e7dca1c00baba.exe	nethtsrv.exe
PID 1260 wrote to memory of 1008	1260	46ff71f529360dd96a098dc828172e1b72cdfd645ef9eeb5424e7dca1c00baba.exe	nethtsrv.exe
PID 1260 wrote to memory of 1204	1260	46ff71f529360dd96a098dc828172e1b72cdfd645ef9eeb5424e7dca1c00baba.exe	netupdsrv.exe
PID 1260 wrote to memory of 1204	1260	46ff71f529360dd96a098dc828172e1b72cdfd645ef9eeb5424e7dca1c00baba.exe	netupdsrv.exe
PID 1260 wrote to memory of 1204	1260	46ff71f529360dd96a098dc828172e1b72cdfd645ef9eeb5424e7dca1c00baba.exe	netupdsrv.exe
PID 1260 wrote to memory of 1204	1260	46ff71f529360dd96a098dc828172e1b72cdfd645ef9eeb5424e7dca1c00baba.exe	netupdsrv.exe
PID 1260 wrote to memory of 1204	1260	46ff71f529360dd96a098dc828172e1b72cdfd645ef9eeb5424e7dca1c00baba.exe	netupdsrv.exe
PID 1260 wrote to memory of 1204	1260	46ff71f529360dd96a098dc828172e1b72cdfd645ef9eeb5424e7dca1c00baba.exe	netupdsrv.exe
PID 1260 wrote to memory of 1204	1260	46ff71f529360dd96a098dc828172e1b72cdfd645ef9eeb5424e7dca1c00baba.exe	netupdsrv.exe
PID 1260 wrote to memory of 828	1260	46ff71f529360dd96a098dc828172e1b72cdfd645ef9eeb5424e7dca1c00baba.exe	net.exe
PID 1260 wrote to memory of 828	1260	46ff71f529360dd96a098dc828172e1b72cdfd645ef9eeb5424e7dca1c00baba.exe	net.exe
PID 1260 wrote to memory of 828	1260	46ff71f529360dd96a098dc828172e1b72cdfd645ef9eeb5424e7dca1c00baba.exe	net.exe
PID 1260 wrote to memory of 828	1260	46ff71f529360dd96a098dc828172e1b72cdfd645ef9eeb5424e7dca1c00baba.exe	net.exe
PID 828 wrote to memory of 1480	828	net.exe	net1.exe
PID 828 wrote to memory of 1480	828	net.exe	net1.exe
PID 828 wrote to memory of 1480	828	net.exe	net1.exe
PID 828 wrote to memory of 1480	828	net.exe	net1.exe
PID 1260 wrote to memory of 1240	1260	46ff71f529360dd96a098dc828172e1b72cdfd645ef9eeb5424e7dca1c00baba.exe	net.exe
PID 1260 wrote to memory of 1240	1260	46ff71f529360dd96a098dc828172e1b72cdfd645ef9eeb5424e7dca1c00baba.exe	net.exe
PID 1260 wrote to memory of 1240	1260	46ff71f529360dd96a098dc828172e1b72cdfd645ef9eeb5424e7dca1c00baba.exe	net.exe
PID 1260 wrote to memory of 1240	1260	46ff71f529360dd96a098dc828172e1b72cdfd645ef9eeb5424e7dca1c00baba.exe	net.exe
PID 1240 wrote to memory of 1424	1240	net.exe	net1.exe
PID 1240 wrote to memory of 1424	1240	net.exe	net1.exe
PID 1240 wrote to memory of 1424	1240	net.exe	net1.exe
PID 1240 wrote to memory of 1424	1240	net.exe	net1.exe

C:\Users\Admin\AppData\Local\Temp\46ff71f529360dd96a098dc828172e1b72cdfd645ef9eeb5424e7dca1c00baba.exe
"C:\Users\Admin\AppData\Local\Temp\46ff71f529360dd96a098dc828172e1b72cdfd645ef9eeb5424e7dca1c00baba.exe"
1⤵
- Drops file in Drivers directory
- Loads dropped DLL
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:1260

C:\Windows\SysWOW64\net.exe
net stop nethttpservice
2⤵
- Suspicious use of WriteProcessMemory
PID:872

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop nethttpservice
3⤵
PID:584

C:\Windows\SysWOW64\net.exe
net stop serviceupdater
2⤵
- Suspicious use of WriteProcessMemory
PID:548

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop serviceupdater
3⤵
PID:576

C:\Windows\SysWOW64\installd.exe
"C:\Windows\system32\installd.exe" nethfdrv
2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1944

C:\Windows\SysWOW64\nethtsrv.exe
"C:\Windows\system32\nethtsrv.exe" -nfdi
2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1008

C:\Windows\SysWOW64\netupdsrv.exe
"C:\Windows\system32\netupdsrv.exe" -nfdi
2⤵
- Executes dropped EXE
PID:1204

C:\Windows\SysWOW64\net.exe
net start nethttpservice
2⤵
- Suspicious use of WriteProcessMemory
PID:828

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 start nethttpservice
3⤵
PID:1480

C:\Windows\SysWOW64\net.exe
net start serviceupdater
2⤵
- Suspicious use of WriteProcessMemory
PID:1240

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 start serviceupdater
3⤵
PID:1424

C:\Windows\SysWOW64\nethtsrv.exe
C:\Windows\SysWOW64\nethtsrv.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:640

C:\Windows\SysWOW64\netupdsrv.exe
C:\Windows\SysWOW64\netupdsrv.exe
1⤵
- Executes dropped EXE
PID:1708

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\hfnapi.dll
Filesize
106KB

MD5
a3b9367824307d57b9e7924d93adfab8

SHA1
fbdecdf8ced1be1563eb6c64175cfb222c16b10a

SHA256
b0a640d04bc7c69208283aacd4742a52e70c410af0ac4041ce5616f9a887406c

SHA512
e2628cbb424a0b0e5d5e14500f237c4b57f3b934ee32d962ef7f110994ede385bf6f71fd86aa11bf9db933a3efbd974a7e0a5c0eb2ed0b7215474a612c6a7cc9

Download Submit
C:\Windows\SysWOW64\hfpapi.dll
Filesize
241KB

MD5
ba9bc6eefccf4f7a86193b880d00649b

SHA1
7fe026b3a23f62c77fc9765d6499de8a18d43ccf

SHA256
a18cf17ff23bd18d8d25cbeabd3e71b651cc9e9c1c55e5e0f22d5c6b1e2045b9

SHA512
518f3955093ab1049980c333bfbac2d5fc77ada8faa3034c77910b24e0f45605afdcaf5d66d850f1e236d68c7faf3b79ee34b6a507bca95b4210a3b72d181d11

Download Submit
C:\Windows\SysWOW64\installd.exe
Filesize
108KB

MD5
a168c9d073dbcd0a59c843b415b8b234

SHA1
1b9fc3a67bfcfe85b16b324f15edd209ca54396e

SHA256
e0daa8c96247f13d63cca8545a88a3bb9837a49aa3e4a0f6f38e156aaca428d6

SHA512
9c091708bde59f6dd1aa94f6ca5341c254b71c558be71742da41e7da15b92f09310ae4b4c22aff5a61a7569335d5123bf53909c1168c2c93fc0c0915ff038f79

Download Submit
C:\Windows\SysWOW64\nethtsrv.exe
Filesize
176KB

MD5
da4e7a723d3bcc339972b5f5ac58997e

SHA1
2e0affd39b713f6d7b22c77aa09c7b9f972ba18f

SHA256
a23ab8bb11f6c13b714e804cdf466d9b917801d379c03930fd8252bc25b8424f

SHA512
5075027e2e4b994aa71d3133ab3502a86eb1429a90458a8d9620c183556f34a17d32f4c0c0fbc3c5ee2d6a8e81ce93045f208d313ba3a7cdd44ae422794b86a4

Download Submit
C:\Windows\SysWOW64\nethtsrv.exe
Filesize
176KB

MD5
da4e7a723d3bcc339972b5f5ac58997e

SHA1
2e0affd39b713f6d7b22c77aa09c7b9f972ba18f

SHA256
a23ab8bb11f6c13b714e804cdf466d9b917801d379c03930fd8252bc25b8424f

SHA512
5075027e2e4b994aa71d3133ab3502a86eb1429a90458a8d9620c183556f34a17d32f4c0c0fbc3c5ee2d6a8e81ce93045f208d313ba3a7cdd44ae422794b86a4

Download Submit
C:\Windows\SysWOW64\netupdsrv.exe
Filesize
158KB

MD5
a2046a04569902df0ce70e2d914575ea

SHA1
0cb136b2823cdd8eaf4a22d76576656a5068cffe

SHA256
5ec39faa17f85c5e42d430c1338e13c2023d416d73059a5e1e78359ba731ce9d

SHA512
b1601550b7d6756487a310311c87930065799318a877ceacbbb3d97dc8b86ad019af9c5815a404670b48b32aea341b1692c2bbdec96c97f5dd0e287378d9512b

Download Submit
C:\Windows\SysWOW64\netupdsrv.exe
Filesize
158KB

MD5
a2046a04569902df0ce70e2d914575ea

SHA1
0cb136b2823cdd8eaf4a22d76576656a5068cffe

SHA256
5ec39faa17f85c5e42d430c1338e13c2023d416d73059a5e1e78359ba731ce9d

SHA512
b1601550b7d6756487a310311c87930065799318a877ceacbbb3d97dc8b86ad019af9c5815a404670b48b32aea341b1692c2bbdec96c97f5dd0e287378d9512b

Download Submit
\Users\Admin\AppData\Local\Temp\nsjD9BF.tmp\System.dll
Filesize
11KB

MD5
c17103ae9072a06da581dec998343fc1

SHA1
b72148c6bdfaada8b8c3f950e610ee7cf1da1f8d

SHA256
dc58d8ad81cacb0c1ed72e33bff8f23ea40b5252b5bb55d393a0903e6819ae2f

SHA512
d32a71aaef18e993f28096d536e41c4d016850721b31171513ce28bbd805a54fd290b7c3e9d935f72e676a1acfb4f0dcc89d95040a0dd29f2b6975855c18986f

Download Submit
\Users\Admin\AppData\Local\Temp\nsjD9BF.tmp\nsExec.dll
Filesize
6KB

MD5
acc2b699edfea5bf5aae45aba3a41e96

SHA1
d2accf4d494e43ceb2cff69abe4dd17147d29cc2

SHA256
168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e

SHA512
e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe

Download Submit
\Users\Admin\AppData\Local\Temp\nsjD9BF.tmp\nsExec.dll
Filesize
6KB

MD5
acc2b699edfea5bf5aae45aba3a41e96

SHA1
d2accf4d494e43ceb2cff69abe4dd17147d29cc2

SHA256
168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e

SHA512
e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe

Download Submit
\Users\Admin\AppData\Local\Temp\nsjD9BF.tmp\nsExec.dll
Filesize
6KB

MD5
acc2b699edfea5bf5aae45aba3a41e96

SHA1
d2accf4d494e43ceb2cff69abe4dd17147d29cc2

SHA256
168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e

SHA512
e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe

Download Submit
\Users\Admin\AppData\Local\Temp\nsjD9BF.tmp\nsExec.dll
Filesize
6KB

MD5
acc2b699edfea5bf5aae45aba3a41e96

SHA1
d2accf4d494e43ceb2cff69abe4dd17147d29cc2

SHA256
168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e

SHA512
e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe

Download Submit
\Windows\SysWOW64\hfnapi.dll
Filesize
106KB

MD5
a3b9367824307d57b9e7924d93adfab8

SHA1
fbdecdf8ced1be1563eb6c64175cfb222c16b10a

SHA256
b0a640d04bc7c69208283aacd4742a52e70c410af0ac4041ce5616f9a887406c

SHA512
e2628cbb424a0b0e5d5e14500f237c4b57f3b934ee32d962ef7f110994ede385bf6f71fd86aa11bf9db933a3efbd974a7e0a5c0eb2ed0b7215474a612c6a7cc9

Download Submit
\Windows\SysWOW64\hfnapi.dll
Filesize
106KB

MD5
a3b9367824307d57b9e7924d93adfab8

SHA1
fbdecdf8ced1be1563eb6c64175cfb222c16b10a

SHA256
b0a640d04bc7c69208283aacd4742a52e70c410af0ac4041ce5616f9a887406c

SHA512
e2628cbb424a0b0e5d5e14500f237c4b57f3b934ee32d962ef7f110994ede385bf6f71fd86aa11bf9db933a3efbd974a7e0a5c0eb2ed0b7215474a612c6a7cc9

Download Submit
\Windows\SysWOW64\hfnapi.dll
Filesize
106KB

MD5
a3b9367824307d57b9e7924d93adfab8

SHA1
fbdecdf8ced1be1563eb6c64175cfb222c16b10a

SHA256
b0a640d04bc7c69208283aacd4742a52e70c410af0ac4041ce5616f9a887406c

SHA512
e2628cbb424a0b0e5d5e14500f237c4b57f3b934ee32d962ef7f110994ede385bf6f71fd86aa11bf9db933a3efbd974a7e0a5c0eb2ed0b7215474a612c6a7cc9

Download Submit
\Windows\SysWOW64\hfpapi.dll
Filesize
241KB

MD5
ba9bc6eefccf4f7a86193b880d00649b

SHA1
7fe026b3a23f62c77fc9765d6499de8a18d43ccf

SHA256
a18cf17ff23bd18d8d25cbeabd3e71b651cc9e9c1c55e5e0f22d5c6b1e2045b9

SHA512
518f3955093ab1049980c333bfbac2d5fc77ada8faa3034c77910b24e0f45605afdcaf5d66d850f1e236d68c7faf3b79ee34b6a507bca95b4210a3b72d181d11

Download Submit
\Windows\SysWOW64\hfpapi.dll
Filesize
241KB

MD5
ba9bc6eefccf4f7a86193b880d00649b

SHA1
7fe026b3a23f62c77fc9765d6499de8a18d43ccf

SHA256
a18cf17ff23bd18d8d25cbeabd3e71b651cc9e9c1c55e5e0f22d5c6b1e2045b9

SHA512
518f3955093ab1049980c333bfbac2d5fc77ada8faa3034c77910b24e0f45605afdcaf5d66d850f1e236d68c7faf3b79ee34b6a507bca95b4210a3b72d181d11

Download Submit
\Windows\SysWOW64\installd.exe
Filesize
108KB

MD5
a168c9d073dbcd0a59c843b415b8b234

SHA1
1b9fc3a67bfcfe85b16b324f15edd209ca54396e

SHA256
e0daa8c96247f13d63cca8545a88a3bb9837a49aa3e4a0f6f38e156aaca428d6

SHA512
9c091708bde59f6dd1aa94f6ca5341c254b71c558be71742da41e7da15b92f09310ae4b4c22aff5a61a7569335d5123bf53909c1168c2c93fc0c0915ff038f79

Download Submit
\Windows\SysWOW64\nethtsrv.exe
Filesize
176KB

MD5
da4e7a723d3bcc339972b5f5ac58997e

SHA1
2e0affd39b713f6d7b22c77aa09c7b9f972ba18f

SHA256
a23ab8bb11f6c13b714e804cdf466d9b917801d379c03930fd8252bc25b8424f

SHA512
5075027e2e4b994aa71d3133ab3502a86eb1429a90458a8d9620c183556f34a17d32f4c0c0fbc3c5ee2d6a8e81ce93045f208d313ba3a7cdd44ae422794b86a4

Download Submit
\Windows\SysWOW64\netupdsrv.exe
Filesize
158KB

MD5
a2046a04569902df0ce70e2d914575ea

SHA1
0cb136b2823cdd8eaf4a22d76576656a5068cffe

SHA256
5ec39faa17f85c5e42d430c1338e13c2023d416d73059a5e1e78359ba731ce9d

SHA512
b1601550b7d6756487a310311c87930065799318a877ceacbbb3d97dc8b86ad019af9c5815a404670b48b32aea341b1692c2bbdec96c97f5dd0e287378d9512b

Download Submit
memory/548-60-0x0000000000000000-mapping.dmp

Download
memory/576-61-0x0000000000000000-mapping.dmp

Download
memory/584-58-0x0000000000000000-mapping.dmp

Download
memory/828-79-0x0000000000000000-mapping.dmp

Download
memory/872-57-0x0000000000000000-mapping.dmp

Download
memory/1008-69-0x0000000000000000-mapping.dmp

Download
memory/1204-75-0x0000000000000000-mapping.dmp

Download
memory/1240-85-0x0000000000000000-mapping.dmp

Download
memory/1260-54-0x00000000754C1000-0x00000000754C3000-memory.dmp

Filesize
8KB

Download
memory/1424-86-0x0000000000000000-mapping.dmp

Download
memory/1480-80-0x0000000000000000-mapping.dmp

Download
memory/1944-63-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads