0d2ebe9084957cffc11a03107af6251c1c6cb6015a6772247c3eb57c47f2268f

Analysis

max time kernel
91s
max time network
32s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
23-11-2022 11:00

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0d2ebe9084957cffc11a03107af6251c1c6cb6015a6772247c3eb57c47f2268f.exe
Size

447KB
MD5

68fd896ae7ee004b2696ad0395dd75e8
SHA1

05266bb1d33f96dc4ec4b89493d9e8374f7bef48
SHA256

0d2ebe9084957cffc11a03107af6251c1c6cb6015a6772247c3eb57c47f2268f
SHA512

0ffbed9e92ceaf939f68132a481b38bfd70e2fa75605adff7a7815fd192ccce9f5c12f4fe21704ae621ec2a52945f2f50a9642c782fb32928cf7656e45ac08d4
SSDEEP

12288:2O/zchRsRVSr452834JyCLHbnkYn8rjwIbX3QK6Zla3HVAK:2cqRZrAX34JhTbnn8rjwIsK6ZCHN

Score

8^/10

discovery

Malware Config

Signatures

Drops file in Drivers directory 1 IoCs

Processes:

0d2ebe9084957cffc11a03107af6251c1c6cb6015a6772247c3eb57c47f2268f.exe

description ioc process

File created C:\Windows\system32\drivers\nethfdrv.sys 0d2ebe9084957cffc11a03107af6251c1c6cb6015a6772247c3eb57c47f2268f.exe
Executes dropped EXE 5 IoCs

Processes:

installd.exenethtsrv.exenetupdsrv.exenethtsrv.exenetupdsrv.exe

pid process

1680 installd.exe
1364 nethtsrv.exe
1636 netupdsrv.exe
1480 nethtsrv.exe
1004 netupdsrv.exe

description	ioc	process
File created	C:\Windows\system32\drivers\nethfdrv.sys	0d2ebe9084957cffc11a03107af6251c1c6cb6015a6772247c3eb57c47f2268f.exe

pid	process
1680	installd.exe
1364	nethtsrv.exe
1636	netupdsrv.exe
1480	nethtsrv.exe
1004	netupdsrv.exe

Loads dropped DLL 13 IoCs

Processes:

0d2ebe9084957cffc11a03107af6251c1c6cb6015a6772247c3eb57c47f2268f.exeinstalld.exenethtsrv.exenethtsrv.exe

pid	process
1932	0d2ebe9084957cffc11a03107af6251c1c6cb6015a6772247c3eb57c47f2268f.exe
1932	0d2ebe9084957cffc11a03107af6251c1c6cb6015a6772247c3eb57c47f2268f.exe
1932	0d2ebe9084957cffc11a03107af6251c1c6cb6015a6772247c3eb57c47f2268f.exe
1932	0d2ebe9084957cffc11a03107af6251c1c6cb6015a6772247c3eb57c47f2268f.exe
1680	installd.exe
1932	0d2ebe9084957cffc11a03107af6251c1c6cb6015a6772247c3eb57c47f2268f.exe
1364	nethtsrv.exe
1364	nethtsrv.exe
1932	0d2ebe9084957cffc11a03107af6251c1c6cb6015a6772247c3eb57c47f2268f.exe
1932	0d2ebe9084957cffc11a03107af6251c1c6cb6015a6772247c3eb57c47f2268f.exe
1480	nethtsrv.exe
1480	nethtsrv.exe
1932	0d2ebe9084957cffc11a03107af6251c1c6cb6015a6772247c3eb57c47f2268f.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in System32 directory 5 IoCs

Processes:

0d2ebe9084957cffc11a03107af6251c1c6cb6015a6772247c3eb57c47f2268f.exe

description	ioc	process
File created	C:\Windows\SysWOW64\hfpapi.dll	0d2ebe9084957cffc11a03107af6251c1c6cb6015a6772247c3eb57c47f2268f.exe
File created	C:\Windows\SysWOW64\installd.exe	0d2ebe9084957cffc11a03107af6251c1c6cb6015a6772247c3eb57c47f2268f.exe
File created	C:\Windows\SysWOW64\nethtsrv.exe	0d2ebe9084957cffc11a03107af6251c1c6cb6015a6772247c3eb57c47f2268f.exe
File created	C:\Windows\SysWOW64\netupdsrv.exe	0d2ebe9084957cffc11a03107af6251c1c6cb6015a6772247c3eb57c47f2268f.exe
File created	C:\Windows\SysWOW64\hfnapi.dll	0d2ebe9084957cffc11a03107af6251c1c6cb6015a6772247c3eb57c47f2268f.exe

Drops file in Program Files directory 3 IoCs

Processes:

0d2ebe9084957cffc11a03107af6251c1c6cb6015a6772247c3eb57c47f2268f.exe

description	ioc	process
File created	C:\Program Files (x86)\Common Files\Config\data.xml	0d2ebe9084957cffc11a03107af6251c1c6cb6015a6772247c3eb57c47f2268f.exe
File created	C:\Program Files (x86)\Common Files\Config\ver.xml	0d2ebe9084957cffc11a03107af6251c1c6cb6015a6772247c3eb57c47f2268f.exe
File created	C:\Program Files (x86)\Common Files\config\uninstinethnfd.exe	0d2ebe9084957cffc11a03107af6251c1c6cb6015a6772247c3eb57c47f2268f.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Runs net.exe
Suspicious behavior: LoadsDriver 1 IoCs

Processes:

pid process

464
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

nethtsrv.exe

description pid process

Token: SeDebugPrivilege 1480 nethtsrv.exe

pid	process
464

description	pid	process
Token: SeDebugPrivilege	1480	nethtsrv.exe

Suspicious use of WriteProcessMemory 50 IoCs

Processes:

0d2ebe9084957cffc11a03107af6251c1c6cb6015a6772247c3eb57c47f2268f.exenet.exenet.exenet.exenet.exe

description	pid	process	target process
PID 1932 wrote to memory of 1512	1932	0d2ebe9084957cffc11a03107af6251c1c6cb6015a6772247c3eb57c47f2268f.exe	net.exe
PID 1932 wrote to memory of 1512	1932	0d2ebe9084957cffc11a03107af6251c1c6cb6015a6772247c3eb57c47f2268f.exe	net.exe
PID 1932 wrote to memory of 1512	1932	0d2ebe9084957cffc11a03107af6251c1c6cb6015a6772247c3eb57c47f2268f.exe	net.exe
PID 1932 wrote to memory of 1512	1932	0d2ebe9084957cffc11a03107af6251c1c6cb6015a6772247c3eb57c47f2268f.exe	net.exe
PID 1512 wrote to memory of 1508	1512	net.exe	net1.exe
PID 1512 wrote to memory of 1508	1512	net.exe	net1.exe
PID 1512 wrote to memory of 1508	1512	net.exe	net1.exe
PID 1512 wrote to memory of 1508	1512	net.exe	net1.exe
PID 1932 wrote to memory of 548	1932	0d2ebe9084957cffc11a03107af6251c1c6cb6015a6772247c3eb57c47f2268f.exe	net.exe
PID 1932 wrote to memory of 548	1932	0d2ebe9084957cffc11a03107af6251c1c6cb6015a6772247c3eb57c47f2268f.exe	net.exe
PID 1932 wrote to memory of 548	1932	0d2ebe9084957cffc11a03107af6251c1c6cb6015a6772247c3eb57c47f2268f.exe	net.exe
PID 1932 wrote to memory of 548	1932	0d2ebe9084957cffc11a03107af6251c1c6cb6015a6772247c3eb57c47f2268f.exe	net.exe
PID 548 wrote to memory of 552	548	net.exe	net1.exe
PID 548 wrote to memory of 552	548	net.exe	net1.exe
PID 548 wrote to memory of 552	548	net.exe	net1.exe
PID 548 wrote to memory of 552	548	net.exe	net1.exe
PID 1932 wrote to memory of 1680	1932	0d2ebe9084957cffc11a03107af6251c1c6cb6015a6772247c3eb57c47f2268f.exe	installd.exe
PID 1932 wrote to memory of 1680	1932	0d2ebe9084957cffc11a03107af6251c1c6cb6015a6772247c3eb57c47f2268f.exe	installd.exe
PID 1932 wrote to memory of 1680	1932	0d2ebe9084957cffc11a03107af6251c1c6cb6015a6772247c3eb57c47f2268f.exe	installd.exe
PID 1932 wrote to memory of 1680	1932	0d2ebe9084957cffc11a03107af6251c1c6cb6015a6772247c3eb57c47f2268f.exe	installd.exe
PID 1932 wrote to memory of 1680	1932	0d2ebe9084957cffc11a03107af6251c1c6cb6015a6772247c3eb57c47f2268f.exe	installd.exe
PID 1932 wrote to memory of 1680	1932	0d2ebe9084957cffc11a03107af6251c1c6cb6015a6772247c3eb57c47f2268f.exe	installd.exe
PID 1932 wrote to memory of 1680	1932	0d2ebe9084957cffc11a03107af6251c1c6cb6015a6772247c3eb57c47f2268f.exe	installd.exe
PID 1932 wrote to memory of 1364	1932	0d2ebe9084957cffc11a03107af6251c1c6cb6015a6772247c3eb57c47f2268f.exe	nethtsrv.exe
PID 1932 wrote to memory of 1364	1932	0d2ebe9084957cffc11a03107af6251c1c6cb6015a6772247c3eb57c47f2268f.exe	nethtsrv.exe
PID 1932 wrote to memory of 1364	1932	0d2ebe9084957cffc11a03107af6251c1c6cb6015a6772247c3eb57c47f2268f.exe	nethtsrv.exe
PID 1932 wrote to memory of 1364	1932	0d2ebe9084957cffc11a03107af6251c1c6cb6015a6772247c3eb57c47f2268f.exe	nethtsrv.exe
PID 1932 wrote to memory of 1636	1932	0d2ebe9084957cffc11a03107af6251c1c6cb6015a6772247c3eb57c47f2268f.exe	netupdsrv.exe
PID 1932 wrote to memory of 1636	1932	0d2ebe9084957cffc11a03107af6251c1c6cb6015a6772247c3eb57c47f2268f.exe	netupdsrv.exe
PID 1932 wrote to memory of 1636	1932	0d2ebe9084957cffc11a03107af6251c1c6cb6015a6772247c3eb57c47f2268f.exe	netupdsrv.exe
PID 1932 wrote to memory of 1636	1932	0d2ebe9084957cffc11a03107af6251c1c6cb6015a6772247c3eb57c47f2268f.exe	netupdsrv.exe
PID 1932 wrote to memory of 1636	1932	0d2ebe9084957cffc11a03107af6251c1c6cb6015a6772247c3eb57c47f2268f.exe	netupdsrv.exe
PID 1932 wrote to memory of 1636	1932	0d2ebe9084957cffc11a03107af6251c1c6cb6015a6772247c3eb57c47f2268f.exe	netupdsrv.exe
PID 1932 wrote to memory of 1636	1932	0d2ebe9084957cffc11a03107af6251c1c6cb6015a6772247c3eb57c47f2268f.exe	netupdsrv.exe
PID 1932 wrote to memory of 1012	1932	0d2ebe9084957cffc11a03107af6251c1c6cb6015a6772247c3eb57c47f2268f.exe	net.exe
PID 1932 wrote to memory of 1012	1932	0d2ebe9084957cffc11a03107af6251c1c6cb6015a6772247c3eb57c47f2268f.exe	net.exe
PID 1932 wrote to memory of 1012	1932	0d2ebe9084957cffc11a03107af6251c1c6cb6015a6772247c3eb57c47f2268f.exe	net.exe
PID 1932 wrote to memory of 1012	1932	0d2ebe9084957cffc11a03107af6251c1c6cb6015a6772247c3eb57c47f2268f.exe	net.exe
PID 1012 wrote to memory of 980	1012	net.exe	net1.exe
PID 1012 wrote to memory of 980	1012	net.exe	net1.exe
PID 1012 wrote to memory of 980	1012	net.exe	net1.exe
PID 1012 wrote to memory of 980	1012	net.exe	net1.exe
PID 1932 wrote to memory of 1716	1932	0d2ebe9084957cffc11a03107af6251c1c6cb6015a6772247c3eb57c47f2268f.exe	net.exe
PID 1932 wrote to memory of 1716	1932	0d2ebe9084957cffc11a03107af6251c1c6cb6015a6772247c3eb57c47f2268f.exe	net.exe
PID 1932 wrote to memory of 1716	1932	0d2ebe9084957cffc11a03107af6251c1c6cb6015a6772247c3eb57c47f2268f.exe	net.exe
PID 1932 wrote to memory of 1716	1932	0d2ebe9084957cffc11a03107af6251c1c6cb6015a6772247c3eb57c47f2268f.exe	net.exe
PID 1716 wrote to memory of 1424	1716	net.exe	net1.exe
PID 1716 wrote to memory of 1424	1716	net.exe	net1.exe
PID 1716 wrote to memory of 1424	1716	net.exe	net1.exe
PID 1716 wrote to memory of 1424	1716	net.exe	net1.exe

C:\Users\Admin\AppData\Local\Temp\0d2ebe9084957cffc11a03107af6251c1c6cb6015a6772247c3eb57c47f2268f.exe
"C:\Users\Admin\AppData\Local\Temp\0d2ebe9084957cffc11a03107af6251c1c6cb6015a6772247c3eb57c47f2268f.exe"
1⤵
- Drops file in Drivers directory
- Loads dropped DLL
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:1932

C:\Windows\SysWOW64\net.exe
net stop nethttpservice
2⤵
- Suspicious use of WriteProcessMemory
PID:1512

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop nethttpservice
3⤵
PID:1508

C:\Windows\SysWOW64\net.exe
net stop serviceupdater
2⤵
- Suspicious use of WriteProcessMemory
PID:548

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop serviceupdater
3⤵
PID:552

C:\Windows\SysWOW64\installd.exe
"C:\Windows\system32\installd.exe" nethfdrv
2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1680

C:\Windows\SysWOW64\nethtsrv.exe
"C:\Windows\system32\nethtsrv.exe" -nfdi
2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1364

C:\Windows\SysWOW64\netupdsrv.exe
"C:\Windows\system32\netupdsrv.exe" -nfdi
2⤵
- Executes dropped EXE
PID:1636

C:\Windows\SysWOW64\net.exe
net start nethttpservice
2⤵
- Suspicious use of WriteProcessMemory
PID:1012

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 start nethttpservice
3⤵
PID:980

C:\Windows\SysWOW64\net.exe
net start serviceupdater
2⤵
- Suspicious use of WriteProcessMemory
PID:1716

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 start serviceupdater
3⤵
PID:1424

C:\Windows\SysWOW64\nethtsrv.exe
C:\Windows\SysWOW64\nethtsrv.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:1480

C:\Windows\SysWOW64\netupdsrv.exe
C:\Windows\SysWOW64\netupdsrv.exe
1⤵
- Executes dropped EXE
PID:1004

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\hfnapi.dll
Filesize
106KB

MD5
001a2716d072c881062d7c433fdd3b0c

SHA1
63ace6c003aa921d2b412b5931e9132ba8ec709a

SHA256
bab46567a4289633bf015914ed89f61452b635f969d7e255cc5b5f8ea804e7b8

SHA512
4b6f73b778687aabf4457d5d46f70c893c0421f8d4b6bfea4cef05adb5f9e5dd2ebf0559a3eef18856359a23a7c83dc9c7a8fb66ea5254a2360f0dd6cb990167

Download Submit
C:\Windows\SysWOW64\hfpapi.dll
Filesize
244KB

MD5
e83dbecc3020e9fbd7359a6f716c259e

SHA1
c3575fb8aba69987a301ead825cb42195c52d0e1

SHA256
c4feeec6dbe945ce07ba1133e03f27d7b5291bfd4f0b293398f724e9123e7d69

SHA512
eb0503191da1ec5fc84341154731af3be3f95ac2696a2ee538a8a3d16d19ccee9039321d42c48e6dbaa74909fcf9d244d36ca940980d653fc722915a3d328336

Download Submit
C:\Windows\SysWOW64\installd.exe
Filesize
108KB

MD5
11e23a52c2f3f9e7ff0a4315d6414619

SHA1
fe2e514df307c85f006552da10669cac23c8aa5a

SHA256
e332fb42f77c7468a60b846ce28fafe486aeb540bf21c2bca598b3971bbaebe1

SHA512
98b8afd8cc29b7c62ec31893473f88a6f4d36f44725093b10100216285ce0cdbdf9c445ebf54df51bfb8b8b619e86f8915dbc87e43905cb60c1104b968b537b3

Download Submit
C:\Windows\SysWOW64\nethtsrv.exe
Filesize
176KB

MD5
3145a1c8e45ce881a7913f867989ee8b

SHA1
830f2016720bb39cb1db0e89faaf21caf029d0ef

SHA256
52ee843e536a01f8829a1c3b3b09a6a777ea0d66d059dd7d2db89c26e05fecef

SHA512
eef465e5b89aa5ddd53920549e70810bf89db5389c05493872cb632a585b34de234d1e0b4d3bb86feeace6f8df512c43b2ea7c391d3528a3cef56e9cc717b7ff

Download Submit
C:\Windows\SysWOW64\nethtsrv.exe
Filesize
176KB

MD5
3145a1c8e45ce881a7913f867989ee8b

SHA1
830f2016720bb39cb1db0e89faaf21caf029d0ef

SHA256
52ee843e536a01f8829a1c3b3b09a6a777ea0d66d059dd7d2db89c26e05fecef

SHA512
eef465e5b89aa5ddd53920549e70810bf89db5389c05493872cb632a585b34de234d1e0b4d3bb86feeace6f8df512c43b2ea7c391d3528a3cef56e9cc717b7ff

Download Submit
C:\Windows\SysWOW64\netupdsrv.exe
Filesize
158KB

MD5
ffc42a632b7eca305af3ebd06a90fbf3

SHA1
07852fa8d9073e012ff43492bbf4be69d3dae393

SHA256
40e92bf81f4c50ce623eb7fbe0d68fc991ae360e9c38076bc7f3060565609b58

SHA512
bfc56999edc3d5d7890f715e88e82f6bc314707c29f8ad4c304b88762b9f53b4b941db23f5a3830ef99fd4b80ee28ab4310b7abde07cf8a7317bc2a0dfa7d95d

Download Submit
C:\Windows\SysWOW64\netupdsrv.exe
Filesize
158KB

MD5
ffc42a632b7eca305af3ebd06a90fbf3

SHA1
07852fa8d9073e012ff43492bbf4be69d3dae393

SHA256
40e92bf81f4c50ce623eb7fbe0d68fc991ae360e9c38076bc7f3060565609b58

SHA512
bfc56999edc3d5d7890f715e88e82f6bc314707c29f8ad4c304b88762b9f53b4b941db23f5a3830ef99fd4b80ee28ab4310b7abde07cf8a7317bc2a0dfa7d95d

Download Submit
\Users\Admin\AppData\Local\Temp\nseFBC0.tmp\System.dll
Filesize
11KB

MD5
c17103ae9072a06da581dec998343fc1

SHA1
b72148c6bdfaada8b8c3f950e610ee7cf1da1f8d

SHA256
dc58d8ad81cacb0c1ed72e33bff8f23ea40b5252b5bb55d393a0903e6819ae2f

SHA512
d32a71aaef18e993f28096d536e41c4d016850721b31171513ce28bbd805a54fd290b7c3e9d935f72e676a1acfb4f0dcc89d95040a0dd29f2b6975855c18986f

Download Submit
\Users\Admin\AppData\Local\Temp\nseFBC0.tmp\nsExec.dll
Filesize
6KB

MD5
acc2b699edfea5bf5aae45aba3a41e96

SHA1
d2accf4d494e43ceb2cff69abe4dd17147d29cc2

SHA256
168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e

SHA512
e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe

Download Submit
\Users\Admin\AppData\Local\Temp\nseFBC0.tmp\nsExec.dll
Filesize
6KB

MD5
acc2b699edfea5bf5aae45aba3a41e96

SHA1
d2accf4d494e43ceb2cff69abe4dd17147d29cc2

SHA256
168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e

SHA512
e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe

Download Submit
\Users\Admin\AppData\Local\Temp\nseFBC0.tmp\nsExec.dll
Filesize
6KB

MD5
acc2b699edfea5bf5aae45aba3a41e96

SHA1
d2accf4d494e43ceb2cff69abe4dd17147d29cc2

SHA256
168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e

SHA512
e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe

Download Submit
\Users\Admin\AppData\Local\Temp\nseFBC0.tmp\nsExec.dll
Filesize
6KB

MD5
acc2b699edfea5bf5aae45aba3a41e96

SHA1
d2accf4d494e43ceb2cff69abe4dd17147d29cc2

SHA256
168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e

SHA512
e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe

Download Submit
\Windows\SysWOW64\hfnapi.dll
Filesize
106KB

MD5
001a2716d072c881062d7c433fdd3b0c

SHA1
63ace6c003aa921d2b412b5931e9132ba8ec709a

SHA256
bab46567a4289633bf015914ed89f61452b635f969d7e255cc5b5f8ea804e7b8

SHA512
4b6f73b778687aabf4457d5d46f70c893c0421f8d4b6bfea4cef05adb5f9e5dd2ebf0559a3eef18856359a23a7c83dc9c7a8fb66ea5254a2360f0dd6cb990167

Download Submit
\Windows\SysWOW64\hfnapi.dll
Filesize
106KB

MD5
001a2716d072c881062d7c433fdd3b0c

SHA1
63ace6c003aa921d2b412b5931e9132ba8ec709a

SHA256
bab46567a4289633bf015914ed89f61452b635f969d7e255cc5b5f8ea804e7b8

SHA512
4b6f73b778687aabf4457d5d46f70c893c0421f8d4b6bfea4cef05adb5f9e5dd2ebf0559a3eef18856359a23a7c83dc9c7a8fb66ea5254a2360f0dd6cb990167

Download Submit
\Windows\SysWOW64\hfnapi.dll
Filesize
106KB

MD5
001a2716d072c881062d7c433fdd3b0c

SHA1
63ace6c003aa921d2b412b5931e9132ba8ec709a

SHA256
bab46567a4289633bf015914ed89f61452b635f969d7e255cc5b5f8ea804e7b8

SHA512
4b6f73b778687aabf4457d5d46f70c893c0421f8d4b6bfea4cef05adb5f9e5dd2ebf0559a3eef18856359a23a7c83dc9c7a8fb66ea5254a2360f0dd6cb990167

Download Submit
\Windows\SysWOW64\hfpapi.dll
Filesize
244KB

MD5
e83dbecc3020e9fbd7359a6f716c259e

SHA1
c3575fb8aba69987a301ead825cb42195c52d0e1

SHA256
c4feeec6dbe945ce07ba1133e03f27d7b5291bfd4f0b293398f724e9123e7d69

SHA512
eb0503191da1ec5fc84341154731af3be3f95ac2696a2ee538a8a3d16d19ccee9039321d42c48e6dbaa74909fcf9d244d36ca940980d653fc722915a3d328336

Download Submit
\Windows\SysWOW64\hfpapi.dll
Filesize
244KB

MD5
e83dbecc3020e9fbd7359a6f716c259e

SHA1
c3575fb8aba69987a301ead825cb42195c52d0e1

SHA256
c4feeec6dbe945ce07ba1133e03f27d7b5291bfd4f0b293398f724e9123e7d69

SHA512
eb0503191da1ec5fc84341154731af3be3f95ac2696a2ee538a8a3d16d19ccee9039321d42c48e6dbaa74909fcf9d244d36ca940980d653fc722915a3d328336

Download Submit
\Windows\SysWOW64\installd.exe
Filesize
108KB

MD5
11e23a52c2f3f9e7ff0a4315d6414619

SHA1
fe2e514df307c85f006552da10669cac23c8aa5a

SHA256
e332fb42f77c7468a60b846ce28fafe486aeb540bf21c2bca598b3971bbaebe1

SHA512
98b8afd8cc29b7c62ec31893473f88a6f4d36f44725093b10100216285ce0cdbdf9c445ebf54df51bfb8b8b619e86f8915dbc87e43905cb60c1104b968b537b3

Download Submit
\Windows\SysWOW64\nethtsrv.exe
Filesize
176KB

MD5
3145a1c8e45ce881a7913f867989ee8b

SHA1
830f2016720bb39cb1db0e89faaf21caf029d0ef

SHA256
52ee843e536a01f8829a1c3b3b09a6a777ea0d66d059dd7d2db89c26e05fecef

SHA512
eef465e5b89aa5ddd53920549e70810bf89db5389c05493872cb632a585b34de234d1e0b4d3bb86feeace6f8df512c43b2ea7c391d3528a3cef56e9cc717b7ff

Download Submit
\Windows\SysWOW64\netupdsrv.exe
Filesize
158KB

MD5
ffc42a632b7eca305af3ebd06a90fbf3

SHA1
07852fa8d9073e012ff43492bbf4be69d3dae393

SHA256
40e92bf81f4c50ce623eb7fbe0d68fc991ae360e9c38076bc7f3060565609b58

SHA512
bfc56999edc3d5d7890f715e88e82f6bc314707c29f8ad4c304b88762b9f53b4b941db23f5a3830ef99fd4b80ee28ab4310b7abde07cf8a7317bc2a0dfa7d95d

Download Submit
memory/548-60-0x0000000000000000-mapping.dmp

Download
memory/552-61-0x0000000000000000-mapping.dmp

Download
memory/980-80-0x0000000000000000-mapping.dmp

Download
memory/1012-79-0x0000000000000000-mapping.dmp

Download
memory/1364-69-0x0000000000000000-mapping.dmp

Download
memory/1424-86-0x0000000000000000-mapping.dmp

Download
memory/1508-58-0x0000000000000000-mapping.dmp

Download
memory/1512-57-0x0000000000000000-mapping.dmp

Download
memory/1636-75-0x0000000000000000-mapping.dmp

Download
memory/1680-63-0x0000000000000000-mapping.dmp

Download
memory/1716-85-0x0000000000000000-mapping.dmp

Download
memory/1932-54-0x0000000074D71000-0x0000000074D73000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads