0ba6bf5259dd5d60b5b953f87223aa53b1c22d2faee45fb726fce7aaf8f3bbfd

Analysis

max time kernel
94s
max time network
31s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
23-11-2022 11:00

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0ba6bf5259dd5d60b5b953f87223aa53b1c22d2faee45fb726fce7aaf8f3bbfd.exe
Size

446KB
MD5

401c5dfb6af13ec7f13d3d87c311a440
SHA1

fc3e33afa9c3ab3c6a2cc34cf433f086dff9fac1
SHA256

0ba6bf5259dd5d60b5b953f87223aa53b1c22d2faee45fb726fce7aaf8f3bbfd
SHA512

3701d1ddef287dcc668fa709fa23374543b791015e9c6d636299e6747ca58fb568fa13b1c1d2d65738736d44d823e6d6523f4b08eb12a83f3549c1e2b6c3037b
SSDEEP

6144:XzfSE+4y4X9WOxlRLqRYG1+K2j6vf3BA0njOwCumFQEyma+Dhjrv92Rw/+uh:OEHy4og7Lqt2j637n6wCucrD1rP7

Score

8^/10

discovery

Malware Config

Signatures

Drops file in Drivers directory 1 IoCs

Processes:

0ba6bf5259dd5d60b5b953f87223aa53b1c22d2faee45fb726fce7aaf8f3bbfd.exe

description ioc process

File created C:\Windows\system32\drivers\nethfdrv.sys 0ba6bf5259dd5d60b5b953f87223aa53b1c22d2faee45fb726fce7aaf8f3bbfd.exe
Executes dropped EXE 5 IoCs

Processes:

installd.exenethtsrv.exenetupdsrv.exenethtsrv.exenetupdsrv.exe

pid process

824 installd.exe
1728 nethtsrv.exe
812 netupdsrv.exe
924 nethtsrv.exe
1716 netupdsrv.exe

description	ioc	process
File created	C:\Windows\system32\drivers\nethfdrv.sys	0ba6bf5259dd5d60b5b953f87223aa53b1c22d2faee45fb726fce7aaf8f3bbfd.exe

pid	process
824	installd.exe
1728	nethtsrv.exe
812	netupdsrv.exe
924	nethtsrv.exe
1716	netupdsrv.exe

Loads dropped DLL 13 IoCs

Processes:

0ba6bf5259dd5d60b5b953f87223aa53b1c22d2faee45fb726fce7aaf8f3bbfd.exeinstalld.exenethtsrv.exenethtsrv.exe

pid	process
1252	0ba6bf5259dd5d60b5b953f87223aa53b1c22d2faee45fb726fce7aaf8f3bbfd.exe
1252	0ba6bf5259dd5d60b5b953f87223aa53b1c22d2faee45fb726fce7aaf8f3bbfd.exe
1252	0ba6bf5259dd5d60b5b953f87223aa53b1c22d2faee45fb726fce7aaf8f3bbfd.exe
1252	0ba6bf5259dd5d60b5b953f87223aa53b1c22d2faee45fb726fce7aaf8f3bbfd.exe
824	installd.exe
1252	0ba6bf5259dd5d60b5b953f87223aa53b1c22d2faee45fb726fce7aaf8f3bbfd.exe
1728	nethtsrv.exe
1728	nethtsrv.exe
1252	0ba6bf5259dd5d60b5b953f87223aa53b1c22d2faee45fb726fce7aaf8f3bbfd.exe
1252	0ba6bf5259dd5d60b5b953f87223aa53b1c22d2faee45fb726fce7aaf8f3bbfd.exe
924	nethtsrv.exe
924	nethtsrv.exe
1252	0ba6bf5259dd5d60b5b953f87223aa53b1c22d2faee45fb726fce7aaf8f3bbfd.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in System32 directory 5 IoCs

Processes:

0ba6bf5259dd5d60b5b953f87223aa53b1c22d2faee45fb726fce7aaf8f3bbfd.exe

description	ioc	process
File created	C:\Windows\SysWOW64\hfnapi.dll	0ba6bf5259dd5d60b5b953f87223aa53b1c22d2faee45fb726fce7aaf8f3bbfd.exe
File created	C:\Windows\SysWOW64\hfpapi.dll	0ba6bf5259dd5d60b5b953f87223aa53b1c22d2faee45fb726fce7aaf8f3bbfd.exe
File created	C:\Windows\SysWOW64\installd.exe	0ba6bf5259dd5d60b5b953f87223aa53b1c22d2faee45fb726fce7aaf8f3bbfd.exe
File created	C:\Windows\SysWOW64\nethtsrv.exe	0ba6bf5259dd5d60b5b953f87223aa53b1c22d2faee45fb726fce7aaf8f3bbfd.exe
File created	C:\Windows\SysWOW64\netupdsrv.exe	0ba6bf5259dd5d60b5b953f87223aa53b1c22d2faee45fb726fce7aaf8f3bbfd.exe

Drops file in Program Files directory 3 IoCs

Processes:

0ba6bf5259dd5d60b5b953f87223aa53b1c22d2faee45fb726fce7aaf8f3bbfd.exe

description	ioc	process
File created	C:\Program Files (x86)\Common Files\Config\data.xml	0ba6bf5259dd5d60b5b953f87223aa53b1c22d2faee45fb726fce7aaf8f3bbfd.exe
File created	C:\Program Files (x86)\Common Files\Config\ver.xml	0ba6bf5259dd5d60b5b953f87223aa53b1c22d2faee45fb726fce7aaf8f3bbfd.exe
File created	C:\Program Files (x86)\Common Files\config\uninstinethnfd.exe	0ba6bf5259dd5d60b5b953f87223aa53b1c22d2faee45fb726fce7aaf8f3bbfd.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Runs net.exe
Suspicious behavior: LoadsDriver 1 IoCs

Processes:

pid process

460
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

nethtsrv.exe

description pid process

Token: SeDebugPrivilege 924 nethtsrv.exe

pid	process
460

description	pid	process
Token: SeDebugPrivilege	924	nethtsrv.exe

Suspicious use of WriteProcessMemory 50 IoCs

Processes:

0ba6bf5259dd5d60b5b953f87223aa53b1c22d2faee45fb726fce7aaf8f3bbfd.exenet.exenet.exenet.exenet.exe

description	pid	process	target process
PID 1252 wrote to memory of 520	1252	0ba6bf5259dd5d60b5b953f87223aa53b1c22d2faee45fb726fce7aaf8f3bbfd.exe	net.exe
PID 1252 wrote to memory of 520	1252	0ba6bf5259dd5d60b5b953f87223aa53b1c22d2faee45fb726fce7aaf8f3bbfd.exe	net.exe
PID 1252 wrote to memory of 520	1252	0ba6bf5259dd5d60b5b953f87223aa53b1c22d2faee45fb726fce7aaf8f3bbfd.exe	net.exe
PID 1252 wrote to memory of 520	1252	0ba6bf5259dd5d60b5b953f87223aa53b1c22d2faee45fb726fce7aaf8f3bbfd.exe	net.exe
PID 520 wrote to memory of 1092	520	net.exe	net1.exe
PID 520 wrote to memory of 1092	520	net.exe	net1.exe
PID 520 wrote to memory of 1092	520	net.exe	net1.exe
PID 520 wrote to memory of 1092	520	net.exe	net1.exe
PID 1252 wrote to memory of 1320	1252	0ba6bf5259dd5d60b5b953f87223aa53b1c22d2faee45fb726fce7aaf8f3bbfd.exe	net.exe
PID 1252 wrote to memory of 1320	1252	0ba6bf5259dd5d60b5b953f87223aa53b1c22d2faee45fb726fce7aaf8f3bbfd.exe	net.exe
PID 1252 wrote to memory of 1320	1252	0ba6bf5259dd5d60b5b953f87223aa53b1c22d2faee45fb726fce7aaf8f3bbfd.exe	net.exe
PID 1252 wrote to memory of 1320	1252	0ba6bf5259dd5d60b5b953f87223aa53b1c22d2faee45fb726fce7aaf8f3bbfd.exe	net.exe
PID 1320 wrote to memory of 1288	1320	net.exe	net1.exe
PID 1320 wrote to memory of 1288	1320	net.exe	net1.exe
PID 1320 wrote to memory of 1288	1320	net.exe	net1.exe
PID 1320 wrote to memory of 1288	1320	net.exe	net1.exe
PID 1252 wrote to memory of 824	1252	0ba6bf5259dd5d60b5b953f87223aa53b1c22d2faee45fb726fce7aaf8f3bbfd.exe	installd.exe
PID 1252 wrote to memory of 824	1252	0ba6bf5259dd5d60b5b953f87223aa53b1c22d2faee45fb726fce7aaf8f3bbfd.exe	installd.exe
PID 1252 wrote to memory of 824	1252	0ba6bf5259dd5d60b5b953f87223aa53b1c22d2faee45fb726fce7aaf8f3bbfd.exe	installd.exe
PID 1252 wrote to memory of 824	1252	0ba6bf5259dd5d60b5b953f87223aa53b1c22d2faee45fb726fce7aaf8f3bbfd.exe	installd.exe
PID 1252 wrote to memory of 824	1252	0ba6bf5259dd5d60b5b953f87223aa53b1c22d2faee45fb726fce7aaf8f3bbfd.exe	installd.exe
PID 1252 wrote to memory of 824	1252	0ba6bf5259dd5d60b5b953f87223aa53b1c22d2faee45fb726fce7aaf8f3bbfd.exe	installd.exe
PID 1252 wrote to memory of 824	1252	0ba6bf5259dd5d60b5b953f87223aa53b1c22d2faee45fb726fce7aaf8f3bbfd.exe	installd.exe
PID 1252 wrote to memory of 1728	1252	0ba6bf5259dd5d60b5b953f87223aa53b1c22d2faee45fb726fce7aaf8f3bbfd.exe	nethtsrv.exe
PID 1252 wrote to memory of 1728	1252	0ba6bf5259dd5d60b5b953f87223aa53b1c22d2faee45fb726fce7aaf8f3bbfd.exe	nethtsrv.exe
PID 1252 wrote to memory of 1728	1252	0ba6bf5259dd5d60b5b953f87223aa53b1c22d2faee45fb726fce7aaf8f3bbfd.exe	nethtsrv.exe
PID 1252 wrote to memory of 1728	1252	0ba6bf5259dd5d60b5b953f87223aa53b1c22d2faee45fb726fce7aaf8f3bbfd.exe	nethtsrv.exe
PID 1252 wrote to memory of 812	1252	0ba6bf5259dd5d60b5b953f87223aa53b1c22d2faee45fb726fce7aaf8f3bbfd.exe	netupdsrv.exe
PID 1252 wrote to memory of 812	1252	0ba6bf5259dd5d60b5b953f87223aa53b1c22d2faee45fb726fce7aaf8f3bbfd.exe	netupdsrv.exe
PID 1252 wrote to memory of 812	1252	0ba6bf5259dd5d60b5b953f87223aa53b1c22d2faee45fb726fce7aaf8f3bbfd.exe	netupdsrv.exe
PID 1252 wrote to memory of 812	1252	0ba6bf5259dd5d60b5b953f87223aa53b1c22d2faee45fb726fce7aaf8f3bbfd.exe	netupdsrv.exe
PID 1252 wrote to memory of 812	1252	0ba6bf5259dd5d60b5b953f87223aa53b1c22d2faee45fb726fce7aaf8f3bbfd.exe	netupdsrv.exe
PID 1252 wrote to memory of 812	1252	0ba6bf5259dd5d60b5b953f87223aa53b1c22d2faee45fb726fce7aaf8f3bbfd.exe	netupdsrv.exe
PID 1252 wrote to memory of 812	1252	0ba6bf5259dd5d60b5b953f87223aa53b1c22d2faee45fb726fce7aaf8f3bbfd.exe	netupdsrv.exe
PID 1252 wrote to memory of 1940	1252	0ba6bf5259dd5d60b5b953f87223aa53b1c22d2faee45fb726fce7aaf8f3bbfd.exe	net.exe
PID 1252 wrote to memory of 1940	1252	0ba6bf5259dd5d60b5b953f87223aa53b1c22d2faee45fb726fce7aaf8f3bbfd.exe	net.exe
PID 1252 wrote to memory of 1940	1252	0ba6bf5259dd5d60b5b953f87223aa53b1c22d2faee45fb726fce7aaf8f3bbfd.exe	net.exe
PID 1252 wrote to memory of 1940	1252	0ba6bf5259dd5d60b5b953f87223aa53b1c22d2faee45fb726fce7aaf8f3bbfd.exe	net.exe
PID 1940 wrote to memory of 1784	1940	net.exe	net1.exe
PID 1940 wrote to memory of 1784	1940	net.exe	net1.exe
PID 1940 wrote to memory of 1784	1940	net.exe	net1.exe
PID 1940 wrote to memory of 1784	1940	net.exe	net1.exe
PID 1252 wrote to memory of 1064	1252	0ba6bf5259dd5d60b5b953f87223aa53b1c22d2faee45fb726fce7aaf8f3bbfd.exe	net.exe
PID 1252 wrote to memory of 1064	1252	0ba6bf5259dd5d60b5b953f87223aa53b1c22d2faee45fb726fce7aaf8f3bbfd.exe	net.exe
PID 1252 wrote to memory of 1064	1252	0ba6bf5259dd5d60b5b953f87223aa53b1c22d2faee45fb726fce7aaf8f3bbfd.exe	net.exe
PID 1252 wrote to memory of 1064	1252	0ba6bf5259dd5d60b5b953f87223aa53b1c22d2faee45fb726fce7aaf8f3bbfd.exe	net.exe
PID 1064 wrote to memory of 1492	1064	net.exe	net1.exe
PID 1064 wrote to memory of 1492	1064	net.exe	net1.exe
PID 1064 wrote to memory of 1492	1064	net.exe	net1.exe
PID 1064 wrote to memory of 1492	1064	net.exe	net1.exe

C:\Users\Admin\AppData\Local\Temp\0ba6bf5259dd5d60b5b953f87223aa53b1c22d2faee45fb726fce7aaf8f3bbfd.exe
"C:\Users\Admin\AppData\Local\Temp\0ba6bf5259dd5d60b5b953f87223aa53b1c22d2faee45fb726fce7aaf8f3bbfd.exe"
1⤵
- Drops file in Drivers directory
- Loads dropped DLL
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:1252

C:\Windows\SysWOW64\net.exe
net stop nethttpservice
2⤵
- Suspicious use of WriteProcessMemory
PID:520

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop nethttpservice
3⤵
PID:1092

C:\Windows\SysWOW64\net.exe
net stop serviceupdater
2⤵
- Suspicious use of WriteProcessMemory
PID:1320

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop serviceupdater
3⤵
PID:1288

C:\Windows\SysWOW64\installd.exe
"C:\Windows\system32\installd.exe" nethfdrv
2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:824

C:\Windows\SysWOW64\nethtsrv.exe
"C:\Windows\system32\nethtsrv.exe" -nfdi
2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1728

C:\Windows\SysWOW64\netupdsrv.exe
"C:\Windows\system32\netupdsrv.exe" -nfdi
2⤵
- Executes dropped EXE
PID:812

C:\Windows\SysWOW64\net.exe
net start nethttpservice
2⤵
- Suspicious use of WriteProcessMemory
PID:1940

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 start nethttpservice
3⤵
PID:1784

C:\Windows\SysWOW64\net.exe
net start serviceupdater
2⤵
- Suspicious use of WriteProcessMemory
PID:1064

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 start serviceupdater
3⤵
PID:1492

C:\Windows\SysWOW64\nethtsrv.exe
C:\Windows\SysWOW64\nethtsrv.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:924

C:\Windows\SysWOW64\netupdsrv.exe
C:\Windows\SysWOW64\netupdsrv.exe
1⤵
- Executes dropped EXE
PID:1716

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\hfnapi.dll
Filesize
106KB

MD5
7f0b44124e8c29a00e704762fcae1848

SHA1
fc84cd3b64540aa2270b16acf6039ff19b19e054

SHA256
951291b5ff4e4aaee629f9f67e0c82a4a3841d5457afaa16fef4666dd171bef7

SHA512
dba644763036e9a7c1f960b7e2c07de9c295d4ff1a7dcd7ecccc7294c5332dda5aaf187f7f9ca870ac40ada10f305f7c184ca0f1380cb30c7f5f6a9c12264631

Download Submit
C:\Windows\SysWOW64\hfpapi.dll
Filesize
244KB

MD5
3a709a7e366acf4ac8f16ec37ae9f654

SHA1
c14d7d44192520191e6ba573ef0d8b61b310fd21

SHA256
5a82867e413b7f98de1b79f2268fd663da1672805e6029b94ef4244e385cb729

SHA512
e1a67b65bbb07ee486c73e2f163c43b7a68f1103178b2733141f6e50ae078896bd911fb418a6d4ba034d9c25e6272842a1e94f3c304d5b936be43f744c9d7080

Download Submit
C:\Windows\SysWOW64\installd.exe
Filesize
108KB

MD5
3fe186fc971932d0cf611301e6f00b1d

SHA1
37e261d7e2b36e6592b70e5ccd2a0c23004d45ae

SHA256
887196f705925251e58ad34cf4a0ee5e9e5687304c257bd2aba0bdf39ad66a98

SHA512
f3efcc2bcc9990fd89b71998bc308ac24b4fc70c9a5eb25dfd51c5fa8df207c90ac77f2a39071c5090ed384442e38d351618ce98b3df113f4cab67ca7415781b

Download Submit
C:\Windows\SysWOW64\nethtsrv.exe
Filesize
176KB

MD5
e8cffcbd3e92e880cbee4dfac4eeadfc

SHA1
7cedd041f888543a92c214f12d1f543479f458ed

SHA256
bf08b867a6c7cdd44d31ac7f1e0413937e0b492244243d66708468ebb5b7c423

SHA512
8739892b10eb92c849ca80bbfdfe137d11aa5d542387bd12adc1f56ca1dd2a0c9f78b858ff1ecec91abdacca77c62b05625b40bf4ca057ae66ecd619cba73524

Download Submit
C:\Windows\SysWOW64\nethtsrv.exe
Filesize
176KB

MD5
e8cffcbd3e92e880cbee4dfac4eeadfc

SHA1
7cedd041f888543a92c214f12d1f543479f458ed

SHA256
bf08b867a6c7cdd44d31ac7f1e0413937e0b492244243d66708468ebb5b7c423

SHA512
8739892b10eb92c849ca80bbfdfe137d11aa5d542387bd12adc1f56ca1dd2a0c9f78b858ff1ecec91abdacca77c62b05625b40bf4ca057ae66ecd619cba73524

Download Submit
C:\Windows\SysWOW64\netupdsrv.exe
Filesize
158KB

MD5
a8bd39c9cc25d79b2e3e49b1008df015

SHA1
ab90488f3def6674e0916a8789bc577132a062a0

SHA256
29ddf139dca19220ce7476e9bbf43a3cc55bba706d9982ef044b6bcee3b42d9b

SHA512
fda7f0270f5ddb8d080e4773c38a2c0e64f534fd0aeee560ab5aed0ef46630054b9000a9c78a44b60218c0a1d0bab9e0547bc7ce942110cd800f38d7e28ff735

Download Submit
C:\Windows\SysWOW64\netupdsrv.exe
Filesize
158KB

MD5
a8bd39c9cc25d79b2e3e49b1008df015

SHA1
ab90488f3def6674e0916a8789bc577132a062a0

SHA256
29ddf139dca19220ce7476e9bbf43a3cc55bba706d9982ef044b6bcee3b42d9b

SHA512
fda7f0270f5ddb8d080e4773c38a2c0e64f534fd0aeee560ab5aed0ef46630054b9000a9c78a44b60218c0a1d0bab9e0547bc7ce942110cd800f38d7e28ff735

Download Submit
\Users\Admin\AppData\Local\Temp\nsjF357.tmp\System.dll
Filesize
11KB

MD5
c17103ae9072a06da581dec998343fc1

SHA1
b72148c6bdfaada8b8c3f950e610ee7cf1da1f8d

SHA256
dc58d8ad81cacb0c1ed72e33bff8f23ea40b5252b5bb55d393a0903e6819ae2f

SHA512
d32a71aaef18e993f28096d536e41c4d016850721b31171513ce28bbd805a54fd290b7c3e9d935f72e676a1acfb4f0dcc89d95040a0dd29f2b6975855c18986f

Download Submit
\Users\Admin\AppData\Local\Temp\nsjF357.tmp\nsExec.dll
Filesize
6KB

MD5
acc2b699edfea5bf5aae45aba3a41e96

SHA1
d2accf4d494e43ceb2cff69abe4dd17147d29cc2

SHA256
168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e

SHA512
e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe

Download Submit
\Users\Admin\AppData\Local\Temp\nsjF357.tmp\nsExec.dll
Filesize
6KB

MD5
acc2b699edfea5bf5aae45aba3a41e96

SHA1
d2accf4d494e43ceb2cff69abe4dd17147d29cc2

SHA256
168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e

SHA512
e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe

Download Submit
\Users\Admin\AppData\Local\Temp\nsjF357.tmp\nsExec.dll
Filesize
6KB

MD5
acc2b699edfea5bf5aae45aba3a41e96

SHA1
d2accf4d494e43ceb2cff69abe4dd17147d29cc2

SHA256
168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e

SHA512
e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe

Download Submit
\Users\Admin\AppData\Local\Temp\nsjF357.tmp\nsExec.dll
Filesize
6KB

MD5
acc2b699edfea5bf5aae45aba3a41e96

SHA1
d2accf4d494e43ceb2cff69abe4dd17147d29cc2

SHA256
168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e

SHA512
e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe

Download Submit
\Windows\SysWOW64\hfnapi.dll
Filesize
106KB

MD5
7f0b44124e8c29a00e704762fcae1848

SHA1
fc84cd3b64540aa2270b16acf6039ff19b19e054

SHA256
951291b5ff4e4aaee629f9f67e0c82a4a3841d5457afaa16fef4666dd171bef7

SHA512
dba644763036e9a7c1f960b7e2c07de9c295d4ff1a7dcd7ecccc7294c5332dda5aaf187f7f9ca870ac40ada10f305f7c184ca0f1380cb30c7f5f6a9c12264631

Download Submit
\Windows\SysWOW64\hfnapi.dll
Filesize
106KB

MD5
7f0b44124e8c29a00e704762fcae1848

SHA1
fc84cd3b64540aa2270b16acf6039ff19b19e054

SHA256
951291b5ff4e4aaee629f9f67e0c82a4a3841d5457afaa16fef4666dd171bef7

SHA512
dba644763036e9a7c1f960b7e2c07de9c295d4ff1a7dcd7ecccc7294c5332dda5aaf187f7f9ca870ac40ada10f305f7c184ca0f1380cb30c7f5f6a9c12264631

Download Submit
\Windows\SysWOW64\hfnapi.dll
Filesize
106KB

MD5
7f0b44124e8c29a00e704762fcae1848

SHA1
fc84cd3b64540aa2270b16acf6039ff19b19e054

SHA256
951291b5ff4e4aaee629f9f67e0c82a4a3841d5457afaa16fef4666dd171bef7

SHA512
dba644763036e9a7c1f960b7e2c07de9c295d4ff1a7dcd7ecccc7294c5332dda5aaf187f7f9ca870ac40ada10f305f7c184ca0f1380cb30c7f5f6a9c12264631

Download Submit
\Windows\SysWOW64\hfpapi.dll
Filesize
244KB

MD5
3a709a7e366acf4ac8f16ec37ae9f654

SHA1
c14d7d44192520191e6ba573ef0d8b61b310fd21

SHA256
5a82867e413b7f98de1b79f2268fd663da1672805e6029b94ef4244e385cb729

SHA512
e1a67b65bbb07ee486c73e2f163c43b7a68f1103178b2733141f6e50ae078896bd911fb418a6d4ba034d9c25e6272842a1e94f3c304d5b936be43f744c9d7080

Download Submit
\Windows\SysWOW64\hfpapi.dll
Filesize
244KB

MD5
3a709a7e366acf4ac8f16ec37ae9f654

SHA1
c14d7d44192520191e6ba573ef0d8b61b310fd21

SHA256
5a82867e413b7f98de1b79f2268fd663da1672805e6029b94ef4244e385cb729

SHA512
e1a67b65bbb07ee486c73e2f163c43b7a68f1103178b2733141f6e50ae078896bd911fb418a6d4ba034d9c25e6272842a1e94f3c304d5b936be43f744c9d7080

Download Submit
\Windows\SysWOW64\installd.exe
Filesize
108KB

MD5
3fe186fc971932d0cf611301e6f00b1d

SHA1
37e261d7e2b36e6592b70e5ccd2a0c23004d45ae

SHA256
887196f705925251e58ad34cf4a0ee5e9e5687304c257bd2aba0bdf39ad66a98

SHA512
f3efcc2bcc9990fd89b71998bc308ac24b4fc70c9a5eb25dfd51c5fa8df207c90ac77f2a39071c5090ed384442e38d351618ce98b3df113f4cab67ca7415781b

Download Submit
\Windows\SysWOW64\nethtsrv.exe
Filesize
176KB

MD5
e8cffcbd3e92e880cbee4dfac4eeadfc

SHA1
7cedd041f888543a92c214f12d1f543479f458ed

SHA256
bf08b867a6c7cdd44d31ac7f1e0413937e0b492244243d66708468ebb5b7c423

SHA512
8739892b10eb92c849ca80bbfdfe137d11aa5d542387bd12adc1f56ca1dd2a0c9f78b858ff1ecec91abdacca77c62b05625b40bf4ca057ae66ecd619cba73524

Download Submit
\Windows\SysWOW64\netupdsrv.exe
Filesize
158KB

MD5
a8bd39c9cc25d79b2e3e49b1008df015

SHA1
ab90488f3def6674e0916a8789bc577132a062a0

SHA256
29ddf139dca19220ce7476e9bbf43a3cc55bba706d9982ef044b6bcee3b42d9b

SHA512
fda7f0270f5ddb8d080e4773c38a2c0e64f534fd0aeee560ab5aed0ef46630054b9000a9c78a44b60218c0a1d0bab9e0547bc7ce942110cd800f38d7e28ff735

Download Submit
memory/520-57-0x0000000000000000-mapping.dmp

Download
memory/812-75-0x0000000000000000-mapping.dmp

Download
memory/824-63-0x0000000000000000-mapping.dmp

Download
memory/1064-85-0x0000000000000000-mapping.dmp

Download
memory/1092-58-0x0000000000000000-mapping.dmp

Download
memory/1252-54-0x0000000075CF1000-0x0000000075CF3000-memory.dmp

Filesize
8KB

Download
memory/1288-61-0x0000000000000000-mapping.dmp

Download
memory/1320-60-0x0000000000000000-mapping.dmp

Download
memory/1492-86-0x0000000000000000-mapping.dmp

Download
memory/1728-69-0x0000000000000000-mapping.dmp

Download
memory/1784-80-0x0000000000000000-mapping.dmp

Download
memory/1940-79-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads