191cb3a79e87499c9954f7ba837e6353c548764afd81f12dd73b1dd753d285c2

Analysis

max time kernel
35s
max time network
41s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
23-11-2022 10:59

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

191cb3a79e87499c9954f7ba837e6353c548764afd81f12dd73b1dd753d285c2.exe
Size

445KB
MD5

85a530c1f6fa3e3c3f953a6042c9dbbf
SHA1

73f665f457f277f5ff93710b5491a316cd59e235
SHA256

191cb3a79e87499c9954f7ba837e6353c548764afd81f12dd73b1dd753d285c2
SHA512

0651cc875051ac00f5dc6c116ffb2fa932998b7c674862af5dac8811440260899f17436b20fd8aa555da2da17327def9aee6fdb392830118bdb0bf1f455ecf7e
SSDEEP

12288:FmxLhe0XfrZcJRxz3lWAs3oyBrsC7eMm9nGcFt:FmxdNXfrZcLxRW53oyBrssGP

Score

8^/10

discovery

Malware Config

Signatures

Drops file in Drivers directory 1 IoCs

Processes:

191cb3a79e87499c9954f7ba837e6353c548764afd81f12dd73b1dd753d285c2.exe

description ioc process

File created C:\Windows\system32\drivers\nethfdrv.sys 191cb3a79e87499c9954f7ba837e6353c548764afd81f12dd73b1dd753d285c2.exe
Executes dropped EXE 5 IoCs

Processes:

installd.exenethtsrv.exenetupdsrv.exenethtsrv.exenetupdsrv.exe

pid process

1412 installd.exe
1708 nethtsrv.exe
1936 netupdsrv.exe
1296 nethtsrv.exe
1748 netupdsrv.exe

description	ioc	process
File created	C:\Windows\system32\drivers\nethfdrv.sys	191cb3a79e87499c9954f7ba837e6353c548764afd81f12dd73b1dd753d285c2.exe

pid	process
1412	installd.exe
1708	nethtsrv.exe
1936	netupdsrv.exe
1296	nethtsrv.exe
1748	netupdsrv.exe

Loads dropped DLL 13 IoCs

Processes:

191cb3a79e87499c9954f7ba837e6353c548764afd81f12dd73b1dd753d285c2.exeinstalld.exenethtsrv.exenethtsrv.exe

pid	process
1256	191cb3a79e87499c9954f7ba837e6353c548764afd81f12dd73b1dd753d285c2.exe
1256	191cb3a79e87499c9954f7ba837e6353c548764afd81f12dd73b1dd753d285c2.exe
1256	191cb3a79e87499c9954f7ba837e6353c548764afd81f12dd73b1dd753d285c2.exe
1256	191cb3a79e87499c9954f7ba837e6353c548764afd81f12dd73b1dd753d285c2.exe
1412	installd.exe
1256	191cb3a79e87499c9954f7ba837e6353c548764afd81f12dd73b1dd753d285c2.exe
1708	nethtsrv.exe
1708	nethtsrv.exe
1256	191cb3a79e87499c9954f7ba837e6353c548764afd81f12dd73b1dd753d285c2.exe
1256	191cb3a79e87499c9954f7ba837e6353c548764afd81f12dd73b1dd753d285c2.exe
1296	nethtsrv.exe
1296	nethtsrv.exe
1256	191cb3a79e87499c9954f7ba837e6353c548764afd81f12dd73b1dd753d285c2.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in System32 directory 5 IoCs

Processes:

191cb3a79e87499c9954f7ba837e6353c548764afd81f12dd73b1dd753d285c2.exe

description	ioc	process
File created	C:\Windows\SysWOW64\hfpapi.dll	191cb3a79e87499c9954f7ba837e6353c548764afd81f12dd73b1dd753d285c2.exe
File created	C:\Windows\SysWOW64\installd.exe	191cb3a79e87499c9954f7ba837e6353c548764afd81f12dd73b1dd753d285c2.exe
File created	C:\Windows\SysWOW64\nethtsrv.exe	191cb3a79e87499c9954f7ba837e6353c548764afd81f12dd73b1dd753d285c2.exe
File created	C:\Windows\SysWOW64\netupdsrv.exe	191cb3a79e87499c9954f7ba837e6353c548764afd81f12dd73b1dd753d285c2.exe
File created	C:\Windows\SysWOW64\hfnapi.dll	191cb3a79e87499c9954f7ba837e6353c548764afd81f12dd73b1dd753d285c2.exe

Drops file in Program Files directory 3 IoCs

Processes:

191cb3a79e87499c9954f7ba837e6353c548764afd81f12dd73b1dd753d285c2.exe

description	ioc	process
File created	C:\Program Files (x86)\Common Files\Config\data.xml	191cb3a79e87499c9954f7ba837e6353c548764afd81f12dd73b1dd753d285c2.exe
File created	C:\Program Files (x86)\Common Files\Config\ver.xml	191cb3a79e87499c9954f7ba837e6353c548764afd81f12dd73b1dd753d285c2.exe
File created	C:\Program Files (x86)\Common Files\config\uninstinethnfd.exe	191cb3a79e87499c9954f7ba837e6353c548764afd81f12dd73b1dd753d285c2.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Runs net.exe
Suspicious behavior: LoadsDriver 1 IoCs

Processes:

pid process

460
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

nethtsrv.exe

description pid process

Token: SeDebugPrivilege 1296 nethtsrv.exe

pid	process
460

description	pid	process
Token: SeDebugPrivilege	1296	nethtsrv.exe

Suspicious use of WriteProcessMemory 50 IoCs

Processes:

191cb3a79e87499c9954f7ba837e6353c548764afd81f12dd73b1dd753d285c2.exenet.exenet.exenet.exenet.exe

description	pid	process	target process
PID 1256 wrote to memory of 1984	1256	191cb3a79e87499c9954f7ba837e6353c548764afd81f12dd73b1dd753d285c2.exe	net.exe
PID 1256 wrote to memory of 1984	1256	191cb3a79e87499c9954f7ba837e6353c548764afd81f12dd73b1dd753d285c2.exe	net.exe
PID 1256 wrote to memory of 1984	1256	191cb3a79e87499c9954f7ba837e6353c548764afd81f12dd73b1dd753d285c2.exe	net.exe
PID 1256 wrote to memory of 1984	1256	191cb3a79e87499c9954f7ba837e6353c548764afd81f12dd73b1dd753d285c2.exe	net.exe
PID 1984 wrote to memory of 1408	1984	net.exe	net1.exe
PID 1984 wrote to memory of 1408	1984	net.exe	net1.exe
PID 1984 wrote to memory of 1408	1984	net.exe	net1.exe
PID 1984 wrote to memory of 1408	1984	net.exe	net1.exe
PID 1256 wrote to memory of 1604	1256	191cb3a79e87499c9954f7ba837e6353c548764afd81f12dd73b1dd753d285c2.exe	net.exe
PID 1256 wrote to memory of 1604	1256	191cb3a79e87499c9954f7ba837e6353c548764afd81f12dd73b1dd753d285c2.exe	net.exe
PID 1256 wrote to memory of 1604	1256	191cb3a79e87499c9954f7ba837e6353c548764afd81f12dd73b1dd753d285c2.exe	net.exe
PID 1256 wrote to memory of 1604	1256	191cb3a79e87499c9954f7ba837e6353c548764afd81f12dd73b1dd753d285c2.exe	net.exe
PID 1604 wrote to memory of 828	1604	net.exe	net1.exe
PID 1604 wrote to memory of 828	1604	net.exe	net1.exe
PID 1604 wrote to memory of 828	1604	net.exe	net1.exe
PID 1604 wrote to memory of 828	1604	net.exe	net1.exe
PID 1256 wrote to memory of 1412	1256	191cb3a79e87499c9954f7ba837e6353c548764afd81f12dd73b1dd753d285c2.exe	installd.exe
PID 1256 wrote to memory of 1412	1256	191cb3a79e87499c9954f7ba837e6353c548764afd81f12dd73b1dd753d285c2.exe	installd.exe
PID 1256 wrote to memory of 1412	1256	191cb3a79e87499c9954f7ba837e6353c548764afd81f12dd73b1dd753d285c2.exe	installd.exe
PID 1256 wrote to memory of 1412	1256	191cb3a79e87499c9954f7ba837e6353c548764afd81f12dd73b1dd753d285c2.exe	installd.exe
PID 1256 wrote to memory of 1412	1256	191cb3a79e87499c9954f7ba837e6353c548764afd81f12dd73b1dd753d285c2.exe	installd.exe
PID 1256 wrote to memory of 1412	1256	191cb3a79e87499c9954f7ba837e6353c548764afd81f12dd73b1dd753d285c2.exe	installd.exe
PID 1256 wrote to memory of 1412	1256	191cb3a79e87499c9954f7ba837e6353c548764afd81f12dd73b1dd753d285c2.exe	installd.exe
PID 1256 wrote to memory of 1708	1256	191cb3a79e87499c9954f7ba837e6353c548764afd81f12dd73b1dd753d285c2.exe	nethtsrv.exe
PID 1256 wrote to memory of 1708	1256	191cb3a79e87499c9954f7ba837e6353c548764afd81f12dd73b1dd753d285c2.exe	nethtsrv.exe
PID 1256 wrote to memory of 1708	1256	191cb3a79e87499c9954f7ba837e6353c548764afd81f12dd73b1dd753d285c2.exe	nethtsrv.exe
PID 1256 wrote to memory of 1708	1256	191cb3a79e87499c9954f7ba837e6353c548764afd81f12dd73b1dd753d285c2.exe	nethtsrv.exe
PID 1256 wrote to memory of 1936	1256	191cb3a79e87499c9954f7ba837e6353c548764afd81f12dd73b1dd753d285c2.exe	netupdsrv.exe
PID 1256 wrote to memory of 1936	1256	191cb3a79e87499c9954f7ba837e6353c548764afd81f12dd73b1dd753d285c2.exe	netupdsrv.exe
PID 1256 wrote to memory of 1936	1256	191cb3a79e87499c9954f7ba837e6353c548764afd81f12dd73b1dd753d285c2.exe	netupdsrv.exe
PID 1256 wrote to memory of 1936	1256	191cb3a79e87499c9954f7ba837e6353c548764afd81f12dd73b1dd753d285c2.exe	netupdsrv.exe
PID 1256 wrote to memory of 1936	1256	191cb3a79e87499c9954f7ba837e6353c548764afd81f12dd73b1dd753d285c2.exe	netupdsrv.exe
PID 1256 wrote to memory of 1936	1256	191cb3a79e87499c9954f7ba837e6353c548764afd81f12dd73b1dd753d285c2.exe	netupdsrv.exe
PID 1256 wrote to memory of 1936	1256	191cb3a79e87499c9954f7ba837e6353c548764afd81f12dd73b1dd753d285c2.exe	netupdsrv.exe
PID 1256 wrote to memory of 1884	1256	191cb3a79e87499c9954f7ba837e6353c548764afd81f12dd73b1dd753d285c2.exe	net.exe
PID 1256 wrote to memory of 1884	1256	191cb3a79e87499c9954f7ba837e6353c548764afd81f12dd73b1dd753d285c2.exe	net.exe
PID 1256 wrote to memory of 1884	1256	191cb3a79e87499c9954f7ba837e6353c548764afd81f12dd73b1dd753d285c2.exe	net.exe
PID 1256 wrote to memory of 1884	1256	191cb3a79e87499c9954f7ba837e6353c548764afd81f12dd73b1dd753d285c2.exe	net.exe
PID 1884 wrote to memory of 1660	1884	net.exe	net1.exe
PID 1884 wrote to memory of 1660	1884	net.exe	net1.exe
PID 1884 wrote to memory of 1660	1884	net.exe	net1.exe
PID 1884 wrote to memory of 1660	1884	net.exe	net1.exe
PID 1256 wrote to memory of 836	1256	191cb3a79e87499c9954f7ba837e6353c548764afd81f12dd73b1dd753d285c2.exe	net.exe
PID 1256 wrote to memory of 836	1256	191cb3a79e87499c9954f7ba837e6353c548764afd81f12dd73b1dd753d285c2.exe	net.exe
PID 1256 wrote to memory of 836	1256	191cb3a79e87499c9954f7ba837e6353c548764afd81f12dd73b1dd753d285c2.exe	net.exe
PID 1256 wrote to memory of 836	1256	191cb3a79e87499c9954f7ba837e6353c548764afd81f12dd73b1dd753d285c2.exe	net.exe
PID 836 wrote to memory of 968	836	net.exe	net1.exe
PID 836 wrote to memory of 968	836	net.exe	net1.exe
PID 836 wrote to memory of 968	836	net.exe	net1.exe
PID 836 wrote to memory of 968	836	net.exe	net1.exe

C:\Users\Admin\AppData\Local\Temp\191cb3a79e87499c9954f7ba837e6353c548764afd81f12dd73b1dd753d285c2.exe
"C:\Users\Admin\AppData\Local\Temp\191cb3a79e87499c9954f7ba837e6353c548764afd81f12dd73b1dd753d285c2.exe"
1⤵
- Drops file in Drivers directory
- Loads dropped DLL
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:1256

C:\Windows\SysWOW64\net.exe
net stop nethttpservice
2⤵
- Suspicious use of WriteProcessMemory
PID:1984

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop nethttpservice
3⤵
PID:1408

C:\Windows\SysWOW64\net.exe
net stop serviceupdater
2⤵
- Suspicious use of WriteProcessMemory
PID:1604

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop serviceupdater
3⤵
PID:828

C:\Windows\SysWOW64\installd.exe
"C:\Windows\system32\installd.exe" nethfdrv
2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1412

C:\Windows\SysWOW64\nethtsrv.exe
"C:\Windows\system32\nethtsrv.exe" -nfdi
2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1708

C:\Windows\SysWOW64\netupdsrv.exe
"C:\Windows\system32\netupdsrv.exe" -nfdi
2⤵
- Executes dropped EXE
PID:1936

C:\Windows\SysWOW64\net.exe
net start nethttpservice
2⤵
- Suspicious use of WriteProcessMemory
PID:1884

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 start nethttpservice
3⤵
PID:1660

C:\Windows\SysWOW64\net.exe
net start serviceupdater
2⤵
- Suspicious use of WriteProcessMemory
PID:836

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 start serviceupdater
3⤵
PID:968

C:\Windows\SysWOW64\nethtsrv.exe
C:\Windows\SysWOW64\nethtsrv.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:1296

C:\Windows\SysWOW64\netupdsrv.exe
C:\Windows\SysWOW64\netupdsrv.exe
1⤵
- Executes dropped EXE
PID:1748

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\hfnapi.dll
Filesize
106KB

MD5
d4a16f319dbc3b63f898907891348fe1

SHA1
6622f0fe7359c6d0128107e12031df2e5c541fea

SHA256
eda146048a60dcee4fcd800cbed447ea7f2c684fc77bebb91761f4de2a014308

SHA512
9b402853217f8dd0730045553b252673110edaa233f244691fa03ed1cde9b8ac221f408424ab91fa23ea0e2912ce0b979d8c1c5be024d2dc3245e261cb04d295

Download Submit
C:\Windows\SysWOW64\hfpapi.dll
Filesize
241KB

MD5
f5998b172e73f60ed8a1b0450b6ee31b

SHA1
1ba1f72661dfb28c81dd83de69f63c9f32afd2e8

SHA256
69ea19a9b4d793f659a14a9b97042c4092b7cc8b378a7ecb8074bf15636412f4

SHA512
fc68e13f7ac8a0cdc41d27b6825d9e79ec453396bae0c76b1ea73faa05eaf42933aedcbe1d1e10fac752c0c12a88632886ab86f74c80092b38afafe7144fd085

Download Submit
C:\Windows\SysWOW64\installd.exe
Filesize
108KB

MD5
1754a357c813d9aca606f9accbd29486

SHA1
0fb22315899503e1724e19ffefb5853f2c7650d9

SHA256
1c7fe9112eaf48b321c0dd568d261c950b669b607ae76053964df0d7d1ea5e7a

SHA512
0d5b50ef6628de8bee971e28bf1ce56c1360e8402d1545198642c56bae7b0ed4f85761f6b28cdf6f54654ff2fb455fbefb0189c8ed198cc403e8d9c433b3bac0

Download Submit
C:\Windows\SysWOW64\nethtsrv.exe
Filesize
176KB

MD5
0f4349dbc3cb05b3fc0015696b7eca31

SHA1
4a1559f68448bad41dc297bf3ca3cb6d23d334cb

SHA256
bd89d4eac0352b4342865ba3db63196d2c68df481b55ae4096432031779c8a7f

SHA512
c133663099b0d3d63b7e5237b18f2e8daaffe151f5c44716a9df16acff011d52952db698f6a9b321e867a63f7a4b9af29bc74ab4c1cdd0019d81c83ddce11160

Download Submit
C:\Windows\SysWOW64\nethtsrv.exe
Filesize
176KB

MD5
0f4349dbc3cb05b3fc0015696b7eca31

SHA1
4a1559f68448bad41dc297bf3ca3cb6d23d334cb

SHA256
bd89d4eac0352b4342865ba3db63196d2c68df481b55ae4096432031779c8a7f

SHA512
c133663099b0d3d63b7e5237b18f2e8daaffe151f5c44716a9df16acff011d52952db698f6a9b321e867a63f7a4b9af29bc74ab4c1cdd0019d81c83ddce11160

Download Submit
C:\Windows\SysWOW64\netupdsrv.exe
Filesize
158KB

MD5
3e5ed75fc2ffd0a1b481c3cc319889fb

SHA1
6a22d2a7e3860846397c7ee2e39fe47170029f92

SHA256
66f3b0895f5e150cb1883b9f2c9e18010279347818af3c7398d3dd1b9bdb88af

SHA512
093d97d8c096959f6574872532a335f8115bc152726f0e51319f170161d438aca87f251bbf5b4f9cbf3c87d9e309bfcab1d0f076d534f188cb093657c38dd614

Download Submit
C:\Windows\SysWOW64\netupdsrv.exe
Filesize
158KB

MD5
3e5ed75fc2ffd0a1b481c3cc319889fb

SHA1
6a22d2a7e3860846397c7ee2e39fe47170029f92

SHA256
66f3b0895f5e150cb1883b9f2c9e18010279347818af3c7398d3dd1b9bdb88af

SHA512
093d97d8c096959f6574872532a335f8115bc152726f0e51319f170161d438aca87f251bbf5b4f9cbf3c87d9e309bfcab1d0f076d534f188cb093657c38dd614

Download Submit
\Users\Admin\AppData\Local\Temp\nso5332.tmp\System.dll
Filesize
11KB

MD5
c17103ae9072a06da581dec998343fc1

SHA1
b72148c6bdfaada8b8c3f950e610ee7cf1da1f8d

SHA256
dc58d8ad81cacb0c1ed72e33bff8f23ea40b5252b5bb55d393a0903e6819ae2f

SHA512
d32a71aaef18e993f28096d536e41c4d016850721b31171513ce28bbd805a54fd290b7c3e9d935f72e676a1acfb4f0dcc89d95040a0dd29f2b6975855c18986f

Download Submit
\Users\Admin\AppData\Local\Temp\nso5332.tmp\nsExec.dll
Filesize
6KB

MD5
acc2b699edfea5bf5aae45aba3a41e96

SHA1
d2accf4d494e43ceb2cff69abe4dd17147d29cc2

SHA256
168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e

SHA512
e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe

Download Submit
\Users\Admin\AppData\Local\Temp\nso5332.tmp\nsExec.dll
Filesize
6KB

MD5
acc2b699edfea5bf5aae45aba3a41e96

SHA1
d2accf4d494e43ceb2cff69abe4dd17147d29cc2

SHA256
168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e

SHA512
e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe

Download Submit
\Users\Admin\AppData\Local\Temp\nso5332.tmp\nsExec.dll
Filesize
6KB

MD5
acc2b699edfea5bf5aae45aba3a41e96

SHA1
d2accf4d494e43ceb2cff69abe4dd17147d29cc2

SHA256
168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e

SHA512
e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe

Download Submit
\Users\Admin\AppData\Local\Temp\nso5332.tmp\nsExec.dll
Filesize
6KB

MD5
acc2b699edfea5bf5aae45aba3a41e96

SHA1
d2accf4d494e43ceb2cff69abe4dd17147d29cc2

SHA256
168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e

SHA512
e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe

Download Submit
\Windows\SysWOW64\hfnapi.dll
Filesize
106KB

MD5
d4a16f319dbc3b63f898907891348fe1

SHA1
6622f0fe7359c6d0128107e12031df2e5c541fea

SHA256
eda146048a60dcee4fcd800cbed447ea7f2c684fc77bebb91761f4de2a014308

SHA512
9b402853217f8dd0730045553b252673110edaa233f244691fa03ed1cde9b8ac221f408424ab91fa23ea0e2912ce0b979d8c1c5be024d2dc3245e261cb04d295

Download Submit
\Windows\SysWOW64\hfnapi.dll
Filesize
106KB

MD5
d4a16f319dbc3b63f898907891348fe1

SHA1
6622f0fe7359c6d0128107e12031df2e5c541fea

SHA256
eda146048a60dcee4fcd800cbed447ea7f2c684fc77bebb91761f4de2a014308

SHA512
9b402853217f8dd0730045553b252673110edaa233f244691fa03ed1cde9b8ac221f408424ab91fa23ea0e2912ce0b979d8c1c5be024d2dc3245e261cb04d295

Download Submit
\Windows\SysWOW64\hfnapi.dll
Filesize
106KB

MD5
d4a16f319dbc3b63f898907891348fe1

SHA1
6622f0fe7359c6d0128107e12031df2e5c541fea

SHA256
eda146048a60dcee4fcd800cbed447ea7f2c684fc77bebb91761f4de2a014308

SHA512
9b402853217f8dd0730045553b252673110edaa233f244691fa03ed1cde9b8ac221f408424ab91fa23ea0e2912ce0b979d8c1c5be024d2dc3245e261cb04d295

Download Submit
\Windows\SysWOW64\hfpapi.dll
Filesize
241KB

MD5
f5998b172e73f60ed8a1b0450b6ee31b

SHA1
1ba1f72661dfb28c81dd83de69f63c9f32afd2e8

SHA256
69ea19a9b4d793f659a14a9b97042c4092b7cc8b378a7ecb8074bf15636412f4

SHA512
fc68e13f7ac8a0cdc41d27b6825d9e79ec453396bae0c76b1ea73faa05eaf42933aedcbe1d1e10fac752c0c12a88632886ab86f74c80092b38afafe7144fd085

Download Submit
\Windows\SysWOW64\hfpapi.dll
Filesize
241KB

MD5
f5998b172e73f60ed8a1b0450b6ee31b

SHA1
1ba1f72661dfb28c81dd83de69f63c9f32afd2e8

SHA256
69ea19a9b4d793f659a14a9b97042c4092b7cc8b378a7ecb8074bf15636412f4

SHA512
fc68e13f7ac8a0cdc41d27b6825d9e79ec453396bae0c76b1ea73faa05eaf42933aedcbe1d1e10fac752c0c12a88632886ab86f74c80092b38afafe7144fd085

Download Submit
\Windows\SysWOW64\installd.exe
Filesize
108KB

MD5
1754a357c813d9aca606f9accbd29486

SHA1
0fb22315899503e1724e19ffefb5853f2c7650d9

SHA256
1c7fe9112eaf48b321c0dd568d261c950b669b607ae76053964df0d7d1ea5e7a

SHA512
0d5b50ef6628de8bee971e28bf1ce56c1360e8402d1545198642c56bae7b0ed4f85761f6b28cdf6f54654ff2fb455fbefb0189c8ed198cc403e8d9c433b3bac0

Download Submit
\Windows\SysWOW64\nethtsrv.exe
Filesize
176KB

MD5
0f4349dbc3cb05b3fc0015696b7eca31

SHA1
4a1559f68448bad41dc297bf3ca3cb6d23d334cb

SHA256
bd89d4eac0352b4342865ba3db63196d2c68df481b55ae4096432031779c8a7f

SHA512
c133663099b0d3d63b7e5237b18f2e8daaffe151f5c44716a9df16acff011d52952db698f6a9b321e867a63f7a4b9af29bc74ab4c1cdd0019d81c83ddce11160

Download Submit
\Windows\SysWOW64\netupdsrv.exe
Filesize
158KB

MD5
3e5ed75fc2ffd0a1b481c3cc319889fb

SHA1
6a22d2a7e3860846397c7ee2e39fe47170029f92

SHA256
66f3b0895f5e150cb1883b9f2c9e18010279347818af3c7398d3dd1b9bdb88af

SHA512
093d97d8c096959f6574872532a335f8115bc152726f0e51319f170161d438aca87f251bbf5b4f9cbf3c87d9e309bfcab1d0f076d534f188cb093657c38dd614

Download Submit
memory/828-61-0x0000000000000000-mapping.dmp

Download
memory/836-85-0x0000000000000000-mapping.dmp

Download
memory/968-86-0x0000000000000000-mapping.dmp

Download
memory/1256-54-0x0000000075C61000-0x0000000075C63000-memory.dmp

Filesize
8KB

Download
memory/1408-58-0x0000000000000000-mapping.dmp

Download
memory/1412-63-0x0000000000000000-mapping.dmp

Download
memory/1604-60-0x0000000000000000-mapping.dmp

Download
memory/1660-80-0x0000000000000000-mapping.dmp

Download
memory/1708-69-0x0000000000000000-mapping.dmp

Download
memory/1884-79-0x0000000000000000-mapping.dmp

Download
memory/1936-75-0x0000000000000000-mapping.dmp

Download
memory/1984-57-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads