13b334243e130e7b0b261a4c72e4b1a2d3219e8899b5a4eb2c3c9435faa2abaa

Analysis

max time kernel
42s
max time network
45s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
23-11-2022 11:00

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

13b334243e130e7b0b261a4c72e4b1a2d3219e8899b5a4eb2c3c9435faa2abaa.exe
Size

446KB
MD5

44fa6a39a1fba70f665c343093960c71
SHA1

805aaa96cb048f5c61cd416623f1c76318f0932e
SHA256

13b334243e130e7b0b261a4c72e4b1a2d3219e8899b5a4eb2c3c9435faa2abaa
SHA512

ec5a6052fbf7eedf8f867e1881e70f304b9655e5c80880f8b9b97063f948a727bc89b8287d30ec8b8b950e3d30db254329d384c41cdd6b6f1d94fe286475cd47
SSDEEP

12288:99UCJhukcjcwE46Ui3Tk6vy972VjfMd5XrT:99fvcj0BDZO7ggXrT

Score

8^/10

discovery

Malware Config

Signatures

Drops file in Drivers directory 1 IoCs

Processes:

13b334243e130e7b0b261a4c72e4b1a2d3219e8899b5a4eb2c3c9435faa2abaa.exe

description ioc process

File created C:\Windows\system32\drivers\nethfdrv.sys 13b334243e130e7b0b261a4c72e4b1a2d3219e8899b5a4eb2c3c9435faa2abaa.exe
Executes dropped EXE 5 IoCs

Processes:

installd.exenethtsrv.exenetupdsrv.exenethtsrv.exenetupdsrv.exe

pid process

1708 installd.exe
1960 nethtsrv.exe
1092 netupdsrv.exe
1848 nethtsrv.exe
684 netupdsrv.exe

description	ioc	process
File created	C:\Windows\system32\drivers\nethfdrv.sys	13b334243e130e7b0b261a4c72e4b1a2d3219e8899b5a4eb2c3c9435faa2abaa.exe

pid	process
1708	installd.exe
1960	nethtsrv.exe
1092	netupdsrv.exe
1848	nethtsrv.exe
684	netupdsrv.exe

Loads dropped DLL 13 IoCs

Processes:

13b334243e130e7b0b261a4c72e4b1a2d3219e8899b5a4eb2c3c9435faa2abaa.exeinstalld.exenethtsrv.exenethtsrv.exe

pid	process
1636	13b334243e130e7b0b261a4c72e4b1a2d3219e8899b5a4eb2c3c9435faa2abaa.exe
1636	13b334243e130e7b0b261a4c72e4b1a2d3219e8899b5a4eb2c3c9435faa2abaa.exe
1636	13b334243e130e7b0b261a4c72e4b1a2d3219e8899b5a4eb2c3c9435faa2abaa.exe
1636	13b334243e130e7b0b261a4c72e4b1a2d3219e8899b5a4eb2c3c9435faa2abaa.exe
1708	installd.exe
1636	13b334243e130e7b0b261a4c72e4b1a2d3219e8899b5a4eb2c3c9435faa2abaa.exe
1960	nethtsrv.exe
1960	nethtsrv.exe
1636	13b334243e130e7b0b261a4c72e4b1a2d3219e8899b5a4eb2c3c9435faa2abaa.exe
1636	13b334243e130e7b0b261a4c72e4b1a2d3219e8899b5a4eb2c3c9435faa2abaa.exe
1848	nethtsrv.exe
1848	nethtsrv.exe
1636	13b334243e130e7b0b261a4c72e4b1a2d3219e8899b5a4eb2c3c9435faa2abaa.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in System32 directory 5 IoCs

Processes:

13b334243e130e7b0b261a4c72e4b1a2d3219e8899b5a4eb2c3c9435faa2abaa.exe

description	ioc	process
File created	C:\Windows\SysWOW64\hfnapi.dll	13b334243e130e7b0b261a4c72e4b1a2d3219e8899b5a4eb2c3c9435faa2abaa.exe
File created	C:\Windows\SysWOW64\hfpapi.dll	13b334243e130e7b0b261a4c72e4b1a2d3219e8899b5a4eb2c3c9435faa2abaa.exe
File created	C:\Windows\SysWOW64\installd.exe	13b334243e130e7b0b261a4c72e4b1a2d3219e8899b5a4eb2c3c9435faa2abaa.exe
File created	C:\Windows\SysWOW64\nethtsrv.exe	13b334243e130e7b0b261a4c72e4b1a2d3219e8899b5a4eb2c3c9435faa2abaa.exe
File created	C:\Windows\SysWOW64\netupdsrv.exe	13b334243e130e7b0b261a4c72e4b1a2d3219e8899b5a4eb2c3c9435faa2abaa.exe

Drops file in Program Files directory 3 IoCs

Processes:

13b334243e130e7b0b261a4c72e4b1a2d3219e8899b5a4eb2c3c9435faa2abaa.exe

description	ioc	process
File created	C:\Program Files (x86)\Common Files\Config\ver.xml	13b334243e130e7b0b261a4c72e4b1a2d3219e8899b5a4eb2c3c9435faa2abaa.exe
File created	C:\Program Files (x86)\Common Files\config\uninstinethnfd.exe	13b334243e130e7b0b261a4c72e4b1a2d3219e8899b5a4eb2c3c9435faa2abaa.exe
File created	C:\Program Files (x86)\Common Files\Config\data.xml	13b334243e130e7b0b261a4c72e4b1a2d3219e8899b5a4eb2c3c9435faa2abaa.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Runs net.exe
Suspicious behavior: LoadsDriver 1 IoCs

Processes:

pid process

472
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

nethtsrv.exe

description pid process

Token: SeDebugPrivilege 1848 nethtsrv.exe

pid	process
472

description	pid	process
Token: SeDebugPrivilege	1848	nethtsrv.exe

Suspicious use of WriteProcessMemory 50 IoCs

Processes:

13b334243e130e7b0b261a4c72e4b1a2d3219e8899b5a4eb2c3c9435faa2abaa.exenet.exenet.exenet.exenet.exe

description	pid	process	target process
PID 1636 wrote to memory of 844	1636	13b334243e130e7b0b261a4c72e4b1a2d3219e8899b5a4eb2c3c9435faa2abaa.exe	net.exe
PID 1636 wrote to memory of 844	1636	13b334243e130e7b0b261a4c72e4b1a2d3219e8899b5a4eb2c3c9435faa2abaa.exe	net.exe
PID 1636 wrote to memory of 844	1636	13b334243e130e7b0b261a4c72e4b1a2d3219e8899b5a4eb2c3c9435faa2abaa.exe	net.exe
PID 1636 wrote to memory of 844	1636	13b334243e130e7b0b261a4c72e4b1a2d3219e8899b5a4eb2c3c9435faa2abaa.exe	net.exe
PID 844 wrote to memory of 1340	844	net.exe	net1.exe
PID 844 wrote to memory of 1340	844	net.exe	net1.exe
PID 844 wrote to memory of 1340	844	net.exe	net1.exe
PID 844 wrote to memory of 1340	844	net.exe	net1.exe
PID 1636 wrote to memory of 1336	1636	13b334243e130e7b0b261a4c72e4b1a2d3219e8899b5a4eb2c3c9435faa2abaa.exe	net.exe
PID 1636 wrote to memory of 1336	1636	13b334243e130e7b0b261a4c72e4b1a2d3219e8899b5a4eb2c3c9435faa2abaa.exe	net.exe
PID 1636 wrote to memory of 1336	1636	13b334243e130e7b0b261a4c72e4b1a2d3219e8899b5a4eb2c3c9435faa2abaa.exe	net.exe
PID 1636 wrote to memory of 1336	1636	13b334243e130e7b0b261a4c72e4b1a2d3219e8899b5a4eb2c3c9435faa2abaa.exe	net.exe
PID 1336 wrote to memory of 1136	1336	net.exe	net1.exe
PID 1336 wrote to memory of 1136	1336	net.exe	net1.exe
PID 1336 wrote to memory of 1136	1336	net.exe	net1.exe
PID 1336 wrote to memory of 1136	1336	net.exe	net1.exe
PID 1636 wrote to memory of 1708	1636	13b334243e130e7b0b261a4c72e4b1a2d3219e8899b5a4eb2c3c9435faa2abaa.exe	installd.exe
PID 1636 wrote to memory of 1708	1636	13b334243e130e7b0b261a4c72e4b1a2d3219e8899b5a4eb2c3c9435faa2abaa.exe	installd.exe
PID 1636 wrote to memory of 1708	1636	13b334243e130e7b0b261a4c72e4b1a2d3219e8899b5a4eb2c3c9435faa2abaa.exe	installd.exe
PID 1636 wrote to memory of 1708	1636	13b334243e130e7b0b261a4c72e4b1a2d3219e8899b5a4eb2c3c9435faa2abaa.exe	installd.exe
PID 1636 wrote to memory of 1708	1636	13b334243e130e7b0b261a4c72e4b1a2d3219e8899b5a4eb2c3c9435faa2abaa.exe	installd.exe
PID 1636 wrote to memory of 1708	1636	13b334243e130e7b0b261a4c72e4b1a2d3219e8899b5a4eb2c3c9435faa2abaa.exe	installd.exe
PID 1636 wrote to memory of 1708	1636	13b334243e130e7b0b261a4c72e4b1a2d3219e8899b5a4eb2c3c9435faa2abaa.exe	installd.exe
PID 1636 wrote to memory of 1960	1636	13b334243e130e7b0b261a4c72e4b1a2d3219e8899b5a4eb2c3c9435faa2abaa.exe	nethtsrv.exe
PID 1636 wrote to memory of 1960	1636	13b334243e130e7b0b261a4c72e4b1a2d3219e8899b5a4eb2c3c9435faa2abaa.exe	nethtsrv.exe
PID 1636 wrote to memory of 1960	1636	13b334243e130e7b0b261a4c72e4b1a2d3219e8899b5a4eb2c3c9435faa2abaa.exe	nethtsrv.exe
PID 1636 wrote to memory of 1960	1636	13b334243e130e7b0b261a4c72e4b1a2d3219e8899b5a4eb2c3c9435faa2abaa.exe	nethtsrv.exe
PID 1636 wrote to memory of 1092	1636	13b334243e130e7b0b261a4c72e4b1a2d3219e8899b5a4eb2c3c9435faa2abaa.exe	netupdsrv.exe
PID 1636 wrote to memory of 1092	1636	13b334243e130e7b0b261a4c72e4b1a2d3219e8899b5a4eb2c3c9435faa2abaa.exe	netupdsrv.exe
PID 1636 wrote to memory of 1092	1636	13b334243e130e7b0b261a4c72e4b1a2d3219e8899b5a4eb2c3c9435faa2abaa.exe	netupdsrv.exe
PID 1636 wrote to memory of 1092	1636	13b334243e130e7b0b261a4c72e4b1a2d3219e8899b5a4eb2c3c9435faa2abaa.exe	netupdsrv.exe
PID 1636 wrote to memory of 1092	1636	13b334243e130e7b0b261a4c72e4b1a2d3219e8899b5a4eb2c3c9435faa2abaa.exe	netupdsrv.exe
PID 1636 wrote to memory of 1092	1636	13b334243e130e7b0b261a4c72e4b1a2d3219e8899b5a4eb2c3c9435faa2abaa.exe	netupdsrv.exe
PID 1636 wrote to memory of 1092	1636	13b334243e130e7b0b261a4c72e4b1a2d3219e8899b5a4eb2c3c9435faa2abaa.exe	netupdsrv.exe
PID 1636 wrote to memory of 1744	1636	13b334243e130e7b0b261a4c72e4b1a2d3219e8899b5a4eb2c3c9435faa2abaa.exe	net.exe
PID 1636 wrote to memory of 1744	1636	13b334243e130e7b0b261a4c72e4b1a2d3219e8899b5a4eb2c3c9435faa2abaa.exe	net.exe
PID 1636 wrote to memory of 1744	1636	13b334243e130e7b0b261a4c72e4b1a2d3219e8899b5a4eb2c3c9435faa2abaa.exe	net.exe
PID 1636 wrote to memory of 1744	1636	13b334243e130e7b0b261a4c72e4b1a2d3219e8899b5a4eb2c3c9435faa2abaa.exe	net.exe
PID 1744 wrote to memory of 820	1744	net.exe	net1.exe
PID 1744 wrote to memory of 820	1744	net.exe	net1.exe
PID 1744 wrote to memory of 820	1744	net.exe	net1.exe
PID 1744 wrote to memory of 820	1744	net.exe	net1.exe
PID 1636 wrote to memory of 848	1636	13b334243e130e7b0b261a4c72e4b1a2d3219e8899b5a4eb2c3c9435faa2abaa.exe	net.exe
PID 1636 wrote to memory of 848	1636	13b334243e130e7b0b261a4c72e4b1a2d3219e8899b5a4eb2c3c9435faa2abaa.exe	net.exe
PID 1636 wrote to memory of 848	1636	13b334243e130e7b0b261a4c72e4b1a2d3219e8899b5a4eb2c3c9435faa2abaa.exe	net.exe
PID 1636 wrote to memory of 848	1636	13b334243e130e7b0b261a4c72e4b1a2d3219e8899b5a4eb2c3c9435faa2abaa.exe	net.exe
PID 848 wrote to memory of 972	848	net.exe	net1.exe
PID 848 wrote to memory of 972	848	net.exe	net1.exe
PID 848 wrote to memory of 972	848	net.exe	net1.exe
PID 848 wrote to memory of 972	848	net.exe	net1.exe

C:\Users\Admin\AppData\Local\Temp\13b334243e130e7b0b261a4c72e4b1a2d3219e8899b5a4eb2c3c9435faa2abaa.exe
"C:\Users\Admin\AppData\Local\Temp\13b334243e130e7b0b261a4c72e4b1a2d3219e8899b5a4eb2c3c9435faa2abaa.exe"
1⤵
- Drops file in Drivers directory
- Loads dropped DLL
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:1636

C:\Windows\SysWOW64\net.exe
net stop nethttpservice
2⤵
- Suspicious use of WriteProcessMemory
PID:844

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop nethttpservice
3⤵
PID:1340

C:\Windows\SysWOW64\net.exe
net stop serviceupdater
2⤵
- Suspicious use of WriteProcessMemory
PID:1336

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop serviceupdater
3⤵
PID:1136

C:\Windows\SysWOW64\installd.exe
"C:\Windows\system32\installd.exe" nethfdrv
2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1708

C:\Windows\SysWOW64\nethtsrv.exe
"C:\Windows\system32\nethtsrv.exe" -nfdi
2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1960

C:\Windows\SysWOW64\netupdsrv.exe
"C:\Windows\system32\netupdsrv.exe" -nfdi
2⤵
- Executes dropped EXE
PID:1092

C:\Windows\SysWOW64\net.exe
net start nethttpservice
2⤵
- Suspicious use of WriteProcessMemory
PID:1744

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 start nethttpservice
3⤵
PID:820

C:\Windows\SysWOW64\net.exe
net start serviceupdater
2⤵
- Suspicious use of WriteProcessMemory
PID:848

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 start serviceupdater
3⤵
PID:972

C:\Windows\SysWOW64\nethtsrv.exe
C:\Windows\SysWOW64\nethtsrv.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:1848

C:\Windows\SysWOW64\netupdsrv.exe
C:\Windows\SysWOW64\netupdsrv.exe
1⤵
- Executes dropped EXE
PID:684

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\hfnapi.dll
Filesize
106KB

MD5
660530cd22e2bab286a4d5692d3385cc

SHA1
a80fdc470f80e3ebdb54d78d03c8b3de835e9927

SHA256
bdefb791241912b773452de9866f05b52775910d79da6bc573b545fd3abb9ef3

SHA512
dcfb48fc16916e2732ca34735b01da9e56f09a5ca3650e8f9962cc16fecf0c65362e27138bd2a14e18bf47d1cadf748452e645e13c79e1c6f6a21386426e27dc

Download Submit
C:\Windows\SysWOW64\hfpapi.dll
Filesize
241KB

MD5
e247f5c0c62b8c8fa017bef20b27938c

SHA1
5fb3a46ccbe5160c1039e702ac84cb23b5318fcc

SHA256
a407151c3e0029471415c40ae614e8af4b19f96838312a466e269d5bf7698720

SHA512
e6e5312fea4bd7ca8f5b0b53264ac4513bda197d149634d522cd7e0278fa1834d1b5d37ea2fd425eca9573dee6902af4ad0771042c77cb5dc42eead358746089

Download Submit
C:\Windows\SysWOW64\installd.exe
Filesize
108KB

MD5
f7e4badaa20b05ed3e70fa43a53766b2

SHA1
08e261b6588ace0c85ecf34394c028eedb078185

SHA256
f45637cbc4a9278fa9ee891d1708d81a239a1714689777ab3b4cb16a0069ce92

SHA512
698334ae971730abd396f5b9e3dbdcd84881d70e30d218a446f09838b3a3ce286782a89f1239c9ab197b80e03d13202bea9455a866acacd20854f5652505a276

Download Submit
C:\Windows\SysWOW64\nethtsrv.exe
Filesize
176KB

MD5
2939709ad3ea0a15ef1cb51b30623023

SHA1
ac3d438e68961a0a3a5bbdcd07f0722f489ba120

SHA256
94c9f49aeff5947d4cf60daa711e357f7fd913330ccabc6e0bd29ad64f5d944b

SHA512
d01885e3f9a76e713653123c8903b1b9745dbb79aa06945224647280da580001452bc96d8549e2b20dcbc55f5981c23e322824d24afd350f5f4a4c17f6437855

Download Submit
C:\Windows\SysWOW64\nethtsrv.exe
Filesize
176KB

MD5
2939709ad3ea0a15ef1cb51b30623023

SHA1
ac3d438e68961a0a3a5bbdcd07f0722f489ba120

SHA256
94c9f49aeff5947d4cf60daa711e357f7fd913330ccabc6e0bd29ad64f5d944b

SHA512
d01885e3f9a76e713653123c8903b1b9745dbb79aa06945224647280da580001452bc96d8549e2b20dcbc55f5981c23e322824d24afd350f5f4a4c17f6437855

Download Submit
C:\Windows\SysWOW64\netupdsrv.exe
Filesize
158KB

MD5
2a96d6165e67203fb116a486abccf5d9

SHA1
5f7743955153189f2af84196ec9af26eb659d836

SHA256
6208e021232647442565aa87daf33867e058dda2aa6310bbbd6506ab655682af

SHA512
9a550a6f26f930900f765e805f140efc69557129cad11392a9a0f13aadcaadad5035f97607b752d3a5bcdf31a83c7bdd2147af2f4c865b95768cb67015a5a0a9

Download Submit
C:\Windows\SysWOW64\netupdsrv.exe
Filesize
158KB

MD5
2a96d6165e67203fb116a486abccf5d9

SHA1
5f7743955153189f2af84196ec9af26eb659d836

SHA256
6208e021232647442565aa87daf33867e058dda2aa6310bbbd6506ab655682af

SHA512
9a550a6f26f930900f765e805f140efc69557129cad11392a9a0f13aadcaadad5035f97607b752d3a5bcdf31a83c7bdd2147af2f4c865b95768cb67015a5a0a9

Download Submit
\Users\Admin\AppData\Local\Temp\nstFB91.tmp\System.dll
Filesize
11KB

MD5
c17103ae9072a06da581dec998343fc1

SHA1
b72148c6bdfaada8b8c3f950e610ee7cf1da1f8d

SHA256
dc58d8ad81cacb0c1ed72e33bff8f23ea40b5252b5bb55d393a0903e6819ae2f

SHA512
d32a71aaef18e993f28096d536e41c4d016850721b31171513ce28bbd805a54fd290b7c3e9d935f72e676a1acfb4f0dcc89d95040a0dd29f2b6975855c18986f

Download Submit
\Users\Admin\AppData\Local\Temp\nstFB91.tmp\nsExec.dll
Filesize
6KB

MD5
acc2b699edfea5bf5aae45aba3a41e96

SHA1
d2accf4d494e43ceb2cff69abe4dd17147d29cc2

SHA256
168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e

SHA512
e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe

Download Submit
\Users\Admin\AppData\Local\Temp\nstFB91.tmp\nsExec.dll
Filesize
6KB

MD5
acc2b699edfea5bf5aae45aba3a41e96

SHA1
d2accf4d494e43ceb2cff69abe4dd17147d29cc2

SHA256
168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e

SHA512
e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe

Download Submit
\Users\Admin\AppData\Local\Temp\nstFB91.tmp\nsExec.dll
Filesize
6KB

MD5
acc2b699edfea5bf5aae45aba3a41e96

SHA1
d2accf4d494e43ceb2cff69abe4dd17147d29cc2

SHA256
168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e

SHA512
e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe

Download Submit
\Users\Admin\AppData\Local\Temp\nstFB91.tmp\nsExec.dll
Filesize
6KB

MD5
acc2b699edfea5bf5aae45aba3a41e96

SHA1
d2accf4d494e43ceb2cff69abe4dd17147d29cc2

SHA256
168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e

SHA512
e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe

Download Submit
\Windows\SysWOW64\hfnapi.dll
Filesize
106KB

MD5
660530cd22e2bab286a4d5692d3385cc

SHA1
a80fdc470f80e3ebdb54d78d03c8b3de835e9927

SHA256
bdefb791241912b773452de9866f05b52775910d79da6bc573b545fd3abb9ef3

SHA512
dcfb48fc16916e2732ca34735b01da9e56f09a5ca3650e8f9962cc16fecf0c65362e27138bd2a14e18bf47d1cadf748452e645e13c79e1c6f6a21386426e27dc

Download Submit
\Windows\SysWOW64\hfnapi.dll
Filesize
106KB

MD5
660530cd22e2bab286a4d5692d3385cc

SHA1
a80fdc470f80e3ebdb54d78d03c8b3de835e9927

SHA256
bdefb791241912b773452de9866f05b52775910d79da6bc573b545fd3abb9ef3

SHA512
dcfb48fc16916e2732ca34735b01da9e56f09a5ca3650e8f9962cc16fecf0c65362e27138bd2a14e18bf47d1cadf748452e645e13c79e1c6f6a21386426e27dc

Download Submit
\Windows\SysWOW64\hfnapi.dll
Filesize
106KB

MD5
660530cd22e2bab286a4d5692d3385cc

SHA1
a80fdc470f80e3ebdb54d78d03c8b3de835e9927

SHA256
bdefb791241912b773452de9866f05b52775910d79da6bc573b545fd3abb9ef3

SHA512
dcfb48fc16916e2732ca34735b01da9e56f09a5ca3650e8f9962cc16fecf0c65362e27138bd2a14e18bf47d1cadf748452e645e13c79e1c6f6a21386426e27dc

Download Submit
\Windows\SysWOW64\hfpapi.dll
Filesize
241KB

MD5
e247f5c0c62b8c8fa017bef20b27938c

SHA1
5fb3a46ccbe5160c1039e702ac84cb23b5318fcc

SHA256
a407151c3e0029471415c40ae614e8af4b19f96838312a466e269d5bf7698720

SHA512
e6e5312fea4bd7ca8f5b0b53264ac4513bda197d149634d522cd7e0278fa1834d1b5d37ea2fd425eca9573dee6902af4ad0771042c77cb5dc42eead358746089

Download Submit
\Windows\SysWOW64\hfpapi.dll
Filesize
241KB

MD5
e247f5c0c62b8c8fa017bef20b27938c

SHA1
5fb3a46ccbe5160c1039e702ac84cb23b5318fcc

SHA256
a407151c3e0029471415c40ae614e8af4b19f96838312a466e269d5bf7698720

SHA512
e6e5312fea4bd7ca8f5b0b53264ac4513bda197d149634d522cd7e0278fa1834d1b5d37ea2fd425eca9573dee6902af4ad0771042c77cb5dc42eead358746089

Download Submit
\Windows\SysWOW64\installd.exe
Filesize
108KB

MD5
f7e4badaa20b05ed3e70fa43a53766b2

SHA1
08e261b6588ace0c85ecf34394c028eedb078185

SHA256
f45637cbc4a9278fa9ee891d1708d81a239a1714689777ab3b4cb16a0069ce92

SHA512
698334ae971730abd396f5b9e3dbdcd84881d70e30d218a446f09838b3a3ce286782a89f1239c9ab197b80e03d13202bea9455a866acacd20854f5652505a276

Download Submit
\Windows\SysWOW64\nethtsrv.exe
Filesize
176KB

MD5
2939709ad3ea0a15ef1cb51b30623023

SHA1
ac3d438e68961a0a3a5bbdcd07f0722f489ba120

SHA256
94c9f49aeff5947d4cf60daa711e357f7fd913330ccabc6e0bd29ad64f5d944b

SHA512
d01885e3f9a76e713653123c8903b1b9745dbb79aa06945224647280da580001452bc96d8549e2b20dcbc55f5981c23e322824d24afd350f5f4a4c17f6437855

Download Submit
\Windows\SysWOW64\netupdsrv.exe
Filesize
158KB

MD5
2a96d6165e67203fb116a486abccf5d9

SHA1
5f7743955153189f2af84196ec9af26eb659d836

SHA256
6208e021232647442565aa87daf33867e058dda2aa6310bbbd6506ab655682af

SHA512
9a550a6f26f930900f765e805f140efc69557129cad11392a9a0f13aadcaadad5035f97607b752d3a5bcdf31a83c7bdd2147af2f4c865b95768cb67015a5a0a9

Download Submit
memory/820-80-0x0000000000000000-mapping.dmp

Download
memory/844-57-0x0000000000000000-mapping.dmp

Download
memory/848-85-0x0000000000000000-mapping.dmp

Download
memory/972-86-0x0000000000000000-mapping.dmp

Download
memory/1092-75-0x0000000000000000-mapping.dmp

Download
memory/1136-61-0x0000000000000000-mapping.dmp

Download
memory/1336-60-0x0000000000000000-mapping.dmp

Download
memory/1340-58-0x0000000000000000-mapping.dmp

Download
memory/1636-54-0x00000000762F1000-0x00000000762F3000-memory.dmp

Filesize
8KB

Download
memory/1708-63-0x0000000000000000-mapping.dmp

Download
memory/1744-79-0x0000000000000000-mapping.dmp

Download
memory/1960-69-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads