ae6e064e8eb2bd1d69f02ca4f2764ff9385c04e291a3f838f1ab4d7997555657

Analysis

max time kernel
13s
max time network
33s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
23-11-2022 10:15

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ae6e064e8eb2bd1d69f02ca4f2764ff9385c04e291a3f838f1ab4d7997555657.exe
Size

601KB
MD5

3aad2fff8d05a3efa1b4c17bf4df67fa
SHA1

7280fbee131826bb33d1efcc5fda1d26b670268e
SHA256

ae6e064e8eb2bd1d69f02ca4f2764ff9385c04e291a3f838f1ab4d7997555657
SHA512

fd2b1518528759c5682aa805aceace0062e9db4bced4d00a5e80c0b23cd5999b3d23153ce1a4111af2621edef232ac297869e764d258c9e1b51393bf8b5bf768
SSDEEP

12288:gIny5DYTNISqjxnHK1Lda0XY8Qi9oSJ6CcPM6S:eUTNIxjxu28QiKu

Score

8^/10

discovery

Malware Config

Signatures

Drops file in Drivers directory 1 IoCs

Processes:

ae6e064e8eb2bd1d69f02ca4f2764ff9385c04e291a3f838f1ab4d7997555657.exe

description ioc process

File created C:\Windows\system32\drivers\nethfdrv.sys ae6e064e8eb2bd1d69f02ca4f2764ff9385c04e291a3f838f1ab4d7997555657.exe
Executes dropped EXE 5 IoCs

Processes:

installd.exenethtsrv.exenetupdsrv.exenethtsrv.exenetupdsrv.exe

pid process

596 installd.exe
1400 nethtsrv.exe
2044 netupdsrv.exe
880 nethtsrv.exe
1060 netupdsrv.exe

description	ioc	process
File created	C:\Windows\system32\drivers\nethfdrv.sys	ae6e064e8eb2bd1d69f02ca4f2764ff9385c04e291a3f838f1ab4d7997555657.exe

pid	process
596	installd.exe
1400	nethtsrv.exe
2044	netupdsrv.exe
880	nethtsrv.exe
1060	netupdsrv.exe

Loads dropped DLL 13 IoCs

Processes:

ae6e064e8eb2bd1d69f02ca4f2764ff9385c04e291a3f838f1ab4d7997555657.exeinstalld.exenethtsrv.exenethtsrv.exe

pid	process
1972	ae6e064e8eb2bd1d69f02ca4f2764ff9385c04e291a3f838f1ab4d7997555657.exe
1972	ae6e064e8eb2bd1d69f02ca4f2764ff9385c04e291a3f838f1ab4d7997555657.exe
1972	ae6e064e8eb2bd1d69f02ca4f2764ff9385c04e291a3f838f1ab4d7997555657.exe
1972	ae6e064e8eb2bd1d69f02ca4f2764ff9385c04e291a3f838f1ab4d7997555657.exe
596	installd.exe
1972	ae6e064e8eb2bd1d69f02ca4f2764ff9385c04e291a3f838f1ab4d7997555657.exe
1400	nethtsrv.exe
1400	nethtsrv.exe
1972	ae6e064e8eb2bd1d69f02ca4f2764ff9385c04e291a3f838f1ab4d7997555657.exe
1972	ae6e064e8eb2bd1d69f02ca4f2764ff9385c04e291a3f838f1ab4d7997555657.exe
880	nethtsrv.exe
880	nethtsrv.exe
1972	ae6e064e8eb2bd1d69f02ca4f2764ff9385c04e291a3f838f1ab4d7997555657.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in System32 directory 5 IoCs

Processes:

ae6e064e8eb2bd1d69f02ca4f2764ff9385c04e291a3f838f1ab4d7997555657.exe

description	ioc	process
File created	C:\Windows\SysWOW64\hfnapi.dll	ae6e064e8eb2bd1d69f02ca4f2764ff9385c04e291a3f838f1ab4d7997555657.exe
File created	C:\Windows\SysWOW64\hfpapi.dll	ae6e064e8eb2bd1d69f02ca4f2764ff9385c04e291a3f838f1ab4d7997555657.exe
File created	C:\Windows\SysWOW64\installd.exe	ae6e064e8eb2bd1d69f02ca4f2764ff9385c04e291a3f838f1ab4d7997555657.exe
File created	C:\Windows\SysWOW64\nethtsrv.exe	ae6e064e8eb2bd1d69f02ca4f2764ff9385c04e291a3f838f1ab4d7997555657.exe
File created	C:\Windows\SysWOW64\netupdsrv.exe	ae6e064e8eb2bd1d69f02ca4f2764ff9385c04e291a3f838f1ab4d7997555657.exe

Drops file in Program Files directory 3 IoCs

Processes:

ae6e064e8eb2bd1d69f02ca4f2764ff9385c04e291a3f838f1ab4d7997555657.exe

description	ioc	process
File created	C:\Program Files (x86)\Common Files\Config\data.xml	ae6e064e8eb2bd1d69f02ca4f2764ff9385c04e291a3f838f1ab4d7997555657.exe
File created	C:\Program Files (x86)\Common Files\Config\ver.xml	ae6e064e8eb2bd1d69f02ca4f2764ff9385c04e291a3f838f1ab4d7997555657.exe
File created	C:\Program Files (x86)\Common Files\config\uninstinethnfd.exe	ae6e064e8eb2bd1d69f02ca4f2764ff9385c04e291a3f838f1ab4d7997555657.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Runs net.exe
Suspicious behavior: LoadsDriver 1 IoCs

Processes:

pid process

460
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

nethtsrv.exe

description pid process

Token: SeDebugPrivilege 880 nethtsrv.exe

pid	process
460

description	pid	process
Token: SeDebugPrivilege	880	nethtsrv.exe

Suspicious use of WriteProcessMemory 50 IoCs

Processes:

ae6e064e8eb2bd1d69f02ca4f2764ff9385c04e291a3f838f1ab4d7997555657.exenet.exenet.exenet.exenet.exe

description	pid	process	target process
PID 1972 wrote to memory of 1236	1972	ae6e064e8eb2bd1d69f02ca4f2764ff9385c04e291a3f838f1ab4d7997555657.exe	net.exe
PID 1972 wrote to memory of 1236	1972	ae6e064e8eb2bd1d69f02ca4f2764ff9385c04e291a3f838f1ab4d7997555657.exe	net.exe
PID 1972 wrote to memory of 1236	1972	ae6e064e8eb2bd1d69f02ca4f2764ff9385c04e291a3f838f1ab4d7997555657.exe	net.exe
PID 1972 wrote to memory of 1236	1972	ae6e064e8eb2bd1d69f02ca4f2764ff9385c04e291a3f838f1ab4d7997555657.exe	net.exe
PID 1236 wrote to memory of 1620	1236	net.exe	net1.exe
PID 1236 wrote to memory of 1620	1236	net.exe	net1.exe
PID 1236 wrote to memory of 1620	1236	net.exe	net1.exe
PID 1236 wrote to memory of 1620	1236	net.exe	net1.exe
PID 1972 wrote to memory of 816	1972	ae6e064e8eb2bd1d69f02ca4f2764ff9385c04e291a3f838f1ab4d7997555657.exe	net.exe
PID 1972 wrote to memory of 816	1972	ae6e064e8eb2bd1d69f02ca4f2764ff9385c04e291a3f838f1ab4d7997555657.exe	net.exe
PID 1972 wrote to memory of 816	1972	ae6e064e8eb2bd1d69f02ca4f2764ff9385c04e291a3f838f1ab4d7997555657.exe	net.exe
PID 1972 wrote to memory of 816	1972	ae6e064e8eb2bd1d69f02ca4f2764ff9385c04e291a3f838f1ab4d7997555657.exe	net.exe
PID 816 wrote to memory of 896	816	net.exe	net1.exe
PID 816 wrote to memory of 896	816	net.exe	net1.exe
PID 816 wrote to memory of 896	816	net.exe	net1.exe
PID 816 wrote to memory of 896	816	net.exe	net1.exe
PID 1972 wrote to memory of 596	1972	ae6e064e8eb2bd1d69f02ca4f2764ff9385c04e291a3f838f1ab4d7997555657.exe	installd.exe
PID 1972 wrote to memory of 596	1972	ae6e064e8eb2bd1d69f02ca4f2764ff9385c04e291a3f838f1ab4d7997555657.exe	installd.exe
PID 1972 wrote to memory of 596	1972	ae6e064e8eb2bd1d69f02ca4f2764ff9385c04e291a3f838f1ab4d7997555657.exe	installd.exe
PID 1972 wrote to memory of 596	1972	ae6e064e8eb2bd1d69f02ca4f2764ff9385c04e291a3f838f1ab4d7997555657.exe	installd.exe
PID 1972 wrote to memory of 596	1972	ae6e064e8eb2bd1d69f02ca4f2764ff9385c04e291a3f838f1ab4d7997555657.exe	installd.exe
PID 1972 wrote to memory of 596	1972	ae6e064e8eb2bd1d69f02ca4f2764ff9385c04e291a3f838f1ab4d7997555657.exe	installd.exe
PID 1972 wrote to memory of 596	1972	ae6e064e8eb2bd1d69f02ca4f2764ff9385c04e291a3f838f1ab4d7997555657.exe	installd.exe
PID 1972 wrote to memory of 1400	1972	ae6e064e8eb2bd1d69f02ca4f2764ff9385c04e291a3f838f1ab4d7997555657.exe	nethtsrv.exe
PID 1972 wrote to memory of 1400	1972	ae6e064e8eb2bd1d69f02ca4f2764ff9385c04e291a3f838f1ab4d7997555657.exe	nethtsrv.exe
PID 1972 wrote to memory of 1400	1972	ae6e064e8eb2bd1d69f02ca4f2764ff9385c04e291a3f838f1ab4d7997555657.exe	nethtsrv.exe
PID 1972 wrote to memory of 1400	1972	ae6e064e8eb2bd1d69f02ca4f2764ff9385c04e291a3f838f1ab4d7997555657.exe	nethtsrv.exe
PID 1972 wrote to memory of 2044	1972	ae6e064e8eb2bd1d69f02ca4f2764ff9385c04e291a3f838f1ab4d7997555657.exe	netupdsrv.exe
PID 1972 wrote to memory of 2044	1972	ae6e064e8eb2bd1d69f02ca4f2764ff9385c04e291a3f838f1ab4d7997555657.exe	netupdsrv.exe
PID 1972 wrote to memory of 2044	1972	ae6e064e8eb2bd1d69f02ca4f2764ff9385c04e291a3f838f1ab4d7997555657.exe	netupdsrv.exe
PID 1972 wrote to memory of 2044	1972	ae6e064e8eb2bd1d69f02ca4f2764ff9385c04e291a3f838f1ab4d7997555657.exe	netupdsrv.exe
PID 1972 wrote to memory of 2044	1972	ae6e064e8eb2bd1d69f02ca4f2764ff9385c04e291a3f838f1ab4d7997555657.exe	netupdsrv.exe
PID 1972 wrote to memory of 2044	1972	ae6e064e8eb2bd1d69f02ca4f2764ff9385c04e291a3f838f1ab4d7997555657.exe	netupdsrv.exe
PID 1972 wrote to memory of 2044	1972	ae6e064e8eb2bd1d69f02ca4f2764ff9385c04e291a3f838f1ab4d7997555657.exe	netupdsrv.exe
PID 1972 wrote to memory of 1624	1972	ae6e064e8eb2bd1d69f02ca4f2764ff9385c04e291a3f838f1ab4d7997555657.exe	net.exe
PID 1972 wrote to memory of 1624	1972	ae6e064e8eb2bd1d69f02ca4f2764ff9385c04e291a3f838f1ab4d7997555657.exe	net.exe
PID 1972 wrote to memory of 1624	1972	ae6e064e8eb2bd1d69f02ca4f2764ff9385c04e291a3f838f1ab4d7997555657.exe	net.exe
PID 1972 wrote to memory of 1624	1972	ae6e064e8eb2bd1d69f02ca4f2764ff9385c04e291a3f838f1ab4d7997555657.exe	net.exe
PID 1624 wrote to memory of 1704	1624	net.exe	net1.exe
PID 1624 wrote to memory of 1704	1624	net.exe	net1.exe
PID 1624 wrote to memory of 1704	1624	net.exe	net1.exe
PID 1624 wrote to memory of 1704	1624	net.exe	net1.exe
PID 1972 wrote to memory of 1980	1972	ae6e064e8eb2bd1d69f02ca4f2764ff9385c04e291a3f838f1ab4d7997555657.exe	net.exe
PID 1972 wrote to memory of 1980	1972	ae6e064e8eb2bd1d69f02ca4f2764ff9385c04e291a3f838f1ab4d7997555657.exe	net.exe
PID 1972 wrote to memory of 1980	1972	ae6e064e8eb2bd1d69f02ca4f2764ff9385c04e291a3f838f1ab4d7997555657.exe	net.exe
PID 1972 wrote to memory of 1980	1972	ae6e064e8eb2bd1d69f02ca4f2764ff9385c04e291a3f838f1ab4d7997555657.exe	net.exe
PID 1980 wrote to memory of 1536	1980	net.exe	net1.exe
PID 1980 wrote to memory of 1536	1980	net.exe	net1.exe
PID 1980 wrote to memory of 1536	1980	net.exe	net1.exe
PID 1980 wrote to memory of 1536	1980	net.exe	net1.exe

C:\Users\Admin\AppData\Local\Temp\ae6e064e8eb2bd1d69f02ca4f2764ff9385c04e291a3f838f1ab4d7997555657.exe
"C:\Users\Admin\AppData\Local\Temp\ae6e064e8eb2bd1d69f02ca4f2764ff9385c04e291a3f838f1ab4d7997555657.exe"
1⤵
- Drops file in Drivers directory
- Loads dropped DLL
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:1972

C:\Windows\SysWOW64\net.exe
net stop nethttpservice
2⤵
- Suspicious use of WriteProcessMemory
PID:1236

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop nethttpservice
3⤵
PID:1620

C:\Windows\SysWOW64\net.exe
net stop serviceupdater
2⤵
- Suspicious use of WriteProcessMemory
PID:816

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop serviceupdater
3⤵
PID:896

C:\Windows\SysWOW64\installd.exe
"C:\Windows\system32\installd.exe" nethfdrv
2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:596

C:\Windows\SysWOW64\nethtsrv.exe
"C:\Windows\system32\nethtsrv.exe" -nfdi
2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1400

C:\Windows\SysWOW64\netupdsrv.exe
"C:\Windows\system32\netupdsrv.exe" -nfdi
2⤵
- Executes dropped EXE
PID:2044

C:\Windows\SysWOW64\net.exe
net start nethttpservice
2⤵
- Suspicious use of WriteProcessMemory
PID:1624

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 start nethttpservice
3⤵
PID:1704

C:\Windows\SysWOW64\net.exe
net start serviceupdater
2⤵
- Suspicious use of WriteProcessMemory
PID:1980

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 start serviceupdater
3⤵
PID:1536

C:\Windows\SysWOW64\nethtsrv.exe
C:\Windows\SysWOW64\nethtsrv.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:880

C:\Windows\SysWOW64\netupdsrv.exe
C:\Windows\SysWOW64\netupdsrv.exe
1⤵
- Executes dropped EXE
PID:1060

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\hfnapi.dll
Filesize
106KB

MD5
469932379c891a629dd195555b330b56

SHA1
21818532607f4694937bdaf4bde44e2910e3dfc8

SHA256
5e13931b6c4e8007398ec91549ccfe5270091602376faa15314e8ef7acb18a8b

SHA512
72922a1885af16df9cee0d40547e91b8ea662c9a4266bbbe30f1a15cd689d024572fda589fda2d66f23e52d9cdfb78f2f50973d5a373b95c565312ac6465d5c9

Download Submit
C:\Windows\SysWOW64\hfpapi.dll
Filesize
241KB

MD5
c5d99c8a281446239101210e5341a229

SHA1
49aca5b18ba9d46c3499c716e11d7ee6443b6024

SHA256
2118a628b3dee9908b0a0ef0ae17ad359280efb92caf5c24f6ffbd6b8951d302

SHA512
344ac3f58ddf6c2e191c38f40ccbb236fe920f0470b86b0f1d304088cc253f7fb4bd6b2ddfdbbd69d53f7d99ffafe487f42d7fecf1722930b04f7f814978e141

Download Submit
C:\Windows\SysWOW64\installd.exe
Filesize
108KB

MD5
d3d12251201dfb20d0054e2f08a4afe8

SHA1
12212188623b206c3ef7dbf109739e720b3abc44

SHA256
f9e2cca1e1aa7c882793f8343d1f34eacdc1b0ff27e5aa55b64b40b34939e15f

SHA512
083100d0f4bb7cab516424a031dd0e4e3e5614e271db3eecd70265a516e4ec6c94600a12560d9c4b9f9f5dea8a10e0d3af468eba8aef1b49226fcf3228c202da

Download Submit
C:\Windows\SysWOW64\nethtsrv.exe
Filesize
176KB

MD5
97bb4edca054166677924cb6850123bf

SHA1
cbfc58fe15bb978ef78c1418e236d9cdb6b8fa09

SHA256
b4b9f0ed94b0dca275c0de7aa30f3c2ad81d75d82694002bdcb5e5a7f8297479

SHA512
9622cd67c49b71eec38774fbda2f60971082c38cf600bed32f1eb8c994040b4e41e30526f3c757be7b5d65c057585a09b75e9ba888c1b38307f8a55a4b0f9f4d

Download Submit
C:\Windows\SysWOW64\nethtsrv.exe
Filesize
176KB

MD5
97bb4edca054166677924cb6850123bf

SHA1
cbfc58fe15bb978ef78c1418e236d9cdb6b8fa09

SHA256
b4b9f0ed94b0dca275c0de7aa30f3c2ad81d75d82694002bdcb5e5a7f8297479

SHA512
9622cd67c49b71eec38774fbda2f60971082c38cf600bed32f1eb8c994040b4e41e30526f3c757be7b5d65c057585a09b75e9ba888c1b38307f8a55a4b0f9f4d

Download Submit
C:\Windows\SysWOW64\netupdsrv.exe
Filesize
158KB

MD5
dbea887658fa479a1bcb5f1fea913a0f

SHA1
135d0963bc4d6697eb129b0ce88e39b32df8aa17

SHA256
74871fe5d8666621132ddba9e18d68a8c51cae93f0b52d54e24624ed1cb5ee50

SHA512
46640a3f76c69ec4c3aa4626ffe6d7552f6d5379aa8631dfed7af607eb04b0f04a3380ce6512927672bd2344bfd0328f02fc025e308f90af7bebddf949dafea8

Download Submit
C:\Windows\SysWOW64\netupdsrv.exe
Filesize
158KB

MD5
dbea887658fa479a1bcb5f1fea913a0f

SHA1
135d0963bc4d6697eb129b0ce88e39b32df8aa17

SHA256
74871fe5d8666621132ddba9e18d68a8c51cae93f0b52d54e24624ed1cb5ee50

SHA512
46640a3f76c69ec4c3aa4626ffe6d7552f6d5379aa8631dfed7af607eb04b0f04a3380ce6512927672bd2344bfd0328f02fc025e308f90af7bebddf949dafea8

Download Submit
\Users\Admin\AppData\Local\Temp\nsoC96A.tmp\System.dll
Filesize
11KB

MD5
c17103ae9072a06da581dec998343fc1

SHA1
b72148c6bdfaada8b8c3f950e610ee7cf1da1f8d

SHA256
dc58d8ad81cacb0c1ed72e33bff8f23ea40b5252b5bb55d393a0903e6819ae2f

SHA512
d32a71aaef18e993f28096d536e41c4d016850721b31171513ce28bbd805a54fd290b7c3e9d935f72e676a1acfb4f0dcc89d95040a0dd29f2b6975855c18986f

Download Submit
\Users\Admin\AppData\Local\Temp\nsoC96A.tmp\nsExec.dll
Filesize
6KB

MD5
acc2b699edfea5bf5aae45aba3a41e96

SHA1
d2accf4d494e43ceb2cff69abe4dd17147d29cc2

SHA256
168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e

SHA512
e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe

Download Submit
\Users\Admin\AppData\Local\Temp\nsoC96A.tmp\nsExec.dll
Filesize
6KB

MD5
acc2b699edfea5bf5aae45aba3a41e96

SHA1
d2accf4d494e43ceb2cff69abe4dd17147d29cc2

SHA256
168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e

SHA512
e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe

Download Submit
\Users\Admin\AppData\Local\Temp\nsoC96A.tmp\nsExec.dll
Filesize
6KB

MD5
acc2b699edfea5bf5aae45aba3a41e96

SHA1
d2accf4d494e43ceb2cff69abe4dd17147d29cc2

SHA256
168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e

SHA512
e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe

Download Submit
\Users\Admin\AppData\Local\Temp\nsoC96A.tmp\nsExec.dll
Filesize
6KB

MD5
acc2b699edfea5bf5aae45aba3a41e96

SHA1
d2accf4d494e43ceb2cff69abe4dd17147d29cc2

SHA256
168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e

SHA512
e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe

Download Submit
\Windows\SysWOW64\hfnapi.dll
Filesize
106KB

MD5
469932379c891a629dd195555b330b56

SHA1
21818532607f4694937bdaf4bde44e2910e3dfc8

SHA256
5e13931b6c4e8007398ec91549ccfe5270091602376faa15314e8ef7acb18a8b

SHA512
72922a1885af16df9cee0d40547e91b8ea662c9a4266bbbe30f1a15cd689d024572fda589fda2d66f23e52d9cdfb78f2f50973d5a373b95c565312ac6465d5c9

Download Submit
\Windows\SysWOW64\hfnapi.dll
Filesize
106KB

MD5
469932379c891a629dd195555b330b56

SHA1
21818532607f4694937bdaf4bde44e2910e3dfc8

SHA256
5e13931b6c4e8007398ec91549ccfe5270091602376faa15314e8ef7acb18a8b

SHA512
72922a1885af16df9cee0d40547e91b8ea662c9a4266bbbe30f1a15cd689d024572fda589fda2d66f23e52d9cdfb78f2f50973d5a373b95c565312ac6465d5c9

Download Submit
\Windows\SysWOW64\hfnapi.dll
Filesize
106KB

MD5
469932379c891a629dd195555b330b56

SHA1
21818532607f4694937bdaf4bde44e2910e3dfc8

SHA256
5e13931b6c4e8007398ec91549ccfe5270091602376faa15314e8ef7acb18a8b

SHA512
72922a1885af16df9cee0d40547e91b8ea662c9a4266bbbe30f1a15cd689d024572fda589fda2d66f23e52d9cdfb78f2f50973d5a373b95c565312ac6465d5c9

Download Submit
\Windows\SysWOW64\hfpapi.dll
Filesize
241KB

MD5
c5d99c8a281446239101210e5341a229

SHA1
49aca5b18ba9d46c3499c716e11d7ee6443b6024

SHA256
2118a628b3dee9908b0a0ef0ae17ad359280efb92caf5c24f6ffbd6b8951d302

SHA512
344ac3f58ddf6c2e191c38f40ccbb236fe920f0470b86b0f1d304088cc253f7fb4bd6b2ddfdbbd69d53f7d99ffafe487f42d7fecf1722930b04f7f814978e141

Download Submit
\Windows\SysWOW64\hfpapi.dll
Filesize
241KB

MD5
c5d99c8a281446239101210e5341a229

SHA1
49aca5b18ba9d46c3499c716e11d7ee6443b6024

SHA256
2118a628b3dee9908b0a0ef0ae17ad359280efb92caf5c24f6ffbd6b8951d302

SHA512
344ac3f58ddf6c2e191c38f40ccbb236fe920f0470b86b0f1d304088cc253f7fb4bd6b2ddfdbbd69d53f7d99ffafe487f42d7fecf1722930b04f7f814978e141

Download Submit
\Windows\SysWOW64\installd.exe
Filesize
108KB

MD5
d3d12251201dfb20d0054e2f08a4afe8

SHA1
12212188623b206c3ef7dbf109739e720b3abc44

SHA256
f9e2cca1e1aa7c882793f8343d1f34eacdc1b0ff27e5aa55b64b40b34939e15f

SHA512
083100d0f4bb7cab516424a031dd0e4e3e5614e271db3eecd70265a516e4ec6c94600a12560d9c4b9f9f5dea8a10e0d3af468eba8aef1b49226fcf3228c202da

Download Submit
\Windows\SysWOW64\nethtsrv.exe
Filesize
176KB

MD5
97bb4edca054166677924cb6850123bf

SHA1
cbfc58fe15bb978ef78c1418e236d9cdb6b8fa09

SHA256
b4b9f0ed94b0dca275c0de7aa30f3c2ad81d75d82694002bdcb5e5a7f8297479

SHA512
9622cd67c49b71eec38774fbda2f60971082c38cf600bed32f1eb8c994040b4e41e30526f3c757be7b5d65c057585a09b75e9ba888c1b38307f8a55a4b0f9f4d

Download Submit
\Windows\SysWOW64\netupdsrv.exe
Filesize
158KB

MD5
dbea887658fa479a1bcb5f1fea913a0f

SHA1
135d0963bc4d6697eb129b0ce88e39b32df8aa17

SHA256
74871fe5d8666621132ddba9e18d68a8c51cae93f0b52d54e24624ed1cb5ee50

SHA512
46640a3f76c69ec4c3aa4626ffe6d7552f6d5379aa8631dfed7af607eb04b0f04a3380ce6512927672bd2344bfd0328f02fc025e308f90af7bebddf949dafea8

Download Submit
memory/596-64-0x0000000000000000-mapping.dmp

Download
memory/816-61-0x0000000000000000-mapping.dmp

Download
memory/896-62-0x0000000000000000-mapping.dmp

Download
memory/1236-58-0x0000000000000000-mapping.dmp

Download
memory/1400-70-0x0000000000000000-mapping.dmp

Download
memory/1536-87-0x0000000000000000-mapping.dmp

Download
memory/1620-59-0x0000000000000000-mapping.dmp

Download
memory/1624-80-0x0000000000000000-mapping.dmp

Download
memory/1704-81-0x0000000000000000-mapping.dmp

Download
memory/1972-54-0x0000000076391000-0x0000000076393000-memory.dmp

Filesize
8KB

Download
memory/1972-55-0x0000000000360000-0x00000000007BE000-memory.dmp

Filesize
4.4MB

Download
memory/1972-90-0x0000000000360000-0x00000000007BE000-memory.dmp

Filesize
4.4MB

Download
memory/1980-86-0x0000000000000000-mapping.dmp

Download
memory/2044-76-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads