ab921ca77da26ce8602eee4a1109bd72f747e8b46ef194a6a112295ba7717e9c

Analysis

max time kernel
51s
max time network
33s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
23-11-2022 10:15

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ab921ca77da26ce8602eee4a1109bd72f747e8b46ef194a6a112295ba7717e9c.exe
Size

603KB
MD5

bbc2ec266270d20670d6d20c0679471f
SHA1

aeede3d1b36364a11839ac0157af5463af0ea6a2
SHA256

ab921ca77da26ce8602eee4a1109bd72f747e8b46ef194a6a112295ba7717e9c
SHA512

68eae7b629009ab3e22c46693815d90fbf3e90ce05648a00a0f6ca15f57552f87bcf93293501cd41d36de889d18545fbd52b4a7d5b481551c3a93cadd02cdfbb
SSDEEP

12288:pIny5DYTwJtntyR9E1syNu4yX5dx5Tkyj/4K:FUTWtn4R9HHFZTkq/4K

Score

8^/10

discovery

Malware Config

Signatures

Drops file in Drivers directory 1 IoCs

Processes:

ab921ca77da26ce8602eee4a1109bd72f747e8b46ef194a6a112295ba7717e9c.exe

description ioc process

File created C:\Windows\system32\drivers\nethfdrv.sys ab921ca77da26ce8602eee4a1109bd72f747e8b46ef194a6a112295ba7717e9c.exe
Executes dropped EXE 5 IoCs

Processes:

installd.exenethtsrv.exenetupdsrv.exenethtsrv.exenetupdsrv.exe

pid process

1760 installd.exe
1552 nethtsrv.exe
1380 netupdsrv.exe
1516 nethtsrv.exe
1672 netupdsrv.exe

description	ioc	process
File created	C:\Windows\system32\drivers\nethfdrv.sys	ab921ca77da26ce8602eee4a1109bd72f747e8b46ef194a6a112295ba7717e9c.exe

pid	process
1760	installd.exe
1552	nethtsrv.exe
1380	netupdsrv.exe
1516	nethtsrv.exe
1672	netupdsrv.exe

Loads dropped DLL 13 IoCs

Processes:

ab921ca77da26ce8602eee4a1109bd72f747e8b46ef194a6a112295ba7717e9c.exeinstalld.exenethtsrv.exenethtsrv.exe

pid	process
1628	ab921ca77da26ce8602eee4a1109bd72f747e8b46ef194a6a112295ba7717e9c.exe
1628	ab921ca77da26ce8602eee4a1109bd72f747e8b46ef194a6a112295ba7717e9c.exe
1628	ab921ca77da26ce8602eee4a1109bd72f747e8b46ef194a6a112295ba7717e9c.exe
1628	ab921ca77da26ce8602eee4a1109bd72f747e8b46ef194a6a112295ba7717e9c.exe
1760	installd.exe
1628	ab921ca77da26ce8602eee4a1109bd72f747e8b46ef194a6a112295ba7717e9c.exe
1552	nethtsrv.exe
1552	nethtsrv.exe
1628	ab921ca77da26ce8602eee4a1109bd72f747e8b46ef194a6a112295ba7717e9c.exe
1628	ab921ca77da26ce8602eee4a1109bd72f747e8b46ef194a6a112295ba7717e9c.exe
1516	nethtsrv.exe
1516	nethtsrv.exe
1628	ab921ca77da26ce8602eee4a1109bd72f747e8b46ef194a6a112295ba7717e9c.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in System32 directory 5 IoCs

Processes:

ab921ca77da26ce8602eee4a1109bd72f747e8b46ef194a6a112295ba7717e9c.exe

description	ioc	process
File created	C:\Windows\SysWOW64\hfnapi.dll	ab921ca77da26ce8602eee4a1109bd72f747e8b46ef194a6a112295ba7717e9c.exe
File created	C:\Windows\SysWOW64\hfpapi.dll	ab921ca77da26ce8602eee4a1109bd72f747e8b46ef194a6a112295ba7717e9c.exe
File created	C:\Windows\SysWOW64\installd.exe	ab921ca77da26ce8602eee4a1109bd72f747e8b46ef194a6a112295ba7717e9c.exe
File created	C:\Windows\SysWOW64\nethtsrv.exe	ab921ca77da26ce8602eee4a1109bd72f747e8b46ef194a6a112295ba7717e9c.exe
File created	C:\Windows\SysWOW64\netupdsrv.exe	ab921ca77da26ce8602eee4a1109bd72f747e8b46ef194a6a112295ba7717e9c.exe

Drops file in Program Files directory 3 IoCs

Processes:

ab921ca77da26ce8602eee4a1109bd72f747e8b46ef194a6a112295ba7717e9c.exe

description	ioc	process
File created	C:\Program Files (x86)\Common Files\Config\data.xml	ab921ca77da26ce8602eee4a1109bd72f747e8b46ef194a6a112295ba7717e9c.exe
File created	C:\Program Files (x86)\Common Files\Config\ver.xml	ab921ca77da26ce8602eee4a1109bd72f747e8b46ef194a6a112295ba7717e9c.exe
File created	C:\Program Files (x86)\Common Files\config\uninstinethnfd.exe	ab921ca77da26ce8602eee4a1109bd72f747e8b46ef194a6a112295ba7717e9c.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Runs net.exe
Suspicious behavior: LoadsDriver 1 IoCs

Processes:

pid process

460
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

nethtsrv.exe

description pid process

Token: SeDebugPrivilege 1516 nethtsrv.exe

pid	process
460

description	pid	process
Token: SeDebugPrivilege	1516	nethtsrv.exe

Suspicious use of WriteProcessMemory 50 IoCs

Processes:

ab921ca77da26ce8602eee4a1109bd72f747e8b46ef194a6a112295ba7717e9c.exenet.exenet.exenet.exenet.exe

description	pid	process	target process
PID 1628 wrote to memory of 1428	1628	ab921ca77da26ce8602eee4a1109bd72f747e8b46ef194a6a112295ba7717e9c.exe	net.exe
PID 1628 wrote to memory of 1428	1628	ab921ca77da26ce8602eee4a1109bd72f747e8b46ef194a6a112295ba7717e9c.exe	net.exe
PID 1628 wrote to memory of 1428	1628	ab921ca77da26ce8602eee4a1109bd72f747e8b46ef194a6a112295ba7717e9c.exe	net.exe
PID 1628 wrote to memory of 1428	1628	ab921ca77da26ce8602eee4a1109bd72f747e8b46ef194a6a112295ba7717e9c.exe	net.exe
PID 1428 wrote to memory of 1752	1428	net.exe	net1.exe
PID 1428 wrote to memory of 1752	1428	net.exe	net1.exe
PID 1428 wrote to memory of 1752	1428	net.exe	net1.exe
PID 1428 wrote to memory of 1752	1428	net.exe	net1.exe
PID 1628 wrote to memory of 1764	1628	ab921ca77da26ce8602eee4a1109bd72f747e8b46ef194a6a112295ba7717e9c.exe	net.exe
PID 1628 wrote to memory of 1764	1628	ab921ca77da26ce8602eee4a1109bd72f747e8b46ef194a6a112295ba7717e9c.exe	net.exe
PID 1628 wrote to memory of 1764	1628	ab921ca77da26ce8602eee4a1109bd72f747e8b46ef194a6a112295ba7717e9c.exe	net.exe
PID 1628 wrote to memory of 1764	1628	ab921ca77da26ce8602eee4a1109bd72f747e8b46ef194a6a112295ba7717e9c.exe	net.exe
PID 1764 wrote to memory of 756	1764	net.exe	net1.exe
PID 1764 wrote to memory of 756	1764	net.exe	net1.exe
PID 1764 wrote to memory of 756	1764	net.exe	net1.exe
PID 1764 wrote to memory of 756	1764	net.exe	net1.exe
PID 1628 wrote to memory of 1760	1628	ab921ca77da26ce8602eee4a1109bd72f747e8b46ef194a6a112295ba7717e9c.exe	installd.exe
PID 1628 wrote to memory of 1760	1628	ab921ca77da26ce8602eee4a1109bd72f747e8b46ef194a6a112295ba7717e9c.exe	installd.exe
PID 1628 wrote to memory of 1760	1628	ab921ca77da26ce8602eee4a1109bd72f747e8b46ef194a6a112295ba7717e9c.exe	installd.exe
PID 1628 wrote to memory of 1760	1628	ab921ca77da26ce8602eee4a1109bd72f747e8b46ef194a6a112295ba7717e9c.exe	installd.exe
PID 1628 wrote to memory of 1760	1628	ab921ca77da26ce8602eee4a1109bd72f747e8b46ef194a6a112295ba7717e9c.exe	installd.exe
PID 1628 wrote to memory of 1760	1628	ab921ca77da26ce8602eee4a1109bd72f747e8b46ef194a6a112295ba7717e9c.exe	installd.exe
PID 1628 wrote to memory of 1760	1628	ab921ca77da26ce8602eee4a1109bd72f747e8b46ef194a6a112295ba7717e9c.exe	installd.exe
PID 1628 wrote to memory of 1552	1628	ab921ca77da26ce8602eee4a1109bd72f747e8b46ef194a6a112295ba7717e9c.exe	nethtsrv.exe
PID 1628 wrote to memory of 1552	1628	ab921ca77da26ce8602eee4a1109bd72f747e8b46ef194a6a112295ba7717e9c.exe	nethtsrv.exe
PID 1628 wrote to memory of 1552	1628	ab921ca77da26ce8602eee4a1109bd72f747e8b46ef194a6a112295ba7717e9c.exe	nethtsrv.exe
PID 1628 wrote to memory of 1552	1628	ab921ca77da26ce8602eee4a1109bd72f747e8b46ef194a6a112295ba7717e9c.exe	nethtsrv.exe
PID 1628 wrote to memory of 1380	1628	ab921ca77da26ce8602eee4a1109bd72f747e8b46ef194a6a112295ba7717e9c.exe	netupdsrv.exe
PID 1628 wrote to memory of 1380	1628	ab921ca77da26ce8602eee4a1109bd72f747e8b46ef194a6a112295ba7717e9c.exe	netupdsrv.exe
PID 1628 wrote to memory of 1380	1628	ab921ca77da26ce8602eee4a1109bd72f747e8b46ef194a6a112295ba7717e9c.exe	netupdsrv.exe
PID 1628 wrote to memory of 1380	1628	ab921ca77da26ce8602eee4a1109bd72f747e8b46ef194a6a112295ba7717e9c.exe	netupdsrv.exe
PID 1628 wrote to memory of 1380	1628	ab921ca77da26ce8602eee4a1109bd72f747e8b46ef194a6a112295ba7717e9c.exe	netupdsrv.exe
PID 1628 wrote to memory of 1380	1628	ab921ca77da26ce8602eee4a1109bd72f747e8b46ef194a6a112295ba7717e9c.exe	netupdsrv.exe
PID 1628 wrote to memory of 1380	1628	ab921ca77da26ce8602eee4a1109bd72f747e8b46ef194a6a112295ba7717e9c.exe	netupdsrv.exe
PID 1628 wrote to memory of 736	1628	ab921ca77da26ce8602eee4a1109bd72f747e8b46ef194a6a112295ba7717e9c.exe	net.exe
PID 1628 wrote to memory of 736	1628	ab921ca77da26ce8602eee4a1109bd72f747e8b46ef194a6a112295ba7717e9c.exe	net.exe
PID 1628 wrote to memory of 736	1628	ab921ca77da26ce8602eee4a1109bd72f747e8b46ef194a6a112295ba7717e9c.exe	net.exe
PID 1628 wrote to memory of 736	1628	ab921ca77da26ce8602eee4a1109bd72f747e8b46ef194a6a112295ba7717e9c.exe	net.exe
PID 736 wrote to memory of 1528	736	net.exe	net1.exe
PID 736 wrote to memory of 1528	736	net.exe	net1.exe
PID 736 wrote to memory of 1528	736	net.exe	net1.exe
PID 736 wrote to memory of 1528	736	net.exe	net1.exe
PID 1628 wrote to memory of 1556	1628	ab921ca77da26ce8602eee4a1109bd72f747e8b46ef194a6a112295ba7717e9c.exe	net.exe
PID 1628 wrote to memory of 1556	1628	ab921ca77da26ce8602eee4a1109bd72f747e8b46ef194a6a112295ba7717e9c.exe	net.exe
PID 1628 wrote to memory of 1556	1628	ab921ca77da26ce8602eee4a1109bd72f747e8b46ef194a6a112295ba7717e9c.exe	net.exe
PID 1628 wrote to memory of 1556	1628	ab921ca77da26ce8602eee4a1109bd72f747e8b46ef194a6a112295ba7717e9c.exe	net.exe
PID 1556 wrote to memory of 992	1556	net.exe	net1.exe
PID 1556 wrote to memory of 992	1556	net.exe	net1.exe
PID 1556 wrote to memory of 992	1556	net.exe	net1.exe
PID 1556 wrote to memory of 992	1556	net.exe	net1.exe

C:\Users\Admin\AppData\Local\Temp\ab921ca77da26ce8602eee4a1109bd72f747e8b46ef194a6a112295ba7717e9c.exe
"C:\Users\Admin\AppData\Local\Temp\ab921ca77da26ce8602eee4a1109bd72f747e8b46ef194a6a112295ba7717e9c.exe"
1⤵
- Drops file in Drivers directory
- Loads dropped DLL
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:1628

C:\Windows\SysWOW64\net.exe
net stop nethttpservice
2⤵
- Suspicious use of WriteProcessMemory
PID:1428

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop nethttpservice
3⤵
PID:1752

C:\Windows\SysWOW64\net.exe
net stop serviceupdater
2⤵
- Suspicious use of WriteProcessMemory
PID:1764

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop serviceupdater
3⤵
PID:756

C:\Windows\SysWOW64\installd.exe
"C:\Windows\system32\installd.exe" nethfdrv
2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1760

C:\Windows\SysWOW64\nethtsrv.exe
"C:\Windows\system32\nethtsrv.exe" -nfdi
2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1552

C:\Windows\SysWOW64\netupdsrv.exe
"C:\Windows\system32\netupdsrv.exe" -nfdi
2⤵
- Executes dropped EXE
PID:1380

C:\Windows\SysWOW64\net.exe
net start nethttpservice
2⤵
- Suspicious use of WriteProcessMemory
PID:736

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 start nethttpservice
3⤵
PID:1528

C:\Windows\SysWOW64\net.exe
net start serviceupdater
2⤵
- Suspicious use of WriteProcessMemory
PID:1556

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 start serviceupdater
3⤵
PID:992

C:\Windows\SysWOW64\nethtsrv.exe
C:\Windows\SysWOW64\nethtsrv.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:1516

C:\Windows\SysWOW64\netupdsrv.exe
C:\Windows\SysWOW64\netupdsrv.exe
1⤵
- Executes dropped EXE
PID:1672

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\hfnapi.dll
Filesize
106KB

MD5
2d3c0bb683adc241ac45acc53ba47dfe

SHA1
f244645b7b3886b62db9da701f5b564df868a987

SHA256
c0e8e288d99312e6f04f0f8d708818a65e91baa4683238209ed3611ee22efd59

SHA512
708639c9f41614a9defb066a44f00dbd22c5efbc9c201210d2f8b54bdd531157d64cf38b8bcb64d1ffd301fc1839786207190d7bc3e3f3ac3f584161c23df6e4

Download Submit
C:\Windows\SysWOW64\hfpapi.dll
Filesize
244KB

MD5
0ad9b9ad12e36f43c29c8a46e233b5e1

SHA1
1e323f5e606a070fd4396144fde3f55024643b65

SHA256
aaf484110eb1e3d6437983909ac7b9e5b8dd4519707dead040024d638ec07c56

SHA512
3689d0abbadee826131ded9cd387a7c9b8dac710a57a03a52a2b6ca779cc912edc1d27022d503cbe9bcfefac0892066dfaf6dabd47ab46c20bc72106337fa5c8

Download Submit
C:\Windows\SysWOW64\installd.exe
Filesize
108KB

MD5
bd534e6fa26da3bb87cd9e1f2cd7967a

SHA1
bf6006d128d5d7ef8e2633430dc02c790a4e9e96

SHA256
1ceef17466c53dbe40774f7559175e607a1ca793a38cc528f50ffdb8095144cf

SHA512
a21b884a8ddff39d2617c887d3955f8672dea7de87fb010f241a4c933ea948f8a9974b9425dc74bfe8f3fe7da691b2f34ae13444e787cf384f13ce5f069d26a9

Download Submit
C:\Windows\SysWOW64\nethtsrv.exe
Filesize
176KB

MD5
5c2eb976c77eeca14489b670b3a16d3e

SHA1
e4696521511d88f901c40032cadaa1c4859edfd4

SHA256
fb3eb494657053a9124ff12be874dddaf25cec236c2561ae920e4bd3c3717b4b

SHA512
3b301e32083083907fc8500021a6987e975a2dc20e081702e3b5f1f8ad9dbb0faf3ab87ab093c4cc78f274ea291f967dfb6948bda59af6cc1a5ba31f67844242

Download Submit
C:\Windows\SysWOW64\nethtsrv.exe
Filesize
176KB

MD5
5c2eb976c77eeca14489b670b3a16d3e

SHA1
e4696521511d88f901c40032cadaa1c4859edfd4

SHA256
fb3eb494657053a9124ff12be874dddaf25cec236c2561ae920e4bd3c3717b4b

SHA512
3b301e32083083907fc8500021a6987e975a2dc20e081702e3b5f1f8ad9dbb0faf3ab87ab093c4cc78f274ea291f967dfb6948bda59af6cc1a5ba31f67844242

Download Submit
C:\Windows\SysWOW64\netupdsrv.exe
Filesize
158KB

MD5
b9987a57cb7a1dad296c6d196a50140e

SHA1
241e5445b9c028aba32c7c3d1655644ae77d7507

SHA256
817dc21ca499c37573eb4e38e1a1bb09fa67aacc6da79ea03e1b68df232273d6

SHA512
558c084185ac2f71a6de4c1ef949254881c1d47c7ce38af6ce8b9d933bd67b87e4af82991e21a3f6ab509213cc8aded4969a2befc0f8bea8b86da5c86fde193d

Download Submit
C:\Windows\SysWOW64\netupdsrv.exe
Filesize
158KB

MD5
b9987a57cb7a1dad296c6d196a50140e

SHA1
241e5445b9c028aba32c7c3d1655644ae77d7507

SHA256
817dc21ca499c37573eb4e38e1a1bb09fa67aacc6da79ea03e1b68df232273d6

SHA512
558c084185ac2f71a6de4c1ef949254881c1d47c7ce38af6ce8b9d933bd67b87e4af82991e21a3f6ab509213cc8aded4969a2befc0f8bea8b86da5c86fde193d

Download Submit
\Users\Admin\AppData\Local\Temp\nsjACF5.tmp\System.dll
Filesize
11KB

MD5
c17103ae9072a06da581dec998343fc1

SHA1
b72148c6bdfaada8b8c3f950e610ee7cf1da1f8d

SHA256
dc58d8ad81cacb0c1ed72e33bff8f23ea40b5252b5bb55d393a0903e6819ae2f

SHA512
d32a71aaef18e993f28096d536e41c4d016850721b31171513ce28bbd805a54fd290b7c3e9d935f72e676a1acfb4f0dcc89d95040a0dd29f2b6975855c18986f

Download Submit
\Users\Admin\AppData\Local\Temp\nsjACF5.tmp\nsExec.dll
Filesize
6KB

MD5
acc2b699edfea5bf5aae45aba3a41e96

SHA1
d2accf4d494e43ceb2cff69abe4dd17147d29cc2

SHA256
168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e

SHA512
e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe

Download Submit
\Users\Admin\AppData\Local\Temp\nsjACF5.tmp\nsExec.dll
Filesize
6KB

MD5
acc2b699edfea5bf5aae45aba3a41e96

SHA1
d2accf4d494e43ceb2cff69abe4dd17147d29cc2

SHA256
168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e

SHA512
e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe

Download Submit
\Users\Admin\AppData\Local\Temp\nsjACF5.tmp\nsExec.dll
Filesize
6KB

MD5
acc2b699edfea5bf5aae45aba3a41e96

SHA1
d2accf4d494e43ceb2cff69abe4dd17147d29cc2

SHA256
168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e

SHA512
e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe

Download Submit
\Users\Admin\AppData\Local\Temp\nsjACF5.tmp\nsExec.dll
Filesize
6KB

MD5
acc2b699edfea5bf5aae45aba3a41e96

SHA1
d2accf4d494e43ceb2cff69abe4dd17147d29cc2

SHA256
168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e

SHA512
e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe

Download Submit
\Windows\SysWOW64\hfnapi.dll
Filesize
106KB

MD5
2d3c0bb683adc241ac45acc53ba47dfe

SHA1
f244645b7b3886b62db9da701f5b564df868a987

SHA256
c0e8e288d99312e6f04f0f8d708818a65e91baa4683238209ed3611ee22efd59

SHA512
708639c9f41614a9defb066a44f00dbd22c5efbc9c201210d2f8b54bdd531157d64cf38b8bcb64d1ffd301fc1839786207190d7bc3e3f3ac3f584161c23df6e4

Download Submit
\Windows\SysWOW64\hfnapi.dll
Filesize
106KB

MD5
2d3c0bb683adc241ac45acc53ba47dfe

SHA1
f244645b7b3886b62db9da701f5b564df868a987

SHA256
c0e8e288d99312e6f04f0f8d708818a65e91baa4683238209ed3611ee22efd59

SHA512
708639c9f41614a9defb066a44f00dbd22c5efbc9c201210d2f8b54bdd531157d64cf38b8bcb64d1ffd301fc1839786207190d7bc3e3f3ac3f584161c23df6e4

Download Submit
\Windows\SysWOW64\hfnapi.dll
Filesize
106KB

MD5
2d3c0bb683adc241ac45acc53ba47dfe

SHA1
f244645b7b3886b62db9da701f5b564df868a987

SHA256
c0e8e288d99312e6f04f0f8d708818a65e91baa4683238209ed3611ee22efd59

SHA512
708639c9f41614a9defb066a44f00dbd22c5efbc9c201210d2f8b54bdd531157d64cf38b8bcb64d1ffd301fc1839786207190d7bc3e3f3ac3f584161c23df6e4

Download Submit
\Windows\SysWOW64\hfpapi.dll
Filesize
244KB

MD5
0ad9b9ad12e36f43c29c8a46e233b5e1

SHA1
1e323f5e606a070fd4396144fde3f55024643b65

SHA256
aaf484110eb1e3d6437983909ac7b9e5b8dd4519707dead040024d638ec07c56

SHA512
3689d0abbadee826131ded9cd387a7c9b8dac710a57a03a52a2b6ca779cc912edc1d27022d503cbe9bcfefac0892066dfaf6dabd47ab46c20bc72106337fa5c8

Download Submit
\Windows\SysWOW64\hfpapi.dll
Filesize
244KB

MD5
0ad9b9ad12e36f43c29c8a46e233b5e1

SHA1
1e323f5e606a070fd4396144fde3f55024643b65

SHA256
aaf484110eb1e3d6437983909ac7b9e5b8dd4519707dead040024d638ec07c56

SHA512
3689d0abbadee826131ded9cd387a7c9b8dac710a57a03a52a2b6ca779cc912edc1d27022d503cbe9bcfefac0892066dfaf6dabd47ab46c20bc72106337fa5c8

Download Submit
\Windows\SysWOW64\installd.exe
Filesize
108KB

MD5
bd534e6fa26da3bb87cd9e1f2cd7967a

SHA1
bf6006d128d5d7ef8e2633430dc02c790a4e9e96

SHA256
1ceef17466c53dbe40774f7559175e607a1ca793a38cc528f50ffdb8095144cf

SHA512
a21b884a8ddff39d2617c887d3955f8672dea7de87fb010f241a4c933ea948f8a9974b9425dc74bfe8f3fe7da691b2f34ae13444e787cf384f13ce5f069d26a9

Download Submit
\Windows\SysWOW64\nethtsrv.exe
Filesize
176KB

MD5
5c2eb976c77eeca14489b670b3a16d3e

SHA1
e4696521511d88f901c40032cadaa1c4859edfd4

SHA256
fb3eb494657053a9124ff12be874dddaf25cec236c2561ae920e4bd3c3717b4b

SHA512
3b301e32083083907fc8500021a6987e975a2dc20e081702e3b5f1f8ad9dbb0faf3ab87ab093c4cc78f274ea291f967dfb6948bda59af6cc1a5ba31f67844242

Download Submit
\Windows\SysWOW64\netupdsrv.exe
Filesize
158KB

MD5
b9987a57cb7a1dad296c6d196a50140e

SHA1
241e5445b9c028aba32c7c3d1655644ae77d7507

SHA256
817dc21ca499c37573eb4e38e1a1bb09fa67aacc6da79ea03e1b68df232273d6

SHA512
558c084185ac2f71a6de4c1ef949254881c1d47c7ce38af6ce8b9d933bd67b87e4af82991e21a3f6ab509213cc8aded4969a2befc0f8bea8b86da5c86fde193d

Download Submit
memory/736-81-0x0000000000000000-mapping.dmp

Download
memory/756-62-0x0000000000000000-mapping.dmp

Download
memory/992-88-0x0000000000000000-mapping.dmp

Download
memory/1380-77-0x0000000000000000-mapping.dmp

Download
memory/1428-57-0x0000000000000000-mapping.dmp

Download
memory/1528-82-0x0000000000000000-mapping.dmp

Download
memory/1552-71-0x0000000000000000-mapping.dmp

Download
memory/1556-87-0x0000000000000000-mapping.dmp

Download
memory/1628-69-0x0000000000360000-0x00000000007BE000-memory.dmp

Filesize
4.4MB

Download
memory/1628-54-0x0000000075BE1000-0x0000000075BE3000-memory.dmp

Filesize
8KB

Download
memory/1628-91-0x0000000000360000-0x00000000007BE000-memory.dmp

Filesize
4.4MB

Download
memory/1628-59-0x0000000000360000-0x00000000007BE000-memory.dmp

Filesize
4.4MB

Download
memory/1752-58-0x0000000000000000-mapping.dmp

Download
memory/1760-64-0x0000000000000000-mapping.dmp

Download
memory/1764-61-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads