884ad5929ee87ae62b37ac381b8243d98657b064f34d6e2ae23eddfad974f50e

Analysis

max time kernel
45s
max time network
31s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
23-11-2022 10:20

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

884ad5929ee87ae62b37ac381b8243d98657b064f34d6e2ae23eddfad974f50e.exe
Size

603KB
MD5

6c7eac937697bd7d70247f655a3c03be
SHA1

7ca5d9314ca93d53c23dd350c7dc262f2aac5e13
SHA256

884ad5929ee87ae62b37ac381b8243d98657b064f34d6e2ae23eddfad974f50e
SHA512

46bab5abff17c4c076bff89e91835b579e00a5f320828ae0f2b8694fa9896a3306eccc6201be1692ba6882a0344fb19c4842b16b1ca5b898e87128499ceddd5b
SSDEEP

12288:WIny5DYTmIM8YQfTB/QXFnXu5JHZuoL/Wz4Hhh2pqkWF4HD7CEuU:YUTm78YQ7B/peAhkpeyHD7CE

Score

8^/10

discovery

Malware Config

Signatures

Drops file in Drivers directory 1 IoCs

Processes:

884ad5929ee87ae62b37ac381b8243d98657b064f34d6e2ae23eddfad974f50e.exe

description ioc process

File created C:\Windows\system32\drivers\nethfdrv.sys 884ad5929ee87ae62b37ac381b8243d98657b064f34d6e2ae23eddfad974f50e.exe
Executes dropped EXE 5 IoCs

Processes:

installd.exenethtsrv.exenetupdsrv.exenethtsrv.exenetupdsrv.exe

pid process

1636 installd.exe
1748 nethtsrv.exe
1120 netupdsrv.exe
1956 nethtsrv.exe
916 netupdsrv.exe

description	ioc	process
File created	C:\Windows\system32\drivers\nethfdrv.sys	884ad5929ee87ae62b37ac381b8243d98657b064f34d6e2ae23eddfad974f50e.exe

pid	process
1636	installd.exe
1748	nethtsrv.exe
1120	netupdsrv.exe
1956	nethtsrv.exe
916	netupdsrv.exe

Loads dropped DLL 13 IoCs

Processes:

884ad5929ee87ae62b37ac381b8243d98657b064f34d6e2ae23eddfad974f50e.exeinstalld.exenethtsrv.exenethtsrv.exe

pid	process
1388	884ad5929ee87ae62b37ac381b8243d98657b064f34d6e2ae23eddfad974f50e.exe
1388	884ad5929ee87ae62b37ac381b8243d98657b064f34d6e2ae23eddfad974f50e.exe
1388	884ad5929ee87ae62b37ac381b8243d98657b064f34d6e2ae23eddfad974f50e.exe
1388	884ad5929ee87ae62b37ac381b8243d98657b064f34d6e2ae23eddfad974f50e.exe
1636	installd.exe
1388	884ad5929ee87ae62b37ac381b8243d98657b064f34d6e2ae23eddfad974f50e.exe
1748	nethtsrv.exe
1748	nethtsrv.exe
1388	884ad5929ee87ae62b37ac381b8243d98657b064f34d6e2ae23eddfad974f50e.exe
1388	884ad5929ee87ae62b37ac381b8243d98657b064f34d6e2ae23eddfad974f50e.exe
1956	nethtsrv.exe
1956	nethtsrv.exe
1388	884ad5929ee87ae62b37ac381b8243d98657b064f34d6e2ae23eddfad974f50e.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in System32 directory 5 IoCs

Processes:

884ad5929ee87ae62b37ac381b8243d98657b064f34d6e2ae23eddfad974f50e.exe

description	ioc	process
File created	C:\Windows\SysWOW64\hfnapi.dll	884ad5929ee87ae62b37ac381b8243d98657b064f34d6e2ae23eddfad974f50e.exe
File created	C:\Windows\SysWOW64\hfpapi.dll	884ad5929ee87ae62b37ac381b8243d98657b064f34d6e2ae23eddfad974f50e.exe
File created	C:\Windows\SysWOW64\installd.exe	884ad5929ee87ae62b37ac381b8243d98657b064f34d6e2ae23eddfad974f50e.exe
File created	C:\Windows\SysWOW64\nethtsrv.exe	884ad5929ee87ae62b37ac381b8243d98657b064f34d6e2ae23eddfad974f50e.exe
File created	C:\Windows\SysWOW64\netupdsrv.exe	884ad5929ee87ae62b37ac381b8243d98657b064f34d6e2ae23eddfad974f50e.exe

Drops file in Program Files directory 3 IoCs

Processes:

884ad5929ee87ae62b37ac381b8243d98657b064f34d6e2ae23eddfad974f50e.exe

description	ioc	process
File created	C:\Program Files (x86)\Common Files\config\uninstinethnfd.exe	884ad5929ee87ae62b37ac381b8243d98657b064f34d6e2ae23eddfad974f50e.exe
File created	C:\Program Files (x86)\Common Files\Config\data.xml	884ad5929ee87ae62b37ac381b8243d98657b064f34d6e2ae23eddfad974f50e.exe
File created	C:\Program Files (x86)\Common Files\Config\ver.xml	884ad5929ee87ae62b37ac381b8243d98657b064f34d6e2ae23eddfad974f50e.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Runs net.exe
Suspicious behavior: LoadsDriver 1 IoCs

Processes:

pid process

464
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

nethtsrv.exe

description pid process

Token: SeDebugPrivilege 1956 nethtsrv.exe

pid	process
464

description	pid	process
Token: SeDebugPrivilege	1956	nethtsrv.exe

Suspicious use of WriteProcessMemory 50 IoCs

Processes:

884ad5929ee87ae62b37ac381b8243d98657b064f34d6e2ae23eddfad974f50e.exenet.exenet.exenet.exenet.exe

description	pid	process	target process
PID 1388 wrote to memory of 1348	1388	884ad5929ee87ae62b37ac381b8243d98657b064f34d6e2ae23eddfad974f50e.exe	net.exe
PID 1388 wrote to memory of 1348	1388	884ad5929ee87ae62b37ac381b8243d98657b064f34d6e2ae23eddfad974f50e.exe	net.exe
PID 1388 wrote to memory of 1348	1388	884ad5929ee87ae62b37ac381b8243d98657b064f34d6e2ae23eddfad974f50e.exe	net.exe
PID 1388 wrote to memory of 1348	1388	884ad5929ee87ae62b37ac381b8243d98657b064f34d6e2ae23eddfad974f50e.exe	net.exe
PID 1348 wrote to memory of 712	1348	net.exe	net1.exe
PID 1348 wrote to memory of 712	1348	net.exe	net1.exe
PID 1348 wrote to memory of 712	1348	net.exe	net1.exe
PID 1348 wrote to memory of 712	1348	net.exe	net1.exe
PID 1388 wrote to memory of 1488	1388	884ad5929ee87ae62b37ac381b8243d98657b064f34d6e2ae23eddfad974f50e.exe	net.exe
PID 1388 wrote to memory of 1488	1388	884ad5929ee87ae62b37ac381b8243d98657b064f34d6e2ae23eddfad974f50e.exe	net.exe
PID 1388 wrote to memory of 1488	1388	884ad5929ee87ae62b37ac381b8243d98657b064f34d6e2ae23eddfad974f50e.exe	net.exe
PID 1388 wrote to memory of 1488	1388	884ad5929ee87ae62b37ac381b8243d98657b064f34d6e2ae23eddfad974f50e.exe	net.exe
PID 1488 wrote to memory of 1128	1488	net.exe	net1.exe
PID 1488 wrote to memory of 1128	1488	net.exe	net1.exe
PID 1488 wrote to memory of 1128	1488	net.exe	net1.exe
PID 1488 wrote to memory of 1128	1488	net.exe	net1.exe
PID 1388 wrote to memory of 1636	1388	884ad5929ee87ae62b37ac381b8243d98657b064f34d6e2ae23eddfad974f50e.exe	installd.exe
PID 1388 wrote to memory of 1636	1388	884ad5929ee87ae62b37ac381b8243d98657b064f34d6e2ae23eddfad974f50e.exe	installd.exe
PID 1388 wrote to memory of 1636	1388	884ad5929ee87ae62b37ac381b8243d98657b064f34d6e2ae23eddfad974f50e.exe	installd.exe
PID 1388 wrote to memory of 1636	1388	884ad5929ee87ae62b37ac381b8243d98657b064f34d6e2ae23eddfad974f50e.exe	installd.exe
PID 1388 wrote to memory of 1636	1388	884ad5929ee87ae62b37ac381b8243d98657b064f34d6e2ae23eddfad974f50e.exe	installd.exe
PID 1388 wrote to memory of 1636	1388	884ad5929ee87ae62b37ac381b8243d98657b064f34d6e2ae23eddfad974f50e.exe	installd.exe
PID 1388 wrote to memory of 1636	1388	884ad5929ee87ae62b37ac381b8243d98657b064f34d6e2ae23eddfad974f50e.exe	installd.exe
PID 1388 wrote to memory of 1748	1388	884ad5929ee87ae62b37ac381b8243d98657b064f34d6e2ae23eddfad974f50e.exe	nethtsrv.exe
PID 1388 wrote to memory of 1748	1388	884ad5929ee87ae62b37ac381b8243d98657b064f34d6e2ae23eddfad974f50e.exe	nethtsrv.exe
PID 1388 wrote to memory of 1748	1388	884ad5929ee87ae62b37ac381b8243d98657b064f34d6e2ae23eddfad974f50e.exe	nethtsrv.exe
PID 1388 wrote to memory of 1748	1388	884ad5929ee87ae62b37ac381b8243d98657b064f34d6e2ae23eddfad974f50e.exe	nethtsrv.exe
PID 1388 wrote to memory of 1120	1388	884ad5929ee87ae62b37ac381b8243d98657b064f34d6e2ae23eddfad974f50e.exe	netupdsrv.exe
PID 1388 wrote to memory of 1120	1388	884ad5929ee87ae62b37ac381b8243d98657b064f34d6e2ae23eddfad974f50e.exe	netupdsrv.exe
PID 1388 wrote to memory of 1120	1388	884ad5929ee87ae62b37ac381b8243d98657b064f34d6e2ae23eddfad974f50e.exe	netupdsrv.exe
PID 1388 wrote to memory of 1120	1388	884ad5929ee87ae62b37ac381b8243d98657b064f34d6e2ae23eddfad974f50e.exe	netupdsrv.exe
PID 1388 wrote to memory of 1120	1388	884ad5929ee87ae62b37ac381b8243d98657b064f34d6e2ae23eddfad974f50e.exe	netupdsrv.exe
PID 1388 wrote to memory of 1120	1388	884ad5929ee87ae62b37ac381b8243d98657b064f34d6e2ae23eddfad974f50e.exe	netupdsrv.exe
PID 1388 wrote to memory of 1120	1388	884ad5929ee87ae62b37ac381b8243d98657b064f34d6e2ae23eddfad974f50e.exe	netupdsrv.exe
PID 1388 wrote to memory of 1892	1388	884ad5929ee87ae62b37ac381b8243d98657b064f34d6e2ae23eddfad974f50e.exe	net.exe
PID 1388 wrote to memory of 1892	1388	884ad5929ee87ae62b37ac381b8243d98657b064f34d6e2ae23eddfad974f50e.exe	net.exe
PID 1388 wrote to memory of 1892	1388	884ad5929ee87ae62b37ac381b8243d98657b064f34d6e2ae23eddfad974f50e.exe	net.exe
PID 1388 wrote to memory of 1892	1388	884ad5929ee87ae62b37ac381b8243d98657b064f34d6e2ae23eddfad974f50e.exe	net.exe
PID 1892 wrote to memory of 1576	1892	net.exe	net1.exe
PID 1892 wrote to memory of 1576	1892	net.exe	net1.exe
PID 1892 wrote to memory of 1576	1892	net.exe	net1.exe
PID 1892 wrote to memory of 1576	1892	net.exe	net1.exe
PID 1388 wrote to memory of 2044	1388	884ad5929ee87ae62b37ac381b8243d98657b064f34d6e2ae23eddfad974f50e.exe	net.exe
PID 1388 wrote to memory of 2044	1388	884ad5929ee87ae62b37ac381b8243d98657b064f34d6e2ae23eddfad974f50e.exe	net.exe
PID 1388 wrote to memory of 2044	1388	884ad5929ee87ae62b37ac381b8243d98657b064f34d6e2ae23eddfad974f50e.exe	net.exe
PID 1388 wrote to memory of 2044	1388	884ad5929ee87ae62b37ac381b8243d98657b064f34d6e2ae23eddfad974f50e.exe	net.exe
PID 2044 wrote to memory of 1560	2044	net.exe	net1.exe
PID 2044 wrote to memory of 1560	2044	net.exe	net1.exe
PID 2044 wrote to memory of 1560	2044	net.exe	net1.exe
PID 2044 wrote to memory of 1560	2044	net.exe	net1.exe

C:\Users\Admin\AppData\Local\Temp\884ad5929ee87ae62b37ac381b8243d98657b064f34d6e2ae23eddfad974f50e.exe
"C:\Users\Admin\AppData\Local\Temp\884ad5929ee87ae62b37ac381b8243d98657b064f34d6e2ae23eddfad974f50e.exe"
1⤵
- Drops file in Drivers directory
- Loads dropped DLL
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:1388

C:\Windows\SysWOW64\net.exe
net stop nethttpservice
2⤵
- Suspicious use of WriteProcessMemory
PID:1348

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop nethttpservice
3⤵
PID:712

C:\Windows\SysWOW64\net.exe
net stop serviceupdater
2⤵
- Suspicious use of WriteProcessMemory
PID:1488

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop serviceupdater
3⤵
PID:1128

C:\Windows\SysWOW64\installd.exe
"C:\Windows\system32\installd.exe" nethfdrv
2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1636

C:\Windows\SysWOW64\nethtsrv.exe
"C:\Windows\system32\nethtsrv.exe" -nfdi
2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1748

C:\Windows\SysWOW64\netupdsrv.exe
"C:\Windows\system32\netupdsrv.exe" -nfdi
2⤵
- Executes dropped EXE
PID:1120

C:\Windows\SysWOW64\net.exe
net start nethttpservice
2⤵
- Suspicious use of WriteProcessMemory
PID:1892

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 start nethttpservice
3⤵
PID:1576

C:\Windows\SysWOW64\net.exe
net start serviceupdater
2⤵
- Suspicious use of WriteProcessMemory
PID:2044

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 start serviceupdater
3⤵
PID:1560

C:\Windows\SysWOW64\nethtsrv.exe
C:\Windows\SysWOW64\nethtsrv.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:1956

C:\Windows\SysWOW64\netupdsrv.exe
C:\Windows\SysWOW64\netupdsrv.exe
1⤵
- Executes dropped EXE
PID:916

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\hfnapi.dll
Filesize
106KB

MD5
37c3ebd2b2e2df5c29d818e249c0d4b7

SHA1
50437d8a0dccf2739ce1b3323bce06955ff45816

SHA256
447e83a05fb6ef56a5cd06e561fdba59811ae7199c6035adbddfc0b2039fd082

SHA512
fa246f400c6fa652281785d842f657a66d9058b2da3610f265c8d4bf6b9ee156b750495d5bc2c23c5491578393cfb3875e2a8757a8582257b134c0c6f3bb5daa

Download Submit
C:\Windows\SysWOW64\hfpapi.dll
Filesize
244KB

MD5
56c57a367689023616315b7e25b901f3

SHA1
747401f3c637dd468db005dfada04f6e002e03f7

SHA256
602741a1ee14a25f98b20284b790561db380a524394e09dfd61622279cd09976

SHA512
72ef5cfcd6879f05b6c944c30e3c2e8abf6781389b8aeccc74c0c08196364fc79a943ba06d9b5b014a4ddd03e7744451dffba944e18e4d08203f660353d735a0

Download Submit
C:\Windows\SysWOW64\installd.exe
Filesize
108KB

MD5
5bb1ef5b80f1f2824a2705c9fec04371

SHA1
582b67fce59e87e0d4fe2c36f1c03dfdae1bba52

SHA256
e605889e8e5f5036834d11d9133bab6985d6ed6e92b9f80ded7d7bad8210cd29

SHA512
134a2f90ad43ae9c74d4df6b5d372c557b15aee989bc78e031d43e9698819e91cb0f7f9810eee502bb846eeaf73b7a059af02d35a2f84dce117718f52e0c4f41

Download Submit
C:\Windows\SysWOW64\nethtsrv.exe
Filesize
176KB

MD5
7dd304e88c1dec2546d11a6ccdfd3815

SHA1
04f9f289ec5374d99cbd9b3891b7e971ce6b308d

SHA256
0f06b29a69eaa8aee9aea4e7222c5af01bc82c121137eb870f80428934211622

SHA512
0a2732d0b41d244a1d646289c5a107e7dde138fe9ec2750f88bf57dae1064223655ed3b5fffb0692fce265a659906fa663bdc512aa16c0a16755ff8bd2c95a5c

Download Submit
C:\Windows\SysWOW64\nethtsrv.exe
Filesize
176KB

MD5
7dd304e88c1dec2546d11a6ccdfd3815

SHA1
04f9f289ec5374d99cbd9b3891b7e971ce6b308d

SHA256
0f06b29a69eaa8aee9aea4e7222c5af01bc82c121137eb870f80428934211622

SHA512
0a2732d0b41d244a1d646289c5a107e7dde138fe9ec2750f88bf57dae1064223655ed3b5fffb0692fce265a659906fa663bdc512aa16c0a16755ff8bd2c95a5c

Download Submit
C:\Windows\SysWOW64\netupdsrv.exe
Filesize
158KB

MD5
05ae95fdf1b63726fa93450845233a94

SHA1
18c2b91ecac2ce4bb781b7166476d69584128d83

SHA256
560d0d8d782618e6b09485d16300a5dd060e45a0de0dcf37e74aa708448a3c25

SHA512
28e28f6d549b71d0ff5929b31983c6aadc920ed8d03da4a47cbd6387af3dc11d51d85bb80d65a89dfd1b01e6c8dfe6c68e00cc6bcd84094c40f0b76776ce2cee

Download Submit
C:\Windows\SysWOW64\netupdsrv.exe
Filesize
158KB

MD5
05ae95fdf1b63726fa93450845233a94

SHA1
18c2b91ecac2ce4bb781b7166476d69584128d83

SHA256
560d0d8d782618e6b09485d16300a5dd060e45a0de0dcf37e74aa708448a3c25

SHA512
28e28f6d549b71d0ff5929b31983c6aadc920ed8d03da4a47cbd6387af3dc11d51d85bb80d65a89dfd1b01e6c8dfe6c68e00cc6bcd84094c40f0b76776ce2cee

Download Submit
\Users\Admin\AppData\Local\Temp\nsd69CD.tmp\System.dll
Filesize
11KB

MD5
c17103ae9072a06da581dec998343fc1

SHA1
b72148c6bdfaada8b8c3f950e610ee7cf1da1f8d

SHA256
dc58d8ad81cacb0c1ed72e33bff8f23ea40b5252b5bb55d393a0903e6819ae2f

SHA512
d32a71aaef18e993f28096d536e41c4d016850721b31171513ce28bbd805a54fd290b7c3e9d935f72e676a1acfb4f0dcc89d95040a0dd29f2b6975855c18986f

Download Submit
\Users\Admin\AppData\Local\Temp\nsd69CD.tmp\nsExec.dll
Filesize
6KB

MD5
acc2b699edfea5bf5aae45aba3a41e96

SHA1
d2accf4d494e43ceb2cff69abe4dd17147d29cc2

SHA256
168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e

SHA512
e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe

Download Submit
\Users\Admin\AppData\Local\Temp\nsd69CD.tmp\nsExec.dll
Filesize
6KB

MD5
acc2b699edfea5bf5aae45aba3a41e96

SHA1
d2accf4d494e43ceb2cff69abe4dd17147d29cc2

SHA256
168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e

SHA512
e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe

Download Submit
\Users\Admin\AppData\Local\Temp\nsd69CD.tmp\nsExec.dll
Filesize
6KB

MD5
acc2b699edfea5bf5aae45aba3a41e96

SHA1
d2accf4d494e43ceb2cff69abe4dd17147d29cc2

SHA256
168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e

SHA512
e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe

Download Submit
\Users\Admin\AppData\Local\Temp\nsd69CD.tmp\nsExec.dll
Filesize
6KB

MD5
acc2b699edfea5bf5aae45aba3a41e96

SHA1
d2accf4d494e43ceb2cff69abe4dd17147d29cc2

SHA256
168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e

SHA512
e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe

Download Submit
\Windows\SysWOW64\hfnapi.dll
Filesize
106KB

MD5
37c3ebd2b2e2df5c29d818e249c0d4b7

SHA1
50437d8a0dccf2739ce1b3323bce06955ff45816

SHA256
447e83a05fb6ef56a5cd06e561fdba59811ae7199c6035adbddfc0b2039fd082

SHA512
fa246f400c6fa652281785d842f657a66d9058b2da3610f265c8d4bf6b9ee156b750495d5bc2c23c5491578393cfb3875e2a8757a8582257b134c0c6f3bb5daa

Download Submit
\Windows\SysWOW64\hfnapi.dll
Filesize
106KB

MD5
37c3ebd2b2e2df5c29d818e249c0d4b7

SHA1
50437d8a0dccf2739ce1b3323bce06955ff45816

SHA256
447e83a05fb6ef56a5cd06e561fdba59811ae7199c6035adbddfc0b2039fd082

SHA512
fa246f400c6fa652281785d842f657a66d9058b2da3610f265c8d4bf6b9ee156b750495d5bc2c23c5491578393cfb3875e2a8757a8582257b134c0c6f3bb5daa

Download Submit
\Windows\SysWOW64\hfnapi.dll
Filesize
106KB

MD5
37c3ebd2b2e2df5c29d818e249c0d4b7

SHA1
50437d8a0dccf2739ce1b3323bce06955ff45816

SHA256
447e83a05fb6ef56a5cd06e561fdba59811ae7199c6035adbddfc0b2039fd082

SHA512
fa246f400c6fa652281785d842f657a66d9058b2da3610f265c8d4bf6b9ee156b750495d5bc2c23c5491578393cfb3875e2a8757a8582257b134c0c6f3bb5daa

Download Submit
\Windows\SysWOW64\hfpapi.dll
Filesize
244KB

MD5
56c57a367689023616315b7e25b901f3

SHA1
747401f3c637dd468db005dfada04f6e002e03f7

SHA256
602741a1ee14a25f98b20284b790561db380a524394e09dfd61622279cd09976

SHA512
72ef5cfcd6879f05b6c944c30e3c2e8abf6781389b8aeccc74c0c08196364fc79a943ba06d9b5b014a4ddd03e7744451dffba944e18e4d08203f660353d735a0

Download Submit
\Windows\SysWOW64\hfpapi.dll
Filesize
244KB

MD5
56c57a367689023616315b7e25b901f3

SHA1
747401f3c637dd468db005dfada04f6e002e03f7

SHA256
602741a1ee14a25f98b20284b790561db380a524394e09dfd61622279cd09976

SHA512
72ef5cfcd6879f05b6c944c30e3c2e8abf6781389b8aeccc74c0c08196364fc79a943ba06d9b5b014a4ddd03e7744451dffba944e18e4d08203f660353d735a0

Download Submit
\Windows\SysWOW64\installd.exe
Filesize
108KB

MD5
5bb1ef5b80f1f2824a2705c9fec04371

SHA1
582b67fce59e87e0d4fe2c36f1c03dfdae1bba52

SHA256
e605889e8e5f5036834d11d9133bab6985d6ed6e92b9f80ded7d7bad8210cd29

SHA512
134a2f90ad43ae9c74d4df6b5d372c557b15aee989bc78e031d43e9698819e91cb0f7f9810eee502bb846eeaf73b7a059af02d35a2f84dce117718f52e0c4f41

Download Submit
\Windows\SysWOW64\nethtsrv.exe
Filesize
176KB

MD5
7dd304e88c1dec2546d11a6ccdfd3815

SHA1
04f9f289ec5374d99cbd9b3891b7e971ce6b308d

SHA256
0f06b29a69eaa8aee9aea4e7222c5af01bc82c121137eb870f80428934211622

SHA512
0a2732d0b41d244a1d646289c5a107e7dde138fe9ec2750f88bf57dae1064223655ed3b5fffb0692fce265a659906fa663bdc512aa16c0a16755ff8bd2c95a5c

Download Submit
\Windows\SysWOW64\netupdsrv.exe
Filesize
158KB

MD5
05ae95fdf1b63726fa93450845233a94

SHA1
18c2b91ecac2ce4bb781b7166476d69584128d83

SHA256
560d0d8d782618e6b09485d16300a5dd060e45a0de0dcf37e74aa708448a3c25

SHA512
28e28f6d549b71d0ff5929b31983c6aadc920ed8d03da4a47cbd6387af3dc11d51d85bb80d65a89dfd1b01e6c8dfe6c68e00cc6bcd84094c40f0b76776ce2cee

Download Submit
memory/712-58-0x0000000000000000-mapping.dmp

Download
memory/1120-77-0x0000000000000000-mapping.dmp

Download
memory/1128-61-0x0000000000000000-mapping.dmp

Download
memory/1348-57-0x0000000000000000-mapping.dmp

Download
memory/1388-62-0x0000000000360000-0x00000000007BE000-memory.dmp

Filesize
4.4MB

Download
memory/1388-69-0x0000000000360000-0x00000000007BE000-memory.dmp

Filesize
4.4MB

Download
memory/1388-54-0x0000000075C31000-0x0000000075C33000-memory.dmp

Filesize
8KB

Download
memory/1388-91-0x0000000000360000-0x00000000007BE000-memory.dmp

Filesize
4.4MB

Download
memory/1488-60-0x0000000000000000-mapping.dmp

Download
memory/1560-88-0x0000000000000000-mapping.dmp

Download
memory/1576-82-0x0000000000000000-mapping.dmp

Download
memory/1636-64-0x0000000000000000-mapping.dmp

Download
memory/1748-71-0x0000000000000000-mapping.dmp

Download
memory/1892-81-0x0000000000000000-mapping.dmp

Download
memory/2044-87-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads