982096fc40eab95ea974cb59d6caa3ba9cfad5608e5cbbb265dcf656aa1e4e8a

Analysis

max time kernel
47s
max time network
52s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
23-11-2022 10:18

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

982096fc40eab95ea974cb59d6caa3ba9cfad5608e5cbbb265dcf656aa1e4e8a.exe
Size

602KB
MD5

d8fa652ce4a2f264f4f45996d896f31a
SHA1

4f2539e6b7ba75e4de101d5bafd9b04020e22d91
SHA256

982096fc40eab95ea974cb59d6caa3ba9cfad5608e5cbbb265dcf656aa1e4e8a
SHA512

4f45ec3600ed6792fe0521db3dcdc1122c7f35e0804f5dfc50191ff211ceabb6c45803e16244529725b1b28e46ceb5b96b684614d971f7a3fb8da5c1bffe401d
SSDEEP

12288:bIny5DYT6skk/Dj/1LPA/WWqQO4dJGPaItzvBW:jUTVkSjlI/5O44F

Score

8^/10

discovery

Malware Config

Signatures

Drops file in Drivers directory 1 IoCs

Processes:

982096fc40eab95ea974cb59d6caa3ba9cfad5608e5cbbb265dcf656aa1e4e8a.exe

description ioc process

File created C:\Windows\system32\drivers\nethfdrv.sys 982096fc40eab95ea974cb59d6caa3ba9cfad5608e5cbbb265dcf656aa1e4e8a.exe
Executes dropped EXE 5 IoCs

Processes:

installd.exenethtsrv.exenetupdsrv.exenethtsrv.exenetupdsrv.exe

pid process

792 installd.exe
1096 nethtsrv.exe
1592 netupdsrv.exe
2036 nethtsrv.exe
2000 netupdsrv.exe

description	ioc	process
File created	C:\Windows\system32\drivers\nethfdrv.sys	982096fc40eab95ea974cb59d6caa3ba9cfad5608e5cbbb265dcf656aa1e4e8a.exe

pid	process
792	installd.exe
1096	nethtsrv.exe
1592	netupdsrv.exe
2036	nethtsrv.exe
2000	netupdsrv.exe

Loads dropped DLL 13 IoCs

Processes:

982096fc40eab95ea974cb59d6caa3ba9cfad5608e5cbbb265dcf656aa1e4e8a.exeinstalld.exenethtsrv.exenethtsrv.exe

pid	process
1204	982096fc40eab95ea974cb59d6caa3ba9cfad5608e5cbbb265dcf656aa1e4e8a.exe
1204	982096fc40eab95ea974cb59d6caa3ba9cfad5608e5cbbb265dcf656aa1e4e8a.exe
1204	982096fc40eab95ea974cb59d6caa3ba9cfad5608e5cbbb265dcf656aa1e4e8a.exe
1204	982096fc40eab95ea974cb59d6caa3ba9cfad5608e5cbbb265dcf656aa1e4e8a.exe
792	installd.exe
1204	982096fc40eab95ea974cb59d6caa3ba9cfad5608e5cbbb265dcf656aa1e4e8a.exe
1096	nethtsrv.exe
1096	nethtsrv.exe
1204	982096fc40eab95ea974cb59d6caa3ba9cfad5608e5cbbb265dcf656aa1e4e8a.exe
1204	982096fc40eab95ea974cb59d6caa3ba9cfad5608e5cbbb265dcf656aa1e4e8a.exe
2036	nethtsrv.exe
2036	nethtsrv.exe
1204	982096fc40eab95ea974cb59d6caa3ba9cfad5608e5cbbb265dcf656aa1e4e8a.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in System32 directory 5 IoCs

Processes:

982096fc40eab95ea974cb59d6caa3ba9cfad5608e5cbbb265dcf656aa1e4e8a.exe

description	ioc	process
File created	C:\Windows\SysWOW64\hfnapi.dll	982096fc40eab95ea974cb59d6caa3ba9cfad5608e5cbbb265dcf656aa1e4e8a.exe
File created	C:\Windows\SysWOW64\hfpapi.dll	982096fc40eab95ea974cb59d6caa3ba9cfad5608e5cbbb265dcf656aa1e4e8a.exe
File created	C:\Windows\SysWOW64\installd.exe	982096fc40eab95ea974cb59d6caa3ba9cfad5608e5cbbb265dcf656aa1e4e8a.exe
File created	C:\Windows\SysWOW64\nethtsrv.exe	982096fc40eab95ea974cb59d6caa3ba9cfad5608e5cbbb265dcf656aa1e4e8a.exe
File created	C:\Windows\SysWOW64\netupdsrv.exe	982096fc40eab95ea974cb59d6caa3ba9cfad5608e5cbbb265dcf656aa1e4e8a.exe

Drops file in Program Files directory 3 IoCs

Processes:

982096fc40eab95ea974cb59d6caa3ba9cfad5608e5cbbb265dcf656aa1e4e8a.exe

description	ioc	process
File created	C:\Program Files (x86)\Common Files\Config\data.xml	982096fc40eab95ea974cb59d6caa3ba9cfad5608e5cbbb265dcf656aa1e4e8a.exe
File created	C:\Program Files (x86)\Common Files\Config\ver.xml	982096fc40eab95ea974cb59d6caa3ba9cfad5608e5cbbb265dcf656aa1e4e8a.exe
File created	C:\Program Files (x86)\Common Files\config\uninstinethnfd.exe	982096fc40eab95ea974cb59d6caa3ba9cfad5608e5cbbb265dcf656aa1e4e8a.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Runs net.exe
Suspicious behavior: LoadsDriver 1 IoCs

Processes:

pid process

468
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

nethtsrv.exe

description pid process

Token: SeDebugPrivilege 2036 nethtsrv.exe

pid	process
468

description	pid	process
Token: SeDebugPrivilege	2036	nethtsrv.exe

Suspicious use of WriteProcessMemory 50 IoCs

Processes:

982096fc40eab95ea974cb59d6caa3ba9cfad5608e5cbbb265dcf656aa1e4e8a.exenet.exenet.exenet.exenet.exe

description	pid	process	target process
PID 1204 wrote to memory of 2044	1204	982096fc40eab95ea974cb59d6caa3ba9cfad5608e5cbbb265dcf656aa1e4e8a.exe	net.exe
PID 1204 wrote to memory of 2044	1204	982096fc40eab95ea974cb59d6caa3ba9cfad5608e5cbbb265dcf656aa1e4e8a.exe	net.exe
PID 1204 wrote to memory of 2044	1204	982096fc40eab95ea974cb59d6caa3ba9cfad5608e5cbbb265dcf656aa1e4e8a.exe	net.exe
PID 1204 wrote to memory of 2044	1204	982096fc40eab95ea974cb59d6caa3ba9cfad5608e5cbbb265dcf656aa1e4e8a.exe	net.exe
PID 2044 wrote to memory of 1744	2044	net.exe	net1.exe
PID 2044 wrote to memory of 1744	2044	net.exe	net1.exe
PID 2044 wrote to memory of 1744	2044	net.exe	net1.exe
PID 2044 wrote to memory of 1744	2044	net.exe	net1.exe
PID 1204 wrote to memory of 1528	1204	982096fc40eab95ea974cb59d6caa3ba9cfad5608e5cbbb265dcf656aa1e4e8a.exe	net.exe
PID 1204 wrote to memory of 1528	1204	982096fc40eab95ea974cb59d6caa3ba9cfad5608e5cbbb265dcf656aa1e4e8a.exe	net.exe
PID 1204 wrote to memory of 1528	1204	982096fc40eab95ea974cb59d6caa3ba9cfad5608e5cbbb265dcf656aa1e4e8a.exe	net.exe
PID 1204 wrote to memory of 1528	1204	982096fc40eab95ea974cb59d6caa3ba9cfad5608e5cbbb265dcf656aa1e4e8a.exe	net.exe
PID 1528 wrote to memory of 332	1528	net.exe	net1.exe
PID 1528 wrote to memory of 332	1528	net.exe	net1.exe
PID 1528 wrote to memory of 332	1528	net.exe	net1.exe
PID 1528 wrote to memory of 332	1528	net.exe	net1.exe
PID 1204 wrote to memory of 792	1204	982096fc40eab95ea974cb59d6caa3ba9cfad5608e5cbbb265dcf656aa1e4e8a.exe	installd.exe
PID 1204 wrote to memory of 792	1204	982096fc40eab95ea974cb59d6caa3ba9cfad5608e5cbbb265dcf656aa1e4e8a.exe	installd.exe
PID 1204 wrote to memory of 792	1204	982096fc40eab95ea974cb59d6caa3ba9cfad5608e5cbbb265dcf656aa1e4e8a.exe	installd.exe
PID 1204 wrote to memory of 792	1204	982096fc40eab95ea974cb59d6caa3ba9cfad5608e5cbbb265dcf656aa1e4e8a.exe	installd.exe
PID 1204 wrote to memory of 792	1204	982096fc40eab95ea974cb59d6caa3ba9cfad5608e5cbbb265dcf656aa1e4e8a.exe	installd.exe
PID 1204 wrote to memory of 792	1204	982096fc40eab95ea974cb59d6caa3ba9cfad5608e5cbbb265dcf656aa1e4e8a.exe	installd.exe
PID 1204 wrote to memory of 792	1204	982096fc40eab95ea974cb59d6caa3ba9cfad5608e5cbbb265dcf656aa1e4e8a.exe	installd.exe
PID 1204 wrote to memory of 1096	1204	982096fc40eab95ea974cb59d6caa3ba9cfad5608e5cbbb265dcf656aa1e4e8a.exe	nethtsrv.exe
PID 1204 wrote to memory of 1096	1204	982096fc40eab95ea974cb59d6caa3ba9cfad5608e5cbbb265dcf656aa1e4e8a.exe	nethtsrv.exe
PID 1204 wrote to memory of 1096	1204	982096fc40eab95ea974cb59d6caa3ba9cfad5608e5cbbb265dcf656aa1e4e8a.exe	nethtsrv.exe
PID 1204 wrote to memory of 1096	1204	982096fc40eab95ea974cb59d6caa3ba9cfad5608e5cbbb265dcf656aa1e4e8a.exe	nethtsrv.exe
PID 1204 wrote to memory of 1592	1204	982096fc40eab95ea974cb59d6caa3ba9cfad5608e5cbbb265dcf656aa1e4e8a.exe	netupdsrv.exe
PID 1204 wrote to memory of 1592	1204	982096fc40eab95ea974cb59d6caa3ba9cfad5608e5cbbb265dcf656aa1e4e8a.exe	netupdsrv.exe
PID 1204 wrote to memory of 1592	1204	982096fc40eab95ea974cb59d6caa3ba9cfad5608e5cbbb265dcf656aa1e4e8a.exe	netupdsrv.exe
PID 1204 wrote to memory of 1592	1204	982096fc40eab95ea974cb59d6caa3ba9cfad5608e5cbbb265dcf656aa1e4e8a.exe	netupdsrv.exe
PID 1204 wrote to memory of 1592	1204	982096fc40eab95ea974cb59d6caa3ba9cfad5608e5cbbb265dcf656aa1e4e8a.exe	netupdsrv.exe
PID 1204 wrote to memory of 1592	1204	982096fc40eab95ea974cb59d6caa3ba9cfad5608e5cbbb265dcf656aa1e4e8a.exe	netupdsrv.exe
PID 1204 wrote to memory of 1592	1204	982096fc40eab95ea974cb59d6caa3ba9cfad5608e5cbbb265dcf656aa1e4e8a.exe	netupdsrv.exe
PID 1204 wrote to memory of 2012	1204	982096fc40eab95ea974cb59d6caa3ba9cfad5608e5cbbb265dcf656aa1e4e8a.exe	net.exe
PID 1204 wrote to memory of 2012	1204	982096fc40eab95ea974cb59d6caa3ba9cfad5608e5cbbb265dcf656aa1e4e8a.exe	net.exe
PID 1204 wrote to memory of 2012	1204	982096fc40eab95ea974cb59d6caa3ba9cfad5608e5cbbb265dcf656aa1e4e8a.exe	net.exe
PID 1204 wrote to memory of 2012	1204	982096fc40eab95ea974cb59d6caa3ba9cfad5608e5cbbb265dcf656aa1e4e8a.exe	net.exe
PID 2012 wrote to memory of 1492	2012	net.exe	net1.exe
PID 2012 wrote to memory of 1492	2012	net.exe	net1.exe
PID 2012 wrote to memory of 1492	2012	net.exe	net1.exe
PID 2012 wrote to memory of 1492	2012	net.exe	net1.exe
PID 1204 wrote to memory of 904	1204	982096fc40eab95ea974cb59d6caa3ba9cfad5608e5cbbb265dcf656aa1e4e8a.exe	net.exe
PID 1204 wrote to memory of 904	1204	982096fc40eab95ea974cb59d6caa3ba9cfad5608e5cbbb265dcf656aa1e4e8a.exe	net.exe
PID 1204 wrote to memory of 904	1204	982096fc40eab95ea974cb59d6caa3ba9cfad5608e5cbbb265dcf656aa1e4e8a.exe	net.exe
PID 1204 wrote to memory of 904	1204	982096fc40eab95ea974cb59d6caa3ba9cfad5608e5cbbb265dcf656aa1e4e8a.exe	net.exe
PID 904 wrote to memory of 1788	904	net.exe	net1.exe
PID 904 wrote to memory of 1788	904	net.exe	net1.exe
PID 904 wrote to memory of 1788	904	net.exe	net1.exe
PID 904 wrote to memory of 1788	904	net.exe	net1.exe

C:\Users\Admin\AppData\Local\Temp\982096fc40eab95ea974cb59d6caa3ba9cfad5608e5cbbb265dcf656aa1e4e8a.exe
"C:\Users\Admin\AppData\Local\Temp\982096fc40eab95ea974cb59d6caa3ba9cfad5608e5cbbb265dcf656aa1e4e8a.exe"
1⤵
- Drops file in Drivers directory
- Loads dropped DLL
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:1204

C:\Windows\SysWOW64\net.exe
net stop nethttpservice
2⤵
- Suspicious use of WriteProcessMemory
PID:2044

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop nethttpservice
3⤵
PID:1744

C:\Windows\SysWOW64\net.exe
net stop serviceupdater
2⤵
- Suspicious use of WriteProcessMemory
PID:1528

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop serviceupdater
3⤵
PID:332

C:\Windows\SysWOW64\installd.exe
"C:\Windows\system32\installd.exe" nethfdrv
2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:792

C:\Windows\SysWOW64\nethtsrv.exe
"C:\Windows\system32\nethtsrv.exe" -nfdi
2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1096

C:\Windows\SysWOW64\netupdsrv.exe
"C:\Windows\system32\netupdsrv.exe" -nfdi
2⤵
- Executes dropped EXE
PID:1592

C:\Windows\SysWOW64\net.exe
net start nethttpservice
2⤵
- Suspicious use of WriteProcessMemory
PID:2012

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 start nethttpservice
3⤵
PID:1492

C:\Windows\SysWOW64\net.exe
net start serviceupdater
2⤵
- Suspicious use of WriteProcessMemory
PID:904

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 start serviceupdater
3⤵
PID:1788

C:\Windows\SysWOW64\nethtsrv.exe
C:\Windows\SysWOW64\nethtsrv.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:2036

C:\Windows\SysWOW64\netupdsrv.exe
C:\Windows\SysWOW64\netupdsrv.exe
1⤵
- Executes dropped EXE
PID:2000

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\hfnapi.dll
Filesize
106KB

MD5
bbb7cfb4e8cb9f6641843ecd73c7e1a6

SHA1
03ee064874f3528540960af178795760fa4dde32

SHA256
c1e939ee4812954af92bf8e82cb518dcd06b46d70959083b1849f171265eee87

SHA512
d5253561af2f66bc4c10944ad5361b28a35d11b721f2f4df0deb719866574ecb2e4de763bf8cba9ea22dda8503ab013534f1352d0ce99e2f1d47c5685079ec1b

Download Submit
C:\Windows\SysWOW64\hfpapi.dll
Filesize
241KB

MD5
335c780a51781381d7d2b7961d0f1c0d

SHA1
52c0b66f8e1dfb4f62b2025b21a4ab501429ae39

SHA256
f7fe4eb81b192ef2350579d1e5545f3058c48cd7437d4b2fb07910c44e5689e2

SHA512
08d26227a1d8a7c98b6bf3f2560abfe4a886fe6b89221d828109a00312557ce253ebf0143b6796e353aa715f92a1410c8c080088e83ae457231ddccbf2f81738

Download Submit
C:\Windows\SysWOW64\installd.exe
Filesize
108KB

MD5
9a1071a6de5c7d4d0f4633538f9c3a72

SHA1
0ef8fd69ca386243095640ff23a5c43330b61be5

SHA256
64420b5200069d2222a0b1eb9e660b38948e9d3599a8b6b7285111581f8a29f3

SHA512
0797a09afbb670e8ff151f07be66115de425e602e51161b80d4a7e1766fa0d7f0bd4e2c13820494c6d7272adf9d829a92f3210d4e3f64fe5ae2c5db3a3f4d7a4

Download Submit
C:\Windows\SysWOW64\nethtsrv.exe
Filesize
176KB

MD5
abceedc4ab72878ee222e2209cf63f38

SHA1
87d549085dfd254d22342edafec19f38d39ea703

SHA256
6cc3713e79a8defc44d811a20893fd6913bad57abc9c2e75582ae18a62c3f9ae

SHA512
06b21dd7606e4a6aaa2dd017277da8dbc94a2b21ee715111285017fcbd66c4933aa6a6a737bd24a598a801beae312d000791c5812411ecb63f0d752819031672

Download Submit
C:\Windows\SysWOW64\nethtsrv.exe
Filesize
176KB

MD5
abceedc4ab72878ee222e2209cf63f38

SHA1
87d549085dfd254d22342edafec19f38d39ea703

SHA256
6cc3713e79a8defc44d811a20893fd6913bad57abc9c2e75582ae18a62c3f9ae

SHA512
06b21dd7606e4a6aaa2dd017277da8dbc94a2b21ee715111285017fcbd66c4933aa6a6a737bd24a598a801beae312d000791c5812411ecb63f0d752819031672

Download Submit
C:\Windows\SysWOW64\netupdsrv.exe
Filesize
159KB

MD5
b3b5c54c114a17fb569080c1d6afd135

SHA1
e338ee6121bdcc813f3c6911eb46dd942884bc6b

SHA256
f30e1609f33b5fd96f86232245c1371730a76760d600b0db4fbfb87de7bac4b6

SHA512
90ee3505d3682d6759e6d6735c2373f46ff27748cb0174920500c057a09c8dda1e0ec3abdbb0a53c8edebce63014e01fff08e3b042e86b5d38a2577b48762536

Download Submit
C:\Windows\SysWOW64\netupdsrv.exe
Filesize
159KB

MD5
b3b5c54c114a17fb569080c1d6afd135

SHA1
e338ee6121bdcc813f3c6911eb46dd942884bc6b

SHA256
f30e1609f33b5fd96f86232245c1371730a76760d600b0db4fbfb87de7bac4b6

SHA512
90ee3505d3682d6759e6d6735c2373f46ff27748cb0174920500c057a09c8dda1e0ec3abdbb0a53c8edebce63014e01fff08e3b042e86b5d38a2577b48762536

Download Submit
\Users\Admin\AppData\Local\Temp\nso2C32.tmp\System.dll
Filesize
11KB

MD5
c17103ae9072a06da581dec998343fc1

SHA1
b72148c6bdfaada8b8c3f950e610ee7cf1da1f8d

SHA256
dc58d8ad81cacb0c1ed72e33bff8f23ea40b5252b5bb55d393a0903e6819ae2f

SHA512
d32a71aaef18e993f28096d536e41c4d016850721b31171513ce28bbd805a54fd290b7c3e9d935f72e676a1acfb4f0dcc89d95040a0dd29f2b6975855c18986f

Download Submit
\Users\Admin\AppData\Local\Temp\nso2C32.tmp\nsExec.dll
Filesize
6KB

MD5
acc2b699edfea5bf5aae45aba3a41e96

SHA1
d2accf4d494e43ceb2cff69abe4dd17147d29cc2

SHA256
168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e

SHA512
e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe

Download Submit
\Users\Admin\AppData\Local\Temp\nso2C32.tmp\nsExec.dll
Filesize
6KB

MD5
acc2b699edfea5bf5aae45aba3a41e96

SHA1
d2accf4d494e43ceb2cff69abe4dd17147d29cc2

SHA256
168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e

SHA512
e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe

Download Submit
\Users\Admin\AppData\Local\Temp\nso2C32.tmp\nsExec.dll
Filesize
6KB

MD5
acc2b699edfea5bf5aae45aba3a41e96

SHA1
d2accf4d494e43ceb2cff69abe4dd17147d29cc2

SHA256
168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e

SHA512
e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe

Download Submit
\Users\Admin\AppData\Local\Temp\nso2C32.tmp\nsExec.dll
Filesize
6KB

MD5
acc2b699edfea5bf5aae45aba3a41e96

SHA1
d2accf4d494e43ceb2cff69abe4dd17147d29cc2

SHA256
168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e

SHA512
e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe

Download Submit
\Windows\SysWOW64\hfnapi.dll
Filesize
106KB

MD5
bbb7cfb4e8cb9f6641843ecd73c7e1a6

SHA1
03ee064874f3528540960af178795760fa4dde32

SHA256
c1e939ee4812954af92bf8e82cb518dcd06b46d70959083b1849f171265eee87

SHA512
d5253561af2f66bc4c10944ad5361b28a35d11b721f2f4df0deb719866574ecb2e4de763bf8cba9ea22dda8503ab013534f1352d0ce99e2f1d47c5685079ec1b

Download Submit
\Windows\SysWOW64\hfnapi.dll
Filesize
106KB

MD5
bbb7cfb4e8cb9f6641843ecd73c7e1a6

SHA1
03ee064874f3528540960af178795760fa4dde32

SHA256
c1e939ee4812954af92bf8e82cb518dcd06b46d70959083b1849f171265eee87

SHA512
d5253561af2f66bc4c10944ad5361b28a35d11b721f2f4df0deb719866574ecb2e4de763bf8cba9ea22dda8503ab013534f1352d0ce99e2f1d47c5685079ec1b

Download Submit
\Windows\SysWOW64\hfnapi.dll
Filesize
106KB

MD5
bbb7cfb4e8cb9f6641843ecd73c7e1a6

SHA1
03ee064874f3528540960af178795760fa4dde32

SHA256
c1e939ee4812954af92bf8e82cb518dcd06b46d70959083b1849f171265eee87

SHA512
d5253561af2f66bc4c10944ad5361b28a35d11b721f2f4df0deb719866574ecb2e4de763bf8cba9ea22dda8503ab013534f1352d0ce99e2f1d47c5685079ec1b

Download Submit
\Windows\SysWOW64\hfpapi.dll
Filesize
241KB

MD5
335c780a51781381d7d2b7961d0f1c0d

SHA1
52c0b66f8e1dfb4f62b2025b21a4ab501429ae39

SHA256
f7fe4eb81b192ef2350579d1e5545f3058c48cd7437d4b2fb07910c44e5689e2

SHA512
08d26227a1d8a7c98b6bf3f2560abfe4a886fe6b89221d828109a00312557ce253ebf0143b6796e353aa715f92a1410c8c080088e83ae457231ddccbf2f81738

Download Submit
\Windows\SysWOW64\hfpapi.dll
Filesize
241KB

MD5
335c780a51781381d7d2b7961d0f1c0d

SHA1
52c0b66f8e1dfb4f62b2025b21a4ab501429ae39

SHA256
f7fe4eb81b192ef2350579d1e5545f3058c48cd7437d4b2fb07910c44e5689e2

SHA512
08d26227a1d8a7c98b6bf3f2560abfe4a886fe6b89221d828109a00312557ce253ebf0143b6796e353aa715f92a1410c8c080088e83ae457231ddccbf2f81738

Download Submit
\Windows\SysWOW64\installd.exe
Filesize
108KB

MD5
9a1071a6de5c7d4d0f4633538f9c3a72

SHA1
0ef8fd69ca386243095640ff23a5c43330b61be5

SHA256
64420b5200069d2222a0b1eb9e660b38948e9d3599a8b6b7285111581f8a29f3

SHA512
0797a09afbb670e8ff151f07be66115de425e602e51161b80d4a7e1766fa0d7f0bd4e2c13820494c6d7272adf9d829a92f3210d4e3f64fe5ae2c5db3a3f4d7a4

Download Submit
\Windows\SysWOW64\nethtsrv.exe
Filesize
176KB

MD5
abceedc4ab72878ee222e2209cf63f38

SHA1
87d549085dfd254d22342edafec19f38d39ea703

SHA256
6cc3713e79a8defc44d811a20893fd6913bad57abc9c2e75582ae18a62c3f9ae

SHA512
06b21dd7606e4a6aaa2dd017277da8dbc94a2b21ee715111285017fcbd66c4933aa6a6a737bd24a598a801beae312d000791c5812411ecb63f0d752819031672

Download Submit
\Windows\SysWOW64\netupdsrv.exe
Filesize
159KB

MD5
b3b5c54c114a17fb569080c1d6afd135

SHA1
e338ee6121bdcc813f3c6911eb46dd942884bc6b

SHA256
f30e1609f33b5fd96f86232245c1371730a76760d600b0db4fbfb87de7bac4b6

SHA512
90ee3505d3682d6759e6d6735c2373f46ff27748cb0174920500c057a09c8dda1e0ec3abdbb0a53c8edebce63014e01fff08e3b042e86b5d38a2577b48762536

Download Submit
memory/332-62-0x0000000000000000-mapping.dmp

Download
memory/792-64-0x0000000000000000-mapping.dmp

Download
memory/904-86-0x0000000000000000-mapping.dmp

Download
memory/1096-70-0x0000000000000000-mapping.dmp

Download
memory/1204-90-0x0000000000360000-0x00000000007BE000-memory.dmp

Filesize
4.4MB

Download
memory/1204-54-0x0000000074DE1000-0x0000000074DE3000-memory.dmp

Filesize
8KB

Download
memory/1204-55-0x0000000000360000-0x00000000007BE000-memory.dmp

Filesize
4.4MB

Download
memory/1492-81-0x0000000000000000-mapping.dmp

Download
memory/1528-61-0x0000000000000000-mapping.dmp

Download
memory/1592-76-0x0000000000000000-mapping.dmp

Download
memory/1744-59-0x0000000000000000-mapping.dmp

Download
memory/1788-87-0x0000000000000000-mapping.dmp

Download
memory/2012-80-0x0000000000000000-mapping.dmp

Download
memory/2044-58-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads