97625a28e045cbf4e79283d1959e1cad02690de95c4ccc351a86a532d22a9323

Analysis

max time kernel
45s
max time network
34s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
23-11-2022 10:18

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

97625a28e045cbf4e79283d1959e1cad02690de95c4ccc351a86a532d22a9323.exe
Size

602KB
MD5

6ab51a6024f1130db647d3552ebc4d8a
SHA1

30d72c0629f29b968f86b04e6b7d31ab20ad493a
SHA256

97625a28e045cbf4e79283d1959e1cad02690de95c4ccc351a86a532d22a9323
SHA512

280ec5aabb10c3c5d6a1e3f636f0f846305fab926dd3774778ca0822516791ba0a392e9f8bc325bdb31db4b43b4f09f44bf35262195ff77d818f05ea39568176
SSDEEP

12288:sIny5DYTZInfZPjfyMr6RpDjrjqatggPOLpg3CTsSPuSz0aT:qUTZMfZr3rartXPkpgWsVSYa

Score

8^/10

discovery

Malware Config

Signatures

Drops file in Drivers directory 1 IoCs

Processes:

97625a28e045cbf4e79283d1959e1cad02690de95c4ccc351a86a532d22a9323.exe

description ioc process

File created C:\Windows\system32\drivers\nethfdrv.sys 97625a28e045cbf4e79283d1959e1cad02690de95c4ccc351a86a532d22a9323.exe
Executes dropped EXE 5 IoCs

Processes:

installd.exenethtsrv.exenetupdsrv.exenethtsrv.exenetupdsrv.exe

pid process

760 installd.exe
1048 nethtsrv.exe
1984 netupdsrv.exe
1220 nethtsrv.exe
1304 netupdsrv.exe

description	ioc	process
File created	C:\Windows\system32\drivers\nethfdrv.sys	97625a28e045cbf4e79283d1959e1cad02690de95c4ccc351a86a532d22a9323.exe

pid	process
760	installd.exe
1048	nethtsrv.exe
1984	netupdsrv.exe
1220	nethtsrv.exe
1304	netupdsrv.exe

Loads dropped DLL 13 IoCs

Processes:

97625a28e045cbf4e79283d1959e1cad02690de95c4ccc351a86a532d22a9323.exeinstalld.exenethtsrv.exenethtsrv.exe

pid	process
2024	97625a28e045cbf4e79283d1959e1cad02690de95c4ccc351a86a532d22a9323.exe
2024	97625a28e045cbf4e79283d1959e1cad02690de95c4ccc351a86a532d22a9323.exe
2024	97625a28e045cbf4e79283d1959e1cad02690de95c4ccc351a86a532d22a9323.exe
2024	97625a28e045cbf4e79283d1959e1cad02690de95c4ccc351a86a532d22a9323.exe
760	installd.exe
2024	97625a28e045cbf4e79283d1959e1cad02690de95c4ccc351a86a532d22a9323.exe
1048	nethtsrv.exe
1048	nethtsrv.exe
2024	97625a28e045cbf4e79283d1959e1cad02690de95c4ccc351a86a532d22a9323.exe
2024	97625a28e045cbf4e79283d1959e1cad02690de95c4ccc351a86a532d22a9323.exe
1220	nethtsrv.exe
1220	nethtsrv.exe
2024	97625a28e045cbf4e79283d1959e1cad02690de95c4ccc351a86a532d22a9323.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in System32 directory 5 IoCs

Processes:

97625a28e045cbf4e79283d1959e1cad02690de95c4ccc351a86a532d22a9323.exe

description	ioc	process
File created	C:\Windows\SysWOW64\hfnapi.dll	97625a28e045cbf4e79283d1959e1cad02690de95c4ccc351a86a532d22a9323.exe
File created	C:\Windows\SysWOW64\hfpapi.dll	97625a28e045cbf4e79283d1959e1cad02690de95c4ccc351a86a532d22a9323.exe
File created	C:\Windows\SysWOW64\installd.exe	97625a28e045cbf4e79283d1959e1cad02690de95c4ccc351a86a532d22a9323.exe
File created	C:\Windows\SysWOW64\nethtsrv.exe	97625a28e045cbf4e79283d1959e1cad02690de95c4ccc351a86a532d22a9323.exe
File created	C:\Windows\SysWOW64\netupdsrv.exe	97625a28e045cbf4e79283d1959e1cad02690de95c4ccc351a86a532d22a9323.exe

Drops file in Program Files directory 3 IoCs

Processes:

97625a28e045cbf4e79283d1959e1cad02690de95c4ccc351a86a532d22a9323.exe

description	ioc	process
File created	C:\Program Files (x86)\Common Files\Config\data.xml	97625a28e045cbf4e79283d1959e1cad02690de95c4ccc351a86a532d22a9323.exe
File created	C:\Program Files (x86)\Common Files\Config\ver.xml	97625a28e045cbf4e79283d1959e1cad02690de95c4ccc351a86a532d22a9323.exe
File created	C:\Program Files (x86)\Common Files\config\uninstinethnfd.exe	97625a28e045cbf4e79283d1959e1cad02690de95c4ccc351a86a532d22a9323.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Runs net.exe
Suspicious behavior: LoadsDriver 1 IoCs

Processes:

pid process

464
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

nethtsrv.exe

description pid process

Token: SeDebugPrivilege 1220 nethtsrv.exe

pid	process
464

description	pid	process
Token: SeDebugPrivilege	1220	nethtsrv.exe

Suspicious use of WriteProcessMemory 50 IoCs

Processes:

97625a28e045cbf4e79283d1959e1cad02690de95c4ccc351a86a532d22a9323.exenet.exenet.exenet.exenet.exe

description	pid	process	target process
PID 2024 wrote to memory of 1032	2024	97625a28e045cbf4e79283d1959e1cad02690de95c4ccc351a86a532d22a9323.exe	net.exe
PID 2024 wrote to memory of 1032	2024	97625a28e045cbf4e79283d1959e1cad02690de95c4ccc351a86a532d22a9323.exe	net.exe
PID 2024 wrote to memory of 1032	2024	97625a28e045cbf4e79283d1959e1cad02690de95c4ccc351a86a532d22a9323.exe	net.exe
PID 2024 wrote to memory of 1032	2024	97625a28e045cbf4e79283d1959e1cad02690de95c4ccc351a86a532d22a9323.exe	net.exe
PID 1032 wrote to memory of 544	1032	net.exe	net1.exe
PID 1032 wrote to memory of 544	1032	net.exe	net1.exe
PID 1032 wrote to memory of 544	1032	net.exe	net1.exe
PID 1032 wrote to memory of 544	1032	net.exe	net1.exe
PID 2024 wrote to memory of 964	2024	97625a28e045cbf4e79283d1959e1cad02690de95c4ccc351a86a532d22a9323.exe	net.exe
PID 2024 wrote to memory of 964	2024	97625a28e045cbf4e79283d1959e1cad02690de95c4ccc351a86a532d22a9323.exe	net.exe
PID 2024 wrote to memory of 964	2024	97625a28e045cbf4e79283d1959e1cad02690de95c4ccc351a86a532d22a9323.exe	net.exe
PID 2024 wrote to memory of 964	2024	97625a28e045cbf4e79283d1959e1cad02690de95c4ccc351a86a532d22a9323.exe	net.exe
PID 964 wrote to memory of 1944	964	net.exe	net1.exe
PID 964 wrote to memory of 1944	964	net.exe	net1.exe
PID 964 wrote to memory of 1944	964	net.exe	net1.exe
PID 964 wrote to memory of 1944	964	net.exe	net1.exe
PID 2024 wrote to memory of 760	2024	97625a28e045cbf4e79283d1959e1cad02690de95c4ccc351a86a532d22a9323.exe	installd.exe
PID 2024 wrote to memory of 760	2024	97625a28e045cbf4e79283d1959e1cad02690de95c4ccc351a86a532d22a9323.exe	installd.exe
PID 2024 wrote to memory of 760	2024	97625a28e045cbf4e79283d1959e1cad02690de95c4ccc351a86a532d22a9323.exe	installd.exe
PID 2024 wrote to memory of 760	2024	97625a28e045cbf4e79283d1959e1cad02690de95c4ccc351a86a532d22a9323.exe	installd.exe
PID 2024 wrote to memory of 760	2024	97625a28e045cbf4e79283d1959e1cad02690de95c4ccc351a86a532d22a9323.exe	installd.exe
PID 2024 wrote to memory of 760	2024	97625a28e045cbf4e79283d1959e1cad02690de95c4ccc351a86a532d22a9323.exe	installd.exe
PID 2024 wrote to memory of 760	2024	97625a28e045cbf4e79283d1959e1cad02690de95c4ccc351a86a532d22a9323.exe	installd.exe
PID 2024 wrote to memory of 1048	2024	97625a28e045cbf4e79283d1959e1cad02690de95c4ccc351a86a532d22a9323.exe	nethtsrv.exe
PID 2024 wrote to memory of 1048	2024	97625a28e045cbf4e79283d1959e1cad02690de95c4ccc351a86a532d22a9323.exe	nethtsrv.exe
PID 2024 wrote to memory of 1048	2024	97625a28e045cbf4e79283d1959e1cad02690de95c4ccc351a86a532d22a9323.exe	nethtsrv.exe
PID 2024 wrote to memory of 1048	2024	97625a28e045cbf4e79283d1959e1cad02690de95c4ccc351a86a532d22a9323.exe	nethtsrv.exe
PID 2024 wrote to memory of 1984	2024	97625a28e045cbf4e79283d1959e1cad02690de95c4ccc351a86a532d22a9323.exe	netupdsrv.exe
PID 2024 wrote to memory of 1984	2024	97625a28e045cbf4e79283d1959e1cad02690de95c4ccc351a86a532d22a9323.exe	netupdsrv.exe
PID 2024 wrote to memory of 1984	2024	97625a28e045cbf4e79283d1959e1cad02690de95c4ccc351a86a532d22a9323.exe	netupdsrv.exe
PID 2024 wrote to memory of 1984	2024	97625a28e045cbf4e79283d1959e1cad02690de95c4ccc351a86a532d22a9323.exe	netupdsrv.exe
PID 2024 wrote to memory of 1984	2024	97625a28e045cbf4e79283d1959e1cad02690de95c4ccc351a86a532d22a9323.exe	netupdsrv.exe
PID 2024 wrote to memory of 1984	2024	97625a28e045cbf4e79283d1959e1cad02690de95c4ccc351a86a532d22a9323.exe	netupdsrv.exe
PID 2024 wrote to memory of 1984	2024	97625a28e045cbf4e79283d1959e1cad02690de95c4ccc351a86a532d22a9323.exe	netupdsrv.exe
PID 2024 wrote to memory of 996	2024	97625a28e045cbf4e79283d1959e1cad02690de95c4ccc351a86a532d22a9323.exe	net.exe
PID 2024 wrote to memory of 996	2024	97625a28e045cbf4e79283d1959e1cad02690de95c4ccc351a86a532d22a9323.exe	net.exe
PID 2024 wrote to memory of 996	2024	97625a28e045cbf4e79283d1959e1cad02690de95c4ccc351a86a532d22a9323.exe	net.exe
PID 2024 wrote to memory of 996	2024	97625a28e045cbf4e79283d1959e1cad02690de95c4ccc351a86a532d22a9323.exe	net.exe
PID 996 wrote to memory of 1556	996	net.exe	net1.exe
PID 996 wrote to memory of 1556	996	net.exe	net1.exe
PID 996 wrote to memory of 1556	996	net.exe	net1.exe
PID 996 wrote to memory of 1556	996	net.exe	net1.exe
PID 2024 wrote to memory of 1840	2024	97625a28e045cbf4e79283d1959e1cad02690de95c4ccc351a86a532d22a9323.exe	net.exe
PID 2024 wrote to memory of 1840	2024	97625a28e045cbf4e79283d1959e1cad02690de95c4ccc351a86a532d22a9323.exe	net.exe
PID 2024 wrote to memory of 1840	2024	97625a28e045cbf4e79283d1959e1cad02690de95c4ccc351a86a532d22a9323.exe	net.exe
PID 2024 wrote to memory of 1840	2024	97625a28e045cbf4e79283d1959e1cad02690de95c4ccc351a86a532d22a9323.exe	net.exe
PID 1840 wrote to memory of 896	1840	net.exe	net1.exe
PID 1840 wrote to memory of 896	1840	net.exe	net1.exe
PID 1840 wrote to memory of 896	1840	net.exe	net1.exe
PID 1840 wrote to memory of 896	1840	net.exe	net1.exe

C:\Users\Admin\AppData\Local\Temp\97625a28e045cbf4e79283d1959e1cad02690de95c4ccc351a86a532d22a9323.exe
"C:\Users\Admin\AppData\Local\Temp\97625a28e045cbf4e79283d1959e1cad02690de95c4ccc351a86a532d22a9323.exe"
1⤵
- Drops file in Drivers directory
- Loads dropped DLL
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:2024

C:\Windows\SysWOW64\net.exe
net stop nethttpservice
2⤵
- Suspicious use of WriteProcessMemory
PID:1032

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop nethttpservice
3⤵
PID:544

C:\Windows\SysWOW64\net.exe
net stop serviceupdater
2⤵
- Suspicious use of WriteProcessMemory
PID:964

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop serviceupdater
3⤵
PID:1944

C:\Windows\SysWOW64\installd.exe
"C:\Windows\system32\installd.exe" nethfdrv
2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:760

C:\Windows\SysWOW64\nethtsrv.exe
"C:\Windows\system32\nethtsrv.exe" -nfdi
2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1048

C:\Windows\SysWOW64\netupdsrv.exe
"C:\Windows\system32\netupdsrv.exe" -nfdi
2⤵
- Executes dropped EXE
PID:1984

C:\Windows\SysWOW64\net.exe
net start nethttpservice
2⤵
- Suspicious use of WriteProcessMemory
PID:996

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 start nethttpservice
3⤵
PID:1556

C:\Windows\SysWOW64\net.exe
net start serviceupdater
2⤵
- Suspicious use of WriteProcessMemory
PID:1840

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 start serviceupdater
3⤵
PID:896

C:\Windows\SysWOW64\nethtsrv.exe
C:\Windows\SysWOW64\nethtsrv.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:1220

C:\Windows\SysWOW64\netupdsrv.exe
C:\Windows\SysWOW64\netupdsrv.exe
1⤵
- Executes dropped EXE
PID:1304

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\hfnapi.dll
Filesize
106KB

MD5
4efc629b4bb0a42d6efa512d2b44b262

SHA1
3d318dc3f41a00309be77bddbb54745c19001ed8

SHA256
745ebd045b59f0e001fb96867594be9572d33e7b80bd77d371ff7c207e366fd9

SHA512
10bfd4f97a485aff93643bb0a42a942245a886645008bc34151de8cae4d7ac938f144d301a906bfeeab6d68cd4788d7b28eb3f6253324d30991968b0dcac531d

Download Submit
C:\Windows\SysWOW64\hfpapi.dll
Filesize
241KB

MD5
294ac4958060c8057890587995b5f383

SHA1
2c67515013ed195de89f7a8ac027fd257f943e9c

SHA256
b6ff0bbfe2962ea07bf16861284f05e8c36a8521cd973f0374dfca4e4ca87dad

SHA512
1df4192149f336abf8c72661a9230b4d734bc1b640231d69af94c36e03ba107ab07a5a02cb27ab86590093bd5b132b8f799fcaa46ab25f95571efad48da3f7fc

Download Submit
C:\Windows\SysWOW64\installd.exe
Filesize
108KB

MD5
a9e42ae8a9704c2e651de7eaddd1bab7

SHA1
e1183aecdd8f749bf45f83be0c3c0f1507368edf

SHA256
92b8a3f7b0e8701d3a868e7a193545881889c7fd2730e129390c71a548c62f71

SHA512
cba268fad7eb198cb38b4b26b5b749eae246d7b5e8eae5dd03748f121fbfa974cf002d10d8962e50d72bc8da3e75f3630520a399661181a53638517c7d8934df

Download Submit
C:\Windows\SysWOW64\nethtsrv.exe
Filesize
176KB

MD5
97b0b134324943ee9661316f64b34698

SHA1
be1ba11b7a8d9435d419ff6a1fc91617e333d560

SHA256
0ccb6095f436c2e07300c22d926844a0123cb10c6ba145992011f42392001dc1

SHA512
50bd0f4ae2d1b08bbc1e4ad771f70f82db98a114cf0fd4779bc81b08243851898cb75a42961be6212dac61606659b6578594ae0ca1dc2804907f9281d4fdd4dc

Download Submit
C:\Windows\SysWOW64\nethtsrv.exe
Filesize
176KB

MD5
97b0b134324943ee9661316f64b34698

SHA1
be1ba11b7a8d9435d419ff6a1fc91617e333d560

SHA256
0ccb6095f436c2e07300c22d926844a0123cb10c6ba145992011f42392001dc1

SHA512
50bd0f4ae2d1b08bbc1e4ad771f70f82db98a114cf0fd4779bc81b08243851898cb75a42961be6212dac61606659b6578594ae0ca1dc2804907f9281d4fdd4dc

Download Submit
C:\Windows\SysWOW64\netupdsrv.exe
Filesize
159KB

MD5
2c028144a6d1513d04243fb71fca1524

SHA1
ec7c054a6a2221cfa9077573783cbaba7f3e4d09

SHA256
c5d0e3568234f372827cd67111edd4881422e2c7a49171ea6c513fc98452898c

SHA512
6bd5e0f71cca1de252317399e80ef68f73880c021a3f37c62d8a8d1ae289fb2a616109bf7494e106181868bc1dbeb8a9372a7545ce8c6f9fae68be3b11402abd

Download Submit
C:\Windows\SysWOW64\netupdsrv.exe
Filesize
159KB

MD5
2c028144a6d1513d04243fb71fca1524

SHA1
ec7c054a6a2221cfa9077573783cbaba7f3e4d09

SHA256
c5d0e3568234f372827cd67111edd4881422e2c7a49171ea6c513fc98452898c

SHA512
6bd5e0f71cca1de252317399e80ef68f73880c021a3f37c62d8a8d1ae289fb2a616109bf7494e106181868bc1dbeb8a9372a7545ce8c6f9fae68be3b11402abd

Download Submit
\Users\Admin\AppData\Local\Temp\nsjC46B.tmp\System.dll
Filesize
11KB

MD5
c17103ae9072a06da581dec998343fc1

SHA1
b72148c6bdfaada8b8c3f950e610ee7cf1da1f8d

SHA256
dc58d8ad81cacb0c1ed72e33bff8f23ea40b5252b5bb55d393a0903e6819ae2f

SHA512
d32a71aaef18e993f28096d536e41c4d016850721b31171513ce28bbd805a54fd290b7c3e9d935f72e676a1acfb4f0dcc89d95040a0dd29f2b6975855c18986f

Download Submit
\Users\Admin\AppData\Local\Temp\nsjC46B.tmp\nsExec.dll
Filesize
6KB

MD5
acc2b699edfea5bf5aae45aba3a41e96

SHA1
d2accf4d494e43ceb2cff69abe4dd17147d29cc2

SHA256
168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e

SHA512
e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe

Download Submit
\Users\Admin\AppData\Local\Temp\nsjC46B.tmp\nsExec.dll
Filesize
6KB

MD5
acc2b699edfea5bf5aae45aba3a41e96

SHA1
d2accf4d494e43ceb2cff69abe4dd17147d29cc2

SHA256
168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e

SHA512
e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe

Download Submit
\Users\Admin\AppData\Local\Temp\nsjC46B.tmp\nsExec.dll
Filesize
6KB

MD5
acc2b699edfea5bf5aae45aba3a41e96

SHA1
d2accf4d494e43ceb2cff69abe4dd17147d29cc2

SHA256
168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e

SHA512
e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe

Download Submit
\Users\Admin\AppData\Local\Temp\nsjC46B.tmp\nsExec.dll
Filesize
6KB

MD5
acc2b699edfea5bf5aae45aba3a41e96

SHA1
d2accf4d494e43ceb2cff69abe4dd17147d29cc2

SHA256
168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e

SHA512
e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe

Download Submit
\Windows\SysWOW64\hfnapi.dll
Filesize
106KB

MD5
4efc629b4bb0a42d6efa512d2b44b262

SHA1
3d318dc3f41a00309be77bddbb54745c19001ed8

SHA256
745ebd045b59f0e001fb96867594be9572d33e7b80bd77d371ff7c207e366fd9

SHA512
10bfd4f97a485aff93643bb0a42a942245a886645008bc34151de8cae4d7ac938f144d301a906bfeeab6d68cd4788d7b28eb3f6253324d30991968b0dcac531d

Download Submit
\Windows\SysWOW64\hfnapi.dll
Filesize
106KB

MD5
4efc629b4bb0a42d6efa512d2b44b262

SHA1
3d318dc3f41a00309be77bddbb54745c19001ed8

SHA256
745ebd045b59f0e001fb96867594be9572d33e7b80bd77d371ff7c207e366fd9

SHA512
10bfd4f97a485aff93643bb0a42a942245a886645008bc34151de8cae4d7ac938f144d301a906bfeeab6d68cd4788d7b28eb3f6253324d30991968b0dcac531d

Download Submit
\Windows\SysWOW64\hfnapi.dll
Filesize
106KB

MD5
4efc629b4bb0a42d6efa512d2b44b262

SHA1
3d318dc3f41a00309be77bddbb54745c19001ed8

SHA256
745ebd045b59f0e001fb96867594be9572d33e7b80bd77d371ff7c207e366fd9

SHA512
10bfd4f97a485aff93643bb0a42a942245a886645008bc34151de8cae4d7ac938f144d301a906bfeeab6d68cd4788d7b28eb3f6253324d30991968b0dcac531d

Download Submit
\Windows\SysWOW64\hfpapi.dll
Filesize
241KB

MD5
294ac4958060c8057890587995b5f383

SHA1
2c67515013ed195de89f7a8ac027fd257f943e9c

SHA256
b6ff0bbfe2962ea07bf16861284f05e8c36a8521cd973f0374dfca4e4ca87dad

SHA512
1df4192149f336abf8c72661a9230b4d734bc1b640231d69af94c36e03ba107ab07a5a02cb27ab86590093bd5b132b8f799fcaa46ab25f95571efad48da3f7fc

Download Submit
\Windows\SysWOW64\hfpapi.dll
Filesize
241KB

MD5
294ac4958060c8057890587995b5f383

SHA1
2c67515013ed195de89f7a8ac027fd257f943e9c

SHA256
b6ff0bbfe2962ea07bf16861284f05e8c36a8521cd973f0374dfca4e4ca87dad

SHA512
1df4192149f336abf8c72661a9230b4d734bc1b640231d69af94c36e03ba107ab07a5a02cb27ab86590093bd5b132b8f799fcaa46ab25f95571efad48da3f7fc

Download Submit
\Windows\SysWOW64\installd.exe
Filesize
108KB

MD5
a9e42ae8a9704c2e651de7eaddd1bab7

SHA1
e1183aecdd8f749bf45f83be0c3c0f1507368edf

SHA256
92b8a3f7b0e8701d3a868e7a193545881889c7fd2730e129390c71a548c62f71

SHA512
cba268fad7eb198cb38b4b26b5b749eae246d7b5e8eae5dd03748f121fbfa974cf002d10d8962e50d72bc8da3e75f3630520a399661181a53638517c7d8934df

Download Submit
\Windows\SysWOW64\nethtsrv.exe
Filesize
176KB

MD5
97b0b134324943ee9661316f64b34698

SHA1
be1ba11b7a8d9435d419ff6a1fc91617e333d560

SHA256
0ccb6095f436c2e07300c22d926844a0123cb10c6ba145992011f42392001dc1

SHA512
50bd0f4ae2d1b08bbc1e4ad771f70f82db98a114cf0fd4779bc81b08243851898cb75a42961be6212dac61606659b6578594ae0ca1dc2804907f9281d4fdd4dc

Download Submit
\Windows\SysWOW64\netupdsrv.exe
Filesize
159KB

MD5
2c028144a6d1513d04243fb71fca1524

SHA1
ec7c054a6a2221cfa9077573783cbaba7f3e4d09

SHA256
c5d0e3568234f372827cd67111edd4881422e2c7a49171ea6c513fc98452898c

SHA512
6bd5e0f71cca1de252317399e80ef68f73880c021a3f37c62d8a8d1ae289fb2a616109bf7494e106181868bc1dbeb8a9372a7545ce8c6f9fae68be3b11402abd

Download Submit
memory/544-59-0x0000000000000000-mapping.dmp

Download
memory/760-64-0x0000000000000000-mapping.dmp

Download
memory/896-88-0x0000000000000000-mapping.dmp

Download
memory/964-61-0x0000000000000000-mapping.dmp

Download
memory/996-81-0x0000000000000000-mapping.dmp

Download
memory/1032-58-0x0000000000000000-mapping.dmp

Download
memory/1048-70-0x0000000000000000-mapping.dmp

Download
memory/1556-82-0x0000000000000000-mapping.dmp

Download
memory/1840-87-0x0000000000000000-mapping.dmp

Download
memory/1944-62-0x0000000000000000-mapping.dmp

Download
memory/1984-77-0x0000000000000000-mapping.dmp

Download
memory/2024-54-0x00000000754C1000-0x00000000754C3000-memory.dmp

Filesize
8KB

Download
memory/2024-75-0x0000000000360000-0x00000000007BE000-memory.dmp

Filesize
4.4MB

Download
memory/2024-55-0x0000000000360000-0x00000000007BE000-memory.dmp

Filesize
4.4MB

Download
memory/2024-91-0x0000000000360000-0x00000000007BE000-memory.dmp

Filesize
4.4MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads