9716716a243d8e4c2d95726614e22489cbbbae1d40c78af550ff419a27ff0e36

Analysis

max time kernel
44s
max time network
32s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
23-11-2022 10:18

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

9716716a243d8e4c2d95726614e22489cbbbae1d40c78af550ff419a27ff0e36.exe
Size

602KB
MD5

69ecec0a4ac499b0c33bf8ca046a406d
SHA1

ec0aac4b1df99cc86522d806a846b55d1f33411a
SHA256

9716716a243d8e4c2d95726614e22489cbbbae1d40c78af550ff419a27ff0e36
SHA512

d83b5b463ca7792f9605bf8e3fa85709069860851d842f9842e0cfc1e455c6240956b6cb327b3a6dec18e60ed89a613276dd02bfb896b2e6c75c4ee21ff8da4e
SSDEEP

12288:WIny5DYTuII13VN9KsqrBTLbxHp4oCMbR+l7mESbbm0CQdj:YUTuIK3pKxZbxH/1Lb3

Score

8^/10

discovery

Malware Config

Signatures

Drops file in Drivers directory 1 IoCs

Processes:

9716716a243d8e4c2d95726614e22489cbbbae1d40c78af550ff419a27ff0e36.exe

description ioc process

File created C:\Windows\system32\drivers\nethfdrv.sys 9716716a243d8e4c2d95726614e22489cbbbae1d40c78af550ff419a27ff0e36.exe
Executes dropped EXE 5 IoCs

Processes:

installd.exenethtsrv.exenetupdsrv.exenethtsrv.exenetupdsrv.exe

pid process

1876 installd.exe
1376 nethtsrv.exe
1464 netupdsrv.exe
1636 nethtsrv.exe
908 netupdsrv.exe

description	ioc	process
File created	C:\Windows\system32\drivers\nethfdrv.sys	9716716a243d8e4c2d95726614e22489cbbbae1d40c78af550ff419a27ff0e36.exe

pid	process
1876	installd.exe
1376	nethtsrv.exe
1464	netupdsrv.exe
1636	nethtsrv.exe
908	netupdsrv.exe

Loads dropped DLL 13 IoCs

Processes:

9716716a243d8e4c2d95726614e22489cbbbae1d40c78af550ff419a27ff0e36.exeinstalld.exenethtsrv.exenethtsrv.exe

pid	process
1940	9716716a243d8e4c2d95726614e22489cbbbae1d40c78af550ff419a27ff0e36.exe
1940	9716716a243d8e4c2d95726614e22489cbbbae1d40c78af550ff419a27ff0e36.exe
1940	9716716a243d8e4c2d95726614e22489cbbbae1d40c78af550ff419a27ff0e36.exe
1940	9716716a243d8e4c2d95726614e22489cbbbae1d40c78af550ff419a27ff0e36.exe
1876	installd.exe
1940	9716716a243d8e4c2d95726614e22489cbbbae1d40c78af550ff419a27ff0e36.exe
1376	nethtsrv.exe
1376	nethtsrv.exe
1940	9716716a243d8e4c2d95726614e22489cbbbae1d40c78af550ff419a27ff0e36.exe
1940	9716716a243d8e4c2d95726614e22489cbbbae1d40c78af550ff419a27ff0e36.exe
1636	nethtsrv.exe
1636	nethtsrv.exe
1940	9716716a243d8e4c2d95726614e22489cbbbae1d40c78af550ff419a27ff0e36.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in System32 directory 5 IoCs

Processes:

9716716a243d8e4c2d95726614e22489cbbbae1d40c78af550ff419a27ff0e36.exe

description	ioc	process
File created	C:\Windows\SysWOW64\hfnapi.dll	9716716a243d8e4c2d95726614e22489cbbbae1d40c78af550ff419a27ff0e36.exe
File created	C:\Windows\SysWOW64\hfpapi.dll	9716716a243d8e4c2d95726614e22489cbbbae1d40c78af550ff419a27ff0e36.exe
File created	C:\Windows\SysWOW64\installd.exe	9716716a243d8e4c2d95726614e22489cbbbae1d40c78af550ff419a27ff0e36.exe
File created	C:\Windows\SysWOW64\nethtsrv.exe	9716716a243d8e4c2d95726614e22489cbbbae1d40c78af550ff419a27ff0e36.exe
File created	C:\Windows\SysWOW64\netupdsrv.exe	9716716a243d8e4c2d95726614e22489cbbbae1d40c78af550ff419a27ff0e36.exe

Drops file in Program Files directory 3 IoCs

Processes:

9716716a243d8e4c2d95726614e22489cbbbae1d40c78af550ff419a27ff0e36.exe

description	ioc	process
File created	C:\Program Files (x86)\Common Files\config\uninstinethnfd.exe	9716716a243d8e4c2d95726614e22489cbbbae1d40c78af550ff419a27ff0e36.exe
File created	C:\Program Files (x86)\Common Files\Config\data.xml	9716716a243d8e4c2d95726614e22489cbbbae1d40c78af550ff419a27ff0e36.exe
File created	C:\Program Files (x86)\Common Files\Config\ver.xml	9716716a243d8e4c2d95726614e22489cbbbae1d40c78af550ff419a27ff0e36.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Runs net.exe
Suspicious behavior: LoadsDriver 1 IoCs

Processes:

pid process

460
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

nethtsrv.exe

description pid process

Token: SeDebugPrivilege 1636 nethtsrv.exe

pid	process
460

description	pid	process
Token: SeDebugPrivilege	1636	nethtsrv.exe

Suspicious use of WriteProcessMemory 50 IoCs

Processes:

9716716a243d8e4c2d95726614e22489cbbbae1d40c78af550ff419a27ff0e36.exenet.exenet.exenet.exenet.exe

description	pid	process	target process
PID 1940 wrote to memory of 1068	1940	9716716a243d8e4c2d95726614e22489cbbbae1d40c78af550ff419a27ff0e36.exe	net.exe
PID 1940 wrote to memory of 1068	1940	9716716a243d8e4c2d95726614e22489cbbbae1d40c78af550ff419a27ff0e36.exe	net.exe
PID 1940 wrote to memory of 1068	1940	9716716a243d8e4c2d95726614e22489cbbbae1d40c78af550ff419a27ff0e36.exe	net.exe
PID 1940 wrote to memory of 1068	1940	9716716a243d8e4c2d95726614e22489cbbbae1d40c78af550ff419a27ff0e36.exe	net.exe
PID 1068 wrote to memory of 560	1068	net.exe	net1.exe
PID 1068 wrote to memory of 560	1068	net.exe	net1.exe
PID 1068 wrote to memory of 560	1068	net.exe	net1.exe
PID 1068 wrote to memory of 560	1068	net.exe	net1.exe
PID 1940 wrote to memory of 1880	1940	9716716a243d8e4c2d95726614e22489cbbbae1d40c78af550ff419a27ff0e36.exe	net.exe
PID 1940 wrote to memory of 1880	1940	9716716a243d8e4c2d95726614e22489cbbbae1d40c78af550ff419a27ff0e36.exe	net.exe
PID 1940 wrote to memory of 1880	1940	9716716a243d8e4c2d95726614e22489cbbbae1d40c78af550ff419a27ff0e36.exe	net.exe
PID 1940 wrote to memory of 1880	1940	9716716a243d8e4c2d95726614e22489cbbbae1d40c78af550ff419a27ff0e36.exe	net.exe
PID 1880 wrote to memory of 1508	1880	net.exe	net1.exe
PID 1880 wrote to memory of 1508	1880	net.exe	net1.exe
PID 1880 wrote to memory of 1508	1880	net.exe	net1.exe
PID 1880 wrote to memory of 1508	1880	net.exe	net1.exe
PID 1940 wrote to memory of 1876	1940	9716716a243d8e4c2d95726614e22489cbbbae1d40c78af550ff419a27ff0e36.exe	installd.exe
PID 1940 wrote to memory of 1876	1940	9716716a243d8e4c2d95726614e22489cbbbae1d40c78af550ff419a27ff0e36.exe	installd.exe
PID 1940 wrote to memory of 1876	1940	9716716a243d8e4c2d95726614e22489cbbbae1d40c78af550ff419a27ff0e36.exe	installd.exe
PID 1940 wrote to memory of 1876	1940	9716716a243d8e4c2d95726614e22489cbbbae1d40c78af550ff419a27ff0e36.exe	installd.exe
PID 1940 wrote to memory of 1876	1940	9716716a243d8e4c2d95726614e22489cbbbae1d40c78af550ff419a27ff0e36.exe	installd.exe
PID 1940 wrote to memory of 1876	1940	9716716a243d8e4c2d95726614e22489cbbbae1d40c78af550ff419a27ff0e36.exe	installd.exe
PID 1940 wrote to memory of 1876	1940	9716716a243d8e4c2d95726614e22489cbbbae1d40c78af550ff419a27ff0e36.exe	installd.exe
PID 1940 wrote to memory of 1376	1940	9716716a243d8e4c2d95726614e22489cbbbae1d40c78af550ff419a27ff0e36.exe	nethtsrv.exe
PID 1940 wrote to memory of 1376	1940	9716716a243d8e4c2d95726614e22489cbbbae1d40c78af550ff419a27ff0e36.exe	nethtsrv.exe
PID 1940 wrote to memory of 1376	1940	9716716a243d8e4c2d95726614e22489cbbbae1d40c78af550ff419a27ff0e36.exe	nethtsrv.exe
PID 1940 wrote to memory of 1376	1940	9716716a243d8e4c2d95726614e22489cbbbae1d40c78af550ff419a27ff0e36.exe	nethtsrv.exe
PID 1940 wrote to memory of 1464	1940	9716716a243d8e4c2d95726614e22489cbbbae1d40c78af550ff419a27ff0e36.exe	netupdsrv.exe
PID 1940 wrote to memory of 1464	1940	9716716a243d8e4c2d95726614e22489cbbbae1d40c78af550ff419a27ff0e36.exe	netupdsrv.exe
PID 1940 wrote to memory of 1464	1940	9716716a243d8e4c2d95726614e22489cbbbae1d40c78af550ff419a27ff0e36.exe	netupdsrv.exe
PID 1940 wrote to memory of 1464	1940	9716716a243d8e4c2d95726614e22489cbbbae1d40c78af550ff419a27ff0e36.exe	netupdsrv.exe
PID 1940 wrote to memory of 1464	1940	9716716a243d8e4c2d95726614e22489cbbbae1d40c78af550ff419a27ff0e36.exe	netupdsrv.exe
PID 1940 wrote to memory of 1464	1940	9716716a243d8e4c2d95726614e22489cbbbae1d40c78af550ff419a27ff0e36.exe	netupdsrv.exe
PID 1940 wrote to memory of 1464	1940	9716716a243d8e4c2d95726614e22489cbbbae1d40c78af550ff419a27ff0e36.exe	netupdsrv.exe
PID 1940 wrote to memory of 1948	1940	9716716a243d8e4c2d95726614e22489cbbbae1d40c78af550ff419a27ff0e36.exe	net.exe
PID 1940 wrote to memory of 1948	1940	9716716a243d8e4c2d95726614e22489cbbbae1d40c78af550ff419a27ff0e36.exe	net.exe
PID 1940 wrote to memory of 1948	1940	9716716a243d8e4c2d95726614e22489cbbbae1d40c78af550ff419a27ff0e36.exe	net.exe
PID 1940 wrote to memory of 1948	1940	9716716a243d8e4c2d95726614e22489cbbbae1d40c78af550ff419a27ff0e36.exe	net.exe
PID 1948 wrote to memory of 1116	1948	net.exe	net1.exe
PID 1948 wrote to memory of 1116	1948	net.exe	net1.exe
PID 1948 wrote to memory of 1116	1948	net.exe	net1.exe
PID 1948 wrote to memory of 1116	1948	net.exe	net1.exe
PID 1940 wrote to memory of 1628	1940	9716716a243d8e4c2d95726614e22489cbbbae1d40c78af550ff419a27ff0e36.exe	net.exe
PID 1940 wrote to memory of 1628	1940	9716716a243d8e4c2d95726614e22489cbbbae1d40c78af550ff419a27ff0e36.exe	net.exe
PID 1940 wrote to memory of 1628	1940	9716716a243d8e4c2d95726614e22489cbbbae1d40c78af550ff419a27ff0e36.exe	net.exe
PID 1940 wrote to memory of 1628	1940	9716716a243d8e4c2d95726614e22489cbbbae1d40c78af550ff419a27ff0e36.exe	net.exe
PID 1628 wrote to memory of 552	1628	net.exe	net1.exe
PID 1628 wrote to memory of 552	1628	net.exe	net1.exe
PID 1628 wrote to memory of 552	1628	net.exe	net1.exe
PID 1628 wrote to memory of 552	1628	net.exe	net1.exe

C:\Users\Admin\AppData\Local\Temp\9716716a243d8e4c2d95726614e22489cbbbae1d40c78af550ff419a27ff0e36.exe
"C:\Users\Admin\AppData\Local\Temp\9716716a243d8e4c2d95726614e22489cbbbae1d40c78af550ff419a27ff0e36.exe"
1⤵
- Drops file in Drivers directory
- Loads dropped DLL
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:1940

C:\Windows\SysWOW64\net.exe
net stop nethttpservice
2⤵
- Suspicious use of WriteProcessMemory
PID:1068

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop nethttpservice
3⤵
PID:560

C:\Windows\SysWOW64\net.exe
net stop serviceupdater
2⤵
- Suspicious use of WriteProcessMemory
PID:1880

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop serviceupdater
3⤵
PID:1508

C:\Windows\SysWOW64\installd.exe
"C:\Windows\system32\installd.exe" nethfdrv
2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1876

C:\Windows\SysWOW64\nethtsrv.exe
"C:\Windows\system32\nethtsrv.exe" -nfdi
2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1376

C:\Windows\SysWOW64\netupdsrv.exe
"C:\Windows\system32\netupdsrv.exe" -nfdi
2⤵
- Executes dropped EXE
PID:1464

C:\Windows\SysWOW64\net.exe
net start nethttpservice
2⤵
- Suspicious use of WriteProcessMemory
PID:1948

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 start nethttpservice
3⤵
PID:1116

C:\Windows\SysWOW64\net.exe
net start serviceupdater
2⤵
- Suspicious use of WriteProcessMemory
PID:1628

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 start serviceupdater
3⤵
PID:552

C:\Windows\SysWOW64\nethtsrv.exe
C:\Windows\SysWOW64\nethtsrv.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:1636

C:\Windows\SysWOW64\netupdsrv.exe
C:\Windows\SysWOW64\netupdsrv.exe
1⤵
- Executes dropped EXE
PID:908

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\hfnapi.dll
Filesize
106KB

MD5
621eede44d0c700a6efbbd18836ccc47

SHA1
b2092a1bfd350a914a333e0ff119a486aadfaafb

SHA256
34b0e4e6d27f52bd6917908942944965a8244e22809098fe546ecd3c89617388

SHA512
5f59bbd891e2272715b665883f49d911d331e2ba1e70a77a9c960b68a79c1c551a8c316994303ee98e9829e467a2147faaf36ad72abaec2ed7d9147ba013f0e9

Download Submit
C:\Windows\SysWOW64\hfpapi.dll
Filesize
241KB

MD5
4e03f3ae4fdb6004d8573de533796a54

SHA1
b50da0fdc01643e8862d55cdb48135131f1d7b8e

SHA256
5c5c625f7d7bc3a601bc6a2b99afcff8f5992ef45c90463c888cf4b49f54bc06

SHA512
cbd2f6a7c399233f392789756535292118479be8a8821a59e56a1a2800faa012ac9722995f020c66963a135abf8af33f77ba72cd7d11e553703845642329d80f

Download Submit
C:\Windows\SysWOW64\installd.exe
Filesize
108KB

MD5
23a963c6d805ee6db98ecc31e1b9c53a

SHA1
6b3bac52e1278caea90ea424b072488bb12fd2ea

SHA256
e81cc6087a7495bd234c338f9a2c772eb488d3cae87bebd62c4e309e33bcb885

SHA512
2175c6be7e2571c32bc7d3526c802309d2cdb8e9c14632d386b0353af759cbdbcb16cc5d20eeb9ff79fa2f4f4c7cd82e4946b74a7be4f38f332b21a9c6d6bf82

Download Submit
C:\Windows\SysWOW64\nethtsrv.exe
Filesize
176KB

MD5
560cbe0e52b3340066343b1e4a345a93

SHA1
c3ca7be823174cfb4acd017c3e0284f1f7d24aa7

SHA256
869ed5e0a65583dffcafd1873e2c4f54d9d4f1b6ca3ea66eebc08836e655dde2

SHA512
0707ce95ed2d806096e90b63dbd761f6c9094e7f9c0e492a8e85ec42ca86d44dea45c373518144073623bf1085b9cba35d5474f8df0c092b5f6dc548f10d47b5

Download Submit
C:\Windows\SysWOW64\nethtsrv.exe
Filesize
176KB

MD5
560cbe0e52b3340066343b1e4a345a93

SHA1
c3ca7be823174cfb4acd017c3e0284f1f7d24aa7

SHA256
869ed5e0a65583dffcafd1873e2c4f54d9d4f1b6ca3ea66eebc08836e655dde2

SHA512
0707ce95ed2d806096e90b63dbd761f6c9094e7f9c0e492a8e85ec42ca86d44dea45c373518144073623bf1085b9cba35d5474f8df0c092b5f6dc548f10d47b5

Download Submit
C:\Windows\SysWOW64\netupdsrv.exe
Filesize
158KB

MD5
d01019d8437868598975e8040a96839c

SHA1
b3336fade932f23979f43932d6b5ea0d2ad68691

SHA256
c59a46f6961671b8aa72f225d96ce7dc548d6cf8aa4a11ab60d2ab0b70974156

SHA512
452a179ff6f1de4bc37f347d8232a7fe4a7a85d238178df19dcd2179d79e4ac752cbcfa7598d555cc25d4dc7be4a89516d6d24d81e466dac676b2af3fe6ff894

Download Submit
C:\Windows\SysWOW64\netupdsrv.exe
Filesize
158KB

MD5
d01019d8437868598975e8040a96839c

SHA1
b3336fade932f23979f43932d6b5ea0d2ad68691

SHA256
c59a46f6961671b8aa72f225d96ce7dc548d6cf8aa4a11ab60d2ab0b70974156

SHA512
452a179ff6f1de4bc37f347d8232a7fe4a7a85d238178df19dcd2179d79e4ac752cbcfa7598d555cc25d4dc7be4a89516d6d24d81e466dac676b2af3fe6ff894

Download Submit
\Users\Admin\AppData\Local\Temp\nst31BD.tmp\System.dll
Filesize
11KB

MD5
c17103ae9072a06da581dec998343fc1

SHA1
b72148c6bdfaada8b8c3f950e610ee7cf1da1f8d

SHA256
dc58d8ad81cacb0c1ed72e33bff8f23ea40b5252b5bb55d393a0903e6819ae2f

SHA512
d32a71aaef18e993f28096d536e41c4d016850721b31171513ce28bbd805a54fd290b7c3e9d935f72e676a1acfb4f0dcc89d95040a0dd29f2b6975855c18986f

Download Submit
\Users\Admin\AppData\Local\Temp\nst31BD.tmp\nsExec.dll
Filesize
6KB

MD5
acc2b699edfea5bf5aae45aba3a41e96

SHA1
d2accf4d494e43ceb2cff69abe4dd17147d29cc2

SHA256
168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e

SHA512
e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe

Download Submit
\Users\Admin\AppData\Local\Temp\nst31BD.tmp\nsExec.dll
Filesize
6KB

MD5
acc2b699edfea5bf5aae45aba3a41e96

SHA1
d2accf4d494e43ceb2cff69abe4dd17147d29cc2

SHA256
168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e

SHA512
e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe

Download Submit
\Users\Admin\AppData\Local\Temp\nst31BD.tmp\nsExec.dll
Filesize
6KB

MD5
acc2b699edfea5bf5aae45aba3a41e96

SHA1
d2accf4d494e43ceb2cff69abe4dd17147d29cc2

SHA256
168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e

SHA512
e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe

Download Submit
\Users\Admin\AppData\Local\Temp\nst31BD.tmp\nsExec.dll
Filesize
6KB

MD5
acc2b699edfea5bf5aae45aba3a41e96

SHA1
d2accf4d494e43ceb2cff69abe4dd17147d29cc2

SHA256
168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e

SHA512
e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe

Download Submit
\Windows\SysWOW64\hfnapi.dll
Filesize
106KB

MD5
621eede44d0c700a6efbbd18836ccc47

SHA1
b2092a1bfd350a914a333e0ff119a486aadfaafb

SHA256
34b0e4e6d27f52bd6917908942944965a8244e22809098fe546ecd3c89617388

SHA512
5f59bbd891e2272715b665883f49d911d331e2ba1e70a77a9c960b68a79c1c551a8c316994303ee98e9829e467a2147faaf36ad72abaec2ed7d9147ba013f0e9

Download Submit
\Windows\SysWOW64\hfnapi.dll
Filesize
106KB

MD5
621eede44d0c700a6efbbd18836ccc47

SHA1
b2092a1bfd350a914a333e0ff119a486aadfaafb

SHA256
34b0e4e6d27f52bd6917908942944965a8244e22809098fe546ecd3c89617388

SHA512
5f59bbd891e2272715b665883f49d911d331e2ba1e70a77a9c960b68a79c1c551a8c316994303ee98e9829e467a2147faaf36ad72abaec2ed7d9147ba013f0e9

Download Submit
\Windows\SysWOW64\hfnapi.dll
Filesize
106KB

MD5
621eede44d0c700a6efbbd18836ccc47

SHA1
b2092a1bfd350a914a333e0ff119a486aadfaafb

SHA256
34b0e4e6d27f52bd6917908942944965a8244e22809098fe546ecd3c89617388

SHA512
5f59bbd891e2272715b665883f49d911d331e2ba1e70a77a9c960b68a79c1c551a8c316994303ee98e9829e467a2147faaf36ad72abaec2ed7d9147ba013f0e9

Download Submit
\Windows\SysWOW64\hfpapi.dll
Filesize
241KB

MD5
4e03f3ae4fdb6004d8573de533796a54

SHA1
b50da0fdc01643e8862d55cdb48135131f1d7b8e

SHA256
5c5c625f7d7bc3a601bc6a2b99afcff8f5992ef45c90463c888cf4b49f54bc06

SHA512
cbd2f6a7c399233f392789756535292118479be8a8821a59e56a1a2800faa012ac9722995f020c66963a135abf8af33f77ba72cd7d11e553703845642329d80f

Download Submit
\Windows\SysWOW64\hfpapi.dll
Filesize
241KB

MD5
4e03f3ae4fdb6004d8573de533796a54

SHA1
b50da0fdc01643e8862d55cdb48135131f1d7b8e

SHA256
5c5c625f7d7bc3a601bc6a2b99afcff8f5992ef45c90463c888cf4b49f54bc06

SHA512
cbd2f6a7c399233f392789756535292118479be8a8821a59e56a1a2800faa012ac9722995f020c66963a135abf8af33f77ba72cd7d11e553703845642329d80f

Download Submit
\Windows\SysWOW64\installd.exe
Filesize
108KB

MD5
23a963c6d805ee6db98ecc31e1b9c53a

SHA1
6b3bac52e1278caea90ea424b072488bb12fd2ea

SHA256
e81cc6087a7495bd234c338f9a2c772eb488d3cae87bebd62c4e309e33bcb885

SHA512
2175c6be7e2571c32bc7d3526c802309d2cdb8e9c14632d386b0353af759cbdbcb16cc5d20eeb9ff79fa2f4f4c7cd82e4946b74a7be4f38f332b21a9c6d6bf82

Download Submit
\Windows\SysWOW64\nethtsrv.exe
Filesize
176KB

MD5
560cbe0e52b3340066343b1e4a345a93

SHA1
c3ca7be823174cfb4acd017c3e0284f1f7d24aa7

SHA256
869ed5e0a65583dffcafd1873e2c4f54d9d4f1b6ca3ea66eebc08836e655dde2

SHA512
0707ce95ed2d806096e90b63dbd761f6c9094e7f9c0e492a8e85ec42ca86d44dea45c373518144073623bf1085b9cba35d5474f8df0c092b5f6dc548f10d47b5

Download Submit
\Windows\SysWOW64\netupdsrv.exe
Filesize
158KB

MD5
d01019d8437868598975e8040a96839c

SHA1
b3336fade932f23979f43932d6b5ea0d2ad68691

SHA256
c59a46f6961671b8aa72f225d96ce7dc548d6cf8aa4a11ab60d2ab0b70974156

SHA512
452a179ff6f1de4bc37f347d8232a7fe4a7a85d238178df19dcd2179d79e4ac752cbcfa7598d555cc25d4dc7be4a89516d6d24d81e466dac676b2af3fe6ff894

Download Submit
memory/552-88-0x0000000000000000-mapping.dmp

Download
memory/560-59-0x0000000000000000-mapping.dmp

Download
memory/1068-58-0x0000000000000000-mapping.dmp

Download
memory/1116-82-0x0000000000000000-mapping.dmp

Download
memory/1376-70-0x0000000000000000-mapping.dmp

Download
memory/1464-77-0x0000000000000000-mapping.dmp

Download
memory/1508-62-0x0000000000000000-mapping.dmp

Download
memory/1628-87-0x0000000000000000-mapping.dmp

Download
memory/1876-64-0x0000000000000000-mapping.dmp

Download
memory/1880-61-0x0000000000000000-mapping.dmp

Download
memory/1940-54-0x0000000075761000-0x0000000075763000-memory.dmp

Filesize
8KB

Download
memory/1940-75-0x0000000000360000-0x00000000007BE000-memory.dmp

Filesize
4.4MB

Download
memory/1940-55-0x0000000000360000-0x00000000007BE000-memory.dmp

Filesize
4.4MB

Download
memory/1940-91-0x0000000000360000-0x00000000007BE000-memory.dmp

Filesize
4.4MB

Download
memory/1948-81-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads