952608c4594e4023a0152c36a49c3bc282f3e646364f44fca1c908f74f0cfbdb

Analysis

max time kernel
44s
max time network
50s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
23-11-2022 10:19

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

952608c4594e4023a0152c36a49c3bc282f3e646364f44fca1c908f74f0cfbdb.exe
Size

603KB
MD5

c91d01dfdabc1f1f1eb7914846575125
SHA1

cb2c517d57000a4a15c7871967d2e2a39bb648e9
SHA256

952608c4594e4023a0152c36a49c3bc282f3e646364f44fca1c908f74f0cfbdb
SHA512

9846585c0d7a3bf7a8fe6be4c8cc32f9d274a94bbda7fc6e4169575c3d865edbf4a33fe16d8a34e97173656ff1ccf78d71f90474e53967507eb2e53f7067eb73
SSDEEP

12288:yIny5DYTEvvGa3Z3p4vkoXMeiV1cuLSltX8FuToiRG8dkYhvJ:0UTEXGa3ZWz8xV1tOltXNT5yo

Score

8^/10

discovery

Malware Config

Signatures

Drops file in Drivers directory 1 IoCs

Processes:

952608c4594e4023a0152c36a49c3bc282f3e646364f44fca1c908f74f0cfbdb.exe

description ioc process

File created C:\Windows\system32\drivers\nethfdrv.sys 952608c4594e4023a0152c36a49c3bc282f3e646364f44fca1c908f74f0cfbdb.exe
Executes dropped EXE 5 IoCs

Processes:

installd.exenethtsrv.exenetupdsrv.exenethtsrv.exenetupdsrv.exe

pid process

844 installd.exe
1032 nethtsrv.exe
868 netupdsrv.exe
1276 nethtsrv.exe
1148 netupdsrv.exe

description	ioc	process
File created	C:\Windows\system32\drivers\nethfdrv.sys	952608c4594e4023a0152c36a49c3bc282f3e646364f44fca1c908f74f0cfbdb.exe

pid	process
844	installd.exe
1032	nethtsrv.exe
868	netupdsrv.exe
1276	nethtsrv.exe
1148	netupdsrv.exe

Loads dropped DLL 13 IoCs

Processes:

952608c4594e4023a0152c36a49c3bc282f3e646364f44fca1c908f74f0cfbdb.exeinstalld.exenethtsrv.exenethtsrv.exe

pid	process
1464	952608c4594e4023a0152c36a49c3bc282f3e646364f44fca1c908f74f0cfbdb.exe
1464	952608c4594e4023a0152c36a49c3bc282f3e646364f44fca1c908f74f0cfbdb.exe
1464	952608c4594e4023a0152c36a49c3bc282f3e646364f44fca1c908f74f0cfbdb.exe
1464	952608c4594e4023a0152c36a49c3bc282f3e646364f44fca1c908f74f0cfbdb.exe
844	installd.exe
1464	952608c4594e4023a0152c36a49c3bc282f3e646364f44fca1c908f74f0cfbdb.exe
1032	nethtsrv.exe
1032	nethtsrv.exe
1464	952608c4594e4023a0152c36a49c3bc282f3e646364f44fca1c908f74f0cfbdb.exe
1464	952608c4594e4023a0152c36a49c3bc282f3e646364f44fca1c908f74f0cfbdb.exe
1276	nethtsrv.exe
1276	nethtsrv.exe
1464	952608c4594e4023a0152c36a49c3bc282f3e646364f44fca1c908f74f0cfbdb.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in System32 directory 5 IoCs

Processes:

952608c4594e4023a0152c36a49c3bc282f3e646364f44fca1c908f74f0cfbdb.exe

description	ioc	process
File created	C:\Windows\SysWOW64\hfnapi.dll	952608c4594e4023a0152c36a49c3bc282f3e646364f44fca1c908f74f0cfbdb.exe
File created	C:\Windows\SysWOW64\hfpapi.dll	952608c4594e4023a0152c36a49c3bc282f3e646364f44fca1c908f74f0cfbdb.exe
File created	C:\Windows\SysWOW64\installd.exe	952608c4594e4023a0152c36a49c3bc282f3e646364f44fca1c908f74f0cfbdb.exe
File created	C:\Windows\SysWOW64\nethtsrv.exe	952608c4594e4023a0152c36a49c3bc282f3e646364f44fca1c908f74f0cfbdb.exe
File created	C:\Windows\SysWOW64\netupdsrv.exe	952608c4594e4023a0152c36a49c3bc282f3e646364f44fca1c908f74f0cfbdb.exe

Drops file in Program Files directory 3 IoCs

Processes:

952608c4594e4023a0152c36a49c3bc282f3e646364f44fca1c908f74f0cfbdb.exe

description	ioc	process
File created	C:\Program Files (x86)\Common Files\Config\ver.xml	952608c4594e4023a0152c36a49c3bc282f3e646364f44fca1c908f74f0cfbdb.exe
File created	C:\Program Files (x86)\Common Files\config\uninstinethnfd.exe	952608c4594e4023a0152c36a49c3bc282f3e646364f44fca1c908f74f0cfbdb.exe
File created	C:\Program Files (x86)\Common Files\Config\data.xml	952608c4594e4023a0152c36a49c3bc282f3e646364f44fca1c908f74f0cfbdb.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Runs net.exe
Suspicious behavior: LoadsDriver 1 IoCs

Processes:

pid process

464
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

nethtsrv.exe

description pid process

Token: SeDebugPrivilege 1276 nethtsrv.exe

pid	process
464

description	pid	process
Token: SeDebugPrivilege	1276	nethtsrv.exe

Suspicious use of WriteProcessMemory 50 IoCs

Processes:

952608c4594e4023a0152c36a49c3bc282f3e646364f44fca1c908f74f0cfbdb.exenet.exenet.exenet.exenet.exe

description	pid	process	target process
PID 1464 wrote to memory of 1324	1464	952608c4594e4023a0152c36a49c3bc282f3e646364f44fca1c908f74f0cfbdb.exe	net.exe
PID 1464 wrote to memory of 1324	1464	952608c4594e4023a0152c36a49c3bc282f3e646364f44fca1c908f74f0cfbdb.exe	net.exe
PID 1464 wrote to memory of 1324	1464	952608c4594e4023a0152c36a49c3bc282f3e646364f44fca1c908f74f0cfbdb.exe	net.exe
PID 1464 wrote to memory of 1324	1464	952608c4594e4023a0152c36a49c3bc282f3e646364f44fca1c908f74f0cfbdb.exe	net.exe
PID 1324 wrote to memory of 1112	1324	net.exe	net1.exe
PID 1324 wrote to memory of 1112	1324	net.exe	net1.exe
PID 1324 wrote to memory of 1112	1324	net.exe	net1.exe
PID 1324 wrote to memory of 1112	1324	net.exe	net1.exe
PID 1464 wrote to memory of 2024	1464	952608c4594e4023a0152c36a49c3bc282f3e646364f44fca1c908f74f0cfbdb.exe	net.exe
PID 1464 wrote to memory of 2024	1464	952608c4594e4023a0152c36a49c3bc282f3e646364f44fca1c908f74f0cfbdb.exe	net.exe
PID 1464 wrote to memory of 2024	1464	952608c4594e4023a0152c36a49c3bc282f3e646364f44fca1c908f74f0cfbdb.exe	net.exe
PID 1464 wrote to memory of 2024	1464	952608c4594e4023a0152c36a49c3bc282f3e646364f44fca1c908f74f0cfbdb.exe	net.exe
PID 2024 wrote to memory of 1376	2024	net.exe	net1.exe
PID 2024 wrote to memory of 1376	2024	net.exe	net1.exe
PID 2024 wrote to memory of 1376	2024	net.exe	net1.exe
PID 2024 wrote to memory of 1376	2024	net.exe	net1.exe
PID 1464 wrote to memory of 844	1464	952608c4594e4023a0152c36a49c3bc282f3e646364f44fca1c908f74f0cfbdb.exe	installd.exe
PID 1464 wrote to memory of 844	1464	952608c4594e4023a0152c36a49c3bc282f3e646364f44fca1c908f74f0cfbdb.exe	installd.exe
PID 1464 wrote to memory of 844	1464	952608c4594e4023a0152c36a49c3bc282f3e646364f44fca1c908f74f0cfbdb.exe	installd.exe
PID 1464 wrote to memory of 844	1464	952608c4594e4023a0152c36a49c3bc282f3e646364f44fca1c908f74f0cfbdb.exe	installd.exe
PID 1464 wrote to memory of 844	1464	952608c4594e4023a0152c36a49c3bc282f3e646364f44fca1c908f74f0cfbdb.exe	installd.exe
PID 1464 wrote to memory of 844	1464	952608c4594e4023a0152c36a49c3bc282f3e646364f44fca1c908f74f0cfbdb.exe	installd.exe
PID 1464 wrote to memory of 844	1464	952608c4594e4023a0152c36a49c3bc282f3e646364f44fca1c908f74f0cfbdb.exe	installd.exe
PID 1464 wrote to memory of 1032	1464	952608c4594e4023a0152c36a49c3bc282f3e646364f44fca1c908f74f0cfbdb.exe	nethtsrv.exe
PID 1464 wrote to memory of 1032	1464	952608c4594e4023a0152c36a49c3bc282f3e646364f44fca1c908f74f0cfbdb.exe	nethtsrv.exe
PID 1464 wrote to memory of 1032	1464	952608c4594e4023a0152c36a49c3bc282f3e646364f44fca1c908f74f0cfbdb.exe	nethtsrv.exe
PID 1464 wrote to memory of 1032	1464	952608c4594e4023a0152c36a49c3bc282f3e646364f44fca1c908f74f0cfbdb.exe	nethtsrv.exe
PID 1464 wrote to memory of 868	1464	952608c4594e4023a0152c36a49c3bc282f3e646364f44fca1c908f74f0cfbdb.exe	netupdsrv.exe
PID 1464 wrote to memory of 868	1464	952608c4594e4023a0152c36a49c3bc282f3e646364f44fca1c908f74f0cfbdb.exe	netupdsrv.exe
PID 1464 wrote to memory of 868	1464	952608c4594e4023a0152c36a49c3bc282f3e646364f44fca1c908f74f0cfbdb.exe	netupdsrv.exe
PID 1464 wrote to memory of 868	1464	952608c4594e4023a0152c36a49c3bc282f3e646364f44fca1c908f74f0cfbdb.exe	netupdsrv.exe
PID 1464 wrote to memory of 868	1464	952608c4594e4023a0152c36a49c3bc282f3e646364f44fca1c908f74f0cfbdb.exe	netupdsrv.exe
PID 1464 wrote to memory of 868	1464	952608c4594e4023a0152c36a49c3bc282f3e646364f44fca1c908f74f0cfbdb.exe	netupdsrv.exe
PID 1464 wrote to memory of 868	1464	952608c4594e4023a0152c36a49c3bc282f3e646364f44fca1c908f74f0cfbdb.exe	netupdsrv.exe
PID 1464 wrote to memory of 1748	1464	952608c4594e4023a0152c36a49c3bc282f3e646364f44fca1c908f74f0cfbdb.exe	net.exe
PID 1464 wrote to memory of 1748	1464	952608c4594e4023a0152c36a49c3bc282f3e646364f44fca1c908f74f0cfbdb.exe	net.exe
PID 1464 wrote to memory of 1748	1464	952608c4594e4023a0152c36a49c3bc282f3e646364f44fca1c908f74f0cfbdb.exe	net.exe
PID 1464 wrote to memory of 1748	1464	952608c4594e4023a0152c36a49c3bc282f3e646364f44fca1c908f74f0cfbdb.exe	net.exe
PID 1748 wrote to memory of 1720	1748	net.exe	net1.exe
PID 1748 wrote to memory of 1720	1748	net.exe	net1.exe
PID 1748 wrote to memory of 1720	1748	net.exe	net1.exe
PID 1748 wrote to memory of 1720	1748	net.exe	net1.exe
PID 1464 wrote to memory of 1252	1464	952608c4594e4023a0152c36a49c3bc282f3e646364f44fca1c908f74f0cfbdb.exe	net.exe
PID 1464 wrote to memory of 1252	1464	952608c4594e4023a0152c36a49c3bc282f3e646364f44fca1c908f74f0cfbdb.exe	net.exe
PID 1464 wrote to memory of 1252	1464	952608c4594e4023a0152c36a49c3bc282f3e646364f44fca1c908f74f0cfbdb.exe	net.exe
PID 1464 wrote to memory of 1252	1464	952608c4594e4023a0152c36a49c3bc282f3e646364f44fca1c908f74f0cfbdb.exe	net.exe
PID 1252 wrote to memory of 1512	1252	net.exe	net1.exe
PID 1252 wrote to memory of 1512	1252	net.exe	net1.exe
PID 1252 wrote to memory of 1512	1252	net.exe	net1.exe
PID 1252 wrote to memory of 1512	1252	net.exe	net1.exe

C:\Users\Admin\AppData\Local\Temp\952608c4594e4023a0152c36a49c3bc282f3e646364f44fca1c908f74f0cfbdb.exe
"C:\Users\Admin\AppData\Local\Temp\952608c4594e4023a0152c36a49c3bc282f3e646364f44fca1c908f74f0cfbdb.exe"
1⤵
- Drops file in Drivers directory
- Loads dropped DLL
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:1464

C:\Windows\SysWOW64\net.exe
net stop nethttpservice
2⤵
- Suspicious use of WriteProcessMemory
PID:1324

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop nethttpservice
3⤵
PID:1112

C:\Windows\SysWOW64\net.exe
net stop serviceupdater
2⤵
- Suspicious use of WriteProcessMemory
PID:2024

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop serviceupdater
3⤵
PID:1376

C:\Windows\SysWOW64\installd.exe
"C:\Windows\system32\installd.exe" nethfdrv
2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:844

C:\Windows\SysWOW64\nethtsrv.exe
"C:\Windows\system32\nethtsrv.exe" -nfdi
2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1032

C:\Windows\SysWOW64\netupdsrv.exe
"C:\Windows\system32\netupdsrv.exe" -nfdi
2⤵
- Executes dropped EXE
PID:868

C:\Windows\SysWOW64\net.exe
net start nethttpservice
2⤵
- Suspicious use of WriteProcessMemory
PID:1748

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 start nethttpservice
3⤵
PID:1720

C:\Windows\SysWOW64\net.exe
net start serviceupdater
2⤵
- Suspicious use of WriteProcessMemory
PID:1252

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 start serviceupdater
3⤵
PID:1512

C:\Windows\SysWOW64\nethtsrv.exe
C:\Windows\SysWOW64\nethtsrv.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:1276

C:\Windows\SysWOW64\netupdsrv.exe
C:\Windows\SysWOW64\netupdsrv.exe
1⤵
- Executes dropped EXE
PID:1148

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\hfnapi.dll
Filesize
106KB

MD5
ba2ca1c09e3d9c7c655a34a505e4d2b5

SHA1
67a948236521cea00b652cdc142ea5be9d6231be

SHA256
9d76926aa0ac6199cc2a9f4d925a984038c7992ea01bef818c0a9ace1c123105

SHA512
ff36d768f049160e3e4d4233dcbad07c2110e6e989925343cfc4583b81874d934b45be6653e385d7c98ac30e8a9ff6fbe4083b98eb4c50c3b16441f6d639d281

Download Submit
C:\Windows\SysWOW64\hfpapi.dll
Filesize
241KB

MD5
98f45c1bd581b55aacd51b27ce42c2ec

SHA1
a6c105fd21c0f577fa3be2a42af99501cd38f323

SHA256
97854dda3dcf7bc917c9f7301471276283ad851716610cf35313d14f2f2f6eed

SHA512
e32d70f5fb7b9af395b88837f051ffff1d121e05d81ea842d6165c57f99f6f3a7194df2476b3e37c6be27958b0f075b888c93dfddfd2e46ca528fdac9637ba31

Download Submit
C:\Windows\SysWOW64\installd.exe
Filesize
108KB

MD5
72908471cd2c4178cb70f037e018538a

SHA1
a1d468697e14b447f6548f56c19a63f5ab03c02e

SHA256
999b56e8846f4f05efb83f82d06754ade19c268fa14a58d3aea48653d3f2d16b

SHA512
cf3a8a185b691a830a77c2805389aeef19e5dc1f920b86d5341f44cc93d0be7487726d8342fc2a8b002d19fc5433f9a7051e50f759ce07f7e21e235778686ecb

Download Submit
C:\Windows\SysWOW64\nethtsrv.exe
Filesize
176KB

MD5
fd3dd332cbda518e3f265a6bd5680781

SHA1
00a10affbf5d60b7336a045410c68f3c10353f51

SHA256
dca933dbc77ab6f01826d52bebc42c30189ad97428ff82c2c87d8993b118eb24

SHA512
223d5f777bf3778bfe3ed6b122c9f2e778a48df1ff945c9453ce55082b1917aec86596cad094a1c4a87ffc0507b79766ddcd7c1f6335e7e7254527c430a07afb

Download Submit
C:\Windows\SysWOW64\nethtsrv.exe
Filesize
176KB

MD5
fd3dd332cbda518e3f265a6bd5680781

SHA1
00a10affbf5d60b7336a045410c68f3c10353f51

SHA256
dca933dbc77ab6f01826d52bebc42c30189ad97428ff82c2c87d8993b118eb24

SHA512
223d5f777bf3778bfe3ed6b122c9f2e778a48df1ff945c9453ce55082b1917aec86596cad094a1c4a87ffc0507b79766ddcd7c1f6335e7e7254527c430a07afb

Download Submit
C:\Windows\SysWOW64\netupdsrv.exe
Filesize
158KB

MD5
5f034137b5a52eb9ac35829a3b4f9572

SHA1
5d4ce7905b8d7271d84d4a52ce362c1bd7afd142

SHA256
587d2ffaee2ada432b42f0a12556637025eff8607d481a0719fa46d3334b618c

SHA512
b82ee47b9d66101da64378cfd1b55d4fc33100492c2b33f066893abcc7ccf2be3bd1067510a0eecd930312e526de06df77222646d8c0dac596edc5036608eed3

Download Submit
C:\Windows\SysWOW64\netupdsrv.exe
Filesize
158KB

MD5
5f034137b5a52eb9ac35829a3b4f9572

SHA1
5d4ce7905b8d7271d84d4a52ce362c1bd7afd142

SHA256
587d2ffaee2ada432b42f0a12556637025eff8607d481a0719fa46d3334b618c

SHA512
b82ee47b9d66101da64378cfd1b55d4fc33100492c2b33f066893abcc7ccf2be3bd1067510a0eecd930312e526de06df77222646d8c0dac596edc5036608eed3

Download Submit
\Users\Admin\AppData\Local\Temp\nsy3B10.tmp\System.dll
Filesize
11KB

MD5
c17103ae9072a06da581dec998343fc1

SHA1
b72148c6bdfaada8b8c3f950e610ee7cf1da1f8d

SHA256
dc58d8ad81cacb0c1ed72e33bff8f23ea40b5252b5bb55d393a0903e6819ae2f

SHA512
d32a71aaef18e993f28096d536e41c4d016850721b31171513ce28bbd805a54fd290b7c3e9d935f72e676a1acfb4f0dcc89d95040a0dd29f2b6975855c18986f

Download Submit
\Users\Admin\AppData\Local\Temp\nsy3B10.tmp\nsExec.dll
Filesize
6KB

MD5
acc2b699edfea5bf5aae45aba3a41e96

SHA1
d2accf4d494e43ceb2cff69abe4dd17147d29cc2

SHA256
168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e

SHA512
e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe

Download Submit
\Users\Admin\AppData\Local\Temp\nsy3B10.tmp\nsExec.dll
Filesize
6KB

MD5
acc2b699edfea5bf5aae45aba3a41e96

SHA1
d2accf4d494e43ceb2cff69abe4dd17147d29cc2

SHA256
168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e

SHA512
e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe

Download Submit
\Users\Admin\AppData\Local\Temp\nsy3B10.tmp\nsExec.dll
Filesize
6KB

MD5
acc2b699edfea5bf5aae45aba3a41e96

SHA1
d2accf4d494e43ceb2cff69abe4dd17147d29cc2

SHA256
168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e

SHA512
e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe

Download Submit
\Users\Admin\AppData\Local\Temp\nsy3B10.tmp\nsExec.dll
Filesize
6KB

MD5
acc2b699edfea5bf5aae45aba3a41e96

SHA1
d2accf4d494e43ceb2cff69abe4dd17147d29cc2

SHA256
168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e

SHA512
e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe

Download Submit
\Windows\SysWOW64\hfnapi.dll
Filesize
106KB

MD5
ba2ca1c09e3d9c7c655a34a505e4d2b5

SHA1
67a948236521cea00b652cdc142ea5be9d6231be

SHA256
9d76926aa0ac6199cc2a9f4d925a984038c7992ea01bef818c0a9ace1c123105

SHA512
ff36d768f049160e3e4d4233dcbad07c2110e6e989925343cfc4583b81874d934b45be6653e385d7c98ac30e8a9ff6fbe4083b98eb4c50c3b16441f6d639d281

Download Submit
\Windows\SysWOW64\hfnapi.dll
Filesize
106KB

MD5
ba2ca1c09e3d9c7c655a34a505e4d2b5

SHA1
67a948236521cea00b652cdc142ea5be9d6231be

SHA256
9d76926aa0ac6199cc2a9f4d925a984038c7992ea01bef818c0a9ace1c123105

SHA512
ff36d768f049160e3e4d4233dcbad07c2110e6e989925343cfc4583b81874d934b45be6653e385d7c98ac30e8a9ff6fbe4083b98eb4c50c3b16441f6d639d281

Download Submit
\Windows\SysWOW64\hfnapi.dll
Filesize
106KB

MD5
ba2ca1c09e3d9c7c655a34a505e4d2b5

SHA1
67a948236521cea00b652cdc142ea5be9d6231be

SHA256
9d76926aa0ac6199cc2a9f4d925a984038c7992ea01bef818c0a9ace1c123105

SHA512
ff36d768f049160e3e4d4233dcbad07c2110e6e989925343cfc4583b81874d934b45be6653e385d7c98ac30e8a9ff6fbe4083b98eb4c50c3b16441f6d639d281

Download Submit
\Windows\SysWOW64\hfpapi.dll
Filesize
241KB

MD5
98f45c1bd581b55aacd51b27ce42c2ec

SHA1
a6c105fd21c0f577fa3be2a42af99501cd38f323

SHA256
97854dda3dcf7bc917c9f7301471276283ad851716610cf35313d14f2f2f6eed

SHA512
e32d70f5fb7b9af395b88837f051ffff1d121e05d81ea842d6165c57f99f6f3a7194df2476b3e37c6be27958b0f075b888c93dfddfd2e46ca528fdac9637ba31

Download Submit
\Windows\SysWOW64\hfpapi.dll
Filesize
241KB

MD5
98f45c1bd581b55aacd51b27ce42c2ec

SHA1
a6c105fd21c0f577fa3be2a42af99501cd38f323

SHA256
97854dda3dcf7bc917c9f7301471276283ad851716610cf35313d14f2f2f6eed

SHA512
e32d70f5fb7b9af395b88837f051ffff1d121e05d81ea842d6165c57f99f6f3a7194df2476b3e37c6be27958b0f075b888c93dfddfd2e46ca528fdac9637ba31

Download Submit
\Windows\SysWOW64\installd.exe
Filesize
108KB

MD5
72908471cd2c4178cb70f037e018538a

SHA1
a1d468697e14b447f6548f56c19a63f5ab03c02e

SHA256
999b56e8846f4f05efb83f82d06754ade19c268fa14a58d3aea48653d3f2d16b

SHA512
cf3a8a185b691a830a77c2805389aeef19e5dc1f920b86d5341f44cc93d0be7487726d8342fc2a8b002d19fc5433f9a7051e50f759ce07f7e21e235778686ecb

Download Submit
\Windows\SysWOW64\nethtsrv.exe
Filesize
176KB

MD5
fd3dd332cbda518e3f265a6bd5680781

SHA1
00a10affbf5d60b7336a045410c68f3c10353f51

SHA256
dca933dbc77ab6f01826d52bebc42c30189ad97428ff82c2c87d8993b118eb24

SHA512
223d5f777bf3778bfe3ed6b122c9f2e778a48df1ff945c9453ce55082b1917aec86596cad094a1c4a87ffc0507b79766ddcd7c1f6335e7e7254527c430a07afb

Download Submit
\Windows\SysWOW64\netupdsrv.exe
Filesize
158KB

MD5
5f034137b5a52eb9ac35829a3b4f9572

SHA1
5d4ce7905b8d7271d84d4a52ce362c1bd7afd142

SHA256
587d2ffaee2ada432b42f0a12556637025eff8607d481a0719fa46d3334b618c

SHA512
b82ee47b9d66101da64378cfd1b55d4fc33100492c2b33f066893abcc7ccf2be3bd1067510a0eecd930312e526de06df77222646d8c0dac596edc5036608eed3

Download Submit
memory/844-64-0x0000000000000000-mapping.dmp

Download
memory/868-76-0x0000000000000000-mapping.dmp

Download
memory/1032-70-0x0000000000000000-mapping.dmp

Download
memory/1112-58-0x0000000000000000-mapping.dmp

Download
memory/1252-86-0x0000000000000000-mapping.dmp

Download
memory/1324-57-0x0000000000000000-mapping.dmp

Download
memory/1376-62-0x0000000000000000-mapping.dmp

Download
memory/1464-54-0x0000000075B51000-0x0000000075B53000-memory.dmp

Filesize
8KB

Download
memory/1464-59-0x0000000000360000-0x00000000007BE000-memory.dmp

Filesize
4.4MB

Download
memory/1464-90-0x0000000000360000-0x00000000007BE000-memory.dmp

Filesize
4.4MB

Download
memory/1512-87-0x0000000000000000-mapping.dmp

Download
memory/1720-81-0x0000000000000000-mapping.dmp

Download
memory/1748-80-0x0000000000000000-mapping.dmp

Download
memory/2024-61-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads