8eff2b0395a14860312142408b764433943c1c8a468bf4655f0e913cb65da10d

Analysis

max time kernel
40s
max time network
46s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
23-11-2022 10:19

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

8eff2b0395a14860312142408b764433943c1c8a468bf4655f0e913cb65da10d.exe
Size

602KB
MD5

91ab9503734f5b4779d2379cdc5434fe
SHA1

0af2f870c035f3b568472c32f6b1cd867905b72f
SHA256

8eff2b0395a14860312142408b764433943c1c8a468bf4655f0e913cb65da10d
SHA512

562202191c6d39286f6ff9b06903aa9f2bd0fa04919bd7d07743a6a12172dad39cf33e0a0bcede96552391fc11a10f2a05616c5c9c00c7168751887a3b22ac8c
SSDEEP

12288:YIny5DYTj7WVdU2WAG+aOspAQEK8tsKZOSzvOQMW4+F:2UTj7GpWAG+PspAQnRKZOSz2TW4+F

Score

8^/10

discovery

Malware Config

Signatures

Drops file in Drivers directory 1 IoCs

Processes:

8eff2b0395a14860312142408b764433943c1c8a468bf4655f0e913cb65da10d.exe

description ioc process

File created C:\Windows\system32\drivers\nethfdrv.sys 8eff2b0395a14860312142408b764433943c1c8a468bf4655f0e913cb65da10d.exe
Executes dropped EXE 5 IoCs

Processes:

installd.exenethtsrv.exenetupdsrv.exenethtsrv.exenetupdsrv.exe

pid process

2012 installd.exe
1016 nethtsrv.exe
1352 netupdsrv.exe
1800 nethtsrv.exe
472 netupdsrv.exe

description	ioc	process
File created	C:\Windows\system32\drivers\nethfdrv.sys	8eff2b0395a14860312142408b764433943c1c8a468bf4655f0e913cb65da10d.exe

pid	process
2012	installd.exe
1016	nethtsrv.exe
1352	netupdsrv.exe
1800	nethtsrv.exe
472	netupdsrv.exe

Loads dropped DLL 13 IoCs

Processes:

8eff2b0395a14860312142408b764433943c1c8a468bf4655f0e913cb65da10d.exeinstalld.exenethtsrv.exenethtsrv.exe

pid	process
1500	8eff2b0395a14860312142408b764433943c1c8a468bf4655f0e913cb65da10d.exe
1500	8eff2b0395a14860312142408b764433943c1c8a468bf4655f0e913cb65da10d.exe
1500	8eff2b0395a14860312142408b764433943c1c8a468bf4655f0e913cb65da10d.exe
1500	8eff2b0395a14860312142408b764433943c1c8a468bf4655f0e913cb65da10d.exe
2012	installd.exe
1500	8eff2b0395a14860312142408b764433943c1c8a468bf4655f0e913cb65da10d.exe
1016	nethtsrv.exe
1016	nethtsrv.exe
1500	8eff2b0395a14860312142408b764433943c1c8a468bf4655f0e913cb65da10d.exe
1500	8eff2b0395a14860312142408b764433943c1c8a468bf4655f0e913cb65da10d.exe
1800	nethtsrv.exe
1800	nethtsrv.exe
1500	8eff2b0395a14860312142408b764433943c1c8a468bf4655f0e913cb65da10d.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in System32 directory 5 IoCs

Processes:

8eff2b0395a14860312142408b764433943c1c8a468bf4655f0e913cb65da10d.exe

description	ioc	process
File created	C:\Windows\SysWOW64\hfnapi.dll	8eff2b0395a14860312142408b764433943c1c8a468bf4655f0e913cb65da10d.exe
File created	C:\Windows\SysWOW64\hfpapi.dll	8eff2b0395a14860312142408b764433943c1c8a468bf4655f0e913cb65da10d.exe
File created	C:\Windows\SysWOW64\installd.exe	8eff2b0395a14860312142408b764433943c1c8a468bf4655f0e913cb65da10d.exe
File created	C:\Windows\SysWOW64\nethtsrv.exe	8eff2b0395a14860312142408b764433943c1c8a468bf4655f0e913cb65da10d.exe
File created	C:\Windows\SysWOW64\netupdsrv.exe	8eff2b0395a14860312142408b764433943c1c8a468bf4655f0e913cb65da10d.exe

Drops file in Program Files directory 3 IoCs

Processes:

8eff2b0395a14860312142408b764433943c1c8a468bf4655f0e913cb65da10d.exe

description	ioc	process
File created	C:\Program Files (x86)\Common Files\Config\data.xml	8eff2b0395a14860312142408b764433943c1c8a468bf4655f0e913cb65da10d.exe
File created	C:\Program Files (x86)\Common Files\Config\ver.xml	8eff2b0395a14860312142408b764433943c1c8a468bf4655f0e913cb65da10d.exe
File created	C:\Program Files (x86)\Common Files\config\uninstinethnfd.exe	8eff2b0395a14860312142408b764433943c1c8a468bf4655f0e913cb65da10d.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Runs net.exe
Suspicious behavior: LoadsDriver 1 IoCs

Processes:

pid process

464
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

nethtsrv.exe

description pid process

Token: SeDebugPrivilege 1800 nethtsrv.exe

pid	process
464

description	pid	process
Token: SeDebugPrivilege	1800	nethtsrv.exe

Suspicious use of WriteProcessMemory 50 IoCs

Processes:

8eff2b0395a14860312142408b764433943c1c8a468bf4655f0e913cb65da10d.exenet.exenet.exenet.exenet.exe

description	pid	process	target process
PID 1500 wrote to memory of 1920	1500	8eff2b0395a14860312142408b764433943c1c8a468bf4655f0e913cb65da10d.exe	net.exe
PID 1500 wrote to memory of 1920	1500	8eff2b0395a14860312142408b764433943c1c8a468bf4655f0e913cb65da10d.exe	net.exe
PID 1500 wrote to memory of 1920	1500	8eff2b0395a14860312142408b764433943c1c8a468bf4655f0e913cb65da10d.exe	net.exe
PID 1500 wrote to memory of 1920	1500	8eff2b0395a14860312142408b764433943c1c8a468bf4655f0e913cb65da10d.exe	net.exe
PID 1920 wrote to memory of 936	1920	net.exe	net1.exe
PID 1920 wrote to memory of 936	1920	net.exe	net1.exe
PID 1920 wrote to memory of 936	1920	net.exe	net1.exe
PID 1920 wrote to memory of 936	1920	net.exe	net1.exe
PID 1500 wrote to memory of 112	1500	8eff2b0395a14860312142408b764433943c1c8a468bf4655f0e913cb65da10d.exe	net.exe
PID 1500 wrote to memory of 112	1500	8eff2b0395a14860312142408b764433943c1c8a468bf4655f0e913cb65da10d.exe	net.exe
PID 1500 wrote to memory of 112	1500	8eff2b0395a14860312142408b764433943c1c8a468bf4655f0e913cb65da10d.exe	net.exe
PID 1500 wrote to memory of 112	1500	8eff2b0395a14860312142408b764433943c1c8a468bf4655f0e913cb65da10d.exe	net.exe
PID 112 wrote to memory of 1744	112	net.exe	net1.exe
PID 112 wrote to memory of 1744	112	net.exe	net1.exe
PID 112 wrote to memory of 1744	112	net.exe	net1.exe
PID 112 wrote to memory of 1744	112	net.exe	net1.exe
PID 1500 wrote to memory of 2012	1500	8eff2b0395a14860312142408b764433943c1c8a468bf4655f0e913cb65da10d.exe	installd.exe
PID 1500 wrote to memory of 2012	1500	8eff2b0395a14860312142408b764433943c1c8a468bf4655f0e913cb65da10d.exe	installd.exe
PID 1500 wrote to memory of 2012	1500	8eff2b0395a14860312142408b764433943c1c8a468bf4655f0e913cb65da10d.exe	installd.exe
PID 1500 wrote to memory of 2012	1500	8eff2b0395a14860312142408b764433943c1c8a468bf4655f0e913cb65da10d.exe	installd.exe
PID 1500 wrote to memory of 2012	1500	8eff2b0395a14860312142408b764433943c1c8a468bf4655f0e913cb65da10d.exe	installd.exe
PID 1500 wrote to memory of 2012	1500	8eff2b0395a14860312142408b764433943c1c8a468bf4655f0e913cb65da10d.exe	installd.exe
PID 1500 wrote to memory of 2012	1500	8eff2b0395a14860312142408b764433943c1c8a468bf4655f0e913cb65da10d.exe	installd.exe
PID 1500 wrote to memory of 1016	1500	8eff2b0395a14860312142408b764433943c1c8a468bf4655f0e913cb65da10d.exe	nethtsrv.exe
PID 1500 wrote to memory of 1016	1500	8eff2b0395a14860312142408b764433943c1c8a468bf4655f0e913cb65da10d.exe	nethtsrv.exe
PID 1500 wrote to memory of 1016	1500	8eff2b0395a14860312142408b764433943c1c8a468bf4655f0e913cb65da10d.exe	nethtsrv.exe
PID 1500 wrote to memory of 1016	1500	8eff2b0395a14860312142408b764433943c1c8a468bf4655f0e913cb65da10d.exe	nethtsrv.exe
PID 1500 wrote to memory of 1352	1500	8eff2b0395a14860312142408b764433943c1c8a468bf4655f0e913cb65da10d.exe	netupdsrv.exe
PID 1500 wrote to memory of 1352	1500	8eff2b0395a14860312142408b764433943c1c8a468bf4655f0e913cb65da10d.exe	netupdsrv.exe
PID 1500 wrote to memory of 1352	1500	8eff2b0395a14860312142408b764433943c1c8a468bf4655f0e913cb65da10d.exe	netupdsrv.exe
PID 1500 wrote to memory of 1352	1500	8eff2b0395a14860312142408b764433943c1c8a468bf4655f0e913cb65da10d.exe	netupdsrv.exe
PID 1500 wrote to memory of 1352	1500	8eff2b0395a14860312142408b764433943c1c8a468bf4655f0e913cb65da10d.exe	netupdsrv.exe
PID 1500 wrote to memory of 1352	1500	8eff2b0395a14860312142408b764433943c1c8a468bf4655f0e913cb65da10d.exe	netupdsrv.exe
PID 1500 wrote to memory of 1352	1500	8eff2b0395a14860312142408b764433943c1c8a468bf4655f0e913cb65da10d.exe	netupdsrv.exe
PID 1500 wrote to memory of 1944	1500	8eff2b0395a14860312142408b764433943c1c8a468bf4655f0e913cb65da10d.exe	net.exe
PID 1500 wrote to memory of 1944	1500	8eff2b0395a14860312142408b764433943c1c8a468bf4655f0e913cb65da10d.exe	net.exe
PID 1500 wrote to memory of 1944	1500	8eff2b0395a14860312142408b764433943c1c8a468bf4655f0e913cb65da10d.exe	net.exe
PID 1500 wrote to memory of 1944	1500	8eff2b0395a14860312142408b764433943c1c8a468bf4655f0e913cb65da10d.exe	net.exe
PID 1944 wrote to memory of 1328	1944	net.exe	net1.exe
PID 1944 wrote to memory of 1328	1944	net.exe	net1.exe
PID 1944 wrote to memory of 1328	1944	net.exe	net1.exe
PID 1944 wrote to memory of 1328	1944	net.exe	net1.exe
PID 1500 wrote to memory of 1280	1500	8eff2b0395a14860312142408b764433943c1c8a468bf4655f0e913cb65da10d.exe	net.exe
PID 1500 wrote to memory of 1280	1500	8eff2b0395a14860312142408b764433943c1c8a468bf4655f0e913cb65da10d.exe	net.exe
PID 1500 wrote to memory of 1280	1500	8eff2b0395a14860312142408b764433943c1c8a468bf4655f0e913cb65da10d.exe	net.exe
PID 1500 wrote to memory of 1280	1500	8eff2b0395a14860312142408b764433943c1c8a468bf4655f0e913cb65da10d.exe	net.exe
PID 1280 wrote to memory of 996	1280	net.exe	net1.exe
PID 1280 wrote to memory of 996	1280	net.exe	net1.exe
PID 1280 wrote to memory of 996	1280	net.exe	net1.exe
PID 1280 wrote to memory of 996	1280	net.exe	net1.exe

C:\Users\Admin\AppData\Local\Temp\8eff2b0395a14860312142408b764433943c1c8a468bf4655f0e913cb65da10d.exe
"C:\Users\Admin\AppData\Local\Temp\8eff2b0395a14860312142408b764433943c1c8a468bf4655f0e913cb65da10d.exe"
1⤵
- Drops file in Drivers directory
- Loads dropped DLL
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:1500

C:\Windows\SysWOW64\net.exe
net stop nethttpservice
2⤵
- Suspicious use of WriteProcessMemory
PID:1920

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop nethttpservice
3⤵
PID:936

C:\Windows\SysWOW64\net.exe
net stop serviceupdater
2⤵
- Suspicious use of WriteProcessMemory
PID:112

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop serviceupdater
3⤵
PID:1744

C:\Windows\SysWOW64\installd.exe
"C:\Windows\system32\installd.exe" nethfdrv
2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2012

C:\Windows\SysWOW64\nethtsrv.exe
"C:\Windows\system32\nethtsrv.exe" -nfdi
2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1016

C:\Windows\SysWOW64\netupdsrv.exe
"C:\Windows\system32\netupdsrv.exe" -nfdi
2⤵
- Executes dropped EXE
PID:1352

C:\Windows\SysWOW64\net.exe
net start nethttpservice
2⤵
- Suspicious use of WriteProcessMemory
PID:1944

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 start nethttpservice
3⤵
PID:1328

C:\Windows\SysWOW64\net.exe
net start serviceupdater
2⤵
- Suspicious use of WriteProcessMemory
PID:1280

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 start serviceupdater
3⤵
PID:996

C:\Windows\SysWOW64\nethtsrv.exe
C:\Windows\SysWOW64\nethtsrv.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:1800

C:\Windows\SysWOW64\netupdsrv.exe
C:\Windows\SysWOW64\netupdsrv.exe
1⤵
- Executes dropped EXE
PID:472

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\hfnapi.dll
Filesize
106KB

MD5
9521375251e98a694b4fc14d7e97a0c8

SHA1
a96a36191e372a3e21e9aae89f6f8c4886309725

SHA256
bfe6678d3f79f19afaa9eaf7bda327f11a53b10efdc188e50adbcd238ebfe5d7

SHA512
ac1e5474bb7e7be7217fb81873905e74ef5dcd6b5dd1d1a828ef33e70d40bcb84563df2dc57b157dd8de2ba21c2c504976615b29fb070385569fa3e0ccc00687

Download Submit
C:\Windows\SysWOW64\hfpapi.dll
Filesize
241KB

MD5
6db0c3a6381d1c742384d5812eefb970

SHA1
3d979ef2611014d12e3268342b151b1f487702e9

SHA256
a3e429c32c0fcaecc1287c522b5ee1ef243bf1fa70a1971c713a0442a46c1e3c

SHA512
86158c198bb54e6c7713551366a7503c1df7102337bb6aa67909a1988e3175a509bceab1e75e467c200641026a4fcdb1b3b350bec9d9f9eb4058b6068e32e2f1

Download Submit
C:\Windows\SysWOW64\installd.exe
Filesize
108KB

MD5
ad0ffeadd743ea1c78c02238ace9635f

SHA1
fd03e7283adfa58d8372148afd66b610eac8589d

SHA256
7e1b822884b9ebe71a19d15b1af530698e56cabe7674298a844e3c587b48f3f2

SHA512
ade20dc00dbbb0bcbb1e65d7fd95109a4c131b854c4c20122a97f7cfd37200ddb0112941d1e990fc036d486070ef75a0d1eb588718577d192aafccd795360feb

Download Submit
C:\Windows\SysWOW64\nethtsrv.exe
Filesize
176KB

MD5
2b4da54325c2129e722efc4b5f06143e

SHA1
7054cf89e2f428e0bc415637d455245f74b0255b

SHA256
c4cbf8e9df47ab013d0a8a6d27bca7b0b18f19a7653c921b748adfd254faba64

SHA512
7ae6bb4f1dc597fa45ef1082e16e66089e6c4cd9c24e229455ca6429c34205a5e165bf962a1386863ac0381437beef6cca08036cd19941a5c57202512d4d7242

Download Submit
C:\Windows\SysWOW64\nethtsrv.exe
Filesize
176KB

MD5
2b4da54325c2129e722efc4b5f06143e

SHA1
7054cf89e2f428e0bc415637d455245f74b0255b

SHA256
c4cbf8e9df47ab013d0a8a6d27bca7b0b18f19a7653c921b748adfd254faba64

SHA512
7ae6bb4f1dc597fa45ef1082e16e66089e6c4cd9c24e229455ca6429c34205a5e165bf962a1386863ac0381437beef6cca08036cd19941a5c57202512d4d7242

Download Submit
C:\Windows\SysWOW64\netupdsrv.exe
Filesize
158KB

MD5
b40cb83d98b55d9a20c0015923cc639e

SHA1
e2be0ca1e3c4cdff4aaf92d7d57c0ae72dec3cba

SHA256
762a1115a18174f87dd532e321ec7756092d45f550c8d15ac42186580acfc3ff

SHA512
54b0e777e89206c5fa5b5c7c0fcb3930836c7edaf6fae61db79b47a6b87dfdb356a97743801faea8262e787b838e0d5d96f469849d6e882517bfb6ef14851640

Download Submit
C:\Windows\SysWOW64\netupdsrv.exe
Filesize
158KB

MD5
b40cb83d98b55d9a20c0015923cc639e

SHA1
e2be0ca1e3c4cdff4aaf92d7d57c0ae72dec3cba

SHA256
762a1115a18174f87dd532e321ec7756092d45f550c8d15ac42186580acfc3ff

SHA512
54b0e777e89206c5fa5b5c7c0fcb3930836c7edaf6fae61db79b47a6b87dfdb356a97743801faea8262e787b838e0d5d96f469849d6e882517bfb6ef14851640

Download Submit
\Users\Admin\AppData\Local\Temp\nsj429F.tmp\System.dll
Filesize
11KB

MD5
c17103ae9072a06da581dec998343fc1

SHA1
b72148c6bdfaada8b8c3f950e610ee7cf1da1f8d

SHA256
dc58d8ad81cacb0c1ed72e33bff8f23ea40b5252b5bb55d393a0903e6819ae2f

SHA512
d32a71aaef18e993f28096d536e41c4d016850721b31171513ce28bbd805a54fd290b7c3e9d935f72e676a1acfb4f0dcc89d95040a0dd29f2b6975855c18986f

Download Submit
\Users\Admin\AppData\Local\Temp\nsj429F.tmp\nsExec.dll
Filesize
6KB

MD5
acc2b699edfea5bf5aae45aba3a41e96

SHA1
d2accf4d494e43ceb2cff69abe4dd17147d29cc2

SHA256
168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e

SHA512
e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe

Download Submit
\Users\Admin\AppData\Local\Temp\nsj429F.tmp\nsExec.dll
Filesize
6KB

MD5
acc2b699edfea5bf5aae45aba3a41e96

SHA1
d2accf4d494e43ceb2cff69abe4dd17147d29cc2

SHA256
168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e

SHA512
e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe

Download Submit
\Users\Admin\AppData\Local\Temp\nsj429F.tmp\nsExec.dll
Filesize
6KB

MD5
acc2b699edfea5bf5aae45aba3a41e96

SHA1
d2accf4d494e43ceb2cff69abe4dd17147d29cc2

SHA256
168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e

SHA512
e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe

Download Submit
\Users\Admin\AppData\Local\Temp\nsj429F.tmp\nsExec.dll
Filesize
6KB

MD5
acc2b699edfea5bf5aae45aba3a41e96

SHA1
d2accf4d494e43ceb2cff69abe4dd17147d29cc2

SHA256
168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e

SHA512
e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe

Download Submit
\Windows\SysWOW64\hfnapi.dll
Filesize
106KB

MD5
9521375251e98a694b4fc14d7e97a0c8

SHA1
a96a36191e372a3e21e9aae89f6f8c4886309725

SHA256
bfe6678d3f79f19afaa9eaf7bda327f11a53b10efdc188e50adbcd238ebfe5d7

SHA512
ac1e5474bb7e7be7217fb81873905e74ef5dcd6b5dd1d1a828ef33e70d40bcb84563df2dc57b157dd8de2ba21c2c504976615b29fb070385569fa3e0ccc00687

Download Submit
\Windows\SysWOW64\hfnapi.dll
Filesize
106KB

MD5
9521375251e98a694b4fc14d7e97a0c8

SHA1
a96a36191e372a3e21e9aae89f6f8c4886309725

SHA256
bfe6678d3f79f19afaa9eaf7bda327f11a53b10efdc188e50adbcd238ebfe5d7

SHA512
ac1e5474bb7e7be7217fb81873905e74ef5dcd6b5dd1d1a828ef33e70d40bcb84563df2dc57b157dd8de2ba21c2c504976615b29fb070385569fa3e0ccc00687

Download Submit
\Windows\SysWOW64\hfnapi.dll
Filesize
106KB

MD5
9521375251e98a694b4fc14d7e97a0c8

SHA1
a96a36191e372a3e21e9aae89f6f8c4886309725

SHA256
bfe6678d3f79f19afaa9eaf7bda327f11a53b10efdc188e50adbcd238ebfe5d7

SHA512
ac1e5474bb7e7be7217fb81873905e74ef5dcd6b5dd1d1a828ef33e70d40bcb84563df2dc57b157dd8de2ba21c2c504976615b29fb070385569fa3e0ccc00687

Download Submit
\Windows\SysWOW64\hfpapi.dll
Filesize
241KB

MD5
6db0c3a6381d1c742384d5812eefb970

SHA1
3d979ef2611014d12e3268342b151b1f487702e9

SHA256
a3e429c32c0fcaecc1287c522b5ee1ef243bf1fa70a1971c713a0442a46c1e3c

SHA512
86158c198bb54e6c7713551366a7503c1df7102337bb6aa67909a1988e3175a509bceab1e75e467c200641026a4fcdb1b3b350bec9d9f9eb4058b6068e32e2f1

Download Submit
\Windows\SysWOW64\hfpapi.dll
Filesize
241KB

MD5
6db0c3a6381d1c742384d5812eefb970

SHA1
3d979ef2611014d12e3268342b151b1f487702e9

SHA256
a3e429c32c0fcaecc1287c522b5ee1ef243bf1fa70a1971c713a0442a46c1e3c

SHA512
86158c198bb54e6c7713551366a7503c1df7102337bb6aa67909a1988e3175a509bceab1e75e467c200641026a4fcdb1b3b350bec9d9f9eb4058b6068e32e2f1

Download Submit
\Windows\SysWOW64\installd.exe
Filesize
108KB

MD5
ad0ffeadd743ea1c78c02238ace9635f

SHA1
fd03e7283adfa58d8372148afd66b610eac8589d

SHA256
7e1b822884b9ebe71a19d15b1af530698e56cabe7674298a844e3c587b48f3f2

SHA512
ade20dc00dbbb0bcbb1e65d7fd95109a4c131b854c4c20122a97f7cfd37200ddb0112941d1e990fc036d486070ef75a0d1eb588718577d192aafccd795360feb

Download Submit
\Windows\SysWOW64\nethtsrv.exe
Filesize
176KB

MD5
2b4da54325c2129e722efc4b5f06143e

SHA1
7054cf89e2f428e0bc415637d455245f74b0255b

SHA256
c4cbf8e9df47ab013d0a8a6d27bca7b0b18f19a7653c921b748adfd254faba64

SHA512
7ae6bb4f1dc597fa45ef1082e16e66089e6c4cd9c24e229455ca6429c34205a5e165bf962a1386863ac0381437beef6cca08036cd19941a5c57202512d4d7242

Download Submit
\Windows\SysWOW64\netupdsrv.exe
Filesize
158KB

MD5
b40cb83d98b55d9a20c0015923cc639e

SHA1
e2be0ca1e3c4cdff4aaf92d7d57c0ae72dec3cba

SHA256
762a1115a18174f87dd532e321ec7756092d45f550c8d15ac42186580acfc3ff

SHA512
54b0e777e89206c5fa5b5c7c0fcb3930836c7edaf6fae61db79b47a6b87dfdb356a97743801faea8262e787b838e0d5d96f469849d6e882517bfb6ef14851640

Download Submit
memory/112-60-0x0000000000000000-mapping.dmp

Download
memory/936-58-0x0000000000000000-mapping.dmp

Download
memory/996-87-0x0000000000000000-mapping.dmp

Download
memory/1016-70-0x0000000000000000-mapping.dmp

Download
memory/1280-86-0x0000000000000000-mapping.dmp

Download
memory/1328-81-0x0000000000000000-mapping.dmp

Download
memory/1352-76-0x0000000000000000-mapping.dmp

Download
memory/1500-62-0x0000000000360000-0x00000000007BE000-memory.dmp

Filesize
4.4MB

Download
memory/1500-54-0x0000000076201000-0x0000000076203000-memory.dmp

Filesize
8KB

Download
memory/1500-90-0x0000000000360000-0x00000000007BE000-memory.dmp

Filesize
4.4MB

Download
memory/1744-61-0x0000000000000000-mapping.dmp

Download
memory/1920-57-0x0000000000000000-mapping.dmp

Download
memory/1944-80-0x0000000000000000-mapping.dmp

Download
memory/2012-64-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads