70b7ba74109c90a1575f872e3dd272321b221f78ece77c1b1a7b20829dbe4cae

Analysis

max time kernel
38s
max time network
45s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
23-11-2022 10:23

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

70b7ba74109c90a1575f872e3dd272321b221f78ece77c1b1a7b20829dbe4cae.exe
Size

603KB
MD5

d7d8f16165251d363f27ea7d44f0e46b
SHA1

b19d701bae6d9e2c08b6dae3a33a281c14b08b6e
SHA256

70b7ba74109c90a1575f872e3dd272321b221f78ece77c1b1a7b20829dbe4cae
SHA512

8295a17e41cc8f3d825f7afb9fcec3ba25c5fb44a6ca1c69d5575503a1224cbef49b58ca80b5cbfe5c8b0d54e2eab4e3d4feb9164d70c87aa4e22ee5e2729526
SSDEEP

12288:hIny5DYTQIndBjQjkMNdEb1ETRHv0qn1ioo1EiQucrPpIqqdh:dUTQwrjQjkMNe1ETjn9iQucrPR8h

Score

8^/10

discovery

Malware Config

Signatures

Drops file in Drivers directory 1 IoCs

Processes:

70b7ba74109c90a1575f872e3dd272321b221f78ece77c1b1a7b20829dbe4cae.exe

description ioc process

File created C:\Windows\system32\drivers\nethfdrv.sys 70b7ba74109c90a1575f872e3dd272321b221f78ece77c1b1a7b20829dbe4cae.exe
Executes dropped EXE 5 IoCs

Processes:

installd.exenethtsrv.exenetupdsrv.exenethtsrv.exenetupdsrv.exe

pid process

1800 installd.exe
1644 nethtsrv.exe
824 netupdsrv.exe
840 nethtsrv.exe
1548 netupdsrv.exe

description	ioc	process
File created	C:\Windows\system32\drivers\nethfdrv.sys	70b7ba74109c90a1575f872e3dd272321b221f78ece77c1b1a7b20829dbe4cae.exe

pid	process
1800	installd.exe
1644	nethtsrv.exe
824	netupdsrv.exe
840	nethtsrv.exe
1548	netupdsrv.exe

Loads dropped DLL 13 IoCs

Processes:

70b7ba74109c90a1575f872e3dd272321b221f78ece77c1b1a7b20829dbe4cae.exeinstalld.exenethtsrv.exenethtsrv.exe

pid	process
1424	70b7ba74109c90a1575f872e3dd272321b221f78ece77c1b1a7b20829dbe4cae.exe
1424	70b7ba74109c90a1575f872e3dd272321b221f78ece77c1b1a7b20829dbe4cae.exe
1424	70b7ba74109c90a1575f872e3dd272321b221f78ece77c1b1a7b20829dbe4cae.exe
1424	70b7ba74109c90a1575f872e3dd272321b221f78ece77c1b1a7b20829dbe4cae.exe
1800	installd.exe
1424	70b7ba74109c90a1575f872e3dd272321b221f78ece77c1b1a7b20829dbe4cae.exe
1644	nethtsrv.exe
1644	nethtsrv.exe
1424	70b7ba74109c90a1575f872e3dd272321b221f78ece77c1b1a7b20829dbe4cae.exe
1424	70b7ba74109c90a1575f872e3dd272321b221f78ece77c1b1a7b20829dbe4cae.exe
840	nethtsrv.exe
840	nethtsrv.exe
1424	70b7ba74109c90a1575f872e3dd272321b221f78ece77c1b1a7b20829dbe4cae.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in System32 directory 5 IoCs

Processes:

70b7ba74109c90a1575f872e3dd272321b221f78ece77c1b1a7b20829dbe4cae.exe

description	ioc	process
File created	C:\Windows\SysWOW64\hfnapi.dll	70b7ba74109c90a1575f872e3dd272321b221f78ece77c1b1a7b20829dbe4cae.exe
File created	C:\Windows\SysWOW64\hfpapi.dll	70b7ba74109c90a1575f872e3dd272321b221f78ece77c1b1a7b20829dbe4cae.exe
File created	C:\Windows\SysWOW64\installd.exe	70b7ba74109c90a1575f872e3dd272321b221f78ece77c1b1a7b20829dbe4cae.exe
File created	C:\Windows\SysWOW64\nethtsrv.exe	70b7ba74109c90a1575f872e3dd272321b221f78ece77c1b1a7b20829dbe4cae.exe
File created	C:\Windows\SysWOW64\netupdsrv.exe	70b7ba74109c90a1575f872e3dd272321b221f78ece77c1b1a7b20829dbe4cae.exe

Drops file in Program Files directory 3 IoCs

Processes:

70b7ba74109c90a1575f872e3dd272321b221f78ece77c1b1a7b20829dbe4cae.exe

description	ioc	process
File created	C:\Program Files (x86)\Common Files\config\uninstinethnfd.exe	70b7ba74109c90a1575f872e3dd272321b221f78ece77c1b1a7b20829dbe4cae.exe
File created	C:\Program Files (x86)\Common Files\Config\data.xml	70b7ba74109c90a1575f872e3dd272321b221f78ece77c1b1a7b20829dbe4cae.exe
File created	C:\Program Files (x86)\Common Files\Config\ver.xml	70b7ba74109c90a1575f872e3dd272321b221f78ece77c1b1a7b20829dbe4cae.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Runs net.exe
Suspicious behavior: LoadsDriver 1 IoCs

Processes:

pid process

460
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

nethtsrv.exe

description pid process

Token: SeDebugPrivilege 840 nethtsrv.exe

pid	process
460

description	pid	process
Token: SeDebugPrivilege	840	nethtsrv.exe

Suspicious use of WriteProcessMemory 50 IoCs

Processes:

70b7ba74109c90a1575f872e3dd272321b221f78ece77c1b1a7b20829dbe4cae.exenet.exenet.exenet.exenet.exe

description	pid	process	target process
PID 1424 wrote to memory of 1204	1424	70b7ba74109c90a1575f872e3dd272321b221f78ece77c1b1a7b20829dbe4cae.exe	net.exe
PID 1424 wrote to memory of 1204	1424	70b7ba74109c90a1575f872e3dd272321b221f78ece77c1b1a7b20829dbe4cae.exe	net.exe
PID 1424 wrote to memory of 1204	1424	70b7ba74109c90a1575f872e3dd272321b221f78ece77c1b1a7b20829dbe4cae.exe	net.exe
PID 1424 wrote to memory of 1204	1424	70b7ba74109c90a1575f872e3dd272321b221f78ece77c1b1a7b20829dbe4cae.exe	net.exe
PID 1204 wrote to memory of 1528	1204	net.exe	net1.exe
PID 1204 wrote to memory of 1528	1204	net.exe	net1.exe
PID 1204 wrote to memory of 1528	1204	net.exe	net1.exe
PID 1204 wrote to memory of 1528	1204	net.exe	net1.exe
PID 1424 wrote to memory of 1540	1424	70b7ba74109c90a1575f872e3dd272321b221f78ece77c1b1a7b20829dbe4cae.exe	net.exe
PID 1424 wrote to memory of 1540	1424	70b7ba74109c90a1575f872e3dd272321b221f78ece77c1b1a7b20829dbe4cae.exe	net.exe
PID 1424 wrote to memory of 1540	1424	70b7ba74109c90a1575f872e3dd272321b221f78ece77c1b1a7b20829dbe4cae.exe	net.exe
PID 1424 wrote to memory of 1540	1424	70b7ba74109c90a1575f872e3dd272321b221f78ece77c1b1a7b20829dbe4cae.exe	net.exe
PID 1540 wrote to memory of 1104	1540	net.exe	net1.exe
PID 1540 wrote to memory of 1104	1540	net.exe	net1.exe
PID 1540 wrote to memory of 1104	1540	net.exe	net1.exe
PID 1540 wrote to memory of 1104	1540	net.exe	net1.exe
PID 1424 wrote to memory of 1800	1424	70b7ba74109c90a1575f872e3dd272321b221f78ece77c1b1a7b20829dbe4cae.exe	installd.exe
PID 1424 wrote to memory of 1800	1424	70b7ba74109c90a1575f872e3dd272321b221f78ece77c1b1a7b20829dbe4cae.exe	installd.exe
PID 1424 wrote to memory of 1800	1424	70b7ba74109c90a1575f872e3dd272321b221f78ece77c1b1a7b20829dbe4cae.exe	installd.exe
PID 1424 wrote to memory of 1800	1424	70b7ba74109c90a1575f872e3dd272321b221f78ece77c1b1a7b20829dbe4cae.exe	installd.exe
PID 1424 wrote to memory of 1800	1424	70b7ba74109c90a1575f872e3dd272321b221f78ece77c1b1a7b20829dbe4cae.exe	installd.exe
PID 1424 wrote to memory of 1800	1424	70b7ba74109c90a1575f872e3dd272321b221f78ece77c1b1a7b20829dbe4cae.exe	installd.exe
PID 1424 wrote to memory of 1800	1424	70b7ba74109c90a1575f872e3dd272321b221f78ece77c1b1a7b20829dbe4cae.exe	installd.exe
PID 1424 wrote to memory of 1644	1424	70b7ba74109c90a1575f872e3dd272321b221f78ece77c1b1a7b20829dbe4cae.exe	nethtsrv.exe
PID 1424 wrote to memory of 1644	1424	70b7ba74109c90a1575f872e3dd272321b221f78ece77c1b1a7b20829dbe4cae.exe	nethtsrv.exe
PID 1424 wrote to memory of 1644	1424	70b7ba74109c90a1575f872e3dd272321b221f78ece77c1b1a7b20829dbe4cae.exe	nethtsrv.exe
PID 1424 wrote to memory of 1644	1424	70b7ba74109c90a1575f872e3dd272321b221f78ece77c1b1a7b20829dbe4cae.exe	nethtsrv.exe
PID 1424 wrote to memory of 824	1424	70b7ba74109c90a1575f872e3dd272321b221f78ece77c1b1a7b20829dbe4cae.exe	netupdsrv.exe
PID 1424 wrote to memory of 824	1424	70b7ba74109c90a1575f872e3dd272321b221f78ece77c1b1a7b20829dbe4cae.exe	netupdsrv.exe
PID 1424 wrote to memory of 824	1424	70b7ba74109c90a1575f872e3dd272321b221f78ece77c1b1a7b20829dbe4cae.exe	netupdsrv.exe
PID 1424 wrote to memory of 824	1424	70b7ba74109c90a1575f872e3dd272321b221f78ece77c1b1a7b20829dbe4cae.exe	netupdsrv.exe
PID 1424 wrote to memory of 824	1424	70b7ba74109c90a1575f872e3dd272321b221f78ece77c1b1a7b20829dbe4cae.exe	netupdsrv.exe
PID 1424 wrote to memory of 824	1424	70b7ba74109c90a1575f872e3dd272321b221f78ece77c1b1a7b20829dbe4cae.exe	netupdsrv.exe
PID 1424 wrote to memory of 824	1424	70b7ba74109c90a1575f872e3dd272321b221f78ece77c1b1a7b20829dbe4cae.exe	netupdsrv.exe
PID 1424 wrote to memory of 1488	1424	70b7ba74109c90a1575f872e3dd272321b221f78ece77c1b1a7b20829dbe4cae.exe	net.exe
PID 1424 wrote to memory of 1488	1424	70b7ba74109c90a1575f872e3dd272321b221f78ece77c1b1a7b20829dbe4cae.exe	net.exe
PID 1424 wrote to memory of 1488	1424	70b7ba74109c90a1575f872e3dd272321b221f78ece77c1b1a7b20829dbe4cae.exe	net.exe
PID 1424 wrote to memory of 1488	1424	70b7ba74109c90a1575f872e3dd272321b221f78ece77c1b1a7b20829dbe4cae.exe	net.exe
PID 1488 wrote to memory of 1380	1488	net.exe	net1.exe
PID 1488 wrote to memory of 1380	1488	net.exe	net1.exe
PID 1488 wrote to memory of 1380	1488	net.exe	net1.exe
PID 1488 wrote to memory of 1380	1488	net.exe	net1.exe
PID 1424 wrote to memory of 1516	1424	70b7ba74109c90a1575f872e3dd272321b221f78ece77c1b1a7b20829dbe4cae.exe	net.exe
PID 1424 wrote to memory of 1516	1424	70b7ba74109c90a1575f872e3dd272321b221f78ece77c1b1a7b20829dbe4cae.exe	net.exe
PID 1424 wrote to memory of 1516	1424	70b7ba74109c90a1575f872e3dd272321b221f78ece77c1b1a7b20829dbe4cae.exe	net.exe
PID 1424 wrote to memory of 1516	1424	70b7ba74109c90a1575f872e3dd272321b221f78ece77c1b1a7b20829dbe4cae.exe	net.exe
PID 1516 wrote to memory of 972	1516	net.exe	net1.exe
PID 1516 wrote to memory of 972	1516	net.exe	net1.exe
PID 1516 wrote to memory of 972	1516	net.exe	net1.exe
PID 1516 wrote to memory of 972	1516	net.exe	net1.exe

C:\Users\Admin\AppData\Local\Temp\70b7ba74109c90a1575f872e3dd272321b221f78ece77c1b1a7b20829dbe4cae.exe
"C:\Users\Admin\AppData\Local\Temp\70b7ba74109c90a1575f872e3dd272321b221f78ece77c1b1a7b20829dbe4cae.exe"
1⤵
- Drops file in Drivers directory
- Loads dropped DLL
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:1424

C:\Windows\SysWOW64\net.exe
net stop nethttpservice
2⤵
- Suspicious use of WriteProcessMemory
PID:1204

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop nethttpservice
3⤵
PID:1528

C:\Windows\SysWOW64\net.exe
net stop serviceupdater
2⤵
- Suspicious use of WriteProcessMemory
PID:1540

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop serviceupdater
3⤵
PID:1104

C:\Windows\SysWOW64\installd.exe
"C:\Windows\system32\installd.exe" nethfdrv
2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1800

C:\Windows\SysWOW64\nethtsrv.exe
"C:\Windows\system32\nethtsrv.exe" -nfdi
2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1644

C:\Windows\SysWOW64\netupdsrv.exe
"C:\Windows\system32\netupdsrv.exe" -nfdi
2⤵
- Executes dropped EXE
PID:824

C:\Windows\SysWOW64\net.exe
net start nethttpservice
2⤵
- Suspicious use of WriteProcessMemory
PID:1488

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 start nethttpservice
3⤵
PID:1380

C:\Windows\SysWOW64\net.exe
net start serviceupdater
2⤵
- Suspicious use of WriteProcessMemory
PID:1516

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 start serviceupdater
3⤵
PID:972

C:\Windows\SysWOW64\nethtsrv.exe
C:\Windows\SysWOW64\nethtsrv.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:840

C:\Windows\SysWOW64\netupdsrv.exe
C:\Windows\SysWOW64\netupdsrv.exe
1⤵
- Executes dropped EXE
PID:1548

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\hfnapi.dll
Filesize
106KB

MD5
97ff5bf674b1c7d6cd2b7a19e0d34eb3

SHA1
9e6dfc3d2bacb046e752c013caf94d3d76e2764e

SHA256
3a7128b29374eb701c14018dc973125ab65b9b2e49b40b43859e41d4b08d78a4

SHA512
e5ed0d54ac9afa1edc678e48ee382ddbdbd53356e986c12c1de0336489e71bbbdfe527989220c7c3f2f55d506567f4a097214b38e56905a21b9241fb891e9c47

Download Submit
C:\Windows\SysWOW64\hfpapi.dll
Filesize
244KB

MD5
485be82fdeccce5438fc536bf700cd1d

SHA1
82fc8a438e9d50fbbe48265a4b4d3697ed379c4e

SHA256
96d418be2a281efa403d68d9790bd541fabcffb457cc0583eb9c719098483c8b

SHA512
3dc4e3070fa65c605330f7cc747a2113b02d041bd8bbd11d4e6ec34b671255ad4d32b309fad25b463e04377efec54f87e3a6a09bc731cb89347a4a08fc8314ff

Download Submit
C:\Windows\SysWOW64\installd.exe
Filesize
108KB

MD5
f0115ff1ede3f37b7b36cbc7e22a7600

SHA1
5a9bdf6cc950a60ee56896aca2fb60a62dc5c796

SHA256
e6297d7c8251af1ae551396f66077c3e41d1e19c961fc235324e2a9583f55ad6

SHA512
ded3967e2a924a7ab86659bd0c10f1af1bb2b7999e91d1ccd43f400ffd9d91c05b231ab634cccae781a55f98d0f452a8bb962111d7832c983c612b1594a9e349

Download Submit
C:\Windows\SysWOW64\nethtsrv.exe
Filesize
176KB

MD5
fc06aa84d4a5042bc80baedd9640c4e6

SHA1
88127dc35e0d1c79094eab6c35d14c4829e0847a

SHA256
4f29ce723a12df0133279d1938304c7fa732ab8c431d6cee614f0962bf8884e0

SHA512
757f16add8b4b3b81e408646235e02dcc4363279eeaa817edad81521527fbb7427a8688d501868fbcc83fc9feb5a27d6486bc4b7db4c67ed8f536dc11df32c64

Download Submit
C:\Windows\SysWOW64\nethtsrv.exe
Filesize
176KB

MD5
fc06aa84d4a5042bc80baedd9640c4e6

SHA1
88127dc35e0d1c79094eab6c35d14c4829e0847a

SHA256
4f29ce723a12df0133279d1938304c7fa732ab8c431d6cee614f0962bf8884e0

SHA512
757f16add8b4b3b81e408646235e02dcc4363279eeaa817edad81521527fbb7427a8688d501868fbcc83fc9feb5a27d6486bc4b7db4c67ed8f536dc11df32c64

Download Submit
C:\Windows\SysWOW64\netupdsrv.exe
Filesize
158KB

MD5
5b704966f578995082fafb825838d17f

SHA1
d3644b48d9729515e4c3de0b88b85227988ea313

SHA256
3bbf4450e75b3f7fa2af37fc54502de3bae18717fb90ee92debe1d30a0e19ea5

SHA512
c67e6ec4f3ba18ab985b36f9dcf8492bc12b25e5c27bad1966bdca290ae26eedce6f476cd8d35a557d508f939e7a6a1b681bda44ed04d943d200a6a4aec09575

Download Submit
C:\Windows\SysWOW64\netupdsrv.exe
Filesize
158KB

MD5
5b704966f578995082fafb825838d17f

SHA1
d3644b48d9729515e4c3de0b88b85227988ea313

SHA256
3bbf4450e75b3f7fa2af37fc54502de3bae18717fb90ee92debe1d30a0e19ea5

SHA512
c67e6ec4f3ba18ab985b36f9dcf8492bc12b25e5c27bad1966bdca290ae26eedce6f476cd8d35a557d508f939e7a6a1b681bda44ed04d943d200a6a4aec09575

Download Submit
\Users\Admin\AppData\Local\Temp\nsj67CB.tmp\System.dll
Filesize
11KB

MD5
c17103ae9072a06da581dec998343fc1

SHA1
b72148c6bdfaada8b8c3f950e610ee7cf1da1f8d

SHA256
dc58d8ad81cacb0c1ed72e33bff8f23ea40b5252b5bb55d393a0903e6819ae2f

SHA512
d32a71aaef18e993f28096d536e41c4d016850721b31171513ce28bbd805a54fd290b7c3e9d935f72e676a1acfb4f0dcc89d95040a0dd29f2b6975855c18986f

Download Submit
\Users\Admin\AppData\Local\Temp\nsj67CB.tmp\nsExec.dll
Filesize
6KB

MD5
acc2b699edfea5bf5aae45aba3a41e96

SHA1
d2accf4d494e43ceb2cff69abe4dd17147d29cc2

SHA256
168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e

SHA512
e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe

Download Submit
\Users\Admin\AppData\Local\Temp\nsj67CB.tmp\nsExec.dll
Filesize
6KB

MD5
acc2b699edfea5bf5aae45aba3a41e96

SHA1
d2accf4d494e43ceb2cff69abe4dd17147d29cc2

SHA256
168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e

SHA512
e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe

Download Submit
\Users\Admin\AppData\Local\Temp\nsj67CB.tmp\nsExec.dll
Filesize
6KB

MD5
acc2b699edfea5bf5aae45aba3a41e96

SHA1
d2accf4d494e43ceb2cff69abe4dd17147d29cc2

SHA256
168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e

SHA512
e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe

Download Submit
\Users\Admin\AppData\Local\Temp\nsj67CB.tmp\nsExec.dll
Filesize
6KB

MD5
acc2b699edfea5bf5aae45aba3a41e96

SHA1
d2accf4d494e43ceb2cff69abe4dd17147d29cc2

SHA256
168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e

SHA512
e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe

Download Submit
\Windows\SysWOW64\hfnapi.dll
Filesize
106KB

MD5
97ff5bf674b1c7d6cd2b7a19e0d34eb3

SHA1
9e6dfc3d2bacb046e752c013caf94d3d76e2764e

SHA256
3a7128b29374eb701c14018dc973125ab65b9b2e49b40b43859e41d4b08d78a4

SHA512
e5ed0d54ac9afa1edc678e48ee382ddbdbd53356e986c12c1de0336489e71bbbdfe527989220c7c3f2f55d506567f4a097214b38e56905a21b9241fb891e9c47

Download Submit
\Windows\SysWOW64\hfnapi.dll
Filesize
106KB

MD5
97ff5bf674b1c7d6cd2b7a19e0d34eb3

SHA1
9e6dfc3d2bacb046e752c013caf94d3d76e2764e

SHA256
3a7128b29374eb701c14018dc973125ab65b9b2e49b40b43859e41d4b08d78a4

SHA512
e5ed0d54ac9afa1edc678e48ee382ddbdbd53356e986c12c1de0336489e71bbbdfe527989220c7c3f2f55d506567f4a097214b38e56905a21b9241fb891e9c47

Download Submit
\Windows\SysWOW64\hfnapi.dll
Filesize
106KB

MD5
97ff5bf674b1c7d6cd2b7a19e0d34eb3

SHA1
9e6dfc3d2bacb046e752c013caf94d3d76e2764e

SHA256
3a7128b29374eb701c14018dc973125ab65b9b2e49b40b43859e41d4b08d78a4

SHA512
e5ed0d54ac9afa1edc678e48ee382ddbdbd53356e986c12c1de0336489e71bbbdfe527989220c7c3f2f55d506567f4a097214b38e56905a21b9241fb891e9c47

Download Submit
\Windows\SysWOW64\hfpapi.dll
Filesize
244KB

MD5
485be82fdeccce5438fc536bf700cd1d

SHA1
82fc8a438e9d50fbbe48265a4b4d3697ed379c4e

SHA256
96d418be2a281efa403d68d9790bd541fabcffb457cc0583eb9c719098483c8b

SHA512
3dc4e3070fa65c605330f7cc747a2113b02d041bd8bbd11d4e6ec34b671255ad4d32b309fad25b463e04377efec54f87e3a6a09bc731cb89347a4a08fc8314ff

Download Submit
\Windows\SysWOW64\hfpapi.dll
Filesize
244KB

MD5
485be82fdeccce5438fc536bf700cd1d

SHA1
82fc8a438e9d50fbbe48265a4b4d3697ed379c4e

SHA256
96d418be2a281efa403d68d9790bd541fabcffb457cc0583eb9c719098483c8b

SHA512
3dc4e3070fa65c605330f7cc747a2113b02d041bd8bbd11d4e6ec34b671255ad4d32b309fad25b463e04377efec54f87e3a6a09bc731cb89347a4a08fc8314ff

Download Submit
\Windows\SysWOW64\installd.exe
Filesize
108KB

MD5
f0115ff1ede3f37b7b36cbc7e22a7600

SHA1
5a9bdf6cc950a60ee56896aca2fb60a62dc5c796

SHA256
e6297d7c8251af1ae551396f66077c3e41d1e19c961fc235324e2a9583f55ad6

SHA512
ded3967e2a924a7ab86659bd0c10f1af1bb2b7999e91d1ccd43f400ffd9d91c05b231ab634cccae781a55f98d0f452a8bb962111d7832c983c612b1594a9e349

Download Submit
\Windows\SysWOW64\nethtsrv.exe
Filesize
176KB

MD5
fc06aa84d4a5042bc80baedd9640c4e6

SHA1
88127dc35e0d1c79094eab6c35d14c4829e0847a

SHA256
4f29ce723a12df0133279d1938304c7fa732ab8c431d6cee614f0962bf8884e0

SHA512
757f16add8b4b3b81e408646235e02dcc4363279eeaa817edad81521527fbb7427a8688d501868fbcc83fc9feb5a27d6486bc4b7db4c67ed8f536dc11df32c64

Download Submit
\Windows\SysWOW64\netupdsrv.exe
Filesize
158KB

MD5
5b704966f578995082fafb825838d17f

SHA1
d3644b48d9729515e4c3de0b88b85227988ea313

SHA256
3bbf4450e75b3f7fa2af37fc54502de3bae18717fb90ee92debe1d30a0e19ea5

SHA512
c67e6ec4f3ba18ab985b36f9dcf8492bc12b25e5c27bad1966bdca290ae26eedce6f476cd8d35a557d508f939e7a6a1b681bda44ed04d943d200a6a4aec09575

Download Submit
memory/824-76-0x0000000000000000-mapping.dmp

Download
memory/972-87-0x0000000000000000-mapping.dmp

Download
memory/1104-62-0x0000000000000000-mapping.dmp

Download
memory/1204-58-0x0000000000000000-mapping.dmp

Download
memory/1380-81-0x0000000000000000-mapping.dmp

Download
memory/1424-54-0x0000000076151000-0x0000000076153000-memory.dmp

Filesize
8KB

Download
memory/1424-55-0x0000000000360000-0x00000000007BE000-memory.dmp

Filesize
4.4MB

Download
memory/1424-90-0x0000000000360000-0x00000000007BE000-memory.dmp

Filesize
4.4MB

Download
memory/1488-80-0x0000000000000000-mapping.dmp

Download
memory/1516-86-0x0000000000000000-mapping.dmp

Download
memory/1528-59-0x0000000000000000-mapping.dmp

Download
memory/1540-61-0x0000000000000000-mapping.dmp

Download
memory/1644-70-0x0000000000000000-mapping.dmp

Download
memory/1800-64-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads