6e526ca298a8b562b009f68ea6a02165a6b1088b42bd4d0acd4349f68c241d67

Analysis

max time kernel
36s
max time network
42s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
23-11-2022 10:23

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6e526ca298a8b562b009f68ea6a02165a6b1088b42bd4d0acd4349f68c241d67.exe
Size

600KB
MD5

cac5b37f8b4b39fc535646ae54a3edef
SHA1

71b0c190b9ab2642d2ee5ab4641d92ac26efdd0f
SHA256

6e526ca298a8b562b009f68ea6a02165a6b1088b42bd4d0acd4349f68c241d67
SHA512

c585ec7511f4ddf0c82d4600df4645dca053eca628dee50cbe48f6620e9b2aea97d01c234bc9f456239bb3664a8f2185e18c8169af4cf7a168ad474a1f2be81d
SSDEEP

12288:pIny5DYTOsWb79oS8P6g0B0oPVXp6j2a/JC:FUTOsWbQCvXgj

Score

8^/10

discovery

Malware Config

Signatures

Drops file in Drivers directory 1 IoCs

Processes:

6e526ca298a8b562b009f68ea6a02165a6b1088b42bd4d0acd4349f68c241d67.exe

description ioc process

File created C:\Windows\system32\drivers\nethfdrv.sys 6e526ca298a8b562b009f68ea6a02165a6b1088b42bd4d0acd4349f68c241d67.exe
Executes dropped EXE 5 IoCs

Processes:

installd.exenethtsrv.exenetupdsrv.exenethtsrv.exenetupdsrv.exe

pid process

1444 installd.exe
1352 nethtsrv.exe
276 netupdsrv.exe
2024 nethtsrv.exe
1668 netupdsrv.exe

description	ioc	process
File created	C:\Windows\system32\drivers\nethfdrv.sys	6e526ca298a8b562b009f68ea6a02165a6b1088b42bd4d0acd4349f68c241d67.exe

pid	process
1444	installd.exe
1352	nethtsrv.exe
276	netupdsrv.exe
2024	nethtsrv.exe
1668	netupdsrv.exe

Loads dropped DLL 13 IoCs

Processes:

6e526ca298a8b562b009f68ea6a02165a6b1088b42bd4d0acd4349f68c241d67.exeinstalld.exenethtsrv.exenethtsrv.exe

pid	process
784	6e526ca298a8b562b009f68ea6a02165a6b1088b42bd4d0acd4349f68c241d67.exe
784	6e526ca298a8b562b009f68ea6a02165a6b1088b42bd4d0acd4349f68c241d67.exe
784	6e526ca298a8b562b009f68ea6a02165a6b1088b42bd4d0acd4349f68c241d67.exe
784	6e526ca298a8b562b009f68ea6a02165a6b1088b42bd4d0acd4349f68c241d67.exe
1444	installd.exe
784	6e526ca298a8b562b009f68ea6a02165a6b1088b42bd4d0acd4349f68c241d67.exe
1352	nethtsrv.exe
1352	nethtsrv.exe
784	6e526ca298a8b562b009f68ea6a02165a6b1088b42bd4d0acd4349f68c241d67.exe
784	6e526ca298a8b562b009f68ea6a02165a6b1088b42bd4d0acd4349f68c241d67.exe
2024	nethtsrv.exe
2024	nethtsrv.exe
784	6e526ca298a8b562b009f68ea6a02165a6b1088b42bd4d0acd4349f68c241d67.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in System32 directory 5 IoCs

Processes:

6e526ca298a8b562b009f68ea6a02165a6b1088b42bd4d0acd4349f68c241d67.exe

description	ioc	process
File created	C:\Windows\SysWOW64\hfnapi.dll	6e526ca298a8b562b009f68ea6a02165a6b1088b42bd4d0acd4349f68c241d67.exe
File created	C:\Windows\SysWOW64\hfpapi.dll	6e526ca298a8b562b009f68ea6a02165a6b1088b42bd4d0acd4349f68c241d67.exe
File created	C:\Windows\SysWOW64\installd.exe	6e526ca298a8b562b009f68ea6a02165a6b1088b42bd4d0acd4349f68c241d67.exe
File created	C:\Windows\SysWOW64\nethtsrv.exe	6e526ca298a8b562b009f68ea6a02165a6b1088b42bd4d0acd4349f68c241d67.exe
File created	C:\Windows\SysWOW64\netupdsrv.exe	6e526ca298a8b562b009f68ea6a02165a6b1088b42bd4d0acd4349f68c241d67.exe

Drops file in Program Files directory 3 IoCs

Processes:

6e526ca298a8b562b009f68ea6a02165a6b1088b42bd4d0acd4349f68c241d67.exe

description	ioc	process
File created	C:\Program Files (x86)\Common Files\Config\data.xml	6e526ca298a8b562b009f68ea6a02165a6b1088b42bd4d0acd4349f68c241d67.exe
File created	C:\Program Files (x86)\Common Files\Config\ver.xml	6e526ca298a8b562b009f68ea6a02165a6b1088b42bd4d0acd4349f68c241d67.exe
File created	C:\Program Files (x86)\Common Files\config\uninstinethnfd.exe	6e526ca298a8b562b009f68ea6a02165a6b1088b42bd4d0acd4349f68c241d67.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Runs net.exe
Suspicious behavior: LoadsDriver 1 IoCs

Processes:

pid process

460
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

nethtsrv.exe

description pid process

Token: SeDebugPrivilege 2024 nethtsrv.exe

pid	process
460

description	pid	process
Token: SeDebugPrivilege	2024	nethtsrv.exe

Suspicious use of WriteProcessMemory 50 IoCs

Processes:

6e526ca298a8b562b009f68ea6a02165a6b1088b42bd4d0acd4349f68c241d67.exenet.exenet.exenet.exenet.exe

description	pid	process	target process
PID 784 wrote to memory of 2004	784	6e526ca298a8b562b009f68ea6a02165a6b1088b42bd4d0acd4349f68c241d67.exe	net.exe
PID 784 wrote to memory of 2004	784	6e526ca298a8b562b009f68ea6a02165a6b1088b42bd4d0acd4349f68c241d67.exe	net.exe
PID 784 wrote to memory of 2004	784	6e526ca298a8b562b009f68ea6a02165a6b1088b42bd4d0acd4349f68c241d67.exe	net.exe
PID 784 wrote to memory of 2004	784	6e526ca298a8b562b009f68ea6a02165a6b1088b42bd4d0acd4349f68c241d67.exe	net.exe
PID 2004 wrote to memory of 1268	2004	net.exe	net1.exe
PID 2004 wrote to memory of 1268	2004	net.exe	net1.exe
PID 2004 wrote to memory of 1268	2004	net.exe	net1.exe
PID 2004 wrote to memory of 1268	2004	net.exe	net1.exe
PID 784 wrote to memory of 940	784	6e526ca298a8b562b009f68ea6a02165a6b1088b42bd4d0acd4349f68c241d67.exe	net.exe
PID 784 wrote to memory of 940	784	6e526ca298a8b562b009f68ea6a02165a6b1088b42bd4d0acd4349f68c241d67.exe	net.exe
PID 784 wrote to memory of 940	784	6e526ca298a8b562b009f68ea6a02165a6b1088b42bd4d0acd4349f68c241d67.exe	net.exe
PID 784 wrote to memory of 940	784	6e526ca298a8b562b009f68ea6a02165a6b1088b42bd4d0acd4349f68c241d67.exe	net.exe
PID 940 wrote to memory of 1732	940	net.exe	net1.exe
PID 940 wrote to memory of 1732	940	net.exe	net1.exe
PID 940 wrote to memory of 1732	940	net.exe	net1.exe
PID 940 wrote to memory of 1732	940	net.exe	net1.exe
PID 784 wrote to memory of 1444	784	6e526ca298a8b562b009f68ea6a02165a6b1088b42bd4d0acd4349f68c241d67.exe	installd.exe
PID 784 wrote to memory of 1444	784	6e526ca298a8b562b009f68ea6a02165a6b1088b42bd4d0acd4349f68c241d67.exe	installd.exe
PID 784 wrote to memory of 1444	784	6e526ca298a8b562b009f68ea6a02165a6b1088b42bd4d0acd4349f68c241d67.exe	installd.exe
PID 784 wrote to memory of 1444	784	6e526ca298a8b562b009f68ea6a02165a6b1088b42bd4d0acd4349f68c241d67.exe	installd.exe
PID 784 wrote to memory of 1444	784	6e526ca298a8b562b009f68ea6a02165a6b1088b42bd4d0acd4349f68c241d67.exe	installd.exe
PID 784 wrote to memory of 1444	784	6e526ca298a8b562b009f68ea6a02165a6b1088b42bd4d0acd4349f68c241d67.exe	installd.exe
PID 784 wrote to memory of 1444	784	6e526ca298a8b562b009f68ea6a02165a6b1088b42bd4d0acd4349f68c241d67.exe	installd.exe
PID 784 wrote to memory of 1352	784	6e526ca298a8b562b009f68ea6a02165a6b1088b42bd4d0acd4349f68c241d67.exe	nethtsrv.exe
PID 784 wrote to memory of 1352	784	6e526ca298a8b562b009f68ea6a02165a6b1088b42bd4d0acd4349f68c241d67.exe	nethtsrv.exe
PID 784 wrote to memory of 1352	784	6e526ca298a8b562b009f68ea6a02165a6b1088b42bd4d0acd4349f68c241d67.exe	nethtsrv.exe
PID 784 wrote to memory of 1352	784	6e526ca298a8b562b009f68ea6a02165a6b1088b42bd4d0acd4349f68c241d67.exe	nethtsrv.exe
PID 784 wrote to memory of 276	784	6e526ca298a8b562b009f68ea6a02165a6b1088b42bd4d0acd4349f68c241d67.exe	netupdsrv.exe
PID 784 wrote to memory of 276	784	6e526ca298a8b562b009f68ea6a02165a6b1088b42bd4d0acd4349f68c241d67.exe	netupdsrv.exe
PID 784 wrote to memory of 276	784	6e526ca298a8b562b009f68ea6a02165a6b1088b42bd4d0acd4349f68c241d67.exe	netupdsrv.exe
PID 784 wrote to memory of 276	784	6e526ca298a8b562b009f68ea6a02165a6b1088b42bd4d0acd4349f68c241d67.exe	netupdsrv.exe
PID 784 wrote to memory of 276	784	6e526ca298a8b562b009f68ea6a02165a6b1088b42bd4d0acd4349f68c241d67.exe	netupdsrv.exe
PID 784 wrote to memory of 276	784	6e526ca298a8b562b009f68ea6a02165a6b1088b42bd4d0acd4349f68c241d67.exe	netupdsrv.exe
PID 784 wrote to memory of 276	784	6e526ca298a8b562b009f68ea6a02165a6b1088b42bd4d0acd4349f68c241d67.exe	netupdsrv.exe
PID 784 wrote to memory of 1144	784	6e526ca298a8b562b009f68ea6a02165a6b1088b42bd4d0acd4349f68c241d67.exe	net.exe
PID 784 wrote to memory of 1144	784	6e526ca298a8b562b009f68ea6a02165a6b1088b42bd4d0acd4349f68c241d67.exe	net.exe
PID 784 wrote to memory of 1144	784	6e526ca298a8b562b009f68ea6a02165a6b1088b42bd4d0acd4349f68c241d67.exe	net.exe
PID 784 wrote to memory of 1144	784	6e526ca298a8b562b009f68ea6a02165a6b1088b42bd4d0acd4349f68c241d67.exe	net.exe
PID 1144 wrote to memory of 832	1144	net.exe	net1.exe
PID 1144 wrote to memory of 832	1144	net.exe	net1.exe
PID 1144 wrote to memory of 832	1144	net.exe	net1.exe
PID 1144 wrote to memory of 832	1144	net.exe	net1.exe
PID 784 wrote to memory of 1968	784	6e526ca298a8b562b009f68ea6a02165a6b1088b42bd4d0acd4349f68c241d67.exe	net.exe
PID 784 wrote to memory of 1968	784	6e526ca298a8b562b009f68ea6a02165a6b1088b42bd4d0acd4349f68c241d67.exe	net.exe
PID 784 wrote to memory of 1968	784	6e526ca298a8b562b009f68ea6a02165a6b1088b42bd4d0acd4349f68c241d67.exe	net.exe
PID 784 wrote to memory of 1968	784	6e526ca298a8b562b009f68ea6a02165a6b1088b42bd4d0acd4349f68c241d67.exe	net.exe
PID 1968 wrote to memory of 944	1968	net.exe	net1.exe
PID 1968 wrote to memory of 944	1968	net.exe	net1.exe
PID 1968 wrote to memory of 944	1968	net.exe	net1.exe
PID 1968 wrote to memory of 944	1968	net.exe	net1.exe

C:\Users\Admin\AppData\Local\Temp\6e526ca298a8b562b009f68ea6a02165a6b1088b42bd4d0acd4349f68c241d67.exe
"C:\Users\Admin\AppData\Local\Temp\6e526ca298a8b562b009f68ea6a02165a6b1088b42bd4d0acd4349f68c241d67.exe"
1⤵
- Drops file in Drivers directory
- Loads dropped DLL
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:784

C:\Windows\SysWOW64\net.exe
net stop nethttpservice
2⤵
- Suspicious use of WriteProcessMemory
PID:2004

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop nethttpservice
3⤵
PID:1268

C:\Windows\SysWOW64\net.exe
net stop serviceupdater
2⤵
- Suspicious use of WriteProcessMemory
PID:940

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop serviceupdater
3⤵
PID:1732

C:\Windows\SysWOW64\installd.exe
"C:\Windows\system32\installd.exe" nethfdrv
2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1444

C:\Windows\SysWOW64\nethtsrv.exe
"C:\Windows\system32\nethtsrv.exe" -nfdi
2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1352

C:\Windows\SysWOW64\netupdsrv.exe
"C:\Windows\system32\netupdsrv.exe" -nfdi
2⤵
- Executes dropped EXE
PID:276

C:\Windows\SysWOW64\net.exe
net start nethttpservice
2⤵
- Suspicious use of WriteProcessMemory
PID:1144

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 start nethttpservice
3⤵
PID:832

C:\Windows\SysWOW64\net.exe
net start serviceupdater
2⤵
- Suspicious use of WriteProcessMemory
PID:1968

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 start serviceupdater
3⤵
PID:944

C:\Windows\SysWOW64\nethtsrv.exe
C:\Windows\SysWOW64\nethtsrv.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:2024

C:\Windows\SysWOW64\netupdsrv.exe
C:\Windows\SysWOW64\netupdsrv.exe
1⤵
- Executes dropped EXE
PID:1668

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\hfnapi.dll
Filesize
106KB

MD5
97642619a66d1a062488a33c2427b657

SHA1
a8165fe4d1e4bd3ccc739f3a32479e63d6b8dbe1

SHA256
fa753ab4114abb4dff327e2257cbac20ad8164a9283044bc288f906225179122

SHA512
e3dd76ea7dfa40dec02010ba81139bbc47509dc9fda239bf06109174a4503581e35fbf4ad49836bb7e879f9b2362ab85ec1ed97b44d629e6109bfe41d5cfa3ac

Download Submit
C:\Windows\SysWOW64\hfpapi.dll
Filesize
244KB

MD5
3c1c6b09535c8d9a4364f74bb7ba771d

SHA1
3e18240fa2c4e5c76f61b53ed8647098c8d40cae

SHA256
bbe1e87979accd7d55a55b59e2407ed92834bf970c5ae1d60d29e8b68e3b015c

SHA512
274bd6cf17130977b286245e13e85ca59435e6717349ca51a2c24d07144faa75f64c1044f75f4a000ec0ec6cb6b51b719568af63b9101c0ba5972bcea0cdcf54

Download Submit
C:\Windows\SysWOW64\installd.exe
Filesize
108KB

MD5
2e3916d6b44bcd024ae6b0c934e17783

SHA1
0029841c18a046fbe0fcd7b61d8bbd204fa5f4ec

SHA256
c975040c2b5c8472c69908a8199861834ee55526921accd07abb3319757f835b

SHA512
2cf022a4fc0cb963b891fb081b92228e10092ce91936715e6db49202cd078423601cc58192ef22a4d4d944140eb7f882993238f3eecc0b60943806c1b1de888e

Download Submit
C:\Windows\SysWOW64\nethtsrv.exe
Filesize
176KB

MD5
48d77ec3ceb00826730e2c61037a2a37

SHA1
2c48d686f061fe4d4c8a1c9d8297a566b16f1fc9

SHA256
90f1377b178752d28f352cd08c405d36546a6b3f990e9791200d92ea56c364af

SHA512
6c8d8cc64fa1d3dbf0294a9a958f6449040fc0d9261d91a64801f4d7c3985c7be521867b0fbfd681e2433b1dca19b2f4f3d787ec438ca007f4856ae742c0f4cb

Download Submit
C:\Windows\SysWOW64\nethtsrv.exe
Filesize
176KB

MD5
48d77ec3ceb00826730e2c61037a2a37

SHA1
2c48d686f061fe4d4c8a1c9d8297a566b16f1fc9

SHA256
90f1377b178752d28f352cd08c405d36546a6b3f990e9791200d92ea56c364af

SHA512
6c8d8cc64fa1d3dbf0294a9a958f6449040fc0d9261d91a64801f4d7c3985c7be521867b0fbfd681e2433b1dca19b2f4f3d787ec438ca007f4856ae742c0f4cb

Download Submit
C:\Windows\SysWOW64\netupdsrv.exe
Filesize
158KB

MD5
30ec4d0b8c7d516328c0f5fac60c70fc

SHA1
34c08d68b2a6eb8045e36dc02e2cd7306a7c48a3

SHA256
8f4c1b3d4434fb7f544d6a14fff4dbd45203a952e016e9778a2c95ce3e23b253

SHA512
85950b2fca92c9134e3a756220083ef3aa3d62c113ea3db69c683bcb747915f6751dfd199dcce1cde6c4cd90bddd436b3c420be6c201141cc4df0c1de983e11d

Download Submit
C:\Windows\SysWOW64\netupdsrv.exe
Filesize
158KB

MD5
30ec4d0b8c7d516328c0f5fac60c70fc

SHA1
34c08d68b2a6eb8045e36dc02e2cd7306a7c48a3

SHA256
8f4c1b3d4434fb7f544d6a14fff4dbd45203a952e016e9778a2c95ce3e23b253

SHA512
85950b2fca92c9134e3a756220083ef3aa3d62c113ea3db69c683bcb747915f6751dfd199dcce1cde6c4cd90bddd436b3c420be6c201141cc4df0c1de983e11d

Download Submit
\Users\Admin\AppData\Local\Temp\nsd76E7.tmp\System.dll
Filesize
11KB

MD5
c17103ae9072a06da581dec998343fc1

SHA1
b72148c6bdfaada8b8c3f950e610ee7cf1da1f8d

SHA256
dc58d8ad81cacb0c1ed72e33bff8f23ea40b5252b5bb55d393a0903e6819ae2f

SHA512
d32a71aaef18e993f28096d536e41c4d016850721b31171513ce28bbd805a54fd290b7c3e9d935f72e676a1acfb4f0dcc89d95040a0dd29f2b6975855c18986f

Download Submit
\Users\Admin\AppData\Local\Temp\nsd76E7.tmp\nsExec.dll
Filesize
6KB

MD5
acc2b699edfea5bf5aae45aba3a41e96

SHA1
d2accf4d494e43ceb2cff69abe4dd17147d29cc2

SHA256
168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e

SHA512
e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe

Download Submit
\Users\Admin\AppData\Local\Temp\nsd76E7.tmp\nsExec.dll
Filesize
6KB

MD5
acc2b699edfea5bf5aae45aba3a41e96

SHA1
d2accf4d494e43ceb2cff69abe4dd17147d29cc2

SHA256
168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e

SHA512
e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe

Download Submit
\Users\Admin\AppData\Local\Temp\nsd76E7.tmp\nsExec.dll
Filesize
6KB

MD5
acc2b699edfea5bf5aae45aba3a41e96

SHA1
d2accf4d494e43ceb2cff69abe4dd17147d29cc2

SHA256
168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e

SHA512
e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe

Download Submit
\Users\Admin\AppData\Local\Temp\nsd76E7.tmp\nsExec.dll
Filesize
6KB

MD5
acc2b699edfea5bf5aae45aba3a41e96

SHA1
d2accf4d494e43ceb2cff69abe4dd17147d29cc2

SHA256
168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e

SHA512
e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe

Download Submit
\Windows\SysWOW64\hfnapi.dll
Filesize
106KB

MD5
97642619a66d1a062488a33c2427b657

SHA1
a8165fe4d1e4bd3ccc739f3a32479e63d6b8dbe1

SHA256
fa753ab4114abb4dff327e2257cbac20ad8164a9283044bc288f906225179122

SHA512
e3dd76ea7dfa40dec02010ba81139bbc47509dc9fda239bf06109174a4503581e35fbf4ad49836bb7e879f9b2362ab85ec1ed97b44d629e6109bfe41d5cfa3ac

Download Submit
\Windows\SysWOW64\hfnapi.dll
Filesize
106KB

MD5
97642619a66d1a062488a33c2427b657

SHA1
a8165fe4d1e4bd3ccc739f3a32479e63d6b8dbe1

SHA256
fa753ab4114abb4dff327e2257cbac20ad8164a9283044bc288f906225179122

SHA512
e3dd76ea7dfa40dec02010ba81139bbc47509dc9fda239bf06109174a4503581e35fbf4ad49836bb7e879f9b2362ab85ec1ed97b44d629e6109bfe41d5cfa3ac

Download Submit
\Windows\SysWOW64\hfnapi.dll
Filesize
106KB

MD5
97642619a66d1a062488a33c2427b657

SHA1
a8165fe4d1e4bd3ccc739f3a32479e63d6b8dbe1

SHA256
fa753ab4114abb4dff327e2257cbac20ad8164a9283044bc288f906225179122

SHA512
e3dd76ea7dfa40dec02010ba81139bbc47509dc9fda239bf06109174a4503581e35fbf4ad49836bb7e879f9b2362ab85ec1ed97b44d629e6109bfe41d5cfa3ac

Download Submit
\Windows\SysWOW64\hfpapi.dll
Filesize
244KB

MD5
3c1c6b09535c8d9a4364f74bb7ba771d

SHA1
3e18240fa2c4e5c76f61b53ed8647098c8d40cae

SHA256
bbe1e87979accd7d55a55b59e2407ed92834bf970c5ae1d60d29e8b68e3b015c

SHA512
274bd6cf17130977b286245e13e85ca59435e6717349ca51a2c24d07144faa75f64c1044f75f4a000ec0ec6cb6b51b719568af63b9101c0ba5972bcea0cdcf54

Download Submit
\Windows\SysWOW64\hfpapi.dll
Filesize
244KB

MD5
3c1c6b09535c8d9a4364f74bb7ba771d

SHA1
3e18240fa2c4e5c76f61b53ed8647098c8d40cae

SHA256
bbe1e87979accd7d55a55b59e2407ed92834bf970c5ae1d60d29e8b68e3b015c

SHA512
274bd6cf17130977b286245e13e85ca59435e6717349ca51a2c24d07144faa75f64c1044f75f4a000ec0ec6cb6b51b719568af63b9101c0ba5972bcea0cdcf54

Download Submit
\Windows\SysWOW64\installd.exe
Filesize
108KB

MD5
2e3916d6b44bcd024ae6b0c934e17783

SHA1
0029841c18a046fbe0fcd7b61d8bbd204fa5f4ec

SHA256
c975040c2b5c8472c69908a8199861834ee55526921accd07abb3319757f835b

SHA512
2cf022a4fc0cb963b891fb081b92228e10092ce91936715e6db49202cd078423601cc58192ef22a4d4d944140eb7f882993238f3eecc0b60943806c1b1de888e

Download Submit
\Windows\SysWOW64\nethtsrv.exe
Filesize
176KB

MD5
48d77ec3ceb00826730e2c61037a2a37

SHA1
2c48d686f061fe4d4c8a1c9d8297a566b16f1fc9

SHA256
90f1377b178752d28f352cd08c405d36546a6b3f990e9791200d92ea56c364af

SHA512
6c8d8cc64fa1d3dbf0294a9a958f6449040fc0d9261d91a64801f4d7c3985c7be521867b0fbfd681e2433b1dca19b2f4f3d787ec438ca007f4856ae742c0f4cb

Download Submit
\Windows\SysWOW64\netupdsrv.exe
Filesize
158KB

MD5
30ec4d0b8c7d516328c0f5fac60c70fc

SHA1
34c08d68b2a6eb8045e36dc02e2cd7306a7c48a3

SHA256
8f4c1b3d4434fb7f544d6a14fff4dbd45203a952e016e9778a2c95ce3e23b253

SHA512
85950b2fca92c9134e3a756220083ef3aa3d62c113ea3db69c683bcb747915f6751dfd199dcce1cde6c4cd90bddd436b3c420be6c201141cc4df0c1de983e11d

Download Submit
memory/276-76-0x0000000000000000-mapping.dmp

Download
memory/784-90-0x0000000000360000-0x00000000007BE000-memory.dmp

Filesize
4.4MB

Download
memory/784-54-0x0000000075FC1000-0x0000000075FC3000-memory.dmp

Filesize
8KB

Download
memory/784-59-0x0000000000360000-0x00000000007BE000-memory.dmp

Filesize
4.4MB

Download
memory/832-81-0x0000000000000000-mapping.dmp

Download
memory/940-61-0x0000000000000000-mapping.dmp

Download
memory/944-87-0x0000000000000000-mapping.dmp

Download
memory/1144-80-0x0000000000000000-mapping.dmp

Download
memory/1268-58-0x0000000000000000-mapping.dmp

Download
memory/1352-70-0x0000000000000000-mapping.dmp

Download
memory/1444-64-0x0000000000000000-mapping.dmp

Download
memory/1732-62-0x0000000000000000-mapping.dmp

Download
memory/1968-86-0x0000000000000000-mapping.dmp

Download
memory/2004-57-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads