6dc7c41015574b5c5f0ff0575b487cf3e495c97b5ed812eb6175c640d35f5a21

Analysis

max time kernel
48s
max time network
49s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
23-11-2022 10:23

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6dc7c41015574b5c5f0ff0575b487cf3e495c97b5ed812eb6175c640d35f5a21.exe
Size

603KB
MD5

915812aeb863fd51f765914ae83693ea
SHA1

7c62b052e9ebb250029c0d217b8652df205ab288
SHA256

6dc7c41015574b5c5f0ff0575b487cf3e495c97b5ed812eb6175c640d35f5a21
SHA512

a5f008af6c83c7b2e69ecef86468a4a22f1cd30fd0e16c938ba6637c6acc1b7df1aa9420761f6a741a0ae41dc3f969047985b191bea3da055ab3dcd62a1affdc
SSDEEP

12288:uIny5DYTmIHqEF+CcQk8YlRGQ2hSPyby3+04m8QF+WHF0Yw:wUTmgqBClk/lRhPwy3+0plF0Y

Score

8^/10

discovery

Malware Config

Signatures

Drops file in Drivers directory 1 IoCs

Processes:

6dc7c41015574b5c5f0ff0575b487cf3e495c97b5ed812eb6175c640d35f5a21.exe

description ioc process

File created C:\Windows\system32\drivers\nethfdrv.sys 6dc7c41015574b5c5f0ff0575b487cf3e495c97b5ed812eb6175c640d35f5a21.exe
Executes dropped EXE 5 IoCs

Processes:

installd.exenethtsrv.exenetupdsrv.exenethtsrv.exenetupdsrv.exe

pid process

2044 installd.exe
820 nethtsrv.exe
1328 netupdsrv.exe
288 nethtsrv.exe
1136 netupdsrv.exe

description	ioc	process
File created	C:\Windows\system32\drivers\nethfdrv.sys	6dc7c41015574b5c5f0ff0575b487cf3e495c97b5ed812eb6175c640d35f5a21.exe

pid	process
2044	installd.exe
820	nethtsrv.exe
1328	netupdsrv.exe
288	nethtsrv.exe
1136	netupdsrv.exe

Loads dropped DLL 13 IoCs

Processes:

6dc7c41015574b5c5f0ff0575b487cf3e495c97b5ed812eb6175c640d35f5a21.exeinstalld.exenethtsrv.exenethtsrv.exe

pid	process
940	6dc7c41015574b5c5f0ff0575b487cf3e495c97b5ed812eb6175c640d35f5a21.exe
940	6dc7c41015574b5c5f0ff0575b487cf3e495c97b5ed812eb6175c640d35f5a21.exe
940	6dc7c41015574b5c5f0ff0575b487cf3e495c97b5ed812eb6175c640d35f5a21.exe
940	6dc7c41015574b5c5f0ff0575b487cf3e495c97b5ed812eb6175c640d35f5a21.exe
2044	installd.exe
940	6dc7c41015574b5c5f0ff0575b487cf3e495c97b5ed812eb6175c640d35f5a21.exe
820	nethtsrv.exe
820	nethtsrv.exe
940	6dc7c41015574b5c5f0ff0575b487cf3e495c97b5ed812eb6175c640d35f5a21.exe
940	6dc7c41015574b5c5f0ff0575b487cf3e495c97b5ed812eb6175c640d35f5a21.exe
288	nethtsrv.exe
288	nethtsrv.exe
940	6dc7c41015574b5c5f0ff0575b487cf3e495c97b5ed812eb6175c640d35f5a21.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in System32 directory 5 IoCs

Processes:

6dc7c41015574b5c5f0ff0575b487cf3e495c97b5ed812eb6175c640d35f5a21.exe

description	ioc	process
File created	C:\Windows\SysWOW64\nethtsrv.exe	6dc7c41015574b5c5f0ff0575b487cf3e495c97b5ed812eb6175c640d35f5a21.exe
File created	C:\Windows\SysWOW64\netupdsrv.exe	6dc7c41015574b5c5f0ff0575b487cf3e495c97b5ed812eb6175c640d35f5a21.exe
File created	C:\Windows\SysWOW64\hfnapi.dll	6dc7c41015574b5c5f0ff0575b487cf3e495c97b5ed812eb6175c640d35f5a21.exe
File created	C:\Windows\SysWOW64\hfpapi.dll	6dc7c41015574b5c5f0ff0575b487cf3e495c97b5ed812eb6175c640d35f5a21.exe
File created	C:\Windows\SysWOW64\installd.exe	6dc7c41015574b5c5f0ff0575b487cf3e495c97b5ed812eb6175c640d35f5a21.exe

Drops file in Program Files directory 3 IoCs

Processes:

6dc7c41015574b5c5f0ff0575b487cf3e495c97b5ed812eb6175c640d35f5a21.exe

description	ioc	process
File created	C:\Program Files (x86)\Common Files\Config\data.xml	6dc7c41015574b5c5f0ff0575b487cf3e495c97b5ed812eb6175c640d35f5a21.exe
File created	C:\Program Files (x86)\Common Files\Config\ver.xml	6dc7c41015574b5c5f0ff0575b487cf3e495c97b5ed812eb6175c640d35f5a21.exe
File created	C:\Program Files (x86)\Common Files\config\uninstinethnfd.exe	6dc7c41015574b5c5f0ff0575b487cf3e495c97b5ed812eb6175c640d35f5a21.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Runs net.exe
Suspicious behavior: LoadsDriver 1 IoCs

Processes:

pid process

460
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

nethtsrv.exe

description pid process

Token: SeDebugPrivilege 288 nethtsrv.exe

pid	process
460

description	pid	process
Token: SeDebugPrivilege	288	nethtsrv.exe

Suspicious use of WriteProcessMemory 50 IoCs

Processes:

6dc7c41015574b5c5f0ff0575b487cf3e495c97b5ed812eb6175c640d35f5a21.exenet.exenet.exenet.exenet.exe

description	pid	process	target process
PID 940 wrote to memory of 1232	940	6dc7c41015574b5c5f0ff0575b487cf3e495c97b5ed812eb6175c640d35f5a21.exe	net.exe
PID 940 wrote to memory of 1232	940	6dc7c41015574b5c5f0ff0575b487cf3e495c97b5ed812eb6175c640d35f5a21.exe	net.exe
PID 940 wrote to memory of 1232	940	6dc7c41015574b5c5f0ff0575b487cf3e495c97b5ed812eb6175c640d35f5a21.exe	net.exe
PID 940 wrote to memory of 1232	940	6dc7c41015574b5c5f0ff0575b487cf3e495c97b5ed812eb6175c640d35f5a21.exe	net.exe
PID 1232 wrote to memory of 1696	1232	net.exe	net1.exe
PID 1232 wrote to memory of 1696	1232	net.exe	net1.exe
PID 1232 wrote to memory of 1696	1232	net.exe	net1.exe
PID 1232 wrote to memory of 1696	1232	net.exe	net1.exe
PID 940 wrote to memory of 1128	940	6dc7c41015574b5c5f0ff0575b487cf3e495c97b5ed812eb6175c640d35f5a21.exe	net.exe
PID 940 wrote to memory of 1128	940	6dc7c41015574b5c5f0ff0575b487cf3e495c97b5ed812eb6175c640d35f5a21.exe	net.exe
PID 940 wrote to memory of 1128	940	6dc7c41015574b5c5f0ff0575b487cf3e495c97b5ed812eb6175c640d35f5a21.exe	net.exe
PID 940 wrote to memory of 1128	940	6dc7c41015574b5c5f0ff0575b487cf3e495c97b5ed812eb6175c640d35f5a21.exe	net.exe
PID 1128 wrote to memory of 1200	1128	net.exe	net1.exe
PID 1128 wrote to memory of 1200	1128	net.exe	net1.exe
PID 1128 wrote to memory of 1200	1128	net.exe	net1.exe
PID 1128 wrote to memory of 1200	1128	net.exe	net1.exe
PID 940 wrote to memory of 2044	940	6dc7c41015574b5c5f0ff0575b487cf3e495c97b5ed812eb6175c640d35f5a21.exe	installd.exe
PID 940 wrote to memory of 2044	940	6dc7c41015574b5c5f0ff0575b487cf3e495c97b5ed812eb6175c640d35f5a21.exe	installd.exe
PID 940 wrote to memory of 2044	940	6dc7c41015574b5c5f0ff0575b487cf3e495c97b5ed812eb6175c640d35f5a21.exe	installd.exe
PID 940 wrote to memory of 2044	940	6dc7c41015574b5c5f0ff0575b487cf3e495c97b5ed812eb6175c640d35f5a21.exe	installd.exe
PID 940 wrote to memory of 2044	940	6dc7c41015574b5c5f0ff0575b487cf3e495c97b5ed812eb6175c640d35f5a21.exe	installd.exe
PID 940 wrote to memory of 2044	940	6dc7c41015574b5c5f0ff0575b487cf3e495c97b5ed812eb6175c640d35f5a21.exe	installd.exe
PID 940 wrote to memory of 2044	940	6dc7c41015574b5c5f0ff0575b487cf3e495c97b5ed812eb6175c640d35f5a21.exe	installd.exe
PID 940 wrote to memory of 820	940	6dc7c41015574b5c5f0ff0575b487cf3e495c97b5ed812eb6175c640d35f5a21.exe	nethtsrv.exe
PID 940 wrote to memory of 820	940	6dc7c41015574b5c5f0ff0575b487cf3e495c97b5ed812eb6175c640d35f5a21.exe	nethtsrv.exe
PID 940 wrote to memory of 820	940	6dc7c41015574b5c5f0ff0575b487cf3e495c97b5ed812eb6175c640d35f5a21.exe	nethtsrv.exe
PID 940 wrote to memory of 820	940	6dc7c41015574b5c5f0ff0575b487cf3e495c97b5ed812eb6175c640d35f5a21.exe	nethtsrv.exe
PID 940 wrote to memory of 1328	940	6dc7c41015574b5c5f0ff0575b487cf3e495c97b5ed812eb6175c640d35f5a21.exe	netupdsrv.exe
PID 940 wrote to memory of 1328	940	6dc7c41015574b5c5f0ff0575b487cf3e495c97b5ed812eb6175c640d35f5a21.exe	netupdsrv.exe
PID 940 wrote to memory of 1328	940	6dc7c41015574b5c5f0ff0575b487cf3e495c97b5ed812eb6175c640d35f5a21.exe	netupdsrv.exe
PID 940 wrote to memory of 1328	940	6dc7c41015574b5c5f0ff0575b487cf3e495c97b5ed812eb6175c640d35f5a21.exe	netupdsrv.exe
PID 940 wrote to memory of 1328	940	6dc7c41015574b5c5f0ff0575b487cf3e495c97b5ed812eb6175c640d35f5a21.exe	netupdsrv.exe
PID 940 wrote to memory of 1328	940	6dc7c41015574b5c5f0ff0575b487cf3e495c97b5ed812eb6175c640d35f5a21.exe	netupdsrv.exe
PID 940 wrote to memory of 1328	940	6dc7c41015574b5c5f0ff0575b487cf3e495c97b5ed812eb6175c640d35f5a21.exe	netupdsrv.exe
PID 940 wrote to memory of 1964	940	6dc7c41015574b5c5f0ff0575b487cf3e495c97b5ed812eb6175c640d35f5a21.exe	net.exe
PID 940 wrote to memory of 1964	940	6dc7c41015574b5c5f0ff0575b487cf3e495c97b5ed812eb6175c640d35f5a21.exe	net.exe
PID 940 wrote to memory of 1964	940	6dc7c41015574b5c5f0ff0575b487cf3e495c97b5ed812eb6175c640d35f5a21.exe	net.exe
PID 940 wrote to memory of 1964	940	6dc7c41015574b5c5f0ff0575b487cf3e495c97b5ed812eb6175c640d35f5a21.exe	net.exe
PID 1964 wrote to memory of 1580	1964	net.exe	net1.exe
PID 1964 wrote to memory of 1580	1964	net.exe	net1.exe
PID 1964 wrote to memory of 1580	1964	net.exe	net1.exe
PID 1964 wrote to memory of 1580	1964	net.exe	net1.exe
PID 940 wrote to memory of 1540	940	6dc7c41015574b5c5f0ff0575b487cf3e495c97b5ed812eb6175c640d35f5a21.exe	net.exe
PID 940 wrote to memory of 1540	940	6dc7c41015574b5c5f0ff0575b487cf3e495c97b5ed812eb6175c640d35f5a21.exe	net.exe
PID 940 wrote to memory of 1540	940	6dc7c41015574b5c5f0ff0575b487cf3e495c97b5ed812eb6175c640d35f5a21.exe	net.exe
PID 940 wrote to memory of 1540	940	6dc7c41015574b5c5f0ff0575b487cf3e495c97b5ed812eb6175c640d35f5a21.exe	net.exe
PID 1540 wrote to memory of 1576	1540	net.exe	net1.exe
PID 1540 wrote to memory of 1576	1540	net.exe	net1.exe
PID 1540 wrote to memory of 1576	1540	net.exe	net1.exe
PID 1540 wrote to memory of 1576	1540	net.exe	net1.exe

C:\Users\Admin\AppData\Local\Temp\6dc7c41015574b5c5f0ff0575b487cf3e495c97b5ed812eb6175c640d35f5a21.exe
"C:\Users\Admin\AppData\Local\Temp\6dc7c41015574b5c5f0ff0575b487cf3e495c97b5ed812eb6175c640d35f5a21.exe"
1⤵
- Drops file in Drivers directory
- Loads dropped DLL
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:940

C:\Windows\SysWOW64\net.exe
net stop nethttpservice
2⤵
- Suspicious use of WriteProcessMemory
PID:1232

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop nethttpservice
3⤵
PID:1696

C:\Windows\SysWOW64\net.exe
net stop serviceupdater
2⤵
- Suspicious use of WriteProcessMemory
PID:1128

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop serviceupdater
3⤵
PID:1200

C:\Windows\SysWOW64\installd.exe
"C:\Windows\system32\installd.exe" nethfdrv
2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2044

C:\Windows\SysWOW64\nethtsrv.exe
"C:\Windows\system32\nethtsrv.exe" -nfdi
2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:820

C:\Windows\SysWOW64\netupdsrv.exe
"C:\Windows\system32\netupdsrv.exe" -nfdi
2⤵
- Executes dropped EXE
PID:1328

C:\Windows\SysWOW64\net.exe
net start nethttpservice
2⤵
- Suspicious use of WriteProcessMemory
PID:1964

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 start nethttpservice
3⤵
PID:1580

C:\Windows\SysWOW64\net.exe
net start serviceupdater
2⤵
- Suspicious use of WriteProcessMemory
PID:1540

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 start serviceupdater
3⤵
PID:1576

C:\Windows\SysWOW64\nethtsrv.exe
C:\Windows\SysWOW64\nethtsrv.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:288

C:\Windows\SysWOW64\netupdsrv.exe
C:\Windows\SysWOW64\netupdsrv.exe
1⤵
- Executes dropped EXE
PID:1136

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\hfnapi.dll
Filesize
106KB

MD5
aea9df13af36216d0280741ca0d57db1

SHA1
e3e1ae737371d225ff29a43d955467e2f3fba12e

SHA256
b8772ccfe53f9af7e28ac521c27ffe725044d8835bd080f8ca26f3ed7718d443

SHA512
a6021479d9dcddcc12a9836c0f3acdaa4b4e36db3ad5ff0a843017c6b31559abe175581855db46910b12c723441ae624379c95772f4c0592ba6f4e6e11c198b2

Download Submit
C:\Windows\SysWOW64\hfpapi.dll
Filesize
244KB

MD5
277816a4822aff3fa61fe058073649ca

SHA1
250230b8edf64bce5bd4a6ac12f5f0ed235389a4

SHA256
498e255ad98122e4d63bd88ac8bd5bbbc4510c05cad71bbb579053d6950a9547

SHA512
de2a40586e4f516d1bbaa2f12d349927dadafcd195f0eef5691c5a3f8fb7aae9f462a1af7fe3ad3636585e0f028be10397ffd013fc3a065c60cde270c6229eb2

Download Submit
C:\Windows\SysWOW64\installd.exe
Filesize
108KB

MD5
68374f30f881cd3cb04654038af50353

SHA1
741576b48b16fed11806b45ef94a1325130dd4f5

SHA256
2fcd0b513fdeef73b24c568572cc230f31a164a3244d9e8777765a1e1ac52a5a

SHA512
214e603447d7b2b9e68d406a59126a82634fbd1293fbce6cdc40402f868f83635c5b960c660321c0c0852cdc45ba96a69242bd7df1febfa4efe385a4ea228f4f

Download Submit
C:\Windows\SysWOW64\nethtsrv.exe
Filesize
176KB

MD5
bb7b11a465ea22a8f4e123fc846e58aa

SHA1
12964724e0a943b88531aeac07fb89e3a13aa1fe

SHA256
fdfa2acb8eafd614e3732a72b3ec24c30137d6e406f6ff5a3f3967868af60ab6

SHA512
b55e5212c3f0d1e60819c75edc1a82b8c37b50da48c5035e46915f00d29cc77e05df97d6b7acb2f8ca3eb6f6bfdb60e377149efee2413d606f463ba54328e2f1

Download Submit
C:\Windows\SysWOW64\nethtsrv.exe
Filesize
176KB

MD5
bb7b11a465ea22a8f4e123fc846e58aa

SHA1
12964724e0a943b88531aeac07fb89e3a13aa1fe

SHA256
fdfa2acb8eafd614e3732a72b3ec24c30137d6e406f6ff5a3f3967868af60ab6

SHA512
b55e5212c3f0d1e60819c75edc1a82b8c37b50da48c5035e46915f00d29cc77e05df97d6b7acb2f8ca3eb6f6bfdb60e377149efee2413d606f463ba54328e2f1

Download Submit
C:\Windows\SysWOW64\netupdsrv.exe
Filesize
159KB

MD5
580b64b00ee9224e3161e75d486cdfff

SHA1
f7e3de5bef75e027a764ee94b3225e78ec88d9ca

SHA256
9070ff2e6f544157af4d0455dbf554a3b578e56ec345ebfe8a51d8bc66025fee

SHA512
eafc0f05b66c2d3af50fac5922553fceea400c24f5b7535bc3c90acb015b9bb9e0d87eca517775e22cde88e9358839789d9c1d4805dd0148c0873f7d773b73f3

Download Submit
C:\Windows\SysWOW64\netupdsrv.exe
Filesize
159KB

MD5
580b64b00ee9224e3161e75d486cdfff

SHA1
f7e3de5bef75e027a764ee94b3225e78ec88d9ca

SHA256
9070ff2e6f544157af4d0455dbf554a3b578e56ec345ebfe8a51d8bc66025fee

SHA512
eafc0f05b66c2d3af50fac5922553fceea400c24f5b7535bc3c90acb015b9bb9e0d87eca517775e22cde88e9358839789d9c1d4805dd0148c0873f7d773b73f3

Download Submit
\Users\Admin\AppData\Local\Temp\nso3334.tmp\System.dll
Filesize
11KB

MD5
c17103ae9072a06da581dec998343fc1

SHA1
b72148c6bdfaada8b8c3f950e610ee7cf1da1f8d

SHA256
dc58d8ad81cacb0c1ed72e33bff8f23ea40b5252b5bb55d393a0903e6819ae2f

SHA512
d32a71aaef18e993f28096d536e41c4d016850721b31171513ce28bbd805a54fd290b7c3e9d935f72e676a1acfb4f0dcc89d95040a0dd29f2b6975855c18986f

Download Submit
\Users\Admin\AppData\Local\Temp\nso3334.tmp\nsExec.dll
Filesize
6KB

MD5
acc2b699edfea5bf5aae45aba3a41e96

SHA1
d2accf4d494e43ceb2cff69abe4dd17147d29cc2

SHA256
168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e

SHA512
e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe

Download Submit
\Users\Admin\AppData\Local\Temp\nso3334.tmp\nsExec.dll
Filesize
6KB

MD5
acc2b699edfea5bf5aae45aba3a41e96

SHA1
d2accf4d494e43ceb2cff69abe4dd17147d29cc2

SHA256
168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e

SHA512
e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe

Download Submit
\Users\Admin\AppData\Local\Temp\nso3334.tmp\nsExec.dll
Filesize
6KB

MD5
acc2b699edfea5bf5aae45aba3a41e96

SHA1
d2accf4d494e43ceb2cff69abe4dd17147d29cc2

SHA256
168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e

SHA512
e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe

Download Submit
\Users\Admin\AppData\Local\Temp\nso3334.tmp\nsExec.dll
Filesize
6KB

MD5
acc2b699edfea5bf5aae45aba3a41e96

SHA1
d2accf4d494e43ceb2cff69abe4dd17147d29cc2

SHA256
168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e

SHA512
e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe

Download Submit
\Windows\SysWOW64\hfnapi.dll
Filesize
106KB

MD5
aea9df13af36216d0280741ca0d57db1

SHA1
e3e1ae737371d225ff29a43d955467e2f3fba12e

SHA256
b8772ccfe53f9af7e28ac521c27ffe725044d8835bd080f8ca26f3ed7718d443

SHA512
a6021479d9dcddcc12a9836c0f3acdaa4b4e36db3ad5ff0a843017c6b31559abe175581855db46910b12c723441ae624379c95772f4c0592ba6f4e6e11c198b2

Download Submit
\Windows\SysWOW64\hfnapi.dll
Filesize
106KB

MD5
aea9df13af36216d0280741ca0d57db1

SHA1
e3e1ae737371d225ff29a43d955467e2f3fba12e

SHA256
b8772ccfe53f9af7e28ac521c27ffe725044d8835bd080f8ca26f3ed7718d443

SHA512
a6021479d9dcddcc12a9836c0f3acdaa4b4e36db3ad5ff0a843017c6b31559abe175581855db46910b12c723441ae624379c95772f4c0592ba6f4e6e11c198b2

Download Submit
\Windows\SysWOW64\hfnapi.dll
Filesize
106KB

MD5
aea9df13af36216d0280741ca0d57db1

SHA1
e3e1ae737371d225ff29a43d955467e2f3fba12e

SHA256
b8772ccfe53f9af7e28ac521c27ffe725044d8835bd080f8ca26f3ed7718d443

SHA512
a6021479d9dcddcc12a9836c0f3acdaa4b4e36db3ad5ff0a843017c6b31559abe175581855db46910b12c723441ae624379c95772f4c0592ba6f4e6e11c198b2

Download Submit
\Windows\SysWOW64\hfpapi.dll
Filesize
244KB

MD5
277816a4822aff3fa61fe058073649ca

SHA1
250230b8edf64bce5bd4a6ac12f5f0ed235389a4

SHA256
498e255ad98122e4d63bd88ac8bd5bbbc4510c05cad71bbb579053d6950a9547

SHA512
de2a40586e4f516d1bbaa2f12d349927dadafcd195f0eef5691c5a3f8fb7aae9f462a1af7fe3ad3636585e0f028be10397ffd013fc3a065c60cde270c6229eb2

Download Submit
\Windows\SysWOW64\hfpapi.dll
Filesize
244KB

MD5
277816a4822aff3fa61fe058073649ca

SHA1
250230b8edf64bce5bd4a6ac12f5f0ed235389a4

SHA256
498e255ad98122e4d63bd88ac8bd5bbbc4510c05cad71bbb579053d6950a9547

SHA512
de2a40586e4f516d1bbaa2f12d349927dadafcd195f0eef5691c5a3f8fb7aae9f462a1af7fe3ad3636585e0f028be10397ffd013fc3a065c60cde270c6229eb2

Download Submit
\Windows\SysWOW64\installd.exe
Filesize
108KB

MD5
68374f30f881cd3cb04654038af50353

SHA1
741576b48b16fed11806b45ef94a1325130dd4f5

SHA256
2fcd0b513fdeef73b24c568572cc230f31a164a3244d9e8777765a1e1ac52a5a

SHA512
214e603447d7b2b9e68d406a59126a82634fbd1293fbce6cdc40402f868f83635c5b960c660321c0c0852cdc45ba96a69242bd7df1febfa4efe385a4ea228f4f

Download Submit
\Windows\SysWOW64\nethtsrv.exe
Filesize
176KB

MD5
bb7b11a465ea22a8f4e123fc846e58aa

SHA1
12964724e0a943b88531aeac07fb89e3a13aa1fe

SHA256
fdfa2acb8eafd614e3732a72b3ec24c30137d6e406f6ff5a3f3967868af60ab6

SHA512
b55e5212c3f0d1e60819c75edc1a82b8c37b50da48c5035e46915f00d29cc77e05df97d6b7acb2f8ca3eb6f6bfdb60e377149efee2413d606f463ba54328e2f1

Download Submit
\Windows\SysWOW64\netupdsrv.exe
Filesize
159KB

MD5
580b64b00ee9224e3161e75d486cdfff

SHA1
f7e3de5bef75e027a764ee94b3225e78ec88d9ca

SHA256
9070ff2e6f544157af4d0455dbf554a3b578e56ec345ebfe8a51d8bc66025fee

SHA512
eafc0f05b66c2d3af50fac5922553fceea400c24f5b7535bc3c90acb015b9bb9e0d87eca517775e22cde88e9358839789d9c1d4805dd0148c0873f7d773b73f3

Download Submit
memory/820-70-0x0000000000000000-mapping.dmp

Download
memory/940-91-0x0000000000360000-0x00000000007BE000-memory.dmp

Filesize
4.4MB

Download
memory/940-54-0x00000000756B1000-0x00000000756B3000-memory.dmp

Filesize
8KB

Download
memory/940-75-0x0000000000360000-0x00000000007BE000-memory.dmp

Filesize
4.4MB

Download
memory/940-55-0x0000000000360000-0x00000000007BE000-memory.dmp

Filesize
4.4MB

Download
memory/1128-61-0x0000000000000000-mapping.dmp

Download
memory/1200-62-0x0000000000000000-mapping.dmp

Download
memory/1232-58-0x0000000000000000-mapping.dmp

Download
memory/1328-77-0x0000000000000000-mapping.dmp

Download
memory/1540-87-0x0000000000000000-mapping.dmp

Download
memory/1576-88-0x0000000000000000-mapping.dmp

Download
memory/1580-82-0x0000000000000000-mapping.dmp

Download
memory/1696-59-0x0000000000000000-mapping.dmp

Download
memory/1964-81-0x0000000000000000-mapping.dmp

Download
memory/2044-64-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads