782a6ef46c05ba93a58ddb1647af8465bde23492006586ad62f9b22ad2f5325a

Analysis

max time kernel
41s
max time network
50s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
23-11-2022 10:22

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

782a6ef46c05ba93a58ddb1647af8465bde23492006586ad62f9b22ad2f5325a.exe
Size

602KB
MD5

c71f1b4753b839e3f7dc5a794462fc7a
SHA1

13e966b1feeff3c66c4533cd411330291fff2e9e
SHA256

782a6ef46c05ba93a58ddb1647af8465bde23492006586ad62f9b22ad2f5325a
SHA512

dc790d3cc4c94f9d4b072d8215efec7346a82d935a4231f0de8d355e3d92830ef3f407b0e4ac80e675fefe34c91acccb6aab735dc8de85740f6f49b77f395e58
SSDEEP

12288:+Iny5DYTgIPZvfF11Bo83lvIOQpDZtirnPANNlxCB39ps34zB1qjKPB:gUTgEZXvfo81z2PeP2N8Nqo+jKZ

Score

8^/10

discovery

Malware Config

Signatures

Drops file in Drivers directory 1 IoCs

Processes:

782a6ef46c05ba93a58ddb1647af8465bde23492006586ad62f9b22ad2f5325a.exe

description ioc process

File created C:\Windows\system32\drivers\nethfdrv.sys 782a6ef46c05ba93a58ddb1647af8465bde23492006586ad62f9b22ad2f5325a.exe
Executes dropped EXE 5 IoCs

Processes:

installd.exenethtsrv.exenetupdsrv.exenethtsrv.exenetupdsrv.exe

pid process

1436 installd.exe
1784 nethtsrv.exe
680 netupdsrv.exe
772 nethtsrv.exe
1256 netupdsrv.exe

description	ioc	process
File created	C:\Windows\system32\drivers\nethfdrv.sys	782a6ef46c05ba93a58ddb1647af8465bde23492006586ad62f9b22ad2f5325a.exe

pid	process
1436	installd.exe
1784	nethtsrv.exe
680	netupdsrv.exe
772	nethtsrv.exe
1256	netupdsrv.exe

Loads dropped DLL 13 IoCs

Processes:

782a6ef46c05ba93a58ddb1647af8465bde23492006586ad62f9b22ad2f5325a.exeinstalld.exenethtsrv.exenethtsrv.exe

pid	process
1760	782a6ef46c05ba93a58ddb1647af8465bde23492006586ad62f9b22ad2f5325a.exe
1760	782a6ef46c05ba93a58ddb1647af8465bde23492006586ad62f9b22ad2f5325a.exe
1760	782a6ef46c05ba93a58ddb1647af8465bde23492006586ad62f9b22ad2f5325a.exe
1760	782a6ef46c05ba93a58ddb1647af8465bde23492006586ad62f9b22ad2f5325a.exe
1436	installd.exe
1760	782a6ef46c05ba93a58ddb1647af8465bde23492006586ad62f9b22ad2f5325a.exe
1784	nethtsrv.exe
1784	nethtsrv.exe
1760	782a6ef46c05ba93a58ddb1647af8465bde23492006586ad62f9b22ad2f5325a.exe
1760	782a6ef46c05ba93a58ddb1647af8465bde23492006586ad62f9b22ad2f5325a.exe
772	nethtsrv.exe
772	nethtsrv.exe
1760	782a6ef46c05ba93a58ddb1647af8465bde23492006586ad62f9b22ad2f5325a.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in System32 directory 5 IoCs

Processes:

782a6ef46c05ba93a58ddb1647af8465bde23492006586ad62f9b22ad2f5325a.exe

description	ioc	process
File created	C:\Windows\SysWOW64\hfnapi.dll	782a6ef46c05ba93a58ddb1647af8465bde23492006586ad62f9b22ad2f5325a.exe
File created	C:\Windows\SysWOW64\hfpapi.dll	782a6ef46c05ba93a58ddb1647af8465bde23492006586ad62f9b22ad2f5325a.exe
File created	C:\Windows\SysWOW64\installd.exe	782a6ef46c05ba93a58ddb1647af8465bde23492006586ad62f9b22ad2f5325a.exe
File created	C:\Windows\SysWOW64\nethtsrv.exe	782a6ef46c05ba93a58ddb1647af8465bde23492006586ad62f9b22ad2f5325a.exe
File created	C:\Windows\SysWOW64\netupdsrv.exe	782a6ef46c05ba93a58ddb1647af8465bde23492006586ad62f9b22ad2f5325a.exe

Drops file in Program Files directory 3 IoCs

Processes:

782a6ef46c05ba93a58ddb1647af8465bde23492006586ad62f9b22ad2f5325a.exe

description	ioc	process
File created	C:\Program Files (x86)\Common Files\Config\data.xml	782a6ef46c05ba93a58ddb1647af8465bde23492006586ad62f9b22ad2f5325a.exe
File created	C:\Program Files (x86)\Common Files\Config\ver.xml	782a6ef46c05ba93a58ddb1647af8465bde23492006586ad62f9b22ad2f5325a.exe
File created	C:\Program Files (x86)\Common Files\config\uninstinethnfd.exe	782a6ef46c05ba93a58ddb1647af8465bde23492006586ad62f9b22ad2f5325a.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Runs net.exe
Suspicious behavior: LoadsDriver 1 IoCs

Processes:

pid process

468
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

nethtsrv.exe

description pid process

Token: SeDebugPrivilege 772 nethtsrv.exe

pid	process
468

description	pid	process
Token: SeDebugPrivilege	772	nethtsrv.exe

Suspicious use of WriteProcessMemory 50 IoCs

Processes:

782a6ef46c05ba93a58ddb1647af8465bde23492006586ad62f9b22ad2f5325a.exenet.exenet.exenet.exenet.exe

description	pid	process	target process
PID 1760 wrote to memory of 888	1760	782a6ef46c05ba93a58ddb1647af8465bde23492006586ad62f9b22ad2f5325a.exe	net.exe
PID 1760 wrote to memory of 888	1760	782a6ef46c05ba93a58ddb1647af8465bde23492006586ad62f9b22ad2f5325a.exe	net.exe
PID 1760 wrote to memory of 888	1760	782a6ef46c05ba93a58ddb1647af8465bde23492006586ad62f9b22ad2f5325a.exe	net.exe
PID 1760 wrote to memory of 888	1760	782a6ef46c05ba93a58ddb1647af8465bde23492006586ad62f9b22ad2f5325a.exe	net.exe
PID 888 wrote to memory of 944	888	net.exe	net1.exe
PID 888 wrote to memory of 944	888	net.exe	net1.exe
PID 888 wrote to memory of 944	888	net.exe	net1.exe
PID 888 wrote to memory of 944	888	net.exe	net1.exe
PID 1760 wrote to memory of 1540	1760	782a6ef46c05ba93a58ddb1647af8465bde23492006586ad62f9b22ad2f5325a.exe	net.exe
PID 1760 wrote to memory of 1540	1760	782a6ef46c05ba93a58ddb1647af8465bde23492006586ad62f9b22ad2f5325a.exe	net.exe
PID 1760 wrote to memory of 1540	1760	782a6ef46c05ba93a58ddb1647af8465bde23492006586ad62f9b22ad2f5325a.exe	net.exe
PID 1760 wrote to memory of 1540	1760	782a6ef46c05ba93a58ddb1647af8465bde23492006586ad62f9b22ad2f5325a.exe	net.exe
PID 1540 wrote to memory of 820	1540	net.exe	net1.exe
PID 1540 wrote to memory of 820	1540	net.exe	net1.exe
PID 1540 wrote to memory of 820	1540	net.exe	net1.exe
PID 1540 wrote to memory of 820	1540	net.exe	net1.exe
PID 1760 wrote to memory of 1436	1760	782a6ef46c05ba93a58ddb1647af8465bde23492006586ad62f9b22ad2f5325a.exe	installd.exe
PID 1760 wrote to memory of 1436	1760	782a6ef46c05ba93a58ddb1647af8465bde23492006586ad62f9b22ad2f5325a.exe	installd.exe
PID 1760 wrote to memory of 1436	1760	782a6ef46c05ba93a58ddb1647af8465bde23492006586ad62f9b22ad2f5325a.exe	installd.exe
PID 1760 wrote to memory of 1436	1760	782a6ef46c05ba93a58ddb1647af8465bde23492006586ad62f9b22ad2f5325a.exe	installd.exe
PID 1760 wrote to memory of 1436	1760	782a6ef46c05ba93a58ddb1647af8465bde23492006586ad62f9b22ad2f5325a.exe	installd.exe
PID 1760 wrote to memory of 1436	1760	782a6ef46c05ba93a58ddb1647af8465bde23492006586ad62f9b22ad2f5325a.exe	installd.exe
PID 1760 wrote to memory of 1436	1760	782a6ef46c05ba93a58ddb1647af8465bde23492006586ad62f9b22ad2f5325a.exe	installd.exe
PID 1760 wrote to memory of 1784	1760	782a6ef46c05ba93a58ddb1647af8465bde23492006586ad62f9b22ad2f5325a.exe	nethtsrv.exe
PID 1760 wrote to memory of 1784	1760	782a6ef46c05ba93a58ddb1647af8465bde23492006586ad62f9b22ad2f5325a.exe	nethtsrv.exe
PID 1760 wrote to memory of 1784	1760	782a6ef46c05ba93a58ddb1647af8465bde23492006586ad62f9b22ad2f5325a.exe	nethtsrv.exe
PID 1760 wrote to memory of 1784	1760	782a6ef46c05ba93a58ddb1647af8465bde23492006586ad62f9b22ad2f5325a.exe	nethtsrv.exe
PID 1760 wrote to memory of 680	1760	782a6ef46c05ba93a58ddb1647af8465bde23492006586ad62f9b22ad2f5325a.exe	netupdsrv.exe
PID 1760 wrote to memory of 680	1760	782a6ef46c05ba93a58ddb1647af8465bde23492006586ad62f9b22ad2f5325a.exe	netupdsrv.exe
PID 1760 wrote to memory of 680	1760	782a6ef46c05ba93a58ddb1647af8465bde23492006586ad62f9b22ad2f5325a.exe	netupdsrv.exe
PID 1760 wrote to memory of 680	1760	782a6ef46c05ba93a58ddb1647af8465bde23492006586ad62f9b22ad2f5325a.exe	netupdsrv.exe
PID 1760 wrote to memory of 680	1760	782a6ef46c05ba93a58ddb1647af8465bde23492006586ad62f9b22ad2f5325a.exe	netupdsrv.exe
PID 1760 wrote to memory of 680	1760	782a6ef46c05ba93a58ddb1647af8465bde23492006586ad62f9b22ad2f5325a.exe	netupdsrv.exe
PID 1760 wrote to memory of 680	1760	782a6ef46c05ba93a58ddb1647af8465bde23492006586ad62f9b22ad2f5325a.exe	netupdsrv.exe
PID 1760 wrote to memory of 432	1760	782a6ef46c05ba93a58ddb1647af8465bde23492006586ad62f9b22ad2f5325a.exe	net.exe
PID 1760 wrote to memory of 432	1760	782a6ef46c05ba93a58ddb1647af8465bde23492006586ad62f9b22ad2f5325a.exe	net.exe
PID 1760 wrote to memory of 432	1760	782a6ef46c05ba93a58ddb1647af8465bde23492006586ad62f9b22ad2f5325a.exe	net.exe
PID 1760 wrote to memory of 432	1760	782a6ef46c05ba93a58ddb1647af8465bde23492006586ad62f9b22ad2f5325a.exe	net.exe
PID 432 wrote to memory of 908	432	net.exe	net1.exe
PID 432 wrote to memory of 908	432	net.exe	net1.exe
PID 432 wrote to memory of 908	432	net.exe	net1.exe
PID 432 wrote to memory of 908	432	net.exe	net1.exe
PID 1760 wrote to memory of 1928	1760	782a6ef46c05ba93a58ddb1647af8465bde23492006586ad62f9b22ad2f5325a.exe	net.exe
PID 1760 wrote to memory of 1928	1760	782a6ef46c05ba93a58ddb1647af8465bde23492006586ad62f9b22ad2f5325a.exe	net.exe
PID 1760 wrote to memory of 1928	1760	782a6ef46c05ba93a58ddb1647af8465bde23492006586ad62f9b22ad2f5325a.exe	net.exe
PID 1760 wrote to memory of 1928	1760	782a6ef46c05ba93a58ddb1647af8465bde23492006586ad62f9b22ad2f5325a.exe	net.exe
PID 1928 wrote to memory of 1456	1928	net.exe	net1.exe
PID 1928 wrote to memory of 1456	1928	net.exe	net1.exe
PID 1928 wrote to memory of 1456	1928	net.exe	net1.exe
PID 1928 wrote to memory of 1456	1928	net.exe	net1.exe

C:\Users\Admin\AppData\Local\Temp\782a6ef46c05ba93a58ddb1647af8465bde23492006586ad62f9b22ad2f5325a.exe
"C:\Users\Admin\AppData\Local\Temp\782a6ef46c05ba93a58ddb1647af8465bde23492006586ad62f9b22ad2f5325a.exe"
1⤵
- Drops file in Drivers directory
- Loads dropped DLL
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:1760

C:\Windows\SysWOW64\net.exe
net stop nethttpservice
2⤵
- Suspicious use of WriteProcessMemory
PID:888

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop nethttpservice
3⤵
PID:944

C:\Windows\SysWOW64\net.exe
net stop serviceupdater
2⤵
- Suspicious use of WriteProcessMemory
PID:1540

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop serviceupdater
3⤵
PID:820

C:\Windows\SysWOW64\installd.exe
"C:\Windows\system32\installd.exe" nethfdrv
2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1436

C:\Windows\SysWOW64\nethtsrv.exe
"C:\Windows\system32\nethtsrv.exe" -nfdi
2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1784

C:\Windows\SysWOW64\netupdsrv.exe
"C:\Windows\system32\netupdsrv.exe" -nfdi
2⤵
- Executes dropped EXE
PID:680

C:\Windows\SysWOW64\net.exe
net start nethttpservice
2⤵
- Suspicious use of WriteProcessMemory
PID:432

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 start nethttpservice
3⤵
PID:908

C:\Windows\SysWOW64\net.exe
net start serviceupdater
2⤵
- Suspicious use of WriteProcessMemory
PID:1928

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 start serviceupdater
3⤵
PID:1456

C:\Windows\SysWOW64\nethtsrv.exe
C:\Windows\SysWOW64\nethtsrv.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:772

C:\Windows\SysWOW64\netupdsrv.exe
C:\Windows\SysWOW64\netupdsrv.exe
1⤵
- Executes dropped EXE
PID:1256

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\hfnapi.dll
Filesize
106KB

MD5
79767f61cc638c40e912c7a89a834e64

SHA1
12fabb7336b21b00bfba5a1a593aaa84846d2474

SHA256
302949fbf36cc647848960c7ea8278b183598f704a50052b09d683ff8e2c4c79

SHA512
7d75df4b0f5a969b9942f86f1151394b1e95a4c621df11acdc0394d43e2413d91fc41bab2bb4b901438c9b16a80d789d2be72cd0cd8f473a8be3267d7c243c61

Download Submit
C:\Windows\SysWOW64\hfpapi.dll
Filesize
241KB

MD5
65e3723188f20c2984c89c3b0083086b

SHA1
f99ef19e69654057358987f930ce059e60fd8f36

SHA256
5eb95962008121cc2f441897ba03bd682c8bf414e51f1b3dc9654b6eff4bcb86

SHA512
8c80d5efd39cbcdfa9b6102cf83ad30f1123872bd5aa19ca72d4a2e8d09b79e51f18bc3bc1d53e383b29445e4678d52245a3e9393834194235c2c8d7b3fd43c3

Download Submit
C:\Windows\SysWOW64\installd.exe
Filesize
108KB

MD5
1aea85423100cb82c3f83f717c4872af

SHA1
bf63f66c4a88737db87c445ca3e1b8ce345e0da3

SHA256
a12ae94946ae1a13f0abccc4fdc29ac5c791a13fcf585603f5ce98cb40dcd6a0

SHA512
a99030f9b14d7e63a1c0a2589622710940c18113cd4aa8ac882e49b497530b21a01e0eb9ef0f33c79a1875068c465fe149162bb8f55b5d842cf190cac1de0132

Download Submit
C:\Windows\SysWOW64\nethtsrv.exe
Filesize
176KB

MD5
159ad773f34be82dd589ad11bf42d004

SHA1
cb3cfe974c343a39df65a65db3e93f0f92067d37

SHA256
3dfeac2424cf1bc8be2b4acab7ef3843b26e97265b714a3c01db0ed2a53aea6a

SHA512
fc06a558ce24d8c66096808122607b5c4ab38108edb5f6e95c1b91da5dc8441c6dad8bbdd9553d833baf8b2a616ab6c099e635f6bad9c26260fc35807a4438ba

Download Submit
C:\Windows\SysWOW64\nethtsrv.exe
Filesize
176KB

MD5
159ad773f34be82dd589ad11bf42d004

SHA1
cb3cfe974c343a39df65a65db3e93f0f92067d37

SHA256
3dfeac2424cf1bc8be2b4acab7ef3843b26e97265b714a3c01db0ed2a53aea6a

SHA512
fc06a558ce24d8c66096808122607b5c4ab38108edb5f6e95c1b91da5dc8441c6dad8bbdd9553d833baf8b2a616ab6c099e635f6bad9c26260fc35807a4438ba

Download Submit
C:\Windows\SysWOW64\netupdsrv.exe
Filesize
158KB

MD5
8792970d913ed21cb19a6037f9e79439

SHA1
1351316e30f47e6f94e39b0dbc8e0d11e4118562

SHA256
8ef9d547d833bb6a97ca07ac72b731353c30af1e496adf2648a01136d8527c2e

SHA512
8a526df5e8f3084f6f3fb655719b5eb8c158b98011ca4cca85d308ec34b43a9b2af33f41fac01e75aa85593271fb9f3980ead818ca8d51ab031a661f79199f93

Download Submit
C:\Windows\SysWOW64\netupdsrv.exe
Filesize
158KB

MD5
8792970d913ed21cb19a6037f9e79439

SHA1
1351316e30f47e6f94e39b0dbc8e0d11e4118562

SHA256
8ef9d547d833bb6a97ca07ac72b731353c30af1e496adf2648a01136d8527c2e

SHA512
8a526df5e8f3084f6f3fb655719b5eb8c158b98011ca4cca85d308ec34b43a9b2af33f41fac01e75aa85593271fb9f3980ead818ca8d51ab031a661f79199f93

Download Submit
\Users\Admin\AppData\Local\Temp\nsiF05A.tmp\System.dll
Filesize
11KB

MD5
c17103ae9072a06da581dec998343fc1

SHA1
b72148c6bdfaada8b8c3f950e610ee7cf1da1f8d

SHA256
dc58d8ad81cacb0c1ed72e33bff8f23ea40b5252b5bb55d393a0903e6819ae2f

SHA512
d32a71aaef18e993f28096d536e41c4d016850721b31171513ce28bbd805a54fd290b7c3e9d935f72e676a1acfb4f0dcc89d95040a0dd29f2b6975855c18986f

Download Submit
\Users\Admin\AppData\Local\Temp\nsiF05A.tmp\nsExec.dll
Filesize
6KB

MD5
acc2b699edfea5bf5aae45aba3a41e96

SHA1
d2accf4d494e43ceb2cff69abe4dd17147d29cc2

SHA256
168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e

SHA512
e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe

Download Submit
\Users\Admin\AppData\Local\Temp\nsiF05A.tmp\nsExec.dll
Filesize
6KB

MD5
acc2b699edfea5bf5aae45aba3a41e96

SHA1
d2accf4d494e43ceb2cff69abe4dd17147d29cc2

SHA256
168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e

SHA512
e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe

Download Submit
\Users\Admin\AppData\Local\Temp\nsiF05A.tmp\nsExec.dll
Filesize
6KB

MD5
acc2b699edfea5bf5aae45aba3a41e96

SHA1
d2accf4d494e43ceb2cff69abe4dd17147d29cc2

SHA256
168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e

SHA512
e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe

Download Submit
\Users\Admin\AppData\Local\Temp\nsiF05A.tmp\nsExec.dll
Filesize
6KB

MD5
acc2b699edfea5bf5aae45aba3a41e96

SHA1
d2accf4d494e43ceb2cff69abe4dd17147d29cc2

SHA256
168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e

SHA512
e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe

Download Submit
\Windows\SysWOW64\hfnapi.dll
Filesize
106KB

MD5
79767f61cc638c40e912c7a89a834e64

SHA1
12fabb7336b21b00bfba5a1a593aaa84846d2474

SHA256
302949fbf36cc647848960c7ea8278b183598f704a50052b09d683ff8e2c4c79

SHA512
7d75df4b0f5a969b9942f86f1151394b1e95a4c621df11acdc0394d43e2413d91fc41bab2bb4b901438c9b16a80d789d2be72cd0cd8f473a8be3267d7c243c61

Download Submit
\Windows\SysWOW64\hfnapi.dll
Filesize
106KB

MD5
79767f61cc638c40e912c7a89a834e64

SHA1
12fabb7336b21b00bfba5a1a593aaa84846d2474

SHA256
302949fbf36cc647848960c7ea8278b183598f704a50052b09d683ff8e2c4c79

SHA512
7d75df4b0f5a969b9942f86f1151394b1e95a4c621df11acdc0394d43e2413d91fc41bab2bb4b901438c9b16a80d789d2be72cd0cd8f473a8be3267d7c243c61

Download Submit
\Windows\SysWOW64\hfnapi.dll
Filesize
106KB

MD5
79767f61cc638c40e912c7a89a834e64

SHA1
12fabb7336b21b00bfba5a1a593aaa84846d2474

SHA256
302949fbf36cc647848960c7ea8278b183598f704a50052b09d683ff8e2c4c79

SHA512
7d75df4b0f5a969b9942f86f1151394b1e95a4c621df11acdc0394d43e2413d91fc41bab2bb4b901438c9b16a80d789d2be72cd0cd8f473a8be3267d7c243c61

Download Submit
\Windows\SysWOW64\hfpapi.dll
Filesize
241KB

MD5
65e3723188f20c2984c89c3b0083086b

SHA1
f99ef19e69654057358987f930ce059e60fd8f36

SHA256
5eb95962008121cc2f441897ba03bd682c8bf414e51f1b3dc9654b6eff4bcb86

SHA512
8c80d5efd39cbcdfa9b6102cf83ad30f1123872bd5aa19ca72d4a2e8d09b79e51f18bc3bc1d53e383b29445e4678d52245a3e9393834194235c2c8d7b3fd43c3

Download Submit
\Windows\SysWOW64\hfpapi.dll
Filesize
241KB

MD5
65e3723188f20c2984c89c3b0083086b

SHA1
f99ef19e69654057358987f930ce059e60fd8f36

SHA256
5eb95962008121cc2f441897ba03bd682c8bf414e51f1b3dc9654b6eff4bcb86

SHA512
8c80d5efd39cbcdfa9b6102cf83ad30f1123872bd5aa19ca72d4a2e8d09b79e51f18bc3bc1d53e383b29445e4678d52245a3e9393834194235c2c8d7b3fd43c3

Download Submit
\Windows\SysWOW64\installd.exe
Filesize
108KB

MD5
1aea85423100cb82c3f83f717c4872af

SHA1
bf63f66c4a88737db87c445ca3e1b8ce345e0da3

SHA256
a12ae94946ae1a13f0abccc4fdc29ac5c791a13fcf585603f5ce98cb40dcd6a0

SHA512
a99030f9b14d7e63a1c0a2589622710940c18113cd4aa8ac882e49b497530b21a01e0eb9ef0f33c79a1875068c465fe149162bb8f55b5d842cf190cac1de0132

Download Submit
\Windows\SysWOW64\nethtsrv.exe
Filesize
176KB

MD5
159ad773f34be82dd589ad11bf42d004

SHA1
cb3cfe974c343a39df65a65db3e93f0f92067d37

SHA256
3dfeac2424cf1bc8be2b4acab7ef3843b26e97265b714a3c01db0ed2a53aea6a

SHA512
fc06a558ce24d8c66096808122607b5c4ab38108edb5f6e95c1b91da5dc8441c6dad8bbdd9553d833baf8b2a616ab6c099e635f6bad9c26260fc35807a4438ba

Download Submit
\Windows\SysWOW64\netupdsrv.exe
Filesize
158KB

MD5
8792970d913ed21cb19a6037f9e79439

SHA1
1351316e30f47e6f94e39b0dbc8e0d11e4118562

SHA256
8ef9d547d833bb6a97ca07ac72b731353c30af1e496adf2648a01136d8527c2e

SHA512
8a526df5e8f3084f6f3fb655719b5eb8c158b98011ca4cca85d308ec34b43a9b2af33f41fac01e75aa85593271fb9f3980ead818ca8d51ab031a661f79199f93

Download Submit
memory/432-80-0x0000000000000000-mapping.dmp

Download
memory/680-76-0x0000000000000000-mapping.dmp

Download
memory/820-62-0x0000000000000000-mapping.dmp

Download
memory/888-57-0x0000000000000000-mapping.dmp

Download
memory/908-81-0x0000000000000000-mapping.dmp

Download
memory/944-58-0x0000000000000000-mapping.dmp

Download
memory/1436-64-0x0000000000000000-mapping.dmp

Download
memory/1456-87-0x0000000000000000-mapping.dmp

Download
memory/1540-61-0x0000000000000000-mapping.dmp

Download
memory/1760-54-0x0000000075281000-0x0000000075283000-memory.dmp

Filesize
8KB

Download
memory/1760-59-0x0000000000360000-0x00000000007BE000-memory.dmp

Filesize
4.4MB

Download
memory/1760-90-0x0000000000360000-0x00000000007BE000-memory.dmp

Filesize
4.4MB

Download
memory/1784-70-0x0000000000000000-mapping.dmp

Download
memory/1928-86-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads