72eafe040af82c52d99106b9584a749f264392170b3a6fb198b705ca0ec4e982

Analysis

max time kernel
41s
max time network
46s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
23-11-2022 10:23

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

72eafe040af82c52d99106b9584a749f264392170b3a6fb198b705ca0ec4e982.exe
Size

602KB
MD5

ffd361743b0434e5946464e81ec349d1
SHA1

45cbca5201da0712b949f64780b6ac2e8383aa95
SHA256

72eafe040af82c52d99106b9584a749f264392170b3a6fb198b705ca0ec4e982
SHA512

db42dbed72a7e1c671e171620d8ff565bc7c8521201e95336a109bdfa7d369df0e86bcacd672b8541707a503df821721636876b712cae0f4356f30506259a4a1
SSDEEP

12288:fIny5DYTZIYSUch8j/D4xIeCryHgYuWAUWD8LSiBXD/QBnnC:HUTZzSP8j/cIjEjuZUQCSSzQC

Score

8^/10

discovery

Malware Config

Signatures

Drops file in Drivers directory 1 IoCs

Processes:

72eafe040af82c52d99106b9584a749f264392170b3a6fb198b705ca0ec4e982.exe

description ioc process

File created C:\Windows\system32\drivers\nethfdrv.sys 72eafe040af82c52d99106b9584a749f264392170b3a6fb198b705ca0ec4e982.exe
Executes dropped EXE 5 IoCs

Processes:

installd.exenethtsrv.exenetupdsrv.exenethtsrv.exenetupdsrv.exe

pid process

1156 installd.exe
272 nethtsrv.exe
2028 netupdsrv.exe
1476 nethtsrv.exe
1196 netupdsrv.exe

description	ioc	process
File created	C:\Windows\system32\drivers\nethfdrv.sys	72eafe040af82c52d99106b9584a749f264392170b3a6fb198b705ca0ec4e982.exe

pid	process
1156	installd.exe
272	nethtsrv.exe
2028	netupdsrv.exe
1476	nethtsrv.exe
1196	netupdsrv.exe

Loads dropped DLL 13 IoCs

Processes:

72eafe040af82c52d99106b9584a749f264392170b3a6fb198b705ca0ec4e982.exeinstalld.exenethtsrv.exenethtsrv.exe

pid	process
1968	72eafe040af82c52d99106b9584a749f264392170b3a6fb198b705ca0ec4e982.exe
1968	72eafe040af82c52d99106b9584a749f264392170b3a6fb198b705ca0ec4e982.exe
1968	72eafe040af82c52d99106b9584a749f264392170b3a6fb198b705ca0ec4e982.exe
1968	72eafe040af82c52d99106b9584a749f264392170b3a6fb198b705ca0ec4e982.exe
1156	installd.exe
1968	72eafe040af82c52d99106b9584a749f264392170b3a6fb198b705ca0ec4e982.exe
272	nethtsrv.exe
272	nethtsrv.exe
1968	72eafe040af82c52d99106b9584a749f264392170b3a6fb198b705ca0ec4e982.exe
1968	72eafe040af82c52d99106b9584a749f264392170b3a6fb198b705ca0ec4e982.exe
1476	nethtsrv.exe
1476	nethtsrv.exe
1968	72eafe040af82c52d99106b9584a749f264392170b3a6fb198b705ca0ec4e982.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in System32 directory 5 IoCs

Processes:

72eafe040af82c52d99106b9584a749f264392170b3a6fb198b705ca0ec4e982.exe

description	ioc	process
File created	C:\Windows\SysWOW64\hfpapi.dll	72eafe040af82c52d99106b9584a749f264392170b3a6fb198b705ca0ec4e982.exe
File created	C:\Windows\SysWOW64\installd.exe	72eafe040af82c52d99106b9584a749f264392170b3a6fb198b705ca0ec4e982.exe
File created	C:\Windows\SysWOW64\nethtsrv.exe	72eafe040af82c52d99106b9584a749f264392170b3a6fb198b705ca0ec4e982.exe
File created	C:\Windows\SysWOW64\netupdsrv.exe	72eafe040af82c52d99106b9584a749f264392170b3a6fb198b705ca0ec4e982.exe
File created	C:\Windows\SysWOW64\hfnapi.dll	72eafe040af82c52d99106b9584a749f264392170b3a6fb198b705ca0ec4e982.exe

Drops file in Program Files directory 3 IoCs

Processes:

72eafe040af82c52d99106b9584a749f264392170b3a6fb198b705ca0ec4e982.exe

description	ioc	process
File created	C:\Program Files (x86)\Common Files\Config\ver.xml	72eafe040af82c52d99106b9584a749f264392170b3a6fb198b705ca0ec4e982.exe
File created	C:\Program Files (x86)\Common Files\config\uninstinethnfd.exe	72eafe040af82c52d99106b9584a749f264392170b3a6fb198b705ca0ec4e982.exe
File created	C:\Program Files (x86)\Common Files\Config\data.xml	72eafe040af82c52d99106b9584a749f264392170b3a6fb198b705ca0ec4e982.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Runs net.exe
Suspicious behavior: LoadsDriver 1 IoCs

Processes:

pid process

460
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

nethtsrv.exe

description pid process

Token: SeDebugPrivilege 1476 nethtsrv.exe

pid	process
460

description	pid	process
Token: SeDebugPrivilege	1476	nethtsrv.exe

Suspicious use of WriteProcessMemory 50 IoCs

Processes:

72eafe040af82c52d99106b9584a749f264392170b3a6fb198b705ca0ec4e982.exenet.exenet.exenet.exenet.exe

description	pid	process	target process
PID 1968 wrote to memory of 948	1968	72eafe040af82c52d99106b9584a749f264392170b3a6fb198b705ca0ec4e982.exe	net.exe
PID 1968 wrote to memory of 948	1968	72eafe040af82c52d99106b9584a749f264392170b3a6fb198b705ca0ec4e982.exe	net.exe
PID 1968 wrote to memory of 948	1968	72eafe040af82c52d99106b9584a749f264392170b3a6fb198b705ca0ec4e982.exe	net.exe
PID 1968 wrote to memory of 948	1968	72eafe040af82c52d99106b9584a749f264392170b3a6fb198b705ca0ec4e982.exe	net.exe
PID 948 wrote to memory of 1760	948	net.exe	net1.exe
PID 948 wrote to memory of 1760	948	net.exe	net1.exe
PID 948 wrote to memory of 1760	948	net.exe	net1.exe
PID 948 wrote to memory of 1760	948	net.exe	net1.exe
PID 1968 wrote to memory of 1380	1968	72eafe040af82c52d99106b9584a749f264392170b3a6fb198b705ca0ec4e982.exe	net.exe
PID 1968 wrote to memory of 1380	1968	72eafe040af82c52d99106b9584a749f264392170b3a6fb198b705ca0ec4e982.exe	net.exe
PID 1968 wrote to memory of 1380	1968	72eafe040af82c52d99106b9584a749f264392170b3a6fb198b705ca0ec4e982.exe	net.exe
PID 1968 wrote to memory of 1380	1968	72eafe040af82c52d99106b9584a749f264392170b3a6fb198b705ca0ec4e982.exe	net.exe
PID 1380 wrote to memory of 1768	1380	net.exe	net1.exe
PID 1380 wrote to memory of 1768	1380	net.exe	net1.exe
PID 1380 wrote to memory of 1768	1380	net.exe	net1.exe
PID 1380 wrote to memory of 1768	1380	net.exe	net1.exe
PID 1968 wrote to memory of 1156	1968	72eafe040af82c52d99106b9584a749f264392170b3a6fb198b705ca0ec4e982.exe	installd.exe
PID 1968 wrote to memory of 1156	1968	72eafe040af82c52d99106b9584a749f264392170b3a6fb198b705ca0ec4e982.exe	installd.exe
PID 1968 wrote to memory of 1156	1968	72eafe040af82c52d99106b9584a749f264392170b3a6fb198b705ca0ec4e982.exe	installd.exe
PID 1968 wrote to memory of 1156	1968	72eafe040af82c52d99106b9584a749f264392170b3a6fb198b705ca0ec4e982.exe	installd.exe
PID 1968 wrote to memory of 1156	1968	72eafe040af82c52d99106b9584a749f264392170b3a6fb198b705ca0ec4e982.exe	installd.exe
PID 1968 wrote to memory of 1156	1968	72eafe040af82c52d99106b9584a749f264392170b3a6fb198b705ca0ec4e982.exe	installd.exe
PID 1968 wrote to memory of 1156	1968	72eafe040af82c52d99106b9584a749f264392170b3a6fb198b705ca0ec4e982.exe	installd.exe
PID 1968 wrote to memory of 272	1968	72eafe040af82c52d99106b9584a749f264392170b3a6fb198b705ca0ec4e982.exe	nethtsrv.exe
PID 1968 wrote to memory of 272	1968	72eafe040af82c52d99106b9584a749f264392170b3a6fb198b705ca0ec4e982.exe	nethtsrv.exe
PID 1968 wrote to memory of 272	1968	72eafe040af82c52d99106b9584a749f264392170b3a6fb198b705ca0ec4e982.exe	nethtsrv.exe
PID 1968 wrote to memory of 272	1968	72eafe040af82c52d99106b9584a749f264392170b3a6fb198b705ca0ec4e982.exe	nethtsrv.exe
PID 1968 wrote to memory of 2028	1968	72eafe040af82c52d99106b9584a749f264392170b3a6fb198b705ca0ec4e982.exe	netupdsrv.exe
PID 1968 wrote to memory of 2028	1968	72eafe040af82c52d99106b9584a749f264392170b3a6fb198b705ca0ec4e982.exe	netupdsrv.exe
PID 1968 wrote to memory of 2028	1968	72eafe040af82c52d99106b9584a749f264392170b3a6fb198b705ca0ec4e982.exe	netupdsrv.exe
PID 1968 wrote to memory of 2028	1968	72eafe040af82c52d99106b9584a749f264392170b3a6fb198b705ca0ec4e982.exe	netupdsrv.exe
PID 1968 wrote to memory of 2028	1968	72eafe040af82c52d99106b9584a749f264392170b3a6fb198b705ca0ec4e982.exe	netupdsrv.exe
PID 1968 wrote to memory of 2028	1968	72eafe040af82c52d99106b9584a749f264392170b3a6fb198b705ca0ec4e982.exe	netupdsrv.exe
PID 1968 wrote to memory of 2028	1968	72eafe040af82c52d99106b9584a749f264392170b3a6fb198b705ca0ec4e982.exe	netupdsrv.exe
PID 1968 wrote to memory of 384	1968	72eafe040af82c52d99106b9584a749f264392170b3a6fb198b705ca0ec4e982.exe	net.exe
PID 1968 wrote to memory of 384	1968	72eafe040af82c52d99106b9584a749f264392170b3a6fb198b705ca0ec4e982.exe	net.exe
PID 1968 wrote to memory of 384	1968	72eafe040af82c52d99106b9584a749f264392170b3a6fb198b705ca0ec4e982.exe	net.exe
PID 1968 wrote to memory of 384	1968	72eafe040af82c52d99106b9584a749f264392170b3a6fb198b705ca0ec4e982.exe	net.exe
PID 384 wrote to memory of 1664	384	net.exe	net1.exe
PID 384 wrote to memory of 1664	384	net.exe	net1.exe
PID 384 wrote to memory of 1664	384	net.exe	net1.exe
PID 384 wrote to memory of 1664	384	net.exe	net1.exe
PID 1968 wrote to memory of 1920	1968	72eafe040af82c52d99106b9584a749f264392170b3a6fb198b705ca0ec4e982.exe	net.exe
PID 1968 wrote to memory of 1920	1968	72eafe040af82c52d99106b9584a749f264392170b3a6fb198b705ca0ec4e982.exe	net.exe
PID 1968 wrote to memory of 1920	1968	72eafe040af82c52d99106b9584a749f264392170b3a6fb198b705ca0ec4e982.exe	net.exe
PID 1968 wrote to memory of 1920	1968	72eafe040af82c52d99106b9584a749f264392170b3a6fb198b705ca0ec4e982.exe	net.exe
PID 1920 wrote to memory of 360	1920	net.exe	net1.exe
PID 1920 wrote to memory of 360	1920	net.exe	net1.exe
PID 1920 wrote to memory of 360	1920	net.exe	net1.exe
PID 1920 wrote to memory of 360	1920	net.exe	net1.exe

C:\Users\Admin\AppData\Local\Temp\72eafe040af82c52d99106b9584a749f264392170b3a6fb198b705ca0ec4e982.exe
"C:\Users\Admin\AppData\Local\Temp\72eafe040af82c52d99106b9584a749f264392170b3a6fb198b705ca0ec4e982.exe"
1⤵
- Drops file in Drivers directory
- Loads dropped DLL
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:1968

C:\Windows\SysWOW64\net.exe
net stop nethttpservice
2⤵
- Suspicious use of WriteProcessMemory
PID:948

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop nethttpservice
3⤵
PID:1760

C:\Windows\SysWOW64\net.exe
net stop serviceupdater
2⤵
- Suspicious use of WriteProcessMemory
PID:1380

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop serviceupdater
3⤵
PID:1768

C:\Windows\SysWOW64\installd.exe
"C:\Windows\system32\installd.exe" nethfdrv
2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1156

C:\Windows\SysWOW64\nethtsrv.exe
"C:\Windows\system32\nethtsrv.exe" -nfdi
2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:272

C:\Windows\SysWOW64\netupdsrv.exe
"C:\Windows\system32\netupdsrv.exe" -nfdi
2⤵
- Executes dropped EXE
PID:2028

C:\Windows\SysWOW64\net.exe
net start nethttpservice
2⤵
- Suspicious use of WriteProcessMemory
PID:384

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 start nethttpservice
3⤵
PID:1664

C:\Windows\SysWOW64\net.exe
net start serviceupdater
2⤵
- Suspicious use of WriteProcessMemory
PID:1920

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 start serviceupdater
3⤵
PID:360

C:\Windows\SysWOW64\nethtsrv.exe
C:\Windows\SysWOW64\nethtsrv.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:1476

C:\Windows\SysWOW64\netupdsrv.exe
C:\Windows\SysWOW64\netupdsrv.exe
1⤵
- Executes dropped EXE
PID:1196

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\hfnapi.dll
Filesize
106KB

MD5
1d7d6222a5dc81478481198b8d3e5006

SHA1
5853cce712aae0067e2c8eb3c462d0c3778df501

SHA256
fc27100b8427ac9ce604ea8faba9dfc689335fc3291b9879dd1959f24fefb2ae

SHA512
32e470e15f2b6843c455716ffff965cbcb0f8ed9fff87201a5dc8ffe2eb93f493d314e44dc20ac8a207af81b463c3e1c27c3e552886d7115e4d98c22a5da4fad

Download Submit
C:\Windows\SysWOW64\hfpapi.dll
Filesize
244KB

MD5
baaf0bb2223a01c6c554bd24c49dcc1c

SHA1
01b2f3d97fded0c45ce31e98aa894b60fcf0a7dc

SHA256
530a036b589e9c04e187ad2ca910d3b7ddb6f2e3b479dee6f08d62e4dc8c7094

SHA512
e0630320be0a14e25730b026911760d9cce9cc8bcd312a413a640585cb0806064ffb5f72056b94e88bd1f5eeda366c0198e6b37630728548ff9ab0dd522853f2

Download Submit
C:\Windows\SysWOW64\installd.exe
Filesize
108KB

MD5
12ca8395aeedf2a96a191d0a04172707

SHA1
d1413933b116ff3b7e062d4a328de63987e94253

SHA256
b21c4b144314c759682ed84545fe74ec27347c9ad914fd95c738272faaa3ccd9

SHA512
14d198174e78a5a76996fc2eda4f2f39cd9d28960a6935121af8f1680179ac1da20c85d7671e4558590487f3f305b3f939d8827c67d9e3ae20a348db2a0cc82b

Download Submit
C:\Windows\SysWOW64\nethtsrv.exe
Filesize
176KB

MD5
1b7bb3ef7be8afef9048f8d9677e2fc1

SHA1
4f6dd5f3f12495fe7b3120dd3b83ca22d5a109ad

SHA256
8f4228e65ed479cf1ac57d5ee7456c1bde5f9c87449d21301911b6b046785ff3

SHA512
c6ecd4f92d989d343c2b29bb2d69ff8cf00c7efeaa644b762d660a874ad8346ced4579835463b6b4e781fb29ab87da51387437e06061a48bbcaadfdfb6df0ad5

Download Submit
C:\Windows\SysWOW64\nethtsrv.exe
Filesize
176KB

MD5
1b7bb3ef7be8afef9048f8d9677e2fc1

SHA1
4f6dd5f3f12495fe7b3120dd3b83ca22d5a109ad

SHA256
8f4228e65ed479cf1ac57d5ee7456c1bde5f9c87449d21301911b6b046785ff3

SHA512
c6ecd4f92d989d343c2b29bb2d69ff8cf00c7efeaa644b762d660a874ad8346ced4579835463b6b4e781fb29ab87da51387437e06061a48bbcaadfdfb6df0ad5

Download Submit
C:\Windows\SysWOW64\netupdsrv.exe
Filesize
158KB

MD5
e8b071f268c54b26cffd6996f24ae234

SHA1
c61bec9a1e122571a08dc6bad3d85b744d1bedc6

SHA256
c9a42e37ab6aa2600e44542641dd745d44b1be7e8b1a330e0b08e2d0195c6ceb

SHA512
d3817aa57859a4b2ee0dbaabbcfc88a89c6649aea326139d025a34c0ddb8948c24f3066bb991f9de82a5cd2bf815dd0fdcb60f54e26d2db0cea92ece9fb12691

Download Submit
C:\Windows\SysWOW64\netupdsrv.exe
Filesize
158KB

MD5
e8b071f268c54b26cffd6996f24ae234

SHA1
c61bec9a1e122571a08dc6bad3d85b744d1bedc6

SHA256
c9a42e37ab6aa2600e44542641dd745d44b1be7e8b1a330e0b08e2d0195c6ceb

SHA512
d3817aa57859a4b2ee0dbaabbcfc88a89c6649aea326139d025a34c0ddb8948c24f3066bb991f9de82a5cd2bf815dd0fdcb60f54e26d2db0cea92ece9fb12691

Download Submit
\Users\Admin\AppData\Local\Temp\nst1049.tmp\System.dll
Filesize
11KB

MD5
c17103ae9072a06da581dec998343fc1

SHA1
b72148c6bdfaada8b8c3f950e610ee7cf1da1f8d

SHA256
dc58d8ad81cacb0c1ed72e33bff8f23ea40b5252b5bb55d393a0903e6819ae2f

SHA512
d32a71aaef18e993f28096d536e41c4d016850721b31171513ce28bbd805a54fd290b7c3e9d935f72e676a1acfb4f0dcc89d95040a0dd29f2b6975855c18986f

Download Submit
\Users\Admin\AppData\Local\Temp\nst1049.tmp\nsExec.dll
Filesize
6KB

MD5
acc2b699edfea5bf5aae45aba3a41e96

SHA1
d2accf4d494e43ceb2cff69abe4dd17147d29cc2

SHA256
168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e

SHA512
e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe

Download Submit
\Users\Admin\AppData\Local\Temp\nst1049.tmp\nsExec.dll
Filesize
6KB

MD5
acc2b699edfea5bf5aae45aba3a41e96

SHA1
d2accf4d494e43ceb2cff69abe4dd17147d29cc2

SHA256
168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e

SHA512
e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe

Download Submit
\Users\Admin\AppData\Local\Temp\nst1049.tmp\nsExec.dll
Filesize
6KB

MD5
acc2b699edfea5bf5aae45aba3a41e96

SHA1
d2accf4d494e43ceb2cff69abe4dd17147d29cc2

SHA256
168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e

SHA512
e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe

Download Submit
\Users\Admin\AppData\Local\Temp\nst1049.tmp\nsExec.dll
Filesize
6KB

MD5
acc2b699edfea5bf5aae45aba3a41e96

SHA1
d2accf4d494e43ceb2cff69abe4dd17147d29cc2

SHA256
168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e

SHA512
e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe

Download Submit
\Windows\SysWOW64\hfnapi.dll
Filesize
106KB

MD5
1d7d6222a5dc81478481198b8d3e5006

SHA1
5853cce712aae0067e2c8eb3c462d0c3778df501

SHA256
fc27100b8427ac9ce604ea8faba9dfc689335fc3291b9879dd1959f24fefb2ae

SHA512
32e470e15f2b6843c455716ffff965cbcb0f8ed9fff87201a5dc8ffe2eb93f493d314e44dc20ac8a207af81b463c3e1c27c3e552886d7115e4d98c22a5da4fad

Download Submit
\Windows\SysWOW64\hfnapi.dll
Filesize
106KB

MD5
1d7d6222a5dc81478481198b8d3e5006

SHA1
5853cce712aae0067e2c8eb3c462d0c3778df501

SHA256
fc27100b8427ac9ce604ea8faba9dfc689335fc3291b9879dd1959f24fefb2ae

SHA512
32e470e15f2b6843c455716ffff965cbcb0f8ed9fff87201a5dc8ffe2eb93f493d314e44dc20ac8a207af81b463c3e1c27c3e552886d7115e4d98c22a5da4fad

Download Submit
\Windows\SysWOW64\hfnapi.dll
Filesize
106KB

MD5
1d7d6222a5dc81478481198b8d3e5006

SHA1
5853cce712aae0067e2c8eb3c462d0c3778df501

SHA256
fc27100b8427ac9ce604ea8faba9dfc689335fc3291b9879dd1959f24fefb2ae

SHA512
32e470e15f2b6843c455716ffff965cbcb0f8ed9fff87201a5dc8ffe2eb93f493d314e44dc20ac8a207af81b463c3e1c27c3e552886d7115e4d98c22a5da4fad

Download Submit
\Windows\SysWOW64\hfpapi.dll
Filesize
244KB

MD5
baaf0bb2223a01c6c554bd24c49dcc1c

SHA1
01b2f3d97fded0c45ce31e98aa894b60fcf0a7dc

SHA256
530a036b589e9c04e187ad2ca910d3b7ddb6f2e3b479dee6f08d62e4dc8c7094

SHA512
e0630320be0a14e25730b026911760d9cce9cc8bcd312a413a640585cb0806064ffb5f72056b94e88bd1f5eeda366c0198e6b37630728548ff9ab0dd522853f2

Download Submit
\Windows\SysWOW64\hfpapi.dll
Filesize
244KB

MD5
baaf0bb2223a01c6c554bd24c49dcc1c

SHA1
01b2f3d97fded0c45ce31e98aa894b60fcf0a7dc

SHA256
530a036b589e9c04e187ad2ca910d3b7ddb6f2e3b479dee6f08d62e4dc8c7094

SHA512
e0630320be0a14e25730b026911760d9cce9cc8bcd312a413a640585cb0806064ffb5f72056b94e88bd1f5eeda366c0198e6b37630728548ff9ab0dd522853f2

Download Submit
\Windows\SysWOW64\installd.exe
Filesize
108KB

MD5
12ca8395aeedf2a96a191d0a04172707

SHA1
d1413933b116ff3b7e062d4a328de63987e94253

SHA256
b21c4b144314c759682ed84545fe74ec27347c9ad914fd95c738272faaa3ccd9

SHA512
14d198174e78a5a76996fc2eda4f2f39cd9d28960a6935121af8f1680179ac1da20c85d7671e4558590487f3f305b3f939d8827c67d9e3ae20a348db2a0cc82b

Download Submit
\Windows\SysWOW64\nethtsrv.exe
Filesize
176KB

MD5
1b7bb3ef7be8afef9048f8d9677e2fc1

SHA1
4f6dd5f3f12495fe7b3120dd3b83ca22d5a109ad

SHA256
8f4228e65ed479cf1ac57d5ee7456c1bde5f9c87449d21301911b6b046785ff3

SHA512
c6ecd4f92d989d343c2b29bb2d69ff8cf00c7efeaa644b762d660a874ad8346ced4579835463b6b4e781fb29ab87da51387437e06061a48bbcaadfdfb6df0ad5

Download Submit
\Windows\SysWOW64\netupdsrv.exe
Filesize
158KB

MD5
e8b071f268c54b26cffd6996f24ae234

SHA1
c61bec9a1e122571a08dc6bad3d85b744d1bedc6

SHA256
c9a42e37ab6aa2600e44542641dd745d44b1be7e8b1a330e0b08e2d0195c6ceb

SHA512
d3817aa57859a4b2ee0dbaabbcfc88a89c6649aea326139d025a34c0ddb8948c24f3066bb991f9de82a5cd2bf815dd0fdcb60f54e26d2db0cea92ece9fb12691

Download Submit
memory/272-71-0x0000000000000000-mapping.dmp

Download
memory/360-88-0x0000000000000000-mapping.dmp

Download
memory/384-81-0x0000000000000000-mapping.dmp

Download
memory/948-57-0x0000000000000000-mapping.dmp

Download
memory/1156-64-0x0000000000000000-mapping.dmp

Download
memory/1380-61-0x0000000000000000-mapping.dmp

Download
memory/1664-82-0x0000000000000000-mapping.dmp

Download
memory/1760-58-0x0000000000000000-mapping.dmp

Download
memory/1768-62-0x0000000000000000-mapping.dmp

Download
memory/1920-87-0x0000000000000000-mapping.dmp

Download
memory/1968-59-0x0000000000360000-0x00000000007BE000-memory.dmp

Filesize
4.4MB

Download
memory/1968-54-0x0000000075141000-0x0000000075143000-memory.dmp

Filesize
8KB

Download
memory/1968-69-0x0000000000360000-0x00000000007BE000-memory.dmp

Filesize
4.4MB

Download
memory/1968-91-0x0000000000360000-0x00000000007BE000-memory.dmp

Filesize
4.4MB

Download
memory/2028-77-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads