71472fcc8b8900ec069b2ac1e4d68429b016306b4f2d8beb86cb9b3693fc1222

Analysis

max time kernel
45s
max time network
35s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
23-11-2022 10:23

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

71472fcc8b8900ec069b2ac1e4d68429b016306b4f2d8beb86cb9b3693fc1222.exe
Size

598KB
MD5

f131d2f944bff5d290a65d0d0e21c194
SHA1

910777bd76cef9e234ebcb1d59d7abebe254c29b
SHA256

71472fcc8b8900ec069b2ac1e4d68429b016306b4f2d8beb86cb9b3693fc1222
SHA512

d3ed98eb5155d71672fa968b6c1af12e62b3d9434c8d63c368ada5eafe27f9251b4f0be14f241cf11c53847832c19e3f81e850cc907c73ec68e95081e9146b0c
SSDEEP

12288:9Iny5DYTdEIJHaec3Y3sLl5yn3N3F1Dw8dZ7ks6RLjGYx6nUd:pUTXJzcIKyn9PDJ+swLSYwo

Score

8^/10

discovery

Malware Config

Signatures

Drops file in Drivers directory 1 IoCs

Processes:

71472fcc8b8900ec069b2ac1e4d68429b016306b4f2d8beb86cb9b3693fc1222.exe

description ioc process

File created C:\Windows\system32\drivers\nethfdrv.sys 71472fcc8b8900ec069b2ac1e4d68429b016306b4f2d8beb86cb9b3693fc1222.exe
Executes dropped EXE 5 IoCs

Processes:

installd.exenethtsrv.exenetupdsrv.exenethtsrv.exenetupdsrv.exe

pid process

580 installd.exe
364 nethtsrv.exe
1240 netupdsrv.exe
1296 nethtsrv.exe
1908 netupdsrv.exe

description	ioc	process
File created	C:\Windows\system32\drivers\nethfdrv.sys	71472fcc8b8900ec069b2ac1e4d68429b016306b4f2d8beb86cb9b3693fc1222.exe

pid	process
580	installd.exe
364	nethtsrv.exe
1240	netupdsrv.exe
1296	nethtsrv.exe
1908	netupdsrv.exe

Loads dropped DLL 13 IoCs

Processes:

71472fcc8b8900ec069b2ac1e4d68429b016306b4f2d8beb86cb9b3693fc1222.exeinstalld.exenethtsrv.exenethtsrv.exe

pid	process
1200	71472fcc8b8900ec069b2ac1e4d68429b016306b4f2d8beb86cb9b3693fc1222.exe
1200	71472fcc8b8900ec069b2ac1e4d68429b016306b4f2d8beb86cb9b3693fc1222.exe
1200	71472fcc8b8900ec069b2ac1e4d68429b016306b4f2d8beb86cb9b3693fc1222.exe
1200	71472fcc8b8900ec069b2ac1e4d68429b016306b4f2d8beb86cb9b3693fc1222.exe
580	installd.exe
1200	71472fcc8b8900ec069b2ac1e4d68429b016306b4f2d8beb86cb9b3693fc1222.exe
364	nethtsrv.exe
364	nethtsrv.exe
1200	71472fcc8b8900ec069b2ac1e4d68429b016306b4f2d8beb86cb9b3693fc1222.exe
1200	71472fcc8b8900ec069b2ac1e4d68429b016306b4f2d8beb86cb9b3693fc1222.exe
1296	nethtsrv.exe
1296	nethtsrv.exe
1200	71472fcc8b8900ec069b2ac1e4d68429b016306b4f2d8beb86cb9b3693fc1222.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in System32 directory 5 IoCs

Processes:

71472fcc8b8900ec069b2ac1e4d68429b016306b4f2d8beb86cb9b3693fc1222.exe

description	ioc	process
File created	C:\Windows\SysWOW64\installd.exe	71472fcc8b8900ec069b2ac1e4d68429b016306b4f2d8beb86cb9b3693fc1222.exe
File created	C:\Windows\SysWOW64\nethtsrv.exe	71472fcc8b8900ec069b2ac1e4d68429b016306b4f2d8beb86cb9b3693fc1222.exe
File created	C:\Windows\SysWOW64\netupdsrv.exe	71472fcc8b8900ec069b2ac1e4d68429b016306b4f2d8beb86cb9b3693fc1222.exe
File created	C:\Windows\SysWOW64\hfnapi.dll	71472fcc8b8900ec069b2ac1e4d68429b016306b4f2d8beb86cb9b3693fc1222.exe
File created	C:\Windows\SysWOW64\hfpapi.dll	71472fcc8b8900ec069b2ac1e4d68429b016306b4f2d8beb86cb9b3693fc1222.exe

Drops file in Program Files directory 3 IoCs

Processes:

71472fcc8b8900ec069b2ac1e4d68429b016306b4f2d8beb86cb9b3693fc1222.exe

description	ioc	process
File created	C:\Program Files (x86)\Common Files\Config\data.xml	71472fcc8b8900ec069b2ac1e4d68429b016306b4f2d8beb86cb9b3693fc1222.exe
File created	C:\Program Files (x86)\Common Files\Config\ver.xml	71472fcc8b8900ec069b2ac1e4d68429b016306b4f2d8beb86cb9b3693fc1222.exe
File created	C:\Program Files (x86)\Common Files\config\uninstinethnfd.exe	71472fcc8b8900ec069b2ac1e4d68429b016306b4f2d8beb86cb9b3693fc1222.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Runs net.exe
Suspicious behavior: LoadsDriver 1 IoCs

Processes:

pid process

460
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

nethtsrv.exe

description pid process

Token: SeDebugPrivilege 1296 nethtsrv.exe

pid	process
460

description	pid	process
Token: SeDebugPrivilege	1296	nethtsrv.exe

Suspicious use of WriteProcessMemory 50 IoCs

Processes:

71472fcc8b8900ec069b2ac1e4d68429b016306b4f2d8beb86cb9b3693fc1222.exenet.exenet.exenet.exenet.exe

description	pid	process	target process
PID 1200 wrote to memory of 1028	1200	71472fcc8b8900ec069b2ac1e4d68429b016306b4f2d8beb86cb9b3693fc1222.exe	net.exe
PID 1200 wrote to memory of 1028	1200	71472fcc8b8900ec069b2ac1e4d68429b016306b4f2d8beb86cb9b3693fc1222.exe	net.exe
PID 1200 wrote to memory of 1028	1200	71472fcc8b8900ec069b2ac1e4d68429b016306b4f2d8beb86cb9b3693fc1222.exe	net.exe
PID 1200 wrote to memory of 1028	1200	71472fcc8b8900ec069b2ac1e4d68429b016306b4f2d8beb86cb9b3693fc1222.exe	net.exe
PID 1028 wrote to memory of 1652	1028	net.exe	net1.exe
PID 1028 wrote to memory of 1652	1028	net.exe	net1.exe
PID 1028 wrote to memory of 1652	1028	net.exe	net1.exe
PID 1028 wrote to memory of 1652	1028	net.exe	net1.exe
PID 1200 wrote to memory of 592	1200	71472fcc8b8900ec069b2ac1e4d68429b016306b4f2d8beb86cb9b3693fc1222.exe	net.exe
PID 1200 wrote to memory of 592	1200	71472fcc8b8900ec069b2ac1e4d68429b016306b4f2d8beb86cb9b3693fc1222.exe	net.exe
PID 1200 wrote to memory of 592	1200	71472fcc8b8900ec069b2ac1e4d68429b016306b4f2d8beb86cb9b3693fc1222.exe	net.exe
PID 1200 wrote to memory of 592	1200	71472fcc8b8900ec069b2ac1e4d68429b016306b4f2d8beb86cb9b3693fc1222.exe	net.exe
PID 592 wrote to memory of 1484	592	net.exe	net1.exe
PID 592 wrote to memory of 1484	592	net.exe	net1.exe
PID 592 wrote to memory of 1484	592	net.exe	net1.exe
PID 592 wrote to memory of 1484	592	net.exe	net1.exe
PID 1200 wrote to memory of 580	1200	71472fcc8b8900ec069b2ac1e4d68429b016306b4f2d8beb86cb9b3693fc1222.exe	installd.exe
PID 1200 wrote to memory of 580	1200	71472fcc8b8900ec069b2ac1e4d68429b016306b4f2d8beb86cb9b3693fc1222.exe	installd.exe
PID 1200 wrote to memory of 580	1200	71472fcc8b8900ec069b2ac1e4d68429b016306b4f2d8beb86cb9b3693fc1222.exe	installd.exe
PID 1200 wrote to memory of 580	1200	71472fcc8b8900ec069b2ac1e4d68429b016306b4f2d8beb86cb9b3693fc1222.exe	installd.exe
PID 1200 wrote to memory of 580	1200	71472fcc8b8900ec069b2ac1e4d68429b016306b4f2d8beb86cb9b3693fc1222.exe	installd.exe
PID 1200 wrote to memory of 580	1200	71472fcc8b8900ec069b2ac1e4d68429b016306b4f2d8beb86cb9b3693fc1222.exe	installd.exe
PID 1200 wrote to memory of 580	1200	71472fcc8b8900ec069b2ac1e4d68429b016306b4f2d8beb86cb9b3693fc1222.exe	installd.exe
PID 1200 wrote to memory of 364	1200	71472fcc8b8900ec069b2ac1e4d68429b016306b4f2d8beb86cb9b3693fc1222.exe	nethtsrv.exe
PID 1200 wrote to memory of 364	1200	71472fcc8b8900ec069b2ac1e4d68429b016306b4f2d8beb86cb9b3693fc1222.exe	nethtsrv.exe
PID 1200 wrote to memory of 364	1200	71472fcc8b8900ec069b2ac1e4d68429b016306b4f2d8beb86cb9b3693fc1222.exe	nethtsrv.exe
PID 1200 wrote to memory of 364	1200	71472fcc8b8900ec069b2ac1e4d68429b016306b4f2d8beb86cb9b3693fc1222.exe	nethtsrv.exe
PID 1200 wrote to memory of 1240	1200	71472fcc8b8900ec069b2ac1e4d68429b016306b4f2d8beb86cb9b3693fc1222.exe	netupdsrv.exe
PID 1200 wrote to memory of 1240	1200	71472fcc8b8900ec069b2ac1e4d68429b016306b4f2d8beb86cb9b3693fc1222.exe	netupdsrv.exe
PID 1200 wrote to memory of 1240	1200	71472fcc8b8900ec069b2ac1e4d68429b016306b4f2d8beb86cb9b3693fc1222.exe	netupdsrv.exe
PID 1200 wrote to memory of 1240	1200	71472fcc8b8900ec069b2ac1e4d68429b016306b4f2d8beb86cb9b3693fc1222.exe	netupdsrv.exe
PID 1200 wrote to memory of 1240	1200	71472fcc8b8900ec069b2ac1e4d68429b016306b4f2d8beb86cb9b3693fc1222.exe	netupdsrv.exe
PID 1200 wrote to memory of 1240	1200	71472fcc8b8900ec069b2ac1e4d68429b016306b4f2d8beb86cb9b3693fc1222.exe	netupdsrv.exe
PID 1200 wrote to memory of 1240	1200	71472fcc8b8900ec069b2ac1e4d68429b016306b4f2d8beb86cb9b3693fc1222.exe	netupdsrv.exe
PID 1200 wrote to memory of 972	1200	71472fcc8b8900ec069b2ac1e4d68429b016306b4f2d8beb86cb9b3693fc1222.exe	net.exe
PID 1200 wrote to memory of 972	1200	71472fcc8b8900ec069b2ac1e4d68429b016306b4f2d8beb86cb9b3693fc1222.exe	net.exe
PID 1200 wrote to memory of 972	1200	71472fcc8b8900ec069b2ac1e4d68429b016306b4f2d8beb86cb9b3693fc1222.exe	net.exe
PID 1200 wrote to memory of 972	1200	71472fcc8b8900ec069b2ac1e4d68429b016306b4f2d8beb86cb9b3693fc1222.exe	net.exe
PID 972 wrote to memory of 1624	972	net.exe	net1.exe
PID 972 wrote to memory of 1624	972	net.exe	net1.exe
PID 972 wrote to memory of 1624	972	net.exe	net1.exe
PID 972 wrote to memory of 1624	972	net.exe	net1.exe
PID 1200 wrote to memory of 1748	1200	71472fcc8b8900ec069b2ac1e4d68429b016306b4f2d8beb86cb9b3693fc1222.exe	net.exe
PID 1200 wrote to memory of 1748	1200	71472fcc8b8900ec069b2ac1e4d68429b016306b4f2d8beb86cb9b3693fc1222.exe	net.exe
PID 1200 wrote to memory of 1748	1200	71472fcc8b8900ec069b2ac1e4d68429b016306b4f2d8beb86cb9b3693fc1222.exe	net.exe
PID 1200 wrote to memory of 1748	1200	71472fcc8b8900ec069b2ac1e4d68429b016306b4f2d8beb86cb9b3693fc1222.exe	net.exe
PID 1748 wrote to memory of 1752	1748	net.exe	net1.exe
PID 1748 wrote to memory of 1752	1748	net.exe	net1.exe
PID 1748 wrote to memory of 1752	1748	net.exe	net1.exe
PID 1748 wrote to memory of 1752	1748	net.exe	net1.exe

C:\Users\Admin\AppData\Local\Temp\71472fcc8b8900ec069b2ac1e4d68429b016306b4f2d8beb86cb9b3693fc1222.exe
"C:\Users\Admin\AppData\Local\Temp\71472fcc8b8900ec069b2ac1e4d68429b016306b4f2d8beb86cb9b3693fc1222.exe"
1⤵
- Drops file in Drivers directory
- Loads dropped DLL
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:1200

C:\Windows\SysWOW64\net.exe
net stop nethttpservice
2⤵
- Suspicious use of WriteProcessMemory
PID:1028

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop nethttpservice
3⤵
PID:1652

C:\Windows\SysWOW64\net.exe
net stop serviceupdater
2⤵
- Suspicious use of WriteProcessMemory
PID:592

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop serviceupdater
3⤵
PID:1484

C:\Windows\SysWOW64\installd.exe
"C:\Windows\system32\installd.exe" nethfdrv
2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:580

C:\Windows\SysWOW64\nethtsrv.exe
"C:\Windows\system32\nethtsrv.exe" -nfdi
2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:364

C:\Windows\SysWOW64\netupdsrv.exe
"C:\Windows\system32\netupdsrv.exe" -nfdi
2⤵
- Executes dropped EXE
PID:1240

C:\Windows\SysWOW64\net.exe
net start nethttpservice
2⤵
- Suspicious use of WriteProcessMemory
PID:972

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 start nethttpservice
3⤵
PID:1624

C:\Windows\SysWOW64\net.exe
net start serviceupdater
2⤵
- Suspicious use of WriteProcessMemory
PID:1748

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 start serviceupdater
3⤵
PID:1752

C:\Windows\SysWOW64\nethtsrv.exe
C:\Windows\SysWOW64\nethtsrv.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:1296

C:\Windows\SysWOW64\netupdsrv.exe
C:\Windows\SysWOW64\netupdsrv.exe
1⤵
- Executes dropped EXE
PID:1908

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\hfnapi.dll
Filesize
106KB

MD5
4e7db26ab9efe3ee88a213486778726d

SHA1
4caa49f7b70c79dad1a5f125107b64676bfaa3fa

SHA256
3724ed6ddc4f47e7e3972b211e5e6109d830c46fd26ddb20166a281afe104a77

SHA512
ae1288710bd0491bf6bf47e4c7c85391a4f90e0647aac55560162480b5b6a05ffa89cef81336b4e1ebd693dccbde45c555f2689e489bd718494ef1b7d3ecb298

Download Submit
C:\Windows\SysWOW64\hfpapi.dll
Filesize
241KB

MD5
de9ffccc3ca7547f588e9c7164980f23

SHA1
977bcf56df57b6fa3ffac312a9cf0b43467baa4b

SHA256
29b0113921c452d32d8702117eb2a1920894bed381aaa20ef5a62f444a4bd5ec

SHA512
813c30537f2e34e9d2f2476ae01253e7e172cc91e87919f18b218a97b946e3d316d567b396dde260c43b35fbd510a8d8ceda0d843a48f5b1ea1d91fac4941a28

Download Submit
C:\Windows\SysWOW64\installd.exe
Filesize
108KB

MD5
576955930d812caf2f9f8fd2664a5445

SHA1
35b2c5335286901ccd9010ccaf2b7eb1d25d5c28

SHA256
beaccbe2911c3333f6caa351d1a94b02a021ab9ee34f77d0299fce3c3ed4c765

SHA512
a24f85dc0988e32492540a1078c3f3d3154e664f3062980538fa0fe3ebdb72b280d6a16965462d08567085d0a0af787c0f93ce675534fff737470cc280c2cba1

Download Submit
C:\Windows\SysWOW64\nethtsrv.exe
Filesize
176KB

MD5
dc4a4ad2d9c74a0b50ad7a09e191ba5b

SHA1
df5f9b91124b35650134d2bf83aff2cab9903527

SHA256
5311aca33b1d0328ec1aa33e08391877a86a1ac9d0b991673bb885ab1663d6df

SHA512
9f8b638cb47c332248d63673ec0306856d72862c0cf1c1cf1693519b0ff8b18bdb5b385de4d7b3c2d67334b659cefd26d3588c8978c9cb1cd55099cb4624135c

Download Submit
C:\Windows\SysWOW64\nethtsrv.exe
Filesize
176KB

MD5
dc4a4ad2d9c74a0b50ad7a09e191ba5b

SHA1
df5f9b91124b35650134d2bf83aff2cab9903527

SHA256
5311aca33b1d0328ec1aa33e08391877a86a1ac9d0b991673bb885ab1663d6df

SHA512
9f8b638cb47c332248d63673ec0306856d72862c0cf1c1cf1693519b0ff8b18bdb5b385de4d7b3c2d67334b659cefd26d3588c8978c9cb1cd55099cb4624135c

Download Submit
C:\Windows\SysWOW64\netupdsrv.exe
Filesize
158KB

MD5
b7e5c9fcd8a1b328617256a020bac927

SHA1
23509befa9644d4eee1fb5cb765072c54557929e

SHA256
3e8e195c2af391eb2dcba38b6b4f5b18b81317be2ad093400ce54c84b2db206b

SHA512
684c3afaff474174da4042dc0c757c3368a90ba745aed567cd724a8a697cf585d2d0f3e41d9058c8837a77473695b0dcbb2473213ae0aef87a5b024e45da4a7e

Download Submit
C:\Windows\SysWOW64\netupdsrv.exe
Filesize
158KB

MD5
b7e5c9fcd8a1b328617256a020bac927

SHA1
23509befa9644d4eee1fb5cb765072c54557929e

SHA256
3e8e195c2af391eb2dcba38b6b4f5b18b81317be2ad093400ce54c84b2db206b

SHA512
684c3afaff474174da4042dc0c757c3368a90ba745aed567cd724a8a697cf585d2d0f3e41d9058c8837a77473695b0dcbb2473213ae0aef87a5b024e45da4a7e

Download Submit
\Users\Admin\AppData\Local\Temp\nseA92E.tmp\System.dll
Filesize
11KB

MD5
c17103ae9072a06da581dec998343fc1

SHA1
b72148c6bdfaada8b8c3f950e610ee7cf1da1f8d

SHA256
dc58d8ad81cacb0c1ed72e33bff8f23ea40b5252b5bb55d393a0903e6819ae2f

SHA512
d32a71aaef18e993f28096d536e41c4d016850721b31171513ce28bbd805a54fd290b7c3e9d935f72e676a1acfb4f0dcc89d95040a0dd29f2b6975855c18986f

Download Submit
\Users\Admin\AppData\Local\Temp\nseA92E.tmp\nsExec.dll
Filesize
6KB

MD5
acc2b699edfea5bf5aae45aba3a41e96

SHA1
d2accf4d494e43ceb2cff69abe4dd17147d29cc2

SHA256
168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e

SHA512
e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe

Download Submit
\Users\Admin\AppData\Local\Temp\nseA92E.tmp\nsExec.dll
Filesize
6KB

MD5
acc2b699edfea5bf5aae45aba3a41e96

SHA1
d2accf4d494e43ceb2cff69abe4dd17147d29cc2

SHA256
168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e

SHA512
e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe

Download Submit
\Users\Admin\AppData\Local\Temp\nseA92E.tmp\nsExec.dll
Filesize
6KB

MD5
acc2b699edfea5bf5aae45aba3a41e96

SHA1
d2accf4d494e43ceb2cff69abe4dd17147d29cc2

SHA256
168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e

SHA512
e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe

Download Submit
\Users\Admin\AppData\Local\Temp\nseA92E.tmp\nsExec.dll
Filesize
6KB

MD5
acc2b699edfea5bf5aae45aba3a41e96

SHA1
d2accf4d494e43ceb2cff69abe4dd17147d29cc2

SHA256
168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e

SHA512
e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe

Download Submit
\Windows\SysWOW64\hfnapi.dll
Filesize
106KB

MD5
4e7db26ab9efe3ee88a213486778726d

SHA1
4caa49f7b70c79dad1a5f125107b64676bfaa3fa

SHA256
3724ed6ddc4f47e7e3972b211e5e6109d830c46fd26ddb20166a281afe104a77

SHA512
ae1288710bd0491bf6bf47e4c7c85391a4f90e0647aac55560162480b5b6a05ffa89cef81336b4e1ebd693dccbde45c555f2689e489bd718494ef1b7d3ecb298

Download Submit
\Windows\SysWOW64\hfnapi.dll
Filesize
106KB

MD5
4e7db26ab9efe3ee88a213486778726d

SHA1
4caa49f7b70c79dad1a5f125107b64676bfaa3fa

SHA256
3724ed6ddc4f47e7e3972b211e5e6109d830c46fd26ddb20166a281afe104a77

SHA512
ae1288710bd0491bf6bf47e4c7c85391a4f90e0647aac55560162480b5b6a05ffa89cef81336b4e1ebd693dccbde45c555f2689e489bd718494ef1b7d3ecb298

Download Submit
\Windows\SysWOW64\hfnapi.dll
Filesize
106KB

MD5
4e7db26ab9efe3ee88a213486778726d

SHA1
4caa49f7b70c79dad1a5f125107b64676bfaa3fa

SHA256
3724ed6ddc4f47e7e3972b211e5e6109d830c46fd26ddb20166a281afe104a77

SHA512
ae1288710bd0491bf6bf47e4c7c85391a4f90e0647aac55560162480b5b6a05ffa89cef81336b4e1ebd693dccbde45c555f2689e489bd718494ef1b7d3ecb298

Download Submit
\Windows\SysWOW64\hfpapi.dll
Filesize
241KB

MD5
de9ffccc3ca7547f588e9c7164980f23

SHA1
977bcf56df57b6fa3ffac312a9cf0b43467baa4b

SHA256
29b0113921c452d32d8702117eb2a1920894bed381aaa20ef5a62f444a4bd5ec

SHA512
813c30537f2e34e9d2f2476ae01253e7e172cc91e87919f18b218a97b946e3d316d567b396dde260c43b35fbd510a8d8ceda0d843a48f5b1ea1d91fac4941a28

Download Submit
\Windows\SysWOW64\hfpapi.dll
Filesize
241KB

MD5
de9ffccc3ca7547f588e9c7164980f23

SHA1
977bcf56df57b6fa3ffac312a9cf0b43467baa4b

SHA256
29b0113921c452d32d8702117eb2a1920894bed381aaa20ef5a62f444a4bd5ec

SHA512
813c30537f2e34e9d2f2476ae01253e7e172cc91e87919f18b218a97b946e3d316d567b396dde260c43b35fbd510a8d8ceda0d843a48f5b1ea1d91fac4941a28

Download Submit
\Windows\SysWOW64\installd.exe
Filesize
108KB

MD5
576955930d812caf2f9f8fd2664a5445

SHA1
35b2c5335286901ccd9010ccaf2b7eb1d25d5c28

SHA256
beaccbe2911c3333f6caa351d1a94b02a021ab9ee34f77d0299fce3c3ed4c765

SHA512
a24f85dc0988e32492540a1078c3f3d3154e664f3062980538fa0fe3ebdb72b280d6a16965462d08567085d0a0af787c0f93ce675534fff737470cc280c2cba1

Download Submit
\Windows\SysWOW64\nethtsrv.exe
Filesize
176KB

MD5
dc4a4ad2d9c74a0b50ad7a09e191ba5b

SHA1
df5f9b91124b35650134d2bf83aff2cab9903527

SHA256
5311aca33b1d0328ec1aa33e08391877a86a1ac9d0b991673bb885ab1663d6df

SHA512
9f8b638cb47c332248d63673ec0306856d72862c0cf1c1cf1693519b0ff8b18bdb5b385de4d7b3c2d67334b659cefd26d3588c8978c9cb1cd55099cb4624135c

Download Submit
\Windows\SysWOW64\netupdsrv.exe
Filesize
158KB

MD5
b7e5c9fcd8a1b328617256a020bac927

SHA1
23509befa9644d4eee1fb5cb765072c54557929e

SHA256
3e8e195c2af391eb2dcba38b6b4f5b18b81317be2ad093400ce54c84b2db206b

SHA512
684c3afaff474174da4042dc0c757c3368a90ba745aed567cd724a8a697cf585d2d0f3e41d9058c8837a77473695b0dcbb2473213ae0aef87a5b024e45da4a7e

Download Submit
memory/364-70-0x0000000000000000-mapping.dmp

Download
memory/580-64-0x0000000000000000-mapping.dmp

Download
memory/592-61-0x0000000000000000-mapping.dmp

Download
memory/972-80-0x0000000000000000-mapping.dmp

Download
memory/1028-58-0x0000000000000000-mapping.dmp

Download
memory/1200-54-0x0000000075C21000-0x0000000075C23000-memory.dmp

Filesize
8KB

Download
memory/1200-55-0x0000000000360000-0x00000000007BE000-memory.dmp

Filesize
4.4MB

Download
memory/1200-90-0x0000000000360000-0x00000000007BE000-memory.dmp

Filesize
4.4MB

Download
memory/1240-76-0x0000000000000000-mapping.dmp

Download
memory/1484-62-0x0000000000000000-mapping.dmp

Download
memory/1624-81-0x0000000000000000-mapping.dmp

Download
memory/1652-59-0x0000000000000000-mapping.dmp

Download
memory/1748-86-0x0000000000000000-mapping.dmp

Download
memory/1752-87-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads