67bb825361c9b4b089bae921dd8196feda2ca0a380eb1d2e53e9a5b01673e3d7

Analysis

max time kernel
42s
max time network
46s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
23-11-2022 10:24

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

67bb825361c9b4b089bae921dd8196feda2ca0a380eb1d2e53e9a5b01673e3d7.exe
Size

601KB
MD5

0238b861a1200b2e5ae4133be0428aaa
SHA1

e631695c3539b6b5b4078c40d8e5dae72891ae9a
SHA256

67bb825361c9b4b089bae921dd8196feda2ca0a380eb1d2e53e9a5b01673e3d7
SHA512

c19648d2a837dae48d6cdfeecf4956661aa61615a65dd03ceeeda6e488c11971b4a43fc3907209d5a208bdc855fa1c2e1a0d3613dc09584aaf47a25d2c69c6d2
SSDEEP

12288:FIny5DYTfZ9OAIDyQiCWKQuX5DsgLEAfHg0l5RDaGAmeqjx7zxq:xUTfrOAI9NW/WvEcHbzDaExB

Score

8^/10

discovery

Malware Config

Signatures

Drops file in Drivers directory 1 IoCs

Processes:

67bb825361c9b4b089bae921dd8196feda2ca0a380eb1d2e53e9a5b01673e3d7.exe

description ioc process

File created C:\Windows\system32\drivers\nethfdrv.sys 67bb825361c9b4b089bae921dd8196feda2ca0a380eb1d2e53e9a5b01673e3d7.exe
Executes dropped EXE 5 IoCs

Processes:

installd.exenethtsrv.exenetupdsrv.exenethtsrv.exenetupdsrv.exe

pid process

800 installd.exe
896 nethtsrv.exe
820 netupdsrv.exe
528 nethtsrv.exe
1492 netupdsrv.exe

description	ioc	process
File created	C:\Windows\system32\drivers\nethfdrv.sys	67bb825361c9b4b089bae921dd8196feda2ca0a380eb1d2e53e9a5b01673e3d7.exe

pid	process
800	installd.exe
896	nethtsrv.exe
820	netupdsrv.exe
528	nethtsrv.exe
1492	netupdsrv.exe

Loads dropped DLL 13 IoCs

Processes:

67bb825361c9b4b089bae921dd8196feda2ca0a380eb1d2e53e9a5b01673e3d7.exeinstalld.exenethtsrv.exenethtsrv.exe

pid	process
900	67bb825361c9b4b089bae921dd8196feda2ca0a380eb1d2e53e9a5b01673e3d7.exe
900	67bb825361c9b4b089bae921dd8196feda2ca0a380eb1d2e53e9a5b01673e3d7.exe
900	67bb825361c9b4b089bae921dd8196feda2ca0a380eb1d2e53e9a5b01673e3d7.exe
900	67bb825361c9b4b089bae921dd8196feda2ca0a380eb1d2e53e9a5b01673e3d7.exe
800	installd.exe
900	67bb825361c9b4b089bae921dd8196feda2ca0a380eb1d2e53e9a5b01673e3d7.exe
896	nethtsrv.exe
896	nethtsrv.exe
900	67bb825361c9b4b089bae921dd8196feda2ca0a380eb1d2e53e9a5b01673e3d7.exe
900	67bb825361c9b4b089bae921dd8196feda2ca0a380eb1d2e53e9a5b01673e3d7.exe
528	nethtsrv.exe
528	nethtsrv.exe
900	67bb825361c9b4b089bae921dd8196feda2ca0a380eb1d2e53e9a5b01673e3d7.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in System32 directory 5 IoCs

Processes:

67bb825361c9b4b089bae921dd8196feda2ca0a380eb1d2e53e9a5b01673e3d7.exe

description	ioc	process
File created	C:\Windows\SysWOW64\installd.exe	67bb825361c9b4b089bae921dd8196feda2ca0a380eb1d2e53e9a5b01673e3d7.exe
File created	C:\Windows\SysWOW64\nethtsrv.exe	67bb825361c9b4b089bae921dd8196feda2ca0a380eb1d2e53e9a5b01673e3d7.exe
File created	C:\Windows\SysWOW64\netupdsrv.exe	67bb825361c9b4b089bae921dd8196feda2ca0a380eb1d2e53e9a5b01673e3d7.exe
File created	C:\Windows\SysWOW64\hfnapi.dll	67bb825361c9b4b089bae921dd8196feda2ca0a380eb1d2e53e9a5b01673e3d7.exe
File created	C:\Windows\SysWOW64\hfpapi.dll	67bb825361c9b4b089bae921dd8196feda2ca0a380eb1d2e53e9a5b01673e3d7.exe

Drops file in Program Files directory 3 IoCs

Processes:

67bb825361c9b4b089bae921dd8196feda2ca0a380eb1d2e53e9a5b01673e3d7.exe

description	ioc	process
File created	C:\Program Files (x86)\Common Files\Config\data.xml	67bb825361c9b4b089bae921dd8196feda2ca0a380eb1d2e53e9a5b01673e3d7.exe
File created	C:\Program Files (x86)\Common Files\Config\ver.xml	67bb825361c9b4b089bae921dd8196feda2ca0a380eb1d2e53e9a5b01673e3d7.exe
File created	C:\Program Files (x86)\Common Files\config\uninstinethnfd.exe	67bb825361c9b4b089bae921dd8196feda2ca0a380eb1d2e53e9a5b01673e3d7.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Runs net.exe
Suspicious behavior: LoadsDriver 1 IoCs

Processes:

pid process

464
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

nethtsrv.exe

description pid process

Token: SeDebugPrivilege 528 nethtsrv.exe

pid	process
464

description	pid	process
Token: SeDebugPrivilege	528	nethtsrv.exe

Suspicious use of WriteProcessMemory 50 IoCs

Processes:

67bb825361c9b4b089bae921dd8196feda2ca0a380eb1d2e53e9a5b01673e3d7.exenet.exenet.exenet.exenet.exe

description	pid	process	target process
PID 900 wrote to memory of 884	900	67bb825361c9b4b089bae921dd8196feda2ca0a380eb1d2e53e9a5b01673e3d7.exe	net.exe
PID 900 wrote to memory of 884	900	67bb825361c9b4b089bae921dd8196feda2ca0a380eb1d2e53e9a5b01673e3d7.exe	net.exe
PID 900 wrote to memory of 884	900	67bb825361c9b4b089bae921dd8196feda2ca0a380eb1d2e53e9a5b01673e3d7.exe	net.exe
PID 900 wrote to memory of 884	900	67bb825361c9b4b089bae921dd8196feda2ca0a380eb1d2e53e9a5b01673e3d7.exe	net.exe
PID 884 wrote to memory of 1032	884	net.exe	net1.exe
PID 884 wrote to memory of 1032	884	net.exe	net1.exe
PID 884 wrote to memory of 1032	884	net.exe	net1.exe
PID 884 wrote to memory of 1032	884	net.exe	net1.exe
PID 900 wrote to memory of 1216	900	67bb825361c9b4b089bae921dd8196feda2ca0a380eb1d2e53e9a5b01673e3d7.exe	net.exe
PID 900 wrote to memory of 1216	900	67bb825361c9b4b089bae921dd8196feda2ca0a380eb1d2e53e9a5b01673e3d7.exe	net.exe
PID 900 wrote to memory of 1216	900	67bb825361c9b4b089bae921dd8196feda2ca0a380eb1d2e53e9a5b01673e3d7.exe	net.exe
PID 900 wrote to memory of 1216	900	67bb825361c9b4b089bae921dd8196feda2ca0a380eb1d2e53e9a5b01673e3d7.exe	net.exe
PID 1216 wrote to memory of 1876	1216	net.exe	net1.exe
PID 1216 wrote to memory of 1876	1216	net.exe	net1.exe
PID 1216 wrote to memory of 1876	1216	net.exe	net1.exe
PID 1216 wrote to memory of 1876	1216	net.exe	net1.exe
PID 900 wrote to memory of 800	900	67bb825361c9b4b089bae921dd8196feda2ca0a380eb1d2e53e9a5b01673e3d7.exe	installd.exe
PID 900 wrote to memory of 800	900	67bb825361c9b4b089bae921dd8196feda2ca0a380eb1d2e53e9a5b01673e3d7.exe	installd.exe
PID 900 wrote to memory of 800	900	67bb825361c9b4b089bae921dd8196feda2ca0a380eb1d2e53e9a5b01673e3d7.exe	installd.exe
PID 900 wrote to memory of 800	900	67bb825361c9b4b089bae921dd8196feda2ca0a380eb1d2e53e9a5b01673e3d7.exe	installd.exe
PID 900 wrote to memory of 800	900	67bb825361c9b4b089bae921dd8196feda2ca0a380eb1d2e53e9a5b01673e3d7.exe	installd.exe
PID 900 wrote to memory of 800	900	67bb825361c9b4b089bae921dd8196feda2ca0a380eb1d2e53e9a5b01673e3d7.exe	installd.exe
PID 900 wrote to memory of 800	900	67bb825361c9b4b089bae921dd8196feda2ca0a380eb1d2e53e9a5b01673e3d7.exe	installd.exe
PID 900 wrote to memory of 896	900	67bb825361c9b4b089bae921dd8196feda2ca0a380eb1d2e53e9a5b01673e3d7.exe	nethtsrv.exe
PID 900 wrote to memory of 896	900	67bb825361c9b4b089bae921dd8196feda2ca0a380eb1d2e53e9a5b01673e3d7.exe	nethtsrv.exe
PID 900 wrote to memory of 896	900	67bb825361c9b4b089bae921dd8196feda2ca0a380eb1d2e53e9a5b01673e3d7.exe	nethtsrv.exe
PID 900 wrote to memory of 896	900	67bb825361c9b4b089bae921dd8196feda2ca0a380eb1d2e53e9a5b01673e3d7.exe	nethtsrv.exe
PID 900 wrote to memory of 820	900	67bb825361c9b4b089bae921dd8196feda2ca0a380eb1d2e53e9a5b01673e3d7.exe	netupdsrv.exe
PID 900 wrote to memory of 820	900	67bb825361c9b4b089bae921dd8196feda2ca0a380eb1d2e53e9a5b01673e3d7.exe	netupdsrv.exe
PID 900 wrote to memory of 820	900	67bb825361c9b4b089bae921dd8196feda2ca0a380eb1d2e53e9a5b01673e3d7.exe	netupdsrv.exe
PID 900 wrote to memory of 820	900	67bb825361c9b4b089bae921dd8196feda2ca0a380eb1d2e53e9a5b01673e3d7.exe	netupdsrv.exe
PID 900 wrote to memory of 820	900	67bb825361c9b4b089bae921dd8196feda2ca0a380eb1d2e53e9a5b01673e3d7.exe	netupdsrv.exe
PID 900 wrote to memory of 820	900	67bb825361c9b4b089bae921dd8196feda2ca0a380eb1d2e53e9a5b01673e3d7.exe	netupdsrv.exe
PID 900 wrote to memory of 820	900	67bb825361c9b4b089bae921dd8196feda2ca0a380eb1d2e53e9a5b01673e3d7.exe	netupdsrv.exe
PID 900 wrote to memory of 1636	900	67bb825361c9b4b089bae921dd8196feda2ca0a380eb1d2e53e9a5b01673e3d7.exe	net.exe
PID 900 wrote to memory of 1636	900	67bb825361c9b4b089bae921dd8196feda2ca0a380eb1d2e53e9a5b01673e3d7.exe	net.exe
PID 900 wrote to memory of 1636	900	67bb825361c9b4b089bae921dd8196feda2ca0a380eb1d2e53e9a5b01673e3d7.exe	net.exe
PID 900 wrote to memory of 1636	900	67bb825361c9b4b089bae921dd8196feda2ca0a380eb1d2e53e9a5b01673e3d7.exe	net.exe
PID 1636 wrote to memory of 1472	1636	net.exe	net1.exe
PID 1636 wrote to memory of 1472	1636	net.exe	net1.exe
PID 1636 wrote to memory of 1472	1636	net.exe	net1.exe
PID 1636 wrote to memory of 1472	1636	net.exe	net1.exe
PID 900 wrote to memory of 1800	900	67bb825361c9b4b089bae921dd8196feda2ca0a380eb1d2e53e9a5b01673e3d7.exe	net.exe
PID 900 wrote to memory of 1800	900	67bb825361c9b4b089bae921dd8196feda2ca0a380eb1d2e53e9a5b01673e3d7.exe	net.exe
PID 900 wrote to memory of 1800	900	67bb825361c9b4b089bae921dd8196feda2ca0a380eb1d2e53e9a5b01673e3d7.exe	net.exe
PID 900 wrote to memory of 1800	900	67bb825361c9b4b089bae921dd8196feda2ca0a380eb1d2e53e9a5b01673e3d7.exe	net.exe
PID 1800 wrote to memory of 1580	1800	net.exe	net1.exe
PID 1800 wrote to memory of 1580	1800	net.exe	net1.exe
PID 1800 wrote to memory of 1580	1800	net.exe	net1.exe
PID 1800 wrote to memory of 1580	1800	net.exe	net1.exe

C:\Users\Admin\AppData\Local\Temp\67bb825361c9b4b089bae921dd8196feda2ca0a380eb1d2e53e9a5b01673e3d7.exe
"C:\Users\Admin\AppData\Local\Temp\67bb825361c9b4b089bae921dd8196feda2ca0a380eb1d2e53e9a5b01673e3d7.exe"
1⤵
- Drops file in Drivers directory
- Loads dropped DLL
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:900

C:\Windows\SysWOW64\net.exe
net stop nethttpservice
2⤵
- Suspicious use of WriteProcessMemory
PID:884

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop nethttpservice
3⤵
PID:1032

C:\Windows\SysWOW64\net.exe
net stop serviceupdater
2⤵
- Suspicious use of WriteProcessMemory
PID:1216

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop serviceupdater
3⤵
PID:1876

C:\Windows\SysWOW64\installd.exe
"C:\Windows\system32\installd.exe" nethfdrv
2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:800

C:\Windows\SysWOW64\nethtsrv.exe
"C:\Windows\system32\nethtsrv.exe" -nfdi
2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:896

C:\Windows\SysWOW64\netupdsrv.exe
"C:\Windows\system32\netupdsrv.exe" -nfdi
2⤵
- Executes dropped EXE
PID:820

C:\Windows\SysWOW64\net.exe
net start nethttpservice
2⤵
- Suspicious use of WriteProcessMemory
PID:1636

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 start nethttpservice
3⤵
PID:1472

C:\Windows\SysWOW64\net.exe
net start serviceupdater
2⤵
- Suspicious use of WriteProcessMemory
PID:1800

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 start serviceupdater
3⤵
PID:1580

C:\Windows\SysWOW64\nethtsrv.exe
C:\Windows\SysWOW64\nethtsrv.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:528

C:\Windows\SysWOW64\netupdsrv.exe
C:\Windows\SysWOW64\netupdsrv.exe
1⤵
- Executes dropped EXE
PID:1492

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\hfnapi.dll
Filesize
106KB

MD5
398f40f92813996f4c86842e452b7df7

SHA1
cba1806faa63eba92d6c6d172a5e0f596b61d10d

SHA256
286b5cc69c6d3037bfd81650ba9bd571db3a04bc19e7df309c93f0b87f05a9f8

SHA512
af19efbdb1543c364244f6f83e3df0029f5d08931632a10a8e349198d9e9c9f2cd7de5a18adf668384b93dc3613eb6523d8cfa529c8a97bfbd53dab06bcc80c7

Download Submit
C:\Windows\SysWOW64\hfpapi.dll
Filesize
241KB

MD5
b8d7a18caf60ecaa6689368bc99bd113

SHA1
32619fd7af42acde7f6af26f668c20db0ae70060

SHA256
25d7d4d388bff3e92c920bb868e9dd1bba69fe59d041060f6e8c21ce4f599f61

SHA512
0cbfcbf676203b123ca3d49d02cc9b151f05c3ac49123b2d12431f653d3e0d689a0e3e48f9264814540e15a7aac241b50466a9b9a69b0ec537d0dc1c71eb4a7c

Download Submit
C:\Windows\SysWOW64\installd.exe
Filesize
108KB

MD5
acdd3743ab1e426c2021a9caa4bbfeeb

SHA1
9e9a52080bcb4d531518ebd47094f8033788a028

SHA256
a6990b7c1572357ca8c88609ae9b4dcd592e4a9abd9ffb40960a4d2a0c277652

SHA512
711b1c0707aa9c0a96d3d10b98c59524031e66d350786802e6b480ea9d0cf3dfc009d1405ba27f1cc9fdaa2b552df9c73e044dc618bc10e09e4d17adb4cdb0ba

Download Submit
C:\Windows\SysWOW64\nethtsrv.exe
Filesize
176KB

MD5
ef9b70af2d828b10c3ae21d46b6f33ed

SHA1
8a807cdb688b97670211e0442fc77e2888c9212a

SHA256
65159839a66ae88b43301a7e1a3daeeab3d59149554928a710933962a4335d95

SHA512
b37b948c6938b5e270cdb7efea9c610d19aa8a5fd314e6792137b38b777b02ce6991b582985ca4bd9126bf9024bf5b538339a0e20eaf89762ba6f07baace62c5

Download Submit
C:\Windows\SysWOW64\nethtsrv.exe
Filesize
176KB

MD5
ef9b70af2d828b10c3ae21d46b6f33ed

SHA1
8a807cdb688b97670211e0442fc77e2888c9212a

SHA256
65159839a66ae88b43301a7e1a3daeeab3d59149554928a710933962a4335d95

SHA512
b37b948c6938b5e270cdb7efea9c610d19aa8a5fd314e6792137b38b777b02ce6991b582985ca4bd9126bf9024bf5b538339a0e20eaf89762ba6f07baace62c5

Download Submit
C:\Windows\SysWOW64\netupdsrv.exe
Filesize
158KB

MD5
9fad180b00f9216e662547332d25d1e9

SHA1
c80cade1a036df9ac844f8ade9b353a2465e51fa

SHA256
df0891f2b2e61d64c17bfdc986f87f3a7ee7280641a90fbb7e339be99668bcab

SHA512
85dd7989c0961fcca053d5f05da362da2cedfa3d363f43708381542792bb28cd736058b7ef2f29341acce21bcfcdf2f983589b6e72751878750501e52ba8c521

Download Submit
C:\Windows\SysWOW64\netupdsrv.exe
Filesize
158KB

MD5
9fad180b00f9216e662547332d25d1e9

SHA1
c80cade1a036df9ac844f8ade9b353a2465e51fa

SHA256
df0891f2b2e61d64c17bfdc986f87f3a7ee7280641a90fbb7e339be99668bcab

SHA512
85dd7989c0961fcca053d5f05da362da2cedfa3d363f43708381542792bb28cd736058b7ef2f29341acce21bcfcdf2f983589b6e72751878750501e52ba8c521

Download Submit
\Users\Admin\AppData\Local\Temp\nsd125B.tmp\System.dll
Filesize
11KB

MD5
c17103ae9072a06da581dec998343fc1

SHA1
b72148c6bdfaada8b8c3f950e610ee7cf1da1f8d

SHA256
dc58d8ad81cacb0c1ed72e33bff8f23ea40b5252b5bb55d393a0903e6819ae2f

SHA512
d32a71aaef18e993f28096d536e41c4d016850721b31171513ce28bbd805a54fd290b7c3e9d935f72e676a1acfb4f0dcc89d95040a0dd29f2b6975855c18986f

Download Submit
\Users\Admin\AppData\Local\Temp\nsd125B.tmp\nsExec.dll
Filesize
6KB

MD5
acc2b699edfea5bf5aae45aba3a41e96

SHA1
d2accf4d494e43ceb2cff69abe4dd17147d29cc2

SHA256
168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e

SHA512
e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe

Download Submit
\Users\Admin\AppData\Local\Temp\nsd125B.tmp\nsExec.dll
Filesize
6KB

MD5
acc2b699edfea5bf5aae45aba3a41e96

SHA1
d2accf4d494e43ceb2cff69abe4dd17147d29cc2

SHA256
168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e

SHA512
e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe

Download Submit
\Users\Admin\AppData\Local\Temp\nsd125B.tmp\nsExec.dll
Filesize
6KB

MD5
acc2b699edfea5bf5aae45aba3a41e96

SHA1
d2accf4d494e43ceb2cff69abe4dd17147d29cc2

SHA256
168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e

SHA512
e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe

Download Submit
\Users\Admin\AppData\Local\Temp\nsd125B.tmp\nsExec.dll
Filesize
6KB

MD5
acc2b699edfea5bf5aae45aba3a41e96

SHA1
d2accf4d494e43ceb2cff69abe4dd17147d29cc2

SHA256
168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e

SHA512
e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe

Download Submit
\Windows\SysWOW64\hfnapi.dll
Filesize
106KB

MD5
398f40f92813996f4c86842e452b7df7

SHA1
cba1806faa63eba92d6c6d172a5e0f596b61d10d

SHA256
286b5cc69c6d3037bfd81650ba9bd571db3a04bc19e7df309c93f0b87f05a9f8

SHA512
af19efbdb1543c364244f6f83e3df0029f5d08931632a10a8e349198d9e9c9f2cd7de5a18adf668384b93dc3613eb6523d8cfa529c8a97bfbd53dab06bcc80c7

Download Submit
\Windows\SysWOW64\hfnapi.dll
Filesize
106KB

MD5
398f40f92813996f4c86842e452b7df7

SHA1
cba1806faa63eba92d6c6d172a5e0f596b61d10d

SHA256
286b5cc69c6d3037bfd81650ba9bd571db3a04bc19e7df309c93f0b87f05a9f8

SHA512
af19efbdb1543c364244f6f83e3df0029f5d08931632a10a8e349198d9e9c9f2cd7de5a18adf668384b93dc3613eb6523d8cfa529c8a97bfbd53dab06bcc80c7

Download Submit
\Windows\SysWOW64\hfnapi.dll
Filesize
106KB

MD5
398f40f92813996f4c86842e452b7df7

SHA1
cba1806faa63eba92d6c6d172a5e0f596b61d10d

SHA256
286b5cc69c6d3037bfd81650ba9bd571db3a04bc19e7df309c93f0b87f05a9f8

SHA512
af19efbdb1543c364244f6f83e3df0029f5d08931632a10a8e349198d9e9c9f2cd7de5a18adf668384b93dc3613eb6523d8cfa529c8a97bfbd53dab06bcc80c7

Download Submit
\Windows\SysWOW64\hfpapi.dll
Filesize
241KB

MD5
b8d7a18caf60ecaa6689368bc99bd113

SHA1
32619fd7af42acde7f6af26f668c20db0ae70060

SHA256
25d7d4d388bff3e92c920bb868e9dd1bba69fe59d041060f6e8c21ce4f599f61

SHA512
0cbfcbf676203b123ca3d49d02cc9b151f05c3ac49123b2d12431f653d3e0d689a0e3e48f9264814540e15a7aac241b50466a9b9a69b0ec537d0dc1c71eb4a7c

Download Submit
\Windows\SysWOW64\hfpapi.dll
Filesize
241KB

MD5
b8d7a18caf60ecaa6689368bc99bd113

SHA1
32619fd7af42acde7f6af26f668c20db0ae70060

SHA256
25d7d4d388bff3e92c920bb868e9dd1bba69fe59d041060f6e8c21ce4f599f61

SHA512
0cbfcbf676203b123ca3d49d02cc9b151f05c3ac49123b2d12431f653d3e0d689a0e3e48f9264814540e15a7aac241b50466a9b9a69b0ec537d0dc1c71eb4a7c

Download Submit
\Windows\SysWOW64\installd.exe
Filesize
108KB

MD5
acdd3743ab1e426c2021a9caa4bbfeeb

SHA1
9e9a52080bcb4d531518ebd47094f8033788a028

SHA256
a6990b7c1572357ca8c88609ae9b4dcd592e4a9abd9ffb40960a4d2a0c277652

SHA512
711b1c0707aa9c0a96d3d10b98c59524031e66d350786802e6b480ea9d0cf3dfc009d1405ba27f1cc9fdaa2b552df9c73e044dc618bc10e09e4d17adb4cdb0ba

Download Submit
\Windows\SysWOW64\nethtsrv.exe
Filesize
176KB

MD5
ef9b70af2d828b10c3ae21d46b6f33ed

SHA1
8a807cdb688b97670211e0442fc77e2888c9212a

SHA256
65159839a66ae88b43301a7e1a3daeeab3d59149554928a710933962a4335d95

SHA512
b37b948c6938b5e270cdb7efea9c610d19aa8a5fd314e6792137b38b777b02ce6991b582985ca4bd9126bf9024bf5b538339a0e20eaf89762ba6f07baace62c5

Download Submit
\Windows\SysWOW64\netupdsrv.exe
Filesize
158KB

MD5
9fad180b00f9216e662547332d25d1e9

SHA1
c80cade1a036df9ac844f8ade9b353a2465e51fa

SHA256
df0891f2b2e61d64c17bfdc986f87f3a7ee7280641a90fbb7e339be99668bcab

SHA512
85dd7989c0961fcca053d5f05da362da2cedfa3d363f43708381542792bb28cd736058b7ef2f29341acce21bcfcdf2f983589b6e72751878750501e52ba8c521

Download Submit
memory/800-64-0x0000000000000000-mapping.dmp

Download
memory/820-76-0x0000000000000000-mapping.dmp

Download
memory/884-57-0x0000000000000000-mapping.dmp

Download
memory/896-70-0x0000000000000000-mapping.dmp

Download
memory/900-59-0x0000000000360000-0x00000000007BE000-memory.dmp

Filesize
4.4MB

Download
memory/900-54-0x00000000762D1000-0x00000000762D3000-memory.dmp

Filesize
8KB

Download
memory/900-90-0x0000000000360000-0x00000000007BE000-memory.dmp

Filesize
4.4MB

Download
memory/1032-58-0x0000000000000000-mapping.dmp

Download
memory/1216-61-0x0000000000000000-mapping.dmp

Download
memory/1472-81-0x0000000000000000-mapping.dmp

Download
memory/1580-87-0x0000000000000000-mapping.dmp

Download
memory/1636-80-0x0000000000000000-mapping.dmp

Download
memory/1800-86-0x0000000000000000-mapping.dmp

Download
memory/1876-62-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads