67443ca1a77b4b4ef0d66b96f2a94e004d1b22e12c3a53f7455444e3620edd30

Analysis

max time kernel
32s
max time network
44s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
23-11-2022 10:24

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

67443ca1a77b4b4ef0d66b96f2a94e004d1b22e12c3a53f7455444e3620edd30.exe
Size

603KB
MD5

12e8a34879443a3a289f5ac2cac96182
SHA1

fa724c6af7b696de1aa934eac1c55b56b0bfbef5
SHA256

67443ca1a77b4b4ef0d66b96f2a94e004d1b22e12c3a53f7455444e3620edd30
SHA512

91c5ecc4762167763d821a048570b16788c8e5e266ac3997f42a694aedf206b7a85cf7350316a6abe9232a5b4193c597354f4a7997e9b4b1f0553288558d7e20
SSDEEP

12288:QIny5DYTfQn8aXZ45s0zg9/3Jk4LH8QtFMROsctviRuXrKsjYJK0uu8nnOh:uUTgK5j8/5k4D1ck3vcubKsjO5qO

Score

8^/10

discovery

Malware Config

Signatures

Drops file in Drivers directory 1 IoCs

Processes:

67443ca1a77b4b4ef0d66b96f2a94e004d1b22e12c3a53f7455444e3620edd30.exe

description ioc process

File created C:\Windows\system32\drivers\nethfdrv.sys 67443ca1a77b4b4ef0d66b96f2a94e004d1b22e12c3a53f7455444e3620edd30.exe
Executes dropped EXE 5 IoCs

Processes:

installd.exenethtsrv.exenetupdsrv.exenethtsrv.exenetupdsrv.exe

pid process

948 installd.exe
1172 nethtsrv.exe
1624 netupdsrv.exe
1772 nethtsrv.exe
1420 netupdsrv.exe

description	ioc	process
File created	C:\Windows\system32\drivers\nethfdrv.sys	67443ca1a77b4b4ef0d66b96f2a94e004d1b22e12c3a53f7455444e3620edd30.exe

pid	process
948	installd.exe
1172	nethtsrv.exe
1624	netupdsrv.exe
1772	nethtsrv.exe
1420	netupdsrv.exe

Loads dropped DLL 13 IoCs

Processes:

67443ca1a77b4b4ef0d66b96f2a94e004d1b22e12c3a53f7455444e3620edd30.exeinstalld.exenethtsrv.exenethtsrv.exe

pid	process
684	67443ca1a77b4b4ef0d66b96f2a94e004d1b22e12c3a53f7455444e3620edd30.exe
684	67443ca1a77b4b4ef0d66b96f2a94e004d1b22e12c3a53f7455444e3620edd30.exe
684	67443ca1a77b4b4ef0d66b96f2a94e004d1b22e12c3a53f7455444e3620edd30.exe
684	67443ca1a77b4b4ef0d66b96f2a94e004d1b22e12c3a53f7455444e3620edd30.exe
948	installd.exe
684	67443ca1a77b4b4ef0d66b96f2a94e004d1b22e12c3a53f7455444e3620edd30.exe
1172	nethtsrv.exe
1172	nethtsrv.exe
684	67443ca1a77b4b4ef0d66b96f2a94e004d1b22e12c3a53f7455444e3620edd30.exe
684	67443ca1a77b4b4ef0d66b96f2a94e004d1b22e12c3a53f7455444e3620edd30.exe
1772	nethtsrv.exe
1772	nethtsrv.exe
684	67443ca1a77b4b4ef0d66b96f2a94e004d1b22e12c3a53f7455444e3620edd30.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in System32 directory 5 IoCs

Processes:

67443ca1a77b4b4ef0d66b96f2a94e004d1b22e12c3a53f7455444e3620edd30.exe

description	ioc	process
File created	C:\Windows\SysWOW64\netupdsrv.exe	67443ca1a77b4b4ef0d66b96f2a94e004d1b22e12c3a53f7455444e3620edd30.exe
File created	C:\Windows\SysWOW64\hfnapi.dll	67443ca1a77b4b4ef0d66b96f2a94e004d1b22e12c3a53f7455444e3620edd30.exe
File created	C:\Windows\SysWOW64\hfpapi.dll	67443ca1a77b4b4ef0d66b96f2a94e004d1b22e12c3a53f7455444e3620edd30.exe
File created	C:\Windows\SysWOW64\installd.exe	67443ca1a77b4b4ef0d66b96f2a94e004d1b22e12c3a53f7455444e3620edd30.exe
File created	C:\Windows\SysWOW64\nethtsrv.exe	67443ca1a77b4b4ef0d66b96f2a94e004d1b22e12c3a53f7455444e3620edd30.exe

Drops file in Program Files directory 3 IoCs

Processes:

67443ca1a77b4b4ef0d66b96f2a94e004d1b22e12c3a53f7455444e3620edd30.exe

description	ioc	process
File created	C:\Program Files (x86)\Common Files\Config\data.xml	67443ca1a77b4b4ef0d66b96f2a94e004d1b22e12c3a53f7455444e3620edd30.exe
File created	C:\Program Files (x86)\Common Files\Config\ver.xml	67443ca1a77b4b4ef0d66b96f2a94e004d1b22e12c3a53f7455444e3620edd30.exe
File created	C:\Program Files (x86)\Common Files\config\uninstinethnfd.exe	67443ca1a77b4b4ef0d66b96f2a94e004d1b22e12c3a53f7455444e3620edd30.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Runs net.exe
Suspicious behavior: LoadsDriver 1 IoCs

Processes:

pid process

460
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

nethtsrv.exe

description pid process

Token: SeDebugPrivilege 1772 nethtsrv.exe

pid	process
460

description	pid	process
Token: SeDebugPrivilege	1772	nethtsrv.exe

Suspicious use of WriteProcessMemory 50 IoCs

Processes:

67443ca1a77b4b4ef0d66b96f2a94e004d1b22e12c3a53f7455444e3620edd30.exenet.exenet.exenet.exenet.exe

description	pid	process	target process
PID 684 wrote to memory of 1320	684	67443ca1a77b4b4ef0d66b96f2a94e004d1b22e12c3a53f7455444e3620edd30.exe	net.exe
PID 684 wrote to memory of 1320	684	67443ca1a77b4b4ef0d66b96f2a94e004d1b22e12c3a53f7455444e3620edd30.exe	net.exe
PID 684 wrote to memory of 1320	684	67443ca1a77b4b4ef0d66b96f2a94e004d1b22e12c3a53f7455444e3620edd30.exe	net.exe
PID 684 wrote to memory of 1320	684	67443ca1a77b4b4ef0d66b96f2a94e004d1b22e12c3a53f7455444e3620edd30.exe	net.exe
PID 1320 wrote to memory of 952	1320	net.exe	net1.exe
PID 1320 wrote to memory of 952	1320	net.exe	net1.exe
PID 1320 wrote to memory of 952	1320	net.exe	net1.exe
PID 1320 wrote to memory of 952	1320	net.exe	net1.exe
PID 684 wrote to memory of 1128	684	67443ca1a77b4b4ef0d66b96f2a94e004d1b22e12c3a53f7455444e3620edd30.exe	net.exe
PID 684 wrote to memory of 1128	684	67443ca1a77b4b4ef0d66b96f2a94e004d1b22e12c3a53f7455444e3620edd30.exe	net.exe
PID 684 wrote to memory of 1128	684	67443ca1a77b4b4ef0d66b96f2a94e004d1b22e12c3a53f7455444e3620edd30.exe	net.exe
PID 684 wrote to memory of 1128	684	67443ca1a77b4b4ef0d66b96f2a94e004d1b22e12c3a53f7455444e3620edd30.exe	net.exe
PID 1128 wrote to memory of 2036	1128	net.exe	net1.exe
PID 1128 wrote to memory of 2036	1128	net.exe	net1.exe
PID 1128 wrote to memory of 2036	1128	net.exe	net1.exe
PID 1128 wrote to memory of 2036	1128	net.exe	net1.exe
PID 684 wrote to memory of 948	684	67443ca1a77b4b4ef0d66b96f2a94e004d1b22e12c3a53f7455444e3620edd30.exe	installd.exe
PID 684 wrote to memory of 948	684	67443ca1a77b4b4ef0d66b96f2a94e004d1b22e12c3a53f7455444e3620edd30.exe	installd.exe
PID 684 wrote to memory of 948	684	67443ca1a77b4b4ef0d66b96f2a94e004d1b22e12c3a53f7455444e3620edd30.exe	installd.exe
PID 684 wrote to memory of 948	684	67443ca1a77b4b4ef0d66b96f2a94e004d1b22e12c3a53f7455444e3620edd30.exe	installd.exe
PID 684 wrote to memory of 948	684	67443ca1a77b4b4ef0d66b96f2a94e004d1b22e12c3a53f7455444e3620edd30.exe	installd.exe
PID 684 wrote to memory of 948	684	67443ca1a77b4b4ef0d66b96f2a94e004d1b22e12c3a53f7455444e3620edd30.exe	installd.exe
PID 684 wrote to memory of 948	684	67443ca1a77b4b4ef0d66b96f2a94e004d1b22e12c3a53f7455444e3620edd30.exe	installd.exe
PID 684 wrote to memory of 1172	684	67443ca1a77b4b4ef0d66b96f2a94e004d1b22e12c3a53f7455444e3620edd30.exe	nethtsrv.exe
PID 684 wrote to memory of 1172	684	67443ca1a77b4b4ef0d66b96f2a94e004d1b22e12c3a53f7455444e3620edd30.exe	nethtsrv.exe
PID 684 wrote to memory of 1172	684	67443ca1a77b4b4ef0d66b96f2a94e004d1b22e12c3a53f7455444e3620edd30.exe	nethtsrv.exe
PID 684 wrote to memory of 1172	684	67443ca1a77b4b4ef0d66b96f2a94e004d1b22e12c3a53f7455444e3620edd30.exe	nethtsrv.exe
PID 684 wrote to memory of 1624	684	67443ca1a77b4b4ef0d66b96f2a94e004d1b22e12c3a53f7455444e3620edd30.exe	netupdsrv.exe
PID 684 wrote to memory of 1624	684	67443ca1a77b4b4ef0d66b96f2a94e004d1b22e12c3a53f7455444e3620edd30.exe	netupdsrv.exe
PID 684 wrote to memory of 1624	684	67443ca1a77b4b4ef0d66b96f2a94e004d1b22e12c3a53f7455444e3620edd30.exe	netupdsrv.exe
PID 684 wrote to memory of 1624	684	67443ca1a77b4b4ef0d66b96f2a94e004d1b22e12c3a53f7455444e3620edd30.exe	netupdsrv.exe
PID 684 wrote to memory of 1624	684	67443ca1a77b4b4ef0d66b96f2a94e004d1b22e12c3a53f7455444e3620edd30.exe	netupdsrv.exe
PID 684 wrote to memory of 1624	684	67443ca1a77b4b4ef0d66b96f2a94e004d1b22e12c3a53f7455444e3620edd30.exe	netupdsrv.exe
PID 684 wrote to memory of 1624	684	67443ca1a77b4b4ef0d66b96f2a94e004d1b22e12c3a53f7455444e3620edd30.exe	netupdsrv.exe
PID 684 wrote to memory of 1156	684	67443ca1a77b4b4ef0d66b96f2a94e004d1b22e12c3a53f7455444e3620edd30.exe	net.exe
PID 684 wrote to memory of 1156	684	67443ca1a77b4b4ef0d66b96f2a94e004d1b22e12c3a53f7455444e3620edd30.exe	net.exe
PID 684 wrote to memory of 1156	684	67443ca1a77b4b4ef0d66b96f2a94e004d1b22e12c3a53f7455444e3620edd30.exe	net.exe
PID 684 wrote to memory of 1156	684	67443ca1a77b4b4ef0d66b96f2a94e004d1b22e12c3a53f7455444e3620edd30.exe	net.exe
PID 1156 wrote to memory of 1744	1156	net.exe	net1.exe
PID 1156 wrote to memory of 1744	1156	net.exe	net1.exe
PID 1156 wrote to memory of 1744	1156	net.exe	net1.exe
PID 1156 wrote to memory of 1744	1156	net.exe	net1.exe
PID 684 wrote to memory of 1736	684	67443ca1a77b4b4ef0d66b96f2a94e004d1b22e12c3a53f7455444e3620edd30.exe	net.exe
PID 684 wrote to memory of 1736	684	67443ca1a77b4b4ef0d66b96f2a94e004d1b22e12c3a53f7455444e3620edd30.exe	net.exe
PID 684 wrote to memory of 1736	684	67443ca1a77b4b4ef0d66b96f2a94e004d1b22e12c3a53f7455444e3620edd30.exe	net.exe
PID 684 wrote to memory of 1736	684	67443ca1a77b4b4ef0d66b96f2a94e004d1b22e12c3a53f7455444e3620edd30.exe	net.exe
PID 1736 wrote to memory of 1608	1736	net.exe	net1.exe
PID 1736 wrote to memory of 1608	1736	net.exe	net1.exe
PID 1736 wrote to memory of 1608	1736	net.exe	net1.exe
PID 1736 wrote to memory of 1608	1736	net.exe	net1.exe

C:\Users\Admin\AppData\Local\Temp\67443ca1a77b4b4ef0d66b96f2a94e004d1b22e12c3a53f7455444e3620edd30.exe
"C:\Users\Admin\AppData\Local\Temp\67443ca1a77b4b4ef0d66b96f2a94e004d1b22e12c3a53f7455444e3620edd30.exe"
1⤵
- Drops file in Drivers directory
- Loads dropped DLL
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:684

C:\Windows\SysWOW64\net.exe
net stop nethttpservice
2⤵
- Suspicious use of WriteProcessMemory
PID:1320

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop nethttpservice
3⤵
PID:952

C:\Windows\SysWOW64\net.exe
net stop serviceupdater
2⤵
- Suspicious use of WriteProcessMemory
PID:1128

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop serviceupdater
3⤵
PID:2036

C:\Windows\SysWOW64\installd.exe
"C:\Windows\system32\installd.exe" nethfdrv
2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:948

C:\Windows\SysWOW64\nethtsrv.exe
"C:\Windows\system32\nethtsrv.exe" -nfdi
2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1172

C:\Windows\SysWOW64\netupdsrv.exe
"C:\Windows\system32\netupdsrv.exe" -nfdi
2⤵
- Executes dropped EXE
PID:1624

C:\Windows\SysWOW64\net.exe
net start nethttpservice
2⤵
- Suspicious use of WriteProcessMemory
PID:1156

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 start nethttpservice
3⤵
PID:1744

C:\Windows\SysWOW64\net.exe
net start serviceupdater
2⤵
- Suspicious use of WriteProcessMemory
PID:1736

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 start serviceupdater
3⤵
PID:1608

C:\Windows\SysWOW64\nethtsrv.exe
C:\Windows\SysWOW64\nethtsrv.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:1772

C:\Windows\SysWOW64\netupdsrv.exe
C:\Windows\SysWOW64\netupdsrv.exe
1⤵
- Executes dropped EXE
PID:1420

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\hfnapi.dll
Filesize
106KB

MD5
9af4cf9d743f8c600c0174d6cc3f595e

SHA1
6c700b97c4581dc485c65522ec002e3844fdc208

SHA256
8ae493db9da22933c1d11f34563b1fd271fdf471971a77a7564b474028a6d875

SHA512
431fda9e9d021cd387c7306b5bac669a0c3317fbc0357c1c850c567e988436098a7635c07ce09d03174908fc2931ee74c4ef8bf513bf879fff6ed1136208bad1

Download Submit
C:\Windows\SysWOW64\hfpapi.dll
Filesize
244KB

MD5
e2df07ae6ebe804cca259ece7f7ec708

SHA1
fa92d34dc6b0ff7ea67cd17815c2589be4e6f008

SHA256
56a99386d1a4a280344137d8ae68b9ef0b220c2cd36fcc41f71f83768a2de023

SHA512
fa3f12974115040671b41869063bad9c052973ac369c394a4c2c124ee2ac9f419b933b5a875d6a233c520388592ac0daa3adf01ae7f42528f5feff6d8164a8bc

Download Submit
C:\Windows\SysWOW64\installd.exe
Filesize
108KB

MD5
ac6c3e37e052da4188fc7fdbace05abc

SHA1
8aca78de45dc5fcb2c3214393fa3b3ea3bb4ba76

SHA256
9815805b043dd2769ea96ddff3cabe47193e1a508ff252a07f3c9db46c23fabe

SHA512
c3499f338b54f674d399d022eea3354b21c098533cda0bc3773b7f0bccce3d270d074e9949f8ed4ee2c248606fb900869d98023828e3df8b0a7cdc64becdb781

Download Submit
C:\Windows\SysWOW64\nethtsrv.exe
Filesize
176KB

MD5
061a0303c6f391c523d0b4a47eb119bb

SHA1
2618aa753bf6ef3bf22b19dde6807e3570628942

SHA256
793d00a53634a72dac08284810261a072d5f5441be78ccee0adaa36ed4082e8a

SHA512
45dd250d38d1e8e138d8bacb6094beb5c737f072d37844954daf087dd4c8746a0adbda9bba1ed2e940b5b5a3361ded69a02d6693e63119fa6a4d6062a41a04fd

Download Submit
C:\Windows\SysWOW64\nethtsrv.exe
Filesize
176KB

MD5
061a0303c6f391c523d0b4a47eb119bb

SHA1
2618aa753bf6ef3bf22b19dde6807e3570628942

SHA256
793d00a53634a72dac08284810261a072d5f5441be78ccee0adaa36ed4082e8a

SHA512
45dd250d38d1e8e138d8bacb6094beb5c737f072d37844954daf087dd4c8746a0adbda9bba1ed2e940b5b5a3361ded69a02d6693e63119fa6a4d6062a41a04fd

Download Submit
C:\Windows\SysWOW64\netupdsrv.exe
Filesize
158KB

MD5
2a9735a0d8e8847785093b0b306bd814

SHA1
baed8671b385ca31adaedf28664b7fd25d066b18

SHA256
382cc80b8044cea846678c172de105b50a3c76d3dcfefc81285254b8e7e109ca

SHA512
7c2a712a94262d4813c0d82fd2919c15a6d6b35cc3d9eaa3c80c13e38f6615c369a326cefc7e563d4d1fefbbdef99899b4b752d3827983595a0df0624b14f1a8

Download Submit
C:\Windows\SysWOW64\netupdsrv.exe
Filesize
158KB

MD5
2a9735a0d8e8847785093b0b306bd814

SHA1
baed8671b385ca31adaedf28664b7fd25d066b18

SHA256
382cc80b8044cea846678c172de105b50a3c76d3dcfefc81285254b8e7e109ca

SHA512
7c2a712a94262d4813c0d82fd2919c15a6d6b35cc3d9eaa3c80c13e38f6615c369a326cefc7e563d4d1fefbbdef99899b4b752d3827983595a0df0624b14f1a8

Download Submit
\Users\Admin\AppData\Local\Temp\nso20EC.tmp\System.dll
Filesize
11KB

MD5
c17103ae9072a06da581dec998343fc1

SHA1
b72148c6bdfaada8b8c3f950e610ee7cf1da1f8d

SHA256
dc58d8ad81cacb0c1ed72e33bff8f23ea40b5252b5bb55d393a0903e6819ae2f

SHA512
d32a71aaef18e993f28096d536e41c4d016850721b31171513ce28bbd805a54fd290b7c3e9d935f72e676a1acfb4f0dcc89d95040a0dd29f2b6975855c18986f

Download Submit
\Users\Admin\AppData\Local\Temp\nso20EC.tmp\nsExec.dll
Filesize
6KB

MD5
acc2b699edfea5bf5aae45aba3a41e96

SHA1
d2accf4d494e43ceb2cff69abe4dd17147d29cc2

SHA256
168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e

SHA512
e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe

Download Submit
\Users\Admin\AppData\Local\Temp\nso20EC.tmp\nsExec.dll
Filesize
6KB

MD5
acc2b699edfea5bf5aae45aba3a41e96

SHA1
d2accf4d494e43ceb2cff69abe4dd17147d29cc2

SHA256
168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e

SHA512
e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe

Download Submit
\Users\Admin\AppData\Local\Temp\nso20EC.tmp\nsExec.dll
Filesize
6KB

MD5
acc2b699edfea5bf5aae45aba3a41e96

SHA1
d2accf4d494e43ceb2cff69abe4dd17147d29cc2

SHA256
168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e

SHA512
e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe

Download Submit
\Users\Admin\AppData\Local\Temp\nso20EC.tmp\nsExec.dll
Filesize
6KB

MD5
acc2b699edfea5bf5aae45aba3a41e96

SHA1
d2accf4d494e43ceb2cff69abe4dd17147d29cc2

SHA256
168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e

SHA512
e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe

Download Submit
\Windows\SysWOW64\hfnapi.dll
Filesize
106KB

MD5
9af4cf9d743f8c600c0174d6cc3f595e

SHA1
6c700b97c4581dc485c65522ec002e3844fdc208

SHA256
8ae493db9da22933c1d11f34563b1fd271fdf471971a77a7564b474028a6d875

SHA512
431fda9e9d021cd387c7306b5bac669a0c3317fbc0357c1c850c567e988436098a7635c07ce09d03174908fc2931ee74c4ef8bf513bf879fff6ed1136208bad1

Download Submit
\Windows\SysWOW64\hfnapi.dll
Filesize
106KB

MD5
9af4cf9d743f8c600c0174d6cc3f595e

SHA1
6c700b97c4581dc485c65522ec002e3844fdc208

SHA256
8ae493db9da22933c1d11f34563b1fd271fdf471971a77a7564b474028a6d875

SHA512
431fda9e9d021cd387c7306b5bac669a0c3317fbc0357c1c850c567e988436098a7635c07ce09d03174908fc2931ee74c4ef8bf513bf879fff6ed1136208bad1

Download Submit
\Windows\SysWOW64\hfnapi.dll
Filesize
106KB

MD5
9af4cf9d743f8c600c0174d6cc3f595e

SHA1
6c700b97c4581dc485c65522ec002e3844fdc208

SHA256
8ae493db9da22933c1d11f34563b1fd271fdf471971a77a7564b474028a6d875

SHA512
431fda9e9d021cd387c7306b5bac669a0c3317fbc0357c1c850c567e988436098a7635c07ce09d03174908fc2931ee74c4ef8bf513bf879fff6ed1136208bad1

Download Submit
\Windows\SysWOW64\hfpapi.dll
Filesize
244KB

MD5
e2df07ae6ebe804cca259ece7f7ec708

SHA1
fa92d34dc6b0ff7ea67cd17815c2589be4e6f008

SHA256
56a99386d1a4a280344137d8ae68b9ef0b220c2cd36fcc41f71f83768a2de023

SHA512
fa3f12974115040671b41869063bad9c052973ac369c394a4c2c124ee2ac9f419b933b5a875d6a233c520388592ac0daa3adf01ae7f42528f5feff6d8164a8bc

Download Submit
\Windows\SysWOW64\hfpapi.dll
Filesize
244KB

MD5
e2df07ae6ebe804cca259ece7f7ec708

SHA1
fa92d34dc6b0ff7ea67cd17815c2589be4e6f008

SHA256
56a99386d1a4a280344137d8ae68b9ef0b220c2cd36fcc41f71f83768a2de023

SHA512
fa3f12974115040671b41869063bad9c052973ac369c394a4c2c124ee2ac9f419b933b5a875d6a233c520388592ac0daa3adf01ae7f42528f5feff6d8164a8bc

Download Submit
\Windows\SysWOW64\installd.exe
Filesize
108KB

MD5
ac6c3e37e052da4188fc7fdbace05abc

SHA1
8aca78de45dc5fcb2c3214393fa3b3ea3bb4ba76

SHA256
9815805b043dd2769ea96ddff3cabe47193e1a508ff252a07f3c9db46c23fabe

SHA512
c3499f338b54f674d399d022eea3354b21c098533cda0bc3773b7f0bccce3d270d074e9949f8ed4ee2c248606fb900869d98023828e3df8b0a7cdc64becdb781

Download Submit
\Windows\SysWOW64\nethtsrv.exe
Filesize
176KB

MD5
061a0303c6f391c523d0b4a47eb119bb

SHA1
2618aa753bf6ef3bf22b19dde6807e3570628942

SHA256
793d00a53634a72dac08284810261a072d5f5441be78ccee0adaa36ed4082e8a

SHA512
45dd250d38d1e8e138d8bacb6094beb5c737f072d37844954daf087dd4c8746a0adbda9bba1ed2e940b5b5a3361ded69a02d6693e63119fa6a4d6062a41a04fd

Download Submit
\Windows\SysWOW64\netupdsrv.exe
Filesize
158KB

MD5
2a9735a0d8e8847785093b0b306bd814

SHA1
baed8671b385ca31adaedf28664b7fd25d066b18

SHA256
382cc80b8044cea846678c172de105b50a3c76d3dcfefc81285254b8e7e109ca

SHA512
7c2a712a94262d4813c0d82fd2919c15a6d6b35cc3d9eaa3c80c13e38f6615c369a326cefc7e563d4d1fefbbdef99899b4b752d3827983595a0df0624b14f1a8

Download Submit
memory/684-59-0x0000000000360000-0x00000000007BE000-memory.dmp

Filesize
4.4MB

Download
memory/684-90-0x0000000000360000-0x00000000007BE000-memory.dmp

Filesize
4.4MB

Download
memory/684-54-0x0000000075071000-0x0000000075073000-memory.dmp

Filesize
8KB

Download
memory/948-64-0x0000000000000000-mapping.dmp

Download
memory/952-58-0x0000000000000000-mapping.dmp

Download
memory/1128-61-0x0000000000000000-mapping.dmp

Download
memory/1156-80-0x0000000000000000-mapping.dmp

Download
memory/1172-70-0x0000000000000000-mapping.dmp

Download
memory/1320-57-0x0000000000000000-mapping.dmp

Download
memory/1608-87-0x0000000000000000-mapping.dmp

Download
memory/1624-76-0x0000000000000000-mapping.dmp

Download
memory/1736-86-0x0000000000000000-mapping.dmp

Download
memory/1744-81-0x0000000000000000-mapping.dmp

Download
memory/2036-62-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads