55d6415c91ea3df98681a4605a23fc623a7f28a4355f5274268fd5e5bc57ba0d

Analysis

max time kernel
45s
max time network
50s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
23-11-2022 10:25

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

55d6415c91ea3df98681a4605a23fc623a7f28a4355f5274268fd5e5bc57ba0d.exe
Size

602KB
MD5

f067165242822c3c4e9fa93f14df4093
SHA1

5a9d0c362dd8e056d24991ae561357ae4895f386
SHA256

55d6415c91ea3df98681a4605a23fc623a7f28a4355f5274268fd5e5bc57ba0d
SHA512

86616b5194a2fd57aeb96a9d8e404bc7d92e3b0c09eec659b8421aaa5345b3ba1337b9d76b1623ab39b6af6060d30b241aa01627ddbc0b6f36b57426c885bccf
SSDEEP

12288:GIny5DYT1kxQswmyiKUegcO82hDYvhC96I8EKASh:oUT1kxQswER8nvhC96IaZ

Score

8^/10

discovery

Malware Config

Signatures

Drops file in Drivers directory 1 IoCs

Processes:

55d6415c91ea3df98681a4605a23fc623a7f28a4355f5274268fd5e5bc57ba0d.exe

description ioc process

File created C:\Windows\system32\drivers\nethfdrv.sys 55d6415c91ea3df98681a4605a23fc623a7f28a4355f5274268fd5e5bc57ba0d.exe
Executes dropped EXE 5 IoCs

Processes:

installd.exenethtsrv.exenetupdsrv.exenethtsrv.exenetupdsrv.exe

pid process

580 installd.exe
632 nethtsrv.exe
1556 netupdsrv.exe
2032 nethtsrv.exe
1512 netupdsrv.exe

description	ioc	process
File created	C:\Windows\system32\drivers\nethfdrv.sys	55d6415c91ea3df98681a4605a23fc623a7f28a4355f5274268fd5e5bc57ba0d.exe

pid	process
580	installd.exe
632	nethtsrv.exe
1556	netupdsrv.exe
2032	nethtsrv.exe
1512	netupdsrv.exe

Loads dropped DLL 13 IoCs

Processes:

55d6415c91ea3df98681a4605a23fc623a7f28a4355f5274268fd5e5bc57ba0d.exeinstalld.exenethtsrv.exenethtsrv.exe

pid	process
1464	55d6415c91ea3df98681a4605a23fc623a7f28a4355f5274268fd5e5bc57ba0d.exe
1464	55d6415c91ea3df98681a4605a23fc623a7f28a4355f5274268fd5e5bc57ba0d.exe
1464	55d6415c91ea3df98681a4605a23fc623a7f28a4355f5274268fd5e5bc57ba0d.exe
1464	55d6415c91ea3df98681a4605a23fc623a7f28a4355f5274268fd5e5bc57ba0d.exe
580	installd.exe
1464	55d6415c91ea3df98681a4605a23fc623a7f28a4355f5274268fd5e5bc57ba0d.exe
632	nethtsrv.exe
632	nethtsrv.exe
1464	55d6415c91ea3df98681a4605a23fc623a7f28a4355f5274268fd5e5bc57ba0d.exe
1464	55d6415c91ea3df98681a4605a23fc623a7f28a4355f5274268fd5e5bc57ba0d.exe
2032	nethtsrv.exe
2032	nethtsrv.exe
1464	55d6415c91ea3df98681a4605a23fc623a7f28a4355f5274268fd5e5bc57ba0d.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in System32 directory 5 IoCs

Processes:

55d6415c91ea3df98681a4605a23fc623a7f28a4355f5274268fd5e5bc57ba0d.exe

description	ioc	process
File created	C:\Windows\SysWOW64\netupdsrv.exe	55d6415c91ea3df98681a4605a23fc623a7f28a4355f5274268fd5e5bc57ba0d.exe
File created	C:\Windows\SysWOW64\hfnapi.dll	55d6415c91ea3df98681a4605a23fc623a7f28a4355f5274268fd5e5bc57ba0d.exe
File created	C:\Windows\SysWOW64\hfpapi.dll	55d6415c91ea3df98681a4605a23fc623a7f28a4355f5274268fd5e5bc57ba0d.exe
File created	C:\Windows\SysWOW64\installd.exe	55d6415c91ea3df98681a4605a23fc623a7f28a4355f5274268fd5e5bc57ba0d.exe
File created	C:\Windows\SysWOW64\nethtsrv.exe	55d6415c91ea3df98681a4605a23fc623a7f28a4355f5274268fd5e5bc57ba0d.exe

Drops file in Program Files directory 3 IoCs

Processes:

55d6415c91ea3df98681a4605a23fc623a7f28a4355f5274268fd5e5bc57ba0d.exe

description	ioc	process
File created	C:\Program Files (x86)\Common Files\Config\data.xml	55d6415c91ea3df98681a4605a23fc623a7f28a4355f5274268fd5e5bc57ba0d.exe
File created	C:\Program Files (x86)\Common Files\Config\ver.xml	55d6415c91ea3df98681a4605a23fc623a7f28a4355f5274268fd5e5bc57ba0d.exe
File created	C:\Program Files (x86)\Common Files\config\uninstinethnfd.exe	55d6415c91ea3df98681a4605a23fc623a7f28a4355f5274268fd5e5bc57ba0d.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Runs net.exe
Suspicious behavior: LoadsDriver 1 IoCs

Processes:

pid process

464
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

nethtsrv.exe

description pid process

Token: SeDebugPrivilege 2032 nethtsrv.exe

pid	process
464

description	pid	process
Token: SeDebugPrivilege	2032	nethtsrv.exe

Suspicious use of WriteProcessMemory 50 IoCs

Processes:

55d6415c91ea3df98681a4605a23fc623a7f28a4355f5274268fd5e5bc57ba0d.exenet.exenet.exenet.exenet.exe

description	pid	process	target process
PID 1464 wrote to memory of 1472	1464	55d6415c91ea3df98681a4605a23fc623a7f28a4355f5274268fd5e5bc57ba0d.exe	net.exe
PID 1464 wrote to memory of 1472	1464	55d6415c91ea3df98681a4605a23fc623a7f28a4355f5274268fd5e5bc57ba0d.exe	net.exe
PID 1464 wrote to memory of 1472	1464	55d6415c91ea3df98681a4605a23fc623a7f28a4355f5274268fd5e5bc57ba0d.exe	net.exe
PID 1464 wrote to memory of 1472	1464	55d6415c91ea3df98681a4605a23fc623a7f28a4355f5274268fd5e5bc57ba0d.exe	net.exe
PID 1472 wrote to memory of 824	1472	net.exe	net1.exe
PID 1472 wrote to memory of 824	1472	net.exe	net1.exe
PID 1472 wrote to memory of 824	1472	net.exe	net1.exe
PID 1472 wrote to memory of 824	1472	net.exe	net1.exe
PID 1464 wrote to memory of 916	1464	55d6415c91ea3df98681a4605a23fc623a7f28a4355f5274268fd5e5bc57ba0d.exe	net.exe
PID 1464 wrote to memory of 916	1464	55d6415c91ea3df98681a4605a23fc623a7f28a4355f5274268fd5e5bc57ba0d.exe	net.exe
PID 1464 wrote to memory of 916	1464	55d6415c91ea3df98681a4605a23fc623a7f28a4355f5274268fd5e5bc57ba0d.exe	net.exe
PID 1464 wrote to memory of 916	1464	55d6415c91ea3df98681a4605a23fc623a7f28a4355f5274268fd5e5bc57ba0d.exe	net.exe
PID 916 wrote to memory of 1372	916	net.exe	net1.exe
PID 916 wrote to memory of 1372	916	net.exe	net1.exe
PID 916 wrote to memory of 1372	916	net.exe	net1.exe
PID 916 wrote to memory of 1372	916	net.exe	net1.exe
PID 1464 wrote to memory of 580	1464	55d6415c91ea3df98681a4605a23fc623a7f28a4355f5274268fd5e5bc57ba0d.exe	installd.exe
PID 1464 wrote to memory of 580	1464	55d6415c91ea3df98681a4605a23fc623a7f28a4355f5274268fd5e5bc57ba0d.exe	installd.exe
PID 1464 wrote to memory of 580	1464	55d6415c91ea3df98681a4605a23fc623a7f28a4355f5274268fd5e5bc57ba0d.exe	installd.exe
PID 1464 wrote to memory of 580	1464	55d6415c91ea3df98681a4605a23fc623a7f28a4355f5274268fd5e5bc57ba0d.exe	installd.exe
PID 1464 wrote to memory of 580	1464	55d6415c91ea3df98681a4605a23fc623a7f28a4355f5274268fd5e5bc57ba0d.exe	installd.exe
PID 1464 wrote to memory of 580	1464	55d6415c91ea3df98681a4605a23fc623a7f28a4355f5274268fd5e5bc57ba0d.exe	installd.exe
PID 1464 wrote to memory of 580	1464	55d6415c91ea3df98681a4605a23fc623a7f28a4355f5274268fd5e5bc57ba0d.exe	installd.exe
PID 1464 wrote to memory of 632	1464	55d6415c91ea3df98681a4605a23fc623a7f28a4355f5274268fd5e5bc57ba0d.exe	nethtsrv.exe
PID 1464 wrote to memory of 632	1464	55d6415c91ea3df98681a4605a23fc623a7f28a4355f5274268fd5e5bc57ba0d.exe	nethtsrv.exe
PID 1464 wrote to memory of 632	1464	55d6415c91ea3df98681a4605a23fc623a7f28a4355f5274268fd5e5bc57ba0d.exe	nethtsrv.exe
PID 1464 wrote to memory of 632	1464	55d6415c91ea3df98681a4605a23fc623a7f28a4355f5274268fd5e5bc57ba0d.exe	nethtsrv.exe
PID 1464 wrote to memory of 1556	1464	55d6415c91ea3df98681a4605a23fc623a7f28a4355f5274268fd5e5bc57ba0d.exe	netupdsrv.exe
PID 1464 wrote to memory of 1556	1464	55d6415c91ea3df98681a4605a23fc623a7f28a4355f5274268fd5e5bc57ba0d.exe	netupdsrv.exe
PID 1464 wrote to memory of 1556	1464	55d6415c91ea3df98681a4605a23fc623a7f28a4355f5274268fd5e5bc57ba0d.exe	netupdsrv.exe
PID 1464 wrote to memory of 1556	1464	55d6415c91ea3df98681a4605a23fc623a7f28a4355f5274268fd5e5bc57ba0d.exe	netupdsrv.exe
PID 1464 wrote to memory of 1556	1464	55d6415c91ea3df98681a4605a23fc623a7f28a4355f5274268fd5e5bc57ba0d.exe	netupdsrv.exe
PID 1464 wrote to memory of 1556	1464	55d6415c91ea3df98681a4605a23fc623a7f28a4355f5274268fd5e5bc57ba0d.exe	netupdsrv.exe
PID 1464 wrote to memory of 1556	1464	55d6415c91ea3df98681a4605a23fc623a7f28a4355f5274268fd5e5bc57ba0d.exe	netupdsrv.exe
PID 1464 wrote to memory of 288	1464	55d6415c91ea3df98681a4605a23fc623a7f28a4355f5274268fd5e5bc57ba0d.exe	net.exe
PID 1464 wrote to memory of 288	1464	55d6415c91ea3df98681a4605a23fc623a7f28a4355f5274268fd5e5bc57ba0d.exe	net.exe
PID 1464 wrote to memory of 288	1464	55d6415c91ea3df98681a4605a23fc623a7f28a4355f5274268fd5e5bc57ba0d.exe	net.exe
PID 1464 wrote to memory of 288	1464	55d6415c91ea3df98681a4605a23fc623a7f28a4355f5274268fd5e5bc57ba0d.exe	net.exe
PID 288 wrote to memory of 1956	288	net.exe	net1.exe
PID 288 wrote to memory of 1956	288	net.exe	net1.exe
PID 288 wrote to memory of 1956	288	net.exe	net1.exe
PID 288 wrote to memory of 1956	288	net.exe	net1.exe
PID 1464 wrote to memory of 960	1464	55d6415c91ea3df98681a4605a23fc623a7f28a4355f5274268fd5e5bc57ba0d.exe	net.exe
PID 1464 wrote to memory of 960	1464	55d6415c91ea3df98681a4605a23fc623a7f28a4355f5274268fd5e5bc57ba0d.exe	net.exe
PID 1464 wrote to memory of 960	1464	55d6415c91ea3df98681a4605a23fc623a7f28a4355f5274268fd5e5bc57ba0d.exe	net.exe
PID 1464 wrote to memory of 960	1464	55d6415c91ea3df98681a4605a23fc623a7f28a4355f5274268fd5e5bc57ba0d.exe	net.exe
PID 960 wrote to memory of 1080	960	net.exe	net1.exe
PID 960 wrote to memory of 1080	960	net.exe	net1.exe
PID 960 wrote to memory of 1080	960	net.exe	net1.exe
PID 960 wrote to memory of 1080	960	net.exe	net1.exe

C:\Users\Admin\AppData\Local\Temp\55d6415c91ea3df98681a4605a23fc623a7f28a4355f5274268fd5e5bc57ba0d.exe
"C:\Users\Admin\AppData\Local\Temp\55d6415c91ea3df98681a4605a23fc623a7f28a4355f5274268fd5e5bc57ba0d.exe"
1⤵
- Drops file in Drivers directory
- Loads dropped DLL
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:1464

C:\Windows\SysWOW64\net.exe
net stop nethttpservice
2⤵
- Suspicious use of WriteProcessMemory
PID:1472

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop nethttpservice
3⤵
PID:824

C:\Windows\SysWOW64\net.exe
net stop serviceupdater
2⤵
- Suspicious use of WriteProcessMemory
PID:916

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop serviceupdater
3⤵
PID:1372

C:\Windows\SysWOW64\installd.exe
"C:\Windows\system32\installd.exe" nethfdrv
2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:580

C:\Windows\SysWOW64\nethtsrv.exe
"C:\Windows\system32\nethtsrv.exe" -nfdi
2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:632

C:\Windows\SysWOW64\netupdsrv.exe
"C:\Windows\system32\netupdsrv.exe" -nfdi
2⤵
- Executes dropped EXE
PID:1556

C:\Windows\SysWOW64\net.exe
net start nethttpservice
2⤵
- Suspicious use of WriteProcessMemory
PID:288

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 start nethttpservice
3⤵
PID:1956

C:\Windows\SysWOW64\net.exe
net start serviceupdater
2⤵
- Suspicious use of WriteProcessMemory
PID:960

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 start serviceupdater
3⤵
PID:1080

C:\Windows\SysWOW64\nethtsrv.exe
C:\Windows\SysWOW64\nethtsrv.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:2032

C:\Windows\SysWOW64\netupdsrv.exe
C:\Windows\SysWOW64\netupdsrv.exe
1⤵
- Executes dropped EXE
PID:1512

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\hfnapi.dll
Filesize
106KB

MD5
854094dc985e1bd43a39fb5b8aadfc16

SHA1
a464d9c577b995144cc0ebe8a938a8bb952b8fd9

SHA256
c7db79b0fbddf7498856239c0da7c24e9d5ceb6266ce81d930cef370321f81fd

SHA512
b28aafb4c06a0b862adad68383896da5a9e75596182043a5bf4a15741d428f2a7e4b38b03e41403d5ba30ee175b9999be3e65380516d08a2cbd0a4233410eaee

Download Submit
C:\Windows\SysWOW64\hfpapi.dll
Filesize
244KB

MD5
d696a3dfbe49f86b71796a07f849c658

SHA1
ccd5697a38fbca2264f2a982ecb7803d9bf07884

SHA256
a18095850231efa72d140c634a7450c7c58ce79d77092132ddea47e41d335a66

SHA512
9c9f78a5852751d8cb3651e52315e00c76c293fd3165e35f871f881b315732d3b5bb5755be3d8245d9ec2e68f3a2234dffc6dc9767e5f1c035e666239f49ca89

Download Submit
C:\Windows\SysWOW64\installd.exe
Filesize
108KB

MD5
933e1975396f421290ad8a484fdeec41

SHA1
ec8b5e8bd28585b1d5fc83cc887550094f118fbf

SHA256
8fb6980ae3486ebdfa43c301401dee137755316becdb349bf1c83795dcb9c22e

SHA512
0693f2f583b48088819834c34b6ee7f9ec808cd9ab6bdb75d0fafa3981e71b4525ba93783729880dc687ca80b8a91fb31325dbad8b67679cd2f243e9186a5233

Download Submit
C:\Windows\SysWOW64\nethtsrv.exe
Filesize
176KB

MD5
ff26f9f740d4953e5d068d5b4b98fc3e

SHA1
e56f29f63085fae8aedde467ac154158d83232b0

SHA256
de584a156d9b2ce913b395a785a86dccac7fcd7f510c490ac57534b39ef4ce9d

SHA512
f47b2ffc4205901ec0d682d830fb7172ee5d8a12ad44bd78a0697ddff0446309f3c9751e0b23a45cc12d7dd9ae5264b2dc0f8235caca1532556c083c64cfaaf8

Download Submit
C:\Windows\SysWOW64\nethtsrv.exe
Filesize
176KB

MD5
ff26f9f740d4953e5d068d5b4b98fc3e

SHA1
e56f29f63085fae8aedde467ac154158d83232b0

SHA256
de584a156d9b2ce913b395a785a86dccac7fcd7f510c490ac57534b39ef4ce9d

SHA512
f47b2ffc4205901ec0d682d830fb7172ee5d8a12ad44bd78a0697ddff0446309f3c9751e0b23a45cc12d7dd9ae5264b2dc0f8235caca1532556c083c64cfaaf8

Download Submit
C:\Windows\SysWOW64\netupdsrv.exe
Filesize
159KB

MD5
40b7baa5282b957ce4fd141b2712cb96

SHA1
80033912c0a4c99e839533410c360af9f07c0a84

SHA256
5605f677810ce73e7b91b5211a7876a4b8f8f909385da271d6b1075e4fe260df

SHA512
848cce8a14b48fa543d4f2008c0b0a2783e652490146715494ef946301bdbb135a82bf99cf7898c6732fe6e70a96e5d4e51f3c62a95a48d1e70f6af18b54aea6

Download Submit
C:\Windows\SysWOW64\netupdsrv.exe
Filesize
159KB

MD5
40b7baa5282b957ce4fd141b2712cb96

SHA1
80033912c0a4c99e839533410c360af9f07c0a84

SHA256
5605f677810ce73e7b91b5211a7876a4b8f8f909385da271d6b1075e4fe260df

SHA512
848cce8a14b48fa543d4f2008c0b0a2783e652490146715494ef946301bdbb135a82bf99cf7898c6732fe6e70a96e5d4e51f3c62a95a48d1e70f6af18b54aea6

Download Submit
\Users\Admin\AppData\Local\Temp\nso3AD2.tmp\System.dll
Filesize
11KB

MD5
c17103ae9072a06da581dec998343fc1

SHA1
b72148c6bdfaada8b8c3f950e610ee7cf1da1f8d

SHA256
dc58d8ad81cacb0c1ed72e33bff8f23ea40b5252b5bb55d393a0903e6819ae2f

SHA512
d32a71aaef18e993f28096d536e41c4d016850721b31171513ce28bbd805a54fd290b7c3e9d935f72e676a1acfb4f0dcc89d95040a0dd29f2b6975855c18986f

Download Submit
\Users\Admin\AppData\Local\Temp\nso3AD2.tmp\nsExec.dll
Filesize
6KB

MD5
acc2b699edfea5bf5aae45aba3a41e96

SHA1
d2accf4d494e43ceb2cff69abe4dd17147d29cc2

SHA256
168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e

SHA512
e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe

Download Submit
\Users\Admin\AppData\Local\Temp\nso3AD2.tmp\nsExec.dll
Filesize
6KB

MD5
acc2b699edfea5bf5aae45aba3a41e96

SHA1
d2accf4d494e43ceb2cff69abe4dd17147d29cc2

SHA256
168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e

SHA512
e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe

Download Submit
\Users\Admin\AppData\Local\Temp\nso3AD2.tmp\nsExec.dll
Filesize
6KB

MD5
acc2b699edfea5bf5aae45aba3a41e96

SHA1
d2accf4d494e43ceb2cff69abe4dd17147d29cc2

SHA256
168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e

SHA512
e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe

Download Submit
\Users\Admin\AppData\Local\Temp\nso3AD2.tmp\nsExec.dll
Filesize
6KB

MD5
acc2b699edfea5bf5aae45aba3a41e96

SHA1
d2accf4d494e43ceb2cff69abe4dd17147d29cc2

SHA256
168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e

SHA512
e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe

Download Submit
\Windows\SysWOW64\hfnapi.dll
Filesize
106KB

MD5
854094dc985e1bd43a39fb5b8aadfc16

SHA1
a464d9c577b995144cc0ebe8a938a8bb952b8fd9

SHA256
c7db79b0fbddf7498856239c0da7c24e9d5ceb6266ce81d930cef370321f81fd

SHA512
b28aafb4c06a0b862adad68383896da5a9e75596182043a5bf4a15741d428f2a7e4b38b03e41403d5ba30ee175b9999be3e65380516d08a2cbd0a4233410eaee

Download Submit
\Windows\SysWOW64\hfnapi.dll
Filesize
106KB

MD5
854094dc985e1bd43a39fb5b8aadfc16

SHA1
a464d9c577b995144cc0ebe8a938a8bb952b8fd9

SHA256
c7db79b0fbddf7498856239c0da7c24e9d5ceb6266ce81d930cef370321f81fd

SHA512
b28aafb4c06a0b862adad68383896da5a9e75596182043a5bf4a15741d428f2a7e4b38b03e41403d5ba30ee175b9999be3e65380516d08a2cbd0a4233410eaee

Download Submit
\Windows\SysWOW64\hfnapi.dll
Filesize
106KB

MD5
854094dc985e1bd43a39fb5b8aadfc16

SHA1
a464d9c577b995144cc0ebe8a938a8bb952b8fd9

SHA256
c7db79b0fbddf7498856239c0da7c24e9d5ceb6266ce81d930cef370321f81fd

SHA512
b28aafb4c06a0b862adad68383896da5a9e75596182043a5bf4a15741d428f2a7e4b38b03e41403d5ba30ee175b9999be3e65380516d08a2cbd0a4233410eaee

Download Submit
\Windows\SysWOW64\hfpapi.dll
Filesize
244KB

MD5
d696a3dfbe49f86b71796a07f849c658

SHA1
ccd5697a38fbca2264f2a982ecb7803d9bf07884

SHA256
a18095850231efa72d140c634a7450c7c58ce79d77092132ddea47e41d335a66

SHA512
9c9f78a5852751d8cb3651e52315e00c76c293fd3165e35f871f881b315732d3b5bb5755be3d8245d9ec2e68f3a2234dffc6dc9767e5f1c035e666239f49ca89

Download Submit
\Windows\SysWOW64\hfpapi.dll
Filesize
244KB

MD5
d696a3dfbe49f86b71796a07f849c658

SHA1
ccd5697a38fbca2264f2a982ecb7803d9bf07884

SHA256
a18095850231efa72d140c634a7450c7c58ce79d77092132ddea47e41d335a66

SHA512
9c9f78a5852751d8cb3651e52315e00c76c293fd3165e35f871f881b315732d3b5bb5755be3d8245d9ec2e68f3a2234dffc6dc9767e5f1c035e666239f49ca89

Download Submit
\Windows\SysWOW64\installd.exe
Filesize
108KB

MD5
933e1975396f421290ad8a484fdeec41

SHA1
ec8b5e8bd28585b1d5fc83cc887550094f118fbf

SHA256
8fb6980ae3486ebdfa43c301401dee137755316becdb349bf1c83795dcb9c22e

SHA512
0693f2f583b48088819834c34b6ee7f9ec808cd9ab6bdb75d0fafa3981e71b4525ba93783729880dc687ca80b8a91fb31325dbad8b67679cd2f243e9186a5233

Download Submit
\Windows\SysWOW64\nethtsrv.exe
Filesize
176KB

MD5
ff26f9f740d4953e5d068d5b4b98fc3e

SHA1
e56f29f63085fae8aedde467ac154158d83232b0

SHA256
de584a156d9b2ce913b395a785a86dccac7fcd7f510c490ac57534b39ef4ce9d

SHA512
f47b2ffc4205901ec0d682d830fb7172ee5d8a12ad44bd78a0697ddff0446309f3c9751e0b23a45cc12d7dd9ae5264b2dc0f8235caca1532556c083c64cfaaf8

Download Submit
\Windows\SysWOW64\netupdsrv.exe
Filesize
159KB

MD5
40b7baa5282b957ce4fd141b2712cb96

SHA1
80033912c0a4c99e839533410c360af9f07c0a84

SHA256
5605f677810ce73e7b91b5211a7876a4b8f8f909385da271d6b1075e4fe260df

SHA512
848cce8a14b48fa543d4f2008c0b0a2783e652490146715494ef946301bdbb135a82bf99cf7898c6732fe6e70a96e5d4e51f3c62a95a48d1e70f6af18b54aea6

Download Submit
memory/288-80-0x0000000000000000-mapping.dmp

Download
memory/580-64-0x0000000000000000-mapping.dmp

Download
memory/632-70-0x0000000000000000-mapping.dmp

Download
memory/824-58-0x0000000000000000-mapping.dmp

Download
memory/916-61-0x0000000000000000-mapping.dmp

Download
memory/960-86-0x0000000000000000-mapping.dmp

Download
memory/1080-87-0x0000000000000000-mapping.dmp

Download
memory/1372-62-0x0000000000000000-mapping.dmp

Download
memory/1464-59-0x0000000000360000-0x00000000007BE000-memory.dmp

Filesize
4.4MB

Download
memory/1464-54-0x0000000075B51000-0x0000000075B53000-memory.dmp

Filesize
8KB

Download
memory/1464-90-0x0000000000360000-0x00000000007BE000-memory.dmp

Filesize
4.4MB

Download
memory/1472-57-0x0000000000000000-mapping.dmp

Download
memory/1556-76-0x0000000000000000-mapping.dmp

Download
memory/1956-81-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads