4c1d2efdf9d11099695d74ace930897ff357b584cf97e92ccf430e836d291db3

Analysis

max time kernel
44s
max time network
29s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
23-11-2022 10:26

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4c1d2efdf9d11099695d74ace930897ff357b584cf97e92ccf430e836d291db3.exe
Size

601KB
MD5

af6a0db13007b84d90014b5a503f5513
SHA1

b237548a0b902cfefea8c0f63c4a9cd5b424a41d
SHA256

4c1d2efdf9d11099695d74ace930897ff357b584cf97e92ccf430e836d291db3
SHA512

0d2d5783a5d4c5d2bdc9162c00545befc0a6b68f311ef702ac9afff194b209d001e1122e01dc9cface92b9bebbcc83cff149e1afc45a33e53b66e85babd499bd
SSDEEP

12288:mIny5DYT5IUDdh2443p3loQkmly9ZsbMqfOmsx1aRf5kNGc9Q:IUT5vJh2Z3LoQkmlH72aR8G8Q

Score

8^/10

discovery

Malware Config

Signatures

Drops file in Drivers directory 1 IoCs

Processes:

4c1d2efdf9d11099695d74ace930897ff357b584cf97e92ccf430e836d291db3.exe

description ioc process

File created C:\Windows\system32\drivers\nethfdrv.sys 4c1d2efdf9d11099695d74ace930897ff357b584cf97e92ccf430e836d291db3.exe
Executes dropped EXE 5 IoCs

Processes:

installd.exenethtsrv.exenetupdsrv.exenethtsrv.exenetupdsrv.exe

pid process

588 installd.exe
1616 nethtsrv.exe
476 netupdsrv.exe
852 nethtsrv.exe
752 netupdsrv.exe

description	ioc	process
File created	C:\Windows\system32\drivers\nethfdrv.sys	4c1d2efdf9d11099695d74ace930897ff357b584cf97e92ccf430e836d291db3.exe

pid	process
588	installd.exe
1616	nethtsrv.exe
476	netupdsrv.exe
852	nethtsrv.exe
752	netupdsrv.exe

Loads dropped DLL 13 IoCs

Processes:

4c1d2efdf9d11099695d74ace930897ff357b584cf97e92ccf430e836d291db3.exeinstalld.exenethtsrv.exenethtsrv.exe

pid	process
1260	4c1d2efdf9d11099695d74ace930897ff357b584cf97e92ccf430e836d291db3.exe
1260	4c1d2efdf9d11099695d74ace930897ff357b584cf97e92ccf430e836d291db3.exe
1260	4c1d2efdf9d11099695d74ace930897ff357b584cf97e92ccf430e836d291db3.exe
1260	4c1d2efdf9d11099695d74ace930897ff357b584cf97e92ccf430e836d291db3.exe
588	installd.exe
1260	4c1d2efdf9d11099695d74ace930897ff357b584cf97e92ccf430e836d291db3.exe
1616	nethtsrv.exe
1616	nethtsrv.exe
1260	4c1d2efdf9d11099695d74ace930897ff357b584cf97e92ccf430e836d291db3.exe
1260	4c1d2efdf9d11099695d74ace930897ff357b584cf97e92ccf430e836d291db3.exe
852	nethtsrv.exe
852	nethtsrv.exe
1260	4c1d2efdf9d11099695d74ace930897ff357b584cf97e92ccf430e836d291db3.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in System32 directory 5 IoCs

Processes:

4c1d2efdf9d11099695d74ace930897ff357b584cf97e92ccf430e836d291db3.exe

description	ioc	process
File created	C:\Windows\SysWOW64\netupdsrv.exe	4c1d2efdf9d11099695d74ace930897ff357b584cf97e92ccf430e836d291db3.exe
File created	C:\Windows\SysWOW64\hfnapi.dll	4c1d2efdf9d11099695d74ace930897ff357b584cf97e92ccf430e836d291db3.exe
File created	C:\Windows\SysWOW64\hfpapi.dll	4c1d2efdf9d11099695d74ace930897ff357b584cf97e92ccf430e836d291db3.exe
File created	C:\Windows\SysWOW64\installd.exe	4c1d2efdf9d11099695d74ace930897ff357b584cf97e92ccf430e836d291db3.exe
File created	C:\Windows\SysWOW64\nethtsrv.exe	4c1d2efdf9d11099695d74ace930897ff357b584cf97e92ccf430e836d291db3.exe

Drops file in Program Files directory 3 IoCs

Processes:

4c1d2efdf9d11099695d74ace930897ff357b584cf97e92ccf430e836d291db3.exe

description	ioc	process
File created	C:\Program Files (x86)\Common Files\Config\data.xml	4c1d2efdf9d11099695d74ace930897ff357b584cf97e92ccf430e836d291db3.exe
File created	C:\Program Files (x86)\Common Files\Config\ver.xml	4c1d2efdf9d11099695d74ace930897ff357b584cf97e92ccf430e836d291db3.exe
File created	C:\Program Files (x86)\Common Files\config\uninstinethnfd.exe	4c1d2efdf9d11099695d74ace930897ff357b584cf97e92ccf430e836d291db3.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Runs net.exe
Suspicious behavior: LoadsDriver 1 IoCs

Processes:

pid process

464
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

nethtsrv.exe

description pid process

Token: SeDebugPrivilege 852 nethtsrv.exe

pid	process
464

description	pid	process
Token: SeDebugPrivilege	852	nethtsrv.exe

Suspicious use of WriteProcessMemory 50 IoCs

Processes:

4c1d2efdf9d11099695d74ace930897ff357b584cf97e92ccf430e836d291db3.exenet.exenet.exenet.exenet.exe

description	pid	process	target process
PID 1260 wrote to memory of 2020	1260	4c1d2efdf9d11099695d74ace930897ff357b584cf97e92ccf430e836d291db3.exe	net.exe
PID 1260 wrote to memory of 2020	1260	4c1d2efdf9d11099695d74ace930897ff357b584cf97e92ccf430e836d291db3.exe	net.exe
PID 1260 wrote to memory of 2020	1260	4c1d2efdf9d11099695d74ace930897ff357b584cf97e92ccf430e836d291db3.exe	net.exe
PID 1260 wrote to memory of 2020	1260	4c1d2efdf9d11099695d74ace930897ff357b584cf97e92ccf430e836d291db3.exe	net.exe
PID 2020 wrote to memory of 268	2020	net.exe	net1.exe
PID 2020 wrote to memory of 268	2020	net.exe	net1.exe
PID 2020 wrote to memory of 268	2020	net.exe	net1.exe
PID 2020 wrote to memory of 268	2020	net.exe	net1.exe
PID 1260 wrote to memory of 772	1260	4c1d2efdf9d11099695d74ace930897ff357b584cf97e92ccf430e836d291db3.exe	net.exe
PID 1260 wrote to memory of 772	1260	4c1d2efdf9d11099695d74ace930897ff357b584cf97e92ccf430e836d291db3.exe	net.exe
PID 1260 wrote to memory of 772	1260	4c1d2efdf9d11099695d74ace930897ff357b584cf97e92ccf430e836d291db3.exe	net.exe
PID 1260 wrote to memory of 772	1260	4c1d2efdf9d11099695d74ace930897ff357b584cf97e92ccf430e836d291db3.exe	net.exe
PID 772 wrote to memory of 1912	772	net.exe	net1.exe
PID 772 wrote to memory of 1912	772	net.exe	net1.exe
PID 772 wrote to memory of 1912	772	net.exe	net1.exe
PID 772 wrote to memory of 1912	772	net.exe	net1.exe
PID 1260 wrote to memory of 588	1260	4c1d2efdf9d11099695d74ace930897ff357b584cf97e92ccf430e836d291db3.exe	installd.exe
PID 1260 wrote to memory of 588	1260	4c1d2efdf9d11099695d74ace930897ff357b584cf97e92ccf430e836d291db3.exe	installd.exe
PID 1260 wrote to memory of 588	1260	4c1d2efdf9d11099695d74ace930897ff357b584cf97e92ccf430e836d291db3.exe	installd.exe
PID 1260 wrote to memory of 588	1260	4c1d2efdf9d11099695d74ace930897ff357b584cf97e92ccf430e836d291db3.exe	installd.exe
PID 1260 wrote to memory of 588	1260	4c1d2efdf9d11099695d74ace930897ff357b584cf97e92ccf430e836d291db3.exe	installd.exe
PID 1260 wrote to memory of 588	1260	4c1d2efdf9d11099695d74ace930897ff357b584cf97e92ccf430e836d291db3.exe	installd.exe
PID 1260 wrote to memory of 588	1260	4c1d2efdf9d11099695d74ace930897ff357b584cf97e92ccf430e836d291db3.exe	installd.exe
PID 1260 wrote to memory of 1616	1260	4c1d2efdf9d11099695d74ace930897ff357b584cf97e92ccf430e836d291db3.exe	nethtsrv.exe
PID 1260 wrote to memory of 1616	1260	4c1d2efdf9d11099695d74ace930897ff357b584cf97e92ccf430e836d291db3.exe	nethtsrv.exe
PID 1260 wrote to memory of 1616	1260	4c1d2efdf9d11099695d74ace930897ff357b584cf97e92ccf430e836d291db3.exe	nethtsrv.exe
PID 1260 wrote to memory of 1616	1260	4c1d2efdf9d11099695d74ace930897ff357b584cf97e92ccf430e836d291db3.exe	nethtsrv.exe
PID 1260 wrote to memory of 476	1260	4c1d2efdf9d11099695d74ace930897ff357b584cf97e92ccf430e836d291db3.exe	netupdsrv.exe
PID 1260 wrote to memory of 476	1260	4c1d2efdf9d11099695d74ace930897ff357b584cf97e92ccf430e836d291db3.exe	netupdsrv.exe
PID 1260 wrote to memory of 476	1260	4c1d2efdf9d11099695d74ace930897ff357b584cf97e92ccf430e836d291db3.exe	netupdsrv.exe
PID 1260 wrote to memory of 476	1260	4c1d2efdf9d11099695d74ace930897ff357b584cf97e92ccf430e836d291db3.exe	netupdsrv.exe
PID 1260 wrote to memory of 476	1260	4c1d2efdf9d11099695d74ace930897ff357b584cf97e92ccf430e836d291db3.exe	netupdsrv.exe
PID 1260 wrote to memory of 476	1260	4c1d2efdf9d11099695d74ace930897ff357b584cf97e92ccf430e836d291db3.exe	netupdsrv.exe
PID 1260 wrote to memory of 476	1260	4c1d2efdf9d11099695d74ace930897ff357b584cf97e92ccf430e836d291db3.exe	netupdsrv.exe
PID 1260 wrote to memory of 1168	1260	4c1d2efdf9d11099695d74ace930897ff357b584cf97e92ccf430e836d291db3.exe	net.exe
PID 1260 wrote to memory of 1168	1260	4c1d2efdf9d11099695d74ace930897ff357b584cf97e92ccf430e836d291db3.exe	net.exe
PID 1260 wrote to memory of 1168	1260	4c1d2efdf9d11099695d74ace930897ff357b584cf97e92ccf430e836d291db3.exe	net.exe
PID 1260 wrote to memory of 1168	1260	4c1d2efdf9d11099695d74ace930897ff357b584cf97e92ccf430e836d291db3.exe	net.exe
PID 1168 wrote to memory of 780	1168	net.exe	net1.exe
PID 1168 wrote to memory of 780	1168	net.exe	net1.exe
PID 1168 wrote to memory of 780	1168	net.exe	net1.exe
PID 1168 wrote to memory of 780	1168	net.exe	net1.exe
PID 1260 wrote to memory of 1976	1260	4c1d2efdf9d11099695d74ace930897ff357b584cf97e92ccf430e836d291db3.exe	net.exe
PID 1260 wrote to memory of 1976	1260	4c1d2efdf9d11099695d74ace930897ff357b584cf97e92ccf430e836d291db3.exe	net.exe
PID 1260 wrote to memory of 1976	1260	4c1d2efdf9d11099695d74ace930897ff357b584cf97e92ccf430e836d291db3.exe	net.exe
PID 1260 wrote to memory of 1976	1260	4c1d2efdf9d11099695d74ace930897ff357b584cf97e92ccf430e836d291db3.exe	net.exe
PID 1976 wrote to memory of 1828	1976	net.exe	net1.exe
PID 1976 wrote to memory of 1828	1976	net.exe	net1.exe
PID 1976 wrote to memory of 1828	1976	net.exe	net1.exe
PID 1976 wrote to memory of 1828	1976	net.exe	net1.exe

C:\Users\Admin\AppData\Local\Temp\4c1d2efdf9d11099695d74ace930897ff357b584cf97e92ccf430e836d291db3.exe
"C:\Users\Admin\AppData\Local\Temp\4c1d2efdf9d11099695d74ace930897ff357b584cf97e92ccf430e836d291db3.exe"
1⤵
- Drops file in Drivers directory
- Loads dropped DLL
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:1260

C:\Windows\SysWOW64\net.exe
net stop nethttpservice
2⤵
- Suspicious use of WriteProcessMemory
PID:2020

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop nethttpservice
3⤵
PID:268

C:\Windows\SysWOW64\net.exe
net stop serviceupdater
2⤵
- Suspicious use of WriteProcessMemory
PID:772

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop serviceupdater
3⤵
PID:1912

C:\Windows\SysWOW64\installd.exe
"C:\Windows\system32\installd.exe" nethfdrv
2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:588

C:\Windows\SysWOW64\nethtsrv.exe
"C:\Windows\system32\nethtsrv.exe" -nfdi
2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1616

C:\Windows\SysWOW64\netupdsrv.exe
"C:\Windows\system32\netupdsrv.exe" -nfdi
2⤵
- Executes dropped EXE
PID:476

C:\Windows\SysWOW64\net.exe
net start nethttpservice
2⤵
- Suspicious use of WriteProcessMemory
PID:1168

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 start nethttpservice
3⤵
PID:780

C:\Windows\SysWOW64\net.exe
net start serviceupdater
2⤵
- Suspicious use of WriteProcessMemory
PID:1976

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 start serviceupdater
3⤵
PID:1828

C:\Windows\SysWOW64\nethtsrv.exe
C:\Windows\SysWOW64\nethtsrv.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:852

C:\Windows\SysWOW64\netupdsrv.exe
C:\Windows\SysWOW64\netupdsrv.exe
1⤵
- Executes dropped EXE
PID:752

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\hfnapi.dll
Filesize
106KB

MD5
d25afbba9b675bdb378933aa3e0135b0

SHA1
dc9bdd1181ffc88611a0636a86600e4b956e0d10

SHA256
bc9eb653f2e936869d8a329c4721a45fb663be249d4799b8cecd6e3cc8d9ce51

SHA512
ce796ca8c45156d036128d14d96476e266a4e56ca3caf5a391bbba2a912fa41bf9883748844c1a688f3475126b033e4e0f2ca2449913354827ae5adcab4668ed

Download Submit
C:\Windows\SysWOW64\hfpapi.dll
Filesize
241KB

MD5
36cbf1a85c785211247b1b38b6345231

SHA1
7d2e8ee65eb4b20aacf2a5726a8db255a852b835

SHA256
b99756a501a751543edea514d4ac19306c7b94e587b7869c51d4940ca0c655a5

SHA512
7d3b93fe41adb8870e74a6ba4ab82eeabeb0bb25f104809958f3ce19a3cc36d85961b3003bd440931af68df878dc91018c10102df8f5065dceef3352e64a015c

Download Submit
C:\Windows\SysWOW64\installd.exe
Filesize
108KB

MD5
4f007224b62586d1462d39e6f41dc403

SHA1
484d24d2a33eac2b9317daf2bb5a44de1631153e

SHA256
a08285597d669b62a999d91ab73811bfb34b129781c91a5342a30ace20761c9c

SHA512
f995d0502e6ac5d8925009ef9d85cd79f175143fa2515e4e14e25500ddaa0b937adacfc639bce188520ff7f9b28f4c71aea705910f3fe1c96049bb4d3b8a39c7

Download Submit
C:\Windows\SysWOW64\nethtsrv.exe
Filesize
176KB

MD5
ddf2c35a24e7d43ffc726f0b76b1bdb3

SHA1
181904fc82d285eca90125d8e3dd1f5396241f5f

SHA256
8b7d16f16007874742b4f908ffa20ec18338fd44179b8b555aa428a126858f90

SHA512
a5b3ad8b370087dee91a3c09e28b7b20851606a992dd51a360246486913c16347f661921c708e573ada4fb1e491d36f9f5fab0165aca18440ced9e9403bca461

Download Submit
C:\Windows\SysWOW64\nethtsrv.exe
Filesize
176KB

MD5
ddf2c35a24e7d43ffc726f0b76b1bdb3

SHA1
181904fc82d285eca90125d8e3dd1f5396241f5f

SHA256
8b7d16f16007874742b4f908ffa20ec18338fd44179b8b555aa428a126858f90

SHA512
a5b3ad8b370087dee91a3c09e28b7b20851606a992dd51a360246486913c16347f661921c708e573ada4fb1e491d36f9f5fab0165aca18440ced9e9403bca461

Download Submit
C:\Windows\SysWOW64\netupdsrv.exe
Filesize
159KB

MD5
3f7f2cce5cd1c939c18d5a953905f1c7

SHA1
ffb2cdd135e3bb670f5d04d7864d35fcb2813df4

SHA256
0060928009341ad3c679b765323f4cb1d12fc760905741ec02d7a4f5aa5c54bc

SHA512
142ee7f80e20434d77660df3af5692d41077814b50867eeea8038b8f25c898f7dd48b32f08116f763280fa5df750540532596b5235f9c43919e0baad2efc7320

Download Submit
C:\Windows\SysWOW64\netupdsrv.exe
Filesize
159KB

MD5
3f7f2cce5cd1c939c18d5a953905f1c7

SHA1
ffb2cdd135e3bb670f5d04d7864d35fcb2813df4

SHA256
0060928009341ad3c679b765323f4cb1d12fc760905741ec02d7a4f5aa5c54bc

SHA512
142ee7f80e20434d77660df3af5692d41077814b50867eeea8038b8f25c898f7dd48b32f08116f763280fa5df750540532596b5235f9c43919e0baad2efc7320

Download Submit
\Users\Admin\AppData\Local\Temp\nsyB5DA.tmp\System.dll
Filesize
11KB

MD5
c17103ae9072a06da581dec998343fc1

SHA1
b72148c6bdfaada8b8c3f950e610ee7cf1da1f8d

SHA256
dc58d8ad81cacb0c1ed72e33bff8f23ea40b5252b5bb55d393a0903e6819ae2f

SHA512
d32a71aaef18e993f28096d536e41c4d016850721b31171513ce28bbd805a54fd290b7c3e9d935f72e676a1acfb4f0dcc89d95040a0dd29f2b6975855c18986f

Download Submit
\Users\Admin\AppData\Local\Temp\nsyB5DA.tmp\nsExec.dll
Filesize
6KB

MD5
acc2b699edfea5bf5aae45aba3a41e96

SHA1
d2accf4d494e43ceb2cff69abe4dd17147d29cc2

SHA256
168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e

SHA512
e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe

Download Submit
\Users\Admin\AppData\Local\Temp\nsyB5DA.tmp\nsExec.dll
Filesize
6KB

MD5
acc2b699edfea5bf5aae45aba3a41e96

SHA1
d2accf4d494e43ceb2cff69abe4dd17147d29cc2

SHA256
168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e

SHA512
e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe

Download Submit
\Users\Admin\AppData\Local\Temp\nsyB5DA.tmp\nsExec.dll
Filesize
6KB

MD5
acc2b699edfea5bf5aae45aba3a41e96

SHA1
d2accf4d494e43ceb2cff69abe4dd17147d29cc2

SHA256
168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e

SHA512
e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe

Download Submit
\Users\Admin\AppData\Local\Temp\nsyB5DA.tmp\nsExec.dll
Filesize
6KB

MD5
acc2b699edfea5bf5aae45aba3a41e96

SHA1
d2accf4d494e43ceb2cff69abe4dd17147d29cc2

SHA256
168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e

SHA512
e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe

Download Submit
\Windows\SysWOW64\hfnapi.dll
Filesize
106KB

MD5
d25afbba9b675bdb378933aa3e0135b0

SHA1
dc9bdd1181ffc88611a0636a86600e4b956e0d10

SHA256
bc9eb653f2e936869d8a329c4721a45fb663be249d4799b8cecd6e3cc8d9ce51

SHA512
ce796ca8c45156d036128d14d96476e266a4e56ca3caf5a391bbba2a912fa41bf9883748844c1a688f3475126b033e4e0f2ca2449913354827ae5adcab4668ed

Download Submit
\Windows\SysWOW64\hfnapi.dll
Filesize
106KB

MD5
d25afbba9b675bdb378933aa3e0135b0

SHA1
dc9bdd1181ffc88611a0636a86600e4b956e0d10

SHA256
bc9eb653f2e936869d8a329c4721a45fb663be249d4799b8cecd6e3cc8d9ce51

SHA512
ce796ca8c45156d036128d14d96476e266a4e56ca3caf5a391bbba2a912fa41bf9883748844c1a688f3475126b033e4e0f2ca2449913354827ae5adcab4668ed

Download Submit
\Windows\SysWOW64\hfnapi.dll
Filesize
106KB

MD5
d25afbba9b675bdb378933aa3e0135b0

SHA1
dc9bdd1181ffc88611a0636a86600e4b956e0d10

SHA256
bc9eb653f2e936869d8a329c4721a45fb663be249d4799b8cecd6e3cc8d9ce51

SHA512
ce796ca8c45156d036128d14d96476e266a4e56ca3caf5a391bbba2a912fa41bf9883748844c1a688f3475126b033e4e0f2ca2449913354827ae5adcab4668ed

Download Submit
\Windows\SysWOW64\hfpapi.dll
Filesize
241KB

MD5
36cbf1a85c785211247b1b38b6345231

SHA1
7d2e8ee65eb4b20aacf2a5726a8db255a852b835

SHA256
b99756a501a751543edea514d4ac19306c7b94e587b7869c51d4940ca0c655a5

SHA512
7d3b93fe41adb8870e74a6ba4ab82eeabeb0bb25f104809958f3ce19a3cc36d85961b3003bd440931af68df878dc91018c10102df8f5065dceef3352e64a015c

Download Submit
\Windows\SysWOW64\hfpapi.dll
Filesize
241KB

MD5
36cbf1a85c785211247b1b38b6345231

SHA1
7d2e8ee65eb4b20aacf2a5726a8db255a852b835

SHA256
b99756a501a751543edea514d4ac19306c7b94e587b7869c51d4940ca0c655a5

SHA512
7d3b93fe41adb8870e74a6ba4ab82eeabeb0bb25f104809958f3ce19a3cc36d85961b3003bd440931af68df878dc91018c10102df8f5065dceef3352e64a015c

Download Submit
\Windows\SysWOW64\installd.exe
Filesize
108KB

MD5
4f007224b62586d1462d39e6f41dc403

SHA1
484d24d2a33eac2b9317daf2bb5a44de1631153e

SHA256
a08285597d669b62a999d91ab73811bfb34b129781c91a5342a30ace20761c9c

SHA512
f995d0502e6ac5d8925009ef9d85cd79f175143fa2515e4e14e25500ddaa0b937adacfc639bce188520ff7f9b28f4c71aea705910f3fe1c96049bb4d3b8a39c7

Download Submit
\Windows\SysWOW64\nethtsrv.exe
Filesize
176KB

MD5
ddf2c35a24e7d43ffc726f0b76b1bdb3

SHA1
181904fc82d285eca90125d8e3dd1f5396241f5f

SHA256
8b7d16f16007874742b4f908ffa20ec18338fd44179b8b555aa428a126858f90

SHA512
a5b3ad8b370087dee91a3c09e28b7b20851606a992dd51a360246486913c16347f661921c708e573ada4fb1e491d36f9f5fab0165aca18440ced9e9403bca461

Download Submit
\Windows\SysWOW64\netupdsrv.exe
Filesize
159KB

MD5
3f7f2cce5cd1c939c18d5a953905f1c7

SHA1
ffb2cdd135e3bb670f5d04d7864d35fcb2813df4

SHA256
0060928009341ad3c679b765323f4cb1d12fc760905741ec02d7a4f5aa5c54bc

SHA512
142ee7f80e20434d77660df3af5692d41077814b50867eeea8038b8f25c898f7dd48b32f08116f763280fa5df750540532596b5235f9c43919e0baad2efc7320

Download Submit
memory/268-58-0x0000000000000000-mapping.dmp

Download
memory/476-77-0x0000000000000000-mapping.dmp

Download
memory/588-64-0x0000000000000000-mapping.dmp

Download
memory/772-60-0x0000000000000000-mapping.dmp

Download
memory/780-82-0x0000000000000000-mapping.dmp

Download
memory/1168-81-0x0000000000000000-mapping.dmp

Download
memory/1260-62-0x0000000000360000-0x00000000007BE000-memory.dmp

Filesize
4.4MB

Download
memory/1260-69-0x0000000000360000-0x00000000007BE000-memory.dmp

Filesize
4.4MB

Download
memory/1260-54-0x0000000075C41000-0x0000000075C43000-memory.dmp

Filesize
8KB

Download
memory/1260-91-0x0000000000360000-0x00000000007BE000-memory.dmp

Filesize
4.4MB

Download
memory/1616-71-0x0000000000000000-mapping.dmp

Download
memory/1828-88-0x0000000000000000-mapping.dmp

Download
memory/1912-61-0x0000000000000000-mapping.dmp

Download
memory/1976-87-0x0000000000000000-mapping.dmp

Download
memory/2020-57-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads