49d43206a3ac17340568ec2e4da419ae55ec5790f6eff640342dd2eb16405aba

Analysis

max time kernel
38s
max time network
43s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
23-11-2022 10:26

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

49d43206a3ac17340568ec2e4da419ae55ec5790f6eff640342dd2eb16405aba.exe
Size

602KB
MD5

afdb99a1f187fce5a9dcde4506d60c94
SHA1

257839f7e3b4fd9b0e3b2a0a8d2bf94f18ac685f
SHA256

49d43206a3ac17340568ec2e4da419ae55ec5790f6eff640342dd2eb16405aba
SHA512

8ea7a3bd75ec786002db6d32b88a39724c29bb4e1f6181552f6c1a6abd18d4e3d207d54cf091fdb55e0c71872903330653b84d29788388bfe417a88ae0998927
SSDEEP

12288:cIny5DYTWgtu/68ZwKB2ZwvIIkyX7zm3MUDFMAqPF:6UTWgtu/68Zwy6gX+3/bqt

Score

8^/10

discovery

Malware Config

Signatures

Drops file in Drivers directory 1 IoCs

Processes:

49d43206a3ac17340568ec2e4da419ae55ec5790f6eff640342dd2eb16405aba.exe

description ioc process

File created C:\Windows\system32\drivers\nethfdrv.sys 49d43206a3ac17340568ec2e4da419ae55ec5790f6eff640342dd2eb16405aba.exe
Executes dropped EXE 5 IoCs

Processes:

installd.exenethtsrv.exenetupdsrv.exenethtsrv.exenetupdsrv.exe

pid process

1740 installd.exe
1704 nethtsrv.exe
976 netupdsrv.exe
1004 nethtsrv.exe
1308 netupdsrv.exe

description	ioc	process
File created	C:\Windows\system32\drivers\nethfdrv.sys	49d43206a3ac17340568ec2e4da419ae55ec5790f6eff640342dd2eb16405aba.exe

pid	process
1740	installd.exe
1704	nethtsrv.exe
976	netupdsrv.exe
1004	nethtsrv.exe
1308	netupdsrv.exe

Loads dropped DLL 13 IoCs

Processes:

49d43206a3ac17340568ec2e4da419ae55ec5790f6eff640342dd2eb16405aba.exeinstalld.exenethtsrv.exenethtsrv.exe

pid	process
1504	49d43206a3ac17340568ec2e4da419ae55ec5790f6eff640342dd2eb16405aba.exe
1504	49d43206a3ac17340568ec2e4da419ae55ec5790f6eff640342dd2eb16405aba.exe
1504	49d43206a3ac17340568ec2e4da419ae55ec5790f6eff640342dd2eb16405aba.exe
1504	49d43206a3ac17340568ec2e4da419ae55ec5790f6eff640342dd2eb16405aba.exe
1740	installd.exe
1504	49d43206a3ac17340568ec2e4da419ae55ec5790f6eff640342dd2eb16405aba.exe
1704	nethtsrv.exe
1704	nethtsrv.exe
1504	49d43206a3ac17340568ec2e4da419ae55ec5790f6eff640342dd2eb16405aba.exe
1504	49d43206a3ac17340568ec2e4da419ae55ec5790f6eff640342dd2eb16405aba.exe
1004	nethtsrv.exe
1004	nethtsrv.exe
1504	49d43206a3ac17340568ec2e4da419ae55ec5790f6eff640342dd2eb16405aba.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in System32 directory 5 IoCs

Processes:

49d43206a3ac17340568ec2e4da419ae55ec5790f6eff640342dd2eb16405aba.exe

description	ioc	process
File created	C:\Windows\SysWOW64\nethtsrv.exe	49d43206a3ac17340568ec2e4da419ae55ec5790f6eff640342dd2eb16405aba.exe
File created	C:\Windows\SysWOW64\netupdsrv.exe	49d43206a3ac17340568ec2e4da419ae55ec5790f6eff640342dd2eb16405aba.exe
File created	C:\Windows\SysWOW64\hfnapi.dll	49d43206a3ac17340568ec2e4da419ae55ec5790f6eff640342dd2eb16405aba.exe
File created	C:\Windows\SysWOW64\hfpapi.dll	49d43206a3ac17340568ec2e4da419ae55ec5790f6eff640342dd2eb16405aba.exe
File created	C:\Windows\SysWOW64\installd.exe	49d43206a3ac17340568ec2e4da419ae55ec5790f6eff640342dd2eb16405aba.exe

Drops file in Program Files directory 3 IoCs

Processes:

49d43206a3ac17340568ec2e4da419ae55ec5790f6eff640342dd2eb16405aba.exe

description	ioc	process
File created	C:\Program Files (x86)\Common Files\Config\data.xml	49d43206a3ac17340568ec2e4da419ae55ec5790f6eff640342dd2eb16405aba.exe
File created	C:\Program Files (x86)\Common Files\Config\ver.xml	49d43206a3ac17340568ec2e4da419ae55ec5790f6eff640342dd2eb16405aba.exe
File created	C:\Program Files (x86)\Common Files\config\uninstinethnfd.exe	49d43206a3ac17340568ec2e4da419ae55ec5790f6eff640342dd2eb16405aba.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Runs net.exe
Suspicious behavior: LoadsDriver 1 IoCs

Processes:

pid process

460
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

nethtsrv.exe

description pid process

Token: SeDebugPrivilege 1004 nethtsrv.exe

pid	process
460

description	pid	process
Token: SeDebugPrivilege	1004	nethtsrv.exe

Suspicious use of WriteProcessMemory 50 IoCs

Processes:

49d43206a3ac17340568ec2e4da419ae55ec5790f6eff640342dd2eb16405aba.exenet.exenet.exenet.exenet.exe

description	pid	process	target process
PID 1504 wrote to memory of 1324	1504	49d43206a3ac17340568ec2e4da419ae55ec5790f6eff640342dd2eb16405aba.exe	net.exe
PID 1504 wrote to memory of 1324	1504	49d43206a3ac17340568ec2e4da419ae55ec5790f6eff640342dd2eb16405aba.exe	net.exe
PID 1504 wrote to memory of 1324	1504	49d43206a3ac17340568ec2e4da419ae55ec5790f6eff640342dd2eb16405aba.exe	net.exe
PID 1504 wrote to memory of 1324	1504	49d43206a3ac17340568ec2e4da419ae55ec5790f6eff640342dd2eb16405aba.exe	net.exe
PID 1324 wrote to memory of 760	1324	net.exe	net1.exe
PID 1324 wrote to memory of 760	1324	net.exe	net1.exe
PID 1324 wrote to memory of 760	1324	net.exe	net1.exe
PID 1324 wrote to memory of 760	1324	net.exe	net1.exe
PID 1504 wrote to memory of 1940	1504	49d43206a3ac17340568ec2e4da419ae55ec5790f6eff640342dd2eb16405aba.exe	net.exe
PID 1504 wrote to memory of 1940	1504	49d43206a3ac17340568ec2e4da419ae55ec5790f6eff640342dd2eb16405aba.exe	net.exe
PID 1504 wrote to memory of 1940	1504	49d43206a3ac17340568ec2e4da419ae55ec5790f6eff640342dd2eb16405aba.exe	net.exe
PID 1504 wrote to memory of 1940	1504	49d43206a3ac17340568ec2e4da419ae55ec5790f6eff640342dd2eb16405aba.exe	net.exe
PID 1940 wrote to memory of 964	1940	net.exe	net1.exe
PID 1940 wrote to memory of 964	1940	net.exe	net1.exe
PID 1940 wrote to memory of 964	1940	net.exe	net1.exe
PID 1940 wrote to memory of 964	1940	net.exe	net1.exe
PID 1504 wrote to memory of 1740	1504	49d43206a3ac17340568ec2e4da419ae55ec5790f6eff640342dd2eb16405aba.exe	installd.exe
PID 1504 wrote to memory of 1740	1504	49d43206a3ac17340568ec2e4da419ae55ec5790f6eff640342dd2eb16405aba.exe	installd.exe
PID 1504 wrote to memory of 1740	1504	49d43206a3ac17340568ec2e4da419ae55ec5790f6eff640342dd2eb16405aba.exe	installd.exe
PID 1504 wrote to memory of 1740	1504	49d43206a3ac17340568ec2e4da419ae55ec5790f6eff640342dd2eb16405aba.exe	installd.exe
PID 1504 wrote to memory of 1740	1504	49d43206a3ac17340568ec2e4da419ae55ec5790f6eff640342dd2eb16405aba.exe	installd.exe
PID 1504 wrote to memory of 1740	1504	49d43206a3ac17340568ec2e4da419ae55ec5790f6eff640342dd2eb16405aba.exe	installd.exe
PID 1504 wrote to memory of 1740	1504	49d43206a3ac17340568ec2e4da419ae55ec5790f6eff640342dd2eb16405aba.exe	installd.exe
PID 1504 wrote to memory of 1704	1504	49d43206a3ac17340568ec2e4da419ae55ec5790f6eff640342dd2eb16405aba.exe	nethtsrv.exe
PID 1504 wrote to memory of 1704	1504	49d43206a3ac17340568ec2e4da419ae55ec5790f6eff640342dd2eb16405aba.exe	nethtsrv.exe
PID 1504 wrote to memory of 1704	1504	49d43206a3ac17340568ec2e4da419ae55ec5790f6eff640342dd2eb16405aba.exe	nethtsrv.exe
PID 1504 wrote to memory of 1704	1504	49d43206a3ac17340568ec2e4da419ae55ec5790f6eff640342dd2eb16405aba.exe	nethtsrv.exe
PID 1504 wrote to memory of 976	1504	49d43206a3ac17340568ec2e4da419ae55ec5790f6eff640342dd2eb16405aba.exe	netupdsrv.exe
PID 1504 wrote to memory of 976	1504	49d43206a3ac17340568ec2e4da419ae55ec5790f6eff640342dd2eb16405aba.exe	netupdsrv.exe
PID 1504 wrote to memory of 976	1504	49d43206a3ac17340568ec2e4da419ae55ec5790f6eff640342dd2eb16405aba.exe	netupdsrv.exe
PID 1504 wrote to memory of 976	1504	49d43206a3ac17340568ec2e4da419ae55ec5790f6eff640342dd2eb16405aba.exe	netupdsrv.exe
PID 1504 wrote to memory of 976	1504	49d43206a3ac17340568ec2e4da419ae55ec5790f6eff640342dd2eb16405aba.exe	netupdsrv.exe
PID 1504 wrote to memory of 976	1504	49d43206a3ac17340568ec2e4da419ae55ec5790f6eff640342dd2eb16405aba.exe	netupdsrv.exe
PID 1504 wrote to memory of 976	1504	49d43206a3ac17340568ec2e4da419ae55ec5790f6eff640342dd2eb16405aba.exe	netupdsrv.exe
PID 1504 wrote to memory of 740	1504	49d43206a3ac17340568ec2e4da419ae55ec5790f6eff640342dd2eb16405aba.exe	net.exe
PID 1504 wrote to memory of 740	1504	49d43206a3ac17340568ec2e4da419ae55ec5790f6eff640342dd2eb16405aba.exe	net.exe
PID 1504 wrote to memory of 740	1504	49d43206a3ac17340568ec2e4da419ae55ec5790f6eff640342dd2eb16405aba.exe	net.exe
PID 1504 wrote to memory of 740	1504	49d43206a3ac17340568ec2e4da419ae55ec5790f6eff640342dd2eb16405aba.exe	net.exe
PID 740 wrote to memory of 1976	740	net.exe	net1.exe
PID 740 wrote to memory of 1976	740	net.exe	net1.exe
PID 740 wrote to memory of 1976	740	net.exe	net1.exe
PID 740 wrote to memory of 1976	740	net.exe	net1.exe
PID 1504 wrote to memory of 1624	1504	49d43206a3ac17340568ec2e4da419ae55ec5790f6eff640342dd2eb16405aba.exe	net.exe
PID 1504 wrote to memory of 1624	1504	49d43206a3ac17340568ec2e4da419ae55ec5790f6eff640342dd2eb16405aba.exe	net.exe
PID 1504 wrote to memory of 1624	1504	49d43206a3ac17340568ec2e4da419ae55ec5790f6eff640342dd2eb16405aba.exe	net.exe
PID 1504 wrote to memory of 1624	1504	49d43206a3ac17340568ec2e4da419ae55ec5790f6eff640342dd2eb16405aba.exe	net.exe
PID 1624 wrote to memory of 1648	1624	net.exe	net1.exe
PID 1624 wrote to memory of 1648	1624	net.exe	net1.exe
PID 1624 wrote to memory of 1648	1624	net.exe	net1.exe
PID 1624 wrote to memory of 1648	1624	net.exe	net1.exe

C:\Users\Admin\AppData\Local\Temp\49d43206a3ac17340568ec2e4da419ae55ec5790f6eff640342dd2eb16405aba.exe
"C:\Users\Admin\AppData\Local\Temp\49d43206a3ac17340568ec2e4da419ae55ec5790f6eff640342dd2eb16405aba.exe"
1⤵
- Drops file in Drivers directory
- Loads dropped DLL
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:1504

C:\Windows\SysWOW64\net.exe
net stop nethttpservice
2⤵
- Suspicious use of WriteProcessMemory
PID:1324

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop nethttpservice
3⤵
PID:760

C:\Windows\SysWOW64\net.exe
net stop serviceupdater
2⤵
- Suspicious use of WriteProcessMemory
PID:1940

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop serviceupdater
3⤵
PID:964

C:\Windows\SysWOW64\installd.exe
"C:\Windows\system32\installd.exe" nethfdrv
2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1740

C:\Windows\SysWOW64\nethtsrv.exe
"C:\Windows\system32\nethtsrv.exe" -nfdi
2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1704

C:\Windows\SysWOW64\netupdsrv.exe
"C:\Windows\system32\netupdsrv.exe" -nfdi
2⤵
- Executes dropped EXE
PID:976

C:\Windows\SysWOW64\net.exe
net start nethttpservice
2⤵
- Suspicious use of WriteProcessMemory
PID:740

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 start nethttpservice
3⤵
PID:1976

C:\Windows\SysWOW64\net.exe
net start serviceupdater
2⤵
- Suspicious use of WriteProcessMemory
PID:1624

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 start serviceupdater
3⤵
PID:1648

C:\Windows\SysWOW64\nethtsrv.exe
C:\Windows\SysWOW64\nethtsrv.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:1004

C:\Windows\SysWOW64\netupdsrv.exe
C:\Windows\SysWOW64\netupdsrv.exe
1⤵
- Executes dropped EXE
PID:1308

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\hfnapi.dll
Filesize
106KB

MD5
cc222eac586d6ff4a630cb64135b7a29

SHA1
bf07a9850279519c03dd24d61060b662c289c279

SHA256
e5f4df15c827e51ed3b27f069ae475ae7c5b5fd094711944a016fc7b44060858

SHA512
bc87d3d43c2ac3f886a15effc1042359ca5ca77c0e86933d5ac9dcfcccd4a85dc1238f2ef47c29655342c6dc2fd0ca5c92232c83a67a36df6af0787324d23aa8

Download Submit
C:\Windows\SysWOW64\hfpapi.dll
Filesize
241KB

MD5
eb16a64fdf3e15c91aadcfc19fb0f972

SHA1
f8fb08d6c01ffe78fa5f776d46873734fa8a5aa1

SHA256
c6f34651635120d9d115b92f1621658ec02aee839c4fb3d49d3a66ea86ba7927

SHA512
3efe6ae80deac7a75f89c631dd573eba58109fd249e61c8d6afbfe5c41f602e8e27cba8f7aa4afe62d38c4d318dccc73a17dd3673e1b39f92c25f78fab2a74f4

Download Submit
C:\Windows\SysWOW64\installd.exe
Filesize
108KB

MD5
97a7b85635f05204181addd80fc294d0

SHA1
c216b00daf5ebb45c0c834b953ec7169ca9a56b5

SHA256
e9b39e9ec22b6e06eb8a455d2077421432f10a567961422521008e72856c3f3c

SHA512
7bd2db4483fceb8177d83dad10337859e60bbf035178a3cfcbc4f8dcd5df993d499cb3349e226b1511993a00f121c78eda29d2b14a752c1c117383de0301de3e

Download Submit
C:\Windows\SysWOW64\nethtsrv.exe
Filesize
176KB

MD5
697faf48f4c193fd439c9e72b579ebb4

SHA1
2404c13de9cdd3f5a4ae5082c65c756b53fd33e3

SHA256
abbd2978d50ab7839107f450698b53e93e469be2c39923064b2975bad6fca61c

SHA512
337fb38899ca9f59cc445f3c5ac2c18ad506785cd066da0bccd579cd279bf3d558f1e5104e1984b150314506d276c3315008dbe5b269b8d693165290914f908c

Download Submit
C:\Windows\SysWOW64\nethtsrv.exe
Filesize
176KB

MD5
697faf48f4c193fd439c9e72b579ebb4

SHA1
2404c13de9cdd3f5a4ae5082c65c756b53fd33e3

SHA256
abbd2978d50ab7839107f450698b53e93e469be2c39923064b2975bad6fca61c

SHA512
337fb38899ca9f59cc445f3c5ac2c18ad506785cd066da0bccd579cd279bf3d558f1e5104e1984b150314506d276c3315008dbe5b269b8d693165290914f908c

Download Submit
C:\Windows\SysWOW64\netupdsrv.exe
Filesize
159KB

MD5
69749a87ac04410a3df23d64eaa75896

SHA1
32f41832fa69220983b2414392d33ad995a069ff

SHA256
fb034d79a4cec41634da593be9bcf37527b2c484d18b9cc0060dfd44463ceafa

SHA512
a933059849ccb07bda5c38f81f5e421bd959b0ca0da0afc57ec6247382a9993a2ae4bb057f5dbfb42581fbbee58b41124ee8a2bde48b1fdc4afb9d8ae93a7f3b

Download Submit
C:\Windows\SysWOW64\netupdsrv.exe
Filesize
159KB

MD5
69749a87ac04410a3df23d64eaa75896

SHA1
32f41832fa69220983b2414392d33ad995a069ff

SHA256
fb034d79a4cec41634da593be9bcf37527b2c484d18b9cc0060dfd44463ceafa

SHA512
a933059849ccb07bda5c38f81f5e421bd959b0ca0da0afc57ec6247382a9993a2ae4bb057f5dbfb42581fbbee58b41124ee8a2bde48b1fdc4afb9d8ae93a7f3b

Download Submit
\Users\Admin\AppData\Local\Temp\nst5045.tmp\System.dll
Filesize
11KB

MD5
c17103ae9072a06da581dec998343fc1

SHA1
b72148c6bdfaada8b8c3f950e610ee7cf1da1f8d

SHA256
dc58d8ad81cacb0c1ed72e33bff8f23ea40b5252b5bb55d393a0903e6819ae2f

SHA512
d32a71aaef18e993f28096d536e41c4d016850721b31171513ce28bbd805a54fd290b7c3e9d935f72e676a1acfb4f0dcc89d95040a0dd29f2b6975855c18986f

Download Submit
\Users\Admin\AppData\Local\Temp\nst5045.tmp\nsExec.dll
Filesize
6KB

MD5
acc2b699edfea5bf5aae45aba3a41e96

SHA1
d2accf4d494e43ceb2cff69abe4dd17147d29cc2

SHA256
168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e

SHA512
e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe

Download Submit
\Users\Admin\AppData\Local\Temp\nst5045.tmp\nsExec.dll
Filesize
6KB

MD5
acc2b699edfea5bf5aae45aba3a41e96

SHA1
d2accf4d494e43ceb2cff69abe4dd17147d29cc2

SHA256
168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e

SHA512
e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe

Download Submit
\Users\Admin\AppData\Local\Temp\nst5045.tmp\nsExec.dll
Filesize
6KB

MD5
acc2b699edfea5bf5aae45aba3a41e96

SHA1
d2accf4d494e43ceb2cff69abe4dd17147d29cc2

SHA256
168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e

SHA512
e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe

Download Submit
\Users\Admin\AppData\Local\Temp\nst5045.tmp\nsExec.dll
Filesize
6KB

MD5
acc2b699edfea5bf5aae45aba3a41e96

SHA1
d2accf4d494e43ceb2cff69abe4dd17147d29cc2

SHA256
168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e

SHA512
e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe

Download Submit
\Windows\SysWOW64\hfnapi.dll
Filesize
106KB

MD5
cc222eac586d6ff4a630cb64135b7a29

SHA1
bf07a9850279519c03dd24d61060b662c289c279

SHA256
e5f4df15c827e51ed3b27f069ae475ae7c5b5fd094711944a016fc7b44060858

SHA512
bc87d3d43c2ac3f886a15effc1042359ca5ca77c0e86933d5ac9dcfcccd4a85dc1238f2ef47c29655342c6dc2fd0ca5c92232c83a67a36df6af0787324d23aa8

Download Submit
\Windows\SysWOW64\hfnapi.dll
Filesize
106KB

MD5
cc222eac586d6ff4a630cb64135b7a29

SHA1
bf07a9850279519c03dd24d61060b662c289c279

SHA256
e5f4df15c827e51ed3b27f069ae475ae7c5b5fd094711944a016fc7b44060858

SHA512
bc87d3d43c2ac3f886a15effc1042359ca5ca77c0e86933d5ac9dcfcccd4a85dc1238f2ef47c29655342c6dc2fd0ca5c92232c83a67a36df6af0787324d23aa8

Download Submit
\Windows\SysWOW64\hfnapi.dll
Filesize
106KB

MD5
cc222eac586d6ff4a630cb64135b7a29

SHA1
bf07a9850279519c03dd24d61060b662c289c279

SHA256
e5f4df15c827e51ed3b27f069ae475ae7c5b5fd094711944a016fc7b44060858

SHA512
bc87d3d43c2ac3f886a15effc1042359ca5ca77c0e86933d5ac9dcfcccd4a85dc1238f2ef47c29655342c6dc2fd0ca5c92232c83a67a36df6af0787324d23aa8

Download Submit
\Windows\SysWOW64\hfpapi.dll
Filesize
241KB

MD5
eb16a64fdf3e15c91aadcfc19fb0f972

SHA1
f8fb08d6c01ffe78fa5f776d46873734fa8a5aa1

SHA256
c6f34651635120d9d115b92f1621658ec02aee839c4fb3d49d3a66ea86ba7927

SHA512
3efe6ae80deac7a75f89c631dd573eba58109fd249e61c8d6afbfe5c41f602e8e27cba8f7aa4afe62d38c4d318dccc73a17dd3673e1b39f92c25f78fab2a74f4

Download Submit
\Windows\SysWOW64\hfpapi.dll
Filesize
241KB

MD5
eb16a64fdf3e15c91aadcfc19fb0f972

SHA1
f8fb08d6c01ffe78fa5f776d46873734fa8a5aa1

SHA256
c6f34651635120d9d115b92f1621658ec02aee839c4fb3d49d3a66ea86ba7927

SHA512
3efe6ae80deac7a75f89c631dd573eba58109fd249e61c8d6afbfe5c41f602e8e27cba8f7aa4afe62d38c4d318dccc73a17dd3673e1b39f92c25f78fab2a74f4

Download Submit
\Windows\SysWOW64\installd.exe
Filesize
108KB

MD5
97a7b85635f05204181addd80fc294d0

SHA1
c216b00daf5ebb45c0c834b953ec7169ca9a56b5

SHA256
e9b39e9ec22b6e06eb8a455d2077421432f10a567961422521008e72856c3f3c

SHA512
7bd2db4483fceb8177d83dad10337859e60bbf035178a3cfcbc4f8dcd5df993d499cb3349e226b1511993a00f121c78eda29d2b14a752c1c117383de0301de3e

Download Submit
\Windows\SysWOW64\nethtsrv.exe
Filesize
176KB

MD5
697faf48f4c193fd439c9e72b579ebb4

SHA1
2404c13de9cdd3f5a4ae5082c65c756b53fd33e3

SHA256
abbd2978d50ab7839107f450698b53e93e469be2c39923064b2975bad6fca61c

SHA512
337fb38899ca9f59cc445f3c5ac2c18ad506785cd066da0bccd579cd279bf3d558f1e5104e1984b150314506d276c3315008dbe5b269b8d693165290914f908c

Download Submit
\Windows\SysWOW64\netupdsrv.exe
Filesize
159KB

MD5
69749a87ac04410a3df23d64eaa75896

SHA1
32f41832fa69220983b2414392d33ad995a069ff

SHA256
fb034d79a4cec41634da593be9bcf37527b2c484d18b9cc0060dfd44463ceafa

SHA512
a933059849ccb07bda5c38f81f5e421bd959b0ca0da0afc57ec6247382a9993a2ae4bb057f5dbfb42581fbbee58b41124ee8a2bde48b1fdc4afb9d8ae93a7f3b

Download Submit
memory/740-80-0x0000000000000000-mapping.dmp

Download
memory/760-59-0x0000000000000000-mapping.dmp

Download
memory/964-62-0x0000000000000000-mapping.dmp

Download
memory/976-76-0x0000000000000000-mapping.dmp

Download
memory/1324-58-0x0000000000000000-mapping.dmp

Download
memory/1504-90-0x0000000000360000-0x00000000007BE000-memory.dmp

Filesize
4.4MB

Download
memory/1504-55-0x0000000000360000-0x00000000007BE000-memory.dmp

Filesize
4.4MB

Download
memory/1504-54-0x00000000768A1000-0x00000000768A3000-memory.dmp

Filesize
8KB

Download
memory/1624-86-0x0000000000000000-mapping.dmp

Download
memory/1648-87-0x0000000000000000-mapping.dmp

Download
memory/1704-70-0x0000000000000000-mapping.dmp

Download
memory/1740-64-0x0000000000000000-mapping.dmp

Download
memory/1940-61-0x0000000000000000-mapping.dmp

Download
memory/1976-81-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads