393a99b230210e34ef01f6634c6aa3dadeb0b78ec84343798d3395b8018e78fe

Analysis

max time kernel
44s
max time network
49s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
23-11-2022 10:28

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

393a99b230210e34ef01f6634c6aa3dadeb0b78ec84343798d3395b8018e78fe.exe
Size

603KB
MD5

0fa5adfeeaab820419511b7349bb067c
SHA1

2f25c4439b55694ae58a2e86727425b5006faf40
SHA256

393a99b230210e34ef01f6634c6aa3dadeb0b78ec84343798d3395b8018e78fe
SHA512

8cfc75a07c749a5a2b501414e26f32269e5e420fce656b12767faa87d7687bfe3543b12e328c3c77573ca8d466029d89f920e42296f90d0fc23626c090e33762
SSDEEP

12288:8Iny5DYTE3dTEhZ4j4ASHkD2hRC4Hqld1xLaFhqBpRZx:aUTE3ChZ91dGmSd1xOFCZ

Score

8^/10

discovery

Malware Config

Signatures

Drops file in Drivers directory 1 IoCs

Processes:

393a99b230210e34ef01f6634c6aa3dadeb0b78ec84343798d3395b8018e78fe.exe

description ioc process

File created C:\Windows\system32\drivers\nethfdrv.sys 393a99b230210e34ef01f6634c6aa3dadeb0b78ec84343798d3395b8018e78fe.exe
Executes dropped EXE 5 IoCs

Processes:

installd.exenethtsrv.exenetupdsrv.exenethtsrv.exenetupdsrv.exe

pid process

1292 installd.exe
1592 nethtsrv.exe
1428 netupdsrv.exe
616 nethtsrv.exe
432 netupdsrv.exe

description	ioc	process
File created	C:\Windows\system32\drivers\nethfdrv.sys	393a99b230210e34ef01f6634c6aa3dadeb0b78ec84343798d3395b8018e78fe.exe

pid	process
1292	installd.exe
1592	nethtsrv.exe
1428	netupdsrv.exe
616	nethtsrv.exe
432	netupdsrv.exe

Loads dropped DLL 13 IoCs

Processes:

393a99b230210e34ef01f6634c6aa3dadeb0b78ec84343798d3395b8018e78fe.exeinstalld.exenethtsrv.exenethtsrv.exe

pid	process
2024	393a99b230210e34ef01f6634c6aa3dadeb0b78ec84343798d3395b8018e78fe.exe
2024	393a99b230210e34ef01f6634c6aa3dadeb0b78ec84343798d3395b8018e78fe.exe
2024	393a99b230210e34ef01f6634c6aa3dadeb0b78ec84343798d3395b8018e78fe.exe
2024	393a99b230210e34ef01f6634c6aa3dadeb0b78ec84343798d3395b8018e78fe.exe
1292	installd.exe
2024	393a99b230210e34ef01f6634c6aa3dadeb0b78ec84343798d3395b8018e78fe.exe
1592	nethtsrv.exe
1592	nethtsrv.exe
2024	393a99b230210e34ef01f6634c6aa3dadeb0b78ec84343798d3395b8018e78fe.exe
2024	393a99b230210e34ef01f6634c6aa3dadeb0b78ec84343798d3395b8018e78fe.exe
616	nethtsrv.exe
616	nethtsrv.exe
2024	393a99b230210e34ef01f6634c6aa3dadeb0b78ec84343798d3395b8018e78fe.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in System32 directory 5 IoCs

Processes:

393a99b230210e34ef01f6634c6aa3dadeb0b78ec84343798d3395b8018e78fe.exe

description	ioc	process
File created	C:\Windows\SysWOW64\hfnapi.dll	393a99b230210e34ef01f6634c6aa3dadeb0b78ec84343798d3395b8018e78fe.exe
File created	C:\Windows\SysWOW64\hfpapi.dll	393a99b230210e34ef01f6634c6aa3dadeb0b78ec84343798d3395b8018e78fe.exe
File created	C:\Windows\SysWOW64\installd.exe	393a99b230210e34ef01f6634c6aa3dadeb0b78ec84343798d3395b8018e78fe.exe
File created	C:\Windows\SysWOW64\nethtsrv.exe	393a99b230210e34ef01f6634c6aa3dadeb0b78ec84343798d3395b8018e78fe.exe
File created	C:\Windows\SysWOW64\netupdsrv.exe	393a99b230210e34ef01f6634c6aa3dadeb0b78ec84343798d3395b8018e78fe.exe

Drops file in Program Files directory 3 IoCs

Processes:

393a99b230210e34ef01f6634c6aa3dadeb0b78ec84343798d3395b8018e78fe.exe

description	ioc	process
File created	C:\Program Files (x86)\Common Files\Config\data.xml	393a99b230210e34ef01f6634c6aa3dadeb0b78ec84343798d3395b8018e78fe.exe
File created	C:\Program Files (x86)\Common Files\Config\ver.xml	393a99b230210e34ef01f6634c6aa3dadeb0b78ec84343798d3395b8018e78fe.exe
File created	C:\Program Files (x86)\Common Files\config\uninstinethnfd.exe	393a99b230210e34ef01f6634c6aa3dadeb0b78ec84343798d3395b8018e78fe.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Runs net.exe
Suspicious behavior: LoadsDriver 1 IoCs

Processes:

pid process

468
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

nethtsrv.exe

description pid process

Token: SeDebugPrivilege 616 nethtsrv.exe

pid	process
468

description	pid	process
Token: SeDebugPrivilege	616	nethtsrv.exe

Suspicious use of WriteProcessMemory 50 IoCs

Processes:

393a99b230210e34ef01f6634c6aa3dadeb0b78ec84343798d3395b8018e78fe.exenet.exenet.exenet.exenet.exe

description	pid	process	target process
PID 2024 wrote to memory of 1680	2024	393a99b230210e34ef01f6634c6aa3dadeb0b78ec84343798d3395b8018e78fe.exe	net.exe
PID 2024 wrote to memory of 1680	2024	393a99b230210e34ef01f6634c6aa3dadeb0b78ec84343798d3395b8018e78fe.exe	net.exe
PID 2024 wrote to memory of 1680	2024	393a99b230210e34ef01f6634c6aa3dadeb0b78ec84343798d3395b8018e78fe.exe	net.exe
PID 2024 wrote to memory of 1680	2024	393a99b230210e34ef01f6634c6aa3dadeb0b78ec84343798d3395b8018e78fe.exe	net.exe
PID 1680 wrote to memory of 1732	1680	net.exe	net1.exe
PID 1680 wrote to memory of 1732	1680	net.exe	net1.exe
PID 1680 wrote to memory of 1732	1680	net.exe	net1.exe
PID 1680 wrote to memory of 1732	1680	net.exe	net1.exe
PID 2024 wrote to memory of 676	2024	393a99b230210e34ef01f6634c6aa3dadeb0b78ec84343798d3395b8018e78fe.exe	net.exe
PID 2024 wrote to memory of 676	2024	393a99b230210e34ef01f6634c6aa3dadeb0b78ec84343798d3395b8018e78fe.exe	net.exe
PID 2024 wrote to memory of 676	2024	393a99b230210e34ef01f6634c6aa3dadeb0b78ec84343798d3395b8018e78fe.exe	net.exe
PID 2024 wrote to memory of 676	2024	393a99b230210e34ef01f6634c6aa3dadeb0b78ec84343798d3395b8018e78fe.exe	net.exe
PID 676 wrote to memory of 520	676	net.exe	net1.exe
PID 676 wrote to memory of 520	676	net.exe	net1.exe
PID 676 wrote to memory of 520	676	net.exe	net1.exe
PID 676 wrote to memory of 520	676	net.exe	net1.exe
PID 2024 wrote to memory of 1292	2024	393a99b230210e34ef01f6634c6aa3dadeb0b78ec84343798d3395b8018e78fe.exe	installd.exe
PID 2024 wrote to memory of 1292	2024	393a99b230210e34ef01f6634c6aa3dadeb0b78ec84343798d3395b8018e78fe.exe	installd.exe
PID 2024 wrote to memory of 1292	2024	393a99b230210e34ef01f6634c6aa3dadeb0b78ec84343798d3395b8018e78fe.exe	installd.exe
PID 2024 wrote to memory of 1292	2024	393a99b230210e34ef01f6634c6aa3dadeb0b78ec84343798d3395b8018e78fe.exe	installd.exe
PID 2024 wrote to memory of 1292	2024	393a99b230210e34ef01f6634c6aa3dadeb0b78ec84343798d3395b8018e78fe.exe	installd.exe
PID 2024 wrote to memory of 1292	2024	393a99b230210e34ef01f6634c6aa3dadeb0b78ec84343798d3395b8018e78fe.exe	installd.exe
PID 2024 wrote to memory of 1292	2024	393a99b230210e34ef01f6634c6aa3dadeb0b78ec84343798d3395b8018e78fe.exe	installd.exe
PID 2024 wrote to memory of 1592	2024	393a99b230210e34ef01f6634c6aa3dadeb0b78ec84343798d3395b8018e78fe.exe	nethtsrv.exe
PID 2024 wrote to memory of 1592	2024	393a99b230210e34ef01f6634c6aa3dadeb0b78ec84343798d3395b8018e78fe.exe	nethtsrv.exe
PID 2024 wrote to memory of 1592	2024	393a99b230210e34ef01f6634c6aa3dadeb0b78ec84343798d3395b8018e78fe.exe	nethtsrv.exe
PID 2024 wrote to memory of 1592	2024	393a99b230210e34ef01f6634c6aa3dadeb0b78ec84343798d3395b8018e78fe.exe	nethtsrv.exe
PID 2024 wrote to memory of 1428	2024	393a99b230210e34ef01f6634c6aa3dadeb0b78ec84343798d3395b8018e78fe.exe	netupdsrv.exe
PID 2024 wrote to memory of 1428	2024	393a99b230210e34ef01f6634c6aa3dadeb0b78ec84343798d3395b8018e78fe.exe	netupdsrv.exe
PID 2024 wrote to memory of 1428	2024	393a99b230210e34ef01f6634c6aa3dadeb0b78ec84343798d3395b8018e78fe.exe	netupdsrv.exe
PID 2024 wrote to memory of 1428	2024	393a99b230210e34ef01f6634c6aa3dadeb0b78ec84343798d3395b8018e78fe.exe	netupdsrv.exe
PID 2024 wrote to memory of 1428	2024	393a99b230210e34ef01f6634c6aa3dadeb0b78ec84343798d3395b8018e78fe.exe	netupdsrv.exe
PID 2024 wrote to memory of 1428	2024	393a99b230210e34ef01f6634c6aa3dadeb0b78ec84343798d3395b8018e78fe.exe	netupdsrv.exe
PID 2024 wrote to memory of 1428	2024	393a99b230210e34ef01f6634c6aa3dadeb0b78ec84343798d3395b8018e78fe.exe	netupdsrv.exe
PID 2024 wrote to memory of 2004	2024	393a99b230210e34ef01f6634c6aa3dadeb0b78ec84343798d3395b8018e78fe.exe	net.exe
PID 2024 wrote to memory of 2004	2024	393a99b230210e34ef01f6634c6aa3dadeb0b78ec84343798d3395b8018e78fe.exe	net.exe
PID 2024 wrote to memory of 2004	2024	393a99b230210e34ef01f6634c6aa3dadeb0b78ec84343798d3395b8018e78fe.exe	net.exe
PID 2024 wrote to memory of 2004	2024	393a99b230210e34ef01f6634c6aa3dadeb0b78ec84343798d3395b8018e78fe.exe	net.exe
PID 2004 wrote to memory of 1740	2004	net.exe	net1.exe
PID 2004 wrote to memory of 1740	2004	net.exe	net1.exe
PID 2004 wrote to memory of 1740	2004	net.exe	net1.exe
PID 2004 wrote to memory of 1740	2004	net.exe	net1.exe
PID 2024 wrote to memory of 744	2024	393a99b230210e34ef01f6634c6aa3dadeb0b78ec84343798d3395b8018e78fe.exe	net.exe
PID 2024 wrote to memory of 744	2024	393a99b230210e34ef01f6634c6aa3dadeb0b78ec84343798d3395b8018e78fe.exe	net.exe
PID 2024 wrote to memory of 744	2024	393a99b230210e34ef01f6634c6aa3dadeb0b78ec84343798d3395b8018e78fe.exe	net.exe
PID 2024 wrote to memory of 744	2024	393a99b230210e34ef01f6634c6aa3dadeb0b78ec84343798d3395b8018e78fe.exe	net.exe
PID 744 wrote to memory of 1952	744	net.exe	net1.exe
PID 744 wrote to memory of 1952	744	net.exe	net1.exe
PID 744 wrote to memory of 1952	744	net.exe	net1.exe
PID 744 wrote to memory of 1952	744	net.exe	net1.exe

C:\Users\Admin\AppData\Local\Temp\393a99b230210e34ef01f6634c6aa3dadeb0b78ec84343798d3395b8018e78fe.exe
"C:\Users\Admin\AppData\Local\Temp\393a99b230210e34ef01f6634c6aa3dadeb0b78ec84343798d3395b8018e78fe.exe"
1⤵
- Drops file in Drivers directory
- Loads dropped DLL
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:2024

C:\Windows\SysWOW64\net.exe
net stop nethttpservice
2⤵
- Suspicious use of WriteProcessMemory
PID:1680

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop nethttpservice
3⤵
PID:1732

C:\Windows\SysWOW64\net.exe
net stop serviceupdater
2⤵
- Suspicious use of WriteProcessMemory
PID:676

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop serviceupdater
3⤵
PID:520

C:\Windows\SysWOW64\installd.exe
"C:\Windows\system32\installd.exe" nethfdrv
2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1292

C:\Windows\SysWOW64\nethtsrv.exe
"C:\Windows\system32\nethtsrv.exe" -nfdi
2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1592

C:\Windows\SysWOW64\netupdsrv.exe
"C:\Windows\system32\netupdsrv.exe" -nfdi
2⤵
- Executes dropped EXE
PID:1428

C:\Windows\SysWOW64\net.exe
net start nethttpservice
2⤵
- Suspicious use of WriteProcessMemory
PID:2004

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 start nethttpservice
3⤵
PID:1740

C:\Windows\SysWOW64\net.exe
net start serviceupdater
2⤵
- Suspicious use of WriteProcessMemory
PID:744

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 start serviceupdater
3⤵
PID:1952

C:\Windows\SysWOW64\nethtsrv.exe
C:\Windows\SysWOW64\nethtsrv.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:616

C:\Windows\SysWOW64\netupdsrv.exe
C:\Windows\SysWOW64\netupdsrv.exe
1⤵
- Executes dropped EXE
PID:432

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\hfnapi.dll
Filesize
106KB

MD5
4d19b92f670b50554a29a9878f03639c

SHA1
263287f84d68bd5cec0b301ed12339bbf1383cc3

SHA256
c1767a4a654d6353bcf6440cc043c532486be927f9fbfe3deb786301cb57433d

SHA512
496c0428e71e58858fbdb4c77448605af716f48f575c93411765dd8d9c0c5419f1f91c17e56e2c3b404936930028c4607e99b0ca430b04c1e47cc4ada8f49906

Download Submit
C:\Windows\SysWOW64\hfpapi.dll
Filesize
241KB

MD5
8240d2dcaa2c4c7fe6f91b0613abb1de

SHA1
0e7fe1d2517dd5a8c5cb3535e9a43b4cd77874e2

SHA256
3896724153e58fe338a5f660f3f43f81a2ef5aab887abb976c90e0c69a1dedd7

SHA512
baa8788c64221e78a9a3943e607af966cbbd99ad0266cec0910d4264e6fcfbc1f8cd56dd51626b637f5bb3d98f4866ef990040baed24d7e8c7cdd4eaba69468f

Download Submit
C:\Windows\SysWOW64\installd.exe
Filesize
108KB

MD5
378ea96a2625f43a4bc0535912c1004a

SHA1
36d7d73aa44423c567d38046dc574eb597892be6

SHA256
25405a1b4db7d8882c1d8ff2155d9b1db9987b96f0cbdc3636b37c84a0949b03

SHA512
2ac22e3f9adfed481b0b9d483ac49348c40250d7179a696c2ec766e9a2f8e496d7a5247125b363f6ecd131f678f1f849ac9e409bec83082d5cb936507eb0d52d

Download Submit
C:\Windows\SysWOW64\nethtsrv.exe
Filesize
176KB

MD5
afe0a536a15a5fc24e2e99890139bbf7

SHA1
005751ee59636618d392048f53e996156becafec

SHA256
35941e057915838b4a2d6e1ba12d9f61fd379ffa31c5cdfc7a6e28f4f90ef903

SHA512
48d48e0f53781a100eedebe62f3d251b20b33523abe185e4e307fc876e18d56beffc922730890be4bd0a6532d52b5a1474af70ef3e697f49063c8aacb67833d0

Download Submit
C:\Windows\SysWOW64\nethtsrv.exe
Filesize
176KB

MD5
afe0a536a15a5fc24e2e99890139bbf7

SHA1
005751ee59636618d392048f53e996156becafec

SHA256
35941e057915838b4a2d6e1ba12d9f61fd379ffa31c5cdfc7a6e28f4f90ef903

SHA512
48d48e0f53781a100eedebe62f3d251b20b33523abe185e4e307fc876e18d56beffc922730890be4bd0a6532d52b5a1474af70ef3e697f49063c8aacb67833d0

Download Submit
C:\Windows\SysWOW64\netupdsrv.exe
Filesize
159KB

MD5
99568da559a884a89604b7bcfea00996

SHA1
1d2b33ecb296e04791127015f7f0394e5b7384e2

SHA256
7374faf35d0a53f588b01d1c61304950aa6e1d439ab34ef81dfadbf19f4d100a

SHA512
412e6c57a092fa9b44253ed46a74503a2824fe4c02f8fdc80c89da2defb0b7124166187a49418cc885011bc322dc872eed111ae7be2a92620ae1063f34f5eab5

Download Submit
C:\Windows\SysWOW64\netupdsrv.exe
Filesize
159KB

MD5
99568da559a884a89604b7bcfea00996

SHA1
1d2b33ecb296e04791127015f7f0394e5b7384e2

SHA256
7374faf35d0a53f588b01d1c61304950aa6e1d439ab34ef81dfadbf19f4d100a

SHA512
412e6c57a092fa9b44253ed46a74503a2824fe4c02f8fdc80c89da2defb0b7124166187a49418cc885011bc322dc872eed111ae7be2a92620ae1063f34f5eab5

Download Submit
\Users\Admin\AppData\Local\Temp\nstE27.tmp\System.dll
Filesize
11KB

MD5
c17103ae9072a06da581dec998343fc1

SHA1
b72148c6bdfaada8b8c3f950e610ee7cf1da1f8d

SHA256
dc58d8ad81cacb0c1ed72e33bff8f23ea40b5252b5bb55d393a0903e6819ae2f

SHA512
d32a71aaef18e993f28096d536e41c4d016850721b31171513ce28bbd805a54fd290b7c3e9d935f72e676a1acfb4f0dcc89d95040a0dd29f2b6975855c18986f

Download Submit
\Users\Admin\AppData\Local\Temp\nstE27.tmp\nsExec.dll
Filesize
6KB

MD5
acc2b699edfea5bf5aae45aba3a41e96

SHA1
d2accf4d494e43ceb2cff69abe4dd17147d29cc2

SHA256
168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e

SHA512
e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe

Download Submit
\Users\Admin\AppData\Local\Temp\nstE27.tmp\nsExec.dll
Filesize
6KB

MD5
acc2b699edfea5bf5aae45aba3a41e96

SHA1
d2accf4d494e43ceb2cff69abe4dd17147d29cc2

SHA256
168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e

SHA512
e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe

Download Submit
\Users\Admin\AppData\Local\Temp\nstE27.tmp\nsExec.dll
Filesize
6KB

MD5
acc2b699edfea5bf5aae45aba3a41e96

SHA1
d2accf4d494e43ceb2cff69abe4dd17147d29cc2

SHA256
168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e

SHA512
e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe

Download Submit
\Users\Admin\AppData\Local\Temp\nstE27.tmp\nsExec.dll
Filesize
6KB

MD5
acc2b699edfea5bf5aae45aba3a41e96

SHA1
d2accf4d494e43ceb2cff69abe4dd17147d29cc2

SHA256
168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e

SHA512
e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe

Download Submit
\Windows\SysWOW64\hfnapi.dll
Filesize
106KB

MD5
4d19b92f670b50554a29a9878f03639c

SHA1
263287f84d68bd5cec0b301ed12339bbf1383cc3

SHA256
c1767a4a654d6353bcf6440cc043c532486be927f9fbfe3deb786301cb57433d

SHA512
496c0428e71e58858fbdb4c77448605af716f48f575c93411765dd8d9c0c5419f1f91c17e56e2c3b404936930028c4607e99b0ca430b04c1e47cc4ada8f49906

Download Submit
\Windows\SysWOW64\hfnapi.dll
Filesize
106KB

MD5
4d19b92f670b50554a29a9878f03639c

SHA1
263287f84d68bd5cec0b301ed12339bbf1383cc3

SHA256
c1767a4a654d6353bcf6440cc043c532486be927f9fbfe3deb786301cb57433d

SHA512
496c0428e71e58858fbdb4c77448605af716f48f575c93411765dd8d9c0c5419f1f91c17e56e2c3b404936930028c4607e99b0ca430b04c1e47cc4ada8f49906

Download Submit
\Windows\SysWOW64\hfnapi.dll
Filesize
106KB

MD5
4d19b92f670b50554a29a9878f03639c

SHA1
263287f84d68bd5cec0b301ed12339bbf1383cc3

SHA256
c1767a4a654d6353bcf6440cc043c532486be927f9fbfe3deb786301cb57433d

SHA512
496c0428e71e58858fbdb4c77448605af716f48f575c93411765dd8d9c0c5419f1f91c17e56e2c3b404936930028c4607e99b0ca430b04c1e47cc4ada8f49906

Download Submit
\Windows\SysWOW64\hfpapi.dll
Filesize
241KB

MD5
8240d2dcaa2c4c7fe6f91b0613abb1de

SHA1
0e7fe1d2517dd5a8c5cb3535e9a43b4cd77874e2

SHA256
3896724153e58fe338a5f660f3f43f81a2ef5aab887abb976c90e0c69a1dedd7

SHA512
baa8788c64221e78a9a3943e607af966cbbd99ad0266cec0910d4264e6fcfbc1f8cd56dd51626b637f5bb3d98f4866ef990040baed24d7e8c7cdd4eaba69468f

Download Submit
\Windows\SysWOW64\hfpapi.dll
Filesize
241KB

MD5
8240d2dcaa2c4c7fe6f91b0613abb1de

SHA1
0e7fe1d2517dd5a8c5cb3535e9a43b4cd77874e2

SHA256
3896724153e58fe338a5f660f3f43f81a2ef5aab887abb976c90e0c69a1dedd7

SHA512
baa8788c64221e78a9a3943e607af966cbbd99ad0266cec0910d4264e6fcfbc1f8cd56dd51626b637f5bb3d98f4866ef990040baed24d7e8c7cdd4eaba69468f

Download Submit
\Windows\SysWOW64\installd.exe
Filesize
108KB

MD5
378ea96a2625f43a4bc0535912c1004a

SHA1
36d7d73aa44423c567d38046dc574eb597892be6

SHA256
25405a1b4db7d8882c1d8ff2155d9b1db9987b96f0cbdc3636b37c84a0949b03

SHA512
2ac22e3f9adfed481b0b9d483ac49348c40250d7179a696c2ec766e9a2f8e496d7a5247125b363f6ecd131f678f1f849ac9e409bec83082d5cb936507eb0d52d

Download Submit
\Windows\SysWOW64\nethtsrv.exe
Filesize
176KB

MD5
afe0a536a15a5fc24e2e99890139bbf7

SHA1
005751ee59636618d392048f53e996156becafec

SHA256
35941e057915838b4a2d6e1ba12d9f61fd379ffa31c5cdfc7a6e28f4f90ef903

SHA512
48d48e0f53781a100eedebe62f3d251b20b33523abe185e4e307fc876e18d56beffc922730890be4bd0a6532d52b5a1474af70ef3e697f49063c8aacb67833d0

Download Submit
\Windows\SysWOW64\netupdsrv.exe
Filesize
159KB

MD5
99568da559a884a89604b7bcfea00996

SHA1
1d2b33ecb296e04791127015f7f0394e5b7384e2

SHA256
7374faf35d0a53f588b01d1c61304950aa6e1d439ab34ef81dfadbf19f4d100a

SHA512
412e6c57a092fa9b44253ed46a74503a2824fe4c02f8fdc80c89da2defb0b7124166187a49418cc885011bc322dc872eed111ae7be2a92620ae1063f34f5eab5

Download Submit
memory/520-62-0x0000000000000000-mapping.dmp

Download
memory/676-61-0x0000000000000000-mapping.dmp

Download
memory/744-86-0x0000000000000000-mapping.dmp

Download
memory/1292-64-0x0000000000000000-mapping.dmp

Download
memory/1428-76-0x0000000000000000-mapping.dmp

Download
memory/1592-70-0x0000000000000000-mapping.dmp

Download
memory/1680-57-0x0000000000000000-mapping.dmp

Download
memory/1732-58-0x0000000000000000-mapping.dmp

Download
memory/1740-81-0x0000000000000000-mapping.dmp

Download
memory/1952-87-0x0000000000000000-mapping.dmp

Download
memory/2004-80-0x0000000000000000-mapping.dmp

Download
memory/2024-54-0x00000000766D1000-0x00000000766D3000-memory.dmp

Filesize
8KB

Download
memory/2024-59-0x0000000000360000-0x00000000007BE000-memory.dmp

Filesize
4.4MB

Download
memory/2024-90-0x0000000000360000-0x00000000007BE000-memory.dmp

Filesize
4.4MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads