42faf8bec0b518ec3cb196d52ad897c7e8549cf6e0b653832d53e7a484223e93

Analysis

max time kernel
58s
max time network
35s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
23-11-2022 10:27

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

42faf8bec0b518ec3cb196d52ad897c7e8549cf6e0b653832d53e7a484223e93.exe
Size

602KB
MD5

ed81568bf8baeac764b00078ba7907e8
SHA1

c59298477adf0366ba86b23aabc2db4375ca3b16
SHA256

42faf8bec0b518ec3cb196d52ad897c7e8549cf6e0b653832d53e7a484223e93
SHA512

2732030c66628b6ec543e2f0931092f7eccc50399f4f007748af02ee36085151cb8e8e3d4ff515f3b8ea05228756061d08bb1e08f5542ddeb70e6c8deac97147
SSDEEP

12288:aIny5DYTgPfwJxavkppm3kM93uWcZDJmF2+tueTJucB8JR4jkz:8UTg3wkkpokUUdJx+tueTJuc+bukz

Score

8^/10

discovery

Malware Config

Signatures

Drops file in Drivers directory 1 IoCs

Processes:

42faf8bec0b518ec3cb196d52ad897c7e8549cf6e0b653832d53e7a484223e93.exe

description ioc process

File created C:\Windows\system32\drivers\nethfdrv.sys 42faf8bec0b518ec3cb196d52ad897c7e8549cf6e0b653832d53e7a484223e93.exe
Executes dropped EXE 5 IoCs

Processes:

installd.exenethtsrv.exenetupdsrv.exenethtsrv.exenetupdsrv.exe

pid process

1144 installd.exe
1548 nethtsrv.exe
612 netupdsrv.exe
1868 nethtsrv.exe
1716 netupdsrv.exe

description	ioc	process
File created	C:\Windows\system32\drivers\nethfdrv.sys	42faf8bec0b518ec3cb196d52ad897c7e8549cf6e0b653832d53e7a484223e93.exe

pid	process
1144	installd.exe
1548	nethtsrv.exe
612	netupdsrv.exe
1868	nethtsrv.exe
1716	netupdsrv.exe

Loads dropped DLL 13 IoCs

Processes:

42faf8bec0b518ec3cb196d52ad897c7e8549cf6e0b653832d53e7a484223e93.exeinstalld.exenethtsrv.exenethtsrv.exe

pid	process
2008	42faf8bec0b518ec3cb196d52ad897c7e8549cf6e0b653832d53e7a484223e93.exe
2008	42faf8bec0b518ec3cb196d52ad897c7e8549cf6e0b653832d53e7a484223e93.exe
2008	42faf8bec0b518ec3cb196d52ad897c7e8549cf6e0b653832d53e7a484223e93.exe
2008	42faf8bec0b518ec3cb196d52ad897c7e8549cf6e0b653832d53e7a484223e93.exe
1144	installd.exe
2008	42faf8bec0b518ec3cb196d52ad897c7e8549cf6e0b653832d53e7a484223e93.exe
1548	nethtsrv.exe
1548	nethtsrv.exe
2008	42faf8bec0b518ec3cb196d52ad897c7e8549cf6e0b653832d53e7a484223e93.exe
2008	42faf8bec0b518ec3cb196d52ad897c7e8549cf6e0b653832d53e7a484223e93.exe
1868	nethtsrv.exe
1868	nethtsrv.exe
2008	42faf8bec0b518ec3cb196d52ad897c7e8549cf6e0b653832d53e7a484223e93.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in System32 directory 5 IoCs

Processes:

42faf8bec0b518ec3cb196d52ad897c7e8549cf6e0b653832d53e7a484223e93.exe

description	ioc	process
File created	C:\Windows\SysWOW64\installd.exe	42faf8bec0b518ec3cb196d52ad897c7e8549cf6e0b653832d53e7a484223e93.exe
File created	C:\Windows\SysWOW64\nethtsrv.exe	42faf8bec0b518ec3cb196d52ad897c7e8549cf6e0b653832d53e7a484223e93.exe
File created	C:\Windows\SysWOW64\netupdsrv.exe	42faf8bec0b518ec3cb196d52ad897c7e8549cf6e0b653832d53e7a484223e93.exe
File created	C:\Windows\SysWOW64\hfnapi.dll	42faf8bec0b518ec3cb196d52ad897c7e8549cf6e0b653832d53e7a484223e93.exe
File created	C:\Windows\SysWOW64\hfpapi.dll	42faf8bec0b518ec3cb196d52ad897c7e8549cf6e0b653832d53e7a484223e93.exe

Drops file in Program Files directory 3 IoCs

Processes:

42faf8bec0b518ec3cb196d52ad897c7e8549cf6e0b653832d53e7a484223e93.exe

description	ioc	process
File created	C:\Program Files (x86)\Common Files\Config\data.xml	42faf8bec0b518ec3cb196d52ad897c7e8549cf6e0b653832d53e7a484223e93.exe
File created	C:\Program Files (x86)\Common Files\Config\ver.xml	42faf8bec0b518ec3cb196d52ad897c7e8549cf6e0b653832d53e7a484223e93.exe
File created	C:\Program Files (x86)\Common Files\config\uninstinethnfd.exe	42faf8bec0b518ec3cb196d52ad897c7e8549cf6e0b653832d53e7a484223e93.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Runs net.exe
Suspicious behavior: LoadsDriver 1 IoCs

Processes:

pid process

460
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

nethtsrv.exe

description pid process

Token: SeDebugPrivilege 1868 nethtsrv.exe

pid	process
460

description	pid	process
Token: SeDebugPrivilege	1868	nethtsrv.exe

Suspicious use of WriteProcessMemory 50 IoCs

Processes:

42faf8bec0b518ec3cb196d52ad897c7e8549cf6e0b653832d53e7a484223e93.exenet.exenet.exenet.exenet.exe

description	pid	process	target process
PID 2008 wrote to memory of 1000	2008	42faf8bec0b518ec3cb196d52ad897c7e8549cf6e0b653832d53e7a484223e93.exe	net.exe
PID 2008 wrote to memory of 1000	2008	42faf8bec0b518ec3cb196d52ad897c7e8549cf6e0b653832d53e7a484223e93.exe	net.exe
PID 2008 wrote to memory of 1000	2008	42faf8bec0b518ec3cb196d52ad897c7e8549cf6e0b653832d53e7a484223e93.exe	net.exe
PID 2008 wrote to memory of 1000	2008	42faf8bec0b518ec3cb196d52ad897c7e8549cf6e0b653832d53e7a484223e93.exe	net.exe
PID 1000 wrote to memory of 1048	1000	net.exe	net1.exe
PID 1000 wrote to memory of 1048	1000	net.exe	net1.exe
PID 1000 wrote to memory of 1048	1000	net.exe	net1.exe
PID 1000 wrote to memory of 1048	1000	net.exe	net1.exe
PID 2008 wrote to memory of 520	2008	42faf8bec0b518ec3cb196d52ad897c7e8549cf6e0b653832d53e7a484223e93.exe	net.exe
PID 2008 wrote to memory of 520	2008	42faf8bec0b518ec3cb196d52ad897c7e8549cf6e0b653832d53e7a484223e93.exe	net.exe
PID 2008 wrote to memory of 520	2008	42faf8bec0b518ec3cb196d52ad897c7e8549cf6e0b653832d53e7a484223e93.exe	net.exe
PID 2008 wrote to memory of 520	2008	42faf8bec0b518ec3cb196d52ad897c7e8549cf6e0b653832d53e7a484223e93.exe	net.exe
PID 520 wrote to memory of 1496	520	net.exe	net1.exe
PID 520 wrote to memory of 1496	520	net.exe	net1.exe
PID 520 wrote to memory of 1496	520	net.exe	net1.exe
PID 520 wrote to memory of 1496	520	net.exe	net1.exe
PID 2008 wrote to memory of 1144	2008	42faf8bec0b518ec3cb196d52ad897c7e8549cf6e0b653832d53e7a484223e93.exe	installd.exe
PID 2008 wrote to memory of 1144	2008	42faf8bec0b518ec3cb196d52ad897c7e8549cf6e0b653832d53e7a484223e93.exe	installd.exe
PID 2008 wrote to memory of 1144	2008	42faf8bec0b518ec3cb196d52ad897c7e8549cf6e0b653832d53e7a484223e93.exe	installd.exe
PID 2008 wrote to memory of 1144	2008	42faf8bec0b518ec3cb196d52ad897c7e8549cf6e0b653832d53e7a484223e93.exe	installd.exe
PID 2008 wrote to memory of 1144	2008	42faf8bec0b518ec3cb196d52ad897c7e8549cf6e0b653832d53e7a484223e93.exe	installd.exe
PID 2008 wrote to memory of 1144	2008	42faf8bec0b518ec3cb196d52ad897c7e8549cf6e0b653832d53e7a484223e93.exe	installd.exe
PID 2008 wrote to memory of 1144	2008	42faf8bec0b518ec3cb196d52ad897c7e8549cf6e0b653832d53e7a484223e93.exe	installd.exe
PID 2008 wrote to memory of 1548	2008	42faf8bec0b518ec3cb196d52ad897c7e8549cf6e0b653832d53e7a484223e93.exe	nethtsrv.exe
PID 2008 wrote to memory of 1548	2008	42faf8bec0b518ec3cb196d52ad897c7e8549cf6e0b653832d53e7a484223e93.exe	nethtsrv.exe
PID 2008 wrote to memory of 1548	2008	42faf8bec0b518ec3cb196d52ad897c7e8549cf6e0b653832d53e7a484223e93.exe	nethtsrv.exe
PID 2008 wrote to memory of 1548	2008	42faf8bec0b518ec3cb196d52ad897c7e8549cf6e0b653832d53e7a484223e93.exe	nethtsrv.exe
PID 2008 wrote to memory of 612	2008	42faf8bec0b518ec3cb196d52ad897c7e8549cf6e0b653832d53e7a484223e93.exe	netupdsrv.exe
PID 2008 wrote to memory of 612	2008	42faf8bec0b518ec3cb196d52ad897c7e8549cf6e0b653832d53e7a484223e93.exe	netupdsrv.exe
PID 2008 wrote to memory of 612	2008	42faf8bec0b518ec3cb196d52ad897c7e8549cf6e0b653832d53e7a484223e93.exe	netupdsrv.exe
PID 2008 wrote to memory of 612	2008	42faf8bec0b518ec3cb196d52ad897c7e8549cf6e0b653832d53e7a484223e93.exe	netupdsrv.exe
PID 2008 wrote to memory of 612	2008	42faf8bec0b518ec3cb196d52ad897c7e8549cf6e0b653832d53e7a484223e93.exe	netupdsrv.exe
PID 2008 wrote to memory of 612	2008	42faf8bec0b518ec3cb196d52ad897c7e8549cf6e0b653832d53e7a484223e93.exe	netupdsrv.exe
PID 2008 wrote to memory of 612	2008	42faf8bec0b518ec3cb196d52ad897c7e8549cf6e0b653832d53e7a484223e93.exe	netupdsrv.exe
PID 2008 wrote to memory of 1532	2008	42faf8bec0b518ec3cb196d52ad897c7e8549cf6e0b653832d53e7a484223e93.exe	net.exe
PID 2008 wrote to memory of 1532	2008	42faf8bec0b518ec3cb196d52ad897c7e8549cf6e0b653832d53e7a484223e93.exe	net.exe
PID 2008 wrote to memory of 1532	2008	42faf8bec0b518ec3cb196d52ad897c7e8549cf6e0b653832d53e7a484223e93.exe	net.exe
PID 2008 wrote to memory of 1532	2008	42faf8bec0b518ec3cb196d52ad897c7e8549cf6e0b653832d53e7a484223e93.exe	net.exe
PID 1532 wrote to memory of 112	1532	net.exe	net1.exe
PID 1532 wrote to memory of 112	1532	net.exe	net1.exe
PID 1532 wrote to memory of 112	1532	net.exe	net1.exe
PID 1532 wrote to memory of 112	1532	net.exe	net1.exe
PID 2008 wrote to memory of 1340	2008	42faf8bec0b518ec3cb196d52ad897c7e8549cf6e0b653832d53e7a484223e93.exe	net.exe
PID 2008 wrote to memory of 1340	2008	42faf8bec0b518ec3cb196d52ad897c7e8549cf6e0b653832d53e7a484223e93.exe	net.exe
PID 2008 wrote to memory of 1340	2008	42faf8bec0b518ec3cb196d52ad897c7e8549cf6e0b653832d53e7a484223e93.exe	net.exe
PID 2008 wrote to memory of 1340	2008	42faf8bec0b518ec3cb196d52ad897c7e8549cf6e0b653832d53e7a484223e93.exe	net.exe
PID 1340 wrote to memory of 1652	1340	net.exe	net1.exe
PID 1340 wrote to memory of 1652	1340	net.exe	net1.exe
PID 1340 wrote to memory of 1652	1340	net.exe	net1.exe
PID 1340 wrote to memory of 1652	1340	net.exe	net1.exe

C:\Users\Admin\AppData\Local\Temp\42faf8bec0b518ec3cb196d52ad897c7e8549cf6e0b653832d53e7a484223e93.exe
"C:\Users\Admin\AppData\Local\Temp\42faf8bec0b518ec3cb196d52ad897c7e8549cf6e0b653832d53e7a484223e93.exe"
1⤵
- Drops file in Drivers directory
- Loads dropped DLL
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:2008

C:\Windows\SysWOW64\net.exe
net stop nethttpservice
2⤵
- Suspicious use of WriteProcessMemory
PID:1000

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop nethttpservice
3⤵
PID:1048

C:\Windows\SysWOW64\net.exe
net stop serviceupdater
2⤵
- Suspicious use of WriteProcessMemory
PID:520

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop serviceupdater
3⤵
PID:1496

C:\Windows\SysWOW64\installd.exe
"C:\Windows\system32\installd.exe" nethfdrv
2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1144

C:\Windows\SysWOW64\nethtsrv.exe
"C:\Windows\system32\nethtsrv.exe" -nfdi
2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1548

C:\Windows\SysWOW64\netupdsrv.exe
"C:\Windows\system32\netupdsrv.exe" -nfdi
2⤵
- Executes dropped EXE
PID:612

C:\Windows\SysWOW64\net.exe
net start nethttpservice
2⤵
- Suspicious use of WriteProcessMemory
PID:1532

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 start nethttpservice
3⤵
PID:112

C:\Windows\SysWOW64\net.exe
net start serviceupdater
2⤵
- Suspicious use of WriteProcessMemory
PID:1340

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 start serviceupdater
3⤵
PID:1652

C:\Windows\SysWOW64\nethtsrv.exe
C:\Windows\SysWOW64\nethtsrv.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:1868

C:\Windows\SysWOW64\netupdsrv.exe
C:\Windows\SysWOW64\netupdsrv.exe
1⤵
- Executes dropped EXE
PID:1716

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\hfnapi.dll
Filesize
106KB

MD5
13cf4a5734e24cab4d103073b2ce1ed4

SHA1
8c3f4504ab5debd5f27c043de53ec774cbd76698

SHA256
382d1c9368cc33ca22b70dabfddbdae9c956da2d900930c0daac77f78b0a0dab

SHA512
e054be13c41638ebf647304d1bff564e04cc0e6833b1cda18c4be5aecd119216b894032565abb96c89e91cb28737ce2020b4dbdf8bb8828e10aebea13a211c38

Download Submit
C:\Windows\SysWOW64\hfpapi.dll
Filesize
241KB

MD5
adf0f80e30230aa37dc1dcbfa987e3e6

SHA1
1b0258881409b23142c817842af5d867c92fa43a

SHA256
c6d66925fe5137efda820f92b8b5a69110814304406306474f793b72c5fcfbe2

SHA512
1a361bffa6a25e0e8dab2a0b9526b351aeb368695d2ab8475986827d1233c871d1e628e5ef0b06e725d60bda11e222c71b5d8d2ad954feca79c7fb832e864513

Download Submit
C:\Windows\SysWOW64\installd.exe
Filesize
108KB

MD5
6f9f05ce8ec07ab4397fe9b63741c460

SHA1
7cf973eaf80b50de44653f0f57529c53fd163163

SHA256
a927f733a440ef52a0ff8139046a6eae20d18ad22adfede0102bd0e1fb9f6933

SHA512
c879397ad764b3236e0fc77e8e9e5874553db72a7bc9660fb03a01d5c880f129b773a301ba54acf93b8cac1af85e1774cb35c1f4d6190a2031363ea5685c0eb4

Download Submit
C:\Windows\SysWOW64\nethtsrv.exe
Filesize
176KB

MD5
b53db3f737db84ac54c76df0e2701a74

SHA1
eb92355bfa1b53f6354cc68751c232ca9e209fa2

SHA256
fda1bf205e744aef37b69badf103e962d7bf27bd66720f245b9a3ca7a3e2866a

SHA512
b9a60a8cc43958ea34b25b212f1b3f2786ed63c5addc904e76cb592b906ec6be770c4a0d929a0c62fb5211f60384738f38ef031ffdb193ada61383300c182acf

Download Submit
C:\Windows\SysWOW64\nethtsrv.exe
Filesize
176KB

MD5
b53db3f737db84ac54c76df0e2701a74

SHA1
eb92355bfa1b53f6354cc68751c232ca9e209fa2

SHA256
fda1bf205e744aef37b69badf103e962d7bf27bd66720f245b9a3ca7a3e2866a

SHA512
b9a60a8cc43958ea34b25b212f1b3f2786ed63c5addc904e76cb592b906ec6be770c4a0d929a0c62fb5211f60384738f38ef031ffdb193ada61383300c182acf

Download Submit
C:\Windows\SysWOW64\netupdsrv.exe
Filesize
158KB

MD5
8db04c9092bc869deba418a01aaed10e

SHA1
8ab706852b461beceff248d04b5cd8468369de4b

SHA256
0e7d311b015fc088b90371f0009fe5e6349902f0723ef4088b97f505687a31f0

SHA512
c259d475b1b5a1d6bfb1d3ba08e69fd7b0c8b303c97355606cc7678c44948dc529a6568a366be1377a30c17f5bd557c338aa5bdbcfeeb5e69d11e0ad9b3e008d

Download Submit
C:\Windows\SysWOW64\netupdsrv.exe
Filesize
158KB

MD5
8db04c9092bc869deba418a01aaed10e

SHA1
8ab706852b461beceff248d04b5cd8468369de4b

SHA256
0e7d311b015fc088b90371f0009fe5e6349902f0723ef4088b97f505687a31f0

SHA512
c259d475b1b5a1d6bfb1d3ba08e69fd7b0c8b303c97355606cc7678c44948dc529a6568a366be1377a30c17f5bd557c338aa5bdbcfeeb5e69d11e0ad9b3e008d

Download Submit
\Users\Admin\AppData\Local\Temp\nsoEEE4.tmp\System.dll
Filesize
11KB

MD5
c17103ae9072a06da581dec998343fc1

SHA1
b72148c6bdfaada8b8c3f950e610ee7cf1da1f8d

SHA256
dc58d8ad81cacb0c1ed72e33bff8f23ea40b5252b5bb55d393a0903e6819ae2f

SHA512
d32a71aaef18e993f28096d536e41c4d016850721b31171513ce28bbd805a54fd290b7c3e9d935f72e676a1acfb4f0dcc89d95040a0dd29f2b6975855c18986f

Download Submit
\Users\Admin\AppData\Local\Temp\nsoEEE4.tmp\nsExec.dll
Filesize
6KB

MD5
acc2b699edfea5bf5aae45aba3a41e96

SHA1
d2accf4d494e43ceb2cff69abe4dd17147d29cc2

SHA256
168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e

SHA512
e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe

Download Submit
\Users\Admin\AppData\Local\Temp\nsoEEE4.tmp\nsExec.dll
Filesize
6KB

MD5
acc2b699edfea5bf5aae45aba3a41e96

SHA1
d2accf4d494e43ceb2cff69abe4dd17147d29cc2

SHA256
168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e

SHA512
e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe

Download Submit
\Users\Admin\AppData\Local\Temp\nsoEEE4.tmp\nsExec.dll
Filesize
6KB

MD5
acc2b699edfea5bf5aae45aba3a41e96

SHA1
d2accf4d494e43ceb2cff69abe4dd17147d29cc2

SHA256
168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e

SHA512
e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe

Download Submit
\Users\Admin\AppData\Local\Temp\nsoEEE4.tmp\nsExec.dll
Filesize
6KB

MD5
acc2b699edfea5bf5aae45aba3a41e96

SHA1
d2accf4d494e43ceb2cff69abe4dd17147d29cc2

SHA256
168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e

SHA512
e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe

Download Submit
\Windows\SysWOW64\hfnapi.dll
Filesize
106KB

MD5
13cf4a5734e24cab4d103073b2ce1ed4

SHA1
8c3f4504ab5debd5f27c043de53ec774cbd76698

SHA256
382d1c9368cc33ca22b70dabfddbdae9c956da2d900930c0daac77f78b0a0dab

SHA512
e054be13c41638ebf647304d1bff564e04cc0e6833b1cda18c4be5aecd119216b894032565abb96c89e91cb28737ce2020b4dbdf8bb8828e10aebea13a211c38

Download Submit
\Windows\SysWOW64\hfnapi.dll
Filesize
106KB

MD5
13cf4a5734e24cab4d103073b2ce1ed4

SHA1
8c3f4504ab5debd5f27c043de53ec774cbd76698

SHA256
382d1c9368cc33ca22b70dabfddbdae9c956da2d900930c0daac77f78b0a0dab

SHA512
e054be13c41638ebf647304d1bff564e04cc0e6833b1cda18c4be5aecd119216b894032565abb96c89e91cb28737ce2020b4dbdf8bb8828e10aebea13a211c38

Download Submit
\Windows\SysWOW64\hfnapi.dll
Filesize
106KB

MD5
13cf4a5734e24cab4d103073b2ce1ed4

SHA1
8c3f4504ab5debd5f27c043de53ec774cbd76698

SHA256
382d1c9368cc33ca22b70dabfddbdae9c956da2d900930c0daac77f78b0a0dab

SHA512
e054be13c41638ebf647304d1bff564e04cc0e6833b1cda18c4be5aecd119216b894032565abb96c89e91cb28737ce2020b4dbdf8bb8828e10aebea13a211c38

Download Submit
\Windows\SysWOW64\hfpapi.dll
Filesize
241KB

MD5
adf0f80e30230aa37dc1dcbfa987e3e6

SHA1
1b0258881409b23142c817842af5d867c92fa43a

SHA256
c6d66925fe5137efda820f92b8b5a69110814304406306474f793b72c5fcfbe2

SHA512
1a361bffa6a25e0e8dab2a0b9526b351aeb368695d2ab8475986827d1233c871d1e628e5ef0b06e725d60bda11e222c71b5d8d2ad954feca79c7fb832e864513

Download Submit
\Windows\SysWOW64\hfpapi.dll
Filesize
241KB

MD5
adf0f80e30230aa37dc1dcbfa987e3e6

SHA1
1b0258881409b23142c817842af5d867c92fa43a

SHA256
c6d66925fe5137efda820f92b8b5a69110814304406306474f793b72c5fcfbe2

SHA512
1a361bffa6a25e0e8dab2a0b9526b351aeb368695d2ab8475986827d1233c871d1e628e5ef0b06e725d60bda11e222c71b5d8d2ad954feca79c7fb832e864513

Download Submit
\Windows\SysWOW64\installd.exe
Filesize
108KB

MD5
6f9f05ce8ec07ab4397fe9b63741c460

SHA1
7cf973eaf80b50de44653f0f57529c53fd163163

SHA256
a927f733a440ef52a0ff8139046a6eae20d18ad22adfede0102bd0e1fb9f6933

SHA512
c879397ad764b3236e0fc77e8e9e5874553db72a7bc9660fb03a01d5c880f129b773a301ba54acf93b8cac1af85e1774cb35c1f4d6190a2031363ea5685c0eb4

Download Submit
\Windows\SysWOW64\nethtsrv.exe
Filesize
176KB

MD5
b53db3f737db84ac54c76df0e2701a74

SHA1
eb92355bfa1b53f6354cc68751c232ca9e209fa2

SHA256
fda1bf205e744aef37b69badf103e962d7bf27bd66720f245b9a3ca7a3e2866a

SHA512
b9a60a8cc43958ea34b25b212f1b3f2786ed63c5addc904e76cb592b906ec6be770c4a0d929a0c62fb5211f60384738f38ef031ffdb193ada61383300c182acf

Download Submit
\Windows\SysWOW64\netupdsrv.exe
Filesize
158KB

MD5
8db04c9092bc869deba418a01aaed10e

SHA1
8ab706852b461beceff248d04b5cd8468369de4b

SHA256
0e7d311b015fc088b90371f0009fe5e6349902f0723ef4088b97f505687a31f0

SHA512
c259d475b1b5a1d6bfb1d3ba08e69fd7b0c8b303c97355606cc7678c44948dc529a6568a366be1377a30c17f5bd557c338aa5bdbcfeeb5e69d11e0ad9b3e008d

Download Submit
memory/112-81-0x0000000000000000-mapping.dmp

Download
memory/520-61-0x0000000000000000-mapping.dmp

Download
memory/612-76-0x0000000000000000-mapping.dmp

Download
memory/1000-57-0x0000000000000000-mapping.dmp

Download
memory/1048-58-0x0000000000000000-mapping.dmp

Download
memory/1144-64-0x0000000000000000-mapping.dmp

Download
memory/1340-86-0x0000000000000000-mapping.dmp

Download
memory/1496-62-0x0000000000000000-mapping.dmp

Download
memory/1532-80-0x0000000000000000-mapping.dmp

Download
memory/1548-70-0x0000000000000000-mapping.dmp

Download
memory/1652-87-0x0000000000000000-mapping.dmp

Download
memory/2008-54-0x0000000075B11000-0x0000000075B13000-memory.dmp

Filesize
8KB

Download
memory/2008-59-0x0000000000360000-0x00000000007BE000-memory.dmp

Filesize
4.4MB

Download
memory/2008-90-0x0000000000360000-0x00000000007BE000-memory.dmp

Filesize
4.4MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads