3e43f7d7309a969f50cb1fda9ab3cee048234caceb8eed76ff76cb054fd32ca2

Analysis

max time kernel
42s
max time network
34s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
23-11-2022 10:28

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3e43f7d7309a969f50cb1fda9ab3cee048234caceb8eed76ff76cb054fd32ca2.exe
Size

602KB
MD5

92a526b3e5a121485f000a732aeb3bb2
SHA1

ecc8f40a28ba417ec4e4550d2242d73303147956
SHA256

3e43f7d7309a969f50cb1fda9ab3cee048234caceb8eed76ff76cb054fd32ca2
SHA512

80a1a524b63b34e078fc83b1f122083f0e3e3bc0a8b606bc6e0a5dadfc77329a8416e8147ac5f04e9669fef03f51279cc40ddebb8e7a26b55e69801c97919645
SSDEEP

12288:kIny5DYTkIU8nFK+fnCXvGJmgf59sIEiUVv5gn9xVRQkGS5SzTh:CUTkX8nFDPCGJdf5aIEiUV5k7

Score

8^/10

discovery

Malware Config

Signatures

Drops file in Drivers directory 1 IoCs

Processes:

3e43f7d7309a969f50cb1fda9ab3cee048234caceb8eed76ff76cb054fd32ca2.exe

description ioc process

File created C:\Windows\system32\drivers\nethfdrv.sys 3e43f7d7309a969f50cb1fda9ab3cee048234caceb8eed76ff76cb054fd32ca2.exe
Executes dropped EXE 5 IoCs

Processes:

installd.exenethtsrv.exenetupdsrv.exenethtsrv.exenetupdsrv.exe

pid process

564 installd.exe
964 nethtsrv.exe
1420 netupdsrv.exe
1444 nethtsrv.exe
1352 netupdsrv.exe

description	ioc	process
File created	C:\Windows\system32\drivers\nethfdrv.sys	3e43f7d7309a969f50cb1fda9ab3cee048234caceb8eed76ff76cb054fd32ca2.exe

pid	process
564	installd.exe
964	nethtsrv.exe
1420	netupdsrv.exe
1444	nethtsrv.exe
1352	netupdsrv.exe

Loads dropped DLL 13 IoCs

Processes:

3e43f7d7309a969f50cb1fda9ab3cee048234caceb8eed76ff76cb054fd32ca2.exeinstalld.exenethtsrv.exenethtsrv.exe

pid	process
1780	3e43f7d7309a969f50cb1fda9ab3cee048234caceb8eed76ff76cb054fd32ca2.exe
1780	3e43f7d7309a969f50cb1fda9ab3cee048234caceb8eed76ff76cb054fd32ca2.exe
1780	3e43f7d7309a969f50cb1fda9ab3cee048234caceb8eed76ff76cb054fd32ca2.exe
1780	3e43f7d7309a969f50cb1fda9ab3cee048234caceb8eed76ff76cb054fd32ca2.exe
564	installd.exe
1780	3e43f7d7309a969f50cb1fda9ab3cee048234caceb8eed76ff76cb054fd32ca2.exe
964	nethtsrv.exe
964	nethtsrv.exe
1780	3e43f7d7309a969f50cb1fda9ab3cee048234caceb8eed76ff76cb054fd32ca2.exe
1780	3e43f7d7309a969f50cb1fda9ab3cee048234caceb8eed76ff76cb054fd32ca2.exe
1444	nethtsrv.exe
1444	nethtsrv.exe
1780	3e43f7d7309a969f50cb1fda9ab3cee048234caceb8eed76ff76cb054fd32ca2.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in System32 directory 5 IoCs

Processes:

3e43f7d7309a969f50cb1fda9ab3cee048234caceb8eed76ff76cb054fd32ca2.exe

description	ioc	process
File created	C:\Windows\SysWOW64\hfnapi.dll	3e43f7d7309a969f50cb1fda9ab3cee048234caceb8eed76ff76cb054fd32ca2.exe
File created	C:\Windows\SysWOW64\hfpapi.dll	3e43f7d7309a969f50cb1fda9ab3cee048234caceb8eed76ff76cb054fd32ca2.exe
File created	C:\Windows\SysWOW64\installd.exe	3e43f7d7309a969f50cb1fda9ab3cee048234caceb8eed76ff76cb054fd32ca2.exe
File created	C:\Windows\SysWOW64\nethtsrv.exe	3e43f7d7309a969f50cb1fda9ab3cee048234caceb8eed76ff76cb054fd32ca2.exe
File created	C:\Windows\SysWOW64\netupdsrv.exe	3e43f7d7309a969f50cb1fda9ab3cee048234caceb8eed76ff76cb054fd32ca2.exe

Drops file in Program Files directory 3 IoCs

Processes:

3e43f7d7309a969f50cb1fda9ab3cee048234caceb8eed76ff76cb054fd32ca2.exe

description	ioc	process
File created	C:\Program Files (x86)\Common Files\Config\data.xml	3e43f7d7309a969f50cb1fda9ab3cee048234caceb8eed76ff76cb054fd32ca2.exe
File created	C:\Program Files (x86)\Common Files\Config\ver.xml	3e43f7d7309a969f50cb1fda9ab3cee048234caceb8eed76ff76cb054fd32ca2.exe
File created	C:\Program Files (x86)\Common Files\config\uninstinethnfd.exe	3e43f7d7309a969f50cb1fda9ab3cee048234caceb8eed76ff76cb054fd32ca2.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Runs net.exe
Suspicious behavior: LoadsDriver 1 IoCs

Processes:

pid process

460
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

nethtsrv.exe

description pid process

Token: SeDebugPrivilege 1444 nethtsrv.exe

pid	process
460

description	pid	process
Token: SeDebugPrivilege	1444	nethtsrv.exe

Suspicious use of WriteProcessMemory 50 IoCs

Processes:

3e43f7d7309a969f50cb1fda9ab3cee048234caceb8eed76ff76cb054fd32ca2.exenet.exenet.exenet.exenet.exe

description	pid	process	target process
PID 1780 wrote to memory of 1596	1780	3e43f7d7309a969f50cb1fda9ab3cee048234caceb8eed76ff76cb054fd32ca2.exe	net.exe
PID 1780 wrote to memory of 1596	1780	3e43f7d7309a969f50cb1fda9ab3cee048234caceb8eed76ff76cb054fd32ca2.exe	net.exe
PID 1780 wrote to memory of 1596	1780	3e43f7d7309a969f50cb1fda9ab3cee048234caceb8eed76ff76cb054fd32ca2.exe	net.exe
PID 1780 wrote to memory of 1596	1780	3e43f7d7309a969f50cb1fda9ab3cee048234caceb8eed76ff76cb054fd32ca2.exe	net.exe
PID 1596 wrote to memory of 300	1596	net.exe	net1.exe
PID 1596 wrote to memory of 300	1596	net.exe	net1.exe
PID 1596 wrote to memory of 300	1596	net.exe	net1.exe
PID 1596 wrote to memory of 300	1596	net.exe	net1.exe
PID 1780 wrote to memory of 572	1780	3e43f7d7309a969f50cb1fda9ab3cee048234caceb8eed76ff76cb054fd32ca2.exe	net.exe
PID 1780 wrote to memory of 572	1780	3e43f7d7309a969f50cb1fda9ab3cee048234caceb8eed76ff76cb054fd32ca2.exe	net.exe
PID 1780 wrote to memory of 572	1780	3e43f7d7309a969f50cb1fda9ab3cee048234caceb8eed76ff76cb054fd32ca2.exe	net.exe
PID 1780 wrote to memory of 572	1780	3e43f7d7309a969f50cb1fda9ab3cee048234caceb8eed76ff76cb054fd32ca2.exe	net.exe
PID 572 wrote to memory of 768	572	net.exe	net1.exe
PID 572 wrote to memory of 768	572	net.exe	net1.exe
PID 572 wrote to memory of 768	572	net.exe	net1.exe
PID 572 wrote to memory of 768	572	net.exe	net1.exe
PID 1780 wrote to memory of 564	1780	3e43f7d7309a969f50cb1fda9ab3cee048234caceb8eed76ff76cb054fd32ca2.exe	installd.exe
PID 1780 wrote to memory of 564	1780	3e43f7d7309a969f50cb1fda9ab3cee048234caceb8eed76ff76cb054fd32ca2.exe	installd.exe
PID 1780 wrote to memory of 564	1780	3e43f7d7309a969f50cb1fda9ab3cee048234caceb8eed76ff76cb054fd32ca2.exe	installd.exe
PID 1780 wrote to memory of 564	1780	3e43f7d7309a969f50cb1fda9ab3cee048234caceb8eed76ff76cb054fd32ca2.exe	installd.exe
PID 1780 wrote to memory of 564	1780	3e43f7d7309a969f50cb1fda9ab3cee048234caceb8eed76ff76cb054fd32ca2.exe	installd.exe
PID 1780 wrote to memory of 564	1780	3e43f7d7309a969f50cb1fda9ab3cee048234caceb8eed76ff76cb054fd32ca2.exe	installd.exe
PID 1780 wrote to memory of 564	1780	3e43f7d7309a969f50cb1fda9ab3cee048234caceb8eed76ff76cb054fd32ca2.exe	installd.exe
PID 1780 wrote to memory of 964	1780	3e43f7d7309a969f50cb1fda9ab3cee048234caceb8eed76ff76cb054fd32ca2.exe	nethtsrv.exe
PID 1780 wrote to memory of 964	1780	3e43f7d7309a969f50cb1fda9ab3cee048234caceb8eed76ff76cb054fd32ca2.exe	nethtsrv.exe
PID 1780 wrote to memory of 964	1780	3e43f7d7309a969f50cb1fda9ab3cee048234caceb8eed76ff76cb054fd32ca2.exe	nethtsrv.exe
PID 1780 wrote to memory of 964	1780	3e43f7d7309a969f50cb1fda9ab3cee048234caceb8eed76ff76cb054fd32ca2.exe	nethtsrv.exe
PID 1780 wrote to memory of 1420	1780	3e43f7d7309a969f50cb1fda9ab3cee048234caceb8eed76ff76cb054fd32ca2.exe	netupdsrv.exe
PID 1780 wrote to memory of 1420	1780	3e43f7d7309a969f50cb1fda9ab3cee048234caceb8eed76ff76cb054fd32ca2.exe	netupdsrv.exe
PID 1780 wrote to memory of 1420	1780	3e43f7d7309a969f50cb1fda9ab3cee048234caceb8eed76ff76cb054fd32ca2.exe	netupdsrv.exe
PID 1780 wrote to memory of 1420	1780	3e43f7d7309a969f50cb1fda9ab3cee048234caceb8eed76ff76cb054fd32ca2.exe	netupdsrv.exe
PID 1780 wrote to memory of 1420	1780	3e43f7d7309a969f50cb1fda9ab3cee048234caceb8eed76ff76cb054fd32ca2.exe	netupdsrv.exe
PID 1780 wrote to memory of 1420	1780	3e43f7d7309a969f50cb1fda9ab3cee048234caceb8eed76ff76cb054fd32ca2.exe	netupdsrv.exe
PID 1780 wrote to memory of 1420	1780	3e43f7d7309a969f50cb1fda9ab3cee048234caceb8eed76ff76cb054fd32ca2.exe	netupdsrv.exe
PID 1780 wrote to memory of 1100	1780	3e43f7d7309a969f50cb1fda9ab3cee048234caceb8eed76ff76cb054fd32ca2.exe	net.exe
PID 1780 wrote to memory of 1100	1780	3e43f7d7309a969f50cb1fda9ab3cee048234caceb8eed76ff76cb054fd32ca2.exe	net.exe
PID 1780 wrote to memory of 1100	1780	3e43f7d7309a969f50cb1fda9ab3cee048234caceb8eed76ff76cb054fd32ca2.exe	net.exe
PID 1780 wrote to memory of 1100	1780	3e43f7d7309a969f50cb1fda9ab3cee048234caceb8eed76ff76cb054fd32ca2.exe	net.exe
PID 1100 wrote to memory of 360	1100	net.exe	net1.exe
PID 1100 wrote to memory of 360	1100	net.exe	net1.exe
PID 1100 wrote to memory of 360	1100	net.exe	net1.exe
PID 1100 wrote to memory of 360	1100	net.exe	net1.exe
PID 1780 wrote to memory of 844	1780	3e43f7d7309a969f50cb1fda9ab3cee048234caceb8eed76ff76cb054fd32ca2.exe	net.exe
PID 1780 wrote to memory of 844	1780	3e43f7d7309a969f50cb1fda9ab3cee048234caceb8eed76ff76cb054fd32ca2.exe	net.exe
PID 1780 wrote to memory of 844	1780	3e43f7d7309a969f50cb1fda9ab3cee048234caceb8eed76ff76cb054fd32ca2.exe	net.exe
PID 1780 wrote to memory of 844	1780	3e43f7d7309a969f50cb1fda9ab3cee048234caceb8eed76ff76cb054fd32ca2.exe	net.exe
PID 844 wrote to memory of 1408	844	net.exe	net1.exe
PID 844 wrote to memory of 1408	844	net.exe	net1.exe
PID 844 wrote to memory of 1408	844	net.exe	net1.exe
PID 844 wrote to memory of 1408	844	net.exe	net1.exe

C:\Users\Admin\AppData\Local\Temp\3e43f7d7309a969f50cb1fda9ab3cee048234caceb8eed76ff76cb054fd32ca2.exe
"C:\Users\Admin\AppData\Local\Temp\3e43f7d7309a969f50cb1fda9ab3cee048234caceb8eed76ff76cb054fd32ca2.exe"
1⤵
- Drops file in Drivers directory
- Loads dropped DLL
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:1780

C:\Windows\SysWOW64\net.exe
net stop nethttpservice
2⤵
- Suspicious use of WriteProcessMemory
PID:1596

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop nethttpservice
3⤵
PID:300

C:\Windows\SysWOW64\net.exe
net stop serviceupdater
2⤵
- Suspicious use of WriteProcessMemory
PID:572

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop serviceupdater
3⤵
PID:768

C:\Windows\SysWOW64\installd.exe
"C:\Windows\system32\installd.exe" nethfdrv
2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:564

C:\Windows\SysWOW64\nethtsrv.exe
"C:\Windows\system32\nethtsrv.exe" -nfdi
2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:964

C:\Windows\SysWOW64\netupdsrv.exe
"C:\Windows\system32\netupdsrv.exe" -nfdi
2⤵
- Executes dropped EXE
PID:1420

C:\Windows\SysWOW64\net.exe
net start nethttpservice
2⤵
- Suspicious use of WriteProcessMemory
PID:1100

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 start nethttpservice
3⤵
PID:360

C:\Windows\SysWOW64\net.exe
net start serviceupdater
2⤵
- Suspicious use of WriteProcessMemory
PID:844

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 start serviceupdater
3⤵
PID:1408

C:\Windows\SysWOW64\nethtsrv.exe
C:\Windows\SysWOW64\nethtsrv.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:1444

C:\Windows\SysWOW64\netupdsrv.exe
C:\Windows\SysWOW64\netupdsrv.exe
1⤵
- Executes dropped EXE
PID:1352

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\hfnapi.dll
Filesize
106KB

MD5
f41dedb6a4848674e00f2d0fd4823daa

SHA1
ca872c193eb2161ff5838f743e63465a5fc0a666

SHA256
93b51e02e4551a9eac2f3f4262b8bf2d9bbeae2828ab71f038a3957a48df5538

SHA512
68f0a5491bd05d5d357ac6c5ad87e8041606580b8e9ebdc814f3ace86278a2bde24421fbc14ad4c5f69fb313a4de004b2373414cce34d9286f3e2dfdeaa5229b

Download Submit
C:\Windows\SysWOW64\hfpapi.dll
Filesize
241KB

MD5
2da0452d655b1d0fb21d44ddc0b71f69

SHA1
914a79ea9bae0cd0d9a05624126c27587d8cd0e5

SHA256
038d28fa194a0c2e70b98cb974730982be104b8feb7224f2c9995a6cd4c88818

SHA512
0b8ac234ea55b8dd6213b9003d6faf1f233e3100fdd4b6144e8eb2ee9713ad72102c9a979ff6d988eca42ab5f59c08bb3c83631ed31f7c36c0865d524d7158be

Download Submit
C:\Windows\SysWOW64\installd.exe
Filesize
108KB

MD5
3f72a1d32e4a7180901af51fd09d81a6

SHA1
a89ba04131e47e9b4dc6926166e10df9f027a6ea

SHA256
c43e61b595265b0f92606bc05c6a51c6edc6fd39d0c4253e13ff02ab06628175

SHA512
8ce19245c1ffd42c73d3d8e9fd93f271e736b34668ebb3966dfa44cfad0eab24598531a14a9aa80a28e79b097d9e73500a49954033bdd4d03fb2ac4c11f1f604

Download Submit
C:\Windows\SysWOW64\nethtsrv.exe
Filesize
176KB

MD5
2e3860dc05ebfd01b3511d9bed13dc54

SHA1
7f1fa903e119d6c4d3c81fab3483b202d1877b89

SHA256
da3317472e010af3586858d7da8df687595339c21fdd81e4748a13b9d126fb62

SHA512
b1c08ad20413b0460126c23b57e127b9296e6843676684f5887b8efad9a69a123dd10a00375cdab5fb4739e5fd79513e15bc95011094c493f1ff8e6d42372973

Download Submit
C:\Windows\SysWOW64\nethtsrv.exe
Filesize
176KB

MD5
2e3860dc05ebfd01b3511d9bed13dc54

SHA1
7f1fa903e119d6c4d3c81fab3483b202d1877b89

SHA256
da3317472e010af3586858d7da8df687595339c21fdd81e4748a13b9d126fb62

SHA512
b1c08ad20413b0460126c23b57e127b9296e6843676684f5887b8efad9a69a123dd10a00375cdab5fb4739e5fd79513e15bc95011094c493f1ff8e6d42372973

Download Submit
C:\Windows\SysWOW64\netupdsrv.exe
Filesize
159KB

MD5
faa0fead6fca101f321d0eb28335e9a8

SHA1
5fecf5a97b0b5559821b3593c7a02f687ed0b7d3

SHA256
18f64c139f3713ad7429bb4e323e15ecf0381e149ea9d34856a69c7372d5f8b4

SHA512
4b2112082be5534c141b556d3556420d837c0b4633b95df0b44c0c25da35a1b06f0b4dcb15c72b425a39853b83bd59122a7a29decde7f840f7618feb15c6c92a

Download Submit
C:\Windows\SysWOW64\netupdsrv.exe
Filesize
159KB

MD5
faa0fead6fca101f321d0eb28335e9a8

SHA1
5fecf5a97b0b5559821b3593c7a02f687ed0b7d3

SHA256
18f64c139f3713ad7429bb4e323e15ecf0381e149ea9d34856a69c7372d5f8b4

SHA512
4b2112082be5534c141b556d3556420d837c0b4633b95df0b44c0c25da35a1b06f0b4dcb15c72b425a39853b83bd59122a7a29decde7f840f7618feb15c6c92a

Download Submit
\Users\Admin\AppData\Local\Temp\nsy21C6.tmp\System.dll
Filesize
11KB

MD5
c17103ae9072a06da581dec998343fc1

SHA1
b72148c6bdfaada8b8c3f950e610ee7cf1da1f8d

SHA256
dc58d8ad81cacb0c1ed72e33bff8f23ea40b5252b5bb55d393a0903e6819ae2f

SHA512
d32a71aaef18e993f28096d536e41c4d016850721b31171513ce28bbd805a54fd290b7c3e9d935f72e676a1acfb4f0dcc89d95040a0dd29f2b6975855c18986f

Download Submit
\Users\Admin\AppData\Local\Temp\nsy21C6.tmp\nsExec.dll
Filesize
6KB

MD5
acc2b699edfea5bf5aae45aba3a41e96

SHA1
d2accf4d494e43ceb2cff69abe4dd17147d29cc2

SHA256
168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e

SHA512
e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe

Download Submit
\Users\Admin\AppData\Local\Temp\nsy21C6.tmp\nsExec.dll
Filesize
6KB

MD5
acc2b699edfea5bf5aae45aba3a41e96

SHA1
d2accf4d494e43ceb2cff69abe4dd17147d29cc2

SHA256
168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e

SHA512
e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe

Download Submit
\Users\Admin\AppData\Local\Temp\nsy21C6.tmp\nsExec.dll
Filesize
6KB

MD5
acc2b699edfea5bf5aae45aba3a41e96

SHA1
d2accf4d494e43ceb2cff69abe4dd17147d29cc2

SHA256
168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e

SHA512
e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe

Download Submit
\Users\Admin\AppData\Local\Temp\nsy21C6.tmp\nsExec.dll
Filesize
6KB

MD5
acc2b699edfea5bf5aae45aba3a41e96

SHA1
d2accf4d494e43ceb2cff69abe4dd17147d29cc2

SHA256
168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e

SHA512
e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe

Download Submit
\Windows\SysWOW64\hfnapi.dll
Filesize
106KB

MD5
f41dedb6a4848674e00f2d0fd4823daa

SHA1
ca872c193eb2161ff5838f743e63465a5fc0a666

SHA256
93b51e02e4551a9eac2f3f4262b8bf2d9bbeae2828ab71f038a3957a48df5538

SHA512
68f0a5491bd05d5d357ac6c5ad87e8041606580b8e9ebdc814f3ace86278a2bde24421fbc14ad4c5f69fb313a4de004b2373414cce34d9286f3e2dfdeaa5229b

Download Submit
\Windows\SysWOW64\hfnapi.dll
Filesize
106KB

MD5
f41dedb6a4848674e00f2d0fd4823daa

SHA1
ca872c193eb2161ff5838f743e63465a5fc0a666

SHA256
93b51e02e4551a9eac2f3f4262b8bf2d9bbeae2828ab71f038a3957a48df5538

SHA512
68f0a5491bd05d5d357ac6c5ad87e8041606580b8e9ebdc814f3ace86278a2bde24421fbc14ad4c5f69fb313a4de004b2373414cce34d9286f3e2dfdeaa5229b

Download Submit
\Windows\SysWOW64\hfnapi.dll
Filesize
106KB

MD5
f41dedb6a4848674e00f2d0fd4823daa

SHA1
ca872c193eb2161ff5838f743e63465a5fc0a666

SHA256
93b51e02e4551a9eac2f3f4262b8bf2d9bbeae2828ab71f038a3957a48df5538

SHA512
68f0a5491bd05d5d357ac6c5ad87e8041606580b8e9ebdc814f3ace86278a2bde24421fbc14ad4c5f69fb313a4de004b2373414cce34d9286f3e2dfdeaa5229b

Download Submit
\Windows\SysWOW64\hfpapi.dll
Filesize
241KB

MD5
2da0452d655b1d0fb21d44ddc0b71f69

SHA1
914a79ea9bae0cd0d9a05624126c27587d8cd0e5

SHA256
038d28fa194a0c2e70b98cb974730982be104b8feb7224f2c9995a6cd4c88818

SHA512
0b8ac234ea55b8dd6213b9003d6faf1f233e3100fdd4b6144e8eb2ee9713ad72102c9a979ff6d988eca42ab5f59c08bb3c83631ed31f7c36c0865d524d7158be

Download Submit
\Windows\SysWOW64\hfpapi.dll
Filesize
241KB

MD5
2da0452d655b1d0fb21d44ddc0b71f69

SHA1
914a79ea9bae0cd0d9a05624126c27587d8cd0e5

SHA256
038d28fa194a0c2e70b98cb974730982be104b8feb7224f2c9995a6cd4c88818

SHA512
0b8ac234ea55b8dd6213b9003d6faf1f233e3100fdd4b6144e8eb2ee9713ad72102c9a979ff6d988eca42ab5f59c08bb3c83631ed31f7c36c0865d524d7158be

Download Submit
\Windows\SysWOW64\installd.exe
Filesize
108KB

MD5
3f72a1d32e4a7180901af51fd09d81a6

SHA1
a89ba04131e47e9b4dc6926166e10df9f027a6ea

SHA256
c43e61b595265b0f92606bc05c6a51c6edc6fd39d0c4253e13ff02ab06628175

SHA512
8ce19245c1ffd42c73d3d8e9fd93f271e736b34668ebb3966dfa44cfad0eab24598531a14a9aa80a28e79b097d9e73500a49954033bdd4d03fb2ac4c11f1f604

Download Submit
\Windows\SysWOW64\nethtsrv.exe
Filesize
176KB

MD5
2e3860dc05ebfd01b3511d9bed13dc54

SHA1
7f1fa903e119d6c4d3c81fab3483b202d1877b89

SHA256
da3317472e010af3586858d7da8df687595339c21fdd81e4748a13b9d126fb62

SHA512
b1c08ad20413b0460126c23b57e127b9296e6843676684f5887b8efad9a69a123dd10a00375cdab5fb4739e5fd79513e15bc95011094c493f1ff8e6d42372973

Download Submit
\Windows\SysWOW64\netupdsrv.exe
Filesize
159KB

MD5
faa0fead6fca101f321d0eb28335e9a8

SHA1
5fecf5a97b0b5559821b3593c7a02f687ed0b7d3

SHA256
18f64c139f3713ad7429bb4e323e15ecf0381e149ea9d34856a69c7372d5f8b4

SHA512
4b2112082be5534c141b556d3556420d837c0b4633b95df0b44c0c25da35a1b06f0b4dcb15c72b425a39853b83bd59122a7a29decde7f840f7618feb15c6c92a

Download Submit
memory/300-59-0x0000000000000000-mapping.dmp

Download
memory/360-82-0x0000000000000000-mapping.dmp

Download
memory/564-64-0x0000000000000000-mapping.dmp

Download
memory/572-61-0x0000000000000000-mapping.dmp

Download
memory/768-62-0x0000000000000000-mapping.dmp

Download
memory/844-87-0x0000000000000000-mapping.dmp

Download
memory/964-71-0x0000000000000000-mapping.dmp

Download
memory/1100-81-0x0000000000000000-mapping.dmp

Download
memory/1408-88-0x0000000000000000-mapping.dmp

Download
memory/1420-77-0x0000000000000000-mapping.dmp

Download
memory/1596-58-0x0000000000000000-mapping.dmp

Download
memory/1780-69-0x0000000000360000-0x00000000007BE000-memory.dmp

Filesize
4.4MB

Download
memory/1780-54-0x0000000075001000-0x0000000075003000-memory.dmp

Filesize
8KB

Download
memory/1780-55-0x0000000000360000-0x00000000007BE000-memory.dmp

Filesize
4.4MB

Download
memory/1780-91-0x0000000000360000-0x00000000007BE000-memory.dmp

Filesize
4.4MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads