2be07df02e7f46c30515e166d7e87edad27460ac8ffdc5e3f28af60ab0ccf05d

Analysis

max time kernel
43s
max time network
45s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
23-11-2022 10:30

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2be07df02e7f46c30515e166d7e87edad27460ac8ffdc5e3f28af60ab0ccf05d.exe
Size

601KB
MD5

6a299532ffee954f2babe8dd2e81d5c2
SHA1

a4d29cb6a2e09a709f45076ee24e64b33eda4526
SHA256

2be07df02e7f46c30515e166d7e87edad27460ac8ffdc5e3f28af60ab0ccf05d
SHA512

d86caa1f539f22b69b5d65a2b78c3e34f15abf518a950e26a851e8b5352cd80d5fc8b3d247d1dfdb8dadd7316d8624a8d568ab1866ed8807416ca55fc65af9be
SSDEEP

12288:8Iny5DYTt1wxnLa7QgmzDNBn1y7JK9yu2VhlzuWdF:aUTtOlaUgm1B1UK9yPjTL

Score

8^/10

discovery

Malware Config

Signatures

Drops file in Drivers directory 1 IoCs

Processes:

2be07df02e7f46c30515e166d7e87edad27460ac8ffdc5e3f28af60ab0ccf05d.exe

description ioc process

File created C:\Windows\system32\drivers\nethfdrv.sys 2be07df02e7f46c30515e166d7e87edad27460ac8ffdc5e3f28af60ab0ccf05d.exe
Executes dropped EXE 5 IoCs

Processes:

installd.exenethtsrv.exenetupdsrv.exenethtsrv.exenetupdsrv.exe

pid process

956 installd.exe
632 nethtsrv.exe
1764 netupdsrv.exe
1268 nethtsrv.exe
1816 netupdsrv.exe

description	ioc	process
File created	C:\Windows\system32\drivers\nethfdrv.sys	2be07df02e7f46c30515e166d7e87edad27460ac8ffdc5e3f28af60ab0ccf05d.exe

pid	process
956	installd.exe
632	nethtsrv.exe
1764	netupdsrv.exe
1268	nethtsrv.exe
1816	netupdsrv.exe

Loads dropped DLL 13 IoCs

Processes:

2be07df02e7f46c30515e166d7e87edad27460ac8ffdc5e3f28af60ab0ccf05d.exeinstalld.exenethtsrv.exenethtsrv.exe

pid	process
1676	2be07df02e7f46c30515e166d7e87edad27460ac8ffdc5e3f28af60ab0ccf05d.exe
1676	2be07df02e7f46c30515e166d7e87edad27460ac8ffdc5e3f28af60ab0ccf05d.exe
1676	2be07df02e7f46c30515e166d7e87edad27460ac8ffdc5e3f28af60ab0ccf05d.exe
1676	2be07df02e7f46c30515e166d7e87edad27460ac8ffdc5e3f28af60ab0ccf05d.exe
956	installd.exe
1676	2be07df02e7f46c30515e166d7e87edad27460ac8ffdc5e3f28af60ab0ccf05d.exe
632	nethtsrv.exe
632	nethtsrv.exe
1676	2be07df02e7f46c30515e166d7e87edad27460ac8ffdc5e3f28af60ab0ccf05d.exe
1676	2be07df02e7f46c30515e166d7e87edad27460ac8ffdc5e3f28af60ab0ccf05d.exe
1268	nethtsrv.exe
1268	nethtsrv.exe
1676	2be07df02e7f46c30515e166d7e87edad27460ac8ffdc5e3f28af60ab0ccf05d.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in System32 directory 5 IoCs

Processes:

2be07df02e7f46c30515e166d7e87edad27460ac8ffdc5e3f28af60ab0ccf05d.exe

description	ioc	process
File created	C:\Windows\SysWOW64\installd.exe	2be07df02e7f46c30515e166d7e87edad27460ac8ffdc5e3f28af60ab0ccf05d.exe
File created	C:\Windows\SysWOW64\nethtsrv.exe	2be07df02e7f46c30515e166d7e87edad27460ac8ffdc5e3f28af60ab0ccf05d.exe
File created	C:\Windows\SysWOW64\netupdsrv.exe	2be07df02e7f46c30515e166d7e87edad27460ac8ffdc5e3f28af60ab0ccf05d.exe
File created	C:\Windows\SysWOW64\hfnapi.dll	2be07df02e7f46c30515e166d7e87edad27460ac8ffdc5e3f28af60ab0ccf05d.exe
File created	C:\Windows\SysWOW64\hfpapi.dll	2be07df02e7f46c30515e166d7e87edad27460ac8ffdc5e3f28af60ab0ccf05d.exe

Drops file in Program Files directory 3 IoCs

Processes:

2be07df02e7f46c30515e166d7e87edad27460ac8ffdc5e3f28af60ab0ccf05d.exe

description	ioc	process
File created	C:\Program Files (x86)\Common Files\Config\data.xml	2be07df02e7f46c30515e166d7e87edad27460ac8ffdc5e3f28af60ab0ccf05d.exe
File created	C:\Program Files (x86)\Common Files\Config\ver.xml	2be07df02e7f46c30515e166d7e87edad27460ac8ffdc5e3f28af60ab0ccf05d.exe
File created	C:\Program Files (x86)\Common Files\config\uninstinethnfd.exe	2be07df02e7f46c30515e166d7e87edad27460ac8ffdc5e3f28af60ab0ccf05d.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Runs net.exe
Suspicious behavior: LoadsDriver 1 IoCs

Processes:

pid process

464
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

nethtsrv.exe

description pid process

Token: SeDebugPrivilege 1268 nethtsrv.exe

pid	process
464

description	pid	process
Token: SeDebugPrivilege	1268	nethtsrv.exe

Suspicious use of WriteProcessMemory 50 IoCs

Processes:

2be07df02e7f46c30515e166d7e87edad27460ac8ffdc5e3f28af60ab0ccf05d.exenet.exenet.exenet.exenet.exe

description	pid	process	target process
PID 1676 wrote to memory of 1756	1676	2be07df02e7f46c30515e166d7e87edad27460ac8ffdc5e3f28af60ab0ccf05d.exe	net.exe
PID 1676 wrote to memory of 1756	1676	2be07df02e7f46c30515e166d7e87edad27460ac8ffdc5e3f28af60ab0ccf05d.exe	net.exe
PID 1676 wrote to memory of 1756	1676	2be07df02e7f46c30515e166d7e87edad27460ac8ffdc5e3f28af60ab0ccf05d.exe	net.exe
PID 1676 wrote to memory of 1756	1676	2be07df02e7f46c30515e166d7e87edad27460ac8ffdc5e3f28af60ab0ccf05d.exe	net.exe
PID 1756 wrote to memory of 1988	1756	net.exe	net1.exe
PID 1756 wrote to memory of 1988	1756	net.exe	net1.exe
PID 1756 wrote to memory of 1988	1756	net.exe	net1.exe
PID 1756 wrote to memory of 1988	1756	net.exe	net1.exe
PID 1676 wrote to memory of 2024	1676	2be07df02e7f46c30515e166d7e87edad27460ac8ffdc5e3f28af60ab0ccf05d.exe	net.exe
PID 1676 wrote to memory of 2024	1676	2be07df02e7f46c30515e166d7e87edad27460ac8ffdc5e3f28af60ab0ccf05d.exe	net.exe
PID 1676 wrote to memory of 2024	1676	2be07df02e7f46c30515e166d7e87edad27460ac8ffdc5e3f28af60ab0ccf05d.exe	net.exe
PID 1676 wrote to memory of 2024	1676	2be07df02e7f46c30515e166d7e87edad27460ac8ffdc5e3f28af60ab0ccf05d.exe	net.exe
PID 2024 wrote to memory of 1744	2024	net.exe	net1.exe
PID 2024 wrote to memory of 1744	2024	net.exe	net1.exe
PID 2024 wrote to memory of 1744	2024	net.exe	net1.exe
PID 2024 wrote to memory of 1744	2024	net.exe	net1.exe
PID 1676 wrote to memory of 956	1676	2be07df02e7f46c30515e166d7e87edad27460ac8ffdc5e3f28af60ab0ccf05d.exe	installd.exe
PID 1676 wrote to memory of 956	1676	2be07df02e7f46c30515e166d7e87edad27460ac8ffdc5e3f28af60ab0ccf05d.exe	installd.exe
PID 1676 wrote to memory of 956	1676	2be07df02e7f46c30515e166d7e87edad27460ac8ffdc5e3f28af60ab0ccf05d.exe	installd.exe
PID 1676 wrote to memory of 956	1676	2be07df02e7f46c30515e166d7e87edad27460ac8ffdc5e3f28af60ab0ccf05d.exe	installd.exe
PID 1676 wrote to memory of 956	1676	2be07df02e7f46c30515e166d7e87edad27460ac8ffdc5e3f28af60ab0ccf05d.exe	installd.exe
PID 1676 wrote to memory of 956	1676	2be07df02e7f46c30515e166d7e87edad27460ac8ffdc5e3f28af60ab0ccf05d.exe	installd.exe
PID 1676 wrote to memory of 956	1676	2be07df02e7f46c30515e166d7e87edad27460ac8ffdc5e3f28af60ab0ccf05d.exe	installd.exe
PID 1676 wrote to memory of 632	1676	2be07df02e7f46c30515e166d7e87edad27460ac8ffdc5e3f28af60ab0ccf05d.exe	nethtsrv.exe
PID 1676 wrote to memory of 632	1676	2be07df02e7f46c30515e166d7e87edad27460ac8ffdc5e3f28af60ab0ccf05d.exe	nethtsrv.exe
PID 1676 wrote to memory of 632	1676	2be07df02e7f46c30515e166d7e87edad27460ac8ffdc5e3f28af60ab0ccf05d.exe	nethtsrv.exe
PID 1676 wrote to memory of 632	1676	2be07df02e7f46c30515e166d7e87edad27460ac8ffdc5e3f28af60ab0ccf05d.exe	nethtsrv.exe
PID 1676 wrote to memory of 1764	1676	2be07df02e7f46c30515e166d7e87edad27460ac8ffdc5e3f28af60ab0ccf05d.exe	netupdsrv.exe
PID 1676 wrote to memory of 1764	1676	2be07df02e7f46c30515e166d7e87edad27460ac8ffdc5e3f28af60ab0ccf05d.exe	netupdsrv.exe
PID 1676 wrote to memory of 1764	1676	2be07df02e7f46c30515e166d7e87edad27460ac8ffdc5e3f28af60ab0ccf05d.exe	netupdsrv.exe
PID 1676 wrote to memory of 1764	1676	2be07df02e7f46c30515e166d7e87edad27460ac8ffdc5e3f28af60ab0ccf05d.exe	netupdsrv.exe
PID 1676 wrote to memory of 1764	1676	2be07df02e7f46c30515e166d7e87edad27460ac8ffdc5e3f28af60ab0ccf05d.exe	netupdsrv.exe
PID 1676 wrote to memory of 1764	1676	2be07df02e7f46c30515e166d7e87edad27460ac8ffdc5e3f28af60ab0ccf05d.exe	netupdsrv.exe
PID 1676 wrote to memory of 1764	1676	2be07df02e7f46c30515e166d7e87edad27460ac8ffdc5e3f28af60ab0ccf05d.exe	netupdsrv.exe
PID 1676 wrote to memory of 1828	1676	2be07df02e7f46c30515e166d7e87edad27460ac8ffdc5e3f28af60ab0ccf05d.exe	net.exe
PID 1676 wrote to memory of 1828	1676	2be07df02e7f46c30515e166d7e87edad27460ac8ffdc5e3f28af60ab0ccf05d.exe	net.exe
PID 1676 wrote to memory of 1828	1676	2be07df02e7f46c30515e166d7e87edad27460ac8ffdc5e3f28af60ab0ccf05d.exe	net.exe
PID 1676 wrote to memory of 1828	1676	2be07df02e7f46c30515e166d7e87edad27460ac8ffdc5e3f28af60ab0ccf05d.exe	net.exe
PID 1828 wrote to memory of 300	1828	net.exe	net1.exe
PID 1828 wrote to memory of 300	1828	net.exe	net1.exe
PID 1828 wrote to memory of 300	1828	net.exe	net1.exe
PID 1828 wrote to memory of 300	1828	net.exe	net1.exe
PID 1676 wrote to memory of 1728	1676	2be07df02e7f46c30515e166d7e87edad27460ac8ffdc5e3f28af60ab0ccf05d.exe	net.exe
PID 1676 wrote to memory of 1728	1676	2be07df02e7f46c30515e166d7e87edad27460ac8ffdc5e3f28af60ab0ccf05d.exe	net.exe
PID 1676 wrote to memory of 1728	1676	2be07df02e7f46c30515e166d7e87edad27460ac8ffdc5e3f28af60ab0ccf05d.exe	net.exe
PID 1676 wrote to memory of 1728	1676	2be07df02e7f46c30515e166d7e87edad27460ac8ffdc5e3f28af60ab0ccf05d.exe	net.exe
PID 1728 wrote to memory of 1948	1728	net.exe	net1.exe
PID 1728 wrote to memory of 1948	1728	net.exe	net1.exe
PID 1728 wrote to memory of 1948	1728	net.exe	net1.exe
PID 1728 wrote to memory of 1948	1728	net.exe	net1.exe

C:\Users\Admin\AppData\Local\Temp\2be07df02e7f46c30515e166d7e87edad27460ac8ffdc5e3f28af60ab0ccf05d.exe
"C:\Users\Admin\AppData\Local\Temp\2be07df02e7f46c30515e166d7e87edad27460ac8ffdc5e3f28af60ab0ccf05d.exe"
1⤵
- Drops file in Drivers directory
- Loads dropped DLL
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:1676

C:\Windows\SysWOW64\net.exe
net stop nethttpservice
2⤵
- Suspicious use of WriteProcessMemory
PID:1756

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop nethttpservice
3⤵
PID:1988

C:\Windows\SysWOW64\net.exe
net stop serviceupdater
2⤵
- Suspicious use of WriteProcessMemory
PID:2024

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop serviceupdater
3⤵
PID:1744

C:\Windows\SysWOW64\installd.exe
"C:\Windows\system32\installd.exe" nethfdrv
2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:956

C:\Windows\SysWOW64\nethtsrv.exe
"C:\Windows\system32\nethtsrv.exe" -nfdi
2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:632

C:\Windows\SysWOW64\netupdsrv.exe
"C:\Windows\system32\netupdsrv.exe" -nfdi
2⤵
- Executes dropped EXE
PID:1764

C:\Windows\SysWOW64\net.exe
net start nethttpservice
2⤵
- Suspicious use of WriteProcessMemory
PID:1828

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 start nethttpservice
3⤵
PID:300

C:\Windows\SysWOW64\net.exe
net start serviceupdater
2⤵
- Suspicious use of WriteProcessMemory
PID:1728

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 start serviceupdater
3⤵
PID:1948

C:\Windows\SysWOW64\nethtsrv.exe
C:\Windows\SysWOW64\nethtsrv.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:1268

C:\Windows\SysWOW64\netupdsrv.exe
C:\Windows\SysWOW64\netupdsrv.exe
1⤵
- Executes dropped EXE
PID:1816

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\hfnapi.dll
Filesize
106KB

MD5
4fe4a9332ec6c4270eb7648360715bd9

SHA1
ccfa1583a2c7487a1f9ba37ebf98465f73b0dc41

SHA256
54ad2a466691b613d60ca56381d8cf8cdadcfdb8f7ca20c927502234b8a6d57c

SHA512
c955058c242b875e0b741cb2c2c3c8e7bd8dd8fdb00c36f8bb2058ea97f5a63f39357ceeb89d8b70e5615570a4cd3e8e5e4617e1e7d7e2da6c77b62bf403041f

Download Submit
C:\Windows\SysWOW64\hfpapi.dll
Filesize
241KB

MD5
f99122ad4f21d36b2095ec5c2cf78faf

SHA1
23d5706a7000c728138b151a5f7d0b7769c3205f

SHA256
d124db87fbb7a209cfd342584c06c2f0f170b23b78699d7ff20f527029e3f6cb

SHA512
f099dad11d1b178c67eebf9e344921a9201dcef8b83ee5bd15340adc4b671d7f3a170483d856ddadaf4504e6ef005fbec9fca8ea0ad7f6eb9f8252456efebaae

Download Submit
C:\Windows\SysWOW64\installd.exe
Filesize
108KB

MD5
5c82bf0016a6d6ea73a74ee9f01612ad

SHA1
6c90c01859da00388b1c2b169873ee5b4ad8962b

SHA256
5e06bf14352a4741f378d22a95706a0e1b8ca43d72dd025ac14eefe6556628da

SHA512
f6b2d45148bbaaf7b40c1b751ee73c7ce090cfba2414b1e9266768d72bcd68cfa008887a93f54ea8708ec7297d4bb3779d15a38caffb3b6c2144ea7cef16bdf2

Download Submit
C:\Windows\SysWOW64\nethtsrv.exe
Filesize
176KB

MD5
53c0719aff3908e8a7ca568d53244e1d

SHA1
7d365f4f5f706022abd891d38bc27be0895e7bc7

SHA256
7bf1af3b603e5d71b14ef5ed45b3170ede8908f05b6576f3d5013379506162d3

SHA512
1f94f488d052a5d47d44a6d1f56dd8afd61ba875db0d40a4c0086ffebce62d8dbb204fdfdf092a155d292bdac3b873d365abe10b78c99718a75f579b9b6eb08b

Download Submit
C:\Windows\SysWOW64\nethtsrv.exe
Filesize
176KB

MD5
53c0719aff3908e8a7ca568d53244e1d

SHA1
7d365f4f5f706022abd891d38bc27be0895e7bc7

SHA256
7bf1af3b603e5d71b14ef5ed45b3170ede8908f05b6576f3d5013379506162d3

SHA512
1f94f488d052a5d47d44a6d1f56dd8afd61ba875db0d40a4c0086ffebce62d8dbb204fdfdf092a155d292bdac3b873d365abe10b78c99718a75f579b9b6eb08b

Download Submit
C:\Windows\SysWOW64\netupdsrv.exe
Filesize
158KB

MD5
07a43604e835575b2928470ffe9f9294

SHA1
cef5fe47e0753edc5a94c9704387997ba38207b8

SHA256
824e992207947c16a9bd706dca7b8eedebc2af9f97db4edbf0b97a7376832305

SHA512
b35a30ff06a107e72f2b89679900c29c990ffe561d341d55fe93f9c9cbe8d6f3faabd5c756bcdc8545e8243cb7ec0e6850a5f4893281844304c1ed18cff1b4eb

Download Submit
C:\Windows\SysWOW64\netupdsrv.exe
Filesize
158KB

MD5
07a43604e835575b2928470ffe9f9294

SHA1
cef5fe47e0753edc5a94c9704387997ba38207b8

SHA256
824e992207947c16a9bd706dca7b8eedebc2af9f97db4edbf0b97a7376832305

SHA512
b35a30ff06a107e72f2b89679900c29c990ffe561d341d55fe93f9c9cbe8d6f3faabd5c756bcdc8545e8243cb7ec0e6850a5f4893281844304c1ed18cff1b4eb

Download Submit
\Users\Admin\AppData\Local\Temp\nsj8C0D.tmp\System.dll
Filesize
11KB

MD5
c17103ae9072a06da581dec998343fc1

SHA1
b72148c6bdfaada8b8c3f950e610ee7cf1da1f8d

SHA256
dc58d8ad81cacb0c1ed72e33bff8f23ea40b5252b5bb55d393a0903e6819ae2f

SHA512
d32a71aaef18e993f28096d536e41c4d016850721b31171513ce28bbd805a54fd290b7c3e9d935f72e676a1acfb4f0dcc89d95040a0dd29f2b6975855c18986f

Download Submit
\Users\Admin\AppData\Local\Temp\nsj8C0D.tmp\nsExec.dll
Filesize
6KB

MD5
acc2b699edfea5bf5aae45aba3a41e96

SHA1
d2accf4d494e43ceb2cff69abe4dd17147d29cc2

SHA256
168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e

SHA512
e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe

Download Submit
\Users\Admin\AppData\Local\Temp\nsj8C0D.tmp\nsExec.dll
Filesize
6KB

MD5
acc2b699edfea5bf5aae45aba3a41e96

SHA1
d2accf4d494e43ceb2cff69abe4dd17147d29cc2

SHA256
168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e

SHA512
e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe

Download Submit
\Users\Admin\AppData\Local\Temp\nsj8C0D.tmp\nsExec.dll
Filesize
6KB

MD5
acc2b699edfea5bf5aae45aba3a41e96

SHA1
d2accf4d494e43ceb2cff69abe4dd17147d29cc2

SHA256
168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e

SHA512
e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe

Download Submit
\Users\Admin\AppData\Local\Temp\nsj8C0D.tmp\nsExec.dll
Filesize
6KB

MD5
acc2b699edfea5bf5aae45aba3a41e96

SHA1
d2accf4d494e43ceb2cff69abe4dd17147d29cc2

SHA256
168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e

SHA512
e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe

Download Submit
\Windows\SysWOW64\hfnapi.dll
Filesize
106KB

MD5
4fe4a9332ec6c4270eb7648360715bd9

SHA1
ccfa1583a2c7487a1f9ba37ebf98465f73b0dc41

SHA256
54ad2a466691b613d60ca56381d8cf8cdadcfdb8f7ca20c927502234b8a6d57c

SHA512
c955058c242b875e0b741cb2c2c3c8e7bd8dd8fdb00c36f8bb2058ea97f5a63f39357ceeb89d8b70e5615570a4cd3e8e5e4617e1e7d7e2da6c77b62bf403041f

Download Submit
\Windows\SysWOW64\hfnapi.dll
Filesize
106KB

MD5
4fe4a9332ec6c4270eb7648360715bd9

SHA1
ccfa1583a2c7487a1f9ba37ebf98465f73b0dc41

SHA256
54ad2a466691b613d60ca56381d8cf8cdadcfdb8f7ca20c927502234b8a6d57c

SHA512
c955058c242b875e0b741cb2c2c3c8e7bd8dd8fdb00c36f8bb2058ea97f5a63f39357ceeb89d8b70e5615570a4cd3e8e5e4617e1e7d7e2da6c77b62bf403041f

Download Submit
\Windows\SysWOW64\hfnapi.dll
Filesize
106KB

MD5
4fe4a9332ec6c4270eb7648360715bd9

SHA1
ccfa1583a2c7487a1f9ba37ebf98465f73b0dc41

SHA256
54ad2a466691b613d60ca56381d8cf8cdadcfdb8f7ca20c927502234b8a6d57c

SHA512
c955058c242b875e0b741cb2c2c3c8e7bd8dd8fdb00c36f8bb2058ea97f5a63f39357ceeb89d8b70e5615570a4cd3e8e5e4617e1e7d7e2da6c77b62bf403041f

Download Submit
\Windows\SysWOW64\hfpapi.dll
Filesize
241KB

MD5
f99122ad4f21d36b2095ec5c2cf78faf

SHA1
23d5706a7000c728138b151a5f7d0b7769c3205f

SHA256
d124db87fbb7a209cfd342584c06c2f0f170b23b78699d7ff20f527029e3f6cb

SHA512
f099dad11d1b178c67eebf9e344921a9201dcef8b83ee5bd15340adc4b671d7f3a170483d856ddadaf4504e6ef005fbec9fca8ea0ad7f6eb9f8252456efebaae

Download Submit
\Windows\SysWOW64\hfpapi.dll
Filesize
241KB

MD5
f99122ad4f21d36b2095ec5c2cf78faf

SHA1
23d5706a7000c728138b151a5f7d0b7769c3205f

SHA256
d124db87fbb7a209cfd342584c06c2f0f170b23b78699d7ff20f527029e3f6cb

SHA512
f099dad11d1b178c67eebf9e344921a9201dcef8b83ee5bd15340adc4b671d7f3a170483d856ddadaf4504e6ef005fbec9fca8ea0ad7f6eb9f8252456efebaae

Download Submit
\Windows\SysWOW64\installd.exe
Filesize
108KB

MD5
5c82bf0016a6d6ea73a74ee9f01612ad

SHA1
6c90c01859da00388b1c2b169873ee5b4ad8962b

SHA256
5e06bf14352a4741f378d22a95706a0e1b8ca43d72dd025ac14eefe6556628da

SHA512
f6b2d45148bbaaf7b40c1b751ee73c7ce090cfba2414b1e9266768d72bcd68cfa008887a93f54ea8708ec7297d4bb3779d15a38caffb3b6c2144ea7cef16bdf2

Download Submit
\Windows\SysWOW64\nethtsrv.exe
Filesize
176KB

MD5
53c0719aff3908e8a7ca568d53244e1d

SHA1
7d365f4f5f706022abd891d38bc27be0895e7bc7

SHA256
7bf1af3b603e5d71b14ef5ed45b3170ede8908f05b6576f3d5013379506162d3

SHA512
1f94f488d052a5d47d44a6d1f56dd8afd61ba875db0d40a4c0086ffebce62d8dbb204fdfdf092a155d292bdac3b873d365abe10b78c99718a75f579b9b6eb08b

Download Submit
\Windows\SysWOW64\netupdsrv.exe
Filesize
158KB

MD5
07a43604e835575b2928470ffe9f9294

SHA1
cef5fe47e0753edc5a94c9704387997ba38207b8

SHA256
824e992207947c16a9bd706dca7b8eedebc2af9f97db4edbf0b97a7376832305

SHA512
b35a30ff06a107e72f2b89679900c29c990ffe561d341d55fe93f9c9cbe8d6f3faabd5c756bcdc8545e8243cb7ec0e6850a5f4893281844304c1ed18cff1b4eb

Download Submit
memory/300-81-0x0000000000000000-mapping.dmp

Download
memory/632-70-0x0000000000000000-mapping.dmp

Download
memory/956-64-0x0000000000000000-mapping.dmp

Download
memory/1676-54-0x00000000753C1000-0x00000000753C3000-memory.dmp

Filesize
8KB

Download
memory/1676-90-0x0000000000360000-0x00000000007BE000-memory.dmp

Filesize
4.4MB

Download
memory/1676-61-0x0000000000360000-0x00000000007BE000-memory.dmp

Filesize
4.4MB

Download
memory/1728-86-0x0000000000000000-mapping.dmp

Download
memory/1744-62-0x0000000000000000-mapping.dmp

Download
memory/1756-57-0x0000000000000000-mapping.dmp

Download
memory/1764-76-0x0000000000000000-mapping.dmp

Download
memory/1828-80-0x0000000000000000-mapping.dmp

Download
memory/1948-87-0x0000000000000000-mapping.dmp

Download
memory/1988-58-0x0000000000000000-mapping.dmp

Download
memory/2024-60-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads