2a7c3e4e0d62e74a080346e2589feb16d0f9c9c3635c95d88c11818a99d44189

Analysis

max time kernel
63s
max time network
35s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
23-11-2022 10:30

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2a7c3e4e0d62e74a080346e2589feb16d0f9c9c3635c95d88c11818a99d44189.exe
Size

601KB
MD5

326066ec0e83148111edc4d2315a8923
SHA1

a681649eeefb8ff68929cf420ba2d9686e68ccf1
SHA256

2a7c3e4e0d62e74a080346e2589feb16d0f9c9c3635c95d88c11818a99d44189
SHA512

c2d2367b61b1084f34042866d02ee3d9cefdf8bd99a613b52e28eb6158b8b69a824bd380aad958aeda4190fa16df0bb5b8ad131b99e27d32ebbe4b10bae2f20e
SSDEEP

12288:CIny5DYT68E/ugyCgHbBAzwxWjVMGVqFx5udE:kUTRYdgHFqvE3uS

Score

8^/10

discovery

Malware Config

Signatures

Drops file in Drivers directory 1 IoCs

Processes:

2a7c3e4e0d62e74a080346e2589feb16d0f9c9c3635c95d88c11818a99d44189.exe

description ioc process

File created C:\Windows\system32\drivers\nethfdrv.sys 2a7c3e4e0d62e74a080346e2589feb16d0f9c9c3635c95d88c11818a99d44189.exe
Executes dropped EXE 5 IoCs

Processes:

installd.exenethtsrv.exenetupdsrv.exenethtsrv.exenetupdsrv.exe

pid process

1296 installd.exe
552 nethtsrv.exe
772 netupdsrv.exe
976 nethtsrv.exe
1736 netupdsrv.exe

description	ioc	process
File created	C:\Windows\system32\drivers\nethfdrv.sys	2a7c3e4e0d62e74a080346e2589feb16d0f9c9c3635c95d88c11818a99d44189.exe

pid	process
1296	installd.exe
552	nethtsrv.exe
772	netupdsrv.exe
976	nethtsrv.exe
1736	netupdsrv.exe

Loads dropped DLL 13 IoCs

Processes:

2a7c3e4e0d62e74a080346e2589feb16d0f9c9c3635c95d88c11818a99d44189.exeinstalld.exenethtsrv.exenethtsrv.exe

pid	process
1656	2a7c3e4e0d62e74a080346e2589feb16d0f9c9c3635c95d88c11818a99d44189.exe
1656	2a7c3e4e0d62e74a080346e2589feb16d0f9c9c3635c95d88c11818a99d44189.exe
1656	2a7c3e4e0d62e74a080346e2589feb16d0f9c9c3635c95d88c11818a99d44189.exe
1656	2a7c3e4e0d62e74a080346e2589feb16d0f9c9c3635c95d88c11818a99d44189.exe
1296	installd.exe
1656	2a7c3e4e0d62e74a080346e2589feb16d0f9c9c3635c95d88c11818a99d44189.exe
552	nethtsrv.exe
552	nethtsrv.exe
1656	2a7c3e4e0d62e74a080346e2589feb16d0f9c9c3635c95d88c11818a99d44189.exe
1656	2a7c3e4e0d62e74a080346e2589feb16d0f9c9c3635c95d88c11818a99d44189.exe
976	nethtsrv.exe
976	nethtsrv.exe
1656	2a7c3e4e0d62e74a080346e2589feb16d0f9c9c3635c95d88c11818a99d44189.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in System32 directory 5 IoCs

Processes:

2a7c3e4e0d62e74a080346e2589feb16d0f9c9c3635c95d88c11818a99d44189.exe

description	ioc	process
File created	C:\Windows\SysWOW64\nethtsrv.exe	2a7c3e4e0d62e74a080346e2589feb16d0f9c9c3635c95d88c11818a99d44189.exe
File created	C:\Windows\SysWOW64\netupdsrv.exe	2a7c3e4e0d62e74a080346e2589feb16d0f9c9c3635c95d88c11818a99d44189.exe
File created	C:\Windows\SysWOW64\hfnapi.dll	2a7c3e4e0d62e74a080346e2589feb16d0f9c9c3635c95d88c11818a99d44189.exe
File created	C:\Windows\SysWOW64\hfpapi.dll	2a7c3e4e0d62e74a080346e2589feb16d0f9c9c3635c95d88c11818a99d44189.exe
File created	C:\Windows\SysWOW64\installd.exe	2a7c3e4e0d62e74a080346e2589feb16d0f9c9c3635c95d88c11818a99d44189.exe

Drops file in Program Files directory 3 IoCs

Processes:

2a7c3e4e0d62e74a080346e2589feb16d0f9c9c3635c95d88c11818a99d44189.exe

description	ioc	process
File created	C:\Program Files (x86)\Common Files\Config\data.xml	2a7c3e4e0d62e74a080346e2589feb16d0f9c9c3635c95d88c11818a99d44189.exe
File created	C:\Program Files (x86)\Common Files\Config\ver.xml	2a7c3e4e0d62e74a080346e2589feb16d0f9c9c3635c95d88c11818a99d44189.exe
File created	C:\Program Files (x86)\Common Files\config\uninstinethnfd.exe	2a7c3e4e0d62e74a080346e2589feb16d0f9c9c3635c95d88c11818a99d44189.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Runs net.exe
Suspicious behavior: LoadsDriver 1 IoCs

Processes:

pid process

460
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

nethtsrv.exe

description pid process

Token: SeDebugPrivilege 976 nethtsrv.exe

pid	process
460

description	pid	process
Token: SeDebugPrivilege	976	nethtsrv.exe

Suspicious use of WriteProcessMemory 50 IoCs

Processes:

2a7c3e4e0d62e74a080346e2589feb16d0f9c9c3635c95d88c11818a99d44189.exenet.exenet.exenet.exenet.exe

description	pid	process	target process
PID 1656 wrote to memory of 684	1656	2a7c3e4e0d62e74a080346e2589feb16d0f9c9c3635c95d88c11818a99d44189.exe	net.exe
PID 1656 wrote to memory of 684	1656	2a7c3e4e0d62e74a080346e2589feb16d0f9c9c3635c95d88c11818a99d44189.exe	net.exe
PID 1656 wrote to memory of 684	1656	2a7c3e4e0d62e74a080346e2589feb16d0f9c9c3635c95d88c11818a99d44189.exe	net.exe
PID 1656 wrote to memory of 684	1656	2a7c3e4e0d62e74a080346e2589feb16d0f9c9c3635c95d88c11818a99d44189.exe	net.exe
PID 684 wrote to memory of 584	684	net.exe	net1.exe
PID 684 wrote to memory of 584	684	net.exe	net1.exe
PID 684 wrote to memory of 584	684	net.exe	net1.exe
PID 684 wrote to memory of 584	684	net.exe	net1.exe
PID 1656 wrote to memory of 788	1656	2a7c3e4e0d62e74a080346e2589feb16d0f9c9c3635c95d88c11818a99d44189.exe	net.exe
PID 1656 wrote to memory of 788	1656	2a7c3e4e0d62e74a080346e2589feb16d0f9c9c3635c95d88c11818a99d44189.exe	net.exe
PID 1656 wrote to memory of 788	1656	2a7c3e4e0d62e74a080346e2589feb16d0f9c9c3635c95d88c11818a99d44189.exe	net.exe
PID 1656 wrote to memory of 788	1656	2a7c3e4e0d62e74a080346e2589feb16d0f9c9c3635c95d88c11818a99d44189.exe	net.exe
PID 788 wrote to memory of 1292	788	net.exe	net1.exe
PID 788 wrote to memory of 1292	788	net.exe	net1.exe
PID 788 wrote to memory of 1292	788	net.exe	net1.exe
PID 788 wrote to memory of 1292	788	net.exe	net1.exe
PID 1656 wrote to memory of 1296	1656	2a7c3e4e0d62e74a080346e2589feb16d0f9c9c3635c95d88c11818a99d44189.exe	installd.exe
PID 1656 wrote to memory of 1296	1656	2a7c3e4e0d62e74a080346e2589feb16d0f9c9c3635c95d88c11818a99d44189.exe	installd.exe
PID 1656 wrote to memory of 1296	1656	2a7c3e4e0d62e74a080346e2589feb16d0f9c9c3635c95d88c11818a99d44189.exe	installd.exe
PID 1656 wrote to memory of 1296	1656	2a7c3e4e0d62e74a080346e2589feb16d0f9c9c3635c95d88c11818a99d44189.exe	installd.exe
PID 1656 wrote to memory of 1296	1656	2a7c3e4e0d62e74a080346e2589feb16d0f9c9c3635c95d88c11818a99d44189.exe	installd.exe
PID 1656 wrote to memory of 1296	1656	2a7c3e4e0d62e74a080346e2589feb16d0f9c9c3635c95d88c11818a99d44189.exe	installd.exe
PID 1656 wrote to memory of 1296	1656	2a7c3e4e0d62e74a080346e2589feb16d0f9c9c3635c95d88c11818a99d44189.exe	installd.exe
PID 1656 wrote to memory of 552	1656	2a7c3e4e0d62e74a080346e2589feb16d0f9c9c3635c95d88c11818a99d44189.exe	nethtsrv.exe
PID 1656 wrote to memory of 552	1656	2a7c3e4e0d62e74a080346e2589feb16d0f9c9c3635c95d88c11818a99d44189.exe	nethtsrv.exe
PID 1656 wrote to memory of 552	1656	2a7c3e4e0d62e74a080346e2589feb16d0f9c9c3635c95d88c11818a99d44189.exe	nethtsrv.exe
PID 1656 wrote to memory of 552	1656	2a7c3e4e0d62e74a080346e2589feb16d0f9c9c3635c95d88c11818a99d44189.exe	nethtsrv.exe
PID 1656 wrote to memory of 772	1656	2a7c3e4e0d62e74a080346e2589feb16d0f9c9c3635c95d88c11818a99d44189.exe	netupdsrv.exe
PID 1656 wrote to memory of 772	1656	2a7c3e4e0d62e74a080346e2589feb16d0f9c9c3635c95d88c11818a99d44189.exe	netupdsrv.exe
PID 1656 wrote to memory of 772	1656	2a7c3e4e0d62e74a080346e2589feb16d0f9c9c3635c95d88c11818a99d44189.exe	netupdsrv.exe
PID 1656 wrote to memory of 772	1656	2a7c3e4e0d62e74a080346e2589feb16d0f9c9c3635c95d88c11818a99d44189.exe	netupdsrv.exe
PID 1656 wrote to memory of 772	1656	2a7c3e4e0d62e74a080346e2589feb16d0f9c9c3635c95d88c11818a99d44189.exe	netupdsrv.exe
PID 1656 wrote to memory of 772	1656	2a7c3e4e0d62e74a080346e2589feb16d0f9c9c3635c95d88c11818a99d44189.exe	netupdsrv.exe
PID 1656 wrote to memory of 772	1656	2a7c3e4e0d62e74a080346e2589feb16d0f9c9c3635c95d88c11818a99d44189.exe	netupdsrv.exe
PID 1656 wrote to memory of 272	1656	2a7c3e4e0d62e74a080346e2589feb16d0f9c9c3635c95d88c11818a99d44189.exe	net.exe
PID 1656 wrote to memory of 272	1656	2a7c3e4e0d62e74a080346e2589feb16d0f9c9c3635c95d88c11818a99d44189.exe	net.exe
PID 1656 wrote to memory of 272	1656	2a7c3e4e0d62e74a080346e2589feb16d0f9c9c3635c95d88c11818a99d44189.exe	net.exe
PID 1656 wrote to memory of 272	1656	2a7c3e4e0d62e74a080346e2589feb16d0f9c9c3635c95d88c11818a99d44189.exe	net.exe
PID 272 wrote to memory of 1280	272	net.exe	net1.exe
PID 272 wrote to memory of 1280	272	net.exe	net1.exe
PID 272 wrote to memory of 1280	272	net.exe	net1.exe
PID 272 wrote to memory of 1280	272	net.exe	net1.exe
PID 1656 wrote to memory of 1352	1656	2a7c3e4e0d62e74a080346e2589feb16d0f9c9c3635c95d88c11818a99d44189.exe	net.exe
PID 1656 wrote to memory of 1352	1656	2a7c3e4e0d62e74a080346e2589feb16d0f9c9c3635c95d88c11818a99d44189.exe	net.exe
PID 1656 wrote to memory of 1352	1656	2a7c3e4e0d62e74a080346e2589feb16d0f9c9c3635c95d88c11818a99d44189.exe	net.exe
PID 1656 wrote to memory of 1352	1656	2a7c3e4e0d62e74a080346e2589feb16d0f9c9c3635c95d88c11818a99d44189.exe	net.exe
PID 1352 wrote to memory of 620	1352	net.exe	net1.exe
PID 1352 wrote to memory of 620	1352	net.exe	net1.exe
PID 1352 wrote to memory of 620	1352	net.exe	net1.exe
PID 1352 wrote to memory of 620	1352	net.exe	net1.exe

C:\Users\Admin\AppData\Local\Temp\2a7c3e4e0d62e74a080346e2589feb16d0f9c9c3635c95d88c11818a99d44189.exe
"C:\Users\Admin\AppData\Local\Temp\2a7c3e4e0d62e74a080346e2589feb16d0f9c9c3635c95d88c11818a99d44189.exe"
1⤵
- Drops file in Drivers directory
- Loads dropped DLL
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:1656

C:\Windows\SysWOW64\net.exe
net stop nethttpservice
2⤵
- Suspicious use of WriteProcessMemory
PID:684

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop nethttpservice
3⤵
PID:584

C:\Windows\SysWOW64\net.exe
net stop serviceupdater
2⤵
- Suspicious use of WriteProcessMemory
PID:788

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop serviceupdater
3⤵
PID:1292

C:\Windows\SysWOW64\installd.exe
"C:\Windows\system32\installd.exe" nethfdrv
2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1296

C:\Windows\SysWOW64\nethtsrv.exe
"C:\Windows\system32\nethtsrv.exe" -nfdi
2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:552

C:\Windows\SysWOW64\netupdsrv.exe
"C:\Windows\system32\netupdsrv.exe" -nfdi
2⤵
- Executes dropped EXE
PID:772

C:\Windows\SysWOW64\net.exe
net start nethttpservice
2⤵
- Suspicious use of WriteProcessMemory
PID:272

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 start nethttpservice
3⤵
PID:1280

C:\Windows\SysWOW64\net.exe
net start serviceupdater
2⤵
- Suspicious use of WriteProcessMemory
PID:1352

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 start serviceupdater
3⤵
PID:620

C:\Windows\SysWOW64\nethtsrv.exe
C:\Windows\SysWOW64\nethtsrv.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:976

C:\Windows\SysWOW64\netupdsrv.exe
C:\Windows\SysWOW64\netupdsrv.exe
1⤵
- Executes dropped EXE
PID:1736

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\hfnapi.dll
Filesize
106KB

MD5
d6cff7f5fa1ee4d0246ea78033ee5ed5

SHA1
ad719d4cd9e1777c61c67f2c7dac033fcf253bd5

SHA256
f1de79860a75546a01554bb4d06b677cf5b6656b14864eb4192bbc740c6b2cdf

SHA512
743be51e34204a17a391df3a092b335a5054a170807f1bd2f8dad614ca9a761b943ffcd516e21021e14d87cd8ff9139e0671fa894840ca25dfd4d253d329832c

Download Submit
C:\Windows\SysWOW64\hfpapi.dll
Filesize
241KB

MD5
24efffb9a82312cce0ac46fa3071532b

SHA1
d48481329986dd591a89e64e2cbd370f5e9c0d19

SHA256
2175c2d45b6f50406691f014a4dfac52642c460e5f0d463dea78e366337f9149

SHA512
c6ca0cbfd054826606e513b6d67918f9dc141b0152b916c0c711d47c0ba2ccece3a4bead32f6ff081ff32db6d1d34df482f21a509a8fb673b770f4b768e3048e

Download Submit
C:\Windows\SysWOW64\installd.exe
Filesize
108KB

MD5
7e2198dc26d52ef543257625b70a09c9

SHA1
add1a4d5b8639b60650d8a06d42df0b5f54fe57e

SHA256
7a1f86939ecf61fcdf38b280773b340b4daf12df563721308fa136748172bde3

SHA512
bf0d8e02b795c697cc262d4950a773323f495ae602ca821ebdbd9a824d97cf39889eb8a2447e8e6b97ce4f5476b0495470ca1fae47d6a3a3d0036287a8578201

Download Submit
C:\Windows\SysWOW64\nethtsrv.exe
Filesize
176KB

MD5
0e440b580b36f1d40e6220ed110aff59

SHA1
af52a48f92c6f25b818679da9d6a4a8daeb2f60a

SHA256
64f34b546160918660806c5156225b6e787c127613b4fb807c5c480fc647fa95

SHA512
0a30db3b6aea7d8bce1e7def7fa3a4cbde0e2bb806ef79f43f2d5fc54bf32385ab0683d2dfbd536e50cb4189dbe92d54ba47f6755747d2817ea2b6a72be6382d

Download Submit
C:\Windows\SysWOW64\nethtsrv.exe
Filesize
176KB

MD5
0e440b580b36f1d40e6220ed110aff59

SHA1
af52a48f92c6f25b818679da9d6a4a8daeb2f60a

SHA256
64f34b546160918660806c5156225b6e787c127613b4fb807c5c480fc647fa95

SHA512
0a30db3b6aea7d8bce1e7def7fa3a4cbde0e2bb806ef79f43f2d5fc54bf32385ab0683d2dfbd536e50cb4189dbe92d54ba47f6755747d2817ea2b6a72be6382d

Download Submit
C:\Windows\SysWOW64\netupdsrv.exe
Filesize
158KB

MD5
bc484acb363eaaedb4fbcb330565f183

SHA1
360f28d7293b779714183d621bfb48123842155a

SHA256
b971c593df06253fbdeb5115bbf8239528ab5d8c0367f67ea1fa5036ea97735a

SHA512
7ec58244a4584ebbf17afe1ca02eb36d96dccb4bccea5fb3b75951f43c2472635659e7d35876d7200a24ecedab96618c2b1fff958a9eec109c346586a987a5cc

Download Submit
C:\Windows\SysWOW64\netupdsrv.exe
Filesize
158KB

MD5
bc484acb363eaaedb4fbcb330565f183

SHA1
360f28d7293b779714183d621bfb48123842155a

SHA256
b971c593df06253fbdeb5115bbf8239528ab5d8c0367f67ea1fa5036ea97735a

SHA512
7ec58244a4584ebbf17afe1ca02eb36d96dccb4bccea5fb3b75951f43c2472635659e7d35876d7200a24ecedab96618c2b1fff958a9eec109c346586a987a5cc

Download Submit
\Users\Admin\AppData\Local\Temp\nstE987.tmp\System.dll
Filesize
11KB

MD5
c17103ae9072a06da581dec998343fc1

SHA1
b72148c6bdfaada8b8c3f950e610ee7cf1da1f8d

SHA256
dc58d8ad81cacb0c1ed72e33bff8f23ea40b5252b5bb55d393a0903e6819ae2f

SHA512
d32a71aaef18e993f28096d536e41c4d016850721b31171513ce28bbd805a54fd290b7c3e9d935f72e676a1acfb4f0dcc89d95040a0dd29f2b6975855c18986f

Download Submit
\Users\Admin\AppData\Local\Temp\nstE987.tmp\nsExec.dll
Filesize
6KB

MD5
acc2b699edfea5bf5aae45aba3a41e96

SHA1
d2accf4d494e43ceb2cff69abe4dd17147d29cc2

SHA256
168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e

SHA512
e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe

Download Submit
\Users\Admin\AppData\Local\Temp\nstE987.tmp\nsExec.dll
Filesize
6KB

MD5
acc2b699edfea5bf5aae45aba3a41e96

SHA1
d2accf4d494e43ceb2cff69abe4dd17147d29cc2

SHA256
168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e

SHA512
e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe

Download Submit
\Users\Admin\AppData\Local\Temp\nstE987.tmp\nsExec.dll
Filesize
6KB

MD5
acc2b699edfea5bf5aae45aba3a41e96

SHA1
d2accf4d494e43ceb2cff69abe4dd17147d29cc2

SHA256
168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e

SHA512
e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe

Download Submit
\Users\Admin\AppData\Local\Temp\nstE987.tmp\nsExec.dll
Filesize
6KB

MD5
acc2b699edfea5bf5aae45aba3a41e96

SHA1
d2accf4d494e43ceb2cff69abe4dd17147d29cc2

SHA256
168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e

SHA512
e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe

Download Submit
\Windows\SysWOW64\hfnapi.dll
Filesize
106KB

MD5
d6cff7f5fa1ee4d0246ea78033ee5ed5

SHA1
ad719d4cd9e1777c61c67f2c7dac033fcf253bd5

SHA256
f1de79860a75546a01554bb4d06b677cf5b6656b14864eb4192bbc740c6b2cdf

SHA512
743be51e34204a17a391df3a092b335a5054a170807f1bd2f8dad614ca9a761b943ffcd516e21021e14d87cd8ff9139e0671fa894840ca25dfd4d253d329832c

Download Submit
\Windows\SysWOW64\hfnapi.dll
Filesize
106KB

MD5
d6cff7f5fa1ee4d0246ea78033ee5ed5

SHA1
ad719d4cd9e1777c61c67f2c7dac033fcf253bd5

SHA256
f1de79860a75546a01554bb4d06b677cf5b6656b14864eb4192bbc740c6b2cdf

SHA512
743be51e34204a17a391df3a092b335a5054a170807f1bd2f8dad614ca9a761b943ffcd516e21021e14d87cd8ff9139e0671fa894840ca25dfd4d253d329832c

Download Submit
\Windows\SysWOW64\hfnapi.dll
Filesize
106KB

MD5
d6cff7f5fa1ee4d0246ea78033ee5ed5

SHA1
ad719d4cd9e1777c61c67f2c7dac033fcf253bd5

SHA256
f1de79860a75546a01554bb4d06b677cf5b6656b14864eb4192bbc740c6b2cdf

SHA512
743be51e34204a17a391df3a092b335a5054a170807f1bd2f8dad614ca9a761b943ffcd516e21021e14d87cd8ff9139e0671fa894840ca25dfd4d253d329832c

Download Submit
\Windows\SysWOW64\hfpapi.dll
Filesize
241KB

MD5
24efffb9a82312cce0ac46fa3071532b

SHA1
d48481329986dd591a89e64e2cbd370f5e9c0d19

SHA256
2175c2d45b6f50406691f014a4dfac52642c460e5f0d463dea78e366337f9149

SHA512
c6ca0cbfd054826606e513b6d67918f9dc141b0152b916c0c711d47c0ba2ccece3a4bead32f6ff081ff32db6d1d34df482f21a509a8fb673b770f4b768e3048e

Download Submit
\Windows\SysWOW64\hfpapi.dll
Filesize
241KB

MD5
24efffb9a82312cce0ac46fa3071532b

SHA1
d48481329986dd591a89e64e2cbd370f5e9c0d19

SHA256
2175c2d45b6f50406691f014a4dfac52642c460e5f0d463dea78e366337f9149

SHA512
c6ca0cbfd054826606e513b6d67918f9dc141b0152b916c0c711d47c0ba2ccece3a4bead32f6ff081ff32db6d1d34df482f21a509a8fb673b770f4b768e3048e

Download Submit
\Windows\SysWOW64\installd.exe
Filesize
108KB

MD5
7e2198dc26d52ef543257625b70a09c9

SHA1
add1a4d5b8639b60650d8a06d42df0b5f54fe57e

SHA256
7a1f86939ecf61fcdf38b280773b340b4daf12df563721308fa136748172bde3

SHA512
bf0d8e02b795c697cc262d4950a773323f495ae602ca821ebdbd9a824d97cf39889eb8a2447e8e6b97ce4f5476b0495470ca1fae47d6a3a3d0036287a8578201

Download Submit
\Windows\SysWOW64\nethtsrv.exe
Filesize
176KB

MD5
0e440b580b36f1d40e6220ed110aff59

SHA1
af52a48f92c6f25b818679da9d6a4a8daeb2f60a

SHA256
64f34b546160918660806c5156225b6e787c127613b4fb807c5c480fc647fa95

SHA512
0a30db3b6aea7d8bce1e7def7fa3a4cbde0e2bb806ef79f43f2d5fc54bf32385ab0683d2dfbd536e50cb4189dbe92d54ba47f6755747d2817ea2b6a72be6382d

Download Submit
\Windows\SysWOW64\netupdsrv.exe
Filesize
158KB

MD5
bc484acb363eaaedb4fbcb330565f183

SHA1
360f28d7293b779714183d621bfb48123842155a

SHA256
b971c593df06253fbdeb5115bbf8239528ab5d8c0367f67ea1fa5036ea97735a

SHA512
7ec58244a4584ebbf17afe1ca02eb36d96dccb4bccea5fb3b75951f43c2472635659e7d35876d7200a24ecedab96618c2b1fff958a9eec109c346586a987a5cc

Download Submit
memory/272-80-0x0000000000000000-mapping.dmp

Download
memory/552-70-0x0000000000000000-mapping.dmp

Download
memory/584-59-0x0000000000000000-mapping.dmp

Download
memory/620-87-0x0000000000000000-mapping.dmp

Download
memory/684-58-0x0000000000000000-mapping.dmp

Download
memory/772-76-0x0000000000000000-mapping.dmp

Download
memory/788-61-0x0000000000000000-mapping.dmp

Download
memory/1280-81-0x0000000000000000-mapping.dmp

Download
memory/1292-62-0x0000000000000000-mapping.dmp

Download
memory/1296-64-0x0000000000000000-mapping.dmp

Download
memory/1352-86-0x0000000000000000-mapping.dmp

Download
memory/1656-54-0x0000000075F61000-0x0000000075F63000-memory.dmp

Filesize
8KB

Download
memory/1656-57-0x0000000000360000-0x00000000007BE000-memory.dmp

Filesize
4.4MB

Download
memory/1656-90-0x0000000000360000-0x00000000007BE000-memory.dmp

Filesize
4.4MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads