29eedf373e4b7ef7f34b387edf1c5cfa861b665ac566de53489ae228d8c97186

Analysis

max time kernel
43s
max time network
49s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
23-11-2022 10:30

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

29eedf373e4b7ef7f34b387edf1c5cfa861b665ac566de53489ae228d8c97186.exe
Size

602KB
MD5

c90a3e394098e79a1faf0ed729b06e02
SHA1

35fa096daa28d1d99b93a1478bfb0e3689218d8c
SHA256

29eedf373e4b7ef7f34b387edf1c5cfa861b665ac566de53489ae228d8c97186
SHA512

cf276517ab23d5a0fa938616adb7378eb28042cff48893517fc928e7a2cb6a29d53d30d49da5652fed9802241b0e5c929bec0aed79dc653db9adca5eed733272
SSDEEP

12288:lIny5DYTuo4jPCDAxU5gRMpeojQ623YObxOYBUx9JQajAmW+Pq+fkmhor8x:RUTuXjKejMpjQxYCxoXhqPn8

Score

8^/10

discovery

Malware Config

Signatures

Drops file in Drivers directory 1 IoCs

Processes:

29eedf373e4b7ef7f34b387edf1c5cfa861b665ac566de53489ae228d8c97186.exe

description ioc process

File created C:\Windows\system32\drivers\nethfdrv.sys 29eedf373e4b7ef7f34b387edf1c5cfa861b665ac566de53489ae228d8c97186.exe
Executes dropped EXE 5 IoCs

Processes:

installd.exenethtsrv.exenetupdsrv.exenethtsrv.exenetupdsrv.exe

pid process

1444 installd.exe
592 nethtsrv.exe
1508 netupdsrv.exe
392 nethtsrv.exe
1548 netupdsrv.exe

description	ioc	process
File created	C:\Windows\system32\drivers\nethfdrv.sys	29eedf373e4b7ef7f34b387edf1c5cfa861b665ac566de53489ae228d8c97186.exe

pid	process
1444	installd.exe
592	nethtsrv.exe
1508	netupdsrv.exe
392	nethtsrv.exe
1548	netupdsrv.exe

Loads dropped DLL 13 IoCs

Processes:

29eedf373e4b7ef7f34b387edf1c5cfa861b665ac566de53489ae228d8c97186.exeinstalld.exenethtsrv.exenethtsrv.exe

pid	process
1104	29eedf373e4b7ef7f34b387edf1c5cfa861b665ac566de53489ae228d8c97186.exe
1104	29eedf373e4b7ef7f34b387edf1c5cfa861b665ac566de53489ae228d8c97186.exe
1104	29eedf373e4b7ef7f34b387edf1c5cfa861b665ac566de53489ae228d8c97186.exe
1104	29eedf373e4b7ef7f34b387edf1c5cfa861b665ac566de53489ae228d8c97186.exe
1444	installd.exe
1104	29eedf373e4b7ef7f34b387edf1c5cfa861b665ac566de53489ae228d8c97186.exe
592	nethtsrv.exe
592	nethtsrv.exe
1104	29eedf373e4b7ef7f34b387edf1c5cfa861b665ac566de53489ae228d8c97186.exe
1104	29eedf373e4b7ef7f34b387edf1c5cfa861b665ac566de53489ae228d8c97186.exe
392	nethtsrv.exe
392	nethtsrv.exe
1104	29eedf373e4b7ef7f34b387edf1c5cfa861b665ac566de53489ae228d8c97186.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in System32 directory 5 IoCs

Processes:

29eedf373e4b7ef7f34b387edf1c5cfa861b665ac566de53489ae228d8c97186.exe

description	ioc	process
File created	C:\Windows\SysWOW64\installd.exe	29eedf373e4b7ef7f34b387edf1c5cfa861b665ac566de53489ae228d8c97186.exe
File created	C:\Windows\SysWOW64\nethtsrv.exe	29eedf373e4b7ef7f34b387edf1c5cfa861b665ac566de53489ae228d8c97186.exe
File created	C:\Windows\SysWOW64\netupdsrv.exe	29eedf373e4b7ef7f34b387edf1c5cfa861b665ac566de53489ae228d8c97186.exe
File created	C:\Windows\SysWOW64\hfnapi.dll	29eedf373e4b7ef7f34b387edf1c5cfa861b665ac566de53489ae228d8c97186.exe
File created	C:\Windows\SysWOW64\hfpapi.dll	29eedf373e4b7ef7f34b387edf1c5cfa861b665ac566de53489ae228d8c97186.exe

Drops file in Program Files directory 3 IoCs

Processes:

29eedf373e4b7ef7f34b387edf1c5cfa861b665ac566de53489ae228d8c97186.exe

description	ioc	process
File created	C:\Program Files (x86)\Common Files\config\uninstinethnfd.exe	29eedf373e4b7ef7f34b387edf1c5cfa861b665ac566de53489ae228d8c97186.exe
File created	C:\Program Files (x86)\Common Files\Config\data.xml	29eedf373e4b7ef7f34b387edf1c5cfa861b665ac566de53489ae228d8c97186.exe
File created	C:\Program Files (x86)\Common Files\Config\ver.xml	29eedf373e4b7ef7f34b387edf1c5cfa861b665ac566de53489ae228d8c97186.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Runs net.exe
Suspicious behavior: LoadsDriver 1 IoCs

Processes:

pid process

464
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

nethtsrv.exe

description pid process

Token: SeDebugPrivilege 392 nethtsrv.exe

pid	process
464

description	pid	process
Token: SeDebugPrivilege	392	nethtsrv.exe

Suspicious use of WriteProcessMemory 50 IoCs

Processes:

29eedf373e4b7ef7f34b387edf1c5cfa861b665ac566de53489ae228d8c97186.exenet.exenet.exenet.exenet.exe

description	pid	process	target process
PID 1104 wrote to memory of 1960	1104	29eedf373e4b7ef7f34b387edf1c5cfa861b665ac566de53489ae228d8c97186.exe	net.exe
PID 1104 wrote to memory of 1960	1104	29eedf373e4b7ef7f34b387edf1c5cfa861b665ac566de53489ae228d8c97186.exe	net.exe
PID 1104 wrote to memory of 1960	1104	29eedf373e4b7ef7f34b387edf1c5cfa861b665ac566de53489ae228d8c97186.exe	net.exe
PID 1104 wrote to memory of 1960	1104	29eedf373e4b7ef7f34b387edf1c5cfa861b665ac566de53489ae228d8c97186.exe	net.exe
PID 1960 wrote to memory of 1372	1960	net.exe	net1.exe
PID 1960 wrote to memory of 1372	1960	net.exe	net1.exe
PID 1960 wrote to memory of 1372	1960	net.exe	net1.exe
PID 1960 wrote to memory of 1372	1960	net.exe	net1.exe
PID 1104 wrote to memory of 1088	1104	29eedf373e4b7ef7f34b387edf1c5cfa861b665ac566de53489ae228d8c97186.exe	net.exe
PID 1104 wrote to memory of 1088	1104	29eedf373e4b7ef7f34b387edf1c5cfa861b665ac566de53489ae228d8c97186.exe	net.exe
PID 1104 wrote to memory of 1088	1104	29eedf373e4b7ef7f34b387edf1c5cfa861b665ac566de53489ae228d8c97186.exe	net.exe
PID 1104 wrote to memory of 1088	1104	29eedf373e4b7ef7f34b387edf1c5cfa861b665ac566de53489ae228d8c97186.exe	net.exe
PID 1088 wrote to memory of 856	1088	net.exe	net1.exe
PID 1088 wrote to memory of 856	1088	net.exe	net1.exe
PID 1088 wrote to memory of 856	1088	net.exe	net1.exe
PID 1088 wrote to memory of 856	1088	net.exe	net1.exe
PID 1104 wrote to memory of 1444	1104	29eedf373e4b7ef7f34b387edf1c5cfa861b665ac566de53489ae228d8c97186.exe	installd.exe
PID 1104 wrote to memory of 1444	1104	29eedf373e4b7ef7f34b387edf1c5cfa861b665ac566de53489ae228d8c97186.exe	installd.exe
PID 1104 wrote to memory of 1444	1104	29eedf373e4b7ef7f34b387edf1c5cfa861b665ac566de53489ae228d8c97186.exe	installd.exe
PID 1104 wrote to memory of 1444	1104	29eedf373e4b7ef7f34b387edf1c5cfa861b665ac566de53489ae228d8c97186.exe	installd.exe
PID 1104 wrote to memory of 1444	1104	29eedf373e4b7ef7f34b387edf1c5cfa861b665ac566de53489ae228d8c97186.exe	installd.exe
PID 1104 wrote to memory of 1444	1104	29eedf373e4b7ef7f34b387edf1c5cfa861b665ac566de53489ae228d8c97186.exe	installd.exe
PID 1104 wrote to memory of 1444	1104	29eedf373e4b7ef7f34b387edf1c5cfa861b665ac566de53489ae228d8c97186.exe	installd.exe
PID 1104 wrote to memory of 592	1104	29eedf373e4b7ef7f34b387edf1c5cfa861b665ac566de53489ae228d8c97186.exe	nethtsrv.exe
PID 1104 wrote to memory of 592	1104	29eedf373e4b7ef7f34b387edf1c5cfa861b665ac566de53489ae228d8c97186.exe	nethtsrv.exe
PID 1104 wrote to memory of 592	1104	29eedf373e4b7ef7f34b387edf1c5cfa861b665ac566de53489ae228d8c97186.exe	nethtsrv.exe
PID 1104 wrote to memory of 592	1104	29eedf373e4b7ef7f34b387edf1c5cfa861b665ac566de53489ae228d8c97186.exe	nethtsrv.exe
PID 1104 wrote to memory of 1508	1104	29eedf373e4b7ef7f34b387edf1c5cfa861b665ac566de53489ae228d8c97186.exe	netupdsrv.exe
PID 1104 wrote to memory of 1508	1104	29eedf373e4b7ef7f34b387edf1c5cfa861b665ac566de53489ae228d8c97186.exe	netupdsrv.exe
PID 1104 wrote to memory of 1508	1104	29eedf373e4b7ef7f34b387edf1c5cfa861b665ac566de53489ae228d8c97186.exe	netupdsrv.exe
PID 1104 wrote to memory of 1508	1104	29eedf373e4b7ef7f34b387edf1c5cfa861b665ac566de53489ae228d8c97186.exe	netupdsrv.exe
PID 1104 wrote to memory of 1508	1104	29eedf373e4b7ef7f34b387edf1c5cfa861b665ac566de53489ae228d8c97186.exe	netupdsrv.exe
PID 1104 wrote to memory of 1508	1104	29eedf373e4b7ef7f34b387edf1c5cfa861b665ac566de53489ae228d8c97186.exe	netupdsrv.exe
PID 1104 wrote to memory of 1508	1104	29eedf373e4b7ef7f34b387edf1c5cfa861b665ac566de53489ae228d8c97186.exe	netupdsrv.exe
PID 1104 wrote to memory of 2040	1104	29eedf373e4b7ef7f34b387edf1c5cfa861b665ac566de53489ae228d8c97186.exe	net.exe
PID 1104 wrote to memory of 2040	1104	29eedf373e4b7ef7f34b387edf1c5cfa861b665ac566de53489ae228d8c97186.exe	net.exe
PID 1104 wrote to memory of 2040	1104	29eedf373e4b7ef7f34b387edf1c5cfa861b665ac566de53489ae228d8c97186.exe	net.exe
PID 1104 wrote to memory of 2040	1104	29eedf373e4b7ef7f34b387edf1c5cfa861b665ac566de53489ae228d8c97186.exe	net.exe
PID 2040 wrote to memory of 1764	2040	net.exe	net1.exe
PID 2040 wrote to memory of 1764	2040	net.exe	net1.exe
PID 2040 wrote to memory of 1764	2040	net.exe	net1.exe
PID 2040 wrote to memory of 1764	2040	net.exe	net1.exe
PID 1104 wrote to memory of 1924	1104	29eedf373e4b7ef7f34b387edf1c5cfa861b665ac566de53489ae228d8c97186.exe	net.exe
PID 1104 wrote to memory of 1924	1104	29eedf373e4b7ef7f34b387edf1c5cfa861b665ac566de53489ae228d8c97186.exe	net.exe
PID 1104 wrote to memory of 1924	1104	29eedf373e4b7ef7f34b387edf1c5cfa861b665ac566de53489ae228d8c97186.exe	net.exe
PID 1104 wrote to memory of 1924	1104	29eedf373e4b7ef7f34b387edf1c5cfa861b665ac566de53489ae228d8c97186.exe	net.exe
PID 1924 wrote to memory of 1048	1924	net.exe	net1.exe
PID 1924 wrote to memory of 1048	1924	net.exe	net1.exe
PID 1924 wrote to memory of 1048	1924	net.exe	net1.exe
PID 1924 wrote to memory of 1048	1924	net.exe	net1.exe

C:\Users\Admin\AppData\Local\Temp\29eedf373e4b7ef7f34b387edf1c5cfa861b665ac566de53489ae228d8c97186.exe
"C:\Users\Admin\AppData\Local\Temp\29eedf373e4b7ef7f34b387edf1c5cfa861b665ac566de53489ae228d8c97186.exe"
1⤵
- Drops file in Drivers directory
- Loads dropped DLL
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:1104

C:\Windows\SysWOW64\net.exe
net stop nethttpservice
2⤵
- Suspicious use of WriteProcessMemory
PID:1960

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop nethttpservice
3⤵
PID:1372

C:\Windows\SysWOW64\net.exe
net stop serviceupdater
2⤵
- Suspicious use of WriteProcessMemory
PID:1088

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop serviceupdater
3⤵
PID:856

C:\Windows\SysWOW64\installd.exe
"C:\Windows\system32\installd.exe" nethfdrv
2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1444

C:\Windows\SysWOW64\nethtsrv.exe
"C:\Windows\system32\nethtsrv.exe" -nfdi
2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:592

C:\Windows\SysWOW64\netupdsrv.exe
"C:\Windows\system32\netupdsrv.exe" -nfdi
2⤵
- Executes dropped EXE
PID:1508

C:\Windows\SysWOW64\net.exe
net start nethttpservice
2⤵
- Suspicious use of WriteProcessMemory
PID:2040

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 start nethttpservice
3⤵
PID:1764

C:\Windows\SysWOW64\net.exe
net start serviceupdater
2⤵
- Suspicious use of WriteProcessMemory
PID:1924

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 start serviceupdater
3⤵
PID:1048

C:\Windows\SysWOW64\nethtsrv.exe
C:\Windows\SysWOW64\nethtsrv.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:392

C:\Windows\SysWOW64\netupdsrv.exe
C:\Windows\SysWOW64\netupdsrv.exe
1⤵
- Executes dropped EXE
PID:1548

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\hfnapi.dll
Filesize
106KB

MD5
a91957403136f8aa5564bf1594430d76

SHA1
1b9124cbfeb96224347f2df5eefbe46eb862bac5

SHA256
0a71172b680b5dc31a5a9f5792106a96d63cd4d88bc4196fa5ad1ce5de6c8fe4

SHA512
d01cca722a3ec81a3a907e8868d3216a3b038ea5d3b62bcfcb570f99fbc421a61617c2ff2c647c0b378a22341d55755ad4eacaf7f80e265cd205e7ad72e80cb8

Download Submit
C:\Windows\SysWOW64\hfpapi.dll
Filesize
241KB

MD5
f1f207e46d4c9b25db094afd0f9800cb

SHA1
47469393017c95e938fcfd658938458c5e9d11d4

SHA256
848ff91add26ebcff47f91f2f31dfcc384a4ad8ab9fe8f6da508992519249bd5

SHA512
6bcd00008be6933daf8e3c53b6a22e988105d970283055ca4e51d012ae25280831a0b3e9ded3225da5ce6c614ff314b0276199db825dcd6838a0fdb843284f1a

Download Submit
C:\Windows\SysWOW64\installd.exe
Filesize
108KB

MD5
a67f082e54462f02e5dcf426974c1b7c

SHA1
84d48850684ff7fc7bef10ce2d4ede9a20d0fb08

SHA256
366e3898b46dedc0773030846dcaf95794136d94ba151468225393216703e7ec

SHA512
83bc549449ab2c60e6204ba02b95aab7f0fc3be193bde60b19c4b7a5651d4c3198ea169923685e7b13ec9134293733719f7fedf3c576f9dcc9fa3b817ac6d0f9

Download Submit
C:\Windows\SysWOW64\nethtsrv.exe
Filesize
176KB

MD5
90d35c71f35810fd25980482b5353be8

SHA1
b155d91f0c46c429f98c728ce997b6ddc94bbe33

SHA256
c9b46b499a6262cac9abd90001b9bb82ad4ec03c7260704946c45f1b656b1457

SHA512
0357218cc64b68cc249fd89a0fe2ae5c897e20237b9e2c0a791cd5c09070bbfeed8c6e13de5e09af7e762bbab690670c9791a1b6894844949010c731c11ea4dc

Download Submit
C:\Windows\SysWOW64\nethtsrv.exe
Filesize
176KB

MD5
90d35c71f35810fd25980482b5353be8

SHA1
b155d91f0c46c429f98c728ce997b6ddc94bbe33

SHA256
c9b46b499a6262cac9abd90001b9bb82ad4ec03c7260704946c45f1b656b1457

SHA512
0357218cc64b68cc249fd89a0fe2ae5c897e20237b9e2c0a791cd5c09070bbfeed8c6e13de5e09af7e762bbab690670c9791a1b6894844949010c731c11ea4dc

Download Submit
C:\Windows\SysWOW64\netupdsrv.exe
Filesize
158KB

MD5
65e13f4330676baec179858d53f2df27

SHA1
92c423ab111cd1b28ef237e877dfd3f9ef36b025

SHA256
69c030d86a1cbde6780186545b65a5ae5c7d3962855cb21dfdccdb89fd58ed75

SHA512
43bf2135ad2e9f0a5c423ec787b305adeb8088c1e318848e54c42c185c244c6c14f01a9e01e96bbf02045ec0ecaed391f9687ced37f5e75c62164b3547eb7eee

Download Submit
C:\Windows\SysWOW64\netupdsrv.exe
Filesize
158KB

MD5
65e13f4330676baec179858d53f2df27

SHA1
92c423ab111cd1b28ef237e877dfd3f9ef36b025

SHA256
69c030d86a1cbde6780186545b65a5ae5c7d3962855cb21dfdccdb89fd58ed75

SHA512
43bf2135ad2e9f0a5c423ec787b305adeb8088c1e318848e54c42c185c244c6c14f01a9e01e96bbf02045ec0ecaed391f9687ced37f5e75c62164b3547eb7eee

Download Submit
\Users\Admin\AppData\Local\Temp\nsyB88.tmp\System.dll
Filesize
11KB

MD5
c17103ae9072a06da581dec998343fc1

SHA1
b72148c6bdfaada8b8c3f950e610ee7cf1da1f8d

SHA256
dc58d8ad81cacb0c1ed72e33bff8f23ea40b5252b5bb55d393a0903e6819ae2f

SHA512
d32a71aaef18e993f28096d536e41c4d016850721b31171513ce28bbd805a54fd290b7c3e9d935f72e676a1acfb4f0dcc89d95040a0dd29f2b6975855c18986f

Download Submit
\Users\Admin\AppData\Local\Temp\nsyB88.tmp\nsExec.dll
Filesize
6KB

MD5
acc2b699edfea5bf5aae45aba3a41e96

SHA1
d2accf4d494e43ceb2cff69abe4dd17147d29cc2

SHA256
168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e

SHA512
e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe

Download Submit
\Users\Admin\AppData\Local\Temp\nsyB88.tmp\nsExec.dll
Filesize
6KB

MD5
acc2b699edfea5bf5aae45aba3a41e96

SHA1
d2accf4d494e43ceb2cff69abe4dd17147d29cc2

SHA256
168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e

SHA512
e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe

Download Submit
\Users\Admin\AppData\Local\Temp\nsyB88.tmp\nsExec.dll
Filesize
6KB

MD5
acc2b699edfea5bf5aae45aba3a41e96

SHA1
d2accf4d494e43ceb2cff69abe4dd17147d29cc2

SHA256
168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e

SHA512
e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe

Download Submit
\Users\Admin\AppData\Local\Temp\nsyB88.tmp\nsExec.dll
Filesize
6KB

MD5
acc2b699edfea5bf5aae45aba3a41e96

SHA1
d2accf4d494e43ceb2cff69abe4dd17147d29cc2

SHA256
168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e

SHA512
e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe

Download Submit
\Windows\SysWOW64\hfnapi.dll
Filesize
106KB

MD5
a91957403136f8aa5564bf1594430d76

SHA1
1b9124cbfeb96224347f2df5eefbe46eb862bac5

SHA256
0a71172b680b5dc31a5a9f5792106a96d63cd4d88bc4196fa5ad1ce5de6c8fe4

SHA512
d01cca722a3ec81a3a907e8868d3216a3b038ea5d3b62bcfcb570f99fbc421a61617c2ff2c647c0b378a22341d55755ad4eacaf7f80e265cd205e7ad72e80cb8

Download Submit
\Windows\SysWOW64\hfnapi.dll
Filesize
106KB

MD5
a91957403136f8aa5564bf1594430d76

SHA1
1b9124cbfeb96224347f2df5eefbe46eb862bac5

SHA256
0a71172b680b5dc31a5a9f5792106a96d63cd4d88bc4196fa5ad1ce5de6c8fe4

SHA512
d01cca722a3ec81a3a907e8868d3216a3b038ea5d3b62bcfcb570f99fbc421a61617c2ff2c647c0b378a22341d55755ad4eacaf7f80e265cd205e7ad72e80cb8

Download Submit
\Windows\SysWOW64\hfnapi.dll
Filesize
106KB

MD5
a91957403136f8aa5564bf1594430d76

SHA1
1b9124cbfeb96224347f2df5eefbe46eb862bac5

SHA256
0a71172b680b5dc31a5a9f5792106a96d63cd4d88bc4196fa5ad1ce5de6c8fe4

SHA512
d01cca722a3ec81a3a907e8868d3216a3b038ea5d3b62bcfcb570f99fbc421a61617c2ff2c647c0b378a22341d55755ad4eacaf7f80e265cd205e7ad72e80cb8

Download Submit
\Windows\SysWOW64\hfpapi.dll
Filesize
241KB

MD5
f1f207e46d4c9b25db094afd0f9800cb

SHA1
47469393017c95e938fcfd658938458c5e9d11d4

SHA256
848ff91add26ebcff47f91f2f31dfcc384a4ad8ab9fe8f6da508992519249bd5

SHA512
6bcd00008be6933daf8e3c53b6a22e988105d970283055ca4e51d012ae25280831a0b3e9ded3225da5ce6c614ff314b0276199db825dcd6838a0fdb843284f1a

Download Submit
\Windows\SysWOW64\hfpapi.dll
Filesize
241KB

MD5
f1f207e46d4c9b25db094afd0f9800cb

SHA1
47469393017c95e938fcfd658938458c5e9d11d4

SHA256
848ff91add26ebcff47f91f2f31dfcc384a4ad8ab9fe8f6da508992519249bd5

SHA512
6bcd00008be6933daf8e3c53b6a22e988105d970283055ca4e51d012ae25280831a0b3e9ded3225da5ce6c614ff314b0276199db825dcd6838a0fdb843284f1a

Download Submit
\Windows\SysWOW64\installd.exe
Filesize
108KB

MD5
a67f082e54462f02e5dcf426974c1b7c

SHA1
84d48850684ff7fc7bef10ce2d4ede9a20d0fb08

SHA256
366e3898b46dedc0773030846dcaf95794136d94ba151468225393216703e7ec

SHA512
83bc549449ab2c60e6204ba02b95aab7f0fc3be193bde60b19c4b7a5651d4c3198ea169923685e7b13ec9134293733719f7fedf3c576f9dcc9fa3b817ac6d0f9

Download Submit
\Windows\SysWOW64\nethtsrv.exe
Filesize
176KB

MD5
90d35c71f35810fd25980482b5353be8

SHA1
b155d91f0c46c429f98c728ce997b6ddc94bbe33

SHA256
c9b46b499a6262cac9abd90001b9bb82ad4ec03c7260704946c45f1b656b1457

SHA512
0357218cc64b68cc249fd89a0fe2ae5c897e20237b9e2c0a791cd5c09070bbfeed8c6e13de5e09af7e762bbab690670c9791a1b6894844949010c731c11ea4dc

Download Submit
\Windows\SysWOW64\netupdsrv.exe
Filesize
158KB

MD5
65e13f4330676baec179858d53f2df27

SHA1
92c423ab111cd1b28ef237e877dfd3f9ef36b025

SHA256
69c030d86a1cbde6780186545b65a5ae5c7d3962855cb21dfdccdb89fd58ed75

SHA512
43bf2135ad2e9f0a5c423ec787b305adeb8088c1e318848e54c42c185c244c6c14f01a9e01e96bbf02045ec0ecaed391f9687ced37f5e75c62164b3547eb7eee

Download Submit
memory/592-70-0x0000000000000000-mapping.dmp

Download
memory/856-62-0x0000000000000000-mapping.dmp

Download
memory/1048-87-0x0000000000000000-mapping.dmp

Download
memory/1088-61-0x0000000000000000-mapping.dmp

Download
memory/1104-54-0x0000000075BB1000-0x0000000075BB3000-memory.dmp

Filesize
8KB

Download
memory/1104-59-0x0000000000360000-0x00000000007BE000-memory.dmp

Filesize
4.4MB

Download
memory/1104-90-0x0000000000360000-0x00000000007BE000-memory.dmp

Filesize
4.4MB

Download
memory/1372-58-0x0000000000000000-mapping.dmp

Download
memory/1444-64-0x0000000000000000-mapping.dmp

Download
memory/1508-76-0x0000000000000000-mapping.dmp

Download
memory/1764-81-0x0000000000000000-mapping.dmp

Download
memory/1924-86-0x0000000000000000-mapping.dmp

Download
memory/1960-57-0x0000000000000000-mapping.dmp

Download
memory/2040-80-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads