2900dec29c8e1bdef282b6c086a442722b9a6dec46576b8c53516da96f4b34c5

Analysis

max time kernel
46s
max time network
51s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
23-11-2022 10:30

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2900dec29c8e1bdef282b6c086a442722b9a6dec46576b8c53516da96f4b34c5.exe
Size

598KB
MD5

d000632e24934387d1789edca16bddce
SHA1

ca38373f53ac28c859cbc18d8b58089b06e7615d
SHA256

2900dec29c8e1bdef282b6c086a442722b9a6dec46576b8c53516da96f4b34c5
SHA512

432c64e3277894002e1ce058d33a4ed9ea67e8896c9dd544930af1e4556834199523eee74845caa0ff40b1119c2f9718bb76716ae096ccbee1eff6420161cf86
SSDEEP

12288:YIny5DYTPCRh6H5G9T+ZsRsQocZev31NCvoO+l8EBlAQUe:2UTPCCe3Joce31QzKZvt

Score

8^/10

discovery

Malware Config

Signatures

Drops file in Drivers directory 1 IoCs

Processes:

2900dec29c8e1bdef282b6c086a442722b9a6dec46576b8c53516da96f4b34c5.exe

description ioc process

File created C:\Windows\system32\drivers\nethfdrv.sys 2900dec29c8e1bdef282b6c086a442722b9a6dec46576b8c53516da96f4b34c5.exe
Executes dropped EXE 5 IoCs

Processes:

installd.exenethtsrv.exenetupdsrv.exenethtsrv.exenetupdsrv.exe

pid process

688 installd.exe
1388 nethtsrv.exe
1780 netupdsrv.exe
1816 nethtsrv.exe
1152 netupdsrv.exe

description	ioc	process
File created	C:\Windows\system32\drivers\nethfdrv.sys	2900dec29c8e1bdef282b6c086a442722b9a6dec46576b8c53516da96f4b34c5.exe

pid	process
688	installd.exe
1388	nethtsrv.exe
1780	netupdsrv.exe
1816	nethtsrv.exe
1152	netupdsrv.exe

Loads dropped DLL 13 IoCs

Processes:

2900dec29c8e1bdef282b6c086a442722b9a6dec46576b8c53516da96f4b34c5.exeinstalld.exenethtsrv.exenethtsrv.exe

pid	process
1308	2900dec29c8e1bdef282b6c086a442722b9a6dec46576b8c53516da96f4b34c5.exe
1308	2900dec29c8e1bdef282b6c086a442722b9a6dec46576b8c53516da96f4b34c5.exe
1308	2900dec29c8e1bdef282b6c086a442722b9a6dec46576b8c53516da96f4b34c5.exe
1308	2900dec29c8e1bdef282b6c086a442722b9a6dec46576b8c53516da96f4b34c5.exe
688	installd.exe
1308	2900dec29c8e1bdef282b6c086a442722b9a6dec46576b8c53516da96f4b34c5.exe
1388	nethtsrv.exe
1388	nethtsrv.exe
1308	2900dec29c8e1bdef282b6c086a442722b9a6dec46576b8c53516da96f4b34c5.exe
1308	2900dec29c8e1bdef282b6c086a442722b9a6dec46576b8c53516da96f4b34c5.exe
1816	nethtsrv.exe
1816	nethtsrv.exe
1308	2900dec29c8e1bdef282b6c086a442722b9a6dec46576b8c53516da96f4b34c5.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in System32 directory 5 IoCs

Processes:

2900dec29c8e1bdef282b6c086a442722b9a6dec46576b8c53516da96f4b34c5.exe

description	ioc	process
File created	C:\Windows\SysWOW64\nethtsrv.exe	2900dec29c8e1bdef282b6c086a442722b9a6dec46576b8c53516da96f4b34c5.exe
File created	C:\Windows\SysWOW64\netupdsrv.exe	2900dec29c8e1bdef282b6c086a442722b9a6dec46576b8c53516da96f4b34c5.exe
File created	C:\Windows\SysWOW64\hfnapi.dll	2900dec29c8e1bdef282b6c086a442722b9a6dec46576b8c53516da96f4b34c5.exe
File created	C:\Windows\SysWOW64\hfpapi.dll	2900dec29c8e1bdef282b6c086a442722b9a6dec46576b8c53516da96f4b34c5.exe
File created	C:\Windows\SysWOW64\installd.exe	2900dec29c8e1bdef282b6c086a442722b9a6dec46576b8c53516da96f4b34c5.exe

Drops file in Program Files directory 3 IoCs

Processes:

2900dec29c8e1bdef282b6c086a442722b9a6dec46576b8c53516da96f4b34c5.exe

description	ioc	process
File created	C:\Program Files (x86)\Common Files\Config\data.xml	2900dec29c8e1bdef282b6c086a442722b9a6dec46576b8c53516da96f4b34c5.exe
File created	C:\Program Files (x86)\Common Files\Config\ver.xml	2900dec29c8e1bdef282b6c086a442722b9a6dec46576b8c53516da96f4b34c5.exe
File created	C:\Program Files (x86)\Common Files\config\uninstinethnfd.exe	2900dec29c8e1bdef282b6c086a442722b9a6dec46576b8c53516da96f4b34c5.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Runs net.exe
Suspicious behavior: LoadsDriver 1 IoCs

Processes:

pid process

460
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

nethtsrv.exe

description pid process

Token: SeDebugPrivilege 1816 nethtsrv.exe

pid	process
460

description	pid	process
Token: SeDebugPrivilege	1816	nethtsrv.exe

Suspicious use of WriteProcessMemory 50 IoCs

Processes:

2900dec29c8e1bdef282b6c086a442722b9a6dec46576b8c53516da96f4b34c5.exenet.exenet.exenet.exenet.exe

description	pid	process	target process
PID 1308 wrote to memory of 112	1308	2900dec29c8e1bdef282b6c086a442722b9a6dec46576b8c53516da96f4b34c5.exe	net.exe
PID 1308 wrote to memory of 112	1308	2900dec29c8e1bdef282b6c086a442722b9a6dec46576b8c53516da96f4b34c5.exe	net.exe
PID 1308 wrote to memory of 112	1308	2900dec29c8e1bdef282b6c086a442722b9a6dec46576b8c53516da96f4b34c5.exe	net.exe
PID 1308 wrote to memory of 112	1308	2900dec29c8e1bdef282b6c086a442722b9a6dec46576b8c53516da96f4b34c5.exe	net.exe
PID 112 wrote to memory of 556	112	net.exe	net1.exe
PID 112 wrote to memory of 556	112	net.exe	net1.exe
PID 112 wrote to memory of 556	112	net.exe	net1.exe
PID 112 wrote to memory of 556	112	net.exe	net1.exe
PID 1308 wrote to memory of 916	1308	2900dec29c8e1bdef282b6c086a442722b9a6dec46576b8c53516da96f4b34c5.exe	net.exe
PID 1308 wrote to memory of 916	1308	2900dec29c8e1bdef282b6c086a442722b9a6dec46576b8c53516da96f4b34c5.exe	net.exe
PID 1308 wrote to memory of 916	1308	2900dec29c8e1bdef282b6c086a442722b9a6dec46576b8c53516da96f4b34c5.exe	net.exe
PID 1308 wrote to memory of 916	1308	2900dec29c8e1bdef282b6c086a442722b9a6dec46576b8c53516da96f4b34c5.exe	net.exe
PID 916 wrote to memory of 468	916	net.exe	net1.exe
PID 916 wrote to memory of 468	916	net.exe	net1.exe
PID 916 wrote to memory of 468	916	net.exe	net1.exe
PID 916 wrote to memory of 468	916	net.exe	net1.exe
PID 1308 wrote to memory of 688	1308	2900dec29c8e1bdef282b6c086a442722b9a6dec46576b8c53516da96f4b34c5.exe	installd.exe
PID 1308 wrote to memory of 688	1308	2900dec29c8e1bdef282b6c086a442722b9a6dec46576b8c53516da96f4b34c5.exe	installd.exe
PID 1308 wrote to memory of 688	1308	2900dec29c8e1bdef282b6c086a442722b9a6dec46576b8c53516da96f4b34c5.exe	installd.exe
PID 1308 wrote to memory of 688	1308	2900dec29c8e1bdef282b6c086a442722b9a6dec46576b8c53516da96f4b34c5.exe	installd.exe
PID 1308 wrote to memory of 688	1308	2900dec29c8e1bdef282b6c086a442722b9a6dec46576b8c53516da96f4b34c5.exe	installd.exe
PID 1308 wrote to memory of 688	1308	2900dec29c8e1bdef282b6c086a442722b9a6dec46576b8c53516da96f4b34c5.exe	installd.exe
PID 1308 wrote to memory of 688	1308	2900dec29c8e1bdef282b6c086a442722b9a6dec46576b8c53516da96f4b34c5.exe	installd.exe
PID 1308 wrote to memory of 1388	1308	2900dec29c8e1bdef282b6c086a442722b9a6dec46576b8c53516da96f4b34c5.exe	nethtsrv.exe
PID 1308 wrote to memory of 1388	1308	2900dec29c8e1bdef282b6c086a442722b9a6dec46576b8c53516da96f4b34c5.exe	nethtsrv.exe
PID 1308 wrote to memory of 1388	1308	2900dec29c8e1bdef282b6c086a442722b9a6dec46576b8c53516da96f4b34c5.exe	nethtsrv.exe
PID 1308 wrote to memory of 1388	1308	2900dec29c8e1bdef282b6c086a442722b9a6dec46576b8c53516da96f4b34c5.exe	nethtsrv.exe
PID 1308 wrote to memory of 1780	1308	2900dec29c8e1bdef282b6c086a442722b9a6dec46576b8c53516da96f4b34c5.exe	netupdsrv.exe
PID 1308 wrote to memory of 1780	1308	2900dec29c8e1bdef282b6c086a442722b9a6dec46576b8c53516da96f4b34c5.exe	netupdsrv.exe
PID 1308 wrote to memory of 1780	1308	2900dec29c8e1bdef282b6c086a442722b9a6dec46576b8c53516da96f4b34c5.exe	netupdsrv.exe
PID 1308 wrote to memory of 1780	1308	2900dec29c8e1bdef282b6c086a442722b9a6dec46576b8c53516da96f4b34c5.exe	netupdsrv.exe
PID 1308 wrote to memory of 1780	1308	2900dec29c8e1bdef282b6c086a442722b9a6dec46576b8c53516da96f4b34c5.exe	netupdsrv.exe
PID 1308 wrote to memory of 1780	1308	2900dec29c8e1bdef282b6c086a442722b9a6dec46576b8c53516da96f4b34c5.exe	netupdsrv.exe
PID 1308 wrote to memory of 1780	1308	2900dec29c8e1bdef282b6c086a442722b9a6dec46576b8c53516da96f4b34c5.exe	netupdsrv.exe
PID 1308 wrote to memory of 1932	1308	2900dec29c8e1bdef282b6c086a442722b9a6dec46576b8c53516da96f4b34c5.exe	net.exe
PID 1308 wrote to memory of 1932	1308	2900dec29c8e1bdef282b6c086a442722b9a6dec46576b8c53516da96f4b34c5.exe	net.exe
PID 1308 wrote to memory of 1932	1308	2900dec29c8e1bdef282b6c086a442722b9a6dec46576b8c53516da96f4b34c5.exe	net.exe
PID 1308 wrote to memory of 1932	1308	2900dec29c8e1bdef282b6c086a442722b9a6dec46576b8c53516da96f4b34c5.exe	net.exe
PID 1932 wrote to memory of 968	1932	net.exe	net1.exe
PID 1932 wrote to memory of 968	1932	net.exe	net1.exe
PID 1932 wrote to memory of 968	1932	net.exe	net1.exe
PID 1932 wrote to memory of 968	1932	net.exe	net1.exe
PID 1308 wrote to memory of 1276	1308	2900dec29c8e1bdef282b6c086a442722b9a6dec46576b8c53516da96f4b34c5.exe	net.exe
PID 1308 wrote to memory of 1276	1308	2900dec29c8e1bdef282b6c086a442722b9a6dec46576b8c53516da96f4b34c5.exe	net.exe
PID 1308 wrote to memory of 1276	1308	2900dec29c8e1bdef282b6c086a442722b9a6dec46576b8c53516da96f4b34c5.exe	net.exe
PID 1308 wrote to memory of 1276	1308	2900dec29c8e1bdef282b6c086a442722b9a6dec46576b8c53516da96f4b34c5.exe	net.exe
PID 1276 wrote to memory of 1508	1276	net.exe	net1.exe
PID 1276 wrote to memory of 1508	1276	net.exe	net1.exe
PID 1276 wrote to memory of 1508	1276	net.exe	net1.exe
PID 1276 wrote to memory of 1508	1276	net.exe	net1.exe

C:\Users\Admin\AppData\Local\Temp\2900dec29c8e1bdef282b6c086a442722b9a6dec46576b8c53516da96f4b34c5.exe
"C:\Users\Admin\AppData\Local\Temp\2900dec29c8e1bdef282b6c086a442722b9a6dec46576b8c53516da96f4b34c5.exe"
1⤵
- Drops file in Drivers directory
- Loads dropped DLL
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:1308

C:\Windows\SysWOW64\net.exe
net stop nethttpservice
2⤵
- Suspicious use of WriteProcessMemory
PID:112

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop nethttpservice
3⤵
PID:556

C:\Windows\SysWOW64\net.exe
net stop serviceupdater
2⤵
- Suspicious use of WriteProcessMemory
PID:916

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop serviceupdater
3⤵
PID:468

C:\Windows\SysWOW64\installd.exe
"C:\Windows\system32\installd.exe" nethfdrv
2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:688

C:\Windows\SysWOW64\nethtsrv.exe
"C:\Windows\system32\nethtsrv.exe" -nfdi
2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1388

C:\Windows\SysWOW64\netupdsrv.exe
"C:\Windows\system32\netupdsrv.exe" -nfdi
2⤵
- Executes dropped EXE
PID:1780

C:\Windows\SysWOW64\net.exe
net start nethttpservice
2⤵
- Suspicious use of WriteProcessMemory
PID:1932

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 start nethttpservice
3⤵
PID:968

C:\Windows\SysWOW64\net.exe
net start serviceupdater
2⤵
- Suspicious use of WriteProcessMemory
PID:1276

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 start serviceupdater
3⤵
PID:1508

C:\Windows\SysWOW64\nethtsrv.exe
C:\Windows\SysWOW64\nethtsrv.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:1816

C:\Windows\SysWOW64\netupdsrv.exe
C:\Windows\SysWOW64\netupdsrv.exe
1⤵
- Executes dropped EXE
PID:1152

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\hfnapi.dll
Filesize
106KB

MD5
86f40350178c2825893742fb08527420

SHA1
61e912da79215c77fe9709bd2271d50758939bcf

SHA256
0e9f830ad6838d424d70c8f2aa569d407cac8136fcc8aff91c4f5099912a6cf7

SHA512
43c8130d2c238ebf9a5c5ec053285cce64061484d610fbc6d269004c28f905bdf9c4e54eec43eae9ecd7870bebbdf0c22e709946868faef042c9ce5038ec44ef

Download Submit
C:\Windows\SysWOW64\hfpapi.dll
Filesize
241KB

MD5
c864877501a6f78f29a733b2d738886d

SHA1
8c5dc59292275195801a36e9fea06333df7384e1

SHA256
980ade3cdc415c38e3a6a5e10b49739e1f58abdff759a4676c27c6db41724cf0

SHA512
7daa99f68d3fde88299d5d0cfc31350bd9ecc3d9a1b8a030b08582f15bb8bc2ec2316b8b73c423cb61b46fb61a3311d05dd44367b8a82b697182765198737c8c

Download Submit
C:\Windows\SysWOW64\installd.exe
Filesize
108KB

MD5
88757db169a4adfa320781fbaf05c933

SHA1
e74d3e6debd1dd97a1bd62a27f469aaa08f5adf2

SHA256
6b07663868222a3f6d184165bf3f7cedcd625bcf3d18648fc8986b56290ca34b

SHA512
add52c6f5d1194fc2c5cf5724750bed7249910120dc1b64454f2c4a5392fb8c6c3324a712d1553c324f0193c965b89e5314f08d534abe0d97bb0d3a6c18e718f

Download Submit
C:\Windows\SysWOW64\nethtsrv.exe
Filesize
176KB

MD5
84d88eb5b215c081606e44213acbc104

SHA1
4f1c5874ab3ef3b67eed539568f9d8ae172d0515

SHA256
cd884256e1fcc0d66969ed991cf9f811bb66b2c5095763502986d22199a53a74

SHA512
683d4543ba926266616c085dd7b7a084919ab08016d4930e38bd3b70404dd7814ccf12d275930abb3868f01f9b8fdce8eaf1f79d5eae6de65c94c4b009190d9b

Download Submit
C:\Windows\SysWOW64\nethtsrv.exe
Filesize
176KB

MD5
84d88eb5b215c081606e44213acbc104

SHA1
4f1c5874ab3ef3b67eed539568f9d8ae172d0515

SHA256
cd884256e1fcc0d66969ed991cf9f811bb66b2c5095763502986d22199a53a74

SHA512
683d4543ba926266616c085dd7b7a084919ab08016d4930e38bd3b70404dd7814ccf12d275930abb3868f01f9b8fdce8eaf1f79d5eae6de65c94c4b009190d9b

Download Submit
C:\Windows\SysWOW64\netupdsrv.exe
Filesize
159KB

MD5
0137951765fbb85f13eb82d18d6eb978

SHA1
6c03ac83e177e36b5992048d462c81b89b3c04ce

SHA256
94ac2b9d67de5d852d80a5eb937ac1a3119d55dcff96d082c93b184fa3341420

SHA512
f5674a07daa0dff4bcae948e6eea2bfd3bb0c520613e697c001ea7ce8555970d9ecf1bca226095217e582e7de0b9d7b3ac5434a13087cd30d131746077e922f8

Download Submit
C:\Windows\SysWOW64\netupdsrv.exe
Filesize
159KB

MD5
0137951765fbb85f13eb82d18d6eb978

SHA1
6c03ac83e177e36b5992048d462c81b89b3c04ce

SHA256
94ac2b9d67de5d852d80a5eb937ac1a3119d55dcff96d082c93b184fa3341420

SHA512
f5674a07daa0dff4bcae948e6eea2bfd3bb0c520613e697c001ea7ce8555970d9ecf1bca226095217e582e7de0b9d7b3ac5434a13087cd30d131746077e922f8

Download Submit
\Users\Admin\AppData\Local\Temp\nsyA02.tmp\System.dll
Filesize
11KB

MD5
c17103ae9072a06da581dec998343fc1

SHA1
b72148c6bdfaada8b8c3f950e610ee7cf1da1f8d

SHA256
dc58d8ad81cacb0c1ed72e33bff8f23ea40b5252b5bb55d393a0903e6819ae2f

SHA512
d32a71aaef18e993f28096d536e41c4d016850721b31171513ce28bbd805a54fd290b7c3e9d935f72e676a1acfb4f0dcc89d95040a0dd29f2b6975855c18986f

Download Submit
\Users\Admin\AppData\Local\Temp\nsyA02.tmp\nsExec.dll
Filesize
6KB

MD5
acc2b699edfea5bf5aae45aba3a41e96

SHA1
d2accf4d494e43ceb2cff69abe4dd17147d29cc2

SHA256
168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e

SHA512
e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe

Download Submit
\Users\Admin\AppData\Local\Temp\nsyA02.tmp\nsExec.dll
Filesize
6KB

MD5
acc2b699edfea5bf5aae45aba3a41e96

SHA1
d2accf4d494e43ceb2cff69abe4dd17147d29cc2

SHA256
168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e

SHA512
e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe

Download Submit
\Users\Admin\AppData\Local\Temp\nsyA02.tmp\nsExec.dll
Filesize
6KB

MD5
acc2b699edfea5bf5aae45aba3a41e96

SHA1
d2accf4d494e43ceb2cff69abe4dd17147d29cc2

SHA256
168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e

SHA512
e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe

Download Submit
\Users\Admin\AppData\Local\Temp\nsyA02.tmp\nsExec.dll
Filesize
6KB

MD5
acc2b699edfea5bf5aae45aba3a41e96

SHA1
d2accf4d494e43ceb2cff69abe4dd17147d29cc2

SHA256
168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e

SHA512
e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe

Download Submit
\Windows\SysWOW64\hfnapi.dll
Filesize
106KB

MD5
86f40350178c2825893742fb08527420

SHA1
61e912da79215c77fe9709bd2271d50758939bcf

SHA256
0e9f830ad6838d424d70c8f2aa569d407cac8136fcc8aff91c4f5099912a6cf7

SHA512
43c8130d2c238ebf9a5c5ec053285cce64061484d610fbc6d269004c28f905bdf9c4e54eec43eae9ecd7870bebbdf0c22e709946868faef042c9ce5038ec44ef

Download Submit
\Windows\SysWOW64\hfnapi.dll
Filesize
106KB

MD5
86f40350178c2825893742fb08527420

SHA1
61e912da79215c77fe9709bd2271d50758939bcf

SHA256
0e9f830ad6838d424d70c8f2aa569d407cac8136fcc8aff91c4f5099912a6cf7

SHA512
43c8130d2c238ebf9a5c5ec053285cce64061484d610fbc6d269004c28f905bdf9c4e54eec43eae9ecd7870bebbdf0c22e709946868faef042c9ce5038ec44ef

Download Submit
\Windows\SysWOW64\hfnapi.dll
Filesize
106KB

MD5
86f40350178c2825893742fb08527420

SHA1
61e912da79215c77fe9709bd2271d50758939bcf

SHA256
0e9f830ad6838d424d70c8f2aa569d407cac8136fcc8aff91c4f5099912a6cf7

SHA512
43c8130d2c238ebf9a5c5ec053285cce64061484d610fbc6d269004c28f905bdf9c4e54eec43eae9ecd7870bebbdf0c22e709946868faef042c9ce5038ec44ef

Download Submit
\Windows\SysWOW64\hfpapi.dll
Filesize
241KB

MD5
c864877501a6f78f29a733b2d738886d

SHA1
8c5dc59292275195801a36e9fea06333df7384e1

SHA256
980ade3cdc415c38e3a6a5e10b49739e1f58abdff759a4676c27c6db41724cf0

SHA512
7daa99f68d3fde88299d5d0cfc31350bd9ecc3d9a1b8a030b08582f15bb8bc2ec2316b8b73c423cb61b46fb61a3311d05dd44367b8a82b697182765198737c8c

Download Submit
\Windows\SysWOW64\hfpapi.dll
Filesize
241KB

MD5
c864877501a6f78f29a733b2d738886d

SHA1
8c5dc59292275195801a36e9fea06333df7384e1

SHA256
980ade3cdc415c38e3a6a5e10b49739e1f58abdff759a4676c27c6db41724cf0

SHA512
7daa99f68d3fde88299d5d0cfc31350bd9ecc3d9a1b8a030b08582f15bb8bc2ec2316b8b73c423cb61b46fb61a3311d05dd44367b8a82b697182765198737c8c

Download Submit
\Windows\SysWOW64\installd.exe
Filesize
108KB

MD5
88757db169a4adfa320781fbaf05c933

SHA1
e74d3e6debd1dd97a1bd62a27f469aaa08f5adf2

SHA256
6b07663868222a3f6d184165bf3f7cedcd625bcf3d18648fc8986b56290ca34b

SHA512
add52c6f5d1194fc2c5cf5724750bed7249910120dc1b64454f2c4a5392fb8c6c3324a712d1553c324f0193c965b89e5314f08d534abe0d97bb0d3a6c18e718f

Download Submit
\Windows\SysWOW64\nethtsrv.exe
Filesize
176KB

MD5
84d88eb5b215c081606e44213acbc104

SHA1
4f1c5874ab3ef3b67eed539568f9d8ae172d0515

SHA256
cd884256e1fcc0d66969ed991cf9f811bb66b2c5095763502986d22199a53a74

SHA512
683d4543ba926266616c085dd7b7a084919ab08016d4930e38bd3b70404dd7814ccf12d275930abb3868f01f9b8fdce8eaf1f79d5eae6de65c94c4b009190d9b

Download Submit
\Windows\SysWOW64\netupdsrv.exe
Filesize
159KB

MD5
0137951765fbb85f13eb82d18d6eb978

SHA1
6c03ac83e177e36b5992048d462c81b89b3c04ce

SHA256
94ac2b9d67de5d852d80a5eb937ac1a3119d55dcff96d082c93b184fa3341420

SHA512
f5674a07daa0dff4bcae948e6eea2bfd3bb0c520613e697c001ea7ce8555970d9ecf1bca226095217e582e7de0b9d7b3ac5434a13087cd30d131746077e922f8

Download Submit
memory/112-58-0x0000000000000000-mapping.dmp

Download
memory/468-62-0x0000000000000000-mapping.dmp

Download
memory/556-59-0x0000000000000000-mapping.dmp

Download
memory/688-64-0x0000000000000000-mapping.dmp

Download
memory/916-61-0x0000000000000000-mapping.dmp

Download
memory/968-81-0x0000000000000000-mapping.dmp

Download
memory/1276-86-0x0000000000000000-mapping.dmp

Download
memory/1308-54-0x0000000074DA1000-0x0000000074DA3000-memory.dmp

Filesize
8KB

Download
memory/1308-55-0x0000000000360000-0x00000000007BE000-memory.dmp

Filesize
4.4MB

Download
memory/1308-90-0x0000000000360000-0x00000000007BE000-memory.dmp

Filesize
4.4MB

Download
memory/1388-70-0x0000000000000000-mapping.dmp

Download
memory/1508-87-0x0000000000000000-mapping.dmp

Download
memory/1780-76-0x0000000000000000-mapping.dmp

Download
memory/1932-80-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads