36a8f18fa307b17bc0c35d5887af57de89e80861aadae4f85bc5402b3671f873

Analysis

max time kernel
28s
max time network
46s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
23-11-2022 10:29

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

36a8f18fa307b17bc0c35d5887af57de89e80861aadae4f85bc5402b3671f873.exe
Size

602KB
MD5

6d69ddefc24c59625292bbccb4b9e822
SHA1

44f07795ddc6fc8c330f2755525448e1c77b7570
SHA256

36a8f18fa307b17bc0c35d5887af57de89e80861aadae4f85bc5402b3671f873
SHA512

c6d356f0c75a31462d47e7e819c20a3b7b5a250adfac6d4490f4b2c9f391e5b2beeeeafe02594f9f7a08758e055fce3a7555937db01bdfb8e5696314f831b6f5
SSDEEP

12288:AIny5DYTSI2nhwMM81VQSuvTd0UK8Fi7ahMFBtQeE8AH:+UTSBnhwf8HbuvTdXKIi71tQePAH

Score

8^/10

discovery

Malware Config

Signatures

Drops file in Drivers directory 1 IoCs

Processes:

36a8f18fa307b17bc0c35d5887af57de89e80861aadae4f85bc5402b3671f873.exe

description ioc process

File created C:\Windows\system32\drivers\nethfdrv.sys 36a8f18fa307b17bc0c35d5887af57de89e80861aadae4f85bc5402b3671f873.exe
Executes dropped EXE 5 IoCs

Processes:

installd.exenethtsrv.exenetupdsrv.exenethtsrv.exenetupdsrv.exe

pid process

1712 installd.exe
688 nethtsrv.exe
1840 netupdsrv.exe
1644 nethtsrv.exe
1520 netupdsrv.exe

description	ioc	process
File created	C:\Windows\system32\drivers\nethfdrv.sys	36a8f18fa307b17bc0c35d5887af57de89e80861aadae4f85bc5402b3671f873.exe

pid	process
1712	installd.exe
688	nethtsrv.exe
1840	netupdsrv.exe
1644	nethtsrv.exe
1520	netupdsrv.exe

Loads dropped DLL 13 IoCs

Processes:

36a8f18fa307b17bc0c35d5887af57de89e80861aadae4f85bc5402b3671f873.exeinstalld.exenethtsrv.exenethtsrv.exe

pid	process
2016	36a8f18fa307b17bc0c35d5887af57de89e80861aadae4f85bc5402b3671f873.exe
2016	36a8f18fa307b17bc0c35d5887af57de89e80861aadae4f85bc5402b3671f873.exe
2016	36a8f18fa307b17bc0c35d5887af57de89e80861aadae4f85bc5402b3671f873.exe
2016	36a8f18fa307b17bc0c35d5887af57de89e80861aadae4f85bc5402b3671f873.exe
1712	installd.exe
2016	36a8f18fa307b17bc0c35d5887af57de89e80861aadae4f85bc5402b3671f873.exe
688	nethtsrv.exe
688	nethtsrv.exe
2016	36a8f18fa307b17bc0c35d5887af57de89e80861aadae4f85bc5402b3671f873.exe
2016	36a8f18fa307b17bc0c35d5887af57de89e80861aadae4f85bc5402b3671f873.exe
1644	nethtsrv.exe
1644	nethtsrv.exe
2016	36a8f18fa307b17bc0c35d5887af57de89e80861aadae4f85bc5402b3671f873.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in System32 directory 5 IoCs

Processes:

36a8f18fa307b17bc0c35d5887af57de89e80861aadae4f85bc5402b3671f873.exe

description	ioc	process
File created	C:\Windows\SysWOW64\hfpapi.dll	36a8f18fa307b17bc0c35d5887af57de89e80861aadae4f85bc5402b3671f873.exe
File created	C:\Windows\SysWOW64\installd.exe	36a8f18fa307b17bc0c35d5887af57de89e80861aadae4f85bc5402b3671f873.exe
File created	C:\Windows\SysWOW64\nethtsrv.exe	36a8f18fa307b17bc0c35d5887af57de89e80861aadae4f85bc5402b3671f873.exe
File created	C:\Windows\SysWOW64\netupdsrv.exe	36a8f18fa307b17bc0c35d5887af57de89e80861aadae4f85bc5402b3671f873.exe
File created	C:\Windows\SysWOW64\hfnapi.dll	36a8f18fa307b17bc0c35d5887af57de89e80861aadae4f85bc5402b3671f873.exe

Drops file in Program Files directory 3 IoCs

Processes:

36a8f18fa307b17bc0c35d5887af57de89e80861aadae4f85bc5402b3671f873.exe

description	ioc	process
File created	C:\Program Files (x86)\Common Files\Config\data.xml	36a8f18fa307b17bc0c35d5887af57de89e80861aadae4f85bc5402b3671f873.exe
File created	C:\Program Files (x86)\Common Files\Config\ver.xml	36a8f18fa307b17bc0c35d5887af57de89e80861aadae4f85bc5402b3671f873.exe
File created	C:\Program Files (x86)\Common Files\config\uninstinethnfd.exe	36a8f18fa307b17bc0c35d5887af57de89e80861aadae4f85bc5402b3671f873.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Runs net.exe
Suspicious behavior: LoadsDriver 1 IoCs

Processes:

pid process

460
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

nethtsrv.exe

description pid process

Token: SeDebugPrivilege 1644 nethtsrv.exe

pid	process
460

description	pid	process
Token: SeDebugPrivilege	1644	nethtsrv.exe

Suspicious use of WriteProcessMemory 50 IoCs

Processes:

36a8f18fa307b17bc0c35d5887af57de89e80861aadae4f85bc5402b3671f873.exenet.exenet.exenet.exenet.exe

description	pid	process	target process
PID 2016 wrote to memory of 1724	2016	36a8f18fa307b17bc0c35d5887af57de89e80861aadae4f85bc5402b3671f873.exe	net.exe
PID 2016 wrote to memory of 1724	2016	36a8f18fa307b17bc0c35d5887af57de89e80861aadae4f85bc5402b3671f873.exe	net.exe
PID 2016 wrote to memory of 1724	2016	36a8f18fa307b17bc0c35d5887af57de89e80861aadae4f85bc5402b3671f873.exe	net.exe
PID 2016 wrote to memory of 1724	2016	36a8f18fa307b17bc0c35d5887af57de89e80861aadae4f85bc5402b3671f873.exe	net.exe
PID 1724 wrote to memory of 1716	1724	net.exe	net1.exe
PID 1724 wrote to memory of 1716	1724	net.exe	net1.exe
PID 1724 wrote to memory of 1716	1724	net.exe	net1.exe
PID 1724 wrote to memory of 1716	1724	net.exe	net1.exe
PID 2016 wrote to memory of 964	2016	36a8f18fa307b17bc0c35d5887af57de89e80861aadae4f85bc5402b3671f873.exe	net.exe
PID 2016 wrote to memory of 964	2016	36a8f18fa307b17bc0c35d5887af57de89e80861aadae4f85bc5402b3671f873.exe	net.exe
PID 2016 wrote to memory of 964	2016	36a8f18fa307b17bc0c35d5887af57de89e80861aadae4f85bc5402b3671f873.exe	net.exe
PID 2016 wrote to memory of 964	2016	36a8f18fa307b17bc0c35d5887af57de89e80861aadae4f85bc5402b3671f873.exe	net.exe
PID 964 wrote to memory of 1588	964	net.exe	net1.exe
PID 964 wrote to memory of 1588	964	net.exe	net1.exe
PID 964 wrote to memory of 1588	964	net.exe	net1.exe
PID 964 wrote to memory of 1588	964	net.exe	net1.exe
PID 2016 wrote to memory of 1712	2016	36a8f18fa307b17bc0c35d5887af57de89e80861aadae4f85bc5402b3671f873.exe	installd.exe
PID 2016 wrote to memory of 1712	2016	36a8f18fa307b17bc0c35d5887af57de89e80861aadae4f85bc5402b3671f873.exe	installd.exe
PID 2016 wrote to memory of 1712	2016	36a8f18fa307b17bc0c35d5887af57de89e80861aadae4f85bc5402b3671f873.exe	installd.exe
PID 2016 wrote to memory of 1712	2016	36a8f18fa307b17bc0c35d5887af57de89e80861aadae4f85bc5402b3671f873.exe	installd.exe
PID 2016 wrote to memory of 1712	2016	36a8f18fa307b17bc0c35d5887af57de89e80861aadae4f85bc5402b3671f873.exe	installd.exe
PID 2016 wrote to memory of 1712	2016	36a8f18fa307b17bc0c35d5887af57de89e80861aadae4f85bc5402b3671f873.exe	installd.exe
PID 2016 wrote to memory of 1712	2016	36a8f18fa307b17bc0c35d5887af57de89e80861aadae4f85bc5402b3671f873.exe	installd.exe
PID 2016 wrote to memory of 688	2016	36a8f18fa307b17bc0c35d5887af57de89e80861aadae4f85bc5402b3671f873.exe	nethtsrv.exe
PID 2016 wrote to memory of 688	2016	36a8f18fa307b17bc0c35d5887af57de89e80861aadae4f85bc5402b3671f873.exe	nethtsrv.exe
PID 2016 wrote to memory of 688	2016	36a8f18fa307b17bc0c35d5887af57de89e80861aadae4f85bc5402b3671f873.exe	nethtsrv.exe
PID 2016 wrote to memory of 688	2016	36a8f18fa307b17bc0c35d5887af57de89e80861aadae4f85bc5402b3671f873.exe	nethtsrv.exe
PID 2016 wrote to memory of 1840	2016	36a8f18fa307b17bc0c35d5887af57de89e80861aadae4f85bc5402b3671f873.exe	netupdsrv.exe
PID 2016 wrote to memory of 1840	2016	36a8f18fa307b17bc0c35d5887af57de89e80861aadae4f85bc5402b3671f873.exe	netupdsrv.exe
PID 2016 wrote to memory of 1840	2016	36a8f18fa307b17bc0c35d5887af57de89e80861aadae4f85bc5402b3671f873.exe	netupdsrv.exe
PID 2016 wrote to memory of 1840	2016	36a8f18fa307b17bc0c35d5887af57de89e80861aadae4f85bc5402b3671f873.exe	netupdsrv.exe
PID 2016 wrote to memory of 1840	2016	36a8f18fa307b17bc0c35d5887af57de89e80861aadae4f85bc5402b3671f873.exe	netupdsrv.exe
PID 2016 wrote to memory of 1840	2016	36a8f18fa307b17bc0c35d5887af57de89e80861aadae4f85bc5402b3671f873.exe	netupdsrv.exe
PID 2016 wrote to memory of 1840	2016	36a8f18fa307b17bc0c35d5887af57de89e80861aadae4f85bc5402b3671f873.exe	netupdsrv.exe
PID 2016 wrote to memory of 1676	2016	36a8f18fa307b17bc0c35d5887af57de89e80861aadae4f85bc5402b3671f873.exe	net.exe
PID 2016 wrote to memory of 1676	2016	36a8f18fa307b17bc0c35d5887af57de89e80861aadae4f85bc5402b3671f873.exe	net.exe
PID 2016 wrote to memory of 1676	2016	36a8f18fa307b17bc0c35d5887af57de89e80861aadae4f85bc5402b3671f873.exe	net.exe
PID 2016 wrote to memory of 1676	2016	36a8f18fa307b17bc0c35d5887af57de89e80861aadae4f85bc5402b3671f873.exe	net.exe
PID 1676 wrote to memory of 1256	1676	net.exe	net1.exe
PID 1676 wrote to memory of 1256	1676	net.exe	net1.exe
PID 1676 wrote to memory of 1256	1676	net.exe	net1.exe
PID 1676 wrote to memory of 1256	1676	net.exe	net1.exe
PID 2016 wrote to memory of 1116	2016	36a8f18fa307b17bc0c35d5887af57de89e80861aadae4f85bc5402b3671f873.exe	net.exe
PID 2016 wrote to memory of 1116	2016	36a8f18fa307b17bc0c35d5887af57de89e80861aadae4f85bc5402b3671f873.exe	net.exe
PID 2016 wrote to memory of 1116	2016	36a8f18fa307b17bc0c35d5887af57de89e80861aadae4f85bc5402b3671f873.exe	net.exe
PID 2016 wrote to memory of 1116	2016	36a8f18fa307b17bc0c35d5887af57de89e80861aadae4f85bc5402b3671f873.exe	net.exe
PID 1116 wrote to memory of 568	1116	net.exe	net1.exe
PID 1116 wrote to memory of 568	1116	net.exe	net1.exe
PID 1116 wrote to memory of 568	1116	net.exe	net1.exe
PID 1116 wrote to memory of 568	1116	net.exe	net1.exe

C:\Users\Admin\AppData\Local\Temp\36a8f18fa307b17bc0c35d5887af57de89e80861aadae4f85bc5402b3671f873.exe
"C:\Users\Admin\AppData\Local\Temp\36a8f18fa307b17bc0c35d5887af57de89e80861aadae4f85bc5402b3671f873.exe"
1⤵
- Drops file in Drivers directory
- Loads dropped DLL
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:2016

C:\Windows\SysWOW64\net.exe
net stop nethttpservice
2⤵
- Suspicious use of WriteProcessMemory
PID:1724

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop nethttpservice
3⤵
PID:1716

C:\Windows\SysWOW64\net.exe
net stop serviceupdater
2⤵
- Suspicious use of WriteProcessMemory
PID:964

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop serviceupdater
3⤵
PID:1588

C:\Windows\SysWOW64\installd.exe
"C:\Windows\system32\installd.exe" nethfdrv
2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1712

C:\Windows\SysWOW64\nethtsrv.exe
"C:\Windows\system32\nethtsrv.exe" -nfdi
2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:688

C:\Windows\SysWOW64\netupdsrv.exe
"C:\Windows\system32\netupdsrv.exe" -nfdi
2⤵
- Executes dropped EXE
PID:1840

C:\Windows\SysWOW64\net.exe
net start nethttpservice
2⤵
- Suspicious use of WriteProcessMemory
PID:1676

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 start nethttpservice
3⤵
PID:1256

C:\Windows\SysWOW64\net.exe
net start serviceupdater
2⤵
- Suspicious use of WriteProcessMemory
PID:1116

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 start serviceupdater
3⤵
PID:568

C:\Windows\SysWOW64\nethtsrv.exe
C:\Windows\SysWOW64\nethtsrv.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:1644

C:\Windows\SysWOW64\netupdsrv.exe
C:\Windows\SysWOW64\netupdsrv.exe
1⤵
- Executes dropped EXE
PID:1520

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\hfnapi.dll
Filesize
106KB

MD5
fcd57ec406e058c31713b2553277ef7b

SHA1
371b4aa8fa6116ee3d12723d92fc47f0ece65bbc

SHA256
e0fce65c3a953fbf4d02a6d942866d8410fdbf6316684c09a730e1fb4c359646

SHA512
d4190b90ace624e780b169af0d2cd6e395f0e0937affcc478516e17a9caa898c14a7eb2b1e64a22d2f6417b21f0ad8e82530b4707e50940f72d3da2d6a8cdb61

Download Submit
C:\Windows\SysWOW64\hfpapi.dll
Filesize
241KB

MD5
c621215a7163119c27d2c70e5567cf73

SHA1
eecf8869729b5b4504f53c8ae81aac5e52695b4f

SHA256
aa572bacd9e9566a791a2228d0c7b69b5e2ca07230ea92647edc7de756301875

SHA512
c1c14a6370f4127ef5ed2998fb0edc5977f540c73739f8dacefd6a20307a120a9232b8c771421dabe09ba6edec65e4bb068dc37550b6c426bf7b160c2ea2cd4d

Download Submit
C:\Windows\SysWOW64\installd.exe
Filesize
108KB

MD5
641c4603f59faef5ff8a4535253d2743

SHA1
de82e7a5ebb7d96a5db9a05cd33d5292b5baf37c

SHA256
652318e2da5825a575da660aaef27e1c736c5af3e49e4011cdeb655a2272f453

SHA512
8355fbd2674e80913e0b6e7ad8af4c9bae1a0a465e641a7db7b5c7a27e7b7442283526fef05e778dda7a9d292280c97877ec93330fef7968454b78d77b9a4245

Download Submit
C:\Windows\SysWOW64\nethtsrv.exe
Filesize
176KB

MD5
7d8ea870a7bbbdc269e837cd2b9aaa87

SHA1
8ffec4976e719dba949c4e11fddc1cc30b738554

SHA256
36edfb6398e544b0b14a24eae90e98265664acefccde0020c7bd85443aee0d62

SHA512
9cc3988067cbfcd164d727fc8b6e4a7b6beef43d67a49ef7986ac3fe4cece02eba6fae589075be8129f4edaaa01513352023500815cd23db7d6482cbcf01a258

Download Submit
C:\Windows\SysWOW64\nethtsrv.exe
Filesize
176KB

MD5
7d8ea870a7bbbdc269e837cd2b9aaa87

SHA1
8ffec4976e719dba949c4e11fddc1cc30b738554

SHA256
36edfb6398e544b0b14a24eae90e98265664acefccde0020c7bd85443aee0d62

SHA512
9cc3988067cbfcd164d727fc8b6e4a7b6beef43d67a49ef7986ac3fe4cece02eba6fae589075be8129f4edaaa01513352023500815cd23db7d6482cbcf01a258

Download Submit
C:\Windows\SysWOW64\netupdsrv.exe
Filesize
159KB

MD5
eda874ac0decb674924c3b83eeac0721

SHA1
ae2bc1bd499202e718ec63bf6fa31fb48c29773e

SHA256
18b49ea2a29ca51596e333632f3f263d3ad6859ab58cacb94e463a51d026ef4d

SHA512
87ba2e7f457b8177f9cd9e77717dc0ca7690ca48860280c226a04b4931935a8bac9d133a54615a926c5ec0eb58c5e57cb1f1dbc6646713d35c2f5afd3cddacad

Download Submit
C:\Windows\SysWOW64\netupdsrv.exe
Filesize
159KB

MD5
eda874ac0decb674924c3b83eeac0721

SHA1
ae2bc1bd499202e718ec63bf6fa31fb48c29773e

SHA256
18b49ea2a29ca51596e333632f3f263d3ad6859ab58cacb94e463a51d026ef4d

SHA512
87ba2e7f457b8177f9cd9e77717dc0ca7690ca48860280c226a04b4931935a8bac9d133a54615a926c5ec0eb58c5e57cb1f1dbc6646713d35c2f5afd3cddacad

Download Submit
\Users\Admin\AppData\Local\Temp\nsy2C70.tmp\System.dll
Filesize
11KB

MD5
c17103ae9072a06da581dec998343fc1

SHA1
b72148c6bdfaada8b8c3f950e610ee7cf1da1f8d

SHA256
dc58d8ad81cacb0c1ed72e33bff8f23ea40b5252b5bb55d393a0903e6819ae2f

SHA512
d32a71aaef18e993f28096d536e41c4d016850721b31171513ce28bbd805a54fd290b7c3e9d935f72e676a1acfb4f0dcc89d95040a0dd29f2b6975855c18986f

Download Submit
\Users\Admin\AppData\Local\Temp\nsy2C70.tmp\nsExec.dll
Filesize
6KB

MD5
acc2b699edfea5bf5aae45aba3a41e96

SHA1
d2accf4d494e43ceb2cff69abe4dd17147d29cc2

SHA256
168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e

SHA512
e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe

Download Submit
\Users\Admin\AppData\Local\Temp\nsy2C70.tmp\nsExec.dll
Filesize
6KB

MD5
acc2b699edfea5bf5aae45aba3a41e96

SHA1
d2accf4d494e43ceb2cff69abe4dd17147d29cc2

SHA256
168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e

SHA512
e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe

Download Submit
\Users\Admin\AppData\Local\Temp\nsy2C70.tmp\nsExec.dll
Filesize
6KB

MD5
acc2b699edfea5bf5aae45aba3a41e96

SHA1
d2accf4d494e43ceb2cff69abe4dd17147d29cc2

SHA256
168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e

SHA512
e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe

Download Submit
\Users\Admin\AppData\Local\Temp\nsy2C70.tmp\nsExec.dll
Filesize
6KB

MD5
acc2b699edfea5bf5aae45aba3a41e96

SHA1
d2accf4d494e43ceb2cff69abe4dd17147d29cc2

SHA256
168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e

SHA512
e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe

Download Submit
\Windows\SysWOW64\hfnapi.dll
Filesize
106KB

MD5
fcd57ec406e058c31713b2553277ef7b

SHA1
371b4aa8fa6116ee3d12723d92fc47f0ece65bbc

SHA256
e0fce65c3a953fbf4d02a6d942866d8410fdbf6316684c09a730e1fb4c359646

SHA512
d4190b90ace624e780b169af0d2cd6e395f0e0937affcc478516e17a9caa898c14a7eb2b1e64a22d2f6417b21f0ad8e82530b4707e50940f72d3da2d6a8cdb61

Download Submit
\Windows\SysWOW64\hfnapi.dll
Filesize
106KB

MD5
fcd57ec406e058c31713b2553277ef7b

SHA1
371b4aa8fa6116ee3d12723d92fc47f0ece65bbc

SHA256
e0fce65c3a953fbf4d02a6d942866d8410fdbf6316684c09a730e1fb4c359646

SHA512
d4190b90ace624e780b169af0d2cd6e395f0e0937affcc478516e17a9caa898c14a7eb2b1e64a22d2f6417b21f0ad8e82530b4707e50940f72d3da2d6a8cdb61

Download Submit
\Windows\SysWOW64\hfnapi.dll
Filesize
106KB

MD5
fcd57ec406e058c31713b2553277ef7b

SHA1
371b4aa8fa6116ee3d12723d92fc47f0ece65bbc

SHA256
e0fce65c3a953fbf4d02a6d942866d8410fdbf6316684c09a730e1fb4c359646

SHA512
d4190b90ace624e780b169af0d2cd6e395f0e0937affcc478516e17a9caa898c14a7eb2b1e64a22d2f6417b21f0ad8e82530b4707e50940f72d3da2d6a8cdb61

Download Submit
\Windows\SysWOW64\hfpapi.dll
Filesize
241KB

MD5
c621215a7163119c27d2c70e5567cf73

SHA1
eecf8869729b5b4504f53c8ae81aac5e52695b4f

SHA256
aa572bacd9e9566a791a2228d0c7b69b5e2ca07230ea92647edc7de756301875

SHA512
c1c14a6370f4127ef5ed2998fb0edc5977f540c73739f8dacefd6a20307a120a9232b8c771421dabe09ba6edec65e4bb068dc37550b6c426bf7b160c2ea2cd4d

Download Submit
\Windows\SysWOW64\hfpapi.dll
Filesize
241KB

MD5
c621215a7163119c27d2c70e5567cf73

SHA1
eecf8869729b5b4504f53c8ae81aac5e52695b4f

SHA256
aa572bacd9e9566a791a2228d0c7b69b5e2ca07230ea92647edc7de756301875

SHA512
c1c14a6370f4127ef5ed2998fb0edc5977f540c73739f8dacefd6a20307a120a9232b8c771421dabe09ba6edec65e4bb068dc37550b6c426bf7b160c2ea2cd4d

Download Submit
\Windows\SysWOW64\installd.exe
Filesize
108KB

MD5
641c4603f59faef5ff8a4535253d2743

SHA1
de82e7a5ebb7d96a5db9a05cd33d5292b5baf37c

SHA256
652318e2da5825a575da660aaef27e1c736c5af3e49e4011cdeb655a2272f453

SHA512
8355fbd2674e80913e0b6e7ad8af4c9bae1a0a465e641a7db7b5c7a27e7b7442283526fef05e778dda7a9d292280c97877ec93330fef7968454b78d77b9a4245

Download Submit
\Windows\SysWOW64\nethtsrv.exe
Filesize
176KB

MD5
7d8ea870a7bbbdc269e837cd2b9aaa87

SHA1
8ffec4976e719dba949c4e11fddc1cc30b738554

SHA256
36edfb6398e544b0b14a24eae90e98265664acefccde0020c7bd85443aee0d62

SHA512
9cc3988067cbfcd164d727fc8b6e4a7b6beef43d67a49ef7986ac3fe4cece02eba6fae589075be8129f4edaaa01513352023500815cd23db7d6482cbcf01a258

Download Submit
\Windows\SysWOW64\netupdsrv.exe
Filesize
159KB

MD5
eda874ac0decb674924c3b83eeac0721

SHA1
ae2bc1bd499202e718ec63bf6fa31fb48c29773e

SHA256
18b49ea2a29ca51596e333632f3f263d3ad6859ab58cacb94e463a51d026ef4d

SHA512
87ba2e7f457b8177f9cd9e77717dc0ca7690ca48860280c226a04b4931935a8bac9d133a54615a926c5ec0eb58c5e57cb1f1dbc6646713d35c2f5afd3cddacad

Download Submit
memory/568-87-0x0000000000000000-mapping.dmp

Download
memory/688-70-0x0000000000000000-mapping.dmp

Download
memory/964-61-0x0000000000000000-mapping.dmp

Download
memory/1116-86-0x0000000000000000-mapping.dmp

Download
memory/1256-81-0x0000000000000000-mapping.dmp

Download
memory/1588-62-0x0000000000000000-mapping.dmp

Download
memory/1676-80-0x0000000000000000-mapping.dmp

Download
memory/1712-64-0x0000000000000000-mapping.dmp

Download
memory/1716-58-0x0000000000000000-mapping.dmp

Download
memory/1724-57-0x0000000000000000-mapping.dmp

Download
memory/1840-76-0x0000000000000000-mapping.dmp

Download
memory/2016-54-0x0000000076711000-0x0000000076713000-memory.dmp

Filesize
8KB

Download
memory/2016-59-0x0000000000360000-0x00000000007BE000-memory.dmp

Filesize
4.4MB

Download
memory/2016-90-0x0000000000360000-0x00000000007BE000-memory.dmp

Filesize
4.4MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads