31f12d93559711ddefdd3af4bc8abdd78f8776b6e4cf2552f14c6b2a788f5f16

Analysis

max time kernel
45s
max time network
51s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
23-11-2022 10:29

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

31f12d93559711ddefdd3af4bc8abdd78f8776b6e4cf2552f14c6b2a788f5f16.exe
Size

601KB
MD5

60a9fdeffc9839cc1ae403230a15babb
SHA1

0fb94ebe037600db6218a6a7b37410d687f82521
SHA256

31f12d93559711ddefdd3af4bc8abdd78f8776b6e4cf2552f14c6b2a788f5f16
SHA512

839f87c362c6a1a0071cc56a830d85a93f4925d1f12f439ab543e4144980435ddb2aa0094321ca77c1072a1eb765a951d6ad6f3a0e7bcb65524e8c41991c2d73
SSDEEP

12288:3Iny5DYTW6htKnm0O0hkV6yvDl5ytl2r0wldWTi8+Sm:fUTW80u0U5yXNwLW+VSm

Score

8^/10

discovery

Malware Config

Signatures

Drops file in Drivers directory 1 IoCs

Processes:

31f12d93559711ddefdd3af4bc8abdd78f8776b6e4cf2552f14c6b2a788f5f16.exe

description ioc process

File created C:\Windows\system32\drivers\nethfdrv.sys 31f12d93559711ddefdd3af4bc8abdd78f8776b6e4cf2552f14c6b2a788f5f16.exe
Executes dropped EXE 5 IoCs

Processes:

installd.exenethtsrv.exenetupdsrv.exenethtsrv.exenetupdsrv.exe

pid process

304 installd.exe
996 nethtsrv.exe
1156 netupdsrv.exe
952 nethtsrv.exe
1652 netupdsrv.exe

description	ioc	process
File created	C:\Windows\system32\drivers\nethfdrv.sys	31f12d93559711ddefdd3af4bc8abdd78f8776b6e4cf2552f14c6b2a788f5f16.exe

pid	process
304	installd.exe
996	nethtsrv.exe
1156	netupdsrv.exe
952	nethtsrv.exe
1652	netupdsrv.exe

Loads dropped DLL 13 IoCs

Processes:

31f12d93559711ddefdd3af4bc8abdd78f8776b6e4cf2552f14c6b2a788f5f16.exeinstalld.exenethtsrv.exenethtsrv.exe

pid	process
1500	31f12d93559711ddefdd3af4bc8abdd78f8776b6e4cf2552f14c6b2a788f5f16.exe
1500	31f12d93559711ddefdd3af4bc8abdd78f8776b6e4cf2552f14c6b2a788f5f16.exe
1500	31f12d93559711ddefdd3af4bc8abdd78f8776b6e4cf2552f14c6b2a788f5f16.exe
1500	31f12d93559711ddefdd3af4bc8abdd78f8776b6e4cf2552f14c6b2a788f5f16.exe
304	installd.exe
1500	31f12d93559711ddefdd3af4bc8abdd78f8776b6e4cf2552f14c6b2a788f5f16.exe
996	nethtsrv.exe
996	nethtsrv.exe
1500	31f12d93559711ddefdd3af4bc8abdd78f8776b6e4cf2552f14c6b2a788f5f16.exe
1500	31f12d93559711ddefdd3af4bc8abdd78f8776b6e4cf2552f14c6b2a788f5f16.exe
952	nethtsrv.exe
952	nethtsrv.exe
1500	31f12d93559711ddefdd3af4bc8abdd78f8776b6e4cf2552f14c6b2a788f5f16.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in System32 directory 5 IoCs

Processes:

31f12d93559711ddefdd3af4bc8abdd78f8776b6e4cf2552f14c6b2a788f5f16.exe

description	ioc	process
File created	C:\Windows\SysWOW64\hfnapi.dll	31f12d93559711ddefdd3af4bc8abdd78f8776b6e4cf2552f14c6b2a788f5f16.exe
File created	C:\Windows\SysWOW64\hfpapi.dll	31f12d93559711ddefdd3af4bc8abdd78f8776b6e4cf2552f14c6b2a788f5f16.exe
File created	C:\Windows\SysWOW64\installd.exe	31f12d93559711ddefdd3af4bc8abdd78f8776b6e4cf2552f14c6b2a788f5f16.exe
File created	C:\Windows\SysWOW64\nethtsrv.exe	31f12d93559711ddefdd3af4bc8abdd78f8776b6e4cf2552f14c6b2a788f5f16.exe
File created	C:\Windows\SysWOW64\netupdsrv.exe	31f12d93559711ddefdd3af4bc8abdd78f8776b6e4cf2552f14c6b2a788f5f16.exe

Drops file in Program Files directory 3 IoCs

Processes:

31f12d93559711ddefdd3af4bc8abdd78f8776b6e4cf2552f14c6b2a788f5f16.exe

description	ioc	process
File created	C:\Program Files (x86)\Common Files\Config\data.xml	31f12d93559711ddefdd3af4bc8abdd78f8776b6e4cf2552f14c6b2a788f5f16.exe
File created	C:\Program Files (x86)\Common Files\Config\ver.xml	31f12d93559711ddefdd3af4bc8abdd78f8776b6e4cf2552f14c6b2a788f5f16.exe
File created	C:\Program Files (x86)\Common Files\config\uninstinethnfd.exe	31f12d93559711ddefdd3af4bc8abdd78f8776b6e4cf2552f14c6b2a788f5f16.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Runs net.exe
Suspicious behavior: LoadsDriver 1 IoCs

Processes:

pid process

464
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

nethtsrv.exe

description pid process

Token: SeDebugPrivilege 952 nethtsrv.exe

pid	process
464

description	pid	process
Token: SeDebugPrivilege	952	nethtsrv.exe

Suspicious use of WriteProcessMemory 50 IoCs

Processes:

31f12d93559711ddefdd3af4bc8abdd78f8776b6e4cf2552f14c6b2a788f5f16.exenet.exenet.exenet.exenet.exe

description	pid	process	target process
PID 1500 wrote to memory of 1120	1500	31f12d93559711ddefdd3af4bc8abdd78f8776b6e4cf2552f14c6b2a788f5f16.exe	net.exe
PID 1500 wrote to memory of 1120	1500	31f12d93559711ddefdd3af4bc8abdd78f8776b6e4cf2552f14c6b2a788f5f16.exe	net.exe
PID 1500 wrote to memory of 1120	1500	31f12d93559711ddefdd3af4bc8abdd78f8776b6e4cf2552f14c6b2a788f5f16.exe	net.exe
PID 1500 wrote to memory of 1120	1500	31f12d93559711ddefdd3af4bc8abdd78f8776b6e4cf2552f14c6b2a788f5f16.exe	net.exe
PID 1120 wrote to memory of 460	1120	net.exe	net1.exe
PID 1120 wrote to memory of 460	1120	net.exe	net1.exe
PID 1120 wrote to memory of 460	1120	net.exe	net1.exe
PID 1120 wrote to memory of 460	1120	net.exe	net1.exe
PID 1500 wrote to memory of 1756	1500	31f12d93559711ddefdd3af4bc8abdd78f8776b6e4cf2552f14c6b2a788f5f16.exe	net.exe
PID 1500 wrote to memory of 1756	1500	31f12d93559711ddefdd3af4bc8abdd78f8776b6e4cf2552f14c6b2a788f5f16.exe	net.exe
PID 1500 wrote to memory of 1756	1500	31f12d93559711ddefdd3af4bc8abdd78f8776b6e4cf2552f14c6b2a788f5f16.exe	net.exe
PID 1500 wrote to memory of 1756	1500	31f12d93559711ddefdd3af4bc8abdd78f8776b6e4cf2552f14c6b2a788f5f16.exe	net.exe
PID 1756 wrote to memory of 2012	1756	net.exe	net1.exe
PID 1756 wrote to memory of 2012	1756	net.exe	net1.exe
PID 1756 wrote to memory of 2012	1756	net.exe	net1.exe
PID 1756 wrote to memory of 2012	1756	net.exe	net1.exe
PID 1500 wrote to memory of 304	1500	31f12d93559711ddefdd3af4bc8abdd78f8776b6e4cf2552f14c6b2a788f5f16.exe	installd.exe
PID 1500 wrote to memory of 304	1500	31f12d93559711ddefdd3af4bc8abdd78f8776b6e4cf2552f14c6b2a788f5f16.exe	installd.exe
PID 1500 wrote to memory of 304	1500	31f12d93559711ddefdd3af4bc8abdd78f8776b6e4cf2552f14c6b2a788f5f16.exe	installd.exe
PID 1500 wrote to memory of 304	1500	31f12d93559711ddefdd3af4bc8abdd78f8776b6e4cf2552f14c6b2a788f5f16.exe	installd.exe
PID 1500 wrote to memory of 304	1500	31f12d93559711ddefdd3af4bc8abdd78f8776b6e4cf2552f14c6b2a788f5f16.exe	installd.exe
PID 1500 wrote to memory of 304	1500	31f12d93559711ddefdd3af4bc8abdd78f8776b6e4cf2552f14c6b2a788f5f16.exe	installd.exe
PID 1500 wrote to memory of 304	1500	31f12d93559711ddefdd3af4bc8abdd78f8776b6e4cf2552f14c6b2a788f5f16.exe	installd.exe
PID 1500 wrote to memory of 996	1500	31f12d93559711ddefdd3af4bc8abdd78f8776b6e4cf2552f14c6b2a788f5f16.exe	nethtsrv.exe
PID 1500 wrote to memory of 996	1500	31f12d93559711ddefdd3af4bc8abdd78f8776b6e4cf2552f14c6b2a788f5f16.exe	nethtsrv.exe
PID 1500 wrote to memory of 996	1500	31f12d93559711ddefdd3af4bc8abdd78f8776b6e4cf2552f14c6b2a788f5f16.exe	nethtsrv.exe
PID 1500 wrote to memory of 996	1500	31f12d93559711ddefdd3af4bc8abdd78f8776b6e4cf2552f14c6b2a788f5f16.exe	nethtsrv.exe
PID 1500 wrote to memory of 1156	1500	31f12d93559711ddefdd3af4bc8abdd78f8776b6e4cf2552f14c6b2a788f5f16.exe	netupdsrv.exe
PID 1500 wrote to memory of 1156	1500	31f12d93559711ddefdd3af4bc8abdd78f8776b6e4cf2552f14c6b2a788f5f16.exe	netupdsrv.exe
PID 1500 wrote to memory of 1156	1500	31f12d93559711ddefdd3af4bc8abdd78f8776b6e4cf2552f14c6b2a788f5f16.exe	netupdsrv.exe
PID 1500 wrote to memory of 1156	1500	31f12d93559711ddefdd3af4bc8abdd78f8776b6e4cf2552f14c6b2a788f5f16.exe	netupdsrv.exe
PID 1500 wrote to memory of 1156	1500	31f12d93559711ddefdd3af4bc8abdd78f8776b6e4cf2552f14c6b2a788f5f16.exe	netupdsrv.exe
PID 1500 wrote to memory of 1156	1500	31f12d93559711ddefdd3af4bc8abdd78f8776b6e4cf2552f14c6b2a788f5f16.exe	netupdsrv.exe
PID 1500 wrote to memory of 1156	1500	31f12d93559711ddefdd3af4bc8abdd78f8776b6e4cf2552f14c6b2a788f5f16.exe	netupdsrv.exe
PID 1500 wrote to memory of 1768	1500	31f12d93559711ddefdd3af4bc8abdd78f8776b6e4cf2552f14c6b2a788f5f16.exe	net.exe
PID 1500 wrote to memory of 1768	1500	31f12d93559711ddefdd3af4bc8abdd78f8776b6e4cf2552f14c6b2a788f5f16.exe	net.exe
PID 1500 wrote to memory of 1768	1500	31f12d93559711ddefdd3af4bc8abdd78f8776b6e4cf2552f14c6b2a788f5f16.exe	net.exe
PID 1500 wrote to memory of 1768	1500	31f12d93559711ddefdd3af4bc8abdd78f8776b6e4cf2552f14c6b2a788f5f16.exe	net.exe
PID 1768 wrote to memory of 1480	1768	net.exe	net1.exe
PID 1768 wrote to memory of 1480	1768	net.exe	net1.exe
PID 1768 wrote to memory of 1480	1768	net.exe	net1.exe
PID 1768 wrote to memory of 1480	1768	net.exe	net1.exe
PID 1500 wrote to memory of 268	1500	31f12d93559711ddefdd3af4bc8abdd78f8776b6e4cf2552f14c6b2a788f5f16.exe	net.exe
PID 1500 wrote to memory of 268	1500	31f12d93559711ddefdd3af4bc8abdd78f8776b6e4cf2552f14c6b2a788f5f16.exe	net.exe
PID 1500 wrote to memory of 268	1500	31f12d93559711ddefdd3af4bc8abdd78f8776b6e4cf2552f14c6b2a788f5f16.exe	net.exe
PID 1500 wrote to memory of 268	1500	31f12d93559711ddefdd3af4bc8abdd78f8776b6e4cf2552f14c6b2a788f5f16.exe	net.exe
PID 268 wrote to memory of 1648	268	net.exe	net1.exe
PID 268 wrote to memory of 1648	268	net.exe	net1.exe
PID 268 wrote to memory of 1648	268	net.exe	net1.exe
PID 268 wrote to memory of 1648	268	net.exe	net1.exe

C:\Users\Admin\AppData\Local\Temp\31f12d93559711ddefdd3af4bc8abdd78f8776b6e4cf2552f14c6b2a788f5f16.exe
"C:\Users\Admin\AppData\Local\Temp\31f12d93559711ddefdd3af4bc8abdd78f8776b6e4cf2552f14c6b2a788f5f16.exe"
1⤵
- Drops file in Drivers directory
- Loads dropped DLL
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:1500

C:\Windows\SysWOW64\net.exe
net stop nethttpservice
2⤵
- Suspicious use of WriteProcessMemory
PID:1120

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop nethttpservice
3⤵
PID:460

C:\Windows\SysWOW64\net.exe
net stop serviceupdater
2⤵
- Suspicious use of WriteProcessMemory
PID:1756

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop serviceupdater
3⤵
PID:2012

C:\Windows\SysWOW64\installd.exe
"C:\Windows\system32\installd.exe" nethfdrv
2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:304

C:\Windows\SysWOW64\nethtsrv.exe
"C:\Windows\system32\nethtsrv.exe" -nfdi
2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:996

C:\Windows\SysWOW64\netupdsrv.exe
"C:\Windows\system32\netupdsrv.exe" -nfdi
2⤵
- Executes dropped EXE
PID:1156

C:\Windows\SysWOW64\net.exe
net start nethttpservice
2⤵
- Suspicious use of WriteProcessMemory
PID:1768

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 start nethttpservice
3⤵
PID:1480

C:\Windows\SysWOW64\net.exe
net start serviceupdater
2⤵
- Suspicious use of WriteProcessMemory
PID:268

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 start serviceupdater
3⤵
PID:1648

C:\Windows\SysWOW64\nethtsrv.exe
C:\Windows\SysWOW64\nethtsrv.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:952

C:\Windows\SysWOW64\netupdsrv.exe
C:\Windows\SysWOW64\netupdsrv.exe
1⤵
- Executes dropped EXE
PID:1652

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\hfnapi.dll
Filesize
106KB

MD5
282e18b0e6d829ad2955b0efb1c0758f

SHA1
100508bbcc60b09c37fa76bddc1d93e661c4e76d

SHA256
a4114ec8da1f86e551a9d715fec0aa0f34863e7d82deabaa218a8b1df30c7f3f

SHA512
7f9e2366040c7f7253d0f960c57b0d88f559ed8e47d72d2402d6010216ec74de30c1aaf5e8d16309239e24f46c8e619f4767e3fc9cb2b9cca47650125226cfbc

Download Submit
C:\Windows\SysWOW64\hfpapi.dll
Filesize
241KB

MD5
59a7cfa214c508814c57e14fff3b14d1

SHA1
3023a5b1d6d2893bbf9f0c20e4fc347d082a22ee

SHA256
6ebc2d49f224bc0b45307c0507c6b6a667f1b994802fe126e2ca9668ffc544e6

SHA512
a75d483a8b344002943310204961d40ecd2639665a6fcf1731b0f43f7b8da38ac3b0037c2b7e5cb9904e3b5efcb20f21d9d10f5955185d68640475393f3af6e5

Download Submit
C:\Windows\SysWOW64\installd.exe
Filesize
108KB

MD5
661720ba22f6a30312c26a8ed31812d2

SHA1
7b42e311ae530fde64131d2ce12e285a900aadb6

SHA256
5defbb97d66cdfc9298a32f8f256d4e69ed7654808ffc529a1ed17f0b5d27867

SHA512
13bf51be40bf58aeedc2064f7556d36c253de8a9b78cf12db2eac76c002fffe2e41cc94c531d3acee7bdc98f7951aa2bd628db2a206521370cecced29e04df9f

Download Submit
C:\Windows\SysWOW64\nethtsrv.exe
Filesize
176KB

MD5
ca8f52a8344a228be3b09ea8e6b71b53

SHA1
040a5672a52bb5204898c4416730f52596686119

SHA256
8007943001f5d81b6948d0f97931a7e46ff988c344c2c2048ee308f1caa9bddb

SHA512
552c9e8eae37c774807e3538a6c3a2ea7b3b97e6be12c734c4e12e00e89015cc8eb71bde5992232347326689bb051436f8578b610f00501547ceff0afe76ce11

Download Submit
C:\Windows\SysWOW64\nethtsrv.exe
Filesize
176KB

MD5
ca8f52a8344a228be3b09ea8e6b71b53

SHA1
040a5672a52bb5204898c4416730f52596686119

SHA256
8007943001f5d81b6948d0f97931a7e46ff988c344c2c2048ee308f1caa9bddb

SHA512
552c9e8eae37c774807e3538a6c3a2ea7b3b97e6be12c734c4e12e00e89015cc8eb71bde5992232347326689bb051436f8578b610f00501547ceff0afe76ce11

Download Submit
C:\Windows\SysWOW64\netupdsrv.exe
Filesize
158KB

MD5
39f9974eeea05ba044d587cf7598e4f4

SHA1
6743e9f11b7be007f8e306e72a4ae40c1cc1a13f

SHA256
2c85d7b2d3a6c438b191b91d183982fe635d8b37f4e4b11275c856f0b866c706

SHA512
37dc8b0720e4e62eda82837e60edef12881690826fffce3f7a9021eee29d1cfbe48c8b18b39622e62dd7887e8d30195cb1b9dc44fb68f21f726cd600eb45b82a

Download Submit
C:\Windows\SysWOW64\netupdsrv.exe
Filesize
158KB

MD5
39f9974eeea05ba044d587cf7598e4f4

SHA1
6743e9f11b7be007f8e306e72a4ae40c1cc1a13f

SHA256
2c85d7b2d3a6c438b191b91d183982fe635d8b37f4e4b11275c856f0b866c706

SHA512
37dc8b0720e4e62eda82837e60edef12881690826fffce3f7a9021eee29d1cfbe48c8b18b39622e62dd7887e8d30195cb1b9dc44fb68f21f726cd600eb45b82a

Download Submit
\Users\Admin\AppData\Local\Temp\nsd5DD.tmp\System.dll
Filesize
11KB

MD5
c17103ae9072a06da581dec998343fc1

SHA1
b72148c6bdfaada8b8c3f950e610ee7cf1da1f8d

SHA256
dc58d8ad81cacb0c1ed72e33bff8f23ea40b5252b5bb55d393a0903e6819ae2f

SHA512
d32a71aaef18e993f28096d536e41c4d016850721b31171513ce28bbd805a54fd290b7c3e9d935f72e676a1acfb4f0dcc89d95040a0dd29f2b6975855c18986f

Download Submit
\Users\Admin\AppData\Local\Temp\nsd5DD.tmp\nsExec.dll
Filesize
6KB

MD5
acc2b699edfea5bf5aae45aba3a41e96

SHA1
d2accf4d494e43ceb2cff69abe4dd17147d29cc2

SHA256
168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e

SHA512
e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe

Download Submit
\Users\Admin\AppData\Local\Temp\nsd5DD.tmp\nsExec.dll
Filesize
6KB

MD5
acc2b699edfea5bf5aae45aba3a41e96

SHA1
d2accf4d494e43ceb2cff69abe4dd17147d29cc2

SHA256
168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e

SHA512
e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe

Download Submit
\Users\Admin\AppData\Local\Temp\nsd5DD.tmp\nsExec.dll
Filesize
6KB

MD5
acc2b699edfea5bf5aae45aba3a41e96

SHA1
d2accf4d494e43ceb2cff69abe4dd17147d29cc2

SHA256
168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e

SHA512
e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe

Download Submit
\Users\Admin\AppData\Local\Temp\nsd5DD.tmp\nsExec.dll
Filesize
6KB

MD5
acc2b699edfea5bf5aae45aba3a41e96

SHA1
d2accf4d494e43ceb2cff69abe4dd17147d29cc2

SHA256
168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e

SHA512
e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe

Download Submit
\Windows\SysWOW64\hfnapi.dll
Filesize
106KB

MD5
282e18b0e6d829ad2955b0efb1c0758f

SHA1
100508bbcc60b09c37fa76bddc1d93e661c4e76d

SHA256
a4114ec8da1f86e551a9d715fec0aa0f34863e7d82deabaa218a8b1df30c7f3f

SHA512
7f9e2366040c7f7253d0f960c57b0d88f559ed8e47d72d2402d6010216ec74de30c1aaf5e8d16309239e24f46c8e619f4767e3fc9cb2b9cca47650125226cfbc

Download Submit
\Windows\SysWOW64\hfnapi.dll
Filesize
106KB

MD5
282e18b0e6d829ad2955b0efb1c0758f

SHA1
100508bbcc60b09c37fa76bddc1d93e661c4e76d

SHA256
a4114ec8da1f86e551a9d715fec0aa0f34863e7d82deabaa218a8b1df30c7f3f

SHA512
7f9e2366040c7f7253d0f960c57b0d88f559ed8e47d72d2402d6010216ec74de30c1aaf5e8d16309239e24f46c8e619f4767e3fc9cb2b9cca47650125226cfbc

Download Submit
\Windows\SysWOW64\hfnapi.dll
Filesize
106KB

MD5
282e18b0e6d829ad2955b0efb1c0758f

SHA1
100508bbcc60b09c37fa76bddc1d93e661c4e76d

SHA256
a4114ec8da1f86e551a9d715fec0aa0f34863e7d82deabaa218a8b1df30c7f3f

SHA512
7f9e2366040c7f7253d0f960c57b0d88f559ed8e47d72d2402d6010216ec74de30c1aaf5e8d16309239e24f46c8e619f4767e3fc9cb2b9cca47650125226cfbc

Download Submit
\Windows\SysWOW64\hfpapi.dll
Filesize
241KB

MD5
59a7cfa214c508814c57e14fff3b14d1

SHA1
3023a5b1d6d2893bbf9f0c20e4fc347d082a22ee

SHA256
6ebc2d49f224bc0b45307c0507c6b6a667f1b994802fe126e2ca9668ffc544e6

SHA512
a75d483a8b344002943310204961d40ecd2639665a6fcf1731b0f43f7b8da38ac3b0037c2b7e5cb9904e3b5efcb20f21d9d10f5955185d68640475393f3af6e5

Download Submit
\Windows\SysWOW64\hfpapi.dll
Filesize
241KB

MD5
59a7cfa214c508814c57e14fff3b14d1

SHA1
3023a5b1d6d2893bbf9f0c20e4fc347d082a22ee

SHA256
6ebc2d49f224bc0b45307c0507c6b6a667f1b994802fe126e2ca9668ffc544e6

SHA512
a75d483a8b344002943310204961d40ecd2639665a6fcf1731b0f43f7b8da38ac3b0037c2b7e5cb9904e3b5efcb20f21d9d10f5955185d68640475393f3af6e5

Download Submit
\Windows\SysWOW64\installd.exe
Filesize
108KB

MD5
661720ba22f6a30312c26a8ed31812d2

SHA1
7b42e311ae530fde64131d2ce12e285a900aadb6

SHA256
5defbb97d66cdfc9298a32f8f256d4e69ed7654808ffc529a1ed17f0b5d27867

SHA512
13bf51be40bf58aeedc2064f7556d36c253de8a9b78cf12db2eac76c002fffe2e41cc94c531d3acee7bdc98f7951aa2bd628db2a206521370cecced29e04df9f

Download Submit
\Windows\SysWOW64\nethtsrv.exe
Filesize
176KB

MD5
ca8f52a8344a228be3b09ea8e6b71b53

SHA1
040a5672a52bb5204898c4416730f52596686119

SHA256
8007943001f5d81b6948d0f97931a7e46ff988c344c2c2048ee308f1caa9bddb

SHA512
552c9e8eae37c774807e3538a6c3a2ea7b3b97e6be12c734c4e12e00e89015cc8eb71bde5992232347326689bb051436f8578b610f00501547ceff0afe76ce11

Download Submit
\Windows\SysWOW64\netupdsrv.exe
Filesize
158KB

MD5
39f9974eeea05ba044d587cf7598e4f4

SHA1
6743e9f11b7be007f8e306e72a4ae40c1cc1a13f

SHA256
2c85d7b2d3a6c438b191b91d183982fe635d8b37f4e4b11275c856f0b866c706

SHA512
37dc8b0720e4e62eda82837e60edef12881690826fffce3f7a9021eee29d1cfbe48c8b18b39622e62dd7887e8d30195cb1b9dc44fb68f21f726cd600eb45b82a

Download Submit
memory/268-86-0x0000000000000000-mapping.dmp

Download
memory/304-64-0x0000000000000000-mapping.dmp

Download
memory/460-58-0x0000000000000000-mapping.dmp

Download
memory/996-70-0x0000000000000000-mapping.dmp

Download
memory/1120-57-0x0000000000000000-mapping.dmp

Download
memory/1156-76-0x0000000000000000-mapping.dmp

Download
memory/1480-81-0x0000000000000000-mapping.dmp

Download
memory/1500-62-0x0000000000360000-0x00000000007BE000-memory.dmp

Filesize
4.4MB

Download
memory/1500-54-0x0000000075D71000-0x0000000075D73000-memory.dmp

Filesize
8KB

Download
memory/1500-90-0x0000000000360000-0x00000000007BE000-memory.dmp

Filesize
4.4MB

Download
memory/1648-87-0x0000000000000000-mapping.dmp

Download
memory/1756-60-0x0000000000000000-mapping.dmp

Download
memory/1768-80-0x0000000000000000-mapping.dmp

Download
memory/2012-61-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads