1a5f854f9d6fe3543c633191c80c690d7b725ce720d631db9380536bf3f00eff

Analysis

max time kernel
43s
max time network
47s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
23-11-2022 10:32

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1a5f854f9d6fe3543c633191c80c690d7b725ce720d631db9380536bf3f00eff.exe
Size

603KB
MD5

43aa7793765552e77b75804c9f33b20b
SHA1

c2d63982137adcd289270907674dc7733641c960
SHA256

1a5f854f9d6fe3543c633191c80c690d7b725ce720d631db9380536bf3f00eff
SHA512

579ccd6a1aae72013ca8dbea22f0811c0891c98f4b416d193d718d29bae98f7d6c822b7641fa2fc2e867931a208de64d71b6c3c4f4a2b59358179100b93175ba
SSDEEP

12288:5Iny5DYTmIRawvRHnQSgBxlXe6kvM8Gjh3t2SopMsIPSvsICoI6LpPO:1UTmyawvRHnQpxXPk08G7Y5RsICoIApm

Score

8^/10

discovery

Malware Config

Signatures

Drops file in Drivers directory 1 IoCs

Processes:

1a5f854f9d6fe3543c633191c80c690d7b725ce720d631db9380536bf3f00eff.exe

description ioc process

File created C:\Windows\system32\drivers\nethfdrv.sys 1a5f854f9d6fe3543c633191c80c690d7b725ce720d631db9380536bf3f00eff.exe
Executes dropped EXE 5 IoCs

Processes:

installd.exenethtsrv.exenetupdsrv.exenethtsrv.exenetupdsrv.exe

pid process

572 installd.exe
1680 nethtsrv.exe
916 netupdsrv.exe
1984 nethtsrv.exe
1944 netupdsrv.exe

description	ioc	process
File created	C:\Windows\system32\drivers\nethfdrv.sys	1a5f854f9d6fe3543c633191c80c690d7b725ce720d631db9380536bf3f00eff.exe

pid	process
572	installd.exe
1680	nethtsrv.exe
916	netupdsrv.exe
1984	nethtsrv.exe
1944	netupdsrv.exe

Loads dropped DLL 13 IoCs

Processes:

1a5f854f9d6fe3543c633191c80c690d7b725ce720d631db9380536bf3f00eff.exeinstalld.exenethtsrv.exenethtsrv.exe

pid	process
1284	1a5f854f9d6fe3543c633191c80c690d7b725ce720d631db9380536bf3f00eff.exe
1284	1a5f854f9d6fe3543c633191c80c690d7b725ce720d631db9380536bf3f00eff.exe
1284	1a5f854f9d6fe3543c633191c80c690d7b725ce720d631db9380536bf3f00eff.exe
1284	1a5f854f9d6fe3543c633191c80c690d7b725ce720d631db9380536bf3f00eff.exe
572	installd.exe
1284	1a5f854f9d6fe3543c633191c80c690d7b725ce720d631db9380536bf3f00eff.exe
1680	nethtsrv.exe
1680	nethtsrv.exe
1284	1a5f854f9d6fe3543c633191c80c690d7b725ce720d631db9380536bf3f00eff.exe
1284	1a5f854f9d6fe3543c633191c80c690d7b725ce720d631db9380536bf3f00eff.exe
1984	nethtsrv.exe
1984	nethtsrv.exe
1284	1a5f854f9d6fe3543c633191c80c690d7b725ce720d631db9380536bf3f00eff.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in System32 directory 5 IoCs

Processes:

1a5f854f9d6fe3543c633191c80c690d7b725ce720d631db9380536bf3f00eff.exe

description	ioc	process
File created	C:\Windows\SysWOW64\nethtsrv.exe	1a5f854f9d6fe3543c633191c80c690d7b725ce720d631db9380536bf3f00eff.exe
File created	C:\Windows\SysWOW64\netupdsrv.exe	1a5f854f9d6fe3543c633191c80c690d7b725ce720d631db9380536bf3f00eff.exe
File created	C:\Windows\SysWOW64\hfnapi.dll	1a5f854f9d6fe3543c633191c80c690d7b725ce720d631db9380536bf3f00eff.exe
File created	C:\Windows\SysWOW64\hfpapi.dll	1a5f854f9d6fe3543c633191c80c690d7b725ce720d631db9380536bf3f00eff.exe
File created	C:\Windows\SysWOW64\installd.exe	1a5f854f9d6fe3543c633191c80c690d7b725ce720d631db9380536bf3f00eff.exe

Drops file in Program Files directory 3 IoCs

Processes:

1a5f854f9d6fe3543c633191c80c690d7b725ce720d631db9380536bf3f00eff.exe

description	ioc	process
File created	C:\Program Files (x86)\Common Files\Config\data.xml	1a5f854f9d6fe3543c633191c80c690d7b725ce720d631db9380536bf3f00eff.exe
File created	C:\Program Files (x86)\Common Files\Config\ver.xml	1a5f854f9d6fe3543c633191c80c690d7b725ce720d631db9380536bf3f00eff.exe
File created	C:\Program Files (x86)\Common Files\config\uninstinethnfd.exe	1a5f854f9d6fe3543c633191c80c690d7b725ce720d631db9380536bf3f00eff.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Runs net.exe
Suspicious behavior: LoadsDriver 1 IoCs

Processes:

pid process

464
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

nethtsrv.exe

description pid process

Token: SeDebugPrivilege 1984 nethtsrv.exe

pid	process
464

description	pid	process
Token: SeDebugPrivilege	1984	nethtsrv.exe

Suspicious use of WriteProcessMemory 50 IoCs

Processes:

1a5f854f9d6fe3543c633191c80c690d7b725ce720d631db9380536bf3f00eff.exenet.exenet.exenet.exenet.exe

description	pid	process	target process
PID 1284 wrote to memory of 840	1284	1a5f854f9d6fe3543c633191c80c690d7b725ce720d631db9380536bf3f00eff.exe	net.exe
PID 1284 wrote to memory of 840	1284	1a5f854f9d6fe3543c633191c80c690d7b725ce720d631db9380536bf3f00eff.exe	net.exe
PID 1284 wrote to memory of 840	1284	1a5f854f9d6fe3543c633191c80c690d7b725ce720d631db9380536bf3f00eff.exe	net.exe
PID 1284 wrote to memory of 840	1284	1a5f854f9d6fe3543c633191c80c690d7b725ce720d631db9380536bf3f00eff.exe	net.exe
PID 840 wrote to memory of 1668	840	net.exe	net1.exe
PID 840 wrote to memory of 1668	840	net.exe	net1.exe
PID 840 wrote to memory of 1668	840	net.exe	net1.exe
PID 840 wrote to memory of 1668	840	net.exe	net1.exe
PID 1284 wrote to memory of 1148	1284	1a5f854f9d6fe3543c633191c80c690d7b725ce720d631db9380536bf3f00eff.exe	net.exe
PID 1284 wrote to memory of 1148	1284	1a5f854f9d6fe3543c633191c80c690d7b725ce720d631db9380536bf3f00eff.exe	net.exe
PID 1284 wrote to memory of 1148	1284	1a5f854f9d6fe3543c633191c80c690d7b725ce720d631db9380536bf3f00eff.exe	net.exe
PID 1284 wrote to memory of 1148	1284	1a5f854f9d6fe3543c633191c80c690d7b725ce720d631db9380536bf3f00eff.exe	net.exe
PID 1148 wrote to memory of 1108	1148	net.exe	net1.exe
PID 1148 wrote to memory of 1108	1148	net.exe	net1.exe
PID 1148 wrote to memory of 1108	1148	net.exe	net1.exe
PID 1148 wrote to memory of 1108	1148	net.exe	net1.exe
PID 1284 wrote to memory of 572	1284	1a5f854f9d6fe3543c633191c80c690d7b725ce720d631db9380536bf3f00eff.exe	installd.exe
PID 1284 wrote to memory of 572	1284	1a5f854f9d6fe3543c633191c80c690d7b725ce720d631db9380536bf3f00eff.exe	installd.exe
PID 1284 wrote to memory of 572	1284	1a5f854f9d6fe3543c633191c80c690d7b725ce720d631db9380536bf3f00eff.exe	installd.exe
PID 1284 wrote to memory of 572	1284	1a5f854f9d6fe3543c633191c80c690d7b725ce720d631db9380536bf3f00eff.exe	installd.exe
PID 1284 wrote to memory of 572	1284	1a5f854f9d6fe3543c633191c80c690d7b725ce720d631db9380536bf3f00eff.exe	installd.exe
PID 1284 wrote to memory of 572	1284	1a5f854f9d6fe3543c633191c80c690d7b725ce720d631db9380536bf3f00eff.exe	installd.exe
PID 1284 wrote to memory of 572	1284	1a5f854f9d6fe3543c633191c80c690d7b725ce720d631db9380536bf3f00eff.exe	installd.exe
PID 1284 wrote to memory of 1680	1284	1a5f854f9d6fe3543c633191c80c690d7b725ce720d631db9380536bf3f00eff.exe	nethtsrv.exe
PID 1284 wrote to memory of 1680	1284	1a5f854f9d6fe3543c633191c80c690d7b725ce720d631db9380536bf3f00eff.exe	nethtsrv.exe
PID 1284 wrote to memory of 1680	1284	1a5f854f9d6fe3543c633191c80c690d7b725ce720d631db9380536bf3f00eff.exe	nethtsrv.exe
PID 1284 wrote to memory of 1680	1284	1a5f854f9d6fe3543c633191c80c690d7b725ce720d631db9380536bf3f00eff.exe	nethtsrv.exe
PID 1284 wrote to memory of 916	1284	1a5f854f9d6fe3543c633191c80c690d7b725ce720d631db9380536bf3f00eff.exe	netupdsrv.exe
PID 1284 wrote to memory of 916	1284	1a5f854f9d6fe3543c633191c80c690d7b725ce720d631db9380536bf3f00eff.exe	netupdsrv.exe
PID 1284 wrote to memory of 916	1284	1a5f854f9d6fe3543c633191c80c690d7b725ce720d631db9380536bf3f00eff.exe	netupdsrv.exe
PID 1284 wrote to memory of 916	1284	1a5f854f9d6fe3543c633191c80c690d7b725ce720d631db9380536bf3f00eff.exe	netupdsrv.exe
PID 1284 wrote to memory of 916	1284	1a5f854f9d6fe3543c633191c80c690d7b725ce720d631db9380536bf3f00eff.exe	netupdsrv.exe
PID 1284 wrote to memory of 916	1284	1a5f854f9d6fe3543c633191c80c690d7b725ce720d631db9380536bf3f00eff.exe	netupdsrv.exe
PID 1284 wrote to memory of 916	1284	1a5f854f9d6fe3543c633191c80c690d7b725ce720d631db9380536bf3f00eff.exe	netupdsrv.exe
PID 1284 wrote to memory of 2016	1284	1a5f854f9d6fe3543c633191c80c690d7b725ce720d631db9380536bf3f00eff.exe	net.exe
PID 1284 wrote to memory of 2016	1284	1a5f854f9d6fe3543c633191c80c690d7b725ce720d631db9380536bf3f00eff.exe	net.exe
PID 1284 wrote to memory of 2016	1284	1a5f854f9d6fe3543c633191c80c690d7b725ce720d631db9380536bf3f00eff.exe	net.exe
PID 1284 wrote to memory of 2016	1284	1a5f854f9d6fe3543c633191c80c690d7b725ce720d631db9380536bf3f00eff.exe	net.exe
PID 2016 wrote to memory of 1968	2016	net.exe	net1.exe
PID 2016 wrote to memory of 1968	2016	net.exe	net1.exe
PID 2016 wrote to memory of 1968	2016	net.exe	net1.exe
PID 2016 wrote to memory of 1968	2016	net.exe	net1.exe
PID 1284 wrote to memory of 528	1284	1a5f854f9d6fe3543c633191c80c690d7b725ce720d631db9380536bf3f00eff.exe	net.exe
PID 1284 wrote to memory of 528	1284	1a5f854f9d6fe3543c633191c80c690d7b725ce720d631db9380536bf3f00eff.exe	net.exe
PID 1284 wrote to memory of 528	1284	1a5f854f9d6fe3543c633191c80c690d7b725ce720d631db9380536bf3f00eff.exe	net.exe
PID 1284 wrote to memory of 528	1284	1a5f854f9d6fe3543c633191c80c690d7b725ce720d631db9380536bf3f00eff.exe	net.exe
PID 528 wrote to memory of 1776	528	net.exe	net1.exe
PID 528 wrote to memory of 1776	528	net.exe	net1.exe
PID 528 wrote to memory of 1776	528	net.exe	net1.exe
PID 528 wrote to memory of 1776	528	net.exe	net1.exe

C:\Users\Admin\AppData\Local\Temp\1a5f854f9d6fe3543c633191c80c690d7b725ce720d631db9380536bf3f00eff.exe
"C:\Users\Admin\AppData\Local\Temp\1a5f854f9d6fe3543c633191c80c690d7b725ce720d631db9380536bf3f00eff.exe"
1⤵
- Drops file in Drivers directory
- Loads dropped DLL
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:1284

C:\Windows\SysWOW64\net.exe
net stop nethttpservice
2⤵
- Suspicious use of WriteProcessMemory
PID:840

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop nethttpservice
3⤵
PID:1668

C:\Windows\SysWOW64\net.exe
net stop serviceupdater
2⤵
- Suspicious use of WriteProcessMemory
PID:1148

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop serviceupdater
3⤵
PID:1108

C:\Windows\SysWOW64\installd.exe
"C:\Windows\system32\installd.exe" nethfdrv
2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:572

C:\Windows\SysWOW64\nethtsrv.exe
"C:\Windows\system32\nethtsrv.exe" -nfdi
2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1680

C:\Windows\SysWOW64\netupdsrv.exe
"C:\Windows\system32\netupdsrv.exe" -nfdi
2⤵
- Executes dropped EXE
PID:916

C:\Windows\SysWOW64\net.exe
net start nethttpservice
2⤵
- Suspicious use of WriteProcessMemory
PID:2016

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 start nethttpservice
3⤵
PID:1968

C:\Windows\SysWOW64\net.exe
net start serviceupdater
2⤵
- Suspicious use of WriteProcessMemory
PID:528

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 start serviceupdater
3⤵
PID:1776

C:\Windows\SysWOW64\nethtsrv.exe
C:\Windows\SysWOW64\nethtsrv.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:1984

C:\Windows\SysWOW64\netupdsrv.exe
C:\Windows\SysWOW64\netupdsrv.exe
1⤵
- Executes dropped EXE
PID:1944

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\hfnapi.dll
Filesize
106KB

MD5
f009d007b668ea1f626e26ee4b86fd56

SHA1
6c8572d88ff3b8aaaa6471473ad768272176f868

SHA256
030bf227495cb0669910f38e49f242fd2b86c08eb05b297aa0568961ab158809

SHA512
0e7e307d05015bc401e4adcde5ecef33f2b37b705116c2fa12501f942b2f9c769d6598e3390411ced02ea073d078e1a1638635e10e28437783cba4b9f2bddcd9

Download Submit
C:\Windows\SysWOW64\hfpapi.dll
Filesize
244KB

MD5
97229141c168654ed50ee5c12e60a2f5

SHA1
6344cd5afb507fc901b81068d3878e0a7c98a4ee

SHA256
180c8dec2991e7cec163988fe06ec2953a7dfc5ac8423602756c176fb8dae0ed

SHA512
fd0a6962dc7a1e6c637320ca7d302fccde7b41302b9cc1fce861d927ace7075aa7bde7f58b9bd793f7888a6158482627b6cd3f859816cc228e1f7e1e1194a2f1

Download Submit
C:\Windows\SysWOW64\installd.exe
Filesize
108KB

MD5
336c403f161001776e3291996db53e95

SHA1
31194a9a7c98bf55d7e850a6ea554b90fea86b7c

SHA256
aa008b697052b2dfb78e286e0004fabffed3ff41bbd5df558972921ab00ce8a8

SHA512
68fa942e7a89497bc815322008def597a1a3c4555541737113f430855a14f886102f8f870560018b215a517591864f80f3ae29efd5152f040b52b95dbf649900

Download Submit
C:\Windows\SysWOW64\nethtsrv.exe
Filesize
176KB

MD5
026dcf299e891653ab33f2f617a7cf98

SHA1
8d68a30b0e836ba4fa7848652cacdb5dcb3d7be5

SHA256
61bf67f649d4e92f6e18880a459a041d2da7e080d63abff7f63a14c4e682795b

SHA512
86fff40f7661070303232b9f6ae1b4e2d710c87af1017e7e2c629f3b703ad36d61470c3ebd26610597fa00309335c2d797c0114475c7fde143c2fccea418f500

Download Submit
C:\Windows\SysWOW64\nethtsrv.exe
Filesize
176KB

MD5
026dcf299e891653ab33f2f617a7cf98

SHA1
8d68a30b0e836ba4fa7848652cacdb5dcb3d7be5

SHA256
61bf67f649d4e92f6e18880a459a041d2da7e080d63abff7f63a14c4e682795b

SHA512
86fff40f7661070303232b9f6ae1b4e2d710c87af1017e7e2c629f3b703ad36d61470c3ebd26610597fa00309335c2d797c0114475c7fde143c2fccea418f500

Download Submit
C:\Windows\SysWOW64\netupdsrv.exe
Filesize
158KB

MD5
65b636350452307b0ad02a041ef35020

SHA1
f90d02f5013a95d16d9568c6d72b5dc95856c36f

SHA256
0bfbdd7b4b546def001efe982473916b8f79010f418057304027656e5d91d1aa

SHA512
86803dec7681e465f82612ff3d8e42d26964067eecf36386aa22940c97ea8407d13a4788a7347226e6d8e1c2c62a8a8862f9c26d0132b5bfed85689086858f00

Download Submit
C:\Windows\SysWOW64\netupdsrv.exe
Filesize
158KB

MD5
65b636350452307b0ad02a041ef35020

SHA1
f90d02f5013a95d16d9568c6d72b5dc95856c36f

SHA256
0bfbdd7b4b546def001efe982473916b8f79010f418057304027656e5d91d1aa

SHA512
86803dec7681e465f82612ff3d8e42d26964067eecf36386aa22940c97ea8407d13a4788a7347226e6d8e1c2c62a8a8862f9c26d0132b5bfed85689086858f00

Download Submit
\Users\Admin\AppData\Local\Temp\nstFFB.tmp\System.dll
Filesize
11KB

MD5
c17103ae9072a06da581dec998343fc1

SHA1
b72148c6bdfaada8b8c3f950e610ee7cf1da1f8d

SHA256
dc58d8ad81cacb0c1ed72e33bff8f23ea40b5252b5bb55d393a0903e6819ae2f

SHA512
d32a71aaef18e993f28096d536e41c4d016850721b31171513ce28bbd805a54fd290b7c3e9d935f72e676a1acfb4f0dcc89d95040a0dd29f2b6975855c18986f

Download Submit
\Users\Admin\AppData\Local\Temp\nstFFB.tmp\nsExec.dll
Filesize
6KB

MD5
acc2b699edfea5bf5aae45aba3a41e96

SHA1
d2accf4d494e43ceb2cff69abe4dd17147d29cc2

SHA256
168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e

SHA512
e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe

Download Submit
\Users\Admin\AppData\Local\Temp\nstFFB.tmp\nsExec.dll
Filesize
6KB

MD5
acc2b699edfea5bf5aae45aba3a41e96

SHA1
d2accf4d494e43ceb2cff69abe4dd17147d29cc2

SHA256
168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e

SHA512
e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe

Download Submit
\Users\Admin\AppData\Local\Temp\nstFFB.tmp\nsExec.dll
Filesize
6KB

MD5
acc2b699edfea5bf5aae45aba3a41e96

SHA1
d2accf4d494e43ceb2cff69abe4dd17147d29cc2

SHA256
168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e

SHA512
e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe

Download Submit
\Users\Admin\AppData\Local\Temp\nstFFB.tmp\nsExec.dll
Filesize
6KB

MD5
acc2b699edfea5bf5aae45aba3a41e96

SHA1
d2accf4d494e43ceb2cff69abe4dd17147d29cc2

SHA256
168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e

SHA512
e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe

Download Submit
\Windows\SysWOW64\hfnapi.dll
Filesize
106KB

MD5
f009d007b668ea1f626e26ee4b86fd56

SHA1
6c8572d88ff3b8aaaa6471473ad768272176f868

SHA256
030bf227495cb0669910f38e49f242fd2b86c08eb05b297aa0568961ab158809

SHA512
0e7e307d05015bc401e4adcde5ecef33f2b37b705116c2fa12501f942b2f9c769d6598e3390411ced02ea073d078e1a1638635e10e28437783cba4b9f2bddcd9

Download Submit
\Windows\SysWOW64\hfnapi.dll
Filesize
106KB

MD5
f009d007b668ea1f626e26ee4b86fd56

SHA1
6c8572d88ff3b8aaaa6471473ad768272176f868

SHA256
030bf227495cb0669910f38e49f242fd2b86c08eb05b297aa0568961ab158809

SHA512
0e7e307d05015bc401e4adcde5ecef33f2b37b705116c2fa12501f942b2f9c769d6598e3390411ced02ea073d078e1a1638635e10e28437783cba4b9f2bddcd9

Download Submit
\Windows\SysWOW64\hfnapi.dll
Filesize
106KB

MD5
f009d007b668ea1f626e26ee4b86fd56

SHA1
6c8572d88ff3b8aaaa6471473ad768272176f868

SHA256
030bf227495cb0669910f38e49f242fd2b86c08eb05b297aa0568961ab158809

SHA512
0e7e307d05015bc401e4adcde5ecef33f2b37b705116c2fa12501f942b2f9c769d6598e3390411ced02ea073d078e1a1638635e10e28437783cba4b9f2bddcd9

Download Submit
\Windows\SysWOW64\hfpapi.dll
Filesize
244KB

MD5
97229141c168654ed50ee5c12e60a2f5

SHA1
6344cd5afb507fc901b81068d3878e0a7c98a4ee

SHA256
180c8dec2991e7cec163988fe06ec2953a7dfc5ac8423602756c176fb8dae0ed

SHA512
fd0a6962dc7a1e6c637320ca7d302fccde7b41302b9cc1fce861d927ace7075aa7bde7f58b9bd793f7888a6158482627b6cd3f859816cc228e1f7e1e1194a2f1

Download Submit
\Windows\SysWOW64\hfpapi.dll
Filesize
244KB

MD5
97229141c168654ed50ee5c12e60a2f5

SHA1
6344cd5afb507fc901b81068d3878e0a7c98a4ee

SHA256
180c8dec2991e7cec163988fe06ec2953a7dfc5ac8423602756c176fb8dae0ed

SHA512
fd0a6962dc7a1e6c637320ca7d302fccde7b41302b9cc1fce861d927ace7075aa7bde7f58b9bd793f7888a6158482627b6cd3f859816cc228e1f7e1e1194a2f1

Download Submit
\Windows\SysWOW64\installd.exe
Filesize
108KB

MD5
336c403f161001776e3291996db53e95

SHA1
31194a9a7c98bf55d7e850a6ea554b90fea86b7c

SHA256
aa008b697052b2dfb78e286e0004fabffed3ff41bbd5df558972921ab00ce8a8

SHA512
68fa942e7a89497bc815322008def597a1a3c4555541737113f430855a14f886102f8f870560018b215a517591864f80f3ae29efd5152f040b52b95dbf649900

Download Submit
\Windows\SysWOW64\nethtsrv.exe
Filesize
176KB

MD5
026dcf299e891653ab33f2f617a7cf98

SHA1
8d68a30b0e836ba4fa7848652cacdb5dcb3d7be5

SHA256
61bf67f649d4e92f6e18880a459a041d2da7e080d63abff7f63a14c4e682795b

SHA512
86fff40f7661070303232b9f6ae1b4e2d710c87af1017e7e2c629f3b703ad36d61470c3ebd26610597fa00309335c2d797c0114475c7fde143c2fccea418f500

Download Submit
\Windows\SysWOW64\netupdsrv.exe
Filesize
158KB

MD5
65b636350452307b0ad02a041ef35020

SHA1
f90d02f5013a95d16d9568c6d72b5dc95856c36f

SHA256
0bfbdd7b4b546def001efe982473916b8f79010f418057304027656e5d91d1aa

SHA512
86803dec7681e465f82612ff3d8e42d26964067eecf36386aa22940c97ea8407d13a4788a7347226e6d8e1c2c62a8a8862f9c26d0132b5bfed85689086858f00

Download Submit
memory/528-86-0x0000000000000000-mapping.dmp

Download
memory/572-64-0x0000000000000000-mapping.dmp

Download
memory/840-57-0x0000000000000000-mapping.dmp

Download
memory/916-76-0x0000000000000000-mapping.dmp

Download
memory/1108-62-0x0000000000000000-mapping.dmp

Download
memory/1148-61-0x0000000000000000-mapping.dmp

Download
memory/1284-54-0x0000000075931000-0x0000000075933000-memory.dmp

Filesize
8KB

Download
memory/1284-59-0x0000000000360000-0x00000000007BE000-memory.dmp

Filesize
4.4MB

Download
memory/1284-90-0x0000000000360000-0x00000000007BE000-memory.dmp

Filesize
4.4MB

Download
memory/1668-58-0x0000000000000000-mapping.dmp

Download
memory/1680-70-0x0000000000000000-mapping.dmp

Download
memory/1776-87-0x0000000000000000-mapping.dmp

Download
memory/1968-81-0x0000000000000000-mapping.dmp

Download
memory/2016-80-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads