276ccee26e501d867ffbcc60b2c9dfd0721143eb78e352595117c68d8f131454

Analysis

max time kernel
9s
max time network
46s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
23-11-2022 10:31

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

276ccee26e501d867ffbcc60b2c9dfd0721143eb78e352595117c68d8f131454.exe
Size

602KB
MD5

caf9124c87ff46d6807368c61f2d37ca
SHA1

0da0fd0425b85e7c8a9ddd9dd99205e90352f897
SHA256

276ccee26e501d867ffbcc60b2c9dfd0721143eb78e352595117c68d8f131454
SHA512

6836ad6be34d384fe8e76016f719874b09e89c0fdc134d3cc24b024f5ec447efc76c4c7a691da596ebfc3e1cd0ca11649e6968700f13ebbef2f9b8446c9d2591
SSDEEP

12288:YIny5DYTfSeXG3yVgweHFPmlqwJs1Oz+lkyvU3dkTq:2UTfSeXGgg9/+/zFyvUdC

Score

8^/10

discovery

Malware Config

Signatures

Drops file in Drivers directory 1 IoCs

Processes:

276ccee26e501d867ffbcc60b2c9dfd0721143eb78e352595117c68d8f131454.exe

description ioc process

File created C:\Windows\system32\drivers\nethfdrv.sys 276ccee26e501d867ffbcc60b2c9dfd0721143eb78e352595117c68d8f131454.exe
Executes dropped EXE 5 IoCs

Processes:

installd.exenethtsrv.exenetupdsrv.exenethtsrv.exenetupdsrv.exe

pid process

1988 installd.exe
1200 nethtsrv.exe
1364 netupdsrv.exe
1924 nethtsrv.exe
1500 netupdsrv.exe

description	ioc	process
File created	C:\Windows\system32\drivers\nethfdrv.sys	276ccee26e501d867ffbcc60b2c9dfd0721143eb78e352595117c68d8f131454.exe

pid	process
1988	installd.exe
1200	nethtsrv.exe
1364	netupdsrv.exe
1924	nethtsrv.exe
1500	netupdsrv.exe

Loads dropped DLL 13 IoCs

Processes:

276ccee26e501d867ffbcc60b2c9dfd0721143eb78e352595117c68d8f131454.exeinstalld.exenethtsrv.exenethtsrv.exe

pid	process
1680	276ccee26e501d867ffbcc60b2c9dfd0721143eb78e352595117c68d8f131454.exe
1680	276ccee26e501d867ffbcc60b2c9dfd0721143eb78e352595117c68d8f131454.exe
1680	276ccee26e501d867ffbcc60b2c9dfd0721143eb78e352595117c68d8f131454.exe
1680	276ccee26e501d867ffbcc60b2c9dfd0721143eb78e352595117c68d8f131454.exe
1988	installd.exe
1680	276ccee26e501d867ffbcc60b2c9dfd0721143eb78e352595117c68d8f131454.exe
1200	nethtsrv.exe
1200	nethtsrv.exe
1680	276ccee26e501d867ffbcc60b2c9dfd0721143eb78e352595117c68d8f131454.exe
1680	276ccee26e501d867ffbcc60b2c9dfd0721143eb78e352595117c68d8f131454.exe
1924	nethtsrv.exe
1924	nethtsrv.exe
1680	276ccee26e501d867ffbcc60b2c9dfd0721143eb78e352595117c68d8f131454.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in System32 directory 5 IoCs

Processes:

276ccee26e501d867ffbcc60b2c9dfd0721143eb78e352595117c68d8f131454.exe

description	ioc	process
File created	C:\Windows\SysWOW64\netupdsrv.exe	276ccee26e501d867ffbcc60b2c9dfd0721143eb78e352595117c68d8f131454.exe
File created	C:\Windows\SysWOW64\hfnapi.dll	276ccee26e501d867ffbcc60b2c9dfd0721143eb78e352595117c68d8f131454.exe
File created	C:\Windows\SysWOW64\hfpapi.dll	276ccee26e501d867ffbcc60b2c9dfd0721143eb78e352595117c68d8f131454.exe
File created	C:\Windows\SysWOW64\installd.exe	276ccee26e501d867ffbcc60b2c9dfd0721143eb78e352595117c68d8f131454.exe
File created	C:\Windows\SysWOW64\nethtsrv.exe	276ccee26e501d867ffbcc60b2c9dfd0721143eb78e352595117c68d8f131454.exe

Drops file in Program Files directory 3 IoCs

Processes:

276ccee26e501d867ffbcc60b2c9dfd0721143eb78e352595117c68d8f131454.exe

description	ioc	process
File created	C:\Program Files (x86)\Common Files\config\uninstinethnfd.exe	276ccee26e501d867ffbcc60b2c9dfd0721143eb78e352595117c68d8f131454.exe
File created	C:\Program Files (x86)\Common Files\Config\data.xml	276ccee26e501d867ffbcc60b2c9dfd0721143eb78e352595117c68d8f131454.exe
File created	C:\Program Files (x86)\Common Files\Config\ver.xml	276ccee26e501d867ffbcc60b2c9dfd0721143eb78e352595117c68d8f131454.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Runs net.exe
Suspicious behavior: LoadsDriver 1 IoCs

Processes:

pid process

464
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

nethtsrv.exe

description pid process

Token: SeDebugPrivilege 1924 nethtsrv.exe

pid	process
464

description	pid	process
Token: SeDebugPrivilege	1924	nethtsrv.exe

Suspicious use of WriteProcessMemory 50 IoCs

Processes:

276ccee26e501d867ffbcc60b2c9dfd0721143eb78e352595117c68d8f131454.exenet.exenet.exenet.exenet.exe

description	pid	process	target process
PID 1680 wrote to memory of 1480	1680	276ccee26e501d867ffbcc60b2c9dfd0721143eb78e352595117c68d8f131454.exe	net.exe
PID 1680 wrote to memory of 1480	1680	276ccee26e501d867ffbcc60b2c9dfd0721143eb78e352595117c68d8f131454.exe	net.exe
PID 1680 wrote to memory of 1480	1680	276ccee26e501d867ffbcc60b2c9dfd0721143eb78e352595117c68d8f131454.exe	net.exe
PID 1680 wrote to memory of 1480	1680	276ccee26e501d867ffbcc60b2c9dfd0721143eb78e352595117c68d8f131454.exe	net.exe
PID 1480 wrote to memory of 1724	1480	net.exe	net1.exe
PID 1480 wrote to memory of 1724	1480	net.exe	net1.exe
PID 1480 wrote to memory of 1724	1480	net.exe	net1.exe
PID 1480 wrote to memory of 1724	1480	net.exe	net1.exe
PID 1680 wrote to memory of 2024	1680	276ccee26e501d867ffbcc60b2c9dfd0721143eb78e352595117c68d8f131454.exe	net.exe
PID 1680 wrote to memory of 2024	1680	276ccee26e501d867ffbcc60b2c9dfd0721143eb78e352595117c68d8f131454.exe	net.exe
PID 1680 wrote to memory of 2024	1680	276ccee26e501d867ffbcc60b2c9dfd0721143eb78e352595117c68d8f131454.exe	net.exe
PID 1680 wrote to memory of 2024	1680	276ccee26e501d867ffbcc60b2c9dfd0721143eb78e352595117c68d8f131454.exe	net.exe
PID 2024 wrote to memory of 1720	2024	net.exe	net1.exe
PID 2024 wrote to memory of 1720	2024	net.exe	net1.exe
PID 2024 wrote to memory of 1720	2024	net.exe	net1.exe
PID 2024 wrote to memory of 1720	2024	net.exe	net1.exe
PID 1680 wrote to memory of 1988	1680	276ccee26e501d867ffbcc60b2c9dfd0721143eb78e352595117c68d8f131454.exe	installd.exe
PID 1680 wrote to memory of 1988	1680	276ccee26e501d867ffbcc60b2c9dfd0721143eb78e352595117c68d8f131454.exe	installd.exe
PID 1680 wrote to memory of 1988	1680	276ccee26e501d867ffbcc60b2c9dfd0721143eb78e352595117c68d8f131454.exe	installd.exe
PID 1680 wrote to memory of 1988	1680	276ccee26e501d867ffbcc60b2c9dfd0721143eb78e352595117c68d8f131454.exe	installd.exe
PID 1680 wrote to memory of 1988	1680	276ccee26e501d867ffbcc60b2c9dfd0721143eb78e352595117c68d8f131454.exe	installd.exe
PID 1680 wrote to memory of 1988	1680	276ccee26e501d867ffbcc60b2c9dfd0721143eb78e352595117c68d8f131454.exe	installd.exe
PID 1680 wrote to memory of 1988	1680	276ccee26e501d867ffbcc60b2c9dfd0721143eb78e352595117c68d8f131454.exe	installd.exe
PID 1680 wrote to memory of 1200	1680	276ccee26e501d867ffbcc60b2c9dfd0721143eb78e352595117c68d8f131454.exe	nethtsrv.exe
PID 1680 wrote to memory of 1200	1680	276ccee26e501d867ffbcc60b2c9dfd0721143eb78e352595117c68d8f131454.exe	nethtsrv.exe
PID 1680 wrote to memory of 1200	1680	276ccee26e501d867ffbcc60b2c9dfd0721143eb78e352595117c68d8f131454.exe	nethtsrv.exe
PID 1680 wrote to memory of 1200	1680	276ccee26e501d867ffbcc60b2c9dfd0721143eb78e352595117c68d8f131454.exe	nethtsrv.exe
PID 1680 wrote to memory of 1364	1680	276ccee26e501d867ffbcc60b2c9dfd0721143eb78e352595117c68d8f131454.exe	netupdsrv.exe
PID 1680 wrote to memory of 1364	1680	276ccee26e501d867ffbcc60b2c9dfd0721143eb78e352595117c68d8f131454.exe	netupdsrv.exe
PID 1680 wrote to memory of 1364	1680	276ccee26e501d867ffbcc60b2c9dfd0721143eb78e352595117c68d8f131454.exe	netupdsrv.exe
PID 1680 wrote to memory of 1364	1680	276ccee26e501d867ffbcc60b2c9dfd0721143eb78e352595117c68d8f131454.exe	netupdsrv.exe
PID 1680 wrote to memory of 1364	1680	276ccee26e501d867ffbcc60b2c9dfd0721143eb78e352595117c68d8f131454.exe	netupdsrv.exe
PID 1680 wrote to memory of 1364	1680	276ccee26e501d867ffbcc60b2c9dfd0721143eb78e352595117c68d8f131454.exe	netupdsrv.exe
PID 1680 wrote to memory of 1364	1680	276ccee26e501d867ffbcc60b2c9dfd0721143eb78e352595117c68d8f131454.exe	netupdsrv.exe
PID 1680 wrote to memory of 1920	1680	276ccee26e501d867ffbcc60b2c9dfd0721143eb78e352595117c68d8f131454.exe	net.exe
PID 1680 wrote to memory of 1920	1680	276ccee26e501d867ffbcc60b2c9dfd0721143eb78e352595117c68d8f131454.exe	net.exe
PID 1680 wrote to memory of 1920	1680	276ccee26e501d867ffbcc60b2c9dfd0721143eb78e352595117c68d8f131454.exe	net.exe
PID 1680 wrote to memory of 1920	1680	276ccee26e501d867ffbcc60b2c9dfd0721143eb78e352595117c68d8f131454.exe	net.exe
PID 1920 wrote to memory of 328	1920	net.exe	net1.exe
PID 1920 wrote to memory of 328	1920	net.exe	net1.exe
PID 1920 wrote to memory of 328	1920	net.exe	net1.exe
PID 1920 wrote to memory of 328	1920	net.exe	net1.exe
PID 1680 wrote to memory of 1180	1680	276ccee26e501d867ffbcc60b2c9dfd0721143eb78e352595117c68d8f131454.exe	net.exe
PID 1680 wrote to memory of 1180	1680	276ccee26e501d867ffbcc60b2c9dfd0721143eb78e352595117c68d8f131454.exe	net.exe
PID 1680 wrote to memory of 1180	1680	276ccee26e501d867ffbcc60b2c9dfd0721143eb78e352595117c68d8f131454.exe	net.exe
PID 1680 wrote to memory of 1180	1680	276ccee26e501d867ffbcc60b2c9dfd0721143eb78e352595117c68d8f131454.exe	net.exe
PID 1180 wrote to memory of 588	1180	net.exe	net1.exe
PID 1180 wrote to memory of 588	1180	net.exe	net1.exe
PID 1180 wrote to memory of 588	1180	net.exe	net1.exe
PID 1180 wrote to memory of 588	1180	net.exe	net1.exe

C:\Users\Admin\AppData\Local\Temp\276ccee26e501d867ffbcc60b2c9dfd0721143eb78e352595117c68d8f131454.exe
"C:\Users\Admin\AppData\Local\Temp\276ccee26e501d867ffbcc60b2c9dfd0721143eb78e352595117c68d8f131454.exe"
1⤵
- Drops file in Drivers directory
- Loads dropped DLL
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:1680

C:\Windows\SysWOW64\net.exe
net stop nethttpservice
2⤵
- Suspicious use of WriteProcessMemory
PID:1480

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop nethttpservice
3⤵
PID:1724

C:\Windows\SysWOW64\net.exe
net stop serviceupdater
2⤵
- Suspicious use of WriteProcessMemory
PID:2024

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop serviceupdater
3⤵
PID:1720

C:\Windows\SysWOW64\installd.exe
"C:\Windows\system32\installd.exe" nethfdrv
2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1988

C:\Windows\SysWOW64\nethtsrv.exe
"C:\Windows\system32\nethtsrv.exe" -nfdi
2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1200

C:\Windows\SysWOW64\netupdsrv.exe
"C:\Windows\system32\netupdsrv.exe" -nfdi
2⤵
- Executes dropped EXE
PID:1364

C:\Windows\SysWOW64\net.exe
net start nethttpservice
2⤵
- Suspicious use of WriteProcessMemory
PID:1920

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 start nethttpservice
3⤵
PID:328

C:\Windows\SysWOW64\net.exe
net start serviceupdater
2⤵
- Suspicious use of WriteProcessMemory
PID:1180

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 start serviceupdater
3⤵
PID:588

C:\Windows\SysWOW64\nethtsrv.exe
C:\Windows\SysWOW64\nethtsrv.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:1924

C:\Windows\SysWOW64\netupdsrv.exe
C:\Windows\SysWOW64\netupdsrv.exe
1⤵
- Executes dropped EXE
PID:1500

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\hfnapi.dll
Filesize
106KB

MD5
0b641bbf30a0387fdc0b2bc69ef70e73

SHA1
79f02330b587dcb61bc33638251548ba53aca1cc

SHA256
62bdd8c8bcb3d7dc5958a3ab5020f54153392facb08c317d3c16e555b99631e6

SHA512
82c8004fbe16c86fb1f6f5ba8df11fe4e30ea32a905fb86812da7c962b94e2f19afb315bf41cc6df05163702d13ae14a5b625be954d8319a3b883c011f4c67b8

Download Submit
C:\Windows\SysWOW64\hfpapi.dll
Filesize
244KB

MD5
7a676a854f7afd5de2dc9b345170a4e8

SHA1
642da582fe46edd482fa4d3ad9a6561d04f48870

SHA256
35d2ffbe525968098dcad12f8b2ea4f4b169b2c314eb815e11312b557fe0129f

SHA512
6eb60c6148e33faf3e59ec3547798137628a621a3bb73452362e22cff4e3d6ea67800a5717d12ab2155deb23e57762b7bd90eed1a0202686f1ebbe35ad2ff6b4

Download Submit
C:\Windows\SysWOW64\installd.exe
Filesize
108KB

MD5
31c84e6acfccc45fba89832b622ef8af

SHA1
57d0ad1ed3cc6eb36b05f2307af7f284e45a63d7

SHA256
94ff0d4ea2a5a8c6f2b8adeadcd52ba9b536e6663aad977af52e7db6f929338a

SHA512
cd00e21ca6c6e02c7ff30a269abe8fa1e891ce0f521f253cac819681455a786f0cdb9fe32890cbb6ae8039f20fb893b964210a287af615bff4d89c9a77fa7581

Download Submit
C:\Windows\SysWOW64\nethtsrv.exe
Filesize
176KB

MD5
51c0e213612be21824ede705cf768450

SHA1
0b48d6d95bd993112427108292232fd1673b6d49

SHA256
795b69777d60bef263a467d00b6642a4abb3e47bec14306822b8aeb53f46ec7a

SHA512
3b91aefbafbcf8e095d954d9a2c6ffcbace50e08a239f9c6019dabfec1016f6d94e17444104e4387eba8c60567126353146fa395633181aa1689c6f830b8a688

Download Submit
C:\Windows\SysWOW64\nethtsrv.exe
Filesize
176KB

MD5
51c0e213612be21824ede705cf768450

SHA1
0b48d6d95bd993112427108292232fd1673b6d49

SHA256
795b69777d60bef263a467d00b6642a4abb3e47bec14306822b8aeb53f46ec7a

SHA512
3b91aefbafbcf8e095d954d9a2c6ffcbace50e08a239f9c6019dabfec1016f6d94e17444104e4387eba8c60567126353146fa395633181aa1689c6f830b8a688

Download Submit
C:\Windows\SysWOW64\netupdsrv.exe
Filesize
158KB

MD5
884e05e0432396604bd147b1e54bca61

SHA1
dd95b331c77e8577e550c3a4e34e0f0ade937d6d

SHA256
e5673bfd7bc9d53a1d3a9e83a18332e15b7b54d0282da141f75b9329e891ff2a

SHA512
45f0fd9efc8f5757ccd11f822861f27422fe9948b4ae5f88e85ba92a0841d8191e29fe8770c6598fb160abc177ab9b49c2df1b423b8f101510da4a0b5c6685af

Download Submit
C:\Windows\SysWOW64\netupdsrv.exe
Filesize
158KB

MD5
884e05e0432396604bd147b1e54bca61

SHA1
dd95b331c77e8577e550c3a4e34e0f0ade937d6d

SHA256
e5673bfd7bc9d53a1d3a9e83a18332e15b7b54d0282da141f75b9329e891ff2a

SHA512
45f0fd9efc8f5757ccd11f822861f27422fe9948b4ae5f88e85ba92a0841d8191e29fe8770c6598fb160abc177ab9b49c2df1b423b8f101510da4a0b5c6685af

Download Submit
\Users\Admin\AppData\Local\Temp\nsj7AFD.tmp\System.dll
Filesize
11KB

MD5
c17103ae9072a06da581dec998343fc1

SHA1
b72148c6bdfaada8b8c3f950e610ee7cf1da1f8d

SHA256
dc58d8ad81cacb0c1ed72e33bff8f23ea40b5252b5bb55d393a0903e6819ae2f

SHA512
d32a71aaef18e993f28096d536e41c4d016850721b31171513ce28bbd805a54fd290b7c3e9d935f72e676a1acfb4f0dcc89d95040a0dd29f2b6975855c18986f

Download Submit
\Users\Admin\AppData\Local\Temp\nsj7AFD.tmp\nsExec.dll
Filesize
6KB

MD5
acc2b699edfea5bf5aae45aba3a41e96

SHA1
d2accf4d494e43ceb2cff69abe4dd17147d29cc2

SHA256
168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e

SHA512
e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe

Download Submit
\Users\Admin\AppData\Local\Temp\nsj7AFD.tmp\nsExec.dll
Filesize
6KB

MD5
acc2b699edfea5bf5aae45aba3a41e96

SHA1
d2accf4d494e43ceb2cff69abe4dd17147d29cc2

SHA256
168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e

SHA512
e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe

Download Submit
\Users\Admin\AppData\Local\Temp\nsj7AFD.tmp\nsExec.dll
Filesize
6KB

MD5
acc2b699edfea5bf5aae45aba3a41e96

SHA1
d2accf4d494e43ceb2cff69abe4dd17147d29cc2

SHA256
168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e

SHA512
e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe

Download Submit
\Users\Admin\AppData\Local\Temp\nsj7AFD.tmp\nsExec.dll
Filesize
6KB

MD5
acc2b699edfea5bf5aae45aba3a41e96

SHA1
d2accf4d494e43ceb2cff69abe4dd17147d29cc2

SHA256
168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e

SHA512
e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe

Download Submit
\Windows\SysWOW64\hfnapi.dll
Filesize
106KB

MD5
0b641bbf30a0387fdc0b2bc69ef70e73

SHA1
79f02330b587dcb61bc33638251548ba53aca1cc

SHA256
62bdd8c8bcb3d7dc5958a3ab5020f54153392facb08c317d3c16e555b99631e6

SHA512
82c8004fbe16c86fb1f6f5ba8df11fe4e30ea32a905fb86812da7c962b94e2f19afb315bf41cc6df05163702d13ae14a5b625be954d8319a3b883c011f4c67b8

Download Submit
\Windows\SysWOW64\hfnapi.dll
Filesize
106KB

MD5
0b641bbf30a0387fdc0b2bc69ef70e73

SHA1
79f02330b587dcb61bc33638251548ba53aca1cc

SHA256
62bdd8c8bcb3d7dc5958a3ab5020f54153392facb08c317d3c16e555b99631e6

SHA512
82c8004fbe16c86fb1f6f5ba8df11fe4e30ea32a905fb86812da7c962b94e2f19afb315bf41cc6df05163702d13ae14a5b625be954d8319a3b883c011f4c67b8

Download Submit
\Windows\SysWOW64\hfnapi.dll
Filesize
106KB

MD5
0b641bbf30a0387fdc0b2bc69ef70e73

SHA1
79f02330b587dcb61bc33638251548ba53aca1cc

SHA256
62bdd8c8bcb3d7dc5958a3ab5020f54153392facb08c317d3c16e555b99631e6

SHA512
82c8004fbe16c86fb1f6f5ba8df11fe4e30ea32a905fb86812da7c962b94e2f19afb315bf41cc6df05163702d13ae14a5b625be954d8319a3b883c011f4c67b8

Download Submit
\Windows\SysWOW64\hfpapi.dll
Filesize
244KB

MD5
7a676a854f7afd5de2dc9b345170a4e8

SHA1
642da582fe46edd482fa4d3ad9a6561d04f48870

SHA256
35d2ffbe525968098dcad12f8b2ea4f4b169b2c314eb815e11312b557fe0129f

SHA512
6eb60c6148e33faf3e59ec3547798137628a621a3bb73452362e22cff4e3d6ea67800a5717d12ab2155deb23e57762b7bd90eed1a0202686f1ebbe35ad2ff6b4

Download Submit
\Windows\SysWOW64\hfpapi.dll
Filesize
244KB

MD5
7a676a854f7afd5de2dc9b345170a4e8

SHA1
642da582fe46edd482fa4d3ad9a6561d04f48870

SHA256
35d2ffbe525968098dcad12f8b2ea4f4b169b2c314eb815e11312b557fe0129f

SHA512
6eb60c6148e33faf3e59ec3547798137628a621a3bb73452362e22cff4e3d6ea67800a5717d12ab2155deb23e57762b7bd90eed1a0202686f1ebbe35ad2ff6b4

Download Submit
\Windows\SysWOW64\installd.exe
Filesize
108KB

MD5
31c84e6acfccc45fba89832b622ef8af

SHA1
57d0ad1ed3cc6eb36b05f2307af7f284e45a63d7

SHA256
94ff0d4ea2a5a8c6f2b8adeadcd52ba9b536e6663aad977af52e7db6f929338a

SHA512
cd00e21ca6c6e02c7ff30a269abe8fa1e891ce0f521f253cac819681455a786f0cdb9fe32890cbb6ae8039f20fb893b964210a287af615bff4d89c9a77fa7581

Download Submit
\Windows\SysWOW64\nethtsrv.exe
Filesize
176KB

MD5
51c0e213612be21824ede705cf768450

SHA1
0b48d6d95bd993112427108292232fd1673b6d49

SHA256
795b69777d60bef263a467d00b6642a4abb3e47bec14306822b8aeb53f46ec7a

SHA512
3b91aefbafbcf8e095d954d9a2c6ffcbace50e08a239f9c6019dabfec1016f6d94e17444104e4387eba8c60567126353146fa395633181aa1689c6f830b8a688

Download Submit
\Windows\SysWOW64\netupdsrv.exe
Filesize
158KB

MD5
884e05e0432396604bd147b1e54bca61

SHA1
dd95b331c77e8577e550c3a4e34e0f0ade937d6d

SHA256
e5673bfd7bc9d53a1d3a9e83a18332e15b7b54d0282da141f75b9329e891ff2a

SHA512
45f0fd9efc8f5757ccd11f822861f27422fe9948b4ae5f88e85ba92a0841d8191e29fe8770c6598fb160abc177ab9b49c2df1b423b8f101510da4a0b5c6685af

Download Submit
memory/328-81-0x0000000000000000-mapping.dmp

Download
memory/588-87-0x0000000000000000-mapping.dmp

Download
memory/1180-86-0x0000000000000000-mapping.dmp

Download
memory/1200-70-0x0000000000000000-mapping.dmp

Download
memory/1364-76-0x0000000000000000-mapping.dmp

Download
memory/1480-57-0x0000000000000000-mapping.dmp

Download
memory/1680-54-0x0000000075FB1000-0x0000000075FB3000-memory.dmp

Filesize
8KB

Download
memory/1680-59-0x0000000000360000-0x00000000007BE000-memory.dmp

Filesize
4.4MB

Download
memory/1680-90-0x0000000000360000-0x00000000007BE000-memory.dmp

Filesize
4.4MB

Download
memory/1720-62-0x0000000000000000-mapping.dmp

Download
memory/1724-58-0x0000000000000000-mapping.dmp

Download
memory/1920-80-0x0000000000000000-mapping.dmp

Download
memory/1988-64-0x0000000000000000-mapping.dmp

Download
memory/2024-61-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads