24ef7bb64e42b4d3d7b4e7f85f8b5f455776b19de727de7dc8c56cbdb3697489

Analysis

max time kernel
67s
max time network
30s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
23-11-2022 10:31

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

24ef7bb64e42b4d3d7b4e7f85f8b5f455776b19de727de7dc8c56cbdb3697489.exe
Size

603KB
MD5

8bac5eeca2660763a27184d551ee2254
SHA1

95fd12a61b9291010d7374c960e13d98628d30e6
SHA256

24ef7bb64e42b4d3d7b4e7f85f8b5f455776b19de727de7dc8c56cbdb3697489
SHA512

b04ace1816e9cb2d10b402a9666fbcac900b410470d5eac0fe980f59991a41482ac2c894db2e994307da29efb3d5ac9c94576de7a610f2c326c17aaf9ba7c393
SSDEEP

12288:zIny5DYTMEmG2w5Wl7Ar8zrTs0L23qQI0Lc9unnWpO:bUTMExYlbrTxqHIic8nK

Score

8^/10

discovery

Malware Config

Signatures

Drops file in Drivers directory 1 IoCs

Processes:

24ef7bb64e42b4d3d7b4e7f85f8b5f455776b19de727de7dc8c56cbdb3697489.exe

description ioc process

File created C:\Windows\system32\drivers\nethfdrv.sys 24ef7bb64e42b4d3d7b4e7f85f8b5f455776b19de727de7dc8c56cbdb3697489.exe
Executes dropped EXE 5 IoCs

Processes:

installd.exenethtsrv.exenetupdsrv.exenethtsrv.exenetupdsrv.exe

pid process

520 installd.exe
1548 nethtsrv.exe
1200 netupdsrv.exe
284 nethtsrv.exe
1956 netupdsrv.exe

description	ioc	process
File created	C:\Windows\system32\drivers\nethfdrv.sys	24ef7bb64e42b4d3d7b4e7f85f8b5f455776b19de727de7dc8c56cbdb3697489.exe

pid	process
520	installd.exe
1548	nethtsrv.exe
1200	netupdsrv.exe
284	nethtsrv.exe
1956	netupdsrv.exe

Loads dropped DLL 13 IoCs

Processes:

24ef7bb64e42b4d3d7b4e7f85f8b5f455776b19de727de7dc8c56cbdb3697489.exeinstalld.exenethtsrv.exenethtsrv.exe

pid	process
2040	24ef7bb64e42b4d3d7b4e7f85f8b5f455776b19de727de7dc8c56cbdb3697489.exe
2040	24ef7bb64e42b4d3d7b4e7f85f8b5f455776b19de727de7dc8c56cbdb3697489.exe
2040	24ef7bb64e42b4d3d7b4e7f85f8b5f455776b19de727de7dc8c56cbdb3697489.exe
2040	24ef7bb64e42b4d3d7b4e7f85f8b5f455776b19de727de7dc8c56cbdb3697489.exe
520	installd.exe
2040	24ef7bb64e42b4d3d7b4e7f85f8b5f455776b19de727de7dc8c56cbdb3697489.exe
1548	nethtsrv.exe
1548	nethtsrv.exe
2040	24ef7bb64e42b4d3d7b4e7f85f8b5f455776b19de727de7dc8c56cbdb3697489.exe
2040	24ef7bb64e42b4d3d7b4e7f85f8b5f455776b19de727de7dc8c56cbdb3697489.exe
284	nethtsrv.exe
284	nethtsrv.exe
2040	24ef7bb64e42b4d3d7b4e7f85f8b5f455776b19de727de7dc8c56cbdb3697489.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in System32 directory 5 IoCs

Processes:

24ef7bb64e42b4d3d7b4e7f85f8b5f455776b19de727de7dc8c56cbdb3697489.exe

description	ioc	process
File created	C:\Windows\SysWOW64\hfpapi.dll	24ef7bb64e42b4d3d7b4e7f85f8b5f455776b19de727de7dc8c56cbdb3697489.exe
File created	C:\Windows\SysWOW64\installd.exe	24ef7bb64e42b4d3d7b4e7f85f8b5f455776b19de727de7dc8c56cbdb3697489.exe
File created	C:\Windows\SysWOW64\nethtsrv.exe	24ef7bb64e42b4d3d7b4e7f85f8b5f455776b19de727de7dc8c56cbdb3697489.exe
File created	C:\Windows\SysWOW64\netupdsrv.exe	24ef7bb64e42b4d3d7b4e7f85f8b5f455776b19de727de7dc8c56cbdb3697489.exe
File created	C:\Windows\SysWOW64\hfnapi.dll	24ef7bb64e42b4d3d7b4e7f85f8b5f455776b19de727de7dc8c56cbdb3697489.exe

Drops file in Program Files directory 3 IoCs

Processes:

24ef7bb64e42b4d3d7b4e7f85f8b5f455776b19de727de7dc8c56cbdb3697489.exe

description	ioc	process
File created	C:\Program Files (x86)\Common Files\Config\data.xml	24ef7bb64e42b4d3d7b4e7f85f8b5f455776b19de727de7dc8c56cbdb3697489.exe
File created	C:\Program Files (x86)\Common Files\Config\ver.xml	24ef7bb64e42b4d3d7b4e7f85f8b5f455776b19de727de7dc8c56cbdb3697489.exe
File created	C:\Program Files (x86)\Common Files\config\uninstinethnfd.exe	24ef7bb64e42b4d3d7b4e7f85f8b5f455776b19de727de7dc8c56cbdb3697489.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Runs net.exe
Suspicious behavior: LoadsDriver 1 IoCs

Processes:

pid process

464
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

nethtsrv.exe

description pid process

Token: SeDebugPrivilege 284 nethtsrv.exe

pid	process
464

description	pid	process
Token: SeDebugPrivilege	284	nethtsrv.exe

Suspicious use of WriteProcessMemory 50 IoCs

Processes:

24ef7bb64e42b4d3d7b4e7f85f8b5f455776b19de727de7dc8c56cbdb3697489.exenet.exenet.exenet.exenet.exe

description	pid	process	target process
PID 2040 wrote to memory of 944	2040	24ef7bb64e42b4d3d7b4e7f85f8b5f455776b19de727de7dc8c56cbdb3697489.exe	net.exe
PID 2040 wrote to memory of 944	2040	24ef7bb64e42b4d3d7b4e7f85f8b5f455776b19de727de7dc8c56cbdb3697489.exe	net.exe
PID 2040 wrote to memory of 944	2040	24ef7bb64e42b4d3d7b4e7f85f8b5f455776b19de727de7dc8c56cbdb3697489.exe	net.exe
PID 2040 wrote to memory of 944	2040	24ef7bb64e42b4d3d7b4e7f85f8b5f455776b19de727de7dc8c56cbdb3697489.exe	net.exe
PID 944 wrote to memory of 684	944	net.exe	net1.exe
PID 944 wrote to memory of 684	944	net.exe	net1.exe
PID 944 wrote to memory of 684	944	net.exe	net1.exe
PID 944 wrote to memory of 684	944	net.exe	net1.exe
PID 2040 wrote to memory of 324	2040	24ef7bb64e42b4d3d7b4e7f85f8b5f455776b19de727de7dc8c56cbdb3697489.exe	net.exe
PID 2040 wrote to memory of 324	2040	24ef7bb64e42b4d3d7b4e7f85f8b5f455776b19de727de7dc8c56cbdb3697489.exe	net.exe
PID 2040 wrote to memory of 324	2040	24ef7bb64e42b4d3d7b4e7f85f8b5f455776b19de727de7dc8c56cbdb3697489.exe	net.exe
PID 2040 wrote to memory of 324	2040	24ef7bb64e42b4d3d7b4e7f85f8b5f455776b19de727de7dc8c56cbdb3697489.exe	net.exe
PID 324 wrote to memory of 268	324	net.exe	net1.exe
PID 324 wrote to memory of 268	324	net.exe	net1.exe
PID 324 wrote to memory of 268	324	net.exe	net1.exe
PID 324 wrote to memory of 268	324	net.exe	net1.exe
PID 2040 wrote to memory of 520	2040	24ef7bb64e42b4d3d7b4e7f85f8b5f455776b19de727de7dc8c56cbdb3697489.exe	installd.exe
PID 2040 wrote to memory of 520	2040	24ef7bb64e42b4d3d7b4e7f85f8b5f455776b19de727de7dc8c56cbdb3697489.exe	installd.exe
PID 2040 wrote to memory of 520	2040	24ef7bb64e42b4d3d7b4e7f85f8b5f455776b19de727de7dc8c56cbdb3697489.exe	installd.exe
PID 2040 wrote to memory of 520	2040	24ef7bb64e42b4d3d7b4e7f85f8b5f455776b19de727de7dc8c56cbdb3697489.exe	installd.exe
PID 2040 wrote to memory of 520	2040	24ef7bb64e42b4d3d7b4e7f85f8b5f455776b19de727de7dc8c56cbdb3697489.exe	installd.exe
PID 2040 wrote to memory of 520	2040	24ef7bb64e42b4d3d7b4e7f85f8b5f455776b19de727de7dc8c56cbdb3697489.exe	installd.exe
PID 2040 wrote to memory of 520	2040	24ef7bb64e42b4d3d7b4e7f85f8b5f455776b19de727de7dc8c56cbdb3697489.exe	installd.exe
PID 2040 wrote to memory of 1548	2040	24ef7bb64e42b4d3d7b4e7f85f8b5f455776b19de727de7dc8c56cbdb3697489.exe	nethtsrv.exe
PID 2040 wrote to memory of 1548	2040	24ef7bb64e42b4d3d7b4e7f85f8b5f455776b19de727de7dc8c56cbdb3697489.exe	nethtsrv.exe
PID 2040 wrote to memory of 1548	2040	24ef7bb64e42b4d3d7b4e7f85f8b5f455776b19de727de7dc8c56cbdb3697489.exe	nethtsrv.exe
PID 2040 wrote to memory of 1548	2040	24ef7bb64e42b4d3d7b4e7f85f8b5f455776b19de727de7dc8c56cbdb3697489.exe	nethtsrv.exe
PID 2040 wrote to memory of 1200	2040	24ef7bb64e42b4d3d7b4e7f85f8b5f455776b19de727de7dc8c56cbdb3697489.exe	netupdsrv.exe
PID 2040 wrote to memory of 1200	2040	24ef7bb64e42b4d3d7b4e7f85f8b5f455776b19de727de7dc8c56cbdb3697489.exe	netupdsrv.exe
PID 2040 wrote to memory of 1200	2040	24ef7bb64e42b4d3d7b4e7f85f8b5f455776b19de727de7dc8c56cbdb3697489.exe	netupdsrv.exe
PID 2040 wrote to memory of 1200	2040	24ef7bb64e42b4d3d7b4e7f85f8b5f455776b19de727de7dc8c56cbdb3697489.exe	netupdsrv.exe
PID 2040 wrote to memory of 1200	2040	24ef7bb64e42b4d3d7b4e7f85f8b5f455776b19de727de7dc8c56cbdb3697489.exe	netupdsrv.exe
PID 2040 wrote to memory of 1200	2040	24ef7bb64e42b4d3d7b4e7f85f8b5f455776b19de727de7dc8c56cbdb3697489.exe	netupdsrv.exe
PID 2040 wrote to memory of 1200	2040	24ef7bb64e42b4d3d7b4e7f85f8b5f455776b19de727de7dc8c56cbdb3697489.exe	netupdsrv.exe
PID 2040 wrote to memory of 1344	2040	24ef7bb64e42b4d3d7b4e7f85f8b5f455776b19de727de7dc8c56cbdb3697489.exe	net.exe
PID 2040 wrote to memory of 1344	2040	24ef7bb64e42b4d3d7b4e7f85f8b5f455776b19de727de7dc8c56cbdb3697489.exe	net.exe
PID 2040 wrote to memory of 1344	2040	24ef7bb64e42b4d3d7b4e7f85f8b5f455776b19de727de7dc8c56cbdb3697489.exe	net.exe
PID 2040 wrote to memory of 1344	2040	24ef7bb64e42b4d3d7b4e7f85f8b5f455776b19de727de7dc8c56cbdb3697489.exe	net.exe
PID 1344 wrote to memory of 1680	1344	net.exe	net1.exe
PID 1344 wrote to memory of 1680	1344	net.exe	net1.exe
PID 1344 wrote to memory of 1680	1344	net.exe	net1.exe
PID 1344 wrote to memory of 1680	1344	net.exe	net1.exe
PID 2040 wrote to memory of 1300	2040	24ef7bb64e42b4d3d7b4e7f85f8b5f455776b19de727de7dc8c56cbdb3697489.exe	net.exe
PID 2040 wrote to memory of 1300	2040	24ef7bb64e42b4d3d7b4e7f85f8b5f455776b19de727de7dc8c56cbdb3697489.exe	net.exe
PID 2040 wrote to memory of 1300	2040	24ef7bb64e42b4d3d7b4e7f85f8b5f455776b19de727de7dc8c56cbdb3697489.exe	net.exe
PID 2040 wrote to memory of 1300	2040	24ef7bb64e42b4d3d7b4e7f85f8b5f455776b19de727de7dc8c56cbdb3697489.exe	net.exe
PID 1300 wrote to memory of 1636	1300	net.exe	net1.exe
PID 1300 wrote to memory of 1636	1300	net.exe	net1.exe
PID 1300 wrote to memory of 1636	1300	net.exe	net1.exe
PID 1300 wrote to memory of 1636	1300	net.exe	net1.exe

C:\Users\Admin\AppData\Local\Temp\24ef7bb64e42b4d3d7b4e7f85f8b5f455776b19de727de7dc8c56cbdb3697489.exe
"C:\Users\Admin\AppData\Local\Temp\24ef7bb64e42b4d3d7b4e7f85f8b5f455776b19de727de7dc8c56cbdb3697489.exe"
1⤵
- Drops file in Drivers directory
- Loads dropped DLL
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:2040

C:\Windows\SysWOW64\net.exe
net stop nethttpservice
2⤵
- Suspicious use of WriteProcessMemory
PID:944

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop nethttpservice
3⤵
PID:684

C:\Windows\SysWOW64\net.exe
net stop serviceupdater
2⤵
- Suspicious use of WriteProcessMemory
PID:324

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop serviceupdater
3⤵
PID:268

C:\Windows\SysWOW64\installd.exe
"C:\Windows\system32\installd.exe" nethfdrv
2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:520

C:\Windows\SysWOW64\nethtsrv.exe
"C:\Windows\system32\nethtsrv.exe" -nfdi
2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1548

C:\Windows\SysWOW64\netupdsrv.exe
"C:\Windows\system32\netupdsrv.exe" -nfdi
2⤵
- Executes dropped EXE
PID:1200

C:\Windows\SysWOW64\net.exe
net start nethttpservice
2⤵
- Suspicious use of WriteProcessMemory
PID:1344

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 start nethttpservice
3⤵
PID:1680

C:\Windows\SysWOW64\net.exe
net start serviceupdater
2⤵
- Suspicious use of WriteProcessMemory
PID:1300

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 start serviceupdater
3⤵
PID:1636

C:\Windows\SysWOW64\nethtsrv.exe
C:\Windows\SysWOW64\nethtsrv.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:284

C:\Windows\SysWOW64\netupdsrv.exe
C:\Windows\SysWOW64\netupdsrv.exe
1⤵
- Executes dropped EXE
PID:1956

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\hfnapi.dll
Filesize
106KB

MD5
ae1318d062e6d2788b2627d546813804

SHA1
9f4cf6cc9c56c16ff1317330fd0eb072542f593b

SHA256
9a1cdaaa17fa2a8228051543d5d9cefe6259ccdf71725700ed08af95541c82ab

SHA512
881a90f26d9150e9708024c5310dc7718fa01ca4bca8aed6a6268914f9f0d5ebe78f3de458bdfc79bb588dd4bcc6aee1a00b02856269c6c9fec1e1cddba16d1e

Download Submit
C:\Windows\SysWOW64\hfpapi.dll
Filesize
244KB

MD5
13f3b3b908f04859f69523cf774f63b4

SHA1
57d6e140b100d7b224bf6e8062f6b1ee043bde84

SHA256
24e3f62fd35b8b76ba50e906d3cbc9f8c70eed9965f3135e80abc72b5aa998ee

SHA512
99de1562d5588ee0478321a6f9dea49e816f712d9fdb077692fed1a373c6468164b768061d7e23b9ebcde6a3add3f4b2f079bf7d3050b19420c97b49d7619a0e

Download Submit
C:\Windows\SysWOW64\installd.exe
Filesize
108KB

MD5
06305253aaf32927f645c7dce655c51d

SHA1
ee12aa486636cbd5cf9b5a0353423efb5b158b63

SHA256
556ebf900dfca7b7ff1d881fa915444704ca83b99c71943cccbffb2a9315f921

SHA512
1d72f02a80338c5c82b0f1fcad1086ec688b506248a6ec5f8c0e9496c06495d55c9507d084757cb215ee6ea06c38fcac4e111f89dbfac6c5ede70e30a3257ce1

Download Submit
C:\Windows\SysWOW64\nethtsrv.exe
Filesize
176KB

MD5
2f7deed0d7a842a6a0bef2942c45cef4

SHA1
9bbd61fb1a3eadb01387451ce982ea16a22b9812

SHA256
9f8967fc3ec5d551004103e34c37a46274064873e2558ecbccfea086445e7193

SHA512
f3ecd560e16d1da9b0a3a67aaf5f7db0e81a330ee5d0e1bba1b3994e6d6d31889bb4cae5723ea2f7a220702021499a81be075e320eb65feedc7137b8067472c4

Download Submit
C:\Windows\SysWOW64\nethtsrv.exe
Filesize
176KB

MD5
2f7deed0d7a842a6a0bef2942c45cef4

SHA1
9bbd61fb1a3eadb01387451ce982ea16a22b9812

SHA256
9f8967fc3ec5d551004103e34c37a46274064873e2558ecbccfea086445e7193

SHA512
f3ecd560e16d1da9b0a3a67aaf5f7db0e81a330ee5d0e1bba1b3994e6d6d31889bb4cae5723ea2f7a220702021499a81be075e320eb65feedc7137b8067472c4

Download Submit
C:\Windows\SysWOW64\netupdsrv.exe
Filesize
158KB

MD5
772bf2b2bb4fc90551d12263f316ed40

SHA1
12f5d3c97c825408968f0abb4c5f9a9d0bd51c3d

SHA256
d849b2d0ef828adece6edde9a5092e4f00ab9e4216ad25deefd095e106ae9938

SHA512
6af26cc0a52c32bb2b0aa2de72390c9f75e8fc3497ece826c161fd520778dc3bb9a3a5c84d3a1ccad488992e590d417bdd319ed2098e65042f724daacecb37f5

Download Submit
C:\Windows\SysWOW64\netupdsrv.exe
Filesize
158KB

MD5
772bf2b2bb4fc90551d12263f316ed40

SHA1
12f5d3c97c825408968f0abb4c5f9a9d0bd51c3d

SHA256
d849b2d0ef828adece6edde9a5092e4f00ab9e4216ad25deefd095e106ae9938

SHA512
6af26cc0a52c32bb2b0aa2de72390c9f75e8fc3497ece826c161fd520778dc3bb9a3a5c84d3a1ccad488992e590d417bdd319ed2098e65042f724daacecb37f5

Download Submit
\Users\Admin\AppData\Local\Temp\nsyA824.tmp\System.dll
Filesize
11KB

MD5
c17103ae9072a06da581dec998343fc1

SHA1
b72148c6bdfaada8b8c3f950e610ee7cf1da1f8d

SHA256
dc58d8ad81cacb0c1ed72e33bff8f23ea40b5252b5bb55d393a0903e6819ae2f

SHA512
d32a71aaef18e993f28096d536e41c4d016850721b31171513ce28bbd805a54fd290b7c3e9d935f72e676a1acfb4f0dcc89d95040a0dd29f2b6975855c18986f

Download Submit
\Users\Admin\AppData\Local\Temp\nsyA824.tmp\nsExec.dll
Filesize
6KB

MD5
acc2b699edfea5bf5aae45aba3a41e96

SHA1
d2accf4d494e43ceb2cff69abe4dd17147d29cc2

SHA256
168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e

SHA512
e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe

Download Submit
\Users\Admin\AppData\Local\Temp\nsyA824.tmp\nsExec.dll
Filesize
6KB

MD5
acc2b699edfea5bf5aae45aba3a41e96

SHA1
d2accf4d494e43ceb2cff69abe4dd17147d29cc2

SHA256
168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e

SHA512
e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe

Download Submit
\Users\Admin\AppData\Local\Temp\nsyA824.tmp\nsExec.dll
Filesize
6KB

MD5
acc2b699edfea5bf5aae45aba3a41e96

SHA1
d2accf4d494e43ceb2cff69abe4dd17147d29cc2

SHA256
168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e

SHA512
e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe

Download Submit
\Users\Admin\AppData\Local\Temp\nsyA824.tmp\nsExec.dll
Filesize
6KB

MD5
acc2b699edfea5bf5aae45aba3a41e96

SHA1
d2accf4d494e43ceb2cff69abe4dd17147d29cc2

SHA256
168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e

SHA512
e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe

Download Submit
\Windows\SysWOW64\hfnapi.dll
Filesize
106KB

MD5
ae1318d062e6d2788b2627d546813804

SHA1
9f4cf6cc9c56c16ff1317330fd0eb072542f593b

SHA256
9a1cdaaa17fa2a8228051543d5d9cefe6259ccdf71725700ed08af95541c82ab

SHA512
881a90f26d9150e9708024c5310dc7718fa01ca4bca8aed6a6268914f9f0d5ebe78f3de458bdfc79bb588dd4bcc6aee1a00b02856269c6c9fec1e1cddba16d1e

Download Submit
\Windows\SysWOW64\hfnapi.dll
Filesize
106KB

MD5
ae1318d062e6d2788b2627d546813804

SHA1
9f4cf6cc9c56c16ff1317330fd0eb072542f593b

SHA256
9a1cdaaa17fa2a8228051543d5d9cefe6259ccdf71725700ed08af95541c82ab

SHA512
881a90f26d9150e9708024c5310dc7718fa01ca4bca8aed6a6268914f9f0d5ebe78f3de458bdfc79bb588dd4bcc6aee1a00b02856269c6c9fec1e1cddba16d1e

Download Submit
\Windows\SysWOW64\hfnapi.dll
Filesize
106KB

MD5
ae1318d062e6d2788b2627d546813804

SHA1
9f4cf6cc9c56c16ff1317330fd0eb072542f593b

SHA256
9a1cdaaa17fa2a8228051543d5d9cefe6259ccdf71725700ed08af95541c82ab

SHA512
881a90f26d9150e9708024c5310dc7718fa01ca4bca8aed6a6268914f9f0d5ebe78f3de458bdfc79bb588dd4bcc6aee1a00b02856269c6c9fec1e1cddba16d1e

Download Submit
\Windows\SysWOW64\hfpapi.dll
Filesize
244KB

MD5
13f3b3b908f04859f69523cf774f63b4

SHA1
57d6e140b100d7b224bf6e8062f6b1ee043bde84

SHA256
24e3f62fd35b8b76ba50e906d3cbc9f8c70eed9965f3135e80abc72b5aa998ee

SHA512
99de1562d5588ee0478321a6f9dea49e816f712d9fdb077692fed1a373c6468164b768061d7e23b9ebcde6a3add3f4b2f079bf7d3050b19420c97b49d7619a0e

Download Submit
\Windows\SysWOW64\hfpapi.dll
Filesize
244KB

MD5
13f3b3b908f04859f69523cf774f63b4

SHA1
57d6e140b100d7b224bf6e8062f6b1ee043bde84

SHA256
24e3f62fd35b8b76ba50e906d3cbc9f8c70eed9965f3135e80abc72b5aa998ee

SHA512
99de1562d5588ee0478321a6f9dea49e816f712d9fdb077692fed1a373c6468164b768061d7e23b9ebcde6a3add3f4b2f079bf7d3050b19420c97b49d7619a0e

Download Submit
\Windows\SysWOW64\installd.exe
Filesize
108KB

MD5
06305253aaf32927f645c7dce655c51d

SHA1
ee12aa486636cbd5cf9b5a0353423efb5b158b63

SHA256
556ebf900dfca7b7ff1d881fa915444704ca83b99c71943cccbffb2a9315f921

SHA512
1d72f02a80338c5c82b0f1fcad1086ec688b506248a6ec5f8c0e9496c06495d55c9507d084757cb215ee6ea06c38fcac4e111f89dbfac6c5ede70e30a3257ce1

Download Submit
\Windows\SysWOW64\nethtsrv.exe
Filesize
176KB

MD5
2f7deed0d7a842a6a0bef2942c45cef4

SHA1
9bbd61fb1a3eadb01387451ce982ea16a22b9812

SHA256
9f8967fc3ec5d551004103e34c37a46274064873e2558ecbccfea086445e7193

SHA512
f3ecd560e16d1da9b0a3a67aaf5f7db0e81a330ee5d0e1bba1b3994e6d6d31889bb4cae5723ea2f7a220702021499a81be075e320eb65feedc7137b8067472c4

Download Submit
\Windows\SysWOW64\netupdsrv.exe
Filesize
158KB

MD5
772bf2b2bb4fc90551d12263f316ed40

SHA1
12f5d3c97c825408968f0abb4c5f9a9d0bd51c3d

SHA256
d849b2d0ef828adece6edde9a5092e4f00ab9e4216ad25deefd095e106ae9938

SHA512
6af26cc0a52c32bb2b0aa2de72390c9f75e8fc3497ece826c161fd520778dc3bb9a3a5c84d3a1ccad488992e590d417bdd319ed2098e65042f724daacecb37f5

Download Submit
memory/268-61-0x0000000000000000-mapping.dmp

Download
memory/324-60-0x0000000000000000-mapping.dmp

Download
memory/520-64-0x0000000000000000-mapping.dmp

Download
memory/684-58-0x0000000000000000-mapping.dmp

Download
memory/944-57-0x0000000000000000-mapping.dmp

Download
memory/1200-77-0x0000000000000000-mapping.dmp

Download
memory/1300-87-0x0000000000000000-mapping.dmp

Download
memory/1344-81-0x0000000000000000-mapping.dmp

Download
memory/1548-70-0x0000000000000000-mapping.dmp

Download
memory/1636-88-0x0000000000000000-mapping.dmp

Download
memory/1680-82-0x0000000000000000-mapping.dmp

Download
memory/2040-54-0x00000000761E1000-0x00000000761E3000-memory.dmp

Filesize
8KB

Download
memory/2040-62-0x0000000000360000-0x00000000007BE000-memory.dmp

Filesize
4.4MB

Download
memory/2040-75-0x0000000000360000-0x00000000007BE000-memory.dmp

Filesize
4.4MB

Download
memory/2040-91-0x0000000000360000-0x00000000007BE000-memory.dmp

Filesize
4.4MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads