237184cfc7fb4a151418bc5fce74298deb7fff3770a30408c25e0096b5f73683

Analysis

max time kernel
42s
max time network
46s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
23-11-2022 10:31

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

237184cfc7fb4a151418bc5fce74298deb7fff3770a30408c25e0096b5f73683.exe
Size

598KB
MD5

63a77879c8119d3a877e9bfee98c6376
SHA1

c639b571d95035cdc2681a448295205b4bcbc6b4
SHA256

237184cfc7fb4a151418bc5fce74298deb7fff3770a30408c25e0096b5f73683
SHA512

0389430e5cae8b48a14cb90cd695d73e4db33d5c3b38fb7322b621c346f75a973271836289e97cd6982bd471ecc8d5a33a1a7d06b0b61ea3b89cf2bc2bdc3be9
SSDEEP

12288:jIny5DYTV10frJYb4xQG+3ZfiIjg5FzMlQzyRoD1TBLsBvL:rUTV10frJYbUQvZfiIj5lQCoD9

Score

8^/10

discovery

Malware Config

Signatures

Drops file in Drivers directory 1 IoCs

Processes:

237184cfc7fb4a151418bc5fce74298deb7fff3770a30408c25e0096b5f73683.exe

description ioc process

File created C:\Windows\system32\drivers\nethfdrv.sys 237184cfc7fb4a151418bc5fce74298deb7fff3770a30408c25e0096b5f73683.exe
Executes dropped EXE 5 IoCs

Processes:

installd.exenethtsrv.exenetupdsrv.exenethtsrv.exenetupdsrv.exe

pid process

1416 installd.exe
436 nethtsrv.exe
612 netupdsrv.exe
1520 nethtsrv.exe
1792 netupdsrv.exe

description	ioc	process
File created	C:\Windows\system32\drivers\nethfdrv.sys	237184cfc7fb4a151418bc5fce74298deb7fff3770a30408c25e0096b5f73683.exe

pid	process
1416	installd.exe
436	nethtsrv.exe
612	netupdsrv.exe
1520	nethtsrv.exe
1792	netupdsrv.exe

Loads dropped DLL 13 IoCs

Processes:

237184cfc7fb4a151418bc5fce74298deb7fff3770a30408c25e0096b5f73683.exeinstalld.exenethtsrv.exenethtsrv.exe

pid	process
1752	237184cfc7fb4a151418bc5fce74298deb7fff3770a30408c25e0096b5f73683.exe
1752	237184cfc7fb4a151418bc5fce74298deb7fff3770a30408c25e0096b5f73683.exe
1752	237184cfc7fb4a151418bc5fce74298deb7fff3770a30408c25e0096b5f73683.exe
1752	237184cfc7fb4a151418bc5fce74298deb7fff3770a30408c25e0096b5f73683.exe
1416	installd.exe
1752	237184cfc7fb4a151418bc5fce74298deb7fff3770a30408c25e0096b5f73683.exe
436	nethtsrv.exe
436	nethtsrv.exe
1752	237184cfc7fb4a151418bc5fce74298deb7fff3770a30408c25e0096b5f73683.exe
1752	237184cfc7fb4a151418bc5fce74298deb7fff3770a30408c25e0096b5f73683.exe
1520	nethtsrv.exe
1520	nethtsrv.exe
1752	237184cfc7fb4a151418bc5fce74298deb7fff3770a30408c25e0096b5f73683.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in System32 directory 5 IoCs

Processes:

237184cfc7fb4a151418bc5fce74298deb7fff3770a30408c25e0096b5f73683.exe

description	ioc	process
File created	C:\Windows\SysWOW64\hfnapi.dll	237184cfc7fb4a151418bc5fce74298deb7fff3770a30408c25e0096b5f73683.exe
File created	C:\Windows\SysWOW64\hfpapi.dll	237184cfc7fb4a151418bc5fce74298deb7fff3770a30408c25e0096b5f73683.exe
File created	C:\Windows\SysWOW64\installd.exe	237184cfc7fb4a151418bc5fce74298deb7fff3770a30408c25e0096b5f73683.exe
File created	C:\Windows\SysWOW64\nethtsrv.exe	237184cfc7fb4a151418bc5fce74298deb7fff3770a30408c25e0096b5f73683.exe
File created	C:\Windows\SysWOW64\netupdsrv.exe	237184cfc7fb4a151418bc5fce74298deb7fff3770a30408c25e0096b5f73683.exe

Drops file in Program Files directory 3 IoCs

Processes:

237184cfc7fb4a151418bc5fce74298deb7fff3770a30408c25e0096b5f73683.exe

description	ioc	process
File created	C:\Program Files (x86)\Common Files\Config\data.xml	237184cfc7fb4a151418bc5fce74298deb7fff3770a30408c25e0096b5f73683.exe
File created	C:\Program Files (x86)\Common Files\Config\ver.xml	237184cfc7fb4a151418bc5fce74298deb7fff3770a30408c25e0096b5f73683.exe
File created	C:\Program Files (x86)\Common Files\config\uninstinethnfd.exe	237184cfc7fb4a151418bc5fce74298deb7fff3770a30408c25e0096b5f73683.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Runs net.exe
Suspicious behavior: LoadsDriver 1 IoCs

Processes:

pid process

464
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

nethtsrv.exe

description pid process

Token: SeDebugPrivilege 1520 nethtsrv.exe

pid	process
464

description	pid	process
Token: SeDebugPrivilege	1520	nethtsrv.exe

Suspicious use of WriteProcessMemory 50 IoCs

Processes:

237184cfc7fb4a151418bc5fce74298deb7fff3770a30408c25e0096b5f73683.exenet.exenet.exenet.exenet.exe

description	pid	process	target process
PID 1752 wrote to memory of 956	1752	237184cfc7fb4a151418bc5fce74298deb7fff3770a30408c25e0096b5f73683.exe	net.exe
PID 1752 wrote to memory of 956	1752	237184cfc7fb4a151418bc5fce74298deb7fff3770a30408c25e0096b5f73683.exe	net.exe
PID 1752 wrote to memory of 956	1752	237184cfc7fb4a151418bc5fce74298deb7fff3770a30408c25e0096b5f73683.exe	net.exe
PID 1752 wrote to memory of 956	1752	237184cfc7fb4a151418bc5fce74298deb7fff3770a30408c25e0096b5f73683.exe	net.exe
PID 956 wrote to memory of 1276	956	net.exe	net1.exe
PID 956 wrote to memory of 1276	956	net.exe	net1.exe
PID 956 wrote to memory of 1276	956	net.exe	net1.exe
PID 956 wrote to memory of 1276	956	net.exe	net1.exe
PID 1752 wrote to memory of 1500	1752	237184cfc7fb4a151418bc5fce74298deb7fff3770a30408c25e0096b5f73683.exe	net.exe
PID 1752 wrote to memory of 1500	1752	237184cfc7fb4a151418bc5fce74298deb7fff3770a30408c25e0096b5f73683.exe	net.exe
PID 1752 wrote to memory of 1500	1752	237184cfc7fb4a151418bc5fce74298deb7fff3770a30408c25e0096b5f73683.exe	net.exe
PID 1752 wrote to memory of 1500	1752	237184cfc7fb4a151418bc5fce74298deb7fff3770a30408c25e0096b5f73683.exe	net.exe
PID 1500 wrote to memory of 1168	1500	net.exe	net1.exe
PID 1500 wrote to memory of 1168	1500	net.exe	net1.exe
PID 1500 wrote to memory of 1168	1500	net.exe	net1.exe
PID 1500 wrote to memory of 1168	1500	net.exe	net1.exe
PID 1752 wrote to memory of 1416	1752	237184cfc7fb4a151418bc5fce74298deb7fff3770a30408c25e0096b5f73683.exe	installd.exe
PID 1752 wrote to memory of 1416	1752	237184cfc7fb4a151418bc5fce74298deb7fff3770a30408c25e0096b5f73683.exe	installd.exe
PID 1752 wrote to memory of 1416	1752	237184cfc7fb4a151418bc5fce74298deb7fff3770a30408c25e0096b5f73683.exe	installd.exe
PID 1752 wrote to memory of 1416	1752	237184cfc7fb4a151418bc5fce74298deb7fff3770a30408c25e0096b5f73683.exe	installd.exe
PID 1752 wrote to memory of 1416	1752	237184cfc7fb4a151418bc5fce74298deb7fff3770a30408c25e0096b5f73683.exe	installd.exe
PID 1752 wrote to memory of 1416	1752	237184cfc7fb4a151418bc5fce74298deb7fff3770a30408c25e0096b5f73683.exe	installd.exe
PID 1752 wrote to memory of 1416	1752	237184cfc7fb4a151418bc5fce74298deb7fff3770a30408c25e0096b5f73683.exe	installd.exe
PID 1752 wrote to memory of 436	1752	237184cfc7fb4a151418bc5fce74298deb7fff3770a30408c25e0096b5f73683.exe	nethtsrv.exe
PID 1752 wrote to memory of 436	1752	237184cfc7fb4a151418bc5fce74298deb7fff3770a30408c25e0096b5f73683.exe	nethtsrv.exe
PID 1752 wrote to memory of 436	1752	237184cfc7fb4a151418bc5fce74298deb7fff3770a30408c25e0096b5f73683.exe	nethtsrv.exe
PID 1752 wrote to memory of 436	1752	237184cfc7fb4a151418bc5fce74298deb7fff3770a30408c25e0096b5f73683.exe	nethtsrv.exe
PID 1752 wrote to memory of 612	1752	237184cfc7fb4a151418bc5fce74298deb7fff3770a30408c25e0096b5f73683.exe	netupdsrv.exe
PID 1752 wrote to memory of 612	1752	237184cfc7fb4a151418bc5fce74298deb7fff3770a30408c25e0096b5f73683.exe	netupdsrv.exe
PID 1752 wrote to memory of 612	1752	237184cfc7fb4a151418bc5fce74298deb7fff3770a30408c25e0096b5f73683.exe	netupdsrv.exe
PID 1752 wrote to memory of 612	1752	237184cfc7fb4a151418bc5fce74298deb7fff3770a30408c25e0096b5f73683.exe	netupdsrv.exe
PID 1752 wrote to memory of 612	1752	237184cfc7fb4a151418bc5fce74298deb7fff3770a30408c25e0096b5f73683.exe	netupdsrv.exe
PID 1752 wrote to memory of 612	1752	237184cfc7fb4a151418bc5fce74298deb7fff3770a30408c25e0096b5f73683.exe	netupdsrv.exe
PID 1752 wrote to memory of 612	1752	237184cfc7fb4a151418bc5fce74298deb7fff3770a30408c25e0096b5f73683.exe	netupdsrv.exe
PID 1752 wrote to memory of 1388	1752	237184cfc7fb4a151418bc5fce74298deb7fff3770a30408c25e0096b5f73683.exe	net.exe
PID 1752 wrote to memory of 1388	1752	237184cfc7fb4a151418bc5fce74298deb7fff3770a30408c25e0096b5f73683.exe	net.exe
PID 1752 wrote to memory of 1388	1752	237184cfc7fb4a151418bc5fce74298deb7fff3770a30408c25e0096b5f73683.exe	net.exe
PID 1752 wrote to memory of 1388	1752	237184cfc7fb4a151418bc5fce74298deb7fff3770a30408c25e0096b5f73683.exe	net.exe
PID 1388 wrote to memory of 1984	1388	net.exe	net1.exe
PID 1388 wrote to memory of 1984	1388	net.exe	net1.exe
PID 1388 wrote to memory of 1984	1388	net.exe	net1.exe
PID 1388 wrote to memory of 1984	1388	net.exe	net1.exe
PID 1752 wrote to memory of 1684	1752	237184cfc7fb4a151418bc5fce74298deb7fff3770a30408c25e0096b5f73683.exe	net.exe
PID 1752 wrote to memory of 1684	1752	237184cfc7fb4a151418bc5fce74298deb7fff3770a30408c25e0096b5f73683.exe	net.exe
PID 1752 wrote to memory of 1684	1752	237184cfc7fb4a151418bc5fce74298deb7fff3770a30408c25e0096b5f73683.exe	net.exe
PID 1752 wrote to memory of 1684	1752	237184cfc7fb4a151418bc5fce74298deb7fff3770a30408c25e0096b5f73683.exe	net.exe
PID 1684 wrote to memory of 1696	1684	net.exe	net1.exe
PID 1684 wrote to memory of 1696	1684	net.exe	net1.exe
PID 1684 wrote to memory of 1696	1684	net.exe	net1.exe
PID 1684 wrote to memory of 1696	1684	net.exe	net1.exe

C:\Users\Admin\AppData\Local\Temp\237184cfc7fb4a151418bc5fce74298deb7fff3770a30408c25e0096b5f73683.exe
"C:\Users\Admin\AppData\Local\Temp\237184cfc7fb4a151418bc5fce74298deb7fff3770a30408c25e0096b5f73683.exe"
1⤵
- Drops file in Drivers directory
- Loads dropped DLL
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:1752

C:\Windows\SysWOW64\net.exe
net stop nethttpservice
2⤵
- Suspicious use of WriteProcessMemory
PID:956

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop nethttpservice
3⤵
PID:1276

C:\Windows\SysWOW64\net.exe
net stop serviceupdater
2⤵
- Suspicious use of WriteProcessMemory
PID:1500

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop serviceupdater
3⤵
PID:1168

C:\Windows\SysWOW64\installd.exe
"C:\Windows\system32\installd.exe" nethfdrv
2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1416

C:\Windows\SysWOW64\nethtsrv.exe
"C:\Windows\system32\nethtsrv.exe" -nfdi
2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:436

C:\Windows\SysWOW64\netupdsrv.exe
"C:\Windows\system32\netupdsrv.exe" -nfdi
2⤵
- Executes dropped EXE
PID:612

C:\Windows\SysWOW64\net.exe
net start nethttpservice
2⤵
- Suspicious use of WriteProcessMemory
PID:1388

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 start nethttpservice
3⤵
PID:1984

C:\Windows\SysWOW64\net.exe
net start serviceupdater
2⤵
- Suspicious use of WriteProcessMemory
PID:1684

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 start serviceupdater
3⤵
PID:1696

C:\Windows\SysWOW64\nethtsrv.exe
C:\Windows\SysWOW64\nethtsrv.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:1520

C:\Windows\SysWOW64\netupdsrv.exe
C:\Windows\SysWOW64\netupdsrv.exe
1⤵
- Executes dropped EXE
PID:1792

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\hfnapi.dll
Filesize
106KB

MD5
0d8859fd63e06851664c9a5c332e1956

SHA1
a563057d943b34943aab6a154f298c55540d7af5

SHA256
095dea909c20a4e1fe79ec4215900ceab57a5bef969af4aef2c5fc58981814a9

SHA512
62c5b0b0c002868e98edd6e2ab9deda1b62673a51942498b006d6b8b465cf54c7480df8a6a207e20867ad7a4bc57399f64e66e74f65874be889ab4ae291a3470

Download Submit
C:\Windows\SysWOW64\hfpapi.dll
Filesize
241KB

MD5
bf03903f93066286fd478b4820d9dbf4

SHA1
3abc58a9277a1e6586fac47fa715a6bb09aee57e

SHA256
041c3972af90950f8c1d1e872542475b401c35381789c2c5ac4bc7cb7f7a0b03

SHA512
762d00496a60b0517e5a570ad16b944412dfcee65873739d455c85033883c8175b2e6808d0830270869a55ec24bdb1f1facf35e336c983edcdacf8f0fe3f2aae

Download Submit
C:\Windows\SysWOW64\installd.exe
Filesize
108KB

MD5
f0bc119c655f00f64f90468d08e92e7a

SHA1
c226f27b88b1d2bbf24ab83f28040b154fc9fc39

SHA256
8d6c96d58cd5a38e8194ab3ef99724ef28f97e8d86a05fa2616393aa737111a0

SHA512
ea498cf111560d15777de8b60973c1eb6ba821092926731eba2f488ee511b3acf8a23b44c080adc142935b370576d9720ba7ebc2bf2842e31868974978e4bec1

Download Submit
C:\Windows\SysWOW64\nethtsrv.exe
Filesize
176KB

MD5
31238871d3b7dc2530adba77180335af

SHA1
ef72338f860fe047b87efc5dd2b910d582d4a78d

SHA256
f7c0757b66eb487345a4b03d20c91783800c63b418e5f391deb294dda764b8f7

SHA512
ccbfcb7e5cf398f2ad4d33da27d54a70965aadadd1ab0859856db52c8c8da16d76a3cc0eb41e974c68305429e30b4330633e3f07f5609b318582815b54f967ca

Download Submit
C:\Windows\SysWOW64\nethtsrv.exe
Filesize
176KB

MD5
31238871d3b7dc2530adba77180335af

SHA1
ef72338f860fe047b87efc5dd2b910d582d4a78d

SHA256
f7c0757b66eb487345a4b03d20c91783800c63b418e5f391deb294dda764b8f7

SHA512
ccbfcb7e5cf398f2ad4d33da27d54a70965aadadd1ab0859856db52c8c8da16d76a3cc0eb41e974c68305429e30b4330633e3f07f5609b318582815b54f967ca

Download Submit
C:\Windows\SysWOW64\netupdsrv.exe
Filesize
159KB

MD5
ae00ab20d6afbc20bef059f4a370e6ac

SHA1
9745cfd6d33315747430e812bccd554e1a7646cb

SHA256
ac8bf0230a12190bf4c47880fd529fa3ceac3c5ae4b0fbdfed0389d7ab43200d

SHA512
d50e80d72bfabe94fb331c68957fa0d9f8204f4060b8c3efa8e876deab677bc757383338f28dfaf1cf04f7b5a4c4f65c72d7933dc2ebc629f4c91bd6c8b799bd

Download Submit
C:\Windows\SysWOW64\netupdsrv.exe
Filesize
159KB

MD5
ae00ab20d6afbc20bef059f4a370e6ac

SHA1
9745cfd6d33315747430e812bccd554e1a7646cb

SHA256
ac8bf0230a12190bf4c47880fd529fa3ceac3c5ae4b0fbdfed0389d7ab43200d

SHA512
d50e80d72bfabe94fb331c68957fa0d9f8204f4060b8c3efa8e876deab677bc757383338f28dfaf1cf04f7b5a4c4f65c72d7933dc2ebc629f4c91bd6c8b799bd

Download Submit
\Users\Admin\AppData\Local\Temp\nsd41E3.tmp\System.dll
Filesize
11KB

MD5
c17103ae9072a06da581dec998343fc1

SHA1
b72148c6bdfaada8b8c3f950e610ee7cf1da1f8d

SHA256
dc58d8ad81cacb0c1ed72e33bff8f23ea40b5252b5bb55d393a0903e6819ae2f

SHA512
d32a71aaef18e993f28096d536e41c4d016850721b31171513ce28bbd805a54fd290b7c3e9d935f72e676a1acfb4f0dcc89d95040a0dd29f2b6975855c18986f

Download Submit
\Users\Admin\AppData\Local\Temp\nsd41E3.tmp\nsExec.dll
Filesize
6KB

MD5
acc2b699edfea5bf5aae45aba3a41e96

SHA1
d2accf4d494e43ceb2cff69abe4dd17147d29cc2

SHA256
168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e

SHA512
e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe

Download Submit
\Users\Admin\AppData\Local\Temp\nsd41E3.tmp\nsExec.dll
Filesize
6KB

MD5
acc2b699edfea5bf5aae45aba3a41e96

SHA1
d2accf4d494e43ceb2cff69abe4dd17147d29cc2

SHA256
168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e

SHA512
e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe

Download Submit
\Users\Admin\AppData\Local\Temp\nsd41E3.tmp\nsExec.dll
Filesize
6KB

MD5
acc2b699edfea5bf5aae45aba3a41e96

SHA1
d2accf4d494e43ceb2cff69abe4dd17147d29cc2

SHA256
168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e

SHA512
e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe

Download Submit
\Users\Admin\AppData\Local\Temp\nsd41E3.tmp\nsExec.dll
Filesize
6KB

MD5
acc2b699edfea5bf5aae45aba3a41e96

SHA1
d2accf4d494e43ceb2cff69abe4dd17147d29cc2

SHA256
168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e

SHA512
e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe

Download Submit
\Windows\SysWOW64\hfnapi.dll
Filesize
106KB

MD5
0d8859fd63e06851664c9a5c332e1956

SHA1
a563057d943b34943aab6a154f298c55540d7af5

SHA256
095dea909c20a4e1fe79ec4215900ceab57a5bef969af4aef2c5fc58981814a9

SHA512
62c5b0b0c002868e98edd6e2ab9deda1b62673a51942498b006d6b8b465cf54c7480df8a6a207e20867ad7a4bc57399f64e66e74f65874be889ab4ae291a3470

Download Submit
\Windows\SysWOW64\hfnapi.dll
Filesize
106KB

MD5
0d8859fd63e06851664c9a5c332e1956

SHA1
a563057d943b34943aab6a154f298c55540d7af5

SHA256
095dea909c20a4e1fe79ec4215900ceab57a5bef969af4aef2c5fc58981814a9

SHA512
62c5b0b0c002868e98edd6e2ab9deda1b62673a51942498b006d6b8b465cf54c7480df8a6a207e20867ad7a4bc57399f64e66e74f65874be889ab4ae291a3470

Download Submit
\Windows\SysWOW64\hfnapi.dll
Filesize
106KB

MD5
0d8859fd63e06851664c9a5c332e1956

SHA1
a563057d943b34943aab6a154f298c55540d7af5

SHA256
095dea909c20a4e1fe79ec4215900ceab57a5bef969af4aef2c5fc58981814a9

SHA512
62c5b0b0c002868e98edd6e2ab9deda1b62673a51942498b006d6b8b465cf54c7480df8a6a207e20867ad7a4bc57399f64e66e74f65874be889ab4ae291a3470

Download Submit
\Windows\SysWOW64\hfpapi.dll
Filesize
241KB

MD5
bf03903f93066286fd478b4820d9dbf4

SHA1
3abc58a9277a1e6586fac47fa715a6bb09aee57e

SHA256
041c3972af90950f8c1d1e872542475b401c35381789c2c5ac4bc7cb7f7a0b03

SHA512
762d00496a60b0517e5a570ad16b944412dfcee65873739d455c85033883c8175b2e6808d0830270869a55ec24bdb1f1facf35e336c983edcdacf8f0fe3f2aae

Download Submit
\Windows\SysWOW64\hfpapi.dll
Filesize
241KB

MD5
bf03903f93066286fd478b4820d9dbf4

SHA1
3abc58a9277a1e6586fac47fa715a6bb09aee57e

SHA256
041c3972af90950f8c1d1e872542475b401c35381789c2c5ac4bc7cb7f7a0b03

SHA512
762d00496a60b0517e5a570ad16b944412dfcee65873739d455c85033883c8175b2e6808d0830270869a55ec24bdb1f1facf35e336c983edcdacf8f0fe3f2aae

Download Submit
\Windows\SysWOW64\installd.exe
Filesize
108KB

MD5
f0bc119c655f00f64f90468d08e92e7a

SHA1
c226f27b88b1d2bbf24ab83f28040b154fc9fc39

SHA256
8d6c96d58cd5a38e8194ab3ef99724ef28f97e8d86a05fa2616393aa737111a0

SHA512
ea498cf111560d15777de8b60973c1eb6ba821092926731eba2f488ee511b3acf8a23b44c080adc142935b370576d9720ba7ebc2bf2842e31868974978e4bec1

Download Submit
\Windows\SysWOW64\nethtsrv.exe
Filesize
176KB

MD5
31238871d3b7dc2530adba77180335af

SHA1
ef72338f860fe047b87efc5dd2b910d582d4a78d

SHA256
f7c0757b66eb487345a4b03d20c91783800c63b418e5f391deb294dda764b8f7

SHA512
ccbfcb7e5cf398f2ad4d33da27d54a70965aadadd1ab0859856db52c8c8da16d76a3cc0eb41e974c68305429e30b4330633e3f07f5609b318582815b54f967ca

Download Submit
\Windows\SysWOW64\netupdsrv.exe
Filesize
159KB

MD5
ae00ab20d6afbc20bef059f4a370e6ac

SHA1
9745cfd6d33315747430e812bccd554e1a7646cb

SHA256
ac8bf0230a12190bf4c47880fd529fa3ceac3c5ae4b0fbdfed0389d7ab43200d

SHA512
d50e80d72bfabe94fb331c68957fa0d9f8204f4060b8c3efa8e876deab677bc757383338f28dfaf1cf04f7b5a4c4f65c72d7933dc2ebc629f4c91bd6c8b799bd

Download Submit
memory/436-70-0x0000000000000000-mapping.dmp

Download
memory/612-76-0x0000000000000000-mapping.dmp

Download
memory/956-57-0x0000000000000000-mapping.dmp

Download
memory/1168-61-0x0000000000000000-mapping.dmp

Download
memory/1276-58-0x0000000000000000-mapping.dmp

Download
memory/1388-80-0x0000000000000000-mapping.dmp

Download
memory/1416-64-0x0000000000000000-mapping.dmp

Download
memory/1500-60-0x0000000000000000-mapping.dmp

Download
memory/1684-86-0x0000000000000000-mapping.dmp

Download
memory/1696-87-0x0000000000000000-mapping.dmp

Download
memory/1752-54-0x0000000075931000-0x0000000075933000-memory.dmp

Filesize
8KB

Download
memory/1752-62-0x0000000000360000-0x00000000007BE000-memory.dmp

Filesize
4.4MB

Download
memory/1752-90-0x0000000000360000-0x00000000007BE000-memory.dmp

Filesize
4.4MB

Download
memory/1984-81-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads