22e92acc09e1b9e094a3b17e3ffd98dbc38fe449d99cfd9b49ff6e956862ea07

Analysis

max time kernel
32s
max time network
45s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
23-11-2022 10:31

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

22e92acc09e1b9e094a3b17e3ffd98dbc38fe449d99cfd9b49ff6e956862ea07.exe
Size

603KB
MD5

b5304d51c66c9498d43b803a5964a9cb
SHA1

b641249404927d26e711b39bf8b4756a9a788741
SHA256

22e92acc09e1b9e094a3b17e3ffd98dbc38fe449d99cfd9b49ff6e956862ea07
SHA512

a9c4a23ce90a21a6407d433b241a3c378895bc9fa65a9f30350028d31ebf52ddc927cf25073611ea032ee0234d910463eb9e836117120bbf124ddb39b14f4e6b
SSDEEP

12288:gIny5DYTmI1pR0C46Uqb56vdT03MmlQWLBWxuQisqdp5TBXeAi6:eUTmC8cUqdM9VOLBW3BqL5FXeAi

Score

8^/10

discovery

Malware Config

Signatures

Drops file in Drivers directory 1 IoCs

Processes:

22e92acc09e1b9e094a3b17e3ffd98dbc38fe449d99cfd9b49ff6e956862ea07.exe

description ioc process

File created C:\Windows\system32\drivers\nethfdrv.sys 22e92acc09e1b9e094a3b17e3ffd98dbc38fe449d99cfd9b49ff6e956862ea07.exe
Executes dropped EXE 5 IoCs

Processes:

installd.exenethtsrv.exenetupdsrv.exenethtsrv.exenetupdsrv.exe

pid process

1052 installd.exe
1716 nethtsrv.exe
1952 netupdsrv.exe
1328 nethtsrv.exe
1056 netupdsrv.exe

description	ioc	process
File created	C:\Windows\system32\drivers\nethfdrv.sys	22e92acc09e1b9e094a3b17e3ffd98dbc38fe449d99cfd9b49ff6e956862ea07.exe

pid	process
1052	installd.exe
1716	nethtsrv.exe
1952	netupdsrv.exe
1328	nethtsrv.exe
1056	netupdsrv.exe

Loads dropped DLL 13 IoCs

Processes:

22e92acc09e1b9e094a3b17e3ffd98dbc38fe449d99cfd9b49ff6e956862ea07.exeinstalld.exenethtsrv.exenethtsrv.exe

pid	process
1392	22e92acc09e1b9e094a3b17e3ffd98dbc38fe449d99cfd9b49ff6e956862ea07.exe
1392	22e92acc09e1b9e094a3b17e3ffd98dbc38fe449d99cfd9b49ff6e956862ea07.exe
1392	22e92acc09e1b9e094a3b17e3ffd98dbc38fe449d99cfd9b49ff6e956862ea07.exe
1392	22e92acc09e1b9e094a3b17e3ffd98dbc38fe449d99cfd9b49ff6e956862ea07.exe
1052	installd.exe
1392	22e92acc09e1b9e094a3b17e3ffd98dbc38fe449d99cfd9b49ff6e956862ea07.exe
1716	nethtsrv.exe
1716	nethtsrv.exe
1392	22e92acc09e1b9e094a3b17e3ffd98dbc38fe449d99cfd9b49ff6e956862ea07.exe
1392	22e92acc09e1b9e094a3b17e3ffd98dbc38fe449d99cfd9b49ff6e956862ea07.exe
1328	nethtsrv.exe
1328	nethtsrv.exe
1392	22e92acc09e1b9e094a3b17e3ffd98dbc38fe449d99cfd9b49ff6e956862ea07.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in System32 directory 5 IoCs

Processes:

22e92acc09e1b9e094a3b17e3ffd98dbc38fe449d99cfd9b49ff6e956862ea07.exe

description	ioc	process
File created	C:\Windows\SysWOW64\hfnapi.dll	22e92acc09e1b9e094a3b17e3ffd98dbc38fe449d99cfd9b49ff6e956862ea07.exe
File created	C:\Windows\SysWOW64\hfpapi.dll	22e92acc09e1b9e094a3b17e3ffd98dbc38fe449d99cfd9b49ff6e956862ea07.exe
File created	C:\Windows\SysWOW64\installd.exe	22e92acc09e1b9e094a3b17e3ffd98dbc38fe449d99cfd9b49ff6e956862ea07.exe
File created	C:\Windows\SysWOW64\nethtsrv.exe	22e92acc09e1b9e094a3b17e3ffd98dbc38fe449d99cfd9b49ff6e956862ea07.exe
File created	C:\Windows\SysWOW64\netupdsrv.exe	22e92acc09e1b9e094a3b17e3ffd98dbc38fe449d99cfd9b49ff6e956862ea07.exe

Drops file in Program Files directory 3 IoCs

Processes:

22e92acc09e1b9e094a3b17e3ffd98dbc38fe449d99cfd9b49ff6e956862ea07.exe

description	ioc	process
File created	C:\Program Files (x86)\Common Files\config\uninstinethnfd.exe	22e92acc09e1b9e094a3b17e3ffd98dbc38fe449d99cfd9b49ff6e956862ea07.exe
File created	C:\Program Files (x86)\Common Files\Config\data.xml	22e92acc09e1b9e094a3b17e3ffd98dbc38fe449d99cfd9b49ff6e956862ea07.exe
File created	C:\Program Files (x86)\Common Files\Config\ver.xml	22e92acc09e1b9e094a3b17e3ffd98dbc38fe449d99cfd9b49ff6e956862ea07.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Runs net.exe
Suspicious behavior: LoadsDriver 1 IoCs

Processes:

pid process

464
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

nethtsrv.exe

description pid process

Token: SeDebugPrivilege 1328 nethtsrv.exe

pid	process
464

description	pid	process
Token: SeDebugPrivilege	1328	nethtsrv.exe

Suspicious use of WriteProcessMemory 50 IoCs

Processes:

22e92acc09e1b9e094a3b17e3ffd98dbc38fe449d99cfd9b49ff6e956862ea07.exenet.exenet.exenet.exenet.exe

description	pid	process	target process
PID 1392 wrote to memory of 1600	1392	22e92acc09e1b9e094a3b17e3ffd98dbc38fe449d99cfd9b49ff6e956862ea07.exe	net.exe
PID 1392 wrote to memory of 1600	1392	22e92acc09e1b9e094a3b17e3ffd98dbc38fe449d99cfd9b49ff6e956862ea07.exe	net.exe
PID 1392 wrote to memory of 1600	1392	22e92acc09e1b9e094a3b17e3ffd98dbc38fe449d99cfd9b49ff6e956862ea07.exe	net.exe
PID 1392 wrote to memory of 1600	1392	22e92acc09e1b9e094a3b17e3ffd98dbc38fe449d99cfd9b49ff6e956862ea07.exe	net.exe
PID 1600 wrote to memory of 1272	1600	net.exe	net1.exe
PID 1600 wrote to memory of 1272	1600	net.exe	net1.exe
PID 1600 wrote to memory of 1272	1600	net.exe	net1.exe
PID 1600 wrote to memory of 1272	1600	net.exe	net1.exe
PID 1392 wrote to memory of 2000	1392	22e92acc09e1b9e094a3b17e3ffd98dbc38fe449d99cfd9b49ff6e956862ea07.exe	net.exe
PID 1392 wrote to memory of 2000	1392	22e92acc09e1b9e094a3b17e3ffd98dbc38fe449d99cfd9b49ff6e956862ea07.exe	net.exe
PID 1392 wrote to memory of 2000	1392	22e92acc09e1b9e094a3b17e3ffd98dbc38fe449d99cfd9b49ff6e956862ea07.exe	net.exe
PID 1392 wrote to memory of 2000	1392	22e92acc09e1b9e094a3b17e3ffd98dbc38fe449d99cfd9b49ff6e956862ea07.exe	net.exe
PID 2000 wrote to memory of 848	2000	net.exe	net1.exe
PID 2000 wrote to memory of 848	2000	net.exe	net1.exe
PID 2000 wrote to memory of 848	2000	net.exe	net1.exe
PID 2000 wrote to memory of 848	2000	net.exe	net1.exe
PID 1392 wrote to memory of 1052	1392	22e92acc09e1b9e094a3b17e3ffd98dbc38fe449d99cfd9b49ff6e956862ea07.exe	installd.exe
PID 1392 wrote to memory of 1052	1392	22e92acc09e1b9e094a3b17e3ffd98dbc38fe449d99cfd9b49ff6e956862ea07.exe	installd.exe
PID 1392 wrote to memory of 1052	1392	22e92acc09e1b9e094a3b17e3ffd98dbc38fe449d99cfd9b49ff6e956862ea07.exe	installd.exe
PID 1392 wrote to memory of 1052	1392	22e92acc09e1b9e094a3b17e3ffd98dbc38fe449d99cfd9b49ff6e956862ea07.exe	installd.exe
PID 1392 wrote to memory of 1052	1392	22e92acc09e1b9e094a3b17e3ffd98dbc38fe449d99cfd9b49ff6e956862ea07.exe	installd.exe
PID 1392 wrote to memory of 1052	1392	22e92acc09e1b9e094a3b17e3ffd98dbc38fe449d99cfd9b49ff6e956862ea07.exe	installd.exe
PID 1392 wrote to memory of 1052	1392	22e92acc09e1b9e094a3b17e3ffd98dbc38fe449d99cfd9b49ff6e956862ea07.exe	installd.exe
PID 1392 wrote to memory of 1716	1392	22e92acc09e1b9e094a3b17e3ffd98dbc38fe449d99cfd9b49ff6e956862ea07.exe	nethtsrv.exe
PID 1392 wrote to memory of 1716	1392	22e92acc09e1b9e094a3b17e3ffd98dbc38fe449d99cfd9b49ff6e956862ea07.exe	nethtsrv.exe
PID 1392 wrote to memory of 1716	1392	22e92acc09e1b9e094a3b17e3ffd98dbc38fe449d99cfd9b49ff6e956862ea07.exe	nethtsrv.exe
PID 1392 wrote to memory of 1716	1392	22e92acc09e1b9e094a3b17e3ffd98dbc38fe449d99cfd9b49ff6e956862ea07.exe	nethtsrv.exe
PID 1392 wrote to memory of 1952	1392	22e92acc09e1b9e094a3b17e3ffd98dbc38fe449d99cfd9b49ff6e956862ea07.exe	netupdsrv.exe
PID 1392 wrote to memory of 1952	1392	22e92acc09e1b9e094a3b17e3ffd98dbc38fe449d99cfd9b49ff6e956862ea07.exe	netupdsrv.exe
PID 1392 wrote to memory of 1952	1392	22e92acc09e1b9e094a3b17e3ffd98dbc38fe449d99cfd9b49ff6e956862ea07.exe	netupdsrv.exe
PID 1392 wrote to memory of 1952	1392	22e92acc09e1b9e094a3b17e3ffd98dbc38fe449d99cfd9b49ff6e956862ea07.exe	netupdsrv.exe
PID 1392 wrote to memory of 1952	1392	22e92acc09e1b9e094a3b17e3ffd98dbc38fe449d99cfd9b49ff6e956862ea07.exe	netupdsrv.exe
PID 1392 wrote to memory of 1952	1392	22e92acc09e1b9e094a3b17e3ffd98dbc38fe449d99cfd9b49ff6e956862ea07.exe	netupdsrv.exe
PID 1392 wrote to memory of 1952	1392	22e92acc09e1b9e094a3b17e3ffd98dbc38fe449d99cfd9b49ff6e956862ea07.exe	netupdsrv.exe
PID 1392 wrote to memory of 584	1392	22e92acc09e1b9e094a3b17e3ffd98dbc38fe449d99cfd9b49ff6e956862ea07.exe	net.exe
PID 1392 wrote to memory of 584	1392	22e92acc09e1b9e094a3b17e3ffd98dbc38fe449d99cfd9b49ff6e956862ea07.exe	net.exe
PID 1392 wrote to memory of 584	1392	22e92acc09e1b9e094a3b17e3ffd98dbc38fe449d99cfd9b49ff6e956862ea07.exe	net.exe
PID 1392 wrote to memory of 584	1392	22e92acc09e1b9e094a3b17e3ffd98dbc38fe449d99cfd9b49ff6e956862ea07.exe	net.exe
PID 584 wrote to memory of 1108	584	net.exe	net1.exe
PID 584 wrote to memory of 1108	584	net.exe	net1.exe
PID 584 wrote to memory of 1108	584	net.exe	net1.exe
PID 584 wrote to memory of 1108	584	net.exe	net1.exe
PID 1392 wrote to memory of 1772	1392	22e92acc09e1b9e094a3b17e3ffd98dbc38fe449d99cfd9b49ff6e956862ea07.exe	net.exe
PID 1392 wrote to memory of 1772	1392	22e92acc09e1b9e094a3b17e3ffd98dbc38fe449d99cfd9b49ff6e956862ea07.exe	net.exe
PID 1392 wrote to memory of 1772	1392	22e92acc09e1b9e094a3b17e3ffd98dbc38fe449d99cfd9b49ff6e956862ea07.exe	net.exe
PID 1392 wrote to memory of 1772	1392	22e92acc09e1b9e094a3b17e3ffd98dbc38fe449d99cfd9b49ff6e956862ea07.exe	net.exe
PID 1772 wrote to memory of 276	1772	net.exe	net1.exe
PID 1772 wrote to memory of 276	1772	net.exe	net1.exe
PID 1772 wrote to memory of 276	1772	net.exe	net1.exe
PID 1772 wrote to memory of 276	1772	net.exe	net1.exe

C:\Users\Admin\AppData\Local\Temp\22e92acc09e1b9e094a3b17e3ffd98dbc38fe449d99cfd9b49ff6e956862ea07.exe
"C:\Users\Admin\AppData\Local\Temp\22e92acc09e1b9e094a3b17e3ffd98dbc38fe449d99cfd9b49ff6e956862ea07.exe"
1⤵
- Drops file in Drivers directory
- Loads dropped DLL
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:1392

C:\Windows\SysWOW64\net.exe
net stop nethttpservice
2⤵
- Suspicious use of WriteProcessMemory
PID:1600

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop nethttpservice
3⤵
PID:1272

C:\Windows\SysWOW64\net.exe
net stop serviceupdater
2⤵
- Suspicious use of WriteProcessMemory
PID:2000

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop serviceupdater
3⤵
PID:848

C:\Windows\SysWOW64\installd.exe
"C:\Windows\system32\installd.exe" nethfdrv
2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1052

C:\Windows\SysWOW64\nethtsrv.exe
"C:\Windows\system32\nethtsrv.exe" -nfdi
2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1716

C:\Windows\SysWOW64\netupdsrv.exe
"C:\Windows\system32\netupdsrv.exe" -nfdi
2⤵
- Executes dropped EXE
PID:1952

C:\Windows\SysWOW64\net.exe
net start nethttpservice
2⤵
- Suspicious use of WriteProcessMemory
PID:584

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 start nethttpservice
3⤵
PID:1108

C:\Windows\SysWOW64\net.exe
net start serviceupdater
2⤵
- Suspicious use of WriteProcessMemory
PID:1772

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 start serviceupdater
3⤵
PID:276

C:\Windows\SysWOW64\nethtsrv.exe
C:\Windows\SysWOW64\nethtsrv.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:1328

C:\Windows\SysWOW64\netupdsrv.exe
C:\Windows\SysWOW64\netupdsrv.exe
1⤵
- Executes dropped EXE
PID:1056

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\hfnapi.dll
Filesize
106KB

MD5
cc5b46843da86c06977ba8a71b23d14c

SHA1
39b0def658c81323f6f31029f7ff7a6fd4bf7d1b

SHA256
01024f0b238f40220bf1f5e0f9be4316f27cf0f12c4af02ffac5ad66a365083c

SHA512
a2a13dc6f467dd19521b32dc460b671b5d6a2696efd7ebe71a1f968f6b1031856ae377d65370645f6c6796e6e2357a7293816090605e62a792af98eac7720558

Download Submit
C:\Windows\SysWOW64\hfpapi.dll
Filesize
244KB

MD5
0414011313df19dc215edbbd5d1de9c8

SHA1
4032036084d62e7a43b60d175b7028cc11e432dc

SHA256
9ddeec9a1228dffce101b1280823faef74b8f209fecb3855b4cf1c96f3527f40

SHA512
346387e12a256b447c034613df8f028777cc9fcbd1a0523a0803960e0d131e1a9e18b0c63769cea89111690fa7884ffd8fcb07c7ccdb6ee2aa1ca336b5ba4cd2

Download Submit
C:\Windows\SysWOW64\installd.exe
Filesize
108KB

MD5
694e4ff753c69121d8f37c20b06e2483

SHA1
d08f66ff61efd7fd80f94d1714810167a0fa807c

SHA256
33aa26589bcd0729065d013672e4a7abd1c67e4180acc07d9a4f32842a94b75d

SHA512
8d379037a8df24f90c146d85b3e6a2b742ffa8f16c1095b26af8183dbee0dca33329abb8e0c1de37ef3340637e1afc16e6edea1b1b8c988fa0679605b0626274

Download Submit
C:\Windows\SysWOW64\nethtsrv.exe
Filesize
176KB

MD5
58d01f7b823b937f4342bc09d8c81431

SHA1
3cbe6f6153f9088ed03aafa080ec36d1eefffc8d

SHA256
7c1ee4a096ec4bb4a933bbe433a1c0609da345d3ad418ab9df541be5a8d76d46

SHA512
fca36764cfec5a82334e09726a01c6a877bbdb86db5c6512c09d6d507183a5378f6000726f41cb62ad17aaefe4598dec4111182ad5516668c9dd6858f5270180

Download Submit
C:\Windows\SysWOW64\nethtsrv.exe
Filesize
176KB

MD5
58d01f7b823b937f4342bc09d8c81431

SHA1
3cbe6f6153f9088ed03aafa080ec36d1eefffc8d

SHA256
7c1ee4a096ec4bb4a933bbe433a1c0609da345d3ad418ab9df541be5a8d76d46

SHA512
fca36764cfec5a82334e09726a01c6a877bbdb86db5c6512c09d6d507183a5378f6000726f41cb62ad17aaefe4598dec4111182ad5516668c9dd6858f5270180

Download Submit
C:\Windows\SysWOW64\netupdsrv.exe
Filesize
158KB

MD5
2811b2328ff36018d99b8a95e5295ef1

SHA1
35e3b8c090c1182582183705aa18df39bbe8b3f0

SHA256
6b143d2a51f03ae739fa238c9ec861f27506a6366be1e3b1587825a518b7bd84

SHA512
8f705e9fe8b134a29f7fc9eb3ec438670b85aa5602258db374eb2ba57bf874667e02c694b5a2791718a470eb1a119ea4783b140b0c1127b15ec57a2828a8d91d

Download Submit
C:\Windows\SysWOW64\netupdsrv.exe
Filesize
158KB

MD5
2811b2328ff36018d99b8a95e5295ef1

SHA1
35e3b8c090c1182582183705aa18df39bbe8b3f0

SHA256
6b143d2a51f03ae739fa238c9ec861f27506a6366be1e3b1587825a518b7bd84

SHA512
8f705e9fe8b134a29f7fc9eb3ec438670b85aa5602258db374eb2ba57bf874667e02c694b5a2791718a470eb1a119ea4783b140b0c1127b15ec57a2828a8d91d

Download Submit
\Users\Admin\AppData\Local\Temp\nsj20CD.tmp\System.dll
Filesize
11KB

MD5
c17103ae9072a06da581dec998343fc1

SHA1
b72148c6bdfaada8b8c3f950e610ee7cf1da1f8d

SHA256
dc58d8ad81cacb0c1ed72e33bff8f23ea40b5252b5bb55d393a0903e6819ae2f

SHA512
d32a71aaef18e993f28096d536e41c4d016850721b31171513ce28bbd805a54fd290b7c3e9d935f72e676a1acfb4f0dcc89d95040a0dd29f2b6975855c18986f

Download Submit
\Users\Admin\AppData\Local\Temp\nsj20CD.tmp\nsExec.dll
Filesize
6KB

MD5
acc2b699edfea5bf5aae45aba3a41e96

SHA1
d2accf4d494e43ceb2cff69abe4dd17147d29cc2

SHA256
168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e

SHA512
e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe

Download Submit
\Users\Admin\AppData\Local\Temp\nsj20CD.tmp\nsExec.dll
Filesize
6KB

MD5
acc2b699edfea5bf5aae45aba3a41e96

SHA1
d2accf4d494e43ceb2cff69abe4dd17147d29cc2

SHA256
168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e

SHA512
e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe

Download Submit
\Users\Admin\AppData\Local\Temp\nsj20CD.tmp\nsExec.dll
Filesize
6KB

MD5
acc2b699edfea5bf5aae45aba3a41e96

SHA1
d2accf4d494e43ceb2cff69abe4dd17147d29cc2

SHA256
168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e

SHA512
e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe

Download Submit
\Users\Admin\AppData\Local\Temp\nsj20CD.tmp\nsExec.dll
Filesize
6KB

MD5
acc2b699edfea5bf5aae45aba3a41e96

SHA1
d2accf4d494e43ceb2cff69abe4dd17147d29cc2

SHA256
168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e

SHA512
e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe

Download Submit
\Windows\SysWOW64\hfnapi.dll
Filesize
106KB

MD5
cc5b46843da86c06977ba8a71b23d14c

SHA1
39b0def658c81323f6f31029f7ff7a6fd4bf7d1b

SHA256
01024f0b238f40220bf1f5e0f9be4316f27cf0f12c4af02ffac5ad66a365083c

SHA512
a2a13dc6f467dd19521b32dc460b671b5d6a2696efd7ebe71a1f968f6b1031856ae377d65370645f6c6796e6e2357a7293816090605e62a792af98eac7720558

Download Submit
\Windows\SysWOW64\hfnapi.dll
Filesize
106KB

MD5
cc5b46843da86c06977ba8a71b23d14c

SHA1
39b0def658c81323f6f31029f7ff7a6fd4bf7d1b

SHA256
01024f0b238f40220bf1f5e0f9be4316f27cf0f12c4af02ffac5ad66a365083c

SHA512
a2a13dc6f467dd19521b32dc460b671b5d6a2696efd7ebe71a1f968f6b1031856ae377d65370645f6c6796e6e2357a7293816090605e62a792af98eac7720558

Download Submit
\Windows\SysWOW64\hfnapi.dll
Filesize
106KB

MD5
cc5b46843da86c06977ba8a71b23d14c

SHA1
39b0def658c81323f6f31029f7ff7a6fd4bf7d1b

SHA256
01024f0b238f40220bf1f5e0f9be4316f27cf0f12c4af02ffac5ad66a365083c

SHA512
a2a13dc6f467dd19521b32dc460b671b5d6a2696efd7ebe71a1f968f6b1031856ae377d65370645f6c6796e6e2357a7293816090605e62a792af98eac7720558

Download Submit
\Windows\SysWOW64\hfpapi.dll
Filesize
244KB

MD5
0414011313df19dc215edbbd5d1de9c8

SHA1
4032036084d62e7a43b60d175b7028cc11e432dc

SHA256
9ddeec9a1228dffce101b1280823faef74b8f209fecb3855b4cf1c96f3527f40

SHA512
346387e12a256b447c034613df8f028777cc9fcbd1a0523a0803960e0d131e1a9e18b0c63769cea89111690fa7884ffd8fcb07c7ccdb6ee2aa1ca336b5ba4cd2

Download Submit
\Windows\SysWOW64\hfpapi.dll
Filesize
244KB

MD5
0414011313df19dc215edbbd5d1de9c8

SHA1
4032036084d62e7a43b60d175b7028cc11e432dc

SHA256
9ddeec9a1228dffce101b1280823faef74b8f209fecb3855b4cf1c96f3527f40

SHA512
346387e12a256b447c034613df8f028777cc9fcbd1a0523a0803960e0d131e1a9e18b0c63769cea89111690fa7884ffd8fcb07c7ccdb6ee2aa1ca336b5ba4cd2

Download Submit
\Windows\SysWOW64\installd.exe
Filesize
108KB

MD5
694e4ff753c69121d8f37c20b06e2483

SHA1
d08f66ff61efd7fd80f94d1714810167a0fa807c

SHA256
33aa26589bcd0729065d013672e4a7abd1c67e4180acc07d9a4f32842a94b75d

SHA512
8d379037a8df24f90c146d85b3e6a2b742ffa8f16c1095b26af8183dbee0dca33329abb8e0c1de37ef3340637e1afc16e6edea1b1b8c988fa0679605b0626274

Download Submit
\Windows\SysWOW64\nethtsrv.exe
Filesize
176KB

MD5
58d01f7b823b937f4342bc09d8c81431

SHA1
3cbe6f6153f9088ed03aafa080ec36d1eefffc8d

SHA256
7c1ee4a096ec4bb4a933bbe433a1c0609da345d3ad418ab9df541be5a8d76d46

SHA512
fca36764cfec5a82334e09726a01c6a877bbdb86db5c6512c09d6d507183a5378f6000726f41cb62ad17aaefe4598dec4111182ad5516668c9dd6858f5270180

Download Submit
\Windows\SysWOW64\netupdsrv.exe
Filesize
158KB

MD5
2811b2328ff36018d99b8a95e5295ef1

SHA1
35e3b8c090c1182582183705aa18df39bbe8b3f0

SHA256
6b143d2a51f03ae739fa238c9ec861f27506a6366be1e3b1587825a518b7bd84

SHA512
8f705e9fe8b134a29f7fc9eb3ec438670b85aa5602258db374eb2ba57bf874667e02c694b5a2791718a470eb1a119ea4783b140b0c1127b15ec57a2828a8d91d

Download Submit
memory/276-87-0x0000000000000000-mapping.dmp

Download
memory/584-80-0x0000000000000000-mapping.dmp

Download
memory/848-62-0x0000000000000000-mapping.dmp

Download
memory/1052-64-0x0000000000000000-mapping.dmp

Download
memory/1108-81-0x0000000000000000-mapping.dmp

Download
memory/1272-58-0x0000000000000000-mapping.dmp

Download
memory/1392-54-0x0000000075601000-0x0000000075603000-memory.dmp

Filesize
8KB

Download
memory/1392-59-0x0000000000360000-0x00000000007BE000-memory.dmp

Filesize
4.4MB

Download
memory/1392-90-0x0000000000360000-0x00000000007BE000-memory.dmp

Filesize
4.4MB

Download
memory/1600-57-0x0000000000000000-mapping.dmp

Download
memory/1716-70-0x0000000000000000-mapping.dmp

Download
memory/1772-86-0x0000000000000000-mapping.dmp

Download
memory/1952-76-0x0000000000000000-mapping.dmp

Download
memory/2000-61-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads