20cb2b3fd36ce75489b10f864f9384fd86f8a41e189b5d8205c8eb3d0c9d8a5d

Analysis

max time kernel
38s
max time network
43s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
23-11-2022 10:31

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

20cb2b3fd36ce75489b10f864f9384fd86f8a41e189b5d8205c8eb3d0c9d8a5d.exe
Size

601KB
MD5

0c00383123b7cec1403250f37787e0ff
SHA1

799008ea0747148ac4d6ff49ebf2b193522e00cf
SHA256

20cb2b3fd36ce75489b10f864f9384fd86f8a41e189b5d8205c8eb3d0c9d8a5d
SHA512

8319c4d0b76403cf5cf95a485cf5b27355b49287e2e2980a6aed86d356620db2a08fbb11c8aa0c062cb353396560ad2b2775ecff4f22277aa67161cfed165214
SSDEEP

12288:6Iny5DYT9fih13A3+8JP9l0z3dMDtgdtN/hMO1NDeiZw4L0s:cUThih13Z60TeCpMmNDeJ4

Score

8^/10

discovery

Malware Config

Signatures

Drops file in Drivers directory 1 IoCs

Processes:

20cb2b3fd36ce75489b10f864f9384fd86f8a41e189b5d8205c8eb3d0c9d8a5d.exe

description ioc process

File created C:\Windows\system32\drivers\nethfdrv.sys 20cb2b3fd36ce75489b10f864f9384fd86f8a41e189b5d8205c8eb3d0c9d8a5d.exe
Executes dropped EXE 5 IoCs

Processes:

installd.exenethtsrv.exenetupdsrv.exenethtsrv.exenetupdsrv.exe

pid process

972 installd.exe
380 nethtsrv.exe
1844 netupdsrv.exe
1512 nethtsrv.exe
1364 netupdsrv.exe

description	ioc	process
File created	C:\Windows\system32\drivers\nethfdrv.sys	20cb2b3fd36ce75489b10f864f9384fd86f8a41e189b5d8205c8eb3d0c9d8a5d.exe

pid	process
972	installd.exe
380	nethtsrv.exe
1844	netupdsrv.exe
1512	nethtsrv.exe
1364	netupdsrv.exe

Loads dropped DLL 13 IoCs

Processes:

20cb2b3fd36ce75489b10f864f9384fd86f8a41e189b5d8205c8eb3d0c9d8a5d.exeinstalld.exenethtsrv.exenethtsrv.exe

pid	process
1504	20cb2b3fd36ce75489b10f864f9384fd86f8a41e189b5d8205c8eb3d0c9d8a5d.exe
1504	20cb2b3fd36ce75489b10f864f9384fd86f8a41e189b5d8205c8eb3d0c9d8a5d.exe
1504	20cb2b3fd36ce75489b10f864f9384fd86f8a41e189b5d8205c8eb3d0c9d8a5d.exe
1504	20cb2b3fd36ce75489b10f864f9384fd86f8a41e189b5d8205c8eb3d0c9d8a5d.exe
972	installd.exe
1504	20cb2b3fd36ce75489b10f864f9384fd86f8a41e189b5d8205c8eb3d0c9d8a5d.exe
380	nethtsrv.exe
380	nethtsrv.exe
1504	20cb2b3fd36ce75489b10f864f9384fd86f8a41e189b5d8205c8eb3d0c9d8a5d.exe
1504	20cb2b3fd36ce75489b10f864f9384fd86f8a41e189b5d8205c8eb3d0c9d8a5d.exe
1512	nethtsrv.exe
1512	nethtsrv.exe
1504	20cb2b3fd36ce75489b10f864f9384fd86f8a41e189b5d8205c8eb3d0c9d8a5d.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in System32 directory 5 IoCs

Processes:

20cb2b3fd36ce75489b10f864f9384fd86f8a41e189b5d8205c8eb3d0c9d8a5d.exe

description	ioc	process
File created	C:\Windows\SysWOW64\hfpapi.dll	20cb2b3fd36ce75489b10f864f9384fd86f8a41e189b5d8205c8eb3d0c9d8a5d.exe
File created	C:\Windows\SysWOW64\installd.exe	20cb2b3fd36ce75489b10f864f9384fd86f8a41e189b5d8205c8eb3d0c9d8a5d.exe
File created	C:\Windows\SysWOW64\nethtsrv.exe	20cb2b3fd36ce75489b10f864f9384fd86f8a41e189b5d8205c8eb3d0c9d8a5d.exe
File created	C:\Windows\SysWOW64\netupdsrv.exe	20cb2b3fd36ce75489b10f864f9384fd86f8a41e189b5d8205c8eb3d0c9d8a5d.exe
File created	C:\Windows\SysWOW64\hfnapi.dll	20cb2b3fd36ce75489b10f864f9384fd86f8a41e189b5d8205c8eb3d0c9d8a5d.exe

Drops file in Program Files directory 3 IoCs

Processes:

20cb2b3fd36ce75489b10f864f9384fd86f8a41e189b5d8205c8eb3d0c9d8a5d.exe

description	ioc	process
File created	C:\Program Files (x86)\Common Files\Config\data.xml	20cb2b3fd36ce75489b10f864f9384fd86f8a41e189b5d8205c8eb3d0c9d8a5d.exe
File created	C:\Program Files (x86)\Common Files\Config\ver.xml	20cb2b3fd36ce75489b10f864f9384fd86f8a41e189b5d8205c8eb3d0c9d8a5d.exe
File created	C:\Program Files (x86)\Common Files\config\uninstinethnfd.exe	20cb2b3fd36ce75489b10f864f9384fd86f8a41e189b5d8205c8eb3d0c9d8a5d.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Runs net.exe
Suspicious behavior: LoadsDriver 1 IoCs

Processes:

pid process

460
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

nethtsrv.exe

description pid process

Token: SeDebugPrivilege 1512 nethtsrv.exe

pid	process
460

description	pid	process
Token: SeDebugPrivilege	1512	nethtsrv.exe

Suspicious use of WriteProcessMemory 50 IoCs

Processes:

20cb2b3fd36ce75489b10f864f9384fd86f8a41e189b5d8205c8eb3d0c9d8a5d.exenet.exenet.exenet.exenet.exe

description	pid	process	target process
PID 1504 wrote to memory of 1352	1504	20cb2b3fd36ce75489b10f864f9384fd86f8a41e189b5d8205c8eb3d0c9d8a5d.exe	net.exe
PID 1504 wrote to memory of 1352	1504	20cb2b3fd36ce75489b10f864f9384fd86f8a41e189b5d8205c8eb3d0c9d8a5d.exe	net.exe
PID 1504 wrote to memory of 1352	1504	20cb2b3fd36ce75489b10f864f9384fd86f8a41e189b5d8205c8eb3d0c9d8a5d.exe	net.exe
PID 1504 wrote to memory of 1352	1504	20cb2b3fd36ce75489b10f864f9384fd86f8a41e189b5d8205c8eb3d0c9d8a5d.exe	net.exe
PID 1352 wrote to memory of 1112	1352	net.exe	net1.exe
PID 1352 wrote to memory of 1112	1352	net.exe	net1.exe
PID 1352 wrote to memory of 1112	1352	net.exe	net1.exe
PID 1352 wrote to memory of 1112	1352	net.exe	net1.exe
PID 1504 wrote to memory of 888	1504	20cb2b3fd36ce75489b10f864f9384fd86f8a41e189b5d8205c8eb3d0c9d8a5d.exe	net.exe
PID 1504 wrote to memory of 888	1504	20cb2b3fd36ce75489b10f864f9384fd86f8a41e189b5d8205c8eb3d0c9d8a5d.exe	net.exe
PID 1504 wrote to memory of 888	1504	20cb2b3fd36ce75489b10f864f9384fd86f8a41e189b5d8205c8eb3d0c9d8a5d.exe	net.exe
PID 1504 wrote to memory of 888	1504	20cb2b3fd36ce75489b10f864f9384fd86f8a41e189b5d8205c8eb3d0c9d8a5d.exe	net.exe
PID 888 wrote to memory of 956	888	net.exe	net1.exe
PID 888 wrote to memory of 956	888	net.exe	net1.exe
PID 888 wrote to memory of 956	888	net.exe	net1.exe
PID 888 wrote to memory of 956	888	net.exe	net1.exe
PID 1504 wrote to memory of 972	1504	20cb2b3fd36ce75489b10f864f9384fd86f8a41e189b5d8205c8eb3d0c9d8a5d.exe	installd.exe
PID 1504 wrote to memory of 972	1504	20cb2b3fd36ce75489b10f864f9384fd86f8a41e189b5d8205c8eb3d0c9d8a5d.exe	installd.exe
PID 1504 wrote to memory of 972	1504	20cb2b3fd36ce75489b10f864f9384fd86f8a41e189b5d8205c8eb3d0c9d8a5d.exe	installd.exe
PID 1504 wrote to memory of 972	1504	20cb2b3fd36ce75489b10f864f9384fd86f8a41e189b5d8205c8eb3d0c9d8a5d.exe	installd.exe
PID 1504 wrote to memory of 972	1504	20cb2b3fd36ce75489b10f864f9384fd86f8a41e189b5d8205c8eb3d0c9d8a5d.exe	installd.exe
PID 1504 wrote to memory of 972	1504	20cb2b3fd36ce75489b10f864f9384fd86f8a41e189b5d8205c8eb3d0c9d8a5d.exe	installd.exe
PID 1504 wrote to memory of 972	1504	20cb2b3fd36ce75489b10f864f9384fd86f8a41e189b5d8205c8eb3d0c9d8a5d.exe	installd.exe
PID 1504 wrote to memory of 380	1504	20cb2b3fd36ce75489b10f864f9384fd86f8a41e189b5d8205c8eb3d0c9d8a5d.exe	nethtsrv.exe
PID 1504 wrote to memory of 380	1504	20cb2b3fd36ce75489b10f864f9384fd86f8a41e189b5d8205c8eb3d0c9d8a5d.exe	nethtsrv.exe
PID 1504 wrote to memory of 380	1504	20cb2b3fd36ce75489b10f864f9384fd86f8a41e189b5d8205c8eb3d0c9d8a5d.exe	nethtsrv.exe
PID 1504 wrote to memory of 380	1504	20cb2b3fd36ce75489b10f864f9384fd86f8a41e189b5d8205c8eb3d0c9d8a5d.exe	nethtsrv.exe
PID 1504 wrote to memory of 1844	1504	20cb2b3fd36ce75489b10f864f9384fd86f8a41e189b5d8205c8eb3d0c9d8a5d.exe	netupdsrv.exe
PID 1504 wrote to memory of 1844	1504	20cb2b3fd36ce75489b10f864f9384fd86f8a41e189b5d8205c8eb3d0c9d8a5d.exe	netupdsrv.exe
PID 1504 wrote to memory of 1844	1504	20cb2b3fd36ce75489b10f864f9384fd86f8a41e189b5d8205c8eb3d0c9d8a5d.exe	netupdsrv.exe
PID 1504 wrote to memory of 1844	1504	20cb2b3fd36ce75489b10f864f9384fd86f8a41e189b5d8205c8eb3d0c9d8a5d.exe	netupdsrv.exe
PID 1504 wrote to memory of 1844	1504	20cb2b3fd36ce75489b10f864f9384fd86f8a41e189b5d8205c8eb3d0c9d8a5d.exe	netupdsrv.exe
PID 1504 wrote to memory of 1844	1504	20cb2b3fd36ce75489b10f864f9384fd86f8a41e189b5d8205c8eb3d0c9d8a5d.exe	netupdsrv.exe
PID 1504 wrote to memory of 1844	1504	20cb2b3fd36ce75489b10f864f9384fd86f8a41e189b5d8205c8eb3d0c9d8a5d.exe	netupdsrv.exe
PID 1504 wrote to memory of 1168	1504	20cb2b3fd36ce75489b10f864f9384fd86f8a41e189b5d8205c8eb3d0c9d8a5d.exe	net.exe
PID 1504 wrote to memory of 1168	1504	20cb2b3fd36ce75489b10f864f9384fd86f8a41e189b5d8205c8eb3d0c9d8a5d.exe	net.exe
PID 1504 wrote to memory of 1168	1504	20cb2b3fd36ce75489b10f864f9384fd86f8a41e189b5d8205c8eb3d0c9d8a5d.exe	net.exe
PID 1504 wrote to memory of 1168	1504	20cb2b3fd36ce75489b10f864f9384fd86f8a41e189b5d8205c8eb3d0c9d8a5d.exe	net.exe
PID 1168 wrote to memory of 1320	1168	net.exe	net1.exe
PID 1168 wrote to memory of 1320	1168	net.exe	net1.exe
PID 1168 wrote to memory of 1320	1168	net.exe	net1.exe
PID 1168 wrote to memory of 1320	1168	net.exe	net1.exe
PID 1504 wrote to memory of 1484	1504	20cb2b3fd36ce75489b10f864f9384fd86f8a41e189b5d8205c8eb3d0c9d8a5d.exe	net.exe
PID 1504 wrote to memory of 1484	1504	20cb2b3fd36ce75489b10f864f9384fd86f8a41e189b5d8205c8eb3d0c9d8a5d.exe	net.exe
PID 1504 wrote to memory of 1484	1504	20cb2b3fd36ce75489b10f864f9384fd86f8a41e189b5d8205c8eb3d0c9d8a5d.exe	net.exe
PID 1504 wrote to memory of 1484	1504	20cb2b3fd36ce75489b10f864f9384fd86f8a41e189b5d8205c8eb3d0c9d8a5d.exe	net.exe
PID 1484 wrote to memory of 1052	1484	net.exe	net1.exe
PID 1484 wrote to memory of 1052	1484	net.exe	net1.exe
PID 1484 wrote to memory of 1052	1484	net.exe	net1.exe
PID 1484 wrote to memory of 1052	1484	net.exe	net1.exe

C:\Users\Admin\AppData\Local\Temp\20cb2b3fd36ce75489b10f864f9384fd86f8a41e189b5d8205c8eb3d0c9d8a5d.exe
"C:\Users\Admin\AppData\Local\Temp\20cb2b3fd36ce75489b10f864f9384fd86f8a41e189b5d8205c8eb3d0c9d8a5d.exe"
1⤵
- Drops file in Drivers directory
- Loads dropped DLL
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:1504

C:\Windows\SysWOW64\net.exe
net stop nethttpservice
2⤵
- Suspicious use of WriteProcessMemory
PID:1352

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop nethttpservice
3⤵
PID:1112

C:\Windows\SysWOW64\net.exe
net stop serviceupdater
2⤵
- Suspicious use of WriteProcessMemory
PID:888

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop serviceupdater
3⤵
PID:956

C:\Windows\SysWOW64\installd.exe
"C:\Windows\system32\installd.exe" nethfdrv
2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:972

C:\Windows\SysWOW64\nethtsrv.exe
"C:\Windows\system32\nethtsrv.exe" -nfdi
2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:380

C:\Windows\SysWOW64\netupdsrv.exe
"C:\Windows\system32\netupdsrv.exe" -nfdi
2⤵
- Executes dropped EXE
PID:1844

C:\Windows\SysWOW64\net.exe
net start nethttpservice
2⤵
- Suspicious use of WriteProcessMemory
PID:1168

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 start nethttpservice
3⤵
PID:1320

C:\Windows\SysWOW64\net.exe
net start serviceupdater
2⤵
- Suspicious use of WriteProcessMemory
PID:1484

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 start serviceupdater
3⤵
PID:1052

C:\Windows\SysWOW64\nethtsrv.exe
C:\Windows\SysWOW64\nethtsrv.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:1512

C:\Windows\SysWOW64\netupdsrv.exe
C:\Windows\SysWOW64\netupdsrv.exe
1⤵
- Executes dropped EXE
PID:1364

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\hfnapi.dll
Filesize
106KB

MD5
4b59d10103a1742e8bafa82efe149cd7

SHA1
9c93fd87be9f12f96c5d193eda377dbd8623f3c3

SHA256
f7c2a0b9ee1b160c866a156743f4825bf8883f57965e0f1e5eace084da57cea9

SHA512
0b277e6288a9a22d79447e78945dd2aba0e47338bf6fa22703a6c3975443554883e8ab757cb7244ce5fc3d56aeb6631935c179cb0b2d3f63b987f38f0f1bbbd0

Download Submit
C:\Windows\SysWOW64\hfpapi.dll
Filesize
241KB

MD5
48e1e976926acb917bf7487a7e8da11f

SHA1
04f3f87508cb611207ff944c5a8b77f74b4f4861

SHA256
5f0f70f450195ee0797750216fc1c564b3da9031cbea5d17c10c0ebdc75c6d90

SHA512
7fcd8d901ad0b1c4f5099cdf0ed1713d0756cd9b200f49f52e255efe1a37b7588d72df0fa590bd6dc8353ad244f9af8e0acfc6814c05b56e13c9c33191abed32

Download Submit
C:\Windows\SysWOW64\installd.exe
Filesize
108KB

MD5
6de5be9e92304fb2ffbfb53397cd053c

SHA1
600196f9faea0d603e5156177b1199d658f9f1ad

SHA256
f1745d2b36fd68b7b481ec4900dfe80fe88b135210f17f6afb88bf3e88475efb

SHA512
dc4eae4756720445ac947e2c96baf16b121795448ef75424389467b62467f5dd713662030911ed55500b058a0f1594be69ef84c418c3c11b1ace33992139a107

Download Submit
C:\Windows\SysWOW64\nethtsrv.exe
Filesize
176KB

MD5
385cad95fa26f81c602d86a637f8b50c

SHA1
961d8f16147efab211c63ca167d67b93cfacabd8

SHA256
aea97ad85c4da42e4644eb36c5dc4ade2ad36a3ddf39594aad1d0912a490f69a

SHA512
c6ca7efdeb1b9a1805855a0d3fd9a0d3826a666b378cdbabb0b871c8730884c97cba4b0d39e15d72ce975fb796b7f26e51e9306596ce30e3f3724b114e762d8f

Download Submit
C:\Windows\SysWOW64\nethtsrv.exe
Filesize
176KB

MD5
385cad95fa26f81c602d86a637f8b50c

SHA1
961d8f16147efab211c63ca167d67b93cfacabd8

SHA256
aea97ad85c4da42e4644eb36c5dc4ade2ad36a3ddf39594aad1d0912a490f69a

SHA512
c6ca7efdeb1b9a1805855a0d3fd9a0d3826a666b378cdbabb0b871c8730884c97cba4b0d39e15d72ce975fb796b7f26e51e9306596ce30e3f3724b114e762d8f

Download Submit
C:\Windows\SysWOW64\netupdsrv.exe
Filesize
158KB

MD5
a02be164147290226186a4f93a35e8b6

SHA1
c6115f105927b456064cabd95427cc5e708f7d49

SHA256
da05bc8c6b674852c59e2c50c0266ce5ad979f995895f1af74f64cf0b7922d63

SHA512
8b7399b120c1f0c56d51e8c97623a3e590799bfbca821fd9a1f907531cc79638622e653ac915290cf8fa043f91f8fbd5997659b9332aa8ddeff61562ad78a5d8

Download Submit
C:\Windows\SysWOW64\netupdsrv.exe
Filesize
158KB

MD5
a02be164147290226186a4f93a35e8b6

SHA1
c6115f105927b456064cabd95427cc5e708f7d49

SHA256
da05bc8c6b674852c59e2c50c0266ce5ad979f995895f1af74f64cf0b7922d63

SHA512
8b7399b120c1f0c56d51e8c97623a3e590799bfbca821fd9a1f907531cc79638622e653ac915290cf8fa043f91f8fbd5997659b9332aa8ddeff61562ad78a5d8

Download Submit
\Users\Admin\AppData\Local\Temp\nsj55D1.tmp\System.dll
Filesize
11KB

MD5
c17103ae9072a06da581dec998343fc1

SHA1
b72148c6bdfaada8b8c3f950e610ee7cf1da1f8d

SHA256
dc58d8ad81cacb0c1ed72e33bff8f23ea40b5252b5bb55d393a0903e6819ae2f

SHA512
d32a71aaef18e993f28096d536e41c4d016850721b31171513ce28bbd805a54fd290b7c3e9d935f72e676a1acfb4f0dcc89d95040a0dd29f2b6975855c18986f

Download Submit
\Users\Admin\AppData\Local\Temp\nsj55D1.tmp\nsExec.dll
Filesize
6KB

MD5
acc2b699edfea5bf5aae45aba3a41e96

SHA1
d2accf4d494e43ceb2cff69abe4dd17147d29cc2

SHA256
168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e

SHA512
e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe

Download Submit
\Users\Admin\AppData\Local\Temp\nsj55D1.tmp\nsExec.dll
Filesize
6KB

MD5
acc2b699edfea5bf5aae45aba3a41e96

SHA1
d2accf4d494e43ceb2cff69abe4dd17147d29cc2

SHA256
168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e

SHA512
e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe

Download Submit
\Users\Admin\AppData\Local\Temp\nsj55D1.tmp\nsExec.dll
Filesize
6KB

MD5
acc2b699edfea5bf5aae45aba3a41e96

SHA1
d2accf4d494e43ceb2cff69abe4dd17147d29cc2

SHA256
168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e

SHA512
e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe

Download Submit
\Users\Admin\AppData\Local\Temp\nsj55D1.tmp\nsExec.dll
Filesize
6KB

MD5
acc2b699edfea5bf5aae45aba3a41e96

SHA1
d2accf4d494e43ceb2cff69abe4dd17147d29cc2

SHA256
168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e

SHA512
e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe

Download Submit
\Windows\SysWOW64\hfnapi.dll
Filesize
106KB

MD5
4b59d10103a1742e8bafa82efe149cd7

SHA1
9c93fd87be9f12f96c5d193eda377dbd8623f3c3

SHA256
f7c2a0b9ee1b160c866a156743f4825bf8883f57965e0f1e5eace084da57cea9

SHA512
0b277e6288a9a22d79447e78945dd2aba0e47338bf6fa22703a6c3975443554883e8ab757cb7244ce5fc3d56aeb6631935c179cb0b2d3f63b987f38f0f1bbbd0

Download Submit
\Windows\SysWOW64\hfnapi.dll
Filesize
106KB

MD5
4b59d10103a1742e8bafa82efe149cd7

SHA1
9c93fd87be9f12f96c5d193eda377dbd8623f3c3

SHA256
f7c2a0b9ee1b160c866a156743f4825bf8883f57965e0f1e5eace084da57cea9

SHA512
0b277e6288a9a22d79447e78945dd2aba0e47338bf6fa22703a6c3975443554883e8ab757cb7244ce5fc3d56aeb6631935c179cb0b2d3f63b987f38f0f1bbbd0

Download Submit
\Windows\SysWOW64\hfnapi.dll
Filesize
106KB

MD5
4b59d10103a1742e8bafa82efe149cd7

SHA1
9c93fd87be9f12f96c5d193eda377dbd8623f3c3

SHA256
f7c2a0b9ee1b160c866a156743f4825bf8883f57965e0f1e5eace084da57cea9

SHA512
0b277e6288a9a22d79447e78945dd2aba0e47338bf6fa22703a6c3975443554883e8ab757cb7244ce5fc3d56aeb6631935c179cb0b2d3f63b987f38f0f1bbbd0

Download Submit
\Windows\SysWOW64\hfpapi.dll
Filesize
241KB

MD5
48e1e976926acb917bf7487a7e8da11f

SHA1
04f3f87508cb611207ff944c5a8b77f74b4f4861

SHA256
5f0f70f450195ee0797750216fc1c564b3da9031cbea5d17c10c0ebdc75c6d90

SHA512
7fcd8d901ad0b1c4f5099cdf0ed1713d0756cd9b200f49f52e255efe1a37b7588d72df0fa590bd6dc8353ad244f9af8e0acfc6814c05b56e13c9c33191abed32

Download Submit
\Windows\SysWOW64\hfpapi.dll
Filesize
241KB

MD5
48e1e976926acb917bf7487a7e8da11f

SHA1
04f3f87508cb611207ff944c5a8b77f74b4f4861

SHA256
5f0f70f450195ee0797750216fc1c564b3da9031cbea5d17c10c0ebdc75c6d90

SHA512
7fcd8d901ad0b1c4f5099cdf0ed1713d0756cd9b200f49f52e255efe1a37b7588d72df0fa590bd6dc8353ad244f9af8e0acfc6814c05b56e13c9c33191abed32

Download Submit
\Windows\SysWOW64\installd.exe
Filesize
108KB

MD5
6de5be9e92304fb2ffbfb53397cd053c

SHA1
600196f9faea0d603e5156177b1199d658f9f1ad

SHA256
f1745d2b36fd68b7b481ec4900dfe80fe88b135210f17f6afb88bf3e88475efb

SHA512
dc4eae4756720445ac947e2c96baf16b121795448ef75424389467b62467f5dd713662030911ed55500b058a0f1594be69ef84c418c3c11b1ace33992139a107

Download Submit
\Windows\SysWOW64\nethtsrv.exe
Filesize
176KB

MD5
385cad95fa26f81c602d86a637f8b50c

SHA1
961d8f16147efab211c63ca167d67b93cfacabd8

SHA256
aea97ad85c4da42e4644eb36c5dc4ade2ad36a3ddf39594aad1d0912a490f69a

SHA512
c6ca7efdeb1b9a1805855a0d3fd9a0d3826a666b378cdbabb0b871c8730884c97cba4b0d39e15d72ce975fb796b7f26e51e9306596ce30e3f3724b114e762d8f

Download Submit
\Windows\SysWOW64\netupdsrv.exe
Filesize
158KB

MD5
a02be164147290226186a4f93a35e8b6

SHA1
c6115f105927b456064cabd95427cc5e708f7d49

SHA256
da05bc8c6b674852c59e2c50c0266ce5ad979f995895f1af74f64cf0b7922d63

SHA512
8b7399b120c1f0c56d51e8c97623a3e590799bfbca821fd9a1f907531cc79638622e653ac915290cf8fa043f91f8fbd5997659b9332aa8ddeff61562ad78a5d8

Download Submit
memory/380-70-0x0000000000000000-mapping.dmp

Download
memory/888-61-0x0000000000000000-mapping.dmp

Download
memory/956-62-0x0000000000000000-mapping.dmp

Download
memory/972-64-0x0000000000000000-mapping.dmp

Download
memory/1052-87-0x0000000000000000-mapping.dmp

Download
memory/1112-59-0x0000000000000000-mapping.dmp

Download
memory/1168-80-0x0000000000000000-mapping.dmp

Download
memory/1320-81-0x0000000000000000-mapping.dmp

Download
memory/1352-58-0x0000000000000000-mapping.dmp

Download
memory/1484-86-0x0000000000000000-mapping.dmp

Download
memory/1504-54-0x00000000768A1000-0x00000000768A3000-memory.dmp

Filesize
8KB

Download
memory/1504-55-0x0000000000360000-0x00000000007BE000-memory.dmp

Filesize
4.4MB

Download
memory/1504-90-0x0000000000360000-0x00000000007BE000-memory.dmp

Filesize
4.4MB

Download
memory/1844-76-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads