1db741ad71fd78dbf156fe72a4840d61349dc1af75bbe08635e9b4d4af26105c

Analysis

max time kernel
42s
max time network
46s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
23-11-2022 10:31

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1db741ad71fd78dbf156fe72a4840d61349dc1af75bbe08635e9b4d4af26105c.exe
Size

601KB
MD5

95729bf843161984c698e088d336738d
SHA1

b68fa1a3ee8680647933f8600cefe91c9c34d56c
SHA256

1db741ad71fd78dbf156fe72a4840d61349dc1af75bbe08635e9b4d4af26105c
SHA512

c611b03d9b4e769524bdf1ec88228742d1390e5a792aa556d8d18d66a36117f3076b8d1e8ba0b95cc1ba3be875f82679c09197131c997c07641254b538593250
SSDEEP

12288:8Iny5DYT5IRN4Pcaih3MBDwXyDFjc1oFB51tln1:aUT5i63WSDAyDyqB9h

Score

8^/10

discovery

Malware Config

Signatures

Drops file in Drivers directory 1 IoCs

Processes:

1db741ad71fd78dbf156fe72a4840d61349dc1af75bbe08635e9b4d4af26105c.exe

description ioc process

File created C:\Windows\system32\drivers\nethfdrv.sys 1db741ad71fd78dbf156fe72a4840d61349dc1af75bbe08635e9b4d4af26105c.exe
Executes dropped EXE 5 IoCs

Processes:

installd.exenethtsrv.exenetupdsrv.exenethtsrv.exenetupdsrv.exe

pid process

1136 installd.exe
1588 nethtsrv.exe
684 netupdsrv.exe
1652 nethtsrv.exe
1964 netupdsrv.exe

description	ioc	process
File created	C:\Windows\system32\drivers\nethfdrv.sys	1db741ad71fd78dbf156fe72a4840d61349dc1af75bbe08635e9b4d4af26105c.exe

pid	process
1136	installd.exe
1588	nethtsrv.exe
684	netupdsrv.exe
1652	nethtsrv.exe
1964	netupdsrv.exe

Loads dropped DLL 13 IoCs

Processes:

1db741ad71fd78dbf156fe72a4840d61349dc1af75bbe08635e9b4d4af26105c.exeinstalld.exenethtsrv.exenethtsrv.exe

pid	process
540	1db741ad71fd78dbf156fe72a4840d61349dc1af75bbe08635e9b4d4af26105c.exe
540	1db741ad71fd78dbf156fe72a4840d61349dc1af75bbe08635e9b4d4af26105c.exe
540	1db741ad71fd78dbf156fe72a4840d61349dc1af75bbe08635e9b4d4af26105c.exe
540	1db741ad71fd78dbf156fe72a4840d61349dc1af75bbe08635e9b4d4af26105c.exe
1136	installd.exe
540	1db741ad71fd78dbf156fe72a4840d61349dc1af75bbe08635e9b4d4af26105c.exe
1588	nethtsrv.exe
1588	nethtsrv.exe
540	1db741ad71fd78dbf156fe72a4840d61349dc1af75bbe08635e9b4d4af26105c.exe
540	1db741ad71fd78dbf156fe72a4840d61349dc1af75bbe08635e9b4d4af26105c.exe
1652	nethtsrv.exe
1652	nethtsrv.exe
540	1db741ad71fd78dbf156fe72a4840d61349dc1af75bbe08635e9b4d4af26105c.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in System32 directory 5 IoCs

Processes:

1db741ad71fd78dbf156fe72a4840d61349dc1af75bbe08635e9b4d4af26105c.exe

description	ioc	process
File created	C:\Windows\SysWOW64\hfpapi.dll	1db741ad71fd78dbf156fe72a4840d61349dc1af75bbe08635e9b4d4af26105c.exe
File created	C:\Windows\SysWOW64\installd.exe	1db741ad71fd78dbf156fe72a4840d61349dc1af75bbe08635e9b4d4af26105c.exe
File created	C:\Windows\SysWOW64\nethtsrv.exe	1db741ad71fd78dbf156fe72a4840d61349dc1af75bbe08635e9b4d4af26105c.exe
File created	C:\Windows\SysWOW64\netupdsrv.exe	1db741ad71fd78dbf156fe72a4840d61349dc1af75bbe08635e9b4d4af26105c.exe
File created	C:\Windows\SysWOW64\hfnapi.dll	1db741ad71fd78dbf156fe72a4840d61349dc1af75bbe08635e9b4d4af26105c.exe

Drops file in Program Files directory 3 IoCs

Processes:

1db741ad71fd78dbf156fe72a4840d61349dc1af75bbe08635e9b4d4af26105c.exe

description	ioc	process
File created	C:\Program Files (x86)\Common Files\Config\data.xml	1db741ad71fd78dbf156fe72a4840d61349dc1af75bbe08635e9b4d4af26105c.exe
File created	C:\Program Files (x86)\Common Files\Config\ver.xml	1db741ad71fd78dbf156fe72a4840d61349dc1af75bbe08635e9b4d4af26105c.exe
File created	C:\Program Files (x86)\Common Files\config\uninstinethnfd.exe	1db741ad71fd78dbf156fe72a4840d61349dc1af75bbe08635e9b4d4af26105c.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Runs net.exe
Suspicious behavior: LoadsDriver 1 IoCs

Processes:

pid process

464
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

nethtsrv.exe

description pid process

Token: SeDebugPrivilege 1652 nethtsrv.exe

pid	process
464

description	pid	process
Token: SeDebugPrivilege	1652	nethtsrv.exe

Suspicious use of WriteProcessMemory 50 IoCs

Processes:

1db741ad71fd78dbf156fe72a4840d61349dc1af75bbe08635e9b4d4af26105c.exenet.exenet.exenet.exenet.exe

description	pid	process	target process
PID 540 wrote to memory of 1496	540	1db741ad71fd78dbf156fe72a4840d61349dc1af75bbe08635e9b4d4af26105c.exe	net.exe
PID 540 wrote to memory of 1496	540	1db741ad71fd78dbf156fe72a4840d61349dc1af75bbe08635e9b4d4af26105c.exe	net.exe
PID 540 wrote to memory of 1496	540	1db741ad71fd78dbf156fe72a4840d61349dc1af75bbe08635e9b4d4af26105c.exe	net.exe
PID 540 wrote to memory of 1496	540	1db741ad71fd78dbf156fe72a4840d61349dc1af75bbe08635e9b4d4af26105c.exe	net.exe
PID 1496 wrote to memory of 1420	1496	net.exe	net1.exe
PID 1496 wrote to memory of 1420	1496	net.exe	net1.exe
PID 1496 wrote to memory of 1420	1496	net.exe	net1.exe
PID 1496 wrote to memory of 1420	1496	net.exe	net1.exe
PID 540 wrote to memory of 1440	540	1db741ad71fd78dbf156fe72a4840d61349dc1af75bbe08635e9b4d4af26105c.exe	net.exe
PID 540 wrote to memory of 1440	540	1db741ad71fd78dbf156fe72a4840d61349dc1af75bbe08635e9b4d4af26105c.exe	net.exe
PID 540 wrote to memory of 1440	540	1db741ad71fd78dbf156fe72a4840d61349dc1af75bbe08635e9b4d4af26105c.exe	net.exe
PID 540 wrote to memory of 1440	540	1db741ad71fd78dbf156fe72a4840d61349dc1af75bbe08635e9b4d4af26105c.exe	net.exe
PID 1440 wrote to memory of 1344	1440	net.exe	net1.exe
PID 1440 wrote to memory of 1344	1440	net.exe	net1.exe
PID 1440 wrote to memory of 1344	1440	net.exe	net1.exe
PID 1440 wrote to memory of 1344	1440	net.exe	net1.exe
PID 540 wrote to memory of 1136	540	1db741ad71fd78dbf156fe72a4840d61349dc1af75bbe08635e9b4d4af26105c.exe	installd.exe
PID 540 wrote to memory of 1136	540	1db741ad71fd78dbf156fe72a4840d61349dc1af75bbe08635e9b4d4af26105c.exe	installd.exe
PID 540 wrote to memory of 1136	540	1db741ad71fd78dbf156fe72a4840d61349dc1af75bbe08635e9b4d4af26105c.exe	installd.exe
PID 540 wrote to memory of 1136	540	1db741ad71fd78dbf156fe72a4840d61349dc1af75bbe08635e9b4d4af26105c.exe	installd.exe
PID 540 wrote to memory of 1136	540	1db741ad71fd78dbf156fe72a4840d61349dc1af75bbe08635e9b4d4af26105c.exe	installd.exe
PID 540 wrote to memory of 1136	540	1db741ad71fd78dbf156fe72a4840d61349dc1af75bbe08635e9b4d4af26105c.exe	installd.exe
PID 540 wrote to memory of 1136	540	1db741ad71fd78dbf156fe72a4840d61349dc1af75bbe08635e9b4d4af26105c.exe	installd.exe
PID 540 wrote to memory of 1588	540	1db741ad71fd78dbf156fe72a4840d61349dc1af75bbe08635e9b4d4af26105c.exe	nethtsrv.exe
PID 540 wrote to memory of 1588	540	1db741ad71fd78dbf156fe72a4840d61349dc1af75bbe08635e9b4d4af26105c.exe	nethtsrv.exe
PID 540 wrote to memory of 1588	540	1db741ad71fd78dbf156fe72a4840d61349dc1af75bbe08635e9b4d4af26105c.exe	nethtsrv.exe
PID 540 wrote to memory of 1588	540	1db741ad71fd78dbf156fe72a4840d61349dc1af75bbe08635e9b4d4af26105c.exe	nethtsrv.exe
PID 540 wrote to memory of 684	540	1db741ad71fd78dbf156fe72a4840d61349dc1af75bbe08635e9b4d4af26105c.exe	netupdsrv.exe
PID 540 wrote to memory of 684	540	1db741ad71fd78dbf156fe72a4840d61349dc1af75bbe08635e9b4d4af26105c.exe	netupdsrv.exe
PID 540 wrote to memory of 684	540	1db741ad71fd78dbf156fe72a4840d61349dc1af75bbe08635e9b4d4af26105c.exe	netupdsrv.exe
PID 540 wrote to memory of 684	540	1db741ad71fd78dbf156fe72a4840d61349dc1af75bbe08635e9b4d4af26105c.exe	netupdsrv.exe
PID 540 wrote to memory of 684	540	1db741ad71fd78dbf156fe72a4840d61349dc1af75bbe08635e9b4d4af26105c.exe	netupdsrv.exe
PID 540 wrote to memory of 684	540	1db741ad71fd78dbf156fe72a4840d61349dc1af75bbe08635e9b4d4af26105c.exe	netupdsrv.exe
PID 540 wrote to memory of 684	540	1db741ad71fd78dbf156fe72a4840d61349dc1af75bbe08635e9b4d4af26105c.exe	netupdsrv.exe
PID 540 wrote to memory of 1840	540	1db741ad71fd78dbf156fe72a4840d61349dc1af75bbe08635e9b4d4af26105c.exe	net.exe
PID 540 wrote to memory of 1840	540	1db741ad71fd78dbf156fe72a4840d61349dc1af75bbe08635e9b4d4af26105c.exe	net.exe
PID 540 wrote to memory of 1840	540	1db741ad71fd78dbf156fe72a4840d61349dc1af75bbe08635e9b4d4af26105c.exe	net.exe
PID 540 wrote to memory of 1840	540	1db741ad71fd78dbf156fe72a4840d61349dc1af75bbe08635e9b4d4af26105c.exe	net.exe
PID 1840 wrote to memory of 1524	1840	net.exe	net1.exe
PID 1840 wrote to memory of 1524	1840	net.exe	net1.exe
PID 1840 wrote to memory of 1524	1840	net.exe	net1.exe
PID 1840 wrote to memory of 1524	1840	net.exe	net1.exe
PID 540 wrote to memory of 1332	540	1db741ad71fd78dbf156fe72a4840d61349dc1af75bbe08635e9b4d4af26105c.exe	net.exe
PID 540 wrote to memory of 1332	540	1db741ad71fd78dbf156fe72a4840d61349dc1af75bbe08635e9b4d4af26105c.exe	net.exe
PID 540 wrote to memory of 1332	540	1db741ad71fd78dbf156fe72a4840d61349dc1af75bbe08635e9b4d4af26105c.exe	net.exe
PID 540 wrote to memory of 1332	540	1db741ad71fd78dbf156fe72a4840d61349dc1af75bbe08635e9b4d4af26105c.exe	net.exe
PID 1332 wrote to memory of 1476	1332	net.exe	net1.exe
PID 1332 wrote to memory of 1476	1332	net.exe	net1.exe
PID 1332 wrote to memory of 1476	1332	net.exe	net1.exe
PID 1332 wrote to memory of 1476	1332	net.exe	net1.exe

C:\Users\Admin\AppData\Local\Temp\1db741ad71fd78dbf156fe72a4840d61349dc1af75bbe08635e9b4d4af26105c.exe
"C:\Users\Admin\AppData\Local\Temp\1db741ad71fd78dbf156fe72a4840d61349dc1af75bbe08635e9b4d4af26105c.exe"
1⤵
- Drops file in Drivers directory
- Loads dropped DLL
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:540

C:\Windows\SysWOW64\net.exe
net stop nethttpservice
2⤵
- Suspicious use of WriteProcessMemory
PID:1496

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop nethttpservice
3⤵
PID:1420

C:\Windows\SysWOW64\net.exe
net stop serviceupdater
2⤵
- Suspicious use of WriteProcessMemory
PID:1440

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop serviceupdater
3⤵
PID:1344

C:\Windows\SysWOW64\installd.exe
"C:\Windows\system32\installd.exe" nethfdrv
2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1136

C:\Windows\SysWOW64\nethtsrv.exe
"C:\Windows\system32\nethtsrv.exe" -nfdi
2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1588

C:\Windows\SysWOW64\netupdsrv.exe
"C:\Windows\system32\netupdsrv.exe" -nfdi
2⤵
- Executes dropped EXE
PID:684

C:\Windows\SysWOW64\net.exe
net start nethttpservice
2⤵
- Suspicious use of WriteProcessMemory
PID:1840

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 start nethttpservice
3⤵
PID:1524

C:\Windows\SysWOW64\net.exe
net start serviceupdater
2⤵
- Suspicious use of WriteProcessMemory
PID:1332

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 start serviceupdater
3⤵
PID:1476

C:\Windows\SysWOW64\nethtsrv.exe
C:\Windows\SysWOW64\nethtsrv.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:1652

C:\Windows\SysWOW64\netupdsrv.exe
C:\Windows\SysWOW64\netupdsrv.exe
1⤵
- Executes dropped EXE
PID:1964

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\hfnapi.dll
Filesize
106KB

MD5
7d06af3c599b5c1132f28427ad68bf03

SHA1
a973059074318f530f3f3f917aeb7227411673c2

SHA256
5daceadaea8d752ca0a8818f8fc33dfe26b851174435c161bdcfbad49560cff3

SHA512
8a6d56a27f0174d924ffb04f1c7386786df97ef77ed8e58c6eaec8d40e0d9fa2dd55abe98b18e59874b697503c634d5cfdbf49a13be941957445577aa493908f

Download Submit
C:\Windows\SysWOW64\hfpapi.dll
Filesize
241KB

MD5
364828dc85793cb6039270983af459e6

SHA1
a6d6a363dfcb88cc8383c4e42858c3a6de993553

SHA256
e94244f5706ded1f3c62613de39be664be3429aafa5c5c1358fefc9fced0bf7c

SHA512
4d622208cb007fb27835495aad5e0e79942ff26a29891f08b748bdffa89ce741259ecae6e7b3c634a461805b02f9ea47fca05705c2a4ffea4956b4da10321393

Download Submit
C:\Windows\SysWOW64\installd.exe
Filesize
108KB

MD5
146da669f1d99f041dca09e789cb4bc0

SHA1
24f36d29ffe6887ef2174bbcfa72dd4b72e50bcc

SHA256
fb24c203a27b6e125a1f942101b35c22fd65f44284f798f862834c9e91901657

SHA512
d2f48798a09963d0ec8cc722fad227abdde3f61b93fad9afab8165a19852c863ac15958fac01eb0f761e0797b96946c33e006bd63a38594c6ac57604a6f87b28

Download Submit
C:\Windows\SysWOW64\nethtsrv.exe
Filesize
176KB

MD5
9eabe077bd5b6ad832d6b7bf48010a18

SHA1
a413dc86b4cf85e98c31aecd4300023f7e79426c

SHA256
2655664fa4f9a55b029433953cdc593a74fdbfff2e87bc3438c9d1015a6a7e32

SHA512
1d819dc63116c08a4d259295774f0424d415920c6dbb61e1fd4c2b52e148588145a884e7a0e7e659eac3d3127033ca81d17a6abf026d7bf8d47ef090389f5962

Download Submit
C:\Windows\SysWOW64\nethtsrv.exe
Filesize
176KB

MD5
9eabe077bd5b6ad832d6b7bf48010a18

SHA1
a413dc86b4cf85e98c31aecd4300023f7e79426c

SHA256
2655664fa4f9a55b029433953cdc593a74fdbfff2e87bc3438c9d1015a6a7e32

SHA512
1d819dc63116c08a4d259295774f0424d415920c6dbb61e1fd4c2b52e148588145a884e7a0e7e659eac3d3127033ca81d17a6abf026d7bf8d47ef090389f5962

Download Submit
C:\Windows\SysWOW64\netupdsrv.exe
Filesize
158KB

MD5
ad1a9ade11fda70ccff31fcdec0c6ad0

SHA1
fb0f93fe7e266af348a930ddc68d47e774478f82

SHA256
c21cd869a2153fdbf99b97b3e7cdb9facb43e994cae7786161ca49063eb7390e

SHA512
ef5f2c3115d3069959b408d0050188e7ce3e67eaa4b3808ab4cb5461db58e40b23923a73abea3e85aa68ef79a11e7dac5b1f59355bb5ee79e27334b1d567de29

Download Submit
C:\Windows\SysWOW64\netupdsrv.exe
Filesize
158KB

MD5
ad1a9ade11fda70ccff31fcdec0c6ad0

SHA1
fb0f93fe7e266af348a930ddc68d47e774478f82

SHA256
c21cd869a2153fdbf99b97b3e7cdb9facb43e994cae7786161ca49063eb7390e

SHA512
ef5f2c3115d3069959b408d0050188e7ce3e67eaa4b3808ab4cb5461db58e40b23923a73abea3e85aa68ef79a11e7dac5b1f59355bb5ee79e27334b1d567de29

Download Submit
\Users\Admin\AppData\Local\Temp\nso4AF8.tmp\System.dll
Filesize
11KB

MD5
c17103ae9072a06da581dec998343fc1

SHA1
b72148c6bdfaada8b8c3f950e610ee7cf1da1f8d

SHA256
dc58d8ad81cacb0c1ed72e33bff8f23ea40b5252b5bb55d393a0903e6819ae2f

SHA512
d32a71aaef18e993f28096d536e41c4d016850721b31171513ce28bbd805a54fd290b7c3e9d935f72e676a1acfb4f0dcc89d95040a0dd29f2b6975855c18986f

Download Submit
\Users\Admin\AppData\Local\Temp\nso4AF8.tmp\nsExec.dll
Filesize
6KB

MD5
acc2b699edfea5bf5aae45aba3a41e96

SHA1
d2accf4d494e43ceb2cff69abe4dd17147d29cc2

SHA256
168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e

SHA512
e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe

Download Submit
\Users\Admin\AppData\Local\Temp\nso4AF8.tmp\nsExec.dll
Filesize
6KB

MD5
acc2b699edfea5bf5aae45aba3a41e96

SHA1
d2accf4d494e43ceb2cff69abe4dd17147d29cc2

SHA256
168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e

SHA512
e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe

Download Submit
\Users\Admin\AppData\Local\Temp\nso4AF8.tmp\nsExec.dll
Filesize
6KB

MD5
acc2b699edfea5bf5aae45aba3a41e96

SHA1
d2accf4d494e43ceb2cff69abe4dd17147d29cc2

SHA256
168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e

SHA512
e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe

Download Submit
\Users\Admin\AppData\Local\Temp\nso4AF8.tmp\nsExec.dll
Filesize
6KB

MD5
acc2b699edfea5bf5aae45aba3a41e96

SHA1
d2accf4d494e43ceb2cff69abe4dd17147d29cc2

SHA256
168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e

SHA512
e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe

Download Submit
\Windows\SysWOW64\hfnapi.dll
Filesize
106KB

MD5
7d06af3c599b5c1132f28427ad68bf03

SHA1
a973059074318f530f3f3f917aeb7227411673c2

SHA256
5daceadaea8d752ca0a8818f8fc33dfe26b851174435c161bdcfbad49560cff3

SHA512
8a6d56a27f0174d924ffb04f1c7386786df97ef77ed8e58c6eaec8d40e0d9fa2dd55abe98b18e59874b697503c634d5cfdbf49a13be941957445577aa493908f

Download Submit
\Windows\SysWOW64\hfnapi.dll
Filesize
106KB

MD5
7d06af3c599b5c1132f28427ad68bf03

SHA1
a973059074318f530f3f3f917aeb7227411673c2

SHA256
5daceadaea8d752ca0a8818f8fc33dfe26b851174435c161bdcfbad49560cff3

SHA512
8a6d56a27f0174d924ffb04f1c7386786df97ef77ed8e58c6eaec8d40e0d9fa2dd55abe98b18e59874b697503c634d5cfdbf49a13be941957445577aa493908f

Download Submit
\Windows\SysWOW64\hfnapi.dll
Filesize
106KB

MD5
7d06af3c599b5c1132f28427ad68bf03

SHA1
a973059074318f530f3f3f917aeb7227411673c2

SHA256
5daceadaea8d752ca0a8818f8fc33dfe26b851174435c161bdcfbad49560cff3

SHA512
8a6d56a27f0174d924ffb04f1c7386786df97ef77ed8e58c6eaec8d40e0d9fa2dd55abe98b18e59874b697503c634d5cfdbf49a13be941957445577aa493908f

Download Submit
\Windows\SysWOW64\hfpapi.dll
Filesize
241KB

MD5
364828dc85793cb6039270983af459e6

SHA1
a6d6a363dfcb88cc8383c4e42858c3a6de993553

SHA256
e94244f5706ded1f3c62613de39be664be3429aafa5c5c1358fefc9fced0bf7c

SHA512
4d622208cb007fb27835495aad5e0e79942ff26a29891f08b748bdffa89ce741259ecae6e7b3c634a461805b02f9ea47fca05705c2a4ffea4956b4da10321393

Download Submit
\Windows\SysWOW64\hfpapi.dll
Filesize
241KB

MD5
364828dc85793cb6039270983af459e6

SHA1
a6d6a363dfcb88cc8383c4e42858c3a6de993553

SHA256
e94244f5706ded1f3c62613de39be664be3429aafa5c5c1358fefc9fced0bf7c

SHA512
4d622208cb007fb27835495aad5e0e79942ff26a29891f08b748bdffa89ce741259ecae6e7b3c634a461805b02f9ea47fca05705c2a4ffea4956b4da10321393

Download Submit
\Windows\SysWOW64\installd.exe
Filesize
108KB

MD5
146da669f1d99f041dca09e789cb4bc0

SHA1
24f36d29ffe6887ef2174bbcfa72dd4b72e50bcc

SHA256
fb24c203a27b6e125a1f942101b35c22fd65f44284f798f862834c9e91901657

SHA512
d2f48798a09963d0ec8cc722fad227abdde3f61b93fad9afab8165a19852c863ac15958fac01eb0f761e0797b96946c33e006bd63a38594c6ac57604a6f87b28

Download Submit
\Windows\SysWOW64\nethtsrv.exe
Filesize
176KB

MD5
9eabe077bd5b6ad832d6b7bf48010a18

SHA1
a413dc86b4cf85e98c31aecd4300023f7e79426c

SHA256
2655664fa4f9a55b029433953cdc593a74fdbfff2e87bc3438c9d1015a6a7e32

SHA512
1d819dc63116c08a4d259295774f0424d415920c6dbb61e1fd4c2b52e148588145a884e7a0e7e659eac3d3127033ca81d17a6abf026d7bf8d47ef090389f5962

Download Submit
\Windows\SysWOW64\netupdsrv.exe
Filesize
158KB

MD5
ad1a9ade11fda70ccff31fcdec0c6ad0

SHA1
fb0f93fe7e266af348a930ddc68d47e774478f82

SHA256
c21cd869a2153fdbf99b97b3e7cdb9facb43e994cae7786161ca49063eb7390e

SHA512
ef5f2c3115d3069959b408d0050188e7ce3e67eaa4b3808ab4cb5461db58e40b23923a73abea3e85aa68ef79a11e7dac5b1f59355bb5ee79e27334b1d567de29

Download Submit
memory/540-90-0x0000000000360000-0x00000000007BE000-memory.dmp

Filesize
4.4MB

Download
memory/540-54-0x0000000076171000-0x0000000076173000-memory.dmp

Filesize
8KB

Download
memory/540-56-0x0000000000360000-0x00000000007BE000-memory.dmp

Filesize
4.4MB

Download
memory/684-76-0x0000000000000000-mapping.dmp

Download
memory/1136-64-0x0000000000000000-mapping.dmp

Download
memory/1332-86-0x0000000000000000-mapping.dmp

Download
memory/1344-62-0x0000000000000000-mapping.dmp

Download
memory/1420-59-0x0000000000000000-mapping.dmp

Download
memory/1440-61-0x0000000000000000-mapping.dmp

Download
memory/1476-87-0x0000000000000000-mapping.dmp

Download
memory/1496-58-0x0000000000000000-mapping.dmp

Download
memory/1524-81-0x0000000000000000-mapping.dmp

Download
memory/1588-70-0x0000000000000000-mapping.dmp

Download
memory/1840-80-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads