0a7e0215af1c6285400f143fac99132e6dc3f947ca1a6004d3b126a08ec00163

Analysis

max time kernel
44s
max time network
48s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
23-11-2022 10:34

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0a7e0215af1c6285400f143fac99132e6dc3f947ca1a6004d3b126a08ec00163.exe
Size

602KB
MD5

b3000958da5604040e5d42902bc9fc66
SHA1

4ee364f14be3a75cf1f5540d8724eaedbe7b4338
SHA256

0a7e0215af1c6285400f143fac99132e6dc3f947ca1a6004d3b126a08ec00163
SHA512

41649f1656f85776ed0dbb2dad1cd27253bd9109a7b23becfa35ada31bda2c6c6cbd52afbacf5f49d4b1e18e31c8fde6e28c40dc9bda4a8c26763bba629e958a
SSDEEP

12288:PIny5DYTg+mSzjxY9O9mZMaPTHxuCRZZenpo51NqzYcs91:XUTg3etotRTHxueuorNI03

Score

8^/10

discovery

Malware Config

Signatures

Drops file in Drivers directory 1 IoCs

Processes:

0a7e0215af1c6285400f143fac99132e6dc3f947ca1a6004d3b126a08ec00163.exe

description ioc process

File created C:\Windows\system32\drivers\nethfdrv.sys 0a7e0215af1c6285400f143fac99132e6dc3f947ca1a6004d3b126a08ec00163.exe
Executes dropped EXE 5 IoCs

Processes:

installd.exenethtsrv.exenetupdsrv.exenethtsrv.exenetupdsrv.exe

pid process

1720 installd.exe
1260 nethtsrv.exe
1732 netupdsrv.exe
1860 nethtsrv.exe
1320 netupdsrv.exe

description	ioc	process
File created	C:\Windows\system32\drivers\nethfdrv.sys	0a7e0215af1c6285400f143fac99132e6dc3f947ca1a6004d3b126a08ec00163.exe

pid	process
1720	installd.exe
1260	nethtsrv.exe
1732	netupdsrv.exe
1860	nethtsrv.exe
1320	netupdsrv.exe

Loads dropped DLL 13 IoCs

Processes:

0a7e0215af1c6285400f143fac99132e6dc3f947ca1a6004d3b126a08ec00163.exeinstalld.exenethtsrv.exenethtsrv.exe

pid	process
1664	0a7e0215af1c6285400f143fac99132e6dc3f947ca1a6004d3b126a08ec00163.exe
1664	0a7e0215af1c6285400f143fac99132e6dc3f947ca1a6004d3b126a08ec00163.exe
1664	0a7e0215af1c6285400f143fac99132e6dc3f947ca1a6004d3b126a08ec00163.exe
1664	0a7e0215af1c6285400f143fac99132e6dc3f947ca1a6004d3b126a08ec00163.exe
1720	installd.exe
1664	0a7e0215af1c6285400f143fac99132e6dc3f947ca1a6004d3b126a08ec00163.exe
1260	nethtsrv.exe
1260	nethtsrv.exe
1664	0a7e0215af1c6285400f143fac99132e6dc3f947ca1a6004d3b126a08ec00163.exe
1664	0a7e0215af1c6285400f143fac99132e6dc3f947ca1a6004d3b126a08ec00163.exe
1860	nethtsrv.exe
1860	nethtsrv.exe
1664	0a7e0215af1c6285400f143fac99132e6dc3f947ca1a6004d3b126a08ec00163.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in System32 directory 5 IoCs

Processes:

0a7e0215af1c6285400f143fac99132e6dc3f947ca1a6004d3b126a08ec00163.exe

description	ioc	process
File created	C:\Windows\SysWOW64\nethtsrv.exe	0a7e0215af1c6285400f143fac99132e6dc3f947ca1a6004d3b126a08ec00163.exe
File created	C:\Windows\SysWOW64\netupdsrv.exe	0a7e0215af1c6285400f143fac99132e6dc3f947ca1a6004d3b126a08ec00163.exe
File created	C:\Windows\SysWOW64\hfnapi.dll	0a7e0215af1c6285400f143fac99132e6dc3f947ca1a6004d3b126a08ec00163.exe
File created	C:\Windows\SysWOW64\hfpapi.dll	0a7e0215af1c6285400f143fac99132e6dc3f947ca1a6004d3b126a08ec00163.exe
File created	C:\Windows\SysWOW64\installd.exe	0a7e0215af1c6285400f143fac99132e6dc3f947ca1a6004d3b126a08ec00163.exe

Drops file in Program Files directory 3 IoCs

Processes:

0a7e0215af1c6285400f143fac99132e6dc3f947ca1a6004d3b126a08ec00163.exe

description	ioc	process
File created	C:\Program Files (x86)\Common Files\Config\ver.xml	0a7e0215af1c6285400f143fac99132e6dc3f947ca1a6004d3b126a08ec00163.exe
File created	C:\Program Files (x86)\Common Files\config\uninstinethnfd.exe	0a7e0215af1c6285400f143fac99132e6dc3f947ca1a6004d3b126a08ec00163.exe
File created	C:\Program Files (x86)\Common Files\Config\data.xml	0a7e0215af1c6285400f143fac99132e6dc3f947ca1a6004d3b126a08ec00163.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Runs net.exe
Suspicious behavior: LoadsDriver 1 IoCs

Processes:

pid process

460
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

nethtsrv.exe

description pid process

Token: SeDebugPrivilege 1860 nethtsrv.exe

pid	process
460

description	pid	process
Token: SeDebugPrivilege	1860	nethtsrv.exe

Suspicious use of WriteProcessMemory 50 IoCs

Processes:

0a7e0215af1c6285400f143fac99132e6dc3f947ca1a6004d3b126a08ec00163.exenet.exenet.exenet.exenet.exe

description	pid	process	target process
PID 1664 wrote to memory of 1976	1664	0a7e0215af1c6285400f143fac99132e6dc3f947ca1a6004d3b126a08ec00163.exe	net.exe
PID 1664 wrote to memory of 1976	1664	0a7e0215af1c6285400f143fac99132e6dc3f947ca1a6004d3b126a08ec00163.exe	net.exe
PID 1664 wrote to memory of 1976	1664	0a7e0215af1c6285400f143fac99132e6dc3f947ca1a6004d3b126a08ec00163.exe	net.exe
PID 1664 wrote to memory of 1976	1664	0a7e0215af1c6285400f143fac99132e6dc3f947ca1a6004d3b126a08ec00163.exe	net.exe
PID 1976 wrote to memory of 1460	1976	net.exe	net1.exe
PID 1976 wrote to memory of 1460	1976	net.exe	net1.exe
PID 1976 wrote to memory of 1460	1976	net.exe	net1.exe
PID 1976 wrote to memory of 1460	1976	net.exe	net1.exe
PID 1664 wrote to memory of 1136	1664	0a7e0215af1c6285400f143fac99132e6dc3f947ca1a6004d3b126a08ec00163.exe	net.exe
PID 1664 wrote to memory of 1136	1664	0a7e0215af1c6285400f143fac99132e6dc3f947ca1a6004d3b126a08ec00163.exe	net.exe
PID 1664 wrote to memory of 1136	1664	0a7e0215af1c6285400f143fac99132e6dc3f947ca1a6004d3b126a08ec00163.exe	net.exe
PID 1664 wrote to memory of 1136	1664	0a7e0215af1c6285400f143fac99132e6dc3f947ca1a6004d3b126a08ec00163.exe	net.exe
PID 1136 wrote to memory of 1276	1136	net.exe	net1.exe
PID 1136 wrote to memory of 1276	1136	net.exe	net1.exe
PID 1136 wrote to memory of 1276	1136	net.exe	net1.exe
PID 1136 wrote to memory of 1276	1136	net.exe	net1.exe
PID 1664 wrote to memory of 1720	1664	0a7e0215af1c6285400f143fac99132e6dc3f947ca1a6004d3b126a08ec00163.exe	installd.exe
PID 1664 wrote to memory of 1720	1664	0a7e0215af1c6285400f143fac99132e6dc3f947ca1a6004d3b126a08ec00163.exe	installd.exe
PID 1664 wrote to memory of 1720	1664	0a7e0215af1c6285400f143fac99132e6dc3f947ca1a6004d3b126a08ec00163.exe	installd.exe
PID 1664 wrote to memory of 1720	1664	0a7e0215af1c6285400f143fac99132e6dc3f947ca1a6004d3b126a08ec00163.exe	installd.exe
PID 1664 wrote to memory of 1720	1664	0a7e0215af1c6285400f143fac99132e6dc3f947ca1a6004d3b126a08ec00163.exe	installd.exe
PID 1664 wrote to memory of 1720	1664	0a7e0215af1c6285400f143fac99132e6dc3f947ca1a6004d3b126a08ec00163.exe	installd.exe
PID 1664 wrote to memory of 1720	1664	0a7e0215af1c6285400f143fac99132e6dc3f947ca1a6004d3b126a08ec00163.exe	installd.exe
PID 1664 wrote to memory of 1260	1664	0a7e0215af1c6285400f143fac99132e6dc3f947ca1a6004d3b126a08ec00163.exe	nethtsrv.exe
PID 1664 wrote to memory of 1260	1664	0a7e0215af1c6285400f143fac99132e6dc3f947ca1a6004d3b126a08ec00163.exe	nethtsrv.exe
PID 1664 wrote to memory of 1260	1664	0a7e0215af1c6285400f143fac99132e6dc3f947ca1a6004d3b126a08ec00163.exe	nethtsrv.exe
PID 1664 wrote to memory of 1260	1664	0a7e0215af1c6285400f143fac99132e6dc3f947ca1a6004d3b126a08ec00163.exe	nethtsrv.exe
PID 1664 wrote to memory of 1732	1664	0a7e0215af1c6285400f143fac99132e6dc3f947ca1a6004d3b126a08ec00163.exe	netupdsrv.exe
PID 1664 wrote to memory of 1732	1664	0a7e0215af1c6285400f143fac99132e6dc3f947ca1a6004d3b126a08ec00163.exe	netupdsrv.exe
PID 1664 wrote to memory of 1732	1664	0a7e0215af1c6285400f143fac99132e6dc3f947ca1a6004d3b126a08ec00163.exe	netupdsrv.exe
PID 1664 wrote to memory of 1732	1664	0a7e0215af1c6285400f143fac99132e6dc3f947ca1a6004d3b126a08ec00163.exe	netupdsrv.exe
PID 1664 wrote to memory of 1732	1664	0a7e0215af1c6285400f143fac99132e6dc3f947ca1a6004d3b126a08ec00163.exe	netupdsrv.exe
PID 1664 wrote to memory of 1732	1664	0a7e0215af1c6285400f143fac99132e6dc3f947ca1a6004d3b126a08ec00163.exe	netupdsrv.exe
PID 1664 wrote to memory of 1732	1664	0a7e0215af1c6285400f143fac99132e6dc3f947ca1a6004d3b126a08ec00163.exe	netupdsrv.exe
PID 1664 wrote to memory of 1196	1664	0a7e0215af1c6285400f143fac99132e6dc3f947ca1a6004d3b126a08ec00163.exe	net.exe
PID 1664 wrote to memory of 1196	1664	0a7e0215af1c6285400f143fac99132e6dc3f947ca1a6004d3b126a08ec00163.exe	net.exe
PID 1664 wrote to memory of 1196	1664	0a7e0215af1c6285400f143fac99132e6dc3f947ca1a6004d3b126a08ec00163.exe	net.exe
PID 1664 wrote to memory of 1196	1664	0a7e0215af1c6285400f143fac99132e6dc3f947ca1a6004d3b126a08ec00163.exe	net.exe
PID 1196 wrote to memory of 1748	1196	net.exe	net1.exe
PID 1196 wrote to memory of 1748	1196	net.exe	net1.exe
PID 1196 wrote to memory of 1748	1196	net.exe	net1.exe
PID 1196 wrote to memory of 1748	1196	net.exe	net1.exe
PID 1664 wrote to memory of 1540	1664	0a7e0215af1c6285400f143fac99132e6dc3f947ca1a6004d3b126a08ec00163.exe	net.exe
PID 1664 wrote to memory of 1540	1664	0a7e0215af1c6285400f143fac99132e6dc3f947ca1a6004d3b126a08ec00163.exe	net.exe
PID 1664 wrote to memory of 1540	1664	0a7e0215af1c6285400f143fac99132e6dc3f947ca1a6004d3b126a08ec00163.exe	net.exe
PID 1664 wrote to memory of 1540	1664	0a7e0215af1c6285400f143fac99132e6dc3f947ca1a6004d3b126a08ec00163.exe	net.exe
PID 1540 wrote to memory of 1480	1540	net.exe	net1.exe
PID 1540 wrote to memory of 1480	1540	net.exe	net1.exe
PID 1540 wrote to memory of 1480	1540	net.exe	net1.exe
PID 1540 wrote to memory of 1480	1540	net.exe	net1.exe

C:\Users\Admin\AppData\Local\Temp\0a7e0215af1c6285400f143fac99132e6dc3f947ca1a6004d3b126a08ec00163.exe
"C:\Users\Admin\AppData\Local\Temp\0a7e0215af1c6285400f143fac99132e6dc3f947ca1a6004d3b126a08ec00163.exe"
1⤵
- Drops file in Drivers directory
- Loads dropped DLL
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:1664

C:\Windows\SysWOW64\net.exe
net stop nethttpservice
2⤵
- Suspicious use of WriteProcessMemory
PID:1976

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop nethttpservice
3⤵
PID:1460

C:\Windows\SysWOW64\net.exe
net stop serviceupdater
2⤵
- Suspicious use of WriteProcessMemory
PID:1136

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop serviceupdater
3⤵
PID:1276

C:\Windows\SysWOW64\installd.exe
"C:\Windows\system32\installd.exe" nethfdrv
2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1720

C:\Windows\SysWOW64\nethtsrv.exe
"C:\Windows\system32\nethtsrv.exe" -nfdi
2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1260

C:\Windows\SysWOW64\netupdsrv.exe
"C:\Windows\system32\netupdsrv.exe" -nfdi
2⤵
- Executes dropped EXE
PID:1732

C:\Windows\SysWOW64\net.exe
net start nethttpservice
2⤵
- Suspicious use of WriteProcessMemory
PID:1196

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 start nethttpservice
3⤵
PID:1748

C:\Windows\SysWOW64\net.exe
net start serviceupdater
2⤵
- Suspicious use of WriteProcessMemory
PID:1540

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 start serviceupdater
3⤵
PID:1480

C:\Windows\SysWOW64\nethtsrv.exe
C:\Windows\SysWOW64\nethtsrv.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:1860

C:\Windows\SysWOW64\netupdsrv.exe
C:\Windows\SysWOW64\netupdsrv.exe
1⤵
- Executes dropped EXE
PID:1320

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\hfnapi.dll
Filesize
106KB

MD5
178738348431223029a970dc3366850f

SHA1
3a63af1200ceb10b237ca440744226cce3944feb

SHA256
e0718fe0fed95d088f00a8700c6f7cc097ef90f807c2aedc4a0354a7944c3a7e

SHA512
ff8140df4dfd793f8819c33908f20c07d2d4edec1b29a6bf3ff78cef728ebb6dd05f915ea7a4771a126ee57c259c99d6b05632a44358ad0eeefb7af6a6446e70

Download Submit
C:\Windows\SysWOW64\hfpapi.dll
Filesize
241KB

MD5
09733c841d7e9d950a8a337dd1cab9fe

SHA1
9a37d9f15081780b214a8d7e30cb43e3f40a4965

SHA256
a587a4210beb93e60e20a3083c8d237de0d6928bbcafe4bbf3ed8200725f3e39

SHA512
a869a7e9cbf3bcd2343b71a5f83facc8bfa823e4b3c747d97f07fadbecd98869288f9d3773e41ab3a030cb0316024f454a13ac4c8f9f9d783000ac9d7c9f1854

Download Submit
C:\Windows\SysWOW64\installd.exe
Filesize
108KB

MD5
3e7ada4be051a32547c20c16d3cbe494

SHA1
7ff834a7b66940d0bce1a7cc8beb3479af36ae83

SHA256
fd49b79bc6a28d5eebd41566a638ce716a30874b561d2329a5cbf383d96ed777

SHA512
b14da1fbb1b2bb4d205e6e8a5b199997c5d4bb4378cdfd120a2c66d381161e8bb9e2e8a990c8c275c6058f2b169d4de5024e1e764422bf5876f22563cfebe6dd

Download Submit
C:\Windows\SysWOW64\nethtsrv.exe
Filesize
176KB

MD5
4fffa466cce8cfe88fe9ee177cb09f90

SHA1
61a67e294dbad4a369153b04393411992d8dd69e

SHA256
94db6a05447f22ca0386fffd0f609ccb6c6c657c5d47aa5176212653ee83a824

SHA512
46cfe5d229e7189d8e48142af073f19a97f3d45ffcf51beb94962476bf030801c2a56c0372ca3c02b8eb7e9e429925e62b4f10999d76298e5dffb4ed8f08a206

Download Submit
C:\Windows\SysWOW64\nethtsrv.exe
Filesize
176KB

MD5
4fffa466cce8cfe88fe9ee177cb09f90

SHA1
61a67e294dbad4a369153b04393411992d8dd69e

SHA256
94db6a05447f22ca0386fffd0f609ccb6c6c657c5d47aa5176212653ee83a824

SHA512
46cfe5d229e7189d8e48142af073f19a97f3d45ffcf51beb94962476bf030801c2a56c0372ca3c02b8eb7e9e429925e62b4f10999d76298e5dffb4ed8f08a206

Download Submit
C:\Windows\SysWOW64\netupdsrv.exe
Filesize
158KB

MD5
642f59a9d82a8eab07106e327bff7bba

SHA1
9ce8f680e27a2ea9968bcf5cad7140e27e9dd5b8

SHA256
139ed41245fac7830d723779fe557e352ae15cb53befef172df60fe4a76da4c0

SHA512
85d44a4274a46555d2e6349188988be53b7957f3ff19ededbdb8cb4ce4f347a1f20576daa90b5e6f08e487d313880c90fc4ed8c550b57b1a12af23ab7a7784b5

Download Submit
C:\Windows\SysWOW64\netupdsrv.exe
Filesize
158KB

MD5
642f59a9d82a8eab07106e327bff7bba

SHA1
9ce8f680e27a2ea9968bcf5cad7140e27e9dd5b8

SHA256
139ed41245fac7830d723779fe557e352ae15cb53befef172df60fe4a76da4c0

SHA512
85d44a4274a46555d2e6349188988be53b7957f3ff19ededbdb8cb4ce4f347a1f20576daa90b5e6f08e487d313880c90fc4ed8c550b57b1a12af23ab7a7784b5

Download Submit
\Users\Admin\AppData\Local\Temp\nsy371A.tmp\System.dll
Filesize
11KB

MD5
c17103ae9072a06da581dec998343fc1

SHA1
b72148c6bdfaada8b8c3f950e610ee7cf1da1f8d

SHA256
dc58d8ad81cacb0c1ed72e33bff8f23ea40b5252b5bb55d393a0903e6819ae2f

SHA512
d32a71aaef18e993f28096d536e41c4d016850721b31171513ce28bbd805a54fd290b7c3e9d935f72e676a1acfb4f0dcc89d95040a0dd29f2b6975855c18986f

Download Submit
\Users\Admin\AppData\Local\Temp\nsy371A.tmp\nsExec.dll
Filesize
6KB

MD5
acc2b699edfea5bf5aae45aba3a41e96

SHA1
d2accf4d494e43ceb2cff69abe4dd17147d29cc2

SHA256
168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e

SHA512
e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe

Download Submit
\Users\Admin\AppData\Local\Temp\nsy371A.tmp\nsExec.dll
Filesize
6KB

MD5
acc2b699edfea5bf5aae45aba3a41e96

SHA1
d2accf4d494e43ceb2cff69abe4dd17147d29cc2

SHA256
168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e

SHA512
e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe

Download Submit
\Users\Admin\AppData\Local\Temp\nsy371A.tmp\nsExec.dll
Filesize
6KB

MD5
acc2b699edfea5bf5aae45aba3a41e96

SHA1
d2accf4d494e43ceb2cff69abe4dd17147d29cc2

SHA256
168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e

SHA512
e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe

Download Submit
\Users\Admin\AppData\Local\Temp\nsy371A.tmp\nsExec.dll
Filesize
6KB

MD5
acc2b699edfea5bf5aae45aba3a41e96

SHA1
d2accf4d494e43ceb2cff69abe4dd17147d29cc2

SHA256
168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e

SHA512
e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe

Download Submit
\Windows\SysWOW64\hfnapi.dll
Filesize
106KB

MD5
178738348431223029a970dc3366850f

SHA1
3a63af1200ceb10b237ca440744226cce3944feb

SHA256
e0718fe0fed95d088f00a8700c6f7cc097ef90f807c2aedc4a0354a7944c3a7e

SHA512
ff8140df4dfd793f8819c33908f20c07d2d4edec1b29a6bf3ff78cef728ebb6dd05f915ea7a4771a126ee57c259c99d6b05632a44358ad0eeefb7af6a6446e70

Download Submit
\Windows\SysWOW64\hfnapi.dll
Filesize
106KB

MD5
178738348431223029a970dc3366850f

SHA1
3a63af1200ceb10b237ca440744226cce3944feb

SHA256
e0718fe0fed95d088f00a8700c6f7cc097ef90f807c2aedc4a0354a7944c3a7e

SHA512
ff8140df4dfd793f8819c33908f20c07d2d4edec1b29a6bf3ff78cef728ebb6dd05f915ea7a4771a126ee57c259c99d6b05632a44358ad0eeefb7af6a6446e70

Download Submit
\Windows\SysWOW64\hfnapi.dll
Filesize
106KB

MD5
178738348431223029a970dc3366850f

SHA1
3a63af1200ceb10b237ca440744226cce3944feb

SHA256
e0718fe0fed95d088f00a8700c6f7cc097ef90f807c2aedc4a0354a7944c3a7e

SHA512
ff8140df4dfd793f8819c33908f20c07d2d4edec1b29a6bf3ff78cef728ebb6dd05f915ea7a4771a126ee57c259c99d6b05632a44358ad0eeefb7af6a6446e70

Download Submit
\Windows\SysWOW64\hfpapi.dll
Filesize
241KB

MD5
09733c841d7e9d950a8a337dd1cab9fe

SHA1
9a37d9f15081780b214a8d7e30cb43e3f40a4965

SHA256
a587a4210beb93e60e20a3083c8d237de0d6928bbcafe4bbf3ed8200725f3e39

SHA512
a869a7e9cbf3bcd2343b71a5f83facc8bfa823e4b3c747d97f07fadbecd98869288f9d3773e41ab3a030cb0316024f454a13ac4c8f9f9d783000ac9d7c9f1854

Download Submit
\Windows\SysWOW64\hfpapi.dll
Filesize
241KB

MD5
09733c841d7e9d950a8a337dd1cab9fe

SHA1
9a37d9f15081780b214a8d7e30cb43e3f40a4965

SHA256
a587a4210beb93e60e20a3083c8d237de0d6928bbcafe4bbf3ed8200725f3e39

SHA512
a869a7e9cbf3bcd2343b71a5f83facc8bfa823e4b3c747d97f07fadbecd98869288f9d3773e41ab3a030cb0316024f454a13ac4c8f9f9d783000ac9d7c9f1854

Download Submit
\Windows\SysWOW64\installd.exe
Filesize
108KB

MD5
3e7ada4be051a32547c20c16d3cbe494

SHA1
7ff834a7b66940d0bce1a7cc8beb3479af36ae83

SHA256
fd49b79bc6a28d5eebd41566a638ce716a30874b561d2329a5cbf383d96ed777

SHA512
b14da1fbb1b2bb4d205e6e8a5b199997c5d4bb4378cdfd120a2c66d381161e8bb9e2e8a990c8c275c6058f2b169d4de5024e1e764422bf5876f22563cfebe6dd

Download Submit
\Windows\SysWOW64\nethtsrv.exe
Filesize
176KB

MD5
4fffa466cce8cfe88fe9ee177cb09f90

SHA1
61a67e294dbad4a369153b04393411992d8dd69e

SHA256
94db6a05447f22ca0386fffd0f609ccb6c6c657c5d47aa5176212653ee83a824

SHA512
46cfe5d229e7189d8e48142af073f19a97f3d45ffcf51beb94962476bf030801c2a56c0372ca3c02b8eb7e9e429925e62b4f10999d76298e5dffb4ed8f08a206

Download Submit
\Windows\SysWOW64\netupdsrv.exe
Filesize
158KB

MD5
642f59a9d82a8eab07106e327bff7bba

SHA1
9ce8f680e27a2ea9968bcf5cad7140e27e9dd5b8

SHA256
139ed41245fac7830d723779fe557e352ae15cb53befef172df60fe4a76da4c0

SHA512
85d44a4274a46555d2e6349188988be53b7957f3ff19ededbdb8cb4ce4f347a1f20576daa90b5e6f08e487d313880c90fc4ed8c550b57b1a12af23ab7a7784b5

Download Submit
memory/1136-61-0x0000000000000000-mapping.dmp

Download
memory/1196-80-0x0000000000000000-mapping.dmp

Download
memory/1260-70-0x0000000000000000-mapping.dmp

Download
memory/1276-62-0x0000000000000000-mapping.dmp

Download
memory/1460-58-0x0000000000000000-mapping.dmp

Download
memory/1480-87-0x0000000000000000-mapping.dmp

Download
memory/1540-86-0x0000000000000000-mapping.dmp

Download
memory/1664-54-0x0000000076181000-0x0000000076183000-memory.dmp

Filesize
8KB

Download
memory/1664-59-0x0000000000360000-0x00000000007BE000-memory.dmp

Filesize
4.4MB

Download
memory/1664-90-0x0000000000360000-0x00000000007BE000-memory.dmp

Filesize
4.4MB

Download
memory/1720-64-0x0000000000000000-mapping.dmp

Download
memory/1732-76-0x0000000000000000-mapping.dmp

Download
memory/1748-81-0x0000000000000000-mapping.dmp

Download
memory/1976-57-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads