16f22a2fadd1a103737fc92f9f5bab98e453721e970407cba3fa1c15a2d40fb7

Analysis

max time kernel
93s
max time network
31s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
23-11-2022 10:32

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

16f22a2fadd1a103737fc92f9f5bab98e453721e970407cba3fa1c15a2d40fb7.exe
Size

603KB
MD5

6b05b573a62a7db79b7713869241987b
SHA1

e6595b3533159c427ccc36eaef884b02b739dd7e
SHA256

16f22a2fadd1a103737fc92f9f5bab98e453721e970407cba3fa1c15a2d40fb7
SHA512

07d029a0c4d71a29227f153586660fbc724173745f4d66997356c884a54132b4a1758a8cd7df830a1a90757993e005261d62686ef979e450876d8668ac2a87b3
SSDEEP

12288:8Iny5DYT8km9T6AoTlq2xGkgL77ixHyyYUkwRt3l:aUTo96AyxGkgL776ysTl

Score

8^/10

discovery

Malware Config

Signatures

Drops file in Drivers directory 1 IoCs

Processes:

16f22a2fadd1a103737fc92f9f5bab98e453721e970407cba3fa1c15a2d40fb7.exe

description ioc process

File created C:\Windows\system32\drivers\nethfdrv.sys 16f22a2fadd1a103737fc92f9f5bab98e453721e970407cba3fa1c15a2d40fb7.exe
Executes dropped EXE 5 IoCs

Processes:

installd.exenethtsrv.exenetupdsrv.exenethtsrv.exenetupdsrv.exe

pid process

1180 installd.exe
1012 nethtsrv.exe
1688 netupdsrv.exe
1684 nethtsrv.exe
1976 netupdsrv.exe

description	ioc	process
File created	C:\Windows\system32\drivers\nethfdrv.sys	16f22a2fadd1a103737fc92f9f5bab98e453721e970407cba3fa1c15a2d40fb7.exe

pid	process
1180	installd.exe
1012	nethtsrv.exe
1688	netupdsrv.exe
1684	nethtsrv.exe
1976	netupdsrv.exe

Loads dropped DLL 13 IoCs

Processes:

16f22a2fadd1a103737fc92f9f5bab98e453721e970407cba3fa1c15a2d40fb7.exeinstalld.exenethtsrv.exenethtsrv.exe

pid	process
1344	16f22a2fadd1a103737fc92f9f5bab98e453721e970407cba3fa1c15a2d40fb7.exe
1344	16f22a2fadd1a103737fc92f9f5bab98e453721e970407cba3fa1c15a2d40fb7.exe
1344	16f22a2fadd1a103737fc92f9f5bab98e453721e970407cba3fa1c15a2d40fb7.exe
1344	16f22a2fadd1a103737fc92f9f5bab98e453721e970407cba3fa1c15a2d40fb7.exe
1180	installd.exe
1344	16f22a2fadd1a103737fc92f9f5bab98e453721e970407cba3fa1c15a2d40fb7.exe
1012	nethtsrv.exe
1012	nethtsrv.exe
1344	16f22a2fadd1a103737fc92f9f5bab98e453721e970407cba3fa1c15a2d40fb7.exe
1344	16f22a2fadd1a103737fc92f9f5bab98e453721e970407cba3fa1c15a2d40fb7.exe
1684	nethtsrv.exe
1684	nethtsrv.exe
1344	16f22a2fadd1a103737fc92f9f5bab98e453721e970407cba3fa1c15a2d40fb7.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in System32 directory 5 IoCs

Processes:

16f22a2fadd1a103737fc92f9f5bab98e453721e970407cba3fa1c15a2d40fb7.exe

description	ioc	process
File created	C:\Windows\SysWOW64\nethtsrv.exe	16f22a2fadd1a103737fc92f9f5bab98e453721e970407cba3fa1c15a2d40fb7.exe
File created	C:\Windows\SysWOW64\netupdsrv.exe	16f22a2fadd1a103737fc92f9f5bab98e453721e970407cba3fa1c15a2d40fb7.exe
File created	C:\Windows\SysWOW64\hfnapi.dll	16f22a2fadd1a103737fc92f9f5bab98e453721e970407cba3fa1c15a2d40fb7.exe
File created	C:\Windows\SysWOW64\hfpapi.dll	16f22a2fadd1a103737fc92f9f5bab98e453721e970407cba3fa1c15a2d40fb7.exe
File created	C:\Windows\SysWOW64\installd.exe	16f22a2fadd1a103737fc92f9f5bab98e453721e970407cba3fa1c15a2d40fb7.exe

Drops file in Program Files directory 3 IoCs

Processes:

16f22a2fadd1a103737fc92f9f5bab98e453721e970407cba3fa1c15a2d40fb7.exe

description	ioc	process
File created	C:\Program Files (x86)\Common Files\Config\data.xml	16f22a2fadd1a103737fc92f9f5bab98e453721e970407cba3fa1c15a2d40fb7.exe
File created	C:\Program Files (x86)\Common Files\Config\ver.xml	16f22a2fadd1a103737fc92f9f5bab98e453721e970407cba3fa1c15a2d40fb7.exe
File created	C:\Program Files (x86)\Common Files\config\uninstinethnfd.exe	16f22a2fadd1a103737fc92f9f5bab98e453721e970407cba3fa1c15a2d40fb7.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Runs net.exe
Suspicious behavior: LoadsDriver 1 IoCs

Processes:

pid process

460
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

nethtsrv.exe

description pid process

Token: SeDebugPrivilege 1684 nethtsrv.exe

pid	process
460

description	pid	process
Token: SeDebugPrivilege	1684	nethtsrv.exe

Suspicious use of WriteProcessMemory 50 IoCs

Processes:

16f22a2fadd1a103737fc92f9f5bab98e453721e970407cba3fa1c15a2d40fb7.exenet.exenet.exenet.exenet.exe

description	pid	process	target process
PID 1344 wrote to memory of 576	1344	16f22a2fadd1a103737fc92f9f5bab98e453721e970407cba3fa1c15a2d40fb7.exe	net.exe
PID 1344 wrote to memory of 576	1344	16f22a2fadd1a103737fc92f9f5bab98e453721e970407cba3fa1c15a2d40fb7.exe	net.exe
PID 1344 wrote to memory of 576	1344	16f22a2fadd1a103737fc92f9f5bab98e453721e970407cba3fa1c15a2d40fb7.exe	net.exe
PID 1344 wrote to memory of 576	1344	16f22a2fadd1a103737fc92f9f5bab98e453721e970407cba3fa1c15a2d40fb7.exe	net.exe
PID 576 wrote to memory of 616	576	net.exe	net1.exe
PID 576 wrote to memory of 616	576	net.exe	net1.exe
PID 576 wrote to memory of 616	576	net.exe	net1.exe
PID 576 wrote to memory of 616	576	net.exe	net1.exe
PID 1344 wrote to memory of 1620	1344	16f22a2fadd1a103737fc92f9f5bab98e453721e970407cba3fa1c15a2d40fb7.exe	net.exe
PID 1344 wrote to memory of 1620	1344	16f22a2fadd1a103737fc92f9f5bab98e453721e970407cba3fa1c15a2d40fb7.exe	net.exe
PID 1344 wrote to memory of 1620	1344	16f22a2fadd1a103737fc92f9f5bab98e453721e970407cba3fa1c15a2d40fb7.exe	net.exe
PID 1344 wrote to memory of 1620	1344	16f22a2fadd1a103737fc92f9f5bab98e453721e970407cba3fa1c15a2d40fb7.exe	net.exe
PID 1620 wrote to memory of 1396	1620	net.exe	net1.exe
PID 1620 wrote to memory of 1396	1620	net.exe	net1.exe
PID 1620 wrote to memory of 1396	1620	net.exe	net1.exe
PID 1620 wrote to memory of 1396	1620	net.exe	net1.exe
PID 1344 wrote to memory of 1180	1344	16f22a2fadd1a103737fc92f9f5bab98e453721e970407cba3fa1c15a2d40fb7.exe	installd.exe
PID 1344 wrote to memory of 1180	1344	16f22a2fadd1a103737fc92f9f5bab98e453721e970407cba3fa1c15a2d40fb7.exe	installd.exe
PID 1344 wrote to memory of 1180	1344	16f22a2fadd1a103737fc92f9f5bab98e453721e970407cba3fa1c15a2d40fb7.exe	installd.exe
PID 1344 wrote to memory of 1180	1344	16f22a2fadd1a103737fc92f9f5bab98e453721e970407cba3fa1c15a2d40fb7.exe	installd.exe
PID 1344 wrote to memory of 1180	1344	16f22a2fadd1a103737fc92f9f5bab98e453721e970407cba3fa1c15a2d40fb7.exe	installd.exe
PID 1344 wrote to memory of 1180	1344	16f22a2fadd1a103737fc92f9f5bab98e453721e970407cba3fa1c15a2d40fb7.exe	installd.exe
PID 1344 wrote to memory of 1180	1344	16f22a2fadd1a103737fc92f9f5bab98e453721e970407cba3fa1c15a2d40fb7.exe	installd.exe
PID 1344 wrote to memory of 1012	1344	16f22a2fadd1a103737fc92f9f5bab98e453721e970407cba3fa1c15a2d40fb7.exe	nethtsrv.exe
PID 1344 wrote to memory of 1012	1344	16f22a2fadd1a103737fc92f9f5bab98e453721e970407cba3fa1c15a2d40fb7.exe	nethtsrv.exe
PID 1344 wrote to memory of 1012	1344	16f22a2fadd1a103737fc92f9f5bab98e453721e970407cba3fa1c15a2d40fb7.exe	nethtsrv.exe
PID 1344 wrote to memory of 1012	1344	16f22a2fadd1a103737fc92f9f5bab98e453721e970407cba3fa1c15a2d40fb7.exe	nethtsrv.exe
PID 1344 wrote to memory of 1688	1344	16f22a2fadd1a103737fc92f9f5bab98e453721e970407cba3fa1c15a2d40fb7.exe	netupdsrv.exe
PID 1344 wrote to memory of 1688	1344	16f22a2fadd1a103737fc92f9f5bab98e453721e970407cba3fa1c15a2d40fb7.exe	netupdsrv.exe
PID 1344 wrote to memory of 1688	1344	16f22a2fadd1a103737fc92f9f5bab98e453721e970407cba3fa1c15a2d40fb7.exe	netupdsrv.exe
PID 1344 wrote to memory of 1688	1344	16f22a2fadd1a103737fc92f9f5bab98e453721e970407cba3fa1c15a2d40fb7.exe	netupdsrv.exe
PID 1344 wrote to memory of 1688	1344	16f22a2fadd1a103737fc92f9f5bab98e453721e970407cba3fa1c15a2d40fb7.exe	netupdsrv.exe
PID 1344 wrote to memory of 1688	1344	16f22a2fadd1a103737fc92f9f5bab98e453721e970407cba3fa1c15a2d40fb7.exe	netupdsrv.exe
PID 1344 wrote to memory of 1688	1344	16f22a2fadd1a103737fc92f9f5bab98e453721e970407cba3fa1c15a2d40fb7.exe	netupdsrv.exe
PID 1344 wrote to memory of 1536	1344	16f22a2fadd1a103737fc92f9f5bab98e453721e970407cba3fa1c15a2d40fb7.exe	net.exe
PID 1344 wrote to memory of 1536	1344	16f22a2fadd1a103737fc92f9f5bab98e453721e970407cba3fa1c15a2d40fb7.exe	net.exe
PID 1344 wrote to memory of 1536	1344	16f22a2fadd1a103737fc92f9f5bab98e453721e970407cba3fa1c15a2d40fb7.exe	net.exe
PID 1344 wrote to memory of 1536	1344	16f22a2fadd1a103737fc92f9f5bab98e453721e970407cba3fa1c15a2d40fb7.exe	net.exe
PID 1536 wrote to memory of 828	1536	net.exe	net1.exe
PID 1536 wrote to memory of 828	1536	net.exe	net1.exe
PID 1536 wrote to memory of 828	1536	net.exe	net1.exe
PID 1536 wrote to memory of 828	1536	net.exe	net1.exe
PID 1344 wrote to memory of 1340	1344	16f22a2fadd1a103737fc92f9f5bab98e453721e970407cba3fa1c15a2d40fb7.exe	net.exe
PID 1344 wrote to memory of 1340	1344	16f22a2fadd1a103737fc92f9f5bab98e453721e970407cba3fa1c15a2d40fb7.exe	net.exe
PID 1344 wrote to memory of 1340	1344	16f22a2fadd1a103737fc92f9f5bab98e453721e970407cba3fa1c15a2d40fb7.exe	net.exe
PID 1344 wrote to memory of 1340	1344	16f22a2fadd1a103737fc92f9f5bab98e453721e970407cba3fa1c15a2d40fb7.exe	net.exe
PID 1340 wrote to memory of 1516	1340	net.exe	net1.exe
PID 1340 wrote to memory of 1516	1340	net.exe	net1.exe
PID 1340 wrote to memory of 1516	1340	net.exe	net1.exe
PID 1340 wrote to memory of 1516	1340	net.exe	net1.exe

C:\Users\Admin\AppData\Local\Temp\16f22a2fadd1a103737fc92f9f5bab98e453721e970407cba3fa1c15a2d40fb7.exe
"C:\Users\Admin\AppData\Local\Temp\16f22a2fadd1a103737fc92f9f5bab98e453721e970407cba3fa1c15a2d40fb7.exe"
1⤵
- Drops file in Drivers directory
- Loads dropped DLL
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:1344

C:\Windows\SysWOW64\net.exe
net stop nethttpservice
2⤵
- Suspicious use of WriteProcessMemory
PID:576

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop nethttpservice
3⤵
PID:616

C:\Windows\SysWOW64\net.exe
net stop serviceupdater
2⤵
- Suspicious use of WriteProcessMemory
PID:1620

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop serviceupdater
3⤵
PID:1396

C:\Windows\SysWOW64\installd.exe
"C:\Windows\system32\installd.exe" nethfdrv
2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1180

C:\Windows\SysWOW64\nethtsrv.exe
"C:\Windows\system32\nethtsrv.exe" -nfdi
2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1012

C:\Windows\SysWOW64\netupdsrv.exe
"C:\Windows\system32\netupdsrv.exe" -nfdi
2⤵
- Executes dropped EXE
PID:1688

C:\Windows\SysWOW64\net.exe
net start nethttpservice
2⤵
- Suspicious use of WriteProcessMemory
PID:1536

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 start nethttpservice
3⤵
PID:828

C:\Windows\SysWOW64\net.exe
net start serviceupdater
2⤵
- Suspicious use of WriteProcessMemory
PID:1340

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 start serviceupdater
3⤵
PID:1516

C:\Windows\SysWOW64\nethtsrv.exe
C:\Windows\SysWOW64\nethtsrv.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:1684

C:\Windows\SysWOW64\netupdsrv.exe
C:\Windows\SysWOW64\netupdsrv.exe
1⤵
- Executes dropped EXE
PID:1976

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\hfnapi.dll
Filesize
106KB

MD5
d40aaebc32f9d1169ca8e8017e0de7e2

SHA1
0ce152dfee131c92c8acf98113272aab3b1eda39

SHA256
f22f9515ef60e97625cb0fdae91d4310f14551f32e345a98bfd69c125a7e2724

SHA512
30fbac25aa4169e68295825d51d6aabd087aa71504ca7d190e68853370fabe6aad85c20718d273a1b9c53f03d9dc5639b3a72cbd506ca0d0494e1db7fcef61f8

Download Submit
C:\Windows\SysWOW64\hfpapi.dll
Filesize
244KB

MD5
08a5ef3ea0f93b8708b42284b9b4caae

SHA1
cdbc7c18b8c1410820073424f4cf90ca60b15a4a

SHA256
5c346c04352d8f295603ddd6ab54076bf536b8e11b17269c2eef14fbc812e301

SHA512
0a4335d81156a0d1cdc3fa252796bd18387982b015a943bd8f74d13cd84f501a26058002443cec2724fece1ed7074a8c7064ef65da4f87daf38257b287182eec

Download Submit
C:\Windows\SysWOW64\installd.exe
Filesize
108KB

MD5
a1dfd038cc8cda2fa65db7faabd8e5a3

SHA1
3103064af6bac94ad5dc17c8413257f797d93d56

SHA256
90e2858b4a1e496953227d1d743c3fa62abf492fdf441edb4f506c83a9f6fb22

SHA512
b8d114323a09101727415bdc37f942e04f86711a983a48d7cca713eebcf4ae1359ed56ba14194f15d910ed39f0a61e9aaf0b9de1da63c115e0bf0df75d8b9bb8

Download Submit
C:\Windows\SysWOW64\nethtsrv.exe
Filesize
176KB

MD5
48e750766ad8875d532df6fc5287dfc7

SHA1
175251ebc6d1b3544519f44168fcc2fa7844ec49

SHA256
0be632acd28d18aa38aa32600165b88bab98abe4d9b23577d9b550ae1ebbe746

SHA512
946570061d123bfd35c2b7ce5be67416873e2be18e58bfeb8e3b24a8559402c02567c5e2557bd054a553d4c03a1c2a1c5c07d03d2c71f1ee91efe0345511b332

Download Submit
C:\Windows\SysWOW64\nethtsrv.exe
Filesize
176KB

MD5
48e750766ad8875d532df6fc5287dfc7

SHA1
175251ebc6d1b3544519f44168fcc2fa7844ec49

SHA256
0be632acd28d18aa38aa32600165b88bab98abe4d9b23577d9b550ae1ebbe746

SHA512
946570061d123bfd35c2b7ce5be67416873e2be18e58bfeb8e3b24a8559402c02567c5e2557bd054a553d4c03a1c2a1c5c07d03d2c71f1ee91efe0345511b332

Download Submit
C:\Windows\SysWOW64\netupdsrv.exe
Filesize
158KB

MD5
b5910dd9f600a9c51bb5e4e77a60e575

SHA1
ea291418b754690068703760645c31face86e678

SHA256
69eb6a67974722d323b99ff6db0fd2f98e37615156b5748bc7c8929c73f72169

SHA512
1fd1789af458c95223b95f93466c5b127272260bf972c8639b6f9c6353725fe34354dc90b2ab94f2cbaab2625418e24f7edc53e668d37748b3fb281cadf82dae

Download Submit
C:\Windows\SysWOW64\netupdsrv.exe
Filesize
158KB

MD5
b5910dd9f600a9c51bb5e4e77a60e575

SHA1
ea291418b754690068703760645c31face86e678

SHA256
69eb6a67974722d323b99ff6db0fd2f98e37615156b5748bc7c8929c73f72169

SHA512
1fd1789af458c95223b95f93466c5b127272260bf972c8639b6f9c6353725fe34354dc90b2ab94f2cbaab2625418e24f7edc53e668d37748b3fb281cadf82dae

Download Submit
\Users\Admin\AppData\Local\Temp\nsjB493.tmp\System.dll
Filesize
11KB

MD5
c17103ae9072a06da581dec998343fc1

SHA1
b72148c6bdfaada8b8c3f950e610ee7cf1da1f8d

SHA256
dc58d8ad81cacb0c1ed72e33bff8f23ea40b5252b5bb55d393a0903e6819ae2f

SHA512
d32a71aaef18e993f28096d536e41c4d016850721b31171513ce28bbd805a54fd290b7c3e9d935f72e676a1acfb4f0dcc89d95040a0dd29f2b6975855c18986f

Download Submit
\Users\Admin\AppData\Local\Temp\nsjB493.tmp\nsExec.dll
Filesize
6KB

MD5
acc2b699edfea5bf5aae45aba3a41e96

SHA1
d2accf4d494e43ceb2cff69abe4dd17147d29cc2

SHA256
168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e

SHA512
e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe

Download Submit
\Users\Admin\AppData\Local\Temp\nsjB493.tmp\nsExec.dll
Filesize
6KB

MD5
acc2b699edfea5bf5aae45aba3a41e96

SHA1
d2accf4d494e43ceb2cff69abe4dd17147d29cc2

SHA256
168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e

SHA512
e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe

Download Submit
\Users\Admin\AppData\Local\Temp\nsjB493.tmp\nsExec.dll
Filesize
6KB

MD5
acc2b699edfea5bf5aae45aba3a41e96

SHA1
d2accf4d494e43ceb2cff69abe4dd17147d29cc2

SHA256
168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e

SHA512
e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe

Download Submit
\Users\Admin\AppData\Local\Temp\nsjB493.tmp\nsExec.dll
Filesize
6KB

MD5
acc2b699edfea5bf5aae45aba3a41e96

SHA1
d2accf4d494e43ceb2cff69abe4dd17147d29cc2

SHA256
168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e

SHA512
e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe

Download Submit
\Windows\SysWOW64\hfnapi.dll
Filesize
106KB

MD5
d40aaebc32f9d1169ca8e8017e0de7e2

SHA1
0ce152dfee131c92c8acf98113272aab3b1eda39

SHA256
f22f9515ef60e97625cb0fdae91d4310f14551f32e345a98bfd69c125a7e2724

SHA512
30fbac25aa4169e68295825d51d6aabd087aa71504ca7d190e68853370fabe6aad85c20718d273a1b9c53f03d9dc5639b3a72cbd506ca0d0494e1db7fcef61f8

Download Submit
\Windows\SysWOW64\hfnapi.dll
Filesize
106KB

MD5
d40aaebc32f9d1169ca8e8017e0de7e2

SHA1
0ce152dfee131c92c8acf98113272aab3b1eda39

SHA256
f22f9515ef60e97625cb0fdae91d4310f14551f32e345a98bfd69c125a7e2724

SHA512
30fbac25aa4169e68295825d51d6aabd087aa71504ca7d190e68853370fabe6aad85c20718d273a1b9c53f03d9dc5639b3a72cbd506ca0d0494e1db7fcef61f8

Download Submit
\Windows\SysWOW64\hfnapi.dll
Filesize
106KB

MD5
d40aaebc32f9d1169ca8e8017e0de7e2

SHA1
0ce152dfee131c92c8acf98113272aab3b1eda39

SHA256
f22f9515ef60e97625cb0fdae91d4310f14551f32e345a98bfd69c125a7e2724

SHA512
30fbac25aa4169e68295825d51d6aabd087aa71504ca7d190e68853370fabe6aad85c20718d273a1b9c53f03d9dc5639b3a72cbd506ca0d0494e1db7fcef61f8

Download Submit
\Windows\SysWOW64\hfpapi.dll
Filesize
244KB

MD5
08a5ef3ea0f93b8708b42284b9b4caae

SHA1
cdbc7c18b8c1410820073424f4cf90ca60b15a4a

SHA256
5c346c04352d8f295603ddd6ab54076bf536b8e11b17269c2eef14fbc812e301

SHA512
0a4335d81156a0d1cdc3fa252796bd18387982b015a943bd8f74d13cd84f501a26058002443cec2724fece1ed7074a8c7064ef65da4f87daf38257b287182eec

Download Submit
\Windows\SysWOW64\hfpapi.dll
Filesize
244KB

MD5
08a5ef3ea0f93b8708b42284b9b4caae

SHA1
cdbc7c18b8c1410820073424f4cf90ca60b15a4a

SHA256
5c346c04352d8f295603ddd6ab54076bf536b8e11b17269c2eef14fbc812e301

SHA512
0a4335d81156a0d1cdc3fa252796bd18387982b015a943bd8f74d13cd84f501a26058002443cec2724fece1ed7074a8c7064ef65da4f87daf38257b287182eec

Download Submit
\Windows\SysWOW64\installd.exe
Filesize
108KB

MD5
a1dfd038cc8cda2fa65db7faabd8e5a3

SHA1
3103064af6bac94ad5dc17c8413257f797d93d56

SHA256
90e2858b4a1e496953227d1d743c3fa62abf492fdf441edb4f506c83a9f6fb22

SHA512
b8d114323a09101727415bdc37f942e04f86711a983a48d7cca713eebcf4ae1359ed56ba14194f15d910ed39f0a61e9aaf0b9de1da63c115e0bf0df75d8b9bb8

Download Submit
\Windows\SysWOW64\nethtsrv.exe
Filesize
176KB

MD5
48e750766ad8875d532df6fc5287dfc7

SHA1
175251ebc6d1b3544519f44168fcc2fa7844ec49

SHA256
0be632acd28d18aa38aa32600165b88bab98abe4d9b23577d9b550ae1ebbe746

SHA512
946570061d123bfd35c2b7ce5be67416873e2be18e58bfeb8e3b24a8559402c02567c5e2557bd054a553d4c03a1c2a1c5c07d03d2c71f1ee91efe0345511b332

Download Submit
\Windows\SysWOW64\netupdsrv.exe
Filesize
158KB

MD5
b5910dd9f600a9c51bb5e4e77a60e575

SHA1
ea291418b754690068703760645c31face86e678

SHA256
69eb6a67974722d323b99ff6db0fd2f98e37615156b5748bc7c8929c73f72169

SHA512
1fd1789af458c95223b95f93466c5b127272260bf972c8639b6f9c6353725fe34354dc90b2ab94f2cbaab2625418e24f7edc53e668d37748b3fb281cadf82dae

Download Submit
memory/576-58-0x0000000000000000-mapping.dmp

Download
memory/616-59-0x0000000000000000-mapping.dmp

Download
memory/828-82-0x0000000000000000-mapping.dmp

Download
memory/1012-70-0x0000000000000000-mapping.dmp

Download
memory/1180-64-0x0000000000000000-mapping.dmp

Download
memory/1340-87-0x0000000000000000-mapping.dmp

Download
memory/1344-54-0x0000000074DE1000-0x0000000074DE3000-memory.dmp

Filesize
8KB

Download
memory/1344-75-0x0000000000360000-0x00000000007BE000-memory.dmp

Filesize
4.4MB

Download
memory/1344-55-0x0000000000360000-0x00000000007BE000-memory.dmp

Filesize
4.4MB

Download
memory/1344-91-0x0000000000360000-0x00000000007BE000-memory.dmp

Filesize
4.4MB

Download
memory/1396-62-0x0000000000000000-mapping.dmp

Download
memory/1516-88-0x0000000000000000-mapping.dmp

Download
memory/1536-81-0x0000000000000000-mapping.dmp

Download
memory/1620-61-0x0000000000000000-mapping.dmp

Download
memory/1688-77-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads