117db8189d91f0f2e050085d003b481f77645f6c6087c8c7250c08d3ad96fd75

Analysis

max time kernel
41s
max time network
45s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
23-11-2022 10:33

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

117db8189d91f0f2e050085d003b481f77645f6c6087c8c7250c08d3ad96fd75.exe
Size

603KB
MD5

89e29784c137989eed4c5fb6bce454c6
SHA1

904cea411b29e2da4551d3f8188c8e00e94485d2
SHA256

117db8189d91f0f2e050085d003b481f77645f6c6087c8c7250c08d3ad96fd75
SHA512

fc5635c05e679892e098bb4c546bdbb4f38b2003027bc6d42d91f66ce889c6e9b41b43a622bd16334ef0e8ec70737c34602b0c08074d5acfbba00ce0b5a974b9
SSDEEP

12288:jIny5DYTfIz4IqvhXfc2pc3p+tEFvh8Y5bbskDtY+JxNRbTfibI:rUTfo4Iq62pc3p+tElCY58/+B1Ta0

Score

8^/10

discovery

Malware Config

Signatures

Drops file in Drivers directory 1 IoCs

Processes:

117db8189d91f0f2e050085d003b481f77645f6c6087c8c7250c08d3ad96fd75.exe

description ioc process

File created C:\Windows\system32\drivers\nethfdrv.sys 117db8189d91f0f2e050085d003b481f77645f6c6087c8c7250c08d3ad96fd75.exe
Executes dropped EXE 5 IoCs

Processes:

installd.exenethtsrv.exenetupdsrv.exenethtsrv.exenetupdsrv.exe

pid process

1788 installd.exe
1560 nethtsrv.exe
1688 netupdsrv.exe
1928 nethtsrv.exe
1704 netupdsrv.exe

description	ioc	process
File created	C:\Windows\system32\drivers\nethfdrv.sys	117db8189d91f0f2e050085d003b481f77645f6c6087c8c7250c08d3ad96fd75.exe

pid	process
1788	installd.exe
1560	nethtsrv.exe
1688	netupdsrv.exe
1928	nethtsrv.exe
1704	netupdsrv.exe

Loads dropped DLL 13 IoCs

Processes:

117db8189d91f0f2e050085d003b481f77645f6c6087c8c7250c08d3ad96fd75.exeinstalld.exenethtsrv.exenethtsrv.exe

pid	process
2024	117db8189d91f0f2e050085d003b481f77645f6c6087c8c7250c08d3ad96fd75.exe
2024	117db8189d91f0f2e050085d003b481f77645f6c6087c8c7250c08d3ad96fd75.exe
2024	117db8189d91f0f2e050085d003b481f77645f6c6087c8c7250c08d3ad96fd75.exe
2024	117db8189d91f0f2e050085d003b481f77645f6c6087c8c7250c08d3ad96fd75.exe
1788	installd.exe
2024	117db8189d91f0f2e050085d003b481f77645f6c6087c8c7250c08d3ad96fd75.exe
1560	nethtsrv.exe
1560	nethtsrv.exe
2024	117db8189d91f0f2e050085d003b481f77645f6c6087c8c7250c08d3ad96fd75.exe
2024	117db8189d91f0f2e050085d003b481f77645f6c6087c8c7250c08d3ad96fd75.exe
1928	nethtsrv.exe
1928	nethtsrv.exe
2024	117db8189d91f0f2e050085d003b481f77645f6c6087c8c7250c08d3ad96fd75.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in System32 directory 5 IoCs

Processes:

117db8189d91f0f2e050085d003b481f77645f6c6087c8c7250c08d3ad96fd75.exe

description	ioc	process
File created	C:\Windows\SysWOW64\installd.exe	117db8189d91f0f2e050085d003b481f77645f6c6087c8c7250c08d3ad96fd75.exe
File created	C:\Windows\SysWOW64\nethtsrv.exe	117db8189d91f0f2e050085d003b481f77645f6c6087c8c7250c08d3ad96fd75.exe
File created	C:\Windows\SysWOW64\netupdsrv.exe	117db8189d91f0f2e050085d003b481f77645f6c6087c8c7250c08d3ad96fd75.exe
File created	C:\Windows\SysWOW64\hfnapi.dll	117db8189d91f0f2e050085d003b481f77645f6c6087c8c7250c08d3ad96fd75.exe
File created	C:\Windows\SysWOW64\hfpapi.dll	117db8189d91f0f2e050085d003b481f77645f6c6087c8c7250c08d3ad96fd75.exe

Drops file in Program Files directory 3 IoCs

Processes:

117db8189d91f0f2e050085d003b481f77645f6c6087c8c7250c08d3ad96fd75.exe

description	ioc	process
File created	C:\Program Files (x86)\Common Files\Config\ver.xml	117db8189d91f0f2e050085d003b481f77645f6c6087c8c7250c08d3ad96fd75.exe
File created	C:\Program Files (x86)\Common Files\config\uninstinethnfd.exe	117db8189d91f0f2e050085d003b481f77645f6c6087c8c7250c08d3ad96fd75.exe
File created	C:\Program Files (x86)\Common Files\Config\data.xml	117db8189d91f0f2e050085d003b481f77645f6c6087c8c7250c08d3ad96fd75.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Runs net.exe
Suspicious behavior: LoadsDriver 1 IoCs

Processes:

pid process

460
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

nethtsrv.exe

description pid process

Token: SeDebugPrivilege 1928 nethtsrv.exe

pid	process
460

description	pid	process
Token: SeDebugPrivilege	1928	nethtsrv.exe

Suspicious use of WriteProcessMemory 50 IoCs

Processes:

117db8189d91f0f2e050085d003b481f77645f6c6087c8c7250c08d3ad96fd75.exenet.exenet.exenet.exenet.exe

description	pid	process	target process
PID 2024 wrote to memory of 956	2024	117db8189d91f0f2e050085d003b481f77645f6c6087c8c7250c08d3ad96fd75.exe	net.exe
PID 2024 wrote to memory of 956	2024	117db8189d91f0f2e050085d003b481f77645f6c6087c8c7250c08d3ad96fd75.exe	net.exe
PID 2024 wrote to memory of 956	2024	117db8189d91f0f2e050085d003b481f77645f6c6087c8c7250c08d3ad96fd75.exe	net.exe
PID 2024 wrote to memory of 956	2024	117db8189d91f0f2e050085d003b481f77645f6c6087c8c7250c08d3ad96fd75.exe	net.exe
PID 956 wrote to memory of 1632	956	net.exe	net1.exe
PID 956 wrote to memory of 1632	956	net.exe	net1.exe
PID 956 wrote to memory of 1632	956	net.exe	net1.exe
PID 956 wrote to memory of 1632	956	net.exe	net1.exe
PID 2024 wrote to memory of 1596	2024	117db8189d91f0f2e050085d003b481f77645f6c6087c8c7250c08d3ad96fd75.exe	net.exe
PID 2024 wrote to memory of 1596	2024	117db8189d91f0f2e050085d003b481f77645f6c6087c8c7250c08d3ad96fd75.exe	net.exe
PID 2024 wrote to memory of 1596	2024	117db8189d91f0f2e050085d003b481f77645f6c6087c8c7250c08d3ad96fd75.exe	net.exe
PID 2024 wrote to memory of 1596	2024	117db8189d91f0f2e050085d003b481f77645f6c6087c8c7250c08d3ad96fd75.exe	net.exe
PID 1596 wrote to memory of 1564	1596	net.exe	net1.exe
PID 1596 wrote to memory of 1564	1596	net.exe	net1.exe
PID 1596 wrote to memory of 1564	1596	net.exe	net1.exe
PID 1596 wrote to memory of 1564	1596	net.exe	net1.exe
PID 2024 wrote to memory of 1788	2024	117db8189d91f0f2e050085d003b481f77645f6c6087c8c7250c08d3ad96fd75.exe	installd.exe
PID 2024 wrote to memory of 1788	2024	117db8189d91f0f2e050085d003b481f77645f6c6087c8c7250c08d3ad96fd75.exe	installd.exe
PID 2024 wrote to memory of 1788	2024	117db8189d91f0f2e050085d003b481f77645f6c6087c8c7250c08d3ad96fd75.exe	installd.exe
PID 2024 wrote to memory of 1788	2024	117db8189d91f0f2e050085d003b481f77645f6c6087c8c7250c08d3ad96fd75.exe	installd.exe
PID 2024 wrote to memory of 1788	2024	117db8189d91f0f2e050085d003b481f77645f6c6087c8c7250c08d3ad96fd75.exe	installd.exe
PID 2024 wrote to memory of 1788	2024	117db8189d91f0f2e050085d003b481f77645f6c6087c8c7250c08d3ad96fd75.exe	installd.exe
PID 2024 wrote to memory of 1788	2024	117db8189d91f0f2e050085d003b481f77645f6c6087c8c7250c08d3ad96fd75.exe	installd.exe
PID 2024 wrote to memory of 1560	2024	117db8189d91f0f2e050085d003b481f77645f6c6087c8c7250c08d3ad96fd75.exe	nethtsrv.exe
PID 2024 wrote to memory of 1560	2024	117db8189d91f0f2e050085d003b481f77645f6c6087c8c7250c08d3ad96fd75.exe	nethtsrv.exe
PID 2024 wrote to memory of 1560	2024	117db8189d91f0f2e050085d003b481f77645f6c6087c8c7250c08d3ad96fd75.exe	nethtsrv.exe
PID 2024 wrote to memory of 1560	2024	117db8189d91f0f2e050085d003b481f77645f6c6087c8c7250c08d3ad96fd75.exe	nethtsrv.exe
PID 2024 wrote to memory of 1688	2024	117db8189d91f0f2e050085d003b481f77645f6c6087c8c7250c08d3ad96fd75.exe	netupdsrv.exe
PID 2024 wrote to memory of 1688	2024	117db8189d91f0f2e050085d003b481f77645f6c6087c8c7250c08d3ad96fd75.exe	netupdsrv.exe
PID 2024 wrote to memory of 1688	2024	117db8189d91f0f2e050085d003b481f77645f6c6087c8c7250c08d3ad96fd75.exe	netupdsrv.exe
PID 2024 wrote to memory of 1688	2024	117db8189d91f0f2e050085d003b481f77645f6c6087c8c7250c08d3ad96fd75.exe	netupdsrv.exe
PID 2024 wrote to memory of 1688	2024	117db8189d91f0f2e050085d003b481f77645f6c6087c8c7250c08d3ad96fd75.exe	netupdsrv.exe
PID 2024 wrote to memory of 1688	2024	117db8189d91f0f2e050085d003b481f77645f6c6087c8c7250c08d3ad96fd75.exe	netupdsrv.exe
PID 2024 wrote to memory of 1688	2024	117db8189d91f0f2e050085d003b481f77645f6c6087c8c7250c08d3ad96fd75.exe	netupdsrv.exe
PID 2024 wrote to memory of 1168	2024	117db8189d91f0f2e050085d003b481f77645f6c6087c8c7250c08d3ad96fd75.exe	net.exe
PID 2024 wrote to memory of 1168	2024	117db8189d91f0f2e050085d003b481f77645f6c6087c8c7250c08d3ad96fd75.exe	net.exe
PID 2024 wrote to memory of 1168	2024	117db8189d91f0f2e050085d003b481f77645f6c6087c8c7250c08d3ad96fd75.exe	net.exe
PID 2024 wrote to memory of 1168	2024	117db8189d91f0f2e050085d003b481f77645f6c6087c8c7250c08d3ad96fd75.exe	net.exe
PID 1168 wrote to memory of 1156	1168	net.exe	net1.exe
PID 1168 wrote to memory of 1156	1168	net.exe	net1.exe
PID 1168 wrote to memory of 1156	1168	net.exe	net1.exe
PID 1168 wrote to memory of 1156	1168	net.exe	net1.exe
PID 2024 wrote to memory of 1652	2024	117db8189d91f0f2e050085d003b481f77645f6c6087c8c7250c08d3ad96fd75.exe	net.exe
PID 2024 wrote to memory of 1652	2024	117db8189d91f0f2e050085d003b481f77645f6c6087c8c7250c08d3ad96fd75.exe	net.exe
PID 2024 wrote to memory of 1652	2024	117db8189d91f0f2e050085d003b481f77645f6c6087c8c7250c08d3ad96fd75.exe	net.exe
PID 2024 wrote to memory of 1652	2024	117db8189d91f0f2e050085d003b481f77645f6c6087c8c7250c08d3ad96fd75.exe	net.exe
PID 1652 wrote to memory of 1004	1652	net.exe	net1.exe
PID 1652 wrote to memory of 1004	1652	net.exe	net1.exe
PID 1652 wrote to memory of 1004	1652	net.exe	net1.exe
PID 1652 wrote to memory of 1004	1652	net.exe	net1.exe

C:\Users\Admin\AppData\Local\Temp\117db8189d91f0f2e050085d003b481f77645f6c6087c8c7250c08d3ad96fd75.exe
"C:\Users\Admin\AppData\Local\Temp\117db8189d91f0f2e050085d003b481f77645f6c6087c8c7250c08d3ad96fd75.exe"
1⤵
- Drops file in Drivers directory
- Loads dropped DLL
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:2024

C:\Windows\SysWOW64\net.exe
net stop nethttpservice
2⤵
- Suspicious use of WriteProcessMemory
PID:956

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop nethttpservice
3⤵
PID:1632

C:\Windows\SysWOW64\net.exe
net stop serviceupdater
2⤵
- Suspicious use of WriteProcessMemory
PID:1596

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop serviceupdater
3⤵
PID:1564

C:\Windows\SysWOW64\installd.exe
"C:\Windows\system32\installd.exe" nethfdrv
2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1788

C:\Windows\SysWOW64\nethtsrv.exe
"C:\Windows\system32\nethtsrv.exe" -nfdi
2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1560

C:\Windows\SysWOW64\netupdsrv.exe
"C:\Windows\system32\netupdsrv.exe" -nfdi
2⤵
- Executes dropped EXE
PID:1688

C:\Windows\SysWOW64\net.exe
net start nethttpservice
2⤵
- Suspicious use of WriteProcessMemory
PID:1168

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 start nethttpservice
3⤵
PID:1156

C:\Windows\SysWOW64\net.exe
net start serviceupdater
2⤵
- Suspicious use of WriteProcessMemory
PID:1652

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 start serviceupdater
3⤵
PID:1004

C:\Windows\SysWOW64\nethtsrv.exe
C:\Windows\SysWOW64\nethtsrv.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:1928

C:\Windows\SysWOW64\netupdsrv.exe
C:\Windows\SysWOW64\netupdsrv.exe
1⤵
- Executes dropped EXE
PID:1704

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\hfnapi.dll
Filesize
106KB

MD5
879a272a452aeceb586c3b356475a0fb

SHA1
10feaf748ca59d6f493069bd0fc6d4d305e4d6ea

SHA256
480e423cf5052e65c04514c400dd31613fc368bcd2888c0ada58f12853fe5ede

SHA512
1ca14808cf12dc93398de41e46ce43113295ebe2d54aa063502a499cb34f43cbf68a478d56a89ec723d46e115703c48aeb7c7c7cdbcf9ec8303900c0d88b01b9

Download Submit
C:\Windows\SysWOW64\hfpapi.dll
Filesize
244KB

MD5
264789a685cbe8964349ab9600471e3e

SHA1
3421aaeaf22e4c5af4774b79fd3e2f4e71b789cc

SHA256
6243c4198867d01b94725684c2efb2593d64aa61db084a817eeda38c8773c6c5

SHA512
eccc80bec4a702158aafd7fe9bd5cf7764467001dd77a0cbb11ba1eeb2f3473c495c7999f865bf1e64ba0511eabdedf28e445f9ed02c56d116e11d7c311c89a7

Download Submit
C:\Windows\SysWOW64\installd.exe
Filesize
108KB

MD5
e9db876415f67b20e6ba8d9582ae1392

SHA1
8a118c883761da67831998564d71f6cf8c666bd1

SHA256
3d4fc9c134ef5513162015026ba1d72bd8e5ffd3305b92f4bace4927d99b5319

SHA512
45be47361ff3055b0bde1bc34aa3a98e8392f4cb08f3d5f770997b3cf0ebf23df2140382b2285df9fffbee9b8c339e1647c1742715aa727c61d366165f07a16e

Download Submit
C:\Windows\SysWOW64\nethtsrv.exe
Filesize
176KB

MD5
09efe3e55806ab8cbc2fa8a2a7fe9f52

SHA1
e0450b6cd955ba1196acd4254f25c6cfcb489536

SHA256
13455584a4ad8a9e06c0515cfc3631d816b382a7f1cd53b7ca43c18bfeb4ae90

SHA512
f588a4d8dd3f076126a3032e5b3b89190157af424d4cc55830788516f3089ac5f6d08d476946f886eb85c2d938e32bcbc5e0d2db71bd6da7a7bcb75afc1db4fb

Download Submit
C:\Windows\SysWOW64\nethtsrv.exe
Filesize
176KB

MD5
09efe3e55806ab8cbc2fa8a2a7fe9f52

SHA1
e0450b6cd955ba1196acd4254f25c6cfcb489536

SHA256
13455584a4ad8a9e06c0515cfc3631d816b382a7f1cd53b7ca43c18bfeb4ae90

SHA512
f588a4d8dd3f076126a3032e5b3b89190157af424d4cc55830788516f3089ac5f6d08d476946f886eb85c2d938e32bcbc5e0d2db71bd6da7a7bcb75afc1db4fb

Download Submit
C:\Windows\SysWOW64\netupdsrv.exe
Filesize
158KB

MD5
44b871cea6964c6d5b76034ec41eb13c

SHA1
a6f062be49f34a2853fca5ded44ffb98230a85b5

SHA256
570a1323e8aa80001a7682a5938a56e2a37f7173bfd68938af6771879750288d

SHA512
7e8060079269d6308873e73f171690d372cd02b348fd0f86039ecf35e493fde4edf75e12c4c832a5c4c34c4db185ca755e99d4ddeabcf0ddee7dff280d8f663a

Download Submit
C:\Windows\SysWOW64\netupdsrv.exe
Filesize
158KB

MD5
44b871cea6964c6d5b76034ec41eb13c

SHA1
a6f062be49f34a2853fca5ded44ffb98230a85b5

SHA256
570a1323e8aa80001a7682a5938a56e2a37f7173bfd68938af6771879750288d

SHA512
7e8060079269d6308873e73f171690d372cd02b348fd0f86039ecf35e493fde4edf75e12c4c832a5c4c34c4db185ca755e99d4ddeabcf0ddee7dff280d8f663a

Download Submit
\Users\Admin\AppData\Local\Temp\nst41A5.tmp\System.dll
Filesize
11KB

MD5
c17103ae9072a06da581dec998343fc1

SHA1
b72148c6bdfaada8b8c3f950e610ee7cf1da1f8d

SHA256
dc58d8ad81cacb0c1ed72e33bff8f23ea40b5252b5bb55d393a0903e6819ae2f

SHA512
d32a71aaef18e993f28096d536e41c4d016850721b31171513ce28bbd805a54fd290b7c3e9d935f72e676a1acfb4f0dcc89d95040a0dd29f2b6975855c18986f

Download Submit
\Users\Admin\AppData\Local\Temp\nst41A5.tmp\nsExec.dll
Filesize
6KB

MD5
acc2b699edfea5bf5aae45aba3a41e96

SHA1
d2accf4d494e43ceb2cff69abe4dd17147d29cc2

SHA256
168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e

SHA512
e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe

Download Submit
\Users\Admin\AppData\Local\Temp\nst41A5.tmp\nsExec.dll
Filesize
6KB

MD5
acc2b699edfea5bf5aae45aba3a41e96

SHA1
d2accf4d494e43ceb2cff69abe4dd17147d29cc2

SHA256
168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e

SHA512
e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe

Download Submit
\Users\Admin\AppData\Local\Temp\nst41A5.tmp\nsExec.dll
Filesize
6KB

MD5
acc2b699edfea5bf5aae45aba3a41e96

SHA1
d2accf4d494e43ceb2cff69abe4dd17147d29cc2

SHA256
168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e

SHA512
e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe

Download Submit
\Users\Admin\AppData\Local\Temp\nst41A5.tmp\nsExec.dll
Filesize
6KB

MD5
acc2b699edfea5bf5aae45aba3a41e96

SHA1
d2accf4d494e43ceb2cff69abe4dd17147d29cc2

SHA256
168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e

SHA512
e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe

Download Submit
\Windows\SysWOW64\hfnapi.dll
Filesize
106KB

MD5
879a272a452aeceb586c3b356475a0fb

SHA1
10feaf748ca59d6f493069bd0fc6d4d305e4d6ea

SHA256
480e423cf5052e65c04514c400dd31613fc368bcd2888c0ada58f12853fe5ede

SHA512
1ca14808cf12dc93398de41e46ce43113295ebe2d54aa063502a499cb34f43cbf68a478d56a89ec723d46e115703c48aeb7c7c7cdbcf9ec8303900c0d88b01b9

Download Submit
\Windows\SysWOW64\hfnapi.dll
Filesize
106KB

MD5
879a272a452aeceb586c3b356475a0fb

SHA1
10feaf748ca59d6f493069bd0fc6d4d305e4d6ea

SHA256
480e423cf5052e65c04514c400dd31613fc368bcd2888c0ada58f12853fe5ede

SHA512
1ca14808cf12dc93398de41e46ce43113295ebe2d54aa063502a499cb34f43cbf68a478d56a89ec723d46e115703c48aeb7c7c7cdbcf9ec8303900c0d88b01b9

Download Submit
\Windows\SysWOW64\hfnapi.dll
Filesize
106KB

MD5
879a272a452aeceb586c3b356475a0fb

SHA1
10feaf748ca59d6f493069bd0fc6d4d305e4d6ea

SHA256
480e423cf5052e65c04514c400dd31613fc368bcd2888c0ada58f12853fe5ede

SHA512
1ca14808cf12dc93398de41e46ce43113295ebe2d54aa063502a499cb34f43cbf68a478d56a89ec723d46e115703c48aeb7c7c7cdbcf9ec8303900c0d88b01b9

Download Submit
\Windows\SysWOW64\hfpapi.dll
Filesize
244KB

MD5
264789a685cbe8964349ab9600471e3e

SHA1
3421aaeaf22e4c5af4774b79fd3e2f4e71b789cc

SHA256
6243c4198867d01b94725684c2efb2593d64aa61db084a817eeda38c8773c6c5

SHA512
eccc80bec4a702158aafd7fe9bd5cf7764467001dd77a0cbb11ba1eeb2f3473c495c7999f865bf1e64ba0511eabdedf28e445f9ed02c56d116e11d7c311c89a7

Download Submit
\Windows\SysWOW64\hfpapi.dll
Filesize
244KB

MD5
264789a685cbe8964349ab9600471e3e

SHA1
3421aaeaf22e4c5af4774b79fd3e2f4e71b789cc

SHA256
6243c4198867d01b94725684c2efb2593d64aa61db084a817eeda38c8773c6c5

SHA512
eccc80bec4a702158aafd7fe9bd5cf7764467001dd77a0cbb11ba1eeb2f3473c495c7999f865bf1e64ba0511eabdedf28e445f9ed02c56d116e11d7c311c89a7

Download Submit
\Windows\SysWOW64\installd.exe
Filesize
108KB

MD5
e9db876415f67b20e6ba8d9582ae1392

SHA1
8a118c883761da67831998564d71f6cf8c666bd1

SHA256
3d4fc9c134ef5513162015026ba1d72bd8e5ffd3305b92f4bace4927d99b5319

SHA512
45be47361ff3055b0bde1bc34aa3a98e8392f4cb08f3d5f770997b3cf0ebf23df2140382b2285df9fffbee9b8c339e1647c1742715aa727c61d366165f07a16e

Download Submit
\Windows\SysWOW64\nethtsrv.exe
Filesize
176KB

MD5
09efe3e55806ab8cbc2fa8a2a7fe9f52

SHA1
e0450b6cd955ba1196acd4254f25c6cfcb489536

SHA256
13455584a4ad8a9e06c0515cfc3631d816b382a7f1cd53b7ca43c18bfeb4ae90

SHA512
f588a4d8dd3f076126a3032e5b3b89190157af424d4cc55830788516f3089ac5f6d08d476946f886eb85c2d938e32bcbc5e0d2db71bd6da7a7bcb75afc1db4fb

Download Submit
\Windows\SysWOW64\netupdsrv.exe
Filesize
158KB

MD5
44b871cea6964c6d5b76034ec41eb13c

SHA1
a6f062be49f34a2853fca5ded44ffb98230a85b5

SHA256
570a1323e8aa80001a7682a5938a56e2a37f7173bfd68938af6771879750288d

SHA512
7e8060079269d6308873e73f171690d372cd02b348fd0f86039ecf35e493fde4edf75e12c4c832a5c4c34c4db185ca755e99d4ddeabcf0ddee7dff280d8f663a

Download Submit
memory/956-58-0x0000000000000000-mapping.dmp

Download
memory/1004-87-0x0000000000000000-mapping.dmp

Download
memory/1156-81-0x0000000000000000-mapping.dmp

Download
memory/1168-80-0x0000000000000000-mapping.dmp

Download
memory/1560-70-0x0000000000000000-mapping.dmp

Download
memory/1564-62-0x0000000000000000-mapping.dmp

Download
memory/1596-61-0x0000000000000000-mapping.dmp

Download
memory/1632-59-0x0000000000000000-mapping.dmp

Download
memory/1652-86-0x0000000000000000-mapping.dmp

Download
memory/1688-76-0x0000000000000000-mapping.dmp

Download
memory/1788-64-0x0000000000000000-mapping.dmp

Download
memory/2024-54-0x0000000075F81000-0x0000000075F83000-memory.dmp

Filesize
8KB

Download
memory/2024-55-0x0000000000360000-0x00000000007BE000-memory.dmp

Filesize
4.4MB

Download
memory/2024-90-0x0000000000360000-0x00000000007BE000-memory.dmp

Filesize
4.4MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads