0f06ee07972e91c22883b5bc010200ee5e28cfb7148aedfff0729040260ee422

Analysis

max time kernel
120s
max time network
35s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
23-11-2022 10:33

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0f06ee07972e91c22883b5bc010200ee5e28cfb7148aedfff0729040260ee422.exe
Size

603KB
MD5

a41d70bc9a2a94a62d1779d889fa8abd
SHA1

7cd9fc5a43ea56eb47e28eefd1ed29d71269c65d
SHA256

0f06ee07972e91c22883b5bc010200ee5e28cfb7148aedfff0729040260ee422
SHA512

fa57fafee0e010e638c133803a3872782e5d9b27785edce8d97b0c633e8c845c8f0520011ccd34b7f1767b72e6880615a3f6792803c9aea7a1a454ef1040f556
SSDEEP

12288:sIny5DYTfImSKBflG/WmQ4KnQ1cOUSf3dst0EGo0WdXs1:qUTflSK2/WU4QeOUQe0EbpQ

Score

8^/10

discovery

Malware Config

Signatures

Drops file in Drivers directory 1 IoCs

Processes:

0f06ee07972e91c22883b5bc010200ee5e28cfb7148aedfff0729040260ee422.exe

description ioc process

File created C:\Windows\system32\drivers\nethfdrv.sys 0f06ee07972e91c22883b5bc010200ee5e28cfb7148aedfff0729040260ee422.exe
Executes dropped EXE 5 IoCs

Processes:

installd.exenethtsrv.exenetupdsrv.exenethtsrv.exenetupdsrv.exe

pid process

1172 installd.exe
1596 nethtsrv.exe
1960 netupdsrv.exe
1184 nethtsrv.exe
1292 netupdsrv.exe

description	ioc	process
File created	C:\Windows\system32\drivers\nethfdrv.sys	0f06ee07972e91c22883b5bc010200ee5e28cfb7148aedfff0729040260ee422.exe

pid	process
1172	installd.exe
1596	nethtsrv.exe
1960	netupdsrv.exe
1184	nethtsrv.exe
1292	netupdsrv.exe

Loads dropped DLL 13 IoCs

Processes:

0f06ee07972e91c22883b5bc010200ee5e28cfb7148aedfff0729040260ee422.exeinstalld.exenethtsrv.exenethtsrv.exe

pid	process
1216	0f06ee07972e91c22883b5bc010200ee5e28cfb7148aedfff0729040260ee422.exe
1216	0f06ee07972e91c22883b5bc010200ee5e28cfb7148aedfff0729040260ee422.exe
1216	0f06ee07972e91c22883b5bc010200ee5e28cfb7148aedfff0729040260ee422.exe
1216	0f06ee07972e91c22883b5bc010200ee5e28cfb7148aedfff0729040260ee422.exe
1172	installd.exe
1216	0f06ee07972e91c22883b5bc010200ee5e28cfb7148aedfff0729040260ee422.exe
1596	nethtsrv.exe
1596	nethtsrv.exe
1216	0f06ee07972e91c22883b5bc010200ee5e28cfb7148aedfff0729040260ee422.exe
1216	0f06ee07972e91c22883b5bc010200ee5e28cfb7148aedfff0729040260ee422.exe
1184	nethtsrv.exe
1184	nethtsrv.exe
1216	0f06ee07972e91c22883b5bc010200ee5e28cfb7148aedfff0729040260ee422.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in System32 directory 5 IoCs

Processes:

0f06ee07972e91c22883b5bc010200ee5e28cfb7148aedfff0729040260ee422.exe

description	ioc	process
File created	C:\Windows\SysWOW64\hfnapi.dll	0f06ee07972e91c22883b5bc010200ee5e28cfb7148aedfff0729040260ee422.exe
File created	C:\Windows\SysWOW64\hfpapi.dll	0f06ee07972e91c22883b5bc010200ee5e28cfb7148aedfff0729040260ee422.exe
File created	C:\Windows\SysWOW64\installd.exe	0f06ee07972e91c22883b5bc010200ee5e28cfb7148aedfff0729040260ee422.exe
File created	C:\Windows\SysWOW64\nethtsrv.exe	0f06ee07972e91c22883b5bc010200ee5e28cfb7148aedfff0729040260ee422.exe
File created	C:\Windows\SysWOW64\netupdsrv.exe	0f06ee07972e91c22883b5bc010200ee5e28cfb7148aedfff0729040260ee422.exe

Drops file in Program Files directory 3 IoCs

Processes:

0f06ee07972e91c22883b5bc010200ee5e28cfb7148aedfff0729040260ee422.exe

description	ioc	process
File created	C:\Program Files (x86)\Common Files\Config\data.xml	0f06ee07972e91c22883b5bc010200ee5e28cfb7148aedfff0729040260ee422.exe
File created	C:\Program Files (x86)\Common Files\Config\ver.xml	0f06ee07972e91c22883b5bc010200ee5e28cfb7148aedfff0729040260ee422.exe
File created	C:\Program Files (x86)\Common Files\config\uninstinethnfd.exe	0f06ee07972e91c22883b5bc010200ee5e28cfb7148aedfff0729040260ee422.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Runs net.exe
Suspicious behavior: LoadsDriver 1 IoCs

Processes:

pid process

464
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

nethtsrv.exe

description pid process

Token: SeDebugPrivilege 1184 nethtsrv.exe

pid	process
464

description	pid	process
Token: SeDebugPrivilege	1184	nethtsrv.exe

Suspicious use of WriteProcessMemory 50 IoCs

Processes:

0f06ee07972e91c22883b5bc010200ee5e28cfb7148aedfff0729040260ee422.exenet.exenet.exenet.exenet.exe

description	pid	process	target process
PID 1216 wrote to memory of 564	1216	0f06ee07972e91c22883b5bc010200ee5e28cfb7148aedfff0729040260ee422.exe	net.exe
PID 1216 wrote to memory of 564	1216	0f06ee07972e91c22883b5bc010200ee5e28cfb7148aedfff0729040260ee422.exe	net.exe
PID 1216 wrote to memory of 564	1216	0f06ee07972e91c22883b5bc010200ee5e28cfb7148aedfff0729040260ee422.exe	net.exe
PID 1216 wrote to memory of 564	1216	0f06ee07972e91c22883b5bc010200ee5e28cfb7148aedfff0729040260ee422.exe	net.exe
PID 564 wrote to memory of 680	564	net.exe	net1.exe
PID 564 wrote to memory of 680	564	net.exe	net1.exe
PID 564 wrote to memory of 680	564	net.exe	net1.exe
PID 564 wrote to memory of 680	564	net.exe	net1.exe
PID 1216 wrote to memory of 472	1216	0f06ee07972e91c22883b5bc010200ee5e28cfb7148aedfff0729040260ee422.exe	net.exe
PID 1216 wrote to memory of 472	1216	0f06ee07972e91c22883b5bc010200ee5e28cfb7148aedfff0729040260ee422.exe	net.exe
PID 1216 wrote to memory of 472	1216	0f06ee07972e91c22883b5bc010200ee5e28cfb7148aedfff0729040260ee422.exe	net.exe
PID 1216 wrote to memory of 472	1216	0f06ee07972e91c22883b5bc010200ee5e28cfb7148aedfff0729040260ee422.exe	net.exe
PID 472 wrote to memory of 756	472	net.exe	net1.exe
PID 472 wrote to memory of 756	472	net.exe	net1.exe
PID 472 wrote to memory of 756	472	net.exe	net1.exe
PID 472 wrote to memory of 756	472	net.exe	net1.exe
PID 1216 wrote to memory of 1172	1216	0f06ee07972e91c22883b5bc010200ee5e28cfb7148aedfff0729040260ee422.exe	installd.exe
PID 1216 wrote to memory of 1172	1216	0f06ee07972e91c22883b5bc010200ee5e28cfb7148aedfff0729040260ee422.exe	installd.exe
PID 1216 wrote to memory of 1172	1216	0f06ee07972e91c22883b5bc010200ee5e28cfb7148aedfff0729040260ee422.exe	installd.exe
PID 1216 wrote to memory of 1172	1216	0f06ee07972e91c22883b5bc010200ee5e28cfb7148aedfff0729040260ee422.exe	installd.exe
PID 1216 wrote to memory of 1172	1216	0f06ee07972e91c22883b5bc010200ee5e28cfb7148aedfff0729040260ee422.exe	installd.exe
PID 1216 wrote to memory of 1172	1216	0f06ee07972e91c22883b5bc010200ee5e28cfb7148aedfff0729040260ee422.exe	installd.exe
PID 1216 wrote to memory of 1172	1216	0f06ee07972e91c22883b5bc010200ee5e28cfb7148aedfff0729040260ee422.exe	installd.exe
PID 1216 wrote to memory of 1596	1216	0f06ee07972e91c22883b5bc010200ee5e28cfb7148aedfff0729040260ee422.exe	nethtsrv.exe
PID 1216 wrote to memory of 1596	1216	0f06ee07972e91c22883b5bc010200ee5e28cfb7148aedfff0729040260ee422.exe	nethtsrv.exe
PID 1216 wrote to memory of 1596	1216	0f06ee07972e91c22883b5bc010200ee5e28cfb7148aedfff0729040260ee422.exe	nethtsrv.exe
PID 1216 wrote to memory of 1596	1216	0f06ee07972e91c22883b5bc010200ee5e28cfb7148aedfff0729040260ee422.exe	nethtsrv.exe
PID 1216 wrote to memory of 1960	1216	0f06ee07972e91c22883b5bc010200ee5e28cfb7148aedfff0729040260ee422.exe	netupdsrv.exe
PID 1216 wrote to memory of 1960	1216	0f06ee07972e91c22883b5bc010200ee5e28cfb7148aedfff0729040260ee422.exe	netupdsrv.exe
PID 1216 wrote to memory of 1960	1216	0f06ee07972e91c22883b5bc010200ee5e28cfb7148aedfff0729040260ee422.exe	netupdsrv.exe
PID 1216 wrote to memory of 1960	1216	0f06ee07972e91c22883b5bc010200ee5e28cfb7148aedfff0729040260ee422.exe	netupdsrv.exe
PID 1216 wrote to memory of 1960	1216	0f06ee07972e91c22883b5bc010200ee5e28cfb7148aedfff0729040260ee422.exe	netupdsrv.exe
PID 1216 wrote to memory of 1960	1216	0f06ee07972e91c22883b5bc010200ee5e28cfb7148aedfff0729040260ee422.exe	netupdsrv.exe
PID 1216 wrote to memory of 1960	1216	0f06ee07972e91c22883b5bc010200ee5e28cfb7148aedfff0729040260ee422.exe	netupdsrv.exe
PID 1216 wrote to memory of 864	1216	0f06ee07972e91c22883b5bc010200ee5e28cfb7148aedfff0729040260ee422.exe	net.exe
PID 1216 wrote to memory of 864	1216	0f06ee07972e91c22883b5bc010200ee5e28cfb7148aedfff0729040260ee422.exe	net.exe
PID 1216 wrote to memory of 864	1216	0f06ee07972e91c22883b5bc010200ee5e28cfb7148aedfff0729040260ee422.exe	net.exe
PID 1216 wrote to memory of 864	1216	0f06ee07972e91c22883b5bc010200ee5e28cfb7148aedfff0729040260ee422.exe	net.exe
PID 864 wrote to memory of 1604	864	net.exe	net1.exe
PID 864 wrote to memory of 1604	864	net.exe	net1.exe
PID 864 wrote to memory of 1604	864	net.exe	net1.exe
PID 864 wrote to memory of 1604	864	net.exe	net1.exe
PID 1216 wrote to memory of 2016	1216	0f06ee07972e91c22883b5bc010200ee5e28cfb7148aedfff0729040260ee422.exe	net.exe
PID 1216 wrote to memory of 2016	1216	0f06ee07972e91c22883b5bc010200ee5e28cfb7148aedfff0729040260ee422.exe	net.exe
PID 1216 wrote to memory of 2016	1216	0f06ee07972e91c22883b5bc010200ee5e28cfb7148aedfff0729040260ee422.exe	net.exe
PID 1216 wrote to memory of 2016	1216	0f06ee07972e91c22883b5bc010200ee5e28cfb7148aedfff0729040260ee422.exe	net.exe
PID 2016 wrote to memory of 828	2016	net.exe	net1.exe
PID 2016 wrote to memory of 828	2016	net.exe	net1.exe
PID 2016 wrote to memory of 828	2016	net.exe	net1.exe
PID 2016 wrote to memory of 828	2016	net.exe	net1.exe

C:\Users\Admin\AppData\Local\Temp\0f06ee07972e91c22883b5bc010200ee5e28cfb7148aedfff0729040260ee422.exe
"C:\Users\Admin\AppData\Local\Temp\0f06ee07972e91c22883b5bc010200ee5e28cfb7148aedfff0729040260ee422.exe"
1⤵
- Drops file in Drivers directory
- Loads dropped DLL
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:1216

C:\Windows\SysWOW64\net.exe
net stop nethttpservice
2⤵
- Suspicious use of WriteProcessMemory
PID:564

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop nethttpservice
3⤵
PID:680

C:\Windows\SysWOW64\net.exe
net stop serviceupdater
2⤵
- Suspicious use of WriteProcessMemory
PID:472

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop serviceupdater
3⤵
PID:756

C:\Windows\SysWOW64\installd.exe
"C:\Windows\system32\installd.exe" nethfdrv
2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1172

C:\Windows\SysWOW64\nethtsrv.exe
"C:\Windows\system32\nethtsrv.exe" -nfdi
2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1596

C:\Windows\SysWOW64\netupdsrv.exe
"C:\Windows\system32\netupdsrv.exe" -nfdi
2⤵
- Executes dropped EXE
PID:1960

C:\Windows\SysWOW64\net.exe
net start nethttpservice
2⤵
- Suspicious use of WriteProcessMemory
PID:864

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 start nethttpservice
3⤵
PID:1604

C:\Windows\SysWOW64\net.exe
net start serviceupdater
2⤵
- Suspicious use of WriteProcessMemory
PID:2016

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 start serviceupdater
3⤵
PID:828

C:\Windows\SysWOW64\nethtsrv.exe
C:\Windows\SysWOW64\nethtsrv.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:1184

C:\Windows\SysWOW64\netupdsrv.exe
C:\Windows\SysWOW64\netupdsrv.exe
1⤵
- Executes dropped EXE
PID:1292

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\hfnapi.dll
Filesize
106KB

MD5
b803c1df01e4d70c6dd224e96f66241f

SHA1
814f34cb171855d516f3f5f7f2dfc16b571e3eda

SHA256
918bb27a6559b3b68e9721d15e121674cc071fc668ace961486276278388bda2

SHA512
842a51ff9f4c141f24d2c7a18dcab376a56ad7725841b876698892cea3724712041a705e078cb2551416a13b8fb565951a213f8385ad9a5e72440bc356efa10b

Download Submit
C:\Windows\SysWOW64\hfpapi.dll
Filesize
244KB

MD5
a2d9cff0bfc6ae5425b9c77c7f10e489

SHA1
5693db9a5c01d684028e741018d725a1cdea74ed

SHA256
fdece10512ce51a01c2815a6c38e6e1af8931dd4580fb4a7cc44a94c8690cf96

SHA512
59ff86c64b96e740b7d52103ac5b81e1f782439f94aeb7373e5b0078dea30564f834fd955cca503a483e0548b1c8f787b7c22791ff0da90f1b074211d16af64f

Download Submit
C:\Windows\SysWOW64\installd.exe
Filesize
108KB

MD5
0a16985eef7fe5e25408b24db264f660

SHA1
f374ad9b600ef30af02cce8c556ed1840de2aac3

SHA256
6803f6be2c682144a92cc2c5df4928a46a0999e182f65aea122c29f74abb2d94

SHA512
127213b43e3f0e7425fb20c2986dc26c6dc0fdd60dc3d28e6a686abac3712210f4605fba8cef57961726592fde425bfcd12b27857b18971980d062b56458f0c6

Download Submit
C:\Windows\SysWOW64\nethtsrv.exe
Filesize
176KB

MD5
35525bdb9a49ff5869bffb2daf1e98c7

SHA1
709bb0cdc43ab39acc6c87b08ea2fb1390fc124e

SHA256
f651628423e0b5118945a1ebd40d1881d8ec2981afe5b69c300a14f9eb381ec4

SHA512
b961fbbae95819343dd6a7bc2bed9de94612469698b557de27173d189daceb0ba6ca88b1e600e961ef50f2ed11da431aa06b5a7a7d323252e143cdde2aeec49f

Download Submit
C:\Windows\SysWOW64\nethtsrv.exe
Filesize
176KB

MD5
35525bdb9a49ff5869bffb2daf1e98c7

SHA1
709bb0cdc43ab39acc6c87b08ea2fb1390fc124e

SHA256
f651628423e0b5118945a1ebd40d1881d8ec2981afe5b69c300a14f9eb381ec4

SHA512
b961fbbae95819343dd6a7bc2bed9de94612469698b557de27173d189daceb0ba6ca88b1e600e961ef50f2ed11da431aa06b5a7a7d323252e143cdde2aeec49f

Download Submit
C:\Windows\SysWOW64\netupdsrv.exe
Filesize
159KB

MD5
47dc75c1ba81ddae6a31809ef3dffbed

SHA1
5e3f4b8fd8fb1a02e4261509043f961d59ee1a40

SHA256
76ef4984367b90df2c73319db343eb2a5aea4576d2d20655d9263c1a4d8a0053

SHA512
03b7c0d44562d2974753ceed82f12020f5560a36ddde6d211b61fa60a2efd293855c6ad5218c32fe00afb6509bc2150dd0d332f09c88a406507ab1d52129c478

Download Submit
C:\Windows\SysWOW64\netupdsrv.exe
Filesize
159KB

MD5
47dc75c1ba81ddae6a31809ef3dffbed

SHA1
5e3f4b8fd8fb1a02e4261509043f961d59ee1a40

SHA256
76ef4984367b90df2c73319db343eb2a5aea4576d2d20655d9263c1a4d8a0053

SHA512
03b7c0d44562d2974753ceed82f12020f5560a36ddde6d211b61fa60a2efd293855c6ad5218c32fe00afb6509bc2150dd0d332f09c88a406507ab1d52129c478

Download Submit
\Users\Admin\AppData\Local\Temp\nsyE034.tmp\System.dll
Filesize
11KB

MD5
c17103ae9072a06da581dec998343fc1

SHA1
b72148c6bdfaada8b8c3f950e610ee7cf1da1f8d

SHA256
dc58d8ad81cacb0c1ed72e33bff8f23ea40b5252b5bb55d393a0903e6819ae2f

SHA512
d32a71aaef18e993f28096d536e41c4d016850721b31171513ce28bbd805a54fd290b7c3e9d935f72e676a1acfb4f0dcc89d95040a0dd29f2b6975855c18986f

Download Submit
\Users\Admin\AppData\Local\Temp\nsyE034.tmp\nsExec.dll
Filesize
6KB

MD5
acc2b699edfea5bf5aae45aba3a41e96

SHA1
d2accf4d494e43ceb2cff69abe4dd17147d29cc2

SHA256
168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e

SHA512
e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe

Download Submit
\Users\Admin\AppData\Local\Temp\nsyE034.tmp\nsExec.dll
Filesize
6KB

MD5
acc2b699edfea5bf5aae45aba3a41e96

SHA1
d2accf4d494e43ceb2cff69abe4dd17147d29cc2

SHA256
168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e

SHA512
e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe

Download Submit
\Users\Admin\AppData\Local\Temp\nsyE034.tmp\nsExec.dll
Filesize
6KB

MD5
acc2b699edfea5bf5aae45aba3a41e96

SHA1
d2accf4d494e43ceb2cff69abe4dd17147d29cc2

SHA256
168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e

SHA512
e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe

Download Submit
\Users\Admin\AppData\Local\Temp\nsyE034.tmp\nsExec.dll
Filesize
6KB

MD5
acc2b699edfea5bf5aae45aba3a41e96

SHA1
d2accf4d494e43ceb2cff69abe4dd17147d29cc2

SHA256
168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e

SHA512
e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe

Download Submit
\Windows\SysWOW64\hfnapi.dll
Filesize
106KB

MD5
b803c1df01e4d70c6dd224e96f66241f

SHA1
814f34cb171855d516f3f5f7f2dfc16b571e3eda

SHA256
918bb27a6559b3b68e9721d15e121674cc071fc668ace961486276278388bda2

SHA512
842a51ff9f4c141f24d2c7a18dcab376a56ad7725841b876698892cea3724712041a705e078cb2551416a13b8fb565951a213f8385ad9a5e72440bc356efa10b

Download Submit
\Windows\SysWOW64\hfnapi.dll
Filesize
106KB

MD5
b803c1df01e4d70c6dd224e96f66241f

SHA1
814f34cb171855d516f3f5f7f2dfc16b571e3eda

SHA256
918bb27a6559b3b68e9721d15e121674cc071fc668ace961486276278388bda2

SHA512
842a51ff9f4c141f24d2c7a18dcab376a56ad7725841b876698892cea3724712041a705e078cb2551416a13b8fb565951a213f8385ad9a5e72440bc356efa10b

Download Submit
\Windows\SysWOW64\hfnapi.dll
Filesize
106KB

MD5
b803c1df01e4d70c6dd224e96f66241f

SHA1
814f34cb171855d516f3f5f7f2dfc16b571e3eda

SHA256
918bb27a6559b3b68e9721d15e121674cc071fc668ace961486276278388bda2

SHA512
842a51ff9f4c141f24d2c7a18dcab376a56ad7725841b876698892cea3724712041a705e078cb2551416a13b8fb565951a213f8385ad9a5e72440bc356efa10b

Download Submit
\Windows\SysWOW64\hfpapi.dll
Filesize
244KB

MD5
a2d9cff0bfc6ae5425b9c77c7f10e489

SHA1
5693db9a5c01d684028e741018d725a1cdea74ed

SHA256
fdece10512ce51a01c2815a6c38e6e1af8931dd4580fb4a7cc44a94c8690cf96

SHA512
59ff86c64b96e740b7d52103ac5b81e1f782439f94aeb7373e5b0078dea30564f834fd955cca503a483e0548b1c8f787b7c22791ff0da90f1b074211d16af64f

Download Submit
\Windows\SysWOW64\hfpapi.dll
Filesize
244KB

MD5
a2d9cff0bfc6ae5425b9c77c7f10e489

SHA1
5693db9a5c01d684028e741018d725a1cdea74ed

SHA256
fdece10512ce51a01c2815a6c38e6e1af8931dd4580fb4a7cc44a94c8690cf96

SHA512
59ff86c64b96e740b7d52103ac5b81e1f782439f94aeb7373e5b0078dea30564f834fd955cca503a483e0548b1c8f787b7c22791ff0da90f1b074211d16af64f

Download Submit
\Windows\SysWOW64\installd.exe
Filesize
108KB

MD5
0a16985eef7fe5e25408b24db264f660

SHA1
f374ad9b600ef30af02cce8c556ed1840de2aac3

SHA256
6803f6be2c682144a92cc2c5df4928a46a0999e182f65aea122c29f74abb2d94

SHA512
127213b43e3f0e7425fb20c2986dc26c6dc0fdd60dc3d28e6a686abac3712210f4605fba8cef57961726592fde425bfcd12b27857b18971980d062b56458f0c6

Download Submit
\Windows\SysWOW64\nethtsrv.exe
Filesize
176KB

MD5
35525bdb9a49ff5869bffb2daf1e98c7

SHA1
709bb0cdc43ab39acc6c87b08ea2fb1390fc124e

SHA256
f651628423e0b5118945a1ebd40d1881d8ec2981afe5b69c300a14f9eb381ec4

SHA512
b961fbbae95819343dd6a7bc2bed9de94612469698b557de27173d189daceb0ba6ca88b1e600e961ef50f2ed11da431aa06b5a7a7d323252e143cdde2aeec49f

Download Submit
\Windows\SysWOW64\netupdsrv.exe
Filesize
159KB

MD5
47dc75c1ba81ddae6a31809ef3dffbed

SHA1
5e3f4b8fd8fb1a02e4261509043f961d59ee1a40

SHA256
76ef4984367b90df2c73319db343eb2a5aea4576d2d20655d9263c1a4d8a0053

SHA512
03b7c0d44562d2974753ceed82f12020f5560a36ddde6d211b61fa60a2efd293855c6ad5218c32fe00afb6509bc2150dd0d332f09c88a406507ab1d52129c478

Download Submit
memory/472-60-0x0000000000000000-mapping.dmp

Download
memory/564-57-0x0000000000000000-mapping.dmp

Download
memory/680-58-0x0000000000000000-mapping.dmp

Download
memory/756-61-0x0000000000000000-mapping.dmp

Download
memory/828-88-0x0000000000000000-mapping.dmp

Download
memory/864-81-0x0000000000000000-mapping.dmp

Download
memory/1172-64-0x0000000000000000-mapping.dmp

Download
memory/1216-54-0x0000000075011000-0x0000000075013000-memory.dmp

Filesize
8KB

Download
memory/1216-62-0x0000000000360000-0x00000000007BE000-memory.dmp

Filesize
4.4MB

Download
memory/1216-79-0x0000000000360000-0x00000000007BE000-memory.dmp

Filesize
4.4MB

Download
memory/1216-91-0x0000000000360000-0x00000000007BE000-memory.dmp

Filesize
4.4MB

Download
memory/1596-70-0x0000000000000000-mapping.dmp

Download
memory/1604-82-0x0000000000000000-mapping.dmp

Download
memory/1960-76-0x0000000000000000-mapping.dmp

Download
memory/2016-87-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads