0887298f1b73d2d205b1dda8fba1ca4c751df33f280ad80d423737cfebb21c21

Analysis

max time kernel
23s
max time network
46s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
23-11-2022 10:34

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0887298f1b73d2d205b1dda8fba1ca4c751df33f280ad80d423737cfebb21c21.exe
Size

602KB
MD5

feda77a30dece5fe9390bd6b91651417
SHA1

34b3a9ebb556b5a524fbd295eae75b536a269896
SHA256

0887298f1b73d2d205b1dda8fba1ca4c751df33f280ad80d423737cfebb21c21
SHA512

dc6f5eec77995968e446b61b4760944cdeb0892e7c6531c03d69b7868e0822d147d2985f9b8c77c9177d22f9a63942d5577af25e532c108e56553b0fb4cf336a
SSDEEP

12288:mIny5DYT0INiHamwOKaSmgXJvhhIvzu1FmTcazJj2Hq2mCS10Hv1:IUT0Dw0SmgXlhfIBGLH9

Score

8^/10

discovery

Malware Config

Signatures

Drops file in Drivers directory 1 IoCs

Processes:

0887298f1b73d2d205b1dda8fba1ca4c751df33f280ad80d423737cfebb21c21.exe

description ioc process

File created C:\Windows\system32\drivers\nethfdrv.sys 0887298f1b73d2d205b1dda8fba1ca4c751df33f280ad80d423737cfebb21c21.exe
Executes dropped EXE 5 IoCs

Processes:

installd.exenethtsrv.exenetupdsrv.exenethtsrv.exenetupdsrv.exe

pid process

2008 installd.exe
624 nethtsrv.exe
1544 netupdsrv.exe
744 nethtsrv.exe
324 netupdsrv.exe

description	ioc	process
File created	C:\Windows\system32\drivers\nethfdrv.sys	0887298f1b73d2d205b1dda8fba1ca4c751df33f280ad80d423737cfebb21c21.exe

pid	process
2008	installd.exe
624	nethtsrv.exe
1544	netupdsrv.exe
744	nethtsrv.exe
324	netupdsrv.exe

Loads dropped DLL 13 IoCs

Processes:

0887298f1b73d2d205b1dda8fba1ca4c751df33f280ad80d423737cfebb21c21.exeinstalld.exenethtsrv.exenethtsrv.exe

pid	process
1988	0887298f1b73d2d205b1dda8fba1ca4c751df33f280ad80d423737cfebb21c21.exe
1988	0887298f1b73d2d205b1dda8fba1ca4c751df33f280ad80d423737cfebb21c21.exe
1988	0887298f1b73d2d205b1dda8fba1ca4c751df33f280ad80d423737cfebb21c21.exe
1988	0887298f1b73d2d205b1dda8fba1ca4c751df33f280ad80d423737cfebb21c21.exe
2008	installd.exe
1988	0887298f1b73d2d205b1dda8fba1ca4c751df33f280ad80d423737cfebb21c21.exe
624	nethtsrv.exe
624	nethtsrv.exe
1988	0887298f1b73d2d205b1dda8fba1ca4c751df33f280ad80d423737cfebb21c21.exe
1988	0887298f1b73d2d205b1dda8fba1ca4c751df33f280ad80d423737cfebb21c21.exe
744	nethtsrv.exe
744	nethtsrv.exe
1988	0887298f1b73d2d205b1dda8fba1ca4c751df33f280ad80d423737cfebb21c21.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in System32 directory 5 IoCs

Processes:

0887298f1b73d2d205b1dda8fba1ca4c751df33f280ad80d423737cfebb21c21.exe

description	ioc	process
File created	C:\Windows\SysWOW64\hfnapi.dll	0887298f1b73d2d205b1dda8fba1ca4c751df33f280ad80d423737cfebb21c21.exe
File created	C:\Windows\SysWOW64\hfpapi.dll	0887298f1b73d2d205b1dda8fba1ca4c751df33f280ad80d423737cfebb21c21.exe
File created	C:\Windows\SysWOW64\installd.exe	0887298f1b73d2d205b1dda8fba1ca4c751df33f280ad80d423737cfebb21c21.exe
File created	C:\Windows\SysWOW64\nethtsrv.exe	0887298f1b73d2d205b1dda8fba1ca4c751df33f280ad80d423737cfebb21c21.exe
File created	C:\Windows\SysWOW64\netupdsrv.exe	0887298f1b73d2d205b1dda8fba1ca4c751df33f280ad80d423737cfebb21c21.exe

Drops file in Program Files directory 3 IoCs

Processes:

0887298f1b73d2d205b1dda8fba1ca4c751df33f280ad80d423737cfebb21c21.exe

description	ioc	process
File created	C:\Program Files (x86)\Common Files\Config\data.xml	0887298f1b73d2d205b1dda8fba1ca4c751df33f280ad80d423737cfebb21c21.exe
File created	C:\Program Files (x86)\Common Files\Config\ver.xml	0887298f1b73d2d205b1dda8fba1ca4c751df33f280ad80d423737cfebb21c21.exe
File created	C:\Program Files (x86)\Common Files\config\uninstinethnfd.exe	0887298f1b73d2d205b1dda8fba1ca4c751df33f280ad80d423737cfebb21c21.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Runs net.exe
Suspicious behavior: LoadsDriver 1 IoCs

Processes:

pid process

464
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

nethtsrv.exe

description pid process

Token: SeDebugPrivilege 744 nethtsrv.exe

pid	process
464

description	pid	process
Token: SeDebugPrivilege	744	nethtsrv.exe

Suspicious use of WriteProcessMemory 50 IoCs

Processes:

0887298f1b73d2d205b1dda8fba1ca4c751df33f280ad80d423737cfebb21c21.exenet.exenet.exenet.exenet.exe

description	pid	process	target process
PID 1988 wrote to memory of 948	1988	0887298f1b73d2d205b1dda8fba1ca4c751df33f280ad80d423737cfebb21c21.exe	net.exe
PID 1988 wrote to memory of 948	1988	0887298f1b73d2d205b1dda8fba1ca4c751df33f280ad80d423737cfebb21c21.exe	net.exe
PID 1988 wrote to memory of 948	1988	0887298f1b73d2d205b1dda8fba1ca4c751df33f280ad80d423737cfebb21c21.exe	net.exe
PID 1988 wrote to memory of 948	1988	0887298f1b73d2d205b1dda8fba1ca4c751df33f280ad80d423737cfebb21c21.exe	net.exe
PID 948 wrote to memory of 1760	948	net.exe	net1.exe
PID 948 wrote to memory of 1760	948	net.exe	net1.exe
PID 948 wrote to memory of 1760	948	net.exe	net1.exe
PID 948 wrote to memory of 1760	948	net.exe	net1.exe
PID 1988 wrote to memory of 1440	1988	0887298f1b73d2d205b1dda8fba1ca4c751df33f280ad80d423737cfebb21c21.exe	net.exe
PID 1988 wrote to memory of 1440	1988	0887298f1b73d2d205b1dda8fba1ca4c751df33f280ad80d423737cfebb21c21.exe	net.exe
PID 1988 wrote to memory of 1440	1988	0887298f1b73d2d205b1dda8fba1ca4c751df33f280ad80d423737cfebb21c21.exe	net.exe
PID 1988 wrote to memory of 1440	1988	0887298f1b73d2d205b1dda8fba1ca4c751df33f280ad80d423737cfebb21c21.exe	net.exe
PID 1440 wrote to memory of 1284	1440	net.exe	net1.exe
PID 1440 wrote to memory of 1284	1440	net.exe	net1.exe
PID 1440 wrote to memory of 1284	1440	net.exe	net1.exe
PID 1440 wrote to memory of 1284	1440	net.exe	net1.exe
PID 1988 wrote to memory of 2008	1988	0887298f1b73d2d205b1dda8fba1ca4c751df33f280ad80d423737cfebb21c21.exe	installd.exe
PID 1988 wrote to memory of 2008	1988	0887298f1b73d2d205b1dda8fba1ca4c751df33f280ad80d423737cfebb21c21.exe	installd.exe
PID 1988 wrote to memory of 2008	1988	0887298f1b73d2d205b1dda8fba1ca4c751df33f280ad80d423737cfebb21c21.exe	installd.exe
PID 1988 wrote to memory of 2008	1988	0887298f1b73d2d205b1dda8fba1ca4c751df33f280ad80d423737cfebb21c21.exe	installd.exe
PID 1988 wrote to memory of 2008	1988	0887298f1b73d2d205b1dda8fba1ca4c751df33f280ad80d423737cfebb21c21.exe	installd.exe
PID 1988 wrote to memory of 2008	1988	0887298f1b73d2d205b1dda8fba1ca4c751df33f280ad80d423737cfebb21c21.exe	installd.exe
PID 1988 wrote to memory of 2008	1988	0887298f1b73d2d205b1dda8fba1ca4c751df33f280ad80d423737cfebb21c21.exe	installd.exe
PID 1988 wrote to memory of 624	1988	0887298f1b73d2d205b1dda8fba1ca4c751df33f280ad80d423737cfebb21c21.exe	nethtsrv.exe
PID 1988 wrote to memory of 624	1988	0887298f1b73d2d205b1dda8fba1ca4c751df33f280ad80d423737cfebb21c21.exe	nethtsrv.exe
PID 1988 wrote to memory of 624	1988	0887298f1b73d2d205b1dda8fba1ca4c751df33f280ad80d423737cfebb21c21.exe	nethtsrv.exe
PID 1988 wrote to memory of 624	1988	0887298f1b73d2d205b1dda8fba1ca4c751df33f280ad80d423737cfebb21c21.exe	nethtsrv.exe
PID 1988 wrote to memory of 1544	1988	0887298f1b73d2d205b1dda8fba1ca4c751df33f280ad80d423737cfebb21c21.exe	netupdsrv.exe
PID 1988 wrote to memory of 1544	1988	0887298f1b73d2d205b1dda8fba1ca4c751df33f280ad80d423737cfebb21c21.exe	netupdsrv.exe
PID 1988 wrote to memory of 1544	1988	0887298f1b73d2d205b1dda8fba1ca4c751df33f280ad80d423737cfebb21c21.exe	netupdsrv.exe
PID 1988 wrote to memory of 1544	1988	0887298f1b73d2d205b1dda8fba1ca4c751df33f280ad80d423737cfebb21c21.exe	netupdsrv.exe
PID 1988 wrote to memory of 1544	1988	0887298f1b73d2d205b1dda8fba1ca4c751df33f280ad80d423737cfebb21c21.exe	netupdsrv.exe
PID 1988 wrote to memory of 1544	1988	0887298f1b73d2d205b1dda8fba1ca4c751df33f280ad80d423737cfebb21c21.exe	netupdsrv.exe
PID 1988 wrote to memory of 1544	1988	0887298f1b73d2d205b1dda8fba1ca4c751df33f280ad80d423737cfebb21c21.exe	netupdsrv.exe
PID 1988 wrote to memory of 2000	1988	0887298f1b73d2d205b1dda8fba1ca4c751df33f280ad80d423737cfebb21c21.exe	net.exe
PID 1988 wrote to memory of 2000	1988	0887298f1b73d2d205b1dda8fba1ca4c751df33f280ad80d423737cfebb21c21.exe	net.exe
PID 1988 wrote to memory of 2000	1988	0887298f1b73d2d205b1dda8fba1ca4c751df33f280ad80d423737cfebb21c21.exe	net.exe
PID 1988 wrote to memory of 2000	1988	0887298f1b73d2d205b1dda8fba1ca4c751df33f280ad80d423737cfebb21c21.exe	net.exe
PID 2000 wrote to memory of 1652	2000	net.exe	net1.exe
PID 2000 wrote to memory of 1652	2000	net.exe	net1.exe
PID 2000 wrote to memory of 1652	2000	net.exe	net1.exe
PID 2000 wrote to memory of 1652	2000	net.exe	net1.exe
PID 1988 wrote to memory of 2044	1988	0887298f1b73d2d205b1dda8fba1ca4c751df33f280ad80d423737cfebb21c21.exe	net.exe
PID 1988 wrote to memory of 2044	1988	0887298f1b73d2d205b1dda8fba1ca4c751df33f280ad80d423737cfebb21c21.exe	net.exe
PID 1988 wrote to memory of 2044	1988	0887298f1b73d2d205b1dda8fba1ca4c751df33f280ad80d423737cfebb21c21.exe	net.exe
PID 1988 wrote to memory of 2044	1988	0887298f1b73d2d205b1dda8fba1ca4c751df33f280ad80d423737cfebb21c21.exe	net.exe
PID 2044 wrote to memory of 1964	2044	net.exe	net1.exe
PID 2044 wrote to memory of 1964	2044	net.exe	net1.exe
PID 2044 wrote to memory of 1964	2044	net.exe	net1.exe
PID 2044 wrote to memory of 1964	2044	net.exe	net1.exe

C:\Users\Admin\AppData\Local\Temp\0887298f1b73d2d205b1dda8fba1ca4c751df33f280ad80d423737cfebb21c21.exe
"C:\Users\Admin\AppData\Local\Temp\0887298f1b73d2d205b1dda8fba1ca4c751df33f280ad80d423737cfebb21c21.exe"
1⤵
- Drops file in Drivers directory
- Loads dropped DLL
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:1988

C:\Windows\SysWOW64\net.exe
net stop nethttpservice
2⤵
- Suspicious use of WriteProcessMemory
PID:948

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop nethttpservice
3⤵
PID:1760

C:\Windows\SysWOW64\net.exe
net stop serviceupdater
2⤵
- Suspicious use of WriteProcessMemory
PID:1440

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop serviceupdater
3⤵
PID:1284

C:\Windows\SysWOW64\installd.exe
"C:\Windows\system32\installd.exe" nethfdrv
2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2008

C:\Windows\SysWOW64\nethtsrv.exe
"C:\Windows\system32\nethtsrv.exe" -nfdi
2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:624

C:\Windows\SysWOW64\netupdsrv.exe
"C:\Windows\system32\netupdsrv.exe" -nfdi
2⤵
- Executes dropped EXE
PID:1544

C:\Windows\SysWOW64\net.exe
net start nethttpservice
2⤵
- Suspicious use of WriteProcessMemory
PID:2000

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 start nethttpservice
3⤵
PID:1652

C:\Windows\SysWOW64\net.exe
net start serviceupdater
2⤵
- Suspicious use of WriteProcessMemory
PID:2044

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 start serviceupdater
3⤵
PID:1964

C:\Windows\SysWOW64\nethtsrv.exe
C:\Windows\SysWOW64\nethtsrv.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:744

C:\Windows\SysWOW64\netupdsrv.exe
C:\Windows\SysWOW64\netupdsrv.exe
1⤵
- Executes dropped EXE
PID:324

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\hfnapi.dll
Filesize
106KB

MD5
dc09528023230bbe48a6c557d24b84bf

SHA1
d3a20f794424f1ef518a8c19063b656a84556147

SHA256
ff32f03f967edb3fad8d2e216bb9f0b9b052330eabe5e15dfcccc6a6ad2c4397

SHA512
367a6de264ad4f79fdc4390766914de2943033dbaffaba6f8230017eec207573cd9f95b8a3cd970de2277688bceb2ac78de362ae41ce603414230f044250a90b

Download Submit
C:\Windows\SysWOW64\hfpapi.dll
Filesize
241KB

MD5
e103109bbf459ab6f1f38e3b817957b6

SHA1
16a5ae472df85c3f8f097413227a057a2167f403

SHA256
13bbd8dcf9e874f6be6207c93254e9822b77b99da5b0cdacaad2c0a2408e15f5

SHA512
f8162814a387eb0efda35c2f0efdc25bf6c62ad730662289f462ade8b6cf165fb7fe1fca48b212a645e1b156b142ad56dc63cb1a8dfc48e784260d28bc606355

Download Submit
C:\Windows\SysWOW64\installd.exe
Filesize
108KB

MD5
37b2755f3570d90ce41bdb6c10344f1e

SHA1
ea6db31f115c4819d22c7da0c47922d87a363cf4

SHA256
2c3d676d8fcd6611b55b0a53052d7cd00d41bf09545713dd3a42c9060525ac67

SHA512
907ef38f399a819d529cdbee945d191f4a7f85e5289c162ca76bb8a32e9918235138dd431d971c43bb3143976e3f775296fc6659ba525c6487a7b58b4a0c86f9

Download Submit
C:\Windows\SysWOW64\nethtsrv.exe
Filesize
176KB

MD5
6801ae98d1f7b5e9e8a1718e7051f88e

SHA1
f483c860aa2ae1b650e7150aeba3efbd9e56059b

SHA256
38f1a3ae3fedde399a41cf8c536ae96919957c718bf82339b8b0ad00a8b61357

SHA512
e0cc7b711b4dccb000847bd4bc2a490e13d63015789b9d46a2550e35c649c276ccc6419dd3f9a056395492b160dbf8cf1316c5d37a9c8c37b441df98f29a779d

Download Submit
C:\Windows\SysWOW64\nethtsrv.exe
Filesize
176KB

MD5
6801ae98d1f7b5e9e8a1718e7051f88e

SHA1
f483c860aa2ae1b650e7150aeba3efbd9e56059b

SHA256
38f1a3ae3fedde399a41cf8c536ae96919957c718bf82339b8b0ad00a8b61357

SHA512
e0cc7b711b4dccb000847bd4bc2a490e13d63015789b9d46a2550e35c649c276ccc6419dd3f9a056395492b160dbf8cf1316c5d37a9c8c37b441df98f29a779d

Download Submit
C:\Windows\SysWOW64\netupdsrv.exe
Filesize
158KB

MD5
997f8e4028c8e7fd02926efe9b12cb38

SHA1
522b12a0e4b2164a93c1aa89965666321031328c

SHA256
63b92b77c7fb43790ed98aa29eb3cd41f3f2c234466140cb7ede20ded328a840

SHA512
59b3b87a09796c9bb0e7f2e3f201c3637ab3cc405b63c500a70f6dcce9f53f84a50bc9e1cb8c1c5a4a206c87fa48d71f0dad8967e0107d55236e35b75a736a04

Download Submit
C:\Windows\SysWOW64\netupdsrv.exe
Filesize
158KB

MD5
997f8e4028c8e7fd02926efe9b12cb38

SHA1
522b12a0e4b2164a93c1aa89965666321031328c

SHA256
63b92b77c7fb43790ed98aa29eb3cd41f3f2c234466140cb7ede20ded328a840

SHA512
59b3b87a09796c9bb0e7f2e3f201c3637ab3cc405b63c500a70f6dcce9f53f84a50bc9e1cb8c1c5a4a206c87fa48d71f0dad8967e0107d55236e35b75a736a04

Download Submit
\Users\Admin\AppData\Local\Temp\nst4C9D.tmp\System.dll
Filesize
11KB

MD5
c17103ae9072a06da581dec998343fc1

SHA1
b72148c6bdfaada8b8c3f950e610ee7cf1da1f8d

SHA256
dc58d8ad81cacb0c1ed72e33bff8f23ea40b5252b5bb55d393a0903e6819ae2f

SHA512
d32a71aaef18e993f28096d536e41c4d016850721b31171513ce28bbd805a54fd290b7c3e9d935f72e676a1acfb4f0dcc89d95040a0dd29f2b6975855c18986f

Download Submit
\Users\Admin\AppData\Local\Temp\nst4C9D.tmp\nsExec.dll
Filesize
6KB

MD5
acc2b699edfea5bf5aae45aba3a41e96

SHA1
d2accf4d494e43ceb2cff69abe4dd17147d29cc2

SHA256
168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e

SHA512
e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe

Download Submit
\Users\Admin\AppData\Local\Temp\nst4C9D.tmp\nsExec.dll
Filesize
6KB

MD5
acc2b699edfea5bf5aae45aba3a41e96

SHA1
d2accf4d494e43ceb2cff69abe4dd17147d29cc2

SHA256
168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e

SHA512
e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe

Download Submit
\Users\Admin\AppData\Local\Temp\nst4C9D.tmp\nsExec.dll
Filesize
6KB

MD5
acc2b699edfea5bf5aae45aba3a41e96

SHA1
d2accf4d494e43ceb2cff69abe4dd17147d29cc2

SHA256
168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e

SHA512
e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe

Download Submit
\Users\Admin\AppData\Local\Temp\nst4C9D.tmp\nsExec.dll
Filesize
6KB

MD5
acc2b699edfea5bf5aae45aba3a41e96

SHA1
d2accf4d494e43ceb2cff69abe4dd17147d29cc2

SHA256
168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e

SHA512
e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe

Download Submit
\Windows\SysWOW64\hfnapi.dll
Filesize
106KB

MD5
dc09528023230bbe48a6c557d24b84bf

SHA1
d3a20f794424f1ef518a8c19063b656a84556147

SHA256
ff32f03f967edb3fad8d2e216bb9f0b9b052330eabe5e15dfcccc6a6ad2c4397

SHA512
367a6de264ad4f79fdc4390766914de2943033dbaffaba6f8230017eec207573cd9f95b8a3cd970de2277688bceb2ac78de362ae41ce603414230f044250a90b

Download Submit
\Windows\SysWOW64\hfnapi.dll
Filesize
106KB

MD5
dc09528023230bbe48a6c557d24b84bf

SHA1
d3a20f794424f1ef518a8c19063b656a84556147

SHA256
ff32f03f967edb3fad8d2e216bb9f0b9b052330eabe5e15dfcccc6a6ad2c4397

SHA512
367a6de264ad4f79fdc4390766914de2943033dbaffaba6f8230017eec207573cd9f95b8a3cd970de2277688bceb2ac78de362ae41ce603414230f044250a90b

Download Submit
\Windows\SysWOW64\hfnapi.dll
Filesize
106KB

MD5
dc09528023230bbe48a6c557d24b84bf

SHA1
d3a20f794424f1ef518a8c19063b656a84556147

SHA256
ff32f03f967edb3fad8d2e216bb9f0b9b052330eabe5e15dfcccc6a6ad2c4397

SHA512
367a6de264ad4f79fdc4390766914de2943033dbaffaba6f8230017eec207573cd9f95b8a3cd970de2277688bceb2ac78de362ae41ce603414230f044250a90b

Download Submit
\Windows\SysWOW64\hfpapi.dll
Filesize
241KB

MD5
e103109bbf459ab6f1f38e3b817957b6

SHA1
16a5ae472df85c3f8f097413227a057a2167f403

SHA256
13bbd8dcf9e874f6be6207c93254e9822b77b99da5b0cdacaad2c0a2408e15f5

SHA512
f8162814a387eb0efda35c2f0efdc25bf6c62ad730662289f462ade8b6cf165fb7fe1fca48b212a645e1b156b142ad56dc63cb1a8dfc48e784260d28bc606355

Download Submit
\Windows\SysWOW64\hfpapi.dll
Filesize
241KB

MD5
e103109bbf459ab6f1f38e3b817957b6

SHA1
16a5ae472df85c3f8f097413227a057a2167f403

SHA256
13bbd8dcf9e874f6be6207c93254e9822b77b99da5b0cdacaad2c0a2408e15f5

SHA512
f8162814a387eb0efda35c2f0efdc25bf6c62ad730662289f462ade8b6cf165fb7fe1fca48b212a645e1b156b142ad56dc63cb1a8dfc48e784260d28bc606355

Download Submit
\Windows\SysWOW64\installd.exe
Filesize
108KB

MD5
37b2755f3570d90ce41bdb6c10344f1e

SHA1
ea6db31f115c4819d22c7da0c47922d87a363cf4

SHA256
2c3d676d8fcd6611b55b0a53052d7cd00d41bf09545713dd3a42c9060525ac67

SHA512
907ef38f399a819d529cdbee945d191f4a7f85e5289c162ca76bb8a32e9918235138dd431d971c43bb3143976e3f775296fc6659ba525c6487a7b58b4a0c86f9

Download Submit
\Windows\SysWOW64\nethtsrv.exe
Filesize
176KB

MD5
6801ae98d1f7b5e9e8a1718e7051f88e

SHA1
f483c860aa2ae1b650e7150aeba3efbd9e56059b

SHA256
38f1a3ae3fedde399a41cf8c536ae96919957c718bf82339b8b0ad00a8b61357

SHA512
e0cc7b711b4dccb000847bd4bc2a490e13d63015789b9d46a2550e35c649c276ccc6419dd3f9a056395492b160dbf8cf1316c5d37a9c8c37b441df98f29a779d

Download Submit
\Windows\SysWOW64\netupdsrv.exe
Filesize
158KB

MD5
997f8e4028c8e7fd02926efe9b12cb38

SHA1
522b12a0e4b2164a93c1aa89965666321031328c

SHA256
63b92b77c7fb43790ed98aa29eb3cd41f3f2c234466140cb7ede20ded328a840

SHA512
59b3b87a09796c9bb0e7f2e3f201c3637ab3cc405b63c500a70f6dcce9f53f84a50bc9e1cb8c1c5a4a206c87fa48d71f0dad8967e0107d55236e35b75a736a04

Download Submit
memory/624-70-0x0000000000000000-mapping.dmp

Download
memory/948-57-0x0000000000000000-mapping.dmp

Download
memory/1284-62-0x0000000000000000-mapping.dmp

Download
memory/1440-61-0x0000000000000000-mapping.dmp

Download
memory/1544-76-0x0000000000000000-mapping.dmp

Download
memory/1652-81-0x0000000000000000-mapping.dmp

Download
memory/1760-58-0x0000000000000000-mapping.dmp

Download
memory/1964-87-0x0000000000000000-mapping.dmp

Download
memory/1988-54-0x0000000076171000-0x0000000076173000-memory.dmp

Filesize
8KB

Download
memory/1988-59-0x0000000000360000-0x00000000007BE000-memory.dmp

Filesize
4.4MB

Download
memory/1988-90-0x0000000000360000-0x00000000007BE000-memory.dmp

Filesize
4.4MB

Download
memory/2000-80-0x0000000000000000-mapping.dmp

Download
memory/2008-64-0x0000000000000000-mapping.dmp

Download
memory/2044-86-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads