0821ddf8f66042b9eb53a97a9bbe05c583ee84f753fa15113b14015357d7da95

Analysis

max time kernel
43s
max time network
48s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
23-11-2022 10:34

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0821ddf8f66042b9eb53a97a9bbe05c583ee84f753fa15113b14015357d7da95.exe
Size

603KB
MD5

e378c7fabed8e3402c703a7ae11c8002
SHA1

132938183af1f5ef810b08a036e5d325c0b8af7d
SHA256

0821ddf8f66042b9eb53a97a9bbe05c583ee84f753fa15113b14015357d7da95
SHA512

7fd928e228e28a2d08373dff9e72db230c5cf6ec51b125fcdf24da8494e1b7533ebb808728573d1d8dee01089946b765ab0cfff8494b2bb93974356f048e9e48
SSDEEP

12288:AIny5DYTfIhwE16gPgwPZ2nK3PYnDFgwyhrXgzT:+UTf6n8glZUK/YD5yV0T

Score

8^/10

discovery

Malware Config

Signatures

Drops file in Drivers directory 1 IoCs

Processes:

0821ddf8f66042b9eb53a97a9bbe05c583ee84f753fa15113b14015357d7da95.exe

description ioc process

File created C:\Windows\system32\drivers\nethfdrv.sys 0821ddf8f66042b9eb53a97a9bbe05c583ee84f753fa15113b14015357d7da95.exe
Executes dropped EXE 5 IoCs

Processes:

installd.exenethtsrv.exenetupdsrv.exenethtsrv.exenetupdsrv.exe

pid process

2036 installd.exe
572 nethtsrv.exe
1816 netupdsrv.exe
1952 nethtsrv.exe
436 netupdsrv.exe

description	ioc	process
File created	C:\Windows\system32\drivers\nethfdrv.sys	0821ddf8f66042b9eb53a97a9bbe05c583ee84f753fa15113b14015357d7da95.exe

pid	process
2036	installd.exe
572	nethtsrv.exe
1816	netupdsrv.exe
1952	nethtsrv.exe
436	netupdsrv.exe

Loads dropped DLL 13 IoCs

Processes:

0821ddf8f66042b9eb53a97a9bbe05c583ee84f753fa15113b14015357d7da95.exeinstalld.exenethtsrv.exenethtsrv.exe

pid	process
1228	0821ddf8f66042b9eb53a97a9bbe05c583ee84f753fa15113b14015357d7da95.exe
1228	0821ddf8f66042b9eb53a97a9bbe05c583ee84f753fa15113b14015357d7da95.exe
1228	0821ddf8f66042b9eb53a97a9bbe05c583ee84f753fa15113b14015357d7da95.exe
1228	0821ddf8f66042b9eb53a97a9bbe05c583ee84f753fa15113b14015357d7da95.exe
2036	installd.exe
1228	0821ddf8f66042b9eb53a97a9bbe05c583ee84f753fa15113b14015357d7da95.exe
572	nethtsrv.exe
572	nethtsrv.exe
1228	0821ddf8f66042b9eb53a97a9bbe05c583ee84f753fa15113b14015357d7da95.exe
1228	0821ddf8f66042b9eb53a97a9bbe05c583ee84f753fa15113b14015357d7da95.exe
1952	nethtsrv.exe
1952	nethtsrv.exe
1228	0821ddf8f66042b9eb53a97a9bbe05c583ee84f753fa15113b14015357d7da95.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in System32 directory 5 IoCs

Processes:

0821ddf8f66042b9eb53a97a9bbe05c583ee84f753fa15113b14015357d7da95.exe

description	ioc	process
File created	C:\Windows\SysWOW64\hfnapi.dll	0821ddf8f66042b9eb53a97a9bbe05c583ee84f753fa15113b14015357d7da95.exe
File created	C:\Windows\SysWOW64\hfpapi.dll	0821ddf8f66042b9eb53a97a9bbe05c583ee84f753fa15113b14015357d7da95.exe
File created	C:\Windows\SysWOW64\installd.exe	0821ddf8f66042b9eb53a97a9bbe05c583ee84f753fa15113b14015357d7da95.exe
File created	C:\Windows\SysWOW64\nethtsrv.exe	0821ddf8f66042b9eb53a97a9bbe05c583ee84f753fa15113b14015357d7da95.exe
File created	C:\Windows\SysWOW64\netupdsrv.exe	0821ddf8f66042b9eb53a97a9bbe05c583ee84f753fa15113b14015357d7da95.exe

Drops file in Program Files directory 3 IoCs

Processes:

0821ddf8f66042b9eb53a97a9bbe05c583ee84f753fa15113b14015357d7da95.exe

description	ioc	process
File created	C:\Program Files (x86)\Common Files\Config\data.xml	0821ddf8f66042b9eb53a97a9bbe05c583ee84f753fa15113b14015357d7da95.exe
File created	C:\Program Files (x86)\Common Files\Config\ver.xml	0821ddf8f66042b9eb53a97a9bbe05c583ee84f753fa15113b14015357d7da95.exe
File created	C:\Program Files (x86)\Common Files\config\uninstinethnfd.exe	0821ddf8f66042b9eb53a97a9bbe05c583ee84f753fa15113b14015357d7da95.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Runs net.exe
Suspicious behavior: LoadsDriver 1 IoCs

Processes:

pid process

464
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

nethtsrv.exe

description pid process

Token: SeDebugPrivilege 1952 nethtsrv.exe

pid	process
464

description	pid	process
Token: SeDebugPrivilege	1952	nethtsrv.exe

Suspicious use of WriteProcessMemory 50 IoCs

Processes:

0821ddf8f66042b9eb53a97a9bbe05c583ee84f753fa15113b14015357d7da95.exenet.exenet.exenet.exenet.exe

description	pid	process	target process
PID 1228 wrote to memory of 1428	1228	0821ddf8f66042b9eb53a97a9bbe05c583ee84f753fa15113b14015357d7da95.exe	net.exe
PID 1228 wrote to memory of 1428	1228	0821ddf8f66042b9eb53a97a9bbe05c583ee84f753fa15113b14015357d7da95.exe	net.exe
PID 1228 wrote to memory of 1428	1228	0821ddf8f66042b9eb53a97a9bbe05c583ee84f753fa15113b14015357d7da95.exe	net.exe
PID 1228 wrote to memory of 1428	1228	0821ddf8f66042b9eb53a97a9bbe05c583ee84f753fa15113b14015357d7da95.exe	net.exe
PID 1428 wrote to memory of 1332	1428	net.exe	net1.exe
PID 1428 wrote to memory of 1332	1428	net.exe	net1.exe
PID 1428 wrote to memory of 1332	1428	net.exe	net1.exe
PID 1428 wrote to memory of 1332	1428	net.exe	net1.exe
PID 1228 wrote to memory of 332	1228	0821ddf8f66042b9eb53a97a9bbe05c583ee84f753fa15113b14015357d7da95.exe	net.exe
PID 1228 wrote to memory of 332	1228	0821ddf8f66042b9eb53a97a9bbe05c583ee84f753fa15113b14015357d7da95.exe	net.exe
PID 1228 wrote to memory of 332	1228	0821ddf8f66042b9eb53a97a9bbe05c583ee84f753fa15113b14015357d7da95.exe	net.exe
PID 1228 wrote to memory of 332	1228	0821ddf8f66042b9eb53a97a9bbe05c583ee84f753fa15113b14015357d7da95.exe	net.exe
PID 332 wrote to memory of 1776	332	net.exe	net1.exe
PID 332 wrote to memory of 1776	332	net.exe	net1.exe
PID 332 wrote to memory of 1776	332	net.exe	net1.exe
PID 332 wrote to memory of 1776	332	net.exe	net1.exe
PID 1228 wrote to memory of 2036	1228	0821ddf8f66042b9eb53a97a9bbe05c583ee84f753fa15113b14015357d7da95.exe	installd.exe
PID 1228 wrote to memory of 2036	1228	0821ddf8f66042b9eb53a97a9bbe05c583ee84f753fa15113b14015357d7da95.exe	installd.exe
PID 1228 wrote to memory of 2036	1228	0821ddf8f66042b9eb53a97a9bbe05c583ee84f753fa15113b14015357d7da95.exe	installd.exe
PID 1228 wrote to memory of 2036	1228	0821ddf8f66042b9eb53a97a9bbe05c583ee84f753fa15113b14015357d7da95.exe	installd.exe
PID 1228 wrote to memory of 2036	1228	0821ddf8f66042b9eb53a97a9bbe05c583ee84f753fa15113b14015357d7da95.exe	installd.exe
PID 1228 wrote to memory of 2036	1228	0821ddf8f66042b9eb53a97a9bbe05c583ee84f753fa15113b14015357d7da95.exe	installd.exe
PID 1228 wrote to memory of 2036	1228	0821ddf8f66042b9eb53a97a9bbe05c583ee84f753fa15113b14015357d7da95.exe	installd.exe
PID 1228 wrote to memory of 572	1228	0821ddf8f66042b9eb53a97a9bbe05c583ee84f753fa15113b14015357d7da95.exe	nethtsrv.exe
PID 1228 wrote to memory of 572	1228	0821ddf8f66042b9eb53a97a9bbe05c583ee84f753fa15113b14015357d7da95.exe	nethtsrv.exe
PID 1228 wrote to memory of 572	1228	0821ddf8f66042b9eb53a97a9bbe05c583ee84f753fa15113b14015357d7da95.exe	nethtsrv.exe
PID 1228 wrote to memory of 572	1228	0821ddf8f66042b9eb53a97a9bbe05c583ee84f753fa15113b14015357d7da95.exe	nethtsrv.exe
PID 1228 wrote to memory of 1816	1228	0821ddf8f66042b9eb53a97a9bbe05c583ee84f753fa15113b14015357d7da95.exe	netupdsrv.exe
PID 1228 wrote to memory of 1816	1228	0821ddf8f66042b9eb53a97a9bbe05c583ee84f753fa15113b14015357d7da95.exe	netupdsrv.exe
PID 1228 wrote to memory of 1816	1228	0821ddf8f66042b9eb53a97a9bbe05c583ee84f753fa15113b14015357d7da95.exe	netupdsrv.exe
PID 1228 wrote to memory of 1816	1228	0821ddf8f66042b9eb53a97a9bbe05c583ee84f753fa15113b14015357d7da95.exe	netupdsrv.exe
PID 1228 wrote to memory of 1816	1228	0821ddf8f66042b9eb53a97a9bbe05c583ee84f753fa15113b14015357d7da95.exe	netupdsrv.exe
PID 1228 wrote to memory of 1816	1228	0821ddf8f66042b9eb53a97a9bbe05c583ee84f753fa15113b14015357d7da95.exe	netupdsrv.exe
PID 1228 wrote to memory of 1816	1228	0821ddf8f66042b9eb53a97a9bbe05c583ee84f753fa15113b14015357d7da95.exe	netupdsrv.exe
PID 1228 wrote to memory of 1988	1228	0821ddf8f66042b9eb53a97a9bbe05c583ee84f753fa15113b14015357d7da95.exe	net.exe
PID 1228 wrote to memory of 1988	1228	0821ddf8f66042b9eb53a97a9bbe05c583ee84f753fa15113b14015357d7da95.exe	net.exe
PID 1228 wrote to memory of 1988	1228	0821ddf8f66042b9eb53a97a9bbe05c583ee84f753fa15113b14015357d7da95.exe	net.exe
PID 1228 wrote to memory of 1988	1228	0821ddf8f66042b9eb53a97a9bbe05c583ee84f753fa15113b14015357d7da95.exe	net.exe
PID 1988 wrote to memory of 1888	1988	net.exe	net1.exe
PID 1988 wrote to memory of 1888	1988	net.exe	net1.exe
PID 1988 wrote to memory of 1888	1988	net.exe	net1.exe
PID 1988 wrote to memory of 1888	1988	net.exe	net1.exe
PID 1228 wrote to memory of 1160	1228	0821ddf8f66042b9eb53a97a9bbe05c583ee84f753fa15113b14015357d7da95.exe	net.exe
PID 1228 wrote to memory of 1160	1228	0821ddf8f66042b9eb53a97a9bbe05c583ee84f753fa15113b14015357d7da95.exe	net.exe
PID 1228 wrote to memory of 1160	1228	0821ddf8f66042b9eb53a97a9bbe05c583ee84f753fa15113b14015357d7da95.exe	net.exe
PID 1228 wrote to memory of 1160	1228	0821ddf8f66042b9eb53a97a9bbe05c583ee84f753fa15113b14015357d7da95.exe	net.exe
PID 1160 wrote to memory of 688	1160	net.exe	net1.exe
PID 1160 wrote to memory of 688	1160	net.exe	net1.exe
PID 1160 wrote to memory of 688	1160	net.exe	net1.exe
PID 1160 wrote to memory of 688	1160	net.exe	net1.exe

C:\Users\Admin\AppData\Local\Temp\0821ddf8f66042b9eb53a97a9bbe05c583ee84f753fa15113b14015357d7da95.exe
"C:\Users\Admin\AppData\Local\Temp\0821ddf8f66042b9eb53a97a9bbe05c583ee84f753fa15113b14015357d7da95.exe"
1⤵
- Drops file in Drivers directory
- Loads dropped DLL
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:1228

C:\Windows\SysWOW64\net.exe
net stop nethttpservice
2⤵
- Suspicious use of WriteProcessMemory
PID:1428

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop nethttpservice
3⤵
PID:1332

C:\Windows\SysWOW64\net.exe
net stop serviceupdater
2⤵
- Suspicious use of WriteProcessMemory
PID:332

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop serviceupdater
3⤵
PID:1776

C:\Windows\SysWOW64\installd.exe
"C:\Windows\system32\installd.exe" nethfdrv
2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2036

C:\Windows\SysWOW64\nethtsrv.exe
"C:\Windows\system32\nethtsrv.exe" -nfdi
2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:572

C:\Windows\SysWOW64\netupdsrv.exe
"C:\Windows\system32\netupdsrv.exe" -nfdi
2⤵
- Executes dropped EXE
PID:1816

C:\Windows\SysWOW64\net.exe
net start nethttpservice
2⤵
- Suspicious use of WriteProcessMemory
PID:1988

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 start nethttpservice
3⤵
PID:1888

C:\Windows\SysWOW64\net.exe
net start serviceupdater
2⤵
- Suspicious use of WriteProcessMemory
PID:1160

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 start serviceupdater
3⤵
PID:688

C:\Windows\SysWOW64\nethtsrv.exe
C:\Windows\SysWOW64\nethtsrv.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:1952

C:\Windows\SysWOW64\netupdsrv.exe
C:\Windows\SysWOW64\netupdsrv.exe
1⤵
- Executes dropped EXE
PID:436

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\hfnapi.dll
Filesize
106KB

MD5
f24b8a4a7528def8ea6fa9acdbef086b

SHA1
921e8875a389f80053d3018dca8317499f941202

SHA256
aa80ebf9e06994cfe44cf182d307d20cd9c0fa861772ef96d82cee1c318c60e7

SHA512
05bbfb8e1864eee0a2be4fb860224d9018d7fe7c487b0c54377b3c320eff5f8fd78018612e84cfb1d78bf670cda5735d3d68325bd9264ddf7178ad38b08e7627

Download Submit
C:\Windows\SysWOW64\hfpapi.dll
Filesize
244KB

MD5
725980024b6c88c36527d412d93d7005

SHA1
083b50d40a23a21ca408cfb3bb634807b7c24a68

SHA256
82740fbf47574f7b4fa22214d79e268083e7ff9268fd7198ca595fbcac8ab464

SHA512
fb1974c07a9067dedd8caeb4ad0c78d0799e752eb0317abc2394693e454d29f03738a08bda428632ee812ab69bbe8ee63653819614df0185be25f380c198febb

Download Submit
C:\Windows\SysWOW64\installd.exe
Filesize
108KB

MD5
c2e14fcdde0c8b83392f9ca4be76f8b2

SHA1
02cc471f91a396cb9358e07832d61143cc6fc3fe

SHA256
f1a813c3a05a7d195302c876729188046a0daee20d78386edcc4a1b1fdc34435

SHA512
84d7de010b2547834559ee56452fa839dfd5d6a8705db9961c57760bc20bfc8b60231659cf36961c6875adecbc090a31c77b8e33c051adb624dcbbc22d21eea6

Download Submit
C:\Windows\SysWOW64\nethtsrv.exe
Filesize
176KB

MD5
d72868c942b541c3ef7b2419260ccf09

SHA1
a62795490b0802fe5166cec20cc915c2629edba4

SHA256
68cb72d3625ac4339013eb6cc79264d7914db90d87c2c701392ba6d1d23621b7

SHA512
60a724878d5d07abda8596dd02add204f7789be3fed62a02b1c8856358482988124b6d467494fcf82eae96c12ac8ca6dc923d930899e853cd156cfcb9f7ac12f

Download Submit
C:\Windows\SysWOW64\nethtsrv.exe
Filesize
176KB

MD5
d72868c942b541c3ef7b2419260ccf09

SHA1
a62795490b0802fe5166cec20cc915c2629edba4

SHA256
68cb72d3625ac4339013eb6cc79264d7914db90d87c2c701392ba6d1d23621b7

SHA512
60a724878d5d07abda8596dd02add204f7789be3fed62a02b1c8856358482988124b6d467494fcf82eae96c12ac8ca6dc923d930899e853cd156cfcb9f7ac12f

Download Submit
C:\Windows\SysWOW64\netupdsrv.exe
Filesize
158KB

MD5
a7faa299bc6270cef12c6e7ba8a6364f

SHA1
460822ace5152ccd19543006eb2868aa6b5491c3

SHA256
10919223300f48b55585e99a341d5d2dde8b64454aaa21c58ba7b491127d19a9

SHA512
8510bf3ea822f2a6bf322f40df0dc3443b039040c203123372cfdc08a5972f9d570f75211b16b04c437823e3a81e0d1a4009d16481ce1d4e49a8f3b70c3eded0

Download Submit
C:\Windows\SysWOW64\netupdsrv.exe
Filesize
158KB

MD5
a7faa299bc6270cef12c6e7ba8a6364f

SHA1
460822ace5152ccd19543006eb2868aa6b5491c3

SHA256
10919223300f48b55585e99a341d5d2dde8b64454aaa21c58ba7b491127d19a9

SHA512
8510bf3ea822f2a6bf322f40df0dc3443b039040c203123372cfdc08a5972f9d570f75211b16b04c437823e3a81e0d1a4009d16481ce1d4e49a8f3b70c3eded0

Download Submit
\Users\Admin\AppData\Local\Temp\nsy2964.tmp\System.dll
Filesize
11KB

MD5
c17103ae9072a06da581dec998343fc1

SHA1
b72148c6bdfaada8b8c3f950e610ee7cf1da1f8d

SHA256
dc58d8ad81cacb0c1ed72e33bff8f23ea40b5252b5bb55d393a0903e6819ae2f

SHA512
d32a71aaef18e993f28096d536e41c4d016850721b31171513ce28bbd805a54fd290b7c3e9d935f72e676a1acfb4f0dcc89d95040a0dd29f2b6975855c18986f

Download Submit
\Users\Admin\AppData\Local\Temp\nsy2964.tmp\nsExec.dll
Filesize
6KB

MD5
acc2b699edfea5bf5aae45aba3a41e96

SHA1
d2accf4d494e43ceb2cff69abe4dd17147d29cc2

SHA256
168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e

SHA512
e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe

Download Submit
\Users\Admin\AppData\Local\Temp\nsy2964.tmp\nsExec.dll
Filesize
6KB

MD5
acc2b699edfea5bf5aae45aba3a41e96

SHA1
d2accf4d494e43ceb2cff69abe4dd17147d29cc2

SHA256
168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e

SHA512
e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe

Download Submit
\Users\Admin\AppData\Local\Temp\nsy2964.tmp\nsExec.dll
Filesize
6KB

MD5
acc2b699edfea5bf5aae45aba3a41e96

SHA1
d2accf4d494e43ceb2cff69abe4dd17147d29cc2

SHA256
168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e

SHA512
e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe

Download Submit
\Users\Admin\AppData\Local\Temp\nsy2964.tmp\nsExec.dll
Filesize
6KB

MD5
acc2b699edfea5bf5aae45aba3a41e96

SHA1
d2accf4d494e43ceb2cff69abe4dd17147d29cc2

SHA256
168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e

SHA512
e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe

Download Submit
\Windows\SysWOW64\hfnapi.dll
Filesize
106KB

MD5
f24b8a4a7528def8ea6fa9acdbef086b

SHA1
921e8875a389f80053d3018dca8317499f941202

SHA256
aa80ebf9e06994cfe44cf182d307d20cd9c0fa861772ef96d82cee1c318c60e7

SHA512
05bbfb8e1864eee0a2be4fb860224d9018d7fe7c487b0c54377b3c320eff5f8fd78018612e84cfb1d78bf670cda5735d3d68325bd9264ddf7178ad38b08e7627

Download Submit
\Windows\SysWOW64\hfnapi.dll
Filesize
106KB

MD5
f24b8a4a7528def8ea6fa9acdbef086b

SHA1
921e8875a389f80053d3018dca8317499f941202

SHA256
aa80ebf9e06994cfe44cf182d307d20cd9c0fa861772ef96d82cee1c318c60e7

SHA512
05bbfb8e1864eee0a2be4fb860224d9018d7fe7c487b0c54377b3c320eff5f8fd78018612e84cfb1d78bf670cda5735d3d68325bd9264ddf7178ad38b08e7627

Download Submit
\Windows\SysWOW64\hfnapi.dll
Filesize
106KB

MD5
f24b8a4a7528def8ea6fa9acdbef086b

SHA1
921e8875a389f80053d3018dca8317499f941202

SHA256
aa80ebf9e06994cfe44cf182d307d20cd9c0fa861772ef96d82cee1c318c60e7

SHA512
05bbfb8e1864eee0a2be4fb860224d9018d7fe7c487b0c54377b3c320eff5f8fd78018612e84cfb1d78bf670cda5735d3d68325bd9264ddf7178ad38b08e7627

Download Submit
\Windows\SysWOW64\hfpapi.dll
Filesize
244KB

MD5
725980024b6c88c36527d412d93d7005

SHA1
083b50d40a23a21ca408cfb3bb634807b7c24a68

SHA256
82740fbf47574f7b4fa22214d79e268083e7ff9268fd7198ca595fbcac8ab464

SHA512
fb1974c07a9067dedd8caeb4ad0c78d0799e752eb0317abc2394693e454d29f03738a08bda428632ee812ab69bbe8ee63653819614df0185be25f380c198febb

Download Submit
\Windows\SysWOW64\hfpapi.dll
Filesize
244KB

MD5
725980024b6c88c36527d412d93d7005

SHA1
083b50d40a23a21ca408cfb3bb634807b7c24a68

SHA256
82740fbf47574f7b4fa22214d79e268083e7ff9268fd7198ca595fbcac8ab464

SHA512
fb1974c07a9067dedd8caeb4ad0c78d0799e752eb0317abc2394693e454d29f03738a08bda428632ee812ab69bbe8ee63653819614df0185be25f380c198febb

Download Submit
\Windows\SysWOW64\installd.exe
Filesize
108KB

MD5
c2e14fcdde0c8b83392f9ca4be76f8b2

SHA1
02cc471f91a396cb9358e07832d61143cc6fc3fe

SHA256
f1a813c3a05a7d195302c876729188046a0daee20d78386edcc4a1b1fdc34435

SHA512
84d7de010b2547834559ee56452fa839dfd5d6a8705db9961c57760bc20bfc8b60231659cf36961c6875adecbc090a31c77b8e33c051adb624dcbbc22d21eea6

Download Submit
\Windows\SysWOW64\nethtsrv.exe
Filesize
176KB

MD5
d72868c942b541c3ef7b2419260ccf09

SHA1
a62795490b0802fe5166cec20cc915c2629edba4

SHA256
68cb72d3625ac4339013eb6cc79264d7914db90d87c2c701392ba6d1d23621b7

SHA512
60a724878d5d07abda8596dd02add204f7789be3fed62a02b1c8856358482988124b6d467494fcf82eae96c12ac8ca6dc923d930899e853cd156cfcb9f7ac12f

Download Submit
\Windows\SysWOW64\netupdsrv.exe
Filesize
158KB

MD5
a7faa299bc6270cef12c6e7ba8a6364f

SHA1
460822ace5152ccd19543006eb2868aa6b5491c3

SHA256
10919223300f48b55585e99a341d5d2dde8b64454aaa21c58ba7b491127d19a9

SHA512
8510bf3ea822f2a6bf322f40df0dc3443b039040c203123372cfdc08a5972f9d570f75211b16b04c437823e3a81e0d1a4009d16481ce1d4e49a8f3b70c3eded0

Download Submit
memory/332-61-0x0000000000000000-mapping.dmp

Download
memory/572-70-0x0000000000000000-mapping.dmp

Download
memory/688-87-0x0000000000000000-mapping.dmp

Download
memory/1160-86-0x0000000000000000-mapping.dmp

Download
memory/1228-90-0x0000000000360000-0x00000000007BE000-memory.dmp

Filesize
4.4MB

Download
memory/1228-54-0x0000000075A11000-0x0000000075A13000-memory.dmp

Filesize
8KB

Download
memory/1228-58-0x0000000000360000-0x00000000007BE000-memory.dmp

Filesize
4.4MB

Download
memory/1332-59-0x0000000000000000-mapping.dmp

Download
memory/1428-57-0x0000000000000000-mapping.dmp

Download
memory/1776-62-0x0000000000000000-mapping.dmp

Download
memory/1816-76-0x0000000000000000-mapping.dmp

Download
memory/1888-81-0x0000000000000000-mapping.dmp

Download
memory/1988-80-0x0000000000000000-mapping.dmp

Download
memory/2036-64-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads