07970a16b5b821cbae9a0c9926be6796ba999456c3df78d36f3ec351932b68b9

Analysis

max time kernel
45s
max time network
50s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
23-11-2022 10:34

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

07970a16b5b821cbae9a0c9926be6796ba999456c3df78d36f3ec351932b68b9.exe
Size

603KB
MD5

deaccc06978e57e52b0796a10c4336e3
SHA1

1c4261163af0ac76610f4987efc3ed27076e0ede
SHA256

07970a16b5b821cbae9a0c9926be6796ba999456c3df78d36f3ec351932b68b9
SHA512

c60959fbc088242db2d00cbd7e2f673ec3448ed1a4b130104edcd74d10ce7a0f07aeae18e460d656df704f2f27ffc6363a3e69cf7655fd42a73e08c913dcc8ce
SSDEEP

12288:bIny5DYT9eHsZ/2UF+kjNiVEKZ5PAsUafBFo06Woqfa4EEkz7T:jUT9zuUs+9KZVA216Woqy4EtT

Score

8^/10

discovery

Malware Config

Signatures

Drops file in Drivers directory 1 IoCs

Processes:

07970a16b5b821cbae9a0c9926be6796ba999456c3df78d36f3ec351932b68b9.exe

description ioc process

File created C:\Windows\system32\drivers\nethfdrv.sys 07970a16b5b821cbae9a0c9926be6796ba999456c3df78d36f3ec351932b68b9.exe
Executes dropped EXE 5 IoCs

Processes:

installd.exenethtsrv.exenetupdsrv.exenethtsrv.exenetupdsrv.exe

pid process

688 installd.exe
1744 nethtsrv.exe
1156 netupdsrv.exe
1876 nethtsrv.exe
1684 netupdsrv.exe

description	ioc	process
File created	C:\Windows\system32\drivers\nethfdrv.sys	07970a16b5b821cbae9a0c9926be6796ba999456c3df78d36f3ec351932b68b9.exe

pid	process
688	installd.exe
1744	nethtsrv.exe
1156	netupdsrv.exe
1876	nethtsrv.exe
1684	netupdsrv.exe

Loads dropped DLL 13 IoCs

Processes:

07970a16b5b821cbae9a0c9926be6796ba999456c3df78d36f3ec351932b68b9.exeinstalld.exenethtsrv.exenethtsrv.exe

pid	process
1368	07970a16b5b821cbae9a0c9926be6796ba999456c3df78d36f3ec351932b68b9.exe
1368	07970a16b5b821cbae9a0c9926be6796ba999456c3df78d36f3ec351932b68b9.exe
1368	07970a16b5b821cbae9a0c9926be6796ba999456c3df78d36f3ec351932b68b9.exe
1368	07970a16b5b821cbae9a0c9926be6796ba999456c3df78d36f3ec351932b68b9.exe
688	installd.exe
1368	07970a16b5b821cbae9a0c9926be6796ba999456c3df78d36f3ec351932b68b9.exe
1744	nethtsrv.exe
1744	nethtsrv.exe
1368	07970a16b5b821cbae9a0c9926be6796ba999456c3df78d36f3ec351932b68b9.exe
1368	07970a16b5b821cbae9a0c9926be6796ba999456c3df78d36f3ec351932b68b9.exe
1876	nethtsrv.exe
1876	nethtsrv.exe
1368	07970a16b5b821cbae9a0c9926be6796ba999456c3df78d36f3ec351932b68b9.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in System32 directory 5 IoCs

Processes:

07970a16b5b821cbae9a0c9926be6796ba999456c3df78d36f3ec351932b68b9.exe

description	ioc	process
File created	C:\Windows\SysWOW64\hfnapi.dll	07970a16b5b821cbae9a0c9926be6796ba999456c3df78d36f3ec351932b68b9.exe
File created	C:\Windows\SysWOW64\hfpapi.dll	07970a16b5b821cbae9a0c9926be6796ba999456c3df78d36f3ec351932b68b9.exe
File created	C:\Windows\SysWOW64\installd.exe	07970a16b5b821cbae9a0c9926be6796ba999456c3df78d36f3ec351932b68b9.exe
File created	C:\Windows\SysWOW64\nethtsrv.exe	07970a16b5b821cbae9a0c9926be6796ba999456c3df78d36f3ec351932b68b9.exe
File created	C:\Windows\SysWOW64\netupdsrv.exe	07970a16b5b821cbae9a0c9926be6796ba999456c3df78d36f3ec351932b68b9.exe

Drops file in Program Files directory 3 IoCs

Processes:

07970a16b5b821cbae9a0c9926be6796ba999456c3df78d36f3ec351932b68b9.exe

description	ioc	process
File created	C:\Program Files (x86)\Common Files\Config\data.xml	07970a16b5b821cbae9a0c9926be6796ba999456c3df78d36f3ec351932b68b9.exe
File created	C:\Program Files (x86)\Common Files\Config\ver.xml	07970a16b5b821cbae9a0c9926be6796ba999456c3df78d36f3ec351932b68b9.exe
File created	C:\Program Files (x86)\Common Files\config\uninstinethnfd.exe	07970a16b5b821cbae9a0c9926be6796ba999456c3df78d36f3ec351932b68b9.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Runs net.exe
Suspicious behavior: LoadsDriver 1 IoCs

Processes:

pid process

468
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

nethtsrv.exe

description pid process

Token: SeDebugPrivilege 1876 nethtsrv.exe

pid	process
468

description	pid	process
Token: SeDebugPrivilege	1876	nethtsrv.exe

Suspicious use of WriteProcessMemory 50 IoCs

Processes:

07970a16b5b821cbae9a0c9926be6796ba999456c3df78d36f3ec351932b68b9.exenet.exenet.exenet.exenet.exe

description	pid	process	target process
PID 1368 wrote to memory of 984	1368	07970a16b5b821cbae9a0c9926be6796ba999456c3df78d36f3ec351932b68b9.exe	net.exe
PID 1368 wrote to memory of 984	1368	07970a16b5b821cbae9a0c9926be6796ba999456c3df78d36f3ec351932b68b9.exe	net.exe
PID 1368 wrote to memory of 984	1368	07970a16b5b821cbae9a0c9926be6796ba999456c3df78d36f3ec351932b68b9.exe	net.exe
PID 1368 wrote to memory of 984	1368	07970a16b5b821cbae9a0c9926be6796ba999456c3df78d36f3ec351932b68b9.exe	net.exe
PID 984 wrote to memory of 1644	984	net.exe	net1.exe
PID 984 wrote to memory of 1644	984	net.exe	net1.exe
PID 984 wrote to memory of 1644	984	net.exe	net1.exe
PID 984 wrote to memory of 1644	984	net.exe	net1.exe
PID 1368 wrote to memory of 392	1368	07970a16b5b821cbae9a0c9926be6796ba999456c3df78d36f3ec351932b68b9.exe	net.exe
PID 1368 wrote to memory of 392	1368	07970a16b5b821cbae9a0c9926be6796ba999456c3df78d36f3ec351932b68b9.exe	net.exe
PID 1368 wrote to memory of 392	1368	07970a16b5b821cbae9a0c9926be6796ba999456c3df78d36f3ec351932b68b9.exe	net.exe
PID 1368 wrote to memory of 392	1368	07970a16b5b821cbae9a0c9926be6796ba999456c3df78d36f3ec351932b68b9.exe	net.exe
PID 392 wrote to memory of 664	392	net.exe	net1.exe
PID 392 wrote to memory of 664	392	net.exe	net1.exe
PID 392 wrote to memory of 664	392	net.exe	net1.exe
PID 392 wrote to memory of 664	392	net.exe	net1.exe
PID 1368 wrote to memory of 688	1368	07970a16b5b821cbae9a0c9926be6796ba999456c3df78d36f3ec351932b68b9.exe	installd.exe
PID 1368 wrote to memory of 688	1368	07970a16b5b821cbae9a0c9926be6796ba999456c3df78d36f3ec351932b68b9.exe	installd.exe
PID 1368 wrote to memory of 688	1368	07970a16b5b821cbae9a0c9926be6796ba999456c3df78d36f3ec351932b68b9.exe	installd.exe
PID 1368 wrote to memory of 688	1368	07970a16b5b821cbae9a0c9926be6796ba999456c3df78d36f3ec351932b68b9.exe	installd.exe
PID 1368 wrote to memory of 688	1368	07970a16b5b821cbae9a0c9926be6796ba999456c3df78d36f3ec351932b68b9.exe	installd.exe
PID 1368 wrote to memory of 688	1368	07970a16b5b821cbae9a0c9926be6796ba999456c3df78d36f3ec351932b68b9.exe	installd.exe
PID 1368 wrote to memory of 688	1368	07970a16b5b821cbae9a0c9926be6796ba999456c3df78d36f3ec351932b68b9.exe	installd.exe
PID 1368 wrote to memory of 1744	1368	07970a16b5b821cbae9a0c9926be6796ba999456c3df78d36f3ec351932b68b9.exe	nethtsrv.exe
PID 1368 wrote to memory of 1744	1368	07970a16b5b821cbae9a0c9926be6796ba999456c3df78d36f3ec351932b68b9.exe	nethtsrv.exe
PID 1368 wrote to memory of 1744	1368	07970a16b5b821cbae9a0c9926be6796ba999456c3df78d36f3ec351932b68b9.exe	nethtsrv.exe
PID 1368 wrote to memory of 1744	1368	07970a16b5b821cbae9a0c9926be6796ba999456c3df78d36f3ec351932b68b9.exe	nethtsrv.exe
PID 1368 wrote to memory of 1156	1368	07970a16b5b821cbae9a0c9926be6796ba999456c3df78d36f3ec351932b68b9.exe	netupdsrv.exe
PID 1368 wrote to memory of 1156	1368	07970a16b5b821cbae9a0c9926be6796ba999456c3df78d36f3ec351932b68b9.exe	netupdsrv.exe
PID 1368 wrote to memory of 1156	1368	07970a16b5b821cbae9a0c9926be6796ba999456c3df78d36f3ec351932b68b9.exe	netupdsrv.exe
PID 1368 wrote to memory of 1156	1368	07970a16b5b821cbae9a0c9926be6796ba999456c3df78d36f3ec351932b68b9.exe	netupdsrv.exe
PID 1368 wrote to memory of 1156	1368	07970a16b5b821cbae9a0c9926be6796ba999456c3df78d36f3ec351932b68b9.exe	netupdsrv.exe
PID 1368 wrote to memory of 1156	1368	07970a16b5b821cbae9a0c9926be6796ba999456c3df78d36f3ec351932b68b9.exe	netupdsrv.exe
PID 1368 wrote to memory of 1156	1368	07970a16b5b821cbae9a0c9926be6796ba999456c3df78d36f3ec351932b68b9.exe	netupdsrv.exe
PID 1368 wrote to memory of 1944	1368	07970a16b5b821cbae9a0c9926be6796ba999456c3df78d36f3ec351932b68b9.exe	net.exe
PID 1368 wrote to memory of 1944	1368	07970a16b5b821cbae9a0c9926be6796ba999456c3df78d36f3ec351932b68b9.exe	net.exe
PID 1368 wrote to memory of 1944	1368	07970a16b5b821cbae9a0c9926be6796ba999456c3df78d36f3ec351932b68b9.exe	net.exe
PID 1368 wrote to memory of 1944	1368	07970a16b5b821cbae9a0c9926be6796ba999456c3df78d36f3ec351932b68b9.exe	net.exe
PID 1944 wrote to memory of 1476	1944	net.exe	net1.exe
PID 1944 wrote to memory of 1476	1944	net.exe	net1.exe
PID 1944 wrote to memory of 1476	1944	net.exe	net1.exe
PID 1944 wrote to memory of 1476	1944	net.exe	net1.exe
PID 1368 wrote to memory of 1824	1368	07970a16b5b821cbae9a0c9926be6796ba999456c3df78d36f3ec351932b68b9.exe	net.exe
PID 1368 wrote to memory of 1824	1368	07970a16b5b821cbae9a0c9926be6796ba999456c3df78d36f3ec351932b68b9.exe	net.exe
PID 1368 wrote to memory of 1824	1368	07970a16b5b821cbae9a0c9926be6796ba999456c3df78d36f3ec351932b68b9.exe	net.exe
PID 1368 wrote to memory of 1824	1368	07970a16b5b821cbae9a0c9926be6796ba999456c3df78d36f3ec351932b68b9.exe	net.exe
PID 1824 wrote to memory of 952	1824	net.exe	net1.exe
PID 1824 wrote to memory of 952	1824	net.exe	net1.exe
PID 1824 wrote to memory of 952	1824	net.exe	net1.exe
PID 1824 wrote to memory of 952	1824	net.exe	net1.exe

C:\Users\Admin\AppData\Local\Temp\07970a16b5b821cbae9a0c9926be6796ba999456c3df78d36f3ec351932b68b9.exe
"C:\Users\Admin\AppData\Local\Temp\07970a16b5b821cbae9a0c9926be6796ba999456c3df78d36f3ec351932b68b9.exe"
1⤵
- Drops file in Drivers directory
- Loads dropped DLL
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:1368

C:\Windows\SysWOW64\net.exe
net stop nethttpservice
2⤵
- Suspicious use of WriteProcessMemory
PID:984

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop nethttpservice
3⤵
PID:1644

C:\Windows\SysWOW64\net.exe
net stop serviceupdater
2⤵
- Suspicious use of WriteProcessMemory
PID:392

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop serviceupdater
3⤵
PID:664

C:\Windows\SysWOW64\installd.exe
"C:\Windows\system32\installd.exe" nethfdrv
2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:688

C:\Windows\SysWOW64\nethtsrv.exe
"C:\Windows\system32\nethtsrv.exe" -nfdi
2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1744

C:\Windows\SysWOW64\netupdsrv.exe
"C:\Windows\system32\netupdsrv.exe" -nfdi
2⤵
- Executes dropped EXE
PID:1156

C:\Windows\SysWOW64\net.exe
net start nethttpservice
2⤵
- Suspicious use of WriteProcessMemory
PID:1944

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 start nethttpservice
3⤵
PID:1476

C:\Windows\SysWOW64\net.exe
net start serviceupdater
2⤵
- Suspicious use of WriteProcessMemory
PID:1824

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 start serviceupdater
3⤵
PID:952

C:\Windows\SysWOW64\nethtsrv.exe
C:\Windows\SysWOW64\nethtsrv.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:1876

C:\Windows\SysWOW64\netupdsrv.exe
C:\Windows\SysWOW64\netupdsrv.exe
1⤵
- Executes dropped EXE
PID:1684

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\hfnapi.dll
Filesize
106KB

MD5
0b506a3278954495da07e2d205c15315

SHA1
6bfbf424c1e393a32d314c8ba69cee61b0b9a41c

SHA256
90de4ff56f3f3529b807d567e07bbaa05b1cbcdba18844748c18d3bf3e98639e

SHA512
1f85897d3287a5ab88bfb0def41df6feb36fb04aae46d3740ecffb29a95c5c39e192430fd616aaf5758c1ddc9b65197d3be054e1e08bd2ff2006a12cc4352359

Download Submit
C:\Windows\SysWOW64\hfpapi.dll
Filesize
241KB

MD5
7ca1600c2ab2d0f789ed0767f51ad069

SHA1
f9596a115d8739a1e1768f8e643284322f0a14a3

SHA256
02c3d260d13199c5bcb57dd9c1f9635f648074ecffb0d24f16843680de551d0e

SHA512
c4e5a1344539da91d03eaa6419cef5197311ecf4d4ed8fc93320063de40624ec73b88cfa6b4143992e7ed29e91481696df4f19314f432593793020ac1c5999b0

Download Submit
C:\Windows\SysWOW64\installd.exe
Filesize
108KB

MD5
7b4b654e4e9c4550a7ab72679db2f5a0

SHA1
45631f0c35384910fab1ecd165ebe22856773369

SHA256
7a3317461c2418d050e7b48f00f9829376de20e44576aa7353e8dc66280729df

SHA512
642c961fc88d7e83b2900e714162179e01a5d4529939b490d2efdf53ccd680f1939900253e0f2d6e627c8cb7d208627e53d9bc844ed7ef6f8346ce6337c8d4ba

Download Submit
C:\Windows\SysWOW64\nethtsrv.exe
Filesize
177KB

MD5
ba69d838c7fd93c4d27f187d45f14198

SHA1
88b71d8c41760398aca1309e0bcd34dd53db3b48

SHA256
b1f6f7ef01b0c235fcb3f4f309f8275dad10e62ea5e04f423f814858b4229463

SHA512
9f2ca6a35bdc91f3db94712e2ef32c743090cf573c3c83c0f24c09a5e9a172ee382b04db9dce3c9679d4b2ea268eb90ab42470ba787ba5be691828b4b892f5c9

Download Submit
C:\Windows\SysWOW64\nethtsrv.exe
Filesize
177KB

MD5
ba69d838c7fd93c4d27f187d45f14198

SHA1
88b71d8c41760398aca1309e0bcd34dd53db3b48

SHA256
b1f6f7ef01b0c235fcb3f4f309f8275dad10e62ea5e04f423f814858b4229463

SHA512
9f2ca6a35bdc91f3db94712e2ef32c743090cf573c3c83c0f24c09a5e9a172ee382b04db9dce3c9679d4b2ea268eb90ab42470ba787ba5be691828b4b892f5c9

Download Submit
C:\Windows\SysWOW64\netupdsrv.exe
Filesize
159KB

MD5
6ce5fac68adaa0775ec2050f2ba969dd

SHA1
81692cc9f185c61ae055c1d2da95e721af274093

SHA256
3389167cb8aee82bfd62e0ba46f6be1379b1702e7053af64bd70b9cd8107e57e

SHA512
6da87b2df93f4159b9585ca27dbf9c42d34e4f4a8e658db5719931bf3ef15dfb0052739570b827bf51895052a37aaf53af84df494c9de3166573e2faf708834b

Download Submit
C:\Windows\SysWOW64\netupdsrv.exe
Filesize
159KB

MD5
6ce5fac68adaa0775ec2050f2ba969dd

SHA1
81692cc9f185c61ae055c1d2da95e721af274093

SHA256
3389167cb8aee82bfd62e0ba46f6be1379b1702e7053af64bd70b9cd8107e57e

SHA512
6da87b2df93f4159b9585ca27dbf9c42d34e4f4a8e658db5719931bf3ef15dfb0052739570b827bf51895052a37aaf53af84df494c9de3166573e2faf708834b

Download Submit
\Users\Admin\AppData\Local\Temp\nsy2D0C.tmp\System.dll
Filesize
11KB

MD5
c17103ae9072a06da581dec998343fc1

SHA1
b72148c6bdfaada8b8c3f950e610ee7cf1da1f8d

SHA256
dc58d8ad81cacb0c1ed72e33bff8f23ea40b5252b5bb55d393a0903e6819ae2f

SHA512
d32a71aaef18e993f28096d536e41c4d016850721b31171513ce28bbd805a54fd290b7c3e9d935f72e676a1acfb4f0dcc89d95040a0dd29f2b6975855c18986f

Download Submit
\Users\Admin\AppData\Local\Temp\nsy2D0C.tmp\nsExec.dll
Filesize
6KB

MD5
acc2b699edfea5bf5aae45aba3a41e96

SHA1
d2accf4d494e43ceb2cff69abe4dd17147d29cc2

SHA256
168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e

SHA512
e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe

Download Submit
\Users\Admin\AppData\Local\Temp\nsy2D0C.tmp\nsExec.dll
Filesize
6KB

MD5
acc2b699edfea5bf5aae45aba3a41e96

SHA1
d2accf4d494e43ceb2cff69abe4dd17147d29cc2

SHA256
168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e

SHA512
e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe

Download Submit
\Users\Admin\AppData\Local\Temp\nsy2D0C.tmp\nsExec.dll
Filesize
6KB

MD5
acc2b699edfea5bf5aae45aba3a41e96

SHA1
d2accf4d494e43ceb2cff69abe4dd17147d29cc2

SHA256
168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e

SHA512
e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe

Download Submit
\Users\Admin\AppData\Local\Temp\nsy2D0C.tmp\nsExec.dll
Filesize
6KB

MD5
acc2b699edfea5bf5aae45aba3a41e96

SHA1
d2accf4d494e43ceb2cff69abe4dd17147d29cc2

SHA256
168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e

SHA512
e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe

Download Submit
\Windows\SysWOW64\hfnapi.dll
Filesize
106KB

MD5
0b506a3278954495da07e2d205c15315

SHA1
6bfbf424c1e393a32d314c8ba69cee61b0b9a41c

SHA256
90de4ff56f3f3529b807d567e07bbaa05b1cbcdba18844748c18d3bf3e98639e

SHA512
1f85897d3287a5ab88bfb0def41df6feb36fb04aae46d3740ecffb29a95c5c39e192430fd616aaf5758c1ddc9b65197d3be054e1e08bd2ff2006a12cc4352359

Download Submit
\Windows\SysWOW64\hfnapi.dll
Filesize
106KB

MD5
0b506a3278954495da07e2d205c15315

SHA1
6bfbf424c1e393a32d314c8ba69cee61b0b9a41c

SHA256
90de4ff56f3f3529b807d567e07bbaa05b1cbcdba18844748c18d3bf3e98639e

SHA512
1f85897d3287a5ab88bfb0def41df6feb36fb04aae46d3740ecffb29a95c5c39e192430fd616aaf5758c1ddc9b65197d3be054e1e08bd2ff2006a12cc4352359

Download Submit
\Windows\SysWOW64\hfnapi.dll
Filesize
106KB

MD5
0b506a3278954495da07e2d205c15315

SHA1
6bfbf424c1e393a32d314c8ba69cee61b0b9a41c

SHA256
90de4ff56f3f3529b807d567e07bbaa05b1cbcdba18844748c18d3bf3e98639e

SHA512
1f85897d3287a5ab88bfb0def41df6feb36fb04aae46d3740ecffb29a95c5c39e192430fd616aaf5758c1ddc9b65197d3be054e1e08bd2ff2006a12cc4352359

Download Submit
\Windows\SysWOW64\hfpapi.dll
Filesize
241KB

MD5
7ca1600c2ab2d0f789ed0767f51ad069

SHA1
f9596a115d8739a1e1768f8e643284322f0a14a3

SHA256
02c3d260d13199c5bcb57dd9c1f9635f648074ecffb0d24f16843680de551d0e

SHA512
c4e5a1344539da91d03eaa6419cef5197311ecf4d4ed8fc93320063de40624ec73b88cfa6b4143992e7ed29e91481696df4f19314f432593793020ac1c5999b0

Download Submit
\Windows\SysWOW64\hfpapi.dll
Filesize
241KB

MD5
7ca1600c2ab2d0f789ed0767f51ad069

SHA1
f9596a115d8739a1e1768f8e643284322f0a14a3

SHA256
02c3d260d13199c5bcb57dd9c1f9635f648074ecffb0d24f16843680de551d0e

SHA512
c4e5a1344539da91d03eaa6419cef5197311ecf4d4ed8fc93320063de40624ec73b88cfa6b4143992e7ed29e91481696df4f19314f432593793020ac1c5999b0

Download Submit
\Windows\SysWOW64\installd.exe
Filesize
108KB

MD5
7b4b654e4e9c4550a7ab72679db2f5a0

SHA1
45631f0c35384910fab1ecd165ebe22856773369

SHA256
7a3317461c2418d050e7b48f00f9829376de20e44576aa7353e8dc66280729df

SHA512
642c961fc88d7e83b2900e714162179e01a5d4529939b490d2efdf53ccd680f1939900253e0f2d6e627c8cb7d208627e53d9bc844ed7ef6f8346ce6337c8d4ba

Download Submit
\Windows\SysWOW64\nethtsrv.exe
Filesize
177KB

MD5
ba69d838c7fd93c4d27f187d45f14198

SHA1
88b71d8c41760398aca1309e0bcd34dd53db3b48

SHA256
b1f6f7ef01b0c235fcb3f4f309f8275dad10e62ea5e04f423f814858b4229463

SHA512
9f2ca6a35bdc91f3db94712e2ef32c743090cf573c3c83c0f24c09a5e9a172ee382b04db9dce3c9679d4b2ea268eb90ab42470ba787ba5be691828b4b892f5c9

Download Submit
\Windows\SysWOW64\netupdsrv.exe
Filesize
159KB

MD5
6ce5fac68adaa0775ec2050f2ba969dd

SHA1
81692cc9f185c61ae055c1d2da95e721af274093

SHA256
3389167cb8aee82bfd62e0ba46f6be1379b1702e7053af64bd70b9cd8107e57e

SHA512
6da87b2df93f4159b9585ca27dbf9c42d34e4f4a8e658db5719931bf3ef15dfb0052739570b827bf51895052a37aaf53af84df494c9de3166573e2faf708834b

Download Submit
memory/392-61-0x0000000000000000-mapping.dmp

Download
memory/664-62-0x0000000000000000-mapping.dmp

Download
memory/688-64-0x0000000000000000-mapping.dmp

Download
memory/952-87-0x0000000000000000-mapping.dmp

Download
memory/984-57-0x0000000000000000-mapping.dmp

Download
memory/1156-76-0x0000000000000000-mapping.dmp

Download
memory/1368-54-0x0000000074E41000-0x0000000074E43000-memory.dmp

Filesize
8KB

Download
memory/1368-59-0x0000000000360000-0x00000000007BE000-memory.dmp

Filesize
4.4MB

Download
memory/1368-90-0x0000000000360000-0x00000000007BE000-memory.dmp

Filesize
4.4MB

Download
memory/1476-81-0x0000000000000000-mapping.dmp

Download
memory/1644-58-0x0000000000000000-mapping.dmp

Download
memory/1744-70-0x0000000000000000-mapping.dmp

Download
memory/1824-86-0x0000000000000000-mapping.dmp

Download
memory/1944-80-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads