f5d8235262512aab3a8e056b0cb8ed730fe4a0038b7e1d28b7758678b70f41c0

Analysis

max time kernel
57s
max time network
33s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
23-11-2022 10:49

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

f5d8235262512aab3a8e056b0cb8ed730fe4a0038b7e1d28b7758678b70f41c0.exe
Size

446KB
MD5

b249846b3f6be697212159ef705f210f
SHA1

1aac8e89c5fee77bac5c8f7f13bb6eb370b67ef7
SHA256

f5d8235262512aab3a8e056b0cb8ed730fe4a0038b7e1d28b7758678b70f41c0
SHA512

20ab0d7d84c8aee193d1030772c57661019bcda1c880e803d1778676a1d9f5bb0a0eb956e5a634e6b628503123a8e1ae2c9bb9549d73d5d6f91e45d0ac7f68b9
SSDEEP

12288:kqgZQPDo+yI4O5ErUcGsaoOPepq3F1vspjCwelO:ka7oDQc/adPepqfvsp2JO

Score

8^/10

discovery

Malware Config

Signatures

Drops file in Drivers directory 1 IoCs

Processes:

f5d8235262512aab3a8e056b0cb8ed730fe4a0038b7e1d28b7758678b70f41c0.exe

description ioc process

File created C:\Windows\system32\drivers\nethfdrv.sys f5d8235262512aab3a8e056b0cb8ed730fe4a0038b7e1d28b7758678b70f41c0.exe
Executes dropped EXE 5 IoCs

Processes:

installd.exenethtsrv.exenetupdsrv.exenethtsrv.exenetupdsrv.exe

pid process

1780 installd.exe
1616 nethtsrv.exe
1380 netupdsrv.exe
1864 nethtsrv.exe
952 netupdsrv.exe

description	ioc	process
File created	C:\Windows\system32\drivers\nethfdrv.sys	f5d8235262512aab3a8e056b0cb8ed730fe4a0038b7e1d28b7758678b70f41c0.exe

pid	process
1780	installd.exe
1616	nethtsrv.exe
1380	netupdsrv.exe
1864	nethtsrv.exe
952	netupdsrv.exe

Loads dropped DLL 13 IoCs

Processes:

f5d8235262512aab3a8e056b0cb8ed730fe4a0038b7e1d28b7758678b70f41c0.exeinstalld.exenethtsrv.exenethtsrv.exe

pid	process
1648	f5d8235262512aab3a8e056b0cb8ed730fe4a0038b7e1d28b7758678b70f41c0.exe
1648	f5d8235262512aab3a8e056b0cb8ed730fe4a0038b7e1d28b7758678b70f41c0.exe
1648	f5d8235262512aab3a8e056b0cb8ed730fe4a0038b7e1d28b7758678b70f41c0.exe
1648	f5d8235262512aab3a8e056b0cb8ed730fe4a0038b7e1d28b7758678b70f41c0.exe
1780	installd.exe
1648	f5d8235262512aab3a8e056b0cb8ed730fe4a0038b7e1d28b7758678b70f41c0.exe
1616	nethtsrv.exe
1616	nethtsrv.exe
1648	f5d8235262512aab3a8e056b0cb8ed730fe4a0038b7e1d28b7758678b70f41c0.exe
1648	f5d8235262512aab3a8e056b0cb8ed730fe4a0038b7e1d28b7758678b70f41c0.exe
1864	nethtsrv.exe
1864	nethtsrv.exe
1648	f5d8235262512aab3a8e056b0cb8ed730fe4a0038b7e1d28b7758678b70f41c0.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in System32 directory 5 IoCs

Processes:

f5d8235262512aab3a8e056b0cb8ed730fe4a0038b7e1d28b7758678b70f41c0.exe

description	ioc	process
File created	C:\Windows\SysWOW64\hfnapi.dll	f5d8235262512aab3a8e056b0cb8ed730fe4a0038b7e1d28b7758678b70f41c0.exe
File created	C:\Windows\SysWOW64\hfpapi.dll	f5d8235262512aab3a8e056b0cb8ed730fe4a0038b7e1d28b7758678b70f41c0.exe
File created	C:\Windows\SysWOW64\installd.exe	f5d8235262512aab3a8e056b0cb8ed730fe4a0038b7e1d28b7758678b70f41c0.exe
File created	C:\Windows\SysWOW64\nethtsrv.exe	f5d8235262512aab3a8e056b0cb8ed730fe4a0038b7e1d28b7758678b70f41c0.exe
File created	C:\Windows\SysWOW64\netupdsrv.exe	f5d8235262512aab3a8e056b0cb8ed730fe4a0038b7e1d28b7758678b70f41c0.exe

Drops file in Program Files directory 3 IoCs

Processes:

f5d8235262512aab3a8e056b0cb8ed730fe4a0038b7e1d28b7758678b70f41c0.exe

description	ioc	process
File created	C:\Program Files (x86)\Common Files\Config\data.xml	f5d8235262512aab3a8e056b0cb8ed730fe4a0038b7e1d28b7758678b70f41c0.exe
File created	C:\Program Files (x86)\Common Files\Config\ver.xml	f5d8235262512aab3a8e056b0cb8ed730fe4a0038b7e1d28b7758678b70f41c0.exe
File created	C:\Program Files (x86)\Common Files\config\uninstinethnfd.exe	f5d8235262512aab3a8e056b0cb8ed730fe4a0038b7e1d28b7758678b70f41c0.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Runs net.exe
Suspicious behavior: LoadsDriver 1 IoCs

Processes:

pid process

460
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

nethtsrv.exe

description pid process

Token: SeDebugPrivilege 1864 nethtsrv.exe

pid	process
460

description	pid	process
Token: SeDebugPrivilege	1864	nethtsrv.exe

Suspicious use of WriteProcessMemory 50 IoCs

Processes:

f5d8235262512aab3a8e056b0cb8ed730fe4a0038b7e1d28b7758678b70f41c0.exenet.exenet.exenet.exenet.exe

description	pid	process	target process
PID 1648 wrote to memory of 1156	1648	f5d8235262512aab3a8e056b0cb8ed730fe4a0038b7e1d28b7758678b70f41c0.exe	net.exe
PID 1648 wrote to memory of 1156	1648	f5d8235262512aab3a8e056b0cb8ed730fe4a0038b7e1d28b7758678b70f41c0.exe	net.exe
PID 1648 wrote to memory of 1156	1648	f5d8235262512aab3a8e056b0cb8ed730fe4a0038b7e1d28b7758678b70f41c0.exe	net.exe
PID 1648 wrote to memory of 1156	1648	f5d8235262512aab3a8e056b0cb8ed730fe4a0038b7e1d28b7758678b70f41c0.exe	net.exe
PID 1156 wrote to memory of 1732	1156	net.exe	net1.exe
PID 1156 wrote to memory of 1732	1156	net.exe	net1.exe
PID 1156 wrote to memory of 1732	1156	net.exe	net1.exe
PID 1156 wrote to memory of 1732	1156	net.exe	net1.exe
PID 1648 wrote to memory of 1764	1648	f5d8235262512aab3a8e056b0cb8ed730fe4a0038b7e1d28b7758678b70f41c0.exe	net.exe
PID 1648 wrote to memory of 1764	1648	f5d8235262512aab3a8e056b0cb8ed730fe4a0038b7e1d28b7758678b70f41c0.exe	net.exe
PID 1648 wrote to memory of 1764	1648	f5d8235262512aab3a8e056b0cb8ed730fe4a0038b7e1d28b7758678b70f41c0.exe	net.exe
PID 1648 wrote to memory of 1764	1648	f5d8235262512aab3a8e056b0cb8ed730fe4a0038b7e1d28b7758678b70f41c0.exe	net.exe
PID 1764 wrote to memory of 1048	1764	net.exe	net1.exe
PID 1764 wrote to memory of 1048	1764	net.exe	net1.exe
PID 1764 wrote to memory of 1048	1764	net.exe	net1.exe
PID 1764 wrote to memory of 1048	1764	net.exe	net1.exe
PID 1648 wrote to memory of 1780	1648	f5d8235262512aab3a8e056b0cb8ed730fe4a0038b7e1d28b7758678b70f41c0.exe	installd.exe
PID 1648 wrote to memory of 1780	1648	f5d8235262512aab3a8e056b0cb8ed730fe4a0038b7e1d28b7758678b70f41c0.exe	installd.exe
PID 1648 wrote to memory of 1780	1648	f5d8235262512aab3a8e056b0cb8ed730fe4a0038b7e1d28b7758678b70f41c0.exe	installd.exe
PID 1648 wrote to memory of 1780	1648	f5d8235262512aab3a8e056b0cb8ed730fe4a0038b7e1d28b7758678b70f41c0.exe	installd.exe
PID 1648 wrote to memory of 1780	1648	f5d8235262512aab3a8e056b0cb8ed730fe4a0038b7e1d28b7758678b70f41c0.exe	installd.exe
PID 1648 wrote to memory of 1780	1648	f5d8235262512aab3a8e056b0cb8ed730fe4a0038b7e1d28b7758678b70f41c0.exe	installd.exe
PID 1648 wrote to memory of 1780	1648	f5d8235262512aab3a8e056b0cb8ed730fe4a0038b7e1d28b7758678b70f41c0.exe	installd.exe
PID 1648 wrote to memory of 1616	1648	f5d8235262512aab3a8e056b0cb8ed730fe4a0038b7e1d28b7758678b70f41c0.exe	nethtsrv.exe
PID 1648 wrote to memory of 1616	1648	f5d8235262512aab3a8e056b0cb8ed730fe4a0038b7e1d28b7758678b70f41c0.exe	nethtsrv.exe
PID 1648 wrote to memory of 1616	1648	f5d8235262512aab3a8e056b0cb8ed730fe4a0038b7e1d28b7758678b70f41c0.exe	nethtsrv.exe
PID 1648 wrote to memory of 1616	1648	f5d8235262512aab3a8e056b0cb8ed730fe4a0038b7e1d28b7758678b70f41c0.exe	nethtsrv.exe
PID 1648 wrote to memory of 1380	1648	f5d8235262512aab3a8e056b0cb8ed730fe4a0038b7e1d28b7758678b70f41c0.exe	netupdsrv.exe
PID 1648 wrote to memory of 1380	1648	f5d8235262512aab3a8e056b0cb8ed730fe4a0038b7e1d28b7758678b70f41c0.exe	netupdsrv.exe
PID 1648 wrote to memory of 1380	1648	f5d8235262512aab3a8e056b0cb8ed730fe4a0038b7e1d28b7758678b70f41c0.exe	netupdsrv.exe
PID 1648 wrote to memory of 1380	1648	f5d8235262512aab3a8e056b0cb8ed730fe4a0038b7e1d28b7758678b70f41c0.exe	netupdsrv.exe
PID 1648 wrote to memory of 1380	1648	f5d8235262512aab3a8e056b0cb8ed730fe4a0038b7e1d28b7758678b70f41c0.exe	netupdsrv.exe
PID 1648 wrote to memory of 1380	1648	f5d8235262512aab3a8e056b0cb8ed730fe4a0038b7e1d28b7758678b70f41c0.exe	netupdsrv.exe
PID 1648 wrote to memory of 1380	1648	f5d8235262512aab3a8e056b0cb8ed730fe4a0038b7e1d28b7758678b70f41c0.exe	netupdsrv.exe
PID 1648 wrote to memory of 968	1648	f5d8235262512aab3a8e056b0cb8ed730fe4a0038b7e1d28b7758678b70f41c0.exe	net.exe
PID 1648 wrote to memory of 968	1648	f5d8235262512aab3a8e056b0cb8ed730fe4a0038b7e1d28b7758678b70f41c0.exe	net.exe
PID 1648 wrote to memory of 968	1648	f5d8235262512aab3a8e056b0cb8ed730fe4a0038b7e1d28b7758678b70f41c0.exe	net.exe
PID 1648 wrote to memory of 968	1648	f5d8235262512aab3a8e056b0cb8ed730fe4a0038b7e1d28b7758678b70f41c0.exe	net.exe
PID 968 wrote to memory of 2028	968	net.exe	net1.exe
PID 968 wrote to memory of 2028	968	net.exe	net1.exe
PID 968 wrote to memory of 2028	968	net.exe	net1.exe
PID 968 wrote to memory of 2028	968	net.exe	net1.exe
PID 1648 wrote to memory of 1684	1648	f5d8235262512aab3a8e056b0cb8ed730fe4a0038b7e1d28b7758678b70f41c0.exe	net.exe
PID 1648 wrote to memory of 1684	1648	f5d8235262512aab3a8e056b0cb8ed730fe4a0038b7e1d28b7758678b70f41c0.exe	net.exe
PID 1648 wrote to memory of 1684	1648	f5d8235262512aab3a8e056b0cb8ed730fe4a0038b7e1d28b7758678b70f41c0.exe	net.exe
PID 1648 wrote to memory of 1684	1648	f5d8235262512aab3a8e056b0cb8ed730fe4a0038b7e1d28b7758678b70f41c0.exe	net.exe
PID 1684 wrote to memory of 1840	1684	net.exe	net1.exe
PID 1684 wrote to memory of 1840	1684	net.exe	net1.exe
PID 1684 wrote to memory of 1840	1684	net.exe	net1.exe
PID 1684 wrote to memory of 1840	1684	net.exe	net1.exe

C:\Users\Admin\AppData\Local\Temp\f5d8235262512aab3a8e056b0cb8ed730fe4a0038b7e1d28b7758678b70f41c0.exe
"C:\Users\Admin\AppData\Local\Temp\f5d8235262512aab3a8e056b0cb8ed730fe4a0038b7e1d28b7758678b70f41c0.exe"
1⤵
- Drops file in Drivers directory
- Loads dropped DLL
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:1648

C:\Windows\SysWOW64\net.exe
net stop nethttpservice
2⤵
- Suspicious use of WriteProcessMemory
PID:1156

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop nethttpservice
3⤵
PID:1732

C:\Windows\SysWOW64\net.exe
net stop serviceupdater
2⤵
- Suspicious use of WriteProcessMemory
PID:1764

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop serviceupdater
3⤵
PID:1048

C:\Windows\SysWOW64\installd.exe
"C:\Windows\system32\installd.exe" nethfdrv
2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1780

C:\Windows\SysWOW64\nethtsrv.exe
"C:\Windows\system32\nethtsrv.exe" -nfdi
2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1616

C:\Windows\SysWOW64\netupdsrv.exe
"C:\Windows\system32\netupdsrv.exe" -nfdi
2⤵
- Executes dropped EXE
PID:1380

C:\Windows\SysWOW64\net.exe
net start nethttpservice
2⤵
- Suspicious use of WriteProcessMemory
PID:968

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 start nethttpservice
3⤵
PID:2028

C:\Windows\SysWOW64\net.exe
net start serviceupdater
2⤵
- Suspicious use of WriteProcessMemory
PID:1684

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 start serviceupdater
3⤵
PID:1840

C:\Windows\SysWOW64\nethtsrv.exe
C:\Windows\SysWOW64\nethtsrv.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:1864

C:\Windows\SysWOW64\netupdsrv.exe
C:\Windows\SysWOW64\netupdsrv.exe
1⤵
- Executes dropped EXE
PID:952

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\hfnapi.dll
Filesize
106KB

MD5
e32beadb1c33ce86af2db7fa32fbaff3

SHA1
8ed2182d26e4e33335dacda61db08e4bd8d3a894

SHA256
e5faf83b27aa76422147d2ca46be986243c46659f6e827efe57bcd6e1c7bb500

SHA512
957bc62af59dc293334986e4037a3550279d357fd9199442bf59bd80efbf22f9eb4e73448d08e43928a784ac0b424ea45ff6123507ed05efe607592f2ac253bc

Download Submit
C:\Windows\SysWOW64\hfpapi.dll
Filesize
241KB

MD5
3ea8fec7b85321bdc2ddb0fbd3904847

SHA1
1e3a5c5cf075e0fc2b450475f0e72a9c398602a8

SHA256
f9a364ea3dd4fbcc84072d798429212c0de6e33b2498d018b756dd041fa4ae39

SHA512
6ecc89af5f8cdde8a02c9527bd3499e49176f33ccaa505c34ac84d5ec636594328beada3c9f9a7d4cb49a368915608eb6df10c71936a846cc051052eec39f357

Download Submit
C:\Windows\SysWOW64\installd.exe
Filesize
108KB

MD5
0638ab1996dbab01854683c6c18af131

SHA1
9bdb8e57f388ab8a9392d28de6af15fce6789f68

SHA256
cc36293a67d54aa710d640bd6c3a70d8a2fcf8cb00e84582d042f48fd17a7490

SHA512
ca9a68b11174f17683ccf17c2bf13a4e76e3c53149a0f72c892dacf1a4d1c7b439ebfed822215c300a135c81e2b6a716b7bc0abd48c90dcdc93bb470ba46cedb

Download Submit
C:\Windows\SysWOW64\nethtsrv.exe
Filesize
176KB

MD5
0d3c788600ef224ce05e7f2e67bc58dd

SHA1
c441b12b83db11309068abfc4c98601a1f5d3d5d

SHA256
79fb672c43aa9e886d108639fa81beec4cf95f31bf8ac240c62b09368ed56049

SHA512
2b14aa38220932a0c2db4b0f6179d7f3d6c21f023e1fdd271aca1970dbac6ef973b0f4865de0790a2e084c0dcd343d982299a82c4a9c82ec32ad422ec99e6093

Download Submit
C:\Windows\SysWOW64\nethtsrv.exe
Filesize
176KB

MD5
0d3c788600ef224ce05e7f2e67bc58dd

SHA1
c441b12b83db11309068abfc4c98601a1f5d3d5d

SHA256
79fb672c43aa9e886d108639fa81beec4cf95f31bf8ac240c62b09368ed56049

SHA512
2b14aa38220932a0c2db4b0f6179d7f3d6c21f023e1fdd271aca1970dbac6ef973b0f4865de0790a2e084c0dcd343d982299a82c4a9c82ec32ad422ec99e6093

Download Submit
C:\Windows\SysWOW64\netupdsrv.exe
Filesize
158KB

MD5
98d002d5c5c2fdba1af858e26bc50624

SHA1
ef6d418b874d81b37aa1a81e8ddfe9ea486593a2

SHA256
9ed092177e4df024083e0f45b35f0b3cb0c88d1605d82bc8b62f80a2a38aacd0

SHA512
06bf635436146eb7cb3133e62762573a4ca96d42ff5f253e2773257e86236baaaab97cb5d49f6e67fe0c6037f56520aa812782b4946c37aa9c79492404cb87ae

Download Submit
C:\Windows\SysWOW64\netupdsrv.exe
Filesize
158KB

MD5
98d002d5c5c2fdba1af858e26bc50624

SHA1
ef6d418b874d81b37aa1a81e8ddfe9ea486593a2

SHA256
9ed092177e4df024083e0f45b35f0b3cb0c88d1605d82bc8b62f80a2a38aacd0

SHA512
06bf635436146eb7cb3133e62762573a4ca96d42ff5f253e2773257e86236baaaab97cb5d49f6e67fe0c6037f56520aa812782b4946c37aa9c79492404cb87ae

Download Submit
\Users\Admin\AppData\Local\Temp\nsjB79F.tmp\System.dll
Filesize
11KB

MD5
c17103ae9072a06da581dec998343fc1

SHA1
b72148c6bdfaada8b8c3f950e610ee7cf1da1f8d

SHA256
dc58d8ad81cacb0c1ed72e33bff8f23ea40b5252b5bb55d393a0903e6819ae2f

SHA512
d32a71aaef18e993f28096d536e41c4d016850721b31171513ce28bbd805a54fd290b7c3e9d935f72e676a1acfb4f0dcc89d95040a0dd29f2b6975855c18986f

Download Submit
\Users\Admin\AppData\Local\Temp\nsjB79F.tmp\nsExec.dll
Filesize
6KB

MD5
acc2b699edfea5bf5aae45aba3a41e96

SHA1
d2accf4d494e43ceb2cff69abe4dd17147d29cc2

SHA256
168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e

SHA512
e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe

Download Submit
\Users\Admin\AppData\Local\Temp\nsjB79F.tmp\nsExec.dll
Filesize
6KB

MD5
acc2b699edfea5bf5aae45aba3a41e96

SHA1
d2accf4d494e43ceb2cff69abe4dd17147d29cc2

SHA256
168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e

SHA512
e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe

Download Submit
\Users\Admin\AppData\Local\Temp\nsjB79F.tmp\nsExec.dll
Filesize
6KB

MD5
acc2b699edfea5bf5aae45aba3a41e96

SHA1
d2accf4d494e43ceb2cff69abe4dd17147d29cc2

SHA256
168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e

SHA512
e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe

Download Submit
\Users\Admin\AppData\Local\Temp\nsjB79F.tmp\nsExec.dll
Filesize
6KB

MD5
acc2b699edfea5bf5aae45aba3a41e96

SHA1
d2accf4d494e43ceb2cff69abe4dd17147d29cc2

SHA256
168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e

SHA512
e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe

Download Submit
\Windows\SysWOW64\hfnapi.dll
Filesize
106KB

MD5
e32beadb1c33ce86af2db7fa32fbaff3

SHA1
8ed2182d26e4e33335dacda61db08e4bd8d3a894

SHA256
e5faf83b27aa76422147d2ca46be986243c46659f6e827efe57bcd6e1c7bb500

SHA512
957bc62af59dc293334986e4037a3550279d357fd9199442bf59bd80efbf22f9eb4e73448d08e43928a784ac0b424ea45ff6123507ed05efe607592f2ac253bc

Download Submit
\Windows\SysWOW64\hfnapi.dll
Filesize
106KB

MD5
e32beadb1c33ce86af2db7fa32fbaff3

SHA1
8ed2182d26e4e33335dacda61db08e4bd8d3a894

SHA256
e5faf83b27aa76422147d2ca46be986243c46659f6e827efe57bcd6e1c7bb500

SHA512
957bc62af59dc293334986e4037a3550279d357fd9199442bf59bd80efbf22f9eb4e73448d08e43928a784ac0b424ea45ff6123507ed05efe607592f2ac253bc

Download Submit
\Windows\SysWOW64\hfnapi.dll
Filesize
106KB

MD5
e32beadb1c33ce86af2db7fa32fbaff3

SHA1
8ed2182d26e4e33335dacda61db08e4bd8d3a894

SHA256
e5faf83b27aa76422147d2ca46be986243c46659f6e827efe57bcd6e1c7bb500

SHA512
957bc62af59dc293334986e4037a3550279d357fd9199442bf59bd80efbf22f9eb4e73448d08e43928a784ac0b424ea45ff6123507ed05efe607592f2ac253bc

Download Submit
\Windows\SysWOW64\hfpapi.dll
Filesize
241KB

MD5
3ea8fec7b85321bdc2ddb0fbd3904847

SHA1
1e3a5c5cf075e0fc2b450475f0e72a9c398602a8

SHA256
f9a364ea3dd4fbcc84072d798429212c0de6e33b2498d018b756dd041fa4ae39

SHA512
6ecc89af5f8cdde8a02c9527bd3499e49176f33ccaa505c34ac84d5ec636594328beada3c9f9a7d4cb49a368915608eb6df10c71936a846cc051052eec39f357

Download Submit
\Windows\SysWOW64\hfpapi.dll
Filesize
241KB

MD5
3ea8fec7b85321bdc2ddb0fbd3904847

SHA1
1e3a5c5cf075e0fc2b450475f0e72a9c398602a8

SHA256
f9a364ea3dd4fbcc84072d798429212c0de6e33b2498d018b756dd041fa4ae39

SHA512
6ecc89af5f8cdde8a02c9527bd3499e49176f33ccaa505c34ac84d5ec636594328beada3c9f9a7d4cb49a368915608eb6df10c71936a846cc051052eec39f357

Download Submit
\Windows\SysWOW64\installd.exe
Filesize
108KB

MD5
0638ab1996dbab01854683c6c18af131

SHA1
9bdb8e57f388ab8a9392d28de6af15fce6789f68

SHA256
cc36293a67d54aa710d640bd6c3a70d8a2fcf8cb00e84582d042f48fd17a7490

SHA512
ca9a68b11174f17683ccf17c2bf13a4e76e3c53149a0f72c892dacf1a4d1c7b439ebfed822215c300a135c81e2b6a716b7bc0abd48c90dcdc93bb470ba46cedb

Download Submit
\Windows\SysWOW64\nethtsrv.exe
Filesize
176KB

MD5
0d3c788600ef224ce05e7f2e67bc58dd

SHA1
c441b12b83db11309068abfc4c98601a1f5d3d5d

SHA256
79fb672c43aa9e886d108639fa81beec4cf95f31bf8ac240c62b09368ed56049

SHA512
2b14aa38220932a0c2db4b0f6179d7f3d6c21f023e1fdd271aca1970dbac6ef973b0f4865de0790a2e084c0dcd343d982299a82c4a9c82ec32ad422ec99e6093

Download Submit
\Windows\SysWOW64\netupdsrv.exe
Filesize
158KB

MD5
98d002d5c5c2fdba1af858e26bc50624

SHA1
ef6d418b874d81b37aa1a81e8ddfe9ea486593a2

SHA256
9ed092177e4df024083e0f45b35f0b3cb0c88d1605d82bc8b62f80a2a38aacd0

SHA512
06bf635436146eb7cb3133e62762573a4ca96d42ff5f253e2773257e86236baaaab97cb5d49f6e67fe0c6037f56520aa812782b4946c37aa9c79492404cb87ae

Download Submit
memory/968-79-0x0000000000000000-mapping.dmp

Download
memory/1048-61-0x0000000000000000-mapping.dmp

Download
memory/1156-57-0x0000000000000000-mapping.dmp

Download
memory/1380-75-0x0000000000000000-mapping.dmp

Download
memory/1616-69-0x0000000000000000-mapping.dmp

Download
memory/1648-54-0x0000000075BE1000-0x0000000075BE3000-memory.dmp

Filesize
8KB

Download
memory/1684-85-0x0000000000000000-mapping.dmp

Download
memory/1732-58-0x0000000000000000-mapping.dmp

Download
memory/1764-60-0x0000000000000000-mapping.dmp

Download
memory/1780-63-0x0000000000000000-mapping.dmp

Download
memory/1840-86-0x0000000000000000-mapping.dmp

Download
memory/2028-80-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads