d4ac2f3949c2884d811e614b7062968e2e85bcf063e3345716aa0f2a5b442b38

Analysis

max time kernel
43s
max time network
47s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
23-11-2022 10:51

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d4ac2f3949c2884d811e614b7062968e2e85bcf063e3345716aa0f2a5b442b38.exe
Size

445KB
MD5

7ffed99a92c60bcf354c82af6bb642e8
SHA1

8a3453d47f00b81760513a68e24d48282a927401
SHA256

d4ac2f3949c2884d811e614b7062968e2e85bcf063e3345716aa0f2a5b442b38
SHA512

b65f0aaa7e496de3eb3ebc5a01c5950f883ea402912ff1e9d1e7125c67a21f86a1476c8aa75ec27eb4f8d918b589bdd7b37e8b52e76ef7ee5c4e1f1d5dea6e00
SSDEEP

12288:AP+S3rxSDDc9GVrW4kfks9V/lbGgUyiGTL/v9JzcY:AP+SbYHJVrW4TUV9b/+Uv3YY

Score

8^/10

discovery

Malware Config

Signatures

Drops file in Drivers directory 1 IoCs

Processes:

d4ac2f3949c2884d811e614b7062968e2e85bcf063e3345716aa0f2a5b442b38.exe

description ioc process

File created C:\Windows\system32\drivers\nethfdrv.sys d4ac2f3949c2884d811e614b7062968e2e85bcf063e3345716aa0f2a5b442b38.exe
Executes dropped EXE 5 IoCs

Processes:

installd.exenethtsrv.exenetupdsrv.exenethtsrv.exenetupdsrv.exe

pid process

516 installd.exe
1684 nethtsrv.exe
1064 netupdsrv.exe
1092 nethtsrv.exe
1364 netupdsrv.exe

description	ioc	process
File created	C:\Windows\system32\drivers\nethfdrv.sys	d4ac2f3949c2884d811e614b7062968e2e85bcf063e3345716aa0f2a5b442b38.exe

pid	process
516	installd.exe
1684	nethtsrv.exe
1064	netupdsrv.exe
1092	nethtsrv.exe
1364	netupdsrv.exe

Loads dropped DLL 13 IoCs

Processes:

d4ac2f3949c2884d811e614b7062968e2e85bcf063e3345716aa0f2a5b442b38.exeinstalld.exenethtsrv.exenethtsrv.exe

pid	process
1672	d4ac2f3949c2884d811e614b7062968e2e85bcf063e3345716aa0f2a5b442b38.exe
1672	d4ac2f3949c2884d811e614b7062968e2e85bcf063e3345716aa0f2a5b442b38.exe
1672	d4ac2f3949c2884d811e614b7062968e2e85bcf063e3345716aa0f2a5b442b38.exe
1672	d4ac2f3949c2884d811e614b7062968e2e85bcf063e3345716aa0f2a5b442b38.exe
516	installd.exe
1672	d4ac2f3949c2884d811e614b7062968e2e85bcf063e3345716aa0f2a5b442b38.exe
1684	nethtsrv.exe
1684	nethtsrv.exe
1672	d4ac2f3949c2884d811e614b7062968e2e85bcf063e3345716aa0f2a5b442b38.exe
1672	d4ac2f3949c2884d811e614b7062968e2e85bcf063e3345716aa0f2a5b442b38.exe
1092	nethtsrv.exe
1092	nethtsrv.exe
1672	d4ac2f3949c2884d811e614b7062968e2e85bcf063e3345716aa0f2a5b442b38.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in System32 directory 5 IoCs

Processes:

d4ac2f3949c2884d811e614b7062968e2e85bcf063e3345716aa0f2a5b442b38.exe

description	ioc	process
File created	C:\Windows\SysWOW64\installd.exe	d4ac2f3949c2884d811e614b7062968e2e85bcf063e3345716aa0f2a5b442b38.exe
File created	C:\Windows\SysWOW64\nethtsrv.exe	d4ac2f3949c2884d811e614b7062968e2e85bcf063e3345716aa0f2a5b442b38.exe
File created	C:\Windows\SysWOW64\netupdsrv.exe	d4ac2f3949c2884d811e614b7062968e2e85bcf063e3345716aa0f2a5b442b38.exe
File created	C:\Windows\SysWOW64\hfnapi.dll	d4ac2f3949c2884d811e614b7062968e2e85bcf063e3345716aa0f2a5b442b38.exe
File created	C:\Windows\SysWOW64\hfpapi.dll	d4ac2f3949c2884d811e614b7062968e2e85bcf063e3345716aa0f2a5b442b38.exe

Drops file in Program Files directory 3 IoCs

Processes:

d4ac2f3949c2884d811e614b7062968e2e85bcf063e3345716aa0f2a5b442b38.exe

description	ioc	process
File created	C:\Program Files (x86)\Common Files\Config\ver.xml	d4ac2f3949c2884d811e614b7062968e2e85bcf063e3345716aa0f2a5b442b38.exe
File created	C:\Program Files (x86)\Common Files\config\uninstinethnfd.exe	d4ac2f3949c2884d811e614b7062968e2e85bcf063e3345716aa0f2a5b442b38.exe
File created	C:\Program Files (x86)\Common Files\Config\data.xml	d4ac2f3949c2884d811e614b7062968e2e85bcf063e3345716aa0f2a5b442b38.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Runs net.exe
Suspicious behavior: LoadsDriver 1 IoCs

Processes:

pid process

464
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

nethtsrv.exe

description pid process

Token: SeDebugPrivilege 1092 nethtsrv.exe

pid	process
464

description	pid	process
Token: SeDebugPrivilege	1092	nethtsrv.exe

Suspicious use of WriteProcessMemory 50 IoCs

Processes:

d4ac2f3949c2884d811e614b7062968e2e85bcf063e3345716aa0f2a5b442b38.exenet.exenet.exenet.exenet.exe

description	pid	process	target process
PID 1672 wrote to memory of 1584	1672	d4ac2f3949c2884d811e614b7062968e2e85bcf063e3345716aa0f2a5b442b38.exe	net.exe
PID 1672 wrote to memory of 1584	1672	d4ac2f3949c2884d811e614b7062968e2e85bcf063e3345716aa0f2a5b442b38.exe	net.exe
PID 1672 wrote to memory of 1584	1672	d4ac2f3949c2884d811e614b7062968e2e85bcf063e3345716aa0f2a5b442b38.exe	net.exe
PID 1672 wrote to memory of 1584	1672	d4ac2f3949c2884d811e614b7062968e2e85bcf063e3345716aa0f2a5b442b38.exe	net.exe
PID 1584 wrote to memory of 552	1584	net.exe	net1.exe
PID 1584 wrote to memory of 552	1584	net.exe	net1.exe
PID 1584 wrote to memory of 552	1584	net.exe	net1.exe
PID 1584 wrote to memory of 552	1584	net.exe	net1.exe
PID 1672 wrote to memory of 584	1672	d4ac2f3949c2884d811e614b7062968e2e85bcf063e3345716aa0f2a5b442b38.exe	net.exe
PID 1672 wrote to memory of 584	1672	d4ac2f3949c2884d811e614b7062968e2e85bcf063e3345716aa0f2a5b442b38.exe	net.exe
PID 1672 wrote to memory of 584	1672	d4ac2f3949c2884d811e614b7062968e2e85bcf063e3345716aa0f2a5b442b38.exe	net.exe
PID 1672 wrote to memory of 584	1672	d4ac2f3949c2884d811e614b7062968e2e85bcf063e3345716aa0f2a5b442b38.exe	net.exe
PID 584 wrote to memory of 1620	584	net.exe	net1.exe
PID 584 wrote to memory of 1620	584	net.exe	net1.exe
PID 584 wrote to memory of 1620	584	net.exe	net1.exe
PID 584 wrote to memory of 1620	584	net.exe	net1.exe
PID 1672 wrote to memory of 516	1672	d4ac2f3949c2884d811e614b7062968e2e85bcf063e3345716aa0f2a5b442b38.exe	installd.exe
PID 1672 wrote to memory of 516	1672	d4ac2f3949c2884d811e614b7062968e2e85bcf063e3345716aa0f2a5b442b38.exe	installd.exe
PID 1672 wrote to memory of 516	1672	d4ac2f3949c2884d811e614b7062968e2e85bcf063e3345716aa0f2a5b442b38.exe	installd.exe
PID 1672 wrote to memory of 516	1672	d4ac2f3949c2884d811e614b7062968e2e85bcf063e3345716aa0f2a5b442b38.exe	installd.exe
PID 1672 wrote to memory of 516	1672	d4ac2f3949c2884d811e614b7062968e2e85bcf063e3345716aa0f2a5b442b38.exe	installd.exe
PID 1672 wrote to memory of 516	1672	d4ac2f3949c2884d811e614b7062968e2e85bcf063e3345716aa0f2a5b442b38.exe	installd.exe
PID 1672 wrote to memory of 516	1672	d4ac2f3949c2884d811e614b7062968e2e85bcf063e3345716aa0f2a5b442b38.exe	installd.exe
PID 1672 wrote to memory of 1684	1672	d4ac2f3949c2884d811e614b7062968e2e85bcf063e3345716aa0f2a5b442b38.exe	nethtsrv.exe
PID 1672 wrote to memory of 1684	1672	d4ac2f3949c2884d811e614b7062968e2e85bcf063e3345716aa0f2a5b442b38.exe	nethtsrv.exe
PID 1672 wrote to memory of 1684	1672	d4ac2f3949c2884d811e614b7062968e2e85bcf063e3345716aa0f2a5b442b38.exe	nethtsrv.exe
PID 1672 wrote to memory of 1684	1672	d4ac2f3949c2884d811e614b7062968e2e85bcf063e3345716aa0f2a5b442b38.exe	nethtsrv.exe
PID 1672 wrote to memory of 1064	1672	d4ac2f3949c2884d811e614b7062968e2e85bcf063e3345716aa0f2a5b442b38.exe	netupdsrv.exe
PID 1672 wrote to memory of 1064	1672	d4ac2f3949c2884d811e614b7062968e2e85bcf063e3345716aa0f2a5b442b38.exe	netupdsrv.exe
PID 1672 wrote to memory of 1064	1672	d4ac2f3949c2884d811e614b7062968e2e85bcf063e3345716aa0f2a5b442b38.exe	netupdsrv.exe
PID 1672 wrote to memory of 1064	1672	d4ac2f3949c2884d811e614b7062968e2e85bcf063e3345716aa0f2a5b442b38.exe	netupdsrv.exe
PID 1672 wrote to memory of 1064	1672	d4ac2f3949c2884d811e614b7062968e2e85bcf063e3345716aa0f2a5b442b38.exe	netupdsrv.exe
PID 1672 wrote to memory of 1064	1672	d4ac2f3949c2884d811e614b7062968e2e85bcf063e3345716aa0f2a5b442b38.exe	netupdsrv.exe
PID 1672 wrote to memory of 1064	1672	d4ac2f3949c2884d811e614b7062968e2e85bcf063e3345716aa0f2a5b442b38.exe	netupdsrv.exe
PID 1672 wrote to memory of 1280	1672	d4ac2f3949c2884d811e614b7062968e2e85bcf063e3345716aa0f2a5b442b38.exe	net.exe
PID 1672 wrote to memory of 1280	1672	d4ac2f3949c2884d811e614b7062968e2e85bcf063e3345716aa0f2a5b442b38.exe	net.exe
PID 1672 wrote to memory of 1280	1672	d4ac2f3949c2884d811e614b7062968e2e85bcf063e3345716aa0f2a5b442b38.exe	net.exe
PID 1672 wrote to memory of 1280	1672	d4ac2f3949c2884d811e614b7062968e2e85bcf063e3345716aa0f2a5b442b38.exe	net.exe
PID 1280 wrote to memory of 1296	1280	net.exe	net1.exe
PID 1280 wrote to memory of 1296	1280	net.exe	net1.exe
PID 1280 wrote to memory of 1296	1280	net.exe	net1.exe
PID 1280 wrote to memory of 1296	1280	net.exe	net1.exe
PID 1672 wrote to memory of 316	1672	d4ac2f3949c2884d811e614b7062968e2e85bcf063e3345716aa0f2a5b442b38.exe	net.exe
PID 1672 wrote to memory of 316	1672	d4ac2f3949c2884d811e614b7062968e2e85bcf063e3345716aa0f2a5b442b38.exe	net.exe
PID 1672 wrote to memory of 316	1672	d4ac2f3949c2884d811e614b7062968e2e85bcf063e3345716aa0f2a5b442b38.exe	net.exe
PID 1672 wrote to memory of 316	1672	d4ac2f3949c2884d811e614b7062968e2e85bcf063e3345716aa0f2a5b442b38.exe	net.exe
PID 316 wrote to memory of 1380	316	net.exe	net1.exe
PID 316 wrote to memory of 1380	316	net.exe	net1.exe
PID 316 wrote to memory of 1380	316	net.exe	net1.exe
PID 316 wrote to memory of 1380	316	net.exe	net1.exe

C:\Users\Admin\AppData\Local\Temp\d4ac2f3949c2884d811e614b7062968e2e85bcf063e3345716aa0f2a5b442b38.exe
"C:\Users\Admin\AppData\Local\Temp\d4ac2f3949c2884d811e614b7062968e2e85bcf063e3345716aa0f2a5b442b38.exe"
1⤵
- Drops file in Drivers directory
- Loads dropped DLL
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:1672

C:\Windows\SysWOW64\net.exe
net stop nethttpservice
2⤵
- Suspicious use of WriteProcessMemory
PID:1584

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop nethttpservice
3⤵
PID:552

C:\Windows\SysWOW64\net.exe
net stop serviceupdater
2⤵
- Suspicious use of WriteProcessMemory
PID:584

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop serviceupdater
3⤵
PID:1620

C:\Windows\SysWOW64\installd.exe
"C:\Windows\system32\installd.exe" nethfdrv
2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:516

C:\Windows\SysWOW64\nethtsrv.exe
"C:\Windows\system32\nethtsrv.exe" -nfdi
2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1684

C:\Windows\SysWOW64\netupdsrv.exe
"C:\Windows\system32\netupdsrv.exe" -nfdi
2⤵
- Executes dropped EXE
PID:1064

C:\Windows\SysWOW64\net.exe
net start nethttpservice
2⤵
- Suspicious use of WriteProcessMemory
PID:1280

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 start nethttpservice
3⤵
PID:1296

C:\Windows\SysWOW64\net.exe
net start serviceupdater
2⤵
- Suspicious use of WriteProcessMemory
PID:316

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 start serviceupdater
3⤵
PID:1380

C:\Windows\SysWOW64\nethtsrv.exe
C:\Windows\SysWOW64\nethtsrv.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:1092

C:\Windows\SysWOW64\netupdsrv.exe
C:\Windows\SysWOW64\netupdsrv.exe
1⤵
- Executes dropped EXE
PID:1364

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\hfnapi.dll
Filesize
106KB

MD5
6095ce5297642db100d075e868eac8c4

SHA1
4d2b6ec487aab91765923003f30bf6d403f72df8

SHA256
4a80976682c95d5895055f6c7ce202fb635b16242f1d5bb40bae70ce2d72e2e2

SHA512
196a4bf17debdc856b986da79b0a7219eb10de72071bf26e1cd78c472b81d4c7903cca88df6d456afb129a53e6277d4dd089d56585d62d79110a8151c7e466df

Download Submit
C:\Windows\SysWOW64\hfpapi.dll
Filesize
241KB

MD5
f065976e98b686dc97349b64462a1829

SHA1
a4c351f4de023d392ecec1aece359c2e385f522a

SHA256
4b6b23842056063dfa64d0ffd36d4459224c3a28b637d76d901e5bea464db220

SHA512
ec7da8d7acbad993f039c827882936e74e4f35a0890cddbbbf6f655a60a4498f4f35a9775c952c4974effaee4eeaea54780aaabe75b918eef5b87b741b48c5f6

Download Submit
C:\Windows\SysWOW64\installd.exe
Filesize
108KB

MD5
715bbf60b194da0b4cb60979cf870135

SHA1
1873e51bc48009a51b40ab1948b8b1511107b3a7

SHA256
df2d4627331b04629c15a5d30f9ae3c99ae71b552fc14517f516cb2f45e7d230

SHA512
b1e01b0a4290625955ec67966fce78f67b3a0f6041437b28c9e737b2a8ab3b5a4ea7b123fcd01e96f0e1e183afa0d6daf259be3f33f5b3b442ae5d73df48f109

Download Submit
C:\Windows\SysWOW64\nethtsrv.exe
Filesize
176KB

MD5
24f5fb522ec7eb072c8b32dc8eccfa75

SHA1
43c0c9bfa70ea46dab4e3ac362caf2f1cde67032

SHA256
f578826e86402e0faf069f40afb34aba788856727fbf30bfdfb6133ec46cdfaa

SHA512
a94db4bd04be6ac5f9a65cd086901bcff9f4c00151418052b059af8ba0ff6fac5019b68421b1eb72cb02b9d673d01cfaae50d4517efb5c4844282e307a537595

Download Submit
C:\Windows\SysWOW64\nethtsrv.exe
Filesize
176KB

MD5
24f5fb522ec7eb072c8b32dc8eccfa75

SHA1
43c0c9bfa70ea46dab4e3ac362caf2f1cde67032

SHA256
f578826e86402e0faf069f40afb34aba788856727fbf30bfdfb6133ec46cdfaa

SHA512
a94db4bd04be6ac5f9a65cd086901bcff9f4c00151418052b059af8ba0ff6fac5019b68421b1eb72cb02b9d673d01cfaae50d4517efb5c4844282e307a537595

Download Submit
C:\Windows\SysWOW64\netupdsrv.exe
Filesize
159KB

MD5
61071887c687f87eaf8ced0d200339e2

SHA1
5e046ee36a0641d24ed4629439e979b10dc4c1f1

SHA256
9c15f4a365e773dffc805dc8d835a5bb4a47e2142f9c30f3e4359d3dd495c924

SHA512
a63f29f1cc8789f4daaae783fcc7aaf8380925bf70690eb43b72e4d57d90a90f1329ab1db7f6f26e17f8b13b7bd609de9084e91a7eaf5ff53f856762c60cc6d8

Download Submit
C:\Windows\SysWOW64\netupdsrv.exe
Filesize
159KB

MD5
61071887c687f87eaf8ced0d200339e2

SHA1
5e046ee36a0641d24ed4629439e979b10dc4c1f1

SHA256
9c15f4a365e773dffc805dc8d835a5bb4a47e2142f9c30f3e4359d3dd495c924

SHA512
a63f29f1cc8789f4daaae783fcc7aaf8380925bf70690eb43b72e4d57d90a90f1329ab1db7f6f26e17f8b13b7bd609de9084e91a7eaf5ff53f856762c60cc6d8

Download Submit
\Users\Admin\AppData\Local\Temp\nsj1A19.tmp\System.dll
Filesize
11KB

MD5
c17103ae9072a06da581dec998343fc1

SHA1
b72148c6bdfaada8b8c3f950e610ee7cf1da1f8d

SHA256
dc58d8ad81cacb0c1ed72e33bff8f23ea40b5252b5bb55d393a0903e6819ae2f

SHA512
d32a71aaef18e993f28096d536e41c4d016850721b31171513ce28bbd805a54fd290b7c3e9d935f72e676a1acfb4f0dcc89d95040a0dd29f2b6975855c18986f

Download Submit
\Users\Admin\AppData\Local\Temp\nsj1A19.tmp\nsExec.dll
Filesize
6KB

MD5
acc2b699edfea5bf5aae45aba3a41e96

SHA1
d2accf4d494e43ceb2cff69abe4dd17147d29cc2

SHA256
168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e

SHA512
e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe

Download Submit
\Users\Admin\AppData\Local\Temp\nsj1A19.tmp\nsExec.dll
Filesize
6KB

MD5
acc2b699edfea5bf5aae45aba3a41e96

SHA1
d2accf4d494e43ceb2cff69abe4dd17147d29cc2

SHA256
168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e

SHA512
e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe

Download Submit
\Users\Admin\AppData\Local\Temp\nsj1A19.tmp\nsExec.dll
Filesize
6KB

MD5
acc2b699edfea5bf5aae45aba3a41e96

SHA1
d2accf4d494e43ceb2cff69abe4dd17147d29cc2

SHA256
168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e

SHA512
e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe

Download Submit
\Users\Admin\AppData\Local\Temp\nsj1A19.tmp\nsExec.dll
Filesize
6KB

MD5
acc2b699edfea5bf5aae45aba3a41e96

SHA1
d2accf4d494e43ceb2cff69abe4dd17147d29cc2

SHA256
168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e

SHA512
e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe

Download Submit
\Windows\SysWOW64\hfnapi.dll
Filesize
106KB

MD5
6095ce5297642db100d075e868eac8c4

SHA1
4d2b6ec487aab91765923003f30bf6d403f72df8

SHA256
4a80976682c95d5895055f6c7ce202fb635b16242f1d5bb40bae70ce2d72e2e2

SHA512
196a4bf17debdc856b986da79b0a7219eb10de72071bf26e1cd78c472b81d4c7903cca88df6d456afb129a53e6277d4dd089d56585d62d79110a8151c7e466df

Download Submit
\Windows\SysWOW64\hfnapi.dll
Filesize
106KB

MD5
6095ce5297642db100d075e868eac8c4

SHA1
4d2b6ec487aab91765923003f30bf6d403f72df8

SHA256
4a80976682c95d5895055f6c7ce202fb635b16242f1d5bb40bae70ce2d72e2e2

SHA512
196a4bf17debdc856b986da79b0a7219eb10de72071bf26e1cd78c472b81d4c7903cca88df6d456afb129a53e6277d4dd089d56585d62d79110a8151c7e466df

Download Submit
\Windows\SysWOW64\hfnapi.dll
Filesize
106KB

MD5
6095ce5297642db100d075e868eac8c4

SHA1
4d2b6ec487aab91765923003f30bf6d403f72df8

SHA256
4a80976682c95d5895055f6c7ce202fb635b16242f1d5bb40bae70ce2d72e2e2

SHA512
196a4bf17debdc856b986da79b0a7219eb10de72071bf26e1cd78c472b81d4c7903cca88df6d456afb129a53e6277d4dd089d56585d62d79110a8151c7e466df

Download Submit
\Windows\SysWOW64\hfpapi.dll
Filesize
241KB

MD5
f065976e98b686dc97349b64462a1829

SHA1
a4c351f4de023d392ecec1aece359c2e385f522a

SHA256
4b6b23842056063dfa64d0ffd36d4459224c3a28b637d76d901e5bea464db220

SHA512
ec7da8d7acbad993f039c827882936e74e4f35a0890cddbbbf6f655a60a4498f4f35a9775c952c4974effaee4eeaea54780aaabe75b918eef5b87b741b48c5f6

Download Submit
\Windows\SysWOW64\hfpapi.dll
Filesize
241KB

MD5
f065976e98b686dc97349b64462a1829

SHA1
a4c351f4de023d392ecec1aece359c2e385f522a

SHA256
4b6b23842056063dfa64d0ffd36d4459224c3a28b637d76d901e5bea464db220

SHA512
ec7da8d7acbad993f039c827882936e74e4f35a0890cddbbbf6f655a60a4498f4f35a9775c952c4974effaee4eeaea54780aaabe75b918eef5b87b741b48c5f6

Download Submit
\Windows\SysWOW64\installd.exe
Filesize
108KB

MD5
715bbf60b194da0b4cb60979cf870135

SHA1
1873e51bc48009a51b40ab1948b8b1511107b3a7

SHA256
df2d4627331b04629c15a5d30f9ae3c99ae71b552fc14517f516cb2f45e7d230

SHA512
b1e01b0a4290625955ec67966fce78f67b3a0f6041437b28c9e737b2a8ab3b5a4ea7b123fcd01e96f0e1e183afa0d6daf259be3f33f5b3b442ae5d73df48f109

Download Submit
\Windows\SysWOW64\nethtsrv.exe
Filesize
176KB

MD5
24f5fb522ec7eb072c8b32dc8eccfa75

SHA1
43c0c9bfa70ea46dab4e3ac362caf2f1cde67032

SHA256
f578826e86402e0faf069f40afb34aba788856727fbf30bfdfb6133ec46cdfaa

SHA512
a94db4bd04be6ac5f9a65cd086901bcff9f4c00151418052b059af8ba0ff6fac5019b68421b1eb72cb02b9d673d01cfaae50d4517efb5c4844282e307a537595

Download Submit
\Windows\SysWOW64\netupdsrv.exe
Filesize
159KB

MD5
61071887c687f87eaf8ced0d200339e2

SHA1
5e046ee36a0641d24ed4629439e979b10dc4c1f1

SHA256
9c15f4a365e773dffc805dc8d835a5bb4a47e2142f9c30f3e4359d3dd495c924

SHA512
a63f29f1cc8789f4daaae783fcc7aaf8380925bf70690eb43b72e4d57d90a90f1329ab1db7f6f26e17f8b13b7bd609de9084e91a7eaf5ff53f856762c60cc6d8

Download Submit
memory/316-85-0x0000000000000000-mapping.dmp

Download
memory/516-63-0x0000000000000000-mapping.dmp

Download
memory/552-58-0x0000000000000000-mapping.dmp

Download
memory/584-60-0x0000000000000000-mapping.dmp

Download
memory/1064-75-0x0000000000000000-mapping.dmp

Download
memory/1280-79-0x0000000000000000-mapping.dmp

Download
memory/1296-80-0x0000000000000000-mapping.dmp

Download
memory/1380-86-0x0000000000000000-mapping.dmp

Download
memory/1584-57-0x0000000000000000-mapping.dmp

Download
memory/1620-61-0x0000000000000000-mapping.dmp

Download
memory/1672-54-0x0000000075111000-0x0000000075113000-memory.dmp

Filesize
8KB

Download
memory/1684-69-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads