ee0ab15289e71208d00d44f6aaf455e844b70c630eddc05aa347e49d1444de90

Analysis

max time kernel
39s
max time network
43s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
23-11-2022 10:50

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ee0ab15289e71208d00d44f6aaf455e844b70c630eddc05aa347e49d1444de90.exe
Size

446KB
MD5

5022ddd697aafffb0b26c3b1b9cf304d
SHA1

d80171e02cc5f788ec7cee640bf54c9e4984089d
SHA256

ee0ab15289e71208d00d44f6aaf455e844b70c630eddc05aa347e49d1444de90
SHA512

096555f7c3942c2822e0fe72d65c73dde1f26e1eefb456066c1e3278e87e746b5a60558ff64b6d309f128f007e509ed02d2e6b44eb1ef2b490eb126e65ce0ba5
SSDEEP

12288:8eB/W2xiFVzZ0vuPaxWml1YD5uBzPEH3xfKBYzuiHkMq:8s/8zaWP0Wml6D5u5CxfLaiu

Score

8^/10

discovery

Malware Config

Signatures

Drops file in Drivers directory 1 IoCs

Processes:

ee0ab15289e71208d00d44f6aaf455e844b70c630eddc05aa347e49d1444de90.exe

description ioc process

File created C:\Windows\system32\drivers\nethfdrv.sys ee0ab15289e71208d00d44f6aaf455e844b70c630eddc05aa347e49d1444de90.exe
Executes dropped EXE 5 IoCs

Processes:

installd.exenethtsrv.exenetupdsrv.exenethtsrv.exenetupdsrv.exe

pid process

1740 installd.exe
668 nethtsrv.exe
1488 netupdsrv.exe
1696 nethtsrv.exe
1328 netupdsrv.exe

description	ioc	process
File created	C:\Windows\system32\drivers\nethfdrv.sys	ee0ab15289e71208d00d44f6aaf455e844b70c630eddc05aa347e49d1444de90.exe

pid	process
1740	installd.exe
668	nethtsrv.exe
1488	netupdsrv.exe
1696	nethtsrv.exe
1328	netupdsrv.exe

Loads dropped DLL 13 IoCs

Processes:

ee0ab15289e71208d00d44f6aaf455e844b70c630eddc05aa347e49d1444de90.exeinstalld.exenethtsrv.exenethtsrv.exe

pid	process
1516	ee0ab15289e71208d00d44f6aaf455e844b70c630eddc05aa347e49d1444de90.exe
1516	ee0ab15289e71208d00d44f6aaf455e844b70c630eddc05aa347e49d1444de90.exe
1516	ee0ab15289e71208d00d44f6aaf455e844b70c630eddc05aa347e49d1444de90.exe
1516	ee0ab15289e71208d00d44f6aaf455e844b70c630eddc05aa347e49d1444de90.exe
1740	installd.exe
1516	ee0ab15289e71208d00d44f6aaf455e844b70c630eddc05aa347e49d1444de90.exe
668	nethtsrv.exe
668	nethtsrv.exe
1516	ee0ab15289e71208d00d44f6aaf455e844b70c630eddc05aa347e49d1444de90.exe
1516	ee0ab15289e71208d00d44f6aaf455e844b70c630eddc05aa347e49d1444de90.exe
1696	nethtsrv.exe
1696	nethtsrv.exe
1516	ee0ab15289e71208d00d44f6aaf455e844b70c630eddc05aa347e49d1444de90.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in System32 directory 5 IoCs

Processes:

ee0ab15289e71208d00d44f6aaf455e844b70c630eddc05aa347e49d1444de90.exe

description	ioc	process
File created	C:\Windows\SysWOW64\hfpapi.dll	ee0ab15289e71208d00d44f6aaf455e844b70c630eddc05aa347e49d1444de90.exe
File created	C:\Windows\SysWOW64\installd.exe	ee0ab15289e71208d00d44f6aaf455e844b70c630eddc05aa347e49d1444de90.exe
File created	C:\Windows\SysWOW64\nethtsrv.exe	ee0ab15289e71208d00d44f6aaf455e844b70c630eddc05aa347e49d1444de90.exe
File created	C:\Windows\SysWOW64\netupdsrv.exe	ee0ab15289e71208d00d44f6aaf455e844b70c630eddc05aa347e49d1444de90.exe
File created	C:\Windows\SysWOW64\hfnapi.dll	ee0ab15289e71208d00d44f6aaf455e844b70c630eddc05aa347e49d1444de90.exe

Drops file in Program Files directory 3 IoCs

Processes:

ee0ab15289e71208d00d44f6aaf455e844b70c630eddc05aa347e49d1444de90.exe

description	ioc	process
File created	C:\Program Files (x86)\Common Files\Config\data.xml	ee0ab15289e71208d00d44f6aaf455e844b70c630eddc05aa347e49d1444de90.exe
File created	C:\Program Files (x86)\Common Files\Config\ver.xml	ee0ab15289e71208d00d44f6aaf455e844b70c630eddc05aa347e49d1444de90.exe
File created	C:\Program Files (x86)\Common Files\config\uninstinethnfd.exe	ee0ab15289e71208d00d44f6aaf455e844b70c630eddc05aa347e49d1444de90.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Runs net.exe
Suspicious behavior: LoadsDriver 1 IoCs

Processes:

pid process

464
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

nethtsrv.exe

description pid process

Token: SeDebugPrivilege 1696 nethtsrv.exe

pid	process
464

description	pid	process
Token: SeDebugPrivilege	1696	nethtsrv.exe

Suspicious use of WriteProcessMemory 50 IoCs

Processes:

ee0ab15289e71208d00d44f6aaf455e844b70c630eddc05aa347e49d1444de90.exenet.exenet.exenet.exenet.exe

description	pid	process	target process
PID 1516 wrote to memory of 1896	1516	ee0ab15289e71208d00d44f6aaf455e844b70c630eddc05aa347e49d1444de90.exe	net.exe
PID 1516 wrote to memory of 1896	1516	ee0ab15289e71208d00d44f6aaf455e844b70c630eddc05aa347e49d1444de90.exe	net.exe
PID 1516 wrote to memory of 1896	1516	ee0ab15289e71208d00d44f6aaf455e844b70c630eddc05aa347e49d1444de90.exe	net.exe
PID 1516 wrote to memory of 1896	1516	ee0ab15289e71208d00d44f6aaf455e844b70c630eddc05aa347e49d1444de90.exe	net.exe
PID 1896 wrote to memory of 1452	1896	net.exe	net1.exe
PID 1896 wrote to memory of 1452	1896	net.exe	net1.exe
PID 1896 wrote to memory of 1452	1896	net.exe	net1.exe
PID 1896 wrote to memory of 1452	1896	net.exe	net1.exe
PID 1516 wrote to memory of 1800	1516	ee0ab15289e71208d00d44f6aaf455e844b70c630eddc05aa347e49d1444de90.exe	net.exe
PID 1516 wrote to memory of 1800	1516	ee0ab15289e71208d00d44f6aaf455e844b70c630eddc05aa347e49d1444de90.exe	net.exe
PID 1516 wrote to memory of 1800	1516	ee0ab15289e71208d00d44f6aaf455e844b70c630eddc05aa347e49d1444de90.exe	net.exe
PID 1516 wrote to memory of 1800	1516	ee0ab15289e71208d00d44f6aaf455e844b70c630eddc05aa347e49d1444de90.exe	net.exe
PID 1800 wrote to memory of 1612	1800	net.exe	net1.exe
PID 1800 wrote to memory of 1612	1800	net.exe	net1.exe
PID 1800 wrote to memory of 1612	1800	net.exe	net1.exe
PID 1800 wrote to memory of 1612	1800	net.exe	net1.exe
PID 1516 wrote to memory of 1740	1516	ee0ab15289e71208d00d44f6aaf455e844b70c630eddc05aa347e49d1444de90.exe	installd.exe
PID 1516 wrote to memory of 1740	1516	ee0ab15289e71208d00d44f6aaf455e844b70c630eddc05aa347e49d1444de90.exe	installd.exe
PID 1516 wrote to memory of 1740	1516	ee0ab15289e71208d00d44f6aaf455e844b70c630eddc05aa347e49d1444de90.exe	installd.exe
PID 1516 wrote to memory of 1740	1516	ee0ab15289e71208d00d44f6aaf455e844b70c630eddc05aa347e49d1444de90.exe	installd.exe
PID 1516 wrote to memory of 1740	1516	ee0ab15289e71208d00d44f6aaf455e844b70c630eddc05aa347e49d1444de90.exe	installd.exe
PID 1516 wrote to memory of 1740	1516	ee0ab15289e71208d00d44f6aaf455e844b70c630eddc05aa347e49d1444de90.exe	installd.exe
PID 1516 wrote to memory of 1740	1516	ee0ab15289e71208d00d44f6aaf455e844b70c630eddc05aa347e49d1444de90.exe	installd.exe
PID 1516 wrote to memory of 668	1516	ee0ab15289e71208d00d44f6aaf455e844b70c630eddc05aa347e49d1444de90.exe	nethtsrv.exe
PID 1516 wrote to memory of 668	1516	ee0ab15289e71208d00d44f6aaf455e844b70c630eddc05aa347e49d1444de90.exe	nethtsrv.exe
PID 1516 wrote to memory of 668	1516	ee0ab15289e71208d00d44f6aaf455e844b70c630eddc05aa347e49d1444de90.exe	nethtsrv.exe
PID 1516 wrote to memory of 668	1516	ee0ab15289e71208d00d44f6aaf455e844b70c630eddc05aa347e49d1444de90.exe	nethtsrv.exe
PID 1516 wrote to memory of 1488	1516	ee0ab15289e71208d00d44f6aaf455e844b70c630eddc05aa347e49d1444de90.exe	netupdsrv.exe
PID 1516 wrote to memory of 1488	1516	ee0ab15289e71208d00d44f6aaf455e844b70c630eddc05aa347e49d1444de90.exe	netupdsrv.exe
PID 1516 wrote to memory of 1488	1516	ee0ab15289e71208d00d44f6aaf455e844b70c630eddc05aa347e49d1444de90.exe	netupdsrv.exe
PID 1516 wrote to memory of 1488	1516	ee0ab15289e71208d00d44f6aaf455e844b70c630eddc05aa347e49d1444de90.exe	netupdsrv.exe
PID 1516 wrote to memory of 1488	1516	ee0ab15289e71208d00d44f6aaf455e844b70c630eddc05aa347e49d1444de90.exe	netupdsrv.exe
PID 1516 wrote to memory of 1488	1516	ee0ab15289e71208d00d44f6aaf455e844b70c630eddc05aa347e49d1444de90.exe	netupdsrv.exe
PID 1516 wrote to memory of 1488	1516	ee0ab15289e71208d00d44f6aaf455e844b70c630eddc05aa347e49d1444de90.exe	netupdsrv.exe
PID 1516 wrote to memory of 1508	1516	ee0ab15289e71208d00d44f6aaf455e844b70c630eddc05aa347e49d1444de90.exe	net.exe
PID 1516 wrote to memory of 1508	1516	ee0ab15289e71208d00d44f6aaf455e844b70c630eddc05aa347e49d1444de90.exe	net.exe
PID 1516 wrote to memory of 1508	1516	ee0ab15289e71208d00d44f6aaf455e844b70c630eddc05aa347e49d1444de90.exe	net.exe
PID 1516 wrote to memory of 1508	1516	ee0ab15289e71208d00d44f6aaf455e844b70c630eddc05aa347e49d1444de90.exe	net.exe
PID 1508 wrote to memory of 2004	1508	net.exe	net1.exe
PID 1508 wrote to memory of 2004	1508	net.exe	net1.exe
PID 1508 wrote to memory of 2004	1508	net.exe	net1.exe
PID 1508 wrote to memory of 2004	1508	net.exe	net1.exe
PID 1516 wrote to memory of 1124	1516	ee0ab15289e71208d00d44f6aaf455e844b70c630eddc05aa347e49d1444de90.exe	net.exe
PID 1516 wrote to memory of 1124	1516	ee0ab15289e71208d00d44f6aaf455e844b70c630eddc05aa347e49d1444de90.exe	net.exe
PID 1516 wrote to memory of 1124	1516	ee0ab15289e71208d00d44f6aaf455e844b70c630eddc05aa347e49d1444de90.exe	net.exe
PID 1516 wrote to memory of 1124	1516	ee0ab15289e71208d00d44f6aaf455e844b70c630eddc05aa347e49d1444de90.exe	net.exe
PID 1124 wrote to memory of 812	1124	net.exe	net1.exe
PID 1124 wrote to memory of 812	1124	net.exe	net1.exe
PID 1124 wrote to memory of 812	1124	net.exe	net1.exe
PID 1124 wrote to memory of 812	1124	net.exe	net1.exe

C:\Users\Admin\AppData\Local\Temp\ee0ab15289e71208d00d44f6aaf455e844b70c630eddc05aa347e49d1444de90.exe
"C:\Users\Admin\AppData\Local\Temp\ee0ab15289e71208d00d44f6aaf455e844b70c630eddc05aa347e49d1444de90.exe"
1⤵
- Drops file in Drivers directory
- Loads dropped DLL
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:1516

C:\Windows\SysWOW64\net.exe
net stop nethttpservice
2⤵
- Suspicious use of WriteProcessMemory
PID:1896

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop nethttpservice
3⤵
PID:1452

C:\Windows\SysWOW64\net.exe
net stop serviceupdater
2⤵
- Suspicious use of WriteProcessMemory
PID:1800

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop serviceupdater
3⤵
PID:1612

C:\Windows\SysWOW64\installd.exe
"C:\Windows\system32\installd.exe" nethfdrv
2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1740

C:\Windows\SysWOW64\nethtsrv.exe
"C:\Windows\system32\nethtsrv.exe" -nfdi
2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:668

C:\Windows\SysWOW64\netupdsrv.exe
"C:\Windows\system32\netupdsrv.exe" -nfdi
2⤵
- Executes dropped EXE
PID:1488

C:\Windows\SysWOW64\net.exe
net start nethttpservice
2⤵
- Suspicious use of WriteProcessMemory
PID:1508

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 start nethttpservice
3⤵
PID:2004

C:\Windows\SysWOW64\net.exe
net start serviceupdater
2⤵
- Suspicious use of WriteProcessMemory
PID:1124

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 start serviceupdater
3⤵
PID:812

C:\Windows\SysWOW64\nethtsrv.exe
C:\Windows\SysWOW64\nethtsrv.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:1696

C:\Windows\SysWOW64\netupdsrv.exe
C:\Windows\SysWOW64\netupdsrv.exe
1⤵
- Executes dropped EXE
PID:1328

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\hfnapi.dll
Filesize
106KB

MD5
c81f56666e2d2899988c58012de346b1

SHA1
be458b935b1869168ff6d571aab029b6719cda53

SHA256
1ead8851828e6caeca922717c17f525fbb2f3c21f0b5293c2ef2b8b39d87b3e4

SHA512
2c8adec007efd1e33d4add4cb76cc9a4ab815f2606bb1a7f22a1ecbc76ae47df57e31eb8c2ec710e34e4e5741aa687ff1628494989d140a368193b41b719ee96

Download Submit
C:\Windows\SysWOW64\hfpapi.dll
Filesize
244KB

MD5
6f69effe3d80211c4a88b67f07c98dac

SHA1
83daa68cb2570ccfb3248d4e3e9ec0a278344273

SHA256
c4582e9fe401ea97d1dd812842c22eef4c5d271ab243a1b2abe72ccbaca7291c

SHA512
f19015722bbdd89f1a68a42ba8c7b7701a2c6f79a486b2406faa7a5eabc727fc941fe82398c1807fdb9c0d3efdb402d707d6c5a1df811c285410a45c7b847d58

Download Submit
C:\Windows\SysWOW64\installd.exe
Filesize
108KB

MD5
21f92086cf1141727d513054ae2e1d40

SHA1
8b934f130e765d697aae285de2d975c95248ea82

SHA256
1d140d485b4d54e19883569b8ccd205e149ee4563cddbbec2701ecb7e7004210

SHA512
c54c609b8ad5f268c22aa3616c1293d28b80e3f4692b5d49a3326a39ac9db1a75446a8f3106a87a37866dff2c1120f7a1066061e7658427583ff89df6036d5c9

Download Submit
C:\Windows\SysWOW64\nethtsrv.exe
Filesize
176KB

MD5
dc385f28a1bfd46aec8b6ea70f04cff6

SHA1
70fbd3dfc1f1b8fee9d98c24ee75c145bc0b9aa1

SHA256
a046cede829395906080a2162de2a20a3209b2371a98413e666190e319dea0a0

SHA512
8fd1b871523827419bfca24a492eeb0008555345cbf669f87b1d33ad64ba6fd52d56091fd8bdf42908c6cf74cda777c47e40b1bcadede416fc35fb162dc21a93

Download Submit
C:\Windows\SysWOW64\nethtsrv.exe
Filesize
176KB

MD5
dc385f28a1bfd46aec8b6ea70f04cff6

SHA1
70fbd3dfc1f1b8fee9d98c24ee75c145bc0b9aa1

SHA256
a046cede829395906080a2162de2a20a3209b2371a98413e666190e319dea0a0

SHA512
8fd1b871523827419bfca24a492eeb0008555345cbf669f87b1d33ad64ba6fd52d56091fd8bdf42908c6cf74cda777c47e40b1bcadede416fc35fb162dc21a93

Download Submit
C:\Windows\SysWOW64\netupdsrv.exe
Filesize
158KB

MD5
359e61de232b33baf33363c25dc0966c

SHA1
1247715208e4809667c8fd9497032dfeb73e6092

SHA256
8fc60bccc83f75bfec7a766114d458974bd3eeb7a5256efc1bb07784da665caf

SHA512
88a5627f8b47b4d7d4cb5a2c1b7ce6909d07f50c2dc8a06f0e94658067c3e8ba498df2158e85a2263f2e6ae105dbd3bcf6dc50934fa7ceb1ab081fac9d2c7285

Download Submit
C:\Windows\SysWOW64\netupdsrv.exe
Filesize
158KB

MD5
359e61de232b33baf33363c25dc0966c

SHA1
1247715208e4809667c8fd9497032dfeb73e6092

SHA256
8fc60bccc83f75bfec7a766114d458974bd3eeb7a5256efc1bb07784da665caf

SHA512
88a5627f8b47b4d7d4cb5a2c1b7ce6909d07f50c2dc8a06f0e94658067c3e8ba498df2158e85a2263f2e6ae105dbd3bcf6dc50934fa7ceb1ab081fac9d2c7285

Download Submit
\Users\Admin\AppData\Local\Temp\nsd2945.tmp\System.dll
Filesize
11KB

MD5
c17103ae9072a06da581dec998343fc1

SHA1
b72148c6bdfaada8b8c3f950e610ee7cf1da1f8d

SHA256
dc58d8ad81cacb0c1ed72e33bff8f23ea40b5252b5bb55d393a0903e6819ae2f

SHA512
d32a71aaef18e993f28096d536e41c4d016850721b31171513ce28bbd805a54fd290b7c3e9d935f72e676a1acfb4f0dcc89d95040a0dd29f2b6975855c18986f

Download Submit
\Users\Admin\AppData\Local\Temp\nsd2945.tmp\nsExec.dll
Filesize
6KB

MD5
acc2b699edfea5bf5aae45aba3a41e96

SHA1
d2accf4d494e43ceb2cff69abe4dd17147d29cc2

SHA256
168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e

SHA512
e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe

Download Submit
\Users\Admin\AppData\Local\Temp\nsd2945.tmp\nsExec.dll
Filesize
6KB

MD5
acc2b699edfea5bf5aae45aba3a41e96

SHA1
d2accf4d494e43ceb2cff69abe4dd17147d29cc2

SHA256
168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e

SHA512
e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe

Download Submit
\Users\Admin\AppData\Local\Temp\nsd2945.tmp\nsExec.dll
Filesize
6KB

MD5
acc2b699edfea5bf5aae45aba3a41e96

SHA1
d2accf4d494e43ceb2cff69abe4dd17147d29cc2

SHA256
168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e

SHA512
e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe

Download Submit
\Users\Admin\AppData\Local\Temp\nsd2945.tmp\nsExec.dll
Filesize
6KB

MD5
acc2b699edfea5bf5aae45aba3a41e96

SHA1
d2accf4d494e43ceb2cff69abe4dd17147d29cc2

SHA256
168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e

SHA512
e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe

Download Submit
\Windows\SysWOW64\hfnapi.dll
Filesize
106KB

MD5
c81f56666e2d2899988c58012de346b1

SHA1
be458b935b1869168ff6d571aab029b6719cda53

SHA256
1ead8851828e6caeca922717c17f525fbb2f3c21f0b5293c2ef2b8b39d87b3e4

SHA512
2c8adec007efd1e33d4add4cb76cc9a4ab815f2606bb1a7f22a1ecbc76ae47df57e31eb8c2ec710e34e4e5741aa687ff1628494989d140a368193b41b719ee96

Download Submit
\Windows\SysWOW64\hfnapi.dll
Filesize
106KB

MD5
c81f56666e2d2899988c58012de346b1

SHA1
be458b935b1869168ff6d571aab029b6719cda53

SHA256
1ead8851828e6caeca922717c17f525fbb2f3c21f0b5293c2ef2b8b39d87b3e4

SHA512
2c8adec007efd1e33d4add4cb76cc9a4ab815f2606bb1a7f22a1ecbc76ae47df57e31eb8c2ec710e34e4e5741aa687ff1628494989d140a368193b41b719ee96

Download Submit
\Windows\SysWOW64\hfnapi.dll
Filesize
106KB

MD5
c81f56666e2d2899988c58012de346b1

SHA1
be458b935b1869168ff6d571aab029b6719cda53

SHA256
1ead8851828e6caeca922717c17f525fbb2f3c21f0b5293c2ef2b8b39d87b3e4

SHA512
2c8adec007efd1e33d4add4cb76cc9a4ab815f2606bb1a7f22a1ecbc76ae47df57e31eb8c2ec710e34e4e5741aa687ff1628494989d140a368193b41b719ee96

Download Submit
\Windows\SysWOW64\hfpapi.dll
Filesize
244KB

MD5
6f69effe3d80211c4a88b67f07c98dac

SHA1
83daa68cb2570ccfb3248d4e3e9ec0a278344273

SHA256
c4582e9fe401ea97d1dd812842c22eef4c5d271ab243a1b2abe72ccbaca7291c

SHA512
f19015722bbdd89f1a68a42ba8c7b7701a2c6f79a486b2406faa7a5eabc727fc941fe82398c1807fdb9c0d3efdb402d707d6c5a1df811c285410a45c7b847d58

Download Submit
\Windows\SysWOW64\hfpapi.dll
Filesize
244KB

MD5
6f69effe3d80211c4a88b67f07c98dac

SHA1
83daa68cb2570ccfb3248d4e3e9ec0a278344273

SHA256
c4582e9fe401ea97d1dd812842c22eef4c5d271ab243a1b2abe72ccbaca7291c

SHA512
f19015722bbdd89f1a68a42ba8c7b7701a2c6f79a486b2406faa7a5eabc727fc941fe82398c1807fdb9c0d3efdb402d707d6c5a1df811c285410a45c7b847d58

Download Submit
\Windows\SysWOW64\installd.exe
Filesize
108KB

MD5
21f92086cf1141727d513054ae2e1d40

SHA1
8b934f130e765d697aae285de2d975c95248ea82

SHA256
1d140d485b4d54e19883569b8ccd205e149ee4563cddbbec2701ecb7e7004210

SHA512
c54c609b8ad5f268c22aa3616c1293d28b80e3f4692b5d49a3326a39ac9db1a75446a8f3106a87a37866dff2c1120f7a1066061e7658427583ff89df6036d5c9

Download Submit
\Windows\SysWOW64\nethtsrv.exe
Filesize
176KB

MD5
dc385f28a1bfd46aec8b6ea70f04cff6

SHA1
70fbd3dfc1f1b8fee9d98c24ee75c145bc0b9aa1

SHA256
a046cede829395906080a2162de2a20a3209b2371a98413e666190e319dea0a0

SHA512
8fd1b871523827419bfca24a492eeb0008555345cbf669f87b1d33ad64ba6fd52d56091fd8bdf42908c6cf74cda777c47e40b1bcadede416fc35fb162dc21a93

Download Submit
\Windows\SysWOW64\netupdsrv.exe
Filesize
158KB

MD5
359e61de232b33baf33363c25dc0966c

SHA1
1247715208e4809667c8fd9497032dfeb73e6092

SHA256
8fc60bccc83f75bfec7a766114d458974bd3eeb7a5256efc1bb07784da665caf

SHA512
88a5627f8b47b4d7d4cb5a2c1b7ce6909d07f50c2dc8a06f0e94658067c3e8ba498df2158e85a2263f2e6ae105dbd3bcf6dc50934fa7ceb1ab081fac9d2c7285

Download Submit
memory/668-69-0x0000000000000000-mapping.dmp

Download
memory/812-86-0x0000000000000000-mapping.dmp

Download
memory/1124-85-0x0000000000000000-mapping.dmp

Download
memory/1452-58-0x0000000000000000-mapping.dmp

Download
memory/1488-75-0x0000000000000000-mapping.dmp

Download
memory/1508-79-0x0000000000000000-mapping.dmp

Download
memory/1516-54-0x0000000075841000-0x0000000075843000-memory.dmp

Filesize
8KB

Download
memory/1612-61-0x0000000000000000-mapping.dmp

Download
memory/1740-63-0x0000000000000000-mapping.dmp

Download
memory/1800-60-0x0000000000000000-mapping.dmp

Download
memory/1896-57-0x0000000000000000-mapping.dmp

Download
memory/2004-80-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads