e27edf9d8b28c3fb8252de326f538c77280c0d20e22181d27240cb14fb70e08c

Analysis

max time kernel
43s
max time network
46s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
23-11-2022 10:51

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

e27edf9d8b28c3fb8252de326f538c77280c0d20e22181d27240cb14fb70e08c.exe
Size

447KB
MD5

9e37cbae5b690e4714ff9c655d17a180
SHA1

278b6a68208bd6ad47d77b0f94bd53df95f42c29
SHA256

e27edf9d8b28c3fb8252de326f538c77280c0d20e22181d27240cb14fb70e08c
SHA512

4534eef32242782b35536682aad6412c0420bbcb1d5a964a9a12c1586cdd018c1ac41f2b7d69d1227db719b91d2c9796661174263c48ae77986ee19cc39f4753
SSDEEP

6144:Xzfmuxi2Fn8Jmic41UZRGgmiw8RlZy8CvUsQG8rDHPPezOm2twrSkb3dltr0:SuTFKmADT8lyZss1uDvPezOdPg4

Score

8^/10

discovery

Malware Config

Signatures

Drops file in Drivers directory 1 IoCs

Processes:

e27edf9d8b28c3fb8252de326f538c77280c0d20e22181d27240cb14fb70e08c.exe

description ioc process

File created C:\Windows\system32\drivers\nethfdrv.sys e27edf9d8b28c3fb8252de326f538c77280c0d20e22181d27240cb14fb70e08c.exe
Executes dropped EXE 5 IoCs

Processes:

installd.exenethtsrv.exenetupdsrv.exenethtsrv.exenetupdsrv.exe

pid process

2024 installd.exe
1696 nethtsrv.exe
1288 netupdsrv.exe
1912 nethtsrv.exe
524 netupdsrv.exe

description	ioc	process
File created	C:\Windows\system32\drivers\nethfdrv.sys	e27edf9d8b28c3fb8252de326f538c77280c0d20e22181d27240cb14fb70e08c.exe

pid	process
2024	installd.exe
1696	nethtsrv.exe
1288	netupdsrv.exe
1912	nethtsrv.exe
524	netupdsrv.exe

Loads dropped DLL 13 IoCs

Processes:

e27edf9d8b28c3fb8252de326f538c77280c0d20e22181d27240cb14fb70e08c.exeinstalld.exenethtsrv.exenethtsrv.exe

pid	process
1444	e27edf9d8b28c3fb8252de326f538c77280c0d20e22181d27240cb14fb70e08c.exe
1444	e27edf9d8b28c3fb8252de326f538c77280c0d20e22181d27240cb14fb70e08c.exe
1444	e27edf9d8b28c3fb8252de326f538c77280c0d20e22181d27240cb14fb70e08c.exe
1444	e27edf9d8b28c3fb8252de326f538c77280c0d20e22181d27240cb14fb70e08c.exe
2024	installd.exe
1444	e27edf9d8b28c3fb8252de326f538c77280c0d20e22181d27240cb14fb70e08c.exe
1696	nethtsrv.exe
1696	nethtsrv.exe
1444	e27edf9d8b28c3fb8252de326f538c77280c0d20e22181d27240cb14fb70e08c.exe
1444	e27edf9d8b28c3fb8252de326f538c77280c0d20e22181d27240cb14fb70e08c.exe
1912	nethtsrv.exe
1912	nethtsrv.exe
1444	e27edf9d8b28c3fb8252de326f538c77280c0d20e22181d27240cb14fb70e08c.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in System32 directory 5 IoCs

Processes:

e27edf9d8b28c3fb8252de326f538c77280c0d20e22181d27240cb14fb70e08c.exe

description	ioc	process
File created	C:\Windows\SysWOW64\hfpapi.dll	e27edf9d8b28c3fb8252de326f538c77280c0d20e22181d27240cb14fb70e08c.exe
File created	C:\Windows\SysWOW64\installd.exe	e27edf9d8b28c3fb8252de326f538c77280c0d20e22181d27240cb14fb70e08c.exe
File created	C:\Windows\SysWOW64\nethtsrv.exe	e27edf9d8b28c3fb8252de326f538c77280c0d20e22181d27240cb14fb70e08c.exe
File created	C:\Windows\SysWOW64\netupdsrv.exe	e27edf9d8b28c3fb8252de326f538c77280c0d20e22181d27240cb14fb70e08c.exe
File created	C:\Windows\SysWOW64\hfnapi.dll	e27edf9d8b28c3fb8252de326f538c77280c0d20e22181d27240cb14fb70e08c.exe

Drops file in Program Files directory 3 IoCs

Processes:

e27edf9d8b28c3fb8252de326f538c77280c0d20e22181d27240cb14fb70e08c.exe

description	ioc	process
File created	C:\Program Files (x86)\Common Files\config\uninstinethnfd.exe	e27edf9d8b28c3fb8252de326f538c77280c0d20e22181d27240cb14fb70e08c.exe
File created	C:\Program Files (x86)\Common Files\Config\data.xml	e27edf9d8b28c3fb8252de326f538c77280c0d20e22181d27240cb14fb70e08c.exe
File created	C:\Program Files (x86)\Common Files\Config\ver.xml	e27edf9d8b28c3fb8252de326f538c77280c0d20e22181d27240cb14fb70e08c.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Runs net.exe
Suspicious behavior: LoadsDriver 1 IoCs

Processes:

pid process

464
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

nethtsrv.exe

description pid process

Token: SeDebugPrivilege 1912 nethtsrv.exe

pid	process
464

description	pid	process
Token: SeDebugPrivilege	1912	nethtsrv.exe

Suspicious use of WriteProcessMemory 50 IoCs

Processes:

e27edf9d8b28c3fb8252de326f538c77280c0d20e22181d27240cb14fb70e08c.exenet.exenet.exenet.exenet.exe

description	pid	process	target process
PID 1444 wrote to memory of 852	1444	e27edf9d8b28c3fb8252de326f538c77280c0d20e22181d27240cb14fb70e08c.exe	net.exe
PID 1444 wrote to memory of 852	1444	e27edf9d8b28c3fb8252de326f538c77280c0d20e22181d27240cb14fb70e08c.exe	net.exe
PID 1444 wrote to memory of 852	1444	e27edf9d8b28c3fb8252de326f538c77280c0d20e22181d27240cb14fb70e08c.exe	net.exe
PID 1444 wrote to memory of 852	1444	e27edf9d8b28c3fb8252de326f538c77280c0d20e22181d27240cb14fb70e08c.exe	net.exe
PID 852 wrote to memory of 1220	852	net.exe	net1.exe
PID 852 wrote to memory of 1220	852	net.exe	net1.exe
PID 852 wrote to memory of 1220	852	net.exe	net1.exe
PID 852 wrote to memory of 1220	852	net.exe	net1.exe
PID 1444 wrote to memory of 940	1444	e27edf9d8b28c3fb8252de326f538c77280c0d20e22181d27240cb14fb70e08c.exe	net.exe
PID 1444 wrote to memory of 940	1444	e27edf9d8b28c3fb8252de326f538c77280c0d20e22181d27240cb14fb70e08c.exe	net.exe
PID 1444 wrote to memory of 940	1444	e27edf9d8b28c3fb8252de326f538c77280c0d20e22181d27240cb14fb70e08c.exe	net.exe
PID 1444 wrote to memory of 940	1444	e27edf9d8b28c3fb8252de326f538c77280c0d20e22181d27240cb14fb70e08c.exe	net.exe
PID 940 wrote to memory of 2012	940	net.exe	net1.exe
PID 940 wrote to memory of 2012	940	net.exe	net1.exe
PID 940 wrote to memory of 2012	940	net.exe	net1.exe
PID 940 wrote to memory of 2012	940	net.exe	net1.exe
PID 1444 wrote to memory of 2024	1444	e27edf9d8b28c3fb8252de326f538c77280c0d20e22181d27240cb14fb70e08c.exe	installd.exe
PID 1444 wrote to memory of 2024	1444	e27edf9d8b28c3fb8252de326f538c77280c0d20e22181d27240cb14fb70e08c.exe	installd.exe
PID 1444 wrote to memory of 2024	1444	e27edf9d8b28c3fb8252de326f538c77280c0d20e22181d27240cb14fb70e08c.exe	installd.exe
PID 1444 wrote to memory of 2024	1444	e27edf9d8b28c3fb8252de326f538c77280c0d20e22181d27240cb14fb70e08c.exe	installd.exe
PID 1444 wrote to memory of 2024	1444	e27edf9d8b28c3fb8252de326f538c77280c0d20e22181d27240cb14fb70e08c.exe	installd.exe
PID 1444 wrote to memory of 2024	1444	e27edf9d8b28c3fb8252de326f538c77280c0d20e22181d27240cb14fb70e08c.exe	installd.exe
PID 1444 wrote to memory of 2024	1444	e27edf9d8b28c3fb8252de326f538c77280c0d20e22181d27240cb14fb70e08c.exe	installd.exe
PID 1444 wrote to memory of 1696	1444	e27edf9d8b28c3fb8252de326f538c77280c0d20e22181d27240cb14fb70e08c.exe	nethtsrv.exe
PID 1444 wrote to memory of 1696	1444	e27edf9d8b28c3fb8252de326f538c77280c0d20e22181d27240cb14fb70e08c.exe	nethtsrv.exe
PID 1444 wrote to memory of 1696	1444	e27edf9d8b28c3fb8252de326f538c77280c0d20e22181d27240cb14fb70e08c.exe	nethtsrv.exe
PID 1444 wrote to memory of 1696	1444	e27edf9d8b28c3fb8252de326f538c77280c0d20e22181d27240cb14fb70e08c.exe	nethtsrv.exe
PID 1444 wrote to memory of 1288	1444	e27edf9d8b28c3fb8252de326f538c77280c0d20e22181d27240cb14fb70e08c.exe	netupdsrv.exe
PID 1444 wrote to memory of 1288	1444	e27edf9d8b28c3fb8252de326f538c77280c0d20e22181d27240cb14fb70e08c.exe	netupdsrv.exe
PID 1444 wrote to memory of 1288	1444	e27edf9d8b28c3fb8252de326f538c77280c0d20e22181d27240cb14fb70e08c.exe	netupdsrv.exe
PID 1444 wrote to memory of 1288	1444	e27edf9d8b28c3fb8252de326f538c77280c0d20e22181d27240cb14fb70e08c.exe	netupdsrv.exe
PID 1444 wrote to memory of 1288	1444	e27edf9d8b28c3fb8252de326f538c77280c0d20e22181d27240cb14fb70e08c.exe	netupdsrv.exe
PID 1444 wrote to memory of 1288	1444	e27edf9d8b28c3fb8252de326f538c77280c0d20e22181d27240cb14fb70e08c.exe	netupdsrv.exe
PID 1444 wrote to memory of 1288	1444	e27edf9d8b28c3fb8252de326f538c77280c0d20e22181d27240cb14fb70e08c.exe	netupdsrv.exe
PID 1444 wrote to memory of 1932	1444	e27edf9d8b28c3fb8252de326f538c77280c0d20e22181d27240cb14fb70e08c.exe	net.exe
PID 1444 wrote to memory of 1932	1444	e27edf9d8b28c3fb8252de326f538c77280c0d20e22181d27240cb14fb70e08c.exe	net.exe
PID 1444 wrote to memory of 1932	1444	e27edf9d8b28c3fb8252de326f538c77280c0d20e22181d27240cb14fb70e08c.exe	net.exe
PID 1444 wrote to memory of 1932	1444	e27edf9d8b28c3fb8252de326f538c77280c0d20e22181d27240cb14fb70e08c.exe	net.exe
PID 1932 wrote to memory of 1944	1932	net.exe	net1.exe
PID 1932 wrote to memory of 1944	1932	net.exe	net1.exe
PID 1932 wrote to memory of 1944	1932	net.exe	net1.exe
PID 1932 wrote to memory of 1944	1932	net.exe	net1.exe
PID 1444 wrote to memory of 1844	1444	e27edf9d8b28c3fb8252de326f538c77280c0d20e22181d27240cb14fb70e08c.exe	net.exe
PID 1444 wrote to memory of 1844	1444	e27edf9d8b28c3fb8252de326f538c77280c0d20e22181d27240cb14fb70e08c.exe	net.exe
PID 1444 wrote to memory of 1844	1444	e27edf9d8b28c3fb8252de326f538c77280c0d20e22181d27240cb14fb70e08c.exe	net.exe
PID 1444 wrote to memory of 1844	1444	e27edf9d8b28c3fb8252de326f538c77280c0d20e22181d27240cb14fb70e08c.exe	net.exe
PID 1844 wrote to memory of 1320	1844	net.exe	net1.exe
PID 1844 wrote to memory of 1320	1844	net.exe	net1.exe
PID 1844 wrote to memory of 1320	1844	net.exe	net1.exe
PID 1844 wrote to memory of 1320	1844	net.exe	net1.exe

C:\Users\Admin\AppData\Local\Temp\e27edf9d8b28c3fb8252de326f538c77280c0d20e22181d27240cb14fb70e08c.exe
"C:\Users\Admin\AppData\Local\Temp\e27edf9d8b28c3fb8252de326f538c77280c0d20e22181d27240cb14fb70e08c.exe"
1⤵
- Drops file in Drivers directory
- Loads dropped DLL
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:1444

C:\Windows\SysWOW64\net.exe
net stop nethttpservice
2⤵
- Suspicious use of WriteProcessMemory
PID:852

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop nethttpservice
3⤵
PID:1220

C:\Windows\SysWOW64\net.exe
net stop serviceupdater
2⤵
- Suspicious use of WriteProcessMemory
PID:940

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop serviceupdater
3⤵
PID:2012

C:\Windows\SysWOW64\installd.exe
"C:\Windows\system32\installd.exe" nethfdrv
2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2024

C:\Windows\SysWOW64\nethtsrv.exe
"C:\Windows\system32\nethtsrv.exe" -nfdi
2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1696

C:\Windows\SysWOW64\netupdsrv.exe
"C:\Windows\system32\netupdsrv.exe" -nfdi
2⤵
- Executes dropped EXE
PID:1288

C:\Windows\SysWOW64\net.exe
net start nethttpservice
2⤵
- Suspicious use of WriteProcessMemory
PID:1932

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 start nethttpservice
3⤵
PID:1944

C:\Windows\SysWOW64\net.exe
net start serviceupdater
2⤵
- Suspicious use of WriteProcessMemory
PID:1844

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 start serviceupdater
3⤵
PID:1320

C:\Windows\SysWOW64\nethtsrv.exe
C:\Windows\SysWOW64\nethtsrv.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:1912

C:\Windows\SysWOW64\netupdsrv.exe
C:\Windows\SysWOW64\netupdsrv.exe
1⤵
- Executes dropped EXE
PID:524

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\hfnapi.dll
Filesize
106KB

MD5
658ceaf376e115205897f66617a43b5c

SHA1
4d75491e8ffb9ec325545812bca0bf0ac157a8b5

SHA256
445bbf3cda2b807218b0bf5d56b9a6bb225f78495e796e048b1c07d4cee83028

SHA512
a3f70f0c2cec7eca09b197b4e485bc82e78c66a057db50fdf7f35d4871c5c7ff57e97c6772983e71cbded48bd4fe688b212cc39086d1d8d59e67a4c32d7b5cda

Download Submit
C:\Windows\SysWOW64\hfpapi.dll
Filesize
244KB

MD5
768ed666f038272941d6e4d943e59f0b

SHA1
c364891c123d71783f57b2755e9dda8e65ae1231

SHA256
056fede5f3b20f76f804d39c15018825a08d8b4ceeac584fc2844377e084958e

SHA512
6827b24bff3a2527da6e7e6e7d5717eff886c8107f4163bfb5b2e1cbc6538b4bfffdf050c56fedd04f25f17059b093ffd7642cd72d0b89fabb17e47fc1fb48ef

Download Submit
C:\Windows\SysWOW64\installd.exe
Filesize
108KB

MD5
ee643598a478076f1de59d0f02c1ea6d

SHA1
141dfb857a416445e1a78e91aa4f3ecad047d1c8

SHA256
64968b5368b90ba1683c8156fbf4cc3cc928ac743cc47e3c15566b7ff8a7b018

SHA512
ccbc87ce1ffec7aa77e99f822fe65e4691400b3ddff750882bd68cb336f357b5d7d9d4bf1b62aa27cad03fec81f1f65fa175392ac8ce8b8e0f6e82e8b9c4c997

Download Submit
C:\Windows\SysWOW64\nethtsrv.exe
Filesize
176KB

MD5
37a0590d460d760151a2d6b2fb13ec06

SHA1
d09461e435447908459d908cdb8c28e095699afd

SHA256
6c9b9e1d2af8a8b0ff5822c119c78519018d4d75299ef48ff33e8022b172a54c

SHA512
ccd1b27440d135230f3879f2c6d57356a3196ac9c163d2a9524e788676c5df4fd0cbda91f13cc65f48c6d68e8c5c458e2627319c660be86e0125b1cbc18f22d8

Download Submit
C:\Windows\SysWOW64\nethtsrv.exe
Filesize
176KB

MD5
37a0590d460d760151a2d6b2fb13ec06

SHA1
d09461e435447908459d908cdb8c28e095699afd

SHA256
6c9b9e1d2af8a8b0ff5822c119c78519018d4d75299ef48ff33e8022b172a54c

SHA512
ccd1b27440d135230f3879f2c6d57356a3196ac9c163d2a9524e788676c5df4fd0cbda91f13cc65f48c6d68e8c5c458e2627319c660be86e0125b1cbc18f22d8

Download Submit
C:\Windows\SysWOW64\netupdsrv.exe
Filesize
158KB

MD5
679a0f9754a17d27d0f114868c8bc116

SHA1
23ba2cba107356f69101a90bdffa048070f0a05e

SHA256
34c712c9c6a3179ec2fed3b932847435c7970da28d5447723608540c468e08a6

SHA512
9d2b2806807ae25bf8695e6aea78f8c7f94e9f6fd58e8e7a3682a11808e1a1a7f3790fc297f910a3549eaa03471579453d16bb4d686587d4b71078c768e4169a

Download Submit
C:\Windows\SysWOW64\netupdsrv.exe
Filesize
158KB

MD5
679a0f9754a17d27d0f114868c8bc116

SHA1
23ba2cba107356f69101a90bdffa048070f0a05e

SHA256
34c712c9c6a3179ec2fed3b932847435c7970da28d5447723608540c468e08a6

SHA512
9d2b2806807ae25bf8695e6aea78f8c7f94e9f6fd58e8e7a3682a11808e1a1a7f3790fc297f910a3549eaa03471579453d16bb4d686587d4b71078c768e4169a

Download Submit
\Users\Admin\AppData\Local\Temp\nsoBE6.tmp\System.dll
Filesize
11KB

MD5
c17103ae9072a06da581dec998343fc1

SHA1
b72148c6bdfaada8b8c3f950e610ee7cf1da1f8d

SHA256
dc58d8ad81cacb0c1ed72e33bff8f23ea40b5252b5bb55d393a0903e6819ae2f

SHA512
d32a71aaef18e993f28096d536e41c4d016850721b31171513ce28bbd805a54fd290b7c3e9d935f72e676a1acfb4f0dcc89d95040a0dd29f2b6975855c18986f

Download Submit
\Users\Admin\AppData\Local\Temp\nsoBE6.tmp\nsExec.dll
Filesize
6KB

MD5
acc2b699edfea5bf5aae45aba3a41e96

SHA1
d2accf4d494e43ceb2cff69abe4dd17147d29cc2

SHA256
168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e

SHA512
e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe

Download Submit
\Users\Admin\AppData\Local\Temp\nsoBE6.tmp\nsExec.dll
Filesize
6KB

MD5
acc2b699edfea5bf5aae45aba3a41e96

SHA1
d2accf4d494e43ceb2cff69abe4dd17147d29cc2

SHA256
168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e

SHA512
e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe

Download Submit
\Users\Admin\AppData\Local\Temp\nsoBE6.tmp\nsExec.dll
Filesize
6KB

MD5
acc2b699edfea5bf5aae45aba3a41e96

SHA1
d2accf4d494e43ceb2cff69abe4dd17147d29cc2

SHA256
168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e

SHA512
e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe

Download Submit
\Users\Admin\AppData\Local\Temp\nsoBE6.tmp\nsExec.dll
Filesize
6KB

MD5
acc2b699edfea5bf5aae45aba3a41e96

SHA1
d2accf4d494e43ceb2cff69abe4dd17147d29cc2

SHA256
168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e

SHA512
e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe

Download Submit
\Windows\SysWOW64\hfnapi.dll
Filesize
106KB

MD5
658ceaf376e115205897f66617a43b5c

SHA1
4d75491e8ffb9ec325545812bca0bf0ac157a8b5

SHA256
445bbf3cda2b807218b0bf5d56b9a6bb225f78495e796e048b1c07d4cee83028

SHA512
a3f70f0c2cec7eca09b197b4e485bc82e78c66a057db50fdf7f35d4871c5c7ff57e97c6772983e71cbded48bd4fe688b212cc39086d1d8d59e67a4c32d7b5cda

Download Submit
\Windows\SysWOW64\hfnapi.dll
Filesize
106KB

MD5
658ceaf376e115205897f66617a43b5c

SHA1
4d75491e8ffb9ec325545812bca0bf0ac157a8b5

SHA256
445bbf3cda2b807218b0bf5d56b9a6bb225f78495e796e048b1c07d4cee83028

SHA512
a3f70f0c2cec7eca09b197b4e485bc82e78c66a057db50fdf7f35d4871c5c7ff57e97c6772983e71cbded48bd4fe688b212cc39086d1d8d59e67a4c32d7b5cda

Download Submit
\Windows\SysWOW64\hfnapi.dll
Filesize
106KB

MD5
658ceaf376e115205897f66617a43b5c

SHA1
4d75491e8ffb9ec325545812bca0bf0ac157a8b5

SHA256
445bbf3cda2b807218b0bf5d56b9a6bb225f78495e796e048b1c07d4cee83028

SHA512
a3f70f0c2cec7eca09b197b4e485bc82e78c66a057db50fdf7f35d4871c5c7ff57e97c6772983e71cbded48bd4fe688b212cc39086d1d8d59e67a4c32d7b5cda

Download Submit
\Windows\SysWOW64\hfpapi.dll
Filesize
244KB

MD5
768ed666f038272941d6e4d943e59f0b

SHA1
c364891c123d71783f57b2755e9dda8e65ae1231

SHA256
056fede5f3b20f76f804d39c15018825a08d8b4ceeac584fc2844377e084958e

SHA512
6827b24bff3a2527da6e7e6e7d5717eff886c8107f4163bfb5b2e1cbc6538b4bfffdf050c56fedd04f25f17059b093ffd7642cd72d0b89fabb17e47fc1fb48ef

Download Submit
\Windows\SysWOW64\hfpapi.dll
Filesize
244KB

MD5
768ed666f038272941d6e4d943e59f0b

SHA1
c364891c123d71783f57b2755e9dda8e65ae1231

SHA256
056fede5f3b20f76f804d39c15018825a08d8b4ceeac584fc2844377e084958e

SHA512
6827b24bff3a2527da6e7e6e7d5717eff886c8107f4163bfb5b2e1cbc6538b4bfffdf050c56fedd04f25f17059b093ffd7642cd72d0b89fabb17e47fc1fb48ef

Download Submit
\Windows\SysWOW64\installd.exe
Filesize
108KB

MD5
ee643598a478076f1de59d0f02c1ea6d

SHA1
141dfb857a416445e1a78e91aa4f3ecad047d1c8

SHA256
64968b5368b90ba1683c8156fbf4cc3cc928ac743cc47e3c15566b7ff8a7b018

SHA512
ccbc87ce1ffec7aa77e99f822fe65e4691400b3ddff750882bd68cb336f357b5d7d9d4bf1b62aa27cad03fec81f1f65fa175392ac8ce8b8e0f6e82e8b9c4c997

Download Submit
\Windows\SysWOW64\nethtsrv.exe
Filesize
176KB

MD5
37a0590d460d760151a2d6b2fb13ec06

SHA1
d09461e435447908459d908cdb8c28e095699afd

SHA256
6c9b9e1d2af8a8b0ff5822c119c78519018d4d75299ef48ff33e8022b172a54c

SHA512
ccd1b27440d135230f3879f2c6d57356a3196ac9c163d2a9524e788676c5df4fd0cbda91f13cc65f48c6d68e8c5c458e2627319c660be86e0125b1cbc18f22d8

Download Submit
\Windows\SysWOW64\netupdsrv.exe
Filesize
158KB

MD5
679a0f9754a17d27d0f114868c8bc116

SHA1
23ba2cba107356f69101a90bdffa048070f0a05e

SHA256
34c712c9c6a3179ec2fed3b932847435c7970da28d5447723608540c468e08a6

SHA512
9d2b2806807ae25bf8695e6aea78f8c7f94e9f6fd58e8e7a3682a11808e1a1a7f3790fc297f910a3549eaa03471579453d16bb4d686587d4b71078c768e4169a

Download Submit
memory/852-57-0x0000000000000000-mapping.dmp

Download
memory/940-60-0x0000000000000000-mapping.dmp

Download
memory/1220-58-0x0000000000000000-mapping.dmp

Download
memory/1288-75-0x0000000000000000-mapping.dmp

Download
memory/1320-86-0x0000000000000000-mapping.dmp

Download
memory/1444-54-0x0000000075ED1000-0x0000000075ED3000-memory.dmp

Filesize
8KB

Download
memory/1696-69-0x0000000000000000-mapping.dmp

Download
memory/1844-85-0x0000000000000000-mapping.dmp

Download
memory/1932-79-0x0000000000000000-mapping.dmp

Download
memory/1944-80-0x0000000000000000-mapping.dmp

Download
memory/2012-61-0x0000000000000000-mapping.dmp

Download
memory/2024-63-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads