bad017ca25e291169c5d11ad5643eba075ef30720b4b000b56b82187ff8dc55b

Analysis

max time kernel
28s
max time network
47s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
23-11-2022 10:52

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

bad017ca25e291169c5d11ad5643eba075ef30720b4b000b56b82187ff8dc55b.exe
Size

445KB
MD5

571f8a1975b2fd893a4250e9bb569cbc
SHA1

8b5ee41a68c23fa4ca047fae20e38f394bf76af7
SHA256

bad017ca25e291169c5d11ad5643eba075ef30720b4b000b56b82187ff8dc55b
SHA512

411d1709cb13af6f317feba4ecea009e25641af2fd40a231a5bb8bb68d8c2dbd55129b66d02eea3db7e5333fb1a2034748d64b21e58d1e8ac4260563b83904a9
SSDEEP

12288:0AkCxDIyBTW5kSaTAYN2ro4NJTh0ycFd2bH/nAbvK:0A9ZkkSaf0rD7Th2FIbfnkvK

Score

8^/10

discovery

Malware Config

Signatures

Drops file in Drivers directory 1 IoCs

Processes:

bad017ca25e291169c5d11ad5643eba075ef30720b4b000b56b82187ff8dc55b.exe

description ioc process

File created C:\Windows\system32\drivers\nethfdrv.sys bad017ca25e291169c5d11ad5643eba075ef30720b4b000b56b82187ff8dc55b.exe
Executes dropped EXE 5 IoCs

Processes:

installd.exenethtsrv.exenetupdsrv.exenethtsrv.exenetupdsrv.exe

pid process

1888 installd.exe
1012 nethtsrv.exe
1516 netupdsrv.exe
1124 nethtsrv.exe
804 netupdsrv.exe

description	ioc	process
File created	C:\Windows\system32\drivers\nethfdrv.sys	bad017ca25e291169c5d11ad5643eba075ef30720b4b000b56b82187ff8dc55b.exe

pid	process
1888	installd.exe
1012	nethtsrv.exe
1516	netupdsrv.exe
1124	nethtsrv.exe
804	netupdsrv.exe

Loads dropped DLL 13 IoCs

Processes:

bad017ca25e291169c5d11ad5643eba075ef30720b4b000b56b82187ff8dc55b.exeinstalld.exenethtsrv.exenethtsrv.exe

pid	process
668	bad017ca25e291169c5d11ad5643eba075ef30720b4b000b56b82187ff8dc55b.exe
668	bad017ca25e291169c5d11ad5643eba075ef30720b4b000b56b82187ff8dc55b.exe
668	bad017ca25e291169c5d11ad5643eba075ef30720b4b000b56b82187ff8dc55b.exe
668	bad017ca25e291169c5d11ad5643eba075ef30720b4b000b56b82187ff8dc55b.exe
1888	installd.exe
668	bad017ca25e291169c5d11ad5643eba075ef30720b4b000b56b82187ff8dc55b.exe
1012	nethtsrv.exe
1012	nethtsrv.exe
668	bad017ca25e291169c5d11ad5643eba075ef30720b4b000b56b82187ff8dc55b.exe
668	bad017ca25e291169c5d11ad5643eba075ef30720b4b000b56b82187ff8dc55b.exe
1124	nethtsrv.exe
1124	nethtsrv.exe
668	bad017ca25e291169c5d11ad5643eba075ef30720b4b000b56b82187ff8dc55b.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in System32 directory 5 IoCs

Processes:

bad017ca25e291169c5d11ad5643eba075ef30720b4b000b56b82187ff8dc55b.exe

description	ioc	process
File created	C:\Windows\SysWOW64\netupdsrv.exe	bad017ca25e291169c5d11ad5643eba075ef30720b4b000b56b82187ff8dc55b.exe
File created	C:\Windows\SysWOW64\hfnapi.dll	bad017ca25e291169c5d11ad5643eba075ef30720b4b000b56b82187ff8dc55b.exe
File created	C:\Windows\SysWOW64\hfpapi.dll	bad017ca25e291169c5d11ad5643eba075ef30720b4b000b56b82187ff8dc55b.exe
File created	C:\Windows\SysWOW64\installd.exe	bad017ca25e291169c5d11ad5643eba075ef30720b4b000b56b82187ff8dc55b.exe
File created	C:\Windows\SysWOW64\nethtsrv.exe	bad017ca25e291169c5d11ad5643eba075ef30720b4b000b56b82187ff8dc55b.exe

Drops file in Program Files directory 3 IoCs

Processes:

bad017ca25e291169c5d11ad5643eba075ef30720b4b000b56b82187ff8dc55b.exe

description	ioc	process
File created	C:\Program Files (x86)\Common Files\Config\ver.xml	bad017ca25e291169c5d11ad5643eba075ef30720b4b000b56b82187ff8dc55b.exe
File created	C:\Program Files (x86)\Common Files\config\uninstinethnfd.exe	bad017ca25e291169c5d11ad5643eba075ef30720b4b000b56b82187ff8dc55b.exe
File created	C:\Program Files (x86)\Common Files\Config\data.xml	bad017ca25e291169c5d11ad5643eba075ef30720b4b000b56b82187ff8dc55b.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Runs net.exe
Suspicious behavior: LoadsDriver 1 IoCs

Processes:

pid process

460
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

nethtsrv.exe

description pid process

Token: SeDebugPrivilege 1124 nethtsrv.exe

pid	process
460

description	pid	process
Token: SeDebugPrivilege	1124	nethtsrv.exe

Suspicious use of WriteProcessMemory 50 IoCs

Processes:

bad017ca25e291169c5d11ad5643eba075ef30720b4b000b56b82187ff8dc55b.exenet.exenet.exenet.exenet.exe

description	pid	process	target process
PID 668 wrote to memory of 940	668	bad017ca25e291169c5d11ad5643eba075ef30720b4b000b56b82187ff8dc55b.exe	net.exe
PID 668 wrote to memory of 940	668	bad017ca25e291169c5d11ad5643eba075ef30720b4b000b56b82187ff8dc55b.exe	net.exe
PID 668 wrote to memory of 940	668	bad017ca25e291169c5d11ad5643eba075ef30720b4b000b56b82187ff8dc55b.exe	net.exe
PID 668 wrote to memory of 940	668	bad017ca25e291169c5d11ad5643eba075ef30720b4b000b56b82187ff8dc55b.exe	net.exe
PID 940 wrote to memory of 1076	940	net.exe	net1.exe
PID 940 wrote to memory of 1076	940	net.exe	net1.exe
PID 940 wrote to memory of 1076	940	net.exe	net1.exe
PID 940 wrote to memory of 1076	940	net.exe	net1.exe
PID 668 wrote to memory of 1080	668	bad017ca25e291169c5d11ad5643eba075ef30720b4b000b56b82187ff8dc55b.exe	net.exe
PID 668 wrote to memory of 1080	668	bad017ca25e291169c5d11ad5643eba075ef30720b4b000b56b82187ff8dc55b.exe	net.exe
PID 668 wrote to memory of 1080	668	bad017ca25e291169c5d11ad5643eba075ef30720b4b000b56b82187ff8dc55b.exe	net.exe
PID 668 wrote to memory of 1080	668	bad017ca25e291169c5d11ad5643eba075ef30720b4b000b56b82187ff8dc55b.exe	net.exe
PID 1080 wrote to memory of 816	1080	net.exe	net1.exe
PID 1080 wrote to memory of 816	1080	net.exe	net1.exe
PID 1080 wrote to memory of 816	1080	net.exe	net1.exe
PID 1080 wrote to memory of 816	1080	net.exe	net1.exe
PID 668 wrote to memory of 1888	668	bad017ca25e291169c5d11ad5643eba075ef30720b4b000b56b82187ff8dc55b.exe	installd.exe
PID 668 wrote to memory of 1888	668	bad017ca25e291169c5d11ad5643eba075ef30720b4b000b56b82187ff8dc55b.exe	installd.exe
PID 668 wrote to memory of 1888	668	bad017ca25e291169c5d11ad5643eba075ef30720b4b000b56b82187ff8dc55b.exe	installd.exe
PID 668 wrote to memory of 1888	668	bad017ca25e291169c5d11ad5643eba075ef30720b4b000b56b82187ff8dc55b.exe	installd.exe
PID 668 wrote to memory of 1888	668	bad017ca25e291169c5d11ad5643eba075ef30720b4b000b56b82187ff8dc55b.exe	installd.exe
PID 668 wrote to memory of 1888	668	bad017ca25e291169c5d11ad5643eba075ef30720b4b000b56b82187ff8dc55b.exe	installd.exe
PID 668 wrote to memory of 1888	668	bad017ca25e291169c5d11ad5643eba075ef30720b4b000b56b82187ff8dc55b.exe	installd.exe
PID 668 wrote to memory of 1012	668	bad017ca25e291169c5d11ad5643eba075ef30720b4b000b56b82187ff8dc55b.exe	nethtsrv.exe
PID 668 wrote to memory of 1012	668	bad017ca25e291169c5d11ad5643eba075ef30720b4b000b56b82187ff8dc55b.exe	nethtsrv.exe
PID 668 wrote to memory of 1012	668	bad017ca25e291169c5d11ad5643eba075ef30720b4b000b56b82187ff8dc55b.exe	nethtsrv.exe
PID 668 wrote to memory of 1012	668	bad017ca25e291169c5d11ad5643eba075ef30720b4b000b56b82187ff8dc55b.exe	nethtsrv.exe
PID 668 wrote to memory of 1516	668	bad017ca25e291169c5d11ad5643eba075ef30720b4b000b56b82187ff8dc55b.exe	netupdsrv.exe
PID 668 wrote to memory of 1516	668	bad017ca25e291169c5d11ad5643eba075ef30720b4b000b56b82187ff8dc55b.exe	netupdsrv.exe
PID 668 wrote to memory of 1516	668	bad017ca25e291169c5d11ad5643eba075ef30720b4b000b56b82187ff8dc55b.exe	netupdsrv.exe
PID 668 wrote to memory of 1516	668	bad017ca25e291169c5d11ad5643eba075ef30720b4b000b56b82187ff8dc55b.exe	netupdsrv.exe
PID 668 wrote to memory of 1516	668	bad017ca25e291169c5d11ad5643eba075ef30720b4b000b56b82187ff8dc55b.exe	netupdsrv.exe
PID 668 wrote to memory of 1516	668	bad017ca25e291169c5d11ad5643eba075ef30720b4b000b56b82187ff8dc55b.exe	netupdsrv.exe
PID 668 wrote to memory of 1516	668	bad017ca25e291169c5d11ad5643eba075ef30720b4b000b56b82187ff8dc55b.exe	netupdsrv.exe
PID 668 wrote to memory of 1968	668	bad017ca25e291169c5d11ad5643eba075ef30720b4b000b56b82187ff8dc55b.exe	net.exe
PID 668 wrote to memory of 1968	668	bad017ca25e291169c5d11ad5643eba075ef30720b4b000b56b82187ff8dc55b.exe	net.exe
PID 668 wrote to memory of 1968	668	bad017ca25e291169c5d11ad5643eba075ef30720b4b000b56b82187ff8dc55b.exe	net.exe
PID 668 wrote to memory of 1968	668	bad017ca25e291169c5d11ad5643eba075ef30720b4b000b56b82187ff8dc55b.exe	net.exe
PID 1968 wrote to memory of 1988	1968	net.exe	net1.exe
PID 1968 wrote to memory of 1988	1968	net.exe	net1.exe
PID 1968 wrote to memory of 1988	1968	net.exe	net1.exe
PID 1968 wrote to memory of 1988	1968	net.exe	net1.exe
PID 668 wrote to memory of 1404	668	bad017ca25e291169c5d11ad5643eba075ef30720b4b000b56b82187ff8dc55b.exe	net.exe
PID 668 wrote to memory of 1404	668	bad017ca25e291169c5d11ad5643eba075ef30720b4b000b56b82187ff8dc55b.exe	net.exe
PID 668 wrote to memory of 1404	668	bad017ca25e291169c5d11ad5643eba075ef30720b4b000b56b82187ff8dc55b.exe	net.exe
PID 668 wrote to memory of 1404	668	bad017ca25e291169c5d11ad5643eba075ef30720b4b000b56b82187ff8dc55b.exe	net.exe
PID 1404 wrote to memory of 1152	1404	net.exe	net1.exe
PID 1404 wrote to memory of 1152	1404	net.exe	net1.exe
PID 1404 wrote to memory of 1152	1404	net.exe	net1.exe
PID 1404 wrote to memory of 1152	1404	net.exe	net1.exe

C:\Users\Admin\AppData\Local\Temp\bad017ca25e291169c5d11ad5643eba075ef30720b4b000b56b82187ff8dc55b.exe
"C:\Users\Admin\AppData\Local\Temp\bad017ca25e291169c5d11ad5643eba075ef30720b4b000b56b82187ff8dc55b.exe"
1⤵
- Drops file in Drivers directory
- Loads dropped DLL
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:668

C:\Windows\SysWOW64\net.exe
net stop nethttpservice
2⤵
- Suspicious use of WriteProcessMemory
PID:940

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop nethttpservice
3⤵
PID:1076

C:\Windows\SysWOW64\net.exe
net stop serviceupdater
2⤵
- Suspicious use of WriteProcessMemory
PID:1080

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop serviceupdater
3⤵
PID:816

C:\Windows\SysWOW64\installd.exe
"C:\Windows\system32\installd.exe" nethfdrv
2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1888

C:\Windows\SysWOW64\nethtsrv.exe
"C:\Windows\system32\nethtsrv.exe" -nfdi
2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1012

C:\Windows\SysWOW64\netupdsrv.exe
"C:\Windows\system32\netupdsrv.exe" -nfdi
2⤵
- Executes dropped EXE
PID:1516

C:\Windows\SysWOW64\net.exe
net start nethttpservice
2⤵
- Suspicious use of WriteProcessMemory
PID:1968

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 start nethttpservice
3⤵
PID:1988

C:\Windows\SysWOW64\net.exe
net start serviceupdater
2⤵
- Suspicious use of WriteProcessMemory
PID:1404

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 start serviceupdater
3⤵
PID:1152

C:\Windows\SysWOW64\nethtsrv.exe
C:\Windows\SysWOW64\nethtsrv.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:1124

C:\Windows\SysWOW64\netupdsrv.exe
C:\Windows\SysWOW64\netupdsrv.exe
1⤵
- Executes dropped EXE
PID:804

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\hfnapi.dll
Filesize
106KB

MD5
2310b93a4a46e58f99309189290da42b

SHA1
8f5f748d2cd10e5329928971b73f70f647064732

SHA256
c77fd4e1078f3bab3d55455e0b248f9c20c618b66420004fab723bc6dbeb0ca4

SHA512
87eaedda15df2e91dd7a74c299b2a1efb0e49d21a0a515d8891913091ec1bb66b8b6f74027c1f5e2d7346fbfa394304fcd96421c3e9c124517b404d193b33aed

Download Submit
C:\Windows\SysWOW64\hfpapi.dll
Filesize
241KB

MD5
e60472766dc01bd0099a4e00a2b1797a

SHA1
318b2be26bf4fd2af7108e701dfde2023ceb17e5

SHA256
f9a29b82cb2215a4387b5057cf0fa0001949971487ae5f22a336a5861e3bfb9e

SHA512
f7750deb46b63cbe0ec38e1f46bed9f0e5e1d54f54f4dae074b5792fe47957213e61f6fb3feb922d4c8a9087ff050726cabc5eb51d48fa9891ac6e13d1434ff2

Download Submit
C:\Windows\SysWOW64\installd.exe
Filesize
108KB

MD5
36875ad4ecf27af97dd29396837a51e2

SHA1
040563c8e286cefd6b4a3cd51ca6b3317f3029a5

SHA256
cc9b2360184f1563f751f0b9ac24d1d70d45fcf52c498180d78d433f6ac49fce

SHA512
d77a485ca77557f7748a620612fd66d6cb2419bfacd6183612a3e3d6c27c25ea46a7846f075ae86d8feae14480209e4f1b615fcf9625324b84f7fceb16b5c772

Download Submit
C:\Windows\SysWOW64\nethtsrv.exe
Filesize
176KB

MD5
063df976d9453cf51054cd545ff20212

SHA1
eb286c9ab170387923f77a76209eff708cbd7c9b

SHA256
67181e41f16e7eab87c24f4b7cb9c7f668a27bb6602ae89f60904016ea7ce454

SHA512
44aa18f308c22b5e8bff32c370eb55eac905b14cfa43394b77fae37bbf09c5a560e6bf8bc40faa3d5b5a111b25b634046ba9f440c043cf2f81c3c51b405bf460

Download Submit
C:\Windows\SysWOW64\nethtsrv.exe
Filesize
176KB

MD5
063df976d9453cf51054cd545ff20212

SHA1
eb286c9ab170387923f77a76209eff708cbd7c9b

SHA256
67181e41f16e7eab87c24f4b7cb9c7f668a27bb6602ae89f60904016ea7ce454

SHA512
44aa18f308c22b5e8bff32c370eb55eac905b14cfa43394b77fae37bbf09c5a560e6bf8bc40faa3d5b5a111b25b634046ba9f440c043cf2f81c3c51b405bf460

Download Submit
C:\Windows\SysWOW64\netupdsrv.exe
Filesize
159KB

MD5
adfcac1b909fd32ef163fbc84619d727

SHA1
24cfe7df0ebc57544235a5e35698267e1856cbed

SHA256
83aa78e07061673a27b23b11fd77efd276f7e9a3a0b1b5304c2d714b30264da3

SHA512
f4e525ffc1df4e624344c13d1abdad7a4fea710b87879524ead60b97a4a095ef9969abe934726b33f3be2c0c94032bc73e93008c5f3063a5652822574c3afadd

Download Submit
C:\Windows\SysWOW64\netupdsrv.exe
Filesize
159KB

MD5
adfcac1b909fd32ef163fbc84619d727

SHA1
24cfe7df0ebc57544235a5e35698267e1856cbed

SHA256
83aa78e07061673a27b23b11fd77efd276f7e9a3a0b1b5304c2d714b30264da3

SHA512
f4e525ffc1df4e624344c13d1abdad7a4fea710b87879524ead60b97a4a095ef9969abe934726b33f3be2c0c94032bc73e93008c5f3063a5652822574c3afadd

Download Submit
\Users\Admin\AppData\Local\Temp\nst3269.tmp\System.dll
Filesize
11KB

MD5
c17103ae9072a06da581dec998343fc1

SHA1
b72148c6bdfaada8b8c3f950e610ee7cf1da1f8d

SHA256
dc58d8ad81cacb0c1ed72e33bff8f23ea40b5252b5bb55d393a0903e6819ae2f

SHA512
d32a71aaef18e993f28096d536e41c4d016850721b31171513ce28bbd805a54fd290b7c3e9d935f72e676a1acfb4f0dcc89d95040a0dd29f2b6975855c18986f

Download Submit
\Users\Admin\AppData\Local\Temp\nst3269.tmp\nsExec.dll
Filesize
6KB

MD5
acc2b699edfea5bf5aae45aba3a41e96

SHA1
d2accf4d494e43ceb2cff69abe4dd17147d29cc2

SHA256
168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e

SHA512
e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe

Download Submit
\Users\Admin\AppData\Local\Temp\nst3269.tmp\nsExec.dll
Filesize
6KB

MD5
acc2b699edfea5bf5aae45aba3a41e96

SHA1
d2accf4d494e43ceb2cff69abe4dd17147d29cc2

SHA256
168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e

SHA512
e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe

Download Submit
\Users\Admin\AppData\Local\Temp\nst3269.tmp\nsExec.dll
Filesize
6KB

MD5
acc2b699edfea5bf5aae45aba3a41e96

SHA1
d2accf4d494e43ceb2cff69abe4dd17147d29cc2

SHA256
168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e

SHA512
e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe

Download Submit
\Users\Admin\AppData\Local\Temp\nst3269.tmp\nsExec.dll
Filesize
6KB

MD5
acc2b699edfea5bf5aae45aba3a41e96

SHA1
d2accf4d494e43ceb2cff69abe4dd17147d29cc2

SHA256
168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e

SHA512
e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe

Download Submit
\Windows\SysWOW64\hfnapi.dll
Filesize
106KB

MD5
2310b93a4a46e58f99309189290da42b

SHA1
8f5f748d2cd10e5329928971b73f70f647064732

SHA256
c77fd4e1078f3bab3d55455e0b248f9c20c618b66420004fab723bc6dbeb0ca4

SHA512
87eaedda15df2e91dd7a74c299b2a1efb0e49d21a0a515d8891913091ec1bb66b8b6f74027c1f5e2d7346fbfa394304fcd96421c3e9c124517b404d193b33aed

Download Submit
\Windows\SysWOW64\hfnapi.dll
Filesize
106KB

MD5
2310b93a4a46e58f99309189290da42b

SHA1
8f5f748d2cd10e5329928971b73f70f647064732

SHA256
c77fd4e1078f3bab3d55455e0b248f9c20c618b66420004fab723bc6dbeb0ca4

SHA512
87eaedda15df2e91dd7a74c299b2a1efb0e49d21a0a515d8891913091ec1bb66b8b6f74027c1f5e2d7346fbfa394304fcd96421c3e9c124517b404d193b33aed

Download Submit
\Windows\SysWOW64\hfnapi.dll
Filesize
106KB

MD5
2310b93a4a46e58f99309189290da42b

SHA1
8f5f748d2cd10e5329928971b73f70f647064732

SHA256
c77fd4e1078f3bab3d55455e0b248f9c20c618b66420004fab723bc6dbeb0ca4

SHA512
87eaedda15df2e91dd7a74c299b2a1efb0e49d21a0a515d8891913091ec1bb66b8b6f74027c1f5e2d7346fbfa394304fcd96421c3e9c124517b404d193b33aed

Download Submit
\Windows\SysWOW64\hfpapi.dll
Filesize
241KB

MD5
e60472766dc01bd0099a4e00a2b1797a

SHA1
318b2be26bf4fd2af7108e701dfde2023ceb17e5

SHA256
f9a29b82cb2215a4387b5057cf0fa0001949971487ae5f22a336a5861e3bfb9e

SHA512
f7750deb46b63cbe0ec38e1f46bed9f0e5e1d54f54f4dae074b5792fe47957213e61f6fb3feb922d4c8a9087ff050726cabc5eb51d48fa9891ac6e13d1434ff2

Download Submit
\Windows\SysWOW64\hfpapi.dll
Filesize
241KB

MD5
e60472766dc01bd0099a4e00a2b1797a

SHA1
318b2be26bf4fd2af7108e701dfde2023ceb17e5

SHA256
f9a29b82cb2215a4387b5057cf0fa0001949971487ae5f22a336a5861e3bfb9e

SHA512
f7750deb46b63cbe0ec38e1f46bed9f0e5e1d54f54f4dae074b5792fe47957213e61f6fb3feb922d4c8a9087ff050726cabc5eb51d48fa9891ac6e13d1434ff2

Download Submit
\Windows\SysWOW64\installd.exe
Filesize
108KB

MD5
36875ad4ecf27af97dd29396837a51e2

SHA1
040563c8e286cefd6b4a3cd51ca6b3317f3029a5

SHA256
cc9b2360184f1563f751f0b9ac24d1d70d45fcf52c498180d78d433f6ac49fce

SHA512
d77a485ca77557f7748a620612fd66d6cb2419bfacd6183612a3e3d6c27c25ea46a7846f075ae86d8feae14480209e4f1b615fcf9625324b84f7fceb16b5c772

Download Submit
\Windows\SysWOW64\nethtsrv.exe
Filesize
176KB

MD5
063df976d9453cf51054cd545ff20212

SHA1
eb286c9ab170387923f77a76209eff708cbd7c9b

SHA256
67181e41f16e7eab87c24f4b7cb9c7f668a27bb6602ae89f60904016ea7ce454

SHA512
44aa18f308c22b5e8bff32c370eb55eac905b14cfa43394b77fae37bbf09c5a560e6bf8bc40faa3d5b5a111b25b634046ba9f440c043cf2f81c3c51b405bf460

Download Submit
\Windows\SysWOW64\netupdsrv.exe
Filesize
159KB

MD5
adfcac1b909fd32ef163fbc84619d727

SHA1
24cfe7df0ebc57544235a5e35698267e1856cbed

SHA256
83aa78e07061673a27b23b11fd77efd276f7e9a3a0b1b5304c2d714b30264da3

SHA512
f4e525ffc1df4e624344c13d1abdad7a4fea710b87879524ead60b97a4a095ef9969abe934726b33f3be2c0c94032bc73e93008c5f3063a5652822574c3afadd

Download Submit
memory/668-54-0x0000000075981000-0x0000000075983000-memory.dmp

Filesize
8KB

Download
memory/816-61-0x0000000000000000-mapping.dmp

Download
memory/940-57-0x0000000000000000-mapping.dmp

Download
memory/1012-69-0x0000000000000000-mapping.dmp

Download
memory/1076-58-0x0000000000000000-mapping.dmp

Download
memory/1080-60-0x0000000000000000-mapping.dmp

Download
memory/1152-86-0x0000000000000000-mapping.dmp

Download
memory/1404-85-0x0000000000000000-mapping.dmp

Download
memory/1516-75-0x0000000000000000-mapping.dmp

Download
memory/1888-63-0x0000000000000000-mapping.dmp

Download
memory/1968-79-0x0000000000000000-mapping.dmp

Download
memory/1988-80-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads