7c8d511a7cedbf9007f2facc3484e3647fb5d8bd17eb1c6bfcbae52f60f8c9f6

Analysis

max time kernel
101s
max time network
35s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
23-11-2022 10:55

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

7c8d511a7cedbf9007f2facc3484e3647fb5d8bd17eb1c6bfcbae52f60f8c9f6.exe
Size

446KB
MD5

e1b045acd4958b17581e0efc4b6d88ae
SHA1

b2ebf3f0237bdacaf1258abcd9704d63365a6306
SHA256

7c8d511a7cedbf9007f2facc3484e3647fb5d8bd17eb1c6bfcbae52f60f8c9f6
SHA512

7edafc14557cb9e7a87634828ab41ac8540aca8a003b6a666341eb4795b37f4d460518d1f67b7864a89329392c1db7af3956970df6f30c6d0f0312ee2fbbef93
SSDEEP

12288:5kqUb1vztYsRiMo9RrZQfDlrOXV+KQK0zrx:5hAYsE9IB6XVYFzrx

Score

8^/10

discovery

Malware Config

Signatures

Drops file in Drivers directory 1 IoCs

Processes:

7c8d511a7cedbf9007f2facc3484e3647fb5d8bd17eb1c6bfcbae52f60f8c9f6.exe

description ioc process

File created C:\Windows\system32\drivers\nethfdrv.sys 7c8d511a7cedbf9007f2facc3484e3647fb5d8bd17eb1c6bfcbae52f60f8c9f6.exe
Executes dropped EXE 5 IoCs

Processes:

installd.exenethtsrv.exenetupdsrv.exenethtsrv.exenetupdsrv.exe

pid process

732 installd.exe
796 nethtsrv.exe
1660 netupdsrv.exe
696 nethtsrv.exe
1308 netupdsrv.exe

description	ioc	process
File created	C:\Windows\system32\drivers\nethfdrv.sys	7c8d511a7cedbf9007f2facc3484e3647fb5d8bd17eb1c6bfcbae52f60f8c9f6.exe

pid	process
732	installd.exe
796	nethtsrv.exe
1660	netupdsrv.exe
696	nethtsrv.exe
1308	netupdsrv.exe

Loads dropped DLL 13 IoCs

Processes:

7c8d511a7cedbf9007f2facc3484e3647fb5d8bd17eb1c6bfcbae52f60f8c9f6.exeinstalld.exenethtsrv.exenethtsrv.exe

pid	process
1344	7c8d511a7cedbf9007f2facc3484e3647fb5d8bd17eb1c6bfcbae52f60f8c9f6.exe
1344	7c8d511a7cedbf9007f2facc3484e3647fb5d8bd17eb1c6bfcbae52f60f8c9f6.exe
1344	7c8d511a7cedbf9007f2facc3484e3647fb5d8bd17eb1c6bfcbae52f60f8c9f6.exe
1344	7c8d511a7cedbf9007f2facc3484e3647fb5d8bd17eb1c6bfcbae52f60f8c9f6.exe
732	installd.exe
1344	7c8d511a7cedbf9007f2facc3484e3647fb5d8bd17eb1c6bfcbae52f60f8c9f6.exe
796	nethtsrv.exe
796	nethtsrv.exe
1344	7c8d511a7cedbf9007f2facc3484e3647fb5d8bd17eb1c6bfcbae52f60f8c9f6.exe
1344	7c8d511a7cedbf9007f2facc3484e3647fb5d8bd17eb1c6bfcbae52f60f8c9f6.exe
696	nethtsrv.exe
696	nethtsrv.exe
1344	7c8d511a7cedbf9007f2facc3484e3647fb5d8bd17eb1c6bfcbae52f60f8c9f6.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in System32 directory 5 IoCs

Processes:

7c8d511a7cedbf9007f2facc3484e3647fb5d8bd17eb1c6bfcbae52f60f8c9f6.exe

description	ioc	process
File created	C:\Windows\SysWOW64\installd.exe	7c8d511a7cedbf9007f2facc3484e3647fb5d8bd17eb1c6bfcbae52f60f8c9f6.exe
File created	C:\Windows\SysWOW64\nethtsrv.exe	7c8d511a7cedbf9007f2facc3484e3647fb5d8bd17eb1c6bfcbae52f60f8c9f6.exe
File created	C:\Windows\SysWOW64\netupdsrv.exe	7c8d511a7cedbf9007f2facc3484e3647fb5d8bd17eb1c6bfcbae52f60f8c9f6.exe
File created	C:\Windows\SysWOW64\hfnapi.dll	7c8d511a7cedbf9007f2facc3484e3647fb5d8bd17eb1c6bfcbae52f60f8c9f6.exe
File created	C:\Windows\SysWOW64\hfpapi.dll	7c8d511a7cedbf9007f2facc3484e3647fb5d8bd17eb1c6bfcbae52f60f8c9f6.exe

Drops file in Program Files directory 3 IoCs

Processes:

7c8d511a7cedbf9007f2facc3484e3647fb5d8bd17eb1c6bfcbae52f60f8c9f6.exe

description	ioc	process
File created	C:\Program Files (x86)\Common Files\Config\data.xml	7c8d511a7cedbf9007f2facc3484e3647fb5d8bd17eb1c6bfcbae52f60f8c9f6.exe
File created	C:\Program Files (x86)\Common Files\Config\ver.xml	7c8d511a7cedbf9007f2facc3484e3647fb5d8bd17eb1c6bfcbae52f60f8c9f6.exe
File created	C:\Program Files (x86)\Common Files\config\uninstinethnfd.exe	7c8d511a7cedbf9007f2facc3484e3647fb5d8bd17eb1c6bfcbae52f60f8c9f6.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Runs net.exe
Suspicious behavior: LoadsDriver 1 IoCs

Processes:

pid process

460
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

nethtsrv.exe

description pid process

Token: SeDebugPrivilege 696 nethtsrv.exe

pid	process
460

description	pid	process
Token: SeDebugPrivilege	696	nethtsrv.exe

Suspicious use of WriteProcessMemory 50 IoCs

Processes:

7c8d511a7cedbf9007f2facc3484e3647fb5d8bd17eb1c6bfcbae52f60f8c9f6.exenet.exenet.exenet.exenet.exe

description	pid	process	target process
PID 1344 wrote to memory of 1620	1344	7c8d511a7cedbf9007f2facc3484e3647fb5d8bd17eb1c6bfcbae52f60f8c9f6.exe	net.exe
PID 1344 wrote to memory of 1620	1344	7c8d511a7cedbf9007f2facc3484e3647fb5d8bd17eb1c6bfcbae52f60f8c9f6.exe	net.exe
PID 1344 wrote to memory of 1620	1344	7c8d511a7cedbf9007f2facc3484e3647fb5d8bd17eb1c6bfcbae52f60f8c9f6.exe	net.exe
PID 1344 wrote to memory of 1620	1344	7c8d511a7cedbf9007f2facc3484e3647fb5d8bd17eb1c6bfcbae52f60f8c9f6.exe	net.exe
PID 1620 wrote to memory of 612	1620	net.exe	net1.exe
PID 1620 wrote to memory of 612	1620	net.exe	net1.exe
PID 1620 wrote to memory of 612	1620	net.exe	net1.exe
PID 1620 wrote to memory of 612	1620	net.exe	net1.exe
PID 1344 wrote to memory of 1672	1344	7c8d511a7cedbf9007f2facc3484e3647fb5d8bd17eb1c6bfcbae52f60f8c9f6.exe	net.exe
PID 1344 wrote to memory of 1672	1344	7c8d511a7cedbf9007f2facc3484e3647fb5d8bd17eb1c6bfcbae52f60f8c9f6.exe	net.exe
PID 1344 wrote to memory of 1672	1344	7c8d511a7cedbf9007f2facc3484e3647fb5d8bd17eb1c6bfcbae52f60f8c9f6.exe	net.exe
PID 1344 wrote to memory of 1672	1344	7c8d511a7cedbf9007f2facc3484e3647fb5d8bd17eb1c6bfcbae52f60f8c9f6.exe	net.exe
PID 1672 wrote to memory of 632	1672	net.exe	net1.exe
PID 1672 wrote to memory of 632	1672	net.exe	net1.exe
PID 1672 wrote to memory of 632	1672	net.exe	net1.exe
PID 1672 wrote to memory of 632	1672	net.exe	net1.exe
PID 1344 wrote to memory of 732	1344	7c8d511a7cedbf9007f2facc3484e3647fb5d8bd17eb1c6bfcbae52f60f8c9f6.exe	installd.exe
PID 1344 wrote to memory of 732	1344	7c8d511a7cedbf9007f2facc3484e3647fb5d8bd17eb1c6bfcbae52f60f8c9f6.exe	installd.exe
PID 1344 wrote to memory of 732	1344	7c8d511a7cedbf9007f2facc3484e3647fb5d8bd17eb1c6bfcbae52f60f8c9f6.exe	installd.exe
PID 1344 wrote to memory of 732	1344	7c8d511a7cedbf9007f2facc3484e3647fb5d8bd17eb1c6bfcbae52f60f8c9f6.exe	installd.exe
PID 1344 wrote to memory of 732	1344	7c8d511a7cedbf9007f2facc3484e3647fb5d8bd17eb1c6bfcbae52f60f8c9f6.exe	installd.exe
PID 1344 wrote to memory of 732	1344	7c8d511a7cedbf9007f2facc3484e3647fb5d8bd17eb1c6bfcbae52f60f8c9f6.exe	installd.exe
PID 1344 wrote to memory of 732	1344	7c8d511a7cedbf9007f2facc3484e3647fb5d8bd17eb1c6bfcbae52f60f8c9f6.exe	installd.exe
PID 1344 wrote to memory of 796	1344	7c8d511a7cedbf9007f2facc3484e3647fb5d8bd17eb1c6bfcbae52f60f8c9f6.exe	nethtsrv.exe
PID 1344 wrote to memory of 796	1344	7c8d511a7cedbf9007f2facc3484e3647fb5d8bd17eb1c6bfcbae52f60f8c9f6.exe	nethtsrv.exe
PID 1344 wrote to memory of 796	1344	7c8d511a7cedbf9007f2facc3484e3647fb5d8bd17eb1c6bfcbae52f60f8c9f6.exe	nethtsrv.exe
PID 1344 wrote to memory of 796	1344	7c8d511a7cedbf9007f2facc3484e3647fb5d8bd17eb1c6bfcbae52f60f8c9f6.exe	nethtsrv.exe
PID 1344 wrote to memory of 1660	1344	7c8d511a7cedbf9007f2facc3484e3647fb5d8bd17eb1c6bfcbae52f60f8c9f6.exe	netupdsrv.exe
PID 1344 wrote to memory of 1660	1344	7c8d511a7cedbf9007f2facc3484e3647fb5d8bd17eb1c6bfcbae52f60f8c9f6.exe	netupdsrv.exe
PID 1344 wrote to memory of 1660	1344	7c8d511a7cedbf9007f2facc3484e3647fb5d8bd17eb1c6bfcbae52f60f8c9f6.exe	netupdsrv.exe
PID 1344 wrote to memory of 1660	1344	7c8d511a7cedbf9007f2facc3484e3647fb5d8bd17eb1c6bfcbae52f60f8c9f6.exe	netupdsrv.exe
PID 1344 wrote to memory of 1660	1344	7c8d511a7cedbf9007f2facc3484e3647fb5d8bd17eb1c6bfcbae52f60f8c9f6.exe	netupdsrv.exe
PID 1344 wrote to memory of 1660	1344	7c8d511a7cedbf9007f2facc3484e3647fb5d8bd17eb1c6bfcbae52f60f8c9f6.exe	netupdsrv.exe
PID 1344 wrote to memory of 1660	1344	7c8d511a7cedbf9007f2facc3484e3647fb5d8bd17eb1c6bfcbae52f60f8c9f6.exe	netupdsrv.exe
PID 1344 wrote to memory of 1832	1344	7c8d511a7cedbf9007f2facc3484e3647fb5d8bd17eb1c6bfcbae52f60f8c9f6.exe	net.exe
PID 1344 wrote to memory of 1832	1344	7c8d511a7cedbf9007f2facc3484e3647fb5d8bd17eb1c6bfcbae52f60f8c9f6.exe	net.exe
PID 1344 wrote to memory of 1832	1344	7c8d511a7cedbf9007f2facc3484e3647fb5d8bd17eb1c6bfcbae52f60f8c9f6.exe	net.exe
PID 1344 wrote to memory of 1832	1344	7c8d511a7cedbf9007f2facc3484e3647fb5d8bd17eb1c6bfcbae52f60f8c9f6.exe	net.exe
PID 1832 wrote to memory of 2040	1832	net.exe	net1.exe
PID 1832 wrote to memory of 2040	1832	net.exe	net1.exe
PID 1832 wrote to memory of 2040	1832	net.exe	net1.exe
PID 1832 wrote to memory of 2040	1832	net.exe	net1.exe
PID 1344 wrote to memory of 1504	1344	7c8d511a7cedbf9007f2facc3484e3647fb5d8bd17eb1c6bfcbae52f60f8c9f6.exe	net.exe
PID 1344 wrote to memory of 1504	1344	7c8d511a7cedbf9007f2facc3484e3647fb5d8bd17eb1c6bfcbae52f60f8c9f6.exe	net.exe
PID 1344 wrote to memory of 1504	1344	7c8d511a7cedbf9007f2facc3484e3647fb5d8bd17eb1c6bfcbae52f60f8c9f6.exe	net.exe
PID 1344 wrote to memory of 1504	1344	7c8d511a7cedbf9007f2facc3484e3647fb5d8bd17eb1c6bfcbae52f60f8c9f6.exe	net.exe
PID 1504 wrote to memory of 1684	1504	net.exe	net1.exe
PID 1504 wrote to memory of 1684	1504	net.exe	net1.exe
PID 1504 wrote to memory of 1684	1504	net.exe	net1.exe
PID 1504 wrote to memory of 1684	1504	net.exe	net1.exe

C:\Users\Admin\AppData\Local\Temp\7c8d511a7cedbf9007f2facc3484e3647fb5d8bd17eb1c6bfcbae52f60f8c9f6.exe
"C:\Users\Admin\AppData\Local\Temp\7c8d511a7cedbf9007f2facc3484e3647fb5d8bd17eb1c6bfcbae52f60f8c9f6.exe"
1⤵
- Drops file in Drivers directory
- Loads dropped DLL
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:1344

C:\Windows\SysWOW64\net.exe
net stop nethttpservice
2⤵
- Suspicious use of WriteProcessMemory
PID:1620

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop nethttpservice
3⤵
PID:612

C:\Windows\SysWOW64\net.exe
net stop serviceupdater
2⤵
- Suspicious use of WriteProcessMemory
PID:1672

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop serviceupdater
3⤵
PID:632

C:\Windows\SysWOW64\installd.exe
"C:\Windows\system32\installd.exe" nethfdrv
2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:732

C:\Windows\SysWOW64\nethtsrv.exe
"C:\Windows\system32\nethtsrv.exe" -nfdi
2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:796

C:\Windows\SysWOW64\netupdsrv.exe
"C:\Windows\system32\netupdsrv.exe" -nfdi
2⤵
- Executes dropped EXE
PID:1660

C:\Windows\SysWOW64\net.exe
net start nethttpservice
2⤵
- Suspicious use of WriteProcessMemory
PID:1832

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 start nethttpservice
3⤵
PID:2040

C:\Windows\SysWOW64\net.exe
net start serviceupdater
2⤵
- Suspicious use of WriteProcessMemory
PID:1504

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 start serviceupdater
3⤵
PID:1684

C:\Windows\SysWOW64\nethtsrv.exe
C:\Windows\SysWOW64\nethtsrv.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:696

C:\Windows\SysWOW64\netupdsrv.exe
C:\Windows\SysWOW64\netupdsrv.exe
1⤵
- Executes dropped EXE
PID:1308

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\hfnapi.dll
Filesize
106KB

MD5
3edde722206c469b23bfd632688b5854

SHA1
94ff004d85eb32ffa530387cb27c83092d31d840

SHA256
a552cac66a0c3799bc97472ac8629fbe7b4407b0d0779d358d7a486c8caf9e8e

SHA512
e629c0ebe65299838c35e2f9111d60d6ef393bd5bf5a9663cc5344798e7a1fdc098c083046309dc3f7ae2149a50f424a10d57e99aca900d41e4235d2bc2bed20

Download Submit
C:\Windows\SysWOW64\hfpapi.dll
Filesize
241KB

MD5
b2bf879e403f31f0b09a9fae3b7e2d15

SHA1
30d0c2353661a8fab3e81a4c5a8776ecac31eb07

SHA256
2b252306981cb94c8688eb6f02601507d05e8f1e496cd63bfcefe07344d3e896

SHA512
8d951402ca6aa31573ec0d13ba4ccc32af489898b3d2817736d9166a077e229497452e8fd544df7eba695563e5aa395669c9f8ff40153eb3bee7334ea1d860ca

Download Submit
C:\Windows\SysWOW64\installd.exe
Filesize
108KB

MD5
a8f641819e94b3ee4bad8d7537ee65b8

SHA1
e1f3ea0be10df2e801ec681204dd1300eaa91f6b

SHA256
7cf2a329c890f53fc916e6710559d0d395b6223f0b9f8e45d553f950527572dc

SHA512
02b498403c2ea1e009a5081e7a7fa50ecd0e6ac5d1fa6b7cb2585d2224b957ebd504130522fc91bd0f25cc8e2e2bf481e325ad821940575bf8125eb13dafff90

Download Submit
C:\Windows\SysWOW64\nethtsrv.exe
Filesize
176KB

MD5
12961ad8a354eb25634b970a4397f94d

SHA1
5e0a473eba52419452b19d392687811b250fd62e

SHA256
13dea89608555e419f0441dde40c2eb588a505f45d04e6e792bd9d68433752a1

SHA512
61e9fc27ede3b05255dd3fe0d7bf551d0167548ca642c11504599e1720a08f54b66c4a630c1a9c97a8930a9d2df758abdbfd834410159046ad48240edb839dc4

Download Submit
C:\Windows\SysWOW64\nethtsrv.exe
Filesize
176KB

MD5
12961ad8a354eb25634b970a4397f94d

SHA1
5e0a473eba52419452b19d392687811b250fd62e

SHA256
13dea89608555e419f0441dde40c2eb588a505f45d04e6e792bd9d68433752a1

SHA512
61e9fc27ede3b05255dd3fe0d7bf551d0167548ca642c11504599e1720a08f54b66c4a630c1a9c97a8930a9d2df758abdbfd834410159046ad48240edb839dc4

Download Submit
C:\Windows\SysWOW64\netupdsrv.exe
Filesize
159KB

MD5
fcba2ebce550b48409c179e579aa54b4

SHA1
ed010cb895f7561b81e261676bade732bfd7ca18

SHA256
2645803f6a08cdfe2eb5cef581b343c969938d9be3230eb7ebdb0d0fb74af98e

SHA512
5894c7e44ff9551f90f02e892bea2a097624407d2844790d0bef8484d4596b50847871493b079753bb30e658d9a9bcad5ea60e51adfa1a63d2be60dbbe277c89

Download Submit
C:\Windows\SysWOW64\netupdsrv.exe
Filesize
159KB

MD5
fcba2ebce550b48409c179e579aa54b4

SHA1
ed010cb895f7561b81e261676bade732bfd7ca18

SHA256
2645803f6a08cdfe2eb5cef581b343c969938d9be3230eb7ebdb0d0fb74af98e

SHA512
5894c7e44ff9551f90f02e892bea2a097624407d2844790d0bef8484d4596b50847871493b079753bb30e658d9a9bcad5ea60e51adfa1a63d2be60dbbe277c89

Download Submit
\Users\Admin\AppData\Local\Temp\nst2281.tmp\System.dll
Filesize
11KB

MD5
c17103ae9072a06da581dec998343fc1

SHA1
b72148c6bdfaada8b8c3f950e610ee7cf1da1f8d

SHA256
dc58d8ad81cacb0c1ed72e33bff8f23ea40b5252b5bb55d393a0903e6819ae2f

SHA512
d32a71aaef18e993f28096d536e41c4d016850721b31171513ce28bbd805a54fd290b7c3e9d935f72e676a1acfb4f0dcc89d95040a0dd29f2b6975855c18986f

Download Submit
\Users\Admin\AppData\Local\Temp\nst2281.tmp\nsExec.dll
Filesize
6KB

MD5
acc2b699edfea5bf5aae45aba3a41e96

SHA1
d2accf4d494e43ceb2cff69abe4dd17147d29cc2

SHA256
168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e

SHA512
e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe

Download Submit
\Users\Admin\AppData\Local\Temp\nst2281.tmp\nsExec.dll
Filesize
6KB

MD5
acc2b699edfea5bf5aae45aba3a41e96

SHA1
d2accf4d494e43ceb2cff69abe4dd17147d29cc2

SHA256
168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e

SHA512
e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe

Download Submit
\Users\Admin\AppData\Local\Temp\nst2281.tmp\nsExec.dll
Filesize
6KB

MD5
acc2b699edfea5bf5aae45aba3a41e96

SHA1
d2accf4d494e43ceb2cff69abe4dd17147d29cc2

SHA256
168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e

SHA512
e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe

Download Submit
\Users\Admin\AppData\Local\Temp\nst2281.tmp\nsExec.dll
Filesize
6KB

MD5
acc2b699edfea5bf5aae45aba3a41e96

SHA1
d2accf4d494e43ceb2cff69abe4dd17147d29cc2

SHA256
168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e

SHA512
e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe

Download Submit
\Windows\SysWOW64\hfnapi.dll
Filesize
106KB

MD5
3edde722206c469b23bfd632688b5854

SHA1
94ff004d85eb32ffa530387cb27c83092d31d840

SHA256
a552cac66a0c3799bc97472ac8629fbe7b4407b0d0779d358d7a486c8caf9e8e

SHA512
e629c0ebe65299838c35e2f9111d60d6ef393bd5bf5a9663cc5344798e7a1fdc098c083046309dc3f7ae2149a50f424a10d57e99aca900d41e4235d2bc2bed20

Download Submit
\Windows\SysWOW64\hfnapi.dll
Filesize
106KB

MD5
3edde722206c469b23bfd632688b5854

SHA1
94ff004d85eb32ffa530387cb27c83092d31d840

SHA256
a552cac66a0c3799bc97472ac8629fbe7b4407b0d0779d358d7a486c8caf9e8e

SHA512
e629c0ebe65299838c35e2f9111d60d6ef393bd5bf5a9663cc5344798e7a1fdc098c083046309dc3f7ae2149a50f424a10d57e99aca900d41e4235d2bc2bed20

Download Submit
\Windows\SysWOW64\hfnapi.dll
Filesize
106KB

MD5
3edde722206c469b23bfd632688b5854

SHA1
94ff004d85eb32ffa530387cb27c83092d31d840

SHA256
a552cac66a0c3799bc97472ac8629fbe7b4407b0d0779d358d7a486c8caf9e8e

SHA512
e629c0ebe65299838c35e2f9111d60d6ef393bd5bf5a9663cc5344798e7a1fdc098c083046309dc3f7ae2149a50f424a10d57e99aca900d41e4235d2bc2bed20

Download Submit
\Windows\SysWOW64\hfpapi.dll
Filesize
241KB

MD5
b2bf879e403f31f0b09a9fae3b7e2d15

SHA1
30d0c2353661a8fab3e81a4c5a8776ecac31eb07

SHA256
2b252306981cb94c8688eb6f02601507d05e8f1e496cd63bfcefe07344d3e896

SHA512
8d951402ca6aa31573ec0d13ba4ccc32af489898b3d2817736d9166a077e229497452e8fd544df7eba695563e5aa395669c9f8ff40153eb3bee7334ea1d860ca

Download Submit
\Windows\SysWOW64\hfpapi.dll
Filesize
241KB

MD5
b2bf879e403f31f0b09a9fae3b7e2d15

SHA1
30d0c2353661a8fab3e81a4c5a8776ecac31eb07

SHA256
2b252306981cb94c8688eb6f02601507d05e8f1e496cd63bfcefe07344d3e896

SHA512
8d951402ca6aa31573ec0d13ba4ccc32af489898b3d2817736d9166a077e229497452e8fd544df7eba695563e5aa395669c9f8ff40153eb3bee7334ea1d860ca

Download Submit
\Windows\SysWOW64\installd.exe
Filesize
108KB

MD5
a8f641819e94b3ee4bad8d7537ee65b8

SHA1
e1f3ea0be10df2e801ec681204dd1300eaa91f6b

SHA256
7cf2a329c890f53fc916e6710559d0d395b6223f0b9f8e45d553f950527572dc

SHA512
02b498403c2ea1e009a5081e7a7fa50ecd0e6ac5d1fa6b7cb2585d2224b957ebd504130522fc91bd0f25cc8e2e2bf481e325ad821940575bf8125eb13dafff90

Download Submit
\Windows\SysWOW64\nethtsrv.exe
Filesize
176KB

MD5
12961ad8a354eb25634b970a4397f94d

SHA1
5e0a473eba52419452b19d392687811b250fd62e

SHA256
13dea89608555e419f0441dde40c2eb588a505f45d04e6e792bd9d68433752a1

SHA512
61e9fc27ede3b05255dd3fe0d7bf551d0167548ca642c11504599e1720a08f54b66c4a630c1a9c97a8930a9d2df758abdbfd834410159046ad48240edb839dc4

Download Submit
\Windows\SysWOW64\netupdsrv.exe
Filesize
159KB

MD5
fcba2ebce550b48409c179e579aa54b4

SHA1
ed010cb895f7561b81e261676bade732bfd7ca18

SHA256
2645803f6a08cdfe2eb5cef581b343c969938d9be3230eb7ebdb0d0fb74af98e

SHA512
5894c7e44ff9551f90f02e892bea2a097624407d2844790d0bef8484d4596b50847871493b079753bb30e658d9a9bcad5ea60e51adfa1a63d2be60dbbe277c89

Download Submit
memory/612-58-0x0000000000000000-mapping.dmp

Download
memory/632-61-0x0000000000000000-mapping.dmp

Download
memory/732-63-0x0000000000000000-mapping.dmp

Download
memory/796-69-0x0000000000000000-mapping.dmp

Download
memory/1344-54-0x0000000075B61000-0x0000000075B63000-memory.dmp

Filesize
8KB

Download
memory/1504-85-0x0000000000000000-mapping.dmp

Download
memory/1620-57-0x0000000000000000-mapping.dmp

Download
memory/1660-75-0x0000000000000000-mapping.dmp

Download
memory/1672-60-0x0000000000000000-mapping.dmp

Download
memory/1684-86-0x0000000000000000-mapping.dmp

Download
memory/1832-79-0x0000000000000000-mapping.dmp

Download
memory/2040-80-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads