a4dede9eed037260a2451135a2ee817f0c988ab316bac943d2b796ca2dc5b66a

Analysis

max time kernel
36s
max time network
46s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
23-11-2022 10:53

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a4dede9eed037260a2451135a2ee817f0c988ab316bac943d2b796ca2dc5b66a.exe
Size

447KB
MD5

e822247039d2e27d6741fbd90499daab
SHA1

e74dff3cd978dabdef25e50edf1c03c710ce56d8
SHA256

a4dede9eed037260a2451135a2ee817f0c988ab316bac943d2b796ca2dc5b66a
SHA512

9074576cf96a3a1a2b5aa1101ae9e9e12619f1fce7784f5cf26bba1afcc91aa5286c50676ba524274d2d5a0869833f8d4d32354029931c38924a90908f037ad1
SSDEEP

6144:XzfHWpBHmuL5nYEL8mAnRKvgpyD+jCp+sbbbEJ8scfBOcyqbLpqxaFc7wJuddvRa:7KmuL5RLbARKv3DuCfVfB3yqbqwuZrm

Score

8^/10

discovery

Malware Config

Signatures

Drops file in Drivers directory 1 IoCs

Processes:

a4dede9eed037260a2451135a2ee817f0c988ab316bac943d2b796ca2dc5b66a.exe

description ioc process

File created C:\Windows\system32\drivers\nethfdrv.sys a4dede9eed037260a2451135a2ee817f0c988ab316bac943d2b796ca2dc5b66a.exe
Executes dropped EXE 5 IoCs

Processes:

installd.exenethtsrv.exenetupdsrv.exenethtsrv.exenetupdsrv.exe

pid process

1988 installd.exe
1652 nethtsrv.exe
604 netupdsrv.exe
608 nethtsrv.exe
976 netupdsrv.exe

description	ioc	process
File created	C:\Windows\system32\drivers\nethfdrv.sys	a4dede9eed037260a2451135a2ee817f0c988ab316bac943d2b796ca2dc5b66a.exe

pid	process
1988	installd.exe
1652	nethtsrv.exe
604	netupdsrv.exe
608	nethtsrv.exe
976	netupdsrv.exe

Loads dropped DLL 13 IoCs

Processes:

a4dede9eed037260a2451135a2ee817f0c988ab316bac943d2b796ca2dc5b66a.exeinstalld.exenethtsrv.exenethtsrv.exe

pid	process
908	a4dede9eed037260a2451135a2ee817f0c988ab316bac943d2b796ca2dc5b66a.exe
908	a4dede9eed037260a2451135a2ee817f0c988ab316bac943d2b796ca2dc5b66a.exe
908	a4dede9eed037260a2451135a2ee817f0c988ab316bac943d2b796ca2dc5b66a.exe
908	a4dede9eed037260a2451135a2ee817f0c988ab316bac943d2b796ca2dc5b66a.exe
1988	installd.exe
908	a4dede9eed037260a2451135a2ee817f0c988ab316bac943d2b796ca2dc5b66a.exe
1652	nethtsrv.exe
1652	nethtsrv.exe
908	a4dede9eed037260a2451135a2ee817f0c988ab316bac943d2b796ca2dc5b66a.exe
908	a4dede9eed037260a2451135a2ee817f0c988ab316bac943d2b796ca2dc5b66a.exe
608	nethtsrv.exe
608	nethtsrv.exe
908	a4dede9eed037260a2451135a2ee817f0c988ab316bac943d2b796ca2dc5b66a.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in System32 directory 5 IoCs

Processes:

a4dede9eed037260a2451135a2ee817f0c988ab316bac943d2b796ca2dc5b66a.exe

description	ioc	process
File created	C:\Windows\SysWOW64\hfnapi.dll	a4dede9eed037260a2451135a2ee817f0c988ab316bac943d2b796ca2dc5b66a.exe
File created	C:\Windows\SysWOW64\hfpapi.dll	a4dede9eed037260a2451135a2ee817f0c988ab316bac943d2b796ca2dc5b66a.exe
File created	C:\Windows\SysWOW64\installd.exe	a4dede9eed037260a2451135a2ee817f0c988ab316bac943d2b796ca2dc5b66a.exe
File created	C:\Windows\SysWOW64\nethtsrv.exe	a4dede9eed037260a2451135a2ee817f0c988ab316bac943d2b796ca2dc5b66a.exe
File created	C:\Windows\SysWOW64\netupdsrv.exe	a4dede9eed037260a2451135a2ee817f0c988ab316bac943d2b796ca2dc5b66a.exe

Drops file in Program Files directory 3 IoCs

Processes:

a4dede9eed037260a2451135a2ee817f0c988ab316bac943d2b796ca2dc5b66a.exe

description	ioc	process
File created	C:\Program Files (x86)\Common Files\Config\data.xml	a4dede9eed037260a2451135a2ee817f0c988ab316bac943d2b796ca2dc5b66a.exe
File created	C:\Program Files (x86)\Common Files\Config\ver.xml	a4dede9eed037260a2451135a2ee817f0c988ab316bac943d2b796ca2dc5b66a.exe
File created	C:\Program Files (x86)\Common Files\config\uninstinethnfd.exe	a4dede9eed037260a2451135a2ee817f0c988ab316bac943d2b796ca2dc5b66a.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Runs net.exe
Suspicious behavior: LoadsDriver 1 IoCs

Processes:

pid process

460
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

nethtsrv.exe

description pid process

Token: SeDebugPrivilege 608 nethtsrv.exe

pid	process
460

description	pid	process
Token: SeDebugPrivilege	608	nethtsrv.exe

Suspicious use of WriteProcessMemory 50 IoCs

Processes:

a4dede9eed037260a2451135a2ee817f0c988ab316bac943d2b796ca2dc5b66a.exenet.exenet.exenet.exenet.exe

description	pid	process	target process
PID 908 wrote to memory of 2040	908	a4dede9eed037260a2451135a2ee817f0c988ab316bac943d2b796ca2dc5b66a.exe	net.exe
PID 908 wrote to memory of 2040	908	a4dede9eed037260a2451135a2ee817f0c988ab316bac943d2b796ca2dc5b66a.exe	net.exe
PID 908 wrote to memory of 2040	908	a4dede9eed037260a2451135a2ee817f0c988ab316bac943d2b796ca2dc5b66a.exe	net.exe
PID 908 wrote to memory of 2040	908	a4dede9eed037260a2451135a2ee817f0c988ab316bac943d2b796ca2dc5b66a.exe	net.exe
PID 2040 wrote to memory of 1928	2040	net.exe	net1.exe
PID 2040 wrote to memory of 1928	2040	net.exe	net1.exe
PID 2040 wrote to memory of 1928	2040	net.exe	net1.exe
PID 2040 wrote to memory of 1928	2040	net.exe	net1.exe
PID 908 wrote to memory of 1924	908	a4dede9eed037260a2451135a2ee817f0c988ab316bac943d2b796ca2dc5b66a.exe	net.exe
PID 908 wrote to memory of 1924	908	a4dede9eed037260a2451135a2ee817f0c988ab316bac943d2b796ca2dc5b66a.exe	net.exe
PID 908 wrote to memory of 1924	908	a4dede9eed037260a2451135a2ee817f0c988ab316bac943d2b796ca2dc5b66a.exe	net.exe
PID 908 wrote to memory of 1924	908	a4dede9eed037260a2451135a2ee817f0c988ab316bac943d2b796ca2dc5b66a.exe	net.exe
PID 1924 wrote to memory of 1760	1924	net.exe	net1.exe
PID 1924 wrote to memory of 1760	1924	net.exe	net1.exe
PID 1924 wrote to memory of 1760	1924	net.exe	net1.exe
PID 1924 wrote to memory of 1760	1924	net.exe	net1.exe
PID 908 wrote to memory of 1988	908	a4dede9eed037260a2451135a2ee817f0c988ab316bac943d2b796ca2dc5b66a.exe	installd.exe
PID 908 wrote to memory of 1988	908	a4dede9eed037260a2451135a2ee817f0c988ab316bac943d2b796ca2dc5b66a.exe	installd.exe
PID 908 wrote to memory of 1988	908	a4dede9eed037260a2451135a2ee817f0c988ab316bac943d2b796ca2dc5b66a.exe	installd.exe
PID 908 wrote to memory of 1988	908	a4dede9eed037260a2451135a2ee817f0c988ab316bac943d2b796ca2dc5b66a.exe	installd.exe
PID 908 wrote to memory of 1988	908	a4dede9eed037260a2451135a2ee817f0c988ab316bac943d2b796ca2dc5b66a.exe	installd.exe
PID 908 wrote to memory of 1988	908	a4dede9eed037260a2451135a2ee817f0c988ab316bac943d2b796ca2dc5b66a.exe	installd.exe
PID 908 wrote to memory of 1988	908	a4dede9eed037260a2451135a2ee817f0c988ab316bac943d2b796ca2dc5b66a.exe	installd.exe
PID 908 wrote to memory of 1652	908	a4dede9eed037260a2451135a2ee817f0c988ab316bac943d2b796ca2dc5b66a.exe	nethtsrv.exe
PID 908 wrote to memory of 1652	908	a4dede9eed037260a2451135a2ee817f0c988ab316bac943d2b796ca2dc5b66a.exe	nethtsrv.exe
PID 908 wrote to memory of 1652	908	a4dede9eed037260a2451135a2ee817f0c988ab316bac943d2b796ca2dc5b66a.exe	nethtsrv.exe
PID 908 wrote to memory of 1652	908	a4dede9eed037260a2451135a2ee817f0c988ab316bac943d2b796ca2dc5b66a.exe	nethtsrv.exe
PID 908 wrote to memory of 604	908	a4dede9eed037260a2451135a2ee817f0c988ab316bac943d2b796ca2dc5b66a.exe	netupdsrv.exe
PID 908 wrote to memory of 604	908	a4dede9eed037260a2451135a2ee817f0c988ab316bac943d2b796ca2dc5b66a.exe	netupdsrv.exe
PID 908 wrote to memory of 604	908	a4dede9eed037260a2451135a2ee817f0c988ab316bac943d2b796ca2dc5b66a.exe	netupdsrv.exe
PID 908 wrote to memory of 604	908	a4dede9eed037260a2451135a2ee817f0c988ab316bac943d2b796ca2dc5b66a.exe	netupdsrv.exe
PID 908 wrote to memory of 604	908	a4dede9eed037260a2451135a2ee817f0c988ab316bac943d2b796ca2dc5b66a.exe	netupdsrv.exe
PID 908 wrote to memory of 604	908	a4dede9eed037260a2451135a2ee817f0c988ab316bac943d2b796ca2dc5b66a.exe	netupdsrv.exe
PID 908 wrote to memory of 604	908	a4dede9eed037260a2451135a2ee817f0c988ab316bac943d2b796ca2dc5b66a.exe	netupdsrv.exe
PID 908 wrote to memory of 1124	908	a4dede9eed037260a2451135a2ee817f0c988ab316bac943d2b796ca2dc5b66a.exe	net.exe
PID 908 wrote to memory of 1124	908	a4dede9eed037260a2451135a2ee817f0c988ab316bac943d2b796ca2dc5b66a.exe	net.exe
PID 908 wrote to memory of 1124	908	a4dede9eed037260a2451135a2ee817f0c988ab316bac943d2b796ca2dc5b66a.exe	net.exe
PID 908 wrote to memory of 1124	908	a4dede9eed037260a2451135a2ee817f0c988ab316bac943d2b796ca2dc5b66a.exe	net.exe
PID 1124 wrote to memory of 1060	1124	net.exe	net1.exe
PID 1124 wrote to memory of 1060	1124	net.exe	net1.exe
PID 1124 wrote to memory of 1060	1124	net.exe	net1.exe
PID 1124 wrote to memory of 1060	1124	net.exe	net1.exe
PID 908 wrote to memory of 1376	908	a4dede9eed037260a2451135a2ee817f0c988ab316bac943d2b796ca2dc5b66a.exe	net.exe
PID 908 wrote to memory of 1376	908	a4dede9eed037260a2451135a2ee817f0c988ab316bac943d2b796ca2dc5b66a.exe	net.exe
PID 908 wrote to memory of 1376	908	a4dede9eed037260a2451135a2ee817f0c988ab316bac943d2b796ca2dc5b66a.exe	net.exe
PID 908 wrote to memory of 1376	908	a4dede9eed037260a2451135a2ee817f0c988ab316bac943d2b796ca2dc5b66a.exe	net.exe
PID 1376 wrote to memory of 1624	1376	net.exe	net1.exe
PID 1376 wrote to memory of 1624	1376	net.exe	net1.exe
PID 1376 wrote to memory of 1624	1376	net.exe	net1.exe
PID 1376 wrote to memory of 1624	1376	net.exe	net1.exe

C:\Users\Admin\AppData\Local\Temp\a4dede9eed037260a2451135a2ee817f0c988ab316bac943d2b796ca2dc5b66a.exe
"C:\Users\Admin\AppData\Local\Temp\a4dede9eed037260a2451135a2ee817f0c988ab316bac943d2b796ca2dc5b66a.exe"
1⤵
- Drops file in Drivers directory
- Loads dropped DLL
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:908

C:\Windows\SysWOW64\net.exe
net stop nethttpservice
2⤵
- Suspicious use of WriteProcessMemory
PID:2040

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop nethttpservice
3⤵
PID:1928

C:\Windows\SysWOW64\net.exe
net stop serviceupdater
2⤵
- Suspicious use of WriteProcessMemory
PID:1924

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop serviceupdater
3⤵
PID:1760

C:\Windows\SysWOW64\installd.exe
"C:\Windows\system32\installd.exe" nethfdrv
2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1988

C:\Windows\SysWOW64\nethtsrv.exe
"C:\Windows\system32\nethtsrv.exe" -nfdi
2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1652

C:\Windows\SysWOW64\netupdsrv.exe
"C:\Windows\system32\netupdsrv.exe" -nfdi
2⤵
- Executes dropped EXE
PID:604

C:\Windows\SysWOW64\net.exe
net start nethttpservice
2⤵
- Suspicious use of WriteProcessMemory
PID:1124

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 start nethttpservice
3⤵
PID:1060

C:\Windows\SysWOW64\net.exe
net start serviceupdater
2⤵
- Suspicious use of WriteProcessMemory
PID:1376

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 start serviceupdater
3⤵
PID:1624

C:\Windows\SysWOW64\nethtsrv.exe
C:\Windows\SysWOW64\nethtsrv.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:608

C:\Windows\SysWOW64\netupdsrv.exe
C:\Windows\SysWOW64\netupdsrv.exe
1⤵
- Executes dropped EXE
PID:976

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\hfnapi.dll
Filesize
106KB

MD5
032e245d1c2f1da89bdffc162e3a7d28

SHA1
1c9f196d3989323035b6d924a1c06a6c802bb468

SHA256
2bead7b0bccffd2433442ed7eee96b074f87d1bbaf8340d2809c1f477afb5bb0

SHA512
afc3de2c7c235069165f84a57c15f8a626c43b974cf45ac092e83202a31ee984e22f9c054f3d4c21efda2c2e92dead8f01779520ad7cbfd322820a242b9a074e

Download Submit
C:\Windows\SysWOW64\hfpapi.dll
Filesize
244KB

MD5
0e3f7d49f914eba5b02f1d88aef5f779

SHA1
b296e6a19b37e3dca4a4e7cc348b8939e7ee3251

SHA256
1a37ba323cf68f80b800e3d4ddaf91a73dc57fde7ee2088378d7f16879e5f8d3

SHA512
3602796232a6102cc5d493b6febb4409bdd34b7be14662e8d64f68a5b0ff5fed33b24a1ccc9ed6396f6ec92a07e3d9028bb9528a9486362dbe940f13bcb4e71c

Download Submit
C:\Windows\SysWOW64\installd.exe
Filesize
108KB

MD5
963aa7bd80ae770590480281f9b7af5a

SHA1
fc3d76d5af6c4eeef9583c1b5228d87fe9f15814

SHA256
6d0f21b1e0c84c470a947e6db8f0265cdd84f7946a18f2465b311e16d55d93ef

SHA512
9d717fdf5e863178a068db40fa2727e00a9db59dbd07bfbf4c224442891d0c65e78cf0f5235b4654297fb78491bfcc00bb0eeab9565a2587b4266dae33996d9b

Download Submit
C:\Windows\SysWOW64\nethtsrv.exe
Filesize
176KB

MD5
99b2f61ea2df51268b88ef3bafdb1f25

SHA1
945a7c353dd18dc19b1836de8f926664def6d673

SHA256
053734b5c1fedea49fe99bbb216baa206cf2439e9be7a3f30d713c2d9fff8702

SHA512
3163d78c5fd15eb9154b0c8c7c2a8196f2ff6053ca93f5262fe19cedcb238192185008f00ebc1e1449f10c7c47007ca42fa344f39bbcb81d4a698f828f15bbd3

Download Submit
C:\Windows\SysWOW64\nethtsrv.exe
Filesize
176KB

MD5
99b2f61ea2df51268b88ef3bafdb1f25

SHA1
945a7c353dd18dc19b1836de8f926664def6d673

SHA256
053734b5c1fedea49fe99bbb216baa206cf2439e9be7a3f30d713c2d9fff8702

SHA512
3163d78c5fd15eb9154b0c8c7c2a8196f2ff6053ca93f5262fe19cedcb238192185008f00ebc1e1449f10c7c47007ca42fa344f39bbcb81d4a698f828f15bbd3

Download Submit
C:\Windows\SysWOW64\netupdsrv.exe
Filesize
159KB

MD5
a71d74f74f77435bfd6ef926e99bfe74

SHA1
169c47506a86ae815bb4c94b649bee1c3805e91e

SHA256
5523f37a3dd4a9a82cd70e3712c9c3436a500c5b97c9962eea4b70946b4698dc

SHA512
2f21873f29186ad936683aedaebdb2c15541d59d353fc30ea8f0d19b4fbd2eb5daaf19a1f203a2ad8a50108b0527a43c10798783736388c3c2c57f035f6eb372

Download Submit
C:\Windows\SysWOW64\netupdsrv.exe
Filesize
159KB

MD5
a71d74f74f77435bfd6ef926e99bfe74

SHA1
169c47506a86ae815bb4c94b649bee1c3805e91e

SHA256
5523f37a3dd4a9a82cd70e3712c9c3436a500c5b97c9962eea4b70946b4698dc

SHA512
2f21873f29186ad936683aedaebdb2c15541d59d353fc30ea8f0d19b4fbd2eb5daaf19a1f203a2ad8a50108b0527a43c10798783736388c3c2c57f035f6eb372

Download Submit
\Users\Admin\AppData\Local\Temp\nsd5CB3.tmp\System.dll
Filesize
11KB

MD5
c17103ae9072a06da581dec998343fc1

SHA1
b72148c6bdfaada8b8c3f950e610ee7cf1da1f8d

SHA256
dc58d8ad81cacb0c1ed72e33bff8f23ea40b5252b5bb55d393a0903e6819ae2f

SHA512
d32a71aaef18e993f28096d536e41c4d016850721b31171513ce28bbd805a54fd290b7c3e9d935f72e676a1acfb4f0dcc89d95040a0dd29f2b6975855c18986f

Download Submit
\Users\Admin\AppData\Local\Temp\nsd5CB3.tmp\nsExec.dll
Filesize
6KB

MD5
acc2b699edfea5bf5aae45aba3a41e96

SHA1
d2accf4d494e43ceb2cff69abe4dd17147d29cc2

SHA256
168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e

SHA512
e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe

Download Submit
\Users\Admin\AppData\Local\Temp\nsd5CB3.tmp\nsExec.dll
Filesize
6KB

MD5
acc2b699edfea5bf5aae45aba3a41e96

SHA1
d2accf4d494e43ceb2cff69abe4dd17147d29cc2

SHA256
168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e

SHA512
e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe

Download Submit
\Users\Admin\AppData\Local\Temp\nsd5CB3.tmp\nsExec.dll
Filesize
6KB

MD5
acc2b699edfea5bf5aae45aba3a41e96

SHA1
d2accf4d494e43ceb2cff69abe4dd17147d29cc2

SHA256
168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e

SHA512
e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe

Download Submit
\Users\Admin\AppData\Local\Temp\nsd5CB3.tmp\nsExec.dll
Filesize
6KB

MD5
acc2b699edfea5bf5aae45aba3a41e96

SHA1
d2accf4d494e43ceb2cff69abe4dd17147d29cc2

SHA256
168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e

SHA512
e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe

Download Submit
\Windows\SysWOW64\hfnapi.dll
Filesize
106KB

MD5
032e245d1c2f1da89bdffc162e3a7d28

SHA1
1c9f196d3989323035b6d924a1c06a6c802bb468

SHA256
2bead7b0bccffd2433442ed7eee96b074f87d1bbaf8340d2809c1f477afb5bb0

SHA512
afc3de2c7c235069165f84a57c15f8a626c43b974cf45ac092e83202a31ee984e22f9c054f3d4c21efda2c2e92dead8f01779520ad7cbfd322820a242b9a074e

Download Submit
\Windows\SysWOW64\hfnapi.dll
Filesize
106KB

MD5
032e245d1c2f1da89bdffc162e3a7d28

SHA1
1c9f196d3989323035b6d924a1c06a6c802bb468

SHA256
2bead7b0bccffd2433442ed7eee96b074f87d1bbaf8340d2809c1f477afb5bb0

SHA512
afc3de2c7c235069165f84a57c15f8a626c43b974cf45ac092e83202a31ee984e22f9c054f3d4c21efda2c2e92dead8f01779520ad7cbfd322820a242b9a074e

Download Submit
\Windows\SysWOW64\hfnapi.dll
Filesize
106KB

MD5
032e245d1c2f1da89bdffc162e3a7d28

SHA1
1c9f196d3989323035b6d924a1c06a6c802bb468

SHA256
2bead7b0bccffd2433442ed7eee96b074f87d1bbaf8340d2809c1f477afb5bb0

SHA512
afc3de2c7c235069165f84a57c15f8a626c43b974cf45ac092e83202a31ee984e22f9c054f3d4c21efda2c2e92dead8f01779520ad7cbfd322820a242b9a074e

Download Submit
\Windows\SysWOW64\hfpapi.dll
Filesize
244KB

MD5
0e3f7d49f914eba5b02f1d88aef5f779

SHA1
b296e6a19b37e3dca4a4e7cc348b8939e7ee3251

SHA256
1a37ba323cf68f80b800e3d4ddaf91a73dc57fde7ee2088378d7f16879e5f8d3

SHA512
3602796232a6102cc5d493b6febb4409bdd34b7be14662e8d64f68a5b0ff5fed33b24a1ccc9ed6396f6ec92a07e3d9028bb9528a9486362dbe940f13bcb4e71c

Download Submit
\Windows\SysWOW64\hfpapi.dll
Filesize
244KB

MD5
0e3f7d49f914eba5b02f1d88aef5f779

SHA1
b296e6a19b37e3dca4a4e7cc348b8939e7ee3251

SHA256
1a37ba323cf68f80b800e3d4ddaf91a73dc57fde7ee2088378d7f16879e5f8d3

SHA512
3602796232a6102cc5d493b6febb4409bdd34b7be14662e8d64f68a5b0ff5fed33b24a1ccc9ed6396f6ec92a07e3d9028bb9528a9486362dbe940f13bcb4e71c

Download Submit
\Windows\SysWOW64\installd.exe
Filesize
108KB

MD5
963aa7bd80ae770590480281f9b7af5a

SHA1
fc3d76d5af6c4eeef9583c1b5228d87fe9f15814

SHA256
6d0f21b1e0c84c470a947e6db8f0265cdd84f7946a18f2465b311e16d55d93ef

SHA512
9d717fdf5e863178a068db40fa2727e00a9db59dbd07bfbf4c224442891d0c65e78cf0f5235b4654297fb78491bfcc00bb0eeab9565a2587b4266dae33996d9b

Download Submit
\Windows\SysWOW64\nethtsrv.exe
Filesize
176KB

MD5
99b2f61ea2df51268b88ef3bafdb1f25

SHA1
945a7c353dd18dc19b1836de8f926664def6d673

SHA256
053734b5c1fedea49fe99bbb216baa206cf2439e9be7a3f30d713c2d9fff8702

SHA512
3163d78c5fd15eb9154b0c8c7c2a8196f2ff6053ca93f5262fe19cedcb238192185008f00ebc1e1449f10c7c47007ca42fa344f39bbcb81d4a698f828f15bbd3

Download Submit
\Windows\SysWOW64\netupdsrv.exe
Filesize
159KB

MD5
a71d74f74f77435bfd6ef926e99bfe74

SHA1
169c47506a86ae815bb4c94b649bee1c3805e91e

SHA256
5523f37a3dd4a9a82cd70e3712c9c3436a500c5b97c9962eea4b70946b4698dc

SHA512
2f21873f29186ad936683aedaebdb2c15541d59d353fc30ea8f0d19b4fbd2eb5daaf19a1f203a2ad8a50108b0527a43c10798783736388c3c2c57f035f6eb372

Download Submit
memory/604-75-0x0000000000000000-mapping.dmp

Download
memory/908-54-0x0000000075131000-0x0000000075133000-memory.dmp

Filesize
8KB

Download
memory/1060-80-0x0000000000000000-mapping.dmp

Download
memory/1124-79-0x0000000000000000-mapping.dmp

Download
memory/1376-85-0x0000000000000000-mapping.dmp

Download
memory/1624-86-0x0000000000000000-mapping.dmp

Download
memory/1652-69-0x0000000000000000-mapping.dmp

Download
memory/1760-61-0x0000000000000000-mapping.dmp

Download
memory/1924-60-0x0000000000000000-mapping.dmp

Download
memory/1928-58-0x0000000000000000-mapping.dmp

Download
memory/1988-63-0x0000000000000000-mapping.dmp

Download
memory/2040-57-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads