a2d7c07f7f34004f9b16a28c275bac759bb1c7e620911ea47f46c337ca73967f

Analysis

max time kernel
44s
max time network
49s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
23-11-2022 10:53

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a2d7c07f7f34004f9b16a28c275bac759bb1c7e620911ea47f46c337ca73967f.exe
Size

445KB
MD5

12dd68f8907adb2cd26dcd5b73f08dbf
SHA1

9cfc04a4030ee5ea1c7f6022cd0e5bc40ea5d456
SHA256

a2d7c07f7f34004f9b16a28c275bac759bb1c7e620911ea47f46c337ca73967f
SHA512

91f0dd7b4818d387e9868fa0fd62d4452a276112ec26ac2194e3b419c8c81b41170f0801afa776db84fa6ddb8e606f6cfa8ec485e745fab6bcb0accf6c973606
SSDEEP

12288:mwaVPZ12yVBNaLNsnb4Wc7bYjodLHlW9sF4ArGES:mwal32yVSinb4WcXwMBX6ES

Score

8^/10

discovery

Malware Config

Signatures

Drops file in Drivers directory 1 IoCs

Processes:

a2d7c07f7f34004f9b16a28c275bac759bb1c7e620911ea47f46c337ca73967f.exe

description ioc process

File created C:\Windows\system32\drivers\nethfdrv.sys a2d7c07f7f34004f9b16a28c275bac759bb1c7e620911ea47f46c337ca73967f.exe
Executes dropped EXE 5 IoCs

Processes:

installd.exenethtsrv.exenetupdsrv.exenethtsrv.exenetupdsrv.exe

pid process

2008 installd.exe
568 nethtsrv.exe
1524 netupdsrv.exe
1984 nethtsrv.exe
1776 netupdsrv.exe

description	ioc	process
File created	C:\Windows\system32\drivers\nethfdrv.sys	a2d7c07f7f34004f9b16a28c275bac759bb1c7e620911ea47f46c337ca73967f.exe

pid	process
2008	installd.exe
568	nethtsrv.exe
1524	netupdsrv.exe
1984	nethtsrv.exe
1776	netupdsrv.exe

Loads dropped DLL 13 IoCs

Processes:

a2d7c07f7f34004f9b16a28c275bac759bb1c7e620911ea47f46c337ca73967f.exeinstalld.exenethtsrv.exenethtsrv.exe

pid	process
2012	a2d7c07f7f34004f9b16a28c275bac759bb1c7e620911ea47f46c337ca73967f.exe
2012	a2d7c07f7f34004f9b16a28c275bac759bb1c7e620911ea47f46c337ca73967f.exe
2012	a2d7c07f7f34004f9b16a28c275bac759bb1c7e620911ea47f46c337ca73967f.exe
2012	a2d7c07f7f34004f9b16a28c275bac759bb1c7e620911ea47f46c337ca73967f.exe
2008	installd.exe
2012	a2d7c07f7f34004f9b16a28c275bac759bb1c7e620911ea47f46c337ca73967f.exe
568	nethtsrv.exe
568	nethtsrv.exe
2012	a2d7c07f7f34004f9b16a28c275bac759bb1c7e620911ea47f46c337ca73967f.exe
2012	a2d7c07f7f34004f9b16a28c275bac759bb1c7e620911ea47f46c337ca73967f.exe
1984	nethtsrv.exe
1984	nethtsrv.exe
2012	a2d7c07f7f34004f9b16a28c275bac759bb1c7e620911ea47f46c337ca73967f.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in System32 directory 5 IoCs

Processes:

a2d7c07f7f34004f9b16a28c275bac759bb1c7e620911ea47f46c337ca73967f.exe

description	ioc	process
File created	C:\Windows\SysWOW64\hfnapi.dll	a2d7c07f7f34004f9b16a28c275bac759bb1c7e620911ea47f46c337ca73967f.exe
File created	C:\Windows\SysWOW64\hfpapi.dll	a2d7c07f7f34004f9b16a28c275bac759bb1c7e620911ea47f46c337ca73967f.exe
File created	C:\Windows\SysWOW64\installd.exe	a2d7c07f7f34004f9b16a28c275bac759bb1c7e620911ea47f46c337ca73967f.exe
File created	C:\Windows\SysWOW64\nethtsrv.exe	a2d7c07f7f34004f9b16a28c275bac759bb1c7e620911ea47f46c337ca73967f.exe
File created	C:\Windows\SysWOW64\netupdsrv.exe	a2d7c07f7f34004f9b16a28c275bac759bb1c7e620911ea47f46c337ca73967f.exe

Drops file in Program Files directory 3 IoCs

Processes:

a2d7c07f7f34004f9b16a28c275bac759bb1c7e620911ea47f46c337ca73967f.exe

description	ioc	process
File created	C:\Program Files (x86)\Common Files\Config\data.xml	a2d7c07f7f34004f9b16a28c275bac759bb1c7e620911ea47f46c337ca73967f.exe
File created	C:\Program Files (x86)\Common Files\Config\ver.xml	a2d7c07f7f34004f9b16a28c275bac759bb1c7e620911ea47f46c337ca73967f.exe
File created	C:\Program Files (x86)\Common Files\config\uninstinethnfd.exe	a2d7c07f7f34004f9b16a28c275bac759bb1c7e620911ea47f46c337ca73967f.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Runs net.exe
Suspicious behavior: LoadsDriver 1 IoCs

Processes:

pid process

472
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

nethtsrv.exe

description pid process

Token: SeDebugPrivilege 1984 nethtsrv.exe

pid	process
472

description	pid	process
Token: SeDebugPrivilege	1984	nethtsrv.exe

Suspicious use of WriteProcessMemory 50 IoCs

Processes:

a2d7c07f7f34004f9b16a28c275bac759bb1c7e620911ea47f46c337ca73967f.exenet.exenet.exenet.exenet.exe

description	pid	process	target process
PID 2012 wrote to memory of 1280	2012	a2d7c07f7f34004f9b16a28c275bac759bb1c7e620911ea47f46c337ca73967f.exe	net.exe
PID 2012 wrote to memory of 1280	2012	a2d7c07f7f34004f9b16a28c275bac759bb1c7e620911ea47f46c337ca73967f.exe	net.exe
PID 2012 wrote to memory of 1280	2012	a2d7c07f7f34004f9b16a28c275bac759bb1c7e620911ea47f46c337ca73967f.exe	net.exe
PID 2012 wrote to memory of 1280	2012	a2d7c07f7f34004f9b16a28c275bac759bb1c7e620911ea47f46c337ca73967f.exe	net.exe
PID 1280 wrote to memory of 1728	1280	net.exe	net1.exe
PID 1280 wrote to memory of 1728	1280	net.exe	net1.exe
PID 1280 wrote to memory of 1728	1280	net.exe	net1.exe
PID 1280 wrote to memory of 1728	1280	net.exe	net1.exe
PID 2012 wrote to memory of 1284	2012	a2d7c07f7f34004f9b16a28c275bac759bb1c7e620911ea47f46c337ca73967f.exe	net.exe
PID 2012 wrote to memory of 1284	2012	a2d7c07f7f34004f9b16a28c275bac759bb1c7e620911ea47f46c337ca73967f.exe	net.exe
PID 2012 wrote to memory of 1284	2012	a2d7c07f7f34004f9b16a28c275bac759bb1c7e620911ea47f46c337ca73967f.exe	net.exe
PID 2012 wrote to memory of 1284	2012	a2d7c07f7f34004f9b16a28c275bac759bb1c7e620911ea47f46c337ca73967f.exe	net.exe
PID 1284 wrote to memory of 1684	1284	net.exe	net1.exe
PID 1284 wrote to memory of 1684	1284	net.exe	net1.exe
PID 1284 wrote to memory of 1684	1284	net.exe	net1.exe
PID 1284 wrote to memory of 1684	1284	net.exe	net1.exe
PID 2012 wrote to memory of 2008	2012	a2d7c07f7f34004f9b16a28c275bac759bb1c7e620911ea47f46c337ca73967f.exe	installd.exe
PID 2012 wrote to memory of 2008	2012	a2d7c07f7f34004f9b16a28c275bac759bb1c7e620911ea47f46c337ca73967f.exe	installd.exe
PID 2012 wrote to memory of 2008	2012	a2d7c07f7f34004f9b16a28c275bac759bb1c7e620911ea47f46c337ca73967f.exe	installd.exe
PID 2012 wrote to memory of 2008	2012	a2d7c07f7f34004f9b16a28c275bac759bb1c7e620911ea47f46c337ca73967f.exe	installd.exe
PID 2012 wrote to memory of 2008	2012	a2d7c07f7f34004f9b16a28c275bac759bb1c7e620911ea47f46c337ca73967f.exe	installd.exe
PID 2012 wrote to memory of 2008	2012	a2d7c07f7f34004f9b16a28c275bac759bb1c7e620911ea47f46c337ca73967f.exe	installd.exe
PID 2012 wrote to memory of 2008	2012	a2d7c07f7f34004f9b16a28c275bac759bb1c7e620911ea47f46c337ca73967f.exe	installd.exe
PID 2012 wrote to memory of 568	2012	a2d7c07f7f34004f9b16a28c275bac759bb1c7e620911ea47f46c337ca73967f.exe	nethtsrv.exe
PID 2012 wrote to memory of 568	2012	a2d7c07f7f34004f9b16a28c275bac759bb1c7e620911ea47f46c337ca73967f.exe	nethtsrv.exe
PID 2012 wrote to memory of 568	2012	a2d7c07f7f34004f9b16a28c275bac759bb1c7e620911ea47f46c337ca73967f.exe	nethtsrv.exe
PID 2012 wrote to memory of 568	2012	a2d7c07f7f34004f9b16a28c275bac759bb1c7e620911ea47f46c337ca73967f.exe	nethtsrv.exe
PID 2012 wrote to memory of 1524	2012	a2d7c07f7f34004f9b16a28c275bac759bb1c7e620911ea47f46c337ca73967f.exe	netupdsrv.exe
PID 2012 wrote to memory of 1524	2012	a2d7c07f7f34004f9b16a28c275bac759bb1c7e620911ea47f46c337ca73967f.exe	netupdsrv.exe
PID 2012 wrote to memory of 1524	2012	a2d7c07f7f34004f9b16a28c275bac759bb1c7e620911ea47f46c337ca73967f.exe	netupdsrv.exe
PID 2012 wrote to memory of 1524	2012	a2d7c07f7f34004f9b16a28c275bac759bb1c7e620911ea47f46c337ca73967f.exe	netupdsrv.exe
PID 2012 wrote to memory of 1524	2012	a2d7c07f7f34004f9b16a28c275bac759bb1c7e620911ea47f46c337ca73967f.exe	netupdsrv.exe
PID 2012 wrote to memory of 1524	2012	a2d7c07f7f34004f9b16a28c275bac759bb1c7e620911ea47f46c337ca73967f.exe	netupdsrv.exe
PID 2012 wrote to memory of 1524	2012	a2d7c07f7f34004f9b16a28c275bac759bb1c7e620911ea47f46c337ca73967f.exe	netupdsrv.exe
PID 2012 wrote to memory of 1960	2012	a2d7c07f7f34004f9b16a28c275bac759bb1c7e620911ea47f46c337ca73967f.exe	net.exe
PID 2012 wrote to memory of 1960	2012	a2d7c07f7f34004f9b16a28c275bac759bb1c7e620911ea47f46c337ca73967f.exe	net.exe
PID 2012 wrote to memory of 1960	2012	a2d7c07f7f34004f9b16a28c275bac759bb1c7e620911ea47f46c337ca73967f.exe	net.exe
PID 2012 wrote to memory of 1960	2012	a2d7c07f7f34004f9b16a28c275bac759bb1c7e620911ea47f46c337ca73967f.exe	net.exe
PID 1960 wrote to memory of 1936	1960	net.exe	net1.exe
PID 1960 wrote to memory of 1936	1960	net.exe	net1.exe
PID 1960 wrote to memory of 1936	1960	net.exe	net1.exe
PID 1960 wrote to memory of 1936	1960	net.exe	net1.exe
PID 2012 wrote to memory of 1812	2012	a2d7c07f7f34004f9b16a28c275bac759bb1c7e620911ea47f46c337ca73967f.exe	net.exe
PID 2012 wrote to memory of 1812	2012	a2d7c07f7f34004f9b16a28c275bac759bb1c7e620911ea47f46c337ca73967f.exe	net.exe
PID 2012 wrote to memory of 1812	2012	a2d7c07f7f34004f9b16a28c275bac759bb1c7e620911ea47f46c337ca73967f.exe	net.exe
PID 2012 wrote to memory of 1812	2012	a2d7c07f7f34004f9b16a28c275bac759bb1c7e620911ea47f46c337ca73967f.exe	net.exe
PID 1812 wrote to memory of 456	1812	net.exe	net1.exe
PID 1812 wrote to memory of 456	1812	net.exe	net1.exe
PID 1812 wrote to memory of 456	1812	net.exe	net1.exe
PID 1812 wrote to memory of 456	1812	net.exe	net1.exe

C:\Users\Admin\AppData\Local\Temp\a2d7c07f7f34004f9b16a28c275bac759bb1c7e620911ea47f46c337ca73967f.exe
"C:\Users\Admin\AppData\Local\Temp\a2d7c07f7f34004f9b16a28c275bac759bb1c7e620911ea47f46c337ca73967f.exe"
1⤵
- Drops file in Drivers directory
- Loads dropped DLL
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:2012

C:\Windows\SysWOW64\net.exe
net stop nethttpservice
2⤵
- Suspicious use of WriteProcessMemory
PID:1280

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop nethttpservice
3⤵
PID:1728

C:\Windows\SysWOW64\net.exe
net stop serviceupdater
2⤵
- Suspicious use of WriteProcessMemory
PID:1284

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop serviceupdater
3⤵
PID:1684

C:\Windows\SysWOW64\installd.exe
"C:\Windows\system32\installd.exe" nethfdrv
2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2008

C:\Windows\SysWOW64\nethtsrv.exe
"C:\Windows\system32\nethtsrv.exe" -nfdi
2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:568

C:\Windows\SysWOW64\netupdsrv.exe
"C:\Windows\system32\netupdsrv.exe" -nfdi
2⤵
- Executes dropped EXE
PID:1524

C:\Windows\SysWOW64\net.exe
net start nethttpservice
2⤵
- Suspicious use of WriteProcessMemory
PID:1960

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 start nethttpservice
3⤵
PID:1936

C:\Windows\SysWOW64\net.exe
net start serviceupdater
2⤵
- Suspicious use of WriteProcessMemory
PID:1812

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 start serviceupdater
3⤵
PID:456

C:\Windows\SysWOW64\nethtsrv.exe
C:\Windows\SysWOW64\nethtsrv.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:1984

C:\Windows\SysWOW64\netupdsrv.exe
C:\Windows\SysWOW64\netupdsrv.exe
1⤵
- Executes dropped EXE
PID:1776

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\hfnapi.dll
Filesize
106KB

MD5
f120e0752526580533036a4880495975

SHA1
aa19d8fb8d6fb9de1456c79ee1ee6e9f4a60d789

SHA256
05b75295e378343a45bdf45c9ce2811979bcf62c3ee211034e5d1a6603a86f3e

SHA512
420b6180c2bf1cf9e7c34f5b3072162a447762eeb8110b985e687e301bceeea86cc18415dcf782a714e4586d49d54a2ea1883139f502deb458a8ea13c57fe672

Download Submit
C:\Windows\SysWOW64\hfpapi.dll
Filesize
241KB

MD5
5a53eed3680dcf5ceed96e45aaaa7fa3

SHA1
054a3155118e693540c8a2edc148c7e62ca75e31

SHA256
f823b3a321699f67a139aebff8f2d939cf9ac258724ad51129c7e1f4da3b6fab

SHA512
9160b7a2e1663b980b12eb7791217e58ac73113a96d0052b94f6a7cf95e63750f34defc5b13a71aa3cd50453d47c132ffb2bceb448538b57e11bab8d19c19855

Download Submit
C:\Windows\SysWOW64\installd.exe
Filesize
108KB

MD5
436718f9899fde3435ad8941943fb3e5

SHA1
152b09b39d6d778cb976f498b6cbd8b3082099a3

SHA256
01c9af1d2050e70895ebb8f34f01aad4a098ac8eb732b0df64baccd59031a7f4

SHA512
0b5968f04a11c2c986b0a11ab946c44d57974ae51e33073cd6073ca20acd4ebc6abd9fcf406c08bbe4e54f0f5b83d9aaf522f97a7b5e7882674b18c38fa97664

Download Submit
C:\Windows\SysWOW64\nethtsrv.exe
Filesize
176KB

MD5
0dd18321d7a70db23ed794c8d7be7695

SHA1
35f28061293691ba7977b3b7e4799ad69f15f51d

SHA256
4d93cf3caebf8569752bd597ec9c662015cb1c0bacf11ceaa2b66455c299c843

SHA512
153d2b402ee310bfb1db3bc446b67649606f61361a76bef34249bb10ab2c8675455f524246b2c29f0b56e59e89a3947de9e5e9b617af550cf986a63eb89c3b40

Download Submit
C:\Windows\SysWOW64\nethtsrv.exe
Filesize
176KB

MD5
0dd18321d7a70db23ed794c8d7be7695

SHA1
35f28061293691ba7977b3b7e4799ad69f15f51d

SHA256
4d93cf3caebf8569752bd597ec9c662015cb1c0bacf11ceaa2b66455c299c843

SHA512
153d2b402ee310bfb1db3bc446b67649606f61361a76bef34249bb10ab2c8675455f524246b2c29f0b56e59e89a3947de9e5e9b617af550cf986a63eb89c3b40

Download Submit
C:\Windows\SysWOW64\netupdsrv.exe
Filesize
158KB

MD5
301b15fdee89a413b627a017cc85bf3f

SHA1
60e76a63dd545fed008b34d4698f8befcd2a51fe

SHA256
587b7cfb9e93680f62fe5a195514b0870a9c45f62676fe3c43a1469c17d7c516

SHA512
0ccbc45dd417b83148c1152f7db71034ff4d6f4ed6a1e9989943aa6926efd118cb244db3625df94ec6e8530ff90e4d28f90dec34e65a419d6b538382c0d6a2c1

Download Submit
C:\Windows\SysWOW64\netupdsrv.exe
Filesize
158KB

MD5
301b15fdee89a413b627a017cc85bf3f

SHA1
60e76a63dd545fed008b34d4698f8befcd2a51fe

SHA256
587b7cfb9e93680f62fe5a195514b0870a9c45f62676fe3c43a1469c17d7c516

SHA512
0ccbc45dd417b83148c1152f7db71034ff4d6f4ed6a1e9989943aa6926efd118cb244db3625df94ec6e8530ff90e4d28f90dec34e65a419d6b538382c0d6a2c1

Download Submit
\Users\Admin\AppData\Local\Temp\nstB1B.tmp\System.dll
Filesize
11KB

MD5
c17103ae9072a06da581dec998343fc1

SHA1
b72148c6bdfaada8b8c3f950e610ee7cf1da1f8d

SHA256
dc58d8ad81cacb0c1ed72e33bff8f23ea40b5252b5bb55d393a0903e6819ae2f

SHA512
d32a71aaef18e993f28096d536e41c4d016850721b31171513ce28bbd805a54fd290b7c3e9d935f72e676a1acfb4f0dcc89d95040a0dd29f2b6975855c18986f

Download Submit
\Users\Admin\AppData\Local\Temp\nstB1B.tmp\nsExec.dll
Filesize
6KB

MD5
acc2b699edfea5bf5aae45aba3a41e96

SHA1
d2accf4d494e43ceb2cff69abe4dd17147d29cc2

SHA256
168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e

SHA512
e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe

Download Submit
\Users\Admin\AppData\Local\Temp\nstB1B.tmp\nsExec.dll
Filesize
6KB

MD5
acc2b699edfea5bf5aae45aba3a41e96

SHA1
d2accf4d494e43ceb2cff69abe4dd17147d29cc2

SHA256
168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e

SHA512
e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe

Download Submit
\Users\Admin\AppData\Local\Temp\nstB1B.tmp\nsExec.dll
Filesize
6KB

MD5
acc2b699edfea5bf5aae45aba3a41e96

SHA1
d2accf4d494e43ceb2cff69abe4dd17147d29cc2

SHA256
168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e

SHA512
e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe

Download Submit
\Users\Admin\AppData\Local\Temp\nstB1B.tmp\nsExec.dll
Filesize
6KB

MD5
acc2b699edfea5bf5aae45aba3a41e96

SHA1
d2accf4d494e43ceb2cff69abe4dd17147d29cc2

SHA256
168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e

SHA512
e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe

Download Submit
\Windows\SysWOW64\hfnapi.dll
Filesize
106KB

MD5
f120e0752526580533036a4880495975

SHA1
aa19d8fb8d6fb9de1456c79ee1ee6e9f4a60d789

SHA256
05b75295e378343a45bdf45c9ce2811979bcf62c3ee211034e5d1a6603a86f3e

SHA512
420b6180c2bf1cf9e7c34f5b3072162a447762eeb8110b985e687e301bceeea86cc18415dcf782a714e4586d49d54a2ea1883139f502deb458a8ea13c57fe672

Download Submit
\Windows\SysWOW64\hfnapi.dll
Filesize
106KB

MD5
f120e0752526580533036a4880495975

SHA1
aa19d8fb8d6fb9de1456c79ee1ee6e9f4a60d789

SHA256
05b75295e378343a45bdf45c9ce2811979bcf62c3ee211034e5d1a6603a86f3e

SHA512
420b6180c2bf1cf9e7c34f5b3072162a447762eeb8110b985e687e301bceeea86cc18415dcf782a714e4586d49d54a2ea1883139f502deb458a8ea13c57fe672

Download Submit
\Windows\SysWOW64\hfnapi.dll
Filesize
106KB

MD5
f120e0752526580533036a4880495975

SHA1
aa19d8fb8d6fb9de1456c79ee1ee6e9f4a60d789

SHA256
05b75295e378343a45bdf45c9ce2811979bcf62c3ee211034e5d1a6603a86f3e

SHA512
420b6180c2bf1cf9e7c34f5b3072162a447762eeb8110b985e687e301bceeea86cc18415dcf782a714e4586d49d54a2ea1883139f502deb458a8ea13c57fe672

Download Submit
\Windows\SysWOW64\hfpapi.dll
Filesize
241KB

MD5
5a53eed3680dcf5ceed96e45aaaa7fa3

SHA1
054a3155118e693540c8a2edc148c7e62ca75e31

SHA256
f823b3a321699f67a139aebff8f2d939cf9ac258724ad51129c7e1f4da3b6fab

SHA512
9160b7a2e1663b980b12eb7791217e58ac73113a96d0052b94f6a7cf95e63750f34defc5b13a71aa3cd50453d47c132ffb2bceb448538b57e11bab8d19c19855

Download Submit
\Windows\SysWOW64\hfpapi.dll
Filesize
241KB

MD5
5a53eed3680dcf5ceed96e45aaaa7fa3

SHA1
054a3155118e693540c8a2edc148c7e62ca75e31

SHA256
f823b3a321699f67a139aebff8f2d939cf9ac258724ad51129c7e1f4da3b6fab

SHA512
9160b7a2e1663b980b12eb7791217e58ac73113a96d0052b94f6a7cf95e63750f34defc5b13a71aa3cd50453d47c132ffb2bceb448538b57e11bab8d19c19855

Download Submit
\Windows\SysWOW64\installd.exe
Filesize
108KB

MD5
436718f9899fde3435ad8941943fb3e5

SHA1
152b09b39d6d778cb976f498b6cbd8b3082099a3

SHA256
01c9af1d2050e70895ebb8f34f01aad4a098ac8eb732b0df64baccd59031a7f4

SHA512
0b5968f04a11c2c986b0a11ab946c44d57974ae51e33073cd6073ca20acd4ebc6abd9fcf406c08bbe4e54f0f5b83d9aaf522f97a7b5e7882674b18c38fa97664

Download Submit
\Windows\SysWOW64\nethtsrv.exe
Filesize
176KB

MD5
0dd18321d7a70db23ed794c8d7be7695

SHA1
35f28061293691ba7977b3b7e4799ad69f15f51d

SHA256
4d93cf3caebf8569752bd597ec9c662015cb1c0bacf11ceaa2b66455c299c843

SHA512
153d2b402ee310bfb1db3bc446b67649606f61361a76bef34249bb10ab2c8675455f524246b2c29f0b56e59e89a3947de9e5e9b617af550cf986a63eb89c3b40

Download Submit
\Windows\SysWOW64\netupdsrv.exe
Filesize
158KB

MD5
301b15fdee89a413b627a017cc85bf3f

SHA1
60e76a63dd545fed008b34d4698f8befcd2a51fe

SHA256
587b7cfb9e93680f62fe5a195514b0870a9c45f62676fe3c43a1469c17d7c516

SHA512
0ccbc45dd417b83148c1152f7db71034ff4d6f4ed6a1e9989943aa6926efd118cb244db3625df94ec6e8530ff90e4d28f90dec34e65a419d6b538382c0d6a2c1

Download Submit
memory/456-86-0x0000000000000000-mapping.dmp

Download
memory/568-69-0x0000000000000000-mapping.dmp

Download
memory/1280-57-0x0000000000000000-mapping.dmp

Download
memory/1284-60-0x0000000000000000-mapping.dmp

Download
memory/1524-75-0x0000000000000000-mapping.dmp

Download
memory/1684-61-0x0000000000000000-mapping.dmp

Download
memory/1728-58-0x0000000000000000-mapping.dmp

Download
memory/1812-85-0x0000000000000000-mapping.dmp

Download
memory/1936-80-0x0000000000000000-mapping.dmp

Download
memory/1960-79-0x0000000000000000-mapping.dmp

Download
memory/2008-63-0x0000000000000000-mapping.dmp

Download
memory/2012-54-0x0000000074B51000-0x0000000074B53000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads