8942cd0838266f42eefe36dafc2adfc92128f977b989f529f1d0f308940d0e12

Analysis

max time kernel
35s
max time network
43s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
23-11-2022 10:54

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

8942cd0838266f42eefe36dafc2adfc92128f977b989f529f1d0f308940d0e12.exe
Size

445KB
MD5

726c8695d618826538d73ba0c5852694
SHA1

f9850992a252bb48e06286b7d9054146199cee0d
SHA256

8942cd0838266f42eefe36dafc2adfc92128f977b989f529f1d0f308940d0e12
SHA512

3ab422c7cbf963e5dc022b94b56d4bb2aedd9fe59142ca2c140fb1d8be61a664cdfb2fc73c6eab13b602b02da1b6a32995ca6b42dab9e7af51ba537c72550adc
SSDEEP

12288:CKcYJ/8GUwvJuMlKJROxx0Y/aRDNmILT2+eP:CYfAbOv/GD0Im+E

Score

8^/10

discovery

Malware Config

Signatures

Drops file in Drivers directory 1 IoCs

Processes:

8942cd0838266f42eefe36dafc2adfc92128f977b989f529f1d0f308940d0e12.exe

description ioc process

File created C:\Windows\system32\drivers\nethfdrv.sys 8942cd0838266f42eefe36dafc2adfc92128f977b989f529f1d0f308940d0e12.exe
Executes dropped EXE 5 IoCs

Processes:

installd.exenethtsrv.exenetupdsrv.exenethtsrv.exenetupdsrv.exe

pid process

840 installd.exe
1060 nethtsrv.exe
1472 netupdsrv.exe
1360 nethtsrv.exe
1324 netupdsrv.exe

description	ioc	process
File created	C:\Windows\system32\drivers\nethfdrv.sys	8942cd0838266f42eefe36dafc2adfc92128f977b989f529f1d0f308940d0e12.exe

pid	process
840	installd.exe
1060	nethtsrv.exe
1472	netupdsrv.exe
1360	nethtsrv.exe
1324	netupdsrv.exe

Loads dropped DLL 13 IoCs

Processes:

8942cd0838266f42eefe36dafc2adfc92128f977b989f529f1d0f308940d0e12.exeinstalld.exenethtsrv.exenethtsrv.exe

pid	process
1368	8942cd0838266f42eefe36dafc2adfc92128f977b989f529f1d0f308940d0e12.exe
1368	8942cd0838266f42eefe36dafc2adfc92128f977b989f529f1d0f308940d0e12.exe
1368	8942cd0838266f42eefe36dafc2adfc92128f977b989f529f1d0f308940d0e12.exe
1368	8942cd0838266f42eefe36dafc2adfc92128f977b989f529f1d0f308940d0e12.exe
840	installd.exe
1368	8942cd0838266f42eefe36dafc2adfc92128f977b989f529f1d0f308940d0e12.exe
1060	nethtsrv.exe
1060	nethtsrv.exe
1368	8942cd0838266f42eefe36dafc2adfc92128f977b989f529f1d0f308940d0e12.exe
1368	8942cd0838266f42eefe36dafc2adfc92128f977b989f529f1d0f308940d0e12.exe
1360	nethtsrv.exe
1360	nethtsrv.exe
1368	8942cd0838266f42eefe36dafc2adfc92128f977b989f529f1d0f308940d0e12.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in System32 directory 5 IoCs

Processes:

8942cd0838266f42eefe36dafc2adfc92128f977b989f529f1d0f308940d0e12.exe

description	ioc	process
File created	C:\Windows\SysWOW64\nethtsrv.exe	8942cd0838266f42eefe36dafc2adfc92128f977b989f529f1d0f308940d0e12.exe
File created	C:\Windows\SysWOW64\netupdsrv.exe	8942cd0838266f42eefe36dafc2adfc92128f977b989f529f1d0f308940d0e12.exe
File created	C:\Windows\SysWOW64\hfnapi.dll	8942cd0838266f42eefe36dafc2adfc92128f977b989f529f1d0f308940d0e12.exe
File created	C:\Windows\SysWOW64\hfpapi.dll	8942cd0838266f42eefe36dafc2adfc92128f977b989f529f1d0f308940d0e12.exe
File created	C:\Windows\SysWOW64\installd.exe	8942cd0838266f42eefe36dafc2adfc92128f977b989f529f1d0f308940d0e12.exe

Drops file in Program Files directory 3 IoCs

Processes:

8942cd0838266f42eefe36dafc2adfc92128f977b989f529f1d0f308940d0e12.exe

description	ioc	process
File created	C:\Program Files (x86)\Common Files\Config\data.xml	8942cd0838266f42eefe36dafc2adfc92128f977b989f529f1d0f308940d0e12.exe
File created	C:\Program Files (x86)\Common Files\Config\ver.xml	8942cd0838266f42eefe36dafc2adfc92128f977b989f529f1d0f308940d0e12.exe
File created	C:\Program Files (x86)\Common Files\config\uninstinethnfd.exe	8942cd0838266f42eefe36dafc2adfc92128f977b989f529f1d0f308940d0e12.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Runs net.exe
Suspicious behavior: LoadsDriver 1 IoCs

Processes:

pid process

464
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

nethtsrv.exe

description pid process

Token: SeDebugPrivilege 1360 nethtsrv.exe

pid	process
464

description	pid	process
Token: SeDebugPrivilege	1360	nethtsrv.exe

Suspicious use of WriteProcessMemory 50 IoCs

Processes:

8942cd0838266f42eefe36dafc2adfc92128f977b989f529f1d0f308940d0e12.exenet.exenet.exenet.exenet.exe

description	pid	process	target process
PID 1368 wrote to memory of 1808	1368	8942cd0838266f42eefe36dafc2adfc92128f977b989f529f1d0f308940d0e12.exe	net.exe
PID 1368 wrote to memory of 1808	1368	8942cd0838266f42eefe36dafc2adfc92128f977b989f529f1d0f308940d0e12.exe	net.exe
PID 1368 wrote to memory of 1808	1368	8942cd0838266f42eefe36dafc2adfc92128f977b989f529f1d0f308940d0e12.exe	net.exe
PID 1368 wrote to memory of 1808	1368	8942cd0838266f42eefe36dafc2adfc92128f977b989f529f1d0f308940d0e12.exe	net.exe
PID 1808 wrote to memory of 240	1808	net.exe	net1.exe
PID 1808 wrote to memory of 240	1808	net.exe	net1.exe
PID 1808 wrote to memory of 240	1808	net.exe	net1.exe
PID 1808 wrote to memory of 240	1808	net.exe	net1.exe
PID 1368 wrote to memory of 1292	1368	8942cd0838266f42eefe36dafc2adfc92128f977b989f529f1d0f308940d0e12.exe	net.exe
PID 1368 wrote to memory of 1292	1368	8942cd0838266f42eefe36dafc2adfc92128f977b989f529f1d0f308940d0e12.exe	net.exe
PID 1368 wrote to memory of 1292	1368	8942cd0838266f42eefe36dafc2adfc92128f977b989f529f1d0f308940d0e12.exe	net.exe
PID 1368 wrote to memory of 1292	1368	8942cd0838266f42eefe36dafc2adfc92128f977b989f529f1d0f308940d0e12.exe	net.exe
PID 1292 wrote to memory of 1120	1292	net.exe	net1.exe
PID 1292 wrote to memory of 1120	1292	net.exe	net1.exe
PID 1292 wrote to memory of 1120	1292	net.exe	net1.exe
PID 1292 wrote to memory of 1120	1292	net.exe	net1.exe
PID 1368 wrote to memory of 840	1368	8942cd0838266f42eefe36dafc2adfc92128f977b989f529f1d0f308940d0e12.exe	installd.exe
PID 1368 wrote to memory of 840	1368	8942cd0838266f42eefe36dafc2adfc92128f977b989f529f1d0f308940d0e12.exe	installd.exe
PID 1368 wrote to memory of 840	1368	8942cd0838266f42eefe36dafc2adfc92128f977b989f529f1d0f308940d0e12.exe	installd.exe
PID 1368 wrote to memory of 840	1368	8942cd0838266f42eefe36dafc2adfc92128f977b989f529f1d0f308940d0e12.exe	installd.exe
PID 1368 wrote to memory of 840	1368	8942cd0838266f42eefe36dafc2adfc92128f977b989f529f1d0f308940d0e12.exe	installd.exe
PID 1368 wrote to memory of 840	1368	8942cd0838266f42eefe36dafc2adfc92128f977b989f529f1d0f308940d0e12.exe	installd.exe
PID 1368 wrote to memory of 840	1368	8942cd0838266f42eefe36dafc2adfc92128f977b989f529f1d0f308940d0e12.exe	installd.exe
PID 1368 wrote to memory of 1060	1368	8942cd0838266f42eefe36dafc2adfc92128f977b989f529f1d0f308940d0e12.exe	nethtsrv.exe
PID 1368 wrote to memory of 1060	1368	8942cd0838266f42eefe36dafc2adfc92128f977b989f529f1d0f308940d0e12.exe	nethtsrv.exe
PID 1368 wrote to memory of 1060	1368	8942cd0838266f42eefe36dafc2adfc92128f977b989f529f1d0f308940d0e12.exe	nethtsrv.exe
PID 1368 wrote to memory of 1060	1368	8942cd0838266f42eefe36dafc2adfc92128f977b989f529f1d0f308940d0e12.exe	nethtsrv.exe
PID 1368 wrote to memory of 1472	1368	8942cd0838266f42eefe36dafc2adfc92128f977b989f529f1d0f308940d0e12.exe	netupdsrv.exe
PID 1368 wrote to memory of 1472	1368	8942cd0838266f42eefe36dafc2adfc92128f977b989f529f1d0f308940d0e12.exe	netupdsrv.exe
PID 1368 wrote to memory of 1472	1368	8942cd0838266f42eefe36dafc2adfc92128f977b989f529f1d0f308940d0e12.exe	netupdsrv.exe
PID 1368 wrote to memory of 1472	1368	8942cd0838266f42eefe36dafc2adfc92128f977b989f529f1d0f308940d0e12.exe	netupdsrv.exe
PID 1368 wrote to memory of 1472	1368	8942cd0838266f42eefe36dafc2adfc92128f977b989f529f1d0f308940d0e12.exe	netupdsrv.exe
PID 1368 wrote to memory of 1472	1368	8942cd0838266f42eefe36dafc2adfc92128f977b989f529f1d0f308940d0e12.exe	netupdsrv.exe
PID 1368 wrote to memory of 1472	1368	8942cd0838266f42eefe36dafc2adfc92128f977b989f529f1d0f308940d0e12.exe	netupdsrv.exe
PID 1368 wrote to memory of 1312	1368	8942cd0838266f42eefe36dafc2adfc92128f977b989f529f1d0f308940d0e12.exe	net.exe
PID 1368 wrote to memory of 1312	1368	8942cd0838266f42eefe36dafc2adfc92128f977b989f529f1d0f308940d0e12.exe	net.exe
PID 1368 wrote to memory of 1312	1368	8942cd0838266f42eefe36dafc2adfc92128f977b989f529f1d0f308940d0e12.exe	net.exe
PID 1368 wrote to memory of 1312	1368	8942cd0838266f42eefe36dafc2adfc92128f977b989f529f1d0f308940d0e12.exe	net.exe
PID 1312 wrote to memory of 1040	1312	net.exe	net1.exe
PID 1312 wrote to memory of 1040	1312	net.exe	net1.exe
PID 1312 wrote to memory of 1040	1312	net.exe	net1.exe
PID 1312 wrote to memory of 1040	1312	net.exe	net1.exe
PID 1368 wrote to memory of 808	1368	8942cd0838266f42eefe36dafc2adfc92128f977b989f529f1d0f308940d0e12.exe	net.exe
PID 1368 wrote to memory of 808	1368	8942cd0838266f42eefe36dafc2adfc92128f977b989f529f1d0f308940d0e12.exe	net.exe
PID 1368 wrote to memory of 808	1368	8942cd0838266f42eefe36dafc2adfc92128f977b989f529f1d0f308940d0e12.exe	net.exe
PID 1368 wrote to memory of 808	1368	8942cd0838266f42eefe36dafc2adfc92128f977b989f529f1d0f308940d0e12.exe	net.exe
PID 808 wrote to memory of 828	808	net.exe	net1.exe
PID 808 wrote to memory of 828	808	net.exe	net1.exe
PID 808 wrote to memory of 828	808	net.exe	net1.exe
PID 808 wrote to memory of 828	808	net.exe	net1.exe

C:\Users\Admin\AppData\Local\Temp\8942cd0838266f42eefe36dafc2adfc92128f977b989f529f1d0f308940d0e12.exe
"C:\Users\Admin\AppData\Local\Temp\8942cd0838266f42eefe36dafc2adfc92128f977b989f529f1d0f308940d0e12.exe"
1⤵
- Drops file in Drivers directory
- Loads dropped DLL
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:1368

C:\Windows\SysWOW64\net.exe
net stop nethttpservice
2⤵
- Suspicious use of WriteProcessMemory
PID:1808

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop nethttpservice
3⤵
PID:240

C:\Windows\SysWOW64\net.exe
net stop serviceupdater
2⤵
- Suspicious use of WriteProcessMemory
PID:1292

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop serviceupdater
3⤵
PID:1120

C:\Windows\SysWOW64\installd.exe
"C:\Windows\system32\installd.exe" nethfdrv
2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:840

C:\Windows\SysWOW64\nethtsrv.exe
"C:\Windows\system32\nethtsrv.exe" -nfdi
2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1060

C:\Windows\SysWOW64\netupdsrv.exe
"C:\Windows\system32\netupdsrv.exe" -nfdi
2⤵
- Executes dropped EXE
PID:1472

C:\Windows\SysWOW64\net.exe
net start nethttpservice
2⤵
- Suspicious use of WriteProcessMemory
PID:1312

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 start nethttpservice
3⤵
PID:1040

C:\Windows\SysWOW64\net.exe
net start serviceupdater
2⤵
- Suspicious use of WriteProcessMemory
PID:808

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 start serviceupdater
3⤵
PID:828

C:\Windows\SysWOW64\nethtsrv.exe
C:\Windows\SysWOW64\nethtsrv.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:1360

C:\Windows\SysWOW64\netupdsrv.exe
C:\Windows\SysWOW64\netupdsrv.exe
1⤵
- Executes dropped EXE
PID:1324

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\hfnapi.dll
Filesize
106KB

MD5
04e7dbdf604a6960ad2899680dfd07f5

SHA1
4e2b1a98478b11d3b11edb354b5658e1b81ce52e

SHA256
be3f75137bb71746272edf59386446e62e02cc0213b488c85531571456a8d5fe

SHA512
c15790388fe7414876c386e7bc86517703a0703fad6f53c187b713e3349dc198f1d17cd8afde07bde32d95e9f530f455148984acfbf7d488b08b5bc2e1027c4d

Download Submit
C:\Windows\SysWOW64\hfpapi.dll
Filesize
241KB

MD5
c04828a4a439bfcc07c9ef0bc8583e12

SHA1
2a2915fad4f28c0726a592e752b536c8619d4e73

SHA256
88fb4c40efd7bf4337866f798ec439c78254875ea41634d2a9f82c506b54ad86

SHA512
5d924f26de761d14d484c5c7ef7ae440b81cc3044602ee7181a2eeecc0d632d45d50902bcc28b72bdafd5ad0d714730c8d3f11a78920f6cb256933ad71e30282

Download Submit
C:\Windows\SysWOW64\installd.exe
Filesize
108KB

MD5
fcfdc062a200ebcb18a1fcc38dd7923e

SHA1
cf8fb2d552aa7fd6417bb3814347b4d650974864

SHA256
229f1d4cdcf71cb1fb00916df92a897df4a8391ad390ecd4715eebf7f926f915

SHA512
7c7d3f53fe963d70b827610faccbbab0402064612f866c18d18d3a7aeb7bb50029a5f5df7ff59cb01c76ab089adbaca48e23c08f21ac9ea867f1abbdcfc76beb

Download Submit
C:\Windows\SysWOW64\nethtsrv.exe
Filesize
176KB

MD5
a51307e3650861cac02035dcdc83cca0

SHA1
b73ad159e6bf804ecbf93801ab0b27396f8b6081

SHA256
610630f35bd993328880701aa0daf216867d48630414c223d1610776ccff3590

SHA512
79cf9cf834b643a2673a75f207b5e1ba914da2b725ec881a5815d7205dece39b3e2147993627ed48c1a9da0cb8a390e125c0edf074167894576fa819f03c4232

Download Submit
C:\Windows\SysWOW64\nethtsrv.exe
Filesize
176KB

MD5
a51307e3650861cac02035dcdc83cca0

SHA1
b73ad159e6bf804ecbf93801ab0b27396f8b6081

SHA256
610630f35bd993328880701aa0daf216867d48630414c223d1610776ccff3590

SHA512
79cf9cf834b643a2673a75f207b5e1ba914da2b725ec881a5815d7205dece39b3e2147993627ed48c1a9da0cb8a390e125c0edf074167894576fa819f03c4232

Download Submit
C:\Windows\SysWOW64\netupdsrv.exe
Filesize
158KB

MD5
17630e45d608b8ddd8dbdc5950ed9171

SHA1
b66e9889cb133bb46216d8e1576820f0839ead4f

SHA256
9d5b0b735fa238204fbce2d3d17af12f8daa89134d379ae8cc515b78a0e98bdb

SHA512
5a66996de96024b69f2ded38abf80dc6434645adcbeb70273c24c65c585a9a858a26d4f777aeae596990df99eafd4b619785e6116ec4f706bd2d51d1cbaa80b4

Download Submit
C:\Windows\SysWOW64\netupdsrv.exe
Filesize
158KB

MD5
17630e45d608b8ddd8dbdc5950ed9171

SHA1
b66e9889cb133bb46216d8e1576820f0839ead4f

SHA256
9d5b0b735fa238204fbce2d3d17af12f8daa89134d379ae8cc515b78a0e98bdb

SHA512
5a66996de96024b69f2ded38abf80dc6434645adcbeb70273c24c65c585a9a858a26d4f777aeae596990df99eafd4b619785e6116ec4f706bd2d51d1cbaa80b4

Download Submit
\Users\Admin\AppData\Local\Temp\nst5795.tmp\System.dll
Filesize
11KB

MD5
c17103ae9072a06da581dec998343fc1

SHA1
b72148c6bdfaada8b8c3f950e610ee7cf1da1f8d

SHA256
dc58d8ad81cacb0c1ed72e33bff8f23ea40b5252b5bb55d393a0903e6819ae2f

SHA512
d32a71aaef18e993f28096d536e41c4d016850721b31171513ce28bbd805a54fd290b7c3e9d935f72e676a1acfb4f0dcc89d95040a0dd29f2b6975855c18986f

Download Submit
\Users\Admin\AppData\Local\Temp\nst5795.tmp\nsExec.dll
Filesize
6KB

MD5
acc2b699edfea5bf5aae45aba3a41e96

SHA1
d2accf4d494e43ceb2cff69abe4dd17147d29cc2

SHA256
168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e

SHA512
e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe

Download Submit
\Users\Admin\AppData\Local\Temp\nst5795.tmp\nsExec.dll
Filesize
6KB

MD5
acc2b699edfea5bf5aae45aba3a41e96

SHA1
d2accf4d494e43ceb2cff69abe4dd17147d29cc2

SHA256
168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e

SHA512
e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe

Download Submit
\Users\Admin\AppData\Local\Temp\nst5795.tmp\nsExec.dll
Filesize
6KB

MD5
acc2b699edfea5bf5aae45aba3a41e96

SHA1
d2accf4d494e43ceb2cff69abe4dd17147d29cc2

SHA256
168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e

SHA512
e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe

Download Submit
\Users\Admin\AppData\Local\Temp\nst5795.tmp\nsExec.dll
Filesize
6KB

MD5
acc2b699edfea5bf5aae45aba3a41e96

SHA1
d2accf4d494e43ceb2cff69abe4dd17147d29cc2

SHA256
168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e

SHA512
e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe

Download Submit
\Windows\SysWOW64\hfnapi.dll
Filesize
106KB

MD5
04e7dbdf604a6960ad2899680dfd07f5

SHA1
4e2b1a98478b11d3b11edb354b5658e1b81ce52e

SHA256
be3f75137bb71746272edf59386446e62e02cc0213b488c85531571456a8d5fe

SHA512
c15790388fe7414876c386e7bc86517703a0703fad6f53c187b713e3349dc198f1d17cd8afde07bde32d95e9f530f455148984acfbf7d488b08b5bc2e1027c4d

Download Submit
\Windows\SysWOW64\hfnapi.dll
Filesize
106KB

MD5
04e7dbdf604a6960ad2899680dfd07f5

SHA1
4e2b1a98478b11d3b11edb354b5658e1b81ce52e

SHA256
be3f75137bb71746272edf59386446e62e02cc0213b488c85531571456a8d5fe

SHA512
c15790388fe7414876c386e7bc86517703a0703fad6f53c187b713e3349dc198f1d17cd8afde07bde32d95e9f530f455148984acfbf7d488b08b5bc2e1027c4d

Download Submit
\Windows\SysWOW64\hfnapi.dll
Filesize
106KB

MD5
04e7dbdf604a6960ad2899680dfd07f5

SHA1
4e2b1a98478b11d3b11edb354b5658e1b81ce52e

SHA256
be3f75137bb71746272edf59386446e62e02cc0213b488c85531571456a8d5fe

SHA512
c15790388fe7414876c386e7bc86517703a0703fad6f53c187b713e3349dc198f1d17cd8afde07bde32d95e9f530f455148984acfbf7d488b08b5bc2e1027c4d

Download Submit
\Windows\SysWOW64\hfpapi.dll
Filesize
241KB

MD5
c04828a4a439bfcc07c9ef0bc8583e12

SHA1
2a2915fad4f28c0726a592e752b536c8619d4e73

SHA256
88fb4c40efd7bf4337866f798ec439c78254875ea41634d2a9f82c506b54ad86

SHA512
5d924f26de761d14d484c5c7ef7ae440b81cc3044602ee7181a2eeecc0d632d45d50902bcc28b72bdafd5ad0d714730c8d3f11a78920f6cb256933ad71e30282

Download Submit
\Windows\SysWOW64\hfpapi.dll
Filesize
241KB

MD5
c04828a4a439bfcc07c9ef0bc8583e12

SHA1
2a2915fad4f28c0726a592e752b536c8619d4e73

SHA256
88fb4c40efd7bf4337866f798ec439c78254875ea41634d2a9f82c506b54ad86

SHA512
5d924f26de761d14d484c5c7ef7ae440b81cc3044602ee7181a2eeecc0d632d45d50902bcc28b72bdafd5ad0d714730c8d3f11a78920f6cb256933ad71e30282

Download Submit
\Windows\SysWOW64\installd.exe
Filesize
108KB

MD5
fcfdc062a200ebcb18a1fcc38dd7923e

SHA1
cf8fb2d552aa7fd6417bb3814347b4d650974864

SHA256
229f1d4cdcf71cb1fb00916df92a897df4a8391ad390ecd4715eebf7f926f915

SHA512
7c7d3f53fe963d70b827610faccbbab0402064612f866c18d18d3a7aeb7bb50029a5f5df7ff59cb01c76ab089adbaca48e23c08f21ac9ea867f1abbdcfc76beb

Download Submit
\Windows\SysWOW64\nethtsrv.exe
Filesize
176KB

MD5
a51307e3650861cac02035dcdc83cca0

SHA1
b73ad159e6bf804ecbf93801ab0b27396f8b6081

SHA256
610630f35bd993328880701aa0daf216867d48630414c223d1610776ccff3590

SHA512
79cf9cf834b643a2673a75f207b5e1ba914da2b725ec881a5815d7205dece39b3e2147993627ed48c1a9da0cb8a390e125c0edf074167894576fa819f03c4232

Download Submit
\Windows\SysWOW64\netupdsrv.exe
Filesize
158KB

MD5
17630e45d608b8ddd8dbdc5950ed9171

SHA1
b66e9889cb133bb46216d8e1576820f0839ead4f

SHA256
9d5b0b735fa238204fbce2d3d17af12f8daa89134d379ae8cc515b78a0e98bdb

SHA512
5a66996de96024b69f2ded38abf80dc6434645adcbeb70273c24c65c585a9a858a26d4f777aeae596990df99eafd4b619785e6116ec4f706bd2d51d1cbaa80b4

Download Submit
memory/240-58-0x0000000000000000-mapping.dmp

Download
memory/808-85-0x0000000000000000-mapping.dmp

Download
memory/828-86-0x0000000000000000-mapping.dmp

Download
memory/840-63-0x0000000000000000-mapping.dmp

Download
memory/1040-80-0x0000000000000000-mapping.dmp

Download
memory/1060-69-0x0000000000000000-mapping.dmp

Download
memory/1120-61-0x0000000000000000-mapping.dmp

Download
memory/1292-60-0x0000000000000000-mapping.dmp

Download
memory/1312-79-0x0000000000000000-mapping.dmp

Download
memory/1368-54-0x0000000076071000-0x0000000076073000-memory.dmp

Filesize
8KB

Download
memory/1472-75-0x0000000000000000-mapping.dmp

Download
memory/1808-57-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads