6d51c212a09f62e92f2df99594f8128be34b77195c96ce71cb4322c2d102d709

General

Target

6d51c212a09f62e92f2df99594f8128be34b77195c96ce71cb4322c2d102d709.exe
Size

124KB
MD5

444ec599045d30aa7bf2a7605fca0ebc
SHA1

e051128d573aa1a0db0b89925b6845030cb4e33d
SHA256

6d51c212a09f62e92f2df99594f8128be34b77195c96ce71cb4322c2d102d709
SHA512

dcb27b84291dc788d639968b6d67f4e0afa7e825d752f4099adeb64843996d0ba4d6b8aaa6605fea7cf003078dc4430ab613cc9faf6447d5bafa05f66dd4214e
SSDEEP

1536:2Jszf5Y2ThRO/N69BH3OoGa+FLHjKKvRgrkOSodPNeG0h/y:kGhY2ThkFoN3Oo1+FvkScIq

Score

10^/10

evasion persistence

Malware Config

Signatures

Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs

evasion

Hidden Files and Directories

T1158

Modify Registry

T1112

Processes:

6d51c212a09f62e92f2df99594f8128be34b77195c96ce71cb4322c2d102d709.exenhfiw.exe

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	6d51c212a09f62e92f2df99594f8128be34b77195c96ce71cb4322c2d102d709.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	nhfiw.exe

Executes dropped EXE 1 IoCs

Processes:

nhfiw.exe

pid process

520 nhfiw.exe

pid	process
520	nhfiw.exe

Loads dropped DLL 2 IoCs

Processes:

6d51c212a09f62e92f2df99594f8128be34b77195c96ce71cb4322c2d102d709.exe

pid	process
2036	6d51c212a09f62e92f2df99594f8128be34b77195c96ce71cb4322c2d102d709.exe
2036	6d51c212a09f62e92f2df99594f8128be34b77195c96ce71cb4322c2d102d709.exe

Adds Run key to start application 2 TTPs 47 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

6d51c212a09f62e92f2df99594f8128be34b77195c96ce71cb4322c2d102d709.exenhfiw.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\nhfiw = "C:\\Users\\Admin\\nhfiw.exe /T"	6d51c212a09f62e92f2df99594f8128be34b77195c96ce71cb4322c2d102d709.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\nhfiw = "C:\\Users\\Admin\\nhfiw.exe /x"	nhfiw.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\nhfiw = "C:\\Users\\Admin\\nhfiw.exe /y"	nhfiw.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\nhfiw = "C:\\Users\\Admin\\nhfiw.exe /f"	nhfiw.exe
Key created	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\	6d51c212a09f62e92f2df99594f8128be34b77195c96ce71cb4322c2d102d709.exe
Key created	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\	nhfiw.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\nhfiw = "C:\\Users\\Admin\\nhfiw.exe /E"	nhfiw.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\nhfiw = "C:\\Users\\Admin\\nhfiw.exe /l"	nhfiw.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\nhfiw = "C:\\Users\\Admin\\nhfiw.exe /D"	nhfiw.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\nhfiw = "C:\\Users\\Admin\\nhfiw.exe /A"	nhfiw.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\nhfiw = "C:\\Users\\Admin\\nhfiw.exe /j"	nhfiw.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\nhfiw = "C:\\Users\\Admin\\nhfiw.exe /c"	nhfiw.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\nhfiw = "C:\\Users\\Admin\\nhfiw.exe /q"	nhfiw.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\nhfiw = "C:\\Users\\Admin\\nhfiw.exe /F"	nhfiw.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\nhfiw = "C:\\Users\\Admin\\nhfiw.exe /P"	nhfiw.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\nhfiw = "C:\\Users\\Admin\\nhfiw.exe /B"	nhfiw.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\nhfiw = "C:\\Users\\Admin\\nhfiw.exe /t"	nhfiw.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\nhfiw = "C:\\Users\\Admin\\nhfiw.exe /m"	nhfiw.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\nhfiw = "C:\\Users\\Admin\\nhfiw.exe /o"	nhfiw.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\nhfiw = "C:\\Users\\Admin\\nhfiw.exe /e"	nhfiw.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\nhfiw = "C:\\Users\\Admin\\nhfiw.exe /z"	nhfiw.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\nhfiw = "C:\\Users\\Admin\\nhfiw.exe /W"	nhfiw.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\nhfiw = "C:\\Users\\Admin\\nhfiw.exe /T"	nhfiw.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\nhfiw = "C:\\Users\\Admin\\nhfiw.exe /C"	nhfiw.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\nhfiw = "C:\\Users\\Admin\\nhfiw.exe /L"	nhfiw.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\nhfiw = "C:\\Users\\Admin\\nhfiw.exe /I"	nhfiw.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\nhfiw = "C:\\Users\\Admin\\nhfiw.exe /n"	nhfiw.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\nhfiw = "C:\\Users\\Admin\\nhfiw.exe /r"	nhfiw.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\nhfiw = "C:\\Users\\Admin\\nhfiw.exe /w"	nhfiw.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\nhfiw = "C:\\Users\\Admin\\nhfiw.exe /v"	nhfiw.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\nhfiw = "C:\\Users\\Admin\\nhfiw.exe /N"	nhfiw.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\nhfiw = "C:\\Users\\Admin\\nhfiw.exe /U"	nhfiw.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\nhfiw = "C:\\Users\\Admin\\nhfiw.exe /Q"	nhfiw.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\nhfiw = "C:\\Users\\Admin\\nhfiw.exe /b"	nhfiw.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\nhfiw = "C:\\Users\\Admin\\nhfiw.exe /S"	nhfiw.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\nhfiw = "C:\\Users\\Admin\\nhfiw.exe /u"	nhfiw.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\nhfiw = "C:\\Users\\Admin\\nhfiw.exe /d"	nhfiw.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\nhfiw = "C:\\Users\\Admin\\nhfiw.exe /M"	nhfiw.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\nhfiw = "C:\\Users\\Admin\\nhfiw.exe /Z"	nhfiw.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\nhfiw = "C:\\Users\\Admin\\nhfiw.exe /V"	nhfiw.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\nhfiw = "C:\\Users\\Admin\\nhfiw.exe /h"	nhfiw.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\nhfiw = "C:\\Users\\Admin\\nhfiw.exe /g"	nhfiw.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\nhfiw = "C:\\Users\\Admin\\nhfiw.exe /X"	nhfiw.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\nhfiw = "C:\\Users\\Admin\\nhfiw.exe /k"	nhfiw.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\nhfiw = "C:\\Users\\Admin\\nhfiw.exe /H"	nhfiw.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\nhfiw = "C:\\Users\\Admin\\nhfiw.exe /K"	nhfiw.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\nhfiw = "C:\\Users\\Admin\\nhfiw.exe /i"	nhfiw.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

6d51c212a09f62e92f2df99594f8128be34b77195c96ce71cb4322c2d102d709.exenhfiw.exe

pid	process
2036	6d51c212a09f62e92f2df99594f8128be34b77195c96ce71cb4322c2d102d709.exe
520	nhfiw.exe
520	nhfiw.exe
520	nhfiw.exe
520	nhfiw.exe
520	nhfiw.exe
520	nhfiw.exe
520	nhfiw.exe
520	nhfiw.exe
520	nhfiw.exe
520	nhfiw.exe
520	nhfiw.exe
520	nhfiw.exe
520	nhfiw.exe
520	nhfiw.exe
520	nhfiw.exe
520	nhfiw.exe
520	nhfiw.exe
520	nhfiw.exe
520	nhfiw.exe
520	nhfiw.exe
520	nhfiw.exe
520	nhfiw.exe
520	nhfiw.exe
520	nhfiw.exe
520	nhfiw.exe
520	nhfiw.exe
520	nhfiw.exe
520	nhfiw.exe
520	nhfiw.exe
520	nhfiw.exe
520	nhfiw.exe
520	nhfiw.exe
520	nhfiw.exe
520	nhfiw.exe
520	nhfiw.exe
520	nhfiw.exe
520	nhfiw.exe
520	nhfiw.exe
520	nhfiw.exe
520	nhfiw.exe
520	nhfiw.exe
520	nhfiw.exe
520	nhfiw.exe
520	nhfiw.exe
520	nhfiw.exe
520	nhfiw.exe
520	nhfiw.exe
520	nhfiw.exe
520	nhfiw.exe
520	nhfiw.exe
520	nhfiw.exe
520	nhfiw.exe
520	nhfiw.exe
520	nhfiw.exe
520	nhfiw.exe
520	nhfiw.exe
520	nhfiw.exe
520	nhfiw.exe
520	nhfiw.exe
520	nhfiw.exe
520	nhfiw.exe
520	nhfiw.exe
520	nhfiw.exe

Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

6d51c212a09f62e92f2df99594f8128be34b77195c96ce71cb4322c2d102d709.exenhfiw.exe

pid process

2036 6d51c212a09f62e92f2df99594f8128be34b77195c96ce71cb4322c2d102d709.exe
520 nhfiw.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

6d51c212a09f62e92f2df99594f8128be34b77195c96ce71cb4322c2d102d709.exe

description	pid	process	target process
PID 2036 wrote to memory of 520	2036	6d51c212a09f62e92f2df99594f8128be34b77195c96ce71cb4322c2d102d709.exe	nhfiw.exe
PID 2036 wrote to memory of 520	2036	6d51c212a09f62e92f2df99594f8128be34b77195c96ce71cb4322c2d102d709.exe	nhfiw.exe
PID 2036 wrote to memory of 520	2036	6d51c212a09f62e92f2df99594f8128be34b77195c96ce71cb4322c2d102d709.exe	nhfiw.exe
PID 2036 wrote to memory of 520	2036	6d51c212a09f62e92f2df99594f8128be34b77195c96ce71cb4322c2d102d709.exe	nhfiw.exe

C:\Users\Admin\AppData\Local\Temp\6d51c212a09f62e92f2df99594f8128be34b77195c96ce71cb4322c2d102d709.exe
"C:\Users\Admin\AppData\Local\Temp\6d51c212a09f62e92f2df99594f8128be34b77195c96ce71cb4322c2d102d709.exe"
1⤵
- Modifies visiblity of hidden/system files in Explorer
- Loads dropped DLL
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2036

C:\Users\Admin\nhfiw.exe
"C:\Users\Admin\nhfiw.exe"
2⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:520

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Hidden Files and Directories

1

T1158

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Hidden Files and Directories

Modify Registry

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\nhfiw.exe

Filesize
124KB

MD5
6f0dfe9804bb2cbe7d207b97e77aa7e2

SHA1
45ada08c687d1af9d68ac9e5a35f6ed82334b8d7

SHA256
a81b732cc94843df86ead8fe64ce9684c9a419f86629bd5d3dbc91d3e9d1805e

SHA512
3d727cc074b7f9ed4b3aafe4726e565f70ae18ec869bd3a5997300f1b6b71330e79f912628e9981981e3882c257ba87075ba9945181daee53344d24f9e8781f1

Download Submit
C:\Users\Admin\nhfiw.exe

Filesize
124KB

MD5
6f0dfe9804bb2cbe7d207b97e77aa7e2

SHA1
45ada08c687d1af9d68ac9e5a35f6ed82334b8d7

SHA256
a81b732cc94843df86ead8fe64ce9684c9a419f86629bd5d3dbc91d3e9d1805e

SHA512
3d727cc074b7f9ed4b3aafe4726e565f70ae18ec869bd3a5997300f1b6b71330e79f912628e9981981e3882c257ba87075ba9945181daee53344d24f9e8781f1

Download Submit
\Users\Admin\nhfiw.exe

Filesize
124KB

MD5
6f0dfe9804bb2cbe7d207b97e77aa7e2

SHA1
45ada08c687d1af9d68ac9e5a35f6ed82334b8d7

SHA256
a81b732cc94843df86ead8fe64ce9684c9a419f86629bd5d3dbc91d3e9d1805e

SHA512
3d727cc074b7f9ed4b3aafe4726e565f70ae18ec869bd3a5997300f1b6b71330e79f912628e9981981e3882c257ba87075ba9945181daee53344d24f9e8781f1

Download Submit
\Users\Admin\nhfiw.exe

Filesize
124KB

MD5
6f0dfe9804bb2cbe7d207b97e77aa7e2

SHA1
45ada08c687d1af9d68ac9e5a35f6ed82334b8d7

SHA256
a81b732cc94843df86ead8fe64ce9684c9a419f86629bd5d3dbc91d3e9d1805e

SHA512
3d727cc074b7f9ed4b3aafe4726e565f70ae18ec869bd3a5997300f1b6b71330e79f912628e9981981e3882c257ba87075ba9945181daee53344d24f9e8781f1

Download Submit
memory/520-59-0x0000000000000000-mapping.dmp

Download
memory/2036-56-0x0000000075FE1000-0x0000000075FE3000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads