Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
146s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system -
submitted
22/11/2022, 00:06
Static task
static1
Behavioral task
behavioral1
Sample
2f27190900fd6db99628a2c51af38169c5163a621250ce3d15cea71d1e10c7b6.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
2f27190900fd6db99628a2c51af38169c5163a621250ce3d15cea71d1e10c7b6.exe
Resource
win10v2004-20221111-en
General
-
Target
2f27190900fd6db99628a2c51af38169c5163a621250ce3d15cea71d1e10c7b6.exe
-
Size
601KB
-
MD5
b5ab35800fd5e11b6257477de7cbf691
-
SHA1
61873ab0f8a935f7c672e72b43c1b5c9e7bd977c
-
SHA256
2f27190900fd6db99628a2c51af38169c5163a621250ce3d15cea71d1e10c7b6
-
SHA512
2a7a078c334f89225f3362069355dc9726d77ea56a9901271ab47e16d525739e2a531c2dce25be450f8c03f7bb1fa7954ce60166fae93ad05d14bc44603582c7
-
SSDEEP
12288:7Iny5DYT5IbKAy9uU8X+4z1uGUFIihc+HSC+eQDtN/Ic:DUT5kKz9v8XjzQpOCjEz
Malware Config
Signatures
-
Drops file in Drivers directory 1 IoCs
description ioc Process File created C:\Windows\system32\drivers\nethfdrv.sys 2f27190900fd6db99628a2c51af38169c5163a621250ce3d15cea71d1e10c7b6.exe -
Executes dropped EXE 5 IoCs
pid Process 1388 installd.exe 328 nethtsrv.exe 672 netupdsrv.exe 4536 nethtsrv.exe 368 netupdsrv.exe -
Loads dropped DLL 14 IoCs
pid Process 3872 2f27190900fd6db99628a2c51af38169c5163a621250ce3d15cea71d1e10c7b6.exe 3872 2f27190900fd6db99628a2c51af38169c5163a621250ce3d15cea71d1e10c7b6.exe 3872 2f27190900fd6db99628a2c51af38169c5163a621250ce3d15cea71d1e10c7b6.exe 3872 2f27190900fd6db99628a2c51af38169c5163a621250ce3d15cea71d1e10c7b6.exe 3872 2f27190900fd6db99628a2c51af38169c5163a621250ce3d15cea71d1e10c7b6.exe 1388 installd.exe 328 nethtsrv.exe 328 nethtsrv.exe 3872 2f27190900fd6db99628a2c51af38169c5163a621250ce3d15cea71d1e10c7b6.exe 3872 2f27190900fd6db99628a2c51af38169c5163a621250ce3d15cea71d1e10c7b6.exe 4536 nethtsrv.exe 4536 nethtsrv.exe 3872 2f27190900fd6db99628a2c51af38169c5163a621250ce3d15cea71d1e10c7b6.exe 3872 2f27190900fd6db99628a2c51af38169c5163a621250ce3d15cea71d1e10c7b6.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops file in System32 directory 5 IoCs
description ioc Process File created C:\Windows\SysWOW64\hfnapi.dll 2f27190900fd6db99628a2c51af38169c5163a621250ce3d15cea71d1e10c7b6.exe File created C:\Windows\SysWOW64\hfpapi.dll 2f27190900fd6db99628a2c51af38169c5163a621250ce3d15cea71d1e10c7b6.exe File created C:\Windows\SysWOW64\installd.exe 2f27190900fd6db99628a2c51af38169c5163a621250ce3d15cea71d1e10c7b6.exe File created C:\Windows\SysWOW64\nethtsrv.exe 2f27190900fd6db99628a2c51af38169c5163a621250ce3d15cea71d1e10c7b6.exe File created C:\Windows\SysWOW64\netupdsrv.exe 2f27190900fd6db99628a2c51af38169c5163a621250ce3d15cea71d1e10c7b6.exe -
Drops file in Program Files directory 3 IoCs
description ioc Process File created C:\Program Files (x86)\Common Files\Config\data.xml 2f27190900fd6db99628a2c51af38169c5163a621250ce3d15cea71d1e10c7b6.exe File created C:\Program Files (x86)\Common Files\Config\ver.xml 2f27190900fd6db99628a2c51af38169c5163a621250ce3d15cea71d1e10c7b6.exe File created C:\Program Files (x86)\Common Files\config\uninstinethnfd.exe 2f27190900fd6db99628a2c51af38169c5163a621250ce3d15cea71d1e10c7b6.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Modifies data under HKEY_USERS 1 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections nethtsrv.exe -
Runs net.exe
-
Suspicious behavior: LoadsDriver 1 IoCs
pid Process 648 Process not Found -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 4536 nethtsrv.exe -
Suspicious use of WriteProcessMemory 33 IoCs
description pid Process procid_target PID 3872 wrote to memory of 836 3872 2f27190900fd6db99628a2c51af38169c5163a621250ce3d15cea71d1e10c7b6.exe 84 PID 3872 wrote to memory of 836 3872 2f27190900fd6db99628a2c51af38169c5163a621250ce3d15cea71d1e10c7b6.exe 84 PID 3872 wrote to memory of 836 3872 2f27190900fd6db99628a2c51af38169c5163a621250ce3d15cea71d1e10c7b6.exe 84 PID 836 wrote to memory of 3428 836 net.exe 86 PID 836 wrote to memory of 3428 836 net.exe 86 PID 836 wrote to memory of 3428 836 net.exe 86 PID 3872 wrote to memory of 5012 3872 2f27190900fd6db99628a2c51af38169c5163a621250ce3d15cea71d1e10c7b6.exe 87 PID 3872 wrote to memory of 5012 3872 2f27190900fd6db99628a2c51af38169c5163a621250ce3d15cea71d1e10c7b6.exe 87 PID 3872 wrote to memory of 5012 3872 2f27190900fd6db99628a2c51af38169c5163a621250ce3d15cea71d1e10c7b6.exe 87 PID 5012 wrote to memory of 1048 5012 net.exe 89 PID 5012 wrote to memory of 1048 5012 net.exe 89 PID 5012 wrote to memory of 1048 5012 net.exe 89 PID 3872 wrote to memory of 1388 3872 2f27190900fd6db99628a2c51af38169c5163a621250ce3d15cea71d1e10c7b6.exe 90 PID 3872 wrote to memory of 1388 3872 2f27190900fd6db99628a2c51af38169c5163a621250ce3d15cea71d1e10c7b6.exe 90 PID 3872 wrote to memory of 1388 3872 2f27190900fd6db99628a2c51af38169c5163a621250ce3d15cea71d1e10c7b6.exe 90 PID 3872 wrote to memory of 328 3872 2f27190900fd6db99628a2c51af38169c5163a621250ce3d15cea71d1e10c7b6.exe 91 PID 3872 wrote to memory of 328 3872 2f27190900fd6db99628a2c51af38169c5163a621250ce3d15cea71d1e10c7b6.exe 91 PID 3872 wrote to memory of 328 3872 2f27190900fd6db99628a2c51af38169c5163a621250ce3d15cea71d1e10c7b6.exe 91 PID 3872 wrote to memory of 672 3872 2f27190900fd6db99628a2c51af38169c5163a621250ce3d15cea71d1e10c7b6.exe 93 PID 3872 wrote to memory of 672 3872 2f27190900fd6db99628a2c51af38169c5163a621250ce3d15cea71d1e10c7b6.exe 93 PID 3872 wrote to memory of 672 3872 2f27190900fd6db99628a2c51af38169c5163a621250ce3d15cea71d1e10c7b6.exe 93 PID 3872 wrote to memory of 2424 3872 2f27190900fd6db99628a2c51af38169c5163a621250ce3d15cea71d1e10c7b6.exe 95 PID 3872 wrote to memory of 2424 3872 2f27190900fd6db99628a2c51af38169c5163a621250ce3d15cea71d1e10c7b6.exe 95 PID 3872 wrote to memory of 2424 3872 2f27190900fd6db99628a2c51af38169c5163a621250ce3d15cea71d1e10c7b6.exe 95 PID 2424 wrote to memory of 4596 2424 net.exe 97 PID 2424 wrote to memory of 4596 2424 net.exe 97 PID 2424 wrote to memory of 4596 2424 net.exe 97 PID 3872 wrote to memory of 2716 3872 2f27190900fd6db99628a2c51af38169c5163a621250ce3d15cea71d1e10c7b6.exe 99 PID 3872 wrote to memory of 2716 3872 2f27190900fd6db99628a2c51af38169c5163a621250ce3d15cea71d1e10c7b6.exe 99 PID 3872 wrote to memory of 2716 3872 2f27190900fd6db99628a2c51af38169c5163a621250ce3d15cea71d1e10c7b6.exe 99 PID 2716 wrote to memory of 2244 2716 net.exe 101 PID 2716 wrote to memory of 2244 2716 net.exe 101 PID 2716 wrote to memory of 2244 2716 net.exe 101
Processes
-
C:\Users\Admin\AppData\Local\Temp\2f27190900fd6db99628a2c51af38169c5163a621250ce3d15cea71d1e10c7b6.exe"C:\Users\Admin\AppData\Local\Temp\2f27190900fd6db99628a2c51af38169c5163a621250ce3d15cea71d1e10c7b6.exe"1⤵
- Drops file in Drivers directory
- Loads dropped DLL
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:3872 -
C:\Windows\SysWOW64\net.exenet stop nethttpservice2⤵
- Suspicious use of WriteProcessMemory
PID:836 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop nethttpservice3⤵PID:3428
-
-
-
C:\Windows\SysWOW64\net.exenet stop serviceupdater2⤵
- Suspicious use of WriteProcessMemory
PID:5012 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop serviceupdater3⤵PID:1048
-
-
-
C:\Windows\SysWOW64\installd.exe"C:\Windows\system32\installd.exe" nethfdrv2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1388
-
-
C:\Windows\SysWOW64\nethtsrv.exe"C:\Windows\system32\nethtsrv.exe" -nfdi2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:328
-
-
C:\Windows\SysWOW64\netupdsrv.exe"C:\Windows\system32\netupdsrv.exe" -nfdi2⤵
- Executes dropped EXE
PID:672
-
-
C:\Windows\SysWOW64\net.exenet start nethttpservice2⤵
- Suspicious use of WriteProcessMemory
PID:2424 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 start nethttpservice3⤵PID:4596
-
-
-
C:\Windows\SysWOW64\net.exenet start serviceupdater2⤵
- Suspicious use of WriteProcessMemory
PID:2716 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 start serviceupdater3⤵PID:2244
-
-
-
C:\Windows\SysWOW64\nethtsrv.exeC:\Windows\SysWOW64\nethtsrv.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:4536
-
C:\Windows\SysWOW64\netupdsrv.exeC:\Windows\SysWOW64\netupdsrv.exe1⤵
- Executes dropped EXE
PID:368
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
11KB
MD5c17103ae9072a06da581dec998343fc1
SHA1b72148c6bdfaada8b8c3f950e610ee7cf1da1f8d
SHA256dc58d8ad81cacb0c1ed72e33bff8f23ea40b5252b5bb55d393a0903e6819ae2f
SHA512d32a71aaef18e993f28096d536e41c4d016850721b31171513ce28bbd805a54fd290b7c3e9d935f72e676a1acfb4f0dcc89d95040a0dd29f2b6975855c18986f
-
Filesize
6KB
MD5acc2b699edfea5bf5aae45aba3a41e96
SHA1d2accf4d494e43ceb2cff69abe4dd17147d29cc2
SHA256168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e
SHA512e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe
-
Filesize
6KB
MD5acc2b699edfea5bf5aae45aba3a41e96
SHA1d2accf4d494e43ceb2cff69abe4dd17147d29cc2
SHA256168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e
SHA512e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe
-
Filesize
6KB
MD5acc2b699edfea5bf5aae45aba3a41e96
SHA1d2accf4d494e43ceb2cff69abe4dd17147d29cc2
SHA256168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e
SHA512e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe
-
Filesize
6KB
MD5acc2b699edfea5bf5aae45aba3a41e96
SHA1d2accf4d494e43ceb2cff69abe4dd17147d29cc2
SHA256168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e
SHA512e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe
-
Filesize
6KB
MD5acc2b699edfea5bf5aae45aba3a41e96
SHA1d2accf4d494e43ceb2cff69abe4dd17147d29cc2
SHA256168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e
SHA512e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe
-
Filesize
6KB
MD5acc2b699edfea5bf5aae45aba3a41e96
SHA1d2accf4d494e43ceb2cff69abe4dd17147d29cc2
SHA256168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e
SHA512e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe
-
Filesize
6KB
MD5acc2b699edfea5bf5aae45aba3a41e96
SHA1d2accf4d494e43ceb2cff69abe4dd17147d29cc2
SHA256168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e
SHA512e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe
-
Filesize
6KB
MD5acc2b699edfea5bf5aae45aba3a41e96
SHA1d2accf4d494e43ceb2cff69abe4dd17147d29cc2
SHA256168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e
SHA512e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe
-
Filesize
106KB
MD5f77670af20abc4fa4116ca68b662e0fa
SHA124509bc0bea05ecfd779917d7cd44110573622ca
SHA25608de5d7e051e9a11ab0d873f71643f8f8a14d322039f6bf37306873867cef1ae
SHA512e5b529e8fa842e21f6be51262366ecb507704f23436f8f6e6eac037da27f6bbf3dcf3ef665c3db1730df0f78f99f691d56a3bcdeb5f6d9efdb5c9c597440d1e5
-
Filesize
106KB
MD5f77670af20abc4fa4116ca68b662e0fa
SHA124509bc0bea05ecfd779917d7cd44110573622ca
SHA25608de5d7e051e9a11ab0d873f71643f8f8a14d322039f6bf37306873867cef1ae
SHA512e5b529e8fa842e21f6be51262366ecb507704f23436f8f6e6eac037da27f6bbf3dcf3ef665c3db1730df0f78f99f691d56a3bcdeb5f6d9efdb5c9c597440d1e5
-
Filesize
106KB
MD5f77670af20abc4fa4116ca68b662e0fa
SHA124509bc0bea05ecfd779917d7cd44110573622ca
SHA25608de5d7e051e9a11ab0d873f71643f8f8a14d322039f6bf37306873867cef1ae
SHA512e5b529e8fa842e21f6be51262366ecb507704f23436f8f6e6eac037da27f6bbf3dcf3ef665c3db1730df0f78f99f691d56a3bcdeb5f6d9efdb5c9c597440d1e5
-
Filesize
106KB
MD5f77670af20abc4fa4116ca68b662e0fa
SHA124509bc0bea05ecfd779917d7cd44110573622ca
SHA25608de5d7e051e9a11ab0d873f71643f8f8a14d322039f6bf37306873867cef1ae
SHA512e5b529e8fa842e21f6be51262366ecb507704f23436f8f6e6eac037da27f6bbf3dcf3ef665c3db1730df0f78f99f691d56a3bcdeb5f6d9efdb5c9c597440d1e5
-
Filesize
241KB
MD5de4f91fe36af0d9040899a3f718811c4
SHA1e2d9eed08e79f34a4ad58b847e2d6979a6443fed
SHA2568f7cc2370de9cd8006be8ea05809ea9f2d25cf4a781e6e261505d206b5d0bdf4
SHA5125e060f2b657b3d499993c4ca70b885ccc6f52620f476f9bc0c51c3797c573aa836d6f241722eb4a2c2b0a8cf2461e125545e77a3e40cb555cbd184e865c66909
-
Filesize
241KB
MD5de4f91fe36af0d9040899a3f718811c4
SHA1e2d9eed08e79f34a4ad58b847e2d6979a6443fed
SHA2568f7cc2370de9cd8006be8ea05809ea9f2d25cf4a781e6e261505d206b5d0bdf4
SHA5125e060f2b657b3d499993c4ca70b885ccc6f52620f476f9bc0c51c3797c573aa836d6f241722eb4a2c2b0a8cf2461e125545e77a3e40cb555cbd184e865c66909
-
Filesize
241KB
MD5de4f91fe36af0d9040899a3f718811c4
SHA1e2d9eed08e79f34a4ad58b847e2d6979a6443fed
SHA2568f7cc2370de9cd8006be8ea05809ea9f2d25cf4a781e6e261505d206b5d0bdf4
SHA5125e060f2b657b3d499993c4ca70b885ccc6f52620f476f9bc0c51c3797c573aa836d6f241722eb4a2c2b0a8cf2461e125545e77a3e40cb555cbd184e865c66909
-
Filesize
108KB
MD5e8b38e7304ef0f2aab1b49577f9341b4
SHA1e1b542581a56dfabc3d85ff2726c2c1ca0858813
SHA256b36c54d7ad59b59b3bef4a4f98966fcdee11ce90e5732f159f1e629281248652
SHA512aff4017ad11ec236c7a6c4ff2cabef2ff9c9766f6c1e05061bba82877eb0f4d956e7468409ff83b67072c5848e4b3a3bd7f36413322de26c95933ee87bad05ca
-
Filesize
108KB
MD5e8b38e7304ef0f2aab1b49577f9341b4
SHA1e1b542581a56dfabc3d85ff2726c2c1ca0858813
SHA256b36c54d7ad59b59b3bef4a4f98966fcdee11ce90e5732f159f1e629281248652
SHA512aff4017ad11ec236c7a6c4ff2cabef2ff9c9766f6c1e05061bba82877eb0f4d956e7468409ff83b67072c5848e4b3a3bd7f36413322de26c95933ee87bad05ca
-
Filesize
176KB
MD5538d8d403892785e6c6111a413bb8371
SHA11c9f8d616dcd4ae7b65ae8f35ebfeed7dc6f6c15
SHA25682f61ef6a0043522f8f9e151a2954f999f9d47b61258542ef55c4481ec3517ec
SHA512978b59d8ee9292bf606490971aa4d8f41fd2bf7e33c63f336a602eb67c130caf3c08fd1018a015351ba2c711cb8bfb4bc498fc0094c500b03f000b0462cbd0fe
-
Filesize
176KB
MD5538d8d403892785e6c6111a413bb8371
SHA11c9f8d616dcd4ae7b65ae8f35ebfeed7dc6f6c15
SHA25682f61ef6a0043522f8f9e151a2954f999f9d47b61258542ef55c4481ec3517ec
SHA512978b59d8ee9292bf606490971aa4d8f41fd2bf7e33c63f336a602eb67c130caf3c08fd1018a015351ba2c711cb8bfb4bc498fc0094c500b03f000b0462cbd0fe
-
Filesize
176KB
MD5538d8d403892785e6c6111a413bb8371
SHA11c9f8d616dcd4ae7b65ae8f35ebfeed7dc6f6c15
SHA25682f61ef6a0043522f8f9e151a2954f999f9d47b61258542ef55c4481ec3517ec
SHA512978b59d8ee9292bf606490971aa4d8f41fd2bf7e33c63f336a602eb67c130caf3c08fd1018a015351ba2c711cb8bfb4bc498fc0094c500b03f000b0462cbd0fe
-
Filesize
159KB
MD55f2581d6201689939ac6e3efa360a265
SHA15d320da89c7258c1eeeffe5ab268164675f066ec
SHA2567962477c3d4f4be07ff738831bc2cbea2126e611de34a6219cd21d51b42986fe
SHA5123b0682dccc04f0f80ad71044d6d67c31cb055e8c541af9fbddab4ed22bc83f2fdce132bca5804edf6634ad4b39d52d3144507cb0e15afeeec25eec04d035faab
-
Filesize
159KB
MD55f2581d6201689939ac6e3efa360a265
SHA15d320da89c7258c1eeeffe5ab268164675f066ec
SHA2567962477c3d4f4be07ff738831bc2cbea2126e611de34a6219cd21d51b42986fe
SHA5123b0682dccc04f0f80ad71044d6d67c31cb055e8c541af9fbddab4ed22bc83f2fdce132bca5804edf6634ad4b39d52d3144507cb0e15afeeec25eec04d035faab
-
Filesize
159KB
MD55f2581d6201689939ac6e3efa360a265
SHA15d320da89c7258c1eeeffe5ab268164675f066ec
SHA2567962477c3d4f4be07ff738831bc2cbea2126e611de34a6219cd21d51b42986fe
SHA5123b0682dccc04f0f80ad71044d6d67c31cb055e8c541af9fbddab4ed22bc83f2fdce132bca5804edf6634ad4b39d52d3144507cb0e15afeeec25eec04d035faab