Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system -
submitted
22/11/2022, 00:10
Static task
static1
Behavioral task
behavioral1
Sample
d8521fd8cb6907d7901bad1675542969e11d3f637a335134970ae74e9fb682b2.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
d8521fd8cb6907d7901bad1675542969e11d3f637a335134970ae74e9fb682b2.exe
Resource
win10v2004-20221111-en
General
-
Target
d8521fd8cb6907d7901bad1675542969e11d3f637a335134970ae74e9fb682b2.exe
-
Size
557KB
-
MD5
0c591c92332b4030957823e02f79b06e
-
SHA1
fe96c2b9767e64ff337774ae907412df060d442c
-
SHA256
d8521fd8cb6907d7901bad1675542969e11d3f637a335134970ae74e9fb682b2
-
SHA512
f20c57b038732e649f858470bbe05e3cd1e6bcd985165b45c6f17a7a84aa28beb3cb067f3220bff8f35ce11ccca423c6080e12f138b90729900a7e35a218434a
-
SSDEEP
12288:a2hB6D/bfzx8EM0ESWA1pXAaBKyu/olWp7qfdxG1VEjM4LV1UZxfGhUlh:mDjf2EMk1/BhuwlW1qlg1VEjhqYqH
Malware Config
Signatures
-
Drops file in Drivers directory 1 IoCs
description ioc Process File created C:\Windows\system32\drivers\nethfdrv.sys d8521fd8cb6907d7901bad1675542969e11d3f637a335134970ae74e9fb682b2.exe -
Executes dropped EXE 5 IoCs
pid Process 3272 installd.exe 2088 nethtsrv.exe 1032 netupdsrv.exe 768 nethtsrv.exe 4092 netupdsrv.exe -
Loads dropped DLL 14 IoCs
pid Process 4884 d8521fd8cb6907d7901bad1675542969e11d3f637a335134970ae74e9fb682b2.exe 4884 d8521fd8cb6907d7901bad1675542969e11d3f637a335134970ae74e9fb682b2.exe 4884 d8521fd8cb6907d7901bad1675542969e11d3f637a335134970ae74e9fb682b2.exe 4884 d8521fd8cb6907d7901bad1675542969e11d3f637a335134970ae74e9fb682b2.exe 4884 d8521fd8cb6907d7901bad1675542969e11d3f637a335134970ae74e9fb682b2.exe 3272 installd.exe 2088 nethtsrv.exe 2088 nethtsrv.exe 4884 d8521fd8cb6907d7901bad1675542969e11d3f637a335134970ae74e9fb682b2.exe 4884 d8521fd8cb6907d7901bad1675542969e11d3f637a335134970ae74e9fb682b2.exe 768 nethtsrv.exe 768 nethtsrv.exe 4884 d8521fd8cb6907d7901bad1675542969e11d3f637a335134970ae74e9fb682b2.exe 4884 d8521fd8cb6907d7901bad1675542969e11d3f637a335134970ae74e9fb682b2.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops file in System32 directory 5 IoCs
description ioc Process File created C:\Windows\SysWOW64\hfpapi.dll d8521fd8cb6907d7901bad1675542969e11d3f637a335134970ae74e9fb682b2.exe File created C:\Windows\SysWOW64\installd.exe d8521fd8cb6907d7901bad1675542969e11d3f637a335134970ae74e9fb682b2.exe File created C:\Windows\SysWOW64\nethtsrv.exe d8521fd8cb6907d7901bad1675542969e11d3f637a335134970ae74e9fb682b2.exe File created C:\Windows\SysWOW64\netupdsrv.exe d8521fd8cb6907d7901bad1675542969e11d3f637a335134970ae74e9fb682b2.exe File created C:\Windows\SysWOW64\hfnapi.dll d8521fd8cb6907d7901bad1675542969e11d3f637a335134970ae74e9fb682b2.exe -
Drops file in Program Files directory 3 IoCs
description ioc Process File created C:\Program Files (x86)\Common Files\Config\data.xml d8521fd8cb6907d7901bad1675542969e11d3f637a335134970ae74e9fb682b2.exe File created C:\Program Files (x86)\Common Files\Config\ver.xml d8521fd8cb6907d7901bad1675542969e11d3f637a335134970ae74e9fb682b2.exe File created C:\Program Files (x86)\Common Files\config\uninstinethnfd.exe d8521fd8cb6907d7901bad1675542969e11d3f637a335134970ae74e9fb682b2.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Modifies data under HKEY_USERS 1 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections nethtsrv.exe -
Runs net.exe
-
Suspicious behavior: LoadsDriver 1 IoCs
pid Process 648 Process not Found -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 768 nethtsrv.exe -
Suspicious use of WriteProcessMemory 33 IoCs
description pid Process procid_target PID 4884 wrote to memory of 3184 4884 d8521fd8cb6907d7901bad1675542969e11d3f637a335134970ae74e9fb682b2.exe 85 PID 4884 wrote to memory of 3184 4884 d8521fd8cb6907d7901bad1675542969e11d3f637a335134970ae74e9fb682b2.exe 85 PID 4884 wrote to memory of 3184 4884 d8521fd8cb6907d7901bad1675542969e11d3f637a335134970ae74e9fb682b2.exe 85 PID 3184 wrote to memory of 752 3184 net.exe 87 PID 3184 wrote to memory of 752 3184 net.exe 87 PID 3184 wrote to memory of 752 3184 net.exe 87 PID 4884 wrote to memory of 3404 4884 d8521fd8cb6907d7901bad1675542969e11d3f637a335134970ae74e9fb682b2.exe 88 PID 4884 wrote to memory of 3404 4884 d8521fd8cb6907d7901bad1675542969e11d3f637a335134970ae74e9fb682b2.exe 88 PID 4884 wrote to memory of 3404 4884 d8521fd8cb6907d7901bad1675542969e11d3f637a335134970ae74e9fb682b2.exe 88 PID 3404 wrote to memory of 1680 3404 net.exe 90 PID 3404 wrote to memory of 1680 3404 net.exe 90 PID 3404 wrote to memory of 1680 3404 net.exe 90 PID 4884 wrote to memory of 3272 4884 d8521fd8cb6907d7901bad1675542969e11d3f637a335134970ae74e9fb682b2.exe 91 PID 4884 wrote to memory of 3272 4884 d8521fd8cb6907d7901bad1675542969e11d3f637a335134970ae74e9fb682b2.exe 91 PID 4884 wrote to memory of 3272 4884 d8521fd8cb6907d7901bad1675542969e11d3f637a335134970ae74e9fb682b2.exe 91 PID 4884 wrote to memory of 2088 4884 d8521fd8cb6907d7901bad1675542969e11d3f637a335134970ae74e9fb682b2.exe 92 PID 4884 wrote to memory of 2088 4884 d8521fd8cb6907d7901bad1675542969e11d3f637a335134970ae74e9fb682b2.exe 92 PID 4884 wrote to memory of 2088 4884 d8521fd8cb6907d7901bad1675542969e11d3f637a335134970ae74e9fb682b2.exe 92 PID 4884 wrote to memory of 1032 4884 d8521fd8cb6907d7901bad1675542969e11d3f637a335134970ae74e9fb682b2.exe 94 PID 4884 wrote to memory of 1032 4884 d8521fd8cb6907d7901bad1675542969e11d3f637a335134970ae74e9fb682b2.exe 94 PID 4884 wrote to memory of 1032 4884 d8521fd8cb6907d7901bad1675542969e11d3f637a335134970ae74e9fb682b2.exe 94 PID 4884 wrote to memory of 116 4884 d8521fd8cb6907d7901bad1675542969e11d3f637a335134970ae74e9fb682b2.exe 96 PID 4884 wrote to memory of 116 4884 d8521fd8cb6907d7901bad1675542969e11d3f637a335134970ae74e9fb682b2.exe 96 PID 4884 wrote to memory of 116 4884 d8521fd8cb6907d7901bad1675542969e11d3f637a335134970ae74e9fb682b2.exe 96 PID 116 wrote to memory of 3636 116 net.exe 98 PID 116 wrote to memory of 3636 116 net.exe 98 PID 116 wrote to memory of 3636 116 net.exe 98 PID 4884 wrote to memory of 1932 4884 d8521fd8cb6907d7901bad1675542969e11d3f637a335134970ae74e9fb682b2.exe 100 PID 4884 wrote to memory of 1932 4884 d8521fd8cb6907d7901bad1675542969e11d3f637a335134970ae74e9fb682b2.exe 100 PID 4884 wrote to memory of 1932 4884 d8521fd8cb6907d7901bad1675542969e11d3f637a335134970ae74e9fb682b2.exe 100 PID 1932 wrote to memory of 5064 1932 net.exe 102 PID 1932 wrote to memory of 5064 1932 net.exe 102 PID 1932 wrote to memory of 5064 1932 net.exe 102
Processes
-
C:\Users\Admin\AppData\Local\Temp\d8521fd8cb6907d7901bad1675542969e11d3f637a335134970ae74e9fb682b2.exe"C:\Users\Admin\AppData\Local\Temp\d8521fd8cb6907d7901bad1675542969e11d3f637a335134970ae74e9fb682b2.exe"1⤵
- Drops file in Drivers directory
- Loads dropped DLL
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:4884 -
C:\Windows\SysWOW64\net.exenet stop nethttpservice2⤵
- Suspicious use of WriteProcessMemory
PID:3184 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop nethttpservice3⤵PID:752
-
-
-
C:\Windows\SysWOW64\net.exenet stop serviceupdater2⤵
- Suspicious use of WriteProcessMemory
PID:3404 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop serviceupdater3⤵PID:1680
-
-
-
C:\Windows\SysWOW64\installd.exe"C:\Windows\system32\installd.exe" nethfdrv2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3272
-
-
C:\Windows\SysWOW64\nethtsrv.exe"C:\Windows\system32\nethtsrv.exe" -nfdi2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2088
-
-
C:\Windows\SysWOW64\netupdsrv.exe"C:\Windows\system32\netupdsrv.exe" -nfdi2⤵
- Executes dropped EXE
PID:1032
-
-
C:\Windows\SysWOW64\net.exenet start nethttpservice2⤵
- Suspicious use of WriteProcessMemory
PID:116 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 start nethttpservice3⤵PID:3636
-
-
-
C:\Windows\SysWOW64\net.exenet start serviceupdater2⤵
- Suspicious use of WriteProcessMemory
PID:1932 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 start serviceupdater3⤵PID:5064
-
-
-
C:\Windows\SysWOW64\nethtsrv.exeC:\Windows\SysWOW64\nethtsrv.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:768
-
C:\Windows\SysWOW64\netupdsrv.exeC:\Windows\SysWOW64\netupdsrv.exe1⤵
- Executes dropped EXE
PID:4092
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
11KB
MD5c17103ae9072a06da581dec998343fc1
SHA1b72148c6bdfaada8b8c3f950e610ee7cf1da1f8d
SHA256dc58d8ad81cacb0c1ed72e33bff8f23ea40b5252b5bb55d393a0903e6819ae2f
SHA512d32a71aaef18e993f28096d536e41c4d016850721b31171513ce28bbd805a54fd290b7c3e9d935f72e676a1acfb4f0dcc89d95040a0dd29f2b6975855c18986f
-
Filesize
6KB
MD5acc2b699edfea5bf5aae45aba3a41e96
SHA1d2accf4d494e43ceb2cff69abe4dd17147d29cc2
SHA256168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e
SHA512e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe
-
Filesize
6KB
MD5acc2b699edfea5bf5aae45aba3a41e96
SHA1d2accf4d494e43ceb2cff69abe4dd17147d29cc2
SHA256168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e
SHA512e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe
-
Filesize
6KB
MD5acc2b699edfea5bf5aae45aba3a41e96
SHA1d2accf4d494e43ceb2cff69abe4dd17147d29cc2
SHA256168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e
SHA512e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe
-
Filesize
6KB
MD5acc2b699edfea5bf5aae45aba3a41e96
SHA1d2accf4d494e43ceb2cff69abe4dd17147d29cc2
SHA256168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e
SHA512e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe
-
Filesize
6KB
MD5acc2b699edfea5bf5aae45aba3a41e96
SHA1d2accf4d494e43ceb2cff69abe4dd17147d29cc2
SHA256168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e
SHA512e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe
-
Filesize
6KB
MD5acc2b699edfea5bf5aae45aba3a41e96
SHA1d2accf4d494e43ceb2cff69abe4dd17147d29cc2
SHA256168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e
SHA512e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe
-
Filesize
6KB
MD5acc2b699edfea5bf5aae45aba3a41e96
SHA1d2accf4d494e43ceb2cff69abe4dd17147d29cc2
SHA256168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e
SHA512e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe
-
Filesize
6KB
MD5acc2b699edfea5bf5aae45aba3a41e96
SHA1d2accf4d494e43ceb2cff69abe4dd17147d29cc2
SHA256168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e
SHA512e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe
-
Filesize
106KB
MD5b8abb570ab9c7361b1b50d2f683b340b
SHA1f5dd4d76dbc78a36f0d3c8ee518fc86bc600bcf8
SHA2569dd8510df153911611e5bbd80c3d717bea94cfaa35819d729889ff56c9202628
SHA512350b601b08b62ec24f1df4810c660ca845a6168079f419ed0a7ed06e27dad9c8a3b8aa9c30b99a31e960349cf2e88c8c60325418d8b3a8070bf559aad7310f55
-
Filesize
106KB
MD5b8abb570ab9c7361b1b50d2f683b340b
SHA1f5dd4d76dbc78a36f0d3c8ee518fc86bc600bcf8
SHA2569dd8510df153911611e5bbd80c3d717bea94cfaa35819d729889ff56c9202628
SHA512350b601b08b62ec24f1df4810c660ca845a6168079f419ed0a7ed06e27dad9c8a3b8aa9c30b99a31e960349cf2e88c8c60325418d8b3a8070bf559aad7310f55
-
Filesize
106KB
MD5b8abb570ab9c7361b1b50d2f683b340b
SHA1f5dd4d76dbc78a36f0d3c8ee518fc86bc600bcf8
SHA2569dd8510df153911611e5bbd80c3d717bea94cfaa35819d729889ff56c9202628
SHA512350b601b08b62ec24f1df4810c660ca845a6168079f419ed0a7ed06e27dad9c8a3b8aa9c30b99a31e960349cf2e88c8c60325418d8b3a8070bf559aad7310f55
-
Filesize
106KB
MD5b8abb570ab9c7361b1b50d2f683b340b
SHA1f5dd4d76dbc78a36f0d3c8ee518fc86bc600bcf8
SHA2569dd8510df153911611e5bbd80c3d717bea94cfaa35819d729889ff56c9202628
SHA512350b601b08b62ec24f1df4810c660ca845a6168079f419ed0a7ed06e27dad9c8a3b8aa9c30b99a31e960349cf2e88c8c60325418d8b3a8070bf559aad7310f55
-
Filesize
241KB
MD566858d33ceb7eba6730a9440a4847c58
SHA1a3d999fd84189956716c964d05b8ec6e4fbe1e67
SHA2565d604ec8d4f142010a13adca3d8b7c1bcd0c0c07a8377b8a084bf3a56c9da70e
SHA512f8468da72f13fb96b6f34eb4be2e690e75d4aeb0347e514a8f49a9e1d6599cab8ef6e1fa4510d036839edc6b0f884710343424f298ff9d0e58215b9ca9f47afe
-
Filesize
241KB
MD566858d33ceb7eba6730a9440a4847c58
SHA1a3d999fd84189956716c964d05b8ec6e4fbe1e67
SHA2565d604ec8d4f142010a13adca3d8b7c1bcd0c0c07a8377b8a084bf3a56c9da70e
SHA512f8468da72f13fb96b6f34eb4be2e690e75d4aeb0347e514a8f49a9e1d6599cab8ef6e1fa4510d036839edc6b0f884710343424f298ff9d0e58215b9ca9f47afe
-
Filesize
241KB
MD566858d33ceb7eba6730a9440a4847c58
SHA1a3d999fd84189956716c964d05b8ec6e4fbe1e67
SHA2565d604ec8d4f142010a13adca3d8b7c1bcd0c0c07a8377b8a084bf3a56c9da70e
SHA512f8468da72f13fb96b6f34eb4be2e690e75d4aeb0347e514a8f49a9e1d6599cab8ef6e1fa4510d036839edc6b0f884710343424f298ff9d0e58215b9ca9f47afe
-
Filesize
108KB
MD548b3345e54c82d51fd8a256487d80518
SHA12d8c5caf4b9666a1f25d2a9d72ed3ed402fa05ff
SHA256df6d891eea24f8c0349530d891a94d0efd5273f5afb5974ee343dd6352f3f7ab
SHA512296b6343574846d2bd4602968e181aec968c9ba1e99e6356744521a8167a3ea0a658be6bcd478834779569b279067299a6bb325087bc46b9f61c98b3673c02b0
-
Filesize
108KB
MD548b3345e54c82d51fd8a256487d80518
SHA12d8c5caf4b9666a1f25d2a9d72ed3ed402fa05ff
SHA256df6d891eea24f8c0349530d891a94d0efd5273f5afb5974ee343dd6352f3f7ab
SHA512296b6343574846d2bd4602968e181aec968c9ba1e99e6356744521a8167a3ea0a658be6bcd478834779569b279067299a6bb325087bc46b9f61c98b3673c02b0
-
Filesize
176KB
MD515994de0e50b71d80ce3541839dedb95
SHA1aea4d207183c4a7430c1ac103159021087e5e50b
SHA2565537642f1b5aeaa8b49aa93e61e7d74a09305e93a9758670ff4ffea55a862769
SHA512a966d150c4bfac30f61768b5a342b24e49ad8b45687ca423cb222c54ab101ce08dc638afaf909a20328eab4dd5a450625c411a3fd36c550cff0569589f3bad8b
-
Filesize
176KB
MD515994de0e50b71d80ce3541839dedb95
SHA1aea4d207183c4a7430c1ac103159021087e5e50b
SHA2565537642f1b5aeaa8b49aa93e61e7d74a09305e93a9758670ff4ffea55a862769
SHA512a966d150c4bfac30f61768b5a342b24e49ad8b45687ca423cb222c54ab101ce08dc638afaf909a20328eab4dd5a450625c411a3fd36c550cff0569589f3bad8b
-
Filesize
176KB
MD515994de0e50b71d80ce3541839dedb95
SHA1aea4d207183c4a7430c1ac103159021087e5e50b
SHA2565537642f1b5aeaa8b49aa93e61e7d74a09305e93a9758670ff4ffea55a862769
SHA512a966d150c4bfac30f61768b5a342b24e49ad8b45687ca423cb222c54ab101ce08dc638afaf909a20328eab4dd5a450625c411a3fd36c550cff0569589f3bad8b
-
Filesize
158KB
MD53172d3979ee011ca5c0c9266b449a2d1
SHA1fcc72d815a9476fe0f623857aa6e1f9614be915f
SHA2568a900319c8ad64c7c3f391e97f001984c7b819b562e3ea81a4b1715ef17681c0
SHA51263be0c09e0b76a44c799e266c89e0eef92e65350b5dff9e973b6e47660ff8488ee95dc2f512ec7753194ce60b4355a6f35879818a0ad0284ee874b4030352951
-
Filesize
158KB
MD53172d3979ee011ca5c0c9266b449a2d1
SHA1fcc72d815a9476fe0f623857aa6e1f9614be915f
SHA2568a900319c8ad64c7c3f391e97f001984c7b819b562e3ea81a4b1715ef17681c0
SHA51263be0c09e0b76a44c799e266c89e0eef92e65350b5dff9e973b6e47660ff8488ee95dc2f512ec7753194ce60b4355a6f35879818a0ad0284ee874b4030352951
-
Filesize
158KB
MD53172d3979ee011ca5c0c9266b449a2d1
SHA1fcc72d815a9476fe0f623857aa6e1f9614be915f
SHA2568a900319c8ad64c7c3f391e97f001984c7b819b562e3ea81a4b1715ef17681c0
SHA51263be0c09e0b76a44c799e266c89e0eef92e65350b5dff9e973b6e47660ff8488ee95dc2f512ec7753194ce60b4355a6f35879818a0ad0284ee874b4030352951