ff57b2e42bc0f2b8fb36e7b71f25f4bcaa46327e77e1f29b2b588118a57b02ec

Analysis

max time kernel
210s
max time network
34s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
23-11-2022 10:05

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ff57b2e42bc0f2b8fb36e7b71f25f4bcaa46327e77e1f29b2b588118a57b02ec.exe
Size

603KB
MD5

06ffb281fd78e3a5144e13036b6959e6
SHA1

c9d559d1d09a9ebb5c295a4df8d92ac7a39cca33
SHA256

ff57b2e42bc0f2b8fb36e7b71f25f4bcaa46327e77e1f29b2b588118a57b02ec
SHA512

5035df130db3d1fa977ae200eaf0ad1a3daac6e864047c4982626837281b13a2fb5829062759e35eb874eb7db7e574f8051af7ac43b7aa6c4877bcdd5c5a89bc
SSDEEP

12288:9Iny5DYTmI1h5P1GpvYh+jq/Jn3rfiKXAo1ZIdrpCQ:pUTmOhHGpBWJ7z1ZCpf

Score

8^/10

discovery

Malware Config

Signatures

Drops file in Drivers directory 1 IoCs

Processes:

ff57b2e42bc0f2b8fb36e7b71f25f4bcaa46327e77e1f29b2b588118a57b02ec.exe

description ioc process

File created C:\Windows\system32\drivers\nethfdrv.sys ff57b2e42bc0f2b8fb36e7b71f25f4bcaa46327e77e1f29b2b588118a57b02ec.exe
Executes dropped EXE 3 IoCs

Processes:

installd.exenethtsrv.exenetupdsrv.exe

pid process

736 installd.exe
1696 nethtsrv.exe
1656 netupdsrv.exe

description	ioc	process
File created	C:\Windows\system32\drivers\nethfdrv.sys	ff57b2e42bc0f2b8fb36e7b71f25f4bcaa46327e77e1f29b2b588118a57b02ec.exe

pid	process
736	installd.exe
1696	nethtsrv.exe
1656	netupdsrv.exe

Loads dropped DLL 9 IoCs

Processes:

ff57b2e42bc0f2b8fb36e7b71f25f4bcaa46327e77e1f29b2b588118a57b02ec.exeinstalld.exenethtsrv.exe

pid	process
1496	ff57b2e42bc0f2b8fb36e7b71f25f4bcaa46327e77e1f29b2b588118a57b02ec.exe
1496	ff57b2e42bc0f2b8fb36e7b71f25f4bcaa46327e77e1f29b2b588118a57b02ec.exe
1496	ff57b2e42bc0f2b8fb36e7b71f25f4bcaa46327e77e1f29b2b588118a57b02ec.exe
1496	ff57b2e42bc0f2b8fb36e7b71f25f4bcaa46327e77e1f29b2b588118a57b02ec.exe
736	installd.exe
1496	ff57b2e42bc0f2b8fb36e7b71f25f4bcaa46327e77e1f29b2b588118a57b02ec.exe
1696	nethtsrv.exe
1696	nethtsrv.exe
1496	ff57b2e42bc0f2b8fb36e7b71f25f4bcaa46327e77e1f29b2b588118a57b02ec.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in System32 directory 5 IoCs

Processes:

ff57b2e42bc0f2b8fb36e7b71f25f4bcaa46327e77e1f29b2b588118a57b02ec.exe

description	ioc	process
File created	C:\Windows\SysWOW64\nethtsrv.exe	ff57b2e42bc0f2b8fb36e7b71f25f4bcaa46327e77e1f29b2b588118a57b02ec.exe
File created	C:\Windows\SysWOW64\netupdsrv.exe	ff57b2e42bc0f2b8fb36e7b71f25f4bcaa46327e77e1f29b2b588118a57b02ec.exe
File created	C:\Windows\SysWOW64\hfnapi.dll	ff57b2e42bc0f2b8fb36e7b71f25f4bcaa46327e77e1f29b2b588118a57b02ec.exe
File created	C:\Windows\SysWOW64\hfpapi.dll	ff57b2e42bc0f2b8fb36e7b71f25f4bcaa46327e77e1f29b2b588118a57b02ec.exe
File created	C:\Windows\SysWOW64\installd.exe	ff57b2e42bc0f2b8fb36e7b71f25f4bcaa46327e77e1f29b2b588118a57b02ec.exe

Drops file in Program Files directory 3 IoCs

Processes:

ff57b2e42bc0f2b8fb36e7b71f25f4bcaa46327e77e1f29b2b588118a57b02ec.exe

description	ioc	process
File created	C:\Program Files (x86)\Common Files\Config\data.xml	ff57b2e42bc0f2b8fb36e7b71f25f4bcaa46327e77e1f29b2b588118a57b02ec.exe
File created	C:\Program Files (x86)\Common Files\Config\ver.xml	ff57b2e42bc0f2b8fb36e7b71f25f4bcaa46327e77e1f29b2b588118a57b02ec.exe
File created	C:\Program Files (x86)\Common Files\config\uninstinethnfd.exe	ff57b2e42bc0f2b8fb36e7b71f25f4bcaa46327e77e1f29b2b588118a57b02ec.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Runs net.exe
Suspicious behavior: LoadsDriver 1 IoCs

Processes:

pid process

460

pid	process
460

Suspicious use of WriteProcessMemory 34 IoCs

Processes:

ff57b2e42bc0f2b8fb36e7b71f25f4bcaa46327e77e1f29b2b588118a57b02ec.exenet.exenet.exe

description	pid	process	target process
PID 1496 wrote to memory of 764	1496	ff57b2e42bc0f2b8fb36e7b71f25f4bcaa46327e77e1f29b2b588118a57b02ec.exe	net.exe
PID 1496 wrote to memory of 764	1496	ff57b2e42bc0f2b8fb36e7b71f25f4bcaa46327e77e1f29b2b588118a57b02ec.exe	net.exe
PID 1496 wrote to memory of 764	1496	ff57b2e42bc0f2b8fb36e7b71f25f4bcaa46327e77e1f29b2b588118a57b02ec.exe	net.exe
PID 1496 wrote to memory of 764	1496	ff57b2e42bc0f2b8fb36e7b71f25f4bcaa46327e77e1f29b2b588118a57b02ec.exe	net.exe
PID 764 wrote to memory of 1912	764	net.exe	net1.exe
PID 764 wrote to memory of 1912	764	net.exe	net1.exe
PID 764 wrote to memory of 1912	764	net.exe	net1.exe
PID 764 wrote to memory of 1912	764	net.exe	net1.exe
PID 1496 wrote to memory of 1956	1496	ff57b2e42bc0f2b8fb36e7b71f25f4bcaa46327e77e1f29b2b588118a57b02ec.exe	net.exe
PID 1496 wrote to memory of 1956	1496	ff57b2e42bc0f2b8fb36e7b71f25f4bcaa46327e77e1f29b2b588118a57b02ec.exe	net.exe
PID 1496 wrote to memory of 1956	1496	ff57b2e42bc0f2b8fb36e7b71f25f4bcaa46327e77e1f29b2b588118a57b02ec.exe	net.exe
PID 1496 wrote to memory of 1956	1496	ff57b2e42bc0f2b8fb36e7b71f25f4bcaa46327e77e1f29b2b588118a57b02ec.exe	net.exe
PID 1956 wrote to memory of 1528	1956	net.exe	net1.exe
PID 1956 wrote to memory of 1528	1956	net.exe	net1.exe
PID 1956 wrote to memory of 1528	1956	net.exe	net1.exe
PID 1956 wrote to memory of 1528	1956	net.exe	net1.exe
PID 1496 wrote to memory of 736	1496	ff57b2e42bc0f2b8fb36e7b71f25f4bcaa46327e77e1f29b2b588118a57b02ec.exe	installd.exe
PID 1496 wrote to memory of 736	1496	ff57b2e42bc0f2b8fb36e7b71f25f4bcaa46327e77e1f29b2b588118a57b02ec.exe	installd.exe
PID 1496 wrote to memory of 736	1496	ff57b2e42bc0f2b8fb36e7b71f25f4bcaa46327e77e1f29b2b588118a57b02ec.exe	installd.exe
PID 1496 wrote to memory of 736	1496	ff57b2e42bc0f2b8fb36e7b71f25f4bcaa46327e77e1f29b2b588118a57b02ec.exe	installd.exe
PID 1496 wrote to memory of 736	1496	ff57b2e42bc0f2b8fb36e7b71f25f4bcaa46327e77e1f29b2b588118a57b02ec.exe	installd.exe
PID 1496 wrote to memory of 736	1496	ff57b2e42bc0f2b8fb36e7b71f25f4bcaa46327e77e1f29b2b588118a57b02ec.exe	installd.exe
PID 1496 wrote to memory of 736	1496	ff57b2e42bc0f2b8fb36e7b71f25f4bcaa46327e77e1f29b2b588118a57b02ec.exe	installd.exe
PID 1496 wrote to memory of 1696	1496	ff57b2e42bc0f2b8fb36e7b71f25f4bcaa46327e77e1f29b2b588118a57b02ec.exe	nethtsrv.exe
PID 1496 wrote to memory of 1696	1496	ff57b2e42bc0f2b8fb36e7b71f25f4bcaa46327e77e1f29b2b588118a57b02ec.exe	nethtsrv.exe
PID 1496 wrote to memory of 1696	1496	ff57b2e42bc0f2b8fb36e7b71f25f4bcaa46327e77e1f29b2b588118a57b02ec.exe	nethtsrv.exe
PID 1496 wrote to memory of 1696	1496	ff57b2e42bc0f2b8fb36e7b71f25f4bcaa46327e77e1f29b2b588118a57b02ec.exe	nethtsrv.exe
PID 1496 wrote to memory of 1656	1496	ff57b2e42bc0f2b8fb36e7b71f25f4bcaa46327e77e1f29b2b588118a57b02ec.exe	netupdsrv.exe
PID 1496 wrote to memory of 1656	1496	ff57b2e42bc0f2b8fb36e7b71f25f4bcaa46327e77e1f29b2b588118a57b02ec.exe	netupdsrv.exe
PID 1496 wrote to memory of 1656	1496	ff57b2e42bc0f2b8fb36e7b71f25f4bcaa46327e77e1f29b2b588118a57b02ec.exe	netupdsrv.exe
PID 1496 wrote to memory of 1656	1496	ff57b2e42bc0f2b8fb36e7b71f25f4bcaa46327e77e1f29b2b588118a57b02ec.exe	netupdsrv.exe
PID 1496 wrote to memory of 1656	1496	ff57b2e42bc0f2b8fb36e7b71f25f4bcaa46327e77e1f29b2b588118a57b02ec.exe	netupdsrv.exe
PID 1496 wrote to memory of 1656	1496	ff57b2e42bc0f2b8fb36e7b71f25f4bcaa46327e77e1f29b2b588118a57b02ec.exe	netupdsrv.exe
PID 1496 wrote to memory of 1656	1496	ff57b2e42bc0f2b8fb36e7b71f25f4bcaa46327e77e1f29b2b588118a57b02ec.exe	netupdsrv.exe

C:\Users\Admin\AppData\Local\Temp\ff57b2e42bc0f2b8fb36e7b71f25f4bcaa46327e77e1f29b2b588118a57b02ec.exe
"C:\Users\Admin\AppData\Local\Temp\ff57b2e42bc0f2b8fb36e7b71f25f4bcaa46327e77e1f29b2b588118a57b02ec.exe"
1⤵
- Drops file in Drivers directory
- Loads dropped DLL
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:1496

C:\Windows\SysWOW64\net.exe
net stop nethttpservice
2⤵
- Suspicious use of WriteProcessMemory
PID:764

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop nethttpservice
3⤵
PID:1912

C:\Windows\SysWOW64\net.exe
net stop serviceupdater
2⤵
- Suspicious use of WriteProcessMemory
PID:1956

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop serviceupdater
3⤵
PID:1528

C:\Windows\SysWOW64\installd.exe
"C:\Windows\system32\installd.exe" nethfdrv
2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:736

C:\Windows\SysWOW64\nethtsrv.exe
"C:\Windows\system32\nethtsrv.exe" -nfdi
2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1696

C:\Windows\SysWOW64\netupdsrv.exe
"C:\Windows\system32\netupdsrv.exe" -nfdi
2⤵
- Executes dropped EXE
PID:1656

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\hfnapi.dll

Filesize
106KB

MD5
6fde20e5b60993e308dca06c8ab8f0ec

SHA1
d114d5f55436c6cbab9679649e10f8c1c01bcbfc

SHA256
dcfe5b710fe9f6e37efd8776ac1eb1726bdef2887e34e4487fe03cf5a4db9fe3

SHA512
c931b2f8070435ae8c1e76e52ce4054b60026446f71cac2ca6573dab0c7881ad337b443b85945caa7f1e40b7657c113441c2c11ece0738f1cbd53c4b70097921

Download Submit
C:\Windows\SysWOW64\hfpapi.dll

Filesize
244KB

MD5
c05134316cbf2da2716c1674755ce5ae

SHA1
618758fb2654e8e6d1995a34a9aa4b7a3a678c63

SHA256
621e70224a75fd9a5242bf81d92446e1a58a047e83da23724d87fc60dfbd83d5

SHA512
90830eee3e57ad274f300a4ef972803b1343408fe8dc64bbff5be7569a1faad05b65ef9ec33491cffdf1586b82b6803029b5df950128cd0744a2b901382a8af9

Download Submit
C:\Windows\SysWOW64\installd.exe

Filesize
108KB

MD5
8af9c9f2f4c24e753d190ab94aee874c

SHA1
e41ab4ef998c35ccd51cf24bfbe2160141336472

SHA256
cbd5d994fc0feae313628bb6f4baa31f35140fe4e6e37a1940d65c271d8509c0

SHA512
ed2c4583055a61c0e5b6389a5c62ad88bddbba58f4461af367ce30be9fcee7a3f4c9e63e2345599b3e2af0d3a0ed75a9f6de13614863e2fb5af416421daafe98

Download Submit
C:\Windows\SysWOW64\nethtsrv.exe

Filesize
176KB

MD5
4ba3c3813d2cc0710a8782831b102ca5

SHA1
ce69116715f4514a69629aa25e478bc70d1747dd

SHA256
c4647bb3ea352a0825257ffd4f244c313dc7f8abcef7d259bbee8a2c8c419267

SHA512
1f899c1cb733a2922150e7a4a8a1daade92bf669bb42be1fd963af3e102f4ec3dd2e4346a54be47928fa547fc63a62c8e9a7f46c3a8b5cba49ea6a6c46bc1460

Download Submit
C:\Windows\SysWOW64\netupdsrv.exe

Filesize
158KB

MD5
b108f3bf80dee8b785a98bfe3a09855a

SHA1
bd0b7d0ed2e896e0c08f7b003205f8667e883fd4

SHA256
c8aae902ec8a1336bc2fc657b4a7261b6cc480c9de8bc193eac5976259be89d4

SHA512
c26df838c25c0849712aefcd2966394b6650eb0d257770ae212132d9f2d2c23cac7dab7a58ae1b5e4beffdecf5d1d20368ff27a583d7f9b0276837933ef9de8e

Download Submit
\Users\Admin\AppData\Local\Temp\nszD4CF.tmp\System.dll

Filesize
11KB

MD5
c17103ae9072a06da581dec998343fc1

SHA1
b72148c6bdfaada8b8c3f950e610ee7cf1da1f8d

SHA256
dc58d8ad81cacb0c1ed72e33bff8f23ea40b5252b5bb55d393a0903e6819ae2f

SHA512
d32a71aaef18e993f28096d536e41c4d016850721b31171513ce28bbd805a54fd290b7c3e9d935f72e676a1acfb4f0dcc89d95040a0dd29f2b6975855c18986f

Download Submit
\Users\Admin\AppData\Local\Temp\nszD4CF.tmp\nsExec.dll

Filesize
6KB

MD5
acc2b699edfea5bf5aae45aba3a41e96

SHA1
d2accf4d494e43ceb2cff69abe4dd17147d29cc2

SHA256
168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e

SHA512
e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe

Download Submit
\Users\Admin\AppData\Local\Temp\nszD4CF.tmp\nsExec.dll

Filesize
6KB

MD5
acc2b699edfea5bf5aae45aba3a41e96

SHA1
d2accf4d494e43ceb2cff69abe4dd17147d29cc2

SHA256
168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e

SHA512
e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe

Download Submit
\Windows\SysWOW64\hfnapi.dll

Filesize
106KB

MD5
6fde20e5b60993e308dca06c8ab8f0ec

SHA1
d114d5f55436c6cbab9679649e10f8c1c01bcbfc

SHA256
dcfe5b710fe9f6e37efd8776ac1eb1726bdef2887e34e4487fe03cf5a4db9fe3

SHA512
c931b2f8070435ae8c1e76e52ce4054b60026446f71cac2ca6573dab0c7881ad337b443b85945caa7f1e40b7657c113441c2c11ece0738f1cbd53c4b70097921

Download Submit
\Windows\SysWOW64\hfnapi.dll

Filesize
106KB

MD5
6fde20e5b60993e308dca06c8ab8f0ec

SHA1
d114d5f55436c6cbab9679649e10f8c1c01bcbfc

SHA256
dcfe5b710fe9f6e37efd8776ac1eb1726bdef2887e34e4487fe03cf5a4db9fe3

SHA512
c931b2f8070435ae8c1e76e52ce4054b60026446f71cac2ca6573dab0c7881ad337b443b85945caa7f1e40b7657c113441c2c11ece0738f1cbd53c4b70097921

Download Submit
\Windows\SysWOW64\hfpapi.dll

Filesize
244KB

MD5
c05134316cbf2da2716c1674755ce5ae

SHA1
618758fb2654e8e6d1995a34a9aa4b7a3a678c63

SHA256
621e70224a75fd9a5242bf81d92446e1a58a047e83da23724d87fc60dfbd83d5

SHA512
90830eee3e57ad274f300a4ef972803b1343408fe8dc64bbff5be7569a1faad05b65ef9ec33491cffdf1586b82b6803029b5df950128cd0744a2b901382a8af9

Download Submit
\Windows\SysWOW64\installd.exe

Filesize
108KB

MD5
8af9c9f2f4c24e753d190ab94aee874c

SHA1
e41ab4ef998c35ccd51cf24bfbe2160141336472

SHA256
cbd5d994fc0feae313628bb6f4baa31f35140fe4e6e37a1940d65c271d8509c0

SHA512
ed2c4583055a61c0e5b6389a5c62ad88bddbba58f4461af367ce30be9fcee7a3f4c9e63e2345599b3e2af0d3a0ed75a9f6de13614863e2fb5af416421daafe98

Download Submit
\Windows\SysWOW64\nethtsrv.exe

Filesize
176KB

MD5
4ba3c3813d2cc0710a8782831b102ca5

SHA1
ce69116715f4514a69629aa25e478bc70d1747dd

SHA256
c4647bb3ea352a0825257ffd4f244c313dc7f8abcef7d259bbee8a2c8c419267

SHA512
1f899c1cb733a2922150e7a4a8a1daade92bf669bb42be1fd963af3e102f4ec3dd2e4346a54be47928fa547fc63a62c8e9a7f46c3a8b5cba49ea6a6c46bc1460

Download Submit
\Windows\SysWOW64\netupdsrv.exe

Filesize
158KB

MD5
b108f3bf80dee8b785a98bfe3a09855a

SHA1
bd0b7d0ed2e896e0c08f7b003205f8667e883fd4

SHA256
c8aae902ec8a1336bc2fc657b4a7261b6cc480c9de8bc193eac5976259be89d4

SHA512
c26df838c25c0849712aefcd2966394b6650eb0d257770ae212132d9f2d2c23cac7dab7a58ae1b5e4beffdecf5d1d20368ff27a583d7f9b0276837933ef9de8e

Download Submit
memory/736-64-0x0000000000000000-mapping.dmp

Download
memory/764-58-0x0000000000000000-mapping.dmp

Download
memory/1496-54-0x0000000076581000-0x0000000076583000-memory.dmp

Filesize
8KB

Download
memory/1496-55-0x0000000000360000-0x00000000007BE000-memory.dmp

Filesize
4.4MB

Download
memory/1528-62-0x0000000000000000-mapping.dmp

Download
memory/1656-76-0x0000000000000000-mapping.dmp

Download
memory/1696-70-0x0000000000000000-mapping.dmp

Download
memory/1912-59-0x0000000000000000-mapping.dmp

Download
memory/1956-61-0x0000000000000000-mapping.dmp

Download