f32265033ca4c0c6233f789291bdd6b925acac2ed88910e50d5686890fab9791

Analysis

max time kernel
351s
max time network
459s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
23-11-2022 10:07

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

f32265033ca4c0c6233f789291bdd6b925acac2ed88910e50d5686890fab9791.exe
Size

603KB
MD5

0d9ad51ec1c739f2b25a7653402e871e
SHA1

ea9891f06558d44cd91571211cddfde1222eece2
SHA256

f32265033ca4c0c6233f789291bdd6b925acac2ed88910e50d5686890fab9791
SHA512

afcd7826d314e0861362bca55e48492ad3477748db48c06949b59f186e627c38ef7dc20f1bd7cb1ee5d6103db0752b79f793ed3190da46779bec76c56563e4d3
SSDEEP

12288:oIny5DYTByVvHPyWS5o24KzwpvbgmwnNqT9gXcqWbghS2q4EcMmiL5QZgF6:mUTgUQtbgmwnMmWbVA8mK5QZg

Score

8^/10

discovery

Malware Config

Signatures

Drops file in Drivers directory 1 IoCs

Processes:

f32265033ca4c0c6233f789291bdd6b925acac2ed88910e50d5686890fab9791.exe

description ioc process

File created C:\Windows\system32\drivers\nethfdrv.sys f32265033ca4c0c6233f789291bdd6b925acac2ed88910e50d5686890fab9791.exe
Executes dropped EXE 1 IoCs

Processes:

installd.exe

pid process

1628 installd.exe

description	ioc	process
File created	C:\Windows\system32\drivers\nethfdrv.sys	f32265033ca4c0c6233f789291bdd6b925acac2ed88910e50d5686890fab9791.exe

pid	process
1628	installd.exe

Loads dropped DLL 6 IoCs

Processes:

f32265033ca4c0c6233f789291bdd6b925acac2ed88910e50d5686890fab9791.exeinstalld.exe

pid	process
4448	f32265033ca4c0c6233f789291bdd6b925acac2ed88910e50d5686890fab9791.exe
4448	f32265033ca4c0c6233f789291bdd6b925acac2ed88910e50d5686890fab9791.exe
4448	f32265033ca4c0c6233f789291bdd6b925acac2ed88910e50d5686890fab9791.exe
4448	f32265033ca4c0c6233f789291bdd6b925acac2ed88910e50d5686890fab9791.exe
4448	f32265033ca4c0c6233f789291bdd6b925acac2ed88910e50d5686890fab9791.exe
1628	installd.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in System32 directory 5 IoCs

Processes:

f32265033ca4c0c6233f789291bdd6b925acac2ed88910e50d5686890fab9791.exe

description	ioc	process
File created	C:\Windows\SysWOW64\netupdsrv.exe	f32265033ca4c0c6233f789291bdd6b925acac2ed88910e50d5686890fab9791.exe
File created	C:\Windows\SysWOW64\hfnapi.dll	f32265033ca4c0c6233f789291bdd6b925acac2ed88910e50d5686890fab9791.exe
File created	C:\Windows\SysWOW64\hfpapi.dll	f32265033ca4c0c6233f789291bdd6b925acac2ed88910e50d5686890fab9791.exe
File created	C:\Windows\SysWOW64\installd.exe	f32265033ca4c0c6233f789291bdd6b925acac2ed88910e50d5686890fab9791.exe
File created	C:\Windows\SysWOW64\nethtsrv.exe	f32265033ca4c0c6233f789291bdd6b925acac2ed88910e50d5686890fab9791.exe

Drops file in Program Files directory 3 IoCs

Processes:

f32265033ca4c0c6233f789291bdd6b925acac2ed88910e50d5686890fab9791.exe

description	ioc	process
File created	C:\Program Files (x86)\Common Files\Config\data.xml	f32265033ca4c0c6233f789291bdd6b925acac2ed88910e50d5686890fab9791.exe
File created	C:\Program Files (x86)\Common Files\Config\ver.xml	f32265033ca4c0c6233f789291bdd6b925acac2ed88910e50d5686890fab9791.exe
File created	C:\Program Files (x86)\Common Files\config\uninstinethnfd.exe	f32265033ca4c0c6233f789291bdd6b925acac2ed88910e50d5686890fab9791.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Runs net.exe
Suspicious behavior: LoadsDriver 1 IoCs

Processes:

pid process

644

pid	process
644

Suspicious use of WriteProcessMemory 15 IoCs

Processes:

f32265033ca4c0c6233f789291bdd6b925acac2ed88910e50d5686890fab9791.exenet.exenet.exe

description	pid	process	target process
PID 4448 wrote to memory of 3592	4448	f32265033ca4c0c6233f789291bdd6b925acac2ed88910e50d5686890fab9791.exe	net.exe
PID 4448 wrote to memory of 3592	4448	f32265033ca4c0c6233f789291bdd6b925acac2ed88910e50d5686890fab9791.exe	net.exe
PID 4448 wrote to memory of 3592	4448	f32265033ca4c0c6233f789291bdd6b925acac2ed88910e50d5686890fab9791.exe	net.exe
PID 3592 wrote to memory of 2716	3592	net.exe	net1.exe
PID 3592 wrote to memory of 2716	3592	net.exe	net1.exe
PID 3592 wrote to memory of 2716	3592	net.exe	net1.exe
PID 4448 wrote to memory of 1736	4448	f32265033ca4c0c6233f789291bdd6b925acac2ed88910e50d5686890fab9791.exe	net.exe
PID 4448 wrote to memory of 1736	4448	f32265033ca4c0c6233f789291bdd6b925acac2ed88910e50d5686890fab9791.exe	net.exe
PID 4448 wrote to memory of 1736	4448	f32265033ca4c0c6233f789291bdd6b925acac2ed88910e50d5686890fab9791.exe	net.exe
PID 1736 wrote to memory of 4392	1736	net.exe	net1.exe
PID 1736 wrote to memory of 4392	1736	net.exe	net1.exe
PID 1736 wrote to memory of 4392	1736	net.exe	net1.exe
PID 4448 wrote to memory of 1628	4448	f32265033ca4c0c6233f789291bdd6b925acac2ed88910e50d5686890fab9791.exe	installd.exe
PID 4448 wrote to memory of 1628	4448	f32265033ca4c0c6233f789291bdd6b925acac2ed88910e50d5686890fab9791.exe	installd.exe
PID 4448 wrote to memory of 1628	4448	f32265033ca4c0c6233f789291bdd6b925acac2ed88910e50d5686890fab9791.exe	installd.exe

C:\Users\Admin\AppData\Local\Temp\f32265033ca4c0c6233f789291bdd6b925acac2ed88910e50d5686890fab9791.exe
"C:\Users\Admin\AppData\Local\Temp\f32265033ca4c0c6233f789291bdd6b925acac2ed88910e50d5686890fab9791.exe"
1⤵
- Drops file in Drivers directory
- Loads dropped DLL
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:4448

C:\Windows\SysWOW64\net.exe
net stop nethttpservice
2⤵
- Suspicious use of WriteProcessMemory
PID:3592

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop nethttpservice
3⤵
PID:2716

C:\Windows\SysWOW64\net.exe
net stop serviceupdater
2⤵
- Suspicious use of WriteProcessMemory
PID:1736

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop serviceupdater
3⤵
PID:4392

C:\Windows\SysWOW64\installd.exe
"C:\Windows\system32\installd.exe" nethfdrv
2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1628

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\nstDEF5.tmp\System.dll

Filesize
11KB

MD5
c17103ae9072a06da581dec998343fc1

SHA1
b72148c6bdfaada8b8c3f950e610ee7cf1da1f8d

SHA256
dc58d8ad81cacb0c1ed72e33bff8f23ea40b5252b5bb55d393a0903e6819ae2f

SHA512
d32a71aaef18e993f28096d536e41c4d016850721b31171513ce28bbd805a54fd290b7c3e9d935f72e676a1acfb4f0dcc89d95040a0dd29f2b6975855c18986f

Download Submit
C:\Users\Admin\AppData\Local\Temp\nstDEF5.tmp\nsExec.dll

Filesize
6KB

MD5
acc2b699edfea5bf5aae45aba3a41e96

SHA1
d2accf4d494e43ceb2cff69abe4dd17147d29cc2

SHA256
168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e

SHA512
e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe

Download Submit
C:\Users\Admin\AppData\Local\Temp\nstDEF5.tmp\nsExec.dll

Filesize
6KB

MD5
acc2b699edfea5bf5aae45aba3a41e96

SHA1
d2accf4d494e43ceb2cff69abe4dd17147d29cc2

SHA256
168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e

SHA512
e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe

Download Submit
C:\Users\Admin\AppData\Local\Temp\nstDEF5.tmp\nsExec.dll

Filesize
6KB

MD5
acc2b699edfea5bf5aae45aba3a41e96

SHA1
d2accf4d494e43ceb2cff69abe4dd17147d29cc2

SHA256
168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e

SHA512
e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe

Download Submit
C:\Users\Admin\AppData\Local\Temp\nstDEF5.tmp\nsExec.dll

Filesize
6KB

MD5
acc2b699edfea5bf5aae45aba3a41e96

SHA1
d2accf4d494e43ceb2cff69abe4dd17147d29cc2

SHA256
168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e

SHA512
e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe

Download Submit
C:\Windows\SysWOW64\hfnapi.dll

Filesize
106KB

MD5
063b3d131b85182a306ad9c76b3ed45b

SHA1
bafdc862ed50b7001b362c34a8c10c46e3fe1f28

SHA256
6f2fdc7a7e42c3e6678bf0c8b628eedab61d5ae2b7dc38b1f4855ef2eea4de18

SHA512
47e4330650e12a5fe20d5da9a20bbfb82703cf2744a3599d66fad3b7f23e479ea42471586f352bf81e4474e0568b4ba0059b2cb160fc2d51b26344ac64fe0990

Download Submit
C:\Windows\SysWOW64\hfnapi.dll

Filesize
106KB

MD5
063b3d131b85182a306ad9c76b3ed45b

SHA1
bafdc862ed50b7001b362c34a8c10c46e3fe1f28

SHA256
6f2fdc7a7e42c3e6678bf0c8b628eedab61d5ae2b7dc38b1f4855ef2eea4de18

SHA512
47e4330650e12a5fe20d5da9a20bbfb82703cf2744a3599d66fad3b7f23e479ea42471586f352bf81e4474e0568b4ba0059b2cb160fc2d51b26344ac64fe0990

Download Submit
C:\Windows\SysWOW64\installd.exe

Filesize
108KB

MD5
4f9bd367bc8467cbb8299ce32010fc44

SHA1
03b8fb38716da86539f08697bd206a5bac861b59

SHA256
ee6aa69cb77fa7687381de45dc83a91b098c8ae61ae45986d538fe9e0903161e

SHA512
050dd6b0d5313b122d1a6ad3183552b3d7232ad7f6f751cdbca8be9a6efc67e350a12f08abf7d2f54b864e4ff5616cc947023c63de2c7b8dca40c4ca49d30cea

Download Submit
C:\Windows\SysWOW64\installd.exe

Filesize
108KB

MD5
4f9bd367bc8467cbb8299ce32010fc44

SHA1
03b8fb38716da86539f08697bd206a5bac861b59

SHA256
ee6aa69cb77fa7687381de45dc83a91b098c8ae61ae45986d538fe9e0903161e

SHA512
050dd6b0d5313b122d1a6ad3183552b3d7232ad7f6f751cdbca8be9a6efc67e350a12f08abf7d2f54b864e4ff5616cc947023c63de2c7b8dca40c4ca49d30cea

Download Submit
memory/1628-142-0x0000000000000000-mapping.dmp

Download
memory/1736-140-0x0000000000000000-mapping.dmp

Download
memory/2716-137-0x0000000000000000-mapping.dmp

Download
memory/3592-136-0x0000000000000000-mapping.dmp

Download
memory/4392-141-0x0000000000000000-mapping.dmp

Download
memory/4448-132-0x0000000000360000-0x00000000007BE000-memory.dmp

Filesize
4.4MB

Download
memory/4448-147-0x0000000000360000-0x00000000007BE000-memory.dmp

Filesize
4.4MB

Download