fc6bac4da1b4c998bcc46fa95424c9186ebf1fd33812706c7b907e9099299f34

Analysis

max time kernel
273s
max time network
341s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
23-11-2022 10:06

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

fc6bac4da1b4c998bcc46fa95424c9186ebf1fd33812706c7b907e9099299f34.exe
Size

603KB
MD5

12b72ac5fb4c6b635044348caa152da3
SHA1

a684dcc63ef78666e3e9f704af7617b8e884f474
SHA256

fc6bac4da1b4c998bcc46fa95424c9186ebf1fd33812706c7b907e9099299f34
SHA512

0ff480d4f76675fa3e04e6fca4b9713a31d6b1953c3a5f7bc7facb172862d8f501c1c8884a9ec06f4ab8f5adc6eb2e0a311aa3341e67b0c83f5ccdd9c30f7db5
SSDEEP

12288:tIny5DYTMI1IpTpQfbY38NE6o5VOtHPrKicOpV4m:5UTMaapQf5NOVOtvrKicC2m

Score

8^/10

discovery

Malware Config

Signatures

Drops file in Drivers directory 1 IoCs

Processes:

fc6bac4da1b4c998bcc46fa95424c9186ebf1fd33812706c7b907e9099299f34.exe

description ioc process

File created C:\Windows\system32\drivers\nethfdrv.sys fc6bac4da1b4c998bcc46fa95424c9186ebf1fd33812706c7b907e9099299f34.exe
Executes dropped EXE 1 IoCs

Processes:

installd.exe

pid process

1536 installd.exe

description	ioc	process
File created	C:\Windows\system32\drivers\nethfdrv.sys	fc6bac4da1b4c998bcc46fa95424c9186ebf1fd33812706c7b907e9099299f34.exe

pid	process
1536	installd.exe

Loads dropped DLL 6 IoCs

Processes:

fc6bac4da1b4c998bcc46fa95424c9186ebf1fd33812706c7b907e9099299f34.exeinstalld.exe

pid	process
5084	fc6bac4da1b4c998bcc46fa95424c9186ebf1fd33812706c7b907e9099299f34.exe
5084	fc6bac4da1b4c998bcc46fa95424c9186ebf1fd33812706c7b907e9099299f34.exe
5084	fc6bac4da1b4c998bcc46fa95424c9186ebf1fd33812706c7b907e9099299f34.exe
5084	fc6bac4da1b4c998bcc46fa95424c9186ebf1fd33812706c7b907e9099299f34.exe
5084	fc6bac4da1b4c998bcc46fa95424c9186ebf1fd33812706c7b907e9099299f34.exe
1536	installd.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in System32 directory 5 IoCs

Processes:

fc6bac4da1b4c998bcc46fa95424c9186ebf1fd33812706c7b907e9099299f34.exe

description	ioc	process
File created	C:\Windows\SysWOW64\hfnapi.dll	fc6bac4da1b4c998bcc46fa95424c9186ebf1fd33812706c7b907e9099299f34.exe
File created	C:\Windows\SysWOW64\hfpapi.dll	fc6bac4da1b4c998bcc46fa95424c9186ebf1fd33812706c7b907e9099299f34.exe
File created	C:\Windows\SysWOW64\installd.exe	fc6bac4da1b4c998bcc46fa95424c9186ebf1fd33812706c7b907e9099299f34.exe
File created	C:\Windows\SysWOW64\nethtsrv.exe	fc6bac4da1b4c998bcc46fa95424c9186ebf1fd33812706c7b907e9099299f34.exe
File created	C:\Windows\SysWOW64\netupdsrv.exe	fc6bac4da1b4c998bcc46fa95424c9186ebf1fd33812706c7b907e9099299f34.exe

Drops file in Program Files directory 3 IoCs

Processes:

fc6bac4da1b4c998bcc46fa95424c9186ebf1fd33812706c7b907e9099299f34.exe

description	ioc	process
File created	C:\Program Files (x86)\Common Files\Config\data.xml	fc6bac4da1b4c998bcc46fa95424c9186ebf1fd33812706c7b907e9099299f34.exe
File created	C:\Program Files (x86)\Common Files\Config\ver.xml	fc6bac4da1b4c998bcc46fa95424c9186ebf1fd33812706c7b907e9099299f34.exe
File created	C:\Program Files (x86)\Common Files\config\uninstinethnfd.exe	fc6bac4da1b4c998bcc46fa95424c9186ebf1fd33812706c7b907e9099299f34.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Runs net.exe

Suspicious use of WriteProcessMemory 15 IoCs

Processes:

fc6bac4da1b4c998bcc46fa95424c9186ebf1fd33812706c7b907e9099299f34.exenet.exenet.exe

description	pid	process	target process
PID 5084 wrote to memory of 2724	5084	fc6bac4da1b4c998bcc46fa95424c9186ebf1fd33812706c7b907e9099299f34.exe	net.exe
PID 5084 wrote to memory of 2724	5084	fc6bac4da1b4c998bcc46fa95424c9186ebf1fd33812706c7b907e9099299f34.exe	net.exe
PID 5084 wrote to memory of 2724	5084	fc6bac4da1b4c998bcc46fa95424c9186ebf1fd33812706c7b907e9099299f34.exe	net.exe
PID 2724 wrote to memory of 4328	2724	net.exe	net1.exe
PID 2724 wrote to memory of 4328	2724	net.exe	net1.exe
PID 2724 wrote to memory of 4328	2724	net.exe	net1.exe
PID 5084 wrote to memory of 2796	5084	fc6bac4da1b4c998bcc46fa95424c9186ebf1fd33812706c7b907e9099299f34.exe	net.exe
PID 5084 wrote to memory of 2796	5084	fc6bac4da1b4c998bcc46fa95424c9186ebf1fd33812706c7b907e9099299f34.exe	net.exe
PID 5084 wrote to memory of 2796	5084	fc6bac4da1b4c998bcc46fa95424c9186ebf1fd33812706c7b907e9099299f34.exe	net.exe
PID 2796 wrote to memory of 1716	2796	net.exe	net1.exe
PID 2796 wrote to memory of 1716	2796	net.exe	net1.exe
PID 2796 wrote to memory of 1716	2796	net.exe	net1.exe
PID 5084 wrote to memory of 1536	5084	fc6bac4da1b4c998bcc46fa95424c9186ebf1fd33812706c7b907e9099299f34.exe	installd.exe
PID 5084 wrote to memory of 1536	5084	fc6bac4da1b4c998bcc46fa95424c9186ebf1fd33812706c7b907e9099299f34.exe	installd.exe
PID 5084 wrote to memory of 1536	5084	fc6bac4da1b4c998bcc46fa95424c9186ebf1fd33812706c7b907e9099299f34.exe	installd.exe

C:\Users\Admin\AppData\Local\Temp\fc6bac4da1b4c998bcc46fa95424c9186ebf1fd33812706c7b907e9099299f34.exe
"C:\Users\Admin\AppData\Local\Temp\fc6bac4da1b4c998bcc46fa95424c9186ebf1fd33812706c7b907e9099299f34.exe"
1⤵
- Drops file in Drivers directory
- Loads dropped DLL
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:5084

C:\Windows\SysWOW64\net.exe
net stop nethttpservice
2⤵
- Suspicious use of WriteProcessMemory
PID:2724

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop nethttpservice
3⤵
PID:4328

C:\Windows\SysWOW64\net.exe
net stop serviceupdater
2⤵
- Suspicious use of WriteProcessMemory
PID:2796

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop serviceupdater
3⤵
PID:1716

C:\Windows\SysWOW64\installd.exe
"C:\Windows\system32\installd.exe" nethfdrv
2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1536

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\nsgEA68.tmp\System.dll

Filesize
11KB

MD5
c17103ae9072a06da581dec998343fc1

SHA1
b72148c6bdfaada8b8c3f950e610ee7cf1da1f8d

SHA256
dc58d8ad81cacb0c1ed72e33bff8f23ea40b5252b5bb55d393a0903e6819ae2f

SHA512
d32a71aaef18e993f28096d536e41c4d016850721b31171513ce28bbd805a54fd290b7c3e9d935f72e676a1acfb4f0dcc89d95040a0dd29f2b6975855c18986f

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsgEA68.tmp\nsExec.dll

Filesize
6KB

MD5
acc2b699edfea5bf5aae45aba3a41e96

SHA1
d2accf4d494e43ceb2cff69abe4dd17147d29cc2

SHA256
168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e

SHA512
e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsgEA68.tmp\nsExec.dll

Filesize
6KB

MD5
acc2b699edfea5bf5aae45aba3a41e96

SHA1
d2accf4d494e43ceb2cff69abe4dd17147d29cc2

SHA256
168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e

SHA512
e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsgEA68.tmp\nsExec.dll

Filesize
6KB

MD5
acc2b699edfea5bf5aae45aba3a41e96

SHA1
d2accf4d494e43ceb2cff69abe4dd17147d29cc2

SHA256
168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e

SHA512
e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsgEA68.tmp\nsExec.dll

Filesize
6KB

MD5
acc2b699edfea5bf5aae45aba3a41e96

SHA1
d2accf4d494e43ceb2cff69abe4dd17147d29cc2

SHA256
168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e

SHA512
e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe

Download Submit
C:\Windows\SysWOW64\hfnapi.dll

Filesize
106KB

MD5
a97d1fd5959bbb4ffac7bad3c53ab395

SHA1
b44eba5770636bee518ff33763c9ea06d1616429

SHA256
546f0bf1011297e55681505bf1fb5af3fe321fef59e0158329d2628134273e7a

SHA512
89778de74de4de5ffae457545b5f06aef5a16c1f1f6b9ad78c0775128fddbb51f32c4c2bff5ee56669612409e11eaa24e1f9dd6b2affae6526e81a257d602ee0

Download Submit
C:\Windows\SysWOW64\hfnapi.dll

Filesize
106KB

MD5
a97d1fd5959bbb4ffac7bad3c53ab395

SHA1
b44eba5770636bee518ff33763c9ea06d1616429

SHA256
546f0bf1011297e55681505bf1fb5af3fe321fef59e0158329d2628134273e7a

SHA512
89778de74de4de5ffae457545b5f06aef5a16c1f1f6b9ad78c0775128fddbb51f32c4c2bff5ee56669612409e11eaa24e1f9dd6b2affae6526e81a257d602ee0

Download Submit
C:\Windows\SysWOW64\installd.exe

Filesize
108KB

MD5
a31540992640f48eb437e84a4e3fd45d

SHA1
96192bb4477c2858e11cc18badde5c308a1cb15d

SHA256
d3b6dc4efebc1f7ab83c7c34a0a2ed8627ed005555134f5b0655f7b7ac72b5cd

SHA512
376deaebff209108281061151db4298405fe4899f85a5358f14a34c31030b120866adc0734d195a22bc9de6d48536465a3fd3ea69ea07e6b1ae5ee623da26671

Download Submit
C:\Windows\SysWOW64\installd.exe

Filesize
108KB

MD5
a31540992640f48eb437e84a4e3fd45d

SHA1
96192bb4477c2858e11cc18badde5c308a1cb15d

SHA256
d3b6dc4efebc1f7ab83c7c34a0a2ed8627ed005555134f5b0655f7b7ac72b5cd

SHA512
376deaebff209108281061151db4298405fe4899f85a5358f14a34c31030b120866adc0734d195a22bc9de6d48536465a3fd3ea69ea07e6b1ae5ee623da26671

Download Submit
memory/1536-143-0x0000000000000000-mapping.dmp

Download
memory/1716-142-0x0000000000000000-mapping.dmp

Download
memory/2724-136-0x0000000000000000-mapping.dmp

Download
memory/2796-141-0x0000000000000000-mapping.dmp

Download
memory/4328-137-0x0000000000000000-mapping.dmp

Download
memory/5084-138-0x0000000000360000-0x00000000007BE000-memory.dmp

Filesize
4.4MB

Download
memory/5084-132-0x0000000000360000-0x00000000007BE000-memory.dmp

Filesize
4.4MB

Download