Analysis
-
max time kernel
131s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
23-11-2022 10:08
Static task
static1
Behavioral task
behavioral1
Sample
edf6332bf988256617a49aef8cc9da795ced267f205c9352f7693c5ec87923fb.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
edf6332bf988256617a49aef8cc9da795ced267f205c9352f7693c5ec87923fb.exe
Resource
win10v2004-20220812-en
General
-
Target
edf6332bf988256617a49aef8cc9da795ced267f205c9352f7693c5ec87923fb.exe
-
Size
601KB
-
MD5
1a321d5ee93b2488c23dfac4ee227ec2
-
SHA1
4b97b3c9ee7e3b9f70acc065caec73a5ff75a646
-
SHA256
edf6332bf988256617a49aef8cc9da795ced267f205c9352f7693c5ec87923fb
-
SHA512
714124c0ffd739c5c89c9b4a5f6d3025de5dd9aeb56ea35962efc9a700086c961b4a3c33bd7e0af5fa08278b815c21eb27d9c8ffb316e348a830a0ecab09a1f7
-
SSDEEP
6144:i6sFuai9ny5DYTBZopkBn2sew1NfL/rT9iiLbDLuvd8soMho7lvhIRkpKMkgHbbO:MIny5DYTtao7ul8sofRhC26s5Oom
Malware Config
Signatures
-
Drops file in Drivers directory 1 IoCs
Processes:
edf6332bf988256617a49aef8cc9da795ced267f205c9352f7693c5ec87923fb.exedescription ioc process File created C:\Windows\system32\drivers\nethfdrv.sys edf6332bf988256617a49aef8cc9da795ced267f205c9352f7693c5ec87923fb.exe -
Executes dropped EXE 5 IoCs
Processes:
installd.exenethtsrv.exenetupdsrv.exenethtsrv.exenetupdsrv.exepid process 2180 installd.exe 4488 nethtsrv.exe 4388 netupdsrv.exe 4308 nethtsrv.exe 4660 netupdsrv.exe -
Loads dropped DLL 14 IoCs
Processes:
edf6332bf988256617a49aef8cc9da795ced267f205c9352f7693c5ec87923fb.exeinstalld.exenethtsrv.exenethtsrv.exepid process 4904 edf6332bf988256617a49aef8cc9da795ced267f205c9352f7693c5ec87923fb.exe 4904 edf6332bf988256617a49aef8cc9da795ced267f205c9352f7693c5ec87923fb.exe 4904 edf6332bf988256617a49aef8cc9da795ced267f205c9352f7693c5ec87923fb.exe 4904 edf6332bf988256617a49aef8cc9da795ced267f205c9352f7693c5ec87923fb.exe 4904 edf6332bf988256617a49aef8cc9da795ced267f205c9352f7693c5ec87923fb.exe 2180 installd.exe 4488 nethtsrv.exe 4488 nethtsrv.exe 4904 edf6332bf988256617a49aef8cc9da795ced267f205c9352f7693c5ec87923fb.exe 4904 edf6332bf988256617a49aef8cc9da795ced267f205c9352f7693c5ec87923fb.exe 4308 nethtsrv.exe 4308 nethtsrv.exe 4904 edf6332bf988256617a49aef8cc9da795ced267f205c9352f7693c5ec87923fb.exe 4904 edf6332bf988256617a49aef8cc9da795ced267f205c9352f7693c5ec87923fb.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops file in System32 directory 5 IoCs
Processes:
edf6332bf988256617a49aef8cc9da795ced267f205c9352f7693c5ec87923fb.exedescription ioc process File created C:\Windows\SysWOW64\netupdsrv.exe edf6332bf988256617a49aef8cc9da795ced267f205c9352f7693c5ec87923fb.exe File created C:\Windows\SysWOW64\hfnapi.dll edf6332bf988256617a49aef8cc9da795ced267f205c9352f7693c5ec87923fb.exe File created C:\Windows\SysWOW64\hfpapi.dll edf6332bf988256617a49aef8cc9da795ced267f205c9352f7693c5ec87923fb.exe File created C:\Windows\SysWOW64\installd.exe edf6332bf988256617a49aef8cc9da795ced267f205c9352f7693c5ec87923fb.exe File created C:\Windows\SysWOW64\nethtsrv.exe edf6332bf988256617a49aef8cc9da795ced267f205c9352f7693c5ec87923fb.exe -
Drops file in Program Files directory 3 IoCs
Processes:
edf6332bf988256617a49aef8cc9da795ced267f205c9352f7693c5ec87923fb.exedescription ioc process File created C:\Program Files (x86)\Common Files\Config\data.xml edf6332bf988256617a49aef8cc9da795ced267f205c9352f7693c5ec87923fb.exe File created C:\Program Files (x86)\Common Files\Config\ver.xml edf6332bf988256617a49aef8cc9da795ced267f205c9352f7693c5ec87923fb.exe File created C:\Program Files (x86)\Common Files\config\uninstinethnfd.exe edf6332bf988256617a49aef8cc9da795ced267f205c9352f7693c5ec87923fb.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Modifies data under HKEY_USERS 1 IoCs
Processes:
nethtsrv.exedescription ioc process Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections nethtsrv.exe -
Runs net.exe
-
Suspicious behavior: LoadsDriver 1 IoCs
Processes:
pid process 660 -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
nethtsrv.exedescription pid process Token: SeDebugPrivilege 4308 nethtsrv.exe -
Suspicious use of WriteProcessMemory 33 IoCs
Processes:
edf6332bf988256617a49aef8cc9da795ced267f205c9352f7693c5ec87923fb.exenet.exenet.exenet.exenet.exedescription pid process target process PID 4904 wrote to memory of 3132 4904 edf6332bf988256617a49aef8cc9da795ced267f205c9352f7693c5ec87923fb.exe net.exe PID 4904 wrote to memory of 3132 4904 edf6332bf988256617a49aef8cc9da795ced267f205c9352f7693c5ec87923fb.exe net.exe PID 4904 wrote to memory of 3132 4904 edf6332bf988256617a49aef8cc9da795ced267f205c9352f7693c5ec87923fb.exe net.exe PID 3132 wrote to memory of 3748 3132 net.exe net1.exe PID 3132 wrote to memory of 3748 3132 net.exe net1.exe PID 3132 wrote to memory of 3748 3132 net.exe net1.exe PID 4904 wrote to memory of 4908 4904 edf6332bf988256617a49aef8cc9da795ced267f205c9352f7693c5ec87923fb.exe net.exe PID 4904 wrote to memory of 4908 4904 edf6332bf988256617a49aef8cc9da795ced267f205c9352f7693c5ec87923fb.exe net.exe PID 4904 wrote to memory of 4908 4904 edf6332bf988256617a49aef8cc9da795ced267f205c9352f7693c5ec87923fb.exe net.exe PID 4908 wrote to memory of 3456 4908 net.exe net1.exe PID 4908 wrote to memory of 3456 4908 net.exe net1.exe PID 4908 wrote to memory of 3456 4908 net.exe net1.exe PID 4904 wrote to memory of 2180 4904 edf6332bf988256617a49aef8cc9da795ced267f205c9352f7693c5ec87923fb.exe installd.exe PID 4904 wrote to memory of 2180 4904 edf6332bf988256617a49aef8cc9da795ced267f205c9352f7693c5ec87923fb.exe installd.exe PID 4904 wrote to memory of 2180 4904 edf6332bf988256617a49aef8cc9da795ced267f205c9352f7693c5ec87923fb.exe installd.exe PID 4904 wrote to memory of 4488 4904 edf6332bf988256617a49aef8cc9da795ced267f205c9352f7693c5ec87923fb.exe nethtsrv.exe PID 4904 wrote to memory of 4488 4904 edf6332bf988256617a49aef8cc9da795ced267f205c9352f7693c5ec87923fb.exe nethtsrv.exe PID 4904 wrote to memory of 4488 4904 edf6332bf988256617a49aef8cc9da795ced267f205c9352f7693c5ec87923fb.exe nethtsrv.exe PID 4904 wrote to memory of 4388 4904 edf6332bf988256617a49aef8cc9da795ced267f205c9352f7693c5ec87923fb.exe netupdsrv.exe PID 4904 wrote to memory of 4388 4904 edf6332bf988256617a49aef8cc9da795ced267f205c9352f7693c5ec87923fb.exe netupdsrv.exe PID 4904 wrote to memory of 4388 4904 edf6332bf988256617a49aef8cc9da795ced267f205c9352f7693c5ec87923fb.exe netupdsrv.exe PID 4904 wrote to memory of 2244 4904 edf6332bf988256617a49aef8cc9da795ced267f205c9352f7693c5ec87923fb.exe net.exe PID 4904 wrote to memory of 2244 4904 edf6332bf988256617a49aef8cc9da795ced267f205c9352f7693c5ec87923fb.exe net.exe PID 4904 wrote to memory of 2244 4904 edf6332bf988256617a49aef8cc9da795ced267f205c9352f7693c5ec87923fb.exe net.exe PID 2244 wrote to memory of 3440 2244 net.exe net1.exe PID 2244 wrote to memory of 3440 2244 net.exe net1.exe PID 2244 wrote to memory of 3440 2244 net.exe net1.exe PID 4904 wrote to memory of 432 4904 edf6332bf988256617a49aef8cc9da795ced267f205c9352f7693c5ec87923fb.exe net.exe PID 4904 wrote to memory of 432 4904 edf6332bf988256617a49aef8cc9da795ced267f205c9352f7693c5ec87923fb.exe net.exe PID 4904 wrote to memory of 432 4904 edf6332bf988256617a49aef8cc9da795ced267f205c9352f7693c5ec87923fb.exe net.exe PID 432 wrote to memory of 3176 432 net.exe net1.exe PID 432 wrote to memory of 3176 432 net.exe net1.exe PID 432 wrote to memory of 3176 432 net.exe net1.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\edf6332bf988256617a49aef8cc9da795ced267f205c9352f7693c5ec87923fb.exe"C:\Users\Admin\AppData\Local\Temp\edf6332bf988256617a49aef8cc9da795ced267f205c9352f7693c5ec87923fb.exe"1⤵
- Drops file in Drivers directory
- Loads dropped DLL
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:4904 -
C:\Windows\SysWOW64\net.exenet stop nethttpservice2⤵
- Suspicious use of WriteProcessMemory
PID:3132 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop nethttpservice3⤵PID:3748
-
C:\Windows\SysWOW64\net.exenet stop serviceupdater2⤵
- Suspicious use of WriteProcessMemory
PID:4908 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop serviceupdater3⤵PID:3456
-
C:\Windows\SysWOW64\installd.exe"C:\Windows\system32\installd.exe" nethfdrv2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2180 -
C:\Windows\SysWOW64\nethtsrv.exe"C:\Windows\system32\nethtsrv.exe" -nfdi2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:4488 -
C:\Windows\SysWOW64\netupdsrv.exe"C:\Windows\system32\netupdsrv.exe" -nfdi2⤵
- Executes dropped EXE
PID:4388 -
C:\Windows\SysWOW64\net.exenet start nethttpservice2⤵
- Suspicious use of WriteProcessMemory
PID:2244 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 start nethttpservice3⤵PID:3440
-
C:\Windows\SysWOW64\net.exenet start serviceupdater2⤵
- Suspicious use of WriteProcessMemory
PID:432 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 start serviceupdater3⤵PID:3176
-
C:\Windows\SysWOW64\nethtsrv.exeC:\Windows\SysWOW64\nethtsrv.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:4308
-
C:\Windows\SysWOW64\netupdsrv.exeC:\Windows\SysWOW64\netupdsrv.exe1⤵
- Executes dropped EXE
PID:4660
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
11KB
MD5c17103ae9072a06da581dec998343fc1
SHA1b72148c6bdfaada8b8c3f950e610ee7cf1da1f8d
SHA256dc58d8ad81cacb0c1ed72e33bff8f23ea40b5252b5bb55d393a0903e6819ae2f
SHA512d32a71aaef18e993f28096d536e41c4d016850721b31171513ce28bbd805a54fd290b7c3e9d935f72e676a1acfb4f0dcc89d95040a0dd29f2b6975855c18986f
-
Filesize
6KB
MD5acc2b699edfea5bf5aae45aba3a41e96
SHA1d2accf4d494e43ceb2cff69abe4dd17147d29cc2
SHA256168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e
SHA512e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe
-
Filesize
6KB
MD5acc2b699edfea5bf5aae45aba3a41e96
SHA1d2accf4d494e43ceb2cff69abe4dd17147d29cc2
SHA256168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e
SHA512e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe
-
Filesize
6KB
MD5acc2b699edfea5bf5aae45aba3a41e96
SHA1d2accf4d494e43ceb2cff69abe4dd17147d29cc2
SHA256168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e
SHA512e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe
-
Filesize
6KB
MD5acc2b699edfea5bf5aae45aba3a41e96
SHA1d2accf4d494e43ceb2cff69abe4dd17147d29cc2
SHA256168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e
SHA512e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe
-
Filesize
6KB
MD5acc2b699edfea5bf5aae45aba3a41e96
SHA1d2accf4d494e43ceb2cff69abe4dd17147d29cc2
SHA256168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e
SHA512e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe
-
Filesize
6KB
MD5acc2b699edfea5bf5aae45aba3a41e96
SHA1d2accf4d494e43ceb2cff69abe4dd17147d29cc2
SHA256168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e
SHA512e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe
-
Filesize
6KB
MD5acc2b699edfea5bf5aae45aba3a41e96
SHA1d2accf4d494e43ceb2cff69abe4dd17147d29cc2
SHA256168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e
SHA512e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe
-
Filesize
6KB
MD5acc2b699edfea5bf5aae45aba3a41e96
SHA1d2accf4d494e43ceb2cff69abe4dd17147d29cc2
SHA256168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e
SHA512e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe
-
Filesize
106KB
MD55a6ead31968a4cfb06f298df2714d5e2
SHA1c7fd3272da7b06b010c8233f6921579af5261c4c
SHA256e820d4f45dc8b9768347d41cdb06d7c078c584d4c69498b9fd7e174b20f8df78
SHA512911954df92c39156ee696c50a18565604257f8b4d7c5f5df240905951aa3d983399376618dcafa894a1ffbd724437a889cb34e037f139c62397a221a44cd4bbc
-
Filesize
106KB
MD55a6ead31968a4cfb06f298df2714d5e2
SHA1c7fd3272da7b06b010c8233f6921579af5261c4c
SHA256e820d4f45dc8b9768347d41cdb06d7c078c584d4c69498b9fd7e174b20f8df78
SHA512911954df92c39156ee696c50a18565604257f8b4d7c5f5df240905951aa3d983399376618dcafa894a1ffbd724437a889cb34e037f139c62397a221a44cd4bbc
-
Filesize
106KB
MD55a6ead31968a4cfb06f298df2714d5e2
SHA1c7fd3272da7b06b010c8233f6921579af5261c4c
SHA256e820d4f45dc8b9768347d41cdb06d7c078c584d4c69498b9fd7e174b20f8df78
SHA512911954df92c39156ee696c50a18565604257f8b4d7c5f5df240905951aa3d983399376618dcafa894a1ffbd724437a889cb34e037f139c62397a221a44cd4bbc
-
Filesize
106KB
MD55a6ead31968a4cfb06f298df2714d5e2
SHA1c7fd3272da7b06b010c8233f6921579af5261c4c
SHA256e820d4f45dc8b9768347d41cdb06d7c078c584d4c69498b9fd7e174b20f8df78
SHA512911954df92c39156ee696c50a18565604257f8b4d7c5f5df240905951aa3d983399376618dcafa894a1ffbd724437a889cb34e037f139c62397a221a44cd4bbc
-
Filesize
241KB
MD5fd9f797116ae542aa592b2de77e46bf6
SHA1d93a8ee34a053eaa5e5b53a075d02a902defc956
SHA256971c6c21023c616a52c6529a329e5937bbf0c2619d487b86d36a62431a506fbf
SHA51231615c5441c695e6edac5f9a2c2bac5178736a0dc36e141f111b83f3d92a0dd5300a8d0bca1fee4b13131b708f06aac98f69d1b1439ca1de90d63e59f80c1640
-
Filesize
241KB
MD5fd9f797116ae542aa592b2de77e46bf6
SHA1d93a8ee34a053eaa5e5b53a075d02a902defc956
SHA256971c6c21023c616a52c6529a329e5937bbf0c2619d487b86d36a62431a506fbf
SHA51231615c5441c695e6edac5f9a2c2bac5178736a0dc36e141f111b83f3d92a0dd5300a8d0bca1fee4b13131b708f06aac98f69d1b1439ca1de90d63e59f80c1640
-
Filesize
241KB
MD5fd9f797116ae542aa592b2de77e46bf6
SHA1d93a8ee34a053eaa5e5b53a075d02a902defc956
SHA256971c6c21023c616a52c6529a329e5937bbf0c2619d487b86d36a62431a506fbf
SHA51231615c5441c695e6edac5f9a2c2bac5178736a0dc36e141f111b83f3d92a0dd5300a8d0bca1fee4b13131b708f06aac98f69d1b1439ca1de90d63e59f80c1640
-
Filesize
108KB
MD563add8e194b729cd7fd14779c5be223e
SHA1d3170e14c7def2698a3a947ab2bd234cd370c192
SHA25624b9fca2c8011f692562853093e5991d34c73ad8ccd1284f19f86f32738ab45c
SHA512fa055caf93439762d2c784c1d2ec3d8ce841d790fe3fd4e6c48ba677c898b6e52e599fa61c03ee7bfed3e6bb86219372bfc64508d047db97c47680d78f2a0f3f
-
Filesize
108KB
MD563add8e194b729cd7fd14779c5be223e
SHA1d3170e14c7def2698a3a947ab2bd234cd370c192
SHA25624b9fca2c8011f692562853093e5991d34c73ad8ccd1284f19f86f32738ab45c
SHA512fa055caf93439762d2c784c1d2ec3d8ce841d790fe3fd4e6c48ba677c898b6e52e599fa61c03ee7bfed3e6bb86219372bfc64508d047db97c47680d78f2a0f3f
-
Filesize
176KB
MD5084b21e1c76dccd8e9a4ea71f1457f02
SHA17ddffd850b9700f65c9ce97fb00ea7798978d045
SHA25670ed03619205ee6c905029c14bee8a9bd96fc49ea016468658e70b52fc1f2d80
SHA5124e248ab697d4c2cf6f9fe27f193000e18eb04c0185692763ba990700a40cf05d61388b096a2536c613fcb6cfc20a54569204cf4cf299b75e499f847ac4055082
-
Filesize
176KB
MD5084b21e1c76dccd8e9a4ea71f1457f02
SHA17ddffd850b9700f65c9ce97fb00ea7798978d045
SHA25670ed03619205ee6c905029c14bee8a9bd96fc49ea016468658e70b52fc1f2d80
SHA5124e248ab697d4c2cf6f9fe27f193000e18eb04c0185692763ba990700a40cf05d61388b096a2536c613fcb6cfc20a54569204cf4cf299b75e499f847ac4055082
-
Filesize
176KB
MD5084b21e1c76dccd8e9a4ea71f1457f02
SHA17ddffd850b9700f65c9ce97fb00ea7798978d045
SHA25670ed03619205ee6c905029c14bee8a9bd96fc49ea016468658e70b52fc1f2d80
SHA5124e248ab697d4c2cf6f9fe27f193000e18eb04c0185692763ba990700a40cf05d61388b096a2536c613fcb6cfc20a54569204cf4cf299b75e499f847ac4055082
-
Filesize
158KB
MD513ddc0df2c1abef56e40494ba43cf3d2
SHA149574bc274d709bb88eefa8c478cc426ce84dc7d
SHA256640e542f1e82a5e37607d04f0f42a76d254015b47bc88c5499d37ed7002cbb39
SHA512ade6301f348db9f70e6113272bab23e6bb3db280c46974327f03b3a8881825de9a6223db6c665b9690a0b10980e7a3dfb1b785afdcc6a785d4398938b37c1e40
-
Filesize
158KB
MD513ddc0df2c1abef56e40494ba43cf3d2
SHA149574bc274d709bb88eefa8c478cc426ce84dc7d
SHA256640e542f1e82a5e37607d04f0f42a76d254015b47bc88c5499d37ed7002cbb39
SHA512ade6301f348db9f70e6113272bab23e6bb3db280c46974327f03b3a8881825de9a6223db6c665b9690a0b10980e7a3dfb1b785afdcc6a785d4398938b37c1e40
-
Filesize
158KB
MD513ddc0df2c1abef56e40494ba43cf3d2
SHA149574bc274d709bb88eefa8c478cc426ce84dc7d
SHA256640e542f1e82a5e37607d04f0f42a76d254015b47bc88c5499d37ed7002cbb39
SHA512ade6301f348db9f70e6113272bab23e6bb3db280c46974327f03b3a8881825de9a6223db6c665b9690a0b10980e7a3dfb1b785afdcc6a785d4398938b37c1e40