d7767d7f550293844d1d262fd396dfd65f5db79a2681748dfcca3b189e9043b1

Analysis

max time kernel
243s
max time network
333s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
23-11-2022 10:10

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d7767d7f550293844d1d262fd396dfd65f5db79a2681748dfcca3b189e9043b1.exe
Size

602KB
MD5

86573e185e08c068b9930b711bfe3520
SHA1

c981b7d13aff39efa95c0ed7066087f65d91b9ab
SHA256

d7767d7f550293844d1d262fd396dfd65f5db79a2681748dfcca3b189e9043b1
SHA512

9dd4290c055c0bafa713bf74369816eecea2a22618e6940a5dd4632c46ce314ff7c86cd7db183cd895a0d67046b0274c143b73840f0843fa09b62bbbc65ebcb1
SSDEEP

12288:5Iny5DYTWjfkeuUtPttX2vHck+KRtdic+qnTLtkIwHJ:1UTWj8yUvtlR7rt

Score

8^/10

discovery

Malware Config

Signatures

Drops file in Drivers directory 1 IoCs

Processes:

d7767d7f550293844d1d262fd396dfd65f5db79a2681748dfcca3b189e9043b1.exe

description ioc process

File created C:\Windows\system32\drivers\nethfdrv.sys d7767d7f550293844d1d262fd396dfd65f5db79a2681748dfcca3b189e9043b1.exe
Executes dropped EXE 3 IoCs

Processes:

installd.exenethtsrv.exenetupdsrv.exe

pid process

1100 installd.exe
1092 nethtsrv.exe
932 netupdsrv.exe

description	ioc	process
File created	C:\Windows\system32\drivers\nethfdrv.sys	d7767d7f550293844d1d262fd396dfd65f5db79a2681748dfcca3b189e9043b1.exe

pid	process
1100	installd.exe
1092	nethtsrv.exe
932	netupdsrv.exe

Loads dropped DLL 9 IoCs

Processes:

d7767d7f550293844d1d262fd396dfd65f5db79a2681748dfcca3b189e9043b1.exeinstalld.exenethtsrv.exe

pid	process
1240	d7767d7f550293844d1d262fd396dfd65f5db79a2681748dfcca3b189e9043b1.exe
1240	d7767d7f550293844d1d262fd396dfd65f5db79a2681748dfcca3b189e9043b1.exe
1240	d7767d7f550293844d1d262fd396dfd65f5db79a2681748dfcca3b189e9043b1.exe
1240	d7767d7f550293844d1d262fd396dfd65f5db79a2681748dfcca3b189e9043b1.exe
1100	installd.exe
1240	d7767d7f550293844d1d262fd396dfd65f5db79a2681748dfcca3b189e9043b1.exe
1092	nethtsrv.exe
1092	nethtsrv.exe
1240	d7767d7f550293844d1d262fd396dfd65f5db79a2681748dfcca3b189e9043b1.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in System32 directory 5 IoCs

Processes:

d7767d7f550293844d1d262fd396dfd65f5db79a2681748dfcca3b189e9043b1.exe

description	ioc	process
File created	C:\Windows\SysWOW64\hfnapi.dll	d7767d7f550293844d1d262fd396dfd65f5db79a2681748dfcca3b189e9043b1.exe
File created	C:\Windows\SysWOW64\hfpapi.dll	d7767d7f550293844d1d262fd396dfd65f5db79a2681748dfcca3b189e9043b1.exe
File created	C:\Windows\SysWOW64\installd.exe	d7767d7f550293844d1d262fd396dfd65f5db79a2681748dfcca3b189e9043b1.exe
File created	C:\Windows\SysWOW64\nethtsrv.exe	d7767d7f550293844d1d262fd396dfd65f5db79a2681748dfcca3b189e9043b1.exe
File created	C:\Windows\SysWOW64\netupdsrv.exe	d7767d7f550293844d1d262fd396dfd65f5db79a2681748dfcca3b189e9043b1.exe

Drops file in Program Files directory 3 IoCs

Processes:

d7767d7f550293844d1d262fd396dfd65f5db79a2681748dfcca3b189e9043b1.exe

description	ioc	process
File created	C:\Program Files (x86)\Common Files\Config\data.xml	d7767d7f550293844d1d262fd396dfd65f5db79a2681748dfcca3b189e9043b1.exe
File created	C:\Program Files (x86)\Common Files\Config\ver.xml	d7767d7f550293844d1d262fd396dfd65f5db79a2681748dfcca3b189e9043b1.exe
File created	C:\Program Files (x86)\Common Files\config\uninstinethnfd.exe	d7767d7f550293844d1d262fd396dfd65f5db79a2681748dfcca3b189e9043b1.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Runs net.exe
Suspicious behavior: LoadsDriver 1 IoCs

Processes:

pid process

464

pid	process
464

Suspicious use of WriteProcessMemory 34 IoCs

Processes:

d7767d7f550293844d1d262fd396dfd65f5db79a2681748dfcca3b189e9043b1.exenet.exenet.exe

description	pid	process	target process
PID 1240 wrote to memory of 436	1240	d7767d7f550293844d1d262fd396dfd65f5db79a2681748dfcca3b189e9043b1.exe	net.exe
PID 1240 wrote to memory of 436	1240	d7767d7f550293844d1d262fd396dfd65f5db79a2681748dfcca3b189e9043b1.exe	net.exe
PID 1240 wrote to memory of 436	1240	d7767d7f550293844d1d262fd396dfd65f5db79a2681748dfcca3b189e9043b1.exe	net.exe
PID 1240 wrote to memory of 436	1240	d7767d7f550293844d1d262fd396dfd65f5db79a2681748dfcca3b189e9043b1.exe	net.exe
PID 436 wrote to memory of 1844	436	net.exe	net1.exe
PID 436 wrote to memory of 1844	436	net.exe	net1.exe
PID 436 wrote to memory of 1844	436	net.exe	net1.exe
PID 436 wrote to memory of 1844	436	net.exe	net1.exe
PID 1240 wrote to memory of 832	1240	d7767d7f550293844d1d262fd396dfd65f5db79a2681748dfcca3b189e9043b1.exe	net.exe
PID 1240 wrote to memory of 832	1240	d7767d7f550293844d1d262fd396dfd65f5db79a2681748dfcca3b189e9043b1.exe	net.exe
PID 1240 wrote to memory of 832	1240	d7767d7f550293844d1d262fd396dfd65f5db79a2681748dfcca3b189e9043b1.exe	net.exe
PID 1240 wrote to memory of 832	1240	d7767d7f550293844d1d262fd396dfd65f5db79a2681748dfcca3b189e9043b1.exe	net.exe
PID 832 wrote to memory of 1640	832	net.exe	net1.exe
PID 832 wrote to memory of 1640	832	net.exe	net1.exe
PID 832 wrote to memory of 1640	832	net.exe	net1.exe
PID 832 wrote to memory of 1640	832	net.exe	net1.exe
PID 1240 wrote to memory of 1100	1240	d7767d7f550293844d1d262fd396dfd65f5db79a2681748dfcca3b189e9043b1.exe	installd.exe
PID 1240 wrote to memory of 1100	1240	d7767d7f550293844d1d262fd396dfd65f5db79a2681748dfcca3b189e9043b1.exe	installd.exe
PID 1240 wrote to memory of 1100	1240	d7767d7f550293844d1d262fd396dfd65f5db79a2681748dfcca3b189e9043b1.exe	installd.exe
PID 1240 wrote to memory of 1100	1240	d7767d7f550293844d1d262fd396dfd65f5db79a2681748dfcca3b189e9043b1.exe	installd.exe
PID 1240 wrote to memory of 1100	1240	d7767d7f550293844d1d262fd396dfd65f5db79a2681748dfcca3b189e9043b1.exe	installd.exe
PID 1240 wrote to memory of 1100	1240	d7767d7f550293844d1d262fd396dfd65f5db79a2681748dfcca3b189e9043b1.exe	installd.exe
PID 1240 wrote to memory of 1100	1240	d7767d7f550293844d1d262fd396dfd65f5db79a2681748dfcca3b189e9043b1.exe	installd.exe
PID 1240 wrote to memory of 1092	1240	d7767d7f550293844d1d262fd396dfd65f5db79a2681748dfcca3b189e9043b1.exe	nethtsrv.exe
PID 1240 wrote to memory of 1092	1240	d7767d7f550293844d1d262fd396dfd65f5db79a2681748dfcca3b189e9043b1.exe	nethtsrv.exe
PID 1240 wrote to memory of 1092	1240	d7767d7f550293844d1d262fd396dfd65f5db79a2681748dfcca3b189e9043b1.exe	nethtsrv.exe
PID 1240 wrote to memory of 1092	1240	d7767d7f550293844d1d262fd396dfd65f5db79a2681748dfcca3b189e9043b1.exe	nethtsrv.exe
PID 1240 wrote to memory of 932	1240	d7767d7f550293844d1d262fd396dfd65f5db79a2681748dfcca3b189e9043b1.exe	netupdsrv.exe
PID 1240 wrote to memory of 932	1240	d7767d7f550293844d1d262fd396dfd65f5db79a2681748dfcca3b189e9043b1.exe	netupdsrv.exe
PID 1240 wrote to memory of 932	1240	d7767d7f550293844d1d262fd396dfd65f5db79a2681748dfcca3b189e9043b1.exe	netupdsrv.exe
PID 1240 wrote to memory of 932	1240	d7767d7f550293844d1d262fd396dfd65f5db79a2681748dfcca3b189e9043b1.exe	netupdsrv.exe
PID 1240 wrote to memory of 932	1240	d7767d7f550293844d1d262fd396dfd65f5db79a2681748dfcca3b189e9043b1.exe	netupdsrv.exe
PID 1240 wrote to memory of 932	1240	d7767d7f550293844d1d262fd396dfd65f5db79a2681748dfcca3b189e9043b1.exe	netupdsrv.exe
PID 1240 wrote to memory of 932	1240	d7767d7f550293844d1d262fd396dfd65f5db79a2681748dfcca3b189e9043b1.exe	netupdsrv.exe

C:\Users\Admin\AppData\Local\Temp\d7767d7f550293844d1d262fd396dfd65f5db79a2681748dfcca3b189e9043b1.exe
"C:\Users\Admin\AppData\Local\Temp\d7767d7f550293844d1d262fd396dfd65f5db79a2681748dfcca3b189e9043b1.exe"
1⤵
- Drops file in Drivers directory
- Loads dropped DLL
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:1240

C:\Windows\SysWOW64\net.exe
net stop nethttpservice
2⤵
- Suspicious use of WriteProcessMemory
PID:436

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop nethttpservice
3⤵
PID:1844

C:\Windows\SysWOW64\net.exe
net stop serviceupdater
2⤵
- Suspicious use of WriteProcessMemory
PID:832

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop serviceupdater
3⤵
PID:1640

C:\Windows\SysWOW64\installd.exe
"C:\Windows\system32\installd.exe" nethfdrv
2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1100

C:\Windows\SysWOW64\nethtsrv.exe
"C:\Windows\system32\nethtsrv.exe" -nfdi
2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1092

C:\Windows\SysWOW64\netupdsrv.exe
"C:\Windows\system32\netupdsrv.exe" -nfdi
2⤵
- Executes dropped EXE
PID:932

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\hfnapi.dll

Filesize
106KB

MD5
9d4195d8ee788562fc1b837a1b7bf394

SHA1
e049eb1d2a0a6d5bdb71e30c0ba8a937b8359055

SHA256
b724887d1f661df768883230e79df8b466c5908adaea652b30e2f1062edd37f1

SHA512
10d66f5fd285464f0bf17b7e1dcbf50738cf0209daa3673024a327f0b0eeb07c57da6a0cd420d4b977a66d575a5757a8760b87df56652d25ff3751c910e14ae6

Download Submit
C:\Windows\SysWOW64\hfpapi.dll

Filesize
241KB

MD5
daa46f6467222ec6e8c95f64e4ba861e

SHA1
6d753c73b48219ad91cd09eb458eed1d2a63e6b5

SHA256
6d693495e5a82ce98dad661211e8221b6fe74a04d87538a7d8b7d37ada52b281

SHA512
fffca2db1af7970c04ec7e523b11761e3e5e48cd5b51660d201b3fb775db61ba6e768017f6d031e2ecc2d51b0d8a850a3b06728292d8cf06b19e6f610cae5cd6

Download Submit
C:\Windows\SysWOW64\installd.exe

Filesize
108KB

MD5
508bf25c87fdd63bbba3875346278739

SHA1
f7f85af76ec5188e7d90a6ede0bef30cb2610f19

SHA256
c7b19e152830ef5451d78944a07bab882717605d9d612e520c342319fa96ce01

SHA512
9e93efc36a2ef04ca61b296c5d0d638a2d11d62e8817dd86362e5eb5f8c5b0b56a343ea9174fd662d1b6dd39812f265bfe1a16f1cd09279f6667616cab669f83

Download Submit
C:\Windows\SysWOW64\nethtsrv.exe

Filesize
176KB

MD5
bc2927aefedf39bb600998ad7732a3e6

SHA1
f9d502771bda0440b5f8537d0862cc19ad9b855e

SHA256
2eb09d04d7d60408c98cc3528c6fdf52fb96bdb769e7ae4ec1d55687d843ea41

SHA512
df81e8641205390aa4c249f36b6122784d2984f3356d9dd15f2910cc4c1e82ff37656cb4684fba98ef9d54c932bbe028d1280374635d8d90e7d5fd289fe96745

Download Submit
C:\Windows\SysWOW64\netupdsrv.exe

Filesize
159KB

MD5
9d8bd7a1d93104159ad9092a501553c9

SHA1
7da4a48a12e0d00168e41de331ef75c2c5bf400c

SHA256
8c6eecffa8f0fecbfefa6c4aaa1b00b7f6f39b524c83d0ff218341d2bc6409a3

SHA512
7c21597b132b9c782cbde0e1ea1e0ec43cbac18f025251c1ee6477687b633d11f859b4fe7c3b9ef8bdb22874eac8598fff4c4630bf4e26ac006a39391844869d

Download Submit
\Users\Admin\AppData\Local\Temp\nsz2899.tmp\System.dll

Filesize
11KB

MD5
c17103ae9072a06da581dec998343fc1

SHA1
b72148c6bdfaada8b8c3f950e610ee7cf1da1f8d

SHA256
dc58d8ad81cacb0c1ed72e33bff8f23ea40b5252b5bb55d393a0903e6819ae2f

SHA512
d32a71aaef18e993f28096d536e41c4d016850721b31171513ce28bbd805a54fd290b7c3e9d935f72e676a1acfb4f0dcc89d95040a0dd29f2b6975855c18986f

Download Submit
\Users\Admin\AppData\Local\Temp\nsz2899.tmp\nsExec.dll

Filesize
6KB

MD5
acc2b699edfea5bf5aae45aba3a41e96

SHA1
d2accf4d494e43ceb2cff69abe4dd17147d29cc2

SHA256
168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e

SHA512
e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe

Download Submit
\Users\Admin\AppData\Local\Temp\nsz2899.tmp\nsExec.dll

Filesize
6KB

MD5
acc2b699edfea5bf5aae45aba3a41e96

SHA1
d2accf4d494e43ceb2cff69abe4dd17147d29cc2

SHA256
168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e

SHA512
e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe

Download Submit
\Windows\SysWOW64\hfnapi.dll

Filesize
106KB

MD5
9d4195d8ee788562fc1b837a1b7bf394

SHA1
e049eb1d2a0a6d5bdb71e30c0ba8a937b8359055

SHA256
b724887d1f661df768883230e79df8b466c5908adaea652b30e2f1062edd37f1

SHA512
10d66f5fd285464f0bf17b7e1dcbf50738cf0209daa3673024a327f0b0eeb07c57da6a0cd420d4b977a66d575a5757a8760b87df56652d25ff3751c910e14ae6

Download Submit
\Windows\SysWOW64\hfnapi.dll

Filesize
106KB

MD5
9d4195d8ee788562fc1b837a1b7bf394

SHA1
e049eb1d2a0a6d5bdb71e30c0ba8a937b8359055

SHA256
b724887d1f661df768883230e79df8b466c5908adaea652b30e2f1062edd37f1

SHA512
10d66f5fd285464f0bf17b7e1dcbf50738cf0209daa3673024a327f0b0eeb07c57da6a0cd420d4b977a66d575a5757a8760b87df56652d25ff3751c910e14ae6

Download Submit
\Windows\SysWOW64\hfpapi.dll

Filesize
241KB

MD5
daa46f6467222ec6e8c95f64e4ba861e

SHA1
6d753c73b48219ad91cd09eb458eed1d2a63e6b5

SHA256
6d693495e5a82ce98dad661211e8221b6fe74a04d87538a7d8b7d37ada52b281

SHA512
fffca2db1af7970c04ec7e523b11761e3e5e48cd5b51660d201b3fb775db61ba6e768017f6d031e2ecc2d51b0d8a850a3b06728292d8cf06b19e6f610cae5cd6

Download Submit
\Windows\SysWOW64\installd.exe

Filesize
108KB

MD5
508bf25c87fdd63bbba3875346278739

SHA1
f7f85af76ec5188e7d90a6ede0bef30cb2610f19

SHA256
c7b19e152830ef5451d78944a07bab882717605d9d612e520c342319fa96ce01

SHA512
9e93efc36a2ef04ca61b296c5d0d638a2d11d62e8817dd86362e5eb5f8c5b0b56a343ea9174fd662d1b6dd39812f265bfe1a16f1cd09279f6667616cab669f83

Download Submit
\Windows\SysWOW64\nethtsrv.exe

Filesize
176KB

MD5
bc2927aefedf39bb600998ad7732a3e6

SHA1
f9d502771bda0440b5f8537d0862cc19ad9b855e

SHA256
2eb09d04d7d60408c98cc3528c6fdf52fb96bdb769e7ae4ec1d55687d843ea41

SHA512
df81e8641205390aa4c249f36b6122784d2984f3356d9dd15f2910cc4c1e82ff37656cb4684fba98ef9d54c932bbe028d1280374635d8d90e7d5fd289fe96745

Download Submit
\Windows\SysWOW64\netupdsrv.exe

Filesize
159KB

MD5
9d8bd7a1d93104159ad9092a501553c9

SHA1
7da4a48a12e0d00168e41de331ef75c2c5bf400c

SHA256
8c6eecffa8f0fecbfefa6c4aaa1b00b7f6f39b524c83d0ff218341d2bc6409a3

SHA512
7c21597b132b9c782cbde0e1ea1e0ec43cbac18f025251c1ee6477687b633d11f859b4fe7c3b9ef8bdb22874eac8598fff4c4630bf4e26ac006a39391844869d

Download Submit
memory/436-58-0x0000000000000000-mapping.dmp

Download
memory/832-61-0x0000000000000000-mapping.dmp

Download
memory/932-77-0x0000000000000000-mapping.dmp

Download
memory/1092-71-0x0000000000000000-mapping.dmp

Download
memory/1100-64-0x0000000000000000-mapping.dmp

Download
memory/1240-69-0x0000000000360000-0x00000000007BE000-memory.dmp

Filesize
4.4MB

Download
memory/1240-54-0x0000000074DA1000-0x0000000074DA3000-memory.dmp

Filesize
8KB

Download
memory/1240-55-0x0000000000360000-0x00000000007BE000-memory.dmp

Filesize
4.4MB

Download
memory/1640-62-0x0000000000000000-mapping.dmp

Download
memory/1844-59-0x0000000000000000-mapping.dmp

Download