d59f6daaa2d93117a986e1644bd9158817cc52afbbc6125092bc3dffa415c2a7

Analysis

max time kernel
245s
max time network
335s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
23-11-2022 10:11

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d59f6daaa2d93117a986e1644bd9158817cc52afbbc6125092bc3dffa415c2a7.exe
Size

603KB
MD5

7597103a4ac5bc2732a021344b0616ed
SHA1

4c74b6482a32ade7c0665008b1c400aba203ccff
SHA256

d59f6daaa2d93117a986e1644bd9158817cc52afbbc6125092bc3dffa415c2a7
SHA512

2e976ecc87f8ec637a3d245c960b15910d4b4e8a418c5d6b0bda3d49e2f41bf8f9ef70ab6280ea5f41a95c01235b12429c8ce95d128ab46f81afbed47ecb1304
SSDEEP

12288:TIny5DYTMIaoMRHYzYuPUQC+aCZFFEZQSg:7UTMlogtu8QC+tKZQSg

Score

8^/10

discovery

Malware Config

Signatures

Drops file in Drivers directory 1 IoCs

Processes:

d59f6daaa2d93117a986e1644bd9158817cc52afbbc6125092bc3dffa415c2a7.exe

description ioc process

File created C:\Windows\system32\drivers\nethfdrv.sys d59f6daaa2d93117a986e1644bd9158817cc52afbbc6125092bc3dffa415c2a7.exe
Executes dropped EXE 3 IoCs

Processes:

installd.exenethtsrv.exenetupdsrv.exe

pid process

1004 installd.exe
1236 nethtsrv.exe
1480 netupdsrv.exe

description	ioc	process
File created	C:\Windows\system32\drivers\nethfdrv.sys	d59f6daaa2d93117a986e1644bd9158817cc52afbbc6125092bc3dffa415c2a7.exe

pid	process
1004	installd.exe
1236	nethtsrv.exe
1480	netupdsrv.exe

Loads dropped DLL 9 IoCs

Processes:

d59f6daaa2d93117a986e1644bd9158817cc52afbbc6125092bc3dffa415c2a7.exeinstalld.exenethtsrv.exe

pid	process
672	d59f6daaa2d93117a986e1644bd9158817cc52afbbc6125092bc3dffa415c2a7.exe
672	d59f6daaa2d93117a986e1644bd9158817cc52afbbc6125092bc3dffa415c2a7.exe
672	d59f6daaa2d93117a986e1644bd9158817cc52afbbc6125092bc3dffa415c2a7.exe
672	d59f6daaa2d93117a986e1644bd9158817cc52afbbc6125092bc3dffa415c2a7.exe
1004	installd.exe
672	d59f6daaa2d93117a986e1644bd9158817cc52afbbc6125092bc3dffa415c2a7.exe
1236	nethtsrv.exe
1236	nethtsrv.exe
672	d59f6daaa2d93117a986e1644bd9158817cc52afbbc6125092bc3dffa415c2a7.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in System32 directory 5 IoCs

Processes:

d59f6daaa2d93117a986e1644bd9158817cc52afbbc6125092bc3dffa415c2a7.exe

description	ioc	process
File created	C:\Windows\SysWOW64\netupdsrv.exe	d59f6daaa2d93117a986e1644bd9158817cc52afbbc6125092bc3dffa415c2a7.exe
File created	C:\Windows\SysWOW64\hfnapi.dll	d59f6daaa2d93117a986e1644bd9158817cc52afbbc6125092bc3dffa415c2a7.exe
File created	C:\Windows\SysWOW64\hfpapi.dll	d59f6daaa2d93117a986e1644bd9158817cc52afbbc6125092bc3dffa415c2a7.exe
File created	C:\Windows\SysWOW64\installd.exe	d59f6daaa2d93117a986e1644bd9158817cc52afbbc6125092bc3dffa415c2a7.exe
File created	C:\Windows\SysWOW64\nethtsrv.exe	d59f6daaa2d93117a986e1644bd9158817cc52afbbc6125092bc3dffa415c2a7.exe

Drops file in Program Files directory 3 IoCs

Processes:

d59f6daaa2d93117a986e1644bd9158817cc52afbbc6125092bc3dffa415c2a7.exe

description	ioc	process
File created	C:\Program Files (x86)\Common Files\Config\data.xml	d59f6daaa2d93117a986e1644bd9158817cc52afbbc6125092bc3dffa415c2a7.exe
File created	C:\Program Files (x86)\Common Files\Config\ver.xml	d59f6daaa2d93117a986e1644bd9158817cc52afbbc6125092bc3dffa415c2a7.exe
File created	C:\Program Files (x86)\Common Files\config\uninstinethnfd.exe	d59f6daaa2d93117a986e1644bd9158817cc52afbbc6125092bc3dffa415c2a7.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Runs net.exe
Suspicious behavior: LoadsDriver 1 IoCs

Processes:

pid process

460

pid	process
460

Suspicious use of WriteProcessMemory 34 IoCs

Processes:

d59f6daaa2d93117a986e1644bd9158817cc52afbbc6125092bc3dffa415c2a7.exenet.exenet.exe

description	pid	process	target process
PID 672 wrote to memory of 888	672	d59f6daaa2d93117a986e1644bd9158817cc52afbbc6125092bc3dffa415c2a7.exe	net.exe
PID 672 wrote to memory of 888	672	d59f6daaa2d93117a986e1644bd9158817cc52afbbc6125092bc3dffa415c2a7.exe	net.exe
PID 672 wrote to memory of 888	672	d59f6daaa2d93117a986e1644bd9158817cc52afbbc6125092bc3dffa415c2a7.exe	net.exe
PID 672 wrote to memory of 888	672	d59f6daaa2d93117a986e1644bd9158817cc52afbbc6125092bc3dffa415c2a7.exe	net.exe
PID 888 wrote to memory of 240	888	net.exe	net1.exe
PID 888 wrote to memory of 240	888	net.exe	net1.exe
PID 888 wrote to memory of 240	888	net.exe	net1.exe
PID 888 wrote to memory of 240	888	net.exe	net1.exe
PID 672 wrote to memory of 544	672	d59f6daaa2d93117a986e1644bd9158817cc52afbbc6125092bc3dffa415c2a7.exe	net.exe
PID 672 wrote to memory of 544	672	d59f6daaa2d93117a986e1644bd9158817cc52afbbc6125092bc3dffa415c2a7.exe	net.exe
PID 672 wrote to memory of 544	672	d59f6daaa2d93117a986e1644bd9158817cc52afbbc6125092bc3dffa415c2a7.exe	net.exe
PID 672 wrote to memory of 544	672	d59f6daaa2d93117a986e1644bd9158817cc52afbbc6125092bc3dffa415c2a7.exe	net.exe
PID 544 wrote to memory of 1288	544	net.exe	net1.exe
PID 544 wrote to memory of 1288	544	net.exe	net1.exe
PID 544 wrote to memory of 1288	544	net.exe	net1.exe
PID 544 wrote to memory of 1288	544	net.exe	net1.exe
PID 672 wrote to memory of 1004	672	d59f6daaa2d93117a986e1644bd9158817cc52afbbc6125092bc3dffa415c2a7.exe	installd.exe
PID 672 wrote to memory of 1004	672	d59f6daaa2d93117a986e1644bd9158817cc52afbbc6125092bc3dffa415c2a7.exe	installd.exe
PID 672 wrote to memory of 1004	672	d59f6daaa2d93117a986e1644bd9158817cc52afbbc6125092bc3dffa415c2a7.exe	installd.exe
PID 672 wrote to memory of 1004	672	d59f6daaa2d93117a986e1644bd9158817cc52afbbc6125092bc3dffa415c2a7.exe	installd.exe
PID 672 wrote to memory of 1004	672	d59f6daaa2d93117a986e1644bd9158817cc52afbbc6125092bc3dffa415c2a7.exe	installd.exe
PID 672 wrote to memory of 1004	672	d59f6daaa2d93117a986e1644bd9158817cc52afbbc6125092bc3dffa415c2a7.exe	installd.exe
PID 672 wrote to memory of 1004	672	d59f6daaa2d93117a986e1644bd9158817cc52afbbc6125092bc3dffa415c2a7.exe	installd.exe
PID 672 wrote to memory of 1236	672	d59f6daaa2d93117a986e1644bd9158817cc52afbbc6125092bc3dffa415c2a7.exe	nethtsrv.exe
PID 672 wrote to memory of 1236	672	d59f6daaa2d93117a986e1644bd9158817cc52afbbc6125092bc3dffa415c2a7.exe	nethtsrv.exe
PID 672 wrote to memory of 1236	672	d59f6daaa2d93117a986e1644bd9158817cc52afbbc6125092bc3dffa415c2a7.exe	nethtsrv.exe
PID 672 wrote to memory of 1236	672	d59f6daaa2d93117a986e1644bd9158817cc52afbbc6125092bc3dffa415c2a7.exe	nethtsrv.exe
PID 672 wrote to memory of 1480	672	d59f6daaa2d93117a986e1644bd9158817cc52afbbc6125092bc3dffa415c2a7.exe	netupdsrv.exe
PID 672 wrote to memory of 1480	672	d59f6daaa2d93117a986e1644bd9158817cc52afbbc6125092bc3dffa415c2a7.exe	netupdsrv.exe
PID 672 wrote to memory of 1480	672	d59f6daaa2d93117a986e1644bd9158817cc52afbbc6125092bc3dffa415c2a7.exe	netupdsrv.exe
PID 672 wrote to memory of 1480	672	d59f6daaa2d93117a986e1644bd9158817cc52afbbc6125092bc3dffa415c2a7.exe	netupdsrv.exe
PID 672 wrote to memory of 1480	672	d59f6daaa2d93117a986e1644bd9158817cc52afbbc6125092bc3dffa415c2a7.exe	netupdsrv.exe
PID 672 wrote to memory of 1480	672	d59f6daaa2d93117a986e1644bd9158817cc52afbbc6125092bc3dffa415c2a7.exe	netupdsrv.exe
PID 672 wrote to memory of 1480	672	d59f6daaa2d93117a986e1644bd9158817cc52afbbc6125092bc3dffa415c2a7.exe	netupdsrv.exe

C:\Users\Admin\AppData\Local\Temp\d59f6daaa2d93117a986e1644bd9158817cc52afbbc6125092bc3dffa415c2a7.exe
"C:\Users\Admin\AppData\Local\Temp\d59f6daaa2d93117a986e1644bd9158817cc52afbbc6125092bc3dffa415c2a7.exe"
1⤵
- Drops file in Drivers directory
- Loads dropped DLL
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:672

C:\Windows\SysWOW64\net.exe
net stop nethttpservice
2⤵
- Suspicious use of WriteProcessMemory
PID:888

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop nethttpservice
3⤵
PID:240

C:\Windows\SysWOW64\net.exe
net stop serviceupdater
2⤵
- Suspicious use of WriteProcessMemory
PID:544

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop serviceupdater
3⤵
PID:1288

C:\Windows\SysWOW64\installd.exe
"C:\Windows\system32\installd.exe" nethfdrv
2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1004

C:\Windows\SysWOW64\nethtsrv.exe
"C:\Windows\system32\nethtsrv.exe" -nfdi
2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1236

C:\Windows\SysWOW64\netupdsrv.exe
"C:\Windows\system32\netupdsrv.exe" -nfdi
2⤵
- Executes dropped EXE
PID:1480

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\hfnapi.dll

Filesize
106KB

MD5
fe55d98a23350b9274d418dcc3ed352c

SHA1
5335e60949d49a5825cca5353865150000cd4593

SHA256
3ff84febce34544c9b8de41bb1b48cab865a17167d7e60a4172769aabd9c11d8

SHA512
64beb9bdaa87e6730753bf56131fddec0eb893324b8ae38a171b6e3a0eb8cde3b3b538fd68c014837966d8721ef4f60800fdfe451230bb91d8d18f49efe49220

Download Submit
C:\Windows\SysWOW64\hfpapi.dll

Filesize
244KB

MD5
94e3aac4049a4c23283f70f83d0bbefa

SHA1
c743cafc6c150f31eb8f8540ccb4ab50a390dcf7

SHA256
dd4bf8f69aa16a7b12ff90e8b150d4ea66d1f7d7b6928bf6176b1a386344eb8c

SHA512
139bde0db8afe771744cdd1d43b1635d9cf4afd06b004bec85d21a5811176241c3eb015b1f3c7624c8a0fbbff80fb278ef0bdbd4bd5a405f62f9c83042a97c25

Download Submit
C:\Windows\SysWOW64\installd.exe

Filesize
108KB

MD5
fe679b23035aed136d008feb4c9f3aab

SHA1
8ea4b829a763f0f7df30e98bb18303c6518f92d6

SHA256
bf9361683e57e41fe595acc2216916dba4ad88ef49a76301eee593443d6b8a65

SHA512
463bec2cbc44a586e32358d9805164ee6239cedfad6abcb2077a7373ca70158343b938ca3a9ead3ddcf7fb6783559415a04d9c884096f082fa502426f29bb5c6

Download Submit
C:\Windows\SysWOW64\nethtsrv.exe

Filesize
176KB

MD5
6c9c2ae1a2034ef588ba2890dfc5f1f5

SHA1
209698ebf5c6f682f08fff2804a0081852ced184

SHA256
b832529ec1c9053346e258ccfa225262380a02e3ce0bf046b78ea8d4a934c667

SHA512
769026401d41d0ddbd12ba6d549417440e11fab46fd3139f388fd4bb18089701172d1794dd68db3196e66b9f36c012d3b3b3a03112465f43e4fc06e46713fa39

Download Submit
C:\Windows\SysWOW64\netupdsrv.exe

Filesize
158KB

MD5
2a3cd10668f06360cf572a871af47000

SHA1
4c456d05db537eb58169e97aa81ea4a77bc4f6ed

SHA256
b51b3e9aacefeef8baf0fc6b373d88e139b7a5b04f53ab5d3cabcc0cf90b7f34

SHA512
15da6d3333f158ecd119735307739ac1f3e689200e9a20ed0991d8c426d43ff10394b1352caf69f93e44256085e9716ed20b3731fdc44aa898453afed6baded8

Download Submit
\Users\Admin\AppData\Local\Temp\nsuFCE8.tmp\System.dll

Filesize
11KB

MD5
c17103ae9072a06da581dec998343fc1

SHA1
b72148c6bdfaada8b8c3f950e610ee7cf1da1f8d

SHA256
dc58d8ad81cacb0c1ed72e33bff8f23ea40b5252b5bb55d393a0903e6819ae2f

SHA512
d32a71aaef18e993f28096d536e41c4d016850721b31171513ce28bbd805a54fd290b7c3e9d935f72e676a1acfb4f0dcc89d95040a0dd29f2b6975855c18986f

Download Submit
\Users\Admin\AppData\Local\Temp\nsuFCE8.tmp\nsExec.dll

Filesize
6KB

MD5
acc2b699edfea5bf5aae45aba3a41e96

SHA1
d2accf4d494e43ceb2cff69abe4dd17147d29cc2

SHA256
168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e

SHA512
e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe

Download Submit
\Users\Admin\AppData\Local\Temp\nsuFCE8.tmp\nsExec.dll

Filesize
6KB

MD5
acc2b699edfea5bf5aae45aba3a41e96

SHA1
d2accf4d494e43ceb2cff69abe4dd17147d29cc2

SHA256
168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e

SHA512
e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe

Download Submit
\Windows\SysWOW64\hfnapi.dll

Filesize
106KB

MD5
fe55d98a23350b9274d418dcc3ed352c

SHA1
5335e60949d49a5825cca5353865150000cd4593

SHA256
3ff84febce34544c9b8de41bb1b48cab865a17167d7e60a4172769aabd9c11d8

SHA512
64beb9bdaa87e6730753bf56131fddec0eb893324b8ae38a171b6e3a0eb8cde3b3b538fd68c014837966d8721ef4f60800fdfe451230bb91d8d18f49efe49220

Download Submit
\Windows\SysWOW64\hfnapi.dll

Filesize
106KB

MD5
fe55d98a23350b9274d418dcc3ed352c

SHA1
5335e60949d49a5825cca5353865150000cd4593

SHA256
3ff84febce34544c9b8de41bb1b48cab865a17167d7e60a4172769aabd9c11d8

SHA512
64beb9bdaa87e6730753bf56131fddec0eb893324b8ae38a171b6e3a0eb8cde3b3b538fd68c014837966d8721ef4f60800fdfe451230bb91d8d18f49efe49220

Download Submit
\Windows\SysWOW64\hfpapi.dll

Filesize
244KB

MD5
94e3aac4049a4c23283f70f83d0bbefa

SHA1
c743cafc6c150f31eb8f8540ccb4ab50a390dcf7

SHA256
dd4bf8f69aa16a7b12ff90e8b150d4ea66d1f7d7b6928bf6176b1a386344eb8c

SHA512
139bde0db8afe771744cdd1d43b1635d9cf4afd06b004bec85d21a5811176241c3eb015b1f3c7624c8a0fbbff80fb278ef0bdbd4bd5a405f62f9c83042a97c25

Download Submit
\Windows\SysWOW64\installd.exe

Filesize
108KB

MD5
fe679b23035aed136d008feb4c9f3aab

SHA1
8ea4b829a763f0f7df30e98bb18303c6518f92d6

SHA256
bf9361683e57e41fe595acc2216916dba4ad88ef49a76301eee593443d6b8a65

SHA512
463bec2cbc44a586e32358d9805164ee6239cedfad6abcb2077a7373ca70158343b938ca3a9ead3ddcf7fb6783559415a04d9c884096f082fa502426f29bb5c6

Download Submit
\Windows\SysWOW64\nethtsrv.exe

Filesize
176KB

MD5
6c9c2ae1a2034ef588ba2890dfc5f1f5

SHA1
209698ebf5c6f682f08fff2804a0081852ced184

SHA256
b832529ec1c9053346e258ccfa225262380a02e3ce0bf046b78ea8d4a934c667

SHA512
769026401d41d0ddbd12ba6d549417440e11fab46fd3139f388fd4bb18089701172d1794dd68db3196e66b9f36c012d3b3b3a03112465f43e4fc06e46713fa39

Download Submit
\Windows\SysWOW64\netupdsrv.exe

Filesize
158KB

MD5
2a3cd10668f06360cf572a871af47000

SHA1
4c456d05db537eb58169e97aa81ea4a77bc4f6ed

SHA256
b51b3e9aacefeef8baf0fc6b373d88e139b7a5b04f53ab5d3cabcc0cf90b7f34

SHA512
15da6d3333f158ecd119735307739ac1f3e689200e9a20ed0991d8c426d43ff10394b1352caf69f93e44256085e9716ed20b3731fdc44aa898453afed6baded8

Download Submit
memory/240-59-0x0000000000000000-mapping.dmp

Download
memory/544-61-0x0000000000000000-mapping.dmp

Download
memory/672-69-0x0000000000360000-0x00000000007BE000-memory.dmp

Filesize
4.4MB

Download
memory/672-54-0x0000000076D71000-0x0000000076D73000-memory.dmp

Filesize
8KB

Download
memory/672-55-0x0000000000360000-0x00000000007BE000-memory.dmp

Filesize
4.4MB

Download
memory/888-58-0x0000000000000000-mapping.dmp

Download
memory/1004-64-0x0000000000000000-mapping.dmp

Download
memory/1236-71-0x0000000000000000-mapping.dmp

Download
memory/1288-62-0x0000000000000000-mapping.dmp

Download
memory/1480-77-0x0000000000000000-mapping.dmp

Download