Analysis

  • max time kernel
    179s
  • max time network
    204s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20221111-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
  • submitted
    23-11-2022 10:14

General

  • Target

    b52a805ab8e84de913f003ac954786960792097b5f106e195b7d3446426ec864.exe

  • Size

    602KB

  • MD5

    8951725b739361457154224c754e3e69

  • SHA1

    254eec30d65a544ea0687370230ec1a02aedb925

  • SHA256

    b52a805ab8e84de913f003ac954786960792097b5f106e195b7d3446426ec864

  • SHA512

    0eed0546d500ab0700ef9d4c801a40463f3079512d74cc4bf8ddeb7b9e7fef43b74f0bce1d484b5538dcba15f2a4dc6e637a0c38bdb53e70587d83a88d18a6f6

  • SSDEEP

    12288:DIny5DYTj9qz6vjMoV8LdsAst1tS8e/R:LUTjZvIoVcOh6

Score
8/10

Malware Config

Signatures

  • Drops file in Drivers directory 1 IoCs
  • Executes dropped EXE 5 IoCs
  • Loads dropped DLL 14 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Drops file in System32 directory 5 IoCs
  • Drops file in Program Files directory 3 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Modifies data under HKEY_USERS 1 IoCs
  • Runs net.exe
  • Suspicious behavior: LoadsDriver 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 33 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\b52a805ab8e84de913f003ac954786960792097b5f106e195b7d3446426ec864.exe
    "C:\Users\Admin\AppData\Local\Temp\b52a805ab8e84de913f003ac954786960792097b5f106e195b7d3446426ec864.exe"
    1⤵
    • Drops file in Drivers directory
    • Loads dropped DLL
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • Suspicious use of WriteProcessMemory
    PID:3660
    • C:\Windows\SysWOW64\net.exe
      net stop nethttpservice
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:224
      • C:\Windows\SysWOW64\net1.exe
        C:\Windows\system32\net1 stop nethttpservice
        3⤵
          PID:5100
      • C:\Windows\SysWOW64\net.exe
        net stop serviceupdater
        2⤵
        • Suspicious use of WriteProcessMemory
        PID:4436
        • C:\Windows\SysWOW64\net1.exe
          C:\Windows\system32\net1 stop serviceupdater
          3⤵
            PID:444
        • C:\Windows\SysWOW64\installd.exe
          "C:\Windows\system32\installd.exe" nethfdrv
          2⤵
          • Executes dropped EXE
          • Loads dropped DLL
          PID:544
        • C:\Windows\SysWOW64\nethtsrv.exe
          "C:\Windows\system32\nethtsrv.exe" -nfdi
          2⤵
          • Executes dropped EXE
          • Loads dropped DLL
          PID:1008
        • C:\Windows\SysWOW64\netupdsrv.exe
          "C:\Windows\system32\netupdsrv.exe" -nfdi
          2⤵
          • Executes dropped EXE
          PID:4616
        • C:\Windows\SysWOW64\net.exe
          net start nethttpservice
          2⤵
          • Suspicious use of WriteProcessMemory
          PID:4764
          • C:\Windows\SysWOW64\net1.exe
            C:\Windows\system32\net1 start nethttpservice
            3⤵
              PID:4716
          • C:\Windows\SysWOW64\net.exe
            net start serviceupdater
            2⤵
            • Suspicious use of WriteProcessMemory
            PID:4480
            • C:\Windows\SysWOW64\net1.exe
              C:\Windows\system32\net1 start serviceupdater
              3⤵
                PID:540
          • C:\Windows\SysWOW64\nethtsrv.exe
            C:\Windows\SysWOW64\nethtsrv.exe
            1⤵
            • Executes dropped EXE
            • Loads dropped DLL
            • Modifies data under HKEY_USERS
            • Suspicious use of AdjustPrivilegeToken
            PID:456
          • C:\Windows\SysWOW64\netupdsrv.exe
            C:\Windows\SysWOW64\netupdsrv.exe
            1⤵
            • Executes dropped EXE
            PID:2940

          Network

          MITRE ATT&CK Enterprise v6

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • C:\Users\Admin\AppData\Local\Temp\nsa54E8.tmp\System.dll

            Filesize

            11KB

            MD5

            c17103ae9072a06da581dec998343fc1

            SHA1

            b72148c6bdfaada8b8c3f950e610ee7cf1da1f8d

            SHA256

            dc58d8ad81cacb0c1ed72e33bff8f23ea40b5252b5bb55d393a0903e6819ae2f

            SHA512

            d32a71aaef18e993f28096d536e41c4d016850721b31171513ce28bbd805a54fd290b7c3e9d935f72e676a1acfb4f0dcc89d95040a0dd29f2b6975855c18986f

          • C:\Users\Admin\AppData\Local\Temp\nsa54E8.tmp\nsExec.dll

            Filesize

            6KB

            MD5

            acc2b699edfea5bf5aae45aba3a41e96

            SHA1

            d2accf4d494e43ceb2cff69abe4dd17147d29cc2

            SHA256

            168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e

            SHA512

            e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe

          • C:\Users\Admin\AppData\Local\Temp\nsa54E8.tmp\nsExec.dll

            Filesize

            6KB

            MD5

            acc2b699edfea5bf5aae45aba3a41e96

            SHA1

            d2accf4d494e43ceb2cff69abe4dd17147d29cc2

            SHA256

            168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e

            SHA512

            e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe

          • C:\Users\Admin\AppData\Local\Temp\nsa54E8.tmp\nsExec.dll

            Filesize

            6KB

            MD5

            acc2b699edfea5bf5aae45aba3a41e96

            SHA1

            d2accf4d494e43ceb2cff69abe4dd17147d29cc2

            SHA256

            168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e

            SHA512

            e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe

          • C:\Users\Admin\AppData\Local\Temp\nsa54E8.tmp\nsExec.dll

            Filesize

            6KB

            MD5

            acc2b699edfea5bf5aae45aba3a41e96

            SHA1

            d2accf4d494e43ceb2cff69abe4dd17147d29cc2

            SHA256

            168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e

            SHA512

            e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe

          • C:\Users\Admin\AppData\Local\Temp\nsa54E8.tmp\nsExec.dll

            Filesize

            6KB

            MD5

            acc2b699edfea5bf5aae45aba3a41e96

            SHA1

            d2accf4d494e43ceb2cff69abe4dd17147d29cc2

            SHA256

            168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e

            SHA512

            e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe

          • C:\Users\Admin\AppData\Local\Temp\nsa54E8.tmp\nsExec.dll

            Filesize

            6KB

            MD5

            acc2b699edfea5bf5aae45aba3a41e96

            SHA1

            d2accf4d494e43ceb2cff69abe4dd17147d29cc2

            SHA256

            168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e

            SHA512

            e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe

          • C:\Users\Admin\AppData\Local\Temp\nsa54E8.tmp\nsExec.dll

            Filesize

            6KB

            MD5

            acc2b699edfea5bf5aae45aba3a41e96

            SHA1

            d2accf4d494e43ceb2cff69abe4dd17147d29cc2

            SHA256

            168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e

            SHA512

            e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe

          • C:\Users\Admin\AppData\Local\Temp\nsa54E8.tmp\nsExec.dll

            Filesize

            6KB

            MD5

            acc2b699edfea5bf5aae45aba3a41e96

            SHA1

            d2accf4d494e43ceb2cff69abe4dd17147d29cc2

            SHA256

            168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e

            SHA512

            e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe

          • C:\Windows\SysWOW64\hfnapi.dll

            Filesize

            106KB

            MD5

            af6f8598f0a8801675a22af9058488a1

            SHA1

            75c2530bc77ab1f4d595b3840c598ad48d783aa4

            SHA256

            760fbd9017ed3ea43ab807aa88afde45ed437c2e8bb80b78641889982bcf37cb

            SHA512

            c0102c1141c9b657ab5c9b59708b38989b9b1c5daa9fd1255fd3e89a3c54bcc3bc477dd580d8cec5dfa00828dcfb8c3a85c9912df7742fccda2e513591510b56

          • C:\Windows\SysWOW64\hfnapi.dll

            Filesize

            106KB

            MD5

            af6f8598f0a8801675a22af9058488a1

            SHA1

            75c2530bc77ab1f4d595b3840c598ad48d783aa4

            SHA256

            760fbd9017ed3ea43ab807aa88afde45ed437c2e8bb80b78641889982bcf37cb

            SHA512

            c0102c1141c9b657ab5c9b59708b38989b9b1c5daa9fd1255fd3e89a3c54bcc3bc477dd580d8cec5dfa00828dcfb8c3a85c9912df7742fccda2e513591510b56

          • C:\Windows\SysWOW64\hfnapi.dll

            Filesize

            106KB

            MD5

            af6f8598f0a8801675a22af9058488a1

            SHA1

            75c2530bc77ab1f4d595b3840c598ad48d783aa4

            SHA256

            760fbd9017ed3ea43ab807aa88afde45ed437c2e8bb80b78641889982bcf37cb

            SHA512

            c0102c1141c9b657ab5c9b59708b38989b9b1c5daa9fd1255fd3e89a3c54bcc3bc477dd580d8cec5dfa00828dcfb8c3a85c9912df7742fccda2e513591510b56

          • C:\Windows\SysWOW64\hfnapi.dll

            Filesize

            106KB

            MD5

            af6f8598f0a8801675a22af9058488a1

            SHA1

            75c2530bc77ab1f4d595b3840c598ad48d783aa4

            SHA256

            760fbd9017ed3ea43ab807aa88afde45ed437c2e8bb80b78641889982bcf37cb

            SHA512

            c0102c1141c9b657ab5c9b59708b38989b9b1c5daa9fd1255fd3e89a3c54bcc3bc477dd580d8cec5dfa00828dcfb8c3a85c9912df7742fccda2e513591510b56

          • C:\Windows\SysWOW64\hfpapi.dll

            Filesize

            241KB

            MD5

            5d59277ec805f839354765a0c6bcdf0c

            SHA1

            ea6a296bf8897c1a6d0701511520374d182a7cd6

            SHA256

            5117c1b3993c8dc8878a14a9fb35fd86a1d8a07737333667123c1e58210997f7

            SHA512

            039aab15a3f6a0a293622153a3d32d5ead8f78e0015243d2553956ce5e0e12453cb96d83e5be8ca8885c569727a627529207c66ef88b64797357c04409a1084b

          • C:\Windows\SysWOW64\hfpapi.dll

            Filesize

            241KB

            MD5

            5d59277ec805f839354765a0c6bcdf0c

            SHA1

            ea6a296bf8897c1a6d0701511520374d182a7cd6

            SHA256

            5117c1b3993c8dc8878a14a9fb35fd86a1d8a07737333667123c1e58210997f7

            SHA512

            039aab15a3f6a0a293622153a3d32d5ead8f78e0015243d2553956ce5e0e12453cb96d83e5be8ca8885c569727a627529207c66ef88b64797357c04409a1084b

          • C:\Windows\SysWOW64\hfpapi.dll

            Filesize

            241KB

            MD5

            5d59277ec805f839354765a0c6bcdf0c

            SHA1

            ea6a296bf8897c1a6d0701511520374d182a7cd6

            SHA256

            5117c1b3993c8dc8878a14a9fb35fd86a1d8a07737333667123c1e58210997f7

            SHA512

            039aab15a3f6a0a293622153a3d32d5ead8f78e0015243d2553956ce5e0e12453cb96d83e5be8ca8885c569727a627529207c66ef88b64797357c04409a1084b

          • C:\Windows\SysWOW64\installd.exe

            Filesize

            108KB

            MD5

            fd5e90fb7bf929eab76bfe5139fb1dca

            SHA1

            e830b2951bccb99f29b66d5f3fa7a16240d7965e

            SHA256

            1c8d1fc2cbc8f9a000d6144ae49a5ac548568cdca6e64b9d616ebe93de03086b

            SHA512

            45cde56de66f3cb9b76ae1009b2da7d2fb0e4cfc088540157deeee3e2197c222637647b83666a4aa3cb0f3b4235dbd92183ba66038507c1f91bf76b0ba253359

          • C:\Windows\SysWOW64\installd.exe

            Filesize

            108KB

            MD5

            fd5e90fb7bf929eab76bfe5139fb1dca

            SHA1

            e830b2951bccb99f29b66d5f3fa7a16240d7965e

            SHA256

            1c8d1fc2cbc8f9a000d6144ae49a5ac548568cdca6e64b9d616ebe93de03086b

            SHA512

            45cde56de66f3cb9b76ae1009b2da7d2fb0e4cfc088540157deeee3e2197c222637647b83666a4aa3cb0f3b4235dbd92183ba66038507c1f91bf76b0ba253359

          • C:\Windows\SysWOW64\nethtsrv.exe

            Filesize

            176KB

            MD5

            cadf9c3487a7139daa5d8d8306bac2c5

            SHA1

            4024273f6952f8e87fdf6460657d48f9c726d580

            SHA256

            05ef576d846b4d35672ff1459e0e951a71d72bba9d1a083f8a0a6f5e1063acea

            SHA512

            6df2804761b0288ddd6b088734d2cd4061b877b3ca1fec7d480c509026a07f13f764fa795e3aa0d118ed8955931d3df91da2a5e28731ca1a260ba54e9eda483b

          • C:\Windows\SysWOW64\nethtsrv.exe

            Filesize

            176KB

            MD5

            cadf9c3487a7139daa5d8d8306bac2c5

            SHA1

            4024273f6952f8e87fdf6460657d48f9c726d580

            SHA256

            05ef576d846b4d35672ff1459e0e951a71d72bba9d1a083f8a0a6f5e1063acea

            SHA512

            6df2804761b0288ddd6b088734d2cd4061b877b3ca1fec7d480c509026a07f13f764fa795e3aa0d118ed8955931d3df91da2a5e28731ca1a260ba54e9eda483b

          • C:\Windows\SysWOW64\nethtsrv.exe

            Filesize

            176KB

            MD5

            cadf9c3487a7139daa5d8d8306bac2c5

            SHA1

            4024273f6952f8e87fdf6460657d48f9c726d580

            SHA256

            05ef576d846b4d35672ff1459e0e951a71d72bba9d1a083f8a0a6f5e1063acea

            SHA512

            6df2804761b0288ddd6b088734d2cd4061b877b3ca1fec7d480c509026a07f13f764fa795e3aa0d118ed8955931d3df91da2a5e28731ca1a260ba54e9eda483b

          • C:\Windows\SysWOW64\netupdsrv.exe

            Filesize

            158KB

            MD5

            28c7433a9eb7aeb24131329baf00c476

            SHA1

            762ad22d07374fca97f2f84df84d5ea51768c7f8

            SHA256

            91bd185b432e3a8cf007bcf8d10f5a2bf191a0c0d830ad3a3fef661c659ad92e

            SHA512

            d2ab39b4f43544c1523afda9c5a1e5c08f3f37c4353577196b489dea6482f5c834f0a410f7b5710ca01ef2f958a06fa8304f2ccff45cc0234cd0dc245a6aafb8

          • C:\Windows\SysWOW64\netupdsrv.exe

            Filesize

            158KB

            MD5

            28c7433a9eb7aeb24131329baf00c476

            SHA1

            762ad22d07374fca97f2f84df84d5ea51768c7f8

            SHA256

            91bd185b432e3a8cf007bcf8d10f5a2bf191a0c0d830ad3a3fef661c659ad92e

            SHA512

            d2ab39b4f43544c1523afda9c5a1e5c08f3f37c4353577196b489dea6482f5c834f0a410f7b5710ca01ef2f958a06fa8304f2ccff45cc0234cd0dc245a6aafb8

          • C:\Windows\SysWOW64\netupdsrv.exe

            Filesize

            158KB

            MD5

            28c7433a9eb7aeb24131329baf00c476

            SHA1

            762ad22d07374fca97f2f84df84d5ea51768c7f8

            SHA256

            91bd185b432e3a8cf007bcf8d10f5a2bf191a0c0d830ad3a3fef661c659ad92e

            SHA512

            d2ab39b4f43544c1523afda9c5a1e5c08f3f37c4353577196b489dea6482f5c834f0a410f7b5710ca01ef2f958a06fa8304f2ccff45cc0234cd0dc245a6aafb8

          • memory/224-136-0x0000000000000000-mapping.dmp

          • memory/444-142-0x0000000000000000-mapping.dmp

          • memory/540-167-0x0000000000000000-mapping.dmp

          • memory/544-143-0x0000000000000000-mapping.dmp

          • memory/1008-148-0x0000000000000000-mapping.dmp

          • memory/3660-132-0x0000000000360000-0x00000000007BE000-memory.dmp

            Filesize

            4.4MB

          • memory/3660-138-0x0000000000360000-0x00000000007BE000-memory.dmp

            Filesize

            4.4MB

          • memory/3660-169-0x0000000000360000-0x00000000007BE000-memory.dmp

            Filesize

            4.4MB

          • memory/4436-141-0x0000000000000000-mapping.dmp

          • memory/4480-166-0x0000000000000000-mapping.dmp

          • memory/4616-154-0x0000000000000000-mapping.dmp

          • memory/4716-160-0x0000000000000000-mapping.dmp

          • memory/4764-159-0x0000000000000000-mapping.dmp

          • memory/5100-137-0x0000000000000000-mapping.dmp