Analysis

  • max time kernel
    238s
  • max time network
    332s
  • platform
    windows7_x64
  • resource
    win7-20221111-en
  • resource tags

    arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
  • submitted
    23-11-2022 10:14

General

  • Target

    bc0f098bbb6b9fddd5d4bf1b9418eb6b0c7d9bd9a7f9cf7a7e8198985f4203d5.exe

  • Size

    602KB

  • MD5

    42c8e1f4ce8da6d3cf188a94325a1539

  • SHA1

    4d09d6b82137e0f340d95c6b2d8f13368e8a4dc1

  • SHA256

    bc0f098bbb6b9fddd5d4bf1b9418eb6b0c7d9bd9a7f9cf7a7e8198985f4203d5

  • SHA512

    99fde8c4c38befde16eab4d115d7fe745a7c3ef1aaa9612bbfdad8aaba58207abdf4edfd7ab9545e55723687d0f787b1f4f76c950e53e16e642268e4eead05fd

  • SSDEEP

    12288:9Iny5DYTjSfz1vMQ+yyWfwa/OwqRue2zR8rkQojE0Nmf21:pUTjahvMQzyFIOHcykQojE0Nms

Score
8/10

Malware Config

Signatures

  • Drops file in Drivers directory 1 IoCs
  • Executes dropped EXE 3 IoCs
  • Loads dropped DLL 9 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Drops file in System32 directory 5 IoCs
  • Drops file in Program Files directory 3 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Runs net.exe
  • Suspicious behavior: LoadsDriver 1 IoCs
  • Suspicious use of WriteProcessMemory 34 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\bc0f098bbb6b9fddd5d4bf1b9418eb6b0c7d9bd9a7f9cf7a7e8198985f4203d5.exe
    "C:\Users\Admin\AppData\Local\Temp\bc0f098bbb6b9fddd5d4bf1b9418eb6b0c7d9bd9a7f9cf7a7e8198985f4203d5.exe"
    1⤵
    • Drops file in Drivers directory
    • Loads dropped DLL
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • Suspicious use of WriteProcessMemory
    PID:476
    • C:\Windows\SysWOW64\net.exe
      net stop nethttpservice
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:1940
      • C:\Windows\SysWOW64\net1.exe
        C:\Windows\system32\net1 stop nethttpservice
        3⤵
          PID:1812
      • C:\Windows\SysWOW64\net.exe
        net stop serviceupdater
        2⤵
        • Suspicious use of WriteProcessMemory
        PID:1684
        • C:\Windows\SysWOW64\net1.exe
          C:\Windows\system32\net1 stop serviceupdater
          3⤵
            PID:1360
        • C:\Windows\SysWOW64\installd.exe
          "C:\Windows\system32\installd.exe" nethfdrv
          2⤵
          • Executes dropped EXE
          • Loads dropped DLL
          PID:1536
        • C:\Windows\SysWOW64\nethtsrv.exe
          "C:\Windows\system32\nethtsrv.exe" -nfdi
          2⤵
          • Executes dropped EXE
          • Loads dropped DLL
          PID:1004
        • C:\Windows\SysWOW64\netupdsrv.exe
          "C:\Windows\system32\netupdsrv.exe" -nfdi
          2⤵
          • Executes dropped EXE
          PID:292

      Network

      MITRE ATT&CK Enterprise v6

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Windows\SysWOW64\hfnapi.dll

        Filesize

        106KB

        MD5

        6b3fa4f45f4de0332ed223b25e6cd664

        SHA1

        20b5c4a3a8a7e84c0b1a72186dec0fb19350fc6c

        SHA256

        558d750a157252b09cd6b82b90872f55dbb0ae6393e2bfddd305eaf65bca345e

        SHA512

        94341704f995528cbc73b0126792f55189e4bdf6557f84d2823ba3184c5c2e73fa52706cb4607514bc03b66ec09c3283cf6570a2c050034d602e939efca3b422

      • C:\Windows\SysWOW64\hfpapi.dll

        Filesize

        241KB

        MD5

        ebcab4f0bde1bf62a9a33822fe2e84d9

        SHA1

        88c06f8a042c2fd7255ccce18311857968e1b212

        SHA256

        cdfc2be27c175f462e38d9c18734b7997506283f011cb27407b408de01c27185

        SHA512

        4caca0885e5ee0ae6c8fd3fc3fff77a30216d7c9de4e34b3aa466bca07b0114e8d6e4dce0fc9094c522e7c247280146c3d099de1fb88d23f10d72be25572edc0

      • C:\Windows\SysWOW64\installd.exe

        Filesize

        108KB

        MD5

        161df777bbbfa678fee58843e667e123

        SHA1

        aab10730deec4fc1befec3aabc6d90087defa6bf

        SHA256

        8ff4b7007758e2fbae172f886dd2e63c5ca094c9091339c93a9902dc15cff0cd

        SHA512

        ab2e69dcc8501005519b163abf8db32541d971d533a4ecacee4c0a0f8fe39ce393103fcdb90775d797ff024b9ec11ea3fab9829afb477c797b41dfd05ad73fd8

      • C:\Windows\SysWOW64\nethtsrv.exe

        Filesize

        176KB

        MD5

        f2c310afbe756b18d28ae6035ad838a5

        SHA1

        029add8bc2e5dab26794b7c49e8ac27173578bec

        SHA256

        01bffbdb50260c5df99319c0eaf17f680cdcc74dabeb43b340714f31cc6776be

        SHA512

        0c6fc8902fa8bffea9b0c9193ec4050aa43c8ce7191108f12200a6f2ce436dc90ac6d2eb461f18d4818b31bf3f7086a724f16423b4147b8bfecb78de00567034

      • C:\Windows\SysWOW64\netupdsrv.exe

        Filesize

        158KB

        MD5

        6ac78dc6287fb861f40843f68beff73a

        SHA1

        98b578c9b13b0a101e38c9203caf1535f250529f

        SHA256

        3e4304cb4cd93971e4dd3709aedda29b970783a83ba07f85c14bd7ff03724f01

        SHA512

        1925f94cfed55ff6fe3dcef9aea8076511af88a4b9f00bfccffbb2219e250e855b009b994e6c39a1d447c3e7cedd786cdaeeb32ee50e432f6bb633ae62cd8fa8

      • \Users\Admin\AppData\Local\Temp\nsuE4D6.tmp\System.dll

        Filesize

        11KB

        MD5

        c17103ae9072a06da581dec998343fc1

        SHA1

        b72148c6bdfaada8b8c3f950e610ee7cf1da1f8d

        SHA256

        dc58d8ad81cacb0c1ed72e33bff8f23ea40b5252b5bb55d393a0903e6819ae2f

        SHA512

        d32a71aaef18e993f28096d536e41c4d016850721b31171513ce28bbd805a54fd290b7c3e9d935f72e676a1acfb4f0dcc89d95040a0dd29f2b6975855c18986f

      • \Users\Admin\AppData\Local\Temp\nsuE4D6.tmp\nsExec.dll

        Filesize

        6KB

        MD5

        acc2b699edfea5bf5aae45aba3a41e96

        SHA1

        d2accf4d494e43ceb2cff69abe4dd17147d29cc2

        SHA256

        168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e

        SHA512

        e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe

      • \Users\Admin\AppData\Local\Temp\nsuE4D6.tmp\nsExec.dll

        Filesize

        6KB

        MD5

        acc2b699edfea5bf5aae45aba3a41e96

        SHA1

        d2accf4d494e43ceb2cff69abe4dd17147d29cc2

        SHA256

        168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e

        SHA512

        e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe

      • \Windows\SysWOW64\hfnapi.dll

        Filesize

        106KB

        MD5

        6b3fa4f45f4de0332ed223b25e6cd664

        SHA1

        20b5c4a3a8a7e84c0b1a72186dec0fb19350fc6c

        SHA256

        558d750a157252b09cd6b82b90872f55dbb0ae6393e2bfddd305eaf65bca345e

        SHA512

        94341704f995528cbc73b0126792f55189e4bdf6557f84d2823ba3184c5c2e73fa52706cb4607514bc03b66ec09c3283cf6570a2c050034d602e939efca3b422

      • \Windows\SysWOW64\hfnapi.dll

        Filesize

        106KB

        MD5

        6b3fa4f45f4de0332ed223b25e6cd664

        SHA1

        20b5c4a3a8a7e84c0b1a72186dec0fb19350fc6c

        SHA256

        558d750a157252b09cd6b82b90872f55dbb0ae6393e2bfddd305eaf65bca345e

        SHA512

        94341704f995528cbc73b0126792f55189e4bdf6557f84d2823ba3184c5c2e73fa52706cb4607514bc03b66ec09c3283cf6570a2c050034d602e939efca3b422

      • \Windows\SysWOW64\hfpapi.dll

        Filesize

        241KB

        MD5

        ebcab4f0bde1bf62a9a33822fe2e84d9

        SHA1

        88c06f8a042c2fd7255ccce18311857968e1b212

        SHA256

        cdfc2be27c175f462e38d9c18734b7997506283f011cb27407b408de01c27185

        SHA512

        4caca0885e5ee0ae6c8fd3fc3fff77a30216d7c9de4e34b3aa466bca07b0114e8d6e4dce0fc9094c522e7c247280146c3d099de1fb88d23f10d72be25572edc0

      • \Windows\SysWOW64\installd.exe

        Filesize

        108KB

        MD5

        161df777bbbfa678fee58843e667e123

        SHA1

        aab10730deec4fc1befec3aabc6d90087defa6bf

        SHA256

        8ff4b7007758e2fbae172f886dd2e63c5ca094c9091339c93a9902dc15cff0cd

        SHA512

        ab2e69dcc8501005519b163abf8db32541d971d533a4ecacee4c0a0f8fe39ce393103fcdb90775d797ff024b9ec11ea3fab9829afb477c797b41dfd05ad73fd8

      • \Windows\SysWOW64\nethtsrv.exe

        Filesize

        176KB

        MD5

        f2c310afbe756b18d28ae6035ad838a5

        SHA1

        029add8bc2e5dab26794b7c49e8ac27173578bec

        SHA256

        01bffbdb50260c5df99319c0eaf17f680cdcc74dabeb43b340714f31cc6776be

        SHA512

        0c6fc8902fa8bffea9b0c9193ec4050aa43c8ce7191108f12200a6f2ce436dc90ac6d2eb461f18d4818b31bf3f7086a724f16423b4147b8bfecb78de00567034

      • \Windows\SysWOW64\netupdsrv.exe

        Filesize

        158KB

        MD5

        6ac78dc6287fb861f40843f68beff73a

        SHA1

        98b578c9b13b0a101e38c9203caf1535f250529f

        SHA256

        3e4304cb4cd93971e4dd3709aedda29b970783a83ba07f85c14bd7ff03724f01

        SHA512

        1925f94cfed55ff6fe3dcef9aea8076511af88a4b9f00bfccffbb2219e250e855b009b994e6c39a1d447c3e7cedd786cdaeeb32ee50e432f6bb633ae62cd8fa8

      • memory/292-77-0x0000000000000000-mapping.dmp

      • memory/476-59-0x0000000000360000-0x00000000007BE000-memory.dmp

        Filesize

        4.4MB

      • memory/476-54-0x0000000076931000-0x0000000076933000-memory.dmp

        Filesize

        8KB

      • memory/476-55-0x0000000000360000-0x00000000007BE000-memory.dmp

        Filesize

        4.4MB

      • memory/1004-71-0x0000000000000000-mapping.dmp

      • memory/1360-63-0x0000000000000000-mapping.dmp

      • memory/1536-65-0x0000000000000000-mapping.dmp

      • memory/1684-62-0x0000000000000000-mapping.dmp

      • memory/1812-60-0x0000000000000000-mapping.dmp

      • memory/1940-58-0x0000000000000000-mapping.dmp