bb56cba8efcf7c14638eba897b66e70c95831ca717f925e50d7eea31e8304e88

Analysis

max time kernel
247s
max time network
337s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
23-11-2022 10:14

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

bb56cba8efcf7c14638eba897b66e70c95831ca717f925e50d7eea31e8304e88.exe
Size

599KB
MD5

454b2fa27736f04f46e62bcfe410ba35
SHA1

80c1a99a4e61e7ff833a0d239b5a3c439edd2c62
SHA256

bb56cba8efcf7c14638eba897b66e70c95831ca717f925e50d7eea31e8304e88
SHA512

2f8a7278e64d857d15232b881207b19178cb6ef99045ae17cb725fce832dd0cb64681e59325f25c2d8e76cb22d17f334abc3e8539e571d51813037ba678290a7
SSDEEP

12288:lIny5DYTWKcZhLRnvz/whuXQwAp95v6wQN8Pq+qqia49tl:RUTXcHtsoXFW0w+gq1Dl

Score

8^/10

discovery

Malware Config

Signatures

Drops file in Drivers directory 1 IoCs

Processes:

bb56cba8efcf7c14638eba897b66e70c95831ca717f925e50d7eea31e8304e88.exe

description ioc process

File created C:\Windows\system32\drivers\nethfdrv.sys bb56cba8efcf7c14638eba897b66e70c95831ca717f925e50d7eea31e8304e88.exe
Executes dropped EXE 3 IoCs

Processes:

installd.exenethtsrv.exenetupdsrv.exe

pid process

1780 installd.exe
1624 nethtsrv.exe
1860 netupdsrv.exe

description	ioc	process
File created	C:\Windows\system32\drivers\nethfdrv.sys	bb56cba8efcf7c14638eba897b66e70c95831ca717f925e50d7eea31e8304e88.exe

pid	process
1780	installd.exe
1624	nethtsrv.exe
1860	netupdsrv.exe

Loads dropped DLL 9 IoCs

Processes:

bb56cba8efcf7c14638eba897b66e70c95831ca717f925e50d7eea31e8304e88.exeinstalld.exenethtsrv.exe

pid	process
540	bb56cba8efcf7c14638eba897b66e70c95831ca717f925e50d7eea31e8304e88.exe
540	bb56cba8efcf7c14638eba897b66e70c95831ca717f925e50d7eea31e8304e88.exe
540	bb56cba8efcf7c14638eba897b66e70c95831ca717f925e50d7eea31e8304e88.exe
540	bb56cba8efcf7c14638eba897b66e70c95831ca717f925e50d7eea31e8304e88.exe
1780	installd.exe
540	bb56cba8efcf7c14638eba897b66e70c95831ca717f925e50d7eea31e8304e88.exe
1624	nethtsrv.exe
1624	nethtsrv.exe
540	bb56cba8efcf7c14638eba897b66e70c95831ca717f925e50d7eea31e8304e88.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in System32 directory 5 IoCs

Processes:

bb56cba8efcf7c14638eba897b66e70c95831ca717f925e50d7eea31e8304e88.exe

description	ioc	process
File created	C:\Windows\SysWOW64\installd.exe	bb56cba8efcf7c14638eba897b66e70c95831ca717f925e50d7eea31e8304e88.exe
File created	C:\Windows\SysWOW64\nethtsrv.exe	bb56cba8efcf7c14638eba897b66e70c95831ca717f925e50d7eea31e8304e88.exe
File created	C:\Windows\SysWOW64\netupdsrv.exe	bb56cba8efcf7c14638eba897b66e70c95831ca717f925e50d7eea31e8304e88.exe
File created	C:\Windows\SysWOW64\hfnapi.dll	bb56cba8efcf7c14638eba897b66e70c95831ca717f925e50d7eea31e8304e88.exe
File created	C:\Windows\SysWOW64\hfpapi.dll	bb56cba8efcf7c14638eba897b66e70c95831ca717f925e50d7eea31e8304e88.exe

Drops file in Program Files directory 3 IoCs

Processes:

bb56cba8efcf7c14638eba897b66e70c95831ca717f925e50d7eea31e8304e88.exe

description	ioc	process
File created	C:\Program Files (x86)\Common Files\Config\ver.xml	bb56cba8efcf7c14638eba897b66e70c95831ca717f925e50d7eea31e8304e88.exe
File created	C:\Program Files (x86)\Common Files\config\uninstinethnfd.exe	bb56cba8efcf7c14638eba897b66e70c95831ca717f925e50d7eea31e8304e88.exe
File created	C:\Program Files (x86)\Common Files\Config\data.xml	bb56cba8efcf7c14638eba897b66e70c95831ca717f925e50d7eea31e8304e88.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Runs net.exe
Suspicious behavior: LoadsDriver 1 IoCs

Processes:

pid process

464

pid	process
464

Suspicious use of WriteProcessMemory 34 IoCs

Processes:

bb56cba8efcf7c14638eba897b66e70c95831ca717f925e50d7eea31e8304e88.exenet.exenet.exe

description	pid	process	target process
PID 540 wrote to memory of 1116	540	bb56cba8efcf7c14638eba897b66e70c95831ca717f925e50d7eea31e8304e88.exe	net.exe
PID 540 wrote to memory of 1116	540	bb56cba8efcf7c14638eba897b66e70c95831ca717f925e50d7eea31e8304e88.exe	net.exe
PID 540 wrote to memory of 1116	540	bb56cba8efcf7c14638eba897b66e70c95831ca717f925e50d7eea31e8304e88.exe	net.exe
PID 540 wrote to memory of 1116	540	bb56cba8efcf7c14638eba897b66e70c95831ca717f925e50d7eea31e8304e88.exe	net.exe
PID 1116 wrote to memory of 1264	1116	net.exe	net1.exe
PID 1116 wrote to memory of 1264	1116	net.exe	net1.exe
PID 1116 wrote to memory of 1264	1116	net.exe	net1.exe
PID 1116 wrote to memory of 1264	1116	net.exe	net1.exe
PID 540 wrote to memory of 1528	540	bb56cba8efcf7c14638eba897b66e70c95831ca717f925e50d7eea31e8304e88.exe	net.exe
PID 540 wrote to memory of 1528	540	bb56cba8efcf7c14638eba897b66e70c95831ca717f925e50d7eea31e8304e88.exe	net.exe
PID 540 wrote to memory of 1528	540	bb56cba8efcf7c14638eba897b66e70c95831ca717f925e50d7eea31e8304e88.exe	net.exe
PID 540 wrote to memory of 1528	540	bb56cba8efcf7c14638eba897b66e70c95831ca717f925e50d7eea31e8304e88.exe	net.exe
PID 1528 wrote to memory of 640	1528	net.exe	net1.exe
PID 1528 wrote to memory of 640	1528	net.exe	net1.exe
PID 1528 wrote to memory of 640	1528	net.exe	net1.exe
PID 1528 wrote to memory of 640	1528	net.exe	net1.exe
PID 540 wrote to memory of 1780	540	bb56cba8efcf7c14638eba897b66e70c95831ca717f925e50d7eea31e8304e88.exe	installd.exe
PID 540 wrote to memory of 1780	540	bb56cba8efcf7c14638eba897b66e70c95831ca717f925e50d7eea31e8304e88.exe	installd.exe
PID 540 wrote to memory of 1780	540	bb56cba8efcf7c14638eba897b66e70c95831ca717f925e50d7eea31e8304e88.exe	installd.exe
PID 540 wrote to memory of 1780	540	bb56cba8efcf7c14638eba897b66e70c95831ca717f925e50d7eea31e8304e88.exe	installd.exe
PID 540 wrote to memory of 1780	540	bb56cba8efcf7c14638eba897b66e70c95831ca717f925e50d7eea31e8304e88.exe	installd.exe
PID 540 wrote to memory of 1780	540	bb56cba8efcf7c14638eba897b66e70c95831ca717f925e50d7eea31e8304e88.exe	installd.exe
PID 540 wrote to memory of 1780	540	bb56cba8efcf7c14638eba897b66e70c95831ca717f925e50d7eea31e8304e88.exe	installd.exe
PID 540 wrote to memory of 1624	540	bb56cba8efcf7c14638eba897b66e70c95831ca717f925e50d7eea31e8304e88.exe	nethtsrv.exe
PID 540 wrote to memory of 1624	540	bb56cba8efcf7c14638eba897b66e70c95831ca717f925e50d7eea31e8304e88.exe	nethtsrv.exe
PID 540 wrote to memory of 1624	540	bb56cba8efcf7c14638eba897b66e70c95831ca717f925e50d7eea31e8304e88.exe	nethtsrv.exe
PID 540 wrote to memory of 1624	540	bb56cba8efcf7c14638eba897b66e70c95831ca717f925e50d7eea31e8304e88.exe	nethtsrv.exe
PID 540 wrote to memory of 1860	540	bb56cba8efcf7c14638eba897b66e70c95831ca717f925e50d7eea31e8304e88.exe	netupdsrv.exe
PID 540 wrote to memory of 1860	540	bb56cba8efcf7c14638eba897b66e70c95831ca717f925e50d7eea31e8304e88.exe	netupdsrv.exe
PID 540 wrote to memory of 1860	540	bb56cba8efcf7c14638eba897b66e70c95831ca717f925e50d7eea31e8304e88.exe	netupdsrv.exe
PID 540 wrote to memory of 1860	540	bb56cba8efcf7c14638eba897b66e70c95831ca717f925e50d7eea31e8304e88.exe	netupdsrv.exe
PID 540 wrote to memory of 1860	540	bb56cba8efcf7c14638eba897b66e70c95831ca717f925e50d7eea31e8304e88.exe	netupdsrv.exe
PID 540 wrote to memory of 1860	540	bb56cba8efcf7c14638eba897b66e70c95831ca717f925e50d7eea31e8304e88.exe	netupdsrv.exe
PID 540 wrote to memory of 1860	540	bb56cba8efcf7c14638eba897b66e70c95831ca717f925e50d7eea31e8304e88.exe	netupdsrv.exe

C:\Users\Admin\AppData\Local\Temp\bb56cba8efcf7c14638eba897b66e70c95831ca717f925e50d7eea31e8304e88.exe
"C:\Users\Admin\AppData\Local\Temp\bb56cba8efcf7c14638eba897b66e70c95831ca717f925e50d7eea31e8304e88.exe"
1⤵
- Drops file in Drivers directory
- Loads dropped DLL
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:540

C:\Windows\SysWOW64\net.exe
net stop nethttpservice
2⤵
- Suspicious use of WriteProcessMemory
PID:1116

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop nethttpservice
3⤵
PID:1264

C:\Windows\SysWOW64\net.exe
net stop serviceupdater
2⤵
- Suspicious use of WriteProcessMemory
PID:1528

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop serviceupdater
3⤵
PID:640

C:\Windows\SysWOW64\installd.exe
"C:\Windows\system32\installd.exe" nethfdrv
2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1780

C:\Windows\SysWOW64\nethtsrv.exe
"C:\Windows\system32\nethtsrv.exe" -nfdi
2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1624

C:\Windows\SysWOW64\netupdsrv.exe
"C:\Windows\system32\netupdsrv.exe" -nfdi
2⤵
- Executes dropped EXE
PID:1860

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\hfnapi.dll

Filesize
106KB

MD5
b0bbfb975aa5c959c0f519f2af59edce

SHA1
2bf7fcead4d0e41ef45a74f95f85afc6decd2217

SHA256
540f2f7d76597cb0213860a4ab967b385621122842c71caceacc21c040b41af2

SHA512
f4dd7d746bcd4990793f26131ec5403aa51d9c9d1e4f66546095371e6dce0e5510b8064cb552f3cc5cb5121c827d93165ac7fce119e24e7446ece88660156004

Download Submit
C:\Windows\SysWOW64\hfpapi.dll

Filesize
241KB

MD5
4d7f375d9e60e581263b76532f155d76

SHA1
4f4d68d2dcc3b8d29a3e8d594ecdb1c617d2f909

SHA256
9249263792a3f7edd3f39355099c00fe110e856ebda4aa522a5267d79ee12e68

SHA512
69844102221ac3283fc8cba8e11d28c011b070eba77ceaa783688538ddef0899efef4415ac08b008a2a435244783d898fc9c0293b51522b4033387b19450c9de

Download Submit
C:\Windows\SysWOW64\installd.exe

Filesize
108KB

MD5
174f18565fa3ad99438c40680d186fc7

SHA1
38d252068c7344e52f7a3d287cee917aa67dbe5d

SHA256
c5f607ae9f8d4e842e99cd866b509f28bd08a6031363ab9abd0bf9f2ee161e43

SHA512
47c701e7c6ee780798229d55a8d61ff840030030b213d8e06a965cf02f9741977f7b8a87d20ebcb6f8b2fe399379095b01c0a119ca2ce5a9d2a735af83f551a7

Download Submit
C:\Windows\SysWOW64\nethtsrv.exe

Filesize
176KB

MD5
1f14e47466b931d0fb95b2976d72bf2e

SHA1
edb1a6ea50568af12ca911c4bc7023bf5c0ea1ef

SHA256
73be277848a8598fde06e4d57d478493a6a73e2e2d44b538b28e1f2e97b1f01b

SHA512
3f38fea649e3cecb5e73012f9dd060787d4e9c0f30d6b5a4c2483e04bf2f60e883c083a5098982e47e45836b7465a5fe52aa30bfdce70c8bbf9b5709a7a7cf32

Download Submit
C:\Windows\SysWOW64\netupdsrv.exe

Filesize
159KB

MD5
910dd0087c260d495db7981dbcafb0c3

SHA1
dfe8cb986d43951ac49dcc9c8a45442c1cbf2406

SHA256
263bda8e854a9bb52d38db4a798d2a3cb98da4894f6b02563b13b2eb7101a696

SHA512
e5a456872708c35da66cb94b96ce744ea3ce6f3fcd2fdac4902c7e42d82af25189d74cf9f2f1c4b15fab9f5ebdf9d89c39d29b238686a1d3764e66b02fdf2480

Download Submit
\Users\Admin\AppData\Local\Temp\nszF7D9.tmp\System.dll

Filesize
11KB

MD5
c17103ae9072a06da581dec998343fc1

SHA1
b72148c6bdfaada8b8c3f950e610ee7cf1da1f8d

SHA256
dc58d8ad81cacb0c1ed72e33bff8f23ea40b5252b5bb55d393a0903e6819ae2f

SHA512
d32a71aaef18e993f28096d536e41c4d016850721b31171513ce28bbd805a54fd290b7c3e9d935f72e676a1acfb4f0dcc89d95040a0dd29f2b6975855c18986f

Download Submit
\Users\Admin\AppData\Local\Temp\nszF7D9.tmp\nsExec.dll

Filesize
6KB

MD5
acc2b699edfea5bf5aae45aba3a41e96

SHA1
d2accf4d494e43ceb2cff69abe4dd17147d29cc2

SHA256
168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e

SHA512
e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe

Download Submit
\Users\Admin\AppData\Local\Temp\nszF7D9.tmp\nsExec.dll

Filesize
6KB

MD5
acc2b699edfea5bf5aae45aba3a41e96

SHA1
d2accf4d494e43ceb2cff69abe4dd17147d29cc2

SHA256
168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e

SHA512
e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe

Download Submit
\Windows\SysWOW64\hfnapi.dll

Filesize
106KB

MD5
b0bbfb975aa5c959c0f519f2af59edce

SHA1
2bf7fcead4d0e41ef45a74f95f85afc6decd2217

SHA256
540f2f7d76597cb0213860a4ab967b385621122842c71caceacc21c040b41af2

SHA512
f4dd7d746bcd4990793f26131ec5403aa51d9c9d1e4f66546095371e6dce0e5510b8064cb552f3cc5cb5121c827d93165ac7fce119e24e7446ece88660156004

Download Submit
\Windows\SysWOW64\hfnapi.dll

Filesize
106KB

MD5
b0bbfb975aa5c959c0f519f2af59edce

SHA1
2bf7fcead4d0e41ef45a74f95f85afc6decd2217

SHA256
540f2f7d76597cb0213860a4ab967b385621122842c71caceacc21c040b41af2

SHA512
f4dd7d746bcd4990793f26131ec5403aa51d9c9d1e4f66546095371e6dce0e5510b8064cb552f3cc5cb5121c827d93165ac7fce119e24e7446ece88660156004

Download Submit
\Windows\SysWOW64\hfpapi.dll

Filesize
241KB

MD5
4d7f375d9e60e581263b76532f155d76

SHA1
4f4d68d2dcc3b8d29a3e8d594ecdb1c617d2f909

SHA256
9249263792a3f7edd3f39355099c00fe110e856ebda4aa522a5267d79ee12e68

SHA512
69844102221ac3283fc8cba8e11d28c011b070eba77ceaa783688538ddef0899efef4415ac08b008a2a435244783d898fc9c0293b51522b4033387b19450c9de

Download Submit
\Windows\SysWOW64\installd.exe

Filesize
108KB

MD5
174f18565fa3ad99438c40680d186fc7

SHA1
38d252068c7344e52f7a3d287cee917aa67dbe5d

SHA256
c5f607ae9f8d4e842e99cd866b509f28bd08a6031363ab9abd0bf9f2ee161e43

SHA512
47c701e7c6ee780798229d55a8d61ff840030030b213d8e06a965cf02f9741977f7b8a87d20ebcb6f8b2fe399379095b01c0a119ca2ce5a9d2a735af83f551a7

Download Submit
\Windows\SysWOW64\nethtsrv.exe

Filesize
176KB

MD5
1f14e47466b931d0fb95b2976d72bf2e

SHA1
edb1a6ea50568af12ca911c4bc7023bf5c0ea1ef

SHA256
73be277848a8598fde06e4d57d478493a6a73e2e2d44b538b28e1f2e97b1f01b

SHA512
3f38fea649e3cecb5e73012f9dd060787d4e9c0f30d6b5a4c2483e04bf2f60e883c083a5098982e47e45836b7465a5fe52aa30bfdce70c8bbf9b5709a7a7cf32

Download Submit
\Windows\SysWOW64\netupdsrv.exe

Filesize
159KB

MD5
910dd0087c260d495db7981dbcafb0c3

SHA1
dfe8cb986d43951ac49dcc9c8a45442c1cbf2406

SHA256
263bda8e854a9bb52d38db4a798d2a3cb98da4894f6b02563b13b2eb7101a696

SHA512
e5a456872708c35da66cb94b96ce744ea3ce6f3fcd2fdac4902c7e42d82af25189d74cf9f2f1c4b15fab9f5ebdf9d89c39d29b238686a1d3764e66b02fdf2480

Download Submit
memory/540-54-0x0000000075551000-0x0000000075553000-memory.dmp

Filesize
8KB

Download
memory/540-69-0x0000000000360000-0x00000000007BE000-memory.dmp

Filesize
4.4MB

Download
memory/540-56-0x0000000000360000-0x00000000007BE000-memory.dmp

Filesize
4.4MB

Download
memory/640-62-0x0000000000000000-mapping.dmp

Download
memory/1116-58-0x0000000000000000-mapping.dmp

Download
memory/1264-59-0x0000000000000000-mapping.dmp

Download
memory/1528-61-0x0000000000000000-mapping.dmp

Download
memory/1624-71-0x0000000000000000-mapping.dmp

Download
memory/1780-64-0x0000000000000000-mapping.dmp

Download
memory/1860-77-0x0000000000000000-mapping.dmp

Download