b7d3446b70b96fae8af9bc9361d7dfa1a8f74a1c97c543490c0582acb39c19d0

Analysis

max time kernel
332s
max time network
408s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
23-11-2022 10:14

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b7d3446b70b96fae8af9bc9361d7dfa1a8f74a1c97c543490c0582acb39c19d0.exe
Size

602KB
MD5

51f84579131b8e4ad908d2877a307f4c
SHA1

a0d1d7fbc9a898cf8707c07b7872a0f8a8219d36
SHA256

b7d3446b70b96fae8af9bc9361d7dfa1a8f74a1c97c543490c0582acb39c19d0
SHA512

1549af799b4f459ccab5f87d6e26f0b3b08494f40dbb48c0e60def7d4bcc501a36a143c5b3b4b3d9b0117ffab554212b372e7110b28feab21ef1ac43744b9eef
SSDEEP

12288:nIny5DYTkIWaHuaz3dMynYJ3x8hSE9KXzm6cfeNXYSoQNPAz+:vUTkNaH5NMvzAuzmZvz+

Score

8^/10

discovery

Malware Config

Signatures

Drops file in Drivers directory 1 IoCs

Processes:

b7d3446b70b96fae8af9bc9361d7dfa1a8f74a1c97c543490c0582acb39c19d0.exe

description ioc process

File created C:\Windows\system32\drivers\nethfdrv.sys b7d3446b70b96fae8af9bc9361d7dfa1a8f74a1c97c543490c0582acb39c19d0.exe
Executes dropped EXE 3 IoCs

Processes:

installd.exenethtsrv.exenetupdsrv.exe

pid process

5040 installd.exe
1436 nethtsrv.exe
1804 netupdsrv.exe

description	ioc	process
File created	C:\Windows\system32\drivers\nethfdrv.sys	b7d3446b70b96fae8af9bc9361d7dfa1a8f74a1c97c543490c0582acb39c19d0.exe

pid	process
5040	installd.exe
1436	nethtsrv.exe
1804	netupdsrv.exe

Loads dropped DLL 10 IoCs

Processes:

b7d3446b70b96fae8af9bc9361d7dfa1a8f74a1c97c543490c0582acb39c19d0.exeinstalld.exenethtsrv.exe

pid	process
5036	b7d3446b70b96fae8af9bc9361d7dfa1a8f74a1c97c543490c0582acb39c19d0.exe
5036	b7d3446b70b96fae8af9bc9361d7dfa1a8f74a1c97c543490c0582acb39c19d0.exe
5036	b7d3446b70b96fae8af9bc9361d7dfa1a8f74a1c97c543490c0582acb39c19d0.exe
5036	b7d3446b70b96fae8af9bc9361d7dfa1a8f74a1c97c543490c0582acb39c19d0.exe
5036	b7d3446b70b96fae8af9bc9361d7dfa1a8f74a1c97c543490c0582acb39c19d0.exe
5040	installd.exe
1436	nethtsrv.exe
1436	nethtsrv.exe
5036	b7d3446b70b96fae8af9bc9361d7dfa1a8f74a1c97c543490c0582acb39c19d0.exe
5036	b7d3446b70b96fae8af9bc9361d7dfa1a8f74a1c97c543490c0582acb39c19d0.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in System32 directory 5 IoCs

Processes:

b7d3446b70b96fae8af9bc9361d7dfa1a8f74a1c97c543490c0582acb39c19d0.exe

description	ioc	process
File created	C:\Windows\SysWOW64\netupdsrv.exe	b7d3446b70b96fae8af9bc9361d7dfa1a8f74a1c97c543490c0582acb39c19d0.exe
File created	C:\Windows\SysWOW64\hfnapi.dll	b7d3446b70b96fae8af9bc9361d7dfa1a8f74a1c97c543490c0582acb39c19d0.exe
File created	C:\Windows\SysWOW64\hfpapi.dll	b7d3446b70b96fae8af9bc9361d7dfa1a8f74a1c97c543490c0582acb39c19d0.exe
File created	C:\Windows\SysWOW64\installd.exe	b7d3446b70b96fae8af9bc9361d7dfa1a8f74a1c97c543490c0582acb39c19d0.exe
File created	C:\Windows\SysWOW64\nethtsrv.exe	b7d3446b70b96fae8af9bc9361d7dfa1a8f74a1c97c543490c0582acb39c19d0.exe

Drops file in Program Files directory 3 IoCs

Processes:

b7d3446b70b96fae8af9bc9361d7dfa1a8f74a1c97c543490c0582acb39c19d0.exe

description	ioc	process
File created	C:\Program Files (x86)\Common Files\Config\data.xml	b7d3446b70b96fae8af9bc9361d7dfa1a8f74a1c97c543490c0582acb39c19d0.exe
File created	C:\Program Files (x86)\Common Files\Config\ver.xml	b7d3446b70b96fae8af9bc9361d7dfa1a8f74a1c97c543490c0582acb39c19d0.exe
File created	C:\Program Files (x86)\Common Files\config\uninstinethnfd.exe	b7d3446b70b96fae8af9bc9361d7dfa1a8f74a1c97c543490c0582acb39c19d0.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Runs net.exe
Suspicious behavior: LoadsDriver 1 IoCs

Processes:

pid process

656

pid	process
656

Suspicious use of WriteProcessMemory 21 IoCs

Processes:

b7d3446b70b96fae8af9bc9361d7dfa1a8f74a1c97c543490c0582acb39c19d0.exenet.exenet.exe

description	pid	process	target process
PID 5036 wrote to memory of 4900	5036	b7d3446b70b96fae8af9bc9361d7dfa1a8f74a1c97c543490c0582acb39c19d0.exe	net.exe
PID 5036 wrote to memory of 4900	5036	b7d3446b70b96fae8af9bc9361d7dfa1a8f74a1c97c543490c0582acb39c19d0.exe	net.exe
PID 5036 wrote to memory of 4900	5036	b7d3446b70b96fae8af9bc9361d7dfa1a8f74a1c97c543490c0582acb39c19d0.exe	net.exe
PID 4900 wrote to memory of 4596	4900	net.exe	net1.exe
PID 4900 wrote to memory of 4596	4900	net.exe	net1.exe
PID 4900 wrote to memory of 4596	4900	net.exe	net1.exe
PID 5036 wrote to memory of 1268	5036	b7d3446b70b96fae8af9bc9361d7dfa1a8f74a1c97c543490c0582acb39c19d0.exe	net.exe
PID 5036 wrote to memory of 1268	5036	b7d3446b70b96fae8af9bc9361d7dfa1a8f74a1c97c543490c0582acb39c19d0.exe	net.exe
PID 5036 wrote to memory of 1268	5036	b7d3446b70b96fae8af9bc9361d7dfa1a8f74a1c97c543490c0582acb39c19d0.exe	net.exe
PID 1268 wrote to memory of 3448	1268	net.exe	net1.exe
PID 1268 wrote to memory of 3448	1268	net.exe	net1.exe
PID 1268 wrote to memory of 3448	1268	net.exe	net1.exe
PID 5036 wrote to memory of 5040	5036	b7d3446b70b96fae8af9bc9361d7dfa1a8f74a1c97c543490c0582acb39c19d0.exe	installd.exe
PID 5036 wrote to memory of 5040	5036	b7d3446b70b96fae8af9bc9361d7dfa1a8f74a1c97c543490c0582acb39c19d0.exe	installd.exe
PID 5036 wrote to memory of 5040	5036	b7d3446b70b96fae8af9bc9361d7dfa1a8f74a1c97c543490c0582acb39c19d0.exe	installd.exe
PID 5036 wrote to memory of 1436	5036	b7d3446b70b96fae8af9bc9361d7dfa1a8f74a1c97c543490c0582acb39c19d0.exe	nethtsrv.exe
PID 5036 wrote to memory of 1436	5036	b7d3446b70b96fae8af9bc9361d7dfa1a8f74a1c97c543490c0582acb39c19d0.exe	nethtsrv.exe
PID 5036 wrote to memory of 1436	5036	b7d3446b70b96fae8af9bc9361d7dfa1a8f74a1c97c543490c0582acb39c19d0.exe	nethtsrv.exe
PID 5036 wrote to memory of 1804	5036	b7d3446b70b96fae8af9bc9361d7dfa1a8f74a1c97c543490c0582acb39c19d0.exe	netupdsrv.exe
PID 5036 wrote to memory of 1804	5036	b7d3446b70b96fae8af9bc9361d7dfa1a8f74a1c97c543490c0582acb39c19d0.exe	netupdsrv.exe
PID 5036 wrote to memory of 1804	5036	b7d3446b70b96fae8af9bc9361d7dfa1a8f74a1c97c543490c0582acb39c19d0.exe	netupdsrv.exe

C:\Users\Admin\AppData\Local\Temp\b7d3446b70b96fae8af9bc9361d7dfa1a8f74a1c97c543490c0582acb39c19d0.exe
"C:\Users\Admin\AppData\Local\Temp\b7d3446b70b96fae8af9bc9361d7dfa1a8f74a1c97c543490c0582acb39c19d0.exe"
1⤵
- Drops file in Drivers directory
- Loads dropped DLL
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:5036

C:\Windows\SysWOW64\net.exe
net stop nethttpservice
2⤵
- Suspicious use of WriteProcessMemory
PID:4900

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop nethttpservice
3⤵
PID:4596

C:\Windows\SysWOW64\net.exe
net stop serviceupdater
2⤵
- Suspicious use of WriteProcessMemory
PID:1268

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop serviceupdater
3⤵
PID:3448

C:\Windows\SysWOW64\installd.exe
"C:\Windows\system32\installd.exe" nethfdrv
2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:5040

C:\Windows\SysWOW64\nethtsrv.exe
"C:\Windows\system32\nethtsrv.exe" -nfdi
2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1436

C:\Windows\SysWOW64\netupdsrv.exe
"C:\Windows\system32\netupdsrv.exe" -nfdi
2⤵
- Executes dropped EXE
PID:1804

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\nslE85.tmp\System.dll

Filesize
11KB

MD5
c17103ae9072a06da581dec998343fc1

SHA1
b72148c6bdfaada8b8c3f950e610ee7cf1da1f8d

SHA256
dc58d8ad81cacb0c1ed72e33bff8f23ea40b5252b5bb55d393a0903e6819ae2f

SHA512
d32a71aaef18e993f28096d536e41c4d016850721b31171513ce28bbd805a54fd290b7c3e9d935f72e676a1acfb4f0dcc89d95040a0dd29f2b6975855c18986f

Download Submit
C:\Users\Admin\AppData\Local\Temp\nslE85.tmp\nsExec.dll

Filesize
6KB

MD5
acc2b699edfea5bf5aae45aba3a41e96

SHA1
d2accf4d494e43ceb2cff69abe4dd17147d29cc2

SHA256
168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e

SHA512
e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe

Download Submit
C:\Users\Admin\AppData\Local\Temp\nslE85.tmp\nsExec.dll

Filesize
6KB

MD5
acc2b699edfea5bf5aae45aba3a41e96

SHA1
d2accf4d494e43ceb2cff69abe4dd17147d29cc2

SHA256
168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e

SHA512
e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe

Download Submit
C:\Users\Admin\AppData\Local\Temp\nslE85.tmp\nsExec.dll

Filesize
6KB

MD5
acc2b699edfea5bf5aae45aba3a41e96

SHA1
d2accf4d494e43ceb2cff69abe4dd17147d29cc2

SHA256
168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e

SHA512
e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe

Download Submit
C:\Users\Admin\AppData\Local\Temp\nslE85.tmp\nsExec.dll

Filesize
6KB

MD5
acc2b699edfea5bf5aae45aba3a41e96

SHA1
d2accf4d494e43ceb2cff69abe4dd17147d29cc2

SHA256
168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e

SHA512
e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe

Download Submit
C:\Users\Admin\AppData\Local\Temp\nslE85.tmp\nsExec.dll

Filesize
6KB

MD5
acc2b699edfea5bf5aae45aba3a41e96

SHA1
d2accf4d494e43ceb2cff69abe4dd17147d29cc2

SHA256
168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e

SHA512
e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe

Download Submit
C:\Users\Admin\AppData\Local\Temp\nslE85.tmp\nsExec.dll

Filesize
6KB

MD5
acc2b699edfea5bf5aae45aba3a41e96

SHA1
d2accf4d494e43ceb2cff69abe4dd17147d29cc2

SHA256
168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e

SHA512
e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe

Download Submit
C:\Windows\SysWOW64\hfnapi.dll

Filesize
106KB

MD5
1d007a647663733dffd2ef2a0cb6af06

SHA1
8bfc23908dfeb95b3050f745ab86138712eda795

SHA256
9c520e7443b1ae6021032364d8cedda221fb3fc31dfd8ad2a31d5badd8994e4f

SHA512
3289196baa7bef33668b13b2e6987cf5db115cb322a651beab86b2a1167f8e337fcc732a05e0da08a97af4b582ea980655ea4093d1bf9313760154e85190596a

Download Submit
C:\Windows\SysWOW64\hfnapi.dll

Filesize
106KB

MD5
1d007a647663733dffd2ef2a0cb6af06

SHA1
8bfc23908dfeb95b3050f745ab86138712eda795

SHA256
9c520e7443b1ae6021032364d8cedda221fb3fc31dfd8ad2a31d5badd8994e4f

SHA512
3289196baa7bef33668b13b2e6987cf5db115cb322a651beab86b2a1167f8e337fcc732a05e0da08a97af4b582ea980655ea4093d1bf9313760154e85190596a

Download Submit
C:\Windows\SysWOW64\hfnapi.dll

Filesize
106KB

MD5
1d007a647663733dffd2ef2a0cb6af06

SHA1
8bfc23908dfeb95b3050f745ab86138712eda795

SHA256
9c520e7443b1ae6021032364d8cedda221fb3fc31dfd8ad2a31d5badd8994e4f

SHA512
3289196baa7bef33668b13b2e6987cf5db115cb322a651beab86b2a1167f8e337fcc732a05e0da08a97af4b582ea980655ea4093d1bf9313760154e85190596a

Download Submit
C:\Windows\SysWOW64\hfpapi.dll

Filesize
244KB

MD5
dedabbc8a543a465385000824a8ef87e

SHA1
e8659221be62d5cf9357933453aeda28e4bda9ce

SHA256
c8828d02c9024e1db61cf6f5a658c53ea9e52bbd71b1721932214547053243eb

SHA512
18587c09351caed31b0b89f9da1dd6e7def4ac6ab88a2169bc3ac6f69bc185ab17e45a3b50d3f47b0a4496c280423645d66bc7b8e1ec14394f302bdd3ea26ebd

Download Submit
C:\Windows\SysWOW64\hfpapi.dll

Filesize
244KB

MD5
dedabbc8a543a465385000824a8ef87e

SHA1
e8659221be62d5cf9357933453aeda28e4bda9ce

SHA256
c8828d02c9024e1db61cf6f5a658c53ea9e52bbd71b1721932214547053243eb

SHA512
18587c09351caed31b0b89f9da1dd6e7def4ac6ab88a2169bc3ac6f69bc185ab17e45a3b50d3f47b0a4496c280423645d66bc7b8e1ec14394f302bdd3ea26ebd

Download Submit
C:\Windows\SysWOW64\installd.exe

Filesize
108KB

MD5
9671951506128952abf8d7a8e5d7d925

SHA1
af984da9b4fcb0c5fde4f95a93882ceddd3faaa2

SHA256
545473b748661a092bd6a009f584a3f4b621b3647c4a6b1495df9a316c2dbea6

SHA512
e4dc4b7206646da5af23561d2abdc28600d0dcf44512b55dfb2a6e85802688ca37d9472020ee0fbf34c1a21af102e8badae47a04afb06f73fe94acd0909f867c

Download Submit
C:\Windows\SysWOW64\installd.exe

Filesize
108KB

MD5
9671951506128952abf8d7a8e5d7d925

SHA1
af984da9b4fcb0c5fde4f95a93882ceddd3faaa2

SHA256
545473b748661a092bd6a009f584a3f4b621b3647c4a6b1495df9a316c2dbea6

SHA512
e4dc4b7206646da5af23561d2abdc28600d0dcf44512b55dfb2a6e85802688ca37d9472020ee0fbf34c1a21af102e8badae47a04afb06f73fe94acd0909f867c

Download Submit
C:\Windows\SysWOW64\nethtsrv.exe

Filesize
176KB

MD5
1d64797fe8b04a0a802c3b7050c3dbd1

SHA1
a922231bca194cc4abcf3aa3d396365fabca48cf

SHA256
cba8c34b090558bb8b5352ef904ab00a6406273a16837c1e1980f8b755ad8e2e

SHA512
91314f86eb5fdc322b2fab3916ccb9a7cc60a62233dbde486631385e4ca492cbc9f0352b27285bbe1096798c258da981282fe2fceba173e886d08c0da9c277fe

Download Submit
C:\Windows\SysWOW64\nethtsrv.exe

Filesize
176KB

MD5
1d64797fe8b04a0a802c3b7050c3dbd1

SHA1
a922231bca194cc4abcf3aa3d396365fabca48cf

SHA256
cba8c34b090558bb8b5352ef904ab00a6406273a16837c1e1980f8b755ad8e2e

SHA512
91314f86eb5fdc322b2fab3916ccb9a7cc60a62233dbde486631385e4ca492cbc9f0352b27285bbe1096798c258da981282fe2fceba173e886d08c0da9c277fe

Download Submit
C:\Windows\SysWOW64\netupdsrv.exe

Filesize
158KB

MD5
c7847e0306e5ca389a20f4671515ec4f

SHA1
0997460f6b7b763cfec1fef16045594cd3302ba2

SHA256
04fccc3a7fb22130e83a6c4d13236546db07138ca0602b98a6ff5dc680f94122

SHA512
73fbaecf5bf747e0cb24bb609f5d60b42b2148106c3a342ba43ef37d8b6caae24c19eed94f27df0127919aecfda3e340c7b8cec269172127af32437d7d36b2a2

Download Submit
C:\Windows\SysWOW64\netupdsrv.exe

Filesize
158KB

MD5
c7847e0306e5ca389a20f4671515ec4f

SHA1
0997460f6b7b763cfec1fef16045594cd3302ba2

SHA256
04fccc3a7fb22130e83a6c4d13236546db07138ca0602b98a6ff5dc680f94122

SHA512
73fbaecf5bf747e0cb24bb609f5d60b42b2148106c3a342ba43ef37d8b6caae24c19eed94f27df0127919aecfda3e340c7b8cec269172127af32437d7d36b2a2

Download Submit
memory/1268-140-0x0000000000000000-mapping.dmp

Download
memory/1436-147-0x0000000000000000-mapping.dmp

Download
memory/1804-153-0x0000000000000000-mapping.dmp

Download
memory/3448-141-0x0000000000000000-mapping.dmp

Download
memory/4596-137-0x0000000000000000-mapping.dmp

Download
memory/4900-135-0x0000000000000000-mapping.dmp

Download
memory/5036-136-0x0000000000360000-0x00000000007BE000-memory.dmp

Filesize
4.4MB

Download
memory/5040-142-0x0000000000000000-mapping.dmp

Download