4783ec93043f66b50b93665d60ab8e270e5c382e7d8275df94bb25d63ed9f5c8

Analysis

max time kernel
204s
max time network
31s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
23-11-2022 10:57

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4783ec93043f66b50b93665d60ab8e270e5c382e7d8275df94bb25d63ed9f5c8.exe
Size

446KB
MD5

9c3b396e1efc3b65c5c304f12a63c38e
SHA1

4e1bf6ac8c6aba0ba288d112e55c0b663e343cf0
SHA256

4783ec93043f66b50b93665d60ab8e270e5c382e7d8275df94bb25d63ed9f5c8
SHA512

e09d1003550678a73ad9a8112b118a2ea0173d46d9576e05c8d24b12fbb26b48ebc7d48bebdfa6ec558535a90d506d182e086d561859f43654d86430edbb312a
SSDEEP

12288:ndXCgfUFIqz8WZvVQwTjRvWW1KFK/H3Lh:ndXpMBz8WZ+wTjRbiK/XLh

Score

8^/10

discovery

Malware Config

Signatures

Drops file in Drivers directory 1 IoCs

Processes:

4783ec93043f66b50b93665d60ab8e270e5c382e7d8275df94bb25d63ed9f5c8.exe

description ioc process

File created C:\Windows\system32\drivers\nethfdrv.sys 4783ec93043f66b50b93665d60ab8e270e5c382e7d8275df94bb25d63ed9f5c8.exe
Executes dropped EXE 3 IoCs

Processes:

installd.exenethtsrv.exenetupdsrv.exe

pid process

1396 installd.exe
944 nethtsrv.exe
1148 netupdsrv.exe

description	ioc	process
File created	C:\Windows\system32\drivers\nethfdrv.sys	4783ec93043f66b50b93665d60ab8e270e5c382e7d8275df94bb25d63ed9f5c8.exe

pid	process
1396	installd.exe
944	nethtsrv.exe
1148	netupdsrv.exe

Loads dropped DLL 9 IoCs

Processes:

4783ec93043f66b50b93665d60ab8e270e5c382e7d8275df94bb25d63ed9f5c8.exeinstalld.exenethtsrv.exe

pid	process
1164	4783ec93043f66b50b93665d60ab8e270e5c382e7d8275df94bb25d63ed9f5c8.exe
1164	4783ec93043f66b50b93665d60ab8e270e5c382e7d8275df94bb25d63ed9f5c8.exe
1164	4783ec93043f66b50b93665d60ab8e270e5c382e7d8275df94bb25d63ed9f5c8.exe
1164	4783ec93043f66b50b93665d60ab8e270e5c382e7d8275df94bb25d63ed9f5c8.exe
1396	installd.exe
1164	4783ec93043f66b50b93665d60ab8e270e5c382e7d8275df94bb25d63ed9f5c8.exe
944	nethtsrv.exe
944	nethtsrv.exe
1164	4783ec93043f66b50b93665d60ab8e270e5c382e7d8275df94bb25d63ed9f5c8.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in System32 directory 5 IoCs

Processes:

4783ec93043f66b50b93665d60ab8e270e5c382e7d8275df94bb25d63ed9f5c8.exe

description	ioc	process
File created	C:\Windows\SysWOW64\nethtsrv.exe	4783ec93043f66b50b93665d60ab8e270e5c382e7d8275df94bb25d63ed9f5c8.exe
File created	C:\Windows\SysWOW64\netupdsrv.exe	4783ec93043f66b50b93665d60ab8e270e5c382e7d8275df94bb25d63ed9f5c8.exe
File created	C:\Windows\SysWOW64\hfnapi.dll	4783ec93043f66b50b93665d60ab8e270e5c382e7d8275df94bb25d63ed9f5c8.exe
File created	C:\Windows\SysWOW64\hfpapi.dll	4783ec93043f66b50b93665d60ab8e270e5c382e7d8275df94bb25d63ed9f5c8.exe
File created	C:\Windows\SysWOW64\installd.exe	4783ec93043f66b50b93665d60ab8e270e5c382e7d8275df94bb25d63ed9f5c8.exe

Drops file in Program Files directory 3 IoCs

Processes:

4783ec93043f66b50b93665d60ab8e270e5c382e7d8275df94bb25d63ed9f5c8.exe

description	ioc	process
File created	C:\Program Files (x86)\Common Files\Config\data.xml	4783ec93043f66b50b93665d60ab8e270e5c382e7d8275df94bb25d63ed9f5c8.exe
File created	C:\Program Files (x86)\Common Files\Config\ver.xml	4783ec93043f66b50b93665d60ab8e270e5c382e7d8275df94bb25d63ed9f5c8.exe
File created	C:\Program Files (x86)\Common Files\config\uninstinethnfd.exe	4783ec93043f66b50b93665d60ab8e270e5c382e7d8275df94bb25d63ed9f5c8.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Runs net.exe
Suspicious behavior: LoadsDriver 1 IoCs

Processes:

pid process

468

pid	process
468

Suspicious use of WriteProcessMemory 34 IoCs

Processes:

4783ec93043f66b50b93665d60ab8e270e5c382e7d8275df94bb25d63ed9f5c8.exenet.exenet.exe

description	pid	process	target process
PID 1164 wrote to memory of 2040	1164	4783ec93043f66b50b93665d60ab8e270e5c382e7d8275df94bb25d63ed9f5c8.exe	net.exe
PID 1164 wrote to memory of 2040	1164	4783ec93043f66b50b93665d60ab8e270e5c382e7d8275df94bb25d63ed9f5c8.exe	net.exe
PID 1164 wrote to memory of 2040	1164	4783ec93043f66b50b93665d60ab8e270e5c382e7d8275df94bb25d63ed9f5c8.exe	net.exe
PID 1164 wrote to memory of 2040	1164	4783ec93043f66b50b93665d60ab8e270e5c382e7d8275df94bb25d63ed9f5c8.exe	net.exe
PID 2040 wrote to memory of 1772	2040	net.exe	net1.exe
PID 2040 wrote to memory of 1772	2040	net.exe	net1.exe
PID 2040 wrote to memory of 1772	2040	net.exe	net1.exe
PID 2040 wrote to memory of 1772	2040	net.exe	net1.exe
PID 1164 wrote to memory of 1868	1164	4783ec93043f66b50b93665d60ab8e270e5c382e7d8275df94bb25d63ed9f5c8.exe	net.exe
PID 1164 wrote to memory of 1868	1164	4783ec93043f66b50b93665d60ab8e270e5c382e7d8275df94bb25d63ed9f5c8.exe	net.exe
PID 1164 wrote to memory of 1868	1164	4783ec93043f66b50b93665d60ab8e270e5c382e7d8275df94bb25d63ed9f5c8.exe	net.exe
PID 1164 wrote to memory of 1868	1164	4783ec93043f66b50b93665d60ab8e270e5c382e7d8275df94bb25d63ed9f5c8.exe	net.exe
PID 1868 wrote to memory of 896	1868	net.exe	net1.exe
PID 1868 wrote to memory of 896	1868	net.exe	net1.exe
PID 1868 wrote to memory of 896	1868	net.exe	net1.exe
PID 1868 wrote to memory of 896	1868	net.exe	net1.exe
PID 1164 wrote to memory of 1396	1164	4783ec93043f66b50b93665d60ab8e270e5c382e7d8275df94bb25d63ed9f5c8.exe	installd.exe
PID 1164 wrote to memory of 1396	1164	4783ec93043f66b50b93665d60ab8e270e5c382e7d8275df94bb25d63ed9f5c8.exe	installd.exe
PID 1164 wrote to memory of 1396	1164	4783ec93043f66b50b93665d60ab8e270e5c382e7d8275df94bb25d63ed9f5c8.exe	installd.exe
PID 1164 wrote to memory of 1396	1164	4783ec93043f66b50b93665d60ab8e270e5c382e7d8275df94bb25d63ed9f5c8.exe	installd.exe
PID 1164 wrote to memory of 1396	1164	4783ec93043f66b50b93665d60ab8e270e5c382e7d8275df94bb25d63ed9f5c8.exe	installd.exe
PID 1164 wrote to memory of 1396	1164	4783ec93043f66b50b93665d60ab8e270e5c382e7d8275df94bb25d63ed9f5c8.exe	installd.exe
PID 1164 wrote to memory of 1396	1164	4783ec93043f66b50b93665d60ab8e270e5c382e7d8275df94bb25d63ed9f5c8.exe	installd.exe
PID 1164 wrote to memory of 944	1164	4783ec93043f66b50b93665d60ab8e270e5c382e7d8275df94bb25d63ed9f5c8.exe	nethtsrv.exe
PID 1164 wrote to memory of 944	1164	4783ec93043f66b50b93665d60ab8e270e5c382e7d8275df94bb25d63ed9f5c8.exe	nethtsrv.exe
PID 1164 wrote to memory of 944	1164	4783ec93043f66b50b93665d60ab8e270e5c382e7d8275df94bb25d63ed9f5c8.exe	nethtsrv.exe
PID 1164 wrote to memory of 944	1164	4783ec93043f66b50b93665d60ab8e270e5c382e7d8275df94bb25d63ed9f5c8.exe	nethtsrv.exe
PID 1164 wrote to memory of 1148	1164	4783ec93043f66b50b93665d60ab8e270e5c382e7d8275df94bb25d63ed9f5c8.exe	netupdsrv.exe
PID 1164 wrote to memory of 1148	1164	4783ec93043f66b50b93665d60ab8e270e5c382e7d8275df94bb25d63ed9f5c8.exe	netupdsrv.exe
PID 1164 wrote to memory of 1148	1164	4783ec93043f66b50b93665d60ab8e270e5c382e7d8275df94bb25d63ed9f5c8.exe	netupdsrv.exe
PID 1164 wrote to memory of 1148	1164	4783ec93043f66b50b93665d60ab8e270e5c382e7d8275df94bb25d63ed9f5c8.exe	netupdsrv.exe
PID 1164 wrote to memory of 1148	1164	4783ec93043f66b50b93665d60ab8e270e5c382e7d8275df94bb25d63ed9f5c8.exe	netupdsrv.exe
PID 1164 wrote to memory of 1148	1164	4783ec93043f66b50b93665d60ab8e270e5c382e7d8275df94bb25d63ed9f5c8.exe	netupdsrv.exe
PID 1164 wrote to memory of 1148	1164	4783ec93043f66b50b93665d60ab8e270e5c382e7d8275df94bb25d63ed9f5c8.exe	netupdsrv.exe

C:\Users\Admin\AppData\Local\Temp\4783ec93043f66b50b93665d60ab8e270e5c382e7d8275df94bb25d63ed9f5c8.exe
"C:\Users\Admin\AppData\Local\Temp\4783ec93043f66b50b93665d60ab8e270e5c382e7d8275df94bb25d63ed9f5c8.exe"
1⤵
- Drops file in Drivers directory
- Loads dropped DLL
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:1164

C:\Windows\SysWOW64\net.exe
net stop nethttpservice
2⤵
- Suspicious use of WriteProcessMemory
PID:2040

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop nethttpservice
3⤵
PID:1772

C:\Windows\SysWOW64\net.exe
net stop serviceupdater
2⤵
- Suspicious use of WriteProcessMemory
PID:1868

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop serviceupdater
3⤵
PID:896

C:\Windows\SysWOW64\installd.exe
"C:\Windows\system32\installd.exe" nethfdrv
2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1396

C:\Windows\SysWOW64\nethtsrv.exe
"C:\Windows\system32\nethtsrv.exe" -nfdi
2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:944

C:\Windows\SysWOW64\netupdsrv.exe
"C:\Windows\system32\netupdsrv.exe" -nfdi
2⤵
- Executes dropped EXE
PID:1148

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\hfnapi.dll

Filesize
106KB

MD5
c85067a4fc81e51016a74793c06124e0

SHA1
3150842f5474176b3d9f17a59eb05daa228d9263

SHA256
91b76c7351405ea1148baa9ff58e0ab87b85b27eed34e1843cbbc572af125dce

SHA512
763294f711d392c706d8a9d7d82df551fa1c535c1b33ac8925f20b1679daa42393d8f6eb34b883d43d712dae33796e0ce504357c76c153d13a8b1d6b0fb524c1

Download Submit
C:\Windows\SysWOW64\hfpapi.dll

Filesize
241KB

MD5
89e93e618b1b6ef92823697898b1cd66

SHA1
8addbd8f1aba3c2eff7ff5632f40513ba1448ced

SHA256
9ca70b2fb2f04fb59e7926a886f15bef2cae259f8bb9ed1c780323c1d6f0ccd7

SHA512
cb1d4e448a5be1f2abbc57066e3fcba124e0ff6b3979ed1fd5ff545af2d7d25c8307dbac3ce48913d8dd9cee5dfe502a19932e937cae8eba15591eaec3ccee7b

Download Submit
C:\Windows\SysWOW64\installd.exe

Filesize
108KB

MD5
45b20a946398e5a38093d328a018c647

SHA1
326ef7f60a1fb2e06a194451f25ddb91851c54a7

SHA256
83b89ab899e91734b7018d2402744b74b7ed486bc4502c43e37996a760f46a9b

SHA512
3f82b7e1109f1e14d07d47075493486ec05c01d2fa24df001f5d116bffae246a10109785cb6f670234e18fbe04d38c4968718b64eb96d52927212afb0c3dbbff

Download Submit
C:\Windows\SysWOW64\nethtsrv.exe

Filesize
176KB

MD5
f8e01fa62ca557f2a57d244b589ebd0f

SHA1
5907438b000545edc6e052e1acefaa68a7bf4878

SHA256
f60e3bfb54e3bfcae466437cb1afb383158e369c799534488373a5a417334320

SHA512
ac040c5f961499f8d881ae693bbbd2d3d2ee889f4843f0b02f968598b2b94df4cffd58fd73e97c68eb9a16e7c39857c03d7f0639d92b07ed1006ce2893e01020

Download Submit
C:\Windows\SysWOW64\netupdsrv.exe

Filesize
158KB

MD5
afabb7c4315409460e11d1d3349ecab6

SHA1
f3d9befa759526708217727ca578dd1a8890d2d0

SHA256
aad7df19d317c912b78205d0c5a62b6a0efc243eced066646b468452a9bc40d7

SHA512
659ad2c85b5a62b372d27ba07d571d333e88005f6305e91c2c99fa80458245ffdc39b878f3f2ccb292ffd3352c7e096eeeceb72f60651ea1845ecf4396182112

Download Submit
\Users\Admin\AppData\Local\Temp\nse46A4.tmp\System.dll

Filesize
11KB

MD5
c17103ae9072a06da581dec998343fc1

SHA1
b72148c6bdfaada8b8c3f950e610ee7cf1da1f8d

SHA256
dc58d8ad81cacb0c1ed72e33bff8f23ea40b5252b5bb55d393a0903e6819ae2f

SHA512
d32a71aaef18e993f28096d536e41c4d016850721b31171513ce28bbd805a54fd290b7c3e9d935f72e676a1acfb4f0dcc89d95040a0dd29f2b6975855c18986f

Download Submit
\Users\Admin\AppData\Local\Temp\nse46A4.tmp\nsExec.dll

Filesize
6KB

MD5
acc2b699edfea5bf5aae45aba3a41e96

SHA1
d2accf4d494e43ceb2cff69abe4dd17147d29cc2

SHA256
168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e

SHA512
e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe

Download Submit
\Users\Admin\AppData\Local\Temp\nse46A4.tmp\nsExec.dll

Filesize
6KB

MD5
acc2b699edfea5bf5aae45aba3a41e96

SHA1
d2accf4d494e43ceb2cff69abe4dd17147d29cc2

SHA256
168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e

SHA512
e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe

Download Submit
\Windows\SysWOW64\hfnapi.dll

Filesize
106KB

MD5
c85067a4fc81e51016a74793c06124e0

SHA1
3150842f5474176b3d9f17a59eb05daa228d9263

SHA256
91b76c7351405ea1148baa9ff58e0ab87b85b27eed34e1843cbbc572af125dce

SHA512
763294f711d392c706d8a9d7d82df551fa1c535c1b33ac8925f20b1679daa42393d8f6eb34b883d43d712dae33796e0ce504357c76c153d13a8b1d6b0fb524c1

Download Submit
\Windows\SysWOW64\hfnapi.dll

Filesize
106KB

MD5
c85067a4fc81e51016a74793c06124e0

SHA1
3150842f5474176b3d9f17a59eb05daa228d9263

SHA256
91b76c7351405ea1148baa9ff58e0ab87b85b27eed34e1843cbbc572af125dce

SHA512
763294f711d392c706d8a9d7d82df551fa1c535c1b33ac8925f20b1679daa42393d8f6eb34b883d43d712dae33796e0ce504357c76c153d13a8b1d6b0fb524c1

Download Submit
\Windows\SysWOW64\hfpapi.dll

Filesize
241KB

MD5
89e93e618b1b6ef92823697898b1cd66

SHA1
8addbd8f1aba3c2eff7ff5632f40513ba1448ced

SHA256
9ca70b2fb2f04fb59e7926a886f15bef2cae259f8bb9ed1c780323c1d6f0ccd7

SHA512
cb1d4e448a5be1f2abbc57066e3fcba124e0ff6b3979ed1fd5ff545af2d7d25c8307dbac3ce48913d8dd9cee5dfe502a19932e937cae8eba15591eaec3ccee7b

Download Submit
\Windows\SysWOW64\installd.exe

Filesize
108KB

MD5
45b20a946398e5a38093d328a018c647

SHA1
326ef7f60a1fb2e06a194451f25ddb91851c54a7

SHA256
83b89ab899e91734b7018d2402744b74b7ed486bc4502c43e37996a760f46a9b

SHA512
3f82b7e1109f1e14d07d47075493486ec05c01d2fa24df001f5d116bffae246a10109785cb6f670234e18fbe04d38c4968718b64eb96d52927212afb0c3dbbff

Download Submit
\Windows\SysWOW64\nethtsrv.exe

Filesize
176KB

MD5
f8e01fa62ca557f2a57d244b589ebd0f

SHA1
5907438b000545edc6e052e1acefaa68a7bf4878

SHA256
f60e3bfb54e3bfcae466437cb1afb383158e369c799534488373a5a417334320

SHA512
ac040c5f961499f8d881ae693bbbd2d3d2ee889f4843f0b02f968598b2b94df4cffd58fd73e97c68eb9a16e7c39857c03d7f0639d92b07ed1006ce2893e01020

Download Submit
\Windows\SysWOW64\netupdsrv.exe

Filesize
158KB

MD5
afabb7c4315409460e11d1d3349ecab6

SHA1
f3d9befa759526708217727ca578dd1a8890d2d0

SHA256
aad7df19d317c912b78205d0c5a62b6a0efc243eced066646b468452a9bc40d7

SHA512
659ad2c85b5a62b372d27ba07d571d333e88005f6305e91c2c99fa80458245ffdc39b878f3f2ccb292ffd3352c7e096eeeceb72f60651ea1845ecf4396182112

Download Submit
memory/896-61-0x0000000000000000-mapping.dmp

Download
memory/944-69-0x0000000000000000-mapping.dmp

Download
memory/1148-75-0x0000000000000000-mapping.dmp

Download
memory/1164-54-0x0000000076931000-0x0000000076933000-memory.dmp

Filesize
8KB

Download
memory/1396-63-0x0000000000000000-mapping.dmp

Download
memory/1772-58-0x0000000000000000-mapping.dmp

Download
memory/1868-60-0x0000000000000000-mapping.dmp

Download
memory/2040-57-0x0000000000000000-mapping.dmp

Download