Analysis

  • max time kernel
    159s
  • max time network
    170s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220812-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
  • submitted
    23-11-2022 10:15

General

  • Target

    aee23b57288a6b4bf83bc7f10b5ecd29830968e2d3a82537bf8f2f265c13fd94.exe

  • Size

    602KB

  • MD5

    5b744bd8018adf22ebb70872607b6648

  • SHA1

    35d6cfea6f31636199c7c3fd2530a3460e4753a2

  • SHA256

    aee23b57288a6b4bf83bc7f10b5ecd29830968e2d3a82537bf8f2f265c13fd94

  • SHA512

    e27cdfd773f70458711feab32932090c9024726f16be8c684054a7da1a34a53a6dfe0f6b5bb20f2c0a75e8504e0fe5bc3198fcbc9234668301fbf7cfaea83281

  • SSDEEP

    12288:EIny5DYTjvosgp3ibUwHVzCJjaclSG0hYBlFfz4zT:iUTjwsgRwUM1CJjacM1hYBlFU

Score
8/10

Malware Config

Signatures

  • Drops file in Drivers directory 1 IoCs
  • Executes dropped EXE 5 IoCs
  • Loads dropped DLL 14 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Drops file in System32 directory 5 IoCs
  • Drops file in Program Files directory 3 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Modifies data under HKEY_USERS 1 IoCs
  • Runs net.exe
  • Suspicious behavior: LoadsDriver 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 33 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\aee23b57288a6b4bf83bc7f10b5ecd29830968e2d3a82537bf8f2f265c13fd94.exe
    "C:\Users\Admin\AppData\Local\Temp\aee23b57288a6b4bf83bc7f10b5ecd29830968e2d3a82537bf8f2f265c13fd94.exe"
    1⤵
    • Drops file in Drivers directory
    • Loads dropped DLL
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • Suspicious use of WriteProcessMemory
    PID:1244
    • C:\Windows\SysWOW64\net.exe
      net stop nethttpservice
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:1684
      • C:\Windows\SysWOW64\net1.exe
        C:\Windows\system32\net1 stop nethttpservice
        3⤵
          PID:4268
      • C:\Windows\SysWOW64\net.exe
        net stop serviceupdater
        2⤵
        • Suspicious use of WriteProcessMemory
        PID:3076
        • C:\Windows\SysWOW64\net1.exe
          C:\Windows\system32\net1 stop serviceupdater
          3⤵
            PID:3324
        • C:\Windows\SysWOW64\installd.exe
          "C:\Windows\system32\installd.exe" nethfdrv
          2⤵
          • Executes dropped EXE
          • Loads dropped DLL
          PID:4804
        • C:\Windows\SysWOW64\nethtsrv.exe
          "C:\Windows\system32\nethtsrv.exe" -nfdi
          2⤵
          • Executes dropped EXE
          • Loads dropped DLL
          PID:4684
        • C:\Windows\SysWOW64\netupdsrv.exe
          "C:\Windows\system32\netupdsrv.exe" -nfdi
          2⤵
          • Executes dropped EXE
          PID:4380
        • C:\Windows\SysWOW64\net.exe
          net start nethttpservice
          2⤵
          • Suspicious use of WriteProcessMemory
          PID:664
          • C:\Windows\SysWOW64\net1.exe
            C:\Windows\system32\net1 start nethttpservice
            3⤵
              PID:2016
          • C:\Windows\SysWOW64\net.exe
            net start serviceupdater
            2⤵
            • Suspicious use of WriteProcessMemory
            PID:3348
            • C:\Windows\SysWOW64\net1.exe
              C:\Windows\system32\net1 start serviceupdater
              3⤵
                PID:2304
          • C:\Windows\SysWOW64\nethtsrv.exe
            C:\Windows\SysWOW64\nethtsrv.exe
            1⤵
            • Executes dropped EXE
            • Loads dropped DLL
            • Modifies data under HKEY_USERS
            • Suspicious use of AdjustPrivilegeToken
            PID:604
          • C:\Windows\SysWOW64\netupdsrv.exe
            C:\Windows\SysWOW64\netupdsrv.exe
            1⤵
            • Executes dropped EXE
            PID:3196

          Network

          MITRE ATT&CK Enterprise v6

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • C:\Users\Admin\AppData\Local\Temp\nsyDDC4.tmp\System.dll

            Filesize

            11KB

            MD5

            c17103ae9072a06da581dec998343fc1

            SHA1

            b72148c6bdfaada8b8c3f950e610ee7cf1da1f8d

            SHA256

            dc58d8ad81cacb0c1ed72e33bff8f23ea40b5252b5bb55d393a0903e6819ae2f

            SHA512

            d32a71aaef18e993f28096d536e41c4d016850721b31171513ce28bbd805a54fd290b7c3e9d935f72e676a1acfb4f0dcc89d95040a0dd29f2b6975855c18986f

          • C:\Users\Admin\AppData\Local\Temp\nsyDDC4.tmp\nsExec.dll

            Filesize

            6KB

            MD5

            acc2b699edfea5bf5aae45aba3a41e96

            SHA1

            d2accf4d494e43ceb2cff69abe4dd17147d29cc2

            SHA256

            168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e

            SHA512

            e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe

          • C:\Users\Admin\AppData\Local\Temp\nsyDDC4.tmp\nsExec.dll

            Filesize

            6KB

            MD5

            acc2b699edfea5bf5aae45aba3a41e96

            SHA1

            d2accf4d494e43ceb2cff69abe4dd17147d29cc2

            SHA256

            168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e

            SHA512

            e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe

          • C:\Users\Admin\AppData\Local\Temp\nsyDDC4.tmp\nsExec.dll

            Filesize

            6KB

            MD5

            acc2b699edfea5bf5aae45aba3a41e96

            SHA1

            d2accf4d494e43ceb2cff69abe4dd17147d29cc2

            SHA256

            168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e

            SHA512

            e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe

          • C:\Users\Admin\AppData\Local\Temp\nsyDDC4.tmp\nsExec.dll

            Filesize

            6KB

            MD5

            acc2b699edfea5bf5aae45aba3a41e96

            SHA1

            d2accf4d494e43ceb2cff69abe4dd17147d29cc2

            SHA256

            168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e

            SHA512

            e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe

          • C:\Users\Admin\AppData\Local\Temp\nsyDDC4.tmp\nsExec.dll

            Filesize

            6KB

            MD5

            acc2b699edfea5bf5aae45aba3a41e96

            SHA1

            d2accf4d494e43ceb2cff69abe4dd17147d29cc2

            SHA256

            168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e

            SHA512

            e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe

          • C:\Users\Admin\AppData\Local\Temp\nsyDDC4.tmp\nsExec.dll

            Filesize

            6KB

            MD5

            acc2b699edfea5bf5aae45aba3a41e96

            SHA1

            d2accf4d494e43ceb2cff69abe4dd17147d29cc2

            SHA256

            168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e

            SHA512

            e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe

          • C:\Users\Admin\AppData\Local\Temp\nsyDDC4.tmp\nsExec.dll

            Filesize

            6KB

            MD5

            acc2b699edfea5bf5aae45aba3a41e96

            SHA1

            d2accf4d494e43ceb2cff69abe4dd17147d29cc2

            SHA256

            168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e

            SHA512

            e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe

          • C:\Users\Admin\AppData\Local\Temp\nsyDDC4.tmp\nsExec.dll

            Filesize

            6KB

            MD5

            acc2b699edfea5bf5aae45aba3a41e96

            SHA1

            d2accf4d494e43ceb2cff69abe4dd17147d29cc2

            SHA256

            168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e

            SHA512

            e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe

          • C:\Windows\SysWOW64\hfnapi.dll

            Filesize

            106KB

            MD5

            1d42066747d8076ec8c8506035ec835f

            SHA1

            bc1edd7a0a1fd80316a6905cb720c7d841909ed8

            SHA256

            00b3ee8b76d281aa18df4b0a337c09f66a2d23dd776a75d5a27506d2a0ac9771

            SHA512

            0320683ad418edb7368edd4b316ed423cff502a32bb26e60279c32faa1f9971287627aaed1ef957d1b4e803d4013e50cb10a8a15e38d88d5f19e39d78b729ede

          • C:\Windows\SysWOW64\hfnapi.dll

            Filesize

            106KB

            MD5

            1d42066747d8076ec8c8506035ec835f

            SHA1

            bc1edd7a0a1fd80316a6905cb720c7d841909ed8

            SHA256

            00b3ee8b76d281aa18df4b0a337c09f66a2d23dd776a75d5a27506d2a0ac9771

            SHA512

            0320683ad418edb7368edd4b316ed423cff502a32bb26e60279c32faa1f9971287627aaed1ef957d1b4e803d4013e50cb10a8a15e38d88d5f19e39d78b729ede

          • C:\Windows\SysWOW64\hfnapi.dll

            Filesize

            106KB

            MD5

            1d42066747d8076ec8c8506035ec835f

            SHA1

            bc1edd7a0a1fd80316a6905cb720c7d841909ed8

            SHA256

            00b3ee8b76d281aa18df4b0a337c09f66a2d23dd776a75d5a27506d2a0ac9771

            SHA512

            0320683ad418edb7368edd4b316ed423cff502a32bb26e60279c32faa1f9971287627aaed1ef957d1b4e803d4013e50cb10a8a15e38d88d5f19e39d78b729ede

          • C:\Windows\SysWOW64\hfnapi.dll

            Filesize

            106KB

            MD5

            1d42066747d8076ec8c8506035ec835f

            SHA1

            bc1edd7a0a1fd80316a6905cb720c7d841909ed8

            SHA256

            00b3ee8b76d281aa18df4b0a337c09f66a2d23dd776a75d5a27506d2a0ac9771

            SHA512

            0320683ad418edb7368edd4b316ed423cff502a32bb26e60279c32faa1f9971287627aaed1ef957d1b4e803d4013e50cb10a8a15e38d88d5f19e39d78b729ede

          • C:\Windows\SysWOW64\hfpapi.dll

            Filesize

            241KB

            MD5

            5d4a8304cb9dcb829276d6eb07161a30

            SHA1

            1ef3aa76c9f3c3ceed9710f6ee6d6a726d1fdb42

            SHA256

            b4095e936cab933fd1419c3249b54e1832c89fef4f24622c019f40eeb12ad356

            SHA512

            13167f34c5b9e137ae7c002783232c227bb35f8c4e7856f964636e7b7ed14630094a13bde2ebab6b4f361fed569db22153ef11f8d25bc8e25ad8053136fcdb64

          • C:\Windows\SysWOW64\hfpapi.dll

            Filesize

            241KB

            MD5

            5d4a8304cb9dcb829276d6eb07161a30

            SHA1

            1ef3aa76c9f3c3ceed9710f6ee6d6a726d1fdb42

            SHA256

            b4095e936cab933fd1419c3249b54e1832c89fef4f24622c019f40eeb12ad356

            SHA512

            13167f34c5b9e137ae7c002783232c227bb35f8c4e7856f964636e7b7ed14630094a13bde2ebab6b4f361fed569db22153ef11f8d25bc8e25ad8053136fcdb64

          • C:\Windows\SysWOW64\hfpapi.dll

            Filesize

            241KB

            MD5

            5d4a8304cb9dcb829276d6eb07161a30

            SHA1

            1ef3aa76c9f3c3ceed9710f6ee6d6a726d1fdb42

            SHA256

            b4095e936cab933fd1419c3249b54e1832c89fef4f24622c019f40eeb12ad356

            SHA512

            13167f34c5b9e137ae7c002783232c227bb35f8c4e7856f964636e7b7ed14630094a13bde2ebab6b4f361fed569db22153ef11f8d25bc8e25ad8053136fcdb64

          • C:\Windows\SysWOW64\installd.exe

            Filesize

            108KB

            MD5

            78f5a831c4c40886c4750f9ab9843c26

            SHA1

            c95b0ad05ecefc23fdcb053dd1d61ca49f9b1bb3

            SHA256

            80c58808d4d728aa9a1af2409c1284b2a2be47b7219a9881f85d89ac59fe481a

            SHA512

            415573d542402b907f0abf179d45d1f17e391bfea552b4d6f402a3d7ee59e256c03528d072dfa0703b402afc2dbcc8b833db39fdfe52d739170655fba803d2c5

          • C:\Windows\SysWOW64\installd.exe

            Filesize

            108KB

            MD5

            78f5a831c4c40886c4750f9ab9843c26

            SHA1

            c95b0ad05ecefc23fdcb053dd1d61ca49f9b1bb3

            SHA256

            80c58808d4d728aa9a1af2409c1284b2a2be47b7219a9881f85d89ac59fe481a

            SHA512

            415573d542402b907f0abf179d45d1f17e391bfea552b4d6f402a3d7ee59e256c03528d072dfa0703b402afc2dbcc8b833db39fdfe52d739170655fba803d2c5

          • C:\Windows\SysWOW64\nethtsrv.exe

            Filesize

            176KB

            MD5

            053104f3d2e311b1070c6b5e17dd8283

            SHA1

            52e643ddd12109ace9a857e1f5cd657d38e78c2a

            SHA256

            4d87eb6680279472e8f1afa5bc08314e3b01c361eb3f6ba41fdce748112df72b

            SHA512

            8efe44ecc07220f4b8bfc720dd562af603c2655788eaa03f0a04b83c94c2867d631c3d7eb128fd83ef4eb870fddcd7901943def2d33d666e9d88ec9aa9deb9f3

          • C:\Windows\SysWOW64\nethtsrv.exe

            Filesize

            176KB

            MD5

            053104f3d2e311b1070c6b5e17dd8283

            SHA1

            52e643ddd12109ace9a857e1f5cd657d38e78c2a

            SHA256

            4d87eb6680279472e8f1afa5bc08314e3b01c361eb3f6ba41fdce748112df72b

            SHA512

            8efe44ecc07220f4b8bfc720dd562af603c2655788eaa03f0a04b83c94c2867d631c3d7eb128fd83ef4eb870fddcd7901943def2d33d666e9d88ec9aa9deb9f3

          • C:\Windows\SysWOW64\nethtsrv.exe

            Filesize

            176KB

            MD5

            053104f3d2e311b1070c6b5e17dd8283

            SHA1

            52e643ddd12109ace9a857e1f5cd657d38e78c2a

            SHA256

            4d87eb6680279472e8f1afa5bc08314e3b01c361eb3f6ba41fdce748112df72b

            SHA512

            8efe44ecc07220f4b8bfc720dd562af603c2655788eaa03f0a04b83c94c2867d631c3d7eb128fd83ef4eb870fddcd7901943def2d33d666e9d88ec9aa9deb9f3

          • C:\Windows\SysWOW64\netupdsrv.exe

            Filesize

            158KB

            MD5

            535ee32bf3cfc8ac1bb118c07d130b54

            SHA1

            7254e82fec9d4477e63a87f54848cbc1a858845c

            SHA256

            d2d489d5476338034455a4a8bd83d162adc51779b61db49fce822f3ef6d6344d

            SHA512

            598a7a3753243fb82df2fbbffab5d2acb0dc61dd851ebe7e571cfb2b937f7a993ec8fd47f48fce0451c39a382122a01cacdd63632506813a744631dd6dc31d6a

          • C:\Windows\SysWOW64\netupdsrv.exe

            Filesize

            158KB

            MD5

            535ee32bf3cfc8ac1bb118c07d130b54

            SHA1

            7254e82fec9d4477e63a87f54848cbc1a858845c

            SHA256

            d2d489d5476338034455a4a8bd83d162adc51779b61db49fce822f3ef6d6344d

            SHA512

            598a7a3753243fb82df2fbbffab5d2acb0dc61dd851ebe7e571cfb2b937f7a993ec8fd47f48fce0451c39a382122a01cacdd63632506813a744631dd6dc31d6a

          • C:\Windows\SysWOW64\netupdsrv.exe

            Filesize

            158KB

            MD5

            535ee32bf3cfc8ac1bb118c07d130b54

            SHA1

            7254e82fec9d4477e63a87f54848cbc1a858845c

            SHA256

            d2d489d5476338034455a4a8bd83d162adc51779b61db49fce822f3ef6d6344d

            SHA512

            598a7a3753243fb82df2fbbffab5d2acb0dc61dd851ebe7e571cfb2b937f7a993ec8fd47f48fce0451c39a382122a01cacdd63632506813a744631dd6dc31d6a

          • memory/664-158-0x0000000000000000-mapping.dmp

          • memory/1244-168-0x0000000000360000-0x00000000007BE000-memory.dmp

            Filesize

            4.4MB

          • memory/1244-132-0x0000000000360000-0x00000000007BE000-memory.dmp

            Filesize

            4.4MB

          • memory/1684-136-0x0000000000000000-mapping.dmp

          • memory/2016-159-0x0000000000000000-mapping.dmp

          • memory/2304-166-0x0000000000000000-mapping.dmp

          • memory/3076-140-0x0000000000000000-mapping.dmp

          • memory/3324-141-0x0000000000000000-mapping.dmp

          • memory/3348-165-0x0000000000000000-mapping.dmp

          • memory/4268-137-0x0000000000000000-mapping.dmp

          • memory/4380-153-0x0000000000000000-mapping.dmp

          • memory/4684-147-0x0000000000000000-mapping.dmp

          • memory/4804-142-0x0000000000000000-mapping.dmp