884ad5929ee87ae62b37ac381b8243d98657b064f34d6e2ae23eddfad974f50e

Analysis

max time kernel
409s
max time network
480s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
23-11-2022 10:20

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

884ad5929ee87ae62b37ac381b8243d98657b064f34d6e2ae23eddfad974f50e.exe
Size

603KB
MD5

6c7eac937697bd7d70247f655a3c03be
SHA1

7ca5d9314ca93d53c23dd350c7dc262f2aac5e13
SHA256

884ad5929ee87ae62b37ac381b8243d98657b064f34d6e2ae23eddfad974f50e
SHA512

46bab5abff17c4c076bff89e91835b579e00a5f320828ae0f2b8694fa9896a3306eccc6201be1692ba6882a0344fb19c4842b16b1ca5b898e87128499ceddd5b
SSDEEP

12288:WIny5DYTmIM8YQfTB/QXFnXu5JHZuoL/Wz4Hhh2pqkWF4HD7CEuU:YUTm78YQ7B/peAhkpeyHD7CE

Score

8^/10

discovery

Malware Config

Signatures

Drops file in Drivers directory 1 IoCs

Processes:

884ad5929ee87ae62b37ac381b8243d98657b064f34d6e2ae23eddfad974f50e.exe

description ioc process

File created C:\Windows\system32\drivers\nethfdrv.sys 884ad5929ee87ae62b37ac381b8243d98657b064f34d6e2ae23eddfad974f50e.exe
Executes dropped EXE 1 IoCs

Processes:

installd.exe

pid process

816 installd.exe

description	ioc	process
File created	C:\Windows\system32\drivers\nethfdrv.sys	884ad5929ee87ae62b37ac381b8243d98657b064f34d6e2ae23eddfad974f50e.exe

pid	process
816	installd.exe

Loads dropped DLL 6 IoCs

Processes:

884ad5929ee87ae62b37ac381b8243d98657b064f34d6e2ae23eddfad974f50e.exeinstalld.exe

pid	process
4940	884ad5929ee87ae62b37ac381b8243d98657b064f34d6e2ae23eddfad974f50e.exe
4940	884ad5929ee87ae62b37ac381b8243d98657b064f34d6e2ae23eddfad974f50e.exe
4940	884ad5929ee87ae62b37ac381b8243d98657b064f34d6e2ae23eddfad974f50e.exe
4940	884ad5929ee87ae62b37ac381b8243d98657b064f34d6e2ae23eddfad974f50e.exe
4940	884ad5929ee87ae62b37ac381b8243d98657b064f34d6e2ae23eddfad974f50e.exe
816	installd.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in System32 directory 5 IoCs

Processes:

884ad5929ee87ae62b37ac381b8243d98657b064f34d6e2ae23eddfad974f50e.exe

description	ioc	process
File created	C:\Windows\SysWOW64\installd.exe	884ad5929ee87ae62b37ac381b8243d98657b064f34d6e2ae23eddfad974f50e.exe
File created	C:\Windows\SysWOW64\nethtsrv.exe	884ad5929ee87ae62b37ac381b8243d98657b064f34d6e2ae23eddfad974f50e.exe
File created	C:\Windows\SysWOW64\netupdsrv.exe	884ad5929ee87ae62b37ac381b8243d98657b064f34d6e2ae23eddfad974f50e.exe
File created	C:\Windows\SysWOW64\hfnapi.dll	884ad5929ee87ae62b37ac381b8243d98657b064f34d6e2ae23eddfad974f50e.exe
File created	C:\Windows\SysWOW64\hfpapi.dll	884ad5929ee87ae62b37ac381b8243d98657b064f34d6e2ae23eddfad974f50e.exe

Drops file in Program Files directory 3 IoCs

Processes:

884ad5929ee87ae62b37ac381b8243d98657b064f34d6e2ae23eddfad974f50e.exe

description	ioc	process
File created	C:\Program Files (x86)\Common Files\Config\data.xml	884ad5929ee87ae62b37ac381b8243d98657b064f34d6e2ae23eddfad974f50e.exe
File created	C:\Program Files (x86)\Common Files\Config\ver.xml	884ad5929ee87ae62b37ac381b8243d98657b064f34d6e2ae23eddfad974f50e.exe
File created	C:\Program Files (x86)\Common Files\config\uninstinethnfd.exe	884ad5929ee87ae62b37ac381b8243d98657b064f34d6e2ae23eddfad974f50e.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Runs net.exe

Suspicious use of WriteProcessMemory 15 IoCs

Processes:

884ad5929ee87ae62b37ac381b8243d98657b064f34d6e2ae23eddfad974f50e.exenet.exenet.exe

description	pid	process	target process
PID 4940 wrote to memory of 2332	4940	884ad5929ee87ae62b37ac381b8243d98657b064f34d6e2ae23eddfad974f50e.exe	net.exe
PID 4940 wrote to memory of 2332	4940	884ad5929ee87ae62b37ac381b8243d98657b064f34d6e2ae23eddfad974f50e.exe	net.exe
PID 4940 wrote to memory of 2332	4940	884ad5929ee87ae62b37ac381b8243d98657b064f34d6e2ae23eddfad974f50e.exe	net.exe
PID 2332 wrote to memory of 2736	2332	net.exe	net1.exe
PID 2332 wrote to memory of 2736	2332	net.exe	net1.exe
PID 2332 wrote to memory of 2736	2332	net.exe	net1.exe
PID 4940 wrote to memory of 5020	4940	884ad5929ee87ae62b37ac381b8243d98657b064f34d6e2ae23eddfad974f50e.exe	net.exe
PID 4940 wrote to memory of 5020	4940	884ad5929ee87ae62b37ac381b8243d98657b064f34d6e2ae23eddfad974f50e.exe	net.exe
PID 4940 wrote to memory of 5020	4940	884ad5929ee87ae62b37ac381b8243d98657b064f34d6e2ae23eddfad974f50e.exe	net.exe
PID 5020 wrote to memory of 428	5020	net.exe	net1.exe
PID 5020 wrote to memory of 428	5020	net.exe	net1.exe
PID 5020 wrote to memory of 428	5020	net.exe	net1.exe
PID 4940 wrote to memory of 816	4940	884ad5929ee87ae62b37ac381b8243d98657b064f34d6e2ae23eddfad974f50e.exe	installd.exe
PID 4940 wrote to memory of 816	4940	884ad5929ee87ae62b37ac381b8243d98657b064f34d6e2ae23eddfad974f50e.exe	installd.exe
PID 4940 wrote to memory of 816	4940	884ad5929ee87ae62b37ac381b8243d98657b064f34d6e2ae23eddfad974f50e.exe	installd.exe

C:\Users\Admin\AppData\Local\Temp\884ad5929ee87ae62b37ac381b8243d98657b064f34d6e2ae23eddfad974f50e.exe
"C:\Users\Admin\AppData\Local\Temp\884ad5929ee87ae62b37ac381b8243d98657b064f34d6e2ae23eddfad974f50e.exe"
1⤵
- Drops file in Drivers directory
- Loads dropped DLL
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:4940

C:\Windows\SysWOW64\net.exe
net stop nethttpservice
2⤵
- Suspicious use of WriteProcessMemory
PID:2332

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop nethttpservice
3⤵
PID:2736

C:\Windows\SysWOW64\net.exe
net stop serviceupdater
2⤵
- Suspicious use of WriteProcessMemory
PID:5020

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop serviceupdater
3⤵
PID:428

C:\Windows\SysWOW64\installd.exe
"C:\Windows\system32\installd.exe" nethfdrv
2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:816

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\nsi6B08.tmp\System.dll
Filesize
11KB

MD5
c17103ae9072a06da581dec998343fc1

SHA1
b72148c6bdfaada8b8c3f950e610ee7cf1da1f8d

SHA256
dc58d8ad81cacb0c1ed72e33bff8f23ea40b5252b5bb55d393a0903e6819ae2f

SHA512
d32a71aaef18e993f28096d536e41c4d016850721b31171513ce28bbd805a54fd290b7c3e9d935f72e676a1acfb4f0dcc89d95040a0dd29f2b6975855c18986f

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsi6B08.tmp\nsExec.dll
Filesize
6KB

MD5
acc2b699edfea5bf5aae45aba3a41e96

SHA1
d2accf4d494e43ceb2cff69abe4dd17147d29cc2

SHA256
168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e

SHA512
e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsi6B08.tmp\nsExec.dll
Filesize
6KB

MD5
acc2b699edfea5bf5aae45aba3a41e96

SHA1
d2accf4d494e43ceb2cff69abe4dd17147d29cc2

SHA256
168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e

SHA512
e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsi6B08.tmp\nsExec.dll
Filesize
6KB

MD5
acc2b699edfea5bf5aae45aba3a41e96

SHA1
d2accf4d494e43ceb2cff69abe4dd17147d29cc2

SHA256
168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e

SHA512
e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsi6B08.tmp\nsExec.dll
Filesize
6KB

MD5
acc2b699edfea5bf5aae45aba3a41e96

SHA1
d2accf4d494e43ceb2cff69abe4dd17147d29cc2

SHA256
168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e

SHA512
e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe

Download Submit
C:\Windows\SysWOW64\hfnapi.dll
Filesize
106KB

MD5
37c3ebd2b2e2df5c29d818e249c0d4b7

SHA1
50437d8a0dccf2739ce1b3323bce06955ff45816

SHA256
447e83a05fb6ef56a5cd06e561fdba59811ae7199c6035adbddfc0b2039fd082

SHA512
fa246f400c6fa652281785d842f657a66d9058b2da3610f265c8d4bf6b9ee156b750495d5bc2c23c5491578393cfb3875e2a8757a8582257b134c0c6f3bb5daa

Download Submit
C:\Windows\SysWOW64\hfnapi.dll
Filesize
106KB

MD5
37c3ebd2b2e2df5c29d818e249c0d4b7

SHA1
50437d8a0dccf2739ce1b3323bce06955ff45816

SHA256
447e83a05fb6ef56a5cd06e561fdba59811ae7199c6035adbddfc0b2039fd082

SHA512
fa246f400c6fa652281785d842f657a66d9058b2da3610f265c8d4bf6b9ee156b750495d5bc2c23c5491578393cfb3875e2a8757a8582257b134c0c6f3bb5daa

Download Submit
C:\Windows\SysWOW64\installd.exe
Filesize
108KB

MD5
5bb1ef5b80f1f2824a2705c9fec04371

SHA1
582b67fce59e87e0d4fe2c36f1c03dfdae1bba52

SHA256
e605889e8e5f5036834d11d9133bab6985d6ed6e92b9f80ded7d7bad8210cd29

SHA512
134a2f90ad43ae9c74d4df6b5d372c557b15aee989bc78e031d43e9698819e91cb0f7f9810eee502bb846eeaf73b7a059af02d35a2f84dce117718f52e0c4f41

Download Submit
C:\Windows\SysWOW64\installd.exe
Filesize
108KB

MD5
5bb1ef5b80f1f2824a2705c9fec04371

SHA1
582b67fce59e87e0d4fe2c36f1c03dfdae1bba52

SHA256
e605889e8e5f5036834d11d9133bab6985d6ed6e92b9f80ded7d7bad8210cd29

SHA512
134a2f90ad43ae9c74d4df6b5d372c557b15aee989bc78e031d43e9698819e91cb0f7f9810eee502bb846eeaf73b7a059af02d35a2f84dce117718f52e0c4f41

Download Submit
memory/428-142-0x0000000000000000-mapping.dmp

Download
memory/816-143-0x0000000000000000-mapping.dmp

Download
memory/2332-136-0x0000000000000000-mapping.dmp

Download
memory/2736-137-0x0000000000000000-mapping.dmp

Download
memory/4940-138-0x0000000000360000-0x00000000007BE000-memory.dmp

Filesize
4.4MB

Download
memory/4940-132-0x0000000000360000-0x00000000007BE000-memory.dmp

Filesize
4.4MB

Download
memory/5020-141-0x0000000000000000-mapping.dmp

Download