952608c4594e4023a0152c36a49c3bc282f3e646364f44fca1c908f74f0cfbdb

Analysis

max time kernel
349s
max time network
406s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
23-11-2022 10:19

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

952608c4594e4023a0152c36a49c3bc282f3e646364f44fca1c908f74f0cfbdb.exe
Size

603KB
MD5

c91d01dfdabc1f1f1eb7914846575125
SHA1

cb2c517d57000a4a15c7871967d2e2a39bb648e9
SHA256

952608c4594e4023a0152c36a49c3bc282f3e646364f44fca1c908f74f0cfbdb
SHA512

9846585c0d7a3bf7a8fe6be4c8cc32f9d274a94bbda7fc6e4169575c3d865edbf4a33fe16d8a34e97173656ff1ccf78d71f90474e53967507eb2e53f7067eb73
SSDEEP

12288:yIny5DYTEvvGa3Z3p4vkoXMeiV1cuLSltX8FuToiRG8dkYhvJ:0UTEXGa3ZWz8xV1tOltXNT5yo

Score

8^/10

discovery

Malware Config

Signatures

Drops file in Drivers directory 1 IoCs

Processes:

952608c4594e4023a0152c36a49c3bc282f3e646364f44fca1c908f74f0cfbdb.exe

description ioc process

File created C:\Windows\system32\drivers\nethfdrv.sys 952608c4594e4023a0152c36a49c3bc282f3e646364f44fca1c908f74f0cfbdb.exe
Executes dropped EXE 2 IoCs

Processes:

installd.exenethtsrv.exe

pid process

892 installd.exe
760 nethtsrv.exe

description	ioc	process
File created	C:\Windows\system32\drivers\nethfdrv.sys	952608c4594e4023a0152c36a49c3bc282f3e646364f44fca1c908f74f0cfbdb.exe

pid	process
892	installd.exe
760	nethtsrv.exe

Loads dropped DLL 7 IoCs

Processes:

952608c4594e4023a0152c36a49c3bc282f3e646364f44fca1c908f74f0cfbdb.exeinstalld.exenethtsrv.exe

pid	process
1132	952608c4594e4023a0152c36a49c3bc282f3e646364f44fca1c908f74f0cfbdb.exe
1132	952608c4594e4023a0152c36a49c3bc282f3e646364f44fca1c908f74f0cfbdb.exe
1132	952608c4594e4023a0152c36a49c3bc282f3e646364f44fca1c908f74f0cfbdb.exe
1132	952608c4594e4023a0152c36a49c3bc282f3e646364f44fca1c908f74f0cfbdb.exe
1132	952608c4594e4023a0152c36a49c3bc282f3e646364f44fca1c908f74f0cfbdb.exe
892	installd.exe
760	nethtsrv.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in System32 directory 5 IoCs

Processes:

952608c4594e4023a0152c36a49c3bc282f3e646364f44fca1c908f74f0cfbdb.exe

description	ioc	process
File created	C:\Windows\SysWOW64\hfnapi.dll	952608c4594e4023a0152c36a49c3bc282f3e646364f44fca1c908f74f0cfbdb.exe
File created	C:\Windows\SysWOW64\hfpapi.dll	952608c4594e4023a0152c36a49c3bc282f3e646364f44fca1c908f74f0cfbdb.exe
File created	C:\Windows\SysWOW64\installd.exe	952608c4594e4023a0152c36a49c3bc282f3e646364f44fca1c908f74f0cfbdb.exe
File created	C:\Windows\SysWOW64\nethtsrv.exe	952608c4594e4023a0152c36a49c3bc282f3e646364f44fca1c908f74f0cfbdb.exe
File created	C:\Windows\SysWOW64\netupdsrv.exe	952608c4594e4023a0152c36a49c3bc282f3e646364f44fca1c908f74f0cfbdb.exe

Drops file in Program Files directory 3 IoCs

Processes:

952608c4594e4023a0152c36a49c3bc282f3e646364f44fca1c908f74f0cfbdb.exe

description	ioc	process
File created	C:\Program Files (x86)\Common Files\Config\data.xml	952608c4594e4023a0152c36a49c3bc282f3e646364f44fca1c908f74f0cfbdb.exe
File created	C:\Program Files (x86)\Common Files\Config\ver.xml	952608c4594e4023a0152c36a49c3bc282f3e646364f44fca1c908f74f0cfbdb.exe
File created	C:\Program Files (x86)\Common Files\config\uninstinethnfd.exe	952608c4594e4023a0152c36a49c3bc282f3e646364f44fca1c908f74f0cfbdb.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Runs net.exe
Suspicious behavior: LoadsDriver 1 IoCs

Processes:

pid process

664

pid	process
664

Suspicious use of WriteProcessMemory 18 IoCs

Processes:

952608c4594e4023a0152c36a49c3bc282f3e646364f44fca1c908f74f0cfbdb.exenet.exenet.exe

description	pid	process	target process
PID 1132 wrote to memory of 4704	1132	952608c4594e4023a0152c36a49c3bc282f3e646364f44fca1c908f74f0cfbdb.exe	net.exe
PID 1132 wrote to memory of 4704	1132	952608c4594e4023a0152c36a49c3bc282f3e646364f44fca1c908f74f0cfbdb.exe	net.exe
PID 1132 wrote to memory of 4704	1132	952608c4594e4023a0152c36a49c3bc282f3e646364f44fca1c908f74f0cfbdb.exe	net.exe
PID 4704 wrote to memory of 3736	4704	net.exe	net1.exe
PID 4704 wrote to memory of 3736	4704	net.exe	net1.exe
PID 4704 wrote to memory of 3736	4704	net.exe	net1.exe
PID 1132 wrote to memory of 1936	1132	952608c4594e4023a0152c36a49c3bc282f3e646364f44fca1c908f74f0cfbdb.exe	net.exe
PID 1132 wrote to memory of 1936	1132	952608c4594e4023a0152c36a49c3bc282f3e646364f44fca1c908f74f0cfbdb.exe	net.exe
PID 1132 wrote to memory of 1936	1132	952608c4594e4023a0152c36a49c3bc282f3e646364f44fca1c908f74f0cfbdb.exe	net.exe
PID 1936 wrote to memory of 4068	1936	net.exe	net1.exe
PID 1936 wrote to memory of 4068	1936	net.exe	net1.exe
PID 1936 wrote to memory of 4068	1936	net.exe	net1.exe
PID 1132 wrote to memory of 892	1132	952608c4594e4023a0152c36a49c3bc282f3e646364f44fca1c908f74f0cfbdb.exe	installd.exe
PID 1132 wrote to memory of 892	1132	952608c4594e4023a0152c36a49c3bc282f3e646364f44fca1c908f74f0cfbdb.exe	installd.exe
PID 1132 wrote to memory of 892	1132	952608c4594e4023a0152c36a49c3bc282f3e646364f44fca1c908f74f0cfbdb.exe	installd.exe
PID 1132 wrote to memory of 760	1132	952608c4594e4023a0152c36a49c3bc282f3e646364f44fca1c908f74f0cfbdb.exe	nethtsrv.exe
PID 1132 wrote to memory of 760	1132	952608c4594e4023a0152c36a49c3bc282f3e646364f44fca1c908f74f0cfbdb.exe	nethtsrv.exe
PID 1132 wrote to memory of 760	1132	952608c4594e4023a0152c36a49c3bc282f3e646364f44fca1c908f74f0cfbdb.exe	nethtsrv.exe

C:\Users\Admin\AppData\Local\Temp\952608c4594e4023a0152c36a49c3bc282f3e646364f44fca1c908f74f0cfbdb.exe
"C:\Users\Admin\AppData\Local\Temp\952608c4594e4023a0152c36a49c3bc282f3e646364f44fca1c908f74f0cfbdb.exe"
1⤵
- Drops file in Drivers directory
- Loads dropped DLL
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:1132

C:\Windows\SysWOW64\net.exe
net stop nethttpservice
2⤵
- Suspicious use of WriteProcessMemory
PID:4704

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop nethttpservice
3⤵
PID:3736

C:\Windows\SysWOW64\net.exe
net stop serviceupdater
2⤵
- Suspicious use of WriteProcessMemory
PID:1936

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop serviceupdater
3⤵
PID:4068

C:\Windows\SysWOW64\installd.exe
"C:\Windows\system32\installd.exe" nethfdrv
2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:892

C:\Windows\SysWOW64\nethtsrv.exe
"C:\Windows\system32\nethtsrv.exe" -nfdi
2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:760

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\nsm445A.tmp\System.dll
Filesize
11KB

MD5
c17103ae9072a06da581dec998343fc1

SHA1
b72148c6bdfaada8b8c3f950e610ee7cf1da1f8d

SHA256
dc58d8ad81cacb0c1ed72e33bff8f23ea40b5252b5bb55d393a0903e6819ae2f

SHA512
d32a71aaef18e993f28096d536e41c4d016850721b31171513ce28bbd805a54fd290b7c3e9d935f72e676a1acfb4f0dcc89d95040a0dd29f2b6975855c18986f

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsm445A.tmp\nsExec.dll
Filesize
6KB

MD5
acc2b699edfea5bf5aae45aba3a41e96

SHA1
d2accf4d494e43ceb2cff69abe4dd17147d29cc2

SHA256
168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e

SHA512
e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsm445A.tmp\nsExec.dll
Filesize
6KB

MD5
acc2b699edfea5bf5aae45aba3a41e96

SHA1
d2accf4d494e43ceb2cff69abe4dd17147d29cc2

SHA256
168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e

SHA512
e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsm445A.tmp\nsExec.dll
Filesize
6KB

MD5
acc2b699edfea5bf5aae45aba3a41e96

SHA1
d2accf4d494e43ceb2cff69abe4dd17147d29cc2

SHA256
168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e

SHA512
e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsm445A.tmp\nsExec.dll
Filesize
6KB

MD5
acc2b699edfea5bf5aae45aba3a41e96

SHA1
d2accf4d494e43ceb2cff69abe4dd17147d29cc2

SHA256
168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e

SHA512
e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe

Download Submit
C:\Windows\SysWOW64\hfnapi.dll
Filesize
106KB

MD5
ba2ca1c09e3d9c7c655a34a505e4d2b5

SHA1
67a948236521cea00b652cdc142ea5be9d6231be

SHA256
9d76926aa0ac6199cc2a9f4d925a984038c7992ea01bef818c0a9ace1c123105

SHA512
ff36d768f049160e3e4d4233dcbad07c2110e6e989925343cfc4583b81874d934b45be6653e385d7c98ac30e8a9ff6fbe4083b98eb4c50c3b16441f6d639d281

Download Submit
C:\Windows\SysWOW64\hfnapi.dll
Filesize
106KB

MD5
ba2ca1c09e3d9c7c655a34a505e4d2b5

SHA1
67a948236521cea00b652cdc142ea5be9d6231be

SHA256
9d76926aa0ac6199cc2a9f4d925a984038c7992ea01bef818c0a9ace1c123105

SHA512
ff36d768f049160e3e4d4233dcbad07c2110e6e989925343cfc4583b81874d934b45be6653e385d7c98ac30e8a9ff6fbe4083b98eb4c50c3b16441f6d639d281

Download Submit
C:\Windows\SysWOW64\hfnapi.dll
Filesize
106KB

MD5
ba2ca1c09e3d9c7c655a34a505e4d2b5

SHA1
67a948236521cea00b652cdc142ea5be9d6231be

SHA256
9d76926aa0ac6199cc2a9f4d925a984038c7992ea01bef818c0a9ace1c123105

SHA512
ff36d768f049160e3e4d4233dcbad07c2110e6e989925343cfc4583b81874d934b45be6653e385d7c98ac30e8a9ff6fbe4083b98eb4c50c3b16441f6d639d281

Download Submit
C:\Windows\SysWOW64\installd.exe
Filesize
108KB

MD5
72908471cd2c4178cb70f037e018538a

SHA1
a1d468697e14b447f6548f56c19a63f5ab03c02e

SHA256
999b56e8846f4f05efb83f82d06754ade19c268fa14a58d3aea48653d3f2d16b

SHA512
cf3a8a185b691a830a77c2805389aeef19e5dc1f920b86d5341f44cc93d0be7487726d8342fc2a8b002d19fc5433f9a7051e50f759ce07f7e21e235778686ecb

Download Submit
C:\Windows\SysWOW64\installd.exe
Filesize
108KB

MD5
72908471cd2c4178cb70f037e018538a

SHA1
a1d468697e14b447f6548f56c19a63f5ab03c02e

SHA256
999b56e8846f4f05efb83f82d06754ade19c268fa14a58d3aea48653d3f2d16b

SHA512
cf3a8a185b691a830a77c2805389aeef19e5dc1f920b86d5341f44cc93d0be7487726d8342fc2a8b002d19fc5433f9a7051e50f759ce07f7e21e235778686ecb

Download Submit
C:\Windows\SysWOW64\nethtsrv.exe
Filesize
176KB

MD5
fd3dd332cbda518e3f265a6bd5680781

SHA1
00a10affbf5d60b7336a045410c68f3c10353f51

SHA256
dca933dbc77ab6f01826d52bebc42c30189ad97428ff82c2c87d8993b118eb24

SHA512
223d5f777bf3778bfe3ed6b122c9f2e778a48df1ff945c9453ce55082b1917aec86596cad094a1c4a87ffc0507b79766ddcd7c1f6335e7e7254527c430a07afb

Download Submit
C:\Windows\SysWOW64\nethtsrv.exe
Filesize
176KB

MD5
fd3dd332cbda518e3f265a6bd5680781

SHA1
00a10affbf5d60b7336a045410c68f3c10353f51

SHA256
dca933dbc77ab6f01826d52bebc42c30189ad97428ff82c2c87d8993b118eb24

SHA512
223d5f777bf3778bfe3ed6b122c9f2e778a48df1ff945c9453ce55082b1917aec86596cad094a1c4a87ffc0507b79766ddcd7c1f6335e7e7254527c430a07afb

Download Submit
memory/760-147-0x0000000000000000-mapping.dmp

Download
memory/892-142-0x0000000000000000-mapping.dmp

Download
memory/1132-132-0x0000000000360000-0x00000000007BE000-memory.dmp

Filesize
4.4MB

Download
memory/1936-140-0x0000000000000000-mapping.dmp

Download
memory/3736-137-0x0000000000000000-mapping.dmp

Download
memory/4068-141-0x0000000000000000-mapping.dmp

Download
memory/4704-136-0x0000000000000000-mapping.dmp

Download