Analysis

  • max time kernel
    140s
  • max time network
    156s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220812-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
  • submitted
    23-11-2022 10:21

General

  • Target

    8048238e3831de660694737363c0ebee1d5abdfa53245cc2a9499c8251ee7df5.exe

  • Size

    602KB

  • MD5

    4d4e9ca6ea2eafac158ad8dc347468f5

  • SHA1

    8ab2790ad786a769b3837855d9d98c82c4fa1c19

  • SHA256

    8048238e3831de660694737363c0ebee1d5abdfa53245cc2a9499c8251ee7df5

  • SHA512

    81e00726956d196db6abd2abce5a9de9f1e617eeaed11252eba566c6a245f1dc595367fd8e959f2161bb35fafc98b7daaa453209e68e5837726b1f032876f312

  • SSDEEP

    12288:hIny5DYTSIro3+iR5ghgnqv9nKqGqrEwtDZ7UgGUG8AGQd:dUTSYoOiugnqvTGIEmlwG

Score
8/10

Malware Config

Signatures

  • Drops file in Drivers directory 1 IoCs
  • Executes dropped EXE 5 IoCs
  • Loads dropped DLL 14 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Drops file in System32 directory 5 IoCs
  • Drops file in Program Files directory 3 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Modifies data under HKEY_USERS 1 IoCs
  • Runs net.exe
  • Suspicious behavior: LoadsDriver 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 33 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\8048238e3831de660694737363c0ebee1d5abdfa53245cc2a9499c8251ee7df5.exe
    "C:\Users\Admin\AppData\Local\Temp\8048238e3831de660694737363c0ebee1d5abdfa53245cc2a9499c8251ee7df5.exe"
    1⤵
    • Drops file in Drivers directory
    • Loads dropped DLL
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • Suspicious use of WriteProcessMemory
    PID:3480
    • C:\Windows\SysWOW64\net.exe
      net stop nethttpservice
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:3268
      • C:\Windows\SysWOW64\net1.exe
        C:\Windows\system32\net1 stop nethttpservice
        3⤵
          PID:1780
      • C:\Windows\SysWOW64\net.exe
        net stop serviceupdater
        2⤵
        • Suspicious use of WriteProcessMemory
        PID:4964
        • C:\Windows\SysWOW64\net1.exe
          C:\Windows\system32\net1 stop serviceupdater
          3⤵
            PID:3596
        • C:\Windows\SysWOW64\installd.exe
          "C:\Windows\system32\installd.exe" nethfdrv
          2⤵
          • Executes dropped EXE
          • Loads dropped DLL
          PID:1400
        • C:\Windows\SysWOW64\nethtsrv.exe
          "C:\Windows\system32\nethtsrv.exe" -nfdi
          2⤵
          • Executes dropped EXE
          • Loads dropped DLL
          PID:2316
        • C:\Windows\SysWOW64\netupdsrv.exe
          "C:\Windows\system32\netupdsrv.exe" -nfdi
          2⤵
          • Executes dropped EXE
          PID:1552
        • C:\Windows\SysWOW64\net.exe
          net start nethttpservice
          2⤵
          • Suspicious use of WriteProcessMemory
          PID:740
          • C:\Windows\SysWOW64\net1.exe
            C:\Windows\system32\net1 start nethttpservice
            3⤵
              PID:204
          • C:\Windows\SysWOW64\net.exe
            net start serviceupdater
            2⤵
            • Suspicious use of WriteProcessMemory
            PID:1532
            • C:\Windows\SysWOW64\net1.exe
              C:\Windows\system32\net1 start serviceupdater
              3⤵
                PID:4988
          • C:\Windows\SysWOW64\nethtsrv.exe
            C:\Windows\SysWOW64\nethtsrv.exe
            1⤵
            • Executes dropped EXE
            • Loads dropped DLL
            • Modifies data under HKEY_USERS
            • Suspicious use of AdjustPrivilegeToken
            PID:320
          • C:\Windows\SysWOW64\netupdsrv.exe
            C:\Windows\SysWOW64\netupdsrv.exe
            1⤵
            • Executes dropped EXE
            PID:1848

          Network

          MITRE ATT&CK Enterprise v6

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • C:\Users\Admin\AppData\Local\Temp\nsv154F.tmp\System.dll

            Filesize

            11KB

            MD5

            c17103ae9072a06da581dec998343fc1

            SHA1

            b72148c6bdfaada8b8c3f950e610ee7cf1da1f8d

            SHA256

            dc58d8ad81cacb0c1ed72e33bff8f23ea40b5252b5bb55d393a0903e6819ae2f

            SHA512

            d32a71aaef18e993f28096d536e41c4d016850721b31171513ce28bbd805a54fd290b7c3e9d935f72e676a1acfb4f0dcc89d95040a0dd29f2b6975855c18986f

          • C:\Users\Admin\AppData\Local\Temp\nsv154F.tmp\nsExec.dll

            Filesize

            6KB

            MD5

            acc2b699edfea5bf5aae45aba3a41e96

            SHA1

            d2accf4d494e43ceb2cff69abe4dd17147d29cc2

            SHA256

            168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e

            SHA512

            e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe

          • C:\Users\Admin\AppData\Local\Temp\nsv154F.tmp\nsExec.dll

            Filesize

            6KB

            MD5

            acc2b699edfea5bf5aae45aba3a41e96

            SHA1

            d2accf4d494e43ceb2cff69abe4dd17147d29cc2

            SHA256

            168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e

            SHA512

            e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe

          • C:\Users\Admin\AppData\Local\Temp\nsv154F.tmp\nsExec.dll

            Filesize

            6KB

            MD5

            acc2b699edfea5bf5aae45aba3a41e96

            SHA1

            d2accf4d494e43ceb2cff69abe4dd17147d29cc2

            SHA256

            168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e

            SHA512

            e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe

          • C:\Users\Admin\AppData\Local\Temp\nsv154F.tmp\nsExec.dll

            Filesize

            6KB

            MD5

            acc2b699edfea5bf5aae45aba3a41e96

            SHA1

            d2accf4d494e43ceb2cff69abe4dd17147d29cc2

            SHA256

            168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e

            SHA512

            e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe

          • C:\Users\Admin\AppData\Local\Temp\nsv154F.tmp\nsExec.dll

            Filesize

            6KB

            MD5

            acc2b699edfea5bf5aae45aba3a41e96

            SHA1

            d2accf4d494e43ceb2cff69abe4dd17147d29cc2

            SHA256

            168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e

            SHA512

            e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe

          • C:\Users\Admin\AppData\Local\Temp\nsv154F.tmp\nsExec.dll

            Filesize

            6KB

            MD5

            acc2b699edfea5bf5aae45aba3a41e96

            SHA1

            d2accf4d494e43ceb2cff69abe4dd17147d29cc2

            SHA256

            168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e

            SHA512

            e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe

          • C:\Users\Admin\AppData\Local\Temp\nsv154F.tmp\nsExec.dll

            Filesize

            6KB

            MD5

            acc2b699edfea5bf5aae45aba3a41e96

            SHA1

            d2accf4d494e43ceb2cff69abe4dd17147d29cc2

            SHA256

            168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e

            SHA512

            e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe

          • C:\Users\Admin\AppData\Local\Temp\nsv154F.tmp\nsExec.dll

            Filesize

            6KB

            MD5

            acc2b699edfea5bf5aae45aba3a41e96

            SHA1

            d2accf4d494e43ceb2cff69abe4dd17147d29cc2

            SHA256

            168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e

            SHA512

            e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe

          • C:\Windows\SysWOW64\hfnapi.dll

            Filesize

            106KB

            MD5

            b50ef438bc9bd7de27438e06c42129a7

            SHA1

            e69df164ee0a0017053e1d9717e055f5bae7160a

            SHA256

            a31f55698bd16c88b209e9fd40dbc2842b666bd4333c3a22849f78de125a1dfe

            SHA512

            3bc18317db8d0c2c673a1c53226f82aec2179fc225b29f9ae05429abd7a0187f34e205080dcd3005f3735214d1697f5044fdae2e2f8c3d8bce55ff667582e397

          • C:\Windows\SysWOW64\hfnapi.dll

            Filesize

            106KB

            MD5

            b50ef438bc9bd7de27438e06c42129a7

            SHA1

            e69df164ee0a0017053e1d9717e055f5bae7160a

            SHA256

            a31f55698bd16c88b209e9fd40dbc2842b666bd4333c3a22849f78de125a1dfe

            SHA512

            3bc18317db8d0c2c673a1c53226f82aec2179fc225b29f9ae05429abd7a0187f34e205080dcd3005f3735214d1697f5044fdae2e2f8c3d8bce55ff667582e397

          • C:\Windows\SysWOW64\hfnapi.dll

            Filesize

            106KB

            MD5

            b50ef438bc9bd7de27438e06c42129a7

            SHA1

            e69df164ee0a0017053e1d9717e055f5bae7160a

            SHA256

            a31f55698bd16c88b209e9fd40dbc2842b666bd4333c3a22849f78de125a1dfe

            SHA512

            3bc18317db8d0c2c673a1c53226f82aec2179fc225b29f9ae05429abd7a0187f34e205080dcd3005f3735214d1697f5044fdae2e2f8c3d8bce55ff667582e397

          • C:\Windows\SysWOW64\hfnapi.dll

            Filesize

            106KB

            MD5

            b50ef438bc9bd7de27438e06c42129a7

            SHA1

            e69df164ee0a0017053e1d9717e055f5bae7160a

            SHA256

            a31f55698bd16c88b209e9fd40dbc2842b666bd4333c3a22849f78de125a1dfe

            SHA512

            3bc18317db8d0c2c673a1c53226f82aec2179fc225b29f9ae05429abd7a0187f34e205080dcd3005f3735214d1697f5044fdae2e2f8c3d8bce55ff667582e397

          • C:\Windows\SysWOW64\hfpapi.dll

            Filesize

            241KB

            MD5

            f919d4f693bb61fbda44505cebef17f2

            SHA1

            03b5abe74bb0351ab0e065f235a3ba4c84cef293

            SHA256

            0134e864b966a252af752a15640fbdc0140b32594c35527418e5f973a17746a0

            SHA512

            6762f87208b8007c8a5919ef07dcf1f4f0a5fbc6684018eb0c48ac7cd72b2c7e7630fcb3d89593ba2811a4732cdfaa4dec445ce598858c436605315879dcd718

          • C:\Windows\SysWOW64\hfpapi.dll

            Filesize

            241KB

            MD5

            f919d4f693bb61fbda44505cebef17f2

            SHA1

            03b5abe74bb0351ab0e065f235a3ba4c84cef293

            SHA256

            0134e864b966a252af752a15640fbdc0140b32594c35527418e5f973a17746a0

            SHA512

            6762f87208b8007c8a5919ef07dcf1f4f0a5fbc6684018eb0c48ac7cd72b2c7e7630fcb3d89593ba2811a4732cdfaa4dec445ce598858c436605315879dcd718

          • C:\Windows\SysWOW64\hfpapi.dll

            Filesize

            241KB

            MD5

            f919d4f693bb61fbda44505cebef17f2

            SHA1

            03b5abe74bb0351ab0e065f235a3ba4c84cef293

            SHA256

            0134e864b966a252af752a15640fbdc0140b32594c35527418e5f973a17746a0

            SHA512

            6762f87208b8007c8a5919ef07dcf1f4f0a5fbc6684018eb0c48ac7cd72b2c7e7630fcb3d89593ba2811a4732cdfaa4dec445ce598858c436605315879dcd718

          • C:\Windows\SysWOW64\installd.exe

            Filesize

            108KB

            MD5

            cb13ad2dd6b031f1393db9332e6f2d9a

            SHA1

            8a8decb047293f1a60c46c9931f12d6bfd327a60

            SHA256

            c63782961e18dbfcf10993c1a328e7b9b9d49d96cfa1201c348c790b2f6b76d6

            SHA512

            0f848a3bcc55c1b5886411f597461fc0e440dc017f30442cd07f94ae1c535ec394885c67a1b05c2f9582a054383719ad8f1f49101c2751580af2445d43d8cf8a

          • C:\Windows\SysWOW64\installd.exe

            Filesize

            108KB

            MD5

            cb13ad2dd6b031f1393db9332e6f2d9a

            SHA1

            8a8decb047293f1a60c46c9931f12d6bfd327a60

            SHA256

            c63782961e18dbfcf10993c1a328e7b9b9d49d96cfa1201c348c790b2f6b76d6

            SHA512

            0f848a3bcc55c1b5886411f597461fc0e440dc017f30442cd07f94ae1c535ec394885c67a1b05c2f9582a054383719ad8f1f49101c2751580af2445d43d8cf8a

          • C:\Windows\SysWOW64\nethtsrv.exe

            Filesize

            176KB

            MD5

            ddfe3ab72caf337b73f89f6540be0e42

            SHA1

            5940a9568c81b71640f6092c158916d492b323a6

            SHA256

            40a87db235ef3548bdab1138de2a89ce5d531f39372006303d1985a8d6c1f9a2

            SHA512

            dc74e955c1f391b9828932681de68edda8a560822545facaf9030f7c41c73538c6232632346246269323a4db76e53e5cbf36a8585b3988bed3e501a1981ea3ed

          • C:\Windows\SysWOW64\nethtsrv.exe

            Filesize

            176KB

            MD5

            ddfe3ab72caf337b73f89f6540be0e42

            SHA1

            5940a9568c81b71640f6092c158916d492b323a6

            SHA256

            40a87db235ef3548bdab1138de2a89ce5d531f39372006303d1985a8d6c1f9a2

            SHA512

            dc74e955c1f391b9828932681de68edda8a560822545facaf9030f7c41c73538c6232632346246269323a4db76e53e5cbf36a8585b3988bed3e501a1981ea3ed

          • C:\Windows\SysWOW64\nethtsrv.exe

            Filesize

            176KB

            MD5

            ddfe3ab72caf337b73f89f6540be0e42

            SHA1

            5940a9568c81b71640f6092c158916d492b323a6

            SHA256

            40a87db235ef3548bdab1138de2a89ce5d531f39372006303d1985a8d6c1f9a2

            SHA512

            dc74e955c1f391b9828932681de68edda8a560822545facaf9030f7c41c73538c6232632346246269323a4db76e53e5cbf36a8585b3988bed3e501a1981ea3ed

          • C:\Windows\SysWOW64\netupdsrv.exe

            Filesize

            158KB

            MD5

            c739866d589d0a75d2052f476c2a935f

            SHA1

            c6ce49c2a0ce3d19c3cd8e7b54de4b7e7ddc159c

            SHA256

            60992f8d4dcd8432e1b9b1d20dbed611e42e777dded6220f8b0b16922d3cbb41

            SHA512

            53c6390c181f36d4cbb07ff067bab565c6d42f66de436c897e330d0d2971c5d5441e161bd79ae4710f1b8b9a56ac520724d0b7a17a2ac7741147d8312e80b0ab

          • C:\Windows\SysWOW64\netupdsrv.exe

            Filesize

            158KB

            MD5

            c739866d589d0a75d2052f476c2a935f

            SHA1

            c6ce49c2a0ce3d19c3cd8e7b54de4b7e7ddc159c

            SHA256

            60992f8d4dcd8432e1b9b1d20dbed611e42e777dded6220f8b0b16922d3cbb41

            SHA512

            53c6390c181f36d4cbb07ff067bab565c6d42f66de436c897e330d0d2971c5d5441e161bd79ae4710f1b8b9a56ac520724d0b7a17a2ac7741147d8312e80b0ab

          • C:\Windows\SysWOW64\netupdsrv.exe

            Filesize

            158KB

            MD5

            c739866d589d0a75d2052f476c2a935f

            SHA1

            c6ce49c2a0ce3d19c3cd8e7b54de4b7e7ddc159c

            SHA256

            60992f8d4dcd8432e1b9b1d20dbed611e42e777dded6220f8b0b16922d3cbb41

            SHA512

            53c6390c181f36d4cbb07ff067bab565c6d42f66de436c897e330d0d2971c5d5441e161bd79ae4710f1b8b9a56ac520724d0b7a17a2ac7741147d8312e80b0ab

          • memory/204-159-0x0000000000000000-mapping.dmp

          • memory/740-158-0x0000000000000000-mapping.dmp

          • memory/1400-142-0x0000000000000000-mapping.dmp

          • memory/1532-165-0x0000000000000000-mapping.dmp

          • memory/1552-153-0x0000000000000000-mapping.dmp

          • memory/1780-136-0x0000000000000000-mapping.dmp

          • memory/2316-147-0x0000000000000000-mapping.dmp

          • memory/3268-135-0x0000000000000000-mapping.dmp

          • memory/3480-137-0x0000000000360000-0x00000000007BE000-memory.dmp

            Filesize

            4.4MB

          • memory/3480-168-0x0000000000360000-0x00000000007BE000-memory.dmp

            Filesize

            4.4MB

          • memory/3596-141-0x0000000000000000-mapping.dmp

          • memory/4964-140-0x0000000000000000-mapping.dmp

          • memory/4988-166-0x0000000000000000-mapping.dmp