778aab7a527b62d240e4715832f6c29a0722e73e36d9dea9985f14e00df649ad

Analysis

max time kernel
246s
max time network
335s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
23-11-2022 10:22

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

778aab7a527b62d240e4715832f6c29a0722e73e36d9dea9985f14e00df649ad.exe
Size

601KB
MD5

8f5bbb2b1635b1ba30ffd3da8a5cf725
SHA1

ca939ac208545a7a9108346b6c0bb8c30da3bad7
SHA256

778aab7a527b62d240e4715832f6c29a0722e73e36d9dea9985f14e00df649ad
SHA512

85ea4bd28eaa7ba21cac8a640e1e728f75ac5bc37b66678bb85b00e9756d48e018908d3e8d7a41d46025ced3af40dfc208bd799ee0e83ec688248cf02f001e42
SSDEEP

12288:QIny5DYTrNoM8G22mDJoFytvplo8LP53B+UF0bn5cE:uUTrWM42kltvvbB32e

Score

8^/10

discovery

Malware Config

Signatures

Drops file in Drivers directory 1 IoCs

Processes:

778aab7a527b62d240e4715832f6c29a0722e73e36d9dea9985f14e00df649ad.exe

description ioc process

File created C:\Windows\system32\drivers\nethfdrv.sys 778aab7a527b62d240e4715832f6c29a0722e73e36d9dea9985f14e00df649ad.exe
Executes dropped EXE 3 IoCs

Processes:

installd.exenethtsrv.exenetupdsrv.exe

pid process

1788 installd.exe
1612 nethtsrv.exe
1924 netupdsrv.exe

description	ioc	process
File created	C:\Windows\system32\drivers\nethfdrv.sys	778aab7a527b62d240e4715832f6c29a0722e73e36d9dea9985f14e00df649ad.exe

pid	process
1788	installd.exe
1612	nethtsrv.exe
1924	netupdsrv.exe

Loads dropped DLL 9 IoCs

Processes:

778aab7a527b62d240e4715832f6c29a0722e73e36d9dea9985f14e00df649ad.exeinstalld.exenethtsrv.exe

pid	process
564	778aab7a527b62d240e4715832f6c29a0722e73e36d9dea9985f14e00df649ad.exe
564	778aab7a527b62d240e4715832f6c29a0722e73e36d9dea9985f14e00df649ad.exe
564	778aab7a527b62d240e4715832f6c29a0722e73e36d9dea9985f14e00df649ad.exe
564	778aab7a527b62d240e4715832f6c29a0722e73e36d9dea9985f14e00df649ad.exe
1788	installd.exe
564	778aab7a527b62d240e4715832f6c29a0722e73e36d9dea9985f14e00df649ad.exe
1612	nethtsrv.exe
1612	nethtsrv.exe
564	778aab7a527b62d240e4715832f6c29a0722e73e36d9dea9985f14e00df649ad.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in System32 directory 5 IoCs

Processes:

778aab7a527b62d240e4715832f6c29a0722e73e36d9dea9985f14e00df649ad.exe

description	ioc	process
File created	C:\Windows\SysWOW64\netupdsrv.exe	778aab7a527b62d240e4715832f6c29a0722e73e36d9dea9985f14e00df649ad.exe
File created	C:\Windows\SysWOW64\hfnapi.dll	778aab7a527b62d240e4715832f6c29a0722e73e36d9dea9985f14e00df649ad.exe
File created	C:\Windows\SysWOW64\hfpapi.dll	778aab7a527b62d240e4715832f6c29a0722e73e36d9dea9985f14e00df649ad.exe
File created	C:\Windows\SysWOW64\installd.exe	778aab7a527b62d240e4715832f6c29a0722e73e36d9dea9985f14e00df649ad.exe
File created	C:\Windows\SysWOW64\nethtsrv.exe	778aab7a527b62d240e4715832f6c29a0722e73e36d9dea9985f14e00df649ad.exe

Drops file in Program Files directory 3 IoCs

Processes:

778aab7a527b62d240e4715832f6c29a0722e73e36d9dea9985f14e00df649ad.exe

description	ioc	process
File created	C:\Program Files (x86)\Common Files\Config\data.xml	778aab7a527b62d240e4715832f6c29a0722e73e36d9dea9985f14e00df649ad.exe
File created	C:\Program Files (x86)\Common Files\Config\ver.xml	778aab7a527b62d240e4715832f6c29a0722e73e36d9dea9985f14e00df649ad.exe
File created	C:\Program Files (x86)\Common Files\config\uninstinethnfd.exe	778aab7a527b62d240e4715832f6c29a0722e73e36d9dea9985f14e00df649ad.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Runs net.exe
Suspicious behavior: LoadsDriver 1 IoCs

Processes:

pid process

460

pid	process
460

Suspicious use of WriteProcessMemory 34 IoCs

Processes:

778aab7a527b62d240e4715832f6c29a0722e73e36d9dea9985f14e00df649ad.exenet.exenet.exe

description	pid	process	target process
PID 564 wrote to memory of 904	564	778aab7a527b62d240e4715832f6c29a0722e73e36d9dea9985f14e00df649ad.exe	net.exe
PID 564 wrote to memory of 904	564	778aab7a527b62d240e4715832f6c29a0722e73e36d9dea9985f14e00df649ad.exe	net.exe
PID 564 wrote to memory of 904	564	778aab7a527b62d240e4715832f6c29a0722e73e36d9dea9985f14e00df649ad.exe	net.exe
PID 564 wrote to memory of 904	564	778aab7a527b62d240e4715832f6c29a0722e73e36d9dea9985f14e00df649ad.exe	net.exe
PID 904 wrote to memory of 1900	904	net.exe	net1.exe
PID 904 wrote to memory of 1900	904	net.exe	net1.exe
PID 904 wrote to memory of 1900	904	net.exe	net1.exe
PID 904 wrote to memory of 1900	904	net.exe	net1.exe
PID 564 wrote to memory of 1520	564	778aab7a527b62d240e4715832f6c29a0722e73e36d9dea9985f14e00df649ad.exe	net.exe
PID 564 wrote to memory of 1520	564	778aab7a527b62d240e4715832f6c29a0722e73e36d9dea9985f14e00df649ad.exe	net.exe
PID 564 wrote to memory of 1520	564	778aab7a527b62d240e4715832f6c29a0722e73e36d9dea9985f14e00df649ad.exe	net.exe
PID 564 wrote to memory of 1520	564	778aab7a527b62d240e4715832f6c29a0722e73e36d9dea9985f14e00df649ad.exe	net.exe
PID 1520 wrote to memory of 452	1520	net.exe	net1.exe
PID 1520 wrote to memory of 452	1520	net.exe	net1.exe
PID 1520 wrote to memory of 452	1520	net.exe	net1.exe
PID 1520 wrote to memory of 452	1520	net.exe	net1.exe
PID 564 wrote to memory of 1788	564	778aab7a527b62d240e4715832f6c29a0722e73e36d9dea9985f14e00df649ad.exe	installd.exe
PID 564 wrote to memory of 1788	564	778aab7a527b62d240e4715832f6c29a0722e73e36d9dea9985f14e00df649ad.exe	installd.exe
PID 564 wrote to memory of 1788	564	778aab7a527b62d240e4715832f6c29a0722e73e36d9dea9985f14e00df649ad.exe	installd.exe
PID 564 wrote to memory of 1788	564	778aab7a527b62d240e4715832f6c29a0722e73e36d9dea9985f14e00df649ad.exe	installd.exe
PID 564 wrote to memory of 1788	564	778aab7a527b62d240e4715832f6c29a0722e73e36d9dea9985f14e00df649ad.exe	installd.exe
PID 564 wrote to memory of 1788	564	778aab7a527b62d240e4715832f6c29a0722e73e36d9dea9985f14e00df649ad.exe	installd.exe
PID 564 wrote to memory of 1788	564	778aab7a527b62d240e4715832f6c29a0722e73e36d9dea9985f14e00df649ad.exe	installd.exe
PID 564 wrote to memory of 1612	564	778aab7a527b62d240e4715832f6c29a0722e73e36d9dea9985f14e00df649ad.exe	nethtsrv.exe
PID 564 wrote to memory of 1612	564	778aab7a527b62d240e4715832f6c29a0722e73e36d9dea9985f14e00df649ad.exe	nethtsrv.exe
PID 564 wrote to memory of 1612	564	778aab7a527b62d240e4715832f6c29a0722e73e36d9dea9985f14e00df649ad.exe	nethtsrv.exe
PID 564 wrote to memory of 1612	564	778aab7a527b62d240e4715832f6c29a0722e73e36d9dea9985f14e00df649ad.exe	nethtsrv.exe
PID 564 wrote to memory of 1924	564	778aab7a527b62d240e4715832f6c29a0722e73e36d9dea9985f14e00df649ad.exe	netupdsrv.exe
PID 564 wrote to memory of 1924	564	778aab7a527b62d240e4715832f6c29a0722e73e36d9dea9985f14e00df649ad.exe	netupdsrv.exe
PID 564 wrote to memory of 1924	564	778aab7a527b62d240e4715832f6c29a0722e73e36d9dea9985f14e00df649ad.exe	netupdsrv.exe
PID 564 wrote to memory of 1924	564	778aab7a527b62d240e4715832f6c29a0722e73e36d9dea9985f14e00df649ad.exe	netupdsrv.exe
PID 564 wrote to memory of 1924	564	778aab7a527b62d240e4715832f6c29a0722e73e36d9dea9985f14e00df649ad.exe	netupdsrv.exe
PID 564 wrote to memory of 1924	564	778aab7a527b62d240e4715832f6c29a0722e73e36d9dea9985f14e00df649ad.exe	netupdsrv.exe
PID 564 wrote to memory of 1924	564	778aab7a527b62d240e4715832f6c29a0722e73e36d9dea9985f14e00df649ad.exe	netupdsrv.exe

C:\Users\Admin\AppData\Local\Temp\778aab7a527b62d240e4715832f6c29a0722e73e36d9dea9985f14e00df649ad.exe
"C:\Users\Admin\AppData\Local\Temp\778aab7a527b62d240e4715832f6c29a0722e73e36d9dea9985f14e00df649ad.exe"
1⤵
- Drops file in Drivers directory
- Loads dropped DLL
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:564

C:\Windows\SysWOW64\net.exe
net stop nethttpservice
2⤵
- Suspicious use of WriteProcessMemory
PID:904

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop nethttpservice
3⤵
PID:1900

C:\Windows\SysWOW64\net.exe
net stop serviceupdater
2⤵
- Suspicious use of WriteProcessMemory
PID:1520

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop serviceupdater
3⤵
PID:452

C:\Windows\SysWOW64\installd.exe
"C:\Windows\system32\installd.exe" nethfdrv
2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1788

C:\Windows\SysWOW64\nethtsrv.exe
"C:\Windows\system32\nethtsrv.exe" -nfdi
2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1612

C:\Windows\SysWOW64\netupdsrv.exe
"C:\Windows\system32\netupdsrv.exe" -nfdi
2⤵
- Executes dropped EXE
PID:1924

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\hfnapi.dll
Filesize
106KB

MD5
2fbb2ae083d134a6b2f93178e8cc072f

SHA1
4db2ae0782be3dce8038d2a907cb5f3af5608dec

SHA256
8df622160602d9914c6ada078d3d5e08b7683d1a9ee1568660195f056aa3eba7

SHA512
dbdd9f7fbd11f67d77bc66281d61aeb2e8338e3fe486481ff507c23a1014e11a0f7735c238e602380244d517fb1befeaff09a33c075f4a06460ad9522cf6d9cc

Download Submit
C:\Windows\SysWOW64\hfpapi.dll
Filesize
241KB

MD5
8c9f45205726d7f72e5160c19a0474b2

SHA1
7b3ae5f036442c1e6cd63bad3ece7e88edd2d6a2

SHA256
29714b5bc580ff944c333cec895dad30e52d558b759bffd72b0d8d4ef9f09385

SHA512
989a8afb6795a9ccde879ef9c14cead34f728d6d878f2dca364ebdfd83cac64c1bc7e9d84a42c61933044fee6f54e8d8c6087ed17b9ffa8830d4557a84972dfc

Download Submit
C:\Windows\SysWOW64\installd.exe
Filesize
108KB

MD5
d09a1a4068f7a7a2009bd9c22c6122d2

SHA1
8567fe0a9f6c6feb180a3118f2c4672cda650419

SHA256
3b6169667402118a9c6cb8b9cafcce2090f37bc2faac259907a9fc9a902234d1

SHA512
4dbb89c498966cd7a4d96a691ba634bbbc0efa9a3bd673fa581b12c4313d3cf35a0d725961416f094f175e8c0077d147ce600ff15462f123bf91c22ea3557ba5

Download Submit
C:\Windows\SysWOW64\nethtsrv.exe
Filesize
176KB

MD5
e6b5adf447a529e0d0dbb28eeaacfb30

SHA1
3d59bc0072478e62d6a852f12e7a4d5d7f0b1c8b

SHA256
daa7d25b2889852c628f5369d5ea7e979f96af2319e463f1c190cd4c9e75e624

SHA512
e9cb659c12d3eb73e949d8c0c8ea459b097574091d0d95edeb2a4d2f66b515858b522dce29439f40618e69fd272d2e6d02f020e38464e3e10bdb920a522428cb

Download Submit
C:\Windows\SysWOW64\netupdsrv.exe
Filesize
158KB

MD5
598de7c2c983daac533f0e5f554f5761

SHA1
490d86a8765c6ba3c8691a368a2912d35821b71e

SHA256
fdeb8b9b3fc164655bee9c923a76152ec8a41c60d82fb6e5459dfeec4287eccd

SHA512
e998f961130e6f92aa5d14ec3ce02e9b82421a299d84b20ae9e0b82e10b59d5245839585ffff1032e71757f032ef143be4b8049a4f2486da65fd84a9f6cd675d

Download Submit
\Users\Admin\AppData\Local\Temp\nsuFCE8.tmp\System.dll
Filesize
11KB

MD5
c17103ae9072a06da581dec998343fc1

SHA1
b72148c6bdfaada8b8c3f950e610ee7cf1da1f8d

SHA256
dc58d8ad81cacb0c1ed72e33bff8f23ea40b5252b5bb55d393a0903e6819ae2f

SHA512
d32a71aaef18e993f28096d536e41c4d016850721b31171513ce28bbd805a54fd290b7c3e9d935f72e676a1acfb4f0dcc89d95040a0dd29f2b6975855c18986f

Download Submit
\Users\Admin\AppData\Local\Temp\nsuFCE8.tmp\nsExec.dll
Filesize
6KB

MD5
acc2b699edfea5bf5aae45aba3a41e96

SHA1
d2accf4d494e43ceb2cff69abe4dd17147d29cc2

SHA256
168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e

SHA512
e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe

Download Submit
\Users\Admin\AppData\Local\Temp\nsuFCE8.tmp\nsExec.dll
Filesize
6KB

MD5
acc2b699edfea5bf5aae45aba3a41e96

SHA1
d2accf4d494e43ceb2cff69abe4dd17147d29cc2

SHA256
168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e

SHA512
e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe

Download Submit
\Windows\SysWOW64\hfnapi.dll
Filesize
106KB

MD5
2fbb2ae083d134a6b2f93178e8cc072f

SHA1
4db2ae0782be3dce8038d2a907cb5f3af5608dec

SHA256
8df622160602d9914c6ada078d3d5e08b7683d1a9ee1568660195f056aa3eba7

SHA512
dbdd9f7fbd11f67d77bc66281d61aeb2e8338e3fe486481ff507c23a1014e11a0f7735c238e602380244d517fb1befeaff09a33c075f4a06460ad9522cf6d9cc

Download Submit
\Windows\SysWOW64\hfnapi.dll
Filesize
106KB

MD5
2fbb2ae083d134a6b2f93178e8cc072f

SHA1
4db2ae0782be3dce8038d2a907cb5f3af5608dec

SHA256
8df622160602d9914c6ada078d3d5e08b7683d1a9ee1568660195f056aa3eba7

SHA512
dbdd9f7fbd11f67d77bc66281d61aeb2e8338e3fe486481ff507c23a1014e11a0f7735c238e602380244d517fb1befeaff09a33c075f4a06460ad9522cf6d9cc

Download Submit
\Windows\SysWOW64\hfpapi.dll
Filesize
241KB

MD5
8c9f45205726d7f72e5160c19a0474b2

SHA1
7b3ae5f036442c1e6cd63bad3ece7e88edd2d6a2

SHA256
29714b5bc580ff944c333cec895dad30e52d558b759bffd72b0d8d4ef9f09385

SHA512
989a8afb6795a9ccde879ef9c14cead34f728d6d878f2dca364ebdfd83cac64c1bc7e9d84a42c61933044fee6f54e8d8c6087ed17b9ffa8830d4557a84972dfc

Download Submit
\Windows\SysWOW64\installd.exe
Filesize
108KB

MD5
d09a1a4068f7a7a2009bd9c22c6122d2

SHA1
8567fe0a9f6c6feb180a3118f2c4672cda650419

SHA256
3b6169667402118a9c6cb8b9cafcce2090f37bc2faac259907a9fc9a902234d1

SHA512
4dbb89c498966cd7a4d96a691ba634bbbc0efa9a3bd673fa581b12c4313d3cf35a0d725961416f094f175e8c0077d147ce600ff15462f123bf91c22ea3557ba5

Download Submit
\Windows\SysWOW64\nethtsrv.exe
Filesize
176KB

MD5
e6b5adf447a529e0d0dbb28eeaacfb30

SHA1
3d59bc0072478e62d6a852f12e7a4d5d7f0b1c8b

SHA256
daa7d25b2889852c628f5369d5ea7e979f96af2319e463f1c190cd4c9e75e624

SHA512
e9cb659c12d3eb73e949d8c0c8ea459b097574091d0d95edeb2a4d2f66b515858b522dce29439f40618e69fd272d2e6d02f020e38464e3e10bdb920a522428cb

Download Submit
\Windows\SysWOW64\netupdsrv.exe
Filesize
158KB

MD5
598de7c2c983daac533f0e5f554f5761

SHA1
490d86a8765c6ba3c8691a368a2912d35821b71e

SHA256
fdeb8b9b3fc164655bee9c923a76152ec8a41c60d82fb6e5459dfeec4287eccd

SHA512
e998f961130e6f92aa5d14ec3ce02e9b82421a299d84b20ae9e0b82e10b59d5245839585ffff1032e71757f032ef143be4b8049a4f2486da65fd84a9f6cd675d

Download Submit
memory/452-62-0x0000000000000000-mapping.dmp

Download
memory/564-55-0x0000000000360000-0x00000000007BE000-memory.dmp

Filesize
4.4MB

Download
memory/564-54-0x0000000076D71000-0x0000000076D73000-memory.dmp

Filesize
8KB

Download
memory/564-69-0x0000000000360000-0x00000000007BE000-memory.dmp

Filesize
4.4MB

Download
memory/904-58-0x0000000000000000-mapping.dmp

Download
memory/1520-61-0x0000000000000000-mapping.dmp

Download
memory/1612-71-0x0000000000000000-mapping.dmp

Download
memory/1788-64-0x0000000000000000-mapping.dmp

Download
memory/1900-59-0x0000000000000000-mapping.dmp

Download
memory/1924-77-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads