Analysis

  • max time kernel
    90s
  • max time network
    137s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220901-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
  • submitted
    23-11-2022 10:24

General

  • Target

    696efaa29a7e3b751e074f12883ed1e00dd281641ef6878ea9ed43fb4f79af5e.exe

  • Size

    602KB

  • MD5

    29d7bedcea35c8557097c557542c1e40

  • SHA1

    3ea4061e6b3e9bf93cd514500d62d9b4d20532e6

  • SHA256

    696efaa29a7e3b751e074f12883ed1e00dd281641ef6878ea9ed43fb4f79af5e

  • SHA512

    00f98975b6c61408b45528a1fe53af7cb4142b535374609a623d9bb9bf6264ae9651c73dedea69974bfe537fb7d2009c6eb560ff0e37e45cc9edbc1624de98e8

  • SSDEEP

    12288:LIny5DYTSIWaadfl8xTgy/jS5sq8hRdt+aNJZATz3Kg+KFkDYSrg:zUTSthuTgy/j7hjtOXKg+IkDYSrg

Score
8/10

Malware Config

Signatures

  • Drops file in Drivers directory 1 IoCs
  • Executes dropped EXE 5 IoCs
  • Loads dropped DLL 14 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Drops file in System32 directory 5 IoCs
  • Drops file in Program Files directory 3 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Modifies data under HKEY_USERS 1 IoCs
  • Runs net.exe
  • Suspicious behavior: LoadsDriver 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 33 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\696efaa29a7e3b751e074f12883ed1e00dd281641ef6878ea9ed43fb4f79af5e.exe
    "C:\Users\Admin\AppData\Local\Temp\696efaa29a7e3b751e074f12883ed1e00dd281641ef6878ea9ed43fb4f79af5e.exe"
    1⤵
    • Drops file in Drivers directory
    • Loads dropped DLL
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • Suspicious use of WriteProcessMemory
    PID:3388
    • C:\Windows\SysWOW64\net.exe
      net stop nethttpservice
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:652
      • C:\Windows\SysWOW64\net1.exe
        C:\Windows\system32\net1 stop nethttpservice
        3⤵
          PID:524
      • C:\Windows\SysWOW64\net.exe
        net stop serviceupdater
        2⤵
        • Suspicious use of WriteProcessMemory
        PID:5088
        • C:\Windows\SysWOW64\net1.exe
          C:\Windows\system32\net1 stop serviceupdater
          3⤵
            PID:2416
        • C:\Windows\SysWOW64\installd.exe
          "C:\Windows\system32\installd.exe" nethfdrv
          2⤵
          • Executes dropped EXE
          • Loads dropped DLL
          PID:1444
        • C:\Windows\SysWOW64\nethtsrv.exe
          "C:\Windows\system32\nethtsrv.exe" -nfdi
          2⤵
          • Executes dropped EXE
          • Loads dropped DLL
          PID:3748
        • C:\Windows\SysWOW64\netupdsrv.exe
          "C:\Windows\system32\netupdsrv.exe" -nfdi
          2⤵
          • Executes dropped EXE
          PID:4432
        • C:\Windows\SysWOW64\net.exe
          net start nethttpservice
          2⤵
          • Suspicious use of WriteProcessMemory
          PID:4536
          • C:\Windows\SysWOW64\net1.exe
            C:\Windows\system32\net1 start nethttpservice
            3⤵
              PID:4524
          • C:\Windows\SysWOW64\net.exe
            net start serviceupdater
            2⤵
            • Suspicious use of WriteProcessMemory
            PID:3684
            • C:\Windows\SysWOW64\net1.exe
              C:\Windows\system32\net1 start serviceupdater
              3⤵
                PID:4416
          • C:\Windows\SysWOW64\nethtsrv.exe
            C:\Windows\SysWOW64\nethtsrv.exe
            1⤵
            • Executes dropped EXE
            • Loads dropped DLL
            • Modifies data under HKEY_USERS
            • Suspicious use of AdjustPrivilegeToken
            PID:2420
          • C:\Windows\SysWOW64\netupdsrv.exe
            C:\Windows\SysWOW64\netupdsrv.exe
            1⤵
            • Executes dropped EXE
            PID:4644

          Network

          MITRE ATT&CK Enterprise v6

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • C:\Users\Admin\AppData\Local\Temp\nsjDDB5.tmp\System.dll

            Filesize

            11KB

            MD5

            c17103ae9072a06da581dec998343fc1

            SHA1

            b72148c6bdfaada8b8c3f950e610ee7cf1da1f8d

            SHA256

            dc58d8ad81cacb0c1ed72e33bff8f23ea40b5252b5bb55d393a0903e6819ae2f

            SHA512

            d32a71aaef18e993f28096d536e41c4d016850721b31171513ce28bbd805a54fd290b7c3e9d935f72e676a1acfb4f0dcc89d95040a0dd29f2b6975855c18986f

          • C:\Users\Admin\AppData\Local\Temp\nsjDDB5.tmp\nsExec.dll

            Filesize

            6KB

            MD5

            acc2b699edfea5bf5aae45aba3a41e96

            SHA1

            d2accf4d494e43ceb2cff69abe4dd17147d29cc2

            SHA256

            168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e

            SHA512

            e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe

          • C:\Users\Admin\AppData\Local\Temp\nsjDDB5.tmp\nsExec.dll

            Filesize

            6KB

            MD5

            acc2b699edfea5bf5aae45aba3a41e96

            SHA1

            d2accf4d494e43ceb2cff69abe4dd17147d29cc2

            SHA256

            168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e

            SHA512

            e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe

          • C:\Users\Admin\AppData\Local\Temp\nsjDDB5.tmp\nsExec.dll

            Filesize

            6KB

            MD5

            acc2b699edfea5bf5aae45aba3a41e96

            SHA1

            d2accf4d494e43ceb2cff69abe4dd17147d29cc2

            SHA256

            168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e

            SHA512

            e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe

          • C:\Users\Admin\AppData\Local\Temp\nsjDDB5.tmp\nsExec.dll

            Filesize

            6KB

            MD5

            acc2b699edfea5bf5aae45aba3a41e96

            SHA1

            d2accf4d494e43ceb2cff69abe4dd17147d29cc2

            SHA256

            168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e

            SHA512

            e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe

          • C:\Users\Admin\AppData\Local\Temp\nsjDDB5.tmp\nsExec.dll

            Filesize

            6KB

            MD5

            acc2b699edfea5bf5aae45aba3a41e96

            SHA1

            d2accf4d494e43ceb2cff69abe4dd17147d29cc2

            SHA256

            168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e

            SHA512

            e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe

          • C:\Users\Admin\AppData\Local\Temp\nsjDDB5.tmp\nsExec.dll

            Filesize

            6KB

            MD5

            acc2b699edfea5bf5aae45aba3a41e96

            SHA1

            d2accf4d494e43ceb2cff69abe4dd17147d29cc2

            SHA256

            168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e

            SHA512

            e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe

          • C:\Users\Admin\AppData\Local\Temp\nsjDDB5.tmp\nsExec.dll

            Filesize

            6KB

            MD5

            acc2b699edfea5bf5aae45aba3a41e96

            SHA1

            d2accf4d494e43ceb2cff69abe4dd17147d29cc2

            SHA256

            168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e

            SHA512

            e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe

          • C:\Users\Admin\AppData\Local\Temp\nsjDDB5.tmp\nsExec.dll

            Filesize

            6KB

            MD5

            acc2b699edfea5bf5aae45aba3a41e96

            SHA1

            d2accf4d494e43ceb2cff69abe4dd17147d29cc2

            SHA256

            168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e

            SHA512

            e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe

          • C:\Windows\SysWOW64\hfnapi.dll

            Filesize

            106KB

            MD5

            c3022c6a1742633eb5f2b11eca29ad8f

            SHA1

            08256a58b8e3b4e4015e4536676cdb7d72a0ecf4

            SHA256

            2fdc6c83740c45d6168ccbe6ae148f5da786971897a580750609f8d22ad9b496

            SHA512

            abced16dc3efd9db31e2b702514778aafde2d9410d54141186931f324e07572822e0c20a4789ad453a31c79ab904c99ab0745f8997f59e40286cd0c8b5754203

          • C:\Windows\SysWOW64\hfnapi.dll

            Filesize

            106KB

            MD5

            c3022c6a1742633eb5f2b11eca29ad8f

            SHA1

            08256a58b8e3b4e4015e4536676cdb7d72a0ecf4

            SHA256

            2fdc6c83740c45d6168ccbe6ae148f5da786971897a580750609f8d22ad9b496

            SHA512

            abced16dc3efd9db31e2b702514778aafde2d9410d54141186931f324e07572822e0c20a4789ad453a31c79ab904c99ab0745f8997f59e40286cd0c8b5754203

          • C:\Windows\SysWOW64\hfnapi.dll

            Filesize

            106KB

            MD5

            c3022c6a1742633eb5f2b11eca29ad8f

            SHA1

            08256a58b8e3b4e4015e4536676cdb7d72a0ecf4

            SHA256

            2fdc6c83740c45d6168ccbe6ae148f5da786971897a580750609f8d22ad9b496

            SHA512

            abced16dc3efd9db31e2b702514778aafde2d9410d54141186931f324e07572822e0c20a4789ad453a31c79ab904c99ab0745f8997f59e40286cd0c8b5754203

          • C:\Windows\SysWOW64\hfnapi.dll

            Filesize

            106KB

            MD5

            c3022c6a1742633eb5f2b11eca29ad8f

            SHA1

            08256a58b8e3b4e4015e4536676cdb7d72a0ecf4

            SHA256

            2fdc6c83740c45d6168ccbe6ae148f5da786971897a580750609f8d22ad9b496

            SHA512

            abced16dc3efd9db31e2b702514778aafde2d9410d54141186931f324e07572822e0c20a4789ad453a31c79ab904c99ab0745f8997f59e40286cd0c8b5754203

          • C:\Windows\SysWOW64\hfpapi.dll

            Filesize

            244KB

            MD5

            b1b63b642f75637bb2517986c82c7059

            SHA1

            f0aa2280f38d82167aadfc19351813d4be0a25c1

            SHA256

            ec291cc99c1c8aae65254ee36d7f944f621c317e6de935bdccd8a8198f37367b

            SHA512

            6b4ff654c9082ea765bf03509d62e383dfa1044be8c673f4a8b6fe33e89f7e3c07e5a0b786fdef481a450ad50e85fb9b88519177cf39fe872bf770892358742f

          • C:\Windows\SysWOW64\hfpapi.dll

            Filesize

            244KB

            MD5

            b1b63b642f75637bb2517986c82c7059

            SHA1

            f0aa2280f38d82167aadfc19351813d4be0a25c1

            SHA256

            ec291cc99c1c8aae65254ee36d7f944f621c317e6de935bdccd8a8198f37367b

            SHA512

            6b4ff654c9082ea765bf03509d62e383dfa1044be8c673f4a8b6fe33e89f7e3c07e5a0b786fdef481a450ad50e85fb9b88519177cf39fe872bf770892358742f

          • C:\Windows\SysWOW64\hfpapi.dll

            Filesize

            244KB

            MD5

            b1b63b642f75637bb2517986c82c7059

            SHA1

            f0aa2280f38d82167aadfc19351813d4be0a25c1

            SHA256

            ec291cc99c1c8aae65254ee36d7f944f621c317e6de935bdccd8a8198f37367b

            SHA512

            6b4ff654c9082ea765bf03509d62e383dfa1044be8c673f4a8b6fe33e89f7e3c07e5a0b786fdef481a450ad50e85fb9b88519177cf39fe872bf770892358742f

          • C:\Windows\SysWOW64\installd.exe

            Filesize

            108KB

            MD5

            a2651c290cb13be116bc3ca73a3b207b

            SHA1

            efdf614f9ea2c0a727f3c3a993aa39dc26e1c8b1

            SHA256

            06a919ffd5b00e652a111a21143c06e64e834de54bcdce9e1b5629ce11f4a881

            SHA512

            2a63d27707a2585ef41eab370e3498a751c27adab358dfad783227f7c03cf33ef5bcdb4d946713653a5719cd8bfa33e6a37ef4c26df5f7e5dc37d7ab13bc3880

          • C:\Windows\SysWOW64\installd.exe

            Filesize

            108KB

            MD5

            a2651c290cb13be116bc3ca73a3b207b

            SHA1

            efdf614f9ea2c0a727f3c3a993aa39dc26e1c8b1

            SHA256

            06a919ffd5b00e652a111a21143c06e64e834de54bcdce9e1b5629ce11f4a881

            SHA512

            2a63d27707a2585ef41eab370e3498a751c27adab358dfad783227f7c03cf33ef5bcdb4d946713653a5719cd8bfa33e6a37ef4c26df5f7e5dc37d7ab13bc3880

          • C:\Windows\SysWOW64\nethtsrv.exe

            Filesize

            176KB

            MD5

            6c417a8ed68b0852d8bf6f3d98bcc117

            SHA1

            eee134f14b3e0e98dbdb2b08c19b6be10fbd9ce4

            SHA256

            f4fd7787e6ea2284f22b84c65cfd738a6dcb8f0a449006a197a3b1ff5f9671dd

            SHA512

            c739a10864f15e4a3c52ee0076bd63ca9a5921b9ce403f9a81813044de79dd536c4d8692a457ab19ef6fb63e9b6c1b587497ca556aced0abccd91ec8f38069df

          • C:\Windows\SysWOW64\nethtsrv.exe

            Filesize

            176KB

            MD5

            6c417a8ed68b0852d8bf6f3d98bcc117

            SHA1

            eee134f14b3e0e98dbdb2b08c19b6be10fbd9ce4

            SHA256

            f4fd7787e6ea2284f22b84c65cfd738a6dcb8f0a449006a197a3b1ff5f9671dd

            SHA512

            c739a10864f15e4a3c52ee0076bd63ca9a5921b9ce403f9a81813044de79dd536c4d8692a457ab19ef6fb63e9b6c1b587497ca556aced0abccd91ec8f38069df

          • C:\Windows\SysWOW64\nethtsrv.exe

            Filesize

            176KB

            MD5

            6c417a8ed68b0852d8bf6f3d98bcc117

            SHA1

            eee134f14b3e0e98dbdb2b08c19b6be10fbd9ce4

            SHA256

            f4fd7787e6ea2284f22b84c65cfd738a6dcb8f0a449006a197a3b1ff5f9671dd

            SHA512

            c739a10864f15e4a3c52ee0076bd63ca9a5921b9ce403f9a81813044de79dd536c4d8692a457ab19ef6fb63e9b6c1b587497ca556aced0abccd91ec8f38069df

          • C:\Windows\SysWOW64\netupdsrv.exe

            Filesize

            158KB

            MD5

            5e053ef02c32afbf449633e5f64284dd

            SHA1

            058eb072d3ed585eaaa72496a476da37b74b37e7

            SHA256

            f204185466f214a5ae5d7d1786eb0c881b7cc1bbfecb0fa46b14fa635e568ac9

            SHA512

            da9196db1cdb6ad975b46556a27a3974b9c56f7bf3df599c8ff7ebd8f24f76724ea803494cd21f3e9876646ed36dea02e912a3b1ebc410da98e06a2f7411f347

          • C:\Windows\SysWOW64\netupdsrv.exe

            Filesize

            158KB

            MD5

            5e053ef02c32afbf449633e5f64284dd

            SHA1

            058eb072d3ed585eaaa72496a476da37b74b37e7

            SHA256

            f204185466f214a5ae5d7d1786eb0c881b7cc1bbfecb0fa46b14fa635e568ac9

            SHA512

            da9196db1cdb6ad975b46556a27a3974b9c56f7bf3df599c8ff7ebd8f24f76724ea803494cd21f3e9876646ed36dea02e912a3b1ebc410da98e06a2f7411f347

          • C:\Windows\SysWOW64\netupdsrv.exe

            Filesize

            158KB

            MD5

            5e053ef02c32afbf449633e5f64284dd

            SHA1

            058eb072d3ed585eaaa72496a476da37b74b37e7

            SHA256

            f204185466f214a5ae5d7d1786eb0c881b7cc1bbfecb0fa46b14fa635e568ac9

            SHA512

            da9196db1cdb6ad975b46556a27a3974b9c56f7bf3df599c8ff7ebd8f24f76724ea803494cd21f3e9876646ed36dea02e912a3b1ebc410da98e06a2f7411f347

          • memory/524-137-0x0000000000000000-mapping.dmp

          • memory/652-135-0x0000000000000000-mapping.dmp

          • memory/1444-142-0x0000000000000000-mapping.dmp

          • memory/2416-141-0x0000000000000000-mapping.dmp

          • memory/3388-136-0x0000000000360000-0x00000000007BE000-memory.dmp

            Filesize

            4.4MB

          • memory/3388-168-0x0000000000360000-0x00000000007BE000-memory.dmp

            Filesize

            4.4MB

          • memory/3684-165-0x0000000000000000-mapping.dmp

          • memory/3748-147-0x0000000000000000-mapping.dmp

          • memory/4416-166-0x0000000000000000-mapping.dmp

          • memory/4432-153-0x0000000000000000-mapping.dmp

          • memory/4524-159-0x0000000000000000-mapping.dmp

          • memory/4536-158-0x0000000000000000-mapping.dmp

          • memory/5088-140-0x0000000000000000-mapping.dmp