5929e95e7d6b23085955a292bf1ddd68512a1f20d5bca15d954db7bd265153b5

Analysis

max time kernel
239s
max time network
336s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
23-11-2022 10:25

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

5929e95e7d6b23085955a292bf1ddd68512a1f20d5bca15d954db7bd265153b5.exe
Size

603KB
MD5

ba922bdb26f1d4561fb6df4b93efdab6
SHA1

67ec81a14e3432507617706e3e31a805cb8dceae
SHA256

5929e95e7d6b23085955a292bf1ddd68512a1f20d5bca15d954db7bd265153b5
SHA512

14573892535180cd0038f44603095fbe26363213d85563008e6b7822d8d4e6996cfb4915af81aa808d1c8aa6e2920b8b8875fdacfc7413cd1525b0840a399fb4
SSDEEP

12288:LIny5DYTmICVzaHjJ+hg8TVJkAnxIfEPkSVM4pyu9:zUTmdqJ+hLjkwd7Fpy

Score

8^/10

discovery

Malware Config

Signatures

Drops file in Drivers directory 1 IoCs

Processes:

5929e95e7d6b23085955a292bf1ddd68512a1f20d5bca15d954db7bd265153b5.exe

description ioc process

File created C:\Windows\system32\drivers\nethfdrv.sys 5929e95e7d6b23085955a292bf1ddd68512a1f20d5bca15d954db7bd265153b5.exe
Executes dropped EXE 3 IoCs

Processes:

installd.exenethtsrv.exenetupdsrv.exe

pid process

1820 installd.exe
1260 nethtsrv.exe
1944 netupdsrv.exe

description	ioc	process
File created	C:\Windows\system32\drivers\nethfdrv.sys	5929e95e7d6b23085955a292bf1ddd68512a1f20d5bca15d954db7bd265153b5.exe

pid	process
1820	installd.exe
1260	nethtsrv.exe
1944	netupdsrv.exe

Loads dropped DLL 9 IoCs

Processes:

5929e95e7d6b23085955a292bf1ddd68512a1f20d5bca15d954db7bd265153b5.exeinstalld.exenethtsrv.exe

pid	process
1868	5929e95e7d6b23085955a292bf1ddd68512a1f20d5bca15d954db7bd265153b5.exe
1868	5929e95e7d6b23085955a292bf1ddd68512a1f20d5bca15d954db7bd265153b5.exe
1868	5929e95e7d6b23085955a292bf1ddd68512a1f20d5bca15d954db7bd265153b5.exe
1868	5929e95e7d6b23085955a292bf1ddd68512a1f20d5bca15d954db7bd265153b5.exe
1820	installd.exe
1868	5929e95e7d6b23085955a292bf1ddd68512a1f20d5bca15d954db7bd265153b5.exe
1260	nethtsrv.exe
1260	nethtsrv.exe
1868	5929e95e7d6b23085955a292bf1ddd68512a1f20d5bca15d954db7bd265153b5.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in System32 directory 5 IoCs

Processes:

5929e95e7d6b23085955a292bf1ddd68512a1f20d5bca15d954db7bd265153b5.exe

description	ioc	process
File created	C:\Windows\SysWOW64\nethtsrv.exe	5929e95e7d6b23085955a292bf1ddd68512a1f20d5bca15d954db7bd265153b5.exe
File created	C:\Windows\SysWOW64\netupdsrv.exe	5929e95e7d6b23085955a292bf1ddd68512a1f20d5bca15d954db7bd265153b5.exe
File created	C:\Windows\SysWOW64\hfnapi.dll	5929e95e7d6b23085955a292bf1ddd68512a1f20d5bca15d954db7bd265153b5.exe
File created	C:\Windows\SysWOW64\hfpapi.dll	5929e95e7d6b23085955a292bf1ddd68512a1f20d5bca15d954db7bd265153b5.exe
File created	C:\Windows\SysWOW64\installd.exe	5929e95e7d6b23085955a292bf1ddd68512a1f20d5bca15d954db7bd265153b5.exe

Drops file in Program Files directory 3 IoCs

Processes:

5929e95e7d6b23085955a292bf1ddd68512a1f20d5bca15d954db7bd265153b5.exe

description	ioc	process
File created	C:\Program Files (x86)\Common Files\Config\data.xml	5929e95e7d6b23085955a292bf1ddd68512a1f20d5bca15d954db7bd265153b5.exe
File created	C:\Program Files (x86)\Common Files\Config\ver.xml	5929e95e7d6b23085955a292bf1ddd68512a1f20d5bca15d954db7bd265153b5.exe
File created	C:\Program Files (x86)\Common Files\config\uninstinethnfd.exe	5929e95e7d6b23085955a292bf1ddd68512a1f20d5bca15d954db7bd265153b5.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Runs net.exe
Suspicious behavior: LoadsDriver 1 IoCs

Processes:

pid process

460

pid	process
460

Suspicious use of WriteProcessMemory 34 IoCs

Processes:

5929e95e7d6b23085955a292bf1ddd68512a1f20d5bca15d954db7bd265153b5.exenet.exenet.exe

description	pid	process	target process
PID 1868 wrote to memory of 1672	1868	5929e95e7d6b23085955a292bf1ddd68512a1f20d5bca15d954db7bd265153b5.exe	net.exe
PID 1868 wrote to memory of 1672	1868	5929e95e7d6b23085955a292bf1ddd68512a1f20d5bca15d954db7bd265153b5.exe	net.exe
PID 1868 wrote to memory of 1672	1868	5929e95e7d6b23085955a292bf1ddd68512a1f20d5bca15d954db7bd265153b5.exe	net.exe
PID 1868 wrote to memory of 1672	1868	5929e95e7d6b23085955a292bf1ddd68512a1f20d5bca15d954db7bd265153b5.exe	net.exe
PID 1672 wrote to memory of 1396	1672	net.exe	net1.exe
PID 1672 wrote to memory of 1396	1672	net.exe	net1.exe
PID 1672 wrote to memory of 1396	1672	net.exe	net1.exe
PID 1672 wrote to memory of 1396	1672	net.exe	net1.exe
PID 1868 wrote to memory of 1808	1868	5929e95e7d6b23085955a292bf1ddd68512a1f20d5bca15d954db7bd265153b5.exe	net.exe
PID 1868 wrote to memory of 1808	1868	5929e95e7d6b23085955a292bf1ddd68512a1f20d5bca15d954db7bd265153b5.exe	net.exe
PID 1868 wrote to memory of 1808	1868	5929e95e7d6b23085955a292bf1ddd68512a1f20d5bca15d954db7bd265153b5.exe	net.exe
PID 1868 wrote to memory of 1808	1868	5929e95e7d6b23085955a292bf1ddd68512a1f20d5bca15d954db7bd265153b5.exe	net.exe
PID 1808 wrote to memory of 1064	1808	net.exe	net1.exe
PID 1808 wrote to memory of 1064	1808	net.exe	net1.exe
PID 1808 wrote to memory of 1064	1808	net.exe	net1.exe
PID 1808 wrote to memory of 1064	1808	net.exe	net1.exe
PID 1868 wrote to memory of 1820	1868	5929e95e7d6b23085955a292bf1ddd68512a1f20d5bca15d954db7bd265153b5.exe	installd.exe
PID 1868 wrote to memory of 1820	1868	5929e95e7d6b23085955a292bf1ddd68512a1f20d5bca15d954db7bd265153b5.exe	installd.exe
PID 1868 wrote to memory of 1820	1868	5929e95e7d6b23085955a292bf1ddd68512a1f20d5bca15d954db7bd265153b5.exe	installd.exe
PID 1868 wrote to memory of 1820	1868	5929e95e7d6b23085955a292bf1ddd68512a1f20d5bca15d954db7bd265153b5.exe	installd.exe
PID 1868 wrote to memory of 1820	1868	5929e95e7d6b23085955a292bf1ddd68512a1f20d5bca15d954db7bd265153b5.exe	installd.exe
PID 1868 wrote to memory of 1820	1868	5929e95e7d6b23085955a292bf1ddd68512a1f20d5bca15d954db7bd265153b5.exe	installd.exe
PID 1868 wrote to memory of 1820	1868	5929e95e7d6b23085955a292bf1ddd68512a1f20d5bca15d954db7bd265153b5.exe	installd.exe
PID 1868 wrote to memory of 1260	1868	5929e95e7d6b23085955a292bf1ddd68512a1f20d5bca15d954db7bd265153b5.exe	nethtsrv.exe
PID 1868 wrote to memory of 1260	1868	5929e95e7d6b23085955a292bf1ddd68512a1f20d5bca15d954db7bd265153b5.exe	nethtsrv.exe
PID 1868 wrote to memory of 1260	1868	5929e95e7d6b23085955a292bf1ddd68512a1f20d5bca15d954db7bd265153b5.exe	nethtsrv.exe
PID 1868 wrote to memory of 1260	1868	5929e95e7d6b23085955a292bf1ddd68512a1f20d5bca15d954db7bd265153b5.exe	nethtsrv.exe
PID 1868 wrote to memory of 1944	1868	5929e95e7d6b23085955a292bf1ddd68512a1f20d5bca15d954db7bd265153b5.exe	netupdsrv.exe
PID 1868 wrote to memory of 1944	1868	5929e95e7d6b23085955a292bf1ddd68512a1f20d5bca15d954db7bd265153b5.exe	netupdsrv.exe
PID 1868 wrote to memory of 1944	1868	5929e95e7d6b23085955a292bf1ddd68512a1f20d5bca15d954db7bd265153b5.exe	netupdsrv.exe
PID 1868 wrote to memory of 1944	1868	5929e95e7d6b23085955a292bf1ddd68512a1f20d5bca15d954db7bd265153b5.exe	netupdsrv.exe
PID 1868 wrote to memory of 1944	1868	5929e95e7d6b23085955a292bf1ddd68512a1f20d5bca15d954db7bd265153b5.exe	netupdsrv.exe
PID 1868 wrote to memory of 1944	1868	5929e95e7d6b23085955a292bf1ddd68512a1f20d5bca15d954db7bd265153b5.exe	netupdsrv.exe
PID 1868 wrote to memory of 1944	1868	5929e95e7d6b23085955a292bf1ddd68512a1f20d5bca15d954db7bd265153b5.exe	netupdsrv.exe

C:\Users\Admin\AppData\Local\Temp\5929e95e7d6b23085955a292bf1ddd68512a1f20d5bca15d954db7bd265153b5.exe
"C:\Users\Admin\AppData\Local\Temp\5929e95e7d6b23085955a292bf1ddd68512a1f20d5bca15d954db7bd265153b5.exe"
1⤵
- Drops file in Drivers directory
- Loads dropped DLL
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:1868

C:\Windows\SysWOW64\net.exe
net stop nethttpservice
2⤵
- Suspicious use of WriteProcessMemory
PID:1672

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop nethttpservice
3⤵
PID:1396

C:\Windows\SysWOW64\net.exe
net stop serviceupdater
2⤵
- Suspicious use of WriteProcessMemory
PID:1808

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop serviceupdater
3⤵
PID:1064

C:\Windows\SysWOW64\installd.exe
"C:\Windows\system32\installd.exe" nethfdrv
2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1820

C:\Windows\SysWOW64\nethtsrv.exe
"C:\Windows\system32\nethtsrv.exe" -nfdi
2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1260

C:\Windows\SysWOW64\netupdsrv.exe
"C:\Windows\system32\netupdsrv.exe" -nfdi
2⤵
- Executes dropped EXE
PID:1944

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\hfnapi.dll

Filesize
106KB

MD5
655c5301865b859d5d57ab2985287208

SHA1
c8c79a6d70428cb7ddaeed3df4f88851e1724757

SHA256
595280b02bb03dc1db275b73a197a19dbcd75963a7d96d09da6baed5338d3d1b

SHA512
1cbef134fbc6ece933735b78f5e5792d71133f7bf3458af00a2886bab3141787c1b25c9c6c0ee3b6c64b84b4f2b535f3a41d0ee66ba932582459f9591e8170e5

Download Submit
C:\Windows\SysWOW64\hfpapi.dll

Filesize
244KB

MD5
ee879f712ea16c7fcc3a541c87226776

SHA1
0fa12ebdc335a98ba5da93a274db7cabed371f99

SHA256
834e5fbd2ccbb476fa3954008044288789896d64917f1f810124978b90dd3a12

SHA512
3be0bc91858a169d7f90fea174aaed7f336c9f9824b43996c37a6e559435e51f8edc95416494aa0531d04b6fac67eb28044c2ade24420bb09a7867710f21b795

Download Submit
C:\Windows\SysWOW64\installd.exe

Filesize
108KB

MD5
408cd5dc4e08123837bf2bcc0d7d684c

SHA1
38562b61e528a563a96ca737785d2276becaf0d2

SHA256
a47fce214d19b15b1e9cebd1dca0c30c845fe91ae8708608711ac0241faaee39

SHA512
3470e3989ef94bf63e0aab8ac552c0a34dacf0d6397416f2a3c03bcf3d415f496162da2eb66f05aaedc4ab306418eb7a871caa8182794367808d046a43ed070c

Download Submit
C:\Windows\SysWOW64\nethtsrv.exe

Filesize
176KB

MD5
97559023968944f4079c37a1c0b1e4c0

SHA1
1c39f67692520b9ea5093d7a59cae558f376618c

SHA256
956de89e3d18e19fad3dbf95652b563bb67a85a761d368fbee7d5af33e824a6c

SHA512
ac7b90f6cac84b6eb8b4d488299d400d8e1ed934a0f20a905d6da641abfe5ca1bece986e652a4d41f52b9b99a48d2ee8f96d390c62568a11d4302df02333cb35

Download Submit
C:\Windows\SysWOW64\netupdsrv.exe

Filesize
158KB

MD5
1e642ee86ad6865cc26a7a7ff858d6a1

SHA1
c1d41dcafd339a923daaa2d55ca72460f99b252b

SHA256
0ba1b5bdca9d7578d5683b262555502bd30273e2d2dce03066f1484b5d80c0d7

SHA512
3c6b4450b087fae5da9bdbf8d83e28a45d427d993ea0fc05ff2d064d65011c4fcf9b0a46c6d9a9af879ba2a1a0fb1df25ed620e63767e5f505c39bd63c37831e

Download Submit
\Users\Admin\AppData\Local\Temp\nsf3AB3.tmp\System.dll

Filesize
11KB

MD5
c17103ae9072a06da581dec998343fc1

SHA1
b72148c6bdfaada8b8c3f950e610ee7cf1da1f8d

SHA256
dc58d8ad81cacb0c1ed72e33bff8f23ea40b5252b5bb55d393a0903e6819ae2f

SHA512
d32a71aaef18e993f28096d536e41c4d016850721b31171513ce28bbd805a54fd290b7c3e9d935f72e676a1acfb4f0dcc89d95040a0dd29f2b6975855c18986f

Download Submit
\Users\Admin\AppData\Local\Temp\nsf3AB3.tmp\nsExec.dll

Filesize
6KB

MD5
acc2b699edfea5bf5aae45aba3a41e96

SHA1
d2accf4d494e43ceb2cff69abe4dd17147d29cc2

SHA256
168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e

SHA512
e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe

Download Submit
\Users\Admin\AppData\Local\Temp\nsf3AB3.tmp\nsExec.dll

Filesize
6KB

MD5
acc2b699edfea5bf5aae45aba3a41e96

SHA1
d2accf4d494e43ceb2cff69abe4dd17147d29cc2

SHA256
168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e

SHA512
e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe

Download Submit
\Windows\SysWOW64\hfnapi.dll

Filesize
106KB

MD5
655c5301865b859d5d57ab2985287208

SHA1
c8c79a6d70428cb7ddaeed3df4f88851e1724757

SHA256
595280b02bb03dc1db275b73a197a19dbcd75963a7d96d09da6baed5338d3d1b

SHA512
1cbef134fbc6ece933735b78f5e5792d71133f7bf3458af00a2886bab3141787c1b25c9c6c0ee3b6c64b84b4f2b535f3a41d0ee66ba932582459f9591e8170e5

Download Submit
\Windows\SysWOW64\hfnapi.dll

Filesize
106KB

MD5
655c5301865b859d5d57ab2985287208

SHA1
c8c79a6d70428cb7ddaeed3df4f88851e1724757

SHA256
595280b02bb03dc1db275b73a197a19dbcd75963a7d96d09da6baed5338d3d1b

SHA512
1cbef134fbc6ece933735b78f5e5792d71133f7bf3458af00a2886bab3141787c1b25c9c6c0ee3b6c64b84b4f2b535f3a41d0ee66ba932582459f9591e8170e5

Download Submit
\Windows\SysWOW64\hfpapi.dll

Filesize
244KB

MD5
ee879f712ea16c7fcc3a541c87226776

SHA1
0fa12ebdc335a98ba5da93a274db7cabed371f99

SHA256
834e5fbd2ccbb476fa3954008044288789896d64917f1f810124978b90dd3a12

SHA512
3be0bc91858a169d7f90fea174aaed7f336c9f9824b43996c37a6e559435e51f8edc95416494aa0531d04b6fac67eb28044c2ade24420bb09a7867710f21b795

Download Submit
\Windows\SysWOW64\installd.exe

Filesize
108KB

MD5
408cd5dc4e08123837bf2bcc0d7d684c

SHA1
38562b61e528a563a96ca737785d2276becaf0d2

SHA256
a47fce214d19b15b1e9cebd1dca0c30c845fe91ae8708608711ac0241faaee39

SHA512
3470e3989ef94bf63e0aab8ac552c0a34dacf0d6397416f2a3c03bcf3d415f496162da2eb66f05aaedc4ab306418eb7a871caa8182794367808d046a43ed070c

Download Submit
\Windows\SysWOW64\nethtsrv.exe

Filesize
176KB

MD5
97559023968944f4079c37a1c0b1e4c0

SHA1
1c39f67692520b9ea5093d7a59cae558f376618c

SHA256
956de89e3d18e19fad3dbf95652b563bb67a85a761d368fbee7d5af33e824a6c

SHA512
ac7b90f6cac84b6eb8b4d488299d400d8e1ed934a0f20a905d6da641abfe5ca1bece986e652a4d41f52b9b99a48d2ee8f96d390c62568a11d4302df02333cb35

Download Submit
\Windows\SysWOW64\netupdsrv.exe

Filesize
158KB

MD5
1e642ee86ad6865cc26a7a7ff858d6a1

SHA1
c1d41dcafd339a923daaa2d55ca72460f99b252b

SHA256
0ba1b5bdca9d7578d5683b262555502bd30273e2d2dce03066f1484b5d80c0d7

SHA512
3c6b4450b087fae5da9bdbf8d83e28a45d427d993ea0fc05ff2d064d65011c4fcf9b0a46c6d9a9af879ba2a1a0fb1df25ed620e63767e5f505c39bd63c37831e

Download Submit
memory/1064-62-0x0000000000000000-mapping.dmp

Download
memory/1260-71-0x0000000000000000-mapping.dmp

Download
memory/1396-59-0x0000000000000000-mapping.dmp

Download
memory/1672-58-0x0000000000000000-mapping.dmp

Download
memory/1808-61-0x0000000000000000-mapping.dmp

Download
memory/1820-64-0x0000000000000000-mapping.dmp

Download
memory/1868-69-0x0000000000360000-0x00000000007BE000-memory.dmp

Filesize
4.4MB

Download
memory/1868-54-0x0000000075E01000-0x0000000075E03000-memory.dmp

Filesize
8KB

Download
memory/1868-55-0x0000000000360000-0x00000000007BE000-memory.dmp

Filesize
4.4MB

Download
memory/1944-77-0x0000000000000000-mapping.dmp

Download