5172450a293dc60392305523594d6be66f0d32c02ed7ca19475e2766bddc0edb

Analysis

max time kernel
206s
max time network
30s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
23-11-2022 10:26

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

5172450a293dc60392305523594d6be66f0d32c02ed7ca19475e2766bddc0edb.exe
Size

600KB
MD5

72bed3b06a0ab3ce4298a814def3e8f7
SHA1

e32f03cb18949238847c7829719f92d9410ca2d9
SHA256

5172450a293dc60392305523594d6be66f0d32c02ed7ca19475e2766bddc0edb
SHA512

0d45ca8250edcdb0d3a55959185748f9fb2a98cfb3959acbe7ab60e5a2ba62963eaffa9a46bb110ace4412565fd69f36df532a70889d67cac3993043b522d88e
SSDEEP

12288:jIny5DYT15GJAJuW5VQSscvX9hYKBZ27oQYpFZN:rUTeJOJ5VQOvXgo7N

Score

8^/10

discovery

Malware Config

Signatures

Drops file in Drivers directory 1 IoCs

Processes:

5172450a293dc60392305523594d6be66f0d32c02ed7ca19475e2766bddc0edb.exe

description ioc process

File created C:\Windows\system32\drivers\nethfdrv.sys 5172450a293dc60392305523594d6be66f0d32c02ed7ca19475e2766bddc0edb.exe
Executes dropped EXE 3 IoCs

Processes:

installd.exenethtsrv.exenetupdsrv.exe

pid process

336 installd.exe
636 nethtsrv.exe
1252 netupdsrv.exe

description	ioc	process
File created	C:\Windows\system32\drivers\nethfdrv.sys	5172450a293dc60392305523594d6be66f0d32c02ed7ca19475e2766bddc0edb.exe

pid	process
336	installd.exe
636	nethtsrv.exe
1252	netupdsrv.exe

Loads dropped DLL 9 IoCs

Processes:

5172450a293dc60392305523594d6be66f0d32c02ed7ca19475e2766bddc0edb.exeinstalld.exenethtsrv.exe

pid	process
900	5172450a293dc60392305523594d6be66f0d32c02ed7ca19475e2766bddc0edb.exe
900	5172450a293dc60392305523594d6be66f0d32c02ed7ca19475e2766bddc0edb.exe
900	5172450a293dc60392305523594d6be66f0d32c02ed7ca19475e2766bddc0edb.exe
900	5172450a293dc60392305523594d6be66f0d32c02ed7ca19475e2766bddc0edb.exe
336	installd.exe
900	5172450a293dc60392305523594d6be66f0d32c02ed7ca19475e2766bddc0edb.exe
636	nethtsrv.exe
636	nethtsrv.exe
900	5172450a293dc60392305523594d6be66f0d32c02ed7ca19475e2766bddc0edb.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in System32 directory 5 IoCs

Processes:

5172450a293dc60392305523594d6be66f0d32c02ed7ca19475e2766bddc0edb.exe

description	ioc	process
File created	C:\Windows\SysWOW64\hfnapi.dll	5172450a293dc60392305523594d6be66f0d32c02ed7ca19475e2766bddc0edb.exe
File created	C:\Windows\SysWOW64\hfpapi.dll	5172450a293dc60392305523594d6be66f0d32c02ed7ca19475e2766bddc0edb.exe
File created	C:\Windows\SysWOW64\installd.exe	5172450a293dc60392305523594d6be66f0d32c02ed7ca19475e2766bddc0edb.exe
File created	C:\Windows\SysWOW64\nethtsrv.exe	5172450a293dc60392305523594d6be66f0d32c02ed7ca19475e2766bddc0edb.exe
File created	C:\Windows\SysWOW64\netupdsrv.exe	5172450a293dc60392305523594d6be66f0d32c02ed7ca19475e2766bddc0edb.exe

Drops file in Program Files directory 3 IoCs

Processes:

5172450a293dc60392305523594d6be66f0d32c02ed7ca19475e2766bddc0edb.exe

description	ioc	process
File created	C:\Program Files (x86)\Common Files\Config\ver.xml	5172450a293dc60392305523594d6be66f0d32c02ed7ca19475e2766bddc0edb.exe
File created	C:\Program Files (x86)\Common Files\config\uninstinethnfd.exe	5172450a293dc60392305523594d6be66f0d32c02ed7ca19475e2766bddc0edb.exe
File created	C:\Program Files (x86)\Common Files\Config\data.xml	5172450a293dc60392305523594d6be66f0d32c02ed7ca19475e2766bddc0edb.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Runs net.exe
Suspicious behavior: LoadsDriver 1 IoCs

Processes:

pid process

464

pid	process
464

Suspicious use of WriteProcessMemory 34 IoCs

Processes:

5172450a293dc60392305523594d6be66f0d32c02ed7ca19475e2766bddc0edb.exenet.exenet.exe

description	pid	process	target process
PID 900 wrote to memory of 516	900	5172450a293dc60392305523594d6be66f0d32c02ed7ca19475e2766bddc0edb.exe	net.exe
PID 900 wrote to memory of 516	900	5172450a293dc60392305523594d6be66f0d32c02ed7ca19475e2766bddc0edb.exe	net.exe
PID 900 wrote to memory of 516	900	5172450a293dc60392305523594d6be66f0d32c02ed7ca19475e2766bddc0edb.exe	net.exe
PID 900 wrote to memory of 516	900	5172450a293dc60392305523594d6be66f0d32c02ed7ca19475e2766bddc0edb.exe	net.exe
PID 516 wrote to memory of 876	516	net.exe	net1.exe
PID 516 wrote to memory of 876	516	net.exe	net1.exe
PID 516 wrote to memory of 876	516	net.exe	net1.exe
PID 516 wrote to memory of 876	516	net.exe	net1.exe
PID 900 wrote to memory of 704	900	5172450a293dc60392305523594d6be66f0d32c02ed7ca19475e2766bddc0edb.exe	net.exe
PID 900 wrote to memory of 704	900	5172450a293dc60392305523594d6be66f0d32c02ed7ca19475e2766bddc0edb.exe	net.exe
PID 900 wrote to memory of 704	900	5172450a293dc60392305523594d6be66f0d32c02ed7ca19475e2766bddc0edb.exe	net.exe
PID 900 wrote to memory of 704	900	5172450a293dc60392305523594d6be66f0d32c02ed7ca19475e2766bddc0edb.exe	net.exe
PID 704 wrote to memory of 924	704	net.exe	net1.exe
PID 704 wrote to memory of 924	704	net.exe	net1.exe
PID 704 wrote to memory of 924	704	net.exe	net1.exe
PID 704 wrote to memory of 924	704	net.exe	net1.exe
PID 900 wrote to memory of 336	900	5172450a293dc60392305523594d6be66f0d32c02ed7ca19475e2766bddc0edb.exe	installd.exe
PID 900 wrote to memory of 336	900	5172450a293dc60392305523594d6be66f0d32c02ed7ca19475e2766bddc0edb.exe	installd.exe
PID 900 wrote to memory of 336	900	5172450a293dc60392305523594d6be66f0d32c02ed7ca19475e2766bddc0edb.exe	installd.exe
PID 900 wrote to memory of 336	900	5172450a293dc60392305523594d6be66f0d32c02ed7ca19475e2766bddc0edb.exe	installd.exe
PID 900 wrote to memory of 336	900	5172450a293dc60392305523594d6be66f0d32c02ed7ca19475e2766bddc0edb.exe	installd.exe
PID 900 wrote to memory of 336	900	5172450a293dc60392305523594d6be66f0d32c02ed7ca19475e2766bddc0edb.exe	installd.exe
PID 900 wrote to memory of 336	900	5172450a293dc60392305523594d6be66f0d32c02ed7ca19475e2766bddc0edb.exe	installd.exe
PID 900 wrote to memory of 636	900	5172450a293dc60392305523594d6be66f0d32c02ed7ca19475e2766bddc0edb.exe	nethtsrv.exe
PID 900 wrote to memory of 636	900	5172450a293dc60392305523594d6be66f0d32c02ed7ca19475e2766bddc0edb.exe	nethtsrv.exe
PID 900 wrote to memory of 636	900	5172450a293dc60392305523594d6be66f0d32c02ed7ca19475e2766bddc0edb.exe	nethtsrv.exe
PID 900 wrote to memory of 636	900	5172450a293dc60392305523594d6be66f0d32c02ed7ca19475e2766bddc0edb.exe	nethtsrv.exe
PID 900 wrote to memory of 1252	900	5172450a293dc60392305523594d6be66f0d32c02ed7ca19475e2766bddc0edb.exe	netupdsrv.exe
PID 900 wrote to memory of 1252	900	5172450a293dc60392305523594d6be66f0d32c02ed7ca19475e2766bddc0edb.exe	netupdsrv.exe
PID 900 wrote to memory of 1252	900	5172450a293dc60392305523594d6be66f0d32c02ed7ca19475e2766bddc0edb.exe	netupdsrv.exe
PID 900 wrote to memory of 1252	900	5172450a293dc60392305523594d6be66f0d32c02ed7ca19475e2766bddc0edb.exe	netupdsrv.exe
PID 900 wrote to memory of 1252	900	5172450a293dc60392305523594d6be66f0d32c02ed7ca19475e2766bddc0edb.exe	netupdsrv.exe
PID 900 wrote to memory of 1252	900	5172450a293dc60392305523594d6be66f0d32c02ed7ca19475e2766bddc0edb.exe	netupdsrv.exe
PID 900 wrote to memory of 1252	900	5172450a293dc60392305523594d6be66f0d32c02ed7ca19475e2766bddc0edb.exe	netupdsrv.exe

C:\Users\Admin\AppData\Local\Temp\5172450a293dc60392305523594d6be66f0d32c02ed7ca19475e2766bddc0edb.exe
"C:\Users\Admin\AppData\Local\Temp\5172450a293dc60392305523594d6be66f0d32c02ed7ca19475e2766bddc0edb.exe"
1⤵
- Drops file in Drivers directory
- Loads dropped DLL
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:900

C:\Windows\SysWOW64\net.exe
net stop nethttpservice
2⤵
- Suspicious use of WriteProcessMemory
PID:516

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop nethttpservice
3⤵
PID:876

C:\Windows\SysWOW64\net.exe
net stop serviceupdater
2⤵
- Suspicious use of WriteProcessMemory
PID:704

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop serviceupdater
3⤵
PID:924

C:\Windows\SysWOW64\installd.exe
"C:\Windows\system32\installd.exe" nethfdrv
2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:336

C:\Windows\SysWOW64\nethtsrv.exe
"C:\Windows\system32\nethtsrv.exe" -nfdi
2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:636

C:\Windows\SysWOW64\netupdsrv.exe
"C:\Windows\system32\netupdsrv.exe" -nfdi
2⤵
- Executes dropped EXE
PID:1252

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\hfnapi.dll

Filesize
106KB

MD5
6e4c711af0331899dd54f245fbdcadc7

SHA1
0e22c34b9193989db7865d5cdb34c980cc89884c

SHA256
f7a5d7fa2f9a36804b2cdc0328c95ba4e132d0c49adabe1c1e118ad8dc20c3a3

SHA512
729a628213ff11a0b62150cd22f9f7cbcd7ad774b3e6e00f26d1e531c6e3b766d7d2ae9ea4f43bbf6ef05e6be62f18b6ed333234a2a920e24978f7099832e0c0

Download Submit
C:\Windows\SysWOW64\hfpapi.dll

Filesize
241KB

MD5
95ee59d7d55e92914bfa1bf4498a88c8

SHA1
43262e93128a9e65c8f30fa45fd072ca8a467795

SHA256
40e4d398f76924638080db088eabea2050b95ee8077faaaadb508883c71ca09d

SHA512
f0464e586731163f938fcd652ade2a6e875894ffd1120529dddf62e071866f1a86b26fdcab925327a183f58b462c97b8e79f5846b6fcca3fb27f1702313433e4

Download Submit
C:\Windows\SysWOW64\installd.exe

Filesize
108KB

MD5
05f9ffc69b9fc3e5f77df471da473923

SHA1
be5dd794afc00c997598cd226b47f8a61d0e369e

SHA256
dad02919db425bb8703b3c970e1d294f01551cf9c100ecd8b07925ea1e5e6ba1

SHA512
1245b77c68c9b5f2a45e25e543e493cdf3e1128cf90fb011c81b3233c5b32f99a9bef4956a41e2cb63e23e3a549fe46df00905e860e939772faa88b394cbbc65

Download Submit
C:\Windows\SysWOW64\nethtsrv.exe

Filesize
176KB

MD5
f7a0c6ae0d8f6d41e487c9184e35a5f3

SHA1
d8365d6fd704f62ef5e38148eb7b2c3155d29a35

SHA256
adcb7996b5a104d2891e03f495debe17c077da9410e6a27cbcadd3c5dd922a46

SHA512
cfdb23a78110a1118ff54c3ea0036a596d591e7bd34c65e0d51714b31f288a678354cb94c54a6b4ff63e8112263c02e0559a58111776e1e960aac990ea97d999

Download Submit
C:\Windows\SysWOW64\netupdsrv.exe

Filesize
158KB

MD5
5058f42dc289b13bdfcda11e4e124c38

SHA1
7875c69b6301aed4b18f256acf7f2053d5d7a39f

SHA256
18488e694250ee27c5a4aaa5ac97fdb0c3ad0e2fec133797bf9e39a8dabdcc1e

SHA512
523ecf44a78b1860bc06f8d31f3e09d133fa3f64ce13fa1cca59f770e3aeb05ac2523d72d3529867c7756fb3b32a643e6fac7a314e92d67674e29f35e259b255

Download Submit
\Users\Admin\AppData\Local\Temp\nskDCAC.tmp\System.dll

Filesize
11KB

MD5
c17103ae9072a06da581dec998343fc1

SHA1
b72148c6bdfaada8b8c3f950e610ee7cf1da1f8d

SHA256
dc58d8ad81cacb0c1ed72e33bff8f23ea40b5252b5bb55d393a0903e6819ae2f

SHA512
d32a71aaef18e993f28096d536e41c4d016850721b31171513ce28bbd805a54fd290b7c3e9d935f72e676a1acfb4f0dcc89d95040a0dd29f2b6975855c18986f

Download Submit
\Users\Admin\AppData\Local\Temp\nskDCAC.tmp\nsExec.dll

Filesize
6KB

MD5
acc2b699edfea5bf5aae45aba3a41e96

SHA1
d2accf4d494e43ceb2cff69abe4dd17147d29cc2

SHA256
168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e

SHA512
e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe

Download Submit
\Users\Admin\AppData\Local\Temp\nskDCAC.tmp\nsExec.dll

Filesize
6KB

MD5
acc2b699edfea5bf5aae45aba3a41e96

SHA1
d2accf4d494e43ceb2cff69abe4dd17147d29cc2

SHA256
168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e

SHA512
e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe

Download Submit
\Windows\SysWOW64\hfnapi.dll

Filesize
106KB

MD5
6e4c711af0331899dd54f245fbdcadc7

SHA1
0e22c34b9193989db7865d5cdb34c980cc89884c

SHA256
f7a5d7fa2f9a36804b2cdc0328c95ba4e132d0c49adabe1c1e118ad8dc20c3a3

SHA512
729a628213ff11a0b62150cd22f9f7cbcd7ad774b3e6e00f26d1e531c6e3b766d7d2ae9ea4f43bbf6ef05e6be62f18b6ed333234a2a920e24978f7099832e0c0

Download Submit
\Windows\SysWOW64\hfnapi.dll

Filesize
106KB

MD5
6e4c711af0331899dd54f245fbdcadc7

SHA1
0e22c34b9193989db7865d5cdb34c980cc89884c

SHA256
f7a5d7fa2f9a36804b2cdc0328c95ba4e132d0c49adabe1c1e118ad8dc20c3a3

SHA512
729a628213ff11a0b62150cd22f9f7cbcd7ad774b3e6e00f26d1e531c6e3b766d7d2ae9ea4f43bbf6ef05e6be62f18b6ed333234a2a920e24978f7099832e0c0

Download Submit
\Windows\SysWOW64\hfpapi.dll

Filesize
241KB

MD5
95ee59d7d55e92914bfa1bf4498a88c8

SHA1
43262e93128a9e65c8f30fa45fd072ca8a467795

SHA256
40e4d398f76924638080db088eabea2050b95ee8077faaaadb508883c71ca09d

SHA512
f0464e586731163f938fcd652ade2a6e875894ffd1120529dddf62e071866f1a86b26fdcab925327a183f58b462c97b8e79f5846b6fcca3fb27f1702313433e4

Download Submit
\Windows\SysWOW64\installd.exe

Filesize
108KB

MD5
05f9ffc69b9fc3e5f77df471da473923

SHA1
be5dd794afc00c997598cd226b47f8a61d0e369e

SHA256
dad02919db425bb8703b3c970e1d294f01551cf9c100ecd8b07925ea1e5e6ba1

SHA512
1245b77c68c9b5f2a45e25e543e493cdf3e1128cf90fb011c81b3233c5b32f99a9bef4956a41e2cb63e23e3a549fe46df00905e860e939772faa88b394cbbc65

Download Submit
\Windows\SysWOW64\nethtsrv.exe

Filesize
176KB

MD5
f7a0c6ae0d8f6d41e487c9184e35a5f3

SHA1
d8365d6fd704f62ef5e38148eb7b2c3155d29a35

SHA256
adcb7996b5a104d2891e03f495debe17c077da9410e6a27cbcadd3c5dd922a46

SHA512
cfdb23a78110a1118ff54c3ea0036a596d591e7bd34c65e0d51714b31f288a678354cb94c54a6b4ff63e8112263c02e0559a58111776e1e960aac990ea97d999

Download Submit
\Windows\SysWOW64\netupdsrv.exe

Filesize
158KB

MD5
5058f42dc289b13bdfcda11e4e124c38

SHA1
7875c69b6301aed4b18f256acf7f2053d5d7a39f

SHA256
18488e694250ee27c5a4aaa5ac97fdb0c3ad0e2fec133797bf9e39a8dabdcc1e

SHA512
523ecf44a78b1860bc06f8d31f3e09d133fa3f64ce13fa1cca59f770e3aeb05ac2523d72d3529867c7756fb3b32a643e6fac7a314e92d67674e29f35e259b255

Download Submit
memory/336-64-0x0000000000000000-mapping.dmp

Download
memory/516-58-0x0000000000000000-mapping.dmp

Download
memory/636-71-0x0000000000000000-mapping.dmp

Download
memory/704-61-0x0000000000000000-mapping.dmp

Download
memory/876-59-0x0000000000000000-mapping.dmp

Download
memory/900-69-0x0000000000360000-0x00000000007BE000-memory.dmp

Filesize
4.4MB

Download
memory/900-54-0x0000000075FF1000-0x0000000075FF3000-memory.dmp

Filesize
8KB

Download
memory/900-56-0x0000000000360000-0x00000000007BE000-memory.dmp

Filesize
4.4MB

Download
memory/924-62-0x0000000000000000-mapping.dmp

Download
memory/1252-77-0x0000000000000000-mapping.dmp

Download