447e0c46c7ca74867b11e0acf27414b1f4415c8519d88a20fe8f736619189b13

Analysis

max time kernel
236s
max time network
332s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
23-11-2022 10:27

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

447e0c46c7ca74867b11e0acf27414b1f4415c8519d88a20fe8f736619189b13.exe
Size

601KB
MD5

aa94da405b5ab5774e69835a5c9aa620
SHA1

c60b09cbc34186d731b590d0fb75b17f7cd5adb7
SHA256

447e0c46c7ca74867b11e0acf27414b1f4415c8519d88a20fe8f736619189b13
SHA512

14e0c6cc9710ec932a97729a776f16767bca590e980f48fc8bec50c8c2b654c99bff5a64db9cd7687add18259e721325bfe3e3e6a160c2ac4dc9c71b20a1a753
SSDEEP

12288:XIny5DYTD+0nrRNF+fjsq9cAuWIrzkQSaulWj5fdUp:/UTD+O8fQycAu9YaulO5e

Score

8^/10

discovery

Malware Config

Signatures

Drops file in Drivers directory 1 IoCs

Processes:

447e0c46c7ca74867b11e0acf27414b1f4415c8519d88a20fe8f736619189b13.exe

description ioc process

File created C:\Windows\system32\drivers\nethfdrv.sys 447e0c46c7ca74867b11e0acf27414b1f4415c8519d88a20fe8f736619189b13.exe
Executes dropped EXE 3 IoCs

Processes:

installd.exenethtsrv.exenetupdsrv.exe

pid process

656 installd.exe
1952 nethtsrv.exe
1672 netupdsrv.exe

description	ioc	process
File created	C:\Windows\system32\drivers\nethfdrv.sys	447e0c46c7ca74867b11e0acf27414b1f4415c8519d88a20fe8f736619189b13.exe

pid	process
656	installd.exe
1952	nethtsrv.exe
1672	netupdsrv.exe

Loads dropped DLL 9 IoCs

Processes:

447e0c46c7ca74867b11e0acf27414b1f4415c8519d88a20fe8f736619189b13.exeinstalld.exenethtsrv.exe

pid	process
752	447e0c46c7ca74867b11e0acf27414b1f4415c8519d88a20fe8f736619189b13.exe
752	447e0c46c7ca74867b11e0acf27414b1f4415c8519d88a20fe8f736619189b13.exe
752	447e0c46c7ca74867b11e0acf27414b1f4415c8519d88a20fe8f736619189b13.exe
752	447e0c46c7ca74867b11e0acf27414b1f4415c8519d88a20fe8f736619189b13.exe
656	installd.exe
752	447e0c46c7ca74867b11e0acf27414b1f4415c8519d88a20fe8f736619189b13.exe
1952	nethtsrv.exe
1952	nethtsrv.exe
752	447e0c46c7ca74867b11e0acf27414b1f4415c8519d88a20fe8f736619189b13.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in System32 directory 5 IoCs

Processes:

447e0c46c7ca74867b11e0acf27414b1f4415c8519d88a20fe8f736619189b13.exe

description	ioc	process
File created	C:\Windows\SysWOW64\hfpapi.dll	447e0c46c7ca74867b11e0acf27414b1f4415c8519d88a20fe8f736619189b13.exe
File created	C:\Windows\SysWOW64\installd.exe	447e0c46c7ca74867b11e0acf27414b1f4415c8519d88a20fe8f736619189b13.exe
File created	C:\Windows\SysWOW64\nethtsrv.exe	447e0c46c7ca74867b11e0acf27414b1f4415c8519d88a20fe8f736619189b13.exe
File created	C:\Windows\SysWOW64\netupdsrv.exe	447e0c46c7ca74867b11e0acf27414b1f4415c8519d88a20fe8f736619189b13.exe
File created	C:\Windows\SysWOW64\hfnapi.dll	447e0c46c7ca74867b11e0acf27414b1f4415c8519d88a20fe8f736619189b13.exe

Drops file in Program Files directory 3 IoCs

Processes:

447e0c46c7ca74867b11e0acf27414b1f4415c8519d88a20fe8f736619189b13.exe

description	ioc	process
File created	C:\Program Files (x86)\Common Files\Config\data.xml	447e0c46c7ca74867b11e0acf27414b1f4415c8519d88a20fe8f736619189b13.exe
File created	C:\Program Files (x86)\Common Files\Config\ver.xml	447e0c46c7ca74867b11e0acf27414b1f4415c8519d88a20fe8f736619189b13.exe
File created	C:\Program Files (x86)\Common Files\config\uninstinethnfd.exe	447e0c46c7ca74867b11e0acf27414b1f4415c8519d88a20fe8f736619189b13.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Runs net.exe
Suspicious behavior: LoadsDriver 1 IoCs

Processes:

pid process

468

pid	process
468

Suspicious use of WriteProcessMemory 34 IoCs

Processes:

447e0c46c7ca74867b11e0acf27414b1f4415c8519d88a20fe8f736619189b13.exenet.exenet.exe

description	pid	process	target process
PID 752 wrote to memory of 1160	752	447e0c46c7ca74867b11e0acf27414b1f4415c8519d88a20fe8f736619189b13.exe	net.exe
PID 752 wrote to memory of 1160	752	447e0c46c7ca74867b11e0acf27414b1f4415c8519d88a20fe8f736619189b13.exe	net.exe
PID 752 wrote to memory of 1160	752	447e0c46c7ca74867b11e0acf27414b1f4415c8519d88a20fe8f736619189b13.exe	net.exe
PID 752 wrote to memory of 1160	752	447e0c46c7ca74867b11e0acf27414b1f4415c8519d88a20fe8f736619189b13.exe	net.exe
PID 1160 wrote to memory of 680	1160	net.exe	net1.exe
PID 1160 wrote to memory of 680	1160	net.exe	net1.exe
PID 1160 wrote to memory of 680	1160	net.exe	net1.exe
PID 1160 wrote to memory of 680	1160	net.exe	net1.exe
PID 752 wrote to memory of 1840	752	447e0c46c7ca74867b11e0acf27414b1f4415c8519d88a20fe8f736619189b13.exe	net.exe
PID 752 wrote to memory of 1840	752	447e0c46c7ca74867b11e0acf27414b1f4415c8519d88a20fe8f736619189b13.exe	net.exe
PID 752 wrote to memory of 1840	752	447e0c46c7ca74867b11e0acf27414b1f4415c8519d88a20fe8f736619189b13.exe	net.exe
PID 752 wrote to memory of 1840	752	447e0c46c7ca74867b11e0acf27414b1f4415c8519d88a20fe8f736619189b13.exe	net.exe
PID 1840 wrote to memory of 1664	1840	net.exe	net1.exe
PID 1840 wrote to memory of 1664	1840	net.exe	net1.exe
PID 1840 wrote to memory of 1664	1840	net.exe	net1.exe
PID 1840 wrote to memory of 1664	1840	net.exe	net1.exe
PID 752 wrote to memory of 656	752	447e0c46c7ca74867b11e0acf27414b1f4415c8519d88a20fe8f736619189b13.exe	installd.exe
PID 752 wrote to memory of 656	752	447e0c46c7ca74867b11e0acf27414b1f4415c8519d88a20fe8f736619189b13.exe	installd.exe
PID 752 wrote to memory of 656	752	447e0c46c7ca74867b11e0acf27414b1f4415c8519d88a20fe8f736619189b13.exe	installd.exe
PID 752 wrote to memory of 656	752	447e0c46c7ca74867b11e0acf27414b1f4415c8519d88a20fe8f736619189b13.exe	installd.exe
PID 752 wrote to memory of 656	752	447e0c46c7ca74867b11e0acf27414b1f4415c8519d88a20fe8f736619189b13.exe	installd.exe
PID 752 wrote to memory of 656	752	447e0c46c7ca74867b11e0acf27414b1f4415c8519d88a20fe8f736619189b13.exe	installd.exe
PID 752 wrote to memory of 656	752	447e0c46c7ca74867b11e0acf27414b1f4415c8519d88a20fe8f736619189b13.exe	installd.exe
PID 752 wrote to memory of 1952	752	447e0c46c7ca74867b11e0acf27414b1f4415c8519d88a20fe8f736619189b13.exe	nethtsrv.exe
PID 752 wrote to memory of 1952	752	447e0c46c7ca74867b11e0acf27414b1f4415c8519d88a20fe8f736619189b13.exe	nethtsrv.exe
PID 752 wrote to memory of 1952	752	447e0c46c7ca74867b11e0acf27414b1f4415c8519d88a20fe8f736619189b13.exe	nethtsrv.exe
PID 752 wrote to memory of 1952	752	447e0c46c7ca74867b11e0acf27414b1f4415c8519d88a20fe8f736619189b13.exe	nethtsrv.exe
PID 752 wrote to memory of 1672	752	447e0c46c7ca74867b11e0acf27414b1f4415c8519d88a20fe8f736619189b13.exe	netupdsrv.exe
PID 752 wrote to memory of 1672	752	447e0c46c7ca74867b11e0acf27414b1f4415c8519d88a20fe8f736619189b13.exe	netupdsrv.exe
PID 752 wrote to memory of 1672	752	447e0c46c7ca74867b11e0acf27414b1f4415c8519d88a20fe8f736619189b13.exe	netupdsrv.exe
PID 752 wrote to memory of 1672	752	447e0c46c7ca74867b11e0acf27414b1f4415c8519d88a20fe8f736619189b13.exe	netupdsrv.exe
PID 752 wrote to memory of 1672	752	447e0c46c7ca74867b11e0acf27414b1f4415c8519d88a20fe8f736619189b13.exe	netupdsrv.exe
PID 752 wrote to memory of 1672	752	447e0c46c7ca74867b11e0acf27414b1f4415c8519d88a20fe8f736619189b13.exe	netupdsrv.exe
PID 752 wrote to memory of 1672	752	447e0c46c7ca74867b11e0acf27414b1f4415c8519d88a20fe8f736619189b13.exe	netupdsrv.exe

C:\Users\Admin\AppData\Local\Temp\447e0c46c7ca74867b11e0acf27414b1f4415c8519d88a20fe8f736619189b13.exe
"C:\Users\Admin\AppData\Local\Temp\447e0c46c7ca74867b11e0acf27414b1f4415c8519d88a20fe8f736619189b13.exe"
1⤵
- Drops file in Drivers directory
- Loads dropped DLL
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:752

C:\Windows\SysWOW64\net.exe
net stop nethttpservice
2⤵
- Suspicious use of WriteProcessMemory
PID:1160

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop nethttpservice
3⤵
PID:680

C:\Windows\SysWOW64\net.exe
net stop serviceupdater
2⤵
- Suspicious use of WriteProcessMemory
PID:1840

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop serviceupdater
3⤵
PID:1664

C:\Windows\SysWOW64\installd.exe
"C:\Windows\system32\installd.exe" nethfdrv
2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:656

C:\Windows\SysWOW64\nethtsrv.exe
"C:\Windows\system32\nethtsrv.exe" -nfdi
2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1952

C:\Windows\SysWOW64\netupdsrv.exe
"C:\Windows\system32\netupdsrv.exe" -nfdi
2⤵
- Executes dropped EXE
PID:1672

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\hfnapi.dll

Filesize
106KB

MD5
c71e2e63e4bc36bd3d0a6172e57e60a4

SHA1
fc69ca2461fa119b585b562ba9672c1e8251b2de

SHA256
8ca5cc341e5d1fe4951eb5db5f67264c271c0d15250f7b8610541816870fa020

SHA512
95bd11308c5c4e00efc9d8b8dadefd528c7323dabafabb28a25df7cdf5751466a283308504cdf74120b9eb940b434aa124b925c10b088edd99df27cf307a2a33

Download Submit
C:\Windows\SysWOW64\hfpapi.dll

Filesize
241KB

MD5
4b53e20bb2e1e73ba29ba7ab93ec22f8

SHA1
9a4cb2939030a0c516c4ca7034ce255bd28e58b0

SHA256
017ce0b2273465952d89799a24ee6b8bb7ddebd2cefc2857ca0e45c22e9558bd

SHA512
834a92236b727a8b0272e1b05e6d72fc805588cb1a34f05652de4423d89c516502ffba0c8a6d873f433410d427f44cc8a6a72184aa1c4fc8d63debf5b2974daa

Download Submit
C:\Windows\SysWOW64\installd.exe

Filesize
108KB

MD5
eee420b7f5afb620c475c45cbe1cced3

SHA1
71e65e82145c14262a707d95bb5d47de2d6b137a

SHA256
d553c3089f7960b199899db63d3640b722317d696c6aba6f9c9961ccc98adfef

SHA512
048b9c58cb595c4ea24548dfaaf032dbaed3399eb686308d4c5bfe2bea7b04f6787bdd5de48f4cb64fc05ef1e993917c3d965abff1addf4f2a43c20574704ec8

Download Submit
C:\Windows\SysWOW64\nethtsrv.exe

Filesize
176KB

MD5
5eafb2148776b9313d5b986aa2abb568

SHA1
1ab057ce025443d9c61ac5e3b90d7650c3e1a327

SHA256
ff879f9785fd8bc21480e310d8dfb0cafbf3017647ca9f148fc9a823f3271b4a

SHA512
3be26628260478d4c2b20e286e682bc4cf467c5379fbc089735d5765fe80673d3e882685da5c8b2273d68ea28ea09892021a007269b82bfdf9e08bac7fcd1a22

Download Submit
C:\Windows\SysWOW64\netupdsrv.exe

Filesize
158KB

MD5
5747ca7d5e746ec5f3089150b476ffb5

SHA1
cecaae945d62291c95e4698233d0e8730465d01f

SHA256
be3b23072f181171e467f4236231e29251f965d75a3baf38083b545c0691b181

SHA512
69e6b733b8440c2948224670c523469101fc4eff361e6b0c3241218e0656e8c920f1054cc977b095bc70bfe203ff2b74ce8c27fab0ffedaab817734d04aade7b

Download Submit
\Users\Admin\AppData\Local\Temp\nsz1ED9.tmp\System.dll

Filesize
11KB

MD5
c17103ae9072a06da581dec998343fc1

SHA1
b72148c6bdfaada8b8c3f950e610ee7cf1da1f8d

SHA256
dc58d8ad81cacb0c1ed72e33bff8f23ea40b5252b5bb55d393a0903e6819ae2f

SHA512
d32a71aaef18e993f28096d536e41c4d016850721b31171513ce28bbd805a54fd290b7c3e9d935f72e676a1acfb4f0dcc89d95040a0dd29f2b6975855c18986f

Download Submit
\Users\Admin\AppData\Local\Temp\nsz1ED9.tmp\nsExec.dll

Filesize
6KB

MD5
acc2b699edfea5bf5aae45aba3a41e96

SHA1
d2accf4d494e43ceb2cff69abe4dd17147d29cc2

SHA256
168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e

SHA512
e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe

Download Submit
\Users\Admin\AppData\Local\Temp\nsz1ED9.tmp\nsExec.dll

Filesize
6KB

MD5
acc2b699edfea5bf5aae45aba3a41e96

SHA1
d2accf4d494e43ceb2cff69abe4dd17147d29cc2

SHA256
168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e

SHA512
e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe

Download Submit
\Windows\SysWOW64\hfnapi.dll

Filesize
106KB

MD5
c71e2e63e4bc36bd3d0a6172e57e60a4

SHA1
fc69ca2461fa119b585b562ba9672c1e8251b2de

SHA256
8ca5cc341e5d1fe4951eb5db5f67264c271c0d15250f7b8610541816870fa020

SHA512
95bd11308c5c4e00efc9d8b8dadefd528c7323dabafabb28a25df7cdf5751466a283308504cdf74120b9eb940b434aa124b925c10b088edd99df27cf307a2a33

Download Submit
\Windows\SysWOW64\hfnapi.dll

Filesize
106KB

MD5
c71e2e63e4bc36bd3d0a6172e57e60a4

SHA1
fc69ca2461fa119b585b562ba9672c1e8251b2de

SHA256
8ca5cc341e5d1fe4951eb5db5f67264c271c0d15250f7b8610541816870fa020

SHA512
95bd11308c5c4e00efc9d8b8dadefd528c7323dabafabb28a25df7cdf5751466a283308504cdf74120b9eb940b434aa124b925c10b088edd99df27cf307a2a33

Download Submit
\Windows\SysWOW64\hfpapi.dll

Filesize
241KB

MD5
4b53e20bb2e1e73ba29ba7ab93ec22f8

SHA1
9a4cb2939030a0c516c4ca7034ce255bd28e58b0

SHA256
017ce0b2273465952d89799a24ee6b8bb7ddebd2cefc2857ca0e45c22e9558bd

SHA512
834a92236b727a8b0272e1b05e6d72fc805588cb1a34f05652de4423d89c516502ffba0c8a6d873f433410d427f44cc8a6a72184aa1c4fc8d63debf5b2974daa

Download Submit
\Windows\SysWOW64\installd.exe

Filesize
108KB

MD5
eee420b7f5afb620c475c45cbe1cced3

SHA1
71e65e82145c14262a707d95bb5d47de2d6b137a

SHA256
d553c3089f7960b199899db63d3640b722317d696c6aba6f9c9961ccc98adfef

SHA512
048b9c58cb595c4ea24548dfaaf032dbaed3399eb686308d4c5bfe2bea7b04f6787bdd5de48f4cb64fc05ef1e993917c3d965abff1addf4f2a43c20574704ec8

Download Submit
\Windows\SysWOW64\nethtsrv.exe

Filesize
176KB

MD5
5eafb2148776b9313d5b986aa2abb568

SHA1
1ab057ce025443d9c61ac5e3b90d7650c3e1a327

SHA256
ff879f9785fd8bc21480e310d8dfb0cafbf3017647ca9f148fc9a823f3271b4a

SHA512
3be26628260478d4c2b20e286e682bc4cf467c5379fbc089735d5765fe80673d3e882685da5c8b2273d68ea28ea09892021a007269b82bfdf9e08bac7fcd1a22

Download Submit
\Windows\SysWOW64\netupdsrv.exe

Filesize
158KB

MD5
5747ca7d5e746ec5f3089150b476ffb5

SHA1
cecaae945d62291c95e4698233d0e8730465d01f

SHA256
be3b23072f181171e467f4236231e29251f965d75a3baf38083b545c0691b181

SHA512
69e6b733b8440c2948224670c523469101fc4eff361e6b0c3241218e0656e8c920f1054cc977b095bc70bfe203ff2b74ce8c27fab0ffedaab817734d04aade7b

Download Submit
memory/656-64-0x0000000000000000-mapping.dmp

Download
memory/680-59-0x0000000000000000-mapping.dmp

Download
memory/752-69-0x0000000000360000-0x00000000007BE000-memory.dmp

Filesize
4.4MB

Download
memory/752-54-0x0000000075531000-0x0000000075533000-memory.dmp

Filesize
8KB

Download
memory/752-55-0x0000000000360000-0x00000000007BE000-memory.dmp

Filesize
4.4MB

Download
memory/1160-58-0x0000000000000000-mapping.dmp

Download
memory/1664-62-0x0000000000000000-mapping.dmp

Download
memory/1672-77-0x0000000000000000-mapping.dmp

Download
memory/1840-61-0x0000000000000000-mapping.dmp

Download
memory/1952-71-0x0000000000000000-mapping.dmp

Download