1cac15986576fc4cf8b8fb23d041f1e83b783e13e1fce0ed75487b408e1c9c1d

Analysis

max time kernel
203s
max time network
30s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
23-11-2022 10:32

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1cac15986576fc4cf8b8fb23d041f1e83b783e13e1fce0ed75487b408e1c9c1d.exe
Size

602KB
MD5

918b326731010f366c0d451dbcc59106
SHA1

2fd089c544141c61bd1925d84dc0795207a251f1
SHA256

1cac15986576fc4cf8b8fb23d041f1e83b783e13e1fce0ed75487b408e1c9c1d
SHA512

521ec55401c156195eb7683882c809758a088f08e9cd88ae9d747238a5bdf3a4364e4bb5dce762c51c36ab82e83242a486324520aa6fd9e64153f5b35d3e9d9b
SSDEEP

12288:0Iny5DYTgXd3iylfZSjpis9crLha4A0cLGk:yUTgAy+jpikea7LG

Score

8^/10

discovery

Malware Config

Signatures

Drops file in Drivers directory 1 IoCs

Processes:

1cac15986576fc4cf8b8fb23d041f1e83b783e13e1fce0ed75487b408e1c9c1d.exe

description ioc process

File created C:\Windows\system32\drivers\nethfdrv.sys 1cac15986576fc4cf8b8fb23d041f1e83b783e13e1fce0ed75487b408e1c9c1d.exe
Executes dropped EXE 3 IoCs

Processes:

installd.exenethtsrv.exenetupdsrv.exe

pid process

1524 installd.exe
1680 nethtsrv.exe
1528 netupdsrv.exe

description	ioc	process
File created	C:\Windows\system32\drivers\nethfdrv.sys	1cac15986576fc4cf8b8fb23d041f1e83b783e13e1fce0ed75487b408e1c9c1d.exe

pid	process
1524	installd.exe
1680	nethtsrv.exe
1528	netupdsrv.exe

Loads dropped DLL 9 IoCs

Processes:

1cac15986576fc4cf8b8fb23d041f1e83b783e13e1fce0ed75487b408e1c9c1d.exeinstalld.exenethtsrv.exe

pid	process
368	1cac15986576fc4cf8b8fb23d041f1e83b783e13e1fce0ed75487b408e1c9c1d.exe
368	1cac15986576fc4cf8b8fb23d041f1e83b783e13e1fce0ed75487b408e1c9c1d.exe
368	1cac15986576fc4cf8b8fb23d041f1e83b783e13e1fce0ed75487b408e1c9c1d.exe
368	1cac15986576fc4cf8b8fb23d041f1e83b783e13e1fce0ed75487b408e1c9c1d.exe
1524	installd.exe
368	1cac15986576fc4cf8b8fb23d041f1e83b783e13e1fce0ed75487b408e1c9c1d.exe
1680	nethtsrv.exe
1680	nethtsrv.exe
368	1cac15986576fc4cf8b8fb23d041f1e83b783e13e1fce0ed75487b408e1c9c1d.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in System32 directory 5 IoCs

Processes:

1cac15986576fc4cf8b8fb23d041f1e83b783e13e1fce0ed75487b408e1c9c1d.exe

description	ioc	process
File created	C:\Windows\SysWOW64\hfnapi.dll	1cac15986576fc4cf8b8fb23d041f1e83b783e13e1fce0ed75487b408e1c9c1d.exe
File created	C:\Windows\SysWOW64\hfpapi.dll	1cac15986576fc4cf8b8fb23d041f1e83b783e13e1fce0ed75487b408e1c9c1d.exe
File created	C:\Windows\SysWOW64\installd.exe	1cac15986576fc4cf8b8fb23d041f1e83b783e13e1fce0ed75487b408e1c9c1d.exe
File created	C:\Windows\SysWOW64\nethtsrv.exe	1cac15986576fc4cf8b8fb23d041f1e83b783e13e1fce0ed75487b408e1c9c1d.exe
File created	C:\Windows\SysWOW64\netupdsrv.exe	1cac15986576fc4cf8b8fb23d041f1e83b783e13e1fce0ed75487b408e1c9c1d.exe

Drops file in Program Files directory 3 IoCs

Processes:

1cac15986576fc4cf8b8fb23d041f1e83b783e13e1fce0ed75487b408e1c9c1d.exe

description	ioc	process
File created	C:\Program Files (x86)\Common Files\Config\data.xml	1cac15986576fc4cf8b8fb23d041f1e83b783e13e1fce0ed75487b408e1c9c1d.exe
File created	C:\Program Files (x86)\Common Files\Config\ver.xml	1cac15986576fc4cf8b8fb23d041f1e83b783e13e1fce0ed75487b408e1c9c1d.exe
File created	C:\Program Files (x86)\Common Files\config\uninstinethnfd.exe	1cac15986576fc4cf8b8fb23d041f1e83b783e13e1fce0ed75487b408e1c9c1d.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Runs net.exe
Suspicious behavior: LoadsDriver 1 IoCs

Processes:

pid process

468

pid	process
468

Suspicious use of WriteProcessMemory 34 IoCs

Processes:

1cac15986576fc4cf8b8fb23d041f1e83b783e13e1fce0ed75487b408e1c9c1d.exenet.exenet.exe

description	pid	process	target process
PID 368 wrote to memory of 1304	368	1cac15986576fc4cf8b8fb23d041f1e83b783e13e1fce0ed75487b408e1c9c1d.exe	net.exe
PID 368 wrote to memory of 1304	368	1cac15986576fc4cf8b8fb23d041f1e83b783e13e1fce0ed75487b408e1c9c1d.exe	net.exe
PID 368 wrote to memory of 1304	368	1cac15986576fc4cf8b8fb23d041f1e83b783e13e1fce0ed75487b408e1c9c1d.exe	net.exe
PID 368 wrote to memory of 1304	368	1cac15986576fc4cf8b8fb23d041f1e83b783e13e1fce0ed75487b408e1c9c1d.exe	net.exe
PID 1304 wrote to memory of 788	1304	net.exe	net1.exe
PID 1304 wrote to memory of 788	1304	net.exe	net1.exe
PID 1304 wrote to memory of 788	1304	net.exe	net1.exe
PID 1304 wrote to memory of 788	1304	net.exe	net1.exe
PID 368 wrote to memory of 924	368	1cac15986576fc4cf8b8fb23d041f1e83b783e13e1fce0ed75487b408e1c9c1d.exe	net.exe
PID 368 wrote to memory of 924	368	1cac15986576fc4cf8b8fb23d041f1e83b783e13e1fce0ed75487b408e1c9c1d.exe	net.exe
PID 368 wrote to memory of 924	368	1cac15986576fc4cf8b8fb23d041f1e83b783e13e1fce0ed75487b408e1c9c1d.exe	net.exe
PID 368 wrote to memory of 924	368	1cac15986576fc4cf8b8fb23d041f1e83b783e13e1fce0ed75487b408e1c9c1d.exe	net.exe
PID 924 wrote to memory of 1644	924	net.exe	net1.exe
PID 924 wrote to memory of 1644	924	net.exe	net1.exe
PID 924 wrote to memory of 1644	924	net.exe	net1.exe
PID 924 wrote to memory of 1644	924	net.exe	net1.exe
PID 368 wrote to memory of 1524	368	1cac15986576fc4cf8b8fb23d041f1e83b783e13e1fce0ed75487b408e1c9c1d.exe	installd.exe
PID 368 wrote to memory of 1524	368	1cac15986576fc4cf8b8fb23d041f1e83b783e13e1fce0ed75487b408e1c9c1d.exe	installd.exe
PID 368 wrote to memory of 1524	368	1cac15986576fc4cf8b8fb23d041f1e83b783e13e1fce0ed75487b408e1c9c1d.exe	installd.exe
PID 368 wrote to memory of 1524	368	1cac15986576fc4cf8b8fb23d041f1e83b783e13e1fce0ed75487b408e1c9c1d.exe	installd.exe
PID 368 wrote to memory of 1524	368	1cac15986576fc4cf8b8fb23d041f1e83b783e13e1fce0ed75487b408e1c9c1d.exe	installd.exe
PID 368 wrote to memory of 1524	368	1cac15986576fc4cf8b8fb23d041f1e83b783e13e1fce0ed75487b408e1c9c1d.exe	installd.exe
PID 368 wrote to memory of 1524	368	1cac15986576fc4cf8b8fb23d041f1e83b783e13e1fce0ed75487b408e1c9c1d.exe	installd.exe
PID 368 wrote to memory of 1680	368	1cac15986576fc4cf8b8fb23d041f1e83b783e13e1fce0ed75487b408e1c9c1d.exe	nethtsrv.exe
PID 368 wrote to memory of 1680	368	1cac15986576fc4cf8b8fb23d041f1e83b783e13e1fce0ed75487b408e1c9c1d.exe	nethtsrv.exe
PID 368 wrote to memory of 1680	368	1cac15986576fc4cf8b8fb23d041f1e83b783e13e1fce0ed75487b408e1c9c1d.exe	nethtsrv.exe
PID 368 wrote to memory of 1680	368	1cac15986576fc4cf8b8fb23d041f1e83b783e13e1fce0ed75487b408e1c9c1d.exe	nethtsrv.exe
PID 368 wrote to memory of 1528	368	1cac15986576fc4cf8b8fb23d041f1e83b783e13e1fce0ed75487b408e1c9c1d.exe	netupdsrv.exe
PID 368 wrote to memory of 1528	368	1cac15986576fc4cf8b8fb23d041f1e83b783e13e1fce0ed75487b408e1c9c1d.exe	netupdsrv.exe
PID 368 wrote to memory of 1528	368	1cac15986576fc4cf8b8fb23d041f1e83b783e13e1fce0ed75487b408e1c9c1d.exe	netupdsrv.exe
PID 368 wrote to memory of 1528	368	1cac15986576fc4cf8b8fb23d041f1e83b783e13e1fce0ed75487b408e1c9c1d.exe	netupdsrv.exe
PID 368 wrote to memory of 1528	368	1cac15986576fc4cf8b8fb23d041f1e83b783e13e1fce0ed75487b408e1c9c1d.exe	netupdsrv.exe
PID 368 wrote to memory of 1528	368	1cac15986576fc4cf8b8fb23d041f1e83b783e13e1fce0ed75487b408e1c9c1d.exe	netupdsrv.exe
PID 368 wrote to memory of 1528	368	1cac15986576fc4cf8b8fb23d041f1e83b783e13e1fce0ed75487b408e1c9c1d.exe	netupdsrv.exe

C:\Users\Admin\AppData\Local\Temp\1cac15986576fc4cf8b8fb23d041f1e83b783e13e1fce0ed75487b408e1c9c1d.exe
"C:\Users\Admin\AppData\Local\Temp\1cac15986576fc4cf8b8fb23d041f1e83b783e13e1fce0ed75487b408e1c9c1d.exe"
1⤵
- Drops file in Drivers directory
- Loads dropped DLL
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:368

C:\Windows\SysWOW64\net.exe
net stop nethttpservice
2⤵
- Suspicious use of WriteProcessMemory
PID:1304

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop nethttpservice
3⤵
PID:788

C:\Windows\SysWOW64\net.exe
net stop serviceupdater
2⤵
- Suspicious use of WriteProcessMemory
PID:924

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop serviceupdater
3⤵
PID:1644

C:\Windows\SysWOW64\installd.exe
"C:\Windows\system32\installd.exe" nethfdrv
2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1524

C:\Windows\SysWOW64\nethtsrv.exe
"C:\Windows\system32\nethtsrv.exe" -nfdi
2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1680

C:\Windows\SysWOW64\netupdsrv.exe
"C:\Windows\system32\netupdsrv.exe" -nfdi
2⤵
- Executes dropped EXE
PID:1528

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\hfnapi.dll

Filesize
106KB

MD5
a011695ef7c4f60254dc9e240b56beea

SHA1
2a9dadd789add03b3145705a304489d437d298e9

SHA256
dfe3786c134d876566fd393e15b70f23225b8ef23c96358657e24bb2a2844a6d

SHA512
e19655ec3066682841bf66c9fa051ba064834f7b4027a528b1b3d3acb5a5bd0d8193d2a3129ecbf02d21ef155707cadf59e735b2869284506159323e6e68064d

Download Submit
C:\Windows\SysWOW64\hfpapi.dll

Filesize
241KB

MD5
a671e09974569b943e906f5fea9034fb

SHA1
6b4f05900ee500514774dab0117cbc6ec8d7b7e1

SHA256
777edc5a18f7d4d60d17f554fb483d363d7a7ebcd4342f89a38cb050855aed53

SHA512
c63cfaee1244b223ef93ca7c12d1c87e1c88e56d4a423495ebfa7b69e73aa116f4a6a6f9e4601021814559eb3a94f8df5b8d2b23a8912dd7e179ad7131bd278c

Download Submit
C:\Windows\SysWOW64\installd.exe

Filesize
108KB

MD5
8ecd58b6ef4ed29d5638a8b349937898

SHA1
8e60e1d9d8f39dab9993e0dcb4945d564718118e

SHA256
9d7ed5fd6596d8f2ffcbf57fd22ccf89f513fd182c4ff82eb1a6770ed690c250

SHA512
1ff8e89b58e976da00dc34d4c40d6e79b0b0e503e9febb353871ab2fc2e3d45f83322a0f8c2557080dbc24d618533df39f27caf01019c141ae90e4e281402544

Download Submit
C:\Windows\SysWOW64\nethtsrv.exe

Filesize
176KB

MD5
0a0ad27ff50cce3f13ed04773b77760b

SHA1
4ba418d7ccc63059174d8aeacc3795fd32b4be6b

SHA256
a16fe16bee4d63b14456ac5e3a4998344b70479341429d4a77c0220589efe5c9

SHA512
68be64eb7b16c1cd1c36490ce130d5226dfdcc366ea27826af24cf2ce769db934156480cd05ef2527f19294c30326c5935187bbc459076171117bd6297abb991

Download Submit
C:\Windows\SysWOW64\netupdsrv.exe

Filesize
159KB

MD5
21752aec2294e257d42eec681097fb11

SHA1
394845b72ed3310588ee1b4edccff7dd7a844429

SHA256
f7abcc4638c1a2dbd5705ddc0fc1af030b73aab3766ecce5934c288f30cbafb2

SHA512
9861c4c14e6e437d48b9afa0cbf27d4bba6bff1ae67b525105322eaa39f52587a1eefbca5618135304053afeb97baa060157fe5d7b95bd3532dd4fe8fd18117d

Download Submit
\Users\Admin\AppData\Local\Temp\nseAB7E.tmp\System.dll

Filesize
11KB

MD5
c17103ae9072a06da581dec998343fc1

SHA1
b72148c6bdfaada8b8c3f950e610ee7cf1da1f8d

SHA256
dc58d8ad81cacb0c1ed72e33bff8f23ea40b5252b5bb55d393a0903e6819ae2f

SHA512
d32a71aaef18e993f28096d536e41c4d016850721b31171513ce28bbd805a54fd290b7c3e9d935f72e676a1acfb4f0dcc89d95040a0dd29f2b6975855c18986f

Download Submit
\Users\Admin\AppData\Local\Temp\nseAB7E.tmp\nsExec.dll

Filesize
6KB

MD5
acc2b699edfea5bf5aae45aba3a41e96

SHA1
d2accf4d494e43ceb2cff69abe4dd17147d29cc2

SHA256
168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e

SHA512
e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe

Download Submit
\Users\Admin\AppData\Local\Temp\nseAB7E.tmp\nsExec.dll

Filesize
6KB

MD5
acc2b699edfea5bf5aae45aba3a41e96

SHA1
d2accf4d494e43ceb2cff69abe4dd17147d29cc2

SHA256
168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e

SHA512
e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe

Download Submit
\Windows\SysWOW64\hfnapi.dll

Filesize
106KB

MD5
a011695ef7c4f60254dc9e240b56beea

SHA1
2a9dadd789add03b3145705a304489d437d298e9

SHA256
dfe3786c134d876566fd393e15b70f23225b8ef23c96358657e24bb2a2844a6d

SHA512
e19655ec3066682841bf66c9fa051ba064834f7b4027a528b1b3d3acb5a5bd0d8193d2a3129ecbf02d21ef155707cadf59e735b2869284506159323e6e68064d

Download Submit
\Windows\SysWOW64\hfnapi.dll

Filesize
106KB

MD5
a011695ef7c4f60254dc9e240b56beea

SHA1
2a9dadd789add03b3145705a304489d437d298e9

SHA256
dfe3786c134d876566fd393e15b70f23225b8ef23c96358657e24bb2a2844a6d

SHA512
e19655ec3066682841bf66c9fa051ba064834f7b4027a528b1b3d3acb5a5bd0d8193d2a3129ecbf02d21ef155707cadf59e735b2869284506159323e6e68064d

Download Submit
\Windows\SysWOW64\hfpapi.dll

Filesize
241KB

MD5
a671e09974569b943e906f5fea9034fb

SHA1
6b4f05900ee500514774dab0117cbc6ec8d7b7e1

SHA256
777edc5a18f7d4d60d17f554fb483d363d7a7ebcd4342f89a38cb050855aed53

SHA512
c63cfaee1244b223ef93ca7c12d1c87e1c88e56d4a423495ebfa7b69e73aa116f4a6a6f9e4601021814559eb3a94f8df5b8d2b23a8912dd7e179ad7131bd278c

Download Submit
\Windows\SysWOW64\installd.exe

Filesize
108KB

MD5
8ecd58b6ef4ed29d5638a8b349937898

SHA1
8e60e1d9d8f39dab9993e0dcb4945d564718118e

SHA256
9d7ed5fd6596d8f2ffcbf57fd22ccf89f513fd182c4ff82eb1a6770ed690c250

SHA512
1ff8e89b58e976da00dc34d4c40d6e79b0b0e503e9febb353871ab2fc2e3d45f83322a0f8c2557080dbc24d618533df39f27caf01019c141ae90e4e281402544

Download Submit
\Windows\SysWOW64\nethtsrv.exe

Filesize
176KB

MD5
0a0ad27ff50cce3f13ed04773b77760b

SHA1
4ba418d7ccc63059174d8aeacc3795fd32b4be6b

SHA256
a16fe16bee4d63b14456ac5e3a4998344b70479341429d4a77c0220589efe5c9

SHA512
68be64eb7b16c1cd1c36490ce130d5226dfdcc366ea27826af24cf2ce769db934156480cd05ef2527f19294c30326c5935187bbc459076171117bd6297abb991

Download Submit
\Windows\SysWOW64\netupdsrv.exe

Filesize
159KB

MD5
21752aec2294e257d42eec681097fb11

SHA1
394845b72ed3310588ee1b4edccff7dd7a844429

SHA256
f7abcc4638c1a2dbd5705ddc0fc1af030b73aab3766ecce5934c288f30cbafb2

SHA512
9861c4c14e6e437d48b9afa0cbf27d4bba6bff1ae67b525105322eaa39f52587a1eefbca5618135304053afeb97baa060157fe5d7b95bd3532dd4fe8fd18117d

Download Submit
memory/368-54-0x0000000075531000-0x0000000075533000-memory.dmp

Filesize
8KB

Download
memory/368-69-0x0000000000360000-0x00000000007BE000-memory.dmp

Filesize
4.4MB

Download
memory/368-55-0x0000000000360000-0x00000000007BE000-memory.dmp

Filesize
4.4MB

Download
memory/788-59-0x0000000000000000-mapping.dmp

Download
memory/924-61-0x0000000000000000-mapping.dmp

Download
memory/1304-58-0x0000000000000000-mapping.dmp

Download
memory/1524-64-0x0000000000000000-mapping.dmp

Download
memory/1528-77-0x0000000000000000-mapping.dmp

Download
memory/1644-62-0x0000000000000000-mapping.dmp

Download
memory/1680-71-0x0000000000000000-mapping.dmp

Download