Analysis

  • max time kernel
    101s
  • max time network
    31s
  • platform
    windows7_x64
  • resource
    win7-20221111-en
  • resource tags

    arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
  • submitted
    23-11-2022 10:34

General

  • Target

    0d70b068b8dca10c922b302053ea4a924938e116077ca7bbca8576d069d22d29.exe

  • Size

    603KB

  • MD5

    d5715395d705ef0446924ed812a630cd

  • SHA1

    bb92c1c25d3fa9fdc788865afea54b697bd201aa

  • SHA256

    0d70b068b8dca10c922b302053ea4a924938e116077ca7bbca8576d069d22d29

  • SHA512

    62d65385dcd3e9d7818616cd51176b7b7c05e590e4b6cb48725fdf8f21502cc3627f3cc75495dc08681c5f25ed2daeefec78ed61d32e664a6211677b9590ab3a

  • SSDEEP

    12288:RIny5DYTMIUgbia0mIcFIecbqule52k9KdlM7:tUTMzva0DwIec3k2

Score
8/10

Malware Config

Signatures

  • Drops file in Drivers directory 1 IoCs
  • Executes dropped EXE 5 IoCs
  • Loads dropped DLL 13 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Drops file in System32 directory 5 IoCs
  • Drops file in Program Files directory 3 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Runs net.exe
  • Suspicious behavior: LoadsDriver 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 50 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\0d70b068b8dca10c922b302053ea4a924938e116077ca7bbca8576d069d22d29.exe
    "C:\Users\Admin\AppData\Local\Temp\0d70b068b8dca10c922b302053ea4a924938e116077ca7bbca8576d069d22d29.exe"
    1⤵
    • Drops file in Drivers directory
    • Loads dropped DLL
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • Suspicious use of WriteProcessMemory
    PID:520
    • C:\Windows\SysWOW64\net.exe
      net stop nethttpservice
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:584
      • C:\Windows\SysWOW64\net1.exe
        C:\Windows\system32\net1 stop nethttpservice
        3⤵
          PID:1068
      • C:\Windows\SysWOW64\net.exe
        net stop serviceupdater
        2⤵
        • Suspicious use of WriteProcessMemory
        PID:1908
        • C:\Windows\SysWOW64\net1.exe
          C:\Windows\system32\net1 stop serviceupdater
          3⤵
            PID:1804
        • C:\Windows\SysWOW64\installd.exe
          "C:\Windows\system32\installd.exe" nethfdrv
          2⤵
          • Executes dropped EXE
          • Loads dropped DLL
          PID:1564
        • C:\Windows\SysWOW64\nethtsrv.exe
          "C:\Windows\system32\nethtsrv.exe" -nfdi
          2⤵
          • Executes dropped EXE
          • Loads dropped DLL
          PID:1572
        • C:\Windows\SysWOW64\netupdsrv.exe
          "C:\Windows\system32\netupdsrv.exe" -nfdi
          2⤵
          • Executes dropped EXE
          PID:1420
        • C:\Windows\SysWOW64\net.exe
          net start nethttpservice
          2⤵
          • Suspicious use of WriteProcessMemory
          PID:1676
          • C:\Windows\SysWOW64\net1.exe
            C:\Windows\system32\net1 start nethttpservice
            3⤵
              PID:1100
          • C:\Windows\SysWOW64\net.exe
            net start serviceupdater
            2⤵
            • Suspicious use of WriteProcessMemory
            PID:1416
            • C:\Windows\SysWOW64\net1.exe
              C:\Windows\system32\net1 start serviceupdater
              3⤵
                PID:1732
          • C:\Windows\SysWOW64\nethtsrv.exe
            C:\Windows\SysWOW64\nethtsrv.exe
            1⤵
            • Executes dropped EXE
            • Loads dropped DLL
            • Suspicious use of AdjustPrivilegeToken
            PID:1924
          • C:\Windows\SysWOW64\netupdsrv.exe
            C:\Windows\SysWOW64\netupdsrv.exe
            1⤵
            • Executes dropped EXE
            PID:1772

          Network

          MITRE ATT&CK Enterprise v6

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • C:\Windows\SysWOW64\hfnapi.dll

            Filesize

            106KB

            MD5

            fddcadf795e222b72b56c1de1722cfbc

            SHA1

            858b974da9c3f14021076fcb429beb600a2c0c78

            SHA256

            e8dc9a51cb365b36c4998be137bee052fd513ebd630831a05ac3637e5b5dc5c8

            SHA512

            a9f6cbf25611a89a260ce481b8dc5ae0fb5098cb682d527eaffe1740add468c5e2a4572e3020d12529c03f4a4ab87b102e2530994f478206f5572d7886b7a5c4

          • C:\Windows\SysWOW64\hfpapi.dll

            Filesize

            244KB

            MD5

            4474857119a3498ee1714f4284d817f6

            SHA1

            a532efba64c48e5bdc5754bfc840496b43702da8

            SHA256

            515acb8c958fa32b77e9bde2659dcd7feaef528fdd6b22f949a517cf12e67d8d

            SHA512

            de12a269a132514e330367ab6c665d396510991c690bf3ad676404f1bee52dd1359652c8ba1132cd14b4964d684ff3b1c2bdf712930ee4045ff540a419a8157b

          • C:\Windows\SysWOW64\installd.exe

            Filesize

            108KB

            MD5

            23cb5abc9228a6a432b3c314f3a06776

            SHA1

            8741461c6c06fc0c4d0a7c79849e49bd129fced1

            SHA256

            049437f402b1605bb07b56bbcf9b13598aee9b6b0af8956cb71945da72bfbbaa

            SHA512

            e87aa8c8ca95788b54061d3f2e64fe63f7079ca045d6c4dfe1f8a112ea12327eb7f17e766db3f98e4ff784d8c4800016920fd9bae0fcd4d4e1fcd61e7cb65d27

          • C:\Windows\SysWOW64\nethtsrv.exe

            Filesize

            176KB

            MD5

            11333a15bca9330a1a5f75e4d54d4ffa

            SHA1

            bfa1cf14285f0e92491d281055b8a8f45eea70aa

            SHA256

            4fd084eddb47d8135faea3678ec7f94dede5465d017f7209f8353bf8d3fa83a9

            SHA512

            1b8e1359494aa5ca1053d7346a15d28227419d28a3e8abe7f93f12f8d613234f3bf891dee8696cbbf2034c942835decfa3442bae783d1a6a18e9fdb202b91243

          • C:\Windows\SysWOW64\nethtsrv.exe

            Filesize

            176KB

            MD5

            11333a15bca9330a1a5f75e4d54d4ffa

            SHA1

            bfa1cf14285f0e92491d281055b8a8f45eea70aa

            SHA256

            4fd084eddb47d8135faea3678ec7f94dede5465d017f7209f8353bf8d3fa83a9

            SHA512

            1b8e1359494aa5ca1053d7346a15d28227419d28a3e8abe7f93f12f8d613234f3bf891dee8696cbbf2034c942835decfa3442bae783d1a6a18e9fdb202b91243

          • C:\Windows\SysWOW64\netupdsrv.exe

            Filesize

            159KB

            MD5

            0ad6d14e1e6d74950293d115b2e7fe29

            SHA1

            a21b22ba1c79688a1abc3e11394f1d9ed2f10f97

            SHA256

            e537b5351f42d46d95d16cbf879d17872f38bd4c37460b73f543a8cf549547d8

            SHA512

            996bf93242a77d07a24e99c81acc9d666b4fc8b4625a6a5202eb4778f11854100dc4868c728e24e7e667beeba5fa104c7247fb9132dae093c1bb20036043e71b

          • C:\Windows\SysWOW64\netupdsrv.exe

            Filesize

            159KB

            MD5

            0ad6d14e1e6d74950293d115b2e7fe29

            SHA1

            a21b22ba1c79688a1abc3e11394f1d9ed2f10f97

            SHA256

            e537b5351f42d46d95d16cbf879d17872f38bd4c37460b73f543a8cf549547d8

            SHA512

            996bf93242a77d07a24e99c81acc9d666b4fc8b4625a6a5202eb4778f11854100dc4868c728e24e7e667beeba5fa104c7247fb9132dae093c1bb20036043e71b

          • \Users\Admin\AppData\Local\Temp\nse5248.tmp\System.dll

            Filesize

            11KB

            MD5

            c17103ae9072a06da581dec998343fc1

            SHA1

            b72148c6bdfaada8b8c3f950e610ee7cf1da1f8d

            SHA256

            dc58d8ad81cacb0c1ed72e33bff8f23ea40b5252b5bb55d393a0903e6819ae2f

            SHA512

            d32a71aaef18e993f28096d536e41c4d016850721b31171513ce28bbd805a54fd290b7c3e9d935f72e676a1acfb4f0dcc89d95040a0dd29f2b6975855c18986f

          • \Users\Admin\AppData\Local\Temp\nse5248.tmp\nsExec.dll

            Filesize

            6KB

            MD5

            acc2b699edfea5bf5aae45aba3a41e96

            SHA1

            d2accf4d494e43ceb2cff69abe4dd17147d29cc2

            SHA256

            168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e

            SHA512

            e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe

          • \Users\Admin\AppData\Local\Temp\nse5248.tmp\nsExec.dll

            Filesize

            6KB

            MD5

            acc2b699edfea5bf5aae45aba3a41e96

            SHA1

            d2accf4d494e43ceb2cff69abe4dd17147d29cc2

            SHA256

            168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e

            SHA512

            e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe

          • \Users\Admin\AppData\Local\Temp\nse5248.tmp\nsExec.dll

            Filesize

            6KB

            MD5

            acc2b699edfea5bf5aae45aba3a41e96

            SHA1

            d2accf4d494e43ceb2cff69abe4dd17147d29cc2

            SHA256

            168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e

            SHA512

            e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe

          • \Users\Admin\AppData\Local\Temp\nse5248.tmp\nsExec.dll

            Filesize

            6KB

            MD5

            acc2b699edfea5bf5aae45aba3a41e96

            SHA1

            d2accf4d494e43ceb2cff69abe4dd17147d29cc2

            SHA256

            168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e

            SHA512

            e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe

          • \Windows\SysWOW64\hfnapi.dll

            Filesize

            106KB

            MD5

            fddcadf795e222b72b56c1de1722cfbc

            SHA1

            858b974da9c3f14021076fcb429beb600a2c0c78

            SHA256

            e8dc9a51cb365b36c4998be137bee052fd513ebd630831a05ac3637e5b5dc5c8

            SHA512

            a9f6cbf25611a89a260ce481b8dc5ae0fb5098cb682d527eaffe1740add468c5e2a4572e3020d12529c03f4a4ab87b102e2530994f478206f5572d7886b7a5c4

          • \Windows\SysWOW64\hfnapi.dll

            Filesize

            106KB

            MD5

            fddcadf795e222b72b56c1de1722cfbc

            SHA1

            858b974da9c3f14021076fcb429beb600a2c0c78

            SHA256

            e8dc9a51cb365b36c4998be137bee052fd513ebd630831a05ac3637e5b5dc5c8

            SHA512

            a9f6cbf25611a89a260ce481b8dc5ae0fb5098cb682d527eaffe1740add468c5e2a4572e3020d12529c03f4a4ab87b102e2530994f478206f5572d7886b7a5c4

          • \Windows\SysWOW64\hfnapi.dll

            Filesize

            106KB

            MD5

            fddcadf795e222b72b56c1de1722cfbc

            SHA1

            858b974da9c3f14021076fcb429beb600a2c0c78

            SHA256

            e8dc9a51cb365b36c4998be137bee052fd513ebd630831a05ac3637e5b5dc5c8

            SHA512

            a9f6cbf25611a89a260ce481b8dc5ae0fb5098cb682d527eaffe1740add468c5e2a4572e3020d12529c03f4a4ab87b102e2530994f478206f5572d7886b7a5c4

          • \Windows\SysWOW64\hfpapi.dll

            Filesize

            244KB

            MD5

            4474857119a3498ee1714f4284d817f6

            SHA1

            a532efba64c48e5bdc5754bfc840496b43702da8

            SHA256

            515acb8c958fa32b77e9bde2659dcd7feaef528fdd6b22f949a517cf12e67d8d

            SHA512

            de12a269a132514e330367ab6c665d396510991c690bf3ad676404f1bee52dd1359652c8ba1132cd14b4964d684ff3b1c2bdf712930ee4045ff540a419a8157b

          • \Windows\SysWOW64\hfpapi.dll

            Filesize

            244KB

            MD5

            4474857119a3498ee1714f4284d817f6

            SHA1

            a532efba64c48e5bdc5754bfc840496b43702da8

            SHA256

            515acb8c958fa32b77e9bde2659dcd7feaef528fdd6b22f949a517cf12e67d8d

            SHA512

            de12a269a132514e330367ab6c665d396510991c690bf3ad676404f1bee52dd1359652c8ba1132cd14b4964d684ff3b1c2bdf712930ee4045ff540a419a8157b

          • \Windows\SysWOW64\installd.exe

            Filesize

            108KB

            MD5

            23cb5abc9228a6a432b3c314f3a06776

            SHA1

            8741461c6c06fc0c4d0a7c79849e49bd129fced1

            SHA256

            049437f402b1605bb07b56bbcf9b13598aee9b6b0af8956cb71945da72bfbbaa

            SHA512

            e87aa8c8ca95788b54061d3f2e64fe63f7079ca045d6c4dfe1f8a112ea12327eb7f17e766db3f98e4ff784d8c4800016920fd9bae0fcd4d4e1fcd61e7cb65d27

          • \Windows\SysWOW64\nethtsrv.exe

            Filesize

            176KB

            MD5

            11333a15bca9330a1a5f75e4d54d4ffa

            SHA1

            bfa1cf14285f0e92491d281055b8a8f45eea70aa

            SHA256

            4fd084eddb47d8135faea3678ec7f94dede5465d017f7209f8353bf8d3fa83a9

            SHA512

            1b8e1359494aa5ca1053d7346a15d28227419d28a3e8abe7f93f12f8d613234f3bf891dee8696cbbf2034c942835decfa3442bae783d1a6a18e9fdb202b91243

          • \Windows\SysWOW64\netupdsrv.exe

            Filesize

            159KB

            MD5

            0ad6d14e1e6d74950293d115b2e7fe29

            SHA1

            a21b22ba1c79688a1abc3e11394f1d9ed2f10f97

            SHA256

            e537b5351f42d46d95d16cbf879d17872f38bd4c37460b73f543a8cf549547d8

            SHA512

            996bf93242a77d07a24e99c81acc9d666b4fc8b4625a6a5202eb4778f11854100dc4868c728e24e7e667beeba5fa104c7247fb9132dae093c1bb20036043e71b

          • memory/520-91-0x0000000000360000-0x00000000007BE000-memory.dmp

            Filesize

            4.4MB

          • memory/520-55-0x0000000000360000-0x00000000007BE000-memory.dmp

            Filesize

            4.4MB

          • memory/520-75-0x0000000000360000-0x00000000007BE000-memory.dmp

            Filesize

            4.4MB

          • memory/520-54-0x0000000075881000-0x0000000075883000-memory.dmp

            Filesize

            8KB

          • memory/584-58-0x0000000000000000-mapping.dmp

          • memory/1068-59-0x0000000000000000-mapping.dmp

          • memory/1100-82-0x0000000000000000-mapping.dmp

          • memory/1416-87-0x0000000000000000-mapping.dmp

          • memory/1420-77-0x0000000000000000-mapping.dmp

          • memory/1564-64-0x0000000000000000-mapping.dmp

          • memory/1572-70-0x0000000000000000-mapping.dmp

          • memory/1676-81-0x0000000000000000-mapping.dmp

          • memory/1732-88-0x0000000000000000-mapping.dmp

          • memory/1804-62-0x0000000000000000-mapping.dmp

          • memory/1908-61-0x0000000000000000-mapping.dmp