Analysis
-
max time kernel
101s -
max time network
31s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system -
submitted
23-11-2022 10:34
Static task
static1
Behavioral task
behavioral1
Sample
0d70b068b8dca10c922b302053ea4a924938e116077ca7bbca8576d069d22d29.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
0d70b068b8dca10c922b302053ea4a924938e116077ca7bbca8576d069d22d29.exe
Resource
win10v2004-20221111-en
General
-
Target
0d70b068b8dca10c922b302053ea4a924938e116077ca7bbca8576d069d22d29.exe
-
Size
603KB
-
MD5
d5715395d705ef0446924ed812a630cd
-
SHA1
bb92c1c25d3fa9fdc788865afea54b697bd201aa
-
SHA256
0d70b068b8dca10c922b302053ea4a924938e116077ca7bbca8576d069d22d29
-
SHA512
62d65385dcd3e9d7818616cd51176b7b7c05e590e4b6cb48725fdf8f21502cc3627f3cc75495dc08681c5f25ed2daeefec78ed61d32e664a6211677b9590ab3a
-
SSDEEP
12288:RIny5DYTMIUgbia0mIcFIecbqule52k9KdlM7:tUTMzva0DwIec3k2
Malware Config
Signatures
-
Drops file in Drivers directory 1 IoCs
Processes:
0d70b068b8dca10c922b302053ea4a924938e116077ca7bbca8576d069d22d29.exedescription ioc process File created C:\Windows\system32\drivers\nethfdrv.sys 0d70b068b8dca10c922b302053ea4a924938e116077ca7bbca8576d069d22d29.exe -
Executes dropped EXE 5 IoCs
Processes:
installd.exenethtsrv.exenetupdsrv.exenethtsrv.exenetupdsrv.exepid process 1564 installd.exe 1572 nethtsrv.exe 1420 netupdsrv.exe 1924 nethtsrv.exe 1772 netupdsrv.exe -
Loads dropped DLL 13 IoCs
Processes:
0d70b068b8dca10c922b302053ea4a924938e116077ca7bbca8576d069d22d29.exeinstalld.exenethtsrv.exenethtsrv.exepid process 520 0d70b068b8dca10c922b302053ea4a924938e116077ca7bbca8576d069d22d29.exe 520 0d70b068b8dca10c922b302053ea4a924938e116077ca7bbca8576d069d22d29.exe 520 0d70b068b8dca10c922b302053ea4a924938e116077ca7bbca8576d069d22d29.exe 520 0d70b068b8dca10c922b302053ea4a924938e116077ca7bbca8576d069d22d29.exe 1564 installd.exe 520 0d70b068b8dca10c922b302053ea4a924938e116077ca7bbca8576d069d22d29.exe 1572 nethtsrv.exe 1572 nethtsrv.exe 520 0d70b068b8dca10c922b302053ea4a924938e116077ca7bbca8576d069d22d29.exe 520 0d70b068b8dca10c922b302053ea4a924938e116077ca7bbca8576d069d22d29.exe 1924 nethtsrv.exe 1924 nethtsrv.exe 520 0d70b068b8dca10c922b302053ea4a924938e116077ca7bbca8576d069d22d29.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops file in System32 directory 5 IoCs
Processes:
0d70b068b8dca10c922b302053ea4a924938e116077ca7bbca8576d069d22d29.exedescription ioc process File created C:\Windows\SysWOW64\hfnapi.dll 0d70b068b8dca10c922b302053ea4a924938e116077ca7bbca8576d069d22d29.exe File created C:\Windows\SysWOW64\hfpapi.dll 0d70b068b8dca10c922b302053ea4a924938e116077ca7bbca8576d069d22d29.exe File created C:\Windows\SysWOW64\installd.exe 0d70b068b8dca10c922b302053ea4a924938e116077ca7bbca8576d069d22d29.exe File created C:\Windows\SysWOW64\nethtsrv.exe 0d70b068b8dca10c922b302053ea4a924938e116077ca7bbca8576d069d22d29.exe File created C:\Windows\SysWOW64\netupdsrv.exe 0d70b068b8dca10c922b302053ea4a924938e116077ca7bbca8576d069d22d29.exe -
Drops file in Program Files directory 3 IoCs
Processes:
0d70b068b8dca10c922b302053ea4a924938e116077ca7bbca8576d069d22d29.exedescription ioc process File created C:\Program Files (x86)\Common Files\Config\data.xml 0d70b068b8dca10c922b302053ea4a924938e116077ca7bbca8576d069d22d29.exe File created C:\Program Files (x86)\Common Files\Config\ver.xml 0d70b068b8dca10c922b302053ea4a924938e116077ca7bbca8576d069d22d29.exe File created C:\Program Files (x86)\Common Files\config\uninstinethnfd.exe 0d70b068b8dca10c922b302053ea4a924938e116077ca7bbca8576d069d22d29.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Runs net.exe
-
Suspicious behavior: LoadsDriver 1 IoCs
Processes:
pid process 460 -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
nethtsrv.exedescription pid process Token: SeDebugPrivilege 1924 nethtsrv.exe -
Suspicious use of WriteProcessMemory 50 IoCs
Processes:
0d70b068b8dca10c922b302053ea4a924938e116077ca7bbca8576d069d22d29.exenet.exenet.exenet.exenet.exedescription pid process target process PID 520 wrote to memory of 584 520 0d70b068b8dca10c922b302053ea4a924938e116077ca7bbca8576d069d22d29.exe net.exe PID 520 wrote to memory of 584 520 0d70b068b8dca10c922b302053ea4a924938e116077ca7bbca8576d069d22d29.exe net.exe PID 520 wrote to memory of 584 520 0d70b068b8dca10c922b302053ea4a924938e116077ca7bbca8576d069d22d29.exe net.exe PID 520 wrote to memory of 584 520 0d70b068b8dca10c922b302053ea4a924938e116077ca7bbca8576d069d22d29.exe net.exe PID 584 wrote to memory of 1068 584 net.exe net1.exe PID 584 wrote to memory of 1068 584 net.exe net1.exe PID 584 wrote to memory of 1068 584 net.exe net1.exe PID 584 wrote to memory of 1068 584 net.exe net1.exe PID 520 wrote to memory of 1908 520 0d70b068b8dca10c922b302053ea4a924938e116077ca7bbca8576d069d22d29.exe net.exe PID 520 wrote to memory of 1908 520 0d70b068b8dca10c922b302053ea4a924938e116077ca7bbca8576d069d22d29.exe net.exe PID 520 wrote to memory of 1908 520 0d70b068b8dca10c922b302053ea4a924938e116077ca7bbca8576d069d22d29.exe net.exe PID 520 wrote to memory of 1908 520 0d70b068b8dca10c922b302053ea4a924938e116077ca7bbca8576d069d22d29.exe net.exe PID 1908 wrote to memory of 1804 1908 net.exe net1.exe PID 1908 wrote to memory of 1804 1908 net.exe net1.exe PID 1908 wrote to memory of 1804 1908 net.exe net1.exe PID 1908 wrote to memory of 1804 1908 net.exe net1.exe PID 520 wrote to memory of 1564 520 0d70b068b8dca10c922b302053ea4a924938e116077ca7bbca8576d069d22d29.exe installd.exe PID 520 wrote to memory of 1564 520 0d70b068b8dca10c922b302053ea4a924938e116077ca7bbca8576d069d22d29.exe installd.exe PID 520 wrote to memory of 1564 520 0d70b068b8dca10c922b302053ea4a924938e116077ca7bbca8576d069d22d29.exe installd.exe PID 520 wrote to memory of 1564 520 0d70b068b8dca10c922b302053ea4a924938e116077ca7bbca8576d069d22d29.exe installd.exe PID 520 wrote to memory of 1564 520 0d70b068b8dca10c922b302053ea4a924938e116077ca7bbca8576d069d22d29.exe installd.exe PID 520 wrote to memory of 1564 520 0d70b068b8dca10c922b302053ea4a924938e116077ca7bbca8576d069d22d29.exe installd.exe PID 520 wrote to memory of 1564 520 0d70b068b8dca10c922b302053ea4a924938e116077ca7bbca8576d069d22d29.exe installd.exe PID 520 wrote to memory of 1572 520 0d70b068b8dca10c922b302053ea4a924938e116077ca7bbca8576d069d22d29.exe nethtsrv.exe PID 520 wrote to memory of 1572 520 0d70b068b8dca10c922b302053ea4a924938e116077ca7bbca8576d069d22d29.exe nethtsrv.exe PID 520 wrote to memory of 1572 520 0d70b068b8dca10c922b302053ea4a924938e116077ca7bbca8576d069d22d29.exe nethtsrv.exe PID 520 wrote to memory of 1572 520 0d70b068b8dca10c922b302053ea4a924938e116077ca7bbca8576d069d22d29.exe nethtsrv.exe PID 520 wrote to memory of 1420 520 0d70b068b8dca10c922b302053ea4a924938e116077ca7bbca8576d069d22d29.exe netupdsrv.exe PID 520 wrote to memory of 1420 520 0d70b068b8dca10c922b302053ea4a924938e116077ca7bbca8576d069d22d29.exe netupdsrv.exe PID 520 wrote to memory of 1420 520 0d70b068b8dca10c922b302053ea4a924938e116077ca7bbca8576d069d22d29.exe netupdsrv.exe PID 520 wrote to memory of 1420 520 0d70b068b8dca10c922b302053ea4a924938e116077ca7bbca8576d069d22d29.exe netupdsrv.exe PID 520 wrote to memory of 1420 520 0d70b068b8dca10c922b302053ea4a924938e116077ca7bbca8576d069d22d29.exe netupdsrv.exe PID 520 wrote to memory of 1420 520 0d70b068b8dca10c922b302053ea4a924938e116077ca7bbca8576d069d22d29.exe netupdsrv.exe PID 520 wrote to memory of 1420 520 0d70b068b8dca10c922b302053ea4a924938e116077ca7bbca8576d069d22d29.exe netupdsrv.exe PID 520 wrote to memory of 1676 520 0d70b068b8dca10c922b302053ea4a924938e116077ca7bbca8576d069d22d29.exe net.exe PID 520 wrote to memory of 1676 520 0d70b068b8dca10c922b302053ea4a924938e116077ca7bbca8576d069d22d29.exe net.exe PID 520 wrote to memory of 1676 520 0d70b068b8dca10c922b302053ea4a924938e116077ca7bbca8576d069d22d29.exe net.exe PID 520 wrote to memory of 1676 520 0d70b068b8dca10c922b302053ea4a924938e116077ca7bbca8576d069d22d29.exe net.exe PID 1676 wrote to memory of 1100 1676 net.exe net1.exe PID 1676 wrote to memory of 1100 1676 net.exe net1.exe PID 1676 wrote to memory of 1100 1676 net.exe net1.exe PID 1676 wrote to memory of 1100 1676 net.exe net1.exe PID 520 wrote to memory of 1416 520 0d70b068b8dca10c922b302053ea4a924938e116077ca7bbca8576d069d22d29.exe net.exe PID 520 wrote to memory of 1416 520 0d70b068b8dca10c922b302053ea4a924938e116077ca7bbca8576d069d22d29.exe net.exe PID 520 wrote to memory of 1416 520 0d70b068b8dca10c922b302053ea4a924938e116077ca7bbca8576d069d22d29.exe net.exe PID 520 wrote to memory of 1416 520 0d70b068b8dca10c922b302053ea4a924938e116077ca7bbca8576d069d22d29.exe net.exe PID 1416 wrote to memory of 1732 1416 net.exe net1.exe PID 1416 wrote to memory of 1732 1416 net.exe net1.exe PID 1416 wrote to memory of 1732 1416 net.exe net1.exe PID 1416 wrote to memory of 1732 1416 net.exe net1.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\0d70b068b8dca10c922b302053ea4a924938e116077ca7bbca8576d069d22d29.exe"C:\Users\Admin\AppData\Local\Temp\0d70b068b8dca10c922b302053ea4a924938e116077ca7bbca8576d069d22d29.exe"1⤵
- Drops file in Drivers directory
- Loads dropped DLL
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:520 -
C:\Windows\SysWOW64\net.exenet stop nethttpservice2⤵
- Suspicious use of WriteProcessMemory
PID:584 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop nethttpservice3⤵PID:1068
-
C:\Windows\SysWOW64\net.exenet stop serviceupdater2⤵
- Suspicious use of WriteProcessMemory
PID:1908 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop serviceupdater3⤵PID:1804
-
C:\Windows\SysWOW64\installd.exe"C:\Windows\system32\installd.exe" nethfdrv2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1564 -
C:\Windows\SysWOW64\nethtsrv.exe"C:\Windows\system32\nethtsrv.exe" -nfdi2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1572 -
C:\Windows\SysWOW64\netupdsrv.exe"C:\Windows\system32\netupdsrv.exe" -nfdi2⤵
- Executes dropped EXE
PID:1420 -
C:\Windows\SysWOW64\net.exenet start nethttpservice2⤵
- Suspicious use of WriteProcessMemory
PID:1676 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 start nethttpservice3⤵PID:1100
-
C:\Windows\SysWOW64\net.exenet start serviceupdater2⤵
- Suspicious use of WriteProcessMemory
PID:1416 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 start serviceupdater3⤵PID:1732
-
C:\Windows\SysWOW64\nethtsrv.exeC:\Windows\SysWOW64\nethtsrv.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:1924
-
C:\Windows\SysWOW64\netupdsrv.exeC:\Windows\SysWOW64\netupdsrv.exe1⤵
- Executes dropped EXE
PID:1772
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
106KB
MD5fddcadf795e222b72b56c1de1722cfbc
SHA1858b974da9c3f14021076fcb429beb600a2c0c78
SHA256e8dc9a51cb365b36c4998be137bee052fd513ebd630831a05ac3637e5b5dc5c8
SHA512a9f6cbf25611a89a260ce481b8dc5ae0fb5098cb682d527eaffe1740add468c5e2a4572e3020d12529c03f4a4ab87b102e2530994f478206f5572d7886b7a5c4
-
Filesize
244KB
MD54474857119a3498ee1714f4284d817f6
SHA1a532efba64c48e5bdc5754bfc840496b43702da8
SHA256515acb8c958fa32b77e9bde2659dcd7feaef528fdd6b22f949a517cf12e67d8d
SHA512de12a269a132514e330367ab6c665d396510991c690bf3ad676404f1bee52dd1359652c8ba1132cd14b4964d684ff3b1c2bdf712930ee4045ff540a419a8157b
-
Filesize
108KB
MD523cb5abc9228a6a432b3c314f3a06776
SHA18741461c6c06fc0c4d0a7c79849e49bd129fced1
SHA256049437f402b1605bb07b56bbcf9b13598aee9b6b0af8956cb71945da72bfbbaa
SHA512e87aa8c8ca95788b54061d3f2e64fe63f7079ca045d6c4dfe1f8a112ea12327eb7f17e766db3f98e4ff784d8c4800016920fd9bae0fcd4d4e1fcd61e7cb65d27
-
Filesize
176KB
MD511333a15bca9330a1a5f75e4d54d4ffa
SHA1bfa1cf14285f0e92491d281055b8a8f45eea70aa
SHA2564fd084eddb47d8135faea3678ec7f94dede5465d017f7209f8353bf8d3fa83a9
SHA5121b8e1359494aa5ca1053d7346a15d28227419d28a3e8abe7f93f12f8d613234f3bf891dee8696cbbf2034c942835decfa3442bae783d1a6a18e9fdb202b91243
-
Filesize
176KB
MD511333a15bca9330a1a5f75e4d54d4ffa
SHA1bfa1cf14285f0e92491d281055b8a8f45eea70aa
SHA2564fd084eddb47d8135faea3678ec7f94dede5465d017f7209f8353bf8d3fa83a9
SHA5121b8e1359494aa5ca1053d7346a15d28227419d28a3e8abe7f93f12f8d613234f3bf891dee8696cbbf2034c942835decfa3442bae783d1a6a18e9fdb202b91243
-
Filesize
159KB
MD50ad6d14e1e6d74950293d115b2e7fe29
SHA1a21b22ba1c79688a1abc3e11394f1d9ed2f10f97
SHA256e537b5351f42d46d95d16cbf879d17872f38bd4c37460b73f543a8cf549547d8
SHA512996bf93242a77d07a24e99c81acc9d666b4fc8b4625a6a5202eb4778f11854100dc4868c728e24e7e667beeba5fa104c7247fb9132dae093c1bb20036043e71b
-
Filesize
159KB
MD50ad6d14e1e6d74950293d115b2e7fe29
SHA1a21b22ba1c79688a1abc3e11394f1d9ed2f10f97
SHA256e537b5351f42d46d95d16cbf879d17872f38bd4c37460b73f543a8cf549547d8
SHA512996bf93242a77d07a24e99c81acc9d666b4fc8b4625a6a5202eb4778f11854100dc4868c728e24e7e667beeba5fa104c7247fb9132dae093c1bb20036043e71b
-
Filesize
11KB
MD5c17103ae9072a06da581dec998343fc1
SHA1b72148c6bdfaada8b8c3f950e610ee7cf1da1f8d
SHA256dc58d8ad81cacb0c1ed72e33bff8f23ea40b5252b5bb55d393a0903e6819ae2f
SHA512d32a71aaef18e993f28096d536e41c4d016850721b31171513ce28bbd805a54fd290b7c3e9d935f72e676a1acfb4f0dcc89d95040a0dd29f2b6975855c18986f
-
Filesize
6KB
MD5acc2b699edfea5bf5aae45aba3a41e96
SHA1d2accf4d494e43ceb2cff69abe4dd17147d29cc2
SHA256168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e
SHA512e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe
-
Filesize
6KB
MD5acc2b699edfea5bf5aae45aba3a41e96
SHA1d2accf4d494e43ceb2cff69abe4dd17147d29cc2
SHA256168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e
SHA512e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe
-
Filesize
6KB
MD5acc2b699edfea5bf5aae45aba3a41e96
SHA1d2accf4d494e43ceb2cff69abe4dd17147d29cc2
SHA256168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e
SHA512e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe
-
Filesize
6KB
MD5acc2b699edfea5bf5aae45aba3a41e96
SHA1d2accf4d494e43ceb2cff69abe4dd17147d29cc2
SHA256168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e
SHA512e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe
-
Filesize
106KB
MD5fddcadf795e222b72b56c1de1722cfbc
SHA1858b974da9c3f14021076fcb429beb600a2c0c78
SHA256e8dc9a51cb365b36c4998be137bee052fd513ebd630831a05ac3637e5b5dc5c8
SHA512a9f6cbf25611a89a260ce481b8dc5ae0fb5098cb682d527eaffe1740add468c5e2a4572e3020d12529c03f4a4ab87b102e2530994f478206f5572d7886b7a5c4
-
Filesize
106KB
MD5fddcadf795e222b72b56c1de1722cfbc
SHA1858b974da9c3f14021076fcb429beb600a2c0c78
SHA256e8dc9a51cb365b36c4998be137bee052fd513ebd630831a05ac3637e5b5dc5c8
SHA512a9f6cbf25611a89a260ce481b8dc5ae0fb5098cb682d527eaffe1740add468c5e2a4572e3020d12529c03f4a4ab87b102e2530994f478206f5572d7886b7a5c4
-
Filesize
106KB
MD5fddcadf795e222b72b56c1de1722cfbc
SHA1858b974da9c3f14021076fcb429beb600a2c0c78
SHA256e8dc9a51cb365b36c4998be137bee052fd513ebd630831a05ac3637e5b5dc5c8
SHA512a9f6cbf25611a89a260ce481b8dc5ae0fb5098cb682d527eaffe1740add468c5e2a4572e3020d12529c03f4a4ab87b102e2530994f478206f5572d7886b7a5c4
-
Filesize
244KB
MD54474857119a3498ee1714f4284d817f6
SHA1a532efba64c48e5bdc5754bfc840496b43702da8
SHA256515acb8c958fa32b77e9bde2659dcd7feaef528fdd6b22f949a517cf12e67d8d
SHA512de12a269a132514e330367ab6c665d396510991c690bf3ad676404f1bee52dd1359652c8ba1132cd14b4964d684ff3b1c2bdf712930ee4045ff540a419a8157b
-
Filesize
244KB
MD54474857119a3498ee1714f4284d817f6
SHA1a532efba64c48e5bdc5754bfc840496b43702da8
SHA256515acb8c958fa32b77e9bde2659dcd7feaef528fdd6b22f949a517cf12e67d8d
SHA512de12a269a132514e330367ab6c665d396510991c690bf3ad676404f1bee52dd1359652c8ba1132cd14b4964d684ff3b1c2bdf712930ee4045ff540a419a8157b
-
Filesize
108KB
MD523cb5abc9228a6a432b3c314f3a06776
SHA18741461c6c06fc0c4d0a7c79849e49bd129fced1
SHA256049437f402b1605bb07b56bbcf9b13598aee9b6b0af8956cb71945da72bfbbaa
SHA512e87aa8c8ca95788b54061d3f2e64fe63f7079ca045d6c4dfe1f8a112ea12327eb7f17e766db3f98e4ff784d8c4800016920fd9bae0fcd4d4e1fcd61e7cb65d27
-
Filesize
176KB
MD511333a15bca9330a1a5f75e4d54d4ffa
SHA1bfa1cf14285f0e92491d281055b8a8f45eea70aa
SHA2564fd084eddb47d8135faea3678ec7f94dede5465d017f7209f8353bf8d3fa83a9
SHA5121b8e1359494aa5ca1053d7346a15d28227419d28a3e8abe7f93f12f8d613234f3bf891dee8696cbbf2034c942835decfa3442bae783d1a6a18e9fdb202b91243
-
Filesize
159KB
MD50ad6d14e1e6d74950293d115b2e7fe29
SHA1a21b22ba1c79688a1abc3e11394f1d9ed2f10f97
SHA256e537b5351f42d46d95d16cbf879d17872f38bd4c37460b73f543a8cf549547d8
SHA512996bf93242a77d07a24e99c81acc9d666b4fc8b4625a6a5202eb4778f11854100dc4868c728e24e7e667beeba5fa104c7247fb9132dae093c1bb20036043e71b