0e13052059af0f5b12570e98fbaa755a5b622acc468a1099df6e12eca664dc35

Analysis

max time kernel
209s
max time network
31s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
23-11-2022 10:33

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0e13052059af0f5b12570e98fbaa755a5b622acc468a1099df6e12eca664dc35.exe
Size

603KB
MD5

3b84512212be93317a89dfd5743f5639
SHA1

0edece75491f75123d60167dad50f91061e3ee55
SHA256

0e13052059af0f5b12570e98fbaa755a5b622acc468a1099df6e12eca664dc35
SHA512

a1e081470ca04997c21631378c97058121dab9ce85633543ec94b26768ef917952646254d2aa9b55be0cef6f88a7835a74a71af4736f50ae070e4d1cbefb0f3f
SSDEEP

12288:PIny5DYTfIERZtXuuSYMJmtOplR9g6SFVry9ukQz4MkiU:XUTfLluYMEMpDSnBjUMkiU

Score

8^/10

discovery

Malware Config

Signatures

Drops file in Drivers directory 1 IoCs

Processes:

0e13052059af0f5b12570e98fbaa755a5b622acc468a1099df6e12eca664dc35.exe

description ioc process

File created C:\Windows\system32\drivers\nethfdrv.sys 0e13052059af0f5b12570e98fbaa755a5b622acc468a1099df6e12eca664dc35.exe
Executes dropped EXE 3 IoCs

Processes:

installd.exenethtsrv.exenetupdsrv.exe

pid process

1640 installd.exe
1072 nethtsrv.exe
1764 netupdsrv.exe

description	ioc	process
File created	C:\Windows\system32\drivers\nethfdrv.sys	0e13052059af0f5b12570e98fbaa755a5b622acc468a1099df6e12eca664dc35.exe

pid	process
1640	installd.exe
1072	nethtsrv.exe
1764	netupdsrv.exe

Loads dropped DLL 9 IoCs

Processes:

0e13052059af0f5b12570e98fbaa755a5b622acc468a1099df6e12eca664dc35.exeinstalld.exenethtsrv.exe

pid	process
652	0e13052059af0f5b12570e98fbaa755a5b622acc468a1099df6e12eca664dc35.exe
652	0e13052059af0f5b12570e98fbaa755a5b622acc468a1099df6e12eca664dc35.exe
652	0e13052059af0f5b12570e98fbaa755a5b622acc468a1099df6e12eca664dc35.exe
652	0e13052059af0f5b12570e98fbaa755a5b622acc468a1099df6e12eca664dc35.exe
1640	installd.exe
652	0e13052059af0f5b12570e98fbaa755a5b622acc468a1099df6e12eca664dc35.exe
1072	nethtsrv.exe
1072	nethtsrv.exe
652	0e13052059af0f5b12570e98fbaa755a5b622acc468a1099df6e12eca664dc35.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in System32 directory 5 IoCs

Processes:

0e13052059af0f5b12570e98fbaa755a5b622acc468a1099df6e12eca664dc35.exe

description	ioc	process
File created	C:\Windows\SysWOW64\installd.exe	0e13052059af0f5b12570e98fbaa755a5b622acc468a1099df6e12eca664dc35.exe
File created	C:\Windows\SysWOW64\nethtsrv.exe	0e13052059af0f5b12570e98fbaa755a5b622acc468a1099df6e12eca664dc35.exe
File created	C:\Windows\SysWOW64\netupdsrv.exe	0e13052059af0f5b12570e98fbaa755a5b622acc468a1099df6e12eca664dc35.exe
File created	C:\Windows\SysWOW64\hfnapi.dll	0e13052059af0f5b12570e98fbaa755a5b622acc468a1099df6e12eca664dc35.exe
File created	C:\Windows\SysWOW64\hfpapi.dll	0e13052059af0f5b12570e98fbaa755a5b622acc468a1099df6e12eca664dc35.exe

Drops file in Program Files directory 3 IoCs

Processes:

0e13052059af0f5b12570e98fbaa755a5b622acc468a1099df6e12eca664dc35.exe

description	ioc	process
File created	C:\Program Files (x86)\Common Files\Config\data.xml	0e13052059af0f5b12570e98fbaa755a5b622acc468a1099df6e12eca664dc35.exe
File created	C:\Program Files (x86)\Common Files\Config\ver.xml	0e13052059af0f5b12570e98fbaa755a5b622acc468a1099df6e12eca664dc35.exe
File created	C:\Program Files (x86)\Common Files\config\uninstinethnfd.exe	0e13052059af0f5b12570e98fbaa755a5b622acc468a1099df6e12eca664dc35.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Runs net.exe
Suspicious behavior: LoadsDriver 1 IoCs

Processes:

pid process

464

pid	process
464

Suspicious use of WriteProcessMemory 34 IoCs

Processes:

0e13052059af0f5b12570e98fbaa755a5b622acc468a1099df6e12eca664dc35.exenet.exenet.exe

description	pid	process	target process
PID 652 wrote to memory of 1472	652	0e13052059af0f5b12570e98fbaa755a5b622acc468a1099df6e12eca664dc35.exe	net.exe
PID 652 wrote to memory of 1472	652	0e13052059af0f5b12570e98fbaa755a5b622acc468a1099df6e12eca664dc35.exe	net.exe
PID 652 wrote to memory of 1472	652	0e13052059af0f5b12570e98fbaa755a5b622acc468a1099df6e12eca664dc35.exe	net.exe
PID 652 wrote to memory of 1472	652	0e13052059af0f5b12570e98fbaa755a5b622acc468a1099df6e12eca664dc35.exe	net.exe
PID 1472 wrote to memory of 296	1472	net.exe	net1.exe
PID 1472 wrote to memory of 296	1472	net.exe	net1.exe
PID 1472 wrote to memory of 296	1472	net.exe	net1.exe
PID 1472 wrote to memory of 296	1472	net.exe	net1.exe
PID 652 wrote to memory of 1512	652	0e13052059af0f5b12570e98fbaa755a5b622acc468a1099df6e12eca664dc35.exe	net.exe
PID 652 wrote to memory of 1512	652	0e13052059af0f5b12570e98fbaa755a5b622acc468a1099df6e12eca664dc35.exe	net.exe
PID 652 wrote to memory of 1512	652	0e13052059af0f5b12570e98fbaa755a5b622acc468a1099df6e12eca664dc35.exe	net.exe
PID 652 wrote to memory of 1512	652	0e13052059af0f5b12570e98fbaa755a5b622acc468a1099df6e12eca664dc35.exe	net.exe
PID 1512 wrote to memory of 532	1512	net.exe	net1.exe
PID 1512 wrote to memory of 532	1512	net.exe	net1.exe
PID 1512 wrote to memory of 532	1512	net.exe	net1.exe
PID 1512 wrote to memory of 532	1512	net.exe	net1.exe
PID 652 wrote to memory of 1640	652	0e13052059af0f5b12570e98fbaa755a5b622acc468a1099df6e12eca664dc35.exe	installd.exe
PID 652 wrote to memory of 1640	652	0e13052059af0f5b12570e98fbaa755a5b622acc468a1099df6e12eca664dc35.exe	installd.exe
PID 652 wrote to memory of 1640	652	0e13052059af0f5b12570e98fbaa755a5b622acc468a1099df6e12eca664dc35.exe	installd.exe
PID 652 wrote to memory of 1640	652	0e13052059af0f5b12570e98fbaa755a5b622acc468a1099df6e12eca664dc35.exe	installd.exe
PID 652 wrote to memory of 1640	652	0e13052059af0f5b12570e98fbaa755a5b622acc468a1099df6e12eca664dc35.exe	installd.exe
PID 652 wrote to memory of 1640	652	0e13052059af0f5b12570e98fbaa755a5b622acc468a1099df6e12eca664dc35.exe	installd.exe
PID 652 wrote to memory of 1640	652	0e13052059af0f5b12570e98fbaa755a5b622acc468a1099df6e12eca664dc35.exe	installd.exe
PID 652 wrote to memory of 1072	652	0e13052059af0f5b12570e98fbaa755a5b622acc468a1099df6e12eca664dc35.exe	nethtsrv.exe
PID 652 wrote to memory of 1072	652	0e13052059af0f5b12570e98fbaa755a5b622acc468a1099df6e12eca664dc35.exe	nethtsrv.exe
PID 652 wrote to memory of 1072	652	0e13052059af0f5b12570e98fbaa755a5b622acc468a1099df6e12eca664dc35.exe	nethtsrv.exe
PID 652 wrote to memory of 1072	652	0e13052059af0f5b12570e98fbaa755a5b622acc468a1099df6e12eca664dc35.exe	nethtsrv.exe
PID 652 wrote to memory of 1764	652	0e13052059af0f5b12570e98fbaa755a5b622acc468a1099df6e12eca664dc35.exe	netupdsrv.exe
PID 652 wrote to memory of 1764	652	0e13052059af0f5b12570e98fbaa755a5b622acc468a1099df6e12eca664dc35.exe	netupdsrv.exe
PID 652 wrote to memory of 1764	652	0e13052059af0f5b12570e98fbaa755a5b622acc468a1099df6e12eca664dc35.exe	netupdsrv.exe
PID 652 wrote to memory of 1764	652	0e13052059af0f5b12570e98fbaa755a5b622acc468a1099df6e12eca664dc35.exe	netupdsrv.exe
PID 652 wrote to memory of 1764	652	0e13052059af0f5b12570e98fbaa755a5b622acc468a1099df6e12eca664dc35.exe	netupdsrv.exe
PID 652 wrote to memory of 1764	652	0e13052059af0f5b12570e98fbaa755a5b622acc468a1099df6e12eca664dc35.exe	netupdsrv.exe
PID 652 wrote to memory of 1764	652	0e13052059af0f5b12570e98fbaa755a5b622acc468a1099df6e12eca664dc35.exe	netupdsrv.exe

C:\Users\Admin\AppData\Local\Temp\0e13052059af0f5b12570e98fbaa755a5b622acc468a1099df6e12eca664dc35.exe
"C:\Users\Admin\AppData\Local\Temp\0e13052059af0f5b12570e98fbaa755a5b622acc468a1099df6e12eca664dc35.exe"
1⤵
- Drops file in Drivers directory
- Loads dropped DLL
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:652

C:\Windows\SysWOW64\net.exe
net stop nethttpservice
2⤵
- Suspicious use of WriteProcessMemory
PID:1472

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop nethttpservice
3⤵
PID:296

C:\Windows\SysWOW64\net.exe
net stop serviceupdater
2⤵
- Suspicious use of WriteProcessMemory
PID:1512

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop serviceupdater
3⤵
PID:532

C:\Windows\SysWOW64\installd.exe
"C:\Windows\system32\installd.exe" nethfdrv
2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1640

C:\Windows\SysWOW64\nethtsrv.exe
"C:\Windows\system32\nethtsrv.exe" -nfdi
2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1072

C:\Windows\SysWOW64\netupdsrv.exe
"C:\Windows\system32\netupdsrv.exe" -nfdi
2⤵
- Executes dropped EXE
PID:1764

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\hfnapi.dll

Filesize
106KB

MD5
61e9aad4a444e8e5b768e942b6f7754d

SHA1
c5ef7a735949916a75d233c802df96138611abd5

SHA256
d68daba4ac6a809300d068ecb7014dabd41e84aa7688a506b1b5a0de734113a2

SHA512
7b653a5b5b3d9d3944f3b9f4ad165cd7dd565d9e76740b654fd4eff0453fc344496282aa3eb25fa0d579f4592474bfc52bcd919adbdbbe1ac43ee8533d9830a1

Download Submit
C:\Windows\SysWOW64\hfpapi.dll

Filesize
244KB

MD5
cc28f62190a7b810d1f059cf5301a94a

SHA1
1507a428cd739dde4cb490b325a09fabb08cce30

SHA256
a3d5ff6f0720b10f326d29e29db34d399e35560fbd025529d771fc440b841f60

SHA512
5e69696a133b4bec4aa798046a7bf84dd6dc91267c124b2b9f7bd58f45133d3500a938f17b429f5453d2ab44930c141e4af6e91bf25620def628abe25474e74a

Download Submit
C:\Windows\SysWOW64\installd.exe

Filesize
108KB

MD5
14f9d47b8ec1a1481eb2d1219f14868f

SHA1
364b15e1773dcf4b398902b70c57ebc8a2da888f

SHA256
020879b1acaa3971619393edf6721b49ac65fbdfdde97c58d05181600e2faec4

SHA512
94eae74f578cb207b24018ba747cb1cbc04fcebc58e2d7c5809c7407bf1a75d74ed1dbb5bae3ce04cb8f0adb1ef1526ea2d62ff0d8cbd138869000dbc6ec96c2

Download Submit
C:\Windows\SysWOW64\nethtsrv.exe

Filesize
176KB

MD5
a6460dd772ebf552eb35dc3361cc5704

SHA1
e28dbe393ded187ac9a88fd188627a53c5f72640

SHA256
3f9a9d3d0fec0e29cf91dca4d706c5e567592418e0c0aa281c018f4c33119782

SHA512
3f0cc5cd8c6b1e13d801912f27f4891ac8c8e36c496cf785d88207e1e04ce01fa0d2db2b7a2bb9d2c00e6d3084ba0e5344c51714499592f0f866a1fcc2542ba4

Download Submit
C:\Windows\SysWOW64\netupdsrv.exe

Filesize
159KB

MD5
37b5fc05a32a642702d6a4548dfd17a4

SHA1
a2f1cab1bc9172264ce68d96086ab10b1e0852a3

SHA256
c7e2275bd072e4384b2c55199a99c70941091f1b2bcdcab8c5cdb3838879b4b5

SHA512
8bf407ec069092c3379aa66160b95c64b9e71b7ff2e60b11875c6bef46ddfe478034297394fca0209322cc091265a69dfa5754469ac2ab13c977fe36179bc45d

Download Submit
\Users\Admin\AppData\Local\Temp\nsk8BEE.tmp\System.dll

Filesize
11KB

MD5
c17103ae9072a06da581dec998343fc1

SHA1
b72148c6bdfaada8b8c3f950e610ee7cf1da1f8d

SHA256
dc58d8ad81cacb0c1ed72e33bff8f23ea40b5252b5bb55d393a0903e6819ae2f

SHA512
d32a71aaef18e993f28096d536e41c4d016850721b31171513ce28bbd805a54fd290b7c3e9d935f72e676a1acfb4f0dcc89d95040a0dd29f2b6975855c18986f

Download Submit
\Users\Admin\AppData\Local\Temp\nsk8BEE.tmp\nsExec.dll

Filesize
6KB

MD5
acc2b699edfea5bf5aae45aba3a41e96

SHA1
d2accf4d494e43ceb2cff69abe4dd17147d29cc2

SHA256
168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e

SHA512
e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe

Download Submit
\Users\Admin\AppData\Local\Temp\nsk8BEE.tmp\nsExec.dll

Filesize
6KB

MD5
acc2b699edfea5bf5aae45aba3a41e96

SHA1
d2accf4d494e43ceb2cff69abe4dd17147d29cc2

SHA256
168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e

SHA512
e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe

Download Submit
\Windows\SysWOW64\hfnapi.dll

Filesize
106KB

MD5
61e9aad4a444e8e5b768e942b6f7754d

SHA1
c5ef7a735949916a75d233c802df96138611abd5

SHA256
d68daba4ac6a809300d068ecb7014dabd41e84aa7688a506b1b5a0de734113a2

SHA512
7b653a5b5b3d9d3944f3b9f4ad165cd7dd565d9e76740b654fd4eff0453fc344496282aa3eb25fa0d579f4592474bfc52bcd919adbdbbe1ac43ee8533d9830a1

Download Submit
\Windows\SysWOW64\hfnapi.dll

Filesize
106KB

MD5
61e9aad4a444e8e5b768e942b6f7754d

SHA1
c5ef7a735949916a75d233c802df96138611abd5

SHA256
d68daba4ac6a809300d068ecb7014dabd41e84aa7688a506b1b5a0de734113a2

SHA512
7b653a5b5b3d9d3944f3b9f4ad165cd7dd565d9e76740b654fd4eff0453fc344496282aa3eb25fa0d579f4592474bfc52bcd919adbdbbe1ac43ee8533d9830a1

Download Submit
\Windows\SysWOW64\hfpapi.dll

Filesize
244KB

MD5
cc28f62190a7b810d1f059cf5301a94a

SHA1
1507a428cd739dde4cb490b325a09fabb08cce30

SHA256
a3d5ff6f0720b10f326d29e29db34d399e35560fbd025529d771fc440b841f60

SHA512
5e69696a133b4bec4aa798046a7bf84dd6dc91267c124b2b9f7bd58f45133d3500a938f17b429f5453d2ab44930c141e4af6e91bf25620def628abe25474e74a

Download Submit
\Windows\SysWOW64\installd.exe

Filesize
108KB

MD5
14f9d47b8ec1a1481eb2d1219f14868f

SHA1
364b15e1773dcf4b398902b70c57ebc8a2da888f

SHA256
020879b1acaa3971619393edf6721b49ac65fbdfdde97c58d05181600e2faec4

SHA512
94eae74f578cb207b24018ba747cb1cbc04fcebc58e2d7c5809c7407bf1a75d74ed1dbb5bae3ce04cb8f0adb1ef1526ea2d62ff0d8cbd138869000dbc6ec96c2

Download Submit
\Windows\SysWOW64\nethtsrv.exe

Filesize
176KB

MD5
a6460dd772ebf552eb35dc3361cc5704

SHA1
e28dbe393ded187ac9a88fd188627a53c5f72640

SHA256
3f9a9d3d0fec0e29cf91dca4d706c5e567592418e0c0aa281c018f4c33119782

SHA512
3f0cc5cd8c6b1e13d801912f27f4891ac8c8e36c496cf785d88207e1e04ce01fa0d2db2b7a2bb9d2c00e6d3084ba0e5344c51714499592f0f866a1fcc2542ba4

Download Submit
\Windows\SysWOW64\netupdsrv.exe

Filesize
159KB

MD5
37b5fc05a32a642702d6a4548dfd17a4

SHA1
a2f1cab1bc9172264ce68d96086ab10b1e0852a3

SHA256
c7e2275bd072e4384b2c55199a99c70941091f1b2bcdcab8c5cdb3838879b4b5

SHA512
8bf407ec069092c3379aa66160b95c64b9e71b7ff2e60b11875c6bef46ddfe478034297394fca0209322cc091265a69dfa5754469ac2ab13c977fe36179bc45d

Download Submit
memory/296-59-0x0000000000000000-mapping.dmp

Download
memory/532-62-0x0000000000000000-mapping.dmp

Download
memory/652-63-0x0000000000360000-0x00000000007BE000-memory.dmp

Filesize
4.4MB

Download
memory/652-56-0x0000000000360000-0x00000000007BE000-memory.dmp

Filesize
4.4MB

Download
memory/652-54-0x00000000757E1000-0x00000000757E3000-memory.dmp

Filesize
8KB

Download
memory/1072-71-0x0000000000000000-mapping.dmp

Download
memory/1472-58-0x0000000000000000-mapping.dmp

Download
memory/1512-61-0x0000000000000000-mapping.dmp

Download
memory/1640-65-0x0000000000000000-mapping.dmp

Download
memory/1764-77-0x0000000000000000-mapping.dmp

Download