e03c3af586d81d3fb26af74a9e9d61dea1baef2c20ee260a339a63cdf483574e

Analysis

max time kernel
189s
max time network
33s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
23-11-2022 10:51

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

e03c3af586d81d3fb26af74a9e9d61dea1baef2c20ee260a339a63cdf483574e.exe
Size

447KB
MD5

079975ac2c80e7f0a09f55508f36c3cd
SHA1

ee803e0994df8358cabc7438f75b46716e476b39
SHA256

e03c3af586d81d3fb26af74a9e9d61dea1baef2c20ee260a339a63cdf483574e
SHA512

78fd7cd6a868dc7e36f5f9d873944898a85508dd84a3e5c0c2f5ec079458de354002a757b0337e1da0adb5e46f92e519fbce792a1ccc3efabf4b8c9b490d8f6a
SSDEEP

6144:XzfhRd+nzLDQRjDxyjM2P5lZc/hGWp4oCzuKHQOkUrGUthHOC9+TBDYLdlMHlBJF:FsPDQh+XZCh16HHQythj9gXtIQT

Score

8^/10

discovery

Malware Config

Signatures

Drops file in Drivers directory 1 IoCs

Processes:

e03c3af586d81d3fb26af74a9e9d61dea1baef2c20ee260a339a63cdf483574e.exe

description ioc process

File created C:\Windows\system32\drivers\nethfdrv.sys e03c3af586d81d3fb26af74a9e9d61dea1baef2c20ee260a339a63cdf483574e.exe
Executes dropped EXE 3 IoCs

Processes:

installd.exenethtsrv.exenetupdsrv.exe

pid process

532 installd.exe
1952 nethtsrv.exe
1820 netupdsrv.exe

description	ioc	process
File created	C:\Windows\system32\drivers\nethfdrv.sys	e03c3af586d81d3fb26af74a9e9d61dea1baef2c20ee260a339a63cdf483574e.exe

pid	process
532	installd.exe
1952	nethtsrv.exe
1820	netupdsrv.exe

Loads dropped DLL 9 IoCs

Processes:

e03c3af586d81d3fb26af74a9e9d61dea1baef2c20ee260a339a63cdf483574e.exeinstalld.exenethtsrv.exe

pid	process
776	e03c3af586d81d3fb26af74a9e9d61dea1baef2c20ee260a339a63cdf483574e.exe
776	e03c3af586d81d3fb26af74a9e9d61dea1baef2c20ee260a339a63cdf483574e.exe
776	e03c3af586d81d3fb26af74a9e9d61dea1baef2c20ee260a339a63cdf483574e.exe
776	e03c3af586d81d3fb26af74a9e9d61dea1baef2c20ee260a339a63cdf483574e.exe
532	installd.exe
776	e03c3af586d81d3fb26af74a9e9d61dea1baef2c20ee260a339a63cdf483574e.exe
1952	nethtsrv.exe
1952	nethtsrv.exe
776	e03c3af586d81d3fb26af74a9e9d61dea1baef2c20ee260a339a63cdf483574e.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in System32 directory 5 IoCs

Processes:

e03c3af586d81d3fb26af74a9e9d61dea1baef2c20ee260a339a63cdf483574e.exe

description	ioc	process
File created	C:\Windows\SysWOW64\netupdsrv.exe	e03c3af586d81d3fb26af74a9e9d61dea1baef2c20ee260a339a63cdf483574e.exe
File created	C:\Windows\SysWOW64\hfnapi.dll	e03c3af586d81d3fb26af74a9e9d61dea1baef2c20ee260a339a63cdf483574e.exe
File created	C:\Windows\SysWOW64\hfpapi.dll	e03c3af586d81d3fb26af74a9e9d61dea1baef2c20ee260a339a63cdf483574e.exe
File created	C:\Windows\SysWOW64\installd.exe	e03c3af586d81d3fb26af74a9e9d61dea1baef2c20ee260a339a63cdf483574e.exe
File created	C:\Windows\SysWOW64\nethtsrv.exe	e03c3af586d81d3fb26af74a9e9d61dea1baef2c20ee260a339a63cdf483574e.exe

Drops file in Program Files directory 3 IoCs

Processes:

e03c3af586d81d3fb26af74a9e9d61dea1baef2c20ee260a339a63cdf483574e.exe

description	ioc	process
File created	C:\Program Files (x86)\Common Files\Config\data.xml	e03c3af586d81d3fb26af74a9e9d61dea1baef2c20ee260a339a63cdf483574e.exe
File created	C:\Program Files (x86)\Common Files\Config\ver.xml	e03c3af586d81d3fb26af74a9e9d61dea1baef2c20ee260a339a63cdf483574e.exe
File created	C:\Program Files (x86)\Common Files\config\uninstinethnfd.exe	e03c3af586d81d3fb26af74a9e9d61dea1baef2c20ee260a339a63cdf483574e.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Runs net.exe
Suspicious behavior: LoadsDriver 1 IoCs

Processes:

pid process

460

pid	process
460

Suspicious use of WriteProcessMemory 34 IoCs

Processes:

e03c3af586d81d3fb26af74a9e9d61dea1baef2c20ee260a339a63cdf483574e.exenet.exenet.exe

description	pid	process	target process
PID 776 wrote to memory of 784	776	e03c3af586d81d3fb26af74a9e9d61dea1baef2c20ee260a339a63cdf483574e.exe	net.exe
PID 776 wrote to memory of 784	776	e03c3af586d81d3fb26af74a9e9d61dea1baef2c20ee260a339a63cdf483574e.exe	net.exe
PID 776 wrote to memory of 784	776	e03c3af586d81d3fb26af74a9e9d61dea1baef2c20ee260a339a63cdf483574e.exe	net.exe
PID 776 wrote to memory of 784	776	e03c3af586d81d3fb26af74a9e9d61dea1baef2c20ee260a339a63cdf483574e.exe	net.exe
PID 784 wrote to memory of 1632	784	net.exe	net1.exe
PID 784 wrote to memory of 1632	784	net.exe	net1.exe
PID 784 wrote to memory of 1632	784	net.exe	net1.exe
PID 784 wrote to memory of 1632	784	net.exe	net1.exe
PID 776 wrote to memory of 916	776	e03c3af586d81d3fb26af74a9e9d61dea1baef2c20ee260a339a63cdf483574e.exe	net.exe
PID 776 wrote to memory of 916	776	e03c3af586d81d3fb26af74a9e9d61dea1baef2c20ee260a339a63cdf483574e.exe	net.exe
PID 776 wrote to memory of 916	776	e03c3af586d81d3fb26af74a9e9d61dea1baef2c20ee260a339a63cdf483574e.exe	net.exe
PID 776 wrote to memory of 916	776	e03c3af586d81d3fb26af74a9e9d61dea1baef2c20ee260a339a63cdf483574e.exe	net.exe
PID 916 wrote to memory of 692	916	net.exe	net1.exe
PID 916 wrote to memory of 692	916	net.exe	net1.exe
PID 916 wrote to memory of 692	916	net.exe	net1.exe
PID 916 wrote to memory of 692	916	net.exe	net1.exe
PID 776 wrote to memory of 532	776	e03c3af586d81d3fb26af74a9e9d61dea1baef2c20ee260a339a63cdf483574e.exe	installd.exe
PID 776 wrote to memory of 532	776	e03c3af586d81d3fb26af74a9e9d61dea1baef2c20ee260a339a63cdf483574e.exe	installd.exe
PID 776 wrote to memory of 532	776	e03c3af586d81d3fb26af74a9e9d61dea1baef2c20ee260a339a63cdf483574e.exe	installd.exe
PID 776 wrote to memory of 532	776	e03c3af586d81d3fb26af74a9e9d61dea1baef2c20ee260a339a63cdf483574e.exe	installd.exe
PID 776 wrote to memory of 532	776	e03c3af586d81d3fb26af74a9e9d61dea1baef2c20ee260a339a63cdf483574e.exe	installd.exe
PID 776 wrote to memory of 532	776	e03c3af586d81d3fb26af74a9e9d61dea1baef2c20ee260a339a63cdf483574e.exe	installd.exe
PID 776 wrote to memory of 532	776	e03c3af586d81d3fb26af74a9e9d61dea1baef2c20ee260a339a63cdf483574e.exe	installd.exe
PID 776 wrote to memory of 1952	776	e03c3af586d81d3fb26af74a9e9d61dea1baef2c20ee260a339a63cdf483574e.exe	nethtsrv.exe
PID 776 wrote to memory of 1952	776	e03c3af586d81d3fb26af74a9e9d61dea1baef2c20ee260a339a63cdf483574e.exe	nethtsrv.exe
PID 776 wrote to memory of 1952	776	e03c3af586d81d3fb26af74a9e9d61dea1baef2c20ee260a339a63cdf483574e.exe	nethtsrv.exe
PID 776 wrote to memory of 1952	776	e03c3af586d81d3fb26af74a9e9d61dea1baef2c20ee260a339a63cdf483574e.exe	nethtsrv.exe
PID 776 wrote to memory of 1820	776	e03c3af586d81d3fb26af74a9e9d61dea1baef2c20ee260a339a63cdf483574e.exe	netupdsrv.exe
PID 776 wrote to memory of 1820	776	e03c3af586d81d3fb26af74a9e9d61dea1baef2c20ee260a339a63cdf483574e.exe	netupdsrv.exe
PID 776 wrote to memory of 1820	776	e03c3af586d81d3fb26af74a9e9d61dea1baef2c20ee260a339a63cdf483574e.exe	netupdsrv.exe
PID 776 wrote to memory of 1820	776	e03c3af586d81d3fb26af74a9e9d61dea1baef2c20ee260a339a63cdf483574e.exe	netupdsrv.exe
PID 776 wrote to memory of 1820	776	e03c3af586d81d3fb26af74a9e9d61dea1baef2c20ee260a339a63cdf483574e.exe	netupdsrv.exe
PID 776 wrote to memory of 1820	776	e03c3af586d81d3fb26af74a9e9d61dea1baef2c20ee260a339a63cdf483574e.exe	netupdsrv.exe
PID 776 wrote to memory of 1820	776	e03c3af586d81d3fb26af74a9e9d61dea1baef2c20ee260a339a63cdf483574e.exe	netupdsrv.exe

C:\Users\Admin\AppData\Local\Temp\e03c3af586d81d3fb26af74a9e9d61dea1baef2c20ee260a339a63cdf483574e.exe
"C:\Users\Admin\AppData\Local\Temp\e03c3af586d81d3fb26af74a9e9d61dea1baef2c20ee260a339a63cdf483574e.exe"
1⤵
- Drops file in Drivers directory
- Loads dropped DLL
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:776

C:\Windows\SysWOW64\net.exe
net stop nethttpservice
2⤵
- Suspicious use of WriteProcessMemory
PID:784

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop nethttpservice
3⤵
PID:1632

C:\Windows\SysWOW64\net.exe
net stop serviceupdater
2⤵
- Suspicious use of WriteProcessMemory
PID:916

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop serviceupdater
3⤵
PID:692

C:\Windows\SysWOW64\installd.exe
"C:\Windows\system32\installd.exe" nethfdrv
2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:532

C:\Windows\SysWOW64\nethtsrv.exe
"C:\Windows\system32\nethtsrv.exe" -nfdi
2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1952

C:\Windows\SysWOW64\netupdsrv.exe
"C:\Windows\system32\netupdsrv.exe" -nfdi
2⤵
- Executes dropped EXE
PID:1820

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\hfnapi.dll

Filesize
106KB

MD5
05ec023c519f1ceeab7ebb62bc013712

SHA1
b1e64cd8bcaac209a02e3e245936aab9ae4ef434

SHA256
a6ad98759814c8ff68c838d2ac842317135c8103fa59bd01ad5e877801ba6797

SHA512
8700a9585b60703fb6b513f8997101e521c7453edb6aeddd529b011a0fb81dd8491041834b93d1943fbca878d2934609043a2657ab8b8671baa8a6b17588d273

Download Submit
C:\Windows\SysWOW64\hfpapi.dll

Filesize
244KB

MD5
a6041f62b488b1a1e28eb78b63f26857

SHA1
acc5a8f4ef0f77e48fe0df6041e941c70509091e

SHA256
98358d22ea51c70f8809cd7c84377bf5de62865620fd128df33a1e183dc9a03a

SHA512
963745f5584734b81819ba5ec159b4ac7473df76143a25290f3111c63feb796bbc7e965146fbe1d9f046d7ed5db843cc9c80c35e07c9e06cb23e2e1ada05aca9

Download Submit
C:\Windows\SysWOW64\installd.exe

Filesize
108KB

MD5
2c4db80feb0b86e7240ca897f350ab65

SHA1
5ebb46ce76ddccc5ba5092dc2ca48cee2dc2686e

SHA256
81822e4e7efcd77e37051288538124df903a2af2c782bf0fdb02216164b7b785

SHA512
62d4ed4386a0161ea6bd095a46ae5ae6941c445501c9b61c7b13fc3c2dee3d2da9c3b58a14ae62a3ff8e0ae54f1bc52a39fc82260070665fe709db419f7cdba3

Download Submit
C:\Windows\SysWOW64\nethtsrv.exe

Filesize
176KB

MD5
80b6076195ef0f40f25d2ec72d1d5ff1

SHA1
0a50ce533010eed75e3a527c15e5948bb2fde940

SHA256
b26cc4b7abc8729be4efbad8ce3641a665e8ebc1cd12a386a8beb139bb0a2599

SHA512
ca909d4b2817254db6c37a0b5d16f4f54c5e7e79cbae1132710968e482375d398b9be325058c0035ab4ccfb9f702f25730f63f0b31dde00c8fbe5a121adfab6f

Download Submit
C:\Windows\SysWOW64\netupdsrv.exe

Filesize
158KB

MD5
0e440b6b5522aa95ea87954f4b1d16f9

SHA1
ec796ba3c94596624930291300ce906744b0631a

SHA256
fefa55f981c5a15e82e106d9abc99bbe883c7e25f4caef45a0ad178176c02809

SHA512
929c93023fc9e4e9907ee8999b55d591f9b969fd6e3a8adc749505a3ef2b5b9a9ddfa419f53482247ad32a2f7a4b53ec993c61687bd1e692f8104b4734524488

Download Submit
\Users\Admin\AppData\Local\Temp\nsoDF98.tmp\System.dll

Filesize
11KB

MD5
c17103ae9072a06da581dec998343fc1

SHA1
b72148c6bdfaada8b8c3f950e610ee7cf1da1f8d

SHA256
dc58d8ad81cacb0c1ed72e33bff8f23ea40b5252b5bb55d393a0903e6819ae2f

SHA512
d32a71aaef18e993f28096d536e41c4d016850721b31171513ce28bbd805a54fd290b7c3e9d935f72e676a1acfb4f0dcc89d95040a0dd29f2b6975855c18986f

Download Submit
\Users\Admin\AppData\Local\Temp\nsoDF98.tmp\nsExec.dll

Filesize
6KB

MD5
acc2b699edfea5bf5aae45aba3a41e96

SHA1
d2accf4d494e43ceb2cff69abe4dd17147d29cc2

SHA256
168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e

SHA512
e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe

Download Submit
\Users\Admin\AppData\Local\Temp\nsoDF98.tmp\nsExec.dll

Filesize
6KB

MD5
acc2b699edfea5bf5aae45aba3a41e96

SHA1
d2accf4d494e43ceb2cff69abe4dd17147d29cc2

SHA256
168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e

SHA512
e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe

Download Submit
\Windows\SysWOW64\hfnapi.dll

Filesize
106KB

MD5
05ec023c519f1ceeab7ebb62bc013712

SHA1
b1e64cd8bcaac209a02e3e245936aab9ae4ef434

SHA256
a6ad98759814c8ff68c838d2ac842317135c8103fa59bd01ad5e877801ba6797

SHA512
8700a9585b60703fb6b513f8997101e521c7453edb6aeddd529b011a0fb81dd8491041834b93d1943fbca878d2934609043a2657ab8b8671baa8a6b17588d273

Download Submit
\Windows\SysWOW64\hfnapi.dll

Filesize
106KB

MD5
05ec023c519f1ceeab7ebb62bc013712

SHA1
b1e64cd8bcaac209a02e3e245936aab9ae4ef434

SHA256
a6ad98759814c8ff68c838d2ac842317135c8103fa59bd01ad5e877801ba6797

SHA512
8700a9585b60703fb6b513f8997101e521c7453edb6aeddd529b011a0fb81dd8491041834b93d1943fbca878d2934609043a2657ab8b8671baa8a6b17588d273

Download Submit
\Windows\SysWOW64\hfpapi.dll

Filesize
244KB

MD5
a6041f62b488b1a1e28eb78b63f26857

SHA1
acc5a8f4ef0f77e48fe0df6041e941c70509091e

SHA256
98358d22ea51c70f8809cd7c84377bf5de62865620fd128df33a1e183dc9a03a

SHA512
963745f5584734b81819ba5ec159b4ac7473df76143a25290f3111c63feb796bbc7e965146fbe1d9f046d7ed5db843cc9c80c35e07c9e06cb23e2e1ada05aca9

Download Submit
\Windows\SysWOW64\installd.exe

Filesize
108KB

MD5
2c4db80feb0b86e7240ca897f350ab65

SHA1
5ebb46ce76ddccc5ba5092dc2ca48cee2dc2686e

SHA256
81822e4e7efcd77e37051288538124df903a2af2c782bf0fdb02216164b7b785

SHA512
62d4ed4386a0161ea6bd095a46ae5ae6941c445501c9b61c7b13fc3c2dee3d2da9c3b58a14ae62a3ff8e0ae54f1bc52a39fc82260070665fe709db419f7cdba3

Download Submit
\Windows\SysWOW64\nethtsrv.exe

Filesize
176KB

MD5
80b6076195ef0f40f25d2ec72d1d5ff1

SHA1
0a50ce533010eed75e3a527c15e5948bb2fde940

SHA256
b26cc4b7abc8729be4efbad8ce3641a665e8ebc1cd12a386a8beb139bb0a2599

SHA512
ca909d4b2817254db6c37a0b5d16f4f54c5e7e79cbae1132710968e482375d398b9be325058c0035ab4ccfb9f702f25730f63f0b31dde00c8fbe5a121adfab6f

Download Submit
\Windows\SysWOW64\netupdsrv.exe

Filesize
158KB

MD5
0e440b6b5522aa95ea87954f4b1d16f9

SHA1
ec796ba3c94596624930291300ce906744b0631a

SHA256
fefa55f981c5a15e82e106d9abc99bbe883c7e25f4caef45a0ad178176c02809

SHA512
929c93023fc9e4e9907ee8999b55d591f9b969fd6e3a8adc749505a3ef2b5b9a9ddfa419f53482247ad32a2f7a4b53ec993c61687bd1e692f8104b4734524488

Download Submit
memory/532-63-0x0000000000000000-mapping.dmp

Download
memory/692-61-0x0000000000000000-mapping.dmp

Download
memory/776-54-0x00000000757C1000-0x00000000757C3000-memory.dmp

Filesize
8KB

Download
memory/784-57-0x0000000000000000-mapping.dmp

Download
memory/916-60-0x0000000000000000-mapping.dmp

Download
memory/1632-58-0x0000000000000000-mapping.dmp

Download
memory/1820-75-0x0000000000000000-mapping.dmp

Download
memory/1952-69-0x0000000000000000-mapping.dmp

Download