Analysis
-
max time kernel
90s -
max time network
154s -
platform
windows10-2004_x64 -
resource
win10v2004-20220901-en -
resource tags
arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system -
submitted
24-11-2022 05:34
Static task
static1
Behavioral task
behavioral1
Sample
d7c971761308310726162dfa7f96fa874bb828fc093cb10f2533e2658101ce6d.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
d7c971761308310726162dfa7f96fa874bb828fc093cb10f2533e2658101ce6d.exe
Resource
win10v2004-20220901-en
General
-
Target
d7c971761308310726162dfa7f96fa874bb828fc093cb10f2533e2658101ce6d.exe
-
Size
601KB
-
MD5
0933d82da29a3d58170304b8fff42faa
-
SHA1
23aa2e013af58c56f399b7e527c77f90e2ccec39
-
SHA256
d7c971761308310726162dfa7f96fa874bb828fc093cb10f2533e2658101ce6d
-
SHA512
da5808fe10c6be9ad92d6eb5dffe1a98afc4efe2deee6ec4104c59a6dc6b0739999a44f69f0c5af89d47675160ee7ccaa183a2fe9ce2215a0b44dc53c0d3ae70
-
SSDEEP
12288:jIny5DYTtD0d+nPRg4s+0UFudMs+gVHIZ74YBi9wW5xTz4nNZp0uz:rUTtwdWg4s+bU4gVHiE8i9bTa/z
Malware Config
Signatures
-
Drops file in Drivers directory 1 IoCs
description ioc Process File created C:\Windows\system32\drivers\nethfdrv.sys d7c971761308310726162dfa7f96fa874bb828fc093cb10f2533e2658101ce6d.exe -
Executes dropped EXE 5 IoCs
pid Process 2240 installd.exe 1840 nethtsrv.exe 332 netupdsrv.exe 208 nethtsrv.exe 4884 netupdsrv.exe -
Loads dropped DLL 14 IoCs
pid Process 3360 d7c971761308310726162dfa7f96fa874bb828fc093cb10f2533e2658101ce6d.exe 3360 d7c971761308310726162dfa7f96fa874bb828fc093cb10f2533e2658101ce6d.exe 3360 d7c971761308310726162dfa7f96fa874bb828fc093cb10f2533e2658101ce6d.exe 3360 d7c971761308310726162dfa7f96fa874bb828fc093cb10f2533e2658101ce6d.exe 3360 d7c971761308310726162dfa7f96fa874bb828fc093cb10f2533e2658101ce6d.exe 2240 installd.exe 1840 nethtsrv.exe 1840 nethtsrv.exe 3360 d7c971761308310726162dfa7f96fa874bb828fc093cb10f2533e2658101ce6d.exe 3360 d7c971761308310726162dfa7f96fa874bb828fc093cb10f2533e2658101ce6d.exe 208 nethtsrv.exe 208 nethtsrv.exe 3360 d7c971761308310726162dfa7f96fa874bb828fc093cb10f2533e2658101ce6d.exe 3360 d7c971761308310726162dfa7f96fa874bb828fc093cb10f2533e2658101ce6d.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops file in System32 directory 5 IoCs
description ioc Process File created C:\Windows\SysWOW64\netupdsrv.exe d7c971761308310726162dfa7f96fa874bb828fc093cb10f2533e2658101ce6d.exe File created C:\Windows\SysWOW64\hfnapi.dll d7c971761308310726162dfa7f96fa874bb828fc093cb10f2533e2658101ce6d.exe File created C:\Windows\SysWOW64\hfpapi.dll d7c971761308310726162dfa7f96fa874bb828fc093cb10f2533e2658101ce6d.exe File created C:\Windows\SysWOW64\installd.exe d7c971761308310726162dfa7f96fa874bb828fc093cb10f2533e2658101ce6d.exe File created C:\Windows\SysWOW64\nethtsrv.exe d7c971761308310726162dfa7f96fa874bb828fc093cb10f2533e2658101ce6d.exe -
Drops file in Program Files directory 3 IoCs
description ioc Process File created C:\Program Files (x86)\Common Files\Config\data.xml d7c971761308310726162dfa7f96fa874bb828fc093cb10f2533e2658101ce6d.exe File created C:\Program Files (x86)\Common Files\Config\ver.xml d7c971761308310726162dfa7f96fa874bb828fc093cb10f2533e2658101ce6d.exe File created C:\Program Files (x86)\Common Files\config\uninstinethnfd.exe d7c971761308310726162dfa7f96fa874bb828fc093cb10f2533e2658101ce6d.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Modifies data under HKEY_USERS 1 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections nethtsrv.exe -
Runs net.exe
-
Suspicious behavior: LoadsDriver 1 IoCs
pid Process 660 Process not Found -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 208 nethtsrv.exe -
Suspicious use of WriteProcessMemory 33 IoCs
description pid Process procid_target PID 3360 wrote to memory of 3604 3360 d7c971761308310726162dfa7f96fa874bb828fc093cb10f2533e2658101ce6d.exe 80 PID 3360 wrote to memory of 3604 3360 d7c971761308310726162dfa7f96fa874bb828fc093cb10f2533e2658101ce6d.exe 80 PID 3360 wrote to memory of 3604 3360 d7c971761308310726162dfa7f96fa874bb828fc093cb10f2533e2658101ce6d.exe 80 PID 3604 wrote to memory of 1292 3604 net.exe 82 PID 3604 wrote to memory of 1292 3604 net.exe 82 PID 3604 wrote to memory of 1292 3604 net.exe 82 PID 3360 wrote to memory of 5048 3360 d7c971761308310726162dfa7f96fa874bb828fc093cb10f2533e2658101ce6d.exe 84 PID 3360 wrote to memory of 5048 3360 d7c971761308310726162dfa7f96fa874bb828fc093cb10f2533e2658101ce6d.exe 84 PID 3360 wrote to memory of 5048 3360 d7c971761308310726162dfa7f96fa874bb828fc093cb10f2533e2658101ce6d.exe 84 PID 5048 wrote to memory of 2184 5048 net.exe 85 PID 5048 wrote to memory of 2184 5048 net.exe 85 PID 5048 wrote to memory of 2184 5048 net.exe 85 PID 3360 wrote to memory of 2240 3360 d7c971761308310726162dfa7f96fa874bb828fc093cb10f2533e2658101ce6d.exe 86 PID 3360 wrote to memory of 2240 3360 d7c971761308310726162dfa7f96fa874bb828fc093cb10f2533e2658101ce6d.exe 86 PID 3360 wrote to memory of 2240 3360 d7c971761308310726162dfa7f96fa874bb828fc093cb10f2533e2658101ce6d.exe 86 PID 3360 wrote to memory of 1840 3360 d7c971761308310726162dfa7f96fa874bb828fc093cb10f2533e2658101ce6d.exe 87 PID 3360 wrote to memory of 1840 3360 d7c971761308310726162dfa7f96fa874bb828fc093cb10f2533e2658101ce6d.exe 87 PID 3360 wrote to memory of 1840 3360 d7c971761308310726162dfa7f96fa874bb828fc093cb10f2533e2658101ce6d.exe 87 PID 3360 wrote to memory of 332 3360 d7c971761308310726162dfa7f96fa874bb828fc093cb10f2533e2658101ce6d.exe 89 PID 3360 wrote to memory of 332 3360 d7c971761308310726162dfa7f96fa874bb828fc093cb10f2533e2658101ce6d.exe 89 PID 3360 wrote to memory of 332 3360 d7c971761308310726162dfa7f96fa874bb828fc093cb10f2533e2658101ce6d.exe 89 PID 3360 wrote to memory of 3756 3360 d7c971761308310726162dfa7f96fa874bb828fc093cb10f2533e2658101ce6d.exe 91 PID 3360 wrote to memory of 3756 3360 d7c971761308310726162dfa7f96fa874bb828fc093cb10f2533e2658101ce6d.exe 91 PID 3360 wrote to memory of 3756 3360 d7c971761308310726162dfa7f96fa874bb828fc093cb10f2533e2658101ce6d.exe 91 PID 3756 wrote to memory of 2360 3756 net.exe 93 PID 3756 wrote to memory of 2360 3756 net.exe 93 PID 3756 wrote to memory of 2360 3756 net.exe 93 PID 3360 wrote to memory of 2312 3360 d7c971761308310726162dfa7f96fa874bb828fc093cb10f2533e2658101ce6d.exe 98 PID 3360 wrote to memory of 2312 3360 d7c971761308310726162dfa7f96fa874bb828fc093cb10f2533e2658101ce6d.exe 98 PID 3360 wrote to memory of 2312 3360 d7c971761308310726162dfa7f96fa874bb828fc093cb10f2533e2658101ce6d.exe 98 PID 2312 wrote to memory of 1200 2312 net.exe 100 PID 2312 wrote to memory of 1200 2312 net.exe 100 PID 2312 wrote to memory of 1200 2312 net.exe 100
Processes
-
C:\Users\Admin\AppData\Local\Temp\d7c971761308310726162dfa7f96fa874bb828fc093cb10f2533e2658101ce6d.exe"C:\Users\Admin\AppData\Local\Temp\d7c971761308310726162dfa7f96fa874bb828fc093cb10f2533e2658101ce6d.exe"1⤵
- Drops file in Drivers directory
- Loads dropped DLL
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:3360 -
C:\Windows\SysWOW64\net.exenet stop nethttpservice2⤵
- Suspicious use of WriteProcessMemory
PID:3604 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop nethttpservice3⤵PID:1292
-
-
-
C:\Windows\SysWOW64\net.exenet stop serviceupdater2⤵
- Suspicious use of WriteProcessMemory
PID:5048 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop serviceupdater3⤵PID:2184
-
-
-
C:\Windows\SysWOW64\installd.exe"C:\Windows\system32\installd.exe" nethfdrv2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2240
-
-
C:\Windows\SysWOW64\nethtsrv.exe"C:\Windows\system32\nethtsrv.exe" -nfdi2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1840
-
-
C:\Windows\SysWOW64\netupdsrv.exe"C:\Windows\system32\netupdsrv.exe" -nfdi2⤵
- Executes dropped EXE
PID:332
-
-
C:\Windows\SysWOW64\net.exenet start nethttpservice2⤵
- Suspicious use of WriteProcessMemory
PID:3756 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 start nethttpservice3⤵PID:2360
-
-
-
C:\Windows\SysWOW64\net.exenet start serviceupdater2⤵
- Suspicious use of WriteProcessMemory
PID:2312 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 start serviceupdater3⤵PID:1200
-
-
-
C:\Windows\SysWOW64\nethtsrv.exeC:\Windows\SysWOW64\nethtsrv.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:208
-
C:\Windows\SysWOW64\netupdsrv.exeC:\Windows\SysWOW64\netupdsrv.exe1⤵
- Executes dropped EXE
PID:4884
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
11KB
MD5c17103ae9072a06da581dec998343fc1
SHA1b72148c6bdfaada8b8c3f950e610ee7cf1da1f8d
SHA256dc58d8ad81cacb0c1ed72e33bff8f23ea40b5252b5bb55d393a0903e6819ae2f
SHA512d32a71aaef18e993f28096d536e41c4d016850721b31171513ce28bbd805a54fd290b7c3e9d935f72e676a1acfb4f0dcc89d95040a0dd29f2b6975855c18986f
-
Filesize
6KB
MD5acc2b699edfea5bf5aae45aba3a41e96
SHA1d2accf4d494e43ceb2cff69abe4dd17147d29cc2
SHA256168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e
SHA512e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe
-
Filesize
6KB
MD5acc2b699edfea5bf5aae45aba3a41e96
SHA1d2accf4d494e43ceb2cff69abe4dd17147d29cc2
SHA256168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e
SHA512e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe
-
Filesize
6KB
MD5acc2b699edfea5bf5aae45aba3a41e96
SHA1d2accf4d494e43ceb2cff69abe4dd17147d29cc2
SHA256168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e
SHA512e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe
-
Filesize
6KB
MD5acc2b699edfea5bf5aae45aba3a41e96
SHA1d2accf4d494e43ceb2cff69abe4dd17147d29cc2
SHA256168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e
SHA512e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe
-
Filesize
6KB
MD5acc2b699edfea5bf5aae45aba3a41e96
SHA1d2accf4d494e43ceb2cff69abe4dd17147d29cc2
SHA256168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e
SHA512e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe
-
Filesize
6KB
MD5acc2b699edfea5bf5aae45aba3a41e96
SHA1d2accf4d494e43ceb2cff69abe4dd17147d29cc2
SHA256168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e
SHA512e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe
-
Filesize
6KB
MD5acc2b699edfea5bf5aae45aba3a41e96
SHA1d2accf4d494e43ceb2cff69abe4dd17147d29cc2
SHA256168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e
SHA512e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe
-
Filesize
6KB
MD5acc2b699edfea5bf5aae45aba3a41e96
SHA1d2accf4d494e43ceb2cff69abe4dd17147d29cc2
SHA256168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e
SHA512e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe
-
Filesize
106KB
MD5b270ca8f16c38e43e862bd47459f08f5
SHA124d09b853daa6c5063fa3d0e3f27db005dae9266
SHA256c3f984d23b7afa0cf1a2e887d4598065785b9d19c97267c61368a61a7a74a09c
SHA512b0c8af9fa8febb97341c21b142e841d1057e47b6f00a454e711f6a4de5792938e5129fe5e1d94a1fb07d1169b1c1a0c21edf7f2963cad2e88432dae3be848693
-
Filesize
106KB
MD5b270ca8f16c38e43e862bd47459f08f5
SHA124d09b853daa6c5063fa3d0e3f27db005dae9266
SHA256c3f984d23b7afa0cf1a2e887d4598065785b9d19c97267c61368a61a7a74a09c
SHA512b0c8af9fa8febb97341c21b142e841d1057e47b6f00a454e711f6a4de5792938e5129fe5e1d94a1fb07d1169b1c1a0c21edf7f2963cad2e88432dae3be848693
-
Filesize
106KB
MD5b270ca8f16c38e43e862bd47459f08f5
SHA124d09b853daa6c5063fa3d0e3f27db005dae9266
SHA256c3f984d23b7afa0cf1a2e887d4598065785b9d19c97267c61368a61a7a74a09c
SHA512b0c8af9fa8febb97341c21b142e841d1057e47b6f00a454e711f6a4de5792938e5129fe5e1d94a1fb07d1169b1c1a0c21edf7f2963cad2e88432dae3be848693
-
Filesize
106KB
MD5b270ca8f16c38e43e862bd47459f08f5
SHA124d09b853daa6c5063fa3d0e3f27db005dae9266
SHA256c3f984d23b7afa0cf1a2e887d4598065785b9d19c97267c61368a61a7a74a09c
SHA512b0c8af9fa8febb97341c21b142e841d1057e47b6f00a454e711f6a4de5792938e5129fe5e1d94a1fb07d1169b1c1a0c21edf7f2963cad2e88432dae3be848693
-
Filesize
241KB
MD53f2611cdeedb8e3b33d46e6418680d25
SHA18a873218a4a8457c7dad95533fd92e333abbc4e2
SHA256f821770baec8f5bae6b5adfc4563cd3b486eea755950d56c4ce5a3411a81837c
SHA5127bcaf980d57f8bccb5a15d1e9c6f6891a323bccb8113c5f2caec8d4bf18e379012481edd1ae18bf14dca1e8a58fd33fd1a53a03168a721c8e6d4affc0bc3698d
-
Filesize
241KB
MD53f2611cdeedb8e3b33d46e6418680d25
SHA18a873218a4a8457c7dad95533fd92e333abbc4e2
SHA256f821770baec8f5bae6b5adfc4563cd3b486eea755950d56c4ce5a3411a81837c
SHA5127bcaf980d57f8bccb5a15d1e9c6f6891a323bccb8113c5f2caec8d4bf18e379012481edd1ae18bf14dca1e8a58fd33fd1a53a03168a721c8e6d4affc0bc3698d
-
Filesize
241KB
MD53f2611cdeedb8e3b33d46e6418680d25
SHA18a873218a4a8457c7dad95533fd92e333abbc4e2
SHA256f821770baec8f5bae6b5adfc4563cd3b486eea755950d56c4ce5a3411a81837c
SHA5127bcaf980d57f8bccb5a15d1e9c6f6891a323bccb8113c5f2caec8d4bf18e379012481edd1ae18bf14dca1e8a58fd33fd1a53a03168a721c8e6d4affc0bc3698d
-
Filesize
108KB
MD50f2014cacf351f5c813336b625216085
SHA1e369b91e140bacc3b9d5a5ad4f53f41e7def8a6d
SHA2560f55a8d051e91e60f1bf43b154e20577010b2c488c5cb3124198624b2d92b8c9
SHA512092ab78436ce79ce04e8c8b1da7cc2cb7349ac8618fe319cabe9a61358138d7fa9250d45c70a9a41f9d44122948f8c9d833b2d8d745a245815850c5209729508
-
Filesize
108KB
MD50f2014cacf351f5c813336b625216085
SHA1e369b91e140bacc3b9d5a5ad4f53f41e7def8a6d
SHA2560f55a8d051e91e60f1bf43b154e20577010b2c488c5cb3124198624b2d92b8c9
SHA512092ab78436ce79ce04e8c8b1da7cc2cb7349ac8618fe319cabe9a61358138d7fa9250d45c70a9a41f9d44122948f8c9d833b2d8d745a245815850c5209729508
-
Filesize
176KB
MD5871ba8dcbb17fda05b94b351f1707c6d
SHA1c5fd0451353b8acc1dbb2206ee178ee08c253262
SHA256bd691dbaea0498415009e166c5faca629098bb7c4c328ea847178ec44562c203
SHA512275f69f3cdb644cc0fb6f6656f64358274fb73d0845ce9dbb0054593331693f3b4d117694360c19c011ffcff8f691403e45b5e6e5fc1be50f6ad93f0694e4f9f
-
Filesize
176KB
MD5871ba8dcbb17fda05b94b351f1707c6d
SHA1c5fd0451353b8acc1dbb2206ee178ee08c253262
SHA256bd691dbaea0498415009e166c5faca629098bb7c4c328ea847178ec44562c203
SHA512275f69f3cdb644cc0fb6f6656f64358274fb73d0845ce9dbb0054593331693f3b4d117694360c19c011ffcff8f691403e45b5e6e5fc1be50f6ad93f0694e4f9f
-
Filesize
176KB
MD5871ba8dcbb17fda05b94b351f1707c6d
SHA1c5fd0451353b8acc1dbb2206ee178ee08c253262
SHA256bd691dbaea0498415009e166c5faca629098bb7c4c328ea847178ec44562c203
SHA512275f69f3cdb644cc0fb6f6656f64358274fb73d0845ce9dbb0054593331693f3b4d117694360c19c011ffcff8f691403e45b5e6e5fc1be50f6ad93f0694e4f9f
-
Filesize
158KB
MD513bfc22de09dfbbcea6a92ec7497e08f
SHA1ec869f13f3bf7c491bff73d1221c73a0e8b6ef3b
SHA2566bb05b6b45dd2c91891505584f21f36716f11fb64072b7dc54684ec3bbc9dc39
SHA512c498df98a5f1e1fc9c5057fe9cf63213f7f742b105067925267a27980271c7df3f1b709f0b870afcd6f43070ad05e99ef36ec1d7fc1265d0de98fc7571b0e88b
-
Filesize
158KB
MD513bfc22de09dfbbcea6a92ec7497e08f
SHA1ec869f13f3bf7c491bff73d1221c73a0e8b6ef3b
SHA2566bb05b6b45dd2c91891505584f21f36716f11fb64072b7dc54684ec3bbc9dc39
SHA512c498df98a5f1e1fc9c5057fe9cf63213f7f742b105067925267a27980271c7df3f1b709f0b870afcd6f43070ad05e99ef36ec1d7fc1265d0de98fc7571b0e88b
-
Filesize
158KB
MD513bfc22de09dfbbcea6a92ec7497e08f
SHA1ec869f13f3bf7c491bff73d1221c73a0e8b6ef3b
SHA2566bb05b6b45dd2c91891505584f21f36716f11fb64072b7dc54684ec3bbc9dc39
SHA512c498df98a5f1e1fc9c5057fe9cf63213f7f742b105067925267a27980271c7df3f1b709f0b870afcd6f43070ad05e99ef36ec1d7fc1265d0de98fc7571b0e88b