Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
28s -
max time network
49s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
24/11/2022, 05:43
Static task
static1
Behavioral task
behavioral1
Sample
0dcc404ca0bc686b52926e434585798469a8e5d21ada48d086db4763ed204c3a.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
0dcc404ca0bc686b52926e434585798469a8e5d21ada48d086db4763ed204c3a.exe
Resource
win10v2004-20220901-en
General
-
Target
0dcc404ca0bc686b52926e434585798469a8e5d21ada48d086db4763ed204c3a.exe
-
Size
603KB
-
MD5
ad8a975ee8c8b2865020eeca70b1b107
-
SHA1
e3c6712022206df88a1109bb0ecf11afa92cd028
-
SHA256
0dcc404ca0bc686b52926e434585798469a8e5d21ada48d086db4763ed204c3a
-
SHA512
3bbf0a801549993f28e1e03c515eb0e9e6fa0117f819877c294edd03836afbd512cbd46f0fe5d6df529ae69037eebcf0c604189dfb299b1367e3da8a94056773
-
SSDEEP
12288:BIny5DYTmI7gHYQ58DwRC+1WTRHMtgit3Rh:9UTmnHYkfQ+sU9
Malware Config
Signatures
-
Drops file in Drivers directory 1 IoCs
description ioc Process File created C:\Windows\system32\drivers\nethfdrv.sys 0dcc404ca0bc686b52926e434585798469a8e5d21ada48d086db4763ed204c3a.exe -
Executes dropped EXE 5 IoCs
pid Process 2040 installd.exe 988 nethtsrv.exe 1496 netupdsrv.exe 1620 nethtsrv.exe 1936 netupdsrv.exe -
Loads dropped DLL 13 IoCs
pid Process 1968 0dcc404ca0bc686b52926e434585798469a8e5d21ada48d086db4763ed204c3a.exe 1968 0dcc404ca0bc686b52926e434585798469a8e5d21ada48d086db4763ed204c3a.exe 1968 0dcc404ca0bc686b52926e434585798469a8e5d21ada48d086db4763ed204c3a.exe 1968 0dcc404ca0bc686b52926e434585798469a8e5d21ada48d086db4763ed204c3a.exe 2040 installd.exe 1968 0dcc404ca0bc686b52926e434585798469a8e5d21ada48d086db4763ed204c3a.exe 988 nethtsrv.exe 988 nethtsrv.exe 1968 0dcc404ca0bc686b52926e434585798469a8e5d21ada48d086db4763ed204c3a.exe 1968 0dcc404ca0bc686b52926e434585798469a8e5d21ada48d086db4763ed204c3a.exe 1620 nethtsrv.exe 1620 nethtsrv.exe 1968 0dcc404ca0bc686b52926e434585798469a8e5d21ada48d086db4763ed204c3a.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops file in System32 directory 5 IoCs
description ioc Process File created C:\Windows\SysWOW64\nethtsrv.exe 0dcc404ca0bc686b52926e434585798469a8e5d21ada48d086db4763ed204c3a.exe File created C:\Windows\SysWOW64\netupdsrv.exe 0dcc404ca0bc686b52926e434585798469a8e5d21ada48d086db4763ed204c3a.exe File created C:\Windows\SysWOW64\hfnapi.dll 0dcc404ca0bc686b52926e434585798469a8e5d21ada48d086db4763ed204c3a.exe File created C:\Windows\SysWOW64\hfpapi.dll 0dcc404ca0bc686b52926e434585798469a8e5d21ada48d086db4763ed204c3a.exe File created C:\Windows\SysWOW64\installd.exe 0dcc404ca0bc686b52926e434585798469a8e5d21ada48d086db4763ed204c3a.exe -
Drops file in Program Files directory 3 IoCs
description ioc Process File created C:\Program Files (x86)\Common Files\Config\data.xml 0dcc404ca0bc686b52926e434585798469a8e5d21ada48d086db4763ed204c3a.exe File created C:\Program Files (x86)\Common Files\Config\ver.xml 0dcc404ca0bc686b52926e434585798469a8e5d21ada48d086db4763ed204c3a.exe File created C:\Program Files (x86)\Common Files\config\uninstinethnfd.exe 0dcc404ca0bc686b52926e434585798469a8e5d21ada48d086db4763ed204c3a.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Runs net.exe
-
Suspicious behavior: LoadsDriver 1 IoCs
pid Process 460 Process not Found -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 1620 nethtsrv.exe -
Suspicious use of WriteProcessMemory 50 IoCs
description pid Process procid_target PID 1968 wrote to memory of 1232 1968 0dcc404ca0bc686b52926e434585798469a8e5d21ada48d086db4763ed204c3a.exe 28 PID 1968 wrote to memory of 1232 1968 0dcc404ca0bc686b52926e434585798469a8e5d21ada48d086db4763ed204c3a.exe 28 PID 1968 wrote to memory of 1232 1968 0dcc404ca0bc686b52926e434585798469a8e5d21ada48d086db4763ed204c3a.exe 28 PID 1968 wrote to memory of 1232 1968 0dcc404ca0bc686b52926e434585798469a8e5d21ada48d086db4763ed204c3a.exe 28 PID 1232 wrote to memory of 1696 1232 net.exe 30 PID 1232 wrote to memory of 1696 1232 net.exe 30 PID 1232 wrote to memory of 1696 1232 net.exe 30 PID 1232 wrote to memory of 1696 1232 net.exe 30 PID 1968 wrote to memory of 832 1968 0dcc404ca0bc686b52926e434585798469a8e5d21ada48d086db4763ed204c3a.exe 31 PID 1968 wrote to memory of 832 1968 0dcc404ca0bc686b52926e434585798469a8e5d21ada48d086db4763ed204c3a.exe 31 PID 1968 wrote to memory of 832 1968 0dcc404ca0bc686b52926e434585798469a8e5d21ada48d086db4763ed204c3a.exe 31 PID 1968 wrote to memory of 832 1968 0dcc404ca0bc686b52926e434585798469a8e5d21ada48d086db4763ed204c3a.exe 31 PID 832 wrote to memory of 1076 832 net.exe 33 PID 832 wrote to memory of 1076 832 net.exe 33 PID 832 wrote to memory of 1076 832 net.exe 33 PID 832 wrote to memory of 1076 832 net.exe 33 PID 1968 wrote to memory of 2040 1968 0dcc404ca0bc686b52926e434585798469a8e5d21ada48d086db4763ed204c3a.exe 34 PID 1968 wrote to memory of 2040 1968 0dcc404ca0bc686b52926e434585798469a8e5d21ada48d086db4763ed204c3a.exe 34 PID 1968 wrote to memory of 2040 1968 0dcc404ca0bc686b52926e434585798469a8e5d21ada48d086db4763ed204c3a.exe 34 PID 1968 wrote to memory of 2040 1968 0dcc404ca0bc686b52926e434585798469a8e5d21ada48d086db4763ed204c3a.exe 34 PID 1968 wrote to memory of 2040 1968 0dcc404ca0bc686b52926e434585798469a8e5d21ada48d086db4763ed204c3a.exe 34 PID 1968 wrote to memory of 2040 1968 0dcc404ca0bc686b52926e434585798469a8e5d21ada48d086db4763ed204c3a.exe 34 PID 1968 wrote to memory of 2040 1968 0dcc404ca0bc686b52926e434585798469a8e5d21ada48d086db4763ed204c3a.exe 34 PID 1968 wrote to memory of 988 1968 0dcc404ca0bc686b52926e434585798469a8e5d21ada48d086db4763ed204c3a.exe 36 PID 1968 wrote to memory of 988 1968 0dcc404ca0bc686b52926e434585798469a8e5d21ada48d086db4763ed204c3a.exe 36 PID 1968 wrote to memory of 988 1968 0dcc404ca0bc686b52926e434585798469a8e5d21ada48d086db4763ed204c3a.exe 36 PID 1968 wrote to memory of 988 1968 0dcc404ca0bc686b52926e434585798469a8e5d21ada48d086db4763ed204c3a.exe 36 PID 1968 wrote to memory of 1496 1968 0dcc404ca0bc686b52926e434585798469a8e5d21ada48d086db4763ed204c3a.exe 38 PID 1968 wrote to memory of 1496 1968 0dcc404ca0bc686b52926e434585798469a8e5d21ada48d086db4763ed204c3a.exe 38 PID 1968 wrote to memory of 1496 1968 0dcc404ca0bc686b52926e434585798469a8e5d21ada48d086db4763ed204c3a.exe 38 PID 1968 wrote to memory of 1496 1968 0dcc404ca0bc686b52926e434585798469a8e5d21ada48d086db4763ed204c3a.exe 38 PID 1968 wrote to memory of 1496 1968 0dcc404ca0bc686b52926e434585798469a8e5d21ada48d086db4763ed204c3a.exe 38 PID 1968 wrote to memory of 1496 1968 0dcc404ca0bc686b52926e434585798469a8e5d21ada48d086db4763ed204c3a.exe 38 PID 1968 wrote to memory of 1496 1968 0dcc404ca0bc686b52926e434585798469a8e5d21ada48d086db4763ed204c3a.exe 38 PID 1968 wrote to memory of 2036 1968 0dcc404ca0bc686b52926e434585798469a8e5d21ada48d086db4763ed204c3a.exe 40 PID 1968 wrote to memory of 2036 1968 0dcc404ca0bc686b52926e434585798469a8e5d21ada48d086db4763ed204c3a.exe 40 PID 1968 wrote to memory of 2036 1968 0dcc404ca0bc686b52926e434585798469a8e5d21ada48d086db4763ed204c3a.exe 40 PID 1968 wrote to memory of 2036 1968 0dcc404ca0bc686b52926e434585798469a8e5d21ada48d086db4763ed204c3a.exe 40 PID 2036 wrote to memory of 1112 2036 net.exe 42 PID 2036 wrote to memory of 1112 2036 net.exe 42 PID 2036 wrote to memory of 1112 2036 net.exe 42 PID 2036 wrote to memory of 1112 2036 net.exe 42 PID 1968 wrote to memory of 1196 1968 0dcc404ca0bc686b52926e434585798469a8e5d21ada48d086db4763ed204c3a.exe 44 PID 1968 wrote to memory of 1196 1968 0dcc404ca0bc686b52926e434585798469a8e5d21ada48d086db4763ed204c3a.exe 44 PID 1968 wrote to memory of 1196 1968 0dcc404ca0bc686b52926e434585798469a8e5d21ada48d086db4763ed204c3a.exe 44 PID 1968 wrote to memory of 1196 1968 0dcc404ca0bc686b52926e434585798469a8e5d21ada48d086db4763ed204c3a.exe 44 PID 1196 wrote to memory of 1616 1196 net.exe 46 PID 1196 wrote to memory of 1616 1196 net.exe 46 PID 1196 wrote to memory of 1616 1196 net.exe 46 PID 1196 wrote to memory of 1616 1196 net.exe 46
Processes
-
C:\Users\Admin\AppData\Local\Temp\0dcc404ca0bc686b52926e434585798469a8e5d21ada48d086db4763ed204c3a.exe"C:\Users\Admin\AppData\Local\Temp\0dcc404ca0bc686b52926e434585798469a8e5d21ada48d086db4763ed204c3a.exe"1⤵
- Drops file in Drivers directory
- Loads dropped DLL
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:1968 -
C:\Windows\SysWOW64\net.exenet stop nethttpservice2⤵
- Suspicious use of WriteProcessMemory
PID:1232 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop nethttpservice3⤵PID:1696
-
-
-
C:\Windows\SysWOW64\net.exenet stop serviceupdater2⤵
- Suspicious use of WriteProcessMemory
PID:832 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop serviceupdater3⤵PID:1076
-
-
-
C:\Windows\SysWOW64\installd.exe"C:\Windows\system32\installd.exe" nethfdrv2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2040
-
-
C:\Windows\SysWOW64\nethtsrv.exe"C:\Windows\system32\nethtsrv.exe" -nfdi2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:988
-
-
C:\Windows\SysWOW64\netupdsrv.exe"C:\Windows\system32\netupdsrv.exe" -nfdi2⤵
- Executes dropped EXE
PID:1496
-
-
C:\Windows\SysWOW64\net.exenet start nethttpservice2⤵
- Suspicious use of WriteProcessMemory
PID:2036 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 start nethttpservice3⤵PID:1112
-
-
-
C:\Windows\SysWOW64\net.exenet start serviceupdater2⤵
- Suspicious use of WriteProcessMemory
PID:1196 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 start serviceupdater3⤵PID:1616
-
-
-
C:\Windows\SysWOW64\nethtsrv.exeC:\Windows\SysWOW64\nethtsrv.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:1620
-
C:\Windows\SysWOW64\netupdsrv.exeC:\Windows\SysWOW64\netupdsrv.exe1⤵
- Executes dropped EXE
PID:1936
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
106KB
MD576a6d2c81ccc0a8c45bf42b090c1682c
SHA1d11f73de0640b1f781912578c025b382d12f2be5
SHA256e866de732d974732e4a58f46e40cd3a139a4bf3af3e1ff1f2303e97990524825
SHA512d9043a38c5bc125f00cc015f00f65614009073cab01ab67130c669aa05d998e5fe97e2b298985fc81ce67dd360e107409a4a218e750d89f94ea972e6bed6b755
-
Filesize
244KB
MD5877ca9a6aa030c5688484fdfbfb7192c
SHA1f40fbc4c703af3332f3dd2075447be1ba5f430b1
SHA2567021c1ebacb5d1c4e169c5e8216756191ec36fa6fec7d6f8b0dcf9eb03a71675
SHA512e1eadb2826de39aa6216001854222c2142905400614b6f523a6b8e5a77584c99dde8fac85e3ecc5e09406d6c0672269f716611e5bc13e8f6eafa7a092aaa0408
-
Filesize
108KB
MD5a23dcc96079639ec63cf3b340d59e149
SHA1b793aaf323e040e6021c117836a6d6dcf3c34133
SHA256cc7f7d0d8be5adacb76e913deac7e5879925b8e7b8422367a6e24d19773179ba
SHA512d8826605b01290a6641d2ac5d14f01f8ed5a2846316734c7651514506081950518e8e6803ca4aaeb9e4b1c1e7342fbe16a54ec150ee326294aae2392472057ec
-
Filesize
176KB
MD5ed5043051dff4af39a06793282f3af14
SHA15af560e4e67778c1a2e1be4259924770634bf638
SHA2567bce68dff17df52a1d0b5113ad25f698073bdfdf0db489e01b9eef611b36a009
SHA5124960e2d2068fa4160f476a2f86112bd2204e4b395ce9dd2a3f99f40e714c5e243b2e2267f2ddd87b2ba5c972c7099947945c2f1661d2ed2676408ad364d8b76a
-
Filesize
176KB
MD5ed5043051dff4af39a06793282f3af14
SHA15af560e4e67778c1a2e1be4259924770634bf638
SHA2567bce68dff17df52a1d0b5113ad25f698073bdfdf0db489e01b9eef611b36a009
SHA5124960e2d2068fa4160f476a2f86112bd2204e4b395ce9dd2a3f99f40e714c5e243b2e2267f2ddd87b2ba5c972c7099947945c2f1661d2ed2676408ad364d8b76a
-
Filesize
159KB
MD5eb9769a61ee6899b217791c6852f64af
SHA11316b0ac851e8328c80d62d3b5612a2d95ca97c4
SHA2568b888f2a20616a3d025fe8b897eb8049b347e43c194ccaff697609d5e9c353be
SHA512db11e09cd065d01a8b28a7ae9088d2890e58c9db8fd1f5ab9c4679faf8949dad7cee42a090e2a9cbe66c6c5554af99554174ac5957b04bbb2d178db08d0e4272
-
Filesize
159KB
MD5eb9769a61ee6899b217791c6852f64af
SHA11316b0ac851e8328c80d62d3b5612a2d95ca97c4
SHA2568b888f2a20616a3d025fe8b897eb8049b347e43c194ccaff697609d5e9c353be
SHA512db11e09cd065d01a8b28a7ae9088d2890e58c9db8fd1f5ab9c4679faf8949dad7cee42a090e2a9cbe66c6c5554af99554174ac5957b04bbb2d178db08d0e4272
-
Filesize
11KB
MD5c17103ae9072a06da581dec998343fc1
SHA1b72148c6bdfaada8b8c3f950e610ee7cf1da1f8d
SHA256dc58d8ad81cacb0c1ed72e33bff8f23ea40b5252b5bb55d393a0903e6819ae2f
SHA512d32a71aaef18e993f28096d536e41c4d016850721b31171513ce28bbd805a54fd290b7c3e9d935f72e676a1acfb4f0dcc89d95040a0dd29f2b6975855c18986f
-
Filesize
6KB
MD5acc2b699edfea5bf5aae45aba3a41e96
SHA1d2accf4d494e43ceb2cff69abe4dd17147d29cc2
SHA256168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e
SHA512e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe
-
Filesize
6KB
MD5acc2b699edfea5bf5aae45aba3a41e96
SHA1d2accf4d494e43ceb2cff69abe4dd17147d29cc2
SHA256168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e
SHA512e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe
-
Filesize
6KB
MD5acc2b699edfea5bf5aae45aba3a41e96
SHA1d2accf4d494e43ceb2cff69abe4dd17147d29cc2
SHA256168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e
SHA512e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe
-
Filesize
6KB
MD5acc2b699edfea5bf5aae45aba3a41e96
SHA1d2accf4d494e43ceb2cff69abe4dd17147d29cc2
SHA256168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e
SHA512e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe
-
Filesize
106KB
MD576a6d2c81ccc0a8c45bf42b090c1682c
SHA1d11f73de0640b1f781912578c025b382d12f2be5
SHA256e866de732d974732e4a58f46e40cd3a139a4bf3af3e1ff1f2303e97990524825
SHA512d9043a38c5bc125f00cc015f00f65614009073cab01ab67130c669aa05d998e5fe97e2b298985fc81ce67dd360e107409a4a218e750d89f94ea972e6bed6b755
-
Filesize
106KB
MD576a6d2c81ccc0a8c45bf42b090c1682c
SHA1d11f73de0640b1f781912578c025b382d12f2be5
SHA256e866de732d974732e4a58f46e40cd3a139a4bf3af3e1ff1f2303e97990524825
SHA512d9043a38c5bc125f00cc015f00f65614009073cab01ab67130c669aa05d998e5fe97e2b298985fc81ce67dd360e107409a4a218e750d89f94ea972e6bed6b755
-
Filesize
106KB
MD576a6d2c81ccc0a8c45bf42b090c1682c
SHA1d11f73de0640b1f781912578c025b382d12f2be5
SHA256e866de732d974732e4a58f46e40cd3a139a4bf3af3e1ff1f2303e97990524825
SHA512d9043a38c5bc125f00cc015f00f65614009073cab01ab67130c669aa05d998e5fe97e2b298985fc81ce67dd360e107409a4a218e750d89f94ea972e6bed6b755
-
Filesize
244KB
MD5877ca9a6aa030c5688484fdfbfb7192c
SHA1f40fbc4c703af3332f3dd2075447be1ba5f430b1
SHA2567021c1ebacb5d1c4e169c5e8216756191ec36fa6fec7d6f8b0dcf9eb03a71675
SHA512e1eadb2826de39aa6216001854222c2142905400614b6f523a6b8e5a77584c99dde8fac85e3ecc5e09406d6c0672269f716611e5bc13e8f6eafa7a092aaa0408
-
Filesize
244KB
MD5877ca9a6aa030c5688484fdfbfb7192c
SHA1f40fbc4c703af3332f3dd2075447be1ba5f430b1
SHA2567021c1ebacb5d1c4e169c5e8216756191ec36fa6fec7d6f8b0dcf9eb03a71675
SHA512e1eadb2826de39aa6216001854222c2142905400614b6f523a6b8e5a77584c99dde8fac85e3ecc5e09406d6c0672269f716611e5bc13e8f6eafa7a092aaa0408
-
Filesize
108KB
MD5a23dcc96079639ec63cf3b340d59e149
SHA1b793aaf323e040e6021c117836a6d6dcf3c34133
SHA256cc7f7d0d8be5adacb76e913deac7e5879925b8e7b8422367a6e24d19773179ba
SHA512d8826605b01290a6641d2ac5d14f01f8ed5a2846316734c7651514506081950518e8e6803ca4aaeb9e4b1c1e7342fbe16a54ec150ee326294aae2392472057ec
-
Filesize
176KB
MD5ed5043051dff4af39a06793282f3af14
SHA15af560e4e67778c1a2e1be4259924770634bf638
SHA2567bce68dff17df52a1d0b5113ad25f698073bdfdf0db489e01b9eef611b36a009
SHA5124960e2d2068fa4160f476a2f86112bd2204e4b395ce9dd2a3f99f40e714c5e243b2e2267f2ddd87b2ba5c972c7099947945c2f1661d2ed2676408ad364d8b76a
-
Filesize
159KB
MD5eb9769a61ee6899b217791c6852f64af
SHA11316b0ac851e8328c80d62d3b5612a2d95ca97c4
SHA2568b888f2a20616a3d025fe8b897eb8049b347e43c194ccaff697609d5e9c353be
SHA512db11e09cd065d01a8b28a7ae9088d2890e58c9db8fd1f5ab9c4679faf8949dad7cee42a090e2a9cbe66c6c5554af99554174ac5957b04bbb2d178db08d0e4272