Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
43s -
max time network
48s -
platform
windows7_x64 -
resource
win7-20220901-en -
resource tags
arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system -
submitted
24/11/2022, 06:06
Static task
static1
Behavioral task
behavioral1
Sample
33fe7953342990332717f1c2638f671674efe06fa87c82b23cd9dbe748dd761c.exe
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
33fe7953342990332717f1c2638f671674efe06fa87c82b23cd9dbe748dd761c.exe
Resource
win10v2004-20220812-en
General
-
Target
33fe7953342990332717f1c2638f671674efe06fa87c82b23cd9dbe748dd761c.exe
-
Size
695KB
-
MD5
c01b2331d81f793089fa4110135b259a
-
SHA1
05f6cb409c02272d5e444d8981d90df53fff31e4
-
SHA256
33fe7953342990332717f1c2638f671674efe06fa87c82b23cd9dbe748dd761c
-
SHA512
64a79a34e545b69ee3584aa775264760575549b532a37668accaf2466552212ba260b876895299d09457b9d45e052e4fd1f47ec112f6b1a5a9d5c4b746b05df3
-
SSDEEP
12288:dAbu3fQ+thk6Ez1bfbded3ANrKRejCbPNAKTZzI3sRCBKLLq8tIauQAQW:dAbuPPEzxfwxANeR3BAKTZzIczLLXIa
Malware Config
Signatures
-
Drops file in Drivers directory 1 IoCs
description ioc Process File created C:\Windows\system32\drivers\nethfdrv.sys 33fe7953342990332717f1c2638f671674efe06fa87c82b23cd9dbe748dd761c.exe -
Executes dropped EXE 5 IoCs
pid Process 1880 installd.exe 1936 nethtsrv.exe 1796 netupdsrv.exe 1916 nethtsrv.exe 800 netupdsrv.exe -
Loads dropped DLL 13 IoCs
pid Process 1228 33fe7953342990332717f1c2638f671674efe06fa87c82b23cd9dbe748dd761c.exe 1228 33fe7953342990332717f1c2638f671674efe06fa87c82b23cd9dbe748dd761c.exe 1228 33fe7953342990332717f1c2638f671674efe06fa87c82b23cd9dbe748dd761c.exe 1228 33fe7953342990332717f1c2638f671674efe06fa87c82b23cd9dbe748dd761c.exe 1880 installd.exe 1228 33fe7953342990332717f1c2638f671674efe06fa87c82b23cd9dbe748dd761c.exe 1936 nethtsrv.exe 1936 nethtsrv.exe 1228 33fe7953342990332717f1c2638f671674efe06fa87c82b23cd9dbe748dd761c.exe 1228 33fe7953342990332717f1c2638f671674efe06fa87c82b23cd9dbe748dd761c.exe 1916 nethtsrv.exe 1916 nethtsrv.exe 1228 33fe7953342990332717f1c2638f671674efe06fa87c82b23cd9dbe748dd761c.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops file in System32 directory 5 IoCs
description ioc Process File created C:\Windows\SysWOW64\hfnapi.dll 33fe7953342990332717f1c2638f671674efe06fa87c82b23cd9dbe748dd761c.exe File created C:\Windows\SysWOW64\hfpapi.dll 33fe7953342990332717f1c2638f671674efe06fa87c82b23cd9dbe748dd761c.exe File created C:\Windows\SysWOW64\installd.exe 33fe7953342990332717f1c2638f671674efe06fa87c82b23cd9dbe748dd761c.exe File created C:\Windows\SysWOW64\nethtsrv.exe 33fe7953342990332717f1c2638f671674efe06fa87c82b23cd9dbe748dd761c.exe File created C:\Windows\SysWOW64\netupdsrv.exe 33fe7953342990332717f1c2638f671674efe06fa87c82b23cd9dbe748dd761c.exe -
Drops file in Program Files directory 3 IoCs
description ioc Process File created C:\Program Files (x86)\Common Files\Config\data.xml 33fe7953342990332717f1c2638f671674efe06fa87c82b23cd9dbe748dd761c.exe File created C:\Program Files (x86)\Common Files\Config\ver.xml 33fe7953342990332717f1c2638f671674efe06fa87c82b23cd9dbe748dd761c.exe File created C:\Program Files (x86)\Common Files\config\uninstinethnfd.exe 33fe7953342990332717f1c2638f671674efe06fa87c82b23cd9dbe748dd761c.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Runs net.exe
-
Suspicious behavior: LoadsDriver 1 IoCs
pid Process 464 Process not Found -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 1916 nethtsrv.exe -
Suspicious use of WriteProcessMemory 50 IoCs
description pid Process procid_target PID 1228 wrote to memory of 952 1228 33fe7953342990332717f1c2638f671674efe06fa87c82b23cd9dbe748dd761c.exe 27 PID 1228 wrote to memory of 952 1228 33fe7953342990332717f1c2638f671674efe06fa87c82b23cd9dbe748dd761c.exe 27 PID 1228 wrote to memory of 952 1228 33fe7953342990332717f1c2638f671674efe06fa87c82b23cd9dbe748dd761c.exe 27 PID 1228 wrote to memory of 952 1228 33fe7953342990332717f1c2638f671674efe06fa87c82b23cd9dbe748dd761c.exe 27 PID 952 wrote to memory of 1332 952 net.exe 29 PID 952 wrote to memory of 1332 952 net.exe 29 PID 952 wrote to memory of 1332 952 net.exe 29 PID 952 wrote to memory of 1332 952 net.exe 29 PID 1228 wrote to memory of 804 1228 33fe7953342990332717f1c2638f671674efe06fa87c82b23cd9dbe748dd761c.exe 30 PID 1228 wrote to memory of 804 1228 33fe7953342990332717f1c2638f671674efe06fa87c82b23cd9dbe748dd761c.exe 30 PID 1228 wrote to memory of 804 1228 33fe7953342990332717f1c2638f671674efe06fa87c82b23cd9dbe748dd761c.exe 30 PID 1228 wrote to memory of 804 1228 33fe7953342990332717f1c2638f671674efe06fa87c82b23cd9dbe748dd761c.exe 30 PID 804 wrote to memory of 1776 804 net.exe 32 PID 804 wrote to memory of 1776 804 net.exe 32 PID 804 wrote to memory of 1776 804 net.exe 32 PID 804 wrote to memory of 1776 804 net.exe 32 PID 1228 wrote to memory of 1880 1228 33fe7953342990332717f1c2638f671674efe06fa87c82b23cd9dbe748dd761c.exe 33 PID 1228 wrote to memory of 1880 1228 33fe7953342990332717f1c2638f671674efe06fa87c82b23cd9dbe748dd761c.exe 33 PID 1228 wrote to memory of 1880 1228 33fe7953342990332717f1c2638f671674efe06fa87c82b23cd9dbe748dd761c.exe 33 PID 1228 wrote to memory of 1880 1228 33fe7953342990332717f1c2638f671674efe06fa87c82b23cd9dbe748dd761c.exe 33 PID 1228 wrote to memory of 1880 1228 33fe7953342990332717f1c2638f671674efe06fa87c82b23cd9dbe748dd761c.exe 33 PID 1228 wrote to memory of 1880 1228 33fe7953342990332717f1c2638f671674efe06fa87c82b23cd9dbe748dd761c.exe 33 PID 1228 wrote to memory of 1880 1228 33fe7953342990332717f1c2638f671674efe06fa87c82b23cd9dbe748dd761c.exe 33 PID 1228 wrote to memory of 1936 1228 33fe7953342990332717f1c2638f671674efe06fa87c82b23cd9dbe748dd761c.exe 35 PID 1228 wrote to memory of 1936 1228 33fe7953342990332717f1c2638f671674efe06fa87c82b23cd9dbe748dd761c.exe 35 PID 1228 wrote to memory of 1936 1228 33fe7953342990332717f1c2638f671674efe06fa87c82b23cd9dbe748dd761c.exe 35 PID 1228 wrote to memory of 1936 1228 33fe7953342990332717f1c2638f671674efe06fa87c82b23cd9dbe748dd761c.exe 35 PID 1228 wrote to memory of 1796 1228 33fe7953342990332717f1c2638f671674efe06fa87c82b23cd9dbe748dd761c.exe 37 PID 1228 wrote to memory of 1796 1228 33fe7953342990332717f1c2638f671674efe06fa87c82b23cd9dbe748dd761c.exe 37 PID 1228 wrote to memory of 1796 1228 33fe7953342990332717f1c2638f671674efe06fa87c82b23cd9dbe748dd761c.exe 37 PID 1228 wrote to memory of 1796 1228 33fe7953342990332717f1c2638f671674efe06fa87c82b23cd9dbe748dd761c.exe 37 PID 1228 wrote to memory of 1796 1228 33fe7953342990332717f1c2638f671674efe06fa87c82b23cd9dbe748dd761c.exe 37 PID 1228 wrote to memory of 1796 1228 33fe7953342990332717f1c2638f671674efe06fa87c82b23cd9dbe748dd761c.exe 37 PID 1228 wrote to memory of 1796 1228 33fe7953342990332717f1c2638f671674efe06fa87c82b23cd9dbe748dd761c.exe 37 PID 1228 wrote to memory of 240 1228 33fe7953342990332717f1c2638f671674efe06fa87c82b23cd9dbe748dd761c.exe 39 PID 1228 wrote to memory of 240 1228 33fe7953342990332717f1c2638f671674efe06fa87c82b23cd9dbe748dd761c.exe 39 PID 1228 wrote to memory of 240 1228 33fe7953342990332717f1c2638f671674efe06fa87c82b23cd9dbe748dd761c.exe 39 PID 1228 wrote to memory of 240 1228 33fe7953342990332717f1c2638f671674efe06fa87c82b23cd9dbe748dd761c.exe 39 PID 240 wrote to memory of 1912 240 net.exe 41 PID 240 wrote to memory of 1912 240 net.exe 41 PID 240 wrote to memory of 1912 240 net.exe 41 PID 240 wrote to memory of 1912 240 net.exe 41 PID 1228 wrote to memory of 1928 1228 33fe7953342990332717f1c2638f671674efe06fa87c82b23cd9dbe748dd761c.exe 43 PID 1228 wrote to memory of 1928 1228 33fe7953342990332717f1c2638f671674efe06fa87c82b23cd9dbe748dd761c.exe 43 PID 1228 wrote to memory of 1928 1228 33fe7953342990332717f1c2638f671674efe06fa87c82b23cd9dbe748dd761c.exe 43 PID 1228 wrote to memory of 1928 1228 33fe7953342990332717f1c2638f671674efe06fa87c82b23cd9dbe748dd761c.exe 43 PID 1928 wrote to memory of 436 1928 net.exe 45 PID 1928 wrote to memory of 436 1928 net.exe 45 PID 1928 wrote to memory of 436 1928 net.exe 45 PID 1928 wrote to memory of 436 1928 net.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\33fe7953342990332717f1c2638f671674efe06fa87c82b23cd9dbe748dd761c.exe"C:\Users\Admin\AppData\Local\Temp\33fe7953342990332717f1c2638f671674efe06fa87c82b23cd9dbe748dd761c.exe"1⤵
- Drops file in Drivers directory
- Loads dropped DLL
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:1228 -
C:\Windows\SysWOW64\net.exenet stop nethttpservice2⤵
- Suspicious use of WriteProcessMemory
PID:952 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop nethttpservice3⤵PID:1332
-
-
-
C:\Windows\SysWOW64\net.exenet stop serviceupdater2⤵
- Suspicious use of WriteProcessMemory
PID:804 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop serviceupdater3⤵PID:1776
-
-
-
C:\Windows\SysWOW64\installd.exe"C:\Windows\system32\installd.exe" nethfdrv2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1880
-
-
C:\Windows\SysWOW64\nethtsrv.exe"C:\Windows\system32\nethtsrv.exe" -nfdi2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1936
-
-
C:\Windows\SysWOW64\netupdsrv.exe"C:\Windows\system32\netupdsrv.exe" -nfdi2⤵
- Executes dropped EXE
PID:1796
-
-
C:\Windows\SysWOW64\net.exenet start nethttpservice2⤵
- Suspicious use of WriteProcessMemory
PID:240 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 start nethttpservice3⤵PID:1912
-
-
-
C:\Windows\SysWOW64\net.exenet start serviceupdater2⤵
- Suspicious use of WriteProcessMemory
PID:1928 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 start serviceupdater3⤵PID:436
-
-
-
C:\Windows\SysWOW64\nethtsrv.exeC:\Windows\SysWOW64\nethtsrv.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:1916
-
C:\Windows\SysWOW64\netupdsrv.exeC:\Windows\SysWOW64\netupdsrv.exe1⤵
- Executes dropped EXE
PID:800
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
106KB
MD5a188d331d3ea510b235922705b815fc1
SHA1bf38498d0846e58e6beb6a1185d7470db99ccbcd
SHA25658a22c548ae75bd62d8cb0b8ccec15d2d700f7c498e936ab11f05be15c8085f4
SHA5120172cdb4173766fefa0a7f8e463b83a808356fe050b8ace91755271f609a368191c4fd7205e846a64ba8b707e7f8a6c29001f933405f42357b008163c5955422
-
Filesize
241KB
MD562ad02f938a051b0f9542fc878559ac9
SHA16c9016b50bc3a1efc362b67c8eea72bcc2c15c0d
SHA2566291fac1e8956737d0c3e674210df7da3f040f03cb98cb3d496d9ae09b8c6ae6
SHA51288b93e81ed7844fc017a17d03f0d1acbe55b869120b3b44f56de858ba517b574eaac134cbed09c631dd887a6744040c3f34c17ffe1268ab23eeee9c960df16c7
-
Filesize
108KB
MD58d54d8ccd425d7d5cf77f16e194fbdce
SHA19d4658da087d2f48f32e1a95fc884fdcc24c41f4
SHA2560f9794c87ecbf3280bbf2a481e3c6a2e36472e8e8c8cff199bddb5b9c471fe6c
SHA512d53e705a446ec256dfa3a639b0751479b547e50ff850e4efaba64c511f402680ab9b160e92c66f90fb309d4fa7adfc33d0e4f5161a8375418e062a91115fd66c
-
Filesize
176KB
MD534245060ea7a0ab104c6991c255bf1e6
SHA1150c5d450e672ead7d1cc69ced6cff823c1d8c65
SHA256cbff07230beceb4bcb4183b98ef231b667f2a564b5fcc47244575567638a63d7
SHA512eb4443b98f7300438311e919f92b3c7de3b49f41c5e51414bc96e7b7c6b74ddca1eb72f29bf25d1ccf0b56eff5f633a3c4a0c8df7670286732a60c0ebc55f596
-
Filesize
176KB
MD534245060ea7a0ab104c6991c255bf1e6
SHA1150c5d450e672ead7d1cc69ced6cff823c1d8c65
SHA256cbff07230beceb4bcb4183b98ef231b667f2a564b5fcc47244575567638a63d7
SHA512eb4443b98f7300438311e919f92b3c7de3b49f41c5e51414bc96e7b7c6b74ddca1eb72f29bf25d1ccf0b56eff5f633a3c4a0c8df7670286732a60c0ebc55f596
-
Filesize
158KB
MD5a8dfa2b47d63b9b0af8379f9b3a1bbec
SHA192de0d4d92ac7df3f9e28138d55fe0d662eecdbd
SHA25652b4e64c1c690418f3b08be15010fd34d99bd28aff65c0c79dd405844681aa87
SHA5122135de83587a0594d208978094fbd546f37d9f084a5ad90eb00624fbd0d029cce8fe13033b46f09324ac087743f3a06acb4aad12e005496974a1039b7291975a
-
Filesize
158KB
MD5a8dfa2b47d63b9b0af8379f9b3a1bbec
SHA192de0d4d92ac7df3f9e28138d55fe0d662eecdbd
SHA25652b4e64c1c690418f3b08be15010fd34d99bd28aff65c0c79dd405844681aa87
SHA5122135de83587a0594d208978094fbd546f37d9f084a5ad90eb00624fbd0d029cce8fe13033b46f09324ac087743f3a06acb4aad12e005496974a1039b7291975a
-
Filesize
11KB
MD5c17103ae9072a06da581dec998343fc1
SHA1b72148c6bdfaada8b8c3f950e610ee7cf1da1f8d
SHA256dc58d8ad81cacb0c1ed72e33bff8f23ea40b5252b5bb55d393a0903e6819ae2f
SHA512d32a71aaef18e993f28096d536e41c4d016850721b31171513ce28bbd805a54fd290b7c3e9d935f72e676a1acfb4f0dcc89d95040a0dd29f2b6975855c18986f
-
Filesize
6KB
MD5acc2b699edfea5bf5aae45aba3a41e96
SHA1d2accf4d494e43ceb2cff69abe4dd17147d29cc2
SHA256168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e
SHA512e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe
-
Filesize
6KB
MD5acc2b699edfea5bf5aae45aba3a41e96
SHA1d2accf4d494e43ceb2cff69abe4dd17147d29cc2
SHA256168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e
SHA512e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe
-
Filesize
6KB
MD5acc2b699edfea5bf5aae45aba3a41e96
SHA1d2accf4d494e43ceb2cff69abe4dd17147d29cc2
SHA256168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e
SHA512e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe
-
Filesize
6KB
MD5acc2b699edfea5bf5aae45aba3a41e96
SHA1d2accf4d494e43ceb2cff69abe4dd17147d29cc2
SHA256168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e
SHA512e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe
-
Filesize
106KB
MD5a188d331d3ea510b235922705b815fc1
SHA1bf38498d0846e58e6beb6a1185d7470db99ccbcd
SHA25658a22c548ae75bd62d8cb0b8ccec15d2d700f7c498e936ab11f05be15c8085f4
SHA5120172cdb4173766fefa0a7f8e463b83a808356fe050b8ace91755271f609a368191c4fd7205e846a64ba8b707e7f8a6c29001f933405f42357b008163c5955422
-
Filesize
106KB
MD5a188d331d3ea510b235922705b815fc1
SHA1bf38498d0846e58e6beb6a1185d7470db99ccbcd
SHA25658a22c548ae75bd62d8cb0b8ccec15d2d700f7c498e936ab11f05be15c8085f4
SHA5120172cdb4173766fefa0a7f8e463b83a808356fe050b8ace91755271f609a368191c4fd7205e846a64ba8b707e7f8a6c29001f933405f42357b008163c5955422
-
Filesize
106KB
MD5a188d331d3ea510b235922705b815fc1
SHA1bf38498d0846e58e6beb6a1185d7470db99ccbcd
SHA25658a22c548ae75bd62d8cb0b8ccec15d2d700f7c498e936ab11f05be15c8085f4
SHA5120172cdb4173766fefa0a7f8e463b83a808356fe050b8ace91755271f609a368191c4fd7205e846a64ba8b707e7f8a6c29001f933405f42357b008163c5955422
-
Filesize
241KB
MD562ad02f938a051b0f9542fc878559ac9
SHA16c9016b50bc3a1efc362b67c8eea72bcc2c15c0d
SHA2566291fac1e8956737d0c3e674210df7da3f040f03cb98cb3d496d9ae09b8c6ae6
SHA51288b93e81ed7844fc017a17d03f0d1acbe55b869120b3b44f56de858ba517b574eaac134cbed09c631dd887a6744040c3f34c17ffe1268ab23eeee9c960df16c7
-
Filesize
241KB
MD562ad02f938a051b0f9542fc878559ac9
SHA16c9016b50bc3a1efc362b67c8eea72bcc2c15c0d
SHA2566291fac1e8956737d0c3e674210df7da3f040f03cb98cb3d496d9ae09b8c6ae6
SHA51288b93e81ed7844fc017a17d03f0d1acbe55b869120b3b44f56de858ba517b574eaac134cbed09c631dd887a6744040c3f34c17ffe1268ab23eeee9c960df16c7
-
Filesize
108KB
MD58d54d8ccd425d7d5cf77f16e194fbdce
SHA19d4658da087d2f48f32e1a95fc884fdcc24c41f4
SHA2560f9794c87ecbf3280bbf2a481e3c6a2e36472e8e8c8cff199bddb5b9c471fe6c
SHA512d53e705a446ec256dfa3a639b0751479b547e50ff850e4efaba64c511f402680ab9b160e92c66f90fb309d4fa7adfc33d0e4f5161a8375418e062a91115fd66c
-
Filesize
176KB
MD534245060ea7a0ab104c6991c255bf1e6
SHA1150c5d450e672ead7d1cc69ced6cff823c1d8c65
SHA256cbff07230beceb4bcb4183b98ef231b667f2a564b5fcc47244575567638a63d7
SHA512eb4443b98f7300438311e919f92b3c7de3b49f41c5e51414bc96e7b7c6b74ddca1eb72f29bf25d1ccf0b56eff5f633a3c4a0c8df7670286732a60c0ebc55f596
-
Filesize
158KB
MD5a8dfa2b47d63b9b0af8379f9b3a1bbec
SHA192de0d4d92ac7df3f9e28138d55fe0d662eecdbd
SHA25652b4e64c1c690418f3b08be15010fd34d99bd28aff65c0c79dd405844681aa87
SHA5122135de83587a0594d208978094fbd546f37d9f084a5ad90eb00624fbd0d029cce8fe13033b46f09324ac087743f3a06acb4aad12e005496974a1039b7291975a