Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
126s -
max time network
138s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
25/11/2022, 13:28
Static task
static1
Behavioral task
behavioral1
Sample
edd6eb80350b9bbcc08797cb3816b00125683b5dd52385488257fc336ffd1655.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
edd6eb80350b9bbcc08797cb3816b00125683b5dd52385488257fc336ffd1655.exe
Resource
win10v2004-20220812-en
General
-
Target
edd6eb80350b9bbcc08797cb3816b00125683b5dd52385488257fc336ffd1655.exe
-
Size
561KB
-
MD5
1f5e63c83bf985e5ee9c4cfb4cb6cf92
-
SHA1
73eae91c94c6fc8f758c23b72e2f26fb2ef088d0
-
SHA256
edd6eb80350b9bbcc08797cb3816b00125683b5dd52385488257fc336ffd1655
-
SHA512
b3ca726ae203325696845fd1821021eec690fb3ffd176e78f7d9294ea0d67fac8e5d809d13f07dd7203a5ecf51bfb7f573203e0a837f6d9beb14006c4b20c967
-
SSDEEP
12288:FPRYzObfjCzMEk9308Wkoib4OW4T4gVPEnq:MzCf2Mz308T94y8
Malware Config
Signatures
-
Drops file in Drivers directory 1 IoCs
description ioc Process File created C:\Windows\system32\drivers\nethfdrv.sys edd6eb80350b9bbcc08797cb3816b00125683b5dd52385488257fc336ffd1655.exe -
Executes dropped EXE 5 IoCs
pid Process 1112 installd.exe 1848 nethtsrv.exe 4508 netupdsrv.exe 3452 nethtsrv.exe 4236 netupdsrv.exe -
Loads dropped DLL 14 IoCs
pid Process 3828 edd6eb80350b9bbcc08797cb3816b00125683b5dd52385488257fc336ffd1655.exe 3828 edd6eb80350b9bbcc08797cb3816b00125683b5dd52385488257fc336ffd1655.exe 3828 edd6eb80350b9bbcc08797cb3816b00125683b5dd52385488257fc336ffd1655.exe 3828 edd6eb80350b9bbcc08797cb3816b00125683b5dd52385488257fc336ffd1655.exe 3828 edd6eb80350b9bbcc08797cb3816b00125683b5dd52385488257fc336ffd1655.exe 1112 installd.exe 1848 nethtsrv.exe 1848 nethtsrv.exe 3828 edd6eb80350b9bbcc08797cb3816b00125683b5dd52385488257fc336ffd1655.exe 3828 edd6eb80350b9bbcc08797cb3816b00125683b5dd52385488257fc336ffd1655.exe 3452 nethtsrv.exe 3452 nethtsrv.exe 3828 edd6eb80350b9bbcc08797cb3816b00125683b5dd52385488257fc336ffd1655.exe 3828 edd6eb80350b9bbcc08797cb3816b00125683b5dd52385488257fc336ffd1655.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops file in System32 directory 5 IoCs
description ioc Process File created C:\Windows\SysWOW64\netupdsrv.exe edd6eb80350b9bbcc08797cb3816b00125683b5dd52385488257fc336ffd1655.exe File created C:\Windows\SysWOW64\hfnapi.dll edd6eb80350b9bbcc08797cb3816b00125683b5dd52385488257fc336ffd1655.exe File created C:\Windows\SysWOW64\hfpapi.dll edd6eb80350b9bbcc08797cb3816b00125683b5dd52385488257fc336ffd1655.exe File created C:\Windows\SysWOW64\installd.exe edd6eb80350b9bbcc08797cb3816b00125683b5dd52385488257fc336ffd1655.exe File created C:\Windows\SysWOW64\nethtsrv.exe edd6eb80350b9bbcc08797cb3816b00125683b5dd52385488257fc336ffd1655.exe -
Drops file in Program Files directory 3 IoCs
description ioc Process File created C:\Program Files (x86)\Common Files\Config\data.xml edd6eb80350b9bbcc08797cb3816b00125683b5dd52385488257fc336ffd1655.exe File created C:\Program Files (x86)\Common Files\Config\ver.xml edd6eb80350b9bbcc08797cb3816b00125683b5dd52385488257fc336ffd1655.exe File created C:\Program Files (x86)\Common Files\config\uninstinethnfd.exe edd6eb80350b9bbcc08797cb3816b00125683b5dd52385488257fc336ffd1655.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Modifies data under HKEY_USERS 1 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections nethtsrv.exe -
Runs net.exe
-
Suspicious behavior: LoadsDriver 1 IoCs
pid Process 668 Process not Found -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 3452 nethtsrv.exe -
Suspicious use of WriteProcessMemory 33 IoCs
description pid Process procid_target PID 3828 wrote to memory of 4540 3828 edd6eb80350b9bbcc08797cb3816b00125683b5dd52385488257fc336ffd1655.exe 79 PID 3828 wrote to memory of 4540 3828 edd6eb80350b9bbcc08797cb3816b00125683b5dd52385488257fc336ffd1655.exe 79 PID 3828 wrote to memory of 4540 3828 edd6eb80350b9bbcc08797cb3816b00125683b5dd52385488257fc336ffd1655.exe 79 PID 4540 wrote to memory of 372 4540 net.exe 81 PID 4540 wrote to memory of 372 4540 net.exe 81 PID 4540 wrote to memory of 372 4540 net.exe 81 PID 3828 wrote to memory of 4120 3828 edd6eb80350b9bbcc08797cb3816b00125683b5dd52385488257fc336ffd1655.exe 82 PID 3828 wrote to memory of 4120 3828 edd6eb80350b9bbcc08797cb3816b00125683b5dd52385488257fc336ffd1655.exe 82 PID 3828 wrote to memory of 4120 3828 edd6eb80350b9bbcc08797cb3816b00125683b5dd52385488257fc336ffd1655.exe 82 PID 4120 wrote to memory of 2072 4120 net.exe 84 PID 4120 wrote to memory of 2072 4120 net.exe 84 PID 4120 wrote to memory of 2072 4120 net.exe 84 PID 3828 wrote to memory of 1112 3828 edd6eb80350b9bbcc08797cb3816b00125683b5dd52385488257fc336ffd1655.exe 85 PID 3828 wrote to memory of 1112 3828 edd6eb80350b9bbcc08797cb3816b00125683b5dd52385488257fc336ffd1655.exe 85 PID 3828 wrote to memory of 1112 3828 edd6eb80350b9bbcc08797cb3816b00125683b5dd52385488257fc336ffd1655.exe 85 PID 3828 wrote to memory of 1848 3828 edd6eb80350b9bbcc08797cb3816b00125683b5dd52385488257fc336ffd1655.exe 86 PID 3828 wrote to memory of 1848 3828 edd6eb80350b9bbcc08797cb3816b00125683b5dd52385488257fc336ffd1655.exe 86 PID 3828 wrote to memory of 1848 3828 edd6eb80350b9bbcc08797cb3816b00125683b5dd52385488257fc336ffd1655.exe 86 PID 3828 wrote to memory of 4508 3828 edd6eb80350b9bbcc08797cb3816b00125683b5dd52385488257fc336ffd1655.exe 88 PID 3828 wrote to memory of 4508 3828 edd6eb80350b9bbcc08797cb3816b00125683b5dd52385488257fc336ffd1655.exe 88 PID 3828 wrote to memory of 4508 3828 edd6eb80350b9bbcc08797cb3816b00125683b5dd52385488257fc336ffd1655.exe 88 PID 3828 wrote to memory of 100 3828 edd6eb80350b9bbcc08797cb3816b00125683b5dd52385488257fc336ffd1655.exe 91 PID 3828 wrote to memory of 100 3828 edd6eb80350b9bbcc08797cb3816b00125683b5dd52385488257fc336ffd1655.exe 91 PID 3828 wrote to memory of 100 3828 edd6eb80350b9bbcc08797cb3816b00125683b5dd52385488257fc336ffd1655.exe 91 PID 100 wrote to memory of 3896 100 net.exe 93 PID 100 wrote to memory of 3896 100 net.exe 93 PID 100 wrote to memory of 3896 100 net.exe 93 PID 3828 wrote to memory of 2400 3828 edd6eb80350b9bbcc08797cb3816b00125683b5dd52385488257fc336ffd1655.exe 95 PID 3828 wrote to memory of 2400 3828 edd6eb80350b9bbcc08797cb3816b00125683b5dd52385488257fc336ffd1655.exe 95 PID 3828 wrote to memory of 2400 3828 edd6eb80350b9bbcc08797cb3816b00125683b5dd52385488257fc336ffd1655.exe 95 PID 2400 wrote to memory of 2644 2400 net.exe 97 PID 2400 wrote to memory of 2644 2400 net.exe 97 PID 2400 wrote to memory of 2644 2400 net.exe 97
Processes
-
C:\Users\Admin\AppData\Local\Temp\edd6eb80350b9bbcc08797cb3816b00125683b5dd52385488257fc336ffd1655.exe"C:\Users\Admin\AppData\Local\Temp\edd6eb80350b9bbcc08797cb3816b00125683b5dd52385488257fc336ffd1655.exe"1⤵
- Drops file in Drivers directory
- Loads dropped DLL
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:3828 -
C:\Windows\SysWOW64\net.exenet stop nethttpservice2⤵
- Suspicious use of WriteProcessMemory
PID:4540 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop nethttpservice3⤵PID:372
-
-
-
C:\Windows\SysWOW64\net.exenet stop serviceupdater2⤵
- Suspicious use of WriteProcessMemory
PID:4120 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop serviceupdater3⤵PID:2072
-
-
-
C:\Windows\SysWOW64\installd.exe"C:\Windows\system32\installd.exe" nethfdrv2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1112
-
-
C:\Windows\SysWOW64\nethtsrv.exe"C:\Windows\system32\nethtsrv.exe" -nfdi2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1848
-
-
C:\Windows\SysWOW64\netupdsrv.exe"C:\Windows\system32\netupdsrv.exe" -nfdi2⤵
- Executes dropped EXE
PID:4508
-
-
C:\Windows\SysWOW64\net.exenet start nethttpservice2⤵
- Suspicious use of WriteProcessMemory
PID:100 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 start nethttpservice3⤵PID:3896
-
-
-
C:\Windows\SysWOW64\net.exenet start serviceupdater2⤵
- Suspicious use of WriteProcessMemory
PID:2400 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 start serviceupdater3⤵PID:2644
-
-
-
C:\Windows\SysWOW64\nethtsrv.exeC:\Windows\SysWOW64\nethtsrv.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:3452
-
C:\Windows\SysWOW64\netupdsrv.exeC:\Windows\SysWOW64\netupdsrv.exe1⤵
- Executes dropped EXE
PID:4236
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
11KB
MD5c17103ae9072a06da581dec998343fc1
SHA1b72148c6bdfaada8b8c3f950e610ee7cf1da1f8d
SHA256dc58d8ad81cacb0c1ed72e33bff8f23ea40b5252b5bb55d393a0903e6819ae2f
SHA512d32a71aaef18e993f28096d536e41c4d016850721b31171513ce28bbd805a54fd290b7c3e9d935f72e676a1acfb4f0dcc89d95040a0dd29f2b6975855c18986f
-
Filesize
6KB
MD5acc2b699edfea5bf5aae45aba3a41e96
SHA1d2accf4d494e43ceb2cff69abe4dd17147d29cc2
SHA256168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e
SHA512e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe
-
Filesize
6KB
MD5acc2b699edfea5bf5aae45aba3a41e96
SHA1d2accf4d494e43ceb2cff69abe4dd17147d29cc2
SHA256168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e
SHA512e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe
-
Filesize
6KB
MD5acc2b699edfea5bf5aae45aba3a41e96
SHA1d2accf4d494e43ceb2cff69abe4dd17147d29cc2
SHA256168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e
SHA512e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe
-
Filesize
6KB
MD5acc2b699edfea5bf5aae45aba3a41e96
SHA1d2accf4d494e43ceb2cff69abe4dd17147d29cc2
SHA256168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e
SHA512e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe
-
Filesize
6KB
MD5acc2b699edfea5bf5aae45aba3a41e96
SHA1d2accf4d494e43ceb2cff69abe4dd17147d29cc2
SHA256168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e
SHA512e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe
-
Filesize
6KB
MD5acc2b699edfea5bf5aae45aba3a41e96
SHA1d2accf4d494e43ceb2cff69abe4dd17147d29cc2
SHA256168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e
SHA512e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe
-
Filesize
6KB
MD5acc2b699edfea5bf5aae45aba3a41e96
SHA1d2accf4d494e43ceb2cff69abe4dd17147d29cc2
SHA256168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e
SHA512e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe
-
Filesize
6KB
MD5acc2b699edfea5bf5aae45aba3a41e96
SHA1d2accf4d494e43ceb2cff69abe4dd17147d29cc2
SHA256168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e
SHA512e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe
-
Filesize
106KB
MD59b4a7c09d26f2b3938a8fe00a7ec6fb0
SHA162414ee324f55062ad59699e1a43f33faff96364
SHA256eb3e8082115c07ed4f408dab2867bac1a505a997c8259dd01f3f65be4ef2038c
SHA51295800f11fec648ebc48711a862e8cc06b4c439316e36e325d5bb8f481d593b9ef49382793f4b77c1c6a6b5cba7301a40be6643c211612bb653a95f8ba3b17e21
-
Filesize
106KB
MD59b4a7c09d26f2b3938a8fe00a7ec6fb0
SHA162414ee324f55062ad59699e1a43f33faff96364
SHA256eb3e8082115c07ed4f408dab2867bac1a505a997c8259dd01f3f65be4ef2038c
SHA51295800f11fec648ebc48711a862e8cc06b4c439316e36e325d5bb8f481d593b9ef49382793f4b77c1c6a6b5cba7301a40be6643c211612bb653a95f8ba3b17e21
-
Filesize
106KB
MD59b4a7c09d26f2b3938a8fe00a7ec6fb0
SHA162414ee324f55062ad59699e1a43f33faff96364
SHA256eb3e8082115c07ed4f408dab2867bac1a505a997c8259dd01f3f65be4ef2038c
SHA51295800f11fec648ebc48711a862e8cc06b4c439316e36e325d5bb8f481d593b9ef49382793f4b77c1c6a6b5cba7301a40be6643c211612bb653a95f8ba3b17e21
-
Filesize
106KB
MD59b4a7c09d26f2b3938a8fe00a7ec6fb0
SHA162414ee324f55062ad59699e1a43f33faff96364
SHA256eb3e8082115c07ed4f408dab2867bac1a505a997c8259dd01f3f65be4ef2038c
SHA51295800f11fec648ebc48711a862e8cc06b4c439316e36e325d5bb8f481d593b9ef49382793f4b77c1c6a6b5cba7301a40be6643c211612bb653a95f8ba3b17e21
-
Filesize
241KB
MD5e46a2beb957bdd3dfa08718a2cffd62b
SHA1a3269d15e298284530b8e4d667e85c85eeb73dac
SHA256c2f78e69e3dc13d9036567ba6308f0967f0ec1a7cf4a230c2468083d1f521de3
SHA512f02d49ebc58740ef980b5f406d44ab7ca639ddd6d2dd8e8269b738fec5cb8fa5e7a1244c836a93fa14af915da2c5d609b417909a680437f0e8f3946348f355c1
-
Filesize
241KB
MD5e46a2beb957bdd3dfa08718a2cffd62b
SHA1a3269d15e298284530b8e4d667e85c85eeb73dac
SHA256c2f78e69e3dc13d9036567ba6308f0967f0ec1a7cf4a230c2468083d1f521de3
SHA512f02d49ebc58740ef980b5f406d44ab7ca639ddd6d2dd8e8269b738fec5cb8fa5e7a1244c836a93fa14af915da2c5d609b417909a680437f0e8f3946348f355c1
-
Filesize
241KB
MD5e46a2beb957bdd3dfa08718a2cffd62b
SHA1a3269d15e298284530b8e4d667e85c85eeb73dac
SHA256c2f78e69e3dc13d9036567ba6308f0967f0ec1a7cf4a230c2468083d1f521de3
SHA512f02d49ebc58740ef980b5f406d44ab7ca639ddd6d2dd8e8269b738fec5cb8fa5e7a1244c836a93fa14af915da2c5d609b417909a680437f0e8f3946348f355c1
-
Filesize
108KB
MD56e1336a58291fa04a9978089b57266d3
SHA1ab8271da637eb48d09033db0a006b6a966186715
SHA256b13c1e59df2888ff17e6110ad1cd8496af75c0532f3d215071765110f13ec221
SHA5125b6794910f3803626a153bc42115e5fd48bd9734ebb5aedb93f7be50743e95dad9873ef1185ba4c8fb30adaa28a8777f4b53c951909d00bfd97600409ef23771
-
Filesize
108KB
MD56e1336a58291fa04a9978089b57266d3
SHA1ab8271da637eb48d09033db0a006b6a966186715
SHA256b13c1e59df2888ff17e6110ad1cd8496af75c0532f3d215071765110f13ec221
SHA5125b6794910f3803626a153bc42115e5fd48bd9734ebb5aedb93f7be50743e95dad9873ef1185ba4c8fb30adaa28a8777f4b53c951909d00bfd97600409ef23771
-
Filesize
176KB
MD504744956c737a1d92eb32fa58c2942f5
SHA13885d92cd6b6a19c46171ed8a70683dc38821383
SHA256061016419320aaaa82eec3995fa0c7bfb00365d276e2f687f0e8b150f7f5550b
SHA512cc6a1b0c537dbb84fcb84457f76d72d55c1f0fd1809521507a7e9d64ad53ad002ca565cd2a66228d3c0c772bc4accc520aafe0299df10b5d3fb9ea58f5ca8036
-
Filesize
176KB
MD504744956c737a1d92eb32fa58c2942f5
SHA13885d92cd6b6a19c46171ed8a70683dc38821383
SHA256061016419320aaaa82eec3995fa0c7bfb00365d276e2f687f0e8b150f7f5550b
SHA512cc6a1b0c537dbb84fcb84457f76d72d55c1f0fd1809521507a7e9d64ad53ad002ca565cd2a66228d3c0c772bc4accc520aafe0299df10b5d3fb9ea58f5ca8036
-
Filesize
176KB
MD504744956c737a1d92eb32fa58c2942f5
SHA13885d92cd6b6a19c46171ed8a70683dc38821383
SHA256061016419320aaaa82eec3995fa0c7bfb00365d276e2f687f0e8b150f7f5550b
SHA512cc6a1b0c537dbb84fcb84457f76d72d55c1f0fd1809521507a7e9d64ad53ad002ca565cd2a66228d3c0c772bc4accc520aafe0299df10b5d3fb9ea58f5ca8036
-
Filesize
158KB
MD58cbf966e6b4fd1866ba84272fccadc9f
SHA19de2fed256c1cf3d3ffb1323466cebd51138080b
SHA2567e8a7b3bd008de8c740978c76b1a46b369801b6cefea67f2880b50ad92875676
SHA51221d3dec14eaedd0a0a7d36dcae3050c93e898cf9db314a41ca44b3c03b0995133f4d93a1f8213d2ea4f9104b476ecdd42b2c1027147150d92148263db8ff2822
-
Filesize
158KB
MD58cbf966e6b4fd1866ba84272fccadc9f
SHA19de2fed256c1cf3d3ffb1323466cebd51138080b
SHA2567e8a7b3bd008de8c740978c76b1a46b369801b6cefea67f2880b50ad92875676
SHA51221d3dec14eaedd0a0a7d36dcae3050c93e898cf9db314a41ca44b3c03b0995133f4d93a1f8213d2ea4f9104b476ecdd42b2c1027147150d92148263db8ff2822
-
Filesize
158KB
MD58cbf966e6b4fd1866ba84272fccadc9f
SHA19de2fed256c1cf3d3ffb1323466cebd51138080b
SHA2567e8a7b3bd008de8c740978c76b1a46b369801b6cefea67f2880b50ad92875676
SHA51221d3dec14eaedd0a0a7d36dcae3050c93e898cf9db314a41ca44b3c03b0995133f4d93a1f8213d2ea4f9104b476ecdd42b2c1027147150d92148263db8ff2822