Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    195s
  • max time network
    226s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20221111-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
  • submitted
    25/11/2022, 14:28

General

  • Target

    73ba89b658520c89acaea2ec199eb106a97f6c95993cb34a79ac633f1d3e0c6c.exe

  • Size

    562KB

  • MD5

    dba016718093e4b51a515c422d401724

  • SHA1

    a915e735fda5b2b47a397fb0bc23662f79da9ef4

  • SHA256

    73ba89b658520c89acaea2ec199eb106a97f6c95993cb34a79ac633f1d3e0c6c

  • SHA512

    b0325934a06f98aa31f4a7e50b6c4224a7909512b647eeb23d58fc6e5c60a52cc83032ade83dfa877f85c068b254147780e0bede3e5a38982adddf16a326eb44

  • SSDEEP

    12288:vPRYzJbfrCqpGy06eTxCyPT4Uc5wlF/eknfv:iz9fuqRK9chCz

Score
8/10

Malware Config

Signatures

  • Drops file in Drivers directory 1 IoCs
  • Executes dropped EXE 5 IoCs
  • Loads dropped DLL 14 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Drops file in System32 directory 5 IoCs
  • Drops file in Program Files directory 3 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Modifies data under HKEY_USERS 1 IoCs
  • Runs net.exe
  • Suspicious behavior: LoadsDriver 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 33 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\73ba89b658520c89acaea2ec199eb106a97f6c95993cb34a79ac633f1d3e0c6c.exe
    "C:\Users\Admin\AppData\Local\Temp\73ba89b658520c89acaea2ec199eb106a97f6c95993cb34a79ac633f1d3e0c6c.exe"
    1⤵
    • Drops file in Drivers directory
    • Loads dropped DLL
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • Suspicious use of WriteProcessMemory
    PID:2576
    • C:\Windows\SysWOW64\net.exe
      net stop nethttpservice
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:4824
      • C:\Windows\SysWOW64\net1.exe
        C:\Windows\system32\net1 stop nethttpservice
        3⤵
          PID:4820
      • C:\Windows\SysWOW64\net.exe
        net stop serviceupdater
        2⤵
        • Suspicious use of WriteProcessMemory
        PID:4340
        • C:\Windows\SysWOW64\net1.exe
          C:\Windows\system32\net1 stop serviceupdater
          3⤵
            PID:316
        • C:\Windows\SysWOW64\installd.exe
          "C:\Windows\system32\installd.exe" nethfdrv
          2⤵
          • Executes dropped EXE
          • Loads dropped DLL
          PID:4876
        • C:\Windows\SysWOW64\nethtsrv.exe
          "C:\Windows\system32\nethtsrv.exe" -nfdi
          2⤵
          • Executes dropped EXE
          • Loads dropped DLL
          PID:3280
        • C:\Windows\SysWOW64\netupdsrv.exe
          "C:\Windows\system32\netupdsrv.exe" -nfdi
          2⤵
          • Executes dropped EXE
          PID:2916
        • C:\Windows\SysWOW64\net.exe
          net start nethttpservice
          2⤵
          • Suspicious use of WriteProcessMemory
          PID:2884
          • C:\Windows\SysWOW64\net1.exe
            C:\Windows\system32\net1 start nethttpservice
            3⤵
              PID:3812
          • C:\Windows\SysWOW64\net.exe
            net start serviceupdater
            2⤵
            • Suspicious use of WriteProcessMemory
            PID:1124
            • C:\Windows\SysWOW64\net1.exe
              C:\Windows\system32\net1 start serviceupdater
              3⤵
                PID:4856
          • C:\Windows\SysWOW64\nethtsrv.exe
            C:\Windows\SysWOW64\nethtsrv.exe
            1⤵
            • Executes dropped EXE
            • Loads dropped DLL
            • Modifies data under HKEY_USERS
            • Suspicious use of AdjustPrivilegeToken
            PID:4588
          • C:\Windows\SysWOW64\netupdsrv.exe
            C:\Windows\SysWOW64\netupdsrv.exe
            1⤵
            • Executes dropped EXE
            PID:2188

          Network

          MITRE ATT&CK Enterprise v6

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • C:\Users\Admin\AppData\Local\Temp\nsz9EA3.tmp\System.dll

            Filesize

            11KB

            MD5

            c17103ae9072a06da581dec998343fc1

            SHA1

            b72148c6bdfaada8b8c3f950e610ee7cf1da1f8d

            SHA256

            dc58d8ad81cacb0c1ed72e33bff8f23ea40b5252b5bb55d393a0903e6819ae2f

            SHA512

            d32a71aaef18e993f28096d536e41c4d016850721b31171513ce28bbd805a54fd290b7c3e9d935f72e676a1acfb4f0dcc89d95040a0dd29f2b6975855c18986f

          • C:\Users\Admin\AppData\Local\Temp\nsz9EA3.tmp\nsExec.dll

            Filesize

            6KB

            MD5

            acc2b699edfea5bf5aae45aba3a41e96

            SHA1

            d2accf4d494e43ceb2cff69abe4dd17147d29cc2

            SHA256

            168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e

            SHA512

            e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe

          • C:\Users\Admin\AppData\Local\Temp\nsz9EA3.tmp\nsExec.dll

            Filesize

            6KB

            MD5

            acc2b699edfea5bf5aae45aba3a41e96

            SHA1

            d2accf4d494e43ceb2cff69abe4dd17147d29cc2

            SHA256

            168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e

            SHA512

            e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe

          • C:\Users\Admin\AppData\Local\Temp\nsz9EA3.tmp\nsExec.dll

            Filesize

            6KB

            MD5

            acc2b699edfea5bf5aae45aba3a41e96

            SHA1

            d2accf4d494e43ceb2cff69abe4dd17147d29cc2

            SHA256

            168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e

            SHA512

            e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe

          • C:\Users\Admin\AppData\Local\Temp\nsz9EA3.tmp\nsExec.dll

            Filesize

            6KB

            MD5

            acc2b699edfea5bf5aae45aba3a41e96

            SHA1

            d2accf4d494e43ceb2cff69abe4dd17147d29cc2

            SHA256

            168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e

            SHA512

            e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe

          • C:\Users\Admin\AppData\Local\Temp\nsz9EA3.tmp\nsExec.dll

            Filesize

            6KB

            MD5

            acc2b699edfea5bf5aae45aba3a41e96

            SHA1

            d2accf4d494e43ceb2cff69abe4dd17147d29cc2

            SHA256

            168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e

            SHA512

            e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe

          • C:\Users\Admin\AppData\Local\Temp\nsz9EA3.tmp\nsExec.dll

            Filesize

            6KB

            MD5

            acc2b699edfea5bf5aae45aba3a41e96

            SHA1

            d2accf4d494e43ceb2cff69abe4dd17147d29cc2

            SHA256

            168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e

            SHA512

            e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe

          • C:\Users\Admin\AppData\Local\Temp\nsz9EA3.tmp\nsExec.dll

            Filesize

            6KB

            MD5

            acc2b699edfea5bf5aae45aba3a41e96

            SHA1

            d2accf4d494e43ceb2cff69abe4dd17147d29cc2

            SHA256

            168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e

            SHA512

            e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe

          • C:\Users\Admin\AppData\Local\Temp\nsz9EA3.tmp\nsExec.dll

            Filesize

            6KB

            MD5

            acc2b699edfea5bf5aae45aba3a41e96

            SHA1

            d2accf4d494e43ceb2cff69abe4dd17147d29cc2

            SHA256

            168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e

            SHA512

            e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe

          • C:\Windows\SysWOW64\hfnapi.dll

            Filesize

            106KB

            MD5

            1aeef01938fc50dc834d14774dc17011

            SHA1

            1d18549b40183e42d1a336debd8ffe5bb0d56e53

            SHA256

            d7f63deda659efeeb3d7608f4e77a308b6dc292358d625e52ecc37466811c175

            SHA512

            da445ef7bab3bfdcc1ced27a7e8963ee84f205946503b041d385a8fa0bd395089d500127c225c57b7a7b9dc9d5b17ead6e64316df23ef6b01c7bbef97ec48b71

          • C:\Windows\SysWOW64\hfnapi.dll

            Filesize

            106KB

            MD5

            1aeef01938fc50dc834d14774dc17011

            SHA1

            1d18549b40183e42d1a336debd8ffe5bb0d56e53

            SHA256

            d7f63deda659efeeb3d7608f4e77a308b6dc292358d625e52ecc37466811c175

            SHA512

            da445ef7bab3bfdcc1ced27a7e8963ee84f205946503b041d385a8fa0bd395089d500127c225c57b7a7b9dc9d5b17ead6e64316df23ef6b01c7bbef97ec48b71

          • C:\Windows\SysWOW64\hfnapi.dll

            Filesize

            106KB

            MD5

            1aeef01938fc50dc834d14774dc17011

            SHA1

            1d18549b40183e42d1a336debd8ffe5bb0d56e53

            SHA256

            d7f63deda659efeeb3d7608f4e77a308b6dc292358d625e52ecc37466811c175

            SHA512

            da445ef7bab3bfdcc1ced27a7e8963ee84f205946503b041d385a8fa0bd395089d500127c225c57b7a7b9dc9d5b17ead6e64316df23ef6b01c7bbef97ec48b71

          • C:\Windows\SysWOW64\hfnapi.dll

            Filesize

            106KB

            MD5

            1aeef01938fc50dc834d14774dc17011

            SHA1

            1d18549b40183e42d1a336debd8ffe5bb0d56e53

            SHA256

            d7f63deda659efeeb3d7608f4e77a308b6dc292358d625e52ecc37466811c175

            SHA512

            da445ef7bab3bfdcc1ced27a7e8963ee84f205946503b041d385a8fa0bd395089d500127c225c57b7a7b9dc9d5b17ead6e64316df23ef6b01c7bbef97ec48b71

          • C:\Windows\SysWOW64\hfpapi.dll

            Filesize

            244KB

            MD5

            bb0d8f54f9bdd037b18eaede86ad0bae

            SHA1

            64ccb935ecb1a864ad20c64135d6c543318448c5

            SHA256

            f38449db6a77bbfafb19ffd6dbf1d9eebe0fb2685f907b3ede7b0bb88a1a0257

            SHA512

            1dc8a47efc86d365b7b4a285b85fc6799de18c3ee5170f113e4994c425a8ffad8ec8d743d0a4cdb0195663fff843a4c5e060549ebec86ca69d7edac64794289f

          • C:\Windows\SysWOW64\hfpapi.dll

            Filesize

            244KB

            MD5

            bb0d8f54f9bdd037b18eaede86ad0bae

            SHA1

            64ccb935ecb1a864ad20c64135d6c543318448c5

            SHA256

            f38449db6a77bbfafb19ffd6dbf1d9eebe0fb2685f907b3ede7b0bb88a1a0257

            SHA512

            1dc8a47efc86d365b7b4a285b85fc6799de18c3ee5170f113e4994c425a8ffad8ec8d743d0a4cdb0195663fff843a4c5e060549ebec86ca69d7edac64794289f

          • C:\Windows\SysWOW64\hfpapi.dll

            Filesize

            244KB

            MD5

            bb0d8f54f9bdd037b18eaede86ad0bae

            SHA1

            64ccb935ecb1a864ad20c64135d6c543318448c5

            SHA256

            f38449db6a77bbfafb19ffd6dbf1d9eebe0fb2685f907b3ede7b0bb88a1a0257

            SHA512

            1dc8a47efc86d365b7b4a285b85fc6799de18c3ee5170f113e4994c425a8ffad8ec8d743d0a4cdb0195663fff843a4c5e060549ebec86ca69d7edac64794289f

          • C:\Windows\SysWOW64\installd.exe

            Filesize

            108KB

            MD5

            31c93d154138219c280cf2d5f2fe0626

            SHA1

            c19e88d108ea690dfc9579a274e52a92d92f2981

            SHA256

            c634d567356d1ace82a2ca3610acd41fc7a64e7c631d79f851c57dbbe90bad98

            SHA512

            1776d73a3597d2de877107a0fa4e7a12672ca62b0714d68af46b583f4ea371c081af48a6328bd01cb90cb51bfa45ef29258b2bf9203d0fa87e124fcc0de05843

          • C:\Windows\SysWOW64\installd.exe

            Filesize

            108KB

            MD5

            31c93d154138219c280cf2d5f2fe0626

            SHA1

            c19e88d108ea690dfc9579a274e52a92d92f2981

            SHA256

            c634d567356d1ace82a2ca3610acd41fc7a64e7c631d79f851c57dbbe90bad98

            SHA512

            1776d73a3597d2de877107a0fa4e7a12672ca62b0714d68af46b583f4ea371c081af48a6328bd01cb90cb51bfa45ef29258b2bf9203d0fa87e124fcc0de05843

          • C:\Windows\SysWOW64\nethtsrv.exe

            Filesize

            176KB

            MD5

            85d46ceb980c50f957b46893af456108

            SHA1

            d3c59caf6486568d9b93f480f26ab2b0fd033c02

            SHA256

            6782aaa4743299fd446dccb5514bde810ec1433fa992bb6619a4e814c0f9308c

            SHA512

            962728fd6a7af608a2aa01c99893434631269151336814b9eb2996ea627e8510347939e8768013944de6524f2c61f466b9993a66dd863ec3729103a2f0272e07

          • C:\Windows\SysWOW64\nethtsrv.exe

            Filesize

            176KB

            MD5

            85d46ceb980c50f957b46893af456108

            SHA1

            d3c59caf6486568d9b93f480f26ab2b0fd033c02

            SHA256

            6782aaa4743299fd446dccb5514bde810ec1433fa992bb6619a4e814c0f9308c

            SHA512

            962728fd6a7af608a2aa01c99893434631269151336814b9eb2996ea627e8510347939e8768013944de6524f2c61f466b9993a66dd863ec3729103a2f0272e07

          • C:\Windows\SysWOW64\nethtsrv.exe

            Filesize

            176KB

            MD5

            85d46ceb980c50f957b46893af456108

            SHA1

            d3c59caf6486568d9b93f480f26ab2b0fd033c02

            SHA256

            6782aaa4743299fd446dccb5514bde810ec1433fa992bb6619a4e814c0f9308c

            SHA512

            962728fd6a7af608a2aa01c99893434631269151336814b9eb2996ea627e8510347939e8768013944de6524f2c61f466b9993a66dd863ec3729103a2f0272e07

          • C:\Windows\SysWOW64\netupdsrv.exe

            Filesize

            158KB

            MD5

            1d7e997260fb68cec4e4f48bb5de55cd

            SHA1

            f904d1a937a6661b27ce795f8c7644da32cd4120

            SHA256

            07bd064fe1a9dc6a9be81c92b722bd9f612fe37f2505c6f0aad034e0b33fa26f

            SHA512

            982390a1179199c5f222a0e47defd17190781162d0fac24c90e72bd579328294cc23f4d64f85bf27bac4d7a32678785c0986ddbe06c18dc84a188437c3c6bea5

          • C:\Windows\SysWOW64\netupdsrv.exe

            Filesize

            158KB

            MD5

            1d7e997260fb68cec4e4f48bb5de55cd

            SHA1

            f904d1a937a6661b27ce795f8c7644da32cd4120

            SHA256

            07bd064fe1a9dc6a9be81c92b722bd9f612fe37f2505c6f0aad034e0b33fa26f

            SHA512

            982390a1179199c5f222a0e47defd17190781162d0fac24c90e72bd579328294cc23f4d64f85bf27bac4d7a32678785c0986ddbe06c18dc84a188437c3c6bea5

          • C:\Windows\SysWOW64\netupdsrv.exe

            Filesize

            158KB

            MD5

            1d7e997260fb68cec4e4f48bb5de55cd

            SHA1

            f904d1a937a6661b27ce795f8c7644da32cd4120

            SHA256

            07bd064fe1a9dc6a9be81c92b722bd9f612fe37f2505c6f0aad034e0b33fa26f

            SHA512

            982390a1179199c5f222a0e47defd17190781162d0fac24c90e72bd579328294cc23f4d64f85bf27bac4d7a32678785c0986ddbe06c18dc84a188437c3c6bea5

          • memory/2576-132-0x0000000000360000-0x00000000007BE000-memory.dmp

            Filesize

            4.4MB

          • memory/2576-147-0x0000000000360000-0x00000000007BE000-memory.dmp

            Filesize

            4.4MB

          • memory/2576-169-0x0000000000360000-0x00000000007BE000-memory.dmp

            Filesize

            4.4MB