Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
195s -
max time network
226s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system -
submitted
25/11/2022, 14:28
Static task
static1
Behavioral task
behavioral1
Sample
73ba89b658520c89acaea2ec199eb106a97f6c95993cb34a79ac633f1d3e0c6c.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
73ba89b658520c89acaea2ec199eb106a97f6c95993cb34a79ac633f1d3e0c6c.exe
Resource
win10v2004-20221111-en
General
-
Target
73ba89b658520c89acaea2ec199eb106a97f6c95993cb34a79ac633f1d3e0c6c.exe
-
Size
562KB
-
MD5
dba016718093e4b51a515c422d401724
-
SHA1
a915e735fda5b2b47a397fb0bc23662f79da9ef4
-
SHA256
73ba89b658520c89acaea2ec199eb106a97f6c95993cb34a79ac633f1d3e0c6c
-
SHA512
b0325934a06f98aa31f4a7e50b6c4224a7909512b647eeb23d58fc6e5c60a52cc83032ade83dfa877f85c068b254147780e0bede3e5a38982adddf16a326eb44
-
SSDEEP
12288:vPRYzJbfrCqpGy06eTxCyPT4Uc5wlF/eknfv:iz9fuqRK9chCz
Malware Config
Signatures
-
Drops file in Drivers directory 1 IoCs
description ioc Process File created C:\Windows\system32\drivers\nethfdrv.sys 73ba89b658520c89acaea2ec199eb106a97f6c95993cb34a79ac633f1d3e0c6c.exe -
Executes dropped EXE 5 IoCs
pid Process 4876 installd.exe 3280 nethtsrv.exe 2916 netupdsrv.exe 4588 nethtsrv.exe 2188 netupdsrv.exe -
Loads dropped DLL 14 IoCs
pid Process 2576 73ba89b658520c89acaea2ec199eb106a97f6c95993cb34a79ac633f1d3e0c6c.exe 2576 73ba89b658520c89acaea2ec199eb106a97f6c95993cb34a79ac633f1d3e0c6c.exe 2576 73ba89b658520c89acaea2ec199eb106a97f6c95993cb34a79ac633f1d3e0c6c.exe 2576 73ba89b658520c89acaea2ec199eb106a97f6c95993cb34a79ac633f1d3e0c6c.exe 2576 73ba89b658520c89acaea2ec199eb106a97f6c95993cb34a79ac633f1d3e0c6c.exe 4876 installd.exe 3280 nethtsrv.exe 3280 nethtsrv.exe 2576 73ba89b658520c89acaea2ec199eb106a97f6c95993cb34a79ac633f1d3e0c6c.exe 2576 73ba89b658520c89acaea2ec199eb106a97f6c95993cb34a79ac633f1d3e0c6c.exe 4588 nethtsrv.exe 4588 nethtsrv.exe 2576 73ba89b658520c89acaea2ec199eb106a97f6c95993cb34a79ac633f1d3e0c6c.exe 2576 73ba89b658520c89acaea2ec199eb106a97f6c95993cb34a79ac633f1d3e0c6c.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops file in System32 directory 5 IoCs
description ioc Process File created C:\Windows\SysWOW64\hfpapi.dll 73ba89b658520c89acaea2ec199eb106a97f6c95993cb34a79ac633f1d3e0c6c.exe File created C:\Windows\SysWOW64\installd.exe 73ba89b658520c89acaea2ec199eb106a97f6c95993cb34a79ac633f1d3e0c6c.exe File created C:\Windows\SysWOW64\nethtsrv.exe 73ba89b658520c89acaea2ec199eb106a97f6c95993cb34a79ac633f1d3e0c6c.exe File created C:\Windows\SysWOW64\netupdsrv.exe 73ba89b658520c89acaea2ec199eb106a97f6c95993cb34a79ac633f1d3e0c6c.exe File created C:\Windows\SysWOW64\hfnapi.dll 73ba89b658520c89acaea2ec199eb106a97f6c95993cb34a79ac633f1d3e0c6c.exe -
Drops file in Program Files directory 3 IoCs
description ioc Process File created C:\Program Files (x86)\Common Files\Config\data.xml 73ba89b658520c89acaea2ec199eb106a97f6c95993cb34a79ac633f1d3e0c6c.exe File created C:\Program Files (x86)\Common Files\Config\ver.xml 73ba89b658520c89acaea2ec199eb106a97f6c95993cb34a79ac633f1d3e0c6c.exe File created C:\Program Files (x86)\Common Files\config\uninstinethnfd.exe 73ba89b658520c89acaea2ec199eb106a97f6c95993cb34a79ac633f1d3e0c6c.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Modifies data under HKEY_USERS 1 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections nethtsrv.exe -
Runs net.exe
-
Suspicious behavior: LoadsDriver 1 IoCs
pid Process 648 Process not Found -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 4588 nethtsrv.exe -
Suspicious use of WriteProcessMemory 33 IoCs
description pid Process procid_target PID 2576 wrote to memory of 4824 2576 73ba89b658520c89acaea2ec199eb106a97f6c95993cb34a79ac633f1d3e0c6c.exe 83 PID 2576 wrote to memory of 4824 2576 73ba89b658520c89acaea2ec199eb106a97f6c95993cb34a79ac633f1d3e0c6c.exe 83 PID 2576 wrote to memory of 4824 2576 73ba89b658520c89acaea2ec199eb106a97f6c95993cb34a79ac633f1d3e0c6c.exe 83 PID 4824 wrote to memory of 4820 4824 net.exe 85 PID 4824 wrote to memory of 4820 4824 net.exe 85 PID 4824 wrote to memory of 4820 4824 net.exe 85 PID 2576 wrote to memory of 4340 2576 73ba89b658520c89acaea2ec199eb106a97f6c95993cb34a79ac633f1d3e0c6c.exe 86 PID 2576 wrote to memory of 4340 2576 73ba89b658520c89acaea2ec199eb106a97f6c95993cb34a79ac633f1d3e0c6c.exe 86 PID 2576 wrote to memory of 4340 2576 73ba89b658520c89acaea2ec199eb106a97f6c95993cb34a79ac633f1d3e0c6c.exe 86 PID 4340 wrote to memory of 316 4340 net.exe 88 PID 4340 wrote to memory of 316 4340 net.exe 88 PID 4340 wrote to memory of 316 4340 net.exe 88 PID 2576 wrote to memory of 4876 2576 73ba89b658520c89acaea2ec199eb106a97f6c95993cb34a79ac633f1d3e0c6c.exe 89 PID 2576 wrote to memory of 4876 2576 73ba89b658520c89acaea2ec199eb106a97f6c95993cb34a79ac633f1d3e0c6c.exe 89 PID 2576 wrote to memory of 4876 2576 73ba89b658520c89acaea2ec199eb106a97f6c95993cb34a79ac633f1d3e0c6c.exe 89 PID 2576 wrote to memory of 3280 2576 73ba89b658520c89acaea2ec199eb106a97f6c95993cb34a79ac633f1d3e0c6c.exe 90 PID 2576 wrote to memory of 3280 2576 73ba89b658520c89acaea2ec199eb106a97f6c95993cb34a79ac633f1d3e0c6c.exe 90 PID 2576 wrote to memory of 3280 2576 73ba89b658520c89acaea2ec199eb106a97f6c95993cb34a79ac633f1d3e0c6c.exe 90 PID 2576 wrote to memory of 2916 2576 73ba89b658520c89acaea2ec199eb106a97f6c95993cb34a79ac633f1d3e0c6c.exe 92 PID 2576 wrote to memory of 2916 2576 73ba89b658520c89acaea2ec199eb106a97f6c95993cb34a79ac633f1d3e0c6c.exe 92 PID 2576 wrote to memory of 2916 2576 73ba89b658520c89acaea2ec199eb106a97f6c95993cb34a79ac633f1d3e0c6c.exe 92 PID 2576 wrote to memory of 2884 2576 73ba89b658520c89acaea2ec199eb106a97f6c95993cb34a79ac633f1d3e0c6c.exe 94 PID 2576 wrote to memory of 2884 2576 73ba89b658520c89acaea2ec199eb106a97f6c95993cb34a79ac633f1d3e0c6c.exe 94 PID 2576 wrote to memory of 2884 2576 73ba89b658520c89acaea2ec199eb106a97f6c95993cb34a79ac633f1d3e0c6c.exe 94 PID 2884 wrote to memory of 3812 2884 net.exe 96 PID 2884 wrote to memory of 3812 2884 net.exe 96 PID 2884 wrote to memory of 3812 2884 net.exe 96 PID 2576 wrote to memory of 1124 2576 73ba89b658520c89acaea2ec199eb106a97f6c95993cb34a79ac633f1d3e0c6c.exe 98 PID 2576 wrote to memory of 1124 2576 73ba89b658520c89acaea2ec199eb106a97f6c95993cb34a79ac633f1d3e0c6c.exe 98 PID 2576 wrote to memory of 1124 2576 73ba89b658520c89acaea2ec199eb106a97f6c95993cb34a79ac633f1d3e0c6c.exe 98 PID 1124 wrote to memory of 4856 1124 net.exe 100 PID 1124 wrote to memory of 4856 1124 net.exe 100 PID 1124 wrote to memory of 4856 1124 net.exe 100
Processes
-
C:\Users\Admin\AppData\Local\Temp\73ba89b658520c89acaea2ec199eb106a97f6c95993cb34a79ac633f1d3e0c6c.exe"C:\Users\Admin\AppData\Local\Temp\73ba89b658520c89acaea2ec199eb106a97f6c95993cb34a79ac633f1d3e0c6c.exe"1⤵
- Drops file in Drivers directory
- Loads dropped DLL
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:2576 -
C:\Windows\SysWOW64\net.exenet stop nethttpservice2⤵
- Suspicious use of WriteProcessMemory
PID:4824 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop nethttpservice3⤵PID:4820
-
-
-
C:\Windows\SysWOW64\net.exenet stop serviceupdater2⤵
- Suspicious use of WriteProcessMemory
PID:4340 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop serviceupdater3⤵PID:316
-
-
-
C:\Windows\SysWOW64\installd.exe"C:\Windows\system32\installd.exe" nethfdrv2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:4876
-
-
C:\Windows\SysWOW64\nethtsrv.exe"C:\Windows\system32\nethtsrv.exe" -nfdi2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3280
-
-
C:\Windows\SysWOW64\netupdsrv.exe"C:\Windows\system32\netupdsrv.exe" -nfdi2⤵
- Executes dropped EXE
PID:2916
-
-
C:\Windows\SysWOW64\net.exenet start nethttpservice2⤵
- Suspicious use of WriteProcessMemory
PID:2884 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 start nethttpservice3⤵PID:3812
-
-
-
C:\Windows\SysWOW64\net.exenet start serviceupdater2⤵
- Suspicious use of WriteProcessMemory
PID:1124 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 start serviceupdater3⤵PID:4856
-
-
-
C:\Windows\SysWOW64\nethtsrv.exeC:\Windows\SysWOW64\nethtsrv.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:4588
-
C:\Windows\SysWOW64\netupdsrv.exeC:\Windows\SysWOW64\netupdsrv.exe1⤵
- Executes dropped EXE
PID:2188
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
11KB
MD5c17103ae9072a06da581dec998343fc1
SHA1b72148c6bdfaada8b8c3f950e610ee7cf1da1f8d
SHA256dc58d8ad81cacb0c1ed72e33bff8f23ea40b5252b5bb55d393a0903e6819ae2f
SHA512d32a71aaef18e993f28096d536e41c4d016850721b31171513ce28bbd805a54fd290b7c3e9d935f72e676a1acfb4f0dcc89d95040a0dd29f2b6975855c18986f
-
Filesize
6KB
MD5acc2b699edfea5bf5aae45aba3a41e96
SHA1d2accf4d494e43ceb2cff69abe4dd17147d29cc2
SHA256168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e
SHA512e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe
-
Filesize
6KB
MD5acc2b699edfea5bf5aae45aba3a41e96
SHA1d2accf4d494e43ceb2cff69abe4dd17147d29cc2
SHA256168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e
SHA512e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe
-
Filesize
6KB
MD5acc2b699edfea5bf5aae45aba3a41e96
SHA1d2accf4d494e43ceb2cff69abe4dd17147d29cc2
SHA256168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e
SHA512e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe
-
Filesize
6KB
MD5acc2b699edfea5bf5aae45aba3a41e96
SHA1d2accf4d494e43ceb2cff69abe4dd17147d29cc2
SHA256168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e
SHA512e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe
-
Filesize
6KB
MD5acc2b699edfea5bf5aae45aba3a41e96
SHA1d2accf4d494e43ceb2cff69abe4dd17147d29cc2
SHA256168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e
SHA512e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe
-
Filesize
6KB
MD5acc2b699edfea5bf5aae45aba3a41e96
SHA1d2accf4d494e43ceb2cff69abe4dd17147d29cc2
SHA256168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e
SHA512e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe
-
Filesize
6KB
MD5acc2b699edfea5bf5aae45aba3a41e96
SHA1d2accf4d494e43ceb2cff69abe4dd17147d29cc2
SHA256168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e
SHA512e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe
-
Filesize
6KB
MD5acc2b699edfea5bf5aae45aba3a41e96
SHA1d2accf4d494e43ceb2cff69abe4dd17147d29cc2
SHA256168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e
SHA512e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe
-
Filesize
106KB
MD51aeef01938fc50dc834d14774dc17011
SHA11d18549b40183e42d1a336debd8ffe5bb0d56e53
SHA256d7f63deda659efeeb3d7608f4e77a308b6dc292358d625e52ecc37466811c175
SHA512da445ef7bab3bfdcc1ced27a7e8963ee84f205946503b041d385a8fa0bd395089d500127c225c57b7a7b9dc9d5b17ead6e64316df23ef6b01c7bbef97ec48b71
-
Filesize
106KB
MD51aeef01938fc50dc834d14774dc17011
SHA11d18549b40183e42d1a336debd8ffe5bb0d56e53
SHA256d7f63deda659efeeb3d7608f4e77a308b6dc292358d625e52ecc37466811c175
SHA512da445ef7bab3bfdcc1ced27a7e8963ee84f205946503b041d385a8fa0bd395089d500127c225c57b7a7b9dc9d5b17ead6e64316df23ef6b01c7bbef97ec48b71
-
Filesize
106KB
MD51aeef01938fc50dc834d14774dc17011
SHA11d18549b40183e42d1a336debd8ffe5bb0d56e53
SHA256d7f63deda659efeeb3d7608f4e77a308b6dc292358d625e52ecc37466811c175
SHA512da445ef7bab3bfdcc1ced27a7e8963ee84f205946503b041d385a8fa0bd395089d500127c225c57b7a7b9dc9d5b17ead6e64316df23ef6b01c7bbef97ec48b71
-
Filesize
106KB
MD51aeef01938fc50dc834d14774dc17011
SHA11d18549b40183e42d1a336debd8ffe5bb0d56e53
SHA256d7f63deda659efeeb3d7608f4e77a308b6dc292358d625e52ecc37466811c175
SHA512da445ef7bab3bfdcc1ced27a7e8963ee84f205946503b041d385a8fa0bd395089d500127c225c57b7a7b9dc9d5b17ead6e64316df23ef6b01c7bbef97ec48b71
-
Filesize
244KB
MD5bb0d8f54f9bdd037b18eaede86ad0bae
SHA164ccb935ecb1a864ad20c64135d6c543318448c5
SHA256f38449db6a77bbfafb19ffd6dbf1d9eebe0fb2685f907b3ede7b0bb88a1a0257
SHA5121dc8a47efc86d365b7b4a285b85fc6799de18c3ee5170f113e4994c425a8ffad8ec8d743d0a4cdb0195663fff843a4c5e060549ebec86ca69d7edac64794289f
-
Filesize
244KB
MD5bb0d8f54f9bdd037b18eaede86ad0bae
SHA164ccb935ecb1a864ad20c64135d6c543318448c5
SHA256f38449db6a77bbfafb19ffd6dbf1d9eebe0fb2685f907b3ede7b0bb88a1a0257
SHA5121dc8a47efc86d365b7b4a285b85fc6799de18c3ee5170f113e4994c425a8ffad8ec8d743d0a4cdb0195663fff843a4c5e060549ebec86ca69d7edac64794289f
-
Filesize
244KB
MD5bb0d8f54f9bdd037b18eaede86ad0bae
SHA164ccb935ecb1a864ad20c64135d6c543318448c5
SHA256f38449db6a77bbfafb19ffd6dbf1d9eebe0fb2685f907b3ede7b0bb88a1a0257
SHA5121dc8a47efc86d365b7b4a285b85fc6799de18c3ee5170f113e4994c425a8ffad8ec8d743d0a4cdb0195663fff843a4c5e060549ebec86ca69d7edac64794289f
-
Filesize
108KB
MD531c93d154138219c280cf2d5f2fe0626
SHA1c19e88d108ea690dfc9579a274e52a92d92f2981
SHA256c634d567356d1ace82a2ca3610acd41fc7a64e7c631d79f851c57dbbe90bad98
SHA5121776d73a3597d2de877107a0fa4e7a12672ca62b0714d68af46b583f4ea371c081af48a6328bd01cb90cb51bfa45ef29258b2bf9203d0fa87e124fcc0de05843
-
Filesize
108KB
MD531c93d154138219c280cf2d5f2fe0626
SHA1c19e88d108ea690dfc9579a274e52a92d92f2981
SHA256c634d567356d1ace82a2ca3610acd41fc7a64e7c631d79f851c57dbbe90bad98
SHA5121776d73a3597d2de877107a0fa4e7a12672ca62b0714d68af46b583f4ea371c081af48a6328bd01cb90cb51bfa45ef29258b2bf9203d0fa87e124fcc0de05843
-
Filesize
176KB
MD585d46ceb980c50f957b46893af456108
SHA1d3c59caf6486568d9b93f480f26ab2b0fd033c02
SHA2566782aaa4743299fd446dccb5514bde810ec1433fa992bb6619a4e814c0f9308c
SHA512962728fd6a7af608a2aa01c99893434631269151336814b9eb2996ea627e8510347939e8768013944de6524f2c61f466b9993a66dd863ec3729103a2f0272e07
-
Filesize
176KB
MD585d46ceb980c50f957b46893af456108
SHA1d3c59caf6486568d9b93f480f26ab2b0fd033c02
SHA2566782aaa4743299fd446dccb5514bde810ec1433fa992bb6619a4e814c0f9308c
SHA512962728fd6a7af608a2aa01c99893434631269151336814b9eb2996ea627e8510347939e8768013944de6524f2c61f466b9993a66dd863ec3729103a2f0272e07
-
Filesize
176KB
MD585d46ceb980c50f957b46893af456108
SHA1d3c59caf6486568d9b93f480f26ab2b0fd033c02
SHA2566782aaa4743299fd446dccb5514bde810ec1433fa992bb6619a4e814c0f9308c
SHA512962728fd6a7af608a2aa01c99893434631269151336814b9eb2996ea627e8510347939e8768013944de6524f2c61f466b9993a66dd863ec3729103a2f0272e07
-
Filesize
158KB
MD51d7e997260fb68cec4e4f48bb5de55cd
SHA1f904d1a937a6661b27ce795f8c7644da32cd4120
SHA25607bd064fe1a9dc6a9be81c92b722bd9f612fe37f2505c6f0aad034e0b33fa26f
SHA512982390a1179199c5f222a0e47defd17190781162d0fac24c90e72bd579328294cc23f4d64f85bf27bac4d7a32678785c0986ddbe06c18dc84a188437c3c6bea5
-
Filesize
158KB
MD51d7e997260fb68cec4e4f48bb5de55cd
SHA1f904d1a937a6661b27ce795f8c7644da32cd4120
SHA25607bd064fe1a9dc6a9be81c92b722bd9f612fe37f2505c6f0aad034e0b33fa26f
SHA512982390a1179199c5f222a0e47defd17190781162d0fac24c90e72bd579328294cc23f4d64f85bf27bac4d7a32678785c0986ddbe06c18dc84a188437c3c6bea5
-
Filesize
158KB
MD51d7e997260fb68cec4e4f48bb5de55cd
SHA1f904d1a937a6661b27ce795f8c7644da32cd4120
SHA25607bd064fe1a9dc6a9be81c92b722bd9f612fe37f2505c6f0aad034e0b33fa26f
SHA512982390a1179199c5f222a0e47defd17190781162d0fac24c90e72bd579328294cc23f4d64f85bf27bac4d7a32678785c0986ddbe06c18dc84a188437c3c6bea5