Analysis
-
max time kernel
83s -
max time network
35s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system -
submitted
25-11-2022 15:01
Static task
static1
Behavioral task
behavioral1
Sample
3d41cc257b46582ef23a3f79c8efc05ab938f2cb10c32a58861c0a037a7d2df6.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
3d41cc257b46582ef23a3f79c8efc05ab938f2cb10c32a58861c0a037a7d2df6.exe
Resource
win10v2004-20220812-en
General
-
Target
3d41cc257b46582ef23a3f79c8efc05ab938f2cb10c32a58861c0a037a7d2df6.exe
-
Size
561KB
-
MD5
2f4dabe7721b6cf7951c874548ec3a22
-
SHA1
055ae664fe3372bfbdee9cf33eb9ad34971e601a
-
SHA256
3d41cc257b46582ef23a3f79c8efc05ab938f2cb10c32a58861c0a037a7d2df6
-
SHA512
f27612947e4566749ee88b3580ecf3e230aaf37f8232ffdff5e46f4327682ba869e625a735c6e85c00932d64522fddcf6cd4e4e4c2293001890f9a6d7cbfefc0
-
SSDEEP
12288:2PRYzPbfN+/wqXD5bdz5Shk8gWQ/RZWrlKuMofA41uu:rzTfc7pz5R9GhMoozu
Malware Config
Signatures
-
Drops file in Drivers directory 1 IoCs
description ioc Process File created C:\Windows\system32\drivers\nethfdrv.sys 3d41cc257b46582ef23a3f79c8efc05ab938f2cb10c32a58861c0a037a7d2df6.exe -
Executes dropped EXE 5 IoCs
pid Process 1504 installd.exe 1592 nethtsrv.exe 808 netupdsrv.exe 1340 nethtsrv.exe 1580 netupdsrv.exe -
Loads dropped DLL 13 IoCs
pid Process 1724 3d41cc257b46582ef23a3f79c8efc05ab938f2cb10c32a58861c0a037a7d2df6.exe 1724 3d41cc257b46582ef23a3f79c8efc05ab938f2cb10c32a58861c0a037a7d2df6.exe 1724 3d41cc257b46582ef23a3f79c8efc05ab938f2cb10c32a58861c0a037a7d2df6.exe 1724 3d41cc257b46582ef23a3f79c8efc05ab938f2cb10c32a58861c0a037a7d2df6.exe 1504 installd.exe 1724 3d41cc257b46582ef23a3f79c8efc05ab938f2cb10c32a58861c0a037a7d2df6.exe 1592 nethtsrv.exe 1592 nethtsrv.exe 1724 3d41cc257b46582ef23a3f79c8efc05ab938f2cb10c32a58861c0a037a7d2df6.exe 1724 3d41cc257b46582ef23a3f79c8efc05ab938f2cb10c32a58861c0a037a7d2df6.exe 1340 nethtsrv.exe 1340 nethtsrv.exe 1724 3d41cc257b46582ef23a3f79c8efc05ab938f2cb10c32a58861c0a037a7d2df6.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops file in System32 directory 5 IoCs
description ioc Process File created C:\Windows\SysWOW64\hfpapi.dll 3d41cc257b46582ef23a3f79c8efc05ab938f2cb10c32a58861c0a037a7d2df6.exe File created C:\Windows\SysWOW64\installd.exe 3d41cc257b46582ef23a3f79c8efc05ab938f2cb10c32a58861c0a037a7d2df6.exe File created C:\Windows\SysWOW64\nethtsrv.exe 3d41cc257b46582ef23a3f79c8efc05ab938f2cb10c32a58861c0a037a7d2df6.exe File created C:\Windows\SysWOW64\netupdsrv.exe 3d41cc257b46582ef23a3f79c8efc05ab938f2cb10c32a58861c0a037a7d2df6.exe File created C:\Windows\SysWOW64\hfnapi.dll 3d41cc257b46582ef23a3f79c8efc05ab938f2cb10c32a58861c0a037a7d2df6.exe -
Drops file in Program Files directory 3 IoCs
description ioc Process File created C:\Program Files (x86)\Common Files\Config\data.xml 3d41cc257b46582ef23a3f79c8efc05ab938f2cb10c32a58861c0a037a7d2df6.exe File created C:\Program Files (x86)\Common Files\Config\ver.xml 3d41cc257b46582ef23a3f79c8efc05ab938f2cb10c32a58861c0a037a7d2df6.exe File created C:\Program Files (x86)\Common Files\config\uninstinethnfd.exe 3d41cc257b46582ef23a3f79c8efc05ab938f2cb10c32a58861c0a037a7d2df6.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Runs net.exe
-
Suspicious behavior: LoadsDriver 1 IoCs
pid Process 468 Process not Found -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 1340 nethtsrv.exe -
Suspicious use of WriteProcessMemory 50 IoCs
description pid Process procid_target PID 1724 wrote to memory of 1264 1724 3d41cc257b46582ef23a3f79c8efc05ab938f2cb10c32a58861c0a037a7d2df6.exe 28 PID 1724 wrote to memory of 1264 1724 3d41cc257b46582ef23a3f79c8efc05ab938f2cb10c32a58861c0a037a7d2df6.exe 28 PID 1724 wrote to memory of 1264 1724 3d41cc257b46582ef23a3f79c8efc05ab938f2cb10c32a58861c0a037a7d2df6.exe 28 PID 1724 wrote to memory of 1264 1724 3d41cc257b46582ef23a3f79c8efc05ab938f2cb10c32a58861c0a037a7d2df6.exe 28 PID 1264 wrote to memory of 1300 1264 net.exe 30 PID 1264 wrote to memory of 1300 1264 net.exe 30 PID 1264 wrote to memory of 1300 1264 net.exe 30 PID 1264 wrote to memory of 1300 1264 net.exe 30 PID 1724 wrote to memory of 380 1724 3d41cc257b46582ef23a3f79c8efc05ab938f2cb10c32a58861c0a037a7d2df6.exe 31 PID 1724 wrote to memory of 380 1724 3d41cc257b46582ef23a3f79c8efc05ab938f2cb10c32a58861c0a037a7d2df6.exe 31 PID 1724 wrote to memory of 380 1724 3d41cc257b46582ef23a3f79c8efc05ab938f2cb10c32a58861c0a037a7d2df6.exe 31 PID 1724 wrote to memory of 380 1724 3d41cc257b46582ef23a3f79c8efc05ab938f2cb10c32a58861c0a037a7d2df6.exe 31 PID 380 wrote to memory of 520 380 net.exe 33 PID 380 wrote to memory of 520 380 net.exe 33 PID 380 wrote to memory of 520 380 net.exe 33 PID 380 wrote to memory of 520 380 net.exe 33 PID 1724 wrote to memory of 1504 1724 3d41cc257b46582ef23a3f79c8efc05ab938f2cb10c32a58861c0a037a7d2df6.exe 34 PID 1724 wrote to memory of 1504 1724 3d41cc257b46582ef23a3f79c8efc05ab938f2cb10c32a58861c0a037a7d2df6.exe 34 PID 1724 wrote to memory of 1504 1724 3d41cc257b46582ef23a3f79c8efc05ab938f2cb10c32a58861c0a037a7d2df6.exe 34 PID 1724 wrote to memory of 1504 1724 3d41cc257b46582ef23a3f79c8efc05ab938f2cb10c32a58861c0a037a7d2df6.exe 34 PID 1724 wrote to memory of 1504 1724 3d41cc257b46582ef23a3f79c8efc05ab938f2cb10c32a58861c0a037a7d2df6.exe 34 PID 1724 wrote to memory of 1504 1724 3d41cc257b46582ef23a3f79c8efc05ab938f2cb10c32a58861c0a037a7d2df6.exe 34 PID 1724 wrote to memory of 1504 1724 3d41cc257b46582ef23a3f79c8efc05ab938f2cb10c32a58861c0a037a7d2df6.exe 34 PID 1724 wrote to memory of 1592 1724 3d41cc257b46582ef23a3f79c8efc05ab938f2cb10c32a58861c0a037a7d2df6.exe 36 PID 1724 wrote to memory of 1592 1724 3d41cc257b46582ef23a3f79c8efc05ab938f2cb10c32a58861c0a037a7d2df6.exe 36 PID 1724 wrote to memory of 1592 1724 3d41cc257b46582ef23a3f79c8efc05ab938f2cb10c32a58861c0a037a7d2df6.exe 36 PID 1724 wrote to memory of 1592 1724 3d41cc257b46582ef23a3f79c8efc05ab938f2cb10c32a58861c0a037a7d2df6.exe 36 PID 1724 wrote to memory of 808 1724 3d41cc257b46582ef23a3f79c8efc05ab938f2cb10c32a58861c0a037a7d2df6.exe 38 PID 1724 wrote to memory of 808 1724 3d41cc257b46582ef23a3f79c8efc05ab938f2cb10c32a58861c0a037a7d2df6.exe 38 PID 1724 wrote to memory of 808 1724 3d41cc257b46582ef23a3f79c8efc05ab938f2cb10c32a58861c0a037a7d2df6.exe 38 PID 1724 wrote to memory of 808 1724 3d41cc257b46582ef23a3f79c8efc05ab938f2cb10c32a58861c0a037a7d2df6.exe 38 PID 1724 wrote to memory of 808 1724 3d41cc257b46582ef23a3f79c8efc05ab938f2cb10c32a58861c0a037a7d2df6.exe 38 PID 1724 wrote to memory of 808 1724 3d41cc257b46582ef23a3f79c8efc05ab938f2cb10c32a58861c0a037a7d2df6.exe 38 PID 1724 wrote to memory of 808 1724 3d41cc257b46582ef23a3f79c8efc05ab938f2cb10c32a58861c0a037a7d2df6.exe 38 PID 1724 wrote to memory of 828 1724 3d41cc257b46582ef23a3f79c8efc05ab938f2cb10c32a58861c0a037a7d2df6.exe 40 PID 1724 wrote to memory of 828 1724 3d41cc257b46582ef23a3f79c8efc05ab938f2cb10c32a58861c0a037a7d2df6.exe 40 PID 1724 wrote to memory of 828 1724 3d41cc257b46582ef23a3f79c8efc05ab938f2cb10c32a58861c0a037a7d2df6.exe 40 PID 1724 wrote to memory of 828 1724 3d41cc257b46582ef23a3f79c8efc05ab938f2cb10c32a58861c0a037a7d2df6.exe 40 PID 828 wrote to memory of 932 828 net.exe 42 PID 828 wrote to memory of 932 828 net.exe 42 PID 828 wrote to memory of 932 828 net.exe 42 PID 828 wrote to memory of 932 828 net.exe 42 PID 1724 wrote to memory of 1808 1724 3d41cc257b46582ef23a3f79c8efc05ab938f2cb10c32a58861c0a037a7d2df6.exe 44 PID 1724 wrote to memory of 1808 1724 3d41cc257b46582ef23a3f79c8efc05ab938f2cb10c32a58861c0a037a7d2df6.exe 44 PID 1724 wrote to memory of 1808 1724 3d41cc257b46582ef23a3f79c8efc05ab938f2cb10c32a58861c0a037a7d2df6.exe 44 PID 1724 wrote to memory of 1808 1724 3d41cc257b46582ef23a3f79c8efc05ab938f2cb10c32a58861c0a037a7d2df6.exe 44 PID 1808 wrote to memory of 552 1808 net.exe 46 PID 1808 wrote to memory of 552 1808 net.exe 46 PID 1808 wrote to memory of 552 1808 net.exe 46 PID 1808 wrote to memory of 552 1808 net.exe 46
Processes
-
C:\Users\Admin\AppData\Local\Temp\3d41cc257b46582ef23a3f79c8efc05ab938f2cb10c32a58861c0a037a7d2df6.exe"C:\Users\Admin\AppData\Local\Temp\3d41cc257b46582ef23a3f79c8efc05ab938f2cb10c32a58861c0a037a7d2df6.exe"1⤵
- Drops file in Drivers directory
- Loads dropped DLL
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:1724 -
C:\Windows\SysWOW64\net.exenet stop nethttpservice2⤵
- Suspicious use of WriteProcessMemory
PID:1264 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop nethttpservice3⤵PID:1300
-
-
-
C:\Windows\SysWOW64\net.exenet stop serviceupdater2⤵
- Suspicious use of WriteProcessMemory
PID:380 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop serviceupdater3⤵PID:520
-
-
-
C:\Windows\SysWOW64\installd.exe"C:\Windows\system32\installd.exe" nethfdrv2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1504
-
-
C:\Windows\SysWOW64\nethtsrv.exe"C:\Windows\system32\nethtsrv.exe" -nfdi2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1592
-
-
C:\Windows\SysWOW64\netupdsrv.exe"C:\Windows\system32\netupdsrv.exe" -nfdi2⤵
- Executes dropped EXE
PID:808
-
-
C:\Windows\SysWOW64\net.exenet start nethttpservice2⤵
- Suspicious use of WriteProcessMemory
PID:828 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 start nethttpservice3⤵PID:932
-
-
-
C:\Windows\SysWOW64\net.exenet start serviceupdater2⤵
- Suspicious use of WriteProcessMemory
PID:1808 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 start serviceupdater3⤵PID:552
-
-
-
C:\Windows\SysWOW64\nethtsrv.exeC:\Windows\SysWOW64\nethtsrv.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:1340
-
C:\Windows\SysWOW64\netupdsrv.exeC:\Windows\SysWOW64\netupdsrv.exe1⤵
- Executes dropped EXE
PID:1580
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
106KB
MD5016112d23abad94e3cd24f336802fcdb
SHA15a7268980ec15356808a05dbe6679e33e96597bb
SHA256ec55434d96a65b6aab3b6d2f622dd64cf0f54a45728657e8968c26c0d33f95bd
SHA5126d715b21cb9c82614616d6530d93c37c603ee2b8db17c8437b50bebe2f02b21ea30e3a39c195ab5a5304c0185346236641b3efbffaba57b5138697464a22434b
-
Filesize
241KB
MD5e7f94c1531314962355d0a5e19e0f161
SHA1ea39975832f81cc70bd2eaee8b0c534de07298a8
SHA256e4592e5399003a4926c6c0964398a948fed2bbf106494ebfd4ab090c9bda45a9
SHA512e59446f03ba9bddf75beac62ff9c61e422ded397ce4b355ac9bb40ffedb0758cd9429eaf12d020698a4035b9a55c2243a5597bfa102dde94cf68ce085eb13a16
-
Filesize
108KB
MD5c0d4ee15fc237c950beacbb28e7a024d
SHA1c084ad7f1b78f83b918eddeb1a2ebdcd7d802a06
SHA256d65e8bf723f0673ecc65c60d73218b8c1a86b826895f64c6a85c7a218ffc9b0b
SHA51275befa04ce6f8b73d8b92cba428e76107a88c7675244efbe4871e5d06124337d3ad387d74004c27f319e5d1e13091d709fc1095c51dc39f90c229efd7dc13b34
-
Filesize
176KB
MD56822c7d77d0059116bd5523a7b561cdb
SHA1e6c967b160de9d0928fb253995b6b7d449f8ce1e
SHA256b407d94bc75780dd6e0112d22788eae66d10e8ccd261ad1ebf4e9e5a4d736655
SHA512e38fee6deccf393308c22ba8be59fb96934a9dbbe4e91325c3da75ed893e8f4e28f942ccd76bc078b8107c1de2388859be49b974b0ae6f84205be3865fc582f7
-
Filesize
176KB
MD56822c7d77d0059116bd5523a7b561cdb
SHA1e6c967b160de9d0928fb253995b6b7d449f8ce1e
SHA256b407d94bc75780dd6e0112d22788eae66d10e8ccd261ad1ebf4e9e5a4d736655
SHA512e38fee6deccf393308c22ba8be59fb96934a9dbbe4e91325c3da75ed893e8f4e28f942ccd76bc078b8107c1de2388859be49b974b0ae6f84205be3865fc582f7
-
Filesize
158KB
MD5baa46ef4998d631a935fcc6bb782a9f9
SHA18ba5630e3edb34771102e7dff30254e6b43e3f46
SHA2561eef3d805fd8cb8fafaa443fb826a906e4f69797834c75011b3e7d273501b261
SHA512428db65275c60dd4924f4aa521f469e338c0860083e8c3229bdff4dc68ddcf2f636ce4aa4c345fdaa052bfe6558eded7ec7c196f6dd5fc8a601fb6547ae643c6
-
Filesize
158KB
MD5baa46ef4998d631a935fcc6bb782a9f9
SHA18ba5630e3edb34771102e7dff30254e6b43e3f46
SHA2561eef3d805fd8cb8fafaa443fb826a906e4f69797834c75011b3e7d273501b261
SHA512428db65275c60dd4924f4aa521f469e338c0860083e8c3229bdff4dc68ddcf2f636ce4aa4c345fdaa052bfe6558eded7ec7c196f6dd5fc8a601fb6547ae643c6
-
Filesize
11KB
MD5c17103ae9072a06da581dec998343fc1
SHA1b72148c6bdfaada8b8c3f950e610ee7cf1da1f8d
SHA256dc58d8ad81cacb0c1ed72e33bff8f23ea40b5252b5bb55d393a0903e6819ae2f
SHA512d32a71aaef18e993f28096d536e41c4d016850721b31171513ce28bbd805a54fd290b7c3e9d935f72e676a1acfb4f0dcc89d95040a0dd29f2b6975855c18986f
-
Filesize
6KB
MD5acc2b699edfea5bf5aae45aba3a41e96
SHA1d2accf4d494e43ceb2cff69abe4dd17147d29cc2
SHA256168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e
SHA512e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe
-
Filesize
6KB
MD5acc2b699edfea5bf5aae45aba3a41e96
SHA1d2accf4d494e43ceb2cff69abe4dd17147d29cc2
SHA256168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e
SHA512e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe
-
Filesize
6KB
MD5acc2b699edfea5bf5aae45aba3a41e96
SHA1d2accf4d494e43ceb2cff69abe4dd17147d29cc2
SHA256168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e
SHA512e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe
-
Filesize
6KB
MD5acc2b699edfea5bf5aae45aba3a41e96
SHA1d2accf4d494e43ceb2cff69abe4dd17147d29cc2
SHA256168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e
SHA512e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe
-
Filesize
106KB
MD5016112d23abad94e3cd24f336802fcdb
SHA15a7268980ec15356808a05dbe6679e33e96597bb
SHA256ec55434d96a65b6aab3b6d2f622dd64cf0f54a45728657e8968c26c0d33f95bd
SHA5126d715b21cb9c82614616d6530d93c37c603ee2b8db17c8437b50bebe2f02b21ea30e3a39c195ab5a5304c0185346236641b3efbffaba57b5138697464a22434b
-
Filesize
106KB
MD5016112d23abad94e3cd24f336802fcdb
SHA15a7268980ec15356808a05dbe6679e33e96597bb
SHA256ec55434d96a65b6aab3b6d2f622dd64cf0f54a45728657e8968c26c0d33f95bd
SHA5126d715b21cb9c82614616d6530d93c37c603ee2b8db17c8437b50bebe2f02b21ea30e3a39c195ab5a5304c0185346236641b3efbffaba57b5138697464a22434b
-
Filesize
106KB
MD5016112d23abad94e3cd24f336802fcdb
SHA15a7268980ec15356808a05dbe6679e33e96597bb
SHA256ec55434d96a65b6aab3b6d2f622dd64cf0f54a45728657e8968c26c0d33f95bd
SHA5126d715b21cb9c82614616d6530d93c37c603ee2b8db17c8437b50bebe2f02b21ea30e3a39c195ab5a5304c0185346236641b3efbffaba57b5138697464a22434b
-
Filesize
241KB
MD5e7f94c1531314962355d0a5e19e0f161
SHA1ea39975832f81cc70bd2eaee8b0c534de07298a8
SHA256e4592e5399003a4926c6c0964398a948fed2bbf106494ebfd4ab090c9bda45a9
SHA512e59446f03ba9bddf75beac62ff9c61e422ded397ce4b355ac9bb40ffedb0758cd9429eaf12d020698a4035b9a55c2243a5597bfa102dde94cf68ce085eb13a16
-
Filesize
241KB
MD5e7f94c1531314962355d0a5e19e0f161
SHA1ea39975832f81cc70bd2eaee8b0c534de07298a8
SHA256e4592e5399003a4926c6c0964398a948fed2bbf106494ebfd4ab090c9bda45a9
SHA512e59446f03ba9bddf75beac62ff9c61e422ded397ce4b355ac9bb40ffedb0758cd9429eaf12d020698a4035b9a55c2243a5597bfa102dde94cf68ce085eb13a16
-
Filesize
108KB
MD5c0d4ee15fc237c950beacbb28e7a024d
SHA1c084ad7f1b78f83b918eddeb1a2ebdcd7d802a06
SHA256d65e8bf723f0673ecc65c60d73218b8c1a86b826895f64c6a85c7a218ffc9b0b
SHA51275befa04ce6f8b73d8b92cba428e76107a88c7675244efbe4871e5d06124337d3ad387d74004c27f319e5d1e13091d709fc1095c51dc39f90c229efd7dc13b34
-
Filesize
176KB
MD56822c7d77d0059116bd5523a7b561cdb
SHA1e6c967b160de9d0928fb253995b6b7d449f8ce1e
SHA256b407d94bc75780dd6e0112d22788eae66d10e8ccd261ad1ebf4e9e5a4d736655
SHA512e38fee6deccf393308c22ba8be59fb96934a9dbbe4e91325c3da75ed893e8f4e28f942ccd76bc078b8107c1de2388859be49b974b0ae6f84205be3865fc582f7
-
Filesize
158KB
MD5baa46ef4998d631a935fcc6bb782a9f9
SHA18ba5630e3edb34771102e7dff30254e6b43e3f46
SHA2561eef3d805fd8cb8fafaa443fb826a906e4f69797834c75011b3e7d273501b261
SHA512428db65275c60dd4924f4aa521f469e338c0860083e8c3229bdff4dc68ddcf2f636ce4aa4c345fdaa052bfe6558eded7ec7c196f6dd5fc8a601fb6547ae643c6