Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
252s -
max time network
300s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system -
submitted
28/11/2022, 00:38
Static task
static1
Behavioral task
behavioral1
Sample
12806ab9fcc01de964b342adaec36ec072d0b84b9552865dd4ffdaa5c4d1b432.exe
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
12806ab9fcc01de964b342adaec36ec072d0b84b9552865dd4ffdaa5c4d1b432.exe
Resource
win10v2004-20221111-en
General
-
Target
12806ab9fcc01de964b342adaec36ec072d0b84b9552865dd4ffdaa5c4d1b432.exe
-
Size
832KB
-
MD5
daf835f67daae088cfb0d6428343640b
-
SHA1
9f102918c41122ff3c5adc8c77d8eb3abe44dd81
-
SHA256
12806ab9fcc01de964b342adaec36ec072d0b84b9552865dd4ffdaa5c4d1b432
-
SHA512
40ab8c197a0d187286744109e26c75558bc30418614e0623a9c6ae66f9a03652187fb89a1c394c99259fc29ed8a80a22fa90e54768262fae5d0c69c0af7aa697
-
SSDEEP
24576:/rfGR2wDeRMTz2vTnlv1cdjWdJEnZL98t4+yH1x9xfon:/YYRMTOTnD1rEnZLmt4j1xIn
Malware Config
Signatures
-
Drops file in Drivers directory 1 IoCs
description ioc Process File created C:\Windows\system32\drivers\nethfdrv.sys 12806ab9fcc01de964b342adaec36ec072d0b84b9552865dd4ffdaa5c4d1b432.exe -
Executes dropped EXE 5 IoCs
pid Process 4992 installd.exe 2548 nethtsrv.exe 440 netupdsrv.exe 2644 nethtsrv.exe 3116 netupdsrv.exe -
Loads dropped DLL 14 IoCs
pid Process 2092 12806ab9fcc01de964b342adaec36ec072d0b84b9552865dd4ffdaa5c4d1b432.exe 2092 12806ab9fcc01de964b342adaec36ec072d0b84b9552865dd4ffdaa5c4d1b432.exe 2092 12806ab9fcc01de964b342adaec36ec072d0b84b9552865dd4ffdaa5c4d1b432.exe 2092 12806ab9fcc01de964b342adaec36ec072d0b84b9552865dd4ffdaa5c4d1b432.exe 2092 12806ab9fcc01de964b342adaec36ec072d0b84b9552865dd4ffdaa5c4d1b432.exe 4992 installd.exe 2548 nethtsrv.exe 2548 nethtsrv.exe 2092 12806ab9fcc01de964b342adaec36ec072d0b84b9552865dd4ffdaa5c4d1b432.exe 2092 12806ab9fcc01de964b342adaec36ec072d0b84b9552865dd4ffdaa5c4d1b432.exe 2644 nethtsrv.exe 2644 nethtsrv.exe 2092 12806ab9fcc01de964b342adaec36ec072d0b84b9552865dd4ffdaa5c4d1b432.exe 2092 12806ab9fcc01de964b342adaec36ec072d0b84b9552865dd4ffdaa5c4d1b432.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops file in System32 directory 5 IoCs
description ioc Process File created C:\Windows\SysWOW64\netupdsrv.exe 12806ab9fcc01de964b342adaec36ec072d0b84b9552865dd4ffdaa5c4d1b432.exe File created C:\Windows\SysWOW64\hfnapi.dll 12806ab9fcc01de964b342adaec36ec072d0b84b9552865dd4ffdaa5c4d1b432.exe File created C:\Windows\SysWOW64\hfpapi.dll 12806ab9fcc01de964b342adaec36ec072d0b84b9552865dd4ffdaa5c4d1b432.exe File created C:\Windows\SysWOW64\installd.exe 12806ab9fcc01de964b342adaec36ec072d0b84b9552865dd4ffdaa5c4d1b432.exe File created C:\Windows\SysWOW64\nethtsrv.exe 12806ab9fcc01de964b342adaec36ec072d0b84b9552865dd4ffdaa5c4d1b432.exe -
Drops file in Program Files directory 3 IoCs
description ioc Process File created C:\Program Files (x86)\Common Files\Config\data.xml 12806ab9fcc01de964b342adaec36ec072d0b84b9552865dd4ffdaa5c4d1b432.exe File created C:\Program Files (x86)\Common Files\Config\ver.xml 12806ab9fcc01de964b342adaec36ec072d0b84b9552865dd4ffdaa5c4d1b432.exe File created C:\Program Files (x86)\Common Files\config\uninstinethnfd.exe 12806ab9fcc01de964b342adaec36ec072d0b84b9552865dd4ffdaa5c4d1b432.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Modifies data under HKEY_USERS 1 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections nethtsrv.exe -
Runs net.exe
-
Suspicious behavior: LoadsDriver 1 IoCs
pid Process 648 Process not Found -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 2644 nethtsrv.exe -
Suspicious use of WriteProcessMemory 33 IoCs
description pid Process procid_target PID 2092 wrote to memory of 4380 2092 12806ab9fcc01de964b342adaec36ec072d0b84b9552865dd4ffdaa5c4d1b432.exe 81 PID 2092 wrote to memory of 4380 2092 12806ab9fcc01de964b342adaec36ec072d0b84b9552865dd4ffdaa5c4d1b432.exe 81 PID 2092 wrote to memory of 4380 2092 12806ab9fcc01de964b342adaec36ec072d0b84b9552865dd4ffdaa5c4d1b432.exe 81 PID 4380 wrote to memory of 3524 4380 net.exe 83 PID 4380 wrote to memory of 3524 4380 net.exe 83 PID 4380 wrote to memory of 3524 4380 net.exe 83 PID 2092 wrote to memory of 848 2092 12806ab9fcc01de964b342adaec36ec072d0b84b9552865dd4ffdaa5c4d1b432.exe 84 PID 2092 wrote to memory of 848 2092 12806ab9fcc01de964b342adaec36ec072d0b84b9552865dd4ffdaa5c4d1b432.exe 84 PID 2092 wrote to memory of 848 2092 12806ab9fcc01de964b342adaec36ec072d0b84b9552865dd4ffdaa5c4d1b432.exe 84 PID 848 wrote to memory of 3604 848 net.exe 86 PID 848 wrote to memory of 3604 848 net.exe 86 PID 848 wrote to memory of 3604 848 net.exe 86 PID 2092 wrote to memory of 4992 2092 12806ab9fcc01de964b342adaec36ec072d0b84b9552865dd4ffdaa5c4d1b432.exe 87 PID 2092 wrote to memory of 4992 2092 12806ab9fcc01de964b342adaec36ec072d0b84b9552865dd4ffdaa5c4d1b432.exe 87 PID 2092 wrote to memory of 4992 2092 12806ab9fcc01de964b342adaec36ec072d0b84b9552865dd4ffdaa5c4d1b432.exe 87 PID 2092 wrote to memory of 2548 2092 12806ab9fcc01de964b342adaec36ec072d0b84b9552865dd4ffdaa5c4d1b432.exe 88 PID 2092 wrote to memory of 2548 2092 12806ab9fcc01de964b342adaec36ec072d0b84b9552865dd4ffdaa5c4d1b432.exe 88 PID 2092 wrote to memory of 2548 2092 12806ab9fcc01de964b342adaec36ec072d0b84b9552865dd4ffdaa5c4d1b432.exe 88 PID 2092 wrote to memory of 440 2092 12806ab9fcc01de964b342adaec36ec072d0b84b9552865dd4ffdaa5c4d1b432.exe 90 PID 2092 wrote to memory of 440 2092 12806ab9fcc01de964b342adaec36ec072d0b84b9552865dd4ffdaa5c4d1b432.exe 90 PID 2092 wrote to memory of 440 2092 12806ab9fcc01de964b342adaec36ec072d0b84b9552865dd4ffdaa5c4d1b432.exe 90 PID 2092 wrote to memory of 2068 2092 12806ab9fcc01de964b342adaec36ec072d0b84b9552865dd4ffdaa5c4d1b432.exe 92 PID 2092 wrote to memory of 2068 2092 12806ab9fcc01de964b342adaec36ec072d0b84b9552865dd4ffdaa5c4d1b432.exe 92 PID 2092 wrote to memory of 2068 2092 12806ab9fcc01de964b342adaec36ec072d0b84b9552865dd4ffdaa5c4d1b432.exe 92 PID 2068 wrote to memory of 2820 2068 net.exe 94 PID 2068 wrote to memory of 2820 2068 net.exe 94 PID 2068 wrote to memory of 2820 2068 net.exe 94 PID 2092 wrote to memory of 2008 2092 12806ab9fcc01de964b342adaec36ec072d0b84b9552865dd4ffdaa5c4d1b432.exe 96 PID 2092 wrote to memory of 2008 2092 12806ab9fcc01de964b342adaec36ec072d0b84b9552865dd4ffdaa5c4d1b432.exe 96 PID 2092 wrote to memory of 2008 2092 12806ab9fcc01de964b342adaec36ec072d0b84b9552865dd4ffdaa5c4d1b432.exe 96 PID 2008 wrote to memory of 3052 2008 net.exe 98 PID 2008 wrote to memory of 3052 2008 net.exe 98 PID 2008 wrote to memory of 3052 2008 net.exe 98
Processes
-
C:\Users\Admin\AppData\Local\Temp\12806ab9fcc01de964b342adaec36ec072d0b84b9552865dd4ffdaa5c4d1b432.exe"C:\Users\Admin\AppData\Local\Temp\12806ab9fcc01de964b342adaec36ec072d0b84b9552865dd4ffdaa5c4d1b432.exe"1⤵
- Drops file in Drivers directory
- Loads dropped DLL
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:2092 -
C:\Windows\SysWOW64\net.exenet stop nethttpservice2⤵
- Suspicious use of WriteProcessMemory
PID:4380 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop nethttpservice3⤵PID:3524
-
-
-
C:\Windows\SysWOW64\net.exenet stop serviceupdater2⤵
- Suspicious use of WriteProcessMemory
PID:848 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop serviceupdater3⤵PID:3604
-
-
-
C:\Windows\SysWOW64\installd.exe"C:\Windows\system32\installd.exe" nethfdrv2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:4992
-
-
C:\Windows\SysWOW64\nethtsrv.exe"C:\Windows\system32\nethtsrv.exe" -nfdi2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2548
-
-
C:\Windows\SysWOW64\netupdsrv.exe"C:\Windows\system32\netupdsrv.exe" -nfdi2⤵
- Executes dropped EXE
PID:440
-
-
C:\Windows\SysWOW64\net.exenet start nethttpservice2⤵
- Suspicious use of WriteProcessMemory
PID:2068 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 start nethttpservice3⤵PID:2820
-
-
-
C:\Windows\SysWOW64\net.exenet start serviceupdater2⤵
- Suspicious use of WriteProcessMemory
PID:2008 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 start serviceupdater3⤵PID:3052
-
-
-
C:\Windows\SysWOW64\nethtsrv.exeC:\Windows\SysWOW64\nethtsrv.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:2644
-
C:\Windows\SysWOW64\netupdsrv.exeC:\Windows\SysWOW64\netupdsrv.exe1⤵
- Executes dropped EXE
PID:3116
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
11KB
MD5c17103ae9072a06da581dec998343fc1
SHA1b72148c6bdfaada8b8c3f950e610ee7cf1da1f8d
SHA256dc58d8ad81cacb0c1ed72e33bff8f23ea40b5252b5bb55d393a0903e6819ae2f
SHA512d32a71aaef18e993f28096d536e41c4d016850721b31171513ce28bbd805a54fd290b7c3e9d935f72e676a1acfb4f0dcc89d95040a0dd29f2b6975855c18986f
-
Filesize
6KB
MD5acc2b699edfea5bf5aae45aba3a41e96
SHA1d2accf4d494e43ceb2cff69abe4dd17147d29cc2
SHA256168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e
SHA512e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe
-
Filesize
6KB
MD5acc2b699edfea5bf5aae45aba3a41e96
SHA1d2accf4d494e43ceb2cff69abe4dd17147d29cc2
SHA256168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e
SHA512e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe
-
Filesize
6KB
MD5acc2b699edfea5bf5aae45aba3a41e96
SHA1d2accf4d494e43ceb2cff69abe4dd17147d29cc2
SHA256168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e
SHA512e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe
-
Filesize
6KB
MD5acc2b699edfea5bf5aae45aba3a41e96
SHA1d2accf4d494e43ceb2cff69abe4dd17147d29cc2
SHA256168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e
SHA512e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe
-
Filesize
6KB
MD5acc2b699edfea5bf5aae45aba3a41e96
SHA1d2accf4d494e43ceb2cff69abe4dd17147d29cc2
SHA256168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e
SHA512e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe
-
Filesize
6KB
MD5acc2b699edfea5bf5aae45aba3a41e96
SHA1d2accf4d494e43ceb2cff69abe4dd17147d29cc2
SHA256168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e
SHA512e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe
-
Filesize
6KB
MD5acc2b699edfea5bf5aae45aba3a41e96
SHA1d2accf4d494e43ceb2cff69abe4dd17147d29cc2
SHA256168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e
SHA512e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe
-
Filesize
6KB
MD5acc2b699edfea5bf5aae45aba3a41e96
SHA1d2accf4d494e43ceb2cff69abe4dd17147d29cc2
SHA256168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e
SHA512e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe
-
Filesize
106KB
MD594d45326feea4e32ac216f7a4e1ad323
SHA1be54e0b08007104bbe309b0d0d5c225732850173
SHA25657a7ca884205db08b70916ed7963df426b77cfc15fb1c646c30498be4db0f408
SHA51255190631def963cc19de8bce5abef7cd3ecd67167da82aab965a81a9e768ab3adc2ad5d12a2d4478671afcdade9592d71701bdba53f2fbe7964de7612531e4c8
-
Filesize
106KB
MD594d45326feea4e32ac216f7a4e1ad323
SHA1be54e0b08007104bbe309b0d0d5c225732850173
SHA25657a7ca884205db08b70916ed7963df426b77cfc15fb1c646c30498be4db0f408
SHA51255190631def963cc19de8bce5abef7cd3ecd67167da82aab965a81a9e768ab3adc2ad5d12a2d4478671afcdade9592d71701bdba53f2fbe7964de7612531e4c8
-
Filesize
106KB
MD594d45326feea4e32ac216f7a4e1ad323
SHA1be54e0b08007104bbe309b0d0d5c225732850173
SHA25657a7ca884205db08b70916ed7963df426b77cfc15fb1c646c30498be4db0f408
SHA51255190631def963cc19de8bce5abef7cd3ecd67167da82aab965a81a9e768ab3adc2ad5d12a2d4478671afcdade9592d71701bdba53f2fbe7964de7612531e4c8
-
Filesize
106KB
MD594d45326feea4e32ac216f7a4e1ad323
SHA1be54e0b08007104bbe309b0d0d5c225732850173
SHA25657a7ca884205db08b70916ed7963df426b77cfc15fb1c646c30498be4db0f408
SHA51255190631def963cc19de8bce5abef7cd3ecd67167da82aab965a81a9e768ab3adc2ad5d12a2d4478671afcdade9592d71701bdba53f2fbe7964de7612531e4c8
-
Filesize
428KB
MD5091e8037fc5ff69df86a81146ddfe949
SHA10a86dcbb85fa6ec739f3c58236dfed08b50960fb
SHA256dbdb4fd5fd5e5e3310865109bd8abd13423cb5a8343042b2ef9ec4f08c356811
SHA5121559e1fd85e0dd00e9f9026673cd061e1708909dc4d07ae61b1a9150997d7aa582b91fc6b46e54deeb3f28215e02fa182b2b5c61b395803796431b96b428cc96
-
Filesize
428KB
MD5091e8037fc5ff69df86a81146ddfe949
SHA10a86dcbb85fa6ec739f3c58236dfed08b50960fb
SHA256dbdb4fd5fd5e5e3310865109bd8abd13423cb5a8343042b2ef9ec4f08c356811
SHA5121559e1fd85e0dd00e9f9026673cd061e1708909dc4d07ae61b1a9150997d7aa582b91fc6b46e54deeb3f28215e02fa182b2b5c61b395803796431b96b428cc96
-
Filesize
428KB
MD5091e8037fc5ff69df86a81146ddfe949
SHA10a86dcbb85fa6ec739f3c58236dfed08b50960fb
SHA256dbdb4fd5fd5e5e3310865109bd8abd13423cb5a8343042b2ef9ec4f08c356811
SHA5121559e1fd85e0dd00e9f9026673cd061e1708909dc4d07ae61b1a9150997d7aa582b91fc6b46e54deeb3f28215e02fa182b2b5c61b395803796431b96b428cc96
-
Filesize
137KB
MD564851970d2e595422057d88281c95a90
SHA1a06066ea32401ce72c3074cd29c2f1d84129db06
SHA256186db0f73ad08f3472a38ba6724d170f3474296e9faf813ed932842d42ba01ae
SHA512319d864cb494f883609ac16e6f27eb0f9a98106fa3746be0fd1f17b7678201f1e3e17c758fc866d6de4bfa10a122b784e8c0e7eabe3225f888779942f822de74
-
Filesize
137KB
MD564851970d2e595422057d88281c95a90
SHA1a06066ea32401ce72c3074cd29c2f1d84129db06
SHA256186db0f73ad08f3472a38ba6724d170f3474296e9faf813ed932842d42ba01ae
SHA512319d864cb494f883609ac16e6f27eb0f9a98106fa3746be0fd1f17b7678201f1e3e17c758fc866d6de4bfa10a122b784e8c0e7eabe3225f888779942f822de74
-
Filesize
331KB
MD57b7f538db19805809169994e7b5f7c35
SHA147d52eedd53aee5d2057d568296cf7ef057eeed1
SHA25674ad74279e176033028e27e94bf7b1e75e05c51af35563ad7c943b7ba79af8f3
SHA512eb67c5bb140a9f19a000c5831bc2ac0591c98b3bfcbfa3a75ec3fe56b4d12052b0c9c7516ed4c3372e2b238baf71640fb8d4206eff4ed14fa4cffb797928388d
-
Filesize
331KB
MD57b7f538db19805809169994e7b5f7c35
SHA147d52eedd53aee5d2057d568296cf7ef057eeed1
SHA25674ad74279e176033028e27e94bf7b1e75e05c51af35563ad7c943b7ba79af8f3
SHA512eb67c5bb140a9f19a000c5831bc2ac0591c98b3bfcbfa3a75ec3fe56b4d12052b0c9c7516ed4c3372e2b238baf71640fb8d4206eff4ed14fa4cffb797928388d
-
Filesize
331KB
MD57b7f538db19805809169994e7b5f7c35
SHA147d52eedd53aee5d2057d568296cf7ef057eeed1
SHA25674ad74279e176033028e27e94bf7b1e75e05c51af35563ad7c943b7ba79af8f3
SHA512eb67c5bb140a9f19a000c5831bc2ac0591c98b3bfcbfa3a75ec3fe56b4d12052b0c9c7516ed4c3372e2b238baf71640fb8d4206eff4ed14fa4cffb797928388d
-
Filesize
186KB
MD5442b11ff8cfb9193c84f09fba3dfd9fe
SHA1277a28b5adee790b4f9291775d3376da31f42c3e
SHA256434a7f5c3e0c43aaf2198d7bc8ff697e497c45f9e7491def69c702b31a679c7d
SHA512c816b548899a635bd01cb193cf166591307ad6640d238628bbb09afd206cf707f01d73fd9ce4b1c5ae8867ec6b151fc0e4dd4061f903128487179fd0cc8cefa0
-
Filesize
186KB
MD5442b11ff8cfb9193c84f09fba3dfd9fe
SHA1277a28b5adee790b4f9291775d3376da31f42c3e
SHA256434a7f5c3e0c43aaf2198d7bc8ff697e497c45f9e7491def69c702b31a679c7d
SHA512c816b548899a635bd01cb193cf166591307ad6640d238628bbb09afd206cf707f01d73fd9ce4b1c5ae8867ec6b151fc0e4dd4061f903128487179fd0cc8cefa0
-
Filesize
186KB
MD5442b11ff8cfb9193c84f09fba3dfd9fe
SHA1277a28b5adee790b4f9291775d3376da31f42c3e
SHA256434a7f5c3e0c43aaf2198d7bc8ff697e497c45f9e7491def69c702b31a679c7d
SHA512c816b548899a635bd01cb193cf166591307ad6640d238628bbb09afd206cf707f01d73fd9ce4b1c5ae8867ec6b151fc0e4dd4061f903128487179fd0cc8cefa0