Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    91s
  • max time network
    156s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220901-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
  • submitted
    28/11/2022, 02:56

General

  • Target

    b3731ff02a8056b88bec7b5ebc8e0802d1fead4cc9d13e28f7b75d253962362d.exe

  • Size

    831KB

  • MD5

    e6f1d1d6d8e53c3427112d42527d67d6

  • SHA1

    7958f7fb5ff2b99ad62daedcdfbe2c9dad924e27

  • SHA256

    b3731ff02a8056b88bec7b5ebc8e0802d1fead4cc9d13e28f7b75d253962362d

  • SHA512

    6cc63fbf725635f612d31e38a1421afee389615e721f186fb9fafe472c6ea1d1050f38e226335cc6587977768750e63b300d905a7128005bfea1bee5e1f1c399

  • SSDEEP

    12288:/NpbfGRDCwDeR/0TNrXPSJIebh6vmOiuJuvZ5iVEKJiYGKBBNT5GoTwZ1Z6GzfK:/rfGR2wDeRMTlehb0v4i7JvDTIoGD6w

Score
8/10

Malware Config

Signatures

  • Drops file in Drivers directory 1 IoCs
  • Executes dropped EXE 5 IoCs
  • Loads dropped DLL 14 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Drops file in System32 directory 5 IoCs
  • Drops file in Program Files directory 3 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Modifies data under HKEY_USERS 1 IoCs
  • Runs net.exe
  • Suspicious behavior: LoadsDriver 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 33 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\b3731ff02a8056b88bec7b5ebc8e0802d1fead4cc9d13e28f7b75d253962362d.exe
    "C:\Users\Admin\AppData\Local\Temp\b3731ff02a8056b88bec7b5ebc8e0802d1fead4cc9d13e28f7b75d253962362d.exe"
    1⤵
    • Drops file in Drivers directory
    • Loads dropped DLL
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • Suspicious use of WriteProcessMemory
    PID:3436
    • C:\Windows\SysWOW64\net.exe
      net stop nethttpservice
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:4924
      • C:\Windows\SysWOW64\net1.exe
        C:\Windows\system32\net1 stop nethttpservice
        3⤵
          PID:1648
      • C:\Windows\SysWOW64\net.exe
        net stop serviceupdater
        2⤵
        • Suspicious use of WriteProcessMemory
        PID:4460
        • C:\Windows\SysWOW64\net1.exe
          C:\Windows\system32\net1 stop serviceupdater
          3⤵
            PID:1664
        • C:\Windows\SysWOW64\installd.exe
          "C:\Windows\system32\installd.exe" nethfdrv
          2⤵
          • Executes dropped EXE
          • Loads dropped DLL
          PID:4332
        • C:\Windows\SysWOW64\nethtsrv.exe
          "C:\Windows\system32\nethtsrv.exe" -nfdi
          2⤵
          • Executes dropped EXE
          • Loads dropped DLL
          PID:2692
        • C:\Windows\SysWOW64\netupdsrv.exe
          "C:\Windows\system32\netupdsrv.exe" -nfdi
          2⤵
          • Executes dropped EXE
          PID:4996
        • C:\Windows\SysWOW64\net.exe
          net start nethttpservice
          2⤵
          • Suspicious use of WriteProcessMemory
          PID:528
          • C:\Windows\SysWOW64\net1.exe
            C:\Windows\system32\net1 start nethttpservice
            3⤵
              PID:208
          • C:\Windows\SysWOW64\net.exe
            net start serviceupdater
            2⤵
            • Suspicious use of WriteProcessMemory
            PID:3800
            • C:\Windows\SysWOW64\net1.exe
              C:\Windows\system32\net1 start serviceupdater
              3⤵
                PID:1612
          • C:\Windows\SysWOW64\nethtsrv.exe
            C:\Windows\SysWOW64\nethtsrv.exe
            1⤵
            • Executes dropped EXE
            • Loads dropped DLL
            • Modifies data under HKEY_USERS
            • Suspicious use of AdjustPrivilegeToken
            PID:1932
          • C:\Windows\SysWOW64\netupdsrv.exe
            C:\Windows\SysWOW64\netupdsrv.exe
            1⤵
            • Executes dropped EXE
            PID:4604

          Network

          MITRE ATT&CK Enterprise v6

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • C:\Users\Admin\AppData\Local\Temp\nspD393.tmp\System.dll

            Filesize

            11KB

            MD5

            c17103ae9072a06da581dec998343fc1

            SHA1

            b72148c6bdfaada8b8c3f950e610ee7cf1da1f8d

            SHA256

            dc58d8ad81cacb0c1ed72e33bff8f23ea40b5252b5bb55d393a0903e6819ae2f

            SHA512

            d32a71aaef18e993f28096d536e41c4d016850721b31171513ce28bbd805a54fd290b7c3e9d935f72e676a1acfb4f0dcc89d95040a0dd29f2b6975855c18986f

          • C:\Users\Admin\AppData\Local\Temp\nspD393.tmp\nsExec.dll

            Filesize

            6KB

            MD5

            acc2b699edfea5bf5aae45aba3a41e96

            SHA1

            d2accf4d494e43ceb2cff69abe4dd17147d29cc2

            SHA256

            168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e

            SHA512

            e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe

          • C:\Users\Admin\AppData\Local\Temp\nspD393.tmp\nsExec.dll

            Filesize

            6KB

            MD5

            acc2b699edfea5bf5aae45aba3a41e96

            SHA1

            d2accf4d494e43ceb2cff69abe4dd17147d29cc2

            SHA256

            168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e

            SHA512

            e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe

          • C:\Users\Admin\AppData\Local\Temp\nspD393.tmp\nsExec.dll

            Filesize

            6KB

            MD5

            acc2b699edfea5bf5aae45aba3a41e96

            SHA1

            d2accf4d494e43ceb2cff69abe4dd17147d29cc2

            SHA256

            168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e

            SHA512

            e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe

          • C:\Users\Admin\AppData\Local\Temp\nspD393.tmp\nsExec.dll

            Filesize

            6KB

            MD5

            acc2b699edfea5bf5aae45aba3a41e96

            SHA1

            d2accf4d494e43ceb2cff69abe4dd17147d29cc2

            SHA256

            168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e

            SHA512

            e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe

          • C:\Users\Admin\AppData\Local\Temp\nspD393.tmp\nsExec.dll

            Filesize

            6KB

            MD5

            acc2b699edfea5bf5aae45aba3a41e96

            SHA1

            d2accf4d494e43ceb2cff69abe4dd17147d29cc2

            SHA256

            168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e

            SHA512

            e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe

          • C:\Users\Admin\AppData\Local\Temp\nspD393.tmp\nsExec.dll

            Filesize

            6KB

            MD5

            acc2b699edfea5bf5aae45aba3a41e96

            SHA1

            d2accf4d494e43ceb2cff69abe4dd17147d29cc2

            SHA256

            168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e

            SHA512

            e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe

          • C:\Users\Admin\AppData\Local\Temp\nspD393.tmp\nsExec.dll

            Filesize

            6KB

            MD5

            acc2b699edfea5bf5aae45aba3a41e96

            SHA1

            d2accf4d494e43ceb2cff69abe4dd17147d29cc2

            SHA256

            168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e

            SHA512

            e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe

          • C:\Users\Admin\AppData\Local\Temp\nspD393.tmp\nsExec.dll

            Filesize

            6KB

            MD5

            acc2b699edfea5bf5aae45aba3a41e96

            SHA1

            d2accf4d494e43ceb2cff69abe4dd17147d29cc2

            SHA256

            168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e

            SHA512

            e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe

          • C:\Windows\SysWOW64\hfnapi.dll

            Filesize

            106KB

            MD5

            2319bbfbc0ae08b8c0e2422afcee52bc

            SHA1

            d47d7c0cb28d1a544afebbefdf47bf190b1ecefc

            SHA256

            dc80214ac5a33e989f1608f6b0afa3a0d39d56680be7a4ee462044467dd6b605

            SHA512

            84e09576d6988daab0256a8810e0db45ef7a883ed8eabc89c0c5fae43429242e573ad3ae77408412888be62a3ae5243d82d43f2187b1451a6646923b593ad6ec

          • C:\Windows\SysWOW64\hfnapi.dll

            Filesize

            106KB

            MD5

            2319bbfbc0ae08b8c0e2422afcee52bc

            SHA1

            d47d7c0cb28d1a544afebbefdf47bf190b1ecefc

            SHA256

            dc80214ac5a33e989f1608f6b0afa3a0d39d56680be7a4ee462044467dd6b605

            SHA512

            84e09576d6988daab0256a8810e0db45ef7a883ed8eabc89c0c5fae43429242e573ad3ae77408412888be62a3ae5243d82d43f2187b1451a6646923b593ad6ec

          • C:\Windows\SysWOW64\hfnapi.dll

            Filesize

            106KB

            MD5

            2319bbfbc0ae08b8c0e2422afcee52bc

            SHA1

            d47d7c0cb28d1a544afebbefdf47bf190b1ecefc

            SHA256

            dc80214ac5a33e989f1608f6b0afa3a0d39d56680be7a4ee462044467dd6b605

            SHA512

            84e09576d6988daab0256a8810e0db45ef7a883ed8eabc89c0c5fae43429242e573ad3ae77408412888be62a3ae5243d82d43f2187b1451a6646923b593ad6ec

          • C:\Windows\SysWOW64\hfnapi.dll

            Filesize

            106KB

            MD5

            2319bbfbc0ae08b8c0e2422afcee52bc

            SHA1

            d47d7c0cb28d1a544afebbefdf47bf190b1ecefc

            SHA256

            dc80214ac5a33e989f1608f6b0afa3a0d39d56680be7a4ee462044467dd6b605

            SHA512

            84e09576d6988daab0256a8810e0db45ef7a883ed8eabc89c0c5fae43429242e573ad3ae77408412888be62a3ae5243d82d43f2187b1451a6646923b593ad6ec

          • C:\Windows\SysWOW64\hfpapi.dll

            Filesize

            427KB

            MD5

            46e63f8f364044ce33362978ec10b2e2

            SHA1

            6cac4d1abffb956cac2c81fa6d7f317e3fee9077

            SHA256

            8012051e80bef8222c31c7d4c6f1eca100c27857d42dbf94141dbf7dac2bbe09

            SHA512

            93f5d28112a3630ae3b79e2edbad2985a6c2a2af60c00a62a6968a53b27446c890f95a7e7f9513185e7bbbfe11586a28bd72ea390b3c5258fed70600d25cbf4e

          • C:\Windows\SysWOW64\hfpapi.dll

            Filesize

            427KB

            MD5

            46e63f8f364044ce33362978ec10b2e2

            SHA1

            6cac4d1abffb956cac2c81fa6d7f317e3fee9077

            SHA256

            8012051e80bef8222c31c7d4c6f1eca100c27857d42dbf94141dbf7dac2bbe09

            SHA512

            93f5d28112a3630ae3b79e2edbad2985a6c2a2af60c00a62a6968a53b27446c890f95a7e7f9513185e7bbbfe11586a28bd72ea390b3c5258fed70600d25cbf4e

          • C:\Windows\SysWOW64\hfpapi.dll

            Filesize

            427KB

            MD5

            46e63f8f364044ce33362978ec10b2e2

            SHA1

            6cac4d1abffb956cac2c81fa6d7f317e3fee9077

            SHA256

            8012051e80bef8222c31c7d4c6f1eca100c27857d42dbf94141dbf7dac2bbe09

            SHA512

            93f5d28112a3630ae3b79e2edbad2985a6c2a2af60c00a62a6968a53b27446c890f95a7e7f9513185e7bbbfe11586a28bd72ea390b3c5258fed70600d25cbf4e

          • C:\Windows\SysWOW64\installd.exe

            Filesize

            137KB

            MD5

            a4b67ee518af47201636cee45fa2ed5d

            SHA1

            cbd784d560bbb4cb49c6ef68e942db2944c8a11e

            SHA256

            14f1d6eb63b49b5bc2886ba073f84b6e141d10f38bc9cb9f6c3707e81fb1396e

            SHA512

            95ac5f801d5fb8abe354df336fd3f9ea2778091ab68b0244c1a6f7f94b3030566c1561270bdbfefa8a092461552896235d604c1412627c05a5e8824b70ca826a

          • C:\Windows\SysWOW64\installd.exe

            Filesize

            137KB

            MD5

            a4b67ee518af47201636cee45fa2ed5d

            SHA1

            cbd784d560bbb4cb49c6ef68e942db2944c8a11e

            SHA256

            14f1d6eb63b49b5bc2886ba073f84b6e141d10f38bc9cb9f6c3707e81fb1396e

            SHA512

            95ac5f801d5fb8abe354df336fd3f9ea2778091ab68b0244c1a6f7f94b3030566c1561270bdbfefa8a092461552896235d604c1412627c05a5e8824b70ca826a

          • C:\Windows\SysWOW64\nethtsrv.exe

            Filesize

            331KB

            MD5

            d99f6f4c38cb06a7a9603c0f2a7838e5

            SHA1

            8f2dbb4704fe5254fcafb1c6cd85f477728af3f5

            SHA256

            ce033b149189868568e020dff504b7c1e91ac40e7523364ab17b2dfacabbc129

            SHA512

            67409e322883c2495651a16fc18f2e2ee584a29a910a01c965aa7e527a7c6197ee33d245dfa3a003f4e4f98ac19fcb98882d5be4c124601cc71aba06e06999ef

          • C:\Windows\SysWOW64\nethtsrv.exe

            Filesize

            331KB

            MD5

            d99f6f4c38cb06a7a9603c0f2a7838e5

            SHA1

            8f2dbb4704fe5254fcafb1c6cd85f477728af3f5

            SHA256

            ce033b149189868568e020dff504b7c1e91ac40e7523364ab17b2dfacabbc129

            SHA512

            67409e322883c2495651a16fc18f2e2ee584a29a910a01c965aa7e527a7c6197ee33d245dfa3a003f4e4f98ac19fcb98882d5be4c124601cc71aba06e06999ef

          • C:\Windows\SysWOW64\nethtsrv.exe

            Filesize

            331KB

            MD5

            d99f6f4c38cb06a7a9603c0f2a7838e5

            SHA1

            8f2dbb4704fe5254fcafb1c6cd85f477728af3f5

            SHA256

            ce033b149189868568e020dff504b7c1e91ac40e7523364ab17b2dfacabbc129

            SHA512

            67409e322883c2495651a16fc18f2e2ee584a29a910a01c965aa7e527a7c6197ee33d245dfa3a003f4e4f98ac19fcb98882d5be4c124601cc71aba06e06999ef

          • C:\Windows\SysWOW64\netupdsrv.exe

            Filesize

            186KB

            MD5

            0f892f5f4d7f0194d00caa177f1dc889

            SHA1

            04bbfef91ba263e1765085b112cfc3633c909240

            SHA256

            3790a57ca298426480266366bc52a61862bfe0084b501326b989da9d210e5ee5

            SHA512

            fb3214d970e132ed72ac54e5ad14099af9d0fcda3f651a2a58aa6c494da3fa5bcdfbf95562c65d84b4c55560a9e4b79572c929207875ff2199e785aaac75274a

          • C:\Windows\SysWOW64\netupdsrv.exe

            Filesize

            186KB

            MD5

            0f892f5f4d7f0194d00caa177f1dc889

            SHA1

            04bbfef91ba263e1765085b112cfc3633c909240

            SHA256

            3790a57ca298426480266366bc52a61862bfe0084b501326b989da9d210e5ee5

            SHA512

            fb3214d970e132ed72ac54e5ad14099af9d0fcda3f651a2a58aa6c494da3fa5bcdfbf95562c65d84b4c55560a9e4b79572c929207875ff2199e785aaac75274a

          • C:\Windows\SysWOW64\netupdsrv.exe

            Filesize

            186KB

            MD5

            0f892f5f4d7f0194d00caa177f1dc889

            SHA1

            04bbfef91ba263e1765085b112cfc3633c909240

            SHA256

            3790a57ca298426480266366bc52a61862bfe0084b501326b989da9d210e5ee5

            SHA512

            fb3214d970e132ed72ac54e5ad14099af9d0fcda3f651a2a58aa6c494da3fa5bcdfbf95562c65d84b4c55560a9e4b79572c929207875ff2199e785aaac75274a

          • memory/3436-137-0x0000000000320000-0x00000000007BE000-memory.dmp

            Filesize

            4.6MB

          • memory/3436-168-0x0000000000320000-0x00000000007BE000-memory.dmp

            Filesize

            4.6MB