Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
91s -
max time network
156s -
platform
windows10-2004_x64 -
resource
win10v2004-20220901-en -
resource tags
arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system -
submitted
28/11/2022, 02:56
Static task
static1
Behavioral task
behavioral1
Sample
b3731ff02a8056b88bec7b5ebc8e0802d1fead4cc9d13e28f7b75d253962362d.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
b3731ff02a8056b88bec7b5ebc8e0802d1fead4cc9d13e28f7b75d253962362d.exe
Resource
win10v2004-20220901-en
General
-
Target
b3731ff02a8056b88bec7b5ebc8e0802d1fead4cc9d13e28f7b75d253962362d.exe
-
Size
831KB
-
MD5
e6f1d1d6d8e53c3427112d42527d67d6
-
SHA1
7958f7fb5ff2b99ad62daedcdfbe2c9dad924e27
-
SHA256
b3731ff02a8056b88bec7b5ebc8e0802d1fead4cc9d13e28f7b75d253962362d
-
SHA512
6cc63fbf725635f612d31e38a1421afee389615e721f186fb9fafe472c6ea1d1050f38e226335cc6587977768750e63b300d905a7128005bfea1bee5e1f1c399
-
SSDEEP
12288:/NpbfGRDCwDeR/0TNrXPSJIebh6vmOiuJuvZ5iVEKJiYGKBBNT5GoTwZ1Z6GzfK:/rfGR2wDeRMTlehb0v4i7JvDTIoGD6w
Malware Config
Signatures
-
Drops file in Drivers directory 1 IoCs
description ioc Process File created C:\Windows\system32\drivers\nethfdrv.sys b3731ff02a8056b88bec7b5ebc8e0802d1fead4cc9d13e28f7b75d253962362d.exe -
Executes dropped EXE 5 IoCs
pid Process 4332 installd.exe 2692 nethtsrv.exe 4996 netupdsrv.exe 1932 nethtsrv.exe 4604 netupdsrv.exe -
Loads dropped DLL 14 IoCs
pid Process 3436 b3731ff02a8056b88bec7b5ebc8e0802d1fead4cc9d13e28f7b75d253962362d.exe 3436 b3731ff02a8056b88bec7b5ebc8e0802d1fead4cc9d13e28f7b75d253962362d.exe 3436 b3731ff02a8056b88bec7b5ebc8e0802d1fead4cc9d13e28f7b75d253962362d.exe 3436 b3731ff02a8056b88bec7b5ebc8e0802d1fead4cc9d13e28f7b75d253962362d.exe 3436 b3731ff02a8056b88bec7b5ebc8e0802d1fead4cc9d13e28f7b75d253962362d.exe 4332 installd.exe 2692 nethtsrv.exe 2692 nethtsrv.exe 3436 b3731ff02a8056b88bec7b5ebc8e0802d1fead4cc9d13e28f7b75d253962362d.exe 3436 b3731ff02a8056b88bec7b5ebc8e0802d1fead4cc9d13e28f7b75d253962362d.exe 1932 nethtsrv.exe 1932 nethtsrv.exe 3436 b3731ff02a8056b88bec7b5ebc8e0802d1fead4cc9d13e28f7b75d253962362d.exe 3436 b3731ff02a8056b88bec7b5ebc8e0802d1fead4cc9d13e28f7b75d253962362d.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops file in System32 directory 5 IoCs
description ioc Process File created C:\Windows\SysWOW64\nethtsrv.exe b3731ff02a8056b88bec7b5ebc8e0802d1fead4cc9d13e28f7b75d253962362d.exe File created C:\Windows\SysWOW64\netupdsrv.exe b3731ff02a8056b88bec7b5ebc8e0802d1fead4cc9d13e28f7b75d253962362d.exe File created C:\Windows\SysWOW64\hfnapi.dll b3731ff02a8056b88bec7b5ebc8e0802d1fead4cc9d13e28f7b75d253962362d.exe File created C:\Windows\SysWOW64\hfpapi.dll b3731ff02a8056b88bec7b5ebc8e0802d1fead4cc9d13e28f7b75d253962362d.exe File created C:\Windows\SysWOW64\installd.exe b3731ff02a8056b88bec7b5ebc8e0802d1fead4cc9d13e28f7b75d253962362d.exe -
Drops file in Program Files directory 3 IoCs
description ioc Process File created C:\Program Files (x86)\Common Files\Config\data.xml b3731ff02a8056b88bec7b5ebc8e0802d1fead4cc9d13e28f7b75d253962362d.exe File created C:\Program Files (x86)\Common Files\Config\ver.xml b3731ff02a8056b88bec7b5ebc8e0802d1fead4cc9d13e28f7b75d253962362d.exe File created C:\Program Files (x86)\Common Files\config\uninstinethnfd.exe b3731ff02a8056b88bec7b5ebc8e0802d1fead4cc9d13e28f7b75d253962362d.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Modifies data under HKEY_USERS 1 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections nethtsrv.exe -
Runs net.exe
-
Suspicious behavior: LoadsDriver 1 IoCs
pid Process 644 Process not Found -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 1932 nethtsrv.exe -
Suspicious use of WriteProcessMemory 33 IoCs
description pid Process procid_target PID 3436 wrote to memory of 4924 3436 b3731ff02a8056b88bec7b5ebc8e0802d1fead4cc9d13e28f7b75d253962362d.exe 81 PID 3436 wrote to memory of 4924 3436 b3731ff02a8056b88bec7b5ebc8e0802d1fead4cc9d13e28f7b75d253962362d.exe 81 PID 3436 wrote to memory of 4924 3436 b3731ff02a8056b88bec7b5ebc8e0802d1fead4cc9d13e28f7b75d253962362d.exe 81 PID 4924 wrote to memory of 1648 4924 net.exe 83 PID 4924 wrote to memory of 1648 4924 net.exe 83 PID 4924 wrote to memory of 1648 4924 net.exe 83 PID 3436 wrote to memory of 4460 3436 b3731ff02a8056b88bec7b5ebc8e0802d1fead4cc9d13e28f7b75d253962362d.exe 84 PID 3436 wrote to memory of 4460 3436 b3731ff02a8056b88bec7b5ebc8e0802d1fead4cc9d13e28f7b75d253962362d.exe 84 PID 3436 wrote to memory of 4460 3436 b3731ff02a8056b88bec7b5ebc8e0802d1fead4cc9d13e28f7b75d253962362d.exe 84 PID 4460 wrote to memory of 1664 4460 net.exe 86 PID 4460 wrote to memory of 1664 4460 net.exe 86 PID 4460 wrote to memory of 1664 4460 net.exe 86 PID 3436 wrote to memory of 4332 3436 b3731ff02a8056b88bec7b5ebc8e0802d1fead4cc9d13e28f7b75d253962362d.exe 87 PID 3436 wrote to memory of 4332 3436 b3731ff02a8056b88bec7b5ebc8e0802d1fead4cc9d13e28f7b75d253962362d.exe 87 PID 3436 wrote to memory of 4332 3436 b3731ff02a8056b88bec7b5ebc8e0802d1fead4cc9d13e28f7b75d253962362d.exe 87 PID 3436 wrote to memory of 2692 3436 b3731ff02a8056b88bec7b5ebc8e0802d1fead4cc9d13e28f7b75d253962362d.exe 88 PID 3436 wrote to memory of 2692 3436 b3731ff02a8056b88bec7b5ebc8e0802d1fead4cc9d13e28f7b75d253962362d.exe 88 PID 3436 wrote to memory of 2692 3436 b3731ff02a8056b88bec7b5ebc8e0802d1fead4cc9d13e28f7b75d253962362d.exe 88 PID 3436 wrote to memory of 4996 3436 b3731ff02a8056b88bec7b5ebc8e0802d1fead4cc9d13e28f7b75d253962362d.exe 90 PID 3436 wrote to memory of 4996 3436 b3731ff02a8056b88bec7b5ebc8e0802d1fead4cc9d13e28f7b75d253962362d.exe 90 PID 3436 wrote to memory of 4996 3436 b3731ff02a8056b88bec7b5ebc8e0802d1fead4cc9d13e28f7b75d253962362d.exe 90 PID 3436 wrote to memory of 528 3436 b3731ff02a8056b88bec7b5ebc8e0802d1fead4cc9d13e28f7b75d253962362d.exe 92 PID 3436 wrote to memory of 528 3436 b3731ff02a8056b88bec7b5ebc8e0802d1fead4cc9d13e28f7b75d253962362d.exe 92 PID 3436 wrote to memory of 528 3436 b3731ff02a8056b88bec7b5ebc8e0802d1fead4cc9d13e28f7b75d253962362d.exe 92 PID 528 wrote to memory of 208 528 net.exe 94 PID 528 wrote to memory of 208 528 net.exe 94 PID 528 wrote to memory of 208 528 net.exe 94 PID 3436 wrote to memory of 3800 3436 b3731ff02a8056b88bec7b5ebc8e0802d1fead4cc9d13e28f7b75d253962362d.exe 96 PID 3436 wrote to memory of 3800 3436 b3731ff02a8056b88bec7b5ebc8e0802d1fead4cc9d13e28f7b75d253962362d.exe 96 PID 3436 wrote to memory of 3800 3436 b3731ff02a8056b88bec7b5ebc8e0802d1fead4cc9d13e28f7b75d253962362d.exe 96 PID 3800 wrote to memory of 1612 3800 net.exe 98 PID 3800 wrote to memory of 1612 3800 net.exe 98 PID 3800 wrote to memory of 1612 3800 net.exe 98
Processes
-
C:\Users\Admin\AppData\Local\Temp\b3731ff02a8056b88bec7b5ebc8e0802d1fead4cc9d13e28f7b75d253962362d.exe"C:\Users\Admin\AppData\Local\Temp\b3731ff02a8056b88bec7b5ebc8e0802d1fead4cc9d13e28f7b75d253962362d.exe"1⤵
- Drops file in Drivers directory
- Loads dropped DLL
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:3436 -
C:\Windows\SysWOW64\net.exenet stop nethttpservice2⤵
- Suspicious use of WriteProcessMemory
PID:4924 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop nethttpservice3⤵PID:1648
-
-
-
C:\Windows\SysWOW64\net.exenet stop serviceupdater2⤵
- Suspicious use of WriteProcessMemory
PID:4460 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop serviceupdater3⤵PID:1664
-
-
-
C:\Windows\SysWOW64\installd.exe"C:\Windows\system32\installd.exe" nethfdrv2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:4332
-
-
C:\Windows\SysWOW64\nethtsrv.exe"C:\Windows\system32\nethtsrv.exe" -nfdi2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2692
-
-
C:\Windows\SysWOW64\netupdsrv.exe"C:\Windows\system32\netupdsrv.exe" -nfdi2⤵
- Executes dropped EXE
PID:4996
-
-
C:\Windows\SysWOW64\net.exenet start nethttpservice2⤵
- Suspicious use of WriteProcessMemory
PID:528 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 start nethttpservice3⤵PID:208
-
-
-
C:\Windows\SysWOW64\net.exenet start serviceupdater2⤵
- Suspicious use of WriteProcessMemory
PID:3800 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 start serviceupdater3⤵PID:1612
-
-
-
C:\Windows\SysWOW64\nethtsrv.exeC:\Windows\SysWOW64\nethtsrv.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:1932
-
C:\Windows\SysWOW64\netupdsrv.exeC:\Windows\SysWOW64\netupdsrv.exe1⤵
- Executes dropped EXE
PID:4604
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
11KB
MD5c17103ae9072a06da581dec998343fc1
SHA1b72148c6bdfaada8b8c3f950e610ee7cf1da1f8d
SHA256dc58d8ad81cacb0c1ed72e33bff8f23ea40b5252b5bb55d393a0903e6819ae2f
SHA512d32a71aaef18e993f28096d536e41c4d016850721b31171513ce28bbd805a54fd290b7c3e9d935f72e676a1acfb4f0dcc89d95040a0dd29f2b6975855c18986f
-
Filesize
6KB
MD5acc2b699edfea5bf5aae45aba3a41e96
SHA1d2accf4d494e43ceb2cff69abe4dd17147d29cc2
SHA256168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e
SHA512e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe
-
Filesize
6KB
MD5acc2b699edfea5bf5aae45aba3a41e96
SHA1d2accf4d494e43ceb2cff69abe4dd17147d29cc2
SHA256168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e
SHA512e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe
-
Filesize
6KB
MD5acc2b699edfea5bf5aae45aba3a41e96
SHA1d2accf4d494e43ceb2cff69abe4dd17147d29cc2
SHA256168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e
SHA512e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe
-
Filesize
6KB
MD5acc2b699edfea5bf5aae45aba3a41e96
SHA1d2accf4d494e43ceb2cff69abe4dd17147d29cc2
SHA256168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e
SHA512e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe
-
Filesize
6KB
MD5acc2b699edfea5bf5aae45aba3a41e96
SHA1d2accf4d494e43ceb2cff69abe4dd17147d29cc2
SHA256168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e
SHA512e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe
-
Filesize
6KB
MD5acc2b699edfea5bf5aae45aba3a41e96
SHA1d2accf4d494e43ceb2cff69abe4dd17147d29cc2
SHA256168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e
SHA512e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe
-
Filesize
6KB
MD5acc2b699edfea5bf5aae45aba3a41e96
SHA1d2accf4d494e43ceb2cff69abe4dd17147d29cc2
SHA256168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e
SHA512e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe
-
Filesize
6KB
MD5acc2b699edfea5bf5aae45aba3a41e96
SHA1d2accf4d494e43ceb2cff69abe4dd17147d29cc2
SHA256168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e
SHA512e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe
-
Filesize
106KB
MD52319bbfbc0ae08b8c0e2422afcee52bc
SHA1d47d7c0cb28d1a544afebbefdf47bf190b1ecefc
SHA256dc80214ac5a33e989f1608f6b0afa3a0d39d56680be7a4ee462044467dd6b605
SHA51284e09576d6988daab0256a8810e0db45ef7a883ed8eabc89c0c5fae43429242e573ad3ae77408412888be62a3ae5243d82d43f2187b1451a6646923b593ad6ec
-
Filesize
106KB
MD52319bbfbc0ae08b8c0e2422afcee52bc
SHA1d47d7c0cb28d1a544afebbefdf47bf190b1ecefc
SHA256dc80214ac5a33e989f1608f6b0afa3a0d39d56680be7a4ee462044467dd6b605
SHA51284e09576d6988daab0256a8810e0db45ef7a883ed8eabc89c0c5fae43429242e573ad3ae77408412888be62a3ae5243d82d43f2187b1451a6646923b593ad6ec
-
Filesize
106KB
MD52319bbfbc0ae08b8c0e2422afcee52bc
SHA1d47d7c0cb28d1a544afebbefdf47bf190b1ecefc
SHA256dc80214ac5a33e989f1608f6b0afa3a0d39d56680be7a4ee462044467dd6b605
SHA51284e09576d6988daab0256a8810e0db45ef7a883ed8eabc89c0c5fae43429242e573ad3ae77408412888be62a3ae5243d82d43f2187b1451a6646923b593ad6ec
-
Filesize
106KB
MD52319bbfbc0ae08b8c0e2422afcee52bc
SHA1d47d7c0cb28d1a544afebbefdf47bf190b1ecefc
SHA256dc80214ac5a33e989f1608f6b0afa3a0d39d56680be7a4ee462044467dd6b605
SHA51284e09576d6988daab0256a8810e0db45ef7a883ed8eabc89c0c5fae43429242e573ad3ae77408412888be62a3ae5243d82d43f2187b1451a6646923b593ad6ec
-
Filesize
427KB
MD546e63f8f364044ce33362978ec10b2e2
SHA16cac4d1abffb956cac2c81fa6d7f317e3fee9077
SHA2568012051e80bef8222c31c7d4c6f1eca100c27857d42dbf94141dbf7dac2bbe09
SHA51293f5d28112a3630ae3b79e2edbad2985a6c2a2af60c00a62a6968a53b27446c890f95a7e7f9513185e7bbbfe11586a28bd72ea390b3c5258fed70600d25cbf4e
-
Filesize
427KB
MD546e63f8f364044ce33362978ec10b2e2
SHA16cac4d1abffb956cac2c81fa6d7f317e3fee9077
SHA2568012051e80bef8222c31c7d4c6f1eca100c27857d42dbf94141dbf7dac2bbe09
SHA51293f5d28112a3630ae3b79e2edbad2985a6c2a2af60c00a62a6968a53b27446c890f95a7e7f9513185e7bbbfe11586a28bd72ea390b3c5258fed70600d25cbf4e
-
Filesize
427KB
MD546e63f8f364044ce33362978ec10b2e2
SHA16cac4d1abffb956cac2c81fa6d7f317e3fee9077
SHA2568012051e80bef8222c31c7d4c6f1eca100c27857d42dbf94141dbf7dac2bbe09
SHA51293f5d28112a3630ae3b79e2edbad2985a6c2a2af60c00a62a6968a53b27446c890f95a7e7f9513185e7bbbfe11586a28bd72ea390b3c5258fed70600d25cbf4e
-
Filesize
137KB
MD5a4b67ee518af47201636cee45fa2ed5d
SHA1cbd784d560bbb4cb49c6ef68e942db2944c8a11e
SHA25614f1d6eb63b49b5bc2886ba073f84b6e141d10f38bc9cb9f6c3707e81fb1396e
SHA51295ac5f801d5fb8abe354df336fd3f9ea2778091ab68b0244c1a6f7f94b3030566c1561270bdbfefa8a092461552896235d604c1412627c05a5e8824b70ca826a
-
Filesize
137KB
MD5a4b67ee518af47201636cee45fa2ed5d
SHA1cbd784d560bbb4cb49c6ef68e942db2944c8a11e
SHA25614f1d6eb63b49b5bc2886ba073f84b6e141d10f38bc9cb9f6c3707e81fb1396e
SHA51295ac5f801d5fb8abe354df336fd3f9ea2778091ab68b0244c1a6f7f94b3030566c1561270bdbfefa8a092461552896235d604c1412627c05a5e8824b70ca826a
-
Filesize
331KB
MD5d99f6f4c38cb06a7a9603c0f2a7838e5
SHA18f2dbb4704fe5254fcafb1c6cd85f477728af3f5
SHA256ce033b149189868568e020dff504b7c1e91ac40e7523364ab17b2dfacabbc129
SHA51267409e322883c2495651a16fc18f2e2ee584a29a910a01c965aa7e527a7c6197ee33d245dfa3a003f4e4f98ac19fcb98882d5be4c124601cc71aba06e06999ef
-
Filesize
331KB
MD5d99f6f4c38cb06a7a9603c0f2a7838e5
SHA18f2dbb4704fe5254fcafb1c6cd85f477728af3f5
SHA256ce033b149189868568e020dff504b7c1e91ac40e7523364ab17b2dfacabbc129
SHA51267409e322883c2495651a16fc18f2e2ee584a29a910a01c965aa7e527a7c6197ee33d245dfa3a003f4e4f98ac19fcb98882d5be4c124601cc71aba06e06999ef
-
Filesize
331KB
MD5d99f6f4c38cb06a7a9603c0f2a7838e5
SHA18f2dbb4704fe5254fcafb1c6cd85f477728af3f5
SHA256ce033b149189868568e020dff504b7c1e91ac40e7523364ab17b2dfacabbc129
SHA51267409e322883c2495651a16fc18f2e2ee584a29a910a01c965aa7e527a7c6197ee33d245dfa3a003f4e4f98ac19fcb98882d5be4c124601cc71aba06e06999ef
-
Filesize
186KB
MD50f892f5f4d7f0194d00caa177f1dc889
SHA104bbfef91ba263e1765085b112cfc3633c909240
SHA2563790a57ca298426480266366bc52a61862bfe0084b501326b989da9d210e5ee5
SHA512fb3214d970e132ed72ac54e5ad14099af9d0fcda3f651a2a58aa6c494da3fa5bcdfbf95562c65d84b4c55560a9e4b79572c929207875ff2199e785aaac75274a
-
Filesize
186KB
MD50f892f5f4d7f0194d00caa177f1dc889
SHA104bbfef91ba263e1765085b112cfc3633c909240
SHA2563790a57ca298426480266366bc52a61862bfe0084b501326b989da9d210e5ee5
SHA512fb3214d970e132ed72ac54e5ad14099af9d0fcda3f651a2a58aa6c494da3fa5bcdfbf95562c65d84b4c55560a9e4b79572c929207875ff2199e785aaac75274a
-
Filesize
186KB
MD50f892f5f4d7f0194d00caa177f1dc889
SHA104bbfef91ba263e1765085b112cfc3633c909240
SHA2563790a57ca298426480266366bc52a61862bfe0084b501326b989da9d210e5ee5
SHA512fb3214d970e132ed72ac54e5ad14099af9d0fcda3f651a2a58aa6c494da3fa5bcdfbf95562c65d84b4c55560a9e4b79572c929207875ff2199e785aaac75274a