Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
107s -
max time network
34s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system -
submitted
28/11/2022, 02:57
Static task
static1
Behavioral task
behavioral1
Sample
a3c66d1a88ba7b11066de292f0ebc4d7d735a4d680551ac0fe4078453676fb22.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
a3c66d1a88ba7b11066de292f0ebc4d7d735a4d680551ac0fe4078453676fb22.exe
Resource
win10v2004-20220812-en
General
-
Target
a3c66d1a88ba7b11066de292f0ebc4d7d735a4d680551ac0fe4078453676fb22.exe
-
Size
832KB
-
MD5
99693ab9be12f9f4943e152127389bb9
-
SHA1
7b8e0680270f75e273ae2491a907d785cd3e635e
-
SHA256
a3c66d1a88ba7b11066de292f0ebc4d7d735a4d680551ac0fe4078453676fb22
-
SHA512
ecf88fb267bae0b221af7c37d0ac99d61c1c5eb3f366f4ed2b6106553892d8dd7534b1f3f08ccc3f01bfada49833e47a8847372ff53612af43663fbb4ae65670
-
SSDEEP
24576:YrfGR2wDeRMTdWoWyATRFKkqyWo2qvwnzpik:YYYRMT0rRFQhqIzp
Malware Config
Signatures
-
Drops file in Drivers directory 1 IoCs
description ioc Process File created C:\Windows\system32\drivers\nethfdrv.sys a3c66d1a88ba7b11066de292f0ebc4d7d735a4d680551ac0fe4078453676fb22.exe -
Executes dropped EXE 5 IoCs
pid Process 680 installd.exe 1096 nethtsrv.exe 1496 netupdsrv.exe 1372 nethtsrv.exe 1256 netupdsrv.exe -
Loads dropped DLL 13 IoCs
pid Process 320 a3c66d1a88ba7b11066de292f0ebc4d7d735a4d680551ac0fe4078453676fb22.exe 320 a3c66d1a88ba7b11066de292f0ebc4d7d735a4d680551ac0fe4078453676fb22.exe 320 a3c66d1a88ba7b11066de292f0ebc4d7d735a4d680551ac0fe4078453676fb22.exe 320 a3c66d1a88ba7b11066de292f0ebc4d7d735a4d680551ac0fe4078453676fb22.exe 680 installd.exe 320 a3c66d1a88ba7b11066de292f0ebc4d7d735a4d680551ac0fe4078453676fb22.exe 1096 nethtsrv.exe 1096 nethtsrv.exe 320 a3c66d1a88ba7b11066de292f0ebc4d7d735a4d680551ac0fe4078453676fb22.exe 320 a3c66d1a88ba7b11066de292f0ebc4d7d735a4d680551ac0fe4078453676fb22.exe 1372 nethtsrv.exe 1372 nethtsrv.exe 320 a3c66d1a88ba7b11066de292f0ebc4d7d735a4d680551ac0fe4078453676fb22.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops file in System32 directory 5 IoCs
description ioc Process File created C:\Windows\SysWOW64\hfpapi.dll a3c66d1a88ba7b11066de292f0ebc4d7d735a4d680551ac0fe4078453676fb22.exe File created C:\Windows\SysWOW64\installd.exe a3c66d1a88ba7b11066de292f0ebc4d7d735a4d680551ac0fe4078453676fb22.exe File created C:\Windows\SysWOW64\nethtsrv.exe a3c66d1a88ba7b11066de292f0ebc4d7d735a4d680551ac0fe4078453676fb22.exe File created C:\Windows\SysWOW64\netupdsrv.exe a3c66d1a88ba7b11066de292f0ebc4d7d735a4d680551ac0fe4078453676fb22.exe File created C:\Windows\SysWOW64\hfnapi.dll a3c66d1a88ba7b11066de292f0ebc4d7d735a4d680551ac0fe4078453676fb22.exe -
Drops file in Program Files directory 3 IoCs
description ioc Process File created C:\Program Files (x86)\Common Files\config\uninstinethnfd.exe a3c66d1a88ba7b11066de292f0ebc4d7d735a4d680551ac0fe4078453676fb22.exe File created C:\Program Files (x86)\Common Files\Config\data.xml a3c66d1a88ba7b11066de292f0ebc4d7d735a4d680551ac0fe4078453676fb22.exe File created C:\Program Files (x86)\Common Files\Config\ver.xml a3c66d1a88ba7b11066de292f0ebc4d7d735a4d680551ac0fe4078453676fb22.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Runs net.exe
-
Suspicious behavior: LoadsDriver 1 IoCs
pid Process 464 Process not Found -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 1372 nethtsrv.exe -
Suspicious use of WriteProcessMemory 50 IoCs
description pid Process procid_target PID 320 wrote to memory of 1652 320 a3c66d1a88ba7b11066de292f0ebc4d7d735a4d680551ac0fe4078453676fb22.exe 27 PID 320 wrote to memory of 1652 320 a3c66d1a88ba7b11066de292f0ebc4d7d735a4d680551ac0fe4078453676fb22.exe 27 PID 320 wrote to memory of 1652 320 a3c66d1a88ba7b11066de292f0ebc4d7d735a4d680551ac0fe4078453676fb22.exe 27 PID 320 wrote to memory of 1652 320 a3c66d1a88ba7b11066de292f0ebc4d7d735a4d680551ac0fe4078453676fb22.exe 27 PID 1652 wrote to memory of 828 1652 net.exe 29 PID 1652 wrote to memory of 828 1652 net.exe 29 PID 1652 wrote to memory of 828 1652 net.exe 29 PID 1652 wrote to memory of 828 1652 net.exe 29 PID 320 wrote to memory of 1540 320 a3c66d1a88ba7b11066de292f0ebc4d7d735a4d680551ac0fe4078453676fb22.exe 30 PID 320 wrote to memory of 1540 320 a3c66d1a88ba7b11066de292f0ebc4d7d735a4d680551ac0fe4078453676fb22.exe 30 PID 320 wrote to memory of 1540 320 a3c66d1a88ba7b11066de292f0ebc4d7d735a4d680551ac0fe4078453676fb22.exe 30 PID 320 wrote to memory of 1540 320 a3c66d1a88ba7b11066de292f0ebc4d7d735a4d680551ac0fe4078453676fb22.exe 30 PID 1540 wrote to memory of 1836 1540 net.exe 32 PID 1540 wrote to memory of 1836 1540 net.exe 32 PID 1540 wrote to memory of 1836 1540 net.exe 32 PID 1540 wrote to memory of 1836 1540 net.exe 32 PID 320 wrote to memory of 680 320 a3c66d1a88ba7b11066de292f0ebc4d7d735a4d680551ac0fe4078453676fb22.exe 33 PID 320 wrote to memory of 680 320 a3c66d1a88ba7b11066de292f0ebc4d7d735a4d680551ac0fe4078453676fb22.exe 33 PID 320 wrote to memory of 680 320 a3c66d1a88ba7b11066de292f0ebc4d7d735a4d680551ac0fe4078453676fb22.exe 33 PID 320 wrote to memory of 680 320 a3c66d1a88ba7b11066de292f0ebc4d7d735a4d680551ac0fe4078453676fb22.exe 33 PID 320 wrote to memory of 680 320 a3c66d1a88ba7b11066de292f0ebc4d7d735a4d680551ac0fe4078453676fb22.exe 33 PID 320 wrote to memory of 680 320 a3c66d1a88ba7b11066de292f0ebc4d7d735a4d680551ac0fe4078453676fb22.exe 33 PID 320 wrote to memory of 680 320 a3c66d1a88ba7b11066de292f0ebc4d7d735a4d680551ac0fe4078453676fb22.exe 33 PID 320 wrote to memory of 1096 320 a3c66d1a88ba7b11066de292f0ebc4d7d735a4d680551ac0fe4078453676fb22.exe 35 PID 320 wrote to memory of 1096 320 a3c66d1a88ba7b11066de292f0ebc4d7d735a4d680551ac0fe4078453676fb22.exe 35 PID 320 wrote to memory of 1096 320 a3c66d1a88ba7b11066de292f0ebc4d7d735a4d680551ac0fe4078453676fb22.exe 35 PID 320 wrote to memory of 1096 320 a3c66d1a88ba7b11066de292f0ebc4d7d735a4d680551ac0fe4078453676fb22.exe 35 PID 320 wrote to memory of 1496 320 a3c66d1a88ba7b11066de292f0ebc4d7d735a4d680551ac0fe4078453676fb22.exe 37 PID 320 wrote to memory of 1496 320 a3c66d1a88ba7b11066de292f0ebc4d7d735a4d680551ac0fe4078453676fb22.exe 37 PID 320 wrote to memory of 1496 320 a3c66d1a88ba7b11066de292f0ebc4d7d735a4d680551ac0fe4078453676fb22.exe 37 PID 320 wrote to memory of 1496 320 a3c66d1a88ba7b11066de292f0ebc4d7d735a4d680551ac0fe4078453676fb22.exe 37 PID 320 wrote to memory of 1496 320 a3c66d1a88ba7b11066de292f0ebc4d7d735a4d680551ac0fe4078453676fb22.exe 37 PID 320 wrote to memory of 1496 320 a3c66d1a88ba7b11066de292f0ebc4d7d735a4d680551ac0fe4078453676fb22.exe 37 PID 320 wrote to memory of 1496 320 a3c66d1a88ba7b11066de292f0ebc4d7d735a4d680551ac0fe4078453676fb22.exe 37 PID 320 wrote to memory of 1548 320 a3c66d1a88ba7b11066de292f0ebc4d7d735a4d680551ac0fe4078453676fb22.exe 39 PID 320 wrote to memory of 1548 320 a3c66d1a88ba7b11066de292f0ebc4d7d735a4d680551ac0fe4078453676fb22.exe 39 PID 320 wrote to memory of 1548 320 a3c66d1a88ba7b11066de292f0ebc4d7d735a4d680551ac0fe4078453676fb22.exe 39 PID 320 wrote to memory of 1548 320 a3c66d1a88ba7b11066de292f0ebc4d7d735a4d680551ac0fe4078453676fb22.exe 39 PID 1548 wrote to memory of 1908 1548 net.exe 41 PID 1548 wrote to memory of 1908 1548 net.exe 41 PID 1548 wrote to memory of 1908 1548 net.exe 41 PID 1548 wrote to memory of 1908 1548 net.exe 41 PID 320 wrote to memory of 1744 320 a3c66d1a88ba7b11066de292f0ebc4d7d735a4d680551ac0fe4078453676fb22.exe 43 PID 320 wrote to memory of 1744 320 a3c66d1a88ba7b11066de292f0ebc4d7d735a4d680551ac0fe4078453676fb22.exe 43 PID 320 wrote to memory of 1744 320 a3c66d1a88ba7b11066de292f0ebc4d7d735a4d680551ac0fe4078453676fb22.exe 43 PID 320 wrote to memory of 1744 320 a3c66d1a88ba7b11066de292f0ebc4d7d735a4d680551ac0fe4078453676fb22.exe 43 PID 1744 wrote to memory of 1768 1744 net.exe 45 PID 1744 wrote to memory of 1768 1744 net.exe 45 PID 1744 wrote to memory of 1768 1744 net.exe 45 PID 1744 wrote to memory of 1768 1744 net.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\a3c66d1a88ba7b11066de292f0ebc4d7d735a4d680551ac0fe4078453676fb22.exe"C:\Users\Admin\AppData\Local\Temp\a3c66d1a88ba7b11066de292f0ebc4d7d735a4d680551ac0fe4078453676fb22.exe"1⤵
- Drops file in Drivers directory
- Loads dropped DLL
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:320 -
C:\Windows\SysWOW64\net.exenet stop nethttpservice2⤵
- Suspicious use of WriteProcessMemory
PID:1652 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop nethttpservice3⤵PID:828
-
-
-
C:\Windows\SysWOW64\net.exenet stop serviceupdater2⤵
- Suspicious use of WriteProcessMemory
PID:1540 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop serviceupdater3⤵PID:1836
-
-
-
C:\Windows\SysWOW64\installd.exe"C:\Windows\system32\installd.exe" nethfdrv2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:680
-
-
C:\Windows\SysWOW64\nethtsrv.exe"C:\Windows\system32\nethtsrv.exe" -nfdi2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1096
-
-
C:\Windows\SysWOW64\netupdsrv.exe"C:\Windows\system32\netupdsrv.exe" -nfdi2⤵
- Executes dropped EXE
PID:1496
-
-
C:\Windows\SysWOW64\net.exenet start nethttpservice2⤵
- Suspicious use of WriteProcessMemory
PID:1548 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 start nethttpservice3⤵PID:1908
-
-
-
C:\Windows\SysWOW64\net.exenet start serviceupdater2⤵
- Suspicious use of WriteProcessMemory
PID:1744 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 start serviceupdater3⤵PID:1768
-
-
-
C:\Windows\SysWOW64\nethtsrv.exeC:\Windows\SysWOW64\nethtsrv.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:1372
-
C:\Windows\SysWOW64\netupdsrv.exeC:\Windows\SysWOW64\netupdsrv.exe1⤵
- Executes dropped EXE
PID:1256
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
106KB
MD5219594328af58738379280536bab7925
SHA1c1ec874569456f03ef6c7b56557a3b9f03a29670
SHA2560af00d9e6aa6d450c1fafd05e82b9cce9fb1460cb2d376a7d1ab13185f7c7697
SHA512cf5e8f3a773a2d8b059532942cd98ef269471706dfa9917d92f9b385d87f9cfb4c7b15e4fe2fc37dc37c8ea52919a4b7b4488cb9d95df037d31a487792bcd768
-
Filesize
427KB
MD543c22058b994c58309fce8b20f0095ee
SHA1ab272db97a03147bc9f18b69e48f0b88fa212f0d
SHA25693fc8052c9a4e641b71884323364f7bf1ef55484628def72e9cdddba9a79bd59
SHA51223929e5b0ef5c71cf910f5f891e37318f489b49f60d5234f1643c72f37e4dca1b715b3b76fea307bbb2294da2b46c78ec134638384a9fafd9b9f2d22a9c0790c
-
Filesize
137KB
MD5471641a6f8531d8737170a474e03e7d5
SHA15f4dec4620cf8a36732cacebb9897003af6c6f31
SHA256d2e91504d3704168251f7639f57dc4a2261d5a93470cf9f1d1c0dd4f458321c5
SHA512d456464d31179485a940a923855b47471e45fe69421e259f6048223cefc6b771ac377209f127c0dd2b68df11e34de4be9b7c56eaac0cd60de778d09c6c7b2e4b
-
Filesize
331KB
MD53ba85af56fbceadac16edb026ab2e90e
SHA1be8a87c42a8aa2db48a5beee5c991b1f9efe22d4
SHA25614ee3d9549fd64f7dbf1de9ab1c55e8001d5dc201cc734433165ac71f9e5b917
SHA512b45b6e94085613f8383fcda45845cc567b754fa87bebfe6fe9fc7fde416d6e5b57df0a47adccc6b3abfdd26f110cd573ba84fd582fed6efeeb50b4392d98f514
-
Filesize
331KB
MD53ba85af56fbceadac16edb026ab2e90e
SHA1be8a87c42a8aa2db48a5beee5c991b1f9efe22d4
SHA25614ee3d9549fd64f7dbf1de9ab1c55e8001d5dc201cc734433165ac71f9e5b917
SHA512b45b6e94085613f8383fcda45845cc567b754fa87bebfe6fe9fc7fde416d6e5b57df0a47adccc6b3abfdd26f110cd573ba84fd582fed6efeeb50b4392d98f514
-
Filesize
186KB
MD52f824b9687e29c8ae4e11084ddf836f9
SHA11059faec6b861eb1c3840c3da7ffe1688664799f
SHA2561f7f455443dd7c7ef2e2ef7c4dc32c8e62acb73040e9b0997fbd4fc091698302
SHA5124b10bf162f726709db4ad8f18f6cc4544aa865f6f693d3deed7034ca6767a93ec0db626c002bf8c8b52f941578a6bf52061895bb03b65b68ce5cdaff54a6c3e7
-
Filesize
186KB
MD52f824b9687e29c8ae4e11084ddf836f9
SHA11059faec6b861eb1c3840c3da7ffe1688664799f
SHA2561f7f455443dd7c7ef2e2ef7c4dc32c8e62acb73040e9b0997fbd4fc091698302
SHA5124b10bf162f726709db4ad8f18f6cc4544aa865f6f693d3deed7034ca6767a93ec0db626c002bf8c8b52f941578a6bf52061895bb03b65b68ce5cdaff54a6c3e7
-
Filesize
11KB
MD5c17103ae9072a06da581dec998343fc1
SHA1b72148c6bdfaada8b8c3f950e610ee7cf1da1f8d
SHA256dc58d8ad81cacb0c1ed72e33bff8f23ea40b5252b5bb55d393a0903e6819ae2f
SHA512d32a71aaef18e993f28096d536e41c4d016850721b31171513ce28bbd805a54fd290b7c3e9d935f72e676a1acfb4f0dcc89d95040a0dd29f2b6975855c18986f
-
Filesize
6KB
MD5acc2b699edfea5bf5aae45aba3a41e96
SHA1d2accf4d494e43ceb2cff69abe4dd17147d29cc2
SHA256168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e
SHA512e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe
-
Filesize
6KB
MD5acc2b699edfea5bf5aae45aba3a41e96
SHA1d2accf4d494e43ceb2cff69abe4dd17147d29cc2
SHA256168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e
SHA512e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe
-
Filesize
6KB
MD5acc2b699edfea5bf5aae45aba3a41e96
SHA1d2accf4d494e43ceb2cff69abe4dd17147d29cc2
SHA256168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e
SHA512e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe
-
Filesize
6KB
MD5acc2b699edfea5bf5aae45aba3a41e96
SHA1d2accf4d494e43ceb2cff69abe4dd17147d29cc2
SHA256168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e
SHA512e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe
-
Filesize
106KB
MD5219594328af58738379280536bab7925
SHA1c1ec874569456f03ef6c7b56557a3b9f03a29670
SHA2560af00d9e6aa6d450c1fafd05e82b9cce9fb1460cb2d376a7d1ab13185f7c7697
SHA512cf5e8f3a773a2d8b059532942cd98ef269471706dfa9917d92f9b385d87f9cfb4c7b15e4fe2fc37dc37c8ea52919a4b7b4488cb9d95df037d31a487792bcd768
-
Filesize
106KB
MD5219594328af58738379280536bab7925
SHA1c1ec874569456f03ef6c7b56557a3b9f03a29670
SHA2560af00d9e6aa6d450c1fafd05e82b9cce9fb1460cb2d376a7d1ab13185f7c7697
SHA512cf5e8f3a773a2d8b059532942cd98ef269471706dfa9917d92f9b385d87f9cfb4c7b15e4fe2fc37dc37c8ea52919a4b7b4488cb9d95df037d31a487792bcd768
-
Filesize
106KB
MD5219594328af58738379280536bab7925
SHA1c1ec874569456f03ef6c7b56557a3b9f03a29670
SHA2560af00d9e6aa6d450c1fafd05e82b9cce9fb1460cb2d376a7d1ab13185f7c7697
SHA512cf5e8f3a773a2d8b059532942cd98ef269471706dfa9917d92f9b385d87f9cfb4c7b15e4fe2fc37dc37c8ea52919a4b7b4488cb9d95df037d31a487792bcd768
-
Filesize
427KB
MD543c22058b994c58309fce8b20f0095ee
SHA1ab272db97a03147bc9f18b69e48f0b88fa212f0d
SHA25693fc8052c9a4e641b71884323364f7bf1ef55484628def72e9cdddba9a79bd59
SHA51223929e5b0ef5c71cf910f5f891e37318f489b49f60d5234f1643c72f37e4dca1b715b3b76fea307bbb2294da2b46c78ec134638384a9fafd9b9f2d22a9c0790c
-
Filesize
427KB
MD543c22058b994c58309fce8b20f0095ee
SHA1ab272db97a03147bc9f18b69e48f0b88fa212f0d
SHA25693fc8052c9a4e641b71884323364f7bf1ef55484628def72e9cdddba9a79bd59
SHA51223929e5b0ef5c71cf910f5f891e37318f489b49f60d5234f1643c72f37e4dca1b715b3b76fea307bbb2294da2b46c78ec134638384a9fafd9b9f2d22a9c0790c
-
Filesize
137KB
MD5471641a6f8531d8737170a474e03e7d5
SHA15f4dec4620cf8a36732cacebb9897003af6c6f31
SHA256d2e91504d3704168251f7639f57dc4a2261d5a93470cf9f1d1c0dd4f458321c5
SHA512d456464d31179485a940a923855b47471e45fe69421e259f6048223cefc6b771ac377209f127c0dd2b68df11e34de4be9b7c56eaac0cd60de778d09c6c7b2e4b
-
Filesize
331KB
MD53ba85af56fbceadac16edb026ab2e90e
SHA1be8a87c42a8aa2db48a5beee5c991b1f9efe22d4
SHA25614ee3d9549fd64f7dbf1de9ab1c55e8001d5dc201cc734433165ac71f9e5b917
SHA512b45b6e94085613f8383fcda45845cc567b754fa87bebfe6fe9fc7fde416d6e5b57df0a47adccc6b3abfdd26f110cd573ba84fd582fed6efeeb50b4392d98f514
-
Filesize
186KB
MD52f824b9687e29c8ae4e11084ddf836f9
SHA11059faec6b861eb1c3840c3da7ffe1688664799f
SHA2561f7f455443dd7c7ef2e2ef7c4dc32c8e62acb73040e9b0997fbd4fc091698302
SHA5124b10bf162f726709db4ad8f18f6cc4544aa865f6f693d3deed7034ca6767a93ec0db626c002bf8c8b52f941578a6bf52061895bb03b65b68ce5cdaff54a6c3e7