Analysis
- max time kernel
82s - max time network
80s - platform
windows7_x64 - resource
win7-en-20211208 - submitted
20/01/2022, 14:41
Static task
static1
Behavioral task
behavioral1
Sample
EvilNominatusCrypto.exe
Resource
win7-en-20211208
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
EvilNominatusCrypto.exe
Resource
win10v2004-en-20220112
windows10-2004_x64
0 signatures
0 seconds
General
- Target EvilNominatusCrypto.exe
- Size 14KB
- Sample220120-r2fd2sadbk
- SHA256 01cec0306b25849804ac2770d877423d9f00adfae6217c72842630d18c048ba4
- MD5 8e23d84e5c58270136539c4cb3e604a4
- SHA1 4cc242e1f24af73d2a3e38e4ad103df0ae62d93c
- SHA512 159cd61686bec5c83c529e69f1ce653c9b8176c386b0d28b192fa25f07c2784749855f27cd144e6c581c37fd411db857c1476777719feb6f6a291bf8acf4344f
- MD5 SHA1 SHA512
Score
10/10
Malware Config
Signatures
- Modifies WinLogon for persistence 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "C:\\Users\\Admin\\AppData\\Local\\Temp\\EvilNominatusCrypto.exe" EvilNominatusCrypto.exe - Disables RegEdit via registry modification
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
- Modifies registry key 1 TTPs 1 IoCs
pid Process 544 reg.exe - Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 1636 EvilNominatusCrypto.exe Token: SeDebugPrivilege 1636 EvilNominatusCrypto.exe - Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 1636 EvilNominatusCrypto.exe 1636 EvilNominatusCrypto.exe 1636 EvilNominatusCrypto.exe 1636 EvilNominatusCrypto.exe 1636 EvilNominatusCrypto.exe 1636 EvilNominatusCrypto.exe 1636 EvilNominatusCrypto.exe 1636 EvilNominatusCrypto.exe 1636 EvilNominatusCrypto.exe 1636 EvilNominatusCrypto.exe 1636 EvilNominatusCrypto.exe 1636 EvilNominatusCrypto.exe 1636 EvilNominatusCrypto.exe 1636 EvilNominatusCrypto.exe 1636 EvilNominatusCrypto.exe 1636 EvilNominatusCrypto.exe 1636 EvilNominatusCrypto.exe 1636 EvilNominatusCrypto.exe 1636 EvilNominatusCrypto.exe 1636 EvilNominatusCrypto.exe 1636 EvilNominatusCrypto.exe 1636 EvilNominatusCrypto.exe 1636 EvilNominatusCrypto.exe 1636 EvilNominatusCrypto.exe 1636 EvilNominatusCrypto.exe 1636 EvilNominatusCrypto.exe 1636 EvilNominatusCrypto.exe 1636 EvilNominatusCrypto.exe 1636 EvilNominatusCrypto.exe 1636 EvilNominatusCrypto.exe 1636 EvilNominatusCrypto.exe 1636 EvilNominatusCrypto.exe 1636 EvilNominatusCrypto.exe 1636 EvilNominatusCrypto.exe 1636 EvilNominatusCrypto.exe 1636 EvilNominatusCrypto.exe 1636 EvilNominatusCrypto.exe 1636 EvilNominatusCrypto.exe 1636 EvilNominatusCrypto.exe 1636 EvilNominatusCrypto.exe 1636 EvilNominatusCrypto.exe 1636 EvilNominatusCrypto.exe 1636 EvilNominatusCrypto.exe 1636 EvilNominatusCrypto.exe 1636 EvilNominatusCrypto.exe 1636 EvilNominatusCrypto.exe 1636 EvilNominatusCrypto.exe 1636 EvilNominatusCrypto.exe 1636 EvilNominatusCrypto.exe 1636 EvilNominatusCrypto.exe 1636 EvilNominatusCrypto.exe 1636 EvilNominatusCrypto.exe 1636 EvilNominatusCrypto.exe 1636 EvilNominatusCrypto.exe 1636 EvilNominatusCrypto.exe 1636 EvilNominatusCrypto.exe 1636 EvilNominatusCrypto.exe 1636 EvilNominatusCrypto.exe 1636 EvilNominatusCrypto.exe 1636 EvilNominatusCrypto.exe 1636 EvilNominatusCrypto.exe 1636 EvilNominatusCrypto.exe 1636 EvilNominatusCrypto.exe 1636 EvilNominatusCrypto.exe - Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 1636 wrote to memory of 1660 1636 EvilNominatusCrypto.exe 27 PID 1636 wrote to memory of 1660 1636 EvilNominatusCrypto.exe 27 PID 1636 wrote to memory of 1660 1636 EvilNominatusCrypto.exe 27 PID 1636 wrote to memory of 1660 1636 EvilNominatusCrypto.exe 27 PID 1660 wrote to memory of 544 1660 cmd.exe 29 PID 1660 wrote to memory of 544 1660 cmd.exe 29 PID 1660 wrote to memory of 544 1660 cmd.exe 29 PID 1660 wrote to memory of 544 1660 cmd.exe 29
Processes
-
C:\Users\Admin\AppData\Local\Temp\EvilNominatusCrypto.exe"C:\Users\Admin\AppData\Local\Temp\EvilNominatusCrypto.exe"1⤵
- Modifies WinLogon for persistence
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:1636 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableRegistryTools /t REG_DWORD /d 1 /f2⤵
- Suspicious use of WriteProcessMemory
PID:1660 -
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableRegistryTools /t REG_DWORD /d 1 /f3⤵
- Modifies registry key
PID:544
-
-
-
C:\Windows\explorer.exe"C:\Windows\explorer.exe"1⤵PID:292