Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    118s
  • max time network
    120s
  • platform
    windows7_x64
  • resource
    win7-20220812-en
  • resource tags

    arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
  • submitted
    23/09/2022, 22:28

General

  • Target

    file.exe

  • Size

    275KB

  • MD5

    795c64cb86bb41b400ef54d253b0ea89

  • SHA1

    c467e9b37e8554e9a8882d3eb1e2796bf387412f

  • SHA256

    2f45b8aae288b3abbbb7ed8d9ecfa3ae435920d295480b537e2fd6a00a144d21

  • SHA512

    3f0581fe8cb910eafe58bb75cc09014955d810fb80255337eac6437e80ed6021397ba04016743f1d295e0c5b3739e4c6564635fedb56b0892a5074868420e083

  • SSDEEP

    3072:z+M8SsL6u3IIE75ixwGsvn9rT7sUnWThyILYSxRbBJAD7LFsylNoChrXOBfeE/P:0L7E41svhT7s0WYI9xRb+7maoCdXKe

Score
10/10

Malware Config

Extracted

Family

nymaim

C2

208.67.104.97

85.31.46.167

Signatures

  • NyMaim

    NyMaim is a malware with various capabilities written in C++ and first seen in 2013.

  • Downloads MZ/PE file
  • Executes dropped EXE 1 IoCs
  • Deletes itself 1 IoCs
  • Loads dropped DLL 1 IoCs
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Program crash 1 IoCs
  • Kills process with taskkill 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 3 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 19 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\file.exe
    "C:\Users\Admin\AppData\Local\Temp\file.exe"
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:1300
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c start /I "" "C:\Users\Admin\AppData\Local\Temp\SamSAhw6IXt4Rs8NDoCOeVNi9\Cleaner.exe"
      2⤵
      • Loads dropped DLL
      • Suspicious use of WriteProcessMemory
      PID:980
      • C:\Users\Admin\AppData\Local\Temp\SamSAhw6IXt4Rs8NDoCOeVNi9\Cleaner.exe
        "C:\Users\Admin\AppData\Local\Temp\SamSAhw6IXt4Rs8NDoCOeVNi9\Cleaner.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:1612
        • C:\Windows\system32\WerFault.exe
          C:\Windows\system32\WerFault.exe -u -p 1612 -s 1152
          4⤵
          • Program crash
          PID:552
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c taskkill /im "file.exe" /f & erase "C:\Users\Admin\AppData\Local\Temp\file.exe" & exit
      2⤵
      • Deletes itself
      • Suspicious use of WriteProcessMemory
      PID:756
      • C:\Windows\SysWOW64\taskkill.exe
        taskkill /im "file.exe" /f
        3⤵
        • Kills process with taskkill
        • Suspicious use of AdjustPrivilegeToken
        PID:1592

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\SamSAhw6IXt4Rs8NDoCOeVNi9\Bunifu_UI_v1.5.3.dll

    Filesize

    236KB

    MD5

    2ecb51ab00c5f340380ecf849291dbcf

    SHA1

    1a4dffbce2a4ce65495ed79eab42a4da3b660931

    SHA256

    f1b3e0f2750a9103e46a6a4a34f1cf9d17779725f98042cc2475ec66484801cf

    SHA512

    e241a48eafcaf99187035f0870d24d74ae97fe84aaadd2591cceea9f64b8223d77cfb17a038a58eadd3b822c5201a6f7494f26eea6f77d95f77f6c668d088e6b

  • C:\Users\Admin\AppData\Local\Temp\SamSAhw6IXt4Rs8NDoCOeVNi9\Cleaner.exe

    Filesize

    3.8MB

    MD5

    23c1e8f48ec06960bbd9969c1f404192

    SHA1

    b9384151eb3f2dbd095fa273c248722e1cc74ea3

    SHA256

    301d9c55653f6cd8211aafdaf130092cb7ef8ea2e54db2db97153c1c8abf272c

    SHA512

    f572e3a0ad58b3a1ed22db00b05a3909f7f53f70b84ab736e2dd6ddc54d8781fcffe4a9b33b0dd2836d438a1982b944426fe4ed01bd866bd77e20046220f2b5b

  • C:\Users\Admin\AppData\Local\Temp\SamSAhw6IXt4Rs8NDoCOeVNi9\Cleaner.exe

    Filesize

    3.8MB

    MD5

    23c1e8f48ec06960bbd9969c1f404192

    SHA1

    b9384151eb3f2dbd095fa273c248722e1cc74ea3

    SHA256

    301d9c55653f6cd8211aafdaf130092cb7ef8ea2e54db2db97153c1c8abf272c

    SHA512

    f572e3a0ad58b3a1ed22db00b05a3909f7f53f70b84ab736e2dd6ddc54d8781fcffe4a9b33b0dd2836d438a1982b944426fe4ed01bd866bd77e20046220f2b5b

  • \Users\Admin\AppData\Local\Temp\SamSAhw6IXt4Rs8NDoCOeVNi9\Cleaner.exe

    Filesize

    3.8MB

    MD5

    23c1e8f48ec06960bbd9969c1f404192

    SHA1

    b9384151eb3f2dbd095fa273c248722e1cc74ea3

    SHA256

    301d9c55653f6cd8211aafdaf130092cb7ef8ea2e54db2db97153c1c8abf272c

    SHA512

    f572e3a0ad58b3a1ed22db00b05a3909f7f53f70b84ab736e2dd6ddc54d8781fcffe4a9b33b0dd2836d438a1982b944426fe4ed01bd866bd77e20046220f2b5b

  • memory/1300-55-0x000000000026B000-0x0000000000292000-memory.dmp

    Filesize

    156KB

  • memory/1300-75-0x000000000026B000-0x0000000000292000-memory.dmp

    Filesize

    156KB

  • memory/1300-64-0x000000000026B000-0x0000000000292000-memory.dmp

    Filesize

    156KB

  • memory/1300-65-0x0000000000400000-0x000000000059F000-memory.dmp

    Filesize

    1.6MB

  • memory/1300-76-0x0000000000400000-0x000000000059F000-memory.dmp

    Filesize

    1.6MB

  • memory/1300-57-0x0000000000400000-0x000000000059F000-memory.dmp

    Filesize

    1.6MB

  • memory/1300-56-0x00000000003C0000-0x00000000003FF000-memory.dmp

    Filesize

    252KB

  • memory/1300-54-0x0000000074F41000-0x0000000074F43000-memory.dmp

    Filesize

    8KB

  • memory/1300-70-0x0000000010000000-0x000000001001B000-memory.dmp

    Filesize

    108KB

  • memory/1612-68-0x00000000003D0000-0x0000000000412000-memory.dmp

    Filesize

    264KB

  • memory/1612-66-0x000007FEFBAE1000-0x000007FEFBAE3000-memory.dmp

    Filesize

    8KB

  • memory/1612-63-0x0000000000250000-0x00000000003D0000-memory.dmp

    Filesize

    1.5MB