Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    115s
  • max time network
    118s
  • platform
    windows7_x64
  • resource
    win7-20220812-en
  • resource tags

    arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
  • submitted
    24/09/2022, 22:02

General

  • Target

    file.exe

  • Size

    284KB

  • MD5

    0f2971d01eaa04817d8b249cf92ef256

  • SHA1

    10ce251ca6f7a43c27d76b592352baa03a5ed8d0

  • SHA256

    bedaf1afc3514b562f9f12ed77db321f3fd72940c9883f9f6f837fae6992d0ce

  • SHA512

    f87cb2001c46398881a7d8bb0632afa56a3dd0a6a3f0deccddf858204d7e5cab73da5c9f6117ca0eb405a3311939bd59bcfd469f6d3d26a13e7390ec74fc364a

  • SSDEEP

    3072:xkjLhLsmMWPN57R5vPYXghTaEOX50VrWHWYGYBmzlXSlye3sKf+kLYFx33DB1B5Y:MLkWDwXgUXX50VrqbG1SLsXkW3D3w

Score
10/10

Malware Config

Extracted

Family

nymaim

C2

208.67.104.97

85.31.46.167

Signatures

  • NyMaim

    NyMaim is a malware with various capabilities written in C++ and first seen in 2013.

  • Downloads MZ/PE file
  • Executes dropped EXE 1 IoCs
  • Deletes itself 1 IoCs
  • Loads dropped DLL 1 IoCs
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Program crash 1 IoCs
  • Kills process with taskkill 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 3 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 19 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\file.exe
    "C:\Users\Admin\AppData\Local\Temp\file.exe"
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:1764
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c start /I "" "C:\Users\Admin\AppData\Local\Temp\QuOVfp5w3qJzsC71nniZyzRv\Cleaner.exe"
      2⤵
      • Loads dropped DLL
      • Suspicious use of WriteProcessMemory
      PID:1168
      • C:\Users\Admin\AppData\Local\Temp\QuOVfp5w3qJzsC71nniZyzRv\Cleaner.exe
        "C:\Users\Admin\AppData\Local\Temp\QuOVfp5w3qJzsC71nniZyzRv\Cleaner.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:664
        • C:\Windows\system32\WerFault.exe
          C:\Windows\system32\WerFault.exe -u -p 664 -s 1148
          4⤵
          • Program crash
          PID:1992
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c taskkill /im "file.exe" /f & erase "C:\Users\Admin\AppData\Local\Temp\file.exe" & exit
      2⤵
      • Deletes itself
      • Suspicious use of WriteProcessMemory
      PID:1832
      • C:\Windows\SysWOW64\taskkill.exe
        taskkill /im "file.exe" /f
        3⤵
        • Kills process with taskkill
        • Suspicious use of AdjustPrivilegeToken
        PID:1100

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\QuOVfp5w3qJzsC71nniZyzRv\Bunifu_UI_v1.5.3.dll

    Filesize

    236KB

    MD5

    2ecb51ab00c5f340380ecf849291dbcf

    SHA1

    1a4dffbce2a4ce65495ed79eab42a4da3b660931

    SHA256

    f1b3e0f2750a9103e46a6a4a34f1cf9d17779725f98042cc2475ec66484801cf

    SHA512

    e241a48eafcaf99187035f0870d24d74ae97fe84aaadd2591cceea9f64b8223d77cfb17a038a58eadd3b822c5201a6f7494f26eea6f77d95f77f6c668d088e6b

  • C:\Users\Admin\AppData\Local\Temp\QuOVfp5w3qJzsC71nniZyzRv\Cleaner.exe

    Filesize

    3.8MB

    MD5

    23c1e8f48ec06960bbd9969c1f404192

    SHA1

    b9384151eb3f2dbd095fa273c248722e1cc74ea3

    SHA256

    301d9c55653f6cd8211aafdaf130092cb7ef8ea2e54db2db97153c1c8abf272c

    SHA512

    f572e3a0ad58b3a1ed22db00b05a3909f7f53f70b84ab736e2dd6ddc54d8781fcffe4a9b33b0dd2836d438a1982b944426fe4ed01bd866bd77e20046220f2b5b

  • C:\Users\Admin\AppData\Local\Temp\QuOVfp5w3qJzsC71nniZyzRv\Cleaner.exe

    Filesize

    3.8MB

    MD5

    23c1e8f48ec06960bbd9969c1f404192

    SHA1

    b9384151eb3f2dbd095fa273c248722e1cc74ea3

    SHA256

    301d9c55653f6cd8211aafdaf130092cb7ef8ea2e54db2db97153c1c8abf272c

    SHA512

    f572e3a0ad58b3a1ed22db00b05a3909f7f53f70b84ab736e2dd6ddc54d8781fcffe4a9b33b0dd2836d438a1982b944426fe4ed01bd866bd77e20046220f2b5b

  • \Users\Admin\AppData\Local\Temp\QuOVfp5w3qJzsC71nniZyzRv\Cleaner.exe

    Filesize

    3.8MB

    MD5

    23c1e8f48ec06960bbd9969c1f404192

    SHA1

    b9384151eb3f2dbd095fa273c248722e1cc74ea3

    SHA256

    301d9c55653f6cd8211aafdaf130092cb7ef8ea2e54db2db97153c1c8abf272c

    SHA512

    f572e3a0ad58b3a1ed22db00b05a3909f7f53f70b84ab736e2dd6ddc54d8781fcffe4a9b33b0dd2836d438a1982b944426fe4ed01bd866bd77e20046220f2b5b

  • memory/664-64-0x000007FEFBF21000-0x000007FEFBF23000-memory.dmp

    Filesize

    8KB

  • memory/664-66-0x00000000020E0000-0x0000000002122000-memory.dmp

    Filesize

    264KB

  • memory/664-63-0x0000000000B60000-0x0000000000CE0000-memory.dmp

    Filesize

    1.5MB

  • memory/1764-67-0x000000000064B000-0x0000000000672000-memory.dmp

    Filesize

    156KB

  • memory/1764-54-0x0000000075BA1000-0x0000000075BA3000-memory.dmp

    Filesize

    8KB

  • memory/1764-56-0x00000000002B0000-0x00000000002EF000-memory.dmp

    Filesize

    252KB

  • memory/1764-57-0x0000000000400000-0x00000000005A1000-memory.dmp

    Filesize

    1.6MB

  • memory/1764-68-0x0000000000400000-0x00000000005A1000-memory.dmp

    Filesize

    1.6MB

  • memory/1764-70-0x0000000010000000-0x000000001001B000-memory.dmp

    Filesize

    108KB

  • memory/1764-75-0x000000000064B000-0x0000000000672000-memory.dmp

    Filesize

    156KB

  • memory/1764-76-0x0000000000400000-0x00000000005A1000-memory.dmp

    Filesize

    1.6MB

  • memory/1764-55-0x000000000064B000-0x0000000000672000-memory.dmp

    Filesize

    156KB