Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    121s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220812-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
  • submitted
    24/09/2022, 22:02

General

  • Target

    file.exe

  • Size

    284KB

  • MD5

    0f2971d01eaa04817d8b249cf92ef256

  • SHA1

    10ce251ca6f7a43c27d76b592352baa03a5ed8d0

  • SHA256

    bedaf1afc3514b562f9f12ed77db321f3fd72940c9883f9f6f837fae6992d0ce

  • SHA512

    f87cb2001c46398881a7d8bb0632afa56a3dd0a6a3f0deccddf858204d7e5cab73da5c9f6117ca0eb405a3311939bd59bcfd469f6d3d26a13e7390ec74fc364a

  • SSDEEP

    3072:xkjLhLsmMWPN57R5vPYXghTaEOX50VrWHWYGYBmzlXSlye3sKf+kLYFx33DB1B5Y:MLkWDwXgUXX50VrqbG1SLsXkW3D3w

Score
10/10

Malware Config

Extracted

Family

nymaim

C2

208.67.104.97

85.31.46.167

Signatures

  • NyMaim

    NyMaim is a malware with various capabilities written in C++ and first seen in 2013.

  • Downloads MZ/PE file
  • Executes dropped EXE 1 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Program crash 12 IoCs
  • Kills process with taskkill 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 11 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\file.exe
    "C:\Users\Admin\AppData\Local\Temp\file.exe"
    1⤵
    • Checks computer location settings
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of WriteProcessMemory
    PID:4700
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4700 -s 440
      2⤵
      • Program crash
      PID:3792
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4700 -s 772
      2⤵
      • Program crash
      PID:980
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4700 -s 800
      2⤵
      • Program crash
      PID:3452
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4700 -s 800
      2⤵
      • Program crash
      PID:5016
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4700 -s 812
      2⤵
      • Program crash
      PID:4852
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4700 -s 928
      2⤵
      • Program crash
      PID:4332
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4700 -s 1000
      2⤵
      • Program crash
      PID:1912
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4700 -s 996
      2⤵
      • Program crash
      PID:1476
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c start /I "" "C:\Users\Admin\AppData\Local\Temp\89aiLif3\Cleaner.exe"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:3028
      • C:\Users\Admin\AppData\Local\Temp\89aiLif3\Cleaner.exe
        "C:\Users\Admin\AppData\Local\Temp\89aiLif3\Cleaner.exe"
        3⤵
        • Executes dropped EXE
        PID:4564
        • C:\Windows\system32\WerFault.exe
          C:\Windows\system32\WerFault.exe -u -p 4564 -s 976
          4⤵
          • Program crash
          PID:2916
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4700 -s 1404
      2⤵
      • Program crash
      PID:1816
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4700 -s 1740
      2⤵
      • Program crash
      PID:2656
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c taskkill /im "file.exe" /f & erase "C:\Users\Admin\AppData\Local\Temp\file.exe" & exit
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:3480
      • C:\Windows\SysWOW64\taskkill.exe
        taskkill /im "file.exe" /f
        3⤵
        • Kills process with taskkill
        • Suspicious use of AdjustPrivilegeToken
        PID:1172
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4700 -s 492
      2⤵
      • Program crash
      PID:4668
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4700 -ip 4700
    1⤵
      PID:3740
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 4700 -ip 4700
      1⤵
        PID:4304
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 4700 -ip 4700
        1⤵
          PID:4880
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 4700 -ip 4700
          1⤵
            PID:2976
          • C:\Windows\SysWOW64\WerFault.exe
            C:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 4700 -ip 4700
            1⤵
              PID:4784
            • C:\Windows\SysWOW64\WerFault.exe
              C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 4700 -ip 4700
              1⤵
                PID:4824
              • C:\Windows\SysWOW64\WerFault.exe
                C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4700 -ip 4700
                1⤵
                  PID:1256
                • C:\Windows\SysWOW64\WerFault.exe
                  C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 4700 -ip 4700
                  1⤵
                    PID:4780
                  • C:\Windows\system32\WerFault.exe
                    C:\Windows\system32\WerFault.exe -pss -s 520 -p 4564 -ip 4564
                    1⤵
                      PID:3800
                    • C:\Windows\SysWOW64\WerFault.exe
                      C:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 4700 -ip 4700
                      1⤵
                        PID:2044
                      • C:\Windows\SysWOW64\WerFault.exe
                        C:\Windows\SysWOW64\WerFault.exe -pss -s 476 -p 4700 -ip 4700
                        1⤵
                          PID:1860
                        • C:\Windows\SysWOW64\WerFault.exe
                          C:\Windows\SysWOW64\WerFault.exe -pss -s 600 -p 4700 -ip 4700
                          1⤵
                            PID:3112

                          Network

                          MITRE ATT&CK Enterprise v6

                          Replay Monitor

                          Loading Replay Monitor...

                          Downloads

                          • C:\Users\Admin\AppData\Local\Temp\89aiLif3\Cleaner.exe

                            Filesize

                            3.8MB

                            MD5

                            23c1e8f48ec06960bbd9969c1f404192

                            SHA1

                            b9384151eb3f2dbd095fa273c248722e1cc74ea3

                            SHA256

                            301d9c55653f6cd8211aafdaf130092cb7ef8ea2e54db2db97153c1c8abf272c

                            SHA512

                            f572e3a0ad58b3a1ed22db00b05a3909f7f53f70b84ab736e2dd6ddc54d8781fcffe4a9b33b0dd2836d438a1982b944426fe4ed01bd866bd77e20046220f2b5b

                          • C:\Users\Admin\AppData\Local\Temp\89aiLif3\Cleaner.exe

                            Filesize

                            3.8MB

                            MD5

                            23c1e8f48ec06960bbd9969c1f404192

                            SHA1

                            b9384151eb3f2dbd095fa273c248722e1cc74ea3

                            SHA256

                            301d9c55653f6cd8211aafdaf130092cb7ef8ea2e54db2db97153c1c8abf272c

                            SHA512

                            f572e3a0ad58b3a1ed22db00b05a3909f7f53f70b84ab736e2dd6ddc54d8781fcffe4a9b33b0dd2836d438a1982b944426fe4ed01bd866bd77e20046220f2b5b

                          • memory/4564-141-0x00007FF8D0180000-0x00007FF8D0C41000-memory.dmp

                            Filesize

                            10.8MB

                          • memory/4564-140-0x000001BD24760000-0x000001BD248E0000-memory.dmp

                            Filesize

                            1.5MB

                          • memory/4564-142-0x00007FF8D0180000-0x00007FF8D0C41000-memory.dmp

                            Filesize

                            10.8MB

                          • memory/4700-135-0x0000000000400000-0x00000000005A1000-memory.dmp

                            Filesize

                            1.6MB

                          • memory/4700-132-0x0000000000629000-0x000000000064F000-memory.dmp

                            Filesize

                            152KB

                          • memory/4700-143-0x0000000010000000-0x000000001001B000-memory.dmp

                            Filesize

                            108KB

                          • memory/4700-134-0x0000000000400000-0x00000000005A1000-memory.dmp

                            Filesize

                            1.6MB

                          • memory/4700-133-0x00000000022E0000-0x000000000231F000-memory.dmp

                            Filesize

                            252KB

                          • memory/4700-149-0x0000000000400000-0x00000000005A1000-memory.dmp

                            Filesize

                            1.6MB