Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
121s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
24/09/2022, 22:02
Static task
static1
Behavioral task
behavioral1
Sample
file.exe
Resource
win7-20220812-en
General
-
Target
file.exe
-
Size
284KB
-
MD5
0f2971d01eaa04817d8b249cf92ef256
-
SHA1
10ce251ca6f7a43c27d76b592352baa03a5ed8d0
-
SHA256
bedaf1afc3514b562f9f12ed77db321f3fd72940c9883f9f6f837fae6992d0ce
-
SHA512
f87cb2001c46398881a7d8bb0632afa56a3dd0a6a3f0deccddf858204d7e5cab73da5c9f6117ca0eb405a3311939bd59bcfd469f6d3d26a13e7390ec74fc364a
-
SSDEEP
3072:xkjLhLsmMWPN57R5vPYXghTaEOX50VrWHWYGYBmzlXSlye3sKf+kLYFx33DB1B5Y:MLkWDwXgUXX50VrqbG1SLsXkW3D3w
Malware Config
Extracted
nymaim
208.67.104.97
85.31.46.167
Signatures
-
Downloads MZ/PE file
-
Executes dropped EXE 1 IoCs
pid Process 4564 Cleaner.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation file.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 12 IoCs
pid pid_target Process procid_target 3792 4700 WerFault.exe 78 980 4700 WerFault.exe 78 3452 4700 WerFault.exe 78 5016 4700 WerFault.exe 78 4852 4700 WerFault.exe 78 4332 4700 WerFault.exe 78 1912 4700 WerFault.exe 78 1476 4700 WerFault.exe 78 2916 4564 WerFault.exe 105 1816 4700 WerFault.exe 78 2656 4700 WerFault.exe 78 4668 4700 WerFault.exe 78 -
Kills process with taskkill 1 IoCs
pid Process 1172 taskkill.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 4700 file.exe 4700 file.exe 4700 file.exe 4700 file.exe 4700 file.exe 4700 file.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 4700 file.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 1172 taskkill.exe -
Suspicious use of WriteProcessMemory 11 IoCs
description pid Process procid_target PID 4700 wrote to memory of 3028 4700 file.exe 103 PID 4700 wrote to memory of 3028 4700 file.exe 103 PID 4700 wrote to memory of 3028 4700 file.exe 103 PID 3028 wrote to memory of 4564 3028 cmd.exe 105 PID 3028 wrote to memory of 4564 3028 cmd.exe 105 PID 4700 wrote to memory of 3480 4700 file.exe 113 PID 4700 wrote to memory of 3480 4700 file.exe 113 PID 4700 wrote to memory of 3480 4700 file.exe 113 PID 3480 wrote to memory of 1172 3480 cmd.exe 117 PID 3480 wrote to memory of 1172 3480 cmd.exe 117 PID 3480 wrote to memory of 1172 3480 cmd.exe 117
Processes
-
C:\Users\Admin\AppData\Local\Temp\file.exe"C:\Users\Admin\AppData\Local\Temp\file.exe"1⤵
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
PID:4700 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4700 -s 4402⤵
- Program crash
PID:3792
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4700 -s 7722⤵
- Program crash
PID:980
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4700 -s 8002⤵
- Program crash
PID:3452
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4700 -s 8002⤵
- Program crash
PID:5016
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4700 -s 8122⤵
- Program crash
PID:4852
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4700 -s 9282⤵
- Program crash
PID:4332
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4700 -s 10002⤵
- Program crash
PID:1912
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4700 -s 9962⤵
- Program crash
PID:1476
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c start /I "" "C:\Users\Admin\AppData\Local\Temp\89aiLif3\Cleaner.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:3028 -
C:\Users\Admin\AppData\Local\Temp\89aiLif3\Cleaner.exe"C:\Users\Admin\AppData\Local\Temp\89aiLif3\Cleaner.exe"3⤵
- Executes dropped EXE
PID:4564 -
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 4564 -s 9764⤵
- Program crash
PID:2916
-
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4700 -s 14042⤵
- Program crash
PID:1816
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4700 -s 17402⤵
- Program crash
PID:2656
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c taskkill /im "file.exe" /f & erase "C:\Users\Admin\AppData\Local\Temp\file.exe" & exit2⤵
- Suspicious use of WriteProcessMemory
PID:3480 -
C:\Windows\SysWOW64\taskkill.exetaskkill /im "file.exe" /f3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1172
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4700 -s 4922⤵
- Program crash
PID:4668
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4700 -ip 47001⤵PID:3740
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 4700 -ip 47001⤵PID:4304
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 4700 -ip 47001⤵PID:4880
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 4700 -ip 47001⤵PID:2976
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 4700 -ip 47001⤵PID:4784
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 4700 -ip 47001⤵PID:4824
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4700 -ip 47001⤵PID:1256
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 4700 -ip 47001⤵PID:4780
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -pss -s 520 -p 4564 -ip 45641⤵PID:3800
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 4700 -ip 47001⤵PID:2044
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 476 -p 4700 -ip 47001⤵PID:1860
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 600 -p 4700 -ip 47001⤵PID:3112
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3.8MB
MD523c1e8f48ec06960bbd9969c1f404192
SHA1b9384151eb3f2dbd095fa273c248722e1cc74ea3
SHA256301d9c55653f6cd8211aafdaf130092cb7ef8ea2e54db2db97153c1c8abf272c
SHA512f572e3a0ad58b3a1ed22db00b05a3909f7f53f70b84ab736e2dd6ddc54d8781fcffe4a9b33b0dd2836d438a1982b944426fe4ed01bd866bd77e20046220f2b5b
-
Filesize
3.8MB
MD523c1e8f48ec06960bbd9969c1f404192
SHA1b9384151eb3f2dbd095fa273c248722e1cc74ea3
SHA256301d9c55653f6cd8211aafdaf130092cb7ef8ea2e54db2db97153c1c8abf272c
SHA512f572e3a0ad58b3a1ed22db00b05a3909f7f53f70b84ab736e2dd6ddc54d8781fcffe4a9b33b0dd2836d438a1982b944426fe4ed01bd866bd77e20046220f2b5b