Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    144s
  • max time network
    147s
  • platform
    windows7_x64
  • resource
    win7-20220812-en
  • resource tags

    arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
  • submitted
    24/09/2022, 13:42

General

  • Target

    file.exe

  • Size

    284KB

  • MD5

    5cd9388b0e60981c36bc0553a1ca540a

  • SHA1

    3227b002a4f6b6e0b1962ca395133b1dc8c77e84

  • SHA256

    4ccaf0fd0ebf9417aae0e341166b21f3429908e3710d1c745344c399893cb669

  • SHA512

    7d820dc13a8d8ca8d4798038b1d94122615c5b5f413f9c5de41eb2692ed0a512a6266751d12e8084b20f06ccc7e44f374f471a746c20287a98218b3a357126cc

  • SSDEEP

    3072:FJOaLxo02cb5wPpkxYlpkqYSegeCgdLQjNHg7RA+zVRCnWPaVZdiuhz82Dk+Exx1:fLd2VBl3HgNQjF+zV8WPG5Fw+qx32AY

Score
10/10

Malware Config

Extracted

Family

nymaim

C2

208.67.104.97

85.31.46.167

Signatures

  • NyMaim

    NyMaim is a malware with various capabilities written in C++ and first seen in 2013.

  • Downloads MZ/PE file
  • Executes dropped EXE 1 IoCs
  • Deletes itself 1 IoCs
  • Loads dropped DLL 1 IoCs
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Program crash 1 IoCs
  • Kills process with taskkill 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 3 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 19 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\file.exe
    "C:\Users\Admin\AppData\Local\Temp\file.exe"
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:1088
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c start /I "" "C:\Users\Admin\AppData\Local\Temp\h1g35uTkizn\Cleaner.exe"
      2⤵
      • Loads dropped DLL
      • Suspicious use of WriteProcessMemory
      PID:764
      • C:\Users\Admin\AppData\Local\Temp\h1g35uTkizn\Cleaner.exe
        "C:\Users\Admin\AppData\Local\Temp\h1g35uTkizn\Cleaner.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:572
        • C:\Windows\system32\WerFault.exe
          C:\Windows\system32\WerFault.exe -u -p 572 -s 1156
          4⤵
          • Program crash
          PID:1972
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c taskkill /im "file.exe" /f & erase "C:\Users\Admin\AppData\Local\Temp\file.exe" & exit
      2⤵
      • Deletes itself
      • Suspicious use of WriteProcessMemory
      PID:1752
      • C:\Windows\SysWOW64\taskkill.exe
        taskkill /im "file.exe" /f
        3⤵
        • Kills process with taskkill
        • Suspicious use of AdjustPrivilegeToken
        PID:1748

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\h1g35uTkizn\Bunifu_UI_v1.5.3.dll

    Filesize

    236KB

    MD5

    2ecb51ab00c5f340380ecf849291dbcf

    SHA1

    1a4dffbce2a4ce65495ed79eab42a4da3b660931

    SHA256

    f1b3e0f2750a9103e46a6a4a34f1cf9d17779725f98042cc2475ec66484801cf

    SHA512

    e241a48eafcaf99187035f0870d24d74ae97fe84aaadd2591cceea9f64b8223d77cfb17a038a58eadd3b822c5201a6f7494f26eea6f77d95f77f6c668d088e6b

  • C:\Users\Admin\AppData\Local\Temp\h1g35uTkizn\Cleaner.exe

    Filesize

    3.8MB

    MD5

    23c1e8f48ec06960bbd9969c1f404192

    SHA1

    b9384151eb3f2dbd095fa273c248722e1cc74ea3

    SHA256

    301d9c55653f6cd8211aafdaf130092cb7ef8ea2e54db2db97153c1c8abf272c

    SHA512

    f572e3a0ad58b3a1ed22db00b05a3909f7f53f70b84ab736e2dd6ddc54d8781fcffe4a9b33b0dd2836d438a1982b944426fe4ed01bd866bd77e20046220f2b5b

  • C:\Users\Admin\AppData\Local\Temp\h1g35uTkizn\Cleaner.exe

    Filesize

    3.8MB

    MD5

    23c1e8f48ec06960bbd9969c1f404192

    SHA1

    b9384151eb3f2dbd095fa273c248722e1cc74ea3

    SHA256

    301d9c55653f6cd8211aafdaf130092cb7ef8ea2e54db2db97153c1c8abf272c

    SHA512

    f572e3a0ad58b3a1ed22db00b05a3909f7f53f70b84ab736e2dd6ddc54d8781fcffe4a9b33b0dd2836d438a1982b944426fe4ed01bd866bd77e20046220f2b5b

  • \Users\Admin\AppData\Local\Temp\h1g35uTkizn\Cleaner.exe

    Filesize

    3.8MB

    MD5

    23c1e8f48ec06960bbd9969c1f404192

    SHA1

    b9384151eb3f2dbd095fa273c248722e1cc74ea3

    SHA256

    301d9c55653f6cd8211aafdaf130092cb7ef8ea2e54db2db97153c1c8abf272c

    SHA512

    f572e3a0ad58b3a1ed22db00b05a3909f7f53f70b84ab736e2dd6ddc54d8781fcffe4a9b33b0dd2836d438a1982b944426fe4ed01bd866bd77e20046220f2b5b

  • memory/572-63-0x0000000000940000-0x0000000000AC0000-memory.dmp

    Filesize

    1.5MB

  • memory/572-68-0x0000000000590000-0x00000000005D2000-memory.dmp

    Filesize

    264KB

  • memory/572-66-0x000007FEFC431000-0x000007FEFC433000-memory.dmp

    Filesize

    8KB

  • memory/1088-64-0x00000000002AB000-0x00000000002D2000-memory.dmp

    Filesize

    156KB

  • memory/1088-54-0x0000000076681000-0x0000000076683000-memory.dmp

    Filesize

    8KB

  • memory/1088-65-0x0000000000400000-0x00000000005A1000-memory.dmp

    Filesize

    1.6MB

  • memory/1088-57-0x0000000000400000-0x00000000005A1000-memory.dmp

    Filesize

    1.6MB

  • memory/1088-56-0x00000000005B0000-0x00000000005EF000-memory.dmp

    Filesize

    252KB

  • memory/1088-55-0x00000000002AB000-0x00000000002D2000-memory.dmp

    Filesize

    156KB

  • memory/1088-70-0x0000000010000000-0x000000001001B000-memory.dmp

    Filesize

    108KB

  • memory/1088-75-0x00000000002AB000-0x00000000002D2000-memory.dmp

    Filesize

    156KB

  • memory/1088-76-0x0000000000400000-0x00000000005A1000-memory.dmp

    Filesize

    1.6MB