Analysis
-
max time kernel
100s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
25-09-2022 04:17
Static task
static1
Behavioral task
behavioral1
Sample
file.exe
Resource
win7-20220812-en
General
-
Target
file.exe
-
Size
284KB
-
MD5
7c8fa3a31691bc212a3903c922efbabc
-
SHA1
7e5c6794c3973a4407574e3a29bd4a4200805f69
-
SHA256
7ed19db28d8c8a77f137e6e0cd14371e0983b41ebd310ef27f427ed82a2ad71e
-
SHA512
41ea1ce1bc14d607c71efa55917ddb3611bf518250298fc098bcebeb21af627bcb993e37688218a23cbd4feafeabee121f5382c16dd6715430005f551bc0e973
-
SSDEEP
3072:3d+gsLMzdt9gN5+zrb5NYL2ae/XXbjcvoDxjHbP1PKYjZoVhawPCJTgXUBV8/Pkw:sLwX/1NYa/Xbjcv+JbP1PfloVhLPC
Malware Config
Extracted
nymaim
208.67.104.97
85.31.46.167
Signatures
-
Downloads MZ/PE file
-
Executes dropped EXE 1 IoCs
Processes:
Cleaner.exepid process 4112 Cleaner.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
file.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation file.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 12 IoCs
Processes:
WerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exepid pid_target process target process 4868 3092 WerFault.exe file.exe 4860 3092 WerFault.exe file.exe 1664 3092 WerFault.exe file.exe 1292 3092 WerFault.exe file.exe 3404 3092 WerFault.exe file.exe 1368 3092 WerFault.exe file.exe 1520 3092 WerFault.exe file.exe 2352 3092 WerFault.exe file.exe 3824 3092 WerFault.exe file.exe 1608 3092 WerFault.exe file.exe 4392 3092 WerFault.exe file.exe 3276 3092 WerFault.exe file.exe -
Kills process with taskkill 1 IoCs
Processes:
taskkill.exepid process 3880 taskkill.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
Processes:
file.exepid process 3092 file.exe 3092 file.exe 3092 file.exe 3092 file.exe 3092 file.exe 3092 file.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
file.exepid process 3092 file.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
Cleaner.exetaskkill.exedescription pid process Token: SeDebugPrivilege 4112 Cleaner.exe Token: SeDebugPrivilege 3880 taskkill.exe -
Suspicious use of WriteProcessMemory 11 IoCs
Processes:
file.execmd.execmd.exedescription pid process target process PID 3092 wrote to memory of 3540 3092 file.exe cmd.exe PID 3092 wrote to memory of 3540 3092 file.exe cmd.exe PID 3092 wrote to memory of 3540 3092 file.exe cmd.exe PID 3540 wrote to memory of 4112 3540 cmd.exe Cleaner.exe PID 3540 wrote to memory of 4112 3540 cmd.exe Cleaner.exe PID 3092 wrote to memory of 5056 3092 file.exe cmd.exe PID 3092 wrote to memory of 5056 3092 file.exe cmd.exe PID 3092 wrote to memory of 5056 3092 file.exe cmd.exe PID 5056 wrote to memory of 3880 5056 cmd.exe taskkill.exe PID 5056 wrote to memory of 3880 5056 cmd.exe taskkill.exe PID 5056 wrote to memory of 3880 5056 cmd.exe taskkill.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\file.exe"C:\Users\Admin\AppData\Local\Temp\file.exe"1⤵
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3092 -s 4562⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3092 -s 7642⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3092 -s 7642⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3092 -s 7642⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3092 -s 8122⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3092 -s 8442⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3092 -s 10002⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3092 -s 11522⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3092 -s 14162⤵
- Program crash
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c start /I "" "C:\Users\Admin\AppData\Local\Temp\JeO9x9q4\Cleaner.exe"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\JeO9x9q4\Cleaner.exe"C:\Users\Admin\AppData\Local\Temp\JeO9x9q4\Cleaner.exe"3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3092 -s 14282⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3092 -s 16722⤵
- Program crash
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c taskkill /im "file.exe" /f & erase "C:\Users\Admin\AppData\Local\Temp\file.exe" & exit2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\taskkill.exetaskkill /im "file.exe" /f3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3092 -s 4682⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 3092 -ip 30921⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 3092 -ip 30921⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 496 -p 3092 -ip 30921⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 472 -p 3092 -ip 30921⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 3092 -ip 30921⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 3092 -ip 30921⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 472 -p 3092 -ip 30921⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 556 -p 3092 -ip 30921⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 596 -p 3092 -ip 30921⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 616 -p 3092 -ip 30921⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 600 -p 3092 -ip 30921⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 652 -p 3092 -ip 30921⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\JeO9x9q4\Bunifu_UI_v1.5.3.dllFilesize
236KB
MD52ecb51ab00c5f340380ecf849291dbcf
SHA11a4dffbce2a4ce65495ed79eab42a4da3b660931
SHA256f1b3e0f2750a9103e46a6a4a34f1cf9d17779725f98042cc2475ec66484801cf
SHA512e241a48eafcaf99187035f0870d24d74ae97fe84aaadd2591cceea9f64b8223d77cfb17a038a58eadd3b822c5201a6f7494f26eea6f77d95f77f6c668d088e6b
-
C:\Users\Admin\AppData\Local\Temp\JeO9x9q4\Cleaner.exeFilesize
3.8MB
MD523c1e8f48ec06960bbd9969c1f404192
SHA1b9384151eb3f2dbd095fa273c248722e1cc74ea3
SHA256301d9c55653f6cd8211aafdaf130092cb7ef8ea2e54db2db97153c1c8abf272c
SHA512f572e3a0ad58b3a1ed22db00b05a3909f7f53f70b84ab736e2dd6ddc54d8781fcffe4a9b33b0dd2836d438a1982b944426fe4ed01bd866bd77e20046220f2b5b
-
C:\Users\Admin\AppData\Local\Temp\JeO9x9q4\Cleaner.exeFilesize
3.8MB
MD523c1e8f48ec06960bbd9969c1f404192
SHA1b9384151eb3f2dbd095fa273c248722e1cc74ea3
SHA256301d9c55653f6cd8211aafdaf130092cb7ef8ea2e54db2db97153c1c8abf272c
SHA512f572e3a0ad58b3a1ed22db00b05a3909f7f53f70b84ab736e2dd6ddc54d8781fcffe4a9b33b0dd2836d438a1982b944426fe4ed01bd866bd77e20046220f2b5b
-
memory/3092-144-0x0000000000400000-0x00000000005A1000-memory.dmpFilesize
1.6MB
-
memory/3092-133-0x00000000022F0000-0x000000000232F000-memory.dmpFilesize
252KB
-
memory/3092-134-0x0000000000400000-0x00000000005A1000-memory.dmpFilesize
1.6MB
-
memory/3092-132-0x0000000000679000-0x000000000069F000-memory.dmpFilesize
152KB
-
memory/3092-152-0x0000000000400000-0x00000000005A1000-memory.dmpFilesize
1.6MB
-
memory/3092-146-0x0000000010000000-0x000000001001B000-memory.dmpFilesize
108KB
-
memory/3092-143-0x0000000000679000-0x000000000069F000-memory.dmpFilesize
152KB
-
memory/3540-135-0x0000000000000000-mapping.dmp
-
memory/3880-151-0x0000000000000000-mapping.dmp
-
memory/4112-136-0x0000000000000000-mapping.dmp
-
memory/4112-145-0x00007FFE80CB0000-0x00007FFE81771000-memory.dmpFilesize
10.8MB
-
memory/4112-142-0x00007FFE80CB0000-0x00007FFE81771000-memory.dmpFilesize
10.8MB
-
memory/4112-141-0x0000015CA1340000-0x0000015CA1382000-memory.dmpFilesize
264KB
-
memory/4112-139-0x0000015C85C20000-0x0000015C85DA0000-memory.dmpFilesize
1.5MB
-
memory/5056-150-0x0000000000000000-mapping.dmp