Analysis
-
max time kernel
119s -
max time network
124s -
platform
windows7_x64 -
resource
win7-20220901-en -
resource tags
arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system -
submitted
03-10-2022 07:37
Static task
static1
Behavioral task
behavioral1
Sample
file.exe
Resource
win7-20220901-en
General
-
Target
file.exe
-
Size
220KB
-
MD5
5ad8f4a88035e5e94787e34004b0e58c
-
SHA1
998908ccbf798430c268c4f4ff2fd5c8db07c142
-
SHA256
5d59918ce4a82077f71fa248bf45aea8b1937adbbafd5cf0d1c518799007acfb
-
SHA512
5b6945ac9c6f961fa289fb31b198a5a651c72b139f76b708fdb98c1eedc0df9eb5368f87f573254d0a1f7051f333dd6143a5e0672cf1d1c5a82dd416fb1e6a24
-
SSDEEP
3072:9BbhegORVLV/xlGqg56+Ua3WWakts8DH/RMt03IXCmYvRGe31kntVP+paM5utMHl:9ehJl0GaNDhetEyCHvRGeFwPBIuS
Malware Config
Extracted
nymaim
208.67.104.97
85.31.46.167
Signatures
-
Downloads MZ/PE file
-
Executes dropped EXE 1 IoCs
Processes:
Cleaner.exepid process 708 Cleaner.exe -
Deletes itself 1 IoCs
Processes:
cmd.exepid process 2004 cmd.exe -
Loads dropped DLL 1 IoCs
Processes:
cmd.exepid process 1716 cmd.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs
-
AutoIT Executable 3 IoCs
AutoIT scripts compiled to PE executables.
Processes:
resource yara_rule \Users\Admin\AppData\Local\Temp\cmHO5jLZY\Cleaner.exe autoit_exe C:\Users\Admin\AppData\Local\Temp\cmHO5jLZY\Cleaner.exe autoit_exe C:\Users\Admin\AppData\Local\Temp\cmHO5jLZY\Cleaner.exe autoit_exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 1316 708 WerFault.exe Cleaner.exe -
Kills process with taskkill 1 IoCs
Processes:
taskkill.exepid process 1556 taskkill.exe -
Suspicious behavior: EnumeratesProcesses 3 IoCs
Processes:
file.exepid process 1552 file.exe 1552 file.exe 1552 file.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
Cleaner.exetaskkill.exedescription pid process Token: SeDebugPrivilege 708 Cleaner.exe Token: SeDebugPrivilege 1556 taskkill.exe -
Suspicious use of WriteProcessMemory 19 IoCs
Processes:
file.execmd.exeCleaner.execmd.exedescription pid process target process PID 1552 wrote to memory of 1716 1552 file.exe cmd.exe PID 1552 wrote to memory of 1716 1552 file.exe cmd.exe PID 1552 wrote to memory of 1716 1552 file.exe cmd.exe PID 1552 wrote to memory of 1716 1552 file.exe cmd.exe PID 1716 wrote to memory of 708 1716 cmd.exe Cleaner.exe PID 1716 wrote to memory of 708 1716 cmd.exe Cleaner.exe PID 1716 wrote to memory of 708 1716 cmd.exe Cleaner.exe PID 1716 wrote to memory of 708 1716 cmd.exe Cleaner.exe PID 708 wrote to memory of 1316 708 Cleaner.exe WerFault.exe PID 708 wrote to memory of 1316 708 Cleaner.exe WerFault.exe PID 708 wrote to memory of 1316 708 Cleaner.exe WerFault.exe PID 1552 wrote to memory of 2004 1552 file.exe cmd.exe PID 1552 wrote to memory of 2004 1552 file.exe cmd.exe PID 1552 wrote to memory of 2004 1552 file.exe cmd.exe PID 1552 wrote to memory of 2004 1552 file.exe cmd.exe PID 2004 wrote to memory of 1556 2004 cmd.exe taskkill.exe PID 2004 wrote to memory of 1556 2004 cmd.exe taskkill.exe PID 2004 wrote to memory of 1556 2004 cmd.exe taskkill.exe PID 2004 wrote to memory of 1556 2004 cmd.exe taskkill.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\file.exe"C:\Users\Admin\AppData\Local\Temp\file.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c start /I "" "C:\Users\Admin\AppData\Local\Temp\cmHO5jLZY\Cleaner.exe"2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\cmHO5jLZY\Cleaner.exe"C:\Users\Admin\AppData\Local\Temp\cmHO5jLZY\Cleaner.exe"3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 708 -s 11484⤵
- Program crash
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c taskkill /im "file.exe" /f & erase "C:\Users\Admin\AppData\Local\Temp\file.exe" & exit2⤵
- Deletes itself
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\taskkill.exetaskkill /im "file.exe" /f3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\cmHO5jLZY\Bunifu_UI_v1.5.3.dllFilesize
236KB
MD52ecb51ab00c5f340380ecf849291dbcf
SHA11a4dffbce2a4ce65495ed79eab42a4da3b660931
SHA256f1b3e0f2750a9103e46a6a4a34f1cf9d17779725f98042cc2475ec66484801cf
SHA512e241a48eafcaf99187035f0870d24d74ae97fe84aaadd2591cceea9f64b8223d77cfb17a038a58eadd3b822c5201a6f7494f26eea6f77d95f77f6c668d088e6b
-
C:\Users\Admin\AppData\Local\Temp\cmHO5jLZY\Cleaner.exeFilesize
3.8MB
MD504514bd4962f7d60679434e0ebe49184
SHA11493a5447eb8156a7d7aecff60ee8bfba2209526
SHA256c394b068aa87264419f60838a8812b750e67cf93f2494c62b9078c3708072568
SHA512a71c7ed5dfdda22f095dc99b16e8342a42e3361be16e0241dbf8983dd0d5f6e90eb0299aac1815cf78ad3a9f15fa89b42b720b7f818ee5f502300f102ef4c93e
-
C:\Users\Admin\AppData\Local\Temp\cmHO5jLZY\Cleaner.exeFilesize
3.8MB
MD504514bd4962f7d60679434e0ebe49184
SHA11493a5447eb8156a7d7aecff60ee8bfba2209526
SHA256c394b068aa87264419f60838a8812b750e67cf93f2494c62b9078c3708072568
SHA512a71c7ed5dfdda22f095dc99b16e8342a42e3361be16e0241dbf8983dd0d5f6e90eb0299aac1815cf78ad3a9f15fa89b42b720b7f818ee5f502300f102ef4c93e
-
\Users\Admin\AppData\Local\Temp\cmHO5jLZY\Cleaner.exeFilesize
3.8MB
MD504514bd4962f7d60679434e0ebe49184
SHA11493a5447eb8156a7d7aecff60ee8bfba2209526
SHA256c394b068aa87264419f60838a8812b750e67cf93f2494c62b9078c3708072568
SHA512a71c7ed5dfdda22f095dc99b16e8342a42e3361be16e0241dbf8983dd0d5f6e90eb0299aac1815cf78ad3a9f15fa89b42b720b7f818ee5f502300f102ef4c93e
-
memory/708-64-0x000007FEFBB71000-0x000007FEFBB73000-memory.dmpFilesize
8KB
-
memory/708-63-0x00000000012E0000-0x0000000001436000-memory.dmpFilesize
1.3MB
-
memory/708-60-0x0000000000000000-mapping.dmp
-
memory/708-66-0x0000000001200000-0x0000000001242000-memory.dmpFilesize
264KB
-
memory/1316-69-0x0000000000000000-mapping.dmp
-
memory/1552-55-0x000000000073D000-0x0000000000764000-memory.dmpFilesize
156KB
-
memory/1552-54-0x0000000075681000-0x0000000075683000-memory.dmpFilesize
8KB
-
memory/1552-56-0x0000000000220000-0x000000000025F000-memory.dmpFilesize
252KB
-
memory/1552-67-0x000000000073D000-0x0000000000764000-memory.dmpFilesize
156KB
-
memory/1552-68-0x0000000000400000-0x0000000000594000-memory.dmpFilesize
1.6MB
-
memory/1552-57-0x0000000000400000-0x0000000000594000-memory.dmpFilesize
1.6MB
-
memory/1552-70-0x0000000010000000-0x000000001001B000-memory.dmpFilesize
108KB
-
memory/1552-75-0x0000000000400000-0x0000000000594000-memory.dmpFilesize
1.6MB
-
memory/1556-76-0x0000000000000000-mapping.dmp
-
memory/1716-58-0x0000000000000000-mapping.dmp
-
memory/2004-74-0x0000000000000000-mapping.dmp