Analysis
-
max time kernel
187s -
max time network
197s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
04/10/2022, 18:20
Static task
static1
Behavioral task
behavioral1
Sample
file.exe
Resource
win7-20220812-en
General
-
Target
file.exe
-
Size
353KB
-
MD5
b90bf592eb12ad336d85227381f6cd97
-
SHA1
3e89a8b2cd8a7c1168b698027570dbaf4324cd36
-
SHA256
4098ed30f5e2a1d453182391fcef81703351574f6c286ac4308bf0be675de907
-
SHA512
af580dbf51df295bb5078126c062cc6dc4e8027fccc7cbb7b61c5df17a5c15c1321d43be4136dd43f75a2ad7d256cd46b7893b4af9171875c4e999921b7a5772
-
SSDEEP
6144:B4J7ELi+hv99zL+bp1Cf0pgseVPlloeYbr/uzbgwuxc1wVf:2Cm+hv99XGw+gs8P4jHunnqc
Malware Config
Extracted
nymaim
208.67.104.97
85.31.46.167
Signatures
-
Downloads MZ/PE file
-
Executes dropped EXE 1 IoCs
pid Process 4076 Cleaner.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation file.exe -
AutoIT Executable 2 IoCs
AutoIT scripts compiled to PE executables.
resource yara_rule behavioral2/files/0x000200000001e704-139.dat autoit_exe behavioral2/files/0x000200000001e704-140.dat autoit_exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 11 IoCs
pid pid_target Process procid_target 2608 1060 WerFault.exe 79 1068 1060 WerFault.exe 79 2312 1060 WerFault.exe 79 1488 1060 WerFault.exe 79 5096 1060 WerFault.exe 79 1684 1060 WerFault.exe 79 4476 1060 WerFault.exe 79 3868 1060 WerFault.exe 79 4296 1060 WerFault.exe 79 748 4076 WerFault.exe 107 3232 1060 WerFault.exe 79 -
Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 1060 file.exe 1060 file.exe 1060 file.exe 1060 file.exe 1060 file.exe 1060 file.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 1060 file.exe -
Suspicious use of WriteProcessMemory 5 IoCs
description pid Process procid_target PID 1060 wrote to memory of 952 1060 file.exe 105 PID 1060 wrote to memory of 952 1060 file.exe 105 PID 1060 wrote to memory of 952 1060 file.exe 105 PID 952 wrote to memory of 4076 952 cmd.exe 107 PID 952 wrote to memory of 4076 952 cmd.exe 107
Processes
-
C:\Users\Admin\AppData\Local\Temp\file.exe"C:\Users\Admin\AppData\Local\Temp\file.exe"1⤵
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
PID:1060 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1060 -s 4602⤵
- Program crash
PID:2608
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1060 -s 7642⤵
- Program crash
PID:1068
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1060 -s 8042⤵
- Program crash
PID:2312
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1060 -s 8042⤵
- Program crash
PID:1488
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1060 -s 8002⤵
- Program crash
PID:5096
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1060 -s 8402⤵
- Program crash
PID:1684
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1060 -s 9962⤵
- Program crash
PID:4476
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1060 -s 10482⤵
- Program crash
PID:3868
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1060 -s 13802⤵
- Program crash
PID:4296
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c start /I "" "C:\Users\Admin\AppData\Local\Temp\IRbheKW2W\Cleaner.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:952 -
C:\Users\Admin\AppData\Local\Temp\IRbheKW2W\Cleaner.exe"C:\Users\Admin\AppData\Local\Temp\IRbheKW2W\Cleaner.exe"3⤵
- Executes dropped EXE
PID:4076 -
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 4076 -s 9724⤵
- Program crash
PID:748
-
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1060 -s 13842⤵
- Program crash
PID:3232
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 1060 -ip 10601⤵PID:1452
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 1060 -ip 10601⤵PID:4500
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 1060 -ip 10601⤵PID:1064
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 1060 -ip 10601⤵PID:2176
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 1060 -ip 10601⤵PID:220
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 1060 -ip 10601⤵PID:2088
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 480 -p 1060 -ip 10601⤵PID:2680
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 1060 -ip 10601⤵PID:4424
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 1060 -ip 10601⤵PID:2132
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -pss -s 572 -p 4076 -ip 40761⤵PID:1508
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 572 -p 1060 -ip 10601⤵PID:4988
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3.8MB
MD504514bd4962f7d60679434e0ebe49184
SHA11493a5447eb8156a7d7aecff60ee8bfba2209526
SHA256c394b068aa87264419f60838a8812b750e67cf93f2494c62b9078c3708072568
SHA512a71c7ed5dfdda22f095dc99b16e8342a42e3361be16e0241dbf8983dd0d5f6e90eb0299aac1815cf78ad3a9f15fa89b42b720b7f818ee5f502300f102ef4c93e
-
Filesize
3.8MB
MD504514bd4962f7d60679434e0ebe49184
SHA11493a5447eb8156a7d7aecff60ee8bfba2209526
SHA256c394b068aa87264419f60838a8812b750e67cf93f2494c62b9078c3708072568
SHA512a71c7ed5dfdda22f095dc99b16e8342a42e3361be16e0241dbf8983dd0d5f6e90eb0299aac1815cf78ad3a9f15fa89b42b720b7f818ee5f502300f102ef4c93e