Analysis
-
max time kernel
140s -
max time network
143s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
05/10/2022, 15:12
Static task
static1
Behavioral task
behavioral1
Sample
file.exe
Resource
win7-20220812-en
General
-
Target
file.exe
-
Size
367KB
-
MD5
a65f292880c2e8eb18d8b3f8686c9ed6
-
SHA1
22cda93e3435130c76e5afb591815b1e67d9eb50
-
SHA256
a120a87049bbc78fe6651ee4b9602c5cc05666e1a7db4ac8e53c0ecbc2fd06e7
-
SHA512
518153a542e15e589d51172ea53ab1e8bb502f14526175e60461a4f17bc1ae58507c5f1433e9d2bfb5164c6caabbabd0d17602eb5870f76faeb4c1b9c145d3a4
-
SSDEEP
6144:sRFGKkqeLCPp0Cz2nx14kr26ZAE+q67xrc49sFpYUuzbgwuhvbAwwVfU:sRoqe2Pp0CCnxHr2xE+q74Opunnm8Y
Malware Config
Extracted
nymaim
208.67.104.97
85.31.46.167
Signatures
-
Downloads MZ/PE file
-
Executes dropped EXE 1 IoCs
pid Process 968 Cleaner.exe -
Deletes itself 1 IoCs
pid Process 608 cmd.exe -
Loads dropped DLL 1 IoCs
pid Process 1924 cmd.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs
-
AutoIT Executable 3 IoCs
AutoIT scripts compiled to PE executables.
resource yara_rule behavioral1/files/0x000a000000012322-61.dat autoit_exe behavioral1/files/0x000a000000012322-63.dat autoit_exe behavioral1/files/0x000a000000012322-64.dat autoit_exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 1 IoCs
pid pid_target Process procid_target 1088 968 WerFault.exe 32 -
Kills process with taskkill 1 IoCs
pid Process 556 taskkill.exe -
Suspicious behavior: EnumeratesProcesses 3 IoCs
pid Process 1644 file.exe 1644 file.exe 1644 file.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 1644 file.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 968 Cleaner.exe Token: SeDebugPrivilege 556 taskkill.exe -
Suspicious use of WriteProcessMemory 19 IoCs
description pid Process procid_target PID 1644 wrote to memory of 1924 1644 file.exe 30 PID 1644 wrote to memory of 1924 1644 file.exe 30 PID 1644 wrote to memory of 1924 1644 file.exe 30 PID 1644 wrote to memory of 1924 1644 file.exe 30 PID 1924 wrote to memory of 968 1924 cmd.exe 32 PID 1924 wrote to memory of 968 1924 cmd.exe 32 PID 1924 wrote to memory of 968 1924 cmd.exe 32 PID 1924 wrote to memory of 968 1924 cmd.exe 32 PID 968 wrote to memory of 1088 968 Cleaner.exe 34 PID 968 wrote to memory of 1088 968 Cleaner.exe 34 PID 968 wrote to memory of 1088 968 Cleaner.exe 34 PID 1644 wrote to memory of 608 1644 file.exe 35 PID 1644 wrote to memory of 608 1644 file.exe 35 PID 1644 wrote to memory of 608 1644 file.exe 35 PID 1644 wrote to memory of 608 1644 file.exe 35 PID 608 wrote to memory of 556 608 cmd.exe 37 PID 608 wrote to memory of 556 608 cmd.exe 37 PID 608 wrote to memory of 556 608 cmd.exe 37 PID 608 wrote to memory of 556 608 cmd.exe 37
Processes
-
C:\Users\Admin\AppData\Local\Temp\file.exe"C:\Users\Admin\AppData\Local\Temp\file.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
PID:1644 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c start /I "" "C:\Users\Admin\AppData\Local\Temp\Wf4qQVhuUgwre\Cleaner.exe"2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1924 -
C:\Users\Admin\AppData\Local\Temp\Wf4qQVhuUgwre\Cleaner.exe"C:\Users\Admin\AppData\Local\Temp\Wf4qQVhuUgwre\Cleaner.exe"3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:968 -
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 968 -s 11444⤵
- Program crash
PID:1088
-
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c taskkill /im "file.exe" /f & erase "C:\Users\Admin\AppData\Local\Temp\file.exe" & exit2⤵
- Deletes itself
- Suspicious use of WriteProcessMemory
PID:608 -
C:\Windows\SysWOW64\taskkill.exetaskkill /im "file.exe" /f3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:556
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
236KB
MD52ecb51ab00c5f340380ecf849291dbcf
SHA11a4dffbce2a4ce65495ed79eab42a4da3b660931
SHA256f1b3e0f2750a9103e46a6a4a34f1cf9d17779725f98042cc2475ec66484801cf
SHA512e241a48eafcaf99187035f0870d24d74ae97fe84aaadd2591cceea9f64b8223d77cfb17a038a58eadd3b822c5201a6f7494f26eea6f77d95f77f6c668d088e6b
-
Filesize
3.8MB
MD504514bd4962f7d60679434e0ebe49184
SHA11493a5447eb8156a7d7aecff60ee8bfba2209526
SHA256c394b068aa87264419f60838a8812b750e67cf93f2494c62b9078c3708072568
SHA512a71c7ed5dfdda22f095dc99b16e8342a42e3361be16e0241dbf8983dd0d5f6e90eb0299aac1815cf78ad3a9f15fa89b42b720b7f818ee5f502300f102ef4c93e
-
Filesize
3.8MB
MD504514bd4962f7d60679434e0ebe49184
SHA11493a5447eb8156a7d7aecff60ee8bfba2209526
SHA256c394b068aa87264419f60838a8812b750e67cf93f2494c62b9078c3708072568
SHA512a71c7ed5dfdda22f095dc99b16e8342a42e3361be16e0241dbf8983dd0d5f6e90eb0299aac1815cf78ad3a9f15fa89b42b720b7f818ee5f502300f102ef4c93e
-
Filesize
3.8MB
MD504514bd4962f7d60679434e0ebe49184
SHA11493a5447eb8156a7d7aecff60ee8bfba2209526
SHA256c394b068aa87264419f60838a8812b750e67cf93f2494c62b9078c3708072568
SHA512a71c7ed5dfdda22f095dc99b16e8342a42e3361be16e0241dbf8983dd0d5f6e90eb0299aac1815cf78ad3a9f15fa89b42b720b7f818ee5f502300f102ef4c93e