Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    140s
  • max time network
    143s
  • platform
    windows7_x64
  • resource
    win7-20220812-en
  • resource tags

    arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
  • submitted
    05/10/2022, 15:12

General

  • Target

    file.exe

  • Size

    367KB

  • MD5

    a65f292880c2e8eb18d8b3f8686c9ed6

  • SHA1

    22cda93e3435130c76e5afb591815b1e67d9eb50

  • SHA256

    a120a87049bbc78fe6651ee4b9602c5cc05666e1a7db4ac8e53c0ecbc2fd06e7

  • SHA512

    518153a542e15e589d51172ea53ab1e8bb502f14526175e60461a4f17bc1ae58507c5f1433e9d2bfb5164c6caabbabd0d17602eb5870f76faeb4c1b9c145d3a4

  • SSDEEP

    6144:sRFGKkqeLCPp0Cz2nx14kr26ZAE+q67xrc49sFpYUuzbgwuhvbAwwVfU:sRoqe2Pp0CCnxHr2xE+q74Opunnm8Y

Score
10/10

Malware Config

Extracted

Family

nymaim

C2

208.67.104.97

85.31.46.167

Signatures

  • NyMaim

    NyMaim is a malware with various capabilities written in C++ and first seen in 2013.

  • Downloads MZ/PE file
  • Executes dropped EXE 1 IoCs
  • Deletes itself 1 IoCs
  • Loads dropped DLL 1 IoCs
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs
  • AutoIT Executable 3 IoCs

    AutoIT scripts compiled to PE executables.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Program crash 1 IoCs
  • Kills process with taskkill 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 3 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 19 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\file.exe
    "C:\Users\Admin\AppData\Local\Temp\file.exe"
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of WriteProcessMemory
    PID:1644
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c start /I "" "C:\Users\Admin\AppData\Local\Temp\Wf4qQVhuUgwre\Cleaner.exe"
      2⤵
      • Loads dropped DLL
      • Suspicious use of WriteProcessMemory
      PID:1924
      • C:\Users\Admin\AppData\Local\Temp\Wf4qQVhuUgwre\Cleaner.exe
        "C:\Users\Admin\AppData\Local\Temp\Wf4qQVhuUgwre\Cleaner.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:968
        • C:\Windows\system32\WerFault.exe
          C:\Windows\system32\WerFault.exe -u -p 968 -s 1144
          4⤵
          • Program crash
          PID:1088
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c taskkill /im "file.exe" /f & erase "C:\Users\Admin\AppData\Local\Temp\file.exe" & exit
      2⤵
      • Deletes itself
      • Suspicious use of WriteProcessMemory
      PID:608
      • C:\Windows\SysWOW64\taskkill.exe
        taskkill /im "file.exe" /f
        3⤵
        • Kills process with taskkill
        • Suspicious use of AdjustPrivilegeToken
        PID:556

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\Wf4qQVhuUgwre\Bunifu_UI_v1.5.3.dll

    Filesize

    236KB

    MD5

    2ecb51ab00c5f340380ecf849291dbcf

    SHA1

    1a4dffbce2a4ce65495ed79eab42a4da3b660931

    SHA256

    f1b3e0f2750a9103e46a6a4a34f1cf9d17779725f98042cc2475ec66484801cf

    SHA512

    e241a48eafcaf99187035f0870d24d74ae97fe84aaadd2591cceea9f64b8223d77cfb17a038a58eadd3b822c5201a6f7494f26eea6f77d95f77f6c668d088e6b

  • C:\Users\Admin\AppData\Local\Temp\Wf4qQVhuUgwre\Cleaner.exe

    Filesize

    3.8MB

    MD5

    04514bd4962f7d60679434e0ebe49184

    SHA1

    1493a5447eb8156a7d7aecff60ee8bfba2209526

    SHA256

    c394b068aa87264419f60838a8812b750e67cf93f2494c62b9078c3708072568

    SHA512

    a71c7ed5dfdda22f095dc99b16e8342a42e3361be16e0241dbf8983dd0d5f6e90eb0299aac1815cf78ad3a9f15fa89b42b720b7f818ee5f502300f102ef4c93e

  • C:\Users\Admin\AppData\Local\Temp\Wf4qQVhuUgwre\Cleaner.exe

    Filesize

    3.8MB

    MD5

    04514bd4962f7d60679434e0ebe49184

    SHA1

    1493a5447eb8156a7d7aecff60ee8bfba2209526

    SHA256

    c394b068aa87264419f60838a8812b750e67cf93f2494c62b9078c3708072568

    SHA512

    a71c7ed5dfdda22f095dc99b16e8342a42e3361be16e0241dbf8983dd0d5f6e90eb0299aac1815cf78ad3a9f15fa89b42b720b7f818ee5f502300f102ef4c93e

  • \Users\Admin\AppData\Local\Temp\Wf4qQVhuUgwre\Cleaner.exe

    Filesize

    3.8MB

    MD5

    04514bd4962f7d60679434e0ebe49184

    SHA1

    1493a5447eb8156a7d7aecff60ee8bfba2209526

    SHA256

    c394b068aa87264419f60838a8812b750e67cf93f2494c62b9078c3708072568

    SHA512

    a71c7ed5dfdda22f095dc99b16e8342a42e3361be16e0241dbf8983dd0d5f6e90eb0299aac1815cf78ad3a9f15fa89b42b720b7f818ee5f502300f102ef4c93e

  • memory/968-68-0x0000000000420000-0x0000000000462000-memory.dmp

    Filesize

    264KB

  • memory/968-66-0x000007FEFB881000-0x000007FEFB883000-memory.dmp

    Filesize

    8KB

  • memory/968-65-0x00000000008A0000-0x00000000009F6000-memory.dmp

    Filesize

    1.3MB

  • memory/1644-59-0x0000000000400000-0x0000000000461000-memory.dmp

    Filesize

    388KB

  • memory/1644-58-0x00000000005BC000-0x00000000005E2000-memory.dmp

    Filesize

    152KB

  • memory/1644-57-0x0000000000400000-0x0000000000461000-memory.dmp

    Filesize

    388KB

  • memory/1644-54-0x0000000075A11000-0x0000000075A13000-memory.dmp

    Filesize

    8KB

  • memory/1644-70-0x0000000010000000-0x000000001001B000-memory.dmp

    Filesize

    108KB

  • memory/1644-56-0x0000000000230000-0x000000000026F000-memory.dmp

    Filesize

    252KB

  • memory/1644-75-0x00000000005BC000-0x00000000005E2000-memory.dmp

    Filesize

    152KB

  • memory/1644-76-0x0000000000400000-0x0000000000461000-memory.dmp

    Filesize

    388KB

  • memory/1644-55-0x00000000005BC000-0x00000000005E2000-memory.dmp

    Filesize

    152KB