Analysis
-
max time kernel
83s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
23/12/2022, 04:22
Static task
static1
Behavioral task
behavioral1
Sample
cc58143048294ff5fd4eb525b9af83bd.exe
Resource
win7-20220812-en
General
-
Target
cc58143048294ff5fd4eb525b9af83bd.exe
-
Size
385KB
-
MD5
cc58143048294ff5fd4eb525b9af83bd
-
SHA1
10c859ebdd0207d13a4b07d62a5b1df9ba447502
-
SHA256
43209724f0bd10e551388117ec98e9b22a296537b1c1eb6f6bc2b35239e63544
-
SHA512
8e385d7cbf4f7fe55732a194456c56398b1c93d8271ac8c767a361f57e0e0b754b972f64acba710a0b20937a62fab2dadbde8e08b925c5f441307b541851e35c
-
SSDEEP
6144:CGpL5+6yz3wmdCSBV4TbDX1gYd6jt8p4RR0cSpQTtyzsduHNIv:Bp9+6yzgJbZgbt8p4RR0TCtyYduHNI
Malware Config
Extracted
nymaim
45.139.105.171
85.31.46.167
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation cc58143048294ff5fd4eb525b9af83bd.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 10 IoCs
pid pid_target Process procid_target 4592 764 WerFault.exe 79 4872 764 WerFault.exe 79 3056 764 WerFault.exe 79 5116 764 WerFault.exe 79 4356 764 WerFault.exe 79 1276 764 WerFault.exe 79 792 764 WerFault.exe 79 1716 764 WerFault.exe 79 1580 764 WerFault.exe 79 1720 764 WerFault.exe 79 -
Kills process with taskkill 1 IoCs
pid Process 1540 taskkill.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 1540 taskkill.exe -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 764 wrote to memory of 3776 764 cc58143048294ff5fd4eb525b9af83bd.exe 99 PID 764 wrote to memory of 3776 764 cc58143048294ff5fd4eb525b9af83bd.exe 99 PID 764 wrote to memory of 3776 764 cc58143048294ff5fd4eb525b9af83bd.exe 99 PID 3776 wrote to memory of 1540 3776 cmd.exe 103 PID 3776 wrote to memory of 1540 3776 cmd.exe 103 PID 3776 wrote to memory of 1540 3776 cmd.exe 103
Processes
-
C:\Users\Admin\AppData\Local\Temp\cc58143048294ff5fd4eb525b9af83bd.exe"C:\Users\Admin\AppData\Local\Temp\cc58143048294ff5fd4eb525b9af83bd.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:764 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 764 -s 4562⤵
- Program crash
PID:4592
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 764 -s 7642⤵
- Program crash
PID:4872
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 764 -s 7722⤵
- Program crash
PID:3056
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 764 -s 7922⤵
- Program crash
PID:5116
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 764 -s 7762⤵
- Program crash
PID:4356
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 764 -s 9282⤵
- Program crash
PID:1276
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 764 -s 10042⤵
- Program crash
PID:792
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 764 -s 10362⤵
- Program crash
PID:1716
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 764 -s 12362⤵
- Program crash
PID:1580
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c taskkill /im "cc58143048294ff5fd4eb525b9af83bd.exe" /f & erase "C:\Users\Admin\AppData\Local\Temp\cc58143048294ff5fd4eb525b9af83bd.exe" & exit2⤵
- Suspicious use of WriteProcessMemory
PID:3776 -
C:\Windows\SysWOW64\taskkill.exetaskkill /im "cc58143048294ff5fd4eb525b9af83bd.exe" /f3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1540
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 764 -s 5362⤵
- Program crash
PID:1720
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 764 -ip 7641⤵PID:1984
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 484 -p 764 -ip 7641⤵PID:1052
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 764 -ip 7641⤵PID:2940
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 472 -p 764 -ip 7641⤵PID:4392
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 764 -ip 7641⤵PID:4028
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 556 -p 764 -ip 7641⤵PID:4980
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 576 -p 764 -ip 7641⤵PID:2040
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 376 -p 764 -ip 7641⤵PID:1336
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 556 -p 764 -ip 7641⤵PID:2668
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 568 -p 764 -ip 7641⤵PID:2704