Analysis
-
max time kernel
90s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20220901-en -
resource tags
arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system -
submitted
29/12/2022, 12:13
Static task
static1
Behavioral task
behavioral1
Sample
4f8aaa32c25c0df6e6d6b07147fe2210.exe
Resource
win7-20221111-en
General
-
Target
4f8aaa32c25c0df6e6d6b07147fe2210.exe
-
Size
396KB
-
MD5
4f8aaa32c25c0df6e6d6b07147fe2210
-
SHA1
6a3d3cc1440dc5ccd401dcad9f2aa2b5e58efb6a
-
SHA256
3130ae5c7eb9359f37503eae4d9e163031db1cf5cf39b1cf353fefda5e037ed8
-
SHA512
a46d34e735d5953c006c0507d2d76f626a056981ad71052987632016c0512d3b9cbaa0e5efdd9f2230e2b3f218890c2095f44ab9d248be2b7eac7eedbfb2496a
-
SSDEEP
6144:+UfKLfKeWByzgwsVqNGIxg4l2wjJFLDk9iGce6o1Yf67k13bwZ4Vxq:dC2eDzgXVeGIxg4XjJlm6o1Yy7
Malware Config
Extracted
nymaim
45.139.105.171
85.31.46.167
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation 4f8aaa32c25c0df6e6d6b07147fe2210.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 9 IoCs
pid pid_target Process procid_target 4448 3912 WerFault.exe 80 384 3912 WerFault.exe 80 2056 3912 WerFault.exe 80 4580 3912 WerFault.exe 80 2608 3912 WerFault.exe 80 1380 3912 WerFault.exe 80 5036 3912 WerFault.exe 80 4984 3912 WerFault.exe 80 924 3912 WerFault.exe 80 -
Kills process with taskkill 1 IoCs
pid Process 4740 taskkill.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 4740 taskkill.exe -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 3912 wrote to memory of 4216 3912 4f8aaa32c25c0df6e6d6b07147fe2210.exe 102 PID 3912 wrote to memory of 4216 3912 4f8aaa32c25c0df6e6d6b07147fe2210.exe 102 PID 3912 wrote to memory of 4216 3912 4f8aaa32c25c0df6e6d6b07147fe2210.exe 102 PID 4216 wrote to memory of 4740 4216 cmd.exe 106 PID 4216 wrote to memory of 4740 4216 cmd.exe 106 PID 4216 wrote to memory of 4740 4216 cmd.exe 106
Processes
-
C:\Users\Admin\AppData\Local\Temp\4f8aaa32c25c0df6e6d6b07147fe2210.exe"C:\Users\Admin\AppData\Local\Temp\4f8aaa32c25c0df6e6d6b07147fe2210.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:3912 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3912 -s 4522⤵
- Program crash
PID:4448
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3912 -s 7722⤵
- Program crash
PID:384
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3912 -s 7842⤵
- Program crash
PID:2056
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3912 -s 7722⤵
- Program crash
PID:4580
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3912 -s 8362⤵
- Program crash
PID:2608
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3912 -s 9282⤵
- Program crash
PID:1380
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3912 -s 10082⤵
- Program crash
PID:5036
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3912 -s 13602⤵
- Program crash
PID:4984
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c taskkill /im "4f8aaa32c25c0df6e6d6b07147fe2210.exe" /f & erase "C:\Users\Admin\AppData\Local\Temp\4f8aaa32c25c0df6e6d6b07147fe2210.exe" & exit2⤵
- Suspicious use of WriteProcessMemory
PID:4216 -
C:\Windows\SysWOW64\taskkill.exetaskkill /im "4f8aaa32c25c0df6e6d6b07147fe2210.exe" /f3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4740
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3912 -s 13962⤵
- Program crash
PID:924
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 3912 -ip 39121⤵PID:3276
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 500 -p 3912 -ip 39121⤵PID:3116
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 3912 -ip 39121⤵PID:4668
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 3912 -ip 39121⤵PID:2252
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 3912 -ip 39121⤵PID:3484
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 568 -p 3912 -ip 39121⤵PID:3104
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 556 -p 3912 -ip 39121⤵PID:1064
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 492 -p 3912 -ip 39121⤵PID:5080
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 488 -p 3912 -ip 39121⤵PID:4528