Analysis
-
max time kernel
98s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system -
submitted
29/12/2022, 12:14
Static task
static1
Behavioral task
behavioral1
Sample
3a4fc843fea55ee700af9ca739e690e0.exe
Resource
win7-20220812-en
6 signatures
150 seconds
General
-
Target
3a4fc843fea55ee700af9ca739e690e0.exe
-
Size
371KB
-
MD5
3a4fc843fea55ee700af9ca739e690e0
-
SHA1
355974b4c3165312c59afda5f1f11224b73e25dc
-
SHA256
80e0fad3bd2c2640bcb4aa073e7195a8fac77ac92b1085ca71cf975da3de6f9d
-
SHA512
9d218a6f8f59674db9fa3ee433685b215cd8902eab33efb2dead60e0901be3a57199a4ee710b5ab2894f3cc241e591f05a78394f6089e8b36208ce4b91d6c6c9
-
SSDEEP
6144:KOUR7L0Nr4NBsR1JjXjOvlNW62F5grTPPw7n1HbwZoV0J:mBgUsRHgde5Iw7
Malware Config
Extracted
Family
nymaim
C2
45.139.105.171
85.31.46.167
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\Control Panel\International\Geo\Nation 3a4fc843fea55ee700af9ca739e690e0.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 10 IoCs
pid pid_target Process procid_target 4740 3528 WerFault.exe 78 448 3528 WerFault.exe 78 4728 3528 WerFault.exe 78 552 3528 WerFault.exe 78 1704 3528 WerFault.exe 78 1420 3528 WerFault.exe 78 1956 3528 WerFault.exe 78 1116 3528 WerFault.exe 78 4176 3528 WerFault.exe 78 3224 3528 WerFault.exe 78 -
Kills process with taskkill 1 IoCs
pid Process 3052 taskkill.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 3052 taskkill.exe -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 3528 wrote to memory of 1580 3528 3a4fc843fea55ee700af9ca739e690e0.exe 98 PID 3528 wrote to memory of 1580 3528 3a4fc843fea55ee700af9ca739e690e0.exe 98 PID 3528 wrote to memory of 1580 3528 3a4fc843fea55ee700af9ca739e690e0.exe 98 PID 1580 wrote to memory of 3052 1580 cmd.exe 102 PID 1580 wrote to memory of 3052 1580 cmd.exe 102 PID 1580 wrote to memory of 3052 1580 cmd.exe 102
Processes
-
C:\Users\Admin\AppData\Local\Temp\3a4fc843fea55ee700af9ca739e690e0.exe"C:\Users\Admin\AppData\Local\Temp\3a4fc843fea55ee700af9ca739e690e0.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:3528 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3528 -s 4562⤵
- Program crash
PID:4740
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3528 -s 7722⤵
- Program crash
PID:448
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3528 -s 8042⤵
- Program crash
PID:4728
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3528 -s 8042⤵
- Program crash
PID:552
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3528 -s 8362⤵
- Program crash
PID:1704
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3528 -s 9362⤵
- Program crash
PID:1420
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3528 -s 9762⤵
- Program crash
PID:1956
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3528 -s 10562⤵
- Program crash
PID:1116
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3528 -s 10042⤵
- Program crash
PID:4176
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c taskkill /im "3a4fc843fea55ee700af9ca739e690e0.exe" /f & erase "C:\Users\Admin\AppData\Local\Temp\3a4fc843fea55ee700af9ca739e690e0.exe" & exit2⤵
- Suspicious use of WriteProcessMemory
PID:1580 -
C:\Windows\SysWOW64\taskkill.exetaskkill /im "3a4fc843fea55ee700af9ca739e690e0.exe" /f3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:3052
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3528 -s 14882⤵
- Program crash
PID:3224
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 188 -p 3528 -ip 35281⤵PID:4412
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 484 -p 3528 -ip 35281⤵PID:3788
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 3528 -ip 35281⤵PID:692
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 3528 -ip 35281⤵PID:4776
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 3528 -ip 35281⤵PID:740
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 488 -p 3528 -ip 35281⤵PID:1432
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 3528 -ip 35281⤵PID:1336
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 3528 -ip 35281⤵PID:1348
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 3528 -ip 35281⤵PID:2156
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 3528 -ip 35281⤵PID:1988