Analysis

  • max time kernel
    90s
  • max time network
    153s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20221111-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
  • submitted
    29/12/2022, 12:17

General

  • Target

    8cb2f80304f1f188fb8769e9ba089a1f.exe

  • Size

    318KB

  • MD5

    8cb2f80304f1f188fb8769e9ba089a1f

  • SHA1

    e3f3542bafcfb7b7efba45ccb719e607ff462d9c

  • SHA256

    f3a7d831c9fa8577a6dffae63ca18f8c05274b49a5a0f3a6091165fe1a212d85

  • SHA512

    cf4f6db594e2b7da74b66d4b874988ed52bbe3914bc2d180ecb72d38d19fe89472d1cd6739bff0379772f2d321a0eb2427f25d12ea81b236692690a599b5c090

  • SSDEEP

    6144:i0LTNZRJ5OkhT01z2Qnn+FfYcbdhA3xqMVi3tm:FPVOkm1z2s+vdAqii3tm

Score
10/10

Malware Config

Extracted

Family

nymaim

C2

45.139.105.171

85.31.46.167

Signatures

  • NyMaim

    NyMaim is a malware with various capabilities written in C++ and first seen in 2013.

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Program crash 7 IoCs
  • Kills process with taskkill 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 6 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\8cb2f80304f1f188fb8769e9ba089a1f.exe
    "C:\Users\Admin\AppData\Local\Temp\8cb2f80304f1f188fb8769e9ba089a1f.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of WriteProcessMemory
    PID:528
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 528 -s 684
      2⤵
      • Program crash
      PID:2436
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 528 -s 736
      2⤵
      • Program crash
      PID:3476
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 528 -s 916
      2⤵
      • Program crash
      PID:4956
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 528 -s 916
      2⤵
      • Program crash
      PID:800
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 528 -s 792
      2⤵
      • Program crash
      PID:4216
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 528 -s 972
      2⤵
      • Program crash
      PID:4132
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c taskkill /im "8cb2f80304f1f188fb8769e9ba089a1f.exe" /f & erase "C:\Users\Admin\AppData\Local\Temp\8cb2f80304f1f188fb8769e9ba089a1f.exe" & exit
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:4360
      • C:\Windows\SysWOW64\taskkill.exe
        taskkill /im "8cb2f80304f1f188fb8769e9ba089a1f.exe" /f
        3⤵
        • Kills process with taskkill
        • Suspicious use of AdjustPrivilegeToken
        PID:3588
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 528 -s 1156
      2⤵
      • Program crash
      PID:1116
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 464 -p 528 -ip 528
    1⤵
      PID:1904
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -pss -s 500 -p 528 -ip 528
      1⤵
        PID:2828
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 528 -ip 528
        1⤵
          PID:216
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -pss -s 468 -p 528 -ip 528
          1⤵
            PID:3772
          • C:\Windows\SysWOW64\WerFault.exe
            C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 528 -ip 528
            1⤵
              PID:2384
            • C:\Windows\SysWOW64\WerFault.exe
              C:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 528 -ip 528
              1⤵
                PID:1840
              • C:\Windows\SysWOW64\WerFault.exe
                C:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 528 -ip 528
                1⤵
                  PID:3336

                Network

                MITRE ATT&CK Enterprise v6

                Replay Monitor

                Loading Replay Monitor...

                Downloads

                • memory/528-132-0x00000000006D8000-0x00000000006FF000-memory.dmp

                  Filesize

                  156KB

                • memory/528-133-0x0000000000610000-0x0000000000650000-memory.dmp

                  Filesize

                  256KB

                • memory/528-134-0x0000000000400000-0x0000000000473000-memory.dmp

                  Filesize

                  460KB

                • memory/528-137-0x00000000006D8000-0x00000000006FF000-memory.dmp

                  Filesize

                  156KB

                • memory/528-138-0x0000000000610000-0x0000000000650000-memory.dmp

                  Filesize

                  256KB

                • memory/528-139-0x0000000000400000-0x0000000000473000-memory.dmp

                  Filesize

                  460KB