Analysis
-
max time kernel
90s -
max time network
129s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system -
submitted
12-01-2023 14:48
Static task
static1
Behavioral task
behavioral1
Sample
file.exe
Resource
win7-20221111-en
General
-
Target
file.exe
-
Size
1.5MB
-
MD5
c94a916c42e02d493052df1047ba9395
-
SHA1
8eac1d8c5b8f93ba73848a03bfdd097a0c41c9f0
-
SHA256
7fea2d0ae6f2487f26708d60ddeeabc75d0452991fd2c424fabc73c481c6d769
-
SHA512
b1a9cce67154ca4486a66cdb16699895d6ae58e0c34235693fd4887889a3f0556645b5e262085816c702f08ea22957bf5729a9ddf6a8db3c64cab8caa52a357a
-
SSDEEP
24576:220Sx+iFyhXFJAEXUslpmbTkxxkvnl41tH0dkNUgXC75ld1qSVpk:228rh/NnOoxWvnCiddd1qapk
Malware Config
Extracted
nymaim
45.139.105.171
85.31.46.167
Signatures
-
Executes dropped EXE 3 IoCs
Processes:
file.tmpMitFiles138.exewHFBfy.exepid process 2632 file.tmp 640 MitFiles138.exe 4156 wHFBfy.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
MitFiles138.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Control Panel\International\Geo\Nation MitFiles138.exe -
Loads dropped DLL 1 IoCs
Processes:
file.tmppid process 2632 file.tmp -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops file in Program Files directory 17 IoCs
Processes:
file.tmpdescription ioc process File created C:\Program Files (x86)\Mit Files\language\is-JEDM5.tmp file.tmp File created C:\Program Files (x86)\Mit Files\is-HQ8U6.tmp file.tmp File created C:\Program Files (x86)\Mit Files\language\is-CS46E.tmp file.tmp File created C:\Program Files (x86)\Mit Files\language\is-QROE7.tmp file.tmp File created C:\Program Files (x86)\Mit Files\language\is-38D0R.tmp file.tmp File created C:\Program Files (x86)\Mit Files\language\is-MAII3.tmp file.tmp File created C:\Program Files (x86)\Mit Files\is-9418H.tmp file.tmp File opened for modification C:\Program Files (x86)\Mit Files\unins000.dat file.tmp File created C:\Program Files (x86)\Mit Files\language\is-D2RM8.tmp file.tmp File created C:\Program Files (x86)\Mit Files\language\is-8TU3K.tmp file.tmp File created C:\Program Files (x86)\Mit Files\is-GG7H1.tmp file.tmp File created C:\Program Files (x86)\Mit Files\is-6M4KB.tmp file.tmp File created C:\Program Files (x86)\Mit Files\unins000.dat file.tmp File created C:\Program Files (x86)\Mit Files\is-5VEVK.tmp file.tmp File created C:\Program Files (x86)\Mit Files\language\is-6B76J.tmp file.tmp File created C:\Program Files (x86)\Mit Files\language\is-0MA3R.tmp file.tmp File opened for modification C:\Program Files (x86)\Mit Files\MitFiles138.exe file.tmp -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Kills process with taskkill 1 IoCs
Processes:
taskkill.exepid process 4832 taskkill.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
Processes:
MitFiles138.exepid process 640 MitFiles138.exe 640 MitFiles138.exe 640 MitFiles138.exe 640 MitFiles138.exe 640 MitFiles138.exe 640 MitFiles138.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
taskkill.exedescription pid process Token: SeDebugPrivilege 4832 taskkill.exe -
Suspicious use of WriteProcessMemory 15 IoCs
Processes:
file.exefile.tmpMitFiles138.execmd.exedescription pid process target process PID 1620 wrote to memory of 2632 1620 file.exe file.tmp PID 1620 wrote to memory of 2632 1620 file.exe file.tmp PID 1620 wrote to memory of 2632 1620 file.exe file.tmp PID 2632 wrote to memory of 640 2632 file.tmp MitFiles138.exe PID 2632 wrote to memory of 640 2632 file.tmp MitFiles138.exe PID 2632 wrote to memory of 640 2632 file.tmp MitFiles138.exe PID 640 wrote to memory of 4156 640 MitFiles138.exe wHFBfy.exe PID 640 wrote to memory of 4156 640 MitFiles138.exe wHFBfy.exe PID 640 wrote to memory of 4156 640 MitFiles138.exe wHFBfy.exe PID 640 wrote to memory of 3772 640 MitFiles138.exe cmd.exe PID 640 wrote to memory of 3772 640 MitFiles138.exe cmd.exe PID 640 wrote to memory of 3772 640 MitFiles138.exe cmd.exe PID 3772 wrote to memory of 4832 3772 cmd.exe taskkill.exe PID 3772 wrote to memory of 4832 3772 cmd.exe taskkill.exe PID 3772 wrote to memory of 4832 3772 cmd.exe taskkill.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\file.exe"C:\Users\Admin\AppData\Local\Temp\file.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1620 -
C:\Users\Admin\AppData\Local\Temp\is-LP5GU.tmp\file.tmp"C:\Users\Admin\AppData\Local\Temp\is-LP5GU.tmp\file.tmp" /SL5="$80066,1360122,483328,C:\Users\Admin\AppData\Local\Temp\file.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:2632 -
C:\Program Files (x86)\Mit Files\MitFiles138.exe"C:\Program Files (x86)\Mit Files\MitFiles138.exe"3⤵
- Executes dropped EXE
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:640 -
C:\Users\Admin\AppData\Roaming\{6eb576c0-6208-11ed-9190-806e6f6e6963}\wHFBfy.exe
- Executes dropped EXE
PID:4156
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c taskkill /im "MitFiles138.exe" /f & erase "C:\Program Files (x86)\Mit Files\MitFiles138.exe" & exit4⤵
- Suspicious use of WriteProcessMemory
PID:3772 -
C:\Windows\SysWOW64\taskkill.exetaskkill /im "MitFiles138.exe" /f5⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4832
-
-
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.8MB
MD52d3c9d0d4265ecd810104168e6737dee
SHA12c2e711c02e7855a20c6102d5f41401860bbc43d
SHA256b9b7eea7c0388a5af353934e698ed399a4edc3df95aa952db74bae73c8caf6fc
SHA51273578bf1eb44d1c61b4ca9c40a1c30c08bfc4dcfa9b9b9cd48e696e114a8f398894944f91b67ba9458ea01d5711f6d5b3d47fd43dbe4294be410d86a7d940981
-
Filesize
1.8MB
MD52d3c9d0d4265ecd810104168e6737dee
SHA12c2e711c02e7855a20c6102d5f41401860bbc43d
SHA256b9b7eea7c0388a5af353934e698ed399a4edc3df95aa952db74bae73c8caf6fc
SHA51273578bf1eb44d1c61b4ca9c40a1c30c08bfc4dcfa9b9b9cd48e696e114a8f398894944f91b67ba9458ea01d5711f6d5b3d47fd43dbe4294be410d86a7d940981
-
Filesize
2KB
MD5a69559718ab506675e907fe49deb71e9
SHA1bc8f404ffdb1960b50c12ff9413c893b56f2e36f
SHA2562f6294f9aa09f59a574b5dcd33be54e16b39377984f3d5658cda44950fa0f8fc
SHA512e52e0aa7fe3f79e36330c455d944653d449ba05b2f9abee0914a0910c3452cfa679a40441f9ac696b3ccf9445cbb85095747e86153402fc362bb30ac08249a63
-
Filesize
695KB
MD5415533bb40980951c966665cff9e2fe7
SHA1fce396c8fa01876dd008f22c8be9a9b706f4aaec
SHA256f688364bb17f03e53de641e7a0b0efefe30ac155fa9fa414a2150204ed9d3734
SHA5123a8f88fa83e9f8be96fc9a0e8b47536455f50b1c511210d98fa178444b1e5ad1943cc3000e869f6dba4c782b48a3538d0b52d5e29ce3a692636aefc0e52083ae
-
Filesize
695KB
MD5415533bb40980951c966665cff9e2fe7
SHA1fce396c8fa01876dd008f22c8be9a9b706f4aaec
SHA256f688364bb17f03e53de641e7a0b0efefe30ac155fa9fa414a2150204ed9d3734
SHA5123a8f88fa83e9f8be96fc9a0e8b47536455f50b1c511210d98fa178444b1e5ad1943cc3000e869f6dba4c782b48a3538d0b52d5e29ce3a692636aefc0e52083ae
-
Filesize
72KB
MD53fb36cb0b7172e5298d2992d42984d06
SHA1439827777df4a337cbb9fa4a4640d0d3fa1738b7
SHA25627ae813ceff8aa56e9fa68c8e50bb1c6c4a01636015eac4bd8bf444afb7020d6
SHA5126b39cb32d77200209a25080ac92bc71b1f468e2946b651023793f3585ee6034adc70924dbd751cf4a51b5e71377854f1ab43c2dd287d4837e7b544ff886f470c
-
Filesize
72KB
MD53fb36cb0b7172e5298d2992d42984d06
SHA1439827777df4a337cbb9fa4a4640d0d3fa1738b7
SHA25627ae813ceff8aa56e9fa68c8e50bb1c6c4a01636015eac4bd8bf444afb7020d6
SHA5126b39cb32d77200209a25080ac92bc71b1f468e2946b651023793f3585ee6034adc70924dbd751cf4a51b5e71377854f1ab43c2dd287d4837e7b544ff886f470c