Analysis

  • max time kernel
    92s
  • max time network
    143s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220414-en
  • submitted
    12-05-2022 12:00

General

  • Target

    781f78c1ee4bdaeb0bdcdc35380427fdfc00faee122bb4c5ff0733004a56dd04.exe

  • Size

    323KB

  • MD5

    9d8e1173ecc6d44b69fabdfd2d9ecb15

  • SHA1

    a44f35e516f59d764226326c8eb4af6540d8a8a0

  • SHA256

    781f78c1ee4bdaeb0bdcdc35380427fdfc00faee122bb4c5ff0733004a56dd04

  • SHA512

    5f74ad1edb4636b7175ef022ceb71d09aa3334a1814ab85b6b9da2af947242d67a652ee5d42bd09a8755ff581ed07f306ce3240877a8dbae6ebd74872c0db5cb

Score
10/10

Malware Config

Signatures

  • OnlyLogger

    A tiny loader that uses IPLogger to get its payload.

  • OnlyLogger Payload 2 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Program crash 8 IoCs
  • Kills process with taskkill 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 6 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\781f78c1ee4bdaeb0bdcdc35380427fdfc00faee122bb4c5ff0733004a56dd04.exe
    "C:\Users\Admin\AppData\Local\Temp\781f78c1ee4bdaeb0bdcdc35380427fdfc00faee122bb4c5ff0733004a56dd04.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of WriteProcessMemory
    PID:1608
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1608 -s 612
      2⤵
      • Program crash
      PID:1288
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1608 -s 616
      2⤵
      • Program crash
      PID:4220
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1608 -s 612
      2⤵
      • Program crash
      PID:1296
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1608 -s 784
      2⤵
      • Program crash
      PID:1652
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1608 -s 852
      2⤵
      • Program crash
      PID:4412
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1608 -s 1184
      2⤵
      • Program crash
      PID:2816
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1608 -s 1192
      2⤵
      • Program crash
      PID:1716
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c taskkill /im "781f78c1ee4bdaeb0bdcdc35380427fdfc00faee122bb4c5ff0733004a56dd04.exe" /f & erase "C:\Users\Admin\AppData\Local\Temp\781f78c1ee4bdaeb0bdcdc35380427fdfc00faee122bb4c5ff0733004a56dd04.exe" & exit
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:4332
      • C:\Windows\SysWOW64\taskkill.exe
        taskkill /im "781f78c1ee4bdaeb0bdcdc35380427fdfc00faee122bb4c5ff0733004a56dd04.exe" /f
        3⤵
        • Kills process with taskkill
        • Suspicious use of AdjustPrivilegeToken
        PID:4936
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1608 -s 1072
      2⤵
      • Program crash
      PID:3124
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1608 -ip 1608
    1⤵
      PID:2160
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 1608 -ip 1608
      1⤵
        PID:4908
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 1608 -ip 1608
        1⤵
          PID:228
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 1608 -ip 1608
          1⤵
            PID:1504
          • C:\Windows\SysWOW64\WerFault.exe
            C:\Windows\SysWOW64\WerFault.exe -pss -s 468 -p 1608 -ip 1608
            1⤵
              PID:3700
            • C:\Windows\SysWOW64\WerFault.exe
              C:\Windows\SysWOW64\WerFault.exe -pss -s 468 -p 1608 -ip 1608
              1⤵
                PID:5036
              • C:\Windows\SysWOW64\WerFault.exe
                C:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 1608 -ip 1608
                1⤵
                  PID:3704
                • C:\Windows\SysWOW64\WerFault.exe
                  C:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 1608 -ip 1608
                  1⤵
                    PID:4516

                  Network

                  MITRE ATT&CK Enterprise v6

                  Replay Monitor

                  Loading Replay Monitor...

                  Downloads

                  • memory/1608-130-0x0000000004F78000-0x0000000004FA0000-memory.dmp

                    Filesize

                    160KB

                  • memory/1608-131-0x0000000006A00000-0x0000000006A46000-memory.dmp

                    Filesize

                    280KB

                  • memory/1608-132-0x0000000000400000-0x0000000004DCD000-memory.dmp

                    Filesize

                    73.8MB

                  • memory/4332-133-0x0000000000000000-mapping.dmp

                  • memory/4936-134-0x0000000000000000-mapping.dmp