Analysis

  • max time kernel
    79s
  • max time network
    130s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220414-en
  • submitted
    12-05-2022 12:00

General

  • Target

    3f70e988489df0e7eb8ff80460ad88e76464568113a451b8dd5bff16e39999c8.exe

  • Size

    231KB

  • MD5

    5cb1e75311bd45338d7c3daff1d841f2

  • SHA1

    460b6a6a4231419e241b6c82143cf763695d9116

  • SHA256

    3f70e988489df0e7eb8ff80460ad88e76464568113a451b8dd5bff16e39999c8

  • SHA512

    96cdf98c78633319a3874f958a7c79944ecc9c6eb8e854df96503ebf645ecb391236f72312fa3bf61528997162c59b1ff5b5d3e9dc2949e2c5c7cc1954cce57d

Score
10/10

Malware Config

Signatures

  • OnlyLogger

    A tiny loader that uses IPLogger to get its payload.

  • OnlyLogger Payload 2 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Program crash 9 IoCs
  • Kills process with taskkill 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 6 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\3f70e988489df0e7eb8ff80460ad88e76464568113a451b8dd5bff16e39999c8.exe
    "C:\Users\Admin\AppData\Local\Temp\3f70e988489df0e7eb8ff80460ad88e76464568113a451b8dd5bff16e39999c8.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of WriteProcessMemory
    PID:716
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 716 -s 612
      2⤵
      • Program crash
      PID:5008
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 716 -s 620
      2⤵
      • Program crash
      PID:384
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 716 -s 744
      2⤵
      • Program crash
      PID:4104
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 716 -s 796
      2⤵
      • Program crash
      PID:3692
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 716 -s 1064
      2⤵
      • Program crash
      PID:3736
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 716 -s 1112
      2⤵
      • Program crash
      PID:3960
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 716 -s 1196
      2⤵
      • Program crash
      PID:5108
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 716 -s 1204
      2⤵
      • Program crash
      PID:4556
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c taskkill /im "3f70e988489df0e7eb8ff80460ad88e76464568113a451b8dd5bff16e39999c8.exe" /f & erase "C:\Users\Admin\AppData\Local\Temp\3f70e988489df0e7eb8ff80460ad88e76464568113a451b8dd5bff16e39999c8.exe" & exit
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:1464
      • C:\Windows\SysWOW64\taskkill.exe
        taskkill /im "3f70e988489df0e7eb8ff80460ad88e76464568113a451b8dd5bff16e39999c8.exe" /f
        3⤵
        • Kills process with taskkill
        • Suspicious use of AdjustPrivilegeToken
        PID:4808
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 716 -s 1116
      2⤵
      • Program crash
      PID:3300
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 716 -ip 716
    1⤵
      PID:4092
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -pss -s 504 -p 716 -ip 716
      1⤵
        PID:1080
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 716 -ip 716
        1⤵
          PID:4108
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 716 -ip 716
          1⤵
            PID:1600
          • C:\Windows\SysWOW64\WerFault.exe
            C:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 716 -ip 716
            1⤵
              PID:3740
            • C:\Windows\SysWOW64\WerFault.exe
              C:\Windows\SysWOW64\WerFault.exe -pss -s 476 -p 716 -ip 716
              1⤵
                PID:3560
              • C:\Windows\SysWOW64\WerFault.exe
                C:\Windows\SysWOW64\WerFault.exe -pss -s 504 -p 716 -ip 716
                1⤵
                  PID:2032
                • C:\Windows\SysWOW64\WerFault.exe
                  C:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 716 -ip 716
                  1⤵
                    PID:4036
                  • C:\Windows\SysWOW64\WerFault.exe
                    C:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 716 -ip 716
                    1⤵
                      PID:1616

                    Network

                    MITRE ATT&CK Enterprise v6

                    Replay Monitor

                    Loading Replay Monitor...

                    Downloads

                    • memory/716-130-0x0000000001093000-0x00000000010BB000-memory.dmp

                      Filesize

                      160KB

                    • memory/716-131-0x0000000000FA0000-0x0000000000FE6000-memory.dmp

                      Filesize

                      280KB

                    • memory/716-132-0x0000000000400000-0x0000000000F97000-memory.dmp

                      Filesize

                      11.6MB

                    • memory/1464-133-0x0000000000000000-mapping.dmp

                    • memory/4808-134-0x0000000000000000-mapping.dmp