Analysis

  • max time kernel
    157s
  • max time network
    165s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220414-en
  • submitted
    12-05-2022 12:00

General

  • Target

    05c33a3e8abc524778d307356dc4a540bdf864b307a0f2ecd4a60c72016b9cb6.exe

  • Size

    324KB

  • MD5

    5830cf430af8122d01cf361078a6bb93

  • SHA1

    c696f0be9086fc97b757187d203519593a02ce12

  • SHA256

    05c33a3e8abc524778d307356dc4a540bdf864b307a0f2ecd4a60c72016b9cb6

  • SHA512

    79a5dd555ec3423911acb491fb8edaed0ac595d2327570521d6c2e8f337c63192e0dcf2ff46161324c763f721a66f25113363c7fbd06aba2ddb5f4a30fdde5a2

Score
10/10

Malware Config

Signatures

  • OnlyLogger

    A tiny loader that uses IPLogger to get its payload.

  • OnlyLogger Payload 2 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Program crash 9 IoCs
  • Kills process with taskkill 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 6 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\05c33a3e8abc524778d307356dc4a540bdf864b307a0f2ecd4a60c72016b9cb6.exe
    "C:\Users\Admin\AppData\Local\Temp\05c33a3e8abc524778d307356dc4a540bdf864b307a0f2ecd4a60c72016b9cb6.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of WriteProcessMemory
    PID:3496
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3496 -s 616
      2⤵
      • Program crash
      PID:920
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3496 -s 636
      2⤵
      • Program crash
      PID:2760
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3496 -s 644
      2⤵
      • Program crash
      PID:2952
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3496 -s 648
      2⤵
      • Program crash
      PID:1408
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3496 -s 788
      2⤵
      • Program crash
      PID:3904
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3496 -s 820
      2⤵
      • Program crash
      PID:4540
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3496 -s 1084
      2⤵
      • Program crash
      PID:4472
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3496 -s 1228
      2⤵
      • Program crash
      PID:3288
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c taskkill /im "05c33a3e8abc524778d307356dc4a540bdf864b307a0f2ecd4a60c72016b9cb6.exe" /f & erase "C:\Users\Admin\AppData\Local\Temp\05c33a3e8abc524778d307356dc4a540bdf864b307a0f2ecd4a60c72016b9cb6.exe" & exit
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:4468
      • C:\Windows\SysWOW64\taskkill.exe
        taskkill /im "05c33a3e8abc524778d307356dc4a540bdf864b307a0f2ecd4a60c72016b9cb6.exe" /f
        3⤵
        • Kills process with taskkill
        • Suspicious use of AdjustPrivilegeToken
        PID:1460
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3496 -s 1404
      2⤵
      • Program crash
      PID:4772
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 3496 -ip 3496
    1⤵
      PID:4200
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3496 -ip 3496
      1⤵
        PID:4344
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3496 -ip 3496
        1⤵
          PID:2140
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 3496 -ip 3496
          1⤵
            PID:2888
          • C:\Windows\SysWOW64\WerFault.exe
            C:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 3496 -ip 3496
            1⤵
              PID:1880
            • C:\Windows\SysWOW64\WerFault.exe
              C:\Windows\SysWOW64\WerFault.exe -pss -s 560 -p 3496 -ip 3496
              1⤵
                PID:208
              • C:\Windows\SysWOW64\WerFault.exe
                C:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 3496 -ip 3496
                1⤵
                  PID:4400
                • C:\Windows\SysWOW64\WerFault.exe
                  C:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 3496 -ip 3496
                  1⤵
                    PID:2192
                  • C:\Windows\SysWOW64\WerFault.exe
                    C:\Windows\SysWOW64\WerFault.exe -pss -s 604 -p 3496 -ip 3496
                    1⤵
                      PID:844

                    Network

                    MITRE ATT&CK Enterprise v6

                    Replay Monitor

                    Loading Replay Monitor...

                    Downloads

                    • memory/1460-134-0x0000000000000000-mapping.dmp

                    • memory/3496-130-0x0000000005188000-0x00000000051B0000-memory.dmp

                      Filesize

                      160KB

                    • memory/3496-131-0x0000000004F10000-0x0000000004F56000-memory.dmp

                      Filesize

                      280KB

                    • memory/3496-132-0x0000000000400000-0x0000000004DCD000-memory.dmp

                      Filesize

                      73.8MB

                    • memory/4468-133-0x0000000000000000-mapping.dmp