Analysis
-
max time kernel
94s -
max time network
158s -
platform
windows10-2004_x64 -
resource
win10v2004-20220414-en -
submitted
07-07-2022 10:45
Static task
static1
Behavioral task
behavioral1
Sample
45cf856f06e0fa7ff0bf65c620d29b2ad7125efeaf9f0ef2dbd71eca7fb5683b.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
45cf856f06e0fa7ff0bf65c620d29b2ad7125efeaf9f0ef2dbd71eca7fb5683b.exe
Resource
win10v2004-20220414-en
General
-
Target
45cf856f06e0fa7ff0bf65c620d29b2ad7125efeaf9f0ef2dbd71eca7fb5683b.exe
-
Size
434KB
-
MD5
bd9c163f9a299b73f0ba445823d2377e
-
SHA1
66789c2eeec3524beec9ca434d93dbc9fba1ceaf
-
SHA256
45cf856f06e0fa7ff0bf65c620d29b2ad7125efeaf9f0ef2dbd71eca7fb5683b
-
SHA512
51f6740a9e84d5de9963ef6cfb2f0e77a23847df9930484e9924104531ffadcc0aa08053faa24bfbefff16f97a299811e7cf2d18e98d57f35caf53ebbc7556fb
Malware Config
Signatures
-
OnlyLogger
A tiny loader that uses IPLogger to get its payload.
-
OnlyLogger payload 4 IoCs
Processes:
resource yara_rule behavioral2/memory/3996-131-0x0000000000D10000-0x0000000000D59000-memory.dmp family_onlylogger behavioral2/memory/3996-132-0x0000000000400000-0x000000000089C000-memory.dmp family_onlylogger behavioral2/memory/3996-134-0x0000000000D10000-0x0000000000D59000-memory.dmp family_onlylogger behavioral2/memory/3996-138-0x0000000000400000-0x000000000089C000-memory.dmp family_onlylogger -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
45cf856f06e0fa7ff0bf65c620d29b2ad7125efeaf9f0ef2dbd71eca7fb5683b.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-1081944012-3634099177-1681222835-1000\Control Panel\International\Geo\Nation 45cf856f06e0fa7ff0bf65c620d29b2ad7125efeaf9f0ef2dbd71eca7fb5683b.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 8 IoCs
Processes:
WerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exepid pid_target process target process 1724 3996 WerFault.exe 45cf856f06e0fa7ff0bf65c620d29b2ad7125efeaf9f0ef2dbd71eca7fb5683b.exe 2204 3996 WerFault.exe 45cf856f06e0fa7ff0bf65c620d29b2ad7125efeaf9f0ef2dbd71eca7fb5683b.exe 5040 3996 WerFault.exe 45cf856f06e0fa7ff0bf65c620d29b2ad7125efeaf9f0ef2dbd71eca7fb5683b.exe 4672 3996 WerFault.exe 45cf856f06e0fa7ff0bf65c620d29b2ad7125efeaf9f0ef2dbd71eca7fb5683b.exe 2196 3996 WerFault.exe 45cf856f06e0fa7ff0bf65c620d29b2ad7125efeaf9f0ef2dbd71eca7fb5683b.exe 1604 3996 WerFault.exe 45cf856f06e0fa7ff0bf65c620d29b2ad7125efeaf9f0ef2dbd71eca7fb5683b.exe 2912 3996 WerFault.exe 45cf856f06e0fa7ff0bf65c620d29b2ad7125efeaf9f0ef2dbd71eca7fb5683b.exe 1760 3996 WerFault.exe 45cf856f06e0fa7ff0bf65c620d29b2ad7125efeaf9f0ef2dbd71eca7fb5683b.exe -
Kills process with taskkill 1 IoCs
Processes:
taskkill.exepid process 3160 taskkill.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
taskkill.exedescription pid process Token: SeDebugPrivilege 3160 taskkill.exe -
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
45cf856f06e0fa7ff0bf65c620d29b2ad7125efeaf9f0ef2dbd71eca7fb5683b.execmd.exedescription pid process target process PID 3996 wrote to memory of 3652 3996 45cf856f06e0fa7ff0bf65c620d29b2ad7125efeaf9f0ef2dbd71eca7fb5683b.exe cmd.exe PID 3996 wrote to memory of 3652 3996 45cf856f06e0fa7ff0bf65c620d29b2ad7125efeaf9f0ef2dbd71eca7fb5683b.exe cmd.exe PID 3996 wrote to memory of 3652 3996 45cf856f06e0fa7ff0bf65c620d29b2ad7125efeaf9f0ef2dbd71eca7fb5683b.exe cmd.exe PID 3652 wrote to memory of 3160 3652 cmd.exe taskkill.exe PID 3652 wrote to memory of 3160 3652 cmd.exe taskkill.exe PID 3652 wrote to memory of 3160 3652 cmd.exe taskkill.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\45cf856f06e0fa7ff0bf65c620d29b2ad7125efeaf9f0ef2dbd71eca7fb5683b.exe"C:\Users\Admin\AppData\Local\Temp\45cf856f06e0fa7ff0bf65c620d29b2ad7125efeaf9f0ef2dbd71eca7fb5683b.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3996 -s 7442⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3996 -s 7962⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3996 -s 8562⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3996 -s 8002⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3996 -s 9562⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3996 -s 9442⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3996 -s 9882⤵
- Program crash
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c taskkill /im "45cf856f06e0fa7ff0bf65c620d29b2ad7125efeaf9f0ef2dbd71eca7fb5683b.exe" /f & erase "C:\Users\Admin\AppData\Local\Temp\45cf856f06e0fa7ff0bf65c620d29b2ad7125efeaf9f0ef2dbd71eca7fb5683b.exe" & exit2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\taskkill.exetaskkill /im "45cf856f06e0fa7ff0bf65c620d29b2ad7125efeaf9f0ef2dbd71eca7fb5683b.exe" /f3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3996 -s 10322⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 3996 -ip 39961⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 476 -p 3996 -ip 39961⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 480 -p 3996 -ip 39961⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 480 -p 3996 -ip 39961⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 3996 -ip 39961⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 480 -p 3996 -ip 39961⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 3996 -ip 39961⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 3996 -ip 39961⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/3160-136-0x0000000000000000-mapping.dmp
-
memory/3652-135-0x0000000000000000-mapping.dmp
-
memory/3996-130-0x0000000000C29000-0x0000000000C52000-memory.dmpFilesize
164KB
-
memory/3996-131-0x0000000000D10000-0x0000000000D59000-memory.dmpFilesize
292KB
-
memory/3996-132-0x0000000000400000-0x000000000089C000-memory.dmpFilesize
4.6MB
-
memory/3996-133-0x0000000000C29000-0x0000000000C52000-memory.dmpFilesize
164KB
-
memory/3996-134-0x0000000000D10000-0x0000000000D59000-memory.dmpFilesize
292KB
-
memory/3996-137-0x0000000000C29000-0x0000000000C52000-memory.dmpFilesize
164KB
-
memory/3996-138-0x0000000000400000-0x000000000089C000-memory.dmpFilesize
4.6MB