Analysis
-
max time kernel
82s -
max time network
145s -
platform
windows10-2004_x64 -
resource
win10v2004-20220721-en -
resource tags
arch:x64arch:x86image:win10v2004-20220721-enlocale:en-usos:windows10-2004-x64system -
submitted
27-07-2022 00:50
Static task
static1
Behavioral task
behavioral1
Sample
539efe24846cc5cd476d50b6690d508743e62b0358bf9aa74fa4dda455bf3f4d.exe
Resource
win7-20220718-en
Behavioral task
behavioral2
Sample
539efe24846cc5cd476d50b6690d508743e62b0358bf9aa74fa4dda455bf3f4d.exe
Resource
win10v2004-20220721-en
General
-
Target
539efe24846cc5cd476d50b6690d508743e62b0358bf9aa74fa4dda455bf3f4d.exe
-
Size
434KB
-
MD5
e60a53fdbb9c3b317fa294b1f2a5b632
-
SHA1
587c6f730e6ab168e6d697e4bd02b44df65f4205
-
SHA256
539efe24846cc5cd476d50b6690d508743e62b0358bf9aa74fa4dda455bf3f4d
-
SHA512
998c91693fed0519b571607c59135a655dd6f2eae6c3ffe0ff05680d33324227121fd9f8c6ecc717e2aa95d34687d17d55f360ad5a280c32d9003a5776ebf09d
Malware Config
Signatures
-
OnlyLogger
A tiny loader that uses IPLogger to get its payload.
-
OnlyLogger payload 3 IoCs
Processes:
resource yara_rule behavioral2/memory/2656-131-0x0000000001040000-0x0000000001089000-memory.dmp family_onlylogger behavioral2/memory/2656-132-0x0000000000400000-0x000000000103D000-memory.dmp family_onlylogger behavioral2/memory/2656-135-0x0000000000400000-0x000000000103D000-memory.dmp family_onlylogger -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
539efe24846cc5cd476d50b6690d508743e62b0358bf9aa74fa4dda455bf3f4d.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-1101907861-274115917-2188613224-1000\Control Panel\International\Geo\Nation 539efe24846cc5cd476d50b6690d508743e62b0358bf9aa74fa4dda455bf3f4d.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 7 IoCs
Processes:
WerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exepid pid_target process target process 2092 2656 WerFault.exe 539efe24846cc5cd476d50b6690d508743e62b0358bf9aa74fa4dda455bf3f4d.exe 4560 2656 WerFault.exe 539efe24846cc5cd476d50b6690d508743e62b0358bf9aa74fa4dda455bf3f4d.exe 1824 2656 WerFault.exe 539efe24846cc5cd476d50b6690d508743e62b0358bf9aa74fa4dda455bf3f4d.exe 4496 2656 WerFault.exe 539efe24846cc5cd476d50b6690d508743e62b0358bf9aa74fa4dda455bf3f4d.exe 4368 2656 WerFault.exe 539efe24846cc5cd476d50b6690d508743e62b0358bf9aa74fa4dda455bf3f4d.exe 2088 2656 WerFault.exe 539efe24846cc5cd476d50b6690d508743e62b0358bf9aa74fa4dda455bf3f4d.exe 4688 2656 WerFault.exe 539efe24846cc5cd476d50b6690d508743e62b0358bf9aa74fa4dda455bf3f4d.exe -
Kills process with taskkill 1 IoCs
Processes:
taskkill.exepid process 424 taskkill.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
taskkill.exedescription pid process Token: SeDebugPrivilege 424 taskkill.exe -
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
539efe24846cc5cd476d50b6690d508743e62b0358bf9aa74fa4dda455bf3f4d.execmd.exedescription pid process target process PID 2656 wrote to memory of 2644 2656 539efe24846cc5cd476d50b6690d508743e62b0358bf9aa74fa4dda455bf3f4d.exe cmd.exe PID 2656 wrote to memory of 2644 2656 539efe24846cc5cd476d50b6690d508743e62b0358bf9aa74fa4dda455bf3f4d.exe cmd.exe PID 2656 wrote to memory of 2644 2656 539efe24846cc5cd476d50b6690d508743e62b0358bf9aa74fa4dda455bf3f4d.exe cmd.exe PID 2644 wrote to memory of 424 2644 cmd.exe taskkill.exe PID 2644 wrote to memory of 424 2644 cmd.exe taskkill.exe PID 2644 wrote to memory of 424 2644 cmd.exe taskkill.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\539efe24846cc5cd476d50b6690d508743e62b0358bf9aa74fa4dda455bf3f4d.exe"C:\Users\Admin\AppData\Local\Temp\539efe24846cc5cd476d50b6690d508743e62b0358bf9aa74fa4dda455bf3f4d.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2656 -s 7402⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2656 -s 6882⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2656 -s 7962⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2656 -s 9442⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2656 -s 9442⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2656 -s 7962⤵
- Program crash
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c taskkill /im "539efe24846cc5cd476d50b6690d508743e62b0358bf9aa74fa4dda455bf3f4d.exe" /f & erase "C:\Users\Admin\AppData\Local\Temp\539efe24846cc5cd476d50b6690d508743e62b0358bf9aa74fa4dda455bf3f4d.exe" & exit2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\taskkill.exetaskkill /im "539efe24846cc5cd476d50b6690d508743e62b0358bf9aa74fa4dda455bf3f4d.exe" /f3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2656 -s 7122⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 2656 -ip 26561⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 2656 -ip 26561⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 2656 -ip 26561⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 2656 -ip 26561⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 2656 -ip 26561⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 2656 -ip 26561⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 2656 -ip 26561⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/424-134-0x0000000000000000-mapping.dmp
-
memory/2644-133-0x0000000000000000-mapping.dmp
-
memory/2656-130-0x00000000010B3000-0x00000000010DC000-memory.dmpFilesize
164KB
-
memory/2656-131-0x0000000001040000-0x0000000001089000-memory.dmpFilesize
292KB
-
memory/2656-132-0x0000000000400000-0x000000000103D000-memory.dmpFilesize
12.2MB
-
memory/2656-135-0x0000000000400000-0x000000000103D000-memory.dmpFilesize
12.2MB