cf6cf8b6fd4d2ebc27cb0f1346951a7c36da2c1a803e47c44cfd7f72961ed15d

Resubmissions

05/10/2022, 20:39

221005-zfbgzafef8 8

05/10/2022, 20:26

221005-y73j4afec4 8

Analysis

max time kernel
99s
max time network
141s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
05/10/2022, 20:26

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

OriginLogger.rar
Size

457KB
MD5

c369ad4bd90809fd845ba88b365cc085
SHA1

8fdebbf2a79d162b2cd06de0020fd0bce32cbfa4
SHA256

cf6cf8b6fd4d2ebc27cb0f1346951a7c36da2c1a803e47c44cfd7f72961ed15d
SHA512

031be916cca88d3158dfe5f8625ad06180e649d7a6cda599e85793f31db11bf55fbdea971aa6fc11e880fac2d694916135d4d39547bcc8f73b6f55d569c35048
SSDEEP

6144:VBZBLQ41StGbZNs+kNWCC8dZBqQFZZMEpTx3KPGqMyc+ukj6z349mRJWzbAcpyQa:V+491jT8dZwgZ/hhbWXVpTEiflUJOac+

Score

8^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
3696	OriginLogger.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings	OpenWith.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeRestorePrivilege	2356	7zG.exe
Token: 35	2356	7zG.exe
Token: SeSecurityPrivilege	2356	7zG.exe
Token: SeSecurityPrivilege	2356	7zG.exe
Token: SeDebugPrivilege	3696	OriginLogger.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2356	7zG.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
4580	OpenWith.exe
4580	OpenWith.exe
4580	OpenWith.exe

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\OriginLogger.rar
1⤵
- Modifies registry class
PID:3972

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:4580

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:3724

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\AppData\Local\Temp\OriginLogger\" -spe -an -ai#7zMap26909:104:7zEvent7981
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:2356

C:\Users\Admin\AppData\Local\Temp\OriginLogger\OriginLogger.exe
"C:\Users\Admin\AppData\Local\Temp\OriginLogger\OriginLogger.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3696

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\OriginLogger\NetCore.dll

Filesize
21KB

MD5
ae0c5fd1454fcff2c8ac401822164923

SHA1
961f3adc13b09b884f2675fc9da0dc2ea331aeea

SHA256
7c793bcc86a3e8aa83d38f80f6973e2a0276bf76f15bf0cb63a7507de5dd8f7a

SHA512
72a152a64cc609ef4cd37abe0ff9c952a1626f14d2237072d3d9502806334527d2523f9fe27b1caf45b6f5f408081b41db4c28c528b86e182a1de6510a43cce2

Download Submit
C:\Users\Admin\AppData\Local\Temp\OriginLogger\OriginLogger.exe

Filesize
777KB

MD5
bd9981b13c37d3ba04e55152243b1e3e

SHA1
4669160ec356a8640cef92ddbaf7247d717a3ef1

SHA256
595a7ea981a3948c4f387a5a6af54a70a41dd604685c72cbd2a55880c2b702ed

SHA512
ac055e67165f13921b31a68b216f6364ff333e786d155c36c929fe6c34cbc5770216734a36220626af07cc09d93a7b415db69c71c3680b1d5967eda325588948

Download Submit
C:\Users\Admin\AppData\Local\Temp\OriginLogger\OriginLogger.exe

Filesize
777KB

MD5
bd9981b13c37d3ba04e55152243b1e3e

SHA1
4669160ec356a8640cef92ddbaf7247d717a3ef1

SHA256
595a7ea981a3948c4f387a5a6af54a70a41dd604685c72cbd2a55880c2b702ed

SHA512
ac055e67165f13921b31a68b216f6364ff333e786d155c36c929fe6c34cbc5770216734a36220626af07cc09d93a7b415db69c71c3680b1d5967eda325588948

Download Submit
memory/3696-134-0x0000023E86D90000-0x0000023E86E5A000-memory.dmp

Filesize
808KB

Download
memory/3696-135-0x00007FFD3B450000-0x00007FFD3BF11000-memory.dmp

Filesize
10.8MB

Download
memory/3696-136-0x00007FFD3B450000-0x00007FFD3BF11000-memory.dmp

Filesize
10.8MB

Download
memory/3696-138-0x0000023EA4070000-0x0000023EA407C000-memory.dmp

Filesize
48KB

Download