Analysis

  • max time kernel
    105s
  • max time network
    111s
  • platform
    windows10-1703_x64
  • resource
    win10-20230703-en
  • resource tags

    arch:x64arch:x86image:win10-20230703-enlocale:en-usos:windows10-1703-x64system
  • submitted
    14/07/2023, 09:56

General

  • Target

    onetap.exe

  • Size

    15.2MB

  • MD5

    afb258e94c29c18be991e5eb89540472

  • SHA1

    1470eb03e7ae159fd9a3dda30fd1f4d51cba8019

  • SHA256

    fc88ca904adfb9f327311f5c108ac6f86c4b3d1154e80d6336920ac76d4dba1f

  • SHA512

    9944a365c19b8215e03fca606758592dba968b9749bff50cea973663c813de151317aba1b233652d93b7522a4b4987dfb71e8e8eedc5b7a54d5d54d2f30c3156

  • SSDEEP

    393216:NImpeu54sjGtzgFLJqMQ+aVz6jC5CeHMRdG3UQWYabHYsX:yZu2+qMQzz2gsKUTYY

Malware Config

Signatures

  • Suspicious use of NtCreateUserProcessOtherParentProcess 3 IoCs
  • xmrig

    XMRig is a high performance, open source, cross platform CPU/GPU miner.

  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 6 IoCs
  • XMRig Miner payload 10 IoCs
  • Checks BIOS information in registry 2 TTPs 12 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Executes dropped EXE 4 IoCs
  • Themida packer 37 IoCs

    Detects Themida, an advanced Windows software protection system.

  • Checks whether UAC is enabled 1 TTPs 6 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 6 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: LoadsDriver 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 18 IoCs
  • Suspicious use of WriteProcessMemory 27 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
      PID:3252
      • C:\Users\Admin\AppData\Local\Temp\onetap.exe
        "C:\Users\Admin\AppData\Local\Temp\onetap.exe"
        2⤵
        • Identifies VirtualBox via ACPI registry values (likely anti-VM)
        • Checks BIOS information in registry
        • Checks whether UAC is enabled
        • Suspicious use of NtSetInformationThreadHideFromDebugger
        • Suspicious use of WriteProcessMemory
        PID:328
        • C:\Users\Admin\AppData\Local\Temp\@myagkiy_protected.exe
          "C:\Users\Admin\AppData\Local\Temp\@myagkiy_protected.exe"
          3⤵
          • Identifies VirtualBox via ACPI registry values (likely anti-VM)
          • Checks BIOS information in registry
          • Executes dropped EXE
          • Checks whether UAC is enabled
          • Suspicious use of NtSetInformationThreadHideFromDebugger
          PID:864
          • C:\Windows\SysWOW64\WerFault.exe
            C:\Windows\SysWOW64\WerFault.exe -u -p 864 -s 536
            4⤵
            • Program crash
            PID:1496
        • C:\Users\Admin\AppData\Local\Temp\cryptpls_protected.exe
          "C:\Users\Admin\AppData\Local\Temp\cryptpls_protected.exe"
          3⤵
          • Suspicious use of NtCreateUserProcessOtherParentProcess
          • Identifies VirtualBox via ACPI registry values (likely anti-VM)
          • Checks BIOS information in registry
          • Executes dropped EXE
          • Checks whether UAC is enabled
          • Suspicious use of NtSetInformationThreadHideFromDebugger
          • Suspicious use of SetThreadContext
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of WriteProcessMemory
          PID:4196
      • C:\Windows\System32\cmd.exe
        C:\Windows\System32\cmd.exe /c powercfg /x -hibernate-timeout-ac 0 & powercfg /x -hibernate-timeout-dc 0 & powercfg /x -standby-timeout-ac 0 & powercfg /x -standby-timeout-dc 0
        2⤵
        • Suspicious use of WriteProcessMemory
        PID:4240
        • C:\Windows\System32\powercfg.exe
          powercfg /x -hibernate-timeout-ac 0
          3⤵
          • Suspicious use of AdjustPrivilegeToken
          PID:4440
        • C:\Windows\System32\powercfg.exe
          powercfg /x -hibernate-timeout-dc 0
          3⤵
          • Suspicious use of AdjustPrivilegeToken
          PID:2492
        • C:\Windows\System32\powercfg.exe
          powercfg /x -standby-timeout-ac 0
          3⤵
          • Suspicious use of AdjustPrivilegeToken
          PID:3428
        • C:\Windows\System32\powercfg.exe
          powercfg /x -standby-timeout-dc 0
          3⤵
          • Suspicious use of AdjustPrivilegeToken
          PID:3472
      • C:\Windows\explorer.exe
        C:\Windows\explorer.exe
        2⤵
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:316
      • C:\Users\Admin\AppData\Local\Temp\onetap.exe
        "C:\Users\Admin\AppData\Local\Temp\onetap.exe"
        2⤵
        • Identifies VirtualBox via ACPI registry values (likely anti-VM)
        • Checks BIOS information in registry
        • Checks whether UAC is enabled
        • Suspicious use of NtSetInformationThreadHideFromDebugger
        • Suspicious use of WriteProcessMemory
        PID:3420
        • C:\Users\Admin\AppData\Local\Temp\@myagkiy_protected.exe
          "C:\Users\Admin\AppData\Local\Temp\@myagkiy_protected.exe"
          3⤵
          • Identifies VirtualBox via ACPI registry values (likely anti-VM)
          • Checks BIOS information in registry
          • Executes dropped EXE
          • Checks whether UAC is enabled
          • Suspicious use of NtSetInformationThreadHideFromDebugger
          PID:4364
          • C:\Windows\SysWOW64\WerFault.exe
            C:\Windows\SysWOW64\WerFault.exe -u -p 4364 -s 128
            4⤵
            • Program crash
            PID:3632
        • C:\Users\Admin\AppData\Local\Temp\cryptpls_protected.exe
          "C:\Users\Admin\AppData\Local\Temp\cryptpls_protected.exe"
          3⤵
          • Suspicious use of NtCreateUserProcessOtherParentProcess
          • Identifies VirtualBox via ACPI registry values (likely anti-VM)
          • Checks BIOS information in registry
          • Executes dropped EXE
          • Checks whether UAC is enabled
          • Suspicious use of NtSetInformationThreadHideFromDebugger
          PID:4076
      • C:\Windows\System32\cmd.exe
        C:\Windows\System32\cmd.exe /c powercfg /x -hibernate-timeout-ac 0 & powercfg /x -hibernate-timeout-dc 0 & powercfg /x -standby-timeout-ac 0 & powercfg /x -standby-timeout-dc 0
        2⤵
        • Suspicious use of WriteProcessMemory
        PID:4936
        • C:\Windows\System32\powercfg.exe
          powercfg /x -hibernate-timeout-ac 0
          3⤵
          • Suspicious use of AdjustPrivilegeToken
          PID:1200
        • C:\Windows\System32\powercfg.exe
          powercfg /x -hibernate-timeout-dc 0
          3⤵
          • Suspicious use of AdjustPrivilegeToken
          PID:2196
        • C:\Windows\System32\powercfg.exe
          powercfg /x -standby-timeout-ac 0
          3⤵
          • Suspicious use of AdjustPrivilegeToken
          PID:1604
        • C:\Windows\System32\powercfg.exe
          powercfg /x -standby-timeout-dc 0
          3⤵
          • Suspicious use of AdjustPrivilegeToken
          PID:1712
    • C:\Windows\System32\rundll32.exe
      C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
      1⤵
        PID:4968

      Network

            MITRE ATT&CK Enterprise v6

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            • C:\Users\Admin\AppData\Local\Temp\@myagkiy_protected.exe

              Filesize

              3.4MB

              MD5

              e90fae32382eb76fa61f8af25cb08403

              SHA1

              cf6762b5ce07b55d4ab2ae663458ea26fb5ddb0f

              SHA256

              ef47509edc8c5231c49701377fd83ea19125f1dc2eeb08ccef7fb58ff8c32c66

              SHA512

              36f24d11a497ac7c1b618c8c9ba38c75c52f97f4f994657aab89db4aa5dbb184f0695680c6f56bf329f6fc1e73556e259f55b9e988fb3b05ecaf834d703a698a

            • C:\Users\Admin\AppData\Local\Temp\@myagkiy_protected.exe

              Filesize

              3.4MB

              MD5

              e90fae32382eb76fa61f8af25cb08403

              SHA1

              cf6762b5ce07b55d4ab2ae663458ea26fb5ddb0f

              SHA256

              ef47509edc8c5231c49701377fd83ea19125f1dc2eeb08ccef7fb58ff8c32c66

              SHA512

              36f24d11a497ac7c1b618c8c9ba38c75c52f97f4f994657aab89db4aa5dbb184f0695680c6f56bf329f6fc1e73556e259f55b9e988fb3b05ecaf834d703a698a

            • C:\Users\Admin\AppData\Local\Temp\@myagkiy_protected.exe

              Filesize

              3.4MB

              MD5

              e90fae32382eb76fa61f8af25cb08403

              SHA1

              cf6762b5ce07b55d4ab2ae663458ea26fb5ddb0f

              SHA256

              ef47509edc8c5231c49701377fd83ea19125f1dc2eeb08ccef7fb58ff8c32c66

              SHA512

              36f24d11a497ac7c1b618c8c9ba38c75c52f97f4f994657aab89db4aa5dbb184f0695680c6f56bf329f6fc1e73556e259f55b9e988fb3b05ecaf834d703a698a

            • C:\Users\Admin\AppData\Local\Temp\@myagkiy_protected.exe

              Filesize

              3.4MB

              MD5

              e90fae32382eb76fa61f8af25cb08403

              SHA1

              cf6762b5ce07b55d4ab2ae663458ea26fb5ddb0f

              SHA256

              ef47509edc8c5231c49701377fd83ea19125f1dc2eeb08ccef7fb58ff8c32c66

              SHA512

              36f24d11a497ac7c1b618c8c9ba38c75c52f97f4f994657aab89db4aa5dbb184f0695680c6f56bf329f6fc1e73556e259f55b9e988fb3b05ecaf834d703a698a

            • C:\Users\Admin\AppData\Local\Temp\cryptpls_protected.exe

              Filesize

              9.5MB

              MD5

              5478e8d1f4b167b894193583c24673a4

              SHA1

              fdd50bb3d379e3a54061caff7f5f15706c763179

              SHA256

              7cebddc53d178955b1cf3d0428bac2650d50132f42cefc83749e1387b7742d1a

              SHA512

              2b2ca6316629dc870cb7a17cd42de10f2ecb57cd867c4eba9256026ae8f700f796e8c3d9ae4465731dcad1a800031db9bc9a4a3b3bb1d547701678f0b67163d6

            • C:\Users\Admin\AppData\Local\Temp\cryptpls_protected.exe

              Filesize

              9.5MB

              MD5

              5478e8d1f4b167b894193583c24673a4

              SHA1

              fdd50bb3d379e3a54061caff7f5f15706c763179

              SHA256

              7cebddc53d178955b1cf3d0428bac2650d50132f42cefc83749e1387b7742d1a

              SHA512

              2b2ca6316629dc870cb7a17cd42de10f2ecb57cd867c4eba9256026ae8f700f796e8c3d9ae4465731dcad1a800031db9bc9a4a3b3bb1d547701678f0b67163d6

            • C:\Users\Admin\AppData\Local\Temp\cryptpls_protected.exe

              Filesize

              9.5MB

              MD5

              5478e8d1f4b167b894193583c24673a4

              SHA1

              fdd50bb3d379e3a54061caff7f5f15706c763179

              SHA256

              7cebddc53d178955b1cf3d0428bac2650d50132f42cefc83749e1387b7742d1a

              SHA512

              2b2ca6316629dc870cb7a17cd42de10f2ecb57cd867c4eba9256026ae8f700f796e8c3d9ae4465731dcad1a800031db9bc9a4a3b3bb1d547701678f0b67163d6

            • C:\Users\Admin\AppData\Local\Temp\cryptpls_protected.exe

              Filesize

              9.5MB

              MD5

              5478e8d1f4b167b894193583c24673a4

              SHA1

              fdd50bb3d379e3a54061caff7f5f15706c763179

              SHA256

              7cebddc53d178955b1cf3d0428bac2650d50132f42cefc83749e1387b7742d1a

              SHA512

              2b2ca6316629dc870cb7a17cd42de10f2ecb57cd867c4eba9256026ae8f700f796e8c3d9ae4465731dcad1a800031db9bc9a4a3b3bb1d547701678f0b67163d6

            • C:\Users\Admin\AppData\Roaming\Google\Libs\WR64.sys

              Filesize

              14KB

              MD5

              0c0195c48b6b8582fa6f6373032118da

              SHA1

              d25340ae8e92a6d29f599fef426a2bc1b5217299

              SHA256

              11bd2c9f9e2397c9a16e0990e4ed2cf0679498fe0fd418a3dfdac60b5c160ee5

              SHA512

              ab28e99659f219fec553155a0810de90f0c5b07dc9b66bda86d7686499fb0ec5fddeb7cd7a3c5b77dccb5e865f2715c2d81f4d40df4431c92ac7860c7e01720d

            • memory/316-152-0x0000000000DE0000-0x0000000000E00000-memory.dmp

              Filesize

              128KB

            • memory/316-162-0x00007FF601FB0000-0x00007FF60279F000-memory.dmp

              Filesize

              7.9MB

            • memory/316-180-0x0000000013A50000-0x0000000013A70000-memory.dmp

              Filesize

              128KB

            • memory/316-176-0x00007FF601FB0000-0x00007FF60279F000-memory.dmp

              Filesize

              7.9MB

            • memory/316-202-0x00007FF601FB0000-0x00007FF60279F000-memory.dmp

              Filesize

              7.9MB

            • memory/316-163-0x0000000013A50000-0x0000000013A70000-memory.dmp

              Filesize

              128KB

            • memory/316-161-0x00007FF601FB0000-0x00007FF60279F000-memory.dmp

              Filesize

              7.9MB

            • memory/316-199-0x00007FF601FB0000-0x00007FF60279F000-memory.dmp

              Filesize

              7.9MB

            • memory/316-159-0x00007FF601FB0000-0x00007FF60279F000-memory.dmp

              Filesize

              7.9MB

            • memory/316-192-0x00007FF601FB0000-0x00007FF60279F000-memory.dmp

              Filesize

              7.9MB

            • memory/316-157-0x0000000002A60000-0x0000000002AA0000-memory.dmp

              Filesize

              256KB

            • memory/316-187-0x00007FF601FB0000-0x00007FF60279F000-memory.dmp

              Filesize

              7.9MB

            • memory/328-122-0x0000000000370000-0x0000000001658000-memory.dmp

              Filesize

              18.9MB

            • memory/328-123-0x0000000077364000-0x0000000077365000-memory.dmp

              Filesize

              4KB

            • memory/328-124-0x0000000000370000-0x0000000001658000-memory.dmp

              Filesize

              18.9MB

            • memory/328-135-0x0000000000370000-0x0000000001658000-memory.dmp

              Filesize

              18.9MB

            • memory/864-138-0x0000000000400000-0x0000000000BA4000-memory.dmp

              Filesize

              7.6MB

            • memory/864-140-0x0000000000400000-0x0000000000BA4000-memory.dmp

              Filesize

              7.6MB

            • memory/864-131-0x0000000000400000-0x0000000000BA4000-memory.dmp

              Filesize

              7.6MB

            • memory/864-142-0x0000000000400000-0x0000000000BA4000-memory.dmp

              Filesize

              7.6MB

            • memory/3420-175-0x0000000000370000-0x0000000001658000-memory.dmp

              Filesize

              18.9MB

            • memory/3420-165-0x0000000000370000-0x0000000001658000-memory.dmp

              Filesize

              18.9MB

            • memory/3420-164-0x0000000000370000-0x0000000001658000-memory.dmp

              Filesize

              18.9MB

            • memory/4076-197-0x00007FFD42C80000-0x00007FFD42E5B000-memory.dmp

              Filesize

              1.9MB

            • memory/4076-196-0x00007FF76D090000-0x00007FF76E271000-memory.dmp

              Filesize

              17.9MB

            • memory/4076-193-0x00007FFD42C80000-0x00007FFD42E5B000-memory.dmp

              Filesize

              1.9MB

            • memory/4076-189-0x00007FF76D090000-0x00007FF76E271000-memory.dmp

              Filesize

              17.9MB

            • memory/4076-186-0x00007FF76D090000-0x00007FF76E271000-memory.dmp

              Filesize

              17.9MB

            • memory/4076-177-0x00007FF76D090000-0x00007FF76E271000-memory.dmp

              Filesize

              17.9MB

            • memory/4076-179-0x00007FF76D090000-0x00007FF76E271000-memory.dmp

              Filesize

              17.9MB

            • memory/4076-183-0x00007FF76D090000-0x00007FF76E271000-memory.dmp

              Filesize

              17.9MB

            • memory/4076-182-0x00007FFD42C80000-0x00007FFD42E5B000-memory.dmp

              Filesize

              1.9MB

            • memory/4076-185-0x00007FF76D090000-0x00007FF76E271000-memory.dmp

              Filesize

              17.9MB

            • memory/4196-141-0x00007FF7C0080000-0x00007FF7C1261000-memory.dmp

              Filesize

              17.9MB

            • memory/4196-147-0x00007FF7C0080000-0x00007FF7C1261000-memory.dmp

              Filesize

              17.9MB

            • memory/4196-137-0x00007FF7C0080000-0x00007FF7C1261000-memory.dmp

              Filesize

              17.9MB

            • memory/4196-136-0x00007FF7C0080000-0x00007FF7C1261000-memory.dmp

              Filesize

              17.9MB

            • memory/4196-154-0x00007FFD42C80000-0x00007FFD42E5B000-memory.dmp

              Filesize

              1.9MB

            • memory/4196-151-0x00007FF7C0080000-0x00007FF7C1261000-memory.dmp

              Filesize

              17.9MB

            • memory/4196-148-0x00007FFD42C80000-0x00007FFD42E5B000-memory.dmp

              Filesize

              1.9MB

            • memory/4196-139-0x00007FFD42C80000-0x00007FFD42E5B000-memory.dmp

              Filesize

              1.9MB

            • memory/4196-146-0x00007FF7C0080000-0x00007FF7C1261000-memory.dmp

              Filesize

              17.9MB

            • memory/4196-144-0x00007FF7C0080000-0x00007FF7C1261000-memory.dmp

              Filesize

              17.9MB

            • memory/4196-143-0x00007FF7C0080000-0x00007FF7C1261000-memory.dmp

              Filesize

              17.9MB

            • memory/4364-178-0x0000000000400000-0x0000000000BA4000-memory.dmp

              Filesize

              7.6MB

            • memory/4364-181-0x0000000000400000-0x0000000000BA4000-memory.dmp

              Filesize

              7.6MB

            • memory/4364-201-0x0000000000400000-0x0000000000BA4000-memory.dmp

              Filesize

              7.6MB

            • memory/4364-184-0x0000000000400000-0x0000000000BA4000-memory.dmp

              Filesize

              7.6MB