Analysis

  • max time kernel
    150s
  • max time network
    149s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230703-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
  • submitted
    14/07/2023, 09:56

General

  • Target

    onetap.exe

  • Size

    15.2MB

  • MD5

    afb258e94c29c18be991e5eb89540472

  • SHA1

    1470eb03e7ae159fd9a3dda30fd1f4d51cba8019

  • SHA256

    fc88ca904adfb9f327311f5c108ac6f86c4b3d1154e80d6336920ac76d4dba1f

  • SHA512

    9944a365c19b8215e03fca606758592dba968b9749bff50cea973663c813de151317aba1b233652d93b7522a4b4987dfb71e8e8eedc5b7a54d5d54d2f30c3156

  • SSDEEP

    393216:NImpeu54sjGtzgFLJqMQ+aVz6jC5CeHMRdG3UQWYabHYsX:yZu2+qMQzz2gsKUTYY

Malware Config

Signatures

  • Suspicious use of NtCreateUserProcessOtherParentProcess 2 IoCs
  • xmrig

    XMRig is a high performance, open source, cross platform CPU/GPU miner.

  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 3 IoCs
  • XMRig Miner payload 13 IoCs
  • Checks BIOS information in registry 2 TTPs 6 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 2 IoCs
  • Themida packer 20 IoCs

    Detects Themida, an advanced Windows software protection system.

  • Checks whether UAC is enabled 1 TTPs 3 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 3 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: LoadsDriver 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 10 IoCs
  • Suspicious use of WriteProcessMemory 14 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
      PID:3240
      • C:\Users\Admin\AppData\Local\Temp\onetap.exe
        "C:\Users\Admin\AppData\Local\Temp\onetap.exe"
        2⤵
        • Identifies VirtualBox via ACPI registry values (likely anti-VM)
        • Checks BIOS information in registry
        • Checks computer location settings
        • Checks whether UAC is enabled
        • Suspicious use of NtSetInformationThreadHideFromDebugger
        • Suspicious use of WriteProcessMemory
        PID:3652
        • C:\Users\Admin\AppData\Local\Temp\@myagkiy_protected.exe
          "C:\Users\Admin\AppData\Local\Temp\@myagkiy_protected.exe"
          3⤵
          • Identifies VirtualBox via ACPI registry values (likely anti-VM)
          • Checks BIOS information in registry
          • Executes dropped EXE
          • Checks whether UAC is enabled
          • Suspicious use of NtSetInformationThreadHideFromDebugger
          PID:4112
          • C:\Windows\SysWOW64\WerFault.exe
            C:\Windows\SysWOW64\WerFault.exe -u -p 4112 -s 152
            4⤵
            • Program crash
            PID:2972
        • C:\Users\Admin\AppData\Local\Temp\cryptpls_protected.exe
          "C:\Users\Admin\AppData\Local\Temp\cryptpls_protected.exe"
          3⤵
          • Suspicious use of NtCreateUserProcessOtherParentProcess
          • Identifies VirtualBox via ACPI registry values (likely anti-VM)
          • Checks BIOS information in registry
          • Executes dropped EXE
          • Checks whether UAC is enabled
          • Suspicious use of NtSetInformationThreadHideFromDebugger
          • Suspicious use of SetThreadContext
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of WriteProcessMemory
          PID:3024
      • C:\Windows\System32\cmd.exe
        C:\Windows\System32\cmd.exe /c powercfg /x -hibernate-timeout-ac 0 & powercfg /x -hibernate-timeout-dc 0 & powercfg /x -standby-timeout-ac 0 & powercfg /x -standby-timeout-dc 0
        2⤵
        • Suspicious use of WriteProcessMemory
        PID:2156
        • C:\Windows\System32\powercfg.exe
          powercfg /x -hibernate-timeout-ac 0
          3⤵
          • Suspicious use of AdjustPrivilegeToken
          PID:2928
        • C:\Windows\System32\powercfg.exe
          powercfg /x -hibernate-timeout-dc 0
          3⤵
          • Suspicious use of AdjustPrivilegeToken
          PID:784
        • C:\Windows\System32\powercfg.exe
          powercfg /x -standby-timeout-ac 0
          3⤵
          • Suspicious use of AdjustPrivilegeToken
          PID:1436
        • C:\Windows\System32\powercfg.exe
          powercfg /x -standby-timeout-dc 0
          3⤵
          • Suspicious use of AdjustPrivilegeToken
          PID:2676
      • C:\Windows\explorer.exe
        C:\Windows\explorer.exe
        2⤵
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:5080
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4112 -ip 4112
      1⤵
        PID:524

      Network

            MITRE ATT&CK Enterprise v6

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            • C:\Users\Admin\AppData\Local\Temp\@myagkiy_protected.exe

              Filesize

              3.4MB

              MD5

              e90fae32382eb76fa61f8af25cb08403

              SHA1

              cf6762b5ce07b55d4ab2ae663458ea26fb5ddb0f

              SHA256

              ef47509edc8c5231c49701377fd83ea19125f1dc2eeb08ccef7fb58ff8c32c66

              SHA512

              36f24d11a497ac7c1b618c8c9ba38c75c52f97f4f994657aab89db4aa5dbb184f0695680c6f56bf329f6fc1e73556e259f55b9e988fb3b05ecaf834d703a698a

            • C:\Users\Admin\AppData\Local\Temp\@myagkiy_protected.exe

              Filesize

              3.4MB

              MD5

              e90fae32382eb76fa61f8af25cb08403

              SHA1

              cf6762b5ce07b55d4ab2ae663458ea26fb5ddb0f

              SHA256

              ef47509edc8c5231c49701377fd83ea19125f1dc2eeb08ccef7fb58ff8c32c66

              SHA512

              36f24d11a497ac7c1b618c8c9ba38c75c52f97f4f994657aab89db4aa5dbb184f0695680c6f56bf329f6fc1e73556e259f55b9e988fb3b05ecaf834d703a698a

            • C:\Users\Admin\AppData\Local\Temp\@myagkiy_protected.exe

              Filesize

              3.4MB

              MD5

              e90fae32382eb76fa61f8af25cb08403

              SHA1

              cf6762b5ce07b55d4ab2ae663458ea26fb5ddb0f

              SHA256

              ef47509edc8c5231c49701377fd83ea19125f1dc2eeb08ccef7fb58ff8c32c66

              SHA512

              36f24d11a497ac7c1b618c8c9ba38c75c52f97f4f994657aab89db4aa5dbb184f0695680c6f56bf329f6fc1e73556e259f55b9e988fb3b05ecaf834d703a698a

            • C:\Users\Admin\AppData\Local\Temp\cryptpls_protected.exe

              Filesize

              9.5MB

              MD5

              5478e8d1f4b167b894193583c24673a4

              SHA1

              fdd50bb3d379e3a54061caff7f5f15706c763179

              SHA256

              7cebddc53d178955b1cf3d0428bac2650d50132f42cefc83749e1387b7742d1a

              SHA512

              2b2ca6316629dc870cb7a17cd42de10f2ecb57cd867c4eba9256026ae8f700f796e8c3d9ae4465731dcad1a800031db9bc9a4a3b3bb1d547701678f0b67163d6

            • C:\Users\Admin\AppData\Local\Temp\cryptpls_protected.exe

              Filesize

              9.5MB

              MD5

              5478e8d1f4b167b894193583c24673a4

              SHA1

              fdd50bb3d379e3a54061caff7f5f15706c763179

              SHA256

              7cebddc53d178955b1cf3d0428bac2650d50132f42cefc83749e1387b7742d1a

              SHA512

              2b2ca6316629dc870cb7a17cd42de10f2ecb57cd867c4eba9256026ae8f700f796e8c3d9ae4465731dcad1a800031db9bc9a4a3b3bb1d547701678f0b67163d6

            • memory/3024-166-0x00007FF69CDB0000-0x00007FF69DF91000-memory.dmp

              Filesize

              17.9MB

            • memory/3024-159-0x00007FF69CDB0000-0x00007FF69DF91000-memory.dmp

              Filesize

              17.9MB

            • memory/3024-170-0x00007FF69CDB0000-0x00007FF69DF91000-memory.dmp

              Filesize

              17.9MB

            • memory/3024-167-0x00007FFF06410000-0x00007FFF06605000-memory.dmp

              Filesize

              2.0MB

            • memory/3024-164-0x00007FF69CDB0000-0x00007FF69DF91000-memory.dmp

              Filesize

              17.9MB

            • memory/3024-156-0x00007FF69CDB0000-0x00007FF69DF91000-memory.dmp

              Filesize

              17.9MB

            • memory/3024-158-0x00007FFF06410000-0x00007FFF06605000-memory.dmp

              Filesize

              2.0MB

            • memory/3024-163-0x00007FF69CDB0000-0x00007FF69DF91000-memory.dmp

              Filesize

              17.9MB

            • memory/3024-162-0x00007FF69CDB0000-0x00007FF69DF91000-memory.dmp

              Filesize

              17.9MB

            • memory/3024-172-0x00007FFF06410000-0x00007FFF06605000-memory.dmp

              Filesize

              2.0MB

            • memory/3652-155-0x0000000000730000-0x0000000001A18000-memory.dmp

              Filesize

              18.9MB

            • memory/3652-133-0x0000000000730000-0x0000000001A18000-memory.dmp

              Filesize

              18.9MB

            • memory/3652-134-0x0000000077EB4000-0x0000000077EB6000-memory.dmp

              Filesize

              8KB

            • memory/3652-135-0x0000000000730000-0x0000000001A18000-memory.dmp

              Filesize

              18.9MB

            • memory/4112-161-0x0000000000400000-0x0000000000BA4000-memory.dmp

              Filesize

              7.6MB

            • memory/4112-160-0x0000000000400000-0x0000000000BA4000-memory.dmp

              Filesize

              7.6MB

            • memory/4112-157-0x0000000000400000-0x0000000000BA4000-memory.dmp

              Filesize

              7.6MB

            • memory/4112-165-0x0000000000400000-0x0000000000BA4000-memory.dmp

              Filesize

              7.6MB

            • memory/4112-146-0x0000000000400000-0x0000000000BA4000-memory.dmp

              Filesize

              7.6MB

            • memory/5080-171-0x0000000002D40000-0x0000000002D60000-memory.dmp

              Filesize

              128KB

            • memory/5080-173-0x0000000002E80000-0x0000000002EA0000-memory.dmp

              Filesize

              128KB

            • memory/5080-174-0x00007FF673D30000-0x00007FF67451F000-memory.dmp

              Filesize

              7.9MB

            • memory/5080-175-0x00007FF673D30000-0x00007FF67451F000-memory.dmp

              Filesize

              7.9MB

            • memory/5080-176-0x00007FF673D30000-0x00007FF67451F000-memory.dmp

              Filesize

              7.9MB

            • memory/5080-177-0x00007FF673D30000-0x00007FF67451F000-memory.dmp

              Filesize

              7.9MB

            • memory/5080-178-0x0000000013D80000-0x0000000013DA0000-memory.dmp

              Filesize

              128KB

            • memory/5080-179-0x00007FF673D30000-0x00007FF67451F000-memory.dmp

              Filesize

              7.9MB

            • memory/5080-180-0x0000000013D80000-0x0000000013DA0000-memory.dmp

              Filesize

              128KB

            • memory/5080-181-0x00007FF673D30000-0x00007FF67451F000-memory.dmp

              Filesize

              7.9MB

            • memory/5080-182-0x00007FF673D30000-0x00007FF67451F000-memory.dmp

              Filesize

              7.9MB

            • memory/5080-183-0x00007FF673D30000-0x00007FF67451F000-memory.dmp

              Filesize

              7.9MB

            • memory/5080-184-0x00007FF673D30000-0x00007FF67451F000-memory.dmp

              Filesize

              7.9MB

            • memory/5080-185-0x00007FF673D30000-0x00007FF67451F000-memory.dmp

              Filesize

              7.9MB

            • memory/5080-186-0x00007FF673D30000-0x00007FF67451F000-memory.dmp

              Filesize

              7.9MB

            • memory/5080-187-0x00007FF673D30000-0x00007FF67451F000-memory.dmp

              Filesize

              7.9MB