Resubmissions

12-11-2021 18:04

211112-wnzb8aahhm 10

19-11-2020 10:08

201119-rhwlt38jrx 10

18-11-2020 17:26

201118-htd4fq29va 10

Analysis

  • max time kernel
    1356s
  • max time network
    1369s
  • platform
    windows10_x64
  • resource
    win10v20201028
  • submitted
    18-11-2020 17:26

General

  • Target

    infected dot net installer.exe

Score
8/10

Malware Config

Signatures

  • Executes dropped EXE 3 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL 5 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Modifies registry class 1 IoCs
  • Modifies system certificate store 2 TTPs 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 8 IoCs
  • Suspicious use of WriteProcessMemory 9 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\infected dot net installer.exe
    "C:\Users\Admin\AppData\Local\Temp\infected dot net installer.exe"
    1⤵
    • Checks computer location settings
    • Adds Run key to start application
    • Modifies registry class
    • Suspicious use of WriteProcessMemory
    PID:4640
    • C:\Users\Admin\AppData\Local\Temp\._cache_infected dot net installer.exe
      "C:\Users\Admin\AppData\Local\Temp\._cache_infected dot net installer.exe"
      2⤵
      • Executes dropped EXE
      • Suspicious use of WriteProcessMemory
      PID:2212
      • C:\86941549e018f54fc7c791c237642b\Setup.exe
        C:\86941549e018f54fc7c791c237642b\\Setup.exe /x86 /x64 /web
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Checks processor information in registry
        • Suspicious behavior: EnumeratesProcesses
        PID:4208
    • C:\ProgramData\Synaptics\Synaptics.exe
      "C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate
      2⤵
      • Executes dropped EXE
      • Modifies system certificate store
      PID:3676

Network

MITRE ATT&CK Matrix ATT&CK v6

Persistence

Registry Run Keys / Startup Folder

1
T1060

Defense Evasion

Modify Registry

2
T1112

Install Root Certificate

1
T1130

Discovery

Query Registry

2
T1012

System Information Discovery

3
T1082

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\86941549e018f54fc7c791c237642b\1025\LocalizedData.xml
  • C:\86941549e018f54fc7c791c237642b\1028\LocalizedData.xml
  • C:\86941549e018f54fc7c791c237642b\1029\LocalizedData.xml
  • C:\86941549e018f54fc7c791c237642b\1030\LocalizedData.xml
  • C:\86941549e018f54fc7c791c237642b\1031\LocalizedData.xml
  • C:\86941549e018f54fc7c791c237642b\1032\LocalizedData.xml
  • C:\86941549e018f54fc7c791c237642b\1033\LocalizedData.xml
  • C:\86941549e018f54fc7c791c237642b\1033\SetupResources.dll
  • C:\86941549e018f54fc7c791c237642b\1035\LocalizedData.xml
  • C:\86941549e018f54fc7c791c237642b\1036\LocalizedData.xml
  • C:\86941549e018f54fc7c791c237642b\1037\LocalizedData.xml
  • C:\86941549e018f54fc7c791c237642b\1038\LocalizedData.xml
  • C:\86941549e018f54fc7c791c237642b\1040\LocalizedData.xml
  • C:\86941549e018f54fc7c791c237642b\1041\LocalizedData.xml
  • C:\86941549e018f54fc7c791c237642b\1042\LocalizedData.xml
  • C:\86941549e018f54fc7c791c237642b\1043\LocalizedData.xml
  • C:\86941549e018f54fc7c791c237642b\1044\LocalizedData.xml
  • C:\86941549e018f54fc7c791c237642b\1045\LocalizedData.xml
  • C:\86941549e018f54fc7c791c237642b\1046\LocalizedData.xml
  • C:\86941549e018f54fc7c791c237642b\1049\LocalizedData.xml
  • C:\86941549e018f54fc7c791c237642b\1053\LocalizedData.xml
  • C:\86941549e018f54fc7c791c237642b\1055\LocalizedData.xml
  • C:\86941549e018f54fc7c791c237642b\2052\LocalizedData.xml
  • C:\86941549e018f54fc7c791c237642b\2070\LocalizedData.xml
  • C:\86941549e018f54fc7c791c237642b\3082\LocalizedData.xml
  • C:\86941549e018f54fc7c791c237642b\DHTMLHeader.html
  • C:\86941549e018f54fc7c791c237642b\ParameterInfo.xml
  • C:\86941549e018f54fc7c791c237642b\Setup.exe
  • C:\86941549e018f54fc7c791c237642b\Setup.exe
  • C:\86941549e018f54fc7c791c237642b\SetupEngine.dll
  • C:\86941549e018f54fc7c791c237642b\SetupUi.dll
  • C:\86941549e018f54fc7c791c237642b\SetupUi.xsd
  • C:\86941549e018f54fc7c791c237642b\SplashScreen.bmp
  • C:\86941549e018f54fc7c791c237642b\Strings.xml
  • C:\86941549e018f54fc7c791c237642b\UiInfo.xml
  • C:\86941549e018f54fc7c791c237642b\graphics\print.ico
  • C:\86941549e018f54fc7c791c237642b\graphics\save.ico
  • C:\86941549e018f54fc7c791c237642b\graphics\setup.ico
  • C:\86941549e018f54fc7c791c237642b\graphics\warn.ico
  • C:\86941549e018f54fc7c791c237642b\sqmapi.dll
  • C:\ProgramData\Synaptics\Synaptics.exe
  • C:\ProgramData\Synaptics\Synaptics.exe
  • C:\Users\Admin\AppData\Local\Temp\._cache_infected dot net installer.exe
  • C:\Users\Admin\AppData\Local\Temp\._cache_infected dot net installer.exe
  • \86941549e018f54fc7c791c237642b\1033\SetupResources.dll
  • \86941549e018f54fc7c791c237642b\1033\SetupResources.dll
  • \86941549e018f54fc7c791c237642b\SetupEngine.dll
  • \86941549e018f54fc7c791c237642b\SetupUi.dll
  • \86941549e018f54fc7c791c237642b\sqmapi.dll
  • memory/2212-0-0x0000000000000000-mapping.dmp
  • memory/3676-3-0x0000000000000000-mapping.dmp
  • memory/4208-46-0x0000000002D90000-0x0000000002D92000-memory.dmp
    Filesize

    8KB

  • memory/4208-6-0x0000000000000000-mapping.dmp