Resubmissions

19-01-2021 19:24

210119-s26yznnqsn 10

19-11-2020 13:14

201119-s41ec6lt86 10

Analysis

  • max time kernel
    1794s
  • max time network
    429s
  • platform
    windows10_x64
  • resource
    win10v20201028
  • submitted
    19-11-2020 13:14

General

  • Target

    SecurityTaskManager_Setup.exe

Malware Config

Signatures

  • Executes dropped EXE ⋅ 2 IoCs
  • Checks computer location settings ⋅ 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL ⋅ 3 IoCs
  • Reads user/profile data of web browsers ⋅ 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Checks installed software on the system ⋅ 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Checks whether UAC is enabled ⋅ 1 TTPs 1 IoCs
  • Drops file in Program Files directory ⋅ 64 IoCs
  • Enumerates physical storage devices ⋅ 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Checks SCSI registry key(s) ⋅ 3 TTPs 64 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Modifies data under HKEY_USERS ⋅ 2 IoCs
  • Modifies registry class ⋅ 3 IoCs
  • Suspicious behavior: EnumeratesProcesses ⋅ 6 IoCs
  • Suspicious use of AdjustPrivilegeToken ⋅ 17 IoCs
  • Suspicious use of SetWindowsHookEx ⋅ 5 IoCs
  • Suspicious use of WriteProcessMemory ⋅ 9 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\SecurityTaskManager_Setup.exe
    "C:\Users\Admin\AppData\Local\Temp\SecurityTaskManager_Setup.exe"
    Suspicious use of WriteProcessMemory
    PID:1052
    • C:\Users\Admin\AppData\Local\Temp\WZSE0.TMP\setup.exe
      ".\setup.exe"
      Executes dropped EXE
      Drops file in Program Files directory
      Suspicious use of WriteProcessMemory
      PID:3796
      • C:\Windows\SysWOW64\explorer.exe
        "C:\Windows\System32\explorer.exe" "C:\Program Files (x86)\Security Task Manager\taskman.exe"
        PID:496
  • C:\Windows\explorer.exe
    C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
    Suspicious use of WriteProcessMemory
    PID:2596
    • C:\Program Files (x86)\Security Task Manager\TaskMan.exe
      "C:\Program Files (x86)\Security Task Manager\TaskMan.exe"
      Executes dropped EXE
      Checks computer location settings
      Loads dropped DLL
      Checks whether UAC is enabled
      Modifies registry class
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of SetWindowsHookEx
      PID:8
  • C:\Windows\system32\vssvc.exe
    C:\Windows\system32\vssvc.exe
    Suspicious use of AdjustPrivilegeToken
    PID:3800
  • C:\Windows\system32\vssvc.exe
    C:\Windows\system32\vssvc.exe
    Suspicious use of AdjustPrivilegeToken
    PID:3980
  • \??\c:\windows\system32\svchost.exe
    c:\windows\system32\svchost.exe -k netsvcs -s DsmSvc
    Checks SCSI registry key(s)
    Modifies data under HKEY_USERS
    PID:3036
  • C:\Windows\system32\srtasks.exe
    C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
    Suspicious use of AdjustPrivilegeToken
    PID:1076

Network

MITRE ATT&CK Matrix

Command and Control

    Credential Access

    Defense Evasion

      Execution

        Exfiltration

          Impact

            Initial Access

              Lateral Movement

                Persistence

                  Privilege Escalation

                    Replay Monitor

                    00:00 00:00

                    Downloads

                    • C:\Program Files (x86)\Security Task Manager\TaskMan.exe
                    • C:\Program Files (x86)\Security Task Manager\TaskMan.exe
                    • C:\Program Files (x86)\Security Task Manager\ascode.dll
                    • C:\Program Files (x86)\Security Task Manager\lgs_bulgarian.txt
                    • C:\Program Files (x86)\Security Task Manager\lgs_czech.txt
                    • C:\Program Files (x86)\Security Task Manager\lgs_danish.txt
                    • C:\Program Files (x86)\Security Task Manager\lgs_deutsch.txt
                    • C:\Program Files (x86)\Security Task Manager\lgs_dutch.txt
                    • C:\Program Files (x86)\Security Task Manager\lgs_english.txt
                    • C:\Program Files (x86)\Security Task Manager\lgs_finnish.txt
                    • C:\Program Files (x86)\Security Task Manager\lgs_french.txt
                    • C:\Program Files (x86)\Security Task Manager\lgs_hungarian.txt
                    • C:\Program Files (x86)\Security Task Manager\lgs_italiano.txt
                    • C:\Program Files (x86)\Security Task Manager\lgs_japanese.txt
                    • C:\Program Files (x86)\Security Task Manager\lgs_korean.txt
                    • C:\Program Files (x86)\Security Task Manager\lgs_norwegian_bokmaal.txt
                    • C:\Program Files (x86)\Security Task Manager\lgs_polish.txt
                    • C:\Program Files (x86)\Security Task Manager\lgs_portuguese (Brasil).txt
                    • C:\Program Files (x86)\Security Task Manager\lgs_portuguese.txt
                    • C:\Program Files (x86)\Security Task Manager\lgs_russian.txt
                    • C:\Program Files (x86)\Security Task Manager\lgs_spanish.txt
                    • C:\Program Files (x86)\Security Task Manager\lgs_swedish.txt
                    • C:\Program Files (x86)\Security Task Manager\lgs_turkish.txt
                    • C:\Program Files (x86)\Security Task Manager\lgs_ukrainian.txt
                    • C:\Program Files (x86)\Security Task Manager\sqlite3.dll
                    • C:\Users\Admin\AppData\Local\Temp\WZSE0.TMP\Formulaire.txt
                    • C:\Users\Admin\AppData\Local\Temp\WZSE0.TMP\LisezMoi.txt
                    • C:\Users\Admin\AppData\Local\Temp\WZSE0.TMP\Setup.exe
                    • C:\Users\Admin\AppData\Local\Temp\WZSE0.TMP\SpyProDll.dll
                    • C:\Users\Admin\AppData\Local\Temp\WZSE0.TMP\SpyProtector.exe
                    • C:\Users\Admin\AppData\Local\Temp\WZSE0.TMP\ascode.dll
                    • C:\Users\Admin\AppData\Local\Temp\WZSE0.TMP\bestell.txt
                    • C:\Users\Admin\AppData\Local\Temp\WZSE0.TMP\file_id.diz
                    • C:\Users\Admin\AppData\Local\Temp\WZSE0.TMP\leggimi.txt
                    • C:\Users\Admin\AppData\Local\Temp\WZSE0.TMP\lgs_bulgarian.txt
                    • C:\Users\Admin\AppData\Local\Temp\WZSE0.TMP\lgs_czech.txt
                    • C:\Users\Admin\AppData\Local\Temp\WZSE0.TMP\lgs_danish.txt
                    • C:\Users\Admin\AppData\Local\Temp\WZSE0.TMP\lgs_deutsch.txt
                    • C:\Users\Admin\AppData\Local\Temp\WZSE0.TMP\lgs_dutch.txt
                    • C:\Users\Admin\AppData\Local\Temp\WZSE0.TMP\lgs_english.txt
                    • C:\Users\Admin\AppData\Local\Temp\WZSE0.TMP\lgs_finnish.txt
                    • C:\Users\Admin\AppData\Local\Temp\WZSE0.TMP\lgs_french.txt
                    • C:\Users\Admin\AppData\Local\Temp\WZSE0.TMP\lgs_hungarian.txt
                    • C:\Users\Admin\AppData\Local\Temp\WZSE0.TMP\lgs_italiano.txt
                    • C:\Users\Admin\AppData\Local\Temp\WZSE0.TMP\lgs_japanese.txt
                    • C:\Users\Admin\AppData\Local\Temp\WZSE0.TMP\lgs_korean.txt
                    • C:\Users\Admin\AppData\Local\Temp\WZSE0.TMP\lgs_norwegian_bokmaal.txt
                    • C:\Users\Admin\AppData\Local\Temp\WZSE0.TMP\lgs_polish.txt
                    • C:\Users\Admin\AppData\Local\Temp\WZSE0.TMP\lgs_portuguese (Brasil).txt
                    • C:\Users\Admin\AppData\Local\Temp\WZSE0.TMP\lgs_portuguese.txt
                    • C:\Users\Admin\AppData\Local\Temp\WZSE0.TMP\lgs_russian.txt
                    • C:\Users\Admin\AppData\Local\Temp\WZSE0.TMP\lgs_spanish.txt
                    • C:\Users\Admin\AppData\Local\Temp\WZSE0.TMP\lgs_swedish.txt
                    • C:\Users\Admin\AppData\Local\Temp\WZSE0.TMP\lgs_turkish.txt
                    • C:\Users\Admin\AppData\Local\Temp\WZSE0.TMP\lgs_ukrainian.txt
                    • C:\Users\Admin\AppData\Local\Temp\WZSE0.TMP\liesmich.txt
                    • C:\Users\Admin\AppData\Local\Temp\WZSE0.TMP\manual_de.pdf
                    • C:\Users\Admin\AppData\Local\Temp\WZSE0.TMP\manual_en.pdf
                    • C:\Users\Admin\AppData\Local\Temp\WZSE0.TMP\manual_fr.pdf
                    • C:\Users\Admin\AppData\Local\Temp\WZSE0.TMP\order.txt
                    • C:\Users\Admin\AppData\Local\Temp\WZSE0.TMP\ordina.txt
                    • C:\Users\Admin\AppData\Local\Temp\WZSE0.TMP\psapi_.dll
                    • C:\Users\Admin\AppData\Local\Temp\WZSE0.TMP\readme.txt
                    • C:\Users\Admin\AppData\Local\Temp\WZSE0.TMP\setup.exe
                    • C:\Users\Admin\AppData\Local\Temp\WZSE0.TMP\sqlite3.dll
                    • C:\Users\Admin\AppData\Local\Temp\WZSE0.TMP\taskman.exe
                    • C:\Users\Admin\AppData\Local\Temp\WZSE0.TMP\taskman_de.chm
                    • C:\Users\Admin\AppData\Local\Temp\WZSE0.TMP\taskman_en.chm
                    • C:\Users\Admin\AppData\Local\Temp\WZSE0.TMP\taskman_fr.chm
                    • C:\Users\Admin\AppData\Local\Temp\WZSE0.TMP\taskman_ru.chm
                    • C:\Users\Admin\AppData\Local\Temp\WZSE0.TMP\uninstal.exe
                    • C:\Users\Public\Desktop\Security Task Manager.lnk
                    • \Program Files (x86)\Security Task Manager\ascode.dll
                    • \Program Files (x86)\Security Task Manager\ascode.dll
                    • \Program Files (x86)\Security Task Manager\sqlite3.dll
                    • memory/8-204-0x0000000006470000-0x0000000006471000-memory.dmp
                    • memory/8-310-0x0000000006470000-0x0000000006471000-memory.dmp
                    • memory/8-203-0x0000000006470000-0x0000000006471000-memory.dmp
                    • memory/8-552-0x0000000006690000-0x000000000669A000-memory.dmp
                    • memory/8-205-0x0000000006470000-0x0000000006471000-memory.dmp
                    • memory/8-206-0x0000000006470000-0x0000000006471000-memory.dmp
                    • memory/8-207-0x0000000006470000-0x0000000006471000-memory.dmp
                    • memory/8-208-0x0000000006470000-0x0000000006471000-memory.dmp
                    • memory/8-209-0x0000000006470000-0x0000000006471000-memory.dmp
                    • memory/8-210-0x0000000006470000-0x0000000006471000-memory.dmp
                    • memory/8-212-0x0000000006470000-0x0000000006471000-memory.dmp
                    • memory/8-211-0x0000000006470000-0x0000000006471000-memory.dmp
                    • memory/8-213-0x0000000006470000-0x0000000006471000-memory.dmp
                    • memory/8-214-0x0000000006470000-0x0000000006471000-memory.dmp
                    • memory/8-216-0x0000000006470000-0x0000000006471000-memory.dmp
                    • memory/8-215-0x0000000006470000-0x0000000006471000-memory.dmp
                    • memory/8-217-0x0000000006470000-0x0000000006471000-memory.dmp
                    • memory/8-218-0x0000000006470000-0x0000000006471000-memory.dmp
                    • memory/8-219-0x0000000006470000-0x0000000006471000-memory.dmp
                    • memory/8-221-0x0000000006470000-0x0000000006471000-memory.dmp
                    • memory/8-220-0x0000000006470000-0x0000000006471000-memory.dmp
                    • memory/8-222-0x0000000006470000-0x0000000006471000-memory.dmp
                    • memory/8-223-0x0000000006470000-0x0000000006471000-memory.dmp
                    • memory/8-224-0x0000000006470000-0x0000000006471000-memory.dmp
                    • memory/8-225-0x0000000006470000-0x0000000006471000-memory.dmp
                    • memory/8-226-0x0000000006470000-0x0000000006471000-memory.dmp
                    • memory/8-227-0x0000000006470000-0x0000000006471000-memory.dmp
                    • memory/8-228-0x0000000006470000-0x0000000006471000-memory.dmp
                    • memory/8-229-0x0000000006470000-0x0000000006471000-memory.dmp
                    • memory/8-230-0x0000000006470000-0x0000000006471000-memory.dmp
                    • memory/8-254-0x0000000006470000-0x0000000006471000-memory.dmp
                    • memory/8-300-0x0000000006470000-0x0000000006471000-memory.dmp
                    • memory/8-301-0x0000000006470000-0x0000000006471000-memory.dmp
                    • memory/8-302-0x0000000006470000-0x0000000006471000-memory.dmp
                    • memory/8-303-0x0000000006470000-0x0000000006471000-memory.dmp
                    • memory/8-304-0x0000000006470000-0x0000000006471000-memory.dmp
                    • memory/8-305-0x0000000006470000-0x0000000006471000-memory.dmp
                    • memory/8-306-0x0000000006470000-0x0000000006471000-memory.dmp
                    • memory/8-307-0x0000000006470000-0x0000000006471000-memory.dmp
                    • memory/8-308-0x0000000006470000-0x0000000006471000-memory.dmp
                    • memory/8-309-0x0000000006470000-0x0000000006471000-memory.dmp
                    • memory/8-202-0x0000000006470000-0x0000000006471000-memory.dmp
                    • memory/8-311-0x0000000006470000-0x0000000006471000-memory.dmp
                    • memory/8-312-0x0000000006470000-0x0000000006471000-memory.dmp
                    • memory/8-313-0x0000000006470000-0x0000000006471000-memory.dmp
                    • memory/8-314-0x0000000006470000-0x0000000006471000-memory.dmp
                    • memory/8-315-0x0000000006470000-0x0000000006471000-memory.dmp
                    • memory/8-316-0x0000000006470000-0x0000000006471000-memory.dmp
                    • memory/8-317-0x0000000006470000-0x0000000006471000-memory.dmp
                    • memory/8-318-0x0000000006470000-0x0000000006471000-memory.dmp
                    • memory/8-319-0x0000000006470000-0x0000000006471000-memory.dmp
                    • memory/8-320-0x0000000006470000-0x0000000006471000-memory.dmp
                    • memory/8-321-0x0000000006470000-0x0000000006471000-memory.dmp
                    • memory/8-323-0x0000000006470000-0x0000000006471000-memory.dmp
                    • memory/8-201-0x0000000006470000-0x0000000006471000-memory.dmp
                    • memory/8-200-0x0000000006470000-0x0000000006471000-memory.dmp
                    • memory/8-199-0x0000000006470000-0x0000000006471000-memory.dmp
                    • memory/8-198-0x0000000006470000-0x0000000006471000-memory.dmp
                    • memory/8-197-0x0000000006470000-0x0000000006471000-memory.dmp
                    • memory/8-196-0x0000000006470000-0x0000000006471000-memory.dmp
                    • memory/8-195-0x0000000006470000-0x0000000006471000-memory.dmp
                    • memory/8-194-0x0000000006470000-0x0000000006471000-memory.dmp
                    • memory/8-193-0x0000000006470000-0x0000000006471000-memory.dmp
                    • memory/8-192-0x0000000006470000-0x0000000006471000-memory.dmp
                    • memory/8-191-0x0000000006470000-0x0000000006471000-memory.dmp
                    • memory/8-190-0x0000000006470000-0x0000000006471000-memory.dmp
                    • memory/8-189-0x0000000006470000-0x0000000006471000-memory.dmp
                    • memory/8-188-0x0000000006470000-0x0000000006471000-memory.dmp
                    • memory/8-187-0x0000000006470000-0x0000000006471000-memory.dmp
                    • memory/8-186-0x0000000006470000-0x0000000006471000-memory.dmp
                    • memory/8-185-0x0000000006470000-0x0000000006471000-memory.dmp
                    • memory/8-121-0x0000000005B70000-0x0000000005B71000-memory.dmp
                    • memory/8-57-0x00000000046A0000-0x00000000046A1000-memory.dmp
                    • memory/8-49-0x0000000000000000-mapping.dmp
                    • memory/8-485-0x0000000006CA0000-0x0000000006DAA000-memory.dmp
                    • memory/8-497-0x0000000006CA0000-0x0000000006DAA000-memory.dmp
                    • memory/8-501-0x0000000006CA0000-0x0000000006DAA000-memory.dmp
                    • memory/8-505-0x0000000006CA0000-0x0000000006DAA000-memory.dmp
                    • memory/8-549-0x0000000007A50000-0x0000000007A54000-memory.dmp
                    • memory/8-541-0x00000000046A0000-0x00000000046A1000-memory.dmp
                    • memory/8-542-0x00000000046A0000-0x00000000046A1000-memory.dmp
                    • memory/8-546-0x0000000007A50000-0x0000000007A54000-memory.dmp
                    • memory/496-47-0x0000000000000000-mapping.dmp
                    • memory/3796-0-0x0000000000000000-mapping.dmp