Analysis

  • max time kernel
    1062s
  • max time network
    385s
  • platform
    windows10_x64
  • resource
    win10v20201028
  • submitted
    20-11-2020 14:34

General

  • Target

    SecurityTaskManager_Setup.exe

Malware Config

Signatures

  • Executes dropped EXE ⋅ 3 IoCs
  • Loads dropped DLL ⋅ 6 IoCs
  • Reads user/profile data of web browsers ⋅ 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Checks installed software on the system ⋅ 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Checks whether UAC is enabled ⋅ 1 TTPs 2 IoCs
  • Drops file in Program Files directory ⋅ 64 IoCs
  • Enumerates physical storage devices ⋅ 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Modifies registry class ⋅ 6 IoCs
  • Suspicious behavior: EnumeratesProcesses ⋅ 4 IoCs
  • Suspicious use of AdjustPrivilegeToken ⋅ 5 IoCs
  • Suspicious use of SetWindowsHookEx ⋅ 9 IoCs
  • Suspicious use of WriteProcessMemory ⋅ 9 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\SecurityTaskManager_Setup.exe
    "C:\Users\Admin\AppData\Local\Temp\SecurityTaskManager_Setup.exe"
    Suspicious use of WriteProcessMemory
    PID:3084
    • C:\Users\Admin\AppData\Local\Temp\WZSE0.TMP\setup.exe
      ".\setup.exe"
      Executes dropped EXE
      Drops file in Program Files directory
      Suspicious use of WriteProcessMemory
      PID:2796
      • C:\Windows\SysWOW64\explorer.exe
        "C:\Windows\System32\explorer.exe" "C:\Program Files (x86)\Security Task Manager\taskman.exe"
        PID:1848
  • C:\Windows\explorer.exe
    C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
    Suspicious use of WriteProcessMemory
    PID:1956
    • C:\Program Files (x86)\Security Task Manager\TaskMan.exe
      "C:\Program Files (x86)\Security Task Manager\TaskMan.exe"
      Executes dropped EXE
      Loads dropped DLL
      Checks whether UAC is enabled
      Modifies registry class
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of SetWindowsHookEx
      PID:1712
  • C:\Program Files (x86)\Security Task Manager\TaskMan.exe
    "C:\Program Files (x86)\Security Task Manager\TaskMan.exe"
    Executes dropped EXE
    Loads dropped DLL
    Checks whether UAC is enabled
    Modifies registry class
    Suspicious behavior: EnumeratesProcesses
    Suspicious use of AdjustPrivilegeToken
    Suspicious use of SetWindowsHookEx
    PID:1612
  • C:\Windows\system32\vssvc.exe
    C:\Windows\system32\vssvc.exe
    Suspicious use of AdjustPrivilegeToken
    PID:3552

Network

MITRE ATT&CK Matrix

Command and Control

    Credential Access

    Defense Evasion

      Execution

        Exfiltration

          Impact

            Initial Access

              Lateral Movement

                Persistence

                  Privilege Escalation

                    Replay Monitor

                    00:00 00:00

                    Downloads

                    • C:\Program Files (x86)\Security Task Manager\TaskMan.exe
                    • C:\Program Files (x86)\Security Task Manager\TaskMan.exe
                    • C:\Program Files (x86)\Security Task Manager\TaskMan.exe
                    • C:\Program Files (x86)\Security Task Manager\ascode.dll
                    • C:\Program Files (x86)\Security Task Manager\lgs_bulgarian.txt
                    • C:\Program Files (x86)\Security Task Manager\lgs_czech.txt
                    • C:\Program Files (x86)\Security Task Manager\lgs_danish.txt
                    • C:\Program Files (x86)\Security Task Manager\lgs_deutsch.txt
                    • C:\Program Files (x86)\Security Task Manager\lgs_dutch.txt
                    • C:\Program Files (x86)\Security Task Manager\lgs_english.txt
                    • C:\Program Files (x86)\Security Task Manager\lgs_finnish.txt
                    • C:\Program Files (x86)\Security Task Manager\lgs_french.txt
                    • C:\Program Files (x86)\Security Task Manager\lgs_hungarian.txt
                    • C:\Program Files (x86)\Security Task Manager\lgs_italiano.txt
                    • C:\Program Files (x86)\Security Task Manager\lgs_japanese.txt
                    • C:\Program Files (x86)\Security Task Manager\lgs_korean.txt
                    • C:\Program Files (x86)\Security Task Manager\lgs_norwegian_bokmaal.txt
                    • C:\Program Files (x86)\Security Task Manager\lgs_polish.txt
                    • C:\Program Files (x86)\Security Task Manager\lgs_portuguese (Brasil).txt
                    • C:\Program Files (x86)\Security Task Manager\lgs_portuguese.txt
                    • C:\Program Files (x86)\Security Task Manager\lgs_russian.txt
                    • C:\Program Files (x86)\Security Task Manager\lgs_spanish.txt
                    • C:\Program Files (x86)\Security Task Manager\lgs_swedish.txt
                    • C:\Program Files (x86)\Security Task Manager\lgs_turkish.txt
                    • C:\Program Files (x86)\Security Task Manager\lgs_ukrainian.txt
                    • C:\Program Files (x86)\Security Task Manager\sqlite3.dll
                    • C:\ProgramData\SecTaskMan\WindowsUpdates\~jbtmp.log
                    • C:\Users\Admin\AppData\Local\Temp\WZSE0.TMP\Formulaire.txt
                    • C:\Users\Admin\AppData\Local\Temp\WZSE0.TMP\LisezMoi.txt
                    • C:\Users\Admin\AppData\Local\Temp\WZSE0.TMP\Setup.exe
                    • C:\Users\Admin\AppData\Local\Temp\WZSE0.TMP\SpyProDll.dll
                    • C:\Users\Admin\AppData\Local\Temp\WZSE0.TMP\SpyProtector.exe
                    • C:\Users\Admin\AppData\Local\Temp\WZSE0.TMP\ascode.dll
                    • C:\Users\Admin\AppData\Local\Temp\WZSE0.TMP\bestell.txt
                    • C:\Users\Admin\AppData\Local\Temp\WZSE0.TMP\file_id.diz
                    • C:\Users\Admin\AppData\Local\Temp\WZSE0.TMP\leggimi.txt
                    • C:\Users\Admin\AppData\Local\Temp\WZSE0.TMP\lgs_bulgarian.txt
                    • C:\Users\Admin\AppData\Local\Temp\WZSE0.TMP\lgs_czech.txt
                    • C:\Users\Admin\AppData\Local\Temp\WZSE0.TMP\lgs_danish.txt
                    • C:\Users\Admin\AppData\Local\Temp\WZSE0.TMP\lgs_deutsch.txt
                    • C:\Users\Admin\AppData\Local\Temp\WZSE0.TMP\lgs_dutch.txt
                    • C:\Users\Admin\AppData\Local\Temp\WZSE0.TMP\lgs_english.txt
                    • C:\Users\Admin\AppData\Local\Temp\WZSE0.TMP\lgs_finnish.txt
                    • C:\Users\Admin\AppData\Local\Temp\WZSE0.TMP\lgs_french.txt
                    • C:\Users\Admin\AppData\Local\Temp\WZSE0.TMP\lgs_hungarian.txt
                    • C:\Users\Admin\AppData\Local\Temp\WZSE0.TMP\lgs_italiano.txt
                    • C:\Users\Admin\AppData\Local\Temp\WZSE0.TMP\lgs_japanese.txt
                    • C:\Users\Admin\AppData\Local\Temp\WZSE0.TMP\lgs_korean.txt
                    • C:\Users\Admin\AppData\Local\Temp\WZSE0.TMP\lgs_norwegian_bokmaal.txt
                    • C:\Users\Admin\AppData\Local\Temp\WZSE0.TMP\lgs_polish.txt
                    • C:\Users\Admin\AppData\Local\Temp\WZSE0.TMP\lgs_portuguese (Brasil).txt
                    • C:\Users\Admin\AppData\Local\Temp\WZSE0.TMP\lgs_portuguese.txt
                    • C:\Users\Admin\AppData\Local\Temp\WZSE0.TMP\lgs_russian.txt
                    • C:\Users\Admin\AppData\Local\Temp\WZSE0.TMP\lgs_spanish.txt
                    • C:\Users\Admin\AppData\Local\Temp\WZSE0.TMP\lgs_swedish.txt
                    • C:\Users\Admin\AppData\Local\Temp\WZSE0.TMP\lgs_turkish.txt
                    • C:\Users\Admin\AppData\Local\Temp\WZSE0.TMP\lgs_ukrainian.txt
                    • C:\Users\Admin\AppData\Local\Temp\WZSE0.TMP\liesmich.txt
                    • C:\Users\Admin\AppData\Local\Temp\WZSE0.TMP\manual_de.pdf
                    • C:\Users\Admin\AppData\Local\Temp\WZSE0.TMP\manual_en.pdf
                    • C:\Users\Admin\AppData\Local\Temp\WZSE0.TMP\manual_fr.pdf
                    • C:\Users\Admin\AppData\Local\Temp\WZSE0.TMP\order.txt
                    • C:\Users\Admin\AppData\Local\Temp\WZSE0.TMP\ordina.txt
                    • C:\Users\Admin\AppData\Local\Temp\WZSE0.TMP\psapi_.dll
                    • C:\Users\Admin\AppData\Local\Temp\WZSE0.TMP\readme.txt
                    • C:\Users\Admin\AppData\Local\Temp\WZSE0.TMP\setup.exe
                    • C:\Users\Admin\AppData\Local\Temp\WZSE0.TMP\sqlite3.dll
                    • C:\Users\Admin\AppData\Local\Temp\WZSE0.TMP\taskman.exe
                    • C:\Users\Admin\AppData\Local\Temp\WZSE0.TMP\taskman_de.chm
                    • C:\Users\Admin\AppData\Local\Temp\WZSE0.TMP\taskman_en.chm
                    • C:\Users\Admin\AppData\Local\Temp\WZSE0.TMP\taskman_fr.chm
                    • C:\Users\Admin\AppData\Local\Temp\WZSE0.TMP\taskman_ru.chm
                    • C:\Users\Admin\AppData\Local\Temp\WZSE0.TMP\uninstal.exe
                    • C:\Users\Public\Desktop\Security Task Manager.lnk
                    • \Program Files (x86)\Security Task Manager\ascode.dll
                    • \Program Files (x86)\Security Task Manager\ascode.dll
                    • \Program Files (x86)\Security Task Manager\ascode.dll
                    • \Program Files (x86)\Security Task Manager\ascode.dll
                    • \Program Files (x86)\Security Task Manager\sqlite3.dll
                    • \Program Files (x86)\Security Task Manager\sqlite3.dll
                    • memory/1612-61-0x0000000004560000-0x0000000004561000-memory.dmp
                    • memory/1612-317-0x0000000005A30000-0x0000000005A31000-memory.dmp
                    • memory/1612-322-0x0000000006330000-0x0000000006331000-memory.dmp
                    • memory/1612-190-0x0000000005A30000-0x0000000005A31000-memory.dmp
                    • memory/1612-320-0x0000000006330000-0x0000000006331000-memory.dmp
                    • memory/1612-318-0x0000000006330000-0x0000000006331000-memory.dmp
                    • memory/1712-189-0x0000000005B70000-0x0000000005B71000-memory.dmp
                    • memory/1712-324-0x0000000006370000-0x0000000006371000-memory.dmp
                    • memory/1712-319-0x0000000006700000-0x0000000006701000-memory.dmp
                    • memory/1712-49-0x0000000000000000-mapping.dmp
                    • memory/1712-325-0x0000000006370000-0x0000000006371000-memory.dmp
                    • memory/1712-377-0x0000000006C40000-0x0000000006C4A000-memory.dmp
                    • memory/1712-386-0x0000000006C40000-0x0000000006C4A000-memory.dmp
                    • memory/1712-321-0x0000000006700000-0x0000000006701000-memory.dmp
                    • memory/1712-62-0x00000000046A0000-0x00000000046A1000-memory.dmp
                    • memory/1848-47-0x0000000000000000-mapping.dmp
                    • memory/2796-0-0x0000000000000000-mapping.dmp