limerat | 160054467ff97cc397fce9eddc6ce8a27d24320d45ccb3a8c8ba2a28ccbc6b79

Virtualization/Sandbox Evasion

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Oracle\VirtualBox Guest Additions	installutil.exe

Looks for VMWare Tools registry key 2 TTPs 1 IoCs

evasion

Query Registry

Virtualization/Sandbox Evasion

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\VMware, Inc.\VMware Tools	installutil.exe

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	installutil.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	installutil.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102

Maps connected drives based on registry 3 TTPs 2 IoCs

Disk information is often read in order to detect sandboxing environments.

Query Registry

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum	installutil.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0	installutil.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1112 set thread context of 1672	1112	installutil.exe	32

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\debug\WIA\yNsxbmDzw.exe	installutil.exe
File opened for modification	C:\Windows\debug\WIA\yNsxbmDzw.exe	installutil.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

pid	Process
760	schtasks.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1112	installutil.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	1112	installutil.exe
Token: SeDebugPrivilege	1672	RegAsm.exe
Token: SeDebugPrivilege	1672	RegAsm.exe

Suspicious use of WriteProcessMemory 22 IoCs

description	pid	Process	procid_target
PID 1532 wrote to memory of 1112	1532	160054467ff97cc397fce9eddc6ce8a27d24320d45ccb3a8c8ba2a28ccbc6b79.exe	27
PID 1532 wrote to memory of 1112	1532	160054467ff97cc397fce9eddc6ce8a27d24320d45ccb3a8c8ba2a28ccbc6b79.exe	27
PID 1532 wrote to memory of 1112	1532	160054467ff97cc397fce9eddc6ce8a27d24320d45ccb3a8c8ba2a28ccbc6b79.exe	27
PID 1532 wrote to memory of 1112	1532	160054467ff97cc397fce9eddc6ce8a27d24320d45ccb3a8c8ba2a28ccbc6b79.exe	27
PID 1532 wrote to memory of 1112	1532	160054467ff97cc397fce9eddc6ce8a27d24320d45ccb3a8c8ba2a28ccbc6b79.exe	27
PID 1532 wrote to memory of 1112	1532	160054467ff97cc397fce9eddc6ce8a27d24320d45ccb3a8c8ba2a28ccbc6b79.exe	27
PID 1532 wrote to memory of 1112	1532	160054467ff97cc397fce9eddc6ce8a27d24320d45ccb3a8c8ba2a28ccbc6b79.exe	27
PID 1112 wrote to memory of 760	1112	installutil.exe	30
PID 1112 wrote to memory of 760	1112	installutil.exe	30
PID 1112 wrote to memory of 760	1112	installutil.exe	30
PID 1112 wrote to memory of 760	1112	installutil.exe	30
PID 1112 wrote to memory of 1672	1112	installutil.exe	32
PID 1112 wrote to memory of 1672	1112	installutil.exe	32
PID 1112 wrote to memory of 1672	1112	installutil.exe	32
PID 1112 wrote to memory of 1672	1112	installutil.exe	32
PID 1112 wrote to memory of 1672	1112	installutil.exe	32
PID 1112 wrote to memory of 1672	1112	installutil.exe	32
PID 1112 wrote to memory of 1672	1112	installutil.exe	32
PID 1112 wrote to memory of 1672	1112	installutil.exe	32
PID 1112 wrote to memory of 1672	1112	installutil.exe	32
PID 1112 wrote to memory of 1672	1112	installutil.exe	32
PID 1112 wrote to memory of 1672	1112	installutil.exe	32

C:\Users\Admin\AppData\Local\Temp\160054467ff97cc397fce9eddc6ce8a27d24320d45ccb3a8c8ba2a28ccbc6b79.exe
"C:\Users\Admin\AppData\Local\Temp\160054467ff97cc397fce9eddc6ce8a27d24320d45ccb3a8c8ba2a28ccbc6b79.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1532
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\installutil.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\installutil.exe" /logtoconsole=false /logfile= /u "C:\Users\Admin\AppData\Local\Temp\160054467ff97cc397fce9eddc6ce8a27d24320d45ccb3a8c8ba2a28ccbc6b79.exe"
  2⤵
  - Looks for VirtualBox Guest Additions in registry
  - Looks for VMWare Tools registry key
  - Checks BIOS information in registry
  - Maps connected drives based on registry
  - Suspicious use of SetThreadContext
  - Drops file in Windows directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1112
- - C:\Windows\SysWOW64\schtasks.exe
    "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\yNsxbmDzw" /XML "C:\Users\Admin\AppData\Local\Temp\tmpE84D.tmp"
    3⤵
    - Creates scheduled task(s)
    PID:760
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:1672

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

Persistence

Scheduled Task

Privilege Escalation

Scheduled Task

Defense Evasion

Virtualization/Sandbox Evasion

Web Service

T1102

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

System Information Discovery

T1082

Virtualization/Sandbox Evasion