1966544b1933d8679ff224d9ca4293f4ff19988fff103957df1df33a109e848a

Virtualization/Sandbox Evasion

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	SKCertService.exe

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	SKCertService.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	SKCertService.exe

Identifies Wine through registry keys 2 TTPs 1 IoCs

Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

evasion

Query Registry

Virtualization/Sandbox Evasion

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Wine	SKCertService.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\SKCertService Client = "C:\\Program Files (x86)\\SignKorea\\skcert\\SKCertService.exe"	SetupPKG.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs

evasion trojan

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	SKCertService.exe

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

Peripheral Device Discovery

T1120

System Information Discovery

description	ioc	Process
File opened (read-only)	\??\K:	SKCertService.exe
File opened (read-only)	\??\P:	SKCertService.exe
File opened (read-only)	\??\R:	SKCertService.exe
File opened (read-only)	\??\V:	SKCertService.exe
File opened (read-only)	\??\A:	SKCertService.exe
File opened (read-only)	\??\E:	SKCertService.exe
File opened (read-only)	\??\H:	SKCertService.exe
File opened (read-only)	\??\L:	SKCertService.exe
File opened (read-only)	\??\N:	SKCertService.exe
File opened (read-only)	\??\Q:	SKCertService.exe
File opened (read-only)	\??\S:	SKCertService.exe
File opened (read-only)	\??\Y:	SKCertService.exe
File opened (read-only)	\??\Z:	SKCertService.exe
File opened (read-only)	\??\I:	SKCertService.exe
File opened (read-only)	\??\J:	SKCertService.exe
File opened (read-only)	\??\O:	SKCertService.exe
File opened (read-only)	\??\T:	SKCertService.exe
File opened (read-only)	\??\U:	SKCertService.exe
File opened (read-only)	\??\B:	SKCertService.exe
File opened (read-only)	\??\G:	SKCertService.exe
File opened (read-only)	\??\M:	SKCertService.exe
File opened (read-only)	\??\W:	SKCertService.exe
File opened (read-only)	\??\X:	SKCertService.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

pid	Process
1704	SKCertService.exe
1704	SKCertService.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in Program Files directory 25 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\SignKorea\skcert\msvcr100.dll	SetupPKG.exe
File created	C:\Program Files (x86)\SignKorea\skcert\SGBase.dll	SetupPKG.exe
File created	C:\Program Files (x86)\SignKorea\skcert\SGCrypto.dll	SetupPKG.exe
File created	C:\Program Files (x86)\SignKorea\skcert\SKCertService.exe	SetupPKG.exe
File opened for modification	C:\Program Files (x86)\SignKorea\SignKoreaWD\2024-06\signkorea__2024-06-13.log	SignKoreaWD.exe
File created	C:\Program Files (x86)\SignKorea\skcert\libplds4.dll	SetupPKG.exe
File created	C:\Program Files (x86)\SignKorea\skcert\nss3.dll	SetupPKG.exe
File created	C:\Program Files (x86)\SignKorea\skcert\nss4Mango.dll	SetupPKG.exe
File created	C:\Program Files (x86)\SignKorea\skcert\skmagerapi.dll	SetupPKG.exe
File created	C:\Program Files (x86)\SignKorea\skcert\bill\SKCommWB.exe	SetupPKG.exe
File created	C:\Program Files (x86)\SignKorea\skcert\nssdbm3.dll	SetupPKG.exe
File created	C:\Program Files (x86)\SignKorea\skcert\nssutil3.dll	SetupPKG.exe
File created	C:\Program Files (x86)\SignKorea\skcert\SantiagoWireInitializer.exe	SetupPKG.exe
File created	C:\Program Files (x86)\SignKorea\skcert\softokn3.dll	SetupPKG.exe
File created	C:\Program Files (x86)\SignKorea\SetupPKG.exe	SetupPKG.exe
File created	C:\Program Files (x86)\SignKorea\skcert\libplc4.dll	SetupPKG.exe
File created	C:\Program Files (x86)\SignKorea\skcert\SignKoreaWD.exe	SetupPKG.exe
File created	C:\Program Files (x86)\SignKorea\skcert\conf\SantiagoSecurityService.json	SetupPKG.exe
File created	C:\Program Files (x86)\SignKorea\skcert\sqlite3.dll	SetupPKG.exe
File created	C:\Program Files (x86)\SignKorea\skcert\conf\TokenManager.json	SetupPKG.exe
File created	C:\Program Files (x86)\SignKorea\skcert\freebl3.dll	SetupPKG.exe
File created	C:\Program Files (x86)\SignKorea\skcert\libnspr4.dll	SetupPKG.exe
File created	C:\Program Files (x86)\SignKorea\skcert\SantiagoSecurityService.dll	SetupPKG.exe
File created	C:\Program Files (x86)\SignKorea\skcert\SGService.dll	SetupPKG.exe
File created	C:\Program Files (x86)\SignKorea\skcert\smime3.dll	SetupPKG.exe

Executes dropped EXE 5 IoCs

pid	Process
3004	SetupPKG.exe
1092	SignKoreaWD.exe
3012	SignKoreaWD.exe
1704	SKCertService.exe
2012	SantiagoWireInitializer.exe

Loads dropped DLL 38 IoCs

pid	Process
2224	a45a276bc96e4afbe8330c3926b8d5f2_JaffaCakes118.exe
3004	SetupPKG.exe
3004	SetupPKG.exe
3004	SetupPKG.exe
3004	SetupPKG.exe
1092	SignKoreaWD.exe
1092	SignKoreaWD.exe
1092	SignKoreaWD.exe
3012	SignKoreaWD.exe
3012	SignKoreaWD.exe
1704	SKCertService.exe
1704	SKCertService.exe
1704	SKCertService.exe
1704	SKCertService.exe
1704	SKCertService.exe
1704	SKCertService.exe
1704	SKCertService.exe
1704	SKCertService.exe
1704	SKCertService.exe
1704	SKCertService.exe
1704	SKCertService.exe
1704	SKCertService.exe
1704	SKCertService.exe
1704	SKCertService.exe
1704	SKCertService.exe
2012	SantiagoWireInitializer.exe
2012	SantiagoWireInitializer.exe
2012	SantiagoWireInitializer.exe
2012	SantiagoWireInitializer.exe
2012	SantiagoWireInitializer.exe
2012	SantiagoWireInitializer.exe
2012	SantiagoWireInitializer.exe
2012	SantiagoWireInitializer.exe
2012	SantiagoWireInitializer.exe
2012	SantiagoWireInitializer.exe
2012	SantiagoWireInitializer.exe
2012	SantiagoWireInitializer.exe
2012	SantiagoWireInitializer.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 6 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Santiago	SetupPKG.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Santiago\shell	SetupPKG.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Santiago\shell\open	SetupPKG.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Santiago\shell\open\command	SetupPKG.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Santiago\shell\open\command\ = "C:\\Program Files (x86)\\SignKorea\\skcert\\SKCertService.exe \"%1\""	SetupPKG.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Santiago\URL Protocol	SetupPKG.exe

Modifies system certificate store 2 TTPs 2 IoCs

evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\572561A7EAF5A6A752B520E79B9F9CEFB50C030D\Blob = 030000000100000014000000572561a7eaf5a6a752b520e79b9f9cefb50c030d20000000010000002a030000308203263082020ea003020102020200e2300d06092a864886f70d01010b05003046310b3009060355040613024b523111300f060355040a0c08506572736f6e616c31153013060355040b0c0c5369676e4b6f726561204e41310d300b06035504030c04526f6f74301e170d3234303631323037303732375a170d3235303631323037303732375a3046310b3009060355040613024b523111300f060355040a0c08506572736f6e616c31153013060355040b0c0c5369676e4b6f726561204e41310d300b06035504030c04526f6f7430820122300d06092a864886f70d01010105000382010f003082010a0282010100bbfa748b00d753a32418630b04007d2277ce49cf3c0a6e605a92b1b32a119179166b6598305fd4fbce911949597e19e7744c033f56063e2a9d7d9e294c99d8424be0f18ecad90b53f03bffc2f1407ffde416d400d1e1dc6986ea461fa0a5e3722117c3167dddb651c8fc848df779fe0acc2cc8802d5c458a59c8ed675724fe5aaaf9c17936e82c95b37bab64b31d3ac398913143bf7332014d7822d335539986a36968d9b754e67a32995cee42afa318a91766bbac44b31eff109e86b69cc0713d2ce6b4ac39736187878246796f1b1c1a6d5e5f12028e68a1ee39b6f580f512b8558783a0ff53843e0e4eb5f61df1585a6b9ab075228164a823b8b8e582d69d0203010001a31e301c300f0603551d13040830060101ff02010130090603551d1104023000300d06092a864886f70d01010b05000382010100762a03dd4dddf76d1b702d5617a390115528ea11c2fa287046c56c0f6ab7767ecbcb47a4660727d98223165503a9b3c7c1b064592a68f0ba44e3bb1e11642f7ce83475572a9e8eaf98ff3485b0fbee3341c5b5e232cbdca456ce3563c23db1f957788c12058e30275890522aedba71c31c368f066ced32793e1868ab7ddf203385f773f812cb27db289ffbbd9db50c326b2020217ff1565e20043a22687b4be56083c029b1f6e24b28aabdae3d21d4409a77456999b2ed999873ae21249e6cce946f6808ad169f9a0e362c978725adffef40d232573059fb2da5ca54ee53b5480128242cc34bde2070e55a5e4f60e580abbe66c4191a0766ec02302f518f2342	SantiagoWireInitializer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\572561A7EAF5A6A752B520E79B9F9CEFB50C030D	SantiagoWireInitializer.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3004	SetupPKG.exe
3012	SignKoreaWD.exe
3012	SignKoreaWD.exe
1704	SKCertService.exe
1704	SKCertService.exe
1704	SKCertService.exe
1704	SKCertService.exe
1704	SKCertService.exe
1704	SKCertService.exe
1704	SKCertService.exe
1704	SKCertService.exe
1704	SKCertService.exe
1704	SKCertService.exe
1704	SKCertService.exe
1704	SKCertService.exe
1704	SKCertService.exe
3012	SignKoreaWD.exe
1704	SKCertService.exe
1704	SKCertService.exe
1704	SKCertService.exe
1704	SKCertService.exe
1704	SKCertService.exe
3012	SignKoreaWD.exe
2012	SantiagoWireInitializer.exe
2012	SantiagoWireInitializer.exe
2012	SantiagoWireInitializer.exe
2012	SantiagoWireInitializer.exe
2012	SantiagoWireInitializer.exe
2012	SantiagoWireInitializer.exe
2012	SantiagoWireInitializer.exe
2012	SantiagoWireInitializer.exe
2012	SantiagoWireInitializer.exe
2012	SantiagoWireInitializer.exe
2012	SantiagoWireInitializer.exe
2012	SantiagoWireInitializer.exe
3012	SignKoreaWD.exe
2012	SantiagoWireInitializer.exe
2012	SantiagoWireInitializer.exe
2012	SantiagoWireInitializer.exe
2012	SantiagoWireInitializer.exe
2012	SantiagoWireInitializer.exe
3012	SignKoreaWD.exe
3012	SignKoreaWD.exe
3012	SignKoreaWD.exe
3012	SignKoreaWD.exe
3012	SignKoreaWD.exe
3012	SignKoreaWD.exe
3012	SignKoreaWD.exe
3012	SignKoreaWD.exe
3012	SignKoreaWD.exe
3012	SignKoreaWD.exe
3012	SignKoreaWD.exe
3012	SignKoreaWD.exe
3012	SignKoreaWD.exe
3012	SignKoreaWD.exe
3012	SignKoreaWD.exe
3012	SignKoreaWD.exe
3012	SignKoreaWD.exe
3012	SignKoreaWD.exe
3012	SignKoreaWD.exe
3012	SignKoreaWD.exe
3012	SignKoreaWD.exe
3012	SignKoreaWD.exe
3012	SignKoreaWD.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	3012	SignKoreaWD.exe
Token: SeDebugPrivilege	3012	SignKoreaWD.exe
Token: SeDebugPrivilege	3012	SignKoreaWD.exe
Token: SeDebugPrivilege	3012	SignKoreaWD.exe
Token: SeDebugPrivilege	3012	SignKoreaWD.exe
Token: SeDebugPrivilege	3012	SignKoreaWD.exe
Token: SeDebugPrivilege	3012	SignKoreaWD.exe
Token: SeDebugPrivilege	3012	SignKoreaWD.exe
Token: SeDebugPrivilege	3012	SignKoreaWD.exe
Token: SeDebugPrivilege	3012	SignKoreaWD.exe
Token: SeDebugPrivilege	3012	SignKoreaWD.exe
Token: SeDebugPrivilege	3012	SignKoreaWD.exe
Token: SeDebugPrivilege	3012	SignKoreaWD.exe
Token: SeDebugPrivilege	3012	SignKoreaWD.exe
Token: SeDebugPrivilege	3012	SignKoreaWD.exe
Token: SeDebugPrivilege	3012	SignKoreaWD.exe
Token: SeDebugPrivilege	3012	SignKoreaWD.exe
Token: SeDebugPrivilege	3012	SignKoreaWD.exe
Token: SeDebugPrivilege	3012	SignKoreaWD.exe
Token: SeDebugPrivilege	3012	SignKoreaWD.exe
Token: SeDebugPrivilege	3012	SignKoreaWD.exe
Token: SeDebugPrivilege	3012	SignKoreaWD.exe
Token: SeDebugPrivilege	3012	SignKoreaWD.exe
Token: SeDebugPrivilege	3012	SignKoreaWD.exe
Token: SeDebugPrivilege	3012	SignKoreaWD.exe
Token: SeDebugPrivilege	3012	SignKoreaWD.exe
Token: SeDebugPrivilege	3012	SignKoreaWD.exe
Token: SeDebugPrivilege	3012	SignKoreaWD.exe
Token: SeDebugPrivilege	3012	SignKoreaWD.exe
Token: SeDebugPrivilege	3012	SignKoreaWD.exe
Token: SeDebugPrivilege	3012	SignKoreaWD.exe
Token: SeDebugPrivilege	3012	SignKoreaWD.exe
Token: SeDebugPrivilege	3012	SignKoreaWD.exe
Token: SeDebugPrivilege	3012	SignKoreaWD.exe
Token: SeDebugPrivilege	3012	SignKoreaWD.exe
Token: SeDebugPrivilege	3012	SignKoreaWD.exe
Token: SeDebugPrivilege	3012	SignKoreaWD.exe
Token: SeDebugPrivilege	3012	SignKoreaWD.exe
Token: SeDebugPrivilege	3012	SignKoreaWD.exe
Token: SeDebugPrivilege	3012	SignKoreaWD.exe
Token: SeDebugPrivilege	3012	SignKoreaWD.exe
Token: SeDebugPrivilege	3012	SignKoreaWD.exe
Token: SeDebugPrivilege	3012	SignKoreaWD.exe
Token: SeDebugPrivilege	3012	SignKoreaWD.exe
Token: SeDebugPrivilege	3012	SignKoreaWD.exe
Token: SeDebugPrivilege	3012	SignKoreaWD.exe
Token: SeDebugPrivilege	3012	SignKoreaWD.exe
Token: SeDebugPrivilege	3012	SignKoreaWD.exe
Token: SeDebugPrivilege	3012	SignKoreaWD.exe
Token: SeDebugPrivilege	3012	SignKoreaWD.exe
Token: SeDebugPrivilege	3012	SignKoreaWD.exe
Token: SeDebugPrivilege	3012	SignKoreaWD.exe
Token: SeDebugPrivilege	3012	SignKoreaWD.exe
Token: SeDebugPrivilege	3012	SignKoreaWD.exe
Token: SeDebugPrivilege	3012	SignKoreaWD.exe
Token: SeDebugPrivilege	3012	SignKoreaWD.exe
Token: SeDebugPrivilege	3012	SignKoreaWD.exe
Token: SeDebugPrivilege	3012	SignKoreaWD.exe
Token: SeDebugPrivilege	3012	SignKoreaWD.exe
Token: SeDebugPrivilege	3012	SignKoreaWD.exe
Token: SeDebugPrivilege	3012	SignKoreaWD.exe
Token: SeDebugPrivilege	3012	SignKoreaWD.exe
Token: SeDebugPrivilege	3012	SignKoreaWD.exe
Token: SeDebugPrivilege	3012	SignKoreaWD.exe

Suspicious use of WriteProcessMemory 22 IoCs

description	pid	Process	procid_target
PID 2224 wrote to memory of 3004	2224	a45a276bc96e4afbe8330c3926b8d5f2_JaffaCakes118.exe	28
PID 2224 wrote to memory of 3004	2224	a45a276bc96e4afbe8330c3926b8d5f2_JaffaCakes118.exe	28
PID 2224 wrote to memory of 3004	2224	a45a276bc96e4afbe8330c3926b8d5f2_JaffaCakes118.exe	28
PID 2224 wrote to memory of 3004	2224	a45a276bc96e4afbe8330c3926b8d5f2_JaffaCakes118.exe	28
PID 2224 wrote to memory of 3004	2224	a45a276bc96e4afbe8330c3926b8d5f2_JaffaCakes118.exe	28
PID 2224 wrote to memory of 3004	2224	a45a276bc96e4afbe8330c3926b8d5f2_JaffaCakes118.exe	28
PID 2224 wrote to memory of 3004	2224	a45a276bc96e4afbe8330c3926b8d5f2_JaffaCakes118.exe	28
PID 3004 wrote to memory of 1092	3004	SetupPKG.exe	29
PID 3004 wrote to memory of 1092	3004	SetupPKG.exe	29
PID 3004 wrote to memory of 1092	3004	SetupPKG.exe	29
PID 3004 wrote to memory of 1092	3004	SetupPKG.exe	29
PID 3004 wrote to memory of 1092	3004	SetupPKG.exe	29
PID 3004 wrote to memory of 1092	3004	SetupPKG.exe	29
PID 3004 wrote to memory of 1092	3004	SetupPKG.exe	29
PID 3012 wrote to memory of 1704	3012	SignKoreaWD.exe	32
PID 3012 wrote to memory of 1704	3012	SignKoreaWD.exe	32
PID 3012 wrote to memory of 1704	3012	SignKoreaWD.exe	32
PID 3012 wrote to memory of 1704	3012	SignKoreaWD.exe	32
PID 1704 wrote to memory of 2012	1704	SKCertService.exe	33
PID 1704 wrote to memory of 2012	1704	SKCertService.exe	33
PID 1704 wrote to memory of 2012	1704	SKCertService.exe	33
PID 1704 wrote to memory of 2012	1704	SKCertService.exe	33

C:\Users\Admin\AppData\Local\Temp\a45a276bc96e4afbe8330c3926b8d5f2_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\a45a276bc96e4afbe8330c3926b8d5f2_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2224
- C:\Users\Admin\AppData\Local\Temp\7zS58DA.tmp\SetupPKG.exe
  .\SetupPKG.exe -is
  2⤵
  - Adds Run key to start application
  - Drops file in Program Files directory
  - Executes dropped EXE
  - Loads dropped DLL
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:3004
- - C:\Program Files (x86)\SignKorea\skcert\SignKoreaWD.exe
    "C:\Program Files (x86)\SignKorea\skcert\SignKoreaWD.exe" -i
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:1092

C:\Program Files (x86)\SignKorea\skcert\SignKoreaWD.exe
"C:\Program Files (x86)\SignKorea\skcert\SignKoreaWD.exe" "SignKoreaWD"
1⤵
- Drops file in Program Files directory
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3012
- C:\Program Files (x86)\SignKorea\skcert\SKCertService.exe
  "C:\Program Files (x86)\SignKorea\skcert\SKCertService.exe"
  2⤵
  - Identifies VirtualBox via ACPI registry values (likely anti-VM)
  - Checks BIOS information in registry
  - Identifies Wine through registry keys
  - Checks whether UAC is enabled
  - Enumerates connected drives
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:1704
- - C:\Program Files (x86)\SignKorea\skcert\SantiagoWireInitializer.exe
    "C:\Program Files (x86)\SignKorea\skcert\SantiagoWireInitializer.exe" S F C
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Modifies system certificate store
    - Suspicious behavior: EnumeratesProcesses
    PID:2012

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Virtualization/Sandbox Evasion

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

System Information Discovery

Virtualization/Sandbox Evasion