Dynamic analysis is used here first because it is already actively running on victim’s machine, so we might as well start from there.
Discovering malicious executable
- Launch Process Hacker on the victim VM; an anomaly named
5D85C2C17D.execan be found in the process list.
- The process is launched with the system, suggesting a daemon service or autorun registry is keeping the process persistent.
- WhatsInStartup confirms our suspicion
- The process clearly has a name with a description of
Microsoft Windows Auto Update, yet it does not behave like any default Windows applications bundled by Microsoft.
- The process is not signed by Microsoft, further confirming the previous suspicion.
- A signed process should contain a signed signature similar to the following,
CN = Microsoft Windows Production PCA 2011 O = Microsoft Corporation L = Redmond S = Washington C = US
Determining the type of executable
- From Process Hacker’s automatic executable categorization, we can see that this process is a .NET assembly.
- trid (similar to
fileon Linux) further affirms the type of application.
- The file is seen constantly probing the victim’s storage system.
- Common .NET assemblies can be found in the thread stack.
Since we know that the malicious executable is a .NET program, the program could typically be easily reversed via ildasm or any third-party decompilers (e.g. RedGate Reflector, JetBrains dotPeek, dnSpy, etc.).
Unfortunately for us, upon opening the file, we discover that the file had been heavily obfuscated by Confuser.
Fortunately for us, Confuser is a known obfuscation application, and is supported by the de4dot deobfuscator.
The application will pick up the pattern created by Confuser and begin deobfuscation.
Analysis via pestudio
pestudio is a tool that is designed to gather quick information about a malware. It will gather information such as the target application’s manifest, certificate, file header, imported libraries, string table, and more.
|compiler-stamp||0x52DCF9B5 (Mon Jan 20 18:25:57 2014)|
pestudio lists out some of the indicators that it finds concerning/interesting for us. Here are some of them that seem to fit this application and may aid us in the analysis.
|The file seems to be a fake Microsoft executable||1|
|The file references (69) file extensions like a Ransomware (or a Wiper)||1|
|The file expects Administrative permission||2|
|The original file name is “Microsoft Windows Auto Update.exe”||3|
|The file signature is ‘Microsoft Visual C# v7.0 / Basic .NET’||5|
|The file references (20) blacklisted string(s)||5|
|The file does not contain a digital Certificate||7|
|The file is managed by .NET||9|
As we can see, pestudio already picked up some traits that a typical ransomware would exhibit, such as the fact that an extensive list of extension names can be found in the executable.
Upon opening the deobfuscated application, we can already see major red flags in the string table.
Some of these strings indicate that we are dealing with a ransomware:
Payments are processed manually, therefore, the expectation of activation may take up to 48 hours.
This software will be deleted after files decryption, make sure that all important files are decrypted! If software crashes during decryption process, don't panic it will auto restart and your files will be decrypted without making addidional payment, just click Next>>. After all, software will auto remove itself from your computer!
Make sure that all important files have been decrypted! If part of the files had not been decrypted - move them to the desktop and click <<Retry>> button. Otherwise, press <<Cancel>> button - this will delete the software from this computer. Please restart your computer to completely destroy this software!
Without doing any of the code analysis, we can already find several questionable methods used by the malware thanks to pestudio’s automatic flagging:
Analysis via Decompilation
As mentioned before, we could use any .NET reflector to decompile the .NET application to see what the file does now. For this example, we’ll opt to use dnSpy, an open-source debugger and .NET assembly editor. Other decompilers can be used if you are interested in further analysis (RedGate Reflector will drill down to lower-level implementation detail and compiler generated code; JetBrain dotPeek is somewhere in-between).