Analysis
-
max time kernel
132s -
max time network
81s -
platform
windows7_x64 -
resource
win7v200217 -
submitted
25-03-2020 16:34
Static task
static1
Behavioral task
behavioral1
Sample
8E0B0D1FD892EA1BAB2858BCA49ACBAE.bin.exe
Resource
win7v200217
Behavioral task
behavioral2
Sample
8E0B0D1FD892EA1BAB2858BCA49ACBAE.bin.exe
Resource
win10v200217
General
-
Target
8E0B0D1FD892EA1BAB2858BCA49ACBAE.bin.exe
-
Size
264KB
-
MD5
8e0b0d1fd892ea1bab2858bca49acbae
-
SHA1
072afa49a33c82af06973db1948757e59a7ce5aa
-
SHA256
26d575a4e5dfde186ac0fbf344c6e22dbd96ba2e9660ac6bf3db2dae082ed11f
-
SHA512
193f627922c9c1621212269edd4f4d971bd088848399f17f883dcd3da92143629387aa37fcaaad9b1ecdfc43cde093667e0184aeb2c61e9190c26fccd21bc308
Malware Config
Extracted
C:\readme-warning.txt
makop
helpdesk_makp@protonmail.ch
Signatures
-
Suspicious use of WriteProcessMemory 8 IoCs
Processes:
8E0B0D1FD892EA1BAB2858BCA49ACBAE.bin.exedescription pid process target process PID 1852 wrote to memory of 1884 1852 8E0B0D1FD892EA1BAB2858BCA49ACBAE.bin.exe cmd.exe PID 1852 wrote to memory of 1884 1852 8E0B0D1FD892EA1BAB2858BCA49ACBAE.bin.exe cmd.exe PID 1852 wrote to memory of 1884 1852 8E0B0D1FD892EA1BAB2858BCA49ACBAE.bin.exe cmd.exe PID 1852 wrote to memory of 1884 1852 8E0B0D1FD892EA1BAB2858BCA49ACBAE.bin.exe cmd.exe PID 1852 wrote to memory of 1260 1852 8E0B0D1FD892EA1BAB2858BCA49ACBAE.bin.exe NOTEPAD.EXE PID 1852 wrote to memory of 1260 1852 8E0B0D1FD892EA1BAB2858BCA49ACBAE.bin.exe NOTEPAD.EXE PID 1852 wrote to memory of 1260 1852 8E0B0D1FD892EA1BAB2858BCA49ACBAE.bin.exe NOTEPAD.EXE PID 1852 wrote to memory of 1260 1852 8E0B0D1FD892EA1BAB2858BCA49ACBAE.bin.exe NOTEPAD.EXE -
Drops desktop.ini file(s) 77 IoCs
Processes:
8E0B0D1FD892EA1BAB2858BCA49ACBAE.bin.exedescription ioc process File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\desktop.ini 8E0B0D1FD892EA1BAB2858BCA49ACBAE.bin.exe File opened for modification C:\Users\Admin\Downloads\desktop.ini 8E0B0D1FD892EA1BAB2858BCA49ACBAE.bin.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini 8E0B0D1FD892EA1BAB2858BCA49ACBAE.bin.exe File opened for modification C:\Users\Admin\Contacts\desktop.ini 8E0B0D1FD892EA1BAB2858BCA49ACBAE.bin.exe File opened for modification C:\Users\Admin\Desktop\desktop.ini 8E0B0D1FD892EA1BAB2858BCA49ACBAE.bin.exe File opened for modification C:\Users\Admin\Searches\desktop.ini 8E0B0D1FD892EA1BAB2858BCA49ACBAE.bin.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\5IXBIG08\desktop.ini 8E0B0D1FD892EA1BAB2858BCA49ACBAE.bin.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\WQZJKO4S\desktop.ini 8E0B0D1FD892EA1BAB2858BCA49ACBAE.bin.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\desktop.ini 8E0B0D1FD892EA1BAB2858BCA49ACBAE.bin.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools\desktop.ini 8E0B0D1FD892EA1BAB2858BCA49ACBAE.bin.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\Desktop.ini 8E0B0D1FD892EA1BAB2858BCA49ACBAE.bin.exe File opened for modification C:\Users\Public\Pictures\desktop.ini 8E0B0D1FD892EA1BAB2858BCA49ACBAE.bin.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\Desktop.ini 8E0B0D1FD892EA1BAB2858BCA49ACBAE.bin.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\desktop.ini 8E0B0D1FD892EA1BAB2858BCA49ACBAE.bin.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\desktop.ini 8E0B0D1FD892EA1BAB2858BCA49ACBAE.bin.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini 8E0B0D1FD892EA1BAB2858BCA49ACBAE.bin.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\CH201OQ7\desktop.ini 8E0B0D1FD892EA1BAB2858BCA49ACBAE.bin.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini 8E0B0D1FD892EA1BAB2858BCA49ACBAE.bin.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\Desktop.ini 8E0B0D1FD892EA1BAB2858BCA49ACBAE.bin.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Accessibility\Desktop.ini 8E0B0D1FD892EA1BAB2858BCA49ACBAE.bin.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\desktop.ini 8E0B0D1FD892EA1BAB2858BCA49ACBAE.bin.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SendTo\Desktop.ini 8E0B0D1FD892EA1BAB2858BCA49ACBAE.bin.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\SendTo\Desktop.ini 8E0B0D1FD892EA1BAB2858BCA49ACBAE.bin.exe File opened for modification C:\Users\Public\desktop.ini 8E0B0D1FD892EA1BAB2858BCA49ACBAE.bin.exe File opened for modification C:\Users\Public\Pictures\Sample Pictures\desktop.ini 8E0B0D1FD892EA1BAB2858BCA49ACBAE.bin.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\Stationery\Desktop.ini 8E0B0D1FD892EA1BAB2858BCA49ACBAE.bin.exe File opened for modification C:\Program Files (x86)\desktop.ini 8E0B0D1FD892EA1BAB2858BCA49ACBAE.bin.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows Mail\Stationery\Desktop.ini 8E0B0D1FD892EA1BAB2858BCA49ACBAE.bin.exe File opened for modification C:\Users\Admin\Music\desktop.ini 8E0B0D1FD892EA1BAB2858BCA49ACBAE.bin.exe File opened for modification C:\Users\Public\Recorded TV\desktop.ini 8E0B0D1FD892EA1BAB2858BCA49ACBAE.bin.exe File opened for modification C:\Users\Public\Videos\Sample Videos\desktop.ini 8E0B0D1FD892EA1BAB2858BCA49ACBAE.bin.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Desktop.ini 8E0B0D1FD892EA1BAB2858BCA49ACBAE.bin.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Tablet PC\Desktop.ini 8E0B0D1FD892EA1BAB2858BCA49ACBAE.bin.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\History\History.IE5\desktop.ini 8E0B0D1FD892EA1BAB2858BCA49ACBAE.bin.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\desktop.ini 8E0B0D1FD892EA1BAB2858BCA49ACBAE.bin.exe File opened for modification C:\Users\Public\Music\desktop.ini 8E0B0D1FD892EA1BAB2858BCA49ACBAE.bin.exe File opened for modification C:\Users\Public\Music\Sample Music\desktop.ini 8E0B0D1FD892EA1BAB2858BCA49ACBAE.bin.exe File opened for modification C:\Users\Public\Recorded TV\Sample Media\desktop.ini 8E0B0D1FD892EA1BAB2858BCA49ACBAE.bin.exe File opened for modification C:\Program Files\Microsoft Office\Office14\1033\DataServices\DESKTOP.INI 8E0B0D1FD892EA1BAB2858BCA49ACBAE.bin.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\4BOE1AJG\desktop.ini 8E0B0D1FD892EA1BAB2858BCA49ACBAE.bin.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\149Z7I96\desktop.ini 8E0B0D1FD892EA1BAB2858BCA49ACBAE.bin.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Desktop.ini 8E0B0D1FD892EA1BAB2858BCA49ACBAE.bin.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\DZTNHC1N\desktop.ini 8E0B0D1FD892EA1BAB2858BCA49ACBAE.bin.exe File opened for modification C:\Users\Admin\Favorites\Links for United States\desktop.ini 8E0B0D1FD892EA1BAB2858BCA49ACBAE.bin.exe File opened for modification C:\Users\Admin\Saved Games\desktop.ini 8E0B0D1FD892EA1BAB2858BCA49ACBAE.bin.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Desktop.ini 8E0B0D1FD892EA1BAB2858BCA49ACBAE.bin.exe File opened for modification C:\Users\Admin\Videos\desktop.ini 8E0B0D1FD892EA1BAB2858BCA49ACBAE.bin.exe File opened for modification C:\Users\Public\Desktop\desktop.ini 8E0B0D1FD892EA1BAB2858BCA49ACBAE.bin.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Burn\Burn\desktop.ini 8E0B0D1FD892EA1BAB2858BCA49ACBAE.bin.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\desktop.ini 8E0B0D1FD892EA1BAB2858BCA49ACBAE.bin.exe File opened for modification C:\Users\Admin\Links\desktop.ini 8E0B0D1FD892EA1BAB2858BCA49ACBAE.bin.exe File opened for modification C:\Users\Admin\Pictures\desktop.ini 8E0B0D1FD892EA1BAB2858BCA49ACBAE.bin.exe File opened for modification C:\Users\Public\Videos\desktop.ini 8E0B0D1FD892EA1BAB2858BCA49ACBAE.bin.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\MV0POAJ0\desktop.ini 8E0B0D1FD892EA1BAB2858BCA49ACBAE.bin.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Libraries\desktop.ini 8E0B0D1FD892EA1BAB2858BCA49ACBAE.bin.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini 8E0B0D1FD892EA1BAB2858BCA49ACBAE.bin.exe File opened for modification C:\Users\Public\Libraries\desktop.ini 8E0B0D1FD892EA1BAB2858BCA49ACBAE.bin.exe File opened for modification C:\ProgramData\Microsoft\Windows\Ringtones\desktop.ini 8E0B0D1FD892EA1BAB2858BCA49ACBAE.bin.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\desktop.ini 8E0B0D1FD892EA1BAB2858BCA49ACBAE.bin.exe File opened for modification C:\Program Files\desktop.ini 8E0B0D1FD892EA1BAB2858BCA49ACBAE.bin.exe File opened for modification C:\Users\Public\Downloads\desktop.ini 8E0B0D1FD892EA1BAB2858BCA49ACBAE.bin.exe File opened for modification C:\Users\Public\Documents\desktop.ini 8E0B0D1FD892EA1BAB2858BCA49ACBAE.bin.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\desktop.ini 8E0B0D1FD892EA1BAB2858BCA49ACBAE.bin.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\desktop.ini 8E0B0D1FD892EA1BAB2858BCA49ACBAE.bin.exe -
Drops file in Program Files directory 10505 IoCs
Processes:
8E0B0D1FD892EA1BAB2858BCA49ACBAE.bin.exedescription ioc process File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Africa\Tripoli 8E0B0D1FD892EA1BAB2858BCA49ACBAE.bin.exe File opened for modification C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll 8E0B0D1FD892EA1BAB2858BCA49ACBAE.bin.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0107288.WMF 8E0B0D1FD892EA1BAB2858BCA49ACBAE.bin.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\TN00246_.WMF 8E0B0D1FD892EA1BAB2858BCA49ACBAE.bin.exe File opened for modification C:\Program Files\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD14530_.GIF 8E0B0D1FD892EA1BAB2858BCA49ACBAE.bin.exe File opened for modification C:\Program Files\Microsoft Office\Office14\PUBWIZ\RSPMECH.POC 8E0B0D1FD892EA1BAB2858BCA49ACBAE.bin.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0090783.WMF 8E0B0D1FD892EA1BAB2858BCA49ACBAE.bin.exe File opened for modification C:\Program Files\Microsoft Office\MEDIA\CAGCAT10\J0216588.WMF 8E0B0D1FD892EA1BAB2858BCA49ACBAE.bin.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\CommonData\UnreadIconImagesMask.bmp 8E0B0D1FD892EA1BAB2858BCA49ACBAE.bin.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\FlipPage\NavigationLeft_SelectionSubpicture.png 8E0B0D1FD892EA1BAB2858BCA49ACBAE.bin.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\SportsMainToScenesBackground.wmv 8E0B0D1FD892EA1BAB2858BCA49ACBAE.bin.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Rankin_Inlet 8E0B0D1FD892EA1BAB2858BCA49ACBAE.bin.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-application_ja.jar 8E0B0D1FD892EA1BAB2858BCA49ACBAE.bin.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\Publisher\Backgrounds\J0143753.GIF 8E0B0D1FD892EA1BAB2858BCA49ACBAE.bin.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Groove\ToolBMPs\QuestionIcon.jpg 8E0B0D1FD892EA1BAB2858BCA49ACBAE.bin.exe File opened for modification C:\Program Files\Microsoft Office\Office14\OLKIRM.XML 8E0B0D1FD892EA1BAB2858BCA49ACBAE.bin.exe File opened for modification C:\Program Files\Windows NT\TableTextService\TableTextServiceYi.txt 8E0B0D1FD892EA1BAB2858BCA49ACBAE.bin.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\sports_disc_mask.png 8E0B0D1FD892EA1BAB2858BCA49ACBAE.bin.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Yakutsk 8E0B0D1FD892EA1BAB2858BCA49ACBAE.bin.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\javax.annotation_1.2.0.v201401042248.jar 8E0B0D1FD892EA1BAB2858BCA49ACBAE.bin.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\CMNTY_01.MID 8E0B0D1FD892EA1BAB2858BCA49ACBAE.bin.exe File opened for modification C:\Program Files\Windows NT\Accessories\en-US\wordpad.exe.mui 8E0B0D1FD892EA1BAB2858BCA49ACBAE.bin.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\en-US\slideShow.html 8E0B0D1FD892EA1BAB2858BCA49ACBAE.bin.exe File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\Clock.Gadget\images\settings_box_right.png 8E0B0D1FD892EA1BAB2858BCA49ACBAE.bin.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\OUTDR_01.MID 8E0B0D1FD892EA1BAB2858BCA49ACBAE.bin.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\en-US\js\currency.js 8E0B0D1FD892EA1BAB2858BCA49ACBAE.bin.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPWMI.DLL 8E0B0D1FD892EA1BAB2858BCA49ACBAE.bin.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\HH02155_.WMF 8E0B0D1FD892EA1BAB2858BCA49ACBAE.bin.exe File opened for modification C:\Program Files\Microsoft Office\MEDIA\CAGCAT10\J0149481.WMF 8E0B0D1FD892EA1BAB2858BCA49ACBAE.bin.exe File opened for modification C:\Program Files\Microsoft Office\Office14\1033\PUBSPAPR\PDIR35F.GIF 8E0B0D1FD892EA1BAB2858BCA49ACBAE.bin.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\codec\libaribsub_plugin.dll 8E0B0D1FD892EA1BAB2858BCA49ACBAE.bin.exe File opened for modification C:\Program Files\Windows Media Player\Network Sharing\wmpnss_color120.jpg 8E0B0D1FD892EA1BAB2858BCA49ACBAE.bin.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\images\settings_box_divider_right.png 8E0B0D1FD892EA1BAB2858BCA49ACBAE.bin.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-applemenu_zh_CN.jar 8E0B0D1FD892EA1BAB2858BCA49ACBAE.bin.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\America\Curacao 8E0B0D1FD892EA1BAB2858BCA49ACBAE.bin.exe File opened for modification C:\Program Files\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD14532_.GIF 8E0B0D1FD892EA1BAB2858BCA49ACBAE.bin.exe File opened for modification C:\Program Files\Microsoft Office\Office14\OutlookAutoDiscover\NL.ROGERS.COM.XML 8E0B0D1FD892EA1BAB2858BCA49ACBAE.bin.exe File opened for modification C:\Program Files\Microsoft Office\Office14\PUBWIZ\DGSIDEBRV.XML 8E0B0D1FD892EA1BAB2858BCA49ACBAE.bin.exe File opened for modification C:\Program Files\Microsoft Office\Office14\PUBWIZ\DGWEBBTN.DPV 8E0B0D1FD892EA1BAB2858BCA49ACBAE.bin.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\THEMES14\ARCTIC\PREVIEW.GIF 8E0B0D1FD892EA1BAB2858BCA49ACBAE.bin.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.emf.common_2.10.1.v20140901-1043\feature.properties 8E0B0D1FD892EA1BAB2858BCA49ACBAE.bin.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\org-netbeans-lib-profiler-ui.jar 8E0B0D1FD892EA1BAB2858BCA49ACBAE.bin.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\DD01178_.WMF 8E0B0D1FD892EA1BAB2858BCA49ACBAE.bin.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\NA01474_.WMF 8E0B0D1FD892EA1BAB2858BCA49ACBAE.bin.exe File opened for modification C:\Program Files\Microsoft Office\MEDIA\CAGCAT10\J0292982.WMF 8E0B0D1FD892EA1BAB2858BCA49ACBAE.bin.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\demux\libes_plugin.dll 8E0B0D1FD892EA1BAB2858BCA49ACBAE.bin.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\JP2KLib.dll 8E0B0D1FD892EA1BAB2858BCA49ACBAE.bin.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\server_lg.gif 8E0B0D1FD892EA1BAB2858BCA49ACBAE.bin.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\db\bin\stopNetworkServer.bat 8E0B0D1FD892EA1BAB2858BCA49ACBAE.bin.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Managua 8E0B0D1FD892EA1BAB2858BCA49ACBAE.bin.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms\utilityfunctions.js 8E0B0D1FD892EA1BAB2858BCA49ACBAE.bin.exe File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\CPU.Gadget\images\dial_lrg.png 8E0B0D1FD892EA1BAB2858BCA49ACBAE.bin.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\America\Monterrey 8E0B0D1FD892EA1BAB2858BCA49ACBAE.bin.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00154_.GIF 8E0B0D1FD892EA1BAB2858BCA49ACBAE.bin.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\Publisher\Backgrounds\J0143745.GIF 8E0B0D1FD892EA1BAB2858BCA49ACBAE.bin.exe File opened for modification C:\Program Files\Microsoft Office\Office14\1033\PUBSPAPR\PDIR48F.GIF 8E0B0D1FD892EA1BAB2858BCA49ACBAE.bin.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\dialogs\equalizer_window.html 8E0B0D1FD892EA1BAB2858BCA49ACBAE.bin.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\video_filter\libedgedetection_plugin.dll 8E0B0D1FD892EA1BAB2858BCA49ACBAE.bin.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Icons\FDFFile_8.ico.[98509FD4].[helpdesk_makp@protonmail.ch].makop 8E0B0D1FD892EA1BAB2858BCA49ACBAE.bin.exe File opened for modification C:\Program Files (x86)\Windows Photo Viewer\en-US\PhotoViewer.dll.mui 8E0B0D1FD892EA1BAB2858BCA49ACBAE.bin.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Noronha 8E0B0D1FD892EA1BAB2858BCA49ACBAE.bin.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx.zh_CN_5.5.0.165303.jar 8E0B0D1FD892EA1BAB2858BCA49ACBAE.bin.exe File opened for modification C:\Program Files\Java\jre7\bin\plugin2\msvcr100.dll 8E0B0D1FD892EA1BAB2858BCA49ACBAE.bin.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\pe.dll 8E0B0D1FD892EA1BAB2858BCA49ACBAE.bin.exe -
Drops startup file 1 IoCs
Processes:
8E0B0D1FD892EA1BAB2858BCA49ACBAE.bin.exedescription ioc process File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini 8E0B0D1FD892EA1BAB2858BCA49ACBAE.bin.exe -
Makop
Ransomware family discovered by @VK_Intel in early 2020.
-
Adds Run entry to start application 2 TTPs 1 IoCs
Processes:
8E0B0D1FD892EA1BAB2858BCA49ACBAE.bin.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-1848298919-2336104428-4012071465-1000\Software\Microsoft\Windows\CurrentVersion\Run\1 = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\8E0B0D1FD892EA1BAB2858BCA49ACBAE.bin.exe\"" 8E0B0D1FD892EA1BAB2858BCA49ACBAE.bin.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\8E0B0D1FD892EA1BAB2858BCA49ACBAE.bin.exe"C:\Users\Admin\AppData\Local\Temp\8E0B0D1FD892EA1BAB2858BCA49ACBAE.bin.exe"1⤵
- Suspicious use of WriteProcessMemory
- Drops desktop.ini file(s)
- Drops file in Program Files directory
- Drops startup file
- Adds Run entry to start application
-
C:\Users\Admin\AppData\Local\Temp\8E0B0D1FD892EA1BAB2858BCA49ACBAE.bin.exe"C:\Users\Admin\AppData\Local\Temp\8E0B0D1FD892EA1BAB2858BCA49ACBAE.bin.exe" n18522⤵
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe"2⤵
-
C:\Windows\SysWOW64\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\readme-warning.txt2⤵
-
C:\Users\Admin\AppData\Local\Temp\8E0B0D1FD892EA1BAB2858BCA49ACBAE.bin.exe"C:\Users\Admin\AppData\Local\Temp\8E0B0D1FD892EA1BAB2858BCA49ACBAE.bin.exe" n18522⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\Desktop\readme-warning.txt
-
memory/740-5-0x000000000030B000-0x000000000030C000-memory.dmpFilesize
4KB
-
memory/740-6-0x0000000005FC0000-0x0000000005FD1000-memory.dmpFilesize
68KB
-
memory/1852-0-0x00000000047CB000-0x00000000047CC000-memory.dmpFilesize
4KB
-
memory/1852-1-0x0000000005FF0000-0x0000000006001000-memory.dmpFilesize
68KB
-
memory/1876-2-0x000000000476B000-0x000000000476C000-memory.dmpFilesize
4KB
-
memory/1876-3-0x0000000005F70000-0x0000000005F81000-memory.dmpFilesize
68KB