Analysis
-
max time kernel
128s -
max time network
152s -
platform
windows10_x64 -
resource
win10 -
submitted
24-06-2020 05:05
Static task
static1
Behavioral task
behavioral1
Sample
ํฌํธํด๋ฆฌ์ค_๊ฒฝ๋ ฅ์ฌํญ์ ๋ชจ๋ ๊ธฐ์ฌํ์์ต๋๋ค ํ์ธ๋ถํ๋๋ฆฌ๊ฒ ์ต๋๋ค ๊ฐ์ฌํฉ๋๋ค.exe
Resource
win7v200430
Behavioral task
behavioral2
Sample
ํฌํธํด๋ฆฌ์ค_๊ฒฝ๋ ฅ์ฌํญ์ ๋ชจ๋ ๊ธฐ์ฌํ์์ต๋๋ค ํ์ธ๋ถํ๋๋ฆฌ๊ฒ ์ต๋๋ค ๊ฐ์ฌํฉ๋๋ค.exe
Resource
win10
General
-
Target
ํฌํธํด๋ฆฌ์ค_๊ฒฝ๋ ฅ์ฌํญ์ ๋ชจ๋ ๊ธฐ์ฌํ์์ต๋๋ค ํ์ธ๋ถํ๋๋ฆฌ๊ฒ ์ต๋๋ค ๊ฐ์ฌํฉ๋๋ค.exe
-
Size
219KB
-
MD5
f5c6ded07077609d36b4d7886d036e57
-
SHA1
0ba487e27864c387470d826de70c1a13219d2312
-
SHA256
53f5bc946c2b606ab261ee661fba8d32e355455591080c64003214c74c23b994
-
SHA512
dd6b9a15eafaeefe7f6793e9d519ff22effb82183b5bae4a172db3fd6cfda786fdfc3833a117a1c9a486ae9357c8c25008e48b090aea83037fdf7626ba295616
Malware Config
Extracted
C:\readme-warning.txt
makop
akzhq615@protonmail.com
Signatures
-
Makop
Ransomware family discovered by @VK_Intel in early 2020.
-
Suspicious use of AdjustPrivilegeToken 50 IoCs
Processes:
svchost.exevssvc.exewbengine.exeWMIC.exedescription pid process Token: SeTcbPrivilege 4056 svchost.exe Token: SeTcbPrivilege 4056 svchost.exe Token: SeBackupPrivilege 1844 vssvc.exe Token: SeRestorePrivilege 1844 vssvc.exe Token: SeAuditPrivilege 1844 vssvc.exe Token: SeBackupPrivilege 668 wbengine.exe Token: SeRestorePrivilege 668 wbengine.exe Token: SeSecurityPrivilege 668 wbengine.exe Token: SeIncreaseQuotaPrivilege 1416 WMIC.exe Token: SeSecurityPrivilege 1416 WMIC.exe Token: SeTakeOwnershipPrivilege 1416 WMIC.exe Token: SeLoadDriverPrivilege 1416 WMIC.exe Token: SeSystemProfilePrivilege 1416 WMIC.exe Token: SeSystemtimePrivilege 1416 WMIC.exe Token: SeProfSingleProcessPrivilege 1416 WMIC.exe Token: SeIncBasePriorityPrivilege 1416 WMIC.exe Token: SeCreatePagefilePrivilege 1416 WMIC.exe Token: SeBackupPrivilege 1416 WMIC.exe Token: SeRestorePrivilege 1416 WMIC.exe Token: SeShutdownPrivilege 1416 WMIC.exe Token: SeDebugPrivilege 1416 WMIC.exe Token: SeSystemEnvironmentPrivilege 1416 WMIC.exe Token: SeRemoteShutdownPrivilege 1416 WMIC.exe Token: SeUndockPrivilege 1416 WMIC.exe Token: SeManageVolumePrivilege 1416 WMIC.exe Token: 33 1416 WMIC.exe Token: 34 1416 WMIC.exe Token: 35 1416 WMIC.exe Token: 36 1416 WMIC.exe Token: SeIncreaseQuotaPrivilege 1416 WMIC.exe Token: SeSecurityPrivilege 1416 WMIC.exe Token: SeTakeOwnershipPrivilege 1416 WMIC.exe Token: SeLoadDriverPrivilege 1416 WMIC.exe Token: SeSystemProfilePrivilege 1416 WMIC.exe Token: SeSystemtimePrivilege 1416 WMIC.exe Token: SeProfSingleProcessPrivilege 1416 WMIC.exe Token: SeIncBasePriorityPrivilege 1416 WMIC.exe Token: SeCreatePagefilePrivilege 1416 WMIC.exe Token: SeBackupPrivilege 1416 WMIC.exe Token: SeRestorePrivilege 1416 WMIC.exe Token: SeShutdownPrivilege 1416 WMIC.exe Token: SeDebugPrivilege 1416 WMIC.exe Token: SeSystemEnvironmentPrivilege 1416 WMIC.exe Token: SeRemoteShutdownPrivilege 1416 WMIC.exe Token: SeUndockPrivilege 1416 WMIC.exe Token: SeManageVolumePrivilege 1416 WMIC.exe Token: 33 1416 WMIC.exe Token: 34 1416 WMIC.exe Token: 35 1416 WMIC.exe Token: 36 1416 WMIC.exe -
Suspicious use of WriteProcessMemory 36 IoCs
Processes:
svchost.exeํฌํธํด๋ฆฌ์ค_๊ฒฝ๋ ฅ์ฌํญ์ ๋ชจ๋ ๊ธฐ์ฌํ์์ต๋๋ค ํ์ธ๋ถํ๋๋ฆฌ๊ฒ ์ต๋๋ค ๊ฐ์ฌํฉ๋๋ค.execmd.exedescription pid process target process PID 4056 wrote to memory of 3876 4056 svchost.exe ํฌํธํด๋ฆฌ์ค_๊ฒฝ๋ ฅ์ฌํญ์ ๋ชจ๋ ๊ธฐ์ฌํ์์ต๋๋ค ํ์ธ๋ถํ๋๋ฆฌ๊ฒ ์ต๋๋ค ๊ฐ์ฌํฉ๋๋ค.exe PID 4056 wrote to memory of 3876 4056 svchost.exe ํฌํธํด๋ฆฌ์ค_๊ฒฝ๋ ฅ์ฌํญ์ ๋ชจ๋ ๊ธฐ์ฌํ์์ต๋๋ค ํ์ธ๋ถํ๋๋ฆฌ๊ฒ ์ต๋๋ค ๊ฐ์ฌํฉ๋๋ค.exe PID 4056 wrote to memory of 3876 4056 svchost.exe ํฌํธํด๋ฆฌ์ค_๊ฒฝ๋ ฅ์ฌํญ์ ๋ชจ๋ ๊ธฐ์ฌํ์์ต๋๋ค ํ์ธ๋ถํ๋๋ฆฌ๊ฒ ์ต๋๋ค ๊ฐ์ฌํฉ๋๋ค.exe PID 4056 wrote to memory of 3876 4056 svchost.exe ํฌํธํด๋ฆฌ์ค_๊ฒฝ๋ ฅ์ฌํญ์ ๋ชจ๋ ๊ธฐ์ฌํ์์ต๋๋ค ํ์ธ๋ถํ๋๋ฆฌ๊ฒ ์ต๋๋ค ๊ฐ์ฌํฉ๋๋ค.exe PID 4056 wrote to memory of 3876 4056 svchost.exe ํฌํธํด๋ฆฌ์ค_๊ฒฝ๋ ฅ์ฌํญ์ ๋ชจ๋ ๊ธฐ์ฌํ์์ต๋๋ค ํ์ธ๋ถํ๋๋ฆฌ๊ฒ ์ต๋๋ค ๊ฐ์ฌํฉ๋๋ค.exe PID 4056 wrote to memory of 3876 4056 svchost.exe ํฌํธํด๋ฆฌ์ค_๊ฒฝ๋ ฅ์ฌํญ์ ๋ชจ๋ ๊ธฐ์ฌํ์์ต๋๋ค ํ์ธ๋ถํ๋๋ฆฌ๊ฒ ์ต๋๋ค ๊ฐ์ฌํฉ๋๋ค.exe PID 4056 wrote to memory of 3876 4056 svchost.exe ํฌํธํด๋ฆฌ์ค_๊ฒฝ๋ ฅ์ฌํญ์ ๋ชจ๋ ๊ธฐ์ฌํ์์ต๋๋ค ํ์ธ๋ถํ๋๋ฆฌ๊ฒ ์ต๋๋ค ๊ฐ์ฌํฉ๋๋ค.exe PID 3680 wrote to memory of 3856 3680 ํฌํธํด๋ฆฌ์ค_๊ฒฝ๋ ฅ์ฌํญ์ ๋ชจ๋ ๊ธฐ์ฌํ์์ต๋๋ค ํ์ธ๋ถํ๋๋ฆฌ๊ฒ ์ต๋๋ค ๊ฐ์ฌํฉ๋๋ค.exe cmd.exe PID 3680 wrote to memory of 3856 3680 ํฌํธํด๋ฆฌ์ค_๊ฒฝ๋ ฅ์ฌํญ์ ๋ชจ๋ ๊ธฐ์ฌํ์์ต๋๋ค ํ์ธ๋ถํ๋๋ฆฌ๊ฒ ์ต๋๋ค ๊ฐ์ฌํฉ๋๋ค.exe cmd.exe PID 3856 wrote to memory of 736 3856 cmd.exe vssadmin.exe PID 3856 wrote to memory of 736 3856 cmd.exe vssadmin.exe PID 3856 wrote to memory of 512 3856 cmd.exe wbadmin.exe PID 3856 wrote to memory of 512 3856 cmd.exe wbadmin.exe PID 3856 wrote to memory of 1416 3856 cmd.exe WMIC.exe PID 3856 wrote to memory of 1416 3856 cmd.exe WMIC.exe PID 4056 wrote to memory of 804 4056 svchost.exe ํฌํธํด๋ฆฌ์ค_๊ฒฝ๋ ฅ์ฌํญ์ ๋ชจ๋ ๊ธฐ์ฌํ์์ต๋๋ค ํ์ธ๋ถํ๋๋ฆฌ๊ฒ ์ต๋๋ค ๊ฐ์ฌํฉ๋๋ค.exe PID 4056 wrote to memory of 804 4056 svchost.exe ํฌํธํด๋ฆฌ์ค_๊ฒฝ๋ ฅ์ฌํญ์ ๋ชจ๋ ๊ธฐ์ฌํ์์ต๋๋ค ํ์ธ๋ถํ๋๋ฆฌ๊ฒ ์ต๋๋ค ๊ฐ์ฌํฉ๋๋ค.exe PID 4056 wrote to memory of 804 4056 svchost.exe ํฌํธํด๋ฆฌ์ค_๊ฒฝ๋ ฅ์ฌํญ์ ๋ชจ๋ ๊ธฐ์ฌํ์์ต๋๋ค ํ์ธ๋ถํ๋๋ฆฌ๊ฒ ์ต๋๋ค ๊ฐ์ฌํฉ๋๋ค.exe PID 4056 wrote to memory of 804 4056 svchost.exe ํฌํธํด๋ฆฌ์ค_๊ฒฝ๋ ฅ์ฌํญ์ ๋ชจ๋ ๊ธฐ์ฌํ์์ต๋๋ค ํ์ธ๋ถํ๋๋ฆฌ๊ฒ ์ต๋๋ค ๊ฐ์ฌํฉ๋๋ค.exe PID 4056 wrote to memory of 804 4056 svchost.exe ํฌํธํด๋ฆฌ์ค_๊ฒฝ๋ ฅ์ฌํญ์ ๋ชจ๋ ๊ธฐ์ฌํ์์ต๋๋ค ํ์ธ๋ถํ๋๋ฆฌ๊ฒ ์ต๋๋ค ๊ฐ์ฌํฉ๋๋ค.exe PID 4056 wrote to memory of 804 4056 svchost.exe ํฌํธํด๋ฆฌ์ค_๊ฒฝ๋ ฅ์ฌํญ์ ๋ชจ๋ ๊ธฐ์ฌํ์์ต๋๋ค ํ์ธ๋ถํ๋๋ฆฌ๊ฒ ์ต๋๋ค ๊ฐ์ฌํฉ๋๋ค.exe PID 4056 wrote to memory of 804 4056 svchost.exe ํฌํธํด๋ฆฌ์ค_๊ฒฝ๋ ฅ์ฌํญ์ ๋ชจ๋ ๊ธฐ์ฌํ์์ต๋๋ค ํ์ธ๋ถํ๋๋ฆฌ๊ฒ ์ต๋๋ค ๊ฐ์ฌํฉ๋๋ค.exe PID 4056 wrote to memory of 3904 4056 svchost.exe ํฌํธํด๋ฆฌ์ค_๊ฒฝ๋ ฅ์ฌํญ์ ๋ชจ๋ ๊ธฐ์ฌํ์์ต๋๋ค ํ์ธ๋ถํ๋๋ฆฌ๊ฒ ์ต๋๋ค ๊ฐ์ฌํฉ๋๋ค.exe PID 4056 wrote to memory of 3904 4056 svchost.exe ํฌํธํด๋ฆฌ์ค_๊ฒฝ๋ ฅ์ฌํญ์ ๋ชจ๋ ๊ธฐ์ฌํ์์ต๋๋ค ํ์ธ๋ถํ๋๋ฆฌ๊ฒ ์ต๋๋ค ๊ฐ์ฌํฉ๋๋ค.exe PID 4056 wrote to memory of 3904 4056 svchost.exe ํฌํธํด๋ฆฌ์ค_๊ฒฝ๋ ฅ์ฌํญ์ ๋ชจ๋ ๊ธฐ์ฌํ์์ต๋๋ค ํ์ธ๋ถํ๋๋ฆฌ๊ฒ ์ต๋๋ค ๊ฐ์ฌํฉ๋๋ค.exe PID 4056 wrote to memory of 3904 4056 svchost.exe ํฌํธํด๋ฆฌ์ค_๊ฒฝ๋ ฅ์ฌํญ์ ๋ชจ๋ ๊ธฐ์ฌํ์์ต๋๋ค ํ์ธ๋ถํ๋๋ฆฌ๊ฒ ์ต๋๋ค ๊ฐ์ฌํฉ๋๋ค.exe PID 4056 wrote to memory of 3904 4056 svchost.exe ํฌํธํด๋ฆฌ์ค_๊ฒฝ๋ ฅ์ฌํญ์ ๋ชจ๋ ๊ธฐ์ฌํ์์ต๋๋ค ํ์ธ๋ถํ๋๋ฆฌ๊ฒ ์ต๋๋ค ๊ฐ์ฌํฉ๋๋ค.exe PID 4056 wrote to memory of 3904 4056 svchost.exe ํฌํธํด๋ฆฌ์ค_๊ฒฝ๋ ฅ์ฌํญ์ ๋ชจ๋ ๊ธฐ์ฌํ์์ต๋๋ค ํ์ธ๋ถํ๋๋ฆฌ๊ฒ ์ต๋๋ค ๊ฐ์ฌํฉ๋๋ค.exe PID 4056 wrote to memory of 3904 4056 svchost.exe ํฌํธํด๋ฆฌ์ค_๊ฒฝ๋ ฅ์ฌํญ์ ๋ชจ๋ ๊ธฐ์ฌํ์์ต๋๋ค ํ์ธ๋ถํ๋๋ฆฌ๊ฒ ์ต๋๋ค ๊ฐ์ฌํฉ๋๋ค.exe PID 4056 wrote to memory of 1304 4056 svchost.exe ํฌํธํด๋ฆฌ์ค_๊ฒฝ๋ ฅ์ฌํญ์ ๋ชจ๋ ๊ธฐ์ฌํ์์ต๋๋ค ํ์ธ๋ถํ๋๋ฆฌ๊ฒ ์ต๋๋ค ๊ฐ์ฌํฉ๋๋ค.exe PID 4056 wrote to memory of 1304 4056 svchost.exe ํฌํธํด๋ฆฌ์ค_๊ฒฝ๋ ฅ์ฌํญ์ ๋ชจ๋ ๊ธฐ์ฌํ์์ต๋๋ค ํ์ธ๋ถํ๋๋ฆฌ๊ฒ ์ต๋๋ค ๊ฐ์ฌํฉ๋๋ค.exe PID 4056 wrote to memory of 1304 4056 svchost.exe ํฌํธํด๋ฆฌ์ค_๊ฒฝ๋ ฅ์ฌํญ์ ๋ชจ๋ ๊ธฐ์ฌํ์์ต๋๋ค ํ์ธ๋ถํ๋๋ฆฌ๊ฒ ์ต๋๋ค ๊ฐ์ฌํฉ๋๋ค.exe PID 4056 wrote to memory of 1304 4056 svchost.exe ํฌํธํด๋ฆฌ์ค_๊ฒฝ๋ ฅ์ฌํญ์ ๋ชจ๋ ๊ธฐ์ฌํ์์ต๋๋ค ํ์ธ๋ถํ๋๋ฆฌ๊ฒ ์ต๋๋ค ๊ฐ์ฌํฉ๋๋ค.exe PID 4056 wrote to memory of 1304 4056 svchost.exe ํฌํธํด๋ฆฌ์ค_๊ฒฝ๋ ฅ์ฌํญ์ ๋ชจ๋ ๊ธฐ์ฌํ์์ต๋๋ค ํ์ธ๋ถํ๋๋ฆฌ๊ฒ ์ต๋๋ค ๊ฐ์ฌํฉ๋๋ค.exe PID 4056 wrote to memory of 1304 4056 svchost.exe ํฌํธํด๋ฆฌ์ค_๊ฒฝ๋ ฅ์ฌํญ์ ๋ชจ๋ ๊ธฐ์ฌํ์์ต๋๋ค ํ์ธ๋ถํ๋๋ฆฌ๊ฒ ์ต๋๋ค ๊ฐ์ฌํฉ๋๋ค.exe PID 4056 wrote to memory of 1304 4056 svchost.exe ํฌํธํด๋ฆฌ์ค_๊ฒฝ๋ ฅ์ฌํญ์ ๋ชจ๋ ๊ธฐ์ฌํ์์ต๋๋ค ํ์ธ๋ถํ๋๋ฆฌ๊ฒ ์ต๋๋ค ๊ฐ์ฌํฉ๋๋ค.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
ํฌํธํด๋ฆฌ์ค_๊ฒฝ๋ ฅ์ฌํญ์ ๋ชจ๋ ๊ธฐ์ฌํ์์ต๋๋ค ํ์ธ๋ถํ๋๋ฆฌ๊ฒ ์ต๋๋ค ๊ฐ์ฌํฉ๋๋ค.exepid process 3680 ํฌํธํด๋ฆฌ์ค_๊ฒฝ๋ ฅ์ฌํญ์ ๋ชจ๋ ๊ธฐ์ฌํ์์ต๋๋ค ํ์ธ๋ถํ๋๋ฆฌ๊ฒ ์ต๋๋ค ๊ฐ์ฌํฉ๋๋ค.exe 3680 ํฌํธํด๋ฆฌ์ค_๊ฒฝ๋ ฅ์ฌํญ์ ๋ชจ๋ ๊ธฐ์ฌํ์์ต๋๋ค ํ์ธ๋ถํ๋๋ฆฌ๊ฒ ์ต๋๋ค ๊ฐ์ฌํฉ๋๋ค.exe -
Interacts with shadow copies 2 TTPs 1 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
Processes:
vssadmin.exepid process 736 vssadmin.exe -
Deletes system backup catalog 2 TTPs
Ransomware often tries to delete backup files to inhibit system recovery.
-
Adds Run entry to start application 2 TTPs 1 IoCs
Processes:
ํฌํธํด๋ฆฌ์ค_๊ฒฝ๋ ฅ์ฌํญ์ ๋ชจ๋ ๊ธฐ์ฌํ์์ต๋๋ค ํ์ธ๋ถํ๋๋ฆฌ๊ฒ ์ต๋๋ค ๊ฐ์ฌํฉ๋๋ค.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000\Software\Microsoft\Windows\CurrentVersion\Run\1 = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\ํฌํธํด๋ฆฌ์ค_๊ฒฝ๋ ฅ์ฌํญ์ ๋ชจ๋ ๊ธฐ์ฌํ์์ต๋๋ค ํ์ธ๋ถํ๋๋ฆฌ๊ฒ ์ต๋๋ค ๊ฐ์ฌํฉ๋๋ค.exe\"" ํฌํธํด๋ฆฌ์ค_๊ฒฝ๋ ฅ์ฌํญ์ ๋ชจ๋ ๊ธฐ์ฌํ์์ต๋๋ค ํ์ธ๋ถํ๋๋ฆฌ๊ฒ ์ต๋๋ค ๊ฐ์ฌํฉ๋๋ค.exe -
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Processes:
wbadmin.exepid process 512 wbadmin.exe -
Modifies service 2 TTPs 5 IoCs
Processes:
vssvc.exedescription ioc process Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\COM+ REGDB Writer vssvc.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\ASR Writer vssvc.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\Shadow Copy Optimization Writer vssvc.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\SwProvider_{b5946137-7b9f-4925-af80-51abd60b20d5} vssvc.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\Registry Writer vssvc.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Checks SCSI registry key(s) 3 TTPs 4 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
vds.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_&PROD_HEARTDISK\4&37CE57BA&0&000000 vds.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\FriendlyName vds.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_SANU&PROD_SANU_DVD-ROM\4&37CE57BA&0&010000 vds.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\FriendlyName vds.exe -
Suspicious use of NtCreateUserProcessOtherParentProcess 4 IoCs
Processes:
svchost.exedescription pid process target process PID 4056 created 3680 4056 svchost.exe ํฌํธํด๋ฆฌ์ค_๊ฒฝ๋ ฅ์ฌํญ์ ๋ชจ๋ ๊ธฐ์ฌํ์์ต๋๋ค ํ์ธ๋ถํ๋๋ฆฌ๊ฒ ์ต๋๋ค ๊ฐ์ฌํฉ๋๋ค.exe PID 4056 created 3680 4056 svchost.exe ํฌํธํด๋ฆฌ์ค_๊ฒฝ๋ ฅ์ฌํญ์ ๋ชจ๋ ๊ธฐ์ฌํ์์ต๋๋ค ํ์ธ๋ถํ๋๋ฆฌ๊ฒ ์ต๋๋ค ๊ฐ์ฌํฉ๋๋ค.exe PID 4056 created 3680 4056 svchost.exe ํฌํธํด๋ฆฌ์ค_๊ฒฝ๋ ฅ์ฌํญ์ ๋ชจ๋ ๊ธฐ์ฌํ์์ต๋๋ค ํ์ธ๋ถํ๋๋ฆฌ๊ฒ ์ต๋๋ค ๊ฐ์ฌํฉ๋๋ค.exe PID 4056 created 3680 4056 svchost.exe ํฌํธํด๋ฆฌ์ค_๊ฒฝ๋ ฅ์ฌํญ์ ๋ชจ๋ ๊ธฐ์ฌํ์์ต๋๋ค ํ์ธ๋ถํ๋๋ฆฌ๊ฒ ์ต๋๋ค ๊ฐ์ฌํฉ๋๋ค.exe -
Drops file in Program Files directory 16000 IoCs
Processes:
ํฌํธํด๋ฆฌ์ค_๊ฒฝ๋ ฅ์ฌํญ์ ๋ชจ๋ ๊ธฐ์ฌํ์์ต๋๋ค ํ์ธ๋ถํ๋๋ฆฌ๊ฒ ์ต๋๋ค ๊ฐ์ฌํฉ๋๋ค.exedescription ioc process File opened for modification C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.16112.11621.0_x64__8wekyb3d8bbwe\Assets\AppList.targetsize-36.png ํฌํธํด๋ฆฌ์ค_๊ฒฝ๋ ฅ์ฌํญ์ ๋ชจ๋ ๊ธฐ์ฌํ์์ต๋๋ค ํ์ธ๋ถํ๋๋ฆฌ๊ฒ ์ต๋๋ค ๊ฐ์ฌํฉ๋๋ค.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\MobileScanCard_Dark.pdf ํฌํธํด๋ฆฌ์ค_๊ฒฝ๋ ฅ์ฌํญ์ ๋ชจ๋ ๊ธฐ์ฌํ์์ต๋๋ค ํ์ธ๋ถํ๋๋ฆฌ๊ฒ ์ต๋๋ค ๊ฐ์ฌํฉ๋๋ค.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\css\ui-lightness\images\ui-icons_ffd27a_256x240.png ํฌํธํด๋ฆฌ์ค_๊ฒฝ๋ ฅ์ฌํญ์ ๋ชจ๋ ๊ธฐ์ฌํ์์ต๋๋ค ํ์ธ๋ถํ๋๋ฆฌ๊ฒ ์ต๋๋ค ๊ฐ์ฌํฉ๋๋ค.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\Assets\contrast-white\AppPackageAppList.targetsize-96_altform-unplated_contrast-white.png ํฌํธํด๋ฆฌ์ค_๊ฒฝ๋ ฅ์ฌํญ์ ๋ชจ๋ ๊ธฐ์ฌํ์์ต๋๋ค ํ์ธ๋ถํ๋๋ฆฌ๊ฒ ์ต๋๋ค ๊ฐ์ฌํฉ๋๋ค.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\Assets\Themes\Autumn\autumn_cardback.png ํฌํธํด๋ฆฌ์ค_๊ฒฝ๋ ฅ์ฌํญ์ ๋ชจ๋ ๊ธฐ์ฌํ์์ต๋๋ค ํ์ธ๋ถํ๋๋ฆฌ๊ฒ ์ต๋๋ค ๊ฐ์ฌํฉ๋๋ค.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Analysis Services\AS OLEDB\140\Resources\1033\msmdsrv.rll ํฌํธํด๋ฆฌ์ค_๊ฒฝ๋ ฅ์ฌํญ์ ๋ชจ๋ ๊ธฐ์ฌํ์์ต๋๋ค ํ์ธ๋ถํ๋๋ฆฌ๊ฒ ์ต๋๋ค ๊ฐ์ฌํฉ๋๋ค.exe File opened for modification C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsStore_11701.1001.87.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\AppTiles\contrast-white\StoreMedTile.scale-100.png ํฌํธํด๋ฆฌ์ค_๊ฒฝ๋ ฅ์ฌํญ์ ๋ชจ๋ ๊ธฐ์ฌํ์์ต๋๋ค ํ์ธ๋ถํ๋๋ฆฌ๊ฒ ์ต๋๋ค ๊ฐ์ฌํฉ๋๋ค.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.SkypeApp_11.8.204.0_x64__kzf8qxf38zg5c\SkypeApp\Designs\Flags\small\sl_16x11.png ํฌํธํด๋ฆฌ์ค_๊ฒฝ๋ ฅ์ฌํญ์ ๋ชจ๋ ๊ธฐ์ฌํ์์ต๋๋ค ํ์ธ๋ถํ๋๋ฆฌ๊ฒ ์ต๋๋ค ๊ฐ์ฌํฉ๋๋ค.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Fonts\private\MSJHBD.TTC ํฌํธํด๋ฆฌ์ค_๊ฒฝ๋ ฅ์ฌํญ์ ๋ชจ๋ ๊ธฐ์ฌํ์์ต๋๋ค ํ์ธ๋ถํ๋๋ฆฌ๊ฒ ์ต๋๋ค ๊ฐ์ฌํฉ๋๋ค.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsAlarms_10.1702.333.0_x64__8wekyb3d8bbwe\Assets\StopwatchLargeTile.contrast-black_scale-200.png ํฌํธํด๋ฆฌ์ค_๊ฒฝ๋ ฅ์ฌํญ์ ๋ชจ๋ ๊ธฐ์ฌํ์์ต๋๋ค ํ์ธ๋ถํ๋๋ฆฌ๊ฒ ์ต๋๋ค ๊ฐ์ฌํฉ๋๋ค.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Office.OneNote_17.7668.58071.0_x64__8wekyb3d8bbwe\images\contrast-black\OneNoteSectionSmallTile.scale-200.png ํฌํธํด๋ฆฌ์ค_๊ฒฝ๋ ฅ์ฌํญ์ ๋ชจ๋ ๊ธฐ์ฌํ์์ต๋๋ค ํ์ธ๋ถํ๋๋ฆฌ๊ฒ ์ต๋๋ค ๊ฐ์ฌํฉ๋๋ค.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.7906.42257.0_x64__8wekyb3d8bbwe\images\5372_40x40x32.png ํฌํธํด๋ฆฌ์ค_๊ฒฝ๋ ฅ์ฌํญ์ ๋ชจ๋ ๊ธฐ์ฌํ์์ต๋๋ค ํ์ธ๋ถํ๋๋ฆฌ๊ฒ ์ต๋๋ค ๊ฐ์ฌํฉ๋๋ค.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.7906.42257.0_x64__8wekyb3d8bbwe\images\contrast-white\GenericMailSmallTile.scale-150.png ํฌํธํด๋ฆฌ์ค_๊ฒฝ๋ ฅ์ฌํญ์ ๋ชจ๋ ๊ธฐ์ฌํ์์ต๋๋ค ํ์ธ๋ถํ๋๋ฆฌ๊ฒ ์ต๋๋ค ๊ฐ์ฌํฉ๋๋ค.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.XboxApp_25.25.13009.0_x64__8wekyb3d8bbwe\Assets\GamesXboxHubMedTile.scale-100_contrast-high.png ํฌํธํด๋ฆฌ์ค_๊ฒฝ๋ ฅ์ฌํญ์ ๋ชจ๋ ๊ธฐ์ฌํ์์ต๋๋ค ํ์ธ๋ถํ๋๋ฆฌ๊ฒ ์ต๋๋ค ๊ฐ์ฌํฉ๋๋ค.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\editvideoimage.png ํฌํธํด๋ฆฌ์ค_๊ฒฝ๋ ฅ์ฌํญ์ ๋ชจ๋ ๊ธฐ์ฌํ์์ต๋๋ค ํ์ธ๋ถํ๋๋ฆฌ๊ฒ ์ต๋๋ค ๊ฐ์ฌํฉ๋๋ค.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\Abbreviations\en_GB\List.txt ํฌํธํด๋ฆฌ์ค_๊ฒฝ๋ ฅ์ฌํญ์ ๋ชจ๋ ๊ธฐ์ฌํ์์ต๋๋ค ํ์ธ๋ถํ๋๋ฆฌ๊ฒ ์ต๋๋ค ๊ฐ์ฌํฉ๋๋ค.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.7906.42257.0_x64__8wekyb3d8bbwe\images\contrast-white\LinkedInboxBadge.scale-400.png ํฌํธํด๋ฆฌ์ค_๊ฒฝ๋ ฅ์ฌํญ์ ๋ชจ๋ ๊ธฐ์ฌํ์์ต๋๋ค ํ์ธ๋ถํ๋๋ฆฌ๊ฒ ์ต๋๋ค ๊ฐ์ฌํฉ๋๋ค.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsSoundRecorder_10.1702.301.0_x64__8wekyb3d8bbwe\Assets\VoiceRecorderAppList.targetsize-30.png ํฌํธํด๋ฆฌ์ค_๊ฒฝ๋ ฅ์ฌํญ์ ๋ชจ๋ ๊ธฐ์ฌํ์์ต๋๋ค ํ์ธ๋ถํ๋๋ฆฌ๊ฒ ์ต๋๋ค ๊ฐ์ฌํฉ๋๋ค.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.16112.11621.0_x64__8wekyb3d8bbwe\Assets\AppList.targetsize-60.png ํฌํธํด๋ฆฌ์ค_๊ฒฝ๋ ฅ์ฌํญ์ ๋ชจ๋ ๊ธฐ์ฌํ์์ต๋๋ค ํ์ธ๋ถํ๋๋ฆฌ๊ฒ ์ต๋๋ค ๊ฐ์ฌํฉ๋๋ค.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsAlarms_10.1702.333.0_x64__8wekyb3d8bbwe\Assets\AlarmsAppList.targetsize-80_altform-unplated.png ํฌํธํด๋ฆฌ์ค_๊ฒฝ๋ ฅ์ฌํญ์ ๋ชจ๋ ๊ธฐ์ฌํ์์ต๋๋ค ํ์ธ๋ถํ๋๋ฆฌ๊ฒ ์ต๋๋ค ๊ฐ์ฌํฉ๋๋ค.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.7906.42257.0_x64__8wekyb3d8bbwe\images\HxA-Exchange.scale-100.png ํฌํธํด๋ฆฌ์ค_๊ฒฝ๋ ฅ์ฌํญ์ ๋ชจ๋ ๊ธฐ์ฌํ์์ต๋๋ค ํ์ธ๋ถํ๋๋ฆฌ๊ฒ ์ต๋๋ค ๊ฐ์ฌํฉ๋๋ค.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\ccloud_retina.png ํฌํธํด๋ฆฌ์ค_๊ฒฝ๋ ฅ์ฌํญ์ ๋ชจ๋ ๊ธฐ์ฌํ์์ต๋๋ค ํ์ธ๋ถํ๋๋ฆฌ๊ฒ ์ต๋๋ค ๊ฐ์ฌํฉ๋๋ค.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\file_types\themes\dark\s_shared_single_filetype.svg ํฌํธํด๋ฆฌ์ค_๊ฒฝ๋ ฅ์ฌํญ์ ๋ชจ๋ ๊ธฐ์ฌํ์์ต๋๋ค ํ์ธ๋ถํ๋๋ฆฌ๊ฒ ์ต๋๋ค ๊ฐ์ฌํฉ๋๋ค.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\cs-cz\ui-strings.js ํฌํธํด๋ฆฌ์ค_๊ฒฝ๋ ฅ์ฌํญ์ ๋ชจ๋ ๊ธฐ์ฌํ์์ต๋๋ค ํ์ธ๋ถํ๋๋ฆฌ๊ฒ ์ต๋๋ค ๊ฐ์ฌํฉ๋๋ค.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\lib\deploy\messages_it.properties ํฌํธํด๋ฆฌ์ค_๊ฒฝ๋ ฅ์ฌํญ์ ๋ชจ๋ ๊ธฐ์ฌํ์์ต๋๋ค ํ์ธ๋ถํ๋๋ฆฌ๊ฒ ์ต๋๋ค ๊ฐ์ฌํฉ๋๋ค.exe File opened for modification C:\Program Files\Java\jre1.8.0_66\lib\fonts\LucidaBrightItalic.ttf ํฌํธํด๋ฆฌ์ค_๊ฒฝ๋ ฅ์ฌํญ์ ๋ชจ๋ ๊ธฐ์ฌํ์์ต๋๋ค ํ์ธ๋ถํ๋๋ฆฌ๊ฒ ์ต๋๋ค ๊ฐ์ฌํฉ๋๋ค.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\Assets\Themes\Autumn\autumn_11s.png ํฌํธํด๋ฆฌ์ค_๊ฒฝ๋ ฅ์ฌํญ์ ๋ชจ๋ ๊ธฐ์ฌํ์์ต๋๋ค ํ์ธ๋ถํ๋๋ฆฌ๊ฒ ์ต๋๋ค ๊ฐ์ฌํฉ๋๋ค.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.7906.42257.0_x64__8wekyb3d8bbwe\images\HxMailAppList.scale-150.png ํฌํธํด๋ฆฌ์ค_๊ฒฝ๋ ฅ์ฌํญ์ ๋ชจ๋ ๊ธฐ์ฌํ์์ต๋๋ค ํ์ธ๋ถํ๋๋ฆฌ๊ฒ ์ต๋๋ค ๊ฐ์ฌํฉ๋๋ค.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\es-419_get.svg ํฌํธํด๋ฆฌ์ค_๊ฒฝ๋ ฅ์ฌํญ์ ๋ชจ๋ ๊ธฐ์ฌํ์์ต๋๋ค ํ์ธ๋ถํ๋๋ฆฌ๊ฒ ์ต๋๋ค ๊ฐ์ฌํฉ๋๋ค.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\OFFICE16\en-us\oregres.dll.mui ํฌํธํด๋ฆฌ์ค_๊ฒฝ๋ ฅ์ฌํญ์ ๋ชจ๋ ๊ธฐ์ฌํ์์ต๋๋ค ํ์ธ๋ถํ๋๋ฆฌ๊ฒ ์ต๋๋ค ๊ฐ์ฌํฉ๋๋ค.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.10252.0_neutral_split.scale-125_8wekyb3d8bbwe\AppxManifest.xml ํฌํธํด๋ฆฌ์ค_๊ฒฝ๋ ฅ์ฌํญ์ ๋ชจ๋ ๊ธฐ์ฌํ์์ต๋๋ค ํ์ธ๋ถํ๋๋ฆฌ๊ฒ ์ต๋๋ค ๊ฐ์ฌํฉ๋๋ค.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.NET.Native.Runtime.1.3_1.3.23901.0_x64__8wekyb3d8bbwe\AppxBlockMap.xml ํฌํธํด๋ฆฌ์ค_๊ฒฝ๋ ฅ์ฌํญ์ ๋ชจ๋ ๊ธฐ์ฌํ์์ต๋๋ค ํ์ธ๋ถํ๋๋ฆฌ๊ฒ ์ต๋๋ค ๊ฐ์ฌํฉ๋๋ค.exe File opened for modification C:\Program Files\Java\jre1.8.0_66\lib\fonts\LucidaTypewriterBold.ttf ํฌํธํด๋ฆฌ์ค_๊ฒฝ๋ ฅ์ฌํญ์ ๋ชจ๋ ๊ธฐ์ฌํ์์ต๋๋ค ํ์ธ๋ถํ๋๋ฆฌ๊ฒ ์ต๋๋ค ๊ฐ์ฌํฉ๋๋ค.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\ads_win10_300x250.scale-100.jpg ํฌํธํด๋ฆฌ์ค_๊ฒฝ๋ ฅ์ฌํญ์ ๋ชจ๋ ๊ธฐ์ฌํ์์ต๋๋ค ํ์ธ๋ถํ๋๋ฆฌ๊ฒ ์ต๋๋ค ๊ฐ์ฌํฉ๋๋ค.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.7906.42257.0_x64__8wekyb3d8bbwe\images\contrast-black\HxCalendarAppList.targetsize-256.png ํฌํธํด๋ฆฌ์ค_๊ฒฝ๋ ฅ์ฌํญ์ ๋ชจ๋ ๊ธฐ์ฌํ์์ต๋๋ค ํ์ธ๋ถํ๋๋ฆฌ๊ฒ ์ต๋๋ค ๊ฐ์ฌํฉ๋๋ค.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\Assets\Awards\freecell\Alcatraz_Escape_Unearned_small.png ํฌํธํด๋ฆฌ์ค_๊ฒฝ๋ ฅ์ฌํญ์ ๋ชจ๋ ๊ธฐ์ฌํ์์ต๋๋ค ํ์ธ๋ถํ๋๋ฆฌ๊ฒ ์ต๋๋ค ๊ฐ์ฌํฉ๋๋ค.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MSPaint_1.1702.28017.0_x64__8wekyb3d8bbwe\CommunityServicesProvider.winmd ํฌํธํด๋ฆฌ์ค_๊ฒฝ๋ ฅ์ฌํญ์ ๋ชจ๋ ๊ธฐ์ฌํ์์ต๋๋ค ํ์ธ๋ถํ๋๋ฆฌ๊ฒ ์ต๋๋ค ๊ฐ์ฌํฉ๋๋ค.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.OneConnect_2.1701.277.0_x64__8wekyb3d8bbwe\Assets\contrast-black\OneConnectAppList.targetsize-72.png ํฌํธํด๋ฆฌ์ค_๊ฒฝ๋ ฅ์ฌํญ์ ๋ชจ๋ ๊ธฐ์ฌํ์์ต๋๋ค ํ์ธ๋ถํ๋๋ฆฌ๊ฒ ์ต๋๋ค ๊ฐ์ฌํฉ๋๋ค.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\win8-scrollbar\themes\dark\arrow-left-pressed.gif ํฌํธํด๋ฆฌ์ค_๊ฒฝ๋ ฅ์ฌํญ์ ๋ชจ๋ ๊ธฐ์ฌํ์์ต๋๋ค ํ์ธ๋ถํ๋๋ฆฌ๊ฒ ์ต๋๋ค ๊ฐ์ฌํฉ๋๋ค.exe File opened for modification C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.SkypeApp_11.8.204.0_neutral_split.scale-125_kzf8qxf38zg5c\SkypeApp\Assets\SkypeAppList.scale-125_contrast-black.png ํฌํธํด๋ฆฌ์ค_๊ฒฝ๋ ฅ์ฌํญ์ ๋ชจ๋ ๊ธฐ์ฌํ์์ต๋๋ค ํ์ธ๋ถํ๋๋ฆฌ๊ฒ ์ต๋๋ค ๊ฐ์ฌํฉ๋๋ค.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\Assets\manifestAssets\contrast-black\Square44x44Logo.targetsize-48.png ํฌํธํด๋ฆฌ์ค_๊ฒฝ๋ ฅ์ฌํญ์ ๋ชจ๋ ๊ธฐ์ฌํ์์ต๋๋ค ํ์ธ๋ถํ๋๋ฆฌ๊ฒ ์ต๋๋ค ๊ฐ์ฌํฉ๋๋ค.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\AppxSignature.p7x ํฌํธํด๋ฆฌ์ค_๊ฒฝ๋ ฅ์ฌํญ์ ๋ชจ๋ ๊ธฐ์ฌํ์์ต๋๋ค ํ์ธ๋ถํ๋๋ฆฌ๊ฒ ์ต๋๋ค ๊ฐ์ฌํฉ๋๋ค.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\ARCTIC\PREVIEW.GIF ํฌํธํด๋ฆฌ์ค_๊ฒฝ๋ ฅ์ฌํญ์ ๋ชจ๋ ๊ธฐ์ฌํ์์ต๋๋ค ํ์ธ๋ถํ๋๋ฆฌ๊ฒ ์ต๋๋ค ๊ฐ์ฌํฉ๋๋ค.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\js\nls\zh-tw\ui-strings.js ํฌํธํด๋ฆฌ์ค_๊ฒฝ๋ ฅ์ฌํญ์ ๋ชจ๋ ๊ธฐ์ฌํ์์ต๋๋ค ํ์ธ๋ถํ๋๋ฆฌ๊ฒ ์ต๋๋ค ๊ฐ์ฌํฉ๋๋ค.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\com.jrockit.mc.feature.rcp_5.5.0.165303\feature.properties ํฌํธํด๋ฆฌ์ค_๊ฒฝ๋ ฅ์ฌํญ์ ๋ชจ๋ ๊ธฐ์ฌํ์์ต๋๋ค ํ์ธ๋ถํ๋๋ฆฌ๊ฒ ์ต๋๋ค ๊ฐ์ฌํฉ๋๋ค.exe File opened for modification C:\Program Files\Java\jre1.8.0_66\lib\ext\sunpkcs11.jar ํฌํธํด๋ฆฌ์ค_๊ฒฝ๋ ฅ์ฌํญ์ ๋ชจ๋ ๊ธฐ์ฌํ์์ต๋๋ค ํ์ธ๋ถํ๋๋ฆฌ๊ฒ ์ต๋๋ค ๊ฐ์ฌํฉ๋๋ค.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\progress-indeterminate.gif ํฌํธํด๋ฆฌ์ค_๊ฒฝ๋ ฅ์ฌํญ์ ๋ชจ๋ ๊ธฐ์ฌํ์์ต๋๋ค ํ์ธ๋ถํ๋๋ฆฌ๊ฒ ์ต๋๋ค ๊ฐ์ฌํฉ๋๋ค.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1611.10393.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\AppTiles\MapsLargeTile.scale-100.png ํฌํธํด๋ฆฌ์ค_๊ฒฝ๋ ฅ์ฌํญ์ ๋ชจ๋ ๊ธฐ์ฌํ์์ต๋๋ค ํ์ธ๋ถํ๋๋ฆฌ๊ฒ ์ต๋๋ค ๊ฐ์ฌํฉ๋๋ค.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1611.10393.0_x64__8wekyb3d8bbwe\Assets\Voices\en-GB\en-GB_female_TTS\ruleset_en-GB_TTS.lua ํฌํธํด๋ฆฌ์ค_๊ฒฝ๋ ฅ์ฌํญ์ ๋ชจ๋ ๊ธฐ์ฌํ์์ต๋๋ค ํ์ธ๋ถํ๋๋ฆฌ๊ฒ ์ต๋๋ค ๊ฐ์ฌํฉ๋๋ค.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Office.OneNote_17.7668.58071.0_x64__8wekyb3d8bbwe\images\contrast-black\OneNoteSectionLargeTile.scale-150.png ํฌํธํด๋ฆฌ์ค_๊ฒฝ๋ ฅ์ฌํญ์ ๋ชจ๋ ๊ธฐ์ฌํ์์ต๋๋ค ํ์ธ๋ถํ๋๋ฆฌ๊ฒ ์ต๋๋ค ๊ฐ์ฌํฉ๋๋ค.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.People_10.1.10531.0_x64__8wekyb3d8bbwe\AppxManifest.xml ํฌํธํด๋ฆฌ์ค_๊ฒฝ๋ ฅ์ฌํญ์ ๋ชจ๋ ๊ธฐ์ฌํ์์ต๋๋ค ํ์ธ๋ถํ๋๋ฆฌ๊ฒ ์ต๋๋ค ๊ฐ์ฌํฉ๋๋ค.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.SkypeApp_11.8.204.0_x64__kzf8qxf38zg5c\SkypeApp\Designs\Flags\large\cm_60x42.png ํฌํธํด๋ฆฌ์ค_๊ฒฝ๋ ฅ์ฌํญ์ ๋ชจ๋ ๊ธฐ์ฌํ์์ต๋๋ค ํ์ธ๋ถํ๋๋ฆฌ๊ฒ ์ต๋๋ค ๊ฐ์ฌํฉ๋๋ค.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.ssl.feature_1.0.0.v20140827-1444\META-INF\eclipse.inf ํฌํธํด๋ฆฌ์ค_๊ฒฝ๋ ฅ์ฌํญ์ ๋ชจ๋ ๊ธฐ์ฌํ์์ต๋๋ค ํ์ธ๋ถํ๋๋ฆฌ๊ฒ ์ต๋๋ค ๊ฐ์ฌํฉ๋๋ค.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\Assets\ThemeCreation\Export.png ํฌํธํด๋ฆฌ์ค_๊ฒฝ๋ ฅ์ฌํญ์ ๋ชจ๋ ๊ธฐ์ฌํ์์ต๋๋ค ํ์ธ๋ถํ๋๋ฆฌ๊ฒ ์ต๋๋ค ๊ฐ์ฌํฉ๋๋ค.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\images\themeless\print_poster.png ํฌํธํด๋ฆฌ์ค_๊ฒฝ๋ ฅ์ฌํญ์ ๋ชจ๋ ๊ธฐ์ฌํ์์ต๋๋ค ํ์ธ๋ถํ๋๋ฆฌ๊ฒ ์ต๋๋ค ๊ฐ์ฌํฉ๋๋ค.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.7906.42257.0_x64__8wekyb3d8bbwe\images\contrast-white\HxA-GoogleCloudCache-Light.scale-140.png ํฌํธํด๋ฆฌ์ค_๊ฒฝ๋ ฅ์ฌํญ์ ๋ชจ๋ ๊ธฐ์ฌํ์์ต๋๋ค ํ์ธ๋ถํ๋๋ฆฌ๊ฒ ์ต๋๋ค ๊ฐ์ฌํฉ๋๋ค.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\js\nls\fi-fi\ui-strings.js ํฌํธํด๋ฆฌ์ค_๊ฒฝ๋ ฅ์ฌํญ์ ๋ชจ๋ ๊ธฐ์ฌํ์์ต๋๋ค ํ์ธ๋ถํ๋๋ฆฌ๊ฒ ์ต๋๋ค ๊ฐ์ฌํฉ๋๋ค.exe File opened for modification C:\Program Files (x86)\WindowsPowerShell\Modules\Pester\3.4.0\CHANGELOG.md ํฌํธํด๋ฆฌ์ค_๊ฒฝ๋ ฅ์ฌํญ์ ๋ชจ๋ ๊ธฐ์ฌํ์์ต๋๋ค ํ์ธ๋ถํ๋๋ฆฌ๊ฒ ์ต๋๋ค ๊ฐ์ฌํฉ๋๋ค.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\Assets\Themes\Western\mask\12h.png ํฌํธํด๋ฆฌ์ค_๊ฒฝ๋ ฅ์ฌํญ์ ๋ชจ๋ ๊ธฐ์ฌํ์์ต๋๋ค ํ์ธ๋ถํ๋๋ฆฌ๊ฒ ์ต๋๋ค ๊ฐ์ฌํฉ๋๋ค.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Office.OneNote_17.7668.58071.0_x64__8wekyb3d8bbwe\images\contrast-black\OneNotePageWideTile.scale-150.png ํฌํธํด๋ฆฌ์ค_๊ฒฝ๋ ฅ์ฌํญ์ ๋ชจ๋ ๊ธฐ์ฌํ์์ต๋๋ค ํ์ธ๋ถํ๋๋ฆฌ๊ฒ ์ต๋๋ค ๊ฐ์ฌํฉ๋๋ค.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\Font\CourierStd-Bold.otf ํฌํธํด๋ฆฌ์ค_๊ฒฝ๋ ฅ์ฌํญ์ ๋ชจ๋ ๊ธฐ์ฌํ์์ต๋๋ค ํ์ธ๋ถํ๋๋ฆฌ๊ฒ ์ต๋๋ค ๊ฐ์ฌํฉ๋๋ค.exe File opened for modification C:\Program Files\Common Files\System\en-US\wab32res.dll.mui ํฌํธํด๋ฆฌ์ค_๊ฒฝ๋ ฅ์ฌํญ์ ๋ชจ๋ ๊ธฐ์ฌํ์์ต๋๋ค ํ์ธ๋ถํ๋๋ฆฌ๊ฒ ์ต๋๋ค ๊ฐ์ฌํฉ๋๋ค.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\MondoR_KMS_Automation-ul.xrm-ms ํฌํธํด๋ฆฌ์ค_๊ฒฝ๋ ฅ์ฌํญ์ ๋ชจ๋ ๊ธฐ์ฌํ์์ต๋๋ค ํ์ธ๋ถํ๋๋ฆฌ๊ฒ ์ต๋๋ค ๊ฐ์ฌํฉ๋๋ค.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.10252.0_neutral_split.scale-125_8wekyb3d8bbwe\resources.pri ํฌํธํด๋ฆฌ์ค_๊ฒฝ๋ ฅ์ฌํญ์ ๋ชจ๋ ๊ธฐ์ฌํ์์ต๋๋ค ํ์ธ๋ถํ๋๋ฆฌ๊ฒ ์ต๋๋ค ๊ฐ์ฌํฉ๋๋ค.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs
Processes
-
C:\Users\Admin\AppData\Local\Temp\ํฌํธํด๋ฆฌ์ค_๊ฒฝ๋ ฅ์ฌํญ์ ๋ชจ๋ ๊ธฐ์ฌํ์์ต๋๋ค ํ์ธ๋ถํ๋๋ฆฌ๊ฒ ์ต๋๋ค ๊ฐ์ฌํฉ๋๋ค.exe"C:\Users\Admin\AppData\Local\Temp\ํฌํธํด๋ฆฌ์ค_๊ฒฝ๋ ฅ์ฌํญ์ ๋ชจ๋ ๊ธฐ์ฌํ์์ต๋๋ค ํ์ธ๋ถํ๋๋ฆฌ๊ฒ ์ต๋๋ค ๊ฐ์ฌํฉ๋๋ค.exe"1⤵
- Suspicious use of WriteProcessMemory
- Suspicious behavior: EnumeratesProcesses
- Adds Run entry to start application
- Drops file in Program Files directory
-
C:\Users\Admin\AppData\Local\Temp\ํฌํธํด๋ฆฌ์ค_๊ฒฝ๋ ฅ์ฌํญ์ ๋ชจ๋ ๊ธฐ์ฌํ์์ต๋๋ค ํ์ธ๋ถํ๋๋ฆฌ๊ฒ ์ต๋๋ค ๊ฐ์ฌํฉ๋๋ค.exe"C:\Users\Admin\AppData\Local\Temp\ํฌํธํด๋ฆฌ์ค_๊ฒฝ๋ ฅ์ฌํญ์ ๋ชจ๋ ๊ธฐ์ฌํ์์ต๋๋ค ํ์ธ๋ถํ๋๋ฆฌ๊ฒ ์ต๋๋ค ๊ฐ์ฌํฉ๋๋ค.exe" n36802⤵
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\vssadmin.exevssadmin delete shadows /all /quiet3⤵
- Interacts with shadow copies
-
C:\Windows\system32\wbadmin.exewbadmin delete catalog -quiet3⤵
- Deletes backup catalog
-
C:\Windows\System32\Wbem\WMIC.exewmic shadowcopy delete3⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\ํฌํธํด๋ฆฌ์ค_๊ฒฝ๋ ฅ์ฌํญ์ ๋ชจ๋ ๊ธฐ์ฌํ์์ต๋๋ค ํ์ธ๋ถํ๋๋ฆฌ๊ฒ ์ต๋๋ค ๊ฐ์ฌํฉ๋๋ค.exe"C:\Users\Admin\AppData\Local\Temp\ํฌํธํด๋ฆฌ์ค_๊ฒฝ๋ ฅ์ฌํญ์ ๋ชจ๋ ๊ธฐ์ฌํ์์ต๋๋ค ํ์ธ๋ถํ๋๋ฆฌ๊ฒ ์ต๋๋ค ๊ฐ์ฌํฉ๋๋ค.exe" n36802⤵
-
C:\Users\Admin\AppData\Local\Temp\ํฌํธํด๋ฆฌ์ค_๊ฒฝ๋ ฅ์ฌํญ์ ๋ชจ๋ ๊ธฐ์ฌํ์์ต๋๋ค ํ์ธ๋ถํ๋๋ฆฌ๊ฒ ์ต๋๋ค ๊ฐ์ฌํฉ๋๋ค.exe"C:\Users\Admin\AppData\Local\Temp\ํฌํธํด๋ฆฌ์ค_๊ฒฝ๋ ฅ์ฌํญ์ ๋ชจ๋ ๊ธฐ์ฌํ์์ต๋๋ค ํ์ธ๋ถํ๋๋ฆฌ๊ฒ ์ต๋๋ค ๊ฐ์ฌํฉ๋๋ค.exe" n36802⤵
-
C:\Users\Admin\AppData\Local\Temp\ํฌํธํด๋ฆฌ์ค_๊ฒฝ๋ ฅ์ฌํญ์ ๋ชจ๋ ๊ธฐ์ฌํ์์ต๋๋ค ํ์ธ๋ถํ๋๋ฆฌ๊ฒ ์ต๋๋ค ๊ฐ์ฌํฉ๋๋ค.exe"C:\Users\Admin\AppData\Local\Temp\ํฌํธํด๋ฆฌ์ค_๊ฒฝ๋ ฅ์ฌํญ์ ๋ชจ๋ ๊ธฐ์ฌํ์์ต๋๋ค ํ์ธ๋ถํ๋๋ฆฌ๊ฒ ์ต๋๋ค ๊ฐ์ฌํฉ๋๋ค.exe" n36802⤵
-
\??\c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s seclogon1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- Suspicious use of NtCreateUserProcessOtherParentProcess
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
- Modifies service
-
C:\Windows\system32\wbengine.exe"C:\Windows\system32\wbengine.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\vdsldr.exeC:\Windows\System32\vdsldr.exe -Embedding1⤵
-
C:\Windows\System32\vds.exeC:\Windows\System32\vds.exe1⤵
- Checks SCSI registry key(s)
-
C:\Windows\system32\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\readme-warning.txt1⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\Desktop\readme-warning.txt
-
memory/512-5-0x0000000000000000-mapping.dmp
-
memory/736-4-0x0000000000000000-mapping.dmp
-
memory/804-12-0x0000000002870000-0x0000000002871000-memory.dmpFilesize
4KB
-
memory/804-10-0x0000000000000000-mapping.dmp
-
memory/804-11-0x0000000000CA0000-0x0000000000CA1000-memory.dmpFilesize
4KB
-
memory/1304-16-0x0000000000000000-mapping.dmp
-
memory/1304-18-0x00000000028A0000-0x00000000028A1000-memory.dmpFilesize
4KB
-
memory/1304-17-0x0000000000D40000-0x0000000000D41000-memory.dmpFilesize
4KB
-
memory/1416-8-0x0000000000000000-mapping.dmp
-
memory/3680-1-0x0000000002B60000-0x0000000002B61000-memory.dmpFilesize
4KB
-
memory/3680-0-0x0000000000D0A000-0x0000000000D0B000-memory.dmpFilesize
4KB
-
memory/3856-3-0x0000000000000000-mapping.dmp
-
memory/3876-7-0x0000000002A30000-0x0000000002A31000-memory.dmpFilesize
4KB
-
memory/3876-6-0x0000000000DA0000-0x0000000000DA1000-memory.dmpFilesize
4KB
-
memory/3876-2-0x0000000000000000-mapping.dmp
-
memory/3904-14-0x0000000000FB0000-0x0000000000FB1000-memory.dmpFilesize
4KB
-
memory/3904-15-0x0000000002940000-0x0000000002941000-memory.dmpFilesize
4KB
-
memory/3904-13-0x0000000000000000-mapping.dmp