Analysis
-
max time kernel
147s -
max time network
130s -
platform
windows7_x64 -
resource
win7v200430 -
submitted
24-06-2020 05:01
Static task
static1
Behavioral task
behavioral1
Sample
μ΄λ ₯μ_κ²½λ ₯μ¬νμ λͺ¨λ κΈ°μ¬νμμ΅λλ€ νμΈλΆνλλ¦¬κ² μ΅λλ€ κ°μ¬ν©λλ€.exe
Resource
win7v200430
Behavioral task
behavioral2
Sample
μ΄λ ₯μ_κ²½λ ₯μ¬νμ λͺ¨λ κΈ°μ¬νμμ΅λλ€ νμΈλΆνλλ¦¬κ² μ΅λλ€ κ°μ¬ν©λλ€.exe
Resource
win10
General
-
Target
μ΄λ ₯μ_κ²½λ ₯μ¬νμ λͺ¨λ κΈ°μ¬νμμ΅λλ€ νμΈλΆνλλ¦¬κ² μ΅λλ€ κ°μ¬ν©λλ€.exe
-
Size
196KB
-
MD5
2b581dad6e832d91b1e03ad22ead74a3
-
SHA1
f9b81dba7907a7f95690a09eb4d71c74fd753f75
-
SHA256
ff91860e1c0ee0dda06ef8e326e2e284ee7ec0de97ee80348720c5ab637f8cf5
-
SHA512
2c9e568c6f104a406cad3fc68618d15f839833e01a791755223e7f6e55bc6dc656c56e74b1160c0923aaaef473e3aefcf782ee7d1ec7220a1cdb12d1c959afe5
Malware Config
Extracted
C:\readme-warning.txt
makop
akzhq615@protonmail.com
Signatures
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs
-
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Processes:
μ΄λ ₯μ_κ²½λ ₯μ¬νμ λͺ¨λ κΈ°μ¬νμμ΅λλ€ νμΈλΆνλλ¦¬κ² μ΅λλ€ κ°μ¬ν©λλ€.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DAC9024F54D8F6DF94935FB1732638CA6AD77C13 μ΄λ ₯μ_κ²½λ ₯μ¬νμ λͺ¨λ κΈ°μ¬νμμ΅λλ€ νμΈλΆνλλ¦¬κ² μ΅λλ€ κ°μ¬ν©λλ€.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DAC9024F54D8F6DF94935FB1732638CA6AD77C13\Blob = 0f00000001000000140000005bcaa1c2780f0bcb5a90770451d96f38963f012d0b000000010000001e000000440053005400200052006f006f0074002000430041002000580033000000090000000100000016000000301406082b0601050507030406082b06010505070301140000000100000014000000c4a7b1a47b2c71fadbe14b9075ffc415608589101d00000001000000100000004558d512eecb27464920897de7b66053030000000100000014000000dac9024f54d8f6df94935fb1732638ca6ad77c1320000000010000004e0300003082034a30820232a003020102021044afb080d6a327ba893039862ef8406b300d06092a864886f70d0101050500303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f74204341205833301e170d3030303933303231313231395a170d3231303933303134303131355a303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f7420434120583330820122300d06092a864886f70d01010105000382010f003082010a0282010100dfafe99750088357b4cc6265f69082ecc7d32c6b30ca5becd9c37dc740c118148be0e83376492ae33f214993ac4e0eaf3e48cb65eefcd3210f65d22ad9328f8ce5f777b0127bb595c089a3a9baed732e7a0c063283a27e8a1430cd11a0e12a38b9790a31fd50bd8065dfb7516383c8e28861ea4b6181ec526bb9a2e24b1a289f48a39e0cda098e3e172e1edd20df5bc62a8aab2ebd70adc50b1a25907472c57b6aab34d63089ffe568137b540bc8d6aeec5a9c921e3d64b38cc6dfbfc94170ec1672d526ec38553943d0fcfd185c40f197ebd59a9b8d1dbada25b9c6d8dfc115023aabda6ef13e2ef55c089c3cd68369e4109b192ab62957e3e53d9b9ff0025d0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106301d0603551d0e04160414c4a7b1a47b2c71fadbe14b9075ffc41560858910300d06092a864886f70d01010505000382010100a31a2c9b17005ca91eee2866373abf83c73f4bc309a095205de3d95944d23e0d3ebd8a4ba0741fce10829c741a1d7e981addcb134bb32044e491e9ccfc7da5db6ae5fee6fde04eddb7003ab57049aff2e5eb02f1d1028b19cb943a5e48c4181e58195f1e025af00cf1b1ada9dc59868b6ee991f586cafab96633aa595bcee2a7167347cb2bcc99b03748cfe3564bf5cf0f0c723287c6f044bb53726d43f526489a5267b758abfe67767178db0da256141339243185a2a8025a3047e1dd5007bc02099000eb6463609b16bc88c912e6d27d918bf93d328d65b4e97cb15776eac5b62839bf15651cc8f677966a0a8d770bd8910b048e07db29b60aee9d82353510 μ΄λ ₯μ_κ²½λ ₯μ¬νμ λͺ¨λ κΈ°μ¬νμμ΅λλ€ νμΈλΆνλλ¦¬κ² μ΅λλ€ κ°μ¬ν©λλ€.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DAC9024F54D8F6DF94935FB1732638CA6AD77C13\Blob = 1900000001000000100000006cf252fec3e8f20996de5d4dd9aef424030000000100000014000000dac9024f54d8f6df94935fb1732638ca6ad77c131d00000001000000100000004558d512eecb27464920897de7b66053140000000100000014000000c4a7b1a47b2c71fadbe14b9075ffc41560858910090000000100000016000000301406082b0601050507030406082b060105050703010b000000010000001e000000440053005400200052006f006f00740020004300410020005800330000000f00000001000000140000005bcaa1c2780f0bcb5a90770451d96f38963f012d20000000010000004e0300003082034a30820232a003020102021044afb080d6a327ba893039862ef8406b300d06092a864886f70d0101050500303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f74204341205833301e170d3030303933303231313231395a170d3231303933303134303131355a303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f7420434120583330820122300d06092a864886f70d01010105000382010f003082010a0282010100dfafe99750088357b4cc6265f69082ecc7d32c6b30ca5becd9c37dc740c118148be0e83376492ae33f214993ac4e0eaf3e48cb65eefcd3210f65d22ad9328f8ce5f777b0127bb595c089a3a9baed732e7a0c063283a27e8a1430cd11a0e12a38b9790a31fd50bd8065dfb7516383c8e28861ea4b6181ec526bb9a2e24b1a289f48a39e0cda098e3e172e1edd20df5bc62a8aab2ebd70adc50b1a25907472c57b6aab34d63089ffe568137b540bc8d6aeec5a9c921e3d64b38cc6dfbfc94170ec1672d526ec38553943d0fcfd185c40f197ebd59a9b8d1dbada25b9c6d8dfc115023aabda6ef13e2ef55c089c3cd68369e4109b192ab62957e3e53d9b9ff0025d0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106301d0603551d0e04160414c4a7b1a47b2c71fadbe14b9075ffc41560858910300d06092a864886f70d01010505000382010100a31a2c9b17005ca91eee2866373abf83c73f4bc309a095205de3d95944d23e0d3ebd8a4ba0741fce10829c741a1d7e981addcb134bb32044e491e9ccfc7da5db6ae5fee6fde04eddb7003ab57049aff2e5eb02f1d1028b19cb943a5e48c4181e58195f1e025af00cf1b1ada9dc59868b6ee991f586cafab96633aa595bcee2a7167347cb2bcc99b03748cfe3564bf5cf0f0c723287c6f044bb53726d43f526489a5267b758abfe67767178db0da256141339243185a2a8025a3047e1dd5007bc02099000eb6463609b16bc88c912e6d27d918bf93d328d65b4e97cb15776eac5b62839bf15651cc8f677966a0a8d770bd8910b048e07db29b60aee9d82353510 μ΄λ ₯μ_κ²½λ ₯μ¬νμ λͺ¨λ κΈ°μ¬νμμ΅λλ€ νμΈλΆνλλ¦¬κ² μ΅λλ€ κ°μ¬ν©λλ€.exe -
Makop
Ransomware family discovered by @VK_Intel in early 2020.
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
μ΄λ ₯μ_κ²½λ ₯μ¬νμ λͺ¨λ κΈ°μ¬νμμ΅λλ€ νμΈλΆνλλ¦¬κ² μ΅λλ€ κ°μ¬ν©λλ€.exepid process 1252 μ΄λ ₯μ_κ²½λ ₯μ¬νμ λͺ¨λ κΈ°μ¬νμμ΅λλ€ νμΈλΆνλλ¦¬κ² μ΅λλ€ κ°μ¬ν©λλ€.exe -
Deletes system backup catalog 2 TTPs
Ransomware often tries to delete backup files to inhibit system recovery.
-
Interacts with shadow copies 2 TTPs 1 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
Processes:
vssadmin.exepid process 384 vssadmin.exe -
Modifies service 2 TTPs 5 IoCs
Processes:
vssvc.exedescription ioc process Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\Registry Writer vssvc.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\SwProvider_{b5946137-7b9f-4925-af80-51abd60b20d5} vssvc.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\COM+ REGDB Writer vssvc.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\ASR Writer vssvc.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\Shadow Copy Optimization Writer vssvc.exe -
Suspicious use of WriteProcessMemory 13 IoCs
Processes:
μ΄λ ₯μ_κ²½λ ₯μ¬νμ λͺ¨λ κΈ°μ¬νμμ΅λλ€ νμΈλΆνλλ¦¬κ² μ΅λλ€ κ°μ¬ν©λλ€.execmd.exedescription pid process target process PID 1252 wrote to memory of 1444 1252 μ΄λ ₯μ_κ²½λ ₯μ¬νμ λͺ¨λ κΈ°μ¬νμμ΅λλ€ νμΈλΆνλλ¦¬κ² μ΅λλ€ κ°μ¬ν©λλ€.exe cmd.exe PID 1252 wrote to memory of 1444 1252 μ΄λ ₯μ_κ²½λ ₯μ¬νμ λͺ¨λ κΈ°μ¬νμμ΅λλ€ νμΈλΆνλλ¦¬κ² μ΅λλ€ κ°μ¬ν©λλ€.exe cmd.exe PID 1252 wrote to memory of 1444 1252 μ΄λ ₯μ_κ²½λ ₯μ¬νμ λͺ¨λ κΈ°μ¬νμμ΅λλ€ νμΈλΆνλλ¦¬κ² μ΅λλ€ κ°μ¬ν©λλ€.exe cmd.exe PID 1252 wrote to memory of 1444 1252 μ΄λ ₯μ_κ²½λ ₯μ¬νμ λͺ¨λ κΈ°μ¬νμμ΅λλ€ νμΈλΆνλλ¦¬κ² μ΅λλ€ κ°μ¬ν©λλ€.exe cmd.exe PID 1444 wrote to memory of 384 1444 cmd.exe vssadmin.exe PID 1444 wrote to memory of 384 1444 cmd.exe vssadmin.exe PID 1444 wrote to memory of 384 1444 cmd.exe vssadmin.exe PID 1444 wrote to memory of 1796 1444 cmd.exe wbadmin.exe PID 1444 wrote to memory of 1796 1444 cmd.exe wbadmin.exe PID 1444 wrote to memory of 1796 1444 cmd.exe wbadmin.exe PID 1444 wrote to memory of 820 1444 cmd.exe WMIC.exe PID 1444 wrote to memory of 820 1444 cmd.exe WMIC.exe PID 1444 wrote to memory of 820 1444 cmd.exe WMIC.exe -
Suspicious use of AdjustPrivilegeToken 46 IoCs
Processes:
vssvc.exewbengine.exeWMIC.exedescription pid process Token: SeBackupPrivilege 1592 vssvc.exe Token: SeRestorePrivilege 1592 vssvc.exe Token: SeAuditPrivilege 1592 vssvc.exe Token: SeBackupPrivilege 1752 wbengine.exe Token: SeRestorePrivilege 1752 wbengine.exe Token: SeSecurityPrivilege 1752 wbengine.exe Token: SeIncreaseQuotaPrivilege 820 WMIC.exe Token: SeSecurityPrivilege 820 WMIC.exe Token: SeTakeOwnershipPrivilege 820 WMIC.exe Token: SeLoadDriverPrivilege 820 WMIC.exe Token: SeSystemProfilePrivilege 820 WMIC.exe Token: SeSystemtimePrivilege 820 WMIC.exe Token: SeProfSingleProcessPrivilege 820 WMIC.exe Token: SeIncBasePriorityPrivilege 820 WMIC.exe Token: SeCreatePagefilePrivilege 820 WMIC.exe Token: SeBackupPrivilege 820 WMIC.exe Token: SeRestorePrivilege 820 WMIC.exe Token: SeShutdownPrivilege 820 WMIC.exe Token: SeDebugPrivilege 820 WMIC.exe Token: SeSystemEnvironmentPrivilege 820 WMIC.exe Token: SeRemoteShutdownPrivilege 820 WMIC.exe Token: SeUndockPrivilege 820 WMIC.exe Token: SeManageVolumePrivilege 820 WMIC.exe Token: 33 820 WMIC.exe Token: 34 820 WMIC.exe Token: 35 820 WMIC.exe Token: SeIncreaseQuotaPrivilege 820 WMIC.exe Token: SeSecurityPrivilege 820 WMIC.exe Token: SeTakeOwnershipPrivilege 820 WMIC.exe Token: SeLoadDriverPrivilege 820 WMIC.exe Token: SeSystemProfilePrivilege 820 WMIC.exe Token: SeSystemtimePrivilege 820 WMIC.exe Token: SeProfSingleProcessPrivilege 820 WMIC.exe Token: SeIncBasePriorityPrivilege 820 WMIC.exe Token: SeCreatePagefilePrivilege 820 WMIC.exe Token: SeBackupPrivilege 820 WMIC.exe Token: SeRestorePrivilege 820 WMIC.exe Token: SeShutdownPrivilege 820 WMIC.exe Token: SeDebugPrivilege 820 WMIC.exe Token: SeSystemEnvironmentPrivilege 820 WMIC.exe Token: SeRemoteShutdownPrivilege 820 WMIC.exe Token: SeUndockPrivilege 820 WMIC.exe Token: SeManageVolumePrivilege 820 WMIC.exe Token: 33 820 WMIC.exe Token: 34 820 WMIC.exe Token: 35 820 WMIC.exe -
Processes:
wbadmin.exepid process 1796 wbadmin.exe -
Adds Run entry to start application 2 TTPs 1 IoCs
Processes:
μ΄λ ₯μ_κ²½λ ₯μ¬νμ λͺ¨λ κΈ°μ¬νμμ΅λλ€ νμΈλΆνλλ¦¬κ² μ΅λλ€ κ°μ¬ν©λλ€.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000\Software\Microsoft\Windows\CurrentVersion\Run\1 = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\μ΄λ ₯μ_κ²½λ ₯μ¬νμ λͺ¨λ κΈ°μ¬νμμ΅λλ€ νμΈλΆνλλ¦¬κ² μ΅λλ€ κ°μ¬ν©λλ€.exe\"" μ΄λ ₯μ_κ²½λ ₯μ¬νμ λͺ¨λ κΈ°μ¬νμμ΅λλ€ νμΈλΆνλλ¦¬κ² μ΅λλ€ κ°μ¬ν©λλ€.exe -
Drops file in Program Files directory 9162 IoCs
Processes:
μ΄λ ₯μ_κ²½λ ₯μ¬νμ λͺ¨λ κΈ°μ¬νμμ΅λλ€ νμΈλΆνλλ¦¬κ² μ΅λλ€ κ°μ¬ν©λλ€.exedescription ioc process File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\STUBBY1.WMF μ΄λ ₯μ_κ²½λ ₯μ¬νμ λͺ¨λ κΈ°μ¬νμμ΅λλ€ νμΈλΆνλλ¦¬κ² μ΅λλ€ κ°μ¬ν©λλ€.exe File opened for modification C:\Program Files\Microsoft Office\Office14\1033\SETLANG.HXS μ΄λ ₯μ_κ²½λ ₯μ¬νμ λͺ¨λ κΈ°μ¬νμμ΅λλ€ νμΈλΆνλλ¦¬κ² μ΅λλ€ κ°μ¬ν©λλ€.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\reviews_joined.gif.[DFAE7271].[akzhq615@protonmail.com].makop μ΄λ ₯μ_κ²½λ ₯μ¬νμ λͺ¨λ κΈ°μ¬νμμ΅λλ€ νμΈλΆνλλ¦¬κ² μ΅λλ€ κ°μ¬ν©λλ€.exe File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\images\undocked_black_foggy.png μ΄λ ₯μ_κ²½λ ₯μ¬νμ λͺ¨λ κΈ°μ¬νμμ΅λλ€ νμΈλΆνλλ¦¬κ² μ΅λλ€ κ°μ¬ν©λλ€.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Antarctica\Casey μ΄λ ₯μ_κ²½λ ₯μ¬νμ λͺ¨λ κΈ°μ¬νμμ΅λλ€ νμΈλΆνλλ¦¬κ² μ΅λλ€ κ°μ¬ν©λλ€.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0105526.WMF μ΄λ ₯μ_κ²½λ ₯μ¬νμ λͺ¨λ κΈ°μ¬νμμ΅λλ€ νμΈλΆνλλ¦¬κ² μ΅λλ€ κ°μ¬ν©λλ€.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0386270.JPG μ΄λ ₯μ_κ²½λ ₯μ¬νμ λͺ¨λ κΈ°μ¬νμμ΅λλ€ νμΈλΆνλλ¦¬κ² μ΅λλ€ κ°μ¬ν©λλ€.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\nav_uparrow.png μ΄λ ₯μ_κ²½λ ₯μ¬νμ λͺ¨λ κΈ°μ¬νμμ΅λλ€ νμΈλΆνλλ¦¬κ² μ΅λλ€ κ°μ¬ν©λλ€.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Pets_btn-previous-static.png μ΄λ ₯μ_κ²½λ ₯μ¬νμ λͺ¨λ κΈ°μ¬νμμ΅λλ€ νμΈλΆνλλ¦¬κ² μ΅λλ€ κ°μ¬ν©λλ€.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-netbeans-modules-favorites.jar μ΄λ ₯μ_κ²½λ ₯μ¬νμ λͺ¨λ κΈ°μ¬νμμ΅λλ€ νμΈλΆνλλ¦¬κ² μ΅λλ€ κ°μ¬ν©λλ€.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0199483.WMF μ΄λ ₯μ_κ²½λ ₯μ¬νμ λͺ¨λ κΈ°μ¬νμμ΅λλ€ νμΈλΆνλλ¦¬κ² μ΅λλ€ κ°μ¬ν©λλ€.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\mobile.html μ΄λ ₯μ_κ²½λ ₯μ¬νμ λͺ¨λ κΈ°μ¬νμμ΅λλ€ νμΈλΆνλλ¦¬κ² μ΅λλ€ κ°μ¬ν©λλ€.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\review_browser.gif μ΄λ ₯μ_κ²½λ ₯μ¬νμ λͺ¨λ κΈ°μ¬νμμ΅λλ€ νμΈλΆνλλ¦¬κ² μ΅λλ€ κ°μ¬ν©λλ€.exe File opened for modification C:\Program Files\7-Zip\Lang\fy.txt μ΄λ ₯μ_κ²½λ ₯μ¬νμ λͺ¨λ κΈ°μ¬νμμ΅λλ€ νμΈλΆνλλ¦¬κ² μ΅λλ€ κ°μ¬ν©λλ€.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\lib\jfluid-server-15.jar μ΄λ ₯μ_κ²½λ ₯μ¬νμ λͺ¨λ κΈ°μ¬νμμ΅λλ€ νμΈλΆνλλ¦¬κ² μ΅λλ€ κ°μ¬ν©λλ€.exe File opened for modification C:\Program Files\Microsoft Office\Document Themes 14\Theme Effects\Solstice.eftx μ΄λ ₯μ_κ²½λ ₯μ¬νμ λͺ¨λ κΈ°μ¬νμμ΅λλ€ νμΈλΆνλλ¦¬κ² μ΅λλ€ κ°μ¬ν©λλ€.exe File opened for modification C:\Program Files\Microsoft Office\Office14\1033\WINWORD_COL.HXC μ΄λ ₯μ_κ²½λ ₯μ¬νμ λͺ¨λ κΈ°μ¬νμμ΅λλ€ νμΈλΆνλλ¦¬κ² μ΅λλ€ κ°μ¬ν©λλ€.exe File opened for modification C:\Program Files\Microsoft Office\Office14\PAGESIZE\PGMN108.XML μ΄λ ₯μ_κ²½λ ₯μ¬νμ λͺ¨λ κΈ°μ¬νμμ΅λλ€ νμΈλΆνλλ¦¬κ² μ΅λλ€ κ°μ¬ν©λλ€.exe File opened for modification C:\Program Files\Microsoft Office\Office14\PUBWIZ\LTHDHM.POC μ΄λ ₯μ_κ²½λ ₯μ¬νμ λͺ¨λ κΈ°μ¬νμμ΅λλ€ νμΈλΆνλλ¦¬κ² μ΅λλ€ κ°μ¬ν©λλ€.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.workbench_3.106.1.v20140827-1737.jar μ΄λ ₯μ_κ²½λ ₯μ¬νμ λͺ¨λ κΈ°μ¬νμμ΅λλ€ νμΈλΆνλλ¦¬κ² μ΅λλ€ κ°μ¬ν©λλ€.exe File opened for modification C:\Program Files\Windows Media Player\Media Renderer\DMR_120.jpg μ΄λ ₯μ_κ²½λ ₯μ¬νμ λͺ¨λ κΈ°μ¬νμμ΅λλ€ νμΈλΆνλλ¦¬κ² μ΅λλ€ κ°μ¬ν©λλ€.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\undocked_black_moon-first-quarter_partly-cloudy.png μ΄λ ₯μ_κ²½λ ₯μ¬νμ λͺ¨λ κΈ°μ¬νμμ΅λλ€ νμΈλΆνλλ¦¬κ² μ΅λλ€ κ°μ¬ν©λλ€.exe File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\images\info.png μ΄λ ₯μ_κ²½λ ₯μ¬νμ λͺ¨λ κΈ°μ¬νμμ΅λλ€ νμΈλΆνλλ¦¬κ² μ΅λλ€ κ°μ¬ν©λλ€.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\PH02748G.GIF μ΄λ ₯μ_κ²½λ ₯μ¬νμ λͺ¨λ κΈ°μ¬νμμ΅λλ€ νμΈλΆνλλ¦¬κ² μ΅λλ€ κ°μ¬ν©λλ€.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\jfr\profile.jfc μ΄λ ₯μ_κ²½λ ₯μ¬νμ λͺ¨λ κΈ°μ¬νμμ΅λλ€ νμΈλΆνλλ¦¬κ² μ΅λλ€ κ°μ¬ν©λλ€.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\SystemV\YST9 μ΄λ ₯μ_κ²½λ ₯μ¬νμ λͺ¨λ κΈ°μ¬νμμ΅λλ€ νμΈλΆνλλ¦¬κ² μ΅λλ€ κ°μ¬ν©λλ€.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.jetty.security_8.1.14.v20131031.jar μ΄λ ₯μ_κ²½λ ₯μ¬νμ λͺ¨λ κΈ°μ¬νμμ΅λλ€ νμΈλΆνλλ¦¬κ² μ΅λλ€ κ°μ¬ν©λλ€.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\org-netbeans-modules-profiler-selector-api.jar μ΄λ ₯μ_κ²½λ ₯μ¬νμ λͺ¨λ κΈ°μ¬νμμ΅λλ€ νμΈλΆνλλ¦¬κ² μ΅λλ€ κ°μ¬ν©λλ€.exe File opened for modification C:\Program Files\Java\jre7\lib\jfxrt.jar μ΄λ ₯μ_κ²½λ ₯μ¬νμ λͺ¨λ κΈ°μ¬νμμ΅λλ€ νμΈλΆνλλ¦¬κ² μ΅λλ€ κ°μ¬ν©λλ€.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN04174_.WMF μ΄λ ₯μ_κ²½λ ₯μ¬νμ λͺ¨λ κΈ°μ¬νμμ΅λλ€ νμΈλΆνλλ¦¬κ² μ΅λλ€ κ°μ¬ν©λλ€.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\PH02743G.GIF μ΄λ ₯μ_κ²½λ ₯μ¬νμ λͺ¨λ κΈ°μ¬νμμ΅λλ€ νμΈλΆνλλ¦¬κ² μ΅λλ€ κ°μ¬ν©λλ€.exe File opened for modification C:\Program Files\7-Zip\Lang\et.txt μ΄λ ₯μ_κ²½λ ₯μ¬νμ λͺ¨λ κΈ°μ¬νμμ΅λλ€ νμΈλΆνλλ¦¬κ² μ΅λλ€ κ°μ¬ν©λλ€.exe File opened for modification C:\Program Files\Microsoft Office\Office14\FORMS\1033\SMSS.ICO μ΄λ ₯μ_κ²½λ ₯μ¬νμ λͺ¨λ κΈ°μ¬νμμ΅λλ€ νμΈλΆνλλ¦¬κ² μ΅λλ€ κ°μ¬ν©λλ€.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\CommonData\CommsOutgoingImageMaskSmall.bmp μ΄λ ₯μ_κ²½λ ₯μ¬νμ λͺ¨λ κΈ°μ¬νμμ΅λλ€ νμΈλΆνλλ¦¬κ² μ΅λλ€ κ°μ¬ν©λλ€.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\FormsViewAttachmentIconsMask.bmp μ΄λ ₯μ_κ²½λ ₯μ¬νμ λͺ¨λ κΈ°μ¬νμμ΅λλ€ νμΈλΆνλλ¦¬κ² μ΅λλ€ κ°μ¬ν©λλ€.exe File opened for modification C:\Program Files\Microsoft Office\Templates\1033\ContemporaryPhotoAlbum.potx μ΄λ ₯μ_κ²½λ ₯μ¬νμ λͺ¨λ κΈ°μ¬νμμ΅λλ€ νμΈλΆνλλ¦¬κ² μ΅λλ€ κ°μ¬ν©λλ€.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\playlist\vocaroo.luac μ΄λ ₯μ_κ²½λ ₯μ¬νμ λͺ¨λ κΈ°μ¬νμμ΅λλ€ νμΈλΆνλλ¦¬κ² μ΅λλ€ κ°μ¬ν©λλ€.exe File opened for modification C:\Program Files\VideoLAN\VLC\skins\winamp2.xml μ΄λ ₯μ_κ²½λ ₯μ¬νμ λͺ¨λ κΈ°μ¬νμμ΅λλ€ νμΈλΆνλλ¦¬κ² μ΅λλ€ κ°μ¬ν©λλ€.exe File opened for modification C:\Program Files\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD15169_.GIF μ΄λ ₯μ_κ²½λ ₯μ¬νμ λͺ¨λ κΈ°μ¬νμμ΅λλ€ νμΈλΆνλλ¦¬κ² μ΅λλ€ κ°μ¬ν©λλ€.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\locale\org-netbeans-modules-profiler-selector-api_zh_CN.jar μ΄λ ₯μ_κ²½λ ₯μ¬νμ λͺ¨λ κΈ°μ¬νμμ΅λλ€ νμΈλΆνλλ¦¬κ² μ΅λλ€ κ°μ¬ν©λλ€.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0199429.WMF μ΄λ ₯μ_κ²½λ ₯μ¬νμ λͺ¨λ κΈ°μ¬νμμ΅λλ€ νμΈλΆνλλ¦¬κ² μ΅λλ€ κ°μ¬ν©λλ€.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\PE03453_.WMF μ΄λ ₯μ_κ²½λ ₯μ¬νμ λͺ¨λ κΈ°μ¬νμμ΅λλ€ νμΈλΆνλλ¦¬κ² μ΅λλ€ κ°μ¬ν©λλ€.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\SO02252_.WMF μ΄λ ₯μ_κ²½λ ₯μ¬νμ λͺ¨λ κΈ°μ¬νμμ΅λλ€ νμΈλΆνλλ¦¬κ² μ΅λλ€ κ°μ¬ν©λλ€.exe File opened for modification C:\Program Files\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD21297_.GIF μ΄λ ₯μ_κ²½λ ₯μ¬νμ λͺ¨λ κΈ°μ¬νμμ΅λλ€ νμΈλΆνλλ¦¬κ² μ΅λλ€ κ°μ¬ν©λλ€.exe File opened for modification C:\Program Files\Microsoft Office\Office14\MEDIA\PUSH.WAV μ΄λ ₯μ_κ²½λ ₯μ¬νμ λͺ¨λ κΈ°μ¬νμμ΅λλ€ νμΈλΆνλλ¦¬κ² μ΅λλ€ κ°μ¬ν©λλ€.exe File opened for modification C:\Program Files\Microsoft Office\Office14\PUBWIZ\DGWEBCAL.DPV μ΄λ ₯μ_κ²½λ ₯μ¬νμ λͺ¨λ κΈ°μ¬νμμ΅λλ€ νμΈλΆνλλ¦¬κ² μ΅λλ€ κ°μ¬ν©λλ€.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\THEMES14\DEEPBLUE\PREVIEW.GIF μ΄λ ₯μ_κ²½λ ₯μ¬νμ λͺ¨λ κΈ°μ¬νμμ΅λλ€ νμΈλΆνλλ¦¬κ² μ΅λλ€ κ°μ¬ν©λλ€.exe File opened for modification C:\Program Files (x86)\Common Files\System\msadc\en-US\msdaprsr.dll.mui μ΄λ ₯μ_κ²½λ ₯μ¬νμ λͺ¨λ κΈ°μ¬νμμ΅λλ€ νμΈλΆνλλ¦¬κ² μ΅λλ€ κ°μ¬ν©λλ€.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-core-windows.xml μ΄λ ₯μ_κ²½λ ₯μ¬νμ λͺ¨λ κΈ°μ¬νμμ΅λλ€ νμΈλΆνλλ¦¬κ² μ΅λλ€ κ°μ¬ν©λλ€.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0309705.JPG μ΄λ ₯μ_κ²½λ ₯μ¬νμ λͺ¨λ κΈ°μ¬νμμ΅λλ€ νμΈλΆνλλ¦¬κ² μ΅λλ€ κ°μ¬ν©λλ€.exe File opened for modification C:\Program Files\UninstallUnblock.wmv μ΄λ ₯μ_κ²½λ ₯μ¬νμ λͺ¨λ κΈ°μ¬νμμ΅λλ€ νμΈλΆνλλ¦¬κ² μ΅λλ€ κ°μ¬ν©λλ€.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Etc\GMT-13 μ΄λ ₯μ_κ²½λ ₯μ¬νμ λͺ¨λ κΈ°μ¬νμμ΅λλ€ νμΈλΆνλλ¦¬κ² μ΅λλ€ κ°μ¬ν©λλ€.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\Budapest μ΄λ ₯μ_κ²½λ ₯μ¬νμ λͺ¨λ κΈ°μ¬νμμ΅λλ€ νμΈλΆνλλ¦¬κ² μ΅λλ€ κ°μ¬ν©λλ€.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-lib-uihandler.xml μ΄λ ₯μ_κ²½λ ₯μ¬νμ λͺ¨λ κΈ°μ¬νμμ΅λλ€ νμΈλΆνλλ¦¬κ² μ΅λλ€ κ°μ¬ν©λλ€.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0153313.WMF μ΄λ ₯μ_κ²½λ ₯μ¬νμ λͺ¨λ κΈ°μ¬νμμ΅λλ€ νμΈλΆνλλ¦¬κ² μ΅λλ€ κ°μ¬ν©λλ€.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\NA01361_.WMF μ΄λ ₯μ_κ²½λ ₯μ¬νμ λͺ¨λ κΈ°μ¬νμμ΅λλ€ νμΈλΆνλλ¦¬κ² μ΅λλ€ κ°μ¬ν©λλ€.exe File opened for modification C:\Program Files\Microsoft Office\Office14\1033\OUTLOOK_COL.HXC μ΄λ ₯μ_κ²½λ ₯μ¬νμ λͺ¨λ κΈ°μ¬νμμ΅λλ€ νμΈλΆνλλ¦¬κ² μ΅λλ€ κ°μ¬ν©λλ€.exe File opened for modification C:\Program Files\Microsoft Office\Office14\1033\PUBSPAPR\PDIR21F.GIF μ΄λ ₯μ_κ²½λ ₯μ¬νμ λͺ¨λ κΈ°μ¬νμμ΅λλ€ νμΈλΆνλλ¦¬κ² μ΅λλ€ κ°μ¬ν©λλ€.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\button_right_over.gif μ΄λ ₯μ_κ²½λ ₯μ¬νμ λͺ¨λ κΈ°μ¬νμμ΅λλ€ νμΈλΆνλλ¦¬κ² μ΅λλ€ κ°μ¬ν©λλ€.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Office32.en-us\SETUP.XML μ΄λ ₯μ_κ²½λ ₯μ¬νμ λͺ¨λ κΈ°μ¬νμμ΅λλ€ νμΈλΆνλλ¦¬κ² μ΅λλ€ κ°μ¬ν©λλ€.exe File opened for modification C:\Program Files\Microsoft Office\Templates\1033\Access\Assets.accdt μ΄λ ₯μ_κ²½λ ₯μ¬νμ λͺ¨λ κΈ°μ¬νμμ΅λλ€ νμΈλΆνλλ¦¬κ² μ΅λλ€ κ°μ¬ν©λλ€.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0153302.WMF μ΄λ ₯μ_κ²½λ ₯μ¬νμ λͺ¨λ κΈ°μ¬νμμ΅λλ€ νμΈλΆνλλ¦¬κ² μ΅λλ€ κ°μ¬ν©λλ€.exe File opened for modification C:\Program Files\Microsoft Office\Document Themes 14\Theme Effects\Trek.eftx μ΄λ ₯μ_κ²½λ ₯μ¬νμ λͺ¨λ κΈ°μ¬νμμ΅λλ€ νμΈλΆνλλ¦¬κ² μ΅λλ€ κ°μ¬ν©λλ€.exe File opened for modification C:\Program Files\Microsoft Office\Office14\1033\PUBSPAPR\PDIR14F.GIF μ΄λ ₯μ_κ²½λ ₯μ¬νμ λͺ¨λ κΈ°μ¬νμμ΅λλ€ νμΈλΆνλλ¦¬κ² μ΅λλ€ κ°μ¬ν©λλ€.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\μ΄λ ₯μ_κ²½λ ₯μ¬νμ λͺ¨λ κΈ°μ¬νμμ΅λλ€ νμΈλΆνλλ¦¬κ² μ΅λλ€ κ°μ¬ν©λλ€.exe"C:\Users\Admin\AppData\Local\Temp\μ΄λ ₯μ_κ²½λ ₯μ¬νμ λͺ¨λ κΈ°μ¬νμμ΅λλ€ νμΈλΆνλλ¦¬κ² μ΅λλ€ κ°μ¬ν©λλ€.exe"1⤵
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
- Adds Run entry to start application
- Drops file in Program Files directory
-
C:\Users\Admin\AppData\Local\Temp\μ΄λ ₯μ_κ²½λ ₯μ¬νμ λͺ¨λ κΈ°μ¬νμμ΅λλ€ νμΈλΆνλλ¦¬κ² μ΅λλ€ κ°μ¬ν©λλ€.exe"C:\Users\Admin\AppData\Local\Temp\μ΄λ ₯μ_κ²½λ ₯μ¬νμ λͺ¨λ κΈ°μ¬νμμ΅λλ€ νμΈλΆνλλ¦¬κ² μ΅λλ€ κ°μ¬ν©λλ€.exe" n12522⤵
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\vssadmin.exevssadmin delete shadows /all /quiet3⤵
- Interacts with shadow copies
-
C:\Windows\system32\wbadmin.exewbadmin delete catalog -quiet3⤵
- Deletes backup catalog
-
C:\Windows\System32\Wbem\WMIC.exewmic shadowcopy delete3⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\μ΄λ ₯μ_κ²½λ ₯μ¬νμ λͺ¨λ κΈ°μ¬νμμ΅λλ€ νμΈλΆνλλ¦¬κ² μ΅λλ€ κ°μ¬ν©λλ€.exe"C:\Users\Admin\AppData\Local\Temp\μ΄λ ₯μ_κ²½λ ₯μ¬νμ λͺ¨λ κΈ°μ¬νμμ΅λλ€ νμΈλΆνλλ¦¬κ² μ΅λλ€ κ°μ¬ν©λλ€.exe" n12522⤵
-
C:\Users\Admin\AppData\Local\Temp\μ΄λ ₯μ_κ²½λ ₯μ¬νμ λͺ¨λ κΈ°μ¬νμμ΅λλ€ νμΈλΆνλλ¦¬κ² μ΅λλ€ κ°μ¬ν©λλ€.exe"C:\Users\Admin\AppData\Local\Temp\μ΄λ ₯μ_κ²½λ ₯μ¬νμ λͺ¨λ κΈ°μ¬νμμ΅λλ€ νμΈλΆνλλ¦¬κ² μ΅λλ€ κ°μ¬ν©λλ€.exe" n12522⤵
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Modifies service
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\wbengine.exe"C:\Windows\system32\wbengine.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\vdsldr.exeC:\Windows\System32\vdsldr.exe -Embedding1⤵
-
C:\Windows\System32\vds.exeC:\Windows\System32\vds.exe1⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/384-3-0x0000000000000000-mapping.dmp
-
memory/432-8-0x0000000000D3F000-0x0000000000D40000-memory.dmpFilesize
4KB
-
memory/432-9-0x00000000025A0000-0x00000000025B1000-memory.dmpFilesize
68KB
-
memory/820-7-0x0000000000000000-mapping.dmp
-
memory/1252-0-0x0000000000D7F000-0x0000000000D80000-memory.dmpFilesize
4KB
-
memory/1252-1-0x00000000025F0000-0x0000000002601000-memory.dmpFilesize
68KB
-
memory/1400-4-0x0000000000DEF000-0x0000000000DF0000-memory.dmpFilesize
4KB
-
memory/1400-5-0x00000000025F0000-0x0000000002601000-memory.dmpFilesize
68KB
-
memory/1444-2-0x0000000000000000-mapping.dmp
-
memory/1796-6-0x0000000000000000-mapping.dmp
-
memory/2004-10-0x000000000030F000-0x0000000000310000-memory.dmpFilesize
4KB
-
memory/2004-11-0x0000000002410000-0x0000000002421000-memory.dmpFilesize
68KB