makop | 801384c781c364acdc61e60e5b120359cb4617a42da8155123f3a0381a56495a

General

Target

_______200728(_____ __ __ ________ ________).exe
Size

142KB
MD5

88e86bec16a339b6eb5ede18f383ffd9
SHA1

91e79df0e7b60a9f58f068f5eacb1e1b32419e40
SHA256

801384c781c364acdc61e60e5b120359cb4617a42da8155123f3a0381a56495a
SHA512

3cd8291b6ed8ed94b3c523ef43fd31b155f62547dadf2d4810d06696af5e616aa5f454dd3a0cfa9ff6025890dcd4998966a539257158f43da764b7ff767dfd93

Score

10^/10

ransomware persistence makop spyware

Malware Config

Extracted

Path

C:\Users\Admin\AppData\Local\Temp\readme-warning.txt

Family

makop

Ransom Note

::: Greetings ::: Little FAQ: .1. Q: Whats Happen? A: Your files have been encrypted and now have the "makop" extension. The file structure was not damaged, we did everything possible so that this could not happen. .2. Q: How to recover files? A: If you wish to decrypt your files you will need to pay in bitcoins. .3. Q: What about guarantees? A: Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will cooperate with us. Its not in our interests. To check the ability of returning files, you can send to us any 2 files with SIMPLE extensions(jpg,xls,doc, etc... not databases!) and low sizes(max 1 mb), we will decrypt them and send back to you. That is our guarantee. .4. Q: How to contact with you? A: You can write us to our mailbox: akzhq725@tutanota.com or akzhq725@cock.li .5. Q: How will the decryption process proceed after payment? A: After payment we will send to you our scanner-decoder program and detailed instructions for use. With this program you will be able to decrypt all your encrypted files. .6. Q: If I don�t want to pay bad people like you? A: If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause only we have the private key. In practice - time is much more valuable than money. :::BEWARE::: DON'T try to change encrypted files by yourself! If you will try to use any third party software for restoring your data or antivirus solutions - please make a backup for all encrypted files! Any changes in encrypted files may entail damage of the private key and, as result, the loss all data.

Emails

akzhq725@tutanota.com

akzhq725@cock.li

Signatures

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

_______200728(_____ __ __ ________ ________).exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-1400429095-533421673-2598934218-1000\Software\Microsoft\Windows\CurrentVersion\Run\1 = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\_______200728(_____ __ __ ________ ________).exe\""	_______200728(_____ __ __ ________ ________).exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware

File Deletion
T1107

Inhibit System Recovery
T1490
Interacts with shadow copies 2 TTPs 1 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
ransomware

File Deletion
T1107

Inhibit System Recovery
T1490

Processes:

vssadmin.exe

pid process

376 vssadmin.exe

pid	process
376	vssadmin.exe

Drops file in Program Files directory 17736 IoCs

Processes:

_______200728(_____ __ __ ________ ________).exe

description	ioc	process
File opened for modification	C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.16112.11601.0_x64__8wekyb3d8bbwe\Assets\FileExtension.targetsize-40.png	_______200728(_____ __ __ ________ ________).exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\eu-es\readme-warning.txt	_______200728(_____ __ __ ________ ________).exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProXC2RVL_KMS_ClientC2R-ppd.xrm-ms	_______200728(_____ __ __ ________ ________).exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019XC2RVL_KMS_ClientC2R-ul-oob.xrm-ms	_______200728(_____ __ __ ________ ________).exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsAlarms_10.1702.333.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\StopwatchMedTile.scale-100.png	_______200728(_____ __ __ ________ ________).exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsAlarms_10.1702.333.0_x64__8wekyb3d8bbwe\Assets\AlarmsSmallTile.contrast-black_scale-200.png	_______200728(_____ __ __ ________ ________).exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\ECLIPSE\ECLIPSE.ELM	_______200728(_____ __ __ ________ ________).exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGMN120.XML	_______200728(_____ __ __ ________ ________).exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Advertising.Xaml_10.0.1605.0_x86__8wekyb3d8bbwe\Microsoft.Advertising\ormma.js	_______200728(_____ __ __ ________ ________).exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1611.10393.0_x64__8wekyb3d8bbwe\Assets\SecondaryTiles\Directions\Place\LTR\contrast-white\WideTile.scale-200.png	_______200728(_____ __ __ ________ ________).exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\back-arrow-hover.svg	_______200728(_____ __ __ ________ ________).exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\com.jrockit.mc.console.historicaldata_5.5.0.165303.jar	_______200728(_____ __ __ ________ ________).exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\modules\org-netbeans-core-multiview.jar	_______200728(_____ __ __ ________ ________).exe
File opened for modification	C:\Program Files\Java\jre1.8.0_66\lib\tzdb.dat	_______200728(_____ __ __ ________ ________).exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019XC2RVL_MAKC2R-ul-oob.xrm-ms	_______200728(_____ __ __ ________ ________).exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.SkypeApp_11.8.204.0_x64__kzf8qxf38zg5c\SkypeApp\Designs\Flags\small\cc_16x11.png	_______200728(_____ __ __ ________ ________).exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.SkypeApp_11.8.204.0_x64__kzf8qxf38zg5c\SkypeApp\Designs\Flags\small\ht_16x11.png	_______200728(_____ __ __ ________ ________).exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.16112.11601.0_x64__8wekyb3d8bbwe\Assets\contrast-black\AppList.targetsize-60_contrast-black.png	_______200728(_____ __ __ ________ ________).exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\reviews\images\themes\dark\s_thumbnailview_18.svg	_______200728(_____ __ __ ________ ________).exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\reviews\js\nls\sl-si\readme-warning.txt	_______200728(_____ __ __ ________ ________).exe
File opened for modification	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsMaps_5.1611.10393.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\SecondaryTiles\Directions\Home\RTL\SmallTile.scale-125.png	_______200728(_____ __ __ ________ ________).exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.7906.42257.0_x64__8wekyb3d8bbwe\images\contrast-black\HxCalendarAppList.targetsize-64.png	_______200728(_____ __ __ ________ ________).exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.XboxApp_25.25.13009.0_x64__8wekyb3d8bbwe\Assets\GamesXboxHubStoreLogo.scale-100_contrast-white.png	_______200728(_____ __ __ ________ ________).exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\js\nls\ko-kr\ui-strings.js	_______200728(_____ __ __ ________ ________).exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.XboxGameOverlay_1.15.2003.0_neutral_~_8wekyb3d8bbwe\AppxSignature.p7x	_______200728(_____ __ __ ________ ________).exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\Assets\GamePlayAssets\Localization\localized_PT-BR.respack	_______200728(_____ __ __ ________ ________).exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\Assets\Tournament\ShowLeaderboardButton.png	_______200728(_____ __ __ ________ ________).exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.MSPaint_1.1702.28017.0_x64__8wekyb3d8bbwe\Assets\Logo.png	_______200728(_____ __ __ ________ ________).exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.StorePurchaseApp_1.0.45.0_x64__8wekyb3d8bbwe\AppxManifest.xml	_______200728(_____ __ __ ________ ________).exe
File created	C:\Program Files\VideoLAN\VLC\locale\mai\LC_MESSAGES\readme-warning.txt	_______200728(_____ __ __ ________ ________).exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\Assets\contrast-black\AppPackageAppList.targetsize-80_contrast-black.png	_______200728(_____ __ __ ________ ________).exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\images\CompleteCheckmark2x.png	_______200728(_____ __ __ ________ ________).exe
File opened for modification	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsSoundRecorder_10.1702.301.0_neutral_split.scale-200_8wekyb3d8bbwe\Assets\VoiceRecorderWideTile.contrast-black_scale-200.png	_______200728(_____ __ __ ________ ________).exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.SkypeApp_11.8.204.0_x64__kzf8qxf38zg5c\SkypeApp\Designs\Emoticons\small\skype.png	_______200728(_____ __ __ ________ ________).exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\Assets\DailyChallenges\Icons\tripeaks.png	_______200728(_____ __ __ ________ ________).exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1611.10393.0_x64__8wekyb3d8bbwe\Assets\SecondaryTiles\Collections\contrast-black\WideTile.scale-200_contrast-black.png	_______200728(_____ __ __ ________ ________).exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\css\main.css	_______200728(_____ __ __ ________ ________).exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\js\nls\eu-es\readme-warning.txt	_______200728(_____ __ __ ________ ________).exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.osgi.services_3.4.0.v20140312-2051.jar	_______200728(_____ __ __ ________ ________).exe
File opened for modification	C:\Program Files\Java\jre1.8.0_66\lib\security\java.policy	_______200728(_____ __ __ ________ ________).exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\EXCEL_K_COL.HXK	_______200728(_____ __ __ ________ ________).exe
File opened for modification	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsAlarms_10.1702.333.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\AlarmsSmallTile.contrast-black_scale-125.png	_______200728(_____ __ __ ________ ________).exe
File opened for modification	C:\Program Files (x86)\WindowsPowerShell\Modules\Pester\3.4.0\Functions\In.ps1	_______200728(_____ __ __ ________ ________).exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_Subscription2-ppd.xrm-ms	_______200728(_____ __ __ ________ ________).exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.7906.42257.0_x64__8wekyb3d8bbwe\images\contrast-white\HxA-Outlook.scale-200.png	_______200728(_____ __ __ ________ ________).exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sign-services-auth\js\nls\da-dk\readme-warning.txt	_______200728(_____ __ __ ________ ________).exe
File opened for modification	C:\Program Files (x86)\WindowsPowerShell\Modules\Pester\3.4.0\Functions\Assertions\Should.Tests.ps1	_______200728(_____ __ __ ________ ________).exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\com.jrockit.mc.feature.console_5.5.0.165303\feature.properties	_______200728(_____ __ __ ________ ________).exe
File opened for modification	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Fonts\Century Gothic.xml	_______200728(_____ __ __ ________ ________).exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.7906.42257.0_x64__8wekyb3d8bbwe\images\contrast-white\HxA-Advanced-Light.scale-300.png	_______200728(_____ __ __ ________ ________).exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.7906.42257.0_x64__8wekyb3d8bbwe\images\HxAccountsSplashLogo.scale-180.png	_______200728(_____ __ __ ________ ________).exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.7906.42257.0_x64__8wekyb3d8bbwe\images\contrast-black\HxMailMediumTile.scale-125.png	_______200728(_____ __ __ ________ ________).exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\pages-app\images\themes\dark\readme-warning.txt	_______200728(_____ __ __ ________ ________).exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Office.OneNote_17.7668.58071.0_x64__8wekyb3d8bbwe\images\MicrosoftAccount.scale-140.png	_______200728(_____ __ __ ________ ________).exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.SkypeApp_11.8.204.0_x64__kzf8qxf38zg5c\SkypeApp\Designs\Flags\small\xs_16x11.png	_______200728(_____ __ __ ________ ________).exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsAlarms_10.1702.333.0_x64__8wekyb3d8bbwe\Assets\AlarmsAppList.contrast-white_targetsize-96_altform-unplated.png	_______200728(_____ __ __ ________ ________).exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.7906.42257.0_x64__8wekyb3d8bbwe\images\8576_32x32x32.png	_______200728(_____ __ __ ________ ________).exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\example_icons2x.png	_______200728(_____ __ __ ________ ________).exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\en-US\IpsMigrationPlugin.dll.mui	_______200728(_____ __ __ ________ ________).exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\Assets\ThemeCreation\Delete.png	_______200728(_____ __ __ ________ ________).exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.1702.312.0_x64__8wekyb3d8bbwe\Assets\CalculatorAppList.targetsize-96_altform-fullcolor.png	_______200728(_____ __ __ ________ ________).exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1611.10393.0_x64__8wekyb3d8bbwe\Assets\SecondaryTiles\Directions\Work\RTL\contrast-white\WideTile.scale-200.png	_______200728(_____ __ __ ________ ________).exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.7906.42257.0_x64__8wekyb3d8bbwe\images\2_20x20x32.png	_______200728(_____ __ __ ________ ________).exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\css\main-selector.css	_______200728(_____ __ __ ________ ________).exe

Suspicious use of WriteProcessMemory 22 IoCs

Processes:

svchost.exe_______200728(_____ __ __ ________ ________).execmd.exe

description	pid	process	target process
PID 3016 wrote to memory of 576	3016	svchost.exe	_______200728(_____ __ __ ________ ________).exe
PID 3016 wrote to memory of 576	3016	svchost.exe	_______200728(_____ __ __ ________ ________).exe
PID 3016 wrote to memory of 576	3016	svchost.exe	_______200728(_____ __ __ ________ ________).exe
PID 3016 wrote to memory of 576	3016	svchost.exe	_______200728(_____ __ __ ________ ________).exe
PID 3016 wrote to memory of 576	3016	svchost.exe	_______200728(_____ __ __ ________ ________).exe
PID 3016 wrote to memory of 576	3016	svchost.exe	_______200728(_____ __ __ ________ ________).exe
PID 3016 wrote to memory of 576	3016	svchost.exe	_______200728(_____ __ __ ________ ________).exe
PID 4040 wrote to memory of 900	4040	_______200728(_____ __ __ ________ ________).exe	cmd.exe
PID 4040 wrote to memory of 900	4040	_______200728(_____ __ __ ________ ________).exe	cmd.exe
PID 900 wrote to memory of 376	900	cmd.exe	vssadmin.exe
PID 900 wrote to memory of 376	900	cmd.exe	vssadmin.exe
PID 900 wrote to memory of 1644	900	cmd.exe	wbadmin.exe
PID 900 wrote to memory of 1644	900	cmd.exe	wbadmin.exe
PID 900 wrote to memory of 2672	900	cmd.exe	WMIC.exe
PID 900 wrote to memory of 2672	900	cmd.exe	WMIC.exe
PID 3016 wrote to memory of 2776	3016	svchost.exe	_______200728(_____ __ __ ________ ________).exe
PID 3016 wrote to memory of 2776	3016	svchost.exe	_______200728(_____ __ __ ________ ________).exe
PID 3016 wrote to memory of 2776	3016	svchost.exe	_______200728(_____ __ __ ________ ________).exe
PID 3016 wrote to memory of 2776	3016	svchost.exe	_______200728(_____ __ __ ________ ________).exe
PID 3016 wrote to memory of 2776	3016	svchost.exe	_______200728(_____ __ __ ________ ________).exe
PID 3016 wrote to memory of 2776	3016	svchost.exe	_______200728(_____ __ __ ________ ________).exe
PID 3016 wrote to memory of 2776	3016	svchost.exe	_______200728(_____ __ __ ________ ________).exe

Checks SCSI registry key(s) 3 TTPs 4 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

vds.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_SANU&PROD_SANU_DVD-ROM\4&37CE57BA&0&010000	vds.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\FriendlyName	vds.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_&PROD_HEARTDISK\4&37CE57BA&0&000000	vds.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\FriendlyName	vds.exe

Makop
Ransomware family discovered by @VK_Intel in early 2020.
ransomware makop

Modifies extensions of user files 3 IoCs

Ransomware generally changes the extension on encrypted files.

ransomware

Processes:

_______200728(_____ __ __ ________ ________).exe

description	ioc	process
File opened for modification	C:\Users\Admin\Pictures\NewLimit.tiff	_______200728(_____ __ __ ________ ________).exe
File opened for modification	C:\Users\Admin\Pictures\SelectEnter.tiff	_______200728(_____ __ __ ________ ________).exe
File opened for modification	C:\Users\Admin\Pictures\TraceRemove.tiff	_______200728(_____ __ __ ________ ________).exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

_______200728(_____ __ __ ________ ________).exe

pid process

4040 _______200728(_____ __ __ ________ ________).exe
4040 _______200728(_____ __ __ ________ ________).exe
Deletes system backup catalog 2 TTPs
Ransomware often tries to delete backup files to inhibit system recovery.
ransomware

File Deletion
T1107

Inhibit System Recovery
T1490

pid	process
4040	_______200728(_____ __ __ ________ ________).exe
4040	_______200728(_____ __ __ ________ ________).exe

Suspicious use of AdjustPrivilegeToken 50 IoCs

Processes:

svchost.exevssvc.exewbengine.exeWMIC.exe

description	pid	process
Token: SeTcbPrivilege	3016	svchost.exe
Token: SeTcbPrivilege	3016	svchost.exe
Token: SeBackupPrivilege	1112	vssvc.exe
Token: SeRestorePrivilege	1112	vssvc.exe
Token: SeAuditPrivilege	1112	vssvc.exe
Token: SeBackupPrivilege	1880	wbengine.exe
Token: SeRestorePrivilege	1880	wbengine.exe
Token: SeSecurityPrivilege	1880	wbengine.exe
Token: SeIncreaseQuotaPrivilege	2672	WMIC.exe
Token: SeSecurityPrivilege	2672	WMIC.exe
Token: SeTakeOwnershipPrivilege	2672	WMIC.exe
Token: SeLoadDriverPrivilege	2672	WMIC.exe
Token: SeSystemProfilePrivilege	2672	WMIC.exe
Token: SeSystemtimePrivilege	2672	WMIC.exe
Token: SeProfSingleProcessPrivilege	2672	WMIC.exe
Token: SeIncBasePriorityPrivilege	2672	WMIC.exe
Token: SeCreatePagefilePrivilege	2672	WMIC.exe
Token: SeBackupPrivilege	2672	WMIC.exe
Token: SeRestorePrivilege	2672	WMIC.exe
Token: SeShutdownPrivilege	2672	WMIC.exe
Token: SeDebugPrivilege	2672	WMIC.exe
Token: SeSystemEnvironmentPrivilege	2672	WMIC.exe
Token: SeRemoteShutdownPrivilege	2672	WMIC.exe
Token: SeUndockPrivilege	2672	WMIC.exe
Token: SeManageVolumePrivilege	2672	WMIC.exe
Token: 33	2672	WMIC.exe
Token: 34	2672	WMIC.exe
Token: 35	2672	WMIC.exe
Token: 36	2672	WMIC.exe
Token: SeIncreaseQuotaPrivilege	2672	WMIC.exe
Token: SeSecurityPrivilege	2672	WMIC.exe
Token: SeTakeOwnershipPrivilege	2672	WMIC.exe
Token: SeLoadDriverPrivilege	2672	WMIC.exe
Token: SeSystemProfilePrivilege	2672	WMIC.exe
Token: SeSystemtimePrivilege	2672	WMIC.exe
Token: SeProfSingleProcessPrivilege	2672	WMIC.exe
Token: SeIncBasePriorityPrivilege	2672	WMIC.exe
Token: SeCreatePagefilePrivilege	2672	WMIC.exe
Token: SeBackupPrivilege	2672	WMIC.exe
Token: SeRestorePrivilege	2672	WMIC.exe
Token: SeShutdownPrivilege	2672	WMIC.exe
Token: SeDebugPrivilege	2672	WMIC.exe
Token: SeSystemEnvironmentPrivilege	2672	WMIC.exe
Token: SeRemoteShutdownPrivilege	2672	WMIC.exe
Token: SeUndockPrivilege	2672	WMIC.exe
Token: SeManageVolumePrivilege	2672	WMIC.exe
Token: 33	2672	WMIC.exe
Token: 34	2672	WMIC.exe
Token: 35	2672	WMIC.exe
Token: 36	2672	WMIC.exe

Suspicious use of NtCreateUserProcessOtherParentProcess 2 IoCs

Processes:

svchost.exe

description	pid	process	target process
PID 3016 created 4040	3016	svchost.exe	_______200728(_____ __ __ ________ ________).exe
PID 3016 created 4040	3016	svchost.exe	_______200728(_____ __ __ ________ ________).exe

Deletes backup catalog 3 TTPs 1 IoCs
Uses wbadmin.exe to inhibit system recovery.
ransomware

Command-Line Interface
T1059

File Deletion
T1107

Inhibit System Recovery
T1490

Processes:

wbadmin.exe

pid process

1644 wbadmin.exe

pid	process
1644	wbadmin.exe

Modifies service 2 TTPs 5 IoCs

persistence

Modify Registry

T1112

Modify Existing Service

T1031

Processes:

vssvc.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\Registry Writer	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\SwProvider_{b5946137-7b9f-4925-af80-51abd60b20d5}	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\COM+ REGDB Writer	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\ASR Writer	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\Shadow Copy Optimization Writer	vssvc.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware

Data from Local System
T1005

Credentials in Files
T1081

C:\Users\Admin\AppData\Local\Temp\_______200728(_____ __ __ ________ ________).exe
"C:\Users\Admin\AppData\Local\Temp\_______200728(_____ __ __ ________ ________).exe"
1⤵
- Adds Run key to start application
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
- Modifies extensions of user files
- Suspicious behavior: EnumeratesProcesses
PID:4040

C:\Users\Admin\AppData\Local\Temp\_______200728(_____ __ __ ________ ________).exe
"C:\Users\Admin\AppData\Local\Temp\_______200728(_____ __ __ ________ ________).exe" n4040
2⤵
PID:576

C:\Windows\system32\cmd.exe
"C:\Windows\system32\cmd.exe"
2⤵
- Suspicious use of WriteProcessMemory
PID:900

C:\Windows\system32\vssadmin.exe
vssadmin delete shadows /all /quiet
3⤵
- Interacts with shadow copies
PID:376

C:\Windows\system32\wbadmin.exe
wbadmin delete catalog -quiet
3⤵
- Deletes backup catalog
PID:1644

C:\Windows\System32\Wbem\WMIC.exe
wmic shadowcopy delete
3⤵
- Suspicious use of AdjustPrivilegeToken
PID:2672

C:\Users\Admin\AppData\Local\Temp\_______200728(_____ __ __ ________ ________).exe
"C:\Users\Admin\AppData\Local\Temp\_______200728(_____ __ __ ________ ________).exe" n4040
2⤵
PID:2776

\??\c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s seclogon
1⤵
- Suspicious use of WriteProcessMemory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of NtCreateUserProcessOtherParentProcess
PID:3016

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
- Modifies service
PID:1112

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1880

C:\Windows\System32\vdsldr.exe
C:\Windows\System32\vdsldr.exe -Embedding
1⤵
PID:2140

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Checks SCSI registry key(s)
PID:2296

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Command-Line Interface

1

T1059

Persistence

Registry Run Keys / Startup Folder

1

T1060

Modify Existing Service

1

T1031

Privilege Escalation

Defense Evasion

Modify Registry

2

T1112

File Deletion

4

T1107

Credential Access

Credentials in Files

1

T1081

Discovery

Query Registry

1

T1012

Peripheral Device Discovery

1

T1120

System Information Discovery

1

T1082

Lateral Movement

Collection

Data from Local System

1

T1005

Exfiltration

Command and Control

Web Service

1

T1102

Impact

Inhibit System Recovery

4

T1490

Replay Monitor

Loading Replay Monitor...

Downloads

memory/376-4-0x0000000000000000-mapping.dmp

Download
memory/576-2-0x0000000000000000-mapping.dmp

Download
memory/576-5-0x000000000342B000-0x000000000342D000-memory.dmp

Filesize
8KB

Download
memory/576-6-0x0000000004EC0000-0x0000000004EC1000-memory.dmp

Filesize
4KB

Download
memory/900-3-0x0000000000000000-mapping.dmp

Download
memory/1644-7-0x0000000000000000-mapping.dmp

Download
memory/2672-8-0x0000000000000000-mapping.dmp

Download
memory/2776-10-0x0000000000000000-mapping.dmp

Download
memory/2776-11-0x000000000344C000-0x000000000344D000-memory.dmp

Filesize
4KB

Download
memory/2776-12-0x0000000004F00000-0x0000000004F01000-memory.dmp

Filesize
4KB

Download
memory/4040-0-0x00000000034B6000-0x00000000034B7000-memory.dmp

Filesize
4KB

Download
memory/4040-1-0x00000000051F0000-0x00000000051F1000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads