makop | fc257f64a0279bb5ae221b968d3f38bbb7237a8475c165c5a8430fe6633e3fe6

Analysis

max time kernel
147s
max time network
149s
platform
windows7_x64
resource
win7v20201028
submitted
22-12-2020 13:46

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

InnoExtractor.exe
Size

117KB
MD5

f64ecdec4c84ac7ef0ca6c2ef4d94eea
SHA1

7c88af3c8a27402da1d67cfaa1a02555f1c7945d
SHA256

fc257f64a0279bb5ae221b968d3f38bbb7237a8475c165c5a8430fe6633e3fe6
SHA512

87b8a1c6098a67a6a7f61e154deba8c16a5b421e5157183b40f808c23187ec46e046d7f4ac006d375fcf66000da7da588c9105f9acba5471604255d15c1ac8f7

Score

10^/10

makop persistence ransomware spyware

Malware Config

Extracted

Path

C:\Users\Admin\AppData\Local\Temp\readme-warning.txt

Family

makop

Ransom Note

::: Greetings ::: Little FAQ: .1. Q: Whats Happen? A: Your files have been encrypted and now have the "makop" extension. The file structure was not damaged, we did everything possible so that this could not happen. .2. Q: How to recover files? A: If you wish to decrypt your files you will need to pay in bitcoins. .3. Q: What about guarantees? A: Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will cooperate with us. Its not in our interests. To check the ability of returning files, you can send to us any 2 files with SIMPLE extensions(jpg,xls,doc, etc... not databases!) and low sizes(max 1 mb), we will decrypt them and send back to you. That is our guarantee. .4. Q: How to contact with you? A: You can write us to our mailbox: akzhq1010@tutanota.com or akzhq1010@cock.li .5. Q: How will the decryption process proceed after payment? A: After payment we will send to you our scanner-decoder program and detailed instructions for use. With this program you will be able to decrypt all your encrypted files. .6. Q: If I don�t want to pay bad people like you? A: If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause only we have the private key. In practice - time is much more valuable than money. :::BEWARE::: DON'T try to change encrypted files by yourself! If you will try to use any third party software for restoring your data or antivirus solutions - please make a backup for all encrypted files! Any changes in encrypted files may entail damage of the private key and, as result, the loss all data.

Emails

akzhq1010@tutanota.com

akzhq1010@cock.li

Signatures

Makop
Ransomware family discovered by @VK_Intel in early 2020.
ransomware makop
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware

File Deletion
T1107

Inhibit System Recovery
T1490
Deletes backup catalog 3 TTPs 1 IoCs
Uses wbadmin.exe to inhibit system recovery.
ransomware

Command-Line Interface
T1059

File Deletion
T1107

Inhibit System Recovery
T1490

Processes:

wbadmin.exe

pid process

1960 wbadmin.exe

pid	process
1960	wbadmin.exe

Modifies extensions of user files 2 IoCs

Ransomware generally changes the extension on encrypted files.

ransomware

Processes:

InnoExtractor.exe

description	ioc	process
File opened for modification	C:\Users\Admin\Pictures\GrantProtect.tiff	InnoExtractor.exe
File opened for modification	C:\Users\Admin\Pictures\MeasureWatch.tiff	InnoExtractor.exe

Loads dropped DLL 4 IoCs

Processes:

InnoExtractor.exeInnoExtractor.exeInnoExtractor.exeInnoExtractor.exe

pid process

1744 InnoExtractor.exe
816 InnoExtractor.exe
1840 InnoExtractor.exe
1784 InnoExtractor.exe
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware

Data from Local System
T1005

Credentials in Files
T1081

pid	process
1744	InnoExtractor.exe
816	InnoExtractor.exe
1840	InnoExtractor.exe
1784	InnoExtractor.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

InnoExtractor.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Windows\CurrentVersion\Run\1 = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\InnoExtractor.exe\""	InnoExtractor.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102

Suspicious use of SetThreadContext 4 IoCs

Processes:

InnoExtractor.exeInnoExtractor.exeInnoExtractor.exeInnoExtractor.exe

description	pid	process	target process
PID 1744 set thread context of 1244	1744	InnoExtractor.exe	InnoExtractor.exe
PID 816 set thread context of 1584	816	InnoExtractor.exe	InnoExtractor.exe
PID 1840 set thread context of 784	1840	InnoExtractor.exe	InnoExtractor.exe
PID 1784 set thread context of 1572	1784	InnoExtractor.exe	InnoExtractor.exe

Drops file in Program Files directory 9731 IoCs

Processes:

InnoExtractor.exe

description	ioc	process
File opened for modification	C:\Program Files (x86)\Microsoft Office\Document Themes 14\Equity.thmx	InnoExtractor.exe
File created	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms\readme-warning.txt	InnoExtractor.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\CALNDR98.POC	InnoExtractor.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Antarctica\Syowa	InnoExtractor.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0292286.WMF	InnoExtractor.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0195772.WMF	InnoExtractor.exe
File opened for modification	C:\Program Files\DVD Maker\Shared\DvdStyles\SpecialOccasion\NavigationUp_SelectionSubpicture.png	InnoExtractor.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\PAPYRUS\THMBNAIL.PNG	InnoExtractor.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsHomePageStyle.css	InnoExtractor.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.feature_3.9.1.v20140827-1444\META-INF\ECLIPSE_.RSA	InnoExtractor.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\MEDIA\CAGCAT10\J0216588.WMF	InnoExtractor.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\Desert\HEADER.GIF	InnoExtractor.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\GIFT.XML	InnoExtractor.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\CASCADE\THMBNAIL.PNG	InnoExtractor.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\BL00130_.WMF	InnoExtractor.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.forms.nl_zh_4.4.0.v20140623020002.jar	InnoExtractor.exe
File opened for modification	C:\Program Files\Java\jre7\lib\zi\Etc\GMT+8	InnoExtractor.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\en-US\iexplore.exe.mui	InnoExtractor.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Document Themes 14\Theme Fonts\Metro.xml	InnoExtractor.exe
File opened for modification	C:\Program Files (x86)\Windows Photo Viewer\en-US\PhotoViewer.dll.mui	InnoExtractor.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Cayman	InnoExtractor.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Damascus	InnoExtractor.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\en-US\settings.html	InnoExtractor.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\en-US\css\settings.css	InnoExtractor.exe
File created	C:\Program Files (x86)\Microsoft Office\Office14\Bibliography\Sort\readme-warning.txt	InnoExtractor.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\CommonData\CommsOutgoingImageSmall.jpg	InnoExtractor.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\rtf_spellcheck.gif	InnoExtractor.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\DGBORDER.XML	InnoExtractor.exe
File opened for modification	C:\Program Files\DVD Maker\Shared\DvdStyles\Shatter\NavigationLeft_ButtonGraphic.png	InnoExtractor.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\update_tracking\readme-warning.txt	InnoExtractor.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\WB01301_.GIF	InnoExtractor.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\PUBSPAPR\PDIR21F.GIF	InnoExtractor.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\db\bin\dblook	InnoExtractor.exe
File created	C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Outlook.en-us\readme-warning.txt	InnoExtractor.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\BL00098_.WMF	InnoExtractor.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\CG1606.WMF	InnoExtractor.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Document Themes 14\Austin.thmx	InnoExtractor.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\lib\images\cursors\win32_MoveDrop32x32.gif	InnoExtractor.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.help_2.0.102.v20141007-2301\feature.properties	InnoExtractor.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\NA02388_.WMF	InnoExtractor.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\Publisher\Backgrounds\J0143744.GIF	InnoExtractor.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\SAMPLES\SOLVSAMP.XLS	InnoExtractor.exe
File opened for modification	C:\Program Files\Java\jre7\lib\security\java.security	InnoExtractor.exe
File opened for modification	C:\Program Files\Java\jre7\lib\zi\America\Halifax	InnoExtractor.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Icons\APIFile_8.ico	InnoExtractor.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD21299_.GIF	InnoExtractor.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\Gadgets\Clock.Gadget\images\modern.png	InnoExtractor.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\CPU.Gadget\images\glass.png	InnoExtractor.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\forms_received.gif.[D2AAA3CF].[akzhq1010@tutanota.com].makop	InnoExtractor.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\SO00486_.WMF	InnoExtractor.exe
File opened for modification	C:\Program Files\Java\jre7\lib\zi\Asia\Macau	InnoExtractor.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\DD01172_.WMF	InnoExtractor.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\PUBSPAPR\PDIR7B.GIF	InnoExtractor.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\Bibliography\Style\TURABIAN.XSL	InnoExtractor.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\FORMS\1033\OMSSMS.CFG	InnoExtractor.exe
File created	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveDocumentReview\readme-warning.txt	InnoExtractor.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Atlantic\readme-warning.txt	InnoExtractor.exe
File opened for modification	C:\Program Files\Java\jre7\lib\zi\Pacific\Tarawa	InnoExtractor.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\mr\LC_MESSAGES\vlc.mo	InnoExtractor.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\PDDom.api	InnoExtractor.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0099159.WMF	InnoExtractor.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Templates\1033\Access\Faculty.accdt	InnoExtractor.exe
File opened for modification	C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\SceneButtonSubpicture.png	InnoExtractor.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\p2\org.eclipse.equinox.p2.engine\profileRegistry\JMC.profile\1423861261279.profile.gz	InnoExtractor.exe

Interacts with shadow copies 2 TTPs 1 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
ransomware

File Deletion
T1107

Inhibit System Recovery
T1490

Processes:

vssadmin.exe

pid process

1476 vssadmin.exe

pid	process
1476	vssadmin.exe

Modifies system certificate store 2 TTPs 3 IoCs

evasion spyware trojan

Install Root Certificate

T1130

Modify Registry

T1112

Processes:

InnoExtractor.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349	InnoExtractor.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 0f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030853000000010000002600000030243022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c00b00000001000000180000004300b7004f00b7004d00b7004f00b7004400b7004f000000140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b41d00000001000000100000002e0d6875874a44c820912e85e964cfdb030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e349200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e	InnoExtractor.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 1900000001000000100000002aa1c05e2ae606f198c2c5e937c97aa2030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e3491d00000001000000100000002e0d6875874a44c820912e85e964cfdb140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b40b00000001000000180000004300b7004f00b7004d00b7004f00b7004400b7004f00000053000000010000002600000030243022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b060105050703080f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e	InnoExtractor.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

InnoExtractor.exe

pid process

1244 InnoExtractor.exe
Suspicious behavior: MapViewOfSection 4 IoCs

Processes:

InnoExtractor.exeInnoExtractor.exeInnoExtractor.exeInnoExtractor.exe

pid process

1744 InnoExtractor.exe
816 InnoExtractor.exe
1840 InnoExtractor.exe
1784 InnoExtractor.exe

pid	process
1244	InnoExtractor.exe

pid	process
1744	InnoExtractor.exe
816	InnoExtractor.exe
1840	InnoExtractor.exe
1784	InnoExtractor.exe

Suspicious use of AdjustPrivilegeToken 46 IoCs

Processes:

vssvc.exewbengine.exeWMIC.exe

description	pid	process
Token: SeBackupPrivilege	556	vssvc.exe
Token: SeRestorePrivilege	556	vssvc.exe
Token: SeAuditPrivilege	556	vssvc.exe
Token: SeBackupPrivilege	920	wbengine.exe
Token: SeRestorePrivilege	920	wbengine.exe
Token: SeSecurityPrivilege	920	wbengine.exe
Token: SeIncreaseQuotaPrivilege	1700	WMIC.exe
Token: SeSecurityPrivilege	1700	WMIC.exe
Token: SeTakeOwnershipPrivilege	1700	WMIC.exe
Token: SeLoadDriverPrivilege	1700	WMIC.exe
Token: SeSystemProfilePrivilege	1700	WMIC.exe
Token: SeSystemtimePrivilege	1700	WMIC.exe
Token: SeProfSingleProcessPrivilege	1700	WMIC.exe
Token: SeIncBasePriorityPrivilege	1700	WMIC.exe
Token: SeCreatePagefilePrivilege	1700	WMIC.exe
Token: SeBackupPrivilege	1700	WMIC.exe
Token: SeRestorePrivilege	1700	WMIC.exe
Token: SeShutdownPrivilege	1700	WMIC.exe
Token: SeDebugPrivilege	1700	WMIC.exe
Token: SeSystemEnvironmentPrivilege	1700	WMIC.exe
Token: SeRemoteShutdownPrivilege	1700	WMIC.exe
Token: SeUndockPrivilege	1700	WMIC.exe
Token: SeManageVolumePrivilege	1700	WMIC.exe
Token: 33	1700	WMIC.exe
Token: 34	1700	WMIC.exe
Token: 35	1700	WMIC.exe
Token: SeIncreaseQuotaPrivilege	1700	WMIC.exe
Token: SeSecurityPrivilege	1700	WMIC.exe
Token: SeTakeOwnershipPrivilege	1700	WMIC.exe
Token: SeLoadDriverPrivilege	1700	WMIC.exe
Token: SeSystemProfilePrivilege	1700	WMIC.exe
Token: SeSystemtimePrivilege	1700	WMIC.exe
Token: SeProfSingleProcessPrivilege	1700	WMIC.exe
Token: SeIncBasePriorityPrivilege	1700	WMIC.exe
Token: SeCreatePagefilePrivilege	1700	WMIC.exe
Token: SeBackupPrivilege	1700	WMIC.exe
Token: SeRestorePrivilege	1700	WMIC.exe
Token: SeShutdownPrivilege	1700	WMIC.exe
Token: SeDebugPrivilege	1700	WMIC.exe
Token: SeSystemEnvironmentPrivilege	1700	WMIC.exe
Token: SeRemoteShutdownPrivilege	1700	WMIC.exe
Token: SeUndockPrivilege	1700	WMIC.exe
Token: SeManageVolumePrivilege	1700	WMIC.exe
Token: 33	1700	WMIC.exe
Token: 34	1700	WMIC.exe
Token: 35	1700	WMIC.exe

Suspicious use of WriteProcessMemory 45 IoCs

Processes:

InnoExtractor.exeInnoExtractor.execmd.exeInnoExtractor.exeInnoExtractor.exeInnoExtractor.exe

description	pid	process	target process
PID 1744 wrote to memory of 1244	1744	InnoExtractor.exe	InnoExtractor.exe
PID 1744 wrote to memory of 1244	1744	InnoExtractor.exe	InnoExtractor.exe
PID 1744 wrote to memory of 1244	1744	InnoExtractor.exe	InnoExtractor.exe
PID 1744 wrote to memory of 1244	1744	InnoExtractor.exe	InnoExtractor.exe
PID 1744 wrote to memory of 1244	1744	InnoExtractor.exe	InnoExtractor.exe
PID 1744 wrote to memory of 1244	1744	InnoExtractor.exe	InnoExtractor.exe
PID 1744 wrote to memory of 1244	1744	InnoExtractor.exe	InnoExtractor.exe
PID 1744 wrote to memory of 1244	1744	InnoExtractor.exe	InnoExtractor.exe
PID 1244 wrote to memory of 1344	1244	InnoExtractor.exe	cmd.exe
PID 1244 wrote to memory of 1344	1244	InnoExtractor.exe	cmd.exe
PID 1244 wrote to memory of 1344	1244	InnoExtractor.exe	cmd.exe
PID 1244 wrote to memory of 1344	1244	InnoExtractor.exe	cmd.exe
PID 1344 wrote to memory of 1476	1344	cmd.exe	vssadmin.exe
PID 1344 wrote to memory of 1476	1344	cmd.exe	vssadmin.exe
PID 1344 wrote to memory of 1476	1344	cmd.exe	vssadmin.exe
PID 1344 wrote to memory of 1960	1344	cmd.exe	wbadmin.exe
PID 1344 wrote to memory of 1960	1344	cmd.exe	wbadmin.exe
PID 1344 wrote to memory of 1960	1344	cmd.exe	wbadmin.exe
PID 1344 wrote to memory of 1700	1344	cmd.exe	WMIC.exe
PID 1344 wrote to memory of 1700	1344	cmd.exe	WMIC.exe
PID 1344 wrote to memory of 1700	1344	cmd.exe	WMIC.exe
PID 816 wrote to memory of 1584	816	InnoExtractor.exe	InnoExtractor.exe
PID 816 wrote to memory of 1584	816	InnoExtractor.exe	InnoExtractor.exe
PID 816 wrote to memory of 1584	816	InnoExtractor.exe	InnoExtractor.exe
PID 816 wrote to memory of 1584	816	InnoExtractor.exe	InnoExtractor.exe
PID 816 wrote to memory of 1584	816	InnoExtractor.exe	InnoExtractor.exe
PID 816 wrote to memory of 1584	816	InnoExtractor.exe	InnoExtractor.exe
PID 816 wrote to memory of 1584	816	InnoExtractor.exe	InnoExtractor.exe
PID 816 wrote to memory of 1584	816	InnoExtractor.exe	InnoExtractor.exe
PID 1840 wrote to memory of 784	1840	InnoExtractor.exe	InnoExtractor.exe
PID 1840 wrote to memory of 784	1840	InnoExtractor.exe	InnoExtractor.exe
PID 1840 wrote to memory of 784	1840	InnoExtractor.exe	InnoExtractor.exe
PID 1840 wrote to memory of 784	1840	InnoExtractor.exe	InnoExtractor.exe
PID 1840 wrote to memory of 784	1840	InnoExtractor.exe	InnoExtractor.exe
PID 1840 wrote to memory of 784	1840	InnoExtractor.exe	InnoExtractor.exe
PID 1840 wrote to memory of 784	1840	InnoExtractor.exe	InnoExtractor.exe
PID 1840 wrote to memory of 784	1840	InnoExtractor.exe	InnoExtractor.exe
PID 1784 wrote to memory of 1572	1784	InnoExtractor.exe	InnoExtractor.exe
PID 1784 wrote to memory of 1572	1784	InnoExtractor.exe	InnoExtractor.exe
PID 1784 wrote to memory of 1572	1784	InnoExtractor.exe	InnoExtractor.exe
PID 1784 wrote to memory of 1572	1784	InnoExtractor.exe	InnoExtractor.exe
PID 1784 wrote to memory of 1572	1784	InnoExtractor.exe	InnoExtractor.exe
PID 1784 wrote to memory of 1572	1784	InnoExtractor.exe	InnoExtractor.exe
PID 1784 wrote to memory of 1572	1784	InnoExtractor.exe	InnoExtractor.exe
PID 1784 wrote to memory of 1572	1784	InnoExtractor.exe	InnoExtractor.exe

C:\Users\Admin\AppData\Local\Temp\InnoExtractor.exe
"C:\Users\Admin\AppData\Local\Temp\InnoExtractor.exe"
1⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1744

C:\Users\Admin\AppData\Local\Temp\InnoExtractor.exe
"C:\Users\Admin\AppData\Local\Temp\InnoExtractor.exe"
2⤵
- Modifies extensions of user files
- Adds Run key to start application
- Drops file in Program Files directory
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1244

C:\Users\Admin\AppData\Local\Temp\InnoExtractor.exe
"C:\Users\Admin\AppData\Local\Temp\InnoExtractor.exe" n1244
3⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:816

C:\Users\Admin\AppData\Local\Temp\InnoExtractor.exe
"C:\Users\Admin\AppData\Local\Temp\InnoExtractor.exe" n1244
4⤵
PID:1584

C:\Windows\system32\cmd.exe
"C:\Windows\system32\cmd.exe"
3⤵
- Suspicious use of WriteProcessMemory
PID:1344

C:\Windows\system32\vssadmin.exe
vssadmin delete shadows /all /quiet
4⤵
- Interacts with shadow copies
PID:1476

C:\Windows\system32\wbadmin.exe
wbadmin delete catalog -quiet
4⤵
- Deletes backup catalog
PID:1960

C:\Windows\System32\Wbem\WMIC.exe
wmic shadowcopy delete
4⤵
- Suspicious use of AdjustPrivilegeToken
PID:1700

C:\Users\Admin\AppData\Local\Temp\InnoExtractor.exe
"C:\Users\Admin\AppData\Local\Temp\InnoExtractor.exe" n1244
3⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1840

C:\Users\Admin\AppData\Local\Temp\InnoExtractor.exe
"C:\Users\Admin\AppData\Local\Temp\InnoExtractor.exe" n1244
4⤵
PID:784

C:\Users\Admin\AppData\Local\Temp\InnoExtractor.exe
"C:\Users\Admin\AppData\Local\Temp\InnoExtractor.exe" n1244
3⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1784

C:\Users\Admin\AppData\Local\Temp\InnoExtractor.exe
"C:\Users\Admin\AppData\Local\Temp\InnoExtractor.exe" n1244
4⤵
PID:1572

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:556

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:920

C:\Windows\System32\vdsldr.exe
C:\Windows\System32\vdsldr.exe -Embedding
1⤵
PID:1956

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
PID:1804

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Command-Line Interface

T1059

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

File Deletion

T1107

Modify Registry

T1112

Install Root Certificate

T1130

Credential Access

Credentials in Files

T1081

Discovery

Lateral Movement

Collection

Data from Local System

T1005

Exfiltration

Command and Control

Web Service

T1102

Impact

Inhibit System Recovery

T1490

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\972313772
MD5
55d67d93e343f527a96d6d90861b834a

SHA1
6391a141f7dc90526aac012f8e7e355e5ce3ba5a

SHA256
fe1692ccf24428d2266ec7089785367de02837c4302f1c0bdcb38e829bef5c63

SHA512
977458515752198647b231b85ce695c541cec7024b563971b36794c18ddb81cf134becee9bd13dfb43d8ab36ecc39dde3f23b6409102302e2e2bff09f8e86f7b

Download Submit
C:\Users\Admin\AppData\Roaming\972313772
MD5
18668c3a11b0458f86330e6063869484

SHA1
701d1f5075dc9b124811c972a6e5d566988394be

SHA256
a00de16ae3484951fb5cf4ee7f1893f950b9c91e559edd70d0f627235d4d8a12

SHA512
d5ae285abc59758ec0bbb080aa796f32b0ffe59ee948355b54f45ecb5dc96080bc40e0cdd0095cad05903b53d6ec56dd4ac089ddc14f942632421c3363dcb92c

Download Submit
C:\Users\Admin\AppData\Roaming\972313772
MD5
7b886ad9241e779bc4937798b7e51c6a

SHA1
f2a22622a8f5052fb989db5f9f50fa109815c9ac

SHA256
15e3a11710ab84dc372116ba32a7bfaafa5d3103cbd4d48a10b81e8e8de2c691

SHA512
e2fddd935110d325a8c72e1061f5146ec3e503063df1c7f02974177a61b0a36eb3a37fc087ca92fce653ef538de94951f1e714d203808f68ce11773797620b38

Download Submit
C:\Users\Admin\AppData\Roaming\972313772
MD5
ced0af2b5daf86ac5531871bd4ba8f35

SHA1
aeff900a1b7e3717b037c7b5a3bf0eb6d9d51e60

SHA256
c166b5367a287572bb08a9baf0b6a2c847a7fec24a0598fc897c67ec93136705

SHA512
4b4817afdb7084257ce979992382795a807e85b0a19f5725a773b0b488f2fb71a1116e8ff786d49c74fb9772cc5e78d805f724f2e97d929b9f83d2608e1b447e

Download Submit
C:\Users\Admin\AppData\Roaming\972313772
MD5
18668c3a11b0458f86330e6063869484

SHA1
701d1f5075dc9b124811c972a6e5d566988394be

SHA256
a00de16ae3484951fb5cf4ee7f1893f950b9c91e559edd70d0f627235d4d8a12

SHA512
d5ae285abc59758ec0bbb080aa796f32b0ffe59ee948355b54f45ecb5dc96080bc40e0cdd0095cad05903b53d6ec56dd4ac089ddc14f942632421c3363dcb92c

Download Submit
\Users\Admin\AppData\Local\Temp\nso8383.tmp\System.dll
MD5
fccff8cb7a1067e23fd2e2b63971a8e1

SHA1
30e2a9e137c1223a78a0f7b0bf96a1c361976d91

SHA256
6fcea34c8666b06368379c6c402b5321202c11b00889401c743fb96c516c679e

SHA512
f4335e84e6f8d70e462a22f1c93d2998673a7616c868177cac3e8784a3be1d7d0bb96f2583fa0ed82f4f2b6b8f5d9b33521c279a42e055d80a94b4f3f1791e0c

Download Submit
\Users\Admin\AppData\Local\Temp\nss6A77.tmp\System.dll
MD5
fccff8cb7a1067e23fd2e2b63971a8e1

SHA1
30e2a9e137c1223a78a0f7b0bf96a1c361976d91

SHA256
6fcea34c8666b06368379c6c402b5321202c11b00889401c743fb96c516c679e

SHA512
f4335e84e6f8d70e462a22f1c93d2998673a7616c868177cac3e8784a3be1d7d0bb96f2583fa0ed82f4f2b6b8f5d9b33521c279a42e055d80a94b4f3f1791e0c

Download Submit
\Users\Admin\AppData\Local\Temp\nst7EE.tmp\System.dll
MD5
fccff8cb7a1067e23fd2e2b63971a8e1

SHA1
30e2a9e137c1223a78a0f7b0bf96a1c361976d91

SHA256
6fcea34c8666b06368379c6c402b5321202c11b00889401c743fb96c516c679e

SHA512
f4335e84e6f8d70e462a22f1c93d2998673a7616c868177cac3e8784a3be1d7d0bb96f2583fa0ed82f4f2b6b8f5d9b33521c279a42e055d80a94b4f3f1791e0c

Download Submit
\Users\Admin\AppData\Local\Temp\nsx8C1A.tmp\System.dll
MD5
fccff8cb7a1067e23fd2e2b63971a8e1

SHA1
30e2a9e137c1223a78a0f7b0bf96a1c361976d91

SHA256
6fcea34c8666b06368379c6c402b5321202c11b00889401c743fb96c516c679e

SHA512
f4335e84e6f8d70e462a22f1c93d2998673a7616c868177cac3e8784a3be1d7d0bb96f2583fa0ed82f4f2b6b8f5d9b33521c279a42e055d80a94b4f3f1791e0c

Download Submit
memory/784-20-0x00000000004059A0-mapping.dmp

Download
memory/1244-5-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/1244-4-0x00000000004059A0-mapping.dmp

Download
memory/1244-3-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/1344-6-0x0000000000000000-mapping.dmp

Download
memory/1344-16-0x000007FEF5BD0000-0x000007FEF5E4A000-memory.dmp

Filesize
2.5MB

Download
memory/1476-7-0x0000000000000000-mapping.dmp

Download
memory/1572-26-0x00000000004059A0-mapping.dmp

Download
memory/1584-13-0x00000000004059A0-mapping.dmp

Download
memory/1700-11-0x0000000000000000-mapping.dmp

Download
memory/1960-10-0x0000000000000000-mapping.dmp

Download