makop | 94658982002db6acea22c68b7619f71154933effd6428a81a235aba6e2789328

General

Target

b80103a60fa68e425a4fd200ca223915.exe
Size

751KB
MD5

b80103a60fa68e425a4fd200ca223915
SHA1

635825a5b35ea82c0255ba2c2e887c27fadd76f2
SHA256

94658982002db6acea22c68b7619f71154933effd6428a81a235aba6e2789328
SHA512

089db4834228073e77dc4af4259905977df9b976f8e4837fccc5f77991fef93d62fd809c2e67b3680f94877ef54209f1693ed93fbd412a13e3de187d0586ed2e

Score

10^/10

makop persistence ransomware

Malware Config

Extracted

Path

C:\Users\Admin\AppData\Local\Temp\readme-warning.txt

Family

makop

Ransom Note

::: Greetings ::: Little FAQ: .1. Q: Whats Happen? A: Your files have been encrypted and now have the "BKGHJ" extension. The file structure was not damaged, we did everything possible so that this could not happen. .2. Q: How to recover files? A: If you wish to decrypt your files you will need to pay in bitcoins. .3. Q: What about guarantees? A: Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will cooperate with us. Its not in our interests. To check the ability of returning files, you can send to us any 2 files with SIMPLE extensions(jpg,xls,doc, etc... not databases!) and low sizes(max 1 mb), we will decrypt them and send back to you. That is our guarantee. .4. Q: How to contact with you? A: You can write us to our mailbox: toddmhickey@outlook.com or penkatyjamie@yahoo.com .5. Q: How will the decryption process proceed after payment? A: After payment we will send to you our scanner-decoder program and detailed instructions for use. With this program you will be able to decrypt all your encrypted files. .6. Q: If I don�t want to pay bad people like you? A: If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause only we have the private key. In practice - time is much more valuable than money. :::BEWARE::: DON'T try to change encrypted files by yourself! If you will try to use any third party software for restoring your data or antivirus solutions - please make a backup for all encrypted files! Any changes in encrypted files may entail damage of the private key and, as result, the loss all data.

Emails

toddmhickey@outlook.com

penkatyjamie@yahoo.com

Signatures

Makop
Ransomware family discovered by @VK_Intel in early 2020.
ransomware makop
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware

File Deletion
T1107

Inhibit System Recovery
T1490
Deletes backup catalog 3 TTPs 1 IoCs
Uses wbadmin.exe to inhibit system recovery.
ransomware

Command-Line Interface
T1059

File Deletion
T1107

Inhibit System Recovery
T1490

Processes:

wbadmin.exe

pid process

956 wbadmin.exe

pid	process
956	wbadmin.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

b80103a60fa68e425a4fd200ca223915.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Windows\CurrentVersion\Run\1 = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\b80103a60fa68e425a4fd200ca223915.exe\""	b80103a60fa68e425a4fd200ca223915.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 16 IoCs

Processes:

b80103a60fa68e425a4fd200ca223915.exeb80103a60fa68e425a4fd200ca223915.exe

pid	process
1464	b80103a60fa68e425a4fd200ca223915.exe
1464	b80103a60fa68e425a4fd200ca223915.exe
1464	b80103a60fa68e425a4fd200ca223915.exe
1464	b80103a60fa68e425a4fd200ca223915.exe
1464	b80103a60fa68e425a4fd200ca223915.exe
1464	b80103a60fa68e425a4fd200ca223915.exe
1464	b80103a60fa68e425a4fd200ca223915.exe
1504	b80103a60fa68e425a4fd200ca223915.exe
1504	b80103a60fa68e425a4fd200ca223915.exe
1504	b80103a60fa68e425a4fd200ca223915.exe
1504	b80103a60fa68e425a4fd200ca223915.exe
1504	b80103a60fa68e425a4fd200ca223915.exe
1504	b80103a60fa68e425a4fd200ca223915.exe
1504	b80103a60fa68e425a4fd200ca223915.exe
1504	b80103a60fa68e425a4fd200ca223915.exe
1504	b80103a60fa68e425a4fd200ca223915.exe

Suspicious use of SetThreadContext 4 IoCs

Processes:

b80103a60fa68e425a4fd200ca223915.exeb80103a60fa68e425a4fd200ca223915.exeb80103a60fa68e425a4fd200ca223915.exeb80103a60fa68e425a4fd200ca223915.exe

description	pid	process	target process
PID 528 set thread context of 1464	528	b80103a60fa68e425a4fd200ca223915.exe	b80103a60fa68e425a4fd200ca223915.exe
PID 1464 set thread context of 1284	1464	b80103a60fa68e425a4fd200ca223915.exe	b80103a60fa68e425a4fd200ca223915.exe
PID 280 set thread context of 1504	280	b80103a60fa68e425a4fd200ca223915.exe	b80103a60fa68e425a4fd200ca223915.exe
PID 1504 set thread context of 752	1504	b80103a60fa68e425a4fd200ca223915.exe	b80103a60fa68e425a4fd200ca223915.exe

Drops file in Program Files directory 64 IoCs

Processes:

b80103a60fa68e425a4fd200ca223915.exe

description	ioc	process
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\sv-SE\tipresx.dll.mui	b80103a60fa68e425a4fd200ca223915.exe
File opened for modification	C:\Program Files\7-Zip\Lang\nn.txt	b80103a60fa68e425a4fd200ca223915.exe
File opened for modification	C:\Program Files\AssertOpen.kix	b80103a60fa68e425a4fd200ca223915.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\ipskor.xml	b80103a60fa68e425a4fd200ca223915.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\cs-CZ\tipresx.dll.mui	b80103a60fa68e425a4fd200ca223915.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\en-US\mip.exe.mui	b80103a60fa68e425a4fd200ca223915.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ba.txt	b80103a60fa68e425a4fd200ca223915.exe
File opened for modification	C:\Program Files\7-Zip\Lang\da.txt	b80103a60fa68e425a4fd200ca223915.exe
File opened for modification	C:\Program Files\7-Zip\Lang\hu.txt	b80103a60fa68e425a4fd200ca223915.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\hwrusalm.dat	b80103a60fa68e425a4fd200ca223915.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\tipresx.dll.mui	b80103a60fa68e425a4fd200ca223915.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\fi-FI\tipresx.dll.mui	b80103a60fa68e425a4fd200ca223915.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\ko-kr.xml	b80103a60fa68e425a4fd200ca223915.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\en-US\micaut.dll.mui	b80103a60fa68e425a4fd200ca223915.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\en-US\tabskb.dll.mui	b80103a60fa68e425a4fd200ca223915.exe
File opened for modification	C:\Program Files\7-Zip\Lang\it.txt	b80103a60fa68e425a4fd200ca223915.exe
File opened for modification	C:\Program Files\7-Zip\License.txt	b80103a60fa68e425a4fd200ca223915.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\symbols\ea-sym.xml	b80103a60fa68e425a4fd200ca223915.exe
File opened for modification	C:\Program Files\7-Zip\Lang\bn.txt	b80103a60fa68e425a4fd200ca223915.exe
File opened for modification	C:\Program Files\7-Zip\Lang\fr.txt	b80103a60fa68e425a4fd200ca223915.exe
File opened for modification	C:\Program Files\7-Zip\Lang\hy.txt	b80103a60fa68e425a4fd200ca223915.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\en-US\TipRes.dll.mui	b80103a60fa68e425a4fd200ca223915.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ko.txt	b80103a60fa68e425a4fd200ca223915.exe
File opened for modification	C:\Program Files\7-Zip\Lang\lij.txt	b80103a60fa68e425a4fd200ca223915.exe
File opened for modification	C:\Program Files\7-Zip\Lang\uk.txt	b80103a60fa68e425a4fd200ca223915.exe
File opened for modification	C:\Program Files\7-Zip\Lang\an.txt	b80103a60fa68e425a4fd200ca223915.exe
File opened for modification	C:\Program Files\7-Zip\Lang\en.ttt	b80103a60fa68e425a4fd200ca223915.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ku-ckb.txt	b80103a60fa68e425a4fd200ca223915.exe
File opened for modification	C:\Program Files\7-Zip\Lang\si.txt	b80103a60fa68e425a4fd200ca223915.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\zh-changjei.xml	b80103a60fa68e425a4fd200ca223915.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\MSInfo\en-US\msinfo32.exe.mui	b80103a60fa68e425a4fd200ca223915.exe
File opened for modification	C:\Program Files\7-Zip\Lang\fa.txt	b80103a60fa68e425a4fd200ca223915.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\en-US\tipresx.dll.mui	b80103a60fa68e425a4fd200ca223915.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\keypad\keypadbase.xml	b80103a60fa68e425a4fd200ca223915.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\en-US\boxed-split.avi	b80103a60fa68e425a4fd200ca223915.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\osknumpad.xml	b80103a60fa68e425a4fd200ca223915.exe
File opened for modification	C:\Program Files\7-Zip\Lang\pl.txt	b80103a60fa68e425a4fd200ca223915.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ro.txt	b80103a60fa68e425a4fd200ca223915.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\bg-BG\tipresx.dll.mui	b80103a60fa68e425a4fd200ca223915.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\pl-PL\tipresx.dll.mui	b80103a60fa68e425a4fd200ca223915.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ast.txt	b80103a60fa68e425a4fd200ca223915.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\ipsfra.xml	b80103a60fa68e425a4fd200ca223915.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\lt-LT\tipresx.dll.mui	b80103a60fa68e425a4fd200ca223915.exe
File opened for modification	C:\Program Files\7-Zip\7zCon.sfx	b80103a60fa68e425a4fd200ca223915.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\en-US\boxed-join.avi	b80103a60fa68e425a4fd200ca223915.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\nb-NO\tipresx.dll.mui	b80103a60fa68e425a4fd200ca223915.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\ru-RU\tipresx.dll.mui	b80103a60fa68e425a4fd200ca223915.exe
File opened for modification	C:\Program Files\7-Zip\Lang\de.txt	b80103a60fa68e425a4fd200ca223915.exe
File opened for modification	C:\Program Files\7-Zip\Lang\he.txt	b80103a60fa68e425a4fd200ca223915.exe
File opened for modification	C:\Program Files\7-Zip\Lang\mng.txt	b80103a60fa68e425a4fd200ca223915.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ar.txt	b80103a60fa68e425a4fd200ca223915.exe
File opened for modification	C:\Program Files\7-Zip\Lang\lv.txt	b80103a60fa68e425a4fd200ca223915.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\ipssrl.xml	b80103a60fa68e425a4fd200ca223915.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\sk-SK\tipresx.dll.mui	b80103a60fa68e425a4fd200ca223915.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\web.xml	b80103a60fa68e425a4fd200ca223915.exe
File opened for modification	C:\Program Files\7-Zip\Lang\id.txt	b80103a60fa68e425a4fd200ca223915.exe
File opened for modification	C:\Program Files\7-Zip\Lang\sr-spc.txt	b80103a60fa68e425a4fd200ca223915.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskpred.xml	b80103a60fa68e425a4fd200ca223915.exe
File opened for modification	C:\Program Files\7-Zip\Lang\mr.txt	b80103a60fa68e425a4fd200ca223915.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\zh-phonetic.xml	b80103a60fa68e425a4fd200ca223915.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\ipscat.xml	b80103a60fa68e425a4fd200ca223915.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ne.txt	b80103a60fa68e425a4fd200ca223915.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\en-US\InputPersonalization.exe.mui	b80103a60fa68e425a4fd200ca223915.exe
File opened for modification	C:\Program Files\7-Zip\Lang\nb.txt	b80103a60fa68e425a4fd200ca223915.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Program crash 2 IoCs

Processes:

WerFault.exeWerFault.exe

pid pid_target process target process

1012 1464 WerFault.exe b80103a60fa68e425a4fd200ca223915.exe
1692 1504 WerFault.exe b80103a60fa68e425a4fd200ca223915.exe
Delays execution with timeout.exe 2 IoCs
evasion

Processes:

timeout.exetimeout.exe

pid process

848 timeout.exe
1392 timeout.exe
Interacts with shadow copies 2 TTPs 1 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
ransomware

File Deletion
T1107

Inhibit System Recovery
T1490

Processes:

vssadmin.exe

pid process

940 vssadmin.exe

pid	pid_target	process	target process
1012	1464	WerFault.exe	b80103a60fa68e425a4fd200ca223915.exe
1692	1504	WerFault.exe	b80103a60fa68e425a4fd200ca223915.exe

pid	process
848	timeout.exe
1392	timeout.exe

pid	process
940	vssadmin.exe

Suspicious behavior: EnumeratesProcesses 25 IoCs

Processes:

b80103a60fa68e425a4fd200ca223915.exeWerFault.exeb80103a60fa68e425a4fd200ca223915.exeWerFault.exeb80103a60fa68e425a4fd200ca223915.exe

pid	process
1464	b80103a60fa68e425a4fd200ca223915.exe
1464	b80103a60fa68e425a4fd200ca223915.exe
1464	b80103a60fa68e425a4fd200ca223915.exe
1464	b80103a60fa68e425a4fd200ca223915.exe
1464	b80103a60fa68e425a4fd200ca223915.exe
1464	b80103a60fa68e425a4fd200ca223915.exe
1464	b80103a60fa68e425a4fd200ca223915.exe
1012	WerFault.exe
1012	WerFault.exe
1012	WerFault.exe
1012	WerFault.exe
1012	WerFault.exe
1504	b80103a60fa68e425a4fd200ca223915.exe
1504	b80103a60fa68e425a4fd200ca223915.exe
1504	b80103a60fa68e425a4fd200ca223915.exe
1504	b80103a60fa68e425a4fd200ca223915.exe
1504	b80103a60fa68e425a4fd200ca223915.exe
1504	b80103a60fa68e425a4fd200ca223915.exe
1504	b80103a60fa68e425a4fd200ca223915.exe
1692	WerFault.exe
1692	WerFault.exe
1692	WerFault.exe
1692	WerFault.exe
1692	WerFault.exe
1284	b80103a60fa68e425a4fd200ca223915.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

WerFault.exe

pid process

1012 WerFault.exe

pid	process
1012	WerFault.exe

Suspicious use of AdjustPrivilegeToken 50 IoCs

Processes:

b80103a60fa68e425a4fd200ca223915.exevssvc.exeWerFault.exeb80103a60fa68e425a4fd200ca223915.exeWerFault.exewbengine.exeWMIC.exe

description	pid	process
Token: SeDebugPrivilege	1464	b80103a60fa68e425a4fd200ca223915.exe
Token: SeBackupPrivilege	1548	vssvc.exe
Token: SeRestorePrivilege	1548	vssvc.exe
Token: SeAuditPrivilege	1548	vssvc.exe
Token: SeDebugPrivilege	1012	WerFault.exe
Token: SeDebugPrivilege	1504	b80103a60fa68e425a4fd200ca223915.exe
Token: SeDebugPrivilege	1692	WerFault.exe
Token: SeBackupPrivilege	1592	wbengine.exe
Token: SeRestorePrivilege	1592	wbengine.exe
Token: SeSecurityPrivilege	1592	wbengine.exe
Token: SeIncreaseQuotaPrivilege	204	WMIC.exe
Token: SeSecurityPrivilege	204	WMIC.exe
Token: SeTakeOwnershipPrivilege	204	WMIC.exe
Token: SeLoadDriverPrivilege	204	WMIC.exe
Token: SeSystemProfilePrivilege	204	WMIC.exe
Token: SeSystemtimePrivilege	204	WMIC.exe
Token: SeProfSingleProcessPrivilege	204	WMIC.exe
Token: SeIncBasePriorityPrivilege	204	WMIC.exe
Token: SeCreatePagefilePrivilege	204	WMIC.exe
Token: SeBackupPrivilege	204	WMIC.exe
Token: SeRestorePrivilege	204	WMIC.exe
Token: SeShutdownPrivilege	204	WMIC.exe
Token: SeDebugPrivilege	204	WMIC.exe
Token: SeSystemEnvironmentPrivilege	204	WMIC.exe
Token: SeRemoteShutdownPrivilege	204	WMIC.exe
Token: SeUndockPrivilege	204	WMIC.exe
Token: SeManageVolumePrivilege	204	WMIC.exe
Token: 33	204	WMIC.exe
Token: 34	204	WMIC.exe
Token: 35	204	WMIC.exe
Token: SeIncreaseQuotaPrivilege	204	WMIC.exe
Token: SeSecurityPrivilege	204	WMIC.exe
Token: SeTakeOwnershipPrivilege	204	WMIC.exe
Token: SeLoadDriverPrivilege	204	WMIC.exe
Token: SeSystemProfilePrivilege	204	WMIC.exe
Token: SeSystemtimePrivilege	204	WMIC.exe
Token: SeProfSingleProcessPrivilege	204	WMIC.exe
Token: SeIncBasePriorityPrivilege	204	WMIC.exe
Token: SeCreatePagefilePrivilege	204	WMIC.exe
Token: SeBackupPrivilege	204	WMIC.exe
Token: SeRestorePrivilege	204	WMIC.exe
Token: SeShutdownPrivilege	204	WMIC.exe
Token: SeDebugPrivilege	204	WMIC.exe
Token: SeSystemEnvironmentPrivilege	204	WMIC.exe
Token: SeRemoteShutdownPrivilege	204	WMIC.exe
Token: SeUndockPrivilege	204	WMIC.exe
Token: SeManageVolumePrivilege	204	WMIC.exe
Token: 33	204	WMIC.exe
Token: 34	204	WMIC.exe
Token: 35	204	WMIC.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

b80103a60fa68e425a4fd200ca223915.exeb80103a60fa68e425a4fd200ca223915.execmd.exeb80103a60fa68e425a4fd200ca223915.execmd.exeb80103a60fa68e425a4fd200ca223915.exeb80103a60fa68e425a4fd200ca223915.execmd.exe

description	pid	process	target process
PID 528 wrote to memory of 1464	528	b80103a60fa68e425a4fd200ca223915.exe	b80103a60fa68e425a4fd200ca223915.exe
PID 528 wrote to memory of 1464	528	b80103a60fa68e425a4fd200ca223915.exe	b80103a60fa68e425a4fd200ca223915.exe
PID 528 wrote to memory of 1464	528	b80103a60fa68e425a4fd200ca223915.exe	b80103a60fa68e425a4fd200ca223915.exe
PID 528 wrote to memory of 1464	528	b80103a60fa68e425a4fd200ca223915.exe	b80103a60fa68e425a4fd200ca223915.exe
PID 528 wrote to memory of 1464	528	b80103a60fa68e425a4fd200ca223915.exe	b80103a60fa68e425a4fd200ca223915.exe
PID 528 wrote to memory of 1464	528	b80103a60fa68e425a4fd200ca223915.exe	b80103a60fa68e425a4fd200ca223915.exe
PID 528 wrote to memory of 1464	528	b80103a60fa68e425a4fd200ca223915.exe	b80103a60fa68e425a4fd200ca223915.exe
PID 528 wrote to memory of 1464	528	b80103a60fa68e425a4fd200ca223915.exe	b80103a60fa68e425a4fd200ca223915.exe
PID 528 wrote to memory of 1464	528	b80103a60fa68e425a4fd200ca223915.exe	b80103a60fa68e425a4fd200ca223915.exe
PID 1464 wrote to memory of 268	1464	b80103a60fa68e425a4fd200ca223915.exe	cmd.exe
PID 1464 wrote to memory of 268	1464	b80103a60fa68e425a4fd200ca223915.exe	cmd.exe
PID 1464 wrote to memory of 268	1464	b80103a60fa68e425a4fd200ca223915.exe	cmd.exe
PID 1464 wrote to memory of 268	1464	b80103a60fa68e425a4fd200ca223915.exe	cmd.exe
PID 268 wrote to memory of 848	268	cmd.exe	timeout.exe
PID 268 wrote to memory of 848	268	cmd.exe	timeout.exe
PID 268 wrote to memory of 848	268	cmd.exe	timeout.exe
PID 268 wrote to memory of 848	268	cmd.exe	timeout.exe
PID 1464 wrote to memory of 1224	1464	b80103a60fa68e425a4fd200ca223915.exe	b80103a60fa68e425a4fd200ca223915.exe
PID 1464 wrote to memory of 1224	1464	b80103a60fa68e425a4fd200ca223915.exe	b80103a60fa68e425a4fd200ca223915.exe
PID 1464 wrote to memory of 1224	1464	b80103a60fa68e425a4fd200ca223915.exe	b80103a60fa68e425a4fd200ca223915.exe
PID 1464 wrote to memory of 1224	1464	b80103a60fa68e425a4fd200ca223915.exe	b80103a60fa68e425a4fd200ca223915.exe
PID 1464 wrote to memory of 1268	1464	b80103a60fa68e425a4fd200ca223915.exe	b80103a60fa68e425a4fd200ca223915.exe
PID 1464 wrote to memory of 1268	1464	b80103a60fa68e425a4fd200ca223915.exe	b80103a60fa68e425a4fd200ca223915.exe
PID 1464 wrote to memory of 1268	1464	b80103a60fa68e425a4fd200ca223915.exe	b80103a60fa68e425a4fd200ca223915.exe
PID 1464 wrote to memory of 1268	1464	b80103a60fa68e425a4fd200ca223915.exe	b80103a60fa68e425a4fd200ca223915.exe
PID 1464 wrote to memory of 1284	1464	b80103a60fa68e425a4fd200ca223915.exe	b80103a60fa68e425a4fd200ca223915.exe
PID 1464 wrote to memory of 1284	1464	b80103a60fa68e425a4fd200ca223915.exe	b80103a60fa68e425a4fd200ca223915.exe
PID 1464 wrote to memory of 1284	1464	b80103a60fa68e425a4fd200ca223915.exe	b80103a60fa68e425a4fd200ca223915.exe
PID 1464 wrote to memory of 1284	1464	b80103a60fa68e425a4fd200ca223915.exe	b80103a60fa68e425a4fd200ca223915.exe
PID 1464 wrote to memory of 1284	1464	b80103a60fa68e425a4fd200ca223915.exe	b80103a60fa68e425a4fd200ca223915.exe
PID 1464 wrote to memory of 1284	1464	b80103a60fa68e425a4fd200ca223915.exe	b80103a60fa68e425a4fd200ca223915.exe
PID 1464 wrote to memory of 1284	1464	b80103a60fa68e425a4fd200ca223915.exe	b80103a60fa68e425a4fd200ca223915.exe
PID 1464 wrote to memory of 1284	1464	b80103a60fa68e425a4fd200ca223915.exe	b80103a60fa68e425a4fd200ca223915.exe
PID 1464 wrote to memory of 1284	1464	b80103a60fa68e425a4fd200ca223915.exe	b80103a60fa68e425a4fd200ca223915.exe
PID 1464 wrote to memory of 1284	1464	b80103a60fa68e425a4fd200ca223915.exe	b80103a60fa68e425a4fd200ca223915.exe
PID 1284 wrote to memory of 1744	1284	b80103a60fa68e425a4fd200ca223915.exe	cmd.exe
PID 1284 wrote to memory of 1744	1284	b80103a60fa68e425a4fd200ca223915.exe	cmd.exe
PID 1284 wrote to memory of 1744	1284	b80103a60fa68e425a4fd200ca223915.exe	cmd.exe
PID 1284 wrote to memory of 1744	1284	b80103a60fa68e425a4fd200ca223915.exe	cmd.exe
PID 1464 wrote to memory of 1012	1464	b80103a60fa68e425a4fd200ca223915.exe	WerFault.exe
PID 1464 wrote to memory of 1012	1464	b80103a60fa68e425a4fd200ca223915.exe	WerFault.exe
PID 1464 wrote to memory of 1012	1464	b80103a60fa68e425a4fd200ca223915.exe	WerFault.exe
PID 1464 wrote to memory of 1012	1464	b80103a60fa68e425a4fd200ca223915.exe	WerFault.exe
PID 1744 wrote to memory of 940	1744	cmd.exe	vssadmin.exe
PID 1744 wrote to memory of 940	1744	cmd.exe	vssadmin.exe
PID 1744 wrote to memory of 940	1744	cmd.exe	vssadmin.exe
PID 280 wrote to memory of 1504	280	b80103a60fa68e425a4fd200ca223915.exe	b80103a60fa68e425a4fd200ca223915.exe
PID 280 wrote to memory of 1504	280	b80103a60fa68e425a4fd200ca223915.exe	b80103a60fa68e425a4fd200ca223915.exe
PID 280 wrote to memory of 1504	280	b80103a60fa68e425a4fd200ca223915.exe	b80103a60fa68e425a4fd200ca223915.exe
PID 280 wrote to memory of 1504	280	b80103a60fa68e425a4fd200ca223915.exe	b80103a60fa68e425a4fd200ca223915.exe
PID 280 wrote to memory of 1504	280	b80103a60fa68e425a4fd200ca223915.exe	b80103a60fa68e425a4fd200ca223915.exe
PID 280 wrote to memory of 1504	280	b80103a60fa68e425a4fd200ca223915.exe	b80103a60fa68e425a4fd200ca223915.exe
PID 280 wrote to memory of 1504	280	b80103a60fa68e425a4fd200ca223915.exe	b80103a60fa68e425a4fd200ca223915.exe
PID 280 wrote to memory of 1504	280	b80103a60fa68e425a4fd200ca223915.exe	b80103a60fa68e425a4fd200ca223915.exe
PID 280 wrote to memory of 1504	280	b80103a60fa68e425a4fd200ca223915.exe	b80103a60fa68e425a4fd200ca223915.exe
PID 1504 wrote to memory of 1708	1504	b80103a60fa68e425a4fd200ca223915.exe	cmd.exe
PID 1504 wrote to memory of 1708	1504	b80103a60fa68e425a4fd200ca223915.exe	cmd.exe
PID 1504 wrote to memory of 1708	1504	b80103a60fa68e425a4fd200ca223915.exe	cmd.exe
PID 1504 wrote to memory of 1708	1504	b80103a60fa68e425a4fd200ca223915.exe	cmd.exe
PID 1708 wrote to memory of 1392	1708	cmd.exe	timeout.exe
PID 1708 wrote to memory of 1392	1708	cmd.exe	timeout.exe
PID 1708 wrote to memory of 1392	1708	cmd.exe	timeout.exe
PID 1708 wrote to memory of 1392	1708	cmd.exe	timeout.exe
PID 1504 wrote to memory of 1260	1504	b80103a60fa68e425a4fd200ca223915.exe	b80103a60fa68e425a4fd200ca223915.exe

C:\Users\Admin\AppData\Local\Temp\b80103a60fa68e425a4fd200ca223915.exe
"C:\Users\Admin\AppData\Local\Temp\b80103a60fa68e425a4fd200ca223915.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:528

C:\Users\Admin\AppData\Local\Temp\b80103a60fa68e425a4fd200ca223915.exe
"C:\Users\Admin\AppData\Local\Temp\b80103a60fa68e425a4fd200ca223915.exe"
2⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1464

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c timeout 1
3⤵
- Suspicious use of WriteProcessMemory
PID:268

C:\Windows\SysWOW64\timeout.exe
timeout 1
4⤵
- Delays execution with timeout.exe
PID:848

C:\Users\Admin\AppData\Local\Temp\b80103a60fa68e425a4fd200ca223915.exe
"C:\Users\Admin\AppData\Local\Temp\b80103a60fa68e425a4fd200ca223915.exe"
3⤵
PID:1224

C:\Users\Admin\AppData\Local\Temp\b80103a60fa68e425a4fd200ca223915.exe
"C:\Users\Admin\AppData\Local\Temp\b80103a60fa68e425a4fd200ca223915.exe"
3⤵
PID:1268

C:\Users\Admin\AppData\Local\Temp\b80103a60fa68e425a4fd200ca223915.exe
"C:\Users\Admin\AppData\Local\Temp\b80103a60fa68e425a4fd200ca223915.exe"
3⤵
- Adds Run key to start application
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1284

C:\Users\Admin\AppData\Local\Temp\b80103a60fa68e425a4fd200ca223915.exe
"C:\Users\Admin\AppData\Local\Temp\b80103a60fa68e425a4fd200ca223915.exe" n1284
4⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:280

C:\Users\Admin\AppData\Local\Temp\b80103a60fa68e425a4fd200ca223915.exe
"C:\Users\Admin\AppData\Local\Temp\b80103a60fa68e425a4fd200ca223915.exe"
5⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1504

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c timeout 1
6⤵
- Suspicious use of WriteProcessMemory
PID:1708

C:\Windows\SysWOW64\timeout.exe
timeout 1
7⤵
- Delays execution with timeout.exe
PID:1392

C:\Users\Admin\AppData\Local\Temp\b80103a60fa68e425a4fd200ca223915.exe
"C:\Users\Admin\AppData\Local\Temp\b80103a60fa68e425a4fd200ca223915.exe"
6⤵
PID:1260

C:\Users\Admin\AppData\Local\Temp\b80103a60fa68e425a4fd200ca223915.exe
"C:\Users\Admin\AppData\Local\Temp\b80103a60fa68e425a4fd200ca223915.exe"
6⤵
PID:848

C:\Users\Admin\AppData\Local\Temp\b80103a60fa68e425a4fd200ca223915.exe
"C:\Users\Admin\AppData\Local\Temp\b80103a60fa68e425a4fd200ca223915.exe"
6⤵
PID:752

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1504 -s 908
6⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1692

C:\Windows\system32\cmd.exe
"C:\Windows\system32\cmd.exe"
4⤵
- Suspicious use of WriteProcessMemory
PID:1744

C:\Windows\system32\vssadmin.exe
vssadmin delete shadows /all /quiet
5⤵
- Interacts with shadow copies
PID:940

C:\Windows\system32\wbadmin.exe
wbadmin delete catalog -quiet
5⤵
- Deletes backup catalog
PID:956

C:\Windows\System32\Wbem\WMIC.exe
wmic shadowcopy delete
5⤵
- Suspicious use of AdjustPrivilegeToken
PID:204

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1464 -s 876
3⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
PID:1012

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1548

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1592

C:\Windows\System32\vdsldr.exe
C:\Windows\System32\vdsldr.exe -Embedding
1⤵
PID:1368

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
PID:920

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Command-Line Interface

1

T1059

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

File Deletion

3

T1107

Modify Registry

1

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Inhibit System Recovery

3

T1490

Replay Monitor

Loading Replay Monitor...

Downloads

memory/204-48-0x0000000000000000-mapping.dmp

Download
memory/268-12-0x0000000000000000-mapping.dmp

Download
memory/280-18-0x00000000746D0000-0x0000000074DBE000-memory.dmp

Filesize
6.9MB

Download
memory/280-27-0x0000000004DD0000-0x0000000004DD1000-memory.dmp

Filesize
4KB

Download
memory/528-3-0x0000000000170000-0x0000000000171000-memory.dmp

Filesize
4KB

Download
memory/528-5-0x0000000004300000-0x0000000004301000-memory.dmp

Filesize
4KB

Download
memory/528-2-0x0000000074DC0000-0x00000000754AE000-memory.dmp

Filesize
6.9MB

Download
memory/528-11-0x00000000002C0000-0x00000000002C1000-memory.dmp

Filesize
4KB

Download
memory/752-36-0x0000000000405790-mapping.dmp

Download
memory/848-13-0x0000000000000000-mapping.dmp

Download
memory/940-22-0x0000000000000000-mapping.dmp

Download
memory/956-47-0x000007FEFC3C1000-0x000007FEFC3C3000-memory.dmp

Filesize
8KB

Download
memory/956-46-0x0000000000000000-mapping.dmp

Download
memory/1012-21-0x0000000000000000-mapping.dmp

Download
memory/1012-23-0x0000000002200000-0x0000000002211000-memory.dmp

Filesize
68KB

Download
memory/1012-42-0x0000000000250000-0x0000000000251000-memory.dmp

Filesize
4KB

Download
memory/1284-25-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/1284-16-0x0000000075D01000-0x0000000075D03000-memory.dmp

Filesize
8KB

Download
memory/1284-14-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/1284-15-0x0000000000405790-mapping.dmp

Download
memory/1392-34-0x0000000000000000-mapping.dmp

Download
memory/1464-9-0x0000000010000000-0x0000000010020000-memory.dmp

Filesize
128KB

Download
memory/1464-8-0x00000000746D0000-0x0000000074DBE000-memory.dmp

Filesize
6.9MB

Download
memory/1464-7-0x000000001001A22E-mapping.dmp

Download
memory/1464-24-0x0000000005430000-0x0000000005431000-memory.dmp

Filesize
4KB

Download
memory/1464-6-0x0000000010000000-0x0000000010020000-memory.dmp

Filesize
128KB

Download
memory/1504-29-0x00000000746D0000-0x0000000074DBE000-memory.dmp

Filesize
6.9MB

Download
memory/1504-43-0x00000000041B0000-0x00000000041B1000-memory.dmp

Filesize
4KB

Download
memory/1504-28-0x000000001001A22E-mapping.dmp

Download
memory/1692-38-0x0000000000000000-mapping.dmp

Download
memory/1692-39-0x0000000001CC0000-0x0000000001CD1000-memory.dmp

Filesize
68KB

Download
memory/1692-45-0x00000000003A0000-0x00000000003A1000-memory.dmp

Filesize
4KB

Download
memory/1708-33-0x0000000000000000-mapping.dmp

Download
memory/1744-17-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads