Analysis
-
max time kernel
145s -
max time network
124s -
platform
windows7_x64 -
resource
win7-en-20211208 -
submitted
05-03-2022 20:53
Static task
static1
Behavioral task
behavioral1
Sample
c4b59e78c8f04caf59609f10f1f6ced44efc76384656a86de6d81dcab2d5acbd.exe
Resource
win7-en-20211208
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
c4b59e78c8f04caf59609f10f1f6ced44efc76384656a86de6d81dcab2d5acbd.exe
Resource
win10v2004-en-20220113
windows10-2004_x64
0 signatures
0 seconds
General
-
Target
c4b59e78c8f04caf59609f10f1f6ced44efc76384656a86de6d81dcab2d5acbd.exe
-
Size
450KB
-
MD5
064f9bb166e2d273804e8e9465afc030
-
SHA1
d0ded8463d2f4b9533e6b894dc03bc0095c172ae
-
SHA256
c4b59e78c8f04caf59609f10f1f6ced44efc76384656a86de6d81dcab2d5acbd
-
SHA512
f120fcac42e9205cf82cb6f48cc0566a2f0609a366c83351f74f38ba9de7e60a263e1771dffa4b4dc9f1c26ab648bb52f0dff5d12c68d26db9eb3a7c7c0a32de
Score
10/10
Malware Config
Extracted
Path
C:\Users\Admin\AppData\Local\Temp\readme-warning.txt
Family
makop
Ransom Note
::: Greetings :::
Little FAQ:
.1.
Q: Whats Happen?
A: Your files have been encrypted and now have the "fair" extension. The file structure was not damaged, we did everything possible so that this could not happen.
.2.
Q: How to recover files?
A: If you wish to decrypt your files you will need to pay in bitcoins.
.3.
Q: What about guarantees?
A: Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will cooperate with us. Its not in our interests.
To check the ability of returning files, you can send to us any 2 files with SIMPLE extensions(jpg,xls,doc, etc... not databases!) and low sizes(max 1 mb), we will decrypt them and send back to you. That is our guarantee.
.4.
Q: How to contact with you?
A: You can write us to our mailbox: [email protected]
.5.
Q: How will the decryption process proceed after payment?
A: After payment we will send to you our scanner-decoder program and detailed instructions for use. With this program you will be able to decrypt all your encrypted files.
.6.
Q: If I don�t want to pay bad people like you?
A: If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause only we have the private key. In practice - time is much more valuable than money.
:::BEWARE:::
DON'T try to change encrypted files by yourself!
If you will try to use any third party software for restoring your data or antivirus solutions - please make a backup for all encrypted files!
Any changes in encrypted files may entail damage of the private key and, as result, the loss all data.
Emails
Signatures
-
Makop
Ransomware family discovered by @VK_Intel in early 2020.
-
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
pid Process 1112 wbadmin.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2329389628-4064185017-3901522362-1000\Software\Microsoft\Windows\CurrentVersion\Run\1 = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\c4b59e78c8f04caf59609f10f1f6ced44efc76384656a86de6d81dcab2d5acbd.exe\"" c4b59e78c8f04caf59609f10f1f6ced44efc76384656a86de6d81dcab2d5acbd.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs
-
Suspicious use of SetThreadContext 3 IoCs
description pid Process procid_target PID 1192 set thread context of 1684 1192 c4b59e78c8f04caf59609f10f1f6ced44efc76384656a86de6d81dcab2d5acbd.exe 27 PID 1380 set thread context of 1648 1380 c4b59e78c8f04caf59609f10f1f6ced44efc76384656a86de6d81dcab2d5acbd.exe 34 PID 1732 set thread context of 2004 1732 c4b59e78c8f04caf59609f10f1f6ced44efc76384656a86de6d81dcab2d5acbd.exe 47 -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\turnOffNotificationInAcrobat.gif.[AC69BFEE].[[email protected]].fair c4b59e78c8f04caf59609f10f1f6ced44efc76384656a86de6d81dcab2d5acbd.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0153516.WMF c4b59e78c8f04caf59609f10f1f6ced44efc76384656a86de6d81dcab2d5acbd.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\Publisher\Backgrounds\WB02201_.GIF c4b59e78c8f04caf59609f10f1f6ced44efc76384656a86de6d81dcab2d5acbd.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\FORMS\1033\MMSS.ICO c4b59e78c8f04caf59609f10f1f6ced44efc76384656a86de6d81dcab2d5acbd.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\th-TH\tipresx.dll.mui c4b59e78c8f04caf59609f10f1f6ced44efc76384656a86de6d81dcab2d5acbd.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.browser.attach.zh_CN_5.5.0.165303.jar c4b59e78c8f04caf59609f10f1f6ced44efc76384656a86de6d81dcab2d5acbd.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\email_initiator.gif c4b59e78c8f04caf59609f10f1f6ced44efc76384656a86de6d81dcab2d5acbd.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\Providers\Proximity\11.00\can.hyp.[AC69BFEE].[[email protected]].fair c4b59e78c8f04caf59609f10f1f6ced44efc76384656a86de6d81dcab2d5acbd.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\FORMS\1033\CONTACTS.ICO c4b59e78c8f04caf59609f10f1f6ced44efc76384656a86de6d81dcab2d5acbd.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\BL00234_.WMF c4b59e78c8f04caf59609f10f1f6ced44efc76384656a86de6d81dcab2d5acbd.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0282928.WMF c4b59e78c8f04caf59609f10f1f6ced44efc76384656a86de6d81dcab2d5acbd.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\TN00014_.WMF c4b59e78c8f04caf59609f10f1f6ced44efc76384656a86de6d81dcab2d5acbd.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\en-US\boxed-join.avi c4b59e78c8f04caf59609f10f1f6ced44efc76384656a86de6d81dcab2d5acbd.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\OldAge\NavigationLeft_SelectionSubpicture.png c4b59e78c8f04caf59609f10f1f6ced44efc76384656a86de6d81dcab2d5acbd.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-options-api_ja.jar c4b59e78c8f04caf59609f10f1f6ced44efc76384656a86de6d81dcab2d5acbd.exe File opened for modification C:\Program Files\Microsoft Games\Purble Place\PurblePlaceMCE.lnk c4b59e78c8f04caf59609f10f1f6ced44efc76384656a86de6d81dcab2d5acbd.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\de-DE\js\settings.js c4b59e78c8f04caf59609f10f1f6ced44efc76384656a86de6d81dcab2d5acbd.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\WB01839_.GIF c4b59e78c8f04caf59609f10f1f6ced44efc76384656a86de6d81dcab2d5acbd.exe File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD21399_.GIF c4b59e78c8f04caf59609f10f1f6ced44efc76384656a86de6d81dcab2d5acbd.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\POWERPNT_K_COL.HXK c4b59e78c8f04caf59609f10f1f6ced44efc76384656a86de6d81dcab2d5acbd.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\InfoPathOM\Microsoft.Office.InfoPath.xml c4b59e78c8f04caf59609f10f1f6ced44efc76384656a86de6d81dcab2d5acbd.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Rectangles\NavigationUp_ButtonGraphic.png c4b59e78c8f04caf59609f10f1f6ced44efc76384656a86de6d81dcab2d5acbd.exe File opened for modification C:\Program Files\Microsoft Games\Multiplayer\Backgammon\en-US\bckgRes.dll.mui c4b59e78c8f04caf59609f10f1f6ced44efc76384656a86de6d81dcab2d5acbd.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\DD01629_.WMF c4b59e78c8f04caf59609f10f1f6ced44efc76384656a86de6d81dcab2d5acbd.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\NA02439_.WMF c4b59e78c8f04caf59609f10f1f6ced44efc76384656a86de6d81dcab2d5acbd.exe File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\CAGCAT10\J0212661.WMF c4b59e78c8f04caf59609f10f1f6ced44efc76384656a86de6d81dcab2d5acbd.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\FORMS\1033\OOFTMPL.CFG c4b59e78c8f04caf59609f10f1f6ced44efc76384656a86de6d81dcab2d5acbd.exe File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\Images\timer_down.png c4b59e78c8f04caf59609f10f1f6ced44efc76384656a86de6d81dcab2d5acbd.exe File opened for modification C:\Program Files\Common Files\System\msadc\de-DE\msadcfr.dll.mui c4b59e78c8f04caf59609f10f1f6ced44efc76384656a86de6d81dcab2d5acbd.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\London c4b59e78c8f04caf59609f10f1f6ced44efc76384656a86de6d81dcab2d5acbd.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.feature_3.9.0.v20140827-1444\feature.xml c4b59e78c8f04caf59609f10f1f6ced44efc76384656a86de6d81dcab2d5acbd.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\DVA.api c4b59e78c8f04caf59609f10f1f6ced44efc76384656a86de6d81dcab2d5acbd.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\BL00008_.WMF c4b59e78c8f04caf59609f10f1f6ced44efc76384656a86de6d81dcab2d5acbd.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0321179.JPG c4b59e78c8f04caf59609f10f1f6ced44efc76384656a86de6d81dcab2d5acbd.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\PE02120_.WMF c4b59e78c8f04caf59609f10f1f6ced44efc76384656a86de6d81dcab2d5acbd.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\LABEL.XML c4b59e78c8f04caf59609f10f1f6ced44efc76384656a86de6d81dcab2d5acbd.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Stationery\1033\TECHTOOL.HTM c4b59e78c8f04caf59609f10f1f6ced44efc76384656a86de6d81dcab2d5acbd.exe File opened for modification C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\VSTA\ItemTemplates\VisualBasic\1033\Text.zip c4b59e78c8f04caf59609f10f1f6ced44efc76384656a86de6d81dcab2d5acbd.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\MyriadPro-Regular.otf.[AC69BFEE].[[email protected]].fair c4b59e78c8f04caf59609f10f1f6ced44efc76384656a86de6d81dcab2d5acbd.exe File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\Images\settings_left_hover.png c4b59e78c8f04caf59609f10f1f6ced44efc76384656a86de6d81dcab2d5acbd.exe File created C:\Program Files\Microsoft Games\SpiderSolitaire\fr-FR\readme-warning.txt c4b59e78c8f04caf59609f10f1f6ced44efc76384656a86de6d81dcab2d5acbd.exe File created C:\Program Files\VideoLAN\VLC\locale\ne\LC_MESSAGES\readme-warning.txt c4b59e78c8f04caf59609f10f1f6ced44efc76384656a86de6d81dcab2d5acbd.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\PFM\zy______.pfm c4b59e78c8f04caf59609f10f1f6ced44efc76384656a86de6d81dcab2d5acbd.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\Publisher\Backgrounds\WB02073_.GIF c4b59e78c8f04caf59609f10f1f6ced44efc76384656a86de6d81dcab2d5acbd.exe File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\AUTOSHAP\BD18228_.WMF c4b59e78c8f04caf59609f10f1f6ced44efc76384656a86de6d81dcab2d5acbd.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\GRPHFLT\EPSIMP32.FLT c4b59e78c8f04caf59609f10f1f6ced44efc76384656a86de6d81dcab2d5acbd.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\ko-KR\tipresx.dll.mui c4b59e78c8f04caf59609f10f1f6ced44efc76384656a86de6d81dcab2d5acbd.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\deploy\messages_es.properties c4b59e78c8f04caf59609f10f1f6ced44efc76384656a86de6d81dcab2d5acbd.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\update_tracking\org-netbeans-lib-profiler.xml c4b59e78c8f04caf59609f10f1f6ced44efc76384656a86de6d81dcab2d5acbd.exe File opened for modification C:\Program Files\Java\jre7\lib\resources.jar c4b59e78c8f04caf59609f10f1f6ced44efc76384656a86de6d81dcab2d5acbd.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\bl.gif c4b59e78c8f04caf59609f10f1f6ced44efc76384656a86de6d81dcab2d5acbd.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\EST5EDT c4b59e78c8f04caf59609f10f1f6ced44efc76384656a86de6d81dcab2d5acbd.exe File created C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\DEEPBLUE\readme-warning.txt c4b59e78c8f04caf59609f10f1f6ced44efc76384656a86de6d81dcab2d5acbd.exe File opened for modification C:\Program Files (x86)\Common Files\System\ado\msado27.tlb c4b59e78c8f04caf59609f10f1f6ced44efc76384656a86de6d81dcab2d5acbd.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\LINEACT.POC c4b59e78c8f04caf59609f10f1f6ced44efc76384656a86de6d81dcab2d5acbd.exe File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\Clock.Gadget\en-US\css\clock.css c4b59e78c8f04caf59609f10f1f6ced44efc76384656a86de6d81dcab2d5acbd.exe File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\Clock.Gadget\es-ES\gadget.xml c4b59e78c8f04caf59609f10f1f6ced44efc76384656a86de6d81dcab2d5acbd.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Etc\GMT+12 c4b59e78c8f04caf59609f10f1f6ced44efc76384656a86de6d81dcab2d5acbd.exe File created C:\Program Files\VideoLAN\VLC\locale\nn\LC_MESSAGES\readme-warning.txt c4b59e78c8f04caf59609f10f1f6ced44efc76384656a86de6d81dcab2d5acbd.exe File opened for modification C:\Program Files\Windows Journal\Templates\Shorthand.jtp c4b59e78c8f04caf59609f10f1f6ced44efc76384656a86de6d81dcab2d5acbd.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\turnOnNotificationInTray.gif c4b59e78c8f04caf59609f10f1f6ced44efc76384656a86de6d81dcab2d5acbd.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\Lime\TAB_OFF.GIF c4b59e78c8f04caf59609f10f1f6ced44efc76384656a86de6d81dcab2d5acbd.exe File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD21304_.GIF c4b59e78c8f04caf59609f10f1f6ced44efc76384656a86de6d81dcab2d5acbd.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms\bg_VelvetRose.gif c4b59e78c8f04caf59609f10f1f6ced44efc76384656a86de6d81dcab2d5acbd.exe -
Interacts with shadow copies 2 TTPs 1 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
pid Process 1672 vssadmin.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 1684 c4b59e78c8f04caf59609f10f1f6ced44efc76384656a86de6d81dcab2d5acbd.exe -
Suspicious use of AdjustPrivilegeToken 46 IoCs
description pid Process Token: SeBackupPrivilege 1660 vssvc.exe Token: SeRestorePrivilege 1660 vssvc.exe Token: SeAuditPrivilege 1660 vssvc.exe Token: SeBackupPrivilege 648 wbengine.exe Token: SeRestorePrivilege 648 wbengine.exe Token: SeSecurityPrivilege 648 wbengine.exe Token: SeIncreaseQuotaPrivilege 1632 WMIC.exe Token: SeSecurityPrivilege 1632 WMIC.exe Token: SeTakeOwnershipPrivilege 1632 WMIC.exe Token: SeLoadDriverPrivilege 1632 WMIC.exe Token: SeSystemProfilePrivilege 1632 WMIC.exe Token: SeSystemtimePrivilege 1632 WMIC.exe Token: SeProfSingleProcessPrivilege 1632 WMIC.exe Token: SeIncBasePriorityPrivilege 1632 WMIC.exe Token: SeCreatePagefilePrivilege 1632 WMIC.exe Token: SeBackupPrivilege 1632 WMIC.exe Token: SeRestorePrivilege 1632 WMIC.exe Token: SeShutdownPrivilege 1632 WMIC.exe Token: SeDebugPrivilege 1632 WMIC.exe Token: SeSystemEnvironmentPrivilege 1632 WMIC.exe Token: SeRemoteShutdownPrivilege 1632 WMIC.exe Token: SeUndockPrivilege 1632 WMIC.exe Token: SeManageVolumePrivilege 1632 WMIC.exe Token: 33 1632 WMIC.exe Token: 34 1632 WMIC.exe Token: 35 1632 WMIC.exe Token: SeIncreaseQuotaPrivilege 1632 WMIC.exe Token: SeSecurityPrivilege 1632 WMIC.exe Token: SeTakeOwnershipPrivilege 1632 WMIC.exe Token: SeLoadDriverPrivilege 1632 WMIC.exe Token: SeSystemProfilePrivilege 1632 WMIC.exe Token: SeSystemtimePrivilege 1632 WMIC.exe Token: SeProfSingleProcessPrivilege 1632 WMIC.exe Token: SeIncBasePriorityPrivilege 1632 WMIC.exe Token: SeCreatePagefilePrivilege 1632 WMIC.exe Token: SeBackupPrivilege 1632 WMIC.exe Token: SeRestorePrivilege 1632 WMIC.exe Token: SeShutdownPrivilege 1632 WMIC.exe Token: SeDebugPrivilege 1632 WMIC.exe Token: SeSystemEnvironmentPrivilege 1632 WMIC.exe Token: SeRemoteShutdownPrivilege 1632 WMIC.exe Token: SeUndockPrivilege 1632 WMIC.exe Token: SeManageVolumePrivilege 1632 WMIC.exe Token: 33 1632 WMIC.exe Token: 34 1632 WMIC.exe Token: 35 1632 WMIC.exe -
Suspicious use of WriteProcessMemory 43 IoCs
description pid Process procid_target PID 1192 wrote to memory of 1684 1192 c4b59e78c8f04caf59609f10f1f6ced44efc76384656a86de6d81dcab2d5acbd.exe 27 PID 1192 wrote to memory of 1684 1192 c4b59e78c8f04caf59609f10f1f6ced44efc76384656a86de6d81dcab2d5acbd.exe 27 PID 1192 wrote to memory of 1684 1192 c4b59e78c8f04caf59609f10f1f6ced44efc76384656a86de6d81dcab2d5acbd.exe 27 PID 1192 wrote to memory of 1684 1192 c4b59e78c8f04caf59609f10f1f6ced44efc76384656a86de6d81dcab2d5acbd.exe 27 PID 1192 wrote to memory of 1684 1192 c4b59e78c8f04caf59609f10f1f6ced44efc76384656a86de6d81dcab2d5acbd.exe 27 PID 1192 wrote to memory of 1684 1192 c4b59e78c8f04caf59609f10f1f6ced44efc76384656a86de6d81dcab2d5acbd.exe 27 PID 1192 wrote to memory of 1684 1192 c4b59e78c8f04caf59609f10f1f6ced44efc76384656a86de6d81dcab2d5acbd.exe 27 PID 1192 wrote to memory of 1684 1192 c4b59e78c8f04caf59609f10f1f6ced44efc76384656a86de6d81dcab2d5acbd.exe 27 PID 1192 wrote to memory of 1684 1192 c4b59e78c8f04caf59609f10f1f6ced44efc76384656a86de6d81dcab2d5acbd.exe 27 PID 1192 wrote to memory of 1684 1192 c4b59e78c8f04caf59609f10f1f6ced44efc76384656a86de6d81dcab2d5acbd.exe 27 PID 1684 wrote to memory of 1384 1684 c4b59e78c8f04caf59609f10f1f6ced44efc76384656a86de6d81dcab2d5acbd.exe 29 PID 1684 wrote to memory of 1384 1684 c4b59e78c8f04caf59609f10f1f6ced44efc76384656a86de6d81dcab2d5acbd.exe 29 PID 1684 wrote to memory of 1384 1684 c4b59e78c8f04caf59609f10f1f6ced44efc76384656a86de6d81dcab2d5acbd.exe 29 PID 1684 wrote to memory of 1384 1684 c4b59e78c8f04caf59609f10f1f6ced44efc76384656a86de6d81dcab2d5acbd.exe 29 PID 1384 wrote to memory of 1672 1384 cmd.exe 31 PID 1384 wrote to memory of 1672 1384 cmd.exe 31 PID 1384 wrote to memory of 1672 1384 cmd.exe 31 PID 1380 wrote to memory of 1648 1380 c4b59e78c8f04caf59609f10f1f6ced44efc76384656a86de6d81dcab2d5acbd.exe 34 PID 1380 wrote to memory of 1648 1380 c4b59e78c8f04caf59609f10f1f6ced44efc76384656a86de6d81dcab2d5acbd.exe 34 PID 1380 wrote to memory of 1648 1380 c4b59e78c8f04caf59609f10f1f6ced44efc76384656a86de6d81dcab2d5acbd.exe 34 PID 1380 wrote to memory of 1648 1380 c4b59e78c8f04caf59609f10f1f6ced44efc76384656a86de6d81dcab2d5acbd.exe 34 PID 1380 wrote to memory of 1648 1380 c4b59e78c8f04caf59609f10f1f6ced44efc76384656a86de6d81dcab2d5acbd.exe 34 PID 1380 wrote to memory of 1648 1380 c4b59e78c8f04caf59609f10f1f6ced44efc76384656a86de6d81dcab2d5acbd.exe 34 PID 1380 wrote to memory of 1648 1380 c4b59e78c8f04caf59609f10f1f6ced44efc76384656a86de6d81dcab2d5acbd.exe 34 PID 1380 wrote to memory of 1648 1380 c4b59e78c8f04caf59609f10f1f6ced44efc76384656a86de6d81dcab2d5acbd.exe 34 PID 1380 wrote to memory of 1648 1380 c4b59e78c8f04caf59609f10f1f6ced44efc76384656a86de6d81dcab2d5acbd.exe 34 PID 1380 wrote to memory of 1648 1380 c4b59e78c8f04caf59609f10f1f6ced44efc76384656a86de6d81dcab2d5acbd.exe 34 PID 1384 wrote to memory of 1112 1384 cmd.exe 35 PID 1384 wrote to memory of 1112 1384 cmd.exe 35 PID 1384 wrote to memory of 1112 1384 cmd.exe 35 PID 1384 wrote to memory of 1632 1384 cmd.exe 39 PID 1384 wrote to memory of 1632 1384 cmd.exe 39 PID 1384 wrote to memory of 1632 1384 cmd.exe 39 PID 1732 wrote to memory of 2004 1732 c4b59e78c8f04caf59609f10f1f6ced44efc76384656a86de6d81dcab2d5acbd.exe 47 PID 1732 wrote to memory of 2004 1732 c4b59e78c8f04caf59609f10f1f6ced44efc76384656a86de6d81dcab2d5acbd.exe 47 PID 1732 wrote to memory of 2004 1732 c4b59e78c8f04caf59609f10f1f6ced44efc76384656a86de6d81dcab2d5acbd.exe 47 PID 1732 wrote to memory of 2004 1732 c4b59e78c8f04caf59609f10f1f6ced44efc76384656a86de6d81dcab2d5acbd.exe 47 PID 1732 wrote to memory of 2004 1732 c4b59e78c8f04caf59609f10f1f6ced44efc76384656a86de6d81dcab2d5acbd.exe 47 PID 1732 wrote to memory of 2004 1732 c4b59e78c8f04caf59609f10f1f6ced44efc76384656a86de6d81dcab2d5acbd.exe 47 PID 1732 wrote to memory of 2004 1732 c4b59e78c8f04caf59609f10f1f6ced44efc76384656a86de6d81dcab2d5acbd.exe 47 PID 1732 wrote to memory of 2004 1732 c4b59e78c8f04caf59609f10f1f6ced44efc76384656a86de6d81dcab2d5acbd.exe 47 PID 1732 wrote to memory of 2004 1732 c4b59e78c8f04caf59609f10f1f6ced44efc76384656a86de6d81dcab2d5acbd.exe 47 PID 1732 wrote to memory of 2004 1732 c4b59e78c8f04caf59609f10f1f6ced44efc76384656a86de6d81dcab2d5acbd.exe 47
Processes
-
C:\Users\Admin\AppData\Local\Temp\c4b59e78c8f04caf59609f10f1f6ced44efc76384656a86de6d81dcab2d5acbd.exe"C:\Users\Admin\AppData\Local\Temp\c4b59e78c8f04caf59609f10f1f6ced44efc76384656a86de6d81dcab2d5acbd.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1192 -
C:\Users\Admin\AppData\Local\Temp\c4b59e78c8f04caf59609f10f1f6ced44efc76384656a86de6d81dcab2d5acbd.exe"C:\Users\Admin\AppData\Local\Temp\c4b59e78c8f04caf59609f10f1f6ced44efc76384656a86de6d81dcab2d5acbd.exe"2⤵
- Adds Run key to start application
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1684 -
C:\Users\Admin\AppData\Local\Temp\c4b59e78c8f04caf59609f10f1f6ced44efc76384656a86de6d81dcab2d5acbd.exe"C:\Users\Admin\AppData\Local\Temp\c4b59e78c8f04caf59609f10f1f6ced44efc76384656a86de6d81dcab2d5acbd.exe" n16843⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1380 -
C:\Users\Admin\AppData\Local\Temp\c4b59e78c8f04caf59609f10f1f6ced44efc76384656a86de6d81dcab2d5acbd.exe"C:\Users\Admin\AppData\Local\Temp\c4b59e78c8f04caf59609f10f1f6ced44efc76384656a86de6d81dcab2d5acbd.exe"4⤵PID:1648
-
-
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe"3⤵
- Suspicious use of WriteProcessMemory
PID:1384 -
C:\Windows\system32\vssadmin.exevssadmin delete shadows /all /quiet4⤵
- Interacts with shadow copies
PID:1672
-
-
C:\Windows\system32\wbadmin.exewbadmin delete catalog -quiet4⤵
- Deletes backup catalog
PID:1112
-
-
C:\Windows\System32\Wbem\WMIC.exewmic shadowcopy delete4⤵
- Suspicious use of AdjustPrivilegeToken
PID:1632
-
-
-
C:\Users\Admin\AppData\Local\Temp\c4b59e78c8f04caf59609f10f1f6ced44efc76384656a86de6d81dcab2d5acbd.exe"C:\Users\Admin\AppData\Local\Temp\c4b59e78c8f04caf59609f10f1f6ced44efc76384656a86de6d81dcab2d5acbd.exe" n16843⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1732 -
C:\Users\Admin\AppData\Local\Temp\c4b59e78c8f04caf59609f10f1f6ced44efc76384656a86de6d81dcab2d5acbd.exe"C:\Users\Admin\AppData\Local\Temp\c4b59e78c8f04caf59609f10f1f6ced44efc76384656a86de6d81dcab2d5acbd.exe"4⤵PID:2004
-
-
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1660
-
C:\Windows\system32\wbengine.exe"C:\Windows\system32\wbengine.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
PID:648
-
C:\Windows\System32\vdsldr.exeC:\Windows\System32\vdsldr.exe -Embedding1⤵PID:2028
-
C:\Windows\System32\vds.exeC:\Windows\System32\vds.exe1⤵PID:1704