makop | 45f51b31a00c9ce48e8aba64482b953186fbe57431e383297a83000255fb0bb4

Analysis

max time kernel
4294211s
max time network
123s
platform
windows7_x64
resource
win7-20220223-en
submitted
06-03-2022 02:15

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

45f51b31a00c9ce48e8aba64482b953186fbe57431e383297a83000255fb0bb4.exe
Size

644KB
MD5

3f0f88f7b35eaa5d34fddb6928866d08
SHA1

b7d63fbc6bb0ab24b42f8d041346cec7988c9342
SHA256

45f51b31a00c9ce48e8aba64482b953186fbe57431e383297a83000255fb0bb4
SHA512

bdc295d02a7686e879ed3f3e17fb059146c6cef35c6f16fdc12c2355c1501f35c164fe8a8ceeb5733aac2a7fff3fc76a16622e022c096552aec86e48ddc6fa71

Score

10^/10

makop persistence ransomware spyware stealer

Malware Config

Extracted

Path

C:\Users\Admin\AppData\Local\Temp\3701988625\readme-warning.txt

Family

makop

Ransom Note

::: Greetings ::: Little FAQ: .1. Q: Whats Happen? A: Your files have been encrypted and now have the "fair" extension. The file structure was not damaged, we did everything possible so that this could not happen. .2. Q: How to recover files? A: If you wish to decrypt your files you will need to pay in bitcoins. .3. Q: What about guarantees? A: Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will cooperate with us. Its not in our interests. To check the ability of returning files, you can send to us any 2 files with SIMPLE extensions(jpg,xls,doc, etc... not databases!) and low sizes(max 1 mb), we will decrypt them and send back to you. That is our guarantee. .4. Q: How to contact with you? A: You can write us to our mailbox: [email protected] .5. Q: How will the decryption process proceed after payment? A: After payment we will send to you our scanner-decoder program and detailed instructions for use. With this program you will be able to decrypt all your encrypted files. .6. Q: If I don�t want to pay bad people like you? A: If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause only we have the private key. In practice - time is much more valuable than money. :::BEWARE::: DON'T try to change encrypted files by yourself! If you will try to use any third party software for restoring your data or antivirus solutions - please make a backup for all encrypted files! Any changes in encrypted files may entail damage of the private key and, as result, the loss all data.

Emails

[email protected]

Signatures

Makop
Ransomware family discovered by @VK_Intel in early 2020.
ransomware makop
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware

File Deletion
T1107

Inhibit System Recovery
T1490

Deletes backup catalog 3 TTPs 1 IoCs

Uses wbadmin.exe to inhibit system recovery.

ransomware

Command-Line Interface

T1059

File Deletion

T1107

Inhibit System Recovery

T1490

pid	Process
1284	wbadmin.exe

Modifies extensions of user files 1 IoCs

Ransomware generally changes the extension on encrypted files.

ransomware

description	ioc	Process
File opened for modification	C:\Users\Admin\Pictures\ResumeReceive.tiff	45f51b31a00c9ce48e8aba64482b953186fbe57431e383297a83000255fb0bb4.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1405931862-909307831-4085185274-1000\Software\Microsoft\Windows\CurrentVersion\Run\1 = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\45f51b31a00c9ce48e8aba64482b953186fbe57431e383297a83000255fb0bb4.exe\""	45f51b31a00c9ce48e8aba64482b953186fbe57431e383297a83000255fb0bb4.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102

Suspicious use of SetThreadContext 4 IoCs

description	pid	Process	procid_target
PID 1112 set thread context of 1120	1112	45f51b31a00c9ce48e8aba64482b953186fbe57431e383297a83000255fb0bb4.exe	27
PID 900 set thread context of 1648	900	45f51b31a00c9ce48e8aba64482b953186fbe57431e383297a83000255fb0bb4.exe	34
PID 1612 set thread context of 1584	1612	45f51b31a00c9ce48e8aba64482b953186fbe57431e383297a83000255fb0bb4.exe	47
PID 1648 set thread context of 1352	1648	45f51b31a00c9ce48e8aba64482b953186fbe57431e383297a83000255fb0bb4.exe	49

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jre7\lib\zi\EST5EDT	45f51b31a00c9ce48e8aba64482b953186fbe57431e383297a83000255fb0bb4.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\de-DE\picturePuzzle.html	45f51b31a00c9ce48e8aba64482b953186fbe57431e383297a83000255fb0bb4.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\images\120DPI\(120DPI)notConnectedStateIcon.png	45f51b31a00c9ce48e8aba64482b953186fbe57431e383297a83000255fb0bb4.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Etc\UTC	45f51b31a00c9ce48e8aba64482b953186fbe57431e383297a83000255fb0bb4.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\BL00392_.WMF	45f51b31a00c9ce48e8aba64482b953186fbe57431e383297a83000255fb0bb4.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Templates\1033\FiveRules.potx	45f51b31a00c9ce48e8aba64482b953186fbe57431e383297a83000255fb0bb4.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\en-US\css\picturePuzzle.css	45f51b31a00c9ce48e8aba64482b953186fbe57431e383297a83000255fb0bb4.exe
File opened for modification	C:\Program Files\Java\jre7\lib\zi\Etc\GMT-2	45f51b31a00c9ce48e8aba64482b953186fbe57431e383297a83000255fb0bb4.exe
File opened for modification	C:\Program Files\Windows Mail\fr-FR\WinMail.exe.mui	45f51b31a00c9ce48e8aba64482b953186fbe57431e383297a83000255fb0bb4.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\STRBRST.POC	45f51b31a00c9ce48e8aba64482b953186fbe57431e383297a83000255fb0bb4.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\playlist\anevia_streams.luac	45f51b31a00c9ce48e8aba64482b953186fbe57431e383297a83000255fb0bb4.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\CASCADE\THMBNAIL.PNG	45f51b31a00c9ce48e8aba64482b953186fbe57431e383297a83000255fb0bb4.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\EN00397_.WMF	45f51b31a00c9ce48e8aba64482b953186fbe57431e383297a83000255fb0bb4.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0187851.WMF	45f51b31a00c9ce48e8aba64482b953186fbe57431e383297a83000255fb0bb4.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Templates\1033\OrielMergeFax.Dotx	45f51b31a00c9ce48e8aba64482b953186fbe57431e383297a83000255fb0bb4.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\Providers\Proximity\11.00\usa.fca.[CD3D4E5C].[[email protected]].fair	45f51b31a00c9ce48e8aba64482b953186fbe57431e383297a83000255fb0bb4.exe
File opened for modification	C:\Program Files\Java\jre7\lib\zi\SystemV\PST8	45f51b31a00c9ce48e8aba64482b953186fbe57431e383297a83000255fb0bb4.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\be\LC_MESSAGES\vlc.mo	45f51b31a00c9ce48e8aba64482b953186fbe57431e383297a83000255fb0bb4.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\zh_TW\LC_MESSAGES\vlc.mo	45f51b31a00c9ce48e8aba64482b953186fbe57431e383297a83000255fb0bb4.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\DD01772_.WMF	45f51b31a00c9ce48e8aba64482b953186fbe57431e383297a83000255fb0bb4.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0150861.WMF	45f51b31a00c9ce48e8aba64482b953186fbe57431e383297a83000255fb0bb4.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Document Themes 14\Theme Colors\Apex.xml	45f51b31a00c9ce48e8aba64482b953186fbe57431e383297a83000255fb0bb4.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Document Themes 14\Theme Fonts\Black Tie.xml	45f51b31a00c9ce48e8aba64482b953186fbe57431e383297a83000255fb0bb4.exe
File opened for modification	C:\Program Files\Java\jre7\lib\zi\Australia\Perth	45f51b31a00c9ce48e8aba64482b953186fbe57431e383297a83000255fb0bb4.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\Gadgets\Calendar.Gadget\images\calendar_ring_docked.png	45f51b31a00c9ce48e8aba64482b953186fbe57431e383297a83000255fb0bb4.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolBMPs\WebToolImages16x16.jpg	45f51b31a00c9ce48e8aba64482b953186fbe57431e383297a83000255fb0bb4.exe
File opened for modification	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\RedistList\FrameworkList.xml	45f51b31a00c9ce48e8aba64482b953186fbe57431e383297a83000255fb0bb4.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\ink\ja-JP\TipTsf.dll.mui	45f51b31a00c9ce48e8aba64482b953186fbe57431e383297a83000255fb0bb4.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\NA02398_.WMF	45f51b31a00c9ce48e8aba64482b953186fbe57431e383297a83000255fb0bb4.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\XML2WORD.XSL	45f51b31a00c9ce48e8aba64482b953186fbe57431e383297a83000255fb0bb4.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Templates\1033\Access\Assets.accdt	45f51b31a00c9ce48e8aba64482b953186fbe57431e383297a83000255fb0bb4.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\Gadgets\Calendar.Gadget\fr-FR\calendar.html	45f51b31a00c9ce48e8aba64482b953186fbe57431e383297a83000255fb0bb4.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\Gadgets\Calendar.Gadget\it-IT\js\calendar.js	45f51b31a00c9ce48e8aba64482b953186fbe57431e383297a83000255fb0bb4.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\images\winXPTSFrame.png	45f51b31a00c9ce48e8aba64482b953186fbe57431e383297a83000255fb0bb4.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\it-IT\slideShow.html	45f51b31a00c9ce48e8aba64482b953186fbe57431e383297a83000255fb0bb4.exe
File opened for modification	C:\Program Files (x86)\Common Files\System\msadc\fr-FR\msadcfr.dll.mui	45f51b31a00c9ce48e8aba64482b953186fbe57431e383297a83000255fb0bb4.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\OUTLOOK.DEV_F_COL.HXK	45f51b31a00c9ce48e8aba64482b953186fbe57431e383297a83000255fb0bb4.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\FORMS\1033\POST.CFG	45f51b31a00c9ce48e8aba64482b953186fbe57431e383297a83000255fb0bb4.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\keypad\ea.xml	45f51b31a00c9ce48e8aba64482b953186fbe57431e383297a83000255fb0bb4.exe
File opened for modification	C:\Program Files\Windows Defender\fr-FR\MpAsDesc.dll.mui	45f51b31a00c9ce48e8aba64482b953186fbe57431e383297a83000255fb0bb4.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0101863.BMP	45f51b31a00c9ce48e8aba64482b953186fbe57431e383297a83000255fb0bb4.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\SL00260_.WMF	45f51b31a00c9ce48e8aba64482b953186fbe57431e383297a83000255fb0bb4.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\lib\ext\localedata.jar	45f51b31a00c9ce48e8aba64482b953186fbe57431e383297a83000255fb0bb4.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.core.databinding.nl_zh_4.4.0.v20140623020002.jar	45f51b31a00c9ce48e8aba64482b953186fbe57431e383297a83000255fb0bb4.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\kk\LC_MESSAGES\vlc.mo	45f51b31a00c9ce48e8aba64482b953186fbe57431e383297a83000255fb0bb4.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0179963.JPG	45f51b31a00c9ce48e8aba64482b953186fbe57431e383297a83000255fb0bb4.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\CET	45f51b31a00c9ce48e8aba64482b953186fbe57431e383297a83000255fb0bb4.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.simpleconfigurator.manipulator_2.0.0.v20131217-1203.jar	45f51b31a00c9ce48e8aba64482b953186fbe57431e383297a83000255fb0bb4.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-openide-loaders_ja.jar	45f51b31a00c9ce48e8aba64482b953186fbe57431e383297a83000255fb0bb4.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.core.databinding.beans.nl_ja_4.4.0.v20140623020002.jar	45f51b31a00c9ce48e8aba64482b953186fbe57431e383297a83000255fb0bb4.exe
File opened for modification	C:\Program Files\DVD Maker\Shared\DvdStyles\SpecialOccasion\SpecialNavigationUp_SelectionSubpicture.png	45f51b31a00c9ce48e8aba64482b953186fbe57431e383297a83000255fb0bb4.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Etc\GMT-3	45f51b31a00c9ce48e8aba64482b953186fbe57431e383297a83000255fb0bb4.exe
File opened for modification	C:\Program Files\Java\jre7\lib\ext\meta-index	45f51b31a00c9ce48e8aba64482b953186fbe57431e383297a83000255fb0bb4.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0199303.WMF	45f51b31a00c9ce48e8aba64482b953186fbe57431e383297a83000255fb0bb4.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\FORMS\1033\DISTLSTS.ICO	45f51b31a00c9ce48e8aba64482b953186fbe57431e383297a83000255fb0bb4.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\ko-KR\tipresx.dll.mui	45f51b31a00c9ce48e8aba64482b953186fbe57431e383297a83000255fb0bb4.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\EN00319_.WMF	45f51b31a00c9ce48e8aba64482b953186fbe57431e383297a83000255fb0bb4.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\WITHCOMP.XML	45f51b31a00c9ce48e8aba64482b953186fbe57431e383297a83000255fb0bb4.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.ql.nl_ja_4.4.0.v20140623020002.jar	45f51b31a00c9ce48e8aba64482b953186fbe57431e383297a83000255fb0bb4.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-core-output2.xml	45f51b31a00c9ce48e8aba64482b953186fbe57431e383297a83000255fb0bb4.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Document Themes 14\Theme Colors\Metro.xml	45f51b31a00c9ce48e8aba64482b953186fbe57431e383297a83000255fb0bb4.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\Bibliography\BIBFORM.XML	45f51b31a00c9ce48e8aba64482b953186fbe57431e383297a83000255fb0bb4.exe
File opened for modification	C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\highlight.png	45f51b31a00c9ce48e8aba64482b953186fbe57431e383297a83000255fb0bb4.exe
File opened for modification	C:\Program Files\Java\jre7\lib\security\javaws.policy	45f51b31a00c9ce48e8aba64482b953186fbe57431e383297a83000255fb0bb4.exe

Interacts with shadow copies 2 TTPs 1 IoCs

Shadow copies are often targeted by ransomware to inhibit system recovery.

ransomware

File Deletion

T1107

Inhibit System Recovery

T1490

pid	Process
1940	vssadmin.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1120	45f51b31a00c9ce48e8aba64482b953186fbe57431e383297a83000255fb0bb4.exe

Suspicious use of AdjustPrivilegeToken 46 IoCs

description	pid	Process
Token: SeBackupPrivilege	1540	vssvc.exe
Token: SeRestorePrivilege	1540	vssvc.exe
Token: SeAuditPrivilege	1540	vssvc.exe
Token: SeBackupPrivilege	1296	wbengine.exe
Token: SeRestorePrivilege	1296	wbengine.exe
Token: SeSecurityPrivilege	1296	wbengine.exe
Token: SeIncreaseQuotaPrivilege	1116	WMIC.exe
Token: SeSecurityPrivilege	1116	WMIC.exe
Token: SeTakeOwnershipPrivilege	1116	WMIC.exe
Token: SeLoadDriverPrivilege	1116	WMIC.exe
Token: SeSystemProfilePrivilege	1116	WMIC.exe
Token: SeSystemtimePrivilege	1116	WMIC.exe
Token: SeProfSingleProcessPrivilege	1116	WMIC.exe
Token: SeIncBasePriorityPrivilege	1116	WMIC.exe
Token: SeCreatePagefilePrivilege	1116	WMIC.exe
Token: SeBackupPrivilege	1116	WMIC.exe
Token: SeRestorePrivilege	1116	WMIC.exe
Token: SeShutdownPrivilege	1116	WMIC.exe
Token: SeDebugPrivilege	1116	WMIC.exe
Token: SeSystemEnvironmentPrivilege	1116	WMIC.exe
Token: SeRemoteShutdownPrivilege	1116	WMIC.exe
Token: SeUndockPrivilege	1116	WMIC.exe
Token: SeManageVolumePrivilege	1116	WMIC.exe
Token: 33	1116	WMIC.exe
Token: 34	1116	WMIC.exe
Token: 35	1116	WMIC.exe
Token: SeIncreaseQuotaPrivilege	1116	WMIC.exe
Token: SeSecurityPrivilege	1116	WMIC.exe
Token: SeTakeOwnershipPrivilege	1116	WMIC.exe
Token: SeLoadDriverPrivilege	1116	WMIC.exe
Token: SeSystemProfilePrivilege	1116	WMIC.exe
Token: SeSystemtimePrivilege	1116	WMIC.exe
Token: SeProfSingleProcessPrivilege	1116	WMIC.exe
Token: SeIncBasePriorityPrivilege	1116	WMIC.exe
Token: SeCreatePagefilePrivilege	1116	WMIC.exe
Token: SeBackupPrivilege	1116	WMIC.exe
Token: SeRestorePrivilege	1116	WMIC.exe
Token: SeShutdownPrivilege	1116	WMIC.exe
Token: SeDebugPrivilege	1116	WMIC.exe
Token: SeSystemEnvironmentPrivilege	1116	WMIC.exe
Token: SeRemoteShutdownPrivilege	1116	WMIC.exe
Token: SeUndockPrivilege	1116	WMIC.exe
Token: SeManageVolumePrivilege	1116	WMIC.exe
Token: 33	1116	WMIC.exe
Token: 34	1116	WMIC.exe
Token: 35	1116	WMIC.exe

Suspicious use of WriteProcessMemory 53 IoCs

description	pid	Process	procid_target
PID 1112 wrote to memory of 1120	1112	45f51b31a00c9ce48e8aba64482b953186fbe57431e383297a83000255fb0bb4.exe	27
PID 1112 wrote to memory of 1120	1112	45f51b31a00c9ce48e8aba64482b953186fbe57431e383297a83000255fb0bb4.exe	27
PID 1112 wrote to memory of 1120	1112	45f51b31a00c9ce48e8aba64482b953186fbe57431e383297a83000255fb0bb4.exe	27
PID 1112 wrote to memory of 1120	1112	45f51b31a00c9ce48e8aba64482b953186fbe57431e383297a83000255fb0bb4.exe	27
PID 1112 wrote to memory of 1120	1112	45f51b31a00c9ce48e8aba64482b953186fbe57431e383297a83000255fb0bb4.exe	27
PID 1112 wrote to memory of 1120	1112	45f51b31a00c9ce48e8aba64482b953186fbe57431e383297a83000255fb0bb4.exe	27
PID 1112 wrote to memory of 1120	1112	45f51b31a00c9ce48e8aba64482b953186fbe57431e383297a83000255fb0bb4.exe	27
PID 1112 wrote to memory of 1120	1112	45f51b31a00c9ce48e8aba64482b953186fbe57431e383297a83000255fb0bb4.exe	27
PID 1112 wrote to memory of 1120	1112	45f51b31a00c9ce48e8aba64482b953186fbe57431e383297a83000255fb0bb4.exe	27
PID 1112 wrote to memory of 1120	1112	45f51b31a00c9ce48e8aba64482b953186fbe57431e383297a83000255fb0bb4.exe	27
PID 1120 wrote to memory of 1380	1120	45f51b31a00c9ce48e8aba64482b953186fbe57431e383297a83000255fb0bb4.exe	29
PID 1120 wrote to memory of 1380	1120	45f51b31a00c9ce48e8aba64482b953186fbe57431e383297a83000255fb0bb4.exe	29
PID 1120 wrote to memory of 1380	1120	45f51b31a00c9ce48e8aba64482b953186fbe57431e383297a83000255fb0bb4.exe	29
PID 1120 wrote to memory of 1380	1120	45f51b31a00c9ce48e8aba64482b953186fbe57431e383297a83000255fb0bb4.exe	29
PID 1380 wrote to memory of 1940	1380	cmd.exe	31
PID 1380 wrote to memory of 1940	1380	cmd.exe	31
PID 1380 wrote to memory of 1940	1380	cmd.exe	31
PID 900 wrote to memory of 1648	900	45f51b31a00c9ce48e8aba64482b953186fbe57431e383297a83000255fb0bb4.exe	34
PID 900 wrote to memory of 1648	900	45f51b31a00c9ce48e8aba64482b953186fbe57431e383297a83000255fb0bb4.exe	34
PID 900 wrote to memory of 1648	900	45f51b31a00c9ce48e8aba64482b953186fbe57431e383297a83000255fb0bb4.exe	34
PID 900 wrote to memory of 1648	900	45f51b31a00c9ce48e8aba64482b953186fbe57431e383297a83000255fb0bb4.exe	34
PID 900 wrote to memory of 1648	900	45f51b31a00c9ce48e8aba64482b953186fbe57431e383297a83000255fb0bb4.exe	34
PID 900 wrote to memory of 1648	900	45f51b31a00c9ce48e8aba64482b953186fbe57431e383297a83000255fb0bb4.exe	34
PID 900 wrote to memory of 1648	900	45f51b31a00c9ce48e8aba64482b953186fbe57431e383297a83000255fb0bb4.exe	34
PID 900 wrote to memory of 1648	900	45f51b31a00c9ce48e8aba64482b953186fbe57431e383297a83000255fb0bb4.exe	34
PID 900 wrote to memory of 1648	900	45f51b31a00c9ce48e8aba64482b953186fbe57431e383297a83000255fb0bb4.exe	34
PID 900 wrote to memory of 1648	900	45f51b31a00c9ce48e8aba64482b953186fbe57431e383297a83000255fb0bb4.exe	34
PID 1380 wrote to memory of 1284	1380	cmd.exe	35
PID 1380 wrote to memory of 1284	1380	cmd.exe	35
PID 1380 wrote to memory of 1284	1380	cmd.exe	35
PID 1380 wrote to memory of 1116	1380	cmd.exe	39
PID 1380 wrote to memory of 1116	1380	cmd.exe	39
PID 1380 wrote to memory of 1116	1380	cmd.exe	39
PID 1612 wrote to memory of 1584	1612	45f51b31a00c9ce48e8aba64482b953186fbe57431e383297a83000255fb0bb4.exe	47
PID 1612 wrote to memory of 1584	1612	45f51b31a00c9ce48e8aba64482b953186fbe57431e383297a83000255fb0bb4.exe	47
PID 1612 wrote to memory of 1584	1612	45f51b31a00c9ce48e8aba64482b953186fbe57431e383297a83000255fb0bb4.exe	47
PID 1612 wrote to memory of 1584	1612	45f51b31a00c9ce48e8aba64482b953186fbe57431e383297a83000255fb0bb4.exe	47
PID 1612 wrote to memory of 1584	1612	45f51b31a00c9ce48e8aba64482b953186fbe57431e383297a83000255fb0bb4.exe	47
PID 1612 wrote to memory of 1584	1612	45f51b31a00c9ce48e8aba64482b953186fbe57431e383297a83000255fb0bb4.exe	47
PID 1612 wrote to memory of 1584	1612	45f51b31a00c9ce48e8aba64482b953186fbe57431e383297a83000255fb0bb4.exe	47
PID 1612 wrote to memory of 1584	1612	45f51b31a00c9ce48e8aba64482b953186fbe57431e383297a83000255fb0bb4.exe	47
PID 1612 wrote to memory of 1584	1612	45f51b31a00c9ce48e8aba64482b953186fbe57431e383297a83000255fb0bb4.exe	47
PID 1612 wrote to memory of 1584	1612	45f51b31a00c9ce48e8aba64482b953186fbe57431e383297a83000255fb0bb4.exe	47
PID 1648 wrote to memory of 1352	1648	45f51b31a00c9ce48e8aba64482b953186fbe57431e383297a83000255fb0bb4.exe	49
PID 1648 wrote to memory of 1352	1648	45f51b31a00c9ce48e8aba64482b953186fbe57431e383297a83000255fb0bb4.exe	49
PID 1648 wrote to memory of 1352	1648	45f51b31a00c9ce48e8aba64482b953186fbe57431e383297a83000255fb0bb4.exe	49
PID 1648 wrote to memory of 1352	1648	45f51b31a00c9ce48e8aba64482b953186fbe57431e383297a83000255fb0bb4.exe	49
PID 1648 wrote to memory of 1352	1648	45f51b31a00c9ce48e8aba64482b953186fbe57431e383297a83000255fb0bb4.exe	49
PID 1648 wrote to memory of 1352	1648	45f51b31a00c9ce48e8aba64482b953186fbe57431e383297a83000255fb0bb4.exe	49
PID 1648 wrote to memory of 1352	1648	45f51b31a00c9ce48e8aba64482b953186fbe57431e383297a83000255fb0bb4.exe	49
PID 1648 wrote to memory of 1352	1648	45f51b31a00c9ce48e8aba64482b953186fbe57431e383297a83000255fb0bb4.exe	49
PID 1648 wrote to memory of 1352	1648	45f51b31a00c9ce48e8aba64482b953186fbe57431e383297a83000255fb0bb4.exe	49
PID 1648 wrote to memory of 1352	1648	45f51b31a00c9ce48e8aba64482b953186fbe57431e383297a83000255fb0bb4.exe	49

C:\Users\Admin\AppData\Local\Temp\45f51b31a00c9ce48e8aba64482b953186fbe57431e383297a83000255fb0bb4.exe
"C:\Users\Admin\AppData\Local\Temp\45f51b31a00c9ce48e8aba64482b953186fbe57431e383297a83000255fb0bb4.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1112
- C:\Users\Admin\AppData\Local\Temp\45f51b31a00c9ce48e8aba64482b953186fbe57431e383297a83000255fb0bb4.exe
  "C:\Users\Admin\AppData\Local\Temp\45f51b31a00c9ce48e8aba64482b953186fbe57431e383297a83000255fb0bb4.exe"
  2⤵
  - Modifies extensions of user files
  - Adds Run key to start application
  - Drops file in Program Files directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:1120
- - C:\Users\Admin\AppData\Local\Temp\45f51b31a00c9ce48e8aba64482b953186fbe57431e383297a83000255fb0bb4.exe
    "C:\Users\Admin\AppData\Local\Temp\45f51b31a00c9ce48e8aba64482b953186fbe57431e383297a83000255fb0bb4.exe" n1120
    3⤵
    - Suspicious use of SetThreadContext
    - Suspicious use of WriteProcessMemory
    PID:900
  - - C:\Users\Admin\AppData\Local\Temp\45f51b31a00c9ce48e8aba64482b953186fbe57431e383297a83000255fb0bb4.exe
      "C:\Users\Admin\AppData\Local\Temp\45f51b31a00c9ce48e8aba64482b953186fbe57431e383297a83000255fb0bb4.exe"
      4⤵
      PID:1648
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1380
  - - C:\Windows\system32\vssadmin.exe
      vssadmin delete shadows /all /quiet
      4⤵
      Interacts with shadow copies
      PID:1940
  - - C:\Windows\system32\wbadmin.exe
      wbadmin delete catalog -quiet
      4⤵
      Deletes backup catalog
      PID:1284
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic shadowcopy delete
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:1116
- - C:\Users\Admin\AppData\Local\Temp\45f51b31a00c9ce48e8aba64482b953186fbe57431e383297a83000255fb0bb4.exe
    "C:\Users\Admin\AppData\Local\Temp\45f51b31a00c9ce48e8aba64482b953186fbe57431e383297a83000255fb0bb4.exe" n1120
    3⤵
    - Suspicious use of SetThreadContext
    - Suspicious use of WriteProcessMemory
    PID:1612
  - - C:\Users\Admin\AppData\Local\Temp\45f51b31a00c9ce48e8aba64482b953186fbe57431e383297a83000255fb0bb4.exe
      "C:\Users\Admin\AppData\Local\Temp\45f51b31a00c9ce48e8aba64482b953186fbe57431e383297a83000255fb0bb4.exe"
      4⤵
      PID:1584
- - C:\Users\Admin\AppData\Local\Temp\45f51b31a00c9ce48e8aba64482b953186fbe57431e383297a83000255fb0bb4.exe
    "C:\Users\Admin\AppData\Local\Temp\45f51b31a00c9ce48e8aba64482b953186fbe57431e383297a83000255fb0bb4.exe" n1120
    3⤵
    - Suspicious use of SetThreadContext
    - Suspicious use of WriteProcessMemory
    PID:1648
  - - C:\Users\Admin\AppData\Local\Temp\45f51b31a00c9ce48e8aba64482b953186fbe57431e383297a83000255fb0bb4.exe
      "C:\Users\Admin\AppData\Local\Temp\45f51b31a00c9ce48e8aba64482b953186fbe57431e383297a83000255fb0bb4.exe"
      4⤵
      PID:1352
- - C:\Users\Admin\AppData\Local\Temp\45f51b31a00c9ce48e8aba64482b953186fbe57431e383297a83000255fb0bb4.exe
    "C:\Users\Admin\AppData\Local\Temp\45f51b31a00c9ce48e8aba64482b953186fbe57431e383297a83000255fb0bb4.exe" n1120
    3⤵
    PID:1388

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1540

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1296

C:\Windows\System32\vdsldr.exe
C:\Windows\System32\vdsldr.exe -Embedding
1⤵
PID:1660

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
PID:780

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Command-Line Interface

T1059

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

File Deletion

T1107

Modify Registry

T1112

Web Service

T1102

Credential Access

Credentials in Files

T1081

Discovery

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Inhibit System Recovery

T1490

Replay Monitor

Loading Replay Monitor...

Downloads

memory/900-73-0x0000000000FC0000-0x0000000001064000-memory.dmp

Filesize
656KB

Download
memory/900-76-0x0000000073F90000-0x000000007467E000-memory.dmp

Filesize
6.9MB

Download
memory/900-77-0x00000000009C0000-0x00000000009C1000-memory.dmp

Filesize
4KB

Download
memory/900-75-0x00000000002E0000-0x00000000002F6000-memory.dmp

Filesize
88KB

Download
memory/1112-55-0x0000000074040000-0x000000007472E000-memory.dmp

Filesize
6.9MB

Download
memory/1112-56-0x00000000757F1000-0x00000000757F3000-memory.dmp

Filesize
8KB

Download
memory/1112-57-0x00000000001F0000-0x0000000000206000-memory.dmp

Filesize
88KB

Download
memory/1112-58-0x0000000000200000-0x0000000000201000-memory.dmp

Filesize
4KB

Download
memory/1112-54-0x0000000000FC0000-0x0000000001064000-memory.dmp

Filesize
656KB

Download
memory/1120-61-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/1120-72-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/1120-67-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/1120-65-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/1120-63-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/1120-59-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/1120-69-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/1284-92-0x000007FEFB651000-0x000007FEFB653000-memory.dmp

Filesize
8KB

Download
memory/1388-131-0x0000000073B50000-0x000000007423E000-memory.dmp

Filesize
6.9MB

Download
memory/1388-132-0x0000000000F30000-0x0000000000F31000-memory.dmp

Filesize
4KB

Download
memory/1612-95-0x0000000073B50000-0x000000007423E000-memory.dmp

Filesize
6.9MB

Download
memory/1612-97-0x00000000003D0000-0x00000000003E6000-memory.dmp

Filesize
88KB

Download
memory/1612-96-0x0000000000F20000-0x0000000000F21000-memory.dmp

Filesize
4KB

Download
memory/1612-93-0x0000000000FC0000-0x0000000001064000-memory.dmp

Filesize
656KB

Download
memory/1648-112-0x0000000000FC0000-0x0000000001064000-memory.dmp

Filesize
656KB

Download
memory/1648-113-0x0000000073B00000-0x00000000741EE000-memory.dmp

Filesize
6.9MB

Download
memory/1648-115-0x0000000004C80000-0x0000000004C81000-memory.dmp

Filesize
4KB

Download