Analysis
-
max time kernel
4294180s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20220311-en -
submitted
23-03-2022 01:24
Static task
static1
Behavioral task
behavioral1
Sample
ssee.exe
Resource
win7-20220311-en
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
ssee.exe
Resource
win10v2004-20220310-en
windows10-2004_x64
0 signatures
0 seconds
General
-
Target
ssee.exe
-
Size
548KB
-
MD5
128ab502ed4f070abea44fd42b24f9d3
-
SHA1
6636ec203bf0cf69b8694e0ff17f465367dfb5f3
-
SHA256
81a7dab1e034b1f79713acf2323d23337f0b96a6c9502051251190587246318b
-
SHA512
f6da0526cb5c3d0957a8d1c505e44e4654b7ef7198c5c920c9d4827f7c50b7454df4decedd86f373c17265082d54d7853fae04de1b8200e1d0d61f650d64c10a
Score
10/10
Malware Config
Extracted
Path
C:\Users\Admin\AppData\Local\Temp\1642321044\readme-warning.txt
Family
makop
Ransom Note
::: Greetings :::
Little FAQ:
.1.
Q: Whats Happen?
A: Your files have been encrypted and now have the "snick" extension. The file structure was not damaged, we did everything possible so that this could not happen.
.2.
Q: How to recover files?
A: If you wish to decrypt your files you will need to pay in bitcoins.
.3.
Q: What about guarantees?
A: Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will cooperate with us. Its not in our interests.
To check the ability of returning files, you can send to us any 2 files with SIMPLE extensions(jpg,xls,doc, etc... not databases!) and low sizes(max 1 mb), we will decrypt them and send back to you. That is our guarantee.
.4.
Q: How to contact with you?
A: You can write us to our mailbox: [email protected] or [email protected]
.5.
Q: How will the decryption process proceed after payment?
A: After payment we will send to you our scanner-decoder program and detailed instructions for use. With this program you will be able to decrypt all your encrypted files.
.6.
Q: If I don�t want to pay bad people like you?
A: If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause only we have the private key. In practice - time is much more valuable than money.
:::BEWARE:::
DON'T try to change encrypted files by yourself!
If you will try to use any third party software for restoring your data or antivirus solutions - please make a backup for all encrypted files!
Any changes in encrypted files may entail damage of the private key and, as result, the loss all data.
Signatures
-
Makop
Ransomware family discovered by @VK_Intel in early 2020.
-
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
pid Process 1560 wbadmin.exe -
Suspicious use of SetThreadContext 2 IoCs
description pid Process procid_target PID 1652 set thread context of 452 1652 ssee.exe 30 PID 1936 set thread context of 1764 1936 ssee.exe 45 -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Common Files\Microsoft Shared\MSInfo\en-US\msinfo32.exe.mui ssee.exe File opened for modification C:\Program Files\7-Zip\Lang\ku.txt ssee.exe File opened for modification C:\Program Files\7-Zip\Lang\pt.txt ssee.exe File opened for modification C:\Program Files\7-Zip\Lang\sq.txt ssee.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\InkObj.dll.mui ssee.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\TipBand.dll.mui ssee.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\tipresx.dll.mui ssee.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\numbers\numbase.xml ssee.exe File opened for modification C:\Program Files\7-Zip\Lang\cy.txt ssee.exe File opened for modification C:\Program Files\7-Zip\Lang\ext.txt ssee.exe File opened for modification C:\Program Files\7-Zip\Lang\sr-spl.txt ssee.exe File opened for modification C:\Program Files\7-Zip\Lang\ug.txt ssee.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\en-US\mshwLatin.dll.mui ssee.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\ipsjpn.xml ssee.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\FlickLearningWizard.exe.mui ssee.exe File opened for modification C:\Program Files\7-Zip\Lang\lv.txt ssee.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fi-FI\tipresx.dll.mui ssee.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\hwrcatsh.dat ssee.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\pt-PT\tipresx.dll.mui ssee.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\TipTsf.dll.mui ssee.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\baseAltGr_rtl.xml ssee.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\ja-jp.xml ssee.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\uk-UA\tipresx.dll.mui ssee.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\InputPersonalization.exe.mui ssee.exe File opened for modification C:\Program Files\7-Zip\Lang\hr.txt ssee.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\pt-BR\tipresx.dll.mui ssee.exe File opened for modification C:\Program Files\7-Zip\Lang\kk.txt ssee.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\en-US\InkWatson.exe.mui ssee.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\it-IT\IPSEventLogMsg.dll.mui ssee.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\tr-TR\tipresx.dll.mui ssee.exe File opened for modification C:\Program Files\7-Zip\Lang\et.txt ssee.exe File opened for modification C:\Program Files\7-Zip\Lang\nb.txt ssee.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\da-DK\tipresx.dll.mui ssee.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\tabskb.dll.mui ssee.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\symbols\ja-jp-sym.xml ssee.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\hwrcatlm.dat ssee.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\hwrenalm.dat ssee.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\hwrdeslm.dat ssee.exe File opened for modification C:\Program Files\7-Zip\Lang\it.txt ssee.exe File opened for modification C:\Program Files\7-Zip\Lang\pt-br.txt ssee.exe File opened for modification C:\Program Files\7-Zip\Lang\tr.txt ssee.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\InkWatson.exe.mui ssee.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\he-IL\tipresx.dll.mui ssee.exe File opened for modification C:\Program Files\7-Zip\Lang\nn.txt ssee.exe File opened for modification C:\Program Files\7-Zip\readme.txt ssee.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\en-US\boxed-split.avi ssee.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\zh-dayi.xml ssee.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\web\webbase.xml ssee.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\hwresplm.dat ssee.exe File opened for modification C:\Program Files\7-Zip\Lang\io.txt ssee.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\mip.exe.mui ssee.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\TipBand.dll.mui ssee.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\et-EE\tipresx.dll.mui ssee.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\numbers.xml ssee.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\th-TH\tipresx.dll.mui ssee.exe File opened for modification C:\Program Files\7-Zip\Lang\eo.txt ssee.exe File opened for modification C:\Program Files\7-Zip\Lang\sr-spc.txt ssee.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\en-US\boxed-delete.avi ssee.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\FlickAnimation.avi ssee.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\micaut.dll.mui ssee.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\zh-phonetic.xml ssee.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\osknumpad\osknumpadbase.xml ssee.exe File opened for modification C:\Program Files\7-Zip\Lang\de.txt ssee.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\en-US\InkObj.dll.mui ssee.exe -
Interacts with shadow copies 2 TTPs 1 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
pid Process 632 vssadmin.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 1652 ssee.exe 1652 ssee.exe 1652 ssee.exe 452 ssee.exe -
Suspicious use of AdjustPrivilegeToken 47 IoCs
description pid Process Token: SeDebugPrivilege 1652 ssee.exe Token: SeBackupPrivilege 1052 vssvc.exe Token: SeRestorePrivilege 1052 vssvc.exe Token: SeAuditPrivilege 1052 vssvc.exe Token: SeBackupPrivilege 624 wbengine.exe Token: SeRestorePrivilege 624 wbengine.exe Token: SeSecurityPrivilege 624 wbengine.exe Token: SeIncreaseQuotaPrivilege 1604 WMIC.exe Token: SeSecurityPrivilege 1604 WMIC.exe Token: SeTakeOwnershipPrivilege 1604 WMIC.exe Token: SeLoadDriverPrivilege 1604 WMIC.exe Token: SeSystemProfilePrivilege 1604 WMIC.exe Token: SeSystemtimePrivilege 1604 WMIC.exe Token: SeProfSingleProcessPrivilege 1604 WMIC.exe Token: SeIncBasePriorityPrivilege 1604 WMIC.exe Token: SeCreatePagefilePrivilege 1604 WMIC.exe Token: SeBackupPrivilege 1604 WMIC.exe Token: SeRestorePrivilege 1604 WMIC.exe Token: SeShutdownPrivilege 1604 WMIC.exe Token: SeDebugPrivilege 1604 WMIC.exe Token: SeSystemEnvironmentPrivilege 1604 WMIC.exe Token: SeRemoteShutdownPrivilege 1604 WMIC.exe Token: SeUndockPrivilege 1604 WMIC.exe Token: SeManageVolumePrivilege 1604 WMIC.exe Token: 33 1604 WMIC.exe Token: 34 1604 WMIC.exe Token: 35 1604 WMIC.exe Token: SeIncreaseQuotaPrivilege 1604 WMIC.exe Token: SeSecurityPrivilege 1604 WMIC.exe Token: SeTakeOwnershipPrivilege 1604 WMIC.exe Token: SeLoadDriverPrivilege 1604 WMIC.exe Token: SeSystemProfilePrivilege 1604 WMIC.exe Token: SeSystemtimePrivilege 1604 WMIC.exe Token: SeProfSingleProcessPrivilege 1604 WMIC.exe Token: SeIncBasePriorityPrivilege 1604 WMIC.exe Token: SeCreatePagefilePrivilege 1604 WMIC.exe Token: SeBackupPrivilege 1604 WMIC.exe Token: SeRestorePrivilege 1604 WMIC.exe Token: SeShutdownPrivilege 1604 WMIC.exe Token: SeDebugPrivilege 1604 WMIC.exe Token: SeSystemEnvironmentPrivilege 1604 WMIC.exe Token: SeRemoteShutdownPrivilege 1604 WMIC.exe Token: SeUndockPrivilege 1604 WMIC.exe Token: SeManageVolumePrivilege 1604 WMIC.exe Token: 33 1604 WMIC.exe Token: 34 1604 WMIC.exe Token: 35 1604 WMIC.exe -
Suspicious use of WriteProcessMemory 45 IoCs
description pid Process procid_target PID 1652 wrote to memory of 268 1652 ssee.exe 27 PID 1652 wrote to memory of 268 1652 ssee.exe 27 PID 1652 wrote to memory of 268 1652 ssee.exe 27 PID 1652 wrote to memory of 268 1652 ssee.exe 27 PID 1652 wrote to memory of 1956 1652 ssee.exe 28 PID 1652 wrote to memory of 1956 1652 ssee.exe 28 PID 1652 wrote to memory of 1956 1652 ssee.exe 28 PID 1652 wrote to memory of 1956 1652 ssee.exe 28 PID 1652 wrote to memory of 432 1652 ssee.exe 29 PID 1652 wrote to memory of 432 1652 ssee.exe 29 PID 1652 wrote to memory of 432 1652 ssee.exe 29 PID 1652 wrote to memory of 432 1652 ssee.exe 29 PID 1652 wrote to memory of 452 1652 ssee.exe 30 PID 1652 wrote to memory of 452 1652 ssee.exe 30 PID 1652 wrote to memory of 452 1652 ssee.exe 30 PID 1652 wrote to memory of 452 1652 ssee.exe 30 PID 1652 wrote to memory of 452 1652 ssee.exe 30 PID 1652 wrote to memory of 452 1652 ssee.exe 30 PID 1652 wrote to memory of 452 1652 ssee.exe 30 PID 1652 wrote to memory of 452 1652 ssee.exe 30 PID 1652 wrote to memory of 452 1652 ssee.exe 30 PID 1652 wrote to memory of 452 1652 ssee.exe 30 PID 452 wrote to memory of 776 452 ssee.exe 32 PID 452 wrote to memory of 776 452 ssee.exe 32 PID 452 wrote to memory of 776 452 ssee.exe 32 PID 452 wrote to memory of 776 452 ssee.exe 32 PID 776 wrote to memory of 632 776 cmd.exe 34 PID 776 wrote to memory of 632 776 cmd.exe 34 PID 776 wrote to memory of 632 776 cmd.exe 34 PID 776 wrote to memory of 1560 776 cmd.exe 37 PID 776 wrote to memory of 1560 776 cmd.exe 37 PID 776 wrote to memory of 1560 776 cmd.exe 37 PID 776 wrote to memory of 1604 776 cmd.exe 41 PID 776 wrote to memory of 1604 776 cmd.exe 41 PID 776 wrote to memory of 1604 776 cmd.exe 41 PID 1936 wrote to memory of 1764 1936 ssee.exe 45 PID 1936 wrote to memory of 1764 1936 ssee.exe 45 PID 1936 wrote to memory of 1764 1936 ssee.exe 45 PID 1936 wrote to memory of 1764 1936 ssee.exe 45 PID 1936 wrote to memory of 1764 1936 ssee.exe 45 PID 1936 wrote to memory of 1764 1936 ssee.exe 45 PID 1936 wrote to memory of 1764 1936 ssee.exe 45 PID 1936 wrote to memory of 1764 1936 ssee.exe 45 PID 1936 wrote to memory of 1764 1936 ssee.exe 45 PID 1936 wrote to memory of 1764 1936 ssee.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\ssee.exe"C:\Users\Admin\AppData\Local\Temp\ssee.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1652 -
C:\Users\Admin\AppData\Local\Temp\ssee.exe"{path}"2⤵PID:268
-
-
C:\Users\Admin\AppData\Local\Temp\ssee.exe"{path}"2⤵PID:1956
-
-
C:\Users\Admin\AppData\Local\Temp\ssee.exe"{path}"2⤵PID:432
-
-
C:\Users\Admin\AppData\Local\Temp\ssee.exe"{path}"2⤵
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:452 -
C:\Users\Admin\AppData\Local\Temp\ssee.exe"C:\Users\Admin\AppData\Local\Temp\ssee.exe" n4523⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1936 -
C:\Users\Admin\AppData\Local\Temp\ssee.exe"{path}"4⤵PID:1764
-
-
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe"3⤵
- Suspicious use of WriteProcessMemory
PID:776 -
C:\Windows\system32\vssadmin.exevssadmin delete shadows /all /quiet4⤵
- Interacts with shadow copies
PID:632
-
-
C:\Windows\system32\wbadmin.exewbadmin delete catalog -quiet4⤵
- Deletes backup catalog
PID:1560
-
-
C:\Windows\System32\Wbem\WMIC.exewmic shadowcopy delete4⤵
- Suspicious use of AdjustPrivilegeToken
PID:1604
-
-
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1052
-
C:\Windows\system32\wbengine.exe"C:\Windows\system32\wbengine.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
PID:624
-
C:\Windows\System32\vdsldr.exeC:\Windows\System32\vdsldr.exe -Embedding1⤵PID:2004
-
C:\Windows\System32\vds.exeC:\Windows\System32\vds.exe1⤵PID:1756