Analysis
-
max time kernel
169s -
max time network
48s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
07-11-2022 18:05
Static task
static1
Behavioral task
behavioral1
Sample
e4133986284c2640065ed2cc5798ee1751479732c169a8728f41536306a42ba2.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
e4133986284c2640065ed2cc5798ee1751479732c169a8728f41536306a42ba2.exe
Resource
win10v2004-20220812-en
General
-
Target
e4133986284c2640065ed2cc5798ee1751479732c169a8728f41536306a42ba2.exe
-
Size
41KB
-
MD5
ad29f77ee86ed9827158347befa8998d
-
SHA1
b3b380be84a7042884f1c9c9f14331faa65c51f2
-
SHA256
e4133986284c2640065ed2cc5798ee1751479732c169a8728f41536306a42ba2
-
SHA512
57d1e4cbfab347a35ea5ed2fa1fc5bfb61c48fd8e2f0b0ee32fbc1bb8693715e15f075e203fb462e70cf2d73e30631f9f605dbf3fd46875d14f72912710065cc
-
SSDEEP
768:NSfdupUQ61pjmEcE1BezWNEEFCRhDAMtCLB+GEI:Odud61lmRBzl5A8CLv
Malware Config
Extracted
C:\Users\Admin\AppData\Local\Temp\readme-warning.txt
makop
moloch_helpdesk@tutanota.com
moloch_helpdesk@protonmail.ch
Signatures
-
Makop
Ransomware family discovered by @VK_Intel in early 2020.
-
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Processes:
wbadmin.exepid process 560 wbadmin.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
e4133986284c2640065ed2cc5798ee1751479732c169a8728f41536306a42ba2.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\1 = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\e4133986284c2640065ed2cc5798ee1751479732c169a8728f41536306a42ba2.exe\"" e4133986284c2640065ed2cc5798ee1751479732c169a8728f41536306a42ba2.exe -
Drops file in Program Files directory 64 IoCs
Processes:
e4133986284c2640065ed2cc5798ee1751479732c169a8728f41536306a42ba2.exedescription ioc process File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-autoupdate-services_ja.jar e4133986284c2640065ed2cc5798ee1751479732c169a8728f41536306a42ba2.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-masterfs-nio2_ja.jar e4133986284c2640065ed2cc5798ee1751479732c169a8728f41536306a42ba2.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\images\system_dot.png e4133986284c2640065ed2cc5798ee1751479732c169a8728f41536306a42ba2.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\drag.png e4133986284c2640065ed2cc5798ee1751479732c169a8728f41536306a42ba2.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-autoupdate-services_zh_CN.jar e4133986284c2640065ed2cc5798ee1751479732c169a8728f41536306a42ba2.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\Images\6.png e4133986284c2640065ed2cc5798ee1751479732c169a8728f41536306a42ba2.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\TitleButtonSubpicture.png e4133986284c2640065ed2cc5798ee1751479732c169a8728f41536306a42ba2.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\SportsMainToScenesBackground_PAL.wmv e4133986284c2640065ed2cc5798ee1751479732c169a8728f41536306a42ba2.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Africa\Windhoek e4133986284c2640065ed2cc5798ee1751479732c169a8728f41536306a42ba2.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\gifs\mix.gif e4133986284c2640065ed2cc5798ee1751479732c169a8728f41536306a42ba2.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\Berlin e4133986284c2640065ed2cc5798ee1751479732c169a8728f41536306a42ba2.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\gifs\prodbig.gif e4133986284c2640065ed2cc5798ee1751479732c169a8728f41536306a42ba2.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\sk\LC_MESSAGES\vlc.mo e4133986284c2640065ed2cc5798ee1751479732c169a8728f41536306a42ba2.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\logo.png e4133986284c2640065ed2cc5798ee1751479732c169a8728f41536306a42ba2.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.osgi.nl_zh_4.4.0.v20140623020002.jar e4133986284c2640065ed2cc5798ee1751479732c169a8728f41536306a42ba2.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Asia\Srednekolymsk e4133986284c2640065ed2cc5798ee1751479732c169a8728f41536306a42ba2.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\photoedge_videoinset.png e4133986284c2640065ed2cc5798ee1751479732c169a8728f41536306a42ba2.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\ext\dnsns.jar e4133986284c2640065ed2cc5798ee1751479732c169a8728f41536306a42ba2.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.ui.ja_5.5.0.165303.jar e4133986284c2640065ed2cc5798ee1751479732c169a8728f41536306a42ba2.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.core.di.extensions_0.12.0.v20140417-2033.jar e4133986284c2640065ed2cc5798ee1751479732c169a8728f41536306a42ba2.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\el\LC_MESSAGES\vlc.mo e4133986284c2640065ed2cc5798ee1751479732c169a8728f41536306a42ba2.exe File created C:\Program Files\VideoLAN\VLC\locale\tl\LC_MESSAGES\readme-warning.txt e4133986284c2640065ed2cc5798ee1751479732c169a8728f41536306a42ba2.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.ssl.feature_1.0.0.v20140827-1444\about.html e4133986284c2640065ed2cc5798ee1751479732c169a8728f41536306a42ba2.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\css\dark\e4-dark_preferencestyle.css e4133986284c2640065ed2cc5798ee1751479732c169a8728f41536306a42ba2.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-openide-dialogs.jar e4133986284c2640065ed2cc5798ee1751479732c169a8728f41536306a42ba2.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\locale\org-netbeans-modules-profiler_ja.jar e4133986284c2640065ed2cc5798ee1751479732c169a8728f41536306a42ba2.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.core.databinding.beans.nl_ja_4.4.0.v20140623020002.jar e4133986284c2640065ed2cc5798ee1751479732c169a8728f41536306a42ba2.exe File opened for modification C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\Workflow.Targets e4133986284c2640065ed2cc5798ee1751479732c169a8728f41536306a42ba2.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\tipresx.dll.mui e4133986284c2640065ed2cc5798ee1751479732c169a8728f41536306a42ba2.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Africa\Ndjamena e4133986284c2640065ed2cc5798ee1751479732c169a8728f41536306a42ba2.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Atlantic\Stanley e4133986284c2640065ed2cc5798ee1751479732c169a8728f41536306a42ba2.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\Gibraltar e4133986284c2640065ed2cc5798ee1751479732c169a8728f41536306a42ba2.exe File opened for modification C:\Program Files\Windows Photo Viewer\es-ES\PhotoAcq.dll.mui e4133986284c2640065ed2cc5798ee1751479732c169a8728f41536306a42ba2.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\MediaCenter.Gadget\images\button_MCELogo_mouseout.png e4133986284c2640065ed2cc5798ee1751479732c169a8728f41536306a42ba2.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\IPSEventLogMsg.dll.mui e4133986284c2640065ed2cc5798ee1751479732c169a8728f41536306a42ba2.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\ResizingPanels\blackbars80.png e4133986284c2640065ed2cc5798ee1751479732c169a8728f41536306a42ba2.exe File created C:\Program Files\VideoLAN\VLC\locale\wa\LC_MESSAGES\readme-warning.txt e4133986284c2640065ed2cc5798ee1751479732c169a8728f41536306a42ba2.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-openide-loaders_zh_CN.jar e4133986284c2640065ed2cc5798ee1751479732c169a8728f41536306a42ba2.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-openide-execution.jar e4133986284c2640065ed2cc5798ee1751479732c169a8728f41536306a42ba2.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\README.html e4133986284c2640065ed2cc5798ee1751479732c169a8728f41536306a42ba2.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\en-US\boxed-join.avi e4133986284c2640065ed2cc5798ee1751479732c169a8728f41536306a42ba2.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.console_1.1.0.v20140131-1639.jar e4133986284c2640065ed2cc5798ee1751479732c169a8728f41536306a42ba2.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\images\gtkTSFrame.png e4133986284c2640065ed2cc5798ee1751479732c169a8728f41536306a42ba2.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\images\modern_m.png e4133986284c2640065ed2cc5798ee1751479732c169a8728f41536306a42ba2.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\fontconfig.properties.src e4133986284c2640065ed2cc5798ee1751479732c169a8728f41536306a42ba2.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-modules-masterfs-nio2.xml e4133986284c2640065ed2cc5798ee1751479732c169a8728f41536306a42ba2.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-options-api_zh_CN.jar e4133986284c2640065ed2cc5798ee1751479732c169a8728f41536306a42ba2.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-core-io-ui_ja.jar e4133986284c2640065ed2cc5798ee1751479732c169a8728f41536306a42ba2.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Asia\Aqtau e4133986284c2640065ed2cc5798ee1751479732c169a8728f41536306a42ba2.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Europe\Helsinki e4133986284c2640065ed2cc5798ee1751479732c169a8728f41536306a42ba2.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\or\LC_MESSAGES\vlc.mo e4133986284c2640065ed2cc5798ee1751479732c169a8728f41536306a42ba2.exe File opened for modification C:\Program Files\Common Files\System\Ole DB\es-ES\sqloledb.rll.mui e4133986284c2640065ed2cc5798ee1751479732c169a8728f41536306a42ba2.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.core.databinding.observable.nl_ja_4.4.0.v20140623020002.jar e4133986284c2640065ed2cc5798ee1751479732c169a8728f41536306a42ba2.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\images\system_s.png e4133986284c2640065ed2cc5798ee1751479732c169a8728f41536306a42ba2.exe File opened for modification C:\Program Files\Windows Photo Viewer\de-DE\PhotoViewer.dll.mui e4133986284c2640065ed2cc5798ee1751479732c169a8728f41536306a42ba2.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.flightrecorder_5.5.0.165303.jar e4133986284c2640065ed2cc5798ee1751479732c169a8728f41536306a42ba2.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-api-search_ja.jar e4133986284c2640065ed2cc5798ee1751479732c169a8728f41536306a42ba2.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\Modules\com-sun-tools-visualvm-coredump.xml e4133986284c2640065ed2cc5798ee1751479732c169a8728f41536306a42ba2.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\update_tracking\com-sun-tools-visualvm-host-views.xml e4133986284c2640065ed2cc5798ee1751479732c169a8728f41536306a42ba2.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\lib\locale\boot_zh_CN.jar e4133986284c2640065ed2cc5798ee1751479732c169a8728f41536306a42ba2.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\America\Tegucigalpa e4133986284c2640065ed2cc5798ee1751479732c169a8728f41536306a42ba2.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\mr\LC_MESSAGES\vlc.mo e4133986284c2640065ed2cc5798ee1751479732c169a8728f41536306a42ba2.exe File opened for modification C:\Program Files\Windows Photo Viewer\it-IT\ImagingDevices.exe.mui e4133986284c2640065ed2cc5798ee1751479732c169a8728f41536306a42ba2.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\MediaCenter.Gadget\images\Gadget_Star_Full.png e4133986284c2640065ed2cc5798ee1751479732c169a8728f41536306a42ba2.exe -
Interacts with shadow copies 2 TTPs 1 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
Processes:
vssadmin.exepid process 1396 vssadmin.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
e4133986284c2640065ed2cc5798ee1751479732c169a8728f41536306a42ba2.exepid process 1956 e4133986284c2640065ed2cc5798ee1751479732c169a8728f41536306a42ba2.exe -
Suspicious use of AdjustPrivilegeToken 46 IoCs
Processes:
vssvc.exewbengine.exeWMIC.exedescription pid process Token: SeBackupPrivilege 1356 vssvc.exe Token: SeRestorePrivilege 1356 vssvc.exe Token: SeAuditPrivilege 1356 vssvc.exe Token: SeBackupPrivilege 1448 wbengine.exe Token: SeRestorePrivilege 1448 wbengine.exe Token: SeSecurityPrivilege 1448 wbengine.exe Token: SeIncreaseQuotaPrivilege 1236 WMIC.exe Token: SeSecurityPrivilege 1236 WMIC.exe Token: SeTakeOwnershipPrivilege 1236 WMIC.exe Token: SeLoadDriverPrivilege 1236 WMIC.exe Token: SeSystemProfilePrivilege 1236 WMIC.exe Token: SeSystemtimePrivilege 1236 WMIC.exe Token: SeProfSingleProcessPrivilege 1236 WMIC.exe Token: SeIncBasePriorityPrivilege 1236 WMIC.exe Token: SeCreatePagefilePrivilege 1236 WMIC.exe Token: SeBackupPrivilege 1236 WMIC.exe Token: SeRestorePrivilege 1236 WMIC.exe Token: SeShutdownPrivilege 1236 WMIC.exe Token: SeDebugPrivilege 1236 WMIC.exe Token: SeSystemEnvironmentPrivilege 1236 WMIC.exe Token: SeRemoteShutdownPrivilege 1236 WMIC.exe Token: SeUndockPrivilege 1236 WMIC.exe Token: SeManageVolumePrivilege 1236 WMIC.exe Token: 33 1236 WMIC.exe Token: 34 1236 WMIC.exe Token: 35 1236 WMIC.exe Token: SeIncreaseQuotaPrivilege 1236 WMIC.exe Token: SeSecurityPrivilege 1236 WMIC.exe Token: SeTakeOwnershipPrivilege 1236 WMIC.exe Token: SeLoadDriverPrivilege 1236 WMIC.exe Token: SeSystemProfilePrivilege 1236 WMIC.exe Token: SeSystemtimePrivilege 1236 WMIC.exe Token: SeProfSingleProcessPrivilege 1236 WMIC.exe Token: SeIncBasePriorityPrivilege 1236 WMIC.exe Token: SeCreatePagefilePrivilege 1236 WMIC.exe Token: SeBackupPrivilege 1236 WMIC.exe Token: SeRestorePrivilege 1236 WMIC.exe Token: SeShutdownPrivilege 1236 WMIC.exe Token: SeDebugPrivilege 1236 WMIC.exe Token: SeSystemEnvironmentPrivilege 1236 WMIC.exe Token: SeRemoteShutdownPrivilege 1236 WMIC.exe Token: SeUndockPrivilege 1236 WMIC.exe Token: SeManageVolumePrivilege 1236 WMIC.exe Token: 33 1236 WMIC.exe Token: 34 1236 WMIC.exe Token: 35 1236 WMIC.exe -
Suspicious use of WriteProcessMemory 13 IoCs
Processes:
e4133986284c2640065ed2cc5798ee1751479732c169a8728f41536306a42ba2.execmd.exedescription pid process target process PID 1956 wrote to memory of 1952 1956 e4133986284c2640065ed2cc5798ee1751479732c169a8728f41536306a42ba2.exe cmd.exe PID 1956 wrote to memory of 1952 1956 e4133986284c2640065ed2cc5798ee1751479732c169a8728f41536306a42ba2.exe cmd.exe PID 1956 wrote to memory of 1952 1956 e4133986284c2640065ed2cc5798ee1751479732c169a8728f41536306a42ba2.exe cmd.exe PID 1956 wrote to memory of 1952 1956 e4133986284c2640065ed2cc5798ee1751479732c169a8728f41536306a42ba2.exe cmd.exe PID 1952 wrote to memory of 1396 1952 cmd.exe vssadmin.exe PID 1952 wrote to memory of 1396 1952 cmd.exe vssadmin.exe PID 1952 wrote to memory of 1396 1952 cmd.exe vssadmin.exe PID 1952 wrote to memory of 560 1952 cmd.exe wbadmin.exe PID 1952 wrote to memory of 560 1952 cmd.exe wbadmin.exe PID 1952 wrote to memory of 560 1952 cmd.exe wbadmin.exe PID 1952 wrote to memory of 1236 1952 cmd.exe WMIC.exe PID 1952 wrote to memory of 1236 1952 cmd.exe WMIC.exe PID 1952 wrote to memory of 1236 1952 cmd.exe WMIC.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\e4133986284c2640065ed2cc5798ee1751479732c169a8728f41536306a42ba2.exe"C:\Users\Admin\AppData\Local\Temp\e4133986284c2640065ed2cc5798ee1751479732c169a8728f41536306a42ba2.exe"1⤵
- Adds Run key to start application
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\e4133986284c2640065ed2cc5798ee1751479732c169a8728f41536306a42ba2.exe"C:\Users\Admin\AppData\Local\Temp\e4133986284c2640065ed2cc5798ee1751479732c169a8728f41536306a42ba2.exe" n19562⤵
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\vssadmin.exevssadmin delete shadows /all /quiet3⤵
- Interacts with shadow copies
-
C:\Windows\system32\wbadmin.exewbadmin delete catalog -quiet3⤵
- Deletes backup catalog
-
C:\Windows\System32\Wbem\WMIC.exewmic shadowcopy delete3⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\wbengine.exe"C:\Windows\system32\wbengine.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\vdsldr.exeC:\Windows\System32\vdsldr.exe -Embedding1⤵
-
C:\Windows\System32\vds.exeC:\Windows\System32\vds.exe1⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/560-58-0x0000000000000000-mapping.dmp
-
memory/560-59-0x000007FEFBC61000-0x000007FEFBC63000-memory.dmpFilesize
8KB
-
memory/1236-60-0x0000000000000000-mapping.dmp
-
memory/1396-57-0x0000000000000000-mapping.dmp
-
memory/1952-55-0x0000000000000000-mapping.dmp
-
memory/1956-54-0x0000000075B11000-0x0000000075B13000-memory.dmpFilesize
8KB