Analysis
-
max time kernel
151s -
max time network
95s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
08-11-2022 15:20
Behavioral task
behavioral1
Sample
3b15b66bf6a7d7ebab6437906686037f23a797d15e0fbff3d6741d3f58db8f1e.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
3b15b66bf6a7d7ebab6437906686037f23a797d15e0fbff3d6741d3f58db8f1e.exe
Resource
win10v2004-20220901-en
General
-
Target
3b15b66bf6a7d7ebab6437906686037f23a797d15e0fbff3d6741d3f58db8f1e.exe
-
Size
34KB
-
MD5
5bcf1a6a65d8d0d2ad1c2a78935322b5
-
SHA1
c5af15f8170e3840ba756397cb1548fa9489fae9
-
SHA256
3b15b66bf6a7d7ebab6437906686037f23a797d15e0fbff3d6741d3f58db8f1e
-
SHA512
f21e3bc29b60d3ed248dd048774823d013beb43f2fcf7e560774f1987dc07ff42de2fb68a8dd3bad0653a8587cca9b9f18e0671342c81d8c5698b97a135eb639
-
SSDEEP
768:24HLd8Vdh1qV1Esg8kdJCzSIZHkKRV6kNDB3eHkkb/u:2Q8VgV1U8ZGURVFB3eH/u
Malware Config
Extracted
C:\Users\Admin\AppData\Local\Temp\readme-warning.txt
makop
coleman.dec@tutanota.com
lauracc@msgsafe.io
Signatures
-
Makop
Ransomware family discovered by @VK_Intel in early 2020.
-
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Processes:
wbadmin.exepid process 1848 wbadmin.exe -
Drops file in Program Files directory 64 IoCs
Processes:
3b15b66bf6a7d7ebab6437906686037f23a797d15e0fbff3d6741d3f58db8f1e.exedescription ioc process File opened for modification C:\Program Files\Microsoft Games\SpiderSolitaire\SpiderSolitaireMCE.png 3b15b66bf6a7d7ebab6437906686037f23a797d15e0fbff3d6741d3f58db8f1e.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\DD01015_.WMF 3b15b66bf6a7d7ebab6437906686037f23a797d15e0fbff3d6741d3f58db8f1e.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.swt.win32.win32.x86_64_3.103.1.v20140903-1947.jar 3b15b66bf6a7d7ebab6437906686037f23a797d15e0fbff3d6741d3f58db8f1e.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Indian\Chagos 3b15b66bf6a7d7ebab6437906686037f23a797d15e0fbff3d6741d3f58db8f1e.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\de-DE\clock.html 3b15b66bf6a7d7ebab6437906686037f23a797d15e0fbff3d6741d3f58db8f1e.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\ja-JP\picturePuzzle.html 3b15b66bf6a7d7ebab6437906686037f23a797d15e0fbff3d6741d3f58db8f1e.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0156537.WMF 3b15b66bf6a7d7ebab6437906686037f23a797d15e0fbff3d6741d3f58db8f1e.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0382948.JPG 3b15b66bf6a7d7ebab6437906686037f23a797d15e0fbff3d6741d3f58db8f1e.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-uihandler_zh_CN.jar 3b15b66bf6a7d7ebab6437906686037f23a797d15e0fbff3d6741d3f58db8f1e.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\FALL_01.MID 3b15b66bf6a7d7ebab6437906686037f23a797d15e0fbff3d6741d3f58db8f1e.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0251007.WMF 3b15b66bf6a7d7ebab6437906686037f23a797d15e0fbff3d6741d3f58db8f1e.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\core\org-openide-filesystems.jar 3b15b66bf6a7d7ebab6437906686037f23a797d15e0fbff3d6741d3f58db8f1e.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\docked_gray_snow.png 3b15b66bf6a7d7ebab6437906686037f23a797d15e0fbff3d6741d3f58db8f1e.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Menominee 3b15b66bf6a7d7ebab6437906686037f23a797d15e0fbff3d6741d3f58db8f1e.exe File created C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Outlook.en-us\readme-warning.txt 3b15b66bf6a7d7ebab6437906686037f23a797d15e0fbff3d6741d3f58db8f1e.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.frameworkadmin.equinox_1.0.500.v20131211-1531.jar 3b15b66bf6a7d7ebab6437906686037f23a797d15e0fbff3d6741d3f58db8f1e.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Rainy_River 3b15b66bf6a7d7ebab6437906686037f23a797d15e0fbff3d6741d3f58db8f1e.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Jakarta 3b15b66bf6a7d7ebab6437906686037f23a797d15e0fbff3d6741d3f58db8f1e.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\IRIS\IRIS.INF 3b15b66bf6a7d7ebab6437906686037f23a797d15e0fbff3d6741d3f58db8f1e.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\AG00142_.GIF 3b15b66bf6a7d7ebab6437906686037f23a797d15e0fbff3d6741d3f58db8f1e.exe File opened for modification C:\Program Files\CompleteNew.cab 3b15b66bf6a7d7ebab6437906686037f23a797d15e0fbff3d6741d3f58db8f1e.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\SO00017_.WMF 3b15b66bf6a7d7ebab6437906686037f23a797d15e0fbff3d6741d3f58db8f1e.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\images\rss_headline_glow_floating.png 3b15b66bf6a7d7ebab6437906686037f23a797d15e0fbff3d6741d3f58db8f1e.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\NA02127_.WMF 3b15b66bf6a7d7ebab6437906686037f23a797d15e0fbff3d6741d3f58db8f1e.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\CPU.Gadget\ja-JP\css\cpu.css 3b15b66bf6a7d7ebab6437906686037f23a797d15e0fbff3d6741d3f58db8f1e.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\ink\en-US\TipTsf.dll.mui 3b15b66bf6a7d7ebab6437906686037f23a797d15e0fbff3d6741d3f58db8f1e.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Africa\Bissau 3b15b66bf6a7d7ebab6437906686037f23a797d15e0fbff3d6741d3f58db8f1e.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\America\Porto_Velho 3b15b66bf6a7d7ebab6437906686037f23a797d15e0fbff3d6741d3f58db8f1e.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\css\ui-lightness\images\ui-bg_flat_10_000000_40x100.png 3b15b66bf6a7d7ebab6437906686037f23a797d15e0fbff3d6741d3f58db8f1e.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\Providers\Proximity\11.00\eng.hyp.[04634D33].[coleman.dec@tutanota.com].makop 3b15b66bf6a7d7ebab6437906686037f23a797d15e0fbff3d6741d3f58db8f1e.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\HH01013_.WMF 3b15b66bf6a7d7ebab6437906686037f23a797d15e0fbff3d6741d3f58db8f1e.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0086384.WMF 3b15b66bf6a7d7ebab6437906686037f23a797d15e0fbff3d6741d3f58db8f1e.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\psfontj2d.properties 3b15b66bf6a7d7ebab6437906686037f23a797d15e0fbff3d6741d3f58db8f1e.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\win\CP1252.TXT 3b15b66bf6a7d7ebab6437906686037f23a797d15e0fbff3d6741d3f58db8f1e.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\AN01216_.WMF 3b15b66bf6a7d7ebab6437906686037f23a797d15e0fbff3d6741d3f58db8f1e.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\NA01158_.WMF 3b15b66bf6a7d7ebab6437906686037f23a797d15e0fbff3d6741d3f58db8f1e.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\LICENSE 3b15b66bf6a7d7ebab6437906686037f23a797d15e0fbff3d6741d3f58db8f1e.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\docked_black_moon-new_partly-cloudy.png 3b15b66bf6a7d7ebab6437906686037f23a797d15e0fbff3d6741d3f58db8f1e.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\HH00669_.WMF 3b15b66bf6a7d7ebab6437906686037f23a797d15e0fbff3d6741d3f58db8f1e.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.net_1.2.200.v20120807-0927.jar 3b15b66bf6a7d7ebab6437906686037f23a797d15e0fbff3d6741d3f58db8f1e.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\th\LC_MESSAGES\vlc.mo 3b15b66bf6a7d7ebab6437906686037f23a797d15e0fbff3d6741d3f58db8f1e.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\FD00336_.WMF 3b15b66bf6a7d7ebab6437906686037f23a797d15e0fbff3d6741d3f58db8f1e.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\readme-warning.txt 3b15b66bf6a7d7ebab6437906686037f23a797d15e0fbff3d6741d3f58db8f1e.exe File opened for modification C:\Program Files (x86)\Common Files\System\Ole DB\es-ES\msdaorar.dll.mui 3b15b66bf6a7d7ebab6437906686037f23a797d15e0fbff3d6741d3f58db8f1e.exe File created C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\PFM\readme-warning.txt 3b15b66bf6a7d7ebab6437906686037f23a797d15e0fbff3d6741d3f58db8f1e.exe File created C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\1033\readme-warning.txt 3b15b66bf6a7d7ebab6437906686037f23a797d15e0fbff3d6741d3f58db8f1e.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0153514.WMF 3b15b66bf6a7d7ebab6437906686037f23a797d15e0fbff3d6741d3f58db8f1e.exe File opened for modification C:\Program Files\Microsoft Games\More Games\it-IT\MoreGames.dll.mui 3b15b66bf6a7d7ebab6437906686037f23a797d15e0fbff3d6741d3f58db8f1e.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Jamaica 3b15b66bf6a7d7ebab6437906686037f23a797d15e0fbff3d6741d3f58db8f1e.exe File opened for modification C:\Program Files\Java\jre7\lib\javaws.jar 3b15b66bf6a7d7ebab6437906686037f23a797d15e0fbff3d6741d3f58db8f1e.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Pacific\Niue 3b15b66bf6a7d7ebab6437906686037f23a797d15e0fbff3d6741d3f58db8f1e.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Publisher.en-us\PublisherMUI.XML 3b15b66bf6a7d7ebab6437906686037f23a797d15e0fbff3d6741d3f58db8f1e.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\PH02749G.GIF 3b15b66bf6a7d7ebab6437906686037f23a797d15e0fbff3d6741d3f58db8f1e.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Guyana 3b15b66bf6a7d7ebab6437906686037f23a797d15e0fbff3d6741d3f58db8f1e.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\pa\LC_MESSAGES\vlc.mo 3b15b66bf6a7d7ebab6437906686037f23a797d15e0fbff3d6741d3f58db8f1e.exe File created C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\RADIAL\readme-warning.txt 3b15b66bf6a7d7ebab6437906686037f23a797d15e0fbff3d6741d3f58db8f1e.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0185670.WMF 3b15b66bf6a7d7ebab6437906686037f23a797d15e0fbff3d6741d3f58db8f1e.exe File created C:\Program Files\VideoLAN\VLC\locale\hi\LC_MESSAGES\readme-warning.txt 3b15b66bf6a7d7ebab6437906686037f23a797d15e0fbff3d6741d3f58db8f1e.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\BOLDSTRI\BOLDSTRI.INF 3b15b66bf6a7d7ebab6437906686037f23a797d15e0fbff3d6741d3f58db8f1e.exe File opened for modification C:\Program Files (x86)\Common Files\System\msadc\handler.reg 3b15b66bf6a7d7ebab6437906686037f23a797d15e0fbff3d6741d3f58db8f1e.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\AG00120_.GIF 3b15b66bf6a7d7ebab6437906686037f23a797d15e0fbff3d6741d3f58db8f1e.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\BS01638_.WMF 3b15b66bf6a7d7ebab6437906686037f23a797d15e0fbff3d6741d3f58db8f1e.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\ParentMenuButtonIcon.png 3b15b66bf6a7d7ebab6437906686037f23a797d15e0fbff3d6741d3f58db8f1e.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.common_3.6.200.v20130402-1505.jar 3b15b66bf6a7d7ebab6437906686037f23a797d15e0fbff3d6741d3f58db8f1e.exe -
Interacts with shadow copies 2 TTPs 1 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
Processes:
vssadmin.exepid process 1844 vssadmin.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
3b15b66bf6a7d7ebab6437906686037f23a797d15e0fbff3d6741d3f58db8f1e.exepid process 1672 3b15b66bf6a7d7ebab6437906686037f23a797d15e0fbff3d6741d3f58db8f1e.exe -
Suspicious use of AdjustPrivilegeToken 46 IoCs
Processes:
vssvc.exewbengine.exeWMIC.exedescription pid process Token: SeBackupPrivilege 1652 vssvc.exe Token: SeRestorePrivilege 1652 vssvc.exe Token: SeAuditPrivilege 1652 vssvc.exe Token: SeBackupPrivilege 952 wbengine.exe Token: SeRestorePrivilege 952 wbengine.exe Token: SeSecurityPrivilege 952 wbengine.exe Token: SeIncreaseQuotaPrivilege 364 WMIC.exe Token: SeSecurityPrivilege 364 WMIC.exe Token: SeTakeOwnershipPrivilege 364 WMIC.exe Token: SeLoadDriverPrivilege 364 WMIC.exe Token: SeSystemProfilePrivilege 364 WMIC.exe Token: SeSystemtimePrivilege 364 WMIC.exe Token: SeProfSingleProcessPrivilege 364 WMIC.exe Token: SeIncBasePriorityPrivilege 364 WMIC.exe Token: SeCreatePagefilePrivilege 364 WMIC.exe Token: SeBackupPrivilege 364 WMIC.exe Token: SeRestorePrivilege 364 WMIC.exe Token: SeShutdownPrivilege 364 WMIC.exe Token: SeDebugPrivilege 364 WMIC.exe Token: SeSystemEnvironmentPrivilege 364 WMIC.exe Token: SeRemoteShutdownPrivilege 364 WMIC.exe Token: SeUndockPrivilege 364 WMIC.exe Token: SeManageVolumePrivilege 364 WMIC.exe Token: 33 364 WMIC.exe Token: 34 364 WMIC.exe Token: 35 364 WMIC.exe Token: SeIncreaseQuotaPrivilege 364 WMIC.exe Token: SeSecurityPrivilege 364 WMIC.exe Token: SeTakeOwnershipPrivilege 364 WMIC.exe Token: SeLoadDriverPrivilege 364 WMIC.exe Token: SeSystemProfilePrivilege 364 WMIC.exe Token: SeSystemtimePrivilege 364 WMIC.exe Token: SeProfSingleProcessPrivilege 364 WMIC.exe Token: SeIncBasePriorityPrivilege 364 WMIC.exe Token: SeCreatePagefilePrivilege 364 WMIC.exe Token: SeBackupPrivilege 364 WMIC.exe Token: SeRestorePrivilege 364 WMIC.exe Token: SeShutdownPrivilege 364 WMIC.exe Token: SeDebugPrivilege 364 WMIC.exe Token: SeSystemEnvironmentPrivilege 364 WMIC.exe Token: SeRemoteShutdownPrivilege 364 WMIC.exe Token: SeUndockPrivilege 364 WMIC.exe Token: SeManageVolumePrivilege 364 WMIC.exe Token: 33 364 WMIC.exe Token: 34 364 WMIC.exe Token: 35 364 WMIC.exe -
Suspicious use of WriteProcessMemory 13 IoCs
Processes:
3b15b66bf6a7d7ebab6437906686037f23a797d15e0fbff3d6741d3f58db8f1e.execmd.exedescription pid process target process PID 1672 wrote to memory of 2036 1672 3b15b66bf6a7d7ebab6437906686037f23a797d15e0fbff3d6741d3f58db8f1e.exe cmd.exe PID 1672 wrote to memory of 2036 1672 3b15b66bf6a7d7ebab6437906686037f23a797d15e0fbff3d6741d3f58db8f1e.exe cmd.exe PID 1672 wrote to memory of 2036 1672 3b15b66bf6a7d7ebab6437906686037f23a797d15e0fbff3d6741d3f58db8f1e.exe cmd.exe PID 1672 wrote to memory of 2036 1672 3b15b66bf6a7d7ebab6437906686037f23a797d15e0fbff3d6741d3f58db8f1e.exe cmd.exe PID 2036 wrote to memory of 1844 2036 cmd.exe vssadmin.exe PID 2036 wrote to memory of 1844 2036 cmd.exe vssadmin.exe PID 2036 wrote to memory of 1844 2036 cmd.exe vssadmin.exe PID 2036 wrote to memory of 1848 2036 cmd.exe wbadmin.exe PID 2036 wrote to memory of 1848 2036 cmd.exe wbadmin.exe PID 2036 wrote to memory of 1848 2036 cmd.exe wbadmin.exe PID 2036 wrote to memory of 364 2036 cmd.exe WMIC.exe PID 2036 wrote to memory of 364 2036 cmd.exe WMIC.exe PID 2036 wrote to memory of 364 2036 cmd.exe WMIC.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\3b15b66bf6a7d7ebab6437906686037f23a797d15e0fbff3d6741d3f58db8f1e.exe"C:\Users\Admin\AppData\Local\Temp\3b15b66bf6a7d7ebab6437906686037f23a797d15e0fbff3d6741d3f58db8f1e.exe"1⤵
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\3b15b66bf6a7d7ebab6437906686037f23a797d15e0fbff3d6741d3f58db8f1e.exe"C:\Users\Admin\AppData\Local\Temp\3b15b66bf6a7d7ebab6437906686037f23a797d15e0fbff3d6741d3f58db8f1e.exe" n16722⤵
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\vssadmin.exevssadmin delete shadows /all /quiet3⤵
- Interacts with shadow copies
-
C:\Windows\system32\wbadmin.exewbadmin delete catalog -quiet3⤵
- Deletes backup catalog
-
C:\Windows\System32\Wbem\WMIC.exewmic shadowcopy delete3⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\wbengine.exe"C:\Windows\system32\wbengine.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\vdsldr.exeC:\Windows\System32\vdsldr.exe -Embedding1⤵
-
C:\Windows\System32\vds.exeC:\Windows\System32\vds.exe1⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/364-60-0x0000000000000000-mapping.dmp
-
memory/1672-54-0x0000000075BD1000-0x0000000075BD3000-memory.dmpFilesize
8KB
-
memory/1844-57-0x0000000000000000-mapping.dmp
-
memory/1848-58-0x0000000000000000-mapping.dmp
-
memory/1848-59-0x000007FEFBC01000-0x000007FEFBC03000-memory.dmpFilesize
8KB
-
memory/2036-56-0x0000000000000000-mapping.dmp