d66bfeb539f4b6f81d0610a128d8a7ebbf559b37df226c5c8b3e04d64c37be0d

Analysis

max time kernel
128s
max time network
150s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
02-10-2024 17:16

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024100229df096d37993e1f6ac7071cb84617eemakop.exe
Size

54KB
MD5

29df096d37993e1f6ac7071cb84617ee
SHA1

3296fa956f71468813b341cc45b44e7c749f9266
SHA256

d66bfeb539f4b6f81d0610a128d8a7ebbf559b37df226c5c8b3e04d64c37be0d
SHA512

7dffa0f513c8bea2c3fc6d025656e6b04991440f03236c2bf101982fa985b482bc6304fe123c04e029183bacd65a376d293afd84d90c112a0a2d8cd6ec6c76c2
SSDEEP

768:2yN4rOjnmQjHeWi0SToS8W9A0WohKTz42vH+Z5ykBNyJaoykY4DuY3zqlrKKMVkq:2cnmQj60IANoaz+Z5ykB+YmX3zHf5f

Score

10^/10

defense_evasion discovery evasion execution impact ransomware spyware stealer

Malware Config

Extracted

Path

C:\Users\Admin\AppData\Local\Temp\+README-WARNING+.txt

Ransom Note

::: Greetings ::: Little FAQ: .1. Q: Whats Happen? A: Your files have been encrypted. The file structure was not damaged, we did everything possible so that this could not happen. .2. Q: How to recover files? A: If you wish to decrypt your files you will need to pay us. .3. Q: What about guarantees? A: Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will cooperate with us. Its not in our interests. To check the ability of returning files, you can send to us any 2 files with SIMPLE extensions(jpg,xls,doc, etc... not databases!) and low sizes(max 1 mb), we will decrypt them and send back to you. That is our guarantee. .4. Q: How to contact with you? A: You can write us to our mailboxes: [email protected] or [email protected] .5. Q: How will the decryption process proceed after payment? A: After payment we will send to you our scanner-decoder program and detailed instructions for use. With this program you will be able to decrypt all your encrypted files. .6. Q: If I don�t want to pay bad people like you? A: If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause only we have the private key. In practice - time is much more valuable than money. :::BEWARE::: DON'T try to change encrypted files by yourself! If you will try to use any third party software for restoring your data or antivirus solutions - please make a backup for all encrypted files! Any changes in encrypted files may entail damage of the private key and, as result, the loss all data. Your ID: 9D59F14C

Emails

[email protected]

Signatures

Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware defense_evasion impact execution

File Deletion
T1070.004

Inhibit System Recovery
T1490

Windows Management Instrumentation
T1047
Renames multiple (8359) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Deletes backup catalog 3 TTPs 1 IoCs

Uses wbadmin.exe to inhibit system recovery.

ransomware

Command and Scripting Interpreter

T1059

File Deletion

T1070.004

Inhibit System Recovery

T1490

pid	Process
2524	wbadmin.exe

Stops running service(s) 4 TTPs
evasion execution

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

Service Execution
T1569.002
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Legitimate hosting services abused for malware hosting/C2 1 TTPs 3 IoCs

Web Service

T1102

flow	ioc
3	iplogger.com
4	iplogger.com
12	iplogger.com

Sets desktop wallpaper using registry 2 TTPs 1 IoCs

ransomware

Defacement

T1491

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\4C6D.tmp.bmp"	2024100229df096d37993e1f6ac7071cb84617eemakop.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jre7\lib\zi\America\Edmonton	2024100229df096d37993e1f6ac7071cb84617eemakop.exe
File opened for modification	C:\Program Files\Java\jre7\lib\zi\EET	2024100229df096d37993e1f6ac7071cb84617eemakop.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Proof.en\Proof.XML	2024100229df096d37993e1f6ac7071cb84617eemakop.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\NA00809_.WMF	2024100229df096d37993e1f6ac7071cb84617eemakop.exe
File opened for modification	C:\Program Files\Java\jre7\lib\zi\Africa\Tunis	2024100229df096d37993e1f6ac7071cb84617eemakop.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\Gadgets\Calendar.Gadget\images\calendar_single_orange.png	2024100229df096d37993e1f6ac7071cb84617eemakop.exe
File opened for modification	C:\Program Files\Java\jre7\lib\zi\Asia\Omsk	2024100229df096d37993e1f6ac7071cb84617eemakop.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\QUAD\QUAD.INF	2024100229df096d37993e1f6ac7071cb84617eemakop.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\LINES\BD14539_.GIF	2024100229df096d37993e1f6ac7071cb84617eemakop.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\logo.png	2024100229df096d37993e1f6ac7071cb84617eemakop.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0195254.WMF	2024100229df096d37993e1f6ac7071cb84617eemakop.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\Desert.css	2024100229df096d37993e1f6ac7071cb84617eemakop.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolIcons\messageboxalert.ico	2024100229df096d37993e1f6ac7071cb84617eemakop.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\DGBORDER.DPV	2024100229df096d37993e1f6ac7071cb84617eemakop.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Guyana	2024100229df096d37993e1f6ac7071cb84617eemakop.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\STUDIO\THMBNAIL.PNG	2024100229df096d37993e1f6ac7071cb84617eemakop.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\TRANSLAT\ESEN\WT61ES.LEX	2024100229df096d37993e1f6ac7071cb84617eemakop.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\LINES\BD21324_.GIF	2024100229df096d37993e1f6ac7071cb84617eemakop.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-openide-awt.xml	2024100229df096d37993e1f6ac7071cb84617eemakop.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\icon.png	2024100229df096d37993e1f6ac7071cb84617eemakop.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\LAYERS\LAYERS.INF	2024100229df096d37993e1f6ac7071cb84617eemakop.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\AD.DPV	2024100229df096d37993e1f6ac7071cb84617eemakop.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Templates\1033\Access\DataType\Category.accft	2024100229df096d37993e1f6ac7071cb84617eemakop.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\ipssve.xml	2024100229df096d37993e1f6ac7071cb84617eemakop.exe
File opened for modification	C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\travel.png	2024100229df096d37993e1f6ac7071cb84617eemakop.exe
File opened for modification	C:\Program Files\Microsoft Games\SpiderSolitaire\it-IT\SpiderSolitaire.exe.mui	2024100229df096d37993e1f6ac7071cb84617eemakop.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\WEBHOME.POC	2024100229df096d37993e1f6ac7071cb84617eemakop.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\images\47.png	2024100229df096d37993e1f6ac7071cb84617eemakop.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Damascus	2024100229df096d37993e1f6ac7071cb84617eemakop.exe
File opened for modification	C:\Program Files\Java\jre7\lib\zi\America\Montevideo	2024100229df096d37993e1f6ac7071cb84617eemakop.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\MediaCenter.Gadget\images\button_right_mouseover.png	2024100229df096d37993e1f6ac7071cb84617eemakop.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\PSRCHLEX.DAT	2024100229df096d37993e1f6ac7071cb84617eemakop.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolBMPs\WSSFilesToolIconImagesMask.bmp	2024100229df096d37993e1f6ac7071cb84617eemakop.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\Gadgets\Clock.Gadget\images\system_h.png	2024100229df096d37993e1f6ac7071cb84617eemakop.exe
File opened for modification	C:\Program Files\DVD Maker\Shared\DvdStyles\Full\NavigationRight_SelectionSubpicture.png	2024100229df096d37993e1f6ac7071cb84617eemakop.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-templates_ja.jar	2024100229df096d37993e1f6ac7071cb84617eemakop.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-swing-plaf.xml	2024100229df096d37993e1f6ac7071cb84617eemakop.exe
File opened for modification	C:\Program Files\Microsoft Games\SpiderSolitaire\SpiderSolitaireMCE.png	2024100229df096d37993e1f6ac7071cb84617eemakop.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\images\rss_headline_glow_flyout.png	2024100229df096d37993e1f6ac7071cb84617eemakop.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\BL00242_.WMF	2024100229df096d37993e1f6ac7071cb84617eemakop.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\SO00638_.WMF	2024100229df096d37993e1f6ac7071cb84617eemakop.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\PUBSPAPR\ZPDIR8F.GIF	2024100229df096d37993e1f6ac7071cb84617eemakop.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Templates\1033\ApothecaryMergeLetter.dotx	2024100229df096d37993e1f6ac7071cb84617eemakop.exe
File opened for modification	C:\Program Files\Common Files\System\Ole DB\ja-JP\sqlxmlx.rll.mui	2024100229df096d37993e1f6ac7071cb84617eemakop.exe
File opened for modification	C:\Program Files\Java\jre7\lib\fontconfig.bfc	2024100229df096d37993e1f6ac7071cb84617eemakop.exe
File opened for modification	C:\Program Files\Java\jre7\lib\zi\SystemV\MST7MDT	2024100229df096d37993e1f6ac7071cb84617eemakop.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\DD01143_.WMF	2024100229df096d37993e1f6ac7071cb84617eemakop.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\AUTOSHAP\BD18257_.WMF	2024100229df096d37993e1f6ac7071cb84617eemakop.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\Gadgets\Currency.Gadget\fr-FR\currency.html	2024100229df096d37993e1f6ac7071cb84617eemakop.exe
File opened for modification	C:\Program Files\Java\jre7\lib\security\US_export_policy.jar	2024100229df096d37993e1f6ac7071cb84617eemakop.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0195248.WMF	2024100229df096d37993e1f6ac7071cb84617eemakop.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\com.jrockit.mc.feature.core_5.5.0.165303\feature.properties	2024100229df096d37993e1f6ac7071cb84617eemakop.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-openide-explorer.xml	2024100229df096d37993e1f6ac7071cb84617eemakop.exe
File created	C:\Program Files\Microsoft Games\Minesweeper\ja-JP\+README-WARNING+.txt	2024100229df096d37993e1f6ac7071cb84617eemakop.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\it-IT\calendar.html	2024100229df096d37993e1f6ac7071cb84617eemakop.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\FD00336_.WMF	2024100229df096d37993e1f6ac7071cb84617eemakop.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\PH02829J.JPG	2024100229df096d37993e1f6ac7071cb84617eemakop.exe
File created	C:\Program Files\Microsoft Games\Purble Place\en-US\+README-WARNING+.txt	2024100229df096d37993e1f6ac7071cb84617eemakop.exe
File opened for modification	C:\Program Files\Windows Defender\ja-JP\MpAsDesc.dll.mui	2024100229df096d37993e1f6ac7071cb84617eemakop.exe
File opened for modification	C:\Program Files (x86)\Common Files\System\msadc\it-IT\msadcfr.dll.mui	2024100229df096d37993e1f6ac7071cb84617eemakop.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\DD01178_.WMF	2024100229df096d37993e1f6ac7071cb84617eemakop.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0086424.WMF	2024100229df096d37993e1f6ac7071cb84617eemakop.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\FORMS\1033\REPLTMPL.CFG	2024100229df096d37993e1f6ac7071cb84617eemakop.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\plugin.xml	2024100229df096d37993e1f6ac7071cb84617eemakop.exe

Launches sc.exe 62 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
2576	sc.exe
572	sc.exe
2292	sc.exe
2928	sc.exe
1564	sc.exe
2956	sc.exe
2904	sc.exe
1660	sc.exe
2084	sc.exe
2652	sc.exe
2564	sc.exe
1044	sc.exe
2628	sc.exe
1224	sc.exe
320	sc.exe
2548	sc.exe
2868	sc.exe
1752	sc.exe
3032	sc.exe
2360	sc.exe
2804	sc.exe
2572	sc.exe
2416	sc.exe
2612	sc.exe
1204	sc.exe
2780	sc.exe
1664	sc.exe
1120	sc.exe
776	sc.exe
2876	sc.exe
588	sc.exe
1064	sc.exe
2892	sc.exe
1540	sc.exe
2428	sc.exe
2172	sc.exe
2544	sc.exe
400	sc.exe
2740	sc.exe
2916	sc.exe
2588	sc.exe
2604	sc.exe
2800	sc.exe
2788	sc.exe
880	sc.exe
2592	sc.exe
1560	sc.exe
2684	sc.exe
2456	sc.exe
2672	sc.exe
1412	sc.exe
2760	sc.exe
2608	sc.exe
3056	sc.exe
1968	sc.exe
1900	sc.exe
2936	sc.exe
2736	sc.exe
3052	sc.exe
2748	sc.exe
2632	sc.exe
908	sc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2024100229df096d37993e1f6ac7071cb84617eemakop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	NOTEPAD.EXE

Interacts with shadow copies 3 TTPs 1 IoCs

Shadow copies are often targeted by ransomware to inhibit system recovery.

ransomware

File Deletion

T1070.004

Inhibit System Recovery

T1490

Direct Volume Access

T1006

pid	Process
2512	vssadmin.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2708	2024100229df096d37993e1f6ac7071cb84617eemakop.exe

Suspicious use of AdjustPrivilegeToken 46 IoCs

description	pid	Process
Token: SeBackupPrivilege	2240	vssvc.exe
Token: SeRestorePrivilege	2240	vssvc.exe
Token: SeAuditPrivilege	2240	vssvc.exe
Token: SeBackupPrivilege	836	wbengine.exe
Token: SeRestorePrivilege	836	wbengine.exe
Token: SeSecurityPrivilege	836	wbengine.exe
Token: SeIncreaseQuotaPrivilege	1724	WMIC.exe
Token: SeSecurityPrivilege	1724	WMIC.exe
Token: SeTakeOwnershipPrivilege	1724	WMIC.exe
Token: SeLoadDriverPrivilege	1724	WMIC.exe
Token: SeSystemProfilePrivilege	1724	WMIC.exe
Token: SeSystemtimePrivilege	1724	WMIC.exe
Token: SeProfSingleProcessPrivilege	1724	WMIC.exe
Token: SeIncBasePriorityPrivilege	1724	WMIC.exe
Token: SeCreatePagefilePrivilege	1724	WMIC.exe
Token: SeBackupPrivilege	1724	WMIC.exe
Token: SeRestorePrivilege	1724	WMIC.exe
Token: SeShutdownPrivilege	1724	WMIC.exe
Token: SeDebugPrivilege	1724	WMIC.exe
Token: SeSystemEnvironmentPrivilege	1724	WMIC.exe
Token: SeRemoteShutdownPrivilege	1724	WMIC.exe
Token: SeUndockPrivilege	1724	WMIC.exe
Token: SeManageVolumePrivilege	1724	WMIC.exe
Token: 33	1724	WMIC.exe
Token: 34	1724	WMIC.exe
Token: 35	1724	WMIC.exe
Token: SeIncreaseQuotaPrivilege	1724	WMIC.exe
Token: SeSecurityPrivilege	1724	WMIC.exe
Token: SeTakeOwnershipPrivilege	1724	WMIC.exe
Token: SeLoadDriverPrivilege	1724	WMIC.exe
Token: SeSystemProfilePrivilege	1724	WMIC.exe
Token: SeSystemtimePrivilege	1724	WMIC.exe
Token: SeProfSingleProcessPrivilege	1724	WMIC.exe
Token: SeIncBasePriorityPrivilege	1724	WMIC.exe
Token: SeCreatePagefilePrivilege	1724	WMIC.exe
Token: SeBackupPrivilege	1724	WMIC.exe
Token: SeRestorePrivilege	1724	WMIC.exe
Token: SeShutdownPrivilege	1724	WMIC.exe
Token: SeDebugPrivilege	1724	WMIC.exe
Token: SeSystemEnvironmentPrivilege	1724	WMIC.exe
Token: SeRemoteShutdownPrivilege	1724	WMIC.exe
Token: SeUndockPrivilege	1724	WMIC.exe
Token: SeManageVolumePrivilege	1724	WMIC.exe
Token: 33	1724	WMIC.exe
Token: 34	1724	WMIC.exe
Token: 35	1724	WMIC.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2708 wrote to memory of 2980	2708	2024100229df096d37993e1f6ac7071cb84617eemakop.exe	30
PID 2708 wrote to memory of 2980	2708	2024100229df096d37993e1f6ac7071cb84617eemakop.exe	30
PID 2708 wrote to memory of 2980	2708	2024100229df096d37993e1f6ac7071cb84617eemakop.exe	30
PID 2708 wrote to memory of 2980	2708	2024100229df096d37993e1f6ac7071cb84617eemakop.exe	30
PID 2980 wrote to memory of 2672	2980	cmd.exe	32
PID 2980 wrote to memory of 2672	2980	cmd.exe	32
PID 2980 wrote to memory of 2672	2980	cmd.exe	32
PID 2980 wrote to memory of 2876	2980	cmd.exe	33
PID 2980 wrote to memory of 2876	2980	cmd.exe	33
PID 2980 wrote to memory of 2876	2980	cmd.exe	33
PID 2980 wrote to memory of 2572	2980	cmd.exe	34
PID 2980 wrote to memory of 2572	2980	cmd.exe	34
PID 2980 wrote to memory of 2572	2980	cmd.exe	34
PID 2980 wrote to memory of 1900	2980	cmd.exe	35
PID 2980 wrote to memory of 1900	2980	cmd.exe	35
PID 2980 wrote to memory of 1900	2980	cmd.exe	35
PID 2980 wrote to memory of 2868	2980	cmd.exe	36
PID 2980 wrote to memory of 2868	2980	cmd.exe	36
PID 2980 wrote to memory of 2868	2980	cmd.exe	36
PID 2980 wrote to memory of 2892	2980	cmd.exe	37
PID 2980 wrote to memory of 2892	2980	cmd.exe	37
PID 2980 wrote to memory of 2892	2980	cmd.exe	37
PID 2980 wrote to memory of 2936	2980	cmd.exe	38
PID 2980 wrote to memory of 2936	2980	cmd.exe	38
PID 2980 wrote to memory of 2936	2980	cmd.exe	38
PID 2980 wrote to memory of 2916	2980	cmd.exe	39
PID 2980 wrote to memory of 2916	2980	cmd.exe	39
PID 2980 wrote to memory of 2916	2980	cmd.exe	39
PID 2980 wrote to memory of 2592	2980	cmd.exe	40
PID 2980 wrote to memory of 2592	2980	cmd.exe	40
PID 2980 wrote to memory of 2592	2980	cmd.exe	40
PID 2980 wrote to memory of 2588	2980	cmd.exe	41
PID 2980 wrote to memory of 2588	2980	cmd.exe	41
PID 2980 wrote to memory of 2588	2980	cmd.exe	41
PID 2980 wrote to memory of 2736	2980	cmd.exe	42
PID 2980 wrote to memory of 2736	2980	cmd.exe	42
PID 2980 wrote to memory of 2736	2980	cmd.exe	42
PID 2980 wrote to memory of 2612	2980	cmd.exe	43
PID 2980 wrote to memory of 2612	2980	cmd.exe	43
PID 2980 wrote to memory of 2612	2980	cmd.exe	43
PID 2980 wrote to memory of 1752	2980	cmd.exe	44
PID 2980 wrote to memory of 1752	2980	cmd.exe	44
PID 2980 wrote to memory of 1752	2980	cmd.exe	44
PID 2980 wrote to memory of 2564	2980	cmd.exe	45
PID 2980 wrote to memory of 2564	2980	cmd.exe	45
PID 2980 wrote to memory of 2564	2980	cmd.exe	45
PID 2980 wrote to memory of 2576	2980	cmd.exe	46
PID 2980 wrote to memory of 2576	2980	cmd.exe	46
PID 2980 wrote to memory of 2576	2980	cmd.exe	46
PID 2980 wrote to memory of 1560	2980	cmd.exe	47
PID 2980 wrote to memory of 1560	2980	cmd.exe	47
PID 2980 wrote to memory of 1560	2980	cmd.exe	47
PID 2980 wrote to memory of 2628	2980	cmd.exe	48
PID 2980 wrote to memory of 2628	2980	cmd.exe	48
PID 2980 wrote to memory of 2628	2980	cmd.exe	48
PID 2980 wrote to memory of 2684	2980	cmd.exe	49
PID 2980 wrote to memory of 2684	2980	cmd.exe	49
PID 2980 wrote to memory of 2684	2980	cmd.exe	49
PID 2980 wrote to memory of 3052	2980	cmd.exe	50
PID 2980 wrote to memory of 3052	2980	cmd.exe	50
PID 2980 wrote to memory of 3052	2980	cmd.exe	50
PID 2980 wrote to memory of 2608	2980	cmd.exe	51
PID 2980 wrote to memory of 2608	2980	cmd.exe	51
PID 2980 wrote to memory of 2608	2980	cmd.exe	51

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\2024100229df096d37993e1f6ac7071cb84617eemakop.exe
"C:\Users\Admin\AppData\Local\Temp\2024100229df096d37993e1f6ac7071cb84617eemakop.exe"
1⤵
- Sets desktop wallpaper using registry
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2708
- C:\Windows\system32\cmd.exe
  "C:\Windows\system32\cmd.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2980
- - C:\Windows\system32\sc.exe
    sc delete vmickvpexchange
    3⤵
    - Launches sc.exe
    PID:2672
- - C:\Windows\system32\sc.exe
    sc delete vmicguestinterface
    3⤵
    - Launches sc.exe
    PID:2876
- - C:\Windows\system32\sc.exe
    sc delete vmicshutdown
    3⤵
    - Launches sc.exe
    PID:2572
- - C:\Windows\system32\sc.exe
    sc delete vmicheartbeat
    3⤵
    - Launches sc.exe
    PID:1900
- - C:\Windows\system32\sc.exe
    sc delete vmicrdv
    3⤵
    - Launches sc.exe
    PID:2868
- - C:\Windows\system32\sc.exe
    sc delete storflt
    3⤵
    - Launches sc.exe
    PID:2892
- - C:\Windows\system32\sc.exe
    sc delete vmictimesync
    3⤵
    - Launches sc.exe
    PID:2936
- - C:\Windows\system32\sc.exe
    sc delete vmicvss
    3⤵
    - Launches sc.exe
    PID:2916
- - C:\Windows\system32\sc.exe
    sc delete MSSQLFDLauncher
    3⤵
    - Launches sc.exe
    PID:2592
- - C:\Windows\system32\sc.exe
    sc delete MSSQLSERVER
    3⤵
    - Launches sc.exe
    PID:2588
- - C:\Windows\system32\sc.exe
    sc delete SQLSERVERAGENT
    3⤵
    - Launches sc.exe
    PID:2736
- - C:\Windows\system32\sc.exe
    sc delete SQLBrowser
    3⤵
    - Launches sc.exe
    PID:2612
- - C:\Windows\system32\sc.exe
    sc delete SQLTELEMETRY
    3⤵
    - Launches sc.exe
    PID:1752
- - C:\Windows\system32\sc.exe
    sc delete MsDtsServer130
    3⤵
    - Launches sc.exe
    PID:2564
- - C:\Windows\system32\sc.exe
    sc delete SSISTELEMETRY130
    3⤵
    - Launches sc.exe
    PID:2576
- - C:\Windows\system32\sc.exe
    sc delete SQLWriter
    3⤵
    - Launches sc.exe
    PID:1560
- - C:\Windows\system32\sc.exe
    sc delete "MSSQL$VEEAMSQL2012"
    3⤵
    - Launches sc.exe
    PID:2628
- - C:\Windows\system32\sc.exe
    sc delete "SQLAgent$VEEAMSQL2012"
    3⤵
    - Launches sc.exe
    PID:2684
- - C:\Windows\system32\sc.exe
    sc delete MSSQL
    3⤵
    - Launches sc.exe
    PID:3052
- - C:\Windows\system32\sc.exe
    sc delete SQLAgent
    3⤵
    - Launches sc.exe
    PID:2608
- - C:\Windows\system32\sc.exe
    sc delete MSSQLServerADHelper100
    3⤵
    - Launches sc.exe
    PID:3056
- - C:\Windows\system32\sc.exe
    sc delete MSSQLServerOLAPService
    3⤵
    - Launches sc.exe
    PID:1224
- - C:\Windows\system32\sc.exe
    sc delete MsDtsServer100
    3⤵
    - Launches sc.exe
    PID:588
- - C:\Windows\system32\sc.exe
    sc delete ReportServer
    3⤵
    - Launches sc.exe
    PID:1540
- - C:\Windows\system32\sc.exe
    sc delete "SQLTELEMETRY$HL"
    3⤵
    - Launches sc.exe
    PID:2904
- - C:\Windows\system32\sc.exe
    sc delete TMBMServer
    3⤵
    - Launches sc.exe
    PID:2956
- - C:\Windows\system32\sc.exe
    sc delete "MSSQL$PROGID"
    3⤵
    - Launches sc.exe
    PID:3032
- - C:\Windows\system32\sc.exe
    sc delete "MSSQL$WOLTERSKLUWER"
    3⤵
    - Launches sc.exe
    PID:2604
- - C:\Windows\system32\sc.exe
    sc delete "SQLAgent$PROGID"
    3⤵
    - Launches sc.exe
    PID:1064
- - C:\Windows\system32\sc.exe
    sc delete "SQLAgent$WOLTERSKLUWER"
    3⤵
    - Launches sc.exe
    PID:1044
- - C:\Windows\system32\sc.exe
    sc delete "MSSQLFDLauncher$OPTIMA"
    3⤵
    - Launches sc.exe
    PID:2428
- - C:\Windows\system32\sc.exe
    sc delete "MSSQL$OPTIMA"
    3⤵
    - Launches sc.exe
    PID:572
- - C:\Windows\system32\sc.exe
    sc delete "SQLAgent$OPTIMA"
    3⤵
    - Launches sc.exe
    PID:2172
- - C:\Windows\system32\sc.exe
    sc delete "ReportServer$OPTIMA"
    3⤵
    - Launches sc.exe
    PID:1204
- - C:\Windows\system32\sc.exe
    sc delete "msftesql$SQLEXPRESS"
    3⤵
    - Launches sc.exe
    PID:2780
- - C:\Windows\system32\sc.exe
    sc delete "postgresql-x64-9.4"
    3⤵
    - Launches sc.exe
    PID:2748
- - C:\Windows\system32\sc.exe
    sc delete WRSVC
    3⤵
    - Launches sc.exe
    PID:2360
- - C:\Windows\system32\sc.exe
    sc delete ekrn
    3⤵
    - Launches sc.exe
    PID:1968
- - C:\Windows\system32\sc.exe
    sc delete klim6
    3⤵
    - Launches sc.exe
    PID:2292
- - C:\Windows\system32\sc.exe
    sc delete "AVP18.0.0"
    3⤵
    - Launches sc.exe
    PID:1660
- - C:\Windows\system32\sc.exe
    sc delete KLIF
    3⤵
    - Launches sc.exe
    PID:2632
- - C:\Windows\system32\sc.exe
    sc delete klpd
    3⤵
    - Launches sc.exe
    PID:2800
- - C:\Windows\system32\sc.exe
    sc delete klflt
    3⤵
    - Launches sc.exe
    PID:2804
- - C:\Windows\system32\sc.exe
    sc delete klbackupdisk
    3⤵
    - Launches sc.exe
    PID:2084
- - C:\Windows\system32\sc.exe
    sc delete klbackupflt
    3⤵
    - Launches sc.exe
    PID:2456
- - C:\Windows\system32\sc.exe
    sc delete klkbdflt
    3⤵
    - Launches sc.exe
    PID:2788
- - C:\Windows\system32\sc.exe
    sc delete klmouflt
    3⤵
    - Launches sc.exe
    PID:1412
- - C:\Windows\system32\sc.exe
    sc delete klhk
    3⤵
    - Launches sc.exe
    PID:1664
- - C:\Windows\system32\sc.exe
    sc delete "KSDE1.0.0"
    3⤵
    - Launches sc.exe
    PID:2928
- - C:\Windows\system32\sc.exe
    sc delete kltap
    3⤵
    - Launches sc.exe
    PID:2652
- - C:\Windows\system32\sc.exe
    sc delete TmFilter
    3⤵
    - Launches sc.exe
    PID:2760
- - C:\Windows\system32\sc.exe
    sc delete TMLWCSService
    3⤵
    - Launches sc.exe
    PID:1120
- - C:\Windows\system32\sc.exe
    sc delete tmusa
    3⤵
    - Launches sc.exe
    PID:908
- - C:\Windows\system32\sc.exe
    sc delete TmPreFilter
    3⤵
    - Launches sc.exe
    PID:880
- - C:\Windows\system32\sc.exe
    sc delete TMSmartRelayService
    3⤵
    - Launches sc.exe
    PID:400
- - C:\Windows\system32\sc.exe
    sc delete TMiCRCScanService
    3⤵
    - Launches sc.exe
    PID:320
- - C:\Windows\system32\sc.exe
    sc delete VSApiNt
    3⤵
    - Launches sc.exe
    PID:776
- - C:\Windows\system32\sc.exe
    sc delete TmCCSF
    3⤵
    - Launches sc.exe
    PID:2544
- - C:\Windows\system32\sc.exe
    sc delete tmlisten
    3⤵
    - Launches sc.exe
    PID:2416
- - C:\Windows\system32\sc.exe
    sc delete TmProxy
    3⤵
    - Launches sc.exe
    PID:2740
- - C:\Windows\system32\sc.exe
    sc delete ntrtscan
    3⤵
    - Launches sc.exe
    PID:1564
- - C:\Windows\system32\sc.exe
    sc delete ofcservice
    3⤵
    - Launches sc.exe
    PID:2548
- - C:\Windows\system32\vssadmin.exe
    vssadmin delete shadows /all /quiet
    3⤵
    - Interacts with shadow copies
    PID:2512
- - C:\Windows\system32\wbadmin.exe
    wbadmin delete catalog -quiet
    3⤵
    - Deletes backup catalog
    PID:2524
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic shadowcopy delete
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:1724
- C:\Windows\SysWOW64\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\+README-WARNING+.txt
  2⤵
  - System Location Discovery: System Language Discovery
  PID:796
- C:\Windows\SysWOW64\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\+README-WARNING+.txt
  2⤵
  PID:2776

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2240

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:836

C:\Windows\System32\vdsldr.exe
C:\Windows\System32\vdsldr.exe -Embedding
1⤵
PID:1704

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
PID:1552

C:\Windows\system32\Dwm.exe
"C:\Windows\system32\Dwm.exe"
1⤵
PID:2152

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

System Services

T1569

Service Execution

T1569.002

Windows Management Instrumentation

T1047

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Direct Volume Access

T1006

Impair Defenses

T1562

Indicator Removal

T1070

File Deletion

T1070.004

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Defacement

T1491

Inhibit System Recovery

T1490

Service Stop

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\+README-WARNING+.txt

Filesize
1KB

MD5
db4e24160efed62372eca19d0e93f54b

SHA1
3f6cd25e6fe834ba850fe9c956ab7448e8a02c95

SHA256
192e0e3f08d28568ca9f16db6a5833e55072294f75acb872e24b5725d58e0f7a

SHA512
0ede14ced3b90cce4e507d9b938c6d179b59b6b7e85ae582e84ff55b4af19809e663d8505a4548197433fe9e89c66cd1a41e9d084fb0f40b527be71c175886f3

Download Submit