Analysis
-
max time kernel
68s -
max time network
19s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system -
submitted
15/12/2024, 19:42
Behavioral task
behavioral1
Sample
2024-12-15_3403f9816386da96eb1d0e1065034eda_makop.exe
Resource
win7-20241010-en
Behavioral task
behavioral2
Sample
2024-12-15_3403f9816386da96eb1d0e1065034eda_makop.exe
Resource
win10v2004-20241007-en
General
-
Target
2024-12-15_3403f9816386da96eb1d0e1065034eda_makop.exe
-
Size
52KB
-
MD5
3403f9816386da96eb1d0e1065034eda
-
SHA1
71372ff6121f279ca2cb7adaf0d84f10fb859705
-
SHA256
5b37aca4247965dd05c07471f6746eb54c0133cdf4be48c20cff345dd8aa4e8a
-
SHA512
502cce3b8ab65bcfe43d9e8c45f247a64f9b65a005e1df25eb8037944118dbfd511773e04319f41cd8d43951fc7fae0e902b96c1740800c622da8d51d08c5ee2
-
SSDEEP
768:MaQRff/B31aCytHLykiKPT3JATD2qBwV2ckjbnsb0Ah99De0YADxy6vd8/LF84:MaC318HxZATvnsblYOE618W
Malware Config
Extracted
C:\MSOCache\All Users\{90140000-0018-0409-0000-0000000FF1CE}-C\+README-WARNING+.txt
Signatures
-
Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Renames multiple (2777) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
pid Process 2780 wbadmin.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Microsoft Games\Purble Place\it-IT\PurblePlace.exe.mui 2024-12-15_3403f9816386da96eb1d0e1065034eda_makop.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\ml\LC_MESSAGES\vlc.mo 2024-12-15_3403f9816386da96eb1d0e1065034eda_makop.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\de-DE\gadget.xml 2024-12-15_3403f9816386da96eb1d0e1065034eda_makop.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\css\dark\e4-dark_basestyle.css 2024-12-15_3403f9816386da96eb1d0e1065034eda_makop.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-spi-actions_ja.jar 2024-12-15_3403f9816386da96eb1d0e1065034eda_makop.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\America\Campo_Grande 2024-12-15_3403f9816386da96eb1d0e1065034eda_makop.exe File opened for modification C:\Program Files\Common Files\System\ado\msado21.tlb 2024-12-15_3403f9816386da96eb1d0e1065034eda_makop.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\America\Menominee 2024-12-15_3403f9816386da96eb1d0e1065034eda_makop.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\css\ui-lightness\images\ui-icons_ef8c08_256x240.png 2024-12-15_3403f9816386da96eb1d0e1065034eda_makop.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\es-ES\gadget.xml 2024-12-15_3403f9816386da96eb1d0e1065034eda_makop.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\configuration\config.ini 2024-12-15_3403f9816386da96eb1d0e1065034eda_makop.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.ql.nl_ja_4.4.0.v20140623020002.jar 2024-12-15_3403f9816386da96eb1d0e1065034eda_makop.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Europe\Athens 2024-12-15_3403f9816386da96eb1d0e1065034eda_makop.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Europe\Dublin 2024-12-15_3403f9816386da96eb1d0e1065034eda_makop.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\ru-RU\tipresx.dll.mui 2024-12-15_3403f9816386da96eb1d0e1065034eda_makop.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Belem 2024-12-15_3403f9816386da96eb1d0e1065034eda_makop.exe File opened for modification C:\Program Files\Java\jre7\lib\security\javaws.policy 2024-12-15_3403f9816386da96eb1d0e1065034eda_makop.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\it-IT\tabskb.dll.mui 2024-12-15_3403f9816386da96eb1d0e1065034eda_makop.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Vladivostok 2024-12-15_3403f9816386da96eb1d0e1065034eda_makop.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Etc\GMT-5 2024-12-15_3403f9816386da96eb1d0e1065034eda_makop.exe File opened for modification C:\Program Files\Windows Journal\fr-FR\NBMapTIP.dll.mui 2024-12-15_3403f9816386da96eb1d0e1065034eda_makop.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\es-ES\css\clock.css 2024-12-15_3403f9816386da96eb1d0e1065034eda_makop.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\North_Dakota\Beulah 2024-12-15_3403f9816386da96eb1d0e1065034eda_makop.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Atlantic\Bermuda 2024-12-15_3403f9816386da96eb1d0e1065034eda_makop.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.e4.rcp_1.3.100.v20141007-2033\epl-v10.html 2024-12-15_3403f9816386da96eb1d0e1065034eda_makop.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\kab\LC_MESSAGES\vlc.mo 2024-12-15_3403f9816386da96eb1d0e1065034eda_makop.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Etc\GMT+10 2024-12-15_3403f9816386da96eb1d0e1065034eda_makop.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Europe\London 2024-12-15_3403f9816386da96eb1d0e1065034eda_makop.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Pacific\Tongatapu 2024-12-15_3403f9816386da96eb1d0e1065034eda_makop.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\update_tracking\com-sun-tools-visualvm-threaddump.xml 2024-12-15_3403f9816386da96eb1d0e1065034eda_makop.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\passport.png 2024-12-15_3403f9816386da96eb1d0e1065034eda_makop.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\com.jrockit.mc.feature.core_5.5.0.165303\feature.xml 2024-12-15_3403f9816386da96eb1d0e1065034eda_makop.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rcp.intro_5.5.0.165303.jar 2024-12-15_3403f9816386da96eb1d0e1065034eda_makop.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\p2\org.eclipse.equinox.p2.core\cache\+README-WARNING+.txt 2024-12-15_3403f9816386da96eb1d0e1065034eda_makop.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.docs_5.5.0.165303.jar 2024-12-15_3403f9816386da96eb1d0e1065034eda_makop.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-api-visual.xml 2024-12-15_3403f9816386da96eb1d0e1065034eda_makop.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\intf\luac.luac 2024-12-15_3403f9816386da96eb1d0e1065034eda_makop.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\images\square_s.png 2024-12-15_3403f9816386da96eb1d0e1065034eda_makop.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\EST 2024-12-15_3403f9816386da96eb1d0e1065034eda_makop.exe File opened for modification C:\Program Files\Java\jre7\lib\ext\localedata.jar 2024-12-15_3403f9816386da96eb1d0e1065034eda_makop.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\tt\LC_MESSAGES\vlc.mo 2024-12-15_3403f9816386da96eb1d0e1065034eda_makop.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\es-ES\js\library.js 2024-12-15_3403f9816386da96eb1d0e1065034eda_makop.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\FlipPage\pagecurl.png 2024-12-15_3403f9816386da96eb1d0e1065034eda_makop.exe File opened for modification C:\Program Files\Microsoft Games\FreeCell\FreeCellMCE.png 2024-12-15_3403f9816386da96eb1d0e1065034eda_makop.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\images\Folder-48.png 2024-12-15_3403f9816386da96eb1d0e1065034eda_makop.exe File opened for modification C:\Program Files\Windows Photo Viewer\es-ES\PhotoViewer.dll.mui 2024-12-15_3403f9816386da96eb1d0e1065034eda_makop.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\TipRes.dll.mui 2024-12-15_3403f9816386da96eb1d0e1065034eda_makop.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Africa\Windhoek 2024-12-15_3403f9816386da96eb1d0e1065034eda_makop.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\Helsinki 2024-12-15_3403f9816386da96eb1d0e1065034eda_makop.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\es_MX\LC_MESSAGES\vlc.mo 2024-12-15_3403f9816386da96eb1d0e1065034eda_makop.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\rtscom.dll.mui 2024-12-15_3403f9816386da96eb1d0e1065034eda_makop.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.ui.sdk.scheduler_1.2.0.v20140422-1847.jar 2024-12-15_3403f9816386da96eb1d0e1065034eda_makop.exe File opened for modification C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\WinFXList.xml 2024-12-15_3403f9816386da96eb1d0e1065034eda_makop.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.reconciler.dropins.nl_ja_4.4.0.v20140623020002.jar 2024-12-15_3403f9816386da96eb1d0e1065034eda_makop.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Africa\Tripoli 2024-12-15_3403f9816386da96eb1d0e1065034eda_makop.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Pangnirtung 2024-12-15_3403f9816386da96eb1d0e1065034eda_makop.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.ssl.feature_1.0.0.v20140827-1444\+README-WARNING+.txt 2024-12-15_3403f9816386da96eb1d0e1065034eda_makop.exe File opened for modification C:\Program Files\Windows Media Player\ja-JP\WMPDMC.exe.mui 2024-12-15_3403f9816386da96eb1d0e1065034eda_makop.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\it-IT\settings.html 2024-12-15_3403f9816386da96eb1d0e1065034eda_makop.exe File created C:\Program Files\VideoLAN\VLC\locale\de\LC_MESSAGES\+README-WARNING+.txt 2024-12-15_3403f9816386da96eb1d0e1065034eda_makop.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\ResizingPanels\NavigationLeft_ButtonGraphic.png 2024-12-15_3403f9816386da96eb1d0e1065034eda_makop.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Argentina\Buenos_Aires 2024-12-15_3403f9816386da96eb1d0e1065034eda_makop.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.ui_5.5.0.165303.jar 2024-12-15_3403f9816386da96eb1d0e1065034eda_makop.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-openide-explorer.jar 2024-12-15_3403f9816386da96eb1d0e1065034eda_makop.exe -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2024-12-15_3403f9816386da96eb1d0e1065034eda_makop.exe -
Interacts with shadow copies 3 TTPs 1 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
pid Process 2156 vssadmin.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 2580 2024-12-15_3403f9816386da96eb1d0e1065034eda_makop.exe -
Suspicious use of AdjustPrivilegeToken 46 IoCs
description pid Process Token: SeBackupPrivilege 2772 vssvc.exe Token: SeRestorePrivilege 2772 vssvc.exe Token: SeAuditPrivilege 2772 vssvc.exe Token: SeBackupPrivilege 2684 wbengine.exe Token: SeRestorePrivilege 2684 wbengine.exe Token: SeSecurityPrivilege 2684 wbengine.exe Token: SeIncreaseQuotaPrivilege 564 WMIC.exe Token: SeSecurityPrivilege 564 WMIC.exe Token: SeTakeOwnershipPrivilege 564 WMIC.exe Token: SeLoadDriverPrivilege 564 WMIC.exe Token: SeSystemProfilePrivilege 564 WMIC.exe Token: SeSystemtimePrivilege 564 WMIC.exe Token: SeProfSingleProcessPrivilege 564 WMIC.exe Token: SeIncBasePriorityPrivilege 564 WMIC.exe Token: SeCreatePagefilePrivilege 564 WMIC.exe Token: SeBackupPrivilege 564 WMIC.exe Token: SeRestorePrivilege 564 WMIC.exe Token: SeShutdownPrivilege 564 WMIC.exe Token: SeDebugPrivilege 564 WMIC.exe Token: SeSystemEnvironmentPrivilege 564 WMIC.exe Token: SeRemoteShutdownPrivilege 564 WMIC.exe Token: SeUndockPrivilege 564 WMIC.exe Token: SeManageVolumePrivilege 564 WMIC.exe Token: 33 564 WMIC.exe Token: 34 564 WMIC.exe Token: 35 564 WMIC.exe Token: SeIncreaseQuotaPrivilege 564 WMIC.exe Token: SeSecurityPrivilege 564 WMIC.exe Token: SeTakeOwnershipPrivilege 564 WMIC.exe Token: SeLoadDriverPrivilege 564 WMIC.exe Token: SeSystemProfilePrivilege 564 WMIC.exe Token: SeSystemtimePrivilege 564 WMIC.exe Token: SeProfSingleProcessPrivilege 564 WMIC.exe Token: SeIncBasePriorityPrivilege 564 WMIC.exe Token: SeCreatePagefilePrivilege 564 WMIC.exe Token: SeBackupPrivilege 564 WMIC.exe Token: SeRestorePrivilege 564 WMIC.exe Token: SeShutdownPrivilege 564 WMIC.exe Token: SeDebugPrivilege 564 WMIC.exe Token: SeSystemEnvironmentPrivilege 564 WMIC.exe Token: SeRemoteShutdownPrivilege 564 WMIC.exe Token: SeUndockPrivilege 564 WMIC.exe Token: SeManageVolumePrivilege 564 WMIC.exe Token: 33 564 WMIC.exe Token: 34 564 WMIC.exe Token: 35 564 WMIC.exe -
Suspicious use of WriteProcessMemory 13 IoCs
description pid Process procid_target PID 2580 wrote to memory of 2288 2580 2024-12-15_3403f9816386da96eb1d0e1065034eda_makop.exe 29 PID 2580 wrote to memory of 2288 2580 2024-12-15_3403f9816386da96eb1d0e1065034eda_makop.exe 29 PID 2580 wrote to memory of 2288 2580 2024-12-15_3403f9816386da96eb1d0e1065034eda_makop.exe 29 PID 2580 wrote to memory of 2288 2580 2024-12-15_3403f9816386da96eb1d0e1065034eda_makop.exe 29 PID 2288 wrote to memory of 2156 2288 cmd.exe 31 PID 2288 wrote to memory of 2156 2288 cmd.exe 31 PID 2288 wrote to memory of 2156 2288 cmd.exe 31 PID 2288 wrote to memory of 2780 2288 cmd.exe 34 PID 2288 wrote to memory of 2780 2288 cmd.exe 34 PID 2288 wrote to memory of 2780 2288 cmd.exe 34 PID 2288 wrote to memory of 564 2288 cmd.exe 38 PID 2288 wrote to memory of 564 2288 cmd.exe 38 PID 2288 wrote to memory of 564 2288 cmd.exe 38 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
-
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-12-15_3403f9816386da96eb1d0e1065034eda_makop.exe"C:\Users\Admin\AppData\Local\Temp\2024-12-15_3403f9816386da96eb1d0e1065034eda_makop.exe"1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2580 -
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:2288 -
C:\Windows\system32\vssadmin.exevssadmin delete shadows /all /quiet3⤵
- Interacts with shadow copies
PID:2156
-
-
C:\Windows\system32\wbadmin.exewbadmin delete catalog -quiet3⤵
- Deletes backup catalog
PID:2780
-
-
C:\Windows\System32\Wbem\WMIC.exewmic shadowcopy delete3⤵
- Suspicious use of AdjustPrivilegeToken
PID:564
-
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2772
-
C:\Windows\system32\wbengine.exe"C:\Windows\system32\wbengine.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2684
-
C:\Windows\System32\vdsldr.exeC:\Windows\System32\vdsldr.exe -Embedding1⤵PID:1184
-
C:\Windows\System32\vds.exeC:\Windows\System32\vds.exe1⤵PID:2184
-
C:\Windows\system32\Dwm.exe"C:\Windows\system32\Dwm.exe"1⤵PID:2748
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD55d377addd5fb119f9d200838847ff087
SHA18cdf851e8945d590a672a594cbce8fa354e4542e
SHA256dd62f39b01cf2120c9e21add9e80396b44704d3d9e5499de2ef26fa5824c10bb
SHA512c2779f2e5b30bd6d8337e6663cf17d4ae972f758a894d481b01b3d4f7336734259615592fb7a975b134f5cbc5db19647d26a32f7938c975c361c264d36eeae0c