Overview

overview

10

Static

static

10

4339192e18...12.exe

windows7_x64

10

4339192e18...12.exe

windows10_x64

10

Resubmissions

19-10-2021 14:03

211019-rcwpqsfhg4 10

19-10-2021 13:56

211019-q8vxmsfhf4 10

15-10-2021 16:42

211015-t719tabbe4 10

Analysis

  • max time kernel
    138s
  • max time network
    133s
  • platform
    windows10_x64
  • resource
    win10-en-20210920
  • submitted
    19-10-2021 14:03

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    4339192e184bea89107928ccd5bcc1f5d4a928922361ab3f999926f74a0f6512.exe

  • Size

    42KB

  • MD5

    d29a5ac669fd239a2df8a7ba6bad4b75

  • SHA1

    b18e00d53474c95fa0720b1720557e4d9a09f161

  • SHA256

    4339192e184bea89107928ccd5bcc1f5d4a928922361ab3f999926f74a0f6512

  • SHA512

    c1e104375d445d7431fd68d0cb6731e459aa0be5b8495bcdca147d0052aa18e4a1f0817d54e2b72489cc9668772c36d6243f716cf542d48a3514f4fb3060a7b6

Score
10/10
makoppersistenceransomwarespywarestealer

Malware Config

Extracted

Path

C:\Users\Admin\AppData\Local\Temp\926737707\readme-warning.txt

Family

makop

Ransom Note
::: Greetings ::: Little FAQ: .1. Q: Whats Happen? A: Your files have been encrypted and now have the "makop" extension. The file structure was not damaged, we did everything possible so that this could not happen. .2. Q: How to recover files? A: If you wish to decrypt your files you will need to pay in bitcoins. .3. Q: What about guarantees? A: Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will cooperate with us. Its not in our interests. To check the ability of returning files, you can send to us any 2 files with SIMPLE extensions(jpg,xls,doc, etc... not databases!) and low sizes(max 1 mb), we will decrypt them and send back to you. That is our guarantee. .4. Q: How to contact with you? A: You can write us to our mailbox: makopransom@outlook.com .5. Q: How will the decryption process proceed after payment? A: After payment we will send to you our scanner-decoder program and detailed instructions for use. With this program you will be able to decrypt all your encrypted files. .6. Q: If I don�t want to pay bad people like you? A: If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause only we have the private key. In practice - time is much more valuable than money. :::BEWARE::: DON'T try to change encrypted files by yourself! If you will try to use any third party software for restoring your data or antivirus solutions - please make a backup for all encrypted files! Any changes in encrypted files may entail damage of the private key and, as result, the loss all data.
Emails

makopransom@outlook.com

Signatures

  • Makop

    Ransomware family discovered by @VK_Intel in early 2020.

    ransomwaremakop
  • Suspicious use of NtCreateProcessExOtherParentProcess 1 IoCs
  • Deletes shadow copies 2 TTPs

    Ransomware often targets backup files to inhibit system recovery.

    ransomware
  • Deletes backup catalog 3 TTPs 1 IoCs

    Uses wbadmin.exe to inhibit system recovery.

    ransomware
  • Modifies Installed Components in the registry 2 TTPs
    persistence
  • Modifies extensions of user files 1 IoCs

    Ransomware generally changes the extension on encrypted files.

    ransomware
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Enumerates connected drives 3 TTPs 1 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Legitimate hosting services abused for malware hosting/C2 1 TTPs
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 12 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Program crash 2 IoCs
  • Checks SCSI registry key(s) 3 TTPs 16 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 6 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 7 IoCs
  • Interacts with shadow copies 2 TTPs 1 IoCs

    Shadow copies are often targeted by ransomware to inhibit system recovery.

    ransomware
  • Modifies registry class 31 IoCs
  • Modifies system certificate store 2 TTPs 2 IoCs
    evasionspywaretrojan
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 35 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 46 IoCs
  • Suspicious use of SendNotifyMessage 24 IoCs
  • Suspicious use of SetWindowsHookEx 12 IoCs
  • Suspicious use of WriteProcessMemory 11 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\4339192e184bea89107928ccd5bcc1f5d4a928922361ab3f999926f74a0f6512.exe
    "C:\Users\Admin\AppData\Local\Temp\4339192e184bea89107928ccd5bcc1f5d4a928922361ab3f999926f74a0f6512.exe"
    1⤵
    • Modifies extensions of user files
    • Drops file in Program Files directory
    • Modifies registry class
    • Modifies system certificate store
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:1752
    • C:\Windows\system32\cmd.exe
      "C:\Windows\system32\cmd.exe"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:668
      • C:\Windows\system32\vssadmin.exe
        vssadmin delete shadows /all /quiet
        3⤵
        • Interacts with shadow copies
        PID:2384
      • C:\Windows\system32\wbadmin.exe
        wbadmin delete catalog -quiet
        3⤵
        • Deletes backup catalog
        PID:3888
      • C:\Windows\System32\Wbem\WMIC.exe
        wmic shadowcopy delete
        3⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:632
    • C:\Windows\SysWOW64\NOTEPAD.EXE
      "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\readme-warning.txt
      2⤵
        PID:3344
    • C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
      "C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\Desktop\RestoreConvertFrom.ods"
      1⤵
      • Checks processor information in registry
      • Enumerates system info in registry
      • Suspicious behavior: AddClipboardFormatListener
      • Suspicious use of SetWindowsHookEx
      PID:1876
    • C:\Windows\system32\vssvc.exe
      C:\Windows\system32\vssvc.exe
      1⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:1264
    • C:\Windows\system32\wbengine.exe
      "C:\Windows\system32\wbengine.exe"
      1⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:2304
    • C:\Windows\System32\vdsldr.exe
      C:\Windows\System32\vdsldr.exe -Embedding
      1⤵
        PID:3848
      • C:\Windows\System32\vds.exe
        C:\Windows\System32\vds.exe
        1⤵
        • Checks SCSI registry key(s)
        PID:3232
      • C:\Windows\system32\WerFault.exe
        C:\Windows\system32\WerFault.exe -u -p 2872 -s 2648
        1⤵
        • Program crash
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:1320
      • C:\Windows\explorer.exe
        explorer.exe
        1⤵
        • Enumerates connected drives
        • Drops file in Windows directory
        • Checks SCSI registry key(s)
        • Modifies registry class
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        PID:776
      • C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe
        "C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe" -ServerName:App.AppXtk181tbxbce2qsex02s8tw7hfxa9xb3t.mca
        1⤵
        • Drops file in Windows directory
        • Suspicious use of SetWindowsHookEx
        PID:212
      • C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe
        "C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe" -ServerName:CortanaUI.AppXa50dqqa5gqv4a428c9y1jjw7m3btvepj.mca
        1⤵
        • Drops file in Windows directory
        • Suspicious use of SetWindowsHookEx
        PID:2812
        • C:\Windows\system32\WerFault.exe
          C:\Windows\system32\WerFault.exe -u -p 2812 -s 2040
          2⤵
          • Suspicious use of NtCreateProcessExOtherParentProcess
          • Program crash
          • Checks processor information in registry
          • Enumerates system info in registry
          • Suspicious behavior: EnumeratesProcesses
          PID:184
      • C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe
        "C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe" -ServerName:CortanaUI.AppXa50dqqa5gqv4a428c9y1jjw7m3btvepj.mca
        1⤵
        • Drops file in Windows directory
        • Enumerates system info in registry
        • Modifies registry class
        • Suspicious use of SetWindowsHookEx
        PID:3816

      Network

      MITRE ATT&CK Matrix ATT&CK v6

      Initial Access

      Execution

      Command-Line Interface

      1
      T1059

      Persistence

      Registry Run Keys / Startup Folder

      1
      T1060

      Privilege Escalation

      Defense Evasion

      File Deletion

      3
      T1107

      Modify Registry

      2
      T1112

      Install Root Certificate

      1
      T1130

      Credential Access

      Credentials in Files

      1
      T1081

      Discovery

      Query Registry

      4
      T1012

      Peripheral Device Discovery

      2
      T1120

      System Information Discovery

      5
      T1082

      Lateral Movement

      Collection

      Data from Local System

      1
      T1005

      Exfiltration

      Command and Control

      Web Service

      1
      T1102

      Impact

      Inhibit System Recovery

      3
      T1490

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Users\Admin\AppData\Local\Microsoft\Office\16.0\WebServiceCache\AllUsers\officeclient.microsoft.com\7C0DD390-A82C-4DA9-8D4C-A25D3F1BDD63
        MD5

        ac86bad8c7cdf97559d3570da5016664

        SHA1

        dc4e3871f9932c3fd676c5a4a1a76188c2b1126b

        SHA256

        783319dc7e9bd47ad5e82bf609bb56b3f3ed4d225fa6c6d6562ea30280890490

        SHA512

        bac74b8bce7d45c29afc4858a93eb6065283e12e164036233f9a083dee04d46f4bd8d6529eace47fb129c011c799015ac6411449faf57211b858b2ad0cb1d2a9

        Download Submit
      • C:\Users\Admin\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules.xml
        MD5

        807f6904dece69c1a2a1115f1a5f5645

        SHA1

        5a16c41f90f804be23b244fbcef969356b3b56e0

        SHA256

        86e9db5b7c0417260b40a3c69339f0932afb3bcbcb53a13db728048e91d11e6e

        SHA512

        4ea35c824e617edfe8d34d2236b3dc7e9ef12ceca9503d763213b5dd52b19a7c0a91587ecafe8a7bc02a8833c6cb1f5dadf48a9fb41301d2b7b7e4a25452bec7

        Download Submit
      • C:\Users\Admin\AppData\Local\Microsoft\Office\OTele\excel.exe.db
        MD5

        7b3fcacbe6f684e77e37008472c873d6

        SHA1

        0985b5bd819de936928361992d9f475b4b52d116

        SHA256

        cb8c95d2823e7dcad01b743c4cb977201e5aa2a068ce6c4803a0b0043b0cae76

        SHA512

        5386070e1c8fa7615c118c17b2c9de5fcc63303335bc6963b34ee6fab392484545f18860abeb8122432369287d730a8ea0dc6f56cb6b47c7e89af39f19a16ee5

        Download Submit
      • C:\Users\Admin\AppData\Local\Microsoft\Office\OTele\excel.exe.db-wal
        MD5

        1b68d531e237e92c8533c7315078f496

        SHA1

        42da423a43618667ecda9407e4593982f654a09a

        SHA256

        38de45714e94c3584ce75f0eaed6472b4e92ec157a185609a9966c95930151f8

        SHA512

        6dfc9fbf0f0556778fea23e2e009624dd362256628e22653dbfdad5c5ecbef621ea1da4fe76d1ae0f230e16d2045269aad322f93e1928fb34e095022524acd7e

        Download Submit
      • C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\cversions.3.db
        MD5

        ba5ea2a2900a9634cc74f8b7c8ecd959

        SHA1

        c209140f406b21e4fe67dd418365fe8944160deb

        SHA256

        fbac95c49939c92629133f8dc361e360b62047c21b6d049c606b92559367457c

        SHA512

        c6996f97d1348efd5bbc8a531b21e3f9685a52469cfd46e4e429f60f88ce7ac58dfbf1860838261fc8791885228676e9ad832a207fe8c47d0aa5db93da22f2f2

        Download Submit
      • C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\{3DA71D5A-20CC-432F-A115-DFE92379E91F}.3.ver0x000000000000001d.db.[1C98C4F5].[makopransom@outlook.com].makop
        MD5

        b3e3ec1ac02ef73e8ca09f2549721b95

        SHA1

        b180f0f5eccaf140431f9eade364b6e9d8a7d33c

        SHA256

        afed76f6c8de035eac3defb4627448d0b782ab031252a4cc46220bf060ba6ee4

        SHA512

        a7e4677f0c47215ada05f904da11f997aa228703d37b9db7f0dc7cfca21514acb957d23c0ceafc7ac4b0390299c0adc9c94faa566f56137d5b5e095a8e7f251c

        Download Submit
      • C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\{3DA71D5A-20CC-432F-A115-DFE92379E91F}.3.ver0x000000000000001e.db
        MD5

        ebcf310b25de8984c4cdf945c7848889

        SHA1

        98963e066cf28c18aac713871cb95e54a3ec6c71

        SHA256

        0cd433b0075a4e3285bdd184c3686647ca8dc9dc006f4869f0d0d5cdee2a73df

        SHA512

        acda3cc327a84559177a10964dde1295b2a330a280ca6d4d1716ba7b45c83a7ad16e69f51d72fe94b485127d663e8d16c73aad92906444cb579e338dc6b944e6

        Download Submit
      • C:\Users\Admin\AppData\Local\Microsoft\Windows\PRICache\4032412167\2690874625.pri
        MD5

        d4768595c747f6923c92724f6c46d8d0

        SHA1

        a71df0353457621ef794c472e176bc44c9e8345a

        SHA256

        50be96de17b3a35b21e919770036b8caf4e2a5811d587f54db9da02baf2dc8e3

        SHA512

        3dcb1ed7bb92736f3f38975d21a4209331c1f9f0e2b9158731ca885407aa17634880fea2a02246acdbde93b814b77ade1c617c2b8118fa19a16c6444437ec187

        Download Submit
      • C:\Users\Admin\AppData\Local\Packages\microsoft.windows.cortana_cw5n1h2txyewy\AC\Microsoft\Windows\1601268389\3068621934.pri
        MD5

        fba8be708969567b482e70d163eff30f

        SHA1

        1ec5dea44e8367459a32fd5858125caf071cc3dc

        SHA256

        a7f9a4bfce1c3bc530db06ed1606ba15d09f7dfd99fdf691620b60797acac455

        SHA512

        34377d606fd72d8165c70b5d653f72f70c12cb04d607bd698ec7cae0ded654e804fccd379645b839925a2e52978afe91dbae19994abce782a5bdc86fa3c08292

        Download Submit
      • C:\Users\Admin\AppData\Local\Temp\WER6DF.tmp.appcompat.txt
        MD5

        2279d0ac67e8a4efa1182f44770ec170

        SHA1

        ebda8154960dce76c2b608c6eb35701345b96416

        SHA256

        f1cfb01d15071ebe46fa364105a34be3466fc4c3dbf3005a442cc4bc1cf42c62

        SHA512

        3005b6fe44e1784f7ff891df9441a9332eb264a4076c57537b33fc6690909b03c2d11bc5687b2fc72f94bd9b938b65425895bdc4f8e7480dea59488cc48622cf

        Download Submit
      • C:\Users\Admin\AppData\Local\Temp\a60b587f-b361-4a97-94d7-db1f02712717\1713683155.pri
        MD5

        25d6f880c0ed0e044dd2ccd773f694cd

        SHA1

        89053c28600e88413188fd721ea7101a42b05082

        SHA256

        d2e78b24ef2195f43c47b82e5c0623b2464dc0dc69ef50a5abc8365110999806

        SHA512

        eff68668ae0794fb2750ecab50a2c0f459dc81f8234766e31fd9467702a7f75ff84ca001b8892bb3f37da86df1b9b99e8b5cb0a9d012dcfc8610b5da4e274c19

        Download Submit
      • C:\Users\Admin\AppData\Local\Temp\e940d2c5-1c34-4316-81f4-8985a48c2123\1713683155.pri
        MD5

        1cbb2014fea6e26e89f31f331767c81e

        SHA1

        ddb3983560c815b80321e61b68c410f0bdd2f4bd

        SHA256

        5818c0098e58bf7b6dbe4c2535213e50b39c5356df1142bf5718a8e59ebd5798

        SHA512

        cf2e04ef30e32764dcf711966c7bb96f1d8a249449964d6e2c48e18d14760072da69e28b2e678fca878a7dd8edcbec0d587f3a2b20c85239b404b9657070d536

        Download Submit
      • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Themes\CachedFiles\CachedImage_1280_720_POS4.jpg.[1C98C4F5].[makopransom@outlook.com].makop
        MD5

        0a17ff5de8e08d174ed55a91c737bd18

        SHA1

        6dd4851dfddb88565ca652cc3e9bf5d2268af2ac

        SHA256

        ebfbd8b1291532d79b5a61c899c73fef661bd0a353195faa5807bcf25265f611

        SHA512

        8bc2ca259d639e19558dae87abd46865c6e018564619d11641ee59b3fe6d181da12ce0841fec898242ff57e81daa97d70c54916afcd74dc4c8911550f8816f97

        Download Submit
      • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Themes\CachedFiles\readme-warning.txt
        MD5

        fedc6e4006fbfceb0967ddf88f1ad348

        SHA1

        4d94294e5c2918e410502ebd6cf71e0b4dbdd6e6

        SHA256

        f5ffb8388a3b741156957f0b7e45321ed41a847880e44b4a9eac28a60001517a

        SHA512

        640fbb4be0b2aa88a295980c92f1d802ce4e39fdb40393370b21606c3517620e64ebb62dd5ee2e8c694935d6e89e5224d510752a621a748c654b75f509b93a6a

        Download Submit
      • C:\Users\Admin\Desktop\readme-warning.txt
        MD5

        fedc6e4006fbfceb0967ddf88f1ad348

        SHA1

        4d94294e5c2918e410502ebd6cf71e0b4dbdd6e6

        SHA256

        f5ffb8388a3b741156957f0b7e45321ed41a847880e44b4a9eac28a60001517a

        SHA512

        640fbb4be0b2aa88a295980c92f1d802ce4e39fdb40393370b21606c3517620e64ebb62dd5ee2e8c694935d6e89e5224d510752a621a748c654b75f509b93a6a

        Download Submit
      • C:\Users\All Users\Microsoft\Windows\WER\Temp\WER1C0B.tmp.mdmp
        MD5

        0e2ec3070e0954270e9b4b2939aed4c3

        SHA1

        c51047d323fcd636070ddaba9720141891b293c1

        SHA256

        eb743323750acdc9737851fdb9a04b7a6a65a585d36c90d0d6d3d7d2de315ff2

        SHA512

        bdb21db79cc13393d9332b40856ccc19e6217cd86b4907c0b6409eb4e433116abf9324b064d6e7a5802305685d2b92247dbf71a3a95756cb1e55085bf00bdf47

        Download Submit
      • C:\Users\All Users\Microsoft\Windows\WER\Temp\WER1F57.tmp.WERInternalMetadata.xml
        MD5

        4bca455fae58254ec6019001ca5e9491

        SHA1

        52ec8a1acd472a0702644408c3e9280826b8c91f

        SHA256

        05ce7790839c2bbb703d880f8fde30a889f15006ff160224e9351e09897fc956

        SHA512

        d8c1fd8825f729d0976cb58a783deddb73b1379888073010caa385f8c26f679f7000e8a0b7f3b26b42a188712b4a000bef856e23f59b54ee86c6ebf09afbc6ea

        Download Submit
      • C:\Users\All Users\Microsoft\Windows\WER\Temp\WER5E3.tmp.WERInternalMetadata.xml
        MD5

        fe718700537b6e6f3a4eae7275bf0675

        SHA1

        84fca99d513607e85ba181ee461597a862b3f4c5

        SHA256

        246ab4fdca88189bc16c61cc6bcbc5486c69fa135f899dc9fffc5b77d5938002

        SHA512

        37894d1bae5bcf118641fa6a419d6c6d1ae43083b938de59cea9e4a4c69431c49ef208a12fcac1e3c0a3e35d8acc612f690cb0de37b153173266374e80d9b53b

        Download Submit
      • memory/632-261-0x0000000000000000-mapping.dmp
        Download
      • memory/668-258-0x0000000000000000-mapping.dmp
        Download
      • memory/1876-122-0x000001992FF20000-0x000001992FF22000-memory.dmp
        Filesize

        8KB

        Download
      • memory/1876-115-0x00007FFD20840000-0x00007FFD20850000-memory.dmp
        Filesize

        64KB

        Download
      • memory/1876-121-0x00007FFD20840000-0x00007FFD20850000-memory.dmp
        Filesize

        64KB

        Download
      • memory/1876-120-0x000001992FF20000-0x000001992FF22000-memory.dmp
        Filesize

        8KB

        Download
      • memory/1876-119-0x000001992FF20000-0x000001992FF22000-memory.dmp
        Filesize

        8KB

        Download
      • memory/1876-118-0x00007FFD20840000-0x00007FFD20850000-memory.dmp
        Filesize

        64KB

        Download
      • memory/1876-117-0x00007FFD20840000-0x00007FFD20850000-memory.dmp
        Filesize

        64KB

        Download
      • memory/1876-116-0x00007FFD20840000-0x00007FFD20850000-memory.dmp
        Filesize

        64KB

        Download
      • memory/2384-259-0x0000000000000000-mapping.dmp
        Download
      • memory/3344-274-0x0000000000000000-mapping.dmp
        Download
      • memory/3888-260-0x0000000000000000-mapping.dmp
        Download