makop | 0bb22d8cf087f9652841cf885e524f38c21c132a1920cad07b2ebf48012920af

Analysis

max time kernel
147s
max time network
45s
platform
windows7_x64
resource
win7-20220414-en
submitted
27/04/2022, 09:30

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1.exe
Size

1.0MB
MD5

342a196528cc22163fa6a9bd7640c221
SHA1

d8e9e8908a9f3be4bbd8fe169d420dcb523e6b4c
SHA256

94b9665b40a2b36d6ff46ffd083bbf1c6d6c08de9fe24eb6dfb0199bd17f84b4
SHA512

f3b2363664153b3ddcb060edfa44263de7f68f0c4febccc13b8e690aa751ed8edf096a40a08ee33ffe04748b360e4240805c1623ef8987861a33fea042e006e4

Score

10^/10

makop ransomware

Malware Config

Extracted

Path

C:\Users\Admin\AppData\Local\Temp\3374973704\readme-warning.txt

Family

makop

Ransom Note

::: Greetings ::: Little FAQ: .1. Q: Whats Happen? A: Your files have been encrypted and now have the "noctua" extension. The file structure was not damaged, we did everything possible so that this could not happen. .2. Q: How to recover files? A: If you wish to decrypt your files you will need to pay in bitcoins. .3. Q: What about guarantees? A: Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will cooperate with us. Its not in our interests. To check the ability of returning files, you can send to us any 2 files with SIMPLE extensions(jpg,xls,doc, etc... not databases!) and low sizes(max 1 mb), we will decrypt them and send back to you. That is our guarantee. .4. Q: How to contact with you? A: You can write us to our mailbox: [email protected] or [email protected] .5. Q: How will the decryption process proceed after payment? A: After payment we will send to you our scanner-decoder program and detailed instructions for use. With this program you will be able to decrypt all your encrypted files. .6. Q: If I don�t want to pay bad people like you? A: If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause only we have the private key. In practice - time is much more valuable than money. :::BEWARE::: DON'T try to change encrypted files by yourself! If you will try to use any third party software for restoring your data or antivirus solutions - please make a backup for all encrypted files! Any changes in encrypted files may entail damage of the private key and, as result, the loss all data.

Emails

[email protected]

Signatures

Makop
Ransomware family discovered by @VK_Intel in early 2020.
ransomware makop
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware

File Deletion
T1107

Inhibit System Recovery
T1490

Deletes backup catalog 3 TTPs 1 IoCs

Uses wbadmin.exe to inhibit system recovery.

ransomware

Command-Line Interface

T1059

File Deletion

T1107

Inhibit System Recovery

T1490

pid	Process
1700	wbadmin.exe

Loads dropped DLL 2 IoCs

pid	Process
1740	1.exe
1176	1.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1740 set thread context of 956	1740	1.exe	28

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\readme-warning.txt	1.exe
File opened for modification	C:\Program Files\Microsoft Games\Multiplayer\Spades\de-DE\shvlzm.exe.mui	1.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\MinionPro-Bold.otf	1.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\AG00167_.GIF	1.exe
File opened for modification	C:\Program Files\Common Files\System\msadc\en-US\msdaprsr.dll.mui	1.exe
File opened for modification	C:\Program Files\Common Files\System\Ole DB\ja-JP\oledb32r.dll.mui	1.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.ui.di_1.0.0.v20140328-2112.jar	1.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.directorywatcher.nl_ja_4.4.0.v20140623020002.jar	1.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.transport.ecf.nl_ja_4.4.0.v20140623020002.jar	1.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-progress-ui_zh_CN.jar	1.exe
File opened for modification	C:\Program Files\Windows Photo Viewer\it-IT\PhotoViewer.dll.mui	1.exe
File opened for modification	C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Notes_INTRO_BG_PAL.wmv	1.exe
File opened for modification	C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Pets_btn-back-over-select.png	1.exe
File opened for modification	C:\Program Files\DVD Maker\Shared\DvdStyles\SpecialOccasion\scenesscroll.png	1.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\images\Other-48.png	1.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\de-DE\js\highDpiImageSwap.js	1.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\notConnectedStateIcon.png	1.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\Providers\Proximity\11.00\usa03.hsp.[F3356450].[[email protected]].noctua	1.exe
File opened for modification	C:\Program Files\Common Files\System\msadc\ja-JP\msaddsr.dll.mui	1.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\db\bin\stopNetworkServer	1.exe
File opened for modification	C:\Program Files\Java\jre7\lib\fonts\LucidaBrightDemiBold.ttf	1.exe
File opened for modification	C:\Program Files\Windows Journal\ja-JP\jnwmon.dll.mui	1.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\logo.png	1.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Icons\FDFFile_8.ico.[F3356450].[[email protected]].noctua	1.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\Providers\Proximity\11.00\eng.hyp.[F3356450].[[email protected]].noctua	1.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\FD02088_.WMF	1.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Pacific\Funafuti	1.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.browser.jdp.ja_5.5.0.165303.jar	1.exe
File opened for modification	C:\Program Files\Windows Defender\de-DE\MpEvMsg.dll.mui	1.exe
File opened for modification	C:\Program Files (x86)\Common Files\System\Ole DB\it-IT\sqlxmlx.rll.mui	1.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\AN04332_.WMF	1.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-autoupdate-ui_ja.jar	1.exe
File opened for modification	C:\Program Files\Java\jre7\lib\psfont.properties.ja	1.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\intf\modules\httprequests.luac	1.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\hwruksh.dat	1.exe
File created	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins3d\prc\readme-warning.txt	1.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\Stationery\OrangeCircles.jpg	1.exe
File opened for modification	C:\Program Files\Windows Sidebar\it-IT\sbdrop.dll.mui	1.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\email_all.gif	1.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\BLENDS\PREVIEW.GIF	1.exe
File created	C:\Program Files (x86)\Common Files\microsoft shared\TRANSLAT\ESEN\readme-warning.txt	1.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-core-ui.xml	1.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\sv\LC_MESSAGES\vlc.mo	1.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\images\bNext-disable.png	1.exe
File opened for modification	C:\Program Files\SearchMove.potm	1.exe
File opened for modification	C:\Program Files\Windows Media Player\it-IT\WMPDMC.exe.mui	1.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\turnOnNotificationInTray.gif	1.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\SLATE\SLATE.INF	1.exe
File opened for modification	C:\Program Files\DVD Maker\Shared\DvdStyles\Push\NavigationLeft_ButtonGraphic.png	1.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\lib\deploy\messages_zh_TW.properties	1.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-heapdump_zh_CN.jar	1.exe
File opened for modification	C:\Program Files\Java\jre7\lib\zi\Etc\GMT-8	1.exe
File opened for modification	C:\Program Files\Java\jre7\lib\zi\Europe\Belgrade	1.exe
File opened for modification	C:\Program Files\Microsoft Games\Multiplayer\Backgammon\en-US\bckgRes.dll.mui	1.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\images\item_hover_flyout.png	1.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Multimedia\MPP\Real.mpp	1.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\ko-KR\tipresx.dll.mui	1.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\Stationery\grid_(cm).wmf	1.exe
File opened for modification	C:\Program Files\Java\jre7\lib\zi\America\El_Salvador	1.exe
File created	C:\Program Files (x86)\Adobe\Reader 9.0\Resource\readme-warning.txt	1.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\DD01163_.WMF	1.exe
File opened for modification	C:\Program Files\Java\jre7\lib\zi\Europe\Berlin	1.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Publisher.en-us\SETUP.XML	1.exe
File opened for modification	C:\Program Files (x86)\Common Files\System\ja-JP\wab32res.dll.mui	1.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Program crash 2 IoCs

pid	pid_target	Process	procid_target
2036	1740	WerFault.exe	27
1372	1176	WerFault.exe	30

Interacts with shadow copies 2 TTPs 1 IoCs

Shadow copies are often targeted by ransomware to inhibit system recovery.

ransomware

File Deletion

T1107

Inhibit System Recovery

T1490

pid	Process
528	vssadmin.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
956	1.exe

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
1740	1.exe

Suspicious use of AdjustPrivilegeToken 46 IoCs

description	pid	Process
Token: SeBackupPrivilege	1208	vssvc.exe
Token: SeRestorePrivilege	1208	vssvc.exe
Token: SeAuditPrivilege	1208	vssvc.exe
Token: SeBackupPrivilege	1364	wbengine.exe
Token: SeRestorePrivilege	1364	wbengine.exe
Token: SeSecurityPrivilege	1364	wbengine.exe
Token: SeIncreaseQuotaPrivilege	240	WMIC.exe
Token: SeSecurityPrivilege	240	WMIC.exe
Token: SeTakeOwnershipPrivilege	240	WMIC.exe
Token: SeLoadDriverPrivilege	240	WMIC.exe
Token: SeSystemProfilePrivilege	240	WMIC.exe
Token: SeSystemtimePrivilege	240	WMIC.exe
Token: SeProfSingleProcessPrivilege	240	WMIC.exe
Token: SeIncBasePriorityPrivilege	240	WMIC.exe
Token: SeCreatePagefilePrivilege	240	WMIC.exe
Token: SeBackupPrivilege	240	WMIC.exe
Token: SeRestorePrivilege	240	WMIC.exe
Token: SeShutdownPrivilege	240	WMIC.exe
Token: SeDebugPrivilege	240	WMIC.exe
Token: SeSystemEnvironmentPrivilege	240	WMIC.exe
Token: SeRemoteShutdownPrivilege	240	WMIC.exe
Token: SeUndockPrivilege	240	WMIC.exe
Token: SeManageVolumePrivilege	240	WMIC.exe
Token: 33	240	WMIC.exe
Token: 34	240	WMIC.exe
Token: 35	240	WMIC.exe
Token: SeIncreaseQuotaPrivilege	240	WMIC.exe
Token: SeSecurityPrivilege	240	WMIC.exe
Token: SeTakeOwnershipPrivilege	240	WMIC.exe
Token: SeLoadDriverPrivilege	240	WMIC.exe
Token: SeSystemProfilePrivilege	240	WMIC.exe
Token: SeSystemtimePrivilege	240	WMIC.exe
Token: SeProfSingleProcessPrivilege	240	WMIC.exe
Token: SeIncBasePriorityPrivilege	240	WMIC.exe
Token: SeCreatePagefilePrivilege	240	WMIC.exe
Token: SeBackupPrivilege	240	WMIC.exe
Token: SeRestorePrivilege	240	WMIC.exe
Token: SeShutdownPrivilege	240	WMIC.exe
Token: SeDebugPrivilege	240	WMIC.exe
Token: SeSystemEnvironmentPrivilege	240	WMIC.exe
Token: SeRemoteShutdownPrivilege	240	WMIC.exe
Token: SeUndockPrivilege	240	WMIC.exe
Token: SeManageVolumePrivilege	240	WMIC.exe
Token: 33	240	WMIC.exe
Token: 34	240	WMIC.exe
Token: 35	240	WMIC.exe

Suspicious use of WriteProcessMemory 32 IoCs

description	pid	Process	procid_target
PID 1740 wrote to memory of 956	1740	1.exe	28
PID 1740 wrote to memory of 956	1740	1.exe	28
PID 1740 wrote to memory of 956	1740	1.exe	28
PID 1740 wrote to memory of 956	1740	1.exe	28
PID 1740 wrote to memory of 956	1740	1.exe	28
PID 1740 wrote to memory of 956	1740	1.exe	28
PID 1740 wrote to memory of 956	1740	1.exe	28
PID 1740 wrote to memory of 956	1740	1.exe	28
PID 1740 wrote to memory of 956	1740	1.exe	28
PID 1740 wrote to memory of 956	1740	1.exe	28
PID 1740 wrote to memory of 956	1740	1.exe	28
PID 1740 wrote to memory of 2036	1740	1.exe	29
PID 1740 wrote to memory of 2036	1740	1.exe	29
PID 1740 wrote to memory of 2036	1740	1.exe	29
PID 1740 wrote to memory of 2036	1740	1.exe	29
PID 956 wrote to memory of 1980	956	1.exe	31
PID 956 wrote to memory of 1980	956	1.exe	31
PID 956 wrote to memory of 1980	956	1.exe	31
PID 956 wrote to memory of 1980	956	1.exe	31
PID 1980 wrote to memory of 528	1980	cmd.exe	33
PID 1980 wrote to memory of 528	1980	cmd.exe	33
PID 1980 wrote to memory of 528	1980	cmd.exe	33
PID 1980 wrote to memory of 1700	1980	cmd.exe	36
PID 1980 wrote to memory of 1700	1980	cmd.exe	36
PID 1980 wrote to memory of 1700	1980	cmd.exe	36
PID 1980 wrote to memory of 240	1980	cmd.exe	40
PID 1980 wrote to memory of 240	1980	cmd.exe	40
PID 1980 wrote to memory of 240	1980	cmd.exe	40
PID 1176 wrote to memory of 1372	1176	1.exe	42
PID 1176 wrote to memory of 1372	1176	1.exe	42
PID 1176 wrote to memory of 1372	1176	1.exe	42
PID 1176 wrote to memory of 1372	1176	1.exe	42

C:\Users\Admin\AppData\Local\Temp\1.exe
"C:\Users\Admin\AppData\Local\Temp\1.exe"
1⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1740
- C:\Users\Admin\AppData\Local\Temp\1.exe
  ﮅ
  2⤵
  - Drops file in Program Files directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:956
- - C:\Users\Admin\AppData\Local\Temp\1.exe
    "C:\Users\Admin\AppData\Local\Temp\1.exe" n956
    3⤵
    - Loads dropped DLL
    - Suspicious use of WriteProcessMemory
    PID:1176
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1176 -s 392
      4⤵
      Program crash
      PID:1372
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1980
  - - C:\Windows\system32\vssadmin.exe
      vssadmin delete shadows /all /quiet
      4⤵
      Interacts with shadow copies
      PID:528
  - - C:\Windows\system32\wbadmin.exe
      wbadmin delete catalog -quiet
      4⤵
      Deletes backup catalog
      PID:1700
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic shadowcopy delete
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:240
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1740 -s 480
  2⤵
  - Program crash
  PID:2036

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1208

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1364

C:\Windows\System32\vdsldr.exe
C:\Windows\System32\vdsldr.exe -Embedding
1⤵
PID:980

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
PID:1736

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Command-Line Interface

T1059

Persistence

Privilege Escalation

Defense Evasion

File Deletion

T1107

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Inhibit System Recovery

T1490

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\134245471

Filesize
256.7MB

MD5
9ccad7b4b1f71bb08b4286bbdb5874d8

SHA1
c3fcb6aa1729ccd76fd1e150b0a34d81c2f1d017

SHA256
5c38c89ecae449d4689804ac0ebc06edc57bbacf362e7ba8fbfc2cda557cdbab

SHA512
50a6e9fd8d6cb137a939f708130e432aa4cbcf0217f7ada8c3a7e93d8cf8c150efaeae1d30419ef20ed6ca31df99b39c2e453b9e5de48fcf05461779be8f03a6

Download Submit
C:\Users\Admin\AppData\Local\Temp\134245471

Filesize
305.0MB

MD5
026ee8de15880586852638e4a81fb251

SHA1
527ee12c2cb7dbf7f3226c6d5d42b692613a0f96

SHA256
044a04c0e0198ddeb9a5a3e4a5d324ba8ec6aee772c86edaa4f5e0bdcd211528

SHA512
96b41ae9244836e4e227e7e080a8f2bd1e1bb0c2a5a41f7d10b38bca2bd89fceee493c2268c0783c1bd4b9308b770e1e5878827b1230d562e85852851ea9bc97

Download Submit
\Users\Admin\AppData\Local\Temp\nst2934.tmp\System.dll

Filesize
12KB

MD5
cff85c549d536f651d4fb8387f1976f2

SHA1
d41ce3a5ff609df9cf5c7e207d3b59bf8a48530e

SHA256
8dc562cda7217a3a52db898243de3e2ed68b80e62ddcb8619545ed0b4e7f65a8

SHA512
531d6328daf3b86d85556016d299798fa06fefc81604185108a342d000e203094c8c12226a12bd6e1f89b0db501fb66f827b610d460b933bd4ab936ac2fd8a88

Download Submit
\Users\Admin\AppData\Local\Temp\nsy55DF.tmp\System.dll

Filesize
12KB

MD5
cff85c549d536f651d4fb8387f1976f2

SHA1
d41ce3a5ff609df9cf5c7e207d3b59bf8a48530e

SHA256
8dc562cda7217a3a52db898243de3e2ed68b80e62ddcb8619545ed0b4e7f65a8

SHA512
531d6328daf3b86d85556016d299798fa06fefc81604185108a342d000e203094c8c12226a12bd6e1f89b0db501fb66f827b610d460b933bd4ab936ac2fd8a88

Download Submit
memory/956-56-0x0000000000401000-0x0000000000407600-memory.dmp

Filesize
25KB

Download
memory/956-58-0x0000000000408000-0x0000000000409000-memory.dmp

Filesize
4KB

Download
memory/1700-66-0x000007FEFC1F1000-0x000007FEFC1F3000-memory.dmp

Filesize
8KB

Download
memory/1740-54-0x00000000761F1000-0x00000000761F3000-memory.dmp

Filesize
8KB

Download