Overview

overview

10

Static

static

1

686b5240e5...5f.exe

windows7_x64

10

686b5240e5...5f.exe

windows10-2004_x64

10

Analysis

  • max time kernel
    173s
  • max time network
    243s
  • platform
    windows7_x64
  • resource
    win7-20220414-en
  • submitted
    12-05-2022 16:03

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    686b5240e5e503528cc5ac8d764883413a260716dd290f114a60af873ee6a65f.exe

  • Size

    322KB

  • MD5

    a3f4d926dd9e36327ff2e467a0a930bb

  • SHA1

    08e865fb1cf421ce39a378221b4b452c868e6f18

  • SHA256

    686b5240e5e503528cc5ac8d764883413a260716dd290f114a60af873ee6a65f

  • SHA512

    016a361a6e74a144811c6d0a022a98987a142c88c974ae6c32f1bb510308cf6f549351e0dc08bcafd99d6270c8627898d5b960e9572cf9be6e5e70ad1e2e1532

Score
10/10
makoppersistenceransomware

Malware Config

Extracted

Path

C:\Users\Admin\AppData\Local\Temp\readme-warning.txt

Family

makop

Ransom Note
::: Greetings ::: Little FAQ: .1. Q: Whats Happen? A: Your files have been encrypted and now have the "makop" extension. The file structure was not damaged, we did everything possible so that this could not happen. .2. Q: How to recover files? A: If you wish to decrypt your files you will need to pay in bitcoins. .3. Q: What about guarantees? A: Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will cooperate with us. Its not in our interests. To check the ability of returning files, you can send to us any 2 files with SIMPLE extensions(jpg,xls,doc, etc... not databases!) and low sizes(max 1 mb), we will decrypt them and send back to you. That is our guarantee. .4. Q: How to contact with you? A: You can write us to our mailbox: [email protected] or [email protected] or [email protected] .5. Q: How will the decryption process proceed after payment? A: After payment we will send to you our scanner-decoder program and detailed instructions for use. With this program you will be able to decrypt all your encrypted files. .6. Q: If I don�t want to pay bad people like you? A: If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause only we have the private key. In practice - time is much more valuable than money. :::BEWARE::: DON'T try to change encrypted files by yourself! If you will try to use any third party software for restoring your data or antivirus solutions - please make a backup for all encrypted files! Any changes in encrypted files may entail damage of the private key and, as result, the loss all data.

Signatures

  • Makop

    Ransomware family discovered by @VK_Intel in early 2020.

    ransomwaremakop
  • Deletes shadow copies 2 TTPs

    Ransomware often targets backup files to inhibit system recovery.

    ransomware
  • Deletes backup catalog 3 TTPs 1 IoCs

    Uses wbadmin.exe to inhibit system recovery.

    ransomware
  • Loads dropped DLL 2 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Suspicious use of SetThreadContext 2 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Interacts with shadow copies 2 TTPs 1 IoCs

    Shadow copies are often targeted by ransomware to inhibit system recovery.

    ransomware
  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious behavior: MapViewOfSection 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 46 IoCs
  • Suspicious use of WriteProcessMemory 33 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\686b5240e5e503528cc5ac8d764883413a260716dd290f114a60af873ee6a65f.exe
    "C:\Users\Admin\AppData\Local\Temp\686b5240e5e503528cc5ac8d764883413a260716dd290f114a60af873ee6a65f.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of SetThreadContext
    • Suspicious behavior: MapViewOfSection
    • Suspicious use of WriteProcessMemory
    PID:1348
    • C:\Users\Admin\AppData\Local\Temp\686b5240e5e503528cc5ac8d764883413a260716dd290f114a60af873ee6a65f.exe
      "C:\Users\Admin\AppData\Local\Temp\686b5240e5e503528cc5ac8d764883413a260716dd290f114a60af873ee6a65f.exe"
      2⤵
      • Adds Run key to start application
      • Drops file in Program Files directory
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:1168
      • C:\Windows\system32\cmd.exe
        "C:\Windows\system32\cmd.exe"
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:2028
        • C:\Windows\system32\vssadmin.exe
          vssadmin delete shadows /all /quiet
          4⤵
          • Interacts with shadow copies
          PID:988
        • C:\Windows\system32\wbadmin.exe
          wbadmin delete catalog -quiet
          4⤵
          • Deletes backup catalog
          PID:1488
        • C:\Windows\System32\Wbem\WMIC.exe
          wmic shadowcopy delete
          4⤵
          • Suspicious use of AdjustPrivilegeToken
          PID:916
      • C:\Users\Admin\AppData\Local\Temp\686b5240e5e503528cc5ac8d764883413a260716dd290f114a60af873ee6a65f.exe
        "C:\Users\Admin\AppData\Local\Temp\686b5240e5e503528cc5ac8d764883413a260716dd290f114a60af873ee6a65f.exe" n1168
        3⤵
        • Loads dropped DLL
        • Suspicious use of SetThreadContext
        • Suspicious behavior: MapViewOfSection
        • Suspicious use of WriteProcessMemory
        PID:2032
        • C:\Users\Admin\AppData\Local\Temp\686b5240e5e503528cc5ac8d764883413a260716dd290f114a60af873ee6a65f.exe
          "C:\Users\Admin\AppData\Local\Temp\686b5240e5e503528cc5ac8d764883413a260716dd290f114a60af873ee6a65f.exe" n1168
          4⤵
            PID:1320
    • C:\Windows\system32\vssvc.exe
      C:\Windows\system32\vssvc.exe
      1⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:656
    • C:\Windows\system32\wbengine.exe
      "C:\Windows\system32\wbengine.exe"
      1⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:1460
    • C:\Windows\System32\vdsldr.exe
      C:\Windows\System32\vdsldr.exe -Embedding
      1⤵
        PID:620
      • C:\Windows\System32\vds.exe
        C:\Windows\System32\vds.exe
        1⤵
          PID:1816

        Network

        MITRE ATT&CK Enterprise v6

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\Local\Temp\610352966
          Filesize

          57KB

          MD5

          7db4f37a385ed9db6da048c4206acb75

          SHA1

          a1ea31f83abe9ac2c48cbaebb13a19a25b970783

          SHA256

          e2be0b459604bca5999fe28ddaf4847418bf099a2ceac139e9b9f081d7b9ab15

          SHA512

          6f4f13b1d8bc0fe7a72ff01b9404422b4c8ef74d7ce9be8cb0c41f17d7f11edbe2ae52a252aa35492553ec43350dd943bb2e9206b9e77f964aba9f3946fded4c

          Download Submit

        • C:\Users\Admin\AppData\Local\Temp\610352966
          Filesize

          57KB

          MD5

          02b7ba666c167f861ed4fae68f855d89

          SHA1

          e7a515ed19e2b2e768f03d57248e7a8ab7a2b64a

          SHA256

          88752a801d053f2631794dfa1aa739ce35b7ec904665833cfdee97209f4691ce

          SHA512

          041c95a680240c769fda9669968eda0bb356865f2607746d85318e2fde5bdbd02c39f51f4119ee52b644e96544c85ef95a5fa56c5594efeefea2367e25d04132

          Download Submit

        • \Users\Admin\AppData\Local\Temp\nseF93F.tmp\System.dll
          Filesize

          11KB

          MD5

          fccff8cb7a1067e23fd2e2b63971a8e1

          SHA1

          30e2a9e137c1223a78a0f7b0bf96a1c361976d91

          SHA256

          6fcea34c8666b06368379c6c402b5321202c11b00889401c743fb96c516c679e

          SHA512

          f4335e84e6f8d70e462a22f1c93d2998673a7616c868177cac3e8784a3be1d7d0bb96f2583fa0ed82f4f2b6b8f5d9b33521c279a42e055d80a94b4f3f1791e0c

          Download Submit

        • \Users\Admin\AppData\Local\Temp\nszC67C.tmp\System.dll
          Filesize

          11KB

          MD5

          fccff8cb7a1067e23fd2e2b63971a8e1

          SHA1

          30e2a9e137c1223a78a0f7b0bf96a1c361976d91

          SHA256

          6fcea34c8666b06368379c6c402b5321202c11b00889401c743fb96c516c679e

          SHA512

          f4335e84e6f8d70e462a22f1c93d2998673a7616c868177cac3e8784a3be1d7d0bb96f2583fa0ed82f4f2b6b8f5d9b33521c279a42e055d80a94b4f3f1791e0c

          Download Submit

        • memory/1168-56-0x0000000000401000-0x0000000000407A00-memory.dmp

          Filesize

          26KB

          Download

        • memory/1168-59-0x0000000000408000-0x0000000000409000-memory.dmp

          Filesize

          4KB

          Download

        • memory/1348-54-0x0000000075BF1000-0x0000000075BF3000-memory.dmp

          Filesize

          8KB

          Download

        • memory/1488-66-0x000007FEFC521000-0x000007FEFC523000-memory.dmp

          Filesize

          8KB

          Download