Overview

overview

10

Static

static

10

aa0073548e...da.exe

windows7-x64

9

aa0073548e...da.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    aa0073548e845d1119186ba77368adfd81dbe0d056ec1f258e83a7dd368972da

  • Size

    42KB

  • Sample

    221018-kcyqrsfba5

  • MD5

    485a9199578ab6219dce9435d4289071

  • SHA1

    ab5431ec64d80fcf12f327200954a367f6466623

  • SHA256

    aa0073548e845d1119186ba77368adfd81dbe0d056ec1f258e83a7dd368972da

  • SHA512

    a7e78ce53fb008372f4878593b05b11ab6e48c2a3cde9f0266457688832ee5dae673b9f336f81d313665c04907615bd8468dfa3a95ff7dcb43187ca12a9e4dba

  • SSDEEP

    768:vO1oR/rVS1RzK4wbs+D/SIJX+ZZ1SQQwZxMPPzDf4rOcWNJLoYg:v5S1FKnDtkxMfjNJ8

Score
10/10
makopransomware

Malware Config

Targets

    • Target

      aa0073548e845d1119186ba77368adfd81dbe0d056ec1f258e83a7dd368972da

    • Size

      42KB

    • MD5

      485a9199578ab6219dce9435d4289071

    • SHA1

      ab5431ec64d80fcf12f327200954a367f6466623

    • SHA256

      aa0073548e845d1119186ba77368adfd81dbe0d056ec1f258e83a7dd368972da

    • SHA512

      a7e78ce53fb008372f4878593b05b11ab6e48c2a3cde9f0266457688832ee5dae673b9f336f81d313665c04907615bd8468dfa3a95ff7dcb43187ca12a9e4dba

    • SSDEEP

      768:vO1oR/rVS1RzK4wbs+D/SIJX+ZZ1SQQwZxMPPzDf4rOcWNJLoYg:v5S1FKnDtkxMfjNJ8

    Score
    10/10
    ransomware

    • Suspicious use of NtCreateUserProcessOtherParentProcess

    • Deletes shadow copies

      Ransomware often targets backup files to inhibit system recovery.

      ransomware

    • Deletes backup catalog

      Uses wbadmin.exe to inhibit system recovery.

      ransomware

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks