Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

10

6a845a5bbf...0a.exe

windows7-x64

10

6a845a5bbf...0a.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    166s
  • max time network
    138s
  • platform
    windows7_x64
  • resource
    win7-20220812-en
  • resource tags

    arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
  • submitted
    07/11/2022, 18:05 UTC

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    6a845a5bbfabda4d9a5153444718b0426c9a2cf7f23f9ee87cae34d2c594400a.exe

  • Size

    36KB

  • MD5

    f2ee5fac443bc271ea8dffc4759ad104

  • SHA1

    2e0b54d11a13b114cfd203b1679e251482b67794

  • SHA256

    6a845a5bbfabda4d9a5153444718b0426c9a2cf7f23f9ee87cae34d2c594400a

  • SHA512

    4528b0eb86ae1e0b116496fa69fe1901a199a20a8524de60d798717bb7e5caaddc59163a06bf5a7e40455f9f6bf6ef6adbe87ddb9d1022cbafa3c1e908fc9834

  • SSDEEP

    768:G9GEnDiAZ6vc4y1xP7jIFpaEuiXLiP6AluDAKCfIQJpxHN:GJnDiAOy1tjVfP6ZArg4pdN

Score
10/10
makoppersistenceransomware

Malware Config

Extracted

Path

C:\Users\Admin\AppData\Local\Temp\readme-warning.txt

Family

makop

Ransom Note
::: Greetings ::: Little FAQ: .1. Q: Whats Happen? A: Your files have been encrypted and now have the "makop" extension. The file structure was not damaged, we did everything possible so that this could not happen. .2. Q: How to recover files? A: If you wish to decrypt your files you will need to pay in bitcoins. .3. Q: What about guarantees? A: Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will cooperate with us. Its not in our interests. To check the ability of returning files, you can send to us any 2 files with SIMPLE extensions(jpg,xls,doc, etc... not databases!) and low sizes(max 1 mb), we will decrypt them and send back to you. That is our guarantee. .4. Q: How to contact with you? A: You can write us to our mailbox: mozgpitona@outlook.com .5. Q: How will the decryption process proceed after payment? A: After payment we will send to you our scanner-decoder program and detailed instructions for use. With this program you will be able to decrypt all your encrypted files. .6. Q: If I don�t want to pay bad people like you? A: If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause only we have the private key. In practice - time is much more valuable than money. :::BEWARE::: DON'T try to change encrypted files by yourself! If you will try to use any third party software for restoring your data or antivirus solutions - please make a backup for all encrypted files! Any changes in encrypted files may entail damage of the private key and, as result, the loss all data.
Emails

mozgpitona@outlook.com

Signatures

  • Makop

    Ransomware family discovered by @VK_Intel in early 2020.

    ransomwaremakop
  • Deletes shadow copies 2 TTPs

    Ransomware often targets backup files to inhibit system recovery.

    ransomware
  • Deletes backup catalog 3 TTPs 1 IoCs

    Uses wbadmin.exe to inhibit system recovery.

    ransomware
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Drops file in Program Files directory 64 IoCs
  • Interacts with shadow copies 2 TTPs 1 IoCs

    Shadow copies are often targeted by ransomware to inhibit system recovery.

    ransomware
  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 46 IoCs
  • Suspicious use of WriteProcessMemory 13 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\6a845a5bbfabda4d9a5153444718b0426c9a2cf7f23f9ee87cae34d2c594400a.exe
    "C:\Users\Admin\AppData\Local\Temp\6a845a5bbfabda4d9a5153444718b0426c9a2cf7f23f9ee87cae34d2c594400a.exe"
    1⤵
    • Adds Run key to start application
    • Drops file in Program Files directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:1960
    • C:\Users\Admin\AppData\Local\Temp\6a845a5bbfabda4d9a5153444718b0426c9a2cf7f23f9ee87cae34d2c594400a.exe
      "C:\Users\Admin\AppData\Local\Temp\6a845a5bbfabda4d9a5153444718b0426c9a2cf7f23f9ee87cae34d2c594400a.exe" n1960
      2⤵
        PID:1784
      • C:\Windows\system32\cmd.exe
        "C:\Windows\system32\cmd.exe"
        2⤵
        • Suspicious use of WriteProcessMemory
        PID:1200
        • C:\Windows\system32\vssadmin.exe
          vssadmin delete shadows /all /quiet
          3⤵
          • Interacts with shadow copies
          PID:2008
        • C:\Windows\system32\wbadmin.exe
          wbadmin delete catalog -quiet
          3⤵
          • Deletes backup catalog
          PID:1692
        • C:\Windows\System32\Wbem\WMIC.exe
          wmic shadowcopy delete
          3⤵
          • Suspicious use of AdjustPrivilegeToken
          PID:1500
    • C:\Windows\system32\vssvc.exe
      C:\Windows\system32\vssvc.exe
      1⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:2020
    • C:\Windows\system32\wbengine.exe
      "C:\Windows\system32\wbengine.exe"
      1⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:1180
    • C:\Windows\System32\vdsldr.exe
      C:\Windows\System32\vdsldr.exe -Embedding
      1⤵
        PID:1752
      • C:\Windows\System32\vds.exe
        C:\Windows\System32\vds.exe
        1⤵
          PID:2000

        Network

          No results found
        • 34.117.59.81:443
          46 B
           40 B
           1
          1
        No results found

        MITRE ATT&CK Enterprise v6

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • memory/1692-59-0x000007FEFBD01000-0x000007FEFBD03000-memory.dmp

          Filesize

          8KB

          Download

        • memory/1960-54-0x0000000076321000-0x0000000076323000-memory.dmp

          Filesize

          8KB

          Download

        We care about your privacy.

        This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.