makop | 5235da476ce257081ccf375da5b9217025bfb151efd8b3522853719cac84d1af | Triage

Sharing

General

Target

5235da476ce257081ccf375da5b9217025bfb151efd8b3522853719cac84d1af
Size

30KB
Sample

221107-wpfaqsddhl
MD5

e4c10fca8733b5e03025c3ebd265a9ae
SHA1

68a5abe32d67b337b0398a39960ce2f54ea29441
SHA256

5235da476ce257081ccf375da5b9217025bfb151efd8b3522853719cac84d1af
SHA512

f1950d0474bba8e053996a1b7c43fac44d738ad3321f6b37dbd4c333b3b8c560625e2efe44a4f72d359fedb87973c10b487bc9b7f4572e51218989f7e07b41ac
SSDEEP

768:VpuBNtX5EUX7WuP3yCwYJ1wl+o9UGgis0YE6DAeYBzxuv:gDvyoMlpdiJAe8zW

Score

10^/10

makop evasion persistence ransomware

Malware Config

Targets

- Target
  
  5235da476ce257081ccf375da5b9217025bfb151efd8b3522853719cac84d1af
- Size
  
  30KB
- MD5
  
  e4c10fca8733b5e03025c3ebd265a9ae
- SHA1
  
  68a5abe32d67b337b0398a39960ce2f54ea29441
- SHA256
  
  5235da476ce257081ccf375da5b9217025bfb151efd8b3522853719cac84d1af
- SHA512
  
  f1950d0474bba8e053996a1b7c43fac44d738ad3321f6b37dbd4c333b3b8c560625e2efe44a4f72d359fedb87973c10b487bc9b7f4572e51218989f7e07b41ac
- SSDEEP
  
  768:VpuBNtX5EUX7WuP3yCwYJ1wl+o9UGgis0YE6DAeYBzxuv:gDvyoMlpdiJAe8zW
Score

10^/10

persistence evasion ransomware
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Deletes shadow copies
  Ransomware often targets backup files to inhibit system recovery.
  ransomware
- Modifies boot configuration data using bcdedit
  ransomware evasion
- Deletes backup catalog
  Uses wbadmin.exe to inhibit system recovery.
  ransomware
- Adds Run key to start application
  persistence
- Drops desktop.ini file(s)
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Command-Line Interface

Persistence

Registry Run Keys / Startup Folder

Privilege Escalation

Defense Evasion

File Deletion

Modify Registry

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Inhibit System Recovery

Tasks

static1

behavioral1

behavioral2

evasionpersistenceransomware