Overview

overview

10

Static

static

1

SecuriteIn...09.exe

windows7-x64

10

SecuriteIn...09.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    75s
  • max time network
    124s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20221111-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
  • submitted
    17-11-2022 22:41

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    SecuriteInfo.com.FileRepMalware.13968.19609.exe

  • Size

    847KB

  • MD5

    586d6732d8c8d4045b05276f2a0cbf53

  • SHA1

    e58187c1708079e9487310f8c4b34722e4271f35

  • SHA256

    ad534790700a9daa5fda6452692590e5e8c86d6a86aec0110822d0b54a6c21d9

  • SHA512

    edfb4e63b497793678977aad364e5c85919981fe9a93d74d64b4339b3596fd44d8c8b943d0b3bfcc95689e9476ea86fdff0822fd7de77870ef6430176b97792b

  • SSDEEP

    24576:NmSo/l/4X2EM3GdNsFiKZqzYvqi/NmZrRV/tJ:NcaXNM2PBKZAsAZrRVVJ

Score
10/10
makopransomwarespywarestealer

Malware Config

Extracted

Path

C:\Users\Admin\AppData\Local\Temp\readme-warning.txt

Family

makop

Ransom Note
::: Greetings ::: Little FAQ: .1. Q: Whats Happen? A: Your files have been encrypted and now have the "gamigin" extension. The file structure was not damaged, we did everything possible so that this could not happen. .2. Q: How to recover files? A: If you wish to decrypt your files you will need to pay in bitcoins. .3. Q: What about guarantees? A: Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will cooperate with us. Its not in our interests. To check the ability of returning files, you can send to us any 2 files with SIMPLE extensions(jpg,xls,doc, etc... not databases!) and low sizes(max 1 mb), we will decrypt them and send back to you. That is our guarantee. .4. Q: How to contact with you? A: You can write us to our mailbox: gamigin0612@tutanota.com or mammon0503@protonmail.com or pecunia0318@goat.si .5. Q: How will the decryption process proceed after payment? A: After payment we will send to you our scanner-decoder program and detailed instructions for use. With this program you will be able to decrypt all your encrypted files. .6. Q: If I don�t want to pay bad people like you? A: If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause only we have the private key. In practice - time is much more valuable than money. :::BEWARE::: DON'T try to change encrypted files by yourself! If you will try to use any third party software for restoring your data or antivirus solutions - please make a backup for all encrypted files! Any changes in encrypted files may entail damage of the private key and, as result, the loss all data.
Emails

gamigin0612@tutanota.com

mammon0503@protonmail.com

pecunia0318@goat.si

Signatures

  • Makop

    Ransomware family discovered by @VK_Intel in early 2020.

    ransomwaremakop
  • Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs
  • Deletes shadow copies 2 TTPs

    Ransomware often targets backup files to inhibit system recovery.

    ransomware
  • Deletes backup catalog 3 TTPs 1 IoCs

    Uses wbadmin.exe to inhibit system recovery.

    ransomware
  • Modifies extensions of user files 1 IoCs

    Ransomware generally changes the extension on encrypted files.

    ransomware
  • Loads dropped DLL 2 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs
  • Suspicious use of SetThreadContext 2 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Checks SCSI registry key(s) 3 TTPs 4 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Interacts with shadow copies 2 TTPs 1 IoCs

    Shadow copies are often targeted by ransomware to inhibit system recovery.

    ransomware
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious behavior: MapViewOfSection 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 50 IoCs
  • Suspicious use of WriteProcessMemory 23 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.FileRepMalware.13968.19609.exe
    "C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.FileRepMalware.13968.19609.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of SetThreadContext
    • Suspicious behavior: MapViewOfSection
    • Suspicious use of WriteProcessMemory
    PID:1652
    • C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.FileRepMalware.13968.19609.exe
      "C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.FileRepMalware.13968.19609.exe"
      2⤵
      • Modifies extensions of user files
      • Drops file in Program Files directory
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:2520
      • C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.FileRepMalware.13968.19609.exe
        "C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.FileRepMalware.13968.19609.exe" n2520
        3⤵
        • Loads dropped DLL
        • Suspicious use of SetThreadContext
        • Suspicious behavior: MapViewOfSection
        • Suspicious use of WriteProcessMemory
        PID:4320
        • C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.FileRepMalware.13968.19609.exe
          "C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.FileRepMalware.13968.19609.exe" n2520
          4⤵
            PID:4124
        • C:\Windows\system32\cmd.exe
          "C:\Windows\system32\cmd.exe"
          3⤵
          • Suspicious use of WriteProcessMemory
          PID:2484
          • C:\Windows\system32\vssadmin.exe
            vssadmin delete shadows /all /quiet
            4⤵
            • Interacts with shadow copies
            PID:4676
          • C:\Windows\system32\wbadmin.exe
            wbadmin delete catalog -quiet
            4⤵
            • Deletes backup catalog
            PID:5000
          • C:\Windows\System32\Wbem\WMIC.exe
            wmic shadowcopy delete
            4⤵
            • Suspicious use of AdjustPrivilegeToken
            PID:3004
    • C:\Windows\system32\svchost.exe
      C:\Windows\system32\svchost.exe -k netsvcs -p -s seclogon
      1⤵
      • Suspicious use of NtCreateUserProcessOtherParentProcess
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:1984
    • C:\Windows\system32\vssvc.exe
      C:\Windows\system32\vssvc.exe
      1⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:4684
    • C:\Windows\system32\wbengine.exe
      "C:\Windows\system32\wbengine.exe"
      1⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:3720
    • C:\Windows\System32\vdsldr.exe
      C:\Windows\System32\vdsldr.exe -Embedding
      1⤵
        PID:1844
      • C:\Windows\System32\vds.exe
        C:\Windows\System32\vds.exe
        1⤵
        • Checks SCSI registry key(s)
        PID:4528

      Network

      MITRE ATT&CK Matrix ATT&CK v6

      Initial Access

      Execution

      Command-Line Interface

      1
      T1059

      Persistence

      Privilege Escalation

      Defense Evasion

      File Deletion

      3
      T1107

      Credential Access

      Credentials in Files

      1
      T1081

      Discovery

      System Information Discovery

      2
      T1082

      Query Registry

      1
      T1012

      Peripheral Device Discovery

      1
      T1120

      Lateral Movement

      Collection

      Data from Local System

      1
      T1005

      Exfiltration

      Command and Control

      Web Service

      1
      T1102

      Impact

      Inhibit System Recovery

      3
      T1490

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Users\Admin\AppData\Local\Temp\nsu92FF.tmp\System.dll
        Filesize

        11KB

        MD5

        fccff8cb7a1067e23fd2e2b63971a8e1

        SHA1

        30e2a9e137c1223a78a0f7b0bf96a1c361976d91

        SHA256

        6fcea34c8666b06368379c6c402b5321202c11b00889401c743fb96c516c679e

        SHA512

        f4335e84e6f8d70e462a22f1c93d2998673a7616c868177cac3e8784a3be1d7d0bb96f2583fa0ed82f4f2b6b8f5d9b33521c279a42e055d80a94b4f3f1791e0c

        Download Submit
      • C:\Users\Admin\AppData\Local\Temp\nswA5CB.tmp\System.dll
        Filesize

        11KB

        MD5

        fccff8cb7a1067e23fd2e2b63971a8e1

        SHA1

        30e2a9e137c1223a78a0f7b0bf96a1c361976d91

        SHA256

        6fcea34c8666b06368379c6c402b5321202c11b00889401c743fb96c516c679e

        SHA512

        f4335e84e6f8d70e462a22f1c93d2998673a7616c868177cac3e8784a3be1d7d0bb96f2583fa0ed82f4f2b6b8f5d9b33521c279a42e055d80a94b4f3f1791e0c

        Download Submit
      • C:\Users\Admin\AppData\Roaming\681096313
        Filesize

        645KB

        MD5

        470cc9935c68fd64655ccb51d5d0d731

        SHA1

        cba611dbd1f784c0bffa64720181327004b23653

        SHA256

        fcc3cf71d0be88e485e9c3e19adc64438b038562643aac3e52aa98e82280d8b6

        SHA512

        f363c352bc41d81fcbb1095b0e0c784fcf23053f70156d5495db065871d99df87ce1dac40a0d5740fdac5608f538c6647d1e8053ae3bd6152c618e18665e2ee6

        Download Submit
      • C:\Users\Admin\AppData\Roaming\681096313
        Filesize

        645KB

        MD5

        d6c55165b2117cd08ee9d4829c3b857f

        SHA1

        5db7e15b64cf20fe2c43dad41d13ad5e0ed570e3

        SHA256

        c8f8036d1db337efaf66f9af941f7cbf96f1b16256d084da86dea8331b8de8e5

        SHA512

        c58f5a5db2b8c28ccd7a5bd5fe5fc5a27db0c9b5312d5d6dbaecf249faef32033f530453a8ea980a303343beef5c420bdde7fbd4d8b025a6afe3dae751c86f3a

        Download Submit
      • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\zsadsadsad\dsffffffdd.lnk
        Filesize

        1KB

        MD5

        035d01e548d773c433db177a68b09953

        SHA1

        858215adb678548a2cf9d35a6c76de2ff6b32fb1

        SHA256

        48e11127b61cbcc2aa956d5b5681a93102f2e239a270fe6f565fe45cf83f60d3

        SHA512

        10394658e0c546f3fcb2ce6a66710be89d113a0382178708e41c70e71c122843442431a4b563c08f70f477518f6b59c3f36442742ab093f7facc859254811744

        Download Submit
      • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\zsadsadsad\dsffffffdd.lnk
        Filesize

        1KB

        MD5

        dd212d80dd914293cedd0944e5b0294e

        SHA1

        fe34027a45e366db40d192d6e44f9408520857be

        SHA256

        86e8b974af2062f42fad69b3ae29a6cea38fa04888c341fd34e2ca1bb06b7268

        SHA512

        74740d77efc68790a8e5db85ff6fc42ca8ff3302ada11e7d26c2381d506d4019c7ec9c4752445d5b7a339d43c222919ef15872fcdcba0873a478af1adf1d82de

        Download Submit
      • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\zsadsadsad\qasdadsdsd.lnk
        Filesize

        1KB

        MD5

        23b76e5eb59a7e4d562574e10a102af9

        SHA1

        4e476bed66be05d606455fb5f2d9b1753ace2ac9

        SHA256

        dc6e15e48e9ff76752d82f385c2962b5235405a9987f8dfeed180b60251bc366

        SHA512

        691f263d4899ec48791a4c803684c9a1e00c09db7eacd8ada96c9966bec9bebb1532f3abc83d6d2203cef1879befdc7b8329e68d6030a9fb80bc1cb9c8e51491

        Download Submit
      • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\zsadsadsad\qasdadsdsd.lnk
        Filesize

        1KB

        MD5

        bc98df82a577d30b2d8a73287510afd5

        SHA1

        35a0bda51b3946a53d46ad6e91f16694b5849c8c

        SHA256

        d5670b945ffa88905cc651f4f5378c261e6184aec051c1d8137b88ac3c63fe8c

        SHA512

        7dd32f378caa3f37d924d481efe125dfb4eacac660f7f04ae6b076404f45a56838986a7276f8f9ae98348d57accddc3fe00ceeddab3c4f1420a6253f30c05d31

        Download Submit
      • memory/2484-136-0x0000000000000000-mapping.dmp
        Download
      • memory/2520-146-0x0000000000400000-0x000000000041E000-memory.dmp
        Filesize

        120KB

        Download
      • memory/2520-151-0x0000000000400000-0x000000000041E000-memory.dmp
        Filesize

        120KB

        Download
      • memory/2520-134-0x0000000000400000-0x000000000041E000-memory.dmp
        Filesize

        120KB

        Download
      • memory/2520-133-0x0000000000000000-mapping.dmp
        Download
      • memory/3004-143-0x0000000000000000-mapping.dmp
        Download
      • memory/4124-147-0x0000000000400000-0x000000000041E000-memory.dmp
        Filesize

        120KB

        Download
      • memory/4124-145-0x0000000000400000-0x000000000041E000-memory.dmp
        Filesize

        120KB

        Download
      • memory/4124-144-0x0000000000000000-mapping.dmp
        Download
      • memory/4320-135-0x0000000000000000-mapping.dmp
        Download
      • memory/4676-141-0x0000000000000000-mapping.dmp
        Download
      • memory/5000-142-0x0000000000000000-mapping.dmp
        Download